diff --git a/README.md b/README.md
index 14add86124b..76c5b4d46ec 100644
--- a/README.md
+++ b/README.md
@@ -1,613 +1,12 @@
-<!--lint disable no-literal-urls-->
-<p align="center">
-  <a href="https://nodejs.org/">
-    <img
-      alt="Node.js"
-      src="https://nodejs.org/static/images/logo-light.svg"
-      width="400"
-    />
-  </a>
-</p>
+This is an automatically updated **experimental**
+version of [Node.js](https://github.com/nodejs/node)
+with the lkgr (last known good revision) of V8.
 
-Node.js is an open-source, cross-platform, JavaScript runtime environment. It
-executes JavaScript code outside of a browser. For more information on using
-Node.js, see the [Node.js Website][].
+The daily builds of this repo can be found at
+[`v8-canary`](https://nodejs.org/download/v8-canary/).
+**Do not use this in production!**
 
-The Node.js project uses an [open governance model](./GOVERNANCE.md). The
-[OpenJS Foundation][] provides support for the project.
+This repository is not owned by `@nodejs/v8`, but they might be able to
+help with issues.
 
-**This project is bound by a [Code of Conduct][].**
-
-# Table of Contents
-
-* [Support](#support)
-* [Release Types](#release-types)
-  * [Download](#download)
-    * [Current and LTS Releases](#current-and-lts-releases)
-    * [Nightly Releases](#nightly-releases)
-    * [API Documentation](#api-documentation)
-  * [Verifying Binaries](#verifying-binaries)
-* [Building Node.js](#building-nodejs)
-* [Security](#security)
-* [Contributing to Node.js](#contributing-to-nodejs)
-* [Current Project Team Members](#current-project-team-members)
-  * [TSC (Technical Steering Committee)](#tsc-technical-steering-committee)
-  * [Collaborators](#collaborators)
-  * [Release Keys](#release-keys)
-
-## Support
-
-Looking for help? Check out the
-[instructions for getting support](.github/SUPPORT.md).
-
-## Release Types
-
-* **Current**: Under active development. Code for the Current release is in the
-  branch for its major version number (for example,
-  [v10.x](https://github.com/nodejs/node/tree/v10.x)). Node.js releases a new
-  major version every 6 months, allowing for breaking changes. This happens in
-  April and October every year. Releases appearing each October have a support
-  life of 8 months. Releases appearing each April convert to LTS (see below)
-  each October.
-* **LTS**: Releases that receive Long-term Support, with a focus on stability
-  and security. Every even-numbered major version will become an LTS release.
-  LTS releases receive 12 months of _Active LTS_ support and a further 18 months
-  of _Maintenance_. LTS release lines have alphabetically-ordered codenames,
-  beginning with v4 Argon. There are no breaking changes or feature additions,
-  except in some special circumstances.
-* **Nightly**: Code from the Current branch built every 24-hours when there are
-  changes. Use with caution.
-
-Current and LTS releases follow [Semantic Versioning](https://semver.org). A
-member of the Release Team [signs](#release-keys) each Current and LTS release.
-For more information, see the
-[Release README](https://github.com/nodejs/Release#readme).
-
-### Download
-
-Binaries, installers, and source tarballs are available at
-<https://nodejs.org/en/download/>.
-
-#### Current and LTS Releases
-<https://nodejs.org/download/release/>
-
-The [latest](https://nodejs.org/download/release/latest/) directory is an
-alias for the latest Current release. The latest-_codename_ directory is an
-alias for the latest release from an LTS line. For example, the
-[latest-carbon](https://nodejs.org/download/release/latest-carbon/) directory
-contains the latest Carbon (Node.js 8) release.
-
-#### Nightly Releases
-<https://nodejs.org/download/nightly/>
-
-Each directory name and filename contains a date (in UTC) and the commit
-SHA at the HEAD of the release.
-
-#### API Documentation
-
-Documentation for the latest Current release is at <https://nodejs.org/api/>.
-Version-specific documentation is available in each release directory in the
-_docs_ subdirectory. Version-specific documentation is also at
-<https://nodejs.org/download/docs/>.
-
-### Verifying Binaries
-
-Download directories contain a `SHASUMS256.txt` file with SHA checksums for the
-files.
-
-To download `SHASUMS256.txt` using `curl`:
-
-```console
-$ curl -O https://nodejs.org/dist/vx.y.z/SHASUMS256.txt
-```
-
-To check that a downloaded file matches the checksum, run
-it through `sha256sum` with a command such as:
-
-```console
-$ grep node-vx.y.z.tar.gz SHASUMS256.txt | sha256sum -c -
-```
-
-For Current and LTS, the GPG detached signature of `SHASUMS256.txt` is in
-`SHASUMS256.txt.sig`. You can use it with `gpg` to verify the integrity of
-`SHASUM256.txt`. You will first need to import
-[the GPG keys of individuals authorized to create releases](#release-keys). To
-import the keys:
-
-```console
-$ gpg --keyserver pool.sks-keyservers.net --recv-keys DD8F2338BAE7501E3DD5AC78C273792F7D83545D
-```
-
-See the bottom of this README for a full script to import active release keys.
-
-Next, download the `SHASUMS256.txt.sig` for the release:
-
-```console
-$ curl -O https://nodejs.org/dist/vx.y.z/SHASUMS256.txt.sig
-```
-
-Then use `gpg --verify SHASUMS256.txt.sig SHASUMS256.txt` to verify
-the file's signature.
-
-## Building Node.js
-
-See [BUILDING.md](BUILDING.md) for instructions on how to build Node.js from
-source and a list of supported platforms.
-
-## Security
-
-For information on reporting security vulnerabilities in Node.js, see
-[SECURITY.md](./SECURITY.md).
-
-## Contributing to Node.js
-
-* [Contributing to the project][]
-* [Working Groups][]
-* [Strategic Initiatives][]
-
-## Current Project Team Members
-
-For information about the governance of the Node.js project, see
-[GOVERNANCE.md](./GOVERNANCE.md).
-
-### TSC (Technical Steering Committee)
-
-* [addaleax](https://github.com/addaleax) -
-**Anna Henningsen** &lt;anna@addaleax.net&gt; (she/her)
-* [apapirovski](https://github.com/apapirovski) -
-**Anatoli Papirovski** &lt;apapirovski@mac.com&gt; (he/him)
-* [BethGriggs](https://github.com/BethGriggs) -
-**Beth Griggs** &lt;Bethany.Griggs@uk.ibm.com&gt; (she/her)
-* [BridgeAR](https://github.com/BridgeAR) -
-**Ruben Bridgewater** &lt;ruben@bridgewater.de&gt; (he/him)
-* [ChALkeR](https://github.com/ChALkeR) -
-**Сковорода Никита Андреевич** &lt;chalkerx@gmail.com&gt; (he/him)
-* [cjihrig](https://github.com/cjihrig) -
-**Colin Ihrig** &lt;cjihrig@gmail.com&gt; (he/him)
-* [codebytere](https://github.com/codebytere) -
-**Shelley Vohr** &lt;codebytere@gmail.com&gt; (she/her)
-* [danbev](https://github.com/danbev) -
-**Daniel Bevenius** &lt;daniel.bevenius@gmail.com&gt; (he/him)
-* [fhinkel](https://github.com/fhinkel) -
-**Franziska Hinkelmann** &lt;franziska.hinkelmann@gmail.com&gt; (she/her)
-* [gabrielschulhof](https://github.com/gabrielschulhof) -
-**Gabriel Schulhof** &lt;gabriel.schulhof@intel.com&gt;
-* [gireeshpunathil](https://github.com/gireeshpunathil) -
-**Gireesh Punathil** &lt;gpunathi@in.ibm.com&gt; (he/him)
-* [jasnell](https://github.com/jasnell) -
-**James M Snell** &lt;jasnell@gmail.com&gt; (he/him)
-* [joyeecheung](https://github.com/joyeecheung) -
-**Joyee Cheung** &lt;joyeec9h3@gmail.com&gt; (she/her)
-* [mcollina](https://github.com/mcollina) -
-**Matteo Collina** &lt;matteo.collina@gmail.com&gt; (he/him)
-* [mhdawson](https://github.com/mhdawson) -
-**Michael Dawson** &lt;michael_dawson@ca.ibm.com&gt; (he/him)
-* [mmarchini](https://github.com/mmarchini) -
-**Matheus Marchini** &lt;mat@mmarchini.me&gt;
-* [MylesBorins](https://github.com/MylesBorins) -
-**Myles Borins** &lt;myles.borins@gmail.com&gt; (he/him)
-* [sam-github](https://github.com/sam-github) -
-**Sam Roberts** &lt;vieuxtech@gmail.com&gt;
-* [targos](https://github.com/targos) -
-**Michaël Zasso** &lt;targos@protonmail.com&gt; (he/him)
-* [tniessen](https://github.com/tniessen) -
-**Tobias Nießen** &lt;tniessen@tnie.de&gt;
-* [Trott](https://github.com/Trott) -
-**Rich Trott** &lt;rtrott@gmail.com&gt; (he/him)
-
-### TSC Emeriti
-
-* [bnoordhuis](https://github.com/bnoordhuis) -
-**Ben Noordhuis** &lt;info@bnoordhuis.nl&gt;
-* [chrisdickinson](https://github.com/chrisdickinson) -
-**Chris Dickinson** &lt;christopher.s.dickinson@gmail.com&gt;
-* [evanlucas](https://github.com/evanlucas) -
-**Evan Lucas** &lt;evanlucas@me.com&gt; (he/him)
-* [Fishrock123](https://github.com/Fishrock123) -
-**Jeremiah Senkpiel** &lt;fishrock123@rocketmail.com&gt; (he/they)
-* [gibfahn](https://github.com/gibfahn) -
-**Gibson Fahnestock** &lt;gibfahn@gmail.com&gt; (he/him)
-* [indutny](https://github.com/indutny) -
-**Fedor Indutny** &lt;fedor.indutny@gmail.com&gt;
-* [isaacs](https://github.com/isaacs) -
-**Isaac Z. Schlueter** &lt;i@izs.me&gt;
-* [joshgav](https://github.com/joshgav) -
-**Josh Gavant** &lt;josh.gavant@outlook.com&gt;
-* [mscdex](https://github.com/mscdex) -
-**Brian White** &lt;mscdex@mscdex.net&gt;
-* [nebrius](https://github.com/nebrius) -
-**Bryan Hughes** &lt;bryan@nebri.us&gt;
-* [ofrobots](https://github.com/ofrobots) -
-**Ali Ijaz Sheikh** &lt;ofrobots@google.com&gt; (he/him)
-* [orangemocha](https://github.com/orangemocha) -
-**Alexis Campailla** &lt;orangemocha@nodejs.org&gt;
-* [piscisaureus](https://github.com/piscisaureus) -
-**Bert Belder** &lt;bertbelder@gmail.com&gt;
-* [rvagg](https://github.com/rvagg) -
-**Rod Vagg** &lt;r@va.gg&gt;
-* [shigeki](https://github.com/shigeki) -
-**Shigeki Ohtsu** &lt;ohtsu@ohtsu.org&gt; (he/him)
-* [thefourtheye](https://github.com/thefourtheye) -
-**Sakthipriyan Vairamani** &lt;thechargingvolcano@gmail.com&gt; (he/him)
-* [TimothyGu](https://github.com/TimothyGu) -
-**Tiancheng "Timothy" Gu** &lt;timothygu99@gmail.com&gt; (he/him)
-* [trevnorris](https://github.com/trevnorris) -
-**Trevor Norris** &lt;trev.norris@gmail.com&gt;
-
-### Collaborators
-
-* [addaleax](https://github.com/addaleax) -
-**Anna Henningsen** &lt;anna@addaleax.net&gt; (she/her)
-* [ak239](https://github.com/ak239) -
-**Aleksei Koziatinskii** &lt;ak239spb@gmail.com&gt;
-* [AndreasMadsen](https://github.com/AndreasMadsen) -
-**Andreas Madsen** &lt;amwebdk@gmail.com&gt; (he/him)
-* [antsmartian](https://github.com/antsmartian) -
-**Anto Aravinth** &lt;anto.aravinth.cse@gmail.com&gt; (he/him)
-* [apapirovski](https://github.com/apapirovski) -
-**Anatoli Papirovski** &lt;apapirovski@mac.com&gt; (he/him)
-* [bcoe](https://github.com/bcoe) -
-**Ben Coe** &lt;bencoe@gmail.com&gt; (he/him)
-* [bengl](https://github.com/bengl) -
-**Bryan English** &lt;bryan@bryanenglish.com&gt; (he/him)
-* [benjamingr](https://github.com/benjamingr) -
-**Benjamin Gruenbaum** &lt;benjamingr@gmail.com&gt;
-* [BethGriggs](https://github.com/BethGriggs) -
-**Beth Griggs** &lt;Bethany.Griggs@uk.ibm.com&gt; (she/her)
-* [bmeck](https://github.com/bmeck) -
-**Bradley Farias** &lt;bradley.meck@gmail.com&gt;
-* [bmeurer](https://github.com/bmeurer) -
-**Benedikt Meurer** &lt;benedikt.meurer@gmail.com&gt;
-* [bnoordhuis](https://github.com/bnoordhuis) -
-**Ben Noordhuis** &lt;info@bnoordhuis.nl&gt;
-* [boneskull](https://github.com/boneskull) -
-**Christopher Hiller** &lt;boneskull@boneskull.com&gt; (he/him)
-* [BridgeAR](https://github.com/BridgeAR) -
-**Ruben Bridgewater** &lt;ruben@bridgewater.de&gt; (he/him)
-* [bzoz](https://github.com/bzoz) -
-**Bartosz Sosnowski** &lt;bartosz@janeasystems.com&gt;
-* [cclauss](https://github.com/cclauss) -
-**Christian Clauss** &lt;cclauss@me.com&gt; (he/him)
-* [ChALkeR](https://github.com/ChALkeR) -
-**Сковорода Никита Андреевич** &lt;chalkerx@gmail.com&gt; (he/him)
-* [cjihrig](https://github.com/cjihrig) -
-**Colin Ihrig** &lt;cjihrig@gmail.com&gt; (he/him)
-* [codebytere](https://github.com/codebytere) -
-**Shelley Vohr** &lt;codebytere@gmail.com&gt; (she/her)
-* [danbev](https://github.com/danbev) -
-**Daniel Bevenius** &lt;daniel.bevenius@gmail.com&gt; (he/him)
-* [davisjam](https://github.com/davisjam) -
-**Jamie Davis** &lt;davisjam@vt.edu&gt; (he/him)
-* [devnexen](https://github.com/devnexen) -
-**David Carlier** &lt;devnexen@gmail.com&gt;
-* [devsnek](https://github.com/devsnek) -
-**Gus Caplan** &lt;me@gus.host&gt; (he/him)
-* [digitalinfinity](https://github.com/digitalinfinity) -
-**Hitesh Kanwathirtha** &lt;digitalinfinity@gmail.com&gt; (he/him)
-* [edsadr](https://github.com/edsadr) -
-**Adrian Estrada** &lt;edsadr@gmail.com&gt; (he/him)
-* [eugeneo](https://github.com/eugeneo) -
-**Eugene Ostroukhov** &lt;eostroukhov@google.com&gt;
-* [evanlucas](https://github.com/evanlucas) -
-**Evan Lucas** &lt;evanlucas@me.com&gt; (he/him)
-* [fhinkel](https://github.com/fhinkel) -
-**Franziska Hinkelmann** &lt;franziska.hinkelmann@gmail.com&gt; (she/her)
-* [Fishrock123](https://github.com/Fishrock123) -
-**Jeremiah Senkpiel** &lt;fishrock123@rocketmail.com&gt;  (he/they)
-* [Flarna](https://github.com/Flarna) -
-**Gerhard Stöbich** &lt;deb2001-github@yahoo.de&gt;  (he/they)
-* [gabrielschulhof](https://github.com/gabrielschulhof) -
-**Gabriel Schulhof** &lt;gabriel.schulhof@intel.com&gt;
-* [gdams](https://github.com/gdams) -
-**George Adams** &lt;george.adams@uk.ibm.com&gt; (he/him)
-* [geek](https://github.com/geek) -
-**Wyatt Preul** &lt;wpreul@gmail.com&gt;
-* [gengjiawen](https://github.com/gengjiawen) -
-**Jiawen Geng** &lt;technicalcute@gmail.com&gt;
-* [GeoffreyBooth](https://github.com/geoffreybooth) -
-**Geoffrey Booth** &lt;webmaster@geoffreybooth.com&gt; (he/him)
-* [gibfahn](https://github.com/gibfahn) -
-**Gibson Fahnestock** &lt;gibfahn@gmail.com&gt; (he/him)
-* [gireeshpunathil](https://github.com/gireeshpunathil) -
-**Gireesh Punathil** &lt;gpunathi@in.ibm.com&gt; (he/him)
-* [guybedford](https://github.com/guybedford) -
-**Guy Bedford** &lt;guybedford@gmail.com&gt; (he/him)
-* [hashseed](https://github.com/hashseed) -
-**Yang Guo** &lt;yangguo@chromium.org&gt; (he/him)
-* [himself65](https://github.com/himself65) -
-**Zeyu Yang** &lt;himself65@outlook.com&gt; (he/him)
-* [hiroppy](https://github.com/hiroppy) -
-**Yuta Hiroto** &lt;hello@hiroppy.me&gt; (he/him)
-* [indutny](https://github.com/indutny) -
-**Fedor Indutny** &lt;fedor.indutny@gmail.com&gt;
-* [JacksonTian](https://github.com/JacksonTian) -
-**Jackson Tian** &lt;shyvo1987@gmail.com&gt;
-* [jasnell](https://github.com/jasnell) -
-**James M Snell** &lt;jasnell@gmail.com&gt; (he/him)
-* [jdalton](https://github.com/jdalton) -
-**John-David Dalton** &lt;john.david.dalton@gmail.com&gt;
-* [jkrems](https://github.com/jkrems) -
-**Jan Krems** &lt;jan.krems@gmail.com&gt; (he/him)
-* [joaocgreis](https://github.com/joaocgreis) -
-**João Reis** &lt;reis@janeasystems.com&gt;
-* [joyeecheung](https://github.com/joyeecheung) -
-**Joyee Cheung** &lt;joyeec9h3@gmail.com&gt; (she/her)
-* [juanarbol](https://github.com/juanarbol) -
-**Juan José Arboleda** &lt;soyjuanarbol@gmail.com&gt; (he/him)
-* [JungMinu](https://github.com/JungMinu) -
-**Minwoo Jung** &lt;nodecorelab@gmail.com&gt; (he/him)
-* [kfarnung](https://github.com/kfarnung) -
-**Kyle Farnung** &lt;kfarnung@microsoft.com&gt; (he/him)
-* [lance](https://github.com/lance) -
-**Lance Ball** &lt;lball@redhat.com&gt; (he/him)
-* [legendecas](https://github.com/legendecas) -
-**Chengzhong Wu** &lt;legendecas@gmail.com&gt; (he/him)
-* [Leko](https://github.com/Leko) -
-**Shingo Inoue** &lt;leko.noor@gmail.com&gt; (he/him)
-* [lpinca](https://github.com/lpinca) -
-**Luigi Pinca** &lt;luigipinca@gmail.com&gt; (he/him)
-* [lundibundi](https://github.com/lundibundi) -
-**Denys Otrishko** &lt;shishugi@gmail.com&gt; (he/him)
-* [mafintosh](https://github.com/mafintosh) -
-**Mathias Buus** &lt;mathiasbuus@gmail.com&gt; (he/him)
-* [mcollina](https://github.com/mcollina) -
-**Matteo Collina** &lt;matteo.collina@gmail.com&gt; (he/him)
-* [mhdawson](https://github.com/mhdawson) -
-**Michael Dawson** &lt;michael_dawson@ca.ibm.com&gt; (he/him)
-* [mildsunrise](https://github.com/mildsunrise) -
-**Alba Mendez** &lt;me@alba.sh&gt; (she/her)
-* [misterdjules](https://github.com/misterdjules) -
-**Julien Gilli** &lt;jgilli@nodejs.org&gt;
-* [mmarchini](https://github.com/mmarchini) -
-**Matheus Marchini** &lt;mat@mmarchini.me&gt;
-* [mscdex](https://github.com/mscdex) -
-**Brian White** &lt;mscdex@mscdex.net&gt;
-* [MylesBorins](https://github.com/MylesBorins) -
-**Myles Borins** &lt;myles.borins@gmail.com&gt; (he/him)
-* [ofrobots](https://github.com/ofrobots) -
-**Ali Ijaz Sheikh** &lt;ofrobots@google.com&gt; (he/him)
-* [oyyd](https://github.com/oyyd) -
-**Ouyang Yadong** &lt;oyydoibh@gmail.com&gt; (he/him)
-* [psmarshall](https://github.com/psmarshall) -
-**Peter Marshall** &lt;petermarshall@chromium.org&gt; (he/him)
-* [puzpuzpuz](https://github.com/puzpuzpuz) -
-**Andrey Pechkurov** &lt;apechkurov@gmail.com&gt; (he/him)
-* [Qard](https://github.com/Qard) -
-**Stephen Belanger** &lt;admin@stephenbelanger.com&gt; (he/him)
-* [refack](https://github.com/refack) -
-**Refael Ackermann (רפאל פלחי)** &lt;refack@gmail.com&gt; (he/him/הוא/אתה)
-* [richardlau](https://github.com/richardlau) -
-**Richard Lau** &lt;riclau@uk.ibm.com&gt;
-* [ronag](https://github.com/ronag) -
-**Robert Nagy** &lt;ronagy@icloud.com&gt;
-* [ronkorving](https://github.com/ronkorving) -
-**Ron Korving** &lt;ron@ronkorving.nl&gt;
-* [rubys](https://github.com/rubys) -
-**Sam Ruby** &lt;rubys@intertwingly.net&gt;
-* [rvagg](https://github.com/rvagg) -
-**Rod Vagg** &lt;rod@vagg.org&gt;
-* [ryzokuken](https://github.com/ryzokuken) -
-**Ujjwal Sharma** &lt;ryzokuken@disroot.org&gt; (he/him)
-* [saghul](https://github.com/saghul) -
-**Saúl Ibarra Corretgé** &lt;saghul@gmail.com&gt;
-* [sam-github](https://github.com/sam-github) -
-**Sam Roberts** &lt;vieuxtech@gmail.com&gt;
-* [santigimeno](https://github.com/santigimeno) -
-**Santiago Gimeno** &lt;santiago.gimeno@gmail.com&gt;
-* [sebdeckers](https://github.com/sebdeckers) -
-**Sebastiaan Deckers** &lt;sebdeckers83@gmail.com&gt;
-* [seishun](https://github.com/seishun) -
-**Nikolai Vavilov** &lt;vvnicholas@gmail.com&gt;
-* [shigeki](https://github.com/shigeki) -
-**Shigeki Ohtsu** &lt;ohtsu@ohtsu.org&gt; (he/him)
-* [shisama](https://github.com/shisama) -
-**Masashi Hirano** &lt;shisama07@gmail.com&gt; (he/him)
-* [silverwind](https://github.com/silverwind) -
-**Roman Reiss** &lt;me@silverwind.io&gt;
-* [srl295](https://github.com/srl295) -
-**Steven R Loomis** &lt;srloomis@us.ibm.com&gt;
-* [starkwang](https://github.com/starkwang) -
-**Weijia Wang** &lt;starkwang@126.com&gt;
-* [targos](https://github.com/targos) -
-**Michaël Zasso** &lt;targos@protonmail.com&gt; (he/him)
-* [thefourtheye](https://github.com/thefourtheye) -
-**Sakthipriyan Vairamani** &lt;thechargingvolcano@gmail.com&gt; (he/him)
-* [TimothyGu](https://github.com/TimothyGu) -
-**Tiancheng "Timothy" Gu** &lt;timothygu99@gmail.com&gt; (he/him)
-* [tniessen](https://github.com/tniessen) -
-**Tobias Nießen** &lt;tniessen@tnie.de&gt;
-* [trivikr](https://github.com/trivikr) -
-**Trivikram Kamat** &lt;trivikr.dev@gmail.com&gt;
-* [Trott](https://github.com/Trott) -
-**Rich Trott** &lt;rtrott@gmail.com&gt; (he/him)
-* [vdeturckheim](https://github.com/vdeturckheim) -
-**Vladimir de Turckheim** &lt;vlad2t@hotmail.com&gt; (he/him)
-* [watilde](https://github.com/watilde) -
-**Daijiro Wachi** &lt;daijiro.wachi@gmail.com&gt; (he/him)
-* [watson](https://github.com/watson) -
-**Thomas Watson** &lt;w@tson.dk&gt;
-* [XadillaX](https://github.com/XadillaX) -
-**Khaidi Chu** &lt;i@2333.moe&gt; (he/him)
-* [yhwang](https://github.com/yhwang) -
-**Yihong Wang** &lt;yh.wang@ibm.com&gt;
-* [yorkie](https://github.com/yorkie) -
-**Yorkie Liu** &lt;yorkiefixer@gmail.com&gt;
-* [yosuke-furukawa](https://github.com/yosuke-furukawa) -
-**Yosuke Furukawa** &lt;yosuke.furukawa@gmail.com&gt;
-* [ZYSzys](https://github.com/ZYSzys) -
-**Yongsheng Zhang** &lt;zyszys98@gmail.com&gt; (he/him)
-
-### Collaborator Emeriti
-
-* [andrasq](https://github.com/andrasq) -
-**Andras** &lt;andras@kinvey.com&gt;
-* [AnnaMag](https://github.com/AnnaMag) -
-**Anna M. Kedzierska** &lt;anna.m.kedzierska@gmail.com&gt;
-* [aqrln](https://github.com/aqrln) -
-**Alexey Orlenko** &lt;eaglexrlnk@gmail.com&gt; (he/him)
-* [brendanashworth](https://github.com/brendanashworth) -
-**Brendan Ashworth** &lt;brendan.ashworth@me.com&gt;
-* [calvinmetcalf](https://github.com/calvinmetcalf) -
-**Calvin Metcalf** &lt;calvin.metcalf@gmail.com&gt;
-* [chrisdickinson](https://github.com/chrisdickinson) -
-**Chris Dickinson** &lt;christopher.s.dickinson@gmail.com&gt;
-* [claudiorodriguez](https://github.com/claudiorodriguez) -
-**Claudio Rodriguez** &lt;cjrodr@yahoo.com&gt;
-* [DavidCai1993](https://github.com/DavidCai1993) -
-**David Cai** &lt;davidcai1993@yahoo.com&gt; (he/him)
-* [eljefedelrodeodeljefe](https://github.com/eljefedelrodeodeljefe) -
-**Robert Jefe Lindstaedt** &lt;robert.lindstaedt@gmail.com&gt;
-* [estliberitas](https://github.com/estliberitas) -
-**Alexander Makarenko** &lt;estliberitas@gmail.com&gt;
-* [firedfox](https://github.com/firedfox) -
-**Daniel Wang** &lt;wangyang0123@gmail.com&gt;
-* [glentiki](https://github.com/glentiki) -
-**Glen Keane** &lt;glenkeane.94@gmail.com&gt; (he/him)
-* [iarna](https://github.com/iarna) -
-**Rebecca Turner** &lt;me@re-becca.org&gt;
-* [imran-iq](https://github.com/imran-iq) -
-**Imran Iqbal** &lt;imran@imraniqbal.org&gt;
-* [imyller](https://github.com/imyller) -
-**Ilkka Myller** &lt;ilkka.myller@nodefield.com&gt;
-* [isaacs](https://github.com/isaacs) -
-**Isaac Z. Schlueter** &lt;i@izs.me&gt;
-* [italoacasas](https://github.com/italoacasas) -
-**Italo A. Casas** &lt;me@italoacasas.com&gt; (he/him)
-* [jasongin](https://github.com/jasongin) -
-**Jason Ginchereau** &lt;jasongin@microsoft.com&gt;
-* [jbergstroem](https://github.com/jbergstroem) -
-**Johan Bergström** &lt;bugs@bergstroem.nu&gt;
-* [jhamhader](https://github.com/jhamhader) -
-**Yuval Brik** &lt;yuval@brik.org.il&gt;
-* [joshgav](https://github.com/joshgav) -
-**Josh Gavant** &lt;josh.gavant@outlook.com&gt;
-* [julianduque](https://github.com/julianduque) -
-**Julian Duque** &lt;julianduquej@gmail.com&gt; (he/him)
-* [kunalspathak](https://github.com/kunalspathak) -
-**Kunal Pathak** &lt;kunal.pathak@microsoft.com&gt;
-* [lucamaraschi](https://github.com/lucamaraschi) -
-**Luca Maraschi** &lt;luca.maraschi@gmail.com&gt; (he/him)
-* [lxe](https://github.com/lxe) -
-**Aleksey Smolenchuk** &lt;lxe@lxe.co&gt;
-* [maclover7](https://github.com/maclover7) -
-**Jon Moss** &lt;me@jonathanmoss.me&gt; (he/him)
-* [matthewloring](https://github.com/matthewloring) -
-**Matthew Loring** &lt;mattloring@google.com&gt;
-* [micnic](https://github.com/micnic) -
-**Nicu Micleușanu** &lt;micnic90@gmail.com&gt; (he/him)
-* [mikeal](https://github.com/mikeal) -
-**Mikeal Rogers** &lt;mikeal.rogers@gmail.com&gt;
-* [monsanto](https://github.com/monsanto) -
-**Christopher Monsanto** &lt;chris@monsan.to&gt;
-* [MoonBall](https://github.com/MoonBall) -
-**Chen Gang** &lt;gangc.cxy@foxmail.com&gt;
-* [not-an-aardvark](https://github.com/not-an-aardvark) -
-**Teddy Katz** &lt;teddy.katz@gmail.com&gt; (he/him)
-* [Olegas](https://github.com/Olegas) -
-**Oleg Elifantiev** &lt;oleg@elifantiev.ru&gt;
-* [orangemocha](https://github.com/orangemocha) -
-**Alexis Campailla** &lt;orangemocha@nodejs.org&gt;
-* [othiym23](https://github.com/othiym23) -
-**Forrest L Norvell** &lt;ogd@aoaioxxysz.net&gt; (he/him)
-* [petkaantonov](https://github.com/petkaantonov) -
-**Petka Antonov** &lt;petka_antonov@hotmail.com&gt;
-* [phillipj](https://github.com/phillipj) -
-**Phillip Johnsen** &lt;johphi@gmail.com&gt;
-* [piscisaureus](https://github.com/piscisaureus) -
-**Bert Belder** &lt;bertbelder@gmail.com&gt;
-* [pmq20](https://github.com/pmq20) -
-**Minqi Pan** &lt;pmq2001@gmail.com&gt;
-* [princejwesley](https://github.com/princejwesley) -
-**Prince John Wesley** &lt;princejohnwesley@gmail.com&gt;
-* [rlidwka](https://github.com/rlidwka) -
-**Alex Kocharin** &lt;alex@kocharin.ru&gt;
-* [rmg](https://github.com/rmg) -
-**Ryan Graham** &lt;r.m.graham@gmail.com&gt;
-* [robertkowalski](https://github.com/robertkowalski) -
-**Robert Kowalski** &lt;rok@kowalski.gd&gt;
-* [romankl](https://github.com/romankl) -
-**Roman Klauke** &lt;romaaan.git@gmail.com&gt;
-* [RReverser](https://github.com/RReverser) -
-**Ingvar Stepanyan** &lt;me@rreverser.com&gt;
-* [stefanmb](https://github.com/stefanmb) -
-**Stefan Budeanu** &lt;stefan@budeanu.com&gt;
-* [tellnes](https://github.com/tellnes) -
-**Christian Tellnes** &lt;christian@tellnes.no&gt;
-* [thlorenz](https://github.com/thlorenz) -
-**Thorsten Lorenz** &lt;thlorenz@gmx.de&gt;
-* [trevnorris](https://github.com/trevnorris) -
-**Trevor Norris** &lt;trev.norris@gmail.com&gt;
-* [tunniclm](https://github.com/tunniclm) -
-**Mike Tunnicliffe** &lt;m.j.tunnicliffe@gmail.com&gt;
-* [vkurchatkin](https://github.com/vkurchatkin) -
-**Vladimir Kurchatkin** &lt;vladimir.kurchatkin@gmail.com&gt;
-* [vsemozhetbyt](https://github.com/vsemozhetbyt) -
-**Vse Mozhet Byt** &lt;vsemozhetbyt@gmail.com&gt; (he/him)
-* [whitlockjc](https://github.com/whitlockjc) -
-**Jeremy Whitlock** &lt;jwhitlock@apache.org&gt;
-
-Collaborators follow the [Collaborator Guide](./doc/guides/collaborator-guide.md) in
-maintaining the Node.js project.
-
-### Release Keys
-
-Primary GPG keys for Node.js Releasers (some Releasers sign with subkeys):
-
-* **Beth Griggs** &lt;bethany.griggs@uk.ibm.com&gt;
-`4ED778F539E3634C779C87C6D7062848A1AB005C`
-* **Colin Ihrig** &lt;cjihrig@gmail.com&gt;
-`94AE36675C464D64BAFA68DD7434390BDBE9B9C5`
-* **James M Snell** &lt;jasnell@keybase.io&gt;
-`71DCFD284A79C3B38668286BC97EC7A07EDE3FC1`
-* **Michaël Zasso** &lt;targos@protonmail.com&gt;
-`8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600`
-* **Myles Borins** &lt;myles.borins@gmail.com&gt;
-`C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8`
-* **Rod Vagg** &lt;rod@vagg.org&gt;
-`DD8F2338BAE7501E3DD5AC78C273792F7D83545D`
-* **Ruben Bridgewater** &lt;ruben@bridgewater.de&gt;
-`A48C2BEE680E841632CD4E44F07496B3EB3C1762`
-* **Shelley Vohr** &lt;shelley.vohr@gmail.com&gt;
-`B9E2F5981AA6E0CD28160D9FF13993A75599653C`
-
-To import the full set of trusted release keys:
-
-```bash
-gpg --keyserver pool.sks-keyservers.net --recv-keys 4ED778F539E3634C779C87C6D7062848A1AB005C
-gpg --keyserver pool.sks-keyservers.net --recv-keys 94AE36675C464D64BAFA68DD7434390BDBE9B9C5
-gpg --keyserver pool.sks-keyservers.net --recv-keys 71DCFD284A79C3B38668286BC97EC7A07EDE3FC1
-gpg --keyserver pool.sks-keyservers.net --recv-keys 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600
-gpg --keyserver pool.sks-keyservers.net --recv-keys C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8
-gpg --keyserver pool.sks-keyservers.net --recv-keys DD8F2338BAE7501E3DD5AC78C273792F7D83545D
-gpg --keyserver pool.sks-keyservers.net --recv-keys A48C2BEE680E841632CD4E44F07496B3EB3C1762
-gpg --keyserver pool.sks-keyservers.net --recv-keys B9E2F5981AA6E0CD28160D9FF13993A75599653C
-```
-
-See the section above on [Verifying Binaries](#verifying-binaries) for how to
-use these keys to verify a downloaded file.
-
-Other keys used to sign some previous releases:
-
-* **Chris Dickinson** &lt;christopher.s.dickinson@gmail.com&gt;
-`9554F04D7259F04124DE6B476D5A82AC7E37093B`
-* **Evan Lucas** &lt;evanlucas@me.com&gt;
-`B9AE9905FFD7803F25714661B63B535A4C206CA9`
-* **Gibson Fahnestock** &lt;gibfahn@gmail.com&gt;
-`77984A986EBC2AA786BC0F66B01FBB92821C587A`
-* **Isaac Z. Schlueter** &lt;i@izs.me&gt;
-`93C7E9E91B49E432C2F75674B0A78B0A6C481CF6`
-* **Italo A. Casas** &lt;me@italoacasas.com&gt;
-`56730D5401028683275BD23C23EFEFE93C4CFFFE`
-* **Jeremiah Senkpiel** &lt;fishrock@keybase.io&gt;
-`FD3A5288F042B6850C66B31F09FE44734EB7990E`
-* **Julien Gilli** &lt;jgilli@fastmail.fm&gt;
-`114F43EE0176B71C7BC219DD50A3051F888C628D`
-* **Timothy J Fontaine** &lt;tjfontaine@gmail.com&gt;
-`7937DFD2AB06298B2293C3187D33FF9D0246406D`
-
-[Code of Conduct]: https://github.com/nodejs/admin/blob/master/CODE_OF_CONDUCT.md
-[Contributing to the project]: CONTRIBUTING.md
-[Node.js Website]: https://nodejs.org/
-[OpenJS Foundation]: https://openjsf.org/
-[Working Groups]: https://github.com/nodejs/TSC/blob/master/WORKING_GROUPS.md
-[Strategic Initiatives]: https://github.com/nodejs/TSC/blob/master/Strategic-Initiatives.md
+This project is bound by a [Code of Conduct](https://github.com/nodejs/TSC/blob/master/CODE_OF_CONDUCT.md).
diff --git a/common.gypi b/common.gypi
index 3afe3c133f8..da641d3547b 100644
--- a/common.gypi
+++ b/common.gypi
@@ -36,7 +36,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.14',
+    'v8_embedder_string': '-node.7',
 
     ##### V8 defaults for Node.js #####
 
diff --git a/deps/v8/.gitignore b/deps/v8/.gitignore
index 1afbd765d3e..6d2cf1077a5 100644
--- a/deps/v8/.gitignore
+++ b/deps/v8/.gitignore
@@ -61,6 +61,8 @@
 !/third_party/antlr4
 !/third_party/binutils
 !/third_party/inspector_protocol
+!/third_party/jsoncpp
+/third_party/jsoncpp/source
 !/third_party/colorama
 /third_party/colorama/src
 !/third_party/googletest
diff --git a/deps/v8/AUTHORS b/deps/v8/AUTHORS
index 7036ecd42bc..d6d9ffb1ed4 100644
--- a/deps/v8/AUTHORS
+++ b/deps/v8/AUTHORS
@@ -43,6 +43,7 @@ Julia Computing, Inc. <*@juliacomputing.com>
 
 Aaron Bieber <deftly@gmail.com>
 Abdulla Kamar <abdulla.kamar@gmail.com>
+Adam Kallai <kadam@inf.u-szeged.hu>
 Akinori MUSHA <knu@FreeBSD.org>
 Alessandro Pignotti <alessandro@leaningtech.com>
 Alex Kodat <akodat@rocketsoftware.com>
@@ -112,10 +113,12 @@ James Pike <g00gle@chilon.net>
 James M Snell <jasnell@gmail.com>
 Jianghua Yang <jianghua.yjh@alibaba-inc.com>
 Jiawen Geng <technicalcute@gmail.com>
+Jiaxun Yang <jiaxun.yang@flygoat.com>
 Joel Stanley <joel@jms.id.au>
 Johan Bergström <johan@bergstroem.nu>
 Jonathan Liu <net147@gmail.com>
 Julien Brianceau <jbriance@cisco.com>
+Junha Park <jpark3@scu.edu>
 JunHo Seo <sejunho@gmail.com>
 Junming Huang <kiminghjm@gmail.com>
 Kang-Hao (Kenny) Lu <kennyluck@csail.mit.edu>
@@ -194,6 +197,7 @@ Tobias Burnus <burnus@net-b.de>
 Tobias Nießen <tniessen@tnie.de>
 Ujjwal Sharma <usharma1998@gmail.com>
 Vadim Gorbachev <bmsdave@gmail.com>
+Varun Varada <varuncvarada@gmail.com>
 Victor Costan <costan@gmail.com>
 Vlad Burlik <vladbph@gmail.com>
 Vladimir Krivosheev <develar@gmail.com>
@@ -211,3 +215,4 @@ Zhao Jiazhong <kyslie3100@gmail.com>
 Zhongping Wang <kewpie.w.zp@gmail.com>
 柳荣一 <admin@web-tinker.com>
 Yanbo Li <lybvinci@gmail.com>
+Gilang Mentari Hamidy <gilang@hamidy.net>
diff --git a/deps/v8/BUILD.gn b/deps/v8/BUILD.gn
index b2dde3f9d70..cde17854138 100644
--- a/deps/v8/BUILD.gn
+++ b/deps/v8/BUILD.gn
@@ -79,7 +79,7 @@ declare_args() {
   v8_enable_vtunetracemark = false
 
   # Sets -dENABLE_HANDLE_ZAPPING.
-  v8_enable_handle_zapping = is_debug
+  v8_enable_handle_zapping = true
 
   # Enable slow dchecks.
   v8_enable_slow_dchecks = false
@@ -130,6 +130,11 @@ declare_args() {
   # Sets -dV8_ARRAY_BUFFER_EXTENSION
   v8_enable_array_buffer_extension = true
 
+  # Runs mksnapshot with --turbo-profiling. After building in this
+  # configuration, any subsequent run of d8 with --turbo-profiling will output
+  # information about both runtime-generated code and builtins.
+  v8_enable_builtins_profiling = false
+
   # Enables various testing features.
   v8_enable_test_features = ""
 
@@ -218,6 +223,20 @@ declare_args() {
   # Enable control-flow integrity features, such as pointer authentication for
   # ARM64.
   v8_control_flow_integrity = false
+
+  # Enable object names in cppgc for debug purposes.
+  cppgc_enable_object_names = false
+
+  # Enable heap reservation of size 4GB. Only possible for 64bit archs.
+  cppgc_enable_caged_heap = v8_current_cpu == "x64" || v8_current_cpu == "arm64"
+
+  # Enable V8 heap sandbox experimental feature.
+  # Sets -DV8_HEAP_SANDBOX.
+  v8_enable_heap_sandbox = ""
+
+  # Experimental support for native context independent code.
+  # https://crbug.com/v8/8888
+  v8_enable_nci_code = false
 }
 
 # Derived defaults.
@@ -254,7 +273,9 @@ if (v8_enable_pointer_compression == "") {
 if (v8_enable_fast_torque == "") {
   v8_enable_fast_torque = v8_enable_fast_mksnapshot
 }
-
+if (v8_enable_heap_sandbox == "") {
+  v8_enable_heap_sandbox = false
+}
 if (v8_enable_single_generation == "") {
   v8_enable_single_generation = v8_disable_write_barriers
 }
@@ -284,6 +305,13 @@ assert(
     !v8_enable_pointer_compression || !v8_enable_shared_ro_heap,
     "Pointer compression is not supported with shared read-only heap enabled")
 
+assert(!v8_enable_heap_sandbox || v8_enable_pointer_compression,
+       "V8 Heap Sandbox requires pointer compression")
+
+assert(!cppgc_enable_caged_heap || v8_current_cpu == "x64" ||
+           v8_current_cpu == "arm64",
+       "CppGC caged heap requires 64bit platforms")
+
 v8_random_seed = "314159265"
 v8_toolset_for_shell = "host"
 
@@ -294,8 +322,11 @@ v8_toolset_for_shell = "host"
 config("internal_config_base") {
   visibility = [ ":*" ]  # Only targets in this file can depend on this.
 
+  configs = [ ":v8_tracing_config" ]
+
   include_dirs = [
     ".",
+    "include",
     "$target_gen_dir",
   ]
 }
@@ -308,7 +339,6 @@ config("internal_config") {
     "//build/config/compiler:wexit_time_destructors",
     ":internal_config_base",
     ":v8_header_features",
-    ":v8_tracing_config",
   ]
 
   if (is_component_build) {
@@ -346,6 +376,17 @@ config("libbase_config") {
   }
 }
 
+# This config should be applied to code using the cppgc_base.
+config("cppgc_base_config") {
+  defines = []
+  if (cppgc_enable_object_names) {
+    defines += [ "CPPGC_SUPPORTS_OBJECT_NAMES" ]
+  }
+  if (cppgc_enable_caged_heap) {
+    defines += [ "CPPGC_CAGED_HEAP" ]
+  }
+}
+
 # This config should be applied to code using the libsampler.
 config("libsampler_config") {
   include_dirs = [ "include" ]
@@ -389,6 +430,9 @@ config("v8_header_features") {
   if (v8_enable_pointer_compression || v8_enable_31bit_smis_on_64bit_arch) {
     defines += [ "V8_31BIT_SMIS_ON_64BIT_ARCH" ]
   }
+  if (v8_enable_heap_sandbox) {
+    defines += [ "V8_HEAP_SANDBOX" ]
+  }
   if (v8_deprecation_warnings) {
     defines += [ "V8_DEPRECATION_WARNINGS" ]
   }
@@ -428,10 +472,6 @@ config("features") {
   }
   if (v8_enable_lite_mode) {
     defines += [ "V8_LITE_MODE" ]
-
-    # TODO(v8:7777): Remove the define once the --jitless runtime flag does
-    # everything we need.
-    defines += [ "V8_JITLESS_MODE" ]
   }
   if (v8_enable_gdbjit) {
     defines += [ "ENABLE_GDB_JIT_INTERFACE" ]
@@ -501,10 +541,6 @@ config("features") {
   if (v8_check_microtasks_scopes_consistency) {
     defines += [ "V8_CHECK_MICROTASKS_SCOPES_CONSISTENCY" ]
   }
-
-  # TODO(v8:8519): Remove the define once all use-sites in
-  #                the code are removed/fixed
-  defines += [ "V8_EMBEDDED_BUILTINS" ]
   if (v8_use_multi_snapshots) {
     defines += [ "V8_MULTI_SNAPSHOTS" ]
   }
@@ -532,6 +568,9 @@ config("features") {
   if (v8_enable_wasm_gdb_remote_debugging) {
     defines += [ "V8_ENABLE_WASM_GDB_REMOTE_DEBUGGING" ]
   }
+  if (v8_enable_nci_code) {
+    defines += [ "V8_ENABLE_NCI_CODE" ]
+  }
 }
 
 config("toolchain") {
@@ -630,7 +669,9 @@ config("toolchain") {
     if (v8_can_use_fpu_instructions) {
       defines += [ "CAN_USE_FPU_INSTRUCTIONS" ]
     }
-
+    if (mips_use_msa) {
+      defines += [ "_MIPS_MSA" ]
+    }
     if (host_byteorder == "little") {
       defines += [ "V8_TARGET_ARCH_MIPS64_LE" ]
     } else if (host_byteorder == "big") {
@@ -646,9 +687,6 @@ config("toolchain") {
     }
     if (mips_arch_variant == "r6") {
       defines += [ "_MIPS_ARCH_MIPS64R6" ]
-      if (mips_use_msa) {
-        defines += [ "_MIPS_MSA" ]
-      }
     } else if (mips_arch_variant == "r2") {
       defines += [ "_MIPS_ARCH_MIPS64R2" ]
     }
@@ -982,6 +1020,7 @@ action("postmortem-metadata") {
 }
 
 torque_files = [
+  "src/builtins/aggregate-error.tq",
   "src/builtins/array-copywithin.tq",
   "src/builtins/array-every.tq",
   "src/builtins/array-filter.tq",
@@ -1007,14 +1046,19 @@ torque_files = [
   "src/builtins/bigint.tq",
   "src/builtins/boolean.tq",
   "src/builtins/builtins-string.tq",
-  "src/builtins/collections.tq",
   "src/builtins/cast.tq",
+  "src/builtins/collections.tq",
+  "src/builtins/conversion.tq",
   "src/builtins/convert.tq",
   "src/builtins/console.tq",
   "src/builtins/data-view.tq",
+  "src/builtins/finalization-registry.tq",
   "src/builtins/frames.tq",
   "src/builtins/frame-arguments.tq",
+  "src/builtins/function.tq",
   "src/builtins/growable-fixed-array.tq",
+  "src/builtins/ic-callable.tq",
+  "src/builtins/ic.tq",
   "src/builtins/internal-coverage.tq",
   "src/builtins/iterator.tq",
   "src/builtins/math.tq",
@@ -1024,6 +1068,7 @@ torque_files = [
   "src/builtins/promise-abstract-operations.tq",
   "src/builtins/promise-all.tq",
   "src/builtins/promise-all-element-closure.tq",
+  "src/builtins/promise-any.tq",
   "src/builtins/promise-constructor.tq",
   "src/builtins/promise-finally.tq",
   "src/builtins/promise-misc.tq",
@@ -1068,11 +1113,13 @@ torque_files = [
   "src/builtins/torque-internal.tq",
   "src/builtins/typed-array-createtypedarray.tq",
   "src/builtins/typed-array-every.tq",
+  "src/builtins/typed-array-entries.tq",
   "src/builtins/typed-array-filter.tq",
   "src/builtins/typed-array-find.tq",
   "src/builtins/typed-array-findindex.tq",
   "src/builtins/typed-array-foreach.tq",
   "src/builtins/typed-array-from.tq",
+  "src/builtins/typed-array-keys.tq",
   "src/builtins/typed-array-of.tq",
   "src/builtins/typed-array-reduce.tq",
   "src/builtins/typed-array-reduceright.tq",
@@ -1081,7 +1128,9 @@ torque_files = [
   "src/builtins/typed-array-some.tq",
   "src/builtins/typed-array-sort.tq",
   "src/builtins/typed-array-subarray.tq",
+  "src/builtins/typed-array-values.tq",
   "src/builtins/typed-array.tq",
+  "src/builtins/wasm.tq",
   "src/ic/handler-configuration.tq",
   "src/objects/allocation-site.tq",
   "src/objects/api-callbacks.tq",
@@ -1184,7 +1233,7 @@ template("run_torque") {
       "class-verifiers-tq.h",
       "enum-verifiers-tq.cc",
       "objects-printer-tq.cc",
-      "objects-body-descriptors-tq-inl.h",
+      "objects-body-descriptors-tq-inl.inc",
       "class-definitions-tq.cc",
       "class-definitions-tq-inl.h",
       "class-definitions-tq.h",
@@ -1196,6 +1245,8 @@ template("run_torque") {
       "instance-types-tq.h",
       "internal-class-definitions-tq.h",
       "internal-class-definitions-tq-inl.h",
+      "exported-class-definitions-tq.h",
+      "exported-class-definitions-tq-inl.h",
     ]
 
     outputs = []
@@ -1270,6 +1321,7 @@ v8_source_set("torque_generated_initializers") {
   deps = [
     ":generate_bytecode_builtins_list",
     ":run_torque",
+    ":v8_tracing",
   ]
 
   public_deps = [ ":v8_maybe_icu" ]
@@ -1298,6 +1350,7 @@ v8_source_set("torque_generated_definitions") {
   deps = [
     ":generate_bytecode_builtins_list",
     ":run_torque",
+    ":v8_tracing",
   ]
 
   public_deps = [ ":v8_maybe_icu" ]
@@ -1375,6 +1428,10 @@ template("run_mksnapshot") {
       rebase_path("$target_gen_dir/embedded${suffix}.S", root_build_dir),
     ]
 
+    if (v8_enable_builtins_profiling) {
+      args += [ "--turbo-profiling" ]
+    }
+
     # This is needed to distinguish between generating code for the simulator
     # and cross-compiling. The latter may need to run code on the host with the
     # simulator but cannot use simulator-specific instructions.
@@ -1573,7 +1630,10 @@ v8_source_set("v8_initializers") {
     "test/cctest:*",
   ]
 
-  deps = [ ":torque_generated_initializers" ]
+  deps = [
+    ":torque_generated_initializers",
+    ":v8_tracing",
+  ]
 
   sources = [
     ### gcmole(all) ###
@@ -1596,7 +1656,6 @@ v8_source_set("v8_initializers") {
     "src/builtins/builtins-data-view-gen.h",
     "src/builtins/builtins-date-gen.cc",
     "src/builtins/builtins-debug-gen.cc",
-    "src/builtins/builtins-function-gen.cc",
     "src/builtins/builtins-generator-gen.cc",
     "src/builtins/builtins-global-gen.cc",
     "src/builtins/builtins-handler-gen.cc",
@@ -1624,6 +1683,7 @@ v8_source_set("v8_initializers") {
     "src/builtins/builtins-typed-array-gen.h",
     "src/builtins/builtins-utils-gen.h",
     "src/builtins/builtins-wasm-gen.cc",
+    "src/builtins/builtins-wasm-gen.h",
     "src/builtins/growable-fixed-array-gen.cc",
     "src/builtins/growable-fixed-array-gen.h",
     "src/builtins/setup-builtins-internal.cc",
@@ -1636,6 +1696,8 @@ v8_source_set("v8_initializers") {
     "src/ic/binary-op-assembler.h",
     "src/ic/keyed-store-generic.cc",
     "src/ic/keyed-store-generic.h",
+    "src/ic/unary-op-assembler.cc",
+    "src/ic/unary-op-assembler.h",
     "src/interpreter/interpreter-assembler.cc",
     "src/interpreter/interpreter-assembler.h",
     "src/interpreter/interpreter-generator.cc",
@@ -1701,7 +1763,10 @@ v8_source_set("v8_initializers") {
 v8_source_set("v8_init") {
   visibility = [ ":*" ]  # Only targets in this file can depend on this.
 
-  deps = [ ":v8_initializers" ]
+  deps = [
+    ":v8_initializers",
+    ":v8_tracing",
+  ]
 
   sources = [
     ### gcmole(all) ###
@@ -2005,6 +2070,7 @@ v8_source_set("v8_compiler_opt") {
     ":generate_bytecode_builtins_list",
     ":run_torque",
     ":v8_maybe_icu",
+    ":v8_tracing",
   ]
 
   if (is_debug && !v8_optimized_debug && v8_enable_fast_mksnapshot) {
@@ -2029,6 +2095,7 @@ v8_source_set("v8_compiler") {
     ":generate_bytecode_builtins_list",
     ":run_torque",
     ":v8_maybe_icu",
+    ":v8_tracing",
   ]
 
   configs = [ ":internal_config" ]
@@ -2042,6 +2109,18 @@ group("v8_compiler_for_mksnapshot") {
   }
 }
 
+# Any target using trace events must directly or indirectly depend on
+# v8_tracing.
+group("v8_tracing") {
+  if (v8_use_perfetto) {
+    if (build_with_chromium) {
+      public_deps = [ "//third_party/perfetto:libperfetto" ]
+    } else {
+      public_deps = [ ":v8_libperfetto" ]
+    }
+  }
+}
+
 v8_source_set("v8_base_without_compiler") {
   visibility = [ ":*" ]  # Only targets in this file can depend on this.
 
@@ -2053,6 +2132,7 @@ v8_source_set("v8_base_without_compiler") {
 
     ### gcmole(all) ###
     "$target_gen_dir/builtins-generated/bytecodes-builtins-list.h",
+    "include/cppgc/common.h",
     "include/v8-fast-api-calls.h",
     "include/v8-inspector-protocol.h",
     "include/v8-inspector.h",
@@ -2121,7 +2201,6 @@ v8_source_set("v8_base_without_compiler") {
     "src/builtins/builtins-json.cc",
     "src/builtins/builtins-number.cc",
     "src/builtins/builtins-object.cc",
-    "src/builtins/builtins-promise.cc",
     "src/builtins/builtins-promise.h",
     "src/builtins/builtins-reflect.cc",
     "src/builtins/builtins-regexp.cc",
@@ -2160,6 +2239,8 @@ v8_source_set("v8_base_without_compiler") {
     "src/codegen/constant-pool.h",
     "src/codegen/constants-arch.h",
     "src/codegen/cpu-features.h",
+    "src/codegen/external-reference-encoder.cc",
+    "src/codegen/external-reference-encoder.h",
     "src/codegen/external-reference-table.cc",
     "src/codegen/external-reference-table.h",
     "src/codegen/external-reference.cc",
@@ -2207,6 +2288,8 @@ v8_source_set("v8_base_without_compiler") {
     "src/common/assert-scope.cc",
     "src/common/assert-scope.h",
     "src/common/checks.h",
+    "src/common/external-pointer-inl.h",
+    "src/common/external-pointer.h",
     "src/common/message-template.h",
     "src/common/ptr-compr-inl.h",
     "src/common/ptr-compr.h",
@@ -2284,6 +2367,7 @@ v8_source_set("v8_base_without_compiler") {
     "src/execution/messages.h",
     "src/execution/microtask-queue.cc",
     "src/execution/microtask-queue.h",
+    "src/execution/off-thread-isolate-inl.h",
     "src/execution/off-thread-isolate.cc",
     "src/execution/off-thread-isolate.h",
     "src/execution/pointer-authentication.h",
@@ -2330,6 +2414,8 @@ v8_source_set("v8_base_without_compiler") {
     "src/handles/local-handles.h",
     "src/handles/maybe-handles-inl.h",
     "src/handles/maybe-handles.h",
+    "src/handles/persistent-handles.cc",
+    "src/handles/persistent-handles.h",
     "src/heap/array-buffer-collector.cc",
     "src/heap/array-buffer-collector.h",
     "src/heap/array-buffer-sweeper.cc",
@@ -2340,10 +2426,15 @@ v8_source_set("v8_base_without_compiler") {
     "src/heap/barrier.h",
     "src/heap/basic-memory-chunk.cc",
     "src/heap/basic-memory-chunk.h",
+    "src/heap/code-object-registry.cc",
+    "src/heap/code-object-registry.h",
     "src/heap/code-stats.cc",
     "src/heap/code-stats.h",
     "src/heap/combined-heap.cc",
     "src/heap/combined-heap.h",
+    "src/heap/concurrent-allocator-inl.h",
+    "src/heap/concurrent-allocator.cc",
+    "src/heap/concurrent-allocator.h",
     "src/heap/concurrent-marking.cc",
     "src/heap/concurrent-marking.h",
     "src/heap/embedder-tracing.cc",
@@ -2376,6 +2467,9 @@ v8_source_set("v8_base_without_compiler") {
     "src/heap/invalidated-slots.h",
     "src/heap/item-parallel-job.cc",
     "src/heap/item-parallel-job.h",
+    "src/heap/large-spaces.cc",
+    "src/heap/large-spaces.h",
+    "src/heap/list.h",
     "src/heap/local-allocator-inl.h",
     "src/heap/local-allocator.h",
     "src/heap/local-heap.cc",
@@ -2389,11 +2483,19 @@ v8_source_set("v8_base_without_compiler") {
     "src/heap/marking-worklist.h",
     "src/heap/marking.cc",
     "src/heap/marking.h",
+    "src/heap/memory-allocator.cc",
+    "src/heap/memory-allocator.h",
+    "src/heap/memory-chunk-inl.h",
+    "src/heap/memory-chunk.cc",
+    "src/heap/memory-chunk.h",
     "src/heap/memory-measurement-inl.h",
     "src/heap/memory-measurement.cc",
     "src/heap/memory-measurement.h",
     "src/heap/memory-reducer.cc",
     "src/heap/memory-reducer.h",
+    "src/heap/new-spaces-inl.h",
+    "src/heap/new-spaces.cc",
+    "src/heap/new-spaces.h",
     "src/heap/object-stats.cc",
     "src/heap/object-stats.h",
     "src/heap/objects-visiting-inl.h",
@@ -2401,9 +2503,16 @@ v8_source_set("v8_base_without_compiler") {
     "src/heap/objects-visiting.h",
     "src/heap/off-thread-factory.cc",
     "src/heap/off-thread-factory.h",
+    "src/heap/off-thread-heap.cc",
+    "src/heap/off-thread-heap.h",
+    "src/heap/paged-spaces-inl.h",
+    "src/heap/paged-spaces.cc",
+    "src/heap/paged-spaces.h",
     "src/heap/read-only-heap-inl.h",
     "src/heap/read-only-heap.cc",
     "src/heap/read-only-heap.h",
+    "src/heap/read-only-spaces.cc",
+    "src/heap/read-only-spaces.h",
     "src/heap/remembered-set.h",
     "src/heap/safepoint.cc",
     "src/heap/safepoint.h",
@@ -2888,6 +2997,7 @@ v8_source_set("v8_base_without_compiler") {
     "src/runtime/runtime-typedarray.cc",
     "src/runtime/runtime-utils.h",
     "src/runtime/runtime-wasm.cc",
+    "src/runtime/runtime-weak-refs.cc",
     "src/runtime/runtime.cc",
     "src/runtime/runtime.h",
     "src/sanitizer/asan.h",
@@ -2897,6 +3007,10 @@ v8_source_set("v8_base_without_compiler") {
     "src/sanitizer/tsan.h",
     "src/snapshot/code-serializer.cc",
     "src/snapshot/code-serializer.h",
+    "src/snapshot/context-deserializer.cc",
+    "src/snapshot/context-deserializer.h",
+    "src/snapshot/context-serializer.cc",
+    "src/snapshot/context-serializer.h",
     "src/snapshot/deserializer-allocator.cc",
     "src/snapshot/deserializer-allocator.h",
     "src/snapshot/deserializer.cc",
@@ -2905,10 +3019,6 @@ v8_source_set("v8_base_without_compiler") {
     "src/snapshot/embedded/embedded-data.h",
     "src/snapshot/object-deserializer.cc",
     "src/snapshot/object-deserializer.h",
-    "src/snapshot/partial-deserializer.cc",
-    "src/snapshot/partial-deserializer.h",
-    "src/snapshot/partial-serializer.cc",
-    "src/snapshot/partial-serializer.h",
     "src/snapshot/read-only-deserializer.cc",
     "src/snapshot/read-only-deserializer.h",
     "src/snapshot/read-only-serializer.cc",
@@ -2918,15 +3028,19 @@ v8_source_set("v8_base_without_compiler") {
     "src/snapshot/roots-serializer.h",
     "src/snapshot/serializer-allocator.cc",
     "src/snapshot/serializer-allocator.h",
-    "src/snapshot/serializer-common.cc",
-    "src/snapshot/serializer-common.h",
+    "src/snapshot/serializer-deserializer.cc",
+    "src/snapshot/serializer-deserializer.h",
     "src/snapshot/serializer.cc",
     "src/snapshot/serializer.h",
-    "src/snapshot/snapshot-common.cc",
     "src/snapshot/snapshot-compression.cc",
     "src/snapshot/snapshot-compression.h",
+    "src/snapshot/snapshot-data.cc",
+    "src/snapshot/snapshot-data.h",
     "src/snapshot/snapshot-source-sink.cc",
     "src/snapshot/snapshot-source-sink.h",
+    "src/snapshot/snapshot-utils.cc",
+    "src/snapshot/snapshot-utils.h",
+    "src/snapshot/snapshot.cc",
     "src/snapshot/snapshot.h",
     "src/snapshot/startup-deserializer.cc",
     "src/snapshot/startup-deserializer.h",
@@ -3026,6 +3140,8 @@ v8_source_set("v8_base_without_compiler") {
     "src/wasm/signature-map.h",
     "src/wasm/streaming-decoder.cc",
     "src/wasm/streaming-decoder.h",
+    "src/wasm/struct-types.h",
+    "src/wasm/sync-streaming-decoder.cc",
     "src/wasm/value-type.h",
     "src/wasm/wasm-arguments.h",
     "src/wasm/wasm-code-manager.cc",
@@ -3085,21 +3201,28 @@ v8_source_set("v8_base_without_compiler") {
 
   if (v8_enable_third_party_heap) {
     sources += v8_third_party_heap_files
+  } else {
+    sources += [ "src/heap/third-party/heap-api-stub.cc" ]
   }
 
   if (v8_enable_wasm_gdb_remote_debugging) {
     sources += [
+      "src/debug/wasm/gdb-server/gdb-remote-util.cc",
+      "src/debug/wasm/gdb-server/gdb-remote-util.h",
       "src/debug/wasm/gdb-server/gdb-server-thread.cc",
       "src/debug/wasm/gdb-server/gdb-server-thread.h",
       "src/debug/wasm/gdb-server/gdb-server.cc",
       "src/debug/wasm/gdb-server/gdb-server.h",
+      "src/debug/wasm/gdb-server/packet.cc",
+      "src/debug/wasm/gdb-server/packet.h",
       "src/debug/wasm/gdb-server/session.cc",
       "src/debug/wasm/gdb-server/session.h",
       "src/debug/wasm/gdb-server/target.cc",
       "src/debug/wasm/gdb-server/target.h",
       "src/debug/wasm/gdb-server/transport.cc",
       "src/debug/wasm/gdb-server/transport.h",
-      "src/debug/wasm/gdb-server/util.h",
+      "src/debug/wasm/gdb-server/wasm-module-debug.cc",
+      "src/debug/wasm/gdb-server/wasm-module-debug.h",
     ]
   }
 
@@ -3420,6 +3543,7 @@ v8_source_set("v8_base_without_compiler") {
     ":v8_libbase",
     ":v8_libsampler",
     ":v8_shared_internal_headers",
+    ":v8_tracing",
     ":v8_version",
     "src/inspector:inspector",
   ]
@@ -3511,6 +3635,14 @@ v8_source_set("v8_base_without_compiler") {
     ]
     deps += [ "src/third_party/vtune:v8_vtune_trace_mark" ]
   }
+
+  if (v8_use_perfetto) {
+    sources -= [ "//base/trace_event/common/trace_event_common.h" ]
+    sources += [
+      "src/tracing/trace-categories.cc",
+      "src/tracing/trace-categories.h",
+    ]
+  }
 }
 
 group("v8_base") {
@@ -3672,7 +3804,6 @@ v8_component("v8_libbase") {
     "src/base/ieee754.h",
     "src/base/iterator.h",
     "src/base/lazy-instance.h",
-    "src/base/list.h",
     "src/base/logging.cc",
     "src/base/logging.h",
     "src/base/lsan.h",
@@ -3843,6 +3974,8 @@ v8_component("v8_libplatform") {
     "include/libplatform/v8-tracing.h",
     "src/libplatform/default-foreground-task-runner.cc",
     "src/libplatform/default-foreground-task-runner.h",
+    "src/libplatform/default-job.cc",
+    "src/libplatform/default-job.h",
     "src/libplatform/default-platform.cc",
     "src/libplatform/default-platform.h",
     "src/libplatform/default-worker-threads-task-runner.cc",
@@ -3873,20 +4006,25 @@ v8_component("v8_libplatform") {
   deps = [
     ":v8_headers",
     ":v8_libbase",
+    ":v8_tracing",
   ]
+
   if (v8_use_perfetto) {
+    sources -= [
+      "//base/trace_event/common/trace_event_common.h",
+      "src/libplatform/tracing/trace-buffer.cc",
+      "src/libplatform/tracing/trace-buffer.h",
+      "src/libplatform/tracing/trace-object.cc",
+      "src/libplatform/tracing/trace-writer.cc",
+      "src/libplatform/tracing/trace-writer.h",
+    ]
     sources += [
-      "src/libplatform/tracing/json-trace-event-listener.cc",
-      "src/libplatform/tracing/json-trace-event-listener.h",
       "src/libplatform/tracing/trace-event-listener.cc",
       "src/libplatform/tracing/trace-event-listener.h",
     ]
     deps += [
+      # TODO(skyostil): Switch TraceEventListener to protozero.
       "//third_party/perfetto/protos/perfetto/trace:lite",
-      "//third_party/perfetto/protos/perfetto/trace/chrome:minimal_complete_lite",
-      "//third_party/perfetto/protos/perfetto/trace/chrome:zero",
-      "//third_party/perfetto/src/tracing:client_api",
-      "//third_party/perfetto/src/tracing:platform_posix",
     ]
   }
 }
@@ -3914,9 +4052,8 @@ v8_source_set("fuzzer_support") {
 
   configs = [ ":internal_config_base" ]
 
-  deps = [ ":v8" ]
-
   public_deps = [
+    ":v8",
     ":v8_libbase",
     ":v8_libplatform",
     ":v8_maybe_icu",
@@ -3928,14 +4065,33 @@ v8_source_set("cppgc_base") {
 
   sources = [
     "include/cppgc/allocation.h",
-    "include/cppgc/api-constants.h",
-    "include/cppgc/finalizer-trait.h",
+    "include/cppgc/common.h",
+    "include/cppgc/custom-space.h",
     "include/cppgc/garbage-collected.h",
-    "include/cppgc/gc-info.h",
     "include/cppgc/heap.h",
+    "include/cppgc/internal/accessors.h",
+    "include/cppgc/internal/api-contants.h",
+    "include/cppgc/internal/compiler-specific.h",
+    "include/cppgc/internal/finalizer-traits.h",
+    "include/cppgc/internal/gc-info.h",
+    "include/cppgc/internal/persistent-node.h",
+    "include/cppgc/internal/pointer-policies.h",
+    "include/cppgc/internal/prefinalizer-handler.h",
+    "include/cppgc/liveness-broker.h",
+    "include/cppgc/liveness-broker.h",
+    "include/cppgc/macros.h",
+    "include/cppgc/member.h",
+    "include/cppgc/persistent.h",
     "include/cppgc/platform.h",
+    "include/cppgc/prefinalizer.h",
+    "include/cppgc/source-location.h",
+    "include/cppgc/trace-trait.h",
+    "include/cppgc/type-traits.h",
+    "include/cppgc/visitor.h",
     "include/v8config.h",
     "src/heap/cppgc/allocation.cc",
+    "src/heap/cppgc/free-list.cc",
+    "src/heap/cppgc/free-list.h",
     "src/heap/cppgc/gc-info-table.cc",
     "src/heap/cppgc/gc-info-table.h",
     "src/heap/cppgc/gc-info.cc",
@@ -3943,23 +4099,78 @@ v8_source_set("cppgc_base") {
     "src/heap/cppgc/heap-object-header-inl.h",
     "src/heap/cppgc/heap-object-header.cc",
     "src/heap/cppgc/heap-object-header.h",
+    "src/heap/cppgc/heap-page.cc",
+    "src/heap/cppgc/heap-page.h",
+    "src/heap/cppgc/heap-space.cc",
+    "src/heap/cppgc/heap-space.h",
+    "src/heap/cppgc/heap-visitor.h",
     "src/heap/cppgc/heap.cc",
     "src/heap/cppgc/heap.h",
+    "src/heap/cppgc/liveness-broker.cc",
+    "src/heap/cppgc/logging.cc",
+    "src/heap/cppgc/marker.cc",
+    "src/heap/cppgc/marker.h",
+    "src/heap/cppgc/marking-visitor.cc",
+    "src/heap/cppgc/marking-visitor.h",
+    "src/heap/cppgc/object-allocator-inl.h",
+    "src/heap/cppgc/object-allocator.cc",
+    "src/heap/cppgc/object-allocator.h",
+    "src/heap/cppgc/object-start-bitmap-inl.h",
+    "src/heap/cppgc/object-start-bitmap.h",
+    "src/heap/cppgc/page-memory-inl.h",
+    "src/heap/cppgc/page-memory.cc",
+    "src/heap/cppgc/page-memory.h",
+    "src/heap/cppgc/persistent-node.cc",
     "src/heap/cppgc/platform.cc",
+    "src/heap/cppgc/pointer-policies.cc",
+    "src/heap/cppgc/prefinalizer-handler.cc",
+    "src/heap/cppgc/prefinalizer-handler.h",
+    "src/heap/cppgc/raw-heap.cc",
+    "src/heap/cppgc/raw-heap.h",
     "src/heap/cppgc/sanitizers.h",
+    "src/heap/cppgc/source-location.cc",
     "src/heap/cppgc/stack.cc",
     "src/heap/cppgc/stack.h",
+    "src/heap/cppgc/sweeper.cc",
+    "src/heap/cppgc/sweeper.h",
+    "src/heap/cppgc/virtual-memory.cc",
+    "src/heap/cppgc/virtual-memory.h",
+    "src/heap/cppgc/visitor.cc",
+    "src/heap/cppgc/worklist.h",
   ]
 
-  if (target_cpu == "x64") {
-    if (is_win) {
-      sources += [ "src/heap/cppgc/asm/x64/push_registers_win.S" ]
-    } else {
-      sources += [ "src/heap/cppgc/asm/x64/push_registers.S" ]
+  if (is_clang || !is_win) {
+    if (target_cpu == "x64") {
+      sources += [ "src/heap/cppgc/asm/x64/push_registers_asm.cc" ]
+    } else if (target_cpu == "x86") {
+      sources += [ "src/heap/cppgc/asm/ia32/push_registers_asm.cc" ]
+    } else if (target_cpu == "arm") {
+      sources += [ "src/heap/cppgc/asm/arm/push_registers_asm.cc" ]
+    } else if (target_cpu == "arm64") {
+      sources += [ "src/heap/cppgc/asm/arm64/push_registers_asm.cc" ]
+    } else if (target_cpu == "ppc64") {
+      sources += [ "src/heap/cppgc/asm/ppc/push_registers_asm.cc" ]
+    } else if (target_cpu == "s390x") {
+      sources += [ "src/heap/cppgc/asm/s390/push_registers_asm.cc" ]
+    } else if (target_cpu == "mipsel") {
+      sources += [ "src/heap/cppgc/asm/mips/push_registers_asm.cc" ]
+    } else if (target_cpu == "mips64el") {
+      sources += [ "src/heap/cppgc/asm/mips64/push_registers_asm.cc" ]
+    }
+  } else if (is_win) {
+    if (target_cpu == "x64") {
+      sources += [ "src/heap/cppgc/asm/x64/push_registers_masm.S" ]
+    } else if (target_cpu == "x86") {
+      sources += [ "src/heap/cppgc/asm/ia32/push_registers_masm.S" ]
+    } else if (target_cpu == "arm64") {
+      sources += [ "src/heap/cppgc/asm/arm64/push_registers_masm.S" ]
     }
   }
 
-  configs = [ ":internal_config" ]
+  configs = [
+    ":internal_config",
+    ":cppgc_base_config",
+  ]
 
   public_deps = [ ":v8_libbase" ]
 }
@@ -4010,12 +4221,6 @@ v8_static_library("wee8") {
   ]
 }
 
-v8_static_library("cppgc") {
-  deps = [ ":cppgc_base" ]
-
-  configs = [ ":internal_config" ]
-}
-
 ###############################################################################
 # Executables
 #
@@ -4074,6 +4279,7 @@ if (current_toolchain == v8_snapshot_toolchain) {
       ":v8_libbase",
       ":v8_libplatform",
       ":v8_maybe_icu",
+      ":v8_tracing",
       "//build/win:default_exe_manifest",
     ]
   }
@@ -4308,6 +4514,14 @@ if (is_component_build) {
     public_configs = [ ":external_config" ]
   }
 
+  v8_component("cppgc") {
+    public_deps = [ ":cppgc_base" ]
+
+    configs = [ ":internal_config" ]
+
+    public_configs = [ ":external_config" ]
+  }
+
   v8_component("cppgc_for_testing") {
     testonly = true
 
@@ -4340,6 +4554,12 @@ if (is_component_build) {
     public_configs = [ ":external_config" ]
   }
 
+  group("cppgc") {
+    public_deps = [ ":cppgc_base" ]
+
+    public_configs = [ ":external_config" ]
+  }
+
   group("cppgc_for_testing") {
     testonly = true
 
@@ -4374,6 +4594,7 @@ v8_executable("d8") {
     ":v8",
     ":v8_libbase",
     ":v8_libplatform",
+    ":v8_tracing",
     "//build/win:default_exe_manifest",
   ]
 
@@ -4392,10 +4613,6 @@ v8_executable("d8") {
   if (v8_enable_vtunejit) {
     deps += [ "src/third_party/vtune:v8_vtune" ]
   }
-
-  if (v8_use_perfetto) {
-    deps += [ "//third_party/perfetto/src/tracing:in_process_backend" ]
-  }
 }
 
 v8_executable("v8_hello_world") {
@@ -4551,6 +4768,7 @@ v8_source_set("wasm_module_runner") {
   deps = [
     ":generate_bytecode_builtins_list",
     ":run_torque",
+    ":v8_tracing",
   ]
 
   public_deps = [ ":v8_maybe_icu" ]
@@ -4627,6 +4845,7 @@ v8_source_set("lib_wasm_fuzzer_common") {
   deps = [
     ":generate_bytecode_builtins_list",
     ":run_torque",
+    ":v8_tracing",
   ]
 
   public_deps = [ ":v8_maybe_icu" ]
@@ -4709,7 +4928,7 @@ if (!build_with_chromium && v8_use_perfetto) {
         "-Wno-tautological-constant-compare",
       ]
     }
-    if (is_win) {
+    if (is_win && is_clang) {
       cflags += [ "-Wno-microsoft-unqualified-friend" ]
     }
   }
@@ -4868,4 +5087,21 @@ if (!build_with_chromium && v8_use_perfetto) {
       configs += [ "//build/config/compiler:no_chromium_code" ]
     }
   }  # host_toolchain
+
+  v8_component("v8_libperfetto") {
+    configs = [ ":v8_tracing_config" ]
+    public_configs = [ "//third_party/perfetto/gn:public_config" ]
+    deps = [
+      "//third_party/perfetto/src/trace_processor:export_json",
+      "//third_party/perfetto/src/trace_processor:storage_minimal",
+      "//third_party/perfetto/src/tracing:client_api",
+      "//third_party/perfetto/src/tracing/core",
+
+      # TODO(skyostil): Support non-POSIX platforms.
+      "//third_party/perfetto/protos/perfetto/config:cpp",
+      "//third_party/perfetto/protos/perfetto/trace/track_event:zero",
+      "//third_party/perfetto/src/tracing:in_process_backend",
+      "//third_party/perfetto/src/tracing:platform_posix",
+    ]
+  }
 }  # if (!build_with_chromium && v8_use_perfetto)
diff --git a/deps/v8/COMMON_OWNERS b/deps/v8/COMMON_OWNERS
index 1eee48173a1..bfd539fb420 100644
--- a/deps/v8/COMMON_OWNERS
+++ b/deps/v8/COMMON_OWNERS
@@ -2,12 +2,14 @@ adamk@chromium.org
 ahaas@chromium.org
 bbudge@chromium.org
 binji@chromium.org
+bikineev@chromium.org
 bmeurer@chromium.org
 cbruni@chromium.org
 clemensb@chromium.org
 danno@chromium.org
 delphick@chromium.org
 dinfuehr@chromium.org
+ecmziegler@chromium.org
 gdeepti@chromium.org
 gsathya@chromium.org
 hablich@chromium.org
@@ -25,6 +27,7 @@ mslekova@chromium.org
 mvstanton@chromium.org
 mythria@chromium.org
 neis@chromium.org
+omerkatz@chromium.org
 petermarshall@chromium.org
 rmcilroy@chromium.org
 sigurds@chromium.org
@@ -32,6 +35,7 @@ solanes@chromium.org
 syg@chromium.org
 szuend@chromium.org
 tebbi@chromium.org
+thibaudm@chromium.org
 ulan@chromium.org
 verwaest@chromium.org
 victorgomes@chromium.org
diff --git a/deps/v8/DEPS b/deps/v8/DEPS
index 1bc687beaf6..4d0f67a0656 100644
--- a/deps/v8/DEPS
+++ b/deps/v8/DEPS
@@ -31,10 +31,10 @@ vars = {
   'check_v8_header_includes': False,
 
   # GN CIPD package version.
-  'gn_version': 'git_revision:5ed3c9cc67b090d5e311e4bd2aba072173e82db9',
+  'gn_version': 'git_revision:d0a6f072070988e7b038496c4e7d6c562b649732',
 
   # luci-go CIPD package version.
-  'luci_go': 'git_revision:de73cf6c4bde86f0a9c8d54151b69b0154a398f1',
+  'luci_go': 'git_revision:56ae79476e3caf14da59d75118408aa778637936',
 
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling android_sdk_build-tools_version
@@ -55,7 +55,7 @@ vars = {
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling android_sdk_platform-tools_version
   # and whatever else without interference from each other.
-  'android_sdk_platform-tools_version': 'Jxtur3_L9RzY4q79K-AwIahwFW4oi5uYVD5URx9h62wC',
+  'android_sdk_platform-tools_version': 'zMVtBEihXp2Z0NYFNjLLmNrwy6252b_YWG6sh2l0QAcC',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling android_sdk_platforms_version
   # and whatever else without interference from each other.
@@ -67,20 +67,20 @@ vars = {
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling android_sdk_tools-lint_version
   # and whatever else without interference from each other.
-  'android_sdk_tools-lint_version': '89hXqZYzCum3delB5RV7J_QyWkaRodqdtQS0s3LMh3wC',
+  'android_sdk_cmdline-tools_version': 'CR25ixsRhwuRnhdgDpGFyl9S0C_0HO9SUgFrwX46zq8C',
 }
 
 deps = {
   'v8/build':
-    Var('chromium_url') + '/chromium/src/build.git' + '@' + '26e9d485d01d6e0eb9dadd21df767a63494c8fea',
+    Var('chromium_url') + '/chromium/src/build.git' + '@' + 'c523c20ca356cf8149569a4aeece9922c7f05813',
   'v8/third_party/depot_tools':
-    Var('chromium_url') + '/chromium/tools/depot_tools.git' + '@' + '2b2aec6506a810f8d7bd018609de2c2450b3c121',
+    Var('chromium_url') + '/chromium/tools/depot_tools.git' + '@' + '99044852de36333f88644adfd074189c05eaec12',
   'v8/third_party/icu':
-    Var('chromium_url') + '/chromium/deps/icu.git' + '@' + 'd7aff76cf6bb0fbef3afa6c07718f78a80a70f8f',
+    Var('chromium_url') + '/chromium/deps/icu.git' + '@' + '84e9d0035875f383b98320d48f3e7008a23c3738',
   'v8/third_party/instrumented_libraries':
     Var('chromium_url') + '/chromium/src/third_party/instrumented_libraries.git' + '@' + 'bb3f1802c237dd19105dd0f7919f99e536a39d10',
   'v8/buildtools':
-    Var('chromium_url') + '/chromium/src/buildtools.git' + '@' + '7977eb176752aeec29d888cfe8e677ac12ed1c41',
+    Var('chromium_url') + '/chromium/src/buildtools.git' + '@' + '7a0ebcc8407db6983748dd2edccec7a526e181fc',
   'v8/buildtools/clang_format/script':
     Var('chromium_url') + '/chromium/llvm-project/cfe/tools/clang-format.git' + '@' + '96636aa0e9f047f17447f2d45a094d0b59ed7917',
   'v8/buildtools/linux64': {
@@ -108,7 +108,7 @@ deps = {
   'v8/buildtools/third_party/libc++abi/trunk':
     Var('chromium_url') + '/external/github.com/llvm/llvm-project/libcxxabi.git' + '@' + '196ba1aaa8ac285d94f4ea8d9836390a45360533',
   'v8/buildtools/third_party/libunwind/trunk':
-    Var('chromium_url') + '/external/github.com/llvm/llvm-project/libunwind.git' + '@' + '43bb9f872232f531bac80093ceb4de61c64b9ab7',
+    Var('chromium_url') + '/external/github.com/llvm/llvm-project/libunwind.git' + '@' + 'd999d54f4bca789543a2eb6c995af2d9b5a1f3ed',
   'v8/buildtools/win': {
     'packages': [
       {
@@ -120,13 +120,13 @@ deps = {
     'condition': 'host_os == "win"',
   },
   'v8/base/trace_event/common':
-    Var('chromium_url') + '/chromium/src/base/trace_event/common.git' + '@' + 'dab187b372fc17e51f5b9fad8201813d0aed5129',
+    Var('chromium_url') + '/chromium/src/base/trace_event/common.git' + '@' + 'ef3586804494b7e402b6c1791d5dccdf2971afff',
   'v8/third_party/android_ndk': {
     'url': Var('chromium_url') + '/android_ndk.git' + '@' + '27c0a8d090c666a50e40fceb4ee5b40b1a2d3f87',
     'condition': 'checkout_android',
   },
   'v8/third_party/android_platform': {
-    'url': Var('chromium_url') + '/chromium/src/third_party/android_platform.git' + '@' + '2244b5ea295f8fda3179bef160c84ef8fa0ec9fc',
+    'url': Var('chromium_url') + '/chromium/src/third_party/android_platform.git' + '@' + 'c1f84dcf41795fba13a53c86de608fc0cf6f813e',
     'condition': 'checkout_android',
   },
   'v8/third_party/android_sdk/public': {
@@ -160,15 +160,15 @@ deps = {
               'version': Var('android_sdk_sources_version'),
           },
           {
-              'package': 'chromium/third_party/android_sdk/public/tools-lint',
-              'version': Var('android_sdk_tools-lint_version'),
+              'package': 'chromium/third_party/android_sdk/public/cmdline-tools',
+              'version': Var('android_sdk_cmdline-tools_version'),
           },
       ],
       'condition': 'checkout_android',
       'dep_type': 'cipd',
   },
   'v8/third_party/catapult': {
-    'url': Var('chromium_url') + '/catapult.git' + '@' + '032c78376792ef343ea361bca2181ba6dec6b95f',
+    'url': Var('chromium_url') + '/catapult.git' + '@' + '1ec298698eeb08ce1af69370e3e013aaaf1ec18d',
     'condition': 'checkout_android',
   },
   'v8/third_party/colorama/src': {
@@ -176,23 +176,23 @@ deps = {
     'condition': 'checkout_android',
   },
   'v8/third_party/fuchsia-sdk': {
-    'url': Var('chromium_url') + '/chromium/src/third_party/fuchsia-sdk.git' + '@' + '2457e41d8dc379f74662d3157e76339ba92cee06',
+    'url': Var('chromium_url') + '/chromium/src/third_party/fuchsia-sdk.git' + '@' + '8ce22865fbbc501198e0dc9d3ca2eeaa46471d11',
     'condition': 'checkout_fuchsia',
   },
   'v8/third_party/googletest/src':
-    Var('chromium_url') + '/external/github.com/google/googletest.git' + '@' + '10b1902d893ea8cc43c69541d70868f91af3646b',
+    Var('chromium_url') + '/external/github.com/google/googletest.git' + '@' + '011959aafddcd30611003de96cfd8d7a7685c700',
   'v8/third_party/jinja2':
-    Var('chromium_url') + '/chromium/src/third_party/jinja2.git' + '@' + 'b41863e42637544c2941b574c7877d3e1f663e25',
+    Var('chromium_url') + '/chromium/src/third_party/jinja2.git' + '@' + '3f90fa05c85718505e28c9c3426c1ba52843b9b7',
   'v8/third_party/markupsafe':
     Var('chromium_url') + '/chromium/src/third_party/markupsafe.git' + '@' + '8f45f5cfa0009d2a70589bcda0349b8cb2b72783',
   'v8/tools/swarming_client':
-    Var('chromium_url') + '/infra/luci/client-py.git' + '@' + 'cc958279ffd6853e0a1b227a7e957ca334fe56af',
+    Var('chromium_url') + '/infra/luci/client-py.git' + '@' + '90c5e17a82612bc898c90ab1530dd1bd5822eae8',
   'v8/test/benchmarks/data':
     Var('chromium_url') + '/v8/deps/third_party/benchmarks.git' + '@' + '05d7188267b4560491ff9155c5ee13e207ecd65f',
   'v8/test/mozilla/data':
     Var('chromium_url') + '/v8/deps/third_party/mozilla-tests.git' + '@' + 'f6c578a10ea707b1a8ab0b88943fe5115ce2b9be',
   'v8/test/test262/data':
-    Var('chromium_url') + '/external/github.com/tc39/test262.git' + '@' + 'f6b2ccdd091ff82da54150796297c3a96d7edb41',
+    Var('chromium_url') + '/external/github.com/tc39/test262.git' + '@' + 'd2f7d4285c4a5267f5be37a9c823a397daadad1b',
   'v8/test/test262/harness':
     Var('chromium_url') + '/external/github.com/test262-utils/test262-harness-py.git' + '@' + '4555345a943d0c99a9461182705543fb171dda4b',
   'v8/third_party/qemu-linux-x64': {
@@ -219,7 +219,7 @@ deps = {
       'packages': [
           {
               'package': 'fuchsia/third_party/aemu/linux-amd64',
-              'version': '7YlCgase5GlIanqHn-nZClSlZ5kQETJyVUYRF7Jjy6UC'
+              'version': 'V4ZGjQxGJ00ndsSZd9X90QJnY3N7-ZbuPq57Yk7yv74C'
           },
       ],
       'condition': 'host_os == "linux" and checkout_fuchsia',
@@ -236,7 +236,7 @@ deps = {
       'dep_type': 'cipd',
   },
   'v8/tools/clang':
-    Var('chromium_url') + '/chromium/src/tools/clang.git' + '@' + '105a8460911176861a422738eee4daad8dfe88a2',
+    Var('chromium_url') + '/chromium/src/tools/clang.git' + '@' + '8b9091fe8fc8e919e99b014907b264b2d81f241b',
   'v8/tools/luci-go': {
       'packages': [
         {
@@ -266,11 +266,13 @@ deps = {
     'dep_type': 'cipd',
   },
   'v8/third_party/perfetto':
-    Var('android_url') + '/platform/external/perfetto.git' + '@' + 'b9b24d1b0b80aafec393af085067e9eae829412f',
+    Var('android_url') + '/platform/external/perfetto.git' + '@' + 'ff70e0d273ed10995866c803f23e11250eb3dc52',
   'v8/third_party/protobuf':
     Var('chromium_url') + '/external/github.com/google/protobuf'+ '@' + 'b68a347f56137b4b1a746e8c7438495a6ac1bd91',
   'v8/third_party/zlib':
-    Var('chromium_url') + '/chromium/src/third_party/zlib.git'+ '@' + '156be8c52f80cde343088b4a69a80579101b6e67',
+    Var('chromium_url') + '/chromium/src/third_party/zlib.git'+ '@' + 'f5eca0dc9b4525e975a5e862633ab38a06dc11b4',
+  'v8/third_party/jsoncpp/source':
+    Var('chromium_url') + '/external/github.com/open-source-parsers/jsoncpp.git'+ '@' + '645250b6690785be60ab6780ce4b58698d884d11',
   'v8/third_party/ittapi': {
     # Force checkout ittapi libraries to pass v8 header includes check on
     # bots that has check_v8_header_includes enabled.
diff --git a/deps/v8/INTL_OWNERS b/deps/v8/INTL_OWNERS
index dbe6f3b7b54..6e9f2cedb98 100644
--- a/deps/v8/INTL_OWNERS
+++ b/deps/v8/INTL_OWNERS
@@ -1,3 +1,4 @@
 cira@chromium.org
 mnita@google.com
 jshin@chromium.org
+ftang@chromium.org
diff --git a/deps/v8/WATCHLISTS b/deps/v8/WATCHLISTS
index 47470f49e42..54d6bbec1c5 100644
--- a/deps/v8/WATCHLISTS
+++ b/deps/v8/WATCHLISTS
@@ -33,10 +33,6 @@
 
 {
   'WATCHLIST_DEFINITIONS': {
-    'api': {
-      'filepath': 'include/' \
-                  '|src/api\.(cc|h)$',
-    },
     'snapshot': {
       'filepath': 'src/snapshot/',
     },
@@ -94,9 +90,6 @@
   },
 
   'WATCHLISTS': {
-    'api': [
-      'yangguo+watch@chromium.org',
-    ],
     'csa': [
       'jgruber+watch@chromium.org',
     ],
diff --git a/deps/v8/base/trace_event/common/trace_event_common.h b/deps/v8/base/trace_event/common/trace_event_common.h
index a7bffbdbeb4..28b7275345c 100644
--- a/deps/v8/base/trace_event/common/trace_event_common.h
+++ b/deps/v8/base/trace_event/common/trace_event_common.h
@@ -837,6 +837,14 @@
   INTERNAL_TRACE_EVENT_ADD_WITH_ID_TID_AND_TIMESTAMP(                     \
       TRACE_EVENT_PHASE_NESTABLE_ASYNC_INSTANT, category_group, name, id, \
       TRACE_EVENT_API_CURRENT_THREAD_ID, timestamp, TRACE_EVENT_FLAG_NONE)
+#define TRACE_EVENT_COPY_NESTABLE_ASYNC_BEGIN0(category_group, name, id)   \
+  INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_NESTABLE_ASYNC_BEGIN, \
+                                   category_group, name, id,               \
+                                   TRACE_EVENT_FLAG_COPY)
+#define TRACE_EVENT_COPY_NESTABLE_ASYNC_END0(category_group, name, id)   \
+  INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_NESTABLE_ASYNC_END, \
+                                   category_group, name, id,             \
+                                   TRACE_EVENT_FLAG_COPY)
 #define TRACE_EVENT_COPY_NESTABLE_ASYNC_BEGIN_WITH_TIMESTAMP0(          \
     category_group, name, id, timestamp)                                \
   INTERNAL_TRACE_EVENT_ADD_WITH_ID_TID_AND_TIMESTAMP(                   \
diff --git a/deps/v8/build_overrides/build.gni b/deps/v8/build_overrides/build.gni
index 5b99eb94022..dde92c46eaa 100644
--- a/deps/v8/build_overrides/build.gni
+++ b/deps/v8/build_overrides/build.gni
@@ -16,6 +16,14 @@ perfetto_build_with_embedder = true
 perfetto_protobuf_target_prefix = "//"
 perfetto_protobuf_gni = "//gni/proto_library.gni"
 
+# We use Perfetto's Trace Processor to convert traces to the legacy JSON
+# format.
+enable_perfetto_trace_processor = true
+
+# When building with chromium, determines whether we want to also use the
+# perfetto library from chromium instead declaring our own.
+use_perfetto_client_library = false
+
 # Uncomment these to specify a different NDK location and version in
 # non-Chromium builds.
 # default_android_ndk_root = "//third_party/android_ndk"
diff --git a/deps/v8/gni/v8.gni b/deps/v8/gni/v8.gni
index 0b2806ca949..9d286ebbfc0 100644
--- a/deps/v8/gni/v8.gni
+++ b/deps/v8/gni/v8.gni
@@ -54,8 +54,7 @@ declare_args() {
   # Expose symbols for dynamic linking.
   v8_expose_symbols = false
 
-  # Use Perfetto (https://perfetto.dev) as the default TracingController. Not
-  # currently implemented.
+  # Implement tracing using Perfetto (https://perfetto.dev).
   v8_use_perfetto = false
 
   # Override global symbol level setting for v8
@@ -82,6 +81,12 @@ if (v8_enable_backtrace == "") {
   v8_enable_backtrace = is_debug && !v8_optimized_debug
 }
 
+# If chromium is configured to use the perfetto client library, v8 should also
+# use perfetto for tracing.
+if (build_with_chromium && use_perfetto_client_library) {
+  v8_use_perfetto = true
+}
+
 # Points to // in v8 stand-alone or to //v8/ in chromium. We need absolute
 # paths for all configs in templates as they are shared in different
 # subdirectories.
diff --git a/deps/v8/include/DEPS b/deps/v8/include/DEPS
index ca60f841f53..7305ff51125 100644
--- a/deps/v8/include/DEPS
+++ b/deps/v8/include/DEPS
@@ -1,4 +1,5 @@
 include_rules = [
   # v8-inspector-protocol.h depends on generated files under include/inspector.
   "+inspector",
+  "+cppgc/common.h",
 ]
diff --git a/deps/v8/include/OWNERS b/deps/v8/include/OWNERS
index 4f90a5c8c70..a61f6ed48ed 100644
--- a/deps/v8/include/OWNERS
+++ b/deps/v8/include/OWNERS
@@ -16,4 +16,9 @@ per-file v8-inspector-protocol.h=kozyatinskiy@chromium.org
 per-file js_protocol.pdl=dgozman@chromium.org
 per-file js_protocol.pdl=pfeldman@chromium.org
 
+# For branch updates:
+per-file v8-version.h=file:../INFRA_OWNERS
+per-file v8-version.h=hablich@chromium.org
+per-file v8-version.h=vahl@chromium.org
+
 # COMPONENT: Blink>JavaScript>API
diff --git a/deps/v8/include/cppgc/DEPS b/deps/v8/include/cppgc/DEPS
new file mode 100644
index 00000000000..04c343de27c
--- /dev/null
+++ b/deps/v8/include/cppgc/DEPS
@@ -0,0 +1,7 @@
+include_rules = [
+  "-include",
+  "+v8config.h",
+  "+v8-platform.h",
+  "+cppgc",
+  "-src",
+]
diff --git a/deps/v8/include/cppgc/allocation.h b/deps/v8/include/cppgc/allocation.h
index 3e717ad7d42..49ad49c34d6 100644
--- a/deps/v8/include/cppgc/allocation.h
+++ b/deps/v8/include/cppgc/allocation.h
@@ -6,12 +6,14 @@
 #define INCLUDE_CPPGC_ALLOCATION_H_
 
 #include <stdint.h>
+
 #include <atomic>
 
-#include "include/cppgc/garbage-collected.h"
-#include "include/cppgc/gc-info.h"
-#include "include/cppgc/heap.h"
-#include "include/cppgc/internals.h"
+#include "cppgc/custom-space.h"
+#include "cppgc/garbage-collected.h"
+#include "cppgc/heap.h"
+#include "cppgc/internal/api-constants.h"
+#include "cppgc/internal/gc-info.h"
 
 namespace cppgc {
 
@@ -35,36 +37,80 @@ class V8_EXPORT MakeGarbageCollectedTraitInternal {
   }
 
   static void* Allocate(cppgc::Heap* heap, size_t size, GCInfoIndex index);
+  static void* Allocate(cppgc::Heap* heapx, size_t size, GCInfoIndex index,
+                        CustomSpaceIndex space_inde);
 
   friend class HeapObjectHeader;
 };
 
 }  // namespace internal
 
-// Users with custom allocation needs (e.g. overriding size) should override
-// MakeGarbageCollectedTrait (see below) and inherit their trait from
-// MakeGarbageCollectedTraitBase to get access to low-level primitives.
+/**
+ * Base trait that provides utilities for advancers users that have custom
+ * allocation needs (e.g., overriding size). It's expected that users override
+ * MakeGarbageCollectedTrait (see below) and inherit from
+ * MakeGarbageCollectedTraitBase and make use of the low-level primitives
+ * offered to allocate and construct an object.
+ */
 template <typename T>
 class MakeGarbageCollectedTraitBase
     : private internal::MakeGarbageCollectedTraitInternal {
+ private:
+  template <typename U, typename CustomSpace>
+  struct SpacePolicy {
+    static void* Allocate(Heap* heap, size_t size) {
+      // Custom space.
+      static_assert(std::is_base_of<CustomSpaceBase, CustomSpace>::value,
+                    "Custom space must inherit from CustomSpaceBase.");
+      return internal::MakeGarbageCollectedTraitInternal::Allocate(
+          heap, size, internal::GCInfoTrait<T>::Index(),
+          CustomSpace::kSpaceIndex);
+    }
+  };
+
+  template <typename U>
+  struct SpacePolicy<U, void> {
+    static void* Allocate(Heap* heap, size_t size) {
+      // Default space.
+      return internal::MakeGarbageCollectedTraitInternal::Allocate(
+          heap, size, internal::GCInfoTrait<T>::Index());
+    }
+  };
+
  protected:
-  // Allocates an object of |size| bytes on |heap|.
-  //
-  // TODO(mlippautz): Allow specifying arena for specific embedder uses.
+  /**
+   * Allocates memory for an object of type T.
+   *
+   * \param heap The heap to allocate this object on.
+   * \param size The size that should be reserved for the object.
+   * \returns the memory to construct an object of type T on.
+   */
   static void* Allocate(Heap* heap, size_t size) {
-    return internal::MakeGarbageCollectedTraitInternal::Allocate(
-        heap, size, internal::GCInfoTrait<T>::Index());
+    return SpacePolicy<T, typename SpaceTrait<T>::Space>::Allocate(heap, size);
   }
 
-  // Marks an object as being fully constructed, resulting in precise handling
-  // by the garbage collector.
+  /**
+   * Marks an object as fully constructed, resulting in precise handling by the
+   * garbage collector.
+   *
+   * \param payload The base pointer the object is allocated at.
+   */
   static void MarkObjectAsFullyConstructed(const void* payload) {
-    // internal::MarkObjectAsFullyConstructed(payload);
     internal::MakeGarbageCollectedTraitInternal::MarkObjectAsFullyConstructed(
         payload);
   }
 };
 
+/**
+ * Default trait class that specifies how to construct an object of type T.
+ * Advanced users may override how an object is constructed using the utilities
+ * that are provided through MakeGarbageCollectedTraitBase.
+ *
+ * Any trait overriding construction must
+ * - allocate through MakeGarbageCollectedTraitBase<T>::Allocate;
+ * - mark the object as fully constructed using
+ *   MakeGarbageCollectedTraitBase<T>::MarkObjectAsFullyConstructed;
+ */
 template <typename T>
 class MakeGarbageCollectedTrait : public MakeGarbageCollectedTraitBase<T> {
  public:
@@ -72,6 +118,10 @@ class MakeGarbageCollectedTrait : public MakeGarbageCollectedTraitBase<T> {
   static T* Call(Heap* heap, Args&&... args) {
     static_assert(internal::IsGarbageCollectedType<T>::value,
                   "T needs to be a garbage collected object");
+    static_assert(
+        !internal::IsGarbageCollectedMixinType<T>::value ||
+            sizeof(T) <= internal::api_constants::kLargeObjectSizeThreshold,
+        "GarbageCollectedMixin may not be a large object");
     void* memory = MakeGarbageCollectedTraitBase<T>::Allocate(heap, sizeof(T));
     T* object = ::new (memory) T(std::forward<Args>(args)...);
     MakeGarbageCollectedTraitBase<T>::MarkObjectAsFullyConstructed(object);
@@ -79,11 +129,31 @@ class MakeGarbageCollectedTrait : public MakeGarbageCollectedTraitBase<T> {
   }
 };
 
-// Default MakeGarbageCollected: Constructs an instance of T, which is a garbage
-// collected type.
+/**
+ * Allows users to specify a post-construction callback for specific types. The
+ * callback is invoked on the instance of type T right after it has been
+ * constructed. This can be useful when the callback requires a
+ * fully-constructed object to be able to dispatch to virtual methods.
+ */
+template <typename T, typename = void>
+struct PostConstructionCallbackTrait {
+  static void Call(T*) {}
+};
+
+/**
+ * Constructs a managed object of type T where T transitively inherits from
+ * GarbageCollected.
+ *
+ * \param args List of arguments with which an instance of T will be
+ *   constructed.
+ * \returns an instance of type T.
+ */
 template <typename T, typename... Args>
 T* MakeGarbageCollected(Heap* heap, Args&&... args) {
-  return MakeGarbageCollectedTrait<T>::Call(heap, std::forward<Args>(args)...);
+  T* object =
+      MakeGarbageCollectedTrait<T>::Call(heap, std::forward<Args>(args)...);
+  PostConstructionCallbackTrait<T>::Call(object);
+  return object;
 }
 
 }  // namespace cppgc
diff --git a/deps/v8/include/cppgc/common.h b/deps/v8/include/cppgc/common.h
new file mode 100644
index 00000000000..228b9abb74e
--- /dev/null
+++ b/deps/v8/include/cppgc/common.h
@@ -0,0 +1,26 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_COMMON_H_
+#define INCLUDE_CPPGC_COMMON_H_
+
+// TODO(chromium:1056170): Remove dependency on v8.
+#include "v8config.h"  // NOLINT(build/include_directory)
+
+namespace cppgc {
+
+// Indicator for the stack state of the embedder.
+enum class EmbedderStackState {
+  kMayContainHeapPointers,
+  kNoHeapPointers,
+  kUnknown V8_ENUM_DEPRECATE_SOON("Use kMayContainHeapPointers") =
+      kMayContainHeapPointers,
+  kNonEmpty V8_ENUM_DEPRECATE_SOON("Use kMayContainHeapPointers") =
+      kMayContainHeapPointers,
+  kEmpty V8_ENUM_DEPRECATE_SOON("Use kNoHeapPointers") = kNoHeapPointers,
+};
+
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_COMMON_H_
diff --git a/deps/v8/include/cppgc/custom-space.h b/deps/v8/include/cppgc/custom-space.h
new file mode 100644
index 00000000000..2597a5bdef7
--- /dev/null
+++ b/deps/v8/include/cppgc/custom-space.h
@@ -0,0 +1,62 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_CUSTOM_SPACE_H_
+#define INCLUDE_CPPGC_CUSTOM_SPACE_H_
+
+#include <stddef.h>
+
+namespace cppgc {
+
+struct CustomSpaceIndex {
+  CustomSpaceIndex(size_t value) : value(value) {}  // NOLINT
+  size_t value;
+};
+
+/**
+ * Top-level base class for custom spaces. Users must inherit from CustomSpace
+ * below.
+ */
+class CustomSpaceBase {
+ public:
+  virtual ~CustomSpaceBase() = default;
+  virtual CustomSpaceIndex GetCustomSpaceIndex() const = 0;
+};
+
+/**
+ * Base class custom spaces should directly inherit from. The class inheriting
+ * from CustomSpace must define kSpaceIndex as unique space index. These
+ * indices need for form a sequence starting at 0.
+ *
+ * Example:
+ * \code
+ * class CustomSpace1 : public CustomSpace<CustomSpace1> {
+ *  public:
+ *   static constexpr CustomSpaceIndex kSpaceIndex = 0;
+ * };
+ * class CustomSpace2 : public CustomSpace<CustomSpace2> {
+ *  public:
+ *   static constexpr CustomSpaceIndex kSpaceIndex = 1;
+ * };
+ * \endcode
+ */
+template <typename ConcreteCustomSpace>
+class CustomSpace : public CustomSpaceBase {
+ public:
+  CustomSpaceIndex GetCustomSpaceIndex() const final {
+    return ConcreteCustomSpace::kSpaceIndex;
+  }
+};
+
+/**
+ * User-overridable trait that allows pinning types to custom spaces.
+ */
+template <typename T, typename = void>
+struct SpaceTrait {
+  using Space = void;
+};
+
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_CUSTOM_SPACE_H_
diff --git a/deps/v8/include/cppgc/garbage-collected.h b/deps/v8/include/cppgc/garbage-collected.h
index 6c62daafdc5..299b861d845 100644
--- a/deps/v8/include/cppgc/garbage-collected.h
+++ b/deps/v8/include/cppgc/garbage-collected.h
@@ -7,31 +7,19 @@
 
 #include <type_traits>
 
-#include "include/cppgc/internals.h"
-#include "include/cppgc/platform.h"
+#include "cppgc/internal/api-constants.h"
+#include "cppgc/platform.h"
+#include "cppgc/trace-trait.h"
+#include "cppgc/type-traits.h"
 
 namespace cppgc {
-namespace internal {
-
-template <typename T, typename = void>
-struct IsGarbageCollectedType : std::false_type {
-  static_assert(sizeof(T), "T must be fully defined");
-};
 
-template <typename T>
-struct IsGarbageCollectedType<
-    T, void_t<typename std::remove_const_t<T>::IsGarbageCollectedTypeMarker>>
-    : std::true_type {
-  static_assert(sizeof(T), "T must be fully defined");
-};
+class Visitor;
 
-}  // namespace internal
+namespace internal {
 
-template <typename>
-class GarbageCollected {
+class GarbageCollectedBase {
  public:
-  using IsGarbageCollectedTypeMarker = void;
-
   // Must use MakeGarbageCollected.
   void* operator new(size_t) = delete;
   void* operator new[](size_t) = delete;
@@ -44,10 +32,160 @@ class GarbageCollected {
   }
   void operator delete[](void*) = delete;
 
+ protected:
+  GarbageCollectedBase() = default;
+};
+
+}  // namespace internal
+
+/**
+ * Base class for managed objects. Only descendent types of GarbageCollected
+ * can be constructed using MakeGarbageCollected. Must be inherited from as
+ * left-most base class.
+ *
+ * Types inheriting from GarbageCollected must provide a method of
+ * signature `void Trace(cppgc::Visitor*) const` that dispatchs all managed
+ * pointers to the visitor and delegates to garbage-collected base classes.
+ * The method must be virtual if the type is not directly a child of
+ * GarbageCollected and marked as final.
+ *
+ * \code
+ * // Example using final class.
+ * class FinalType final : public GarbageCollected<FinalType> {
+ *  public:
+ *   void Trace(cppgc::Visitor* visitor) const {
+ *     // Dispatch using visitor->Trace(...);
+ *   }
+ * };
+ *
+ * // Example using non-final base class.
+ * class NonFinalBase : public GarbageCollected<NonFinalBase> {
+ *  public:
+ *   virtual void Trace(cppgc::Visitor*) const {}
+ * };
+ *
+ * class FinalChild final : public NonFinalBase {
+ *  public:
+ *   void Trace(cppgc::Visitor* visitor) const final {
+ *     // Dispatch using visitor->Trace(...);
+ *     NonFinalBase::Trace(visitor);
+ *   }
+ * };
+ * \endcode
+ */
+template <typename>
+class GarbageCollected : public internal::GarbageCollectedBase {
+ public:
+  using IsGarbageCollectedTypeMarker = void;
+
  protected:
   GarbageCollected() = default;
 };
 
+/**
+ * Base class for managed mixin objects. Such objects cannot be constructed
+ * directly but must be mixed into the inheritance hierarchy of a
+ * GarbageCollected object.
+ *
+ * Types inheriting from GarbageCollectedMixin must override a virtual method
+ * of signature `void Trace(cppgc::Visitor*) const` that dispatchs all managed
+ * pointers to the visitor and delegates to base classes.
+ *
+ * \code
+ * class Mixin : public GarbageCollectedMixin {
+ *  public:
+ *   void Trace(cppgc::Visitor* visitor) const override {
+ *     // Dispatch using visitor->Trace(...);
+ *   }
+ * };
+ * \endcode
+ */
+class GarbageCollectedMixin : public internal::GarbageCollectedBase {
+ public:
+  using IsGarbageCollectedMixinTypeMarker = void;
+
+  // Sentinel used to mark not-fully-constructed mixins.
+  static constexpr void* kNotFullyConstructedObject = nullptr;
+
+  // Provide default implementation that indicate that the vtable is not yet
+  // set up properly. This is used to to get GCInfo objects for mixins so that
+  // these objects can be processed later on.
+  virtual TraceDescriptor GetTraceDescriptor() const {
+    return {kNotFullyConstructedObject, nullptr};
+  }
+
+  /**
+   * This Trace method must be overriden by objects inheriting from
+   * GarbageCollectedMixin.
+   */
+  virtual void Trace(cppgc::Visitor*) const {}
+};
+
+/**
+ * Macro defines all methods and markers needed for handling mixins. Must be
+ * used on the type that is inheriting from GarbageCollected *and*
+ * GarbageCollectedMixin.
+ *
+ * \code
+ * class Mixin : public GarbageCollectedMixin {
+ *  public:
+ *   void Trace(cppgc::Visitor* visitor) const override {
+ *     // Dispatch using visitor->Trace(...);
+ *   }
+ * };
+ *
+ * class Foo : public GarbageCollected<Foo>, public Mixin {
+ *   USING_GARBAGE_COLLECTED_MIXIN();
+ *  public:
+ *   void Trace(cppgc::Visitor* visitor) const override {
+ *     // Dispatch using visitor->Trace(...);
+ *     Mixin::Trace(visitor);
+ *   }
+ * };
+ * \endcode
+ */
+#define USING_GARBAGE_COLLECTED_MIXIN()                                      \
+ public:                                                                     \
+  /* Marker is used by clang to check for proper usages of the macro. */     \
+  typedef int HasUsingGarbageCollectedMixinMacro;                            \
+                                                                             \
+  TraceDescriptor GetTraceDescriptor() const override {                      \
+    static_assert(                                                           \
+        internal::IsSubclassOfTemplate<                                      \
+            std::remove_const_t<std::remove_pointer_t<decltype(this)>>,      \
+            cppgc::GarbageCollected>::value,                                 \
+        "Only garbage collected objects can have garbage collected mixins"); \
+    return {this, TraceTrait<std::remove_const_t<                            \
+                      std::remove_pointer_t<decltype(this)>>>::Trace};       \
+  }                                                                          \
+                                                                             \
+ private:                                                                    \
+  static_assert(true, "Force semicolon.")
+
+/**
+ * Merge two or more Mixins into one.
+ *
+ * \code
+ * class A : public GarbageCollectedMixin {};
+ * class B : public GarbageCollectedMixin {};
+ * class C : public A, public B {
+ *   MERGE_GARBAGE_COLLECTED_MIXINS();
+ *  public:
+ * };
+ * \endcode
+ */
+#define MERGE_GARBAGE_COLLECTED_MIXINS()                \
+ public:                                                \
+  /* When using multiple mixins the methods become  */  \
+  /* ambigous. Providing additional implementations */  \
+  /* disambiguate them again.                       */  \
+  TraceDescriptor GetTraceDescriptor() const override { \
+    return {kNotFullyConstructedObject, nullptr};       \
+  }                                                     \
+                                                        \
+ private:                                               \
+  static_assert(true, "Force semicolon.")
+
 }  // namespace cppgc
 
 #endif  // INCLUDE_CPPGC_GARBAGE_COLLECTED_H_
diff --git a/deps/v8/include/cppgc/heap.h b/deps/v8/include/cppgc/heap.h
index a0568d534fb..d24b63e517e 100644
--- a/deps/v8/include/cppgc/heap.h
+++ b/deps/v8/include/cppgc/heap.h
@@ -6,20 +6,75 @@
 #define INCLUDE_CPPGC_HEAP_H_
 
 #include <memory>
+#include <vector>
 
-#include "include/v8config.h"
+#include "cppgc/common.h"
+#include "cppgc/custom-space.h"
+#include "cppgc/platform.h"
+#include "v8config.h"  // NOLINT(build/include_directory)
 
+/**
+ * cppgc - A C++ garbage collection library.
+ */
 namespace cppgc {
+
 namespace internal {
 class Heap;
 }  // namespace internal
 
 class V8_EXPORT Heap {
  public:
-  static std::unique_ptr<Heap> Create();
+  /**
+   * Specifies the stack state the embedder is in.
+   */
+  using StackState = EmbedderStackState;
+
+  /**
+   * Options specifying Heap properties (e.g. custom spaces) when initializing a
+   * heap through Heap::Create().
+   */
+  struct HeapOptions {
+    /**
+     * Creates reasonable defaults for instantiating a Heap.
+     *
+     * \returns the HeapOptions that can be passed to Heap::Create().
+     */
+    static HeapOptions Default() { return {}; }
+
+    /**
+     * Custom spaces added to heap are required to have indices forming a
+     * numbered sequence starting at 0, i.e., their kSpaceIndex must correspond
+     * to the index they reside in the vector.
+     */
+    std::vector<std::unique_ptr<CustomSpaceBase>> custom_spaces;
+  };
+
+  /**
+   * Creates a new heap that can be used for object allocation.
+   *
+   * \param platform implemented and provided by the embedder.
+   * \param options HeapOptions specifying various properties for the Heap.
+   * \returns a new Heap instance.
+   */
+  static std::unique_ptr<Heap> Create(
+      std::shared_ptr<Platform> platform,
+      HeapOptions options = HeapOptions::Default());
 
   virtual ~Heap() = default;
 
+  /**
+   * Forces garbage collection.
+   *
+   * \param source String specifying the source (or caller) triggering a
+   *   forced garbage collection.
+   * \param reason String specifying the reason for the forced garbage
+   *   collection.
+   * \param stack_state The embedder stack state, see StackState.
+   */
+  void ForceGarbageCollectionSlow(
+      const char* source, const char* reason,
+      StackState stack_state = StackState::kMayContainHeapPointers);
+
  private:
   Heap() = default;
 
diff --git a/deps/v8/include/cppgc/internal/accessors.h b/deps/v8/include/cppgc/internal/accessors.h
new file mode 100644
index 00000000000..ee0a0042fe0
--- /dev/null
+++ b/deps/v8/include/cppgc/internal/accessors.h
@@ -0,0 +1,26 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_INTERNAL_ACCESSORS_H_
+#define INCLUDE_CPPGC_INTERNAL_ACCESSORS_H_
+
+#include "cppgc/internal/api-constants.h"
+
+namespace cppgc {
+
+class Heap;
+
+namespace internal {
+
+inline cppgc::Heap* GetHeapFromPayload(const void* payload) {
+  return *reinterpret_cast<cppgc::Heap**>(
+      ((reinterpret_cast<uintptr_t>(payload) & api_constants::kPageBaseMask) +
+       api_constants::kGuardPageSize) +
+      api_constants::kHeapOffset);
+}
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_INTERNAL_ACCESSORS_H_
diff --git a/deps/v8/include/cppgc/internals.h b/deps/v8/include/cppgc/internal/api-constants.h
similarity index 57%
rename from deps/v8/include/cppgc/internals.h
rename to deps/v8/include/cppgc/internal/api-constants.h
index 1e57779758b..ef910a48571 100644
--- a/deps/v8/include/cppgc/internals.h
+++ b/deps/v8/include/cppgc/internal/api-constants.h
@@ -2,25 +2,17 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef INCLUDE_CPPGC_INTERNALS_H_
-#define INCLUDE_CPPGC_INTERNALS_H_
+#ifndef INCLUDE_CPPGC_INTERNAL_API_CONSTANTS_H_
+#define INCLUDE_CPPGC_INTERNAL_API_CONSTANTS_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
-#include "include/v8config.h"
+#include "v8config.h"  // NOLINT(build/include_directory)
 
 namespace cppgc {
 namespace internal {
 
-// Pre-C++17 custom implementation of std::void_t.
-template <typename... Ts>
-struct make_void {
-  typedef void type;
-};
-template <typename... Ts>
-using void_t = typename make_void<Ts...>::type;
-
 // Embedders should not rely on this code!
 
 // Internal constants to avoid exposing internal types on the API surface.
@@ -33,9 +25,20 @@ static constexpr size_t kFullyConstructedBitFieldOffsetFromPayload =
 // Mask for in-construction bit.
 static constexpr size_t kFullyConstructedBitMask = size_t{1};
 
+// Page constants used to align pointers to page begin.
+static constexpr size_t kPageSize = size_t{1} << 17;
+static constexpr size_t kPageAlignment = kPageSize;
+static constexpr size_t kPageBaseMask = ~(kPageAlignment - 1);
+static constexpr size_t kGuardPageSize = 4096;
+
+// Offset of the Heap backref.
+static constexpr size_t kHeapOffset = 0;
+
+static constexpr size_t kLargeObjectSizeThreshold = kPageSize / 2;
+
 }  // namespace api_constants
 
 }  // namespace internal
 }  // namespace cppgc
 
-#endif  // INCLUDE_CPPGC_INTERNALS_H_
+#endif  // INCLUDE_CPPGC_INTERNAL_API_CONSTANTS_H_
diff --git a/deps/v8/include/cppgc/internal/compiler-specific.h b/deps/v8/include/cppgc/internal/compiler-specific.h
new file mode 100644
index 00000000000..e1f5c1d57fb
--- /dev/null
+++ b/deps/v8/include/cppgc/internal/compiler-specific.h
@@ -0,0 +1,26 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_INTERNAL_COMPILER_SPECIFIC_H_
+#define INCLUDE_CPPGC_INTERNAL_COMPILER_SPECIFIC_H_
+
+namespace cppgc {
+
+#if defined(__has_cpp_attribute)
+#define CPPGC_HAS_CPP_ATTRIBUTE(FEATURE) __has_cpp_attribute(FEATURE)
+#else
+#define CPPGC_HAS_CPP_ATTRIBUTE(FEATURE) 0
+#endif
+
+// [[no_unique_address]] comes in C++20 but supported in clang with -std >=
+// c++11.
+#if CPPGC_HAS_CPP_ATTRIBUTE(no_unique_address)  // NOLINTNEXTLINE
+#define CPPGC_NO_UNIQUE_ADDRESS [[no_unique_address]]
+#else
+#define CPPGC_NO_UNIQUE_ADDRESS
+#endif
+
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_INTERNAL_COMPILER_SPECIFIC_H_
diff --git a/deps/v8/include/cppgc/finalizer-trait.h b/deps/v8/include/cppgc/internal/finalizer-trait.h
similarity index 92%
rename from deps/v8/include/cppgc/finalizer-trait.h
rename to deps/v8/include/cppgc/internal/finalizer-trait.h
index 12216ed84ed..a95126591cb 100644
--- a/deps/v8/include/cppgc/finalizer-trait.h
+++ b/deps/v8/include/cppgc/internal/finalizer-trait.h
@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef INCLUDE_CPPGC_FINALIZER_TRAIT_H_
-#define INCLUDE_CPPGC_FINALIZER_TRAIT_H_
+#ifndef INCLUDE_CPPGC_INTERNAL_FINALIZER_TRAIT_H_
+#define INCLUDE_CPPGC_INTERNAL_FINALIZER_TRAIT_H_
 
 #include <type_traits>
 
-#include "include/cppgc/internals.h"
+#include "cppgc/type-traits.h"
 
 namespace cppgc {
 namespace internal {
@@ -87,4 +87,4 @@ constexpr FinalizationCallback FinalizerTrait<T>::kCallback;
 }  // namespace internal
 }  // namespace cppgc
 
-#endif  // INCLUDE_CPPGC_FINALIZER_TRAIT_H_
+#endif  // INCLUDE_CPPGC_INTERNAL_FINALIZER_TRAIT_H_
diff --git a/deps/v8/include/cppgc/gc-info.h b/deps/v8/include/cppgc/internal/gc-info.h
similarity index 66%
rename from deps/v8/include/cppgc/gc-info.h
rename to deps/v8/include/cppgc/internal/gc-info.h
index 987ba34fa42..3d361e6d71a 100644
--- a/deps/v8/include/cppgc/gc-info.h
+++ b/deps/v8/include/cppgc/internal/gc-info.h
@@ -2,13 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef INCLUDE_CPPGC_GC_INFO_H_
-#define INCLUDE_CPPGC_GC_INFO_H_
+#ifndef INCLUDE_CPPGC_INTERNAL_GC_INFO_H_
+#define INCLUDE_CPPGC_INTERNAL_GC_INFO_H_
 
 #include <stdint.h>
 
-#include "include/cppgc/finalizer-trait.h"
-#include "include/v8config.h"
+#include "cppgc/internal/finalizer-trait.h"
+#include "cppgc/trace-trait.h"
+#include "v8config.h"  // NOLINT(build/include_directory)
 
 namespace cppgc {
 namespace internal {
@@ -18,7 +19,7 @@ using GCInfoIndex = uint16_t;
 class V8_EXPORT RegisteredGCInfoIndex final {
  public:
   RegisteredGCInfoIndex(FinalizationCallback finalization_callback,
-                        bool has_v_table);
+                        TraceCallback trace_callback, bool has_v_table);
   GCInfoIndex GetIndex() const { return index_; }
 
  private:
@@ -32,7 +33,8 @@ struct GCInfoTrait {
   static GCInfoIndex Index() {
     static_assert(sizeof(T), "T must be fully defined");
     static const RegisteredGCInfoIndex registered_index(
-        FinalizerTrait<T>::kCallback, std::is_polymorphic<T>::value);
+        FinalizerTrait<T>::kCallback, TraceTrait<T>::Trace,
+        std::is_polymorphic<T>::value);
     return registered_index.GetIndex();
   }
 };
@@ -40,4 +42,4 @@ struct GCInfoTrait {
 }  // namespace internal
 }  // namespace cppgc
 
-#endif  // INCLUDE_CPPGC_GC_INFO_H_
+#endif  // INCLUDE_CPPGC_INTERNAL_GC_INFO_H_
diff --git a/deps/v8/include/cppgc/internal/logging.h b/deps/v8/include/cppgc/internal/logging.h
new file mode 100644
index 00000000000..79beaef7d4f
--- /dev/null
+++ b/deps/v8/include/cppgc/internal/logging.h
@@ -0,0 +1,50 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_INTERNAL_LOGGING_H_
+#define INCLUDE_CPPGC_INTERNAL_LOGGING_H_
+
+#include "cppgc/source-location.h"
+#include "v8config.h"  // NOLINT(build/include_directory)
+
+namespace cppgc {
+namespace internal {
+
+void V8_EXPORT DCheckImpl(const char*,
+                          const SourceLocation& = SourceLocation::Current());
+[[noreturn]] void V8_EXPORT
+FatalImpl(const char*, const SourceLocation& = SourceLocation::Current());
+
+// Used to ignore -Wunused-variable.
+template <typename>
+struct EatParams {};
+
+#if DEBUG
+#define CPPGC_DCHECK_MSG(condition, message)  \
+  do {                                        \
+    if (V8_UNLIKELY(!(condition))) {          \
+      ::cppgc::internal::DCheckImpl(message); \
+    }                                         \
+  } while (false)
+#else
+#define CPPGC_DCHECK_MSG(condition, message)                \
+  (static_cast<void>(::cppgc::internal::EatParams<decltype( \
+                         static_cast<void>(condition), message)>{}))
+#endif
+
+#define CPPGC_DCHECK(condition) CPPGC_DCHECK_MSG(condition, #condition)
+
+#define CPPGC_CHECK_MSG(condition, message)  \
+  do {                                       \
+    if (V8_UNLIKELY(!(condition))) {         \
+      ::cppgc::internal::FatalImpl(message); \
+    }                                        \
+  } while (false)
+
+#define CPPGC_CHECK(condition) CPPGC_CHECK_MSG(condition, #condition)
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_INTERNAL_LOGGING_H_
diff --git a/deps/v8/include/cppgc/internal/persistent-node.h b/deps/v8/include/cppgc/internal/persistent-node.h
new file mode 100644
index 00000000000..11cf69623e8
--- /dev/null
+++ b/deps/v8/include/cppgc/internal/persistent-node.h
@@ -0,0 +1,109 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_INTERNAL_PERSISTENT_NODE_H_
+#define INCLUDE_CPPGC_INTERNAL_PERSISTENT_NODE_H_
+
+#include <array>
+#include <memory>
+#include <vector>
+
+#include "cppgc/internal/logging.h"
+#include "cppgc/trace-trait.h"
+#include "v8config.h"  // NOLINT(build/include_directory)
+
+namespace cppgc {
+
+class Visitor;
+
+namespace internal {
+
+// PersistentNode represesents a variant of two states:
+// 1) traceable node with a back pointer to the Persistent object;
+// 2) freelist entry.
+class PersistentNode final {
+ public:
+  PersistentNode() = default;
+
+  PersistentNode(const PersistentNode&) = delete;
+  PersistentNode& operator=(const PersistentNode&) = delete;
+
+  void InitializeAsUsedNode(void* owner, TraceCallback trace) {
+    owner_ = owner;
+    trace_ = trace;
+  }
+
+  void InitializeAsFreeNode(PersistentNode* next) {
+    next_ = next;
+    trace_ = nullptr;
+  }
+
+  void UpdateOwner(void* owner) {
+    CPPGC_DCHECK(IsUsed());
+    owner_ = owner;
+  }
+
+  PersistentNode* FreeListNext() const {
+    CPPGC_DCHECK(!IsUsed());
+    return next_;
+  }
+
+  void Trace(Visitor* visitor) const {
+    CPPGC_DCHECK(IsUsed());
+    trace_(visitor, owner_);
+  }
+
+  bool IsUsed() const { return trace_; }
+
+ private:
+  // PersistentNode acts as a designated union:
+  // If trace_ != nullptr, owner_ points to the corresponding Persistent handle.
+  // Otherwise, next_ points to the next freed PersistentNode.
+  union {
+    void* owner_ = nullptr;
+    PersistentNode* next_;
+  };
+  TraceCallback trace_ = nullptr;
+};
+
+class V8_EXPORT PersistentRegion {
+  using PersistentNodeSlots = std::array<PersistentNode, 256u>;
+
+ public:
+  PersistentRegion() = default;
+
+  PersistentRegion(const PersistentRegion&) = delete;
+  PersistentRegion& operator=(const PersistentRegion&) = delete;
+
+  PersistentNode* AllocateNode(void* owner, TraceCallback trace) {
+    if (!free_list_head_) {
+      EnsureNodeSlots();
+    }
+    PersistentNode* node = free_list_head_;
+    free_list_head_ = free_list_head_->FreeListNext();
+    node->InitializeAsUsedNode(owner, trace);
+    return node;
+  }
+
+  void FreeNode(PersistentNode* node) {
+    node->InitializeAsFreeNode(free_list_head_);
+    free_list_head_ = node;
+  }
+
+  void Trace(Visitor*);
+
+  size_t NodesInUse() const;
+
+ private:
+  void EnsureNodeSlots();
+
+  std::vector<std::unique_ptr<PersistentNodeSlots>> nodes_;
+  PersistentNode* free_list_head_ = nullptr;
+};
+
+}  // namespace internal
+
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_INTERNAL_PERSISTENT_NODE_H_
diff --git a/deps/v8/include/cppgc/internal/pointer-policies.h b/deps/v8/include/cppgc/internal/pointer-policies.h
new file mode 100644
index 00000000000..fe8d94b57a6
--- /dev/null
+++ b/deps/v8/include/cppgc/internal/pointer-policies.h
@@ -0,0 +1,133 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_INTERNAL_POINTER_POLICIES_H_
+#define INCLUDE_CPPGC_INTERNAL_POINTER_POLICIES_H_
+
+#include <cstdint>
+#include <type_traits>
+
+#include "cppgc/source-location.h"
+#include "v8config.h"  // NOLINT(build/include_directory)
+
+namespace cppgc {
+namespace internal {
+
+class PersistentRegion;
+
+// Tags to distinguish between strong and weak member types.
+class StrongMemberTag;
+class WeakMemberTag;
+class UntracedMemberTag;
+
+struct DijkstraWriteBarrierPolicy {
+  static void InitializingBarrier(const void*, const void*) {
+    // Since in initializing writes the source object is always white, having no
+    // barrier doesn't break the tri-color invariant.
+  }
+  static void AssigningBarrier(const void*, const void*) {
+    // TODO(chromium:1056170): Add actual implementation.
+  }
+};
+
+struct NoWriteBarrierPolicy {
+  static void InitializingBarrier(const void*, const void*) {}
+  static void AssigningBarrier(const void*, const void*) {}
+};
+
+class V8_EXPORT EnabledCheckingPolicy {
+ protected:
+  EnabledCheckingPolicy();
+  void CheckPointer(const void* ptr);
+
+ private:
+  void* impl_;
+};
+
+class DisabledCheckingPolicy {
+ protected:
+  void CheckPointer(const void* raw) {}
+};
+
+#if V8_ENABLE_CHECKS
+using DefaultCheckingPolicy = EnabledCheckingPolicy;
+#else
+using DefaultCheckingPolicy = DisabledCheckingPolicy;
+#endif
+
+class KeepLocationPolicy {
+ public:
+  constexpr const SourceLocation& Location() const { return location_; }
+
+ protected:
+  constexpr explicit KeepLocationPolicy(const SourceLocation& location)
+      : location_(location) {}
+
+  // KeepLocationPolicy must not copy underlying source locations.
+  KeepLocationPolicy(const KeepLocationPolicy&) = delete;
+  KeepLocationPolicy& operator=(const KeepLocationPolicy&) = delete;
+
+  // Location of the original moved from object should be preserved.
+  KeepLocationPolicy(KeepLocationPolicy&&) = default;
+  KeepLocationPolicy& operator=(KeepLocationPolicy&&) = default;
+
+ private:
+  SourceLocation location_;
+};
+
+class IgnoreLocationPolicy {
+ public:
+  constexpr SourceLocation Location() const { return {}; }
+
+ protected:
+  constexpr explicit IgnoreLocationPolicy(const SourceLocation&) {}
+};
+
+#if CPPGC_SUPPORTS_OBJECT_NAMES
+using DefaultLocationPolicy = KeepLocationPolicy;
+#else
+using DefaultLocationPolicy = IgnoreLocationPolicy;
+#endif
+
+struct StrongPersistentPolicy {
+  using IsStrongPersistent = std::true_type;
+
+  static V8_EXPORT PersistentRegion& GetPersistentRegion(void* object);
+};
+
+struct WeakPersistentPolicy {
+  using IsStrongPersistent = std::false_type;
+
+  static V8_EXPORT PersistentRegion& GetPersistentRegion(void* object);
+};
+
+// Persistent/Member forward declarations.
+template <typename T, typename WeaknessPolicy,
+          typename LocationPolicy = DefaultLocationPolicy,
+          typename CheckingPolicy = DefaultCheckingPolicy>
+class BasicPersistent;
+template <typename T, typename WeaknessTag, typename WriteBarrierPolicy,
+          typename CheckingPolicy = DefaultCheckingPolicy>
+class BasicMember;
+
+// Special tag type used to denote some sentinel member. The semantics of the
+// sentinel is defined by the embedder.
+struct SentinelPointer {
+  template <typename T>
+  operator T*() const {  // NOLINT
+    static constexpr intptr_t kSentinelValue = -1;
+    return reinterpret_cast<T*>(kSentinelValue);
+  }
+  // Hidden friends.
+  friend bool operator==(SentinelPointer, SentinelPointer) { return true; }
+  friend bool operator!=(SentinelPointer, SentinelPointer) { return false; }
+};
+
+}  // namespace internal
+
+constexpr internal::SentinelPointer kSentinelPointer;
+
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_INTERNAL_POINTER_POLICIES_H_
diff --git a/deps/v8/include/cppgc/internal/prefinalizer-handler.h b/deps/v8/include/cppgc/internal/prefinalizer-handler.h
new file mode 100644
index 00000000000..939a9b8ff0a
--- /dev/null
+++ b/deps/v8/include/cppgc/internal/prefinalizer-handler.h
@@ -0,0 +1,31 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_INTERNAL_PREFINALIZER_HANDLER_H_
+#define INCLUDE_CPPGC_INTERNAL_PREFINALIZER_HANDLER_H_
+
+#include "cppgc/heap.h"
+#include "cppgc/liveness-broker.h"
+
+namespace cppgc {
+namespace internal {
+
+class V8_EXPORT PreFinalizerRegistrationDispatcher final {
+ public:
+  using PreFinalizerCallback = bool (*)(const LivenessBroker&, void*);
+  struct PreFinalizer {
+    void* object_;
+    PreFinalizerCallback callback_;
+
+    bool operator==(const PreFinalizer& other);
+  };
+
+  static void RegisterPrefinalizer(cppgc::Heap* heap,
+                                   PreFinalizer prefinalzier);
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_INTERNAL_PREFINALIZER_HANDLER_H_
diff --git a/deps/v8/include/cppgc/liveness-broker.h b/deps/v8/include/cppgc/liveness-broker.h
new file mode 100644
index 00000000000..640a5519ff9
--- /dev/null
+++ b/deps/v8/include/cppgc/liveness-broker.h
@@ -0,0 +1,74 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_LIVENESS_BROKER_H_
+#define INCLUDE_CPPGC_LIVENESS_BROKER_H_
+
+#include "cppgc/heap.h"
+#include "cppgc/member.h"
+#include "cppgc/trace-trait.h"
+#include "v8config.h"  // NOLINT(build/include_directory)
+
+namespace cppgc {
+
+namespace internal {
+class LivenessBrokerFactory;
+}  // namespace internal
+
+/**
+ * The broker is passed to weak callbacks to allow (temporarily) querying
+ * the liveness state of an object. References to non-live objects must be
+ * cleared when IsHeapObjectAlive() returns false.
+ *
+ * \code
+ * class GCedWithCustomWeakCallback final
+ *   : public GarbageCollected<GCedWithCustomWeakCallback> {
+ *  public:
+ *   UntracedMember<Bar> bar;
+ *
+ *   void CustomWeakCallbackMethod(const LivenessBroker& broker) {
+ *     if (!broker.IsHeapObjectAlive(bar))
+ *       bar = nullptr;
+ *   }
+ *
+ *   void Trace(cppgc::Visitor* visitor) const {
+ *     visitor->RegisterWeakCallbackMethod<
+ *         GCedWithCustomWeakCallback,
+ *         &GCedWithCustomWeakCallback::CustomWeakCallbackMethod>(this);
+ *   }
+ * };
+ * \endcode
+ */
+class V8_EXPORT LivenessBroker final {
+ public:
+  template <typename T>
+  bool IsHeapObjectAlive(const T* object) const {
+    return object &&
+           IsHeapObjectAliveImpl(
+               TraceTrait<T>::GetTraceDescriptor(object).base_object_payload);
+  }
+
+  template <typename T>
+  bool IsHeapObjectAlive(const WeakMember<T>& weak_member) const {
+    return (weak_member != kSentinelPointer) &&
+           IsHeapObjectAlive<T>(weak_member.Get());
+  }
+
+  template <typename T>
+  bool IsHeapObjectAlive(const UntracedMember<T>& untraced_member) const {
+    return (untraced_member != kSentinelPointer) &&
+           IsHeapObjectAlive<T>(untraced_member.Get());
+  }
+
+ private:
+  LivenessBroker() = default;
+
+  bool IsHeapObjectAliveImpl(const void*) const;
+
+  friend class internal::LivenessBrokerFactory;
+};
+
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_LIVENESS_BROKER_H_
diff --git a/deps/v8/include/cppgc/macros.h b/deps/v8/include/cppgc/macros.h
new file mode 100644
index 00000000000..adff32e4246
--- /dev/null
+++ b/deps/v8/include/cppgc/macros.h
@@ -0,0 +1,22 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_MACROS_H_
+#define INCLUDE_CPPGC_MACROS_H_
+
+namespace cppgc {
+
+// Use if the object is only stack allocated.
+#define CPPGC_STACK_ALLOCATED()               \
+ public:                                      \
+  using IsStackAllocatedTypeMarker = int;     \
+                                              \
+ private:                                     \
+  void* operator new(size_t) = delete;        \
+  void* operator new(size_t, void*) = delete; \
+  static_assert(true, "Force semicolon.")
+
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_MACROS_H_
diff --git a/deps/v8/include/cppgc/member.h b/deps/v8/include/cppgc/member.h
new file mode 100644
index 00000000000..a183edb96fd
--- /dev/null
+++ b/deps/v8/include/cppgc/member.h
@@ -0,0 +1,206 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_MEMBER_H_
+#define INCLUDE_CPPGC_MEMBER_H_
+
+#include <atomic>
+#include <cstddef>
+#include <type_traits>
+
+#include "cppgc/internal/pointer-policies.h"
+#include "cppgc/type-traits.h"
+#include "v8config.h"  // NOLINT(build/include_directory)
+
+namespace cppgc {
+
+class Visitor;
+
+namespace internal {
+
+// The basic class from which all Member classes are 'generated'.
+template <typename T, typename WeaknessTag, typename WriteBarrierPolicy,
+          typename CheckingPolicy>
+class BasicMember : private CheckingPolicy {
+ public:
+  using PointeeType = T;
+
+  constexpr BasicMember() = default;
+  constexpr BasicMember(std::nullptr_t) {}     // NOLINT
+  BasicMember(SentinelPointer s) : raw_(s) {}  // NOLINT
+  BasicMember(T* raw) : raw_(raw) {            // NOLINT
+    InitializingWriteBarrier();
+    this->CheckPointer(raw_);
+  }
+  BasicMember(T& raw) : BasicMember(&raw) {}  // NOLINT
+  BasicMember(const BasicMember& other) : BasicMember(other.Get()) {}
+  // Allow heterogeneous construction.
+  template <typename U, typename OtherBarrierPolicy, typename OtherWeaknessTag,
+            typename OtherCheckingPolicy,
+            typename = std::enable_if_t<std::is_base_of<T, U>::value>>
+  BasicMember(  // NOLINT
+      const BasicMember<U, OtherWeaknessTag, OtherBarrierPolicy,
+                        OtherCheckingPolicy>& other)
+      : BasicMember(other.Get()) {}
+  // Construction from Persistent.
+  template <typename U, typename PersistentWeaknessPolicy,
+            typename PersistentLocationPolicy,
+            typename PersistentCheckingPolicy,
+            typename = std::enable_if_t<std::is_base_of<T, U>::value>>
+  BasicMember(  // NOLINT
+      const BasicPersistent<U, PersistentWeaknessPolicy,
+                            PersistentLocationPolicy, PersistentCheckingPolicy>&
+          p)
+      : BasicMember(p.Get()) {}
+
+  BasicMember& operator=(const BasicMember& other) {
+    return operator=(other.Get());
+  }
+  // Allow heterogeneous assignment.
+  template <typename U, typename OtherWeaknessTag, typename OtherBarrierPolicy,
+            typename OtherCheckingPolicy,
+            typename = std::enable_if_t<std::is_base_of<T, U>::value>>
+  BasicMember& operator=(
+      const BasicMember<U, OtherWeaknessTag, OtherBarrierPolicy,
+                        OtherCheckingPolicy>& other) {
+    return operator=(other.Get());
+  }
+  // Assignment from Persistent.
+  template <typename U, typename PersistentWeaknessPolicy,
+            typename PersistentLocationPolicy,
+            typename PersistentCheckingPolicy,
+            typename = std::enable_if_t<std::is_base_of<T, U>::value>>
+  BasicMember& operator=(
+      const BasicPersistent<U, PersistentWeaknessPolicy,
+                            PersistentLocationPolicy, PersistentCheckingPolicy>&
+          other) {
+    return operator=(other.Get());
+  }
+  BasicMember& operator=(T* other) {
+    SetRawAtomic(other);
+    AssigningWriteBarrier();
+    this->CheckPointer(Get());
+    return *this;
+  }
+  BasicMember& operator=(std::nullptr_t) {
+    Clear();
+    return *this;
+  }
+  BasicMember& operator=(SentinelPointer s) {
+    SetRawAtomic(s);
+    return *this;
+  }
+
+  template <typename OtherWeaknessTag, typename OtherBarrierPolicy,
+            typename OtherCheckingPolicy>
+  void Swap(BasicMember<T, OtherWeaknessTag, OtherBarrierPolicy,
+                        OtherCheckingPolicy>& other) {
+    T* tmp = Get();
+    *this = other;
+    other = tmp;
+  }
+
+  explicit operator bool() const { return Get(); }
+  operator T*() const { return Get(); }  // NOLINT
+  T* operator->() const { return Get(); }
+  T& operator*() const { return *Get(); }
+
+  T* Get() const {
+    // Executed by the mutator, hence non atomic load.
+    return raw_;
+  }
+
+  void Clear() { SetRawAtomic(nullptr); }
+
+  T* Release() {
+    T* result = Get();
+    Clear();
+    return result;
+  }
+
+ private:
+  void SetRawAtomic(T* raw) {
+    reinterpret_cast<std::atomic<T*>*>(&raw_)->store(raw,
+                                                     std::memory_order_relaxed);
+  }
+  T* GetRawAtomic() const {
+    return reinterpret_cast<const std::atomic<T*>*>(&raw_)->load(
+        std::memory_order_relaxed);
+  }
+
+  void InitializingWriteBarrier() const {
+    WriteBarrierPolicy::InitializingBarrier(
+        reinterpret_cast<const void*>(&raw_), static_cast<const void*>(raw_));
+  }
+  void AssigningWriteBarrier() const {
+    WriteBarrierPolicy::AssigningBarrier(reinterpret_cast<const void*>(&raw_),
+                                         static_cast<const void*>(raw_));
+  }
+
+  T* raw_ = nullptr;
+
+  friend class cppgc::Visitor;
+};
+
+template <typename T1, typename WeaknessTag1, typename WriteBarrierPolicy1,
+          typename CheckingPolicy1, typename T2, typename WeaknessTag2,
+          typename WriteBarrierPolicy2, typename CheckingPolicy2>
+bool operator==(
+    BasicMember<T1, WeaknessTag1, WriteBarrierPolicy1, CheckingPolicy1> member1,
+    BasicMember<T2, WeaknessTag2, WriteBarrierPolicy2, CheckingPolicy2>
+        member2) {
+  return member1.Get() == member2.Get();
+}
+
+template <typename T1, typename WeaknessTag1, typename WriteBarrierPolicy1,
+          typename CheckingPolicy1, typename T2, typename WeaknessTag2,
+          typename WriteBarrierPolicy2, typename CheckingPolicy2>
+bool operator!=(
+    BasicMember<T1, WeaknessTag1, WriteBarrierPolicy1, CheckingPolicy1> member1,
+    BasicMember<T2, WeaknessTag2, WriteBarrierPolicy2, CheckingPolicy2>
+        member2) {
+  return !(member1 == member2);
+}
+
+template <typename T, typename WriteBarrierPolicy, typename CheckingPolicy>
+struct IsWeak<
+    internal::BasicMember<T, WeakMemberTag, WriteBarrierPolicy, CheckingPolicy>>
+    : std::true_type {};
+
+}  // namespace internal
+
+/**
+ * Members are used in classes to contain strong pointers to other garbage
+ * collected objects. All Member fields of a class must be traced in the class'
+ * trace method.
+ */
+template <typename T>
+using Member = internal::BasicMember<T, internal::StrongMemberTag,
+                                     internal::DijkstraWriteBarrierPolicy>;
+
+/**
+ * WeakMember is similar to Member in that it is used to point to other garbage
+ * collected objects. However instead of creating a strong pointer to the
+ * object, the WeakMember creates a weak pointer, which does not keep the
+ * pointee alive. Hence if all pointers to to a heap allocated object are weak
+ * the object will be garbage collected. At the time of GC the weak pointers
+ * will automatically be set to null.
+ */
+template <typename T>
+using WeakMember = internal::BasicMember<T, internal::WeakMemberTag,
+                                         internal::DijkstraWriteBarrierPolicy>;
+
+/**
+ * UntracedMember is a pointer to an on-heap object that is not traced for some
+ * reason. Do not use this unless you know what you are doing. Keeping raw
+ * pointers to on-heap objects is prohibited unless used from stack. Pointee
+ * must be kept alive through other means.
+ */
+template <typename T>
+using UntracedMember = internal::BasicMember<T, internal::UntracedMemberTag,
+                                             internal::NoWriteBarrierPolicy>;
+
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_MEMBER_H_
diff --git a/deps/v8/include/cppgc/persistent.h b/deps/v8/include/cppgc/persistent.h
new file mode 100644
index 00000000000..fc6b0b9d92e
--- /dev/null
+++ b/deps/v8/include/cppgc/persistent.h
@@ -0,0 +1,304 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_PERSISTENT_H_
+#define INCLUDE_CPPGC_PERSISTENT_H_
+
+#include <type_traits>
+
+#include "cppgc/internal/persistent-node.h"
+#include "cppgc/internal/pointer-policies.h"
+#include "cppgc/source-location.h"
+#include "cppgc/type-traits.h"
+#include "cppgc/visitor.h"
+#include "v8config.h"  // NOLINT(build/include_directory)
+
+namespace cppgc {
+namespace internal {
+
+// The basic class from which all Persistent classes are generated.
+template <typename T, typename WeaknessPolicy, typename LocationPolicy,
+          typename CheckingPolicy>
+class BasicPersistent : public LocationPolicy,
+                        private WeaknessPolicy,
+                        private CheckingPolicy {
+ public:
+  using typename WeaknessPolicy::IsStrongPersistent;
+  using PointeeType = T;
+
+  // Null-state/sentinel constructors.
+  BasicPersistent(  // NOLINT
+      const SourceLocation& loc = SourceLocation::Current())
+      : LocationPolicy(loc) {}
+
+  BasicPersistent(std::nullptr_t,  // NOLINT
+                  const SourceLocation& loc = SourceLocation::Current())
+      : LocationPolicy(loc) {}
+
+  BasicPersistent(  // NOLINT
+      SentinelPointer s, const SourceLocation& loc = SourceLocation::Current())
+      : LocationPolicy(loc), raw_(s) {}
+
+  // Raw value contstructors.
+  BasicPersistent(T* raw,  // NOLINT
+                  const SourceLocation& loc = SourceLocation::Current())
+      : LocationPolicy(loc), raw_(raw) {
+    if (!IsValid()) return;
+    node_ = WeaknessPolicy::GetPersistentRegion(raw_).AllocateNode(
+        this, &BasicPersistent::Trace);
+    this->CheckPointer(Get());
+  }
+
+  BasicPersistent(T& raw,  // NOLINT
+                  const SourceLocation& loc = SourceLocation::Current())
+      : BasicPersistent(&raw, loc) {}
+
+  // Copy ctor.
+  BasicPersistent(const BasicPersistent& other,
+                  const SourceLocation& loc = SourceLocation::Current())
+      : BasicPersistent(other.Get(), loc) {}
+
+  // Heterogeneous ctor.
+  template <typename U, typename OtherWeaknessPolicy,
+            typename OtherLocationPolicy, typename OtherCheckingPolicy,
+            typename = std::enable_if_t<std::is_base_of<T, U>::value>>
+  BasicPersistent(  // NOLINT
+      const BasicPersistent<U, OtherWeaknessPolicy, OtherLocationPolicy,
+                            OtherCheckingPolicy>& other,
+      const SourceLocation& loc = SourceLocation::Current())
+      : BasicPersistent(other.Get(), loc) {}
+
+  // Move ctor. The heterogeneous move ctor is not supported since e.g.
+  // persistent can't reuse persistent node from weak persistent.
+  BasicPersistent(
+      BasicPersistent&& other,
+      const SourceLocation& loc = SourceLocation::Current()) noexcept
+      : LocationPolicy(std::move(other)),
+        raw_(std::move(other.raw_)),
+        node_(std::move(other.node_)) {
+    if (!IsValid()) return;
+    node_->UpdateOwner(this);
+    other.raw_ = nullptr;
+    other.node_ = nullptr;
+    this->CheckPointer(Get());
+  }
+
+  // Constructor from member.
+  template <typename U, typename MemberBarrierPolicy,
+            typename MemberWeaknessTag, typename MemberCheckingPolicy,
+            typename = std::enable_if_t<std::is_base_of<T, U>::value>>
+  BasicPersistent(internal::BasicMember<U, MemberBarrierPolicy,  // NOLINT
+                                        MemberWeaknessTag, MemberCheckingPolicy>
+                      member,
+                  const SourceLocation& loc = SourceLocation::Current())
+      : BasicPersistent(member.Get(), loc) {}
+
+  ~BasicPersistent() { Clear(); }
+
+  // Copy assignment.
+  BasicPersistent& operator=(const BasicPersistent& other) {
+    return operator=(other.Get());
+  }
+
+  template <typename U, typename OtherWeaknessPolicy,
+            typename OtherLocationPolicy, typename OtherCheckingPolicy,
+            typename = std::enable_if_t<std::is_base_of<T, U>::value>>
+  BasicPersistent& operator=(
+      const BasicPersistent<U, OtherWeaknessPolicy, OtherLocationPolicy,
+                            OtherCheckingPolicy>& other) {
+    return operator=(other.Get());
+  }
+
+  // Move assignment.
+  BasicPersistent& operator=(BasicPersistent&& other) {
+    if (this == &other) return *this;
+    Clear();
+    LocationPolicy::operator=(std::move(other));
+    raw_ = std::move(other.raw_);
+    node_ = std::move(other.node_);
+    if (!IsValid()) return *this;
+    node_->UpdateOwner(this);
+    other.raw_ = nullptr;
+    other.node_ = nullptr;
+    this->CheckPointer(Get());
+    return *this;
+  }
+
+  // Assignment from member.
+  template <typename U, typename MemberBarrierPolicy,
+            typename MemberWeaknessTag, typename MemberCheckingPolicy,
+            typename = std::enable_if_t<std::is_base_of<T, U>::value>>
+  BasicPersistent& operator=(
+      internal::BasicMember<U, MemberBarrierPolicy, MemberWeaknessTag,
+                            MemberCheckingPolicy>
+          member) {
+    return operator=(member.Get());
+  }
+
+  BasicPersistent& operator=(T* other) {
+    Assign(other);
+    return *this;
+  }
+
+  BasicPersistent& operator=(std::nullptr_t) {
+    Clear();
+    return *this;
+  }
+
+  BasicPersistent& operator=(SentinelPointer s) {
+    Assign(s);
+    return *this;
+  }
+
+  explicit operator bool() const { return Get(); }
+  operator T*() const { return Get(); }
+  T* operator->() const { return Get(); }
+  T& operator*() const { return *Get(); }
+
+  T* Get() const { return raw_; }
+
+  void Clear() { Assign(nullptr); }
+
+  T* Release() {
+    T* result = Get();
+    Clear();
+    return result;
+  }
+
+ private:
+  static void Trace(Visitor* v, const void* ptr) {
+    const auto* persistent = static_cast<const BasicPersistent*>(ptr);
+    v->TraceRoot(*persistent, persistent->Location());
+  }
+
+  bool IsValid() const {
+    // Ideally, handling kSentinelPointer would be done by the embedder. On the
+    // other hand, having Persistent aware of it is beneficial since no node
+    // gets wasted.
+    return raw_ != nullptr && raw_ != kSentinelPointer;
+  }
+
+  void Assign(T* ptr) {
+    if (IsValid()) {
+      if (ptr && ptr != kSentinelPointer) {
+        // Simply assign the pointer reusing the existing node.
+        raw_ = ptr;
+        this->CheckPointer(ptr);
+        return;
+      }
+      WeaknessPolicy::GetPersistentRegion(raw_).FreeNode(node_);
+      node_ = nullptr;
+    }
+    raw_ = ptr;
+    if (!IsValid()) return;
+    node_ = WeaknessPolicy::GetPersistentRegion(raw_).AllocateNode(
+        this, &BasicPersistent::Trace);
+    this->CheckPointer(Get());
+  }
+
+  T* raw_ = nullptr;
+  PersistentNode* node_ = nullptr;
+};
+
+template <typename T1, typename WeaknessPolicy1, typename LocationPolicy1,
+          typename CheckingPolicy1, typename T2, typename WeaknessPolicy2,
+          typename LocationPolicy2, typename CheckingPolicy2>
+bool operator==(const BasicPersistent<T1, WeaknessPolicy1, LocationPolicy1,
+                                      CheckingPolicy1>& p1,
+                const BasicPersistent<T2, WeaknessPolicy2, LocationPolicy2,
+                                      CheckingPolicy2>& p2) {
+  return p1.Get() == p2.Get();
+}
+
+template <typename T1, typename WeaknessPolicy1, typename LocationPolicy1,
+          typename CheckingPolicy1, typename T2, typename WeaknessPolicy2,
+          typename LocationPolicy2, typename CheckingPolicy2>
+bool operator!=(const BasicPersistent<T1, WeaknessPolicy1, LocationPolicy1,
+                                      CheckingPolicy1>& p1,
+                const BasicPersistent<T2, WeaknessPolicy2, LocationPolicy2,
+                                      CheckingPolicy2>& p2) {
+  return !(p1 == p2);
+}
+
+template <typename T1, typename PersistentWeaknessPolicy,
+          typename PersistentLocationPolicy, typename PersistentCheckingPolicy,
+          typename T2, typename MemberWriteBarrierPolicy,
+          typename MemberWeaknessTag, typename MemberCheckingPolicy>
+bool operator==(const BasicPersistent<T1, PersistentWeaknessPolicy,
+                                      PersistentLocationPolicy,
+                                      PersistentCheckingPolicy>& p,
+                BasicMember<T2, MemberWeaknessTag, MemberWriteBarrierPolicy,
+                            MemberCheckingPolicy>
+                    m) {
+  return p.Get() == m.Get();
+}
+
+template <typename T1, typename PersistentWeaknessPolicy,
+          typename PersistentLocationPolicy, typename PersistentCheckingPolicy,
+          typename T2, typename MemberWriteBarrierPolicy,
+          typename MemberWeaknessTag, typename MemberCheckingPolicy>
+bool operator!=(const BasicPersistent<T1, PersistentWeaknessPolicy,
+                                      PersistentLocationPolicy,
+                                      PersistentCheckingPolicy>& p,
+                BasicMember<T2, MemberWeaknessTag, MemberWriteBarrierPolicy,
+                            MemberCheckingPolicy>
+                    m) {
+  return !(p == m);
+}
+
+template <typename T1, typename MemberWriteBarrierPolicy,
+          typename MemberWeaknessTag, typename MemberCheckingPolicy,
+          typename T2, typename PersistentWeaknessPolicy,
+          typename PersistentLocationPolicy, typename PersistentCheckingPolicy>
+bool operator==(BasicMember<T2, MemberWeaknessTag, MemberWriteBarrierPolicy,
+                            MemberCheckingPolicy>
+                    m,
+                const BasicPersistent<T1, PersistentWeaknessPolicy,
+                                      PersistentLocationPolicy,
+                                      PersistentCheckingPolicy>& p) {
+  return m.Get() == p.Get();
+}
+
+template <typename T1, typename MemberWriteBarrierPolicy,
+          typename MemberWeaknessTag, typename MemberCheckingPolicy,
+          typename T2, typename PersistentWeaknessPolicy,
+          typename PersistentLocationPolicy, typename PersistentCheckingPolicy>
+bool operator!=(BasicMember<T2, MemberWeaknessTag, MemberWriteBarrierPolicy,
+                            MemberCheckingPolicy>
+                    m,
+                const BasicPersistent<T1, PersistentWeaknessPolicy,
+                                      PersistentLocationPolicy,
+                                      PersistentCheckingPolicy>& p) {
+  return !(m == p);
+}
+
+template <typename T, typename LocationPolicy, typename CheckingPolicy>
+struct IsWeak<BasicPersistent<T, internal::WeakPersistentPolicy, LocationPolicy,
+                              CheckingPolicy>> : std::true_type {};
+}  // namespace internal
+
+/**
+ * Persistent is a way to create a strong pointer from an off-heap object to
+ * another on-heap object. As long as the Persistent handle is alive the GC will
+ * keep the object pointed to alive. The Persistent handle is always a GC root
+ * from the point of view of the GC. Persistent must be constructed and
+ * destructed in the same thread.
+ */
+template <typename T>
+using Persistent =
+    internal::BasicPersistent<T, internal::StrongPersistentPolicy>;
+
+/**
+ * WeakPersistent is a way to create a weak pointer from an off-heap object to
+ * an on-heap object. The pointer is automatically cleared when the pointee gets
+ * collected. WeakPersistent must be constructed and destructed in the same
+ * thread.
+ */
+template <typename T>
+using WeakPersistent =
+    internal::BasicPersistent<T, internal::WeakPersistentPolicy>;
+
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_PERSISTENT_H_
diff --git a/deps/v8/include/cppgc/platform.h b/deps/v8/include/cppgc/platform.h
index f216c2730a4..c52b73c8e75 100644
--- a/deps/v8/include/cppgc/platform.h
+++ b/deps/v8/include/cppgc/platform.h
@@ -5,21 +5,117 @@
 #ifndef INCLUDE_CPPGC_PLATFORM_H_
 #define INCLUDE_CPPGC_PLATFORM_H_
 
-#include "include/v8-platform.h"
-#include "include/v8config.h"
+#include "v8-platform.h"  // NOLINT(build/include_directory)
+#include "v8config.h"     // NOLINT(build/include_directory)
 
 namespace cppgc {
 
-// TODO(v8:10346): Put PageAllocator in a non-V8 include header to avoid
-// depending on namespace v8.
+// TODO(v8:10346): Create separate includes for concepts that are not
+// V8-specific.
+using JobHandle = v8::JobHandle;
+using JobTask = v8::JobTask;
 using PageAllocator = v8::PageAllocator;
+using TaskPriority = v8::TaskPriority;
+using TaskRunner = v8::TaskRunner;
 
-// Initializes the garbage collector with the provided platform. Must be called
-// before creating a Heap.
-V8_EXPORT void InitializePlatform(PageAllocator* page_allocator);
+/**
+ * Platform interface used by Heap. Contains allocators and executors.
+ */
+class V8_EXPORT Platform {
+ public:
+  virtual ~Platform() = default;
 
-// Must be called after destroying the last used heap.
-V8_EXPORT void ShutdownPlatform();
+  /**
+   * Returns the allocator used by cppgc to allocate its heap and various
+   * support structures.
+   */
+  virtual PageAllocator* GetPageAllocator() = 0;
+
+  /**
+   * Monotonically increasing time in seconds from an arbitrary fixed point in
+   * the past. This function is expected to return at least
+   * millisecond-precision values. For this reason,
+   * it is recommended that the fixed point be no further in the past than
+   * the epoch.
+   **/
+  virtual double MonotonicallyIncreasingTime() = 0;
+
+  /**
+   * Foreground task runner that should be used by a Heap.
+   */
+  virtual std::shared_ptr<TaskRunner> GetForegroundTaskRunner() {
+    return nullptr;
+  }
+
+  /**
+   * Posts |job_task| to run in parallel. Returns a JobHandle associated with
+   * the Job, which can be joined or canceled.
+   * This avoids degenerate cases:
+   * - Calling CallOnWorkerThread() for each work item, causing significant
+   *   overhead.
+   * - Fixed number of CallOnWorkerThread() calls that split the work and might
+   *   run for a long time. This is problematic when many components post
+   *   "num cores" tasks and all expect to use all the cores. In these cases,
+   *   the scheduler lacks context to be fair to multiple same-priority requests
+   *   and/or ability to request lower priority work to yield when high priority
+   *   work comes in.
+   * A canonical implementation of |job_task| looks like:
+   * class MyJobTask : public JobTask {
+   *  public:
+   *   MyJobTask(...) : worker_queue_(...) {}
+   *   // JobTask:
+   *   void Run(JobDelegate* delegate) override {
+   *     while (!delegate->ShouldYield()) {
+   *       // Smallest unit of work.
+   *       auto work_item = worker_queue_.TakeWorkItem(); // Thread safe.
+   *       if (!work_item) return;
+   *       ProcessWork(work_item);
+   *     }
+   *   }
+   *
+   *   size_t GetMaxConcurrency() const override {
+   *     return worker_queue_.GetSize(); // Thread safe.
+   *   }
+   * };
+   * auto handle = PostJob(TaskPriority::kUserVisible,
+   *                       std::make_unique<MyJobTask>(...));
+   * handle->Join();
+   *
+   * PostJob() and methods of the returned JobHandle/JobDelegate, must never be
+   * called while holding a lock that could be acquired by JobTask::Run or
+   * JobTask::GetMaxConcurrency -- that could result in a deadlock. This is
+   * because [1] JobTask::GetMaxConcurrency may be invoked while holding
+   * internal lock (A), hence JobTask::GetMaxConcurrency can only use a lock (B)
+   * if that lock is *never* held while calling back into JobHandle from any
+   * thread (A=>B/B=>A deadlock) and [2] JobTask::Run or
+   * JobTask::GetMaxConcurrency may be invoked synchronously from JobHandle
+   * (B=>JobHandle::foo=>B deadlock).
+   *
+   * A sufficient PostJob() implementation that uses the default Job provided in
+   * libplatform looks like:
+   *  std::unique_ptr<JobHandle> PostJob(
+   *      TaskPriority priority, std::unique_ptr<JobTask> job_task) override {
+   *    return std::make_unique<DefaultJobHandle>(
+   *        std::make_shared<DefaultJobState>(
+   *            this, std::move(job_task), kNumThreads));
+   * }
+   */
+  virtual std::unique_ptr<JobHandle> PostJob(
+      TaskPriority priority, std::unique_ptr<JobTask> job_task) {
+    return nullptr;
+  }
+};
+
+/**
+ * Process-global initialization of the garbage collector. Must be called before
+ * creating a Heap.
+ */
+V8_EXPORT void InitializeProcess(PageAllocator*);
+
+/**
+ * Must be called after destroying the last used heap.
+ */
+V8_EXPORT void ShutdownProcess();
 
 namespace internal {
 
diff --git a/deps/v8/include/cppgc/prefinalizer.h b/deps/v8/include/cppgc/prefinalizer.h
new file mode 100644
index 00000000000..6c741645990
--- /dev/null
+++ b/deps/v8/include/cppgc/prefinalizer.h
@@ -0,0 +1,53 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_PREFINALIZER_H_
+#define INCLUDE_CPPGC_PREFINALIZER_H_
+
+#include "cppgc/internal/accessors.h"
+#include "cppgc/internal/compiler-specific.h"
+#include "cppgc/internal/prefinalizer-handler.h"
+#include "cppgc/liveness-broker.h"
+
+namespace cppgc {
+
+namespace internal {
+
+template <typename T>
+class PrefinalizerRegistration final {
+ public:
+  explicit PrefinalizerRegistration(T* self) {
+    static_assert(sizeof(&T::InvokePreFinalizer) > 0,
+                  "USING_PRE_FINALIZER(T) must be defined.");
+
+    cppgc::internal::PreFinalizerRegistrationDispatcher::RegisterPrefinalizer(
+        internal::GetHeapFromPayload(self), {self, T::InvokePreFinalizer});
+  }
+
+  void* operator new(size_t, void* location) = delete;
+  void* operator new(size_t) = delete;
+};
+
+}  // namespace internal
+
+#define CPPGC_USING_PRE_FINALIZER(Class, PreFinalizer)                      \
+ public:                                                                    \
+  static bool InvokePreFinalizer(const LivenessBroker& liveness_broker,     \
+                                 void* object) {                            \
+    static_assert(internal::IsGarbageCollectedTypeV<Class>,                 \
+                  "Only garbage collected objects can have prefinalizers"); \
+    Class* self = static_cast<Class*>(object);                              \
+    if (liveness_broker.IsHeapObjectAlive(self)) return false;              \
+    self->Class::PreFinalizer();                                            \
+    return true;                                                            \
+  }                                                                         \
+                                                                            \
+ private:                                                                   \
+  CPPGC_NO_UNIQUE_ADDRESS internal::PrefinalizerRegistration<Class>         \
+      prefinalizer_dummy_{this};                                            \
+  static_assert(true, "Force semicolon.")
+
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_PREFINALIZER_H_
diff --git a/deps/v8/include/cppgc/source-location.h b/deps/v8/include/cppgc/source-location.h
new file mode 100644
index 00000000000..8cc52d6a539
--- /dev/null
+++ b/deps/v8/include/cppgc/source-location.h
@@ -0,0 +1,59 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_SOURCE_LOCATION_H_
+#define INCLUDE_CPPGC_SOURCE_LOCATION_H_
+
+#include <string>
+
+#include "v8config.h"  // NOLINT(build/include_directory)
+
+#if defined(__has_builtin)
+#define CPPGC_SUPPORTS_SOURCE_LOCATION                                   \
+  (__has_builtin(__builtin_FUNCTION) && __has_builtin(__builtin_FILE) && \
+   __has_builtin(__builtin_LINE))  // NOLINT
+#elif defined(V8_CC_GNU) && __GNUC__ >= 7
+#define CPPGC_SUPPORTS_SOURCE_LOCATION 1
+#elif defined(V8_CC_INTEL) && __ICC >= 1800
+#define CPPGC_SUPPORTS_SOURCE_LOCATION 1
+#else
+#define CPPGC_SUPPORTS_SOURCE_LOCATION 0
+#endif
+
+namespace cppgc {
+
+// Encapsulates source location information. Mimics C++20's
+// std::source_location.
+class V8_EXPORT SourceLocation final {
+ public:
+#if CPPGC_SUPPORTS_SOURCE_LOCATION
+  static constexpr SourceLocation Current(
+      const char* function = __builtin_FUNCTION(),
+      const char* file = __builtin_FILE(), size_t line = __builtin_LINE()) {
+    return SourceLocation(function, file, line);
+  }
+#else
+  static constexpr SourceLocation Current() { return SourceLocation(); }
+#endif  // CPPGC_SUPPORTS_SOURCE_LOCATION
+
+  constexpr SourceLocation() = default;
+
+  constexpr const char* Function() const { return function_; }
+  constexpr const char* FileName() const { return file_; }
+  constexpr size_t Line() const { return line_; }
+
+  std::string ToString() const;
+
+ private:
+  constexpr SourceLocation(const char* function, const char* file, size_t line)
+      : function_(function), file_(file), line_(line) {}
+
+  const char* function_ = nullptr;
+  const char* file_ = nullptr;
+  size_t line_ = 0u;
+};
+
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_SOURCE_LOCATION_H_
diff --git a/deps/v8/include/cppgc/trace-trait.h b/deps/v8/include/cppgc/trace-trait.h
new file mode 100644
index 00000000000..e246bc53b7d
--- /dev/null
+++ b/deps/v8/include/cppgc/trace-trait.h
@@ -0,0 +1,67 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_TRACE_TRAIT_H_
+#define INCLUDE_CPPGC_TRACE_TRAIT_H_
+
+#include <type_traits>
+#include "cppgc/type-traits.h"
+
+namespace cppgc {
+
+class Visitor;
+
+namespace internal {
+
+template <typename T,
+          bool =
+              IsGarbageCollectedMixinTypeV<typename std::remove_const<T>::type>>
+struct TraceTraitImpl;
+
+}  // namespace internal
+
+using TraceCallback = void (*)(Visitor*, const void*);
+
+// TraceDescriptor is used to describe how to trace an object.
+struct TraceDescriptor {
+  // The adjusted base pointer of the object that should be traced.
+  const void* base_object_payload;
+  // A callback for tracing the object.
+  TraceCallback callback;
+};
+
+template <typename T>
+struct TraceTrait {
+  static_assert(internal::IsTraceableV<T>, "T must have a Trace() method");
+
+  static TraceDescriptor GetTraceDescriptor(const void* self) {
+    return internal::TraceTraitImpl<T>::GetTraceDescriptor(
+        static_cast<const T*>(self));
+  }
+
+  static void Trace(Visitor* visitor, const void* self) {
+    static_cast<const T*>(self)->Trace(visitor);
+  }
+};
+
+namespace internal {
+
+template <typename T>
+struct TraceTraitImpl<T, false> {
+  static TraceDescriptor GetTraceDescriptor(const void* self) {
+    return {self, TraceTrait<T>::Trace};
+  }
+};
+
+template <typename T>
+struct TraceTraitImpl<T, true> {
+  static TraceDescriptor GetTraceDescriptor(const void* self) {
+    return static_cast<const T*>(self)->GetTraceDescriptor();
+  }
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_TRACE_TRAIT_H_
diff --git a/deps/v8/include/cppgc/type-traits.h b/deps/v8/include/cppgc/type-traits.h
new file mode 100644
index 00000000000..4d8ab809c8d
--- /dev/null
+++ b/deps/v8/include/cppgc/type-traits.h
@@ -0,0 +1,109 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_TYPE_TRAITS_H_
+#define INCLUDE_CPPGC_TYPE_TRAITS_H_
+
+#include <type_traits>
+
+namespace cppgc {
+
+class Visitor;
+
+namespace internal {
+
+// Pre-C++17 custom implementation of std::void_t.
+template <typename... Ts>
+struct make_void {
+  typedef void type;
+};
+template <typename... Ts>
+using void_t = typename make_void<Ts...>::type;
+
+// Not supposed to be specialized by the user.
+template <typename T>
+struct IsWeak : std::false_type {};
+
+template <typename T, template <typename... V> class U>
+struct IsSubclassOfTemplate {
+ private:
+  template <typename... W>
+  static std::true_type SubclassCheck(U<W...>*);
+  static std::false_type SubclassCheck(...);
+
+ public:
+  static constexpr bool value =
+      decltype(SubclassCheck(std::declval<T*>()))::value;
+};
+
+// IsTraceMethodConst is used to verify that all Trace methods are marked as
+// const. It is equivalent to IsTraceable but for a non-const object.
+template <typename T, typename = void>
+struct IsTraceMethodConst : std::false_type {};
+
+template <typename T>
+struct IsTraceMethodConst<T, void_t<decltype(std::declval<const T>().Trace(
+                                 std::declval<Visitor*>()))>> : std::true_type {
+};
+
+template <typename T, typename = void>
+struct IsTraceable : std::false_type {
+  static_assert(sizeof(T), "T must be fully defined");
+};
+
+template <typename T>
+struct IsTraceable<
+    T, void_t<decltype(std::declval<T>().Trace(std::declval<Visitor*>()))>>
+    : std::true_type {
+  // All Trace methods should be marked as const. If an object of type
+  // 'T' is traceable then any object of type 'const T' should also
+  // be traceable.
+  static_assert(IsTraceMethodConst<T>(),
+                "Trace methods should be marked as const.");
+};
+
+template <typename T>
+constexpr bool IsTraceableV = IsTraceable<T>::value;
+
+template <typename T, typename = void>
+struct IsGarbageCollectedMixinType : std::false_type {
+  static_assert(sizeof(T), "T must be fully defined");
+};
+
+template <typename T>
+struct IsGarbageCollectedMixinType<
+    T,
+    void_t<typename std::remove_const_t<T>::IsGarbageCollectedMixinTypeMarker>>
+    : std::true_type {
+  static_assert(sizeof(T), "T must be fully defined");
+};
+
+template <typename T, typename = void>
+struct IsGarbageCollectedType : IsGarbageCollectedMixinType<T> {
+  static_assert(sizeof(T), "T must be fully defined");
+};
+
+template <typename T>
+struct IsGarbageCollectedType<
+    T, void_t<typename std::remove_const_t<T>::IsGarbageCollectedTypeMarker>>
+    : std::true_type {
+  static_assert(sizeof(T), "T must be fully defined");
+};
+
+template <typename T>
+constexpr bool IsGarbageCollectedTypeV =
+    internal::IsGarbageCollectedType<T>::value;
+
+template <typename T>
+constexpr bool IsGarbageCollectedMixinTypeV =
+    internal::IsGarbageCollectedMixinType<T>::value;
+
+}  // namespace internal
+
+template <typename T>
+constexpr bool IsWeakV = internal::IsWeak<T>::value;
+
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_TYPE_TRAITS_H_
diff --git a/deps/v8/include/cppgc/visitor.h b/deps/v8/include/cppgc/visitor.h
new file mode 100644
index 00000000000..55d44c1ccea
--- /dev/null
+++ b/deps/v8/include/cppgc/visitor.h
@@ -0,0 +1,154 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_VISITOR_H_
+#define INCLUDE_CPPGC_VISITOR_H_
+
+#include "cppgc/garbage-collected.h"
+#include "cppgc/internal/logging.h"
+#include "cppgc/internal/pointer-policies.h"
+#include "cppgc/liveness-broker.h"
+#include "cppgc/member.h"
+#include "cppgc/source-location.h"
+#include "cppgc/trace-trait.h"
+
+namespace cppgc {
+namespace internal {
+class VisitorBase;
+}  // namespace internal
+
+using WeakCallback = void (*)(const LivenessBroker&, const void*);
+
+/**
+ * Visitor passed to trace methods. All managed pointers must have called the
+ * visitor's trace method on them.
+ */
+class Visitor {
+ public:
+  template <typename T>
+  void Trace(const Member<T>& member) {
+    const T* value = member.GetRawAtomic();
+    CPPGC_DCHECK(value != kSentinelPointer);
+    Trace(value);
+  }
+
+  template <typename T>
+  void Trace(const WeakMember<T>& weak_member) {
+    static_assert(sizeof(T), "Pointee type must be fully defined.");
+    static_assert(internal::IsGarbageCollectedType<T>::value,
+                  "T must be GarabgeCollected or GarbageCollectedMixin type");
+
+    const T* value = weak_member.GetRawAtomic();
+
+    // Bailout assumes that WeakMember emits write barrier.
+    if (!value) {
+      return;
+    }
+
+    // TODO(chromium:1056170): DCHECK (or similar) for deleted values as they
+    // should come in at a different path.
+    VisitWeak(value, TraceTrait<T>::GetTraceDescriptor(value),
+              &HandleWeak<WeakMember<T>>, &weak_member);
+  }
+
+  template <typename Persistent,
+            std::enable_if_t<Persistent::IsStrongPersistent::value>* = nullptr>
+  void TraceRoot(const Persistent& p, const SourceLocation& loc) {
+    using PointeeType = typename Persistent::PointeeType;
+    static_assert(sizeof(PointeeType),
+                  "Persistent's pointee type must be fully defined");
+    static_assert(internal::IsGarbageCollectedType<PointeeType>::value,
+                  "Persisent's pointee type must be GarabgeCollected or "
+                  "GarbageCollectedMixin");
+    if (!p.Get()) {
+      return;
+    }
+    VisitRoot(p.Get(), TraceTrait<PointeeType>::GetTraceDescriptor(p.Get()));
+  }
+
+  template <
+      typename WeakPersistent,
+      std::enable_if_t<!WeakPersistent::IsStrongPersistent::value>* = nullptr>
+  void TraceRoot(const WeakPersistent& p, const SourceLocation& loc) {
+    using PointeeType = typename WeakPersistent::PointeeType;
+    static_assert(sizeof(PointeeType),
+                  "Persistent's pointee type must be fully defined");
+    static_assert(internal::IsGarbageCollectedType<PointeeType>::value,
+                  "Persisent's pointee type must be GarabgeCollected or "
+                  "GarbageCollectedMixin");
+    VisitWeakRoot(p.Get(), TraceTrait<PointeeType>::GetTraceDescriptor(p.Get()),
+                  &HandleWeak<WeakPersistent>, &p);
+  }
+
+  template <typename T>
+  void Trace(const T& object) {
+#if V8_ENABLE_CHECKS
+    // This object is embedded in potentially multiple nested objects. The
+    // outermost object must not be in construction as such objects are (a) not
+    // processed immediately, and (b) only processed conservatively if not
+    // otherwise possible.
+    CheckObjectNotInConstruction(&object);
+#endif  // V8_ENABLE_CHECKS
+    TraceTrait<T>::Trace(this, &object);
+  }
+
+  template <typename T, void (T::*method)(const LivenessBroker&)>
+  void RegisterWeakCallbackMethod(const T* obj) {
+    RegisterWeakCallback(&WeakCallbackMethodDelegate<T, method>, obj);
+  }
+
+  virtual void RegisterWeakCallback(WeakCallback, const void*) {}
+
+ protected:
+  virtual void Visit(const void* self, TraceDescriptor) {}
+  virtual void VisitWeak(const void* self, TraceDescriptor, WeakCallback,
+                         const void* weak_member) {}
+  virtual void VisitRoot(const void*, TraceDescriptor) {}
+  virtual void VisitWeakRoot(const void* self, TraceDescriptor, WeakCallback,
+                             const void* weak_root) {}
+
+ private:
+  template <typename T, void (T::*method)(const LivenessBroker&)>
+  static void WeakCallbackMethodDelegate(const LivenessBroker& info,
+                                         const void* self) {
+    // Callback is registered through a potential const Trace method but needs
+    // to be able to modify fields. See HandleWeak.
+    (const_cast<T*>(static_cast<const T*>(self))->*method)(info);
+  }
+
+  template <typename PointerType>
+  static void HandleWeak(const LivenessBroker& info, const void* object) {
+    const PointerType* weak = static_cast<const PointerType*>(object);
+    const auto* raw = weak->Get();
+    if (raw && !info.IsHeapObjectAlive(raw)) {
+      // Object is passed down through the marker as const. Alternatives are
+      // - non-const Trace method;
+      // - mutable pointer in MemberBase;
+      const_cast<PointerType*>(weak)->Clear();
+    }
+  }
+
+  Visitor() = default;
+
+  template <typename T>
+  void Trace(const T* t) {
+    static_assert(sizeof(T), "Pointee type must be fully defined.");
+    static_assert(internal::IsGarbageCollectedType<T>::value,
+                  "T must be GarabgeCollected or GarbageCollectedMixin type");
+    if (!t) {
+      return;
+    }
+    Visit(t, TraceTrait<T>::GetTraceDescriptor(t));
+  }
+
+#if V8_ENABLE_CHECKS
+  V8_EXPORT void CheckObjectNotInConstruction(const void* address);
+#endif  // V8_ENABLE_CHECKS
+
+  friend class internal::VisitorBase;
+};
+
+}  // namespace cppgc
+
+#endif  // INCLUDE_CPPGC_VISITOR_H_
diff --git a/deps/v8/include/js_protocol.pdl b/deps/v8/include/js_protocol.pdl
index 3f5410d1e1f..706c37f958e 100644
--- a/deps/v8/include/js_protocol.pdl
+++ b/deps/v8/include/js_protocol.pdl
@@ -204,6 +204,21 @@ domain Debugger
       # Exception details.
       optional Runtime.ExceptionDetails exceptionDetails
 
+  # Execute a Wasm Evaluator module on a given call frame.
+  experimental command executeWasmEvaluator
+    parameters
+      # WebAssembly call frame identifier to evaluate on.
+      CallFrameId callFrameId
+      # Code of the evaluator module.
+      binary evaluator
+      # Terminate execution after timing out (number of milliseconds).
+      experimental optional Runtime.TimeDelta timeout
+    returns
+      # Object wrapper for the evaluation result.
+      Runtime.RemoteObject result
+      # Exception details.
+      optional Runtime.ExceptionDetails exceptionDetails
+
   # Returns possible locations for breakpoint. scriptId in start and end range locations should be
   # the same.
   command getPossibleBreakpoints
@@ -510,6 +525,18 @@ domain Debugger
       JavaScript
       WebAssembly
 
+  # Debug symbols available for a wasm script.
+  type DebugSymbols extends object
+    properties
+      # Type of the debug symbols.
+      enum type
+        None
+        SourceMap
+        EmbeddedDWARF
+        ExternalDWARF
+      # URL of the external symbol source.
+      optional string externalURL
+
   # Fired when virtual machine fails to parse the script.
   event scriptFailedToParse
     parameters
@@ -584,6 +611,8 @@ domain Debugger
       experimental optional integer codeOffset
       # The language of the script.
       experimental optional Debugger.ScriptLanguage scriptLanguage
+      # If the scriptLanguage is WebASsembly, the source of debug symbols for the module.
+      experimental optional Debugger.DebugSymbols debugSymbols
 
 experimental domain HeapProfiler
   depends on Runtime
@@ -980,6 +1009,7 @@ domain Runtime
         f32
         f64
         v128
+        anyref
       # Object class (constructor) name. Specified for `object` type values only.
       optional string className
       # Remote object value in case of primitive values or JSON values (if it was requested).
diff --git a/deps/v8/include/libplatform/libplatform.h b/deps/v8/include/libplatform/libplatform.h
index 6051b644fb9..c7ea4c2bd38 100644
--- a/deps/v8/include/libplatform/libplatform.h
+++ b/deps/v8/include/libplatform/libplatform.h
@@ -9,8 +9,8 @@
 
 #include "libplatform/libplatform-export.h"
 #include "libplatform/v8-tracing.h"
-#include "v8-platform.h"  // NOLINT(build/include)
-#include "v8config.h"     // NOLINT(build/include)
+#include "v8-platform.h"  // NOLINT(build/include_directory)
+#include "v8config.h"     // NOLINT(build/include_directory)
 
 namespace v8 {
 namespace platform {
diff --git a/deps/v8/include/libplatform/v8-tracing.h b/deps/v8/include/libplatform/v8-tracing.h
index 79e6f62d23e..45822d00f37 100644
--- a/deps/v8/include/libplatform/v8-tracing.h
+++ b/deps/v8/include/libplatform/v8-tracing.h
@@ -12,9 +12,12 @@
 #include <vector>
 
 #include "libplatform/libplatform-export.h"
-#include "v8-platform.h"  // NOLINT(build/include)
+#include "v8-platform.h"  // NOLINT(build/include_directory)
 
 namespace perfetto {
+namespace trace_processor {
+class TraceProcessorStorage;
+}
 class TracingSession;
 }
 
@@ -28,7 +31,6 @@ namespace platform {
 namespace tracing {
 
 class TraceEventListener;
-class JSONTraceEventListener;
 
 const int kTraceMaxNumArgs = 2;
 
@@ -197,6 +199,9 @@ class V8_PLATFORM_EXPORT TraceConfig {
 
   TraceConfig() : enable_systrace_(false), enable_argument_filter_(false) {}
   TraceRecordMode GetTraceRecordMode() const { return record_mode_; }
+  const StringList& GetEnabledCategories() const {
+    return included_categories_;
+  }
   bool IsSystraceEnabled() const { return enable_systrace_; }
   bool IsArgumentFilterEnabled() const { return enable_argument_filter_; }
 
@@ -229,6 +234,17 @@ class V8_PLATFORM_EXPORT TraceConfig {
 class V8_PLATFORM_EXPORT TracingController
     : public V8_PLATFORM_NON_EXPORTED_BASE(v8::TracingController) {
  public:
+  TracingController();
+  ~TracingController() override;
+
+#if defined(V8_USE_PERFETTO)
+  // Must be called before StartTracing() if V8_USE_PERFETTO is true. Provides
+  // the output stream for the JSON trace data.
+  void InitializeForPerfetto(std::ostream* output_stream);
+  // Provide an optional listener for testing that will receive trace events.
+  // Must be called before StartTracing().
+  void SetTraceEventListenerForTesting(TraceEventListener* listener);
+#else   // defined(V8_USE_PERFETTO)
   // The pointer returned from GetCategoryGroupEnabled() points to a value with
   // zero or more of the following bits. Used in this class only. The
   // TRACE_EVENT macros should only use the value as a bool. These values must
@@ -242,19 +258,8 @@ class V8_PLATFORM_EXPORT TracingController
     ENABLED_FOR_ETW_EXPORT = 1 << 3
   };
 
-  TracingController();
-  ~TracingController() override;
-
   // Takes ownership of |trace_buffer|.
   void Initialize(TraceBuffer* trace_buffer);
-#ifdef V8_USE_PERFETTO
-  // Must be called before StartTracing() if V8_USE_PERFETTO is true. Provides
-  // the output stream for the JSON trace data.
-  void InitializeForPerfetto(std::ostream* output_stream);
-  // Provide an optional listener for testing that will receive trace events.
-  // Must be called before StartTracing().
-  void SetTraceEventListenerForTesting(TraceEventListener* listener);
-#endif
 
   // v8::TracingController implementation.
   const uint8_t* GetCategoryGroupEnabled(const char* category_group) override;
@@ -274,6 +279,10 @@ class V8_PLATFORM_EXPORT TracingController
       unsigned int flags, int64_t timestamp) override;
   void UpdateTraceEventDuration(const uint8_t* category_enabled_flag,
                                 const char* name, uint64_t handle) override;
+
+  static const char* GetCategoryGroupName(const uint8_t* category_enabled_flag);
+#endif  // !defined(V8_USE_PERFETTO)
+
   void AddTraceStateObserver(
       v8::TracingController::TraceStateObserver* observer) override;
   void RemoveTraceStateObserver(
@@ -282,27 +291,32 @@ class V8_PLATFORM_EXPORT TracingController
   void StartTracing(TraceConfig* trace_config);
   void StopTracing();
 
-  static const char* GetCategoryGroupName(const uint8_t* category_enabled_flag);
-
  protected:
+#if !defined(V8_USE_PERFETTO)
   virtual int64_t CurrentTimestampMicroseconds();
   virtual int64_t CurrentCpuTimestampMicroseconds();
+#endif  // !defined(V8_USE_PERFETTO)
 
  private:
+#if !defined(V8_USE_PERFETTO)
   void UpdateCategoryGroupEnabledFlag(size_t category_index);
   void UpdateCategoryGroupEnabledFlags();
+#endif  // !defined(V8_USE_PERFETTO)
 
-  std::unique_ptr<TraceBuffer> trace_buffer_;
-  std::unique_ptr<TraceConfig> trace_config_;
   std::unique_ptr<base::Mutex> mutex_;
-  std::unordered_set<v8::TracingController::TraceStateObserver*> observers_;
+  std::unique_ptr<TraceConfig> trace_config_;
   std::atomic_bool recording_{false};
-#ifdef V8_USE_PERFETTO
+  std::unordered_set<v8::TracingController::TraceStateObserver*> observers_;
+
+#if defined(V8_USE_PERFETTO)
   std::ostream* output_stream_ = nullptr;
-  std::unique_ptr<JSONTraceEventListener> json_listener_;
+  std::unique_ptr<perfetto::trace_processor::TraceProcessorStorage>
+      trace_processor_;
   TraceEventListener* listener_for_testing_ = nullptr;
   std::unique_ptr<perfetto::TracingSession> tracing_session_;
-#endif
+#else   // !defined(V8_USE_PERFETTO)
+  std::unique_ptr<TraceBuffer> trace_buffer_;
+#endif  // !defined(V8_USE_PERFETTO)
 
   // Disallow copy and assign
   TracingController(const TracingController&) = delete;
diff --git a/deps/v8/include/v8-fast-api-calls.h b/deps/v8/include/v8-fast-api-calls.h
index bfce66b652d..f74406493bc 100644
--- a/deps/v8/include/v8-fast-api-calls.h
+++ b/deps/v8/include/v8-fast-api-calls.h
@@ -165,7 +165,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include "v8config.h"  // NOLINT(build/include)
+#include "v8config.h"  // NOLINT(build/include_directory)
 
 namespace v8 {
 
@@ -183,30 +183,32 @@ class CTypeInfo {
     kUnwrappedApiObject,
   };
 
-  enum ArgFlags : char {
-    None = 0,
-    IsArrayBit = 1 << 0,  // This argument is first in an array of values.
+  enum class ArgFlags : uint8_t {
+    kNone = 0,
+    kIsArrayBit = 1 << 0,  // This argument is first in an array of values.
   };
 
   static CTypeInfo FromWrapperType(const void* wrapper_type_info,
-                                   ArgFlags flags = ArgFlags::None) {
+                                   ArgFlags flags = ArgFlags::kNone) {
     uintptr_t wrapper_type_info_ptr =
         reinterpret_cast<uintptr_t>(wrapper_type_info);
     // Check that the lower kIsWrapperTypeBit bits are 0's.
     CHECK_EQ(
         wrapper_type_info_ptr & ~(static_cast<uintptr_t>(~0)
                                   << static_cast<uintptr_t>(kIsWrapperTypeBit)),
-        0);
+        0u);
     // TODO(mslekova): Refactor the manual bit manipulations to use
     // PointerWithPayload instead.
-    return CTypeInfo(wrapper_type_info_ptr | flags | kIsWrapperTypeBit);
+    return CTypeInfo(wrapper_type_info_ptr | static_cast<int>(flags) |
+                     kIsWrapperTypeBit);
   }
 
   static constexpr CTypeInfo FromCType(Type ctype,
-                                       ArgFlags flags = ArgFlags::None) {
+                                       ArgFlags flags = ArgFlags::kNone) {
     // ctype cannot be Type::kUnwrappedApiObject.
     return CTypeInfo(
-        ((static_cast<uintptr_t>(ctype) << kTypeOffset) & kTypeMask) | flags);
+        ((static_cast<uintptr_t>(ctype) << kTypeOffset) & kTypeMask) |
+        static_cast<int>(flags));
   }
 
   const void* GetWrapperInfo() const;
@@ -218,7 +220,9 @@ class CTypeInfo {
     return static_cast<Type>((payload_ & kTypeMask) >> kTypeOffset);
   }
 
-  constexpr bool IsArray() const { return payload_ & ArgFlags::IsArrayBit; }
+  constexpr bool IsArray() const {
+    return payload_ & static_cast<int>(ArgFlags::kIsArrayBit);
+  }
 
  private:
   explicit constexpr CTypeInfo(uintptr_t payload) : payload_(payload) {}
@@ -283,9 +287,6 @@ SUPPORTED_C_TYPES(SPECIALIZE_GET_C_TYPE_FOR)
 template <typename T, typename = void>
 struct EnableIfHasWrapperTypeInfo {};
 
-template <>
-struct EnableIfHasWrapperTypeInfo<void> {};
-
 template <typename T>
 struct EnableIfHasWrapperTypeInfo<T, decltype(WrapperTraits<T>::GetTypeInfo(),
                                               void())> {
@@ -297,7 +298,7 @@ template <typename T, typename = void>
 struct GetCTypePointerImpl {
   static constexpr CTypeInfo Get() {
     return CTypeInfo::FromCType(GetCType<T>::Get().GetType(),
-                                CTypeInfo::IsArrayBit);
+                                CTypeInfo::ArgFlags::kIsArrayBit);
   }
 };
 
@@ -321,7 +322,7 @@ struct GetCTypePointerPointerImpl<
     T, typename EnableIfHasWrapperTypeInfo<T>::type> {
   static constexpr CTypeInfo Get() {
     return CTypeInfo::FromWrapperType(WrapperTraits<T>::GetTypeInfo(),
-                                      CTypeInfo::IsArrayBit);
+                                      CTypeInfo::ArgFlags::kIsArrayBit);
   }
 };
 
@@ -335,11 +336,12 @@ template <typename R, typename... Args>
 class CFunctionInfoImpl : public CFunctionInfo {
  public:
   CFunctionInfoImpl()
-      : return_info_(i::GetCType<R>::Get()),
+      : return_info_(internal::GetCType<R>::Get()),
         arg_count_(sizeof...(Args)),
-        arg_info_{i::GetCType<Args>::Get()...} {
-    static_assert(i::GetCType<R>::Get().GetType() == CTypeInfo::Type::kVoid,
-                  "Only void return types are currently supported.");
+        arg_info_{internal::GetCType<Args>::Get()...} {
+    static_assert(
+        internal::GetCType<R>::Get().GetType() == CTypeInfo::Type::kVoid,
+        "Only void return types are currently supported.");
   }
 
   const CTypeInfo& ReturnInfo() const override { return return_info_; }
@@ -359,6 +361,8 @@ class CFunctionInfoImpl : public CFunctionInfo {
 
 class V8_EXPORT CFunction {
  public:
+  constexpr CFunction() : address_(nullptr), type_info_(nullptr) {}
+
   const CTypeInfo& ReturnInfo() const { return type_info_->ReturnInfo(); }
 
   const CTypeInfo& ArgumentInfo(unsigned int index) const {
diff --git a/deps/v8/include/v8-inspector-protocol.h b/deps/v8/include/v8-inspector-protocol.h
index 612a2ebc391..a5ffb7d6954 100644
--- a/deps/v8/include/v8-inspector-protocol.h
+++ b/deps/v8/include/v8-inspector-protocol.h
@@ -5,9 +5,9 @@
 #ifndef V8_V8_INSPECTOR_PROTOCOL_H_
 #define V8_V8_INSPECTOR_PROTOCOL_H_
 
-#include "inspector/Debugger.h"  // NOLINT(build/include)
-#include "inspector/Runtime.h"   // NOLINT(build/include)
-#include "inspector/Schema.h"    // NOLINT(build/include)
-#include "v8-inspector.h"        // NOLINT(build/include)
+#include "inspector/Debugger.h"  // NOLINT(build/include_directory)
+#include "inspector/Runtime.h"   // NOLINT(build/include_directory)
+#include "inspector/Schema.h"    // NOLINT(build/include_directory)
+#include "v8-inspector.h"        // NOLINT(build/include_directory)
 
 #endif  // V8_V8_INSPECTOR_PROTOCOL_H_
diff --git a/deps/v8/include/v8-inspector.h b/deps/v8/include/v8-inspector.h
index 01274625c1f..6573940e2fe 100644
--- a/deps/v8/include/v8-inspector.h
+++ b/deps/v8/include/v8-inspector.h
@@ -11,7 +11,7 @@
 #include <memory>
 #include <unordered_map>
 
-#include "v8.h"  // NOLINT(build/include)
+#include "v8.h"  // NOLINT(build/include_directory)
 
 namespace v8_inspector {
 
diff --git a/deps/v8/include/v8-internal.h b/deps/v8/include/v8-internal.h
index 876408ebba9..127a77dbfca 100644
--- a/deps/v8/include/v8-internal.h
+++ b/deps/v8/include/v8-internal.h
@@ -10,8 +10,8 @@
 #include <string.h>
 #include <type_traits>
 
-#include "v8-version.h"  // NOLINT(build/include)
-#include "v8config.h"    // NOLINT(build/include)
+#include "v8-version.h"  // NOLINT(build/include_directory)
+#include "v8config.h"    // NOLINT(build/include_directory)
 
 namespace v8 {
 
@@ -106,6 +106,20 @@ const int kApiTaggedSize = kApiInt32Size;
 const int kApiTaggedSize = kApiSystemPointerSize;
 #endif
 
+constexpr bool PointerCompressionIsEnabled() {
+  return kApiTaggedSize != kApiSystemPointerSize;
+}
+
+constexpr bool HeapSandboxIsEnabled() {
+#ifdef V8_HEAP_SANDBOX
+  return true;
+#else
+  return false;
+#endif
+}
+
+using ExternalPointer_t = Address;
+
 #ifdef V8_31BIT_SMIS_ON_64BIT_ARCH
 using PlatformSmiTagging = SmiTagging<kApiInt32Size>;
 #else
@@ -126,6 +140,15 @@ V8_INLINE static constexpr internal::Address IntToSmi(int value) {
          kSmiTag;
 }
 
+// {obj} must be the raw tagged pointer representation of a HeapObject
+// that's guaranteed to never be in ReadOnlySpace.
+V8_EXPORT internal::Isolate* IsolateFromNeverReadOnlySpaceObject(Address obj);
+
+// Returns if we need to throw when an error occurs. This infers the language
+// mode based on the current context and the closure. This returns true if the
+// language mode is strict.
+V8_EXPORT bool ShouldThrowOnError(v8::internal::Isolate* isolate);
+
 /**
  * This class exports constants and functionality from within v8 that
  * is necessary to implement inline functions in the v8 api.  Don't
@@ -141,7 +164,6 @@ class Internals {
       1 * kApiTaggedSize + 2 * kApiInt32Size;
 
   static const int kOddballKindOffset = 4 * kApiTaggedSize + kApiDoubleSize;
-  static const int kForeignAddressOffset = kApiTaggedSize;
   static const int kJSObjectHeaderSize = 3 * kApiTaggedSize;
   static const int kFixedArrayHeaderSize = 2 * kApiTaggedSize;
   static const int kEmbedderDataArrayHeaderSize = 2 * kApiTaggedSize;
@@ -326,11 +348,36 @@ class Internals {
 #endif
   }
 
+  V8_INLINE static internal::Isolate* GetIsolateForHeapSandbox(
+      internal::Address obj) {
+#ifdef V8_HEAP_SANDBOX
+    return internal::IsolateFromNeverReadOnlySpaceObject(obj);
+#else
+    // Not used in non-sandbox mode.
+    return nullptr;
+#endif
+  }
+
+  V8_INLINE static internal::Address ReadExternalPointerField(
+      internal::Isolate* isolate, internal::Address heap_object_ptr,
+      int offset) {
+    internal::Address value = ReadRawField<Address>(heap_object_ptr, offset);
+#ifdef V8_HEAP_SANDBOX
+    // We currently have to treat zero as nullptr in embedder slots.
+    if (value) value = DecodeExternalPointer(isolate, value);
+#endif
+    return value;
+  }
+
 #ifdef V8_COMPRESS_POINTERS
   // See v8:7703 or src/ptr-compr.* for details about pointer compression.
   static constexpr size_t kPtrComprHeapReservationSize = size_t{1} << 32;
   static constexpr size_t kPtrComprIsolateRootAlignment = size_t{1} << 32;
 
+  // See v8:10391 for details about V8 heap sandbox.
+  static constexpr uint32_t kExternalPointerSalt =
+      0x7fffffff & ~static_cast<uint32_t>(kHeapObjectTagMask);
+
   V8_INLINE static internal::Address GetRootFromOnHeapAddress(
       internal::Address addr) {
     return addr & -static_cast<intptr_t>(kPtrComprIsolateRootAlignment);
@@ -341,6 +388,15 @@ class Internals {
     internal::Address root = GetRootFromOnHeapAddress(heap_object_ptr);
     return root + static_cast<internal::Address>(static_cast<uintptr_t>(value));
   }
+
+  V8_INLINE static Address DecodeExternalPointer(
+      const Isolate* isolate, ExternalPointer_t encoded_pointer) {
+#ifndef V8_HEAP_SANDBOX
+    return encoded_pointer;
+#else
+    return encoded_pointer ^ kExternalPointerSalt;
+#endif
+  }
 #endif  // V8_COMPRESS_POINTERS
 };
 
@@ -367,15 +423,6 @@ V8_INLINE void PerformCastCheck(T* data) {
   CastCheck<std::is_base_of<Data, T>::value>::Perform(data);
 }
 
-// {obj} must be the raw tagged pointer representation of a HeapObject
-// that's guaranteed to never be in ReadOnlySpace.
-V8_EXPORT internal::Isolate* IsolateFromNeverReadOnlySpaceObject(Address obj);
-
-// Returns if we need to throw when an error occurs. This infers the language
-// mode based on the current context and the closure. This returns true if the
-// language mode is strict.
-V8_EXPORT bool ShouldThrowOnError(v8::internal::Isolate* isolate);
-
 // A base class for backing stores, which is needed due to vagaries of
 // how static casts work with std::shared_ptr.
 class BackingStoreBase {};
diff --git a/deps/v8/include/v8-platform.h b/deps/v8/include/v8-platform.h
index 5d23cd665ed..7cfd18b5708 100644
--- a/deps/v8/include/v8-platform.h
+++ b/deps/v8/include/v8-platform.h
@@ -11,12 +11,34 @@
 #include <memory>
 #include <string>
 
-#include "v8config.h"  // NOLINT(build/include)
+#include "v8config.h"  // NOLINT(build/include_directory)
 
 namespace v8 {
 
 class Isolate;
 
+// Valid priorities supported by the task scheduling infrastructure.
+enum class TaskPriority : uint8_t {
+  /**
+   * Best effort tasks are not critical for performance of the application. The
+   * platform implementation should preempt such tasks if higher priority tasks
+   * arrive.
+   */
+  kBestEffort,
+  /**
+   * User visible tasks are long running background tasks that will
+   * improve performance and memory usage of the application upon completion.
+   * Example: background compilation and garbage collection.
+   */
+  kUserVisible,
+  /**
+   * User blocking tasks are highest priority tasks that block the execution
+   * thread (e.g. major garbage collection). They must be finished as soon as
+   * possible.
+   */
+  kUserBlocking,
+};
+
 /**
  * A Task represents a unit of work.
  */
@@ -113,6 +135,82 @@ class TaskRunner {
   TaskRunner& operator=(const TaskRunner&) = delete;
 };
 
+/**
+ * Delegate that's passed to Job's worker task, providing an entry point to
+ * communicate with the scheduler.
+ */
+class JobDelegate {
+ public:
+  /**
+   * Returns true if this thread should return from the worker task on the
+   * current thread ASAP. Workers should periodically invoke ShouldYield (or
+   * YieldIfNeeded()) as often as is reasonable.
+   */
+  virtual bool ShouldYield() = 0;
+
+  /**
+   * Notifies the scheduler that max concurrency was increased, and the number
+   * of worker should be adjusted accordingly. See Platform::PostJob() for more
+   * details.
+   */
+  virtual void NotifyConcurrencyIncrease() = 0;
+};
+
+/**
+ * Handle returned when posting a Job. Provides methods to control execution of
+ * the posted Job.
+ */
+class JobHandle {
+ public:
+  virtual ~JobHandle() = default;
+
+  /**
+   * Notifies the scheduler that max concurrency was increased, and the number
+   * of worker should be adjusted accordingly. See Platform::PostJob() for more
+   * details.
+   */
+  virtual void NotifyConcurrencyIncrease() = 0;
+
+  /**
+   * Contributes to the job on this thread. Doesn't return until all tasks have
+   * completed and max concurrency becomes 0. When Join() is called and max
+   * concurrency reaches 0, it should not increase again. This also promotes
+   * this Job's priority to be at least as high as the calling thread's
+   * priority.
+   */
+  virtual void Join() = 0;
+
+  /**
+   * Forces all existing workers to yield ASAP. Waits until they have all
+   * returned from the Job's callback before returning.
+   */
+  virtual void Cancel() = 0;
+
+  /**
+   * Returns true if associated with a Job and other methods may be called.
+   * Returns false after Join() or Cancel() was called.
+   */
+  virtual bool IsRunning() = 0;
+};
+
+/**
+ * A JobTask represents work to run in parallel from Platform::PostJob().
+ */
+class JobTask {
+ public:
+  virtual ~JobTask() = default;
+
+  virtual void Run(JobDelegate* delegate) = 0;
+
+  /**
+   * Controls the maximum number of threads calling Run() concurrently. Run() is
+   * only invoked if the number of threads previously running Run() was less
+   * than the value returned. Since GetMaxConcurrency() is a leaf function, it
+   * must not call back any JobHandle methods.
+   */
+  virtual size_t GetMaxConcurrency() const = 0;
+};
+
 /**
  * The interface represents complex arguments to trace events.
  */
@@ -138,6 +236,10 @@ class TracingController {
  public:
   virtual ~TracingController() = default;
 
+  // In Perfetto mode, trace events are written using Perfetto's Track Event
+  // API directly without going through the embedder. However, it is still
+  // possible to observe tracing being enabled and disabled.
+#if !defined(V8_USE_PERFETTO)
   /**
    * Called by TRACE_EVENT* macros, don't call this directly.
    * The name parameter is a category group for example:
@@ -183,6 +285,7 @@ class TracingController {
    **/
   virtual void UpdateTraceEventDuration(const uint8_t* category_enabled_flag,
                                         const char* name, uint64_t handle) {}
+#endif  // !defined(V8_USE_PERFETTO)
 
   class TraceStateObserver {
    public:
@@ -368,6 +471,64 @@ class Platform {
    */
   virtual bool IdleTasksEnabled(Isolate* isolate) { return false; }
 
+  /**
+   * Posts |job_task| to run in parallel. Returns a JobHandle associated with
+   * the Job, which can be joined or canceled.
+   * This avoids degenerate cases:
+   * - Calling CallOnWorkerThread() for each work item, causing significant
+   *   overhead.
+   * - Fixed number of CallOnWorkerThread() calls that split the work and might
+   *   run for a long time. This is problematic when many components post
+   *   "num cores" tasks and all expect to use all the cores. In these cases,
+   *   the scheduler lacks context to be fair to multiple same-priority requests
+   *   and/or ability to request lower priority work to yield when high priority
+   *   work comes in.
+   * A canonical implementation of |job_task| looks like:
+   * class MyJobTask : public JobTask {
+   *  public:
+   *   MyJobTask(...) : worker_queue_(...) {}
+   *   // JobTask:
+   *   void Run(JobDelegate* delegate) override {
+   *     while (!delegate->ShouldYield()) {
+   *       // Smallest unit of work.
+   *       auto work_item = worker_queue_.TakeWorkItem(); // Thread safe.
+   *       if (!work_item) return;
+   *       ProcessWork(work_item);
+   *     }
+   *   }
+   *
+   *   size_t GetMaxConcurrency() const override {
+   *     return worker_queue_.GetSize(); // Thread safe.
+   *   }
+   * };
+   * auto handle = PostJob(TaskPriority::kUserVisible,
+   *                       std::make_unique<MyJobTask>(...));
+   * handle->Join();
+   *
+   * PostJob() and methods of the returned JobHandle/JobDelegate, must never be
+   * called while holding a lock that could be acquired by JobTask::Run or
+   * JobTask::GetMaxConcurrency -- that could result in a deadlock. This is
+   * because [1] JobTask::GetMaxConcurrency may be invoked while holding
+   * internal lock (A), hence JobTask::GetMaxConcurrency can only use a lock (B)
+   * if that lock is *never* held while calling back into JobHandle from any
+   * thread (A=>B/B=>A deadlock) and [2] JobTask::Run or
+   * JobTask::GetMaxConcurrency may be invoked synchronously from JobHandle
+   * (B=>JobHandle::foo=>B deadlock).
+   *
+   * A sufficient PostJob() implementation that uses the default Job provided in
+   * libplatform looks like:
+   *  std::unique_ptr<JobHandle> PostJob(
+   *      TaskPriority priority, std::unique_ptr<JobTask> job_task) override {
+   *    return std::make_unique<DefaultJobHandle>(
+   *        std::make_shared<DefaultJobState>(
+   *            this, std::move(job_task), kNumThreads));
+   * }
+   */
+  virtual std::unique_ptr<JobHandle> PostJob(
+      TaskPriority priority, std::unique_ptr<JobTask> job_task) {
+    return nullptr;
+  }
+
   /**
    * Monotonically increasing time in seconds from an arbitrary fixed point in
    * the past. This function is expected to return at least
diff --git a/deps/v8/include/v8-profiler.h b/deps/v8/include/v8-profiler.h
index 866d799076e..c3b25e8d6a6 100644
--- a/deps/v8/include/v8-profiler.h
+++ b/deps/v8/include/v8-profiler.h
@@ -10,7 +10,7 @@
 #include <unordered_set>
 #include <vector>
 
-#include "v8.h"  // NOLINT(build/include)
+#include "v8.h"  // NOLINT(build/include_directory)
 
 /**
  * Profiler support for the V8 JavaScript engine.
diff --git a/deps/v8/include/v8-util.h b/deps/v8/include/v8-util.h
index 29d813e4274..89ec4f6a789 100644
--- a/deps/v8/include/v8-util.h
+++ b/deps/v8/include/v8-util.h
@@ -5,7 +5,7 @@
 #ifndef V8_UTIL_H_
 #define V8_UTIL_H_
 
-#include "v8.h"  // NOLINT(build/include)
+#include "v8.h"  // NOLINT(build/include_directory)
 #include <assert.h>
 #include <map>
 #include <vector>
diff --git a/deps/v8/include/v8-version-string.h b/deps/v8/include/v8-version-string.h
index fb84144d544..8faed2a7405 100644
--- a/deps/v8/include/v8-version-string.h
+++ b/deps/v8/include/v8-version-string.h
@@ -5,7 +5,7 @@
 #ifndef V8_VERSION_STRING_H_
 #define V8_VERSION_STRING_H_
 
-#include "v8-version.h"  // NOLINT(build/include)
+#include "v8-version.h"  // NOLINT(build/include_directory)
 
 // This is here rather than v8-version.h to keep that file simple and
 // machine-processable.
diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
index 64f18486653..1061218a36a 100644
--- a/deps/v8/include/v8-version.h
+++ b/deps/v8/include/v8-version.h
@@ -9,9 +9,9 @@
 // NOTE these macros are used by some of the tool scripts and the build
 // system so their names cannot be changed without changing the scripts.
 #define V8_MAJOR_VERSION 8
-#define V8_MINOR_VERSION 3
-#define V8_BUILD_NUMBER 110
-#define V8_PATCH_LEVEL 9
+#define V8_MINOR_VERSION 5
+#define V8_BUILD_NUMBER 74
+#define V8_PATCH_LEVEL 0
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/deps/v8/include/v8-wasm-trap-handler-posix.h b/deps/v8/include/v8-wasm-trap-handler-posix.h
index 998d0a41bb7..9b8e8a5b496 100644
--- a/deps/v8/include/v8-wasm-trap-handler-posix.h
+++ b/deps/v8/include/v8-wasm-trap-handler-posix.h
@@ -7,7 +7,7 @@
 
 #include <signal.h>
 
-#include "v8config.h"  // NOLINT(build/include)
+#include "v8config.h"  // NOLINT(build/include_directory)
 
 namespace v8 {
 /**
diff --git a/deps/v8/include/v8-wasm-trap-handler-win.h b/deps/v8/include/v8-wasm-trap-handler-win.h
index 0185df6401c..9d3cad58483 100644
--- a/deps/v8/include/v8-wasm-trap-handler-win.h
+++ b/deps/v8/include/v8-wasm-trap-handler-win.h
@@ -7,7 +7,7 @@
 
 #include <windows.h>
 
-#include "v8config.h"  // NOLINT(build/include)
+#include "v8config.h"  // NOLINT(build/include_directory)
 
 namespace v8 {
 /**
diff --git a/deps/v8/include/v8.h b/deps/v8/include/v8.h
index 5dcb6765608..5773d083987 100644
--- a/deps/v8/include/v8.h
+++ b/deps/v8/include/v8.h
@@ -18,15 +18,17 @@
 #include <stddef.h>
 #include <stdint.h>
 #include <stdio.h>
+
 #include <memory>
 #include <string>
 #include <type_traits>
 #include <utility>
 #include <vector>
 
-#include "v8-internal.h"  // NOLINT(build/include)
-#include "v8-version.h"   // NOLINT(build/include)
-#include "v8config.h"     // NOLINT(build/include)
+#include "cppgc/common.h"
+#include "v8-internal.h"  // NOLINT(build/include_directory)
+#include "v8-version.h"   // NOLINT(build/include_directory)
+#include "v8config.h"     // NOLINT(build/include_directory)
 
 // We reserve the V8_* prefix for macros defined in V8 public API and
 // assume there are no name conflicts with the embedder's code.
@@ -123,19 +125,21 @@ namespace internal {
 enum class ArgumentsType;
 template <ArgumentsType>
 class Arguments;
+template <typename T>
+class CustomArguments;
 class DeferredHandles;
+class FunctionCallbackArguments;
+class GlobalHandles;
 class Heap;
 class HeapObject;
 class ExternalString;
 class Isolate;
 class LocalEmbedderHeapTracer;
 class MicrotaskQueue;
-struct ScriptStreamingData;
-template<typename T> class CustomArguments;
 class PropertyCallbackArguments;
-class FunctionCallbackArguments;
-class GlobalHandles;
+class ReadOnlyHeap;
 class ScopedExternalStringLock;
+struct ScriptStreamingData;
 class ThreadLocalTop;
 
 namespace wasm {
@@ -4764,11 +4768,17 @@ class V8_EXPORT CompiledWasmModule {
    */
   MemorySpan<const uint8_t> GetWireBytesRef();
 
+  const std::string& source_url() const { return source_url_; }
+
  private:
-  explicit CompiledWasmModule(std::shared_ptr<internal::wasm::NativeModule>);
-  friend class Utils;
+  friend class WasmModuleObject;
+  friend class WasmStreaming;
+
+  explicit CompiledWasmModule(std::shared_ptr<internal::wasm::NativeModule>,
+                              const char* source_url, size_t url_length);
 
   const std::shared_ptr<internal::wasm::NativeModule> native_module_;
+  const std::string source_url_;
 };
 
 // An instance of WebAssembly.Module.
@@ -5935,37 +5945,6 @@ class V8_EXPORT RegExp : public Object {
   static void CheckCast(Value* obj);
 };
 
-/**
- * An instance of the built-in FinalizationRegistry constructor.
- *
- * The C++ name is FinalizationGroup for backwards compatibility. This API is
- * experimental and deprecated.
- */
-class V8_EXPORT FinalizationGroup : public Object {
- public:
-  /**
-   * Runs the cleanup callback of the given FinalizationRegistry.
-   *
-   * V8 will inform the embedder that there are finalizer callbacks be
-   * called through HostCleanupFinalizationGroupCallback.
-   *
-   * HostCleanupFinalizationGroupCallback should schedule a task to
-   * call FinalizationGroup::Cleanup() at some point in the
-   * future. It's the embedders responsiblity to make this call at a
-   * time which does not interrupt synchronous ECMAScript code
-   * execution.
-   *
-   * If the result is Nothing<bool> then an exception has
-   * occurred. Otherwise the result is |true| if the cleanup callback
-   * was called successfully. The result is never |false|.
-   */
-  V8_DEPRECATED(
-      "FinalizationGroup cleanup is automatic if "
-      "HostCleanupFinalizationGroupCallback is not set")
-  static V8_WARN_UNUSED_RESULT Maybe<bool> Cleanup(
-      Local<FinalizationGroup> finalization_group);
-};
-
 /**
  * A JavaScript value that wraps a C++ void*. This type of value is mainly used
  * to associate C++ data structures with JavaScript objects.
@@ -6451,11 +6430,6 @@ class V8_EXPORT FunctionTemplate : public Template {
       SideEffectType side_effect_type = SideEffectType::kHasSideEffect,
       const CFunction* c_function = nullptr);
 
-  /** Get a template included in the snapshot by index. */
-  V8_DEPRECATED("Use v8::Isolate::GetDataFromSnapshotOnce instead")
-  static MaybeLocal<FunctionTemplate> FromSnapshot(Isolate* isolate,
-                                                   size_t index);
-
   /**
    * Creates a function template backed/cached by a private property.
    */
@@ -6745,11 +6719,6 @@ class V8_EXPORT ObjectTemplate : public Template {
       Isolate* isolate,
       Local<FunctionTemplate> constructor = Local<FunctionTemplate>());
 
-  /** Get a template included in the snapshot by index. */
-  V8_DEPRECATED("Use v8::Isolate::GetDataFromSnapshotOnce instead")
-  static MaybeLocal<ObjectTemplate> FromSnapshot(Isolate* isolate,
-                                                 size_t index);
-
   /** Creates a new instance of this template.*/
   V8_WARN_UNUSED_RESULT MaybeLocal<Object> NewInstance(Local<Context> context);
 
@@ -7182,6 +7151,9 @@ class V8_EXPORT Exception {
   static Local<Value> ReferenceError(Local<String> message);
   static Local<Value> SyntaxError(Local<String> message);
   static Local<Value> TypeError(Local<String> message);
+  static Local<Value> WasmCompileError(Local<String> message);
+  static Local<Value> WasmLinkError(Local<String> message);
+  static Local<Value> WasmRuntimeError(Local<String> message);
   static Local<Value> Error(Local<String> message);
 
   /**
@@ -7225,20 +7197,6 @@ typedef void (*AddCrashKeyCallback)(CrashKeyId id, const std::string& value);
 typedef void (*BeforeCallEnteredCallback)(Isolate*);
 typedef void (*CallCompletedCallback)(Isolate*);
 
-/**
- * HostCleanupFinalizationGroupCallback is called when we require the
- * embedder to enqueue a task that would call
- * FinalizationGroup::Cleanup().
- *
- * The FinalizationGroup is the one for which the embedder needs to
- * call FinalizationGroup::Cleanup() on.
- *
- * The context provided is the one in which the FinalizationGroup was
- * created in.
- */
-typedef void (*HostCleanupFinalizationGroupCallback)(
-    Local<Context> context, Local<FinalizationGroup> fg);
-
 /**
  * HostImportModuleDynamicallyCallback is called when we require the
  * embedder to load a module. This is used as part of the dynamic
@@ -7265,7 +7223,8 @@ typedef MaybeLocal<Promise> (*HostImportModuleDynamicallyCallback)(
 
 /**
  * HostInitializeImportMetaObjectCallback is called the first time import.meta
- * is accessed for a module. Subsequent access will reuse the same value.
+ * is accessed for a module. Subsequent access will reuse the same value. The
+ * callback must not throw.
  *
  * The method combines two implementation-defined abstract operations into one:
  * HostGetImportMetaProperties and HostFinalizeImportMeta.
@@ -7527,6 +7486,9 @@ typedef bool (*WasmThreadsEnabledCallback)(Local<Context> context);
 typedef Local<String> (*WasmLoadSourceMapCallback)(Isolate* isolate,
                                                    const char* name);
 
+// --- Callback for checking if WebAssembly Simd is enabled ---
+typedef bool (*WasmSimdEnabledCallback)(Local<Context> context);
+
 // --- Garbage Collection Callbacks ---
 
 /**
@@ -7604,6 +7566,7 @@ class V8_EXPORT SharedMemoryStatistics {
   size_t read_only_space_physical_size_;
 
   friend class V8;
+  friend class internal::ReadOnlyHeap;
 };
 
 /**
@@ -7883,16 +7846,12 @@ enum class MemoryPressureLevel { kNone, kModerate, kCritical };
  */
 class V8_EXPORT EmbedderHeapTracer {
  public:
+  using EmbedderStackState = cppgc::EmbedderStackState;
+
   enum TraceFlags : uint64_t {
     kNoFlags = 0,
     kReduceMemory = 1 << 0,
-  };
-
-  // Indicator for the stack state of the embedder.
-  enum EmbedderStackState {
-    kUnknown,
-    kNonEmpty,
-    kEmpty,
+    kForced = 1 << 2,
   };
 
   /**
@@ -8184,7 +8143,9 @@ class V8_EXPORT Isolate {
           array_buffer_allocator_shared(),
           external_references(nullptr),
           allow_atomics_wait(true),
-          only_terminate_in_safe_scope(false) {}
+          only_terminate_in_safe_scope(false),
+          embedder_wrapper_type_index(-1),
+          embedder_wrapper_object_index(-1) {}
 
     /**
      * Allows the host application to provide the address of a function that is
@@ -8248,6 +8209,14 @@ class V8_EXPORT Isolate {
      * Termination is postponed when there is no active SafeForTerminationScope.
      */
     bool only_terminate_in_safe_scope;
+
+    /**
+     * The following parameters describe the offsets for addressing type info
+     * for wrapped API objects and are used by the fast C API
+     * (for details see v8-fast-api-calls.h).
+     */
+    int embedder_wrapper_type_index;
+    int embedder_wrapper_object_index;
   };
 
 
@@ -8340,7 +8309,7 @@ class V8_EXPORT Isolate {
 
   /**
    * This scope allows terminations inside direct V8 API calls and forbid them
-   * inside any recursice API calls without explicit SafeForTerminationScope.
+   * inside any recursive API calls without explicit SafeForTerminationScope.
    */
   class V8_EXPORT SafeForTerminationScope {
    public:
@@ -8445,7 +8414,7 @@ class V8_EXPORT Isolate {
     kOptimizedFunctionWithOneShotBytecode = 71,
     kRegExpMatchIsTrueishOnNonJSRegExp = 72,
     kRegExpMatchIsFalseishOnJSRegExp = 73,
-    kDateGetTimezoneOffset = 74,
+    kDateGetTimezoneOffset = 74,  // Unused.
     kStringNormalize = 75,
     kCallSiteAPIGetFunctionSloppyCall = 76,
     kCallSiteAPIGetThisSloppyCall = 77,
@@ -8461,6 +8430,24 @@ class V8_EXPORT Isolate {
     kDateTimeFormatDateTimeStyle = 87,
     kBreakIteratorTypeWord = 88,
     kBreakIteratorTypeLine = 89,
+    kInvalidatedArrayBufferDetachingProtector = 90,
+    kInvalidatedArrayConstructorProtector = 91,
+    kInvalidatedArrayIteratorLookupChainProtector = 92,
+    kInvalidatedArraySpeciesLookupChainProtector = 93,
+    kInvalidatedIsConcatSpreadableLookupChainProtector = 94,
+    kInvalidatedMapIteratorLookupChainProtector = 95,
+    kInvalidatedNoElementsProtector = 96,
+    kInvalidatedPromiseHookProtector = 97,
+    kInvalidatedPromiseResolveLookupChainProtector = 98,
+    kInvalidatedPromiseSpeciesLookupChainProtector = 99,
+    kInvalidatedPromiseThenLookupChainProtector = 100,
+    kInvalidatedRegExpSpeciesLookupChainProtector = 101,
+    kInvalidatedSetIteratorLookupChainProtector = 102,
+    kInvalidatedStringIteratorLookupChainProtector = 103,
+    kInvalidatedStringLengthOverflowLookupChainProtector = 104,
+    kInvalidatedTypedArraySpeciesLookupChainProtector = 105,
+    kWasmSimdOpcodes = 106,
+    kVarRedeclaredCatchBinding = 107,
 
     // If you add new values here, you'll also need to update Chromium's:
     // web_feature.mojom, use_counter_callback.cc, and enums.xml. V8 changes to
@@ -8549,17 +8536,6 @@ class V8_EXPORT Isolate {
   void SetAbortOnUncaughtExceptionCallback(
       AbortOnUncaughtExceptionCallback callback);
 
-  /**
-   * This specifies the callback to be called when FinalizationRegistries
-   * are ready to be cleaned up and require FinalizationGroup::Cleanup()
-   * to be called in a future task.
-   */
-  V8_DEPRECATED(
-      "FinalizationRegistry cleanup is automatic if "
-      "HostCleanupFinalizationGroupCallback is not set")
-  void SetHostCleanupFinalizationGroupCallback(
-      HostCleanupFinalizationGroupCallback callback);
-
   /**
    * This specifies the callback called by the upcoming dynamic
    * import() language feature to load modules.
@@ -8568,7 +8544,7 @@ class V8_EXPORT Isolate {
       HostImportModuleDynamicallyCallback callback);
 
   /**
-   * This specifies the callback called by the upcoming importa.meta
+   * This specifies the callback called by the upcoming import.meta
    * language feature to retrieve host-defined meta data for a module.
    */
   void SetHostInitializeImportMetaObjectCallback(
@@ -9374,6 +9350,8 @@ class V8_EXPORT Isolate {
 
   void SetWasmLoadSourceMapCallback(WasmLoadSourceMapCallback callback);
 
+  void SetWasmSimdEnabledCallback(WasmSimdEnabledCallback callback);
+
   /**
   * Check if V8 is dead and therefore unusable.  This is the case after
   * fatal errors such as out-of-memory situations.
@@ -9512,7 +9490,6 @@ class V8_EXPORT Isolate {
 
   internal::Address* GetDataFromSnapshotOnce(size_t index);
   void ReportExternalAllocationLimitReached();
-  void CheckMemoryPressure();
 };
 
 class V8_EXPORT StartupData {
@@ -9523,12 +9500,16 @@ class V8_EXPORT StartupData {
    * Only valid for StartupData returned by SnapshotCreator::CreateBlob().
    */
   bool CanBeRehashed() const;
+  /**
+   * Allows embedders to verify whether the data is valid for the current
+   * V8 instance.
+   */
+  bool IsValid() const;
 
   const char* data;
   int raw_size;
 };
 
-
 /**
  * EntropySource is used as a callback function when v8 needs a source
  * of entropy.
@@ -9598,7 +9579,13 @@ class V8_EXPORT V8 {
    * Initializes V8. This function needs to be called before the first Isolate
    * is created. It always returns true.
    */
-  static bool Initialize();
+  V8_INLINE static bool Initialize() {
+    const int kBuildConfiguration =
+        (internal::PointerCompressionIsEnabled() ? kPointerCompression : 0) |
+        (internal::SmiValuesAre31Bits() ? k31BitSmis : 0) |
+        (internal::HeapSandboxIsEnabled() ? kHeapSandbox : 0);
+    return Initialize(kBuildConfiguration);
+  }
 
   /**
    * Allows the host application to provide a callback which can be used
@@ -9732,6 +9719,18 @@ class V8_EXPORT V8 {
  private:
   V8();
 
+  enum BuildConfigurationFeatures {
+    kPointerCompression = 1 << 0,
+    k31BitSmis = 1 << 1,
+    kHeapSandbox = 1 << 2,
+  };
+
+  /**
+   * Checks that the embedder build configuration is compatible with
+   * the V8 binary and if so initializes V8.
+   */
+  static bool Initialize(int build_config);
+
   static internal::Address* GlobalizeReference(internal::Isolate* isolate,
                                                internal::Address* handle);
   static internal::Address* GlobalizeTracedReference(internal::Isolate* isolate,
@@ -9788,6 +9787,11 @@ class V8_EXPORT V8 {
 
 /**
  * Helper class to create a snapshot data blob.
+ *
+ * The Isolate used by a SnapshotCreator is owned by it, and will be entered
+ * and exited by the constructor and destructor, respectively; The destructor
+ * will also destroy the Isolate. Experimental language features, including
+ * those available by default, are not available while creating a snapshot.
  */
 class V8_EXPORT SnapshotCreator {
  public:
@@ -9816,6 +9820,10 @@ class V8_EXPORT SnapshotCreator {
   SnapshotCreator(const intptr_t* external_references = nullptr,
                   StartupData* existing_blob = nullptr);
 
+  /**
+   * Destroy the snapshot creator, and exit and dispose of the Isolate
+   * associated with it.
+   */
   ~SnapshotCreator();
 
   /**
@@ -9846,13 +9854,6 @@ class V8_EXPORT SnapshotCreator {
                     SerializeInternalFieldsCallback callback =
                         SerializeInternalFieldsCallback());
 
-  /**
-   * Add a template to be included in the snapshot blob.
-   * \returns the index of the template in the snapshot blob.
-   */
-  V8_DEPRECATED("use AddData instead")
-  size_t AddTemplate(Local<Template> template_obj);
-
   /**
    * Attach arbitrary V8::Data to the context snapshot, which can be retrieved
    * via Context::GetDataFromSnapshot after deserialization. This data does not
@@ -11363,7 +11364,9 @@ void* Object::GetAlignedPointerFromInternalField(int index) {
                 instance_type == I::kJSApiObjectType ||
                 instance_type == I::kJSSpecialApiObjectType)) {
     int offset = I::kJSObjectHeaderSize + (I::kEmbedderDataSlotSize * index);
-    return I::ReadRawField<void*>(obj, offset);
+    internal::Isolate* isolate = I::GetIsolateForHeapSandbox(obj);
+    A value = I::ReadExternalPointerField(isolate, obj, offset);
+    return reinterpret_cast<void*>(value);
   }
 #endif
   return SlowGetAlignedPointerFromInternalField(index);
@@ -11393,7 +11396,9 @@ String::ExternalStringResource* String::GetExternalStringResource() const {
 
   ExternalStringResource* result;
   if (I::IsExternalTwoByteString(I::GetInstanceType(obj))) {
-    void* value = I::ReadRawField<void*>(obj, I::kStringResourceOffset);
+    internal::Isolate* isolate = I::GetIsolateForHeapSandbox(obj);
+    A value =
+        I::ReadExternalPointerField(isolate, obj, I::kStringResourceOffset);
     result = reinterpret_cast<String::ExternalStringResource*>(value);
   } else {
     result = GetExternalStringResourceSlow();
@@ -11415,8 +11420,10 @@ String::ExternalStringResourceBase* String::GetExternalStringResourceBase(
   ExternalStringResourceBase* resource;
   if (type == I::kExternalOneByteRepresentationTag ||
       type == I::kExternalTwoByteRepresentationTag) {
-    void* value = I::ReadRawField<void*>(obj, I::kStringResourceOffset);
-    resource = static_cast<ExternalStringResourceBase*>(value);
+    internal::Isolate* isolate = I::GetIsolateForHeapSandbox(obj);
+    A value =
+        I::ReadExternalPointerField(isolate, obj, I::kStringResourceOffset);
+    resource = reinterpret_cast<ExternalStringResourceBase*>(value);
   } else {
     resource = GetExternalStringResourceBaseSlow(encoding_out);
   }
@@ -11932,7 +11939,6 @@ MaybeLocal<T> Isolate::GetDataFromSnapshotOnce(size_t index) {
 int64_t Isolate::AdjustAmountOfExternalAllocatedMemory(
     int64_t change_in_bytes) {
   typedef internal::Internals I;
-  constexpr int64_t kMemoryReducerActivationLimit = 32 * 1024 * 1024;
   int64_t* external_memory = reinterpret_cast<int64_t*>(
       reinterpret_cast<uint8_t*>(this) + I::kExternalMemoryOffset);
   int64_t* external_memory_limit = reinterpret_cast<int64_t*>(
@@ -11955,14 +11961,6 @@ int64_t Isolate::AdjustAmountOfExternalAllocatedMemory(
 
   if (change_in_bytes <= 0) return *external_memory;
 
-  int64_t allocation_diff_since_last_mc = static_cast<int64_t>(
-      static_cast<uint64_t>(*external_memory) -
-      static_cast<uint64_t>(*external_memory_low_since_mc));
-  // Only check memory pressure and potentially trigger GC if the amount of
-  // external memory increased.
-  if (allocation_diff_since_last_mc > kMemoryReducerActivationLimit) {
-    CheckMemoryPressure();
-  }
   if (amount > *external_memory_limit) {
     ReportExternalAllocationLimitReached();
   }
@@ -12004,7 +12002,9 @@ void* Context::GetAlignedPointerFromEmbedderData(int index) {
       I::ReadTaggedPointerField(ctx, I::kNativeContextEmbedderDataOffset);
   int value_offset =
       I::kEmbedderDataArrayHeaderSize + (I::kEmbedderDataSlotSize * index);
-  return I::ReadRawField<void*>(embedder_data, value_offset);
+  internal::Isolate* isolate = I::GetIsolateForHeapSandbox(ctx);
+  return reinterpret_cast<void*>(
+      I::ReadExternalPointerField(isolate, embedder_data, value_offset));
 #else
   return SlowGetAlignedPointerFromEmbedderData(index);
 #endif
diff --git a/deps/v8/include/v8config.h b/deps/v8/include/v8config.h
index 40d23c35c18..9825232d6a1 100644
--- a/deps/v8/include/v8config.h
+++ b/deps/v8/include/v8config.h
@@ -405,6 +405,15 @@
 #endif
 
 
+#if defined(__GNUC__) && !defined(__clang__) && (__GNUC__ < 6)
+# define V8_ENUM_DEPRECATED(message)
+# define V8_ENUM_DEPRECATE_SOON(message)
+#else
+# define V8_ENUM_DEPRECATED(message) V8_DEPRECATED(message)
+# define V8_ENUM_DEPRECATE_SOON(message) V8_DEPRECATE_SOON(message)
+#endif
+
+
 // A macro to provide the compiler with branch prediction information.
 #if V8_HAS_BUILTIN_EXPECT
 # define V8_UNLIKELY(condition) (__builtin_expect(!!(condition), 0))
diff --git a/deps/v8/infra/mb/mb_config.pyl b/deps/v8/infra/mb/mb_config.pyl
index 8677333c2f8..7385910156d 100644
--- a/deps/v8/infra/mb/mb_config.pyl
+++ b/deps/v8/infra/mb/mb_config.pyl
@@ -78,6 +78,7 @@
       # Sanitizers.
       'V8 Linux64 ASAN': 'release_x64_asan',
       'V8 Linux64 TSAN - builder': 'release_x64_tsan',
+      'V8 Linux - arm64 - sim - CFI': 'release_simulate_arm64_cfi',
       'V8 Linux - arm64 - sim - MSAN': 'release_simulate_arm64_msan',
       # Misc.
       'V8 Linux gcc': 'release_x86_gcc',
@@ -98,6 +99,7 @@
       'V8 Linux64 - gcov coverage': 'release_x64_gcc_coverage',
       'V8 Linux - predictable': 'release_x86_predictable',
       'V8 Linux - full debug': 'full_debug_x86',
+      'V8 Mac64 - full debug': 'full_debug_x64',
       'V8 Random Deopt Fuzzer - debug': 'debug_x64',
     },
     'client.v8.clusterfuzz': {
@@ -230,6 +232,7 @@
       'v8_linux64_asan_rel_ng': 'release_x64_asan_minimal_symbols',
       'v8_linux64_cfi_rel_ng': 'release_x64_cfi',
       'v8_linux64_msan_rel': 'release_simulate_arm64_msan_minimal_symbols',
+      'v8_linux64_msan_rel_ng': 'release_simulate_arm64_msan_minimal_symbols',
       'v8_linux64_sanitizer_coverage_rel':
           'release_x64_asan_minimal_symbols_coverage',
       'v8_linux64_tsan_rel': 'release_x64_tsan_minimal_symbols',
@@ -251,6 +254,7 @@
       'v8_mac64_rel_ng': 'release_x64_trybot',
       'v8_mac64_dbg': 'debug_x64',
       'v8_mac64_dbg_ng': 'debug_x64',
+      'v8_mac64_compile_full_dbg_ng': 'full_debug_x64',
       'v8_mac64_asan_rel': 'release_x64_asan_no_lsan',
       'v8_linux_arm_rel_ng': 'release_simulate_arm_trybot',
       'v8_linux_arm_lite_rel_ng': 'release_simulate_arm_lite_trybot',
@@ -258,6 +262,7 @@
       'v8_linux_arm_armv8a_rel': 'release_simulate_arm_trybot',
       'v8_linux_arm_armv8a_dbg': 'debug_simulate_arm',
       'v8_linux_arm64_rel_ng': 'release_simulate_arm64_trybot',
+      'v8_linux_arm64_cfi_rel_ng' : 'release_simulate_arm64_cfi',
       'v8_linux_arm64_dbg': 'debug_simulate_arm64',
       'v8_linux_arm64_gc_stress_dbg': 'debug_simulate_arm64',
       'v8_linux_mipsel_compile_rel': 'release_simulate_mipsel',
@@ -363,6 +368,8 @@
       'release_trybot', 'simulate_arm', 'v8_enable_lite_mode'],
     'release_simulate_arm64': [
       'release_bot', 'simulate_arm64'],
+    'release_simulate_arm64_cfi': [
+      'release_bot', 'simulate_arm64', 'v8_control_flow_integrity'],
     'release_simulate_arm64_pointer_compression': [
       # TODO(v8:v7703): Make pointer compression bots testing non pointer
       # compression mode while pointer compression is temporarily enabled
@@ -513,6 +520,8 @@
       'debug_trybot', 'x64'],
     'debug_x64_trybot_custom': [
       'debug_trybot', 'x64', 'v8_snapshot_custom'],
+    'full_debug_x64': [
+      'debug_bot', 'x64', 'v8_full_debug'],
 
     # Debug configs for x86.
     'debug_x86': [
@@ -776,6 +785,10 @@
       'gn_args': 'v8_correctness_fuzzer=true v8_multi_arch_build=true',
     },
 
+    'v8_control_flow_integrity' : {
+      'gn_args': 'v8_control_flow_integrity=true',
+    },
+
     'v8_enable_lite_mode': {
       'gn_args': 'v8_enable_lite_mode=true',
     },
diff --git a/deps/v8/infra/testing/builders.pyl b/deps/v8/infra/testing/builders.pyl
index 6c3379b5cbc..77d9a80f5d6 100644
--- a/deps/v8/infra/testing/builders.pyl
+++ b/deps/v8/infra/testing/builders.pyl
@@ -310,12 +310,15 @@
       'os': 'Ubuntu-16.04',
     },
     'tests': [
+      # Infra staging.
+      {'name': 'v8testing', 'variant': 'infra_staging', 'shards': 2},
+      # Native context independent code.
+      {'name': 'v8testing', 'variant': 'nci'},
       # Stress sampling.
       {'name': 'mjsunit', 'variant': 'stress_sampling'},
       {'name': 'webkit', 'variant': 'stress_sampling'},
-      # Infra staging.
-      {'name': 'test262', 'variant': 'infra_staging', 'shards': 2},
-      {'name': 'v8testing', 'variant': 'infra_staging', 'shards': 2},
+      # Stress snapshot.
+      {'name': 'mjsunit', 'variant': 'stress_snapshot'},
     ],
   },
   'v8_linux64_msan_rel': {
@@ -327,6 +330,15 @@
       {'name': 'v8testing', 'shards': 5},
     ],
   },
+  'v8_linux64_msan_rel_ng_triggered': {
+    'swarming_dimensions' : {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
+      {'name': 'v8testing', 'shards': 5},
+    ],
+  },
   'v8_linux64_nodcheck_rel_ng_triggered': {
     'swarming_dimensions' : {
       'cpu': 'x86-64-avx2',
@@ -481,6 +493,15 @@
       {'name': 'v8testing', 'variant': 'trusted', 'shards': 5},
     ],
   },
+  'v8_linux_arm64_cfi_rel_ng_triggered': {
+    'swarming_dimensions' : {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'test262', 'variant': 'default', 'shards': 3},
+      {'name': 'v8testing', 'shards': 4},
+    ],
+  },
   'v8_linux64_arm64_pointer_compression_rel_ng_triggered': {
     'swarming_dimensions' : {
       'os': 'Ubuntu-16.04',
@@ -679,6 +700,15 @@
       },
     ],
   },
+  'V8 Linux - arm64 - sim - CFI': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'test262', 'variant': 'default', 'shards': 3},
+      {'name': 'v8testing', 'shards': 4},
+    ],
+  },
   'V8 Linux - arm64 - sim - MSAN': {
     'swarming_dimensions': {
       'os': 'Ubuntu-16.04',
@@ -941,9 +971,13 @@
     'tests': [
       # Infra staging.
       {'name': 'v8testing', 'variant': 'infra_staging', 'shards': 2},
+      # Native context independent code.
+      {'name': 'v8testing', 'variant': 'nci'},
       # Stress sampling.
-      {'name': 'mjsunit', 'variant': 'stress_sampling', 'shards': 1},
-      {'name': 'webkit', 'variant': 'stress_sampling', 'shards': 1},
+      {'name': 'mjsunit', 'variant': 'stress_sampling'},
+      {'name': 'webkit', 'variant': 'stress_sampling'},
+      # Stress snapshot.
+      {'name': 'mjsunit', 'variant': 'stress_snapshot'},
     ],
   },
   'V8 Linux64 - debug - perfetto': {
@@ -965,10 +999,14 @@
     },
     'tests': [
       # Infra staging.
-      {'name': 'v8testing', 'variant': 'infra_staging', 'shards': 1},
+      {'name': 'v8testing', 'variant': 'infra_staging'},
+      # Native context independent code.
+      {'name': 'v8testing', 'variant': 'nci'},
       # Stress sampling.
-      {'name': 'mjsunit', 'variant': 'stress_sampling', 'shards': 1},
-      {'name': 'webkit', 'variant': 'stress_sampling', 'shards': 1},
+      {'name': 'mjsunit', 'variant': 'stress_sampling'},
+      {'name': 'webkit', 'variant': 'stress_sampling'},
+      # Stress snapshot.
+      {'name': 'mjsunit', 'variant': 'stress_snapshot'},
     ],
   },
   'V8 Linux64 - gcov coverage': {
diff --git a/deps/v8/src/DEPS b/deps/v8/src/DEPS
index 772ad53b326..abea95558da 100644
--- a/deps/v8/src/DEPS
+++ b/deps/v8/src/DEPS
@@ -12,15 +12,22 @@ include_rules = [
   "+src/heap/embedder-tracing.h",
   "+src/heap/factory.h",
   "+src/heap/factory-inl.h",
+  # TODO(v8:10496): Don't expose so much (through transitive includes) outside
+  # of heap/.
   "+src/heap/heap.h",
   "+src/heap/heap-inl.h",
   "+src/heap/heap-write-barrier-inl.h",
   "+src/heap/heap-write-barrier.h",
   "+src/heap/local-heap.h",
+  # TODO(v8:10496): Don't expose memory chunk outside of heap/.
+  "+src/heap/memory-chunk.h",
+  "+src/heap/memory-chunk-inl.h",
   "+src/heap/off-thread-factory-inl.h",
   "+src/heap/off-thread-factory.h",
+  "+src/heap/off-thread-heap.h",
   "+src/heap/read-only-heap-inl.h",
   "+src/heap/read-only-heap.h",
+  "+src/heap/safepoint.h",
   "-src/inspector",
   "-src/interpreter",
   "+src/interpreter/bytecode-array-accessor.h",
@@ -54,4 +61,7 @@ specific_include_rules = {
     "+include/libplatform/v8-tracing.h",
     "+perfetto/tracing.h"
   ],
+  "builtins-trace\.cc": [
+    "+protos/perfetto",
+  ],
 }
diff --git a/deps/v8/src/api/api-arguments.h b/deps/v8/src/api/api-arguments.h
index 794681b71d0..18690b5db2b 100644
--- a/deps/v8/src/api/api-arguments.h
+++ b/deps/v8/src/api/api-arguments.h
@@ -160,11 +160,9 @@ class FunctionCallbackArguments
   static const int kIsolateIndex = T::kIsolateIndex;
   static const int kNewTargetIndex = T::kNewTargetIndex;
 
-  FunctionCallbackArguments(internal::Isolate* isolate, internal::Object data,
-                            internal::HeapObject callee,
-                            internal::Object holder,
-                            internal::HeapObject new_target,
-                            internal::Address* argv, int argc);
+  FunctionCallbackArguments(Isolate* isolate, Object data, HeapObject callee,
+                            Object holder, HeapObject new_target, Address* argv,
+                            int argc);
 
   /*
    * The following Call function wraps the calling of all callbacks to handle
diff --git a/deps/v8/src/api/api-inl.h b/deps/v8/src/api/api-inl.h
index 0d2ad2f8a0f..f686424286d 100644
--- a/deps/v8/src/api/api-inl.h
+++ b/deps/v8/src/api/api-inl.h
@@ -86,7 +86,6 @@ MAKE_TO_LOCAL(ToLocal, JSArrayBufferView, ArrayBufferView)
 MAKE_TO_LOCAL(ToLocal, JSDataView, DataView)
 MAKE_TO_LOCAL(ToLocal, JSTypedArray, TypedArray)
 MAKE_TO_LOCAL(ToLocalShared, JSArrayBuffer, SharedArrayBuffer)
-MAKE_TO_LOCAL(ToLocal, JSFinalizationRegistry, FinalizationGroup)
 
 TYPED_ARRAYS(MAKE_TO_LOCAL_TYPED_ARRAY)
 
diff --git a/deps/v8/src/api/api-natives.cc b/deps/v8/src/api/api-natives.cc
index 410c37ce98d..e21dbd0eeed 100644
--- a/deps/v8/src/api/api-natives.cc
+++ b/deps/v8/src/api/api-natives.cc
@@ -371,7 +371,7 @@ MaybeHandle<JSObject> InstantiateObject(Isolate* isolate,
                                         Handle<JSReceiver> new_target,
                                         bool is_prototype) {
   Handle<JSFunction> constructor;
-  int serial_number = Smi::ToInt(info->serial_number());
+  int serial_number = info->serial_number();
   if (!new_target.is_null()) {
     if (IsSimpleInstantiation(isolate, *info, *new_target)) {
       constructor = Handle<JSFunction>::cast(new_target);
@@ -462,7 +462,7 @@ MaybeHandle<Object> GetInstancePrototype(Isolate* isolate,
 MaybeHandle<JSFunction> InstantiateFunction(
     Isolate* isolate, Handle<NativeContext> native_context,
     Handle<FunctionTemplateInfo> data, MaybeHandle<Name> maybe_name) {
-  int serial_number = Smi::ToInt(data->serial_number());
+  int serial_number = data->serial_number();
   if (serial_number) {
     Handle<JSObject> result;
     if (ProbeInstantiationsCache(isolate, native_context, serial_number,
diff --git a/deps/v8/src/api/api.cc b/deps/v8/src/api/api.cc
index b2d6db3661a..d6f55b58cfb 100644
--- a/deps/v8/src/api/api.cc
+++ b/deps/v8/src/api/api.cc
@@ -28,6 +28,7 @@
 #include "src/codegen/compiler.h"
 #include "src/codegen/cpu-features.h"
 #include "src/common/assert-scope.h"
+#include "src/common/external-pointer.h"
 #include "src/common/globals.h"
 #include "src/compiler-dispatcher/compiler-dispatcher.h"
 #include "src/date/date.h"
@@ -96,10 +97,8 @@
 #include "src/regexp/regexp-utils.h"
 #include "src/runtime/runtime.h"
 #include "src/snapshot/code-serializer.h"
-#include "src/snapshot/partial-serializer.h"
-#include "src/snapshot/read-only-serializer.h"
 #include "src/snapshot/snapshot.h"
-#include "src/snapshot/startup-serializer.h"
+#include "src/snapshot/startup-serializer.h"  // For SerializedHandleChecker.
 #include "src/strings/char-predicates-inl.h"
 #include "src/strings/string-hasher.h"
 #include "src/strings/unicode-inl.h"
@@ -328,6 +327,7 @@ class CallDepthScope {
   bool CheckKeptObjectsClearedAfterMicrotaskCheckpoint(
       i::MicrotaskQueue* microtask_queue) {
     bool did_perform_microtask_checkpoint =
+        isolate_->thread_local_top()->CallDepthIsZero() &&
         do_callback && microtask_queue &&
         microtask_queue->microtasks_policy() == MicrotasksPolicy::kAuto;
     return !did_perform_microtask_checkpoint ||
@@ -598,7 +598,6 @@ SnapshotCreator::SnapshotCreator(Isolate* isolate,
                                  const intptr_t* external_references,
                                  StartupData* existing_snapshot) {
   SnapshotCreatorData* data = new SnapshotCreatorData(isolate);
-  data->isolate_ = isolate;
   i::Isolate* internal_isolate = reinterpret_cast<i::Isolate*>(isolate);
   internal_isolate->set_array_buffer_allocator(&data->allocator_);
   internal_isolate->set_api_external_references(external_references);
@@ -659,10 +658,6 @@ size_t SnapshotCreator::AddContext(Local<Context> context,
   return index;
 }
 
-size_t SnapshotCreator::AddTemplate(Local<Template> template_obj) {
-  return AddData(template_obj);
-}
-
 size_t SnapshotCreator::AddData(i::Address object) {
   DCHECK_NE(object, i::kNullAddress);
   SnapshotCreatorData* data = SnapshotCreatorData::cast(data_);
@@ -737,8 +732,11 @@ StartupData SnapshotCreator::CreateBlob(
   DCHECK(!data->created_);
   DCHECK(!data->default_context_.IsEmpty());
 
-  int num_additional_contexts = static_cast<int>(data->contexts_.Size());
+  const int num_additional_contexts = static_cast<int>(data->contexts_.Size());
+  const int num_contexts = num_additional_contexts + 1;  // The default context.
 
+  // Create and store lists of embedder-provided data needed during
+  // serialization.
   {
     i::HandleScope scope(isolate);
     // Convert list of context-independent data to FixedArray.
@@ -777,48 +775,15 @@ StartupData SnapshotCreator::CreateBlob(
     isolate->heap()->CompactWeakArrayLists(internal::AllocationType::kOld);
   }
 
-  if (function_code_handling == FunctionCodeHandling::kClear) {
-    // Clear out re-compilable data from all shared function infos. Any
-    // JSFunctions using these SFIs will have their code pointers reset by the
-    // partial serializer.
-    //
-    // We have to iterate the heap and collect handles to each clearable SFI,
-    // before we disable allocation, since we have to allocate UncompiledDatas
-    // to be able to recompile them.
-    //
-    // Compiled irregexp code is also flushed by collecting and clearing any
-    // seen JSRegExp objects.
-    i::HandleScope scope(isolate);
-    std::vector<i::Handle<i::SharedFunctionInfo>> sfis_to_clear;
-
-    {  // Heap allocation is disallowed within this scope.
-      i::HeapObjectIterator heap_iterator(isolate->heap());
-      for (i::HeapObject current_obj = heap_iterator.Next();
-           !current_obj.is_null(); current_obj = heap_iterator.Next()) {
-        if (current_obj.IsSharedFunctionInfo()) {
-          i::SharedFunctionInfo shared =
-              i::SharedFunctionInfo::cast(current_obj);
-          if (shared.CanDiscardCompiled()) {
-            sfis_to_clear.emplace_back(shared, isolate);
-          }
-        } else if (current_obj.IsJSRegExp()) {
-          i::JSRegExp regexp = i::JSRegExp::cast(current_obj);
-          if (regexp.HasCompiledCode()) {
-            regexp.DiscardCompiledCodeForSerialization();
-          }
-        }
-      }
-    }
-
-    // Must happen after heap iteration since SFI::DiscardCompiled may allocate.
-    for (i::Handle<i::SharedFunctionInfo> shared : sfis_to_clear) {
-      i::SharedFunctionInfo::DiscardCompiled(isolate, shared);
-    }
-  }
+  i::Snapshot::ClearReconstructableDataForSerialization(
+      isolate, function_code_handling == FunctionCodeHandling::kClear);
 
   i::DisallowHeapAllocation no_gc_from_here_on;
 
-  int num_contexts = num_additional_contexts + 1;
+  // Create a vector with all contexts and clear associated Persistent fields.
+  // Note these contexts may be dead after calling Clear(), but will not be
+  // collected until serialization completes and the DisallowHeapAllocation
+  // scope above goes out of scope.
   std::vector<i::Context> contexts;
   contexts.reserve(num_contexts);
   {
@@ -838,82 +803,19 @@ StartupData SnapshotCreator::CreateBlob(
   i::SerializedHandleChecker handle_checker(isolate, &contexts);
   CHECK(handle_checker.CheckGlobalAndEternalHandles());
 
-  i::HeapObjectIterator heap_iterator(isolate->heap());
-  for (i::HeapObject current_obj = heap_iterator.Next(); !current_obj.is_null();
-       current_obj = heap_iterator.Next()) {
-    if (current_obj.IsJSFunction()) {
-      i::JSFunction fun = i::JSFunction::cast(current_obj);
-
-      // Complete in-object slack tracking for all functions.
-      fun.CompleteInobjectSlackTrackingIfActive();
-
-      // Also, clear out feedback vectors, or any optimized code.
-      // Note that checking for fun.IsOptimized() || fun.IsInterpreted() is not
-      // sufficient because the function can have a feedback vector even if it
-      // is not compiled (e.g. when the bytecode was flushed). On the other
-      // hand, only checking for the feedback vector is not sufficient because
-      // there can be multiple functions sharing the same feedback vector. So we
-      // need all these checks.
-      if (fun.IsOptimized() || fun.IsInterpreted() ||
-          !fun.raw_feedback_cell().value().IsUndefined()) {
-        fun.raw_feedback_cell().set_value(
-            i::ReadOnlyRoots(isolate).undefined_value());
-        fun.set_code(isolate->builtins()->builtin(i::Builtins::kCompileLazy));
-      }
-      if (function_code_handling == FunctionCodeHandling::kClear) {
-        DCHECK(fun.shared().HasWasmExportedFunctionData() ||
-               fun.shared().HasBuiltinId() || fun.shared().IsApiFunction() ||
-               fun.shared().HasUncompiledDataWithoutPreparseData());
-      }
-    }
+  // Create a vector with all embedder fields serializers.
+  std::vector<SerializeInternalFieldsCallback> embedder_fields_serializers;
+  embedder_fields_serializers.reserve(num_contexts);
+  embedder_fields_serializers.push_back(
+      data->default_embedder_fields_serializer_);
+  for (int i = 0; i < num_additional_contexts; i++) {
+    embedder_fields_serializers.push_back(
+        data->embedder_fields_serializers_[i]);
   }
 
-  i::ReadOnlySerializer read_only_serializer(isolate);
-  read_only_serializer.SerializeReadOnlyRoots();
-
-  i::StartupSerializer startup_serializer(isolate, &read_only_serializer);
-  startup_serializer.SerializeStrongReferences();
-
-  // Serialize each context with a new partial serializer.
-  std::vector<i::SnapshotData*> context_snapshots;
-  context_snapshots.reserve(num_contexts);
-
-  // TODO(6593): generalize rehashing, and remove this flag.
-  bool can_be_rehashed = true;
-
-  for (int i = 0; i < num_contexts; i++) {
-    bool is_default_context = i == 0;
-    i::PartialSerializer partial_serializer(
-        isolate, &startup_serializer,
-        is_default_context ? data->default_embedder_fields_serializer_
-                           : data->embedder_fields_serializers_[i - 1]);
-    partial_serializer.Serialize(&contexts[i], !is_default_context);
-    can_be_rehashed = can_be_rehashed && partial_serializer.can_be_rehashed();
-    context_snapshots.push_back(new i::SnapshotData(&partial_serializer));
-  }
-
-  startup_serializer.SerializeWeakReferencesAndDeferred();
-  can_be_rehashed = can_be_rehashed && startup_serializer.can_be_rehashed();
-
-  startup_serializer.CheckNoDirtyFinalizationRegistries();
-
-  read_only_serializer.FinalizeSerialization();
-  can_be_rehashed = can_be_rehashed && read_only_serializer.can_be_rehashed();
-
-  i::SnapshotData read_only_snapshot(&read_only_serializer);
-  i::SnapshotData startup_snapshot(&startup_serializer);
-  StartupData result =
-      i::Snapshot::CreateSnapshotBlob(&startup_snapshot, &read_only_snapshot,
-                                      context_snapshots, can_be_rehashed);
-
-  // Delete heap-allocated context snapshot instances.
-  for (const auto context_snapshot : context_snapshots) {
-    delete context_snapshot;
-  }
   data->created_ = true;
-
-  DCHECK(i::Snapshot::VerifyChecksum(&result));
-  return result;
+  return i::Snapshot::Create(isolate, &contexts, embedder_fields_serializers,
+                             no_gc_from_here_on);
 }
 
 bool StartupData::CanBeRehashed() const {
@@ -921,6 +823,8 @@ bool StartupData::CanBeRehashed() const {
   return i::Snapshot::ExtractRehashability(this);
 }
 
+bool StartupData::IsValid() const { return i::Snapshot::VersionIsValid(this); }
+
 void V8::SetDcheckErrorHandler(DcheckErrorCallback that) {
   v8::base::SetDcheckFunction(that);
 }
@@ -1345,21 +1249,25 @@ void Context::SetEmbedderData(int index, v8::Local<Value> value) {
 
 void* Context::SlowGetAlignedPointerFromEmbedderData(int index) {
   const char* location = "v8::Context::GetAlignedPointerFromEmbedderData()";
-  HandleScope handle_scope(GetIsolate());
+  i::Isolate* isolate = Utils::OpenHandle(this)->GetIsolate();
+  i::HandleScope handle_scope(isolate);
   i::Handle<i::EmbedderDataArray> data =
       EmbedderDataFor(this, index, false, location);
   if (data.is_null()) return nullptr;
   void* result;
-  Utils::ApiCheck(i::EmbedderDataSlot(*data, index).ToAlignedPointer(&result),
-                  location, "Pointer is not aligned");
+  Utils::ApiCheck(
+      i::EmbedderDataSlot(*data, index).ToAlignedPointer(isolate, &result),
+      location, "Pointer is not aligned");
   return result;
 }
 
 void Context::SetAlignedPointerInEmbedderData(int index, void* value) {
   const char* location = "v8::Context::SetAlignedPointerInEmbedderData()";
+  i::Isolate* isolate = Utils::OpenHandle(this)->GetIsolate();
   i::Handle<i::EmbedderDataArray> data =
       EmbedderDataFor(this, index, true, location);
-  bool ok = i::EmbedderDataSlot(*data, index).store_aligned_pointer(value);
+  bool ok =
+      i::EmbedderDataSlot(*data, index).store_aligned_pointer(isolate, value);
   Utils::ApiCheck(ok, location, "Pointer is not aligned");
   DCHECK_EQ(value, GetAlignedPointerFromEmbedderData(index));
 }
@@ -1368,7 +1276,7 @@ void Context::SetAlignedPointerInEmbedderData(int index, void* value) {
 
 static void InitializeTemplate(i::Handle<i::TemplateInfo> that, int type) {
   that->set_number_of_properties(0);
-  that->set_tag(i::Smi::FromInt(type));
+  that->set_tag(type);
 }
 
 void Template::Set(v8::Local<Name> name, v8::Local<Data> value,
@@ -1380,7 +1288,7 @@ void Template::Set(v8::Local<Name> name, v8::Local<Data> value,
   auto value_obj = Utils::OpenHandle(*value);
   CHECK(!value_obj->IsJSReceiver() || value_obj->IsTemplateInfo());
   if (value_obj->IsObjectTemplateInfo()) {
-    templ->set_serial_number(i::Smi::zero());
+    templ->set_serial_number(0);
     if (templ->IsFunctionTemplateInfo()) {
       i::Handle<i::FunctionTemplateInfo>::cast(templ)->set_do_not_cache(true);
     }
@@ -1430,7 +1338,7 @@ Local<ObjectTemplate> FunctionTemplate::PrototypeTemplate() {
   auto self = Utils::OpenHandle(this);
   i::Isolate* i_isolate = self->GetIsolate();
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
-  i::Handle<i::Object> result(self->GetPrototypeTemplate(), i_isolate);
+  i::Handle<i::HeapObject> result(self->GetPrototypeTemplate(), i_isolate);
   if (result->IsUndefined(i_isolate)) {
     // Do not cache prototype objects.
     result = Utils::OpenHandle(
@@ -1445,7 +1353,8 @@ void FunctionTemplate::SetPrototypeProviderTemplate(
   auto self = Utils::OpenHandle(this);
   i::Isolate* i_isolate = self->GetIsolate();
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
-  i::Handle<i::Object> result = Utils::OpenHandle(*prototype_provider);
+  i::Handle<i::FunctionTemplateInfo> result =
+      Utils::OpenHandle(*prototype_provider);
   CHECK(self->GetPrototypeTemplate().IsUndefined(i_isolate));
   CHECK(self->GetParentTemplate().IsUndefined(i_isolate));
   i::FunctionTemplateInfo::SetPrototypeProviderTemplate(i_isolate, self,
@@ -1488,7 +1397,7 @@ static Local<FunctionTemplate> FunctionTemplateNew(
     if (!do_not_cache) {
       next_serial_number = isolate->heap()->GetNextTemplateSerialNumber();
     }
-    obj->set_serial_number(i::Smi::FromInt(next_serial_number));
+    obj->set_serial_number(next_serial_number);
   }
   if (callback != nullptr) {
     Utils::ToLocal(obj)->SetCallHandler(callback, data, side_effect_type,
@@ -1523,21 +1432,6 @@ Local<FunctionTemplate> FunctionTemplate::New(
   return templ;
 }
 
-MaybeLocal<FunctionTemplate> FunctionTemplate::FromSnapshot(Isolate* isolate,
-                                                            size_t index) {
-  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  i::FixedArray serialized_objects = i_isolate->heap()->serialized_objects();
-  int int_index = static_cast<int>(index);
-  if (int_index < serialized_objects.length()) {
-    i::Object info = serialized_objects.get(int_index);
-    if (info.IsFunctionTemplateInfo()) {
-      return Utils::ToLocal(i::Handle<i::FunctionTemplateInfo>(
-          i::FunctionTemplateInfo::cast(info), i_isolate));
-    }
-  }
-  return Local<FunctionTemplate>();
-}
-
 Local<FunctionTemplate> FunctionTemplate::NewWithCache(
     Isolate* isolate, FunctionCallback callback, Local<Private> cache_property,
     Local<Value> data, Local<Signature> signature, int length,
@@ -1582,8 +1476,9 @@ void FunctionTemplate::SetCallHandler(FunctionCallback callback,
     data = v8::Undefined(reinterpret_cast<v8::Isolate*>(isolate));
   }
   obj->set_data(*Utils::OpenHandle(*data));
-  if (c_function != nullptr) {
-    DCHECK_NOT_NULL(c_function->GetAddress());
+  // Blink passes CFunction's constructed with the default constructor
+  // for non-fast calls, so we should check the address too.
+  if (c_function != nullptr && c_function->GetAddress()) {
     i::FunctionTemplateInfo::SetCFunction(
         isolate, info,
         i::handle(*FromCData(isolate, c_function->GetAddress()), isolate));
@@ -1713,15 +1608,19 @@ static Local<ObjectTemplate> ObjectTemplateNew(
       i::OBJECT_TEMPLATE_INFO_TYPE, i::AllocationType::kOld);
   i::Handle<i::ObjectTemplateInfo> obj =
       i::Handle<i::ObjectTemplateInfo>::cast(struct_obj);
-  InitializeTemplate(obj, Consts::OBJECT_TEMPLATE);
-  int next_serial_number = 0;
-  if (!do_not_cache) {
-    next_serial_number = isolate->heap()->GetNextTemplateSerialNumber();
+  {
+    // Disallow GC until all fields of obj have acceptable types.
+    i::DisallowHeapAllocation no_gc;
+    InitializeTemplate(obj, Consts::OBJECT_TEMPLATE);
+    int next_serial_number = 0;
+    if (!do_not_cache) {
+      next_serial_number = isolate->heap()->GetNextTemplateSerialNumber();
+    }
+    obj->set_serial_number(next_serial_number);
+    obj->set_data(0);
   }
-  obj->set_serial_number(i::Smi::FromInt(next_serial_number));
   if (!constructor.IsEmpty())
     obj->set_constructor(*Utils::OpenHandle(*constructor));
-  obj->set_data(i::Smi::zero());
   return Utils::ToLocal(obj);
 }
 
@@ -1730,21 +1629,6 @@ Local<ObjectTemplate> ObjectTemplate::New(
   return ObjectTemplateNew(isolate, constructor, false);
 }
 
-MaybeLocal<ObjectTemplate> ObjectTemplate::FromSnapshot(Isolate* isolate,
-                                                        size_t index) {
-  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  i::FixedArray serialized_objects = i_isolate->heap()->serialized_objects();
-  int int_index = static_cast<int>(index);
-  if (int_index < serialized_objects.length()) {
-    i::Object info = serialized_objects.get(int_index);
-    if (info.IsObjectTemplateInfo()) {
-      return Utils::ToLocal(i::Handle<i::ObjectTemplateInfo>(
-          i::ObjectTemplateInfo::cast(info), i_isolate));
-    }
-  }
-  return Local<ObjectTemplate>();
-}
-
 // Ensure that the object template has a constructor.  If no
 // constructor is available we create one.
 static i::Handle<i::FunctionTemplateInfo> EnsureConstructor(
@@ -3809,6 +3693,12 @@ void v8::debug::AccessorPair::CheckCast(Value* that) {
                   "Value is not a debug::AccessorPair");
 }
 
+void v8::debug::WasmValue::CheckCast(Value* that) {
+  i::Handle<i::Object> obj = Utils::OpenHandle(that);
+  Utils::ApiCheck(obj->IsWasmValue(), "v8::WasmValue::Cast",
+                  "Value is not a debug::WasmValue");
+}
+
 v8::BackingStore::~BackingStore() {
   auto i_this = reinterpret_cast<const i::BackingStore*>(this);
   i_this->~BackingStore();  // manually call internal destructor
@@ -5527,7 +5417,9 @@ String::ExternalStringResource* String::GetExternalStringResourceSlow() const {
   }
 
   if (i::StringShape(str).IsExternalTwoByte()) {
-    void* value = I::ReadRawField<void*>(str.ptr(), I::kStringResourceOffset);
+    internal::Isolate* isolate = I::GetIsolateForHeapSandbox(str.ptr());
+    internal::Address value = I::ReadExternalPointerField(
+        isolate, str.ptr(), I::kStringResourceOffset);
     return reinterpret_cast<String::ExternalStringResource*>(value);
   }
   return nullptr;
@@ -5549,8 +5441,10 @@ String::ExternalStringResourceBase* String::GetExternalStringResourceBaseSlow(
   *encoding_out = static_cast<Encoding>(type & I::kStringEncodingMask);
   if (i::StringShape(str).IsExternalOneByte() ||
       i::StringShape(str).IsExternalTwoByte()) {
-    void* value = I::ReadRawField<void*>(string, I::kStringResourceOffset);
-    resource = static_cast<ExternalStringResourceBase*>(value);
+    internal::Isolate* isolate = I::GetIsolateForHeapSandbox(string);
+    internal::Address value =
+        I::ReadExternalPointerField(isolate, string, I::kStringResourceOffset);
+    resource = reinterpret_cast<ExternalStringResourceBase*>(value);
   }
   return resource;
 }
@@ -5668,7 +5562,7 @@ void* v8::Object::SlowGetAlignedPointerFromInternalField(int index) {
   if (!InternalFieldOK(obj, index, location)) return nullptr;
   void* result;
   Utils::ApiCheck(i::EmbedderDataSlot(i::JSObject::cast(*obj), index)
-                      .ToAlignedPointer(&result),
+                      .ToAlignedPointer(obj->GetIsolate(), &result),
                   location, "Unaligned pointer");
   return result;
 }
@@ -5678,7 +5572,7 @@ void v8::Object::SetAlignedPointerInInternalField(int index, void* value) {
   const char* location = "v8::Object::SetAlignedPointerInInternalField()";
   if (!InternalFieldOK(obj, index, location)) return;
   Utils::ApiCheck(i::EmbedderDataSlot(i::JSObject::cast(*obj), index)
-                      .store_aligned_pointer(value),
+                      .store_aligned_pointer(obj->GetIsolate(), value),
                   location, "Unaligned pointer");
   DCHECK_EQ(value, GetAlignedPointerFromInternalField(index));
 }
@@ -5697,9 +5591,9 @@ void v8::Object::SetAlignedPointerInInternalFields(int argc, int indices[],
       return;
     }
     void* value = values[i];
-    Utils::ApiCheck(
-        i::EmbedderDataSlot(js_obj, index).store_aligned_pointer(value),
-        location, "Unaligned pointer");
+    Utils::ApiCheck(i::EmbedderDataSlot(js_obj, index)
+                        .store_aligned_pointer(obj->GetIsolate(), value),
+                    location, "Unaligned pointer");
     DCHECK_EQ(value, GetAlignedPointerFromInternalField(index));
   }
 }
@@ -5721,7 +5615,34 @@ void v8::V8::InitializePlatform(Platform* platform) {
 
 void v8::V8::ShutdownPlatform() { i::V8::ShutdownPlatform(); }
 
-bool v8::V8::Initialize() {
+bool v8::V8::Initialize(const int build_config) {
+  const bool kEmbedderPointerCompression =
+      (build_config & kPointerCompression) != 0;
+  if (kEmbedderPointerCompression != COMPRESS_POINTERS_BOOL) {
+    FATAL(
+        "Embedder-vs-V8 build configuration mismatch. On embedder side "
+        "pointer compression is %s while on V8 side it's %s.",
+        kEmbedderPointerCompression ? "ENABLED" : "DISABLED",
+        COMPRESS_POINTERS_BOOL ? "ENABLED" : "DISABLED");
+  }
+
+  const int kEmbedderSmiValueSize = (build_config & k31BitSmis) ? 31 : 32;
+  if (kEmbedderSmiValueSize != internal::kSmiValueSize) {
+    FATAL(
+        "Embedder-vs-V8 build configuration mismatch. On embedder side "
+        "Smi value size is %d while on V8 side it's %d.",
+        kEmbedderSmiValueSize, internal::kSmiValueSize);
+  }
+
+  const bool kEmbedderHeapSandbox = (build_config & kHeapSandbox) != 0;
+  if (kEmbedderHeapSandbox != V8_HEAP_SANDBOX_BOOL) {
+    FATAL(
+        "Embedder-vs-V8 build configuration mismatch. On embedder side "
+        "heap sandbox is %s while on V8 side it's %s.",
+        kEmbedderHeapSandbox ? "ENABLED" : "DISABLED",
+        V8_HEAP_SANDBOX_BOOL ? "ENABLED" : "DISABLED");
+  }
+
   i::V8::Initialize();
   return true;
 }
@@ -5839,17 +5760,7 @@ void v8::V8::InitializeExternalStartupDataFromFile(const char* snapshot_blob) {
 const char* v8::V8::GetVersion() { return i::Version::GetVersion(); }
 
 void V8::GetSharedMemoryStatistics(SharedMemoryStatistics* statistics) {
-#ifdef V8_SHARED_RO_HEAP
-  i::ReadOnlySpace* ro_space = i::ReadOnlyHeap::Instance()->read_only_space();
-  statistics->read_only_space_size_ = ro_space->CommittedMemory();
-  statistics->read_only_space_used_size_ = ro_space->SizeOfObjects();
-  statistics->read_only_space_physical_size_ =
-      ro_space->CommittedPhysicalMemory();
-#else
-  statistics->read_only_space_size_ = 0;
-  statistics->read_only_space_used_size_ = 0;
-  statistics->read_only_space_physical_size_ = 0;
-#endif  // V8_SHARED_RO_HEAP
+  i::ReadOnlyHeap::PopulateReadOnlySpaceStatistics(statistics);
 }
 
 template <typename ObjectType>
@@ -5898,9 +5809,9 @@ static i::Handle<ObjectType> CreateEnvironment(
     v8::Local<ObjectTemplate> proxy_template;
     i::Handle<i::FunctionTemplateInfo> proxy_constructor;
     i::Handle<i::FunctionTemplateInfo> global_constructor;
-    i::Handle<i::Object> named_interceptor(
+    i::Handle<i::HeapObject> named_interceptor(
         isolate->factory()->undefined_value());
-    i::Handle<i::Object> indexed_interceptor(
+    i::Handle<i::HeapObject> indexed_interceptor(
         isolate->factory()->undefined_value());
 
     if (!maybe_global_template.IsEmpty()) {
@@ -7262,8 +7173,10 @@ MaybeLocal<Proxy> Proxy::New(Local<Context> context, Local<Object> local_target,
 }
 
 CompiledWasmModule::CompiledWasmModule(
-    std::shared_ptr<internal::wasm::NativeModule> native_module)
-    : native_module_(std::move(native_module)) {
+    std::shared_ptr<internal::wasm::NativeModule> native_module,
+    const char* source_url, size_t url_length)
+    : native_module_(std::move(native_module)),
+      source_url_(source_url, url_length) {
   CHECK_NOT_NULL(native_module_);
 }
 
@@ -7284,7 +7197,13 @@ MemorySpan<const uint8_t> CompiledWasmModule::GetWireBytesRef() {
 CompiledWasmModule WasmModuleObject::GetCompiledModule() {
   i::Handle<i::WasmModuleObject> obj =
       i::Handle<i::WasmModuleObject>::cast(Utils::OpenHandle(this));
-  return Utils::Convert(obj->shared_native_module());
+  auto source_url = i::String::cast(obj->script().source_url());
+  int length;
+  std::unique_ptr<char[]> cstring = source_url.ToCString(
+      i::DISALLOW_NULLS, i::FAST_STRING_TRAVERSAL, &length);
+  i::Handle<i::String> url(source_url, obj->GetIsolate());
+  return CompiledWasmModule(std::move(obj->shared_native_module()),
+                            cstring.get(), length);
 }
 
 MaybeLocal<WasmModuleObject> WasmModuleObject::FromCompiledModule(
@@ -7292,7 +7211,8 @@ MaybeLocal<WasmModuleObject> WasmModuleObject::FromCompiledModule(
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   i::Handle<i::WasmModuleObject> module_object =
       i_isolate->wasm_engine()->ImportNativeModule(
-          i_isolate, Utils::Open(compiled_module));
+          i_isolate, compiled_module.native_module_,
+          i::VectorOf(compiled_module.source_url()));
   return Local<WasmModuleObject>::Cast(
       Utils::ToLocal(i::Handle<i::JSObject>::cast(module_object)));
 }
@@ -8074,12 +7994,6 @@ void Isolate::ReportExternalAllocationLimitReached() {
   heap->ReportExternalMemoryPressure();
 }
 
-void Isolate::CheckMemoryPressure() {
-  i::Heap* heap = reinterpret_cast<i::Isolate*>(this)->heap();
-  if (heap->gc_state() != i::Heap::NOT_IN_GC) return;
-  heap->CheckMemoryPressure();
-}
-
 HeapProfiler* Isolate::GetHeapProfiler() {
   i::HeapProfiler* heap_profiler =
       reinterpret_cast<i::Isolate*>(this)->heap_profiler();
@@ -8333,6 +8247,10 @@ void Isolate::Initialize(Isolate* isolate,
   }
   i_isolate->set_only_terminate_in_safe_scope(
       params.only_terminate_in_safe_scope);
+  i_isolate->set_embedder_wrapper_type_index(
+      params.embedder_wrapper_type_index);
+  i_isolate->set_embedder_wrapper_object_index(
+      params.embedder_wrapper_object_index);
 
   if (!i::V8::GetCurrentPlatform()
            ->GetForegroundTaskRunner(isolate)
@@ -8384,29 +8302,6 @@ void Isolate::SetAbortOnUncaughtExceptionCallback(
   isolate->SetAbortOnUncaughtExceptionCallback(callback);
 }
 
-void Isolate::SetHostCleanupFinalizationGroupCallback(
-    HostCleanupFinalizationGroupCallback callback) {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
-  isolate->SetHostCleanupFinalizationGroupCallback(callback);
-}
-
-Maybe<bool> FinalizationGroup::Cleanup(
-    Local<FinalizationGroup> finalization_group) {
-  i::Handle<i::JSFinalizationRegistry> fr =
-      Utils::OpenHandle(*finalization_group);
-  i::Isolate* isolate = fr->native_context().GetIsolate();
-  i::Handle<i::Context> i_context(fr->native_context(), isolate);
-  Local<Context> context = Utils::ToLocal(i_context);
-  ENTER_V8(isolate, context, FinalizationGroup, Cleanup, Nothing<bool>(),
-           i::HandleScope);
-  i::Handle<i::Object> callback(fr->cleanup(), isolate);
-  fr->set_scheduled_for_cleanup(false);
-  has_pending_exception =
-      i::JSFinalizationRegistry::Cleanup(isolate, fr, callback).IsNothing();
-  RETURN_ON_FAILED_EXECUTION_PRIMITIVE(bool);
-  return Just(true);
-}
-
 void Isolate::SetHostImportModuleDynamicallyCallback(
     HostImportModuleDynamicallyCallback callback) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
@@ -8741,11 +8636,7 @@ void Isolate::EnqueueMicrotask(Local<Function> v8_function) {
 
 void Isolate::EnqueueMicrotask(MicrotaskCallback callback, void* data) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
-  i::HandleScope scope(isolate);
-  i::Handle<i::CallbackTask> microtask = isolate->factory()->NewCallbackTask(
-      isolate->factory()->NewForeign(reinterpret_cast<i::Address>(callback)),
-      isolate->factory()->NewForeign(reinterpret_cast<i::Address>(data)));
-  isolate->default_microtask_queue()->EnqueueMicrotask(*microtask);
+  isolate->default_microtask_queue()->EnqueueMicrotask(this, callback, data);
 }
 
 void Isolate::SetMicrotasksPolicy(MicrotasksPolicy policy) {
@@ -9022,6 +8913,9 @@ CALLBACK_SETTER(WasmThreadsEnabledCallback, WasmThreadsEnabledCallback,
 CALLBACK_SETTER(WasmLoadSourceMapCallback, WasmLoadSourceMapCallback,
                 wasm_load_source_map_callback)
 
+CALLBACK_SETTER(WasmSimdEnabledCallback, WasmSimdEnabledCallback,
+                wasm_simd_enabled_callback)
+
 void Isolate::AddNearHeapLimitCallback(v8::NearHeapLimitCallback callback,
                                        void* data) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
@@ -9149,6 +9043,7 @@ void v8::Isolate::LocaleConfigurationChangeNotification() {
 
 #ifdef V8_INTL_SUPPORT
   i_isolate->ResetDefaultLocale();
+  i_isolate->ClearCachedIcuObjects();
 #endif  // V8_INTL_SUPPORT
 }
 
@@ -9267,6 +9162,9 @@ DEFINE_ERROR(RangeError, range_error)
 DEFINE_ERROR(ReferenceError, reference_error)
 DEFINE_ERROR(SyntaxError, syntax_error)
 DEFINE_ERROR(TypeError, type_error)
+DEFINE_ERROR(WasmCompileError, wasm_compile_error)
+DEFINE_ERROR(WasmLinkError, wasm_link_error)
+DEFINE_ERROR(WasmRuntimeError, wasm_runtime_error)
 DEFINE_ERROR(Error, error)
 
 #undef DEFINE_ERROR
@@ -9778,6 +9676,37 @@ debug::WasmScript* debug::WasmScript::Cast(debug::Script* script) {
   return static_cast<WasmScript*>(script);
 }
 
+debug::WasmScript::DebugSymbolsType debug::WasmScript::GetDebugSymbolType()
+    const {
+  i::Handle<i::Script> script = Utils::OpenHandle(this);
+  DCHECK_EQ(i::Script::TYPE_WASM, script->type());
+  switch (script->wasm_native_module()->module()->debug_symbols.type) {
+    case i::wasm::WasmDebugSymbols::Type::None:
+      return debug::WasmScript::DebugSymbolsType::None;
+    case i::wasm::WasmDebugSymbols::Type::EmbeddedDWARF:
+      return debug::WasmScript::DebugSymbolsType::EmbeddedDWARF;
+    case i::wasm::WasmDebugSymbols::Type::ExternalDWARF:
+      return debug::WasmScript::DebugSymbolsType::ExternalDWARF;
+    case i::wasm::WasmDebugSymbols::Type::SourceMap:
+      return debug::WasmScript::DebugSymbolsType::SourceMap;
+  }
+}
+
+MemorySpan<const char> debug::WasmScript::ExternalSymbolsURL() const {
+  i::Handle<i::Script> script = Utils::OpenHandle(this);
+  DCHECK_EQ(i::Script::TYPE_WASM, script->type());
+
+  const i::wasm::WasmDebugSymbols& symbols =
+      script->wasm_native_module()->module()->debug_symbols;
+  if (symbols.external_url.is_empty()) return {};
+
+  internal::wasm::ModuleWireBytes wire_bytes(
+      script->wasm_native_module()->wire_bytes());
+  i::wasm::WasmName external_url =
+      wire_bytes.GetNameOrNull(symbols.external_url);
+  return {external_url.data(), external_url.size()};
+}
+
 int debug::WasmScript::NumFunctions() const {
   i::DisallowHeapAllocation no_gc;
   i::Handle<i::Script> script = Utils::OpenHandle(this);
@@ -10376,6 +10305,51 @@ bool debug::AccessorPair::IsAccessorPair(Local<Value> that) {
   return obj->IsAccessorPair();
 }
 
+int debug::WasmValue::value_type() {
+  i::Handle<i::WasmValue> obj = Utils::OpenHandle(this);
+  return obj->value_type();
+}
+
+v8::Local<v8::Array> debug::WasmValue::bytes() {
+  i::Handle<i::WasmValue> obj = Utils::OpenHandle(this);
+  // Should only be called on i32, i64, f32, f64, s128.
+  DCHECK_LE(1, obj->value_type());
+  DCHECK_GE(5, obj->value_type());
+
+  i::Isolate* isolate = obj->GetIsolate();
+  i::Handle<i::Object> bytes_or_ref(obj->bytes_or_ref(), isolate);
+  i::Handle<i::ByteArray> bytes(i::Handle<i::ByteArray>::cast(bytes_or_ref));
+
+  int length = bytes->length();
+
+  i::Handle<i::FixedArray> fa = isolate->factory()->NewFixedArray(length);
+  i::Handle<i::JSArray> arr = obj->GetIsolate()->factory()->NewJSArray(
+      i::PACKED_SMI_ELEMENTS, length, length);
+  i::JSArray::SetContent(arr, fa);
+
+  for (int i = 0; i < length; i++) {
+    fa->set(i, i::Smi::FromInt(bytes->get(i)));
+  }
+
+  return Utils::ToLocal(arr);
+}
+
+v8::Local<v8::Value> debug::WasmValue::ref() {
+  i::Handle<i::WasmValue> obj = Utils::OpenHandle(this);
+  // Should only be called on anyref.
+  DCHECK_EQ(6, obj->value_type());
+
+  i::Isolate* isolate = obj->GetIsolate();
+  i::Handle<i::Object> bytes_or_ref(obj->bytes_or_ref(), isolate);
+
+  return Utils::ToLocal(bytes_or_ref);
+}
+
+bool debug::WasmValue::IsWasmValue(Local<Value> that) {
+  i::Handle<i::Object> obj = Utils::OpenHandle(*that);
+  return obj->IsWasmValue();
+}
+
 MaybeLocal<Message> debug::GetMessageFromPromise(Local<Promise> p) {
   i::Handle<i::JSPromise> promise = Utils::OpenHandle(*p);
   i::Isolate* isolate = promise->GetIsolate();
@@ -11185,8 +11159,11 @@ void InvokeFinalizationRegistryCleanupFromTask(
   Local<v8::Context> api_context = Utils::ToLocal(context);
   CallDepthScope<true> call_depth_scope(isolate, api_context);
   VMState<OTHER> state(isolate);
-  if (JSFinalizationRegistry::Cleanup(isolate, finalization_registry, callback)
-          .IsNothing()) {
+  Handle<Object> argv[] = {callback};
+  if (Execution::CallBuiltin(isolate,
+                             isolate->finalization_registry_cleanup_some(),
+                             finalization_registry, arraysize(argv), argv)
+          .is_null()) {
     call_depth_scope.Escape();
   }
 }
diff --git a/deps/v8/src/api/api.h b/deps/v8/src/api/api.h
index 4c383d3e43c..ad879657c99 100644
--- a/deps/v8/src/api/api.h
+++ b/deps/v8/src/api/api.h
@@ -33,6 +33,7 @@ namespace debug {
 class AccessorPair;
 class GeneratorObject;
 class Script;
+class WasmValue;
 class WeakMap;
 }  // namespace debug
 
@@ -93,7 +94,6 @@ class RegisteredExtension {
   V(Data, Object)                              \
   V(RegExp, JSRegExp)                          \
   V(Object, JSReceiver)                        \
-  V(FinalizationGroup, JSFinalizationRegistry) \
   V(Array, JSArray)                            \
   V(Map, JSMap)                                \
   V(Set, JSSet)                                \
@@ -129,6 +129,7 @@ class RegisteredExtension {
   V(debug::Script, Script)                     \
   V(debug::WeakMap, JSWeakMap)                 \
   V(debug::AccessorPair, AccessorPair)         \
+  V(debug::WasmValue, WasmValue)               \
   V(Promise, JSPromise)                        \
   V(Primitive, Object)                         \
   V(PrimitiveArray, FixedArray)                \
@@ -205,8 +206,6 @@ class Utils {
       v8::internal::Handle<v8::internal::JSTypedArray> obj);
   static inline Local<BigUint64Array> ToLocalBigUint64Array(
       v8::internal::Handle<v8::internal::JSTypedArray> obj);
-  static inline Local<FinalizationGroup> ToLocal(
-      v8::internal::Handle<v8::internal::JSFinalizationRegistry> obj);
 
   static inline Local<SharedArrayBuffer> ToLocalShared(
       v8::internal::Handle<v8::internal::JSArrayBuffer> obj);
@@ -275,16 +274,6 @@ class Utils {
     return OpenHandle(*handle);
   }
 
-  static inline CompiledWasmModule Convert(
-      std::shared_ptr<i::wasm::NativeModule> native_module) {
-    return CompiledWasmModule{std::move(native_module)};
-  }
-
-  static inline const std::shared_ptr<i::wasm::NativeModule>& Open(
-      const CompiledWasmModule& compiled_module) {
-    return compiled_module.native_module_;
-  }
-
  private:
   static void ReportApiFailure(const char* location, const char* message);
 };
diff --git a/deps/v8/src/asmjs/asm-js.cc b/deps/v8/src/asmjs/asm-js.cc
index 5a6846c33f4..17bf39c8538 100644
--- a/deps/v8/src/asmjs/asm-js.cc
+++ b/deps/v8/src/asmjs/asm-js.cc
@@ -187,7 +187,8 @@ class AsmJsCompilationJob final : public UnoptimizedCompilationJob {
   explicit AsmJsCompilationJob(ParseInfo* parse_info, FunctionLiteral* literal,
                                AccountingAllocator* allocator)
       : UnoptimizedCompilationJob(parse_info->stack_limit(), parse_info,
-                                  &compilation_info_),
+                                  &compilation_info_,
+                                  CanOffThreadFinalize::kNo),
         allocator_(allocator),
         zone_(allocator, ZONE_NAME),
         compilation_info_(&zone_, parse_info, literal),
@@ -223,7 +224,7 @@ class AsmJsCompilationJob final : public UnoptimizedCompilationJob {
 
 UnoptimizedCompilationJob::Status AsmJsCompilationJob::ExecuteJobImpl() {
   // Step 1: Translate asm.js module to WebAssembly module.
-  Zone* compile_zone = compilation_info()->zone();
+  Zone* compile_zone = &zone_;
   Zone translate_zone(allocator_, ZONE_NAME);
 
   Utf16CharacterStream* stream = parse_info()->character_stream();
@@ -332,6 +333,13 @@ MaybeHandle<Object> AsmJs::InstantiateAsmWasm(Isolate* isolate,
   // but should instead point to the instantiation site (more intuitive).
   int position = shared->StartPosition();
 
+  // Check that the module is not instantiated as a generator or async function.
+  if (IsResumableFunction(shared->scope_info().function_kind())) {
+    ReportInstantiationFailure(script, position,
+                               "Cannot be instantiated as resumable function");
+    return MaybeHandle<Object>();
+  }
+
   // Check that all used stdlib members are valid.
   bool stdlib_use_of_typed_array_present = false;
   wasm::AsmJsParser::StdlibSet stdlib_uses =
diff --git a/deps/v8/src/asmjs/asm-scanner.cc b/deps/v8/src/asmjs/asm-scanner.cc
index eaff042d31c..73140867084 100644
--- a/deps/v8/src/asmjs/asm-scanner.cc
+++ b/deps/v8/src/asmjs/asm-scanner.cc
@@ -329,7 +329,7 @@ void AsmJsScanner::ConsumeNumber(uc32 ch) {
     token_ = kParseError;
     return;
   }
-  if (has_dot) {
+  if (has_dot || trunc(double_value_) != double_value_) {
     token_ = kDouble;
   } else {
     // Exceeding safe integer range is an error.
diff --git a/deps/v8/src/ast/ast-value-factory.cc b/deps/v8/src/ast/ast-value-factory.cc
index 7e1be44da16..23f28b834ac 100644
--- a/deps/v8/src/ast/ast-value-factory.cc
+++ b/deps/v8/src/ast/ast-value-factory.cc
@@ -27,6 +27,7 @@
 
 #include "src/ast/ast-value-factory.h"
 
+#include "src/base/logging.h"
 #include "src/common/globals.h"
 #include "src/execution/off-thread-isolate.h"
 #include "src/heap/factory-inl.h"
@@ -332,20 +333,22 @@ const AstRawString* AstValueFactory::CloneFromOtherFactory(
 }
 
 AstConsString* AstValueFactory::NewConsString() {
-  return new (zone_) AstConsString;
+  return new (zone()) AstConsString;
 }
 
 AstConsString* AstValueFactory::NewConsString(const AstRawString* str) {
-  return NewConsString()->AddString(zone_, str);
+  return NewConsString()->AddString(zone(), str);
 }
 
 AstConsString* AstValueFactory::NewConsString(const AstRawString* str1,
                                               const AstRawString* str2) {
-  return NewConsString()->AddString(zone_, str1)->AddString(zone_, str2);
+  return NewConsString()->AddString(zone(), str1)->AddString(zone(), str2);
 }
 
 template <typename LocalIsolate>
 void AstValueFactory::Internalize(LocalIsolate* isolate) {
+  if (!zone_) return;
+
   // Strings need to be internalized before values, because values refer to
   // strings.
   for (AstRawString* current = strings_; current != nullptr;) {
@@ -355,6 +358,7 @@ void AstValueFactory::Internalize(LocalIsolate* isolate) {
   }
 
   ResetStrings();
+  zone_ = nullptr;
 }
 template EXPORT_TEMPLATE_DEFINE(
     V8_EXPORT_PRIVATE) void AstValueFactory::Internalize<Isolate>(Isolate*
@@ -373,9 +377,9 @@ AstRawString* AstValueFactory::GetString(uint32_t hash_field, bool is_one_byte,
   if (entry->value == nullptr) {
     // Copy literal contents for later comparison.
     int length = literal_bytes.length();
-    byte* new_literal_bytes = zone_->NewArray<byte>(length);
+    byte* new_literal_bytes = zone()->NewArray<byte>(length);
     memcpy(new_literal_bytes, literal_bytes.begin(), length);
-    AstRawString* new_string = new (zone_) AstRawString(
+    AstRawString* new_string = new (zone()) AstRawString(
         is_one_byte, Vector<const byte>(new_literal_bytes, length), hash_field);
     CHECK_NOT_NULL(new_string);
     AddString(new_string);
diff --git a/deps/v8/src/ast/ast-value-factory.h b/deps/v8/src/ast/ast-value-factory.h
index dce9de40697..134612f1fd0 100644
--- a/deps/v8/src/ast/ast-value-factory.h
+++ b/deps/v8/src/ast/ast-value-factory.h
@@ -31,6 +31,7 @@
 #include <forward_list>
 
 #include "src/base/hashmap.h"
+#include "src/base/logging.h"
 #include "src/common/globals.h"
 #include "src/heap/factory.h"
 #include "src/numbers/conversions.h"
@@ -66,6 +67,8 @@ class AstRawString final : public ZoneObject {
   int byte_length() const { return literal_bytes_.length(); }
   const unsigned char* raw_data() const { return literal_bytes_.begin(); }
 
+  bool IsPrivateName() const { return length() > 0 && FirstCharacter() == '#'; }
+
   // For storing AstRawStrings in a hash map.
   uint32_t hash_field() const { return hash_field_; }
   uint32_t Hash() const { return hash_field_ >> Name::kHashShift; }
@@ -288,6 +291,7 @@ class AstValueFactory {
         empty_cons_string_(nullptr),
         zone_(zone),
         hash_seed_(hash_seed) {
+    DCHECK_NOT_NULL(zone_);
     DCHECK_EQ(hash_seed, string_constants->hash_seed());
     std::fill(one_character_strings_,
               one_character_strings_ + arraysize(one_character_strings_),
@@ -295,7 +299,10 @@ class AstValueFactory {
     empty_cons_string_ = NewConsString();
   }
 
-  Zone* zone() const { return zone_; }
+  Zone* zone() const {
+    DCHECK_NOT_NULL(zone_);
+    return zone_;
+  }
 
   const AstRawString* GetOneByteString(Vector<const uint8_t> literal) {
     return GetOneByteStringInternal(literal);
@@ -317,6 +324,9 @@ class AstValueFactory {
   V8_EXPORT_PRIVATE AstConsString* NewConsString(const AstRawString* str1,
                                                  const AstRawString* str2);
 
+  // Internalize all the strings in the factory, and prevent any more from being
+  // allocated. Multiple calls to Internalize are allowed, for simplicity, where
+  // subsequent calls are a no-op.
   template <typename LocalIsolate>
   void Internalize(LocalIsolate* isolate);
 
diff --git a/deps/v8/src/ast/ast.cc b/deps/v8/src/ast/ast.cc
index 651508b677f..8cd1140154a 100644
--- a/deps/v8/src/ast/ast.cc
+++ b/deps/v8/src/ast/ast.cc
@@ -927,6 +927,7 @@ Call::CallType Call::GetCallType() const {
   }
   if (property != nullptr) {
     if (property->IsPrivateReference()) {
+      if (is_optional_chain) return PRIVATE_OPTIONAL_CHAIN_CALL;
       return PRIVATE_CALL;
     }
     bool is_super = property->IsSuperAccess();
diff --git a/deps/v8/src/ast/ast.h b/deps/v8/src/ast/ast.h
index 5bf2d7e1928..dab3981c638 100644
--- a/deps/v8/src/ast/ast.h
+++ b/deps/v8/src/ast/ast.h
@@ -14,8 +14,6 @@
 #include "src/codegen/bailout-reason.h"
 #include "src/codegen/label.h"
 #include "src/common/globals.h"
-#include "src/execution/isolate.h"
-#include "src/execution/off-thread-isolate.h"
 #include "src/heap/factory.h"
 #include "src/objects/elements-kind.h"
 #include "src/objects/function-syntax-kind.h"
@@ -117,6 +115,9 @@ namespace internal {
   EXPRESSION_NODE_LIST(V)
 
 // Forward declarations
+class Isolate;
+class OffThreadIsolate;
+
 class AstNode;
 class AstNodeFactory;
 class Declaration;
@@ -1445,9 +1446,7 @@ class VariableProxy final : public Expression {
         HoleCheckModeField::update(bit_field_, HoleCheckMode::kRequired);
   }
 
-  bool IsPrivateName() const {
-    return raw_name()->length() > 0 && raw_name()->FirstCharacter() == '#';
-  }
+  bool IsPrivateName() const { return raw_name()->IsPrivateName(); }
 
   // Bind this proxy to the variable var.
   void BindTo(Variable* var);
@@ -1631,6 +1630,7 @@ class Call final : public Expression {
     NAMED_SUPER_PROPERTY_CALL,
     KEYED_SUPER_PROPERTY_CALL,
     PRIVATE_CALL,
+    PRIVATE_OPTIONAL_CHAIN_CALL,
     SUPER_CALL,
     OTHER_CALL,
   };
@@ -2242,7 +2242,7 @@ class FunctionLiteral final : public Expression {
  private:
   friend class AstNodeFactory;
 
-  FunctionLiteral(Zone* zone, const AstRawString* name,
+  FunctionLiteral(Zone* zone, const AstConsString* name,
                   AstValueFactory* ast_value_factory, DeclarationScope* scope,
                   const ScopedPtrList<Statement>& body,
                   int expected_property_count, int parameter_count,
@@ -2258,7 +2258,7 @@ class FunctionLiteral final : public Expression {
         function_token_position_(kNoSourcePosition),
         suspend_count_(0),
         function_literal_id_(function_literal_id),
-        raw_name_(name ? ast_value_factory->NewConsString(name) : nullptr),
+        raw_name_(name),
         scope_(scope),
         body_(0, nullptr),
         raw_inferred_name_(ast_value_factory->empty_cons_string()),
@@ -3109,7 +3109,8 @@ class AstNodeFactory final {
       bool has_braces, int function_literal_id,
       ProducedPreparseData* produced_preparse_data = nullptr) {
     return new (zone_) FunctionLiteral(
-        zone_, name, ast_value_factory_, scope, body, expected_property_count,
+        zone_, name ? ast_value_factory_->NewConsString(name) : nullptr,
+        ast_value_factory_, scope, body, expected_property_count,
         parameter_count, function_length, function_syntax_kind,
         has_duplicate_parameters, eager_compile_hint, position, has_braces,
         function_literal_id, produced_preparse_data);
@@ -3122,8 +3123,8 @@ class AstNodeFactory final {
       DeclarationScope* scope, const ScopedPtrList<Statement>& body,
       int expected_property_count, int parameter_count) {
     return new (zone_) FunctionLiteral(
-        zone_, ast_value_factory_->empty_string(), ast_value_factory_, scope,
-        body, expected_property_count, parameter_count, parameter_count,
+        zone_, ast_value_factory_->empty_cons_string(), ast_value_factory_,
+        scope, body, expected_property_count, parameter_count, parameter_count,
         FunctionSyntaxKind::kAnonymousExpression,
         FunctionLiteral::kNoDuplicateParameters,
         FunctionLiteral::kShouldLazyCompile, 0, /* has_braces */ false,
diff --git a/deps/v8/src/ast/scopes.cc b/deps/v8/src/ast/scopes.cc
index 8c13556db91..3f0a1adbc3a 100644
--- a/deps/v8/src/ast/scopes.cc
+++ b/deps/v8/src/ast/scopes.cc
@@ -598,7 +598,7 @@ bool DeclarationScope::Analyze(ParseInfo* info) {
     DCHECK_EQ(scope->scope_type_, ScopeType::FUNCTION_SCOPE);
     allow_deref.emplace();
     info->consumed_preparse_data()->RestoreScopeAllocationData(
-        scope, info->ast_value_factory());
+        scope, info->ast_value_factory(), info->zone());
   }
 
   if (!scope->AllocateVariables(info)) return false;
@@ -1138,7 +1138,8 @@ Variable* Scope::NewTemporary(const AstRawString* name,
   return var;
 }
 
-Declaration* DeclarationScope::CheckConflictingVarDeclarations() {
+Declaration* DeclarationScope::CheckConflictingVarDeclarations(
+    bool* allowed_catch_binding_var_redeclaration) {
   if (has_checked_syntax_) return nullptr;
   for (Declaration* decl : decls_) {
     // Lexical vs lexical conflicts within the same scope have already been
@@ -1152,11 +1153,12 @@ Declaration* DeclarationScope::CheckConflictingVarDeclarations() {
       // Iterate through all scopes until the declaration scope.
       do {
         // There is a conflict if there exists a non-VAR binding.
+        Variable* other_var = current->LookupLocal(decl->var()->raw_name());
         if (current->is_catch_scope()) {
+          *allowed_catch_binding_var_redeclaration |= other_var != nullptr;
           current = current->outer_scope();
           continue;
         }
-        Variable* other_var = current->LookupLocal(decl->var()->raw_name());
         if (other_var != nullptr) {
           DCHECK(IsLexicalVariableMode(other_var->mode()));
           return decl;
@@ -2586,8 +2588,8 @@ Variable* ClassScope::DeclarePrivateName(const AstRawString* name,
                                          bool* was_added) {
   Variable* result = EnsureRareData()->private_name_map.Declare(
       zone(), this, name, mode, NORMAL_VARIABLE,
-      InitializationFlag::kNeedsInitialization,
-      MaybeAssignedFlag::kMaybeAssigned, is_static_flag, was_added);
+      InitializationFlag::kNeedsInitialization, MaybeAssignedFlag::kNotAssigned,
+      is_static_flag, was_added);
   if (*was_added) {
     locals_.Add(result);
     has_static_private_methods_ |=
@@ -2683,7 +2685,7 @@ Variable* ClassScope::LookupPrivateNameInScopeInfo(const AstRawString* name) {
 
   DCHECK(IsConstVariableMode(mode));
   DCHECK_EQ(init_flag, InitializationFlag::kNeedsInitialization);
-  DCHECK_EQ(maybe_assigned_flag, MaybeAssignedFlag::kMaybeAssigned);
+  DCHECK_EQ(maybe_assigned_flag, MaybeAssignedFlag::kNotAssigned);
 
   // Add the found private name to the map to speed up subsequent
   // lookups for the same name.
@@ -2725,7 +2727,7 @@ bool ClassScope::ResolvePrivateNames(ParseInfo* info) {
     if (var == nullptr) {
       // It's only possible to fail to resolve private names here if
       // this is at the top level or the private name is accessed through eval.
-      DCHECK(info->is_eval() || outer_scope_->is_script_scope());
+      DCHECK(info->flags().is_eval() || outer_scope_->is_script_scope());
       Scanner::Location loc = proxy->location();
       info->pending_error_handler()->ReportMessageAt(
           loc.beg_pos, loc.end_pos,
@@ -2812,7 +2814,7 @@ Variable* ClassScope::DeclareBrandVariable(AstValueFactory* ast_value_factory,
   Variable* brand = Declare(zone(), ast_value_factory->dot_brand_string(),
                             VariableMode::kConst, NORMAL_VARIABLE,
                             InitializationFlag::kNeedsInitialization,
-                            MaybeAssignedFlag::kMaybeAssigned, &was_added);
+                            MaybeAssignedFlag::kNotAssigned, &was_added);
   DCHECK(was_added);
   brand->set_is_static_flag(is_static_flag);
   brand->ForceContextAllocation();
diff --git a/deps/v8/src/ast/scopes.h b/deps/v8/src/ast/scopes.h
index 08bbc696d94..babb90bdd01 100644
--- a/deps/v8/src/ast/scopes.h
+++ b/deps/v8/src/ast/scopes.h
@@ -102,6 +102,10 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
     }
     inline explicit Snapshot(Scope* scope);
 
+    // Disallow copy and move.
+    Snapshot(const Snapshot&) = delete;
+    Snapshot(Snapshot&&) = delete;
+
     ~Snapshot() {
       // If we're still active, there was no arrow function. In that case outer
       // calls eval if it already called eval before this snapshot started, or
@@ -142,10 +146,6 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
     Scope* top_inner_scope_;
     UnresolvedList::Iterator top_unresolved_;
     base::ThreadedList<Variable>::Iterator top_local_;
-
-    // Disallow copy and move.
-    Snapshot(const Snapshot&) = delete;
-    Snapshot(Snapshot&&) = delete;
   };
 
   enum class DeserializationMode { kIncludingVariables, kScopesOnly };
@@ -909,7 +909,8 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
   // Check if the scope has conflicting var
   // declarations, i.e. a var declaration that has been hoisted from a nested
   // scope over a let binding of the same name.
-  Declaration* CheckConflictingVarDeclarations();
+  Declaration* CheckConflictingVarDeclarations(
+      bool* allowed_catch_binding_var_redeclaration);
 
   void set_has_checked_syntax(bool has_checked_syntax) {
     has_checked_syntax_ = has_checked_syntax;
diff --git a/deps/v8/src/ast/variables.h b/deps/v8/src/ast/variables.h
index a3a5199620e..7c6ee4324e8 100644
--- a/deps/v8/src/ast/variables.h
+++ b/deps/v8/src/ast/variables.h
@@ -90,7 +90,10 @@ class Variable final : public ZoneObject {
   }
   void SetMaybeAssigned() {
     if (mode() == VariableMode::kConst) return;
-
+    // Private names are only initialized once by us.
+    if (name_->IsPrivateName()) {
+      return;
+    }
     // If this variable is dynamically shadowing another variable, then that
     // variable could also be assigned (in the non-shadowing case).
     if (has_local_if_not_shadowed()) {
diff --git a/deps/v8/src/base/address-region.h b/deps/v8/src/base/address-region.h
index 9ef6160d2a7..44151606c0c 100644
--- a/deps/v8/src/base/address-region.h
+++ b/deps/v8/src/base/address-region.h
@@ -15,6 +15,14 @@ namespace base {
 // Helper class representing an address region of certain size.
 class AddressRegion {
  public:
+  // Function object that compares the start address of two regions. Usable as
+  // compare function on std data structures and algorithms.
+  struct StartAddressLess {
+    bool operator()(base::AddressRegion a, base::AddressRegion b) const {
+      return a.begin() < b.begin();
+    }
+  };
+
   using Address = uintptr_t;
 
   AddressRegion() = default;
diff --git a/deps/v8/src/base/bits.h b/deps/v8/src/base/bits.h
index b74b98e1069..eadf2ee012f 100644
--- a/deps/v8/src/base/bits.h
+++ b/deps/v8/src/base/bits.h
@@ -32,22 +32,27 @@ constexpr inline
   return sizeof(T) == 8 ? __builtin_popcountll(static_cast<uint64_t>(value))
                         : __builtin_popcount(static_cast<uint32_t>(value));
 #else
+  // Fall back to divide-and-conquer popcount (see "Hacker's Delight" by Henry
+  // S. Warren, Jr.), chapter 5-1.
   constexpr uint64_t mask[] = {0x5555555555555555, 0x3333333333333333,
                                0x0f0f0f0f0f0f0f0f};
-  // Start with 1 bit wide buckets of [0,1].
+  // Start with 64 buckets of 1 bits, holding values from [0,1].
   value = ((value >> 1) & mask[0]) + (value & mask[0]);
-  // Having 2 bit wide buckets of [0,2] now.
+  // Having 32 buckets of 2 bits, holding values from [0,2] now.
   value = ((value >> 2) & mask[1]) + (value & mask[1]);
-  // Having 4 bit wide buckets of [0,4] now.
-  value = (value >> 4) + value;
-  // Having 4 bit wide buckets of [0,8] now.
-  if (sizeof(T) > 1)
-    value = ((value >> (sizeof(T) > 1 ? 8 : 0)) & mask[2]) + (value & mask[2]);
-  // Having 8 bit wide buckets of [0,16] now.
+  // Having 16 buckets of 4 bits, holding values from [0,4] now.
+  value = ((value >> 4) & mask[2]) + (value & mask[2]);
+  // Having 8 buckets of 8 bits, holding values from [0,8] now.
+  // From this point on, the buckets are bigger than the number of bits
+  // required to hold the values, and the buckets are bigger the maximum
+  // result, so there's no need to mask value anymore, since there's no
+  // more risk of overflow between buckets.
+  if (sizeof(T) > 1) value = (value >> (sizeof(T) > 1 ? 8 : 0)) + value;
+  // Having 4 buckets of 16 bits, holding values from [0,16] now.
   if (sizeof(T) > 2) value = (value >> (sizeof(T) > 2 ? 16 : 0)) + value;
-  // Having 8 bit wide buckets of [0,32] now.
+  // Having 2 buckets of 32 bits, holding values from [0,32] now.
   if (sizeof(T) > 4) value = (value >> (sizeof(T) > 4 ? 32 : 0)) + value;
-  // Having 8 bit wide buckets of [0,64] now.
+  // Having 1 buckets of 64 bits, holding values from [0,64] now.
   return static_cast<unsigned>(value & 0xff);
 #endif
 }
diff --git a/deps/v8/src/base/cpu.cc b/deps/v8/src/base/cpu.cc
index f1c48fa1356..bbdae525e30 100644
--- a/deps/v8/src/base/cpu.cc
+++ b/deps/v8/src/base/cpu.cc
@@ -605,7 +605,11 @@ CPU::CPU()
 #endif
 
 #elif V8_HOST_ARCH_ARM64
-// Implementer, variant and part are currently unused under ARM64.
+#ifdef V8_OS_WIN
+  // Windows makes high-resolution thread timing information available in
+  // user-space.
+  has_non_stop_time_stamp_counter_ = true;
+#endif  // V8_OS_WIN
 
 #elif V8_HOST_ARCH_PPC || V8_HOST_ARCH_PPC64
 
diff --git a/deps/v8/src/base/platform/mutex.h b/deps/v8/src/base/platform/mutex.h
index 5b3b31ec1e5..c3144f7ceb5 100644
--- a/deps/v8/src/base/platform/mutex.h
+++ b/deps/v8/src/base/platform/mutex.h
@@ -67,7 +67,8 @@ class V8_BASE_EXPORT Mutex final {
     return native_handle_;
   }
 
-  V8_INLINE void AssertHeld() { DCHECK_EQ(1, level_); }
+  V8_INLINE void AssertHeld() const { DCHECK_EQ(1, level_); }
+  V8_INLINE void AssertUnheld() const { DCHECK_EQ(0, level_); }
 
  private:
   NativeHandle native_handle_;
diff --git a/deps/v8/src/base/platform/platform-aix.cc b/deps/v8/src/base/platform/platform-aix.cc
index e3d7c426b4a..e1ccda2ab05 100644
--- a/deps/v8/src/base/platform/platform-aix.cc
+++ b/deps/v8/src/base/platform/platform-aix.cc
@@ -129,5 +129,34 @@ void OS::SignalCodeMovingGC() {}
 
 void OS::AdjustSchedulingParams() {}
 
+// static
+void* Stack::GetStackStart() {
+  // pthread_getthrds_np creates 3 values:
+  // __pi_stackaddr, __pi_stacksize, __pi_stackend
+
+  // higher address ----- __pi_stackend, stack base
+  //
+  //   |
+  //   |  __pi_stacksize, stack grows downwards
+  //   |
+  //   V
+  //
+  // lower address -----  __pi_stackaddr, current sp
+
+  pthread_t tid = pthread_self();
+  struct __pthrdsinfo buf;
+  // clear buf
+  memset(&buf, 0, sizeof(buf));
+  char regbuf[1];
+  int regbufsize = sizeof(regbuf);
+  const int rc = pthread_getthrds_np(&tid, PTHRDSINFO_QUERY_ALL, &buf,
+                                     sizeof(buf), regbuf, &regbufsize);
+  CHECK(!rc);
+  if (buf.__pi_stackend == NULL || buf.__pi_stackaddr == NULL) {
+    return nullptr;
+  }
+  return reinterpret_cast<void*>(buf.__pi_stackend);
+}
+
 }  // namespace base
 }  // namespace v8
diff --git a/deps/v8/src/base/platform/platform-posix.cc b/deps/v8/src/base/platform/platform-posix.cc
index 54f72e04e68..17fc5b50839 100644
--- a/deps/v8/src/base/platform/platform-posix.cc
+++ b/deps/v8/src/base/platform/platform-posix.cc
@@ -970,7 +970,8 @@ void Thread::SetThreadLocal(LocalStorageKey key, void* value) {
 // pthread_getattr_np used below is non portable (hence the _np suffix). We
 // keep this version in POSIX as most Linux-compatible derivatives will
 // support it. MacOS and FreeBSD are different here.
-#if !defined(V8_OS_FREEBSD) && !defined(V8_OS_MACOSX) && !defined(V8_OS_SOLARIS)
+#if !defined(V8_OS_FREEBSD) && !defined(V8_OS_MACOSX) && !defined(_AIX) && \
+    !defined(V8_OS_SOLARIS)
 
 // static
 void* Stack::GetStackStart() {
@@ -996,7 +997,8 @@ void* Stack::GetStackStart() {
   return nullptr;
 }
 
-#endif  // !defined(V8_OS_FREEBSD) && !defined(V8_OS_MACOSX) && !defined(V8_OS_SOLARIS)
+#endif  // !defined(V8_OS_FREEBSD) && !defined(V8_OS_MACOSX) &&
+        // !defined(_AIX) && !defined(V8_OS_SOLARIS)
 
 // static
 void* Stack::GetCurrentStackPosition() { return __builtin_frame_address(0); }
diff --git a/deps/v8/src/base/platform/time.cc b/deps/v8/src/base/platform/time.cc
index f07fd8e595f..a12a5b0d0a7 100644
--- a/deps/v8/src/base/platform/time.cc
+++ b/deps/v8/src/base/platform/time.cc
@@ -125,12 +125,6 @@ V8_INLINE bool IsHighResolutionTimer(clockid_t clk_id) {
 }
 
 #elif V8_OS_WIN
-V8_INLINE bool IsQPCReliable() {
-  v8::base::CPU cpu;
-  // On Athlon X2 CPUs (e.g. model 15) QueryPerformanceCounter is unreliable.
-  return strcmp(cpu.vendor(), "AuthenticAMD") == 0 && cpu.family() == 15;
-}
-
 // Returns the current value of the performance counter.
 V8_INLINE uint64_t QPCNowRaw() {
   LARGE_INTEGER perf_counter_now = {};
@@ -645,11 +639,6 @@ TimeDelta QPCValueToTimeDelta(LONGLONG qpc_value) {
 
 TimeTicks QPCNow() { return TimeTicks() + QPCValueToTimeDelta(QPCNowRaw()); }
 
-bool IsBuggyAthlon(const CPU& cpu) {
-  // On Athlon X2 CPUs (e.g. model 15) QueryPerformanceCounter is unreliable.
-  return strcmp(cpu.vendor(), "AuthenticAMD") == 0 && cpu.family() == 15;
-}
-
 void InitializeTimeTicksNowFunctionPointer() {
   LARGE_INTEGER ticks_per_sec = {};
   if (!QueryPerformanceFrequency(&ticks_per_sec)) ticks_per_sec.QuadPart = 0;
@@ -667,8 +656,7 @@ void InitializeTimeTicksNowFunctionPointer() {
   // ~72% of users fall within this category.
   TimeTicksNowFunction now_function;
   CPU cpu;
-  if (ticks_per_sec.QuadPart <= 0 || !cpu.has_non_stop_time_stamp_counter() ||
-      IsBuggyAthlon(cpu)) {
+  if (ticks_per_sec.QuadPart <= 0 || !cpu.has_non_stop_time_stamp_counter()) {
     now_function = &RolloverProtectedNow;
   } else {
     now_function = &QPCNow;
@@ -800,8 +788,7 @@ ThreadTicks ThreadTicks::GetForThread(const HANDLE& thread_handle) {
 
 // static
 bool ThreadTicks::IsSupportedWin() {
-  static bool is_supported = base::CPU().has_non_stop_time_stamp_counter() &&
-                             !IsQPCReliable();
+  static bool is_supported = base::CPU().has_non_stop_time_stamp_counter();
   return is_supported;
 }
 
diff --git a/deps/v8/src/builtins/aggregate-error.tq b/deps/v8/src/builtins/aggregate-error.tq
new file mode 100644
index 00000000000..3ae13d4e878
--- /dev/null
+++ b/deps/v8/src/builtins/aggregate-error.tq
@@ -0,0 +1,44 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/objects/js-objects.h'
+
+namespace error {
+
+transitioning javascript builtin AggregateErrorConstructor(
+    js-implicit context: NativeContext, target: JSFunction,
+    newTarget: JSAny)(...arguments): JSAny {
+  // This function is implementing the spec as suggested by
+  // https://github.com/tc39/proposal-promise-any/pull/59 . FIXME(marja):
+  // change this if the PR is declined, otherwise remove the comment.
+
+  // 1. If NewTarget is undefined, let newTarget be the active function
+  // object, else let newTarget be NewTarget.
+  // 2. Let O be ? OrdinaryCreateFromConstructor(newTarget,
+  // "%AggregateError.prototype%", « [[ErrorData]], [[AggregateErrors]] »).
+  // 3. If _message_ is not _undefined_, then
+  //   a. Let msg be ? ToString(_message_).
+  //   b. Let msgDesc be the PropertyDescriptor { [[Value]]: _msg_,
+  //   [[Writable]]: *true*, [[Enumerable]]: *false*, [[Configurable]]: *true*
+  //   c. Perform ! DefinePropertyOrThrow(_O_, *"message"*, _msgDesc_).
+  const message: JSAny = arguments[1];
+  const obj: JSObject =
+      ConstructAggregateErrorHelper(context, target, newTarget, message);
+
+  // 4. Let errorsList be ? IterableToList(errors).
+  const errors: JSAny = arguments[0];
+  const errorsList = iterator::IterableToListWithSymbolLookup(errors);
+
+  // 5. Perform ! CreateDataPropertyOrThrow(_O_, `"errors"`, _errorsList_).
+  CreateDataProperty(obj, ErrorsStringConstant(), errorsList);
+
+  // 6. Return O.
+  return obj;
+}
+
+extern runtime ConstructAggregateErrorHelper(
+    Context, JSFunction, JSAny, Object): JSObject;
+
+extern runtime ConstructInternalAggregateErrorHelper(Context, Object): JSObject;
+}
diff --git a/deps/v8/src/builtins/arm/builtins-arm.cc b/deps/v8/src/builtins/arm/builtins-arm.cc
index 49f578d1fd1..d340fd20b0a 100644
--- a/deps/v8/src/builtins/arm/builtins-arm.cc
+++ b/deps/v8/src/builtins/arm/builtins-arm.cc
@@ -123,32 +123,23 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     __ Push(cp, r0);
     __ SmiUntag(r0);
 
+#ifdef V8_REVERSE_JSARGS
+    // Set up pointer to last argument (skip receiver).
+    __ add(
+        r4, fp,
+        Operand(StandardFrameConstants::kCallerSPOffset + kSystemPointerSize));
+    // Copy arguments and receiver to the expression stack.
+    __ PushArray(r4, r0, r5);
+    // The receiver for the builtin/api call.
+    __ PushRoot(RootIndex::kTheHoleValue);
+#else
     // The receiver for the builtin/api call.
     __ PushRoot(RootIndex::kTheHoleValue);
-
     // Set up pointer to last argument.
     __ add(r4, fp, Operand(StandardFrameConstants::kCallerSPOffset));
-
     // Copy arguments and receiver to the expression stack.
-    Label loop, entry;
-    __ mov(r5, r0);
-    // ----------- S t a t e -------------
-    //  --                 r0: number of arguments (untagged)
-    //  --                 r1: constructor function
-    //  --                 r3: new target
-    //  --                 r4: pointer to last argument
-    //  --                 r5: counter
-    //  -- sp[0*kPointerSize]: the hole (receiver)
-    //  -- sp[1*kPointerSize]: number of arguments (tagged)
-    //  -- sp[2*kPointerSize]: context
-    // -----------------------------------
-    __ b(&entry);
-    __ bind(&loop);
-    __ ldr(scratch, MemOperand(r4, r5, LSL, kPointerSizeLog2));
-    __ push(scratch);
-    __ bind(&entry);
-    __ sub(r5, r5, Operand(1), SetCC);
-    __ b(ge, &loop);
+    __ PushArray(r4, r0, r5);
+#endif
 
     // Call the function.
     // r0: number of arguments (untagged)
@@ -239,29 +230,36 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
 
     // Restore new target.
     __ Pop(r3);
+
+#ifdef V8_REVERSE_JSARGS
+    // Push the allocated receiver to the stack.
+    __ Push(r0);
+    // We need two copies because we may have to return the original one
+    // and the calling conventions dictate that the called function pops the
+    // receiver. The second copy is pushed after the arguments, we saved in r6
+    // since r0 needs to store the number of arguments before
+    // InvokingFunction.
+    __ mov(r6, r0);
+
+    // Set up pointer to first argument (skip receiver).
+    __ add(
+        r4, fp,
+        Operand(StandardFrameConstants::kCallerSPOffset + kSystemPointerSize));
+#else
     // Push the allocated receiver to the stack. We need two copies
     // because we may have to return the original one and the calling
     // conventions dictate that the called function pops the receiver.
     __ Push(r0, r0);
 
-    // ----------- S t a t e -------------
-    //  --                 r3: new target
-    //  -- sp[0*kPointerSize]: implicit receiver
-    //  -- sp[1*kPointerSize]: implicit receiver
-    //  -- sp[2*kPointerSize]: padding
-    //  -- sp[3*kPointerSize]: constructor function
-    //  -- sp[4*kPointerSize]: number of arguments (tagged)
-    //  -- sp[5*kPointerSize]: context
-    // -----------------------------------
+    // Set up pointer to last argument.
+    __ add(r4, fp, Operand(StandardFrameConstants::kCallerSPOffset));
+#endif
 
     // Restore constructor function and argument count.
     __ ldr(r1, MemOperand(fp, ConstructFrameConstants::kConstructorOffset));
     __ ldr(r0, MemOperand(fp, ConstructFrameConstants::kLengthOffset));
     __ SmiUntag(r0);
 
-    // Set up pointer to last argument.
-    __ add(r4, fp, Operand(StandardFrameConstants::kCallerSPOffset));
-
     Label enough_stack_space, stack_overflow;
     Generate_StackOverflowCheck(masm, r0, r5, &stack_overflow);
     __ b(&enough_stack_space);
@@ -275,29 +273,13 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
 
     __ bind(&enough_stack_space);
 
-    // Copy arguments and receiver to the expression stack.
-    Label loop, entry;
-    __ mov(r5, r0);
-    // ----------- S t a t e -------------
-    //  --                        r0: number of arguments (untagged)
-    //  --                        r3: new target
-    //  --                        r4: pointer to last argument
-    //  --                        r5: counter
-    //  --        sp[0*kPointerSize]: implicit receiver
-    //  --        sp[1*kPointerSize]: implicit receiver
-    //  --        sp[2*kPointerSize]: padding
-    //  -- r1 and sp[3*kPointerSize]: constructor function
-    //  --        sp[4*kPointerSize]: number of arguments (tagged)
-    //  --        sp[5*kPointerSize]: context
-    // -----------------------------------
-    __ b(&entry);
+    // Copy arguments to the expression stack.
+    __ PushArray(r4, r0, r5);
 
-    __ bind(&loop);
-    __ ldr(r6, MemOperand(r4, r5, LSL, kPointerSizeLog2));
-    __ push(r6);
-    __ bind(&entry);
-    __ sub(r5, r5, Operand(1), SetCC);
-    __ b(ge, &loop);
+#ifdef V8_REVERSE_JSARGS
+    // Push implicit receiver.
+    __ Push(r6);
+#endif
 
     // Call the function.
     __ InvokeFunctionWithNewTarget(r1, r3, r0, CALL_FUNCTION);
@@ -424,9 +406,11 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   __ cmp(sp, scratch);
   __ b(lo, &stack_overflow);
 
+#ifndef V8_REVERSE_JSARGS
   // Push receiver.
   __ ldr(scratch, FieldMemOperand(r1, JSGeneratorObject::kReceiverOffset));
   __ Push(scratch);
+#endif
 
   // ----------- S t a t e -------------
   //  -- r1    : the JSGeneratorObject to resume
@@ -443,19 +427,38 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   __ ldr(r2,
          FieldMemOperand(r1, JSGeneratorObject::kParametersAndRegistersOffset));
   {
+#ifdef V8_REVERSE_JSARGS
+    Label done_loop, loop;
+    __ mov(r6, r3);
+
+    __ bind(&loop);
+    __ sub(r6, r6, Operand(1), SetCC);
+    __ b(lt, &done_loop);
+    __ add(scratch, r2, Operand(r6, LSL, kTaggedSizeLog2));
+    __ ldr(scratch, FieldMemOperand(scratch, FixedArray::kHeaderSize));
+    __ Push(scratch);
+    __ b(&loop);
+
+    __ bind(&done_loop);
+
+    // Push receiver.
+    __ ldr(scratch, FieldMemOperand(r1, JSGeneratorObject::kReceiverOffset));
+    __ Push(scratch);
+#else
     Label done_loop, loop;
     __ mov(r6, Operand(0));
 
     __ bind(&loop);
     __ cmp(r6, r3);
     __ b(ge, &done_loop);
-    __ add(scratch, r2, Operand(r6, LSL, kPointerSizeLog2));
+    __ add(scratch, r2, Operand(r6, LSL, kTaggedSizeLog2));
     __ ldr(scratch, FieldMemOperand(scratch, FixedArray::kHeaderSize));
     __ Push(scratch);
     __ add(r6, r6, Operand(1));
     __ b(&loop);
 
     __ bind(&done_loop);
+#endif
   }
 
   // Underlying function needs to have bytecode available.
@@ -744,13 +747,14 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     __ Move(cp, context_address);
     __ ldr(cp, MemOperand(cp));
 
-    // Push the function and the receiver onto the stack.
-    __ Push(r2, r3);
+    // Push the function.
+    __ Push(r2);
 
-    // Check if we have enough stack space to push all arguments.
-    // Clobbers r3.
+    // Check if we have enough stack space to push all arguments + receiver.
+    // Clobbers r5.
     Label enough_stack_space, stack_overflow;
-    Generate_StackOverflowCheck(masm, r0, r3, &stack_overflow);
+    __ add(r6, r0, Operand(1));  // Add one for receiver.
+    Generate_StackOverflowCheck(masm, r6, r5, &stack_overflow);
     __ b(&enough_stack_space);
     __ bind(&stack_overflow);
     __ CallRuntime(Runtime::kThrowStackOverflow);
@@ -762,19 +766,42 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     // Copy arguments to the stack in a loop.
     // r1: new.target
     // r2: function
+    // r3: receiver
     // r0: argc
     // r4: argv, i.e. points to first arg
+#ifdef V8_REVERSE_JSARGS
+    Label loop, entry;
+    __ add(r6, r4, Operand(r0, LSL, kSystemPointerSizeLog2));
+    // r6 points past last arg.
+    __ b(&entry);
+    __ bind(&loop);
+    __ ldr(r5, MemOperand(r6, -kSystemPointerSize,
+                          PreIndex));  // read next parameter
+    __ ldr(r5, MemOperand(r5));        // dereference handle
+    __ push(r5);                       // push parameter
+    __ bind(&entry);
+    __ cmp(r4, r6);
+    __ b(ne, &loop);
+
+    // Push the receiver.
+    __ Push(r3);
+#else
+    // Push the receiver.
+    __ Push(r3);
+
     Label loop, entry;
-    __ add(r3, r4, Operand(r0, LSL, kPointerSizeLog2));
-    // r1 points past last arg.
+    __ add(r3, r4, Operand(r0, LSL, kSystemPointerSizeLog2));
+    // r3 points past last arg.
     __ b(&entry);
     __ bind(&loop);
-    __ ldr(r5, MemOperand(r4, kPointerSize, PostIndex));  // read next parameter
+    __ ldr(r5, MemOperand(r4, kSystemPointerSize,
+                          PostIndex));                    // read next parameter
     __ ldr(r5, MemOperand(r5));                           // dereference handle
     __ push(r5);                                          // push parameter
     __ bind(&entry);
     __ cmp(r4, r3);
     __ b(ne, &loop);
+#endif
 
     // Setup new.target and function.
     __ mov(r3, r1);
@@ -1237,21 +1264,20 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
 }
 
 static void Generate_InterpreterPushArgs(MacroAssembler* masm,
-                                         Register num_args, Register index,
-                                         Register limit, Register scratch) {
-  // Find the address of the last argument.
-  __ mov(limit, num_args);
-  __ mov(limit, Operand(limit, LSL, kPointerSizeLog2));
-  __ sub(limit, index, limit);
-
-  Label loop_header, loop_check;
-  __ b(al, &loop_check);
-  __ bind(&loop_header);
-  __ ldr(scratch, MemOperand(index, -kPointerSize, PostIndex));
-  __ push(scratch);
-  __ bind(&loop_check);
-  __ cmp(index, limit);
-  __ b(hi, &loop_header);
+                                         Register num_args,
+                                         Register start_address,
+                                         Register scratch) {
+  // Find the argument with lowest address.
+  __ sub(scratch, num_args, Operand(1));
+  __ mov(scratch, Operand(scratch, LSL, kSystemPointerSizeLog2));
+  __ sub(start_address, start_address, scratch);
+  // Push the arguments.
+#ifdef V8_REVERSE_JSARGS
+  __ PushArray(start_address, num_args, scratch,
+               TurboAssembler::PushArrayOrder::kReverse);
+#else
+  __ PushArray(start_address, num_args, scratch);
+#endif
 }
 
 // static
@@ -1268,23 +1294,53 @@ void Builtins::Generate_InterpreterPushArgsThenCallImpl(
   // -----------------------------------
   Label stack_overflow;
 
+#ifdef V8_REVERSE_JSARGS
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+    // The spread argument should not be pushed.
+    __ sub(r0, r0, Operand(1));
+  }
+#endif
+
   __ add(r3, r0, Operand(1));  // Add one for receiver.
 
   Generate_StackOverflowCheck(masm, r3, r4, &stack_overflow);
 
+#ifdef V8_REVERSE_JSARGS
+  if (receiver_mode == ConvertReceiverMode::kNullOrUndefined) {
+    // Don't copy receiver. Argument count is correct.
+    __ mov(r3, r0);
+  }
+
+  // Push the arguments. r2 and r4 will be modified.
+  Generate_InterpreterPushArgs(masm, r3, r2, r4);
+
+  // Push "undefined" as the receiver arg if we need to.
+  if (receiver_mode == ConvertReceiverMode::kNullOrUndefined) {
+    __ PushRoot(RootIndex::kUndefinedValue);
+  }
+
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+    // Pass the spread in the register r2.
+    // r2 already points to the penultimate argument, the spread
+    // lies in the next interpreter register.
+    __ sub(r2, r2, Operand(kSystemPointerSize));
+    __ ldr(r2, MemOperand(r2));
+  }
+#else
   // Push "undefined" as the receiver arg if we need to.
   if (receiver_mode == ConvertReceiverMode::kNullOrUndefined) {
     __ PushRoot(RootIndex::kUndefinedValue);
     __ mov(r3, r0);  // Argument count is correct.
   }
 
-  // Push the arguments. r2, r4, r5 will be modified.
-  Generate_InterpreterPushArgs(masm, r3, r2, r4, r5);
+  // Push the arguments. r2 and r4 will be modified.
+  Generate_InterpreterPushArgs(masm, r3, r2, r4);
 
   if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     __ Pop(r2);                  // Pass the spread in a register
     __ sub(r0, r0, Operand(1));  // Subtract one for spread
   }
+#endif
 
   // Call the target.
   if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
@@ -1315,14 +1371,39 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
   // -----------------------------------
   Label stack_overflow;
 
+  __ add(r5, r0, Operand(1));  // Add one for receiver.
+
+  Generate_StackOverflowCheck(masm, r5, r6, &stack_overflow);
+
+#ifdef V8_REVERSE_JSARGS
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+    // The spread argument should not be pushed.
+    __ sub(r0, r0, Operand(1));
+  }
+
+  // Push the arguments. r4 and r5 will be modified.
+  Generate_InterpreterPushArgs(masm, r0, r4, r5);
+
   // Push a slot for the receiver to be constructed.
   __ mov(r5, Operand::Zero());
   __ push(r5);
 
-  Generate_StackOverflowCheck(masm, r0, r5, &stack_overflow);
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+    // Pass the spread in the register r2.
+    // r4 already points to the penultimate argument, the spread
+    // lies in the next interpreter register.
+    __ sub(r4, r4, Operand(kSystemPointerSize));
+    __ ldr(r2, MemOperand(r4));
+  } else {
+    __ AssertUndefinedOrAllocationSite(r2, r5);
+  }
+#else
+  // Push a slot for the receiver to be constructed.
+  __ mov(r5, Operand::Zero());
+  __ push(r5);
 
-  // Push the arguments. r5, r4, r6 will be modified.
-  Generate_InterpreterPushArgs(masm, r0, r4, r5, r6);
+  // Push the arguments. r4 and r5 will be modified.
+  Generate_InterpreterPushArgs(masm, r0, r4, r5);
 
   if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     __ Pop(r2);                  // Pass the spread in a register
@@ -1330,6 +1411,7 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
   } else {
     __ AssertUndefinedOrAllocationSite(r2, r5);
   }
+#endif
 
   if (mode == InterpreterPushArgsMode::kArrayFunction) {
     __ AssertFunction(r1);
@@ -1604,12 +1686,21 @@ void Builtins::Generate_FunctionPrototypeApply(MacroAssembler* masm) {
   {
     __ LoadRoot(r5, RootIndex::kUndefinedValue);
     __ mov(r2, r5);
-    __ ldr(r1, MemOperand(sp, r0, LSL, kPointerSizeLog2));  // receiver
+#ifdef V8_REVERSE_JSARGS
+    __ ldr(r1, MemOperand(sp, 0));  // receiver
+    __ cmp(r0, Operand(1));
+    __ ldr(r5, MemOperand(sp, kSystemPointerSize), ge);  // thisArg
+    __ cmp(r0, Operand(2), ge);
+    __ ldr(r2, MemOperand(sp, 2 * kSystemPointerSize), ge);  // argArray
+#else
+    __ ldr(r1, MemOperand(sp, r0, LSL, kSystemPointerSizeLog2));  // receiver
     __ sub(r4, r0, Operand(1), SetCC);
-    __ ldr(r5, MemOperand(sp, r4, LSL, kPointerSizeLog2), ge);  // thisArg
+    __ ldr(r5, MemOperand(sp, r4, LSL, kSystemPointerSizeLog2), ge);  // thisArg
     __ sub(r4, r4, Operand(1), SetCC, ge);
-    __ ldr(r2, MemOperand(sp, r4, LSL, kPointerSizeLog2), ge);  // argArray
-    __ add(sp, sp, Operand(r0, LSL, kPointerSizeLog2));
+    __ ldr(r2, MemOperand(sp, r4, LSL, kSystemPointerSizeLog2),
+           ge);  // argArray
+#endif
+    __ add(sp, sp, Operand(r0, LSL, kSystemPointerSizeLog2));
     __ str(r5, MemOperand(sp, 0));
   }
 
@@ -1643,6 +1734,24 @@ void Builtins::Generate_FunctionPrototypeApply(MacroAssembler* masm) {
 
 // static
 void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
+#ifdef V8_REVERSE_JSARGS
+  // 1. Get the callable to call (passed as receiver) from the stack.
+  __ Pop(r1);
+
+  // 2. Make sure we have at least one argument.
+  // r0: actual number of arguments
+  {
+    Label done;
+    __ cmp(r0, Operand::Zero());
+    __ b(ne, &done);
+    __ PushRoot(RootIndex::kUndefinedValue);
+    __ add(r0, r0, Operand(1));
+    __ bind(&done);
+  }
+
+  // 3. Adjust the actual number of arguments.
+  __ sub(r0, r0, Operand(1));
+#else
   // 1. Make sure we have at least one argument.
   // r0: actual number of arguments
   {
@@ -1656,7 +1765,7 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
 
   // 2. Get the callable to call (passed as receiver) from the stack.
   // r0: actual number of arguments
-  __ ldr(r1, MemOperand(sp, r0, LSL, kPointerSizeLog2));
+  __ ldr(r1, __ ReceiverOperand(r0));
 
   // 3. Shift arguments and return address one slot down on the stack
   //    (overwriting the original receiver).  Adjust argument count to make
@@ -1667,12 +1776,12 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
     Register scratch = r3;
     Label loop;
     // Calculate the copy start address (destination). Copy end address is sp.
-    __ add(r2, sp, Operand(r0, LSL, kPointerSizeLog2));
+    __ add(r2, sp, Operand(r0, LSL, kSystemPointerSizeLog2));
 
     __ bind(&loop);
-    __ ldr(scratch, MemOperand(r2, -kPointerSize));
+    __ ldr(scratch, MemOperand(r2, -kSystemPointerSize));
     __ str(scratch, MemOperand(r2));
-    __ sub(r2, r2, Operand(kPointerSize));
+    __ sub(r2, r2, Operand(kSystemPointerSize));
     __ cmp(r2, sp);
     __ b(ne, &loop);
     // Adjust the actual number of arguments and remove the top element
@@ -1680,6 +1789,7 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
     __ sub(r0, r0, Operand(1));
     __ pop();
   }
+#endif
 
   // 4. Call the callable.
   __ Jump(masm->isolate()->builtins()->Call(), RelocInfo::CODE_TARGET);
@@ -1693,6 +1803,7 @@ void Builtins::Generate_ReflectApply(MacroAssembler* masm) {
   //  -- sp[8]  : target
   //  -- sp[12] : receiver
   // -----------------------------------
+  // NOTE: The order of args in the stack are reversed if V8_REVERSE_JSARGS
 
   // 1. Load target into r1 (if present), argumentsList into r2 (if present),
   // remove all arguments from the stack (including the receiver), and push
@@ -1701,13 +1812,24 @@ void Builtins::Generate_ReflectApply(MacroAssembler* masm) {
     __ LoadRoot(r1, RootIndex::kUndefinedValue);
     __ mov(r5, r1);
     __ mov(r2, r1);
+#ifdef V8_REVERSE_JSARGS
+    __ cmp(r0, Operand(1));
+    __ ldr(r1, MemOperand(sp, kSystemPointerSize), ge);  // target
+    __ cmp(r0, Operand(2), ge);
+    __ ldr(r5, MemOperand(sp, 2 * kSystemPointerSize), ge);  // thisArgument
+    __ cmp(r0, Operand(3), ge);
+    __ ldr(r2, MemOperand(sp, 3 * kSystemPointerSize), ge);  // argumentsList
+#else
     __ sub(r4, r0, Operand(1), SetCC);
-    __ ldr(r1, MemOperand(sp, r4, LSL, kPointerSizeLog2), ge);  // target
+    __ ldr(r1, MemOperand(sp, r4, LSL, kSystemPointerSizeLog2), ge);  // target
     __ sub(r4, r4, Operand(1), SetCC, ge);
-    __ ldr(r5, MemOperand(sp, r4, LSL, kPointerSizeLog2), ge);  // thisArgument
+    __ ldr(r5, MemOperand(sp, r4, LSL, kSystemPointerSizeLog2),
+           ge);  // thisArgument
     __ sub(r4, r4, Operand(1), SetCC, ge);
-    __ ldr(r2, MemOperand(sp, r4, LSL, kPointerSizeLog2), ge);  // argumentsList
-    __ add(sp, sp, Operand(r0, LSL, kPointerSizeLog2));
+    __ ldr(r2, MemOperand(sp, r4, LSL, kSystemPointerSizeLog2),
+           ge);  // argumentsList
+#endif
+    __ add(sp, sp, Operand(r0, LSL, kSystemPointerSizeLog2));
     __ str(r5, MemOperand(sp, 0));
   }
 
@@ -1734,6 +1856,7 @@ void Builtins::Generate_ReflectConstruct(MacroAssembler* masm) {
   //  -- sp[8]  : target
   //  -- sp[12] : receiver
   // -----------------------------------
+  // NOTE: The order of args in the stack are reversed if V8_REVERSE_JSARGS
 
   // 1. Load target into r1 (if present), argumentsList into r2 (if present),
   // new.target into r3 (if present, otherwise use target), remove all
@@ -1742,15 +1865,30 @@ void Builtins::Generate_ReflectConstruct(MacroAssembler* masm) {
   {
     __ LoadRoot(r1, RootIndex::kUndefinedValue);
     __ mov(r2, r1);
-    __ str(r2, MemOperand(sp, r0, LSL, kPointerSizeLog2));  // receiver
+#ifdef V8_REVERSE_JSARGS
+    __ mov(r4, r1);
+    __ cmp(r0, Operand(1));
+    __ ldr(r1, MemOperand(sp, kSystemPointerSize), ge);  // target
+    __ mov(r3, r1);  // new.target defaults to target
+    __ cmp(r0, Operand(2), ge);
+    __ ldr(r2, MemOperand(sp, 2 * kSystemPointerSize), ge);  // argumentsList
+    __ cmp(r0, Operand(3), ge);
+    __ ldr(r3, MemOperand(sp, 3 * kSystemPointerSize), ge);  // new.target
+    __ add(sp, sp, Operand(r0, LSL, kSystemPointerSizeLog2));
+    __ str(r4, MemOperand(sp, 0));  // set undefined to the receiver
+#else
+    __ str(r2, MemOperand(sp, r0, LSL, kSystemPointerSizeLog2));  // receiver
     __ sub(r4, r0, Operand(1), SetCC);
-    __ ldr(r1, MemOperand(sp, r4, LSL, kPointerSizeLog2), ge);  // target
+    __ ldr(r1, MemOperand(sp, r4, LSL, kSystemPointerSizeLog2), ge);  // target
     __ mov(r3, r1);  // new.target defaults to target
     __ sub(r4, r4, Operand(1), SetCC, ge);
-    __ ldr(r2, MemOperand(sp, r4, LSL, kPointerSizeLog2), ge);  // argumentsList
+    __ ldr(r2, MemOperand(sp, r4, LSL, kSystemPointerSizeLog2),
+           ge);  // argumentsList
     __ sub(r4, r4, Operand(1), SetCC, ge);
-    __ ldr(r3, MemOperand(sp, r4, LSL, kPointerSizeLog2), ge);  // new.target
-    __ add(sp, sp, Operand(r0, LSL, kPointerSizeLog2));
+    __ ldr(r3, MemOperand(sp, r4, LSL, kSystemPointerSizeLog2),
+           ge);  // new.target
+    __ add(sp, sp, Operand(r0, LSL, kSystemPointerSizeLog2));
+#endif
   }
 
   // ----------- S t a t e -------------
@@ -1830,7 +1968,29 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
   Label stack_overflow;
   Generate_StackOverflowCheck(masm, r4, scratch, &stack_overflow);
 
-  // Push arguments onto the stack (thisArgument is already on the stack).
+#ifdef V8_REVERSE_JSARGS
+  // Move the arguments already in the stack,
+  // including the receiver and the return address.
+  {
+    Label copy, check;
+    Register num = r5, src = r6, dest = r9;  // r7 and r8 are context and root.
+    __ mov(src, sp);
+    // Update stack pointer.
+    __ lsl(scratch, r4, Operand(kSystemPointerSizeLog2));
+    __ AllocateStackSpace(scratch);
+    __ mov(dest, sp);
+    __ mov(num, r0);
+    __ b(&check);
+    __ bind(&copy);
+    __ ldr(scratch, MemOperand(src, kSystemPointerSize, PostIndex));
+    __ str(scratch, MemOperand(dest, kSystemPointerSize, PostIndex));
+    __ sub(num, num, Operand(1), SetCC);
+    __ bind(&check);
+    __ b(ge, &copy);
+  }
+#endif
+
+  // Copy arguments onto the stack (thisArgument is already on the stack).
   {
     __ mov(r6, Operand(0));
     __ LoadRoot(r5, RootIndex::kTheHoleValue);
@@ -1838,11 +1998,16 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
     __ bind(&loop);
     __ cmp(r6, r4);
     __ b(eq, &done);
-    __ add(scratch, r2, Operand(r6, LSL, kPointerSizeLog2));
+    __ add(scratch, r2, Operand(r6, LSL, kTaggedSizeLog2));
     __ ldr(scratch, FieldMemOperand(scratch, FixedArray::kHeaderSize));
     __ cmp(scratch, r5);
+    // Turn the hole into undefined as we go.
     __ LoadRoot(scratch, RootIndex::kUndefinedValue, eq);
+#ifdef V8_REVERSE_JSARGS
+    __ str(scratch, MemOperand(r9, kSystemPointerSize, PostIndex));
+#else
     __ Push(scratch);
+#endif
     __ add(r6, r6, Operand(1));
     __ b(&loop);
     __ bind(&done);
@@ -1981,7 +2146,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
       __ LoadGlobalProxy(r3);
     } else {
       Label convert_to_object, convert_receiver;
-      __ ldr(r3, MemOperand(sp, r0, LSL, kPointerSizeLog2));
+      __ ldr(r3, __ ReceiverOperand(r0));
       __ JumpIfSmi(r3, &convert_to_object);
       STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
       __ CompareObjectType(r3, r4, r4, FIRST_JS_RECEIVER_TYPE);
@@ -2017,7 +2182,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
       __ ldr(r2, FieldMemOperand(r1, JSFunction::kSharedFunctionInfoOffset));
       __ bind(&convert_receiver);
     }
-    __ str(r3, MemOperand(sp, r0, LSL, kPointerSizeLog2));
+    __ str(r3, __ ReceiverOperand(r0));
   }
   __ bind(&done_convert);
 
@@ -2073,10 +2238,11 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
       // (i.e. debug break and preemption) here, so check the "real stack
       // limit".
       Label done;
-      __ mov(scratch, Operand(r4, LSL, kPointerSizeLog2));
+      __ mov(scratch, Operand(r4, LSL, kSystemPointerSizeLog2));
       {
         UseScratchRegisterScope temps(masm);
         Register remaining_stack_size = temps.Acquire();
+        DCHECK(!AreAliased(r0, r1, r2, r3, r4, scratch, remaining_stack_size));
 
         // Compute the space we have left. The stack might already be overflowed
         // here which will cause remaining_stack_size to become negative.
@@ -2096,6 +2262,25 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
       __ bind(&done);
     }
 
+#ifdef V8_REVERSE_JSARGS
+    // Pop receiver.
+    __ Pop(r5);
+
+    // Push [[BoundArguments]].
+    {
+      Label loop;
+      __ add(r0, r0, r4);  // Adjust effective number of arguments.
+      __ add(r2, r2, Operand(FixedArray::kHeaderSize - kHeapObjectTag));
+      __ bind(&loop);
+      __ sub(r4, r4, Operand(1), SetCC);
+      __ ldr(scratch, MemOperand(r2, r4, LSL, kTaggedSizeLog2));
+      __ Push(scratch);
+      __ b(gt, &loop);
+    }
+
+    // Push receiver.
+    __ Push(r5);
+#else
     // Reserve stack space for the [[BoundArguments]].
     __ AllocateStackSpace(scratch);
 
@@ -2106,8 +2291,8 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
       __ bind(&loop);
       __ cmp(r5, r0);
       __ b(gt, &done_loop);
-      __ ldr(scratch, MemOperand(sp, r4, LSL, kPointerSizeLog2));
-      __ str(scratch, MemOperand(sp, r5, LSL, kPointerSizeLog2));
+      __ ldr(scratch, MemOperand(sp, r4, LSL, kSystemPointerSizeLog2));
+      __ str(scratch, MemOperand(sp, r5, LSL, kSystemPointerSizeLog2));
       __ add(r4, r4, Operand(1));
       __ add(r5, r5, Operand(1));
       __ b(&loop);
@@ -2127,6 +2312,7 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
       __ add(r0, r0, Operand(1));
       __ b(gt, &loop);
     }
+#endif
   }
   __ bind(&no_bound_arguments);
 }
@@ -2143,7 +2329,7 @@ void Builtins::Generate_CallBoundFunctionImpl(MacroAssembler* masm) {
 
   // Patch the receiver to [[BoundThis]].
   __ ldr(r3, FieldMemOperand(r1, JSBoundFunction::kBoundThisOffset));
-  __ str(r3, MemOperand(sp, r0, LSL, kPointerSizeLog2));
+  __ str(r3, __ ReceiverOperand(r0));
 
   // Push the [[BoundArguments]] onto the stack.
   Generate_PushBoundArguments(masm);
@@ -2183,7 +2369,7 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
   // 2. Call to something else, which might have a [[Call]] internal method (if
   // not we raise an exception).
   // Overwrite the original receiver the (original) target.
-  __ str(r1, MemOperand(sp, r0, LSL, kPointerSizeLog2));
+  __ str(r1, __ ReceiverOperand(r0));
   // Let the "call_as_function_delegate" take care of the rest.
   __ LoadNativeContextSlot(Context::CALL_AS_FUNCTION_DELEGATE_INDEX, r1);
   __ Jump(masm->isolate()->builtins()->CallFunction(
@@ -2292,7 +2478,7 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   __ bind(&non_proxy);
   {
     // Overwrite the original receiver with the (original) target.
-    __ str(r1, MemOperand(sp, r0, LSL, kPointerSizeLog2));
+    __ str(r1, __ ReceiverOperand(r0));
     // Let the "call_as_constructor_delegate" take care of the rest.
     __ LoadNativeContextSlot(Context::CALL_AS_CONSTRUCTOR_DELEGATE_INDEX, r1);
     __ Jump(masm->isolate()->builtins()->CallFunction(),
@@ -2319,9 +2505,13 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   __ b(eq, &dont_adapt_arguments);
   __ ldr(r4, FieldMemOperand(r1, JSFunction::kSharedFunctionInfoOffset));
   __ ldr(r4, FieldMemOperand(r4, SharedFunctionInfo::kFlagsOffset));
+
+#ifndef V8_REVERSE_JSARGS
+  // This optimization is disabled when the arguments are reversed.
   __ tst(r4,
          Operand(SharedFunctionInfo::IsSafeToSkipArgumentsAdaptorBit::kMask));
   __ b(ne, &skip_adapt_arguments);
+#endif
 
   // -------------------------------------------
   // Adapt arguments.
@@ -2342,10 +2532,14 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
       // r1: function
       // r2: expected number of arguments
       // r3: new target (passed through to callee)
+#ifdef V8_REVERSE_JSARGS
+      __ add(r0, fp, Operand(r2, LSL, kSystemPointerSizeLog2));
+#else
       __ add(r0, fp, Operand::PointerOffsetFromSmiKey(r0));
+#endif
       // adjust for return address and receiver
-      __ add(r0, r0, Operand(2 * kPointerSize));
-      __ sub(r4, r0, Operand(r2, LSL, kPointerSizeLog2));
+      __ add(r0, r0, Operand(2 * kSystemPointerSize));
+      __ sub(r4, r0, Operand(r2, LSL, kSystemPointerSizeLog2));
 
       // Copy the arguments (including the receiver) to the new stack frame.
       // r0: copy start address
@@ -2359,7 +2553,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
       __ ldr(r5, MemOperand(r0, 0));
       __ push(r5);
       __ cmp(r0, r4);  // Compare before moving to next argument.
-      __ sub(r0, r0, Operand(kPointerSize));
+      __ sub(r0, r0, Operand(kSystemPointerSize));
       __ b(ne, &copy);
 
       __ b(&invoke);
@@ -2371,6 +2565,49 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
       EnterArgumentsAdaptorFrame(masm);
       Generate_StackOverflowCheck(masm, r2, r5, &stack_overflow);
 
+#ifdef V8_REVERSE_JSARGS
+      // Fill the remaining expected arguments with undefined.
+      // r0: actual number of arguments as a smi
+      // r1: function
+      // r2: expected number of arguments
+      // r3: new target (passed through to callee)
+      __ LoadRoot(r5, RootIndex::kUndefinedValue);
+      __ sub(r6, r2, Operand::SmiUntag(r0));
+      __ sub(r4, fp, Operand(r6, LSL, kPointerSizeLog2));
+      // Adjust for frame.
+      __ sub(r4, r4,
+             Operand(ArgumentsAdaptorFrameConstants::kFixedFrameSizeFromFp +
+                     kPointerSize));
+
+      Label fill;
+      __ bind(&fill);
+      __ push(r5);
+      __ cmp(sp, r4);
+      __ b(ne, &fill);
+
+      // Calculate copy start address into r0 and copy end address is fp.
+      // r0: actual number of arguments as a smi
+      // r1: function
+      // r2: expected number of arguments
+      // r3: new target (passed through to callee)
+      __ add(r0, fp, Operand::PointerOffsetFromSmiKey(r0));
+
+      // Copy the arguments (including the receiver) to the new stack frame.
+      // r0: copy start address
+      // r1: function
+      // r2: expected number of arguments
+      // r3: new target (passed through to callee)
+      Label copy;
+      __ bind(&copy);
+
+      // Adjust load for return address and receiver.
+      __ ldr(r5, MemOperand(r0, 2 * kPointerSize));
+      __ push(r5);
+
+      __ cmp(r0, fp);  // Compare before moving to next argument.
+      __ sub(r0, r0, Operand(kPointerSize));
+      __ b(ne, &copy);
+#else
       // Calculate copy start address into r0 and copy end address is fp.
       // r0: actual number of arguments as a smi
       // r1: function
@@ -2410,6 +2647,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
       __ push(r5);
       __ cmp(sp, r4);
       __ b(ne, &fill);
+#endif
     }
 
     // Call the entry point.
@@ -2915,6 +3153,7 @@ void Builtins::Generate_CallApiCallback(MacroAssembler* masm) {
   //  -- sp[(argc - 1) * 4]  : first argument
   //  -- sp[(argc + 0) * 4]  : receiver
   // -----------------------------------
+  // NOTE: The order of args are reversed if V8_REVERSE_JSARGS
 
   Register api_function_address = r1;
   Register argc = r2;
@@ -2982,8 +3221,12 @@ void Builtins::Generate_CallApiCallback(MacroAssembler* masm) {
 
   // FunctionCallbackInfo::values_ (points at the first varargs argument passed
   // on the stack).
+#ifdef V8_REVERSE_JSARGS
+  __ add(scratch, scratch, Operand((FCA::kArgsLength + 1) * kPointerSize));
+#else
   __ add(scratch, scratch, Operand((FCA::kArgsLength - 1) * kPointerSize));
   __ add(scratch, scratch, Operand(argc, LSL, kPointerSizeLog2));
+#endif
   __ str(scratch, MemOperand(sp, 2 * kPointerSize));
 
   // FunctionCallbackInfo::length_.
diff --git a/deps/v8/src/builtins/arm64/builtins-arm64.cc b/deps/v8/src/builtins/arm64/builtins-arm64.cc
index 9c38ae085ec..46ab7a61fa8 100644
--- a/deps/v8/src/builtins/arm64/builtins-arm64.cc
+++ b/deps/v8/src/builtins/arm64/builtins-arm64.cc
@@ -143,17 +143,19 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     __ Claim(slot_count);
 
     // Preserve the incoming parameters on the stack.
-    __ LoadRoot(x10, RootIndex::kTheHoleValue);
+    __ LoadRoot(x4, RootIndex::kTheHoleValue);
 
     // Compute a pointer to the slot immediately above the location on the
     // stack to which arguments will be later copied.
     __ SlotAddress(x2, argc);
 
+#ifndef V8_REVERSE_JSARGS
     // Poke the hole (receiver) in the highest slot.
-    __ Str(x10, MemOperand(x2));
-    __ Tbnz(slot_count_without_rounding, 0, &already_aligned);
+    __ Str(x4, MemOperand(x2));
+#endif
 
     // Store padding, if needed.
+    __ Tbnz(slot_count_without_rounding, 0, &already_aligned);
     __ Str(padreg, MemOperand(x2, 1 * kSystemPointerSize));
     __ Bind(&already_aligned);
 
@@ -162,9 +164,18 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
       Register count = x2;
       Register dst = x10;
       Register src = x11;
-      __ Mov(count, argc);
       __ SlotAddress(dst, 0);
+#ifdef V8_REVERSE_JSARGS
+      // Poke the hole (receiver).
+      __ Str(x4, MemOperand(dst));
+      __ Add(dst, dst, kSystemPointerSize);  // Skip receiver.
+      __ Add(src, fp,
+             StandardFrameConstants::kCallerSPOffset +
+                 kSystemPointerSize);  // Skip receiver.
+#else
       __ Add(src, fp, StandardFrameConstants::kCallerSPOffset);
+#endif
+      __ Mov(count, argc);
       __ CopyDoubleWords(dst, src, count);
     }
 
@@ -175,7 +186,7 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     // If argc is odd:
     //  --     sp[0*kSystemPointerSize]: argument n - 1
     //  --             ...
-    //  -- sp[(n-1)*kSystemPointerSize]: argument 0
+    //  -- sp[(n-1)*kSystemPointerSize]: argument 1
     //  -- sp[(n+0)*kSystemPointerSize]: the hole (receiver)
     //  -- sp[(n+1)*kSystemPointerSize]: padding
     //  -- sp[(n+2)*kSystemPointerSize]: padding
@@ -184,12 +195,13 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     // If argc is even:
     //  --     sp[0*kSystemPointerSize]: argument n - 1
     //  --             ...
-    //  -- sp[(n-1)*kSystemPointerSize]: argument 0
+    //  -- sp[(n-1)*kSystemPointerSize]: argument 1
     //  -- sp[(n+0)*kSystemPointerSize]: the hole (receiver)
     //  -- sp[(n+1)*kSystemPointerSize]: padding
     //  -- sp[(n+2)*kSystemPointerSize]: number of arguments (tagged)
     //  -- sp[(n+3)*kSystemPointerSize]: context (pushed by FrameScope)
     // -----------------------------------
+    // NOTE: The order of args in the stack are reversed if V8_REVERSE_JSARGS
 
     // Call the function.
     __ InvokeFunctionWithNewTarget(x1, x3, argc, CALL_FUNCTION);
@@ -264,8 +276,10 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
     // If not derived class constructor: Allocate the new receiver object.
     __ IncrementCounter(masm->isolate()->counters()->constructed_objects(), 1,
                         x4, x5);
+
     __ Call(BUILTIN_CODE(masm->isolate(), FastNewObject),
             RelocInfo::CODE_TARGET);
+
     __ B(&post_instantiation_deopt_entry);
 
     // Else: use TheHoleValue as receiver for constructor call
@@ -346,8 +360,15 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
       Register dst = x10;
       Register src = x11;
       __ Mov(count, x12);
+#ifdef V8_REVERSE_JSARGS
+      __ Poke(x0, 0);          // Add the receiver.
+      __ SlotAddress(dst, 1);  // Skip receiver.
+      __ Add(src, fp,
+             StandardFrameConstants::kCallerSPOffset + kSystemPointerSize);
+#else
       __ SlotAddress(dst, 0);
       __ Add(src, fp, StandardFrameConstants::kCallerSPOffset);
+#endif
       __ CopyDoubleWords(dst, src, count);
     }
 
@@ -496,7 +517,7 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   // Poke receiver into highest claimed slot.
   __ LoadTaggedPointerField(
       x5, FieldMemOperand(x1, JSGeneratorObject::kReceiverOffset));
-  __ Poke(x5, Operand(x10, LSL, kSystemPointerSizeLog2));
+  __ Poke(x5, __ ReceiverOperand(x10));
 
   // ----------- S t a t e -------------
   //  -- x1                       : the JSGeneratorObject to resume
@@ -504,26 +525,33 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   //  -- x10                      : argument count
   //  -- cp                       : generator context
   //  -- lr                       : return address
-  //  -- sp[arg count]            : generator receiver
-  //  -- sp[0 .. arg count - 1]   : claimed for args
+  //  -- sp[0 .. arg count]       : claimed for receiver and args
   // -----------------------------------
 
   // Copy the function arguments from the generator object's register file.
-
   __ LoadTaggedPointerField(
       x5,
       FieldMemOperand(x1, JSGeneratorObject::kParametersAndRegistersOffset));
   {
     Label loop, done;
     __ Cbz(x10, &done);
+#ifdef V8_REVERSE_JSARGS
+    __ SlotAddress(x12, x10);
+    __ Add(x5, x5, Operand(x10, LSL, kTaggedSizeLog2));
+    __ Add(x5, x5, Operand(FixedArray::kHeaderSize - kHeapObjectTag));
+    __ Bind(&loop);
+    __ Sub(x10, x10, 1);
+    __ LoadAnyTaggedField(x11, MemOperand(x5, -kTaggedSize, PreIndex));
+    __ Str(x11, MemOperand(x12, -kSystemPointerSize, PostIndex));
+#else
     __ Mov(x12, 0);
-
     __ Bind(&loop);
     __ Sub(x10, x10, 1);
     __ Add(x11, x5, Operand(x12, LSL, kTaggedSizeLog2));
     __ LoadAnyTaggedField(x11, FieldMemOperand(x11, FixedArray::kHeaderSize));
     __ Poke(x11, Operand(x10, LSL, kSystemPointerSizeLog2));
     __ Add(x12, x12, 1);
+#endif
     __ Cbnz(x10, &loop);
     __ Bind(&done);
   }
@@ -862,9 +890,17 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     __ SlotAddress(scratch, slots_to_claim);
     __ Str(padreg, MemOperand(scratch, -kSystemPointerSize));
 
+#ifdef V8_REVERSE_JSARGS
+    // Store receiver on the stack.
+    __ Poke(receiver, 0);
+    // Store function on the stack.
+    __ SlotAddress(scratch, argc);
+    __ Str(function, MemOperand(scratch, kSystemPointerSize));
+#else
     // Store receiver and function on the stack.
     __ SlotAddress(scratch, argc);
     __ Stp(receiver, function, MemOperand(scratch));
+#endif
 
     // Copy arguments to the stack in a loop, in reverse order.
     // x4: argc.
@@ -874,9 +910,21 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     // Skip the argument set up if we have no arguments.
     __ Cbz(argc, &done);
 
-    // scratch has been set to point to the location of the receiver, which
+    // scratch has been set to point to the location of the function, which
     // marks the end of the argument copy.
-
+#ifdef V8_REVERSE_JSARGS
+    __ SlotAddress(x0, 1);  // Skips receiver.
+    __ Bind(&loop);
+    // Load the handle.
+    __ Ldr(x11, MemOperand(argv, kSystemPointerSize, PostIndex));
+    // Dereference the handle.
+    __ Ldr(x11, MemOperand(x11));
+    // Poke the result into the stack.
+    __ Str(x11, MemOperand(x0, kSystemPointerSize, PostIndex));
+    // Loop if we've not reached the end of copy marker.
+    __ Cmp(x0, scratch);
+    __ B(le, &loop);
+#else
     __ Bind(&loop);
     // Load the handle.
     __ Ldr(x11, MemOperand(argv, kSystemPointerSize, PostIndex));
@@ -887,6 +935,7 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     // Loop if we've not reached the end of copy marker.
     __ Cmp(sp, scratch);
     __ B(lt, &loop);
+#endif
 
     __ Bind(&done);
 
@@ -1418,6 +1467,36 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
     __ Poke(padreg, Operand(scratch, LSL, kSystemPointerSizeLog2));
   }
 
+#ifdef V8_REVERSE_JSARGS
+  if (receiver_mode == ConvertReceiverMode::kNullOrUndefined) {
+    __ Mov(slots_to_copy, num_args);
+    __ SlotAddress(stack_addr, 1);
+  } else {
+    // If we're not given an explicit receiver to store, we'll need to copy it
+    // together with the rest of the arguments.
+    __ Add(slots_to_copy, num_args, 1);
+    __ SlotAddress(stack_addr, 0);
+  }
+
+  __ Sub(last_arg_addr, first_arg_index,
+         Operand(slots_to_copy, LSL, kSystemPointerSizeLog2));
+  __ Add(last_arg_addr, last_arg_addr, kSystemPointerSize);
+
+  // Load the final spread argument into spread_arg_out, if necessary.
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+    __ Ldr(spread_arg_out, MemOperand(last_arg_addr, -kSystemPointerSize));
+  }
+
+  __ CopyDoubleWords(stack_addr, last_arg_addr, slots_to_copy,
+                     TurboAssembler::kDstLessThanSrcAndReverse);
+
+  if (receiver_mode == ConvertReceiverMode::kNullOrUndefined) {
+    // Store "undefined" as the receiver arg if we need to.
+    Register receiver = x14;
+    __ LoadRoot(receiver, RootIndex::kUndefinedValue);
+    __ Poke(receiver, 0);
+  }
+#else   // !V8_REVERSE_JSARGS
   if (receiver_mode == ConvertReceiverMode::kNullOrUndefined) {
     // Store "undefined" as the receiver arg if we need to.
     Register receiver = x14;
@@ -1443,6 +1522,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
   // Copy the rest of the arguments.
   __ SlotAddress(stack_addr, 0);
   __ CopyDoubleWords(stack_addr, last_arg_addr, slots_to_copy);
+#endif  // !V8_REVERSE_JSARGS
 }
 
 // static
@@ -1778,14 +1858,16 @@ void Builtins::Generate_FunctionPrototypeApply(MacroAssembler* masm) {
   //  -- sp[8]    : thisArg  (if argc >= 1)
   //  -- sp[16]   : receiver
   // -----------------------------------
+  // NOTE: The order of args in the stack are reversed if V8_REVERSE_JSARGS
+
   ASM_LOCATION("Builtins::Generate_FunctionPrototypeApply");
 
   Register argc = x0;
-  Register arg_array = x2;
   Register receiver = x1;
-  Register this_arg = x0;
-  Register undefined_value = x3;
-  Register null_value = x4;
+  Register arg_array = x2;
+  Register this_arg = x3;
+  Register undefined_value = x4;
+  Register null_value = x5;
 
   __ LoadRoot(undefined_value, RootIndex::kUndefinedValue);
   __ LoadRoot(null_value, RootIndex::kNullValue);
@@ -1793,8 +1875,21 @@ void Builtins::Generate_FunctionPrototypeApply(MacroAssembler* masm) {
   // 1. Load receiver into x1, argArray into x2 (if present), remove all
   // arguments from the stack (including the receiver), and push thisArg (if
   // present) instead.
+#ifdef V8_REVERSE_JSARGS
+  {
+    Label done;
+    __ Mov(this_arg, undefined_value);
+    __ Mov(arg_array, undefined_value);
+    __ Peek(receiver, 0);
+    __ Cmp(argc, Immediate(1));
+    __ B(lt, &done);
+    __ Peek(this_arg, kSystemPointerSize);
+    __ B(eq, &done);
+    __ Peek(arg_array, 2 * kSystemPointerSize);
+    __ bind(&done);
+  }
+#else   // !V8_REVERSE_JSARGS
   {
-    Register saved_argc = x10;
     Register scratch = x11;
 
     // Push two undefined values on the stack, to put it in a consistent state
@@ -1814,16 +1909,13 @@ void Builtins::Generate_FunctionPrototypeApply(MacroAssembler* masm) {
     // There are now always three arguments to read, in the slots starting from
     // slot argc.
     __ SlotAddress(scratch, argc);
-
-    __ Mov(saved_argc, argc);
-    __ Ldp(arg_array, this_arg, MemOperand(scratch));  // Overwrites argc.
+    __ Ldp(arg_array, this_arg, MemOperand(scratch));
     __ Ldr(receiver, MemOperand(scratch, 2 * kSystemPointerSize));
-
     __ Drop(2);  // Drop the undefined values we pushed above.
-    __ DropArguments(saved_argc, TurboAssembler::kCountExcludesReceiver);
-
-    __ PushArgument(this_arg);
   }
+#endif  // !V8_REVERSE_JSARGS
+  __ DropArguments(argc, TurboAssembler::kCountExcludesReceiver);
+  __ PushArgument(this_arg);
 
   // ----------- S t a t e -------------
   //  -- x2      : argArray
@@ -1863,7 +1955,7 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
   ASM_LOCATION("Builtins::Generate_FunctionPrototypeCall");
 
   // 1. Get the callable to call (passed as receiver) from the stack.
-  __ Peek(function, Operand(argc, LSL, kXRegSizeLog2));
+  __ Peek(function, __ ReceiverOperand(argc));
 
   // 2. Handle case with no arguments.
   {
@@ -1879,9 +1971,39 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
     __ Bind(&non_zero);
   }
 
+  Label arguments_ready;
+#ifdef V8_REVERSE_JSARGS
+  // 3. Shift arguments. It depends if the arguments is even or odd.
+  // That is if padding exists or not.
+  {
+    Label even;
+    Register copy_from = x10;
+    Register copy_to = x11;
+    Register count = x12;
+    __ Mov(count, argc);  // CopyDoubleWords changes the count argument.
+    __ Tbz(argc, 0, &even);
+
+    // Shift arguments one slot down on the stack (overwriting the original
+    // receiver).
+    __ SlotAddress(copy_from, 1);
+    __ Sub(copy_to, copy_from, kSystemPointerSize);
+    __ CopyDoubleWords(copy_to, copy_from, count);
+    // Overwrite the duplicated remaining last argument.
+    __ Poke(padreg, Operand(argc, LSL, kXRegSizeLog2));
+    __ B(&arguments_ready);
+
+    // Copy arguments one slot higher in memory, overwriting the original
+    // receiver and padding.
+    __ Bind(&even);
+    __ SlotAddress(copy_from, count);
+    __ Add(copy_to, copy_from, kSystemPointerSize);
+    __ CopyDoubleWords(copy_to, copy_from, count,
+                       TurboAssembler::kSrcLessThanDst);
+    __ Drop(2);
+  }
+#else   // !V8_REVERSE_JSARGS
   // 3. Overwrite the receiver with padding. If argc is odd, this is all we
   //    need to do.
-  Label arguments_ready;
   __ Poke(padreg, Operand(argc, LSL, kXRegSizeLog2));
   __ Tbnz(argc, 0, &arguments_ready);
 
@@ -1902,6 +2024,7 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
     // Drop two slots. These are copies of the last two arguments.
     __ Drop(2);
   }
+#endif  // !V8_REVERSE_JSARGS
 
   // 5. Adjust argument count to make the original first argument the new
   //    receiver and call the callable.
@@ -1918,6 +2041,8 @@ void Builtins::Generate_ReflectApply(MacroAssembler* masm) {
   //  -- sp[16]   : target        (if argc >= 1)
   //  -- sp[24]   : receiver
   // -----------------------------------
+  // NOTE: The order of args in the stack are reversed if V8_REVERSE_JSARGS
+
   ASM_LOCATION("Builtins::Generate_ReflectApply");
 
   Register argc = x0;
@@ -1931,6 +2056,23 @@ void Builtins::Generate_ReflectApply(MacroAssembler* masm) {
   // 1. Load target into x1 (if present), argumentsList into x2 (if present),
   // remove all arguments from the stack (including the receiver), and push
   // thisArgument (if present) instead.
+#ifdef V8_REVERSE_JSARGS
+  {
+    Label done;
+    __ Mov(target, undefined_value);
+    __ Mov(this_argument, undefined_value);
+    __ Mov(arguments_list, undefined_value);
+    __ Cmp(argc, Immediate(1));
+    __ B(lt, &done);
+    __ Peek(target, kSystemPointerSize);
+    __ B(eq, &done);
+    __ Peek(this_argument, 2 * kSystemPointerSize);
+    __ Cmp(argc, Immediate(3));
+    __ B(lt, &done);
+    __ Peek(arguments_list, 3 * kSystemPointerSize);
+    __ bind(&done);
+  }
+#else   // !V8_REVERSE_JSARGS
   {
     // Push four undefined values on the stack, to put it in a consistent state
     // so that we can always read the three arguments we need from it. The
@@ -1967,10 +2109,10 @@ void Builtins::Generate_ReflectApply(MacroAssembler* masm) {
     __ Ldr(target, MemOperand(scratch, 3 * kSystemPointerSize));
 
     __ Drop(4);  // Drop the undefined values we pushed above.
-    __ DropArguments(argc, TurboAssembler::kCountExcludesReceiver);
-
-    __ PushArgument(this_argument);
   }
+#endif  // !V8_REVERSE_JSARGS
+  __ DropArguments(argc, TurboAssembler::kCountExcludesReceiver);
+  __ PushArgument(this_argument);
 
   // ----------- S t a t e -------------
   //  -- x2      : argumentsList
@@ -1995,6 +2137,8 @@ void Builtins::Generate_ReflectConstruct(MacroAssembler* masm) {
   //  -- sp[16]   : target
   //  -- sp[24]   : receiver
   // -----------------------------------
+  // NOTE: The order of args in the stack are reversed if V8_REVERSE_JSARGS
+
   ASM_LOCATION("Builtins::Generate_ReflectConstruct");
 
   Register argc = x0;
@@ -2009,6 +2153,24 @@ void Builtins::Generate_ReflectConstruct(MacroAssembler* masm) {
   // new.target into x3 (if present, otherwise use target), remove all
   // arguments from the stack (including the receiver), and push thisArgument
   // (if present) instead.
+#ifdef V8_REVERSE_JSARGS
+  {
+    Label done;
+    __ Mov(target, undefined_value);
+    __ Mov(arguments_list, undefined_value);
+    __ Mov(new_target, undefined_value);
+    __ Cmp(argc, Immediate(1));
+    __ B(lt, &done);
+    __ Peek(target, kSystemPointerSize);
+    __ B(eq, &done);
+    __ Peek(arguments_list, 2 * kSystemPointerSize);
+    __ Mov(new_target, target);  // new.target defaults to target
+    __ Cmp(argc, Immediate(3));
+    __ B(lt, &done);
+    __ Peek(new_target, 3 * kSystemPointerSize);
+    __ bind(&done);
+  }
+#else   // !V8_REVERSE_JSARGS
   {
     // Push four undefined values on the stack, to put it in a consistent state
     // so that we can always read the three arguments we need from it. The
@@ -2048,11 +2210,13 @@ void Builtins::Generate_ReflectConstruct(MacroAssembler* masm) {
     __ CmovX(new_target, target, ls);  // target if argc <= 2.
 
     __ Drop(4);  // Drop the undefined values we pushed above.
-    __ DropArguments(argc, TurboAssembler::kCountExcludesReceiver);
-
-    // Push receiver (undefined).
-    __ PushArgument(undefined_value);
   }
+#endif  // !V8_REVERSE_JSARGS
+
+  __ DropArguments(argc, TurboAssembler::kCountExcludesReceiver);
+
+  // Push receiver (undefined).
+  __ PushArgument(undefined_value);
 
   // ----------- S t a t e -------------
   //  -- x2      : argumentsList
@@ -2105,6 +2269,39 @@ void LeaveArgumentsAdaptorFrame(MacroAssembler* masm) {
 // one slot up or one slot down, as needed.
 void Generate_PrepareForCopyingVarargs(MacroAssembler* masm, Register argc,
                                        Register len) {
+#ifdef V8_REVERSE_JSARGS
+  Label even;
+  Register slots_to_copy = x10;
+  Register slots_to_claim = x12;
+
+  __ Add(slots_to_copy, argc, 1);  // Copy with receiver.
+  __ Mov(slots_to_claim, len);
+  __ Tbz(slots_to_claim, 0, &even);
+
+  // Claim space we need. If argc is even, slots_to_claim = len + 1, as we need
+  // one extra padding slot. If argc is odd, we know that the original arguments
+  // will have a padding slot we can reuse (since len is odd), so
+  // slots_to_claim = len - 1.
+  {
+    Register scratch = x11;
+    __ Add(slots_to_claim, len, 1);
+    __ And(scratch, argc, 1);
+    __ Eor(scratch, scratch, 1);
+    __ Sub(slots_to_claim, slots_to_claim, Operand(scratch, LSL, 1));
+  }
+
+  __ Bind(&even);
+  __ Claim(slots_to_claim);
+
+  // Move the arguments already in the stack including the receiver.
+  {
+    Register src = x11;
+    Register dst = x12;
+    __ SlotAddress(src, slots_to_claim);
+    __ SlotAddress(dst, 0);
+    __ CopyDoubleWords(dst, src, slots_to_copy);
+  }
+#else   // !V8_REVERSE_JSARGS
   Label len_odd, exit;
   Register slots_to_copy = x10;  // If needed.
   __ Add(slots_to_copy, argc, 1);
@@ -2158,6 +2355,7 @@ void Generate_PrepareForCopyingVarargs(MacroAssembler* masm, Register argc,
   }
 
   __ Bind(&exit);
+#endif  // !V8_REVERSE_JSARGS
 }
 
 }  // namespace
@@ -2217,6 +2415,19 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
     // We do not use the CompareRoot macro as it would do a LoadRoot behind the
     // scenes and we want to avoid that in a loop.
     // TODO(all): Consider using Ldp and Stp.
+#ifdef V8_REVERSE_JSARGS
+    Register dst = x16;
+    __ Add(dst, argc, Immediate(1));  // Consider the receiver as well.
+    __ SlotAddress(dst, dst);
+    __ Add(argc, argc, len);  // Update new argc.
+    __ Bind(&loop);
+    __ Sub(len, len, 1);
+    __ LoadAnyTaggedField(scratch, MemOperand(src, kTaggedSize, PostIndex));
+    __ CmpTagged(scratch, the_hole_value);
+    __ Csel(scratch, scratch, undefined_value, ne);
+    __ Str(scratch, MemOperand(dst, kSystemPointerSize, PostIndex));
+    __ Cbnz(len, &loop);
+#else
     __ Bind(&loop);
     __ Sub(len, len, 1);
     __ LoadAnyTaggedField(scratch, MemOperand(src, kTaggedSize, PostIndex));
@@ -2224,9 +2435,9 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
     __ Csel(scratch, scratch, undefined_value, ne);
     __ Poke(scratch, Operand(len, LSL, kSystemPointerSizeLog2));
     __ Cbnz(len, &loop);
+#endif
   }
   __ Bind(&done);
-
   // Tail-call to the actual Call or Construct builtin.
   __ Jump(code, RelocInfo::CODE_TARGET);
 
@@ -2368,7 +2579,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
       __ LoadGlobalProxy(x3);
     } else {
       Label convert_to_object, convert_receiver;
-      __ Peek(x3, Operand(x0, LSL, kXRegSizeLog2));
+      __ Peek(x3, __ ReceiverOperand(x0));
       __ JumpIfSmi(x3, &convert_to_object);
       STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
       __ CompareObjectType(x3, x4, x4, FIRST_JS_RECEIVER_TYPE);
@@ -2403,7 +2614,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
           x2, FieldMemOperand(x1, JSFunction::kSharedFunctionInfoOffset));
       __ Bind(&convert_receiver);
     }
-    __ Poke(x3, Operand(x0, LSL, kXRegSizeLog2));
+    __ Poke(x3, __ ReceiverOperand(x0));
   }
   __ Bind(&done_convert);
 
@@ -2474,6 +2685,83 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
       __ Bind(&done);
     }
 
+#ifdef V8_REVERSE_JSARGS
+    Label copy_bound_args;
+    Register total_argc = x15;
+    Register slots_to_claim = x12;
+    Register scratch = x10;
+    Register receiver = x14;
+
+    __ Add(total_argc, argc, bound_argc);
+    __ Peek(receiver, 0);
+
+    // Round up slots_to_claim to an even number if it is odd.
+    __ Add(slots_to_claim, bound_argc, 1);
+    __ Bic(slots_to_claim, slots_to_claim, 1);
+    __ Claim(slots_to_claim, kSystemPointerSize);
+
+    __ Tbz(bound_argc, 0, &copy_bound_args);
+    {
+      Label argc_even;
+      __ Tbz(argc, 0, &argc_even);
+      // Arguments count is odd (with the receiver it's even), so there's no
+      // alignment padding above the arguments and we have to "add" it. We
+      // claimed bound_argc + 1, since it is odd and it was rounded up. +1 here
+      // is for stack alignment padding.
+      // 1. Shift args one slot down.
+      {
+        Register copy_from = x11;
+        Register copy_to = x12;
+        __ SlotAddress(copy_to, slots_to_claim);
+        __ Add(copy_from, copy_to, kSystemPointerSize);
+        __ CopyDoubleWords(copy_to, copy_from, argc);
+      }
+      // 2. Write a padding in the last slot.
+      __ Add(scratch, total_argc, 1);
+      __ Str(padreg, MemOperand(sp, scratch, LSL, kSystemPointerSizeLog2));
+      __ B(&copy_bound_args);
+
+      __ Bind(&argc_even);
+      // Arguments count is even (with the receiver it's odd), so there's an
+      // alignment padding above the arguments and we can reuse it. We need to
+      // claim bound_argc - 1, but we claimed bound_argc + 1, since it is odd
+      // and it was rounded up.
+      // 1. Drop 2.
+      __ Drop(2);
+      // 2. Shift args one slot up.
+      {
+        Register copy_from = x11;
+        Register copy_to = x12;
+        __ SlotAddress(copy_to, total_argc);
+        __ Sub(copy_from, copy_to, kSystemPointerSize);
+        __ CopyDoubleWords(copy_to, copy_from, argc,
+                           TurboAssembler::kSrcLessThanDst);
+      }
+    }
+
+    // If bound_argc is even, there is no alignment massage to do, and we have
+    // already claimed the correct number of slots (bound_argc).
+    __ Bind(&copy_bound_args);
+
+    // Copy the receiver back.
+    __ Poke(receiver, 0);
+    // Copy [[BoundArguments]] to the stack (below the receiver).
+    {
+      Label loop;
+      Register counter = bound_argc;
+      Register copy_to = x12;
+      __ Add(bound_argv, bound_argv, FixedArray::kHeaderSize - kHeapObjectTag);
+      __ SlotAddress(copy_to, 1);
+      __ Bind(&loop);
+      __ Sub(counter, counter, 1);
+      __ LoadAnyTaggedField(scratch,
+                            MemOperand(bound_argv, kTaggedSize, PostIndex));
+      __ Str(scratch, MemOperand(copy_to, kSystemPointerSize, PostIndex));
+      __ Cbnz(counter, &loop);
+    }
+    // Update argc.
+    __ Mov(argc, total_argc);
+#else   // !V8_REVERSE_JSARGS
     // Check if we need padding.
     Label copy_args, copy_bound_args;
     Register total_argc = x15;
@@ -2546,6 +2834,7 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
         __ Bind(&done);
       }
     }
+#endif  // !V8_REVERSE_JSARGS
   }
   __ Bind(&no_bound_arguments);
 }
@@ -2563,7 +2852,7 @@ void Builtins::Generate_CallBoundFunctionImpl(MacroAssembler* masm) {
   // Patch the receiver to [[BoundThis]].
   __ LoadAnyTaggedField(x10,
                         FieldMemOperand(x1, JSBoundFunction::kBoundThisOffset));
-  __ Poke(x10, Operand(x0, LSL, kSystemPointerSizeLog2));
+  __ Poke(x10, __ ReceiverOperand(x0));
 
   // Push the [[BoundArguments]] onto the stack.
   Generate_PushBoundArguments(masm);
@@ -2604,7 +2893,8 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
   // 2. Call to something else, which might have a [[Call]] internal method (if
   // not we raise an exception).
   // Overwrite the original receiver with the (original) target.
-  __ Poke(x1, Operand(x0, LSL, kXRegSizeLog2));
+  __ Poke(x1, __ ReceiverOperand(x0));
+
   // Let the "call_as_function_delegate" take care of the rest.
   __ LoadNativeContextSlot(Context::CALL_AS_FUNCTION_DELEGATE_INDEX, x1);
   __ Jump(masm->isolate()->builtins()->CallFunction(
@@ -2720,7 +3010,8 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   __ bind(&non_proxy);
   {
     // Overwrite the original receiver with the (original) target.
-    __ Poke(x1, Operand(x0, LSL, kXRegSizeLog2));
+    __ Poke(x1, __ ReceiverOperand(x0));
+
     // Let the "call_as_constructor_delegate" take care of the rest.
     __ LoadNativeContextSlot(Context::CALL_AS_CONSTRUCTOR_DELEGATE_INDEX, x1);
     __ Jump(masm->isolate()->builtins()->CallFunction(),
@@ -2793,18 +3084,22 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // alignment of the arguments.
   // If the number of expected arguments is larger than the number of actual
   // arguments, the remaining expected slots will be filled with undefined.
+  // TODO(v8:10201) update comment once reversed arguments order sticks
 
   Register argc_actual = x0;    // Excluding the receiver.
   Register argc_expected = x2;  // Excluding the receiver.
   Register function = x1;
-  Register argc_actual_minus_expected = x5;
 
-  Label create_adaptor_frame, dont_adapt_arguments, stack_overflow,
-      adapt_arguments_in_place;
+  Label create_adaptor_frame, dont_adapt_arguments, stack_overflow;
 
   __ Cmp(argc_expected, kDontAdaptArgumentsSentinel);
   __ B(eq, &dont_adapt_arguments);
 
+#ifndef V8_REVERSE_JSARGS
+  // This optimization is disabled when the arguments are reversed.
+  Label adapt_arguments_in_place;
+  Register argc_actual_minus_expected = x5;
+
   // When the difference between argc_actual and argc_expected is odd, we
   // create an arguments adaptor frame.
   __ Sub(argc_actual_minus_expected, argc_actual, argc_expected);
@@ -2818,6 +3113,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   __ TestAndBranchIfAnySet(
       w4, SharedFunctionInfo::IsSafeToSkipArgumentsAdaptorBit::kMask,
       &adapt_arguments_in_place);
+#endif
 
   // -------------------------------------------
   // Create an arguments adaptor frame.
@@ -2828,11 +3124,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     EnterArgumentsAdaptorFrame(masm);
 
     Register copy_from = x10;
-    Register copy_end = x11;
     Register copy_to = x12;
+    Register copy_end = x11;
     Register argc_to_copy = x13;
-    Register argc_unused_actual = x14;
-    Register scratch1 = x15, scratch2 = x16;
+    Register scratch1 = x15;
 
     // We need slots for the expected arguments, with one extra slot for the
     // receiver.
@@ -2846,12 +3141,61 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     __ Bic(scratch1, scratch1, 1);
     __ Claim(scratch1, kSystemPointerSize);
 
+#ifdef V8_REVERSE_JSARGS
+    // If we don't have enough arguments, fill the remaining expected
+    // arguments with undefined, otherwise skip this step.
+    Label enough_arguments;
+    __ Cmp(argc_actual, argc_expected);
+    __ Csel(argc_to_copy, argc_expected, argc_actual, ge);
+    __ Add(argc_to_copy, argc_to_copy, 1);  // Include receiver.
+    __ B(ge, &enough_arguments);
+
+    // Fill the remaining expected arguments with undefined.
+    __ RecordComment("-- Fill slots with undefined --");
+    Label fill;
+    // scratch1 still contains the size of the claimed area,
+    // which is RoundUp(argc_expected + 1, 2).
+    __ SlotAddress(copy_to, scratch1);
+    __ SlotAddress(copy_end, argc_to_copy);
+    __ LoadRoot(scratch1, RootIndex::kUndefinedValue);
+    // Now we can write pairs of undefineds, potentially overwriting one word
+    // below copy_end, but that's ok because that slot is still within claimed
+    // region. This loop will execute at least once because at this point we
+    // know that there's at least one undefined to be pushed and
+    // argc_to_copy >= 1.
+    __ Bind(&fill);
+    __ Stp(scratch1, scratch1,
+           MemOperand(copy_to, -2 * kSystemPointerSize, PreIndex));
+    __ Cmp(copy_to, copy_end);
+    __ B(hi, &fill);
+
+    // Enough arguments.
+    __ Bind(&enough_arguments);
+
+    // Store padding if needed, when expected arguments is even.
+    __ RecordComment("-- Store padding --");
+    Label skip_padding;
+    __ Tbnz(argc_expected, 0, &skip_padding);
+    __ SlotAddress(scratch1, argc_expected);
+    __ Str(padreg, MemOperand(scratch1, kSystemPointerSize));
+    __ bind(&skip_padding);
+
+    // Copy arguments.
+    __ RecordComment("-- Copy actual arguments --");
     __ Mov(copy_to, sp);
+    __ Add(copy_from, fp, 2 * kSystemPointerSize);
+    __ CopyDoubleWords(copy_to, copy_from, argc_to_copy);
+
+#else  // !V8_REVERSE_JSARGS
+    Register argc_unused_actual = x14;
+    Register scratch2 = x16;
 
     // Preparing the expected arguments is done in four steps, the order of
     // which is chosen so we can use LDP/STP and avoid conditional branches as
     // much as possible.
 
+    __ Mov(copy_to, sp);
+
     // (1) If we don't have enough arguments, fill the remaining expected
     // arguments with undefined, otherwise skip this step.
     Label enough_arguments;
@@ -2918,6 +3262,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
            MemOperand(copy_from, argc_actual, LSL, kSystemPointerSizeLog2));
     __ Str(scratch1,
            MemOperand(sp, argc_expected, LSL, kSystemPointerSizeLog2));
+#endif
 
     // Arguments have been adapted. Now call the entry point.
     __ RecordComment("-- Call entry point --");
@@ -2939,6 +3284,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     __ Ret();
   }
 
+#ifndef V8_REVERSE_JSARGS
   // -----------------------------------------
   // Adapt arguments in the existing frame.
   // -----------------------------------------
@@ -2976,6 +3322,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
       __ B(&dont_adapt_arguments);
     }
   }
+#endif
 
   // -------------------------------------------
   // Dont adapt arguments.
@@ -3492,6 +3839,7 @@ void Builtins::Generate_CallApiCallback(MacroAssembler* masm) {
   //  -- sp[(argc - 1) * 8]  : first argument
   //  -- sp[(argc + 0) * 8]  : receiver
   // -----------------------------------
+  // NOTE: The order of args in the stack are reversed if V8_REVERSE_JSARGS
 
   Register api_function_address = x1;
   Register argc = x2;
@@ -3561,9 +3909,14 @@ void Builtins::Generate_CallApiCallback(MacroAssembler* masm) {
 
   // FunctionCallbackInfo::values_ (points at the first varargs argument passed
   // on the stack).
+#ifdef V8_REVERSE_JSARGS
+  __ Add(scratch, scratch,
+         Operand((FCA::kArgsLength + 1) * kSystemPointerSize));
+#else
   __ Add(scratch, scratch,
          Operand((FCA::kArgsLength - 1) * kSystemPointerSize));
   __ Add(scratch, scratch, Operand(argc, LSL, kSystemPointerSizeLog2));
+#endif
   __ Str(scratch, MemOperand(sp, 2 * kSystemPointerSize));
 
   // FunctionCallbackInfo::length_.
diff --git a/deps/v8/src/builtins/array-copywithin.tq b/deps/v8/src/builtins/array-copywithin.tq
index cee0b1e1a48..3d2a456efbb 100644
--- a/deps/v8/src/builtins/array-copywithin.tq
+++ b/deps/v8/src/builtins/array-copywithin.tq
@@ -3,92 +3,91 @@
 // found in the LICENSE file.
 
 namespace array {
-  macro ConvertToRelativeIndex(index: Number, length: Number): Number {
-    return index < 0 ? Max(index + length, 0) : Min(index, length);
-  }
+macro ConvertToRelativeIndex(index: Number, length: Number): Number {
+  return index < 0 ? Max(index + length, 0) : Min(index, length);
+}
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.copyWithin
-  transitioning javascript builtin ArrayPrototypeCopyWithin(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    // 1. Let O be ? ToObject(this value).
-    const object: JSReceiver = ToObject_Inline(context, receiver);
+// https://tc39.github.io/ecma262/#sec-array.prototype.copyWithin
+transitioning javascript builtin ArrayPrototypeCopyWithin(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // 1. Let O be ? ToObject(this value).
+  const object: JSReceiver = ToObject_Inline(context, receiver);
 
-    // 2. Let len be ? ToLength(? Get(O, "length")).
-    const length: Number = GetLengthProperty(object);
+  // 2. Let len be ? ToLength(? Get(O, "length")).
+  const length: Number = GetLengthProperty(object);
 
-    // 3. Let relativeTarget be ? ToInteger(target).
-    const relativeTarget: Number = ToInteger_Inline(arguments[0]);
+  // 3. Let relativeTarget be ? ToInteger(target).
+  const relativeTarget: Number = ToInteger_Inline(arguments[0]);
 
-    // 4. If relativeTarget < 0, let to be max((len + relativeTarget), 0);
-    //    else let to be min(relativeTarget, len).
-    let to: Number = ConvertToRelativeIndex(relativeTarget, length);
+  // 4. If relativeTarget < 0, let to be max((len + relativeTarget), 0);
+  //    else let to be min(relativeTarget, len).
+  let to: Number = ConvertToRelativeIndex(relativeTarget, length);
 
-    // 5. Let relativeStart be ? ToInteger(start).
-    const relativeStart: Number = ToInteger_Inline(arguments[1]);
+  // 5. Let relativeStart be ? ToInteger(start).
+  const relativeStart: Number = ToInteger_Inline(arguments[1]);
 
-    // 6. If relativeStart < 0, let from be max((len + relativeStart), 0);
-    //    else let from be min(relativeStart, len).
-    let from: Number = ConvertToRelativeIndex(relativeStart, length);
+  // 6. If relativeStart < 0, let from be max((len + relativeStart), 0);
+  //    else let from be min(relativeStart, len).
+  let from: Number = ConvertToRelativeIndex(relativeStart, length);
 
-    // 7. If end is undefined, let relativeEnd be len;
-    //    else let relativeEnd be ? ToInteger(end).
-    let relativeEnd: Number = length;
-    if (arguments[2] != Undefined) {
-      relativeEnd = ToInteger_Inline(arguments[2]);
-    }
+  // 7. If end is undefined, let relativeEnd be len;
+  //    else let relativeEnd be ? ToInteger(end).
+  let relativeEnd: Number = length;
+  if (arguments[2] != Undefined) {
+    relativeEnd = ToInteger_Inline(arguments[2]);
+  }
 
-    // 8. If relativeEnd < 0, let final be max((len + relativeEnd), 0);
-    //    else let final be min(relativeEnd, len).
-    const final: Number = ConvertToRelativeIndex(relativeEnd, length);
+  // 8. If relativeEnd < 0, let final be max((len + relativeEnd), 0);
+  //    else let final be min(relativeEnd, len).
+  const final: Number = ConvertToRelativeIndex(relativeEnd, length);
 
-    // 9. Let count be min(final-from, len-to).
-    let count: Number = Min(final - from, length - to);
+  // 9. Let count be min(final-from, len-to).
+  let count: Number = Min(final - from, length - to);
 
-    // 10. If from<to and to<from+count, then.
-    let direction: Number = 1;
+  // 10. If from<to and to<from+count, then.
+  let direction: Number = 1;
 
-    if (from < to && to < (from + count)) {
-      // a. Let direction be -1.
-      direction = -1;
+  if (from < to && to < (from + count)) {
+    // a. Let direction be -1.
+    direction = -1;
 
-      // b. Let from be from + count - 1.
-      from = from + count - 1;
+    // b. Let from be from + count - 1.
+    from = from + count - 1;
 
-      // c. Let to be to + count - 1.
-      to = to + count - 1;
-    }
+    // c. Let to be to + count - 1.
+    to = to + count - 1;
+  }
 
-    // 12. Repeat, while count > 0.
-    while (count > 0) {
-      // a. Let fromKey be ! ToString(from).
-      // b. Let toKey be ! ToString(to).
-      // c. Let fromPresent be ? HasProperty(O, fromKey).
-      const fromPresent: Boolean = HasProperty(object, from);
-
-      // d. If fromPresent is true, then.
-      if (fromPresent == True) {
-        // i. Let fromVal be ? Get(O, fromKey).
-        const fromVal: JSAny = GetProperty(object, from);
-
-        // ii. Perform ? Set(O, toKey, fromVal, true).
-        SetProperty(object, to, fromVal);
-      } else {
-        // i. Perform ? DeletePropertyOrThrow(O, toKey).
-        DeleteProperty(object, to, LanguageMode::kStrict);
-      }
-
-      // f. Let from be from + direction.
-      from = from + direction;
-
-      // g. Let to be to + direction.
-      to = to + direction;
-
-      // h. Let count be count - 1.
-      --count;
+  // 12. Repeat, while count > 0.
+  while (count > 0) {
+    // a. Let fromKey be ! ToString(from).
+    // b. Let toKey be ! ToString(to).
+    // c. Let fromPresent be ? HasProperty(O, fromKey).
+    const fromPresent: Boolean = HasProperty(object, from);
+
+    // d. If fromPresent is true, then.
+    if (fromPresent == True) {
+      // i. Let fromVal be ? Get(O, fromKey).
+      const fromVal: JSAny = GetProperty(object, from);
+
+      // ii. Perform ? Set(O, toKey, fromVal, true).
+      SetProperty(object, to, fromVal);
+    } else {
+      // i. Perform ? DeletePropertyOrThrow(O, toKey).
+      DeleteProperty(object, to, LanguageMode::kStrict);
     }
 
-    // 13. Return O.
-    return object;
+    // f. Let from be from + direction.
+    from = from + direction;
+
+    // g. Let to be to + direction.
+    to = to + direction;
+
+    // h. Let count be count - 1.
+    --count;
   }
+
+  // 13. Return O.
+  return object;
+}
 }
diff --git a/deps/v8/src/builtins/array-every.tq b/deps/v8/src/builtins/array-every.tq
index 4e5f99d40a5..2514a18b747 100644
--- a/deps/v8/src/builtins/array-every.tq
+++ b/deps/v8/src/builtins/array-every.tq
@@ -3,145 +3,142 @@
 // found in the LICENSE file.
 
 namespace array {
-  transitioning javascript builtin
-  ArrayEveryLoopEagerDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
-    // All continuation points in the optimized every implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    //
-    // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires JSAny type for all parameters
-    // other than {context}.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    return ArrayEveryLoopContinuation(
-        jsreceiver, callbackfn, thisArg, Undefined, jsreceiver, numberK,
-        numberLength, Undefined);
+transitioning javascript builtin
+ArrayEveryLoopEagerDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
+  // All continuation points in the optimized every implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  //
+  // Also, this great mass of casts is necessary because the signature
+  // of Torque javascript builtins requires JSAny type for all parameters
+  // other than {context}.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  return ArrayEveryLoopContinuation(
+      jsreceiver, callbackfn, thisArg, Undefined, jsreceiver, numberK,
+      numberLength, Undefined);
+}
+
+transitioning javascript builtin
+ArrayEveryLoopLazyDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
+    result: JSAny): JSAny {
+  // All continuation points in the optimized every implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  let numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  // This custom lazy deopt point is right after the callback. every() needs
+  // to pick up at the next step, which is either continuing to the next
+  // array element or returning false if {result} is false.
+  if (!ToBoolean(result)) {
+    return False;
   }
 
-  transitioning javascript builtin
-  ArrayEveryLoopLazyDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
-      result: JSAny): JSAny {
-    // All continuation points in the optimized every implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    let numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    // This custom lazy deopt point is right after the callback. every() needs
-    // to pick up at the next step, which is either continuing to the next
-    // array element or returning false if {result} is false.
-    if (!ToBoolean(result)) {
-      return False;
-    }
+  numberK = numberK + 1;
 
-    numberK = numberK + 1;
+  return ArrayEveryLoopContinuation(
+      jsreceiver, callbackfn, thisArg, Undefined, jsreceiver, numberK,
+      numberLength, Undefined);
+}
 
-    return ArrayEveryLoopContinuation(
-        jsreceiver, callbackfn, thisArg, Undefined, jsreceiver, numberK,
-        numberLength, Undefined);
-  }
+transitioning builtin ArrayEveryLoopContinuation(implicit context: Context)(
+    _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny, _array: JSAny,
+    o: JSReceiver, initialK: Number, length: Number, _initialTo: JSAny): JSAny {
+  // 5. Let k be 0.
+  // 6. Repeat, while k < len
+  for (let k: Number = initialK; k < length; k++) {
+    // 6a. Let Pk be ! ToString(k).
+    // k is guaranteed to be a positive integer, hence ToString is
+    // side-effect free and HasProperty/GetProperty do the conversion inline.
 
-  transitioning builtin ArrayEveryLoopContinuation(implicit context: Context)(
-      _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
-      _array: JSAny, o: JSReceiver, initialK: Number, length: Number,
-      _initialTo: JSAny): JSAny {
-    // 5. Let k be 0.
-    // 6. Repeat, while k < len
-    for (let k: Number = initialK; k < length; k++) {
-      // 6a. Let Pk be ! ToString(k).
-      // k is guaranteed to be a positive integer, hence ToString is
-      // side-effect free and HasProperty/GetProperty do the conversion inline.
-
-      // 6b. Let kPresent be ? HasProperty(O, Pk).
-      const kPresent: Boolean = HasProperty_Inline(o, k);
-
-      // 6c. If kPresent is true, then
-      if (kPresent == True) {
-        // 6c. i. Let kValue be ? Get(O, Pk).
-        const kValue: JSAny = GetProperty(o, k);
-
-        // 6c. ii. Perform ? Call(callbackfn, T, <kValue, k, O>).
-        const result: JSAny = Call(context, callbackfn, thisArg, kValue, k, o);
-
-        // iii. If selected is true, then...
-        if (!ToBoolean(result)) {
-          return False;
-        }
-      }
+    // 6b. Let kPresent be ? HasProperty(O, Pk).
+    const kPresent: Boolean = HasProperty_Inline(o, k);
 
-      // 6d. Increase k by 1. (done by the loop).
-    }
-    return True;
-  }
+    // 6c. If kPresent is true, then
+    if (kPresent == True) {
+      // 6c. i. Let kValue be ? Get(O, Pk).
+      const kValue: JSAny = GetProperty(o, k);
+
+      // 6c. ii. Perform ? Call(callbackfn, T, <kValue, k, O>).
+      const result: JSAny = Call(context, callbackfn, thisArg, kValue, k, o);
 
-  transitioning macro FastArrayEvery(implicit context: Context)(
-      o: JSReceiver, len: Number, callbackfn: Callable, thisArg: JSAny): JSAny
-      labels Bailout(Smi) {
-    let k: Smi = 0;
-    const smiLen = Cast<Smi>(len) otherwise goto Bailout(k);
-    const fastO: FastJSArray = Cast<FastJSArray>(o) otherwise goto Bailout(k);
-    let fastOW = NewFastJSArrayWitness(fastO);
-
-    // Build a fast loop over the smi array.
-    for (; k < smiLen; k++) {
-      fastOW.Recheck() otherwise goto Bailout(k);
-
-      // Ensure that we haven't walked beyond a possibly updated length.
-      if (k >= fastOW.Get().length) goto Bailout(k);
-      const value: JSAny = fastOW.LoadElementNoHole(k) otherwise continue;
-      const result: JSAny =
-          Call(context, callbackfn, thisArg, value, k, fastOW.Get());
+      // iii. If selected is true, then...
       if (!ToBoolean(result)) {
         return False;
       }
     }
-    return True;
-  }
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.every
-  transitioning javascript builtin
-  ArrayEvery(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
-      JSAny {
-    try {
-      RequireObjectCoercible(receiver, 'Array.prototype.every');
+    // 6d. Increase k by 1. (done by the loop).
+  }
+  return True;
+}
 
-      // 1. Let O be ? ToObject(this value).
-      const o: JSReceiver = ToObject_Inline(context, receiver);
+transitioning macro FastArrayEvery(implicit context: Context)(
+    o: JSReceiver, len: Number, callbackfn: Callable, thisArg: JSAny): JSAny
+    labels Bailout(Smi) {
+  let k: Smi = 0;
+  const smiLen = Cast<Smi>(len) otherwise goto Bailout(k);
+  const fastO: FastJSArray = Cast<FastJSArray>(o) otherwise goto Bailout(k);
+  let fastOW = NewFastJSArrayWitness(fastO);
+
+  // Build a fast loop over the smi array.
+  for (; k < smiLen; k++) {
+    fastOW.Recheck() otherwise goto Bailout(k);
+
+    // Ensure that we haven't walked beyond a possibly updated length.
+    if (k >= fastOW.Get().length) goto Bailout(k);
+    const value: JSAny = fastOW.LoadElementNoHole(k) otherwise continue;
+    const result: JSAny =
+        Call(context, callbackfn, thisArg, value, k, fastOW.Get());
+    if (!ToBoolean(result)) {
+      return False;
+    }
+  }
+  return True;
+}
 
-      // 2. Let len be ? ToLength(? Get(O, "length")).
-      const len: Number = GetLengthProperty(o);
+// https://tc39.github.io/ecma262/#sec-array.prototype.every
+transitioning javascript builtin
+ArrayEvery(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  try {
+    RequireObjectCoercible(receiver, 'Array.prototype.every');
 
-      // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
-      if (arguments.length == 0) {
-        goto TypeError;
-      }
-      const callbackfn = Cast<Callable>(arguments[0]) otherwise TypeError;
+    // 1. Let O be ? ToObject(this value).
+    const o: JSReceiver = ToObject_Inline(context, receiver);
 
-      // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
+    // 2. Let len be ? ToLength(? Get(O, "length")).
+    const len: Number = GetLengthProperty(o);
 
-      // Special cases.
-      try {
-        return FastArrayEvery(o, len, callbackfn, thisArg)
-            otherwise Bailout;
-      }
-      label Bailout(kValue: Smi) deferred {
-        return ArrayEveryLoopContinuation(
-            o, callbackfn, thisArg, Undefined, o, kValue, len, Undefined);
-      }
+    // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
+    if (arguments.length == 0) {
+      goto TypeError;
     }
-    label TypeError deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise TypeError;
+
+    // 4. If thisArg is present, let T be thisArg; else let T be undefined.
+    const thisArg: JSAny = arguments[1];
+
+    // Special cases.
+    try {
+      return FastArrayEvery(o, len, callbackfn, thisArg)
+          otherwise Bailout;
+    } label Bailout(kValue: Smi) deferred {
+      return ArrayEveryLoopContinuation(
+          o, callbackfn, thisArg, Undefined, o, kValue, len, Undefined);
     }
+  } label TypeError deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
   }
 }
+}
diff --git a/deps/v8/src/builtins/array-filter.tq b/deps/v8/src/builtins/array-filter.tq
index 1da1c551664..1add88fa6a4 100644
--- a/deps/v8/src/builtins/array-filter.tq
+++ b/deps/v8/src/builtins/array-filter.tq
@@ -3,200 +3,197 @@
 // found in the LICENSE file.
 
 namespace array {
-  transitioning javascript builtin
-  ArrayFilterLoopEagerDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
-      length: JSAny, initialTo: JSAny): JSAny {
-    // All continuation points in the optimized filter implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    //
-    // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires JSAny type for all parameters
-    // other than {context}.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const outputArray = Cast<JSReceiver>(array) otherwise unreachable;
-    const numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberTo = Cast<Number>(initialTo) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
+transitioning javascript builtin
+ArrayFilterLoopEagerDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
+    length: JSAny, initialTo: JSAny): JSAny {
+  // All continuation points in the optimized filter implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  //
+  // Also, this great mass of casts is necessary because the signature
+  // of Torque javascript builtins requires JSAny type for all parameters
+  // other than {context}.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const outputArray = Cast<JSReceiver>(array) otherwise unreachable;
+  const numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberTo = Cast<Number>(initialTo) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  return ArrayFilterLoopContinuation(
+      jsreceiver, callbackfn, thisArg, outputArray, jsreceiver, numberK,
+      numberLength, numberTo);
+}
 
-    return ArrayFilterLoopContinuation(
-        jsreceiver, callbackfn, thisArg, outputArray, jsreceiver, numberK,
-        numberLength, numberTo);
+transitioning javascript builtin
+ArrayFilterLoopLazyDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
+    length: JSAny, valueK: JSAny, initialTo: JSAny, result: JSAny): JSAny {
+  // All continuation points in the optimized filter implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const outputArray = Cast<JSReceiver>(array) otherwise unreachable;
+  let numberK = Cast<Number>(initialK) otherwise unreachable;
+  let numberTo = Cast<Number>(initialTo) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  // This custom lazy deopt point is right after the callback. filter() needs
+  // to pick up at the next step, which is setting the callback
+  // result in the output array. After incrementing k and to, we can glide
+  // into the loop continuation builtin.
+  if (ToBoolean(result)) {
+    FastCreateDataProperty(outputArray, numberTo, valueK);
+    numberTo = numberTo + 1;
   }
 
-  transitioning javascript builtin
-  ArrayFilterLoopLazyDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
-      length: JSAny, valueK: JSAny, initialTo: JSAny, result: JSAny): JSAny {
-    // All continuation points in the optimized filter implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const outputArray = Cast<JSReceiver>(array) otherwise unreachable;
-    let numberK = Cast<Number>(initialK) otherwise unreachable;
-    let numberTo = Cast<Number>(initialTo) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    // This custom lazy deopt point is right after the callback. filter() needs
-    // to pick up at the next step, which is setting the callback
-    // result in the output array. After incrementing k and to, we can glide
-    // into the loop continuation builtin.
-    if (ToBoolean(result)) {
-      FastCreateDataProperty(outputArray, numberTo, valueK);
-      numberTo = numberTo + 1;
-    }
-
-    numberK = numberK + 1;
+  numberK = numberK + 1;
 
-    return ArrayFilterLoopContinuation(
-        jsreceiver, callbackfn, thisArg, outputArray, jsreceiver, numberK,
-        numberLength, numberTo);
-  }
+  return ArrayFilterLoopContinuation(
+      jsreceiver, callbackfn, thisArg, outputArray, jsreceiver, numberK,
+      numberLength, numberTo);
+}
 
-  transitioning builtin ArrayFilterLoopContinuation(implicit context: Context)(
-      _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
-      array: JSReceiver, o: JSReceiver, initialK: Number, length: Number,
-      initialTo: Number): JSAny {
-    let to: Number = initialTo;
-    // 5. Let k be 0.
-    // 6. Repeat, while k < len
-    for (let k: Number = initialK; k < length; k++) {
-      // 6a. Let Pk be ! ToString(k).
-      // k is guaranteed to be a positive integer, hence ToString is
-      // side-effect free and HasProperty/GetProperty do the conversion inline.
-
-      // 6b. Let kPresent be ? HasProperty(O, Pk).
-      const kPresent: Boolean = HasProperty_Inline(o, k);
-
-      // 6c. If kPresent is true, then
-      if (kPresent == True) {
-        // 6c. i. Let kValue be ? Get(O, Pk).
-        const kValue: JSAny = GetProperty(o, k);
-
-        // 6c. ii. Perform ? Call(callbackfn, T, <kValue, k, O>).
-        const result: JSAny = Call(context, callbackfn, thisArg, kValue, k, o);
-
-        // iii. If selected is true, then...
-        if (ToBoolean(result)) {
-          // 1. Perform ? CreateDataPropertyOrThrow(A, ToString(to), kValue).
-          FastCreateDataProperty(array, to, kValue);
-          // 2. Increase to by 1.
-          to = to + 1;
-        }
+transitioning builtin ArrayFilterLoopContinuation(implicit context: Context)(
+    _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
+    array: JSReceiver, o: JSReceiver, initialK: Number, length: Number,
+    initialTo: Number): JSAny {
+  let to: Number = initialTo;
+  // 5. Let k be 0.
+  // 6. Repeat, while k < len
+  for (let k: Number = initialK; k < length; k++) {
+    // 6a. Let Pk be ! ToString(k).
+    // k is guaranteed to be a positive integer, hence ToString is
+    // side-effect free and HasProperty/GetProperty do the conversion inline.
+
+    // 6b. Let kPresent be ? HasProperty(O, Pk).
+    const kPresent: Boolean = HasProperty_Inline(o, k);
+
+    // 6c. If kPresent is true, then
+    if (kPresent == True) {
+      // 6c. i. Let kValue be ? Get(O, Pk).
+      const kValue: JSAny = GetProperty(o, k);
+
+      // 6c. ii. Perform ? Call(callbackfn, T, <kValue, k, O>).
+      const result: JSAny = Call(context, callbackfn, thisArg, kValue, k, o);
+
+      // iii. If selected is true, then...
+      if (ToBoolean(result)) {
+        // 1. Perform ? CreateDataPropertyOrThrow(A, ToString(to), kValue).
+        FastCreateDataProperty(array, to, kValue);
+        // 2. Increase to by 1.
+        to = to + 1;
       }
-
-      // 6d. Increase k by 1. (done by the loop).
     }
-    return array;
+
+    // 6d. Increase k by 1. (done by the loop).
   }
+  return array;
+}
 
-  transitioning macro FastArrayFilter(implicit context: Context)(
-      fastO: FastJSArray, len: Smi, callbackfn: Callable, thisArg: JSAny,
-      output: FastJSArray) labels Bailout(Number, Number) {
-    let k: Smi = 0;
-    let to: Smi = 0;
-    let fastOW = NewFastJSArrayWitness(fastO);
-    let fastOutputW = NewFastJSArrayWitness(output);
-
-    fastOutputW.EnsureArrayPushable() otherwise goto Bailout(k, to);
-
-    // Build a fast loop over the array.
-    for (; k < len; k++) {
-      fastOW.Recheck() otherwise goto Bailout(k, to);
-
-      // Ensure that we haven't walked beyond a possibly updated length.
-      if (k >= fastOW.Get().length) goto Bailout(k, to);
-      const value: JSAny = fastOW.LoadElementNoHole(k) otherwise continue;
-      const result: JSAny =
-          Call(context, callbackfn, thisArg, value, k, fastOW.Get());
-      if (ToBoolean(result)) {
-        try {
-          // Since the call to {callbackfn} is observable, we can't
-          // use the Bailout label until we've successfully stored.
-          // Hence the {SlowStore} label.
-          fastOutputW.Recheck() otherwise SlowStore;
-          if (fastOutputW.Get().length != to) goto SlowStore;
-          fastOutputW.Push(value) otherwise SlowStore;
-        }
-        label SlowStore {
-          FastCreateDataProperty(fastOutputW.stable, to, value);
-        }
-        to = to + 1;
+transitioning macro FastArrayFilter(implicit context: Context)(
+    fastO: FastJSArray, len: Smi, callbackfn: Callable, thisArg: JSAny,
+    output: FastJSArray) labels
+Bailout(Number, Number) {
+  let k: Smi = 0;
+  let to: Smi = 0;
+  let fastOW = NewFastJSArrayWitness(fastO);
+  let fastOutputW = NewFastJSArrayWitness(output);
+
+  fastOutputW.EnsureArrayPushable() otherwise goto Bailout(k, to);
+
+  // Build a fast loop over the array.
+  for (; k < len; k++) {
+    fastOW.Recheck() otherwise goto Bailout(k, to);
+
+    // Ensure that we haven't walked beyond a possibly updated length.
+    if (k >= fastOW.Get().length) goto Bailout(k, to);
+    const value: JSAny = fastOW.LoadElementNoHole(k) otherwise continue;
+    const result: JSAny =
+        Call(context, callbackfn, thisArg, value, k, fastOW.Get());
+    if (ToBoolean(result)) {
+      try {
+        // Since the call to {callbackfn} is observable, we can't
+        // use the Bailout label until we've successfully stored.
+        // Hence the {SlowStore} label.
+        fastOutputW.Recheck() otherwise SlowStore;
+        if (fastOutputW.Get().length != to) goto SlowStore;
+        fastOutputW.Push(value) otherwise SlowStore;
+      } label SlowStore {
+        FastCreateDataProperty(fastOutputW.stable, to, value);
       }
+      to = to + 1;
     }
   }
+}
 
-  // This method creates a 0-length array with the ElementsKind of the
-  // receiver if possible, otherwise, bails out. It makes sense for the
-  // caller to know that the slow case needs to be invoked.
-  macro FastFilterSpeciesCreate(implicit context: Context)(
-      receiver: JSReceiver): JSReceiver labels Slow {
-    const len: Smi = 0;
-    if (IsArraySpeciesProtectorCellInvalid()) goto Slow;
-    const o = Cast<FastJSArray>(receiver) otherwise Slow;
-    const newMap: Map =
-        LoadJSArrayElementsMap(o.map.elements_kind, LoadNativeContext(context));
-    return AllocateJSArray(ElementsKind::PACKED_SMI_ELEMENTS, newMap, len, len);
-  }
+// This method creates a 0-length array with the ElementsKind of the
+// receiver if possible, otherwise, bails out. It makes sense for the
+// caller to know that the slow case needs to be invoked.
+macro FastFilterSpeciesCreate(implicit context: Context)(receiver: JSReceiver):
+    JSReceiver labels Slow {
+  const len: Smi = 0;
+  if (IsArraySpeciesProtectorCellInvalid()) goto Slow;
+  const o = Cast<FastJSArray>(receiver) otherwise Slow;
+  const newMap: Map =
+      LoadJSArrayElementsMap(o.map.elements_kind, LoadNativeContext(context));
+  return AllocateJSArray(ElementsKind::PACKED_SMI_ELEMENTS, newMap, len, len);
+}
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.filter
-  transitioning javascript builtin
-  ArrayFilter(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSAny {
-    try {
-      RequireObjectCoercible(receiver, 'Array.prototype.filter');
+// https://tc39.github.io/ecma262/#sec-array.prototype.filter
+transitioning javascript builtin
+ArrayFilter(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  try {
+    RequireObjectCoercible(receiver, 'Array.prototype.filter');
 
-      // 1. Let O be ? ToObject(this value).
-      const o: JSReceiver = ToObject_Inline(context, receiver);
+    // 1. Let O be ? ToObject(this value).
+    const o: JSReceiver = ToObject_Inline(context, receiver);
 
-      // 2. Let len be ? ToLength(? Get(O, "length")).
-      const len: Number = GetLengthProperty(o);
+    // 2. Let len be ? ToLength(? Get(O, "length")).
+    const len: Number = GetLengthProperty(o);
 
-      // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
-      if (arguments.length == 0) {
-        goto TypeError;
-      }
-      const callbackfn = Cast<Callable>(arguments[0]) otherwise TypeError;
+    // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
+    if (arguments.length == 0) {
+      goto TypeError;
+    }
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise TypeError;
 
-      // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
-      let output: JSReceiver;
+    // 4. If thisArg is present, let T be thisArg; else let T be undefined.
+    const thisArg: JSAny = arguments[1];
+    let output: JSReceiver;
+
+    // Special cases.
+    let k: Number = 0;
+    let to: Number = 0;
+    try {
+      output = FastFilterSpeciesCreate(o) otherwise SlowSpeciesCreate;
 
-      // Special cases.
-      let k: Number = 0;
-      let to: Number = 0;
       try {
-        output = FastFilterSpeciesCreate(o) otherwise SlowSpeciesCreate;
-
-        try {
-          const smiLen: Smi = Cast<Smi>(len) otherwise goto Bailout(k, to);
-          const fastOutput =
-              Cast<FastJSArray>(output) otherwise goto Bailout(k, to);
-          const fastO = Cast<FastJSArray>(o) otherwise goto Bailout(k, to);
-
-          FastArrayFilter(fastO, smiLen, callbackfn, thisArg, fastOutput)
-              otherwise Bailout;
-          return output;
-        }
-        label Bailout(kValue: Number, toValue: Number) deferred {
-          k = kValue;
-          to = toValue;
-        }
-      }
-      label SlowSpeciesCreate {
-        output = ArraySpeciesCreate(context, receiver, 0);
+        const smiLen: Smi = Cast<Smi>(len) otherwise goto Bailout(k, to);
+        const fastOutput =
+            Cast<FastJSArray>(output) otherwise goto Bailout(k, to);
+        const fastO = Cast<FastJSArray>(o) otherwise goto Bailout(k, to);
+
+        FastArrayFilter(fastO, smiLen, callbackfn, thisArg, fastOutput)
+            otherwise Bailout;
+        return output;
+      } label Bailout(kValue: Number, toValue: Number) deferred {
+        k = kValue;
+        to = toValue;
       }
-
-      return ArrayFilterLoopContinuation(
-          o, callbackfn, thisArg, output, o, k, len, to);
-    }
-    label TypeError deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+    } label SlowSpeciesCreate {
+      output = ArraySpeciesCreate(context, receiver, 0);
     }
+
+    return ArrayFilterLoopContinuation(
+        o, callbackfn, thisArg, output, o, k, len, to);
+  } label TypeError deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
   }
 }
+}
diff --git a/deps/v8/src/builtins/array-find.tq b/deps/v8/src/builtins/array-find.tq
index cd3ec45e98e..9b53f9c7000 100644
--- a/deps/v8/src/builtins/array-find.tq
+++ b/deps/v8/src/builtins/array-find.tq
@@ -3,152 +3,149 @@
 // found in the LICENSE file.
 
 namespace array {
-  transitioning javascript builtin
-  ArrayFindLoopEagerDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
-    // All continuation points in the optimized find implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    //
-    // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires JSAny type for all parameters
-    // other than {context}.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    return ArrayFindLoopContinuation(
-        jsreceiver, callbackfn, thisArg, jsreceiver, numberK, numberLength);
-  }
+transitioning javascript builtin
+ArrayFindLoopEagerDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
+  // All continuation points in the optimized find implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  //
+  // Also, this great mass of casts is necessary because the signature
+  // of Torque javascript builtins requires JSAny type for all parameters
+  // other than {context}.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  return ArrayFindLoopContinuation(
+      jsreceiver, callbackfn, thisArg, jsreceiver, numberK, numberLength);
+}
+
+transitioning javascript builtin
+ArrayFindLoopLazyDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    _callback: JSAny, _thisArg: JSAny, _initialK: JSAny, _length: JSAny,
+    _result: JSAny): JSAny {
+  // This deopt continuation point is never actually called, it just
+  // exists to make stack traces correct from a ThrowTypeError if the
+  // callback was found to be non-callable.
+  unreachable;
+}
 
-  transitioning javascript builtin
-  ArrayFindLoopLazyDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      _callback: JSAny, _thisArg: JSAny, _initialK: JSAny, _length: JSAny,
-      _result: JSAny): JSAny {
-    // This deopt continuation point is never actually called, it just
-    // exists to make stack traces correct from a ThrowTypeError if the
-    // callback was found to be non-callable.
-    unreachable;
+// Continuation that is called after a lazy deoptimization from TF that
+// happens right after the callback and it's returned value must be handled
+// before iteration continues.
+transitioning javascript builtin
+ArrayFindLoopAfterCallbackLazyDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
+    foundValue: JSAny, isFound: JSAny): JSAny {
+  // All continuation points in the optimized find implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  // This custom lazy deopt point is right after the callback. find() needs
+  // to pick up at the next step, which is returning the element if the
+  // callback value is truthy.  Otherwise, continue the search by calling the
+  // continuation.
+
+  if (ToBoolean(isFound)) {
+    return foundValue;
   }
 
-  // Continuation that is called after a lazy deoptimization from TF that
-  // happens right after the callback and it's returned value must be handled
-  // before iteration continues.
-  transitioning javascript builtin
-  ArrayFindLoopAfterCallbackLazyDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
-      foundValue: JSAny, isFound: JSAny): JSAny {
-    // All continuation points in the optimized find implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    // This custom lazy deopt point is right after the callback. find() needs
-    // to pick up at the next step, which is returning the element if the
-    // callback value is truthy.  Otherwise, continue the search by calling the
-    // continuation.
-
-    if (ToBoolean(isFound)) {
-      return foundValue;
+  return ArrayFindLoopContinuation(
+      jsreceiver, callbackfn, thisArg, jsreceiver, numberK, numberLength);
+}
+
+transitioning builtin ArrayFindLoopContinuation(implicit context: Context)(
+    _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny, o: JSReceiver,
+    initialK: Number, length: Number): JSAny {
+  // 5. Let k be 0.
+  // 6. Repeat, while k < len
+  for (let k: Number = initialK; k < length; k++) {
+    // 6a. Let Pk be ! ToString(k).
+    // k is guaranteed to be a positive integer, hence ToString is
+    // side-effect free and HasProperty/GetProperty do the conversion inline.
+
+    // 6b. i. Let kValue be ? Get(O, Pk).
+    const value: JSAny = GetProperty(o, k);
+
+    // 6c. Let testResult be ToBoolean(? Call(predicate, T, <<kValue, k,
+    // O>>)).
+    const testResult: JSAny = Call(context, callbackfn, thisArg, value, k, o);
+
+    // 6d. If testResult is true, return kValue.
+    if (ToBoolean(testResult)) {
+      return value;
     }
 
-    return ArrayFindLoopContinuation(
-        jsreceiver, callbackfn, thisArg, jsreceiver, numberK, numberLength);
+    // 6e. Increase k by 1. (done by the loop).
   }
+  return Undefined;
+}
 
-  transitioning builtin ArrayFindLoopContinuation(implicit context: Context)(
-      _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
-      o: JSReceiver, initialK: Number, length: Number): JSAny {
-    // 5. Let k be 0.
-    // 6. Repeat, while k < len
-    for (let k: Number = initialK; k < length; k++) {
-      // 6a. Let Pk be ! ToString(k).
-      // k is guaranteed to be a positive integer, hence ToString is
-      // side-effect free and HasProperty/GetProperty do the conversion inline.
-
-      // 6b. i. Let kValue be ? Get(O, Pk).
-      const value: JSAny = GetProperty(o, k);
-
-      // 6c. Let testResult be ToBoolean(? Call(predicate, T, <<kValue, k,
-      // O>>)).
-      const testResult: JSAny = Call(context, callbackfn, thisArg, value, k, o);
-
-      // 6d. If testResult is true, return kValue.
-      if (ToBoolean(testResult)) {
-        return value;
-      }
-
-      // 6e. Increase k by 1. (done by the loop).
+transitioning macro FastArrayFind(implicit context: Context)(
+    o: JSReceiver, len: Number, callbackfn: Callable, thisArg: JSAny): JSAny
+    labels Bailout(Smi) {
+  let k: Smi = 0;
+  const smiLen = Cast<Smi>(len) otherwise goto Bailout(k);
+  const fastO = Cast<FastJSArray>(o) otherwise goto Bailout(k);
+  let fastOW = NewFastJSArrayWitness(fastO);
+
+  // Build a fast loop over the smi array.
+  for (; k < smiLen; k++) {
+    fastOW.Recheck() otherwise goto Bailout(k);
+
+    // Ensure that we haven't walked beyond a possibly updated length.
+    if (k >= fastOW.Get().length) goto Bailout(k);
+
+    const value: JSAny = fastOW.LoadElementOrUndefined(k);
+    const testResult: JSAny =
+        Call(context, callbackfn, thisArg, value, k, fastOW.Get());
+    if (ToBoolean(testResult)) {
+      return value;
     }
-    return Undefined;
   }
+  return Undefined;
+}
 
-  transitioning macro FastArrayFind(implicit context: Context)(
-      o: JSReceiver, len: Number, callbackfn: Callable, thisArg: JSAny): JSAny
-      labels Bailout(Smi) {
-    let k: Smi = 0;
-    const smiLen = Cast<Smi>(len) otherwise goto Bailout(k);
-    const fastO = Cast<FastJSArray>(o) otherwise goto Bailout(k);
-    let fastOW = NewFastJSArrayWitness(fastO);
-
-    // Build a fast loop over the smi array.
-    for (; k < smiLen; k++) {
-      fastOW.Recheck() otherwise goto Bailout(k);
-
-      // Ensure that we haven't walked beyond a possibly updated length.
-      if (k >= fastOW.Get().length) goto Bailout(k);
-
-      const value: JSAny = fastOW.LoadElementOrUndefined(k);
-      const testResult: JSAny =
-          Call(context, callbackfn, thisArg, value, k, fastOW.Get());
-      if (ToBoolean(testResult)) {
-        return value;
-      }
+// https://tc39.github.io/ecma262/#sec-array.prototype.find
+transitioning javascript builtin
+ArrayPrototypeFind(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  try {
+    RequireObjectCoercible(receiver, 'Array.prototype.find');
+
+    // 1. Let O be ? ToObject(this value).
+    const o: JSReceiver = ToObject_Inline(context, receiver);
+
+    // 2. Let len be ? ToLength(? Get(O, "length")).
+    const len: Number = GetLengthProperty(o);
+
+    // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
+    if (arguments.length == 0) {
+      goto NotCallableError;
     }
-    return Undefined;
-  }
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallableError;
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.find
-  transitioning javascript builtin
-  ArrayPrototypeFind(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSAny {
+    // 4. If thisArg is present, let T be thisArg; else let T be undefined.
+    const thisArg: JSAny = arguments[1];
+
+    // Special cases.
     try {
-      RequireObjectCoercible(receiver, 'Array.prototype.find');
-
-      // 1. Let O be ? ToObject(this value).
-      const o: JSReceiver = ToObject_Inline(context, receiver);
-
-      // 2. Let len be ? ToLength(? Get(O, "length")).
-      const len: Number = GetLengthProperty(o);
-
-      // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
-      if (arguments.length == 0) {
-        goto NotCallableError;
-      }
-      const callbackfn =
-          Cast<Callable>(arguments[0]) otherwise NotCallableError;
-
-      // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
-
-      // Special cases.
-      try {
-        return FastArrayFind(o, len, callbackfn, thisArg)
-            otherwise Bailout;
-      }
-      label Bailout(k: Smi) deferred {
-        return ArrayFindLoopContinuation(o, callbackfn, thisArg, o, k, len);
-      }
-    }
-    label NotCallableError deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+      return FastArrayFind(o, len, callbackfn, thisArg)
+          otherwise Bailout;
+    } label Bailout(k: Smi) deferred {
+      return ArrayFindLoopContinuation(o, callbackfn, thisArg, o, k, len);
     }
+  } label NotCallableError deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
   }
 }
+}
diff --git a/deps/v8/src/builtins/array-findindex.tq b/deps/v8/src/builtins/array-findindex.tq
index 05a26406466..ed70a122594 100644
--- a/deps/v8/src/builtins/array-findindex.tq
+++ b/deps/v8/src/builtins/array-findindex.tq
@@ -3,154 +3,149 @@
 // found in the LICENSE file.
 
 namespace array {
-  transitioning javascript builtin
-  ArrayFindIndexLoopEagerDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
-    // All continuation points in the optimized findIndex implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    //
-    // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires JSAny type for all parameters
-    // other than {context}.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    return ArrayFindIndexLoopContinuation(
-        jsreceiver, callbackfn, thisArg, jsreceiver, numberK, numberLength);
-  }
+transitioning javascript builtin
+ArrayFindIndexLoopEagerDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
+  // All continuation points in the optimized findIndex implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  //
+  // Also, this great mass of casts is necessary because the signature
+  // of Torque javascript builtins requires JSAny type for all parameters
+  // other than {context}.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  return ArrayFindIndexLoopContinuation(
+      jsreceiver, callbackfn, thisArg, jsreceiver, numberK, numberLength);
+}
+
+transitioning javascript builtin
+ArrayFindIndexLoopLazyDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    _callback: JSAny, _thisArg: JSAny, _initialK: JSAny, _length: JSAny,
+    _result: JSAny): JSAny {
+  // This deopt continuation point is never actually called, it just
+  // exists to make stack traces correct from a ThrowTypeError if the
+  // callback was found to be non-callable.
+  unreachable;
+}
 
-  transitioning javascript builtin
-  ArrayFindIndexLoopLazyDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      _callback: JSAny, _thisArg: JSAny, _initialK: JSAny, _length: JSAny,
-      _result: JSAny): JSAny {
-    // This deopt continuation point is never actually called, it just
-    // exists to make stack traces correct from a ThrowTypeError if the
-    // callback was found to be non-callable.
-    unreachable;
+// Continuation that is called after a lazy deoptimization from TF that
+// happens right after the callback and it's returned value must be handled
+// before iteration continues.
+transitioning javascript builtin
+ArrayFindIndexLoopAfterCallbackLazyDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
+    foundValue: JSAny, isFound: JSAny): JSAny {
+  // All continuation points in the optimized findIndex implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  // This custom lazy deopt point is right after the callback. find() needs
+  // to pick up at the next step, which is returning the element if the
+  // callback value is truthy.  Otherwise, continue the search by calling the
+  // continuation.
+
+  if (ToBoolean(isFound)) {
+    return foundValue;
   }
 
-  // Continuation that is called after a lazy deoptimization from TF that
-  // happens right after the callback and it's returned value must be handled
-  // before iteration continues.
-  transitioning javascript builtin
-  ArrayFindIndexLoopAfterCallbackLazyDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
-      foundValue: JSAny, isFound: JSAny): JSAny {
-    // All continuation points in the optimized findIndex implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    // This custom lazy deopt point is right after the callback. find() needs
-    // to pick up at the next step, which is returning the element if the
-    // callback value is truthy.  Otherwise, continue the search by calling the
-    // continuation.
-
-    if (ToBoolean(isFound)) {
-      return foundValue;
+  return ArrayFindIndexLoopContinuation(
+      jsreceiver, callbackfn, thisArg, jsreceiver, numberK, numberLength);
+}
+
+transitioning builtin ArrayFindIndexLoopContinuation(implicit context: Context)(
+    _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny, o: JSReceiver,
+    initialK: Number, length: Number): Number {
+  // 5. Let k be 0.
+  // 6. Repeat, while k < len
+  for (let k: Number = initialK; k < length; k++) {
+    // 6a. Let Pk be ! ToString(k).
+    // k is guaranteed to be a positive integer, hence ToString is
+    // side-effect free and HasProperty/GetProperty do the conversion inline.
+
+    // 6b. i. Let kValue be ? Get(O, Pk).
+    const value: JSAny = GetProperty(o, k);
+
+    // 6c. Let testResult be ToBoolean(? Call(predicate, T, <<kValue, k,
+    // O>>)).
+    const testResult: JSAny = Call(context, callbackfn, thisArg, value, k, o);
+
+    // 6d. If testResult is true, return k.
+    if (ToBoolean(testResult)) {
+      return k;
     }
 
-    return ArrayFindIndexLoopContinuation(
-        jsreceiver, callbackfn, thisArg, jsreceiver, numberK, numberLength);
+    // 6e. Increase k by 1. (done by the loop).
   }
+  return Convert<Smi>(-1);
+}
 
-  transitioning builtin ArrayFindIndexLoopContinuation(implicit context:
-                                                           Context)(
-      _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
-      o: JSReceiver, initialK: Number, length: Number): Number {
-    // 5. Let k be 0.
-    // 6. Repeat, while k < len
-    for (let k: Number = initialK; k < length; k++) {
-      // 6a. Let Pk be ! ToString(k).
-      // k is guaranteed to be a positive integer, hence ToString is
-      // side-effect free and HasProperty/GetProperty do the conversion inline.
-
-      // 6b. i. Let kValue be ? Get(O, Pk).
-      const value: JSAny = GetProperty(o, k);
-
-      // 6c. Let testResult be ToBoolean(? Call(predicate, T, <<kValue, k,
-      // O>>)).
-      const testResult: JSAny = Call(context, callbackfn, thisArg, value, k, o);
-
-      // 6d. If testResult is true, return k.
-      if (ToBoolean(testResult)) {
-        return k;
-      }
-
-      // 6e. Increase k by 1. (done by the loop).
+transitioning macro FastArrayFindIndex(implicit context: Context)(
+    o: JSReceiver, len: Number, callbackfn: Callable, thisArg: JSAny): Number
+    labels Bailout(Smi) {
+  let k: Smi = 0;
+  const smiLen = Cast<Smi>(len) otherwise goto Bailout(k);
+  const fastO = Cast<FastJSArray>(o) otherwise goto Bailout(k);
+  let fastOW = NewFastJSArrayWitness(fastO);
+
+  // Build a fast loop over the smi array.
+  for (; k < smiLen; k++) {
+    fastOW.Recheck() otherwise goto Bailout(k);
+
+    // Ensure that we haven't walked beyond a possibly updated length.
+    if (k >= fastOW.Get().length) goto Bailout(k);
+
+    const value: JSAny = fastOW.LoadElementOrUndefined(k);
+    const testResult: JSAny =
+        Call(context, callbackfn, thisArg, value, k, fastOW.Get());
+    if (ToBoolean(testResult)) {
+      return k;
     }
-    return Convert<Smi>(-1);
   }
+  return -1;
+}
 
-  transitioning macro FastArrayFindIndex(implicit context: Context)(
-      o: JSReceiver, len: Number, callbackfn: Callable, thisArg: JSAny): Number
-      labels Bailout(Smi) {
-    let k: Smi = 0;
-    const smiLen = Cast<Smi>(len) otherwise goto Bailout(k);
-    const fastO = Cast<FastJSArray>(o) otherwise goto Bailout(k);
-    let fastOW = NewFastJSArrayWitness(fastO);
-
-    // Build a fast loop over the smi array.
-    for (; k < smiLen; k++) {
-      fastOW.Recheck() otherwise goto Bailout(k);
-
-      // Ensure that we haven't walked beyond a possibly updated length.
-      if (k >= fastOW.Get().length) goto Bailout(k);
-
-      const value: JSAny = fastOW.LoadElementOrUndefined(k);
-      const testResult: JSAny =
-          Call(context, callbackfn, thisArg, value, k, fastOW.Get());
-      if (ToBoolean(testResult)) {
-        return k;
-      }
+// https://tc39.github.io/ecma262/#sec-array.prototype.findIndex
+transitioning javascript builtin
+ArrayPrototypeFindIndex(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  try {
+    RequireObjectCoercible(receiver, 'Array.prototype.findIndex');
+
+    // 1. Let O be ? ToObject(this value).
+    const o: JSReceiver = ToObject_Inline(context, receiver);
+
+    // 2. Let len be ? ToLength(? Get(O, "length")).
+    const len: Number = GetLengthProperty(o);
+
+    // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
+    if (arguments.length == 0) {
+      goto NotCallableError;
     }
-    return -1;
-  }
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallableError;
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.findIndex
-  transitioning javascript builtin
-  ArrayPrototypeFindIndex(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSAny {
+    // 4. If thisArg is present, let T be thisArg; else let T be undefined.
+    const thisArg: JSAny = arguments[1];
+
+    // Special cases.
     try {
-      RequireObjectCoercible(receiver, 'Array.prototype.findIndex');
-
-      // 1. Let O be ? ToObject(this value).
-      const o: JSReceiver = ToObject_Inline(context, receiver);
-
-      // 2. Let len be ? ToLength(? Get(O, "length")).
-      const len: Number = GetLengthProperty(o);
-
-      // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
-      if (arguments.length == 0) {
-        goto NotCallableError;
-      }
-      const callbackfn =
-          Cast<Callable>(arguments[0]) otherwise NotCallableError;
-
-      // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
-
-      // Special cases.
-      try {
-        return FastArrayFindIndex(o, len, callbackfn, thisArg)
-            otherwise Bailout;
-      }
-      label Bailout(k: Smi) deferred {
-        return ArrayFindIndexLoopContinuation(
-            o, callbackfn, thisArg, o, k, len);
-      }
-    }
-    label NotCallableError deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+      return FastArrayFindIndex(o, len, callbackfn, thisArg)
+          otherwise Bailout;
+    } label Bailout(k: Smi) deferred {
+      return ArrayFindIndexLoopContinuation(o, callbackfn, thisArg, o, k, len);
     }
+  } label NotCallableError deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
   }
 }
+}
diff --git a/deps/v8/src/builtins/array-foreach.tq b/deps/v8/src/builtins/array-foreach.tq
index b30c8533e69..938210dcdc3 100644
--- a/deps/v8/src/builtins/array-foreach.tq
+++ b/deps/v8/src/builtins/array-foreach.tq
@@ -3,129 +3,126 @@
 // found in the LICENSE file.
 
 namespace array {
-  transitioning javascript builtin
-  ArrayForEachLoopEagerDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
-    // All continuation points in the optimized forEach implemntation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
+transitioning javascript builtin
+ArrayForEachLoopEagerDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
+  // All continuation points in the optimized forEach implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  return ArrayForEachLoopContinuation(
+      jsreceiver, callbackfn, thisArg, Undefined, jsreceiver, numberK,
+      numberLength, Undefined);
+}
 
-    return ArrayForEachLoopContinuation(
-        jsreceiver, callbackfn, thisArg, Undefined, jsreceiver, numberK,
-        numberLength, Undefined);
-  }
+transitioning javascript builtin
+ArrayForEachLoopLazyDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
+    _result: JSAny): JSAny {
+  // All continuation points in the optimized forEach implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  return ArrayForEachLoopContinuation(
+      jsreceiver, callbackfn, thisArg, Undefined, jsreceiver, numberK,
+      numberLength, Undefined);
+}
 
-  transitioning javascript builtin
-  ArrayForEachLoopLazyDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
-      _result: JSAny): JSAny {
-    // All continuation points in the optimized forEach implemntation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
+transitioning builtin ArrayForEachLoopContinuation(implicit context: Context)(
+    _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny, _array: JSAny,
+    o: JSReceiver, initialK: Number, len: Number, _to: JSAny): JSAny {
+  // variables {array} and {to} are ignored.
 
-    return ArrayForEachLoopContinuation(
-        jsreceiver, callbackfn, thisArg, Undefined, jsreceiver, numberK,
-        numberLength, Undefined);
-  }
+  // 5. Let k be 0.
+  // 6. Repeat, while k < len
+  for (let k: Number = initialK; k < len; k = k + 1) {
+    // 6a. Let Pk be ! ToString(k).
+    // k is guaranteed to be a positive integer, hence ToString is
+    // side-effect free and HasProperty/GetProperty do the conversion inline.
 
-  transitioning builtin ArrayForEachLoopContinuation(implicit context: Context)(
-      _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
-      _array: JSAny, o: JSReceiver, initialK: Number, len: Number,
-      _to: JSAny): JSAny {
-    // variables {array} and {to} are ignored.
+    // 6b. Let kPresent be ? HasProperty(O, Pk).
+    const kPresent: Boolean = HasProperty_Inline(o, k);
 
-    // 5. Let k be 0.
-    // 6. Repeat, while k < len
-    for (let k: Number = initialK; k < len; k = k + 1) {
-      // 6a. Let Pk be ! ToString(k).
-      // k is guaranteed to be a positive integer, hence ToString is
-      // side-effect free and HasProperty/GetProperty do the conversion inline.
+    // 6c. If kPresent is true, then
+    if (kPresent == True) {
+      // 6c. i. Let kValue be ? Get(O, Pk).
+      const kValue: JSAny = GetProperty(o, k);
 
-      // 6b. Let kPresent be ? HasProperty(O, Pk).
-      const kPresent: Boolean = HasProperty_Inline(o, k);
-
-      // 6c. If kPresent is true, then
-      if (kPresent == True) {
-        // 6c. i. Let kValue be ? Get(O, Pk).
-        const kValue: JSAny = GetProperty(o, k);
+      // 6c. ii. Perform ? Call(callbackfn, T, <kValue, k, O>).
+      Call(context, callbackfn, thisArg, kValue, k, o);
+    }
 
-        // 6c. ii. Perform ? Call(callbackfn, T, <kValue, k, O>).
-        Call(context, callbackfn, thisArg, kValue, k, o);
-      }
+    // 6d. Increase k by 1. (done by the loop).
+  }
+  return Undefined;
+}
 
-      // 6d. Increase k by 1. (done by the loop).
-    }
-    return Undefined;
+transitioning macro FastArrayForEach(implicit context: Context)(
+    o: JSReceiver, len: Number, callbackfn: Callable, thisArg: JSAny): JSAny
+    labels Bailout(Smi) {
+  let k: Smi = 0;
+  const smiLen = Cast<Smi>(len) otherwise goto Bailout(k);
+  const fastO = Cast<FastJSArray>(o) otherwise goto Bailout(k);
+  let fastOW = NewFastJSArrayWitness(fastO);
+
+  // Build a fast loop over the smi array.
+  for (; k < smiLen; k++) {
+    fastOW.Recheck() otherwise goto Bailout(k);
+
+    // Ensure that we haven't walked beyond a possibly updated length.
+    if (k >= fastOW.Get().length) goto Bailout(k);
+    const value: JSAny = fastOW.LoadElementNoHole(k)
+        otherwise continue;
+    Call(context, callbackfn, thisArg, value, k, fastOW.Get());
   }
+  return Undefined;
+}
+
+// https://tc39.github.io/ecma262/#sec-array.prototype.foreach
+transitioning javascript builtin
+ArrayForEach(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  try {
+    RequireObjectCoercible(receiver, 'Array.prototype.forEach');
+
+    // 1. Let O be ? ToObject(this value).
+    const o: JSReceiver = ToObject_Inline(context, receiver);
 
-  transitioning macro FastArrayForEach(implicit context: Context)(
-      o: JSReceiver, len: Number, callbackfn: Callable, thisArg: JSAny): JSAny
-      labels Bailout(Smi) {
-    let k: Smi = 0;
-    const smiLen = Cast<Smi>(len) otherwise goto Bailout(k);
-    const fastO = Cast<FastJSArray>(o) otherwise goto Bailout(k);
-    let fastOW = NewFastJSArrayWitness(fastO);
-
-    // Build a fast loop over the smi array.
-    for (; k < smiLen; k++) {
-      fastOW.Recheck() otherwise goto Bailout(k);
-
-      // Ensure that we haven't walked beyond a possibly updated length.
-      if (k >= fastOW.Get().length) goto Bailout(k);
-      const value: JSAny = fastOW.LoadElementNoHole(k)
-          otherwise continue;
-      Call(context, callbackfn, thisArg, value, k, fastOW.Get());
+    // 2. Let len be ? ToLength(? Get(O, "length")).
+    const len: Number = GetLengthProperty(o);
+
+    // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
+    if (arguments.length == 0) {
+      goto TypeError;
     }
-    return Undefined;
-  }
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise TypeError;
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.foreach
-  transitioning javascript builtin
-  ArrayForEach(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSAny {
+    // 4. If thisArg is present, let T be thisArg; else let T be undefined.
+    const thisArg: JSAny = arguments[1];
+
+    // Special cases.
+    let k: Number = 0;
     try {
-      RequireObjectCoercible(receiver, 'Array.prototype.forEach');
-
-      // 1. Let O be ? ToObject(this value).
-      const o: JSReceiver = ToObject_Inline(context, receiver);
-
-      // 2. Let len be ? ToLength(? Get(O, "length")).
-      const len: Number = GetLengthProperty(o);
-
-      // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
-      if (arguments.length == 0) {
-        goto TypeError;
-      }
-      const callbackfn = Cast<Callable>(arguments[0]) otherwise TypeError;
-
-      // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
-
-      // Special cases.
-      let k: Number = 0;
-      try {
-        return FastArrayForEach(o, len, callbackfn, thisArg)
-            otherwise Bailout;
-      }
-      label Bailout(kValue: Smi) deferred {
-        k = kValue;
-      }
-
-      return ArrayForEachLoopContinuation(
-          o, callbackfn, thisArg, Undefined, o, k, len, Undefined);
-    }
-    label TypeError deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+      return FastArrayForEach(o, len, callbackfn, thisArg)
+          otherwise Bailout;
+    } label Bailout(kValue: Smi) deferred {
+      k = kValue;
     }
+
+    return ArrayForEachLoopContinuation(
+        o, callbackfn, thisArg, Undefined, o, k, len, Undefined);
+  } label TypeError deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
   }
 }
+}
diff --git a/deps/v8/src/builtins/array-from.tq b/deps/v8/src/builtins/array-from.tq
index 6eb3b006935..e51d37fef2c 100644
--- a/deps/v8/src/builtins/array-from.tq
+++ b/deps/v8/src/builtins/array-from.tq
@@ -3,182 +3,181 @@
 // found in the LICENSE file.
 
 namespace array {
-  // Array.from( items [, mapfn [, thisArg ] ] )
-  // ES #sec-array.from
-  transitioning javascript builtin
-  ArrayFrom(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
-      JSReceiver {
-    // Use fast path if:
-    // * |items| is the only argument, and
-    // * the receiver is the Array function.
-    if (arguments.length == 1 && receiver == GetArrayFunction()) {
-      try {
-        return iterator::FastIterableToList(arguments[0]) otherwise Slow;
-      }
-      label Slow {
-        // fall through
-      }
+// Array.from( items [, mapfn [, thisArg ] ] )
+// ES #sec-array.from
+transitioning javascript builtin
+ArrayFrom(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
+    JSReceiver {
+  // Use fast path if:
+  // * |items| is the only argument, and
+  // * the receiver is the Array function.
+  if (arguments.length == 1 && receiver == GetArrayFunction()) {
+    try {
+      return iterator::FastIterableToList(arguments[0]) otherwise Slow;
+    } label Slow {
+      // fall through
     }
+  }
 
-    const items = arguments[0];
-    const mapfn = arguments[1];
-    const thisArg = arguments[2];
-
-    // 1. Let C be the this value.
-    const c = receiver;
-
-    let mapping: bool;
-    // 2. If mapfn is undefined, let mapping be false.
-    if (mapfn == Undefined) {
-      mapping = false;
-    } else {
-      // a. If IsCallable(mapfn) is false, throw a TypeError exception.
-      if (!TaggedIsCallable(mapfn)) deferred {
-          ThrowTypeError(MessageTemplate::kCalledNonCallable, mapfn);
-        }
-      // b. Let mapping be true.
-      mapping = true;
+  const items = arguments[0];
+  const mapfn = arguments[1];
+  const thisArg = arguments[2];
+
+  // 1. Let C be the this value.
+  const c = receiver;
+
+  let mapping: bool;
+  // 2. If mapfn is undefined, let mapping be false.
+  if (mapfn == Undefined) {
+    mapping = false;
+  } else {
+    // a. If IsCallable(mapfn) is false, throw a TypeError exception.
+    if (!Is<Callable>(mapfn)) deferred {
+        ThrowTypeError(MessageTemplate::kCalledNonCallable, mapfn);
+      }
+    // b. Let mapping be true.
+    mapping = true;
+  }
+
+  // 4. Let usingIterator be ? GetMethod(items, @@iterator).
+  // 5. If usingIterator is not undefined, then
+  try {
+    const usingIterator = GetMethod(items, IteratorSymbolConstant())
+        otherwise IteratorIsUndefined, IteratorNotCallable;
+
+    let a: JSReceiver;
+    // a. If IsConstructor(C) is true, then
+    typeswitch (c) {
+      case (c: Constructor): {
+        // i. Let A be ? Construct(C).
+        a = Construct(c);
+      }
+      case (JSAny): {
+        // i. Let A be ? ArrayCreate(0).
+        a = ArrayCreate(0);
+      }
     }
 
-    // 4. Let usingIterator be ? GetMethod(items, @@iterator).
-    // 5. If usingIterator is not undefined, then
-    try {
-      const usingIterator = GetMethod(items, IteratorSymbolConstant())
-          otherwise IteratorIsUndefined, IteratorNotCallable;
-
-      let a: JSReceiver;
-      // a. If IsConstructor(C) is true, then
-      typeswitch (c) {
-        case (c: Constructor): {
-          // i. Let A be ? Construct(C).
-          a = Construct(c);
-        }
-        case (JSAny): {
-          // i. Let A be ? ArrayCreate(0).
-          a = ArrayCreate(0);
-        }
+    // c. Let iteratorRecord be ? GetIterator(items, sync, usingIterator).
+    const iteratorRecord = iterator::GetIterator(items, usingIterator);
+
+    const fastIteratorResultMap = GetIteratorResultMap();
+
+    // d. Let k be 0.
+    let k: Smi = 0;
+    // e. Repeat,
+    while (true) {
+      // i. If k ≥ 2^53-1, then
+      //   1. Let error be ThrowCompletion(a newly created TypeError object).
+      //   2. Return ? IteratorClose(iteratorRecord, error).
+      // The spec requires that we throw an exception if index reaches 2^53-1,
+      // but an empty loop would take >100 days to do this many iterations. To
+      // actually run for that long would require an iterator that never set
+      // done to true and a target array which somehow never ran out of
+      // memory, e.g. a proxy that discarded the values. Ignoring this case
+      // just means we would repeatedly call CreateDataProperty with index =
+      // 2^53
+      assert(k < kMaxSafeInteger);
+
+      // ii. Let Pk be ! ToString(k).
+
+      // iii. Let next be ? IteratorStep(iteratorRecord).
+      let next: JSReceiver;
+      try {
+        next = iterator::IteratorStep(iteratorRecord, fastIteratorResultMap)
+            otherwise NextIsFalse;
+      }
+      // iv. If next is false, then
+      label NextIsFalse {
+        // 1. Perform ? Set(A, "length", k, true).
+        array::SetPropertyLength(a, k);
+        // 2. Return A.
+        return a;
       }
 
-      // c. Let iteratorRecord be ? GetIterator(items, sync, usingIterator).
-      const iteratorRecord = iterator::GetIterator(items, usingIterator);
-
-      const fastIteratorResultMap = GetIteratorResultMap();
-
-      // d. Let k be 0.
-      let k: Smi = 0;
-      // e. Repeat,
-      while (true) {
-        // i. If k ≥ 2^53-1, then
-        //   1. Let error be ThrowCompletion(a newly created TypeError object).
-        //   2. Return ? IteratorClose(iteratorRecord, error).
-        // The spec requires that we throw an exception if index reaches 2^53-1,
-        // but an empty loop would take >100 days to do this many iterations. To
-        // actually run for that long would require an iterator that never set
-        // done to true and a target array which somehow never ran out of
-        // memory, e.g. a proxy that discarded the values. Ignoring this case
-        // just means we would repeatedly call CreateDataProperty with index =
-        // 2^53
-        assert(k < kMaxSafeInteger);
-
-        // ii. Let Pk be ! ToString(k).
-
-        // iii. Let next be ? IteratorStep(iteratorRecord).
-        let next: JSReceiver;
-        try {
-          next = iterator::IteratorStep(iteratorRecord, fastIteratorResultMap)
-              otherwise NextIsFalse;
-        }
-        // iv. If next is false, then
-        label NextIsFalse {
-          // 1. Perform ? Set(A, "length", k, true).
-          array::SetPropertyLength(a, k);
-          // 2. Return A.
-          return a;
-        }
+      // v. Let nextValue be ? IteratorValue(next).
+      const nextValue = iterator::IteratorValue(next, fastIteratorResultMap);
 
-        // v. Let nextValue be ? IteratorValue(next).
-        const nextValue = iterator::IteratorValue(next, fastIteratorResultMap);
-
-        let mappedValue: JSAny;
-        // vi. If mapping is true, then
-        if (mapping) {
-          // 1. Let mappedValue be Call(mapfn, thisArg, « nextValue, k »).
-          // 2. If mappedValue is an abrupt completion,
-          //    return ? IteratorClose(iteratorRecord, mappedValue).
-          // 3. Set mappedValue to mappedValue.[[Value]].
-          try {
-            mappedValue = Call(
-                context, UnsafeCast<Callable>(mapfn), thisArg, nextValue, k);
-          } catch (e) {
-            iterator::IteratorCloseOnException(iteratorRecord, e);
-          }
-        } else {
-          mappedValue = nextValue;
-        }
-        // viii. Let defineStatus be
-        //       CreateDataPropertyOrThrow(A, Pk, mappedValue).
-        // ix. If defineStatus is an abrupt completion,
-        //     return ? IteratorClose(iteratorRecord, defineStatus).
+      let mappedValue: JSAny;
+      // vi. If mapping is true, then
+      if (mapping) {
+        // 1. Let mappedValue be Call(mapfn, thisArg, « nextValue, k »).
+        // 2. If mappedValue is an abrupt completion,
+        //    return ? IteratorClose(iteratorRecord, mappedValue).
+        // 3. Set mappedValue to mappedValue.[[Value]].
         try {
-          FastCreateDataProperty(a, k, mappedValue);
-        } catch (e) deferred {
-          iterator::IteratorCloseOnException(iteratorRecord, e);
+          mappedValue =
+              Call(context, UnsafeCast<Callable>(mapfn), thisArg, nextValue, k);
+        } catch (e) {
+          iterator::IteratorCloseOnException(iteratorRecord);
+          ReThrow(context, e);
         }
-        // x. Set k to k + 1.
-        k += 1;
+      } else {
+        mappedValue = nextValue;
       }
-      unreachable;
+      // viii. Let defineStatus be
+      //       CreateDataPropertyOrThrow(A, Pk, mappedValue).
+      // ix. If defineStatus is an abrupt completion,
+      //     return ? IteratorClose(iteratorRecord, defineStatus).
+      try {
+        FastCreateDataProperty(a, k, mappedValue);
+      } catch (e) deferred {
+        iterator::IteratorCloseOnException(iteratorRecord);
+        ReThrow(context, e);
+      }
+      // x. Set k to k + 1.
+      k += 1;
     }
-    label IteratorIsUndefined {
-      // 6. NOTE: items is not an Iterable so assume it is an array-like object.
-      // 7. Let arrayLike be ! ToObject(items).
-      const arrayLike = ToObject_Inline(context, items);
-      // 8. Let len be ? LengthOfArrayLike(arrayLike).
-      const len = GetLengthProperty(arrayLike);
-
-      let a: JSReceiver;
-      // 9. If IsConstructor(C) is true, then
-      typeswitch (c) {
-        case (c: Constructor): {
-          // a. Let A be ? Construct(C, « len »).
-          a = Construct(c, len);
-        }
-        case (JSAny): {
-          // a. Let A be ? ArrayCreate(len).
-          a = ArrayCreate(len);
-        }
+    unreachable;
+  } label IteratorIsUndefined {
+    // 6. NOTE: items is not an Iterable so assume it is an array-like object.
+    // 7. Let arrayLike be ! ToObject(items).
+    const arrayLike = ToObject_Inline(context, items);
+    // 8. Let len be ? LengthOfArrayLike(arrayLike).
+    const len = GetLengthProperty(arrayLike);
+
+    let a: JSReceiver;
+    // 9. If IsConstructor(C) is true, then
+    typeswitch (c) {
+      case (c: Constructor): {
+        // a. Let A be ? Construct(C, « len »).
+        a = Construct(c, len);
       }
-
-      // 11. Let k be 0.
-      let k: Smi = 0;
-      // 12. Repeat, while k < len
-      while (k < len) {
-        // a. Let Pk be ! ToString(k).
-        // b. Let kValue be ? Get(arrayLike, Pk).
-        const kValue = GetProperty(arrayLike, k);
-        let mappedValue: JSAny;
-        // c. If mapping is true, then
-        if (mapping) {
-          // i. Let mappedValue be ? Call(mapfn, thisArg, « kValue, k »).
-          mappedValue =
-              Call(context, UnsafeCast<Callable>(mapfn), thisArg, kValue, k);
-        } else {
-          // d. Else, let mappedValue be kValue.
-          mappedValue = kValue;
-        }
-        // e. Perform ? CreateDataPropertyOrThrow(A, Pk, mappedValue).
-        FastCreateDataProperty(a, k, mappedValue);
-        // f. Set k to k + 1.
-        k += 1;
+      case (JSAny): {
+        // a. Let A be ? ArrayCreate(len).
+        a = ArrayCreate(len);
       }
-
-      // 13. Perform ? Set(A, "length", len, true).
-      array::SetPropertyLength(a, len);
-      // 14. Return A.
-      return a;
     }
-    label IteratorNotCallable(_value: JSAny) deferred {
-      ThrowTypeError(MessageTemplate::kIteratorSymbolNonCallable);
+
+    // 11. Let k be 0.
+    let k: Smi = 0;
+    // 12. Repeat, while k < len
+    while (k < len) {
+      // a. Let Pk be ! ToString(k).
+      // b. Let kValue be ? Get(arrayLike, Pk).
+      const kValue = GetProperty(arrayLike, k);
+      let mappedValue: JSAny;
+      // c. If mapping is true, then
+      if (mapping) {
+        // i. Let mappedValue be ? Call(mapfn, thisArg, « kValue, k »).
+        mappedValue =
+            Call(context, UnsafeCast<Callable>(mapfn), thisArg, kValue, k);
+      } else {
+        // d. Else, let mappedValue be kValue.
+        mappedValue = kValue;
+      }
+      // e. Perform ? CreateDataPropertyOrThrow(A, Pk, mappedValue).
+      FastCreateDataProperty(a, k, mappedValue);
+      // f. Set k to k + 1.
+      k += 1;
     }
+
+    // 13. Perform ? Set(A, "length", len, true).
+    array::SetPropertyLength(a, len);
+    // 14. Return A.
+    return a;
+  } label IteratorNotCallable(_value: JSAny) deferred {
+    ThrowTypeError(MessageTemplate::kIteratorSymbolNonCallable);
   }
 }
+}
diff --git a/deps/v8/src/builtins/array-isarray.tq b/deps/v8/src/builtins/array-isarray.tq
index 48fca60339d..a88c1579d1a 100644
--- a/deps/v8/src/builtins/array-isarray.tq
+++ b/deps/v8/src/builtins/array-isarray.tq
@@ -3,25 +3,25 @@
 // found in the LICENSE file.
 
 namespace runtime {
-  extern runtime ArrayIsArray(implicit context: Context)(JSAny): JSAny;
+extern runtime ArrayIsArray(implicit context: Context)(JSAny): JSAny;
 }  // namespace runtime
 
 namespace array {
-  // ES #sec-array.isarray
-  javascript builtin ArrayIsArray(js-implicit context:
-                                      NativeContext)(arg: JSAny): JSAny {
-    // 1. Return ? IsArray(arg).
-    typeswitch (arg) {
-      case (JSArray): {
-        return True;
-      }
-      case (JSProxy): {
-        // TODO(verwaest): Handle proxies in-place
-        return runtime::ArrayIsArray(arg);
-      }
-      case (JSAny): {
-        return False;
-      }
+// ES #sec-array.isarray
+javascript builtin ArrayIsArray(js-implicit context: NativeContext)(arg: JSAny):
+    JSAny {
+  // 1. Return ? IsArray(arg).
+  typeswitch (arg) {
+    case (JSArray): {
+      return True;
+    }
+    case (JSProxy): {
+      // TODO(verwaest): Handle proxies in-place
+      return runtime::ArrayIsArray(arg);
+    }
+    case (JSAny): {
+      return False;
     }
   }
+}
 }  // namespace array
diff --git a/deps/v8/src/builtins/array-join.tq b/deps/v8/src/builtins/array-join.tq
index a06365f3354..bc3c8bb9d24 100644
--- a/deps/v8/src/builtins/array-join.tq
+++ b/deps/v8/src/builtins/array-join.tq
@@ -3,646 +3,632 @@
 // found in the LICENSE file.
 
 namespace array {
-  type LoadJoinElementFn = builtin(Context, JSReceiver, uintptr) => JSAny;
+type LoadJoinElementFn = builtin(Context, JSReceiver, uintptr) => JSAny;
 
-  // Fast C call to write a fixed array (see Buffer.fixedArray) to a single
-  // string.
-  extern macro
-  ArrayBuiltinsAssembler::CallJSArrayArrayJoinConcatToSequentialString(
-      FixedArray, intptr, String, String): String;
+// Fast C call to write a fixed array (see Buffer.fixedArray) to a single
+// string.
+extern macro
+ArrayBuiltinsAssembler::CallJSArrayArrayJoinConcatToSequentialString(
+    FixedArray, intptr, String, String): String;
 
-  transitioning builtin LoadJoinElement<T : type extends ElementsKind>(
-      context: Context, receiver: JSReceiver, k: uintptr): JSAny {
+transitioning builtin LoadJoinElement<T : type extends ElementsKind>(
+    context: Context, receiver: JSReceiver, k: uintptr): JSAny {
+  return GetProperty(receiver, Convert<Number>(k));
+}
+
+transitioning LoadJoinElement<array::DictionaryElements>(
+    context: Context, receiver: JSReceiver, k: uintptr): JSAny {
+  const array: JSArray = UnsafeCast<JSArray>(receiver);
+  const dict: NumberDictionary = UnsafeCast<NumberDictionary>(array.elements);
+  try {
+    return BasicLoadNumberDictionaryElement(dict, Signed(k))
+        otherwise IfNoData, IfHole;
+  } label IfNoData deferred {
     return GetProperty(receiver, Convert<Number>(k));
+  } label IfHole {
+    return kEmptyString;
   }
+}
 
-  transitioning LoadJoinElement<array::DictionaryElements>(
-      context: Context, receiver: JSReceiver, k: uintptr): JSAny {
-    const array: JSArray = UnsafeCast<JSArray>(receiver);
-    const dict: NumberDictionary = UnsafeCast<NumberDictionary>(array.elements);
-    try {
-      return BasicLoadNumberDictionaryElement(dict, Signed(k))
-          otherwise IfNoData, IfHole;
-    }
-    label IfNoData deferred {
-      return GetProperty(receiver, Convert<Number>(k));
-    }
-    label IfHole {
-      return kEmptyString;
+LoadJoinElement<array::FastSmiOrObjectElements>(
+    context: Context, receiver: JSReceiver, k: uintptr): JSAny {
+  const array: JSArray = UnsafeCast<JSArray>(receiver);
+  const fixedArray: FixedArray = UnsafeCast<FixedArray>(array.elements);
+  const element: Object = fixedArray.objects[k];
+  return element == TheHole ? kEmptyString : UnsafeCast<JSAny>(element);
+}
+
+LoadJoinElement<array::FastDoubleElements>(
+    context: Context, receiver: JSReceiver, k: uintptr): JSAny {
+  const array: JSArray = UnsafeCast<JSArray>(receiver);
+  const fixedDoubleArray: FixedDoubleArray =
+      UnsafeCast<FixedDoubleArray>(array.elements);
+  const element: float64 =
+      fixedDoubleArray.floats[k].Value() otherwise return kEmptyString;
+  return AllocateHeapNumberWithValue(element);
+}
+
+builtin LoadJoinTypedElement<T : type extends ElementsKind>(
+    context: Context, receiver: JSReceiver, k: uintptr): JSAny {
+  const typedArray: JSTypedArray = UnsafeCast<JSTypedArray>(receiver);
+  assert(!IsDetachedBuffer(typedArray.buffer));
+  return typed_array::LoadFixedTypedArrayElementAsTagged(
+      typedArray.data_ptr, k, typed_array::KindForArrayType<T>());
+}
+
+transitioning builtin ConvertToLocaleString(
+    context: Context, element: JSAny, locales: JSAny, options: JSAny): String {
+  if (IsNullOrUndefined(element)) return kEmptyString;
+
+  const prop: JSAny = GetProperty(element, 'toLocaleString');
+  try {
+    const callable: Callable = Cast<Callable>(prop) otherwise TypeError;
+    let result: JSAny;
+    if (IsNullOrUndefined(locales)) {
+      result = Call(context, callable, element);
+    } else if (IsNullOrUndefined(options)) {
+      result = Call(context, callable, element, locales);
+    } else {
+      result = Call(context, callable, element, locales, options);
     }
+    return ToString_Inline(result);
+  } label TypeError {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, prop);
   }
+}
 
-  LoadJoinElement<array::FastSmiOrObjectElements>(
-      context: Context, receiver: JSReceiver, k: uintptr): JSAny {
-    const array: JSArray = UnsafeCast<JSArray>(receiver);
-    const fixedArray: FixedArray = UnsafeCast<FixedArray>(array.elements);
-    const element: Object = fixedArray.objects[k];
-    return element == TheHole ? kEmptyString : UnsafeCast<JSAny>(element);
-  }
+// Verifies the current element JSArray accessor can still be safely used
+// (see LoadJoinElement<ElementsAccessor>).
+macro CannotUseSameArrayAccessor<T: type>(implicit context: Context)(
+    loadFn: LoadJoinElementFn, receiver: JSReceiver, originalMap: Map,
+    originalLen: Number): bool;
+
+CannotUseSameArrayAccessor<JSArray>(implicit context: Context)(
+    loadFn: LoadJoinElementFn, receiver: JSReceiver, originalMap: Map,
+    originalLen: Number): bool {
+  if (loadFn == LoadJoinElement<array::GenericElementsAccessor>) return false;
+
+  const array: JSArray = UnsafeCast<JSArray>(receiver);
+  if (originalMap != array.map) return true;
+  if (originalLen != array.length) return true;
+  if (IsNoElementsProtectorCellInvalid()) return true;
+  return false;
+}
 
-  LoadJoinElement<array::FastDoubleElements>(
-      context: Context, receiver: JSReceiver, k: uintptr): JSAny {
-    const array: JSArray = UnsafeCast<JSArray>(receiver);
-    const fixedDoubleArray: FixedDoubleArray =
-        UnsafeCast<FixedDoubleArray>(array.elements);
-    const element: float64 =
-        fixedDoubleArray.floats[k].Value() otherwise return kEmptyString;
-    return AllocateHeapNumberWithValue(element);
-  }
+CannotUseSameArrayAccessor<JSTypedArray>(implicit context: Context)(
+    _loadFn: LoadJoinElementFn, receiver: JSReceiver, _initialMap: Map,
+    _initialLen: Number): bool {
+  const typedArray: JSTypedArray = UnsafeCast<JSTypedArray>(receiver);
+  return IsDetachedBuffer(typedArray.buffer);
+}
 
-  builtin LoadJoinTypedElement<T : type extends ElementsKind>(
-      context: Context, receiver: JSReceiver, k: uintptr): JSAny {
-    const typedArray: JSTypedArray = UnsafeCast<JSTypedArray>(receiver);
-    assert(!IsDetachedBuffer(typedArray.buffer));
-    return typed_array::LoadFixedTypedArrayElementAsTagged(
-        typedArray.data_ptr, k, typed_array::KindForArrayType<T>());
+// Calculates the running total length of the resulting string.  If the
+// calculated length exceeds the maximum string length (see
+// String::kMaxLength), throws a range error.
+macro AddStringLength(implicit context: Context)(
+    lenA: intptr, lenB: intptr): intptr {
+  try {
+    const length: intptr = TryIntPtrAdd(lenA, lenB) otherwise IfOverflow;
+    if (length > kStringMaxLength) goto IfOverflow;
+    return length;
+  } label IfOverflow deferred {
+    ThrowInvalidStringLength(context);
   }
+}
 
-  transitioning builtin ConvertToLocaleString(
-      context: Context, element: JSAny, locales: JSAny,
-      options: JSAny): String {
-    if (IsNullOrUndefined(element)) return kEmptyString;
-
-    const prop: JSAny = GetProperty(element, 'toLocaleString');
-    try {
-      const callable: Callable = Cast<Callable>(prop) otherwise TypeError;
-      let result: JSAny;
-      if (IsNullOrUndefined(locales)) {
-        result = Call(context, callable, element);
-      } else if (IsNullOrUndefined(options)) {
-        result = Call(context, callable, element, locales);
-      } else {
-        result = Call(context, callable, element, locales, options);
-      }
-      return ToString_Inline(result);
-    }
-    label TypeError {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, prop);
+// Stores an element to a fixed array and return the fixed array. If the fixed
+// array is not large enough, create and return a new, larger fixed array that
+// contains all previously elements and the new element.
+macro StoreAndGrowFixedArray<T: type>(
+    fixedArray: FixedArray, index: intptr, element: T): FixedArray {
+  const length: intptr = fixedArray.length_intptr;
+  assert(index <= length);
+  if (index < length) {
+    fixedArray.objects[index] = element;
+    return fixedArray;
+  } else
+    deferred {
+      const newLength: intptr = CalculateNewElementsCapacity(length);
+      assert(index < newLength);
+      const newfixedArray: FixedArray =
+          ExtractFixedArray(fixedArray, 0, length, newLength);
+      newfixedArray.objects[index] = element;
+      return newfixedArray;
     }
-  }
+}
 
-  // Verifies the current element JSArray accessor can still be safely used
-  // (see LoadJoinElement<ElementsAccessor>).
-  macro CannotUseSameArrayAccessor<T: type>(implicit context: Context)(
-      loadFn: LoadJoinElementFn, receiver: JSReceiver, originalMap: Map,
-      originalLen: Number): bool;
-
-  CannotUseSameArrayAccessor<JSArray>(implicit context: Context)(
-      loadFn: LoadJoinElementFn, receiver: JSReceiver, originalMap: Map,
-      originalLen: Number): bool {
-    if (loadFn == LoadJoinElement<array::GenericElementsAccessor>) return false;
-
-    const array: JSArray = UnsafeCast<JSArray>(receiver);
-    if (originalMap != array.map) return true;
-    if (originalLen != array.length) return true;
-    if (IsNoElementsProtectorCellInvalid()) return true;
-    return false;
+// Contains the information necessary to create a single, separator delimited,
+// flattened one or two byte string.
+// The buffer is maintained and updated by Buffer.constructor, Buffer.Add(),
+// Buffer.AddSeparators().
+struct Buffer {
+  macro Add(implicit context: Context)(
+      str: String, nofSeparators: intptr, separatorLength: intptr) {
+    // Add separators if necessary (at the beginning or more than one)
+    const writeSeparators: bool = this.index == 0 | nofSeparators > 1;
+    this.AddSeparators(nofSeparators, separatorLength, writeSeparators);
+
+    this.totalStringLength =
+        AddStringLength(this.totalStringLength, str.length_intptr);
+    this.fixedArray =
+        StoreAndGrowFixedArray(this.fixedArray, this.index++, str);
+    this.isOneByte =
+        IsOneByteStringInstanceType(str.instanceType) & this.isOneByte;
   }
 
-  CannotUseSameArrayAccessor<JSTypedArray>(implicit context: Context)(
-      _loadFn: LoadJoinElementFn, receiver: JSReceiver, _initialMap: Map,
-      _initialLen: Number): bool {
-    const typedArray: JSTypedArray = UnsafeCast<JSTypedArray>(receiver);
-    return IsDetachedBuffer(typedArray.buffer);
-  }
+  macro AddSeparators(implicit context: Context)(
+      nofSeparators: intptr, separatorLength: intptr, write: bool) {
+    if (nofSeparators == 0 || separatorLength == 0) return;
 
-  // Calculates the running total length of the resulting string.  If the
-  // calculated length exceeds the maximum string length (see
-  // String::kMaxLength), throws a range error.
-  macro AddStringLength(implicit context: Context)(lenA: intptr, lenB: intptr):
-      intptr {
-    try {
-      const length: intptr = TryIntPtrAdd(lenA, lenB) otherwise IfOverflow;
-      if (length > kStringMaxLength) goto IfOverflow;
-      return length;
-    }
-    label IfOverflow deferred {
-      ThrowInvalidStringLength(context);
-    }
-  }
+    const nofSeparatorsInt: intptr = nofSeparators;
+    const sepsLen: intptr = separatorLength * nofSeparatorsInt;
+    // Detect integer overflow
+    // TODO(tebbi): Replace with overflow-checked multiplication.
+    if (sepsLen / separatorLength != nofSeparatorsInt) deferred {
+        ThrowInvalidStringLength(context);
+      }
 
-  // Stores an element to a fixed array and return the fixed array. If the fixed
-  // array is not large enough, create and return a new, larger fixed array that
-  // contains all previously elements and the new element.
-  macro StoreAndGrowFixedArray<T: type>(
-      fixedArray: FixedArray, index: intptr, element: T): FixedArray {
-    const length: intptr = fixedArray.length_intptr;
-    assert(index <= length);
-    if (index < length) {
-      fixedArray.objects[index] = element;
-      return fixedArray;
-    } else
-      deferred {
-        const newLength: intptr = CalculateNewElementsCapacity(length);
-        assert(index < newLength);
-        const newfixedArray: FixedArray =
-            ExtractFixedArray(fixedArray, 0, length, newLength);
-        newfixedArray.objects[index] = element;
-        return newfixedArray;
+    this.totalStringLength = AddStringLength(this.totalStringLength, sepsLen);
+    if (write) deferred {
+        this.fixedArray = StoreAndGrowFixedArray(
+            this.fixedArray, this.index++, Convert<Smi>(nofSeparatorsInt));
       }
   }
 
-  // Contains the information necessary to create a single, separator delimited,
-  // flattened one or two byte string.
-  // The buffer is maintained and updated by Buffer.constructor, Buffer.Add(),
-  // Buffer.AddSeparators().
-  struct Buffer {
-    macro Add(implicit context: Context)(
-        str: String, nofSeparators: intptr, separatorLength: intptr) {
-      // Add separators if necessary (at the beginning or more than one)
-      const writeSeparators: bool = this.index == 0 | nofSeparators > 1;
-      this.AddSeparators(nofSeparators, separatorLength, writeSeparators);
-
-      this.totalStringLength =
-          AddStringLength(this.totalStringLength, str.length_intptr);
-      this.fixedArray =
-          StoreAndGrowFixedArray(this.fixedArray, this.index++, str);
-      this.isOneByte =
-          IsOneByteStringInstanceType(str.instanceType) & this.isOneByte;
-    }
+  // Fixed array holding elements that are either:
+  //   1) String result of `ToString(next)`.
+  //   2) Smi representing the number of consecutive separators.
+  // `BufferJoin()` will iterate and writes these entries to a flat string.
+  //
+  // To save space, reduce reads and writes, only separators at the beginning,
+  // end, or more than one are written.
+  //
+  // No hole example
+  //   receiver:   ['hello', 'world']
+  //   fixedArray: ['hello', 'world']
+  //
+  // Hole example
+  //   receiver:   [<hole>, 'hello', <hole>, 'world', <hole>]
+  //   fixedArray: [1, 'hello', 2, 'world', 1]
+  fixedArray: FixedArray;
+
+  // Index to insert a new entry into `fixedArray`.
+  index: intptr;
+
+  // Running total of the resulting string length.
+  totalStringLength: intptr;
+
+  // `true` if the separator and all strings in the buffer are one-byte,
+  // otherwise `false`.
+  isOneByte: bool;
+}
 
-    macro AddSeparators(implicit context: Context)(
-        nofSeparators: intptr, separatorLength: intptr, write: bool) {
-      if (nofSeparators == 0 || separatorLength == 0) return;
+macro NewBuffer(len: uintptr, sep: String): Buffer {
+  const cappedBufferSize: intptr = len > kMaxNewSpaceFixedArrayElements ?
+      kMaxNewSpaceFixedArrayElements :
+      Signed(len);
+  assert(cappedBufferSize > 0);
+  return Buffer{
+    fixedArray: AllocateZeroedFixedArray(cappedBufferSize),
+    index: 0,
+    totalStringLength: 0,
+    isOneByte: IsOneByteStringInstanceType(sep.instanceType)
+  };
+}
 
-      const nofSeparatorsInt: intptr = nofSeparators;
-      const sepsLen: intptr = separatorLength * nofSeparatorsInt;
-      // Detect integer overflow
-      // TODO(tebbi): Replace with overflow-checked multiplication.
-      if (sepsLen / separatorLength != nofSeparatorsInt) deferred {
-          ThrowInvalidStringLength(context);
-        }
+macro BufferJoin(implicit context: Context)(
+    buffer: Buffer, sep: String): String {
+  assert(IsValidPositiveSmi(buffer.totalStringLength));
+  if (buffer.totalStringLength == 0) return kEmptyString;
+
+  // Fast path when there's only one buffer element.
+  if (buffer.index == 1) {
+    const fixedArray: FixedArray = buffer.fixedArray;
+    typeswitch (fixedArray.objects[0]) {
+      // When the element is a string, just return it and completely avoid
+      // allocating another string.
+      case (str: String): {
+        return str;
+      }
 
-      this.totalStringLength = AddStringLength(this.totalStringLength, sepsLen);
-      if (write) deferred {
-          this.fixedArray = StoreAndGrowFixedArray(
-              this.fixedArray, this.index++, Convert<Smi>(nofSeparatorsInt));
-        }
+      // When the element is a smi, use StringRepeat to quickly build a memory
+      // efficient separator repeated string.
+      case (nofSeparators: Number): {
+        return StringRepeat(context, sep, nofSeparators);
+      }
+      case (Object): {
+        unreachable;
+      }
     }
-
-    // Fixed array holding elements that are either:
-    //   1) String result of `ToString(next)`.
-    //   2) Smi representing the number of consecutive separators.
-    // `BufferJoin()` will iterate and writes these entries to a flat string.
-    //
-    // To save space, reduce reads and writes, only separators at the beginning,
-    // end, or more than one are written.
-    //
-    // No hole example
-    //   receiver:   ['hello', 'world']
-    //   fixedArray: ['hello', 'world']
-    //
-    // Hole example
-    //   receiver:   [<hole>, 'hello', <hole>, 'world', <hole>]
-    //   fixedArray: [1, 'hello', 2, 'world', 1]
-    fixedArray: FixedArray;
-
-    // Index to insert a new entry into `fixedArray`.
-    index: intptr;
-
-    // Running total of the resulting string length.
-    totalStringLength: intptr;
-
-    // `true` if the separator and all strings in the buffer are one-byte,
-    // otherwise `false`.
-    isOneByte: bool;
   }
 
-  macro NewBuffer(len: uintptr, sep: String): Buffer {
-    const cappedBufferSize: intptr = len > kMaxNewSpaceFixedArrayElements ?
-        kMaxNewSpaceFixedArrayElements :
-        Signed(len);
-    assert(cappedBufferSize > 0);
-    return Buffer{
-      fixedArray: AllocateZeroedFixedArray(cappedBufferSize),
-      index: 0,
-      totalStringLength: 0,
-      isOneByte: IsOneByteStringInstanceType(sep.instanceType)
-    };
-  }
-
-  macro BufferJoin(implicit context: Context)(buffer: Buffer, sep: String):
-      String {
-    assert(IsValidPositiveSmi(buffer.totalStringLength));
-    if (buffer.totalStringLength == 0) return kEmptyString;
-
-    // Fast path when there's only one buffer element.
-    if (buffer.index == 1) {
-      const fixedArray: FixedArray = buffer.fixedArray;
-      typeswitch (fixedArray.objects[0]) {
-        // When the element is a string, just return it and completely avoid
-        // allocating another string.
-        case (str: String): {
-          return str;
-        }
+  const length: uint32 = Convert<uint32>(Unsigned(buffer.totalStringLength));
+  const r: String = buffer.isOneByte ? AllocateSeqOneByteString(length) :
+                                       AllocateSeqTwoByteString(length);
+  return CallJSArrayArrayJoinConcatToSequentialString(
+      buffer.fixedArray, buffer.index, sep, r);
+}
 
-        // When the element is a smi, use StringRepeat to quickly build a memory
-        // efficient separator repeated string.
-        case (nofSeparators: Number): {
-          return StringRepeat(context, sep, nofSeparators);
-        }
-        case (Object): {
-          unreachable;
-        }
+transitioning macro ArrayJoinImpl<T: type>(implicit context: Context)(
+    receiver: JSReceiver, sep: String, lengthNumber: Number,
+    useToLocaleString: constexpr bool, locales: JSAny, options: JSAny,
+    initialLoadFn: LoadJoinElementFn): String {
+  const initialMap: Map = receiver.map;
+  const len: uintptr = Convert<uintptr>(lengthNumber);
+  const separatorLength: intptr = sep.length_intptr;
+  let nofSeparators: intptr = 0;
+  let loadFn: LoadJoinElementFn = initialLoadFn;
+  let buffer: Buffer = NewBuffer(len, sep);
+
+  // 6. Let k be 0.
+  let k: uintptr = 0;
+
+  // 7. Repeat, while k < len
+  while (k < len) {
+    if (CannotUseSameArrayAccessor<T>(
+            loadFn, receiver, initialMap, lengthNumber))
+      deferred {
+        loadFn = LoadJoinElement<array::GenericElementsAccessor>;
       }
+
+    if (k > 0) {
+      // a. If k > 0, let R be the string-concatenation of R and sep.
+      nofSeparators = nofSeparators + 1;
     }
 
-    const length: uint32 = Convert<uint32>(Unsigned(buffer.totalStringLength));
-    const r: String = buffer.isOneByte ? AllocateSeqOneByteString(length) :
-                                         AllocateSeqTwoByteString(length);
-    return CallJSArrayArrayJoinConcatToSequentialString(
-        buffer.fixedArray, buffer.index, sep, r);
-  }
+    // b. Let element be ? Get(O, ! ToString(k)).
+    const element: JSAny = loadFn(context, receiver, k++);
 
-  transitioning macro ArrayJoinImpl<T: type>(implicit context: Context)(
-      receiver: JSReceiver, sep: String, lengthNumber: Number,
-      useToLocaleString: constexpr bool, locales: JSAny, options: JSAny,
-      initialLoadFn: LoadJoinElementFn): String {
-    const initialMap: Map = receiver.map;
-    const len: uintptr = Convert<uintptr>(lengthNumber);
-    const separatorLength: intptr = sep.length_intptr;
-    let nofSeparators: intptr = 0;
-    let loadFn: LoadJoinElementFn = initialLoadFn;
-    let buffer: Buffer = NewBuffer(len, sep);
-
-    // 6. Let k be 0.
-    let k: uintptr = 0;
-
-    // 7. Repeat, while k < len
-    while (k < len) {
-      if (CannotUseSameArrayAccessor<T>(
-              loadFn, receiver, initialMap, lengthNumber))
-        deferred {
-          loadFn = LoadJoinElement<array::GenericElementsAccessor>;
+    // c. If element is undefined or null, let next be the empty String;
+    //    otherwise, let next be ? ToString(element).
+    let next: String;
+    if constexpr (useToLocaleString) {
+      next = ConvertToLocaleString(context, element, locales, options);
+      if (next == kEmptyString) continue;
+    } else {
+      typeswitch (element) {
+        case (str: String): {
+          if (str == kEmptyString) continue;
+          next = str;
         }
-
-      if (k > 0) {
-        // a. If k > 0, let R be the string-concatenation of R and sep.
-        nofSeparators = nofSeparators + 1;
-      }
-
-      // b. Let element be ? Get(O, ! ToString(k)).
-      const element: JSAny = loadFn(context, receiver, k++);
-
-      // c. If element is undefined or null, let next be the empty String;
-      //    otherwise, let next be ? ToString(element).
-      let next: String;
-      if constexpr (useToLocaleString) {
-        next = ConvertToLocaleString(context, element, locales, options);
-        if (next == kEmptyString) continue;
-      } else {
-        typeswitch (element) {
-          case (str: String): {
-            if (str == kEmptyString) continue;
-            next = str;
-          }
-          case (num: Number): {
-            next = NumberToString(num);
-          }
-          case (obj: JSAny): {
-            if (IsNullOrUndefined(obj)) continue;
-            next = ToString(context, obj);
-          }
+        case (num: Number): {
+          next = NumberToString(num);
+        }
+        case (obj: JSAny): {
+          if (IsNullOrUndefined(obj)) continue;
+          next = string::ToString(context, obj);
         }
       }
-
-      // d. Set R to the string-concatenation of R and next.
-      buffer.Add(next, nofSeparators, separatorLength);
-      nofSeparators = 0;
     }
 
-    // Add any separators at the end.
-    buffer.AddSeparators(nofSeparators, separatorLength, true);
-
-    // 8. Return R.
-    return BufferJoin(buffer, sep);
+    // d. Set R to the string-concatenation of R and next.
+    buffer.Add(next, nofSeparators, separatorLength);
+    nofSeparators = 0;
   }
 
-  transitioning macro ArrayJoin<T: type>(implicit context: Context)(
-      useToLocaleString: constexpr bool, receiver: JSReceiver, sep: String,
-      lenNumber: Number, locales: JSAny, options: JSAny): JSAny;
+  // Add any separators at the end.
+  buffer.AddSeparators(nofSeparators, separatorLength, true);
 
-  transitioning ArrayJoin<JSArray>(implicit context: Context)(
-      useToLocaleString: constexpr bool, receiver: JSReceiver, sep: String,
-      lenNumber: Number, locales: JSAny, options: JSAny): JSAny {
-    const map: Map = receiver.map;
-    const kind: ElementsKind = map.elements_kind;
-    let loadFn: LoadJoinElementFn;
+  // 8. Return R.
+  return BufferJoin(buffer, sep);
+}
 
-    try {
-      const array: JSArray = Cast<JSArray>(receiver) otherwise IfSlowPath;
-      if (array.length != lenNumber) goto IfSlowPath;
-      if (!IsPrototypeInitialArrayPrototype(map)) goto IfSlowPath;
-      if (IsNoElementsProtectorCellInvalid()) goto IfSlowPath;
-
-      if (IsElementsKindLessThanOrEqual(kind, ElementsKind::HOLEY_ELEMENTS)) {
-        loadFn = LoadJoinElement<array::FastSmiOrObjectElements>;
-      } else if (IsElementsKindLessThanOrEqual(
-                     kind, ElementsKind::HOLEY_DOUBLE_ELEMENTS)) {
-        loadFn = LoadJoinElement<array::FastDoubleElements>;
-      } else if (kind == ElementsKind::DICTIONARY_ELEMENTS)
-        deferred {
-          const dict: NumberDictionary =
-              UnsafeCast<NumberDictionary>(array.elements);
-          const nofElements: Smi = GetNumberDictionaryNumberOfElements(dict);
-          if (nofElements == 0) {
-            if (sep == kEmptyString) return kEmptyString;
-            try {
-              const nofSeparators: Smi =
-                  Cast<Smi>(lenNumber - 1) otherwise IfNotSmi;
-              return StringRepeat(context, sep, nofSeparators);
-            }
-            label IfNotSmi {
-              ThrowInvalidStringLength(context);
-            }
-          } else {
-            loadFn = LoadJoinElement<array::DictionaryElements>;
+transitioning macro ArrayJoin<T: type>(implicit context: Context)(
+    useToLocaleString: constexpr bool, receiver: JSReceiver, sep: String,
+    lenNumber: Number, locales: JSAny, options: JSAny): JSAny;
+
+transitioning ArrayJoin<JSArray>(implicit context: Context)(
+    useToLocaleString: constexpr bool, receiver: JSReceiver, sep: String,
+    lenNumber: Number, locales: JSAny, options: JSAny): JSAny {
+  const map: Map = receiver.map;
+  const kind: ElementsKind = map.elements_kind;
+  let loadFn: LoadJoinElementFn;
+
+  try {
+    const array: JSArray = Cast<JSArray>(receiver) otherwise IfSlowPath;
+    if (array.length != lenNumber) goto IfSlowPath;
+    if (!IsPrototypeInitialArrayPrototype(map)) goto IfSlowPath;
+    if (IsNoElementsProtectorCellInvalid()) goto IfSlowPath;
+
+    if (IsElementsKindLessThanOrEqual(kind, ElementsKind::HOLEY_ELEMENTS)) {
+      loadFn = LoadJoinElement<array::FastSmiOrObjectElements>;
+    } else if (IsElementsKindLessThanOrEqual(
+                   kind, ElementsKind::HOLEY_DOUBLE_ELEMENTS)) {
+      loadFn = LoadJoinElement<array::FastDoubleElements>;
+    } else if (kind == ElementsKind::DICTIONARY_ELEMENTS)
+      deferred {
+        const dict: NumberDictionary =
+            UnsafeCast<NumberDictionary>(array.elements);
+        const nofElements: Smi = GetNumberDictionaryNumberOfElements(dict);
+        if (nofElements == 0) {
+          if (sep == kEmptyString) return kEmptyString;
+          try {
+            const nofSeparators: Smi =
+                Cast<Smi>(lenNumber - 1) otherwise IfNotSmi;
+            return StringRepeat(context, sep, nofSeparators);
+          } label IfNotSmi {
+            ThrowInvalidStringLength(context);
           }
+        } else {
+          loadFn = LoadJoinElement<array::DictionaryElements>;
         }
-      else {
-        goto IfSlowPath;
       }
+    else {
+      goto IfSlowPath;
     }
-    label IfSlowPath {
-      loadFn = LoadJoinElement<array::GenericElementsAccessor>;
-    }
-    return ArrayJoinImpl<JSArray>(
-        receiver, sep, lenNumber, useToLocaleString, locales, options, loadFn);
+  } label IfSlowPath {
+    loadFn = LoadJoinElement<array::GenericElementsAccessor>;
   }
+  return ArrayJoinImpl<JSArray>(
+      receiver, sep, lenNumber, useToLocaleString, locales, options, loadFn);
+}
 
-  transitioning ArrayJoin<JSTypedArray>(implicit context: Context)(
-      useToLocaleString: constexpr bool, receiver: JSReceiver, sep: String,
-      lenNumber: Number, locales: JSAny, options: JSAny): JSAny {
-    const map: Map = receiver.map;
-    const kind: ElementsKind = map.elements_kind;
-    let loadFn: LoadJoinElementFn;
-
-    if (IsElementsKindGreaterThan(kind, ElementsKind::UINT32_ELEMENTS)) {
-      if (kind == ElementsKind::INT32_ELEMENTS) {
-        loadFn = LoadJoinTypedElement<typed_array::Int32Elements>;
-      } else if (kind == ElementsKind::FLOAT32_ELEMENTS) {
-        loadFn = LoadJoinTypedElement<typed_array::Float32Elements>;
-      } else if (kind == ElementsKind::FLOAT64_ELEMENTS) {
-        loadFn = LoadJoinTypedElement<typed_array::Float64Elements>;
-      } else if (kind == ElementsKind::UINT8_CLAMPED_ELEMENTS) {
-        loadFn = LoadJoinTypedElement<typed_array::Uint8ClampedElements>;
-      } else if (kind == ElementsKind::BIGUINT64_ELEMENTS) {
-        loadFn = LoadJoinTypedElement<typed_array::BigUint64Elements>;
-      } else if (kind == ElementsKind::BIGINT64_ELEMENTS) {
-        loadFn = LoadJoinTypedElement<typed_array::BigInt64Elements>;
-      } else {
-        unreachable;
-      }
+transitioning ArrayJoin<JSTypedArray>(implicit context: Context)(
+    useToLocaleString: constexpr bool, receiver: JSReceiver, sep: String,
+    lenNumber: Number, locales: JSAny, options: JSAny): JSAny {
+  const map: Map = receiver.map;
+  const kind: ElementsKind = map.elements_kind;
+  let loadFn: LoadJoinElementFn;
+
+  if (IsElementsKindGreaterThan(kind, ElementsKind::UINT32_ELEMENTS)) {
+    if (kind == ElementsKind::INT32_ELEMENTS) {
+      loadFn = LoadJoinTypedElement<typed_array::Int32Elements>;
+    } else if (kind == ElementsKind::FLOAT32_ELEMENTS) {
+      loadFn = LoadJoinTypedElement<typed_array::Float32Elements>;
+    } else if (kind == ElementsKind::FLOAT64_ELEMENTS) {
+      loadFn = LoadJoinTypedElement<typed_array::Float64Elements>;
+    } else if (kind == ElementsKind::UINT8_CLAMPED_ELEMENTS) {
+      loadFn = LoadJoinTypedElement<typed_array::Uint8ClampedElements>;
+    } else if (kind == ElementsKind::BIGUINT64_ELEMENTS) {
+      loadFn = LoadJoinTypedElement<typed_array::BigUint64Elements>;
+    } else if (kind == ElementsKind::BIGINT64_ELEMENTS) {
+      loadFn = LoadJoinTypedElement<typed_array::BigInt64Elements>;
     } else {
-      if (kind == ElementsKind::UINT8_ELEMENTS) {
-        loadFn = LoadJoinTypedElement<typed_array::Uint8Elements>;
-      } else if (kind == ElementsKind::INT8_ELEMENTS) {
-        loadFn = LoadJoinTypedElement<typed_array::Int8Elements>;
-      } else if (kind == ElementsKind::UINT16_ELEMENTS) {
-        loadFn = LoadJoinTypedElement<typed_array::Uint16Elements>;
-      } else if (kind == ElementsKind::INT16_ELEMENTS) {
-        loadFn = LoadJoinTypedElement<typed_array::Int16Elements>;
-      } else if (kind == ElementsKind::UINT32_ELEMENTS) {
-        loadFn = LoadJoinTypedElement<typed_array::Uint32Elements>;
-      } else {
-        unreachable;
-      }
+      unreachable;
+    }
+  } else {
+    if (kind == ElementsKind::UINT8_ELEMENTS) {
+      loadFn = LoadJoinTypedElement<typed_array::Uint8Elements>;
+    } else if (kind == ElementsKind::INT8_ELEMENTS) {
+      loadFn = LoadJoinTypedElement<typed_array::Int8Elements>;
+    } else if (kind == ElementsKind::UINT16_ELEMENTS) {
+      loadFn = LoadJoinTypedElement<typed_array::Uint16Elements>;
+    } else if (kind == ElementsKind::INT16_ELEMENTS) {
+      loadFn = LoadJoinTypedElement<typed_array::Int16Elements>;
+    } else if (kind == ElementsKind::UINT32_ELEMENTS) {
+      loadFn = LoadJoinTypedElement<typed_array::Uint32Elements>;
+    } else {
+      unreachable;
     }
-    return ArrayJoinImpl<JSTypedArray>(
-        receiver, sep, lenNumber, useToLocaleString, locales, options, loadFn);
-  }
-
-  // The Join Stack detects cyclical calls to Array Join builtins
-  // (Array.p.join(), Array.p.toString(), Array.p.toLocaleString()). This
-  // FixedArray holds a stack of receivers to the current call.
-  // CycleProtectedArrayJoin() is responsible for calling JoinStackPush and
-  // JoinStackPop when visiting and leaving a receiver, respectively.
-  const kMinJoinStackSize:
-      constexpr int31 generates 'JSArray::kMinJoinStackSize';
-  macro LoadJoinStack(implicit context: Context)(): FixedArray
-      labels IfUninitialized {
-    const nativeContext: NativeContext = LoadNativeContext(context);
-    const stack: HeapObject = UnsafeCast<HeapObject>(
-        nativeContext[NativeContextSlot::ARRAY_JOIN_STACK_INDEX]);
-    if (stack == Undefined) goto IfUninitialized;
-    assert(IsFixedArray(stack));
-    return UnsafeCast<FixedArray>(stack);
   }
+  return ArrayJoinImpl<JSTypedArray>(
+      receiver, sep, lenNumber, useToLocaleString, locales, options, loadFn);
+}
 
-  macro SetJoinStack(implicit context: Context)(stack: FixedArray): void {
-    const nativeContext: NativeContext = LoadNativeContext(context);
-    nativeContext[NativeContextSlot::ARRAY_JOIN_STACK_INDEX] = stack;
-  }
+// The Join Stack detects cyclical calls to Array Join builtins
+// (Array.p.join(), Array.p.toString(), Array.p.toLocaleString()). This
+// FixedArray holds a stack of receivers to the current call.
+// CycleProtectedArrayJoin() is responsible for calling JoinStackPush and
+// JoinStackPop when visiting and leaving a receiver, respectively.
+const kMinJoinStackSize:
+    constexpr int31 generates 'JSArray::kMinJoinStackSize';
+macro LoadJoinStack(implicit context: Context)(): FixedArray
+    labels IfUninitialized {
+  const nativeContext: NativeContext = LoadNativeContext(context);
+  const stack: HeapObject = UnsafeCast<HeapObject>(
+      nativeContext[NativeContextSlot::ARRAY_JOIN_STACK_INDEX]);
+  if (stack == Undefined) goto IfUninitialized;
+  assert(IsFixedArray(stack));
+  return UnsafeCast<FixedArray>(stack);
+}
 
-  // Adds a receiver to the stack. The FixedArray will automatically grow to
-  // accommodate the receiver. If the receiver already exists on the stack,
-  // this indicates a cyclical call and False is returned.
-  builtin JoinStackPush(implicit context: Context)(
-      stack: FixedArray, receiver: JSReceiver): Boolean {
-    const capacity: intptr = stack.length_intptr;
-    for (let i: intptr = 0; i < capacity; i++) {
-      const previouslyVisited: Object = stack.objects[i];
-
-      // Add `receiver` to the first open slot
-      if (previouslyVisited == TheHole) {
-        stack.objects[i] = receiver;
-        return True;
-      }
+macro SetJoinStack(implicit context: Context)(stack: FixedArray): void {
+  const nativeContext: NativeContext = LoadNativeContext(context);
+  nativeContext[NativeContextSlot::ARRAY_JOIN_STACK_INDEX] = stack;
+}
 
-      // Detect cycles
-      if (receiver == previouslyVisited) return False;
+// Adds a receiver to the stack. The FixedArray will automatically grow to
+// accommodate the receiver. If the receiver already exists on the stack,
+// this indicates a cyclical call and False is returned.
+builtin JoinStackPush(implicit context: Context)(
+    stack: FixedArray, receiver: JSReceiver): Boolean {
+  const capacity: intptr = stack.length_intptr;
+  for (let i: intptr = 0; i < capacity; i++) {
+    const previouslyVisited: Object = stack.objects[i];
+
+    // Add `receiver` to the first open slot
+    if (previouslyVisited == TheHole) {
+      stack.objects[i] = receiver;
+      return True;
     }
 
-    // If no open slots were found, grow the stack and add receiver to the end.
-    const newStack: FixedArray =
-        StoreAndGrowFixedArray(stack, capacity, receiver);
-    SetJoinStack(newStack);
-    return True;
+    // Detect cycles
+    if (receiver == previouslyVisited) return False;
   }
 
-  // Fast path the common non-nested calls. If the receiver is not already on
-  // the stack, add it to the stack and return true. Otherwise return false.
-  macro JoinStackPushInline(implicit context: Context)(receiver: JSReceiver):
-      bool {
-    try {
-      const stack: FixedArray = LoadJoinStack()
-          otherwise IfUninitialized;
-      if (stack.objects[0] == TheHole) {
-        stack.objects[0] = receiver;
-      } else if (JoinStackPush(stack, receiver) == False)
-        deferred {
-          return false;
-        }
-    }
-    label IfUninitialized {
-      const stack: FixedArray =
-          AllocateFixedArrayWithHoles(kMinJoinStackSize, AllocationFlag::kNone);
+  // If no open slots were found, grow the stack and add receiver to the end.
+  const newStack: FixedArray =
+      StoreAndGrowFixedArray(stack, capacity, receiver);
+  SetJoinStack(newStack);
+  return True;
+}
+
+// Fast path the common non-nested calls. If the receiver is not already on
+// the stack, add it to the stack and return true. Otherwise return false.
+macro JoinStackPushInline(implicit context: Context)(receiver: JSReceiver):
+    bool {
+  try {
+    const stack: FixedArray = LoadJoinStack()
+        otherwise IfUninitialized;
+    if (stack.objects[0] == TheHole) {
       stack.objects[0] = receiver;
-      SetJoinStack(stack);
-    }
-    return true;
+    } else if (JoinStackPush(stack, receiver) == False)
+      deferred {
+        return false;
+      }
+  } label IfUninitialized {
+    const stack: FixedArray =
+        AllocateFixedArrayWithHoles(kMinJoinStackSize, AllocationFlag::kNone);
+    stack.objects[0] = receiver;
+    SetJoinStack(stack);
   }
+  return true;
+}
 
-  // Removes a receiver from the stack. The FixedArray will automatically shrink
-  // to Heap::kMinJoinStackSize once the stack becomes empty.
-  builtin JoinStackPop(implicit context: Context)(
-      stack: FixedArray, receiver: JSReceiver): JSAny {
-    const len: intptr = stack.length_intptr;
-    for (let i: intptr = 0; i < len; i++) {
-      if (stack.objects[i] == receiver) {
-        // Shrink the Join Stack if the stack will be empty and is larger than
-        // the minimum size.
-        if (i == 0 && len > kMinJoinStackSize) deferred {
-            const newStack: FixedArray = AllocateFixedArrayWithHoles(
-                kMinJoinStackSize, AllocationFlag::kNone);
-            SetJoinStack(newStack);
-          }
-        else {
-          stack.objects[i] = TheHole;
+// Removes a receiver from the stack. The FixedArray will automatically shrink
+// to Heap::kMinJoinStackSize once the stack becomes empty.
+builtin JoinStackPop(implicit context: Context)(
+    stack: FixedArray, receiver: JSReceiver): JSAny {
+  const len: intptr = stack.length_intptr;
+  for (let i: intptr = 0; i < len; i++) {
+    if (stack.objects[i] == receiver) {
+      // Shrink the Join Stack if the stack will be empty and is larger than
+      // the minimum size.
+      if (i == 0 && len > kMinJoinStackSize) deferred {
+          const newStack: FixedArray = AllocateFixedArrayWithHoles(
+              kMinJoinStackSize, AllocationFlag::kNone);
+          SetJoinStack(newStack);
         }
-        return Undefined;
+      else {
+        stack.objects[i] = TheHole;
       }
+      return Undefined;
     }
-    unreachable;
   }
+  unreachable;
+}
 
-  // Fast path the common non-nested calls.
-  macro JoinStackPopInline(implicit context: Context)(receiver: JSReceiver) {
-    const stack: FixedArray = LoadJoinStack()
-        otherwise unreachable;
-    const len: intptr = stack.length_intptr;
-
-    // Builtin call was not nested (receiver is the first entry) and
-    // did not contain other nested arrays that expanded the stack.
-    if (stack.objects[0] == receiver && len == kMinJoinStackSize) {
-      StoreFixedArrayElement(stack, 0, TheHole, SKIP_WRITE_BARRIER);
-    } else
-      deferred {
-        JoinStackPop(stack, receiver);
-      }
-  }
+// Fast path the common non-nested calls.
+macro JoinStackPopInline(implicit context: Context)(receiver: JSReceiver) {
+  const stack: FixedArray = LoadJoinStack()
+      otherwise unreachable;
+  const len: intptr = stack.length_intptr;
+
+  // Builtin call was not nested (receiver is the first entry) and
+  // did not contain other nested arrays that expanded the stack.
+  if (stack.objects[0] == receiver && len == kMinJoinStackSize) {
+    StoreFixedArrayElement(stack, 0, TheHole, SKIP_WRITE_BARRIER);
+  } else
+    deferred {
+      JoinStackPop(stack, receiver);
+    }
+}
 
-  // Main entry point for all builtins using Array Join functionality.
-  transitioning macro CycleProtectedArrayJoin<T: type>(implicit context:
-                                                            Context)(
-      useToLocaleString: constexpr bool, o: JSReceiver, len: Number,
-      sepObj: JSAny, locales: JSAny, options: JSAny): JSAny {
-    // 3. If separator is undefined, let sep be the single-element String ",".
-    // 4. Else, let sep be ? ToString(separator).
-    const sep: String = sepObj == Undefined ? ',' : ToString_Inline(sepObj);
-
-    // If the receiver is not empty and not already being joined, continue with
-    // the normal join algorithm.
-    if (len > 0 && JoinStackPushInline(o)) {
-      try {
-        const result: JSAny =
-            ArrayJoin<T>(useToLocaleString, o, sep, len, locales, options);
-        JoinStackPopInline(o);
-        return result;
-      } catch (e) deferred {
-        JoinStackPopInline(o);
-        ReThrow(context, e);
-      }
-    } else {
-      return kEmptyString;
+// Main entry point for all builtins using Array Join functionality.
+transitioning macro CycleProtectedArrayJoin<T: type>(
+    implicit context: Context)(
+    useToLocaleString: constexpr bool, o: JSReceiver, len: Number,
+    sepObj: JSAny, locales: JSAny, options: JSAny): JSAny {
+  // 3. If separator is undefined, let sep be the single-element String ",".
+  // 4. Else, let sep be ? ToString(separator).
+  const sep: String = sepObj == Undefined ? ',' : ToString_Inline(sepObj);
+
+  // If the receiver is not empty and not already being joined, continue with
+  // the normal join algorithm.
+  if (len > 0 && JoinStackPushInline(o)) {
+    try {
+      const result: JSAny =
+          ArrayJoin<T>(useToLocaleString, o, sep, len, locales, options);
+      JoinStackPopInline(o);
+      return result;
+    } catch (e) deferred {
+      JoinStackPopInline(o);
+      ReThrow(context, e);
     }
+  } else {
+    return kEmptyString;
   }
+}
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.join
-  transitioning javascript builtin
-  ArrayPrototypeJoin(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSAny {
-    const separator: JSAny = arguments[0];
+// https://tc39.github.io/ecma262/#sec-array.prototype.join
+transitioning javascript builtin
+ArrayPrototypeJoin(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const separator: JSAny = arguments[0];
 
-    // 1. Let O be ? ToObject(this value).
-    const o: JSReceiver = ToObject_Inline(context, receiver);
+  // 1. Let O be ? ToObject(this value).
+  const o: JSReceiver = ToObject_Inline(context, receiver);
 
-    // 2. Let len be ? ToLength(? Get(O, "length")).
-    const len: Number = GetLengthProperty(o);
+  // 2. Let len be ? ToLength(? Get(O, "length")).
+  const len: Number = GetLengthProperty(o);
 
-    // Only handle valid array lengths. Although the spec allows larger
-    // values, this matches historical V8 behavior.
-    if (len > kMaxArrayIndex + 1)
-      ThrowTypeError(MessageTemplate::kInvalidArrayLength);
+  // Only handle valid array lengths. Although the spec allows larger
+  // values, this matches historical V8 behavior.
+  if (len > kMaxArrayIndex + 1)
+    ThrowTypeError(MessageTemplate::kInvalidArrayLength);
 
-    return CycleProtectedArrayJoin<JSArray>(
-        false, o, len, separator, Undefined, Undefined);
-  }
+  return CycleProtectedArrayJoin<JSArray>(
+      false, o, len, separator, Undefined, Undefined);
+}
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.tolocalestring
-  transitioning javascript builtin ArrayPrototypeToLocaleString(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const locales: JSAny = arguments[0];
-    const options: JSAny = arguments[1];
+// https://tc39.github.io/ecma262/#sec-array.prototype.tolocalestring
+transitioning javascript builtin ArrayPrototypeToLocaleString(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const locales: JSAny = arguments[0];
+  const options: JSAny = arguments[1];
 
-    // 1. Let O be ? ToObject(this value).
-    const o: JSReceiver = ToObject_Inline(context, receiver);
+  // 1. Let O be ? ToObject(this value).
+  const o: JSReceiver = ToObject_Inline(context, receiver);
 
-    // 2. Let len be ? ToLength(? Get(O, "length")).
-    const len: Number = GetLengthProperty(o);
+  // 2. Let len be ? ToLength(? Get(O, "length")).
+  const len: Number = GetLengthProperty(o);
 
-    // Only handle valid array lengths. Although the spec allows larger
-    // values, this matches historical V8 behavior.
-    if (len > kMaxArrayIndex + 1)
-      ThrowTypeError(MessageTemplate::kInvalidArrayLength);
+  // Only handle valid array lengths. Although the spec allows larger
+  // values, this matches historical V8 behavior.
+  if (len > kMaxArrayIndex + 1)
+    ThrowTypeError(MessageTemplate::kInvalidArrayLength);
 
-    return CycleProtectedArrayJoin<JSArray>(
-        true, o, len, ',', locales, options);
-  }
+  return CycleProtectedArrayJoin<JSArray>(true, o, len, ',', locales, options);
+}
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.tostring
-  transitioning javascript builtin ArrayPrototypeToString(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    // 1. Let array be ? ToObject(this value).
-    const array: JSReceiver = ToObject_Inline(context, receiver);
+// https://tc39.github.io/ecma262/#sec-array.prototype.tostring
+transitioning javascript builtin ArrayPrototypeToString(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // 1. Let array be ? ToObject(this value).
+  const array: JSReceiver = ToObject_Inline(context, receiver);
+
+  // 2. Let func be ? Get(array, "join").
+  const prop: JSAny = GetProperty(array, 'join');
+  try {
+    // 3. If IsCallable(func) is false, let func be the intrinsic function
+    //    %ObjProto_toString%.
+    const func: Callable = Cast<Callable>(prop) otherwise NotCallable;
+
+    // 4. Return ? Call(func, array).
+    return Call(context, func, array);
+  } label NotCallable {
+    return ObjectToString(context, array);
+  }
+}
 
-    // 2. Let func be ? Get(array, "join").
-    const prop: JSAny = GetProperty(array, 'join');
-    try {
-      // 3. If IsCallable(func) is false, let func be the intrinsic function
-      //    %ObjProto_toString%.
-      const func: Callable = Cast<Callable>(prop) otherwise NotCallable;
+// https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.join
+transitioning javascript builtin TypedArrayPrototypeJoin(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const separator: JSAny = arguments[0];
 
-      // 4. Return ? Call(func, array).
-      return Call(context, func, array);
-    }
-    label NotCallable {
-      return ObjectToString(context, array);
-    }
-  }
+  // Spec: ValidateTypedArray is applied to the this value prior to evaluating
+  // the algorithm.
+  const typedArray: JSTypedArray = typed_array::ValidateTypedArray(
+      context, receiver, '%TypedArray%.prototype.join');
+  const length = Convert<Number>(typedArray.length);
 
-  // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.join
-  transitioning javascript builtin TypedArrayPrototypeJoin(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const separator: JSAny = arguments[0];
+  return CycleProtectedArrayJoin<JSTypedArray>(
+      false, typedArray, length, separator, Undefined, Undefined);
+}
 
-    // Spec: ValidateTypedArray is applied to the this value prior to evaluating
-    // the algorithm.
-    const typedArray: JSTypedArray = typed_array::ValidateTypedArray(
-        context, receiver, '%TypedArray%.prototype.join');
-    const length = Convert<Number>(typedArray.length);
+// https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.tolocalestring
+transitioning javascript builtin TypedArrayPrototypeToLocaleString(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const locales: JSAny = arguments[0];
+  const options: JSAny = arguments[1];
 
-    return CycleProtectedArrayJoin<JSTypedArray>(
-        false, typedArray, length, separator, Undefined, Undefined);
-  }
+  // Spec: ValidateTypedArray is applied to the this value prior to evaluating
+  // the algorithm.
+  const typedArray: JSTypedArray = typed_array::ValidateTypedArray(
+      context, receiver, '%TypedArray%.prototype.toLocaleString');
+  const length = Convert<Number>(typedArray.length);
 
-  // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.tolocalestring
-  transitioning javascript builtin TypedArrayPrototypeToLocaleString(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const locales: JSAny = arguments[0];
-    const options: JSAny = arguments[1];
-
-    // Spec: ValidateTypedArray is applied to the this value prior to evaluating
-    // the algorithm.
-    const typedArray: JSTypedArray = typed_array::ValidateTypedArray(
-        context, receiver, '%TypedArray%.prototype.toLocaleString');
-    const length = Convert<Number>(typedArray.length);
-
-    return CycleProtectedArrayJoin<JSTypedArray>(
-        true, typedArray, length, ',', locales, options);
-  }
+  return CycleProtectedArrayJoin<JSTypedArray>(
+      true, typedArray, length, ',', locales, options);
+}
 }
diff --git a/deps/v8/src/builtins/array-lastindexof.tq b/deps/v8/src/builtins/array-lastindexof.tq
index 52bcc75d195..fe416fa4a24 100644
--- a/deps/v8/src/builtins/array-lastindexof.tq
+++ b/deps/v8/src/builtins/array-lastindexof.tq
@@ -3,154 +3,151 @@
 // found in the LICENSE file.
 
 namespace array {
-  macro LoadWithHoleCheck<Elements : type extends FixedArrayBase>(
-      elements: FixedArrayBase, index: Smi): JSAny
-      labels IfHole;
-
-  LoadWithHoleCheck<FixedArray>(implicit context: Context)(
-      elements: FixedArrayBase, index: Smi): JSAny
-      labels IfHole {
-    const elements: FixedArray = UnsafeCast<FixedArray>(elements);
-    const element: Object = elements.objects[index];
-    if (element == TheHole) goto IfHole;
-    return UnsafeCast<JSAny>(element);
-  }
+macro LoadWithHoleCheck<Elements : type extends FixedArrayBase>(
+    elements: FixedArrayBase, index: Smi): JSAny
+    labels IfHole;
+
+LoadWithHoleCheck<FixedArray>(implicit context: Context)(
+    elements: FixedArrayBase, index: Smi): JSAny
+    labels IfHole {
+  const elements: FixedArray = UnsafeCast<FixedArray>(elements);
+  const element: Object = elements.objects[index];
+  if (element == TheHole) goto IfHole;
+  return UnsafeCast<JSAny>(element);
+}
 
-  LoadWithHoleCheck<FixedDoubleArray>(implicit context: Context)(
-      elements: FixedArrayBase, index: Smi): JSAny
-      labels IfHole {
-    const elements: FixedDoubleArray = UnsafeCast<FixedDoubleArray>(elements);
-    const element: float64 = elements.floats[index].Value() otherwise IfHole;
-    return AllocateHeapNumberWithValue(element);
-  }
+LoadWithHoleCheck<FixedDoubleArray>(implicit context: Context)(
+    elements: FixedArrayBase, index: Smi): JSAny
+    labels IfHole {
+  const elements: FixedDoubleArray = UnsafeCast<FixedDoubleArray>(elements);
+  const element: float64 = elements.floats[index].Value() otherwise IfHole;
+  return AllocateHeapNumberWithValue(element);
+}
 
-  macro FastArrayLastIndexOf<Elements : type extends FixedArrayBase>(
-      context: Context, array: JSArray, from: Smi, searchElement: JSAny): Smi {
-    const elements: FixedArrayBase = array.elements;
-    let k: Smi = from;
-
-    // Bug(898785): Due to side-effects in the evaluation of `fromIndex`
-    // the {from} can be out-of-bounds here, so we need to clamp {k} to
-    // the {elements} length. We might be reading holes / hole NaNs still
-    // due to that, but those will be ignored below.
-    if (k >= elements.length) {
-      k = elements.length - 1;
-    }
+macro FastArrayLastIndexOf<Elements : type extends FixedArrayBase>(
+    context: Context, array: JSArray, from: Smi, searchElement: JSAny): Smi {
+  const elements: FixedArrayBase = array.elements;
+  let k: Smi = from;
+
+  // Bug(898785): Due to side-effects in the evaluation of `fromIndex`
+  // the {from} can be out-of-bounds here, so we need to clamp {k} to
+  // the {elements} length. We might be reading holes / hole NaNs still
+  // due to that, but those will be ignored below.
+  if (k >= elements.length) {
+    k = elements.length - 1;
+  }
 
-    while (k >= 0) {
-      try {
-        const element: JSAny = LoadWithHoleCheck<Elements>(elements, k)
-            otherwise Hole;
+  while (k >= 0) {
+    try {
+      const element: JSAny = LoadWithHoleCheck<Elements>(elements, k)
+          otherwise Hole;
 
-        const same: Boolean = StrictEqual(searchElement, element);
-        if (same == True) {
-          assert(Is<FastJSArray>(array));
-          return k;
-        }
+      const same: Boolean = StrictEqual(searchElement, element);
+      if (same == True) {
+        assert(Is<FastJSArray>(array));
+        return k;
       }
-      label Hole {}  // Do nothing for holes.
-
-      --k;
-    }
+    } label Hole {}  // Do nothing for holes.
 
-    assert(Is<FastJSArray>(array));
-    return -1;
+    --k;
   }
 
-  transitioning macro
-  GetFromIndex(context: Context, length: Number, arguments: Arguments): Number {
-    // 4. If fromIndex is present, let n be ? ToInteger(fromIndex);
-    //    else let n be len - 1.
-    const n: Number =
-        arguments.length < 2 ? length - 1 : ToInteger_Inline(arguments[1]);
-
-    // 5. If n >= 0, then.
-    let k: Number = SmiConstant(0);
-    if (n >= 0) {
-      // a. If n is -0, let k be +0; else let k be min(n, len - 1).
-      // If n was -0 it got truncated to 0.0, so taking the minimum is fine.
-      k = Min(n, length - 1);
-    } else {
-      // a. Let k be len + n.
-      k = length + n;
-    }
-    return k;
+  assert(Is<FastJSArray>(array));
+  return -1;
+}
+
+transitioning macro
+GetFromIndex(context: Context, length: Number, arguments: Arguments): Number {
+  // 4. If fromIndex is present, let n be ? ToInteger(fromIndex);
+  //    else let n be len - 1.
+  const n: Number =
+      arguments.length < 2 ? length - 1 : ToInteger_Inline(arguments[1]);
+
+  // 5. If n >= 0, then.
+  let k: Number = SmiConstant(0);
+  if (n >= 0) {
+    // a. If n is -0, let k be +0; else let k be min(n, len - 1).
+    // If n was -0 it got truncated to 0.0, so taking the minimum is fine.
+    k = Min(n, length - 1);
+  } else {
+    // a. Let k be len + n.
+    k = length + n;
   }
+  return k;
+}
 
-  macro TryFastArrayLastIndexOf(
-      context: Context, receiver: JSReceiver, searchElement: JSAny,
-      from: Number): JSAny
-      labels Slow {
-    const array: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
-    const length: Smi = array.length;
-    if (length == 0) return SmiConstant(-1);
-
-    const fromSmi: Smi = Cast<Smi>(from) otherwise Slow;
-    const kind: ElementsKind = array.map.elements_kind;
-    if (IsFastSmiOrTaggedElementsKind(kind)) {
-      return FastArrayLastIndexOf<FixedArray>(
-          context, array, fromSmi, searchElement);
-    }
-    assert(IsDoubleElementsKind(kind));
-    return FastArrayLastIndexOf<FixedDoubleArray>(
+macro TryFastArrayLastIndexOf(
+    context: Context, receiver: JSReceiver, searchElement: JSAny,
+    from: Number): JSAny
+    labels Slow {
+  const array: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
+  const length: Smi = array.length;
+  if (length == 0) return SmiConstant(-1);
+
+  const fromSmi: Smi = Cast<Smi>(from) otherwise Slow;
+  const kind: ElementsKind = array.map.elements_kind;
+  if (IsFastSmiOrTaggedElementsKind(kind)) {
+    return FastArrayLastIndexOf<FixedArray>(
         context, array, fromSmi, searchElement);
   }
+  assert(IsDoubleElementsKind(kind));
+  return FastArrayLastIndexOf<FixedDoubleArray>(
+      context, array, fromSmi, searchElement);
+}
 
-  transitioning macro GenericArrayLastIndexOf(
-      context: Context, object: JSReceiver, searchElement: JSAny,
-      from: Number): JSAny {
-    let k: Number = from;
-
-    // 7. Repeat, while k >= 0.
-    while (k >= 0) {
-      // a. Let kPresent be ? HasProperty(O, ! ToString(k)).
-      const kPresent: Boolean = HasProperty(object, k);
+transitioning macro GenericArrayLastIndexOf(
+    context: Context, object: JSReceiver, searchElement: JSAny,
+    from: Number): JSAny {
+  let k: Number = from;
 
-      // b. If kPresent is true, then.
-      if (kPresent == True) {
-        // i. Let elementK be ? Get(O, ! ToString(k)).
-        const element: JSAny = GetProperty(object, k);
+  // 7. Repeat, while k >= 0.
+  while (k >= 0) {
+    // a. Let kPresent be ? HasProperty(O, ! ToString(k)).
+    const kPresent: Boolean = HasProperty(object, k);
 
-        // ii. Let same be the result of performing Strict Equality Comparison
-        //     searchElement === elementK.
-        const same: Boolean = StrictEqual(searchElement, element);
+    // b. If kPresent is true, then.
+    if (kPresent == True) {
+      // i. Let elementK be ? Get(O, ! ToString(k)).
+      const element: JSAny = GetProperty(object, k);
 
-        // iii. If same is true, return k.
-        if (same == True) return k;
-      }
+      // ii. Let same be the result of performing Strict Equality Comparison
+      //     searchElement === elementK.
+      const same: Boolean = StrictEqual(searchElement, element);
 
-      // c. Decrease k by 1.
-      --k;
+      // iii. If same is true, return k.
+      if (same == True) return k;
     }
 
-    // 8. Return -1.
-    return SmiConstant(-1);
+    // c. Decrease k by 1.
+    --k;
   }
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.lastIndexOf
-  transitioning javascript builtin ArrayPrototypeLastIndexOf(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    // 1. Let O be ? ToObject(this value).
-    const object: JSReceiver = ToObject_Inline(context, receiver);
+  // 8. Return -1.
+  return SmiConstant(-1);
+}
 
-    // 2. Let len be ? ToLength(? Get(O, "length")).
-    const length: Number = GetLengthProperty(object);
+// https://tc39.github.io/ecma262/#sec-array.prototype.lastIndexOf
+transitioning javascript builtin ArrayPrototypeLastIndexOf(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // 1. Let O be ? ToObject(this value).
+  const object: JSReceiver = ToObject_Inline(context, receiver);
 
-    // 3. If len is 0, return -1.
-    if (length == SmiConstant(0)) return SmiConstant(-1);
+  // 2. Let len be ? ToLength(? Get(O, "length")).
+  const length: Number = GetLengthProperty(object);
 
-    // Step 4 - 6.
-    const from: Number = GetFromIndex(context, length, arguments);
+  // 3. If len is 0, return -1.
+  if (length == SmiConstant(0)) return SmiConstant(-1);
 
-    const searchElement: JSAny = arguments[0];
+  // Step 4 - 6.
+  const from: Number = GetFromIndex(context, length, arguments);
 
-    try {
-      return TryFastArrayLastIndexOf(context, object, searchElement, from)
-          otherwise Baseline;
-    }
-    label Baseline {
-      return GenericArrayLastIndexOf(context, object, searchElement, from);
-    }
+  const searchElement: JSAny = arguments[0];
+
+  try {
+    return TryFastArrayLastIndexOf(context, object, searchElement, from)
+        otherwise Baseline;
+  } label Baseline {
+    return GenericArrayLastIndexOf(context, object, searchElement, from);
   }
 }
+}
diff --git a/deps/v8/src/builtins/array-map.tq b/deps/v8/src/builtins/array-map.tq
index 9b45341c0e2..8ff3cbaccdc 100644
--- a/deps/v8/src/builtins/array-map.tq
+++ b/deps/v8/src/builtins/array-map.tq
@@ -3,271 +3,265 @@
 // found in the LICENSE file.
 
 namespace array {
-  transitioning javascript builtin
-  ArrayMapLoopEagerDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
-      length: JSAny): JSAny {
-    // All continuation points in the optimized filter implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    //
-    // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires JSAny type for all parameters
-    // other than {context}.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const outputArray = Cast<JSReceiver>(array) otherwise unreachable;
-    const numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    return ArrayMapLoopContinuation(
-        jsreceiver, callbackfn, thisArg, outputArray, jsreceiver, numberK,
-        numberLength);
-  }
-
-  transitioning javascript builtin
-  ArrayMapLoopLazyDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
-      length: JSAny, result: JSAny): JSAny {
-    // All continuation points in the optimized filter implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const outputArray = Cast<JSReceiver>(array) otherwise unreachable;
-    let numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    // This custom lazy deopt point is right after the callback. map() needs
-    // to pick up at the next step, which is setting the callback result in
-    // the output array. After incrementing k, we can glide into the loop
-    // continuation builtin.
-
-    // iii. Perform ? CreateDataPropertyOrThrow(A, Pk, mappedValue).
-    FastCreateDataProperty(outputArray, numberK, result);
-
-    // 7d. Increase k by 1.
-    numberK = numberK + 1;
-
-    return ArrayMapLoopContinuation(
-        jsreceiver, callbackfn, thisArg, outputArray, jsreceiver, numberK,
-        numberLength);
-  }
+transitioning javascript builtin
+ArrayMapLoopEagerDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
+    length: JSAny): JSAny {
+  // All continuation points in the optimized filter implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  //
+  // Also, this great mass of casts is necessary because the signature
+  // of Torque javascript builtins requires JSAny type for all parameters
+  // other than {context}.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const outputArray = Cast<JSReceiver>(array) otherwise unreachable;
+  const numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  return ArrayMapLoopContinuation(
+      jsreceiver, callbackfn, thisArg, outputArray, jsreceiver, numberK,
+      numberLength);
+}
 
-  transitioning builtin ArrayMapLoopContinuation(implicit context: Context)(
-      _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
-      array: JSReceiver, o: JSReceiver, initialK: Number,
-      length: Number): JSAny {
-    // 6. Let k be 0.
-    // 7. Repeat, while k < len
-    for (let k: Number = initialK; k < length; k++) {
-      // 7a. Let Pk be ! ToString(k).
-      // k is guaranteed to be a positive integer, hence ToString is
-      // side-effect free and HasProperty/GetProperty do the conversion inline.
-
-      // 7b. Let kPresent be ? HasProperty(O, Pk).
-      const kPresent: Boolean = HasProperty_Inline(o, k);
-
-      // 7c. If kPresent is true, then:
-      if (kPresent == True) {
-        //  i. Let kValue be ? Get(O, Pk).
-        const kValue: JSAny = GetProperty(o, k);
-
-        // ii. Let mapped_value be ? Call(callbackfn, T, kValue, k, O).
-        const mappedValue: JSAny =
-            Call(context, callbackfn, thisArg, kValue, k, o);
-
-        // iii. Perform ? CreateDataPropertyOrThrow(A, Pk, mapped_value).
-        FastCreateDataProperty(array, k, mappedValue);
-      }
+transitioning javascript builtin
+ArrayMapLoopLazyDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
+    length: JSAny, result: JSAny): JSAny {
+  // All continuation points in the optimized filter implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const outputArray = Cast<JSReceiver>(array) otherwise unreachable;
+  let numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  // This custom lazy deopt point is right after the callback. map() needs
+  // to pick up at the next step, which is setting the callback result in
+  // the output array. After incrementing k, we can glide into the loop
+  // continuation builtin.
+
+  // iii. Perform ? CreateDataPropertyOrThrow(A, Pk, mappedValue).
+  FastCreateDataProperty(outputArray, numberK, result);
+
+  // 7d. Increase k by 1.
+  numberK = numberK + 1;
+
+  return ArrayMapLoopContinuation(
+      jsreceiver, callbackfn, thisArg, outputArray, jsreceiver, numberK,
+      numberLength);
+}
 
-      // 7d. Increase k by 1. (done by the loop).
+transitioning builtin ArrayMapLoopContinuation(implicit context: Context)(
+    _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
+    array: JSReceiver, o: JSReceiver, initialK: Number, length: Number): JSAny {
+  // 6. Let k be 0.
+  // 7. Repeat, while k < len
+  for (let k: Number = initialK; k < length; k++) {
+    // 7a. Let Pk be ! ToString(k).
+    // k is guaranteed to be a positive integer, hence ToString is
+    // side-effect free and HasProperty/GetProperty do the conversion inline.
+
+    // 7b. Let kPresent be ? HasProperty(O, Pk).
+    const kPresent: Boolean = HasProperty_Inline(o, k);
+
+    // 7c. If kPresent is true, then:
+    if (kPresent == True) {
+      //  i. Let kValue be ? Get(O, Pk).
+      const kValue: JSAny = GetProperty(o, k);
+
+      // ii. Let mapped_value be ? Call(callbackfn, T, kValue, k, O).
+      const mappedValue: JSAny =
+          Call(context, callbackfn, thisArg, kValue, k, o);
+
+      // iii. Perform ? CreateDataPropertyOrThrow(A, Pk, mapped_value).
+      FastCreateDataProperty(array, k, mappedValue);
     }
 
-    // 8. Return A.
-    return array;
+    // 7d. Increase k by 1. (done by the loop).
   }
 
-  struct Vector {
-    macro ReportSkippedElement() {
-      this.skippedElements = true;
-    }
-
-    macro CreateJSArray(implicit context: Context)(validLength: Smi): JSArray {
-      const length: Smi = this.fixedArray.length;
-      assert(validLength <= length);
-      let kind: ElementsKind = ElementsKind::PACKED_SMI_ELEMENTS;
-      if (!this.onlySmis) {
-        if (this.onlyNumbers) {
-          kind = ElementsKind::PACKED_DOUBLE_ELEMENTS;
-        } else {
-          kind = ElementsKind::PACKED_ELEMENTS;
-        }
-      }
+  // 8. Return A.
+  return array;
+}
 
-      if (this.skippedElements || validLength < length) {
-        // We also need to create a holey output array if we are
-        // bailing out of the fast path partway through the array.
-        // This is indicated by {validLength} < {length}.
-        // Who knows if the bailout condition will continue to fill in
-        // every element?
-        kind = FastHoleyElementsKind(kind);
-      }
+struct Vector {
+  macro ReportSkippedElement() {
+    this.skippedElements = true;
+  }
 
-      const map: Map = LoadJSArrayElementsMap(kind, LoadNativeContext(context));
-      let a: JSArray;
-
-      if (IsDoubleElementsKind(kind)) {
-        // We need to allocate and copy.
-        // First, initialize the elements field before allocation to prevent
-        // heap corruption.
-        const elements: FixedDoubleArray = AllocateFixedDoubleArrayWithHoles(
-            SmiUntag(length), AllocationFlag::kAllowLargeObjectAllocation);
-        a = NewJSArray(map, this.fixedArray);
-        for (let i: Smi = 0; i < validLength; i++) {
-          typeswitch (
-              UnsafeCast<(Number | TheHole)>(this.fixedArray.objects[i])) {
-            case (n: Number): {
-              elements.floats[i] = Convert<float64_or_hole>(n);
-            }
-            case (TheHole): {
-            }
-          }
-        }
-        a.elements = elements;
+  macro CreateJSArray(implicit context: Context)(validLength: Smi): JSArray {
+    const length: Smi = this.fixedArray.length;
+    assert(validLength <= length);
+    let kind: ElementsKind = ElementsKind::PACKED_SMI_ELEMENTS;
+    if (!this.onlySmis) {
+      if (this.onlyNumbers) {
+        kind = ElementsKind::PACKED_DOUBLE_ELEMENTS;
       } else {
-        // Simply install the given fixedArray in {vector}.
-        a = NewJSArray(map, this.fixedArray);
+        kind = ElementsKind::PACKED_ELEMENTS;
       }
+    }
 
-      // Paranoia. the FixedArray now "belongs" to JSArray {a}.
-      this.fixedArray = kEmptyFixedArray;
-      return a;
+    if (this.skippedElements || validLength < length) {
+      // We also need to create a holey output array if we are
+      // bailing out of the fast path partway through the array.
+      // This is indicated by {validLength} < {length}.
+      // Who knows if the bailout condition will continue to fill in
+      // every element?
+      kind = FastHoleyElementsKind(kind);
     }
 
-    macro StoreResult(implicit context: Context)(index: Smi, result: JSAny) {
-      typeswitch (result) {
-        case (s: Smi): {
-          this.fixedArray.objects[index] = s;
-        }
-        case (s: HeapNumber): {
-          this.onlySmis = false;
-          this.fixedArray.objects[index] = s;
-        }
-        case (s: JSAnyNotNumber): {
-          this.onlySmis = false;
-          this.onlyNumbers = false;
-          this.fixedArray.objects[index] = s;
+    const map: Map = LoadJSArrayElementsMap(kind, LoadNativeContext(context));
+    let a: JSArray;
+
+    if (IsDoubleElementsKind(kind)) {
+      // We need to allocate and copy.
+      // First, initialize the elements field before allocation to prevent
+      // heap corruption.
+      const elements: FixedDoubleArray = AllocateFixedDoubleArrayWithHoles(
+          SmiUntag(length), AllocationFlag::kAllowLargeObjectAllocation);
+      a = NewJSArray(map, this.fixedArray);
+      for (let i: Smi = 0; i < validLength; i++) {
+        typeswitch (
+            UnsafeCast<(Number | TheHole)>(this.fixedArray.objects[i])) {
+          case (n: Number): {
+            elements.floats[i] = Convert<float64_or_hole>(n);
+          }
+          case (TheHole): {
+          }
         }
       }
+      a.elements = elements;
+    } else {
+      // Simply install the given fixedArray in {vector}.
+      a = NewJSArray(map, this.fixedArray);
     }
 
-    fixedArray: FixedArray;
-    onlySmis: bool;         // initially true.
-    onlyNumbers: bool;      // initially true.
-    skippedElements: bool;  // initially false.
+    // Paranoia. the FixedArray now "belongs" to JSArray {a}.
+    this.fixedArray = kEmptyFixedArray;
+    return a;
   }
 
-  macro NewVector(implicit context: Context)(length: Smi): Vector {
-    const fixedArray = length > 0 ?
-        AllocateFixedArrayWithHoles(
-            SmiUntag(length), AllocationFlag::kAllowLargeObjectAllocation) :
-        kEmptyFixedArray;
-    return Vector{
-      fixedArray,
-      onlySmis: true,
-      onlyNumbers: true,
-      skippedElements: false
-    };
+  macro StoreResult(implicit context: Context)(index: Smi, result: JSAny) {
+    typeswitch (result) {
+      case (s: Smi): {
+        this.fixedArray.objects[index] = s;
+      }
+      case (s: HeapNumber): {
+        this.onlySmis = false;
+        this.fixedArray.objects[index] = s;
+      }
+      case (s: JSAnyNotNumber): {
+        this.onlySmis = false;
+        this.onlyNumbers = false;
+        this.fixedArray.objects[index] = s;
+      }
+    }
   }
 
-  transitioning macro FastArrayMap(implicit context: Context)(
-      fastO: FastJSArrayForRead, len: Smi, callbackfn: Callable,
-      thisArg: JSAny): JSArray
-      labels Bailout(JSArray, Smi) {
-    let k: Smi = 0;
-    let fastOW = NewFastJSArrayForReadWitness(fastO);
-    let vector = NewVector(len);
+  fixedArray: FixedArray;
+  onlySmis: bool;         // initially true.
+  onlyNumbers: bool;      // initially true.
+  skippedElements: bool;  // initially false.
+}
 
-    // Build a fast loop over the smi array.
-    // 7. Repeat, while k < len.
-    try {
-      for (; k < len; k++) {
-        fastOW.Recheck() otherwise goto PrepareBailout(k);
-
-        // Ensure that we haven't walked beyond a possibly updated length.
-        if (k >= fastOW.Get().length) goto PrepareBailout(k);
-
-        try {
-          const value: JSAny = fastOW.LoadElementNoHole(k)
-              otherwise FoundHole;
-          const result: JSAny =
-              Call(context, callbackfn, thisArg, value, k, fastOW.Get());
-          vector.StoreResult(k, result);
-        }
-        label FoundHole {
-          // Our output array must necessarily be holey because of holes in
-          // the input array.
-          vector.ReportSkippedElement();
-        }
+macro NewVector(implicit context: Context)(length: Smi): Vector {
+  const fixedArray = length > 0 ?
+      AllocateFixedArrayWithHoles(
+          SmiUntag(length), AllocationFlag::kAllowLargeObjectAllocation) :
+      kEmptyFixedArray;
+  return Vector{
+    fixedArray,
+    onlySmis: true,
+    onlyNumbers: true,
+    skippedElements: false
+  };
+}
+
+transitioning macro FastArrayMap(implicit context: Context)(
+    fastO: FastJSArrayForRead, len: Smi, callbackfn: Callable,
+    thisArg: JSAny): JSArray
+    labels Bailout(JSArray, Smi) {
+  let k: Smi = 0;
+  let fastOW = NewFastJSArrayForReadWitness(fastO);
+  let vector = NewVector(len);
+
+  // Build a fast loop over the smi array.
+  // 7. Repeat, while k < len.
+  try {
+    for (; k < len; k++) {
+      fastOW.Recheck() otherwise goto PrepareBailout(k);
+
+      // Ensure that we haven't walked beyond a possibly updated length.
+      if (k >= fastOW.Get().length) goto PrepareBailout(k);
+
+      try {
+        const value: JSAny = fastOW.LoadElementNoHole(k)
+            otherwise FoundHole;
+        const result: JSAny =
+            Call(context, callbackfn, thisArg, value, k, fastOW.Get());
+        vector.StoreResult(k, result);
+      } label FoundHole {
+        // Our output array must necessarily be holey because of holes in
+        // the input array.
+        vector.ReportSkippedElement();
       }
     }
-    label PrepareBailout(k: Smi) deferred {
-      // Transform {vector} into a JSArray and bail out.
-      goto Bailout(vector.CreateJSArray(k), k);
-    }
-
-    return vector.CreateJSArray(len);
+  } label PrepareBailout(k: Smi) deferred {
+    // Transform {vector} into a JSArray and bail out.
+    goto Bailout(vector.CreateJSArray(k), k);
   }
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.map
-  transitioning javascript builtin
-  ArrayMap(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
-      JSAny {
-    try {
-      RequireObjectCoercible(receiver, 'Array.prototype.map');
+  return vector.CreateJSArray(len);
+}
 
-      // 1. Let O be ? ToObject(this value).
-      const o: JSReceiver = ToObject_Inline(context, receiver);
+// https://tc39.github.io/ecma262/#sec-array.prototype.map
+transitioning javascript builtin
+ArrayMap(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  try {
+    RequireObjectCoercible(receiver, 'Array.prototype.map');
 
-      // 2. Let len be ? ToLength(? Get(O, "length")).
-      const len: Number = GetLengthProperty(o);
+    // 1. Let O be ? ToObject(this value).
+    const o: JSReceiver = ToObject_Inline(context, receiver);
 
-      // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
-      if (arguments.length == 0) goto TypeError;
+    // 2. Let len be ? ToLength(? Get(O, "length")).
+    const len: Number = GetLengthProperty(o);
 
-      const callbackfn = Cast<Callable>(arguments[0]) otherwise TypeError;
+    // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
+    if (arguments.length == 0) goto TypeError;
 
-      // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise TypeError;
 
-      let array: JSReceiver;
-      let k: Number = 0;
-      try {
-        // 5. Let A be ? ArraySpeciesCreate(O, len).
-        if (IsArraySpeciesProtectorCellInvalid()) goto SlowSpeciesCreate;
-        const o: FastJSArrayForRead = Cast<FastJSArrayForRead>(receiver)
-            otherwise SlowSpeciesCreate;
-        const smiLength: Smi = Cast<Smi>(len)
-            otherwise SlowSpeciesCreate;
-
-        return FastArrayMap(o, smiLength, callbackfn, thisArg)
-            otherwise Bailout;
-      }
-      label SlowSpeciesCreate {
-        array = ArraySpeciesCreate(context, receiver, len);
-      }
-      label Bailout(output: JSArray, kValue: Smi) deferred {
-        array = output;
-        k = kValue;
-      }
+    // 4. If thisArg is present, let T be thisArg; else let T be undefined.
+    const thisArg: JSAny = arguments[1];
 
-      return ArrayMapLoopContinuation(o, callbackfn, thisArg, array, o, k, len);
-    }
-    label TypeError deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+    let array: JSReceiver;
+    let k: Number = 0;
+    try {
+      // 5. Let A be ? ArraySpeciesCreate(O, len).
+      if (IsArraySpeciesProtectorCellInvalid()) goto SlowSpeciesCreate;
+      const o: FastJSArrayForRead = Cast<FastJSArrayForRead>(receiver)
+          otherwise SlowSpeciesCreate;
+      const smiLength: Smi = Cast<Smi>(len)
+          otherwise SlowSpeciesCreate;
+
+      return FastArrayMap(o, smiLength, callbackfn, thisArg)
+          otherwise Bailout;
+    } label SlowSpeciesCreate {
+      array = ArraySpeciesCreate(context, receiver, len);
+    } label Bailout(output: JSArray, kValue: Smi) deferred {
+      array = output;
+      k = kValue;
     }
+
+    return ArrayMapLoopContinuation(o, callbackfn, thisArg, array, o, k, len);
+  } label TypeError deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
   }
 }
+}
diff --git a/deps/v8/src/builtins/array-of.tq b/deps/v8/src/builtins/array-of.tq
index 2df961b9955..49c67bd8231 100644
--- a/deps/v8/src/builtins/array-of.tq
+++ b/deps/v8/src/builtins/array-of.tq
@@ -3,53 +3,53 @@
 // found in the LICENSE file.
 
 namespace array {
-  // https://tc39.github.io/ecma262/#sec-array.of
-  transitioning javascript builtin
-  ArrayOf(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
-      JSAny {
-    // 1. Let len be the actual number of arguments passed to this function.
-    const len: Smi = Convert<Smi>(arguments.length);
-
-    // 2. Let items be the List of arguments passed to this function.
-    const items: Arguments = arguments;
-
-    // 3. Let C be the this value.
-    const c: JSAny = receiver;
-
-    let a: JSReceiver;
-
-    // 4. If IsConstructor(C) is true, then
-    typeswitch (c) {
-      case (c: Constructor): {
-        // a. Let A be ? Construct(C, « len »).
-        a = Construct(c, len);
-      }
-      case (JSAny): {
-        // a. Let A be ? ArrayCreate(len).
-        a = ArrayCreate(len);
-      }
+// https://tc39.github.io/ecma262/#sec-array.of
+transitioning javascript builtin
+ArrayOf(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // 1. Let len be the actual number of arguments passed to this function.
+  const len: Smi = Convert<Smi>(arguments.length);
+
+  // 2. Let items be the List of arguments passed to this function.
+  const items: Arguments = arguments;
+
+  // 3. Let C be the this value.
+  const c: JSAny = receiver;
+
+  let a: JSReceiver;
+
+  // 4. If IsConstructor(C) is true, then
+  typeswitch (c) {
+    case (c: Constructor): {
+      // a. Let A be ? Construct(C, « len »).
+      a = Construct(c, len);
     }
+    case (JSAny): {
+      // a. Let A be ? ArrayCreate(len).
+      a = ArrayCreate(len);
+    }
+  }
 
-    // 6. Let k be 0.
-    let k: Smi = 0;
+  // 6. Let k be 0.
+  let k: Smi = 0;
 
-    // 7. Repeat, while k < len
-    while (k < len) {
-      // a. Let kValue be items[k].
-      const kValue: JSAny = items[Convert<intptr>(k)];
+  // 7. Repeat, while k < len
+  while (k < len) {
+    // a. Let kValue be items[k].
+    const kValue: JSAny = items[Convert<intptr>(k)];
 
-      // b. Let Pk be ! ToString(k).
-      // c. Perform ? CreateDataPropertyOrThrow(A, Pk, kValue).
-      FastCreateDataProperty(a, k, kValue);
+    // b. Let Pk be ! ToString(k).
+    // c. Perform ? CreateDataPropertyOrThrow(A, Pk, kValue).
+    FastCreateDataProperty(a, k, kValue);
 
-      // d. Increase k by 1.
-      k++;
-    }
+    // d. Increase k by 1.
+    k++;
+  }
 
-    // 8. Perform ? Set(A, "length", len, true).
-    array::SetPropertyLength(a, len);
+  // 8. Perform ? Set(A, "length", len, true).
+  array::SetPropertyLength(a, len);
 
-    // 9. Return A.
-    return a;
-  }
+  // 9. Return A.
+  return a;
+}
 }
diff --git a/deps/v8/src/builtins/array-reduce-right.tq b/deps/v8/src/builtins/array-reduce-right.tq
index 45055862723..90e0e496f8f 100644
--- a/deps/v8/src/builtins/array-reduce-right.tq
+++ b/deps/v8/src/builtins/array-reduce-right.tq
@@ -3,198 +3,195 @@
 // found in the LICENSE file.
 
 namespace array {
-  transitioning javascript builtin
-  ArrayReduceRightPreLoopEagerDeoptContinuation(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(callback: JSAny, length: JSAny): JSAny {
-    // All continuation points in the optimized every implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    //
-    // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires JSAny type for all parameters
-    // other than {context}.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-    const initialK = numberLength - 1;
-
-    // Simulate starting the loop at {length - 1}, but ensuring that the
-    // accumulator is the hole. The continuation stub will search for the
-    // last non-hole element, rightly throwing an exception if not found.
-    return ArrayReduceRightLoopContinuation(
-        jsreceiver, callbackfn, TheHole, jsreceiver, initialK, numberLength);
-  }
-
-  transitioning javascript builtin
-  ArrayReduceRightLoopEagerDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, initialK: JSAny, length: JSAny,
-      accumulator: JSAny): JSAny {
-    // All continuation points in the optimized every implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    //
-    // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires JSAny type for all parameters
-    // other than {context}.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    return ArrayReduceRightLoopContinuation(
-        jsreceiver, callbackfn, accumulator, jsreceiver, numberK, numberLength);
-  }
-
-  transitioning javascript builtin
-  ArrayReduceRightLoopLazyDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, initialK: JSAny, length: JSAny, result: JSAny): JSAny {
-    // All continuation points in the optimized every implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    // The accumulator is the result from the callback call which just occured.
-    const r = ArrayReduceRightLoopContinuation(
-        jsreceiver, callbackfn, result, jsreceiver, numberK, numberLength);
-    return r;
-  }
+transitioning javascript builtin
+ArrayReduceRightPreLoopEagerDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, length: JSAny): JSAny {
+  // All continuation points in the optimized every implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  //
+  // Also, this great mass of casts is necessary because the signature
+  // of Torque javascript builtins requires JSAny type for all parameters
+  // other than {context}.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+  const initialK = numberLength - 1;
+
+  // Simulate starting the loop at {length - 1}, but ensuring that the
+  // accumulator is the hole. The continuation stub will search for the
+  // last non-hole element, rightly throwing an exception if not found.
+  return ArrayReduceRightLoopContinuation(
+      jsreceiver, callbackfn, TheHole, jsreceiver, initialK, numberLength);
+}
 
-  transitioning builtin ArrayReduceRightLoopContinuation(implicit context:
-                                                             Context)(
-      _receiver: JSReceiver, callbackfn: Callable,
-      initialAccumulator: JSAny|TheHole, o: JSReceiver, initialK: Number,
-      _length: Number): JSAny {
-    let accumulator = initialAccumulator;
-
-    // 8b and 9. Repeat, while k >= 0
-    for (let k: Number = initialK; k >= 0; k--) {
-      // 8b i and 9a. Let Pk be ! ToString(k).
-      // k is guaranteed to be a positive integer, hence ToString is
-      // side-effect free and HasProperty/GetProperty do the conversion inline.
-
-      // 8b ii and 9b. Set kPresent to ? HasProperty(O, Pk).
-      const present: Boolean = HasProperty_Inline(o, k);
-
-      // 8b iii and 9c. If kPresent is true, then
-      if (present == True) {
-        // 8b iii and 9c i. Let kValue be ? Get(O, Pk).
-        const value: JSAny = GetProperty(o, k);
-
-        typeswitch (accumulator) {
-          case (TheHole): {
-            // 8b iii 1.
-            accumulator = value;
-          }
-          case (accumulatorNotHole: JSAny): {
-            // 9c. ii. Set accumulator to ? Call(callbackfn, undefined,
-            //         <accumulator, kValue, k, O>).
-            accumulator = Call(
-                context, callbackfn, Undefined, accumulatorNotHole, value, k,
-                o);
-          }
-        }
-      }
+transitioning javascript builtin
+ArrayReduceRightLoopEagerDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, initialK: JSAny, length: JSAny,
+    accumulator: JSAny): JSAny {
+  // All continuation points in the optimized every implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  //
+  // Also, this great mass of casts is necessary because the signature
+  // of Torque javascript builtins requires JSAny type for all parameters
+  // other than {context}.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  return ArrayReduceRightLoopContinuation(
+      jsreceiver, callbackfn, accumulator, jsreceiver, numberK, numberLength);
+}
 
-      // 8b iv and 9d. Decrease k by 1. (done by the loop).
-    }
+transitioning javascript builtin
+ArrayReduceRightLoopLazyDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, initialK: JSAny, length: JSAny, result: JSAny): JSAny {
+  // All continuation points in the optimized every implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  // The accumulator is the result from the callback call which just occured.
+  const r = ArrayReduceRightLoopContinuation(
+      jsreceiver, callbackfn, result, jsreceiver, numberK, numberLength);
+  return r;
+}
 
-    // 8c. if kPresent is false, throw a TypeError exception.
-    // If the accumulator is discovered with the sentinel hole value,
-    // this means kPresent is false.
-    typeswitch (accumulator) {
-      case (TheHole): {
-        ThrowTypeError(
-            MessageTemplate::kReduceNoInitial, 'Array.prototype.reduceRight');
-      }
-      case (accumulator: JSAny): {
-        return accumulator;
-      }
-    }
-  }
+transitioning builtin ArrayReduceRightLoopContinuation(
+    implicit context: Context)(
+    _receiver: JSReceiver, callbackfn: Callable,
+    initialAccumulator: JSAny|TheHole, o: JSReceiver, initialK: Number,
+    _length: Number): JSAny {
+  let accumulator = initialAccumulator;
 
-  transitioning macro FastArrayReduceRight(implicit context: Context)(
-      o: JSReceiver, len: Number, callbackfn: Callable,
-      initialAccumulator: JSAny|TheHole): JSAny
-      labels Bailout(Number, JSAny|TheHole) {
-    let accumulator = initialAccumulator;
-    const smiLen = Cast<Smi>(len) otherwise goto Bailout(len - 1, accumulator);
-    const fastO = Cast<FastJSArrayForRead>(o)
-        otherwise goto Bailout(len - 1, accumulator);
-    let fastOW = NewFastJSArrayForReadWitness(fastO);
+  // 8b and 9. Repeat, while k >= 0
+  for (let k: Number = initialK; k >= 0; k--) {
+    // 8b i and 9a. Let Pk be ! ToString(k).
+    // k is guaranteed to be a positive integer, hence ToString is
+    // side-effect free and HasProperty/GetProperty do the conversion inline.
 
-    // Build a fast loop over the array.
-    for (let k: Smi = smiLen - 1; k >= 0; k--) {
-      fastOW.Recheck() otherwise goto Bailout(k, accumulator);
+    // 8b ii and 9b. Set kPresent to ? HasProperty(O, Pk).
+    const present: Boolean = HasProperty_Inline(o, k);
 
-      // Ensure that we haven't walked beyond a possibly updated length.
-      if (k >= fastOW.Get().length) goto Bailout(k, accumulator);
+    // 8b iii and 9c. If kPresent is true, then
+    if (present == True) {
+      // 8b iii and 9c i. Let kValue be ? Get(O, Pk).
+      const value: JSAny = GetProperty(o, k);
 
-      const value: JSAny = fastOW.LoadElementNoHole(k) otherwise continue;
       typeswitch (accumulator) {
         case (TheHole): {
+          // 8b iii 1.
           accumulator = value;
         }
         case (accumulatorNotHole: JSAny): {
+          // 9c. ii. Set accumulator to ? Call(callbackfn, undefined,
+          //         <accumulator, kValue, k, O>).
           accumulator = Call(
-              context, callbackfn, Undefined, accumulatorNotHole, value, k,
-              fastOW.Get());
+              context, callbackfn, Undefined, accumulatorNotHole, value, k, o);
         }
       }
     }
+
+    // 8b iv and 9d. Decrease k by 1. (done by the loop).
+  }
+
+  // 8c. if kPresent is false, throw a TypeError exception.
+  // If the accumulator is discovered with the sentinel hole value,
+  // this means kPresent is false.
+  typeswitch (accumulator) {
+    case (TheHole): {
+      ThrowTypeError(
+          MessageTemplate::kReduceNoInitial, 'Array.prototype.reduceRight');
+    }
+    case (accumulator: JSAny): {
+      return accumulator;
+    }
+  }
+}
+
+transitioning macro FastArrayReduceRight(implicit context: Context)(
+    o: JSReceiver, len: Number, callbackfn: Callable,
+    initialAccumulator: JSAny|TheHole): JSAny
+    labels Bailout(Number, JSAny | TheHole) {
+  let accumulator = initialAccumulator;
+  const smiLen = Cast<Smi>(len) otherwise goto Bailout(len - 1, accumulator);
+  const fastO = Cast<FastJSArrayForRead>(o)
+      otherwise goto Bailout(len - 1, accumulator);
+  let fastOW = NewFastJSArrayForReadWitness(fastO);
+
+  // Build a fast loop over the array.
+  for (let k: Smi = smiLen - 1; k >= 0; k--) {
+    fastOW.Recheck() otherwise goto Bailout(k, accumulator);
+
+    // Ensure that we haven't walked beyond a possibly updated length.
+    if (k >= fastOW.Get().length) goto Bailout(k, accumulator);
+
+    const value: JSAny = fastOW.LoadElementNoHole(k) otherwise continue;
     typeswitch (accumulator) {
       case (TheHole): {
-        ThrowTypeError(
-            MessageTemplate::kReduceNoInitial, 'Array.prototype.reduceRight');
+        accumulator = value;
       }
-      case (accumulator: JSAny): {
-        return accumulator;
+      case (accumulatorNotHole: JSAny): {
+        accumulator = Call(
+            context, callbackfn, Undefined, accumulatorNotHole, value, k,
+            fastOW.Get());
       }
     }
   }
+  typeswitch (accumulator) {
+    case (TheHole): {
+      ThrowTypeError(
+          MessageTemplate::kReduceNoInitial, 'Array.prototype.reduceRight');
+    }
+    case (accumulator: JSAny): {
+      return accumulator;
+    }
+  }
+}
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.reduceRight
-  transitioning javascript builtin
-  ArrayReduceRight(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSAny {
-    try {
-      RequireObjectCoercible(receiver, 'Array.prototype.reduceRight');
+// https://tc39.github.io/ecma262/#sec-array.prototype.reduceRight
+transitioning javascript builtin
+ArrayReduceRight(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  try {
+    RequireObjectCoercible(receiver, 'Array.prototype.reduceRight');
 
-      // 1. Let O be ? ToObject(this value).
-      const o: JSReceiver = ToObject_Inline(context, receiver);
+    // 1. Let O be ? ToObject(this value).
+    const o: JSReceiver = ToObject_Inline(context, receiver);
 
-      // 2. Let len be ? ToLength(? Get(O, "length")).
-      const len: Number = GetLengthProperty(o);
+    // 2. Let len be ? ToLength(? Get(O, "length")).
+    const len: Number = GetLengthProperty(o);
 
-      // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
-      if (arguments.length == 0) {
-        goto NoCallableError;
-      }
-      const callbackfn = Cast<Callable>(arguments[0]) otherwise NoCallableError;
+    // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
+    if (arguments.length == 0) {
+      goto NoCallableError;
+    }
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise NoCallableError;
 
-      // 4. If len is 0 and initialValue is not present, throw a TypeError
-      // exception. (This case is handled at the end of
-      // ArrayReduceRightLoopContinuation).
+    // 4. If len is 0 and initialValue is not present, throw a TypeError
+    // exception. (This case is handled at the end of
+    // ArrayReduceRightLoopContinuation).
 
-      const initialValue: JSAny|TheHole =
-          arguments.length > 1 ? arguments[1] : TheHole;
+    const initialValue: JSAny|TheHole =
+        arguments.length > 1 ? arguments[1] : TheHole;
 
-      try {
-        return FastArrayReduceRight(o, len, callbackfn, initialValue)
-            otherwise Bailout;
-      }
-      label Bailout(value: Number, accumulator: JSAny|TheHole) {
-        return ArrayReduceRightLoopContinuation(
-            o, callbackfn, accumulator, o, value, len);
-      }
-    }
-    label NoCallableError deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+    try {
+      return FastArrayReduceRight(o, len, callbackfn, initialValue)
+          otherwise Bailout;
+    } label Bailout(value: Number, accumulator: JSAny|TheHole) {
+      return ArrayReduceRightLoopContinuation(
+          o, callbackfn, accumulator, o, value, len);
     }
+  } label NoCallableError deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
   }
 }
+}
diff --git a/deps/v8/src/builtins/array-reduce.tq b/deps/v8/src/builtins/array-reduce.tq
index 4a03776bd4e..8ab85a0cb61 100644
--- a/deps/v8/src/builtins/array-reduce.tq
+++ b/deps/v8/src/builtins/array-reduce.tq
@@ -3,197 +3,194 @@
 // found in the LICENSE file.
 
 namespace array {
-  transitioning javascript builtin
-  ArrayReducePreLoopEagerDeoptContinuation(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(callback: JSAny, length: JSAny): JSAny {
-    // All continuation points in the optimized every implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    //
-    // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires JSAny type for all parameters
-    // other than {context}.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    // Simulate starting the loop at 0, but ensuring that the accumulator is
-    // the hole. The continuation stub will search for the initial non-hole
-    // element, rightly throwing an exception if not found.
-    return ArrayReduceLoopContinuation(
-        jsreceiver, callbackfn, TheHole, jsreceiver, 0, numberLength);
-  }
+transitioning javascript builtin
+ArrayReducePreLoopEagerDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, length: JSAny): JSAny {
+  // All continuation points in the optimized every implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  //
+  // Also, this great mass of casts is necessary because the signature
+  // of Torque javascript builtins requires JSAny type for all parameters
+  // other than {context}.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  // Simulate starting the loop at 0, but ensuring that the accumulator is
+  // the hole. The continuation stub will search for the initial non-hole
+  // element, rightly throwing an exception if not found.
+  return ArrayReduceLoopContinuation(
+      jsreceiver, callbackfn, TheHole, jsreceiver, 0, numberLength);
+}
 
-  transitioning javascript builtin
-  ArrayReduceLoopEagerDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, initialK: JSAny, length: JSAny,
-      accumulator: JSAny): JSAny {
-    // All continuation points in the optimized every implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    //
-    // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires JSAny type for all parameters
-    // other than {context}.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    return ArrayReduceLoopContinuation(
-        jsreceiver, callbackfn, accumulator, jsreceiver, numberK, numberLength);
-  }
+transitioning javascript builtin
+ArrayReduceLoopEagerDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, initialK: JSAny, length: JSAny,
+    accumulator: JSAny): JSAny {
+  // All continuation points in the optimized every implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  //
+  // Also, this great mass of casts is necessary because the signature
+  // of Torque javascript builtins requires JSAny type for all parameters
+  // other than {context}.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  return ArrayReduceLoopContinuation(
+      jsreceiver, callbackfn, accumulator, jsreceiver, numberK, numberLength);
+}
 
-  transitioning javascript builtin
-  ArrayReduceLoopLazyDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, initialK: JSAny, length: JSAny, result: JSAny): JSAny {
-    // All continuation points in the optimized every implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    // The accumulator is the result from the callback call which just occured.
-    const r = ArrayReduceLoopContinuation(
-        jsreceiver, callbackfn, result, jsreceiver, numberK, numberLength);
-    return r;
-  }
+transitioning javascript builtin
+ArrayReduceLoopLazyDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, initialK: JSAny, length: JSAny, result: JSAny): JSAny {
+  // All continuation points in the optimized every implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  // The accumulator is the result from the callback call which just occured.
+  const r = ArrayReduceLoopContinuation(
+      jsreceiver, callbackfn, result, jsreceiver, numberK, numberLength);
+  return r;
+}
 
-  transitioning builtin ArrayReduceLoopContinuation(implicit context: Context)(
-      _receiver: JSReceiver, callbackfn: Callable,
-      initialAccumulator: JSAny|TheHole, o: JSReceiver, initialK: Number,
-      length: Number): JSAny {
-    let accumulator = initialAccumulator;
-
-    // 8b and 9. Repeat, while k < len
-    for (let k: Number = initialK; k < length; k++) {
-      // 8b i and 9a. Let Pk be ! ToString(k).
-      // k is guaranteed to be a positive integer, hence ToString is
-      // side-effect free and HasProperty/GetProperty do the conversion inline.
-
-      // 8b ii and 9b. Set kPresent to ? HasProperty(O, Pk).
-      const present: Boolean = HasProperty_Inline(o, k);
-
-      // 6c. If kPresent is true, then
-      if (present == True) {
-        // 6c. i. Let kValue be ? Get(O, Pk).
-        const value: JSAny = GetProperty(o, k);
-
-        typeswitch (accumulator) {
-          case (TheHole): {
-            // 8b.
-            accumulator = value;
-          }
-          case (accumulatorNotHole: JSAny): {
-            // 9c. ii. Set accumulator to ? Call(callbackfn, undefined,
-            //         <accumulator, kValue, k, O>).
-            accumulator = Call(
-                context, callbackfn, Undefined, accumulatorNotHole, value, k,
-                o);
-          }
-        }
-      }
+transitioning builtin ArrayReduceLoopContinuation(implicit context: Context)(
+    _receiver: JSReceiver, callbackfn: Callable,
+    initialAccumulator: JSAny|TheHole, o: JSReceiver, initialK: Number,
+    length: Number): JSAny {
+  let accumulator = initialAccumulator;
 
-      // 8b iv and 9d. Increase k by 1. (done by the loop).
-    }
+  // 8b and 9. Repeat, while k < len
+  for (let k: Number = initialK; k < length; k++) {
+    // 8b i and 9a. Let Pk be ! ToString(k).
+    // k is guaranteed to be a positive integer, hence ToString is
+    // side-effect free and HasProperty/GetProperty do the conversion inline.
 
-    // 8c. if kPresent is false, throw a TypeError exception.
-    // If the accumulator is discovered with the sentinel hole value,
-    // this means kPresent is false.
-    typeswitch (accumulator) {
-      case (TheHole): {
-        ThrowTypeError(
-            MessageTemplate::kReduceNoInitial, 'Array.prototype.reduce');
-      }
-      case (accumulator: JSAny): {
-        return accumulator;
-      }
-    }
-  }
+    // 8b ii and 9b. Set kPresent to ? HasProperty(O, Pk).
+    const present: Boolean = HasProperty_Inline(o, k);
+
+    // 6c. If kPresent is true, then
+    if (present == True) {
+      // 6c. i. Let kValue be ? Get(O, Pk).
+      const value: JSAny = GetProperty(o, k);
 
-  transitioning macro FastArrayReduce(implicit context: Context)(
-      o: JSReceiver, len: Number, callbackfn: Callable,
-      initialAccumulator: JSAny|TheHole): JSAny
-      labels Bailout(Number, JSAny|TheHole) {
-    const k = 0;
-    let accumulator = initialAccumulator;
-    Cast<Smi>(len) otherwise goto Bailout(k, accumulator);
-    const fastO =
-        Cast<FastJSArrayForRead>(o) otherwise goto Bailout(k, accumulator);
-    let fastOW = NewFastJSArrayForReadWitness(fastO);
-
-    // Build a fast loop over the array.
-    for (let k: Smi = 0; k < len; k++) {
-      fastOW.Recheck() otherwise goto Bailout(k, accumulator);
-
-      // Ensure that we haven't walked beyond a possibly updated length.
-      if (k >= fastOW.Get().length) goto Bailout(k, accumulator);
-
-      const value: JSAny = fastOW.LoadElementNoHole(k) otherwise continue;
       typeswitch (accumulator) {
         case (TheHole): {
+          // 8b.
           accumulator = value;
         }
         case (accumulatorNotHole: JSAny): {
+          // 9c. ii. Set accumulator to ? Call(callbackfn, undefined,
+          //         <accumulator, kValue, k, O>).
           accumulator = Call(
-              context, callbackfn, Undefined, accumulatorNotHole, value, k,
-              fastOW.Get());
+              context, callbackfn, Undefined, accumulatorNotHole, value, k, o);
         }
       }
     }
+
+    // 8b iv and 9d. Increase k by 1. (done by the loop).
+  }
+
+  // 8c. if kPresent is false, throw a TypeError exception.
+  // If the accumulator is discovered with the sentinel hole value,
+  // this means kPresent is false.
+  typeswitch (accumulator) {
+    case (TheHole): {
+      ThrowTypeError(
+          MessageTemplate::kReduceNoInitial, 'Array.prototype.reduce');
+    }
+    case (accumulator: JSAny): {
+      return accumulator;
+    }
+  }
+}
+
+transitioning macro FastArrayReduce(implicit context: Context)(
+    o: JSReceiver, len: Number, callbackfn: Callable,
+    initialAccumulator: JSAny|TheHole): JSAny
+    labels Bailout(Number, JSAny | TheHole) {
+  const k = 0;
+  let accumulator = initialAccumulator;
+  Cast<Smi>(len) otherwise goto Bailout(k, accumulator);
+  const fastO =
+      Cast<FastJSArrayForRead>(o) otherwise goto Bailout(k, accumulator);
+  let fastOW = NewFastJSArrayForReadWitness(fastO);
+
+  // Build a fast loop over the array.
+  for (let k: Smi = 0; k < len; k++) {
+    fastOW.Recheck() otherwise goto Bailout(k, accumulator);
+
+    // Ensure that we haven't walked beyond a possibly updated length.
+    if (k >= fastOW.Get().length) goto Bailout(k, accumulator);
+
+    const value: JSAny = fastOW.LoadElementNoHole(k) otherwise continue;
     typeswitch (accumulator) {
       case (TheHole): {
-        ThrowTypeError(
-            MessageTemplate::kReduceNoInitial, 'Array.prototype.reduce');
+        accumulator = value;
       }
-      case (accumulator: JSAny): {
-        return accumulator;
+      case (accumulatorNotHole: JSAny): {
+        accumulator = Call(
+            context, callbackfn, Undefined, accumulatorNotHole, value, k,
+            fastOW.Get());
       }
     }
   }
+  typeswitch (accumulator) {
+    case (TheHole): {
+      ThrowTypeError(
+          MessageTemplate::kReduceNoInitial, 'Array.prototype.reduce');
+    }
+    case (accumulator: JSAny): {
+      return accumulator;
+    }
+  }
+}
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.reduce
-  transitioning javascript builtin
-  ArrayReduce(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSAny {
-    try {
-      RequireObjectCoercible(receiver, 'Array.prototype.reduce');
+// https://tc39.github.io/ecma262/#sec-array.prototype.reduce
+transitioning javascript builtin
+ArrayReduce(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  try {
+    RequireObjectCoercible(receiver, 'Array.prototype.reduce');
 
-      // 1. Let O be ? ToObject(this value).
-      const o: JSReceiver = ToObject_Inline(context, receiver);
+    // 1. Let O be ? ToObject(this value).
+    const o: JSReceiver = ToObject_Inline(context, receiver);
 
-      // 2. Let len be ? ToLength(? Get(O, "length")).
-      const len: Number = GetLengthProperty(o);
+    // 2. Let len be ? ToLength(? Get(O, "length")).
+    const len: Number = GetLengthProperty(o);
 
-      // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
-      if (arguments.length == 0) {
-        goto NoCallableError;
-      }
-      const callbackfn = Cast<Callable>(arguments[0]) otherwise NoCallableError;
+    // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
+    if (arguments.length == 0) {
+      goto NoCallableError;
+    }
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise NoCallableError;
 
-      // 4. If len is 0 and initialValue is not present, throw a TypeError
-      // exception. (This case is handled at the end of
-      // ArrayReduceLoopContinuation).
+    // 4. If len is 0 and initialValue is not present, throw a TypeError
+    // exception. (This case is handled at the end of
+    // ArrayReduceLoopContinuation).
 
-      const initialValue: JSAny|TheHole =
-          arguments.length > 1 ? arguments[1] : TheHole;
+    const initialValue: JSAny|TheHole =
+        arguments.length > 1 ? arguments[1] : TheHole;
 
-      try {
-        return FastArrayReduce(o, len, callbackfn, initialValue)
-            otherwise Bailout;
-      }
-      label Bailout(value: Number, accumulator: JSAny|TheHole) {
-        return ArrayReduceLoopContinuation(
-            o, callbackfn, accumulator, o, value, len);
-      }
-    }
-    label NoCallableError deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+    try {
+      return FastArrayReduce(o, len, callbackfn, initialValue)
+          otherwise Bailout;
+    } label Bailout(value: Number, accumulator: JSAny|TheHole) {
+      return ArrayReduceLoopContinuation(
+          o, callbackfn, accumulator, o, value, len);
     }
+  } label NoCallableError deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
   }
 }
+}
diff --git a/deps/v8/src/builtins/array-reverse.tq b/deps/v8/src/builtins/array-reverse.tq
index 8c7c61f2ee9..11c325140ee 100644
--- a/deps/v8/src/builtins/array-reverse.tq
+++ b/deps/v8/src/builtins/array-reverse.tq
@@ -3,175 +3,170 @@
 // found in the LICENSE file.
 
 namespace array {
-  macro LoadElement<ElementsAccessor : type extends ElementsKind, T: type>(
-      elements: FixedArrayBase, index: Smi): T;
+macro LoadElement<ElementsAccessor : type extends ElementsKind, T: type>(
+    elements: FixedArrayBase, index: Smi): T;
 
-  LoadElement<array::FastPackedSmiElements, Smi>(implicit context: Context)(
-      elements: FixedArrayBase, index: Smi): Smi {
-    const elements: FixedArray = UnsafeCast<FixedArray>(elements);
-    return UnsafeCast<Smi>(elements.objects[index]);
-  }
+LoadElement<array::FastPackedSmiElements, Smi>(implicit context: Context)(
+    elements: FixedArrayBase, index: Smi): Smi {
+  const elements: FixedArray = UnsafeCast<FixedArray>(elements);
+  return UnsafeCast<Smi>(elements.objects[index]);
+}
 
-  LoadElement<array::FastPackedObjectElements, JSAny>(
-      implicit context: Context)(elements: FixedArrayBase, index: Smi): JSAny {
-    const elements: FixedArray = UnsafeCast<FixedArray>(elements);
-    return UnsafeCast<JSAny>(elements.objects[index]);
-  }
+LoadElement<array::FastPackedObjectElements, JSAny>(implicit context: Context)(
+    elements: FixedArrayBase, index: Smi): JSAny {
+  const elements: FixedArray = UnsafeCast<FixedArray>(elements);
+  return UnsafeCast<JSAny>(elements.objects[index]);
+}
 
-  LoadElement<array::FastPackedDoubleElements, float64>(
-      implicit context: Context)(elements: FixedArrayBase, index: Smi):
-      float64 {
-    const elements: FixedDoubleArray = UnsafeCast<FixedDoubleArray>(elements);
-    // This macro is only used for PACKED_DOUBLE, loading the hole should
-    // be impossible.
-    return elements.floats[index].Value() otherwise unreachable;
-  }
+LoadElement<array::FastPackedDoubleElements, float64>(
+    implicit context: Context)(elements: FixedArrayBase, index: Smi): float64 {
+  const elements: FixedDoubleArray = UnsafeCast<FixedDoubleArray>(elements);
+  // This macro is only used for PACKED_DOUBLE, loading the hole should
+  // be impossible.
+  return elements.floats[index].Value() otherwise unreachable;
+}
 
-  macro StoreElement<ElementsAccessor : type extends ElementsKind, T: type>(
-      implicit context:
-          Context)(elements: FixedArrayBase, index: Smi, value: T);
+macro StoreElement<ElementsAccessor : type extends ElementsKind, T: type>(
+    implicit context: Context)(elements: FixedArrayBase, index: Smi, value: T);
 
-  StoreElement<array::FastPackedSmiElements, Smi>(implicit context: Context)(
-      elements: FixedArrayBase, index: Smi, value: Smi) {
-    const elems: FixedArray = UnsafeCast<FixedArray>(elements);
-    StoreFixedArrayElement(elems, index, value, SKIP_WRITE_BARRIER);
-  }
+StoreElement<array::FastPackedSmiElements, Smi>(implicit context: Context)(
+    elements: FixedArrayBase, index: Smi, value: Smi) {
+  const elems: FixedArray = UnsafeCast<FixedArray>(elements);
+  StoreFixedArrayElement(elems, index, value, SKIP_WRITE_BARRIER);
+}
 
-  StoreElement<array::FastPackedObjectElements, JSAny>(
-      implicit context:
-          Context)(elements: FixedArrayBase, index: Smi, value: JSAny) {
-    const elements: FixedArray = UnsafeCast<FixedArray>(elements);
-    elements.objects[index] = value;
-  }
+StoreElement<array::FastPackedObjectElements, JSAny>(implicit context: Context)(
+    elements: FixedArrayBase, index: Smi, value: JSAny) {
+  const elements: FixedArray = UnsafeCast<FixedArray>(elements);
+  elements.objects[index] = value;
+}
+
+StoreElement<array::FastPackedDoubleElements, float64>(
+    implicit context: Context)(
+    elements: FixedArrayBase, index: Smi, value: float64) {
+  const elems: FixedDoubleArray = UnsafeCast<FixedDoubleArray>(elements);
+  StoreFixedDoubleArrayElementSmi(elems, index, value);
+}
 
-  StoreElement<array::FastPackedDoubleElements, float64>(
-      implicit context:
-          Context)(elements: FixedArrayBase, index: Smi, value: float64) {
-    const elems: FixedDoubleArray = UnsafeCast<FixedDoubleArray>(elements);
-    StoreFixedDoubleArrayElementSmi(elems, index, value);
+// Fast-path for all PACKED_* elements kinds. These do not need to check
+// whether a property is present, so we can simply swap them using fast
+// FixedArray loads/stores.
+macro FastPackedArrayReverse<Accessor: type, T: type>(
+    implicit context: Context)(elements: FixedArrayBase, length: Smi) {
+  let lower: Smi = 0;
+  let upper: Smi = length - 1;
+
+  while (lower < upper) {
+    const lowerValue: T = LoadElement<Accessor, T>(elements, lower);
+    const upperValue: T = LoadElement<Accessor, T>(elements, upper);
+    StoreElement<Accessor>(elements, lower, upperValue);
+    StoreElement<Accessor>(elements, upper, lowerValue);
+    ++lower;
+    --upper;
   }
+}
 
-  // Fast-path for all PACKED_* elements kinds. These do not need to check
-  // whether a property is present, so we can simply swap them using fast
-  // FixedArray loads/stores.
-  macro FastPackedArrayReverse<Accessor: type, T: type>(
-      implicit context: Context)(elements: FixedArrayBase, length: Smi) {
-    let lower: Smi = 0;
-    let upper: Smi = length - 1;
-
-    while (lower < upper) {
-      const lowerValue: T = LoadElement<Accessor, T>(elements, lower);
-      const upperValue: T = LoadElement<Accessor, T>(elements, upper);
-      StoreElement<Accessor>(elements, lower, upperValue);
-      StoreElement<Accessor>(elements, upper, lowerValue);
-      ++lower;
-      --upper;
+transitioning macro GenericArrayReverse(
+    context: Context, receiver: JSAny): JSAny {
+  // 1. Let O be ? ToObject(this value).
+  const object: JSReceiver = ToObject_Inline(context, receiver);
+
+  // 2. Let len be ? ToLength(? Get(O, "length")).
+  const length: Number = GetLengthProperty(object);
+
+  // 3. Let middle be floor(len / 2).
+  // 4. Let lower be 0.
+  // 5. Repeat, while lower != middle.
+  //   a. Let upper be len - lower - 1.
+
+  // Instead of calculating the middle value, we simply initialize upper
+  // with len - 1 and decrement it after each iteration.
+  let lower: Number = 0;
+  let upper: Number = length - 1;
+
+  while (lower < upper) {
+    let lowerValue: JSAny = Undefined;
+    let upperValue: JSAny = Undefined;
+
+    // b. Let upperP be ! ToString(upper).
+    // c. Let lowerP be ! ToString(lower).
+    // d. Let lowerExists be ? HasProperty(O, lowerP).
+    const lowerExists: Boolean = HasProperty(object, lower);
+
+    // e. If lowerExists is true, then.
+    if (lowerExists == True) {
+      // i. Let lowerValue be ? Get(O, lowerP).
+      lowerValue = GetProperty(object, lower);
     }
-  }
 
-  transitioning macro GenericArrayReverse(context: Context, receiver: JSAny):
-      JSAny {
-    // 1. Let O be ? ToObject(this value).
-    const object: JSReceiver = ToObject_Inline(context, receiver);
-
-    // 2. Let len be ? ToLength(? Get(O, "length")).
-    const length: Number = GetLengthProperty(object);
-
-    // 3. Let middle be floor(len / 2).
-    // 4. Let lower be 0.
-    // 5. Repeat, while lower != middle.
-    //   a. Let upper be len - lower - 1.
-
-    // Instead of calculating the middle value, we simply initialize upper
-    // with len - 1 and decrement it after each iteration.
-    let lower: Number = 0;
-    let upper: Number = length - 1;
-
-    while (lower < upper) {
-      let lowerValue: JSAny = Undefined;
-      let upperValue: JSAny = Undefined;
-
-      // b. Let upperP be ! ToString(upper).
-      // c. Let lowerP be ! ToString(lower).
-      // d. Let lowerExists be ? HasProperty(O, lowerP).
-      const lowerExists: Boolean = HasProperty(object, lower);
-
-      // e. If lowerExists is true, then.
-      if (lowerExists == True) {
-        // i. Let lowerValue be ? Get(O, lowerP).
-        lowerValue = GetProperty(object, lower);
-      }
-
-      // f. Let upperExists be ? HasProperty(O, upperP).
-      const upperExists: Boolean = HasProperty(object, upper);
-
-      // g. If upperExists is true, then.
-      if (upperExists == True) {
-        // i. Let upperValue be ? Get(O, upperP).
-        upperValue = GetProperty(object, upper);
-      }
-
-      // h. If lowerExists is true and upperExists is true, then
-      if (lowerExists == True && upperExists == True) {
-        // i. Perform ? Set(O, lowerP, upperValue, true).
-        SetProperty(object, lower, upperValue);
-
-        // ii. Perform ? Set(O, upperP, lowerValue, true).
-        SetProperty(object, upper, lowerValue);
-      } else if (lowerExists == False && upperExists == True) {
-        // i. Perform ? Set(O, lowerP, upperValue, true).
-        SetProperty(object, lower, upperValue);
-
-        // ii. Perform ? DeletePropertyOrThrow(O, upperP).
-        DeleteProperty(object, upper, LanguageMode::kStrict);
-      } else if (lowerExists == True && upperExists == False) {
-        // i. Perform ? DeletePropertyOrThrow(O, lowerP).
-        DeleteProperty(object, lower, LanguageMode::kStrict);
-
-        // ii. Perform ? Set(O, upperP, lowerValue, true).
-        SetProperty(object, upper, lowerValue);
-      }
-
-      // l. Increase lower by 1.
-      ++lower;
-      --upper;
+    // f. Let upperExists be ? HasProperty(O, upperP).
+    const upperExists: Boolean = HasProperty(object, upper);
+
+    // g. If upperExists is true, then.
+    if (upperExists == True) {
+      // i. Let upperValue be ? Get(O, upperP).
+      upperValue = GetProperty(object, upper);
     }
 
-    // 6. Return O.
-    return object;
+    // h. If lowerExists is true and upperExists is true, then
+    if (lowerExists == True && upperExists == True) {
+      // i. Perform ? Set(O, lowerP, upperValue, true).
+      SetProperty(object, lower, upperValue);
+
+      // ii. Perform ? Set(O, upperP, lowerValue, true).
+      SetProperty(object, upper, lowerValue);
+    } else if (lowerExists == False && upperExists == True) {
+      // i. Perform ? Set(O, lowerP, upperValue, true).
+      SetProperty(object, lower, upperValue);
+
+      // ii. Perform ? DeletePropertyOrThrow(O, upperP).
+      DeleteProperty(object, upper, LanguageMode::kStrict);
+    } else if (lowerExists == True && upperExists == False) {
+      // i. Perform ? DeletePropertyOrThrow(O, lowerP).
+      DeleteProperty(object, lower, LanguageMode::kStrict);
+
+      // ii. Perform ? Set(O, upperP, lowerValue, true).
+      SetProperty(object, upper, lowerValue);
+    }
+
+    // l. Increase lower by 1.
+    ++lower;
+    --upper;
   }
 
-  macro TryFastPackedArrayReverse(implicit context: Context)(receiver: JSAny)
-      labels Slow {
-    const array: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
-
-    const kind: ElementsKind = array.map.elements_kind;
-    if (kind == ElementsKind::PACKED_SMI_ELEMENTS) {
-      array::EnsureWriteableFastElements(array);
-      FastPackedArrayReverse<array::FastPackedSmiElements, Smi>(
-          array.elements, array.length);
-    } else if (kind == ElementsKind::PACKED_ELEMENTS) {
-      array::EnsureWriteableFastElements(array);
-      FastPackedArrayReverse<array::FastPackedObjectElements, JSAny>(
-          array.elements, array.length);
-    } else if (kind == ElementsKind::PACKED_DOUBLE_ELEMENTS) {
-      FastPackedArrayReverse<array::FastPackedDoubleElements, float64>(
-          array.elements, array.length);
-    } else {
-      goto Slow;
-    }
+  // 6. Return O.
+  return object;
+}
+
+macro TryFastPackedArrayReverse(implicit context: Context)(receiver: JSAny)
+    labels Slow {
+  const array: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
+
+  const kind: ElementsKind = array.map.elements_kind;
+  if (kind == ElementsKind::PACKED_SMI_ELEMENTS) {
+    array::EnsureWriteableFastElements(array);
+    FastPackedArrayReverse<array::FastPackedSmiElements, Smi>(
+        array.elements, array.length);
+  } else if (kind == ElementsKind::PACKED_ELEMENTS) {
+    array::EnsureWriteableFastElements(array);
+    FastPackedArrayReverse<array::FastPackedObjectElements, JSAny>(
+        array.elements, array.length);
+  } else if (kind == ElementsKind::PACKED_DOUBLE_ELEMENTS) {
+    FastPackedArrayReverse<array::FastPackedDoubleElements, float64>(
+        array.elements, array.length);
+  } else {
+    goto Slow;
   }
+}
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.reverse
-  transitioning javascript builtin ArrayPrototypeReverse(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    try {
-      TryFastPackedArrayReverse(receiver) otherwise Baseline;
-      return receiver;
-    }
-    label Baseline {
-      return GenericArrayReverse(context, receiver);
-    }
+// https://tc39.github.io/ecma262/#sec-array.prototype.reverse
+transitioning javascript builtin ArrayPrototypeReverse(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  try {
+    TryFastPackedArrayReverse(receiver) otherwise Baseline;
+    return receiver;
+  } label Baseline {
+    return GenericArrayReverse(context, receiver);
   }
 }
+}
diff --git a/deps/v8/src/builtins/array-shift.tq b/deps/v8/src/builtins/array-shift.tq
index d32d6be32e3..ed1087a85af 100644
--- a/deps/v8/src/builtins/array-shift.tq
+++ b/deps/v8/src/builtins/array-shift.tq
@@ -3,110 +3,107 @@
 // found in the LICENSE file.
 
 namespace array {
-  extern builtin ArrayShift(Context, JSFunction, JSAny, int32): JSAny;
+extern builtin ArrayShift(Context, JSFunction, JSAny, int32): JSAny;
 
-  macro TryFastArrayShift(implicit context: Context)(receiver: JSAny): JSAny
-      labels Slow, Runtime {
-    const array: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
-    let witness = NewFastJSArrayWitness(array);
+macro TryFastArrayShift(implicit context: Context)(receiver: JSAny): JSAny
+    labels Slow, Runtime {
+  const array: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
+  let witness = NewFastJSArrayWitness(array);
 
-    witness.EnsureArrayPushable() otherwise Slow;
+  witness.EnsureArrayPushable() otherwise Slow;
 
-    if (array.length == 0) {
-      return Undefined;
-    }
+  if (array.length == 0) {
+    return Undefined;
+  }
 
-    const newLength = array.length - 1;
+  const newLength = array.length - 1;
 
-    // Check that we're not supposed to right-trim the backing store, as
-    // implemented in elements.cc:ElementsAccessorBase::SetLengthImpl.
-    if ((newLength + newLength + kMinAddedElementsCapacity) <
-        array.elements.length) {
-      goto Runtime;
-    }
+  // Check that we're not supposed to right-trim the backing store, as
+  // implemented in elements.cc:ElementsAccessorBase::SetLengthImpl.
+  if ((newLength + newLength + kMinAddedElementsCapacity) <
+      array.elements.length) {
+    goto Runtime;
+  }
 
-    // Check that we're not supposed to left-trim the backing store, as
-    // implemented in elements.cc:FastElementsAccessor::MoveElements.
-    if (newLength > kMaxCopyElements) goto Runtime;
+  // Check that we're not supposed to left-trim the backing store, as
+  // implemented in elements.cc:FastElementsAccessor::MoveElements.
+  if (newLength > kMaxCopyElements) goto Runtime;
 
-    const result = witness.LoadElementOrUndefined(0);
-    witness.ChangeLength(newLength);
-    witness.MoveElements(0, 1, Convert<intptr>(newLength));
-    witness.StoreHole(newLength);
-    return result;
-  }
+  const result = witness.LoadElementOrUndefined(0);
+  witness.ChangeLength(newLength);
+  witness.MoveElements(0, 1, Convert<intptr>(newLength));
+  witness.StoreHole(newLength);
+  return result;
+}
 
-  transitioning macro GenericArrayShift(implicit context:
-                                            Context)(receiver: JSAny): JSAny {
-    // 1. Let O be ? ToObject(this value).
-    const object: JSReceiver = ToObject_Inline(context, receiver);
+transitioning macro GenericArrayShift(implicit context: Context)(
+    receiver: JSAny): JSAny {
+  // 1. Let O be ? ToObject(this value).
+  const object: JSReceiver = ToObject_Inline(context, receiver);
 
-    // 2. Let len be ? ToLength(? Get(O, "length")).
-    const length: Number = GetLengthProperty(object);
+  // 2. Let len be ? ToLength(? Get(O, "length")).
+  const length: Number = GetLengthProperty(object);
 
-    // 3. If len is zero, then
-    if (length == 0) {
-      // a. Perform ? Set(O, "length", 0, true).
-      SetProperty(object, kLengthString, Convert<Smi>(0));
-      // b. Return undefined.
-      return Undefined;
-    }
+  // 3. If len is zero, then
+  if (length == 0) {
+    // a. Perform ? Set(O, "length", 0, true).
+    SetProperty(object, kLengthString, Convert<Smi>(0));
+    // b. Return undefined.
+    return Undefined;
+  }
 
-    // 4. Let first be ? Get(O, "0").
-    const first = GetProperty(object, Convert<Smi>(0));
-    // 5. Let k be 1.
-    let k: Number = 1;
-    // 6. Repeat, while k < len
-    while (k < length) {
-      // a. Let from be ! ToString(k).
-      const from: Number = k;
-
-      // b. Let to be ! ToString(k - 1).
-      const to: Number = k - 1;
-
-      // c. Let fromPresent be ? HasProperty(O, from).
-      const fromPresent: Boolean = HasProperty(object, from);
-
-      // d. If fromPresent is true, then
-      if (fromPresent == True) {
-        // i. Let fromVal be ? Get(O, from).
-        const fromValue: JSAny = GetProperty(object, from);
-
-        // ii. Perform ? Set(O, to, fromValue, true).
-        SetProperty(object, to, fromValue);
-      } else {
-        // i. Perform ? DeletePropertyOrThrow(O, to).
-        DeleteProperty(object, to, LanguageMode::kStrict);
-      }
-
-      // f. Increase k by 1.
-      k++;
+  // 4. Let first be ? Get(O, "0").
+  const first = GetProperty(object, Convert<Smi>(0));
+  // 5. Let k be 1.
+  let k: Number = 1;
+  // 6. Repeat, while k < len
+  while (k < length) {
+    // a. Let from be ! ToString(k).
+    const from: Number = k;
+
+    // b. Let to be ! ToString(k - 1).
+    const to: Number = k - 1;
+
+    // c. Let fromPresent be ? HasProperty(O, from).
+    const fromPresent: Boolean = HasProperty(object, from);
+
+    // d. If fromPresent is true, then
+    if (fromPresent == True) {
+      // i. Let fromVal be ? Get(O, from).
+      const fromValue: JSAny = GetProperty(object, from);
+
+      // ii. Perform ? Set(O, to, fromValue, true).
+      SetProperty(object, to, fromValue);
+    } else {
+      // i. Perform ? DeletePropertyOrThrow(O, to).
+      DeleteProperty(object, to, LanguageMode::kStrict);
     }
 
-    // 7. Perform ? DeletePropertyOrThrow(O, ! ToString(len - 1)).
-    DeleteProperty(object, length - 1, LanguageMode::kStrict);
+    // f. Increase k by 1.
+    k++;
+  }
 
-    // 8. Perform ? Set(O, "length", len - 1, true).
-    SetProperty(object, kLengthString, length - 1);
+  // 7. Perform ? DeletePropertyOrThrow(O, ! ToString(len - 1)).
+  DeleteProperty(object, length - 1, LanguageMode::kStrict);
 
-    // 9. Return first.
-    return first;
-  }
+  // 8. Perform ? Set(O, "length", len - 1, true).
+  SetProperty(object, kLengthString, length - 1);
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.shift
-  transitioning javascript builtin ArrayPrototypeShift(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    try {
-      return TryFastArrayShift(receiver) otherwise Slow, Runtime;
-    }
-    label Slow {
-      return GenericArrayShift(receiver);
-    }
-    label Runtime {
-      tail ArrayShift(
-          context, LoadTargetFromFrame(), Undefined,
-          Convert<int32>(arguments.length));
-    }
+  // 9. Return first.
+  return first;
+}
+
+// https://tc39.github.io/ecma262/#sec-array.prototype.shift
+transitioning javascript builtin ArrayPrototypeShift(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  try {
+    return TryFastArrayShift(receiver) otherwise Slow, Runtime;
+  } label Slow {
+    return GenericArrayShift(receiver);
+  } label Runtime {
+    tail ArrayShift(
+        context, LoadTargetFromFrame(), Undefined,
+        Convert<int32>(arguments.length));
   }
 }
+}
diff --git a/deps/v8/src/builtins/array-slice.tq b/deps/v8/src/builtins/array-slice.tq
index b11b07e48be..97026586adf 100644
--- a/deps/v8/src/builtins/array-slice.tq
+++ b/deps/v8/src/builtins/array-slice.tq
@@ -3,225 +3,218 @@
 // found in the LICENSE file.
 
 namespace array {
-  macro HandleSimpleArgumentsSlice(
-      context: NativeContext, args: JSArgumentsObjectWithLength, start: Smi,
-      count: Smi): JSArray
-      labels Bailout {
-    // If the resulting array doesn't fit in new space, use the slow path.
-    if (count >= kMaxNewSpaceFixedArrayElements) goto Bailout;
-
-    const end: Smi = start + count;
-    const sourceElements: FixedArray =
-        Cast<FixedArray>(args.elements) otherwise Bailout;
-    if (SmiAbove(end, sourceElements.length)) goto Bailout;
-
-    const arrayMap: Map =
-        LoadJSArrayElementsMap(ElementsKind::HOLEY_ELEMENTS, context);
-    const result: JSArray =
-        AllocateJSArray(ElementsKind::HOLEY_ELEMENTS, arrayMap, count, count);
-    const newElements: FixedArray =
-        Cast<FixedArray>(result.elements) otherwise Bailout;
-    CopyElements(
-        ElementsKind::PACKED_ELEMENTS, newElements, 0, sourceElements,
-        Convert<intptr>(start), Convert<intptr>(count));
-    return result;
-  }
-
-  macro HandleFastAliasedSloppyArgumentsSlice(
-      context: NativeContext, args: JSArgumentsObjectWithLength, start: Smi,
-      count: Smi): JSArray
-      labels Bailout {
-    // If the resulting array doesn't fit in new space, use the slow path.
-    if (count >= kMaxNewSpaceFixedArrayElements) goto Bailout;
-
-    const sloppyElements: SloppyArgumentsElements =
-        Cast<SloppyArgumentsElements>(args.elements) otherwise Bailout;
-    const sloppyElementsLength: Smi = sloppyElements.length;
-    const parameterMapLength: Smi =
-        sloppyElementsLength - kSloppyArgumentsParameterMapStart;
-
-    // Check to make sure that the extraction will not access outside the
-    // defined arguments
-    const end: Smi = start + count;
-    const unmappedElements: FixedArray =
-        Cast<FixedArray>(sloppyElements.objects[kSloppyArgumentsArgumentsIndex])
-        otherwise Bailout;
-    const unmappedElementsLength: Smi = unmappedElements.length;
-    if (SmiAbove(end, unmappedElementsLength)) goto Bailout;
-
-    const argumentsContext: Context = UnsafeCast<Context>(
-        sloppyElements.objects[kSloppyArgumentsContextIndex]);
-
-    const arrayMap: Map =
-        LoadJSArrayElementsMap(ElementsKind::HOLEY_ELEMENTS, context);
-    const result: JSArray =
-        AllocateJSArray(ElementsKind::HOLEY_ELEMENTS, arrayMap, count, count);
-
-    let indexOut: Smi = 0;
-    const resultElements: FixedArray = UnsafeCast<FixedArray>(result.elements);
-    const to: Smi = SmiMin(parameterMapLength, end);
-
-    // Fill in the part of the result that map to context-mapped parameters.
-    for (let current: Smi = start; current < to; ++current) {
-      const e: Object =
-          sloppyElements.objects[current + kSloppyArgumentsParameterMapStart];
-      const newElement = UnsafeCast<(JSAny | TheHole)>(
-          e != TheHole ? argumentsContext[UnsafeCast<Smi>(e)] :
-                         unmappedElements.objects[current]);
-      // It is safe to skip the write barrier here because resultElements was
-      // allocated together with result in a folded allocation.
-      // TODO(tebbi): The verification of this fails at the moment due to
-      // missing load elimination.
-      StoreFixedArrayElement(
-          resultElements, indexOut++, newElement, UNSAFE_SKIP_WRITE_BARRIER);
-    }
+macro HandleSimpleArgumentsSlice(
+    context: NativeContext, args: JSArgumentsObjectWithLength, start: Smi,
+    count: Smi): JSArray
+    labels Bailout {
+  // If the resulting array doesn't fit in new space, use the slow path.
+  if (count >= kMaxNewSpaceFixedArrayElements) goto Bailout;
+
+  const end: Smi = start + count;
+  const sourceElements: FixedArray =
+      Cast<FixedArray>(args.elements) otherwise Bailout;
+  if (SmiAbove(end, sourceElements.length)) goto Bailout;
+
+  const arrayMap: Map =
+      LoadJSArrayElementsMap(ElementsKind::HOLEY_ELEMENTS, context);
+  const result: JSArray =
+      AllocateJSArray(ElementsKind::HOLEY_ELEMENTS, arrayMap, count, count);
+  const newElements: FixedArray =
+      Cast<FixedArray>(result.elements) otherwise Bailout;
+  CopyElements(
+      ElementsKind::PACKED_ELEMENTS, newElements, 0, sourceElements,
+      Convert<intptr>(start), Convert<intptr>(count));
+  return result;
+}
 
-    // Fill in the rest of the result that contains the unmapped parameters
-    // above the formal parameters.
-    const unmappedFrom: Smi = SmiMin(SmiMax(parameterMapLength, start), end);
-    const restCount: Smi = end - unmappedFrom;
-    CopyElements(
-        ElementsKind::PACKED_ELEMENTS, resultElements,
-        Convert<intptr>(indexOut), unmappedElements,
-        Convert<intptr>(unmappedFrom), Convert<intptr>(restCount));
-    return result;
+macro HandleFastAliasedSloppyArgumentsSlice(
+    context: NativeContext, args: JSArgumentsObjectWithLength, start: Smi,
+    count: Smi): JSArray
+    labels Bailout {
+  // If the resulting array doesn't fit in new space, use the slow path.
+  if (count >= kMaxNewSpaceFixedArrayElements) goto Bailout;
+
+  const sloppyElements: SloppyArgumentsElements =
+      Cast<SloppyArgumentsElements>(args.elements) otherwise Bailout;
+  const parameterMapLength: Smi = sloppyElements.length;
+
+  // Check to make sure that the extraction will not access outside the
+  // defined arguments
+  const end: Smi = start + count;
+  const unmappedElements: FixedArray =
+      Cast<FixedArray>(sloppyElements.arguments)
+      otherwise Bailout;
+  const unmappedElementsLength: Smi = unmappedElements.length;
+  if (SmiAbove(end, unmappedElementsLength)) goto Bailout;
+
+  const argumentsContext: Context = sloppyElements.context;
+
+  const arrayMap: Map =
+      LoadJSArrayElementsMap(ElementsKind::HOLEY_ELEMENTS, context);
+  const result: JSArray =
+      AllocateJSArray(ElementsKind::HOLEY_ELEMENTS, arrayMap, count, count);
+
+  let indexOut: Smi = 0;
+  const resultElements: FixedArray = UnsafeCast<FixedArray>(result.elements);
+  const to: Smi = SmiMin(parameterMapLength, end);
+
+  // Fill in the part of the result that map to context-mapped parameters.
+  for (let current: Smi = start; current < to; ++current) {
+    const e: Object = sloppyElements.mapped_entries[current];
+    const newElement = UnsafeCast<(JSAny | TheHole)>(
+        e != TheHole ? argumentsContext[UnsafeCast<Smi>(e)] :
+                       unmappedElements.objects[current]);
+    // It is safe to skip the write barrier here because resultElements was
+    // allocated together with result in a folded allocation.
+    // TODO(tebbi): The verification of this fails at the moment due to
+    // missing load elimination.
+    StoreFixedArrayElement(
+        resultElements, indexOut++, newElement, UNSAFE_SKIP_WRITE_BARRIER);
   }
 
-  macro HandleFastSlice(
-      context: NativeContext, o: JSAny, startNumber: Number,
-      countNumber: Number): JSArray
-      labels Bailout {
-    const start: Smi = Cast<Smi>(startNumber) otherwise Bailout;
-    const count: Smi = Cast<Smi>(countNumber) otherwise Bailout;
-    assert(start >= 0);
-
-    try {
-      typeswitch (o) {
-        case (a: FastJSArrayForCopy): {
-          // It's possible to modify the array length from a valueOf
-          // callback between the original array length read and this
-          // point. That can change the length of the array backing store,
-          // in the worst case, making it smaller than the region that needs
-          // to be copied out. Therefore, re-check the length before calling
-          // the appropriate fast path. See regress-785804.js
-          if (SmiAbove(start + count, a.length)) goto Bailout;
-          return ExtractFastJSArray(context, a, start, count);
-        }
-        case (a: JSStrictArgumentsObject): {
+  // Fill in the rest of the result that contains the unmapped parameters
+  // above the formal parameters.
+  const unmappedFrom: Smi = SmiMin(SmiMax(parameterMapLength, start), end);
+  const restCount: Smi = end - unmappedFrom;
+  CopyElements(
+      ElementsKind::PACKED_ELEMENTS, resultElements, Convert<intptr>(indexOut),
+      unmappedElements, Convert<intptr>(unmappedFrom),
+      Convert<intptr>(restCount));
+  return result;
+}
+
+macro HandleFastSlice(
+    context: NativeContext, o: JSAny, startNumber: Number,
+    countNumber: Number): JSArray
+    labels Bailout {
+  const start: Smi = Cast<Smi>(startNumber) otherwise Bailout;
+  const count: Smi = Cast<Smi>(countNumber) otherwise Bailout;
+  assert(start >= 0);
+
+  try {
+    typeswitch (o) {
+      case (a: FastJSArrayForCopy): {
+        // It's possible to modify the array length from a valueOf
+        // callback between the original array length read and this
+        // point. That can change the length of the array backing store,
+        // in the worst case, making it smaller than the region that needs
+        // to be copied out. Therefore, re-check the length before calling
+        // the appropriate fast path. See regress-785804.js
+        if (SmiAbove(start + count, a.length)) goto Bailout;
+        return ExtractFastJSArray(context, a, start, count);
+      }
+      case (a: JSStrictArgumentsObject): {
+        goto HandleSimpleArgumentsSlice(a);
+      }
+      case (a: JSSloppyArgumentsObject): {
+        const map: Map = a.map;
+        if (IsFastAliasedArgumentsMap(map)) {
+          return HandleFastAliasedSloppyArgumentsSlice(context, a, start, count)
+              otherwise Bailout;
+        } else if (IsSloppyArgumentsMap(map)) {
           goto HandleSimpleArgumentsSlice(a);
         }
-        case (a: JSSloppyArgumentsObject): {
-          const map: Map = a.map;
-          if (IsFastAliasedArgumentsMap(map)) {
-            return HandleFastAliasedSloppyArgumentsSlice(
-                context, a, start, count)
-                otherwise Bailout;
-          } else if (IsSloppyArgumentsMap(map)) {
-            goto HandleSimpleArgumentsSlice(a);
-          }
-          goto Bailout;
-        }
-        case (JSAny): {
-          goto Bailout;
-        }
+        goto Bailout;
+      }
+      case (JSAny): {
+        goto Bailout;
       }
     }
-    label HandleSimpleArgumentsSlice(a: JSArgumentsObjectWithLength) {
-      return HandleSimpleArgumentsSlice(context, a, start, count)
-          otherwise Bailout;
-    }
+  } label HandleSimpleArgumentsSlice(a: JSArgumentsObjectWithLength) {
+    return HandleSimpleArgumentsSlice(context, a, start, count)
+        otherwise Bailout;
   }
+}
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.slice
-  transitioning javascript builtin
-  ArrayPrototypeSlice(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSAny {
-    // Handle array cloning case if the receiver is a fast array.
-    if (arguments.length == 0) {
-      typeswitch (receiver) {
-        case (a: FastJSArrayForCopy): {
-          return CloneFastJSArray(context, a);
-        }
-        case (JSAny): {
-        }
+// https://tc39.github.io/ecma262/#sec-array.prototype.slice
+transitioning javascript builtin
+ArrayPrototypeSlice(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // Handle array cloning case if the receiver is a fast array.
+  if (arguments.length == 0) {
+    typeswitch (receiver) {
+      case (a: FastJSArrayForCopy): {
+        return CloneFastJSArray(context, a);
+      }
+      case (JSAny): {
       }
     }
+  }
 
-    // 1. Let O be ? ToObject(this value).
-    const o: JSReceiver = ToObject_Inline(context, receiver);
-
-    // 2. Let len be ? ToLength(? Get(O, "length")).
-    const len: Number = GetLengthProperty(o);
-
-    // 3. Let relativeStart be ? ToInteger(start).
-    const start: JSAny = arguments[0];
-    const relativeStart: Number = ToInteger_Inline(start);
+  // 1. Let O be ? ToObject(this value).
+  const o: JSReceiver = ToObject_Inline(context, receiver);
 
-    // 4. If relativeStart < 0, let k be max((len + relativeStart), 0);
-    //    else let k be min(relativeStart, len).
-    let k: Number = relativeStart < 0 ? Max((len + relativeStart), 0) :
-                                        Min(relativeStart, len);
+  // 2. Let len be ? ToLength(? Get(O, "length")).
+  const len: Number = GetLengthProperty(o);
 
-    // 5. If end is undefined, let relativeEnd be len;
-    //    else let relativeEnd be ? ToInteger(end).
-    const end: JSAny = arguments[1];
-    const relativeEnd: Number = end == Undefined ? len : ToInteger_Inline(end);
+  // 3. Let relativeStart be ? ToInteger(start).
+  const start: JSAny = arguments[0];
+  const relativeStart: Number = ToInteger_Inline(start);
 
-    // 6. If relativeEnd < 0, let final be max((len + relativeEnd), 0);
-    //    else let final be min(relativeEnd, len).
-    const final: Number =
-        relativeEnd < 0 ? Max((len + relativeEnd), 0) : Min(relativeEnd, len);
+  // 4. If relativeStart < 0, let k be max((len + relativeStart), 0);
+  //    else let k be min(relativeStart, len).
+  let k: Number = relativeStart < 0 ? Max((len + relativeStart), 0) :
+                                      Min(relativeStart, len);
 
-    // 7. Let count be max(final - k, 0).
-    const count: Number = Max(final - k, 0);
+  // 5. If end is undefined, let relativeEnd be len;
+  //    else let relativeEnd be ? ToInteger(end).
+  const end: JSAny = arguments[1];
+  const relativeEnd: Number = end == Undefined ? len : ToInteger_Inline(end);
 
-    assert(0 <= k);
-    assert(k <= len);
-    assert(0 <= final);
-    assert(final <= len);
-    assert(0 <= count);
-    assert(count <= len);
+  // 6. If relativeEnd < 0, let final be max((len + relativeEnd), 0);
+  //    else let final be min(relativeEnd, len).
+  const final: Number =
+      relativeEnd < 0 ? Max((len + relativeEnd), 0) : Min(relativeEnd, len);
 
-    try {
-      return HandleFastSlice(context, o, k, count)
-          otherwise Slow;
-    }
-    label Slow {}
+  // 7. Let count be max(final - k, 0).
+  const count: Number = Max(final - k, 0);
 
-    // 8. Let A be ? ArraySpeciesCreate(O, count).
-    const a: JSReceiver = ArraySpeciesCreate(context, o, count);
+  assert(0 <= k);
+  assert(k <= len);
+  assert(0 <= final);
+  assert(final <= len);
+  assert(0 <= count);
+  assert(count <= len);
 
-    // 9. Let n be 0.
-    let n: Number = 0;
+  try {
+    return HandleFastSlice(context, o, k, count)
+        otherwise Slow;
+  } label Slow {}
 
-    // 10. Repeat, while k < final
-    while (k < final) {
-      // a. Let Pk be ! ToString(k).
-      const pK: Number = k;
+  // 8. Let A be ? ArraySpeciesCreate(O, count).
+  const a: JSReceiver = ArraySpeciesCreate(context, o, count);
 
-      // b. Let kPresent be ? HasProperty(O, Pk).
-      const fromPresent: Boolean = HasProperty(o, pK);
+  // 9. Let n be 0.
+  let n: Number = 0;
 
-      // c. If kPresent is true, then
-      if (fromPresent == True) {
-        // i. Let kValue be ? Get(O, Pk).
-        const kValue: JSAny = GetProperty(o, pK);
+  // 10. Repeat, while k < final
+  while (k < final) {
+    // a. Let Pk be ! ToString(k).
+    const pK: Number = k;
 
-        // ii. Perform ? CreateDataPropertyOrThrow(A, ! ToString(n), kValue).
-        FastCreateDataProperty(a, n, kValue);
-      }
+    // b. Let kPresent be ? HasProperty(O, Pk).
+    const fromPresent: Boolean = HasProperty(o, pK);
 
-      // d. Increase k by 1.
-      k++;
+    // c. If kPresent is true, then
+    if (fromPresent == True) {
+      // i. Let kValue be ? Get(O, Pk).
+      const kValue: JSAny = GetProperty(o, pK);
 
-      // e. Increase n by 1.
-      n++;
+      // ii. Perform ? CreateDataPropertyOrThrow(A, ! ToString(n), kValue).
+      FastCreateDataProperty(a, n, kValue);
     }
 
-    // 11. Perform ? Set(A, "length", n, true).
-    SetProperty(a, kLengthString, n);
+    // d. Increase k by 1.
+    k++;
 
-    // 12. Return A.
-    return a;
+    // e. Increase n by 1.
+    n++;
   }
+
+  // 11. Perform ? Set(A, "length", n, true).
+  SetProperty(a, kLengthString, n);
+
+  // 12. Return A.
+  return a;
+}
 }
diff --git a/deps/v8/src/builtins/array-some.tq b/deps/v8/src/builtins/array-some.tq
index 59b8294f74d..69467bba276 100644
--- a/deps/v8/src/builtins/array-some.tq
+++ b/deps/v8/src/builtins/array-some.tq
@@ -3,145 +3,142 @@
 // found in the LICENSE file.
 
 namespace array {
-  transitioning javascript builtin
-  ArraySomeLoopEagerDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
-    // All continuation points in the optimized some implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    //
-    // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires JSAny type for all parameters
-    // other than {context}.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    const numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    return ArraySomeLoopContinuation(
-        jsreceiver, callbackfn, thisArg, Undefined, jsreceiver, numberK,
-        numberLength, Undefined);
+transitioning javascript builtin
+ArraySomeLoopEagerDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
+  // All continuation points in the optimized some implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  //
+  // Also, this great mass of casts is necessary because the signature
+  // of Torque javascript builtins requires JSAny type for all parameters
+  // other than {context}.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  const numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  return ArraySomeLoopContinuation(
+      jsreceiver, callbackfn, thisArg, Undefined, jsreceiver, numberK,
+      numberLength, Undefined);
+}
+
+transitioning javascript builtin
+ArraySomeLoopLazyDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
+    result: JSAny): JSAny {
+  // All continuation points in the optimized some implementation are
+  // after the ToObject(O) call that ensures we are dealing with a
+  // JSReceiver.
+  const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+  const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+  let numberK = Cast<Number>(initialK) otherwise unreachable;
+  const numberLength = Cast<Number>(length) otherwise unreachable;
+
+  // This custom lazy deopt point is right after the callback. some() needs
+  // to pick up at the next step: if the result is true, then return,
+  // otherwise, keep going through the array starting from k + 1.
+  if (ToBoolean(result)) {
+    return True;
   }
 
-  transitioning javascript builtin
-  ArraySomeLoopLazyDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
-      result: JSAny): JSAny {
-    // All continuation points in the optimized some implementation are
-    // after the ToObject(O) call that ensures we are dealing with a
-    // JSReceiver.
-    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
-    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
-    let numberK = Cast<Number>(initialK) otherwise unreachable;
-    const numberLength = Cast<Number>(length) otherwise unreachable;
-
-    // This custom lazy deopt point is right after the callback. some() needs
-    // to pick up at the next step: if the result is true, then return,
-    // otherwise, keep going through the array starting from k + 1.
-    if (ToBoolean(result)) {
-      return True;
-    }
+  numberK = numberK + 1;
 
-    numberK = numberK + 1;
+  return ArraySomeLoopContinuation(
+      jsreceiver, callbackfn, thisArg, Undefined, jsreceiver, numberK,
+      numberLength, Undefined);
+}
 
-    return ArraySomeLoopContinuation(
-        jsreceiver, callbackfn, thisArg, Undefined, jsreceiver, numberK,
-        numberLength, Undefined);
-  }
+transitioning builtin ArraySomeLoopContinuation(implicit context: Context)(
+    _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny, _array: JSAny,
+    o: JSReceiver, initialK: Number, length: Number, _initialTo: JSAny): JSAny {
+  // 5. Let k be 0.
+  // 6. Repeat, while k < len
+  for (let k: Number = initialK; k < length; k++) {
+    // 6a. Let Pk be ! ToString(k).
+    // k is guaranteed to be a positive integer, hence ToString is
+    // side-effect free and HasProperty/GetProperty do the conversion inline.
 
-  transitioning builtin ArraySomeLoopContinuation(implicit context: Context)(
-      _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
-      _array: JSAny, o: JSReceiver, initialK: Number, length: Number,
-      _initialTo: JSAny): JSAny {
-    // 5. Let k be 0.
-    // 6. Repeat, while k < len
-    for (let k: Number = initialK; k < length; k++) {
-      // 6a. Let Pk be ! ToString(k).
-      // k is guaranteed to be a positive integer, hence ToString is
-      // side-effect free and HasProperty/GetProperty do the conversion inline.
-
-      // 6b. Let kPresent be ? HasProperty(O, Pk).
-      const kPresent: Boolean = HasProperty_Inline(o, k);
-
-      // 6c. If kPresent is true, then
-      if (kPresent == True) {
-        // 6c. i. Let kValue be ? Get(O, Pk).
-        const kValue: JSAny = GetProperty(o, k);
-
-        // 6c. ii. Perform ? Call(callbackfn, T, <kValue, k, O>).
-        const result: JSAny = Call(context, callbackfn, thisArg, kValue, k, o);
-
-        // iii. If selected is true, then...
-        if (ToBoolean(result)) {
-          return True;
-        }
-      }
+    // 6b. Let kPresent be ? HasProperty(O, Pk).
+    const kPresent: Boolean = HasProperty_Inline(o, k);
 
-      // 6d. Increase k by 1. (done by the loop).
-    }
-    return False;
-  }
+    // 6c. If kPresent is true, then
+    if (kPresent == True) {
+      // 6c. i. Let kValue be ? Get(O, Pk).
+      const kValue: JSAny = GetProperty(o, k);
+
+      // 6c. ii. Perform ? Call(callbackfn, T, <kValue, k, O>).
+      const result: JSAny = Call(context, callbackfn, thisArg, kValue, k, o);
 
-  transitioning macro FastArraySome(implicit context: Context)(
-      o: JSReceiver, len: Number, callbackfn: Callable, thisArg: JSAny): JSAny
-      labels Bailout(Smi) {
-    let k: Smi = 0;
-    const smiLen = Cast<Smi>(len) otherwise goto Bailout(k);
-    const fastO = Cast<FastJSArray>(o) otherwise goto Bailout(k);
-    let fastOW = NewFastJSArrayWitness(fastO);
-
-    // Build a fast loop over the smi array.
-    for (; k < smiLen; k++) {
-      fastOW.Recheck() otherwise goto Bailout(k);
-
-      // Ensure that we haven't walked beyond a possibly updated length.
-      if (k >= fastOW.Get().length) goto Bailout(k);
-      const value: JSAny = fastOW.LoadElementNoHole(k) otherwise continue;
-      const result: JSAny =
-          Call(context, callbackfn, thisArg, value, k, fastOW.Get());
+      // iii. If selected is true, then...
       if (ToBoolean(result)) {
         return True;
       }
     }
-    return False;
-  }
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.some
-  transitioning javascript builtin
-  ArraySome(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
-      JSAny {
-    try {
-      RequireObjectCoercible(receiver, 'Array.prototype.some');
+    // 6d. Increase k by 1. (done by the loop).
+  }
+  return False;
+}
 
-      // 1. Let O be ? ToObject(this value).
-      const o: JSReceiver = ToObject_Inline(context, receiver);
+transitioning macro FastArraySome(implicit context: Context)(
+    o: JSReceiver, len: Number, callbackfn: Callable, thisArg: JSAny): JSAny
+    labels Bailout(Smi) {
+  let k: Smi = 0;
+  const smiLen = Cast<Smi>(len) otherwise goto Bailout(k);
+  const fastO = Cast<FastJSArray>(o) otherwise goto Bailout(k);
+  let fastOW = NewFastJSArrayWitness(fastO);
+
+  // Build a fast loop over the smi array.
+  for (; k < smiLen; k++) {
+    fastOW.Recheck() otherwise goto Bailout(k);
+
+    // Ensure that we haven't walked beyond a possibly updated length.
+    if (k >= fastOW.Get().length) goto Bailout(k);
+    const value: JSAny = fastOW.LoadElementNoHole(k) otherwise continue;
+    const result: JSAny =
+        Call(context, callbackfn, thisArg, value, k, fastOW.Get());
+    if (ToBoolean(result)) {
+      return True;
+    }
+  }
+  return False;
+}
 
-      // 2. Let len be ? ToLength(? Get(O, "length")).
-      const len: Number = GetLengthProperty(o);
+// https://tc39.github.io/ecma262/#sec-array.prototype.some
+transitioning javascript builtin
+ArraySome(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  try {
+    RequireObjectCoercible(receiver, 'Array.prototype.some');
 
-      // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
-      if (arguments.length == 0) {
-        goto TypeError;
-      }
-      const callbackfn = Cast<Callable>(arguments[0]) otherwise TypeError;
+    // 1. Let O be ? ToObject(this value).
+    const o: JSReceiver = ToObject_Inline(context, receiver);
 
-      // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
+    // 2. Let len be ? ToLength(? Get(O, "length")).
+    const len: Number = GetLengthProperty(o);
 
-      // Special cases.
-      try {
-        return FastArraySome(o, len, callbackfn, thisArg)
-            otherwise Bailout;
-      }
-      label Bailout(kValue: Smi) deferred {
-        return ArraySomeLoopContinuation(
-            o, callbackfn, thisArg, Undefined, o, kValue, len, Undefined);
-      }
+    // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
+    if (arguments.length == 0) {
+      goto TypeError;
     }
-    label TypeError deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise TypeError;
+
+    // 4. If thisArg is present, let T be thisArg; else let T be undefined.
+    const thisArg: JSAny = arguments[1];
+
+    // Special cases.
+    try {
+      return FastArraySome(o, len, callbackfn, thisArg)
+          otherwise Bailout;
+    } label Bailout(kValue: Smi) deferred {
+      return ArraySomeLoopContinuation(
+          o, callbackfn, thisArg, Undefined, o, kValue, len, Undefined);
     }
+  } label TypeError deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
   }
 }
+}
diff --git a/deps/v8/src/builtins/array-splice.tq b/deps/v8/src/builtins/array-splice.tq
index 9d7a223d974..92eace071cb 100644
--- a/deps/v8/src/builtins/array-splice.tq
+++ b/deps/v8/src/builtins/array-splice.tq
@@ -3,416 +3,418 @@
 // found in the LICENSE file.
 
 namespace array {
-  // Given {elements}, we want to create a non-zero length array of type
-  // FixedArrayType. Most of this behavior is outsourced to ExtractFixedArray(),
-  // but the special case of wanting to have a FixedDoubleArray when given a
-  // zero-length input FixedArray is handled here.
-  macro Extract(implicit context: Context)(
-      elements: FixedArray, first: Smi, count: Smi, capacity: Smi): FixedArray {
-    return ExtractFixedArray(
-        elements, Convert<intptr>(first), Convert<intptr>(count),
-        Convert<intptr>(capacity));
-  }
+// Given {source}, we want to create a non-zero length array of type
+// FixedArrayType with the specified {result_capacity}. Starting from
+// {startIndex}, {count} number of elements are copied to the newly
+// created result array. Most of this behavior is outsourced to
+// ExtractFixedArray(). We handle the case where the {source} is
+// EmptyFixedArray but result is expected to be a FixedDoubleArray.
+macro Extract(implicit context: Context)(
+    source: FixedArray, startIndex: Smi, count: Smi,
+    resultCapacity: Smi): FixedArray {
+  return ExtractFixedArray(
+      source, Convert<intptr>(startIndex), Convert<intptr>(count),
+      Convert<intptr>(resultCapacity));
+}
 
-  macro Extract(implicit context: Context)(
-      elements: FixedDoubleArray|EmptyFixedArray, first: Smi, count: Smi,
-      capacity: Smi): FixedDoubleArray|EmptyFixedArray {
-    typeswitch (elements) {
-      case (EmptyFixedArray): {
-        return AllocateZeroedFixedDoubleArray(Convert<intptr>(capacity));
-      }
-      case (elements: FixedDoubleArray): {
-        return ExtractFixedDoubleArray(
-            elements, Convert<intptr>(first), Convert<intptr>(count),
-            Convert<intptr>(capacity));
-      }
+macro Extract(implicit context: Context)(
+    source: FixedDoubleArray|EmptyFixedArray, startIndex: Smi, count: Smi,
+    resultCapacity: Smi): FixedDoubleArray|EmptyFixedArray {
+  typeswitch (source) {
+    case (EmptyFixedArray): {
+      // ExtractFixedDoubleArray expects {source} to be a FixedDoubleArray.
+      // Handle the case where {source} is empty here.
+      return AllocateFixedDoubleArrayWithHoles(
+          Convert<intptr>(resultCapacity),
+          AllocationFlag::kAllowLargeObjectAllocation);
+    }
+    case (source: FixedDoubleArray): {
+      return ExtractFixedDoubleArray(
+          source, Convert<intptr>(startIndex), Convert<intptr>(count),
+          Convert<intptr>(resultCapacity));
     }
   }
+}
 
-  macro DoMoveElements<FixedArrayType : type extends FixedArrayBase>(
-      elements: FixedArrayType, dstIndex: Smi, srcIndex: Smi,
-      count: Smi): void {
-    TorqueMoveElements(
-        elements, Convert<intptr>(dstIndex), Convert<intptr>(srcIndex),
-        Convert<intptr>(count));
-  }
+macro DoMoveElements<FixedArrayType : type extends FixedArrayBase>(
+    elements: FixedArrayType, dstIndex: Smi, srcIndex: Smi, count: Smi): void {
+  TorqueMoveElements(
+      elements, Convert<intptr>(dstIndex), Convert<intptr>(srcIndex),
+      Convert<intptr>(count));
+}
 
-  macro StoreHoles<FixedArrayType : type extends FixedArrayBase>(
-      elements: FixedArrayType, holeStartIndex: Smi, holeEndIndex: Smi): void {
-    for (let i: Smi = holeStartIndex; i < holeEndIndex; i++) {
-      array::StoreArrayHole(elements, i);
-    }
+macro StoreHoles<FixedArrayType : type extends FixedArrayBase>(
+    elements: FixedArrayType, holeStartIndex: Smi, holeEndIndex: Smi): void {
+  for (let i: Smi = holeStartIndex; i < holeEndIndex; i++) {
+    array::StoreArrayHole(elements, i);
   }
+}
 
-  macro DoCopyElements<FixedArrayType : type extends FixedArrayBase>(
-      dstElements: FixedArrayType, dstIndex: Smi, srcElements: FixedArrayType,
-      srcIndex: Smi, count: Smi): void {
-    TorqueCopyElements(
-        dstElements, Convert<intptr>(dstIndex), srcElements,
-        Convert<intptr>(srcIndex), Convert<intptr>(count));
-  }
+macro DoCopyElements<FixedArrayType : type extends FixedArrayBase>(
+    dstElements: FixedArrayType, dstIndex: Smi, srcElements: FixedArrayType,
+    srcIndex: Smi, count: Smi): void {
+  TorqueCopyElements(
+      dstElements, Convert<intptr>(dstIndex), srcElements,
+      Convert<intptr>(srcIndex), Convert<intptr>(count));
+}
 
-  macro
-  FastSplice<FixedArrayType : type extends FixedArrayBase, ElementType: type>(
-      implicit context: Context)(
-      args: Arguments, a: JSArray, length: Smi, newLength: Smi,
-      actualStart: Smi, insertCount: Smi, actualDeleteCount: Smi): void {
-    // Make sure elements are writable.
-    array::EnsureWriteableFastElements(a);
-
-    if (insertCount != actualDeleteCount) {
-      const elements =
-          UnsafeCast<(FixedArrayType | EmptyFixedArray)>(a.elements);
-      const dstIndex: Smi = actualStart + insertCount;
-      const srcIndex: Smi = actualStart + actualDeleteCount;
-      const count: Smi = length - actualDeleteCount - actualStart;
-      if (insertCount < actualDeleteCount) {
-        // Shrink.
+macro
+FastSplice<FixedArrayType : type extends FixedArrayBase, ElementType: type>(
+    implicit context: Context)(
+    args: Arguments, a: JSArray, length: Smi, newLength: Smi, actualStart: Smi,
+    insertCount: Smi, actualDeleteCount: Smi): void {
+  // Make sure elements are writable.
+  array::EnsureWriteableFastElements(a);
+
+  if (insertCount != actualDeleteCount) {
+    const elements = UnsafeCast<(FixedArrayType | EmptyFixedArray)>(a.elements);
+    const dstIndex: Smi = actualStart + insertCount;
+    const srcIndex: Smi = actualStart + actualDeleteCount;
+    const count: Smi = length - actualDeleteCount - actualStart;
+    if (insertCount < actualDeleteCount) {
+      // Shrink.
+      DoMoveElements(
+          UnsafeCast<FixedArrayType>(elements), dstIndex, srcIndex, count);
+      StoreHoles(UnsafeCast<FixedArrayType>(elements), newLength, length);
+    } else if (insertCount > actualDeleteCount) {
+      // If the backing store is big enough, then moving elements is enough.
+      if (newLength <= elements.length) {
         DoMoveElements(
             UnsafeCast<FixedArrayType>(elements), dstIndex, srcIndex, count);
-        StoreHoles(UnsafeCast<FixedArrayType>(elements), newLength, length);
-      } else if (insertCount > actualDeleteCount) {
-        // If the backing store is big enough, then moving elements is enough.
-        if (newLength <= elements.length) {
-          DoMoveElements(
-              UnsafeCast<FixedArrayType>(elements), dstIndex, srcIndex, count);
-        } else {
-          // Grow.
-          const capacity: Smi = CalculateNewElementsCapacity(newLength);
-          const newElements: FixedArrayType = UnsafeCast<FixedArrayType>(
-              Extract(elements, 0, actualStart, capacity));
-          a.elements = newElements;
-          if (elements.length > 0) {
-            DoCopyElements(
-                newElements, dstIndex, UnsafeCast<FixedArrayType>(elements),
-                srcIndex, count);
-          }
+      } else {
+        // Grow.
+        const capacity: Smi = CalculateNewElementsCapacity(newLength);
+        const newElements: FixedArrayType = UnsafeCast<FixedArrayType>(
+            Extract(elements, 0, actualStart, capacity));
+        a.elements = newElements;
+        if (elements.length > 0) {
+          DoCopyElements(
+              newElements, dstIndex, UnsafeCast<FixedArrayType>(elements),
+              srcIndex, count);
         }
       }
     }
-
-    // Copy arguments.
-    let k: Smi = actualStart;
-    if (insertCount > 0) {
-      const typedNewElements: FixedArrayType =
-          UnsafeCast<FixedArrayType>(a.elements);
-      for (let i: intptr = 2; i < args.length; ++i) {
-        const e: JSAny = args[i];
-        // The argument elements were already validated to be an appropriate
-        // {ElementType} to store in {FixedArrayType}.
-        typedNewElements[k++] = UnsafeCast<ElementType>(e);
-      }
-    }
-
-    // Update the array's length after all the FixedArray shuffling is done.
-    a.length = newLength;
   }
 
-  transitioning macro FastArraySplice(
-      context: Context, args: Arguments, o: JSReceiver,
-      originalLengthNumber: Number, actualStartNumber: Number, insertCount: Smi,
-      actualDeleteCountNumber: Number): JSAny
-      labels Bailout {
-    const originalLength: Smi =
-        Cast<Smi>(originalLengthNumber) otherwise Bailout;
-    const actualStart: Smi = Cast<Smi>(actualStartNumber) otherwise Bailout;
-    const actualDeleteCount: Smi =
-        Cast<Smi>(actualDeleteCountNumber) otherwise Bailout;
-    const lengthDelta: Smi = insertCount - actualDeleteCount;
-    const newLength: Smi = originalLength + lengthDelta;
-
-    const a: JSArray = Cast<JSArray>(o) otherwise Bailout;
-
-    const map: Map = a.map;
-    if (!IsPrototypeInitialArrayPrototype(map)) goto Bailout;
-    if (IsNoElementsProtectorCellInvalid()) goto Bailout;
-    if (IsArraySpeciesProtectorCellInvalid()) goto Bailout;
-
-    // Fast path only works on fast elements kind and with writable length.
-    let elementsKind: ElementsKind = EnsureArrayPushable(map) otherwise Bailout;
-    if (!IsFastElementsKind(elementsKind)) goto Bailout;
-
-    const oldElementsKind: ElementsKind = elementsKind;
+  // Copy arguments.
+  let k: Smi = actualStart;
+  if (insertCount > 0) {
+    const typedNewElements: FixedArrayType =
+        UnsafeCast<FixedArrayType>(a.elements);
     for (let i: intptr = 2; i < args.length; ++i) {
       const e: JSAny = args[i];
-      if (IsFastSmiElementsKind(elementsKind)) {
-        if (TaggedIsNotSmi(e)) {
-          const heapObject: HeapObject = UnsafeCast<HeapObject>(e);
-          elementsKind = IsHeapNumber(heapObject) ?
-              AllowDoubleElements(elementsKind) :
-              AllowNonNumberElements(elementsKind);
-        }
-      } else if (IsDoubleElementsKind(elementsKind)) {
-        if (!IsNumber(e)) {
-          elementsKind = AllowNonNumberElements(elementsKind);
-        }
-      }
+      // The argument elements were already validated to be an appropriate
+      // {ElementType} to store in {FixedArrayType}.
+      typedNewElements[k++] = UnsafeCast<ElementType>(e);
     }
+  }
 
-    if (elementsKind != oldElementsKind) {
-      const smiElementsKind: Smi = Convert<Smi>(Convert<int32>(elementsKind));
-      TransitionElementsKindWithKind(context, a, smiElementsKind);
-    }
+  // Update the array's length after all the FixedArray shuffling is done.
+  a.length = newLength;
+}
 
-    // Make sure that the length hasn't been changed by side-effect.
-    const length: Smi = Cast<Smi>(a.length) otherwise Bailout;
-    if (originalLength != length) goto Bailout;
+transitioning macro FastArraySplice(
+    context: Context, args: Arguments, o: JSReceiver,
+    originalLengthNumber: Number, actualStartNumber: Number, insertCount: Smi,
+    actualDeleteCountNumber: Number): JSAny
+    labels Bailout {
+  const originalLength: Smi = Cast<Smi>(originalLengthNumber) otherwise Bailout;
+  const actualStart: Smi = Cast<Smi>(actualStartNumber) otherwise Bailout;
+  const actualDeleteCount: Smi =
+      Cast<Smi>(actualDeleteCountNumber) otherwise Bailout;
+  const lengthDelta: Smi = insertCount - actualDeleteCount;
+  const newLength: Smi = originalLength + lengthDelta;
+
+  const a: JSArray = Cast<JSArray>(o) otherwise Bailout;
+
+  const map: Map = a.map;
+  if (!IsPrototypeInitialArrayPrototype(map)) goto Bailout;
+  if (IsNoElementsProtectorCellInvalid()) goto Bailout;
+  if (IsArraySpeciesProtectorCellInvalid()) goto Bailout;
+
+  // Fast path only works on fast elements kind and with writable length.
+  let elementsKind: ElementsKind = EnsureArrayPushable(map) otherwise Bailout;
+  if (!IsFastElementsKind(elementsKind)) goto Bailout;
+
+  const oldElementsKind: ElementsKind = elementsKind;
+  for (let i: intptr = 2; i < args.length; ++i) {
+    const e: JSAny = args[i];
+    if (IsFastSmiElementsKind(elementsKind)) {
+      if (TaggedIsNotSmi(e)) {
+        const heapObject: HeapObject = UnsafeCast<HeapObject>(e);
+        elementsKind = IsHeapNumber(heapObject) ?
+            AllowDoubleElements(elementsKind) :
+            AllowNonNumberElements(elementsKind);
+      }
+    } else if (IsDoubleElementsKind(elementsKind)) {
+      if (!IsNumber(e)) {
+        elementsKind = AllowNonNumberElements(elementsKind);
+      }
+    }
+  }
 
-    const deletedResult: JSArray =
-        ExtractFastJSArray(context, a, actualStart, actualDeleteCount);
+  if (elementsKind != oldElementsKind) {
+    const smiElementsKind: Smi = Convert<Smi>(Convert<int32>(elementsKind));
+    TransitionElementsKindWithKind(context, a, smiElementsKind);
+  }
 
-    if (newLength == 0) {
-      a.elements = kEmptyFixedArray;
-      a.length = 0;
-      return deletedResult;
-    }
+  // Make sure that the length hasn't been changed by side-effect.
+  const length: Smi = Cast<Smi>(a.length) otherwise Bailout;
+  if (originalLength != length) goto Bailout;
 
-    if (IsFastSmiOrTaggedElementsKind(elementsKind)) {
-      FastSplice<FixedArray, JSAny>(
-          args, a, length, newLength, actualStart, insertCount,
-          actualDeleteCount);
-    } else {
-      FastSplice<FixedDoubleArray, Number>(
-          args, a, length, newLength, actualStart, insertCount,
-          actualDeleteCount);
-    }
+  const deletedResult: JSArray =
+      ExtractFastJSArray(context, a, actualStart, actualDeleteCount);
 
+  if (newLength == 0) {
+    a.elements = kEmptyFixedArray;
+    a.length = 0;
     return deletedResult;
   }
 
-  transitioning macro FillDeletedElementsArray(
-      context: Context, o: JSReceiver, actualStart: Number,
-      actualDeleteCount: Number, a: JSReceiver): JSAny {
-    // 10. Let k be 0.
-    let k: Number = 0;
+  if (IsFastSmiOrTaggedElementsKind(elementsKind)) {
+    FastSplice<FixedArray, JSAny>(
+        args, a, length, newLength, actualStart, insertCount,
+        actualDeleteCount);
+  } else {
+    FastSplice<FixedDoubleArray, Number>(
+        args, a, length, newLength, actualStart, insertCount,
+        actualDeleteCount);
+  }
+
+  return deletedResult;
+}
 
-    // 11. Repeat, while k < actualDeleteCount
-    while (k < actualDeleteCount) {
-      // a. Let from be ! ToString(actualStart + k).
-      const from: Number = actualStart + k;
+transitioning macro FillDeletedElementsArray(
+    context: Context, o: JSReceiver, actualStart: Number,
+    actualDeleteCount: Number, a: JSReceiver): JSAny {
+  // 10. Let k be 0.
+  let k: Number = 0;
 
-      // b. Let fromPresent be ? HasProperty(O, from).
-      const fromPresent: Boolean = HasProperty(o, from);
+  // 11. Repeat, while k < actualDeleteCount
+  while (k < actualDeleteCount) {
+    // a. Let from be ! ToString(actualStart + k).
+    const from: Number = actualStart + k;
 
-      // c. If fromPresent is true, then
-      if (fromPresent == True) {
-        // i. Let fromValue be ? Get(O, from).
-        const fromValue: JSAny = GetProperty(o, from);
+    // b. Let fromPresent be ? HasProperty(O, from).
+    const fromPresent: Boolean = HasProperty(o, from);
 
-        // ii. Perform ? CreateDataPropertyOrThrow(A, ! ToString(k), fromValue).
-        FastCreateDataProperty(a, k, fromValue);
-      }
+    // c. If fromPresent is true, then
+    if (fromPresent == True) {
+      // i. Let fromValue be ? Get(O, from).
+      const fromValue: JSAny = GetProperty(o, from);
 
-      // d. Increment k by 1.
-      k++;
+      // ii. Perform ? CreateDataPropertyOrThrow(A, ! ToString(k), fromValue).
+      FastCreateDataProperty(a, k, fromValue);
     }
-    // 12. Perform ? Set(A, "length", actualDeleteCount, true).
-    SetProperty(a, kLengthString, actualDeleteCount);
-    return a;
+
+    // d. Increment k by 1.
+    k++;
   }
+  // 12. Perform ? Set(A, "length", actualDeleteCount, true).
+  SetProperty(a, kLengthString, actualDeleteCount);
+  return a;
+}
 
-  // HandleForwardCase implements step 15. "If itemCount < actualDeleteCount,
-  // then...""
-  transitioning macro HandleForwardCase(
-      context: Context, o: JSReceiver, len: Number, itemCount: Number,
-      actualStart: Number, actualDeleteCount: Number): void {
-    // 15. If itemCount < actualDeleteCount, then
-    // a. Let k be actualStart.
-    let k: Number = actualStart;
-
-    // b. Repeat, while k < (len - actualDeleteCount)
-    while (k < (len - actualDeleteCount)) {
-      // i. Let from be ! ToString(k + actualDeleteCount).
-      const from: Number = k + actualDeleteCount;
-      // ii. Let to be ! ToString(k + itemCount).
-      const to: Number = k + itemCount;
-
-      // iii. Let fromPresent be ? HasProperty(O, from).
-      const fromPresent: Boolean = HasProperty(o, from);
-
-      // iv. If fromPresent is true, then
-      if (fromPresent == True) {
-        // 1. Let fromValue be ? Get(O, from).
-        const fromValue: JSAny = GetProperty(o, from);
-
-        // 2. Perform ? Set(O, to, fromValue, true).
-        SetProperty(o, to, fromValue);
-
-        // v. Else fromPresent is false,
-      } else {
-        // 1. Perform ? DeletePropertyOrThrow(O, to).
-        DeleteProperty(o, to, LanguageMode::kStrict);
-      }
-      // vi. Increase k by 1.
-      k++;
+// HandleForwardCase implements step 15. "If itemCount < actualDeleteCount,
+// then...""
+transitioning macro HandleForwardCase(
+    context: Context, o: JSReceiver, len: Number, itemCount: Number,
+    actualStart: Number, actualDeleteCount: Number): void {
+  // 15. If itemCount < actualDeleteCount, then
+  // a. Let k be actualStart.
+  let k: Number = actualStart;
+
+  // b. Repeat, while k < (len - actualDeleteCount)
+  while (k < (len - actualDeleteCount)) {
+    // i. Let from be ! ToString(k + actualDeleteCount).
+    const from: Number = k + actualDeleteCount;
+    // ii. Let to be ! ToString(k + itemCount).
+    const to: Number = k + itemCount;
+
+    // iii. Let fromPresent be ? HasProperty(O, from).
+    const fromPresent: Boolean = HasProperty(o, from);
+
+    // iv. If fromPresent is true, then
+    if (fromPresent == True) {
+      // 1. Let fromValue be ? Get(O, from).
+      const fromValue: JSAny = GetProperty(o, from);
+
+      // 2. Perform ? Set(O, to, fromValue, true).
+      SetProperty(o, to, fromValue);
+
+      // v. Else fromPresent is false,
+    } else {
+      // 1. Perform ? DeletePropertyOrThrow(O, to).
+      DeleteProperty(o, to, LanguageMode::kStrict);
     }
+    // vi. Increase k by 1.
+    k++;
+  }
 
-    // c. Let k be len.
-    k = len;
+  // c. Let k be len.
+  k = len;
 
-    // d. Repeat, while k > (len - actualDeleteCount + itemCount)
-    while (k > (len - actualDeleteCount + itemCount)) {
-      // i. Perform ? DeletePropertyOrThrow(O, ! ToString(k - 1)).
-      DeleteProperty(o, k - 1, LanguageMode::kStrict);
-      // ii. Decrease k by 1.
-      k--;
-    }
+  // d. Repeat, while k > (len - actualDeleteCount + itemCount)
+  while (k > (len - actualDeleteCount + itemCount)) {
+    // i. Perform ? DeletePropertyOrThrow(O, ! ToString(k - 1)).
+    DeleteProperty(o, k - 1, LanguageMode::kStrict);
+    // ii. Decrease k by 1.
+    k--;
   }
+}
 
-  // HandleBackwardCase implements step 16. "Else if itemCount >
-  // actualDeleteCount, then..."
-  transitioning macro HandleBackwardCase(
-      context: Context, o: JSReceiver, len: Number, itemCount: Number,
-      actualStart: Number, actualDeleteCount: Number): void {
-    // 16. Else if itemCount > actualDeleteCount, then
-    // a. Let k be (len - actualDeleteCount).
-    let k: Number = len - actualDeleteCount;
-
-    // b. Repeat, while k > actualStart
-    while (k > actualStart) {
-      // i. Let from be ! ToString(k + actualDeleteCount - 1).
-      const from: Number = k + actualDeleteCount - 1;
+// HandleBackwardCase implements step 16. "Else if itemCount >
+// actualDeleteCount, then..."
+transitioning macro HandleBackwardCase(
+    context: Context, o: JSReceiver, len: Number, itemCount: Number,
+    actualStart: Number, actualDeleteCount: Number): void {
+  // 16. Else if itemCount > actualDeleteCount, then
+  // a. Let k be (len - actualDeleteCount).
+  let k: Number = len - actualDeleteCount;
 
-      // ii. Let to be ! ToString(k + itemCount - 1).
-      const to: Number = k + itemCount - 1;
+  // b. Repeat, while k > actualStart
+  while (k > actualStart) {
+    // i. Let from be ! ToString(k + actualDeleteCount - 1).
+    const from: Number = k + actualDeleteCount - 1;
 
-      // iii. Let fromPresent be ? HasProperty(O, from).
-      const fromPresent: Boolean = HasProperty(o, from);
+    // ii. Let to be ! ToString(k + itemCount - 1).
+    const to: Number = k + itemCount - 1;
 
-      // iv. If fromPresent is true, then
-      if (fromPresent == True) {
-        // 1. Let fromValue be ? Get(O, from).
-        const fromValue: JSAny = GetProperty(o, from);
+    // iii. Let fromPresent be ? HasProperty(O, from).
+    const fromPresent: Boolean = HasProperty(o, from);
 
-        // 2. Perform ? Set(O, to, fromValue, true).
-        SetProperty(o, to, fromValue);
+    // iv. If fromPresent is true, then
+    if (fromPresent == True) {
+      // 1. Let fromValue be ? Get(O, from).
+      const fromValue: JSAny = GetProperty(o, from);
 
-        // v. Else fromPresent is false,
-      } else {
-        // 1. Perform ? DeletePropertyOrThrow(O, to).
-        DeleteProperty(o, to, LanguageMode::kStrict);
-      }
+      // 2. Perform ? Set(O, to, fromValue, true).
+      SetProperty(o, to, fromValue);
 
-      // vi. Decrease k by 1.
-      k--;
+      // v. Else fromPresent is false,
+    } else {
+      // 1. Perform ? DeletePropertyOrThrow(O, to).
+      DeleteProperty(o, to, LanguageMode::kStrict);
     }
+
+    // vi. Decrease k by 1.
+    k--;
   }
+}
 
-  transitioning macro SlowSplice(
-      context: Context, arguments: Arguments, o: JSReceiver, len: Number,
-      actualStart: Number, insertCount: Smi, actualDeleteCount: Number): JSAny {
-    // 9. Let A be ? ArraySpeciesCreate(O, actualDeleteCount).
-    const a: JSReceiver = ArraySpeciesCreate(context, o, actualDeleteCount);
-    const itemCount: Number = insertCount;
-
-    // Steps 9 through 12: creating the array of deleted elements.
-    FillDeletedElementsArray(context, o, actualStart, actualDeleteCount, a);
-
-    // 13. Let items be a List whose elements are, in left-to-right order,
-    //     the portion of the actual argument list starting with the third
-    //     argument. The list is empty if fewer than three arguments were
-    //     passed.
-    // 14. Let itemCount be the Number of elements in items.
-    // (done above).
-
-    // 15. If itemCount < actualDeleteCount, then
-    if (itemCount < actualDeleteCount) {
-      HandleForwardCase(
-          context, o, len, itemCount, actualStart, actualDeleteCount);
-      // 16. Else if itemCount > actualDeleteCount, then
-    } else if (itemCount > actualDeleteCount) {
-      HandleBackwardCase(
-          context, o, len, itemCount, actualStart, actualDeleteCount);
-    }
+transitioning macro SlowSplice(
+    context: Context, arguments: Arguments, o: JSReceiver, len: Number,
+    actualStart: Number, insertCount: Smi, actualDeleteCount: Number): JSAny {
+  // 9. Let A be ? ArraySpeciesCreate(O, actualDeleteCount).
+  const a: JSReceiver = ArraySpeciesCreate(context, o, actualDeleteCount);
+  const itemCount: Number = insertCount;
+
+  // Steps 9 through 12: creating the array of deleted elements.
+  FillDeletedElementsArray(context, o, actualStart, actualDeleteCount, a);
+
+  // 13. Let items be a List whose elements are, in left-to-right order,
+  //     the portion of the actual argument list starting with the third
+  //     argument. The list is empty if fewer than three arguments were
+  //     passed.
+  // 14. Let itemCount be the Number of elements in items.
+  // (done above).
+
+  // 15. If itemCount < actualDeleteCount, then
+  if (itemCount < actualDeleteCount) {
+    HandleForwardCase(
+        context, o, len, itemCount, actualStart, actualDeleteCount);
+    // 16. Else if itemCount > actualDeleteCount, then
+  } else if (itemCount > actualDeleteCount) {
+    HandleBackwardCase(
+        context, o, len, itemCount, actualStart, actualDeleteCount);
+  }
 
-    // 17. Let k be actualStart.
-    let k: Number = actualStart;
+  // 17. Let k be actualStart.
+  let k: Number = actualStart;
 
-    // 18. Repeat, while items is not empty
-    //   a. Remove the first element from items and let E be the value of that
-    //   element.
-    if (arguments.length > 2) {
-      for (let i: intptr = 2; i < arguments.length; ++i) {
-        const e: JSAny = arguments[i];
-        // b. Perform ? Set(O, ! ToString(k), E, true).
-        SetProperty(o, k, e);
+  // 18. Repeat, while items is not empty
+  //   a. Remove the first element from items and let E be the value of that
+  //   element.
+  if (arguments.length > 2) {
+    for (let i: intptr = 2; i < arguments.length; ++i) {
+      const e: JSAny = arguments[i];
+      // b. Perform ? Set(O, ! ToString(k), E, true).
+      SetProperty(o, k, e);
 
-        // c. Increase k by 1.
-        k = k + 1;
-      }
+      // c. Increase k by 1.
+      k = k + 1;
     }
-
-    // 19. Perform ? Set(O, "length", len - actualDeleteCount + itemCount,
-    // true).
-    SetProperty(o, kLengthString, len - actualDeleteCount + itemCount);
-
-    return a;
   }
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.splice
-  transitioning javascript builtin
-  ArrayPrototypeSplice(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSAny {
-    // 1. Let O be ? ToObject(this value).
-    const o: JSReceiver = ToObject(context, receiver);
-
-    // 2. Let len be ? ToLength(? Get(O, "length")).
-    const len: Number = GetLengthProperty(o);
-
-    // 3. Let relativeStart be ? ToInteger(start).
-    const start: JSAny = arguments[0];
-    const relativeStart: Number = ToInteger_Inline(start);
-
-    // 4. If relativeStart < 0, let actualStart be max((len + relativeStart),
-    // 0);
-    //    else let actualStart be min(relativeStart, len).
-    const actualStart: Number = relativeStart < 0 ?
-        Max((len + relativeStart), 0) :
-        Min(relativeStart, len);
-
-    let insertCount: Smi;
-    let actualDeleteCount: Number;
-    // 5. If the Number of actual arguments is 0, then
-    if (arguments.length == 0) {
-      // a. Let insertCount be 0.
-      insertCount = 0;
-      // b. Let actualDeleteCount be 0.
-      actualDeleteCount = 0;
-      // 6. Else if the Number of actual arguments is 1, then
-    } else if (arguments.length == 1) {
-      // a. Let insertCount be 0.
-      insertCount = 0;
-      // b. Let actualDeleteCount be len - actualStart.
-      actualDeleteCount = len - actualStart;
-      // 7. Else,
-    } else {
-      // a. Let insertCount be the Number of actual arguments minus 2.
-      insertCount = Convert<Smi>(arguments.length) - 2;
-      // b. Let dc be ? ToInteger(deleteCount).
-      const deleteCount: JSAny = arguments[1];
-      const dc: Number = ToInteger_Inline(deleteCount);
-      // c. Let actualDeleteCount be min(max(dc, 0), len - actualStart).
-      actualDeleteCount = Min(Max(dc, 0), len - actualStart);
-    }
+  // 19. Perform ? Set(O, "length", len - actualDeleteCount + itemCount,
+  // true).
+  SetProperty(o, kLengthString, len - actualDeleteCount + itemCount);
 
-    // 8. If len + insertCount - actualDeleteCount > 2^53-1, throw a
-    //    Bailout exception.
-    const newLength: Number = len + insertCount - actualDeleteCount;
-    if (newLength > kMaxSafeInteger) {
-      ThrowTypeError(MessageTemplate::kInvalidArrayLength, start);
-    }
+  return a;
+}
 
-    try {
-      return FastArraySplice(
-          context, arguments, o, len, actualStart, insertCount,
-          actualDeleteCount) otherwise Bailout;
-    }
-    label Bailout {}
+// https://tc39.github.io/ecma262/#sec-array.prototype.splice
+transitioning javascript builtin
+ArrayPrototypeSplice(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // 1. Let O be ? ToObject(this value).
+  const o: JSReceiver = ToObject(context, receiver);
+
+  // 2. Let len be ? ToLength(? Get(O, "length")).
+  const len: Number = GetLengthProperty(o);
+
+  // 3. Let relativeStart be ? ToInteger(start).
+  const start: JSAny = arguments[0];
+  const relativeStart: Number = ToInteger_Inline(start);
+
+  // 4. If relativeStart < 0, let actualStart be max((len + relativeStart),
+  // 0);
+  //    else let actualStart be min(relativeStart, len).
+  const actualStart: Number = relativeStart < 0 ?
+      Max((len + relativeStart), 0) :
+      Min(relativeStart, len);
+
+  let insertCount: Smi;
+  let actualDeleteCount: Number;
+  // 5. If the Number of actual arguments is 0, then
+  if (arguments.length == 0) {
+    // a. Let insertCount be 0.
+    insertCount = 0;
+    // b. Let actualDeleteCount be 0.
+    actualDeleteCount = 0;
+    // 6. Else if the Number of actual arguments is 1, then
+  } else if (arguments.length == 1) {
+    // a. Let insertCount be 0.
+    insertCount = 0;
+    // b. Let actualDeleteCount be len - actualStart.
+    actualDeleteCount = len - actualStart;
+    // 7. Else,
+  } else {
+    // a. Let insertCount be the Number of actual arguments minus 2.
+    insertCount = Convert<Smi>(arguments.length) - 2;
+    // b. Let dc be ? ToInteger(deleteCount).
+    const deleteCount: JSAny = arguments[1];
+    const dc: Number = ToInteger_Inline(deleteCount);
+    // c. Let actualDeleteCount be min(max(dc, 0), len - actualStart).
+    actualDeleteCount = Min(Max(dc, 0), len - actualStart);
+  }
 
-    // If the fast case fails, just continue with the slow, correct,
-    // spec-compliant case.
-    return SlowSplice(
-        context, arguments, o, len, actualStart, insertCount,
-        actualDeleteCount);
+  // 8. If len + insertCount - actualDeleteCount > 2^53-1, throw a
+  //    Bailout exception.
+  const newLength: Number = len + insertCount - actualDeleteCount;
+  if (newLength > kMaxSafeInteger) {
+    ThrowTypeError(MessageTemplate::kInvalidArrayLength, start);
   }
+
+  try {
+    return FastArraySplice(
+        context, arguments, o, len, actualStart, insertCount, actualDeleteCount)
+        otherwise Bailout;
+  } label Bailout {}
+
+  // If the fast case fails, just continue with the slow, correct,
+  // spec-compliant case.
+  return SlowSplice(
+      context, arguments, o, len, actualStart, insertCount, actualDeleteCount);
+}
 }
diff --git a/deps/v8/src/builtins/array-unshift.tq b/deps/v8/src/builtins/array-unshift.tq
index 3b66015d3b3..7afeeb06271 100644
--- a/deps/v8/src/builtins/array-unshift.tq
+++ b/deps/v8/src/builtins/array-unshift.tq
@@ -3,97 +3,95 @@
 // found in the LICENSE file.
 
 namespace array {
-  extern builtin ArrayUnshift(Context, JSFunction, JSAny, int32): JSAny;
+extern builtin ArrayUnshift(Context, JSFunction, JSAny, int32): JSAny;
 
-  transitioning macro GenericArrayUnshift(
-      context: Context, receiver: JSAny, arguments: Arguments): Number {
-    // 1. Let O be ? ToObject(this value).
-    const object: JSReceiver = ToObject_Inline(context, receiver);
+transitioning macro GenericArrayUnshift(
+    context: Context, receiver: JSAny, arguments: Arguments): Number {
+  // 1. Let O be ? ToObject(this value).
+  const object: JSReceiver = ToObject_Inline(context, receiver);
 
-    // 2. Let len be ? ToLength(? Get(O, "length")).
-    const length: Number = GetLengthProperty(object);
+  // 2. Let len be ? ToLength(? Get(O, "length")).
+  const length: Number = GetLengthProperty(object);
 
-    // 3. Let argCount be the number of actual arguments.
-    const argCount: Smi = Convert<Smi>(arguments.length);
+  // 3. Let argCount be the number of actual arguments.
+  const argCount: Smi = Convert<Smi>(arguments.length);
 
-    // 4. If argCount > 0, then.
-    if (argCount > 0) {
-      // a. If len + argCount > 2**53 - 1, throw a TypeError exception.
-      if (length + argCount > kMaxSafeInteger) {
-        ThrowTypeError(MessageTemplate::kInvalidArrayLength);
-      }
-
-      // b. Let k be len.
-      let k: Number = length;
+  // 4. If argCount > 0, then.
+  if (argCount > 0) {
+    // a. If len + argCount > 2**53 - 1, throw a TypeError exception.
+    if (length + argCount > kMaxSafeInteger) {
+      ThrowTypeError(MessageTemplate::kInvalidArrayLength);
+    }
 
-      // c. Repeat, while k > 0.
-      while (k > 0) {
-        // i. Let from be ! ToString(k - 1).
-        const from: Number = k - 1;
+    // b. Let k be len.
+    let k: Number = length;
 
-        // ii. Let to be ! ToString(k + argCount - 1).
-        const to: Number = k + argCount - 1;
+    // c. Repeat, while k > 0.
+    while (k > 0) {
+      // i. Let from be ! ToString(k - 1).
+      const from: Number = k - 1;
 
-        // iii. Let fromPresent be ? HasProperty(O, from).
-        const fromPresent: Boolean = HasProperty(object, from);
+      // ii. Let to be ! ToString(k + argCount - 1).
+      const to: Number = k + argCount - 1;
 
-        // iv. If fromPresent is true, then
-        if (fromPresent == True) {
-          // 1. Let fromValue be ? Get(O, from).
-          const fromValue: JSAny = GetProperty(object, from);
+      // iii. Let fromPresent be ? HasProperty(O, from).
+      const fromPresent: Boolean = HasProperty(object, from);
 
-          // 2. Perform ? Set(O, to, fromValue, true).
-          SetProperty(object, to, fromValue);
-        } else {
-          // 1. Perform ? DeletePropertyOrThrow(O, to).
-          DeleteProperty(object, to, LanguageMode::kStrict);
-        }
+      // iv. If fromPresent is true, then
+      if (fromPresent == True) {
+        // 1. Let fromValue be ? Get(O, from).
+        const fromValue: JSAny = GetProperty(object, from);
 
-        // vi. Decrease k by 1.
-        --k;
+        // 2. Perform ? Set(O, to, fromValue, true).
+        SetProperty(object, to, fromValue);
+      } else {
+        // 1. Perform ? DeletePropertyOrThrow(O, to).
+        DeleteProperty(object, to, LanguageMode::kStrict);
       }
 
-      // d. Let j be 0.
-      let j: Smi = 0;
+      // vi. Decrease k by 1.
+      --k;
+    }
 
-      // e. Let items be a List whose elements are, in left to right order,
-      //    the arguments that were passed to this function invocation.
-      // f. Repeat, while items is not empty
-      while (j < argCount) {
-        // ii .Perform ? Set(O, ! ToString(j), E, true).
-        SetProperty(object, j, arguments[Convert<intptr>(j)]);
+    // d. Let j be 0.
+    let j: Smi = 0;
 
-        // iii. Increase j by 1.
-        ++j;
-      }
+    // e. Let items be a List whose elements are, in left to right order,
+    //    the arguments that were passed to this function invocation.
+    // f. Repeat, while items is not empty
+    while (j < argCount) {
+      // ii .Perform ? Set(O, ! ToString(j), E, true).
+      SetProperty(object, j, arguments[Convert<intptr>(j)]);
+
+      // iii. Increase j by 1.
+      ++j;
     }
+  }
 
-    // 5. Perform ? Set(O, "length", len + argCount, true).
-    const newLength: Number = length + argCount;
-    SetProperty(object, kLengthString, newLength);
+  // 5. Perform ? Set(O, "length", len + argCount, true).
+  const newLength: Number = length + argCount;
+  SetProperty(object, kLengthString, newLength);
 
-    // 6. Return length + argCount.
-    return newLength;
-  }
+  // 6. Return length + argCount.
+  return newLength;
+}
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.unshift
-  transitioning javascript builtin ArrayPrototypeUnshift(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    try {
-      const array: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
-      array::EnsureWriteableFastElements(array);
-
-      const map: Map = array.map;
-      if (!IsExtensibleMap(map)) goto Slow;
-      EnsureArrayLengthWritable(map) otherwise Slow;
-
-      tail ArrayUnshift(
-          context, LoadTargetFromFrame(), Undefined,
-          Convert<int32>(arguments.length));
-    }
-    label Slow {
-      return GenericArrayUnshift(context, receiver, arguments);
-    }
+// https://tc39.github.io/ecma262/#sec-array.prototype.unshift
+transitioning javascript builtin ArrayPrototypeUnshift(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  try {
+    const array: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
+    array::EnsureWriteableFastElements(array);
+
+    const map: Map = array.map;
+    if (!IsExtensibleMap(map)) goto Slow;
+    EnsureArrayLengthWritable(map) otherwise Slow;
+
+    tail ArrayUnshift(
+        context, LoadTargetFromFrame(), Undefined,
+        Convert<int32>(arguments.length));
+  } label Slow {
+    return GenericArrayUnshift(context, receiver, arguments);
   }
 }
+}
diff --git a/deps/v8/src/builtins/array.tq b/deps/v8/src/builtins/array.tq
index a5ffcfe40e9..92b2c520e28 100644
--- a/deps/v8/src/builtins/array.tq
+++ b/deps/v8/src/builtins/array.tq
@@ -5,78 +5,85 @@
 #include 'src/builtins/builtins-array-gen.h'
 
 namespace array {
-  // Naming convention from elements.cc. We have a similar intent but implement
-  // fastpaths using generics instead of using a class hierarchy for elements
-  // kinds specific implementations.
-  type GenericElementsAccessor extends ElementsKind;
-  type FastPackedSmiElements extends ElementsKind;
-  type FastPackedObjectElements extends ElementsKind;
-  type FastPackedDoubleElements extends ElementsKind;
-  type FastSmiOrObjectElements extends ElementsKind;
-  type FastDoubleElements extends ElementsKind;
-  type DictionaryElements extends ElementsKind;
+// Naming convention from elements.cc. We have a similar intent but implement
+// fastpaths using generics instead of using a class hierarchy for elements
+// kinds specific implementations.
+type GenericElementsAccessor extends ElementsKind;
+type FastPackedSmiElements extends ElementsKind;
+type FastPackedObjectElements extends ElementsKind;
+type FastPackedDoubleElements extends ElementsKind;
+type FastSmiOrObjectElements extends ElementsKind;
+type FastDoubleElements extends ElementsKind;
+type DictionaryElements extends ElementsKind;
 
-  macro EnsureWriteableFastElements(implicit context: Context)(array: JSArray) {
-    assert(IsFastElementsKind(array.map.elements_kind));
+macro EnsureWriteableFastElements(implicit context: Context)(array: JSArray) {
+  assert(IsFastElementsKind(array.map.elements_kind));
 
-    const elements: FixedArrayBase = array.elements;
-    if (elements.map != kCOWMap) return;
+  const elements: FixedArrayBase = array.elements;
+  if (elements.map != kCOWMap) return;
 
-    // There are no COW *_DOUBLE_ELEMENTS arrays, so we are allowed to always
-    // extract FixedArrays and don't have to worry about FixedDoubleArrays.
-    assert(IsFastSmiOrTaggedElementsKind(array.map.elements_kind));
+  // There are no COW *_DOUBLE_ELEMENTS arrays, so we are allowed to always
+  // extract FixedArrays and don't have to worry about FixedDoubleArrays.
+  assert(IsFastSmiOrTaggedElementsKind(array.map.elements_kind));
 
-    const length =
-        Convert<intptr>(Cast<Smi>(array.length) otherwise unreachable);
-    array.elements =
-        ExtractFixedArray(UnsafeCast<FixedArray>(elements), 0, length, length);
-    assert(array.elements.map != kCOWMap);
-  }
+  const length = Convert<intptr>(Cast<Smi>(array.length) otherwise unreachable);
+  array.elements =
+      ExtractFixedArray(UnsafeCast<FixedArray>(elements), 0, length, length);
+  assert(array.elements.map != kCOWMap);
+}
 
-  macro LoadElementOrUndefined(implicit context:
-                                   Context)(a: FixedArray, i: Smi): JSAny {
-    const e = UnsafeCast<(JSAny | TheHole)>(a.objects[i]);
-    return ReplaceTheHoleWithUndefined(e);
-  }
+macro LoadElementOrUndefined(implicit context: Context)(
+    a: FixedArray, i: Smi): JSAny {
+  const e = UnsafeCast<(JSAny | TheHole)>(a.objects[i]);
+  return ReplaceTheHoleWithUndefined(e);
+}
 
-  macro LoadElementOrUndefined(a: FixedDoubleArray, i: Smi): NumberOrUndefined {
-    const f: float64 = a.floats[i].Value() otherwise return Undefined;
-    return AllocateHeapNumberWithValue(f);
-  }
+macro LoadElementOrUndefined(a: FixedDoubleArray, i: Smi): NumberOrUndefined {
+  const f: float64 = a.floats[i].Value() otherwise return Undefined;
+  return AllocateHeapNumberWithValue(f);
+}
 
-  macro StoreArrayHole(elements: FixedDoubleArray, k: Smi): void {
-    elements.floats[k] = kDoubleHole;
-  }
+macro StoreArrayHole(elements: FixedDoubleArray, k: Smi): void {
+  elements.floats[k] = kDoubleHole;
+}
 
-  macro StoreArrayHole(elements: FixedArray, k: Smi): void {
-    elements.objects[k] = TheHole;
-  }
+macro StoreArrayHole(elements: FixedArray, k: Smi): void {
+  elements.objects[k] = TheHole;
+}
 
-  extern macro SetPropertyLength(implicit context: Context)(JSAny, Number);
+extern macro SetPropertyLength(implicit context: Context)(JSAny, Number);
 
-  const kLengthDescriptorIndex:
-      constexpr int31 generates 'JSArray::kLengthDescriptorIndex';
-  const kAttributesReadOnlyMask: constexpr int31
-  generates 'PropertyDetails::kAttributesReadOnlyMask';
+const kLengthDescriptorIndex:
+    constexpr int31 generates 'JSArray::kLengthDescriptorIndex';
+const kAttributesReadOnlyMask: constexpr int31
+    generates 'PropertyDetails::kAttributesReadOnlyMask';
 
-  @export
-  macro EnsureArrayLengthWritable(implicit context: Context)(map: Map):
-      void labels Bailout {
-    // Don't support arrays in dictionary named property mode.
-    if (IsDictionaryMap(map)) {
-      goto Bailout;
-    }
+@export
+macro EnsureArrayLengthWritable(implicit context: Context)(map: Map):
+    void labels Bailout {
+  // Don't support arrays in dictionary named property mode.
+  if (IsDictionaryMap(map)) {
+    goto Bailout;
+  }
 
-    // Check whether the length property is writable. The length property is the
-    // only default named property on arrays. It's nonconfigurable, hence is
-    // guaranteed to stay the first property.
-    const descriptors: DescriptorArray = map.instance_descriptors;
-    const descriptor:&DescriptorEntry =
-        & descriptors.descriptors[kLengthDescriptorIndex];
-    assert(TaggedEqual(descriptor->key, LengthStringConstant()));
-    const details: Smi = UnsafeCast<Smi>(descriptor->details);
-    if ((details & kAttributesReadOnlyMask) != 0) {
-      goto Bailout;
-    }
+  // Check whether the length property is writable. The length property is the
+  // only default named property on arrays. It's nonconfigurable, hence is
+  // guaranteed to stay the first property.
+  const descriptors: DescriptorArray = map.instance_descriptors;
+  const descriptor:&DescriptorEntry =
+      & descriptors.descriptors[kLengthDescriptorIndex];
+  assert(TaggedEqual(descriptor->key, LengthStringConstant()));
+  const details: Smi = UnsafeCast<Smi>(descriptor->details);
+  if ((details & kAttributesReadOnlyMask) != 0) {
+    goto Bailout;
   }
 }
+
+macro CreateJSArrayWithElements(implicit context: Context)(array: FixedArray):
+    JSArray {
+  const nativeContext: NativeContext = LoadNativeContext(context);
+  const map: Map =
+      LoadJSArrayElementsMap(ElementsKind::PACKED_ELEMENTS, nativeContext);
+  return AllocateJSArray(map, array, array.length);
+}
+}
diff --git a/deps/v8/src/builtins/base.tq b/deps/v8/src/builtins/base.tq
index 7d87a55e884..4db796da122 100644
--- a/deps/v8/src/builtins/base.tq
+++ b/deps/v8/src/builtins/base.tq
@@ -52,6 +52,7 @@ extern macro MakeWeak(HeapObject): WeakHeapObject;
 extern macro GetHeapObjectAssumeWeak(WeakHeapObject):
     HeapObject labels ClearedWeakPointer;
 extern macro IsWeakOrCleared(MaybeObject): bool;
+extern macro IsWeakReferenceToObject(MaybeObject, Object): bool;
 
 macro StrongToWeak<T: type>(x: T): Weak<T> {
   return %RawDownCast<Weak<T>>(MakeWeak(x));
@@ -77,7 +78,8 @@ type JSPrimitive = Numeric|String|Symbol|Boolean|Null|Undefined;
 // TheHole or FixedArray.
 type JSAny = JSReceiver|JSPrimitive;
 
-type JSAnyNotNumber = BigInt|String|Symbol|Boolean|Null|Undefined|JSReceiver;
+type JSAnyNotNumeric = String|Symbol|Boolean|Null|Undefined|JSReceiver;
+type JSAnyNotNumber = BigInt|JSAnyNotNumeric;
 
 // This is the intersection of JSAny and HeapObject.
 type JSAnyNotSmi = JSAnyNotNumber|HeapNumber;
@@ -147,6 +149,8 @@ type ObjectHashTable extends HashTable
 extern class NumberDictionary extends HashTable;
 
 type RawPtr generates 'TNode<RawPtrT>' constexpr 'void*';
+type ExternalPointer
+    generates 'TNode<ExternalPointerT>' constexpr 'ExternalPointer_t';
 extern class Code extends HeapObject;
 type BuiltinPtr extends Smi generates 'TNode<BuiltinPtr>';
 
@@ -253,12 +257,15 @@ constexpr 'CodeStubAssembler::ExtractFixedArrayFlag' {
 const kBigIntMaxLength: constexpr intptr generates 'BigInt::kMaxLength';
 
 extern enum MessageTemplate {
+  kAllPromisesRejected,
   kInvalidArrayBufferLength,
   kInvalidArrayLength,
   kInvalidIndex,
   kNotConstructor,
+  kNotGeneric,
   kCalledNonCallable,
   kCalledOnNullOrUndefined,
+  kCannotConvertToPrimitive,
   kProtoObjectOrNull,
   kInvalidOffset,
   kInvalidTypedArrayLength,
@@ -287,12 +294,11 @@ extern enum MessageTemplate {
   kPromiseNonCallable,
   kNotAPromise,
   kResolverNotAFunction,
-  kTooManyElementsInPromiseAll,
+  kTooManyElementsInPromiseCombinator,
   kToRadixFormatRange,
   kCalledOnNonObject,
   kRegExpGlobalInvokedOnNonGlobal,
   kProxyNonObject,
-  kProxyHandlerOrTargetRevoked,
   kProxyRevoked,
   kProxyTrapReturnedFalsishFor,
   kProxyPrivate,
@@ -303,6 +309,25 @@ extern enum MessageTemplate {
   kProxyGetPrototypeOfNonExtensible,
   kProxySetPrototypeOfNonExtensible,
   kProxyDeletePropertyNonExtensible,
+  kUndefinedOrNullToObject,
+  kWeakRefsCleanupMustBeCallable,
+  kWasmTrapUnreachable,
+  kWasmTrapMemOutOfBounds,
+  kWasmTrapUnalignedAccess,
+  kWasmTrapDivByZero,
+  kWasmTrapDivUnrepresentable,
+  kWasmTrapRemByZero,
+  kWasmTrapFloatUnrepresentable,
+  kWasmTrapFuncInvalid,
+  kWasmTrapFuncSigMismatch,
+  kWasmTrapDataSegmentDropped,
+  kWasmTrapElemSegmentDropped,
+  kWasmTrapTableOutOfBounds,
+  kWasmTrapBrOnExnNullRef,
+  kWasmTrapRethrowNullRef,
+  kWasmTrapNullDereference,
+  kWasmTrapIllegalCast,
+  kWasmTrapArrayOutOfBounds,
   ...
 }
 
@@ -329,6 +354,8 @@ const kStringMaxLengthUintptr:
     constexpr uintptr generates 'String::kMaxLength';
 const kFixedArrayMaxLength:
     constexpr int31 generates 'FixedArray::kMaxLength';
+const kFixedDoubleArrayMaxLength:
+    constexpr int31 generates 'FixedDoubleArray::kMaxLength';
 const kObjectAlignmentMask: constexpr intptr
     generates 'kObjectAlignmentMask';
 const kMinAddedElementsCapacity:
@@ -340,12 +367,6 @@ const kMaxRegularHeapObjectSize: constexpr int31
 
 const kMaxNewSpaceFixedArrayElements: constexpr int31
     generates 'FixedArray::kMaxRegularLength';
-const kSloppyArgumentsArgumentsIndex: constexpr int31
-    generates 'SloppyArgumentsElements::kArgumentsIndex';
-const kSloppyArgumentsContextIndex: constexpr int31
-    generates 'SloppyArgumentsElements::kContextIndex';
-const kSloppyArgumentsParameterMapStart: constexpr int31
-    generates 'SloppyArgumentsElements::kParameterMapStart';
 
 extern enum PrimitiveType { kString, kBoolean, kSymbol, kNumber }
 
@@ -363,19 +384,28 @@ type Boolean = True|False;
 
 type NumberOrUndefined = Number|Undefined;
 
-extern macro TheHoleConstant(): TheHole;
-extern macro NullConstant(): Null;
-extern macro UndefinedConstant(): Undefined;
-extern macro TrueConstant(): True;
+extern macro DefaultStringConstant(): String;
+extern macro EmptyStringConstant(): EmptyString;
+extern macro ErrorsStringConstant(): String;
 extern macro FalseConstant(): False;
-extern macro Int32TrueConstant(): bool;
 extern macro Int32FalseConstant(): bool;
-extern macro EmptyStringConstant(): EmptyString;
-extern macro LengthStringConstant(): String;
-extern macro NanConstant(): NaN;
+extern macro Int32TrueConstant(): bool;
 extern macro IteratorSymbolConstant(): PublicSymbol;
+extern macro LengthStringConstant(): String;
 extern macro MatchSymbolConstant(): Symbol;
+extern macro MessageStringConstant(): String;
+extern macro NanConstant(): NaN;
+extern macro NameStringConstant(): String;
+extern macro NullConstant(): Null;
+extern macro NumberStringConstant(): String;
 extern macro ReturnStringConstant(): String;
+extern macro StringStringConstant(): String;
+extern macro TheHoleConstant(): TheHole;
+extern macro ToPrimitiveSymbolConstant(): PublicSymbol;
+extern macro ToStringStringConstant(): String;
+extern macro TrueConstant(): True;
+extern macro UndefinedConstant(): Undefined;
+extern macro ValueOfStringConstant(): String;
 
 const TheHole: TheHole = TheHoleConstant();
 const Null: Null = NullConstant();
@@ -384,6 +414,7 @@ const True: True = TrueConstant();
 const False: False = FalseConstant();
 const kEmptyString: EmptyString = EmptyStringConstant();
 const kLengthString: String = LengthStringConstant();
+const kMessageString: String = MessageStringConstant();
 const kReturnString: String = ReturnStringConstant();
 
 const kNaN: NaN = NanConstant();
@@ -491,9 +522,9 @@ extern transitioning macro ToThisValue(implicit context: Context)(
 extern transitioning macro GetProperty(implicit context: Context)(
     JSAny, JSAny): JSAny;
 extern transitioning builtin SetProperty(implicit context: Context)(
-    JSAny, JSAny, JSAny);
+    JSAny, JSAny, JSAny): JSAny;
 extern transitioning builtin SetPropertyInLiteral(implicit context: Context)(
-    JSAny, JSAny, JSAny);
+    JSAny, JSAny, JSAny): JSAny;
 extern transitioning builtin DeleteProperty(implicit context: Context)(
     JSAny, JSAny | PrivateSymbol, LanguageModeSmi): Boolean;
 extern transitioning builtin HasProperty(implicit context: Context)(
@@ -502,8 +533,6 @@ extern transitioning macro HasProperty_Inline(implicit context: Context)(
     JSReceiver, JSAny): Boolean;
 extern builtin LoadIC(
     Context, JSAny, JSAny, TaggedIndex, FeedbackVector): JSAny;
-extern macro CollectCallFeedback(
-    JSAny, Context, Undefined | FeedbackVector, uintptr);
 
 extern macro ThrowRangeError(implicit context: Context)(
     constexpr MessageTemplate): never;
@@ -557,10 +586,6 @@ extern builtin ToObject(Context, JSAny): JSReceiver;
 extern macro ToObject_Inline(Context, JSAny): JSReceiver;
 extern macro IsNullOrUndefined(Object): bool;
 extern macro IsString(HeapObject): bool;
-transitioning builtin ToString(context: Context, o: JSAny): String {
-  return ToStringImpl(context, o);
-}
-extern transitioning runtime ToStringRT(Context, JSAny): String;
 extern transitioning builtin NonPrimitiveToPrimitive_String(
     Context, JSAny): JSPrimitive;
 extern transitioning builtin NonPrimitiveToPrimitive_Default(
@@ -592,6 +617,18 @@ extern macro StringCharCodeAt(String, uintptr): int32;
 extern runtime StringCompareSequence(Context, String, String, Number): Boolean;
 extern macro StringFromSingleCharCode(int32): String;
 
+extern macro NumberToString(Number): String;
+extern macro StringToNumber(String): Number;
+extern macro NonNumberToNumber(implicit context: Context)(JSAnyNotNumber):
+    Number;
+extern macro NonNumberToNumeric(implicit context: Context)(JSAnyNotNumber):
+    Numeric;
+
+extern macro Equal(JSAny, JSAny, Context): Boolean;
+macro Equal(implicit context: Context)(left: JSAny, right: JSAny): Boolean {
+  return Equal(left, right);
+}
+
 extern macro StrictEqual(JSAny, JSAny): Boolean;
 extern macro SmiLexicographicCompare(Smi, Smi): Smi;
 extern runtime ReThrow(Context, JSAny): never;
@@ -640,6 +677,7 @@ extern macro IsFastAliasedArgumentsMap(implicit context: Context)(Map): bool;
 extern macro IsSlowAliasedArgumentsMap(implicit context: Context)(Map): bool;
 extern macro IsSloppyArgumentsMap(implicit context: Context)(Map): bool;
 extern macro IsStrictArgumentsMap(implicit context: Context)(Map): bool;
+extern macro IsTuple2Map(Map): bool;
 
 extern macro SmiAbove(Smi, Smi): bool;
 
@@ -701,7 +739,8 @@ macro Float64IsNaN(n: float64): bool {
 }
 
 // The type of all tagged values that can safely be compared with TaggedEqual.
-type TaggedWithIdentity = JSReceiver|FixedArrayBase|Oddball|Map|EmptyString;
+type TaggedWithIdentity =
+    JSReceiver|FixedArrayBase|Oddball|Map|WeakCell|Context|EmptyString;
 
 extern operator '==' macro TaggedEqual(TaggedWithIdentity, Object): bool;
 extern operator '==' macro TaggedEqual(Object, TaggedWithIdentity): bool;
@@ -788,6 +827,7 @@ extern operator '+' macro Float64Add(float64, float64): float64;
 extern operator '-' macro Float64Sub(float64, float64): float64;
 extern operator '*' macro Float64Mul(float64, float64): float64;
 extern operator '/' macro Float64Div(float64, float64): float64;
+extern operator '%' macro Float64Mod(float64, float64): float64;
 
 extern operator '+' macro NumberAdd(Number, Number): Number;
 extern operator '-' macro NumberSub(Number, Number): Number;
@@ -856,6 +896,7 @@ extern macro TaggedIsNotSmi(Object): bool;
 extern macro TaggedIsPositiveSmi(Object): bool;
 extern macro IsValidPositiveSmi(intptr): bool;
 
+extern macro IsInteger(JSAny): bool;
 extern macro IsInteger(HeapNumber): bool;
 
 extern macro AllocateHeapNumberWithValue(float64): HeapNumber;
@@ -877,11 +918,16 @@ extern macro TruncateIntPtrToInt32(intptr): int32;
 extern macro SmiTag(intptr): Smi;
 extern macro SmiFromInt32(int32): Smi;
 extern macro SmiFromUint32(uint32): Smi;
+extern macro SmiFromIntPtr(intptr): Smi;
 extern macro SmiUntag(Smi): intptr;
 macro SmiUntag<T: type>(value: SmiTagged<T>): T {
   return %RawDownCast<T>(Unsigned(SmiToInt32(Convert<Smi>(value))));
 }
+macro SmiTag<T : type extends uint31>(value: T): SmiTagged<T> {
+  return %RawDownCast<SmiTagged<T>>(SmiFromUint32(value));
+}
 extern macro SmiToInt32(Smi): int32;
+extern macro SmiToFloat64(Smi): float64;
 extern macro TaggedIndexToIntPtr(TaggedIndex): intptr;
 extern macro IntPtrToTaggedIndex(intptr): TaggedIndex;
 extern macro TaggedIndexToSmi(TaggedIndex): Smi;
@@ -889,9 +935,14 @@ extern macro SmiToTaggedIndex(Smi): TaggedIndex;
 extern macro RoundIntPtrToFloat64(intptr): float64;
 extern macro ChangeFloat32ToFloat64(float32): float64;
 extern macro ChangeNumberToFloat64(Number): float64;
+extern macro ChangeNumberToUint32(Number): uint32;
+extern macro ChangeTaggedNonSmiToInt32(implicit context: Context)(JSAnyNotSmi):
+    int32;
+extern macro ChangeTaggedToFloat64(implicit context: Context)(JSAny): float64;
 extern macro ChangeFloat64ToTagged(float64): Number;
 extern macro ChangeFloat64ToUintPtr(float64): uintptr;
 extern macro ChangeFloat64ToIntPtr(float64): intptr;
+extern macro ChangeInt32ToFloat64(int32): float64;
 extern macro ChangeInt32ToIntPtr(int32): intptr;   // Sign-extends.
 extern macro ChangeUint32ToWord(uint32): uintptr;  // Doesn't sign-extend.
 extern macro LoadNativeContext(Context): NativeContext;
@@ -952,7 +1003,6 @@ extern macro EmptyFixedArrayConstant(): EmptyFixedArray;
 extern macro PromiseCapabilityMapConstant(): Map;
 extern macro OneByteStringMapConstant(): Map;
 extern macro StringMapConstant(): Map;
-extern macro SloppyArgumentsElementsMapConstant(): Map;
 
 const kFixedArrayMap: Map = FixedArrayMapConstant();
 const kFixedDoubleArrayMap: Map = FixedDoubleArrayMapConstant();
@@ -964,7 +1014,6 @@ const kPromiseCapabilityMap: Map = PromiseCapabilityMapConstant();
 const kOneByteStringMap: Map = OneByteStringMapConstant();
 // The map of a non-internalized internal SeqTwoByteString.
 const kStringMap: Map = StringMapConstant();
-const kSloppyArgumentsElementsMap: Map = SloppyArgumentsElementsMapConstant();
 
 extern macro IsPrototypeInitialArrayPrototype(implicit context: Context)(Map):
     bool;
@@ -1241,8 +1290,7 @@ macro ChangeUintPtrNumberToUintPtr(value: Number): uintptr {
   try {
     return TryNumberToUintPtr(value, kModeValueIsSafeIntegerUintPtr)
         otherwise InvalidValue, InvalidValue, InvalidValue;
-  }
-  label InvalidValue {
+  } label InvalidValue {
     unreachable;
   }
 }
@@ -1253,8 +1301,7 @@ macro ChangeSafeIntegerNumberToUintPtr(value: Number):
   try {
     return TryNumberToUintPtr(value, kModeValueIsSafeInteger)
         otherwise InvalidValue, IfUIntPtrOverflow, InvalidValue;
-  }
-  label InvalidValue {
+  } label InvalidValue {
     unreachable;
   }
 }
@@ -1300,8 +1347,7 @@ transitioning macro GetLengthProperty(implicit context: Context)(o: JSAny):
         goto ToLength(GetProperty(o, kLengthString));
       }
     }
-  }
-  label ToLength(length: JSAny) deferred {
+  } label ToLength(length: JSAny) deferred {
     return ToLength_Inline(length);
   }
 }
@@ -1321,8 +1367,7 @@ transitioning macro GetMethod(implicit context: Context)(
     o: JSAny, name: String): Callable labels IfNullOrUndefined {
   try {
     return GetMethod(o, name) otherwise IfNullOrUndefined, IfMethodNotCallable;
-  }
-  label IfMethodNotCallable(value: JSAny) deferred {
+  } label IfMethodNotCallable(value: JSAny) deferred {
     ThrowTypeError(MessageTemplate::kPropertyNotFunction, value, name, o);
   }
 }
@@ -1341,7 +1386,6 @@ transitioning macro GetMethod(implicit context: Context)(
       MessageTemplate::kPropertyNotFunction, value, symbol, o);
 }
 
-extern macro NumberToString(Number): String;
 extern macro IsOneByteStringInstanceType(InstanceType): bool;
 
 // After converting an index to an integer, calculate a relative index:
@@ -1428,7 +1472,7 @@ macro ClampToIndexRange(indexNumber: Number, limit: uintptr): uintptr {
   }
 }
 
-extern builtin ObjectToString(Context, JSAny): JSAny;
+extern builtin ObjectToString(Context, JSAny): String;
 extern builtin StringRepeat(Context, String, Number): String;
 
 @export
@@ -1485,8 +1529,8 @@ extern transitioning runtime
 CreateDataProperty(implicit context: Context)(JSReceiver, JSAny, JSAny);
 
 namespace runtime {
-  extern runtime
-  GetDerivedMap(Context, JSFunction, JSReceiver): Map;
+extern runtime
+GetDerivedMap(Context, JSFunction, JSReceiver): Map;
 }
 
 transitioning builtin FastCreateDataProperty(implicit context: Context)(
@@ -1537,42 +1581,12 @@ transitioning builtin FastCreateDataProperty(implicit context: Context)(
         elements[index] = value;
       }
     }
-  }
-  label Slow {
+  } label Slow {
     CreateDataProperty(receiver, key, value);
   }
   return Undefined;
 }
 
-@export
-transitioning macro ToStringImpl(context: Context, o: JSAny): String {
-  let result: JSAny = o;
-  while (true) {
-    typeswitch (result) {
-      case (num: Number): {
-        return NumberToString(num);
-      }
-      case (str: String): {
-        return str;
-      }
-      case (oddball: Oddball): {
-        return oddball.to_string;
-      }
-      case (JSReceiver): {
-        result = NonPrimitiveToPrimitive_String(context, result);
-        continue;
-      }
-      case (Symbol): {
-        ThrowTypeError(MessageTemplate::kSymbolToString);
-      }
-      case (JSAny): {
-        return ToStringRT(context, o);
-      }
-    }
-  }
-  unreachable;
-}
-
 macro VerifiedUnreachable(): never {
   StaticAssert(false);
   unreachable;
diff --git a/deps/v8/src/builtins/bigint.tq b/deps/v8/src/builtins/bigint.tq
index 02dca7543ef..d52de7f84ea 100644
--- a/deps/v8/src/builtins/bigint.tq
+++ b/deps/v8/src/builtins/bigint.tq
@@ -23,225 +23,218 @@ Convert<BigInt, MutableBigInt>(i: MutableBigInt): BigInt {
 
 namespace bigint {
 
-  const kPositiveSign: uint32 = 0;
-  const kNegativeSign: uint32 = 1;
+const kPositiveSign: uint32 = 0;
+const kNegativeSign: uint32 = 1;
+
+extern macro BigIntBuiltinsAssembler::CppAbsoluteAddAndCanonicalize(
+    MutableBigInt, BigIntBase, BigIntBase): void;
+extern macro BigIntBuiltinsAssembler::CppAbsoluteSubAndCanonicalize(
+    MutableBigInt, BigIntBase, BigIntBase): void;
+extern macro BigIntBuiltinsAssembler::CppAbsoluteCompare(
+    BigIntBase, BigIntBase): int32;
+
+extern macro BigIntBuiltinsAssembler::ReadBigIntSign(BigIntBase): uint32;
+extern macro BigIntBuiltinsAssembler::ReadBigIntLength(BigIntBase): intptr;
+extern macro BigIntBuiltinsAssembler::WriteBigIntSignAndLength(
+    MutableBigInt, uint32, intptr): void;
+
+extern macro CodeStubAssembler::AllocateBigInt(intptr): MutableBigInt;
+extern macro CodeStubAssembler::StoreBigIntDigit(
+    MutableBigInt, intptr, uintptr): void;
+extern macro CodeStubAssembler::LoadBigIntDigit(BigIntBase, intptr): uintptr;
+
+macro IsCanonicalized(bigint: BigIntBase): bool {
+  const length = ReadBigIntLength(bigint);
+
+  if (length == 0) {
+    return ReadBigIntSign(bigint) == kPositiveSign;
+  }
+
+  return LoadBigIntDigit(bigint, length - 1) != 0;
+}
+
+macro InvertSign(sign: uint32): uint32 {
+  return sign == kPositiveSign ? kNegativeSign : kPositiveSign;
+}
+
+macro AllocateEmptyBigIntNoThrow(implicit context: Context)(
+    sign: uint32, length: intptr): MutableBigInt labels BigIntTooBig {
+  if (length > kBigIntMaxLength) {
+    goto BigIntTooBig;
+  }
+  const result: MutableBigInt = AllocateBigInt(length);
+
+  WriteBigIntSignAndLength(result, sign, length);
+  return result;
+}
+
+macro AllocateEmptyBigInt(implicit context: Context)(
+    sign: uint32, length: intptr): MutableBigInt {
+  try {
+    return AllocateEmptyBigIntNoThrow(sign, length) otherwise BigIntTooBig;
+  } label BigIntTooBig {
+    ThrowRangeError(MessageTemplate::kBigIntTooBig);
+  }
+}
+
+macro MutableBigIntAbsoluteCompare(x: BigIntBase, y: BigIntBase): int32 {
+  return CppAbsoluteCompare(x, y);
+}
+
+macro MutableBigIntAbsoluteSub(implicit context: Context)(
+    x: BigInt, y: BigInt, resultSign: uint32): BigInt {
+  const xlength = ReadBigIntLength(x);
+  const ylength = ReadBigIntLength(y);
+  const xsign = ReadBigIntSign(x);
+
+  assert(MutableBigIntAbsoluteCompare(x, y) >= 0);
+  if (xlength == 0) {
+    assert(ylength == 0);
+    return x;
+  }
+
+  if (ylength == 0) {
+    return resultSign == xsign ? x : BigIntUnaryMinus(x);
+  }
+
+  const result = AllocateEmptyBigInt(resultSign, xlength);
+  CppAbsoluteSubAndCanonicalize(result, x, y);
+  return Convert<BigInt>(result);
+}
+
+macro MutableBigIntAbsoluteAdd(implicit context: Context)(
+    xBigint: BigInt, yBigint: BigInt,
+    resultSign: uint32): BigInt labels BigIntTooBig {
+  let xlength = ReadBigIntLength(xBigint);
+  let ylength = ReadBigIntLength(yBigint);
+
+  let x = xBigint;
+  let y = yBigint;
+  if (xlength < ylength) {
+    // Swap x and y so that x is longer.
+    x = yBigint;
+    y = xBigint;
+    const tempLength = xlength;
+    xlength = ylength;
+    ylength = tempLength;
+  }
+
+  // case: 0n + 0n
+  if (xlength == 0) {
+    assert(ylength == 0);
+    return x;
+  }
+
+  // case: x + 0n
+  if (ylength == 0) {
+    return resultSign == ReadBigIntSign(x) ? x : BigIntUnaryMinus(x);
+  }
 
-  extern macro BigIntBuiltinsAssembler::CppAbsoluteAddAndCanonicalize(
-      MutableBigInt, BigIntBase, BigIntBase): void;
-  extern macro BigIntBuiltinsAssembler::CppAbsoluteSubAndCanonicalize(
-      MutableBigInt, BigIntBase, BigIntBase): void;
-  extern macro BigIntBuiltinsAssembler::CppAbsoluteCompare(
-      BigIntBase, BigIntBase): int32;
-
-  extern macro BigIntBuiltinsAssembler::ReadBigIntSign(BigIntBase): uint32;
-  extern macro BigIntBuiltinsAssembler::ReadBigIntLength(BigIntBase): intptr;
-  extern macro BigIntBuiltinsAssembler::WriteBigIntSignAndLength(
-      MutableBigInt, uint32, intptr): void;
+  // case: x + y
+  const result = AllocateEmptyBigIntNoThrow(resultSign, xlength + 1)
+      otherwise BigIntTooBig;
+  CppAbsoluteAddAndCanonicalize(result, x, y);
+  return Convert<BigInt>(result);
+}
+
+macro BigIntAddImpl(implicit context: Context)(x: BigInt, y: BigInt): BigInt
+    labels BigIntTooBig {
+  const xsign = ReadBigIntSign(x);
+  const ysign = ReadBigIntSign(y);
+  if (xsign == ysign) {
+    // x + y == x + y
+    // -x + -y == -(x + y)
+    return MutableBigIntAbsoluteAdd(x, y, xsign) otherwise BigIntTooBig;
+  }
+
+  // x + -y == x - y == -(y - x)
+  // -x + y == y - x == -(x - y)
+  if (MutableBigIntAbsoluteCompare(x, y) >= 0) {
+    return MutableBigIntAbsoluteSub(x, y, xsign);
+  }
+  return MutableBigIntAbsoluteSub(y, x, InvertSign(xsign));
+}
+
+builtin BigIntAddNoThrow(implicit context: Context)(
+    x: BigInt, y: BigInt): Numeric {
+  try {
+    return BigIntAddImpl(x, y) otherwise BigIntTooBig;
+  } label BigIntTooBig {
+    // Smi sentinal is used to signal BigIntTooBig exception.
+    return Convert<Smi>(0);
+  }
+}
+
+builtin BigIntAdd(implicit context: Context)(
+    xNum: Numeric, yNum: Numeric): BigInt {
+  try {
+    const x = Cast<BigInt>(xNum) otherwise MixedTypes;
+    const y = Cast<BigInt>(yNum) otherwise MixedTypes;
+
+    return BigIntAddImpl(x, y) otherwise BigIntTooBig;
+  } label MixedTypes {
+    ThrowTypeError(MessageTemplate::kBigIntMixedTypes);
+  } label BigIntTooBig {
+    ThrowRangeError(MessageTemplate::kBigIntTooBig);
+  }
+}
+
+macro BigIntSubtractImpl(implicit context: Context)(
+    x: BigInt, y: BigInt): BigInt labels BigIntTooBig {
+  const xsign = ReadBigIntSign(x);
+  const ysign = ReadBigIntSign(y);
+  if (xsign != ysign) {
+    // x - (-y) == x + y
+    // (-x) - y == -(x + y)
+    return MutableBigIntAbsoluteAdd(x, y, xsign) otherwise BigIntTooBig;
+  }
 
-  extern macro CodeStubAssembler::AllocateBigInt(intptr): MutableBigInt;
-  extern macro CodeStubAssembler::StoreBigIntDigit(
-      MutableBigInt, intptr, uintptr): void;
-  extern macro CodeStubAssembler::LoadBigIntDigit(BigIntBase, intptr): uintptr;
-
-  macro IsCanonicalized(bigint: BigIntBase): bool {
-    const length = ReadBigIntLength(bigint);
-
-    if (length == 0) {
-      return ReadBigIntSign(bigint) == kPositiveSign;
-    }
-
-    return LoadBigIntDigit(bigint, length - 1) != 0;
-  }
-
-  macro InvertSign(sign: uint32): uint32 {
-    return sign == kPositiveSign ? kNegativeSign : kPositiveSign;
-  }
-
-  macro AllocateEmptyBigIntNoThrow(implicit context: Context)(
-      sign: uint32, length: intptr): MutableBigInt labels BigIntTooBig {
-    if (length > kBigIntMaxLength) {
-      goto BigIntTooBig;
-    }
-    const result: MutableBigInt = AllocateBigInt(length);
-
-    WriteBigIntSignAndLength(result, sign, length);
-    return result;
-  }
-
-  macro AllocateEmptyBigInt(implicit context: Context)(
-      sign: uint32, length: intptr): MutableBigInt {
-    try {
-      return AllocateEmptyBigIntNoThrow(sign, length) otherwise BigIntTooBig;
-    }
-    label BigIntTooBig {
-      ThrowRangeError(MessageTemplate::kBigIntTooBig);
-    }
-  }
-
-  macro MutableBigIntAbsoluteCompare(x: BigIntBase, y: BigIntBase): int32 {
-    return CppAbsoluteCompare(x, y);
-  }
-
-  macro MutableBigIntAbsoluteSub(implicit context: Context)(
-      x: BigInt, y: BigInt, resultSign: uint32): BigInt {
-    const xlength = ReadBigIntLength(x);
-    const ylength = ReadBigIntLength(y);
-    const xsign = ReadBigIntSign(x);
-
-    assert(MutableBigIntAbsoluteCompare(x, y) >= 0);
-    if (xlength == 0) {
-      assert(ylength == 0);
-      return x;
-    }
-
-    if (ylength == 0) {
-      return resultSign == xsign ? x : BigIntUnaryMinus(x);
-    }
-
-    const result = AllocateEmptyBigInt(resultSign, xlength);
-    CppAbsoluteSubAndCanonicalize(result, x, y);
-    return Convert<BigInt>(result);
-  }
-
-  macro MutableBigIntAbsoluteAdd(implicit context: Context)(
-      xBigint: BigInt, yBigint: BigInt,
-      resultSign: uint32): BigInt labels BigIntTooBig {
-    let xlength = ReadBigIntLength(xBigint);
-    let ylength = ReadBigIntLength(yBigint);
-
-    let x = xBigint;
-    let y = yBigint;
-    if (xlength < ylength) {
-      // Swap x and y so that x is longer.
-      x = yBigint;
-      y = xBigint;
-      const tempLength = xlength;
-      xlength = ylength;
-      ylength = tempLength;
-    }
-
-    // case: 0n + 0n
-    if (xlength == 0) {
-      assert(ylength == 0);
-      return x;
-    }
-
-    // case: x + 0n
-    if (ylength == 0) {
-      return resultSign == ReadBigIntSign(x) ? x : BigIntUnaryMinus(x);
-    }
-
-    // case: x + y
-    const result = AllocateEmptyBigIntNoThrow(resultSign, xlength + 1)
-        otherwise BigIntTooBig;
-    CppAbsoluteAddAndCanonicalize(result, x, y);
-    return Convert<BigInt>(result);
-  }
-
-  macro BigIntAddImpl(implicit context: Context)(x: BigInt, y: BigInt): BigInt
-      labels BigIntTooBig {
-    const xsign = ReadBigIntSign(x);
-    const ysign = ReadBigIntSign(y);
-    if (xsign == ysign) {
-      // x + y == x + y
-      // -x + -y == -(x + y)
-      return MutableBigIntAbsoluteAdd(x, y, xsign) otherwise BigIntTooBig;
-    }
-
-    // x + -y == x - y == -(y - x)
-    // -x + y == y - x == -(x - y)
-    if (MutableBigIntAbsoluteCompare(x, y) >= 0) {
-      return MutableBigIntAbsoluteSub(x, y, xsign);
-    }
-    return MutableBigIntAbsoluteSub(y, x, InvertSign(xsign));
-  }
-
-  builtin BigIntAddNoThrow(implicit context: Context)(x: BigInt, y: BigInt):
-      Numeric {
-    try {
-      return BigIntAddImpl(x, y) otherwise BigIntTooBig;
-    }
-    label BigIntTooBig {
-      // Smi sentinal is used to signal BigIntTooBig exception.
-      return Convert<Smi>(0);
-    }
-  }
-
-  builtin BigIntAdd(implicit context: Context)(xNum: Numeric, yNum: Numeric):
-      BigInt {
-    try {
-      const x = Cast<BigInt>(xNum) otherwise MixedTypes;
-      const y = Cast<BigInt>(yNum) otherwise MixedTypes;
-
-      return BigIntAddImpl(x, y) otherwise BigIntTooBig;
-    }
-    label MixedTypes {
-      ThrowTypeError(MessageTemplate::kBigIntMixedTypes);
-    }
-    label BigIntTooBig {
-      ThrowRangeError(MessageTemplate::kBigIntTooBig);
-    }
-  }
-
-  macro BigIntSubtractImpl(implicit context: Context)(x: BigInt, y: BigInt):
-      BigInt labels BigIntTooBig {
-    const xsign = ReadBigIntSign(x);
-    const ysign = ReadBigIntSign(y);
-    if (xsign != ysign) {
-      // x - (-y) == x + y
-      // (-x) - y == -(x + y)
-      return MutableBigIntAbsoluteAdd(x, y, xsign) otherwise BigIntTooBig;
-    }
-
-    // x - y == -(y - x)
-    // (-x) - (-y) == y - x == -(x - y)
-    if (MutableBigIntAbsoluteCompare(x, y) >= 0) {
-      return MutableBigIntAbsoluteSub(x, y, xsign);
-    }
-    return MutableBigIntAbsoluteSub(y, x, InvertSign(xsign));
-  }
-
-  builtin BigIntSubtractNoThrow(implicit context:
-                                    Context)(x: BigInt, y: BigInt): Numeric {
-    try {
-      return BigIntSubtractImpl(x, y) otherwise BigIntTooBig;
-    }
-    label BigIntTooBig {
-      // Smi sentinal is used to signal BigIntTooBig exception.
-      return Convert<Smi>(0);
-    }
-  }
-
-  builtin BigIntSubtract(implicit context:
-                             Context)(xNum: Numeric, yNum: Numeric): BigInt {
-    try {
-      const x = Cast<BigInt>(xNum) otherwise MixedTypes;
-      const y = Cast<BigInt>(yNum) otherwise MixedTypes;
-
-      return BigIntSubtractImpl(x, y) otherwise BigIntTooBig;
-    }
-    label MixedTypes {
-      ThrowTypeError(MessageTemplate::kBigIntMixedTypes);
-    }
-    label BigIntTooBig {
-      ThrowRangeError(MessageTemplate::kBigIntTooBig);
-    }
-  }
-
-  builtin BigIntUnaryMinus(implicit context: Context)(bigint: BigInt): BigInt {
-    const length = ReadBigIntLength(bigint);
-
-    // There is no -0n.
-    if (length == 0) {
-      return bigint;
-    }
-
-    const result =
-        AllocateEmptyBigInt(InvertSign(ReadBigIntSign(bigint)), length);
-    for (let i: intptr = 0; i < length; ++i) {
-      StoreBigIntDigit(result, i, LoadBigIntDigit(bigint, i));
-    }
-    return Convert<BigInt>(result);
+  // x - y == -(y - x)
+  // (-x) - (-y) == y - x == -(x - y)
+  if (MutableBigIntAbsoluteCompare(x, y) >= 0) {
+    return MutableBigIntAbsoluteSub(x, y, xsign);
   }
+  return MutableBigIntAbsoluteSub(y, x, InvertSign(xsign));
+}
+
+builtin BigIntSubtractNoThrow(implicit context: Context)(
+    x: BigInt, y: BigInt): Numeric {
+  try {
+    return BigIntSubtractImpl(x, y) otherwise BigIntTooBig;
+  } label BigIntTooBig {
+    // Smi sentinal is used to signal BigIntTooBig exception.
+    return Convert<Smi>(0);
+  }
+}
+
+builtin BigIntSubtract(implicit context: Context)(
+    xNum: Numeric, yNum: Numeric): BigInt {
+  try {
+    const x = Cast<BigInt>(xNum) otherwise MixedTypes;
+    const y = Cast<BigInt>(yNum) otherwise MixedTypes;
+
+    return BigIntSubtractImpl(x, y) otherwise BigIntTooBig;
+  } label MixedTypes {
+    ThrowTypeError(MessageTemplate::kBigIntMixedTypes);
+  } label BigIntTooBig {
+    ThrowRangeError(MessageTemplate::kBigIntTooBig);
+  }
+}
+
+builtin BigIntUnaryMinus(implicit context: Context)(bigint: BigInt): BigInt {
+  const length = ReadBigIntLength(bigint);
+
+  // There is no -0n.
+  if (length == 0) {
+    return bigint;
+  }
+
+  const result =
+      AllocateEmptyBigInt(InvertSign(ReadBigIntSign(bigint)), length);
+  for (let i: intptr = 0; i < length; ++i) {
+    StoreBigIntDigit(result, i, LoadBigIntDigit(bigint, i));
+  }
+  return Convert<BigInt>(result);
+}
 
 }  // namespace bigint
diff --git a/deps/v8/src/builtins/boolean.tq b/deps/v8/src/builtins/boolean.tq
index c8f0d8134ac..40a011d4e09 100644
--- a/deps/v8/src/builtins/boolean.tq
+++ b/deps/v8/src/builtins/boolean.tq
@@ -3,43 +3,43 @@
 // found in the LICENSE file.
 
 namespace boolean {
-  transitioning macro ThisBooleanValue(implicit context: Context)(
-      receiver: JSAny, method: constexpr string): Boolean {
-    return UnsafeCast<Boolean>(
-        ToThisValue(receiver, PrimitiveType::kBoolean, method));
-  }
+transitioning macro ThisBooleanValue(implicit context: Context)(
+    receiver: JSAny, method: constexpr string): Boolean {
+  return UnsafeCast<Boolean>(
+      ToThisValue(receiver, PrimitiveType::kBoolean, method));
+}
 
-  javascript builtin
-  BooleanConstructor(
-      js-implicit context: NativeContext, receiver: JSAny, newTarget: JSAny,
-      target: JSFunction)(...arguments): JSAny {
-    const value = SelectBooleanConstant(ToBoolean(arguments[0]));
+javascript builtin
+BooleanConstructor(
+    js-implicit context: NativeContext, receiver: JSAny, newTarget: JSAny,
+    target: JSFunction)(...arguments): JSAny {
+  const value = SelectBooleanConstant(ToBoolean(arguments[0]));
 
-    if (newTarget == Undefined) {
-      return value;
-    }
+  if (newTarget == Undefined) {
+    return value;
+  }
 
-    const map = GetDerivedMap(target, UnsafeCast<JSReceiver>(newTarget));
+  const map = GetDerivedMap(target, UnsafeCast<JSReceiver>(newTarget));
 
-    const obj =
-        UnsafeCast<JSPrimitiveWrapper>(AllocateFastOrSlowJSObjectFromMap(map));
-    obj.value = value;
-    return obj;
-  }
+  const obj =
+      UnsafeCast<JSPrimitiveWrapper>(AllocateFastOrSlowJSObjectFromMap(map));
+  obj.value = value;
+  return obj;
+}
 
-  // ES #sec-boolean.prototype.tostring
-  transitioning javascript builtin BooleanPrototypeToString(
-      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
-    // 1. Let b be ? thisBooleanValue(this value).
-    const b = ThisBooleanValue(receiver, 'Boolean.prototype.toString');
-    // 2. If b is true, return "true"; else return "false".
-    return b.to_string;
-  }
+// ES #sec-boolean.prototype.tostring
+transitioning javascript builtin BooleanPrototypeToString(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+  // 1. Let b be ? thisBooleanValue(this value).
+  const b = ThisBooleanValue(receiver, 'Boolean.prototype.toString');
+  // 2. If b is true, return "true"; else return "false".
+  return b.to_string;
+}
 
-  // ES #sec-boolean.prototype.valueof
-  transitioning javascript builtin BooleanPrototypeValueOf(
-      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
-    // 1. Return ? thisBooleanValue(this value).
-    return ThisBooleanValue(receiver, 'Boolean.prototype.valueOf');
-  }
+// ES #sec-boolean.prototype.valueof
+transitioning javascript builtin BooleanPrototypeValueOf(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+  // 1. Return ? thisBooleanValue(this value).
+  return ThisBooleanValue(receiver, 'Boolean.prototype.valueOf');
+}
 }
diff --git a/deps/v8/src/builtins/builtins-array-gen.cc b/deps/v8/src/builtins/builtins-array-gen.cc
index 734b9b634a0..dfd52255830 100644
--- a/deps/v8/src/builtins/builtins-array-gen.cc
+++ b/deps/v8/src/builtins/builtins-array-gen.cc
@@ -438,7 +438,6 @@ TF_BUILTIN(ArrayPrototypePush, CodeStubAssembler) {
 }
 
 TF_BUILTIN(ExtractFastJSArray, ArrayBuiltinsAssembler) {
-  ParameterMode mode = OptimalParameterMode();
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<JSArray> array = CAST(Parameter(Descriptor::kSource));
   TNode<BInt> begin = SmiToBInt(CAST(Parameter(Descriptor::kBegin)));
@@ -446,7 +445,7 @@ TF_BUILTIN(ExtractFastJSArray, ArrayBuiltinsAssembler) {
 
   CSA_ASSERT(this, Word32BinaryNot(IsNoElementsProtectorCellInvalid()));
 
-  Return(ExtractFastJSArray(context, array, begin, count, mode));
+  Return(ExtractFastJSArray(context, array, begin, count));
 }
 
 TF_BUILTIN(CloneFastJSArray, ArrayBuiltinsAssembler) {
@@ -477,7 +476,7 @@ TF_BUILTIN(CloneFastJSArrayFillingHoles, ArrayBuiltinsAssembler) {
                           LoadElementsKind(array))),
                       Word32BinaryNot(IsNoElementsProtectorCellInvalid())));
 
-  Return(CloneFastJSArray(context, array, {},
+  Return(CloneFastJSArray(context, array, base::nullopt,
                           HoleConversionMode::kConvertToUndefined));
 }
 
@@ -1153,7 +1152,7 @@ TF_BUILTIN(ArrayIndexOfHoleyDoubles, ArrayIncludesIndexofAssembler) {
 
 // ES #sec-array.prototype.values
 TF_BUILTIN(ArrayPrototypeValues, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<NativeContext> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Return(CreateArrayIterator(context, ToObject_Inline(context, receiver),
                              IterationKind::kValues));
@@ -1161,7 +1160,7 @@ TF_BUILTIN(ArrayPrototypeValues, CodeStubAssembler) {
 
 // ES #sec-array.prototype.entries
 TF_BUILTIN(ArrayPrototypeEntries, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<NativeContext> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Return(CreateArrayIterator(context, ToObject_Inline(context, receiver),
                              IterationKind::kEntries));
@@ -1169,7 +1168,7 @@ TF_BUILTIN(ArrayPrototypeEntries, CodeStubAssembler) {
 
 // ES #sec-array.prototype.keys
 TF_BUILTIN(ArrayPrototypeKeys, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<NativeContext> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Return(CreateArrayIterator(context, ToObject_Inline(context, receiver),
                              IterationKind::kKeys));
@@ -1665,7 +1664,8 @@ void ArrayBuiltinsAssembler::TailCallArrayConstructorStub(
 
 void ArrayBuiltinsAssembler::CreateArrayDispatchNoArgument(
     TNode<Context> context, TNode<JSFunction> target, TNode<Int32T> argc,
-    AllocationSiteOverrideMode mode, TNode<AllocationSite> allocation_site) {
+    AllocationSiteOverrideMode mode,
+    base::Optional<TNode<AllocationSite>> allocation_site) {
   if (mode == DISABLE_ALLOCATION_SITES) {
     Callable callable = CodeFactory::ArrayNoArgumentConstructor(
         isolate(), GetInitialFastElementsKind(), mode);
@@ -1674,7 +1674,8 @@ void ArrayBuiltinsAssembler::CreateArrayDispatchNoArgument(
                                  argc);
   } else {
     DCHECK_EQ(mode, DONT_OVERRIDE);
-    TNode<Int32T> elements_kind = LoadElementsKind(allocation_site);
+    DCHECK(allocation_site);
+    TNode<Int32T> elements_kind = LoadElementsKind(*allocation_site);
 
     // TODO(ishell): Compute the builtin index dynamically instead of
     // iterating over all expected elements kinds.
@@ -1688,7 +1689,7 @@ void ArrayBuiltinsAssembler::CreateArrayDispatchNoArgument(
       Callable callable =
           CodeFactory::ArrayNoArgumentConstructor(isolate(), kind, mode);
 
-      TailCallArrayConstructorStub(callable, context, target, allocation_site,
+      TailCallArrayConstructorStub(callable, context, target, *allocation_site,
                                    argc);
 
       BIND(&next);
@@ -1701,7 +1702,8 @@ void ArrayBuiltinsAssembler::CreateArrayDispatchNoArgument(
 
 void ArrayBuiltinsAssembler::CreateArrayDispatchSingleArgument(
     TNode<Context> context, TNode<JSFunction> target, TNode<Int32T> argc,
-    AllocationSiteOverrideMode mode, TNode<AllocationSite> allocation_site) {
+    AllocationSiteOverrideMode mode,
+    base::Optional<TNode<AllocationSite>> allocation_site) {
   if (mode == DISABLE_ALLOCATION_SITES) {
     ElementsKind initial = GetInitialFastElementsKind();
     ElementsKind holey_initial = GetHoleyElementsKind(initial);
@@ -1712,7 +1714,8 @@ void ArrayBuiltinsAssembler::CreateArrayDispatchSingleArgument(
                                  argc);
   } else {
     DCHECK_EQ(mode, DONT_OVERRIDE);
-    TNode<Smi> transition_info = LoadTransitionInfo(allocation_site);
+    DCHECK(allocation_site);
+    TNode<Smi> transition_info = LoadTransitionInfo(*allocation_site);
 
     // Least significant bit in fast array elements kind means holeyness.
     STATIC_ASSERT(PACKED_SMI_ELEMENTS == 0);
@@ -1735,7 +1738,7 @@ void ArrayBuiltinsAssembler::CreateArrayDispatchSingleArgument(
       // Make elements kind holey and update elements kind in the type info.
       var_elements_kind = Word32Or(var_elements_kind.value(), Int32Constant(1));
       StoreObjectFieldNoWriteBarrier(
-          allocation_site, AllocationSite::kTransitionInfoOrBoilerplateOffset,
+          *allocation_site, AllocationSite::kTransitionInfoOrBoilerplateOffset,
           SmiOr(transition_info, SmiConstant(fast_elements_kind_holey_mask)));
       Goto(&normal_sequence);
     }
@@ -1756,7 +1759,7 @@ void ArrayBuiltinsAssembler::CreateArrayDispatchSingleArgument(
       Callable callable =
           CodeFactory::ArraySingleArgumentConstructor(isolate(), kind, mode);
 
-      TailCallArrayConstructorStub(callable, context, target, allocation_site,
+      TailCallArrayConstructorStub(callable, context, target, *allocation_site,
                                    argc);
 
       BIND(&next);
@@ -1769,7 +1772,8 @@ void ArrayBuiltinsAssembler::CreateArrayDispatchSingleArgument(
 
 void ArrayBuiltinsAssembler::GenerateDispatchToArrayStub(
     TNode<Context> context, TNode<JSFunction> target, TNode<Int32T> argc,
-    AllocationSiteOverrideMode mode, TNode<AllocationSite> allocation_site) {
+    AllocationSiteOverrideMode mode,
+    base::Optional<TNode<AllocationSite>> allocation_site) {
   Label check_one_case(this), fallthrough(this);
   GotoIfNot(Word32Equal(argc, Int32Constant(0)), &check_one_case);
   CreateArrayDispatchNoArgument(context, target, argc, mode, allocation_site);
@@ -1862,8 +1866,9 @@ void ArrayBuiltinsAssembler::GenerateConstructor(
     {
       TNode<JSArray> array = AllocateJSArray(
           elements_kind, array_map, array_size_smi, array_size_smi,
-          mode == DONT_TRACK_ALLOCATION_SITE ? TNode<AllocationSite>()
-                                             : CAST(allocation_site));
+          mode == DONT_TRACK_ALLOCATION_SITE
+              ? base::Optional<TNode<AllocationSite>>(base::nullopt)
+              : CAST(allocation_site));
       Return(array);
     }
   }
@@ -1882,9 +1887,10 @@ void ArrayBuiltinsAssembler::GenerateArrayNoArgumentConstructor(
       Parameter(Descriptor::kFunction), JSFunction::kContextOffset));
   bool track_allocation_site =
       AllocationSite::ShouldTrack(kind) && mode != DISABLE_ALLOCATION_SITES;
-  TNode<AllocationSite> allocation_site =
-      track_allocation_site ? CAST(Parameter(Descriptor::kAllocationSite))
-                            : TNode<AllocationSite>();
+  base::Optional<TNode<AllocationSite>> allocation_site =
+      track_allocation_site
+          ? CAST(Parameter(Descriptor::kAllocationSite))
+          : base::Optional<TNode<AllocationSite>>(base::nullopt);
   TNode<Map> array_map = LoadJSArrayElementsMap(kind, native_context);
   TNode<JSArray> array = AllocateJSArray(
       kind, array_map, IntPtrConstant(JSArray::kPreallocatedArrayElements),
diff --git a/deps/v8/src/builtins/builtins-array-gen.h b/deps/v8/src/builtins/builtins-array-gen.h
index 088af90665d..96833d9dea2 100644
--- a/deps/v8/src/builtins/builtins-array-gen.h
+++ b/deps/v8/src/builtins/builtins-array-gen.h
@@ -72,20 +72,20 @@ class ArrayBuiltinsAssembler : public CodeStubAssembler {
       TNode<JSFunction> target, TNode<HeapObject> allocation_site_or_undefined,
       TNode<Int32T> argc);
 
-  void GenerateDispatchToArrayStub(TNode<Context> context,
-                                   TNode<JSFunction> target, TNode<Int32T> argc,
-                                   AllocationSiteOverrideMode mode,
-                                   TNode<AllocationSite> allocation_site = {});
+  void GenerateDispatchToArrayStub(
+      TNode<Context> context, TNode<JSFunction> target, TNode<Int32T> argc,
+      AllocationSiteOverrideMode mode,
+      base::Optional<TNode<AllocationSite>> allocation_site = base::nullopt);
 
   void CreateArrayDispatchNoArgument(
       TNode<Context> context, TNode<JSFunction> target, TNode<Int32T> argc,
       AllocationSiteOverrideMode mode,
-      TNode<AllocationSite> allocation_site = {});
+      base::Optional<TNode<AllocationSite>> allocation_site);
 
   void CreateArrayDispatchSingleArgument(
       TNode<Context> context, TNode<JSFunction> target, TNode<Int32T> argc,
       AllocationSiteOverrideMode mode,
-      TNode<AllocationSite> allocation_site = {});
+      base::Optional<TNode<AllocationSite>> allocation_site);
 
   void GenerateConstructor(TNode<Context> context,
                            TNode<HeapObject> array_function,
diff --git a/deps/v8/src/builtins/builtins-array.cc b/deps/v8/src/builtins/builtins-array.cc
index 40accae57a7..3c2fe33c5b4 100644
--- a/deps/v8/src/builtins/builtins-array.cc
+++ b/deps/v8/src/builtins/builtins-array.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/base/logging.h"
 #include "src/builtins/builtins-utils-inl.h"
 #include "src/builtins/builtins.h"
 #include "src/codegen/code-factory.h"
@@ -471,6 +472,15 @@ BUILTIN(ArrayPop) {
     uint32_t new_length = len - 1;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, result, JSReceiver::GetElement(isolate, array, new_length));
+
+    // The length could have become read-only during the last GetElement() call,
+    // so check again.
+    if (JSArray::HasReadOnlyLength(array)) {
+      THROW_NEW_ERROR_RETURN_FAILURE(
+          isolate, NewTypeError(MessageTemplate::kStrictReadOnlyProperty,
+                                isolate->factory()->length_string(),
+                                Object::TypeOf(isolate, array), array));
+    }
     JSArray::SetLength(array, new_length);
   }
 
diff --git a/deps/v8/src/builtins/builtins-async-function-gen.cc b/deps/v8/src/builtins/builtins-async-function-gen.cc
index aec64b9ccd3..e84442295cf 100644
--- a/deps/v8/src/builtins/builtins-async-function-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-function-gen.cc
@@ -271,10 +271,12 @@ void AsyncFunctionBuiltinsAssembler::AsyncFunctionAwait(
   Goto(&after_debug_hook);
   BIND(&after_debug_hook);
 
-  Await(context, async_function_object, value, outer_promise,
-        Context::ASYNC_FUNCTION_AWAIT_RESOLVE_SHARED_FUN,
-        Context::ASYNC_FUNCTION_AWAIT_REJECT_SHARED_FUN,
-        is_predicted_as_caught);
+  TNode<SharedFunctionInfo> on_resolve_sfi =
+      AsyncFunctionAwaitResolveSharedFunConstant();
+  TNode<SharedFunctionInfo> on_reject_sfi =
+      AsyncFunctionAwaitRejectSharedFunConstant();
+  Await(context, async_function_object, value, outer_promise, on_resolve_sfi,
+        on_reject_sfi, is_predicted_as_caught);
 
   // Return outer promise to avoid adding an load of the outer promise before
   // suspending in BytecodeGenerator.
diff --git a/deps/v8/src/builtins/builtins-async-gen.cc b/deps/v8/src/builtins/builtins-async-gen.cc
index 785408339e8..383289fd0f3 100644
--- a/deps/v8/src/builtins/builtins-async-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-gen.cc
@@ -27,8 +27,8 @@ class ValueUnwrapContext {
 TNode<Object> AsyncBuiltinsAssembler::AwaitOld(
     TNode<Context> context, TNode<JSGeneratorObject> generator,
     TNode<Object> value, TNode<JSPromise> outer_promise,
-    TNode<IntPtrT> on_resolve_context_index,
-    TNode<IntPtrT> on_reject_context_index,
+    TNode<SharedFunctionInfo> on_resolve_sfi,
+    TNode<SharedFunctionInfo> on_reject_sfi,
     TNode<Oddball> is_predicted_as_caught) {
   const TNode<NativeContext> native_context = LoadNativeContext(context);
 
@@ -90,12 +90,12 @@ TNode<Object> AsyncBuiltinsAssembler::AwaitOld(
   // Initialize resolve handler
   TNode<HeapObject> on_resolve = InnerAllocate(base, kResolveClosureOffset);
   InitializeNativeClosure(closure_context, native_context, on_resolve,
-                          on_resolve_context_index);
+                          on_resolve_sfi);
 
   // Initialize reject handler
   TNode<HeapObject> on_reject = InnerAllocate(base, kRejectClosureOffset);
   InitializeNativeClosure(closure_context, native_context, on_reject,
-                          on_reject_context_index);
+                          on_reject_sfi);
 
   TVARIABLE(HeapObject, var_throwaway, UndefinedConstant());
 
@@ -122,8 +122,8 @@ TNode<Object> AsyncBuiltinsAssembler::AwaitOld(
 TNode<Object> AsyncBuiltinsAssembler::AwaitOptimized(
     TNode<Context> context, TNode<JSGeneratorObject> generator,
     TNode<JSPromise> promise, TNode<JSPromise> outer_promise,
-    TNode<IntPtrT> on_resolve_context_index,
-    TNode<IntPtrT> on_reject_context_index,
+    TNode<SharedFunctionInfo> on_resolve_sfi,
+    TNode<SharedFunctionInfo> on_reject_sfi,
     TNode<Oddball> is_predicted_as_caught) {
   const TNode<NativeContext> native_context = LoadNativeContext(context);
 
@@ -161,12 +161,12 @@ TNode<Object> AsyncBuiltinsAssembler::AwaitOptimized(
   // Initialize resolve handler
   TNode<HeapObject> on_resolve = InnerAllocate(base, kResolveClosureOffset);
   InitializeNativeClosure(closure_context, native_context, on_resolve,
-                          on_resolve_context_index);
+                          on_resolve_sfi);
 
   // Initialize reject handler
   TNode<HeapObject> on_reject = InnerAllocate(base, kRejectClosureOffset);
   InitializeNativeClosure(closure_context, native_context, on_reject,
-                          on_reject_context_index);
+                          on_reject_sfi);
 
   TVARIABLE(HeapObject, var_throwaway, UndefinedConstant());
 
@@ -190,8 +190,8 @@ TNode<Object> AsyncBuiltinsAssembler::AwaitOptimized(
 TNode<Object> AsyncBuiltinsAssembler::Await(
     TNode<Context> context, TNode<JSGeneratorObject> generator,
     TNode<Object> value, TNode<JSPromise> outer_promise,
-    TNode<IntPtrT> on_resolve_context_index,
-    TNode<IntPtrT> on_reject_context_index,
+    TNode<SharedFunctionInfo> on_resolve_sfi,
+    TNode<SharedFunctionInfo> on_reject_sfi,
     TNode<Oddball> is_predicted_as_caught) {
   TVARIABLE(Object, result);
   Label if_old(this), if_new(this), done(this),
@@ -230,15 +230,14 @@ TNode<Object> AsyncBuiltinsAssembler::Await(
   }
 
   BIND(&if_old);
-  result = AwaitOld(context, generator, value, outer_promise,
-                    on_resolve_context_index, on_reject_context_index,
-                    is_predicted_as_caught);
+  result = AwaitOld(context, generator, value, outer_promise, on_resolve_sfi,
+                    on_reject_sfi, is_predicted_as_caught);
   Goto(&done);
 
   BIND(&if_new);
-  result = AwaitOptimized(context, generator, CAST(value), outer_promise,
-                          on_resolve_context_index, on_reject_context_index,
-                          is_predicted_as_caught);
+  result =
+      AwaitOptimized(context, generator, CAST(value), outer_promise,
+                     on_resolve_sfi, on_reject_sfi, is_predicted_as_caught);
   Goto(&done);
 
   BIND(&done);
@@ -247,7 +246,7 @@ TNode<Object> AsyncBuiltinsAssembler::Await(
 
 void AsyncBuiltinsAssembler::InitializeNativeClosure(
     TNode<Context> context, TNode<NativeContext> native_context,
-    TNode<HeapObject> function, TNode<IntPtrT> context_index) {
+    TNode<HeapObject> function, TNode<SharedFunctionInfo> shared_info) {
   TNode<Map> function_map = CAST(LoadContextElement(
       native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX));
   // Ensure that we don't have to initialize prototype_or_initial_map field of
@@ -265,8 +264,6 @@ void AsyncBuiltinsAssembler::InitializeNativeClosure(
   StoreObjectFieldRoot(function, JSFunction::kFeedbackCellOffset,
                        RootIndex::kManyClosuresCell);
 
-  TNode<SharedFunctionInfo> shared_info =
-      CAST(LoadContextElement(native_context, context_index));
   StoreObjectFieldNoWriteBarrier(
       function, JSFunction::kSharedFunctionInfoOffset, shared_info);
   StoreObjectFieldNoWriteBarrier(function, JSFunction::kContextOffset, context);
@@ -286,8 +283,8 @@ TNode<JSFunction> AsyncBuiltinsAssembler::CreateUnwrapClosure(
     TNode<NativeContext> native_context, TNode<Oddball> done) {
   const TNode<Map> map = CAST(LoadContextElement(
       native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX));
-  const TNode<SharedFunctionInfo> on_fulfilled_shared = CAST(LoadContextElement(
-      native_context, Context::ASYNC_ITERATOR_VALUE_UNWRAP_SHARED_FUN));
+  const TNode<SharedFunctionInfo> on_fulfilled_shared =
+      AsyncIteratorValueUnwrapSharedFunConstant();
   const TNode<Context> closure_context =
       AllocateAsyncIteratorValueUnwrapContext(native_context, done);
   return AllocateFunctionWithMapAndContext(map, on_fulfilled_shared,
diff --git a/deps/v8/src/builtins/builtins-async-gen.h b/deps/v8/src/builtins/builtins-async-gen.h
index 7b9c944f4ac..833e78d45d5 100644
--- a/deps/v8/src/builtins/builtins-async-gen.h
+++ b/deps/v8/src/builtins/builtins-async-gen.h
@@ -17,34 +17,23 @@ class AsyncBuiltinsAssembler : public PromiseBuiltinsAssembler {
 
  protected:
   // Perform steps to resume generator after `value` is resolved.
-  // `on_reject_context_index` is an index into the Native Context, which should
-  // point to a SharedFunctioninfo instance used to create the closure. The
-  // value following the reject index should be a similar value for the resolve
-  // closure. Returns the Promise-wrapped `value`.
+  // `on_reject` is the SharedFunctioninfo instance used to create the reject
+  // closure. `on_resolve` is the SharedFunctioninfo instance used to create the
+  // resolve closure. Returns the Promise-wrapped `value`.
   TNode<Object> Await(TNode<Context> context,
                       TNode<JSGeneratorObject> generator, TNode<Object> value,
                       TNode<JSPromise> outer_promise,
-                      TNode<IntPtrT> on_resolve_context_index,
-                      TNode<IntPtrT> on_reject_context_index,
+                      TNode<SharedFunctionInfo> on_resolve_sfi,
+                      TNode<SharedFunctionInfo> on_reject_sfi,
                       TNode<Oddball> is_predicted_as_caught);
   TNode<Object> Await(TNode<Context> context,
                       TNode<JSGeneratorObject> generator, TNode<Object> value,
                       TNode<JSPromise> outer_promise,
-                      int on_resolve_context_index, int on_reject_context_index,
-                      TNode<Oddball> is_predicted_as_caught) {
-    return Await(context, generator, value, outer_promise,
-                 IntPtrConstant(on_resolve_context_index),
-                 IntPtrConstant(on_reject_context_index),
-                 is_predicted_as_caught);
-  }
-  TNode<Object> Await(TNode<Context> context,
-                      TNode<JSGeneratorObject> generator, TNode<Object> value,
-                      TNode<JSPromise> outer_promise,
-                      int on_resolve_context_index, int on_reject_context_index,
+                      TNode<SharedFunctionInfo> on_resolve_sfi,
+                      TNode<SharedFunctionInfo> on_reject_sfi,
                       bool is_predicted_as_caught) {
-    return Await(context, generator, value, outer_promise,
-                 on_resolve_context_index, on_reject_context_index,
-                 BooleanConstant(is_predicted_as_caught));
+    return Await(context, generator, value, outer_promise, on_resolve_sfi,
+                 on_reject_sfi, BooleanConstant(is_predicted_as_caught));
   }
 
   // Return a new built-in function object as defined in
@@ -56,22 +45,22 @@ class AsyncBuiltinsAssembler : public PromiseBuiltinsAssembler {
   void InitializeNativeClosure(TNode<Context> context,
                                TNode<NativeContext> native_context,
                                TNode<HeapObject> function,
-                               TNode<IntPtrT> context_index);
+                               TNode<SharedFunctionInfo> shared_info);
   TNode<Context> AllocateAsyncIteratorValueUnwrapContext(
       TNode<NativeContext> native_context, TNode<Oddball> done);
 
   TNode<Object> AwaitOld(TNode<Context> context,
                          TNode<JSGeneratorObject> generator,
                          TNode<Object> value, TNode<JSPromise> outer_promise,
-                         TNode<IntPtrT> on_resolve_context_index,
-                         TNode<IntPtrT> on_reject_context_index,
+                         TNode<SharedFunctionInfo> on_resolve_sfi,
+                         TNode<SharedFunctionInfo> on_reject_sfi,
                          TNode<Oddball> is_predicted_as_caught);
   TNode<Object> AwaitOptimized(TNode<Context> context,
                                TNode<JSGeneratorObject> generator,
                                TNode<JSPromise> promise,
                                TNode<JSPromise> outer_promise,
-                               TNode<IntPtrT> on_resolve_context_index,
-                               TNode<IntPtrT> on_reject_context_index,
+                               TNode<SharedFunctionInfo> on_resolve_sfi,
+                               TNode<SharedFunctionInfo> on_reject_sfi,
                                TNode<Oddball> is_predicted_as_caught);
 };
 
diff --git a/deps/v8/src/builtins/builtins-async-generator-gen.cc b/deps/v8/src/builtins/builtins-async-generator-gen.cc
index 592400415b9..2b6d7208808 100644
--- a/deps/v8/src/builtins/builtins-async-generator-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-generator-gen.cc
@@ -242,12 +242,10 @@ void AsyncGeneratorBuiltinsAssembler::AsyncGeneratorAwait(bool is_catchable) {
   TNode<JSPromise> outer_promise = LoadObjectField<JSPromise>(
       request, AsyncGeneratorRequest::kPromiseOffset);
 
-  const int resolve_index = Context::ASYNC_GENERATOR_AWAIT_RESOLVE_SHARED_FUN;
-  const int reject_index = Context::ASYNC_GENERATOR_AWAIT_REJECT_SHARED_FUN;
-
   SetGeneratorAwaiting(async_generator_object);
-  Await(context, async_generator_object, value, outer_promise, resolve_index,
-        reject_index, is_catchable);
+  Await(context, async_generator_object, value, outer_promise,
+        AsyncGeneratorAwaitResolveSharedFunConstant(),
+        AsyncGeneratorAwaitRejectSharedFunConstant(), is_catchable);
   Return(UndefinedConstant());
 }
 
@@ -573,12 +571,10 @@ TF_BUILTIN(AsyncGeneratorYield, AsyncGeneratorBuiltinsAssembler) {
   const TNode<JSPromise> outer_promise =
       LoadPromiseFromAsyncGeneratorRequest(request);
 
-  const int on_resolve = Context::ASYNC_GENERATOR_YIELD_RESOLVE_SHARED_FUN;
-  const int on_reject = Context::ASYNC_GENERATOR_AWAIT_REJECT_SHARED_FUN;
-
   SetGeneratorAwaiting(generator);
-  Await(context, generator, value, outer_promise, on_resolve, on_reject,
-        is_caught);
+  Await(context, generator, value, outer_promise,
+        AsyncGeneratorYieldResolveSharedFunConstant(),
+        AsyncGeneratorAwaitRejectSharedFunConstant(), is_caught);
   Return(UndefinedConstant());
 }
 
@@ -623,19 +619,17 @@ TF_BUILTIN(AsyncGeneratorReturn, AsyncGeneratorBuiltinsAssembler) {
       CAST(LoadFirstAsyncGeneratorRequestFromQueue(generator));
 
   Label perform_await(this);
-  TVARIABLE(IntPtrT, var_on_resolve,
-            IntPtrConstant(
-                Context::ASYNC_GENERATOR_RETURN_CLOSED_RESOLVE_SHARED_FUN));
-  TVARIABLE(
-      IntPtrT, var_on_reject,
-      IntPtrConstant(Context::ASYNC_GENERATOR_RETURN_CLOSED_REJECT_SHARED_FUN));
+  TVARIABLE(SharedFunctionInfo, var_on_resolve,
+            AsyncGeneratorReturnClosedResolveSharedFunConstant());
+
+  TVARIABLE(SharedFunctionInfo, var_on_reject,
+            AsyncGeneratorReturnClosedRejectSharedFunConstant());
 
   const TNode<Smi> state = LoadGeneratorState(generator);
   GotoIf(IsGeneratorStateClosed(state), &perform_await);
-  var_on_resolve =
-      IntPtrConstant(Context::ASYNC_GENERATOR_RETURN_RESOLVE_SHARED_FUN);
-  var_on_reject =
-      IntPtrConstant(Context::ASYNC_GENERATOR_AWAIT_REJECT_SHARED_FUN);
+  var_on_resolve = AsyncGeneratorReturnResolveSharedFunConstant();
+  var_on_reject = AsyncGeneratorAwaitRejectSharedFunConstant();
+
   Goto(&perform_await);
 
   BIND(&perform_await);
diff --git a/deps/v8/src/builtins/builtins-call-gen.cc b/deps/v8/src/builtins/builtins-call-gen.cc
index 1b53e9ca8e8..f7919b78f47 100644
--- a/deps/v8/src/builtins/builtins-call-gen.cc
+++ b/deps/v8/src/builtins/builtins-call-gen.cc
@@ -64,6 +64,49 @@ void Builtins::Generate_CallFunctionForwardVarargs(MacroAssembler* masm) {
       masm->isolate()->builtins()->CallFunction());
 }
 
+TF_BUILTIN(Call_ReceiverIsNullOrUndefined_WithFeedback,
+           CallOrConstructBuiltinsAssembler) {
+  TNode<Object> target = CAST(Parameter(Descriptor::kFunction));
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<HeapObject> maybe_feedback_vector =
+      CAST(Parameter(Descriptor::kMaybeFeedbackVector));
+  TNode<Int32T> slot = UncheckedCast<Int32T>(Parameter(Descriptor::kSlot));
+  CollectCallFeedback(target, context, maybe_feedback_vector,
+                      Unsigned(ChangeInt32ToIntPtr(slot)));
+  TailCallBuiltin(Builtins::kCall_ReceiverIsNullOrUndefined, context, target,
+                  argc);
+}
+
+TF_BUILTIN(Call_ReceiverIsNotNullOrUndefined_WithFeedback,
+           CallOrConstructBuiltinsAssembler) {
+  TNode<Object> target = CAST(Parameter(Descriptor::kFunction));
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<HeapObject> maybe_feedback_vector =
+      CAST(Parameter(Descriptor::kMaybeFeedbackVector));
+  TNode<Int32T> slot = UncheckedCast<Int32T>(Parameter(Descriptor::kSlot));
+  CollectCallFeedback(target, context, maybe_feedback_vector,
+                      Unsigned(ChangeInt32ToIntPtr(slot)));
+  TailCallBuiltin(Builtins::kCall_ReceiverIsNotNullOrUndefined, context, target,
+                  argc);
+}
+
+TF_BUILTIN(Call_ReceiverIsAny_WithFeedback, CallOrConstructBuiltinsAssembler) {
+  TNode<Object> target = CAST(Parameter(Descriptor::kFunction));
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<HeapObject> maybe_feedback_vector =
+      CAST(Parameter(Descriptor::kMaybeFeedbackVector));
+  TNode<Int32T> slot = UncheckedCast<Int32T>(Parameter(Descriptor::kSlot));
+  CollectCallFeedback(target, context, maybe_feedback_vector,
+                      Unsigned(ChangeInt32ToIntPtr(slot)));
+  TailCallBuiltin(Builtins::kCall_ReceiverIsAny, context, target, argc);
+}
+
 void CallOrConstructBuiltinsAssembler::CallOrConstructWithArrayLike(
     TNode<Object> target, base::Optional<TNode<Object>> new_target,
     TNode<Object> arguments_list, TNode<Context> context) {
@@ -317,7 +360,9 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithSpread(
   BIND(&if_generic);
   {
     Label if_iterator_fn_not_callable(this, Label::kDeferred),
-        if_iterator_is_null_or_undefined(this, Label::kDeferred);
+        if_iterator_is_null_or_undefined(this, Label::kDeferred),
+        throw_spread_error(this, Label::kDeferred);
+    TVARIABLE(Smi, message_id);
 
     GotoIf(IsNullOrUndefined(spread), &if_iterator_is_null_or_undefined);
 
@@ -336,10 +381,18 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithSpread(
            &if_smiorobject, &if_double);
 
     BIND(&if_iterator_fn_not_callable);
-    ThrowTypeError(context, MessageTemplate::kIteratorSymbolNonCallable);
+    message_id = SmiConstant(
+        static_cast<int>(MessageTemplate::kIteratorSymbolNonCallable)),
+    Goto(&throw_spread_error);
 
     BIND(&if_iterator_is_null_or_undefined);
-    CallRuntime(Runtime::kThrowSpreadArgIsNullOrUndefined, context, spread);
+    message_id = SmiConstant(
+        static_cast<int>(MessageTemplate::kNotIterableNoSymbolLoad));
+    Goto(&throw_spread_error);
+
+    BIND(&throw_spread_error);
+    CallRuntime(Runtime::kThrowSpreadArgError, context, message_id.value(),
+                spread);
     Unreachable();
   }
 
@@ -377,6 +430,19 @@ TF_BUILTIN(CallWithArrayLike, CallOrConstructBuiltinsAssembler) {
   CallOrConstructWithArrayLike(target, new_target, arguments_list, context);
 }
 
+TF_BUILTIN(CallWithArrayLike_WithFeedback, CallOrConstructBuiltinsAssembler) {
+  TNode<Object> target = CAST(Parameter(Descriptor::kTarget));
+  base::Optional<TNode<Object>> new_target = base::nullopt;
+  TNode<Object> arguments_list = CAST(Parameter(Descriptor::kArgumentsList));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<HeapObject> maybe_feedback_vector =
+      CAST(Parameter(Descriptor::kMaybeFeedbackVector));
+  TNode<Int32T> slot = UncheckedCast<Int32T>(Parameter(Descriptor::kSlot));
+  CollectCallFeedback(target, context, maybe_feedback_vector,
+                      Unsigned(ChangeInt32ToIntPtr(slot)));
+  CallOrConstructWithArrayLike(target, new_target, arguments_list, context);
+}
+
 TF_BUILTIN(CallWithSpread, CallOrConstructBuiltinsAssembler) {
   TNode<Object> target = CAST(Parameter(Descriptor::kTarget));
   base::Optional<TNode<Object>> new_target = base::nullopt;
@@ -387,6 +453,21 @@ TF_BUILTIN(CallWithSpread, CallOrConstructBuiltinsAssembler) {
   CallOrConstructWithSpread(target, new_target, spread, args_count, context);
 }
 
+TF_BUILTIN(CallWithSpread_WithFeedback, CallOrConstructBuiltinsAssembler) {
+  TNode<Object> target = CAST(Parameter(Descriptor::kTarget));
+  base::Optional<TNode<Object>> new_target = base::nullopt;
+  TNode<Object> spread = CAST(Parameter(Descriptor::kSpread));
+  TNode<Int32T> args_count =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<HeapObject> maybe_feedback_vector =
+      CAST(Parameter(Descriptor::kMaybeFeedbackVector));
+  TNode<Int32T> slot = UncheckedCast<Int32T>(Parameter(Descriptor::kSlot));
+  CollectCallFeedback(target, context, maybe_feedback_vector,
+                      Unsigned(ChangeInt32ToIntPtr(slot)));
+  CallOrConstructWithSpread(target, new_target, spread, args_count, context);
+}
+
 TNode<JSReceiver> CallOrConstructBuiltinsAssembler::GetCompatibleReceiver(
     TNode<JSReceiver> receiver, TNode<HeapObject> signature,
     TNode<Context> context) {
@@ -525,7 +606,7 @@ void CallOrConstructBuiltinsAssembler::CallFunctionTemplate(
     TNode<IntPtrT> function_template_info_flags = LoadAndUntagObjectField(
         function_template_info, FunctionTemplateInfo::kFlagOffset);
     Branch(IsSetWord(function_template_info_flags,
-                     1 << FunctionTemplateInfo::kAcceptAnyReceiver),
+                     1 << FunctionTemplateInfo::AcceptAnyReceiverBit::kShift),
            &receiver_done, &receiver_needs_access_check);
 
     BIND(&receiver_needs_access_check);
@@ -565,7 +646,7 @@ void CallOrConstructBuiltinsAssembler::CallFunctionTemplate(
   TNode<Foreign> foreign = LoadObjectField<Foreign>(
       call_handler_info, CallHandlerInfo::kJsCallbackOffset);
   TNode<RawPtrT> callback =
-      LoadObjectField<RawPtrT>(foreign, Foreign::kForeignAddressOffset);
+      DecodeExternalPointer(LoadForeignForeignAddress(foreign));
   TNode<Object> call_data =
       LoadObjectField<Object>(call_handler_info, CallHandlerInfo::kDataOffset);
   TailCallStub(CodeFactory::CallApiCallback(isolate()), context, callback, argc,
diff --git a/deps/v8/src/builtins/builtins-callsite.cc b/deps/v8/src/builtins/builtins-callsite.cc
index d1082291ef1..5b7807ed4a9 100644
--- a/deps/v8/src/builtins/builtins-callsite.cc
+++ b/deps/v8/src/builtins/builtins-callsite.cc
@@ -76,7 +76,11 @@ BUILTIN(CallSitePrototypeGetFunction) {
                         GetFrameIndex(isolate, recv));
 
   StackFrameBase* frame = it.Frame();
-  if (frame->IsStrict()) return ReadOnlyRoots(isolate).undefined_value();
+  if (frame->IsStrict() ||
+      (frame->GetFunction()->IsJSFunction() &&
+       JSFunction::cast(*frame->GetFunction()).shared().is_toplevel())) {
+    return ReadOnlyRoots(isolate).undefined_value();
+  }
 
   isolate->CountUsage(v8::Isolate::kCallSiteAPIGetFunctionSloppyCall);
 
diff --git a/deps/v8/src/builtins/builtins-collections-gen.cc b/deps/v8/src/builtins/builtins-collections-gen.cc
index df0ebce993f..3ab4392b87c 100644
--- a/deps/v8/src/builtins/builtins-collections-gen.cc
+++ b/deps/v8/src/builtins/builtins-collections-gen.cc
@@ -334,8 +334,9 @@ void BaseCollectionsAssembler::AddConstructorEntriesFromIterable(
   }
   BIND(&if_exception);
   {
-    iterator_assembler.IteratorCloseOnException(context, iterator,
-                                                var_exception.value());
+    IteratorCloseOnException(context, iterator);
+    CallRuntime(Runtime::kReThrow, context, var_exception.value());
+    Unreachable();
   }
   BIND(&exit);
 }
@@ -760,7 +761,7 @@ void CollectionsBuiltinsAssembler::FindOrderedHashTableEntry(
   const TNode<IntPtrT> number_of_buckets =
       SmiUntag(CAST(UnsafeLoadFixedArrayElement(
           table, CollectionType::NumberOfBucketsIndex())));
-  const TNode<WordT> bucket =
+  const TNode<IntPtrT> bucket =
       WordAnd(hash, IntPtrSub(number_of_buckets, IntPtrConstant(1)));
   const TNode<IntPtrT> first_entry = SmiUntag(CAST(UnsafeLoadFixedArrayElement(
       table, bucket, CollectionType::HashTableStartIndex() * kTaggedSize)));
diff --git a/deps/v8/src/builtins/builtins-constructor-gen.cc b/deps/v8/src/builtins/builtins-constructor-gen.cc
index c706ce9306c..dda3f4b48b9 100644
--- a/deps/v8/src/builtins/builtins-constructor-gen.cc
+++ b/deps/v8/src/builtins/builtins-constructor-gen.cc
@@ -36,6 +36,31 @@ void Builtins::Generate_ConstructFunctionForwardVarargs(MacroAssembler* masm) {
       BUILTIN_CODE(masm->isolate(), ConstructFunction));
 }
 
+TF_BUILTIN(Construct_WithFeedback, CallOrConstructBuiltinsAssembler) {
+  TNode<Object> target = CAST(Parameter(Descriptor::kTarget));
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kNewTarget));
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<HeapObject> maybe_feedback_vector =
+      CAST(Parameter(Descriptor::kMaybeFeedbackVector));
+  TNode<Int32T> slot = UncheckedCast<Int32T>(Parameter(Descriptor::kSlot));
+
+  TVARIABLE(AllocationSite, allocation_site);
+  Label if_construct_generic(this), if_construct_array(this);
+  CollectConstructFeedback(context, target, new_target, maybe_feedback_vector,
+                           Unsigned(ChangeInt32ToIntPtr(slot)),
+                           &if_construct_generic, &if_construct_array,
+                           &allocation_site);
+
+  BIND(&if_construct_generic);
+  TailCallBuiltin(Builtins::kConstruct, context, target, new_target, argc);
+
+  BIND(&if_construct_array);
+  TailCallBuiltin(Builtins::kArrayConstructorImpl, context, target, new_target,
+                  argc, allocation_site.value());
+}
+
 TF_BUILTIN(ConstructWithArrayLike, CallOrConstructBuiltinsAssembler) {
   TNode<Object> target = CAST(Parameter(Descriptor::kTarget));
   TNode<Object> new_target = CAST(Parameter(Descriptor::kNewTarget));
@@ -44,6 +69,30 @@ TF_BUILTIN(ConstructWithArrayLike, CallOrConstructBuiltinsAssembler) {
   CallOrConstructWithArrayLike(target, new_target, arguments_list, context);
 }
 
+TF_BUILTIN(ConstructWithArrayLike_WithFeedback,
+           CallOrConstructBuiltinsAssembler) {
+  TNode<Object> target = CAST(Parameter(Descriptor::kTarget));
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kNewTarget));
+  TNode<Object> arguments_list = CAST(Parameter(Descriptor::kArgumentsList));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<HeapObject> maybe_feedback_vector =
+      CAST(Parameter(Descriptor::kMaybeFeedbackVector));
+  TNode<Int32T> slot = UncheckedCast<Int32T>(Parameter(Descriptor::kSlot));
+
+  TVARIABLE(AllocationSite, allocation_site);
+  Label if_construct_generic(this), if_construct_array(this);
+  CollectConstructFeedback(context, target, new_target, maybe_feedback_vector,
+                           Unsigned(ChangeInt32ToIntPtr(slot)),
+                           &if_construct_generic, &if_construct_array,
+                           &allocation_site);
+
+  BIND(&if_construct_array);
+  Goto(&if_construct_generic);  // Not implemented.
+
+  BIND(&if_construct_generic);
+  CallOrConstructWithArrayLike(target, new_target, arguments_list, context);
+}
+
 TF_BUILTIN(ConstructWithSpread, CallOrConstructBuiltinsAssembler) {
   TNode<Object> target = CAST(Parameter(Descriptor::kTarget));
   TNode<Object> new_target = CAST(Parameter(Descriptor::kNewTarget));
@@ -54,6 +103,31 @@ TF_BUILTIN(ConstructWithSpread, CallOrConstructBuiltinsAssembler) {
   CallOrConstructWithSpread(target, new_target, spread, args_count, context);
 }
 
+TF_BUILTIN(ConstructWithSpread_WithFeedback, CallOrConstructBuiltinsAssembler) {
+  TNode<Object> target = CAST(Parameter(Descriptor::kTarget));
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kNewTarget));
+  TNode<Object> spread = CAST(Parameter(Descriptor::kSpread));
+  TNode<Int32T> args_count =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<HeapObject> maybe_feedback_vector =
+      CAST(Parameter(Descriptor::kMaybeFeedbackVector));
+  TNode<Int32T> slot = UncheckedCast<Int32T>(Parameter(Descriptor::kSlot));
+
+  TVARIABLE(AllocationSite, allocation_site);
+  Label if_construct_generic(this), if_construct_array(this);
+  CollectConstructFeedback(context, target, new_target, maybe_feedback_vector,
+                           Unsigned(ChangeInt32ToIntPtr(slot)),
+                           &if_construct_generic, &if_construct_array,
+                           &allocation_site);
+
+  BIND(&if_construct_array);
+  Goto(&if_construct_generic);  // Not implemented.
+
+  BIND(&if_construct_generic);
+  CallOrConstructWithSpread(target, new_target, spread, args_count, context);
+}
+
 using Node = compiler::Node;
 
 TF_BUILTIN(FastNewClosure, ConstructorBuiltinsAssembler) {
diff --git a/deps/v8/src/builtins/builtins-conversion-gen.cc b/deps/v8/src/builtins/builtins-conversion-gen.cc
index e524f39b5fd..54fa752969e 100644
--- a/deps/v8/src/builtins/builtins-conversion-gen.cc
+++ b/deps/v8/src/builtins/builtins-conversion-gen.cc
@@ -12,181 +12,6 @@
 namespace v8 {
 namespace internal {
 
-class ConversionBuiltinsAssembler : public CodeStubAssembler {
- public:
-  explicit ConversionBuiltinsAssembler(compiler::CodeAssemblerState* state)
-      : CodeStubAssembler(state) {}
-
- protected:
-  void Generate_NonPrimitiveToPrimitive(TNode<Context> context,
-                                        TNode<Object> input,
-                                        ToPrimitiveHint hint);
-
-  void Generate_OrdinaryToPrimitive(TNode<Context> context, TNode<Object> input,
-                                    OrdinaryToPrimitiveHint hint);
-};
-
-// ES6 section 7.1.1 ToPrimitive ( input [ , PreferredType ] )
-void ConversionBuiltinsAssembler::Generate_NonPrimitiveToPrimitive(
-    TNode<Context> context, TNode<Object> input, ToPrimitiveHint hint) {
-  // Lookup the @@toPrimitive property on the {input}.
-  TNode<Object> exotic_to_prim =
-      GetProperty(context, input, factory()->to_primitive_symbol());
-
-  // Check if {exotic_to_prim} is neither null nor undefined.
-  Label ordinary_to_primitive(this);
-  GotoIf(IsNullOrUndefined(exotic_to_prim), &ordinary_to_primitive);
-  {
-    // Invoke the {exotic_to_prim} method on the {input} with a string
-    // representation of the {hint}.
-    TNode<String> hint_string =
-        HeapConstant(factory()->ToPrimitiveHintString(hint));
-    TNode<Object> result = Call(context, exotic_to_prim, input, hint_string);
-
-    // Verify that the {result} is actually a primitive.
-    Label if_resultisprimitive(this),
-        if_resultisnotprimitive(this, Label::kDeferred);
-    GotoIf(TaggedIsSmi(result), &if_resultisprimitive);
-    TNode<Uint16T> result_instance_type = LoadInstanceType(CAST(result));
-    Branch(IsPrimitiveInstanceType(result_instance_type), &if_resultisprimitive,
-           &if_resultisnotprimitive);
-
-    BIND(&if_resultisprimitive);
-    {
-      // Just return the {result}.
-      Return(result);
-    }
-
-    BIND(&if_resultisnotprimitive);
-    {
-      // Somehow the @@toPrimitive method on {input} didn't yield a primitive.
-      ThrowTypeError(context, MessageTemplate::kCannotConvertToPrimitive);
-    }
-  }
-
-  // Convert using the OrdinaryToPrimitive algorithm instead.
-  BIND(&ordinary_to_primitive);
-  {
-    Callable callable = CodeFactory::OrdinaryToPrimitive(
-        isolate(), (hint == ToPrimitiveHint::kString)
-                       ? OrdinaryToPrimitiveHint::kString
-                       : OrdinaryToPrimitiveHint::kNumber);
-    TailCallStub(callable, context, input);
-  }
-}
-
-TF_BUILTIN(NonPrimitiveToPrimitive_Default, ConversionBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> input = CAST(Parameter(Descriptor::kArgument));
-
-  Generate_NonPrimitiveToPrimitive(context, input, ToPrimitiveHint::kDefault);
-}
-
-TF_BUILTIN(NonPrimitiveToPrimitive_Number, ConversionBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> input = CAST(Parameter(Descriptor::kArgument));
-
-  Generate_NonPrimitiveToPrimitive(context, input, ToPrimitiveHint::kNumber);
-}
-
-TF_BUILTIN(NonPrimitiveToPrimitive_String, ConversionBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> input = CAST(Parameter(Descriptor::kArgument));
-
-  Generate_NonPrimitiveToPrimitive(context, input, ToPrimitiveHint::kString);
-}
-
-TF_BUILTIN(StringToNumber, CodeStubAssembler) {
-  TNode<String> input = CAST(Parameter(Descriptor::kArgument));
-
-  Return(StringToNumber(input));
-}
-
-TF_BUILTIN(ToName, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> input = CAST(Parameter(Descriptor::kArgument));
-
-  TVARIABLE(Object, var_input, input);
-  Label loop(this, &var_input);
-  Goto(&loop);
-  BIND(&loop);
-  {
-    // Load the current {input} value.
-    TNode<Object> input = var_input.value();
-
-    // Dispatch based on the type of the {input.}
-    Label if_inputisbigint(this), if_inputisname(this), if_inputisnumber(this),
-        if_inputisoddball(this), if_inputisreceiver(this, Label::kDeferred);
-    GotoIf(TaggedIsSmi(input), &if_inputisnumber);
-    TNode<Uint16T> input_instance_type = LoadInstanceType(CAST(input));
-    STATIC_ASSERT(FIRST_NAME_TYPE == FIRST_TYPE);
-    GotoIf(IsNameInstanceType(input_instance_type), &if_inputisname);
-    GotoIf(IsJSReceiverInstanceType(input_instance_type), &if_inputisreceiver);
-    GotoIf(IsHeapNumberInstanceType(input_instance_type), &if_inputisnumber);
-    Branch(IsBigIntInstanceType(input_instance_type), &if_inputisbigint,
-           &if_inputisoddball);
-
-    BIND(&if_inputisbigint);
-    {
-      // We don't have a fast-path for BigInt currently, so just
-      // tail call to the %ToString runtime function here for now.
-      TailCallRuntime(Runtime::kToStringRT, context, input);
-    }
-
-    BIND(&if_inputisname);
-    {
-      // The {input} is already a Name.
-      Return(input);
-    }
-
-    BIND(&if_inputisnumber);
-    {
-      // Convert the String {input} to a Number.
-      TailCallBuiltin(Builtins::kNumberToString, context, input);
-    }
-
-    BIND(&if_inputisoddball);
-    {
-      // Just return the {input}'s string representation.
-      CSA_ASSERT(this, IsOddballInstanceType(input_instance_type));
-      Return(LoadObjectField(CAST(input), Oddball::kToStringOffset));
-    }
-
-    BIND(&if_inputisreceiver);
-    {
-      // Convert the JSReceiver {input} to a primitive first,
-      // and then run the loop again with the new {input},
-      // which is then a primitive value.
-      var_input = CallBuiltin(Builtins::kNonPrimitiveToPrimitive_String,
-                              context, input);
-      Goto(&loop);
-    }
-  }
-}
-
-TF_BUILTIN(NonNumberToNumber, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<HeapObject> input = CAST(Parameter(Descriptor::kArgument));
-
-  Return(NonNumberToNumber(context, input));
-}
-
-TF_BUILTIN(NonNumberToNumeric, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<HeapObject> input = CAST(Parameter(Descriptor::kArgument));
-
-  Return(NonNumberToNumeric(context, input));
-}
-
-TF_BUILTIN(ToNumeric, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> input = CAST(Parameter(Descriptor::kArgument));
-
-  Return(Select<Numeric>(
-      IsNumber(input), [=] { return CAST(input); },
-      [=] { return NonNumberToNumeric(context, CAST(input)); }));
-}
-
 // ES6 section 7.1.3 ToNumber ( argument )
 TF_BUILTIN(ToNumber, CodeStubAssembler) {
   // TODO(solanes, v8:6949): Changing this to a TNode<Context> crashes with the
@@ -206,93 +31,6 @@ TF_BUILTIN(ToNumberConvertBigInt, CodeStubAssembler) {
   Return(ToNumber(context, input, BigIntHandling::kConvertToNumber));
 }
 
-// ES section #sec-tostring-applied-to-the-number-type
-TF_BUILTIN(NumberToString, CodeStubAssembler) {
-  TNode<Number> input = CAST(Parameter(Descriptor::kArgument));
-
-  Return(NumberToString(input));
-}
-
-// 7.1.1.1 OrdinaryToPrimitive ( O, hint )
-void ConversionBuiltinsAssembler::Generate_OrdinaryToPrimitive(
-    TNode<Context> context, TNode<Object> input, OrdinaryToPrimitiveHint hint) {
-  TVARIABLE(Object, var_result);
-  Label return_result(this, &var_result);
-
-  Handle<String> method_names[2];
-  switch (hint) {
-    case OrdinaryToPrimitiveHint::kNumber:
-      method_names[0] = factory()->valueOf_string();
-      method_names[1] = factory()->toString_string();
-      break;
-    case OrdinaryToPrimitiveHint::kString:
-      method_names[0] = factory()->toString_string();
-      method_names[1] = factory()->valueOf_string();
-      break;
-  }
-  for (Handle<String> name : method_names) {
-    // Lookup the {name} on the {input}.
-    TNode<Object> method = GetProperty(context, input, name);
-
-    // Check if the {method} is callable.
-    Label if_methodiscallable(this),
-        if_methodisnotcallable(this, Label::kDeferred);
-    GotoIf(TaggedIsSmi(method), &if_methodisnotcallable);
-    TNode<Map> method_map = LoadMap(CAST(method));
-    Branch(IsCallableMap(method_map), &if_methodiscallable,
-           &if_methodisnotcallable);
-
-    BIND(&if_methodiscallable);
-    {
-      // Call the {method} on the {input}.
-      TNode<Object> result = Call(context, method, input);
-      var_result = result;
-
-      // Return the {result} if it is a primitive.
-      GotoIf(TaggedIsSmi(result), &return_result);
-      TNode<Uint16T> result_instance_type = LoadInstanceType(CAST(result));
-      GotoIf(IsPrimitiveInstanceType(result_instance_type), &return_result);
-    }
-
-    // Just continue with the next {name} if the {method} is not callable.
-    Goto(&if_methodisnotcallable);
-    BIND(&if_methodisnotcallable);
-  }
-
-  ThrowTypeError(context, MessageTemplate::kCannotConvertToPrimitive);
-
-  BIND(&return_result);
-  Return(var_result.value());
-}
-
-TF_BUILTIN(OrdinaryToPrimitive_Number, ConversionBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> input = CAST(Parameter(Descriptor::kArgument));
-  Generate_OrdinaryToPrimitive(context, input,
-                               OrdinaryToPrimitiveHint::kNumber);
-}
-
-TF_BUILTIN(OrdinaryToPrimitive_String, ConversionBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> input = CAST(Parameter(Descriptor::kArgument));
-  Generate_OrdinaryToPrimitive(context, input,
-                               OrdinaryToPrimitiveHint::kString);
-}
-
-// ES6 section 7.1.2 ToBoolean ( argument )
-TF_BUILTIN(ToBoolean, CodeStubAssembler) {
-  TNode<Object> value = CAST(Parameter(Descriptor::kArgument));
-
-  Label return_true(this), return_false(this);
-  BranchIfToBooleanIsTrue(value, &return_true, &return_false);
-
-  BIND(&return_true);
-  Return(TrueConstant());
-
-  BIND(&return_false);
-  Return(FalseConstant());
-}
-
 // ES6 section 7.1.2 ToBoolean ( argument )
 // Requires parameter on stack so that it can be used as a continuation from a
 // LAZY deopt.
@@ -309,130 +47,6 @@ TF_BUILTIN(ToBooleanLazyDeoptContinuation, CodeStubAssembler) {
   Return(FalseConstant());
 }
 
-TF_BUILTIN(ToLength, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  // We might need to loop once for ToNumber conversion.
-  TVARIABLE(Object, var_len, CAST(Parameter(Descriptor::kArgument)));
-  Label loop(this, &var_len);
-  Goto(&loop);
-  BIND(&loop);
-  {
-    // Shared entry points.
-    Label return_len(this), return_two53minus1(this, Label::kDeferred),
-        return_zero(this, Label::kDeferred);
-
-    // Load the current {len} value.
-    TNode<Object> len = var_len.value();
-
-    // Check if {len} is a positive Smi.
-    GotoIf(TaggedIsPositiveSmi(len), &return_len);
-
-    // Check if {len} is a (negative) Smi.
-    GotoIf(TaggedIsSmi(len), &return_zero);
-
-    // Check if {len} is a HeapNumber.
-    TNode<HeapObject> len_heap_object = CAST(len);
-    Label if_lenisheapnumber(this),
-        if_lenisnotheapnumber(this, Label::kDeferred);
-    Branch(IsHeapNumber(len_heap_object), &if_lenisheapnumber,
-           &if_lenisnotheapnumber);
-
-    BIND(&if_lenisheapnumber);
-    {
-      // Load the floating-point value of {len}.
-      TNode<Float64T> len_value = LoadHeapNumberValue(len_heap_object);
-
-      // Check if {len} is not greater than zero.
-      GotoIfNot(Float64GreaterThan(len_value, Float64Constant(0.0)),
-                &return_zero);
-
-      // Check if {len} is greater than or equal to 2^53-1.
-      GotoIf(Float64GreaterThanOrEqual(len_value,
-                                       Float64Constant(kMaxSafeInteger)),
-             &return_two53minus1);
-
-      // Round the {len} towards -Infinity.
-      TNode<Float64T> value = Float64Floor(len_value);
-      TNode<Number> result = ChangeFloat64ToTagged(value);
-      Return(result);
-    }
-
-    BIND(&if_lenisnotheapnumber);
-    {
-      // Need to convert {len} to a Number first.
-      var_len = CallBuiltin(Builtins::kNonNumberToNumber, context, len);
-      Goto(&loop);
-    }
-
-    BIND(&return_len);
-    Return(var_len.value());
-
-    BIND(&return_two53minus1);
-    Return(NumberConstant(kMaxSafeInteger));
-
-    BIND(&return_zero);
-    Return(SmiConstant(0));
-  }
-}
-
-// ES6 section 7.1.13 ToObject (argument)
-TF_BUILTIN(ToObject, CodeStubAssembler) {
-  Label if_smi(this, Label::kDeferred), if_jsreceiver(this),
-      if_noconstructor(this, Label::kDeferred),
-      if_wrapjs_primitive_wrapper(this);
-
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> object = CAST(Parameter(Descriptor::kArgument));
-
-  TVARIABLE(IntPtrT, constructor_function_index_var);
-
-  GotoIf(TaggedIsSmi(object), &if_smi);
-
-  TNode<Map> map = LoadMap(CAST(object));
-  TNode<Uint16T> instance_type = LoadMapInstanceType(map);
-  GotoIf(IsJSReceiverInstanceType(instance_type), &if_jsreceiver);
-
-  TNode<IntPtrT> constructor_function_index =
-      LoadMapConstructorFunctionIndex(map);
-  GotoIf(WordEqual(constructor_function_index,
-                   IntPtrConstant(Map::kNoConstructorFunctionIndex)),
-         &if_noconstructor);
-  constructor_function_index_var = constructor_function_index;
-  Goto(&if_wrapjs_primitive_wrapper);
-
-  BIND(&if_smi);
-  constructor_function_index_var =
-      IntPtrConstant(Context::NUMBER_FUNCTION_INDEX);
-  Goto(&if_wrapjs_primitive_wrapper);
-
-  BIND(&if_wrapjs_primitive_wrapper);
-  TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<JSFunction> constructor = CAST(LoadContextElement(
-      native_context, constructor_function_index_var.value()));
-  TNode<Map> initial_map = LoadObjectField<Map>(
-      constructor, JSFunction::kPrototypeOrInitialMapOffset);
-  TNode<HeapObject> js_primitive_wrapper =
-      Allocate(JSPrimitiveWrapper::kHeaderSize);
-  StoreMapNoWriteBarrier(js_primitive_wrapper, initial_map);
-  StoreObjectFieldRoot(js_primitive_wrapper,
-                       JSPrimitiveWrapper::kPropertiesOrHashOffset,
-                       RootIndex::kEmptyFixedArray);
-  StoreObjectFieldRoot(js_primitive_wrapper,
-                       JSPrimitiveWrapper::kElementsOffset,
-                       RootIndex::kEmptyFixedArray);
-  StoreObjectField(js_primitive_wrapper, JSPrimitiveWrapper::kValueOffset,
-                   object);
-  Return(js_primitive_wrapper);
-
-  BIND(&if_noconstructor);
-  ThrowTypeError(context, MessageTemplate::kUndefinedOrNullToObject,
-                 "ToObject");
-
-  BIND(&if_jsreceiver);
-  Return(object);
-}
-
 // ES6 section 12.5.5 typeof operator
 TF_BUILTIN(Typeof, CodeStubAssembler) {
   TNode<Object> object = CAST(Parameter(Descriptor::kObject));
diff --git a/deps/v8/src/builtins/builtins-dataview.cc b/deps/v8/src/builtins/builtins-dataview.cc
index 01f43c7fd9a..1718ea97ad1 100644
--- a/deps/v8/src/builtins/builtins-dataview.cc
+++ b/deps/v8/src/builtins/builtins-dataview.cc
@@ -102,6 +102,7 @@ BUILTIN(DataViewConstructor) {
   // 13. Set O's [[ByteOffset]] internal slot to offset.
   Handle<JSDataView>::cast(result)->set_byte_offset(view_byte_offset);
   Handle<JSDataView>::cast(result)->set_data_pointer(
+      isolate,
       static_cast<uint8_t*>(array_buffer->backing_store()) + view_byte_offset);
 
   // 14. Return O.
diff --git a/deps/v8/src/builtins/builtins-date-gen.cc b/deps/v8/src/builtins/builtins-date-gen.cc
index 98c1343d2c8..05fcc53f12b 100644
--- a/deps/v8/src/builtins/builtins-date-gen.cc
+++ b/deps/v8/src/builtins/builtins-date-gen.cc
@@ -50,11 +50,14 @@ void DateBuiltinsAssembler::Generate_DatePrototype_GetField(
       BIND(&stamp_mismatch);
     }
 
+    TNode<ExternalReference> isolate_ptr =
+        ExternalConstant(ExternalReference::isolate_address(isolate()));
     TNode<Smi> field_index_smi = SmiConstant(field_index);
     TNode<ExternalReference> function =
         ExternalConstant(ExternalReference::get_date_field_function());
     TNode<Object> result = CAST(CallCFunction(
         function, MachineType::AnyTagged(),
+        std::make_pair(MachineType::Pointer(), isolate_ptr),
         std::make_pair(MachineType::AnyTagged(), date_receiver),
         std::make_pair(MachineType::AnyTagged(), field_index_smi)));
     Return(result);
@@ -194,7 +197,7 @@ TF_BUILTIN(DatePrototypeToPrimitive, CodeStubAssembler) {
       hint_is_invalid(this, Label::kDeferred);
 
   // Fast cases for internalized strings.
-  TNode<String> number_string = numberStringConstant();
+  TNode<String> number_string = NumberStringConstant();
   GotoIf(TaggedEqual(hint, number_string), &hint_is_number);
   TNode<String> default_string = DefaultStringConstant();
   GotoIf(TaggedEqual(hint, default_string), &hint_is_string);
diff --git a/deps/v8/src/builtins/builtins-definitions.h b/deps/v8/src/builtins/builtins-definitions.h
index 7ed38062c81..e4f0b2de062 100644
--- a/deps/v8/src/builtins/builtins-definitions.h
+++ b/deps/v8/src/builtins/builtins-definitions.h
@@ -51,12 +51,19 @@ namespace internal {
   ASM(Call_ReceiverIsNullOrUndefined, CallTrampoline)                          \
   ASM(Call_ReceiverIsNotNullOrUndefined, CallTrampoline)                       \
   ASM(Call_ReceiverIsAny, CallTrampoline)                                      \
+  TFC(Call_ReceiverIsNullOrUndefined_WithFeedback,                             \
+      CallTrampoline_WithFeedback)                                             \
+  TFC(Call_ReceiverIsNotNullOrUndefined_WithFeedback,                          \
+      CallTrampoline_WithFeedback)                                             \
+  TFC(Call_ReceiverIsAny_WithFeedback, CallTrampoline_WithFeedback)            \
                                                                                \
   /* ES6 section 9.5.12[[Call]] ( thisArgument, argumentsList ) */             \
   TFC(CallProxy, CallTrampoline)                                               \
   ASM(CallVarargs, CallVarargs)                                                \
   TFC(CallWithSpread, CallWithSpread)                                          \
+  TFC(CallWithSpread_WithFeedback, CallWithSpread_WithFeedback)                \
   TFC(CallWithArrayLike, CallWithArrayLike)                                    \
+  TFC(CallWithArrayLike_WithFeedback, CallWithArrayLike_WithFeedback)          \
   ASM(CallForwardVarargs, CallForwardVarargs)                                  \
   ASM(CallFunctionForwardVarargs, CallForwardVarargs)                          \
   /* Call an API callback via a {FunctionTemplateInfo}, doing appropriate */   \
@@ -76,9 +83,13 @@ namespace internal {
   ASM(Construct, JSTrampoline)                                                 \
   ASM(ConstructVarargs, ConstructVarargs)                                      \
   TFC(ConstructWithSpread, ConstructWithSpread)                                \
+  TFC(ConstructWithSpread_WithFeedback, ConstructWithSpread_WithFeedback)      \
   TFC(ConstructWithArrayLike, ConstructWithArrayLike)                          \
+  TFC(ConstructWithArrayLike_WithFeedback,                                     \
+      ConstructWithArrayLike_WithFeedback)                                     \
   ASM(ConstructForwardVarargs, ConstructForwardVarargs)                        \
   ASM(ConstructFunctionForwardVarargs, ConstructForwardVarargs)                \
+  TFC(Construct_WithFeedback, Construct_WithFeedback)                          \
   ASM(JSConstructStubGeneric, Dummy)                                           \
   ASM(JSBuiltinsConstructStub, Dummy)                                          \
   TFC(FastNewObject, FastNewObject)                                            \
@@ -185,22 +196,8 @@ namespace internal {
   ASM(HandleDebuggerStatement, ContextOnly)                                    \
                                                                                \
   /* Type conversions */                                                       \
-  TFC(ToObject, TypeConversion)                                                \
-  TFC(ToBoolean, TypeConversion)                                               \
-  TFC(OrdinaryToPrimitive_Number, TypeConversion)                              \
-  TFC(OrdinaryToPrimitive_String, TypeConversion)                              \
-  TFC(NonPrimitiveToPrimitive_Default, TypeConversion)                         \
-  TFC(NonPrimitiveToPrimitive_Number, TypeConversion)                          \
-  TFC(NonPrimitiveToPrimitive_String, TypeConversion)                          \
-  TFC(StringToNumber, TypeConversion)                                          \
-  TFC(ToName, TypeConversion)                                                  \
-  TFC(NonNumberToNumber, TypeConversion)                                       \
-  TFC(NonNumberToNumeric, TypeConversion)                                      \
   TFC(ToNumber, TypeConversion)                                                \
   TFC(ToNumberConvertBigInt, TypeConversion)                                   \
-  TFC(ToNumeric, TypeConversion)                                               \
-  TFC(NumberToString, TypeConversion)                                          \
-  TFC(ToLength, TypeConversion)                                                \
   TFC(Typeof, Typeof)                                                          \
   TFC(GetSuperConstructor, Typeof)                                             \
   TFC(BigIntToI64, BigIntToI64)                                                \
@@ -498,21 +495,12 @@ namespace internal {
   CPP(ErrorConstructor)                                                        \
   CPP(ErrorCaptureStackTrace)                                                  \
   CPP(ErrorPrototypeToString)                                                  \
-  CPP(MakeError)                                                               \
-  CPP(MakeRangeError)                                                          \
-  CPP(MakeSyntaxError)                                                         \
-  CPP(MakeTypeError)                                                           \
-  CPP(MakeURIError)                                                            \
                                                                                \
   /* Function */                                                               \
   CPP(FunctionConstructor)                                                     \
   ASM(FunctionPrototypeApply, JSTrampoline)                                    \
   CPP(FunctionPrototypeBind)                                                   \
-  /* ES6 #sec-function.prototype.bind */                                       \
-  TFJ(FastFunctionPrototypeBind, kDontAdaptArgumentsSentinel)                  \
   ASM(FunctionPrototypeCall, JSTrampoline)                                     \
-  /* ES6 #sec-function.prototype-@@hasinstance */                              \
-  TFJ(FunctionPrototypeHasInstance, 1, kReceiver, kV)                          \
   /* ES6 #sec-function.prototype.tostring */                                   \
   CPP(FunctionPrototypeToString)                                               \
                                                                                \
@@ -579,7 +567,9 @@ namespace internal {
   /* IterableToList */                                                         \
   /* ES #sec-iterabletolist */                                                 \
   TFS(IterableToList, kIterable, kIteratorFn)                                  \
+  TFS(IterableToFixedArray, kIterable, kIteratorFn)                            \
   TFS(IterableToListWithSymbolLookup, kIterable)                               \
+  TFS(IterableToFixedArrayWithSymbolLookupSlow, kIterable)                     \
   TFS(IterableToListMayPreserveHoles, kIterable, kIteratorFn)                  \
   TFS(IterableToFixedArrayForWasm, kIterable, kExpectedLength)                 \
                                                                                \
@@ -608,53 +598,42 @@ namespace internal {
   TFJ(MapIteratorPrototypeNext, 0, kReceiver)                                  \
   TFS(MapIteratorToList, kSource)                                              \
                                                                                \
-  /* Number */                                                                 \
-  TFC(AllocateHeapNumber, AllocateHeapNumber)                                  \
   /* ES #sec-number-constructor */                                             \
   TFJ(NumberConstructor, kDontAdaptArgumentsSentinel)                          \
-  /* ES6 #sec-number.isfinite */                                               \
-  TFJ(NumberIsFinite, 1, kReceiver, kNumber)                                   \
-  /* ES6 #sec-number.isinteger */                                              \
-  TFJ(NumberIsInteger, 1, kReceiver, kNumber)                                  \
-  /* ES6 #sec-number.isnan */                                                  \
-  TFJ(NumberIsNaN, 1, kReceiver, kNumber)                                      \
-  /* ES6 #sec-number.issafeinteger */                                          \
-  TFJ(NumberIsSafeInteger, 1, kReceiver, kNumber)                              \
-  /* ES6 #sec-number.parsefloat */                                             \
-  TFJ(NumberParseFloat, 1, kReceiver, kString)                                 \
-  /* ES6 #sec-number.parseint */                                               \
-  TFJ(NumberParseInt, 2, kReceiver, kString, kRadix)                           \
-  TFS(ParseInt, kString, kRadix)                                               \
   CPP(NumberPrototypeToExponential)                                            \
   CPP(NumberPrototypeToFixed)                                                  \
   CPP(NumberPrototypeToLocaleString)                                           \
   CPP(NumberPrototypeToPrecision)                                              \
-  /* ES6 #sec-number.prototype.valueof */                                      \
-  TFJ(NumberPrototypeValueOf, 0, kReceiver)                                    \
-  TFC(Add, BinaryOp)                                                           \
-  TFC(Subtract, BinaryOp)                                                      \
-  TFC(Multiply, BinaryOp)                                                      \
-  TFC(Divide, BinaryOp)                                                        \
-  TFC(Modulus, BinaryOp)                                                       \
-  TFC(Exponentiate, BinaryOp)                                                  \
-  TFC(BitwiseAnd, BinaryOp)                                                    \
-  TFC(BitwiseOr, BinaryOp)                                                     \
-  TFC(BitwiseXor, BinaryOp)                                                    \
-  TFC(ShiftLeft, BinaryOp)                                                     \
-  TFC(ShiftRight, BinaryOp)                                                    \
-  TFC(ShiftRightLogical, BinaryOp)                                             \
-  TFC(LessThan, Compare)                                                       \
-  TFC(LessThanOrEqual, Compare)                                                \
-  TFC(GreaterThan, Compare)                                                    \
-  TFC(GreaterThanOrEqual, Compare)                                             \
-  TFC(Equal, Compare)                                                          \
   TFC(SameValue, Compare)                                                      \
   TFC(SameValueNumbersOnly, Compare)                                           \
-  TFC(StrictEqual, Compare)                                                    \
-  TFS(BitwiseNot, kValue)                                                      \
-  TFS(Decrement, kValue)                                                       \
-  TFS(Increment, kValue)                                                       \
-  TFS(Negate, kValue)                                                          \
+                                                                               \
+  /* Binary ops with feedback collection */                                    \
+  TFC(Add_WithFeedback, BinaryOp_WithFeedback)                                 \
+  TFC(Subtract_WithFeedback, BinaryOp_WithFeedback)                            \
+  TFC(Multiply_WithFeedback, BinaryOp_WithFeedback)                            \
+  TFC(Divide_WithFeedback, BinaryOp_WithFeedback)                              \
+  TFC(Modulus_WithFeedback, BinaryOp_WithFeedback)                             \
+  TFC(Exponentiate_WithFeedback, BinaryOp_WithFeedback)                        \
+  TFC(BitwiseAnd_WithFeedback, BinaryOp_WithFeedback)                          \
+  TFC(BitwiseOr_WithFeedback, BinaryOp_WithFeedback)                           \
+  TFC(BitwiseXor_WithFeedback, BinaryOp_WithFeedback)                          \
+  TFC(ShiftLeft_WithFeedback, BinaryOp_WithFeedback)                           \
+  TFC(ShiftRight_WithFeedback, BinaryOp_WithFeedback)                          \
+  TFC(ShiftRightLogical_WithFeedback, BinaryOp_WithFeedback)                   \
+                                                                               \
+  /* Compare ops with feedback collection */                                   \
+  TFC(Equal_WithFeedback, Compare_WithFeedback)                                \
+  TFC(StrictEqual_WithFeedback, Compare_WithFeedback)                          \
+  TFC(LessThan_WithFeedback, Compare_WithFeedback)                             \
+  TFC(GreaterThan_WithFeedback, Compare_WithFeedback)                          \
+  TFC(LessThanOrEqual_WithFeedback, Compare_WithFeedback)                      \
+  TFC(GreaterThanOrEqual_WithFeedback, Compare_WithFeedback)                   \
+                                                                               \
+  /* Unary ops with feedback collection */                                     \
+  TFC(BitwiseNot_WithFeedback, UnaryOp_WithFeedback)                           \
+  TFC(Decrement_WithFeedback, UnaryOp_WithFeedback)                            \
+  TFC(Increment_WithFeedback, UnaryOp_WithFeedback)                            \
+  TFC(Negate_WithFeedback, UnaryOp_WithFeedback)                               \
                                                                                \
   /* Object */                                                                 \
   /* ES #sec-object-constructor */                                             \
@@ -678,18 +657,12 @@ namespace internal {
   TFJ(ObjectKeys, 1, kReceiver, kObject)                                       \
   CPP(ObjectLookupGetter)                                                      \
   CPP(ObjectLookupSetter)                                                      \
-  /* ES6 #sec-object.prototype.tostring */                                     \
-  TFJ(ObjectPrototypeToString, 0, kReceiver)                                   \
-  /* ES6 #sec-object.prototype.valueof */                                      \
-  TFJ(ObjectPrototypeValueOf, 0, kReceiver)                                    \
   /* ES6 #sec-object.prototype.hasownproperty */                               \
   TFJ(ObjectPrototypeHasOwnProperty, 1, kReceiver, kKey)                       \
   TFJ(ObjectPrototypeIsPrototypeOf, 1, kReceiver, kValue)                      \
   CPP(ObjectPrototypePropertyIsEnumerable)                                     \
   CPP(ObjectPrototypeGetProto)                                                 \
   CPP(ObjectPrototypeSetProto)                                                 \
-  /* ES #sec-object.prototype.tolocalestring */                                \
-  TFJ(ObjectPrototypeToLocaleString, 0, kReceiver)                             \
   CPP(ObjectSeal)                                                              \
   TFS(ObjectToString, kReceiver)                                               \
   TFJ(ObjectValues, 1, kReceiver, kObject)                                     \
@@ -702,9 +675,6 @@ namespace internal {
   TFS(ForInEnumerate, kReceiver)                                               \
   TFS(ForInFilter, kKey, kObject)                                              \
                                                                                \
-  /* Promise */                                                                \
-  CPP(IsPromise)                                                               \
-                                                                               \
   /* Reflect */                                                                \
   ASM(ReflectApply, JSTrampoline)                                              \
   ASM(ReflectConstruct, JSTrampoline)                                          \
@@ -825,12 +795,6 @@ namespace internal {
   TFJ(TypedArrayPrototypeByteOffset, 0, kReceiver)                             \
   /* ES6 #sec-get-%typedarray%.prototype.length */                             \
   TFJ(TypedArrayPrototypeLength, 0, kReceiver)                                 \
-  /* ES6 #sec-%typedarray%.prototype.entries */                                \
-  TFJ(TypedArrayPrototypeEntries, 0, kReceiver)                                \
-  /* ES6 #sec-%typedarray%.prototype.keys */                                   \
-  TFJ(TypedArrayPrototypeKeys, 0, kReceiver)                                   \
-  /* ES6 #sec-%typedarray%.prototype.values */                                 \
-  TFJ(TypedArrayPrototypeValues, 0, kReceiver)                                 \
   /* ES6 #sec-%typedarray%.prototype.copywithin */                             \
   CPP(TypedArrayPrototypeCopyWithin)                                           \
   /* ES6 #sec-%typedarray%.prototype.fill */                                   \
@@ -851,35 +815,11 @@ namespace internal {
   /* Wasm */                                                                   \
   ASM(WasmCompileLazy, Dummy)                                                  \
   ASM(WasmDebugBreak, Dummy)                                                   \
-  TFC(WasmAtomicNotify, WasmAtomicNotify)                                      \
+  TFC(WasmFloat32ToNumber, WasmFloat32ToNumber)                                \
+  TFC(WasmFloat64ToNumber, WasmFloat64ToNumber)                                \
+  TFS(WasmAllocateArray, kMapIndex, kLength, kElementSize)                     \
   TFC(WasmI32AtomicWait32, WasmI32AtomicWait32)                                \
-  TFC(WasmI32AtomicWait64, WasmI32AtomicWait64)                                \
   TFC(WasmI64AtomicWait32, WasmI64AtomicWait32)                                \
-  TFC(WasmI64AtomicWait64, WasmI64AtomicWait64)                                \
-  TFC(WasmMemoryGrow, WasmMemoryGrow)                                          \
-  TFC(WasmTableInit, WasmTableInit)                                            \
-  TFC(WasmTableCopy, WasmTableCopy)                                            \
-  TFC(WasmTableGet, WasmTableGet)                                              \
-  TFC(WasmTableSet, WasmTableSet)                                              \
-  TFC(WasmStackGuard, NoContext)                                               \
-  TFC(WasmStackOverflow, NoContext)                                            \
-  TFC(WasmThrow, WasmThrow)                                                    \
-  TFC(WasmRethrow, WasmThrow)                                                  \
-  TFS(WasmTraceMemory, kMemoryTracingInfo)                                     \
-  TFS(ThrowWasmTrapUnreachable)                                                \
-  TFS(ThrowWasmTrapMemOutOfBounds)                                             \
-  TFS(ThrowWasmTrapUnalignedAccess)                                            \
-  TFS(ThrowWasmTrapDivByZero)                                                  \
-  TFS(ThrowWasmTrapDivUnrepresentable)                                         \
-  TFS(ThrowWasmTrapRemByZero)                                                  \
-  TFS(ThrowWasmTrapFloatUnrepresentable)                                       \
-  TFS(ThrowWasmTrapFuncInvalid)                                                \
-  TFS(ThrowWasmTrapFuncSigMismatch)                                            \
-  TFS(ThrowWasmTrapDataSegmentDropped)                                         \
-  TFS(ThrowWasmTrapElemSegmentDropped)                                         \
-  TFS(ThrowWasmTrapTableOutOfBounds)                                           \
-  TFS(ThrowWasmTrapBrOnExnNullRef)                                             \
-  TFS(ThrowWasmTrapRethrowNullRef)                                             \
                                                                                \
   /* WeakMap */                                                                \
   TFJ(WeakMapConstructor, kDontAdaptArgumentsSentinel)                         \
@@ -976,8 +916,6 @@ namespace internal {
   CPP(Trace)                                                                   \
                                                                                \
   /* Weak refs */                                                              \
-  CPP(FinalizationRegistryCleanupIteratorNext)                                 \
-  CPP(FinalizationRegistryCleanupSome)                                         \
   CPP(FinalizationRegistryConstructor)                                         \
   CPP(FinalizationRegistryRegister)                                            \
   CPP(FinalizationRegistryUnregister)                                          \
@@ -1164,6 +1102,7 @@ namespace internal {
   V(AsyncGeneratorAwaitCaught)                       \
   V(AsyncGeneratorAwaitUncaught)                     \
   V(PromiseAll)                                      \
+  V(PromiseAny)                                      \
   V(PromiseConstructor)                              \
   V(PromiseConstructorLazyDeoptContinuation)         \
   V(PromiseFulfillReactionJob)                       \
diff --git a/deps/v8/src/builtins/builtins-descriptors.h b/deps/v8/src/builtins/builtins-descriptors.h
index 174b89795f5..c2eb44debea 100644
--- a/deps/v8/src/builtins/builtins-descriptors.h
+++ b/deps/v8/src/builtins/builtins-descriptors.h
@@ -13,34 +13,7 @@
 namespace v8 {
 namespace internal {
 
-#define REVERSE_0(a) a,
-#define REVERSE_1(a, b) b, a,
-#define REVERSE_2(a, b, c) c, b, a,
-#define REVERSE_3(a, b, c, d) d, c, b, a,
-#define REVERSE_4(a, b, c, d, e) e, d, c, b, a,
-#define REVERSE_5(a, b, c, d, e, f) f, e, d, c, b, a,
-#define REVERSE_6(a, b, c, d, e, f, g) g, f, e, d, c, b, a,
-#define REVERSE_7(a, b, c, d, e, f, g, h) h, g, f, e, d, c, b, a,
-#define REVERSE_8(a, b, c, d, e, f, g, h, i) i, h, g, f, e, d, c, b, a,
-#define REVERSE_kDontAdaptArgumentsSentinel(...)
-#define REVERSE(N, ...) REVERSE_##N(__VA_ARGS__)
-
 // Define interface descriptors for builtins with JS linkage.
-#ifdef V8_REVERSE_JSARGS
-#define DEFINE_TFJ_INTERFACE_DESCRIPTOR(Name, Argc, ...)                \
-  struct Builtin_##Name##_InterfaceDescriptor {                         \
-    enum ParameterIndices {                                             \
-      kJSTarget = compiler::CodeAssembler::kTargetParameterIndex,       \
-      REVERSE_##Argc(__VA_ARGS__) kJSNewTarget,                         \
-      kJSActualArgumentsCount,                                          \
-      kContext,                                                         \
-      kParameterCount,                                                  \
-    };                                                                  \
-    static_assert((Argc) == static_cast<uint16_t>(kParameterCount - 4), \
-                  "Inconsistent set of arguments");                     \
-    static_assert(kJSTarget == -1, "Unexpected kJSTarget index value"); \
-  };
-#else
 #define DEFINE_TFJ_INTERFACE_DESCRIPTOR(Name, Argc, ...)                \
   struct Builtin_##Name##_InterfaceDescriptor {                         \
     enum ParameterIndices {                                             \
@@ -55,7 +28,6 @@ namespace internal {
                   "Inconsistent set of arguments");                     \
     static_assert(kJSTarget == -1, "Unexpected kJSTarget index value"); \
   };
-#endif
 
 // Define interface descriptors for builtins with StubCall linkage.
 #define DEFINE_TFC_INTERFACE_DESCRIPTOR(Name, InterfaceDescriptor) \
diff --git a/deps/v8/src/builtins/builtins-error.cc b/deps/v8/src/builtins/builtins-error.cc
index 3634362205c..840298eacbf 100644
--- a/deps/v8/src/builtins/builtins-error.cc
+++ b/deps/v8/src/builtins/builtins-error.cc
@@ -18,24 +18,9 @@ namespace internal {
 // ES6 section 19.5.1.1 Error ( message )
 BUILTIN(ErrorConstructor) {
   HandleScope scope(isolate);
-
-  FrameSkipMode mode = SKIP_FIRST;
-  Handle<Object> caller;
-
-  // When we're passed a JSFunction as new target, we can skip frames until that
-  // specific function is seen instead of unconditionally skipping the first
-  // frame.
-  if (args.new_target()->IsJSFunction()) {
-    mode = SKIP_UNTIL_SEEN;
-    caller = args.new_target();
-  }
-
   RETURN_RESULT_OR_FAILURE(
-      isolate,
-      ErrorUtils::Construct(isolate, args.target(),
-                            Handle<Object>::cast(args.new_target()),
-                            args.atOrUndefined(isolate, 1), mode, caller,
-                            ErrorUtils::StackTraceCollection::kDetailed));
+      isolate, ErrorUtils::Construct(isolate, args.target(), args.new_target(),
+                                     args.atOrUndefined(isolate, 1)));
 }
 
 // static
@@ -85,53 +70,5 @@ BUILTIN(ErrorPrototypeToString) {
                            ErrorUtils::ToString(isolate, args.receiver()));
 }
 
-namespace {
-
-Object MakeGenericError(Isolate* isolate, BuiltinArguments args,
-                        Handle<JSFunction> constructor) {
-  Handle<Object> template_index = args.atOrUndefined(isolate, 1);
-  Handle<Object> arg0 = args.atOrUndefined(isolate, 2);
-  Handle<Object> arg1 = args.atOrUndefined(isolate, 3);
-  Handle<Object> arg2 = args.atOrUndefined(isolate, 4);
-
-  DCHECK(template_index->IsSmi());
-
-  return *ErrorUtils::MakeGenericError(
-      isolate, constructor, MessageTemplateFromInt(Smi::ToInt(*template_index)),
-      arg0, arg1, arg2, SKIP_NONE);
-}
-
-}  // namespace
-
-BUILTIN(MakeError) {
-  HandleScope scope(isolate);
-  return MakeGenericError(isolate, args, isolate->error_function());
-}
-
-BUILTIN(MakeRangeError) {
-  HandleScope scope(isolate);
-  return MakeGenericError(isolate, args, isolate->range_error_function());
-}
-
-BUILTIN(MakeSyntaxError) {
-  HandleScope scope(isolate);
-  return MakeGenericError(isolate, args, isolate->syntax_error_function());
-}
-
-BUILTIN(MakeTypeError) {
-  HandleScope scope(isolate);
-  return MakeGenericError(isolate, args, isolate->type_error_function());
-}
-
-BUILTIN(MakeURIError) {
-  HandleScope scope(isolate);
-  Handle<JSFunction> constructor = isolate->uri_error_function();
-  Handle<Object> undefined = isolate->factory()->undefined_value();
-  MessageTemplate template_index = MessageTemplate::kURIMalformed;
-  return *ErrorUtils::MakeGenericError(isolate, constructor, template_index,
-                                       undefined, undefined, undefined,
-                                       SKIP_NONE);
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-function-gen.cc b/deps/v8/src/builtins/builtins-function-gen.cc
deleted file mode 100644
index 1d48ee84d1c..00000000000
--- a/deps/v8/src/builtins/builtins-function-gen.cc
+++ /dev/null
@@ -1,202 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/builtins/builtins-utils-gen.h"
-#include "src/builtins/builtins.h"
-#include "src/codegen/code-stub-assembler.h"
-#include "src/execution/frame-constants.h"
-#include "src/objects/api-callbacks.h"
-#include "src/objects/descriptor-array.h"
-
-namespace v8 {
-namespace internal {
-
-TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
-  Label slow(this);
-
-  TNode<Int32T> argc =
-      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> new_target = CAST(Parameter(Descriptor::kJSNewTarget));
-
-  CodeStubArguments args(this, argc);
-
-  // Check that receiver has instance type of JS_FUNCTION_TYPE
-  TNode<Object> receiver = args.GetReceiver();
-  GotoIf(TaggedIsSmi(receiver), &slow);
-
-  TNode<Map> receiver_map = LoadMap(CAST(receiver));
-  {
-    TNode<Uint16T> instance_type = LoadMapInstanceType(receiver_map);
-    GotoIfNot(
-        Word32Or(InstanceTypeEqual(instance_type, JS_FUNCTION_TYPE),
-                 InstanceTypeEqual(instance_type, JS_BOUND_FUNCTION_TYPE)),
-        &slow);
-  }
-
-  // Disallow binding of slow-mode functions. We need to figure out whether the
-  // length and name property are in the original state.
-  Comment("Disallow binding of slow-mode functions");
-  GotoIf(IsDictionaryMap(receiver_map), &slow);
-
-  // Check whether the length and name properties are still present as
-  // AccessorInfo objects. In that case, their value can be recomputed even if
-  // the actual value on the object changes.
-  Comment("Check descriptor array length");
-  // Minimum descriptor array length required for fast path.
-  const int min_nof_descriptors = i::Max(JSFunction::kLengthDescriptorIndex,
-                                         JSFunction::kNameDescriptorIndex) +
-                                  1;
-  TNode<Int32T> nof_descriptors = LoadNumberOfOwnDescriptors(receiver_map);
-  GotoIf(Int32LessThan(nof_descriptors, Int32Constant(min_nof_descriptors)),
-         &slow);
-
-  // Check whether the length and name properties are still present as
-  // AccessorInfo objects. In that case, their value can be recomputed even if
-  // the actual value on the object changes.
-  Comment("Check name and length properties");
-  {
-    TNode<DescriptorArray> descriptors = LoadMapDescriptors(receiver_map);
-    const int length_index = JSFunction::kLengthDescriptorIndex;
-    TNode<Name> maybe_length =
-        LoadKeyByDescriptorEntry(descriptors, length_index);
-    GotoIf(TaggedNotEqual(maybe_length, LengthStringConstant()), &slow);
-
-    TNode<Object> maybe_length_accessor =
-        LoadValueByDescriptorEntry(descriptors, length_index);
-    GotoIf(TaggedIsSmi(maybe_length_accessor), &slow);
-    TNode<Map> length_value_map = LoadMap(CAST(maybe_length_accessor));
-    GotoIfNot(IsAccessorInfoMap(length_value_map), &slow);
-
-    const int name_index = JSFunction::kNameDescriptorIndex;
-    TNode<Name> maybe_name = LoadKeyByDescriptorEntry(descriptors, name_index);
-    GotoIf(TaggedNotEqual(maybe_name, NameStringConstant()), &slow);
-
-    TNode<Object> maybe_name_accessor =
-        LoadValueByDescriptorEntry(descriptors, name_index);
-    GotoIf(TaggedIsSmi(maybe_name_accessor), &slow);
-    TNode<Map> name_value_map = LoadMap(CAST(maybe_name_accessor));
-    GotoIfNot(IsAccessorInfoMap(name_value_map), &slow);
-  }
-
-  // Choose the right bound function map based on whether the target is
-  // constructable.
-  Comment("Choose the right bound function map");
-  TVARIABLE(Map, bound_function_map);
-  {
-    Label with_constructor(this);
-    TNode<NativeContext> native_context = LoadNativeContext(context);
-
-    Label map_done(this, &bound_function_map);
-    GotoIf(IsConstructorMap(receiver_map), &with_constructor);
-
-    bound_function_map = CAST(LoadContextElement(
-        native_context, Context::BOUND_FUNCTION_WITHOUT_CONSTRUCTOR_MAP_INDEX));
-    Goto(&map_done);
-
-    BIND(&with_constructor);
-    bound_function_map = CAST(LoadContextElement(
-        native_context, Context::BOUND_FUNCTION_WITH_CONSTRUCTOR_MAP_INDEX));
-    Goto(&map_done);
-
-    BIND(&map_done);
-  }
-
-  // Verify that __proto__ matches that of a the target bound function.
-  Comment("Verify that __proto__ matches target bound function");
-  TNode<HeapObject> prototype = LoadMapPrototype(receiver_map);
-  TNode<HeapObject> expected_prototype =
-      LoadMapPrototype(bound_function_map.value());
-  GotoIf(TaggedNotEqual(prototype, expected_prototype), &slow);
-
-  // Allocate the arguments array.
-  Comment("Allocate the arguments array");
-  TVARIABLE(FixedArray, argument_array);
-  {
-    Label empty_arguments(this);
-    Label arguments_done(this, &argument_array);
-    GotoIf(Uint32LessThanOrEqual(argc, Int32Constant(1)), &empty_arguments);
-    TNode<IntPtrT> elements_length =
-        Signed(ChangeUint32ToWord(Unsigned(Int32Sub(argc, Int32Constant(1)))));
-    argument_array = CAST(AllocateFixedArray(PACKED_ELEMENTS, elements_length,
-                                             kAllowLargeObjectAllocation));
-    TVARIABLE(IntPtrT, index, IntPtrConstant(0));
-    VariableList foreach_vars({&index}, zone());
-    args.ForEach(
-        foreach_vars,
-        [&](TNode<Object> arg) {
-          StoreFixedArrayElement(argument_array.value(), index.value(), arg);
-          Increment(&index);
-        },
-        IntPtrConstant(1));
-    Goto(&arguments_done);
-
-    BIND(&empty_arguments);
-    argument_array = EmptyFixedArrayConstant();
-    Goto(&arguments_done);
-
-    BIND(&arguments_done);
-  }
-
-  // Determine bound receiver.
-  Comment("Determine bound receiver");
-  TVARIABLE(Object, bound_receiver);
-  {
-    Label has_receiver(this);
-    Label receiver_done(this, &bound_receiver);
-    GotoIf(Word32NotEqual(argc, Int32Constant(0)), &has_receiver);
-    bound_receiver = UndefinedConstant();
-    Goto(&receiver_done);
-
-    BIND(&has_receiver);
-    bound_receiver = args.AtIndex(0);
-    Goto(&receiver_done);
-
-    BIND(&receiver_done);
-  }
-
-  // Allocate the resulting bound function.
-  Comment("Allocate the resulting bound function");
-  {
-    TNode<HeapObject> bound_function = Allocate(JSBoundFunction::kHeaderSize);
-    StoreMapNoWriteBarrier(bound_function, bound_function_map.value());
-    StoreObjectFieldNoWriteBarrier(
-        bound_function, JSBoundFunction::kBoundTargetFunctionOffset, receiver);
-    StoreObjectFieldNoWriteBarrier(bound_function,
-                                   JSBoundFunction::kBoundThisOffset,
-                                   bound_receiver.value());
-    StoreObjectFieldNoWriteBarrier(bound_function,
-                                   JSBoundFunction::kBoundArgumentsOffset,
-                                   argument_array.value());
-    TNode<FixedArray> empty_fixed_array = EmptyFixedArrayConstant();
-    StoreObjectFieldNoWriteBarrier(
-        bound_function, JSObject::kPropertiesOrHashOffset, empty_fixed_array);
-    StoreObjectFieldNoWriteBarrier(bound_function, JSObject::kElementsOffset,
-                                   empty_fixed_array);
-
-    args.PopAndReturn(bound_function);
-  }
-
-  BIND(&slow);
-  {
-    // We are not using Parameter(Descriptor::kJSTarget) and loading the value
-    // from the current frame here in order to reduce register pressure on the
-    // fast path.
-    TNode<JSFunction> target = LoadTargetFromFrame();
-    TailCallBuiltin(Builtins::kFunctionPrototypeBind, context, target,
-                    new_target, argc);
-  }
-}
-
-// ES6 #sec-function.prototype-@@hasinstance
-TF_BUILTIN(FunctionPrototypeHasInstance, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> f = CAST(Parameter(Descriptor::kReceiver));
-  TNode<Object> v = CAST(Parameter(Descriptor::kV));
-  TNode<Oddball> result = OrdinaryHasInstance(context, f, v);
-  Return(result);
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-handler-gen.cc b/deps/v8/src/builtins/builtins-handler-gen.cc
index 48a137abc62..3f4a53a3461 100644
--- a/deps/v8/src/builtins/builtins-handler-gen.cc
+++ b/deps/v8/src/builtins/builtins-handler-gen.cc
@@ -9,6 +9,7 @@
 #include "src/ic/ic.h"
 #include "src/ic/keyed-store-generic.h"
 #include "src/objects/objects-inl.h"
+#include "torque-generated/exported-macros-assembler-tq.h"
 
 namespace v8 {
 namespace internal {
@@ -78,37 +79,11 @@ TNode<Object> HandlerBuiltinsAssembler::EmitKeyedSloppyArguments(
     TNode<JSObject> receiver, TNode<Object> tagged_key,
     base::Optional<TNode<Object>> value, Label* bailout,
     ArgumentsAccessMode access_mode) {
-  // Mapped arguments are actual arguments. Unmapped arguments are values added
-  // to the arguments object after it was created for the call. Mapped arguments
-  // are stored in the context at indexes given by elements[key + 2]. Unmapped
-  // arguments are stored as regular indexed properties in the arguments array,
-  // held at elements[1]. See NewSloppyArguments() in runtime.cc for a detailed
-  // look at argument object construction.
-  //
-  // The sloppy arguments elements array has a special format:
-  //
-  // 0: context
-  // 1: unmapped arguments array
-  // 2: mapped_index0,
-  // 3: mapped_index1,
-  // ...
-  //
-  // length is 2 + min(number_of_actual_arguments, number_of_formal_arguments).
-  // If key + 2 >= elements.length then attempt to look in the unmapped
-  // arguments array (given by elements[1]) and return the value at key, missing
-  // to the runtime if the unmapped arguments array is not a fixed array or if
-  // key >= unmapped_arguments_array.length.
-  //
-  // Otherwise, t = elements[key + 2]. If t is the hole, then look up the value
-  // in the unmapped arguments array, as described above. Otherwise, t is a Smi
-  // index into the context array given at elements[0]. Return the value at
-  // context[t].
-
   GotoIfNot(TaggedIsSmi(tagged_key), bailout);
   TNode<IntPtrT> key = SmiUntag(CAST(tagged_key));
   GotoIf(IntPtrLessThan(key, IntPtrConstant(0)), bailout);
 
-  TNode<FixedArray> elements = CAST(LoadElements(receiver));
+  TNode<SloppyArgumentsElements> elements = CAST(LoadElements(receiver));
   TNode<IntPtrT> elements_length = LoadAndUntagFixedArrayBaseLength(elements);
 
   TVARIABLE(Object, var_result);
@@ -119,20 +94,18 @@ TNode<Object> HandlerBuiltinsAssembler::EmitKeyedSloppyArguments(
            access_mode == ArgumentsAccessMode::kHas);
   }
   Label if_mapped(this), if_unmapped(this), end(this, &var_result);
-  TNode<IntPtrT> intptr_two = IntPtrConstant(2);
-  TNode<IntPtrT> adjusted_length = IntPtrSub(elements_length, intptr_two);
 
-  GotoIf(UintPtrGreaterThanOrEqual(key, adjusted_length), &if_unmapped);
+  GotoIf(UintPtrGreaterThanOrEqual(key, elements_length), &if_unmapped);
 
   TNode<Object> mapped_index =
-      LoadFixedArrayElement(elements, IntPtrAdd(key, intptr_two));
+      LoadSloppyArgumentsElementsMappedEntries(elements, key);
   Branch(TaggedEqual(mapped_index, TheHoleConstant()), &if_unmapped,
          &if_mapped);
 
   BIND(&if_mapped);
   {
     TNode<IntPtrT> mapped_index_intptr = SmiUntag(CAST(mapped_index));
-    TNode<Context> the_context = CAST(LoadFixedArrayElement(elements, 0));
+    TNode<Context> the_context = LoadSloppyArgumentsElementsContext(elements);
     if (access_mode == ArgumentsAccessMode::kLoad) {
       TNode<Object> result =
           LoadContextElement(the_context, mapped_index_intptr);
@@ -151,38 +124,33 @@ TNode<Object> HandlerBuiltinsAssembler::EmitKeyedSloppyArguments(
   BIND(&if_unmapped);
   {
     TNode<HeapObject> backing_store_ho =
-        CAST(LoadFixedArrayElement(elements, 1));
+        LoadSloppyArgumentsElementsArguments(elements);
     GotoIf(TaggedNotEqual(LoadMap(backing_store_ho), FixedArrayMapConstant()),
            bailout);
     TNode<FixedArray> backing_store = CAST(backing_store_ho);
 
     TNode<IntPtrT> backing_store_length =
         LoadAndUntagFixedArrayBaseLength(backing_store);
-    if (access_mode == ArgumentsAccessMode::kHas) {
-      Label out_of_bounds(this);
-      GotoIf(UintPtrGreaterThanOrEqual(key, backing_store_length),
-             &out_of_bounds);
-      TNode<Object> result = LoadFixedArrayElement(backing_store, key);
-      var_result =
-          SelectBooleanConstant(TaggedNotEqual(result, TheHoleConstant()));
-      Goto(&end);
-
-      BIND(&out_of_bounds);
-      var_result = FalseConstant();
-      Goto(&end);
+
+    // Out-of-bounds access may involve prototype chain walk and is handled
+    // in runtime.
+    GotoIf(UintPtrGreaterThanOrEqual(key, backing_store_length), bailout);
+
+    // The key falls into unmapped range.
+    if (access_mode == ArgumentsAccessMode::kStore) {
+      StoreFixedArrayElement(backing_store, key, *value);
     } else {
-      GotoIf(UintPtrGreaterThanOrEqual(key, backing_store_length), bailout);
+      TNode<Object> value = LoadFixedArrayElement(backing_store, key);
+      GotoIf(TaggedEqual(value, TheHoleConstant()), bailout);
 
-      // The key falls into unmapped range.
-      if (access_mode == ArgumentsAccessMode::kLoad) {
-        TNode<Object> result = LoadFixedArrayElement(backing_store, key);
-        GotoIf(TaggedEqual(result, TheHoleConstant()), bailout);
-        var_result = result;
+      if (access_mode == ArgumentsAccessMode::kHas) {
+        var_result = TrueConstant();
       } else {
-        StoreFixedArrayElement(backing_store, key, *value);
+        DCHECK_EQ(access_mode, ArgumentsAccessMode::kLoad);
+        var_result = value;
       }
-      Goto(&end);
     }
+    Goto(&end);
   }
 
   BIND(&end);
diff --git a/deps/v8/src/builtins/builtins-internal-gen.cc b/deps/v8/src/builtins/builtins-internal-gen.cc
index 6f4f54656d6..214f94802f3 100644
--- a/deps/v8/src/builtins/builtins-internal-gen.cc
+++ b/deps/v8/src/builtins/builtins-internal-gen.cc
@@ -7,7 +7,8 @@
 #include "src/builtins/builtins.h"
 #include "src/codegen/code-stub-assembler.h"
 #include "src/codegen/macro-assembler.h"
-#include "src/heap/heap-inl.h"  // crbug.com/v8/8499
+#include "src/execution/frame-constants.h"
+#include "src/heap/memory-chunk.h"
 #include "src/ic/accessor-assembler.h"
 #include "src/ic/keyed-store-generic.h"
 #include "src/logging/counters.h"
@@ -71,7 +72,7 @@ TF_BUILTIN(GrowFastSmiOrObjectElements, CodeStubAssembler) {
 }
 
 TF_BUILTIN(NewArgumentsElements, CodeStubAssembler) {
-  TNode<IntPtrT> frame = UncheckedCast<IntPtrT>(Parameter(Descriptor::kFrame));
+  TNode<RawPtrT> frame = UncheckedCast<RawPtrT>(Parameter(Descriptor::kFrame));
   TNode<IntPtrT> length = SmiToIntPtr(Parameter(Descriptor::kLength));
   TNode<IntPtrT> mapped_count =
       SmiToIntPtr(Parameter(Descriptor::kMappedCount));
@@ -126,10 +127,8 @@ TF_BUILTIN(NewArgumentsElements, CodeStubAssembler) {
       }
       BIND(&done_loop1);
 
-      // Compute the effective {offset} into the {frame}.
-      TNode<IntPtrT> offset = IntPtrAdd(length, IntPtrConstant(1));
-
       // Copy the parameters from {frame} (starting at {offset}) to {result}.
+      CodeStubArguments args(this, length, frame);
       Label loop2(this, &var_index), done_loop2(this);
       Goto(&loop2);
       BIND(&loop2);
@@ -141,9 +140,7 @@ TF_BUILTIN(NewArgumentsElements, CodeStubAssembler) {
         GotoIf(IntPtrEqual(index, length), &done_loop2);
 
         // Load the parameter at the given {index}.
-        TNode<Object> value = BitcastWordToTagged(
-            Load(MachineType::Pointer(), frame,
-                 TimesSystemPointerSize(IntPtrSub(offset, index))));
+        TNode<Object> value = args.AtIndex(index);
 
         // Store the {value} into the {result}.
         StoreFixedArrayElement(result, index, value, SKIP_WRITE_BARRIER);
@@ -220,9 +217,9 @@ class RecordWriteCodeStubAssembler : public CodeStubAssembler {
 
   TNode<BoolT> IsPageFlagSet(TNode<IntPtrT> object, int mask) {
     TNode<IntPtrT> page = PageFromAddress(object);
-    TNode<IntPtrT> flags =
-        UncheckedCast<IntPtrT>(Load(MachineType::Pointer(), page,
-                                    IntPtrConstant(MemoryChunk::kFlagsOffset)));
+    TNode<IntPtrT> flags = UncheckedCast<IntPtrT>(
+        Load(MachineType::Pointer(), page,
+             IntPtrConstant(BasicMemoryChunk::kFlagsOffset)));
     return WordNotEqual(WordAnd(flags, IntPtrConstant(mask)),
                         IntPtrConstant(0));
   }
@@ -241,8 +238,8 @@ class RecordWriteCodeStubAssembler : public CodeStubAssembler {
   void GetMarkBit(TNode<IntPtrT> object, TNode<IntPtrT>* cell,
                   TNode<IntPtrT>* mask) {
     TNode<IntPtrT> page = PageFromAddress(object);
-    TNode<IntPtrT> bitmap =
-        Load<IntPtrT>(page, IntPtrConstant(MemoryChunk::kMarkBitmapOffset));
+    TNode<IntPtrT> bitmap = Load<IntPtrT>(
+        page, IntPtrConstant(BasicMemoryChunk::kMarkBitmapOffset));
 
     {
       // Temp variable to calculate cell offset in bitmap.
diff --git a/deps/v8/src/builtins/builtins-intl.cc b/deps/v8/src/builtins/builtins-intl.cc
index 3b624af91b1..7c8cde70dd8 100644
--- a/deps/v8/src/builtins/builtins-intl.cc
+++ b/deps/v8/src/builtins/builtins-intl.cc
@@ -604,23 +604,35 @@ BUILTIN(ListFormatSupportedLocalesOf) {
                    JSListFormat::GetAvailableLocales(), locales, options));
 }
 
-namespace {
+// Intl.Locale implementation
+BUILTIN(LocaleConstructor) {
+  HandleScope scope(isolate);
+
+  isolate->CountUsage(v8::Isolate::UseCounterFeature::kLocale);
+
+  if (args.new_target()->IsUndefined(isolate)) {  // [[Call]]
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kConstructorNotFunction,
+                              isolate->factory()->NewStringFromAsciiChecked(
+                                  "Intl.Locale")));
+  }
+  // [[Construct]]
+  Handle<JSFunction> target = args.target();
+  Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
+
+  Handle<Object> tag = args.atOrUndefined(isolate, 1);
+  Handle<Object> options = args.atOrUndefined(isolate, 2);
 
-MaybeHandle<JSLocale> CreateLocale(Isolate* isolate,
-                                   Handle<JSFunction> constructor,
-                                   Handle<JSReceiver> new_target,
-                                   Handle<Object> tag, Handle<Object> options) {
   Handle<Map> map;
   // 6. Let locale be ? OrdinaryCreateFromConstructor(NewTarget,
   // %LocalePrototype%, internalSlotsList).
-  ASSIGN_RETURN_ON_EXCEPTION(
-      isolate, map, JSFunction::GetDerivedMap(isolate, constructor, new_target),
-      JSLocale);
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, map, JSFunction::GetDerivedMap(isolate, target, new_target));
 
   // 7. If Type(tag) is not String or Object, throw a TypeError exception.
   if (!tag->IsString() && !tag->IsJSReceiver()) {
-    THROW_NEW_ERROR(isolate, NewTypeError(MessageTemplate::kLocaleNotEmpty),
-                    JSLocale);
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kLocaleNotEmpty));
   }
 
   Handle<String> locale_string;
@@ -631,8 +643,8 @@ MaybeHandle<JSLocale> CreateLocale(Isolate* isolate,
     locale_string = JSLocale::ToString(isolate, Handle<JSLocale>::cast(tag));
   } else {  // 9. Else,
     // a. Let tag be ? ToString(tag).
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, locale_string,
-                               Object::ToString(isolate, tag), JSLocale);
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, locale_string,
+                                       Object::ToString(isolate, tag));
   }
 
   Handle<JSReceiver> options_object;
@@ -642,60 +654,24 @@ MaybeHandle<JSLocale> CreateLocale(Isolate* isolate,
     options_object = isolate->factory()->NewJSObjectWithNullProto();
   } else {  // 11. Else
     // a. Let options be ? ToObject(options).
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, options_object,
-                               Object::ToObject(isolate, options), JSLocale);
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, options_object,
+                                       Object::ToObject(isolate, options));
   }
 
-  return JSLocale::New(isolate, map, locale_string, options_object);
-}
-
-}  // namespace
-
-// Intl.Locale implementation
-BUILTIN(LocaleConstructor) {
-  HandleScope scope(isolate);
-
-  isolate->CountUsage(v8::Isolate::UseCounterFeature::kLocale);
-
-  if (args.new_target()->IsUndefined(isolate)) {  // [[Call]]
-    THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate, NewTypeError(MessageTemplate::kConstructorNotFunction,
-                              isolate->factory()->NewStringFromAsciiChecked(
-                                  "Intl.Locale")));
-  }
-  // [[Construct]]
-  Handle<JSFunction> target = args.target();
-  Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
-
-  Handle<Object> tag = args.atOrUndefined(isolate, 1);
-  Handle<Object> options = args.atOrUndefined(isolate, 2);
-
   RETURN_RESULT_OR_FAILURE(
-      isolate, CreateLocale(isolate, target, new_target, tag, options));
+      isolate, JSLocale::New(isolate, map, locale_string, options_object));
 }
 
 BUILTIN(LocalePrototypeMaximize) {
   HandleScope scope(isolate);
   CHECK_RECEIVER(JSLocale, locale, "Intl.Locale.prototype.maximize");
-  Handle<JSFunction> constructor(
-      isolate->native_context()->intl_locale_function(), isolate);
-  Handle<String> locale_str = JSLocale::ToString(isolate, locale);
-  RETURN_RESULT_OR_FAILURE(
-      isolate, CreateLocale(isolate, constructor, constructor,
-                            JSLocale::Maximize(isolate, *locale_str),
-                            isolate->factory()->NewJSObjectWithNullProto()));
+  RETURN_RESULT_OR_FAILURE(isolate, JSLocale::Maximize(isolate, locale));
 }
 
 BUILTIN(LocalePrototypeMinimize) {
   HandleScope scope(isolate);
   CHECK_RECEIVER(JSLocale, locale, "Intl.Locale.prototype.minimize");
-  Handle<JSFunction> constructor(
-      isolate->native_context()->intl_locale_function(), isolate);
-  Handle<String> locale_str = JSLocale::ToString(isolate, locale);
-  RETURN_RESULT_OR_FAILURE(
-      isolate, CreateLocale(isolate, constructor, constructor,
-                            JSLocale::Minimize(isolate, *locale_str),
-                            isolate->factory()->NewJSObjectWithNullProto()));
+  RETURN_RESULT_OR_FAILURE(isolate, JSLocale::Minimize(isolate, locale));
 }
 
 BUILTIN(RelativeTimeFormatSupportedLocalesOf) {
diff --git a/deps/v8/src/builtins/builtins-iterator-gen.cc b/deps/v8/src/builtins/builtins-iterator-gen.cc
index 94a79d2a32c..9f3ec5c3234 100644
--- a/deps/v8/src/builtins/builtins-iterator-gen.cc
+++ b/deps/v8/src/builtins/builtins-iterator-gen.cc
@@ -133,59 +133,34 @@ TNode<Object> IteratorBuiltinsAssembler::IteratorValue(
   return var_value.value();
 }
 
-void IteratorBuiltinsAssembler::IteratorCloseOnException(
-    TNode<Context> context, const IteratorRecord& iterator, Label* if_exception,
-    TVariable<Object>* exception) {
-  // Perform ES #sec-iteratorclose when an exception occurs. This simpler
-  // algorithm does not include redundant steps which are never reachable from
-  // the spec IteratorClose algorithm.
-  DCHECK((if_exception != nullptr && exception != nullptr));
-  CSA_ASSERT(this, IsNotTheHole(exception->value()));
-  CSA_ASSERT(this, IsJSReceiver(iterator.object));
-
-  // Let return be ? GetMethod(iterator, "return").
-  TNode<Object> method;
-  {
-    compiler::ScopedExceptionHandler handler(this, if_exception, exception);
-    method = GetProperty(context, iterator.object, factory()->return_string());
-  }
-
-  // If return is undefined, return Completion(completion).
-  GotoIf(Word32Or(IsUndefined(method), IsNull(method)), if_exception);
-
-  {
-    // Let innerResult be Call(return, iterator, « »).
-    // If an exception occurs, the original exception remains bound.
-    compiler::ScopedExceptionHandler handler(this, if_exception, nullptr);
-    Call(context, method, iterator.object);
-  }
-
-  // (If completion.[[Type]] is throw) return Completion(completion).
-  Goto(if_exception);
+TNode<JSArray> IteratorBuiltinsAssembler::IterableToList(
+    TNode<Context> context, TNode<Object> iterable, TNode<Object> iterator_fn) {
+  GrowableFixedArray values(state());
+  FillFixedArrayFromIterable(context, iterable, iterator_fn, &values);
+  return values.ToJSArray(context);
 }
 
-void IteratorBuiltinsAssembler::IteratorCloseOnException(
-    TNode<Context> context, const IteratorRecord& iterator,
-    TNode<Object> exception) {
-  Label rethrow(this, Label::kDeferred);
-  TVARIABLE(Object, exception_variable, exception);
-  IteratorCloseOnException(context, iterator, &rethrow, &exception_variable);
-
-  BIND(&rethrow);
-  CallRuntime(Runtime::kReThrow, context, exception_variable.value());
-  Unreachable();
+TNode<FixedArray> IteratorBuiltinsAssembler::IterableToFixedArray(
+    TNode<Context> context, TNode<Object> iterable, TNode<Object> iterator_fn) {
+  GrowableFixedArray values(state());
+  FillFixedArrayFromIterable(context, iterable, iterator_fn, &values);
+  TNode<FixedArray> new_array = values.ToFixedArray();
+  return new_array;
 }
 
-TNode<JSArray> IteratorBuiltinsAssembler::IterableToList(
-    TNode<Context> context, TNode<Object> iterable, TNode<Object> iterator_fn) {
+void IteratorBuiltinsAssembler::FillFixedArrayFromIterable(
+    TNode<Context> context, TNode<Object> iterable, TNode<Object> iterator_fn,
+    GrowableFixedArray* values) {
   // 1. Let iteratorRecord be ? GetIterator(items, method).
   IteratorRecord iterator_record = GetIterator(context, iterable, iterator_fn);
 
   // 2. Let values be a new empty List.
-  GrowableFixedArray values(state());
 
-  Label loop_start(
-      this, {values.var_array(), values.var_length(), values.var_capacity()}),
+  // The GrowableFixedArray has already been created. It's ok if we do this step
+  // out of order, since creating an empty List is not observable.
+
+  Label loop_start(this, {values->var_array(), values->var_length(),
+                          values->var_capacity()}),
       done(this);
   Goto(&loop_start);
   // 3. Let next be true.
@@ -198,12 +173,11 @@ TNode<JSArray> IteratorBuiltinsAssembler::IterableToList(
     //   i. Let nextValue be ? IteratorValue(next).
     TNode<Object> next_value = IteratorValue(context, next);
     //   ii. Append nextValue to the end of the List values.
-    values.Push(next_value);
+    values->Push(next_value);
     Goto(&loop_start);
   }
 
   BIND(&done);
-  return values.ToJSArray(context);
 }
 
 TF_BUILTIN(IterableToList, IteratorBuiltinsAssembler) {
@@ -214,31 +188,26 @@ TF_BUILTIN(IterableToList, IteratorBuiltinsAssembler) {
   Return(IterableToList(context, iterable, iterator_fn));
 }
 
+TF_BUILTIN(IterableToFixedArray, IteratorBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> iterable = CAST(Parameter(Descriptor::kIterable));
+  TNode<Object> iterator_fn = CAST(Parameter(Descriptor::kIteratorFn));
+
+  Return(IterableToFixedArray(context, iterable, iterator_fn));
+}
+
 TF_BUILTIN(IterableToFixedArrayForWasm, IteratorBuiltinsAssembler) {
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> iterable = CAST(Parameter(Descriptor::kIterable));
   TNode<Smi> expected_length = CAST(Parameter(Descriptor::kExpectedLength));
 
   TNode<Object> iterator_fn = GetIteratorMethod(context, iterable);
-
-  IteratorRecord iterator_record = GetIterator(context, iterable, iterator_fn);
-
   GrowableFixedArray values(state());
 
-  Label loop_start(
-      this, {values.var_array(), values.var_length(), values.var_capacity()}),
-      compare_length(this), done(this);
-  Goto(&loop_start);
-  BIND(&loop_start);
-  {
-    TNode<JSReceiver> next =
-        IteratorStep(context, iterator_record, &compare_length);
-    TNode<Object> next_value = IteratorValue(context, next);
-    values.Push(next_value);
-    Goto(&loop_start);
-  }
+  Label done(this);
+
+  FillFixedArrayFromIterable(context, iterable, iterator_fn, &values);
 
-  BIND(&compare_length);
   GotoIf(WordEqual(SmiUntag(expected_length), values.var_length()->value()),
          &done);
   Return(CallRuntime(
@@ -299,7 +268,9 @@ TNode<JSArray> IteratorBuiltinsAssembler::StringListFromIterable(
 
       // 2. Return ? IteratorClose(iteratorRecord, error).
       BIND(&if_exception);
-      IteratorCloseOnException(context, iterator_record, var_exception.value());
+      IteratorCloseOnException(context, iterator_record);
+      CallRuntime(Runtime::kReThrow, context, var_exception.value());
+      Unreachable();
     }
   }
 
@@ -452,5 +423,17 @@ TF_BUILTIN(GetIteratorWithFeedbackLazyDeoptContinuation,
   Return(result);
 }
 
+// This builtin creates a FixedArray based on an Iterable and doesn't have a
+// fast path for anything.
+TF_BUILTIN(IterableToFixedArrayWithSymbolLookupSlow,
+           IteratorBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> iterable = CAST(Parameter(Descriptor::kIterable));
+
+  TNode<Object> iterator_fn = GetIteratorMethod(context, iterable);
+  TailCallBuiltin(Builtins::kIterableToFixedArray, context, iterable,
+                  iterator_fn);
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-iterator-gen.h b/deps/v8/src/builtins/builtins-iterator-gen.h
index 4d496fa3841..6cea2c77ff4 100644
--- a/deps/v8/src/builtins/builtins-iterator-gen.h
+++ b/deps/v8/src/builtins/builtins-iterator-gen.h
@@ -12,6 +12,8 @@ namespace internal {
 
 using compiler::Node;
 
+class GrowableFixedArray;
+
 class IteratorBuiltinsAssembler : public CodeStubAssembler {
  public:
   explicit IteratorBuiltinsAssembler(compiler::CodeAssemblerState* state)
@@ -50,21 +52,21 @@ class IteratorBuiltinsAssembler : public CodeStubAssembler {
       TNode<Context> context, TNode<JSReceiver> result,
       base::Optional<TNode<Map>> fast_iterator_result_map = base::nullopt);
 
-  // https://tc39.github.io/ecma262/#sec-iteratorclose
-  void IteratorCloseOnException(TNode<Context> context,
-                                const IteratorRecord& iterator,
-                                Label* if_exception,
-                                TVariable<Object>* exception);
-  void IteratorCloseOnException(TNode<Context> context,
-                                const IteratorRecord& iterator,
-                                TNode<Object> exception);
-
   // #sec-iterabletolist
   // Build a JSArray by iterating over {iterable} using {iterator_fn},
   // following the ECMAscript operation with the same name.
   TNode<JSArray> IterableToList(TNode<Context> context, TNode<Object> iterable,
                                 TNode<Object> iterator_fn);
 
+  TNode<FixedArray> IterableToFixedArray(TNode<Context> context,
+                                         TNode<Object> iterable,
+                                         TNode<Object> iterator_fn);
+
+  void FillFixedArrayFromIterable(TNode<Context> context,
+                                  TNode<Object> iterable,
+                                  TNode<Object> iterator_fn,
+                                  GrowableFixedArray* values);
+
   // Currently at https://tc39.github.io/proposal-intl-list-format/
   // #sec-createstringlistfromiterable
   TNode<JSArray> StringListFromIterable(TNode<Context> context,
diff --git a/deps/v8/src/builtins/builtins-microtask-queue-gen.cc b/deps/v8/src/builtins/builtins-microtask-queue-gen.cc
index 917255f9bb3..e613ae9c08c 100644
--- a/deps/v8/src/builtins/builtins-microtask-queue-gen.cc
+++ b/deps/v8/src/builtins/builtins-microtask-queue-gen.cc
@@ -53,8 +53,8 @@ class MicrotaskQueueBuiltinsAssembler : public CodeStubAssembler {
 TNode<RawPtrT> MicrotaskQueueBuiltinsAssembler::GetMicrotaskQueue(
     TNode<Context> native_context) {
   CSA_ASSERT(this, IsNativeContext(native_context));
-  return LoadObjectField<RawPtrT>(native_context,
-                                  NativeContext::kMicrotaskQueueOffset);
+  return DecodeExternalPointer(LoadObjectField<ExternalPointerT>(
+      native_context, NativeContext::kMicrotaskQueueOffset));
 }
 
 TNode<RawPtrT> MicrotaskQueueBuiltinsAssembler::GetMicrotaskRingBuffer(
@@ -320,7 +320,7 @@ void MicrotaskQueueBuiltinsAssembler::RunSingleMicrotask(
   BIND(&if_exception);
   {
     // Report unhandled exceptions from microtasks.
-    CallRuntime(Runtime::kReportMessage, current_context,
+    CallRuntime(Runtime::kReportMessageFromMicrotask, current_context,
                 var_exception.value());
     RewindEnteredContext(saved_entered_context_count);
     SetCurrentContext(current_context);
diff --git a/deps/v8/src/builtins/builtins-number-gen.cc b/deps/v8/src/builtins/builtins-number-gen.cc
index 4513d73abc7..4e8bcae60be 100644
--- a/deps/v8/src/builtins/builtins-number-gen.cc
+++ b/deps/v8/src/builtins/builtins-number-gen.cc
@@ -6,6 +6,7 @@
 #include "src/builtins/builtins.h"
 #include "src/codegen/code-stub-assembler.h"
 #include "src/ic/binary-op-assembler.h"
+#include "src/ic/unary-op-assembler.h"
 
 namespace v8 {
 namespace internal {
@@ -13,983 +14,108 @@ namespace internal {
 // -----------------------------------------------------------------------------
 // ES6 section 20.1 Number Objects
 
-class NumberBuiltinsAssembler : public CodeStubAssembler {
- public:
-  explicit NumberBuiltinsAssembler(compiler::CodeAssemblerState* state)
-      : CodeStubAssembler(state) {}
-
- protected:
-  template <typename Descriptor>
-  void EmitBitwiseOp(Operation op) {
-    TNode<Object> left = CAST(Parameter(Descriptor::kLeft));
-    TNode<Object> right = CAST(Parameter(Descriptor::kRight));
-    TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-    BinaryOpAssembler binop_asm(state());
-    Return(binop_asm.Generate_BitwiseBinaryOp(op, left, right, context));
-  }
-
-  template <typename Descriptor>
-  void RelationalComparisonBuiltin(Operation op) {
-    TNode<Object> lhs = CAST(Parameter(Descriptor::kLeft));
-    TNode<Object> rhs = CAST(Parameter(Descriptor::kRight));
-    TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-    Return(RelationalComparison(op, lhs, rhs, context));
-  }
-
-  template <typename Descriptor>
-  void UnaryOp(TVariable<Object>* var_input, Label* do_smi, Label* do_double,
-               TVariable<Float64T>* var_input_double, Label* do_bigint);
-
-  template <typename Descriptor>
-  void BinaryOp(Label* smis, TVariable<Object>* var_left,
-                TVariable<Object>* var_right, Label* doubles,
-                TVariable<Float64T>* var_left_double,
-                TVariable<Float64T>* var_right_double, Label* bigints);
-};
-
-// ES6 #sec-number.isfinite
-TF_BUILTIN(NumberIsFinite, CodeStubAssembler) {
-  TNode<Object> number = CAST(Parameter(Descriptor::kNumber));
-
-  Label return_true(this), return_false(this);
-
-  // Check if {number} is a Smi.
-  GotoIf(TaggedIsSmi(number), &return_true);
-
-  // Check if {number} is a HeapNumber.
-  TNode<HeapObject> number_heap_object = CAST(number);
-  GotoIfNot(IsHeapNumber(number_heap_object), &return_false);
-
-  // Check if {number} contains a finite, non-NaN value.
-  TNode<Float64T> number_value = LoadHeapNumberValue(number_heap_object);
-  BranchIfFloat64IsNaN(Float64Sub(number_value, number_value), &return_false,
-                       &return_true);
-
-  BIND(&return_true);
-  Return(TrueConstant());
-
-  BIND(&return_false);
-  Return(FalseConstant());
-}
-
-TF_BUILTIN(AllocateHeapNumber, CodeStubAssembler) {
-  TNode<HeapNumber> result = AllocateHeapNumber();
-  Return(result);
-}
-
-// ES6 #sec-number.isinteger
-TF_BUILTIN(NumberIsInteger, CodeStubAssembler) {
-  TNode<Object> number = CAST(Parameter(Descriptor::kNumber));
-  Return(SelectBooleanConstant(IsInteger(number)));
-}
-
-// ES6 #sec-number.isnan
-TF_BUILTIN(NumberIsNaN, CodeStubAssembler) {
-  TNode<Object> number = CAST(Parameter(Descriptor::kNumber));
-
-  Label return_true(this), return_false(this);
-
-  // Check if {number} is a Smi.
-  GotoIf(TaggedIsSmi(number), &return_false);
-
-  // Check if {number} is a HeapNumber.
-  TNode<HeapObject> number_heap_object = CAST(number);
-  GotoIfNot(IsHeapNumber(number_heap_object), &return_false);
-
-  // Check if {number} contains a NaN value.
-  TNode<Float64T> number_value = LoadHeapNumberValue(number_heap_object);
-  BranchIfFloat64IsNaN(number_value, &return_true, &return_false);
-
-  BIND(&return_true);
-  Return(TrueConstant());
-
-  BIND(&return_false);
-  Return(FalseConstant());
-}
-
-// ES6 #sec-number.issafeinteger
-TF_BUILTIN(NumberIsSafeInteger, CodeStubAssembler) {
-  TNode<Object> number = CAST(Parameter(Descriptor::kNumber));
-  Return(SelectBooleanConstant(IsSafeInteger(number)));
-}
-
-// ES6 #sec-number.parsefloat
-TF_BUILTIN(NumberParseFloat, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  // We might need to loop once for ToString conversion.
-  TVARIABLE(Object, var_input, CAST(Parameter(Descriptor::kString)));
-  Label loop(this, &var_input);
-  Goto(&loop);
-  BIND(&loop);
-  {
-    // Load the current {input} value.
-    TNode<Object> input = var_input.value();
-
-    // Check if the {input} is a HeapObject or a Smi.
-    Label if_inputissmi(this), if_inputisnotsmi(this);
-    Branch(TaggedIsSmi(input), &if_inputissmi, &if_inputisnotsmi);
-
-    BIND(&if_inputissmi);
-    {
-      // The {input} is already a Number, no need to do anything.
-      Return(input);
-    }
-
-    BIND(&if_inputisnotsmi);
-    {
-      // The {input} is a HeapObject, check if it's already a String.
-      TNode<HeapObject> input_heap_object = CAST(input);
-      Label if_inputisstring(this), if_inputisnotstring(this);
-      TNode<Map> input_map = LoadMap(input_heap_object);
-      TNode<Uint16T> input_instance_type = LoadMapInstanceType(input_map);
-      Branch(IsStringInstanceType(input_instance_type), &if_inputisstring,
-             &if_inputisnotstring);
-
-      BIND(&if_inputisstring);
-      {
-        // The {input} is already a String, check if {input} contains
-        // a cached array index.
-        Label if_inputcached(this), if_inputnotcached(this);
-        TNode<Uint32T> input_hash = LoadNameHashField(CAST(input));
-        Branch(IsClearWord32(input_hash,
-                             Name::kDoesNotContainCachedArrayIndexMask),
-               &if_inputcached, &if_inputnotcached);
-
-        BIND(&if_inputcached);
-        {
-          // Just return the {input}s cached array index.
-          TNode<UintPtrT> input_array_index =
-              DecodeWordFromWord32<String::ArrayIndexValueBits>(input_hash);
-          Return(SmiTag(Signed(input_array_index)));
-        }
-
-        BIND(&if_inputnotcached);
-        {
-          // Need to fall back to the runtime to convert {input} to double.
-          Return(CallRuntime(Runtime::kStringParseFloat, context, input));
-        }
-      }
-
-      BIND(&if_inputisnotstring);
-      {
-        // The {input} is neither a String nor a Smi, check for HeapNumber.
-        Label if_inputisnumber(this),
-            if_inputisnotnumber(this, Label::kDeferred);
-        Branch(IsHeapNumberMap(input_map), &if_inputisnumber,
-               &if_inputisnotnumber);
-
-        BIND(&if_inputisnumber);
-        {
-          // The {input} is already a Number, take care of -0.
-          Label if_inputiszero(this), if_inputisnotzero(this);
-          TNode<Float64T> input_value = LoadHeapNumberValue(input_heap_object);
-          Branch(Float64Equal(input_value, Float64Constant(0.0)),
-                 &if_inputiszero, &if_inputisnotzero);
-
-          BIND(&if_inputiszero);
-          Return(SmiConstant(0));
-
-          BIND(&if_inputisnotzero);
-          Return(input);
-        }
-
-        BIND(&if_inputisnotnumber);
-        {
-          // Need to convert the {input} to String first.
-          // TODO(bmeurer): This could be more efficient if necessary.
-          var_input = CallBuiltin(Builtins::kToString, context, input);
-          Goto(&loop);
-        }
-      }
-    }
-  }
-}
-
-// ES6 #sec-number.parseint
-TF_BUILTIN(ParseInt, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> input = CAST(Parameter(Descriptor::kString));
-  TNode<Object> radix = CAST(Parameter(Descriptor::kRadix));
-
-  // Check if {radix} is treated as 10 (i.e. undefined, 0 or 10).
-  Label if_radix10(this), if_generic(this, Label::kDeferred);
-  GotoIf(IsUndefined(radix), &if_radix10);
-  GotoIf(TaggedEqual(radix, SmiConstant(10)), &if_radix10);
-  GotoIf(TaggedEqual(radix, SmiConstant(0)), &if_radix10);
-  Goto(&if_generic);
-
-  BIND(&if_radix10);
-  {
-    // Check if we can avoid the ToString conversion on {input}.
-    Label if_inputissmi(this), if_inputisheapnumber(this),
-        if_inputisstring(this);
-    GotoIf(TaggedIsSmi(input), &if_inputissmi);
-    TNode<Map> input_map = LoadMap(CAST(input));
-    GotoIf(IsHeapNumberMap(input_map), &if_inputisheapnumber);
-    TNode<Uint16T> input_instance_type = LoadMapInstanceType(input_map);
-    Branch(IsStringInstanceType(input_instance_type), &if_inputisstring,
-           &if_generic);
-
-    BIND(&if_inputissmi);
-    {
-      // Just return the {input}.
-      Return(input);
-    }
-
-    BIND(&if_inputisheapnumber);
-    {
-      // Check if the {input} value is in Signed32 range.
-      Label if_inputissigned32(this);
-      TNode<Float64T> input_value = LoadHeapNumberValue(CAST(input));
-      TNode<Int32T> input_value32 =
-          Signed(TruncateFloat64ToWord32(input_value));
-      GotoIf(Float64Equal(input_value, ChangeInt32ToFloat64(input_value32)),
-             &if_inputissigned32);
-
-      // Check if the absolute {input} value is in the [1,1<<31[ range.
-      // Take the generic path for the range [0,1[ because the result
-      // could be -0.
-      TNode<Float64T> input_value_abs = Float64Abs(input_value);
-
-      GotoIfNot(Float64LessThan(input_value_abs, Float64Constant(1u << 31)),
-                &if_generic);
-      Branch(Float64LessThanOrEqual(Float64Constant(1), input_value_abs),
-             &if_inputissigned32, &if_generic);
-
-      // Return the truncated int32 value, and return the tagged result.
-      BIND(&if_inputissigned32);
-      TNode<Number> result = ChangeInt32ToTagged(input_value32);
-      Return(result);
-    }
-
-    BIND(&if_inputisstring);
-    {
-      // Check if the String {input} has a cached array index.
-      TNode<Uint32T> input_hash = LoadNameHashField(CAST(input));
-      GotoIf(IsSetWord32(input_hash, Name::kDoesNotContainCachedArrayIndexMask),
-             &if_generic);
-
-      // Return the cached array index as result.
-      TNode<UintPtrT> input_index =
-          DecodeWordFromWord32<String::ArrayIndexValueBits>(input_hash);
-      TNode<Smi> result = SmiTag(Signed(input_index));
-      Return(result);
-    }
-  }
-
-  BIND(&if_generic);
-  {
-    TNode<Object> result =
-        CallRuntime(Runtime::kStringParseInt, context, input, radix);
-    Return(result);
-  }
-}
-
-// ES6 #sec-number.parseint
-TF_BUILTIN(NumberParseInt, CodeStubAssembler) {
+#define DEF_BINOP(Name, Generator)                                            \
+  TF_BUILTIN(Name, CodeStubAssembler) {                                       \
+    TNode<Object> lhs = CAST(Parameter(Descriptor::kLeft));                   \
+    TNode<Object> rhs = CAST(Parameter(Descriptor::kRight));                  \
+    TNode<Context> context = CAST(Parameter(Descriptor::kContext));           \
+    TNode<HeapObject> maybe_feedback_vector =                                 \
+        CAST(Parameter(Descriptor::kMaybeFeedbackVector));                    \
+    TNode<UintPtrT> slot =                                                    \
+        UncheckedCast<UintPtrT>(Parameter(Descriptor::kSlot));                \
+                                                                              \
+    BinaryOpAssembler binop_asm(state());                                     \
+    TNode<Object> result = binop_asm.Generator(context, lhs, rhs, slot,       \
+                                               maybe_feedback_vector, false); \
+                                                                              \
+    Return(result);                                                           \
+  }
+DEF_BINOP(Add_WithFeedback, Generate_AddWithFeedback)
+DEF_BINOP(Subtract_WithFeedback, Generate_SubtractWithFeedback)
+DEF_BINOP(Multiply_WithFeedback, Generate_MultiplyWithFeedback)
+DEF_BINOP(Divide_WithFeedback, Generate_DivideWithFeedback)
+DEF_BINOP(Modulus_WithFeedback, Generate_ModulusWithFeedback)
+DEF_BINOP(Exponentiate_WithFeedback, Generate_ExponentiateWithFeedback)
+DEF_BINOP(BitwiseOr_WithFeedback, Generate_BitwiseOrWithFeedback)
+DEF_BINOP(BitwiseXor_WithFeedback, Generate_BitwiseXorWithFeedback)
+DEF_BINOP(BitwiseAnd_WithFeedback, Generate_BitwiseAndWithFeedback)
+DEF_BINOP(ShiftLeft_WithFeedback, Generate_ShiftLeftWithFeedback)
+DEF_BINOP(ShiftRight_WithFeedback, Generate_ShiftRightWithFeedback)
+DEF_BINOP(ShiftRightLogical_WithFeedback,
+          Generate_ShiftRightLogicalWithFeedback)
+#undef DEF_BINOP
+
+#define DEF_UNOP(Name, Generator)                                   \
+  TF_BUILTIN(Name, CodeStubAssembler) {                             \
+    TNode<Object> value = CAST(Parameter(Descriptor::kValue));      \
+    TNode<Context> context = CAST(Parameter(Descriptor::kContext)); \
+    TNode<HeapObject> maybe_feedback_vector =                       \
+        CAST(Parameter(Descriptor::kMaybeFeedbackVector));          \
+    TNode<UintPtrT> slot =                                          \
+        UncheckedCast<UintPtrT>(Parameter(Descriptor::kSlot));      \
+                                                                    \
+    UnaryOpAssembler a(state());                                    \
+    TNode<Object> result =                                          \
+        a.Generator(context, value, slot, maybe_feedback_vector);   \
+                                                                    \
+    Return(result);                                                 \
+  }
+DEF_UNOP(BitwiseNot_WithFeedback, Generate_BitwiseNotWithFeedback)
+DEF_UNOP(Decrement_WithFeedback, Generate_DecrementWithFeedback)
+DEF_UNOP(Increment_WithFeedback, Generate_IncrementWithFeedback)
+DEF_UNOP(Negate_WithFeedback, Generate_NegateWithFeedback)
+#undef DEF_UNOP
+
+#define DEF_COMPARE(Name)                                                      \
+  TF_BUILTIN(Name##_WithFeedback, CodeStubAssembler) {                         \
+    TNode<Object> lhs = CAST(Parameter(Descriptor::kLeft));                    \
+    TNode<Object> rhs = CAST(Parameter(Descriptor::kRight));                   \
+    TNode<Context> context = CAST(Parameter(Descriptor::kContext));            \
+    TNode<HeapObject> maybe_feedback_vector =                                  \
+        CAST(Parameter(Descriptor::kMaybeFeedbackVector));                     \
+    TNode<UintPtrT> slot =                                                     \
+        UncheckedCast<UintPtrT>(Parameter(Descriptor::kSlot));                 \
+                                                                               \
+    TVARIABLE(Smi, var_type_feedback);                                         \
+    TNode<Oddball> result = RelationalComparison(Operation::k##Name, lhs, rhs, \
+                                                 context, &var_type_feedback); \
+    UpdateFeedback(var_type_feedback.value(), maybe_feedback_vector, slot);    \
+                                                                               \
+    Return(result);                                                            \
+  }
+DEF_COMPARE(LessThan)
+DEF_COMPARE(LessThanOrEqual)
+DEF_COMPARE(GreaterThan)
+DEF_COMPARE(GreaterThanOrEqual)
+#undef DEF_COMPARE
+
+TF_BUILTIN(Equal_WithFeedback, CodeStubAssembler) {
+  TNode<Object> lhs = CAST(Parameter(Descriptor::kLeft));
+  TNode<Object> rhs = CAST(Parameter(Descriptor::kRight));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> input = CAST(Parameter(Descriptor::kString));
-  TNode<Object> radix = CAST(Parameter(Descriptor::kRadix));
-  Return(CallBuiltin(Builtins::kParseInt, context, input, radix));
-}
+  TNode<HeapObject> maybe_feedback_vector =
+      CAST(Parameter(Descriptor::kMaybeFeedbackVector));
+  TNode<UintPtrT> slot = UncheckedCast<UintPtrT>(Parameter(Descriptor::kSlot));
 
-// ES6 #sec-number.prototype.valueof
-TF_BUILTIN(NumberPrototypeValueOf, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
+  TVARIABLE(Smi, var_type_feedback);
+  TNode<Oddball> result = Equal(lhs, rhs, context, &var_type_feedback);
+  UpdateFeedback(var_type_feedback.value(), maybe_feedback_vector, slot);
 
-  TNode<Object> result = ToThisValue(context, receiver, PrimitiveType::kNumber,
-                                     "Number.prototype.valueOf");
   Return(result);
 }
 
-class AddStubAssembler : public CodeStubAssembler {
- public:
-  explicit AddStubAssembler(compiler::CodeAssemblerState* state)
-      : CodeStubAssembler(state) {}
-
- protected:
-  TNode<Object> ConvertReceiver(TNode<JSReceiver> js_receiver,
-                                TNode<Context> context) {
-    // Call ToPrimitive explicitly without hint (whereas ToNumber
-    // would pass a "number" hint).
-    Callable callable = CodeFactory::NonPrimitiveToPrimitive(isolate());
-    return CallStub(callable, context, js_receiver);
-  }
-
-  void ConvertNonReceiverAndLoop(TVariable<Object>* var_value, Label* loop,
-                                 TNode<Context> context) {
-    *var_value =
-        CallBuiltin(Builtins::kNonNumberToNumeric, context, var_value->value());
-    Goto(loop);
-  }
-
-  void ConvertAndLoop(TVariable<Object>* var_value,
-                      TNode<Uint16T> instance_type, Label* loop,
-                      TNode<Context> context) {
-    Label is_not_receiver(this, Label::kDeferred);
-    GotoIfNot(IsJSReceiverInstanceType(instance_type), &is_not_receiver);
-
-    *var_value = ConvertReceiver(CAST(var_value->value()), context);
-    Goto(loop);
-
-    BIND(&is_not_receiver);
-    ConvertNonReceiverAndLoop(var_value, loop, context);
-  }
-};
-
-TF_BUILTIN(Add, AddStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TVARIABLE(Object, var_left, CAST(Parameter(Descriptor::kLeft)));
-  TVARIABLE(Object, var_right, CAST(Parameter(Descriptor::kRight)));
-
-  // Shared entry for floating point addition.
-  Label do_double_add(this);
-  TVARIABLE(Float64T, var_left_double);
-  TVARIABLE(Float64T, var_right_double);
-
-  // We might need to loop several times due to ToPrimitive, ToString and/or
-  // ToNumeric conversions.
-  Label loop(this, {&var_left, &var_right}),
-      string_add_convert_left(this, Label::kDeferred),
-      string_add_convert_right(this, Label::kDeferred),
-      do_bigint_add(this, Label::kDeferred);
-  Goto(&loop);
-  BIND(&loop);
-  {
-    TNode<Object> left = var_left.value();
-    TNode<Object> right = var_right.value();
-
-    Label if_left_smi(this), if_left_heapobject(this);
-    Branch(TaggedIsSmi(left), &if_left_smi, &if_left_heapobject);
-
-    BIND(&if_left_smi);
-    {
-      Label if_right_smi(this), if_right_heapobject(this);
-      Branch(TaggedIsSmi(right), &if_right_smi, &if_right_heapobject);
-
-      BIND(&if_right_smi);
-      {
-        Label if_overflow(this);
-        TNode<Smi> left_smi = CAST(left);
-        TNode<Smi> right_smi = CAST(right);
-        TNode<Smi> result = TrySmiAdd(left_smi, right_smi, &if_overflow);
-        Return(result);
-
-        BIND(&if_overflow);
-        {
-          var_left_double = SmiToFloat64(left_smi);
-          var_right_double = SmiToFloat64(right_smi);
-          Goto(&do_double_add);
-        }
-      }  // if_right_smi
-
-      BIND(&if_right_heapobject);
-      {
-        TNode<HeapObject> right_heap_object = CAST(right);
-        TNode<Map> right_map = LoadMap(right_heap_object);
-
-        Label if_right_not_number(this, Label::kDeferred);
-        GotoIfNot(IsHeapNumberMap(right_map), &if_right_not_number);
-
-        // {right} is a HeapNumber.
-        var_left_double = SmiToFloat64(CAST(left));
-        var_right_double = LoadHeapNumberValue(right_heap_object);
-        Goto(&do_double_add);
-
-        BIND(&if_right_not_number);
-        {
-          TNode<Uint16T> right_instance_type = LoadMapInstanceType(right_map);
-          GotoIf(IsStringInstanceType(right_instance_type),
-                 &string_add_convert_left);
-          GotoIf(IsBigIntInstanceType(right_instance_type), &do_bigint_add);
-          ConvertAndLoop(&var_right, right_instance_type, &loop, context);
-        }
-      }  // if_right_heapobject
-    }    // if_left_smi
-
-    BIND(&if_left_heapobject);
-    {
-      TNode<HeapObject> left_heap_object = CAST(left);
-      TNode<Map> left_map = LoadMap(left_heap_object);
-      Label if_right_smi(this), if_right_heapobject(this);
-      Branch(TaggedIsSmi(right), &if_right_smi, &if_right_heapobject);
-
-      BIND(&if_right_smi);
-      {
-        Label if_left_not_number(this, Label::kDeferred);
-        GotoIfNot(IsHeapNumberMap(left_map), &if_left_not_number);
-
-        // {left} is a HeapNumber, {right} is a Smi.
-        var_left_double = LoadHeapNumberValue(left_heap_object);
-        var_right_double = SmiToFloat64(CAST(right));
-        Goto(&do_double_add);
-
-        BIND(&if_left_not_number);
-        {
-          TNode<Uint16T> left_instance_type = LoadMapInstanceType(left_map);
-          GotoIf(IsStringInstanceType(left_instance_type),
-                 &string_add_convert_right);
-          GotoIf(IsBigIntInstanceType(left_instance_type), &do_bigint_add);
-          // {left} is neither a Numeric nor a String, and {right} is a Smi.
-          ConvertAndLoop(&var_left, left_instance_type, &loop, context);
-        }
-      }  // if_right_smi
-
-      BIND(&if_right_heapobject);
-      {
-        TNode<HeapObject> right_heap_object = CAST(right);
-        TNode<Map> right_map = LoadMap(right_heap_object);
-
-        Label if_left_number(this), if_left_not_number(this, Label::kDeferred);
-        Branch(IsHeapNumberMap(left_map), &if_left_number, &if_left_not_number);
-
-        BIND(&if_left_number);
-        {
-          Label if_right_not_number(this, Label::kDeferred);
-          GotoIfNot(IsHeapNumberMap(right_map), &if_right_not_number);
-
-          // Both {left} and {right} are HeapNumbers.
-          var_left_double = LoadHeapNumberValue(CAST(left));
-          var_right_double = LoadHeapNumberValue(right_heap_object);
-          Goto(&do_double_add);
-
-          BIND(&if_right_not_number);
-          {
-            TNode<Uint16T> right_instance_type = LoadMapInstanceType(right_map);
-            GotoIf(IsStringInstanceType(right_instance_type),
-                   &string_add_convert_left);
-            GotoIf(IsBigIntInstanceType(right_instance_type), &do_bigint_add);
-            // {left} is a HeapNumber, {right} is neither Number nor String.
-            ConvertAndLoop(&var_right, right_instance_type, &loop, context);
-          }
-        }  // if_left_number
-
-        BIND(&if_left_not_number);
-        {
-          Label if_left_bigint(this);
-          TNode<Uint16T> left_instance_type = LoadMapInstanceType(left_map);
-          GotoIf(IsStringInstanceType(left_instance_type),
-                 &string_add_convert_right);
-          TNode<Uint16T> right_instance_type = LoadMapInstanceType(right_map);
-          GotoIf(IsStringInstanceType(right_instance_type),
-                 &string_add_convert_left);
-          GotoIf(IsBigIntInstanceType(left_instance_type), &if_left_bigint);
-          Label if_left_not_receiver(this, Label::kDeferred);
-          Label if_right_not_receiver(this, Label::kDeferred);
-          GotoIfNot(IsJSReceiverInstanceType(left_instance_type),
-                    &if_left_not_receiver);
-          // {left} is a JSReceiver, convert it first.
-          var_left = ConvertReceiver(CAST(var_left.value()), context);
-          Goto(&loop);
-
-          BIND(&if_left_bigint);
-          {
-            // {right} is a HeapObject, but not a String. Jump to
-            // {do_bigint_add} if {right} is already a Numeric.
-            GotoIf(IsBigIntInstanceType(right_instance_type), &do_bigint_add);
-            GotoIf(IsHeapNumberMap(right_map), &do_bigint_add);
-            ConvertAndLoop(&var_right, right_instance_type, &loop, context);
-          }
-
-          BIND(&if_left_not_receiver);
-          GotoIfNot(IsJSReceiverInstanceType(right_instance_type),
-                    &if_right_not_receiver);
-          // {left} is a Primitive, but {right} is a JSReceiver, so convert
-          // {right} with priority.
-          var_right = ConvertReceiver(CAST(var_right.value()), context);
-          Goto(&loop);
-
-          BIND(&if_right_not_receiver);
-          // Neither {left} nor {right} are JSReceivers.
-          ConvertNonReceiverAndLoop(&var_left, &loop, context);
-        }
-      }  // if_right_heapobject
-    }    // if_left_heapobject
-  }
-  BIND(&string_add_convert_left);
-  {
-    // Convert {left} to a String and concatenate it with the String {right}.
-    TailCallBuiltin(Builtins::kStringAddConvertLeft, context, var_left.value(),
-                    var_right.value());
-  }
-
-  BIND(&string_add_convert_right);
-  {
-    // Convert {right} to a String and concatenate it with the String {left}.
-    TailCallBuiltin(Builtins::kStringAddConvertRight, context, var_left.value(),
-                    var_right.value());
-  }
-
-  BIND(&do_bigint_add);
-  {
-    TailCallBuiltin(Builtins::kBigIntAdd, context, var_left.value(),
-                    var_right.value());
-  }
-
-  BIND(&do_double_add);
-  {
-    TNode<Float64T> value =
-        Float64Add(var_left_double.value(), var_right_double.value());
-    Return(AllocateHeapNumberWithValue(value));
-  }
-}
-
-template <typename Descriptor>
-void NumberBuiltinsAssembler::UnaryOp(TVariable<Object>* var_input,
-                                      Label* do_smi, Label* do_double,
-                                      TVariable<Float64T>* var_input_double,
-                                      Label* do_bigint) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  *var_input = CAST(Parameter(Descriptor::kValue));
-
-  // We might need to loop for ToNumeric conversion.
-  Label loop(this, {var_input});
-  Goto(&loop);
-  BIND(&loop);
-  TNode<Object> input = var_input->value();
-
-  Label not_number(this);
-  GotoIf(TaggedIsSmi(input), do_smi);
-  TNode<HeapObject> input_heap_object = CAST(input);
-  GotoIfNot(IsHeapNumber(input_heap_object), &not_number);
-  if (var_input_double != nullptr) {
-    *var_input_double = LoadHeapNumberValue(input_heap_object);
-  }
-  Goto(do_double);
-
-  BIND(&not_number);
-  GotoIf(IsBigInt(input_heap_object), do_bigint);
-  *var_input = CallBuiltin(Builtins::kNonNumberToNumeric, context, input);
-  Goto(&loop);
-}
-
-template <typename Descriptor>
-void NumberBuiltinsAssembler::BinaryOp(Label* smis, TVariable<Object>* var_left,
-                                       TVariable<Object>* var_right,
-                                       Label* doubles,
-                                       TVariable<Float64T>* var_left_double,
-                                       TVariable<Float64T>* var_right_double,
-                                       Label* bigints) {
-  DCHECK_EQ(var_left_double == nullptr, var_right_double == nullptr);
-
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  *var_left = CAST(Parameter(Descriptor::kLeft));
-  *var_right = CAST(Parameter(Descriptor::kRight));
-
-  // We might need to loop for ToNumeric conversions.
-  Label loop(this, {var_left, var_right});
-  Goto(&loop);
-  BIND(&loop);
-
-  Label left_not_smi(this), right_not_smi(this);
-  Label left_not_number(this), right_not_number(this);
-  GotoIfNot(TaggedIsSmi(var_left->value()), &left_not_smi);
-  GotoIf(TaggedIsSmi(var_right->value()), smis);
-
-  // At this point, var_left is a Smi but var_right is not.
-  TNode<Smi> var_left_smi = CAST(var_left->value());
-  TNode<HeapObject> var_right_heap_object = CAST(var_right->value());
-  GotoIfNot(IsHeapNumber(var_right_heap_object), &right_not_number);
-  if (var_left_double != nullptr) {
-    *var_left_double = SmiToFloat64(var_left_smi);
-    *var_right_double = LoadHeapNumberValue(var_right_heap_object);
-  }
-  Goto(doubles);
-
-  BIND(&left_not_smi);
-  {
-    TNode<HeapObject> var_left_heap_object = CAST(var_left->value());
-    GotoIfNot(IsHeapNumber(var_left_heap_object), &left_not_number);
-    GotoIfNot(TaggedIsSmi(var_right->value()), &right_not_smi);
-
-    // At this point, var_left is a HeapNumber and var_right is a Smi.
-    if (var_left_double != nullptr) {
-      *var_left_double = LoadHeapNumberValue(var_left_heap_object);
-      *var_right_double = SmiToFloat64(CAST(var_right->value()));
-    }
-    Goto(doubles);
-  }
-
-  BIND(&right_not_smi);
-  {
-    TNode<HeapObject> var_right_heap_object = CAST(var_right->value());
-    GotoIfNot(IsHeapNumber(var_right_heap_object), &right_not_number);
-    if (var_left_double != nullptr) {
-      *var_left_double = LoadHeapNumberValue(CAST(var_left->value()));
-      *var_right_double = LoadHeapNumberValue(var_right_heap_object);
-    }
-    Goto(doubles);
-  }
-
-  BIND(&left_not_number);
-  {
-    Label left_bigint(this);
-    GotoIf(IsBigInt(CAST(var_left->value())), &left_bigint);
-    *var_left =
-        CallBuiltin(Builtins::kNonNumberToNumeric, context, var_left->value());
-    Goto(&loop);
-
-    BIND(&left_bigint);
-    {
-      // Jump to {bigints} if {var_right} is already a Numeric.
-      GotoIf(TaggedIsSmi(var_right->value()), bigints);
-      TNode<HeapObject> var_right_heap_object = CAST(var_right->value());
-      GotoIf(IsBigInt(var_right_heap_object), bigints);
-      GotoIf(IsHeapNumber(var_right_heap_object), bigints);
-      *var_right = CallBuiltin(Builtins::kNonNumberToNumeric, context,
-                               var_right->value());
-      Goto(&loop);
-    }
-  }
-
-  BIND(&right_not_number);
-  {
-    GotoIf(IsBigInt(CAST(var_right->value())), bigints);
-    *var_right =
-        CallBuiltin(Builtins::kNonNumberToNumeric, context, var_right->value());
-    Goto(&loop);
-  }
-}
-
-TF_BUILTIN(Subtract, NumberBuiltinsAssembler) {
-  TVARIABLE(Object, var_left);
-  TVARIABLE(Object, var_right);
-  TVARIABLE(Float64T, var_left_double);
-  TVARIABLE(Float64T, var_right_double);
-  Label do_smi_sub(this), do_double_sub(this), do_bigint_sub(this);
-
-  BinaryOp<Descriptor>(&do_smi_sub, &var_left, &var_right, &do_double_sub,
-                       &var_left_double, &var_right_double, &do_bigint_sub);
-
-  BIND(&do_smi_sub);
-  {
-    Label if_overflow(this);
-    TNode<Smi> var_left_smi = CAST(var_left.value());
-    TNode<Smi> var_right_smi = CAST(var_right.value());
-    TNode<Smi> result = TrySmiSub(var_left_smi, var_right_smi, &if_overflow);
-    Return(result);
-
-    BIND(&if_overflow);
-    {
-      var_left_double = SmiToFloat64(var_left_smi);
-      var_right_double = SmiToFloat64(var_right_smi);
-      Goto(&do_double_sub);
-    }
-  }
-
-  BIND(&do_double_sub);
-  {
-    TNode<Float64T> value =
-        Float64Sub(var_left_double.value(), var_right_double.value());
-    Return(AllocateHeapNumberWithValue(value));
-  }
-
-  BIND(&do_bigint_sub);
-  {
-    TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-    TailCallBuiltin(Builtins::kBigIntSubtract, context, var_left.value(),
-                    var_right.value());
-  }
-}
-
-TF_BUILTIN(BitwiseNot, NumberBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TVARIABLE(Object, var_input);
-  Label do_number(this), do_bigint(this);
-
-  UnaryOp<Descriptor>(&var_input, &do_number, &do_number, nullptr, &do_bigint);
-
-  BIND(&do_number);
-  {
-    TailCallBuiltin(Builtins::kBitwiseXor, context, var_input.value(),
-                    SmiConstant(-1));
-  }
-
-  BIND(&do_bigint);
-  {
-    Return(CallRuntime(Runtime::kBigIntUnaryOp, context, var_input.value(),
-                       SmiConstant(Operation::kBitwiseNot)));
-  }
-}
-
-TF_BUILTIN(Decrement, NumberBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TVARIABLE(Object, var_input);
-  Label do_number(this), do_bigint(this);
-
-  UnaryOp<Descriptor>(&var_input, &do_number, &do_number, nullptr, &do_bigint);
-
-  BIND(&do_number);
-  {
-    TailCallBuiltin(Builtins::kSubtract, context, var_input.value(),
-                    SmiConstant(1));
-  }
-
-  BIND(&do_bigint);
-  {
-    Return(CallRuntime(Runtime::kBigIntUnaryOp, context, var_input.value(),
-                       SmiConstant(Operation::kDecrement)));
-  }
-}
-
-TF_BUILTIN(Increment, NumberBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TVARIABLE(Object, var_input);
-  Label do_number(this), do_bigint(this);
-
-  UnaryOp<Descriptor>(&var_input, &do_number, &do_number, nullptr, &do_bigint);
-
-  BIND(&do_number);
-  {
-    TailCallBuiltin(Builtins::kAdd, context, var_input.value(), SmiConstant(1));
-  }
-
-  BIND(&do_bigint);
-  {
-    Return(CallRuntime(Runtime::kBigIntUnaryOp, context, var_input.value(),
-                       SmiConstant(Operation::kIncrement)));
-  }
-}
-
-TF_BUILTIN(Negate, NumberBuiltinsAssembler) {
-  TVARIABLE(Object, var_input);
-  TVARIABLE(Float64T, var_input_double);
-  Label do_smi(this), do_double(this), do_bigint(this);
-
-  UnaryOp<Descriptor>(&var_input, &do_smi, &do_double, &var_input_double,
-                      &do_bigint);
-
-  BIND(&do_smi);
-  { Return(SmiMul(CAST(var_input.value()), SmiConstant(-1))); }
-
-  BIND(&do_double);
-  {
-    TNode<Float64T> value =
-        Float64Mul(var_input_double.value(), Float64Constant(-1));
-    Return(AllocateHeapNumberWithValue(value));
-  }
-
-  BIND(&do_bigint);
-  {
-    TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-    Return(CallRuntime(Runtime::kBigIntUnaryOp, context, var_input.value(),
-                       SmiConstant(Operation::kNegate)));
-  }
-}
-
-TF_BUILTIN(Multiply, NumberBuiltinsAssembler) {
-  TVARIABLE(Object, var_left);
-  TVARIABLE(Object, var_right);
-  TVARIABLE(Float64T, var_left_double);
-  TVARIABLE(Float64T, var_right_double);
-  Label do_smi_mul(this), do_double_mul(this), do_bigint_mul(this);
-
-  BinaryOp<Descriptor>(&do_smi_mul, &var_left, &var_right, &do_double_mul,
-                       &var_left_double, &var_right_double, &do_bigint_mul);
-
-  BIND(&do_smi_mul);
-  // The result is not necessarily a smi, in case of overflow.
-  Return(SmiMul(CAST(var_left.value()), CAST(var_right.value())));
-
-  BIND(&do_double_mul);
-  TNode<Float64T> value =
-      Float64Mul(var_left_double.value(), var_right_double.value());
-  Return(AllocateHeapNumberWithValue(value));
-
-  BIND(&do_bigint_mul);
-  {
-    TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-    Return(CallRuntime(Runtime::kBigIntBinaryOp, context, var_left.value(),
-                       var_right.value(), SmiConstant(Operation::kMultiply)));
-  }
-}
-
-TF_BUILTIN(Divide, NumberBuiltinsAssembler) {
-  TVARIABLE(Object, var_left);
-  TVARIABLE(Object, var_right);
-  TVARIABLE(Float64T, var_left_double);
-  TVARIABLE(Float64T, var_right_double);
-  Label do_smi_div(this), do_double_div(this), do_bigint_div(this);
-
-  BinaryOp<Descriptor>(&do_smi_div, &var_left, &var_right, &do_double_div,
-                       &var_left_double, &var_right_double, &do_bigint_div);
-
-  BIND(&do_smi_div);
-  {
-    // TODO(jkummerow): Consider just always doing a double division.
-    Label bailout(this);
-    TNode<Smi> dividend = CAST(var_left.value());
-    TNode<Smi> divisor = CAST(var_right.value());
-
-    // Do floating point division if {divisor} is zero.
-    GotoIf(SmiEqual(divisor, SmiConstant(0)), &bailout);
-
-    // Do floating point division if {dividend} is zero and {divisor} is
-    // negative.
-    Label dividend_is_zero(this), dividend_is_not_zero(this);
-    Branch(SmiEqual(dividend, SmiConstant(0)), &dividend_is_zero,
-           &dividend_is_not_zero);
-
-    BIND(&dividend_is_zero);
-    {
-      GotoIf(SmiLessThan(divisor, SmiConstant(0)), &bailout);
-      Goto(&dividend_is_not_zero);
-    }
-    BIND(&dividend_is_not_zero);
-
-    TNode<Int32T> untagged_divisor = SmiToInt32(divisor);
-    TNode<Int32T> untagged_dividend = SmiToInt32(dividend);
-
-    // Do floating point division if {dividend} is kMinInt (or kMinInt - 1
-    // if the Smi size is 31) and {divisor} is -1.
-    Label divisor_is_minus_one(this), divisor_is_not_minus_one(this);
-    Branch(Word32Equal(untagged_divisor, Int32Constant(-1)),
-           &divisor_is_minus_one, &divisor_is_not_minus_one);
-
-    BIND(&divisor_is_minus_one);
-    {
-      GotoIf(Word32Equal(
-                 untagged_dividend,
-                 Int32Constant(kSmiValueSize == 32 ? kMinInt : (kMinInt >> 1))),
-             &bailout);
-      Goto(&divisor_is_not_minus_one);
-    }
-    BIND(&divisor_is_not_minus_one);
-
-    // TODO(epertoso): consider adding a machine instruction that returns
-    // both the result and the remainder.
-    TNode<Int32T> untagged_result =
-        Int32Div(untagged_dividend, untagged_divisor);
-    TNode<Int32T> truncated = Int32Mul(untagged_result, untagged_divisor);
-    // Do floating point division if the remainder is not 0.
-    GotoIf(Word32NotEqual(untagged_dividend, truncated), &bailout);
-    Return(SmiFromInt32(untagged_result));
-
-    // Bailout: convert {dividend} and {divisor} to double and do double
-    // division.
-    BIND(&bailout);
-    {
-      var_left_double = SmiToFloat64(dividend);
-      var_right_double = SmiToFloat64(divisor);
-      Goto(&do_double_div);
-    }
-  }
-
-  BIND(&do_double_div);
-  {
-    TNode<Float64T> value =
-        Float64Div(var_left_double.value(), var_right_double.value());
-    Return(AllocateHeapNumberWithValue(value));
-  }
-
-  BIND(&do_bigint_div);
-  {
-    TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-    Return(CallRuntime(Runtime::kBigIntBinaryOp, context, var_left.value(),
-                       var_right.value(), SmiConstant(Operation::kDivide)));
-  }
-}
-
-TF_BUILTIN(Modulus, NumberBuiltinsAssembler) {
-  TVARIABLE(Object, var_left);
-  TVARIABLE(Object, var_right);
-  TVARIABLE(Float64T, var_left_double);
-  TVARIABLE(Float64T, var_right_double);
-  Label do_smi_mod(this), do_double_mod(this), do_bigint_mod(this);
-
-  BinaryOp<Descriptor>(&do_smi_mod, &var_left, &var_right, &do_double_mod,
-                       &var_left_double, &var_right_double, &do_bigint_mod);
-
-  BIND(&do_smi_mod);
-  Return(SmiMod(CAST(var_left.value()), CAST(var_right.value())));
-
-  BIND(&do_double_mod);
-  TNode<Float64T> value =
-      Float64Mod(var_left_double.value(), var_right_double.value());
-  Return(AllocateHeapNumberWithValue(value));
-
-  BIND(&do_bigint_mod);
-  {
-    TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-    Return(CallRuntime(Runtime::kBigIntBinaryOp, context, var_left.value(),
-                       var_right.value(), SmiConstant(Operation::kModulus)));
-  }
-}
-
-TF_BUILTIN(Exponentiate, NumberBuiltinsAssembler) {
-  TVARIABLE(Object, var_left);
-  TVARIABLE(Object, var_right);
-  Label do_number_exp(this), do_bigint_exp(this);
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  BinaryOp<Descriptor>(&do_number_exp, &var_left, &var_right, &do_number_exp,
-                       nullptr, nullptr, &do_bigint_exp);
-
-  BIND(&do_number_exp);
-  { Return(MathPowImpl(context, var_left.value(), var_right.value())); }
-
-  BIND(&do_bigint_exp);
-  Return(CallRuntime(Runtime::kBigIntBinaryOp, context, var_left.value(),
-                     var_right.value(), SmiConstant(Operation::kExponentiate)));
-}
-
-TF_BUILTIN(ShiftLeft, NumberBuiltinsAssembler) {
-  EmitBitwiseOp<Descriptor>(Operation::kShiftLeft);
-}
-
-TF_BUILTIN(ShiftRight, NumberBuiltinsAssembler) {
-  EmitBitwiseOp<Descriptor>(Operation::kShiftRight);
-}
-
-TF_BUILTIN(ShiftRightLogical, NumberBuiltinsAssembler) {
-  EmitBitwiseOp<Descriptor>(Operation::kShiftRightLogical);
-}
-
-TF_BUILTIN(BitwiseAnd, NumberBuiltinsAssembler) {
-  EmitBitwiseOp<Descriptor>(Operation::kBitwiseAnd);
-}
-
-TF_BUILTIN(BitwiseOr, NumberBuiltinsAssembler) {
-  EmitBitwiseOp<Descriptor>(Operation::kBitwiseOr);
-}
-
-TF_BUILTIN(BitwiseXor, NumberBuiltinsAssembler) {
-  EmitBitwiseOp<Descriptor>(Operation::kBitwiseXor);
-}
-
-TF_BUILTIN(LessThan, NumberBuiltinsAssembler) {
-  RelationalComparisonBuiltin<Descriptor>(Operation::kLessThan);
-}
-
-TF_BUILTIN(LessThanOrEqual, NumberBuiltinsAssembler) {
-  RelationalComparisonBuiltin<Descriptor>(Operation::kLessThanOrEqual);
-}
-
-TF_BUILTIN(GreaterThan, NumberBuiltinsAssembler) {
-  RelationalComparisonBuiltin<Descriptor>(Operation::kGreaterThan);
-}
-
-TF_BUILTIN(GreaterThanOrEqual, NumberBuiltinsAssembler) {
-  RelationalComparisonBuiltin<Descriptor>(Operation::kGreaterThanOrEqual);
-}
-
-TF_BUILTIN(Equal, CodeStubAssembler) {
+TF_BUILTIN(StrictEqual_WithFeedback, CodeStubAssembler) {
   TNode<Object> lhs = CAST(Parameter(Descriptor::kLeft));
   TNode<Object> rhs = CAST(Parameter(Descriptor::kRight));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<HeapObject> maybe_feedback_vector =
+      CAST(Parameter(Descriptor::kMaybeFeedbackVector));
+  TNode<UintPtrT> slot = UncheckedCast<UintPtrT>(Parameter(Descriptor::kSlot));
 
-  Return(Equal(lhs, rhs, context));
-}
+  TVARIABLE(Smi, var_type_feedback);
+  TNode<Oddball> result = StrictEqual(lhs, rhs, &var_type_feedback);
+  UpdateFeedback(var_type_feedback.value(), maybe_feedback_vector, slot);
 
-TF_BUILTIN(StrictEqual, CodeStubAssembler) {
-  TNode<Object> lhs = CAST(Parameter(Descriptor::kLeft));
-  TNode<Object> rhs = CAST(Parameter(Descriptor::kRight));
-
-  Return(StrictEqual(lhs, rhs));
+  Return(result);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-object-gen.cc b/deps/v8/src/builtins/builtins-object-gen.cc
index 9af4affa681..43a0a6953e8 100644
--- a/deps/v8/src/builtins/builtins-object-gen.cc
+++ b/deps/v8/src/builtins/builtins-object-gen.cc
@@ -314,7 +314,8 @@ TNode<JSArray> ObjectEntriesValuesBuiltinsAssembler::FastGetOwnValuesOrEntries(
         TNode<JSArray> array;
         TNode<FixedArrayBase> elements;
         std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
-            PACKED_ELEMENTS, array_map, SmiConstant(2), {}, IntPtrConstant(2));
+            PACKED_ELEMENTS, array_map, SmiConstant(2), base::nullopt,
+            IntPtrConstant(2));
         StoreFixedArrayElement(CAST(elements), 0, next_key, SKIP_WRITE_BARRIER);
         StoreFixedArrayElement(CAST(elements), 1, value, SKIP_WRITE_BARRIER);
         value = TNode<JSArray>::UncheckedCast(array);
@@ -350,22 +351,6 @@ ObjectEntriesValuesBuiltinsAssembler::FinalizeValuesOrEntriesJSArray(
   return TNode<JSArray>::UncheckedCast(array);
 }
 
-TF_BUILTIN(ObjectPrototypeToLocaleString, CodeStubAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-
-  Label if_null_or_undefined(this, Label::kDeferred);
-  GotoIf(IsNullOrUndefined(receiver), &if_null_or_undefined);
-
-  TNode<Object> method =
-      GetProperty(context, receiver, factory()->toString_string());
-  Return(Call(context, method, receiver));
-
-  BIND(&if_null_or_undefined);
-  ThrowTypeError(context, MessageTemplate::kCalledOnNullOrUndefined,
-                 "Object.prototype.toLocaleString");
-}
-
 TF_BUILTIN(ObjectPrototypeHasOwnProperty, ObjectBuiltinsAssembler) {
   TNode<Object> object = CAST(Parameter(Descriptor::kReceiver));
   TNode<Object> key = CAST(Parameter(Descriptor::kKey));
@@ -515,7 +500,7 @@ TF_BUILTIN(ObjectKeys, ObjectBuiltinsAssembler) {
         LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
     TNode<Smi> array_length = SmiTag(Signed(object_enum_length));
     std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
-        PACKED_ELEMENTS, array_map, array_length, {},
+        PACKED_ELEMENTS, array_map, array_length, base::nullopt,
         Signed(object_enum_length));
     CopyFixedArrayElements(PACKED_ELEMENTS, object_enum_keys, elements,
                            object_enum_length, SKIP_WRITE_BARRIER);
@@ -611,7 +596,7 @@ TF_BUILTIN(ObjectGetOwnPropertyNames, ObjectBuiltinsAssembler) {
     TNode<JSArray> array;
     TNode<FixedArrayBase> elements;
     std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
-        PACKED_ELEMENTS, array_map, array_length, {},
+        PACKED_ELEMENTS, array_map, array_length, base::nullopt,
         Signed(object_enum_length));
     CopyFixedArrayElements(PACKED_ELEMENTS, object_enum_keys, elements,
                            object_enum_length, SKIP_WRITE_BARRIER);
@@ -724,20 +709,13 @@ TF_BUILTIN(ObjectPrototypeIsPrototypeOf, ObjectBuiltinsAssembler) {
   Return(FalseConstant());
 }
 
-// ES #sec-object.prototype.tostring
-TF_BUILTIN(ObjectPrototypeToString, CodeStubAssembler) {
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  Return(CallBuiltin(Builtins::kObjectToString, context, receiver));
-}
-
 TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
-  Label checkstringtag(this), if_apiobject(this, Label::kDeferred),
-      if_arguments(this), if_array(this), if_boolean(this), if_date(this),
-      if_error(this), if_function(this), if_number(this, Label::kDeferred),
-      if_object(this), if_primitive(this), if_proxy(this, Label::kDeferred),
-      if_regexp(this), if_string(this), if_symbol(this, Label::kDeferred),
-      if_value(this), if_bigint(this, Label::kDeferred);
+  Label checkstringtag(this), if_arguments(this), if_array(this),
+      if_boolean(this), if_date(this), if_error(this), if_function(this),
+      if_number(this, Label::kDeferred), if_object(this), if_primitive(this),
+      if_proxy(this, Label::kDeferred), if_regexp(this), if_string(this),
+      if_symbol(this, Label::kDeferred), if_value(this),
+      if_bigint(this, Label::kDeferred);
 
   TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
@@ -763,8 +741,8 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
                     {JS_ARGUMENTS_OBJECT_TYPE, &if_arguments},
                     {JS_DATE_TYPE, &if_date},
                     {JS_BOUND_FUNCTION_TYPE, &if_function},
-                    {JS_API_OBJECT_TYPE, &if_apiobject},
-                    {JS_SPECIAL_API_OBJECT_TYPE, &if_apiobject},
+                    {JS_API_OBJECT_TYPE, &if_object},
+                    {JS_SPECIAL_API_OBJECT_TYPE, &if_object},
                     {JS_PROXY_TYPE, &if_proxy},
                     {JS_ERROR_TYPE, &if_error},
                     {JS_PRIMITIVE_WRAPPER_TYPE, &if_value}};
@@ -778,25 +756,6 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
   Switch(receiver_instance_type, &if_object, case_values, case_labels,
          arraysize(case_values));
 
-  BIND(&if_apiobject);
-  {
-    // Lookup the @@toStringTag property on the {receiver}.
-    TVARIABLE(Object, var_tag,
-              GetProperty(context, receiver,
-                          isolate()->factory()->to_string_tag_symbol()));
-    Label if_tagisnotstring(this), if_tagisstring(this);
-    GotoIf(TaggedIsSmi(var_tag.value()), &if_tagisnotstring);
-    Branch(IsString(CAST(var_tag.value())), &if_tagisstring,
-           &if_tagisnotstring);
-    BIND(&if_tagisnotstring);
-    {
-      var_tag = CallRuntime(Runtime::kClassOf, context, receiver);
-      Goto(&if_tagisstring);
-    }
-    BIND(&if_tagisstring);
-    ReturnToStringFormat(context, CAST(var_tag.value()));
-  }
-
   BIND(&if_arguments);
   {
     var_default = ArgumentsToStringConstant();
@@ -1053,14 +1012,6 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
   }
 }
 
-// ES6 #sec-object.prototype.valueof
-TF_BUILTIN(ObjectPrototypeValueOf, CodeStubAssembler) {
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  Return(ToObject_Inline(context, receiver));
-}
-
 // ES #sec-object.create
 TF_BUILTIN(ObjectCreate, ObjectBuiltinsAssembler) {
   int const kPrototypeArg = 0;
diff --git a/deps/v8/src/builtins/builtins-promise.cc b/deps/v8/src/builtins/builtins-promise.cc
deleted file mode 100644
index 5eca1eb9c09..00000000000
--- a/deps/v8/src/builtins/builtins-promise.cc
+++ /dev/null
@@ -1,24 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/builtins/builtins-promise.h"
-
-#include "src/builtins/builtins-utils-inl.h"
-#include "src/builtins/builtins.h"
-#include "src/heap/heap-inl.h"  // For ToBoolean. TODO(jkummerow): Drop.
-#include "src/logging/counters.h"
-#include "src/objects/objects-inl.h"
-
-namespace v8 {
-namespace internal {
-
-BUILTIN(IsPromise) {
-  SealHandleScope scope(isolate);
-
-  Handle<Object> object = args.atOrUndefined(isolate, 1);
-  return isolate->heap()->ToBoolean(object->IsJSPromise());
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-promise.h b/deps/v8/src/builtins/builtins-promise.h
index a97ab7ad1dc..a775ea20411 100644
--- a/deps/v8/src/builtins/builtins-promise.h
+++ b/deps/v8/src/builtins/builtins-promise.h
@@ -35,11 +35,23 @@ class PromiseBuiltins {
     kPromiseAllResolveElementCapabilitySlot,
 
     // Values array from Promise.all
-    kPromiseAllResolveElementValuesArraySlot,
+    kPromiseAllResolveElementValuesSlot,
 
     kPromiseAllResolveElementLength
   };
 
+  enum PromiseAnyRejectElementContextSlots {
+    // Remaining elements count
+    kPromiseAnyRejectElementRemainingSlot = Context::MIN_CONTEXT_SLOTS,
+
+    // Promise capability from Promise.any
+    kPromiseAnyRejectElementCapabilitySlot,
+
+    // errors array from Promise.any
+    kPromiseAnyRejectElementErrorsSlot,
+    kPromiseAnyRejectElementLength
+  };
+
   enum FunctionContextSlot {
     kCapabilitySlot = Context::MIN_CONTEXT_SLOTS,
 
diff --git a/deps/v8/src/builtins/builtins-proxy-gen.cc b/deps/v8/src/builtins/builtins-proxy-gen.cc
index caafcf6506f..f398a6c2825 100644
--- a/deps/v8/src/builtins/builtins-proxy-gen.cc
+++ b/deps/v8/src/builtins/builtins-proxy-gen.cc
@@ -76,8 +76,7 @@ TNode<JSFunction> ProxiesCodeStubAssembler::AllocateProxyRevokeFunction(
       CreateProxyRevokeFunctionContext(proxy, native_context);
   const TNode<Map> revoke_map = CAST(LoadContextElement(
       native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX));
-  const TNode<SharedFunctionInfo> revoke_info = CAST(
-      LoadContextElement(native_context, Context::PROXY_REVOKE_SHARED_FUN));
+  const TNode<SharedFunctionInfo> revoke_info = ProxyRevokeSharedFunConstant();
 
   return AllocateFunctionWithMapAndContext(revoke_map, revoke_info,
                                            proxy_context);
diff --git a/deps/v8/src/builtins/builtins-regexp-gen.cc b/deps/v8/src/builtins/builtins-regexp-gen.cc
index d06ced76d2e..584111cc760 100644
--- a/deps/v8/src/builtins/builtins-regexp-gen.cc
+++ b/deps/v8/src/builtins/builtins-regexp-gen.cc
@@ -89,7 +89,7 @@ TNode<JSRegExpResult> RegExpBuiltinsAssembler::AllocateRegExpResult(
   const ElementsKind elements_kind = PACKED_ELEMENTS;
   TNode<Map> map = CAST(LoadContextElement(LoadNativeContext(context),
                                            Context::REGEXP_RESULT_MAP_INDEX));
-  TNode<AllocationSite> no_allocation_site = {};
+  base::Optional<TNode<AllocationSite>> no_allocation_site = base::nullopt;
   TNode<IntPtrT> length_intptr = SmiUntag(length);
 
   // Note: The returned `elements` may be in young large object space, but
@@ -528,7 +528,7 @@ TNode<HeapObject> RegExpBuiltinsAssembler::RegExpExecInternal(
         data, JSRegExp::kIrregexpCaptureCountIndex));
     // capture_count is the number of captures without the match itself.
     // Required registers = (capture_count + 1) * 2.
-    STATIC_ASSERT(Internals::IsValidSmi((JSRegExp::kMaxCaptures + 1) << 1));
+    STATIC_ASSERT(Internals::IsValidSmi((JSRegExp::kMaxCaptures + 1) * 2));
     TNode<Smi> register_count =
         SmiShl(SmiAdd(capture_count, SmiConstant(1)), 1);
 
@@ -729,13 +729,9 @@ void RegExpBuiltinsAssembler::BranchIfFastRegExp(
 
   // This should only be needed for String.p.(split||matchAll), but we are
   // conservative here.
-  // Note: we are using the current native context here, which may or may not
-  // match the object's native context. That's fine: in case of a mismatch, we
-  // will bail in the next step when comparing the object's map against the
-  // current native context's initial regexp map.
-  TNode<NativeContext> native_context = LoadNativeContext(context);
-  GotoIf(IsRegExpSpeciesProtectorCellInvalid(native_context), if_ismodified);
+  GotoIf(IsRegExpSpeciesProtectorCellInvalid(), if_ismodified);
 
+  TNode<NativeContext> native_context = LoadNativeContext(context);
   TNode<JSFunction> regexp_fun =
       CAST(LoadContextElement(native_context, Context::REGEXP_FUNCTION_INDEX));
   TNode<Map> initial_map = CAST(
@@ -1336,10 +1332,10 @@ TNode<Object> RegExpMatchAllAssembler::CreateRegExpStringIterator(
   // 9. Set iterator.[[Done]] to false.
   TNode<Int32T> global_flag =
       Word32Shl(ReinterpretCast<Int32T>(global),
-                Int32Constant(JSRegExpStringIterator::kGlobalBit));
+                Int32Constant(JSRegExpStringIterator::GlobalBit::kShift));
   TNode<Int32T> unicode_flag =
       Word32Shl(ReinterpretCast<Int32T>(full_unicode),
-                Int32Constant(JSRegExpStringIterator::kUnicodeBit));
+                Int32Constant(JSRegExpStringIterator::UnicodeBit::kShift));
   TNode<Int32T> iterator_flags = Word32Or(global_flag, unicode_flag);
   StoreObjectFieldNoWriteBarrier(iterator, JSRegExpStringIterator::kFlagsOffset,
                                  SmiFromInt32(iterator_flags));
@@ -1358,9 +1354,7 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
   const TNode<IntPtrT> int_limit = SmiUntag(limit);
 
   const ElementsKind kind = PACKED_ELEMENTS;
-  const ParameterMode mode = CodeStubAssembler::INTPTR_PARAMETERS;
 
-  TNode<AllocationSite> allocation_site = {};
   const TNode<NativeContext> native_context = LoadNativeContext(context);
   TNode<Map> array_map = LoadJSArrayElementsMap(kind, native_context);
 
@@ -1400,6 +1394,7 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
       {
         TNode<Smi> length = SmiConstant(1);
         TNode<IntPtrT> capacity = IntPtrConstant(1);
+        base::Optional<TNode<AllocationSite>> allocation_site = base::nullopt;
         var_result =
             AllocateJSArray(kind, array_map, capacity, length, allocation_site);
 
@@ -1512,10 +1507,10 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
         const TNode<IntPtrT> reg = var_reg.value();
         const TNode<Object> from = LoadFixedArrayElement(
             match_indices, reg,
-            RegExpMatchInfo::kFirstCaptureIndex * kTaggedSize, mode);
+            RegExpMatchInfo::kFirstCaptureIndex * kTaggedSize);
         const TNode<Smi> to = CAST(LoadFixedArrayElement(
             match_indices, reg,
-            (RegExpMatchInfo::kFirstCaptureIndex + 1) * kTaggedSize, mode));
+            (RegExpMatchInfo::kFirstCaptureIndex + 1) * kTaggedSize));
 
         Label select_capture(this), select_undefined(this), store_value(this);
         TVARIABLE(Object, var_value);
@@ -1574,6 +1569,7 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
   {
     TNode<Smi> length = SmiZero();
     TNode<IntPtrT> capacity = IntPtrZero();
+    base::Optional<TNode<AllocationSite>> allocation_site = base::nullopt;
     var_result =
         AllocateJSArray(kind, array_map, capacity, length, allocation_site);
     Goto(&done);
diff --git a/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc b/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc
index 3049b01d2f5..010bf965cc6 100644
--- a/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc
+++ b/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc
@@ -89,7 +89,7 @@ void SharedArrayBufferBuiltinsAssembler::ValidateSharedTypedArray(
   BIND(&not_float_or_clamped);
   *out_elements_kind = elements_kind;
 
-  TNode<RawPtrT> backing_store = LoadJSArrayBufferBackingStore(array_buffer);
+  TNode<RawPtrT> backing_store = LoadJSArrayBufferBackingStorePtr(array_buffer);
   TNode<UintPtrT> byte_offset = LoadJSArrayBufferViewByteOffset(array);
   *out_backing_store = RawPtrAdd(backing_store, Signed(byte_offset));
 }
diff --git a/deps/v8/src/builtins/builtins-string-gen.cc b/deps/v8/src/builtins/builtins-string-gen.cc
index e2d16352749..689ced18f52 100644
--- a/deps/v8/src/builtins/builtins-string-gen.cc
+++ b/deps/v8/src/builtins/builtins-string-gen.cc
@@ -20,10 +20,10 @@ namespace internal {
 
 using Node = compiler::Node;
 
-TNode<IntPtrT> StringBuiltinsAssembler::DirectStringData(
+TNode<RawPtrT> StringBuiltinsAssembler::DirectStringData(
     TNode<String> string, TNode<Word32T> string_instance_type) {
   // Compute the effective offset of the first character.
-  TVARIABLE(IntPtrT, var_data);
+  TVARIABLE(RawPtrT, var_data);
   Label if_sequential(this), if_external(this), if_join(this);
   Branch(Word32Equal(Word32And(string_instance_type,
                                Int32Constant(kStringRepresentationMask)),
@@ -32,9 +32,9 @@ TNode<IntPtrT> StringBuiltinsAssembler::DirectStringData(
 
   BIND(&if_sequential);
   {
-    var_data = IntPtrAdd(
-        IntPtrConstant(SeqOneByteString::kHeaderSize - kHeapObjectTag),
-        BitcastTaggedToWord(string));
+    var_data = RawPtrAdd(
+        ReinterpretCast<RawPtrT>(BitcastTaggedToWord(string)),
+        IntPtrConstant(SeqOneByteString::kHeaderSize - kHeapObjectTag));
     Goto(&if_join);
   }
 
@@ -47,7 +47,7 @@ TNode<IntPtrT> StringBuiltinsAssembler::DirectStringData(
                                    Int32Constant(kUncachedExternalStringMask)),
                          Int32Constant(kUncachedExternalStringTag)));
     var_data =
-        LoadObjectField<IntPtrT>(string, ExternalString::kResourceDataOffset);
+        DecodeExternalPointer(LoadExternalStringResourceData(CAST(string)));
     Goto(&if_join);
   }
 
@@ -254,8 +254,8 @@ void StringBuiltinsAssembler::StringEqual_Loop(
   CSA_ASSERT(this, WordEqual(LoadStringLengthAsWord(rhs), length));
 
   // Compute the effective offset of the first character.
-  TNode<IntPtrT> lhs_data = DirectStringData(lhs, lhs_instance_type);
-  TNode<IntPtrT> rhs_data = DirectStringData(rhs, rhs_instance_type);
+  TNode<RawPtrT> lhs_data = DirectStringData(lhs, lhs_instance_type);
+  TNode<RawPtrT> rhs_data = DirectStringData(rhs, rhs_instance_type);
 
   // Loop over the {lhs} and {rhs} strings to see if they are equal.
   TVARIABLE(IntPtrT, var_offset, IntPtrConstant(0));
diff --git a/deps/v8/src/builtins/builtins-string-gen.h b/deps/v8/src/builtins/builtins-string-gen.h
index 93b2086dd7f..2b4dadbbb03 100644
--- a/deps/v8/src/builtins/builtins-string-gen.h
+++ b/deps/v8/src/builtins/builtins-string-gen.h
@@ -67,7 +67,7 @@ class StringBuiltinsAssembler : public CodeStubAssembler {
                         TNode<Word32T> rhs_instance_type, MachineType rhs_type,
                         TNode<IntPtrT> length, Label* if_equal,
                         Label* if_not_equal);
-  TNode<IntPtrT> DirectStringData(TNode<String> string,
+  TNode<RawPtrT> DirectStringData(TNode<String> string,
                                   TNode<Word32T> string_instance_type);
 
   void DispatchOnStringEncodings(const TNode<Word32T> lhs_instance_type,
diff --git a/deps/v8/src/builtins/builtins-string.tq b/deps/v8/src/builtins/builtins-string.tq
index 61cd984e7f4..6ec7bc9d0ac 100644
--- a/deps/v8/src/builtins/builtins-string.tq
+++ b/deps/v8/src/builtins/builtins-string.tq
@@ -5,222 +5,252 @@
 #include 'src/builtins/builtins-string-gen.h'
 
 namespace string {
-  extern macro StringBuiltinsAssembler::SubString(String, uintptr, uintptr):
-      String;
-
-  // ES6 #sec-string.prototype.tostring
-  transitioning javascript builtin
-  StringPrototypeToString(
-      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
-    return ToThisValue(
-        receiver, PrimitiveType::kString, 'String.prototype.toString');
-  }
-
-  // ES6 #sec-string.prototype.valueof
-  transitioning javascript builtin
-  StringPrototypeValueOf(js-implicit context: NativeContext, receiver: JSAny)():
-      JSAny {
-    return ToThisValue(
-        receiver, PrimitiveType::kString, 'String.prototype.valueOf');
-  }
-
-  extern macro StringBuiltinsAssembler::LoadSurrogatePairAt(
-      String, intptr, intptr, constexpr UnicodeEncoding): int32;
-  extern macro StringBuiltinsAssembler::StringFromSingleUTF16EncodedCodePoint(
-      int32): String;
-
-  // This function assumes StringPrimitiveWithNoCustomIteration is true.
-  transitioning builtin StringToList(implicit context: Context)(string: String):
-      JSArray {
-    const kind = ElementsKind::PACKED_ELEMENTS;
-    const stringLength: intptr = string.length_intptr;
-
-    const nativeContext = LoadNativeContext(context);
-    const map: Map = LoadJSArrayElementsMap(kind, nativeContext);
-    const array: JSArray = AllocateJSArray(
-        kind, map, stringLength, SmiTag(stringLength),
-        AllocationFlag::kAllowLargeObjectAllocation);
-    const elements = UnsafeCast<FixedArray>(array.elements);
-    const encoding = UnicodeEncoding::UTF16;
-    let arrayLength: Smi = 0;
-    let i: intptr = 0;
-    while (i < stringLength) {
-      const ch: int32 = LoadSurrogatePairAt(string, stringLength, i, encoding);
-      const value: String = StringFromSingleUTF16EncodedCodePoint(ch);
-      elements[arrayLength] = value;
-      // Increment and continue the loop.
-      i = i + value.length_intptr;
-      arrayLength++;
-    }
-    assert(arrayLength >= 0);
-    assert(SmiTag(stringLength) >= arrayLength);
-    array.length = arrayLength;
 
-    return array;
-  }
+// TODO(bbudge) Remove the 'RT' suffix on this runtime function.
+extern transitioning runtime ToStringRT(Context, JSAny): String;
 
-  transitioning macro GenerateStringAt(implicit context: Context)(
-      receiver: JSAny, position: JSAny,
-      methodName: constexpr string): never labels
-  IfInBounds(String, uintptr, uintptr), IfOutOfBounds {
-    // 1. Let O be ? RequireObjectCoercible(this value).
-    // 2. Let S be ? ToString(O).
-    const string: String = ToThisString(receiver, methodName);
-
-    // 3. Let position be ? ToInteger(pos).
-    const indexNumber: Number = ToInteger_Inline(position);
-
-    // Convert the {position} to a uintptr and check that it's in bounds of
-    // the {string}.
-    typeswitch (indexNumber) {
-      case (indexSmi: Smi): {
-        const length: uintptr = string.length_uintptr;
-        const index: uintptr = Unsigned(Convert<intptr>(indexSmi));
-        // Max string length fits Smi range, so we can do an unsigned bounds
-        // check.
-        const kMaxStringLengthFitsSmi: constexpr bool =
-            kStringMaxLengthUintptr < kSmiMaxValue;
-        StaticAssert(kMaxStringLengthFitsSmi);
-        if (index >= length) goto IfOutOfBounds;
-        goto IfInBounds(string, index, length);
+@export
+transitioning macro ToStringImpl(context: Context, o: JSAny): String {
+  let result: JSAny = o;
+  while (true) {
+    typeswitch (result) {
+      case (num: Number): {
+        return NumberToString(num);
+      }
+      case (str: String): {
+        return str;
+      }
+      case (oddball: Oddball): {
+        return oddball.to_string;
       }
-      case (indexHeapNumber: HeapNumber): {
-        assert(IsNumberNormalized(indexHeapNumber));
-        // Valid string indices fit into Smi range, so HeapNumber index is
-        // definitely an out of bounds case.
-        goto IfOutOfBounds;
+      case (JSReceiver): {
+        result = NonPrimitiveToPrimitive_String(context, result);
+        continue;
+      }
+      case (Symbol): {
+        ThrowTypeError(MessageTemplate::kSymbolToString);
+      }
+      case (JSAny): {
+        return ToStringRT(context, o);
       }
     }
   }
+  unreachable;
+}
 
-  // ES6 #sec-string.prototype.charat
-  transitioning javascript builtin StringPrototypeCharAt(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(position: JSAny): JSAny {
-    try {
-      GenerateStringAt(receiver, position, 'String.prototype.charAt')
-          otherwise IfInBounds, IfOutOfBounds;
-    }
-    label IfInBounds(string: String, index: uintptr, _length: uintptr) {
-      const code: int32 = StringCharCodeAt(string, index);
-      return StringFromSingleCharCode(code);
-    }
-    label IfOutOfBounds {
-      return kEmptyString;
-    }
+transitioning builtin ToString(context: Context, o: JSAny): String {
+  return ToStringImpl(context, o);
+}
+
+extern macro StringBuiltinsAssembler::SubString(
+    String, uintptr, uintptr): String;
+
+// ES6 #sec-string.prototype.tostring
+transitioning javascript builtin
+StringPrototypeToString(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+  return ToThisValue(
+      receiver, PrimitiveType::kString, 'String.prototype.toString');
+}
+
+// ES6 #sec-string.prototype.valueof
+transitioning javascript builtin
+StringPrototypeValueOf(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+  return ToThisValue(
+      receiver, PrimitiveType::kString, 'String.prototype.valueOf');
+}
+
+extern macro StringBuiltinsAssembler::LoadSurrogatePairAt(
+    String, intptr, intptr, constexpr UnicodeEncoding): int32;
+extern macro StringBuiltinsAssembler::StringFromSingleUTF16EncodedCodePoint(
+    int32): String;
+
+// This function assumes StringPrimitiveWithNoCustomIteration is true.
+transitioning builtin StringToList(implicit context: Context)(string: String):
+    JSArray {
+  const kind = ElementsKind::PACKED_ELEMENTS;
+  const stringLength: intptr = string.length_intptr;
+
+  const nativeContext = LoadNativeContext(context);
+  const map: Map = LoadJSArrayElementsMap(kind, nativeContext);
+  const array: JSArray = AllocateJSArray(
+      kind, map, stringLength, SmiTag(stringLength),
+      AllocationFlag::kAllowLargeObjectAllocation);
+  const elements = UnsafeCast<FixedArray>(array.elements);
+  const encoding = UnicodeEncoding::UTF16;
+  let arrayLength: Smi = 0;
+  let i: intptr = 0;
+  while (i < stringLength) {
+    const ch: int32 = LoadSurrogatePairAt(string, stringLength, i, encoding);
+    const value: String = StringFromSingleUTF16EncodedCodePoint(ch);
+    elements[arrayLength] = value;
+    // Increment and continue the loop.
+    i = i + value.length_intptr;
+    arrayLength++;
   }
+  assert(arrayLength >= 0);
+  assert(SmiTag(stringLength) >= arrayLength);
+  array.length = arrayLength;
 
-  // ES6 #sec-string.prototype.charcodeat
-  transitioning javascript builtin StringPrototypeCharCodeAt(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(position: JSAny): JSAny {
-    try {
-      GenerateStringAt(receiver, position, 'String.prototype.charCodeAt')
-          otherwise IfInBounds, IfOutOfBounds;
-    }
-    label IfInBounds(string: String, index: uintptr, _length: uintptr) {
-      const code: int32 = StringCharCodeAt(string, index);
-      return Convert<Smi>(code);
+  return array;
+}
+
+transitioning macro GenerateStringAt(implicit context: Context)(
+    receiver: JSAny, position: JSAny,
+    methodName: constexpr string): never labels
+IfInBounds(String, uintptr, uintptr), IfOutOfBounds {
+  // 1. Let O be ? RequireObjectCoercible(this value).
+  // 2. Let S be ? ToString(O).
+  const string: String = ToThisString(receiver, methodName);
+
+  // 3. Let position be ? ToInteger(pos).
+  const indexNumber: Number = ToInteger_Inline(position);
+
+  // Convert the {position} to a uintptr and check that it's in bounds of
+  // the {string}.
+  typeswitch (indexNumber) {
+    case (indexSmi: Smi): {
+      const length: uintptr = string.length_uintptr;
+      const index: uintptr = Unsigned(Convert<intptr>(indexSmi));
+      // Max string length fits Smi range, so we can do an unsigned bounds
+      // check.
+      const kMaxStringLengthFitsSmi: constexpr bool =
+          kStringMaxLengthUintptr < kSmiMaxValue;
+      StaticAssert(kMaxStringLengthFitsSmi);
+      if (index >= length) goto IfOutOfBounds;
+      goto IfInBounds(string, index, length);
     }
-    label IfOutOfBounds {
-      return kNaN;
+    case (indexHeapNumber: HeapNumber): {
+      assert(IsNumberNormalized(indexHeapNumber));
+      // Valid string indices fit into Smi range, so HeapNumber index is
+      // definitely an out of bounds case.
+      goto IfOutOfBounds;
     }
   }
+}
 
-  // ES6 #sec-string.prototype.codepointat
-  transitioning javascript builtin StringPrototypeCodePointAt(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(position: JSAny): JSAny {
-    try {
-      GenerateStringAt(receiver, position, 'String.prototype.codePointAt')
-          otherwise IfInBounds, IfOutOfBounds;
-    }
-    label IfInBounds(string: String, index: uintptr, length: uintptr) {
-      // This is always a call to a builtin from Javascript, so we need to
-      // produce UTF32.
-      const code: int32 = LoadSurrogatePairAt(
-          string, Signed(length), Signed(index), UnicodeEncoding::UTF32);
-      return Convert<Smi>(code);
-    }
-    label IfOutOfBounds {
-      return Undefined;
-    }
+// ES6 #sec-string.prototype.charat
+transitioning javascript builtin StringPrototypeCharAt(
+    js-implicit context: NativeContext,
+    receiver: JSAny)(position: JSAny): JSAny {
+  try {
+    GenerateStringAt(receiver, position, 'String.prototype.charAt')
+        otherwise IfInBounds, IfOutOfBounds;
+  } label IfInBounds(string: String, index: uintptr, _length: uintptr) {
+    const code: int32 = StringCharCodeAt(string, index);
+    return StringFromSingleCharCode(code);
+  } label IfOutOfBounds {
+    return kEmptyString;
   }
+}
 
-  // ES6 String.prototype.concat(...args)
-  // ES6 #sec-string.prototype.concat
-  transitioning javascript builtin StringPrototypeConcat(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    // Check that {receiver} is coercible to Object and convert it to a String.
-    let string: String = ToThisString(receiver, 'String.prototype.concat');
-
-    // Concatenate all the arguments passed to this builtin.
-    const length: intptr = Convert<intptr>(arguments.length);
-    for (let i: intptr = 0; i < length; i++) {
-      const temp: String = ToString_Inline(arguments[i]);
-      string = string + temp;
-    }
-    return string;
+// ES6 #sec-string.prototype.charcodeat
+transitioning javascript builtin StringPrototypeCharCodeAt(
+    js-implicit context: NativeContext,
+    receiver: JSAny)(position: JSAny): JSAny {
+  try {
+    GenerateStringAt(receiver, position, 'String.prototype.charCodeAt')
+        otherwise IfInBounds, IfOutOfBounds;
+  } label IfInBounds(string: String, index: uintptr, _length: uintptr) {
+    const code: int32 = StringCharCodeAt(string, index);
+    return Convert<Smi>(code);
+  } label IfOutOfBounds {
+    return kNaN;
+  }
+}
+
+// ES6 #sec-string.prototype.codepointat
+transitioning javascript builtin StringPrototypeCodePointAt(
+    js-implicit context: NativeContext,
+    receiver: JSAny)(position: JSAny): JSAny {
+  try {
+    GenerateStringAt(receiver, position, 'String.prototype.codePointAt')
+        otherwise IfInBounds, IfOutOfBounds;
+  } label IfInBounds(string: String, index: uintptr, length: uintptr) {
+    // This is always a call to a builtin from Javascript, so we need to
+    // produce UTF32.
+    const code: int32 = LoadSurrogatePairAt(
+        string, Signed(length), Signed(index), UnicodeEncoding::UTF32);
+    return Convert<Smi>(code);
+  } label IfOutOfBounds {
+    return Undefined;
   }
+}
+
+// ES6 String.prototype.concat(...args)
+// ES6 #sec-string.prototype.concat
+transitioning javascript builtin StringPrototypeConcat(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // Check that {receiver} is coercible to Object and convert it to a String.
+  let string: String = ToThisString(receiver, 'String.prototype.concat');
+
+  // Concatenate all the arguments passed to this builtin.
+  const length: intptr = Convert<intptr>(arguments.length);
+  for (let i: intptr = 0; i < length; i++) {
+    const temp: String = ToString_Inline(arguments[i]);
+    string = string + temp;
+  }
+  return string;
+}
 
-  extern transitioning runtime
-  SymbolDescriptiveString(implicit context: Context)(Symbol): String;
-
-  // ES #sec-string-constructor
-  // https://tc39.github.io/ecma262/#sec-string-constructor
-  transitioning javascript builtin StringConstructor(
-      js-implicit context: NativeContext, receiver: JSAny, newTarget: JSAny,
-      target: JSFunction)(...arguments): JSAny {
-    const length: intptr = Convert<intptr>(arguments.length);
-    let s: String;
-    // 1. If no arguments were passed to this function invocation, let s be "".
-    if (length == 0) {
-      s = EmptyStringConstant();
-    } else {
-      // 2. Else,
-      // 2. a. If NewTarget is undefined and Type(value) is Symbol, return
-      // SymbolDescriptiveString(value).
-      if (newTarget == Undefined) {
-        typeswitch (arguments[0]) {
-          case (value: Symbol): {
-            return SymbolDescriptiveString(value);
-          }
-          case (JSAny): {
-          }
+extern transitioning runtime
+SymbolDescriptiveString(implicit context: Context)(Symbol): String;
+
+// ES #sec-string-constructor
+// https://tc39.github.io/ecma262/#sec-string-constructor
+transitioning javascript builtin StringConstructor(
+    js-implicit context: NativeContext, receiver: JSAny, newTarget: JSAny,
+    target: JSFunction)(...arguments): JSAny {
+  const length: intptr = Convert<intptr>(arguments.length);
+  let s: String;
+  // 1. If no arguments were passed to this function invocation, let s be "".
+  if (length == 0) {
+    s = EmptyStringConstant();
+  } else {
+    // 2. Else,
+    // 2. a. If NewTarget is undefined and Type(value) is Symbol, return
+    // SymbolDescriptiveString(value).
+    if (newTarget == Undefined) {
+      typeswitch (arguments[0]) {
+        case (value: Symbol): {
+          return SymbolDescriptiveString(value);
+        }
+        case (JSAny): {
         }
       }
-      // 2. b. Let s be ? ToString(value).
-      s = ToString_Inline(arguments[0]);
     }
-    // 3. If NewTarget is undefined, return s.
-    if (newTarget == Undefined) {
-      return s;
-    }
-    // 4. Return ! StringCreate(s, ? GetPrototypeFromConstructor(NewTarget,
-    // "%String.prototype%")).
-    const map = GetDerivedMap(target, UnsafeCast<JSReceiver>(newTarget));
-    const obj =
-        UnsafeCast<JSPrimitiveWrapper>(AllocateFastOrSlowJSObjectFromMap(map));
-    obj.value = s;
-    return obj;
+    // 2. b. Let s be ? ToString(value).
+    s = ToString_Inline(arguments[0]);
   }
-
-  transitioning builtin StringAddConvertLeft(implicit context: Context)(
-      left: JSAny, right: String): String {
-    return ToStringImpl(context, ToPrimitiveDefault(left)) + right;
+  // 3. If NewTarget is undefined, return s.
+  if (newTarget == Undefined) {
+    return s;
   }
+  // 4. Return ! StringCreate(s, ? GetPrototypeFromConstructor(NewTarget,
+  // "%String.prototype%")).
+  const map = GetDerivedMap(target, UnsafeCast<JSReceiver>(newTarget));
+  const obj =
+      UnsafeCast<JSPrimitiveWrapper>(AllocateFastOrSlowJSObjectFromMap(map));
+  obj.value = s;
+  return obj;
+}
 
-  transitioning builtin StringAddConvertRight(implicit context: Context)(
-      left: String, right: JSAny): String {
-    return left + ToStringImpl(context, ToPrimitiveDefault(right));
-  }
+transitioning builtin StringAddConvertLeft(implicit context: Context)(
+    left: JSAny, right: String): String {
+  return ToStringImpl(context, ToPrimitiveDefault(left)) + right;
+}
 
-  builtin StringCharAt(implicit context: Context)(
-      receiver: String, position: uintptr): String {
-    // Load the character code at the {position} from the {receiver}.
-    const code: int32 = StringCharCodeAt(receiver, position);
-    // And return the single character string with only that {code}
-    return StringFromSingleCharCode(code);
-  }
+transitioning builtin StringAddConvertRight(implicit context: Context)(
+    left: String, right: JSAny): String {
+  return left + ToStringImpl(context, ToPrimitiveDefault(right));
+}
+
+builtin StringCharAt(implicit context: Context)(
+    receiver: String, position: uintptr): String {
+  // Load the character code at the {position} from the {receiver}.
+  const code: int32 = StringCharCodeAt(receiver, position);
+  // And return the single character string with only that {code}
+  return StringFromSingleCharCode(code);
+}
 }
diff --git a/deps/v8/src/builtins/builtins-trace.cc b/deps/v8/src/builtins/builtins-trace.cc
index b067bb0249f..e98b38d1a5d 100644
--- a/deps/v8/src/builtins/builtins-trace.cc
+++ b/deps/v8/src/builtins/builtins-trace.cc
@@ -10,6 +10,10 @@
 #include "src/logging/counters.h"
 #include "src/objects/objects-inl.h"
 
+#if defined(V8_USE_PERFETTO)
+#include "protos/perfetto/trace/track_event/debug_annotation.pbzero.h"
+#endif
+
 namespace v8 {
 namespace internal {
 
@@ -69,6 +73,7 @@ class MaybeUtf8 {
   std::unique_ptr<uint8_t> allocated_;
 };
 
+#if !defined(V8_USE_PERFETTO)
 class JsonTraceValue : public ConvertableToTraceFormat {
  public:
   explicit JsonTraceValue(Isolate* isolate, Handle<String> object) {
@@ -91,6 +96,7 @@ const uint8_t* GetCategoryGroupEnabled(Isolate* isolate,
   MaybeUtf8 category(isolate, string);
   return TRACE_EVENT_API_GET_CATEGORY_GROUP_ENABLED(*category);
 }
+#endif  // !defined(V8_USE_PERFETTO)
 
 #undef MAX_STACK_LENGTH
 
@@ -104,8 +110,15 @@ BUILTIN(IsTraceCategoryEnabled) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewTypeError(MessageTemplate::kTraceEventCategoryError));
   }
-  return isolate->heap()->ToBoolean(
-      *GetCategoryGroupEnabled(isolate, Handle<String>::cast(category)));
+  bool enabled;
+#if defined(V8_USE_PERFETTO)
+  MaybeUtf8 category_str(isolate, Handle<String>::cast(category));
+  perfetto::DynamicCategory dynamic_category{*category_str};
+  enabled = TRACE_EVENT_CATEGORY_ENABLED(dynamic_category);
+#else
+  enabled = *GetCategoryGroupEnabled(isolate, Handle<String>::cast(category));
+#endif
+  return isolate->heap()->ToBoolean(enabled);
 }
 
 // Builtins::kTrace(phase, category, name, id, data) : bool
@@ -118,18 +131,23 @@ BUILTIN(Trace) {
   Handle<Object> id_arg = args.atOrUndefined(isolate, 4);
   Handle<Object> data_arg = args.atOrUndefined(isolate, 5);
 
-  const uint8_t* category_group_enabled =
-      GetCategoryGroupEnabled(isolate, Handle<String>::cast(category));
-
   // Exit early if the category group is not enabled.
-  if (!*category_group_enabled) {
+#if defined(V8_USE_PERFETTO)
+  MaybeUtf8 category_str(isolate, Handle<String>::cast(category));
+  perfetto::DynamicCategory dynamic_category{*category_str};
+  if (!TRACE_EVENT_CATEGORY_ENABLED(dynamic_category))
     return ReadOnlyRoots(isolate).false_value();
-  }
+#else
+  const uint8_t* category_group_enabled =
+      GetCategoryGroupEnabled(isolate, Handle<String>::cast(category));
+  if (!*category_group_enabled) return ReadOnlyRoots(isolate).false_value();
+#endif
 
   if (!phase_arg->IsNumber()) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewTypeError(MessageTemplate::kTraceEventPhaseError));
   }
+  char phase = static_cast<char>(DoubleToInt32(phase_arg->Number()));
   if (!category->IsString()) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewTypeError(MessageTemplate::kTraceEventCategoryError));
@@ -160,32 +178,67 @@ BUILTIN(Trace) {
   // We support passing one additional trace event argument with the
   // name "data". Any JSON serializable value may be passed.
   static const char* arg_name = "data";
+  Handle<Object> arg_json;
   int32_t num_args = 0;
-  uint8_t arg_type;
-  uint64_t arg_value;
-
   if (!data_arg->IsUndefined(isolate)) {
     // Serializes the data argument as a JSON string, which is then
     // copied into an object. This eliminates duplicated code but
     // could have perf costs. It is also subject to all the same
     // limitations as JSON.stringify() as it relates to circular
     // references and value limitations (e.g. BigInt is not supported).
-    Handle<Object> result;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, result,
+        isolate, arg_json,
         JsonStringify(isolate, data_arg, isolate->factory()->undefined_value(),
                       isolate->factory()->undefined_value()));
-    std::unique_ptr<JsonTraceValue> traced_value;
-    traced_value.reset(
-        new JsonTraceValue(isolate, Handle<String>::cast(result)));
-    tracing::SetTraceValue(std::move(traced_value), &arg_type, &arg_value);
     num_args++;
   }
 
+#if defined(V8_USE_PERFETTO)
+  auto trace_args = [&](perfetto::EventContext ctx) {
+    // TODO(skyostil): Use interned names to reduce trace size.
+    if (phase != TRACE_EVENT_PHASE_END) {
+      ctx.event()->set_name(*name);
+    }
+    if (num_args) {
+      MaybeUtf8 arg_contents(isolate, Handle<String>::cast(arg_json));
+      auto annotation = ctx.event()->add_debug_annotations();
+      annotation->set_name(arg_name);
+      annotation->set_legacy_json_value(*arg_contents);
+    }
+    if (flags & TRACE_EVENT_FLAG_HAS_ID) {
+      auto legacy_event = ctx.event()->set_legacy_event();
+      legacy_event->set_global_id(id);
+    }
+  };
+
+  switch (phase) {
+    case TRACE_EVENT_PHASE_BEGIN:
+      TRACE_EVENT_BEGIN(dynamic_category, nullptr, trace_args);
+      break;
+    case TRACE_EVENT_PHASE_END:
+      TRACE_EVENT_END(dynamic_category, trace_args);
+      break;
+    case TRACE_EVENT_PHASE_INSTANT:
+      TRACE_EVENT_INSTANT(dynamic_category, nullptr, trace_args);
+      break;
+    default:
+      THROW_NEW_ERROR_RETURN_FAILURE(
+          isolate, NewTypeError(MessageTemplate::kTraceEventPhaseError));
+  }
+
+#else   // !defined(V8_USE_PERFETTO)
+  uint8_t arg_type;
+  uint64_t arg_value;
+  if (num_args) {
+    std::unique_ptr<JsonTraceValue> traced_value(
+        new JsonTraceValue(isolate, Handle<String>::cast(arg_json)));
+    tracing::SetTraceValue(std::move(traced_value), &arg_type, &arg_value);
+  }
+
   TRACE_EVENT_API_ADD_TRACE_EVENT(
-      static_cast<char>(DoubleToInt32(phase_arg->Number())),
-      category_group_enabled, *name, tracing::kGlobalScope, id, tracing::kNoId,
-      num_args, &arg_name, &arg_type, &arg_value, flags);
+      phase, category_group_enabled, *name, tracing::kGlobalScope, id,
+      tracing::kNoId, num_args, &arg_name, &arg_type, &arg_value, flags);
+#endif  // !defined(V8_USE_PERFETTO)
 
   return ReadOnlyRoots(isolate).true_value();
 }
diff --git a/deps/v8/src/builtins/builtins-typed-array-gen.cc b/deps/v8/src/builtins/builtins-typed-array-gen.cc
index 021a0e9240c..b359b438c74 100644
--- a/deps/v8/src/builtins/builtins-typed-array-gen.cc
+++ b/deps/v8/src/builtins/builtins-typed-array-gen.cc
@@ -65,8 +65,9 @@ TNode<JSArrayBuffer> TypedArrayBuiltinsAssembler::AllocateEmptyOnHeapBuffer(
 
   StoreObjectFieldNoWriteBarrier(buffer, JSArrayBuffer::kByteLengthOffset,
                                  byte_length);
-  StoreObjectFieldNoWriteBarrier(buffer, JSArrayBuffer::kBackingStoreOffset,
-                                 IntPtrConstant(0));
+  StoreJSArrayBufferBackingStore(
+      buffer,
+      EncodeExternalPointer(ReinterpretCast<RawPtrT>(IntPtrConstant(0))));
   if (V8_ARRAY_BUFFER_EXTENSION_BOOL) {
     StoreObjectFieldNoWriteBarrier(buffer, JSArrayBuffer::kExtensionOffset,
                                    IntPtrConstant(0));
@@ -239,7 +240,7 @@ TNode<JSArrayBuffer> TypedArrayBuiltinsAssembler::GetBuffer(
 
   TNode<JSArrayBuffer> buffer = LoadJSArrayBufferViewBuffer(array);
   GotoIf(IsDetachedBuffer(buffer), &call_runtime);
-  TNode<RawPtrT> backing_store = LoadJSArrayBufferBackingStore(buffer);
+  TNode<RawPtrT> backing_store = LoadJSArrayBufferBackingStorePtr(buffer);
   GotoIf(WordEqual(backing_store, IntPtrConstant(0)), &call_runtime);
   var_result = buffer;
   Goto(&done);
@@ -397,8 +398,8 @@ void TypedArrayBuiltinsAssembler::SetJSTypedArrayOnHeapDataPtr(
   }
 
   StoreObjectField(holder, JSTypedArray::kBasePointerOffset, base);
-  StoreObjectFieldNoWriteBarrier<UintPtrT>(
-      holder, JSTypedArray::kExternalPointerOffset, offset);
+  StoreJSTypedArrayExternalPointer(
+      holder, EncodeExternalPointer(ReinterpretCast<RawPtrT>(offset)));
 }
 
 void TypedArrayBuiltinsAssembler::SetJSTypedArrayOffHeapDataPtr(
@@ -407,8 +408,7 @@ void TypedArrayBuiltinsAssembler::SetJSTypedArrayOffHeapDataPtr(
                                  SmiConstant(0));
 
   base = RawPtrAdd(base, Signed(offset));
-  StoreObjectFieldNoWriteBarrier<RawPtrT>(
-      holder, JSTypedArray::kExternalPointerOffset, base);
+  StoreJSTypedArrayExternalPointer(holder, EncodeExternalPointer(base));
 }
 
 void TypedArrayBuiltinsAssembler::StoreJSTypedArrayElementFromNumeric(
@@ -505,49 +505,5 @@ TF_BUILTIN(TypedArrayPrototypeToStringTag, TypedArrayBuiltinsAssembler) {
   BIND(&return_undefined);
   Return(UndefinedConstant());
 }
-
-void TypedArrayBuiltinsAssembler::GenerateTypedArrayPrototypeIterationMethod(
-    TNode<Context> context, TNode<Object> receiver, const char* method_name,
-    IterationKind kind) {
-  Label throw_bad_receiver(this, Label::kDeferred);
-
-  GotoIf(TaggedIsSmi(receiver), &throw_bad_receiver);
-  GotoIfNot(IsJSTypedArray(CAST(receiver)), &throw_bad_receiver);
-
-  // Check if the {receiver}'s JSArrayBuffer was detached.
-  ThrowIfArrayBufferViewBufferIsDetached(context, CAST(receiver), method_name);
-
-  Return(CreateArrayIterator(context, receiver, kind));
-
-  BIND(&throw_bad_receiver);
-  ThrowTypeError(context, MessageTemplate::kNotTypedArray, method_name);
-}
-
-// ES #sec-%typedarray%.prototype.values
-TF_BUILTIN(TypedArrayPrototypeValues, TypedArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  GenerateTypedArrayPrototypeIterationMethod(context, receiver,
-                                             "%TypedArray%.prototype.values()",
-                                             IterationKind::kValues);
-}
-
-// ES #sec-%typedarray%.prototype.entries
-TF_BUILTIN(TypedArrayPrototypeEntries, TypedArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  GenerateTypedArrayPrototypeIterationMethod(context, receiver,
-                                             "%TypedArray%.prototype.entries()",
-                                             IterationKind::kEntries);
-}
-
-// ES #sec-%typedarray%.prototype.keys
-TF_BUILTIN(TypedArrayPrototypeKeys, TypedArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  GenerateTypedArrayPrototypeIterationMethod(
-      context, receiver, "%TypedArray%.prototype.keys()", IterationKind::kKeys);
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-typed-array-gen.h b/deps/v8/src/builtins/builtins-typed-array-gen.h
index 1008b6bdd73..7b725ffc41f 100644
--- a/deps/v8/src/builtins/builtins-typed-array-gen.h
+++ b/deps/v8/src/builtins/builtins-typed-array-gen.h
@@ -16,11 +16,6 @@ class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
   explicit TypedArrayBuiltinsAssembler(compiler::CodeAssemblerState* state)
       : CodeStubAssembler(state) {}
 
-  void GenerateTypedArrayPrototypeIterationMethod(TNode<Context> context,
-                                                  TNode<Object> receiver,
-                                                  const char* method_name,
-                                                  IterationKind iteration_kind);
-
   void SetupTypedArrayEmbedderFields(TNode<JSTypedArray> holder);
   void AttachBuffer(TNode<JSTypedArray> holder, TNode<JSArrayBuffer> buffer,
                     TNode<Map> map, TNode<Smi> length,
diff --git a/deps/v8/src/builtins/builtins-wasm-gen.cc b/deps/v8/src/builtins/builtins-wasm-gen.cc
index 770f5da97b3..1932db3ff40 100644
--- a/deps/v8/src/builtins/builtins-wasm-gen.cc
+++ b/deps/v8/src/builtins/builtins-wasm-gen.cc
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/builtins/builtins-wasm-gen.h"
+
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/codegen/code-stub-assembler.h"
 #include "src/codegen/interface-descriptors.h"
@@ -12,87 +14,43 @@
 namespace v8 {
 namespace internal {
 
-class WasmBuiltinsAssembler : public CodeStubAssembler {
- public:
-  explicit WasmBuiltinsAssembler(compiler::CodeAssemblerState* state)
-      : CodeStubAssembler(state) {}
-
- protected:
-  TNode<WasmInstanceObject> LoadInstanceFromFrame() {
-    return CAST(
-        LoadFromParentFrame(WasmCompiledFrameConstants::kWasmInstanceOffset));
-  }
-
-  TNode<Context> LoadContextFromInstance(TNode<WasmInstanceObject> instance) {
-    return CAST(Load(MachineType::AnyTagged(), instance,
-                     IntPtrConstant(WasmInstanceObject::kNativeContextOffset -
-                                    kHeapObjectTag)));
-  }
-
-  TNode<Smi> SmiFromUint32WithSaturation(TNode<Uint32T> value, uint32_t max) {
-    DCHECK_LE(max, static_cast<uint32_t>(Smi::kMaxValue));
-    TNode<Uint32T> capped_value = SelectConstant(
-        Uint32LessThan(value, Uint32Constant(max)), value, Uint32Constant(max));
-    return SmiFromUint32(capped_value);
-  }
-};
-
-TF_BUILTIN(WasmStackGuard, WasmBuiltinsAssembler) {
-  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
-  TNode<Context> context = LoadContextFromInstance(instance);
-  TailCallRuntime(Runtime::kWasmStackGuard, context);
+TNode<WasmInstanceObject> WasmBuiltinsAssembler::LoadInstanceFromFrame() {
+  return CAST(LoadFromParentFrame(WasmFrameConstants::kWasmInstanceOffset));
 }
 
-TF_BUILTIN(WasmStackOverflow, WasmBuiltinsAssembler) {
-  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
-  TNode<Context> context = LoadContextFromInstance(instance);
-  TailCallRuntime(Runtime::kThrowWasmStackOverflow, context);
+TNode<NativeContext> WasmBuiltinsAssembler::LoadContextFromInstance(
+    TNode<WasmInstanceObject> instance) {
+  return CAST(Load(MachineType::AnyTagged(), instance,
+                   IntPtrConstant(WasmInstanceObject::kNativeContextOffset -
+                                  kHeapObjectTag)));
 }
 
-TF_BUILTIN(WasmThrow, WasmBuiltinsAssembler) {
-  TNode<Object> exception = CAST(Parameter(Descriptor::kException));
-  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
-  TNode<Context> context = LoadContextFromInstance(instance);
-  TailCallRuntime(Runtime::kThrow, context, exception);
+TNode<FixedArray> WasmBuiltinsAssembler::LoadTablesFromInstance(
+    TNode<WasmInstanceObject> instance) {
+  return LoadObjectField<FixedArray>(instance,
+                                     WasmInstanceObject::kTablesOffset);
 }
 
-TF_BUILTIN(WasmRethrow, WasmBuiltinsAssembler) {
-  TNode<Object> exception = CAST(Parameter(Descriptor::kException));
-  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
-  TNode<Context> context = LoadContextFromInstance(instance);
-
-  Label nullref(this, Label::kDeferred);
-  GotoIf(TaggedEqual(NullConstant(), exception), &nullref);
-
-  TailCallRuntime(Runtime::kReThrow, context, exception);
-
-  BIND(&nullref);
-  MessageTemplate message_id = MessageTemplate::kWasmTrapRethrowNullRef;
-  TailCallRuntime(Runtime::kThrowWasmError, context,
-                  SmiConstant(static_cast<int>(message_id)));
+TNode<FixedArray> WasmBuiltinsAssembler::LoadExternalFunctionsFromInstance(
+    TNode<WasmInstanceObject> instance) {
+  return LoadObjectField<FixedArray>(
+      instance, WasmInstanceObject::kWasmExternalFunctionsOffset);
 }
 
-TF_BUILTIN(WasmTraceMemory, WasmBuiltinsAssembler) {
-  TNode<Smi> info = CAST(Parameter(Descriptor::kMemoryTracingInfo));
-  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
-  TNode<Context> context = LoadContextFromInstance(instance);
-  TailCallRuntime(Runtime::kWasmTraceMemory, context, info);
+TNode<FixedArray> WasmBuiltinsAssembler::LoadManagedObjectMapsFromInstance(
+    TNode<WasmInstanceObject> instance) {
+  return LoadObjectField<FixedArray>(
+      instance, WasmInstanceObject::kManagedObjectMapsOffset);
 }
 
-TF_BUILTIN(WasmAtomicNotify, WasmBuiltinsAssembler) {
-  TNode<Uint32T> address =
-      UncheckedCast<Uint32T>(Parameter(Descriptor::kAddress));
-  TNode<Uint32T> count = UncheckedCast<Uint32T>(Parameter(Descriptor::kCount));
-
-  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
-  TNode<Number> address_number = ChangeUint32ToTagged(address);
-  TNode<Number> count_number = ChangeUint32ToTagged(count);
-  TNode<Context> context = LoadContextFromInstance(instance);
+TF_BUILTIN(WasmFloat32ToNumber, WasmBuiltinsAssembler) {
+  TNode<Float32T> val = UncheckedCast<Float32T>(Parameter(Descriptor::kValue));
+  Return(ChangeFloat32ToTagged(val));
+}
 
-  TNode<Smi> result_smi =
-      CAST(CallRuntime(Runtime::kWasmAtomicNotify, context, instance,
-                       address_number, count_number));
-  Return(Unsigned(SmiToInt32(result_smi)));
+TF_BUILTIN(WasmFloat64ToNumber, WasmBuiltinsAssembler) {
+  TNode<Float64T> val = UncheckedCast<Float64T>(Parameter(Descriptor::kValue));
+  Return(ChangeFloat64ToTagged(val));
 }
 
 TF_BUILTIN(WasmI32AtomicWait32, WasmBuiltinsAssembler) {
@@ -124,33 +82,6 @@ TF_BUILTIN(WasmI32AtomicWait32, WasmBuiltinsAssembler) {
   Return(Unsigned(SmiToInt32(result_smi)));
 }
 
-TF_BUILTIN(WasmI32AtomicWait64, WasmBuiltinsAssembler) {
-  if (!Is64()) {
-    Unreachable();
-    return;
-  }
-
-  TNode<Uint32T> address =
-      UncheckedCast<Uint32T>(Parameter(Descriptor::kAddress));
-  TNode<Number> address_number = ChangeUint32ToTagged(address);
-
-  TNode<Int32T> expected_value =
-      UncheckedCast<Int32T>(Parameter(Descriptor::kExpectedValue));
-  TNode<Number> expected_value_number = ChangeInt32ToTagged(expected_value);
-
-  TNode<IntPtrT> timeout_raw =
-      UncheckedCast<IntPtrT>(Parameter(Descriptor::kTimeout));
-  TNode<BigInt> timeout = BigIntFromInt64(timeout_raw);
-
-  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
-  TNode<Context> context = LoadContextFromInstance(instance);
-
-  TNode<Smi> result_smi =
-      CAST(CallRuntime(Runtime::kWasmI32AtomicWait, context, instance,
-                       address_number, expected_value_number, timeout));
-  Return(Unsigned(SmiToInt32(result_smi)));
-}
-
 TF_BUILTIN(WasmI64AtomicWait32, WasmBuiltinsAssembler) {
   if (!Is32()) {
     Unreachable();
@@ -183,172 +114,29 @@ TF_BUILTIN(WasmI64AtomicWait32, WasmBuiltinsAssembler) {
   Return(Unsigned(SmiToInt32(result_smi)));
 }
 
-TF_BUILTIN(WasmI64AtomicWait64, WasmBuiltinsAssembler) {
-  if (!Is64()) {
-    Unreachable();
-    return;
-  }
-
-  TNode<Uint32T> address =
-      UncheckedCast<Uint32T>(Parameter(Descriptor::kAddress));
-  TNode<Number> address_number = ChangeUint32ToTagged(address);
-
-  TNode<IntPtrT> expected_value_raw =
-      UncheckedCast<IntPtrT>(Parameter(Descriptor::kExpectedValue));
-  TNode<BigInt> expected_value = BigIntFromInt64(expected_value_raw);
-
-  TNode<IntPtrT> timeout_raw =
-      UncheckedCast<IntPtrT>(Parameter(Descriptor::kTimeout));
-  TNode<BigInt> timeout = BigIntFromInt64(timeout_raw);
-
-  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
-  TNode<Context> context = LoadContextFromInstance(instance);
-
-  TNode<Smi> result_smi =
-      CAST(CallRuntime(Runtime::kWasmI64AtomicWait, context, instance,
-                       address_number, expected_value, timeout));
-  Return(Unsigned(SmiToInt32(result_smi)));
-}
-
-TF_BUILTIN(WasmMemoryGrow, WasmBuiltinsAssembler) {
-  TNode<Int32T> num_pages =
-      UncheckedCast<Int32T>(Parameter(Descriptor::kNumPages));
-  Label num_pages_out_of_range(this, Label::kDeferred);
-
-  TNode<BoolT> num_pages_fits_in_smi =
-      IsValidPositiveSmi(ChangeInt32ToIntPtr(num_pages));
-  GotoIfNot(num_pages_fits_in_smi, &num_pages_out_of_range);
-
-  TNode<Smi> num_pages_smi = SmiFromInt32(num_pages);
-  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
-  TNode<Context> context = LoadContextFromInstance(instance);
-  TNode<Smi> ret_smi = CAST(
-      CallRuntime(Runtime::kWasmMemoryGrow, context, instance, num_pages_smi));
-  Return(SmiToInt32(ret_smi));
-
-  BIND(&num_pages_out_of_range);
-  Return(Int32Constant(-1));
-}
-
-TF_BUILTIN(WasmTableInit, WasmBuiltinsAssembler) {
-  TNode<Uint32T> dst_raw =
-      UncheckedCast<Uint32T>(Parameter(Descriptor::kDestination));
-  // We cap {dst}, {src}, and {size} by {wasm::kV8MaxWasmTableSize + 1} to make
-  // sure that the values fit into a Smi.
-  STATIC_ASSERT(static_cast<size_t>(Smi::kMaxValue) >=
-                wasm::kV8MaxWasmTableSize + 1);
-  constexpr uint32_t kCap =
-      static_cast<uint32_t>(wasm::kV8MaxWasmTableSize + 1);
-  TNode<Smi> dst = SmiFromUint32WithSaturation(dst_raw, kCap);
-  TNode<Uint32T> src_raw =
-      UncheckedCast<Uint32T>(Parameter(Descriptor::kSource));
-  TNode<Smi> src = SmiFromUint32WithSaturation(src_raw, kCap);
-  TNode<Uint32T> size_raw =
-      UncheckedCast<Uint32T>(Parameter(Descriptor::kSize));
-  TNode<Smi> size = SmiFromUint32WithSaturation(size_raw, kCap);
-  TNode<Smi> table_index =
-      UncheckedCast<Smi>(Parameter(Descriptor::kTableIndex));
-  TNode<Smi> segment_index =
-      UncheckedCast<Smi>(Parameter(Descriptor::kSegmentIndex));
-  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
-  TNode<Context> context = LoadContextFromInstance(instance);
-
-  TailCallRuntime(Runtime::kWasmTableInit, context, instance, table_index,
-                  segment_index, dst, src, size);
-}
-
-TF_BUILTIN(WasmTableCopy, WasmBuiltinsAssembler) {
-  // We cap {dst}, {src}, and {size} by {wasm::kV8MaxWasmTableSize + 1} to make
-  // sure that the values fit into a Smi.
-  STATIC_ASSERT(static_cast<size_t>(Smi::kMaxValue) >=
-                wasm::kV8MaxWasmTableSize + 1);
-  constexpr uint32_t kCap =
-      static_cast<uint32_t>(wasm::kV8MaxWasmTableSize + 1);
-
-  TNode<Uint32T> dst_raw =
-      UncheckedCast<Uint32T>(Parameter(Descriptor::kDestination));
-  TNode<Smi> dst = SmiFromUint32WithSaturation(dst_raw, kCap);
-
-  TNode<Uint32T> src_raw =
-      UncheckedCast<Uint32T>(Parameter(Descriptor::kSource));
-  TNode<Smi> src = SmiFromUint32WithSaturation(src_raw, kCap);
-
-  TNode<Uint32T> size_raw =
-      UncheckedCast<Uint32T>(Parameter(Descriptor::kSize));
-  TNode<Smi> size = SmiFromUint32WithSaturation(size_raw, kCap);
-
-  TNode<Smi> dst_table =
-      UncheckedCast<Smi>(Parameter(Descriptor::kDestinationTable));
-
-  TNode<Smi> src_table =
-      UncheckedCast<Smi>(Parameter(Descriptor::kSourceTable));
-
+TF_BUILTIN(WasmAllocateArray, WasmBuiltinsAssembler) {
   TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
-  TNode<Context> context = LoadContextFromInstance(instance);
-
-  TailCallRuntime(Runtime::kWasmTableCopy, context, instance, dst_table,
-                  src_table, dst, src, size);
+  TNode<Smi> map_index = CAST(Parameter(Descriptor::kMapIndex));
+  TNode<Smi> length = CAST(Parameter(Descriptor::kLength));
+  TNode<Smi> element_size = CAST(Parameter(Descriptor::kElementSize));
+  TNode<FixedArray> maps_list = LoadObjectField<FixedArray>(
+      instance, WasmInstanceObject::kManagedObjectMapsOffset);
+  TNode<Map> map = CAST(LoadFixedArrayElement(maps_list, map_index));
+  TNode<IntPtrT> untagged_length = SmiUntag(length);
+  // instance_size = WasmArray::kHeaderSize
+  //               + RoundUp(element_size * length, kObjectAlignment)
+  TNode<IntPtrT> raw_size = IntPtrMul(SmiUntag(element_size), untagged_length);
+  TNode<IntPtrT> rounded_size =
+      WordAnd(IntPtrAdd(raw_size, IntPtrConstant(kObjectAlignmentMask)),
+              IntPtrConstant(~kObjectAlignmentMask));
+  TNode<IntPtrT> instance_size =
+      IntPtrAdd(IntPtrConstant(WasmArray::kHeaderSize), rounded_size);
+  TNode<WasmArray> result = UncheckedCast<WasmArray>(Allocate(instance_size));
+  StoreMap(result, map);
+  StoreObjectFieldNoWriteBarrier(result, WasmArray::kLengthOffset,
+                                 TruncateIntPtrToInt32(untagged_length));
+  Return(result);
 }
 
-TF_BUILTIN(WasmTableGet, WasmBuiltinsAssembler) {
-  TNode<Int32T> entry_index =
-      UncheckedCast<Int32T>(Parameter(Descriptor::kEntryIndex));
-  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
-  TNode<Context> context = LoadContextFromInstance(instance);
-  Label entry_index_out_of_range(this, Label::kDeferred);
-
-  TNode<BoolT> entry_index_fits_in_smi =
-      IsValidPositiveSmi(ChangeInt32ToIntPtr(entry_index));
-  GotoIfNot(entry_index_fits_in_smi, &entry_index_out_of_range);
-
-  TNode<Smi> entry_index_smi = SmiFromInt32(entry_index);
-  TNode<Smi> table_index_smi = CAST(Parameter(Descriptor::kTableIndex));
-
-  TailCallRuntime(Runtime::kWasmFunctionTableGet, context, instance,
-                  table_index_smi, entry_index_smi);
-
-  BIND(&entry_index_out_of_range);
-  MessageTemplate message_id =
-      wasm::WasmOpcodes::TrapReasonToMessageId(wasm::kTrapTableOutOfBounds);
-  TailCallRuntime(Runtime::kThrowWasmError, context,
-                  SmiConstant(static_cast<int>(message_id)));
-}
-
-TF_BUILTIN(WasmTableSet, WasmBuiltinsAssembler) {
-  TNode<Int32T> entry_index =
-      UncheckedCast<Int32T>(Parameter(Descriptor::kEntryIndex));
-  TNode<WasmInstanceObject> instance = LoadInstanceFromFrame();
-  TNode<Context> context = LoadContextFromInstance(instance);
-  Label entry_index_out_of_range(this, Label::kDeferred);
-
-  TNode<BoolT> entry_index_fits_in_smi =
-      IsValidPositiveSmi(ChangeInt32ToIntPtr(entry_index));
-  GotoIfNot(entry_index_fits_in_smi, &entry_index_out_of_range);
-
-  TNode<Smi> entry_index_smi = SmiFromInt32(entry_index);
-  TNode<Smi> table_index_smi = CAST(Parameter(Descriptor::kTableIndex));
-  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
-  TailCallRuntime(Runtime::kWasmFunctionTableSet, context, instance,
-                  table_index_smi, entry_index_smi, value);
-
-  BIND(&entry_index_out_of_range);
-  MessageTemplate message_id =
-      wasm::WasmOpcodes::TrapReasonToMessageId(wasm::kTrapTableOutOfBounds);
-  TailCallRuntime(Runtime::kThrowWasmError, context,
-                  SmiConstant(static_cast<int>(message_id)));
-}
-
-#define DECLARE_THROW_RUNTIME_FN(name)                            \
-  TF_BUILTIN(ThrowWasm##name, WasmBuiltinsAssembler) {            \
-    TNode<WasmInstanceObject> instance = LoadInstanceFromFrame(); \
-    TNode<Context> context = LoadContextFromInstance(instance);   \
-    MessageTemplate message_id =                                  \
-        wasm::WasmOpcodes::TrapReasonToMessageId(wasm::k##name);  \
-    TailCallRuntime(Runtime::kThrowWasmError, context,            \
-                    SmiConstant(static_cast<int>(message_id)));   \
-  }
-FOREACH_WASM_TRAPREASON(DECLARE_THROW_RUNTIME_FN)
-#undef DECLARE_THROW_RUNTIME_FN
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-wasm-gen.h b/deps/v8/src/builtins/builtins-wasm-gen.h
new file mode 100644
index 00000000000..ccf5bae7a15
--- /dev/null
+++ b/deps/v8/src/builtins/builtins-wasm-gen.h
@@ -0,0 +1,35 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_BUILTINS_BUILTINS_WASM_GEN_H_
+#define V8_BUILTINS_BUILTINS_WASM_GEN_H_
+
+#include "src/codegen/code-stub-assembler.h"
+
+namespace v8 {
+namespace internal {
+
+class WasmBuiltinsAssembler : public CodeStubAssembler {
+ public:
+  explicit WasmBuiltinsAssembler(compiler::CodeAssemblerState* state)
+      : CodeStubAssembler(state) {}
+
+  TNode<WasmInstanceObject> LoadInstanceFromFrame();
+
+  TNode<NativeContext> LoadContextFromInstance(
+      TNode<WasmInstanceObject> instance);
+
+  TNode<FixedArray> LoadTablesFromInstance(TNode<WasmInstanceObject> instance);
+
+  TNode<FixedArray> LoadExternalFunctionsFromInstance(
+      TNode<WasmInstanceObject> instance);
+
+  TNode<FixedArray> LoadManagedObjectMapsFromInstance(
+      TNode<WasmInstanceObject> instance);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_BUILTINS_BUILTINS_WASM_GEN_H_
diff --git a/deps/v8/src/builtins/builtins-weak-refs.cc b/deps/v8/src/builtins/builtins-weak-refs.cc
index e75c7fae9d1..d5cceda4541 100644
--- a/deps/v8/src/builtins/builtins-weak-refs.cc
+++ b/deps/v8/src/builtins/builtins-weak-refs.cc
@@ -36,7 +36,7 @@ BUILTIN(FinalizationRegistryConstructor) {
   finalization_registry->set_native_context(*isolate->native_context());
   finalization_registry->set_cleanup(*cleanup);
   finalization_registry->set_flags(
-      JSFinalizationRegistry::ScheduledForCleanupField::encode(false));
+      JSFinalizationRegistry::ScheduledForCleanupBit::encode(false));
 
   DCHECK(finalization_registry->active_cells().IsUndefined(isolate));
   DCHECK(finalization_registry->cleared_cells().IsUndefined(isolate));
@@ -122,61 +122,6 @@ BUILTIN(FinalizationRegistryUnregister) {
   return *isolate->factory()->ToBoolean(success);
 }
 
-BUILTIN(FinalizationRegistryCleanupSome) {
-  HandleScope scope(isolate);
-  const char* method_name = "FinalizationRegistry.prototype.cleanupSome";
-
-  // 1. Let finalizationGroup be the this value.
-  //
-  // 2. If Type(finalizationGroup) is not Object, throw a TypeError
-  //    exception.
-  //
-  // 3. If finalizationGroup does not have a [[Cells]] internal slot,
-  //    throw a TypeError exception.
-  CHECK_RECEIVER(JSFinalizationRegistry, finalization_registry, method_name);
-
-  Handle<Object> callback(finalization_registry->cleanup(), isolate);
-  Handle<Object> callback_obj = args.atOrUndefined(isolate, 1);
-
-  // 4. If callback is not undefined and IsCallable(callback) is
-  //    false, throw a TypeError exception.
-  if (!callback_obj->IsUndefined(isolate)) {
-    if (!callback_obj->IsCallable()) {
-      THROW_NEW_ERROR_RETURN_FAILURE(
-          isolate,
-          NewTypeError(MessageTemplate::kWeakRefsCleanupMustBeCallable));
-    }
-    callback = callback_obj;
-  }
-
-  // Don't do set_scheduled_for_cleanup(false); we still have the task
-  // scheduled.
-  if (JSFinalizationRegistry::Cleanup(isolate, finalization_registry, callback)
-          .IsNothing()) {
-    DCHECK(isolate->has_pending_exception());
-    return ReadOnlyRoots(isolate).exception();
-  }
-  return ReadOnlyRoots(isolate).undefined_value();
-}
-
-BUILTIN(FinalizationRegistryCleanupIteratorNext) {
-  HandleScope scope(isolate);
-  CHECK_RECEIVER(JSFinalizationRegistryCleanupIterator, iterator, "next");
-
-  Handle<JSFinalizationRegistry> finalization_registry(
-      iterator->finalization_registry(), isolate);
-  if (!finalization_registry->NeedsCleanup()) {
-    return *isolate->factory()->NewJSIteratorResult(
-        handle(ReadOnlyRoots(isolate).undefined_value(), isolate), true);
-  }
-  Handle<Object> holdings =
-      handle(JSFinalizationRegistry::PopClearedCellHoldings(
-                 finalization_registry, isolate),
-             isolate);
-
-  return *isolate->factory()->NewJSIteratorResult(holdings, false);
-}
-
 BUILTIN(WeakRefConstructor) {
   HandleScope scope(isolate);
   Handle<JSFunction> target = args.target();
diff --git a/deps/v8/src/builtins/cast.tq b/deps/v8/src/builtins/cast.tq
index cb7ff412dea..2f29b8a0e20 100644
--- a/deps/v8/src/builtins/cast.tq
+++ b/deps/v8/src/builtins/cast.tq
@@ -2,44 +2,46 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-extern macro IsCallable(HeapObject): bool;
+extern macro IsAllocationSite(HeapObject): bool;
+extern macro IsBigInt(HeapObject): bool;
 extern macro IsConstructor(HeapObject): bool;
+extern macro IsContext(HeapObject): bool;
+extern macro IsCustomElementsReceiverInstanceType(int32): bool;
+extern macro IsExtensibleMap(Map): bool;
+extern macro IsFeedbackCell(HeapObject): bool;
 extern macro IsFeedbackVector(HeapObject): bool;
+extern macro IsFixedArray(HeapObject): bool;
+extern macro IsHeapNumber(HeapObject): bool;
 extern macro IsJSArray(HeapObject): bool;
-extern macro IsJSProxy(HeapObject): bool;
-extern macro IsJSRegExp(HeapObject): bool;
-extern macro IsJSRegExpStringIterator(HeapObject): bool;
-extern macro IsMap(HeapObject): bool;
-extern macro IsJSFunction(HeapObject): bool;
+extern macro IsJSArrayMap(Map): bool;
 extern macro IsJSBoundFunction(HeapObject): bool;
+extern macro IsJSFinalizationRegistry(HeapObject): bool;
+extern macro IsJSFunction(HeapObject): bool;
 extern macro IsJSObject(HeapObject): bool;
+extern macro IsJSPrimitiveWrapper(HeapObject): bool;
 extern macro IsJSPromise(HeapObject): bool;
-extern macro IsJSTypedArray(HeapObject): bool;
-extern macro IsNumberDictionary(HeapObject): bool;
-extern macro IsContext(HeapObject): bool;
-extern macro IsNativeContext(HeapObject): bool;
+extern macro IsJSProxy(HeapObject): bool;
 extern macro IsJSReceiver(HeapObject): bool;
-extern macro TaggedIsCallable(Object): bool;
-extern macro IsHeapNumber(HeapObject): bool;
-extern macro IsBigInt(HeapObject): bool;
-extern macro IsFixedArray(HeapObject): bool;
+extern macro IsJSRegExp(HeapObject): bool;
+extern macro IsJSRegExpStringIterator(HeapObject): bool;
+extern macro IsJSTypedArray(HeapObject): bool;
+extern macro IsMap(HeapObject): bool;
 extern macro IsName(HeapObject): bool;
-extern macro IsPrivateSymbol(HeapObject): bool;
-extern macro IsNumber(Object): bool;
+extern macro IsNativeContext(HeapObject): bool;
+extern macro IsNumberDictionary(HeapObject): bool;
 extern macro IsNumberNormalized(Number): bool;
-extern macro IsSafeInteger(Object): bool;
+extern macro IsNumber(Object): bool;
 extern macro IsOddball(HeapObject): bool;
-extern macro IsSymbol(HeapObject): bool;
-extern macro IsJSArrayMap(Map): bool;
-extern macro IsExtensibleMap(Map): bool;
-extern macro IsJSPrimitiveWrapper(HeapObject): bool;
+extern macro IsPrivateSymbol(HeapObject): bool;
 extern macro IsPromiseCapability(HeapObject): bool;
+extern macro IsPromiseFulfillReactionJobTask(HeapObject): bool;
 extern macro IsPromiseReaction(HeapObject): bool;
 extern macro IsPromiseReactionJobTask(HeapObject): bool;
 extern macro IsPromiseRejectReactionJobTask(HeapObject): bool;
-extern macro IsPromiseFulfillReactionJobTask(HeapObject): bool;
+extern macro IsSafeInteger(Object): bool;
 extern macro IsSharedFunctionInfo(HeapObject): bool;
-extern macro IsCustomElementsReceiverInstanceType(int32): bool;
+extern macro IsSymbol(HeapObject): bool;
+extern macro IsTuple2(HeapObject): bool;
 
 extern macro HeapObjectToJSDataView(HeapObject): JSDataView
     labels CastError;
@@ -85,7 +87,17 @@ macro Cast<A : type extends WeakHeapObject>(o: A|Object): A labels CastError {
   return %RawDownCast<A>(o);
 }
 
-macro Cast<A: type>(o: MaybeObject): A labels CastError;
+macro Cast<A : type extends Object>(implicit context: Context)(o: MaybeObject):
+    A labels CastError {
+  typeswitch (o) {
+    case (WeakHeapObject): {
+      goto CastError;
+    }
+    case (o: Object): {
+      return Cast<A>(o) otherwise CastError;
+    }
+  }
+}
 
 Cast<Undefined>(o: MaybeObject): Undefined labels CastError {
   if (TaggedNotEqual(o, Undefined)) goto CastError;
@@ -278,6 +290,12 @@ Cast<Undefined>(o: HeapObject): Undefined
   return Cast<Undefined>(o) otherwise CastError;
 }
 
+Cast<AllocationSite>(o: HeapObject): AllocationSite
+    labels CastError {
+  if (IsAllocationSite(o)) return %RawDownCast<AllocationSite>(o);
+  goto CastError;
+}
+
 Cast<FixedArray>(o: HeapObject): FixedArray
     labels CastError {
   return HeapObjectToFixedArray(o) otherwise CastError;
@@ -399,6 +417,11 @@ Cast<NumberDictionary>(o: HeapObject): NumberDictionary
   goto CastError;
 }
 
+Cast<Name>(o: HeapObject): Name
+    labels CastError {
+  if (IsName(o)) return %RawDownCast<Name>(o);
+  goto CastError;
+}
 Cast<String>(o: HeapObject): String
     labels CastError {
   return HeapObjectToString(o) otherwise CastError;
@@ -481,6 +504,12 @@ Cast<Map>(implicit context: Context)(o: HeapObject): Map
   goto CastError;
 }
 
+Cast<FeedbackCell>(implicit context: Context)(o: HeapObject): FeedbackCell
+    labels CastError {
+  if (IsFeedbackCell(o)) return %RawDownCast<FeedbackCell>(o);
+  goto CastError;
+}
+
 Cast<FeedbackVector>(implicit context: Context)(o: HeapObject): FeedbackVector
     labels CastError {
   if (IsFeedbackVector(o)) return %RawDownCast<FeedbackVector>(o);
@@ -627,6 +656,13 @@ Cast<CoverageInfo>(implicit context: Context)(o: HeapObject): CoverageInfo
   goto CastError;
 }
 
+extern macro IsAccessorInfo(HeapObject): bool;
+Cast<AccessorInfo>(o: HeapObject): AccessorInfo
+    labels CastError {
+  if (IsAccessorInfo(o)) return %RawDownCast<AccessorInfo>(o);
+  goto CastError;
+}
+
 Cast<JSReceiver|Null>(o: HeapObject): JSReceiver|Null
     labels CastError {
   typeswitch (o) {
@@ -720,6 +756,21 @@ Cast<JSBoundFunction>(o: HeapObject): JSBoundFunction labels CastError {
   goto CastError;
 }
 
+Cast<JSFunction|JSBoundFunction>(implicit context: Context)(o: Object):
+    JSFunction|JSBoundFunction labels CastError {
+  typeswitch (o) {
+    case (o: JSFunction): {
+      return o;
+    }
+    case (o: JSBoundFunction): {
+      return o;
+    }
+    case (Object): {
+      goto CastError;
+    }
+  }
+}
+
 Cast<PromiseCapability>(o: HeapObject): PromiseCapability labels CastError {
   if (IsPromiseCapability(o)) return %RawDownCast<PromiseCapability>(o);
   goto CastError;
@@ -735,8 +786,21 @@ Cast<JSPromise>(o: HeapObject): JSPromise labels CastError {
   goto CastError;
 }
 
+Cast<JSFinalizationRegistry>(o: HeapObject):
+    JSFinalizationRegistry labels CastError {
+  if (IsJSFinalizationRegistry(o)) {
+    return %RawDownCast<JSFinalizationRegistry>(o);
+  }
+  goto CastError;
+}
+
 UnsafeCast<RegExpMatchInfo>(implicit context: Context)(o: Object):
     RegExpMatchInfo {
   assert(Is<FixedArray>(o));
   return %RawDownCast<RegExpMatchInfo>(o);
 }
+
+macro CastOrDefault<T: type, Arg: type, Default: type>(
+    implicit context: Context)(x: Arg, default: Default): T|Default {
+  return Cast<T>(x) otherwise return default;
+}
diff --git a/deps/v8/src/builtins/collections.tq b/deps/v8/src/builtins/collections.tq
index 60136af6336..c0d311a825f 100644
--- a/deps/v8/src/builtins/collections.tq
+++ b/deps/v8/src/builtins/collections.tq
@@ -5,54 +5,53 @@
 #include 'src/builtins/builtins-collections-gen.h'
 
 namespace collections {
-  @export
-  macro LoadKeyValuePairNoSideEffects(implicit context: Context)(o: JSAny):
-      KeyValuePair labels MayHaveSideEffects {
-    typeswitch (o) {
-      case (a: FastJSArray): {
-        const length: Smi = a.length;
-        typeswitch (a.elements) {
-          case (elements: FixedArray): {
-            return KeyValuePair{
-              key: length > 0 ? array::LoadElementOrUndefined(elements, 0) :
-                                Undefined,
-              value: length > 1 ? array::LoadElementOrUndefined(elements, 1) :
-                                  Undefined
-            };
-          }
-          case (elements: FixedDoubleArray): {
-            return KeyValuePair{
-              key: length > 0 ? array::LoadElementOrUndefined(elements, 0) :
-                                Undefined,
-              value: length > 1 ? array::LoadElementOrUndefined(elements, 1) :
-                                  Undefined
-            };
-          }
-          case (FixedArrayBase): deferred {
-            unreachable;
-          }
+@export
+macro LoadKeyValuePairNoSideEffects(implicit context: Context)(o: JSAny):
+    KeyValuePair labels MayHaveSideEffects {
+  typeswitch (o) {
+    case (a: FastJSArray): {
+      const length: Smi = a.length;
+      typeswitch (a.elements) {
+        case (elements: FixedArray): {
+          return KeyValuePair{
+            key: length > 0 ? array::LoadElementOrUndefined(elements, 0) :
+                              Undefined,
+            value: length > 1 ? array::LoadElementOrUndefined(elements, 1) :
+                                Undefined
+          };
+        }
+        case (elements: FixedDoubleArray): {
+          return KeyValuePair{
+            key: length > 0 ? array::LoadElementOrUndefined(elements, 0) :
+                              Undefined,
+            value: length > 1 ? array::LoadElementOrUndefined(elements, 1) :
+                                Undefined
+          };
+        }
+        case (FixedArrayBase): deferred {
+          unreachable;
         }
-      }
-      case (JSReceiver): {
-        goto MayHaveSideEffects;
-      }
-      case (o: JSAny): deferred {
-        ThrowTypeError(MessageTemplate::kIteratorValueNotAnObject, o);
       }
     }
-  }
-
-  @export
-  transitioning macro LoadKeyValuePair(implicit context: Context)(o: JSAny):
-      KeyValuePair {
-    try {
-      return LoadKeyValuePairNoSideEffects(o) otherwise Generic;
+    case (JSReceiver): {
+      goto MayHaveSideEffects;
     }
-    label Generic {
-      return KeyValuePair{
-        key: GetProperty(o, Convert<Smi>(0)),
-        value: GetProperty(o, Convert<Smi>(1))
-      };
+    case (o: JSAny): deferred {
+      ThrowTypeError(MessageTemplate::kIteratorValueNotAnObject, o);
     }
   }
 }
+
+@export
+transitioning macro LoadKeyValuePair(implicit context: Context)(o: JSAny):
+    KeyValuePair {
+  try {
+    return LoadKeyValuePairNoSideEffects(o) otherwise Generic;
+  } label Generic {
+    return KeyValuePair{
+      key: GetProperty(o, Convert<Smi>(0)),
+      value: GetProperty(o, Convert<Smi>(1))
+    };
+  }
+}
+}
diff --git a/deps/v8/src/builtins/console.tq b/deps/v8/src/builtins/console.tq
index 48d5d08abc4..c0daa19b6df 100644
--- a/deps/v8/src/builtins/console.tq
+++ b/deps/v8/src/builtins/console.tq
@@ -3,16 +3,16 @@
 // found in the LICENSE file.
 
 namespace console {
-  extern builtin ConsoleAssert(implicit context:
-                                   Context)(JSFunction, JSAny, int32): JSAny;
+extern builtin ConsoleAssert(implicit context: Context)(
+    JSFunction, JSAny, int32): JSAny;
 
-  javascript builtin FastConsoleAssert(
-      js-implicit context: NativeContext, receiver: JSAny, newTarget: JSAny,
-      target: JSFunction)(...arguments): JSAny {
-    if (ToBoolean(arguments[0])) {
-      return Undefined;
-    } else {
-      tail ConsoleAssert(target, newTarget, Convert<int32>(arguments.length));
-    }
+javascript builtin FastConsoleAssert(
+    js-implicit context: NativeContext, receiver: JSAny, newTarget: JSAny,
+    target: JSFunction)(...arguments): JSAny {
+  if (ToBoolean(arguments[0])) {
+    return Undefined;
+  } else {
+    tail ConsoleAssert(target, newTarget, Convert<int32>(arguments.length));
   }
 }
+}
diff --git a/deps/v8/src/builtins/constants-table-builder.cc b/deps/v8/src/builtins/constants-table-builder.cc
index 94e8dc05ec7..fa333726e79 100644
--- a/deps/v8/src/builtins/constants-table-builder.cc
+++ b/deps/v8/src/builtins/constants-table-builder.cc
@@ -57,24 +57,30 @@ uint32_t BuiltinsConstantsTableBuilder::AddObject(Handle<Object> object) {
   }
 }
 
-void BuiltinsConstantsTableBuilder::PatchSelfReference(
-    Handle<Object> self_reference, Handle<Code> code_object) {
-#ifdef DEBUG
+namespace {
+void CheckPreconditionsForPatching(Isolate* isolate,
+                                   Handle<Object> replacement_object) {
   // Roots must not be inserted into the constants table as they are already
-  // accessibly from the root list.
+  // accessible from the root list.
   RootIndex root_list_index;
-  DCHECK(!isolate_->roots_table().IsRootHandle(code_object, &root_list_index));
+  DCHECK(!isolate->roots_table().IsRootHandle(replacement_object,
+                                              &root_list_index));
+  USE(root_list_index);
 
   // Not yet finalized.
-  DCHECK_EQ(ReadOnlyRoots(isolate_).empty_fixed_array(),
-            isolate_->heap()->builtins_constants_table());
+  DCHECK_EQ(ReadOnlyRoots(isolate).empty_fixed_array(),
+            isolate->heap()->builtins_constants_table());
 
-  DCHECK(isolate_->IsGeneratingEmbeddedBuiltins());
+  DCHECK(isolate->IsGeneratingEmbeddedBuiltins());
+}
+}  // namespace
 
+void BuiltinsConstantsTableBuilder::PatchSelfReference(
+    Handle<Object> self_reference, Handle<Code> code_object) {
+  CheckPreconditionsForPatching(isolate_, code_object);
   DCHECK(self_reference->IsOddball());
   DCHECK(Oddball::cast(*self_reference).kind() ==
          Oddball::kSelfReferenceMarker);
-#endif
 
   uint32_t key;
   if (map_.Delete(self_reference, &key)) {
@@ -83,6 +89,17 @@ void BuiltinsConstantsTableBuilder::PatchSelfReference(
   }
 }
 
+void BuiltinsConstantsTableBuilder::PatchBasicBlockCountersReference(
+    Handle<ByteArray> counters) {
+  CheckPreconditionsForPatching(isolate_, counters);
+
+  uint32_t key;
+  if (map_.Delete(ReadOnlyRoots(isolate_).basic_block_counters_marker(),
+                  &key)) {
+    map_.Set(counters, key);
+  }
+}
+
 void BuiltinsConstantsTableBuilder::Finalize() {
   HandleScope handle_scope(isolate_);
 
@@ -117,6 +134,8 @@ void BuiltinsConstantsTableBuilder::Finalize() {
     DCHECK(table->get(i).IsHeapObject());
     DCHECK_NE(ReadOnlyRoots(isolate_).undefined_value(), table->get(i));
     DCHECK_NE(ReadOnlyRoots(isolate_).self_reference_marker(), table->get(i));
+    DCHECK_NE(ReadOnlyRoots(isolate_).basic_block_counters_marker(),
+              table->get(i));
   }
 #endif
 
diff --git a/deps/v8/src/builtins/constants-table-builder.h b/deps/v8/src/builtins/constants-table-builder.h
index 89c95912a1e..fa9d7dee3a3 100644
--- a/deps/v8/src/builtins/constants-table-builder.h
+++ b/deps/v8/src/builtins/constants-table-builder.h
@@ -34,6 +34,11 @@ class BuiltinsConstantsTableBuilder final {
   void PatchSelfReference(Handle<Object> self_reference,
                           Handle<Code> code_object);
 
+  // References to the array that stores basic block usage counters start out as
+  // references to a unique oddball. Once the actual array has been allocated,
+  // such entries in the constants map must be patched up.
+  void PatchBasicBlockCountersReference(Handle<ByteArray> counters);
+
   // Should be called after all affected code (e.g. builtins and bytecode
   // handlers) has been generated.
   void Finalize();
diff --git a/deps/v8/src/builtins/conversion.tq b/deps/v8/src/builtins/conversion.tq
new file mode 100644
index 00000000000..8a5b13b4a54
--- /dev/null
+++ b/deps/v8/src/builtins/conversion.tq
@@ -0,0 +1,230 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+namespace runtime {
+extern transitioning runtime ToStringRT(Context, BigInt): String;
+}
+
+extern enum OrdinaryToPrimitiveHint { kString, kNumber }
+
+extern macro OrdinaryToPrimitive(implicit context: Context)(
+    JSAny, constexpr OrdinaryToPrimitiveHint): JSPrimitive;
+
+namespace conversion {
+
+builtin StringToNumber(implicit context: Context)(input: String): Number {
+  return ::StringToNumber(input);
+}
+
+builtin NonNumberToNumber(implicit context: Context)(input: JSAnyNotNumber):
+    Number {
+  return ::NonNumberToNumber(input);
+}
+
+builtin NonNumberToNumeric(implicit context: Context)(input: JSAnyNotNumber):
+    Numeric {
+  return ::NonNumberToNumeric(input);
+}
+
+builtin ToNumeric(implicit context: Context)(input: JSAny): Numeric {
+  typeswitch (input) {
+    case (n: Number): {
+      return n;
+    }
+    case (h: JSAnyNotNumber): {
+      return conversion::NonNumberToNumeric(h);
+    }
+  }
+}
+
+// ES section #sec-tostring-applied-to-the-number-type
+builtin NumberToString(implicit context: Context)(input: Number): String {
+  return ::NumberToString(input);
+}
+
+// ES6 section 7.1.2 ToBoolean ( argument )
+builtin ToBoolean(implicit context: Context)(input: JSAny): Boolean {
+  BranchIfToBooleanIsTrue(input) otherwise return TrueConstant(),
+      return FalseConstant();
+}
+
+builtin ToLength(implicit context: Context)(input: JSAny): Number {
+  // We might need to loop once for ToNumber conversion.
+  let x: JSAny = input;
+  while (true) {
+    typeswitch (x) {
+      case (s: Smi): {
+        if (s < 0) return 0;
+        return s;
+      }
+      case (h: HeapNumber): {
+        let value: float64 = Convert<float64>(h);
+        // The sense of this test is important for the NaN and -0 cases.
+        if (!(value > 0)) return 0;
+        if (value > kMaxSafeInteger) return kMaxSafeInteger;
+        value = math::Float64Floor(value);
+        return ChangeFloat64ToTagged(value);
+      }
+      case (h: JSAnyNotNumber): {
+        x = ::NonNumberToNumber(h);
+      }
+    }
+  }
+  VerifiedUnreachable();
+}
+
+transitioning builtin ToName(implicit context: Context)(input: JSAny): Name {
+  // We might need to loop once for ToNumber conversion.
+  let x: JSAny = input;
+  while (true) {
+    typeswitch (x) {
+      case (n: Name): {
+        return n;
+      }
+      case (n: Number): {
+        return ::NumberToString(n);
+      }
+      case (b: BigInt): {
+        // We don't have a fast-path for BigInt currently, so just
+        // tail call to the %ToString runtime function here for now.
+        tail runtime::ToStringRT(context, b);
+      }
+      case (o: Oddball): {
+        return o.to_string;
+      }
+      case (o: JSReceiver): {
+        x = NonPrimitiveToPrimitive_String(o);
+      }
+    }
+  }
+  VerifiedUnreachable();
+}
+
+const kNoConstructorFunctionIndex:
+    constexpr int31 generates 'Map::kNoConstructorFunctionIndex';
+
+// ES6 section 7.1.13 ToObject (argument)
+transitioning builtin ToObject(implicit context: Context)(input: JSAny):
+    JSReceiver {
+  try {
+    typeswitch (input) {
+      case (Smi): {
+        goto WrapPrimitive(NativeContextSlot::NUMBER_FUNCTION_INDEX);
+      }
+      case (o: JSReceiver): {
+        return o;
+      }
+      case (o: JSAnyNotSmi): {
+        const index: intptr = Convert<intptr>(
+            o.map.in_object_properties_start_or_constructor_function_index);
+        if (index != kNoConstructorFunctionIndex) goto WrapPrimitive(index);
+        ThrowTypeError(MessageTemplate::kUndefinedOrNullToObject, 'ToObject');
+      }
+    }
+  } label WrapPrimitive(constructorIndex: intptr) {
+    const nativeContext = LoadNativeContext(context);
+    const constructor = UnsafeCast<JSFunction>(nativeContext[constructorIndex]);
+    const map: Map = UnsafeCast<Map>(constructor.prototype_or_initial_map);
+    const wrapper =
+        UnsafeCast<JSPrimitiveWrapper>(AllocateFastOrSlowJSObjectFromMap(map));
+    wrapper.value = input;
+    return wrapper;
+  }
+}
+
+// ES6 section 7.1.1 ToPrimitive ( input [ , PreferredType ] )
+
+transitioning macro TryGetExoticToPrimitive(implicit context: Context)(
+    input: JSAny): JSAny labels OrdinaryToPrimitive {
+  // Look up the @@toPrimitive property.
+  const exoticToPrimitive: JSAny =
+      GetProperty(input, ToPrimitiveSymbolConstant());
+  if (IsNullOrUndefined(exoticToPrimitive)) goto OrdinaryToPrimitive;
+  return exoticToPrimitive;
+}
+
+transitioning macro CallExoticToPrimitive(implicit context: Context)(
+    input: JSAny, exoticToPrimitive: JSAny, hint: String): JSPrimitive {
+  // Invoke the exoticToPrimitive method on the input with a string
+  // representation of the hint.
+  const result: JSAny = Call(context, exoticToPrimitive, input, hint);
+
+  // Verify that the result is primitive.
+  typeswitch (result) {
+    case (o: JSPrimitive): {
+      return o;
+    }
+    case (JSReceiver): {
+      // Somehow the @@toPrimitive method on input didn't yield a primitive.
+      ThrowTypeError(MessageTemplate::kCannotConvertToPrimitive);
+    }
+  }
+}
+
+transitioning builtin NonPrimitiveToPrimitive_Default(
+    implicit context: Context)(input: JSReceiver): JSPrimitive {
+  const exoticToPrimitive: JSAny = TryGetExoticToPrimitive(input)
+      otherwise return OrdinaryToPrimitive_Number(input);
+  return CallExoticToPrimitive(
+      input, exoticToPrimitive, DefaultStringConstant());
+}
+
+transitioning builtin NonPrimitiveToPrimitive_Number(implicit context: Context)(
+    input: JSReceiver): JSPrimitive {
+  const exoticToPrimitive: JSAny = TryGetExoticToPrimitive(input)
+      otherwise return OrdinaryToPrimitive_Number(input);
+  return CallExoticToPrimitive(
+      input, exoticToPrimitive, NumberStringConstant());
+}
+
+transitioning builtin NonPrimitiveToPrimitive_String(implicit context: Context)(
+    input: JSReceiver): JSPrimitive {
+  const exoticToPrimitive: JSAny = TryGetExoticToPrimitive(input)
+      otherwise return OrdinaryToPrimitive_String(input);
+  return CallExoticToPrimitive(
+      input, exoticToPrimitive, StringStringConstant());
+}
+
+// 7.1.1.1 OrdinaryToPrimitive ( O, hint )
+
+transitioning macro TryToPrimitiveMethod(implicit context: Context)(
+    input: JSAny, name: String): JSPrimitive labels Continue {
+  const method: JSAny = GetProperty(input, name);
+  typeswitch (method) {
+    case (Callable): {
+      const value: JSAny = Call(context, method, input);
+      return Cast<JSPrimitive>(value) otherwise Continue;
+    }
+    case (JSAny): {
+      goto Continue;
+    }
+  }
+}
+
+transitioning builtin OrdinaryToPrimitive_Number(implicit context: Context)(
+    input: JSAny): JSPrimitive {
+  try {
+    return TryToPrimitiveMethod(input, ValueOfStringConstant())
+        otherwise String;
+  } label String {
+    return TryToPrimitiveMethod(input, ToStringStringConstant())
+        otherwise Throw;
+  } label Throw {
+    ThrowTypeError(MessageTemplate::kCannotConvertToPrimitive);
+  }
+}
+
+transitioning builtin OrdinaryToPrimitive_String(implicit context: Context)(
+    input: JSAny): JSPrimitive {
+  try {
+    return TryToPrimitiveMethod(input, ToStringStringConstant())
+        otherwise String;
+  } label String {
+    return TryToPrimitiveMethod(input, ValueOfStringConstant()) otherwise Throw;
+  } label Throw {
+    ThrowTypeError(MessageTemplate::kCannotConvertToPrimitive);
+  }
+}
+
+}  // namespace conversion
diff --git a/deps/v8/src/builtins/convert.tq b/deps/v8/src/builtins/convert.tq
index ee9be1d411a..34ff95680a9 100644
--- a/deps/v8/src/builtins/convert.tq
+++ b/deps/v8/src/builtins/convert.tq
@@ -90,6 +90,15 @@ FromConstexpr<LanguageModeSmi, constexpr LanguageMode>(
     c: constexpr LanguageMode): LanguageModeSmi {
   return %RawDownCast<LanguageModeSmi>(SmiConstant(c));
 }
+FromConstexpr<PromiseState, constexpr PromiseState>(c: constexpr PromiseState):
+    PromiseState {
+  return %RawDownCast<PromiseState>(Int32Constant(c));
+}
+
+FromConstexpr<IterationKind, constexpr IterationKind>(
+    c: constexpr IterationKind): IterationKind {
+  return %RawDownCast<IterationKind>(Unsigned(%FromConstexpr<int32>(c)));
+}
 
 macro Convert<To: type, From: type>(i: From): To {
   return i;
@@ -99,6 +108,9 @@ macro Convert<To: type, From: type>(i: From): To labels Overflow {
   return i;
 }
 
+Convert<Boolean, bool>(b: bool): Boolean {
+  return b ? True : False;
+}
 extern macro ConvertElementsKindToInt(ElementsKind): int32;
 Convert<int32, ElementsKind>(elementsKind: ElementsKind): int32 {
   return ConvertElementsKindToInt(elementsKind);
@@ -197,6 +209,9 @@ Convert<PositiveSmi, intptr>(i: intptr): PositiveSmi labels IfOverflow {
       goto IfOverflow;
     }
 }
+Convert<PositiveSmi, uint32>(ui: uint32): PositiveSmi labels IfOverflow {
+  return Convert<PositiveSmi>(Convert<uintptr>(ui)) otherwise IfOverflow;
+}
 Convert<int32, Smi>(s: Smi): int32 {
   return SmiToInt32(s);
 }
@@ -209,6 +224,9 @@ Convert<float64, Number>(n: Number): float64 {
 Convert<uintptr, Number>(n: Number): uintptr {
   return ChangeUintPtrNumberToUintPtr(n);
 }
+Convert<float64, int32>(f: int32): float64 {
+  return ChangeInt32ToFloat64(f);
+}
 Convert<float64, float32>(f: float32): float64 {
   return ChangeFloat32ToFloat64(f);
 }
diff --git a/deps/v8/src/builtins/data-view.tq b/deps/v8/src/builtins/data-view.tq
index c5808dfd9de..5f61a194728 100644
--- a/deps/v8/src/builtins/data-view.tq
+++ b/deps/v8/src/builtins/data-view.tq
@@ -6,877 +6,830 @@
 
 namespace data_view {
 
-  macro MakeDataViewGetterNameString(kind: constexpr ElementsKind): String {
-    if constexpr (kind == ElementsKind::UINT8_ELEMENTS) {
-      return 'DataView.prototype.getUint8';
-    } else if constexpr (kind == ElementsKind::INT8_ELEMENTS) {
-      return 'DataView.prototype.getInt8';
-    } else if constexpr (kind == ElementsKind::UINT16_ELEMENTS) {
-      return 'DataView.prototype.getUint16';
-    } else if constexpr (kind == ElementsKind::INT16_ELEMENTS) {
-      return 'DataView.prototype.getInt16';
-    } else if constexpr (kind == ElementsKind::UINT32_ELEMENTS) {
-      return 'DataView.prototype.getUint32';
-    } else if constexpr (kind == ElementsKind::INT32_ELEMENTS) {
-      return 'DataView.prototype.getInt32';
-    } else if constexpr (kind == ElementsKind::FLOAT32_ELEMENTS) {
-      return 'DataView.prototype.getFloat32';
-    } else if constexpr (kind == ElementsKind::FLOAT64_ELEMENTS) {
-      return 'DataView.prototype.getFloat64';
-    } else if constexpr (kind == ElementsKind::BIGINT64_ELEMENTS) {
-      return 'DataView.prototype.getBigInt64';
-    } else if constexpr (kind == ElementsKind::BIGUINT64_ELEMENTS) {
-      return 'DataView.prototype.getBigUint64';
-    } else {
-      unreachable;
-    }
+macro MakeDataViewGetterNameString(kind: constexpr ElementsKind): String {
+  if constexpr (kind == ElementsKind::UINT8_ELEMENTS) {
+    return 'DataView.prototype.getUint8';
+  } else if constexpr (kind == ElementsKind::INT8_ELEMENTS) {
+    return 'DataView.prototype.getInt8';
+  } else if constexpr (kind == ElementsKind::UINT16_ELEMENTS) {
+    return 'DataView.prototype.getUint16';
+  } else if constexpr (kind == ElementsKind::INT16_ELEMENTS) {
+    return 'DataView.prototype.getInt16';
+  } else if constexpr (kind == ElementsKind::UINT32_ELEMENTS) {
+    return 'DataView.prototype.getUint32';
+  } else if constexpr (kind == ElementsKind::INT32_ELEMENTS) {
+    return 'DataView.prototype.getInt32';
+  } else if constexpr (kind == ElementsKind::FLOAT32_ELEMENTS) {
+    return 'DataView.prototype.getFloat32';
+  } else if constexpr (kind == ElementsKind::FLOAT64_ELEMENTS) {
+    return 'DataView.prototype.getFloat64';
+  } else if constexpr (kind == ElementsKind::BIGINT64_ELEMENTS) {
+    return 'DataView.prototype.getBigInt64';
+  } else if constexpr (kind == ElementsKind::BIGUINT64_ELEMENTS) {
+    return 'DataView.prototype.getBigUint64';
+  } else {
+    unreachable;
   }
+}
 
-  macro MakeDataViewSetterNameString(kind: constexpr ElementsKind): String {
-    if constexpr (kind == ElementsKind::UINT8_ELEMENTS) {
-      return 'DataView.prototype.setUint8';
-    } else if constexpr (kind == ElementsKind::INT8_ELEMENTS) {
-      return 'DataView.prototype.setInt8';
-    } else if constexpr (kind == ElementsKind::UINT16_ELEMENTS) {
-      return 'DataView.prototype.setUint16';
-    } else if constexpr (kind == ElementsKind::INT16_ELEMENTS) {
-      return 'DataView.prototype.setInt16';
-    } else if constexpr (kind == ElementsKind::UINT32_ELEMENTS) {
-      return 'DataView.prototype.setUint32';
-    } else if constexpr (kind == ElementsKind::INT32_ELEMENTS) {
-      return 'DataView.prototype.setInt32';
-    } else if constexpr (kind == ElementsKind::FLOAT32_ELEMENTS) {
-      return 'DataView.prototype.setFloat32';
-    } else if constexpr (kind == ElementsKind::FLOAT64_ELEMENTS) {
-      return 'DataView.prototype.setFloat64';
-    } else if constexpr (kind == ElementsKind::BIGINT64_ELEMENTS) {
-      return 'DataView.prototype.setBigInt64';
-    } else if constexpr (kind == ElementsKind::BIGUINT64_ELEMENTS) {
-      return 'DataView.prototype.setBigUint64';
-    } else {
-      unreachable;
-    }
+macro MakeDataViewSetterNameString(kind: constexpr ElementsKind): String {
+  if constexpr (kind == ElementsKind::UINT8_ELEMENTS) {
+    return 'DataView.prototype.setUint8';
+  } else if constexpr (kind == ElementsKind::INT8_ELEMENTS) {
+    return 'DataView.prototype.setInt8';
+  } else if constexpr (kind == ElementsKind::UINT16_ELEMENTS) {
+    return 'DataView.prototype.setUint16';
+  } else if constexpr (kind == ElementsKind::INT16_ELEMENTS) {
+    return 'DataView.prototype.setInt16';
+  } else if constexpr (kind == ElementsKind::UINT32_ELEMENTS) {
+    return 'DataView.prototype.setUint32';
+  } else if constexpr (kind == ElementsKind::INT32_ELEMENTS) {
+    return 'DataView.prototype.setInt32';
+  } else if constexpr (kind == ElementsKind::FLOAT32_ELEMENTS) {
+    return 'DataView.prototype.setFloat32';
+  } else if constexpr (kind == ElementsKind::FLOAT64_ELEMENTS) {
+    return 'DataView.prototype.setFloat64';
+  } else if constexpr (kind == ElementsKind::BIGINT64_ELEMENTS) {
+    return 'DataView.prototype.setBigInt64';
+  } else if constexpr (kind == ElementsKind::BIGUINT64_ELEMENTS) {
+    return 'DataView.prototype.setBigUint64';
+  } else {
+    unreachable;
   }
+}
 
-  macro WasDetached(view: JSArrayBufferView): bool {
-    return IsDetachedBuffer(view.buffer);
-  }
+macro WasDetached(view: JSArrayBufferView): bool {
+  return IsDetachedBuffer(view.buffer);
+}
 
-  macro ValidateDataView(context: Context, o: JSAny, method: String):
-      JSDataView {
-    try {
-      return Cast<JSDataView>(o) otherwise CastError;
-    }
-    label CastError {
-      ThrowTypeError(MessageTemplate::kIncompatibleMethodReceiver, method);
-    }
+macro ValidateDataView(context: Context, o: JSAny, method: String): JSDataView {
+  try {
+    return Cast<JSDataView>(o) otherwise CastError;
+  } label CastError {
+    ThrowTypeError(MessageTemplate::kIncompatibleMethodReceiver, method);
   }
+}
 
-  // ES6 section 24.2.4.1 get DataView.prototype.buffer
-  javascript builtin DataViewPrototypeGetBuffer(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSArrayBuffer {
-    const dataView: JSDataView =
-        ValidateDataView(context, receiver, 'get DataView.prototype.buffer');
-    return dataView.buffer;
-  }
+// ES6 section 24.2.4.1 get DataView.prototype.buffer
+javascript builtin DataViewPrototypeGetBuffer(
+    js-implicit context: NativeContext,
+    receiver: JSAny)(...arguments): JSArrayBuffer {
+  const dataView: JSDataView =
+      ValidateDataView(context, receiver, 'get DataView.prototype.buffer');
+  return dataView.buffer;
+}
 
-  // ES6 section 24.2.4.2 get DataView.prototype.byteLength
-  javascript builtin DataViewPrototypeGetByteLength(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): Number {
-    const dataView: JSDataView = ValidateDataView(
-        context, receiver, 'get DataView.prototype.byte_length');
-    if (WasDetached(dataView)) {
-      // TODO(bmeurer): According to the ES6 spec, we should throw a TypeError
-      // here if the JSArrayBuffer of the {dataView} was detached.
-      return 0;
-    }
-    return Convert<Number>(dataView.byte_length);
-  }
+// ES6 section 24.2.4.2 get DataView.prototype.byteLength
+javascript builtin DataViewPrototypeGetByteLength(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): Number {
+  const dataView: JSDataView =
+      ValidateDataView(context, receiver, 'get DataView.prototype.byte_length');
+  if (WasDetached(dataView)) {
+    // TODO(bmeurer): According to the ES6 spec, we should throw a TypeError
+    // here if the JSArrayBuffer of the {dataView} was detached.
+    return 0;
+  }
+  return Convert<Number>(dataView.byte_length);
+}
 
-  // ES6 section 24.2.4.3 get DataView.prototype.byteOffset
-  javascript builtin DataViewPrototypeGetByteOffset(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): Number {
-    const dataView: JSDataView = ValidateDataView(
-        context, receiver, 'get DataView.prototype.byte_offset');
-    if (WasDetached(dataView)) {
-      // TODO(bmeurer): According to the ES6 spec, we should throw a TypeError
-      // here if the JSArrayBuffer of the {dataView} was detached.
-      return 0;
-    }
-    return Convert<Number>(dataView.byte_offset);
-  }
+// ES6 section 24.2.4.3 get DataView.prototype.byteOffset
+javascript builtin DataViewPrototypeGetByteOffset(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): Number {
+  const dataView: JSDataView =
+      ValidateDataView(context, receiver, 'get DataView.prototype.byte_offset');
+  if (WasDetached(dataView)) {
+    // TODO(bmeurer): According to the ES6 spec, we should throw a TypeError
+    // here if the JSArrayBuffer of the {dataView} was detached.
+    return 0;
+  }
+  return Convert<Number>(dataView.byte_offset);
+}
 
-  extern macro BitcastInt32ToFloat32(uint32): float32;
-  extern macro BitcastFloat32ToInt32(float32): uint32;
-  extern macro Float64ExtractLowWord32(float64): uint32;
-  extern macro Float64ExtractHighWord32(float64): uint32;
-  extern macro Float64InsertLowWord32(float64, uint32): float64;
-  extern macro Float64InsertHighWord32(float64, uint32): float64;
+extern macro BitcastInt32ToFloat32(uint32): float32;
+extern macro BitcastFloat32ToInt32(float32): uint32;
+extern macro Float64ExtractLowWord32(float64): uint32;
+extern macro Float64ExtractHighWord32(float64): uint32;
+extern macro Float64InsertLowWord32(float64, uint32): float64;
+extern macro Float64InsertHighWord32(float64, uint32): float64;
 
-  extern macro DataViewBuiltinsAssembler::LoadUint8(RawPtr, uintptr): uint32;
-  extern macro DataViewBuiltinsAssembler::LoadInt8(RawPtr, uintptr): int32;
+extern macro DataViewBuiltinsAssembler::LoadUint8(RawPtr, uintptr): uint32;
+extern macro DataViewBuiltinsAssembler::LoadInt8(RawPtr, uintptr): int32;
 
-  macro LoadDataView8(
-      buffer: JSArrayBuffer, offset: uintptr, signed: constexpr bool): Smi {
-    if constexpr (signed) {
-      return Convert<Smi>(LoadInt8(buffer.backing_store, offset));
-    } else {
-      return Convert<Smi>(LoadUint8(buffer.backing_store, offset));
-    }
+macro LoadDataView8(
+    buffer: JSArrayBuffer, offset: uintptr, signed: constexpr bool): Smi {
+  if constexpr (signed) {
+    return Convert<Smi>(LoadInt8(buffer.backing_store_ptr, offset));
+  } else {
+    return Convert<Smi>(LoadUint8(buffer.backing_store_ptr, offset));
   }
+}
 
-  macro LoadDataView16(
-      buffer: JSArrayBuffer, offset: uintptr, requestedLittleEndian: bool,
-      signed: constexpr bool): Number {
-    const dataPointer: RawPtr = buffer.backing_store;
+macro LoadDataView16(
+    buffer: JSArrayBuffer, offset: uintptr, requestedLittleEndian: bool,
+    signed: constexpr bool): Number {
+  const dataPointer: RawPtr = buffer.backing_store_ptr;
+
+  let b0: int32;
+  let b1: int32;
+  let result: int32;
+
+  // Sign-extend the most significant byte by loading it as an Int8.
+  if (requestedLittleEndian) {
+    b0 = Signed(LoadUint8(dataPointer, offset));
+    b1 = LoadInt8(dataPointer, offset + 1);
+    result = (b1 << 8) + b0;
+  } else {
+    b0 = LoadInt8(dataPointer, offset);
+    b1 = Signed(LoadUint8(dataPointer, offset + 1));
+    result = (b0 << 8) + b1;
+  }
+  if constexpr (signed) {
+    return Convert<Smi>(result);
+  } else {
+    // Bit-mask the higher bits to prevent sign extension if we're unsigned.
+    return Convert<Smi>(result & 0xFFFF);
+  }
+}
 
-    let b0: int32;
-    let b1: int32;
-    let result: int32;
+macro LoadDataView32(
+    buffer: JSArrayBuffer, offset: uintptr, requestedLittleEndian: bool,
+    kind: constexpr ElementsKind): Number {
+  const dataPointer: RawPtr = buffer.backing_store_ptr;
 
-    // Sign-extend the most significant byte by loading it as an Int8.
-    if (requestedLittleEndian) {
-      b0 = Signed(LoadUint8(dataPointer, offset));
-      b1 = LoadInt8(dataPointer, offset + 1);
-      result = (b1 << 8) + b0;
-    } else {
-      b0 = LoadInt8(dataPointer, offset);
-      b1 = Signed(LoadUint8(dataPointer, offset + 1));
-      result = (b0 << 8) + b1;
-    }
-    if constexpr (signed) {
-      return Convert<Smi>(result);
-    } else {
-      // Bit-mask the higher bits to prevent sign extension if we're unsigned.
-      return Convert<Smi>(result & 0xFFFF);
-    }
+  const b0: uint32 = LoadUint8(dataPointer, offset);
+  const b1: uint32 = LoadUint8(dataPointer, offset + 1);
+  const b2: uint32 = LoadUint8(dataPointer, offset + 2);
+  const b3: uint32 = LoadUint8(dataPointer, offset + 3);
+  let result: uint32;
+
+  if (requestedLittleEndian) {
+    result = (b3 << 24) | (b2 << 16) | (b1 << 8) | b0;
+  } else {
+    result = (b0 << 24) | (b1 << 16) | (b2 << 8) | b3;
   }
 
-  macro LoadDataView32(
-      buffer: JSArrayBuffer, offset: uintptr, requestedLittleEndian: bool,
-      kind: constexpr ElementsKind): Number {
-    const dataPointer: RawPtr = buffer.backing_store;
+  if constexpr (kind == ElementsKind::INT32_ELEMENTS) {
+    return Convert<Number>(Signed(result));
+  } else if constexpr (kind == ElementsKind::UINT32_ELEMENTS) {
+    return Convert<Number>(result);
+  } else if constexpr (kind == ElementsKind::FLOAT32_ELEMENTS) {
+    const floatRes: float64 = Convert<float64>(BitcastInt32ToFloat32(result));
+    return Convert<Number>(floatRes);
+  } else {
+    unreachable;
+  }
+}
 
-    const b0: uint32 = LoadUint8(dataPointer, offset);
-    const b1: uint32 = LoadUint8(dataPointer, offset + 1);
-    const b2: uint32 = LoadUint8(dataPointer, offset + 2);
-    const b3: uint32 = LoadUint8(dataPointer, offset + 3);
-    let result: uint32;
+macro LoadDataViewFloat64(
+    buffer: JSArrayBuffer, offset: uintptr,
+    requestedLittleEndian: bool): Number {
+  const dataPointer: RawPtr = buffer.backing_store_ptr;
+
+  const b0: uint32 = LoadUint8(dataPointer, offset);
+  const b1: uint32 = LoadUint8(dataPointer, offset + 1);
+  const b2: uint32 = LoadUint8(dataPointer, offset + 2);
+  const b3: uint32 = LoadUint8(dataPointer, offset + 3);
+  const b4: uint32 = LoadUint8(dataPointer, offset + 4);
+  const b5: uint32 = LoadUint8(dataPointer, offset + 5);
+  const b6: uint32 = LoadUint8(dataPointer, offset + 6);
+  const b7: uint32 = LoadUint8(dataPointer, offset + 7);
+  let lowWord: uint32;
+  let highWord: uint32;
+
+  if (requestedLittleEndian) {
+    lowWord = (b3 << 24) | (b2 << 16) | (b1 << 8) | b0;
+    highWord = (b7 << 24) | (b6 << 16) | (b5 << 8) | b4;
+  } else {
+    highWord = (b0 << 24) | (b1 << 16) | (b2 << 8) | b3;
+    lowWord = (b4 << 24) | (b5 << 16) | (b6 << 8) | b7;
+  }
+
+  let result: float64 = 0;
+  result = Float64InsertLowWord32(result, lowWord);
+  result = Float64InsertHighWord32(result, highWord);
+
+  return Convert<Number>(result);
+}
 
-    if (requestedLittleEndian) {
-      result = (b3 << 24) | (b2 << 16) | (b1 << 8) | b0;
-    } else {
-      result = (b0 << 24) | (b1 << 16) | (b2 << 8) | b3;
-    }
+const kZeroDigitBigInt: constexpr int31 = 0;
+const kOneDigitBigInt: constexpr int31 = 1;
+const kTwoDigitBigInt: constexpr int31 = 2;
 
-    if constexpr (kind == ElementsKind::INT32_ELEMENTS) {
-      return Convert<Number>(Signed(result));
-    } else if constexpr (kind == ElementsKind::UINT32_ELEMENTS) {
-      return Convert<Number>(result);
-    } else if constexpr (kind == ElementsKind::FLOAT32_ELEMENTS) {
-      const floatRes: float64 = Convert<float64>(BitcastInt32ToFloat32(result));
-      return Convert<Number>(floatRes);
-    } else {
-      unreachable;
-    }
+// Create a BigInt on a 64-bit architecture from two 32-bit values.
+macro MakeBigIntOn64Bit(implicit context: Context)(
+    lowWord: uint32, highWord: uint32, signed: constexpr bool): BigInt {
+  // 0n is represented by a zero-length BigInt.
+  if (lowWord == 0 && highWord == 0) {
+    return Convert<BigInt>(bigint::AllocateBigInt(kZeroDigitBigInt));
   }
 
-  macro LoadDataViewFloat64(
-      buffer: JSArrayBuffer, offset: uintptr,
-      requestedLittleEndian: bool): Number {
-    const dataPointer: RawPtr = buffer.backing_store;
-
-    const b0: uint32 = LoadUint8(dataPointer, offset);
-    const b1: uint32 = LoadUint8(dataPointer, offset + 1);
-    const b2: uint32 = LoadUint8(dataPointer, offset + 2);
-    const b3: uint32 = LoadUint8(dataPointer, offset + 3);
-    const b4: uint32 = LoadUint8(dataPointer, offset + 4);
-    const b5: uint32 = LoadUint8(dataPointer, offset + 5);
-    const b6: uint32 = LoadUint8(dataPointer, offset + 6);
-    const b7: uint32 = LoadUint8(dataPointer, offset + 7);
-    let lowWord: uint32;
-    let highWord: uint32;
-
-    if (requestedLittleEndian) {
-      lowWord = (b3 << 24) | (b2 << 16) | (b1 << 8) | b0;
-      highWord = (b7 << 24) | (b6 << 16) | (b5 << 8) | b4;
-    } else {
-      highWord = (b0 << 24) | (b1 << 16) | (b2 << 8) | b3;
-      lowWord = (b4 << 24) | (b5 << 16) | (b6 << 8) | b7;
+  let sign: uint32 = bigint::kPositiveSign;
+  const highPart: intptr = Signed(Convert<uintptr>(highWord));
+  const lowPart: intptr = Signed(Convert<uintptr>(lowWord));
+  let rawValue: intptr = (highPart << 32) + lowPart;
+
+  if constexpr (signed) {
+    if (rawValue < 0) {
+      sign = bigint::kNegativeSign;
+      // We have to store the absolute value of rawValue in the digit.
+      rawValue = 0 - rawValue;
     }
+  }
 
-    let result: float64 = 0;
-    result = Float64InsertLowWord32(result, lowWord);
-    result = Float64InsertHighWord32(result, highWord);
+  // Allocate the BigInt and store the absolute value.
+  const result: MutableBigInt =
+      bigint::AllocateEmptyBigInt(sign, kOneDigitBigInt);
+  bigint::StoreBigIntDigit(result, 0, Unsigned(rawValue));
+  return Convert<BigInt>(result);
+}
 
-    return Convert<Number>(result);
+// Create a BigInt on a 32-bit architecture from two 32-bit values.
+macro MakeBigIntOn32Bit(implicit context: Context)(
+    lowWord: uint32, highWord: uint32, signed: constexpr bool): BigInt {
+  // 0n is represented by a zero-length BigInt.
+  if (lowWord == 0 && highWord == 0) {
+    return Convert<BigInt>(bigint::AllocateBigInt(kZeroDigitBigInt));
   }
 
-  const kZeroDigitBigInt: constexpr int31 = 0;
-  const kOneDigitBigInt: constexpr int31 = 1;
-  const kTwoDigitBigInt: constexpr int31 = 2;
-
-  // Create a BigInt on a 64-bit architecture from two 32-bit values.
-  macro MakeBigIntOn64Bit(implicit context: Context)(
-      lowWord: uint32, highWord: uint32, signed: constexpr bool): BigInt {
-    // 0n is represented by a zero-length BigInt.
-    if (lowWord == 0 && highWord == 0) {
-      return Convert<BigInt>(bigint::AllocateBigInt(kZeroDigitBigInt));
-    }
+  // On a 32-bit platform, we might need 1 or 2 digits to store the number.
+  let needTwoDigits: bool = false;
+  let sign: uint32 = bigint::kPositiveSign;
 
-    let sign: uint32 = bigint::kPositiveSign;
-    const highPart: intptr = Signed(Convert<uintptr>(highWord));
-    const lowPart: intptr = Signed(Convert<uintptr>(lowWord));
-    let rawValue: intptr = (highPart << 32) + lowPart;
+  // We need to do some math on lowWord and highWord,
+  // so Convert them to int32.
+  let lowPart: int32 = Signed(lowWord);
+  let highPart: int32 = Signed(highWord);
 
+  // If highWord == 0, the number is positive, and we only need 1 digit,
+  // so we don't have anything to do.
+  // Otherwise, all cases are possible.
+  if (highWord != 0) {
     if constexpr (signed) {
-      if (rawValue < 0) {
+      // If highPart < 0, the number is always negative.
+      if (highPart < 0) {
         sign = bigint::kNegativeSign;
-        // We have to store the absolute value of rawValue in the digit.
-        rawValue = 0 - rawValue;
-      }
-    }
 
-    // Allocate the BigInt and store the absolute value.
-    const result: MutableBigInt =
-        bigint::AllocateEmptyBigInt(sign, kOneDigitBigInt);
-    bigint::StoreBigIntDigit(result, 0, Unsigned(rawValue));
-    return Convert<BigInt>(result);
-  }
-
-  // Create a BigInt on a 32-bit architecture from two 32-bit values.
-  macro MakeBigIntOn32Bit(implicit context: Context)(
-      lowWord: uint32, highWord: uint32, signed: constexpr bool): BigInt {
-    // 0n is represented by a zero-length BigInt.
-    if (lowWord == 0 && highWord == 0) {
-      return Convert<BigInt>(bigint::AllocateBigInt(kZeroDigitBigInt));
-    }
+        // We have to compute the absolute value by hand.
+        // There will be a negative carry from the low word
+        // to the high word iff low != 0.
+        highPart = 0 - highPart;
+        if (lowPart != 0) {
+          highPart = highPart - 1;
+        }
+        lowPart = 0 - lowPart;
 
-    // On a 32-bit platform, we might need 1 or 2 digits to store the number.
-    let needTwoDigits: bool = false;
-    let sign: uint32 = bigint::kPositiveSign;
-
-    // We need to do some math on lowWord and highWord,
-    // so Convert them to int32.
-    let lowPart: int32 = Signed(lowWord);
-    let highPart: int32 = Signed(highWord);
-
-    // If highWord == 0, the number is positive, and we only need 1 digit,
-    // so we don't have anything to do.
-    // Otherwise, all cases are possible.
-    if (highWord != 0) {
-      if constexpr (signed) {
-        // If highPart < 0, the number is always negative.
-        if (highPart < 0) {
-          sign = bigint::kNegativeSign;
-
-          // We have to compute the absolute value by hand.
-          // There will be a negative carry from the low word
-          // to the high word iff low != 0.
-          highPart = 0 - highPart;
-          if (lowPart != 0) {
-            highPart = highPart - 1;
-          }
-          lowPart = 0 - lowPart;
-
-          // Here, highPart could be 0 again so we might have 1 or 2 digits.
-          if (highPart != 0) {
-            needTwoDigits = true;
-          }
-
-        } else {
-          // In this case, the number is positive, and we need 2 digits.
+        // Here, highPart could be 0 again so we might have 1 or 2 digits.
+        if (highPart != 0) {
           needTwoDigits = true;
         }
 
       } else {
-        // In this case, the number is positive (unsigned),
-        // and we need 2 digits.
+        // In this case, the number is positive, and we need 2 digits.
         needTwoDigits = true;
       }
-    }
 
-    // Allocate the BigInt with the right sign and length.
-    let result: MutableBigInt;
-    if (needTwoDigits) {
-      result = bigint::AllocateEmptyBigInt(sign, kTwoDigitBigInt);
     } else {
-      result = bigint::AllocateEmptyBigInt(sign, kOneDigitBigInt);
-    }
-
-    // Finally, write the digit(s) to the BigInt.
-    bigint::StoreBigIntDigit(result, 0, Unsigned(Convert<intptr>(lowPart)));
-    if (needTwoDigits) {
-      bigint::StoreBigIntDigit(result, 1, Unsigned(Convert<intptr>(highPart)));
+      // In this case, the number is positive (unsigned),
+      // and we need 2 digits.
+      needTwoDigits = true;
     }
-    return Convert<BigInt>(result);
   }
 
-  macro MakeBigInt(implicit context: Context)(
-      lowWord: uint32, highWord: uint32, signed: constexpr bool): BigInt {
-    // A BigInt digit has the platform word size, so we only need one digit
-    // on 64-bit platforms but may need two on 32-bit.
-    if constexpr (Is64()) {
-      return MakeBigIntOn64Bit(lowWord, highWord, signed);
-    } else {
-      return MakeBigIntOn32Bit(lowWord, highWord, signed);
-    }
+  // Allocate the BigInt with the right sign and length.
+  let result: MutableBigInt;
+  if (needTwoDigits) {
+    result = bigint::AllocateEmptyBigInt(sign, kTwoDigitBigInt);
+  } else {
+    result = bigint::AllocateEmptyBigInt(sign, kOneDigitBigInt);
   }
 
-  macro LoadDataViewBigInt(implicit context: Context)(
-      buffer: JSArrayBuffer, offset: uintptr, requestedLittleEndian: bool,
-      signed: constexpr bool): BigInt {
-    const dataPointer: RawPtr = buffer.backing_store;
-
-    const b0: uint32 = LoadUint8(dataPointer, offset);
-    const b1: uint32 = LoadUint8(dataPointer, offset + 1);
-    const b2: uint32 = LoadUint8(dataPointer, offset + 2);
-    const b3: uint32 = LoadUint8(dataPointer, offset + 3);
-    const b4: uint32 = LoadUint8(dataPointer, offset + 4);
-    const b5: uint32 = LoadUint8(dataPointer, offset + 5);
-    const b6: uint32 = LoadUint8(dataPointer, offset + 6);
-    const b7: uint32 = LoadUint8(dataPointer, offset + 7);
-    let lowWord: uint32;
-    let highWord: uint32;
-
-    if (requestedLittleEndian) {
-      lowWord = (b3 << 24) | (b2 << 16) | (b1 << 8) | b0;
-      highWord = (b7 << 24) | (b6 << 16) | (b5 << 8) | b4;
-    } else {
-      highWord = (b0 << 24) | (b1 << 16) | (b2 << 8) | b3;
-      lowWord = (b4 << 24) | (b5 << 16) | (b6 << 8) | b7;
-    }
+  // Finally, write the digit(s) to the BigInt.
+  bigint::StoreBigIntDigit(result, 0, Unsigned(Convert<intptr>(lowPart)));
+  if (needTwoDigits) {
+    bigint::StoreBigIntDigit(result, 1, Unsigned(Convert<intptr>(highPart)));
+  }
+  return Convert<BigInt>(result);
+}
 
-    return MakeBigInt(lowWord, highWord, signed);
+macro MakeBigInt(implicit context: Context)(
+    lowWord: uint32, highWord: uint32, signed: constexpr bool): BigInt {
+  // A BigInt digit has the platform word size, so we only need one digit
+  // on 64-bit platforms but may need two on 32-bit.
+  if constexpr (Is64()) {
+    return MakeBigIntOn64Bit(lowWord, highWord, signed);
+  } else {
+    return MakeBigIntOn32Bit(lowWord, highWord, signed);
   }
+}
 
-  extern macro DataViewBuiltinsAssembler::DataViewElementSize(
-      constexpr ElementsKind): constexpr int31;
-
-  // GetViewValue ( view, requestIndex, isLittleEndian, type )
-  // https://tc39.es/ecma262/#sec-getviewvalue
-  transitioning macro DataViewGet(
-      context: Context, receiver: JSAny, requestIndex: JSAny,
-      requestedLittleEndian: JSAny, kind: constexpr ElementsKind): Numeric {
-    // 1. Perform ? RequireInternalSlot(view, [[DataView]]).
-    // 2. Assert: view has a [[ViewedArrayBuffer]] internal slot.
-    const dataView: JSDataView =
-        ValidateDataView(context, receiver, MakeDataViewGetterNameString(kind));
-
-    try {
-      // 3. Let getIndex be ? ToIndex(requestIndex).
-      const getIndex: uintptr = ToIndex(requestIndex) otherwise RangeError;
-
-      // 4. Set isLittleEndian to ! ToBoolean(isLittleEndian).
-      const littleEndian: bool = ToBoolean(requestedLittleEndian);
-
-      // 5. Let buffer be view.[[ViewedArrayBuffer]].
-      const buffer: JSArrayBuffer = dataView.buffer;
-
-      // 6. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
-      if (IsDetachedBuffer(buffer)) {
-        ThrowTypeError(
-            MessageTemplate::kDetachedOperation,
-            MakeDataViewGetterNameString(kind));
-      }
+macro LoadDataViewBigInt(implicit context: Context)(
+    buffer: JSArrayBuffer, offset: uintptr, requestedLittleEndian: bool,
+    signed: constexpr bool): BigInt {
+  const dataPointer: RawPtr = buffer.backing_store_ptr;
+
+  const b0: uint32 = LoadUint8(dataPointer, offset);
+  const b1: uint32 = LoadUint8(dataPointer, offset + 1);
+  const b2: uint32 = LoadUint8(dataPointer, offset + 2);
+  const b3: uint32 = LoadUint8(dataPointer, offset + 3);
+  const b4: uint32 = LoadUint8(dataPointer, offset + 4);
+  const b5: uint32 = LoadUint8(dataPointer, offset + 5);
+  const b6: uint32 = LoadUint8(dataPointer, offset + 6);
+  const b7: uint32 = LoadUint8(dataPointer, offset + 7);
+  let lowWord: uint32;
+  let highWord: uint32;
+
+  if (requestedLittleEndian) {
+    lowWord = (b3 << 24) | (b2 << 16) | (b1 << 8) | b0;
+    highWord = (b7 << 24) | (b6 << 16) | (b5 << 8) | b4;
+  } else {
+    highWord = (b0 << 24) | (b1 << 16) | (b2 << 8) | b3;
+    lowWord = (b4 << 24) | (b5 << 16) | (b6 << 8) | b7;
+  }
+
+  return MakeBigInt(lowWord, highWord, signed);
+}
 
-      // 7. Let viewOffset be view.[[ByteOffset]].
-      const viewOffset: uintptr = dataView.byte_offset;
-
-      // 8. Let viewSize be view.[[ByteLength]].
-      const viewSize: uintptr = dataView.byte_length;
-
-      // 9. Let elementSize be the Element Size value specified in Table 62
-      // for Element Type type.
-      const elementSize: uintptr = DataViewElementSize(kind);
-
-      // 10. If getIndex + elementSize > viewSize, throw a RangeError exception.
-      CheckIntegerIndexAdditionOverflow(getIndex, elementSize, viewSize)
-          otherwise RangeError;
-
-      // 11. Let bufferIndex be getIndex + viewOffset.
-      const bufferIndex: uintptr = getIndex + viewOffset;
-
-      if constexpr (kind == ElementsKind::UINT8_ELEMENTS) {
-        return LoadDataView8(buffer, bufferIndex, false);
-      } else if constexpr (kind == ElementsKind::INT8_ELEMENTS) {
-        return LoadDataView8(buffer, bufferIndex, true);
-      } else if constexpr (kind == ElementsKind::UINT16_ELEMENTS) {
-        return LoadDataView16(buffer, bufferIndex, littleEndian, false);
-      } else if constexpr (kind == ElementsKind::INT16_ELEMENTS) {
-        return LoadDataView16(buffer, bufferIndex, littleEndian, true);
-      } else if constexpr (kind == ElementsKind::UINT32_ELEMENTS) {
-        return LoadDataView32(buffer, bufferIndex, littleEndian, kind);
-      } else if constexpr (kind == ElementsKind::INT32_ELEMENTS) {
-        return LoadDataView32(buffer, bufferIndex, littleEndian, kind);
-      } else if constexpr (kind == ElementsKind::FLOAT32_ELEMENTS) {
-        return LoadDataView32(buffer, bufferIndex, littleEndian, kind);
-      } else if constexpr (kind == ElementsKind::FLOAT64_ELEMENTS) {
-        return LoadDataViewFloat64(buffer, bufferIndex, littleEndian);
-      } else if constexpr (kind == ElementsKind::BIGUINT64_ELEMENTS) {
-        return LoadDataViewBigInt(buffer, bufferIndex, littleEndian, false);
-      } else if constexpr (kind == ElementsKind::BIGINT64_ELEMENTS) {
-        return LoadDataViewBigInt(buffer, bufferIndex, littleEndian, true);
-      } else {
-        unreachable;
-      }
+extern macro DataViewBuiltinsAssembler::DataViewElementSize(
+    constexpr ElementsKind): constexpr int31;
+
+// GetViewValue ( view, requestIndex, isLittleEndian, type )
+// https://tc39.es/ecma262/#sec-getviewvalue
+transitioning macro DataViewGet(
+    context: Context, receiver: JSAny, requestIndex: JSAny,
+    requestedLittleEndian: JSAny, kind: constexpr ElementsKind): Numeric {
+  // 1. Perform ? RequireInternalSlot(view, [[DataView]]).
+  // 2. Assert: view has a [[ViewedArrayBuffer]] internal slot.
+  const dataView: JSDataView =
+      ValidateDataView(context, receiver, MakeDataViewGetterNameString(kind));
+
+  try {
+    // 3. Let getIndex be ? ToIndex(requestIndex).
+    const getIndex: uintptr = ToIndex(requestIndex) otherwise RangeError;
+
+    // 4. Set isLittleEndian to ! ToBoolean(isLittleEndian).
+    const littleEndian: bool = ToBoolean(requestedLittleEndian);
+
+    // 5. Let buffer be view.[[ViewedArrayBuffer]].
+    const buffer: JSArrayBuffer = dataView.buffer;
+
+    // 6. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+    if (IsDetachedBuffer(buffer)) {
+      ThrowTypeError(
+          MessageTemplate::kDetachedOperation,
+          MakeDataViewGetterNameString(kind));
     }
-    label RangeError {
-      ThrowRangeError(MessageTemplate::kInvalidDataViewAccessorOffset);
+
+    // 7. Let viewOffset be view.[[ByteOffset]].
+    const viewOffset: uintptr = dataView.byte_offset;
+
+    // 8. Let viewSize be view.[[ByteLength]].
+    const viewSize: uintptr = dataView.byte_length;
+
+    // 9. Let elementSize be the Element Size value specified in Table 62
+    // for Element Type type.
+    const elementSize: uintptr = DataViewElementSize(kind);
+
+    // 10. If getIndex + elementSize > viewSize, throw a RangeError exception.
+    CheckIntegerIndexAdditionOverflow(getIndex, elementSize, viewSize)
+        otherwise RangeError;
+
+    // 11. Let bufferIndex be getIndex + viewOffset.
+    const bufferIndex: uintptr = getIndex + viewOffset;
+
+    if constexpr (kind == ElementsKind::UINT8_ELEMENTS) {
+      return LoadDataView8(buffer, bufferIndex, false);
+    } else if constexpr (kind == ElementsKind::INT8_ELEMENTS) {
+      return LoadDataView8(buffer, bufferIndex, true);
+    } else if constexpr (kind == ElementsKind::UINT16_ELEMENTS) {
+      return LoadDataView16(buffer, bufferIndex, littleEndian, false);
+    } else if constexpr (kind == ElementsKind::INT16_ELEMENTS) {
+      return LoadDataView16(buffer, bufferIndex, littleEndian, true);
+    } else if constexpr (kind == ElementsKind::UINT32_ELEMENTS) {
+      return LoadDataView32(buffer, bufferIndex, littleEndian, kind);
+    } else if constexpr (kind == ElementsKind::INT32_ELEMENTS) {
+      return LoadDataView32(buffer, bufferIndex, littleEndian, kind);
+    } else if constexpr (kind == ElementsKind::FLOAT32_ELEMENTS) {
+      return LoadDataView32(buffer, bufferIndex, littleEndian, kind);
+    } else if constexpr (kind == ElementsKind::FLOAT64_ELEMENTS) {
+      return LoadDataViewFloat64(buffer, bufferIndex, littleEndian);
+    } else if constexpr (kind == ElementsKind::BIGUINT64_ELEMENTS) {
+      return LoadDataViewBigInt(buffer, bufferIndex, littleEndian, false);
+    } else if constexpr (kind == ElementsKind::BIGINT64_ELEMENTS) {
+      return LoadDataViewBigInt(buffer, bufferIndex, littleEndian, true);
+    } else {
+      unreachable;
     }
+  } label RangeError {
+    ThrowRangeError(MessageTemplate::kInvalidDataViewAccessorOffset);
   }
+}
 
-  transitioning javascript builtin DataViewPrototypeGetUint8(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    return DataViewGet(
-        context, receiver, offset, Undefined, ElementsKind::UINT8_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeGetUint8(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  return DataViewGet(
+      context, receiver, offset, Undefined, ElementsKind::UINT8_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeGetInt8(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    return DataViewGet(
-        context, receiver, offset, Undefined, ElementsKind::INT8_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeGetInt8(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  return DataViewGet(
+      context, receiver, offset, Undefined, ElementsKind::INT8_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeGetUint16(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 1 ? arguments[1] : Undefined;
-    return DataViewGet(
-        context, receiver, offset, isLittleEndian,
-        ElementsKind::UINT16_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeGetUint16(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const isLittleEndian: JSAny = arguments[1];
+  return DataViewGet(
+      context, receiver, offset, isLittleEndian, ElementsKind::UINT16_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeGetInt16(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 1 ? arguments[1] : Undefined;
-    return DataViewGet(
-        context, receiver, offset, isLittleEndian,
-        ElementsKind::INT16_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeGetInt16(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const isLittleEndian: JSAny = arguments[1];
+  return DataViewGet(
+      context, receiver, offset, isLittleEndian, ElementsKind::INT16_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeGetUint32(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 1 ? arguments[1] : Undefined;
-    return DataViewGet(
-        context, receiver, offset, isLittleEndian,
-        ElementsKind::UINT32_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeGetUint32(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const isLittleEndian: JSAny = arguments[1];
+  return DataViewGet(
+      context, receiver, offset, isLittleEndian, ElementsKind::UINT32_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeGetInt32(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 1 ? arguments[1] : Undefined;
-    return DataViewGet(
-        context, receiver, offset, isLittleEndian,
-        ElementsKind::INT32_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeGetInt32(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const isLittleEndian: JSAny = arguments[1];
+  return DataViewGet(
+      context, receiver, offset, isLittleEndian, ElementsKind::INT32_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeGetFloat32(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 1 ? arguments[1] : Undefined;
-    return DataViewGet(
-        context, receiver, offset, isLittleEndian,
-        ElementsKind::FLOAT32_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeGetFloat32(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const isLittleEndian: JSAny = arguments[1];
+  return DataViewGet(
+      context, receiver, offset, isLittleEndian,
+      ElementsKind::FLOAT32_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeGetFloat64(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 1 ? arguments[1] : Undefined;
-    return DataViewGet(
-        context, receiver, offset, isLittleEndian,
-        ElementsKind::FLOAT64_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeGetFloat64(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const isLittleEndian: JSAny = arguments[1];
+  return DataViewGet(
+      context, receiver, offset, isLittleEndian,
+      ElementsKind::FLOAT64_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeGetBigUint64(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 1 ? arguments[1] : Undefined;
-    return DataViewGet(
-        context, receiver, offset, isLittleEndian,
-        ElementsKind::BIGUINT64_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeGetBigUint64(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const isLittleEndian: JSAny = arguments[1];
+  return DataViewGet(
+      context, receiver, offset, isLittleEndian,
+      ElementsKind::BIGUINT64_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeGetBigInt64(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 1 ? arguments[1] : Undefined;
-    return DataViewGet(
-        context, receiver, offset, isLittleEndian,
-        ElementsKind::BIGINT64_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeGetBigInt64(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const isLittleEndian: JSAny = arguments[1];
+  return DataViewGet(
+      context, receiver, offset, isLittleEndian,
+      ElementsKind::BIGINT64_ELEMENTS);
+}
 
-  extern macro ToNumber(Context, JSAny): Number;
-  extern macro ToBigInt(Context, JSAny): BigInt;
-  extern macro TruncateFloat64ToWord32(float64): uint32;
+extern macro ToNumber(Context, JSAny): Number;
+extern macro ToBigInt(Context, JSAny): BigInt;
+extern macro TruncateFloat64ToWord32(float64): uint32;
 
-  extern macro DataViewBuiltinsAssembler::StoreWord8(RawPtr, uintptr, uint32):
-      void;
+extern macro DataViewBuiltinsAssembler::StoreWord8(
+    RawPtr, uintptr, uint32): void;
 
-  macro StoreDataView8(buffer: JSArrayBuffer, offset: uintptr, value: uint32) {
-    StoreWord8(buffer.backing_store, offset, value & 0xFF);
-  }
+macro StoreDataView8(buffer: JSArrayBuffer, offset: uintptr, value: uint32) {
+  StoreWord8(buffer.backing_store_ptr, offset, value & 0xFF);
+}
 
-  macro StoreDataView16(
-      buffer: JSArrayBuffer, offset: uintptr, value: uint32,
-      requestedLittleEndian: bool) {
-    const dataPointer: RawPtr = buffer.backing_store;
+macro StoreDataView16(
+    buffer: JSArrayBuffer, offset: uintptr, value: uint32,
+    requestedLittleEndian: bool) {
+  const dataPointer: RawPtr = buffer.backing_store_ptr;
 
-    const b0: uint32 = value & 0xFF;
-    const b1: uint32 = (value >>> 8) & 0xFF;
+  const b0: uint32 = value & 0xFF;
+  const b1: uint32 = (value >>> 8) & 0xFF;
 
-    if (requestedLittleEndian) {
-      StoreWord8(dataPointer, offset, b0);
-      StoreWord8(dataPointer, offset + 1, b1);
-    } else {
-      StoreWord8(dataPointer, offset, b1);
-      StoreWord8(dataPointer, offset + 1, b0);
-    }
+  if (requestedLittleEndian) {
+    StoreWord8(dataPointer, offset, b0);
+    StoreWord8(dataPointer, offset + 1, b1);
+  } else {
+    StoreWord8(dataPointer, offset, b1);
+    StoreWord8(dataPointer, offset + 1, b0);
   }
+}
 
-  macro StoreDataView32(
-      buffer: JSArrayBuffer, offset: uintptr, value: uint32,
-      requestedLittleEndian: bool) {
-    const dataPointer: RawPtr = buffer.backing_store;
-
-    const b0: uint32 = value & 0xFF;
-    const b1: uint32 = (value >>> 8) & 0xFF;
-    const b2: uint32 = (value >>> 16) & 0xFF;
-    const b3: uint32 = value >>> 24;  // We don't need to mask here.
-
-    if (requestedLittleEndian) {
-      StoreWord8(dataPointer, offset, b0);
-      StoreWord8(dataPointer, offset + 1, b1);
-      StoreWord8(dataPointer, offset + 2, b2);
-      StoreWord8(dataPointer, offset + 3, b3);
-    } else {
-      StoreWord8(dataPointer, offset, b3);
-      StoreWord8(dataPointer, offset + 1, b2);
-      StoreWord8(dataPointer, offset + 2, b1);
-      StoreWord8(dataPointer, offset + 3, b0);
-    }
+macro StoreDataView32(
+    buffer: JSArrayBuffer, offset: uintptr, value: uint32,
+    requestedLittleEndian: bool) {
+  const dataPointer: RawPtr = buffer.backing_store_ptr;
+
+  const b0: uint32 = value & 0xFF;
+  const b1: uint32 = (value >>> 8) & 0xFF;
+  const b2: uint32 = (value >>> 16) & 0xFF;
+  const b3: uint32 = value >>> 24;  // We don't need to mask here.
+
+  if (requestedLittleEndian) {
+    StoreWord8(dataPointer, offset, b0);
+    StoreWord8(dataPointer, offset + 1, b1);
+    StoreWord8(dataPointer, offset + 2, b2);
+    StoreWord8(dataPointer, offset + 3, b3);
+  } else {
+    StoreWord8(dataPointer, offset, b3);
+    StoreWord8(dataPointer, offset + 1, b2);
+    StoreWord8(dataPointer, offset + 2, b1);
+    StoreWord8(dataPointer, offset + 3, b0);
   }
+}
 
-  macro StoreDataView64(
-      buffer: JSArrayBuffer, offset: uintptr, lowWord: uint32, highWord: uint32,
-      requestedLittleEndian: bool) {
-    const dataPointer: RawPtr = buffer.backing_store;
-
-    const b0: uint32 = lowWord & 0xFF;
-    const b1: uint32 = (lowWord >>> 8) & 0xFF;
-    const b2: uint32 = (lowWord >>> 16) & 0xFF;
-    const b3: uint32 = lowWord >>> 24;
-
-    const b4: uint32 = highWord & 0xFF;
-    const b5: uint32 = (highWord >>> 8) & 0xFF;
-    const b6: uint32 = (highWord >>> 16) & 0xFF;
-    const b7: uint32 = highWord >>> 24;
-
-    if (requestedLittleEndian) {
-      StoreWord8(dataPointer, offset, b0);
-      StoreWord8(dataPointer, offset + 1, b1);
-      StoreWord8(dataPointer, offset + 2, b2);
-      StoreWord8(dataPointer, offset + 3, b3);
-      StoreWord8(dataPointer, offset + 4, b4);
-      StoreWord8(dataPointer, offset + 5, b5);
-      StoreWord8(dataPointer, offset + 6, b6);
-      StoreWord8(dataPointer, offset + 7, b7);
-    } else {
-      StoreWord8(dataPointer, offset, b7);
-      StoreWord8(dataPointer, offset + 1, b6);
-      StoreWord8(dataPointer, offset + 2, b5);
-      StoreWord8(dataPointer, offset + 3, b4);
-      StoreWord8(dataPointer, offset + 4, b3);
-      StoreWord8(dataPointer, offset + 5, b2);
-      StoreWord8(dataPointer, offset + 6, b1);
-      StoreWord8(dataPointer, offset + 7, b0);
-    }
+macro StoreDataView64(
+    buffer: JSArrayBuffer, offset: uintptr, lowWord: uint32, highWord: uint32,
+    requestedLittleEndian: bool) {
+  const dataPointer: RawPtr = buffer.backing_store_ptr;
+
+  const b0: uint32 = lowWord & 0xFF;
+  const b1: uint32 = (lowWord >>> 8) & 0xFF;
+  const b2: uint32 = (lowWord >>> 16) & 0xFF;
+  const b3: uint32 = lowWord >>> 24;
+
+  const b4: uint32 = highWord & 0xFF;
+  const b5: uint32 = (highWord >>> 8) & 0xFF;
+  const b6: uint32 = (highWord >>> 16) & 0xFF;
+  const b7: uint32 = highWord >>> 24;
+
+  if (requestedLittleEndian) {
+    StoreWord8(dataPointer, offset, b0);
+    StoreWord8(dataPointer, offset + 1, b1);
+    StoreWord8(dataPointer, offset + 2, b2);
+    StoreWord8(dataPointer, offset + 3, b3);
+    StoreWord8(dataPointer, offset + 4, b4);
+    StoreWord8(dataPointer, offset + 5, b5);
+    StoreWord8(dataPointer, offset + 6, b6);
+    StoreWord8(dataPointer, offset + 7, b7);
+  } else {
+    StoreWord8(dataPointer, offset, b7);
+    StoreWord8(dataPointer, offset + 1, b6);
+    StoreWord8(dataPointer, offset + 2, b5);
+    StoreWord8(dataPointer, offset + 3, b4);
+    StoreWord8(dataPointer, offset + 4, b3);
+    StoreWord8(dataPointer, offset + 5, b2);
+    StoreWord8(dataPointer, offset + 6, b1);
+    StoreWord8(dataPointer, offset + 7, b0);
   }
+}
 
-  extern macro DataViewBuiltinsAssembler::DataViewDecodeBigIntLength(
-      BigIntBase): uint32;
-  extern macro DataViewBuiltinsAssembler::DataViewDecodeBigIntSign(BigIntBase):
-      uint32;
-
-  // We might get here a BigInt that is bigger than 64 bits, but we're only
-  // interested in the 64 lowest ones. This means the lowest BigInt digit
-  // on 64-bit platforms, and the 2 lowest BigInt digits on 32-bit ones.
-  macro StoreDataViewBigInt(
-      buffer: JSArrayBuffer, offset: uintptr, bigIntValue: BigInt,
-      requestedLittleEndian: bool) {
-    const length: uint32 = DataViewDecodeBigIntLength(bigIntValue);
-    const sign: uint32 = DataViewDecodeBigIntSign(bigIntValue);
-
-    // The 32-bit words that will hold the BigInt's value in
-    // two's complement representation.
-    let lowWord: uint32 = 0;
-    let highWord: uint32 = 0;
-
-    // The length is nonzero if and only if the BigInt's value is nonzero.
-    if (length != 0) {
-      if constexpr (Is64()) {
-        // There is always exactly 1 BigInt digit to load in this case.
-        const value: uintptr = bigint::LoadBigIntDigit(bigIntValue, 0);
-        lowWord = Convert<uint32>(value);  // Truncates value to 32 bits.
-        highWord = Convert<uint32>(value >>> 32);
-      } else {  // There might be either 1 or 2 BigInt digits we need to load.
-        lowWord = Convert<uint32>(bigint::LoadBigIntDigit(bigIntValue, 0));
-        if (length >= 2) {  // Only load the second digit if there is one.
-          highWord = Convert<uint32>(bigint::LoadBigIntDigit(bigIntValue, 1));
-        }
+extern macro DataViewBuiltinsAssembler::DataViewDecodeBigIntLength(BigIntBase):
+    uint32;
+extern macro DataViewBuiltinsAssembler::DataViewDecodeBigIntSign(BigIntBase):
+    uint32;
+
+// We might get here a BigInt that is bigger than 64 bits, but we're only
+// interested in the 64 lowest ones. This means the lowest BigInt digit
+// on 64-bit platforms, and the 2 lowest BigInt digits on 32-bit ones.
+macro StoreDataViewBigInt(
+    buffer: JSArrayBuffer, offset: uintptr, bigIntValue: BigInt,
+    requestedLittleEndian: bool) {
+  const length: uint32 = DataViewDecodeBigIntLength(bigIntValue);
+  const sign: uint32 = DataViewDecodeBigIntSign(bigIntValue);
+
+  // The 32-bit words that will hold the BigInt's value in
+  // two's complement representation.
+  let lowWord: uint32 = 0;
+  let highWord: uint32 = 0;
+
+  // The length is nonzero if and only if the BigInt's value is nonzero.
+  if (length != 0) {
+    if constexpr (Is64()) {
+      // There is always exactly 1 BigInt digit to load in this case.
+      const value: uintptr = bigint::LoadBigIntDigit(bigIntValue, 0);
+      lowWord = Convert<uint32>(value);  // Truncates value to 32 bits.
+      highWord = Convert<uint32>(value >>> 32);
+    } else {  // There might be either 1 or 2 BigInt digits we need to load.
+      lowWord = Convert<uint32>(bigint::LoadBigIntDigit(bigIntValue, 0));
+      if (length >= 2) {  // Only load the second digit if there is one.
+        highWord = Convert<uint32>(bigint::LoadBigIntDigit(bigIntValue, 1));
       }
     }
+  }
 
-    if (sign != 0) {  // The number is negative, Convert it.
-      highWord = Unsigned(0 - Signed(highWord));
-      if (lowWord != 0) {
-        highWord = Unsigned(Signed(highWord) - 1);
-      }
-      lowWord = Unsigned(0 - Signed(lowWord));
+  if (sign != 0) {  // The number is negative, Convert it.
+    highWord = Unsigned(0 - Signed(highWord));
+    if (lowWord != 0) {
+      highWord = Unsigned(Signed(highWord) - 1);
     }
-
-    StoreDataView64(buffer, offset, lowWord, highWord, requestedLittleEndian);
+    lowWord = Unsigned(0 - Signed(lowWord));
   }
 
-  // SetViewValue ( view, requestIndex, isLittleEndian, type, value )
-  // https://tc39.es/ecma262/#sec-setviewvalue
-  transitioning macro DataViewSet(
-      context: Context, receiver: JSAny, requestIndex: JSAny, value: JSAny,
-      requestedLittleEndian: JSAny, kind: constexpr ElementsKind): JSAny {
-    // 1. Perform ? RequireInternalSlot(view, [[DataView]]).
-    // 2. Assert: view has a [[ViewedArrayBuffer]] internal slot.
-    const dataView: JSDataView =
-        ValidateDataView(context, receiver, MakeDataViewSetterNameString(kind));
-
-    try {
-      // 3. Let getIndex be ? ToIndex(requestIndex).
-      const getIndex: uintptr = ToIndex(requestIndex) otherwise RangeError;
+  StoreDataView64(buffer, offset, lowWord, highWord, requestedLittleEndian);
+}
 
-      const littleEndian: bool = ToBoolean(requestedLittleEndian);
-      const buffer: JSArrayBuffer = dataView.buffer;
+// SetViewValue ( view, requestIndex, isLittleEndian, type, value )
+// https://tc39.es/ecma262/#sec-setviewvalue
+transitioning macro DataViewSet(
+    context: Context, receiver: JSAny, requestIndex: JSAny, value: JSAny,
+    requestedLittleEndian: JSAny, kind: constexpr ElementsKind): JSAny {
+  // 1. Perform ? RequireInternalSlot(view, [[DataView]]).
+  // 2. Assert: view has a [[ViewedArrayBuffer]] internal slot.
+  const dataView: JSDataView =
+      ValidateDataView(context, receiver, MakeDataViewSetterNameString(kind));
+
+  try {
+    // 3. Let getIndex be ? ToIndex(requestIndex).
+    const getIndex: uintptr = ToIndex(requestIndex) otherwise RangeError;
+
+    const littleEndian: bool = ToBoolean(requestedLittleEndian);
+    const buffer: JSArrayBuffer = dataView.buffer;
+
+    let numberValue: Numeric;
+    if constexpr (
+        kind == ElementsKind::BIGUINT64_ELEMENTS ||
+        kind == ElementsKind::BIGINT64_ELEMENTS) {
+      // 4. If ! IsBigIntElementType(type) is true, let numberValue be
+      // ? ToBigInt(value).
+      numberValue = ToBigInt(context, value);
+    } else {
+      // 5. Otherwise, let numberValue be ? ToNumber(value).
+      numberValue = ToNumber(context, value);
+    }
 
-      let numberValue: Numeric;
-      if constexpr (
-          kind == ElementsKind::BIGUINT64_ELEMENTS ||
-          kind == ElementsKind::BIGINT64_ELEMENTS) {
-        // 4. If ! IsBigIntElementType(type) is true, let numberValue be
-        // ? ToBigInt(value).
-        numberValue = ToBigInt(context, value);
-      } else {
-        // 5. Otherwise, let numberValue be ? ToNumber(value).
-        numberValue = ToNumber(context, value);
-      }
+    // 6. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+    if (IsDetachedBuffer(buffer)) {
+      ThrowTypeError(
+          MessageTemplate::kDetachedOperation,
+          MakeDataViewSetterNameString(kind));
+    }
 
-      // 6. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
-      if (IsDetachedBuffer(buffer)) {
-        ThrowTypeError(
-            MessageTemplate::kDetachedOperation,
-            MakeDataViewSetterNameString(kind));
-      }
+    // 9. Let viewOffset be view.[[ByteOffset]].
+    const viewOffset: uintptr = dataView.byte_offset;
 
-      // 9. Let viewOffset be view.[[ByteOffset]].
-      const viewOffset: uintptr = dataView.byte_offset;
+    // 10. Let viewSize be view.[[ByteLength]].
+    const viewSize: uintptr = dataView.byte_length;
 
-      // 10. Let viewSize be view.[[ByteLength]].
-      const viewSize: uintptr = dataView.byte_length;
+    // 11. Let elementSize be the Element Size value specified in Table 62
+    // for Element Type type.
+    const elementSize: uintptr = DataViewElementSize(kind);
 
-      // 11. Let elementSize be the Element Size value specified in Table 62
-      // for Element Type type.
-      const elementSize: uintptr = DataViewElementSize(kind);
+    // 12. If getIndex + elementSize > viewSize, throw a RangeError exception.
+    CheckIntegerIndexAdditionOverflow(getIndex, elementSize, viewSize)
+        otherwise RangeError;
 
-      // 12. If getIndex + elementSize > viewSize, throw a RangeError exception.
-      CheckIntegerIndexAdditionOverflow(getIndex, elementSize, viewSize)
-          otherwise RangeError;
+    // 13. Let bufferIndex be getIndex + viewOffset.
+    const bufferIndex: uintptr = getIndex + viewOffset;
 
-      // 13. Let bufferIndex be getIndex + viewOffset.
-      const bufferIndex: uintptr = getIndex + viewOffset;
+    if constexpr (
+        kind == ElementsKind::BIGUINT64_ELEMENTS ||
+        kind == ElementsKind::BIGINT64_ELEMENTS) {
+      // For these elements kinds numberValue is BigInt.
+      const bigIntValue: BigInt = %RawDownCast<BigInt>(numberValue);
+      StoreDataViewBigInt(buffer, bufferIndex, bigIntValue, littleEndian);
+    } else {
+      // For these elements kinds numberValue is Number.
+      const numValue: Number = %RawDownCast<Number>(numberValue);
+      const doubleValue: float64 = ChangeNumberToFloat64(numValue);
 
       if constexpr (
-          kind == ElementsKind::BIGUINT64_ELEMENTS ||
-          kind == ElementsKind::BIGINT64_ELEMENTS) {
-        // For these elements kinds numberValue is BigInt.
-        const bigIntValue: BigInt = %RawDownCast<BigInt>(numberValue);
-        StoreDataViewBigInt(buffer, bufferIndex, bigIntValue, littleEndian);
-      } else {
-        // For these elements kinds numberValue is Number.
-        const numValue: Number = %RawDownCast<Number>(numberValue);
-        const doubleValue: float64 = ChangeNumberToFloat64(numValue);
-
-        if constexpr (
-            kind == ElementsKind::UINT8_ELEMENTS ||
-            kind == ElementsKind::INT8_ELEMENTS) {
-          StoreDataView8(
-              buffer, bufferIndex, TruncateFloat64ToWord32(doubleValue));
-        } else if constexpr (
-            kind == ElementsKind::UINT16_ELEMENTS ||
-            kind == ElementsKind::INT16_ELEMENTS) {
-          StoreDataView16(
-              buffer, bufferIndex, TruncateFloat64ToWord32(doubleValue),
-              littleEndian);
-        } else if constexpr (
-            kind == ElementsKind::UINT32_ELEMENTS ||
-            kind == ElementsKind::INT32_ELEMENTS) {
-          StoreDataView32(
-              buffer, bufferIndex, TruncateFloat64ToWord32(doubleValue),
-              littleEndian);
-        } else if constexpr (kind == ElementsKind::FLOAT32_ELEMENTS) {
-          const floatValue: float32 = TruncateFloat64ToFloat32(doubleValue);
-          StoreDataView32(
-              buffer, bufferIndex, BitcastFloat32ToInt32(floatValue),
-              littleEndian);
-        } else if constexpr (kind == ElementsKind::FLOAT64_ELEMENTS) {
-          const lowWord: uint32 = Float64ExtractLowWord32(doubleValue);
-          const highWord: uint32 = Float64ExtractHighWord32(doubleValue);
-          StoreDataView64(buffer, bufferIndex, lowWord, highWord, littleEndian);
-        }
+          kind == ElementsKind::UINT8_ELEMENTS ||
+          kind == ElementsKind::INT8_ELEMENTS) {
+        StoreDataView8(
+            buffer, bufferIndex, TruncateFloat64ToWord32(doubleValue));
+      } else if constexpr (
+          kind == ElementsKind::UINT16_ELEMENTS ||
+          kind == ElementsKind::INT16_ELEMENTS) {
+        StoreDataView16(
+            buffer, bufferIndex, TruncateFloat64ToWord32(doubleValue),
+            littleEndian);
+      } else if constexpr (
+          kind == ElementsKind::UINT32_ELEMENTS ||
+          kind == ElementsKind::INT32_ELEMENTS) {
+        StoreDataView32(
+            buffer, bufferIndex, TruncateFloat64ToWord32(doubleValue),
+            littleEndian);
+      } else if constexpr (kind == ElementsKind::FLOAT32_ELEMENTS) {
+        const floatValue: float32 = TruncateFloat64ToFloat32(doubleValue);
+        StoreDataView32(
+            buffer, bufferIndex, BitcastFloat32ToInt32(floatValue),
+            littleEndian);
+      } else if constexpr (kind == ElementsKind::FLOAT64_ELEMENTS) {
+        const lowWord: uint32 = Float64ExtractLowWord32(doubleValue);
+        const highWord: uint32 = Float64ExtractHighWord32(doubleValue);
+        StoreDataView64(buffer, bufferIndex, lowWord, highWord, littleEndian);
       }
-      return Undefined;
-    }
-    label RangeError {
-      ThrowRangeError(MessageTemplate::kInvalidDataViewAccessorOffset);
     }
+    return Undefined;
+  } label RangeError {
+    ThrowRangeError(MessageTemplate::kInvalidDataViewAccessorOffset);
   }
+}
 
-  transitioning javascript builtin DataViewPrototypeSetUint8(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
-    return DataViewSet(
-        context, receiver, offset, value, Undefined,
-        ElementsKind::UINT8_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeSetUint8(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const value: JSAny = arguments[1];
+  return DataViewSet(
+      context, receiver, offset, value, Undefined,
+      ElementsKind::UINT8_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeSetInt8(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
-    return DataViewSet(
-        context, receiver, offset, value, Undefined,
-        ElementsKind::INT8_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeSetInt8(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const value: JSAny = arguments[1];
+  return DataViewSet(
+      context, receiver, offset, value, Undefined, ElementsKind::INT8_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeSetUint16(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 2 ? arguments[2] : Undefined;
-    return DataViewSet(
-        context, receiver, offset, value, isLittleEndian,
-        ElementsKind::UINT16_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeSetUint16(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const value: JSAny = arguments[1];
+  const isLittleEndian: JSAny = arguments[2];
+  return DataViewSet(
+      context, receiver, offset, value, isLittleEndian,
+      ElementsKind::UINT16_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeSetInt16(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 2 ? arguments[2] : Undefined;
-    return DataViewSet(
-        context, receiver, offset, value, isLittleEndian,
-        ElementsKind::INT16_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeSetInt16(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const value: JSAny = arguments[1];
+  const isLittleEndian: JSAny = arguments[2];
+  return DataViewSet(
+      context, receiver, offset, value, isLittleEndian,
+      ElementsKind::INT16_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeSetUint32(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 2 ? arguments[2] : Undefined;
-    return DataViewSet(
-        context, receiver, offset, value, isLittleEndian,
-        ElementsKind::UINT32_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeSetUint32(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const value: JSAny = arguments[1];
+  const isLittleEndian: JSAny = arguments[2];
+  return DataViewSet(
+      context, receiver, offset, value, isLittleEndian,
+      ElementsKind::UINT32_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeSetInt32(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 2 ? arguments[2] : Undefined;
-    return DataViewSet(
-        context, receiver, offset, value, isLittleEndian,
-        ElementsKind::INT32_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeSetInt32(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const value: JSAny = arguments[1];
+  const isLittleEndian: JSAny = arguments[2];
+  return DataViewSet(
+      context, receiver, offset, value, isLittleEndian,
+      ElementsKind::INT32_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeSetFloat32(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 2 ? arguments[2] : Undefined;
-    return DataViewSet(
-        context, receiver, offset, value, isLittleEndian,
-        ElementsKind::FLOAT32_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeSetFloat32(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const value: JSAny = arguments[1];
+  const isLittleEndian: JSAny = arguments[2];
+  return DataViewSet(
+      context, receiver, offset, value, isLittleEndian,
+      ElementsKind::FLOAT32_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeSetFloat64(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 2 ? arguments[2] : Undefined;
-    return DataViewSet(
-        context, receiver, offset, value, isLittleEndian,
-        ElementsKind::FLOAT64_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeSetFloat64(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const value: JSAny = arguments[1];
+  const isLittleEndian: JSAny = arguments[2];
+  return DataViewSet(
+      context, receiver, offset, value, isLittleEndian,
+      ElementsKind::FLOAT64_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeSetBigUint64(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 2 ? arguments[2] : Undefined;
-    return DataViewSet(
-        context, receiver, offset, value, isLittleEndian,
-        ElementsKind::BIGUINT64_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeSetBigUint64(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const value: JSAny = arguments[1];
+  const isLittleEndian: JSAny = arguments[2];
+  return DataViewSet(
+      context, receiver, offset, value, isLittleEndian,
+      ElementsKind::BIGUINT64_ELEMENTS);
+}
 
-  transitioning javascript builtin DataViewPrototypeSetBigInt64(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const offset: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const value: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
-    const isLittleEndian: JSAny =
-        arguments.length > 2 ? arguments[2] : Undefined;
-    return DataViewSet(
-        context, receiver, offset, value, isLittleEndian,
-        ElementsKind::BIGINT64_ELEMENTS);
-  }
+transitioning javascript builtin DataViewPrototypeSetBigInt64(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const offset: JSAny = arguments[0];
+  const value: JSAny = arguments[1];
+  const isLittleEndian: JSAny = arguments[2];
+  return DataViewSet(
+      context, receiver, offset, value, isLittleEndian,
+      ElementsKind::BIGINT64_ELEMENTS);
+}
 }
diff --git a/deps/v8/src/builtins/finalization-registry.tq b/deps/v8/src/builtins/finalization-registry.tq
new file mode 100644
index 00000000000..143486c7376
--- /dev/null
+++ b/deps/v8/src/builtins/finalization-registry.tq
@@ -0,0 +1,105 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+namespace runtime {
+extern runtime
+ShrinkFinalizationRegistryUnregisterTokenMap(
+    Context, JSFinalizationRegistry): void;
+}
+
+namespace weakref {
+extern transitioning macro
+RemoveFinalizationRegistryCellFromUnregisterTokenMap(
+    JSFinalizationRegistry, WeakCell): void;
+
+macro SplitOffTail(weakCell: WeakCell): WeakCell|Undefined {
+  const weakCellTail = weakCell.next;
+  weakCell.next = Undefined;
+  typeswitch (weakCellTail) {
+    case (Undefined): {
+    }
+    case (tailIsNowAHead: WeakCell): {
+      assert(tailIsNowAHead.prev == weakCell);
+      tailIsNowAHead.prev = Undefined;
+    }
+  }
+  return weakCellTail;
+}
+
+transitioning macro
+PopClearedCell(finalizationRegistry: JSFinalizationRegistry): WeakCell|
+    Undefined {
+  typeswitch (finalizationRegistry.cleared_cells) {
+    case (Undefined): {
+      return Undefined;
+    }
+    case (weakCell: WeakCell): {
+      assert(weakCell.prev == Undefined);
+      finalizationRegistry.cleared_cells = SplitOffTail(weakCell);
+
+      // If the WeakCell has an unregister token, remove the cell from the
+      // unregister token linked lists and and the unregister token from
+      // key_map. This doesn't shrink key_map, which is done manually after
+      // the cleanup loop to avoid a runtime call.
+      if (weakCell.unregister_token != Undefined) {
+        RemoveFinalizationRegistryCellFromUnregisterTokenMap(
+            finalizationRegistry, weakCell);
+      }
+
+      return weakCell;
+    }
+  }
+}
+
+transitioning macro
+FinalizationRegistryCleanupLoop(implicit context: Context)(
+    finalizationRegistry: JSFinalizationRegistry, callback: Callable) {
+  while (true) {
+    const weakCellHead = PopClearedCell(finalizationRegistry);
+    typeswitch (weakCellHead) {
+      case (Undefined): {
+        break;
+      }
+      case (weakCell: WeakCell): {
+        try {
+          Call(context, callback, Undefined, weakCell.holdings);
+        } catch (e) {
+          runtime::ShrinkFinalizationRegistryUnregisterTokenMap(
+              context, finalizationRegistry);
+          ReThrow(context, e);
+        }
+      }
+    }
+  }
+
+  runtime::ShrinkFinalizationRegistryUnregisterTokenMap(
+      context, finalizationRegistry);
+}
+
+transitioning javascript builtin
+FinalizationRegistryPrototypeCleanupSome(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // 1. Let finalizationRegistry be the this value.
+  //
+  // 2. Perform ? RequireInternalSlot(finalizationRegistry, [[Cells]]).
+  const methodName: constexpr string =
+      'FinalizationRegistry.prototype.cleanupSome';
+  const finalizationRegistry =
+      Cast<JSFinalizationRegistry>(receiver) otherwise ThrowTypeError(
+          MessageTemplate::kIncompatibleMethodReceiver, methodName, receiver);
+
+  let callback: Callable;
+  if (arguments[0] != Undefined) {
+    // 4. If callback is not undefined and IsCallable(callback) is
+    //    false, throw a TypeError exception.
+    callback = Cast<Callable>(arguments[0]) otherwise ThrowTypeError(
+        MessageTemplate::kWeakRefsCleanupMustBeCallable, arguments[0]);
+  } else {
+    callback = finalizationRegistry.cleanup;
+  }
+
+  FinalizationRegistryCleanupLoop(finalizationRegistry, callback);
+  return Undefined;
+}
+}
diff --git a/deps/v8/src/builtins/function.tq b/deps/v8/src/builtins/function.tq
new file mode 100644
index 00000000000..8266714c7be
--- /dev/null
+++ b/deps/v8/src/builtins/function.tq
@@ -0,0 +1,109 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+namespace function {
+
+extern macro OrdinaryHasInstance(Context, Object, Object): JSAny;
+
+// ES6 section 19.2.3.6 Function.prototype[@@hasInstance]
+javascript builtin FunctionPrototypeHasInstance(
+    js-implicit context: NativeContext, receiver: JSAny)(value: JSAny): JSAny {
+  return OrdinaryHasInstance(context, receiver, value);
+}
+
+extern transitioning builtin
+FunctionPrototypeBind(implicit context: Context)(
+    JSFunction, JSAny, int32): JSAny;
+
+const kLengthDescriptorIndex:
+    constexpr int32 generates 'JSFunction::kLengthDescriptorIndex';
+const kNameDescriptorIndex:
+    constexpr int32 generates 'JSFunction::kNameDescriptorIndex';
+const kMinDescriptorsForFastBind:
+    constexpr int31 generates 'JSFunction::kMinDescriptorsForFastBind';
+
+macro CheckAccessor(implicit context: Context)(
+    array: DescriptorArray, index: constexpr int32, name: Name) labels Slow {
+  const descriptor: DescriptorEntry = array.descriptors[index];
+  const key: Name|Undefined = descriptor.key;
+  if (!TaggedEqual(key, name)) goto Slow;
+
+  // The descriptor value must be an AccessorInfo.
+  Cast<AccessorInfo>(descriptor.value) otherwise goto Slow;
+}
+
+// ES6 section 19.2.3.2 Function.prototype.bind
+transitioning javascript builtin
+FastFunctionPrototypeBind(
+    js-implicit context: NativeContext, receiver: JSAny, newTarget: JSAny,
+    target: JSFunction)(...arguments): JSAny {
+  const argc: intptr = arguments.length;
+  try {
+    typeswitch (receiver) {
+      case (fn: JSFunction|JSBoundFunction): {
+        // Disallow binding of slow-mode functions. We need to figure out
+        // whether the length and name property are in the original state.
+        Comment('Disallow binding of slow-mode functions');
+        if (IsDictionaryMap(fn.map)) goto Slow;
+
+        // Check whether the length and name properties are still present as
+        // AccessorInfo objects. If so, their value can be recomputed even if
+        // the actual value on the object changes.
+
+        if (fn.map.bit_field3.number_of_own_descriptors <
+            kMinDescriptorsForFastBind) {
+          goto Slow;
+        }
+
+        const descriptors: DescriptorArray = fn.map.instance_descriptors;
+        CheckAccessor(
+            descriptors, kLengthDescriptorIndex, LengthStringConstant())
+            otherwise Slow;
+        CheckAccessor(descriptors, kNameDescriptorIndex, NameStringConstant())
+            otherwise Slow;
+
+        // Choose the right bound function map based on whether the target is
+        // constructable.
+
+        const boundFunctionMap: Map = UnsafeCast<Map>(
+            IsConstructor(fn) ?
+                context[NativeContextSlot::
+                            BOUND_FUNCTION_WITH_CONSTRUCTOR_MAP_INDEX] :
+                context[NativeContextSlot::
+                            BOUND_FUNCTION_WITHOUT_CONSTRUCTOR_MAP_INDEX]);
+
+        // Verify that prototype matches that of the target bound function.
+
+        if (fn.map.prototype != boundFunctionMap.prototype) goto Slow;
+
+        // Allocate the arguments array.
+
+        const argumentsArray = arguments.length <= 1 ?
+            kEmptyFixedArray :
+            NewFixedArray(
+                arguments.length - 1, ArgumentsIterator{arguments, current: 1});
+
+        const boundReceiver: JSAny = arguments[0];
+
+        const result = new JSBoundFunction{
+          map: boundFunctionMap,
+          properties_or_hash: kEmptyFixedArray,
+          elements: kEmptyFixedArray,
+          bound_target_function: fn,
+          bound_this: boundReceiver,
+          bound_arguments: argumentsArray
+        };
+        return result;
+      }
+
+      case (JSAny): {
+        goto Slow;
+      }
+    }
+  } label Slow {
+    tail FunctionPrototypeBind(
+        LoadTargetFromFrame(), newTarget, Convert<int32>(argc));
+  }
+}
+}  // namespace function
diff --git a/deps/v8/src/builtins/growable-fixed-array-gen.cc b/deps/v8/src/builtins/growable-fixed-array-gen.cc
index 487d01c060a..042207bff6a 100644
--- a/deps/v8/src/builtins/growable-fixed-array-gen.cc
+++ b/deps/v8/src/builtins/growable-fixed-array-gen.cc
@@ -33,6 +33,10 @@ void GrowableFixedArray::Push(const TNode<Object> value) {
   }
 }
 
+TNode<FixedArray> GrowableFixedArray::ToFixedArray() {
+  return ResizeFixedArray(length(), length());
+}
+
 TNode<JSArray> GrowableFixedArray::ToJSArray(const TNode<Context> context) {
   const ElementsKind kind = PACKED_ELEMENTS;
 
diff --git a/deps/v8/src/builtins/growable-fixed-array-gen.h b/deps/v8/src/builtins/growable-fixed-array-gen.h
index 6e5d2ac7683..e61fce37e8d 100644
--- a/deps/v8/src/builtins/growable-fixed-array-gen.h
+++ b/deps/v8/src/builtins/growable-fixed-array-gen.h
@@ -32,6 +32,7 @@ class GrowableFixedArray : public CodeStubAssembler {
 
   void Push(const TNode<Object> value);
 
+  TNode<FixedArray> ToFixedArray();
   TNode<JSArray> ToJSArray(const TNode<Context> context);
 
  private:
diff --git a/deps/v8/src/builtins/growable-fixed-array.tq b/deps/v8/src/builtins/growable-fixed-array.tq
index 0666c39fd75..af9418b0c91 100644
--- a/deps/v8/src/builtins/growable-fixed-array.tq
+++ b/deps/v8/src/builtins/growable-fixed-array.tq
@@ -3,44 +3,45 @@
 // found in the LICENSE file.
 
 namespace growable_fixed_array {
-  // TODO(pwong): Support FixedTypedArrays.
-  struct GrowableFixedArray {
-    macro Push(obj: Object) {
-      this.EnsureCapacity();
-      this.array.objects[this.length++] = obj;
-    }
-    macro ResizeFixedArray(newCapacity: intptr): FixedArray {
-      assert(this.length >= 0);
-      assert(newCapacity >= 0);
-      assert(newCapacity >= this.length);
-      const first: intptr = 0;
-      return ExtractFixedArray(this.array, first, this.length, newCapacity);
-    }
-    macro EnsureCapacity() {
-      assert(this.length <= this.capacity);
-      if (this.capacity == this.length) {
-        // Growth rate is analog to JSObject::NewElementsCapacity:
-        // new_capacity = (current_capacity + (current_capacity >> 1)) + 16.
-        this.capacity = this.capacity + (this.capacity >> 1) + 16;
-        this.array = this.ResizeFixedArray(this.capacity);
-      }
-    }
-    macro ToJSArray(implicit context: Context)(): JSArray {
-      const nativeContext: NativeContext = LoadNativeContext(context);
-      const map: Map =
-          LoadJSArrayElementsMap(ElementsKind::PACKED_ELEMENTS, nativeContext);
-      const fixedArray: FixedArray = this.ResizeFixedArray(this.length);
-      const lengthSmi = Convert<Smi>(this.length);
-      return AllocateJSArray(map, fixedArray, lengthSmi);
+// TODO(pwong): Support FixedTypedArrays.
+struct GrowableFixedArray {
+  macro Push(obj: Object) {
+    this.EnsureCapacity();
+    this.array.objects[this.length++] = obj;
+  }
+  macro ResizeFixedArray(newCapacity: intptr): FixedArray {
+    assert(this.length >= 0);
+    assert(newCapacity >= 0);
+    assert(newCapacity >= this.length);
+    const first: intptr = 0;
+    return ExtractFixedArray(this.array, first, this.length, newCapacity);
+  }
+  macro EnsureCapacity() {
+    assert(this.length <= this.capacity);
+    if (this.capacity == this.length) {
+      // Growth rate is analog to JSObject::NewElementsCapacity:
+      // new_capacity = (current_capacity + (current_capacity >> 1)) + 16.
+      this.capacity = this.capacity + (this.capacity >> 1) + 16;
+      this.array = this.ResizeFixedArray(this.capacity);
     }
-
-    array: FixedArray;
-    // TODO(v8:4153): make capacity and length uintptr
-    capacity: intptr;
-    length: intptr;
   }
 
-  macro NewGrowableFixedArray(): GrowableFixedArray {
-    return GrowableFixedArray{array: kEmptyFixedArray, capacity: 0, length: 0};
+  macro ToJSArray(implicit context: Context)(): JSArray {
+    const nativeContext: NativeContext = LoadNativeContext(context);
+    const map: Map =
+        LoadJSArrayElementsMap(ElementsKind::PACKED_ELEMENTS, nativeContext);
+    const fixedArray: FixedArray = this.ResizeFixedArray(this.length);
+    const lengthSmi = Convert<Smi>(this.length);
+    return AllocateJSArray(map, fixedArray, lengthSmi);
   }
+
+  array: FixedArray;
+  // TODO(v8:4153): make capacity and length uintptr
+  capacity: intptr;
+  length: intptr;
+}
+
+macro NewGrowableFixedArray(): GrowableFixedArray {
+  return GrowableFixedArray{array: kEmptyFixedArray, capacity: 0, length: 0};
+}
 }
diff --git a/deps/v8/src/builtins/ia32/builtins-ia32.cc b/deps/v8/src/builtins/ia32/builtins-ia32.cc
index 5bea93214cc..04a1fa9e0db 100644
--- a/deps/v8/src/builtins/ia32/builtins-ia32.cc
+++ b/deps/v8/src/builtins/ia32/builtins-ia32.cc
@@ -130,31 +130,22 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     __ push(eax);
     __ SmiUntag(eax);
 
+#ifdef V8_REVERSE_JSARGS
+    // Set up pointer to first argument (skip receiver).
+    __ lea(esi, Operand(ebp, StandardFrameConstants::kCallerSPOffset +
+                                 kSystemPointerSize));
+    // Copy arguments to the expression stack.
+    __ PushArray(esi, eax, ecx);
+    // The receiver for the builtin/api call.
+    __ PushRoot(RootIndex::kTheHoleValue);
+#else
     // The receiver for the builtin/api call.
     __ PushRoot(RootIndex::kTheHoleValue);
-
     // Set up pointer to last argument. We are using esi as scratch register.
     __ lea(esi, Operand(ebp, StandardFrameConstants::kCallerSPOffset));
-
-    // Copy arguments and receiver to the expression stack.
-    Label loop, entry;
-    __ mov(ecx, eax);
-    // ----------- S t a t e -------------
-    //  --                eax: number of arguments (untagged)
-    //  --                edi: constructor function
-    //  --                edx: new target
-    //  --                esi: pointer to last argument
-    //  --                ecx: counter
-    //  -- sp[0*kSystemPointerSize]: the hole (receiver)
-    //  -- sp[1*kSystemPointerSize]: number of arguments (tagged)
-    //  -- sp[2*kSystemPointerSize]: context
-    // -----------------------------------
-    __ jmp(&entry);
-    __ bind(&loop);
-    __ push(Operand(esi, ecx, times_system_pointer_size, 0));
-    __ bind(&entry);
-    __ dec(ecx);
-    __ j(greater_equal, &loop);
+    // Copy arguments to the expression stack.
+    __ PushArray(esi, eax, ecx);
+#endif
 
     // Call the function.
     // eax: number of arguments (untagged)
@@ -254,29 +245,34 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
     // Restore new target.
     __ Pop(edx);
 
-    // Push the allocated receiver to the stack. We need two copies
-    // because we may have to return the original one and the calling
-    // conventions dictate that the called function pops the receiver.
+    // Push the allocated receiver to the stack.
     __ Push(eax);
+
+#ifdef V8_REVERSE_JSARGS
+    // We need two copies because we may have to return the original one
+    // and the calling conventions dictate that the called function pops the
+    // receiver. The second copy is pushed after the arguments, we saved in r8
+    // since rax needs to store the number of arguments before
+    // InvokingFunction.
+    __ movd(xmm0, eax);
+
+    // Set up pointer to first argument (skip receiver).
+    __ lea(edi, Operand(ebp, StandardFrameConstants::kCallerSPOffset +
+                                 kSystemPointerSize));
+#else
+    // We need two copies because we may have to return the original one
+    // and the calling conventions dictate that the called function pops the
+    // receiver.
     __ Push(eax);
 
-    // ----------- S t a t e -------------
-    //  --                edx: new target
-    //  -- sp[0*kSystemPointerSize]: implicit receiver
-    //  -- sp[1*kSystemPointerSize]: implicit receiver
-    //  -- sp[2*kSystemPointerSize]: padding
-    //  -- sp[3*kSystemPointerSize]: constructor function
-    //  -- sp[4*kSystemPointerSize]: number of arguments (tagged)
-    //  -- sp[5*kSystemPointerSize]: context
-    // -----------------------------------
+    // Set up pointer to last argument.
+    __ lea(edi, Operand(ebp, StandardFrameConstants::kCallerSPOffset));
+#endif
 
     // Restore argument count.
     __ mov(eax, Operand(ebp, ConstructFrameConstants::kLengthOffset));
     __ SmiUntag(eax);
 
-    // Set up pointer to last argument.
-    __ lea(edi, Operand(ebp, StandardFrameConstants::kCallerSPOffset));
-
     // Check if we have enough stack space to push all arguments.
     // Argument count in eax. Clobbers ecx.
     Label enough_stack_space, stack_overflow;
@@ -292,27 +288,14 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
 
     __ bind(&enough_stack_space);
 
-    // Copy arguments and receiver to the expression stack.
-    Label loop, entry;
-    __ mov(ecx, eax);
-    // ----------- S t a t e -------------
-    //  --                        eax: number of arguments (untagged)
-    //  --                        edx: new target
-    //  --                        edi: pointer to last argument
-    //  --                        ecx: counter (tagged)
-    //  --         sp[0*kSystemPointerSize]: implicit receiver
-    //  --         sp[1*kSystemPointerSize]: implicit receiver
-    //  --         sp[2*kSystemPointerSize]: padding
-    //  --         sp[3*kSystemPointerSize]: constructor function
-    //  --         sp[4*kSystemPointerSize]: number of arguments (tagged)
-    //  --         sp[5*kSystemPointerSize]: context
-    // -----------------------------------
-    __ jmp(&entry, Label::kNear);
-    __ bind(&loop);
-    __ Push(Operand(edi, ecx, times_system_pointer_size, 0));
-    __ bind(&entry);
-    __ dec(ecx);
-    __ j(greater_equal, &loop);
+    // Copy arguments to the expression stack.
+    __ PushArray(edi, eax, ecx);
+
+#ifdef V8_REVERSE_JSARGS
+    // Push implicit receiver.
+    __ movd(ecx, xmm0);
+    __ Push(ecx);
+#endif
 
     // Restore and and call the constructor function.
     __ mov(edi, Operand(ebp, ConstructFrameConstants::kConstructorOffset));
@@ -536,9 +519,13 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     // Load the previous frame pointer (edx) to access C arguments
     __ mov(scratch1, Operand(ebp, 0));
 
-    // Push the function and the receiver onto the stack.
+    // Push the function.
     __ push(Operand(scratch1, EntryFrameConstants::kFunctionArgOffset));
+
+#ifndef V8_REVERSE_JSARGS
+    // And the receiver onto the stack.
     __ push(Operand(scratch1, EntryFrameConstants::kReceiverArgOffset));
+#endif
 
     // Load the number of arguments and setup pointer to the arguments.
     __ mov(eax, Operand(scratch1, EntryFrameConstants::kArgcOffset));
@@ -558,6 +545,18 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     __ bind(&enough_stack_space);
 
     // Copy arguments to the stack in a loop.
+#ifdef V8_REVERSE_JSARGS
+    Label loop, entry;
+    __ Move(ecx, eax);
+    __ jmp(&entry, Label::kNear);
+    __ bind(&loop);
+    // Push the parameter from argv.
+    __ mov(scratch2, Operand(scratch1, ecx, times_system_pointer_size, 0));
+    __ push(Operand(scratch2, 0));  // dereference handle
+    __ bind(&entry);
+    __ dec(ecx);
+    __ j(greater_equal, &loop);
+#else
     Label loop, entry;
     __ Move(ecx, Immediate(0));
     __ jmp(&entry, Label::kNear);
@@ -569,10 +568,16 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     __ bind(&entry);
     __ cmp(ecx, eax);
     __ j(not_equal, &loop);
+#endif
 
-    // Load the previous frame pointer (ebx) to access C arguments
+    // Load the previous frame pointer to access C arguments
     __ mov(scratch2, Operand(ebp, 0));
 
+#ifdef V8_REVERSE_JSARGS
+    // Push the receiver onto the stack.
+    __ push(Operand(scratch2, EntryFrameConstants::kReceiverArgOffset));
+#endif
+
     // Get the new.target and function from the frame.
     __ mov(edx, Operand(scratch2, EntryFrameConstants::kNewTargetArgOffset));
     __ mov(edi, Operand(scratch2, EntryFrameConstants::kFunctionArgOffset));
@@ -662,15 +667,17 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   // Pop return address.
   __ PopReturnAddressTo(eax);
 
+#ifndef V8_REVERSE_JSARGS
   // Push receiver.
   __ Push(FieldOperand(edx, JSGeneratorObject::kReceiverOffset));
+#endif
 
   // ----------- S t a t e -------------
   //  -- eax    : return address
   //  -- edx    : the JSGeneratorObject to resume
   //  -- edi    : generator function
   //  -- esi    : generator context
-  //  -- esp[0] : generator receiver
+  //  -- esp[0] : generator receiver, if V8_REVERSE_JSARGS is not set
   // -----------------------------------
 
   {
@@ -682,6 +689,24 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
                         ecx, SharedFunctionInfo::kFormalParameterCountOffset));
     __ mov(ebx,
            FieldOperand(edx, JSGeneratorObject::kParametersAndRegistersOffset));
+#ifdef V8_REVERSE_JSARGS
+    {
+      Label done_loop, loop;
+      __ mov(edi, ecx);
+
+      __ bind(&loop);
+      __ dec(edi);
+      __ j(less, &done_loop);
+      __ Push(
+          FieldOperand(ebx, edi, times_tagged_size, FixedArray::kHeaderSize));
+      __ jmp(&loop);
+
+      __ bind(&done_loop);
+    }
+
+    // Push receiver.
+    __ Push(FieldOperand(edx, JSGeneratorObject::kReceiverOffset));
+#else
     {
       Label done_loop, loop;
       __ Set(edi, 0);
@@ -689,13 +714,14 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
       __ bind(&loop);
       __ cmp(edi, ecx);
       __ j(greater_equal, &done_loop);
-      __ Push(FieldOperand(ebx, edi, times_system_pointer_size,
-                           FixedArray::kHeaderSize));
+      __ Push(
+          FieldOperand(ebx, edi, times_tagged_size, FixedArray::kHeaderSize));
       __ add(edi, Immediate(1));
       __ jmp(&loop);
 
       __ bind(&done_loop);
     }
+#endif
 
     // Restore registers.
     __ mov(edi, FieldOperand(edx, JSGeneratorObject::kFunctionOffset));
@@ -1211,11 +1237,19 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
   Label loop_header, loop_check;
   __ jmp(&loop_check);
   __ bind(&loop_header);
+#ifdef V8_REVERSE_JSARGS
+  __ Push(Operand(array_limit, 0));
+  __ bind(&loop_check);
+  __ add(array_limit, Immediate(kSystemPointerSize));
+  __ cmp(array_limit, start_address);
+  __ j(below_equal, &loop_header, Label::kNear);
+#else
   __ Push(Operand(start_address, 0));
   __ sub(start_address, Immediate(kSystemPointerSize));
   __ bind(&loop_check);
   __ cmp(start_address, array_limit);
   __ j(above, &loop_header, Label::kNear);
+#endif
 }
 
 // static
@@ -1235,6 +1269,14 @@ void Builtins::Generate_InterpreterPushArgsThenCallImpl(
   const Register argv = ecx;
 
   Label stack_overflow;
+
+#ifdef V8_REVERSE_JSARGS
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+    // The spread argument should not be pushed.
+    __ dec(eax);
+  }
+#endif
+
   // Add a stack check before pushing the arguments.
   Generate_StackOverflowCheck(masm, eax, scratch, &stack_overflow, true);
 
@@ -1242,11 +1284,37 @@ void Builtins::Generate_InterpreterPushArgsThenCallImpl(
 
   // Compute the expected number of arguments.
   __ mov(scratch, eax);
-  __ add(scratch, Immediate(1));  // Add one for receiver.
 
   // Pop return address to allow tail-call after pushing arguments.
   __ PopReturnAddressTo(eax);
 
+#ifdef V8_REVERSE_JSARGS
+  if (receiver_mode != ConvertReceiverMode::kNullOrUndefined) {
+    __ add(scratch, Immediate(1));  // Add one for receiver.
+  }
+
+  // Find the address of the last argument.
+  __ shl(scratch, kSystemPointerSizeLog2);
+  __ neg(scratch);
+  __ add(scratch, argv);
+
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+    __ movd(xmm1, scratch);
+    Generate_InterpreterPushArgs(masm, scratch, argv);
+    // Pass the spread in the register ecx.
+    __ movd(ecx, xmm1);
+    __ mov(ecx, Operand(ecx, 0));
+  } else {
+    Generate_InterpreterPushArgs(masm, scratch, argv);
+  }
+
+  // Push "undefined" as the receiver arg if we need to.
+  if (receiver_mode == ConvertReceiverMode::kNullOrUndefined) {
+    __ PushRoot(RootIndex::kUndefinedValue);
+  }
+#else
+  __ add(scratch, Immediate(1));  // Add one for receiver.
+
   // Push "undefined" as the receiver arg if we need to.
   if (receiver_mode == ConvertReceiverMode::kNullOrUndefined) {
     __ PushRoot(RootIndex::kUndefinedValue);
@@ -1259,18 +1327,22 @@ void Builtins::Generate_InterpreterPushArgsThenCallImpl(
   __ add(scratch, argv);
   Generate_InterpreterPushArgs(masm, scratch, argv);
 
-  // Call the target.
-
   if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     __ Pop(ecx);                // Pass the spread in a register
-    __ PushReturnAddressFrom(eax);
-    __ movd(eax, xmm0);         // Restore number of arguments.
+  }
+#endif
+
+  __ PushReturnAddressFrom(eax);
+  __ movd(eax, xmm0);  // Restore number of arguments.
+
+  // Call the target.
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+#ifndef V8_REVERSE_JSARGS
     __ sub(eax, Immediate(1));  // Subtract one for spread
+#endif
     __ Jump(BUILTIN_CODE(masm->isolate(), CallWithSpread),
             RelocInfo::CODE_TARGET);
   } else {
-    __ PushReturnAddressFrom(eax);
-    __ movd(eax, xmm0);  // Restore number of arguments.
     __ Jump(masm->isolate()->builtins()->Call(ConvertReceiverMode::kAny),
             RelocInfo::CODE_TARGET);
   }
@@ -1328,6 +1400,25 @@ void Generate_InterpreterPushZeroAndArgsAndReturnAddress(
   // Step 3 copy arguments to correct locations.
   // Slot meant for receiver contains return address. Reset it so that
   // we will not incorrectly interpret return address as an object.
+#ifdef V8_REVERSE_JSARGS
+  __ mov(Operand(esp, (num_slots_to_move + 1) * kSystemPointerSize),
+         Immediate(0));
+  __ mov(scratch1, Immediate(0));
+
+  Label loop_header, loop_check;
+  __ jmp(&loop_check);
+  __ bind(&loop_header);
+  __ mov(scratch2, Operand(start_addr, 0));
+  __ mov(Operand(esp, scratch1, times_system_pointer_size,
+                 (num_slots_to_move + 1) * kSystemPointerSize),
+         scratch2);
+  __ sub(start_addr, Immediate(kSystemPointerSize));
+  __ bind(&loop_check);
+  __ inc(scratch1);
+  __ cmp(scratch1, eax);
+  __ j(less_equal, &loop_header, Label::kNear);
+
+#else
   __ mov(Operand(esp, num_args, times_system_pointer_size,
                  (num_slots_to_move + 1) * kSystemPointerSize),
          Immediate(0));
@@ -1345,6 +1436,7 @@ void Generate_InterpreterPushZeroAndArgsAndReturnAddress(
   __ bind(&loop_check);
   __ cmp(scratch1, Immediate(0));
   __ j(greater, &loop_header, Label::kNear);
+#endif
 }
 
 }  // end anonymous namespace
@@ -1362,9 +1454,15 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
   //  -- esp[8]  : the new target
   //  -- esp[12] : the constructor
   // -----------------------------------
-
   Label stack_overflow;
 
+#ifdef V8_REVERSE_JSARGS
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+    // The spread argument should not be pushed.
+    __ dec(eax);
+  }
+#endif
+
   // Push arguments and move return address and stack spill slots to the top of
   // stack. The eax register is readonly. The ecx register will be modified. edx
   // and edi are used as scratch registers.
@@ -1399,11 +1497,17 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
     __ Drop(1);  // The allocation site is unused.
     __ Pop(kJavaScriptCallNewTargetRegister);
     __ Pop(kJavaScriptCallTargetRegister);
+#ifdef V8_REVERSE_JSARGS
+    // Pass the spread in the register ecx, overwriting ecx.
+    __ mov(ecx, Operand(ecx, 0));
+    __ PushReturnAddressFrom(eax);
+    __ movd(eax, xmm0);  // Reload number of arguments.
+#else
     __ Pop(ecx);  // Pop the spread (i.e. the first argument), overwriting ecx.
     __ PushReturnAddressFrom(eax);
     __ movd(eax, xmm0);         // Reload number of arguments.
     __ sub(eax, Immediate(1));  // The actual argc thus decrements by one.
-
+#endif
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
             RelocInfo::CODE_TARGET);
   } else {
@@ -1705,9 +1809,35 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
   //  ...
   // esp[8 * n]       : Argument 1
   // esp[8 * (n + 1)] : Receiver (callable to call)
-  //
+  // NOTE: The order of args are reversed if V8_REVERSE_JSARGS
   // eax contains the number of arguments, n, not counting the receiver.
-  //
+
+#ifdef V8_REVERSE_JSARGS
+  // 1. Get the callable to call (passed as receiver) from the stack.
+  {
+    StackArgumentsAccessor args(eax);
+    __ mov(edi, args.GetReceiverOperand());
+  }
+
+  // 2. Save the return address and drop the callable.
+  __ PopReturnAddressTo(edx);
+  __ Pop(ecx);
+
+  // 3. Make sure we have at least one argument.
+  {
+    Label done;
+    __ test(eax, eax);
+    __ j(not_zero, &done, Label::kNear);
+    __ PushRoot(RootIndex::kUndefinedValue);
+    __ inc(eax);
+    __ bind(&done);
+  }
+
+  // 4. Push back the return address one slot down on the stack (overwriting the
+  // original callable), making the original first argument the new receiver.
+  __ PushReturnAddressFrom(edx);
+  __ dec(eax);  // One fewer argument (first argument is new receiver).
+#else
   // 1. Make sure we have at least one argument.
   {
     Label done;
@@ -1741,6 +1871,7 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
     __ pop(edx);            // Discard copy of return address.
     __ dec(eax);  // One fewer argument (first argument is new receiver).
   }
+#endif
 
   // 4. Call the callable.
   __ Jump(masm->isolate()->builtins()->Call(), RelocInfo::CODE_TARGET);
@@ -1956,6 +2087,56 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
   Label stack_overflow;
   Generate_StackOverflowCheck(masm, kArgumentsLength, edx, &stack_overflow);
 
+#ifdef V8_REVERSE_JSARGS
+  __ movd(xmm4, kArgumentsList);  // Spill the arguments list.
+
+  // Move the arguments already in the stack,
+  // including the receiver and the return address.
+  {
+    Label copy, check;
+    Register src = edx, current = edi, tmp = esi;
+    // Update stack pointer.
+    __ mov(src, esp);
+    __ lea(tmp, Operand(kArgumentsLength, times_system_pointer_size, 0));
+    __ AllocateStackSpace(tmp);
+    // Include return address and receiver.
+    __ add(eax, Immediate(2));
+    __ mov(current, Immediate(0));
+    __ jmp(&check);
+    // Loop.
+    __ bind(&copy);
+    __ mov(tmp, Operand(src, current, times_system_pointer_size, 0));
+    __ mov(Operand(esp, current, times_system_pointer_size, 0), tmp);
+    __ inc(current);
+    __ bind(&check);
+    __ cmp(current, eax);
+    __ j(less, &copy);
+    __ lea(edx, Operand(esp, eax, times_system_pointer_size, 0));
+  }
+
+  __ movd(kArgumentsList, xmm4);  // Recover arguments list.
+
+  // Push additional arguments onto the stack.
+  {
+    __ Move(eax, Immediate(0));
+    Label done, push, loop;
+    __ bind(&loop);
+    __ cmp(eax, kArgumentsLength);
+    __ j(equal, &done, Label::kNear);
+    // Turn the hole into undefined as we go.
+    __ mov(edi, FieldOperand(kArgumentsList, eax, times_tagged_size,
+                             FixedArray::kHeaderSize));
+    __ CompareRoot(edi, RootIndex::kTheHoleValue);
+    __ j(not_equal, &push, Label::kNear);
+    __ LoadRoot(edi, RootIndex::kUndefinedValue);
+    __ bind(&push);
+    __ mov(Operand(edx, 0), edi);
+    __ add(edx, Immediate(kSystemPointerSize));
+    __ inc(eax);
+    __ jmp(&loop);
+    __ bind(&done);
+  }
+#else   // !V8_REVERSE_JSARGS
   // Push additional arguments onto the stack.
   {
     __ PopReturnAddressTo(edx);
@@ -1965,7 +2146,7 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
     __ cmp(eax, kArgumentsLength);
     __ j(equal, &done, Label::kNear);
     // Turn the hole into undefined as we go.
-    __ mov(edi, FieldOperand(kArgumentsList, eax, times_system_pointer_size,
+    __ mov(edi, FieldOperand(kArgumentsList, eax, times_tagged_size,
                              FixedArray::kHeaderSize));
     __ CompareRoot(edi, RootIndex::kTheHoleValue);
     __ j(not_equal, &push, Label::kNear);
@@ -1977,6 +2158,7 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
     __ bind(&done);
     __ PushReturnAddressFrom(edx);
   }
+#endif  // !V8_REVERSE_JSARGS
 
   // Restore eax, edi and edx.
   __ movd(esi, xmm3);  // Restore the context.
@@ -2203,7 +2385,6 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
   //  -- edx : new.target (only in case of [[Construct]])
   //  -- edi : target (checked to be a JSBoundFunction)
   // -----------------------------------
-
   __ movd(xmm0, edx);  // Spill edx.
 
   // Load [[BoundArguments]] into ecx and length of that into edx.
@@ -2213,6 +2394,67 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
   __ SmiUntag(edx);
   __ test(edx, edx);
   __ j(zero, &no_bound_arguments);
+#ifdef V8_REVERSE_JSARGS
+  {
+    // ----------- S t a t e -------------
+    //  -- eax  : the number of arguments (not including the receiver)
+    //  -- xmm0 : new.target (only in case of [[Construct]])
+    //  -- edi  : target (checked to be a JSBoundFunction)
+    //  -- ecx  : the [[BoundArguments]] (implemented as FixedArray)
+    //  -- edx  : the number of [[BoundArguments]]
+    // -----------------------------------
+
+    // Check the stack for overflow.
+    {
+      Label done, stack_overflow;
+      Generate_StackOverflowCheck(masm, edx, ecx, &stack_overflow);
+      __ jmp(&done);
+      __ bind(&stack_overflow);
+      {
+        FrameScope frame(masm, StackFrame::MANUAL);
+        __ CallRuntime(Runtime::kThrowStackOverflow);
+        __ int3();
+      }
+      __ bind(&done);
+    }
+
+    // Spill context.
+    __ movd(xmm3, esi);
+
+    // Save Return Adress and Receiver into registers.
+    __ pop(esi);
+    __ movd(xmm1, esi);
+    __ pop(esi);
+    __ movd(xmm2, esi);
+
+    // Push [[BoundArguments]] to the stack.
+    {
+      Label loop;
+      __ mov(ecx, FieldOperand(edi, JSBoundFunction::kBoundArgumentsOffset));
+      __ mov(edx, FieldOperand(ecx, FixedArray::kLengthOffset));
+      __ SmiUntag(edx);
+      // Adjust effective number of arguments (eax contains the number of
+      // arguments from the call not including receiver plus the number of
+      // [[BoundArguments]]).
+      __ add(eax, edx);
+      __ bind(&loop);
+      __ dec(edx);
+      __ mov(esi, FieldOperand(ecx, edx, times_tagged_size,
+                               FixedArray::kHeaderSize));
+      __ push(esi);
+      __ j(greater, &loop);
+    }
+
+    // Restore Receiver and Return Address.
+    __ movd(esi, xmm2);
+    __ push(esi);
+    __ movd(esi, xmm1);
+    __ push(esi);
+
+    // Restore context.
+    __ movd(esi, xmm3);
+  }
+#else  // !V8_REVERSE_JSARGS
   {
     // ----------- S t a t e -------------
     //  -- eax  : the number of arguments (not including the receiver)
@@ -2241,7 +2483,6 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
       }
       __ bind(&done);
     }
-
 #if V8_OS_WIN
     // Correctly allocate the stack space that was checked above.
     {
@@ -2291,6 +2532,7 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
     // [[BoundArguments]]), so we need to subtract one for the return address.
     __ dec(eax);
   }
+#endif  // !V8_REVERSE_JSARGS
 
   __ bind(&no_bound_arguments);
   __ movd(edx, xmm0);  // Reload edx.
@@ -2518,7 +2760,11 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
 
     // Copy receiver and all expected arguments.
     const int offset = StandardFrameConstants::kCallerSPOffset;
+#ifdef V8_REVERSE_JSARGS
+    __ lea(edi, Operand(ebp, ecx, times_system_pointer_size, offset));
+#else
     __ lea(edi, Operand(ebp, eax, times_system_pointer_size, offset));
+#endif
     __ mov(eax, -1);  // account for receiver
 
     Label copy;
@@ -2543,6 +2789,35 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     // Remember expected arguments in xmm0.
     __ movd(xmm0, kExpectedNumberOfArgumentsRegister);
 
+#ifdef V8_REVERSE_JSARGS
+    // Remember new target.
+    __ movd(xmm1, edx);
+
+    // Fill remaining expected arguments with undefined values.
+    Label fill;
+    __ mov(edx, ecx);
+    __ sub(edx, eax);
+    __ bind(&fill);
+    __ Push(Immediate(masm->isolate()->factory()->undefined_value()));
+    __ dec(edx);
+    __ j(greater, &fill);
+
+    // Copy receiver and all actual arguments.
+    const int offset = StandardFrameConstants::kCallerSPOffset;
+    __ lea(edi, Operand(ebp, eax, times_system_pointer_size, offset));
+    __ mov(edx, Immediate(-1));
+
+    Label copy;
+    __ bind(&copy);
+    __ inc(edx);
+    __ push(Operand(edi, 0));
+    __ sub(edi, Immediate(kSystemPointerSize));
+    __ cmp(edx, eax);
+    __ j(less, &copy);
+
+    // Restore new.target
+    __ movd(edx, xmm1);
+#else   // !V8_REVERSE_JSARGS
     // Copy receiver and all actual arguments.
     const int offset = StandardFrameConstants::kCallerSPOffset;
     __ lea(edi, Operand(ebp, eax, times_system_pointer_size, offset));
@@ -2567,6 +2842,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     __ Push(Immediate(masm->isolate()->factory()->undefined_value()));
     __ cmp(eax, kExpectedNumberOfArgumentsRegister);
     __ j(less, &fill);
+#endif  // !V8_REVERSE_JSARGS
 
     // Restore expected arguments.
     __ movd(eax, xmm0);
@@ -3153,6 +3429,7 @@ void Builtins::Generate_CallApiCallback(MacroAssembler* masm) {
   //  -- esp[argc * 4]       : first argument
   //  -- esp[(argc + 1) * 4] : receiver
   // -----------------------------------
+  // NOTE: The order of args are reversed if V8_REVERSE_JSARGS
 
   Register api_function_address = edx;
   Register argc = ecx;
@@ -3222,8 +3499,13 @@ void Builtins::Generate_CallApiCallback(MacroAssembler* masm) {
 
   // FunctionCallbackInfo::values_ (points at the first varargs argument passed
   // on the stack).
+#ifdef V8_REVERSE_JSARGS
+  __ lea(scratch,
+         Operand(scratch, (FCA::kArgsLength + 1) * kSystemPointerSize));
+#else
   __ lea(scratch, Operand(scratch, argc, times_system_pointer_size,
                           (FCA::kArgsLength - 1) * kSystemPointerSize));
+#endif
   __ mov(ApiParameterOperand(kApiArgc + 1), scratch);
 
   // FunctionCallbackInfo::length_.
diff --git a/deps/v8/src/builtins/ic-callable.tq b/deps/v8/src/builtins/ic-callable.tq
new file mode 100644
index 00000000000..95e107a9a69
--- /dev/null
+++ b/deps/v8/src/builtins/ic-callable.tq
@@ -0,0 +1,183 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+namespace ic {
+namespace callable {
+
+extern macro IncrementCallCount(FeedbackVector, uintptr): void;
+
+macro IsMonomorphic(feedback: MaybeObject, target: JSAny): bool {
+  return IsWeakReferenceToObject(feedback, target);
+}
+
+macro InSameNativeContext(lhs: Context, rhs: Context): bool {
+  return LoadNativeContext(lhs) == LoadNativeContext(rhs);
+}
+
+macro MaybeObjectToStrong(maybeObject: MaybeObject):
+    HeapObject labels IfCleared {
+  assert(IsWeakOrCleared(maybeObject));
+  const weakObject = %RawDownCast<Weak<HeapObject>>(maybeObject);
+  return WeakToStrong(weakObject) otherwise IfCleared;
+}
+
+macro TryInitializeAsMonomorphic(implicit context: Context)(
+    maybeTarget: JSAny, feedbackVector: FeedbackVector,
+    slotId: uintptr): void labels TransitionToMegamorphic {
+  const targetHeapObject =
+      Cast<HeapObject>(maybeTarget) otherwise TransitionToMegamorphic;
+
+  let unwrappedTarget = targetHeapObject;
+  while (Is<JSBoundFunction>(unwrappedTarget)) {
+    unwrappedTarget =
+        UnsafeCast<JSBoundFunction>(unwrappedTarget).bound_target_function;
+  }
+
+  const unwrappedTargetJSFunction =
+      Cast<JSFunction>(unwrappedTarget) otherwise TransitionToMegamorphic;
+  if (!InSameNativeContext(unwrappedTargetJSFunction.context, context)) {
+    goto TransitionToMegamorphic;
+  }
+
+  StoreWeakReferenceInFeedbackVector(feedbackVector, slotId, targetHeapObject);
+  ReportFeedbackUpdate(feedbackVector, slotId, 'Call:Initialize');
+}
+
+macro TransitionToMegamorphic(implicit context: Context)(
+    feedbackVector: FeedbackVector, slotId: uintptr): void {
+  StoreFeedbackVectorSlot(feedbackVector, slotId, kMegamorphicSymbol);
+  ReportFeedbackUpdate(feedbackVector, slotId, 'Call:TransitionMegamorphic');
+}
+
+macro CollectCallFeedback(
+    maybeTarget: JSAny, context: Context,
+    maybeFeedbackVector: Undefined|FeedbackVector, slotId: uintptr): void {
+  const feedbackVector =
+      Cast<FeedbackVector>(maybeFeedbackVector) otherwise return;
+  IncrementCallCount(feedbackVector, slotId);
+
+  try {
+    const feedback: MaybeObject =
+        LoadFeedbackVectorSlot(feedbackVector, slotId);
+    if (IsMonomorphic(feedback, maybeTarget)) return;
+    if (IsMegamorphic(feedback)) return;
+    if (IsUninitialized(feedback)) goto TryInitializeAsMonomorphic;
+
+    // If cleared, we have a new chance to become monomorphic.
+    const feedbackValue: HeapObject =
+        MaybeObjectToStrong(feedback) otherwise TryInitializeAsMonomorphic;
+
+    // Try transitioning to a feedback cell.
+    // Check if {target}s feedback cell matches the {feedbackValue}.
+    const target =
+        Cast<JSFunction>(maybeTarget) otherwise TransitionToMegamorphic;
+    const targetFeedbackCell: FeedbackCell = target.feedback_cell;
+    if (TaggedEqual(feedbackValue, targetFeedbackCell)) return;
+
+    // Check if {target} and {feedbackValue} are both JSFunctions with
+    // the same feedback vector cell, and that those functions were
+    // actually compiled already.
+    const feedbackValueJSFunction =
+        Cast<JSFunction>(feedbackValue) otherwise TransitionToMegamorphic;
+    const feedbackCell: FeedbackCell = feedbackValueJSFunction.feedback_cell;
+    if (!TaggedEqual(feedbackCell, targetFeedbackCell))
+      goto TransitionToMegamorphic;
+
+    StoreWeakReferenceInFeedbackVector(feedbackVector, slotId, feedbackCell);
+    ReportFeedbackUpdate(feedbackVector, slotId, 'Call:FeedbackVectorCell');
+  } label TryInitializeAsMonomorphic {
+    TryInitializeAsMonomorphic(maybeTarget, feedbackVector, slotId)
+        otherwise TransitionToMegamorphic;
+  } label TransitionToMegamorphic {
+    TransitionToMegamorphic(feedbackVector, slotId);
+  }
+}
+
+macro CollectInstanceOfFeedback(
+    maybeTarget: JSAny, context: Context,
+    maybeFeedbackVector: Undefined|FeedbackVector, slotId: uintptr): void {
+  const feedbackVector =
+      Cast<FeedbackVector>(maybeFeedbackVector) otherwise return;
+  // Note: The call count is not incremented.
+
+  try {
+    const feedback: MaybeObject =
+        LoadFeedbackVectorSlot(feedbackVector, slotId);
+    if (IsMonomorphic(feedback, maybeTarget)) return;
+    if (IsMegamorphic(feedback)) return;
+    if (IsUninitialized(feedback)) goto TryInitializeAsMonomorphic;
+
+    // If cleared, we have a new chance to become monomorphic.
+    const _feedbackValue: HeapObject =
+        MaybeObjectToStrong(feedback) otherwise TryInitializeAsMonomorphic;
+
+    goto TransitionToMegamorphic;
+  } label TryInitializeAsMonomorphic {
+    TryInitializeAsMonomorphic(maybeTarget, feedbackVector, slotId)
+        otherwise TransitionToMegamorphic;
+  } label TransitionToMegamorphic {
+    TransitionToMegamorphic(feedbackVector, slotId);
+  }
+}
+
+macro BothTaggedEqualArrayFunction(implicit context: Context)(
+    first: JSAny, second: JSAny): bool {
+  return TaggedEqual(first, second) && TaggedEqual(second, GetArrayFunction());
+}
+
+extern macro CreateAllocationSiteInFeedbackVector(
+    FeedbackVector, uintptr): AllocationSite;
+
+macro CollectConstructFeedback(implicit context: Context)(
+    target: JSAny, newTarget: JSAny,
+    maybeFeedbackVector: Undefined|FeedbackVector,
+    slotId: uintptr): never labels ConstructGeneric,
+    ConstructArray(AllocationSite) {
+  const feedbackVector = Cast<FeedbackVector>(maybeFeedbackVector)
+      otherwise goto ConstructGeneric;
+  IncrementCallCount(feedbackVector, slotId);
+
+  try {
+    const feedback: MaybeObject =
+        LoadFeedbackVectorSlot(feedbackVector, slotId);
+    if (IsMonomorphic(feedback, newTarget)) goto ConstructGeneric;
+    if (IsMegamorphic(feedback)) goto ConstructGeneric;
+    if (IsUninitialized(feedback)) goto TryInitializeAsMonomorphic;
+
+    if (!IsWeakOrCleared(feedback)) {
+      const feedbackAsStrong = %RawDownCast<Object>(feedback);
+      if (Is<AllocationSite>(feedbackAsStrong)) {
+        if (BothTaggedEqualArrayFunction(target, newTarget)) {
+          goto ConstructArray(UnsafeCast<AllocationSite>(feedbackAsStrong));
+        }
+        goto TransitionToMegamorphic;
+      }
+    }
+
+    // If cleared, we have a new chance to become monomorphic.
+    const _feedbackValue: HeapObject =
+        MaybeObjectToStrong(feedback) otherwise TryInitializeAsMonomorphic;
+
+    goto TransitionToMegamorphic;
+  } label TryInitializeAsMonomorphic {
+    if (BothTaggedEqualArrayFunction(target, newTarget)) {
+      // In this case we can skip unwrapping and context validation since we
+      // know the target is the current context's array function.
+      const allocationSite =
+          CreateAllocationSiteInFeedbackVector(feedbackVector, slotId);
+      ReportFeedbackUpdate(
+          feedbackVector, slotId, 'Construct:CreateAllocationSite');
+      goto ConstructArray(allocationSite);
+    }
+
+    TryInitializeAsMonomorphic(newTarget, feedbackVector, slotId)
+        otherwise TransitionToMegamorphic;
+  } label TransitionToMegamorphic {
+    TransitionToMegamorphic(feedbackVector, slotId);
+  }
+  goto ConstructGeneric;
+}
+
+}  // namespace callable
+}  // namespace ic
diff --git a/deps/v8/src/builtins/ic.tq b/deps/v8/src/builtins/ic.tq
new file mode 100644
index 00000000000..f6fecc557f4
--- /dev/null
+++ b/deps/v8/src/builtins/ic.tq
@@ -0,0 +1,59 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+namespace ic {
+
+// --- The public interface (forwards to the actual implementation).
+
+@export
+macro CollectCallFeedback(
+    maybeTarget: JSAny, context: Context,
+    maybeFeedbackVector: Undefined|FeedbackVector, slotId: uintptr): void {
+  callable::CollectCallFeedback(
+      maybeTarget, context, maybeFeedbackVector, slotId);
+}
+
+@export
+macro CollectInstanceOfFeedback(
+    maybeTarget: JSAny, context: Context,
+    maybeFeedbackVector: Undefined|FeedbackVector, slotId: uintptr): void {
+  callable::CollectInstanceOfFeedback(
+      maybeTarget, context, maybeFeedbackVector, slotId);
+}
+
+@export
+macro CollectConstructFeedback(implicit context: Context)(
+    target: JSAny, newTarget: JSAny,
+    maybeFeedbackVector: Undefined|FeedbackVector,
+    slotId: uintptr): never labels ConstructGeneric,
+    ConstructArray(AllocationSite) {
+  callable::CollectConstructFeedback(
+      target, newTarget, maybeFeedbackVector, slotId)
+      otherwise ConstructGeneric, ConstructArray;
+}
+
+// --- Common functionality.
+
+extern macro MegamorphicSymbolConstant(): Symbol;
+extern macro UninitializedSymbolConstant(): Symbol;
+
+const kMegamorphicSymbol: Symbol = MegamorphicSymbolConstant();
+const kUninitializedSymbol: Symbol = UninitializedSymbolConstant();
+
+macro IsMegamorphic(feedback: MaybeObject): bool {
+  return TaggedEqual(feedback, kMegamorphicSymbol);
+}
+
+macro IsUninitialized(feedback: MaybeObject): bool {
+  return TaggedEqual(feedback, kUninitializedSymbol);
+}
+
+extern macro LoadFeedbackVectorSlot(FeedbackVector, uintptr): MaybeObject;
+extern macro StoreFeedbackVectorSlot(
+    FeedbackVector, uintptr, MaybeObject): void;
+extern macro StoreWeakReferenceInFeedbackVector(
+    FeedbackVector, uintptr, HeapObject): MaybeObject;
+extern macro ReportFeedbackUpdate(FeedbackVector, uintptr, constexpr string);
+
+}  // namespace ic
diff --git a/deps/v8/src/builtins/internal-coverage.tq b/deps/v8/src/builtins/internal-coverage.tq
index 65cb207eaae..07bfc40d8f2 100644
--- a/deps/v8/src/builtins/internal-coverage.tq
+++ b/deps/v8/src/builtins/internal-coverage.tq
@@ -6,33 +6,34 @@
 
 namespace internal_coverage {
 
-  macro GetCoverageInfo(implicit context: Context)(function: JSFunction):
-      CoverageInfo labels IfNoCoverageInfo {
-    const shared: SharedFunctionInfo = function.shared_function_info;
-    const debugInfo = Cast<DebugInfo>(shared.script_or_debug_info)
-        otherwise goto IfNoCoverageInfo;
-
-    if (!SmiUntag(debugInfo.flags).has_coverage_info) goto IfNoCoverageInfo;
-    return UnsafeCast<CoverageInfo>(debugInfo.coverage_info);
-  }
-
-  macro IncrementBlockCount(implicit context: Context)(
-      coverageInfo: CoverageInfo, slot: Smi) {
-    assert(Convert<int32>(slot) < coverageInfo.slot_count);
-    ++coverageInfo.slots[slot].block_count;
-  }
-
-  builtin IncBlockCounter(implicit context: Context)(
-      function: JSFunction, coverageArraySlotIndex: Smi): Undefined {
-    // It's quite possible that a function contains IncBlockCounter bytecodes,
-    // but no coverage info exists. This happens e.g. by selecting the
-    // best-effort coverage collection mode, which triggers deletion of all
-    // coverage infos in order to avoid memory leaks.
-
-    const coverageInfo: CoverageInfo =
-        GetCoverageInfo(function) otherwise return Undefined;
-    IncrementBlockCount(coverageInfo, coverageArraySlotIndex);
-    return Undefined;
-  }
+macro GetCoverageInfo(implicit context: Context)(function: JSFunction):
+    CoverageInfo labels IfNoCoverageInfo {
+  const shared: SharedFunctionInfo = function.shared_function_info;
+  const debugInfo = Cast<DebugInfo>(shared.script_or_debug_info)
+      otherwise goto IfNoCoverageInfo;
+
+  if (!debugInfo.flags.has_coverage_info) goto IfNoCoverageInfo;
+  return UnsafeCast<CoverageInfo>(debugInfo.coverage_info);
+}
+
+macro IncrementBlockCount(implicit context: Context)(
+    coverageInfo: CoverageInfo, slot: Smi) {
+  assert(Convert<int32>(slot) < coverageInfo.slot_count);
+  ++coverageInfo.slots[slot].block_count;
+}
+
+builtin IncBlockCounter(
+    implicit context:
+        Context)(function: JSFunction, coverageArraySlotIndex: Smi): Undefined {
+  // It's quite possible that a function contains IncBlockCounter bytecodes,
+  // but no coverage info exists. This happens e.g. by selecting the
+  // best-effort coverage collection mode, which triggers deletion of all
+  // coverage infos in order to avoid memory leaks.
+
+  const coverageInfo: CoverageInfo =
+      GetCoverageInfo(function) otherwise return Undefined;
+  IncrementBlockCount(coverageInfo, coverageArraySlotIndex);
+  return Undefined;
+}
 
 }  // namespace internal_coverage
diff --git a/deps/v8/src/builtins/iterator.tq b/deps/v8/src/builtins/iterator.tq
index 272a2a7db83..1354c434e7f 100644
--- a/deps/v8/src/builtins/iterator.tq
+++ b/deps/v8/src/builtins/iterator.tq
@@ -5,105 +5,98 @@
 #include 'src/builtins/builtins-iterator-gen.h'
 
 namespace iterator {
-  // Returned from IteratorBuiltinsAssembler::GetIterator().
-  @export
-  struct IteratorRecord {
-    // iteratorRecord.[[Iterator]]
-    object: JSReceiver;
-
-    // iteratorRecord.[[NextMethod]]
-    next: JSAny;
-  }
+// Returned from IteratorBuiltinsAssembler::GetIterator().
+@export
+struct IteratorRecord {
+  // iteratorRecord.[[Iterator]]
+  object: JSReceiver;
+
+  // iteratorRecord.[[NextMethod]]
+  next: JSAny;
+}
 
-  extern macro IteratorBuiltinsAssembler::FastIterableToList(
-      implicit context: Context)(JSAny): JSArray labels Slow;
-
-  extern macro IteratorBuiltinsAssembler::GetIteratorMethod(
-      implicit context: Context)(JSAny): JSAny;
-  extern macro IteratorBuiltinsAssembler::GetIterator(
-      implicit context: Context)(JSAny): IteratorRecord;
-  extern macro IteratorBuiltinsAssembler::GetIterator(
-      implicit context: Context)(JSAny, JSAny): IteratorRecord;
-
-  extern macro IteratorBuiltinsAssembler::IteratorStep(
-      implicit context: Context)(IteratorRecord): JSReceiver
-      labels Done;
-  extern macro IteratorBuiltinsAssembler::IteratorStep(
-      implicit context: Context)(IteratorRecord, Map): JSReceiver
-      labels Done;
-
-  extern macro IteratorBuiltinsAssembler::IteratorValue(
-      implicit context: Context)(JSReceiver): JSAny;
-  extern macro IteratorBuiltinsAssembler::IteratorValue(
-      implicit context: Context)(JSReceiver, Map): JSAny;
-
-  extern macro IteratorBuiltinsAssembler::IteratorCloseOnException(
-      implicit context: Context)(IteratorRecord, JSAny): never;
-
-  extern macro IteratorBuiltinsAssembler::IterableToList(
-      implicit context: Context)(JSAny, JSAny): JSArray;
-
-  extern macro IteratorBuiltinsAssembler::StringListFromIterable(
-      implicit context: Context)(JSAny): JSArray;
-
-  extern builtin IterableToListMayPreserveHoles(implicit context:
-                                                    Context)(JSAny, JSAny);
-  extern builtin IterableToListWithSymbolLookup(implicit context:
-                                                    Context)(JSAny);
-
-  transitioning builtin GetIteratorWithFeedback(
-      context: Context, receiver: JSAny, loadSlot: TaggedIndex,
-      callSlot: TaggedIndex, feedback: Undefined|FeedbackVector): JSAny {
-    let iteratorMethod: JSAny;
-    typeswitch (feedback) {
-      case (Undefined): {
-        iteratorMethod = GetProperty(receiver, IteratorSymbolConstant());
-      }
-      case (feedback: FeedbackVector): {
-        iteratorMethod = LoadIC(
-            context, receiver, IteratorSymbolConstant(), loadSlot, feedback);
-      }
+extern macro IteratorBuiltinsAssembler::FastIterableToList(
+    implicit context: Context)(JSAny): JSArray labels Slow;
+
+extern macro IteratorBuiltinsAssembler::GetIteratorMethod(
+    implicit context: Context)(JSAny): JSAny;
+extern macro IteratorBuiltinsAssembler::GetIterator(implicit context: Context)(
+    JSAny): IteratorRecord;
+extern macro IteratorBuiltinsAssembler::GetIterator(implicit context: Context)(
+    JSAny, JSAny): IteratorRecord;
+
+extern macro IteratorBuiltinsAssembler::IteratorStep(implicit context: Context)(
+    IteratorRecord): JSReceiver
+    labels Done;
+extern macro IteratorBuiltinsAssembler::IteratorStep(implicit context: Context)(
+    IteratorRecord, Map): JSReceiver
+    labels Done;
+
+extern macro IteratorBuiltinsAssembler::IteratorValue(
+    implicit context: Context)(JSReceiver): JSAny;
+extern macro IteratorBuiltinsAssembler::IteratorValue(
+    implicit context: Context)(JSReceiver, Map): JSAny;
+
+extern macro IteratorBuiltinsAssembler::IterableToList(
+    implicit context: Context)(JSAny, JSAny): JSArray;
+
+extern macro IteratorBuiltinsAssembler::StringListFromIterable(
+    implicit context: Context)(JSAny): JSArray;
+
+extern builtin IterableToListWithSymbolLookup(implicit context: Context)(JSAny):
+    JSArray;
+extern builtin IterableToFixedArrayWithSymbolLookupSlow(
+    implicit context: Context)(JSAny): FixedArray;
+
+transitioning builtin GetIteratorWithFeedback(
+    context: Context, receiver: JSAny, loadSlot: TaggedIndex,
+    callSlot: TaggedIndex, feedback: Undefined|FeedbackVector): JSAny {
+  let iteratorMethod: JSAny;
+  typeswitch (feedback) {
+    case (Undefined): {
+      iteratorMethod = GetProperty(receiver, IteratorSymbolConstant());
+    }
+    case (feedback: FeedbackVector): {
+      iteratorMethod = LoadIC(
+          context, receiver, IteratorSymbolConstant(), loadSlot, feedback);
     }
-    // TODO(v8:10047): Use TaggedIndex here once TurboFan supports it.
-    const callSlotSmi: Smi = TaggedIndexToSmi(callSlot);
-    return CallIteratorWithFeedback(
-        context, receiver, iteratorMethod, callSlotSmi, feedback);
   }
+  // TODO(v8:10047): Use TaggedIndex here once TurboFan supports it.
+  const callSlotSmi: Smi = TaggedIndexToSmi(callSlot);
+  return CallIteratorWithFeedback(
+      context, receiver, iteratorMethod, callSlotSmi, feedback);
+}
 
-  transitioning builtin CallIteratorWithFeedback(
-      context: Context, receiver: JSAny, iteratorMethod: JSAny, callSlot: Smi,
-      feedback: Undefined|FeedbackVector): JSAny {
-    const callSlotUnTagged: uintptr = Unsigned(SmiUntag(callSlot));
-    CollectCallFeedback(iteratorMethod, context, feedback, callSlotUnTagged);
-    const iteratorCallable: Callable = Cast<Callable>(iteratorMethod)
-        otherwise ThrowCalledNonCallable(iteratorMethod);
-    return Call(context, iteratorCallable, receiver);
-  }
+transitioning builtin CallIteratorWithFeedback(
+    context: Context, receiver: JSAny, iteratorMethod: JSAny, callSlot: Smi,
+    feedback: Undefined|FeedbackVector): JSAny {
+  const callSlotUnTagged: uintptr = Unsigned(SmiUntag(callSlot));
+  ic::CollectCallFeedback(iteratorMethod, context, feedback, callSlotUnTagged);
+  const iteratorCallable: Callable = Cast<Callable>(iteratorMethod)
+      otherwise ThrowCalledNonCallable(iteratorMethod);
+  return Call(context, iteratorCallable, receiver);
+}
 
-  transitioning
-  macro IteratorCloseOnException(implicit context: Context)(
-      iterator: IteratorRecord, exception: Object): never labels
-  IfException(Object) {
-    // Let return be ? GetMethod(iterator, "return").
-    let method: JSAny;
-    try {
-      method = GetProperty(iterator.object, kReturnString);
-    } catch (e) {
-      goto IfException(e);
-    }
+// https://tc39.es/ecma262/#sec-iteratorclose
+@export
+transitioning macro IteratorCloseOnException(implicit context: Context)(
+    iterator: IteratorRecord) {
+  try {
+    // 4. Let innerResult be GetMethod(iterator, "return").
+    const method = GetProperty(iterator.object, kReturnString);
 
-    // If return is undefined, return Completion(completion).
-    if (method == Undefined || method == Null) goto IfException(exception);
+    // 5. If innerResult.[[Type]] is normal, then
+    //   a. Let return be innerResult.[[Value]].
+    //   b. If return is undefined, return Completion(completion).
+    if (method == Undefined || method == Null) return;
 
-    // Let innerResult be Call(return, iterator, « »).
+    //   c. Set innerResult to Call(return, iterator).
     // If an exception occurs, the original exception remains bound
-    try {
-      Call(context, method, iterator.object);
-    } catch (_e) {
-      goto IfException(exception);
-    }
-
-    // (If completion.[[Type]] is throw) return Completion(completion).
-    goto IfException(exception);
+    Call(context, method, iterator.object);
+  } catch (_e) {
+    // Swallow the exception.
   }
+
+  // (If completion.[[Type]] is throw) return Completion(completion).
+}
 }
diff --git a/deps/v8/src/builtins/math.tq b/deps/v8/src/builtins/math.tq
index 8c9998906a5..d1b8307d1c5 100644
--- a/deps/v8/src/builtins/math.tq
+++ b/deps/v8/src/builtins/math.tq
@@ -4,468 +4,457 @@
 
 namespace math {
 
-  extern transitioning builtin
-  NonNumberToNumber(implicit context: Context)(HeapObject): Number;
-
-  transitioning macro ReduceToSmiOrFloat64(implicit context: Context)(x: JSAny):
-      never
-      labels SmiResult(Smi), Float64Result(float64) {
-    let x1: JSAny = x;
-    while (true) {
-      typeswitch (x1) {
-        case (s: Smi): {
-          goto SmiResult(s);
-        }
-        case (h: HeapNumber): {
-          goto Float64Result(Convert<float64>(h));
-        }
-        case (a: JSAnyNotNumber): {
-          x1 = NonNumberToNumber(a);
-        }
+extern transitioning builtin
+NonNumberToNumber(implicit context: Context)(HeapObject): Number;
+
+transitioning macro ReduceToSmiOrFloat64(implicit context: Context)(x: JSAny):
+    never
+    labels SmiResult(Smi), Float64Result(float64) {
+  let x1: JSAny = x;
+  while (true) {
+    typeswitch (x1) {
+      case (s: Smi): {
+        goto SmiResult(s);
+      }
+      case (h: HeapNumber): {
+        goto Float64Result(Convert<float64>(h));
+      }
+      case (a: JSAnyNotNumber): {
+        x1 = NonNumberToNumber(a);
       }
     }
-    VerifiedUnreachable();
   }
+  VerifiedUnreachable();
+}
 
-  // ES6 #sec-math.abs
-  extern macro IsIntPtrAbsWithOverflowSupported(): constexpr bool;
-  extern macro TrySmiSub(Smi, Smi): Smi labels Overflow;
-  extern macro TrySmiAbs(Smi): Smi labels Overflow;
-  extern macro Float64Abs(float64): float64;
-  const kSmiMaxValuePlusOne:
-      constexpr float64 generates '0.0 - kSmiMinValue';
-
-  transitioning javascript builtin
-  MathAbs(js-implicit context: NativeContext)(x: JSAny): Number {
+// ES6 #sec-math.abs
+extern macro IsIntPtrAbsWithOverflowSupported(): constexpr bool;
+extern macro TrySmiAdd(Smi, Smi): Smi labels Overflow;
+extern macro TrySmiSub(Smi, Smi): Smi labels Overflow;
+extern macro TrySmiAbs(Smi): Smi labels Overflow;
+extern macro Float64Abs(float64): float64;
+const kSmiMaxValuePlusOne:
+    constexpr float64 generates '0.0 - kSmiMinValue';
+
+transitioning javascript builtin
+MathAbs(js-implicit context: NativeContext)(x: JSAny): Number {
+  try {
+    ReduceToSmiOrFloat64(x) otherwise SmiResult, Float64Result;
+  } label SmiResult(s: Smi) {
     try {
-      ReduceToSmiOrFloat64(x) otherwise SmiResult, Float64Result;
-    }
-    label SmiResult(s: Smi) {
-      try {
-        if constexpr (IsIntPtrAbsWithOverflowSupported()) {
-          const result: Smi = TrySmiAbs(s)
-              otherwise SmiOverflow;
-          return result;
+      if constexpr (IsIntPtrAbsWithOverflowSupported()) {
+        const result: Smi = TrySmiAbs(s)
+            otherwise SmiOverflow;
+        return result;
+      } else {
+        if (0 <= s) {
+          return s;
         } else {
-          if (0 <= s) {
-            return s;
-          } else {
-            const result: Smi = TrySmiSub(0, s) otherwise SmiOverflow;
-            return result;
-          }
+          const result: Smi = TrySmiSub(0, s) otherwise SmiOverflow;
+          return result;
         }
       }
-      label SmiOverflow {
-        return NumberConstant(kSmiMaxValuePlusOne);
-      }
-    }
-    label Float64Result(f: float64) {
-      return Convert<Number>(Float64Abs(f));
+    } label SmiOverflow {
+      return NumberConstant(kSmiMaxValuePlusOne);
     }
+  } label Float64Result(f: float64) {
+    return Convert<Number>(Float64Abs(f));
   }
+}
 
-  // ES6 #sec-math.ceil
-  extern macro Float64Ceil(float64): float64;
-  transitioning javascript builtin
-  MathCeil(js-implicit context: NativeContext)(x: JSAny): Number {
-    try {
-      ReduceToSmiOrFloat64(x) otherwise SmiResult, Float64Result;
-    }
-    label SmiResult(s: Smi) {
-      return s;
-    }
-    label Float64Result(f: float64) {
-      return Convert<Number>(Float64Ceil(f));
-    }
+// ES6 #sec-math.ceil
+extern macro Float64Ceil(float64): float64;
+transitioning javascript builtin
+MathCeil(js-implicit context: NativeContext)(x: JSAny): Number {
+  try {
+    ReduceToSmiOrFloat64(x) otherwise SmiResult, Float64Result;
+  } label SmiResult(s: Smi) {
+    return s;
+  } label Float64Result(f: float64) {
+    return Convert<Number>(Float64Ceil(f));
   }
+}
 
-  // ES6 #sec-math.floor
-  extern macro Float64Floor(float64): float64;
-  transitioning javascript builtin
-  MathFloor(js-implicit context: NativeContext)(x: JSAny): Number {
-    try {
-      ReduceToSmiOrFloat64(x) otherwise SmiResult, Float64Result;
-    }
-    label SmiResult(s: Smi) {
-      return s;
-    }
-    label Float64Result(f: float64) {
-      return Convert<Number>(Float64Floor(f));
-    }
+// ES6 #sec-math.floor
+extern macro Float64Floor(float64): float64;
+transitioning javascript builtin
+MathFloor(js-implicit context: NativeContext)(x: JSAny): Number {
+  try {
+    ReduceToSmiOrFloat64(x) otherwise SmiResult, Float64Result;
+  } label SmiResult(s: Smi) {
+    return s;
+  } label Float64Result(f: float64) {
+    return Convert<Number>(Float64Floor(f));
   }
+}
 
-  // ES6 #sec-math.round
-  extern macro Float64Round(float64): float64;
-  transitioning javascript builtin
-  MathRound(js-implicit context: NativeContext)(x: JSAny): Number {
-    try {
-      ReduceToSmiOrFloat64(x) otherwise SmiResult, Float64Result;
-    }
-    label SmiResult(s: Smi) {
-      return s;
-    }
-    label Float64Result(f: float64) {
-      return Convert<Number>(Float64Round(f));
-    }
+// ES6 #sec-math.round
+extern macro Float64Round(float64): float64;
+transitioning javascript builtin
+MathRound(js-implicit context: NativeContext)(x: JSAny): Number {
+  try {
+    ReduceToSmiOrFloat64(x) otherwise SmiResult, Float64Result;
+  } label SmiResult(s: Smi) {
+    return s;
+  } label Float64Result(f: float64) {
+    return Convert<Number>(Float64Round(f));
   }
+}
 
-  // ES6 #sec-math.trunc
-  extern macro Float64Trunc(float64): float64;
-  transitioning javascript builtin
-  MathTrunc(js-implicit context: NativeContext)(x: JSAny): Number {
-    try {
-      ReduceToSmiOrFloat64(x) otherwise SmiResult, Float64Result;
-    }
-    label SmiResult(s: Smi) {
-      return s;
-    }
-    label Float64Result(f: float64) {
-      return Convert<Number>(Float64Trunc(f));
-    }
+// ES6 #sec-math.trunc
+extern macro Float64Trunc(float64): float64;
+transitioning javascript builtin
+MathTrunc(js-implicit context: NativeContext)(x: JSAny): Number {
+  try {
+    ReduceToSmiOrFloat64(x) otherwise SmiResult, Float64Result;
+  } label SmiResult(s: Smi) {
+    return s;
+  } label Float64Result(f: float64) {
+    return Convert<Number>(Float64Trunc(f));
   }
+}
 
-  // ES6 #sec-math.pow
-  extern macro Float64Pow(float64, float64): float64;
-  extern macro TruncateTaggedToFloat64(implicit context: Context)(JSAny):
-      float64;
-
-  @export
-  macro MathPowImpl(implicit context: Context)(base: JSAny, exponent: JSAny):
-      Number {
-    const baseValue: float64 = TruncateTaggedToFloat64(base);
-    const exponentValue: float64 = TruncateTaggedToFloat64(exponent);
-    const result: float64 = Float64Pow(baseValue, exponentValue);
-    return Convert<Number>(result);
-  }
+// ES6 #sec-math.pow
+extern macro Float64Pow(float64, float64): float64;
+extern macro TruncateTaggedToFloat64(implicit context: Context)(JSAny): float64;
+
+@export
+macro MathPowImpl(implicit context: Context)(base: JSAny, exponent: JSAny):
+    Number {
+  const baseValue: float64 = TruncateTaggedToFloat64(base);
+  const exponentValue: float64 = TruncateTaggedToFloat64(exponent);
+  const result: float64 = Float64Pow(baseValue, exponentValue);
+  return Convert<Number>(result);
+}
 
-  transitioning javascript builtin
-  MathPow(js-implicit context: NativeContext)(base: JSAny, exponent: JSAny):
-      Number {
-    return MathPowImpl(base, exponent);
-  }
+transitioning javascript builtin
+MathPow(js-implicit context: NativeContext)(
+    base: JSAny, exponent: JSAny): Number {
+  return MathPowImpl(base, exponent);
+}
 
-  // ES6 #sec-math.max
-  extern macro Float64Max(float64, float64): float64;
-  transitioning javascript builtin
-  MathMax(js-implicit context: NativeContext)(...arguments): Number {
-    let result: float64 = MINUS_V8_INFINITY;
-    const argCount = arguments.length;
-    for (let i: intptr = 0; i < argCount; i++) {
-      const doubleValue = TruncateTaggedToFloat64(arguments[i]);
-      result = Float64Max(result, doubleValue);
-    }
-    return Convert<Number>(result);
-  }
+// ES6 #sec-math.max
+extern macro Float64Max(float64, float64): float64;
+transitioning javascript builtin
+MathMax(js-implicit context: NativeContext)(...arguments): Number {
+  let result: float64 = MINUS_V8_INFINITY;
+  const argCount = arguments.length;
+  for (let i: intptr = 0; i < argCount; i++) {
+    const doubleValue = TruncateTaggedToFloat64(arguments[i]);
+    result = Float64Max(result, doubleValue);
+  }
+  return Convert<Number>(result);
+}
 
-  // ES6 #sec-math.min
-  extern macro Float64Min(float64, float64): float64;
-  transitioning javascript builtin
-  MathMin(js-implicit context: NativeContext)(...arguments): Number {
-    let result: float64 = V8_INFINITY;
-    const argCount = arguments.length;
-    for (let i: intptr = 0; i < argCount; i++) {
-      const doubleValue = TruncateTaggedToFloat64(arguments[i]);
-      result = Float64Min(result, doubleValue);
-    }
-    return Convert<Number>(result);
-  }
+// ES6 #sec-math.min
+extern macro Float64Min(float64, float64): float64;
+transitioning javascript builtin
+MathMin(js-implicit context: NativeContext)(...arguments): Number {
+  let result: float64 = V8_INFINITY;
+  const argCount = arguments.length;
+  for (let i: intptr = 0; i < argCount; i++) {
+    const doubleValue = TruncateTaggedToFloat64(arguments[i]);
+    result = Float64Min(result, doubleValue);
+  }
+  return Convert<Number>(result);
+}
 
-  // ES6 #sec-math.acos
-  extern macro Float64Acos(float64): float64;
+// ES6 #sec-math.acos
+extern macro Float64Acos(float64): float64;
 
-  transitioning javascript builtin
-  MathAcos(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Acos(value));
-  }
+transitioning javascript builtin
+MathAcos(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Acos(value));
+}
 
-  // ES6 #sec-math.acosh
-  extern macro Float64Acosh(float64): float64;
+// ES6 #sec-math.acosh
+extern macro Float64Acosh(float64): float64;
 
-  transitioning javascript builtin
-  MathAcosh(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Acosh(value));
-  }
+transitioning javascript builtin
+MathAcosh(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Acosh(value));
+}
 
-  // ES6 #sec-math.asin
-  extern macro Float64Asin(float64): float64;
+// ES6 #sec-math.asin
+extern macro Float64Asin(float64): float64;
 
-  transitioning javascript builtin
-  MathAsin(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Asin(value));
-  }
+transitioning javascript builtin
+MathAsin(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Asin(value));
+}
 
-  // ES6 #sec-math.asinh
-  extern macro Float64Asinh(float64): float64;
+// ES6 #sec-math.asinh
+extern macro Float64Asinh(float64): float64;
 
-  transitioning javascript builtin
-  MathAsinh(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Asinh(value));
-  }
+transitioning javascript builtin
+MathAsinh(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Asinh(value));
+}
 
-  // ES6 #sec-math.atan
-  extern macro Float64Atan(float64): float64;
+// ES6 #sec-math.atan
+extern macro Float64Atan(float64): float64;
 
-  transitioning javascript builtin
-  MathAtan(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Atan(value));
-  }
+transitioning javascript builtin
+MathAtan(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Atan(value));
+}
 
-  // ES6 #sec-math.atan2
-  extern macro Float64Atan2(float64, float64): float64;
+// ES6 #sec-math.atan2
+extern macro Float64Atan2(float64, float64): float64;
 
-  transitioning javascript builtin
-  MathAtan2(js-implicit context: NativeContext)(y: JSAny, x: JSAny): Number {
-    const yValue = Convert<float64>(ToNumber_Inline(y));
-    const xValue = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Atan2(yValue, xValue));
-  }
+transitioning javascript builtin
+MathAtan2(js-implicit context: NativeContext)(y: JSAny, x: JSAny): Number {
+  const yValue = Convert<float64>(ToNumber_Inline(y));
+  const xValue = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Atan2(yValue, xValue));
+}
 
-  // ES6 #sec-math.atanh
-  extern macro Float64Atanh(float64): float64;
+// ES6 #sec-math.atanh
+extern macro Float64Atanh(float64): float64;
 
-  transitioning javascript builtin
-  MathAtanh(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Atanh(value));
-  }
+transitioning javascript builtin
+MathAtanh(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Atanh(value));
+}
 
-  // ES6 #sec-math.cbrt
-  extern macro Float64Cbrt(float64): float64;
+// ES6 #sec-math.cbrt
+extern macro Float64Cbrt(float64): float64;
 
-  transitioning javascript builtin
-  MathCbrt(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Cbrt(value));
-  }
+transitioning javascript builtin
+MathCbrt(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Cbrt(value));
+}
 
-  // ES6 #sec-math.clz32
-  extern macro Word32Clz(int32): int32;
+// ES6 #sec-math.clz32
+extern macro Word32Clz(int32): int32;
 
-  transitioning javascript builtin
-  MathClz32(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value: int32 = Convert<int32>(ToNumber_Inline(x));
-    return Convert<Number>(Word32Clz(value));
-  }
+transitioning javascript builtin
+MathClz32(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value: int32 = Convert<int32>(ToNumber_Inline(x));
+  return Convert<Number>(Word32Clz(value));
+}
 
-  // ES6 #sec-math.cos
-  extern macro Float64Cos(float64): float64;
+// ES6 #sec-math.cos
+extern macro Float64Cos(float64): float64;
 
-  transitioning javascript builtin
-  MathCos(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Cos(value));
-  }
+transitioning javascript builtin
+MathCos(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Cos(value));
+}
 
-  // ES6 #sec-math.cosh
-  extern macro Float64Cosh(float64): float64;
+// ES6 #sec-math.cosh
+extern macro Float64Cosh(float64): float64;
 
-  transitioning javascript builtin
-  MathCosh(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Cosh(value));
-  }
+transitioning javascript builtin
+MathCosh(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Cosh(value));
+}
 
-  // ES6 #sec-math.exp
-  extern macro Float64Exp(float64): float64;
+// ES6 #sec-math.exp
+extern macro Float64Exp(float64): float64;
 
-  transitioning javascript builtin
-  MathExp(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Exp(value));
-  }
+transitioning javascript builtin
+MathExp(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Exp(value));
+}
 
-  // ES6 #sec-math.expm1
-  extern macro Float64Expm1(float64): float64;
+// ES6 #sec-math.expm1
+extern macro Float64Expm1(float64): float64;
 
-  transitioning javascript builtin
-  MathExpm1(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Expm1(value));
-  }
+transitioning javascript builtin
+MathExpm1(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Expm1(value));
+}
 
-  // ES6 #sec-math.fround
-  transitioning javascript builtin
-  MathFround(js-implicit context: NativeContext)(x: JSAny): Number {
-    const x32 = Convert<float32>(ToNumber_Inline(x));
-    const x64 = Convert<float64>(x32);
-    return Convert<Number>(x64);
-  }
+// ES6 #sec-math.fround
+transitioning javascript builtin
+MathFround(js-implicit context: NativeContext)(x: JSAny): Number {
+  const x32 = Convert<float32>(ToNumber_Inline(x));
+  const x64 = Convert<float64>(x32);
+  return Convert<Number>(x64);
+}
 
-  // ES6 #sec-math.imul
-  transitioning javascript builtin
-  MathImul(js-implicit context: NativeContext)(x: JSAny, y: JSAny): Number {
-    const x = Convert<int32>(ToNumber_Inline(x));
-    const y = Convert<int32>(ToNumber_Inline(y));
-    return Convert<Number>(x * y);
-  }
+// ES6 #sec-math.imul
+transitioning javascript builtin
+MathImul(js-implicit context: NativeContext)(x: JSAny, y: JSAny): Number {
+  const x = Convert<int32>(ToNumber_Inline(x));
+  const y = Convert<int32>(ToNumber_Inline(y));
+  return Convert<Number>(x * y);
+}
 
-  // ES6 #sec-math.log
-  extern macro Float64Log(float64): float64;
+// ES6 #sec-math.log
+extern macro Float64Log(float64): float64;
 
-  transitioning javascript builtin
-  MathLog(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Log(value));
-  }
+transitioning javascript builtin
+MathLog(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Log(value));
+}
 
-  // ES6 #sec-math.log1p
-  extern macro Float64Log1p(float64): float64;
+// ES6 #sec-math.log1p
+extern macro Float64Log1p(float64): float64;
 
-  transitioning javascript builtin
-  MathLog1p(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Log1p(value));
-  }
+transitioning javascript builtin
+MathLog1p(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Log1p(value));
+}
 
-  // ES6 #sec-math.log10
-  extern macro Float64Log10(float64): float64;
+// ES6 #sec-math.log10
+extern macro Float64Log10(float64): float64;
 
-  transitioning javascript builtin
-  MathLog10(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Log10(value));
-  }
+transitioning javascript builtin
+MathLog10(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Log10(value));
+}
 
-  // ES6 #sec-math.log2
-  extern macro Float64Log2(float64): float64;
+// ES6 #sec-math.log2
+extern macro Float64Log2(float64): float64;
 
-  transitioning javascript builtin
-  MathLog2(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Log2(value));
-  }
+transitioning javascript builtin
+MathLog2(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Log2(value));
+}
 
-  // ES6 #sec-math.sin
-  extern macro Float64Sin(float64): float64;
+// ES6 #sec-math.sin
+extern macro Float64Sin(float64): float64;
 
-  transitioning javascript builtin
-  MathSin(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Sin(value));
-  }
+transitioning javascript builtin
+MathSin(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Sin(value));
+}
 
-  // ES6 #sec-math.sign
-  transitioning javascript builtin
-  MathSign(js-implicit context: NativeContext)(x: JSAny): Number {
-    const num = ToNumber_Inline(x);
-    const value = Convert<float64>(num);
+// ES6 #sec-math.sign
+transitioning javascript builtin
+MathSign(js-implicit context: NativeContext)(x: JSAny): Number {
+  const num = ToNumber_Inline(x);
+  const value = Convert<float64>(num);
 
-    if (value < 0) {
-      return -1;
-    } else if (value > 0) {
-      return 1;
-    } else {
-      return num;
-    }
+  if (value < 0) {
+    return -1;
+  } else if (value > 0) {
+    return 1;
+  } else {
+    return num;
   }
+}
 
-  // ES6 #sec-math.sinh
-  extern macro Float64Sinh(float64): float64;
+// ES6 #sec-math.sinh
+extern macro Float64Sinh(float64): float64;
 
-  transitioning javascript builtin
-  MathSinh(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Sinh(value));
-  }
+transitioning javascript builtin
+MathSinh(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Sinh(value));
+}
 
-  // ES6 #sec-math.sqrt
-  extern macro Float64Sqrt(float64): float64;
+// ES6 #sec-math.sqrt
+extern macro Float64Sqrt(float64): float64;
 
-  transitioning javascript builtin
-  MathSqrt(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Sqrt(value));
-  }
+transitioning javascript builtin
+MathSqrt(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Sqrt(value));
+}
 
-  // ES6 #sec-math.tan
-  extern macro Float64Tan(float64): float64;
+// ES6 #sec-math.tan
+extern macro Float64Tan(float64): float64;
 
-  transitioning javascript builtin
-  MathTan(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Tan(value));
-  }
+transitioning javascript builtin
+MathTan(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Tan(value));
+}
 
-  // ES6 #sec-math.tanh
-  extern macro Float64Tanh(float64): float64;
+// ES6 #sec-math.tanh
+extern macro Float64Tanh(float64): float64;
 
-  transitioning javascript builtin
-  MathTanh(js-implicit context: NativeContext)(x: JSAny): Number {
-    const value = Convert<float64>(ToNumber_Inline(x));
-    return Convert<Number>(Float64Tanh(value));
-  }
+transitioning javascript builtin
+MathTanh(js-implicit context: NativeContext)(x: JSAny): Number {
+  const value = Convert<float64>(ToNumber_Inline(x));
+  return Convert<Number>(Float64Tanh(value));
+}
 
-  // ES6 #sec-math.hypot
-  transitioning javascript builtin
-  MathHypot(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
-      Number {
-    const length = arguments.length;
-    if (length == 0) {
-      return 0;
-    }
-    const absValues = AllocateZeroedFixedDoubleArray(length);
-    let oneArgIsNaN: bool = false;
-    let max: float64 = 0;
-    for (let i: intptr = 0; i < length; ++i) {
-      const value = Convert<float64>(ToNumber_Inline(arguments[i]));
-      if (Float64IsNaN(value)) {
-        oneArgIsNaN = true;
-      } else {
-        const absValue = Float64Abs(value);
-        absValues.floats[i] = Convert<float64_or_hole>(absValue);
-        if (absValue > max) {
-          max = absValue;
-        }
+// ES6 #sec-math.hypot
+transitioning javascript builtin
+MathHypot(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): Number {
+  const length = arguments.length;
+  if (length == 0) {
+    return 0;
+  }
+  const absValues = AllocateZeroedFixedDoubleArray(length);
+  let oneArgIsNaN: bool = false;
+  let max: float64 = 0;
+  for (let i: intptr = 0; i < length; ++i) {
+    const value = Convert<float64>(ToNumber_Inline(arguments[i]));
+    if (Float64IsNaN(value)) {
+      oneArgIsNaN = true;
+    } else {
+      const absValue = Float64Abs(value);
+      absValues.floats[i] = Convert<float64_or_hole>(absValue);
+      if (absValue > max) {
+        max = absValue;
       }
     }
-    if (max == V8_INFINITY) {
-      return V8_INFINITY;
-    } else if (oneArgIsNaN) {
-      return kNaN;
-    } else if (max == 0) {
-      return 0;
-    }
-    assert(max > 0);
-
-    // Kahan summation to avoid rounding errors.
-    // Normalize the numbers to the largest one to avoid overflow.
-    let sum: float64 = 0;
-    let compensation: float64 = 0;
-    for (let i: intptr = 0; i < length; ++i) {
-      const n = absValues.floats[i].ValueUnsafeAssumeNotHole() / max;
-      const summand = n * n - compensation;
-      const preliminary = sum + summand;
-      compensation = (preliminary - sum) - summand;
-      sum = preliminary;
-    }
-    return Convert<Number>(Float64Sqrt(sum) * max);
   }
+  if (max == V8_INFINITY) {
+    return V8_INFINITY;
+  } else if (oneArgIsNaN) {
+    return kNaN;
+  } else if (max == 0) {
+    return 0;
+  }
+  assert(max > 0);
+
+  // Kahan summation to avoid rounding errors.
+  // Normalize the numbers to the largest one to avoid overflow.
+  let sum: float64 = 0;
+  let compensation: float64 = 0;
+  for (let i: intptr = 0; i < length; ++i) {
+    const n = absValues.floats[i].ValueUnsafeAssumeNotHole() / max;
+    const summand = n * n - compensation;
+    const preliminary = sum + summand;
+    compensation = (preliminary - sum) - summand;
+    sum = preliminary;
+  }
+  return Convert<Number>(Float64Sqrt(sum) * max);
+}
 
-  // ES6 #sec-math.random
-  extern macro RefillMathRandom(NativeContext): Smi;
-
-  transitioning javascript builtin
-  MathRandom(js-implicit context: NativeContext, receiver: JSAny)(): Number {
-    let smiIndex: Smi =
-        Cast<Smi>(context[NativeContextSlot::MATH_RANDOM_INDEX_INDEX])
-        otherwise unreachable;
-    if (smiIndex == 0) {
-      // refill math random.
-      smiIndex = RefillMathRandom(context);
-    }
-    const newSmiIndex: Smi = smiIndex - 1;
-    context[NativeContextSlot::MATH_RANDOM_INDEX_INDEX] = newSmiIndex;
-
-    const array: FixedDoubleArray = Cast<FixedDoubleArray>(
-        context[NativeContextSlot::MATH_RANDOM_CACHE_INDEX])
-        otherwise unreachable;
-    const random: float64 =
-        array.floats[Convert<intptr>(newSmiIndex)].ValueUnsafeAssumeNotHole();
-    return AllocateHeapNumberWithValue(random);
-  }
+// ES6 #sec-math.random
+extern macro RefillMathRandom(NativeContext): Smi;
+
+transitioning javascript builtin
+MathRandom(js-implicit context: NativeContext, receiver: JSAny)(): Number {
+  let smiIndex: Smi =
+      Cast<Smi>(context[NativeContextSlot::MATH_RANDOM_INDEX_INDEX])
+      otherwise unreachable;
+  if (smiIndex == 0) {
+    // refill math random.
+    smiIndex = RefillMathRandom(context);
+  }
+  const newSmiIndex: Smi = smiIndex - 1;
+  context[NativeContextSlot::MATH_RANDOM_INDEX_INDEX] = newSmiIndex;
+
+  const array: FixedDoubleArray = Cast<FixedDoubleArray>(
+      context[NativeContextSlot::MATH_RANDOM_CACHE_INDEX])
+      otherwise unreachable;
+  const random: float64 =
+      array.floats[Convert<intptr>(newSmiIndex)].ValueUnsafeAssumeNotHole();
+  return AllocateHeapNumberWithValue(random);
+}
 }
diff --git a/deps/v8/src/builtins/mips/builtins-mips.cc b/deps/v8/src/builtins/mips/builtins-mips.cc
index cb1a86db2f4..c98961f2ad4 100644
--- a/deps/v8/src/builtins/mips/builtins-mips.cc
+++ b/deps/v8/src/builtins/mips/builtins-mips.cc
@@ -911,16 +911,25 @@ static void MaybeOptimizeCode(MacroAssembler* masm, Register feedback_vector,
 
 // Advance the current bytecode offset. This simulates what all bytecode
 // handlers do upon completion of the underlying operation. Will bail out to a
-// label if the bytecode (without prefix) is a return bytecode.
+// label if the bytecode (without prefix) is a return bytecode. Will not advance
+// the bytecode offset if the current bytecode is a JumpLoop, instead just
+// re-executing the JumpLoop to jump to the correct bytecode.
 static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
                                           Register bytecode_array,
                                           Register bytecode_offset,
                                           Register bytecode, Register scratch1,
-                                          Register scratch2, Label* if_return) {
+                                          Register scratch2, Register scratch3,
+                                          Label* if_return) {
   Register bytecode_size_table = scratch1;
-  DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
-                     bytecode));
 
+  // The bytecode offset value will be increased by one in wide and extra wide
+  // cases. In the case of having a wide or extra wide JumpLoop bytecode, we
+  // will restore the original bytecode. In order to simplify the code, we have
+  // a backup of it.
+  Register original_bytecode_offset = scratch3;
+  DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode,
+                     bytecode_size_table, original_bytecode_offset));
+  __ Move(original_bytecode_offset, bytecode_offset);
   __ li(bytecode_size_table, ExternalReference::bytecode_size_table_address());
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
@@ -959,10 +968,23 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   RETURN_BYTECODE_LIST(JUMP_IF_EQUAL)
 #undef JUMP_IF_EQUAL
 
+  // If this is a JumpLoop, re-execute it to perform the jump to the beginning
+  // of the loop.
+  Label end, not_jump_loop;
+  __ Branch(&not_jump_loop, ne, bytecode,
+            Operand(static_cast<int>(interpreter::Bytecode::kJumpLoop)));
+  // We need to restore the original bytecode_offset since we might have
+  // increased it to skip the wide / extra-wide prefix bytecode.
+  __ Move(bytecode_offset, original_bytecode_offset);
+  __ jmp(&end);
+
+  __ bind(&not_jump_loop);
   // Otherwise, load the size of the current bytecode and advance the offset.
   __ Lsa(scratch2, bytecode_size_table, bytecode, 2);
   __ lw(scratch2, MemOperand(scratch2));
   __ Addu(bytecode_offset, bytecode_offset, scratch2);
+
+  __ bind(&end);
 }
 
 // Generate code for entering a JS function with the interpreter.
@@ -1134,7 +1156,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   __ lbu(a1, MemOperand(a1));
   AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
                                 kInterpreterBytecodeOffsetRegister, a1, a2, a3,
-                                &do_return);
+                                t0, &do_return);
   __ jmp(&do_dispatch);
 
   __ bind(&do_return);
@@ -1412,7 +1434,7 @@ void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
   Label if_return;
   AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
                                 kInterpreterBytecodeOffsetRegister, a1, a2, a3,
-                                &if_return);
+                                t0, &if_return);
 
   __ bind(&enter_bytecode);
   // Convert new bytecode offset to a Smi and save in the stackframe.
diff --git a/deps/v8/src/builtins/mips64/builtins-mips64.cc b/deps/v8/src/builtins/mips64/builtins-mips64.cc
index baf2d5bfec8..babe084bb05 100644
--- a/deps/v8/src/builtins/mips64/builtins-mips64.cc
+++ b/deps/v8/src/builtins/mips64/builtins-mips64.cc
@@ -930,15 +930,25 @@ static void MaybeOptimizeCode(MacroAssembler* masm, Register feedback_vector,
 
 // Advance the current bytecode offset. This simulates what all bytecode
 // handlers do upon completion of the underlying operation. Will bail out to a
-// label if the bytecode (without prefix) is a return bytecode.
+// label if the bytecode (without prefix) is a return bytecode. Will not advance
+// the bytecode offset if the current bytecode is a JumpLoop, instead just
+// re-executing the JumpLoop to jump to the correct bytecode.
 static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
                                           Register bytecode_array,
                                           Register bytecode_offset,
                                           Register bytecode, Register scratch1,
-                                          Register scratch2, Label* if_return) {
+                                          Register scratch2, Register scratch3,
+                                          Label* if_return) {
   Register bytecode_size_table = scratch1;
-  DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
-                     bytecode));
+
+  // The bytecode offset value will be increased by one in wide and extra wide
+  // cases. In the case of having a wide or extra wide JumpLoop bytecode, we
+  // will restore the original bytecode. In order to simplify the code, we have
+  // a backup of it.
+  Register original_bytecode_offset = scratch3;
+  DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode,
+                     bytecode_size_table, original_bytecode_offset));
+  __ Move(original_bytecode_offset, bytecode_offset);
   __ li(bytecode_size_table, ExternalReference::bytecode_size_table_address());
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
@@ -977,10 +987,23 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   RETURN_BYTECODE_LIST(JUMP_IF_EQUAL)
 #undef JUMP_IF_EQUAL
 
+  // If this is a JumpLoop, re-execute it to perform the jump to the beginning
+  // of the loop.
+  Label end, not_jump_loop;
+  __ Branch(&not_jump_loop, ne, bytecode,
+            Operand(static_cast<int>(interpreter::Bytecode::kJumpLoop)));
+  // We need to restore the original bytecode_offset since we might have
+  // increased it to skip the wide / extra-wide prefix bytecode.
+  __ Move(bytecode_offset, original_bytecode_offset);
+  __ jmp(&end);
+
+  __ bind(&not_jump_loop);
   // Otherwise, load the size of the current bytecode and advance the offset.
   __ Dlsa(scratch2, bytecode_size_table, bytecode, 2);
   __ Lw(scratch2, MemOperand(scratch2));
   __ Daddu(bytecode_offset, bytecode_offset, scratch2);
+
+  __ bind(&end);
 }
 
 // Generate code for entering a JS function with the interpreter.
@@ -1153,7 +1176,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   __ Lbu(a1, MemOperand(a1));
   AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
                                 kInterpreterBytecodeOffsetRegister, a1, a2, a3,
-                                &do_return);
+                                a4, &do_return);
   __ jmp(&do_dispatch);
 
   __ bind(&do_return);
@@ -1430,7 +1453,7 @@ void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
   Label if_return;
   AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
                                 kInterpreterBytecodeOffsetRegister, a1, a2, a3,
-                                &if_return);
+                                a4, &if_return);
 
   __ bind(&enter_bytecode);
   // Convert new bytecode offset to a Smi and save in the stackframe.
diff --git a/deps/v8/src/builtins/number.tq b/deps/v8/src/builtins/number.tq
index 958cd5f5f65..753998424fa 100644
--- a/deps/v8/src/builtins/number.tq
+++ b/deps/v8/src/builtins/number.tq
@@ -2,74 +2,746 @@
 // source code is governed by a BSD-style license that can be found in the
 // LICENSE file.
 
+#include 'src/ic/binary-op-assembler.h'
+
+extern enum Operation extends uint31 {
+  // Binary operations.
+  kAdd,
+  kSubtract,
+  kMultiply,
+  kDivide,
+  kModulus,
+  kExponentiate,
+  kBitwiseAnd,
+  kBitwiseOr,
+  kBitwiseXor,
+  kShiftLeft,
+  kShiftRight,
+  kShiftRightLogical,
+  // Unary operations.
+  kBitwiseNot,
+  kNegate,
+  kIncrement,
+  kDecrement,
+  // Compare operations.
+  kEqual,
+  kStrictEqual,
+  kLessThan,
+  kLessThanOrEqual,
+  kGreaterThan,
+  kGreaterThanOrEqual
+}
+
 namespace runtime {
-  extern transitioning runtime
-  DoubleToStringWithRadix(implicit context: Context)(Number, Number): String;
+extern transitioning runtime
+DoubleToStringWithRadix(implicit context: Context)(Number, Number): String;
+
+extern transitioning runtime StringParseFloat(implicit context: Context)(
+    String): Number;
+extern transitioning runtime StringParseInt(implicit context: Context)(
+    JSAny, JSAny): Number;
+
+extern runtime BigIntUnaryOp(Context, BigInt, SmiTagged<Operation>): BigInt;
+extern runtime BigIntBinaryOp(
+    Context, Numeric, Numeric, SmiTagged<Operation>): BigInt;
 }  // namespace runtime
 
 namespace number {
-  extern macro NaNStringConstant(): String;
-  extern macro ZeroStringConstant(): String;
-  extern macro InfinityStringConstant(): String;
-  extern macro MinusInfinityStringConstant(): String;
+extern macro NaNStringConstant(): String;
+extern macro ZeroStringConstant(): String;
+extern macro InfinityStringConstant(): String;
+extern macro MinusInfinityStringConstant(): String;
+
+const kAsciiZero: constexpr int32 = 48;        // '0' (ascii)
+const kAsciiLowerCaseA: constexpr int32 = 97;  // 'a' (ascii)
+
+transitioning macro ThisNumberValue(implicit context: Context)(
+    receiver: JSAny, method: constexpr string): Number {
+  return UnsafeCast<Number>(
+      ToThisValue(receiver, PrimitiveType::kNumber, method));
+}
+
+// https://tc39.github.io/ecma262/#sec-number.prototype.tostring
+transitioning javascript builtin NumberPrototypeToString(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  // 1. Let x be ? thisNumberValue(this value).
+  const x = ThisNumberValue(receiver, 'Number.prototype.toString');
+
+  // 2. If radix is not present, let radixNumber be 10.
+  // 3. Else if radix is undefined, let radixNumber be 10.
+  // 4. Else, let radixNumber be ? ToInteger(radix).
+  const radix: JSAny = arguments[0];
+  const radixNumber: Number = radix == Undefined ? 10 : ToInteger_Inline(radix);
+
+  // 5. If radixNumber < 2 or radixNumber > 36, throw a RangeError exception.
+  if (radixNumber < 2 || radixNumber > 36) {
+    ThrowRangeError(MessageTemplate::kToRadixFormatRange);
+  }
+
+  // 6. If radixNumber = 10, return ! ToString(x).
+  if (radixNumber == 10) {
+    return NumberToString(x);
+  }
+
+  // 7. Return the String representation of this Number
+  //    value using the radix specified by radixNumber.
+
+  // Fast case where the result is a one character string.
+  if (TaggedIsPositiveSmi(x) && x < radixNumber) {
+    let charCode = Convert<int32>(UnsafeCast<Smi>(x));
+    if (charCode < 10) {
+      charCode += kAsciiZero;
+    } else {
+      charCode = charCode - 10 + kAsciiLowerCaseA;
+    }
+    return StringFromSingleCharCode(charCode);
+  }
+
+  if (x == -0) {
+    return ZeroStringConstant();
+  } else if (::NumberIsNaN(x)) {
+    return NaNStringConstant();
+  } else if (x == V8_INFINITY) {
+    return InfinityStringConstant();
+  } else if (x == MINUS_V8_INFINITY) {
+    return MinusInfinityStringConstant();
+  }
+  return runtime::DoubleToStringWithRadix(x, radixNumber);
+}
+
+// ES6 #sec-number.isfinite
+javascript builtin NumberIsFinite(
+    js-implicit context: NativeContext,
+    receiver: JSAny)(value: JSAny): Boolean {
+  typeswitch (value) {
+    case (Smi): {
+      return True;
+    }
+    case (h: HeapNumber): {
+      const number: float64 = Convert<float64>(h);
+      const infiniteOrNaN: bool = Float64IsNaN(number - number);
+      return Convert<Boolean>(!infiniteOrNaN);
+    }
+    case (JSAnyNotNumber): {
+      return False;
+    }
+  }
+}
+
+// ES6 #sec-number.isinteger
+javascript builtin NumberIsInteger(js-implicit context: NativeContext)(
+    value: JSAny): Boolean {
+  return SelectBooleanConstant(IsInteger(value));
+}
+
+// ES6 #sec-number.isnan
+javascript builtin NumberIsNaN(js-implicit context: NativeContext)(
+    value: JSAny): Boolean {
+  typeswitch (value) {
+    case (Smi): {
+      return False;
+    }
+    case (h: HeapNumber): {
+      const number: float64 = Convert<float64>(h);
+      return Convert<Boolean>(Float64IsNaN(number));
+    }
+    case (JSAnyNotNumber): {
+      return False;
+    }
+  }
+}
+
+// ES6 #sec-number.issafeinteger
+javascript builtin NumberIsSafeInteger(js-implicit context: NativeContext)(
+    value: JSAny): Boolean {
+  return SelectBooleanConstant(IsSafeInteger(value));
+}
+
+// ES6 #sec-number.prototype.valueof
+transitioning javascript builtin NumberPrototypeValueOf(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+  return ToThisValue(
+      receiver, PrimitiveType::kNumber, 'Number.prototype.valueOf');
+}
+
+// ES6 #sec-number.parsefloat
+transitioning javascript builtin NumberParseFloat(
+    js-implicit context: NativeContext)(value: JSAny): Number {
+  try {
+    typeswitch (value) {
+      case (s: Smi): {
+        return s;
+      }
+      case (h: HeapNumber): {
+        // The input is already a Number. Take care of -0.
+        // The sense of comparison is important for the NaN case.
+        return (Convert<float64>(h) == 0) ? SmiConstant(0) : h;
+      }
+      case (s: String): {
+        goto String(s);
+      }
+      case (HeapObject): {
+        goto String(string::ToString(context, value));
+      }
+    }
+  } label String(s: String) {
+    // Check if the string is a cached array index.
+    const hash: NameHash = s.hash_field;
+    if (!hash.is_not_integer_index_mask &&
+        hash.array_index_length < kMaxCachedArrayIndexLength) {
+      const arrayIndex: uint32 = hash.array_index_value;
+      return SmiFromUint32(arrayIndex);
+    }
+    // Fall back to the runtime to convert string to a number.
+    return runtime::StringParseFloat(s);
+  }
+}
 
-  const kAsciiZero: constexpr int32 = 48;        // '0' (ascii)
-  const kAsciiLowerCaseA: constexpr int32 = 97;  // 'a' (ascii)
+extern macro TruncateFloat64ToWord32(float64): uint32;
+
+transitioning builtin ParseInt(implicit context: Context)(
+    input: JSAny, radix: JSAny): Number {
+  try {
+    // Check if radix should be 10 (i.e. undefined, 0 or 10).
+    if (radix != Undefined && !TaggedEqual(radix, SmiConstant(10)) &&
+        !TaggedEqual(radix, SmiConstant(0))) {
+      goto CallRuntime;
+    }
 
-  transitioning macro ThisNumberValue(implicit context: Context)(
-      receiver: JSAny, method: constexpr string): Number {
-    return UnsafeCast<Number>(
-        ToThisValue(receiver, PrimitiveType::kNumber, method));
+    typeswitch (input) {
+      case (s: Smi): {
+        return s;
+      }
+      case (h: HeapNumber): {
+        // Check if the input value is in Signed32 range.
+        const asFloat64: float64 = Convert<float64>(h);
+        const asInt32: int32 = Signed(TruncateFloat64ToWord32(asFloat64));
+        // The sense of comparison is important for the NaN case.
+        if (asFloat64 == ChangeInt32ToFloat64(asInt32)) goto Int32(asInt32);
+
+        // Check if the absolute value of input is in the [1,1<<31[ range. Call
+        // the runtime for the range [0,1[ because the result could be -0.
+        const kMaxAbsValue: float64 = 2147483648.0;
+        const absInput: float64 = math::Float64Abs(asFloat64);
+        if (absInput < kMaxAbsValue && absInput >= 1) goto Int32(asInt32);
+        goto CallRuntime;
+      }
+      case (s: String): {
+        goto String(s);
+      }
+      case (HeapObject): {
+        goto CallRuntime;
+      }
+    }
+  } label Int32(i: int32) {
+    return ChangeInt32ToTagged(i);
+  } label String(s: String) {
+    // Check if the string is a cached array index.
+    const hash: NameHash = s.hash_field;
+    if (!hash.is_not_integer_index_mask &&
+        hash.array_index_length < kMaxCachedArrayIndexLength) {
+      const arrayIndex: uint32 = hash.array_index_value;
+      return SmiFromUint32(arrayIndex);
+    }
+    // Fall back to the runtime.
+    goto CallRuntime;
+  } label CallRuntime {
+    tail runtime::StringParseInt(input, radix);
   }
+}
+
+// ES6 #sec-number.parseint
+transitioning javascript builtin NumberParseInt(
+    js-implicit context: NativeContext)(value: JSAny, radix: JSAny): Number {
+  return ParseInt(value, radix);
+}
+
+extern builtin NonNumberToNumeric(implicit context: Context)(JSAny): Numeric;
+extern builtin BitwiseXor(implicit context: Context)(Number, Number): Number;
+extern builtin Subtract(implicit context: Context)(Number, Number): Number;
+extern builtin Add(implicit context: Context)(Number, Number): Number;
+extern builtin StringAddConvertLeft(implicit context: Context)(
+    JSAny, String): JSAny;
+extern builtin StringAddConvertRight(implicit context: Context)(
+    String, JSAny): JSAny;
+
+extern macro BitwiseOp(int32, int32, constexpr Operation): Number;
+extern macro RelationalComparison(
+    constexpr Operation, JSAny, JSAny, Context): Boolean;
+
+// TODO(bbudge) Use a simpler macro structure that doesn't loop when converting
+// non-numbers, if such a code sequence doesn't make the builtin bigger.
 
-  // https://tc39.github.io/ecma262/#sec-number.prototype.tostring
-  transitioning javascript builtin NumberPrototypeToString(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): String {
-    // 1. Let x be ? thisNumberValue(this value).
-    const x = ThisNumberValue(receiver, 'Number.prototype.toString');
+transitioning macro ToNumericOrPrimitive(implicit context: Context)(
+    value: JSAny): JSAny {
+  typeswitch (value) {
+    case (v: JSReceiver): {
+      return NonPrimitiveToPrimitive_Default(context, v);
+    }
+    case (v: JSPrimitive): {
+      return NonNumberToNumeric(v);
+    }
+  }
+}
 
-    // 2. If radix is not present, let radixNumber be 10.
-    // 3. Else if radix is undefined, let radixNumber be 10.
-    // 4. Else, let radixNumber be ? ToInteger(radix).
-    const radix: JSAny = arguments[0];
-    const radixNumber: Number =
-        radix == Undefined ? 10 : ToInteger_Inline(radix);
+transitioning builtin Add(implicit context: Context)(
+    leftArg: JSAny, rightArg: JSAny): JSAny {
+  let left: JSAny = leftArg;
+  let right: JSAny = rightArg;
+  try {
+    while (true) {
+      typeswitch (left) {
+        case (left: Smi): {
+          typeswitch (right) {
+            case (right: Smi): {
+              return math::TrySmiAdd(left, right) otherwise goto Float64s(
+                  SmiToFloat64(left), SmiToFloat64(right));
+            }
+            case (right: HeapNumber): {
+              goto Float64s(SmiToFloat64(left), Convert<float64>(right));
+            }
+            case (right: BigInt): {
+              goto Numerics(left, right);
+            }
+            case (right: String): {
+              goto StringAddConvertLeft(left, right);
+            }
+            case (HeapObject): {
+              right = ToNumericOrPrimitive(right);
+              continue;
+            }
+          }
+        }
+        case (left: HeapNumber): {
+          typeswitch (right) {
+            case (right: Smi): {
+              goto Float64s(Convert<float64>(left), SmiToFloat64(right));
+            }
+            case (right: HeapNumber): {
+              goto Float64s(Convert<float64>(left), Convert<float64>(right));
+            }
+            case (right: BigInt): {
+              goto Numerics(left, right);
+            }
+            case (right: String): {
+              goto StringAddConvertLeft(left, right);
+            }
+            case (HeapObject): {
+              right = ToNumericOrPrimitive(right);
+              continue;
+            }
+          }
+        }
+        case (left: BigInt): {
+          typeswitch (right) {
+            case (right: Numeric): {
+              goto Numerics(left, right);
+            }
+            case (right: String): {
+              goto StringAddConvertLeft(left, right);
+            }
+            case (HeapObject): {
+              right = ToNumericOrPrimitive(right);
+              continue;
+            }
+          }
+        }
+        case (left: String): {
+          goto StringAddConvertRight(left, right);
+        }
+        case (leftReceiver: JSReceiver): {
+          left = ToPrimitiveDefault(leftReceiver);
+        }
+        case (HeapObject): {
+          // left: HeapObject
+          typeswitch (right) {
+            case (right: String): {
+              goto StringAddConvertLeft(left, right);
+            }
+            case (rightReceiver: JSReceiver): {
+              // left is JSPrimitive and right is JSReceiver, convert right
+              // with priority.
+              right = ToPrimitiveDefault(rightReceiver);
+              continue;
+            }
+            case (JSPrimitive): {
+              // Neither left or right is JSReceiver, convert left.
+              left = NonNumberToNumeric(left);
+              continue;
+            }
+          }
+        }
+      }
+    }
+  } label StringAddConvertLeft(left: JSAny, right: String) {
+    tail StringAddConvertLeft(left, right);
+  } label StringAddConvertRight(left: String, right: JSAny) {
+    tail StringAddConvertRight(left, right);
+  } label Numerics(left: Numeric, right: Numeric) {
+    tail bigint::BigIntAdd(left, right);
+  } label Float64s(left: float64, right: float64) {
+    return AllocateHeapNumberWithValue(left + right);
+  }
+  unreachable;
+}
 
-    // 5. If radixNumber < 2 or radixNumber > 36, throw a RangeError exception.
-    if (radixNumber < 2 || radixNumber > 36) {
-      ThrowRangeError(MessageTemplate::kToRadixFormatRange);
+// Unary type switch on Number | BigInt.
+macro UnaryOp1(implicit context: Context)(value: JSAny): never labels
+Number(Number), BigInt(BigInt) {
+  let x: JSAny = value;
+  while (true) {
+    typeswitch (x) {
+      case (n: Number): {
+        goto Number(n);
+      }
+      case (b: BigInt): {
+        goto BigInt(b);
+      }
+      case (JSAnyNotNumeric): {
+        x = NonNumberToNumeric(x);
+      }
     }
+  }
+  unreachable;
+}
 
-    // 6. If radixNumber = 10, return ! ToString(x).
-    if (radixNumber == 10) {
-      return NumberToString(x);
+// Unary type switch on Smi | HeapNumber | BigInt.
+macro UnaryOp2(implicit context: Context)(value: JSAny): never labels
+Smi(Smi), HeapNumber(HeapNumber), BigInt(BigInt) {
+  let x: JSAny = value;
+  while (true) {
+    typeswitch (x) {
+      case (s: Smi): {
+        goto Smi(s);
+      }
+      case (h: HeapNumber): {
+        goto HeapNumber(h);
+      }
+      case (b: BigInt): {
+        goto BigInt(b);
+      }
+      case (JSAnyNotNumeric): {
+        x = NonNumberToNumeric(x);
+      }
     }
+  }
+  unreachable;
+}
 
-    // 7. Return the String representation of this Number
-    //    value using the radix specified by radixNumber.
+// Binary type switch on Number | BigInt.
+macro BinaryOp1(implicit context: Context)(
+    leftVal: JSAny, rightVal: JSAny): never labels
+Number(Number, Number), AtLeastOneBigInt(Numeric, Numeric) {
+  let left: JSAny = leftVal;
+  let right: JSAny = rightVal;
+  while (true) {
+    try {
+      typeswitch (left) {
+        case (left: Number): {
+          typeswitch (right) {
+            case (right: Number): {
+              goto Number(left, right);
+            }
+            case (right: BigInt): {
+              goto AtLeastOneBigInt(left, right);
+            }
+            case (JSAnyNotNumeric): {
+              goto RightNotNumeric;
+            }
+          }
+        }
+        case (left: BigInt): {
+          typeswitch (right) {
+            case (right: Numeric): {
+              goto AtLeastOneBigInt(left, right);
+            }
+            case (JSAnyNotNumeric): {
+              goto RightNotNumeric;
+            }
+          }
+        }
+        case (JSAnyNotNumeric): {
+          left = NonNumberToNumeric(left);
+        }
+      }
+    } label RightNotNumeric {
+      right = NonNumberToNumeric(right);
+    }
+  }
+  unreachable;
+}
 
-    // Fast case where the result is a one character string.
-    if (TaggedIsPositiveSmi(x) && x < radixNumber) {
-      let charCode = Convert<int32>(UnsafeCast<Smi>(x));
-      if (charCode < 10) {
-        charCode += kAsciiZero;
-      } else {
-        charCode = charCode - 10 + kAsciiLowerCaseA;
+// Binary type switch on Smi | HeapNumber | BigInt.
+macro BinaryOp2(implicit context: Context)(leftVal: JSAny, rightVal: JSAny):
+    never labels Smis(Smi, Smi), Float64s(float64, float64),
+    AtLeastOneBigInt(Numeric, Numeric) {
+  let left: JSAny = leftVal;
+  let right: JSAny = rightVal;
+  while (true) {
+    try {
+      typeswitch (left) {
+        case (left: Smi): {
+          typeswitch (right) {
+            case (right: Smi): {
+              goto Smis(left, right);
+            }
+            case (right: HeapNumber): {
+              goto Float64s(SmiToFloat64(left), Convert<float64>(right));
+            }
+            case (right: BigInt): {
+              goto AtLeastOneBigInt(left, right);
+            }
+            case (JSAnyNotNumeric): {
+              goto RightNotNumeric;
+            }
+          }
+        }
+        case (left: HeapNumber): {
+          typeswitch (right) {
+            case (right: Smi): {
+              goto Float64s(Convert<float64>(left), SmiToFloat64(right));
+            }
+            case (right: HeapNumber): {
+              goto Float64s(Convert<float64>(left), Convert<float64>(right));
+            }
+            case (right: BigInt): {
+              goto AtLeastOneBigInt(left, right);
+            }
+            case (JSAnyNotNumeric): {
+              goto RightNotNumeric;
+            }
+          }
+        }
+        case (left: BigInt): {
+          typeswitch (right) {
+            case (right: Numeric): {
+              goto AtLeastOneBigInt(left, right);
+            }
+            case (JSAnyNotNumeric): {
+              goto RightNotNumeric;
+            }
+          }
+        }
+        case (JSAnyNotNumeric): {
+          left = NonNumberToNumeric(left);
+        }
       }
-      return StringFromSingleCharCode(charCode);
+    } label RightNotNumeric {
+      right = NonNumberToNumeric(right);
+    }
+  }
+  unreachable;
+}
+
+builtin Subtract(implicit context: Context)(
+    left: JSAny, right: JSAny): Numeric {
+  try {
+    BinaryOp2(left, right) otherwise Smis, Float64s, AtLeastOneBigInt;
+  } label Smis(left: Smi, right: Smi) {
+    try {
+      return math::TrySmiSub(left, right) otherwise Overflow;
+    } label Overflow {
+      goto Float64s(SmiToFloat64(left), SmiToFloat64(right));
     }
+  } label Float64s(left: float64, right: float64) {
+    return AllocateHeapNumberWithValue(left - right);
+  } label AtLeastOneBigInt(left: Numeric, right: Numeric) {
+    tail bigint::BigIntSubtract(left, right);
+  }
+}
+
+builtin Multiply(implicit context: Context)(
+    left: JSAny, right: JSAny): Numeric {
+  try {
+    BinaryOp2(left, right) otherwise Smis, Float64s, AtLeastOneBigInt;
+  } label Smis(left: Smi, right: Smi) {
+    // The result is not necessarily a smi, in case of overflow.
+    return SmiMul(left, right);
+  } label Float64s(left: float64, right: float64) {
+    return AllocateHeapNumberWithValue(left * right);
+  } label AtLeastOneBigInt(left: Numeric, right: Numeric) {
+    tail runtime::BigIntBinaryOp(
+        context, left, right, SmiTag<Operation>(Operation::kMultiply));
+  }
+}
+
+const kSmiValueSize: constexpr int32 generates 'kSmiValueSize';
+const kMinInt32: constexpr int32 generates 'kMinInt';
+const kMinInt31: constexpr int32 generates 'kMinInt31';
+const kMinimumDividend: int32 = (kSmiValueSize == 32) ? kMinInt32 : kMinInt31;
+
+builtin Divide(implicit context: Context)(left: JSAny, right: JSAny): Numeric {
+  try {
+    BinaryOp2(left, right) otherwise Smis, Float64s, AtLeastOneBigInt;
+  } label Smis(left: Smi, right: Smi) {
+    // TODO(jkummerow): Consider just always doing a double division.
+    // Bail out if {divisor} is zero.
+    if (right == 0) goto SmiBailout(left, right);
+
+    // Bail out if dividend is zero and divisor is negative.
+    if (left == 0 && right < 0) goto SmiBailout(left, right);
+
+    const dividend: int32 = SmiToInt32(left);
+    const divisor: int32 = SmiToInt32(right);
 
-    if (x == -0) {
-      return ZeroStringConstant();
-    } else if (NumberIsNaN(x)) {
-      return NaNStringConstant();
-    } else if (x == V8_INFINITY) {
-      return InfinityStringConstant();
-    } else if (x == MINUS_V8_INFINITY) {
-      return MinusInfinityStringConstant();
+    // Bail out if dividend is kMinInt31 (or kMinInt32 if Smis are 32 bits)
+    // and divisor is -1.
+    if (divisor == -1 && dividend == kMinimumDividend) {
+      goto SmiBailout(left, right);
     }
+    // TODO(epertoso): consider adding a machine instruction that returns
+    // both the result and the remainder.
+    const result: int32 = dividend / divisor;
+    const truncated: int32 = result * divisor;
+    if (dividend != truncated) goto SmiBailout(left, right);
+    return SmiFromInt32(result);
+  } label SmiBailout(left: Smi, right: Smi) {
+    goto Float64s(SmiToFloat64(left), SmiToFloat64(right));
+  } label Float64s(left: float64, right: float64) {
+    return AllocateHeapNumberWithValue(left / right);
+  } label AtLeastOneBigInt(left: Numeric, right: Numeric) {
+    tail runtime::BigIntBinaryOp(
+        context, left, right, SmiTag<Operation>(Operation::kDivide));
+  }
+}
+
+builtin Modulus(implicit context: Context)(left: JSAny, right: JSAny): Numeric {
+  try {
+    BinaryOp2(left, right) otherwise Smis, Float64s, AtLeastOneBigInt;
+  } label Smis(left: Smi, right: Smi) {
+    return SmiMod(left, right);
+  } label Float64s(left: float64, right: float64) {
+    return AllocateHeapNumberWithValue(left % right);
+  } label AtLeastOneBigInt(left: Numeric, right: Numeric) {
+    tail runtime::BigIntBinaryOp(
+        context, left, right, SmiTag<Operation>(Operation::kModulus));
+  }
+}
+
+builtin Exponentiate(implicit context: Context)(
+    left: JSAny, right: JSAny): Numeric {
+  try {
+    BinaryOp1(left, right) otherwise Numbers, AtLeastOneBigInt;
+  } label Numbers(left: Number, right: Number) {
+    return math::MathPowImpl(left, right);
+  } label AtLeastOneBigInt(left: Numeric, right: Numeric) {
+    tail runtime::BigIntBinaryOp(
+        context, left, right, SmiTag<Operation>(Operation::kExponentiate));
+  }
+}
+
+builtin Negate(implicit context: Context)(value: JSAny): Numeric {
+  try {
+    UnaryOp2(value) otherwise Smi, HeapNumber, BigInt;
+  } label Smi(s: Smi) {
+    return SmiMul(s, -1);
+  } label HeapNumber(h: HeapNumber) {
+    return AllocateHeapNumberWithValue(Convert<float64>(h) * -1);
+  } label BigInt(b: BigInt) {
+    tail runtime::BigIntUnaryOp(
+        context, b, SmiTag<Operation>(Operation::kNegate));
+  }
+}
+
+builtin BitwiseNot(implicit context: Context)(value: JSAny): Numeric {
+  try {
+    UnaryOp1(value) otherwise Number, BigInt;
+  } label Number(n: Number) {
+    tail BitwiseXor(n, -1);
+  } label BigInt(b: BigInt) {
+    return runtime::BigIntUnaryOp(
+        context, b, SmiTag<Operation>(Operation::kBitwiseNot));
+  }
+}
 
-    return runtime::DoubleToStringWithRadix(x, radixNumber);
+builtin Decrement(implicit context: Context)(value: JSAny): Numeric {
+  try {
+    UnaryOp1(value) otherwise Number, BigInt;
+  } label Number(n: Number) {
+    tail Subtract(n, 1);
+  } label BigInt(b: BigInt) {
+    return runtime::BigIntUnaryOp(
+        context, b, SmiTag<Operation>(Operation::kDecrement));
   }
 }
+
+builtin Increment(implicit context: Context)(value: JSAny): Numeric {
+  try {
+    UnaryOp1(value) otherwise Number, BigInt;
+  } label Number(n: Number) {
+    tail Add(n, 1);
+  } label BigInt(b: BigInt) {
+    return runtime::BigIntUnaryOp(
+        context, b, SmiTag<Operation>(Operation::kIncrement));
+  }
+}
+
+// Bitwise binary operations.
+
+extern macro BinaryOpAssembler::Generate_BitwiseBinaryOp(
+    constexpr Operation, JSAny, JSAny, Context): Object;
+
+builtin ShiftLeft(implicit context: Context)(
+    left: JSAny, right: JSAny): Object {
+  return Generate_BitwiseBinaryOp(Operation::kShiftLeft, left, right, context);
+}
+
+builtin ShiftRight(implicit context: Context)(
+    left: JSAny, right: JSAny): Object {
+  return Generate_BitwiseBinaryOp(Operation::kShiftRight, left, right, context);
+}
+
+builtin ShiftRightLogical(implicit context: Context)(
+    left: JSAny, right: JSAny): Object {
+  return Generate_BitwiseBinaryOp(
+      Operation::kShiftRightLogical, left, right, context);
+}
+
+builtin BitwiseAnd(implicit context: Context)(
+    left: JSAny, right: JSAny): Object {
+  return Generate_BitwiseBinaryOp(Operation::kBitwiseAnd, left, right, context);
+}
+
+builtin BitwiseOr(implicit context: Context)(
+    left: JSAny, right: JSAny): Object {
+  return Generate_BitwiseBinaryOp(Operation::kBitwiseOr, left, right, context);
+}
+
+builtin BitwiseXor(implicit context: Context)(
+    left: JSAny, right: JSAny): Object {
+  return Generate_BitwiseBinaryOp(Operation::kBitwiseXor, left, right, context);
+}
+
+// Relational builtins.
+
+builtin LessThan(implicit context: Context)(left: JSAny, right: JSAny): Object {
+  return RelationalComparison(Operation::kLessThan, left, right, context);
+}
+
+builtin LessThanOrEqual(implicit context: Context)(
+    left: JSAny, right: JSAny): Object {
+  return RelationalComparison(
+      Operation::kLessThanOrEqual, left, right, context);
+}
+
+builtin GreaterThan(implicit context: Context)(
+    left: JSAny, right: JSAny): Object {
+  return RelationalComparison(Operation::kGreaterThan, left, right, context);
+}
+
+builtin GreaterThanOrEqual(implicit context: Context)(
+    left: JSAny, right: JSAny): Object {
+  return RelationalComparison(
+      Operation::kGreaterThanOrEqual, left, right, context);
+}
+
+builtin Equal(implicit context: Context)(left: JSAny, right: JSAny): Object {
+  return Equal(left, right, context);
+}
+
+builtin StrictEqual(implicit context: Context)(
+    left: JSAny, right: JSAny): Object {
+  return ::StrictEqual(left, right);
+}
+
+}  // namespace number
diff --git a/deps/v8/src/builtins/object-fromentries.tq b/deps/v8/src/builtins/object-fromentries.tq
index 2dbe9beacf1..32d4dea1574 100644
--- a/deps/v8/src/builtins/object-fromentries.tq
+++ b/deps/v8/src/builtins/object-fromentries.tq
@@ -4,65 +4,63 @@
 
 namespace object {
 
-  transitioning macro ObjectFromEntriesFastCase(implicit context: Context)(
-      iterable: JSAny): JSObject labels IfSlow {
-    typeswitch (iterable) {
-      case (array: FastJSArrayWithNoCustomIteration): {
-        const elements: FixedArray =
-            Cast<FixedArray>(array.elements) otherwise IfSlow;
-        const length: Smi = array.length;
-        const result: JSObject = NewJSObject();
+transitioning macro ObjectFromEntriesFastCase(implicit context: Context)(
+    iterable: JSAny): JSObject labels IfSlow {
+  typeswitch (iterable) {
+    case (array: FastJSArrayWithNoCustomIteration): {
+      const elements: FixedArray =
+          Cast<FixedArray>(array.elements) otherwise IfSlow;
+      const length: Smi = array.length;
+      const result: JSObject = NewJSObject();
 
-        for (let k: Smi = 0; k < length; ++k) {
-          const value: JSAny = array::LoadElementOrUndefined(elements, k);
-          const pair: KeyValuePair =
-              collections::LoadKeyValuePairNoSideEffects(value)
-              otherwise IfSlow;
-          // Bail out if ToPropertyKey will attempt to load and call
-          // Symbol.toPrimitive, toString, and valueOf, which could
-          // invalidate assumptions about the iterable.
-          if (Is<JSReceiver>(pair.key)) goto IfSlow;
-          FastCreateDataProperty(result, pair.key, pair.value);
-        }
-        return result;
-      }
-      case (JSAny): {
-        goto IfSlow;
+      for (let k: Smi = 0; k < length; ++k) {
+        const value: JSAny = array::LoadElementOrUndefined(elements, k);
+        const pair: KeyValuePair =
+            collections::LoadKeyValuePairNoSideEffects(value)
+            otherwise IfSlow;
+        // Bail out if ToPropertyKey will attempt to load and call
+        // Symbol.toPrimitive, toString, and valueOf, which could
+        // invalidate assumptions about the iterable.
+        if (Is<JSReceiver>(pair.key)) goto IfSlow;
+        FastCreateDataProperty(result, pair.key, pair.value);
       }
+      return result;
+    }
+    case (JSAny): {
+      goto IfSlow;
     }
   }
+}
 
-  transitioning javascript builtin
-  ObjectFromEntries(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSAny {
-    const iterable: JSAny = arguments[0];
+transitioning javascript builtin
+ObjectFromEntries(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const iterable: JSAny = arguments[0];
+  try {
+    if (IsNullOrUndefined(iterable)) goto Throw;
+    return ObjectFromEntriesFastCase(iterable) otherwise IfSlow;
+  } label IfSlow {
+    const result: JSObject = NewJSObject();
+    const fastIteratorResultMap: Map = GetIteratorResultMap();
+    let i: iterator::IteratorRecord = iterator::GetIterator(iterable);
     try {
-      if (IsNullOrUndefined(iterable)) goto Throw;
-      return ObjectFromEntriesFastCase(iterable) otherwise IfSlow;
-    }
-    label IfSlow {
-      const result: JSObject = NewJSObject();
-      const fastIteratorResultMap: Map = GetIteratorResultMap();
-      let i: iterator::IteratorRecord = iterator::GetIterator(iterable);
-      try {
-        assert(!IsNullOrUndefined(i.object));
-        while (true) {
-          const step: JSReceiver =
-              iterator::IteratorStep(i, fastIteratorResultMap)
-              otherwise return result;
-          const iteratorValue: JSAny =
-              iterator::IteratorValue(step, fastIteratorResultMap);
-          const pair: KeyValuePair =
-              collections::LoadKeyValuePair(iteratorValue);
-          FastCreateDataProperty(result, pair.key, pair.value);
-        }
-        return result;
-      } catch (e) deferred {
-        iterator::IteratorCloseOnException(i, e);
+      assert(!IsNullOrUndefined(i.object));
+      while (true) {
+        const step: JSReceiver =
+            iterator::IteratorStep(i, fastIteratorResultMap)
+            otherwise return result;
+        const iteratorValue: JSAny =
+            iterator::IteratorValue(step, fastIteratorResultMap);
+        const pair: KeyValuePair = collections::LoadKeyValuePair(iteratorValue);
+        FastCreateDataProperty(result, pair.key, pair.value);
       }
+      return result;
+    } catch (e) deferred {
+      iterator::IteratorCloseOnException(i);
+      ReThrow(context, e);
     }
-    label Throw deferred {
-      ThrowTypeError(MessageTemplate::kNotIterable);
-    }
+  } label Throw deferred {
+    ThrowTypeError(MessageTemplate::kNotIterable);
   }
+}
 }  // namespace object
diff --git a/deps/v8/src/builtins/object.tq b/deps/v8/src/builtins/object.tq
index c6d3e922797..931972024cf 100644
--- a/deps/v8/src/builtins/object.tq
+++ b/deps/v8/src/builtins/object.tq
@@ -3,179 +3,199 @@
 // found in the LICENSE file.
 
 namespace runtime {
-  extern transitioning runtime
-  ObjectIsExtensible(implicit context: Context)(JSAny): JSAny;
+extern transitioning runtime
+ObjectIsExtensible(implicit context: Context)(JSAny): JSAny;
 
-  extern transitioning runtime
-  JSReceiverPreventExtensionsThrow(implicit context: Context)(JSReceiver):
-      JSAny;
+extern transitioning runtime
+JSReceiverPreventExtensionsThrow(implicit context: Context)(JSReceiver): JSAny;
 
-  extern transitioning runtime
-  JSReceiverPreventExtensionsDontThrow(implicit context: Context)(JSReceiver):
-      JSAny;
+extern transitioning runtime
+JSReceiverPreventExtensionsDontThrow(implicit context: Context)(JSReceiver):
+    JSAny;
 
-  extern transitioning runtime
-  JSReceiverGetPrototypeOf(implicit context: Context)(JSReceiver): JSAny;
+extern transitioning runtime
+JSReceiverGetPrototypeOf(implicit context: Context)(JSReceiver): JSAny;
 
-  extern transitioning runtime
-  JSReceiverSetPrototypeOfThrow(implicit context: Context)(JSReceiver, JSAny):
-      JSAny;
+extern transitioning runtime
+JSReceiverSetPrototypeOfThrow(implicit context: Context)(
+    JSReceiver, JSAny): JSAny;
 
-  extern transitioning runtime
-  JSReceiverSetPrototypeOfDontThrow(implicit context:
-                                        Context)(JSReceiver, JSAny): JSAny;
+extern transitioning runtime
+JSReceiverSetPrototypeOfDontThrow(implicit context: Context)(
+    JSReceiver, JSAny): JSAny;
 
-  extern transitioning runtime ObjectCreate(implicit context:
-                                                Context)(JSAny, JSAny): JSAny;
+extern transitioning runtime ObjectCreate(implicit context: Context)(
+    JSAny, JSAny): JSAny;
 }  // namespace runtime
 
 namespace object {
-  transitioning macro
-  ObjectIsExtensibleImpl(implicit context: Context)(object: JSAny): JSAny {
-    const objectJSReceiver = Cast<JSReceiver>(object) otherwise return False;
-    const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
-        otherwise return runtime::ObjectIsExtensible(objectJSReceiver);
-    return proxy::ProxyIsExtensible(objectJSProxy);
-  }
-
-  transitioning macro
-  ObjectPreventExtensionsThrow(implicit context: Context)(object: JSAny):
-      JSAny {
-    const objectJSReceiver = Cast<JSReceiver>(object) otherwise return object;
-    const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
-        otherwise return runtime::JSReceiverPreventExtensionsThrow(
-        objectJSReceiver);
-    proxy::ProxyPreventExtensions(objectJSProxy, True);
-    return objectJSReceiver;
-  }
-
-  transitioning macro
-  ObjectPreventExtensionsDontThrow(implicit context: Context)(object: JSAny):
-      JSAny {
-    const objectJSReceiver = Cast<JSReceiver>(object) otherwise return False;
-    const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
-        otherwise return runtime::JSReceiverPreventExtensionsDontThrow(
-        objectJSReceiver);
-    return proxy::ProxyPreventExtensions(objectJSProxy, False);
-  }
-
-  transitioning macro
-  ObjectGetPrototypeOfImpl(implicit context: Context)(object: JSAny): JSAny {
-    const objectJSReceiver: JSReceiver = ToObject_Inline(context, object);
-    return object::JSReceiverGetPrototypeOf(objectJSReceiver);
-  }
-
-  transitioning macro
-  JSReceiverGetPrototypeOf(implicit context: Context)(object: JSReceiver):
-      JSAny {
-    const objectJSProxy = Cast<JSProxy>(object)
-        otherwise return runtime::JSReceiverGetPrototypeOf(object);
-    return proxy::ProxyGetPrototypeOf(objectJSProxy);
-  }
-
-  transitioning macro
-  ObjectSetPrototypeOfThrow(implicit context: Context)(
-      object: JSAny, proto: JSReceiver|Null): JSAny {
-    const objectJSReceiver = Cast<JSReceiver>(object) otherwise return object;
-    const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
-        otherwise return runtime::JSReceiverSetPrototypeOfThrow(
-        objectJSReceiver, proto);
-    proxy::ProxySetPrototypeOf(objectJSProxy, proto, True);
-    return objectJSReceiver;
-  }
-
-  transitioning macro
-  ObjectSetPrototypeOfDontThrow(implicit context: Context)(
-      object: JSAny, proto: JSReceiver|Null): JSAny {
-    const objectJSReceiver = Cast<JSReceiver>(object) otherwise return False;
-    const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
-        otherwise return runtime::JSReceiverSetPrototypeOfDontThrow(
-        objectJSReceiver, proto);
-    return proxy::ProxySetPrototypeOf(objectJSProxy, proto, False);
-  }
-
-  transitioning builtin CreateObjectWithoutProperties(
-      implicit context: Context)(prototype: JSAny): JSAny {
-    const nativeContext = LoadNativeContext(context);
-
-    try {
-      let map: Map;
-      let properties: NameDictionary|EmptyFixedArray;
-      typeswitch (prototype) {
-        case (Null): {
-          map = UnsafeCast<Map>(
-              nativeContext
-                  [NativeContextSlot::SLOW_OBJECT_WITH_NULL_PROTOTYPE_MAP]);
-          properties = AllocateNameDictionary(kNameDictionaryInitialCapacity);
-        }
-        case (prototype: JSReceiver): {
-          properties = kEmptyFixedArray;
-          const objectFunction = UnsafeCast<JSFunction>(
-              nativeContext[NativeContextSlot::OBJECT_FUNCTION_INDEX]);
-          map = UnsafeCast<Map>(objectFunction.prototype_or_initial_map);
-          if (prototype != map.prototype) {
-            const prototypeInfo =
-                prototype.map.PrototypeInfo() otherwise Runtime;
-            typeswitch (prototypeInfo.object_create_map) {
-              case (Undefined): {
-                goto Runtime;
-              }
-              case (weak_map: Weak<Map>): {
-                map = WeakToStrong(weak_map) otherwise Runtime;
-              }
+transitioning macro
+ObjectIsExtensibleImpl(implicit context: Context)(object: JSAny): JSAny {
+  const objectJSReceiver = Cast<JSReceiver>(object) otherwise return False;
+  const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
+      otherwise return runtime::ObjectIsExtensible(objectJSReceiver);
+  return proxy::ProxyIsExtensible(objectJSProxy);
+}
+
+transitioning macro
+ObjectPreventExtensionsThrow(implicit context: Context)(object: JSAny): JSAny {
+  const objectJSReceiver = Cast<JSReceiver>(object) otherwise return object;
+  const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
+      otherwise return runtime::JSReceiverPreventExtensionsThrow(objectJSReceiver);
+  proxy::ProxyPreventExtensions(objectJSProxy, True);
+  return objectJSReceiver;
+}
+
+transitioning macro
+ObjectPreventExtensionsDontThrow(implicit context: Context)(object: JSAny):
+    JSAny {
+  const objectJSReceiver = Cast<JSReceiver>(object) otherwise return False;
+  const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
+      otherwise return runtime::JSReceiverPreventExtensionsDontThrow(
+      objectJSReceiver);
+  return proxy::ProxyPreventExtensions(objectJSProxy, False);
+}
+
+transitioning macro
+ObjectGetPrototypeOfImpl(implicit context: Context)(object: JSAny): JSAny {
+  const objectJSReceiver: JSReceiver = ToObject_Inline(context, object);
+  return object::JSReceiverGetPrototypeOf(objectJSReceiver);
+}
+
+transitioning macro
+JSReceiverGetPrototypeOf(implicit context: Context)(object: JSReceiver): JSAny {
+  const objectJSProxy = Cast<JSProxy>(object)
+      otherwise return runtime::JSReceiverGetPrototypeOf(object);
+  return proxy::ProxyGetPrototypeOf(objectJSProxy);
+}
+
+transitioning macro
+ObjectSetPrototypeOfThrow(implicit context: Context)(
+    object: JSAny, proto: JSReceiver|Null): JSAny {
+  const objectJSReceiver = Cast<JSReceiver>(object) otherwise return object;
+  const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
+      otherwise return runtime::JSReceiverSetPrototypeOfThrow(
+      objectJSReceiver, proto);
+  proxy::ProxySetPrototypeOf(objectJSProxy, proto, True);
+  return objectJSReceiver;
+}
+
+transitioning macro
+ObjectSetPrototypeOfDontThrow(implicit context: Context)(
+    object: JSAny, proto: JSReceiver|Null): JSAny {
+  const objectJSReceiver = Cast<JSReceiver>(object) otherwise return False;
+  const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
+      otherwise return runtime::JSReceiverSetPrototypeOfDontThrow(
+      objectJSReceiver, proto);
+  return proxy::ProxySetPrototypeOf(objectJSProxy, proto, False);
+}
+
+transitioning builtin CreateObjectWithoutProperties(implicit context: Context)(
+    prototype: JSAny): JSAny {
+  const nativeContext = LoadNativeContext(context);
+
+  try {
+    let map: Map;
+    let properties: NameDictionary|EmptyFixedArray;
+    typeswitch (prototype) {
+      case (Null): {
+        map = UnsafeCast<Map>(
+            nativeContext
+                [NativeContextSlot::SLOW_OBJECT_WITH_NULL_PROTOTYPE_MAP]);
+        properties = AllocateNameDictionary(kNameDictionaryInitialCapacity);
+      }
+      case (prototype: JSReceiver): {
+        properties = kEmptyFixedArray;
+        const objectFunction = UnsafeCast<JSFunction>(
+            nativeContext[NativeContextSlot::OBJECT_FUNCTION_INDEX]);
+        map = UnsafeCast<Map>(objectFunction.prototype_or_initial_map);
+        if (prototype != map.prototype) {
+          const prototypeInfo = prototype.map.PrototypeInfo() otherwise Runtime;
+          typeswitch (prototypeInfo.object_create_map) {
+            case (Undefined): {
+              goto Runtime;
+            }
+            case (weak_map: Weak<Map>): {
+              map = WeakToStrong(weak_map) otherwise Runtime;
             }
           }
         }
-        case (JSAny): {
-          goto Runtime;
-        }
-      }
-      return AllocateJSObjectFromMap(map, properties);
-    }
-    label Runtime deferred {
-      return runtime::ObjectCreate(prototype, Undefined);
-    }
-  }
-
-  // ES6 section 19.1.2.11 Object.isExtensible ( O )
-  transitioning javascript builtin
-  ObjectIsExtensible(js-implicit context: NativeContext)(object: JSAny): JSAny {
-    return object::ObjectIsExtensibleImpl(object);
-  }
-
-  // ES6 section 19.1.2.18 Object.preventExtensions ( O )
-  transitioning javascript builtin
-  ObjectPreventExtensions(js-implicit context: NativeContext)(object: JSAny):
-      JSAny {
-    return object::ObjectPreventExtensionsThrow(object);
-  }
-
-  // ES6 section 19.1.2.9 Object.getPrototypeOf ( O )
-  transitioning javascript builtin
-  ObjectGetPrototypeOf(js-implicit context: NativeContext)(object: JSAny):
-      JSAny {
-    return object::ObjectGetPrototypeOfImpl(object);
-  }
-
-  // ES6 section 19.1.2.21 Object.setPrototypeOf ( O, proto )
-  transitioning javascript builtin ObjectSetPrototypeOf(
-      js-implicit context: NativeContext)(object: JSAny, proto: JSAny): JSAny {
-    // 1. Set O to ? RequireObjectCoercible(O).
-    RequireObjectCoercible(object, 'Object.setPrototypeOf');
-
-    // 2. If Type(proto) is neither Object nor Null, throw a TypeError
-    // exception.
-    // 3. If Type(O) is not Object, return O.
-    // 4. Let status be ? O.[[SetPrototypeOf]](proto).
-    // 5. If status is false, throw a TypeError exception.
-    // 6. Return O.
-    typeswitch (proto) {
-      case (proto: JSReceiver|Null): {
-        return object::ObjectSetPrototypeOfThrow(object, proto);
       }
       case (JSAny): {
-        ThrowTypeError(MessageTemplate::kProtoObjectOrNull, proto);
+        goto Runtime;
       }
     }
+    return AllocateJSObjectFromMap(map, properties);
+  } label Runtime deferred {
+    return runtime::ObjectCreate(prototype, Undefined);
   }
+}
+
+// ES6 section 19.1.2.11 Object.isExtensible ( O )
+transitioning javascript builtin
+ObjectIsExtensible(js-implicit context: NativeContext)(object: JSAny): JSAny {
+  return object::ObjectIsExtensibleImpl(object);
+}
+
+// ES6 section 19.1.2.18 Object.preventExtensions ( O )
+transitioning javascript builtin
+ObjectPreventExtensions(js-implicit context: NativeContext)(object: JSAny):
+    JSAny {
+  return object::ObjectPreventExtensionsThrow(object);
+}
+
+// ES6 section 19.1.2.9 Object.getPrototypeOf ( O )
+transitioning javascript builtin
+ObjectGetPrototypeOf(js-implicit context: NativeContext)(object: JSAny): JSAny {
+  return object::ObjectGetPrototypeOfImpl(object);
+}
+
+// ES6 section 19.1.2.21 Object.setPrototypeOf ( O, proto )
+transitioning javascript builtin ObjectSetPrototypeOf(
+    js-implicit context: NativeContext)(object: JSAny, proto: JSAny): JSAny {
+  // 1. Set O to ? RequireObjectCoercible(O).
+  RequireObjectCoercible(object, 'Object.setPrototypeOf');
+
+  // 2. If Type(proto) is neither Object nor Null, throw a TypeError
+  // exception.
+  // 3. If Type(O) is not Object, return O.
+  // 4. Let status be ? O.[[SetPrototypeOf]](proto).
+  // 5. If status is false, throw a TypeError exception.
+  // 6. Return O.
+  typeswitch (proto) {
+    case (proto: JSReceiver|Null): {
+      return object::ObjectSetPrototypeOfThrow(object, proto);
+    }
+    case (JSAny): {
+      ThrowTypeError(MessageTemplate::kProtoObjectOrNull, proto);
+    }
+  }
+}
+
+// ES #sec-object.prototype.tostring
+transitioning javascript builtin ObjectPrototypeToString(
+    js-implicit context: Context, receiver: JSAny)(): String {
+  return ObjectToString(context, receiver);
+}
+
+// ES #sec-object.prototype.valueof
+transitioning javascript builtin ObjectPrototypeValueOf(
+    js-implicit context: Context, receiver: JSAny)(): JSReceiver {
+  // 1. Return ? ToObject(this value).
+  return ToObject_Inline(context, receiver);
+}
+
+// ES #sec-object.prototype.tolocalestring
+transitioning javascript builtin ObjectPrototypeToLocaleString(
+    js-implicit context: Context, receiver: JSAny)(): JSAny {
+  // 1. Let O be the this value.
+  // 2. Return ? Invoke(O, "toString").
+  if (receiver == Null || receiver == Undefined) deferred {
+      ThrowTypeError(
+          MessageTemplate::kCalledOnNullOrUndefined,
+          'Object.prototype.toLocaleString');
+    }
+  const method = GetProperty(receiver, 'toString');
+  return Call(context, method, receiver);
+}
 }  // namespace object
diff --git a/deps/v8/src/builtins/ppc/builtins-ppc.cc b/deps/v8/src/builtins/ppc/builtins-ppc.cc
index 460d7492970..367838f82cc 100644
--- a/deps/v8/src/builtins/ppc/builtins-ppc.cc
+++ b/deps/v8/src/builtins/ppc/builtins-ppc.cc
@@ -87,7 +87,7 @@ void Generate_StackOverflowCheck(MacroAssembler* masm, Register num_args,
   // here which will cause scratch to become negative.
   __ sub(scratch, sp, scratch);
   // Check if the arguments will overflow the stack.
-  __ ShiftLeftImm(r0, num_args, Operand(kPointerSizeLog2));
+  __ ShiftLeftImm(r0, num_args, Operand(kSystemPointerSizeLog2));
   __ cmp(scratch, r0);
   __ ble(stack_overflow);  // Signed comparison.
 }
@@ -130,16 +130,16 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     //  --                 r6: new target
     //  --                 r7: pointer to last argument
     //  --                 cr0: condition indicating whether r3 is zero
-    //  -- sp[0*kPointerSize]: the hole (receiver)
-    //  -- sp[1*kPointerSize]: number of arguments (tagged)
-    //  -- sp[2*kPointerSize]: context
+    //  -- sp[0*kSystemPointerSize]: the hole (receiver)
+    //  -- sp[1*kSystemPointerSize]: number of arguments (tagged)
+    //  -- sp[2*kSystemPointerSize]: context
     // -----------------------------------
     __ beq(&no_args, cr0);
-    __ ShiftLeftImm(scratch, r3, Operand(kPointerSizeLog2));
+    __ ShiftLeftImm(scratch, r3, Operand(kSystemPointerSizeLog2));
     __ sub(sp, sp, scratch);
     __ mtctr(r3);
     __ bind(&loop);
-    __ subi(scratch, scratch, Operand(kPointerSize));
+    __ subi(scratch, scratch, Operand(kSystemPointerSize));
     __ LoadPX(r0, MemOperand(r7, scratch));
     __ StorePX(r0, MemOperand(sp, scratch));
     __ bdnz(&loop);
@@ -166,7 +166,7 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
 
   __ SmiToPtrArrayOffset(r4, r4);
   __ add(sp, sp, r4);
-  __ addi(sp, sp, Operand(kPointerSize));
+  __ addi(sp, sp, Operand(kSystemPointerSize));
   __ blr();
 
   __ bind(&stack_overflow);
@@ -202,14 +202,15 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
     __ Push(r6);
 
     // ----------- S t a t e -------------
-    //  --        sp[0*kPointerSize]: new target
-    //  --        sp[1*kPointerSize]: padding
-    //  -- r4 and sp[2*kPointerSize]: constructor function
-    //  --        sp[3*kPointerSize]: number of arguments (tagged)
-    //  --        sp[4*kPointerSize]: context
+    //  --        sp[0*kSystemPointerSize]: new target
+    //  --        sp[1*kSystemPointerSize]: padding
+    //  -- r4 and sp[2*kSystemPointerSize]: constructor function
+    //  --        sp[3*kSystemPointerSize]: number of arguments (tagged)
+    //  --        sp[4*kSystemPointerSize]: context
     // -----------------------------------
 
-    __ LoadP(r7, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
+    __ LoadTaggedPointerField(
+        r7, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
     __ lwz(r7, FieldMemOperand(r7, SharedFunctionInfo::kFlagsOffset));
     __ DecodeField<SharedFunctionInfo::FunctionKindBits>(r7);
     __ JumpIfIsInRange(r7, kDefaultDerivedConstructor, kDerivedConstructor,
@@ -228,11 +229,11 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
 
     // ----------- S t a t e -------------
     //  --                          r3: receiver
-    //  -- Slot 4 / sp[0*kPointerSize]: new target
-    //  -- Slot 3 / sp[1*kPointerSize]: padding
-    //  -- Slot 2 / sp[2*kPointerSize]: constructor function
-    //  -- Slot 1 / sp[3*kPointerSize]: number of arguments (tagged)
-    //  -- Slot 0 / sp[4*kPointerSize]: context
+    //  -- Slot 4 / sp[0*kSystemPointerSize]: new target
+    //  -- Slot 3 / sp[1*kSystemPointerSize]: padding
+    //  -- Slot 2 / sp[2*kSystemPointerSize]: constructor function
+    //  -- Slot 1 / sp[3*kSystemPointerSize]: number of arguments (tagged)
+    //  -- Slot 0 / sp[4*kSystemPointerSize]: context
     // -----------------------------------
     // Deoptimizer enters here.
     masm->isolate()->heap()->SetConstructStubCreateDeoptPCOffset(
@@ -248,12 +249,12 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
 
     // ----------- S t a t e -------------
     //  --                 r6: new target
-    //  -- sp[0*kPointerSize]: implicit receiver
-    //  -- sp[1*kPointerSize]: implicit receiver
-    //  -- sp[2*kPointerSize]: padding
-    //  -- sp[3*kPointerSize]: constructor function
-    //  -- sp[4*kPointerSize]: number of arguments (tagged)
-    //  -- sp[5*kPointerSize]: context
+    //  -- sp[0*kSystemPointerSize]: implicit receiver
+    //  -- sp[1*kSystemPointerSize]: implicit receiver
+    //  -- sp[2*kSystemPointerSize]: padding
+    //  -- sp[3*kSystemPointerSize]: constructor function
+    //  -- sp[4*kSystemPointerSize]: number of arguments (tagged)
+    //  -- sp[5*kSystemPointerSize]: context
     // -----------------------------------
 
     // Restore constructor function and argument count.
@@ -284,20 +285,20 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
     //  --                        r6: new target
     //  --                        r7: pointer to last argument
     //  --                        cr0: condition indicating whether r3 is zero
-    //  --        sp[0*kPointerSize]: implicit receiver
-    //  --        sp[1*kPointerSize]: implicit receiver
-    //  --        sp[2*kPointerSize]: padding
-    //  -- r4 and sp[3*kPointerSize]: constructor function
-    //  --        sp[4*kPointerSize]: number of arguments (tagged)
-    //  --        sp[5*kPointerSize]: context
+    //  --        sp[0*kSystemPointerSize]: implicit receiver
+    //  --        sp[1*kSystemPointerSize]: implicit receiver
+    //  --        sp[2*kSystemPointerSize]: padding
+    //  -- r4 and sp[3*kSystemPointerSize]: constructor function
+    //  --        sp[4*kSystemPointerSize]: number of arguments (tagged)
+    //  --        sp[5*kSystemPointerSize]: context
     // -----------------------------------
     __ cmpi(r3, Operand::Zero());
     __ beq(&no_args);
-    __ ShiftLeftImm(r9, r3, Operand(kPointerSizeLog2));
+    __ ShiftLeftImm(r9, r3, Operand(kSystemPointerSizeLog2));
     __ sub(sp, sp, r9);
     __ mtctr(r3);
     __ bind(&loop);
-    __ subi(r9, r9, Operand(kPointerSize));
+    __ subi(r9, r9, Operand(kSystemPointerSize));
     __ LoadPX(r0, MemOperand(r7, r9));
     __ StorePX(r0, MemOperand(sp, r9));
     __ bdnz(&loop);
@@ -311,11 +312,11 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
 
     // ----------- S t a t e -------------
     //  --                 r0: constructor result
-    //  -- sp[0*kPointerSize]: implicit receiver
-    //  -- sp[1*kPointerSize]: padding
-    //  -- sp[2*kPointerSize]: constructor function
-    //  -- sp[3*kPointerSize]: number of arguments
-    //  -- sp[4*kPointerSize]: context
+    //  -- sp[0*kSystemPointerSize]: implicit receiver
+    //  -- sp[1*kSystemPointerSize]: padding
+    //  -- sp[2*kSystemPointerSize]: constructor function
+    //  -- sp[3*kSystemPointerSize]: number of arguments
+    //  -- sp[4*kSystemPointerSize]: context
     // -----------------------------------
 
     // Store offset of return address for deoptimizer.
@@ -366,7 +367,7 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
 
   __ SmiToPtrArrayOffset(r4, r4);
   __ add(sp, sp, r4);
-  __ addi(sp, sp, Operand(kPointerSize));
+  __ addi(sp, sp, Operand(kSystemPointerSize));
   __ blr();
 }
 
@@ -381,8 +382,9 @@ static void GetSharedFunctionInfoBytecode(MacroAssembler* masm,
 
   __ CompareObjectType(sfi_data, scratch1, scratch1, INTERPRETER_DATA_TYPE);
   __ bne(&done);
-  __ LoadP(sfi_data,
-           FieldMemOperand(sfi_data, InterpreterData::kBytecodeArrayOffset));
+  __ LoadTaggedPointerField(
+      sfi_data,
+      FieldMemOperand(sfi_data, InterpreterData::kBytecodeArrayOffset));
   __ bind(&done);
 }
 
@@ -396,14 +398,16 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   __ AssertGeneratorObject(r4);
 
   // Store input value into generator object.
-  __ StoreP(r3, FieldMemOperand(r4, JSGeneratorObject::kInputOrDebugPosOffset),
-            r0);
+  __ StoreTaggedField(
+      r3, FieldMemOperand(r4, JSGeneratorObject::kInputOrDebugPosOffset), r0);
   __ RecordWriteField(r4, JSGeneratorObject::kInputOrDebugPosOffset, r3, r6,
                       kLRHasNotBeenSaved, kDontSaveFPRegs);
 
   // Load suspended function and context.
-  __ LoadP(r7, FieldMemOperand(r4, JSGeneratorObject::kFunctionOffset));
-  __ LoadP(cp, FieldMemOperand(r7, JSFunction::kContextOffset));
+  __ LoadTaggedPointerField(
+      r7, FieldMemOperand(r4, JSGeneratorObject::kFunctionOffset));
+  __ LoadTaggedPointerField(cp,
+                            FieldMemOperand(r7, JSFunction::kContextOffset));
 
   // Flood function if we are stepping.
   Label prepare_step_in_if_stepping, prepare_step_in_suspended_generator;
@@ -436,7 +440,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   __ blt(&stack_overflow);
 
   // Push receiver.
-  __ LoadP(scratch, FieldMemOperand(r4, JSGeneratorObject::kReceiverOffset));
+  __ LoadTaggedPointerField(
+      scratch, FieldMemOperand(r4, JSGeneratorObject::kReceiverOffset));
   __ Push(scratch);
 
   // ----------- S t a t e -------------
@@ -448,23 +453,26 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   // -----------------------------------
 
   // Copy the function arguments from the generator object's register file.
-  __ LoadP(r6, FieldMemOperand(r7, JSFunction::kSharedFunctionInfoOffset));
+  __ LoadTaggedPointerField(
+      r6, FieldMemOperand(r7, JSFunction::kSharedFunctionInfoOffset));
   __ LoadHalfWord(
       r6, FieldMemOperand(r6, SharedFunctionInfo::kFormalParameterCountOffset));
-  __ LoadP(r5, FieldMemOperand(
-                   r4, JSGeneratorObject::kParametersAndRegistersOffset));
+  __ LoadTaggedPointerField(
+      r5,
+      FieldMemOperand(r4, JSGeneratorObject::kParametersAndRegistersOffset));
   {
     Label loop, done_loop;
     __ cmpi(r6, Operand::Zero());
     __ ble(&done_loop);
 
-    // setup r9 to first element address - kPointerSize
+    // setup r9 to first element address - kTaggedSize
     __ addi(r9, r5,
-            Operand(FixedArray::kHeaderSize - kHeapObjectTag - kPointerSize));
+            Operand(FixedArray::kHeaderSize - kHeapObjectTag - kTaggedSize));
 
     __ mtctr(r6);
     __ bind(&loop);
-    __ LoadPU(scratch, MemOperand(r9, kPointerSize));
+    __ LoadAnyTaggedField(scratch, MemOperand(r9, kTaggedSize));
+    __ addi(r9, r9, Operand(kTaggedSize));
     __ push(scratch);
     __ bdnz(&loop);
 
@@ -473,8 +481,10 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
 
   // Underlying function needs to have bytecode available.
   if (FLAG_debug_code) {
-    __ LoadP(r6, FieldMemOperand(r7, JSFunction::kSharedFunctionInfoOffset));
-    __ LoadP(r6, FieldMemOperand(r6, SharedFunctionInfo::kFunctionDataOffset));
+    __ LoadTaggedPointerField(
+        r6, FieldMemOperand(r7, JSFunction::kSharedFunctionInfoOffset));
+    __ LoadTaggedPointerField(
+        r6, FieldMemOperand(r6, SharedFunctionInfo::kFunctionDataOffset));
     GetSharedFunctionInfoBytecode(masm, r6, r3);
     __ CompareObjectType(r6, r6, r6, BYTECODE_ARRAY_TYPE);
     __ Assert(eq, AbortReason::kMissingBytecodeArray);
@@ -488,7 +498,7 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
     __ mr(r6, r4);
     __ mr(r4, r7);
     static_assert(kJavaScriptCallCodeStartRegister == r5, "ABI mismatch");
-    __ LoadP(r5, FieldMemOperand(r4, JSFunction::kCodeOffset));
+    __ LoadTaggedPointerField(r5, FieldMemOperand(r4, JSFunction::kCodeOffset));
     __ JumpCodeObject(r5);
   }
 
@@ -500,7 +510,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
     __ PushRoot(RootIndex::kTheHoleValue);
     __ CallRuntime(Runtime::kDebugOnFunctionCall);
     __ Pop(r4);
-    __ LoadP(r7, FieldMemOperand(r4, JSGeneratorObject::kFunctionOffset));
+    __ LoadTaggedPointerField(
+        r7, FieldMemOperand(r4, JSGeneratorObject::kFunctionOffset));
   }
   __ b(&stepping_prepared);
 
@@ -510,7 +521,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
     __ Push(r4);
     __ CallRuntime(Runtime::kDebugPrepareStepInSuspendedGenerator);
     __ Pop(r4);
-    __ LoadP(r7, FieldMemOperand(r4, JSGeneratorObject::kFunctionOffset));
+    __ LoadTaggedPointerField(
+        r7, FieldMemOperand(r4, JSGeneratorObject::kFunctionOffset));
   }
   __ b(&stepping_prepared);
 
@@ -560,7 +572,7 @@ void Generate_JSEntryVariant(MacroAssembler* masm, StackFrame::Type type,
     // PPC LINUX ABI:
     // preserve LR in pre-reserved slot in caller's frame
     __ mflr(r0);
-    __ StoreP(r0, MemOperand(sp, kStackFrameLRSlot * kPointerSize));
+    __ StoreP(r0, MemOperand(sp, kStackFrameLRSlot * kSystemPointerSize));
 
     // Save callee saved registers on the stack.
     __ MultiPush(kCalleeSaved);
@@ -695,7 +707,7 @@ void Generate_JSEntryVariant(MacroAssembler* masm, StackFrame::Type type,
   __ MultiPop(kCalleeSaved);
 
   // Return
-  __ LoadP(r0, MemOperand(sp, kStackFrameLRSlot * kPointerSize));
+  __ LoadP(r0, MemOperand(sp, kStackFrameLRSlot * kSystemPointerSize));
   __ mtlr(r0);
   __ blr();
 }
@@ -729,7 +741,7 @@ static void Generate_CheckStackOverflow(MacroAssembler* masm, Register argc,
   // here which will cause scratch1 to become negative.
   __ sub(scratch1, sp, scratch1);
   // Check if the arguments will overflow the stack.
-  __ ShiftLeftImm(scratch2, argc, Operand(kPointerSizeLog2));
+  __ ShiftLeftImm(scratch2, argc, Operand(kSystemPointerSizeLog2));
   __ cmp(scratch1, scratch2);
   __ bgt(&okay);  // Signed comparison.
 
@@ -787,13 +799,13 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     // r3: argc
     // r8: argv, i.e. points to first arg
     Label loop, entry;
-    __ ShiftLeftImm(r0, r3, Operand(kPointerSizeLog2));
+    __ ShiftLeftImm(r0, r3, Operand(kSystemPointerSizeLog2));
     __ add(r5, r8, r0);
     // r5 points past last arg.
     __ b(&entry);
     __ bind(&loop);
     __ LoadP(r9, MemOperand(r8));  // read next parameter
-    __ addi(r8, r8, Operand(kPointerSize));
+    __ addi(r8, r8, Operand(kSystemPointerSize));
     __ LoadP(r0, MemOperand(r9));  // dereference handle
     __ push(r0);                   // push parameter
     __ bind(&entry);
@@ -851,8 +863,8 @@ static void ReplaceClosureCodeWithOptimizedCode(MacroAssembler* masm,
                                                 Register scratch1,
                                                 Register scratch2) {
   // Store code entry in the closure.
-  __ StoreP(optimized_code, FieldMemOperand(closure, JSFunction::kCodeOffset),
-            r0);
+  __ StoreTaggedField(optimized_code,
+                      FieldMemOperand(closure, JSFunction::kCodeOffset), r0);
   __ mr(scratch1, optimized_code);  // Write barrier clobbers scratch1 below.
   __ RecordWriteField(closure, JSFunction::kCodeOffset, scratch1, scratch2,
                       kLRHasNotBeenSaved, kDontSaveFPRegs, OMIT_REMEMBERED_SET,
@@ -900,8 +912,9 @@ static void TailCallOptimizedCodeSlot(MacroAssembler* masm,
   // Check if the optimized code is marked for deopt. If it is, call the
   // runtime to clear it.
   Label found_deoptimized_code;
-  __ LoadP(scratch, FieldMemOperand(optimized_code_entry,
-                                    Code::kCodeDataContainerOffset));
+  __ LoadTaggedPointerField(
+      scratch,
+      FieldMemOperand(optimized_code_entry, Code::kCodeDataContainerOffset));
   __ LoadWordArith(
       scratch,
       FieldMemOperand(scratch, CodeDataContainer::kKindSpecificFlagsOffset));
@@ -1057,10 +1070,12 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
 
   // Get the bytecode array from the function object and load it into
   // kInterpreterBytecodeArrayRegister.
-  __ LoadP(r3, FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
+  __ LoadTaggedPointerField(
+      r3, FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
   // Load original bytecode array or the debug copy.
-  __ LoadP(kInterpreterBytecodeArrayRegister,
-           FieldMemOperand(r3, SharedFunctionInfo::kFunctionDataOffset));
+  __ LoadTaggedPointerField(
+      kInterpreterBytecodeArrayRegister,
+      FieldMemOperand(r3, SharedFunctionInfo::kFunctionDataOffset));
   GetSharedFunctionInfoBytecode(masm, kInterpreterBytecodeArrayRegister, r7);
 
   // The bytecode array could have been flushed from the shared function info,
@@ -1071,15 +1086,17 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   __ bne(&compile_lazy);
 
   // Load the feedback vector from the closure.
-  __ LoadP(feedback_vector,
-           FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
-  __ LoadP(feedback_vector,
-           FieldMemOperand(feedback_vector, Cell::kValueOffset));
+  __ LoadTaggedPointerField(
+      feedback_vector,
+      FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
+  __ LoadTaggedPointerField(
+      feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
 
   Label push_stack_frame;
   // Check if feedback vector is valid. If valid, check for optimized code
   // and update invocation count. Otherwise, setup the stack frame.
-  __ LoadP(r7, FieldMemOperand(feedback_vector, HeapObject::kMapOffset));
+  __ LoadTaggedPointerField(
+      r7, FieldMemOperand(feedback_vector, HeapObject::kMapOffset));
   __ LoadHalfWord(r7, FieldMemOperand(r7, Map::kInstanceTypeOffset));
   __ cmpi(r7, Operand(FEEDBACK_VECTOR_TYPE));
   __ bne(&push_stack_frame);
@@ -1087,9 +1104,10 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   Register optimized_code_entry = r7;
 
   // Read off the optimized code slot in the feedback vector.
-  __ LoadP(optimized_code_entry,
-           FieldMemOperand(feedback_vector,
-                           FeedbackVector::kOptimizedCodeWeakOrSmiOffset));
+  __ LoadAnyTaggedField(
+      optimized_code_entry,
+      FieldMemOperand(feedback_vector,
+                      FeedbackVector::kOptimizedCodeWeakOrSmiOffset));
   // Check if the optimized code slot is not empty.
   Label optimized_code_slot_not_empty;
   __ CmpSmiLiteral(optimized_code_entry,
@@ -1156,7 +1174,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
     // TODO(rmcilroy): Consider doing more than one push per loop iteration.
     Label loop, no_args;
     __ LoadRoot(kInterpreterAccumulatorRegister, RootIndex::kUndefinedValue);
-    __ ShiftRightImm(r5, r5, Operand(kPointerSizeLog2), SetRC);
+    __ ShiftRightImm(r5, r5, Operand(kSystemPointerSizeLog2), SetRC);
     __ beq(&no_args, cr0);
     __ mtctr(r5);
     __ bind(&loop);
@@ -1174,7 +1192,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
               BytecodeArray::kIncomingNewTargetOrGeneratorRegisterOffset));
   __ cmpi(r8, Operand::Zero());
   __ beq(&no_incoming_new_target_or_generator_register);
-  __ ShiftLeftImm(r8, r8, Operand(kPointerSizeLog2));
+  __ ShiftLeftImm(r8, r8, Operand(kSystemPointerSizeLog2));
   __ StorePX(r6, MemOperand(fp, r8));
   __ bind(&no_incoming_new_target_or_generator_register);
 
@@ -1197,7 +1215,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
       ExternalReference::interpreter_dispatch_table_address(masm->isolate()));
   __ lbzx(r6, MemOperand(kInterpreterBytecodeArrayRegister,
                          kInterpreterBytecodeOffsetRegister));
-  __ ShiftLeftImm(r6, r6, Operand(kPointerSizeLog2));
+  __ ShiftLeftImm(r6, r6, Operand(kSystemPointerSizeLog2));
   __ LoadPX(kJavaScriptCallCodeStartRegister,
             MemOperand(kInterpreterDispatchTableRegister, r6));
   __ Call(kJavaScriptCallCodeStartRegister);
@@ -1282,10 +1300,10 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
   Label loop, skip;
   __ cmpi(count, Operand::Zero());
   __ beq(&skip);
-  __ addi(index, index, Operand(kPointerSize));  // Bias up for LoadPU
+  __ addi(index, index, Operand(kSystemPointerSize));  // Bias up for LoadPU
   __ mtctr(count);
   __ bind(&loop);
-  __ LoadPU(scratch, MemOperand(index, -kPointerSize));
+  __ LoadPU(scratch, MemOperand(index, -kSystemPointerSize));
   __ push(scratch);
   __ bdnz(&loop);
   __ bind(&skip);
@@ -1409,15 +1427,17 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   // get the custom trampoline, otherwise grab the entry address of the global
   // trampoline.
   __ LoadP(r5, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
-  __ LoadP(r5, FieldMemOperand(r5, JSFunction::kSharedFunctionInfoOffset));
-  __ LoadP(r5, FieldMemOperand(r5, SharedFunctionInfo::kFunctionDataOffset));
+  __ LoadTaggedPointerField(
+      r5, FieldMemOperand(r5, JSFunction::kSharedFunctionInfoOffset));
+  __ LoadTaggedPointerField(
+      r5, FieldMemOperand(r5, SharedFunctionInfo::kFunctionDataOffset));
   __ CompareObjectType(r5, kInterpreterDispatchTableRegister,
                        kInterpreterDispatchTableRegister,
                        INTERPRETER_DATA_TYPE);
   __ bne(&builtin_trampoline);
 
-  __ LoadP(r5,
-           FieldMemOperand(r5, InterpreterData::kInterpreterTrampolineOffset));
+  __ LoadTaggedPointerField(
+      r5, FieldMemOperand(r5, InterpreterData::kInterpreterTrampolineOffset));
   __ addi(r5, r5, Operand(Code::kHeaderSize - kHeapObjectTag));
   __ b(&trampoline_loaded);
 
@@ -1472,7 +1492,7 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   Register scratch = temps.Acquire();
   __ lbzx(ip, MemOperand(kInterpreterBytecodeArrayRegister,
                          kInterpreterBytecodeOffsetRegister));
-  __ ShiftLeftImm(scratch, scratch, Operand(kPointerSizeLog2));
+  __ ShiftLeftImm(scratch, scratch, Operand(kSystemPointerSizeLog2));
   __ LoadPX(kJavaScriptCallCodeStartRegister,
             MemOperand(kInterpreterDispatchTableRegister, scratch));
   __ Jump(kJavaScriptCallCodeStartRegister);
@@ -1538,9 +1558,10 @@ void Generate_ContinueToBuiltinHelper(MacroAssembler* masm,
     // Overwrite the hole inserted by the deoptimizer with the return value from
     // the LAZY deopt point.
     __ StoreP(
-        r3, MemOperand(
-                sp, config->num_allocatable_general_registers() * kPointerSize +
-                        BuiltinContinuationFrameConstants::kFixedFrameSize));
+        r3,
+        MemOperand(sp, config->num_allocatable_general_registers() *
+                               kSystemPointerSize +
+                           BuiltinContinuationFrameConstants::kFixedFrameSize));
   }
   for (int i = allocatable_register_count - 1; i >= 0; --i) {
     int code = config->GetAllocatableGeneralCode(i);
@@ -1591,8 +1612,8 @@ void Builtins::Generate_NotifyDeoptimized(MacroAssembler* masm) {
   }
 
   DCHECK_EQ(kInterpreterAccumulatorRegister.code(), r3.code());
-  __ LoadP(r3, MemOperand(sp, 0 * kPointerSize));
-  __ addi(sp, sp, Operand(1 * kPointerSize));
+  __ LoadP(r3, MemOperand(sp, 0 * kSystemPointerSize));
+  __ addi(sp, sp, Operand(1 * kSystemPointerSize));
   __ Ret();
 }
 
@@ -1616,7 +1637,8 @@ void Builtins::Generate_InterpreterOnStackReplacement(MacroAssembler* masm) {
 
   // Load deoptimization data from the code object.
   // <deopt_data> = <code>[#deoptimization_data_offset]
-  __ LoadP(r4, FieldMemOperand(r3, Code::kDeoptimizationDataOffset));
+  __ LoadTaggedPointerField(
+      r4, FieldMemOperand(r3, Code::kDeoptimizationDataOffset));
 
   {
     ConstantPoolUnavailableScope constant_pool_unavailable(masm);
@@ -1628,10 +1650,9 @@ void Builtins::Generate_InterpreterOnStackReplacement(MacroAssembler* masm) {
 
     // Load the OSR entrypoint offset from the deoptimization data.
     // <osr_offset> = <deopt_data>[#header_size + #osr_pc_offset]
-    __ LoadP(r4,
-             FieldMemOperand(r4, FixedArray::OffsetOfElementAt(
-                                     DeoptimizationData::kOsrPcOffsetIndex)));
-    __ SmiUntag(r4);
+    __ SmiUntagField(
+        r4, FieldMemOperand(r4, FixedArray::OffsetOfElementAt(
+                                    DeoptimizationData::kOsrPcOffsetIndex)));
 
     // Compute the target address = code start + osr_offset
     __ add(r0, r3, r4);
@@ -1659,16 +1680,16 @@ void Builtins::Generate_FunctionPrototypeApply(MacroAssembler* masm) {
     Register arg_size = r8;
     Register new_sp = r6;
     Register scratch = r7;
-    __ ShiftLeftImm(arg_size, r3, Operand(kPointerSizeLog2));
+    __ ShiftLeftImm(arg_size, r3, Operand(kSystemPointerSizeLog2));
     __ add(new_sp, sp, arg_size);
     __ LoadRoot(scratch, RootIndex::kUndefinedValue);
     __ mr(r5, scratch);
     __ LoadP(r4, MemOperand(new_sp, 0));  // receiver
-    __ cmpi(arg_size, Operand(kPointerSize));
+    __ cmpi(arg_size, Operand(kSystemPointerSize));
     __ blt(&skip);
-    __ LoadP(scratch, MemOperand(new_sp, 1 * -kPointerSize));  // thisArg
+    __ LoadP(scratch, MemOperand(new_sp, 1 * -kSystemPointerSize));  // thisArg
     __ beq(&skip);
-    __ LoadP(r5, MemOperand(new_sp, 2 * -kPointerSize));  // argArray
+    __ LoadP(r5, MemOperand(new_sp, 2 * -kSystemPointerSize));  // argArray
     __ bind(&skip);
     __ mr(sp, new_sp);
     __ StoreP(scratch, MemOperand(sp, 0));
@@ -1717,7 +1738,7 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
 
   // 2. Get the callable to call (passed as receiver) from the stack.
   // r3: actual number of arguments
-  __ ShiftLeftImm(r5, r3, Operand(kPointerSizeLog2));
+  __ ShiftLeftImm(r5, r3, Operand(kSystemPointerSizeLog2));
   __ LoadPX(r4, MemOperand(sp, r5));
 
   // 3. Shift arguments and return address one slot down on the stack
@@ -1733,9 +1754,9 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
 
     __ mtctr(r3);
     __ bind(&loop);
-    __ LoadP(scratch, MemOperand(r5, -kPointerSize));
+    __ LoadP(scratch, MemOperand(r5, -kSystemPointerSize));
     __ StoreP(scratch, MemOperand(r5));
-    __ subi(r5, r5, Operand(kPointerSize));
+    __ subi(r5, r5, Operand(kSystemPointerSize));
     __ bdnz(&loop);
     // Adjust the actual number of arguments and remove the top element
     // (which is a copy of the last argument).
@@ -1764,19 +1785,20 @@ void Builtins::Generate_ReflectApply(MacroAssembler* masm) {
     Register arg_size = r8;
     Register new_sp = r6;
     Register scratch = r7;
-    __ ShiftLeftImm(arg_size, r3, Operand(kPointerSizeLog2));
+    __ ShiftLeftImm(arg_size, r3, Operand(kSystemPointerSizeLog2));
     __ add(new_sp, sp, arg_size);
     __ LoadRoot(r4, RootIndex::kUndefinedValue);
     __ mr(scratch, r4);
     __ mr(r5, r4);
-    __ cmpi(arg_size, Operand(kPointerSize));
+    __ cmpi(arg_size, Operand(kSystemPointerSize));
     __ blt(&skip);
-    __ LoadP(r4, MemOperand(new_sp, 1 * -kPointerSize));  // target
+    __ LoadP(r4, MemOperand(new_sp, 1 * -kSystemPointerSize));  // target
     __ beq(&skip);
-    __ LoadP(scratch, MemOperand(new_sp, 2 * -kPointerSize));  // thisArgument
-    __ cmpi(arg_size, Operand(2 * kPointerSize));
+    __ LoadP(scratch,
+             MemOperand(new_sp, 2 * -kSystemPointerSize));  // thisArgument
+    __ cmpi(arg_size, Operand(2 * kSystemPointerSize));
     __ beq(&skip);
-    __ LoadP(r5, MemOperand(new_sp, 3 * -kPointerSize));  // argumentsList
+    __ LoadP(r5, MemOperand(new_sp, 3 * -kSystemPointerSize));  // argumentsList
     __ bind(&skip);
     __ mr(sp, new_sp);
     __ StoreP(scratch, MemOperand(sp, 0));
@@ -1814,21 +1836,21 @@ void Builtins::Generate_ReflectConstruct(MacroAssembler* masm) {
     Label skip;
     Register arg_size = r8;
     Register new_sp = r7;
-    __ ShiftLeftImm(arg_size, r3, Operand(kPointerSizeLog2));
+    __ ShiftLeftImm(arg_size, r3, Operand(kSystemPointerSizeLog2));
     __ add(new_sp, sp, arg_size);
     __ LoadRoot(r4, RootIndex::kUndefinedValue);
     __ mr(r5, r4);
     __ mr(r6, r4);
     __ StoreP(r4, MemOperand(new_sp, 0));  // receiver (undefined)
-    __ cmpi(arg_size, Operand(kPointerSize));
+    __ cmpi(arg_size, Operand(kSystemPointerSize));
     __ blt(&skip);
-    __ LoadP(r4, MemOperand(new_sp, 1 * -kPointerSize));  // target
+    __ LoadP(r4, MemOperand(new_sp, 1 * -kSystemPointerSize));  // target
     __ mr(r6, r4);  // new.target defaults to target
     __ beq(&skip);
-    __ LoadP(r5, MemOperand(new_sp, 2 * -kPointerSize));  // argumentsList
-    __ cmpi(arg_size, Operand(2 * kPointerSize));
+    __ LoadP(r5, MemOperand(new_sp, 2 * -kSystemPointerSize));  // argumentsList
+    __ cmpi(arg_size, Operand(2 * kSystemPointerSize));
     __ beq(&skip);
-    __ LoadP(r6, MemOperand(new_sp, 3 * -kPointerSize));  // new.target
+    __ LoadP(r6, MemOperand(new_sp, 3 * -kSystemPointerSize));  // new.target
     __ bind(&skip);
     __ mr(sp, new_sp);
   }
@@ -1875,7 +1897,7 @@ static void LeaveArgumentsAdaptorFrame(MacroAssembler* masm) {
   // Get the number of arguments passed (as a smi), tear down the frame and
   // then tear down the parameters.
   __ LoadP(r4, MemOperand(fp, ArgumentsAdaptorFrameConstants::kLengthOffset));
-  int stack_adjustment = kPointerSize;  // adjust for receiver
+  int stack_adjustment = kSystemPointerSize;  // adjust for receiver
   __ LeaveFrame(StackFrame::ARGUMENTS_ADAPTOR, stack_adjustment);
   __ SmiToPtrArrayOffset(r0, r4);
   __ add(sp, sp, r0);
@@ -1898,7 +1920,8 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
     // Allow r5 to be a FixedArray, or a FixedDoubleArray if r7 == 0.
     Label ok, fail;
     __ AssertNotSmi(r5);
-    __ LoadP(scratch, FieldMemOperand(r5, HeapObject::kMapOffset));
+    __ LoadTaggedPointerField(scratch,
+                              FieldMemOperand(r5, HeapObject::kMapOffset));
     __ LoadHalfWord(scratch,
                     FieldMemOperand(scratch, Map::kInstanceTypeOffset));
     __ cmpi(scratch, Operand(FIXED_ARRAY_TYPE));
@@ -1924,10 +1947,11 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
     __ cmpi(r7, Operand::Zero());
     __ beq(&no_args);
     __ addi(r5, r5,
-            Operand(FixedArray::kHeaderSize - kHeapObjectTag - kPointerSize));
+            Operand(FixedArray::kHeaderSize - kHeapObjectTag - kTaggedSize));
     __ mtctr(r7);
     __ bind(&loop);
-    __ LoadPU(scratch, MemOperand(r5, kPointerSize));
+    __ LoadTaggedPointerField(scratch, MemOperand(r5, kTaggedSize));
+    __ addi(r5, r5, Operand(kTaggedSize));
     __ CompareRoot(scratch, RootIndex::kTheHoleValue);
     __ bne(&skip);
     __ LoadRoot(scratch, RootIndex::kUndefinedValue);
@@ -1961,7 +1985,8 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   if (mode == CallOrConstructMode::kConstruct) {
     Label new_target_constructor, new_target_not_constructor;
     __ JumpIfSmi(r6, &new_target_not_constructor);
-    __ LoadP(scratch, FieldMemOperand(r6, HeapObject::kMapOffset));
+    __ LoadTaggedPointerField(scratch,
+                              FieldMemOperand(r6, HeapObject::kMapOffset));
     __ lbz(scratch, FieldMemOperand(scratch, Map::kBitFieldOffset));
     __ TestBit(scratch, Map::Bits1::IsConstructorBit::kShift, r0);
     __ bne(&new_target_constructor, cr0);
@@ -1985,7 +2010,8 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   __ beq(&arguments_adaptor);
   {
     __ LoadP(r8, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
-    __ LoadP(r8, FieldMemOperand(r8, JSFunction::kSharedFunctionInfoOffset));
+    __ LoadTaggedPointerField(
+        r8, FieldMemOperand(r8, JSFunction::kSharedFunctionInfoOffset));
     __ LoadHalfWord(
         r8,
         FieldMemOperand(r8, SharedFunctionInfo::kFormalParameterCountOffset));
@@ -2011,11 +2037,11 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
     // Forward the arguments from the caller frame.
     {
       Label loop;
-      __ addi(r7, r7, Operand(kPointerSize));
+      __ addi(r7, r7, Operand(kSystemPointerSize));
       __ add(r3, r3, r8);
       __ bind(&loop);
       {
-        __ ShiftLeftImm(scratch, r8, Operand(kPointerSizeLog2));
+        __ ShiftLeftImm(scratch, r8, Operand(kSystemPointerSizeLog2));
         __ LoadPX(scratch, MemOperand(r7, scratch));
         __ push(scratch);
         __ subi(r8, r8, Operand(1));
@@ -2045,7 +2071,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   // See ES6 section 9.2.1 [[Call]] ( thisArgument, argumentsList)
   // Check that the function is not a "classConstructor".
   Label class_constructor;
-  __ LoadP(r5, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
+  __ LoadTaggedPointerField(
+      r5, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
   __ lwz(r6, FieldMemOperand(r5, SharedFunctionInfo::kFlagsOffset));
   __ TestBitMask(r6, SharedFunctionInfo::IsClassConstructorBit::kMask, r0);
   __ bne(&class_constructor, cr0);
@@ -2053,7 +2080,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   // Enter the context of the function; ToObject has to run in the function
   // context, and we also need to take the global proxy from the function
   // context in case of conversion.
-  __ LoadP(cp, FieldMemOperand(r4, JSFunction::kContextOffset));
+  __ LoadTaggedPointerField(cp,
+                            FieldMemOperand(r4, JSFunction::kContextOffset));
   // We need to convert the receiver for non-native sloppy mode functions.
   Label done_convert;
   __ andi(r0, r6,
@@ -2073,7 +2101,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
       __ LoadGlobalProxy(r6);
     } else {
       Label convert_to_object, convert_receiver;
-      __ ShiftLeftImm(r6, r3, Operand(kPointerSizeLog2));
+      __ ShiftLeftImm(r6, r3, Operand(kSystemPointerSizeLog2));
       __ LoadPX(r6, MemOperand(sp, r6));
       __ JumpIfSmi(r6, &convert_to_object);
       STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
@@ -2107,10 +2135,11 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
         __ Pop(r3, r4);
         __ SmiUntag(r3);
       }
-      __ LoadP(r5, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
+      __ LoadTaggedPointerField(
+          r5, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
       __ bind(&convert_receiver);
     }
-    __ ShiftLeftImm(r7, r3, Operand(kPointerSizeLog2));
+    __ ShiftLeftImm(r7, r3, Operand(kSystemPointerSizeLog2));
     __ StorePX(r6, MemOperand(sp, r7));
   }
   __ bind(&done_convert);
@@ -2146,9 +2175,9 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
 
   // Load [[BoundArguments]] into r5 and length of that into r7.
   Label no_bound_arguments;
-  __ LoadP(r5, FieldMemOperand(r4, JSBoundFunction::kBoundArgumentsOffset));
-  __ LoadP(r7, FieldMemOperand(r5, FixedArray::kLengthOffset));
-  __ SmiUntag(r7, SetRC);
+  __ LoadTaggedPointerField(
+      r5, FieldMemOperand(r4, JSBoundFunction::kBoundArgumentsOffset));
+  __ SmiUntagField(r7, FieldMemOperand(r5, FixedArray::kLengthOffset), SetRC);
   __ beq(&no_bound_arguments, cr0);
   {
     // ----------- S t a t e -------------
@@ -2163,9 +2192,8 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
     // Reserve stack space for the [[BoundArguments]].
     {
       Label done;
-      __ mr(scratch, sp);  // preserve previous stack pointer
-      __ ShiftLeftImm(r10, r7, Operand(kPointerSizeLog2));
-      __ sub(sp, sp, r10);
+      __ ShiftLeftImm(r10, r7, Operand(kSystemPointerSizeLog2));
+      __ sub(r0, sp, r10);
       // Check the stack for overflow. We are not trying to catch interruptions
       // (i.e. debug break and preemption) here, so check the "real stack
       // limit".
@@ -2173,11 +2201,9 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
         UseScratchRegisterScope temps(masm);
         Register scratch = temps.Acquire();
         LoadStackLimit(masm, scratch, StackLimitKind::kRealStackLimit);
-        __ cmpl(sp, scratch);
+        __ cmpl(r0, scratch);
       }
       __ bgt(&done);  // Signed comparison.
-      // Restore the stack pointer.
-      __ mr(sp, scratch);
       {
         FrameScope scope(masm, StackFrame::MANUAL);
         __ EnterFrame(StackFrame::INTERNAL);
@@ -2186,6 +2212,9 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
       __ bind(&done);
     }
 
+    __ mr(scratch, sp);
+    __ mr(sp, r0);
+
     // Relocate arguments down the stack.
     //  -- r3 : the number of arguments (not including the receiver)
     //  -- r9 : the previous stack pointer
@@ -2199,7 +2228,7 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
       __ bind(&loop);
       __ LoadPX(r0, MemOperand(scratch, r8));
       __ StorePX(r0, MemOperand(sp, r8));
-      __ addi(r8, r8, Operand(kPointerSize));
+      __ addi(r8, r8, Operand(kSystemPointerSize));
       __ bdnz(&loop);
       __ bind(&skip);
     }
@@ -2207,13 +2236,15 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
     // Copy [[BoundArguments]] to the stack (below the arguments).
     {
       Label loop;
-      __ addi(r5, r5, Operand(FixedArray::kHeaderSize - kHeapObjectTag));
+      __ ShiftLeftImm(r10, r7, Operand(kTaggedSizeLog2));
+      __ addi(r10, r10, Operand(FixedArray::kHeaderSize - kHeapObjectTag));
       __ add(r5, r5, r10);
       __ mtctr(r7);
       __ bind(&loop);
-      __ LoadPU(r0, MemOperand(r5, -kPointerSize));
-      __ StorePX(r0, MemOperand(sp, r8));
-      __ addi(r8, r8, Operand(kPointerSize));
+      __ LoadAnyTaggedField(ip, MemOperand(r5, -kTaggedSize), r0);
+      __ StorePX(ip, MemOperand(sp, r8));
+      __ addi(r8, r8, Operand(kSystemPointerSize));
+      __ addi(r5, r5, Operand(-kTaggedSize));
       __ bdnz(&loop);
       __ add(r3, r3, r7);
     }
@@ -2232,16 +2263,17 @@ void Builtins::Generate_CallBoundFunctionImpl(MacroAssembler* masm) {
   __ AssertBoundFunction(r4);
 
   // Patch the receiver to [[BoundThis]].
-  __ LoadP(r6, FieldMemOperand(r4, JSBoundFunction::kBoundThisOffset));
-  __ ShiftLeftImm(r0, r3, Operand(kPointerSizeLog2));
+  __ LoadAnyTaggedField(r6,
+                        FieldMemOperand(r4, JSBoundFunction::kBoundThisOffset));
+  __ ShiftLeftImm(r0, r3, Operand(kSystemPointerSizeLog2));
   __ StorePX(r6, MemOperand(sp, r0));
 
   // Push the [[BoundArguments]] onto the stack.
   Generate_PushBoundArguments(masm);
 
   // Call the [[BoundTargetFunction]] via the Call builtin.
-  __ LoadP(r4,
-           FieldMemOperand(r4, JSBoundFunction::kBoundTargetFunctionOffset));
+  __ LoadTaggedPointerField(
+      r4, FieldMemOperand(r4, JSBoundFunction::kBoundTargetFunctionOffset));
   __ Jump(BUILTIN_CODE(masm->isolate(), Call_ReceiverIsAny),
           RelocInfo::CODE_TARGET);
 }
@@ -2275,7 +2307,7 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
   // 2. Call to something else, which might have a [[Call]] internal method (if
   // not we raise an exception).
   // Overwrite the original receiver the (original) target.
-  __ ShiftLeftImm(r8, r3, Operand(kPointerSizeLog2));
+  __ ShiftLeftImm(r8, r3, Operand(kSystemPointerSizeLog2));
   __ StorePX(r4, MemOperand(sp, r8));
   // Let the "call_as_function_delegate" take care of the rest.
   __ LoadNativeContextSlot(Context::CALL_AS_FUNCTION_DELEGATE_INDEX, r4);
@@ -2309,7 +2341,8 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
   Label call_generic_stub;
 
   // Jump to JSBuiltinsConstructStub or JSConstructStubGeneric.
-  __ LoadP(r7, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
+  __ LoadTaggedPointerField(
+      r7, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
   __ lwz(r7, FieldMemOperand(r7, SharedFunctionInfo::kFlagsOffset));
   __ mov(ip, Operand(SharedFunctionInfo::ConstructAsBuiltinBit::kMask));
   __ and_(r7, r7, ip, SetRC);
@@ -2338,15 +2371,15 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
 
   // Patch new.target to [[BoundTargetFunction]] if new.target equals target.
   Label skip;
-  __ cmp(r4, r6);
+  __ CompareTagged(r4, r6);
   __ bne(&skip);
-  __ LoadP(r6,
-           FieldMemOperand(r4, JSBoundFunction::kBoundTargetFunctionOffset));
+  __ LoadTaggedPointerField(
+      r6, FieldMemOperand(r4, JSBoundFunction::kBoundTargetFunctionOffset));
   __ bind(&skip);
 
   // Construct the [[BoundTargetFunction]] via the Construct builtin.
-  __ LoadP(r4,
-           FieldMemOperand(r4, JSBoundFunction::kBoundTargetFunctionOffset));
+  __ LoadTaggedPointerField(
+      r4, FieldMemOperand(r4, JSBoundFunction::kBoundTargetFunctionOffset));
   __ Jump(BUILTIN_CODE(masm->isolate(), Construct), RelocInfo::CODE_TARGET);
 }
 
@@ -2364,7 +2397,7 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   __ JumpIfSmi(r4, &non_constructor);
 
   // Check if target has a [[Construct]] internal method.
-  __ LoadP(r7, FieldMemOperand(r4, HeapObject::kMapOffset));
+  __ LoadTaggedPointerField(r7, FieldMemOperand(r4, HeapObject::kMapOffset));
   __ lbz(r5, FieldMemOperand(r7, Map::kBitFieldOffset));
   __ TestBit(r5, Map::Bits1::IsConstructorBit::kShift, r0);
   __ beq(&non_constructor, cr0);
@@ -2390,7 +2423,7 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   __ bind(&non_proxy);
   {
     // Overwrite the original receiver with the (original) target.
-    __ ShiftLeftImm(r8, r3, Operand(kPointerSizeLog2));
+    __ ShiftLeftImm(r8, r3, Operand(kSystemPointerSizeLog2));
     __ StorePX(r4, MemOperand(sp, r8));
     // Let the "call_as_constructor_delegate" take care of the rest.
     __ LoadNativeContextSlot(Context::CALL_AS_CONSTRUCTOR_DELEGATE_INDEX, r4);
@@ -2416,7 +2449,8 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   Label dont_adapt_arguments, stack_overflow, skip_adapt_arguments;
   __ cmpli(r5, Operand(kDontAdaptArgumentsSentinel));
   __ beq(&dont_adapt_arguments);
-  __ LoadP(r7, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
+  __ LoadTaggedPointerField(
+      r7, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
   __ lwz(r7, FieldMemOperand(r7, SharedFunctionInfo::kFlagsOffset));
   __ TestBitMask(r7, SharedFunctionInfo::IsSafeToSkipArgumentsAdaptorBit::kMask,
                  r0);
@@ -2444,8 +2478,8 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
       __ SmiToPtrArrayOffset(r3, r3);
       __ add(r3, r3, fp);
       // adjust for return address and receiver
-      __ addi(r3, r3, Operand(2 * kPointerSize));
-      __ ShiftLeftImm(r7, r5, Operand(kPointerSizeLog2));
+      __ addi(r3, r3, Operand(2 * kSystemPointerSize));
+      __ ShiftLeftImm(r7, r5, Operand(kSystemPointerSizeLog2));
       __ sub(r7, r3, r7);
 
       // Copy the arguments (including the receiver) to the new stack frame.
@@ -2460,7 +2494,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
       __ LoadP(r0, MemOperand(r3, 0));
       __ push(r0);
       __ cmp(r3, r7);  // Compare before moving to next argument.
-      __ subi(r3, r3, Operand(kPointerSize));
+      __ subi(r3, r3, Operand(kSystemPointerSize));
       __ bne(&copy);
 
       __ b(&invoke);
@@ -2488,10 +2522,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
       Label copy;
       __ bind(&copy);
       // Adjust load for return address and receiver.
-      __ LoadP(r0, MemOperand(r3, 2 * kPointerSize));
+      __ LoadP(r0, MemOperand(r3, 2 * kSystemPointerSize));
       __ push(r0);
       __ cmp(r3, fp);  // Compare before moving to next argument.
-      __ subi(r3, r3, Operand(kPointerSize));
+      __ subi(r3, r3, Operand(kSystemPointerSize));
       __ bne(&copy);
 
       // Fill the remaining expected arguments with undefined.
@@ -2499,12 +2533,12 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
       // r5: expected number of arguments
       // r6: new target (passed through to callee)
       __ LoadRoot(r0, RootIndex::kUndefinedValue);
-      __ ShiftLeftImm(r7, r5, Operand(kPointerSizeLog2));
+      __ ShiftLeftImm(r7, r5, Operand(kSystemPointerSizeLog2));
       __ sub(r7, fp, r7);
       // Adjust for frame.
       __ subi(r7, r7,
               Operand(ArgumentsAdaptorFrameConstants::kFixedFrameSizeFromFp +
-                      kPointerSize));
+                      kSystemPointerSize));
 
       Label fill;
       __ bind(&fill);
@@ -2520,7 +2554,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     // r4 : function (passed through to callee)
     // r6 : new target (passed through to callee)
     static_assert(kJavaScriptCallCodeStartRegister == r5, "ABI mismatch");
-    __ LoadP(r5, FieldMemOperand(r4, JSFunction::kCodeOffset));
+    __ LoadTaggedPointerField(r5, FieldMemOperand(r4, JSFunction::kCodeOffset));
     __ CallCodeObject(r5);
 
     // Store offset of return address for deoptimizer.
@@ -2549,7 +2583,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
       // Remove superfluous parameters from the stack.
       __ sub(r7, r3, r5);
       __ mr(r3, r5);
-      __ ShiftLeftImm(r7, r7, Operand(kPointerSizeLog2));
+      __ ShiftLeftImm(r7, r7, Operand(kSystemPointerSizeLog2));
       __ add(sp, sp, r7);
       __ b(&dont_adapt_arguments);
     }
@@ -2572,8 +2606,9 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // Dont adapt arguments.
   // -------------------------------------------
   __ bind(&dont_adapt_arguments);
+  __ RecordComment("-- Call without adapting args --");
   static_assert(kJavaScriptCallCodeStartRegister == r5, "ABI mismatch");
-  __ LoadP(r5, FieldMemOperand(r4, JSFunction::kCodeOffset));
+  __ LoadTaggedPointerField(r5, FieldMemOperand(r4, JSFunction::kCodeOffset));
   __ JumpCodeObject(r5);
 
   __ bind(&stack_overflow);
@@ -2663,9 +2698,9 @@ void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
     __ mr(r4, r5);
   } else {
     // Compute the argv pointer.
-    __ ShiftLeftImm(r4, r3, Operand(kPointerSizeLog2));
+    __ ShiftLeftImm(r4, r3, Operand(kSystemPointerSizeLog2));
     __ add(r4, r4, sp);
-    __ subi(r4, r4, Operand(kPointerSize));
+    __ subi(r4, r4, Operand(kSystemPointerSize));
   }
 
   // Enter the exit frame that transitions from JavaScript to C++.
@@ -2701,7 +2736,8 @@ void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
     // buffer as implicit first argument.
     __ mr(r5, r4);
     __ mr(r4, r3);
-    __ addi(r3, sp, Operand((kStackFrameExtraParamSlot + 1) * kPointerSize));
+    __ addi(r3, sp,
+            Operand((kStackFrameExtraParamSlot + 1) * kSystemPointerSize));
     isolate_reg = r6;
   }
 
@@ -2713,7 +2749,7 @@ void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
 
   // If return value is on the stack, pop it to registers.
   if (needs_return_buffer) {
-    __ LoadP(r4, MemOperand(r3, kPointerSize));
+    __ LoadP(r4, MemOperand(r3, kSystemPointerSize));
     __ LoadP(r3, MemOperand(r3));
   }
 
@@ -2828,7 +2864,7 @@ void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
 
   __ Push(result_reg, scratch);
   // Account for saved regs.
-  int argument_offset = 2 * kPointerSize;
+  int argument_offset = 2 * kSystemPointerSize;
 
   // Load double input.
   __ lfd(double_scratch, MemOperand(sp, argument_offset));
@@ -2850,7 +2886,7 @@ void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
 
   __ Push(scratch_high, scratch_low);
   // Account for saved regs.
-  argument_offset += 2 * kPointerSize;
+  argument_offset += 2 * kSystemPointerSize;
 
   __ lwz(scratch_high,
          MemOperand(sp, argument_offset + Register::kExponentOffset));
@@ -2921,7 +2957,7 @@ void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
   __ bind(&done);
   __ Pop(scratch_high, scratch_low);
   // Account for saved regs.
-  argument_offset -= 2 * kPointerSize;
+  argument_offset -= 2 * kSystemPointerSize;
 
   __ bind(&fastpath_done);
   __ StoreP(result_reg, MemOperand(sp, argument_offset));
@@ -3092,33 +3128,33 @@ void Builtins::Generate_CallApiCallback(MacroAssembler* masm) {
   // Set up FunctionCallbackInfo's implicit_args on the stack as follows:
   //
   // Target state:
-  //   sp[0 * kPointerSize]: kHolder
-  //   sp[1 * kPointerSize]: kIsolate
-  //   sp[2 * kPointerSize]: undefined (kReturnValueDefaultValue)
-  //   sp[3 * kPointerSize]: undefined (kReturnValue)
-  //   sp[4 * kPointerSize]: kData
-  //   sp[5 * kPointerSize]: undefined (kNewTarget)
+  //   sp[0 * kSystemPointerSize]: kHolder
+  //   sp[1 * kSystemPointerSize]: kIsolate
+  //   sp[2 * kSystemPointerSize]: undefined (kReturnValueDefaultValue)
+  //   sp[3 * kSystemPointerSize]: undefined (kReturnValue)
+  //   sp[4 * kSystemPointerSize]: kData
+  //   sp[5 * kSystemPointerSize]: undefined (kNewTarget)
 
   // Reserve space on the stack.
-  __ subi(sp, sp, Operand(FCA::kArgsLength * kPointerSize));
+  __ subi(sp, sp, Operand(FCA::kArgsLength * kSystemPointerSize));
 
   // kHolder.
-  __ StoreP(holder, MemOperand(sp, 0 * kPointerSize));
+  __ StoreP(holder, MemOperand(sp, 0 * kSystemPointerSize));
 
   // kIsolate.
   __ Move(scratch, ExternalReference::isolate_address(masm->isolate()));
-  __ StoreP(scratch, MemOperand(sp, 1 * kPointerSize));
+  __ StoreP(scratch, MemOperand(sp, 1 * kSystemPointerSize));
 
   // kReturnValueDefaultValue and kReturnValue.
   __ LoadRoot(scratch, RootIndex::kUndefinedValue);
-  __ StoreP(scratch, MemOperand(sp, 2 * kPointerSize));
-  __ StoreP(scratch, MemOperand(sp, 3 * kPointerSize));
+  __ StoreP(scratch, MemOperand(sp, 2 * kSystemPointerSize));
+  __ StoreP(scratch, MemOperand(sp, 3 * kSystemPointerSize));
 
   // kData.
-  __ StoreP(call_data, MemOperand(sp, 4 * kPointerSize));
+  __ StoreP(call_data, MemOperand(sp, 4 * kSystemPointerSize));
 
   // kNewTarget.
-  __ StoreP(scratch, MemOperand(sp, 5 * kPointerSize));
+  __ StoreP(scratch, MemOperand(sp, 5 * kSystemPointerSize));
 
   // Keep a pointer to kHolder (= implicit_args) in a scratch register.
   // We use it below to set up the FunctionCallbackInfo object.
@@ -3140,31 +3176,34 @@ void Builtins::Generate_CallApiCallback(MacroAssembler* masm) {
 
   // FunctionCallbackInfo::implicit_args_ (points at kHolder as set up above).
   // Arguments are after the return address (pushed by EnterExitFrame()).
-  __ StoreP(scratch,
-            MemOperand(sp, (kStackFrameExtraParamSlot + 1) * kPointerSize));
+  __ StoreP(scratch, MemOperand(sp, (kStackFrameExtraParamSlot + 1) *
+                                        kSystemPointerSize));
 
   // FunctionCallbackInfo::values_ (points at the first varargs argument passed
   // on the stack).
-  __ addi(scratch, scratch, Operand((FCA::kArgsLength - 1) * kPointerSize));
-  __ ShiftLeftImm(ip, argc, Operand(kPointerSizeLog2));
+  __ addi(scratch, scratch,
+          Operand((FCA::kArgsLength - 1) * kSystemPointerSize));
+  __ ShiftLeftImm(ip, argc, Operand(kSystemPointerSizeLog2));
   __ add(scratch, scratch, ip);
-  __ StoreP(scratch,
-            MemOperand(sp, (kStackFrameExtraParamSlot + 2) * kPointerSize));
+  __ StoreP(scratch, MemOperand(sp, (kStackFrameExtraParamSlot + 2) *
+                                        kSystemPointerSize));
 
   // FunctionCallbackInfo::length_.
-  __ stw(argc, MemOperand(sp, (kStackFrameExtraParamSlot + 3) * kPointerSize));
+  __ stw(argc,
+         MemOperand(sp, (kStackFrameExtraParamSlot + 3) * kSystemPointerSize));
 
   // We also store the number of bytes to drop from the stack after returning
   // from the API function here.
   __ mov(scratch,
-         Operand((FCA::kArgsLength + 1 /* receiver */) * kPointerSize));
-  __ ShiftLeftImm(ip, argc, Operand(kPointerSizeLog2));
+         Operand((FCA::kArgsLength + 1 /* receiver */) * kSystemPointerSize));
+  __ ShiftLeftImm(ip, argc, Operand(kSystemPointerSizeLog2));
   __ add(scratch, scratch, ip);
-  __ StoreP(scratch,
-            MemOperand(sp, (kStackFrameExtraParamSlot + 4) * kPointerSize));
+  __ StoreP(scratch, MemOperand(sp, (kStackFrameExtraParamSlot + 4) *
+                                        kSystemPointerSize));
 
   // v8::InvocationCallback's argument.
-  __ addi(r3, sp, Operand((kStackFrameExtraParamSlot + 1) * kPointerSize));
+  __ addi(r3, sp,
+          Operand((kStackFrameExtraParamSlot + 1) * kSystemPointerSize));
 
   ExternalReference thunk_ref = ExternalReference::invoke_function_callback();
 
@@ -3172,11 +3211,11 @@ void Builtins::Generate_CallApiCallback(MacroAssembler* masm) {
   // TODO(jgruber): Document what these arguments are.
   static constexpr int kStackSlotsAboveFCA = 2;
   MemOperand return_value_operand(
-      fp, (kStackSlotsAboveFCA + FCA::kReturnValueOffset) * kPointerSize);
+      fp, (kStackSlotsAboveFCA + FCA::kReturnValueOffset) * kSystemPointerSize);
 
   static constexpr int kUseStackSpaceOperand = 0;
   MemOperand stack_space_operand(
-      sp, (kStackFrameExtraParamSlot + 4) * kPointerSize);
+      sp, (kStackFrameExtraParamSlot + 4) * kSystemPointerSize);
 
   AllowExternalCallThatCantCauseGC scope(masm);
   CallApiFunctionAndReturn(masm, api_function_address, thunk_ref,
@@ -3210,14 +3249,16 @@ void Builtins::Generate_CallApiGetter(MacroAssembler* masm) {
 
   __ push(receiver);
   // Push data from AccessorInfo.
-  __ LoadP(scratch, FieldMemOperand(callback, AccessorInfo::kDataOffset));
+  __ LoadAnyTaggedField(scratch,
+                        FieldMemOperand(callback, AccessorInfo::kDataOffset));
   __ push(scratch);
   __ LoadRoot(scratch, RootIndex::kUndefinedValue);
   __ Push(scratch, scratch);
   __ Move(scratch, ExternalReference::isolate_address(masm->isolate()));
   __ Push(scratch, holder);
   __ Push(Smi::zero());  // should_throw_on_error -> false
-  __ LoadP(scratch, FieldMemOperand(callback, AccessorInfo::kNameOffset));
+  __ LoadTaggedPointerField(
+      scratch, FieldMemOperand(callback, AccessorInfo::kNameOffset));
   __ push(scratch);
 
   // v8::PropertyCallbackInfo::args_ array and name handle.
@@ -3225,20 +3266,20 @@ void Builtins::Generate_CallApiGetter(MacroAssembler* masm) {
 
   // Load address of v8::PropertyAccessorInfo::args_ array and name handle.
   __ mr(r3, sp);                               // r3 = Handle<Name>
-  __ addi(r4, r3, Operand(1 * kPointerSize));  // r4 = v8::PCI::args_
+  __ addi(r4, r3, Operand(1 * kSystemPointerSize));  // r4 = v8::PCI::args_
 
-// If ABI passes Handles (pointer-sized struct) in a register:
-//
-// Create 2 extra slots on stack:
-//    [0] space for DirectCEntryStub's LR save
-//    [1] AccessorInfo&
-//
-// Otherwise:
-//
-// Create 3 extra slots on stack:
-//    [0] space for DirectCEntryStub's LR save
-//    [1] copy of Handle (first arg)
-//    [2] AccessorInfo&
+  // If ABI passes Handles (pointer-sized struct) in a register:
+  //
+  // Create 2 extra slots on stack:
+  //    [0] space for DirectCEntryStub's LR save
+  //    [1] AccessorInfo&
+  //
+  // Otherwise:
+  //
+  // Create 3 extra slots on stack:
+  //    [0] space for DirectCEntryStub's LR save
+  //    [1] copy of Handle (first arg)
+  //    [2] AccessorInfo&
   if (ABI_PASSES_HANDLES_IN_REGS) {
     accessorInfoSlot = kStackFrameExtraParamSlot + 1;
     apiStackSpace = 2;
@@ -3253,26 +3294,28 @@ void Builtins::Generate_CallApiGetter(MacroAssembler* masm) {
 
   if (!ABI_PASSES_HANDLES_IN_REGS) {
     // pass 1st arg by reference
-    __ StoreP(r3, MemOperand(sp, arg0Slot * kPointerSize));
-    __ addi(r3, sp, Operand(arg0Slot * kPointerSize));
+    __ StoreP(r3, MemOperand(sp, arg0Slot * kSystemPointerSize));
+    __ addi(r3, sp, Operand(arg0Slot * kSystemPointerSize));
   }
 
   // Create v8::PropertyCallbackInfo object on the stack and initialize
   // it's args_ field.
-  __ StoreP(r4, MemOperand(sp, accessorInfoSlot * kPointerSize));
-  __ addi(r4, sp, Operand(accessorInfoSlot * kPointerSize));
+  __ StoreP(r4, MemOperand(sp, accessorInfoSlot * kSystemPointerSize));
+  __ addi(r4, sp, Operand(accessorInfoSlot * kSystemPointerSize));
   // r4 = v8::PropertyCallbackInfo&
 
   ExternalReference thunk_ref =
       ExternalReference::invoke_accessor_getter_callback();
 
-  __ LoadP(scratch, FieldMemOperand(callback, AccessorInfo::kJsGetterOffset));
+  __ LoadTaggedPointerField(
+      scratch, FieldMemOperand(callback, AccessorInfo::kJsGetterOffset));
   __ LoadP(api_function_address,
         FieldMemOperand(scratch, Foreign::kForeignAddressOffset));
 
   // +3 is to skip prolog, return address and name handle.
   MemOperand return_value_operand(
-      fp, (PropertyCallbackArguments::kReturnValueOffset + 3) * kPointerSize);
+      fp,
+      (PropertyCallbackArguments::kReturnValueOffset + 3) * kSystemPointerSize);
   MemOperand* const kUseStackSpaceConstant = nullptr;
   CallApiFunctionAndReturn(masm, api_function_address, thunk_ref,
                            kStackUnwindSpace, kUseStackSpaceConstant,
@@ -3285,16 +3328,17 @@ void Builtins::Generate_DirectCEntry(MacroAssembler* masm) {
   // Place the return address on the stack, making the call
   // GC safe. The RegExp backend also relies on this.
   __ mflr(r0);
-  __ StoreP(r0, MemOperand(sp, kStackFrameExtraParamSlot * kPointerSize));
+  __ StoreP(r0, MemOperand(sp, kStackFrameExtraParamSlot * kSystemPointerSize));
 
   if (ABI_USES_FUNCTION_DESCRIPTORS) {
     // AIX/PPC64BE Linux use a function descriptor;
-    __ LoadP(ToRegister(ABI_TOC_REGISTER), MemOperand(temp2, kPointerSize));
+    __ LoadP(ToRegister(ABI_TOC_REGISTER),
+             MemOperand(temp2, kSystemPointerSize));
     __ LoadP(temp2, MemOperand(temp2, 0));  // Instruction address
   }
 
   __ Call(temp2);  // Call the C++ function.
-  __ LoadP(r0, MemOperand(sp, kStackFrameExtraParamSlot * kPointerSize));
+  __ LoadP(r0, MemOperand(sp, kStackFrameExtraParamSlot * kSystemPointerSize));
   __ mtlr(r0);
   __ blr();
 }
diff --git a/deps/v8/src/builtins/promise-abstract-operations.tq b/deps/v8/src/builtins/promise-abstract-operations.tq
index 95ca356a0ce..9cf6da102b8 100644
--- a/deps/v8/src/builtins/promise-abstract-operations.tq
+++ b/deps/v8/src/builtins/promise-abstract-operations.tq
@@ -6,544 +6,534 @@
 #include 'src/builtins/builtins-promise-gen.h'
 
 namespace runtime {
-  extern transitioning runtime
-  RejectPromise(implicit context: Context)(JSPromise, JSAny, Boolean): JSAny;
+extern transitioning runtime
+RejectPromise(implicit context: Context)(JSPromise, JSAny, Boolean): JSAny;
 
-  extern transitioning runtime
-  PromiseRevokeReject(implicit context: Context)(JSPromise): JSAny;
+extern transitioning runtime
+PromiseRevokeReject(implicit context: Context)(JSPromise): JSAny;
 
-  extern transitioning runtime
-  PromiseRejectAfterResolved(implicit context: Context)(JSPromise, JSAny):
-      JSAny;
+extern transitioning runtime
+PromiseRejectAfterResolved(implicit context: Context)(JSPromise, JSAny): JSAny;
 
-  extern transitioning runtime
-  PromiseResolveAfterResolved(implicit context: Context)(JSPromise, JSAny):
-      JSAny;
+extern transitioning runtime
+PromiseResolveAfterResolved(implicit context: Context)(JSPromise, JSAny): JSAny;
 
-  extern transitioning runtime
-  PromiseRejectEventFromStack(implicit context: Context)(JSPromise, JSAny):
-      JSAny;
+extern transitioning runtime
+PromiseRejectEventFromStack(implicit context: Context)(JSPromise, JSAny): JSAny;
 }
 
 // https://tc39.es/ecma262/#sec-promise-abstract-operations
 namespace promise {
-  extern macro AllocateFunctionWithMapAndContext(
-      Map, SharedFunctionInfo, Context): JSFunction;
-
-  extern macro PromiseReactionMapConstant(): Map;
-  extern macro PromiseFulfillReactionJobTaskMapConstant(): Map;
-  extern macro PromiseRejectReactionJobTaskMapConstant(): Map;
-  extern transitioning builtin
-  ResolvePromise(Context, JSPromise, JSAny): JSAny;
-
-  extern transitioning builtin
-  EnqueueMicrotask(Context, Microtask): Undefined;
-
-  macro
-  ExtractHandlerContextInternal(implicit context: Context)(handler: Callable|
-                                                           Undefined):
-      Context labels NotFound {
-    let iter: JSAny = handler;
-    while (true) {
-      typeswitch (iter) {
-        case (b: JSBoundFunction): {
-          iter = b.bound_target_function;
-        }
-        case (p: JSProxy): {
-          iter = p.target;
-        }
-        case (f: JSFunction): {
-          return f.context;
-        }
-        case (JSAny): {
-          break;
-        }
+extern macro AllocateFunctionWithMapAndContext(
+    Map, SharedFunctionInfo, Context): JSFunction;
+
+extern macro PromiseReactionMapConstant(): Map;
+extern macro PromiseFulfillReactionJobTaskMapConstant(): Map;
+extern macro PromiseRejectReactionJobTaskMapConstant(): Map;
+extern transitioning builtin
+ResolvePromise(Context, JSPromise, JSAny): JSAny;
+
+extern transitioning builtin
+EnqueueMicrotask(Context, Microtask): Undefined;
+
+macro
+ExtractHandlerContextInternal(implicit context: Context)(
+    handler: Callable|Undefined): Context labels NotFound {
+  let iter: JSAny = handler;
+  while (true) {
+    typeswitch (iter) {
+      case (b: JSBoundFunction): {
+        iter = b.bound_target_function;
+      }
+      case (p: JSProxy): {
+        iter = p.target;
+      }
+      case (f: JSFunction): {
+        return f.context;
+      }
+      case (JSAny): {
+        break;
       }
     }
-    goto NotFound;
   }
+  goto NotFound;
+}
 
-  macro
-  ExtractHandlerContext(implicit context: Context)(handler: Callable|
-                                                   Undefined): Context {
-    try {
-      return ExtractHandlerContextInternal(handler) otherwise NotFound;
-    }
-    label NotFound deferred {
-      return context;
-    }
+macro
+ExtractHandlerContext(implicit context: Context)(handler: Callable|
+                                                 Undefined): Context {
+  try {
+    return ExtractHandlerContextInternal(handler) otherwise NotFound;
+  } label NotFound deferred {
+    return context;
   }
+}
 
-  macro
-  ExtractHandlerContext(implicit context: Context)(
-      primary: Callable|Undefined, secondary: Callable|Undefined): Context {
-    try {
-      return ExtractHandlerContextInternal(primary) otherwise NotFound;
-    }
-    label NotFound deferred {
-      return ExtractHandlerContextInternal(secondary) otherwise Default;
-    }
-    label Default deferred {
-      return context;
-    }
+macro
+ExtractHandlerContext(implicit context: Context)(
+    primary: Callable|Undefined, secondary: Callable|Undefined): Context {
+  try {
+    return ExtractHandlerContextInternal(primary) otherwise NotFound;
+  } label NotFound deferred {
+    return ExtractHandlerContextInternal(secondary) otherwise Default;
+  } label Default deferred {
+    return context;
   }
+}
 
-  transitioning macro MorphAndEnqueuePromiseReaction(implicit context: Context)(
-      promiseReaction: PromiseReaction, argument: JSAny,
-      reactionType: constexpr PromiseReactionType): void {
-    let primaryHandler: Callable|Undefined;
-    let secondaryHandler: Callable|Undefined;
-    if constexpr (reactionType == kPromiseReactionFulfill) {
-      primaryHandler = promiseReaction.fulfill_handler;
-      secondaryHandler = promiseReaction.reject_handler;
-    } else {
-      StaticAssert(reactionType == kPromiseReactionReject);
-      primaryHandler = promiseReaction.reject_handler;
-      secondaryHandler = promiseReaction.fulfill_handler;
-    }
-
-    // According to HTML, we use the context of the appropriate handler as the
-    // context of the microtask. See step 3 of HTML's EnqueueJob:
-    // https://html.spec.whatwg.org/C/#enqueuejob(queuename,-job,-arguments)
-    const handlerContext: Context =
-        ExtractHandlerContext(primaryHandler, secondaryHandler);
+transitioning macro MorphAndEnqueuePromiseReaction(implicit context: Context)(
+    promiseReaction: PromiseReaction, argument: JSAny,
+    reactionType: constexpr PromiseReactionType): void {
+  let primaryHandler: Callable|Undefined;
+  let secondaryHandler: Callable|Undefined;
+  if constexpr (reactionType == kPromiseReactionFulfill) {
+    primaryHandler = promiseReaction.fulfill_handler;
+    secondaryHandler = promiseReaction.reject_handler;
+  } else {
+    StaticAssert(reactionType == kPromiseReactionReject);
+    primaryHandler = promiseReaction.reject_handler;
+    secondaryHandler = promiseReaction.fulfill_handler;
+  }
 
-    // Morph {current} from a PromiseReaction into a PromiseReactionJobTask
-    // and schedule that on the microtask queue. We try to minimize the number
-    // of stores here to avoid screwing up the store buffer.
+  // According to HTML, we use the context of the appropriate handler as the
+  // context of the microtask. See step 3 of HTML's EnqueueJob:
+  // https://html.spec.whatwg.org/C/#enqueuejob(queuename,-job,-arguments)
+  const handlerContext: Context =
+      ExtractHandlerContext(primaryHandler, secondaryHandler);
+
+  // Morph {current} from a PromiseReaction into a PromiseReactionJobTask
+  // and schedule that on the microtask queue. We try to minimize the number
+  // of stores here to avoid screwing up the store buffer.
+  StaticAssert(
+      kPromiseReactionSize ==
+      kPromiseReactionJobTaskSizeOfAllPromiseReactionJobTasks);
+  if constexpr (reactionType == kPromiseReactionFulfill) {
+    * UnsafeConstCast(& promiseReaction.map) =
+        PromiseFulfillReactionJobTaskMapConstant();
+    const promiseReactionJobTask =
+        UnsafeCast<PromiseFulfillReactionJobTask>(promiseReaction);
+    promiseReactionJobTask.argument = argument;
+    promiseReactionJobTask.context = handlerContext;
+    EnqueueMicrotask(handlerContext, promiseReactionJobTask);
     StaticAssert(
-        kPromiseReactionSize ==
-        kPromiseReactionJobTaskSizeOfAllPromiseReactionJobTasks);
-    if constexpr (reactionType == kPromiseReactionFulfill) {
-      * UnsafeConstCast(& promiseReaction.map) =
-          PromiseFulfillReactionJobTaskMapConstant();
-      const promiseReactionJobTask =
-          UnsafeCast<PromiseFulfillReactionJobTask>(promiseReaction);
-      promiseReactionJobTask.argument = argument;
-      promiseReactionJobTask.context = handlerContext;
-      EnqueueMicrotask(handlerContext, promiseReactionJobTask);
-      StaticAssert(
-          kPromiseReactionFulfillHandlerOffset ==
-          kPromiseReactionJobTaskHandlerOffset);
-      StaticAssert(
-          kPromiseReactionPromiseOrCapabilityOffset ==
-          kPromiseReactionJobTaskPromiseOrCapabilityOffset);
-    } else {
-      StaticAssert(reactionType == kPromiseReactionReject);
-      * UnsafeConstCast(& promiseReaction.map) =
-          PromiseRejectReactionJobTaskMapConstant();
-      const promiseReactionJobTask =
-          UnsafeCast<PromiseRejectReactionJobTask>(promiseReaction);
-      promiseReactionJobTask.argument = argument;
-      promiseReactionJobTask.context = handlerContext;
-      promiseReactionJobTask.handler = primaryHandler;
-      EnqueueMicrotask(handlerContext, promiseReactionJobTask);
-      StaticAssert(
-          kPromiseReactionPromiseOrCapabilityOffset ==
-          kPromiseReactionJobTaskPromiseOrCapabilityOffset);
-    }
+        kPromiseReactionFulfillHandlerOffset ==
+        kPromiseReactionJobTaskHandlerOffset);
+    StaticAssert(
+        kPromiseReactionPromiseOrCapabilityOffset ==
+        kPromiseReactionJobTaskPromiseOrCapabilityOffset);
+  } else {
+    StaticAssert(reactionType == kPromiseReactionReject);
+    * UnsafeConstCast(& promiseReaction.map) =
+        PromiseRejectReactionJobTaskMapConstant();
+    const promiseReactionJobTask =
+        UnsafeCast<PromiseRejectReactionJobTask>(promiseReaction);
+    promiseReactionJobTask.argument = argument;
+    promiseReactionJobTask.context = handlerContext;
+    promiseReactionJobTask.handler = primaryHandler;
+    EnqueueMicrotask(handlerContext, promiseReactionJobTask);
+    StaticAssert(
+        kPromiseReactionPromiseOrCapabilityOffset ==
+        kPromiseReactionJobTaskPromiseOrCapabilityOffset);
   }
+}
 
-  // https://tc39.es/ecma262/#sec-triggerpromisereactions
-  transitioning macro TriggerPromiseReactions(implicit context: Context)(
-      reactions: Zero|PromiseReaction, argument: JSAny,
-      reactionType: constexpr PromiseReactionType): void {
-    // We need to reverse the {reactions} here, since we record them on the
-    // JSPromise in the reverse order.
-    let current = reactions;
-    let reversed: Zero|PromiseReaction = kZero;
-
-    // As an additional safety net against misuse of the V8 Extras API, we
-    // sanity check the {reactions} to make sure that they are actually
-    // PromiseReaction instances and not actual JavaScript values (which
-    // would indicate that we're rejecting or resolving an already settled
-    // promise), see https://crbug.com/931640 for details on this.
-    while (true) {
-      typeswitch (current) {
-        case (Zero): {
-          break;
-        }
-        case (currentReaction: PromiseReaction): {
-          current = currentReaction.next;
-          currentReaction.next = reversed;
-          reversed = currentReaction;
-        }
+// https://tc39.es/ecma262/#sec-triggerpromisereactions
+transitioning macro TriggerPromiseReactions(implicit context: Context)(
+    reactions: Zero|PromiseReaction, argument: JSAny,
+    reactionType: constexpr PromiseReactionType): void {
+  // We need to reverse the {reactions} here, since we record them on the
+  // JSPromise in the reverse order.
+  let current = reactions;
+  let reversed: Zero|PromiseReaction = kZero;
+
+  // As an additional safety net against misuse of the V8 Extras API, we
+  // sanity check the {reactions} to make sure that they are actually
+  // PromiseReaction instances and not actual JavaScript values (which
+  // would indicate that we're rejecting or resolving an already settled
+  // promise), see https://crbug.com/931640 for details on this.
+  while (true) {
+    typeswitch (current) {
+      case (Zero): {
+        break;
+      }
+      case (currentReaction: PromiseReaction): {
+        current = currentReaction.next;
+        currentReaction.next = reversed;
+        reversed = currentReaction;
       }
     }
-    // Morph the {reactions} into PromiseReactionJobTasks and push them
-    // onto the microtask queue.
-    current = reversed;
-    while (true) {
-      typeswitch (current) {
-        case (Zero): {
-          break;
-        }
-        case (currentReaction: PromiseReaction): {
-          current = currentReaction.next;
-          MorphAndEnqueuePromiseReaction(
-              currentReaction, argument, reactionType);
-        }
+  }
+  // Morph the {reactions} into PromiseReactionJobTasks and push them
+  // onto the microtask queue.
+  current = reversed;
+  while (true) {
+    typeswitch (current) {
+      case (Zero): {
+        break;
+      }
+      case (currentReaction: PromiseReaction): {
+        current = currentReaction.next;
+        MorphAndEnqueuePromiseReaction(currentReaction, argument, reactionType);
       }
     }
   }
+}
 
-  // https://tc39.es/ecma262/#sec-fulfillpromise
-  transitioning builtin
-  FulfillPromise(implicit context: Context)(promise: JSPromise, value: JSAny):
-      Undefined {
-    // Assert: The value of promise.[[PromiseState]] is "pending".
-    assert(promise.Status() == PromiseState::kPending);
+// https://tc39.es/ecma262/#sec-fulfillpromise
+transitioning builtin
+FulfillPromise(implicit context: Context)(
+    promise: JSPromise, value: JSAny): Undefined {
+  // Assert: The value of promise.[[PromiseState]] is "pending".
+  assert(promise.Status() == PromiseState::kPending);
 
-    // 2. Let reactions be promise.[[PromiseFulfillReactions]].
-    const reactions =
-        UnsafeCast<(Zero | PromiseReaction)>(promise.reactions_or_result);
+  // 2. Let reactions be promise.[[PromiseFulfillReactions]].
+  const reactions =
+      UnsafeCast<(Zero | PromiseReaction)>(promise.reactions_or_result);
 
-    // 3. Set promise.[[PromiseResult]] to value.
-    // 4. Set promise.[[PromiseFulfillReactions]] to undefined.
-    // 5. Set promise.[[PromiseRejectReactions]] to undefined.
-    promise.reactions_or_result = value;
+  // 3. Set promise.[[PromiseResult]] to value.
+  // 4. Set promise.[[PromiseFulfillReactions]] to undefined.
+  // 5. Set promise.[[PromiseRejectReactions]] to undefined.
+  promise.reactions_or_result = value;
 
-    // 6. Set promise.[[PromiseState]] to "fulfilled".
-    promise.SetStatus(PromiseState::kFulfilled);
+  // 6. Set promise.[[PromiseState]] to "fulfilled".
+  promise.SetStatus(PromiseState::kFulfilled);
+
+  // 7. Return TriggerPromiseReactions(reactions, value).
+  TriggerPromiseReactions(reactions, value, kPromiseReactionFulfill);
+  return Undefined;
+}
 
-    // 7. Return TriggerPromiseReactions(reactions, value).
-    TriggerPromiseReactions(reactions, value, kPromiseReactionFulfill);
-    return Undefined;
+extern macro PromiseBuiltinsAssembler::
+    IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate(): bool;
+
+// https://tc39.es/ecma262/#sec-rejectpromise
+transitioning builtin
+RejectPromise(implicit context: Context)(
+    promise: JSPromise, reason: JSAny, debugEvent: Boolean): JSAny {
+  // If promise hook is enabled or the debugger is active, let
+  // the runtime handle this operation, which greatly reduces
+  // the complexity here and also avoids a couple of back and
+  // forth between JavaScript and C++ land.
+  if (IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate() ||
+      !promise.HasHandler()) {
+    // 7. If promise.[[PromiseIsHandled]] is false, perform
+    //    HostPromiseRejectionTracker(promise, "reject").
+    // We don't try to handle rejecting {promise} without handler
+    // here, but we let the C++ code take care of this completely.
+    return runtime::RejectPromise(promise, reason, debugEvent);
   }
 
-  extern macro PromiseBuiltinsAssembler::
-      IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate(): bool;
-
-  // https://tc39.es/ecma262/#sec-rejectpromise
-  transitioning builtin
-  RejectPromise(implicit context: Context)(
-      promise: JSPromise, reason: JSAny, debugEvent: Boolean): JSAny {
-    // If promise hook is enabled or the debugger is active, let
-    // the runtime handle this operation, which greatly reduces
-    // the complexity here and also avoids a couple of back and
-    // forth between JavaScript and C++ land.
-    if (IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate() ||
-        !promise.HasHandler()) {
-      // 7. If promise.[[PromiseIsHandled]] is false, perform
-      //    HostPromiseRejectionTracker(promise, "reject").
-      // We don't try to handle rejecting {promise} without handler
-      // here, but we let the C++ code take care of this completely.
-      return runtime::RejectPromise(promise, reason, debugEvent);
-    }
+  // 2. Let reactions be promise.[[PromiseRejectReactions]].
+  const reactions =
+      UnsafeCast<(Zero | PromiseReaction)>(promise.reactions_or_result);
 
-    // 2. Let reactions be promise.[[PromiseRejectReactions]].
-    const reactions =
-        UnsafeCast<(Zero | PromiseReaction)>(promise.reactions_or_result);
+  // 3. Set promise.[[PromiseResult]] to reason.
+  // 4. Set promise.[[PromiseFulfillReactions]] to undefined.
+  // 5. Set promise.[[PromiseRejectReactions]] to undefined.
+  promise.reactions_or_result = reason;
 
-    // 3. Set promise.[[PromiseResult]] to reason.
-    // 4. Set promise.[[PromiseFulfillReactions]] to undefined.
-    // 5. Set promise.[[PromiseRejectReactions]] to undefined.
-    promise.reactions_or_result = reason;
+  // 6. Set promise.[[PromiseState]] to "rejected".
+  promise.SetStatus(PromiseState::kRejected);
 
-    // 6. Set promise.[[PromiseState]] to "rejected".
-    promise.SetStatus(PromiseState::kRejected);
+  // 8. Return TriggerPromiseReactions(reactions, reason).
+  TriggerPromiseReactions(reactions, reason, kPromiseReactionReject);
+  return Undefined;
+}
 
-    // 8. Return TriggerPromiseReactions(reactions, reason).
-    TriggerPromiseReactions(reactions, reason, kPromiseReactionReject);
-    return Undefined;
-  }
+const kPromiseCapabilitySize:
+    constexpr int31 generates 'PromiseCapability::kSize';
+const kPromiseBuiltinsCapabilitiesContextLength: constexpr int31
+    generates 'PromiseBuiltins::kCapabilitiesContextLength';
+const kPromiseBuiltinsCapabilitySlot: constexpr ContextSlot
+    generates 'PromiseBuiltins::kCapabilitySlot';
+const kPromiseBuiltinsPromiseSlot: constexpr ContextSlot
+    generates 'PromiseBuiltins::kPromiseSlot';
+const kPromiseBuiltinsAlreadyResolvedSlot: constexpr ContextSlot
+    generates 'PromiseBuiltins::kAlreadyResolvedSlot';
+const kPromiseBuiltinsDebugEventSlot: constexpr ContextSlot
+    generates 'PromiseBuiltins::kDebugEventSlot';
+
+@export
+macro CreatePromiseCapabilitiesExecutorContext(
+    nativeContext: NativeContext, capability: PromiseCapability): Context {
+  const executorContext = AllocateSyntheticFunctionContext(
+      nativeContext, kPromiseBuiltinsCapabilitiesContextLength);
+
+  executorContext[kPromiseBuiltinsCapabilitySlot] = capability;
+  return executorContext;
+}
 
-  const kPromiseCapabilitySize:
-      constexpr int31 generates 'PromiseCapability::kSize';
-  const kPromiseBuiltinsCapabilitiesContextLength: constexpr int31
-  generates 'PromiseBuiltins::kCapabilitiesContextLength';
-  const kPromiseBuiltinsCapabilitySlot: constexpr ContextSlot
-  generates 'PromiseBuiltins::kCapabilitySlot';
-  const kPromiseBuiltinsPromiseSlot: constexpr ContextSlot
-  generates 'PromiseBuiltins::kPromiseSlot';
-  const kPromiseBuiltinsAlreadyResolvedSlot: constexpr ContextSlot
-  generates 'PromiseBuiltins::kAlreadyResolvedSlot';
-  const kPromiseBuiltinsDebugEventSlot: constexpr ContextSlot
-  generates 'PromiseBuiltins::kDebugEventSlot';
-
-  @export
-  macro CreatePromiseCapabilitiesExecutorContext(
-      nativeContext: NativeContext, capability: PromiseCapability): Context {
-    const executorContext = AllocateSyntheticFunctionContext(
-        nativeContext, kPromiseBuiltinsCapabilitiesContextLength);
-
-    executorContext[kPromiseBuiltinsCapabilitySlot] = capability;
-    return executorContext;
-  }
+@export
+macro CreatePromiseCapability(
+    promise: JSReceiver|Undefined, resolve: JSFunction|Undefined,
+    reject: JSFunction|Undefined): PromiseCapability {
+  return new PromiseCapability{
+    map: kPromiseCapabilityMap,
+    promise: promise,
+    resolve: resolve,
+    reject: reject
+  };
+}
 
-  @export
-  macro CreatePromiseCapability(
-      promise: JSReceiver|Undefined, resolve: JSFunction|Undefined,
-      reject: JSFunction|Undefined): PromiseCapability {
-    return new PromiseCapability{
-      map: kPromiseCapabilityMap,
-      promise: promise,
-      resolve: resolve,
-      reject: reject
-    };
-  }
+@export
+struct PromiseResolvingFunctions {
+  resolve: JSFunction;
+  reject: JSFunction;
+}
 
-  @export
-  struct PromiseResolvingFunctions {
-    resolve: JSFunction;
-    reject: JSFunction;
-  }
+@export
+macro CreatePromiseResolvingFunctions(implicit context: Context)(
+    promise: JSPromise, debugEvent: Object, nativeContext: NativeContext):
+    PromiseResolvingFunctions {
+  const promiseContext = CreatePromiseResolvingFunctionsContext(
+      promise, debugEvent, nativeContext);
+  const map = UnsafeCast<Map>(
+      nativeContext
+          [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
+  const resolveInfo = PromiseCapabilityDefaultResolveSharedFunConstant();
+
+  const resolve: JSFunction =
+      AllocateFunctionWithMapAndContext(map, resolveInfo, promiseContext);
+  const rejectInfo = PromiseCapabilityDefaultRejectSharedFunConstant();
+  const reject: JSFunction =
+      AllocateFunctionWithMapAndContext(map, rejectInfo, promiseContext);
+  return PromiseResolvingFunctions{resolve: resolve, reject: reject};
+}
 
-  @export
-  macro CreatePromiseResolvingFunctions(implicit context: Context)(
-      promise: JSPromise, debugEvent: Object, nativeContext: NativeContext):
-      PromiseResolvingFunctions {
-    const promiseContext = CreatePromiseResolvingFunctionsContext(
-        promise, debugEvent, nativeContext);
-    const map = UnsafeCast<Map>(
+transitioning macro
+InnerNewPromiseCapability(implicit context: Context)(
+    constructor: HeapObject, debugEvent: Object): PromiseCapability {
+  const nativeContext = LoadNativeContext(context);
+  if (TaggedEqual(
+          constructor,
+          nativeContext[NativeContextSlot::PROMISE_FUNCTION_INDEX])) {
+    const promise = NewJSPromise();
+
+    const pair =
+        CreatePromiseResolvingFunctions(promise, debugEvent, nativeContext);
+
+    return CreatePromiseCapability(promise, pair.resolve, pair.reject);
+  } else {
+    // We have to create the capability before the associated promise
+    // because the builtin PromiseConstructor uses the executor.
+    const capability = CreatePromiseCapability(Undefined, Undefined, Undefined);
+    const executorContext =
+        CreatePromiseCapabilitiesExecutorContext(nativeContext, capability);
+
+    const executorInfo = PromiseGetCapabilitiesExecutorSharedFunConstant();
+    const functionMap = UnsafeCast<Map>(
         nativeContext
             [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
-    const resolveInfo = UnsafeCast<SharedFunctionInfo>(
-        nativeContext[NativeContextSlot::
-                          PROMISE_CAPABILITY_DEFAULT_RESOLVE_SHARED_FUN_INDEX]);
-    const resolve: JSFunction =
-        AllocateFunctionWithMapAndContext(map, resolveInfo, promiseContext);
-    const rejectInfo = UnsafeCast<SharedFunctionInfo>(
-        nativeContext[NativeContextSlot::
-                          PROMISE_CAPABILITY_DEFAULT_REJECT_SHARED_FUN_INDEX]);
-    const reject: JSFunction =
-        AllocateFunctionWithMapAndContext(map, rejectInfo, promiseContext);
-    return PromiseResolvingFunctions{resolve: resolve, reject: reject};
-  }
+    const executor = AllocateFunctionWithMapAndContext(
+        functionMap, executorInfo, executorContext);
 
-  transitioning macro
-  InnerNewPromiseCapability(implicit context: Context)(
-      constructor: HeapObject, debugEvent: Object): PromiseCapability {
-    const nativeContext = LoadNativeContext(context);
-    if (TaggedEqual(
-            constructor,
-            nativeContext[NativeContextSlot::PROMISE_FUNCTION_INDEX])) {
-      const promise = NewJSPromise();
-
-      const pair =
-          CreatePromiseResolvingFunctions(promise, debugEvent, nativeContext);
-
-      return CreatePromiseCapability(promise, pair.resolve, pair.reject);
-    } else {
-      // We have to create the capability before the associated promise
-      // because the builtin PromiseConstructor uses the executor.
-      const capability =
-          CreatePromiseCapability(Undefined, Undefined, Undefined);
-      const executorContext =
-          CreatePromiseCapabilitiesExecutorContext(nativeContext, capability);
-
-      const executorInfo = UnsafeCast<SharedFunctionInfo>(
-          nativeContext[NativeContextSlot::
-                            PROMISE_GET_CAPABILITIES_EXECUTOR_SHARED_FUN]);
-      const functionMap = UnsafeCast<Map>(
-          nativeContext
-              [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
-      const executor = AllocateFunctionWithMapAndContext(
-          functionMap, executorInfo, executorContext);
-
-      const promiseConstructor = UnsafeCast<Constructor>(constructor);
-      const promise = Construct(promiseConstructor, executor);
-      capability.promise = promise;
-
-      if (!TaggedIsCallable(capability.resolve) ||
-          !TaggedIsCallable(capability.reject)) {
-        ThrowTypeError(MessageTemplate::kPromiseNonCallable);
-      }
-      return capability;
+    const promiseConstructor = UnsafeCast<Constructor>(constructor);
+    const promise = Construct(promiseConstructor, executor);
+    capability.promise = promise;
+
+    if (!Is<Callable>(capability.resolve) || !Is<Callable>(capability.reject)) {
+      ThrowTypeError(MessageTemplate::kPromiseNonCallable);
     }
+    return capability;
   }
+}
 
-  // https://tc39.es/ecma262/#sec-newpromisecapability
-  transitioning builtin
-  NewPromiseCapability(implicit context: Context)(
-      maybeConstructor: Object, debugEvent: Object): PromiseCapability {
-    typeswitch (maybeConstructor) {
-      case (Smi): {
+// https://tc39.es/ecma262/#sec-newpromisecapability
+transitioning builtin
+NewPromiseCapability(implicit context: Context)(
+    maybeConstructor: Object, debugEvent: Object): PromiseCapability {
+  typeswitch (maybeConstructor) {
+    case (Smi): {
+      ThrowTypeError(MessageTemplate::kNotConstructor, maybeConstructor);
+    }
+    case (constructor: HeapObject): {
+      if (!IsConstructor(constructor)) {
         ThrowTypeError(MessageTemplate::kNotConstructor, maybeConstructor);
       }
-      case (constructor: HeapObject): {
-        if (!IsConstructor(constructor)) {
-          ThrowTypeError(MessageTemplate::kNotConstructor, maybeConstructor);
-        }
-        return InnerNewPromiseCapability(constructor, debugEvent);
-      }
+      return InnerNewPromiseCapability(constructor, debugEvent);
     }
   }
+}
 
-  // https://tc39.es/ecma262/#sec-promise-reject-functions
-  transitioning javascript builtin
-  PromiseCapabilityDefaultReject(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(reason: JSAny): JSAny {
-    // 2. Let promise be F.[[Promise]].
-    const promise = UnsafeCast<JSPromise>(context[kPromiseBuiltinsPromiseSlot]);
-
-    // 3. Let alreadyResolved be F.[[AlreadyResolved]].
-    const alreadyResolved =
-        UnsafeCast<Boolean>(context[kPromiseBuiltinsAlreadyResolvedSlot]);
-
-    // 4. If alreadyResolved.[[Value]] is true, return undefined.
-    if (alreadyResolved == True) {
-      return runtime::PromiseRejectAfterResolved(promise, reason);
-    }
+// https://tc39.es/ecma262/#sec-promise-reject-functions
+transitioning javascript builtin
+PromiseCapabilityDefaultReject(
+    js-implicit context: NativeContext, receiver: JSAny)(reason: JSAny): JSAny {
+  // 2. Let promise be F.[[Promise]].
+  const promise = UnsafeCast<JSPromise>(context[kPromiseBuiltinsPromiseSlot]);
 
-    // 5. Set alreadyResolved.[[Value]] to true.
-    context[kPromiseBuiltinsAlreadyResolvedSlot] = True;
+  // 3. Let alreadyResolved be F.[[AlreadyResolved]].
+  const alreadyResolved =
+      UnsafeCast<Boolean>(context[kPromiseBuiltinsAlreadyResolvedSlot]);
 
-    // 6. Return RejectPromise(promise, reason).
-    const debugEvent =
-        UnsafeCast<Boolean>(context[kPromiseBuiltinsDebugEventSlot]);
-    return RejectPromise(promise, reason, debugEvent);
+  // 4. If alreadyResolved.[[Value]] is true, return undefined.
+  if (alreadyResolved == True) {
+    return runtime::PromiseRejectAfterResolved(promise, reason);
   }
 
-  // https://tc39.es/ecma262/#sec-promise-resolve-functions
-  transitioning javascript builtin
-  PromiseCapabilityDefaultResolve(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(resolution: JSAny): JSAny {
-    // 2. Let promise be F.[[Promise]].
-    const promise = UnsafeCast<JSPromise>(context[kPromiseBuiltinsPromiseSlot]);
-
-    // 3. Let alreadyResolved be F.[[AlreadyResolved]].
-    const alreadyResolved =
-        UnsafeCast<Boolean>(context[kPromiseBuiltinsAlreadyResolvedSlot]);
-
-    // 4. If alreadyResolved.[[Value]] is true, return undefined.
-    if (alreadyResolved == True) {
-      return runtime::PromiseResolveAfterResolved(promise, resolution);
-    }
+  // 5. Set alreadyResolved.[[Value]] to true.
+  context[kPromiseBuiltinsAlreadyResolvedSlot] = True;
 
-    // 5. Set alreadyResolved.[[Value]] to true.
-    context[kPromiseBuiltinsAlreadyResolvedSlot] = True;
+  // 6. Return RejectPromise(promise, reason).
+  const debugEvent =
+      UnsafeCast<Boolean>(context[kPromiseBuiltinsDebugEventSlot]);
+  return RejectPromise(promise, reason, debugEvent);
+}
 
-    // The rest of the logic (and the catch prediction) is
-    // encapsulated in the dedicated ResolvePromise builtin.
-    return ResolvePromise(context, promise, resolution);
+// https://tc39.es/ecma262/#sec-promise-resolve-functions
+transitioning javascript builtin
+PromiseCapabilityDefaultResolve(
+    js-implicit context: NativeContext,
+    receiver: JSAny)(resolution: JSAny): JSAny {
+  // 2. Let promise be F.[[Promise]].
+  const promise = UnsafeCast<JSPromise>(context[kPromiseBuiltinsPromiseSlot]);
+
+  // 3. Let alreadyResolved be F.[[AlreadyResolved]].
+  const alreadyResolved =
+      UnsafeCast<Boolean>(context[kPromiseBuiltinsAlreadyResolvedSlot]);
+
+  // 4. If alreadyResolved.[[Value]] is true, return undefined.
+  if (alreadyResolved == True) {
+    return runtime::PromiseResolveAfterResolved(promise, resolution);
   }
 
-  @export
-  transitioning macro PerformPromiseThenImpl(implicit context: Context)(
-      promise: JSPromise, onFulfilled: Callable|Undefined,
-      onRejected: Callable|Undefined,
-      resultPromiseOrCapability: JSPromise|PromiseCapability|Undefined): void {
-    if (promise.Status() == PromiseState::kPending) {
-      // The {promise} is still in "Pending" state, so we just record a new
-      // PromiseReaction holding both the onFulfilled and onRejected callbacks.
-      // Once the {promise} is resolved we decide on the concrete handler to
-      // push onto the microtask queue.
-      const handlerContext = ExtractHandlerContext(onFulfilled, onRejected);
-      const promiseReactions =
-          UnsafeCast<(Zero | PromiseReaction)>(promise.reactions_or_result);
-      const reaction = NewPromiseReaction(
-          handlerContext, promiseReactions, resultPromiseOrCapability,
-          onFulfilled, onRejected);
-      promise.reactions_or_result = reaction;
-    } else {
-      const reactionsOrResult = promise.reactions_or_result;
-      let microtask: PromiseReactionJobTask;
-      let handlerContext: Context;
-      if (promise.Status() == PromiseState::kFulfilled) {
-        handlerContext = ExtractHandlerContext(onFulfilled, onRejected);
-        microtask = NewPromiseFulfillReactionJobTask(
-            handlerContext, reactionsOrResult, onFulfilled,
+  // 5. Set alreadyResolved.[[Value]] to true.
+  context[kPromiseBuiltinsAlreadyResolvedSlot] = True;
+
+  // The rest of the logic (and the catch prediction) is
+  // encapsulated in the dedicated ResolvePromise builtin.
+  return ResolvePromise(context, promise, resolution);
+}
+
+@export
+transitioning macro PerformPromiseThenImpl(implicit context: Context)(
+    promise: JSPromise, onFulfilled: Callable|Undefined,
+    onRejected: Callable|Undefined,
+    resultPromiseOrCapability: JSPromise|PromiseCapability|Undefined): void {
+  if (promise.Status() == PromiseState::kPending) {
+    // The {promise} is still in "Pending" state, so we just record a new
+    // PromiseReaction holding both the onFulfilled and onRejected callbacks.
+    // Once the {promise} is resolved we decide on the concrete handler to
+    // push onto the microtask queue.
+    const handlerContext = ExtractHandlerContext(onFulfilled, onRejected);
+    const promiseReactions =
+        UnsafeCast<(Zero | PromiseReaction)>(promise.reactions_or_result);
+    const reaction = NewPromiseReaction(
+        handlerContext, promiseReactions, resultPromiseOrCapability,
+        onFulfilled, onRejected);
+    promise.reactions_or_result = reaction;
+  } else {
+    const reactionsOrResult = promise.reactions_or_result;
+    let microtask: PromiseReactionJobTask;
+    let handlerContext: Context;
+    if (promise.Status() == PromiseState::kFulfilled) {
+      handlerContext = ExtractHandlerContext(onFulfilled, onRejected);
+      microtask = NewPromiseFulfillReactionJobTask(
+          handlerContext, reactionsOrResult, onFulfilled,
+          resultPromiseOrCapability);
+    } else
+      deferred {
+        assert(promise.Status() == PromiseState::kRejected);
+        handlerContext = ExtractHandlerContext(onRejected, onFulfilled);
+        microtask = NewPromiseRejectReactionJobTask(
+            handlerContext, reactionsOrResult, onRejected,
             resultPromiseOrCapability);
-      } else
-        deferred {
-          assert(promise.Status() == PromiseState::kRejected);
-          handlerContext = ExtractHandlerContext(onRejected, onFulfilled);
-          microtask = NewPromiseRejectReactionJobTask(
-              handlerContext, reactionsOrResult, onRejected,
-              resultPromiseOrCapability);
-          if (!promise.HasHandler()) {
-            runtime::PromiseRevokeReject(promise);
-          }
+        if (!promise.HasHandler()) {
+          runtime::PromiseRevokeReject(promise);
         }
-      EnqueueMicrotask(handlerContext, microtask);
-    }
-    promise.SetHasHandler();
+      }
+    EnqueueMicrotask(handlerContext, microtask);
   }
+  promise.SetHasHandler();
+}
 
-  // https://tc39.es/ecma262/#sec-performpromisethen
-  transitioning builtin
-  PerformPromiseThen(implicit context: Context)(
-      promise: JSPromise, onFulfilled: Callable|Undefined,
-      onRejected: Callable|Undefined,
-      resultPromise: JSPromise|Undefined): JSAny {
-    PerformPromiseThenImpl(promise, onFulfilled, onRejected, resultPromise);
-    return resultPromise;
-  }
+// https://tc39.es/ecma262/#sec-performpromisethen
+transitioning builtin
+PerformPromiseThen(implicit context: Context)(
+    promise: JSPromise, onFulfilled: Callable|Undefined,
+    onRejected: Callable|Undefined, resultPromise: JSPromise|Undefined): JSAny {
+  PerformPromiseThenImpl(promise, onFulfilled, onRejected, resultPromise);
+  return resultPromise;
+}
 
-  // https://tc39.es/ecma262/#sec-promise-reject-functions
-  transitioning javascript builtin
-  PromiseReject(js-implicit context: NativeContext, receiver: JSAny)(
-      reason: JSAny): JSAny {
-    // 1. Let C be the this value.
-    // 2. If Type(C) is not Object, throw a TypeError exception.
-    const receiver = Cast<JSReceiver>(receiver) otherwise
-    ThrowTypeError(MessageTemplate::kCalledOnNonObject, 'PromiseReject');
-
-    const promiseFun = context[NativeContextSlot::PROMISE_FUNCTION_INDEX];
-    if (promiseFun == receiver) {
-      const promise = NewJSPromise(PromiseState::kRejected, reason);
-      runtime::PromiseRejectEventFromStack(promise, reason);
-      return promise;
-    } else {
-      // 3. Let promiseCapability be ? NewPromiseCapability(C).
-      const capability = NewPromiseCapability(receiver, True);
-
-      // 4. Perform ? Call(promiseCapability.[[Reject]], undefined, « r »).
-      const reject = UnsafeCast<Callable>(capability.reject);
-      Call(context, reject, Undefined, reason);
-
-      // 5. Return promiseCapability.[[Promise]].
-      return capability.promise;
-    }
-  }
+// https://tc39.es/ecma262/#sec-promise-reject-functions
+transitioning javascript builtin
+PromiseReject(
+    js-implicit context: NativeContext, receiver: JSAny)(reason: JSAny): JSAny {
+  // 1. Let C be the this value.
+  // 2. If Type(C) is not Object, throw a TypeError exception.
+  const receiver = Cast<JSReceiver>(receiver) otherwise
+  ThrowTypeError(MessageTemplate::kCalledOnNonObject, 'PromiseReject');
+
+  const promiseFun = context[NativeContextSlot::PROMISE_FUNCTION_INDEX];
+  if (promiseFun == receiver) {
+    const promise = NewJSPromise(PromiseState::kRejected, reason);
+    runtime::PromiseRejectEventFromStack(promise, reason);
+    return promise;
+  } else {
+    // 3. Let promiseCapability be ? NewPromiseCapability(C).
+    const capability = NewPromiseCapability(receiver, True);
 
-  const kPromiseExecutorAlreadyInvoked: constexpr MessageTemplate
-  generates 'MessageTemplate::kPromiseExecutorAlreadyInvoked';
-
-  // https://tc39.es/ecma262/#sec-getcapabilitiesexecutor-functions
-  transitioning javascript builtin
-  PromiseGetCapabilitiesExecutor(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(resolve: JSAny, reject: JSAny): JSAny {
-    const capability =
-        UnsafeCast<PromiseCapability>(context[kPromiseBuiltinsCapabilitySlot]);
-    if (capability.resolve != Undefined || capability.reject != Undefined)
-      deferred {
-        ThrowTypeError(kPromiseExecutorAlreadyInvoked);
-      }
+    // 4. Perform ? Call(promiseCapability.[[Reject]], undefined, « r »).
+    const reject = UnsafeCast<Callable>(capability.reject);
+    Call(context, reject, Undefined, reason);
 
-    capability.resolve = resolve;
-    capability.reject = reject;
-    return Undefined;
+    // 5. Return promiseCapability.[[Promise]].
+    return capability.promise;
   }
+}
 
-  transitioning macro CallResolve(implicit context: Context)(
-      constructor: Constructor, resolve: JSAny, value: JSAny): JSAny {
-    // Undefined can never be a valid value for the resolve function,
-    // instead it is used as a special marker for the fast path.
-    if (resolve == Undefined) {
-      return PromiseResolve(constructor, value);
-    } else
-      deferred {
-        return Call(context, UnsafeCast<Callable>(resolve), constructor, value);
-      }
-  }
+const kPromiseExecutorAlreadyInvoked: constexpr MessageTemplate
+    generates 'MessageTemplate::kPromiseExecutorAlreadyInvoked';
+
+// https://tc39.es/ecma262/#sec-getcapabilitiesexecutor-functions
+transitioning javascript builtin
+PromiseGetCapabilitiesExecutor(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    resolve: JSAny, reject: JSAny): JSAny {
+  const capability =
+      UnsafeCast<PromiseCapability>(context[kPromiseBuiltinsCapabilitySlot]);
+  if (capability.resolve != Undefined || capability.reject != Undefined)
+    deferred {
+      ThrowTypeError(kPromiseExecutorAlreadyInvoked);
+    }
 
-  transitioning javascript builtin
-  PromiseConstructorLazyDeoptContinuation(
-      js-implicit context: NativeContext, receiver: JSAny)(
-      promise: JSAny, reject: JSAny, exception: JSAny|TheHole,
-      _result: JSAny): JSAny {
-    typeswitch (exception) {
-      case (TheHole): {
-      }
-      case (e: JSAny): {
-        Call(context, reject, Undefined, e);
-      }
+  capability.resolve = resolve;
+  capability.reject = reject;
+  return Undefined;
+}
+
+transitioning macro CallResolve(implicit context: Context)(
+    constructor: Constructor, resolve: JSAny, value: JSAny): JSAny {
+  // Undefined can never be a valid value for the resolve function,
+  // instead it is used as a special marker for the fast path.
+  if (resolve == Undefined) {
+    return PromiseResolve(constructor, value);
+  } else
+    deferred {
+      return Call(context, UnsafeCast<Callable>(resolve), constructor, value);
+    }
+}
+
+transitioning javascript builtin
+PromiseConstructorLazyDeoptContinuation(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    promise: JSAny, reject: JSAny, exception: JSAny|TheHole,
+    _result: JSAny): JSAny {
+  typeswitch (exception) {
+    case (TheHole): {
+    }
+    case (e: JSAny): {
+      Call(context, reject, Undefined, e);
     }
-    return promise;
   }
+  return promise;
+}
+
+extern macro PromiseCapabilityDefaultRejectSharedFunConstant():
+    SharedFunctionInfo;
+extern macro PromiseCapabilityDefaultResolveSharedFunConstant():
+    SharedFunctionInfo;
+extern macro PromiseGetCapabilitiesExecutorSharedFunConstant():
+    SharedFunctionInfo;
 }
diff --git a/deps/v8/src/builtins/promise-all-element-closure.tq b/deps/v8/src/builtins/promise-all-element-closure.tq
index c320b24f036..2d779894cde 100644
--- a/deps/v8/src/builtins/promise-all-element-closure.tq
+++ b/deps/v8/src/builtins/promise-all-element-closure.tq
@@ -8,182 +8,160 @@
 
 namespace promise {
 
-  struct PromiseAllWrapResultAsFulfilledFunctor {
-    macro Call(_nativeContext: NativeContext, value: JSAny): JSAny {
-      return value;
-    }
+struct PromiseAllWrapResultAsFulfilledFunctor {
+  macro Call(_nativeContext: NativeContext, value: JSAny): JSAny {
+    return value;
   }
+}
 
-  struct PromiseAllSettledWrapResultAsFulfilledFunctor {
-    transitioning
-    macro Call(implicit context: Context)(
-        nativeContext: NativeContext, value: JSAny): JSAny {
-      // TODO(gsathya): Optimize the creation using a cached map to
-      // prevent transitions here.
-      // 9. Let obj be ! ObjectCreate(%ObjectPrototype%).
-      const objectFunction = UnsafeCast<JSFunction>(
-          nativeContext[NativeContextSlot::OBJECT_FUNCTION_INDEX]);
-      const objectFunctionMap =
-          UnsafeCast<Map>(objectFunction.prototype_or_initial_map);
-      const obj = AllocateJSObjectFromMap(objectFunctionMap);
-
-      // 10. Perform ! CreateDataProperty(obj, "status", "fulfilled").
-      FastCreateDataProperty(
-          obj, StringConstant('status'), StringConstant('fulfilled'));
-
-      // 11. Perform ! CreateDataProperty(obj, "value", x).
-      FastCreateDataProperty(obj, StringConstant('value'), value);
-      return obj;
-    }
+struct PromiseAllSettledWrapResultAsFulfilledFunctor {
+  transitioning
+  macro Call(implicit context: Context)(
+      nativeContext: NativeContext, value: JSAny): JSAny {
+    // TODO(gsathya): Optimize the creation using a cached map to
+    // prevent transitions here.
+    // 9. Let obj be ! ObjectCreate(%ObjectPrototype%).
+    const objectFunction = UnsafeCast<JSFunction>(
+        nativeContext[NativeContextSlot::OBJECT_FUNCTION_INDEX]);
+    const objectFunctionMap =
+        UnsafeCast<Map>(objectFunction.prototype_or_initial_map);
+    const obj = AllocateJSObjectFromMap(objectFunctionMap);
+
+    // 10. Perform ! CreateDataProperty(obj, "status", "fulfilled").
+    FastCreateDataProperty(
+        obj, StringConstant('status'), StringConstant('fulfilled'));
+
+    // 11. Perform ! CreateDataProperty(obj, "value", x).
+    FastCreateDataProperty(obj, StringConstant('value'), value);
+    return obj;
   }
+}
 
-  struct PromiseAllSettledWrapResultAsRejectedFunctor {
-    transitioning
-    macro Call(implicit context: Context)(
-        nativeContext: NativeContext, value: JSAny): JSAny {
-      // TODO(gsathya): Optimize the creation using a cached map to
-      // prevent transitions here.
-      // 9. Let obj be ! ObjectCreate(%ObjectPrototype%).
-      const objectFunction = UnsafeCast<JSFunction>(
-          nativeContext[NativeContextSlot::OBJECT_FUNCTION_INDEX]);
-      const objectFunctionMap =
-          UnsafeCast<Map>(objectFunction.prototype_or_initial_map);
-      const obj = AllocateJSObjectFromMap(objectFunctionMap);
-
-      // 10. Perform ! CreateDataProperty(obj, "status", "rejected").
-      FastCreateDataProperty(
-          obj, StringConstant('status'), StringConstant('rejected'));
-
-      // 11. Perform ! CreateDataProperty(obj, "reason", x).
-      FastCreateDataProperty(obj, StringConstant('reason'), value);
-      return obj;
-    }
+struct PromiseAllSettledWrapResultAsRejectedFunctor {
+  transitioning
+  macro Call(implicit context: Context)(
+      nativeContext: NativeContext, value: JSAny): JSAny {
+    // TODO(gsathya): Optimize the creation using a cached map to
+    // prevent transitions here.
+    // 9. Let obj be ! ObjectCreate(%ObjectPrototype%).
+    const objectFunction = UnsafeCast<JSFunction>(
+        nativeContext[NativeContextSlot::OBJECT_FUNCTION_INDEX]);
+    const objectFunctionMap =
+        UnsafeCast<Map>(objectFunction.prototype_or_initial_map);
+    const obj = AllocateJSObjectFromMap(objectFunctionMap);
+
+    // 10. Perform ! CreateDataProperty(obj, "status", "rejected").
+    FastCreateDataProperty(
+        obj, StringConstant('status'), StringConstant('rejected'));
+
+    // 11. Perform ! CreateDataProperty(obj, "reason", x).
+    FastCreateDataProperty(obj, StringConstant('reason'), value);
+    return obj;
   }
+}
 
-  extern macro LoadJSReceiverIdentityHash(Object): intptr labels IfNoHash;
+extern macro LoadJSReceiverIdentityHash(Object): intptr labels IfNoHash;
 
-  extern enum PromiseAllResolveElementContextSlots extends int31
-  constexpr 'PromiseBuiltins::PromiseAllResolveElementContextSlots' {
-    kPromiseAllResolveElementRemainingSlot,
-    kPromiseAllResolveElementCapabilitySlot,
-    kPromiseAllResolveElementValuesArraySlot,
-    kPromiseAllResolveElementLength
-  }
-  extern operator '[]=' macro StoreContextElement(
-      Context, constexpr PromiseAllResolveElementContextSlots, Object): void;
-  extern operator '[]' macro LoadContextElement(
-      Context, constexpr PromiseAllResolveElementContextSlots): Object;
-
-  const kPropertyArrayNoHashSentinel: constexpr int31
-  generates 'PropertyArray::kNoHashSentinel';
-
-  const kPropertyArrayHashFieldMax: constexpr int31
-  generates 'PropertyArray::HashField::kMax';
-
-  transitioning macro PromiseAllResolveElementClosure<F: type>(
-      implicit context:
-          Context)(value: JSAny, function: JSFunction, wrapResultFunctor: F):
-      JSAny {
-    // We use the {function}s context as the marker to remember whether this
-    // resolve element closure was already called. It points to the resolve
-    // element context (which is a FunctionContext) until it was called the
-    // first time, in which case we make it point to the native context here
-    // to mark this resolve element closure as done.
-    if (IsNativeContext(context)) deferred {
-        return Undefined;
-      }
-
-    assert(
-        context.length ==
-        PromiseAllResolveElementContextSlots::kPromiseAllResolveElementLength);
-    const nativeContext = LoadNativeContext(context);
-    function.context = nativeContext;
-
-    // Update the value depending on whether Promise.all or
-    // Promise.allSettled is called.
-    const updatedValue = wrapResultFunctor.Call(nativeContext, value);
-
-    // Determine the index from the {function}.
-    assert(kPropertyArrayNoHashSentinel == 0);
-    const identityHash =
-        LoadJSReceiverIdentityHash(function) otherwise unreachable;
-    assert(identityHash > 0);
-    const index = identityHash - 1;
-
-    // Check if we need to grow the [[ValuesArray]] to store {value} at {index}.
-    const valuesArray = UnsafeCast<JSArray>(
-        context[PromiseAllResolveElementContextSlots::
-                    kPromiseAllResolveElementValuesArraySlot]);
-    const elements = UnsafeCast<FixedArray>(valuesArray.elements);
-    const valuesLength = Convert<intptr>(valuesArray.length);
-    if (index < valuesLength) {
-      // The {index} is in bounds of the {values_array},
-      // just store the {value} and continue.
-      elements.objects[index] = updatedValue;
-    } else {
-      // Check if we need to grow the backing store.
-      const newLength = index + 1;
-      const elementsLength = elements.length_intptr;
-      if (index < elementsLength) {
-        // The {index} is within bounds of the {elements} backing store, so
-        // just store the {value} and update the "length" of the {values_array}.
-        valuesArray.length = Convert<Smi>(newLength);
-        elements.objects[index] = updatedValue;
-      } else
-        deferred {
-          // We need to grow the backing store to fit the {index} as well.
-          const newElementsLength = IntPtrMin(
-              CalculateNewElementsCapacity(newLength),
-              kPropertyArrayHashFieldMax + 1);
-          assert(index < newElementsLength);
-          assert(elementsLength < newElementsLength);
-          const newElements =
-              ExtractFixedArray(elements, 0, elementsLength, newElementsLength);
-          newElements.objects[index] = updatedValue;
-
-          // Update backing store and "length" on {values_array}.
-          valuesArray.elements = newElements;
-          valuesArray.length = Convert<Smi>(newLength);
-        }
+extern enum PromiseAllResolveElementContextSlots extends int31
+constexpr 'PromiseBuiltins::PromiseAllResolveElementContextSlots' {
+  kPromiseAllResolveElementRemainingSlot,
+  kPromiseAllResolveElementCapabilitySlot,
+  kPromiseAllResolveElementValuesSlot,
+  kPromiseAllResolveElementLength
+}
+extern operator '[]=' macro StoreContextElement(
+    Context, constexpr PromiseAllResolveElementContextSlots, Object): void;
+extern operator '[]' macro LoadContextElement(
+    Context, constexpr PromiseAllResolveElementContextSlots): Object;
+
+const kPropertyArrayNoHashSentinel: constexpr int31
+    generates 'PropertyArray::kNoHashSentinel';
+
+const kPropertyArrayHashFieldMax: constexpr int31
+    generates 'PropertyArray::HashField::kMax';
+
+transitioning macro PromiseAllResolveElementClosure<F: type>(
+    implicit context: Context)(
+    value: JSAny, function: JSFunction, wrapResultFunctor: F): JSAny {
+  // We use the {function}s context as the marker to remember whether this
+  // resolve element closure was already called. It points to the resolve
+  // element context (which is a FunctionContext) until it was called the
+  // first time, in which case we make it point to the native context here
+  // to mark this resolve element closure as done.
+  if (IsNativeContext(context)) deferred {
+      return Undefined;
     }
-    let remainingElementsCount =
-        UnsafeCast<Smi>(context[PromiseAllResolveElementContextSlots::
-                                    kPromiseAllResolveElementRemainingSlot]);
-    remainingElementsCount = remainingElementsCount - 1;
-    context[PromiseAllResolveElementContextSlots::
-                kPromiseAllResolveElementRemainingSlot] =
-        remainingElementsCount;
-    if (remainingElementsCount == 0) {
-      const capability = UnsafeCast<PromiseCapability>(
-          context[PromiseAllResolveElementContextSlots::
-                      kPromiseAllResolveElementCapabilitySlot]);
-      const resolve = UnsafeCast<JSAny>(capability.resolve);
-      Call(context, resolve, Undefined, valuesArray);
+
+  assert(
+      context.length ==
+      PromiseAllResolveElementContextSlots::kPromiseAllResolveElementLength);
+  const nativeContext = LoadNativeContext(context);
+  function.context = nativeContext;
+
+  // Update the value depending on whether Promise.all or
+  // Promise.allSettled is called.
+  const updatedValue = wrapResultFunctor.Call(nativeContext, value);
+
+  // Determine the index from the {function}.
+  assert(kPropertyArrayNoHashSentinel == 0);
+  const identityHash =
+      LoadJSReceiverIdentityHash(function) otherwise unreachable;
+  assert(identityHash > 0);
+  const index = identityHash - 1;
+
+  let remainingElementsCount =
+      UnsafeCast<Smi>(context[PromiseAllResolveElementContextSlots::
+                                  kPromiseAllResolveElementRemainingSlot]);
+
+  let values =
+      UnsafeCast<FixedArray>(context[PromiseAllResolveElementContextSlots::
+                                         kPromiseAllResolveElementValuesSlot]);
+  const newCapacity = index + 1;
+  if (newCapacity > values.length_intptr) deferred {
+      // This happens only when the promises are resolved during iteration.
+      values = ExtractFixedArray(values, 0, values.length_intptr, newCapacity);
+      context[PromiseAllResolveElementContextSlots::
+                  kPromiseAllResolveElementValuesSlot] = values;
     }
-    return Undefined;
-  }
+  values.objects[index] = updatedValue;
 
-  transitioning javascript builtin
-  PromiseAllResolveElementClosure(
-      js-implicit context: Context, receiver: JSAny,
-      target: JSFunction)(value: JSAny): JSAny {
-    return PromiseAllResolveElementClosure(
-        value, target, PromiseAllWrapResultAsFulfilledFunctor{});
+  remainingElementsCount = remainingElementsCount - 1;
+  context[PromiseAllResolveElementContextSlots::
+              kPromiseAllResolveElementRemainingSlot] = remainingElementsCount;
+  if (remainingElementsCount == 0) {
+    const capability = UnsafeCast<PromiseCapability>(
+        context[PromiseAllResolveElementContextSlots::
+                    kPromiseAllResolveElementCapabilitySlot]);
+    const resolve = UnsafeCast<JSAny>(capability.resolve);
+    const arrayMap = UnsafeCast<Map>(
+        nativeContext[NativeContextSlot::JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX]);
+    const valuesArray = NewJSArray(arrayMap, values);
+    Call(context, resolve, Undefined, valuesArray);
   }
+  return Undefined;
+}
 
-  transitioning javascript builtin
-  PromiseAllSettledResolveElementClosure(
-      js-implicit context: Context, receiver: JSAny,
-      target: JSFunction)(value: JSAny): JSAny {
-    return PromiseAllResolveElementClosure(
-        value, target, PromiseAllSettledWrapResultAsFulfilledFunctor{});
-  }
+transitioning javascript builtin
+PromiseAllResolveElementClosure(
+    js-implicit context: Context, receiver: JSAny,
+    target: JSFunction)(value: JSAny): JSAny {
+  return PromiseAllResolveElementClosure(
+      value, target, PromiseAllWrapResultAsFulfilledFunctor{});
+}
 
-  transitioning javascript builtin
-  PromiseAllSettledRejectElementClosure(
-      js-implicit context: Context, receiver: JSAny,
-      target: JSFunction)(value: JSAny): JSAny {
-    return PromiseAllResolveElementClosure(
-        value, target, PromiseAllSettledWrapResultAsRejectedFunctor{});
-  }
+transitioning javascript builtin
+PromiseAllSettledResolveElementClosure(
+    js-implicit context: Context, receiver: JSAny,
+    target: JSFunction)(value: JSAny): JSAny {
+  return PromiseAllResolveElementClosure(
+      value, target, PromiseAllSettledWrapResultAsFulfilledFunctor{});
+}
+
+transitioning javascript builtin
+PromiseAllSettledRejectElementClosure(
+    js-implicit context: Context, receiver: JSAny,
+    target: JSFunction)(value: JSAny): JSAny {
+  return PromiseAllResolveElementClosure(
+      value, target, PromiseAllSettledWrapResultAsRejectedFunctor{});
+}
 }
diff --git a/deps/v8/src/builtins/promise-all.tq b/deps/v8/src/builtins/promise-all.tq
index 19a16d8da85..a94292433f5 100644
--- a/deps/v8/src/builtins/promise-all.tq
+++ b/deps/v8/src/builtins/promise-all.tq
@@ -6,165 +6,154 @@
 #include 'src/builtins/builtins-promise-gen.h'
 
 namespace promise {
-  const kPromiseBuiltinsPromiseContextLength: constexpr int31
-  generates 'PromiseBuiltins::kPromiseContextLength';
-
-  // Creates the context used by all Promise.all resolve element closures,
-  // together with the values array. Since all closures for a single Promise.all
-  // call use the same context, we need to store the indices for the individual
-  // closures somewhere else (we put them into the identity hash field of the
-  // closures), and we also need to have a separate marker for when the closure
-  // was called already (we slap the native context onto the closure in that
-  // case to mark it's done).
-  macro CreatePromiseAllResolveElementContext(implicit context: Context)(
-      capability: PromiseCapability, nativeContext: NativeContext): Context {
-    // TODO(bmeurer): Manually fold this into a single allocation.
-    const arrayMap = UnsafeCast<Map>(
-        nativeContext[NativeContextSlot::JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX]);
-    const valuesArray = AllocateJSArray(
-        ElementsKind::PACKED_ELEMENTS, arrayMap, IntPtrConstant(0),
-        SmiConstant(0));
-    const resolveContext = AllocateSyntheticFunctionContext(
-        nativeContext,
-        PromiseAllResolveElementContextSlots::kPromiseAllResolveElementLength);
-    resolveContext[PromiseAllResolveElementContextSlots::
-                       kPromiseAllResolveElementRemainingSlot] = SmiConstant(1);
-    resolveContext[PromiseAllResolveElementContextSlots::
-                       kPromiseAllResolveElementCapabilitySlot] = capability;
-    resolveContext[PromiseAllResolveElementContextSlots::
-                       kPromiseAllResolveElementValuesArraySlot] = valuesArray;
-    return resolveContext;
-  }
+const kPromiseBuiltinsPromiseContextLength: constexpr int31
+    generates 'PromiseBuiltins::kPromiseContextLength';
+
+// Creates the context used by all Promise.all resolve element closures,
+// together with the values array. Since all closures for a single Promise.all
+// call use the same context, we need to store the indices for the individual
+// closures somewhere else (we put them into the identity hash field of the
+// closures), and we also need to have a separate marker for when the closure
+// was called already (we slap the native context onto the closure in that
+// case to mark it's done).
+macro CreatePromiseAllResolveElementContext(implicit context: Context)(
+    capability: PromiseCapability, nativeContext: NativeContext): Context {
+  const resolveContext = AllocateSyntheticFunctionContext(
+      nativeContext,
+      PromiseAllResolveElementContextSlots::kPromiseAllResolveElementLength);
+  resolveContext[PromiseAllResolveElementContextSlots::
+                     kPromiseAllResolveElementRemainingSlot] = SmiConstant(1);
+  resolveContext[PromiseAllResolveElementContextSlots::
+                     kPromiseAllResolveElementCapabilitySlot] = capability;
+  resolveContext[PromiseAllResolveElementContextSlots::
+                     kPromiseAllResolveElementValuesSlot] = kEmptyFixedArray;
+  return resolveContext;
+}
 
-  macro CreatePromiseAllResolveElementFunction(implicit context: Context)(
-      resolveElementContext: Context, index: Smi, nativeContext: NativeContext,
-      slotIndex: constexpr NativeContextSlot): JSFunction {
-    assert(index > 0);
-    assert(index < kPropertyArrayHashFieldMax);
-
-    const map = UnsafeCast<Map>(
-        nativeContext
-            [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
-    const resolveInfo =
-        UnsafeCast<SharedFunctionInfo>(nativeContext[slotIndex]);
-    const resolve = AllocateFunctionWithMapAndContext(
-        map, resolveInfo, resolveElementContext);
-
-    assert(kPropertyArrayNoHashSentinel == 0);
-    resolve.properties_or_hash = index;
-    return resolve;
-  }
+macro CreatePromiseAllResolveElementFunction(implicit context: Context)(
+    resolveElementContext: Context, index: Smi, nativeContext: NativeContext,
+    resolveFunction: SharedFunctionInfo): JSFunction {
+  assert(index > 0);
+  assert(index < kPropertyArrayHashFieldMax);
+
+  const map = UnsafeCast<Map>(
+      nativeContext
+          [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
+  const resolve = AllocateFunctionWithMapAndContext(
+      map, resolveFunction, resolveElementContext);
+
+  assert(kPropertyArrayNoHashSentinel == 0);
+  resolve.properties_or_hash = index;
+  return resolve;
+}
 
-  @export
-  macro CreatePromiseResolvingFunctionsContext(implicit context: Context)(
-      promise: JSPromise, debugEvent: Object, nativeContext: NativeContext):
-      Context {
-    const resolveContext = AllocateSyntheticFunctionContext(
-        nativeContext, kPromiseBuiltinsPromiseContextLength);
-    resolveContext[kPromiseBuiltinsPromiseSlot] = promise;
-    resolveContext[kPromiseBuiltinsAlreadyResolvedSlot] = False;
-    resolveContext[kPromiseBuiltinsDebugEventSlot] = debugEvent;
-    return resolveContext;
-  }
+@export
+macro CreatePromiseResolvingFunctionsContext(implicit context: Context)(
+    promise: JSPromise, debugEvent: Object, nativeContext: NativeContext):
+    Context {
+  const resolveContext = AllocateSyntheticFunctionContext(
+      nativeContext, kPromiseBuiltinsPromiseContextLength);
+  resolveContext[kPromiseBuiltinsPromiseSlot] = promise;
+  resolveContext[kPromiseBuiltinsAlreadyResolvedSlot] = False;
+  resolveContext[kPromiseBuiltinsDebugEventSlot] = debugEvent;
+  return resolveContext;
+}
 
-  macro IsPromiseThenLookupChainIntact(implicit context: Context)(
-      nativeContext: NativeContext, receiverMap: Map): bool {
-    if (IsForceSlowPath()) return false;
-    if (!IsJSPromiseMap(receiverMap)) return false;
-    if (receiverMap.prototype !=
-        nativeContext[NativeContextSlot::PROMISE_PROTOTYPE_INDEX])
-      return false;
-    return !IsPromiseThenProtectorCellInvalid();
-  }
+macro IsPromiseThenLookupChainIntact(implicit context: Context)(
+    nativeContext: NativeContext, receiverMap: Map): bool {
+  if (IsForceSlowPath()) return false;
+  if (!IsJSPromiseMap(receiverMap)) return false;
+  if (receiverMap.prototype !=
+      nativeContext[NativeContextSlot::PROMISE_PROTOTYPE_INDEX])
+    return false;
+  return !IsPromiseThenProtectorCellInvalid();
+}
 
-  struct PromiseAllResolveElementFunctor {
-    macro Call(implicit context: Context)(
-        resolveElementContext: Context, nativeContext: NativeContext,
-        index: Smi, _capability: PromiseCapability): Callable {
-      return CreatePromiseAllResolveElementFunction(
-          resolveElementContext, index, nativeContext,
-          NativeContextSlot::PROMISE_ALL_RESOLVE_ELEMENT_SHARED_FUN);
-    }
+struct PromiseAllResolveElementFunctor {
+  macro Call(implicit context: Context)(
+      resolveElementContext: Context, nativeContext: NativeContext, index: Smi,
+      _capability: PromiseCapability): Callable {
+    return CreatePromiseAllResolveElementFunction(
+        resolveElementContext, index, nativeContext,
+        PromiseAllResolveElementSharedFunConstant());
   }
+}
 
-  struct PromiseAllRejectElementFunctor {
-    macro Call(implicit context: Context)(
-        _resolveElementContext: Context, _nativeContext: NativeContext,
-        _index: Smi, capability: PromiseCapability): Callable {
-      return UnsafeCast<Callable>(capability.reject);
-    }
+struct PromiseAllRejectElementFunctor {
+  macro Call(implicit context: Context)(
+      _resolveElementContext: Context, _nativeContext: NativeContext,
+      _index: Smi, capability: PromiseCapability): Callable {
+    return UnsafeCast<Callable>(capability.reject);
   }
+}
 
-  struct PromiseAllSettledResolveElementFunctor {
-    macro Call(implicit context: Context)(
-        resolveElementContext: Context, nativeContext: NativeContext,
-        index: Smi, _capability: PromiseCapability): Callable {
-      return CreatePromiseAllResolveElementFunction(
-          resolveElementContext, index, nativeContext,
-          NativeContextSlot::PROMISE_ALL_SETTLED_RESOLVE_ELEMENT_SHARED_FUN);
-    }
+struct PromiseAllSettledResolveElementFunctor {
+  macro Call(implicit context: Context)(
+      resolveElementContext: Context, nativeContext: NativeContext, index: Smi,
+      _capability: PromiseCapability): Callable {
+    return CreatePromiseAllResolveElementFunction(
+        resolveElementContext, index, nativeContext,
+        PromiseAllSettledResolveElementSharedFunConstant());
   }
+}
 
-  struct PromiseAllSettledRejectElementFunctor {
-    macro Call(implicit context: Context)(
-        resolveElementContext: Context, nativeContext: NativeContext,
-        index: Smi, _capability: PromiseCapability): Callable {
-      return CreatePromiseAllResolveElementFunction(
-          resolveElementContext, index, nativeContext,
-          NativeContextSlot::PROMISE_ALL_SETTLED_REJECT_ELEMENT_SHARED_FUN);
-    }
+struct PromiseAllSettledRejectElementFunctor {
+  macro Call(implicit context: Context)(
+      resolveElementContext: Context, nativeContext: NativeContext, index: Smi,
+      _capability: PromiseCapability): Callable {
+    return CreatePromiseAllResolveElementFunction(
+        resolveElementContext, index, nativeContext,
+        PromiseAllSettledRejectElementSharedFunConstant());
   }
+}
 
-  transitioning macro PerformPromiseAll<F1: type, F2: type>(implicit context:
-                                                                  Context)(
-      constructor: JSReceiver, capability: PromiseCapability,
-      iter: iterator::IteratorRecord, createResolveElementFunctor: F1,
-      createRejectElementFunctor: F2): JSAny labels Reject(Object) {
-    const nativeContext = LoadNativeContext(context);
-    const promise = capability.promise;
-    const resolve = capability.resolve;
-    const reject = capability.reject;
-
-    // For catch prediction, don't treat the .then calls as handling it;
-    // instead, recurse outwards.
-    if (IsDebugActive()) deferred {
-        SetPropertyStrict(
-            context, reject, kPromiseForwardingHandlerSymbol, True);
-      }
+transitioning macro PerformPromiseAll<F1: type, F2: type>(
+    implicit context: Context)(
+    constructor: JSReceiver, capability: PromiseCapability,
+    iter: iterator::IteratorRecord, createResolveElementFunctor: F1,
+    createRejectElementFunctor: F2): JSAny labels
+Reject(Object) {
+  const nativeContext = LoadNativeContext(context);
+  const promise = capability.promise;
+  const resolve = capability.resolve;
+  const reject = capability.reject;
+
+  // For catch prediction, don't treat the .then calls as handling it;
+  // instead, recurse outwards.
+  if (IsDebugActive()) deferred {
+      SetPropertyStrict(context, reject, kPromiseForwardingHandlerSymbol, True);
+    }
 
-    const resolveElementContext =
-        CreatePromiseAllResolveElementContext(capability, nativeContext);
+  const resolveElementContext =
+      CreatePromiseAllResolveElementContext(capability, nativeContext);
 
-    let index: Smi = 1;
+  let index: Smi = 1;
 
-    // We can skip the "resolve" lookup on {constructor} if it's the
-    // Promise constructor and the Promise.resolve protector is intact,
-    // as that guards the lookup path for the "resolve" property on the
-    // Promise constructor.
-    let promiseResolveFunction: JSAny = Undefined;
+  // We can skip the "resolve" lookup on {constructor} if it's the
+  // Promise constructor and the Promise.resolve protector is intact,
+  // as that guards the lookup path for the "resolve" property on the
+  // Promise constructor.
+  let promiseResolveFunction: JSAny = Undefined;
+  try {
     try {
-      try {
-        if (!IsPromiseResolveLookupChainIntact(nativeContext, constructor)) {
-          // 5. Let _promiseResolve_ be ? Get(_constructor_, `"resolve"`).
-          let promiseResolve: JSAny;
-          try {
-            promiseResolve = GetProperty(constructor, kResolveString);
-          } catch (e) deferred {
-            iterator::IteratorCloseOnException(iter, e) otherwise Reject;
-          }
-
-          // 6. If IsCallable(_promiseResolve_) is *false*, throw a *TypeError*
-          // exception.
-          promiseResolveFunction = Cast<Callable>(promiseResolve)
-              otherwise ThrowTypeError(
-              MessageTemplate::kCalledNonCallable, 'resolve');
-        }
+      if (!IsPromiseResolveLookupChainIntact(nativeContext, constructor)) {
+        let promiseResolve: JSAny;
+
+        // 5. Let _promiseResolve_ be ? Get(_constructor_, `"resolve"`).
+        promiseResolve = GetProperty(constructor, kResolveString);
 
-        const fastIteratorResultMap = UnsafeCast<Map>(
-            nativeContext[NativeContextSlot::ITERATOR_RESULT_MAP_INDEX]);
-        while (true) {
-          let nextValue: JSAny;
+        // 6. If IsCallable(_promiseResolve_) is *false*, throw a *TypeError*
+        // exception.
+        promiseResolveFunction =
+            Cast<Callable>(promiseResolve) otherwise ThrowTypeError(
+                MessageTemplate::kCalledNonCallable, 'resolve');
+      }
 
+      const fastIteratorResultMap = UnsafeCast<Map>(
+          nativeContext[NativeContextSlot::ITERATOR_RESULT_MAP_INDEX]);
+      while (true) {
+        let nextValue: JSAny;
+        try {
           // Let next be IteratorStep(iteratorRecord.[[Iterator]]).
           // If next is an abrupt completion, set iteratorRecord.[[Done]] to
           // true. ReturnIfAbrupt(next).
@@ -176,209 +165,213 @@ namespace promise {
           // to true.
           // ReturnIfAbrupt(nextValue).
           nextValue = iterator::IteratorValue(next, fastIteratorResultMap);
+        } catch (e) {
+          goto Reject(e);
+        }
 
-          // Check if we reached the limit.
-          if (index == kPropertyArrayHashFieldMax) {
-            // If there are too many elements (currently more than 2**21-1),
-            // raise a RangeError here (which is caught directly and turned into
-            // a rejection) of the resulting promise. We could gracefully handle
-            // this case as well and support more than this number of elements
-            // by going to a separate function and pass the larger indices via a
-            // separate context, but it doesn't seem likely that we need this,
-            // and it's unclear how the rest of the system deals with 2**21 live
-            // Promises anyways.
-            try {
-              ThrowRangeError(MessageTemplate::kTooManyElementsInPromiseAll);
-            } catch (e) deferred {
-              iterator::IteratorCloseOnException(iter, e) otherwise Reject;
-            }
-          }
-
-          // Set remainingElementsCount.[[Value]] to
-          //     remainingElementsCount.[[Value]] + 1.
-          const remainingElementsCount =
-              UnsafeCast<Smi>(resolveElementContext
-                                  [PromiseAllResolveElementContextSlots::
-                                       kPromiseAllResolveElementRemainingSlot]);
-          resolveElementContext[PromiseAllResolveElementContextSlots::
-                                    kPromiseAllResolveElementRemainingSlot] =
-              remainingElementsCount + 1;
-
-          // Let resolveElement be CreateBuiltinFunction(steps,
-          //                                             « [[AlreadyCalled]],
-          //                                               [[Index]],
-          //                                               [[Values]],
-          //                                               [[Capability]],
-          //                                               [[RemainingElements]]
-          //                                               »).
-          // Set resolveElement.[[AlreadyCalled]] to a Record { [[Value]]: false
-          // }. Set resolveElement.[[Index]] to index. Set
-          // resolveElement.[[Values]] to values. Set
-          // resolveElement.[[Capability]] to resultCapability. Set
-          // resolveElement.[[RemainingElements]] to remainingElementsCount.
-          const resolveElementFun = createResolveElementFunctor.Call(
-              resolveElementContext, nativeContext, index, capability);
-          const rejectElementFun = createRejectElementFunctor.Call(
-              resolveElementContext, nativeContext, index, capability);
-
-          // We can skip the "resolve" lookup on the {constructor} as well as
-          // the "then" lookup on the result of the "resolve" call, and
-          // immediately chain continuation onto the {next_value} if:
-          //
-          //   (a) The {constructor} is the intrinsic %Promise% function, and
-          //       looking up "resolve" on {constructor} yields the initial
-          //       Promise.resolve() builtin, and
-          //   (b) the promise @@species protector cell is valid, meaning that
-          //       no one messed with the Symbol.species property on any
-          //       intrinsic promise or on the Promise.prototype, and
-          //   (c) the {next_value} is a JSPromise whose [[Prototype]] field
-          //       contains the intrinsic %PromisePrototype%, and
-          //   (d) we're not running with async_hooks or DevTools enabled.
-          //
-          // In that case we also don't need to allocate a chained promise for
-          // the PromiseReaction (aka we can pass undefined to
-          // PerformPromiseThen), since this is only necessary for DevTools and
-          // PromiseHooks.
-          if (promiseResolveFunction != Undefined ||
-              IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate() ||
-              IsPromiseSpeciesProtectorCellInvalid() || Is<Smi>(nextValue) ||
-              !IsPromiseThenLookupChainIntact(
-                  nativeContext, UnsafeCast<HeapObject>(nextValue).map)) {
-            try {
-              // Let nextPromise be ? Call(constructor, _promiseResolve_, «
-              // nextValue »).
-              const nextPromise = CallResolve(
-                  UnsafeCast<Constructor>(constructor), promiseResolveFunction,
-                  nextValue);
-
-              // Perform ? Invoke(nextPromise, "then", « resolveElement,
-              //                  resultCapability.[[Reject]] »).
-              const then = GetProperty(nextPromise, kThenString);
-              const thenResult = Call(
-                  nativeContext, then, nextPromise, resolveElementFun,
-                  rejectElementFun);
-
-              // For catch prediction, mark that rejections here are
-              // semantically handled by the combined Promise.
-              if (IsDebugActive() && Is<JSPromise>(thenResult)) deferred {
-                  SetPropertyStrict(
-                      context, thenResult, kPromiseHandledBySymbol, promise);
-                }
-            } catch (e) deferred {
-              iterator::IteratorCloseOnException(iter, e) otherwise Reject;
+        // Check if we reached the limit.
+        if (index == kPropertyArrayHashFieldMax) {
+          // If there are too many elements (currently more than 2**21-1),
+          // raise a RangeError here (which is caught below and turned into
+          // a rejection of the resulting promise). We could gracefully handle
+          // this case as well and support more than this number of elements
+          // by going to a separate function and pass the larger indices via a
+          // separate context, but it doesn't seem likely that we need this,
+          // and it's unclear how the rest of the system deals with 2**21 live
+          // Promises anyway.
+          ThrowRangeError(
+              MessageTemplate::kTooManyElementsInPromiseCombinator, 'all');
+        }
+
+        // Set remainingElementsCount.[[Value]] to
+        //     remainingElementsCount.[[Value]] + 1.
+        const remainingElementsCount = UnsafeCast<Smi>(
+            resolveElementContext[PromiseAllResolveElementContextSlots::
+                                      kPromiseAllResolveElementRemainingSlot]);
+        resolveElementContext[PromiseAllResolveElementContextSlots::
+                                  kPromiseAllResolveElementRemainingSlot] =
+            remainingElementsCount + 1;
+
+        // Let resolveElement be CreateBuiltinFunction(steps,
+        //                                             « [[AlreadyCalled]],
+        //                                               [[Index]],
+        //                                               [[Values]],
+        //                                               [[Capability]],
+        //                                               [[RemainingElements]]
+        //                                               »).
+        // Set resolveElement.[[AlreadyCalled]] to a Record { [[Value]]: false
+        // }. Set resolveElement.[[Index]] to index. Set
+        // resolveElement.[[Values]] to values. Set
+        // resolveElement.[[Capability]] to resultCapability. Set
+        // resolveElement.[[RemainingElements]] to remainingElementsCount.
+        const resolveElementFun = createResolveElementFunctor.Call(
+            resolveElementContext, nativeContext, index, capability);
+        const rejectElementFun = createRejectElementFunctor.Call(
+            resolveElementContext, nativeContext, index, capability);
+
+        // We can skip the "resolve" lookup on the {constructor} as well as
+        // the "then" lookup on the result of the "resolve" call, and
+        // immediately chain continuation onto the {next_value} if:
+        //
+        //   (a) The {constructor} is the intrinsic %Promise% function, and
+        //       looking up "resolve" on {constructor} yields the initial
+        //       Promise.resolve() builtin, and
+        //   (b) the promise @@species protector cell is valid, meaning that
+        //       no one messed with the Symbol.species property on any
+        //       intrinsic promise or on the Promise.prototype, and
+        //   (c) the {next_value} is a JSPromise whose [[Prototype]] field
+        //       contains the intrinsic %PromisePrototype%, and
+        //   (d) we're not running with async_hooks or DevTools enabled.
+        //
+        // In that case we also don't need to allocate a chained promise for
+        // the PromiseReaction (aka we can pass undefined to
+        // PerformPromiseThen), since this is only necessary for DevTools and
+        // PromiseHooks.
+        if (promiseResolveFunction != Undefined ||
+            IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate() ||
+            IsPromiseSpeciesProtectorCellInvalid() || Is<Smi>(nextValue) ||
+            !IsPromiseThenLookupChainIntact(
+                nativeContext, UnsafeCast<HeapObject>(nextValue).map)) {
+          // Let nextPromise be ? Call(constructor, _promiseResolve_, «
+          // nextValue »).
+          const nextPromise = CallResolve(
+              UnsafeCast<Constructor>(constructor), promiseResolveFunction,
+              nextValue);
+
+          // Perform ? Invoke(nextPromise, "then", « resolveElement,
+          //                  resultCapability.[[Reject]] »).
+          const then = GetProperty(nextPromise, kThenString);
+          const thenResult = Call(
+              nativeContext, then, nextPromise, resolveElementFun,
+              rejectElementFun);
+
+          // For catch prediction, mark that rejections here are
+          // semantically handled by the combined Promise.
+          if (IsDebugActive() && Is<JSPromise>(thenResult)) deferred {
+              SetPropertyStrict(
+                  context, thenResult, kPromiseHandledBySymbol, promise);
             }
-          } else {
-            PerformPromiseThenImpl(
-                UnsafeCast<JSPromise>(nextValue), resolveElementFun,
-                rejectElementFun, Undefined);
-          }
-
-          // Set index to index + 1.
-          index += 1;
+        } else {
+          PerformPromiseThenImpl(
+              UnsafeCast<JSPromise>(nextValue), resolveElementFun,
+              rejectElementFun, Undefined);
         }
+
+        // Set index to index + 1.
+        index += 1;
       }
+    } catch (e) deferred {
+      iterator::IteratorCloseOnException(iter);
+      goto Reject(e);
     }
-    label Done {}
-
-    // Set iteratorRecord.[[Done]] to true.
-    // Set remainingElementsCount.[[Value]] to
-    //    remainingElementsCount.[[Value]] - 1.
-    let remainingElementsCount = UnsafeCast<Smi>(
+  } label Done {}
+
+  // Set iteratorRecord.[[Done]] to true.
+  // Set remainingElementsCount.[[Value]] to
+  //    remainingElementsCount.[[Value]] - 1.
+  let remainingElementsCount = UnsafeCast<Smi>(
+      resolveElementContext[PromiseAllResolveElementContextSlots::
+                                kPromiseAllResolveElementRemainingSlot]);
+  remainingElementsCount -= 1;
+  resolveElementContext[PromiseAllResolveElementContextSlots::
+                            kPromiseAllResolveElementRemainingSlot] =
+      remainingElementsCount;
+  if (remainingElementsCount > 0) {
+    // Pre-allocate the backing store for the {values} to the desired
+    // capacity. We may already have elements in "values" - this happens
+    // when the Thenable calls the resolve callback immediately.
+    let values = UnsafeCast<FixedArray>(
         resolveElementContext[PromiseAllResolveElementContextSlots::
-                                  kPromiseAllResolveElementRemainingSlot]);
-    remainingElementsCount -= 1;
-    resolveElementContext[PromiseAllResolveElementContextSlots::
-                              kPromiseAllResolveElementRemainingSlot] =
-        remainingElementsCount;
-    if (remainingElementsCount > 0) {
-      // Pre-allocate the backing store for the {values_array} to the desired
-      // capacity here. We may already have elements here in case of some
-      // fancy Thenable that calls the resolve callback immediately, so we need
-      // to handle that correctly here.
-      const valuesArray = UnsafeCast<JSArray>(
+                                  kPromiseAllResolveElementValuesSlot]);
+    // 'index' is a 1-based index and incremented after every Promise. Later we
+    // use 'values' as a 0-based array, so capacity 'index - 1' is enough.
+    const newCapacity = SmiUntag(index) - 1;
+
+    const oldCapacity = values.length_intptr;
+    if (oldCapacity < newCapacity) {
+      values = ExtractFixedArray(values, 0, oldCapacity, newCapacity);
+      resolveElementContext[PromiseAllResolveElementContextSlots::
+                                kPromiseAllResolveElementValuesSlot] = values;
+    }
+  } else
+    deferred {
+      assert(remainingElementsCount == 0);
+      // If remainingElementsCount.[[Value]] is 0, then
+      //     Let valuesArray be CreateArrayFromList(values).
+      //     Perform ? Call(resultCapability.[[Resolve]], undefined,
+      //                    « valuesArray »).
+
+      const values = UnsafeCast<FixedArray>(
           resolveElementContext[PromiseAllResolveElementContextSlots::
-                                    kPromiseAllResolveElementValuesArraySlot]);
-      const oldElements = UnsafeCast<FixedArray>(valuesArray.elements);
-      const oldCapacity = oldElements.length_intptr;
-      const newCapacity = SmiUntag(index);
-      if (oldCapacity < newCapacity) {
-        valuesArray.elements =
-            ExtractFixedArray(oldElements, 0, oldCapacity, newCapacity);
-      }
-    } else
-      deferred {
-        // If remainingElementsCount.[[Value]] is 0, then
-        //     Let valuesArray be CreateArrayFromList(values).
-        //     Perform ? Call(resultCapability.[[Resolve]], undefined,
-        //                    « valuesArray »).
-        assert(remainingElementsCount == 0);
-        const valuesArray = UnsafeCast<JSAny>(
-            resolveElementContext
-                [PromiseAllResolveElementContextSlots::
-                     kPromiseAllResolveElementValuesArraySlot]);
-        Call(nativeContext, UnsafeCast<JSAny>(resolve), Undefined, valuesArray);
-      }
-
-    // Return resultCapability.[[Promise]].
-    return promise;
-  }
+                                    kPromiseAllResolveElementValuesSlot]);
+      const arrayMap = UnsafeCast<Map>(
+          nativeContext[NativeContextSlot::JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX]);
+      const valuesArray = NewJSArray(arrayMap, values);
+      Call(nativeContext, UnsafeCast<JSAny>(resolve), Undefined, valuesArray);
+    }
 
-  transitioning macro GeneratePromiseAll<F1: type, F2: type>(implicit context:
-                                                                   Context)(
-      receiver: JSAny, iterable: JSAny, createResolveElementFunctor: F1,
-      createRejectElementFunctor: F2): JSAny {
-    // Let C be the this value.
-    // If Type(C) is not Object, throw a TypeError exception.
-    const receiver = Cast<JSReceiver>(receiver)
-        otherwise ThrowTypeError(
-        MessageTemplate::kCalledOnNonObject, 'Promise.all');
-
-    // Let promiseCapability be ? NewPromiseCapability(C).
-    // Don't fire debugEvent so that forwarding the rejection through all does
-    // not trigger redundant ExceptionEvents
-    const capability = NewPromiseCapability(receiver, False);
+  // Return resultCapability.[[Promise]].
+  return promise;
+}
 
-    try {
-      try {
-        // Let iterator be GetIterator(iterable).
-        // IfAbruptRejectPromise(iterator, promiseCapability).
-        let i = iterator::GetIterator(iterable);
-
-        // Let result be PerformPromiseAll(iteratorRecord, C,
-        // promiseCapability). If result is an abrupt completion, then
-        //   If iteratorRecord.[[Done]] is false, let result be
-        //       IteratorClose(iterator, result).
-        //    IfAbruptRejectPromise(result, promiseCapability).
-        return PerformPromiseAll(
-            receiver, capability, i, createResolveElementFunctor,
-            createRejectElementFunctor) otherwise Reject;
-      } catch (e) deferred {
-        goto Reject(e);
-      }
-    }
-    label Reject(e: Object) deferred {
-      // Exception must be bound to a JS value.
-      const e = UnsafeCast<JSAny>(e);
-      const reject = UnsafeCast<JSAny>(capability.reject);
-      Call(context, reject, Undefined, e);
-      return capability.promise;
-    }
+transitioning macro GeneratePromiseAll<F1: type, F2: type>(
+    implicit context: Context)(
+    receiver: JSAny, iterable: JSAny, createResolveElementFunctor: F1,
+    createRejectElementFunctor: F2): JSAny {
+  // Let C be the this value.
+  // If Type(C) is not Object, throw a TypeError exception.
+  const receiver = Cast<JSReceiver>(receiver)
+      otherwise ThrowTypeError(MessageTemplate::kCalledOnNonObject, 'Promise.all');
+
+  // Let promiseCapability be ? NewPromiseCapability(C).
+  // Don't fire debugEvent so that forwarding the rejection through all does
+  // not trigger redundant ExceptionEvents
+  const capability = NewPromiseCapability(receiver, False);
+
+  try {
+    // Let iterator be GetIterator(iterable).
+    // IfAbruptRejectPromise(iterator, promiseCapability).
+    let i = iterator::GetIterator(iterable);
+
+    // Let result be PerformPromiseAll(iteratorRecord, C,
+    // promiseCapability). If result is an abrupt completion, then
+    //   If iteratorRecord.[[Done]] is false, let result be
+    //       IteratorClose(iterator, result).
+    //    IfAbruptRejectPromise(result, promiseCapability).
+    return PerformPromiseAll(
+        receiver, capability, i, createResolveElementFunctor,
+        createRejectElementFunctor) otherwise Reject;
+  } catch (e) deferred {
+    goto Reject(e);
+  } label Reject(e: Object) deferred {
+    // Exception must be bound to a JS value.
+    const e = UnsafeCast<JSAny>(e);
+    const reject = UnsafeCast<JSAny>(capability.reject);
+    Call(context, reject, Undefined, e);
+    return capability.promise;
   }
+}
 
-  // ES#sec-promise.all
-  transitioning javascript builtin PromiseAll(
-      js-implicit context: Context, receiver: JSAny)(iterable: JSAny): JSAny {
-    return GeneratePromiseAll(
-        receiver, iterable, PromiseAllResolveElementFunctor{},
-        PromiseAllRejectElementFunctor{});
-  }
+// ES#sec-promise.all
+transitioning javascript builtin PromiseAll(
+    js-implicit context: Context, receiver: JSAny)(iterable: JSAny): JSAny {
+  return GeneratePromiseAll(
+      receiver, iterable, PromiseAllResolveElementFunctor{},
+      PromiseAllRejectElementFunctor{});
+}
 
-  // ES#sec-promise.allsettled
-  // Promise.allSettled ( iterable )
-  transitioning javascript builtin PromiseAllSettled(
-      js-implicit context: Context, receiver: JSAny)(iterable: JSAny): JSAny {
-    return GeneratePromiseAll(
-        receiver, iterable, PromiseAllSettledResolveElementFunctor{},
-        PromiseAllSettledRejectElementFunctor{});
-  }
+// ES#sec-promise.allsettled
+// Promise.allSettled ( iterable )
+transitioning javascript builtin PromiseAllSettled(
+    js-implicit context: Context, receiver: JSAny)(iterable: JSAny): JSAny {
+  return GeneratePromiseAll(
+      receiver, iterable, PromiseAllSettledResolveElementFunctor{},
+      PromiseAllSettledRejectElementFunctor{});
+}
+
+extern macro PromiseAllResolveElementSharedFunConstant(): SharedFunctionInfo;
+extern macro PromiseAllSettledRejectElementSharedFunConstant():
+    SharedFunctionInfo;
+extern macro PromiseAllSettledResolveElementSharedFunConstant():
+    SharedFunctionInfo;
 }
diff --git a/deps/v8/src/builtins/promise-any.tq b/deps/v8/src/builtins/promise-any.tq
new file mode 100644
index 00000000000..36b2d6f3d54
--- /dev/null
+++ b/deps/v8/src/builtins/promise-any.tq
@@ -0,0 +1,373 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-promise-gen.h'
+
+namespace promise {
+extern enum PromiseAnyRejectElementContextSlots extends int31
+constexpr 'PromiseBuiltins::PromiseAnyRejectElementContextSlots' {
+  kPromiseAnyRejectElementRemainingSlot,
+  kPromiseAnyRejectElementCapabilitySlot,
+  kPromiseAnyRejectElementErrorsSlot,
+  kPromiseAnyRejectElementLength
+}
+
+extern operator '[]=' macro StoreContextElement(
+    Context, constexpr PromiseAnyRejectElementContextSlots, Object): void;
+extern operator '[]' macro LoadContextElement(
+    Context, constexpr PromiseAnyRejectElementContextSlots): Object;
+
+// Creates the context used by all Promise.any reject element closures,
+// together with the errors array. Since all closures for a single Promise.any
+// call use the same context, we need to store the indices for the individual
+// closures somewhere else (we put them into the identity hash field of the
+// closures), and we also need to have a separate marker for when the closure
+// was called already (we slap the native context onto the closure in that
+// case to mark it's done). See Promise.all which uses the same approach.
+transitioning macro CreatePromiseAnyRejectElementContext(
+    implicit context: Context)(
+    capability: PromiseCapability, nativeContext: NativeContext): Context {
+  const rejectContext = AllocateSyntheticFunctionContext(
+      nativeContext,
+      PromiseAnyRejectElementContextSlots::kPromiseAnyRejectElementLength);
+  rejectContext[PromiseAnyRejectElementContextSlots::
+                    kPromiseAnyRejectElementRemainingSlot] = SmiConstant(1);
+  rejectContext[PromiseAnyRejectElementContextSlots::
+                    kPromiseAnyRejectElementCapabilitySlot] = capability;
+  rejectContext[PromiseAnyRejectElementContextSlots::
+                    kPromiseAnyRejectElementErrorsSlot] = kEmptyFixedArray;
+  return rejectContext;
+}
+
+macro CreatePromiseAnyRejectElementFunction(implicit context: Context)(
+    rejectElementContext: Context, index: Smi,
+    nativeContext: NativeContext): JSFunction {
+  assert(index > 0);
+  assert(index < kPropertyArrayHashFieldMax);
+  const map = UnsafeCast<Map>(
+      nativeContext
+          [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
+  const rejectInfo = PromiseAnyRejectElementSharedFunConstant();
+  const reject =
+      AllocateFunctionWithMapAndContext(map, rejectInfo, rejectElementContext);
+  assert(kPropertyArrayNoHashSentinel == 0);
+  reject.properties_or_hash = index;
+  return reject;
+}
+
+// https://tc39.es/proposal-promise-any/#sec-promise.any-reject-element-functions
+transitioning javascript builtin
+PromiseAnyRejectElementClosure(
+    js-implicit context: Context, receiver: JSAny,
+    target: JSFunction)(value: JSAny): JSAny {
+  // 1. Let F be the active function object.
+
+  // 2. Let alreadyCalled be F.[[AlreadyCalled]].
+
+  // 3. If alreadyCalled.[[Value]] is true, return undefined.
+
+  // We use the function's context as the marker to remember whether this
+  // reject element closure was already called. It points to the reject
+  // element context (which is a FunctionContext) until it was called the
+  // first time, in which case we make it point to the native context here
+  // to mark this reject element closure as done.
+  if (IsNativeContext(context)) deferred {
+      return Undefined;
+    }
+
+  assert(
+      context.length ==
+      PromiseAnyRejectElementContextSlots::kPromiseAnyRejectElementLength);
+
+  // 4. Set alreadyCalled.[[Value]] to true.
+  const nativeContext = LoadNativeContext(context);
+  target.context = nativeContext;
+
+  // 5. Let index be F.[[Index]].
+  assert(kPropertyArrayNoHashSentinel == 0);
+  const identityHash = LoadJSReceiverIdentityHash(target) otherwise unreachable;
+  assert(identityHash > 0);
+  const index = identityHash - 1;
+
+  // 6. Let errors be F.[[Errors]].
+  let errors =
+      UnsafeCast<FixedArray>(context[PromiseAnyRejectElementContextSlots::
+                                         kPromiseAnyRejectElementErrorsSlot]);
+
+  // 7. Let promiseCapability be F.[[Capability]].
+
+  // 8. Let remainingElementsCount be F.[[RemainingElements]].
+  let remainingElementsCount =
+      UnsafeCast<Smi>(context[PromiseAnyRejectElementContextSlots::
+                                  kPromiseAnyRejectElementRemainingSlot]);
+
+  // 9. Set errors[index] to x.
+  const newCapacity = IntPtrMax(SmiUntag(remainingElementsCount), index + 1);
+  if (newCapacity > errors.length_intptr) deferred {
+      errors = ExtractFixedArray(errors, 0, errors.length_intptr, newCapacity);
+      context[PromiseAnyRejectElementContextSlots::
+                  kPromiseAnyRejectElementErrorsSlot] = errors;
+    }
+  errors.objects[index] = value;
+
+  // 10. Set remainingElementsCount.[[Value]] to
+  // remainingElementsCount.[[Value]] - 1.
+  remainingElementsCount = remainingElementsCount - 1;
+  context[PromiseAnyRejectElementContextSlots::
+              kPromiseAnyRejectElementRemainingSlot] = remainingElementsCount;
+
+  // 11. If remainingElementsCount.[[Value]] is 0, then
+  if (remainingElementsCount == 0) {
+    //   a. Let error be a newly created AggregateError object.
+
+    //   b. Set error.[[AggregateErrors]] to errors.
+    const error = ConstructAggregateError(errors);
+    //   c. Return ? Call(promiseCapability.[[Reject]], undefined, « error »).
+    const capability = UnsafeCast<PromiseCapability>(
+        context[PromiseAnyRejectElementContextSlots::
+                    kPromiseAnyRejectElementCapabilitySlot]);
+    Call(context, UnsafeCast<Callable>(capability.reject), Undefined, error);
+  }
+
+  // 12. Return undefined.
+  return Undefined;
+}
+
+transitioning macro PerformPromiseAny(implicit context: Context)(
+    iteratorRecord: iterator::IteratorRecord, constructor: Constructor,
+    resultCapability: PromiseCapability): JSAny labels
+Reject(Object) {
+  // 1. Assert: ! IsConstructor(constructor) is true.
+  // 2. Assert: resultCapability is a PromiseCapability Record.
+
+  const nativeContext = LoadNativeContext(context);
+
+  // 3. Let errors be a new empty List. (Do nothing: errors is
+  // initialized lazily when the first Promise rejects.)
+
+  // 4. Let remainingElementsCount be a new Record { [[Value]]: 1 }.
+  const rejectElementContext =
+      CreatePromiseAnyRejectElementContext(resultCapability, nativeContext);
+
+  // 5. Let index be 0.
+  //    (We subtract 1 in the PromiseAnyRejectElementClosure).
+  let index: Smi = 1;
+
+  try {
+    // We can skip the "resolve" lookup on {constructor} if it's the
+    // Promise constructor and the Promise.resolve protector is intact,
+    // as that guards the lookup path for the "resolve" property on the
+    // Promise constructor.
+    let promiseResolveFunction: JSAny = Undefined;
+    if (!IsPromiseResolveLookupChainIntact(nativeContext, constructor))
+      deferred {
+        // 6. Let promiseResolve be ? Get(constructor, `"resolve"`).
+        const promiseResolve = GetProperty(constructor, kResolveString);
+        // 7. If IsCallable(promiseResolve) is false, throw a
+        // TypeError exception.
+        promiseResolveFunction = Cast<Callable>(promiseResolve)
+            otherwise ThrowTypeError(
+            MessageTemplate::kCalledNonCallable, 'resolve');
+      }
+    const fastIteratorResultMap = UnsafeCast<Map>(
+        nativeContext[NativeContextSlot::ITERATOR_RESULT_MAP_INDEX]);
+    // 8. Repeat,
+    while (true) {
+      let nextValue: JSAny;
+      try {
+        // a. Let next be IteratorStep(iteratorRecord).
+
+        // b. If next is an abrupt completion, set
+        // iteratorRecord.[[Done]] to true.
+
+        // c. ReturnIfAbrupt(next).
+
+        // d. if next is false, then [continues below in "Done"]
+        const next: JSReceiver = iterator::IteratorStep(
+            iteratorRecord, fastIteratorResultMap) otherwise goto Done;
+        // e. Let nextValue be IteratorValue(next).
+
+        // f. If nextValue is an abrupt completion, set
+        // iteratorRecord.[[Done]] to true.
+
+        // g. ReturnIfAbrupt(nextValue).
+        nextValue = iterator::IteratorValue(next, fastIteratorResultMap);
+      } catch (e) {
+        goto Reject(e);
+      }
+
+      // We store the indices as identity hash on the reject element
+      // closures. Thus, we need this limit.
+      if (index == kPropertyArrayHashFieldMax) {
+        // If there are too many elements (currently more than
+        // 2**21-1), raise a RangeError here (which is caught later and
+        // turned into a rejection of the resulting promise). We could
+        // gracefully handle this case as well and support more than
+        // this number of elements by going to a separate function and
+        // pass the larger indices via a separate context, but it
+        // doesn't seem likely that we need this, and it's unclear how
+        // the rest of the system deals with 2**21 live Promises
+        // anyway.
+        ThrowRangeError(
+            MessageTemplate::kTooManyElementsInPromiseCombinator, 'any');
+      }
+
+      // h. Append undefined to errors. (Do nothing: errors is initialized
+      // lazily when the first Promise rejects.)
+
+      let nextPromise: JSAny;
+      // i. Let nextPromise be ? Call(constructor, promiseResolve,
+      // «nextValue »).
+      nextPromise = CallResolve(constructor, promiseResolveFunction, nextValue);
+
+      // j. Let steps be the algorithm steps defined in Promise.any
+      // Reject Element Functions.
+
+      // k. Let rejectElement be ! CreateBuiltinFunction(steps, «
+      // [[AlreadyCalled]], [[Index]],
+      // [[Errors]], [[Capability]], [[RemainingElements]] »).
+
+      // l. Set rejectElement.[[AlreadyCalled]] to a new Record {
+      // [[Value]]: false }.
+
+      // m. Set rejectElement.[[Index]] to index.
+
+      // n. Set rejectElement.[[Errors]] to errors.
+
+      // o. Set rejectElement.[[Capability]] to resultCapability.
+
+      // p. Set rejectElement.[[RemainingElements]] to
+      // remainingElementsCount.
+      const rejectElement = CreatePromiseAnyRejectElementFunction(
+          rejectElementContext, index, nativeContext);
+      // q. Set remainingElementsCount.[[Value]] to
+      // remainingElementsCount.[[Value]] + 1.
+      const remainingElementsCount = UnsafeCast<Smi>(
+          rejectElementContext[PromiseAnyRejectElementContextSlots::
+                                   kPromiseAnyRejectElementRemainingSlot]);
+      rejectElementContext[PromiseAnyRejectElementContextSlots::
+                               kPromiseAnyRejectElementRemainingSlot] =
+          remainingElementsCount + 1;
+
+      // r. Perform ? Invoke(nextPromise, "then", «
+      // resultCapability.[[Resolve]], rejectElement »).
+      let thenResult: JSAny;
+
+      const then = GetProperty(nextPromise, kThenString);
+      thenResult = Call(
+          context, then, nextPromise,
+          UnsafeCast<JSAny>(resultCapability.resolve), rejectElement);
+
+      // s. Increase index by 1.
+      index += 1;
+
+      // For catch prediction, mark that rejections here are
+      // semantically handled by the combined Promise.
+      if (IsDebugActive() && Is<JSPromise>(thenResult)) deferred {
+          SetPropertyStrict(
+              context, thenResult, kPromiseHandledBySymbol,
+              resultCapability.promise);
+          SetPropertyStrict(
+              context, rejectElement, kPromiseForwardingHandlerSymbol, True);
+        }
+    }
+  } catch (e) deferred {
+    iterator::IteratorCloseOnException(iteratorRecord);
+    goto Reject(e);
+  } label Done {}
+
+  // (8.d)
+  //   i. Set iteratorRecord.[[Done]] to true.
+  //  ii. Set remainingElementsCount.[[Value]] to
+  //  remainingElementsCount.[[Value]] - 1.
+  let remainingElementsCount = UnsafeCast<Smi>(
+      rejectElementContext[PromiseAnyRejectElementContextSlots::
+                               kPromiseAnyRejectElementRemainingSlot]);
+  remainingElementsCount -= 1;
+  rejectElementContext[PromiseAnyRejectElementContextSlots::
+                           kPromiseAnyRejectElementRemainingSlot] =
+      remainingElementsCount;
+
+  // iii. If remainingElementsCount.[[Value]] is 0, then
+  if (remainingElementsCount == 0) deferred {
+      // 1. Let error be a newly created AggregateError object.
+      // 2. Set error.[[AggregateErrors]] to errors.
+
+      // We may already have elements in "errors" - this happens when the
+      // Thenable calls the reject callback immediately.
+      const errors = UnsafeCast<FixedArray>(
+          rejectElementContext[PromiseAnyRejectElementContextSlots::
+                                   kPromiseAnyRejectElementErrorsSlot]);
+
+      const error = ConstructAggregateError(errors);
+      // 3. Return ThrowCompletion(error).
+      goto Reject(error);
+    }
+  // iv. Return resultCapability.[[Promise]].
+  return resultCapability.promise;
+}
+
+// https://tc39.es/proposal-promise-any/#sec-promise.any
+transitioning javascript builtin
+PromiseAny(
+    js-implicit context: Context, receiver: JSAny)(iterable: JSAny): JSAny {
+  // 1. Let C be the this value.
+  const receiver = Cast<JSReceiver>(receiver)
+      otherwise ThrowTypeError(MessageTemplate::kCalledOnNonObject, 'Promise.any');
+
+  // 2. Let promiseCapability be ? NewPromiseCapability(C).
+  const capability = NewPromiseCapability(receiver, False);
+
+  // NewPromiseCapability guarantees that receiver is Constructor
+  assert(Is<Constructor>(receiver));
+  const constructor = UnsafeCast<Constructor>(receiver);
+
+  try {
+    let iteratorRecord: iterator::IteratorRecord;
+    try {
+      // 3. Let iteratorRecord be GetIterator(iterable).
+
+      // 4. IfAbruptRejectPromise(iteratorRecord, promiseCapability).
+      // (catch below)
+      iteratorRecord = iterator::GetIterator(iterable);
+
+      // 5. Let result be PerformPromiseAny(iteratorRecord, C,
+      // promiseCapability).
+
+      // 6. If result is an abrupt completion, then
+
+      //   a. If iteratorRecord.[[Done]] is false, set result to
+      //   IteratorClose(iteratorRecord, result).
+
+      //   b. IfAbruptRejectPromise(result, promiseCapability).
+
+      // [Iterator closing handled by PerformPromiseAny]
+
+      // 7. Return Completion(result).
+      return PerformPromiseAny(iteratorRecord, constructor, capability)
+          otherwise Reject;
+    } catch (e) deferred {
+      goto Reject(e);
+    }
+  } label Reject(e: Object) deferred {
+    // Exception must be bound to a JS value.
+    assert(e != TheHole);
+    Call(
+        context, UnsafeCast<Callable>(capability.reject), Undefined,
+        UnsafeCast<JSAny>(e));
+    return capability.promise;
+  }
+}
+
+transitioning macro ConstructAggregateError(implicit context: Context)(
+    errors: FixedArray): JSObject {
+  const obj: JSObject = error::ConstructInternalAggregateErrorHelper(
+      context, SmiConstant(MessageTemplate::kAllPromisesRejected));
+  const errorsJSArray = array::CreateJSArrayWithElements(errors);
+  CreateDataProperty(obj, ErrorsStringConstant(), errorsJSArray);
+  return obj;
+}
+
+extern macro PromiseAnyRejectElementSharedFunConstant(): SharedFunctionInfo;
+}
diff --git a/deps/v8/src/builtins/promise-constructor.tq b/deps/v8/src/builtins/promise-constructor.tq
index dc0e077485c..dbf1fe2f4de 100644
--- a/deps/v8/src/builtins/promise-constructor.tq
+++ b/deps/v8/src/builtins/promise-constructor.tq
@@ -6,104 +6,104 @@
 #include 'src/builtins/builtins-promise-gen.h'
 
 namespace runtime {
-  extern transitioning runtime
-  DebugPushPromise(implicit context: Context)(JSAny): JSAny;
+extern transitioning runtime
+DebugPushPromise(implicit context: Context)(JSAny): JSAny;
 
-  extern transitioning runtime
-  DebugPopPromise(implicit context: Context)(): JSAny;
+extern transitioning runtime
+DebugPopPromise(implicit context: Context)(): JSAny;
 
-  extern transitioning runtime
-  PromiseHookInit(implicit context: Context)(Object, Object): JSAny;
+extern transitioning runtime
+PromiseHookInit(implicit context: Context)(Object, Object): JSAny;
 }
 
 // https://tc39.es/ecma262/#sec-promise-constructor
 namespace promise {
 
-  extern runtime IncrementUseCounter(Context, Smi): void;
-  type UseCounterFeature extends int31
-  constexpr 'v8::Isolate::UseCounterFeature';
-  const kPromiseConstructorReturnedUndefined: constexpr UseCounterFeature
-  generates 'v8::Isolate::kPromiseConstructorReturnedUndefined';
-
-  extern macro
-  IsDebugActive(): bool;
-
-  transitioning macro
-  HasAccessCheckFailed(implicit context: Context)(
-      nativeContext: NativeContext, promiseFun: JSAny, executor: JSAny): bool {
-    BranchIfAccessCheckFailed(nativeContext, promiseFun, executor)
-        otherwise return true;
-    return false;
-  }
+extern runtime IncrementUseCounter(Context, Smi): void;
+type UseCounterFeature extends int31
+constexpr 'v8::Isolate::UseCounterFeature';
+const kPromiseConstructorReturnedUndefined: constexpr UseCounterFeature
+    generates 'v8::Isolate::kPromiseConstructorReturnedUndefined';
+
+extern macro
+IsDebugActive(): bool;
+
+transitioning macro
+HasAccessCheckFailed(implicit context: Context)(
+    nativeContext: NativeContext, promiseFun: JSAny, executor: JSAny): bool {
+  BranchIfAccessCheckFailed(nativeContext, promiseFun, executor)
+      otherwise return true;
+  return false;
+}
 
-  extern macro ConstructorBuiltinsAssembler::EmitFastNewObject(
-      Context, JSFunction, JSReceiver): JSObject;
+extern macro ConstructorBuiltinsAssembler::EmitFastNewObject(
+    Context, JSFunction, JSReceiver): JSObject;
 
-  extern macro
-  PromiseBuiltinsAssembler::IsPromiseHookEnabledOrHasAsyncEventDelegate(): bool;
+extern macro
+PromiseBuiltinsAssembler::IsPromiseHookEnabledOrHasAsyncEventDelegate(): bool;
 
-  // https://tc39.es/ecma262/#sec-promise-executor
-  transitioning javascript builtin
-  PromiseConstructor(
-      js-implicit context: NativeContext, receiver: JSAny,
-      newTarget: JSAny)(executor: JSAny): JSAny {
-    // 1. If NewTarget is undefined, throw a TypeError exception.
-    if (newTarget == Undefined) {
-      ThrowTypeError(MessageTemplate::kNotAPromise, newTarget);
-    }
+// https://tc39.es/ecma262/#sec-promise-executor
+transitioning javascript builtin
+PromiseConstructor(
+    js-implicit context: NativeContext, receiver: JSAny,
+    newTarget: JSAny)(executor: JSAny): JSAny {
+  // 1. If NewTarget is undefined, throw a TypeError exception.
+  if (newTarget == Undefined) {
+    ThrowTypeError(MessageTemplate::kNotAPromise, newTarget);
+  }
 
-    // 2. If IsCallable(executor) is false, throw a TypeError exception.
-    if (!TaggedIsCallable(executor)) {
-      ThrowTypeError(MessageTemplate::kResolverNotAFunction, executor);
-    }
+  // 2. If IsCallable(executor) is false, throw a TypeError exception.
+  if (!Is<Callable>(executor)) {
+    ThrowTypeError(MessageTemplate::kResolverNotAFunction, executor);
+  }
 
-    const promiseFun = UnsafeCast<JSFunction>(
-        context[NativeContextSlot::PROMISE_FUNCTION_INDEX]);
+  const promiseFun = UnsafeCast<JSFunction>(
+      context[NativeContextSlot::PROMISE_FUNCTION_INDEX]);
 
-    // Silently fail if the stack looks fishy.
-    if (HasAccessCheckFailed(context, promiseFun, executor)) {
-      IncrementUseCounter(
-          context, SmiConstant(kPromiseConstructorReturnedUndefined));
-      return Undefined;
-    }
+  // Silently fail if the stack looks fishy.
+  if (HasAccessCheckFailed(context, promiseFun, executor)) {
+    IncrementUseCounter(
+        context, SmiConstant(kPromiseConstructorReturnedUndefined));
+    return Undefined;
+  }
 
-    let result: JSPromise;
-    if (promiseFun == newTarget) {
-      result = NewJSPromise();
-    } else {
-      result = UnsafeCast<JSPromise>(EmitFastNewObject(
-          context, promiseFun, UnsafeCast<JSReceiver>(newTarget)));
-      PromiseInit(result);
-      if (IsPromiseHookEnabledOrHasAsyncEventDelegate()) {
-        runtime::PromiseHookInit(result, Undefined);
-      }
+  let result: JSPromise;
+  if (promiseFun == newTarget) {
+    result = NewJSPromise();
+  } else {
+    result = UnsafeCast<JSPromise>(EmitFastNewObject(
+        context, promiseFun, UnsafeCast<JSReceiver>(newTarget)));
+    PromiseInit(result);
+    if (IsPromiseHookEnabledOrHasAsyncEventDelegate()) {
+      runtime::PromiseHookInit(result, Undefined);
     }
+  }
 
-    const isDebugActive = IsDebugActive();
-    if (isDebugActive) runtime::DebugPushPromise(result);
-
-    const funcs = CreatePromiseResolvingFunctions(result, True, context);
-    const resolve = funcs.resolve;
-    const reject = funcs.reject;
-    try {
-      Call(context, UnsafeCast<Callable>(executor), Undefined, resolve, reject);
-    } catch (e) {
-      Call(context, reject, Undefined, e);
-    }
+  const isDebugActive = IsDebugActive();
+  if (isDebugActive) runtime::DebugPushPromise(result);
 
-    if (isDebugActive) runtime::DebugPopPromise();
-    return result;
+  const funcs = CreatePromiseResolvingFunctions(result, True, context);
+  const resolve = funcs.resolve;
+  const reject = funcs.reject;
+  try {
+    Call(context, UnsafeCast<Callable>(executor), Undefined, resolve, reject);
+  } catch (e) {
+    Call(context, reject, Undefined, e);
   }
 
-  // Promise.prototype.catch ( onRejected )
-  // https://tc39.es/ecma262/#sec-promise.prototype.catch
-  transitioning javascript builtin
-  PromisePrototypeCatch(js-implicit context: Context, receiver: JSAny)(
-      onRejected: JSAny): JSAny {
-    // 1. Let promise be the this value.
-    // 2. Return ? Invoke(promise, "then", « undefined, onRejected »).
-    const nativeContext = LoadNativeContext(context);
-    return UnsafeCast<JSAny>(
-        InvokeThen(nativeContext, receiver, Undefined, onRejected));
-  }
+  if (isDebugActive) runtime::DebugPopPromise();
+  return result;
+}
+
+// Promise.prototype.catch ( onRejected )
+// https://tc39.es/ecma262/#sec-promise.prototype.catch
+transitioning javascript builtin
+PromisePrototypeCatch(
+    js-implicit context: Context, receiver: JSAny)(onRejected: JSAny): JSAny {
+  // 1. Let promise be the this value.
+  // 2. Return ? Invoke(promise, "then", « undefined, onRejected »).
+  const nativeContext = LoadNativeContext(context);
+  return UnsafeCast<JSAny>(
+      InvokeThen(nativeContext, receiver, Undefined, onRejected));
+}
 }
diff --git a/deps/v8/src/builtins/promise-finally.tq b/deps/v8/src/builtins/promise-finally.tq
index 32028b819da..48928ca4ce7 100644
--- a/deps/v8/src/builtins/promise-finally.tq
+++ b/deps/v8/src/builtins/promise-finally.tq
@@ -7,201 +7,201 @@
 
 namespace promise {
 
-  // TODO(joshualitt): The below ContextSlots are only available on synthetic
-  // contexts created by the promise pipeline for use in the promise pipeline.
-  // However, with Torque we should type the context and its slots to prevent
-  // accidentially using these slots on contexts which don't support them.
-  const kPromiseBuiltinsValueSlot: constexpr ContextSlot
-  generates 'PromiseBuiltins::kValueSlot';
-  const kPromiseBuiltinsOnFinallySlot: constexpr ContextSlot
-  generates 'PromiseBuiltins::kOnFinallySlot';
-  const kPromiseBuiltinsConstructorSlot: constexpr ContextSlot
-  generates 'PromiseBuiltins::kConstructorSlot';
-  const kPromiseBuiltinsPromiseValueThunkOrReasonContextLength: constexpr int31
-  generates 'PromiseBuiltins::kPromiseValueThunkOrReasonContextLength';
-  const kPromiseBuiltinsPromiseFinallyContextLength: constexpr int31
-  generates 'PromiseBuiltins::kPromiseFinallyContextLength';
-
-  transitioning javascript builtin
-  PromiseValueThunkFinally(js-implicit context: Context, receiver: JSAny)():
-      JSAny {
-    return UnsafeCast<JSAny>(context[kPromiseBuiltinsValueSlot]);
-  }
+// TODO(joshualitt): The below ContextSlots are only available on synthetic
+// contexts created by the promise pipeline for use in the promise pipeline.
+// However, with Torque we should type the context and its slots to prevent
+// accidentially using these slots on contexts which don't support them.
+const kPromiseBuiltinsValueSlot: constexpr ContextSlot
+    generates 'PromiseBuiltins::kValueSlot';
+const kPromiseBuiltinsOnFinallySlot: constexpr ContextSlot
+    generates 'PromiseBuiltins::kOnFinallySlot';
+const kPromiseBuiltinsConstructorSlot: constexpr ContextSlot
+    generates 'PromiseBuiltins::kConstructorSlot';
+const kPromiseBuiltinsPromiseValueThunkOrReasonContextLength: constexpr int31
+    generates 'PromiseBuiltins::kPromiseValueThunkOrReasonContextLength';
+const kPromiseBuiltinsPromiseFinallyContextLength: constexpr int31
+    generates 'PromiseBuiltins::kPromiseFinallyContextLength';
+
+transitioning javascript builtin
+PromiseValueThunkFinally(
+    js-implicit context: Context, receiver: JSAny)(): JSAny {
+  return UnsafeCast<JSAny>(context[kPromiseBuiltinsValueSlot]);
+}
 
-  transitioning javascript builtin
-  PromiseThrowerFinally(js-implicit context: Context, receiver: JSAny)():
-      never {
-    const reason = UnsafeCast<JSAny>(context[kPromiseBuiltinsValueSlot]);
-    Throw(reason);
-  }
+transitioning javascript builtin
+PromiseThrowerFinally(js-implicit context: Context, receiver: JSAny)(): never {
+  const reason = UnsafeCast<JSAny>(context[kPromiseBuiltinsValueSlot]);
+  Throw(reason);
+}
 
-  macro CreateThrowerFunction(implicit context: Context)(
-      nativeContext: NativeContext, reason: JSAny): JSFunction {
-    const throwerContext = AllocateSyntheticFunctionContext(
-        nativeContext, kPromiseBuiltinsPromiseValueThunkOrReasonContextLength);
-    throwerContext[kPromiseBuiltinsValueSlot] = reason;
-    const map = UnsafeCast<Map>(
-        nativeContext
-            [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
-    const throwerInfo = UnsafeCast<SharedFunctionInfo>(
-        nativeContext[NativeContextSlot::PROMISE_THROWER_FINALLY_SHARED_FUN]);
-    return AllocateFunctionWithMapAndContext(map, throwerInfo, throwerContext);
-  }
+macro CreateThrowerFunction(implicit context: Context)(
+    nativeContext: NativeContext, reason: JSAny): JSFunction {
+  const throwerContext = AllocateSyntheticFunctionContext(
+      nativeContext, kPromiseBuiltinsPromiseValueThunkOrReasonContextLength);
+  throwerContext[kPromiseBuiltinsValueSlot] = reason;
+  const map = UnsafeCast<Map>(
+      nativeContext
+          [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
+  const throwerInfo = PromiseThrowerFinallySharedFunConstant();
+  return AllocateFunctionWithMapAndContext(map, throwerInfo, throwerContext);
+}
 
-  transitioning javascript builtin
-  PromiseCatchFinally(js-implicit context: Context, receiver: JSAny)(
-      reason: JSAny): JSAny {
-    // 1. Let onFinally be F.[[OnFinally]].
-    // 2. Assert: IsCallable(onFinally) is true.
-    const onFinally =
-        UnsafeCast<Callable>(context[kPromiseBuiltinsOnFinallySlot]);
+transitioning javascript builtin
+PromiseCatchFinally(
+    js-implicit context: Context, receiver: JSAny)(reason: JSAny): JSAny {
+  // 1. Let onFinally be F.[[OnFinally]].
+  // 2. Assert: IsCallable(onFinally) is true.
+  const onFinally =
+      UnsafeCast<Callable>(context[kPromiseBuiltinsOnFinallySlot]);
 
-    // 3. Let result be ? Call(onFinally).
-    const result = Call(context, onFinally, Undefined);
+  // 3. Let result be ? Call(onFinally).
+  const result = Call(context, onFinally, Undefined);
 
-    // 4. Let C be F.[[Constructor]].
-    const constructor =
-        UnsafeCast<JSFunction>(context[kPromiseBuiltinsConstructorSlot]);
+  // 4. Let C be F.[[Constructor]].
+  const constructor =
+      UnsafeCast<JSFunction>(context[kPromiseBuiltinsConstructorSlot]);
 
-    // 5. Assert: IsConstructor(C) is true.
-    assert(IsConstructor(constructor));
+  // 5. Assert: IsConstructor(C) is true.
+  assert(IsConstructor(constructor));
 
-    // 6. Let promise be ? PromiseResolve(C, result).
-    const promise = PromiseResolve(constructor, result);
+  // 6. Let promise be ? PromiseResolve(C, result).
+  const promise = PromiseResolve(constructor, result);
 
-    // 7. Let thrower be equivalent to a function that throws reason.
-    const nativeContext = LoadNativeContext(context);
-    const thrower = CreateThrowerFunction(nativeContext, reason);
+  // 7. Let thrower be equivalent to a function that throws reason.
+  const nativeContext = LoadNativeContext(context);
+  const thrower = CreateThrowerFunction(nativeContext, reason);
 
-    // 8. Return ? Invoke(promise, "then", « thrower »).
-    return UnsafeCast<JSAny>(InvokeThen(nativeContext, promise, thrower));
-  }
+  // 8. Return ? Invoke(promise, "then", « thrower »).
+  return UnsafeCast<JSAny>(InvokeThen(nativeContext, promise, thrower));
+}
 
-  macro CreateValueThunkFunction(implicit context: Context)(
-      nativeContext: NativeContext, value: JSAny): JSFunction {
-    const valueThunkContext = AllocateSyntheticFunctionContext(
-        nativeContext, kPromiseBuiltinsPromiseValueThunkOrReasonContextLength);
-    valueThunkContext[kPromiseBuiltinsValueSlot] = value;
-    const map = UnsafeCast<Map>(
-        nativeContext
-            [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
-    const valueThunkInfo = UnsafeCast<SharedFunctionInfo>(
-        nativeContext
-            [NativeContextSlot::PROMISE_VALUE_THUNK_FINALLY_SHARED_FUN]);
-    return AllocateFunctionWithMapAndContext(
-        map, valueThunkInfo, valueThunkContext);
-  }
+macro CreateValueThunkFunction(implicit context: Context)(
+    nativeContext: NativeContext, value: JSAny): JSFunction {
+  const valueThunkContext = AllocateSyntheticFunctionContext(
+      nativeContext, kPromiseBuiltinsPromiseValueThunkOrReasonContextLength);
+  valueThunkContext[kPromiseBuiltinsValueSlot] = value;
+  const map = UnsafeCast<Map>(
+      nativeContext
+          [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
+  const valueThunkInfo = PromiseValueThunkFinallySharedFunConstant();
+  return AllocateFunctionWithMapAndContext(
+      map, valueThunkInfo, valueThunkContext);
+}
 
-  transitioning javascript builtin
-  PromiseThenFinally(js-implicit context: Context, receiver: JSAny)(
-      value: JSAny): JSAny {
-    // 1. Let onFinally be F.[[OnFinally]].
-    // 2.  Assert: IsCallable(onFinally) is true.
-    const onFinally =
-        UnsafeCast<Callable>(context[kPromiseBuiltinsOnFinallySlot]);
+transitioning javascript builtin
+PromiseThenFinally(
+    js-implicit context: Context, receiver: JSAny)(value: JSAny): JSAny {
+  // 1. Let onFinally be F.[[OnFinally]].
+  // 2.  Assert: IsCallable(onFinally) is true.
+  const onFinally =
+      UnsafeCast<Callable>(context[kPromiseBuiltinsOnFinallySlot]);
 
-    // 3. Let result be ?  Call(onFinally).
-    const result = Call(context, onFinally, Undefined);
+  // 3. Let result be ?  Call(onFinally).
+  const result = Call(context, onFinally, Undefined);
 
-    // 4. Let C be F.[[Constructor]].
-    const constructor =
-        UnsafeCast<JSFunction>(context[kPromiseBuiltinsConstructorSlot]);
+  // 4. Let C be F.[[Constructor]].
+  const constructor =
+      UnsafeCast<JSFunction>(context[kPromiseBuiltinsConstructorSlot]);
 
-    // 5. Assert: IsConstructor(C) is true.
-    assert(IsConstructor(constructor));
+  // 5. Assert: IsConstructor(C) is true.
+  assert(IsConstructor(constructor));
 
-    // 6. Let promise be ? PromiseResolve(C, result).
-    const promise = PromiseResolve(constructor, result);
+  // 6. Let promise be ? PromiseResolve(C, result).
+  const promise = PromiseResolve(constructor, result);
 
-    // 7. Let valueThunk be equivalent to a function that returns value.
-    const nativeContext = LoadNativeContext(context);
-    const valueThunk = CreateValueThunkFunction(nativeContext, value);
+  // 7. Let valueThunk be equivalent to a function that returns value.
+  const nativeContext = LoadNativeContext(context);
+  const valueThunk = CreateValueThunkFunction(nativeContext, value);
 
-    // 8. Return ? Invoke(promise, "then", « valueThunk »).
-    return UnsafeCast<JSAny>(InvokeThen(nativeContext, promise, valueThunk));
-  }
+  // 8. Return ? Invoke(promise, "then", « valueThunk »).
+  return UnsafeCast<JSAny>(InvokeThen(nativeContext, promise, valueThunk));
+}
 
-  struct PromiseFinallyFunctions {
-    then_finally: JSFunction;
-    catch_finally: JSFunction;
-  }
+struct PromiseFinallyFunctions {
+  then_finally: JSFunction;
+  catch_finally: JSFunction;
+}
 
-  macro CreatePromiseFinallyFunctions(implicit context: Context)(
-      nativeContext: NativeContext, onFinally: Callable,
-      constructor: JSReceiver): PromiseFinallyFunctions {
-    const promiseContext = AllocateSyntheticFunctionContext(
-        nativeContext, kPromiseBuiltinsPromiseFinallyContextLength);
-    promiseContext[kPromiseBuiltinsOnFinallySlot] = onFinally;
-    promiseContext[kPromiseBuiltinsConstructorSlot] = constructor;
-    const map = UnsafeCast<Map>(
-        nativeContext
-            [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
-    const thenFinallyInfo = UnsafeCast<SharedFunctionInfo>(
-        nativeContext[NativeContextSlot::PROMISE_THEN_FINALLY_SHARED_FUN]);
-    const thenFinally =
-        AllocateFunctionWithMapAndContext(map, thenFinallyInfo, promiseContext);
-    const catchFinallyInfo = UnsafeCast<SharedFunctionInfo>(
-        nativeContext[NativeContextSlot::PROMISE_CATCH_FINALLY_SHARED_FUN]);
-    const catchFinally = AllocateFunctionWithMapAndContext(
-        map, catchFinallyInfo, promiseContext);
-    return PromiseFinallyFunctions{
-      then_finally: thenFinally,
-      catch_finally: catchFinally
-    };
-  }
+macro CreatePromiseFinallyFunctions(implicit context: Context)(
+    nativeContext: NativeContext, onFinally: Callable,
+    constructor: JSReceiver): PromiseFinallyFunctions {
+  const promiseContext = AllocateSyntheticFunctionContext(
+      nativeContext, kPromiseBuiltinsPromiseFinallyContextLength);
+  promiseContext[kPromiseBuiltinsOnFinallySlot] = onFinally;
+  promiseContext[kPromiseBuiltinsConstructorSlot] = constructor;
+  const map = UnsafeCast<Map>(
+      nativeContext
+          [NativeContextSlot::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX]);
+  const thenFinallyInfo = PromiseThenFinallySharedFunConstant();
+  const thenFinally =
+      AllocateFunctionWithMapAndContext(map, thenFinallyInfo, promiseContext);
+  const catchFinallyInfo = PromiseCatchFinallySharedFunConstant();
+  const catchFinally =
+      AllocateFunctionWithMapAndContext(map, catchFinallyInfo, promiseContext);
+  return PromiseFinallyFunctions{
+    then_finally: thenFinally,
+    catch_finally: catchFinally
+  };
+}
 
-  transitioning javascript builtin
-  PromisePrototypeFinally(js-implicit context: Context, receiver: JSAny)(
-      onFinally: JSAny): JSAny {
-    // 1. Let promise be the this value.
-    // 2. If Type(promise) is not Object, throw a TypeError exception.
-    const jsReceiver = Cast<JSReceiver>(receiver) otherwise ThrowTypeError(
-        MessageTemplate::kCalledOnNonObject, 'Promise.prototype.finally');
-
-    // 3. Let C be ? SpeciesConstructor(promise, %Promise%).
-    const nativeContext = LoadNativeContext(context);
-    const promiseFun = UnsafeCast<Callable>(
-        nativeContext[NativeContextSlot::PROMISE_FUNCTION_INDEX]);
-
-    let constructor: JSReceiver = promiseFun;
-    const receiverMap = jsReceiver.map;
-    if (!IsJSPromiseMap(receiverMap) ||
-        !IsPromiseSpeciesLookupChainIntact(nativeContext, receiverMap))
-      deferred {
-        constructor = SpeciesConstructor(jsReceiver, promiseFun);
-      }
-
-    // 4. Assert: IsConstructor(C) is true.
-    assert(IsConstructor(constructor));
-
-    // 5. If IsCallable(onFinally) is not true,
-    //    a. Let thenFinally be onFinally.
-    //    b. Let catchFinally be onFinally.
-    // 6. Else,
-    //   a. Let thenFinally be a new built-in function object as defined
-    //   in ThenFinally Function.
-    //   b. Let catchFinally be a new built-in function object as
-    //   defined in CatchFinally Function.
-    //   c. Set thenFinally and catchFinally's [[Constructor]] internal
-    //   slots to C.
-    //   d. Set thenFinally and catchFinally's [[OnFinally]] internal
-    //   slots to onFinally.
-    let thenFinally: JSAny;
-    let catchFinally: JSAny;
-    if (!TaggedIsSmi(onFinally) &&
-        IsCallable(UnsafeCast<HeapObject>(onFinally))) {
-      const pair = CreatePromiseFinallyFunctions(
-          nativeContext, UnsafeCast<Callable>(onFinally), constructor);
+transitioning javascript builtin
+PromisePrototypeFinally(
+    js-implicit context: Context, receiver: JSAny)(onFinally: JSAny): JSAny {
+  // 1. Let promise be the this value.
+  // 2. If Type(promise) is not Object, throw a TypeError exception.
+  const jsReceiver = Cast<JSReceiver>(receiver) otherwise ThrowTypeError(
+      MessageTemplate::kCalledOnNonObject, 'Promise.prototype.finally');
+
+  // 3. Let C be ? SpeciesConstructor(promise, %Promise%).
+  const nativeContext = LoadNativeContext(context);
+  const promiseFun = UnsafeCast<Callable>(
+      nativeContext[NativeContextSlot::PROMISE_FUNCTION_INDEX]);
+
+  let constructor: JSReceiver = promiseFun;
+  const receiverMap = jsReceiver.map;
+  if (!IsJSPromiseMap(receiverMap) ||
+      !IsPromiseSpeciesLookupChainIntact(nativeContext, receiverMap))
+    deferred {
+      constructor = SpeciesConstructor(jsReceiver, promiseFun);
+    }
+
+  // 4. Assert: IsConstructor(C) is true.
+  assert(IsConstructor(constructor));
+
+  // 5. If IsCallable(onFinally) is not true,
+  //    a. Let thenFinally be onFinally.
+  //    b. Let catchFinally be onFinally.
+  // 6. Else,
+  //   a. Let thenFinally be a new built-in function object as defined
+  //   in ThenFinally Function.
+  //   b. Let catchFinally be a new built-in function object as
+  //   defined in CatchFinally Function.
+  //   c. Set thenFinally and catchFinally's [[Constructor]] internal
+  //   slots to C.
+  //   d. Set thenFinally and catchFinally's [[OnFinally]] internal
+  //   slots to onFinally.
+  let thenFinally: JSAny;
+  let catchFinally: JSAny;
+  typeswitch (onFinally) {
+    case (onFinally: Callable): {
+      const pair =
+          CreatePromiseFinallyFunctions(nativeContext, onFinally, constructor);
       thenFinally = pair.then_finally;
       catchFinally = pair.catch_finally;
-    } else
-      deferred {
-        thenFinally = onFinally;
-        catchFinally = onFinally;
-      }
-
-    // 7. Return ? Invoke(promise, "then", « thenFinally, catchFinally »).
-    return UnsafeCast<JSAny>(
-        InvokeThen(nativeContext, receiver, thenFinally, catchFinally));
+    }
+    case (JSAny): deferred {
+      thenFinally = onFinally;
+      catchFinally = onFinally;
+    }
   }
+
+  // 7. Return ? Invoke(promise, "then", « thenFinally, catchFinally »).
+  return UnsafeCast<JSAny>(
+      InvokeThen(nativeContext, receiver, thenFinally, catchFinally));
+}
+
+extern macro PromiseCatchFinallySharedFunConstant(): SharedFunctionInfo;
+extern macro PromiseThenFinallySharedFunConstant(): SharedFunctionInfo;
+extern macro PromiseThrowerFinallySharedFunConstant(): SharedFunctionInfo;
+extern macro PromiseValueThunkFinallySharedFunConstant(): SharedFunctionInfo;
 }
diff --git a/deps/v8/src/builtins/promise-jobs.tq b/deps/v8/src/builtins/promise-jobs.tq
index ee049605e1a..6c64baf22d1 100644
--- a/deps/v8/src/builtins/promise-jobs.tq
+++ b/deps/v8/src/builtins/promise-jobs.tq
@@ -6,68 +6,68 @@
 
 // https://tc39.es/ecma262/#sec-promise-jobs
 namespace promise {
-  extern macro IsJSPromiseMap(Map): bool;
+extern macro IsJSPromiseMap(Map): bool;
 
-  // https://tc39.es/ecma262/#sec-promiseresolvethenablejob
-  transitioning builtin
-  PromiseResolveThenableJob(implicit context: Context)(
-      promiseToResolve: JSPromise, thenable: JSReceiver, then: JSAny): JSAny {
-    // We can use a simple optimization here if we know that {then} is the
-    // initial Promise.prototype.then method, and {thenable} is a JSPromise
-    // whose
-    // @@species lookup chain is intact: We can connect {thenable} and
-    // {promise_to_resolve} directly in that case and avoid the allocation of a
-    // temporary JSPromise and the closures plus context.
+// https://tc39.es/ecma262/#sec-promiseresolvethenablejob
+transitioning builtin
+PromiseResolveThenableJob(implicit context: Context)(
+    promiseToResolve: JSPromise, thenable: JSReceiver, then: JSAny): JSAny {
+  // We can use a simple optimization here if we know that {then} is the
+  // initial Promise.prototype.then method, and {thenable} is a JSPromise
+  // whose
+  // @@species lookup chain is intact: We can connect {thenable} and
+  // {promise_to_resolve} directly in that case and avoid the allocation of a
+  // temporary JSPromise and the closures plus context.
+  //
+  // We take the generic (slow-)path if a PromiseHook is enabled or the
+  // debugger is active, to make sure we expose spec compliant behavior.
+  const nativeContext = LoadNativeContext(context);
+  const promiseThen = nativeContext[NativeContextSlot::PROMISE_THEN_INDEX];
+  const thenableMap = thenable.map;
+  if (TaggedEqual(then, promiseThen) && IsJSPromiseMap(thenableMap) &&
+      !IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate() &&
+      IsPromiseSpeciesLookupChainIntact(nativeContext, thenableMap)) {
+    // We know that the {thenable} is a JSPromise, which doesn't require
+    // any special treatment and that {then} corresponds to the initial
+    // Promise.prototype.then method. So instead of allocating a temporary
+    // JSPromise to connect the {thenable} with the {promise_to_resolve},
+    // we can directly schedule the {promise_to_resolve} with default
+    // handlers onto the {thenable} promise. This does not only save the
+    // JSPromise allocation, but also avoids the allocation of the two
+    // resolving closures and the shared context.
     //
-    // We take the generic (slow-)path if a PromiseHook is enabled or the
-    // debugger is active, to make sure we expose spec compliant behavior.
-    const nativeContext = LoadNativeContext(context);
-    const promiseThen = nativeContext[NativeContextSlot::PROMISE_THEN_INDEX];
-    const thenableMap = thenable.map;
-    if (TaggedEqual(then, promiseThen) && IsJSPromiseMap(thenableMap) &&
-        !IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate() &&
-        IsPromiseSpeciesLookupChainIntact(nativeContext, thenableMap)) {
-      // We know that the {thenable} is a JSPromise, which doesn't require
-      // any special treatment and that {then} corresponds to the initial
-      // Promise.prototype.then method. So instead of allocating a temporary
-      // JSPromise to connect the {thenable} with the {promise_to_resolve},
-      // we can directly schedule the {promise_to_resolve} with default
-      // handlers onto the {thenable} promise. This does not only save the
-      // JSPromise allocation, but also avoids the allocation of the two
-      // resolving closures and the shared context.
-      //
-      // What happens normally in this case is
-      //
-      //   resolve, reject = CreateResolvingFunctions(promise_to_resolve)
-      //   result_capability = NewPromiseCapability(%Promise%)
-      //   PerformPromiseThen(thenable, resolve, reject, result_capability)
-      //
-      // which means that PerformPromiseThen will either schedule a new
-      // PromiseReaction with resolve and reject or a PromiseReactionJob
-      // with resolve or reject based on the state of {thenable}. And
-      // resolve or reject will just invoke the default [[Resolve]] or
-      // [[Reject]] functions on the {promise_to_resolve}.
-      //
-      // This is the same as just doing
-      //
-      //   PerformPromiseThen(thenable, undefined, undefined,
-      //   promise_to_resolve)
-      //
-      // which performs exactly the same (observable) steps.
-      return PerformPromiseThen(
-          UnsafeCast<JSPromise>(thenable), UndefinedConstant(),
-          UndefinedConstant(), promiseToResolve);
-    } else {
-      const funcs = CreatePromiseResolvingFunctions(
-          promiseToResolve, False, nativeContext);
-      const resolve = funcs.resolve;
-      const reject = funcs.reject;
-      try {
-        return Call(
-            context, UnsafeCast<Callable>(then), thenable, resolve, reject);
-      } catch (e) {
-        return Call(context, UnsafeCast<Callable>(reject), Undefined, e);
-      }
+    // What happens normally in this case is
+    //
+    //   resolve, reject = CreateResolvingFunctions(promise_to_resolve)
+    //   result_capability = NewPromiseCapability(%Promise%)
+    //   PerformPromiseThen(thenable, resolve, reject, result_capability)
+    //
+    // which means that PerformPromiseThen will either schedule a new
+    // PromiseReaction with resolve and reject or a PromiseReactionJob
+    // with resolve or reject based on the state of {thenable}. And
+    // resolve or reject will just invoke the default [[Resolve]] or
+    // [[Reject]] functions on the {promise_to_resolve}.
+    //
+    // This is the same as just doing
+    //
+    //   PerformPromiseThen(thenable, undefined, undefined,
+    //   promise_to_resolve)
+    //
+    // which performs exactly the same (observable) steps.
+    return PerformPromiseThen(
+        UnsafeCast<JSPromise>(thenable), UndefinedConstant(),
+        UndefinedConstant(), promiseToResolve);
+  } else {
+    const funcs =
+        CreatePromiseResolvingFunctions(promiseToResolve, False, nativeContext);
+    const resolve = funcs.resolve;
+    const reject = funcs.reject;
+    try {
+      return Call(
+          context, UnsafeCast<Callable>(then), thenable, resolve, reject);
+    } catch (e) {
+      return Call(context, UnsafeCast<Callable>(reject), Undefined, e);
     }
   }
 }
+}
diff --git a/deps/v8/src/builtins/promise-misc.tq b/deps/v8/src/builtins/promise-misc.tq
index 61461de29fe..7ed2f7909a8 100644
--- a/deps/v8/src/builtins/promise-misc.tq
+++ b/deps/v8/src/builtins/promise-misc.tq
@@ -6,246 +6,267 @@
 #include 'src/builtins/builtins-promise-gen.h'
 
 namespace runtime {
-  extern transitioning runtime
-  AllowDynamicFunction(implicit context: Context)(JSAny): JSAny;
+extern transitioning runtime
+AllowDynamicFunction(implicit context: Context)(JSAny): JSAny;
 }
 
 // Unsafe functions that should be used very carefully.
 namespace promise_internal {
-  extern macro PromiseBuiltinsAssembler::ZeroOutEmbedderOffsets(JSPromise):
-      void;
+extern macro PromiseBuiltinsAssembler::ZeroOutEmbedderOffsets(JSPromise): void;
 
-  extern macro PromiseBuiltinsAssembler::AllocateJSPromise(Context): HeapObject;
+extern macro PromiseBuiltinsAssembler::AllocateJSPromise(Context): HeapObject;
 }
 
 namespace promise {
-  extern macro IsFunctionWithPrototypeSlotMap(Map): bool;
+extern macro IsFunctionWithPrototypeSlotMap(Map): bool;
 
-  @export
-  macro PromiseHasHandler(promise: JSPromise): bool {
-    return promise.HasHandler();
-  }
+@export
+macro PromiseHasHandler(promise: JSPromise): bool {
+  return promise.HasHandler();
+}
 
-  @export
-  macro PromiseInit(promise: JSPromise): void {
-    assert(PromiseState::kPending == 0);
-    promise.reactions_or_result = kZero;
-    promise.flags = 0;
-    promise_internal::ZeroOutEmbedderOffsets(promise);
-  }
+@export
+macro PromiseInit(promise: JSPromise): void {
+  promise.reactions_or_result = kZero;
+  promise.flags = SmiTag(JSPromiseFlags{
+    status: PromiseState::kPending,
+    has_handler: false,
+    handled_hint: false,
+    async_task_id: 0
+  });
+  promise_internal::ZeroOutEmbedderOffsets(promise);
+}
 
-  macro InnerNewJSPromise(implicit context: Context)(): JSPromise {
-    const nativeContext = LoadNativeContext(context);
-    const promiseFun = UnsafeCast<JSFunction>(
-        nativeContext[NativeContextSlot::PROMISE_FUNCTION_INDEX]);
-    assert(IsFunctionWithPrototypeSlotMap(promiseFun.map));
-    const promiseMap = UnsafeCast<Map>(promiseFun.prototype_or_initial_map);
-    const promiseHeapObject = promise_internal::AllocateJSPromise(context);
-    * UnsafeConstCast(& promiseHeapObject.map) = promiseMap;
-    const promise = UnsafeCast<JSPromise>(promiseHeapObject);
-    promise.properties_or_hash = kEmptyFixedArray;
-    promise.elements = kEmptyFixedArray;
-    promise.reactions_or_result = kZero;
-    promise.flags = 0;
-    return promise;
-  }
+macro InnerNewJSPromise(implicit context: Context)(): JSPromise {
+  const nativeContext = LoadNativeContext(context);
+  const promiseFun = UnsafeCast<JSFunction>(
+      nativeContext[NativeContextSlot::PROMISE_FUNCTION_INDEX]);
+  assert(IsFunctionWithPrototypeSlotMap(promiseFun.map));
+  const promiseMap = UnsafeCast<Map>(promiseFun.prototype_or_initial_map);
+  const promiseHeapObject = promise_internal::AllocateJSPromise(context);
+  * UnsafeConstCast(& promiseHeapObject.map) = promiseMap;
+  const promise = UnsafeCast<JSPromise>(promiseHeapObject);
+  promise.properties_or_hash = kEmptyFixedArray;
+  promise.elements = kEmptyFixedArray;
+  promise.reactions_or_result = kZero;
+  promise.flags = SmiTag(JSPromiseFlags{
+    status: PromiseState::kPending,
+    has_handler: false,
+    handled_hint: false,
+    async_task_id: 0
+  });
+  return promise;
+}
 
-  macro NewPromiseFulfillReactionJobTask(implicit context: Context)(
-      handlerContext: Context, argument: Object, handler: Callable|Undefined,
-      promiseOrCapability: JSPromise|PromiseCapability|
-      Undefined): PromiseFulfillReactionJobTask {
-    const nativeContext = LoadNativeContext(handlerContext);
-    return new PromiseFulfillReactionJobTask{
-      map: PromiseFulfillReactionJobTaskMapConstant(),
-      argument,
-      context: handlerContext,
-      handler,
-      promise_or_capability: promiseOrCapability,
-      continuation_preserved_embedder_data: nativeContext
-          [NativeContextSlot::CONTINUATION_PRESERVED_EMBEDDER_DATA_INDEX]
-    };
-  }
+macro NewPromiseFulfillReactionJobTask(implicit context: Context)(
+    handlerContext: Context, argument: Object, handler: Callable|Undefined,
+    promiseOrCapability: JSPromise|PromiseCapability|
+    Undefined): PromiseFulfillReactionJobTask {
+  const nativeContext = LoadNativeContext(handlerContext);
+  return new PromiseFulfillReactionJobTask{
+    map: PromiseFulfillReactionJobTaskMapConstant(),
+    argument,
+    context: handlerContext,
+    handler,
+    promise_or_capability: promiseOrCapability,
+    continuation_preserved_embedder_data: nativeContext
+        [NativeContextSlot::CONTINUATION_PRESERVED_EMBEDDER_DATA_INDEX]
+  };
+}
 
-  macro NewPromiseRejectReactionJobTask(implicit context: Context)(
-      handlerContext: Context, argument: Object, handler: Callable|Undefined,
-      promiseOrCapability: JSPromise|PromiseCapability|
-      Undefined): PromiseRejectReactionJobTask {
-    const nativeContext = LoadNativeContext(handlerContext);
-    return new PromiseRejectReactionJobTask{
-      map: PromiseRejectReactionJobTaskMapConstant(),
-      argument,
-      context: handlerContext,
-      handler,
-      promise_or_capability: promiseOrCapability,
-      continuation_preserved_embedder_data: nativeContext
-          [NativeContextSlot::CONTINUATION_PRESERVED_EMBEDDER_DATA_INDEX]
-    };
-  }
+macro NewPromiseRejectReactionJobTask(implicit context: Context)(
+    handlerContext: Context, argument: Object, handler: Callable|Undefined,
+    promiseOrCapability: JSPromise|PromiseCapability|
+    Undefined): PromiseRejectReactionJobTask {
+  const nativeContext = LoadNativeContext(handlerContext);
+  return new PromiseRejectReactionJobTask{
+    map: PromiseRejectReactionJobTaskMapConstant(),
+    argument,
+    context: handlerContext,
+    handler,
+    promise_or_capability: promiseOrCapability,
+    continuation_preserved_embedder_data: nativeContext
+        [NativeContextSlot::CONTINUATION_PRESERVED_EMBEDDER_DATA_INDEX]
+  };
+}
 
-  // These allocate and initialize a promise with pending state and
-  // undefined fields.
-  //
-  // This uses the given parent as the parent promise for the promise
-  // init hook.
-  @export
-  transitioning macro NewJSPromise(implicit context: Context)(parent: Object):
-      JSPromise {
-    const instance = InnerNewJSPromise();
-    PromiseInit(instance);
-    if (IsPromiseHookEnabledOrHasAsyncEventDelegate()) {
-      runtime::PromiseHookInit(instance, parent);
-    }
-    return instance;
+// These allocate and initialize a promise with pending state and
+// undefined fields.
+//
+// This uses the given parent as the parent promise for the promise
+// init hook.
+@export
+transitioning macro NewJSPromise(implicit context: Context)(parent: Object):
+    JSPromise {
+  const instance = InnerNewJSPromise();
+  PromiseInit(instance);
+  if (IsPromiseHookEnabledOrHasAsyncEventDelegate()) {
+    runtime::PromiseHookInit(instance, parent);
   }
+  return instance;
+}
 
-  // This uses undefined as the parent promise for the promise init
-  // hook.
-  @export
-  transitioning macro NewJSPromise(implicit context: Context)(): JSPromise {
-    return NewJSPromise(Undefined);
-  }
+// This uses undefined as the parent promise for the promise init
+// hook.
+@export
+transitioning macro NewJSPromise(implicit context: Context)(): JSPromise {
+  return NewJSPromise(Undefined);
+}
 
-  // This allocates and initializes a promise with the given state and
-  // fields.
-  @export
-  transitioning macro NewJSPromise(implicit context: Context)(
-      status: constexpr PromiseState, result: JSAny): JSPromise {
-    assert(status != PromiseState::kPending);
-    assert(kJSPromiseStatusShift == 0);
-
-    const instance = InnerNewJSPromise();
-    instance.reactions_or_result = result;
-    instance.SetStatus(status);
-    promise_internal::ZeroOutEmbedderOffsets(instance);
-
-    if (IsPromiseHookEnabledOrHasAsyncEventDelegate()) {
-      runtime::PromiseHookInit(instance, Undefined);
-    }
-    return instance;
-  }
+// This allocates and initializes a promise with the given state and
+// fields.
+@export
+transitioning macro NewJSPromise(implicit context: Context)(
+    status: constexpr PromiseState, result: JSAny): JSPromise {
+  assert(status != PromiseState::kPending);
 
-  macro NewPromiseReaction(implicit context: Context)(
-      handlerContext: Context, next: Zero|PromiseReaction,
-      promiseOrCapability: JSPromise|PromiseCapability|Undefined,
-      fulfillHandler: Callable|Undefined,
-      rejectHandler: Callable|Undefined): PromiseReaction {
-    const nativeContext = LoadNativeContext(handlerContext);
-    return new PromiseReaction{
-      map: PromiseReactionMapConstant(),
-      next: next,
-      reject_handler: rejectHandler,
-      fulfill_handler: fulfillHandler,
-      promise_or_capability: promiseOrCapability,
-      continuation_preserved_embedder_data: nativeContext
-          [NativeContextSlot::CONTINUATION_PRESERVED_EMBEDDER_DATA_INDEX]
-    };
-  }
+  const instance = InnerNewJSPromise();
+  instance.reactions_or_result = result;
+  instance.SetStatus(status);
+  promise_internal::ZeroOutEmbedderOffsets(instance);
 
-  extern macro PromiseResolveThenableJobTaskMapConstant(): Map;
-
-  macro NewPromiseResolveThenableJobTask(implicit context: Context)(
-      promiseToResolve: JSPromise, then: JSReceiver, thenable: JSReceiver,
-      thenContext: Context): PromiseResolveThenableJobTask {
-    return new PromiseResolveThenableJobTask{
-      map: PromiseResolveThenableJobTaskMapConstant(),
-      context: thenContext,
-      promise_to_resolve: promiseToResolve,
-      then: then,
-      thenable: thenable
-    };
+  if (IsPromiseHookEnabledOrHasAsyncEventDelegate()) {
+    runtime::PromiseHookInit(instance, Undefined);
   }
+  return instance;
+}
 
-  struct InvokeThenOneArgFunctor {
-    transitioning
-    macro Call(
-        nativeContext: NativeContext, then: JSAny, receiver: JSAny, arg1: JSAny,
-        _arg2: JSAny): JSAny {
-      return Call(nativeContext, then, receiver, arg1);
-    }
-  }
+macro NewPromiseReaction(implicit context: Context)(
+    handlerContext: Context, next: Zero|PromiseReaction,
+    promiseOrCapability: JSPromise|PromiseCapability|Undefined,
+    fulfillHandler: Callable|Undefined,
+    rejectHandler: Callable|Undefined): PromiseReaction {
+  const nativeContext = LoadNativeContext(handlerContext);
+  return new PromiseReaction{
+    map: PromiseReactionMapConstant(),
+    next: next,
+    reject_handler: rejectHandler,
+    fulfill_handler: fulfillHandler,
+    promise_or_capability: promiseOrCapability,
+    continuation_preserved_embedder_data: nativeContext
+        [NativeContextSlot::CONTINUATION_PRESERVED_EMBEDDER_DATA_INDEX]
+  };
+}
 
-  struct InvokeThenTwoArgFunctor {
-    transitioning
-    macro Call(
-        nativeContext: NativeContext, then: JSAny, receiver: JSAny, arg1: JSAny,
-        arg2: JSAny): JSAny {
-      return Call(nativeContext, then, receiver, arg1, arg2);
-    }
-  }
+extern macro PromiseResolveThenableJobTaskMapConstant(): Map;
 
-  transitioning
-  macro InvokeThen<F: type>(implicit context: Context)(
-      nativeContext: NativeContext, receiver: JSAny, arg1: JSAny, arg2: JSAny,
-      callFunctor: F): JSAny {
-    // We can skip the "then" lookup on {receiver} if it's [[Prototype]]
-    // is the (initial) Promise.prototype and the Promise#then protector
-    // is intact, as that guards the lookup path for the "then" property
-    // on JSPromise instances which have the (initial) %PromisePrototype%.
-    if (!Is<Smi>(receiver) &&
-        IsPromiseThenLookupChainIntact(
-            nativeContext, UnsafeCast<HeapObject>(receiver).map)) {
-      const then = UnsafeCast<JSAny>(
-          nativeContext[NativeContextSlot::PROMISE_THEN_INDEX]);
-      return callFunctor.Call(nativeContext, then, receiver, arg1, arg2);
-    } else
-      deferred {
-        const then = UnsafeCast<JSAny>(GetProperty(receiver, kThenString));
-        return callFunctor.Call(nativeContext, then, receiver, arg1, arg2);
-      }
-  }
+// https://tc39.es/ecma262/#sec-newpromiseresolvethenablejob
+macro NewPromiseResolveThenableJobTask(implicit context: Context)(
+    promiseToResolve: JSPromise, thenable: JSReceiver,
+    then: Callable): PromiseResolveThenableJobTask {
+  // 2. Let getThenRealmResult be GetFunctionRealm(then).
+  // 3. If getThenRealmResult is a normal completion, then let thenRealm be
+  //    getThenRealmResult.[[Value]].
+  // 4. Otherwise, let thenRealm be null.
+  //
+  // The only cases where |thenRealm| can be null is when |then| is a revoked
+  // Proxy object, which would throw when it is called anyway. So instead of
+  // setting the context to null as the spec does, we just use the current
+  // realm.
+  const thenContext: Context = ExtractHandlerContext(then);
+  const nativeContext = LoadNativeContext(thenContext);
+
+  // 1. Let job be a new Job abstract closure with no parameters that
+  //    captures promiseToResolve, thenable, and then...
+  // 5. Return { [[Job]]: job, [[Realm]]: thenRealm }.
+  return new PromiseResolveThenableJobTask{
+    map: PromiseResolveThenableJobTaskMapConstant(),
+    context: nativeContext,
+    promise_to_resolve: promiseToResolve,
+    thenable,
+    then
+  };
+}
 
+struct InvokeThenOneArgFunctor {
   transitioning
-  macro InvokeThen(implicit context: Context)(
-      nativeContext: NativeContext, receiver: JSAny, arg: JSAny): JSAny {
-    return InvokeThen(
-        nativeContext, receiver, arg, Undefined, InvokeThenOneArgFunctor{});
+  macro Call(
+      nativeContext: NativeContext, then: JSAny, receiver: JSAny, arg1: JSAny,
+      _arg2: JSAny): JSAny {
+    return Call(nativeContext, then, receiver, arg1);
   }
+}
 
+struct InvokeThenTwoArgFunctor {
   transitioning
-  macro InvokeThen(implicit context: Context)(
-      nativeContext: NativeContext, receiver: JSAny, arg1: JSAny,
+  macro Call(
+      nativeContext: NativeContext, then: JSAny, receiver: JSAny, arg1: JSAny,
       arg2: JSAny): JSAny {
-    return InvokeThen(
-        nativeContext, receiver, arg1, arg2, InvokeThenTwoArgFunctor{});
+    return Call(nativeContext, then, receiver, arg1, arg2);
   }
+}
 
-  transitioning
-  macro BranchIfAccessCheckFailed(implicit context: Context)(
-      nativeContext: NativeContext, promiseConstructor: JSAny,
-      executor: JSAny): void labels IfNoAccess {
-    try {
-      // If executor is a bound function, load the bound function until we've
-      // reached an actual function.
-      let foundExecutor = executor;
-      while (true) {
-        typeswitch (foundExecutor) {
-          case (f: JSFunction): {
-            // Load the context from the function and compare it to the Promise
-            // constructor's context. If they match, everything is fine,
-            // otherwise, bail out to the runtime.
-            const functionContext = f.context;
-            const nativeFunctionContext = LoadNativeContext(functionContext);
-            if (TaggedEqual(nativeContext, nativeFunctionContext)) {
-              goto HasAccess;
-            } else {
-              goto CallRuntime;
-            }
-          }
-          case (b: JSBoundFunction): {
-            foundExecutor = b.bound_target_function;
-          }
-          case (Object): {
+transitioning
+macro InvokeThen<F: type>(implicit context: Context)(
+    nativeContext: NativeContext, receiver: JSAny, arg1: JSAny, arg2: JSAny,
+    callFunctor: F): JSAny {
+  // We can skip the "then" lookup on {receiver} if it's [[Prototype]]
+  // is the (initial) Promise.prototype and the Promise#then protector
+  // is intact, as that guards the lookup path for the "then" property
+  // on JSPromise instances which have the (initial) %PromisePrototype%.
+  if (!Is<Smi>(receiver) &&
+      IsPromiseThenLookupChainIntact(
+          nativeContext, UnsafeCast<HeapObject>(receiver).map)) {
+    const then =
+        UnsafeCast<JSAny>(nativeContext[NativeContextSlot::PROMISE_THEN_INDEX]);
+    return callFunctor.Call(nativeContext, then, receiver, arg1, arg2);
+  } else
+    deferred {
+      const then = UnsafeCast<JSAny>(GetProperty(receiver, kThenString));
+      return callFunctor.Call(nativeContext, then, receiver, arg1, arg2);
+    }
+}
+
+transitioning
+macro InvokeThen(implicit context: Context)(
+    nativeContext: NativeContext, receiver: JSAny, arg: JSAny): JSAny {
+  return InvokeThen(
+      nativeContext, receiver, arg, Undefined, InvokeThenOneArgFunctor{});
+}
+
+transitioning
+macro InvokeThen(implicit context: Context)(
+    nativeContext: NativeContext, receiver: JSAny, arg1: JSAny,
+    arg2: JSAny): JSAny {
+  return InvokeThen(
+      nativeContext, receiver, arg1, arg2, InvokeThenTwoArgFunctor{});
+}
+
+transitioning
+macro BranchIfAccessCheckFailed(implicit context: Context)(
+    nativeContext: NativeContext, promiseConstructor: JSAny,
+    executor: JSAny): void labels IfNoAccess {
+  try {
+    // If executor is a bound function, load the bound function until we've
+    // reached an actual function.
+    let foundExecutor = executor;
+    while (true) {
+      typeswitch (foundExecutor) {
+        case (f: JSFunction): {
+          // Load the context from the function and compare it to the Promise
+          // constructor's context. If they match, everything is fine,
+          // otherwise, bail out to the runtime.
+          const functionContext = f.context;
+          const nativeFunctionContext = LoadNativeContext(functionContext);
+          if (TaggedEqual(nativeContext, nativeFunctionContext)) {
+            goto HasAccess;
+          } else {
             goto CallRuntime;
           }
         }
+        case (b: JSBoundFunction): {
+          foundExecutor = b.bound_target_function;
+        }
+        case (Object): {
+          goto CallRuntime;
+        }
       }
     }
-    label CallRuntime deferred {
-      const result = runtime::AllowDynamicFunction(promiseConstructor);
-      if (result != True) {
-        goto IfNoAccess;
-      }
+  } label CallRuntime deferred {
+    const result = runtime::AllowDynamicFunction(promiseConstructor);
+    if (result != True) {
+      goto IfNoAccess;
     }
-    label HasAccess {}
-  }
+  } label HasAccess {}
+}
 }
diff --git a/deps/v8/src/builtins/promise-race.tq b/deps/v8/src/builtins/promise-race.tq
index 7e56a08c844..27d2038398a 100644
--- a/deps/v8/src/builtins/promise-race.tq
+++ b/deps/v8/src/builtins/promise-race.tq
@@ -6,126 +6,124 @@
 
 namespace promise {
 
-  extern macro PromiseForwardingHandlerSymbolConstant(): Symbol;
-  const kPromiseForwardingHandlerSymbol: Symbol =
-      PromiseForwardingHandlerSymbolConstant();
-  extern macro PromiseHandledBySymbolConstant(): Symbol;
-  const kPromiseHandledBySymbol: Symbol = PromiseHandledBySymbolConstant();
-  extern macro ResolveStringConstant(): String;
-  const kResolveString: String = ResolveStringConstant();
-  extern macro SetPropertyStrict(Context, Object, Object, Object): Object;
-  extern macro IsPromiseResolveProtectorCellInvalid(): bool;
+extern macro PromiseForwardingHandlerSymbolConstant(): Symbol;
+const kPromiseForwardingHandlerSymbol: Symbol =
+    PromiseForwardingHandlerSymbolConstant();
+extern macro PromiseHandledBySymbolConstant(): Symbol;
+const kPromiseHandledBySymbol: Symbol = PromiseHandledBySymbolConstant();
+extern macro ResolveStringConstant(): String;
+const kResolveString: String = ResolveStringConstant();
+extern macro SetPropertyStrict(Context, Object, Object, Object): Object;
+extern macro IsPromiseResolveProtectorCellInvalid(): bool;
 
-  macro IsPromiseResolveLookupChainIntact(implicit context: Context)(
-      nativeContext: NativeContext, constructor: JSReceiver): bool {
-    if (IsForceSlowPath()) return false;
-    const promiseFun = UnsafeCast<JSFunction>(
-        nativeContext[NativeContextSlot::PROMISE_FUNCTION_INDEX]);
-    return promiseFun == constructor && !IsPromiseResolveProtectorCellInvalid();
-  }
+macro IsPromiseResolveLookupChainIntact(implicit context: Context)(
+    nativeContext: NativeContext, constructor: JSReceiver): bool {
+  if (IsForceSlowPath()) return false;
+  const promiseFun = UnsafeCast<JSFunction>(
+      nativeContext[NativeContextSlot::PROMISE_FUNCTION_INDEX]);
+  return promiseFun == constructor && !IsPromiseResolveProtectorCellInvalid();
+}
 
-  // https://tc39.es/ecma262/#sec-promise.race
-  transitioning javascript builtin
-  PromiseRace(js-implicit context: Context, receiver: JSAny)(iterable: JSAny):
-      JSAny {
-    const receiver = Cast<JSReceiver>(receiver)
-        otherwise ThrowTypeError(
-        MessageTemplate::kCalledOnNonObject, 'Promise.race');
+// https://tc39.es/ecma262/#sec-promise.race
+transitioning javascript builtin
+PromiseRace(
+    js-implicit context: Context, receiver: JSAny)(iterable: JSAny): JSAny {
+  const receiver = Cast<JSReceiver>(receiver)
+      otherwise ThrowTypeError(MessageTemplate::kCalledOnNonObject, 'Promise.race');
 
-    // Let promiseCapability be ? NewPromiseCapability(C).
-    // Don't fire debugEvent so that forwarding the rejection through all does
-    // not trigger redundant ExceptionEvents
-    const capability = NewPromiseCapability(receiver, False);
-    const resolve = capability.resolve;
-    const reject = capability.reject;
-    const promise = capability.promise;
+  // Let promiseCapability be ? NewPromiseCapability(C).
+  // Don't fire debugEvent so that forwarding the rejection through all does
+  // not trigger redundant ExceptionEvents
+  const capability = NewPromiseCapability(receiver, False);
+  const resolve = capability.resolve;
+  const reject = capability.reject;
+  const promise = capability.promise;
 
-    // For catch prediction, don't treat the .then calls as handling it;
-    // instead, recurse outwards.
-    if (IsDebugActive()) deferred {
-        SetPropertyStrict(
-            context, reject, kPromiseForwardingHandlerSymbol, True);
-      }
+  // For catch prediction, don't treat the .then calls as handling it;
+  // instead, recurse outwards.
+  if (IsDebugActive()) deferred {
+      SetPropertyStrict(context, reject, kPromiseForwardingHandlerSymbol, True);
+    }
 
+  try {
+    // Let iterator be GetIterator(iterable).
+    // IfAbruptRejectPromise(iterator, promiseCapability).
+    let i: iterator::IteratorRecord;
     try {
-      // Let iterator be GetIterator(iterable).
-      // IfAbruptRejectPromise(iterator, promiseCapability).
-      let i: iterator::IteratorRecord;
-      try {
-        i = iterator::GetIterator(iterable);
-      } catch (e) deferred {
-        goto Reject(e);
-      }
+      i = iterator::GetIterator(iterable);
+    } catch (e) deferred {
+      goto Reject(e);
+    }
 
-      // Let result be PerformPromiseRace(iteratorRecord, C, promiseCapability).
-      try {
-        // We can skip the "resolve" lookup on {constructor} if it's the
-        // Promise constructor and the Promise.resolve protector is intact,
-        // as that guards the lookup path for the "resolve" property on the
-        // Promise constructor.
-        const nativeContext = LoadNativeContext(context);
-        let promiseResolveFunction: JSAny = Undefined;
-        if (!IsPromiseResolveLookupChainIntact(nativeContext, receiver))
-          deferred {
-            // 3. Let _promiseResolve_ be ? Get(_constructor_, `"resolve"`).
-            const resolve = GetProperty(receiver, kResolveString);
+    // Let result be PerformPromiseRace(iteratorRecord, C, promiseCapability).
+    try {
+      // We can skip the "resolve" lookup on {constructor} if it's the
+      // Promise constructor and the Promise.resolve protector is intact,
+      // as that guards the lookup path for the "resolve" property on the
+      // Promise constructor.
+      const nativeContext = LoadNativeContext(context);
+      let promiseResolveFunction: JSAny = Undefined;
+      if (!IsPromiseResolveLookupChainIntact(nativeContext, receiver))
+        deferred {
+          // 3. Let _promiseResolve_ be ? Get(_constructor_, `"resolve"`).
+          const resolve = GetProperty(receiver, kResolveString);
 
-            // 4. If IsCallable(_promiseResolve_) is *false*, throw a
-            // *TypeError* exception.
-            promiseResolveFunction = Cast<Callable>(resolve)
-                otherwise ThrowTypeError(
-                MessageTemplate::kCalledNonCallable, 'resolve');
-          }
+          // 4. If IsCallable(_promiseResolve_) is *false*, throw a
+          // *TypeError* exception.
+          promiseResolveFunction = Cast<Callable>(resolve)
+              otherwise ThrowTypeError(
+              MessageTemplate::kCalledNonCallable, 'resolve');
+        }
 
-        const fastIteratorResultMap = UnsafeCast<Map>(
-            nativeContext[NativeContextSlot::ITERATOR_RESULT_MAP_INDEX]);
-        while (true) {
-          let nextValue: JSAny;
-          try {
-            // Let next be IteratorStep(iteratorRecord.[[Iterator]]).
-            // If next is an abrupt completion, set iteratorRecord.[[Done]] to
-            // true. ReturnIfAbrupt(next).
-            const next: JSReceiver = iterator::IteratorStep(
-                i, fastIteratorResultMap) otherwise return promise;
+      const fastIteratorResultMap = UnsafeCast<Map>(
+          nativeContext[NativeContextSlot::ITERATOR_RESULT_MAP_INDEX]);
+      while (true) {
+        let nextValue: JSAny;
+        try {
+          // Let next be IteratorStep(iteratorRecord.[[Iterator]]).
+          // If next is an abrupt completion, set iteratorRecord.[[Done]] to
+          // true. ReturnIfAbrupt(next).
+          const next: JSReceiver = iterator::IteratorStep(
+              i, fastIteratorResultMap) otherwise return promise;
 
-            // Let nextValue be IteratorValue(next).
-            // If nextValue is an abrupt completion, set iteratorRecord.[[Done]]
-            // to true.
-            // ReturnIfAbrupt(nextValue).
-            nextValue = iterator::IteratorValue(next, fastIteratorResultMap);
-          } catch (e) {
-            goto Reject(e);
-          }
-          // Let nextPromise be ? Call(constructor, _promiseResolve_, «
-          // nextValue »).
-          const nextPromise = CallResolve(
-              UnsafeCast<Constructor>(receiver), promiseResolveFunction,
-              nextValue);
+          // Let nextValue be IteratorValue(next).
+          // If nextValue is an abrupt completion, set iteratorRecord.[[Done]]
+          // to true.
+          // ReturnIfAbrupt(nextValue).
+          nextValue = iterator::IteratorValue(next, fastIteratorResultMap);
+        } catch (e) {
+          goto Reject(e);
+        }
+        // Let nextPromise be ? Call(constructor, _promiseResolve_, «
+        // nextValue »).
+        const nextPromise = CallResolve(
+            UnsafeCast<Constructor>(receiver), promiseResolveFunction,
+            nextValue);
 
-          // Perform ? Invoke(nextPromise, "then", « resolveElement,
-          //                  resultCapability.[[Reject]] »).
-          const then = GetProperty(nextPromise, kThenString);
-          const thenResult = Call(
-              context, then, nextPromise, UnsafeCast<JSAny>(resolve),
-              UnsafeCast<JSAny>(reject));
+        // Perform ? Invoke(nextPromise, "then", « resolveElement,
+        //                  resultCapability.[[Reject]] »).
+        const then = GetProperty(nextPromise, kThenString);
+        const thenResult = Call(
+            context, then, nextPromise, UnsafeCast<JSAny>(resolve),
+            UnsafeCast<JSAny>(reject));
 
-          // For catch prediction, mark that rejections here are semantically
-          // handled by the combined Promise.
-          if (IsDebugActive() && !Is<JSPromise>(promise)) deferred {
-              SetPropertyStrict(
-                  context, thenResult, kPromiseHandledBySymbol, promise);
-            }
-        }
-      } catch (e) deferred {
-        iterator::IteratorCloseOnException(i, e) otherwise Reject;
+        // For catch prediction, mark that rejections here are semantically
+        // handled by the combined Promise.
+        if (IsDebugActive() && !Is<JSPromise>(promise)) deferred {
+            SetPropertyStrict(
+                context, thenResult, kPromiseHandledBySymbol, promise);
+          }
       }
+    } catch (e) deferred {
+      iterator::IteratorCloseOnException(i);
+      goto Reject(e);
     }
-    label Reject(exception: Object) deferred {
-      Call(
-          context, UnsafeCast<JSAny>(reject), Undefined,
-          UnsafeCast<JSAny>(exception));
-      return promise;
-    }
-    unreachable;
+  } label Reject(exception: Object) deferred {
+    Call(
+        context, UnsafeCast<JSAny>(reject), Undefined,
+        UnsafeCast<JSAny>(exception));
+    return promise;
   }
+  unreachable;
+}
 }
diff --git a/deps/v8/src/builtins/promise-reaction-job.tq b/deps/v8/src/builtins/promise-reaction-job.tq
index 1d20d22efbb..1e89da02617 100644
--- a/deps/v8/src/builtins/promise-reaction-job.tq
+++ b/deps/v8/src/builtins/promise-reaction-job.tq
@@ -4,130 +4,120 @@
 
 #include 'src/builtins/builtins-promise-gen.h'
 
-namespace runtime {
-  extern transitioning runtime
-  ReportMessage(implicit context: Context)(JSAny): JSAny;
-}
-
 namespace promise {
 
-  transitioning
-  macro RejectPromiseReactionJob(
-      context: Context,
-      promiseOrCapability: JSPromise|PromiseCapability|Undefined, reason: JSAny,
-      reactionType: constexpr PromiseReactionType): JSAny {
-    if constexpr (reactionType == kPromiseReactionReject) {
-      typeswitch (promiseOrCapability) {
-        case (promise: JSPromise): {
-          // For fast native promises we can skip the indirection via the
-          // promiseCapability.[[Reject]] function and run the resolve logic
-          // directly from here.
-          return RejectPromise(promise, reason, False);
-        }
-        case (Undefined): {
-          return Undefined;
-        }
-        case (capability: PromiseCapability): {
-          // In the general case we need to call the (user provided)
-          // promiseCapability.[[Reject]] function.
-          try {
-            const reject = UnsafeCast<Callable>(capability.reject);
-            return Call(context, reject, Undefined, reason);
-          } catch (e) {
-            // Swallow the exception here.
-            return runtime::ReportMessage(e);
-          }
-        }
-      }
-    } else {
-      StaticAssert(reactionType == kPromiseReactionFulfill);
-      // We have to call out to the dedicated PromiseRejectReactionJob
-      // builtin here, instead of just doing the work inline, as otherwise
-      // the catch predictions in the debugger will be wrong, which just
-      // walks the stack and checks for certain builtins.
-      return PromiseRejectReactionJob(reason, Undefined, promiseOrCapability);
-    }
-  }
-
-  transitioning
-  macro FuflfillPromiseReactionJob(
-      context: Context,
-      promiseOrCapability: JSPromise|PromiseCapability|Undefined, result: JSAny,
-      reactionType: constexpr PromiseReactionType): JSAny {
+transitioning
+macro RejectPromiseReactionJob(
+    context: Context,
+    promiseOrCapability: JSPromise|PromiseCapability|Undefined, reason: JSAny,
+    reactionType: constexpr PromiseReactionType): JSAny {
+  if constexpr (reactionType == kPromiseReactionReject) {
     typeswitch (promiseOrCapability) {
       case (promise: JSPromise): {
         // For fast native promises we can skip the indirection via the
-        // promiseCapability.[[Resolve]] function and run the resolve logic
+        // promiseCapability.[[Reject]] function and run the resolve logic
         // directly from here.
-        return ResolvePromise(context, promise, result);
+        return RejectPromise(promise, reason, False);
       }
       case (Undefined): {
         return Undefined;
       }
       case (capability: PromiseCapability): {
         // In the general case we need to call the (user provided)
-        // promiseCapability.[[Resolve]] function.
-        const resolve = UnsafeCast<Callable>(capability.resolve);
-        try {
-          return Call(context, resolve, Undefined, result);
-        } catch (e) {
-          return RejectPromiseReactionJob(
-              context, promiseOrCapability, e, reactionType);
-        }
+        // promiseCapability.[[Reject]] function.
+        const reject = UnsafeCast<Callable>(capability.reject);
+        return Call(context, reject, Undefined, reason);
       }
     }
+  } else {
+    StaticAssert(reactionType == kPromiseReactionFulfill);
+    // We have to call out to the dedicated PromiseRejectReactionJob
+    // builtin here, instead of just doing the work inline, as otherwise
+    // the catch predictions in the debugger will be wrong, which just
+    // walks the stack and checks for certain builtins.
+    return PromiseRejectReactionJob(reason, Undefined, promiseOrCapability);
   }
+}
 
-  // https://tc39.es/ecma262/#sec-promisereactionjob
-  transitioning
-  macro PromiseReactionJob(
-      context: Context, argument: JSAny, handler: Callable|Undefined,
-      promiseOrCapability: JSPromise|PromiseCapability|Undefined,
-      reactionType: constexpr PromiseReactionType): JSAny {
-    if (handler == Undefined) {
-      if constexpr (reactionType == kPromiseReactionFulfill) {
-        return FuflfillPromiseReactionJob(
-            context, promiseOrCapability, argument, reactionType);
-      } else {
-        StaticAssert(reactionType == kPromiseReactionReject);
-        return RejectPromiseReactionJob(
-            context, promiseOrCapability, argument, reactionType);
-      }
-    } else {
+transitioning
+macro FuflfillPromiseReactionJob(
+    context: Context,
+    promiseOrCapability: JSPromise|PromiseCapability|Undefined, result: JSAny,
+    reactionType: constexpr PromiseReactionType): JSAny {
+  typeswitch (promiseOrCapability) {
+    case (promise: JSPromise): {
+      // For fast native promises we can skip the indirection via the
+      // promiseCapability.[[Resolve]] function and run the resolve logic
+      // directly from here.
+      return ResolvePromise(context, promise, result);
+    }
+    case (Undefined): {
+      return Undefined;
+    }
+    case (capability: PromiseCapability): {
+      // In the general case we need to call the (user provided)
+      // promiseCapability.[[Resolve]] function.
+      const resolve = UnsafeCast<Callable>(capability.resolve);
       try {
-        const result =
-            Call(context, UnsafeCast<Callable>(handler), Undefined, argument);
-        if (promiseOrCapability == Undefined) {
-          // There's no [[Capability]] for this promise reaction job, which
-          // means that this is a specification-internal operation (aka
-          // await) where the result does not matter (see the specification
-          // change in https://github.com/tc39/ecma262/pull/1146 for
-          // details).
-          return Undefined;
-        } else {
-          return FuflfillPromiseReactionJob(
-              context, promiseOrCapability, result, reactionType);
-        }
+        return Call(context, resolve, Undefined, result);
       } catch (e) {
         return RejectPromiseReactionJob(
             context, promiseOrCapability, e, reactionType);
       }
     }
   }
+}
 
-  transitioning builtin
-  PromiseFulfillReactionJob(implicit context: Context)(
-      value: JSAny, handler: Callable|Undefined,
-      promiseOrCapability: JSPromise|PromiseCapability|Undefined): JSAny {
-    return PromiseReactionJob(
-        context, value, handler, promiseOrCapability, kPromiseReactionFulfill);
+// https://tc39.es/ecma262/#sec-promisereactionjob
+transitioning
+macro PromiseReactionJob(
+    context: Context, argument: JSAny, handler: Callable|Undefined,
+    promiseOrCapability: JSPromise|PromiseCapability|Undefined,
+    reactionType: constexpr PromiseReactionType): JSAny {
+  if (handler == Undefined) {
+    if constexpr (reactionType == kPromiseReactionFulfill) {
+      return FuflfillPromiseReactionJob(
+          context, promiseOrCapability, argument, reactionType);
+    } else {
+      StaticAssert(reactionType == kPromiseReactionReject);
+      return RejectPromiseReactionJob(
+          context, promiseOrCapability, argument, reactionType);
+    }
+  } else {
+    try {
+      const result =
+          Call(context, UnsafeCast<Callable>(handler), Undefined, argument);
+      if (promiseOrCapability == Undefined) {
+        // There's no [[Capability]] for this promise reaction job, which
+        // means that this is a specification-internal operation (aka
+        // await) where the result does not matter (see the specification
+        // change in https://github.com/tc39/ecma262/pull/1146 for
+        // details).
+        return Undefined;
+      } else {
+        return FuflfillPromiseReactionJob(
+            context, promiseOrCapability, result, reactionType);
+      }
+    } catch (e) {
+      return RejectPromiseReactionJob(
+          context, promiseOrCapability, e, reactionType);
+    }
   }
+}
 
-  transitioning builtin
-  PromiseRejectReactionJob(implicit context: Context)(
-      reason: JSAny, handler: Callable|Undefined,
-      promiseOrCapability: JSPromise|PromiseCapability|Undefined): JSAny {
-    return PromiseReactionJob(
-        context, reason, handler, promiseOrCapability, kPromiseReactionReject);
-  }
+transitioning builtin
+PromiseFulfillReactionJob(implicit context: Context)(
+    value: JSAny, handler: Callable|Undefined,
+    promiseOrCapability: JSPromise|PromiseCapability|Undefined): JSAny {
+  return PromiseReactionJob(
+      context, value, handler, promiseOrCapability, kPromiseReactionFulfill);
+}
+
+transitioning builtin
+PromiseRejectReactionJob(implicit context: Context)(
+    reason: JSAny, handler: Callable|Undefined,
+    promiseOrCapability: JSPromise|PromiseCapability|Undefined): JSAny {
+  return PromiseReactionJob(
+      context, reason, handler, promiseOrCapability, kPromiseReactionReject);
+}
 }
diff --git a/deps/v8/src/builtins/promise-resolve.tq b/deps/v8/src/builtins/promise-resolve.tq
index 0fc98b556b2..dbb60720c04 100644
--- a/deps/v8/src/builtins/promise-resolve.tq
+++ b/deps/v8/src/builtins/promise-resolve.tq
@@ -5,190 +5,180 @@
 #include 'src/builtins/builtins-promise-gen.h'
 
 namespace runtime {
-  extern transitioning runtime
-  ResolvePromise(implicit context: Context)(JSPromise, JSAny): JSAny;
+extern transitioning runtime
+ResolvePromise(implicit context: Context)(JSPromise, JSAny): JSAny;
 }
 
 namespace promise {
-  extern macro ConstructorStringConstant(): String;
-  const kConstructorString: String = ConstructorStringConstant();
-
-  // https://tc39.es/ecma262/#sec-promise.resolve
-  transitioning javascript builtin
-  PromiseResolveTrampoline(js-implicit context: NativeContext, receiver: JSAny)(
-      value: JSAny): JSAny {
-    // 1. Let C be the this value.
-    // 2. If Type(C) is not Object, throw a TypeError exception.
-    const receiver = Cast<JSReceiver>(receiver) otherwise
-    ThrowTypeError(MessageTemplate::kCalledOnNonObject, 'PromiseResolve');
-
-    // 3. Return ? PromiseResolve(C, x).
-    return PromiseResolve(receiver, value);
-  }
-
-  transitioning builtin
-  PromiseResolve(implicit context:
-                     Context)(constructor: JSReceiver, value: JSAny): JSAny {
-    const nativeContext = LoadNativeContext(context);
-    const promiseFun = nativeContext[NativeContextSlot::PROMISE_FUNCTION_INDEX];
-    try {
-      // Check if {value} is a JSPromise.
-      const value = Cast<JSPromise>(value) otherwise NeedToAllocate;
-
-      // We can skip the "constructor" lookup on {value} if it's [[Prototype]]
-      // is the (initial) Promise.prototype and the @@species protector is
-      // intact, as that guards the lookup path for "constructor" on
-      // JSPromise instances which have the (initial) Promise.prototype.
-      const promisePrototype =
-          nativeContext[NativeContextSlot::PROMISE_PROTOTYPE_INDEX];
-      if (value.map.prototype != promisePrototype) {
-        goto SlowConstructor;
-      }
-
-      if (IsPromiseSpeciesProtectorCellInvalid()) goto SlowConstructor;
+extern macro ConstructorStringConstant(): String;
+const kConstructorString: String = ConstructorStringConstant();
+
+// https://tc39.es/ecma262/#sec-promise.resolve
+transitioning javascript builtin
+PromiseResolveTrampoline(
+    js-implicit context: NativeContext, receiver: JSAny)(value: JSAny): JSAny {
+  // 1. Let C be the this value.
+  // 2. If Type(C) is not Object, throw a TypeError exception.
+  const receiver = Cast<JSReceiver>(receiver) otherwise
+  ThrowTypeError(MessageTemplate::kCalledOnNonObject, 'PromiseResolve');
+
+  // 3. Return ? PromiseResolve(C, x).
+  return PromiseResolve(receiver, value);
+}
 
-      // If the {constructor} is the Promise function, we just immediately
-      // return the {value} here and don't bother wrapping it into a
-      // native Promise.
-      if (promiseFun != constructor) goto SlowConstructor;
-      return value;
-    }
-    label SlowConstructor deferred {
-      // At this point, value or/and constructor are not native promises, but
-      // they could be of the same subclass.
-      const valueConstructor = GetProperty(value, kConstructorString);
-      if (valueConstructor != constructor) goto NeedToAllocate;
-      return value;
-    }
-    label NeedToAllocate {
-      if (promiseFun == constructor) {
-        // This adds a fast path for native promises that don't need to
-        // create NewPromiseCapability.
-        const result = NewJSPromise();
-        ResolvePromise(context, result, value);
-        return result;
-      } else
-        deferred {
-          const capability = NewPromiseCapability(constructor, True);
-          const resolve = UnsafeCast<Callable>(capability.resolve);
-          Call(context, resolve, Undefined, value);
-          return capability.promise;
-        }
+transitioning builtin
+PromiseResolve(implicit context: Context)(
+    constructor: JSReceiver, value: JSAny): JSAny {
+  const nativeContext = LoadNativeContext(context);
+  const promiseFun = nativeContext[NativeContextSlot::PROMISE_FUNCTION_INDEX];
+  try {
+    // Check if {value} is a JSPromise.
+    const value = Cast<JSPromise>(value) otherwise NeedToAllocate;
+
+    // We can skip the "constructor" lookup on {value} if it's [[Prototype]]
+    // is the (initial) Promise.prototype and the @@species protector is
+    // intact, as that guards the lookup path for "constructor" on
+    // JSPromise instances which have the (initial) Promise.prototype.
+    const promisePrototype =
+        nativeContext[NativeContextSlot::PROMISE_PROTOTYPE_INDEX];
+    if (value.map.prototype != promisePrototype) {
+      goto SlowConstructor;
     }
-  }
-
-  extern macro IsJSReceiverMap(Map): bool;
 
-  extern macro IsPromiseThenProtectorCellInvalid(): bool;
-
-  extern macro ThenStringConstant(): String;
-
-  const kThenString: String = ThenStringConstant();
-
-  transitioning builtin
-  ResolvePromise(implicit context:
-                     Context)(promise: JSPromise, resolution: JSAny): JSAny {
-    // 6. If SameValue(resolution, promise) is true, then
-    // If promise hook is enabled or the debugger is active, let
-    // the runtime handle this operation, which greatly reduces
-    // the complexity here and also avoids a couple of back and
-    // forth between JavaScript and C++ land.
-    // We also let the runtime handle it if promise == resolution.
-    // We can use pointer comparison here, since the {promise} is guaranteed
-    // to be a JSPromise inside this function and thus is reference comparable.
-    if (IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate() ||
-        TaggedEqual(promise, resolution))
+    if (IsPromiseSpeciesProtectorCellInvalid()) goto SlowConstructor;
+
+    // If the {constructor} is the Promise function, we just immediately
+    // return the {value} here and don't bother wrapping it into a
+    // native Promise.
+    if (promiseFun != constructor) goto SlowConstructor;
+    return value;
+  } label SlowConstructor deferred {
+    // At this point, value or/and constructor are not native promises, but
+    // they could be of the same subclass.
+    const valueConstructor = GetProperty(value, kConstructorString);
+    if (valueConstructor != constructor) goto NeedToAllocate;
+    return value;
+  } label NeedToAllocate {
+    if (promiseFun == constructor) {
+      // This adds a fast path for native promises that don't need to
+      // create NewPromiseCapability.
+      const result = NewJSPromise();
+      ResolvePromise(context, result, value);
+      return result;
+    } else
       deferred {
-        return runtime::ResolvePromise(promise, resolution);
-      }
-
-    let then: Object = Undefined;
-    try {
-      // 7. If Type(resolution) is not Object, then
-      // 7.b Return FulfillPromise(promise, resolution).
-      if (TaggedIsSmi(resolution)) {
-        return FulfillPromise(promise, resolution);
+        const capability = NewPromiseCapability(constructor, True);
+        const resolve = UnsafeCast<Callable>(capability.resolve);
+        Call(context, resolve, Undefined, value);
+        return capability.promise;
       }
+  }
+}
 
-      const heapResolution = UnsafeCast<HeapObject>(resolution);
-      const resolutionMap = heapResolution.map;
-      if (!IsJSReceiverMap(resolutionMap)) {
-        return FulfillPromise(promise, resolution);
-      }
+extern macro IsJSReceiverMap(Map): bool;
+
+extern macro IsPromiseThenProtectorCellInvalid(): bool;
+
+extern macro ThenStringConstant(): String;
+
+const kThenString: String = ThenStringConstant();
+
+// https://tc39.es/ecma262/#sec-promise-resolve-functions
+transitioning builtin
+ResolvePromise(implicit context: Context)(
+    promise: JSPromise, resolution: JSAny): JSAny {
+  // 7. If SameValue(resolution, promise) is true, then
+  // If promise hook is enabled or the debugger is active, let
+  // the runtime handle this operation, which greatly reduces
+  // the complexity here and also avoids a couple of back and
+  // forth between JavaScript and C++ land.
+  // We also let the runtime handle it if promise == resolution.
+  // We can use pointer comparison here, since the {promise} is guaranteed
+  // to be a JSPromise inside this function and thus is reference comparable.
+  if (IsPromiseHookEnabledOrDebugIsActiveOrHasAsyncEventDelegate() ||
+      TaggedEqual(promise, resolution))
+    deferred {
+      return runtime::ResolvePromise(promise, resolution);
+    }
 
-      // We can skip the "then" lookup on {resolution} if its [[Prototype]]
-      // is the (initial) Promise.prototype and the Promise#then protector
-      // is intact, as that guards the lookup path for the "then" property
-      // on JSPromise instances which have the (initial) %PromisePrototype%.
-      if (IsForceSlowPath()) {
-        goto Slow;
-      }
+  let then: Object = Undefined;
+  try {
+    // 8. If Type(resolution) is not Object, then
+    // 8.a Return FulfillPromise(promise, resolution).
+    if (TaggedIsSmi(resolution)) {
+      return FulfillPromise(promise, resolution);
+    }
 
-      if (IsPromiseThenProtectorCellInvalid()) {
-        goto Slow;
-      }
+    const heapResolution = UnsafeCast<HeapObject>(resolution);
+    const resolutionMap = heapResolution.map;
+    if (!IsJSReceiverMap(resolutionMap)) {
+      return FulfillPromise(promise, resolution);
+    }
 
-      const nativeContext = LoadNativeContext(context);
-      if (!IsJSPromiseMap(resolutionMap)) {
-        // We can skip the lookup of "then" if the {resolution} is a (newly
-        // created) IterResultObject, as the Promise#then() protector also
-        // ensures that the intrinsic %ObjectPrototype% doesn't contain any
-        // "then" property. This helps to avoid negative lookups on iterator
-        // results from async generators.
-        assert(IsJSReceiverMap(resolutionMap));
-        assert(!IsPromiseThenProtectorCellInvalid());
-        if (resolutionMap ==
-            nativeContext[NativeContextSlot::ITERATOR_RESULT_MAP_INDEX]) {
-          return FulfillPromise(promise, resolution);
-        } else {
-          goto Slow;
-        }
-      }
+    // We can skip the "then" lookup on {resolution} if its [[Prototype]]
+    // is the (initial) Promise.prototype and the Promise#then protector
+    // is intact, as that guards the lookup path for the "then" property
+    // on JSPromise instances which have the (initial) %PromisePrototype%.
+    if (IsForceSlowPath()) {
+      goto Slow;
+    }
 
-      const promisePrototype =
-          nativeContext[NativeContextSlot::PROMISE_PROTOTYPE_INDEX];
-      if (resolutionMap.prototype == promisePrototype) {
-        // The {resolution} is a native Promise in this case.
-        then = nativeContext[NativeContextSlot::PROMISE_THEN_INDEX];
-        goto Enqueue;
-      }
+    if (IsPromiseThenProtectorCellInvalid()) {
       goto Slow;
     }
-    label Slow deferred {
-      // 8. Let then be Get(resolution, "then").
-      // 9. If then is an abrupt completion, then
-      // 9.a Return RejectPromise(promise, then.[[Value]]).
-      try {
-        then = GetProperty(resolution, kThenString);
-      } catch (e) {
-        return RejectPromise(promise, e, False);
-      }
 
-      // 11. If IsCallable(thenAction) is false, then
-      if (TaggedIsSmi(then)) {
+    const nativeContext = LoadNativeContext(context);
+    if (!IsJSPromiseMap(resolutionMap)) {
+      // We can skip the lookup of "then" if the {resolution} is a (newly
+      // created) IterResultObject, as the Promise#then() protector also
+      // ensures that the intrinsic %ObjectPrototype% doesn't contain any
+      // "then" property. This helps to avoid negative lookups on iterator
+      // results from async generators.
+      assert(IsJSReceiverMap(resolutionMap));
+      assert(!IsPromiseThenProtectorCellInvalid());
+      if (resolutionMap ==
+          nativeContext[NativeContextSlot::ITERATOR_RESULT_MAP_INDEX]) {
         return FulfillPromise(promise, resolution);
+      } else {
+        goto Slow;
       }
+    }
 
-      if (!IsCallable(UnsafeCast<HeapObject>(then))) {
-        return FulfillPromise(promise, resolution);
-      }
+    const promisePrototype =
+        nativeContext[NativeContextSlot::PROMISE_PROTOTYPE_INDEX];
+    if (resolutionMap.prototype == promisePrototype) {
+      // The {resolution} is a native Promise in this case.
+      then = nativeContext[NativeContextSlot::PROMISE_THEN_INDEX];
       goto Enqueue;
     }
-    label Enqueue {
-      // 12. Perform EnqueueJob("PromiseJobs", PromiseResolveThenableJob,
-      //                        «promise, resolution, thenAction»).
-
-      // According to HTML, we use the context of the then function
-      // (|thenAction|) as the context of the microtask. See step 3 of HTML's
-      // EnqueueJob:
-      // https://html.spec.whatwg.org/C/#enqueuejob(queuename,-job,-arguments)
-      const thenContext: Context =
-          ExtractHandlerContext(UnsafeCast<Callable>(then));
-      const nativeContext = LoadNativeContext(thenContext);
-      const task = NewPromiseResolveThenableJobTask(
-          promise, UnsafeCast<JSReceiver>(then),
-          UnsafeCast<JSReceiver>(resolution), nativeContext);
-      return EnqueueMicrotask(nativeContext, task);
+    goto Slow;
+  } label Slow deferred {
+    // 9. Let then be Get(resolution, "then").
+    // 10. If then is an abrupt completion, then
+    try {
+      then = GetProperty(resolution, kThenString);
+    } catch (e) {
+      // a. Return RejectPromise(promise, then.[[Value]]).
+      return RejectPromise(promise, e, False);
     }
+
+    // 11. Let thenAction be then.[[Value]].
+    // 12. If IsCallable(thenAction) is false, then
+    if (!Is<Callable>(then)) {
+      // a. Return FulfillPromise(promise, resolution).
+      return FulfillPromise(promise, resolution);
+    }
+    goto Enqueue;
+  } label Enqueue {
+    // 13. Let job be NewPromiseResolveThenableJob(promise, resolution,
+    //                                             thenAction).
+    const task = NewPromiseResolveThenableJobTask(
+        promise, UnsafeCast<JSReceiver>(resolution),
+        UnsafeCast<Callable>(then));
+
+    // 14. Perform HostEnqueuePromiseJob(job.[[Job]], job.[[Realm]]).
+    // 15. Return undefined.
+    return EnqueueMicrotask(task.context, task);
   }
 }
+}
diff --git a/deps/v8/src/builtins/promise-then.tq b/deps/v8/src/builtins/promise-then.tq
index 45f8fd0c81f..3de6d277d84 100644
--- a/deps/v8/src/builtins/promise-then.tq
+++ b/deps/v8/src/builtins/promise-then.tq
@@ -6,74 +6,69 @@
 
 namespace promise {
 
-  macro
-  IsPromiseSpeciesLookupChainIntact(
-      nativeContext: NativeContext, promiseMap: Map): bool {
-    const promisePrototype =
-        nativeContext[NativeContextSlot::PROMISE_PROTOTYPE_INDEX];
-    if (IsForceSlowPath()) return false;
-    if (promiseMap.prototype != promisePrototype) return false;
-    return !IsPromiseSpeciesProtectorCellInvalid();
-  }
-
-  // https://tc39.es/ecma262/#sec-promise.prototype.then
-  transitioning javascript builtin
-  PromisePrototypeThen(js-implicit context: NativeContext, receiver: JSAny)(
-      onFulfilled: JSAny, onRejected: JSAny): JSAny {
-    // 1. Let promise be the this value.
-    // 2. If IsPromise(promise) is false, throw a TypeError exception.
-    const promise = Cast<JSPromise>(receiver) otherwise ThrowTypeError(
-        MessageTemplate::kIncompatibleMethodReceiver, 'Promise.prototype.then',
-        receiver);
+macro
+IsPromiseSpeciesLookupChainIntact(
+    nativeContext: NativeContext, promiseMap: Map): bool {
+  const promisePrototype =
+      nativeContext[NativeContextSlot::PROMISE_PROTOTYPE_INDEX];
+  if (IsForceSlowPath()) return false;
+  if (promiseMap.prototype != promisePrototype) return false;
+  return !IsPromiseSpeciesProtectorCellInvalid();
+}
 
-    // 3. Let C be ? SpeciesConstructor(promise, %Promise%).
-    const promiseFun = UnsafeCast<JSFunction>(
-        context[NativeContextSlot::PROMISE_FUNCTION_INDEX]);
+// https://tc39.es/ecma262/#sec-promise.prototype.then
+transitioning javascript builtin
+PromisePrototypeThen(js-implicit context: NativeContext, receiver: JSAny)(
+    onFulfilled: JSAny, onRejected: JSAny): JSAny {
+  // 1. Let promise be the this value.
+  // 2. If IsPromise(promise) is false, throw a TypeError exception.
+  const promise = Cast<JSPromise>(receiver) otherwise ThrowTypeError(
+      MessageTemplate::kIncompatibleMethodReceiver, 'Promise.prototype.then',
+      receiver);
 
-    // 4. Let resultCapability be ? NewPromiseCapability(C).
-    let resultPromiseOrCapability: JSPromise|PromiseCapability;
-    let resultPromise: JSAny;
-    try {
-      if (IsPromiseSpeciesLookupChainIntact(context, promise.map)) {
-        goto AllocateAndInit;
-      }
+  // 3. Let C be ? SpeciesConstructor(promise, %Promise%).
+  const promiseFun = UnsafeCast<JSFunction>(
+      context[NativeContextSlot::PROMISE_FUNCTION_INDEX]);
 
-      const constructor = SpeciesConstructor(promise, promiseFun);
-      if (TaggedEqual(constructor, promiseFun)) {
-        goto AllocateAndInit;
-      } else {
-        const promiseCapability = NewPromiseCapability(constructor, True);
-        resultPromiseOrCapability = promiseCapability;
-        resultPromise = promiseCapability.promise;
-      }
+  // 4. Let resultCapability be ? NewPromiseCapability(C).
+  let resultPromiseOrCapability: JSPromise|PromiseCapability;
+  let resultPromise: JSAny;
+  try {
+    if (IsPromiseSpeciesLookupChainIntact(context, promise.map)) {
+      goto AllocateAndInit;
     }
-    label AllocateAndInit {
-      const resultJSPromise = NewJSPromise(promise);
-      resultPromiseOrCapability = resultJSPromise;
-      resultPromise = resultJSPromise;
+
+    const constructor = SpeciesConstructor(promise, promiseFun);
+    if (TaggedEqual(constructor, promiseFun)) {
+      goto AllocateAndInit;
+    } else {
+      const promiseCapability = NewPromiseCapability(constructor, True);
+      resultPromiseOrCapability = promiseCapability;
+      resultPromise = promiseCapability.promise;
     }
+  } label AllocateAndInit {
+    const resultJSPromise = NewJSPromise(promise);
+    resultPromiseOrCapability = resultJSPromise;
+    resultPromise = resultJSPromise;
+  }
 
-    // We do some work of the PerformPromiseThen operation here, in that
-    // we check the handlers and turn non-callable handlers into undefined.
-    // This is because this is the one and only callsite of PerformPromiseThen
-    // that has to do this.
+  // We do some work of the PerformPromiseThen operation here, in that
+  // we check the handlers and turn non-callable handlers into undefined.
+  // This is because this is the one and only callsite of PerformPromiseThen
+  // that has to do this.
 
-    // 3. If IsCallable(onFulfilled) is false, then
-    //    a. Set onFulfilled to undefined.
-    const onFulfilled = TaggedIsCallable(onFulfilled) ?
-        UnsafeCast<Callable>(onFulfilled) :
-        Undefined;
+  // 3. If IsCallable(onFulfilled) is false, then
+  //    a. Set onFulfilled to undefined.
+  const onFulfilled = CastOrDefault<Callable>(onFulfilled, Undefined);
 
-    // 4. If IsCallable(onRejected) is false, then
-    //    a. Set onRejected to undefined.
-    const onRejected = TaggedIsCallable(onRejected) ?
-        UnsafeCast<Callable>(onRejected) :
-        Undefined;
+  // 4. If IsCallable(onRejected) is false, then
+  //    a. Set onRejected to undefined.
+  const onRejected = CastOrDefault<Callable>(onRejected, Undefined);
 
-    // 5. Return PerformPromiseThen(promise, onFulfilled, onRejected,
-    //    resultCapability).
-    PerformPromiseThenImpl(
-        promise, onFulfilled, onRejected, resultPromiseOrCapability);
-    return resultPromise;
-  }
+  // 5. Return PerformPromiseThen(promise, onFulfilled, onRejected,
+  //    resultCapability).
+  PerformPromiseThenImpl(
+      promise, onFulfilled, onRejected, resultPromiseOrCapability);
+  return resultPromise;
+}
 }
diff --git a/deps/v8/src/builtins/proxy-constructor.tq b/deps/v8/src/builtins/proxy-constructor.tq
index ef886e4f287..ea31ff6db87 100644
--- a/deps/v8/src/builtins/proxy-constructor.tq
+++ b/deps/v8/src/builtins/proxy-constructor.tq
@@ -6,55 +6,40 @@
 
 namespace proxy {
 
-  // ES #sec-proxy-constructor
-  // https://tc39.github.io/ecma262/#sec-proxy-constructor
-  transitioning javascript builtin
-  ProxyConstructor(
-      js-implicit context: NativeContext, receiver: JSAny,
-      newTarget: JSAny)(target: JSAny, handler: JSAny): JSProxy {
-    try {
-      // 1. If NewTarget is undefined, throw a TypeError exception.
-      if (newTarget == Undefined) {
-        ThrowTypeError(MessageTemplate::kConstructorNotFunction, 'Proxy');
-      }
-
-      // 2. Return ? ProxyCreate(target, handler).
-      // https://tc39.github.io/ecma262/#sec-proxycreate
-      // 1. If Type(target) is not Object, throw a TypeError exception.
-      // 2. If target is a Proxy exotic object and target.[[ProxyHandler]] is
-      //    null, throw a TypeError exception.
-      // 3. If Type(handler) is not Object, throw a TypeError exception.
-      // 4. If handler is a Proxy exotic object and handler.[[ProxyHandler]]
-      //    is null, throw a TypeError exception.
-      const targetJSReceiver =
-          Cast<JSReceiver>(target) otherwise ThrowProxyNonObject;
-      if (IsRevokedProxy(targetJSReceiver)) {
-        goto ThrowProxyHandlerOrTargetRevoked;
-      }
+// ES #sec-proxy-constructor
+// https://tc39.github.io/ecma262/#sec-proxy-constructor
+transitioning javascript builtin
+ProxyConstructor(
+    js-implicit context: NativeContext, receiver: JSAny, newTarget: JSAny)(
+    target: JSAny, handler: JSAny): JSProxy {
+  try {
+    // 1. If NewTarget is undefined, throw a TypeError exception.
+    if (newTarget == Undefined) {
+      ThrowTypeError(MessageTemplate::kConstructorNotFunction, 'Proxy');
+    }
 
-      const handlerJSReceiver =
-          Cast<JSReceiver>(handler) otherwise ThrowProxyNonObject;
-      if (IsRevokedProxy(handlerJSReceiver)) {
-        goto ThrowProxyHandlerOrTargetRevoked;
-      }
+    // 2. Return ? ProxyCreate(target, handler).
+    // https://tc39.github.io/ecma262/#sec-proxycreate
+    // 1. If Type(target) is not Object, throw a TypeError exception.
+    // 2. If Type(handler) is not Object, throw a TypeError exception.
+    const targetJSReceiver =
+        Cast<JSReceiver>(target) otherwise ThrowProxyNonObject;
+    const handlerJSReceiver =
+        Cast<JSReceiver>(handler) otherwise ThrowProxyNonObject;
 
-      // 5. Let P be a newly created object.
-      // 6. Set P's essential internal methods (except for [[Call]] and
-      //    [[Construct]]) to the definitions specified in 9.5.
-      // 7. If IsCallable(target) is true, then
-      //    a. Set P.[[Call]] as specified in 9.5.12.
-      //    b. If IsConstructor(target) is true, then
-      //       1. Set P.[[Construct]] as specified in 9.5.13.
-      // 8. Set P.[[ProxyTarget]] to target.
-      // 9. Set P.[[ProxyHandler]] to handler.
-      // 10. Return P.
-      return AllocateProxy(targetJSReceiver, handlerJSReceiver);
-    }
-    label ThrowProxyNonObject deferred {
-      ThrowTypeError(MessageTemplate::kProxyNonObject);
-    }
-    label ThrowProxyHandlerOrTargetRevoked deferred {
-      ThrowTypeError(MessageTemplate::kProxyHandlerOrTargetRevoked);
-    }
+    // 5. Let P be a newly created object.
+    // 6. Set P's essential internal methods (except for [[Call]] and
+    //    [[Construct]]) to the definitions specified in 9.5.
+    // 7. If IsCallable(target) is true, then
+    //    a. Set P.[[Call]] as specified in 9.5.12.
+    //    b. If IsConstructor(target) is true, then
+    //       1. Set P.[[Construct]] as specified in 9.5.13.
+    // 8. Set P.[[ProxyTarget]] to target.
+    // 9. Set P.[[ProxyHandler]] to handler.
+    // 10. Return P.
+    return AllocateProxy(targetJSReceiver, handlerJSReceiver);
+  } label ThrowProxyNonObject deferred {
+    ThrowTypeError(MessageTemplate::kProxyNonObject);
   }
 }
+}
diff --git a/deps/v8/src/builtins/proxy-delete-property.tq b/deps/v8/src/builtins/proxy-delete-property.tq
index b068f3afb1a..45914a6ed55 100644
--- a/deps/v8/src/builtins/proxy-delete-property.tq
+++ b/deps/v8/src/builtins/proxy-delete-property.tq
@@ -6,66 +6,64 @@
 
 namespace proxy {
 
-  // ES #sec-proxy-object-internal-methods-and-internal-slots-delete-p
-  // https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-delete-p
-  transitioning builtin
-  ProxyDeleteProperty(implicit context: Context)(
-      proxy: JSProxy, name: PropertyKey, languageMode: LanguageModeSmi): JSAny {
-    const kTrapName: constexpr string = 'deleteProperty';
-    // Handle deeply nested proxy.
-    PerformStackCheck();
-    // 1. Assert: IsPropertyKey(P) is true.
-    assert(TaggedIsNotSmi(name));
-    assert(IsName(name));
-    assert(!IsPrivateSymbol(name));
+// ES #sec-proxy-object-internal-methods-and-internal-slots-delete-p
+// https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-delete-p
+transitioning builtin
+ProxyDeleteProperty(implicit context: Context)(
+    proxy: JSProxy, name: PropertyKey, languageMode: LanguageModeSmi): JSAny {
+  const kTrapName: constexpr string = 'deleteProperty';
+  // Handle deeply nested proxy.
+  PerformStackCheck();
+  // 1. Assert: IsPropertyKey(P) is true.
+  assert(TaggedIsNotSmi(name));
+  assert(IsName(name));
+  assert(!IsPrivateSymbol(name));
 
-    try {
-      // 2. Let handler be O.[[ProxyHandler]].
-      // 3. If handler is null, throw a TypeError exception.
-      // 4. Assert: Type(handler) is Object.
-      assert(proxy.handler == Null || Is<JSReceiver>(proxy.handler));
-      const handler =
-          Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
+  try {
+    // 2. Let handler be O.[[ProxyHandler]].
+    // 3. If handler is null, throw a TypeError exception.
+    // 4. Assert: Type(handler) is Object.
+    assert(proxy.handler == Null || Is<JSReceiver>(proxy.handler));
+    const handler =
+        Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
 
-      // 5. Let target be O.[[ProxyTarget]].
-      const target = UnsafeCast<JSReceiver>(proxy.target);
+    // 5. Let target be O.[[ProxyTarget]].
+    const target = UnsafeCast<JSReceiver>(proxy.target);
 
-      // 6. Let trap be ? GetMethod(handler, "deleteProperty").
-      // 7. If trap is undefined, then (see 7.a below).
-      const trap: Callable = GetMethod(handler, kTrapName)
-          otherwise goto TrapUndefined(target);
+    // 6. Let trap be ? GetMethod(handler, "deleteProperty").
+    // 7. If trap is undefined, then (see 7.a below).
+    const trap: Callable = GetMethod(handler, kTrapName)
+        otherwise goto TrapUndefined(target);
 
-      // 8. Let booleanTrapResult be ToBoolean(? Call(trap, handler,
-      // « target, P »)).
-      const trapResult = Call(context, trap, handler, target, name);
+    // 8. Let booleanTrapResult be ToBoolean(? Call(trap, handler,
+    // « target, P »)).
+    const trapResult = Call(context, trap, handler, target, name);
 
-      // 9. If booleanTrapResult is false, return false.
-      if (!ToBoolean(trapResult)) {
-        const strictValue: LanguageModeSmi = LanguageMode::kStrict;
-        if (languageMode == strictValue) {
-          ThrowTypeError(
-              MessageTemplate::kProxyTrapReturnedFalsishFor, kTrapName, name);
-        }
-        return False;
+    // 9. If booleanTrapResult is false, return false.
+    if (!ToBoolean(trapResult)) {
+      const strictValue: LanguageModeSmi = LanguageMode::kStrict;
+      if (languageMode == strictValue) {
+        ThrowTypeError(
+            MessageTemplate::kProxyTrapReturnedFalsishFor, kTrapName, name);
       }
+      return False;
+    }
 
-      // 10. Let targetDesc be ? target.[[GetOwnProperty]](P).
-      // 11. If targetDesc is undefined, return true.
-      // 12. If targetDesc.[[Configurable]] is false, throw a TypeError
-      // exception.
-      // 13. Let extensibleTarget be ? IsExtensible(target).
-      // 14. If extensibleTarget is false, throw a TypeError exception.
-      CheckDeleteTrapResult(target, proxy, name);
+    // 10. Let targetDesc be ? target.[[GetOwnProperty]](P).
+    // 11. If targetDesc is undefined, return true.
+    // 12. If targetDesc.[[Configurable]] is false, throw a TypeError
+    // exception.
+    // 13. Let extensibleTarget be ? IsExtensible(target).
+    // 14. If extensibleTarget is false, throw a TypeError exception.
+    CheckDeleteTrapResult(target, proxy, name);
 
-      // 15. Return true.
-      return True;
-    }
-    label TrapUndefined(target: JSAny) {
-      // 7.a. Return ? target.[[Delete]](P).
-      return DeleteProperty(target, name, languageMode);
-    }
-    label ThrowProxyHandlerRevoked deferred {
-      ThrowTypeError(MessageTemplate::kProxyRevoked, kTrapName);
-    }
+    // 15. Return true.
+    return True;
+  } label TrapUndefined(target: JSAny) {
+    // 7.a. Return ? target.[[Delete]](P).
+    return DeleteProperty(target, name, languageMode);
+  } label ThrowProxyHandlerRevoked deferred {
+    ThrowTypeError(MessageTemplate::kProxyRevoked, kTrapName);
   }
 }
+}
diff --git a/deps/v8/src/builtins/proxy-get-property.tq b/deps/v8/src/builtins/proxy-get-property.tq
index 7138648a851..2d6a1edee68 100644
--- a/deps/v8/src/builtins/proxy-get-property.tq
+++ b/deps/v8/src/builtins/proxy-get-property.tq
@@ -6,60 +6,59 @@
 
 namespace proxy {
 
-  extern transitioning builtin GetPropertyWithReceiver(
-      implicit context: Context)(JSAny, Name, JSAny, Smi): JSAny;
+extern transitioning builtin GetPropertyWithReceiver(implicit context: Context)(
+    JSAny, Name, JSAny, Smi): JSAny;
 
-  // ES #sec-proxy-object-internal-methods-and-internal-slots-get-p-receiver
-  // https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-get-p-receiver
-  transitioning builtin
-  ProxyGetProperty(implicit context: Context)(
-      proxy: JSProxy, name: PropertyKey, receiverValue: JSAny,
-      onNonExistent: Smi): JSAny {
-    PerformStackCheck();
-    // 1. Assert: IsPropertyKey(P) is true.
-    assert(TaggedIsNotSmi(name));
-    assert(IsName(name));
-    assert(!IsPrivateSymbol(name));
+// ES #sec-proxy-object-internal-methods-and-internal-slots-get-p-receiver
+// https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-get-p-receiver
+transitioning builtin
+ProxyGetProperty(implicit context: Context)(
+    proxy: JSProxy, name: PropertyKey, receiverValue: JSAny,
+    onNonExistent: Smi): JSAny {
+  PerformStackCheck();
+  // 1. Assert: IsPropertyKey(P) is true.
+  assert(TaggedIsNotSmi(name));
+  assert(IsName(name));
+  assert(!IsPrivateSymbol(name));
 
-    // 2. Let handler be O.[[ProxyHandler]].
-    // 3. If handler is null, throw a TypeError exception.
-    // 4. Assert: Type(handler) is Object.
-    let handler: JSReceiver;
-    typeswitch (proxy.handler) {
-      case (Null): {
-        ThrowTypeError(MessageTemplate::kProxyRevoked, 'get');
-      }
-      case (h: JSReceiver): {
-        handler = h;
-      }
+  // 2. Let handler be O.[[ProxyHandler]].
+  // 3. If handler is null, throw a TypeError exception.
+  // 4. Assert: Type(handler) is Object.
+  let handler: JSReceiver;
+  typeswitch (proxy.handler) {
+    case (Null): {
+      ThrowTypeError(MessageTemplate::kProxyRevoked, 'get');
     }
+    case (h: JSReceiver): {
+      handler = h;
+    }
+  }
 
-    // 5. Let target be O.[[ProxyTarget]].
-    const target = Cast<JSReceiver>(proxy.target) otherwise unreachable;
+  // 5. Let target be O.[[ProxyTarget]].
+  const target = Cast<JSReceiver>(proxy.target) otherwise unreachable;
 
-    // 6. Let trap be ? GetMethod(handler, "get").
-    // 7. If trap is undefined, then (see 7.a below).
-    // 7.a. Return ? target.[[Get]](P, Receiver).
-    const trap: Callable = GetMethod(handler, 'get')
-        otherwise return GetPropertyWithReceiver(
-        target, name, receiverValue, onNonExistent);
+  // 6. Let trap be ? GetMethod(handler, "get").
+  // 7. If trap is undefined, then (see 7.a below).
+  // 7.a. Return ? target.[[Get]](P, Receiver).
+  const trap: Callable = GetMethod(handler, 'get')
+      otherwise return GetPropertyWithReceiver(
+      target, name, receiverValue, onNonExistent);
 
-    // 8. Let trapResult be ? Call(trap, handler, « target, P, Receiver »).
-    const trapResult =
-        Call(context, trap, handler, target, name, receiverValue);
+  // 8. Let trapResult be ? Call(trap, handler, « target, P, Receiver »).
+  const trapResult = Call(context, trap, handler, target, name, receiverValue);
 
-    // 9. Let targetDesc be ? target.[[GetOwnProperty]](P).
-    // 10. If targetDesc is not undefined and targetDesc.[[Configurable]] is
-    // false, then
-    //    a. If IsDataDescriptor(targetDesc) is true and targetDesc.[[Writable]]
-    //    is false, then
-    //      i. If SameValue(trapResult, targetDesc.[[Value]]) is false, throw a
-    //      TypeError exception.
-    //    b. If IsAccessorDescriptor(targetDesc) is true and targetDesc.[[Get]]
-    //    is undefined, then
-    //      i. If trapResult is not undefined, throw a TypeError exception.
-    // 11. Return trapResult.
-    CheckGetSetTrapResult(target, proxy, name, trapResult, kProxyGet);
-    return trapResult;
-  }
+  // 9. Let targetDesc be ? target.[[GetOwnProperty]](P).
+  // 10. If targetDesc is not undefined and targetDesc.[[Configurable]] is
+  // false, then
+  //    a. If IsDataDescriptor(targetDesc) is true and targetDesc.[[Writable]]
+  //    is false, then
+  //      i. If SameValue(trapResult, targetDesc.[[Value]]) is false, throw a
+  //      TypeError exception.
+  //    b. If IsAccessorDescriptor(targetDesc) is true and targetDesc.[[Get]]
+  //    is undefined, then
+  //      i. If trapResult is not undefined, throw a TypeError exception.
+  // 11. Return trapResult.
+  CheckGetSetTrapResult(target, proxy, name, trapResult, kProxyGet);
+  return trapResult;
+}
 }
diff --git a/deps/v8/src/builtins/proxy-get-prototype-of.tq b/deps/v8/src/builtins/proxy-get-prototype-of.tq
index 8c556e27c2b..152489ecb6a 100644
--- a/deps/v8/src/builtins/proxy-get-prototype-of.tq
+++ b/deps/v8/src/builtins/proxy-get-prototype-of.tq
@@ -6,65 +6,62 @@
 
 namespace proxy {
 
-  // ES #sec-proxy-object-internal-methods-and-internal-slots-isextensible
-  // https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-isextensible
-  transitioning builtin
-  ProxyGetPrototypeOf(implicit context: Context)(proxy: JSProxy): JSAny {
-    PerformStackCheck();
-    const kTrapName: constexpr string = 'getPrototypeOf';
-    try {
-      // 1. Let handler be O.[[ProxyHandler]].
-      // 2. If handler is null, throw a TypeError exception.
-      // 3. Assert: Type(handler) is Object.
-      assert(proxy.handler == Null || Is<JSReceiver>(proxy.handler));
-      const handler =
-          Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
+// ES #sec-proxy-object-internal-methods-and-internal-slots-isextensible
+// https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-isextensible
+transitioning builtin
+ProxyGetPrototypeOf(implicit context: Context)(proxy: JSProxy): JSAny {
+  PerformStackCheck();
+  const kTrapName: constexpr string = 'getPrototypeOf';
+  try {
+    // 1. Let handler be O.[[ProxyHandler]].
+    // 2. If handler is null, throw a TypeError exception.
+    // 3. Assert: Type(handler) is Object.
+    assert(proxy.handler == Null || Is<JSReceiver>(proxy.handler));
+    const handler =
+        Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
 
-      // 4. Let target be O.[[ProxyTarget]].
-      const target = proxy.target;
+    // 4. Let target be O.[[ProxyTarget]].
+    const target = proxy.target;
 
-      // 5. Let trap be ? GetMethod(handler, "getPrototypeOf").
-      // 6. If trap is undefined, then (see 6.a below).
-      const trap: Callable = GetMethod(handler, kTrapName)
-          otherwise goto TrapUndefined(target);
+    // 5. Let trap be ? GetMethod(handler, "getPrototypeOf").
+    // 6. If trap is undefined, then (see 6.a below).
+    const trap: Callable = GetMethod(handler, kTrapName)
+        otherwise goto TrapUndefined(target);
 
-      // 7. Let handlerProto be ? Call(trap, handler, « target »).
-      const handlerProto = Call(context, trap, handler, target);
+    // 7. Let handlerProto be ? Call(trap, handler, « target »).
+    const handlerProto = Call(context, trap, handler, target);
 
-      // 8. If Type(handlerProto) is neither Object nor Null, throw a TypeError
-      // exception.
-      if (!Is<JSReceiver>(handlerProto) && handlerProto != Null) {
-        goto ThrowProxyGetPrototypeOfInvalid;
-      }
+    // 8. If Type(handlerProto) is neither Object nor Null, throw a TypeError
+    // exception.
+    if (!Is<JSReceiver>(handlerProto) && handlerProto != Null) {
+      goto ThrowProxyGetPrototypeOfInvalid;
+    }
 
-      // 9. Let extensibleTarget be ? IsExtensible(target).
-      // 10. If extensibleTarget is true, return handlerProto.
-      const extensibleTarget: JSAny = object::ObjectIsExtensibleImpl(target);
-      assert(extensibleTarget == True || extensibleTarget == False);
-      if (extensibleTarget == True) {
-        return handlerProto;
-      }
+    // 9. Let extensibleTarget be ? IsExtensible(target).
+    // 10. If extensibleTarget is true, return handlerProto.
+    const extensibleTarget: JSAny = object::ObjectIsExtensibleImpl(target);
+    assert(extensibleTarget == True || extensibleTarget == False);
+    if (extensibleTarget == True) {
+      return handlerProto;
+    }
 
-      // 11. Let targetProto be ? target.[[GetPrototypeOf]]().
-      const targetProto = object::ObjectGetPrototypeOfImpl(target);
+    // 11. Let targetProto be ? target.[[GetPrototypeOf]]().
+    const targetProto = object::ObjectGetPrototypeOfImpl(target);
 
-      // 12. If SameValue(handlerProto, targetProto) is false, throw a TypeError
-      // exception.
-      // 13. Return handlerProto.
-      if (SameValue(targetProto, handlerProto)) {
-        return handlerProto;
-      }
-      ThrowTypeError(MessageTemplate::kProxyGetPrototypeOfNonExtensible);
-    }
-    label TrapUndefined(target: JSAny) {
-      // 6.a. Return ? target.[[GetPrototypeOf]]().
-      return object::ObjectGetPrototypeOfImpl(target);
-    }
-    label ThrowProxyHandlerRevoked deferred {
-      ThrowTypeError(MessageTemplate::kProxyRevoked, kTrapName);
-    }
-    label ThrowProxyGetPrototypeOfInvalid deferred {
-      ThrowTypeError(MessageTemplate::kProxyGetPrototypeOfInvalid);
+    // 12. If SameValue(handlerProto, targetProto) is false, throw a TypeError
+    // exception.
+    // 13. Return handlerProto.
+    if (SameValue(targetProto, handlerProto)) {
+      return handlerProto;
     }
+    ThrowTypeError(MessageTemplate::kProxyGetPrototypeOfNonExtensible);
+  } label TrapUndefined(target: JSAny) {
+    // 6.a. Return ? target.[[GetPrototypeOf]]().
+    return object::ObjectGetPrototypeOfImpl(target);
+  } label ThrowProxyHandlerRevoked deferred {
+    ThrowTypeError(MessageTemplate::kProxyRevoked, kTrapName);
+  } label ThrowProxyGetPrototypeOfInvalid deferred {
+    ThrowTypeError(MessageTemplate::kProxyGetPrototypeOfInvalid);
   }
 }
+}
diff --git a/deps/v8/src/builtins/proxy-has-property.tq b/deps/v8/src/builtins/proxy-has-property.tq
index 28631466671..488f6fabb31 100644
--- a/deps/v8/src/builtins/proxy-has-property.tq
+++ b/deps/v8/src/builtins/proxy-has-property.tq
@@ -6,52 +6,50 @@
 
 namespace proxy {
 
-  // ES #sec-proxy-object-internal-methods-and-internal-slots-hasproperty-p
-  // https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-hasproperty-p
-  transitioning builtin ProxyHasProperty(implicit context: Context)(
-      proxy: JSProxy, name: PropertyKey): JSAny {
-    assert(IsJSProxy(proxy));
-
-    PerformStackCheck();
-
-    // 1. Assert: IsPropertyKey(P) is true.
-    assert(IsName(name));
-    assert(!IsPrivateSymbol(name));
-
-    try {
-      // 2. Let handler be O.[[ProxyHandler]].
-      // 3. If handler is null, throw a TypeError exception.
-      // 4. Assert: Type(handler) is Object.
-      assert(proxy.handler == Null || Is<JSReceiver>(proxy.handler));
-      const handler =
-          Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
-
-      // 5. Let target be O.[[ProxyTarget]].
-      const target = Cast<JSReceiver>(proxy.target) otherwise unreachable;
-
-      // 6. Let trap be ? GetMethod(handler, "has").
-      // 7. If trap is undefined, then (see 7.a below).
-      const trap: Callable = GetMethod(handler, 'has')
-          otherwise goto TrapUndefined(target);
-
-      // 8. Let booleanTrapResult be ToBoolean(? Call(trap, handler, «
-      // target»)).
-      // 9. If booleanTrapResult is false, then (see 9.a. in
-      // CheckHasTrapResult).
-      // 10. Return booleanTrapResult.
-      const trapResult = Call(context, trap, handler, target, name);
-      if (ToBoolean(trapResult)) {
-        return True;
-      }
-      CheckHasTrapResult(target, proxy, name);
-      return False;
-    }
-    label TrapUndefined(target: JSAny) {
-      // 7.a. Return ? target.[[HasProperty]](P).
-      tail HasProperty(target, name);
-    }
-    label ThrowProxyHandlerRevoked deferred {
-      ThrowTypeError(MessageTemplate::kProxyRevoked, 'has');
+// ES #sec-proxy-object-internal-methods-and-internal-slots-hasproperty-p
+// https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-hasproperty-p
+transitioning builtin ProxyHasProperty(implicit context: Context)(
+    proxy: JSProxy, name: PropertyKey): JSAny {
+  assert(IsJSProxy(proxy));
+
+  PerformStackCheck();
+
+  // 1. Assert: IsPropertyKey(P) is true.
+  assert(IsName(name));
+  assert(!IsPrivateSymbol(name));
+
+  try {
+    // 2. Let handler be O.[[ProxyHandler]].
+    // 3. If handler is null, throw a TypeError exception.
+    // 4. Assert: Type(handler) is Object.
+    assert(proxy.handler == Null || Is<JSReceiver>(proxy.handler));
+    const handler =
+        Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
+
+    // 5. Let target be O.[[ProxyTarget]].
+    const target = Cast<JSReceiver>(proxy.target) otherwise unreachable;
+
+    // 6. Let trap be ? GetMethod(handler, "has").
+    // 7. If trap is undefined, then (see 7.a below).
+    const trap: Callable = GetMethod(handler, 'has')
+        otherwise goto TrapUndefined(target);
+
+    // 8. Let booleanTrapResult be ToBoolean(? Call(trap, handler, «
+    // target»)).
+    // 9. If booleanTrapResult is false, then (see 9.a. in
+    // CheckHasTrapResult).
+    // 10. Return booleanTrapResult.
+    const trapResult = Call(context, trap, handler, target, name);
+    if (ToBoolean(trapResult)) {
+      return True;
     }
+    CheckHasTrapResult(target, proxy, name);
+    return False;
+  } label TrapUndefined(target: JSAny) {
+    // 7.a. Return ? target.[[HasProperty]](P).
+    tail HasProperty(target, name);
+  } label ThrowProxyHandlerRevoked deferred {
+    ThrowTypeError(MessageTemplate::kProxyRevoked, 'has');
   }
 }
+}
diff --git a/deps/v8/src/builtins/proxy-is-extensible.tq b/deps/v8/src/builtins/proxy-is-extensible.tq
index 9c0d45c5294..a7c2c56d441 100644
--- a/deps/v8/src/builtins/proxy-is-extensible.tq
+++ b/deps/v8/src/builtins/proxy-is-extensible.tq
@@ -6,52 +6,50 @@
 
 namespace proxy {
 
-  // ES #sec-proxy-object-internal-methods-and-internal-slots-isextensible
-  // https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-isextensible
-  transitioning builtin ProxyIsExtensible(implicit context:
-                                              Context)(proxy: JSProxy): JSAny {
-    PerformStackCheck();
-    const kTrapName: constexpr string = 'isExtensible';
-    try {
-      // 1. Let handler be O.[[ProxyHandler]].
-      // 2. If handler is null, throw a TypeError exception.
-      // 3. Assert: Type(handler) is Object.
-      assert(proxy.handler == Null || Is<JSReceiver>(proxy.handler));
-      const handler =
-          Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
-
-      // 4. Let target be O.[[ProxyTarget]].
-      const target = proxy.target;
-
-      // 5. Let trap be ? GetMethod(handler, "isExtensible").
-      // 6. If trap is undefined, then (see 6.a below).
-      const trap: Callable = GetMethod(handler, kTrapName)
-          otherwise goto TrapUndefined(target);
-
-      // 7. Let booleanTrapResult be ToBoolean(? Call(trap, handler, «
-      // target»)).
-      const trapResult = ToBoolean(Call(context, trap, handler, target));
-
-      // 8. Let targetResult be ? IsExtensible(target).
-      const targetResult: bool =
-          ToBoolean(object::ObjectIsExtensibleImpl(target));
-
-      // 9. If SameValue(booleanTrapResult, targetResult) is false, throw a
-      // TypeError exception.
-      if (trapResult != targetResult) {
-        ThrowTypeError(
-            MessageTemplate::kProxyIsExtensibleInconsistent,
-            SelectBooleanConstant(targetResult));
-      }
-      // 10. Return booleanTrapResult.
-      return SelectBooleanConstant(trapResult);
-    }
-    label TrapUndefined(target: JSAny) {
-      // 6.a. Return ? IsExtensible(target).
-      return object::ObjectIsExtensibleImpl(target);
-    }
-    label ThrowProxyHandlerRevoked deferred {
-      ThrowTypeError(MessageTemplate::kProxyRevoked, kTrapName);
+// ES #sec-proxy-object-internal-methods-and-internal-slots-isextensible
+// https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-isextensible
+transitioning builtin ProxyIsExtensible(implicit context: Context)(
+    proxy: JSProxy): JSAny {
+  PerformStackCheck();
+  const kTrapName: constexpr string = 'isExtensible';
+  try {
+    // 1. Let handler be O.[[ProxyHandler]].
+    // 2. If handler is null, throw a TypeError exception.
+    // 3. Assert: Type(handler) is Object.
+    assert(proxy.handler == Null || Is<JSReceiver>(proxy.handler));
+    const handler =
+        Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
+
+    // 4. Let target be O.[[ProxyTarget]].
+    const target = proxy.target;
+
+    // 5. Let trap be ? GetMethod(handler, "isExtensible").
+    // 6. If trap is undefined, then (see 6.a below).
+    const trap: Callable = GetMethod(handler, kTrapName)
+        otherwise goto TrapUndefined(target);
+
+    // 7. Let booleanTrapResult be ToBoolean(? Call(trap, handler, «
+    // target»)).
+    const trapResult = ToBoolean(Call(context, trap, handler, target));
+
+    // 8. Let targetResult be ? IsExtensible(target).
+    const targetResult: bool =
+        ToBoolean(object::ObjectIsExtensibleImpl(target));
+
+    // 9. If SameValue(booleanTrapResult, targetResult) is false, throw a
+    // TypeError exception.
+    if (trapResult != targetResult) {
+      ThrowTypeError(
+          MessageTemplate::kProxyIsExtensibleInconsistent,
+          SelectBooleanConstant(targetResult));
     }
+    // 10. Return booleanTrapResult.
+    return SelectBooleanConstant(trapResult);
+  } label TrapUndefined(target: JSAny) {
+    // 6.a. Return ? IsExtensible(target).
+    return object::ObjectIsExtensibleImpl(target);
+  } label ThrowProxyHandlerRevoked deferred {
+    ThrowTypeError(MessageTemplate::kProxyRevoked, kTrapName);
   }
 }
+}
diff --git a/deps/v8/src/builtins/proxy-prevent-extensions.tq b/deps/v8/src/builtins/proxy-prevent-extensions.tq
index 10bd1f45f01..a5a3d93da44 100644
--- a/deps/v8/src/builtins/proxy-prevent-extensions.tq
+++ b/deps/v8/src/builtins/proxy-prevent-extensions.tq
@@ -6,61 +6,59 @@
 
 namespace proxy {
 
-  // ES #sec-proxy-object-internal-methods-and-internal-slots-preventextensions
-  // https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-preventextensions
-  transitioning builtin
-  ProxyPreventExtensions(implicit context:
-                             Context)(proxy: JSProxy, doThrow: Boolean): JSAny {
-    PerformStackCheck();
-    const kTrapName: constexpr string = 'preventExtensions';
-    try {
-      // 1. Let handler be O.[[ProxyHandler]].
-      // 2. If handler is null, throw a TypeError exception.
-      // 3. Assert: Type(handler) is Object.
-      assert(proxy.handler == Null || Is<JSReceiver>(proxy.handler));
-      const handler =
-          Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
+// ES #sec-proxy-object-internal-methods-and-internal-slots-preventextensions
+// https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-preventextensions
+transitioning builtin
+ProxyPreventExtensions(implicit context: Context)(
+    proxy: JSProxy, doThrow: Boolean): JSAny {
+  PerformStackCheck();
+  const kTrapName: constexpr string = 'preventExtensions';
+  try {
+    // 1. Let handler be O.[[ProxyHandler]].
+    // 2. If handler is null, throw a TypeError exception.
+    // 3. Assert: Type(handler) is Object.
+    assert(proxy.handler == Null || Is<JSReceiver>(proxy.handler));
+    const handler =
+        Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
 
-      // 4. Let target be O.[[ProxyTarget]].
-      const target = proxy.target;
+    // 4. Let target be O.[[ProxyTarget]].
+    const target = proxy.target;
 
-      // 5. Let trap be ? GetMethod(handler, "preventExtensions").
-      // 6. If trap is undefined, then (see 6.a below).
-      const trap: Callable = GetMethod(handler, kTrapName)
-          otherwise goto TrapUndefined(target);
+    // 5. Let trap be ? GetMethod(handler, "preventExtensions").
+    // 6. If trap is undefined, then (see 6.a below).
+    const trap: Callable = GetMethod(handler, kTrapName)
+        otherwise goto TrapUndefined(target);
 
-      // 7. Let booleanTrapResult be ToBoolean(? Call(trap, handler, «
-      // target»)).
-      const trapResult = Call(context, trap, handler, target);
+    // 7. Let booleanTrapResult be ToBoolean(? Call(trap, handler, «
+    // target»)).
+    const trapResult = Call(context, trap, handler, target);
 
-      // 8. If booleanTrapResult is true, then
-      //    8.a. Let extensibleTarget be ? IsExtensible(target).
-      //    8.b If extensibleTarget is true, throw a TypeError exception.
-      if (ToBoolean(trapResult)) {
-        const extensibleTarget: JSAny = object::ObjectIsExtensibleImpl(target);
-        assert(extensibleTarget == True || extensibleTarget == False);
-        if (extensibleTarget == True) {
-          ThrowTypeError(MessageTemplate::kProxyPreventExtensionsExtensible);
-        }
-      } else {
-        if (doThrow == True) {
-          ThrowTypeError(MessageTemplate::kProxyTrapReturnedFalsish, kTrapName);
-        }
-        return False;
+    // 8. If booleanTrapResult is true, then
+    //    8.a. Let extensibleTarget be ? IsExtensible(target).
+    //    8.b If extensibleTarget is true, throw a TypeError exception.
+    if (ToBoolean(trapResult)) {
+      const extensibleTarget: JSAny = object::ObjectIsExtensibleImpl(target);
+      assert(extensibleTarget == True || extensibleTarget == False);
+      if (extensibleTarget == True) {
+        ThrowTypeError(MessageTemplate::kProxyPreventExtensionsExtensible);
       }
-
-      // 9. Return booleanTrapResult.
-      return True;
-    }
-    label TrapUndefined(target: JSAny) {
-      // 6.a. Return ? target.[[PreventExtensions]]().
+    } else {
       if (doThrow == True) {
-        return object::ObjectPreventExtensionsThrow(target);
+        ThrowTypeError(MessageTemplate::kProxyTrapReturnedFalsish, kTrapName);
       }
-      return object::ObjectPreventExtensionsDontThrow(target);
+      return False;
     }
-    label ThrowProxyHandlerRevoked deferred {
-      ThrowTypeError(MessageTemplate::kProxyRevoked, kTrapName);
+
+    // 9. Return booleanTrapResult.
+    return True;
+  } label TrapUndefined(target: JSAny) {
+    // 6.a. Return ? target.[[PreventExtensions]]().
+    if (doThrow == True) {
+      return object::ObjectPreventExtensionsThrow(target);
     }
+    return object::ObjectPreventExtensionsDontThrow(target);
+  } label ThrowProxyHandlerRevoked deferred {
+    ThrowTypeError(MessageTemplate::kProxyRevoked, kTrapName);
   }
+}
 }  // namespace proxy
diff --git a/deps/v8/src/builtins/proxy-revocable.tq b/deps/v8/src/builtins/proxy-revocable.tq
index 2b853afefea..989db1c04c6 100644
--- a/deps/v8/src/builtins/proxy-revocable.tq
+++ b/deps/v8/src/builtins/proxy-revocable.tq
@@ -6,48 +6,35 @@
 
 namespace proxy {
 
-  extern macro ProxiesCodeStubAssembler::AllocateProxyRevokeFunction(
-      implicit context: Context)(JSProxy): JSFunction;
-
-  // Proxy.revocable(target, handler)
-  // https://tc39.github.io/ecma262/#sec-proxy.revocable
-  transitioning javascript builtin
-  ProxyRevocable(js-implicit context: NativeContext)(
-      target: JSAny, handler: JSAny): JSProxyRevocableResult {
-    try {
-      const targetJSReceiver =
-          Cast<JSReceiver>(target) otherwise ThrowProxyNonObject;
-      if (IsRevokedProxy(targetJSReceiver)) {
-        goto ThrowProxyHandlerOrTargetRevoked;
-      }
-
-      const handlerJSReceiver =
-          Cast<JSReceiver>(handler) otherwise ThrowProxyNonObject;
-      if (IsRevokedProxy(handlerJSReceiver)) {
-        goto ThrowProxyHandlerOrTargetRevoked;
-      }
-
-      // 1. Let p be ? ProxyCreate(target, handler).
-      const proxy: JSProxy = AllocateProxy(targetJSReceiver, handlerJSReceiver);
-
-      // 2. Let steps be the algorithm steps defined in Proxy Revocation
-      // Functions.
-      // 3. Let revoker be CreateBuiltinFunction(steps, « [[RevocableProxy]] »).
-      // 4. Set revoker.[[RevocableProxy]] to p.
-      const revoke: JSFunction = AllocateProxyRevokeFunction(proxy);
-
-      // 5. Let result be ObjectCreate(%ObjectPrototype%).
-      // 6. Perform CreateDataProperty(result, "proxy", p).
-      // 7. Perform CreateDataProperty(result, "revoke", revoker).
-      // 8. Return result.
-      return NewJSProxyRevocableResult(proxy, revoke);
-    }
-    label ThrowProxyNonObject deferred {
-      ThrowTypeError(MessageTemplate::kProxyNonObject, 'Proxy.revocable');
-    }
-    label ThrowProxyHandlerOrTargetRevoked deferred {
-      ThrowTypeError(
-          MessageTemplate::kProxyHandlerOrTargetRevoked, 'Proxy.revocable');
-    }
+extern macro ProxiesCodeStubAssembler::AllocateProxyRevokeFunction(
+    implicit context: Context)(JSProxy): JSFunction;
+
+// Proxy.revocable(target, handler)
+// https://tc39.github.io/ecma262/#sec-proxy.revocable
+transitioning javascript builtin
+ProxyRevocable(js-implicit context: NativeContext)(
+    target: JSAny, handler: JSAny): JSProxyRevocableResult {
+  try {
+    // 1. Let p be ? ProxyCreate(target, handler).
+    const targetJSReceiver =
+        Cast<JSReceiver>(target) otherwise ThrowProxyNonObject;
+    const handlerJSReceiver =
+        Cast<JSReceiver>(handler) otherwise ThrowProxyNonObject;
+    const proxy: JSProxy = AllocateProxy(targetJSReceiver, handlerJSReceiver);
+
+    // 2. Let steps be the algorithm steps defined in Proxy Revocation
+    // Functions.
+    // 3. Let revoker be CreateBuiltinFunction(steps, « [[RevocableProxy]] »).
+    // 4. Set revoker.[[RevocableProxy]] to p.
+    const revoke: JSFunction = AllocateProxyRevokeFunction(proxy);
+
+    // 5. Let result be ObjectCreate(%ObjectPrototype%).
+    // 6. Perform CreateDataProperty(result, "proxy", p).
+    // 7. Perform CreateDataProperty(result, "revoke", revoker).
+    // 8. Return result.
+    return NewJSProxyRevocableResult(proxy, revoke);
+  } label ThrowProxyNonObject deferred {
+    ThrowTypeError(MessageTemplate::kProxyNonObject, 'Proxy.revocable');
   }
 }
+}
diff --git a/deps/v8/src/builtins/proxy-revoke.tq b/deps/v8/src/builtins/proxy-revoke.tq
index 7300f4d7179..5d2071b931b 100644
--- a/deps/v8/src/builtins/proxy-revoke.tq
+++ b/deps/v8/src/builtins/proxy-revoke.tq
@@ -6,31 +6,31 @@
 
 namespace proxy {
 
-  // Proxy Revocation Functions
-  // https://tc39.github.io/ecma262/#sec-proxy-revocation-functions
-  transitioning javascript builtin
-  ProxyRevoke(js-implicit context: NativeContext)(): Undefined {
-    // 1. Let p be F.[[RevocableProxy]].
-    const proxyObject: Object = context[PROXY_SLOT];
-
-    // 2. If p is null, return undefined
-    if (proxyObject == Null) {
-      return Undefined;
-    }
+// Proxy Revocation Functions
+// https://tc39.github.io/ecma262/#sec-proxy-revocation-functions
+transitioning javascript builtin
+ProxyRevoke(js-implicit context: NativeContext)(): Undefined {
+  // 1. Let p be F.[[RevocableProxy]].
+  const proxyObject: Object = context[PROXY_SLOT];
+
+  // 2. If p is null, return undefined
+  if (proxyObject == Null) {
+    return Undefined;
+  }
 
-    // 3. Set F.[[RevocableProxy]] to null.
-    context[PROXY_SLOT] = Null;
+  // 3. Set F.[[RevocableProxy]] to null.
+  context[PROXY_SLOT] = Null;
 
-    // 4. Assert: p is a Proxy object.
-    const proxy: JSProxy = UnsafeCast<JSProxy>(proxyObject);
+  // 4. Assert: p is a Proxy object.
+  const proxy: JSProxy = UnsafeCast<JSProxy>(proxyObject);
 
-    // 5. Set p.[[ProxyTarget]] to null.
-    proxy.target = Null;
+  // 5. Set p.[[ProxyTarget]] to null.
+  proxy.target = Null;
 
-    // 6. Set p.[[ProxyHandler]] to null.
-    proxy.handler = Null;
+  // 6. Set p.[[ProxyHandler]] to null.
+  proxy.handler = Null;
 
-    // 7. Return undefined.
-    return Undefined;
-  }
+  // 7. Return undefined.
+  return Undefined;
+}
 }
diff --git a/deps/v8/src/builtins/proxy-set-property.tq b/deps/v8/src/builtins/proxy-set-property.tq
index 2d084eac7a5..49f55fcd336 100644
--- a/deps/v8/src/builtins/proxy-set-property.tq
+++ b/deps/v8/src/builtins/proxy-set-property.tq
@@ -6,84 +6,82 @@
 
 namespace proxy {
 
-  extern transitioning runtime
-  SetPropertyWithReceiver(implicit context:
-                              Context)(Object, Name, Object, Object): void;
+extern transitioning runtime
+SetPropertyWithReceiver(implicit context: Context)(
+    Object, Name, Object, Object): void;
 
-  transitioning macro CallThrowTypeErrorIfStrict(implicit context: Context)(
-      message: constexpr MessageTemplate) {
-    ThrowTypeErrorIfStrict(SmiConstant(message), Null, Null);
-  }
+transitioning macro CallThrowTypeErrorIfStrict(implicit context: Context)(
+    message: constexpr MessageTemplate) {
+  ThrowTypeErrorIfStrict(SmiConstant(message), Null, Null);
+}
 
-  // ES #sec-proxy-object-internal-methods-and-internal-slots-set-p-v-receiver
-  // https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-set-p-v-receiver
-  transitioning builtin
-  ProxySetProperty(implicit context: Context)(
-      proxy: JSProxy, name: PropertyKey|PrivateSymbol, value: JSAny,
-      receiverValue: JSAny): JSAny {
-    // 1. Assert: IsPropertyKey(P) is true.
-    assert(TaggedIsNotSmi(name));
-    assert(IsName(name));
+// ES #sec-proxy-object-internal-methods-and-internal-slots-set-p-v-receiver
+// https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-set-p-v-receiver
+transitioning builtin
+ProxySetProperty(implicit context: Context)(
+    proxy: JSProxy, name: PropertyKey|PrivateSymbol, value: JSAny,
+    receiverValue: JSAny): JSAny {
+  // 1. Assert: IsPropertyKey(P) is true.
+  assert(TaggedIsNotSmi(name));
+  assert(IsName(name));
 
-    let key: PropertyKey;
-    typeswitch (name) {
-      case (PrivateSymbol): {
-        CallThrowTypeErrorIfStrict(MessageTemplate::kProxyPrivate);
-        return Undefined;
-      }
-      case (name: PropertyKey): {
-        key = name;
-      }
+  let key: PropertyKey;
+  typeswitch (name) {
+    case (PrivateSymbol): {
+      CallThrowTypeErrorIfStrict(MessageTemplate::kProxyPrivate);
+      return Undefined;
     }
+    case (name: PropertyKey): {
+      key = name;
+    }
+  }
 
-    try {
-      // 2. Let handler be O.[[ProxyHandler]].
-      // 3. If handler is null, throw a TypeError exception.
-      // 4. Assert: Type(handler) is Object.
-      assert(proxy.handler == Null || Is<JSReceiver>(proxy.handler));
-      const handler =
-          Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
+  try {
+    // 2. Let handler be O.[[ProxyHandler]].
+    // 3. If handler is null, throw a TypeError exception.
+    // 4. Assert: Type(handler) is Object.
+    assert(proxy.handler == Null || Is<JSReceiver>(proxy.handler));
+    const handler =
+        Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
 
-      // 5. Let target be O.[[ProxyTarget]].
-      const target = UnsafeCast<JSReceiver>(proxy.target);
+    // 5. Let target be O.[[ProxyTarget]].
+    const target = UnsafeCast<JSReceiver>(proxy.target);
 
-      // 6. Let trap be ? GetMethod(handler, "set").
-      // 7. If trap is undefined, then (see 7.a below).
-      const trap: Callable = GetMethod(handler, 'set')
-          otherwise goto TrapUndefined(target);
+    // 6. Let trap be ? GetMethod(handler, "set").
+    // 7. If trap is undefined, then (see 7.a below).
+    const trap: Callable = GetMethod(handler, 'set')
+        otherwise goto TrapUndefined(target);
 
-      // 8. Let booleanTrapResult be ToBoolean(? Call(trap, handler,
-      // « target, P, V, Receiver »)).
-      // 9. If booleanTrapResult is false, return false.
-      // 10. Let targetDesc be ? target.[[GetOwnProperty]](P).
-      // 11. If targetDesc is not undefined and targetDesc.[[Configurable]] is
-      // false, then
-      //    a. If IsDataDescriptor(targetDesc) is true and
-      //    targetDesc.[[Writable]] is false, then
-      //      i. If SameValue(V, targetDesc.[[Value]]) is false, throw a
-      //      TypeError exception.
-      //    b. If IsAccessorDescriptor(targetDesc) is true, then
-      //      i. If targetDesc.[[Set]] is undefined, throw a TypeError
-      //      exception.
-      // 12. Return true.
-      const trapResult =
-          Call(context, trap, handler, target, key, value, receiverValue);
-      if (ToBoolean(trapResult)) {
-        CheckGetSetTrapResult(target, proxy, name, value, kProxySet);
-        return value;
-      }
-      ThrowTypeErrorIfStrict(
-          SmiConstant(MessageTemplate::kProxyTrapReturnedFalsishFor), 'set',
-          name);
+    // 8. Let booleanTrapResult be ToBoolean(? Call(trap, handler,
+    // « target, P, V, Receiver »)).
+    // 9. If booleanTrapResult is false, return false.
+    // 10. Let targetDesc be ? target.[[GetOwnProperty]](P).
+    // 11. If targetDesc is not undefined and targetDesc.[[Configurable]] is
+    // false, then
+    //    a. If IsDataDescriptor(targetDesc) is true and
+    //    targetDesc.[[Writable]] is false, then
+    //      i. If SameValue(V, targetDesc.[[Value]]) is false, throw a
+    //      TypeError exception.
+    //    b. If IsAccessorDescriptor(targetDesc) is true, then
+    //      i. If targetDesc.[[Set]] is undefined, throw a TypeError
+    //      exception.
+    // 12. Return true.
+    const trapResult =
+        Call(context, trap, handler, target, key, value, receiverValue);
+    if (ToBoolean(trapResult)) {
+      CheckGetSetTrapResult(target, proxy, name, value, kProxySet);
       return value;
     }
-    label TrapUndefined(target: Object) {
-      // 7.a. Return ? target.[[Set]](P, V, Receiver).
-      SetPropertyWithReceiver(target, name, value, receiverValue);
-      return value;
-    }
-    label ThrowProxyHandlerRevoked deferred {
-      ThrowTypeError(MessageTemplate::kProxyRevoked, 'set');
-    }
+    ThrowTypeErrorIfStrict(
+        SmiConstant(MessageTemplate::kProxyTrapReturnedFalsishFor), 'set',
+        name);
+    return value;
+  } label TrapUndefined(target: Object) {
+    // 7.a. Return ? target.[[Set]](P, V, Receiver).
+    SetPropertyWithReceiver(target, name, value, receiverValue);
+    return value;
+  } label ThrowProxyHandlerRevoked deferred {
+    ThrowTypeError(MessageTemplate::kProxyRevoked, 'set');
   }
 }
+}
diff --git a/deps/v8/src/builtins/proxy-set-prototype-of.tq b/deps/v8/src/builtins/proxy-set-prototype-of.tq
index a7a76b75355..ec68cef44c8 100644
--- a/deps/v8/src/builtins/proxy-set-prototype-of.tq
+++ b/deps/v8/src/builtins/proxy-set-prototype-of.tq
@@ -6,73 +6,71 @@
 
 namespace proxy {
 
-  // ES #sec-proxy-object-internal-methods-and-internal-slots-setprototypeof-v
-  // https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-setprototypeof-v
-  transitioning builtin
-  ProxySetPrototypeOf(implicit context: Context)(
-      proxy: JSProxy, proto: Null|JSReceiver, doThrow: Boolean): JSAny {
-    PerformStackCheck();
-    const kTrapName: constexpr string = 'setPrototypeOf';
-    try {
-      // 1. Assert: Either Type(V) is Object or Type(V) is Null.
-      assert(proto == Null || Is<JSReceiver>(proto));
+// ES #sec-proxy-object-internal-methods-and-internal-slots-setprototypeof-v
+// https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-setprototypeof-v
+transitioning builtin
+ProxySetPrototypeOf(implicit context: Context)(
+    proxy: JSProxy, proto: Null|JSReceiver, doThrow: Boolean): JSAny {
+  PerformStackCheck();
+  const kTrapName: constexpr string = 'setPrototypeOf';
+  try {
+    // 1. Assert: Either Type(V) is Object or Type(V) is Null.
+    assert(proto == Null || Is<JSReceiver>(proto));
 
-      // 2. Let handler be O.[[ProxyHandler]].
-      // 3. If handler is null, throw a TypeError exception.
-      // 4. Assert: Type(handler) is Object.
-      assert(proxy.handler == Null || Is<JSReceiver>(proxy.handler));
-      const handler =
-          Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
+    // 2. Let handler be O.[[ProxyHandler]].
+    // 3. If handler is null, throw a TypeError exception.
+    // 4. Assert: Type(handler) is Object.
+    assert(proxy.handler == Null || Is<JSReceiver>(proxy.handler));
+    const handler =
+        Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
 
-      // 5. Let target be O.[[ProxyTarget]].
-      const target = proxy.target;
+    // 5. Let target be O.[[ProxyTarget]].
+    const target = proxy.target;
 
-      // 6. Let trap be ? GetMethod(handler, "setPrototypeOf").
-      // 7. If trap is undefined, then (see 7.a below).
-      const trap: Callable = GetMethod(handler, kTrapName)
-          otherwise goto TrapUndefined(target, proto);
+    // 6. Let trap be ? GetMethod(handler, "setPrototypeOf").
+    // 7. If trap is undefined, then (see 7.a below).
+    const trap: Callable = GetMethod(handler, kTrapName)
+        otherwise goto TrapUndefined(target, proto);
 
-      // 8. Let booleanTrapResult be ToBoolean(? Call(trap, handler, « target, V
-      // »)).
-      const trapResult = Call(context, trap, handler, target, proto);
+    // 8. Let booleanTrapResult be ToBoolean(? Call(trap, handler, « target, V
+    // »)).
+    const trapResult = Call(context, trap, handler, target, proto);
 
-      // 9. If booleanTrapResult is false, return false.
-      if (!ToBoolean(trapResult)) {
-        if (doThrow == True) {
-          ThrowTypeError(
-              MessageTemplate::kProxyTrapReturnedFalsishFor, kTrapName);
-        }
-        return False;
+    // 9. If booleanTrapResult is false, return false.
+    if (!ToBoolean(trapResult)) {
+      if (doThrow == True) {
+        ThrowTypeError(
+            MessageTemplate::kProxyTrapReturnedFalsishFor, kTrapName);
       }
+      return False;
+    }
 
-      // 10. Let extensibleTarget be ? IsExtensible(target).
-      // 11. If extensibleTarget is true, return true.
-      const extensibleTarget: Object = object::ObjectIsExtensibleImpl(target);
-      assert(extensibleTarget == True || extensibleTarget == False);
-      if (extensibleTarget == True) {
-        return True;
-      }
+    // 10. Let extensibleTarget be ? IsExtensible(target).
+    // 11. If extensibleTarget is true, return true.
+    const extensibleTarget: Object = object::ObjectIsExtensibleImpl(target);
+    assert(extensibleTarget == True || extensibleTarget == False);
+    if (extensibleTarget == True) {
+      return True;
+    }
 
-      // 12. Let targetProto be ? target.[[GetPrototypeOf]]().
-      const targetProto = object::ObjectGetPrototypeOfImpl(target);
+    // 12. Let targetProto be ? target.[[GetPrototypeOf]]().
+    const targetProto = object::ObjectGetPrototypeOfImpl(target);
 
-      // 13. If SameValue(V, targetProto) is false, throw a TypeError
-      // exception.
-      // 14. Return true.
-      if (SameValue(proto, targetProto)) {
-        return True;
-      }
-      ThrowTypeError(MessageTemplate::kProxySetPrototypeOfNonExtensible);
+    // 13. If SameValue(V, targetProto) is false, throw a TypeError
+    // exception.
+    // 14. Return true.
+    if (SameValue(proto, targetProto)) {
+      return True;
     }
-    label TrapUndefined(target: JSAny, proto: JSReceiver|Null) {
-      // 7.a. Return ? target.[[SetPrototypeOf]]().
-      if (doThrow == True) {
-        return object::ObjectSetPrototypeOfThrow(target, proto);
-      }
-      return object::ObjectSetPrototypeOfDontThrow(target, proto);
-    }
-    label ThrowProxyHandlerRevoked deferred {
-      ThrowTypeError(MessageTemplate::kProxyRevoked, kTrapName);
+    ThrowTypeError(MessageTemplate::kProxySetPrototypeOfNonExtensible);
+  } label TrapUndefined(target: JSAny, proto: JSReceiver|Null) {
+    // 7.a. Return ? target.[[SetPrototypeOf]]().
+    if (doThrow == True) {
+      return object::ObjectSetPrototypeOfThrow(target, proto);
     }
+    return object::ObjectSetPrototypeOfDontThrow(target, proto);
+  } label ThrowProxyHandlerRevoked deferred {
+    ThrowTypeError(MessageTemplate::kProxyRevoked, kTrapName);
   }
 }
+}
diff --git a/deps/v8/src/builtins/proxy.tq b/deps/v8/src/builtins/proxy.tq
index 2db794e8e80..8f662a9f4d1 100644
--- a/deps/v8/src/builtins/proxy.tq
+++ b/deps/v8/src/builtins/proxy.tq
@@ -6,27 +6,21 @@
 
 namespace proxy {
 
-  extern macro ProxiesCodeStubAssembler::AllocateProxy(
-      implicit context: Context)(JSReceiver, JSReceiver): JSProxy;
+extern macro ProxiesCodeStubAssembler::AllocateProxy(implicit context: Context)(
+    JSReceiver, JSReceiver): JSProxy;
 
-  macro IsRevokedProxy(implicit context: Context)(o: JSReceiver): bool {
-    const proxy: JSProxy = Cast<JSProxy>(o) otherwise return false;
-    Cast<JSReceiver>(proxy.handler) otherwise return true;
-    return false;
-  }
+extern transitioning macro ProxiesCodeStubAssembler::CheckGetSetTrapResult(
+    implicit context: Context)(
+    JSReceiver, JSProxy, Name, Object, constexpr int31);
 
-  extern transitioning macro ProxiesCodeStubAssembler::CheckGetSetTrapResult(
-      implicit context:
-          Context)(JSReceiver, JSProxy, Name, Object, constexpr int31);
+extern transitioning macro ProxiesCodeStubAssembler::CheckDeleteTrapResult(
+    implicit context: Context)(JSReceiver, JSProxy, Name);
 
-  extern transitioning macro ProxiesCodeStubAssembler::CheckDeleteTrapResult(
-      implicit context: Context)(JSReceiver, JSProxy, Name);
+extern transitioning macro ProxiesCodeStubAssembler::CheckHasTrapResult(
+    implicit context: Context)(JSReceiver, JSProxy, Name);
 
-  extern transitioning macro ProxiesCodeStubAssembler::CheckHasTrapResult(
-      implicit context: Context)(JSReceiver, JSProxy, Name);
-
-  const kProxyGet: constexpr int31
-  generates 'JSProxy::AccessKind::kGet';
-  const kProxySet: constexpr int31
-  generates 'JSProxy::AccessKind::kSet';
+const kProxyGet: constexpr int31
+    generates 'JSProxy::AccessKind::kGet';
+const kProxySet: constexpr int31
+    generates 'JSProxy::AccessKind::kSet';
 }
diff --git a/deps/v8/src/builtins/reflect.tq b/deps/v8/src/builtins/reflect.tq
index f1818ed32d7..477c586403c 100644
--- a/deps/v8/src/builtins/reflect.tq
+++ b/deps/v8/src/builtins/reflect.tq
@@ -3,92 +3,88 @@
 // found in the LICENSE file.
 
 namespace reflect {
-  // ES6 section 26.1.10 Reflect.isExtensible
-  transitioning javascript builtin
-  ReflectIsExtensible(js-implicit context: NativeContext)(object: JSAny):
-      JSAny {
-    const objectJSReceiver = Cast<JSReceiver>(object)
-        otherwise ThrowTypeError(
-        MessageTemplate::kCalledOnNonObject, 'Reflect.isExtensible');
-    return object::ObjectIsExtensibleImpl(objectJSReceiver);
-  }
+// ES6 section 26.1.10 Reflect.isExtensible
+transitioning javascript builtin
+ReflectIsExtensible(js-implicit context: NativeContext)(object: JSAny): JSAny {
+  const objectJSReceiver = Cast<JSReceiver>(object)
+      otherwise ThrowTypeError(
+      MessageTemplate::kCalledOnNonObject, 'Reflect.isExtensible');
+  return object::ObjectIsExtensibleImpl(objectJSReceiver);
+}
 
-  // ES6 section 26.1.12 Reflect.preventExtensions
-  transitioning javascript builtin
-  ReflectPreventExtensions(js-implicit context: NativeContext)(object: JSAny):
-      JSAny {
-    const objectJSReceiver = Cast<JSReceiver>(object)
-        otherwise ThrowTypeError(
-        MessageTemplate::kCalledOnNonObject, 'Reflect.preventExtensions');
-    return object::ObjectPreventExtensionsDontThrow(objectJSReceiver);
-  }
+// ES6 section 26.1.12 Reflect.preventExtensions
+transitioning javascript builtin
+ReflectPreventExtensions(js-implicit context: NativeContext)(object: JSAny):
+    JSAny {
+  const objectJSReceiver = Cast<JSReceiver>(object)
+      otherwise ThrowTypeError(
+      MessageTemplate::kCalledOnNonObject, 'Reflect.preventExtensions');
+  return object::ObjectPreventExtensionsDontThrow(objectJSReceiver);
+}
 
-  // ES6 section 26.1.8 Reflect.getPrototypeOf
-  transitioning javascript builtin
-  ReflectGetPrototypeOf(js-implicit context: NativeContext)(object: JSAny):
-      JSAny {
-    const objectJSReceiver = Cast<JSReceiver>(object)
-        otherwise ThrowTypeError(
-        MessageTemplate::kCalledOnNonObject, 'Reflect.getPrototypeOf');
-    return object::JSReceiverGetPrototypeOf(objectJSReceiver);
-  }
+// ES6 section 26.1.8 Reflect.getPrototypeOf
+transitioning javascript builtin
+ReflectGetPrototypeOf(js-implicit context: NativeContext)(object: JSAny):
+    JSAny {
+  const objectJSReceiver = Cast<JSReceiver>(object)
+      otherwise ThrowTypeError(
+      MessageTemplate::kCalledOnNonObject, 'Reflect.getPrototypeOf');
+  return object::JSReceiverGetPrototypeOf(objectJSReceiver);
+}
 
-  // ES6 section 26.1.14 Reflect.setPrototypeOf
-  transitioning javascript builtin ReflectSetPrototypeOf(
-      js-implicit context: NativeContext)(object: JSAny, proto: JSAny): JSAny {
-    const objectJSReceiver = Cast<JSReceiver>(object)
-        otherwise ThrowTypeError(
-        MessageTemplate::kCalledOnNonObject, 'Reflect.setPrototypeOf');
-    typeswitch (proto) {
-      case (proto: JSReceiver|Null): {
-        return object::ObjectSetPrototypeOfDontThrow(objectJSReceiver, proto);
-      }
-      case (JSAny): {
-        ThrowTypeError(MessageTemplate::kProtoObjectOrNull, proto);
-      }
+// ES6 section 26.1.14 Reflect.setPrototypeOf
+transitioning javascript builtin ReflectSetPrototypeOf(
+    js-implicit context: NativeContext)(object: JSAny, proto: JSAny): JSAny {
+  const objectJSReceiver = Cast<JSReceiver>(object)
+      otherwise ThrowTypeError(
+      MessageTemplate::kCalledOnNonObject, 'Reflect.setPrototypeOf');
+  typeswitch (proto) {
+    case (proto: JSReceiver|Null): {
+      return object::ObjectSetPrototypeOfDontThrow(objectJSReceiver, proto);
+    }
+    case (JSAny): {
+      ThrowTypeError(MessageTemplate::kProtoObjectOrNull, proto);
     }
   }
+}
 
-  extern transitioning builtin ToName(implicit context: Context)(JSAny):
-      AnyName;
-  type OnNonExistent constexpr 'OnNonExistent';
-  const kReturnUndefined: constexpr OnNonExistent
-  generates 'OnNonExistent::kReturnUndefined';
-  extern macro SmiConstant(constexpr OnNonExistent): Smi;
-  extern transitioning builtin GetPropertyWithReceiver(
-      implicit context: Context)(JSAny, Name, JSAny, Smi): JSAny;
+extern transitioning builtin ToName(implicit context: Context)(JSAny): AnyName;
+type OnNonExistent constexpr 'OnNonExistent';
+const kReturnUndefined: constexpr OnNonExistent
+    generates 'OnNonExistent::kReturnUndefined';
+extern macro SmiConstant(constexpr OnNonExistent): Smi;
+extern transitioning builtin GetPropertyWithReceiver(implicit context: Context)(
+    JSAny, Name, JSAny, Smi): JSAny;
 
-  // ES6 section 26.1.6 Reflect.get
-  transitioning javascript builtin
-  ReflectGet(js-implicit context: NativeContext)(...arguments): JSAny {
-    const length = arguments.length;
-    const object: JSAny = length > 0 ? arguments[0] : Undefined;
-    const objectJSReceiver = Cast<JSReceiver>(object)
-        otherwise ThrowTypeError(
-        MessageTemplate::kCalledOnNonObject, 'Reflect.get');
-    const propertyKey: JSAny = length > 1 ? arguments[1] : Undefined;
-    const name: AnyName = ToName(propertyKey);
-    const receiver: JSAny = length > 2 ? arguments[2] : objectJSReceiver;
-    return GetPropertyWithReceiver(
-        objectJSReceiver, name, receiver, SmiConstant(kReturnUndefined));
-  }
+// ES6 section 26.1.6 Reflect.get
+transitioning javascript builtin
+ReflectGet(js-implicit context: NativeContext)(...arguments): JSAny {
+  const object: JSAny = arguments[0];
+  const objectJSReceiver = Cast<JSReceiver>(object)
+      otherwise ThrowTypeError(MessageTemplate::kCalledOnNonObject, 'Reflect.get');
+  const propertyKey: JSAny = arguments[1];
+  const name: AnyName = ToName(propertyKey);
+  const receiver: JSAny =
+      arguments.length > 2 ? arguments[2] : objectJSReceiver;
+  return GetPropertyWithReceiver(
+      objectJSReceiver, name, receiver, SmiConstant(kReturnUndefined));
+}
 
-  // ES6 section 26.1.4 Reflect.deleteProperty
-  transitioning javascript builtin ReflectDeleteProperty(
-      js-implicit context: NativeContext)(object: JSAny, key: JSAny): JSAny {
-    const objectJSReceiver = Cast<JSReceiver>(object)
-        otherwise ThrowTypeError(
-        MessageTemplate::kCalledOnNonObject, 'Reflect.deleteProperty');
-    return DeleteProperty(objectJSReceiver, key, LanguageMode::kSloppy);
-  }
+// ES6 section 26.1.4 Reflect.deleteProperty
+transitioning javascript builtin ReflectDeleteProperty(
+    js-implicit context: NativeContext)(object: JSAny, key: JSAny): JSAny {
+  const objectJSReceiver = Cast<JSReceiver>(object)
+      otherwise ThrowTypeError(
+      MessageTemplate::kCalledOnNonObject, 'Reflect.deleteProperty');
+  return DeleteProperty(objectJSReceiver, key, LanguageMode::kSloppy);
+}
 
-  // ES section #sec-reflect.has
-  transitioning javascript builtin
-  ReflectHas(js-implicit context: NativeContext)(object: JSAny, key: JSAny):
-      JSAny {
-    const objectJSReceiver = Cast<JSReceiver>(object)
-        otherwise ThrowTypeError(
-        MessageTemplate::kCalledOnNonObject, 'Reflect.has');
-    return HasProperty(objectJSReceiver, key);
-  }
+// ES section #sec-reflect.has
+transitioning javascript builtin
+ReflectHas(js-implicit context: NativeContext)(
+    object: JSAny, key: JSAny): JSAny {
+  const objectJSReceiver = Cast<JSReceiver>(object)
+      otherwise ThrowTypeError(MessageTemplate::kCalledOnNonObject, 'Reflect.has');
+  return HasProperty(objectJSReceiver, key);
+}
 }  // namespace reflect
diff --git a/deps/v8/src/builtins/regexp-exec.tq b/deps/v8/src/builtins/regexp-exec.tq
index 0b11c42fbf7..87b00c1fdcd 100644
--- a/deps/v8/src/builtins/regexp-exec.tq
+++ b/deps/v8/src/builtins/regexp-exec.tq
@@ -6,40 +6,39 @@
 
 namespace regexp {
 
-  @export
-  transitioning macro RegExpPrototypeExecBodyFast(implicit context: Context)(
-      receiver: JSReceiver, string: String): JSAny {
-    return RegExpPrototypeExecBody(receiver, string, true);
-  }
-
-  transitioning macro RegExpPrototypeExecBodySlow(implicit context: Context)(
-      receiver: JSReceiver, string: String): JSAny {
-    return RegExpPrototypeExecBody(receiver, string, false);
-  }
-
-  // Slow path stub for RegExpPrototypeExec to decrease code size.
-  transitioning builtin
-  RegExpPrototypeExecSlow(implicit context: Context)(
-      regexp: JSRegExp, string: String): JSAny {
-    return RegExpPrototypeExecBodySlow(regexp, string);
-  }
-
-  extern macro RegExpBuiltinsAssembler::IsFastRegExpNoPrototype(
-      implicit context: Context)(Object): bool;
-
-  // ES#sec-regexp.prototype.exec
-  // RegExp.prototype.exec ( string )
-  transitioning javascript builtin RegExpPrototypeExec(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(string: JSAny): JSAny {
-    // Ensure {receiver} is a JSRegExp.
-    const receiver = Cast<JSRegExp>(receiver) otherwise ThrowTypeError(
-        MessageTemplate::kIncompatibleMethodReceiver, 'RegExp.prototype.exec',
-        receiver);
-    const string = ToString_Inline(string);
-
-    return IsFastRegExpNoPrototype(receiver) ?
-        RegExpPrototypeExecBodyFast(receiver, string) :
-        RegExpPrototypeExecSlow(receiver, string);
-  }
+@export
+transitioning macro RegExpPrototypeExecBodyFast(implicit context: Context)(
+    receiver: JSReceiver, string: String): JSAny {
+  return RegExpPrototypeExecBody(receiver, string, true);
+}
+
+transitioning macro RegExpPrototypeExecBodySlow(implicit context: Context)(
+    receiver: JSReceiver, string: String): JSAny {
+  return RegExpPrototypeExecBody(receiver, string, false);
+}
+
+// Slow path stub for RegExpPrototypeExec to decrease code size.
+transitioning builtin
+RegExpPrototypeExecSlow(implicit context: Context)(
+    regexp: JSRegExp, string: String): JSAny {
+  return RegExpPrototypeExecBodySlow(regexp, string);
+}
+
+extern macro RegExpBuiltinsAssembler::IsFastRegExpNoPrototype(
+    implicit context: Context)(Object): bool;
+
+// ES#sec-regexp.prototype.exec
+// RegExp.prototype.exec ( string )
+transitioning javascript builtin RegExpPrototypeExec(
+    js-implicit context: NativeContext, receiver: JSAny)(string: JSAny): JSAny {
+  // Ensure {receiver} is a JSRegExp.
+  const receiver = Cast<JSRegExp>(receiver) otherwise ThrowTypeError(
+      MessageTemplate::kIncompatibleMethodReceiver, 'RegExp.prototype.exec',
+      receiver);
+  const string = ToString_Inline(string);
+
+  return IsFastRegExpNoPrototype(receiver) ?
+      RegExpPrototypeExecBodyFast(receiver, string) :
+      RegExpPrototypeExecSlow(receiver, string);
+}
 }
diff --git a/deps/v8/src/builtins/regexp-match-all.tq b/deps/v8/src/builtins/regexp-match-all.tq
index 022f8bc53f1..932972d8440 100644
--- a/deps/v8/src/builtins/regexp-match-all.tq
+++ b/deps/v8/src/builtins/regexp-match-all.tq
@@ -6,247 +6,217 @@
 
 namespace regexp {
 
-  extern transitioning macro
-  RegExpMatchAllAssembler::CreateRegExpStringIterator(
-      NativeContext, Object, String, bool, bool): JSAny;
-
-  @export
-  transitioning macro RegExpPrototypeMatchAllImpl(implicit context: Context)(
-      nativeContext: NativeContext, receiver: JSAny, string: JSAny): JSAny {
-    // 1. Let R be the this value.
-    // 2. If Type(R) is not Object, throw a TypeError exception.
-    ThrowIfNotJSReceiver(
-        receiver, MessageTemplate::kIncompatibleMethodReceiver,
-        'RegExp.prototype.@@matchAll');
-    const receiver = UnsafeCast<JSReceiver>(receiver);
-
-    // 3. Let S be ? ToString(O).
-    const string: String = ToString_Inline(string);
-
-    let matcher: Object;
-    let global: bool;
-    let unicode: bool;
-
-    // 'FastJSRegExp' uses the strict fast path check because following code
-    // uses the flags property.
-    // TODO(jgruber): Handle slow flag accesses on the fast path and make this
-    // permissive.
-    typeswitch (receiver) {
-      case (fastRegExp: FastJSRegExp): {
-        const source = fastRegExp.source;
-
-        // 4. Let C be ? SpeciesConstructor(R, %RegExp%).
-        // 5. Let flags be ? ToString(? Get(R, "flags")).
-        // 6. Let matcher be ? Construct(C, « R, flags »).
-        const flags: String = FastFlagsGetter(fastRegExp);
-        matcher = RegExpCreate(nativeContext, source, flags);
-        const matcherRegExp = UnsafeCast<JSRegExp>(matcher);
-        assert(IsFastRegExpPermissive(matcherRegExp));
-
-        // 7. Let lastIndex be ? ToLength(? Get(R, "lastIndex")).
-        // 8. Perform ? Set(matcher, "lastIndex", lastIndex, true).
-        const fastRegExp = UnsafeCast<FastJSRegExp>(receiver);
-        FastStoreLastIndex(matcherRegExp, fastRegExp.lastIndex);
-
-        // 9. If flags contains "g", let global be true.
-        // 10. Else, let global be false.
-        global = FastFlagGetter(matcherRegExp, Flag::kGlobal);
-
-        // 11. If flags contains "u", let fullUnicode be true.
-        // 12. Else, let fullUnicode be false.
-        unicode = FastFlagGetter(matcherRegExp, Flag::kUnicode);
-      }
-      case (Object): {
-        // 4. Let C be ? SpeciesConstructor(R, %RegExp%).
-        const regexpFun = LoadRegExpFunction(nativeContext);
-        const speciesConstructor =
-            UnsafeCast<Constructor>(SpeciesConstructor(receiver, regexpFun));
-
-        // 5. Let flags be ? ToString(? Get(R, "flags")).
-        const flags = GetProperty(receiver, 'flags');
-        const flagsString = ToString_Inline(flags);
-
-        // 6. Let matcher be ? Construct(C, « R, flags »).
-        matcher = Construct(speciesConstructor, receiver, flagsString);
-
-        // 7. Let lastIndex be ? ToLength(? Get(R, "lastIndex")).
-        const lastIndex: Number = ToLength_Inline(SlowLoadLastIndex(receiver));
-
-        // 8. Perform ? Set(matcher, "lastIndex", lastIndex, true).
-        SlowStoreLastIndex(UnsafeCast<JSReceiver>(matcher), lastIndex);
-
-        // 9. If flags contains "g", let global be true.
-        // 10. Else, let global be false.
-        const globalCharString: String = StringConstant('g');
-        const globalIndex: Smi =
-            StringIndexOf(flagsString, globalCharString, 0);
-        global = globalIndex != -1;
-
-        // 11. If flags contains "u", let fullUnicode be true.
-        // 12. Else, let fullUnicode be false.
-        const unicodeCharString = StringConstant('u');
-        const unicodeIndex: Smi =
-            StringIndexOf(flagsString, unicodeCharString, 0);
-        unicode = unicodeIndex != -1;
-      }
+extern transitioning macro
+RegExpMatchAllAssembler::CreateRegExpStringIterator(
+    NativeContext, Object, String, bool, bool): JSAny;
+
+@export
+transitioning macro RegExpPrototypeMatchAllImpl(implicit context: Context)(
+    nativeContext: NativeContext, receiver: JSAny, string: JSAny): JSAny {
+  // 1. Let R be the this value.
+  // 2. If Type(R) is not Object, throw a TypeError exception.
+  ThrowIfNotJSReceiver(
+      receiver, MessageTemplate::kIncompatibleMethodReceiver,
+      'RegExp.prototype.@@matchAll');
+  const receiver = UnsafeCast<JSReceiver>(receiver);
+
+  // 3. Let S be ? ToString(O).
+  const string: String = ToString_Inline(string);
+
+  let matcher: Object;
+  let global: bool;
+  let unicode: bool;
+
+  // 'FastJSRegExp' uses the strict fast path check because following code
+  // uses the flags property.
+  // TODO(jgruber): Handle slow flag accesses on the fast path and make this
+  // permissive.
+  typeswitch (receiver) {
+    case (fastRegExp: FastJSRegExp): {
+      const source = fastRegExp.source;
+
+      // 4. Let C be ? SpeciesConstructor(R, %RegExp%).
+      // 5. Let flags be ? ToString(? Get(R, "flags")).
+      // 6. Let matcher be ? Construct(C, « R, flags »).
+      const flags: String = FastFlagsGetter(fastRegExp);
+      matcher = RegExpCreate(nativeContext, source, flags);
+      const matcherRegExp = UnsafeCast<JSRegExp>(matcher);
+      assert(IsFastRegExpPermissive(matcherRegExp));
+
+      // 7. Let lastIndex be ? ToLength(? Get(R, "lastIndex")).
+      // 8. Perform ? Set(matcher, "lastIndex", lastIndex, true).
+      const fastRegExp = UnsafeCast<FastJSRegExp>(receiver);
+      FastStoreLastIndex(matcherRegExp, fastRegExp.lastIndex);
+
+      // 9. If flags contains "g", let global be true.
+      // 10. Else, let global be false.
+      global = FastFlagGetter(matcherRegExp, Flag::kGlobal);
+
+      // 11. If flags contains "u", let fullUnicode be true.
+      // 12. Else, let fullUnicode be false.
+      unicode = FastFlagGetter(matcherRegExp, Flag::kUnicode);
+    }
+    case (Object): {
+      // 4. Let C be ? SpeciesConstructor(R, %RegExp%).
+      const regexpFun = LoadRegExpFunction(nativeContext);
+      const speciesConstructor =
+          UnsafeCast<Constructor>(SpeciesConstructor(receiver, regexpFun));
+
+      // 5. Let flags be ? ToString(? Get(R, "flags")).
+      const flags = GetProperty(receiver, 'flags');
+      const flagsString = ToString_Inline(flags);
+
+      // 6. Let matcher be ? Construct(C, « R, flags »).
+      matcher = Construct(speciesConstructor, receiver, flagsString);
+
+      // 7. Let lastIndex be ? ToLength(? Get(R, "lastIndex")).
+      const lastIndex: Number = ToLength_Inline(SlowLoadLastIndex(receiver));
+
+      // 8. Perform ? Set(matcher, "lastIndex", lastIndex, true).
+      SlowStoreLastIndex(UnsafeCast<JSReceiver>(matcher), lastIndex);
+
+      // 9. If flags contains "g", let global be true.
+      // 10. Else, let global be false.
+      const globalCharString: String = StringConstant('g');
+      const globalIndex: Smi = StringIndexOf(flagsString, globalCharString, 0);
+      global = globalIndex != -1;
+
+      // 11. If flags contains "u", let fullUnicode be true.
+      // 12. Else, let fullUnicode be false.
+      const unicodeCharString = StringConstant('u');
+      const unicodeIndex: Smi =
+          StringIndexOf(flagsString, unicodeCharString, 0);
+      unicode = unicodeIndex != -1;
     }
-
-    // 13. Return ! CreateRegExpStringIterator(matcher, S, global, fullUnicode).
-    return CreateRegExpStringIterator(
-        nativeContext, matcher, string, global, unicode);
-  }
-
-  // https://tc39.github.io/proposal-string-matchall/
-  // RegExp.prototype [ @@matchAll ] ( string )
-  transitioning javascript builtin RegExpPrototypeMatchAll(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(string: JSAny): JSAny {
-    return RegExpPrototypeMatchAllImpl(context, receiver, string);
-  }
-
-  const kJSRegExpStringIteratorDone:
-      constexpr int31 generates '1 << JSRegExpStringIterator::kDoneBit';
-  const kJSRegExpStringIteratorGlobal: constexpr int31
-  generates '1 << JSRegExpStringIterator::kGlobalBit';
-  const kJSRegExpStringIteratorUnicode: constexpr int31
-  generates '1 << JSRegExpStringIterator::kUnicodeBit';
-
-  extern macro IsSetSmi(Smi, constexpr int31): bool;
-
-  macro HasDoneFlag(flags: Smi): bool {
-    return IsSetSmi(flags, kJSRegExpStringIteratorDone);
-  }
-
-  macro HasGlobalFlag(flags: Smi): bool {
-    return IsSetSmi(flags, kJSRegExpStringIteratorGlobal);
-  }
-
-  macro HasUnicodeFlag(flags: Smi): bool {
-    return IsSetSmi(flags, kJSRegExpStringIteratorUnicode);
   }
 
-  macro SetDoneFlag(iterator: JSRegExpStringIterator, flags: Smi) {
-    const newFlags: Smi = flags | kJSRegExpStringIteratorDone;
-    iterator.flags = newFlags;
-  }
+  // 13. Return ! CreateRegExpStringIterator(matcher, S, global, fullUnicode).
+  return CreateRegExpStringIterator(
+      nativeContext, matcher, string, global, unicode);
+}
 
-  // https://tc39.github.io/proposal-string-matchall/
-  // %RegExpStringIteratorPrototype%.next ( )
-  transitioning javascript builtin RegExpStringIteratorPrototypeNext(
-      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
-    // 1. Let O be the this value.
-    // 2. If Type(O) is not Object, throw a TypeError exception.
-    // 3. If O does not have all of the internal slots of a RegExp String
-    // Iterator Object Instance (see 5.3), throw a TypeError exception.
-    const methodName: constexpr string =
-        '%RegExpStringIterator%.prototype.next';
-    const receiver = Cast<JSRegExpStringIterator>(receiver) otherwise
-    ThrowTypeError(
-        MessageTemplate::kIncompatibleMethodReceiver, methodName, receiver);
+// https://tc39.github.io/proposal-string-matchall/
+// RegExp.prototype [ @@matchAll ] ( string )
+transitioning javascript builtin RegExpPrototypeMatchAll(
+    js-implicit context: NativeContext, receiver: JSAny)(string: JSAny): JSAny {
+  return RegExpPrototypeMatchAllImpl(context, receiver, string);
+}
 
+// https://tc39.github.io/proposal-string-matchall/
+// %RegExpStringIteratorPrototype%.next ( )
+transitioning javascript builtin RegExpStringIteratorPrototypeNext(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+  // 1. Let O be the this value.
+  // 2. If Type(O) is not Object, throw a TypeError exception.
+  // 3. If O does not have all of the internal slots of a RegExp String
+  // Iterator Object Instance (see 5.3), throw a TypeError exception.
+  const methodName: constexpr string = '%RegExpStringIterator%.prototype.next';
+  const receiver = Cast<JSRegExpStringIterator>(receiver) otherwise
+  ThrowTypeError(
+      MessageTemplate::kIncompatibleMethodReceiver, methodName, receiver);
+
+  try {
+    // 4. If O.[[Done]] is true, then
+    //   a. Return ! CreateIterResultObject(undefined, true).
+    const flags: SmiTagged<JSRegExpStringIteratorFlags> = receiver.flags;
+    if (flags.done) goto ReturnEmptyDoneResult;
+
+    // 5. Let R be O.[[iteratingRegExp]].
+    const iteratingRegExp: JSReceiver = receiver.iterating_reg_exp;
+
+    // 6. Let S be O.[[IteratedString]].
+    const iteratingString: String = receiver.iterated_string;
+
+    // 7. Let global be O.[[Global]].
+    // 8. Let fullUnicode be O.[[Unicode]].
+    // 9. Let match be ? RegExpExec(R, S).
+    let match: Object;
+    let isFastRegExp: bool = false;
     try {
-      // 4. If O.[[Done]] is true, then
-      //   a. Return ! CreateIterResultObject(undefined, true).
-      const flags: Smi = receiver.flags;
-      if (HasDoneFlag(flags)) goto ReturnEmptyDoneResult;
-
-      // 5. Let R be O.[[iteratingRegExp]].
-      const iteratingRegExp: JSReceiver = receiver.iterating_reg_exp;
-
-      // 6. Let S be O.[[IteratedString]].
-      const iteratingString: String = receiver.iterated_string;
-
-      // 7. Let global be O.[[Global]].
-      // 8. Let fullUnicode be O.[[Unicode]].
-      // 9. Let match be ? RegExpExec(R, S).
-      let match: Object;
-      let isFastRegExp: bool = false;
-      try {
-        if (IsFastRegExpPermissive(iteratingRegExp)) {
-          const regexp = UnsafeCast<JSRegExp>(iteratingRegExp);
-          const lastIndex = LoadLastIndexAsLength(regexp, true);
-          const matchIndices: RegExpMatchInfo =
-              RegExpPrototypeExecBodyWithoutResultFast(
-                  regexp, iteratingString, lastIndex)
-              otherwise IfNoMatch;
-          match = ConstructNewResultFromMatchInfo(
-              regexp, matchIndices, iteratingString, lastIndex);
-          isFastRegExp = true;
-        } else {
-          match = RegExpExec(iteratingRegExp, iteratingString);
-          if (match == Null) {
-            goto IfNoMatch;
-          }
+      if (IsFastRegExpPermissive(iteratingRegExp)) {
+        const regexp = UnsafeCast<JSRegExp>(iteratingRegExp);
+        const lastIndex = LoadLastIndexAsLength(regexp, true);
+        const matchIndices: RegExpMatchInfo =
+            RegExpPrototypeExecBodyWithoutResultFast(
+                regexp, iteratingString, lastIndex)
+            otherwise IfNoMatch;
+        match = ConstructNewResultFromMatchInfo(
+            regexp, matchIndices, iteratingString, lastIndex);
+        isFastRegExp = true;
+      } else {
+        match = RegExpExec(iteratingRegExp, iteratingString);
+        if (match == Null) {
+          goto IfNoMatch;
         }
-        // 11. Else,
-        // b. Else, handle non-global case first.
-        if (!HasGlobalFlag(flags)) {
-          // i. Set O.[[Done]] to true.
-          SetDoneFlag(receiver, flags);
-
-          // ii. Return ! CreateIterResultObject(match, false).
-          return AllocateJSIteratorResult(UnsafeCast<JSAny>(match), False);
-        }
-        // a. If global is true,
-        assert(HasGlobalFlag(flags));
-        if (isFastRegExp) {
-          // i. Let matchStr be ? ToString(? Get(match, "0")).
-          const match = UnsafeCast<JSRegExpResult>(match);
-          const resultFixedArray = UnsafeCast<FixedArray>(match.elements);
-          const matchStr = UnsafeCast<String>(resultFixedArray.objects[0]);
-
-          // When iterating_regexp is fast, we assume it stays fast even after
-          // accessing the first match from the RegExp result.
-          assert(IsFastRegExpPermissive(iteratingRegExp));
-          const iteratingRegExp = UnsafeCast<JSRegExp>(iteratingRegExp);
-          if (matchStr == kEmptyString) {
-            // 1. Let thisIndex be ? ToLength(? Get(R, "lastIndex")).
-            const thisIndex: Smi = FastLoadLastIndex(iteratingRegExp);
-
-            // 2. Let nextIndex be ! AdvanceStringIndex(S, thisIndex,
-            // fullUnicode).
-            const nextIndex: Smi = AdvanceStringIndexFast(
-                iteratingString, thisIndex, HasUnicodeFlag(flags));
-
-            // 3. Perform ? Set(R, "lastIndex", nextIndex, true).
-            FastStoreLastIndex(iteratingRegExp, nextIndex);
-          }
-
-          // iii. Return ! CreateIterResultObject(match, false).
-          return AllocateJSIteratorResult(match, False);
-        }
-        assert(!isFastRegExp);
+      }
+      // 11. Else,
+      // b. Else, handle non-global case first.
+      if (!flags.global) {
+        // i. Set O.[[Done]] to true.
+        receiver.flags.done = true;
+
+        // ii. Return ! CreateIterResultObject(match, false).
+        return AllocateJSIteratorResult(UnsafeCast<JSAny>(match), False);
+      }
+      // a. If global is true,
+      assert(flags.global);
+      if (isFastRegExp) {
         // i. Let matchStr be ? ToString(? Get(match, "0")).
-        const match = UnsafeCast<JSAny>(match);
-        const matchStr = ToString_Inline(GetProperty(match, SmiConstant(0)));
-
+        const match = UnsafeCast<JSRegExpResult>(match);
+        const resultFixedArray = UnsafeCast<FixedArray>(match.elements);
+        const matchStr = UnsafeCast<String>(resultFixedArray.objects[0]);
+
+        // When iterating_regexp is fast, we assume it stays fast even after
+        // accessing the first match from the RegExp result.
+        assert(IsFastRegExpPermissive(iteratingRegExp));
+        const iteratingRegExp = UnsafeCast<JSRegExp>(iteratingRegExp);
         if (matchStr == kEmptyString) {
           // 1. Let thisIndex be ? ToLength(? Get(R, "lastIndex")).
-          const lastIndex: JSAny = SlowLoadLastIndex(iteratingRegExp);
-          const thisIndex: Number = ToLength_Inline(lastIndex);
+          const thisIndex: Smi = FastLoadLastIndex(iteratingRegExp);
 
           // 2. Let nextIndex be ! AdvanceStringIndex(S, thisIndex,
           // fullUnicode).
-          const nextIndex: Number = AdvanceStringIndexSlow(
-              iteratingString, thisIndex, HasUnicodeFlag(flags));
+          const nextIndex: Smi =
+              AdvanceStringIndexFast(iteratingString, thisIndex, flags.unicode);
 
           // 3. Perform ? Set(R, "lastIndex", nextIndex, true).
-          SlowStoreLastIndex(iteratingRegExp, nextIndex);
+          FastStoreLastIndex(iteratingRegExp, nextIndex);
         }
+
         // iii. Return ! CreateIterResultObject(match, false).
         return AllocateJSIteratorResult(match, False);
       }
-      // 10. If match is null, then
-      label IfNoMatch {
-        // a. Set O.[[Done]] to true.
-        SetDoneFlag(receiver, flags);
-
-        // b. Return ! CreateIterResultObject(undefined, true).
-        goto ReturnEmptyDoneResult;
+      assert(!isFastRegExp);
+      // i. Let matchStr be ? ToString(? Get(match, "0")).
+      const match = UnsafeCast<JSAny>(match);
+      const matchStr = ToString_Inline(GetProperty(match, SmiConstant(0)));
+
+      if (matchStr == kEmptyString) {
+        // 1. Let thisIndex be ? ToLength(? Get(R, "lastIndex")).
+        const lastIndex: JSAny = SlowLoadLastIndex(iteratingRegExp);
+        const thisIndex: Number = ToLength_Inline(lastIndex);
+
+        // 2. Let nextIndex be ! AdvanceStringIndex(S, thisIndex,
+        // fullUnicode).
+        const nextIndex: Number =
+            AdvanceStringIndexSlow(iteratingString, thisIndex, flags.unicode);
+
+        // 3. Perform ? Set(R, "lastIndex", nextIndex, true).
+        SlowStoreLastIndex(iteratingRegExp, nextIndex);
       }
+      // iii. Return ! CreateIterResultObject(match, false).
+      return AllocateJSIteratorResult(match, False);
     }
-    label ReturnEmptyDoneResult {
-      return AllocateJSIteratorResult(Undefined, True);
+    // 10. If match is null, then
+    label IfNoMatch {
+      // a. Set O.[[Done]] to true.
+      receiver.flags.done = true;
+
+      // b. Return ! CreateIterResultObject(undefined, true).
+      goto ReturnEmptyDoneResult;
     }
+  } label ReturnEmptyDoneResult {
+    return AllocateJSIteratorResult(Undefined, True);
   }
 }
+}
diff --git a/deps/v8/src/builtins/regexp-match.tq b/deps/v8/src/builtins/regexp-match.tq
index 9b0255762c0..d5581e05093 100644
--- a/deps/v8/src/builtins/regexp-match.tq
+++ b/deps/v8/src/builtins/regexp-match.tq
@@ -6,160 +6,157 @@
 
 namespace regexp {
 
-  const kATOM: constexpr int31
-  generates 'JSRegExp::ATOM';
-  const kTagIndex: constexpr int31
-  generates 'JSRegExp::kTagIndex';
-  const kAtomPatternIndex: constexpr int31
-  generates 'JSRegExp::kAtomPatternIndex';
-
-  extern transitioning macro RegExpBuiltinsAssembler::FlagGetter(
-      implicit context: Context)(Object, constexpr Flag, constexpr bool): bool;
-
-  extern macro UnsafeLoadFixedArrayElement(RegExpMatchInfo, constexpr int31):
-      Object;
-
-  transitioning macro RegExpPrototypeMatchBody(implicit context: Context)(
-      regexp: JSReceiver, string: String, isFastPath: constexpr bool): JSAny {
-    if constexpr (isFastPath) {
-      assert(Is<FastJSRegExp>(regexp));
-    }
+const kATOM: constexpr int31
+    generates 'JSRegExp::ATOM';
+const kTagIndex: constexpr int31
+    generates 'JSRegExp::kTagIndex';
+const kAtomPatternIndex: constexpr int31
+    generates 'JSRegExp::kAtomPatternIndex';
+
+extern transitioning macro RegExpBuiltinsAssembler::FlagGetter(
+    implicit context: Context)(Object, constexpr Flag, constexpr bool): bool;
+
+extern macro UnsafeLoadFixedArrayElement(
+    RegExpMatchInfo, constexpr int31): Object;
+
+transitioning macro RegExpPrototypeMatchBody(implicit context: Context)(
+    regexp: JSReceiver, string: String, isFastPath: constexpr bool): JSAny {
+  if constexpr (isFastPath) {
+    assert(Is<FastJSRegExp>(regexp));
+  }
 
-    const isGlobal: bool = FlagGetter(regexp, Flag::kGlobal, isFastPath);
+  const isGlobal: bool = FlagGetter(regexp, Flag::kGlobal, isFastPath);
 
-    if (!isGlobal) {
-      return isFastPath ? RegExpPrototypeExecBodyFast(regexp, string) :
-                          RegExpExec(regexp, string);
-    }
+  if (!isGlobal) {
+    return isFastPath ? RegExpPrototypeExecBodyFast(regexp, string) :
+                        RegExpExec(regexp, string);
+  }
 
-    assert(isGlobal);
-    const isUnicode: bool = FlagGetter(regexp, Flag::kUnicode, isFastPath);
+  assert(isGlobal);
+  const isUnicode: bool = FlagGetter(regexp, Flag::kUnicode, isFastPath);
 
-    StoreLastIndex(regexp, 0, isFastPath);
+  StoreLastIndex(regexp, 0, isFastPath);
 
-    // Allocate an array to store the resulting match strings.
+  // Allocate an array to store the resulting match strings.
 
-    let array = growable_fixed_array::NewGrowableFixedArray();
+  let array = growable_fixed_array::NewGrowableFixedArray();
 
-    // Check if the regexp is an ATOM type. If so, then keep the literal string
-    // to search for so that we can avoid calling substring in the loop below.
-    let atom: bool = false;
-    let searchString: String = EmptyStringConstant();
-    if constexpr (isFastPath) {
-      const maybeAtomRegexp = UnsafeCast<JSRegExp>(regexp);
-      const data = UnsafeCast<FixedArray>(maybeAtomRegexp.data);
-      if (UnsafeCast<Smi>(data.objects[kTagIndex]) == kATOM) {
-        searchString = UnsafeCast<String>(data.objects[kAtomPatternIndex]);
-        atom = true;
-      }
+  // Check if the regexp is an ATOM type. If so, then keep the literal string
+  // to search for so that we can avoid calling substring in the loop below.
+  let atom: bool = false;
+  let searchString: String = EmptyStringConstant();
+  if constexpr (isFastPath) {
+    const maybeAtomRegexp = UnsafeCast<JSRegExp>(regexp);
+    const data = UnsafeCast<FixedArray>(maybeAtomRegexp.data);
+    if (UnsafeCast<Smi>(data.objects[kTagIndex]) == kATOM) {
+      searchString = UnsafeCast<String>(data.objects[kAtomPatternIndex]);
+      atom = true;
     }
+  }
 
-    while (true) {
-      let match: String = EmptyStringConstant();
-      try {
-        if constexpr (isFastPath) {
-          // On the fast path, grab the matching string from the raw match index
-          // array.
-          const matchIndices: RegExpMatchInfo =
-              RegExpPrototypeExecBodyWithoutResultFast(
-                  UnsafeCast<JSRegExp>(regexp), string) otherwise IfDidNotMatch;
-          if (atom) {
-            match = searchString;
-          } else {
-            const matchFrom = UnsafeLoadFixedArrayElement(
-                matchIndices, kRegExpMatchInfoFirstCaptureIndex);
-            const matchTo = UnsafeLoadFixedArrayElement(
-                matchIndices, kRegExpMatchInfoFirstCaptureIndex + 1);
-            match = SubString(
-                string, UnsafeCast<Smi>(matchFrom), UnsafeCast<Smi>(matchTo));
-          }
+  while (true) {
+    let match: String = EmptyStringConstant();
+    try {
+      if constexpr (isFastPath) {
+        // On the fast path, grab the matching string from the raw match index
+        // array.
+        const matchIndices: RegExpMatchInfo =
+            RegExpPrototypeExecBodyWithoutResultFast(
+                UnsafeCast<JSRegExp>(regexp), string) otherwise IfDidNotMatch;
+        if (atom) {
+          match = searchString;
         } else {
-          assert(!isFastPath);
-          const resultTemp = RegExpExec(regexp, string);
-          if (resultTemp == Null) {
-            goto IfDidNotMatch;
-          }
-          match = ToString_Inline(GetProperty(resultTemp, SmiConstant(0)));
+          const matchFrom = UnsafeLoadFixedArrayElement(
+              matchIndices, kRegExpMatchInfoFirstCaptureIndex);
+          const matchTo = UnsafeLoadFixedArrayElement(
+              matchIndices, kRegExpMatchInfoFirstCaptureIndex + 1);
+          match = SubString(
+              string, UnsafeCast<Smi>(matchFrom), UnsafeCast<Smi>(matchTo));
+        }
+      } else {
+        assert(!isFastPath);
+        const resultTemp = RegExpExec(regexp, string);
+        if (resultTemp == Null) {
+          goto IfDidNotMatch;
         }
-        goto IfDidMatch;
+        match = ToString_Inline(GetProperty(resultTemp, SmiConstant(0)));
       }
-      label IfDidNotMatch {
-        return array.length == 0 ? Null : array.ToJSArray();
+      goto IfDidMatch;
+    } label IfDidNotMatch {
+      return array.length == 0 ? Null : array.ToJSArray();
+    } label IfDidMatch {
+      // Store the match, growing the fixed array if needed.
+
+      array.Push(match);
+
+      // Advance last index if the match is the empty string.
+      const matchLength: Smi = match.length_smi;
+      if (matchLength != 0) {
+        continue;
+      }
+      let lastIndex = LoadLastIndex(regexp, isFastPath);
+      if constexpr (isFastPath) {
+        assert(TaggedIsPositiveSmi(lastIndex));
+      } else {
+        lastIndex = ToLength_Inline(lastIndex);
       }
-      label IfDidMatch {
-        // Store the match, growing the fixed array if needed.
-
-        array.Push(match);
-
-        // Advance last index if the match is the empty string.
-        const matchLength: Smi = match.length_smi;
-        if (matchLength != 0) {
-          continue;
-        }
-        let lastIndex = LoadLastIndex(regexp, isFastPath);
-        if constexpr (isFastPath) {
-          assert(TaggedIsPositiveSmi(lastIndex));
-        } else {
-          lastIndex = ToLength_Inline(lastIndex);
-        }
-
-        const newLastIndex: Number = AdvanceStringIndex(
-            string, UnsafeCast<Number>(lastIndex), isUnicode, isFastPath);
-
-        if constexpr (isFastPath) {
-          // On the fast path, we can be certain that lastIndex can never be
-          // incremented to overflow the Smi range since the maximal string
-          // length is less than the maximal Smi value.
-          const kMaxStringLengthFitsSmi: constexpr bool =
-              kStringMaxLengthUintptr < kSmiMaxValue;
-          StaticAssert(kMaxStringLengthFitsSmi);
-          assert(TaggedIsPositiveSmi(newLastIndex));
-        }
 
-        StoreLastIndex(regexp, newLastIndex, isFastPath);
+      const newLastIndex: Number = AdvanceStringIndex(
+          string, UnsafeCast<Number>(lastIndex), isUnicode, isFastPath);
+
+      if constexpr (isFastPath) {
+        // On the fast path, we can be certain that lastIndex can never be
+        // incremented to overflow the Smi range since the maximal string
+        // length is less than the maximal Smi value.
+        const kMaxStringLengthFitsSmi: constexpr bool =
+            kStringMaxLengthUintptr < kSmiMaxValue;
+        StaticAssert(kMaxStringLengthFitsSmi);
+        assert(TaggedIsPositiveSmi(newLastIndex));
       }
-    }
 
-    VerifiedUnreachable();
+      StoreLastIndex(regexp, newLastIndex, isFastPath);
+    }
   }
 
-  transitioning macro FastRegExpPrototypeMatchBody(implicit context: Context)(
-      receiver: FastJSRegExp, string: String): JSAny {
-    return RegExpPrototypeMatchBody(receiver, string, true);
-  }
+  VerifiedUnreachable();
+}
 
-  transitioning macro SlowRegExpPrototypeMatchBody(implicit context: Context)(
-      receiver: JSReceiver, string: String): JSAny {
-    return RegExpPrototypeMatchBody(receiver, string, false);
-  }
+transitioning macro FastRegExpPrototypeMatchBody(implicit context: Context)(
+    receiver: FastJSRegExp, string: String): JSAny {
+  return RegExpPrototypeMatchBody(receiver, string, true);
+}
 
-  // Helper that skips a few initial checks. and assumes...
-  // 1) receiver is a "fast" RegExp
-  // 2) pattern is a string
-  transitioning builtin RegExpMatchFast(implicit context: Context)(
-      receiver: FastJSRegExp, string: String): JSAny {
-    return FastRegExpPrototypeMatchBody(receiver, string);
-  }
+transitioning macro SlowRegExpPrototypeMatchBody(implicit context: Context)(
+    receiver: JSReceiver, string: String): JSAny {
+  return RegExpPrototypeMatchBody(receiver, string, false);
+}
 
-  // ES#sec-regexp.prototype-@@match
-  // RegExp.prototype [ @@match ] ( string )
-  transitioning javascript builtin RegExpPrototypeMatch(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(string: JSAny): JSAny {
-    ThrowIfNotJSReceiver(
-        receiver, MessageTemplate::kIncompatibleMethodReceiver,
-        'RegExp.prototype.@@match');
-    const receiver = UnsafeCast<JSReceiver>(receiver);
-    const string: String = ToString_Inline(string);
-
-    // Strict: Reads global and unicode properties.
-    // TODO(jgruber): Handle slow flag accesses on the fast path and make this
-    // permissive.
-    const fastRegExp = Cast<FastJSRegExp>(receiver)
-        otherwise return SlowRegExpPrototypeMatchBody(receiver, string);
-
-    // TODO(pwong): Could be optimized to remove the overhead of calling the
-    //              builtin (at the cost of a larger builtin).
-    return RegExpMatchFast(fastRegExp, string);
-  }
+// Helper that skips a few initial checks. and assumes...
+// 1) receiver is a "fast" RegExp
+// 2) pattern is a string
+transitioning builtin RegExpMatchFast(implicit context: Context)(
+    receiver: FastJSRegExp, string: String): JSAny {
+  return FastRegExpPrototypeMatchBody(receiver, string);
+}
+
+// ES#sec-regexp.prototype-@@match
+// RegExp.prototype [ @@match ] ( string )
+transitioning javascript builtin RegExpPrototypeMatch(
+    js-implicit context: NativeContext, receiver: JSAny)(string: JSAny): JSAny {
+  ThrowIfNotJSReceiver(
+      receiver, MessageTemplate::kIncompatibleMethodReceiver,
+      'RegExp.prototype.@@match');
+  const receiver = UnsafeCast<JSReceiver>(receiver);
+  const string: String = ToString_Inline(string);
+
+  // Strict: Reads global and unicode properties.
+  // TODO(jgruber): Handle slow flag accesses on the fast path and make this
+  // permissive.
+  const fastRegExp = Cast<FastJSRegExp>(receiver)
+      otherwise return SlowRegExpPrototypeMatchBody(receiver, string);
+
+  // TODO(pwong): Could be optimized to remove the overhead of calling the
+  //              builtin (at the cost of a larger builtin).
+  return RegExpMatchFast(fastRegExp, string);
+}
 }
diff --git a/deps/v8/src/builtins/regexp-replace.tq b/deps/v8/src/builtins/regexp-replace.tq
index fc9d13cf3c6..c59a41b27f6 100644
--- a/deps/v8/src/builtins/regexp-replace.tq
+++ b/deps/v8/src/builtins/regexp-replace.tq
@@ -6,259 +6,252 @@
 
 namespace regexp {
 
-  extern builtin
-  SubString(implicit context: Context)(String, Smi, Smi): String;
-
-  extern runtime RegExpExecMultiple(implicit context: Context)(
-      JSRegExp, String, RegExpMatchInfo, JSArray): Null|JSArray;
-  extern transitioning runtime
-  RegExpReplaceRT(Context, JSReceiver, String, Object): String;
-  extern transitioning runtime
-  StringBuilderConcat(implicit context: Context)(JSArray, Smi, String): String;
-  extern transitioning runtime
-  StringReplaceNonGlobalRegExpWithFunction(implicit context: Context)(
-      String, JSRegExp, Callable): String;
-
-  transitioning macro RegExpReplaceCallableNoExplicitCaptures(implicit context:
-                                                                  Context)(
-      matchesElements: FixedArray, matchesLength: intptr, string: String,
-      replaceFn: Callable) {
-    let matchStart: Smi = 0;
-    for (let i: intptr = 0; i < matchesLength; i++) {
-      typeswitch (matchesElements.objects[i]) {
-        // Element represents a slice.
-        case (elSmi: Smi): {
-          // The slice's match start and end is either encoded as one or two
-          // smis. A positive smi indicates a single smi encoding (see
-          // ReplacementStringBuilder::AddSubjectSlice()).
-          if (elSmi > 0) {
-            // For single smi encoding, see
-            // StringBuilderSubstringLength::encode() and
-            // StringBuilderSubstringPosition::encode().
-            const elInt: intptr = Convert<intptr>(elSmi);
-            const newMatchStart: intptr = (elInt >> 11) + (elInt & 0x7FF);
-            matchStart = Convert<Smi>(newMatchStart);
-          } else {
-            // For two smi encoding, the length is negative followed by the
-            // match start.
-            const nextEl: Smi = UnsafeCast<Smi>(matchesElements.objects[++i]);
-            matchStart = nextEl - elSmi;
-          }
-        }
-        // Element represents the matched substring, which is then passed to the
-        // replace function.
-        case (elString: String): {
-          const replacementObj: JSAny =
-              Call(context, replaceFn, Undefined, elString, matchStart, string);
-          const replacement: String = ToString_Inline(replacementObj);
-          matchesElements.objects[i] = replacement;
-          matchStart += elString.length_smi;
-        }
-        case (Object): deferred {
-          unreachable;
+extern builtin
+SubString(implicit context: Context)(String, Smi, Smi): String;
+
+extern runtime RegExpExecMultiple(implicit context: Context)(
+    JSRegExp, String, RegExpMatchInfo, JSArray): Null|JSArray;
+extern transitioning runtime
+RegExpReplaceRT(Context, JSReceiver, String, Object): String;
+extern transitioning runtime
+StringBuilderConcat(implicit context: Context)(JSArray, Smi, String): String;
+extern transitioning runtime
+StringReplaceNonGlobalRegExpWithFunction(implicit context: Context)(
+    String, JSRegExp, Callable): String;
+
+transitioning macro RegExpReplaceCallableNoExplicitCaptures(
+    implicit context: Context)(
+    matchesElements: FixedArray, matchesLength: intptr, string: String,
+    replaceFn: Callable) {
+  let matchStart: Smi = 0;
+  for (let i: intptr = 0; i < matchesLength; i++) {
+    typeswitch (matchesElements.objects[i]) {
+      // Element represents a slice.
+      case (elSmi: Smi): {
+        // The slice's match start and end is either encoded as one or two
+        // smis. A positive smi indicates a single smi encoding (see
+        // ReplacementStringBuilder::AddSubjectSlice()).
+        if (elSmi > 0) {
+          // For single smi encoding, see
+          // StringBuilderSubstringLength::encode() and
+          // StringBuilderSubstringPosition::encode().
+          const elInt: intptr = Convert<intptr>(elSmi);
+          const newMatchStart: intptr = (elInt >> 11) + (elInt & 0x7FF);
+          matchStart = Convert<Smi>(newMatchStart);
+        } else {
+          // For two smi encoding, the length is negative followed by the
+          // match start.
+          const nextEl: Smi = UnsafeCast<Smi>(matchesElements.objects[++i]);
+          matchStart = nextEl - elSmi;
         }
       }
+      // Element represents the matched substring, which is then passed to the
+      // replace function.
+      case (elString: String): {
+        const replacementObj: JSAny =
+            Call(context, replaceFn, Undefined, elString, matchStart, string);
+        const replacement: String = ToString_Inline(replacementObj);
+        matchesElements.objects[i] = replacement;
+        matchStart += elString.length_smi;
+      }
+      case (Object): deferred {
+        unreachable;
+      }
     }
   }
+}
 
-  transitioning macro
-  RegExpReplaceCallableWithExplicitCaptures(implicit context: Context)(
-      matchesElements: FixedArray, matchesLength: intptr, replaceFn: Callable) {
-    for (let i: intptr = 0; i < matchesLength; i++) {
-      const elArray =
-          Cast<JSArray>(matchesElements.objects[i]) otherwise continue;
-
-      // The JSArray is expanded into the function args by Reflect.apply().
-      // TODO(jgruber): Remove indirection through Call->ReflectApply.
-      const replacementObj: JSAny = Call(
-          context, GetReflectApply(), Undefined, replaceFn, Undefined, elArray);
-
-      // Overwrite the i'th element in the results with the string
-      // we got back from the callback function.
-      matchesElements.objects[i] = ToString_Inline(replacementObj);
-    }
+transitioning macro
+RegExpReplaceCallableWithExplicitCaptures(implicit context: Context)(
+    matchesElements: FixedArray, matchesLength: intptr, replaceFn: Callable) {
+  for (let i: intptr = 0; i < matchesLength; i++) {
+    const elArray =
+        Cast<JSArray>(matchesElements.objects[i]) otherwise continue;
+
+    // The JSArray is expanded into the function args by Reflect.apply().
+    // TODO(jgruber): Remove indirection through Call->ReflectApply.
+    const replacementObj: JSAny = Call(
+        context, GetReflectApply(), Undefined, replaceFn, Undefined, elArray);
+
+    // Overwrite the i'th element in the results with the string
+    // we got back from the callback function.
+    matchesElements.objects[i] = ToString_Inline(replacementObj);
   }
+}
 
-  transitioning macro RegExpReplaceFastGlobalCallable(implicit context:
-                                                          Context)(
-      regexp: FastJSRegExp, string: String, replaceFn: Callable): String {
-    regexp.lastIndex = 0;
-
-    const kInitialCapacity: intptr = 16;
-    const kInitialLength: Smi = 0;
-    const result: Null|JSArray = RegExpExecMultiple(
-        regexp, string, GetRegExpLastMatchInfo(),
-        AllocateJSArray(
-            ElementsKind::PACKED_ELEMENTS, GetFastPackedElementsJSArrayMap(),
-            kInitialCapacity, kInitialLength));
-
-    regexp.lastIndex = 0;
-
-    // If no matches, return the subject string.
-    if (result == Null) return string;
-
-    const matches: JSArray = UnsafeCast<JSArray>(result);
-    const matchesLength: Smi = Cast<Smi>(matches.length) otherwise unreachable;
-    const matchesLengthInt: intptr = Convert<intptr>(matchesLength);
-    const matchesElements: FixedArray =
-        UnsafeCast<FixedArray>(matches.elements);
-
-    // Reload last match info since it might have changed.
-    const nofCaptures: Smi = GetRegExpLastMatchInfo().NumberOfCaptures();
-
-    // If the number of captures is two then there are no explicit captures in
-    // the regexp, just the implicit capture that captures the whole match. In
-    // this case we can simplify quite a bit and end up with something faster.
-    if (nofCaptures == 2) {
-      RegExpReplaceCallableNoExplicitCaptures(
-          matchesElements, matchesLengthInt, string, replaceFn);
-    } else {
-      RegExpReplaceCallableWithExplicitCaptures(
-          matchesElements, matchesLengthInt, replaceFn);
-    }
-
-    return StringBuilderConcat(matches, matchesLength, string);
+transitioning macro RegExpReplaceFastGlobalCallable(implicit context: Context)(
+    regexp: FastJSRegExp, string: String, replaceFn: Callable): String {
+  regexp.lastIndex = 0;
+
+  const kInitialCapacity: intptr = 16;
+  const kInitialLength: Smi = 0;
+  const result: Null|JSArray = RegExpExecMultiple(
+      regexp, string, GetRegExpLastMatchInfo(),
+      AllocateJSArray(
+          ElementsKind::PACKED_ELEMENTS, GetFastPackedElementsJSArrayMap(),
+          kInitialCapacity, kInitialLength));
+
+  regexp.lastIndex = 0;
+
+  // If no matches, return the subject string.
+  if (result == Null) return string;
+
+  const matches: JSArray = UnsafeCast<JSArray>(result);
+  const matchesLength: Smi = Cast<Smi>(matches.length) otherwise unreachable;
+  const matchesLengthInt: intptr = Convert<intptr>(matchesLength);
+  const matchesElements: FixedArray = UnsafeCast<FixedArray>(matches.elements);
+
+  // Reload last match info since it might have changed.
+  const nofCaptures: Smi = GetRegExpLastMatchInfo().NumberOfCaptures();
+
+  // If the number of captures is two then there are no explicit captures in
+  // the regexp, just the implicit capture that captures the whole match. In
+  // this case we can simplify quite a bit and end up with something faster.
+  if (nofCaptures == 2) {
+    RegExpReplaceCallableNoExplicitCaptures(
+        matchesElements, matchesLengthInt, string, replaceFn);
+  } else {
+    RegExpReplaceCallableWithExplicitCaptures(
+        matchesElements, matchesLengthInt, replaceFn);
   }
 
-  transitioning macro RegExpReplaceFastString(implicit context: Context)(
-      regexp: JSRegExp, string: String, replaceString: String): String {
-    // The fast path is reached only if {receiver} is an unmodified JSRegExp
-    // instance, {replace_value} is non-callable, and ToString({replace_value})
-    // does not contain '$', i.e. we're doing a simple string replacement.
-    let result: String = kEmptyString;
-    let lastMatchEnd: Smi = 0;
-    let unicode: bool = false;
-    const replaceLength: Smi = replaceString.length_smi;
-    const fastRegexp = UnsafeCast<FastJSRegExp>(regexp);
-    const global: bool = fastRegexp.global;
-
-    if (global) {
-      unicode = fastRegexp.unicode;
-      fastRegexp.lastIndex = 0;
-    }
-
-    while (true) {
-      const match: RegExpMatchInfo =
-          RegExpPrototypeExecBodyWithoutResultFast(regexp, string)
-          otherwise break;
-      const matchStart: Smi = match.GetStartOfCapture(0);
-      const matchEnd: Smi = match.GetEndOfCapture(0);
-
-      // TODO(jgruber): We could skip many of the checks that using SubString
-      // here entails.
-      result = result + SubString(string, lastMatchEnd, matchStart);
-      lastMatchEnd = matchEnd;
-
-      if (replaceLength != 0) result = result + replaceString;
-
-      // Non-global case ends here after the first replacement.
-      if (!global) break;
-
-      // If match is the empty string, we have to increment lastIndex.
-      if (matchEnd == matchStart) {
-        typeswitch (regexp) {
-          case (fastRegexp: FastJSRegExp): {
-            fastRegexp.lastIndex =
-                AdvanceStringIndexFast(string, fastRegexp.lastIndex, unicode);
-          }
-          case (Object): {
-            const lastIndex: JSAny = SlowLoadLastIndex(regexp);
-            const thisIndex: Number = ToLength_Inline(lastIndex);
-            const nextIndex: Number =
-                AdvanceStringIndexSlow(string, thisIndex, unicode);
-            SlowStoreLastIndex(regexp, nextIndex);
-          }
-        }
-      }
-    }
+  return StringBuilderConcat(matches, matchesLength, string);
+}
 
-    return result + SubString(string, lastMatchEnd, string.length_smi);
+transitioning macro RegExpReplaceFastString(implicit context: Context)(
+    regexp: JSRegExp, string: String, replaceString: String): String {
+  // The fast path is reached only if {receiver} is an unmodified JSRegExp
+  // instance, {replace_value} is non-callable, and ToString({replace_value})
+  // does not contain '$', i.e. we're doing a simple string replacement.
+  let result: String = kEmptyString;
+  let lastMatchEnd: Smi = 0;
+  let unicode: bool = false;
+  const replaceLength: Smi = replaceString.length_smi;
+  const fastRegexp = UnsafeCast<FastJSRegExp>(regexp);
+  const global: bool = fastRegexp.global;
+
+  if (global) {
+    unicode = fastRegexp.unicode;
+    fastRegexp.lastIndex = 0;
   }
 
-  transitioning builtin RegExpReplace(implicit context: Context)(
-      regexp: FastJSRegExp, string: String, replaceValue: JSAny): String {
-    // TODO(pwong): Remove assert when all callers (StringPrototypeReplace) are
-    // from Torque.
-    assert(Is<FastJSRegExp>(regexp));
-
-    // 2. Is {replace_value} callable?
-    typeswitch (replaceValue) {
-      case (replaceFn: Callable): {
-        return regexp.global ?
-            RegExpReplaceFastGlobalCallable(regexp, string, replaceFn) :
-            StringReplaceNonGlobalRegExpWithFunction(string, regexp, replaceFn);
-      }
-      case (JSAny): {
-        const stableRegexp: JSRegExp = regexp;
-        const replaceString: String = ToString_Inline(replaceValue);
-
-        try {
-          // ToString(replaceValue) could potentially change the shape of the
-          // RegExp object. Recheck that we are still on the fast path and bail
-          // to runtime otherwise.
-          const fastRegexp = Cast<FastJSRegExp>(stableRegexp) otherwise Runtime;
-          if (StringIndexOf(
-                  replaceString, SingleCharacterStringConstant('$'), 0) != -1) {
-            goto Runtime;
-          }
-
-          return RegExpReplaceFastString(fastRegexp, string, replaceString);
+  while (true) {
+    const match: RegExpMatchInfo =
+        RegExpPrototypeExecBodyWithoutResultFast(regexp, string)
+        otherwise break;
+    const matchStart: Smi = match.GetStartOfCapture(0);
+    const matchEnd: Smi = match.GetEndOfCapture(0);
+
+    // TODO(jgruber): We could skip many of the checks that using SubString
+    // here entails.
+    result = result + SubString(string, lastMatchEnd, matchStart);
+    lastMatchEnd = matchEnd;
+
+    if (replaceLength != 0) result = result + replaceString;
+
+    // Non-global case ends here after the first replacement.
+    if (!global) break;
+
+    // If match is the empty string, we have to increment lastIndex.
+    if (matchEnd == matchStart) {
+      typeswitch (regexp) {
+        case (fastRegexp: FastJSRegExp): {
+          fastRegexp.lastIndex =
+              AdvanceStringIndexFast(string, fastRegexp.lastIndex, unicode);
         }
-        label Runtime deferred {
-          return RegExpReplaceRT(context, stableRegexp, string, replaceString);
+        case (Object): {
+          const lastIndex: JSAny = SlowLoadLastIndex(regexp);
+          const thisIndex: Number = ToLength_Inline(lastIndex);
+          const nextIndex: Number =
+              AdvanceStringIndexSlow(string, thisIndex, unicode);
+          SlowStoreLastIndex(regexp, nextIndex);
         }
       }
     }
   }
 
-  const kRegExpReplaceCalledOnSlowRegExp: constexpr int31
-  generates 'v8::Isolate::kRegExpReplaceCalledOnSlowRegExp';
-
-  transitioning javascript builtin RegExpPrototypeReplace(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    const methodName: constexpr string = 'RegExp.prototype.@@replace';
-
-    // RegExpPrototypeReplace is a bit of a beast - a summary of dispatch logic:
-    //
-    // if (!IsFastRegExp(receiver)) CallRuntime(RegExpReplace)
-    // if (IsCallable(replace)) {
-    //   if (IsGlobal(receiver)) {
-    //     // Called 'fast-path' but contains several runtime calls.
-    //     RegExpReplaceFastGlobalCallable()
-    //   } else {
-    //     CallRuntime(StringReplaceNonGlobalRegExpWithFunction)
-    //   }
-    // } else {
-    //   if (replace.contains("$")) {
-    //     CallRuntime(RegExpReplace)
-    //   } else {
-    //     RegExpReplaceFastString()
-    //   }
-    // }
-
-    const string: JSAny = arguments[0];
-    const replaceValue: JSAny = arguments[1];
-
-    // Let rx be the this value.
-    // If Type(rx) is not Object, throw a TypeError exception.
-    const rx = Cast<JSReceiver>(receiver)
-        otherwise ThrowTypeError(
-        MessageTemplate::kIncompatibleMethodReceiver, methodName);
-
-    // Let S be ? ToString(string).
-    const s = ToString_Inline(string);
-
-    // Fast-path checks: 1. Is the {receiver} an unmodified JSRegExp instance?
-    try {
-      const fastRx: FastJSRegExp = Cast<FastJSRegExp>(rx) otherwise Runtime;
-      return RegExpReplace(fastRx, s, replaceValue);
+  return result + SubString(string, lastMatchEnd, string.length_smi);
+}
+
+transitioning builtin RegExpReplace(implicit context: Context)(
+    regexp: FastJSRegExp, string: String, replaceValue: JSAny): String {
+  // TODO(pwong): Remove assert when all callers (StringPrototypeReplace) are
+  // from Torque.
+  assert(Is<FastJSRegExp>(regexp));
+
+  // 2. Is {replace_value} callable?
+  typeswitch (replaceValue) {
+    case (replaceFn: Callable): {
+      return regexp.global ?
+          RegExpReplaceFastGlobalCallable(regexp, string, replaceFn) :
+          StringReplaceNonGlobalRegExpWithFunction(string, regexp, replaceFn);
     }
-    label Runtime deferred {
-      IncrementUseCounter(
-          context, SmiConstant(kRegExpReplaceCalledOnSlowRegExp));
-      return RegExpReplaceRT(context, rx, s, replaceValue);
+    case (JSAny): {
+      const stableRegexp: JSRegExp = regexp;
+      const replaceString: String = ToString_Inline(replaceValue);
+
+      try {
+        // ToString(replaceValue) could potentially change the shape of the
+        // RegExp object. Recheck that we are still on the fast path and bail
+        // to runtime otherwise.
+        const fastRegexp = Cast<FastJSRegExp>(stableRegexp) otherwise Runtime;
+        if (StringIndexOf(
+                replaceString, SingleCharacterStringConstant('$'), 0) != -1) {
+          goto Runtime;
+        }
+
+        return RegExpReplaceFastString(fastRegexp, string, replaceString);
+      } label Runtime deferred {
+        return RegExpReplaceRT(context, stableRegexp, string, replaceString);
+      }
     }
   }
+}
 
+const kRegExpReplaceCalledOnSlowRegExp: constexpr int31
+    generates 'v8::Isolate::kRegExpReplaceCalledOnSlowRegExp';
+
+transitioning javascript builtin RegExpPrototypeReplace(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  const methodName: constexpr string = 'RegExp.prototype.@@replace';
+
+  // RegExpPrototypeReplace is a bit of a beast - a summary of dispatch logic:
+  //
+  // if (!IsFastRegExp(receiver)) CallRuntime(RegExpReplace)
+  // if (IsCallable(replace)) {
+  //   if (IsGlobal(receiver)) {
+  //     // Called 'fast-path' but contains several runtime calls.
+  //     RegExpReplaceFastGlobalCallable()
+  //   } else {
+  //     CallRuntime(StringReplaceNonGlobalRegExpWithFunction)
+  //   }
+  // } else {
+  //   if (replace.contains("$")) {
+  //     CallRuntime(RegExpReplace)
+  //   } else {
+  //     RegExpReplaceFastString()
+  //   }
+  // }
+
+  const string: JSAny = arguments[0];
+  const replaceValue: JSAny = arguments[1];
+
+  // Let rx be the this value.
+  // If Type(rx) is not Object, throw a TypeError exception.
+  const rx = Cast<JSReceiver>(receiver)
+      otherwise ThrowTypeError(
+      MessageTemplate::kIncompatibleMethodReceiver, methodName);
+
+  // Let S be ? ToString(string).
+  const s = ToString_Inline(string);
+
+  // Fast-path checks: 1. Is the {receiver} an unmodified JSRegExp instance?
+  try {
+    const fastRx: FastJSRegExp = Cast<FastJSRegExp>(rx) otherwise Runtime;
+    return RegExpReplace(fastRx, s, replaceValue);
+  } label Runtime deferred {
+    IncrementUseCounter(context, SmiConstant(kRegExpReplaceCalledOnSlowRegExp));
+    return RegExpReplaceRT(context, rx, s, replaceValue);
+  }
+}
 }
diff --git a/deps/v8/src/builtins/regexp-search.tq b/deps/v8/src/builtins/regexp-search.tq
index 14fb9f9b03c..b70d23a0dd5 100644
--- a/deps/v8/src/builtins/regexp-search.tq
+++ b/deps/v8/src/builtins/regexp-search.tq
@@ -6,103 +6,101 @@
 
 namespace regexp {
 
-  transitioning macro
-  RegExpPrototypeSearchBodyFast(implicit context: Context)(
-      regexp: JSRegExp, string: String): JSAny {
-    assert(IsFastRegExpPermissive(regexp));
-
-    // Grab the initial value of last index.
-    const previousLastIndex: Smi = FastLoadLastIndex(regexp);
-
-    // Ensure last index is 0.
-    FastStoreLastIndex(regexp, 0);
-
-    // Call exec.
-    try {
-      const matchIndices: RegExpMatchInfo =
-          RegExpPrototypeExecBodyWithoutResultFast(
-              UnsafeCast<JSRegExp>(regexp), string)
-          otherwise DidNotMatch;
-
-      // Successful match.
-      // Reset last index.
-      FastStoreLastIndex(regexp, previousLastIndex);
-
-      // Return the index of the match.
-      return UnsafeCast<Smi>(
-          matchIndices.objects[kRegExpMatchInfoFirstCaptureIndex]);
-    }
-    label DidNotMatch {
-      // Reset last index and return -1.
-      FastStoreLastIndex(regexp, previousLastIndex);
-      return SmiConstant(-1);
-    }
-  }
+transitioning macro
+RegExpPrototypeSearchBodyFast(implicit context: Context)(
+    regexp: JSRegExp, string: String): JSAny {
+  assert(IsFastRegExpPermissive(regexp));
+
+  // Grab the initial value of last index.
+  const previousLastIndex: Smi = FastLoadLastIndex(regexp);
+
+  // Ensure last index is 0.
+  FastStoreLastIndex(regexp, 0);
+
+  // Call exec.
+  try {
+    const matchIndices: RegExpMatchInfo =
+        RegExpPrototypeExecBodyWithoutResultFast(
+            UnsafeCast<JSRegExp>(regexp), string)
+        otherwise DidNotMatch;
 
-  extern macro RegExpBuiltinsAssembler::BranchIfRegExpResult(
-      implicit context: Context)(Object): never labels IsUnmodified,
-      IsModified;
+    // Successful match.
+    // Reset last index.
+    FastStoreLastIndex(regexp, previousLastIndex);
 
-  macro
-  IsRegExpResult(implicit context: Context)(execResult: HeapObject): bool {
-    BranchIfRegExpResult(execResult) otherwise return true, return false;
+    // Return the index of the match.
+    return UnsafeCast<Smi>(
+        matchIndices.objects[kRegExpMatchInfoFirstCaptureIndex]);
+  } label DidNotMatch {
+    // Reset last index and return -1.
+    FastStoreLastIndex(regexp, previousLastIndex);
+    return SmiConstant(-1);
   }
+}
 
-  transitioning macro RegExpPrototypeSearchBodySlow(implicit context: Context)(
-      regexp: JSReceiver, string: String): JSAny {
-    // Grab the initial value of last index.
-    const previousLastIndex = SlowLoadLastIndex(regexp);
-    const smiZero: Smi = 0;
+extern macro RegExpBuiltinsAssembler::BranchIfRegExpResult(
+    implicit context: Context)(Object): never labels IsUnmodified,
+    IsModified;
 
-    // Ensure last index is 0.
-    if (!SameValue(previousLastIndex, smiZero)) {
-      SlowStoreLastIndex(regexp, smiZero);
-    }
+macro
+IsRegExpResult(implicit context: Context)(execResult: HeapObject): bool {
+  BranchIfRegExpResult(execResult) otherwise return true, return false;
+}
 
-    // Call exec.
-    const execResult = RegExpExec(regexp, string);
+transitioning macro RegExpPrototypeSearchBodySlow(implicit context: Context)(
+    regexp: JSReceiver, string: String): JSAny {
+  // Grab the initial value of last index.
+  const previousLastIndex = SlowLoadLastIndex(regexp);
+  const smiZero: Smi = 0;
 
-    // Reset last index if necessary.
-    const currentLastIndex = SlowLoadLastIndex(regexp);
-    if (!SameValue(currentLastIndex, previousLastIndex)) {
-      SlowStoreLastIndex(regexp, previousLastIndex);
-    }
+  // Ensure last index is 0.
+  if (!SameValue(previousLastIndex, smiZero)) {
+    SlowStoreLastIndex(regexp, smiZero);
+  }
 
-    // Return -1 if no match was found.
-    if (execResult == Null) {
-      return SmiConstant(-1);
-    }
+  // Call exec.
+  const execResult = RegExpExec(regexp, string);
 
-    // Return the index of the match.
-    const fastExecResult = Cast<JSRegExpResult>(execResult)
-        otherwise return GetProperty(execResult, 'index');
-    return fastExecResult.index;
+  // Reset last index if necessary.
+  const currentLastIndex = SlowLoadLastIndex(regexp);
+  if (!SameValue(currentLastIndex, previousLastIndex)) {
+    SlowStoreLastIndex(regexp, previousLastIndex);
   }
 
-  // Helper that skips a few initial checks. and assumes...
-  // 1) receiver is a "fast permissive" RegExp
-  // 2) pattern is a string
-  transitioning builtin RegExpSearchFast(implicit context: Context)(
-      receiver: JSRegExp, string: String): JSAny {
-    return RegExpPrototypeSearchBodyFast(receiver, string);
+  // Return -1 if no match was found.
+  if (execResult == Null) {
+    return SmiConstant(-1);
   }
 
-  // ES#sec-regexp.prototype-@@search
-  // RegExp.prototype [ @@search ] ( string )
-  transitioning javascript builtin RegExpPrototypeSearch(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(string: JSAny): JSAny {
-    ThrowIfNotJSReceiver(
-        receiver, MessageTemplate::kIncompatibleMethodReceiver,
-        'RegExp.prototype.@@search');
-    const receiver = UnsafeCast<JSReceiver>(receiver);
-    const string: String = ToString_Inline(string);
-
-    if (IsFastRegExpPermissive(receiver)) {
-      // TODO(pwong): Could be optimized to remove the overhead of calling the
-      //              builtin (at the cost of a larger builtin).
-      return RegExpSearchFast(UnsafeCast<JSRegExp>(receiver), string);
-    }
-    return RegExpPrototypeSearchBodySlow(receiver, string);
+  // Return the index of the match.
+  const fastExecResult = Cast<JSRegExpResult>(execResult)
+      otherwise return GetProperty(execResult, 'index');
+  return fastExecResult.index;
+}
+
+// Helper that skips a few initial checks. and assumes...
+// 1) receiver is a "fast permissive" RegExp
+// 2) pattern is a string
+transitioning builtin RegExpSearchFast(implicit context: Context)(
+    receiver: JSRegExp, string: String): JSAny {
+  return RegExpPrototypeSearchBodyFast(receiver, string);
+}
+
+// ES#sec-regexp.prototype-@@search
+// RegExp.prototype [ @@search ] ( string )
+transitioning javascript builtin RegExpPrototypeSearch(
+    js-implicit context: NativeContext, receiver: JSAny)(string: JSAny): JSAny {
+  ThrowIfNotJSReceiver(
+      receiver, MessageTemplate::kIncompatibleMethodReceiver,
+      'RegExp.prototype.@@search');
+  const receiver = UnsafeCast<JSReceiver>(receiver);
+  const string: String = ToString_Inline(string);
+
+  if (IsFastRegExpPermissive(receiver)) {
+    // TODO(pwong): Could be optimized to remove the overhead of calling the
+    //              builtin (at the cost of a larger builtin).
+    return RegExpSearchFast(UnsafeCast<JSRegExp>(receiver), string);
   }
+  return RegExpPrototypeSearchBodySlow(receiver, string);
+}
 }
diff --git a/deps/v8/src/builtins/regexp-source.tq b/deps/v8/src/builtins/regexp-source.tq
index 009e5181dc2..5f9c6b22c3a 100644
--- a/deps/v8/src/builtins/regexp-source.tq
+++ b/deps/v8/src/builtins/regexp-source.tq
@@ -6,22 +6,22 @@
 
 namespace regexp {
 
-  // ES6 21.2.5.10.
-  // ES #sec-get-regexp.prototype.source
-  transitioning javascript builtin RegExpPrototypeSourceGetter(
-      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
-    typeswitch (receiver) {
-      case (receiver: JSRegExp): {
-        return receiver.source;
-      }
-      case (Object): {
-      }
+// ES6 21.2.5.10.
+// ES #sec-get-regexp.prototype.source
+transitioning javascript builtin RegExpPrototypeSourceGetter(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+  typeswitch (receiver) {
+    case (receiver: JSRegExp): {
+      return receiver.source;
     }
-    if (!IsReceiverInitialRegExpPrototype(receiver)) {
-      const methodName: constexpr string = 'RegExp.prototype.source';
-      ThrowTypeError(MessageTemplate::kRegExpNonRegExp, methodName);
+    case (Object): {
     }
-    IncrementUseCounter(context, SmiConstant(kRegExpPrototypeSourceGetter));
-    return '(?:)';
   }
+  if (!IsReceiverInitialRegExpPrototype(receiver)) {
+    const methodName: constexpr string = 'RegExp.prototype.source';
+    ThrowTypeError(MessageTemplate::kRegExpNonRegExp, methodName);
+  }
+  IncrementUseCounter(context, SmiConstant(kRegExpPrototypeSourceGetter));
+  return '(?:)';
+}
 }
diff --git a/deps/v8/src/builtins/regexp-split.tq b/deps/v8/src/builtins/regexp-split.tq
index e4092803eea..47ff214130f 100644
--- a/deps/v8/src/builtins/regexp-split.tq
+++ b/deps/v8/src/builtins/regexp-split.tq
@@ -5,70 +5,68 @@
 #include 'src/builtins/builtins-regexp-gen.h'
 
 namespace runtime {
-  extern transitioning runtime
-  RegExpSplit(implicit context: Context)(JSReceiver, String, Object): JSAny;
+extern transitioning runtime
+RegExpSplit(implicit context: Context)(JSReceiver, String, Object): JSAny;
 }  // namespace runtime
 
 namespace regexp {
 
-  const kMaxValueSmi: constexpr int31
-  generates 'Smi::kMaxValue';
+const kMaxValueSmi: constexpr int31
+    generates 'Smi::kMaxValue';
 
-  extern transitioning macro RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
-      implicit context: Context)(JSRegExp, String, Smi): JSArray;
+extern transitioning macro RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
+    implicit context: Context)(JSRegExp, String, Smi): JSArray;
 
-  // Helper that skips a few initial checks.
-  transitioning builtin
-  RegExpSplit(implicit context: Context)(
-      regexp: FastJSRegExp, string: String, limit: JSAny): JSAny {
-    let sanitizedLimit: Smi;
+// Helper that skips a few initial checks.
+transitioning builtin
+RegExpSplit(implicit context: Context)(
+    regexp: FastJSRegExp, string: String, limit: JSAny): JSAny {
+  let sanitizedLimit: Smi;
 
-    // We need to be extra-strict and require the given limit to be either
-    // undefined or a positive smi. We can't call ToUint32(maybe_limit) since
-    // that might move us onto the slow path, resulting in ordering spec
-    // violations (see https://crbug.com/801171).
+  // We need to be extra-strict and require the given limit to be either
+  // undefined or a positive smi. We can't call ToUint32(maybe_limit) since
+  // that might move us onto the slow path, resulting in ordering spec
+  // violations (see https://crbug.com/801171).
 
-    if (limit == Undefined) {
-      // TODO(jgruber): In this case, we can probably avoid generation of limit
-      // checks in Generate_RegExpPrototypeSplitBody.
-      sanitizedLimit = SmiConstant(kMaxValueSmi);
-    } else if (!TaggedIsPositiveSmi(limit)) {
-      return runtime::RegExpSplit(regexp, string, limit);
-    } else {
-      sanitizedLimit = UnsafeCast<Smi>(limit);
-    }
-
-    // Due to specific shortcuts we take on the fast path (specifically, we
-    // don't allocate a new regexp instance as specced), we need to ensure that
-    // the given regexp is non-sticky to avoid invalid results. See
-    // crbug.com/v8/6706.
+  if (limit == Undefined) {
+    // TODO(jgruber): In this case, we can probably avoid generation of limit
+    // checks in Generate_RegExpPrototypeSplitBody.
+    sanitizedLimit = SmiConstant(kMaxValueSmi);
+  } else if (!TaggedIsPositiveSmi(limit)) {
+    return runtime::RegExpSplit(regexp, string, limit);
+  } else {
+    sanitizedLimit = UnsafeCast<Smi>(limit);
+  }
 
-    if (FastFlagGetter(regexp, Flag::kSticky)) {
-      return runtime::RegExpSplit(regexp, string, sanitizedLimit);
-    }
+  // Due to specific shortcuts we take on the fast path (specifically, we
+  // don't allocate a new regexp instance as specced), we need to ensure that
+  // the given regexp is non-sticky to avoid invalid results. See
+  // crbug.com/v8/6706.
 
-    // We're good to go on the fast path, which is inlined here.
-    return RegExpPrototypeSplitBody(regexp, string, sanitizedLimit);
+  if (FastFlagGetter(regexp, Flag::kSticky)) {
+    return runtime::RegExpSplit(regexp, string, sanitizedLimit);
   }
 
-  // ES#sec-regexp.prototype-@@split
-  // RegExp.prototype [ @@split ] ( string, limit )
-  transitioning javascript builtin RegExpPrototypeSplit(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    ThrowIfNotJSReceiver(
-        receiver, MessageTemplate::kIncompatibleMethodReceiver,
-        'RegExp.prototype.@@split');
-    const receiver = UnsafeCast<JSReceiver>(receiver);
-    const string: String = ToString_Inline(arguments[0]);
-    const limit = arguments[1];
+  // We're good to go on the fast path, which is inlined here.
+  return RegExpPrototypeSplitBody(regexp, string, sanitizedLimit);
+}
 
-    // Strict: Reads the flags property.
-    // TODO(jgruber): Handle slow flag accesses on the fast path and make this
-    // permissive.
-    const fastRegExp = Cast<FastJSRegExp>(receiver)
-        otherwise return runtime::RegExpSplit(receiver, string, limit);
-    return RegExpSplit(fastRegExp, string, limit);
-  }
+// ES#sec-regexp.prototype-@@split
+// RegExp.prototype [ @@split ] ( string, limit )
+transitioning javascript builtin RegExpPrototypeSplit(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  ThrowIfNotJSReceiver(
+      receiver, MessageTemplate::kIncompatibleMethodReceiver,
+      'RegExp.prototype.@@split');
+  const receiver = UnsafeCast<JSReceiver>(receiver);
+  const string: String = ToString_Inline(arguments[0]);
+  const limit = arguments[1];
 
+  // Strict: Reads the flags property.
+  // TODO(jgruber): Handle slow flag accesses on the fast path and make this
+  // permissive.
+  const fastRegExp = Cast<FastJSRegExp>(receiver)
+      otherwise return runtime::RegExpSplit(receiver, string, limit);
+  return RegExpSplit(fastRegExp, string, limit);
+}
 }
diff --git a/deps/v8/src/builtins/regexp-test.tq b/deps/v8/src/builtins/regexp-test.tq
index cd418239757..c83afd602de 100644
--- a/deps/v8/src/builtins/regexp-test.tq
+++ b/deps/v8/src/builtins/regexp-test.tq
@@ -6,30 +6,29 @@
 
 namespace regexp {
 
-  // ES#sec-regexp.prototype.test
-  // RegExp.prototype.test ( S )
-  transitioning javascript builtin RegExpPrototypeTest(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(string: JSAny): JSAny {
-    const methodName: constexpr string = 'RegExp.prototype.test';
-    const receiver = Cast<JSReceiver>(receiver)
-        otherwise ThrowTypeError(
-        MessageTemplate::kIncompatibleMethodReceiver, methodName);
-    const str: String = ToString_Inline(string);
-    if (IsFastRegExpPermissive(receiver)) {
-      RegExpPrototypeExecBodyWithoutResultFast(
-          UnsafeCast<JSRegExp>(receiver), str)
-          otherwise return False;
-      return True;
-    }
-    const matchIndices = RegExpExec(receiver, str);
-    return SelectBooleanConstant(matchIndices != Null);
-  }
-
-  transitioning builtin RegExpPrototypeTestFast(implicit context: Context)(
-      receiver: JSRegExp, string: String): Object {
-    RegExpPrototypeExecBodyWithoutResultFast(receiver, string)
+// ES#sec-regexp.prototype.test
+// RegExp.prototype.test ( S )
+transitioning javascript builtin RegExpPrototypeTest(
+    js-implicit context: NativeContext, receiver: JSAny)(string: JSAny): JSAny {
+  const methodName: constexpr string = 'RegExp.prototype.test';
+  const receiver = Cast<JSReceiver>(receiver)
+      otherwise ThrowTypeError(
+      MessageTemplate::kIncompatibleMethodReceiver, methodName);
+  const str: String = ToString_Inline(string);
+  if (IsFastRegExpPermissive(receiver)) {
+    RegExpPrototypeExecBodyWithoutResultFast(
+        UnsafeCast<JSRegExp>(receiver), str)
         otherwise return False;
     return True;
   }
+  const matchIndices = RegExpExec(receiver, str);
+  return SelectBooleanConstant(matchIndices != Null);
+}
+
+transitioning builtin RegExpPrototypeTestFast(implicit context: Context)(
+    receiver: JSRegExp, string: String): Object {
+  RegExpPrototypeExecBodyWithoutResultFast(receiver, string)
+      otherwise return False;
+  return True;
+}
 }
diff --git a/deps/v8/src/builtins/regexp.tq b/deps/v8/src/builtins/regexp.tq
index a48dce3863b..21577b47634 100644
--- a/deps/v8/src/builtins/regexp.tq
+++ b/deps/v8/src/builtins/regexp.tq
@@ -6,417 +6,415 @@
 
 namespace regexp {
 
-  extern macro RegExpBuiltinsAssembler::BranchIfFastRegExp_Strict(
-      implicit context: Context)(HeapObject): never labels IsFast,
-      IsSlow;
-  macro IsFastRegExpStrict(implicit context: Context)(o: HeapObject): bool {
-    BranchIfFastRegExp_Strict(o) otherwise return true, return false;
-  }
+extern macro RegExpBuiltinsAssembler::BranchIfFastRegExp_Strict(
+    implicit context: Context)(HeapObject): never labels IsFast,
+    IsSlow;
+macro IsFastRegExpStrict(implicit context: Context)(o: HeapObject): bool {
+  BranchIfFastRegExp_Strict(o) otherwise return true, return false;
+}
 
-  extern macro RegExpBuiltinsAssembler::BranchIfFastRegExp_Permissive(
-      implicit context: Context)(HeapObject): never labels IsFast,
-      IsSlow;
+extern macro RegExpBuiltinsAssembler::BranchIfFastRegExp_Permissive(
+    implicit context: Context)(HeapObject): never labels IsFast,
+    IsSlow;
 
-  @export
-  macro IsFastRegExpPermissive(implicit context: Context)(o: HeapObject): bool {
-    BranchIfFastRegExp_Permissive(o) otherwise return true, return false;
-  }
+@export
+macro IsFastRegExpPermissive(implicit context: Context)(o: HeapObject): bool {
+  BranchIfFastRegExp_Permissive(o) otherwise return true, return false;
+}
 
-  // ES#sec-regexpexec Runtime Semantics: RegExpExec ( R, S )
-  @export
-  transitioning macro RegExpExec(implicit context: Context)(
-      receiver: JSReceiver, string: String): JSAny {
-    // Take the slow path of fetching the exec property, calling it, and
-    // verifying its return value.
-
-    const exec = GetProperty(receiver, 'exec');
-
-    // Is {exec} callable?
-    typeswitch (exec) {
-      case (execCallable: Callable): {
-        const result = Call(context, execCallable, receiver, string);
-        if (result != Null) {
-          ThrowIfNotJSReceiver(
-              result, MessageTemplate::kInvalidRegExpExecResult, '');
-        }
-        return result;
-      }
-      case (Object): {
-        const regexp = Cast<JSRegExp>(receiver) otherwise ThrowTypeError(
-            MessageTemplate::kIncompatibleMethodReceiver,
-            'RegExp.prototype.exec', receiver);
-        return RegExpPrototypeExecSlow(regexp, string);
+// ES#sec-regexpexec Runtime Semantics: RegExpExec ( R, S )
+@export
+transitioning macro RegExpExec(implicit context: Context)(
+    receiver: JSReceiver, string: String): JSAny {
+  // Take the slow path of fetching the exec property, calling it, and
+  // verifying its return value.
+
+  const exec = GetProperty(receiver, 'exec');
+
+  // Is {exec} callable?
+  typeswitch (exec) {
+    case (execCallable: Callable): {
+      const result = Call(context, execCallable, receiver, string);
+      if (result != Null) {
+        ThrowIfNotJSReceiver(
+            result, MessageTemplate::kInvalidRegExpExecResult, '');
       }
+      return result;
     }
-  }
-
-  extern macro RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
-      implicit context: Context)(JSRegExp, RegExpMatchInfo, String, Number):
-      JSRegExpResult;
-
-  const kGlobalOrSticky: constexpr int31
-  generates 'JSRegExp::kGlobal | JSRegExp::kSticky';
-
-  extern macro RegExpBuiltinsAssembler::RegExpExecInternal(
-      implicit context: Context)(JSRegExp, String, Number, RegExpMatchInfo):
-      HeapObject;
-
-  // ES#sec-regexp.prototype.exec
-  // RegExp.prototype.exec ( string )
-  // Implements the core of RegExp.prototype.exec but without actually
-  // constructing the JSRegExpResult. Returns a fixed array containing match
-  // indices as returned by RegExpExecStub on successful match, and jumps to
-  // IfDidNotMatch otherwise.
-  transitioning macro RegExpPrototypeExecBodyWithoutResult(implicit context:
-                                                               Context)(
-      regexp: JSRegExp, string: String, regexpLastIndex: Number,
-      isFastPath: constexpr bool): RegExpMatchInfo labels IfDidNotMatch {
-    if (isFastPath) {
-      assert(HasInitialRegExpMap(regexp));
-    } else {
-      IncrementUseCounter(context, SmiConstant(kRegExpExecCalledOnSlowRegExp));
+    case (Object): {
+      const regexp = Cast<JSRegExp>(receiver) otherwise ThrowTypeError(
+          MessageTemplate::kIncompatibleMethodReceiver, 'RegExp.prototype.exec',
+          receiver);
+      return RegExpPrototypeExecSlow(regexp, string);
     }
+  }
+}
 
-    let lastIndex = regexpLastIndex;
+extern macro RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
+    implicit context: Context)(
+    JSRegExp, RegExpMatchInfo, String, Number): JSRegExpResult;
+
+const kGlobalOrSticky: constexpr int31
+    generates 'JSRegExp::kGlobal | JSRegExp::kSticky';
+
+extern macro RegExpBuiltinsAssembler::RegExpExecInternal(
+    implicit context: Context)(
+    JSRegExp, String, Number, RegExpMatchInfo): HeapObject;
+
+// ES#sec-regexp.prototype.exec
+// RegExp.prototype.exec ( string )
+// Implements the core of RegExp.prototype.exec but without actually
+// constructing the JSRegExpResult. Returns a fixed array containing match
+// indices as returned by RegExpExecStub on successful match, and jumps to
+// IfDidNotMatch otherwise.
+transitioning macro RegExpPrototypeExecBodyWithoutResult(
+    implicit context: Context)(
+    regexp: JSRegExp, string: String, regexpLastIndex: Number,
+    isFastPath: constexpr bool): RegExpMatchInfo labels IfDidNotMatch {
+  if (isFastPath) {
+    assert(HasInitialRegExpMap(regexp));
+  } else {
+    IncrementUseCounter(context, SmiConstant(kRegExpExecCalledOnSlowRegExp));
+  }
 
-    // Check whether the regexp is global or sticky, which determines whether we
-    // update last index later on.
-    const flags = UnsafeCast<Smi>(regexp.flags);
-    const isGlobalOrSticky: intptr =
-        SmiUntag(flags) & IntPtrConstant(kGlobalOrSticky);
-    const shouldUpdateLastIndex: bool = isGlobalOrSticky != 0;
+  let lastIndex = regexpLastIndex;
 
-    // Grab and possibly update last index.
-    if (shouldUpdateLastIndex) {
-      if (!TaggedIsSmi(lastIndex) || (lastIndex > string.length_smi)) {
-        StoreLastIndex(regexp, SmiConstant(0), isFastPath);
-        goto IfDidNotMatch;
-      }
-    } else {
-      lastIndex = SmiConstant(0);
-    }
+  // Check whether the regexp is global or sticky, which determines whether we
+  // update last index later on.
+  const flags = UnsafeCast<Smi>(regexp.flags);
+  const isGlobalOrSticky: intptr =
+      SmiUntag(flags) & IntPtrConstant(kGlobalOrSticky);
+  const shouldUpdateLastIndex: bool = isGlobalOrSticky != 0;
 
-    const lastMatchInfo: RegExpMatchInfo = GetRegExpLastMatchInfo();
-
-    const matchIndices =
-        RegExpExecInternal(regexp, string, lastIndex, lastMatchInfo);
-
-    // {match_indices} is either null or the RegExpMatchInfo array.
-    // Return early if exec failed, possibly updating last index.
-    if (matchIndices != Null) {
-      const matchIndicesRegExpMatchInfo =
-          UnsafeCast<RegExpMatchInfo>(matchIndices);
-      if (shouldUpdateLastIndex) {
-        // Update the new last index from {match_indices}.
-        const newLastIndex: Smi =
-            matchIndicesRegExpMatchInfo.GetEndOfCapture(0);
-        StoreLastIndex(regexp, newLastIndex, isFastPath);
-      }
-      return matchIndicesRegExpMatchInfo;
-    }
-    if (shouldUpdateLastIndex) {
+  // Grab and possibly update last index.
+  if (shouldUpdateLastIndex) {
+    if (!TaggedIsSmi(lastIndex) || (lastIndex > string.length_smi)) {
       StoreLastIndex(regexp, SmiConstant(0), isFastPath);
+      goto IfDidNotMatch;
     }
-    goto IfDidNotMatch;
+  } else {
+    lastIndex = SmiConstant(0);
   }
 
-  @export
-  transitioning macro RegExpPrototypeExecBodyWithoutResultFast(
-      implicit context: Context)(regexp: JSRegExp, string: String):
-      RegExpMatchInfo labels IfDidNotMatch {
-    const lastIndex = LoadLastIndexAsLength(regexp, true);
-    return RegExpPrototypeExecBodyWithoutResult(regexp, string, lastIndex, true)
-        otherwise IfDidNotMatch;
-  }
+  const lastMatchInfo: RegExpMatchInfo = GetRegExpLastMatchInfo();
 
-  transitioning macro RegExpPrototypeExecBodyWithoutResultFast(
-      implicit context:
-          Context)(regexp: JSRegExp, string: String, lastIndex: Number):
-      RegExpMatchInfo labels IfDidNotMatch {
-    return RegExpPrototypeExecBodyWithoutResult(regexp, string, lastIndex, true)
-        otherwise IfDidNotMatch;
-  }
+  const matchIndices =
+      RegExpExecInternal(regexp, string, lastIndex, lastMatchInfo);
 
-  // ES#sec-regexp.prototype.exec
-  // RegExp.prototype.exec ( string )
-  transitioning macro RegExpPrototypeExecBody(implicit context: Context)(
-      receiver: JSReceiver, string: String, isFastPath: constexpr bool): JSAny {
-    let regexp: JSRegExp;
-    if constexpr (isFastPath) {
-      regexp = UnsafeCast<JSRegExp>(receiver);
-    } else {
-      regexp = Cast<JSRegExp>(receiver) otherwise ThrowTypeError(
-          MessageTemplate::kIncompatibleMethodReceiver, 'RegExp.prototype.exec',
-          receiver);
+  // {match_indices} is either null or the RegExpMatchInfo array.
+  // Return early if exec failed, possibly updating last index.
+  if (matchIndices != Null) {
+    const matchIndicesRegExpMatchInfo =
+        UnsafeCast<RegExpMatchInfo>(matchIndices);
+    if (shouldUpdateLastIndex) {
+      // Update the new last index from {match_indices}.
+      const newLastIndex: Smi = matchIndicesRegExpMatchInfo.GetEndOfCapture(0);
+      StoreLastIndex(regexp, newLastIndex, isFastPath);
     }
-    const lastIndex = LoadLastIndexAsLength(regexp, isFastPath);
-    const matchIndices: RegExpMatchInfo = RegExpPrototypeExecBodyWithoutResult(
-        regexp, string, lastIndex, isFastPath) otherwise return Null;
-    return ConstructNewResultFromMatchInfo(
-        regexp, matchIndices, string, lastIndex);
+    return matchIndicesRegExpMatchInfo;
   }
-
-  macro LoadRegExpFunction(implicit context: Context)(
-      nativeContext: NativeContext): JSFunction {
-    return UnsafeCast<JSFunction>(
-        nativeContext[NativeContextSlot::REGEXP_FUNCTION_INDEX]);
+  if (shouldUpdateLastIndex) {
+    StoreLastIndex(regexp, SmiConstant(0), isFastPath);
   }
+  goto IfDidNotMatch;
+}
 
-  // Note this doesn't guarantee const-ness of object properties, just
-  // unchanged object layout.
-  macro HasInitialRegExpMap(implicit context: Context)(o: HeapObject): bool {
-    const nativeContext = LoadNativeContext(context);
-    const function = LoadRegExpFunction(nativeContext);
-    const initialMap = UnsafeCast<Map>(function.prototype_or_initial_map);
-    return initialMap == o.map;
-  }
+@export
+transitioning macro RegExpPrototypeExecBodyWithoutResultFast(
+    implicit context: Context)(regexp: JSRegExp, string: String):
+    RegExpMatchInfo labels IfDidNotMatch {
+  const lastIndex = LoadLastIndexAsLength(regexp, true);
+  return RegExpPrototypeExecBodyWithoutResult(regexp, string, lastIndex, true)
+      otherwise IfDidNotMatch;
+}
 
-  macro IsReceiverInitialRegExpPrototype(implicit context:
-                                             Context)(receiver: Object): bool {
-    const nativeContext = LoadNativeContext(context);
-    const regexpFun = LoadRegExpFunction(nativeContext);
-    const initialMap = UnsafeCast<Map>(regexpFun.prototype_or_initial_map);
-    const initialPrototype: HeapObject = initialMap.prototype;
-    return TaggedEqual(receiver, initialPrototype);
-  }
+transitioning macro RegExpPrototypeExecBodyWithoutResultFast(
+    implicit context: Context)(
+    regexp: JSRegExp, string: String,
+    lastIndex: Number): RegExpMatchInfo labels IfDidNotMatch {
+  return RegExpPrototypeExecBodyWithoutResult(regexp, string, lastIndex, true)
+      otherwise IfDidNotMatch;
+}
 
-  extern enum Flag constexpr 'JSRegExp::Flag' {
-    kNone,
-    kGlobal,
-    kIgnoreCase,
-    kMultiline,
-    kSticky,
-    kUnicode,
-    kDotAll,
-    kInvalid
+// ES#sec-regexp.prototype.exec
+// RegExp.prototype.exec ( string )
+transitioning macro RegExpPrototypeExecBody(implicit context: Context)(
+    receiver: JSReceiver, string: String, isFastPath: constexpr bool): JSAny {
+  let regexp: JSRegExp;
+  if constexpr (isFastPath) {
+    regexp = UnsafeCast<JSRegExp>(receiver);
+  } else {
+    regexp = Cast<JSRegExp>(receiver) otherwise ThrowTypeError(
+        MessageTemplate::kIncompatibleMethodReceiver, 'RegExp.prototype.exec',
+        receiver);
   }
+  const lastIndex = LoadLastIndexAsLength(regexp, isFastPath);
+  const matchIndices: RegExpMatchInfo = RegExpPrototypeExecBodyWithoutResult(
+      regexp, string, lastIndex, isFastPath) otherwise return Null;
+  return ConstructNewResultFromMatchInfo(
+      regexp, matchIndices, string, lastIndex);
+}
 
-  const kRegExpPrototypeOldFlagGetter: constexpr int31
-  generates 'v8::Isolate::kRegExpPrototypeOldFlagGetter';
-  const kRegExpPrototypeStickyGetter: constexpr int31
-  generates 'v8::Isolate::kRegExpPrototypeStickyGetter';
-  const kRegExpPrototypeUnicodeGetter: constexpr int31
-  generates 'v8::Isolate::kRegExpPrototypeUnicodeGetter';
-
-  extern macro RegExpBuiltinsAssembler::FastFlagGetter(
-      JSRegExp, constexpr Flag): bool;
-  extern runtime IncrementUseCounter(Context, Smi): void;
-
-  macro FlagGetter(implicit context: Context)(
-      receiver: Object, flag: constexpr Flag, counter: constexpr int31,
-      methodName: constexpr string): JSAny {
-    typeswitch (receiver) {
-      case (receiver: JSRegExp): {
-        return SelectBooleanConstant(FastFlagGetter(receiver, flag));
-      }
-      case (Object): {
-      }
-    }
-    if (!IsReceiverInitialRegExpPrototype(receiver)) {
-      ThrowTypeError(MessageTemplate::kRegExpNonRegExp, methodName);
+macro LoadRegExpFunction(implicit context: Context)(
+    nativeContext: NativeContext): JSFunction {
+  return UnsafeCast<JSFunction>(
+      nativeContext[NativeContextSlot::REGEXP_FUNCTION_INDEX]);
+}
+
+// Note this doesn't guarantee const-ness of object properties, just
+// unchanged object layout.
+macro HasInitialRegExpMap(implicit context: Context)(o: HeapObject): bool {
+  const nativeContext = LoadNativeContext(context);
+  const function = LoadRegExpFunction(nativeContext);
+  const initialMap = UnsafeCast<Map>(function.prototype_or_initial_map);
+  return initialMap == o.map;
+}
+
+macro IsReceiverInitialRegExpPrototype(implicit context: Context)(
+    receiver: Object): bool {
+  const nativeContext = LoadNativeContext(context);
+  const regexpFun = LoadRegExpFunction(nativeContext);
+  const initialMap = UnsafeCast<Map>(regexpFun.prototype_or_initial_map);
+  const initialPrototype: HeapObject = initialMap.prototype;
+  return TaggedEqual(receiver, initialPrototype);
+}
+
+extern enum Flag constexpr 'JSRegExp::Flag' {
+  kNone,
+  kGlobal,
+  kIgnoreCase,
+  kMultiline,
+  kSticky,
+  kUnicode,
+  kDotAll,
+  kInvalid
+}
+
+const kRegExpPrototypeOldFlagGetter: constexpr int31
+    generates 'v8::Isolate::kRegExpPrototypeOldFlagGetter';
+const kRegExpPrototypeStickyGetter: constexpr int31
+    generates 'v8::Isolate::kRegExpPrototypeStickyGetter';
+const kRegExpPrototypeUnicodeGetter: constexpr int31
+    generates 'v8::Isolate::kRegExpPrototypeUnicodeGetter';
+
+extern macro RegExpBuiltinsAssembler::FastFlagGetter(
+    JSRegExp, constexpr Flag): bool;
+extern runtime IncrementUseCounter(Context, Smi): void;
+
+macro FlagGetter(implicit context: Context)(
+    receiver: Object, flag: constexpr Flag, counter: constexpr int31,
+    methodName: constexpr string): JSAny {
+  typeswitch (receiver) {
+    case (receiver: JSRegExp): {
+      return SelectBooleanConstant(FastFlagGetter(receiver, flag));
     }
-    if constexpr (counter != -1) {
-      IncrementUseCounter(context, SmiConstant(counter));
+    case (Object): {
     }
-    return Undefined;
   }
-
-  // ES6 21.2.5.4.
-  // ES #sec-get-regexp.prototype.global
-  transitioning javascript builtin RegExpPrototypeGlobalGetter(
-      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
-    return FlagGetter(
-        receiver, Flag::kGlobal, kRegExpPrototypeOldFlagGetter,
-        'RegExp.prototype.global');
+  if (!IsReceiverInitialRegExpPrototype(receiver)) {
+    ThrowTypeError(MessageTemplate::kRegExpNonRegExp, methodName);
   }
-
-  // ES6 21.2.5.5.
-  // ES #sec-get-regexp.prototype.ignorecase
-  transitioning javascript builtin RegExpPrototypeIgnoreCaseGetter(
-      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
-    return FlagGetter(
-        receiver, Flag::kIgnoreCase, kRegExpPrototypeOldFlagGetter,
-        'RegExp.prototype.ignoreCase');
+  if constexpr (counter != -1) {
+    IncrementUseCounter(context, SmiConstant(counter));
   }
+  return Undefined;
+}
 
-  // ES6 21.2.5.7.
-  // ES #sec-get-regexp.prototype.multiline
-  transitioning javascript builtin RegExpPrototypeMultilineGetter(
-      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
-    return FlagGetter(
-        receiver, Flag::kMultiline, kRegExpPrototypeOldFlagGetter,
-        'RegExp.prototype.multiline');
-  }
+// ES6 21.2.5.4.
+// ES #sec-get-regexp.prototype.global
+transitioning javascript builtin RegExpPrototypeGlobalGetter(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+  return FlagGetter(
+      receiver, Flag::kGlobal, kRegExpPrototypeOldFlagGetter,
+      'RegExp.prototype.global');
+}
 
-  // ES #sec-get-regexp.prototype.dotAll
-  transitioning javascript builtin RegExpPrototypeDotAllGetter(
-      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
-    const kNoCounter: constexpr int31 = -1;
-    return FlagGetter(
-        receiver, Flag::kDotAll, kNoCounter, 'RegExp.prototype.dotAll');
-  }
+// ES6 21.2.5.5.
+// ES #sec-get-regexp.prototype.ignorecase
+transitioning javascript builtin RegExpPrototypeIgnoreCaseGetter(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+  return FlagGetter(
+      receiver, Flag::kIgnoreCase, kRegExpPrototypeOldFlagGetter,
+      'RegExp.prototype.ignoreCase');
+}
 
-  // ES6 21.2.5.12.
-  // ES #sec-get-regexp.prototype.sticky
-  transitioning javascript builtin RegExpPrototypeStickyGetter(
-      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
-    return FlagGetter(
-        receiver, Flag::kSticky, kRegExpPrototypeStickyGetter,
-        'RegExp.prototype.sticky');
-  }
+// ES6 21.2.5.7.
+// ES #sec-get-regexp.prototype.multiline
+transitioning javascript builtin RegExpPrototypeMultilineGetter(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+  return FlagGetter(
+      receiver, Flag::kMultiline, kRegExpPrototypeOldFlagGetter,
+      'RegExp.prototype.multiline');
+}
 
-  // ES6 21.2.5.15.
-  // ES #sec-get-regexp.prototype.unicode
-  transitioning javascript builtin RegExpPrototypeUnicodeGetter(
-      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
-    return FlagGetter(
-        receiver, Flag::kUnicode, kRegExpPrototypeUnicodeGetter,
-        'RegExp.prototype.unicode');
-  }
+// ES #sec-get-regexp.prototype.dotAll
+transitioning javascript builtin RegExpPrototypeDotAllGetter(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+  const kNoCounter: constexpr int31 = -1;
+  return FlagGetter(
+      receiver, Flag::kDotAll, kNoCounter, 'RegExp.prototype.dotAll');
+}
 
-  extern transitioning macro
-  RegExpBuiltinsAssembler::FlagsGetter(implicit context: Context)(
-      Object, constexpr bool): String;
+// ES6 21.2.5.12.
+// ES #sec-get-regexp.prototype.sticky
+transitioning javascript builtin RegExpPrototypeStickyGetter(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+  return FlagGetter(
+      receiver, Flag::kSticky, kRegExpPrototypeStickyGetter,
+      'RegExp.prototype.sticky');
+}
 
-  transitioning macro
-  FastFlagsGetter(implicit context: Context)(receiver: FastJSRegExp): String {
-    return FlagsGetter(receiver, true);
-  }
+// ES6 21.2.5.15.
+// ES #sec-get-regexp.prototype.unicode
+transitioning javascript builtin RegExpPrototypeUnicodeGetter(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+  return FlagGetter(
+      receiver, Flag::kUnicode, kRegExpPrototypeUnicodeGetter,
+      'RegExp.prototype.unicode');
+}
 
-  transitioning macro SlowFlagsGetter(implicit context:
-                                          Context)(receiver: JSAny): String {
-    return FlagsGetter(receiver, false);
-  }
+extern transitioning macro
+RegExpBuiltinsAssembler::FlagsGetter(implicit context: Context)(
+    Object, constexpr bool): String;
 
-  // ES #sec-get-regexp.prototype.flags
-  // TFJ(RegExpPrototypeFlagsGetter, 0, kReceiver) \
-  transitioning javascript builtin RegExpPrototypeFlagsGetter(
-      js-implicit context: NativeContext, receiver: JSAny)(): String {
-    ThrowIfNotJSReceiver(
-        receiver, MessageTemplate::kRegExpNonObject, 'RegExp.prototype.flags');
-
-    // The check is strict because the following code relies on individual flag
-    // getters on the regexp prototype (e.g.: global, sticky, ...). We don't
-    // bother to check these individually.
-    const fastRegexp = Cast<FastJSRegExp>(receiver)
-        otherwise return SlowFlagsGetter(receiver);
-    return FastFlagsGetter(fastRegexp);
-  }
+transitioning macro
+FastFlagsGetter(implicit context: Context)(receiver: FastJSRegExp): String {
+  return FlagsGetter(receiver, true);
+}
+
+transitioning macro SlowFlagsGetter(implicit context: Context)(receiver: JSAny):
+    String {
+  return FlagsGetter(receiver, false);
+}
 
-  extern transitioning macro RegExpBuiltinsAssembler::SlowLoadLastIndex(
-      implicit context: Context)(JSAny): JSAny;
-  extern transitioning macro RegExpBuiltinsAssembler::SlowStoreLastIndex(
-      implicit context: Context)(JSAny, JSAny): void;
+// ES #sec-get-regexp.prototype.flags
+// TFJ(RegExpPrototypeFlagsGetter, 0, kReceiver) \
+transitioning javascript builtin RegExpPrototypeFlagsGetter(
+    js-implicit context: NativeContext, receiver: JSAny)(): String {
+  ThrowIfNotJSReceiver(
+      receiver, MessageTemplate::kRegExpNonObject, 'RegExp.prototype.flags');
+
+  // The check is strict because the following code relies on individual flag
+  // getters on the regexp prototype (e.g.: global, sticky, ...). We don't
+  // bother to check these individually.
+  const fastRegexp = Cast<FastJSRegExp>(receiver)
+      otherwise return SlowFlagsGetter(receiver);
+  return FastFlagsGetter(fastRegexp);
+}
 
-  extern macro RegExpBuiltinsAssembler::FastLoadLastIndex(JSRegExp): Smi;
-  extern macro RegExpBuiltinsAssembler::FastStoreLastIndex(JSRegExp, Smi): void;
+extern transitioning macro RegExpBuiltinsAssembler::SlowLoadLastIndex(
+    implicit context: Context)(JSAny): JSAny;
+extern transitioning macro RegExpBuiltinsAssembler::SlowStoreLastIndex(
+    implicit context: Context)(JSAny, JSAny): void;
 
-  @export
-  transitioning macro LoadLastIndex(implicit context: Context)(
-      regexp: JSAny, isFastPath: constexpr bool): JSAny {
-    return isFastPath ? FastLoadLastIndex(UnsafeCast<JSRegExp>(regexp)) :
-                        SlowLoadLastIndex(regexp);
-  }
+extern macro RegExpBuiltinsAssembler::FastLoadLastIndex(JSRegExp): Smi;
+extern macro RegExpBuiltinsAssembler::FastStoreLastIndex(JSRegExp, Smi): void;
 
-  @export
-  transitioning macro LoadLastIndexAsLength(implicit context: Context)(
-      regexp: JSRegExp, isFastPath: constexpr bool): Number {
-    const lastIndex = LoadLastIndex(regexp, isFastPath);
-    if (isFastPath) {
-      // ToLength on a positive smi is a nop and can be skipped.
-      return UnsafeCast<PositiveSmi>(lastIndex);
-    } else {
-      // Omit ToLength if last_index is a non-negative smi.
-      typeswitch (lastIndex) {
-        case (i: PositiveSmi): {
-          return i;
-        }
-        case (o: JSAny): {
-          return ToLength_Inline(o);
-        }
+@export
+transitioning macro LoadLastIndex(implicit context: Context)(
+    regexp: JSAny, isFastPath: constexpr bool): JSAny {
+  return isFastPath ? FastLoadLastIndex(UnsafeCast<JSRegExp>(regexp)) :
+                      SlowLoadLastIndex(regexp);
+}
+
+@export
+transitioning macro LoadLastIndexAsLength(implicit context: Context)(
+    regexp: JSRegExp, isFastPath: constexpr bool): Number {
+  const lastIndex = LoadLastIndex(regexp, isFastPath);
+  if (isFastPath) {
+    // ToLength on a positive smi is a nop and can be skipped.
+    return UnsafeCast<PositiveSmi>(lastIndex);
+  } else {
+    // Omit ToLength if last_index is a non-negative smi.
+    typeswitch (lastIndex) {
+      case (i: PositiveSmi): {
+        return i;
+      }
+      case (o: JSAny): {
+        return ToLength_Inline(o);
       }
     }
   }
+}
 
-  @export
-  transitioning macro StoreLastIndex(implicit context: Context)(
-      regexp: JSAny, value: Number, isFastPath: constexpr bool): void {
-    if (isFastPath) {
-      FastStoreLastIndex(UnsafeCast<JSRegExp>(regexp), UnsafeCast<Smi>(value));
-    } else {
-      SlowStoreLastIndex(regexp, value);
-    }
+@export
+transitioning macro StoreLastIndex(implicit context: Context)(
+    regexp: JSAny, value: Number, isFastPath: constexpr bool): void {
+  if (isFastPath) {
+    FastStoreLastIndex(UnsafeCast<JSRegExp>(regexp), UnsafeCast<Smi>(value));
+  } else {
+    SlowStoreLastIndex(regexp, value);
   }
+}
 
-  extern builtin
-  StringIndexOf(implicit context: Context)(String, String, Smi): Smi;
-
-  extern macro RegExpBuiltinsAssembler::AdvanceStringIndex(
-      String, Number, bool, constexpr bool): Number;
-  extern macro
-  RegExpBuiltinsAssembler::AdvanceStringIndexFast(String, Smi, bool): Smi;
-  extern macro
-  RegExpBuiltinsAssembler::AdvanceStringIndexSlow(String, Number, bool): Smi;
-
-  type UseCounterFeature extends int31
-  constexpr 'v8::Isolate::UseCounterFeature';
-  const kRegExpMatchIsTrueishOnNonJSRegExp: constexpr UseCounterFeature
-  generates 'v8::Isolate::kRegExpMatchIsTrueishOnNonJSRegExp';
-  const kRegExpMatchIsFalseishOnJSRegExp: constexpr UseCounterFeature
-  generates 'v8::Isolate::kRegExpMatchIsFalseishOnJSRegExp';
-  const kRegExpPrototypeSourceGetter: constexpr UseCounterFeature
-  generates 'v8::Isolate::kRegExpPrototypeSourceGetter';
-  const kRegExpExecCalledOnSlowRegExp: constexpr UseCounterFeature
-  generates 'v8::Isolate::kRegExpExecCalledOnSlowRegExp';
-
-  // ES#sec-isregexp IsRegExp ( argument )
-  @export
-  transitioning macro IsRegExp(implicit context: Context)(obj: JSAny): bool {
-    const receiver = Cast<JSReceiver>(obj) otherwise return false;
-
-    // Check @match.
-    const value = GetProperty(receiver, MatchSymbolConstant());
-    if (value == Undefined) {
-      return Is<JSRegExp>(receiver);
-    }
-
-    assert(value != Undefined);
-    // The common path. Symbol.match exists, equals the RegExpPrototypeMatch
-    // function (and is thus trueish), and the receiver is a JSRegExp.
-    if (ToBoolean(value)) {
-      if (!Is<JSRegExp>(receiver)) {
-        IncrementUseCounter(
-            context, SmiConstant(kRegExpMatchIsTrueishOnNonJSRegExp));
-      }
-      return true;
-    }
+extern builtin
+StringIndexOf(implicit context: Context)(String, String, Smi): Smi;
+
+extern macro RegExpBuiltinsAssembler::AdvanceStringIndex(
+    String, Number, bool, constexpr bool): Number;
+extern macro
+RegExpBuiltinsAssembler::AdvanceStringIndexFast(String, Smi, bool): Smi;
+extern macro
+RegExpBuiltinsAssembler::AdvanceStringIndexSlow(String, Number, bool): Smi;
+
+type UseCounterFeature extends int31
+constexpr 'v8::Isolate::UseCounterFeature';
+const kRegExpMatchIsTrueishOnNonJSRegExp: constexpr UseCounterFeature
+    generates 'v8::Isolate::kRegExpMatchIsTrueishOnNonJSRegExp';
+const kRegExpMatchIsFalseishOnJSRegExp: constexpr UseCounterFeature
+    generates 'v8::Isolate::kRegExpMatchIsFalseishOnJSRegExp';
+const kRegExpPrototypeSourceGetter: constexpr UseCounterFeature
+    generates 'v8::Isolate::kRegExpPrototypeSourceGetter';
+const kRegExpExecCalledOnSlowRegExp: constexpr UseCounterFeature
+    generates 'v8::Isolate::kRegExpExecCalledOnSlowRegExp';
+
+// ES#sec-isregexp IsRegExp ( argument )
+@export
+transitioning macro IsRegExp(implicit context: Context)(obj: JSAny): bool {
+  const receiver = Cast<JSReceiver>(obj) otherwise return false;
+
+  // Check @match.
+  const value = GetProperty(receiver, MatchSymbolConstant());
+  if (value == Undefined) {
+    return Is<JSRegExp>(receiver);
+  }
 
-    assert(!ToBoolean(value));
-    if (Is<JSRegExp>(receiver)) {
+  assert(value != Undefined);
+  // The common path. Symbol.match exists, equals the RegExpPrototypeMatch
+  // function (and is thus trueish), and the receiver is a JSRegExp.
+  if (ToBoolean(value)) {
+    if (!Is<JSRegExp>(receiver)) {
       IncrementUseCounter(
-          context, SmiConstant(kRegExpMatchIsFalseishOnJSRegExp));
+          context, SmiConstant(kRegExpMatchIsTrueishOnNonJSRegExp));
     }
-    return false;
+    return true;
   }
 
-  extern runtime RegExpInitializeAndCompile(Context, JSRegExp, String, String):
-      JSAny;
-
-  @export
-  transitioning macro RegExpCreate(implicit context: Context)(
-      nativeContext: NativeContext, maybeString: JSAny, flags: String): JSAny {
-    const regexpFun = LoadRegExpFunction(nativeContext);
-    const initialMap = UnsafeCast<Map>(regexpFun.prototype_or_initial_map);
-    return RegExpCreate(initialMap, maybeString, flags);
+  assert(!ToBoolean(value));
+  if (Is<JSRegExp>(receiver)) {
+    IncrementUseCounter(context, SmiConstant(kRegExpMatchIsFalseishOnJSRegExp));
   }
+  return false;
+}
 
-  @export
-  transitioning macro RegExpCreate(implicit context: Context)(
-      initialMap: Map, maybeString: JSAny, flags: String): JSAny {
-    const pattern: String =
-        maybeString == Undefined ? kEmptyString : ToString_Inline(maybeString);
-    const regexp =
-        UnsafeCast<JSRegExp>(AllocateFastOrSlowJSObjectFromMap(initialMap));
-    return RegExpInitializeAndCompile(context, regexp, pattern, flags);
-  }
+extern runtime RegExpInitializeAndCompile(
+    Context, JSRegExp, String, String): JSAny;
+
+@export
+transitioning macro RegExpCreate(implicit context: Context)(
+    nativeContext: NativeContext, maybeString: JSAny, flags: String): JSAny {
+  const regexpFun = LoadRegExpFunction(nativeContext);
+  const initialMap = UnsafeCast<Map>(regexpFun.prototype_or_initial_map);
+  return RegExpCreate(initialMap, maybeString, flags);
+}
+
+@export
+transitioning macro RegExpCreate(implicit context: Context)(
+    initialMap: Map, maybeString: JSAny, flags: String): JSAny {
+  const pattern: String =
+      maybeString == Undefined ? kEmptyString : ToString_Inline(maybeString);
+  const regexp =
+      UnsafeCast<JSRegExp>(AllocateFastOrSlowJSObjectFromMap(initialMap));
+  return RegExpInitializeAndCompile(context, regexp, pattern, flags);
+}
 }
diff --git a/deps/v8/src/builtins/setup-builtins-internal.cc b/deps/v8/src/builtins/setup-builtins-internal.cc
index 4739e18c57f..d094c3f2ad4 100644
--- a/deps/v8/src/builtins/setup-builtins-internal.cc
+++ b/deps/v8/src/builtins/setup-builtins-internal.cc
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/init/setup-isolate.h"
-
 #include "src/builtins/builtins.h"
 #include "src/codegen/assembler-inl.h"
 #include "src/codegen/interface-descriptors.h"
@@ -12,7 +10,8 @@
 #include "src/compiler/code-assembler.h"
 #include "src/execution/isolate.h"
 #include "src/handles/handles-inl.h"
-#include "src/heap/heap-inl.h"  // For MemoryAllocator::code_range.
+#include "src/heap/heap-inl.h"  // For Heap::code_range.
+#include "src/init/setup-isolate.h"
 #include "src/interpreter/bytecodes.h"
 #include "src/interpreter/interpreter-generator.h"
 #include "src/interpreter/interpreter.h"
diff --git a/deps/v8/src/builtins/string-endswith.tq b/deps/v8/src/builtins/string-endswith.tq
index 6941728b39a..b9615b11498 100644
--- a/deps/v8/src/builtins/string-endswith.tq
+++ b/deps/v8/src/builtins/string-endswith.tq
@@ -3,79 +3,78 @@
 // found in the LICENSE file.
 
 namespace string {
-  macro TryFastStringCompareSequence(
-      string: String, searchStr: String, start: uintptr,
-      searchLength: uintptr): Boolean labels Slow {
-    const directString = Cast<DirectString>(string) otherwise Slow;
-    const directSearchStr = Cast<DirectString>(searchStr) otherwise Slow;
+macro TryFastStringCompareSequence(
+    string: String, searchStr: String, start: uintptr,
+    searchLength: uintptr): Boolean labels Slow {
+  const directString = Cast<DirectString>(string) otherwise Slow;
+  const directSearchStr = Cast<DirectString>(searchStr) otherwise Slow;
 
-    let searchIndex: uintptr = 0;
-    let stringIndex: uintptr = start;
+  let searchIndex: uintptr = 0;
+  let stringIndex: uintptr = start;
 
-    while (searchIndex < searchLength) {
-      if (StringCharCodeAt(directSearchStr, searchIndex) !=
-          StringCharCodeAt(directString, stringIndex)) {
-        return False;
-      }
-
-      searchIndex++;
-      stringIndex++;
+  while (searchIndex < searchLength) {
+    if (StringCharCodeAt(directSearchStr, searchIndex) !=
+        StringCharCodeAt(directString, stringIndex)) {
+      return False;
     }
-    return True;
+
+    searchIndex++;
+    stringIndex++;
   }
+  return True;
+}
 
-  // https://tc39.github.io/ecma262/#sec-string.prototype.endswith
-  transitioning javascript builtin StringPrototypeEndsWith(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): Boolean {
-    const searchString: JSAny = arguments[0];
-    const endPosition: JSAny = arguments[1];
-    const kBuiltinName: constexpr string = 'String.prototype.endsWith';
+// https://tc39.github.io/ecma262/#sec-string.prototype.endswith
+transitioning javascript builtin StringPrototypeEndsWith(
+    js-implicit context: NativeContext,
+    receiver: JSAny)(...arguments): Boolean {
+  const searchString: JSAny = arguments[0];
+  const endPosition: JSAny = arguments[1];
+  const kBuiltinName: constexpr string = 'String.prototype.endsWith';
 
-    // 1. Let O be ? RequireObjectCoercible(this value).
-    // 2. Let S be ? ToString(O).
-    const string: String = ToThisString(receiver, kBuiltinName);
+  // 1. Let O be ? RequireObjectCoercible(this value).
+  // 2. Let S be ? ToString(O).
+  const string: String = ToThisString(receiver, kBuiltinName);
 
-    // 3. Let isRegExp be ? IsRegExp(searchString).
-    // 4. If isRegExp is true, throw a TypeError exception.
-    if (regexp::IsRegExp(searchString)) {
-      ThrowTypeError(MessageTemplate::kFirstArgumentNotRegExp, kBuiltinName);
-    }
+  // 3. Let isRegExp be ? IsRegExp(searchString).
+  // 4. If isRegExp is true, throw a TypeError exception.
+  if (regexp::IsRegExp(searchString)) {
+    ThrowTypeError(MessageTemplate::kFirstArgumentNotRegExp, kBuiltinName);
+  }
 
-    // 5. Let searchStr be ? ToString(searchString).
-    const searchStr: String = ToString_Inline(searchString);
+  // 5. Let searchStr be ? ToString(searchString).
+  const searchStr: String = ToString_Inline(searchString);
 
-    // 6. Let len be the length of S.
-    const len: uintptr = string.length_uintptr;
+  // 6. Let len be the length of S.
+  const len: uintptr = string.length_uintptr;
 
-    // 7. If endPosition is undefined, let pos be len,
-    // else let pos be ? ToInteger(endPosition).
-    // 8. Let end be min(max(pos, 0), len).
-    const end: uintptr =
-        (endPosition != Undefined) ? ClampToIndexRange(endPosition, len) : len;
+  // 7. If endPosition is undefined, let pos be len,
+  // else let pos be ? ToInteger(endPosition).
+  // 8. Let end be min(max(pos, 0), len).
+  const end: uintptr =
+      (endPosition != Undefined) ? ClampToIndexRange(endPosition, len) : len;
 
-    // 9. Let searchLength be the length of searchStr.
-    const searchLength: uintptr = searchStr.length_uintptr;
+  // 9. Let searchLength be the length of searchStr.
+  const searchLength: uintptr = searchStr.length_uintptr;
 
-    // 10. Let start be end - searchLength.
-    const start: uintptr = end - searchLength;
+  // 10. Let start be end - searchLength.
+  const start: uintptr = end - searchLength;
 
-    // 11. If start is less than 0, return false.
-    if (Signed(start) < 0) return False;
+  // 11. If start is less than 0, return false.
+  if (Signed(start) < 0) return False;
 
-    // 12. If the sequence of code units of S starting at start of length
-    // searchLength is the same as the full code unit sequence of searchStr,
-    // return true.
-    // 13. Otherwise, return false.
-    try {
-      // Fast Path: If both strings are direct and relevant indices are Smis.
-      return TryFastStringCompareSequence(
-          string, searchStr, start, searchLength) otherwise Slow;
-    }
-    label Slow {
-      // Slow Path: If either of the string is indirect, bail into runtime.
-      return StringCompareSequence(
-          context, string, searchStr, Convert<Number>(start));
-    }
+  // 12. If the sequence of code units of S starting at start of length
+  // searchLength is the same as the full code unit sequence of searchStr,
+  // return true.
+  // 13. Otherwise, return false.
+  try {
+    // Fast Path: If both strings are direct and relevant indices are Smis.
+    return TryFastStringCompareSequence(string, searchStr, start, searchLength)
+        otherwise Slow;
+  } label Slow {
+    // Slow Path: If either of the string is indirect, bail into runtime.
+    return StringCompareSequence(
+        context, string, searchStr, Convert<Number>(start));
   }
 }
+}
diff --git a/deps/v8/src/builtins/string-html.tq b/deps/v8/src/builtins/string-html.tq
index f12c2dd22f1..8b3e01342ea 100644
--- a/deps/v8/src/builtins/string-html.tq
+++ b/deps/v8/src/builtins/string-html.tq
@@ -3,127 +3,124 @@
 // found in the LICENSE file.
 
 namespace string {
-  extern runtime StringEscapeQuotes(Context, String): String;
-
-  // https://tc39.github.io/ecma262/#sec-createhtml
-  transitioning builtin CreateHTML(implicit context: Context)(
-      receiver: JSAny, methodName: String, tagName: String, attr: String,
-      attrValue: JSAny): String {
-    const tagContents: String = ToThisString(receiver, methodName);
-    let result = '<' + tagName;
-    if (attr != kEmptyString) {
-      const attrStringValue: String =
-          StringEscapeQuotes(context, ToString_Inline(attrValue));
-      result = result + ' ' + attr + '=\"' + attrStringValue + '\"';
-    }
-
-    return result + '>' + tagContents + '</' + tagName + '>';
+extern runtime StringEscapeQuotes(Context, String): String;
+
+// https://tc39.github.io/ecma262/#sec-createhtml
+transitioning builtin CreateHTML(implicit context: Context)(
+    receiver: JSAny, methodName: String, tagName: String, attr: String,
+    attrValue: JSAny): String {
+  const tagContents: String = ToThisString(receiver, methodName);
+  let result = '<' + tagName;
+  if (attr != kEmptyString) {
+    const attrStringValue: String =
+        StringEscapeQuotes(context, ToString_Inline(attrValue));
+    result = result + ' ' + attr + '=\"' + attrStringValue + '\"';
   }
 
-  // https://tc39.github.io/ecma262/#sec-string.prototype.anchor
-  transitioning javascript builtin StringPrototypeAnchor(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): String {
-    return CreateHTML(
-        receiver, 'String.prototype.anchor', 'a', 'name', arguments[0]);
-  }
+  return result + '>' + tagContents + '</' + tagName + '>';
+}
 
-  // https://tc39.github.io/ecma262/#sec-string.prototype.big
-  transitioning javascript builtin
-  StringPrototypeBig(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): String {
-    return CreateHTML(
-        receiver, 'String.prototype.big', 'big', kEmptyString, kEmptyString);
-  }
+// https://tc39.github.io/ecma262/#sec-string.prototype.anchor
+transitioning javascript builtin StringPrototypeAnchor(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  return CreateHTML(
+      receiver, 'String.prototype.anchor', 'a', 'name', arguments[0]);
+}
 
-  // https://tc39.github.io/ecma262/#sec-string.prototype.blink
-  transitioning javascript builtin
-  StringPrototypeBlink(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): String {
-    return CreateHTML(
-        receiver, 'String.prototype.blink', 'blink', kEmptyString,
-        kEmptyString);
-  }
+// https://tc39.github.io/ecma262/#sec-string.prototype.big
+transitioning javascript builtin
+StringPrototypeBig(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  return CreateHTML(
+      receiver, 'String.prototype.big', 'big', kEmptyString, kEmptyString);
+}
 
-  // https://tc39.github.io/ecma262/#sec-string.prototype.bold
-  transitioning javascript builtin
-  StringPrototypeBold(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): String {
-    return CreateHTML(
-        receiver, 'String.prototype.bold', 'b', kEmptyString, kEmptyString);
-  }
+// https://tc39.github.io/ecma262/#sec-string.prototype.blink
+transitioning javascript builtin
+StringPrototypeBlink(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  return CreateHTML(
+      receiver, 'String.prototype.blink', 'blink', kEmptyString, kEmptyString);
+}
 
-  // https://tc39.github.io/ecma262/#sec-string.prototype.fontcolor
-  transitioning javascript builtin
-  StringPrototypeFontcolor(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): String {
-    return CreateHTML(
-        receiver, 'String.prototype.fontcolor', 'font', 'color', arguments[0]);
-  }
+// https://tc39.github.io/ecma262/#sec-string.prototype.bold
+transitioning javascript builtin
+StringPrototypeBold(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  return CreateHTML(
+      receiver, 'String.prototype.bold', 'b', kEmptyString, kEmptyString);
+}
 
-  // https://tc39.github.io/ecma262/#sec-string.prototype.fontsize
-  transitioning javascript builtin
-  StringPrototypeFontsize(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): String {
-    return CreateHTML(
-        receiver, 'String.prototype.fontsize', 'font', 'size', arguments[0]);
-  }
+// https://tc39.github.io/ecma262/#sec-string.prototype.fontcolor
+transitioning javascript builtin
+StringPrototypeFontcolor(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  return CreateHTML(
+      receiver, 'String.prototype.fontcolor', 'font', 'color', arguments[0]);
+}
 
-  // https://tc39.github.io/ecma262/#sec-string.prototype.fixed
-  transitioning javascript builtin
-  StringPrototypeFixed(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): String {
-    return CreateHTML(
-        receiver, 'String.prototype.fixed', 'tt', kEmptyString, kEmptyString);
-  }
+// https://tc39.github.io/ecma262/#sec-string.prototype.fontsize
+transitioning javascript builtin
+StringPrototypeFontsize(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  return CreateHTML(
+      receiver, 'String.prototype.fontsize', 'font', 'size', arguments[0]);
+}
 
-  // https://tc39.github.io/ecma262/#sec-string.prototype.italics
-  transitioning javascript builtin
-  StringPrototypeItalics(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): String {
-    return CreateHTML(
-        receiver, 'String.prototype.italics', 'i', kEmptyString, kEmptyString);
-  }
+// https://tc39.github.io/ecma262/#sec-string.prototype.fixed
+transitioning javascript builtin
+StringPrototypeFixed(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  return CreateHTML(
+      receiver, 'String.prototype.fixed', 'tt', kEmptyString, kEmptyString);
+}
 
-  // https://tc39.github.io/ecma262/#sec-string.prototype.link
-  transitioning javascript builtin
-  StringPrototypeLink(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): String {
-    return CreateHTML(
-        receiver, 'String.prototype.link', 'a', 'href', arguments[0]);
-  }
+// https://tc39.github.io/ecma262/#sec-string.prototype.italics
+transitioning javascript builtin
+StringPrototypeItalics(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  return CreateHTML(
+      receiver, 'String.prototype.italics', 'i', kEmptyString, kEmptyString);
+}
 
-  // https://tc39.github.io/ecma262/#sec-string.prototype.small
-  transitioning javascript builtin
-  StringPrototypeSmall(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): String {
-    return CreateHTML(
-        receiver, 'String.prototype.small', 'small', kEmptyString,
-        kEmptyString);
-  }
+// https://tc39.github.io/ecma262/#sec-string.prototype.link
+transitioning javascript builtin
+StringPrototypeLink(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  return CreateHTML(
+      receiver, 'String.prototype.link', 'a', 'href', arguments[0]);
+}
 
-  // https://tc39.github.io/ecma262/#sec-string.prototype.strike
-  transitioning javascript builtin
-  StringPrototypeStrike(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): String {
-    return CreateHTML(
-        receiver, 'String.prototype.strike', 'strike', kEmptyString,
-        kEmptyString);
-  }
+// https://tc39.github.io/ecma262/#sec-string.prototype.small
+transitioning javascript builtin
+StringPrototypeSmall(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  return CreateHTML(
+      receiver, 'String.prototype.small', 'small', kEmptyString, kEmptyString);
+}
 
-  // https://tc39.github.io/ecma262/#sec-string.prototype.sub
-  transitioning javascript builtin
-  StringPrototypeSub(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): String {
-    return CreateHTML(
-        receiver, 'String.prototype.sub', 'sub', kEmptyString, kEmptyString);
-  }
+// https://tc39.github.io/ecma262/#sec-string.prototype.strike
+transitioning javascript builtin
+StringPrototypeStrike(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  return CreateHTML(
+      receiver, 'String.prototype.strike', 'strike', kEmptyString,
+      kEmptyString);
+}
 
-  // https://tc39.github.io/ecma262/#sec-string.prototype.sup
-  transitioning javascript builtin
-  StringPrototypeSup(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): String {
-    return CreateHTML(
-        receiver, 'String.prototype.sup', 'sup', kEmptyString, kEmptyString);
-  }
+// https://tc39.github.io/ecma262/#sec-string.prototype.sub
+transitioning javascript builtin
+StringPrototypeSub(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  return CreateHTML(
+      receiver, 'String.prototype.sub', 'sub', kEmptyString, kEmptyString);
+}
+
+// https://tc39.github.io/ecma262/#sec-string.prototype.sup
+transitioning javascript builtin
+StringPrototypeSup(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  return CreateHTML(
+      receiver, 'String.prototype.sup', 'sup', kEmptyString, kEmptyString);
+}
 }
diff --git a/deps/v8/src/builtins/string-iterator.tq b/deps/v8/src/builtins/string-iterator.tq
index 79032e0e280..eea7a621f0f 100644
--- a/deps/v8/src/builtins/string-iterator.tq
+++ b/deps/v8/src/builtins/string-iterator.tq
@@ -4,43 +4,43 @@
 
 namespace string {
 
-  macro NewJSStringIterator(implicit context: Context)(
-      string: String, nextIndex: Smi): JSStringIterator {
-    return new JSStringIterator{
-      map: GetInitialStringIteratorMap(),
-      properties_or_hash: kEmptyFixedArray,
-      elements: kEmptyFixedArray,
-      string: string,
-      index: nextIndex
-    };
-  }
+macro NewJSStringIterator(implicit context: Context)(
+    string: String, nextIndex: Smi): JSStringIterator {
+  return new JSStringIterator{
+    map: GetInitialStringIteratorMap(),
+    properties_or_hash: kEmptyFixedArray,
+    elements: kEmptyFixedArray,
+    string: string,
+    index: nextIndex
+  };
+}
 
-  // ES6 #sec-string.prototype-@@iterator
-  transitioning javascript builtin StringPrototypeIterator(
-      js-implicit context: NativeContext, receiver: JSAny)(): JSStringIterator {
-    const name: String =
-        ToThisString(receiver, 'String.prototype[Symbol.iterator]');
-    const index: Smi = 0;
-    return NewJSStringIterator(name, index);
-  }
+// ES6 #sec-string.prototype-@@iterator
+transitioning javascript builtin StringPrototypeIterator(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSStringIterator {
+  const name: String =
+      ToThisString(receiver, 'String.prototype[Symbol.iterator]');
+  const index: Smi = 0;
+  return NewJSStringIterator(name, index);
+}
 
-  // ES6 #sec-%stringiteratorprototype%.next
-  transitioning javascript builtin StringIteratorPrototypeNext(
-      js-implicit context: NativeContext, receiver: JSAny)(): JSObject {
-    const iterator = Cast<JSStringIterator>(receiver) otherwise ThrowTypeError(
-        MessageTemplate::kIncompatibleMethodReceiver,
-        'String Iterator.prototype.next', receiver);
-    const string = iterator.string;
-    const position: intptr = SmiUntag(iterator.index);
-    const length: intptr = string.length_intptr;
-    if (position >= length) {
-      return AllocateJSIteratorResult(Undefined, True);
-    }
-    // Move to next codepoint.
-    const encoding = UnicodeEncoding::UTF16;
-    const ch = string::LoadSurrogatePairAt(string, length, position, encoding);
-    const value: String = string::StringFromSingleUTF16EncodedCodePoint(ch);
-    iterator.index = SmiTag(position + value.length_intptr);
-    return AllocateJSIteratorResult(value, False);
+// ES6 #sec-%stringiteratorprototype%.next
+transitioning javascript builtin StringIteratorPrototypeNext(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSObject {
+  const iterator = Cast<JSStringIterator>(receiver) otherwise ThrowTypeError(
+      MessageTemplate::kIncompatibleMethodReceiver,
+      'String Iterator.prototype.next', receiver);
+  const string = iterator.string;
+  const position: intptr = SmiUntag(iterator.index);
+  const length: intptr = string.length_intptr;
+  if (position >= length) {
+    return AllocateJSIteratorResult(Undefined, True);
   }
+  // Move to next codepoint.
+  const encoding = UnicodeEncoding::UTF16;
+  const ch = string::LoadSurrogatePairAt(string, length, position, encoding);
+  const value: String = string::StringFromSingleUTF16EncodedCodePoint(ch);
+  iterator.index = SmiTag(position + value.length_intptr);
+  return AllocateJSIteratorResult(value, False);
+}
 }
diff --git a/deps/v8/src/builtins/string-pad.tq b/deps/v8/src/builtins/string-pad.tq
index 4a4c3704065..b95e68628a4 100644
--- a/deps/v8/src/builtins/string-pad.tq
+++ b/deps/v8/src/builtins/string-pad.tq
@@ -6,106 +6,106 @@
 
 namespace string {
 
-  extern transitioning builtin
-  StringSubstring(implicit context: Context)(String, intptr, intptr): String;
+extern transitioning builtin
+StringSubstring(implicit context: Context)(String, intptr, intptr): String;
 
-  const kStringPadStart: constexpr int31 = 0;
-  const kStringPadEnd: constexpr int31 = 1;
+const kStringPadStart: constexpr int31 = 0;
+const kStringPadEnd: constexpr int31 = 1;
 
-  transitioning macro StringPad(implicit context: Context)(
-      receiver: JSAny, arguments: Arguments, methodName: constexpr string,
-      variant: constexpr int31): String {
-    const receiverString: String = ToThisString(receiver, methodName);
-    const stringLength: Smi = receiverString.length_smi;
+transitioning macro StringPad(implicit context: Context)(
+    receiver: JSAny, arguments: Arguments, methodName: constexpr string,
+    variant: constexpr int31): String {
+  const receiverString: String = ToThisString(receiver, methodName);
+  const stringLength: Smi = receiverString.length_smi;
 
-    if (arguments.length == 0) {
-      return receiverString;
-    }
-    const maxLength: Number = ToLength_Inline(arguments[0]);
-    assert(IsNumberNormalized(maxLength));
-
-    typeswitch (maxLength) {
-      case (smiMaxLength: Smi): {
-        if (smiMaxLength <= stringLength) {
-          return receiverString;
-        }
-      }
-      case (Number): {
-      }
-    }
+  if (arguments.length == 0) {
+    return receiverString;
+  }
+  const maxLength: Number = ToLength_Inline(arguments[0]);
+  assert(IsNumberNormalized(maxLength));
 
-    let fillString: String = ' ';
-    let fillLength: intptr = 1;
-
-    if (arguments.length != 1) {
-      const fill = arguments[1];
-      if (fill != Undefined) {
-        fillString = ToString_Inline(fill);
-        fillLength = fillString.length_intptr;
-        if (fillLength == 0) {
-          return receiverString;
-        }
+  typeswitch (maxLength) {
+    case (smiMaxLength: Smi): {
+      if (smiMaxLength <= stringLength) {
+        return receiverString;
       }
     }
-
-    // Pad.
-    assert(fillLength > 0);
-    // Throw if max_length is greater than String::kMaxLength.
-    if (!TaggedIsSmi(maxLength)) {
-      ThrowInvalidStringLength(context);
+    case (Number): {
     }
+  }
 
-    const smiMaxLength: Smi = UnsafeCast<Smi>(maxLength);
-    if (smiMaxLength > SmiConstant(kStringMaxLength)) {
-      ThrowInvalidStringLength(context);
-    }
-    assert(smiMaxLength > stringLength);
-    const padLength: Smi = smiMaxLength - stringLength;
-
-    let padding: String;
-    if (fillLength == 1) {
-      // Single char fill.
-      // Fast path for a single character fill.  No need to calculate number of
-      // repetitions or remainder.
-      padding = StringRepeat(context, fillString, padLength);
-    } else {
-      // Multi char fill.
-      const fillLengthWord32: int32 = TruncateIntPtrToInt32(fillLength);
-      const padLengthWord32: int32 = Convert<int32>(padLength);
-      const repetitionsWord32: int32 = padLengthWord32 / fillLengthWord32;
-      const remainingWord32: int32 = padLengthWord32 % fillLengthWord32;
-      padding =
-          StringRepeat(context, fillString, Convert<Smi>(repetitionsWord32));
-
-      if (remainingWord32 != 0) {
-        const remainderString =
-            StringSubstring(fillString, 0, Convert<intptr>(remainingWord32));
-        padding = padding + remainderString;
+  let fillString: String = ' ';
+  let fillLength: intptr = 1;
+
+  if (arguments.length != 1) {
+    const fill = arguments[1];
+    if (fill != Undefined) {
+      fillString = ToString_Inline(fill);
+      fillLength = fillString.length_intptr;
+      if (fillLength == 0) {
+        return receiverString;
       }
     }
+  }
 
-    // Return result.
-    assert(padLength == padding.length_smi);
-    if (variant == kStringPadStart) {
-      return padding + receiverString;
-    }
-    assert(variant == kStringPadEnd);
-    return receiverString + padding;
+  // Pad.
+  assert(fillLength > 0);
+  // Throw if max_length is greater than String::kMaxLength.
+  if (!TaggedIsSmi(maxLength)) {
+    ThrowInvalidStringLength(context);
   }
 
-  // ES6 #sec-string.prototype.padstart
-  transitioning javascript builtin
-  StringPrototypePadStart(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): String {
-    const methodName: constexpr string = 'String.prototype.padStart';
-    return StringPad(receiver, arguments, methodName, kStringPadStart);
+  const smiMaxLength: Smi = UnsafeCast<Smi>(maxLength);
+  if (smiMaxLength > SmiConstant(kStringMaxLength)) {
+    ThrowInvalidStringLength(context);
+  }
+  assert(smiMaxLength > stringLength);
+  const padLength: Smi = smiMaxLength - stringLength;
+
+  let padding: String;
+  if (fillLength == 1) {
+    // Single char fill.
+    // Fast path for a single character fill.  No need to calculate number of
+    // repetitions or remainder.
+    padding = StringRepeat(context, fillString, padLength);
+  } else {
+    // Multi char fill.
+    const fillLengthWord32: int32 = TruncateIntPtrToInt32(fillLength);
+    const padLengthWord32: int32 = Convert<int32>(padLength);
+    const repetitionsWord32: int32 = padLengthWord32 / fillLengthWord32;
+    const remainingWord32: int32 = padLengthWord32 % fillLengthWord32;
+    padding =
+        StringRepeat(context, fillString, Convert<Smi>(repetitionsWord32));
+
+    if (remainingWord32 != 0) {
+      const remainderString =
+          StringSubstring(fillString, 0, Convert<intptr>(remainingWord32));
+      padding = padding + remainderString;
+    }
   }
 
-  // ES6 #sec-string.prototype.padend
-  transitioning javascript builtin
-  StringPrototypePadEnd(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): String {
-    const methodName: constexpr string = 'String.prototype.padEnd';
-    return StringPad(receiver, arguments, methodName, kStringPadEnd);
+  // Return result.
+  assert(padLength == padding.length_smi);
+  if (variant == kStringPadStart) {
+    return padding + receiverString;
   }
+  assert(variant == kStringPadEnd);
+  return receiverString + padding;
+}
+
+// ES6 #sec-string.prototype.padstart
+transitioning javascript builtin
+StringPrototypePadStart(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  const methodName: constexpr string = 'String.prototype.padStart';
+  return StringPad(receiver, arguments, methodName, kStringPadStart);
+}
+
+// ES6 #sec-string.prototype.padend
+transitioning javascript builtin
+StringPrototypePadEnd(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  const methodName: constexpr string = 'String.prototype.padEnd';
+  return StringPad(receiver, arguments, methodName, kStringPadEnd);
+}
 }
diff --git a/deps/v8/src/builtins/string-repeat.tq b/deps/v8/src/builtins/string-repeat.tq
index e3e72ae7b58..e1e33eb53ab 100644
--- a/deps/v8/src/builtins/string-repeat.tq
+++ b/deps/v8/src/builtins/string-repeat.tq
@@ -3,76 +3,72 @@
 // found in the LICENSE file.
 
 namespace string {
-  const kBuiltinName: constexpr string = 'String.prototype.repeat';
+const kBuiltinName: constexpr string = 'String.prototype.repeat';
 
-  builtin StringRepeat(implicit context: Context)(string: String, count: Smi):
-      String {
-    assert(count >= 0);
-    assert(string != kEmptyString);
+builtin StringRepeat(implicit context: Context)(
+    string: String, count: Smi): String {
+  assert(count >= 0);
+  assert(string != kEmptyString);
 
-    let result: String = kEmptyString;
-    let powerOfTwoRepeats: String = string;
-    let n: intptr = Convert<intptr>(count);
+  let result: String = kEmptyString;
+  let powerOfTwoRepeats: String = string;
+  let n: intptr = Convert<intptr>(count);
 
-    while (true) {
-      if ((n & 1) == 1) result = result + powerOfTwoRepeats;
+  while (true) {
+    if ((n & 1) == 1) result = result + powerOfTwoRepeats;
 
-      n = n >> 1;
-      if (n == 0) break;
+    n = n >> 1;
+    if (n == 0) break;
 
-      powerOfTwoRepeats = powerOfTwoRepeats + powerOfTwoRepeats;
-    }
-
-    return result;
+    powerOfTwoRepeats = powerOfTwoRepeats + powerOfTwoRepeats;
   }
 
-  // https://tc39.github.io/ecma262/#sec-string.prototype.repeat
-  transitioning javascript builtin StringPrototypeRepeat(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(count: JSAny): String {
-    // 1. Let O be ? RequireObjectCoercible(this value).
-    // 2. Let S be ? ToString(O).
-    const s: String = ToThisString(receiver, kBuiltinName);
+  return result;
+}
 
-    try {
-      // 3. Let n be ? ToInteger(count).
-      typeswitch (ToInteger_Inline(count)) {
-        case (n: Smi): {
-          // 4. If n < 0, throw a RangeError exception.
-          if (n < 0) goto InvalidCount;
+// https://tc39.github.io/ecma262/#sec-string.prototype.repeat
+transitioning javascript builtin StringPrototypeRepeat(
+    js-implicit context: NativeContext, receiver: JSAny)(count: JSAny): String {
+  // 1. Let O be ? RequireObjectCoercible(this value).
+  // 2. Let S be ? ToString(O).
+  const s: String = ToThisString(receiver, kBuiltinName);
 
-          // 6. If n is 0, return the empty String.
-          if (n == 0 || s.length_uint32 == 0) goto EmptyString;
+  try {
+    // 3. Let n be ? ToInteger(count).
+    typeswitch (ToInteger_Inline(count)) {
+      case (n: Smi): {
+        // 4. If n < 0, throw a RangeError exception.
+        if (n < 0) goto InvalidCount;
 
-          if (n > kStringMaxLength) goto InvalidStringLength;
+        // 6. If n is 0, return the empty String.
+        if (n == 0 || s.length_uint32 == 0) goto EmptyString;
 
-          // 7. Return the String value that is made from n copies of S appended
-          // together.
-          return StringRepeat(s, n);
-        }
-        case (heapNum: HeapNumber): deferred {
-          assert(IsNumberNormalized(heapNum));
-          const n = LoadHeapNumberValue(heapNum);
+        if (n > kStringMaxLength) goto InvalidStringLength;
+
+        // 7. Return the String value that is made from n copies of S appended
+        // together.
+        return StringRepeat(s, n);
+      }
+      case (heapNum: HeapNumber): deferred {
+        assert(IsNumberNormalized(heapNum));
+        const n = LoadHeapNumberValue(heapNum);
 
-          // 4. If n < 0, throw a RangeError exception.
-          // 5. If n is +∞, throw a RangeError exception.
-          if (n == V8_INFINITY || n < 0.0) goto InvalidCount;
+        // 4. If n < 0, throw a RangeError exception.
+        // 5. If n is +∞, throw a RangeError exception.
+        if (n == V8_INFINITY || n < 0.0) goto InvalidCount;
 
-          // 6. If n is 0, return the empty String.
-          if (s.length_uint32 == 0) goto EmptyString;
+        // 6. If n is 0, return the empty String.
+        if (s.length_uint32 == 0) goto EmptyString;
 
-          goto InvalidStringLength;
-        }
+        goto InvalidStringLength;
       }
     }
-    label EmptyString {
-      return kEmptyString;
-    }
-    label InvalidCount deferred {
-      ThrowRangeError(MessageTemplate::kInvalidCountValue, count);
-    }
-    label InvalidStringLength deferred {
-      ThrowInvalidStringLength(context);
-    }
+  } label EmptyString {
+    return kEmptyString;
+  } label InvalidCount deferred {
+    ThrowRangeError(MessageTemplate::kInvalidCountValue, count);
+  } label InvalidStringLength deferred {
+    ThrowInvalidStringLength(context);
   }
 }
+}
diff --git a/deps/v8/src/builtins/string-replaceall.tq b/deps/v8/src/builtins/string-replaceall.tq
index c7589f18a66..9211304b345 100644
--- a/deps/v8/src/builtins/string-replaceall.tq
+++ b/deps/v8/src/builtins/string-replaceall.tq
@@ -5,218 +5,216 @@
 #include 'src/builtins/builtins-string-gen.h'
 
 namespace string {
-  extern macro ReplaceSymbolConstant(): Symbol;
-
-  extern macro StringBuiltinsAssembler::GetSubstitution(
-      implicit context: Context)(String, Smi, Smi, String): String;
-
-  extern builtin
-  StringIndexOf(implicit context: Context)(String, String, Smi): Smi;
-
-  macro TryFastAbstractStringIndexOf(implicit context: Context)(
-      string: String, searchString: String, fromIndex: Smi): Smi labels Slow {
-    const stringLen = string.length_uintptr;
-    const searchLen = searchString.length_uintptr;
-    const directString = Cast<DirectString>(string) otherwise Slow;
-    const directSearchStr = Cast<DirectString>(searchString) otherwise Slow;
-    const fromIndexUint = Unsigned(SmiUntag(fromIndex));
-
-    for (let i: uintptr = fromIndexUint; i < stringLen; i++) {
-      let j = i;
-      let k: uintptr = 0;
-      while (j < stringLen && k < searchLen &&
-             StringCharCodeAt(directString, j) ==
-                 StringCharCodeAt(directSearchStr, k)) {
-        j++;
-        k++;
-      }
-      if (k == searchLen) {
-        return SmiTag(Signed(i));
-      }
+extern macro ReplaceSymbolConstant(): Symbol;
+
+extern macro StringBuiltinsAssembler::GetSubstitution(
+    implicit context: Context)(String, Smi, Smi, String): String;
+
+extern builtin
+StringIndexOf(implicit context: Context)(String, String, Smi): Smi;
+
+macro TryFastAbstractStringIndexOf(implicit context: Context)(
+    string: String, searchString: String, fromIndex: Smi): Smi labels Slow {
+  const stringLen = string.length_uintptr;
+  const searchLen = searchString.length_uintptr;
+  const directString = Cast<DirectString>(string) otherwise Slow;
+  const directSearchStr = Cast<DirectString>(searchString) otherwise Slow;
+  const fromIndexUint = Unsigned(SmiUntag(fromIndex));
+
+  for (let i: uintptr = fromIndexUint; i < stringLen; i++) {
+    let j = i;
+    let k: uintptr = 0;
+    while (j < stringLen && k < searchLen &&
+           StringCharCodeAt(directString, j) ==
+               StringCharCodeAt(directSearchStr, k)) {
+      j++;
+      k++;
+    }
+    if (k == searchLen) {
+      return SmiTag(Signed(i));
     }
-    return -1;
   }
+  return -1;
+}
 
-  macro AbstractStringIndexOf(implicit context: Context)(
-      string: String, searchString: String, fromIndex: Smi): Smi {
-    // Special case the empty string.
-    const searchStringLength = searchString.length_intptr;
-    const stringLength = string.length_intptr;
-    if (searchStringLength == 0 && SmiUntag(fromIndex) <= stringLength) {
-      return fromIndex;
-    }
+macro AbstractStringIndexOf(implicit context: Context)(
+    string: String, searchString: String, fromIndex: Smi): Smi {
+  // Special case the empty string.
+  const searchStringLength = searchString.length_intptr;
+  const stringLength = string.length_intptr;
+  if (searchStringLength == 0 && SmiUntag(fromIndex) <= stringLength) {
+    return fromIndex;
+  }
 
-    // Don't bother to search if the searchString would go past the end
-    // of the string. This is actually necessary because of runtime
-    // checks.
-    if (SmiUntag(fromIndex) + searchStringLength > stringLength) {
-      return -1;
-    }
+  // Don't bother to search if the searchString would go past the end
+  // of the string. This is actually necessary because of runtime
+  // checks.
+  if (SmiUntag(fromIndex) + searchStringLength > stringLength) {
+    return -1;
+  }
 
-    try {
-      return TryFastAbstractStringIndexOf(string, searchString, fromIndex)
-          otherwise Slow;
-    }
-    label Slow {
-      for (let i: intptr = SmiUntag(fromIndex);
-           i + searchStringLength <= stringLength; i++) {
-        if (StringCompareSequence(
-                context, string, searchString, Convert<Number>(SmiTag(i))) ==
-            True) {
-          return SmiTag(i);
-        }
+  try {
+    return TryFastAbstractStringIndexOf(string, searchString, fromIndex)
+        otherwise Slow;
+  } label Slow {
+    for (let i: intptr = SmiUntag(fromIndex);
+         i + searchStringLength <= stringLength; i++) {
+      if (StringCompareSequence(
+              context, string, searchString, Convert<Number>(SmiTag(i))) ==
+          True) {
+        return SmiTag(i);
       }
-      return -1;
     }
+    return -1;
   }
+}
 
-  transitioning macro
-  ThrowIfNotGlobal(implicit context: Context)(searchValue: JSAny): void {
-    let shouldThrow: bool;
-    typeswitch (searchValue) {
-      case (fastRegExp: FastJSRegExp): {
-        shouldThrow = !fastRegExp.global;
-      }
-      case (Object): {
-        const flags = GetProperty(searchValue, 'flags');
-        RequireObjectCoercible(flags, 'String.prototype.replaceAll');
-        shouldThrow =
-            StringIndexOf(ToString_Inline(flags), StringConstant('g'), 0) == -1;
-      }
+transitioning macro
+ThrowIfNotGlobal(implicit context: Context)(searchValue: JSAny): void {
+  let shouldThrow: bool;
+  typeswitch (searchValue) {
+    case (fastRegExp: FastJSRegExp): {
+      shouldThrow = !fastRegExp.global;
     }
-    if (shouldThrow) {
-      ThrowTypeError(
-          MessageTemplate::kRegExpGlobalInvokedOnNonGlobal,
-          'String.prototype.replaceAll');
+    case (Object): {
+      const flags = GetProperty(searchValue, 'flags');
+      RequireObjectCoercible(flags, 'String.prototype.replaceAll');
+      shouldThrow =
+          StringIndexOf(ToString_Inline(flags), StringConstant('g'), 0) == -1;
     }
   }
+  if (shouldThrow) {
+    ThrowTypeError(
+        MessageTemplate::kRegExpGlobalInvokedOnNonGlobal,
+        'String.prototype.replaceAll');
+  }
+}
 
-  // https://tc39.es/ecma262/#sec-string.prototype.replaceall
-  transitioning javascript builtin StringPrototypeReplaceAll(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(searchValue: JSAny, replaceValue: JSAny): JSAny {
-    // 1. Let O be ? RequireObjectCoercible(this value).
-    RequireObjectCoercible(receiver, 'String.prototype.replaceAll');
-
-    // 2. If searchValue is neither undefined nor null, then
-    if (searchValue != Undefined && searchValue != Null) {
-      // a. Let isRegExp be ? IsRegExp(searchString).
-      // b. If isRegExp is true, then
-      //   i. Let flags be ? Get(searchValue, "flags").
-      //  ii. Perform ? RequireObjectCoercible(flags).
-      // iii. If ? ToString(flags) does not contain "g", throw a
-      //      TypeError exception.
-      if (regexp::IsRegExp(searchValue)) {
-        ThrowIfNotGlobal(searchValue);
-      }
-
-      // TODO(joshualitt): We could easily add fast paths for string
-      //                   searchValues and potential FastRegExps.
-      // c. Let replacer be ? GetMethod(searchValue, @@replace).
-      // d. If replacer is not undefined, then
-      //   i. Return ? Call(replacer, searchValue, « O, replaceValue »).
-      try {
-        const replacer = GetMethod(searchValue, ReplaceSymbolConstant())
-            otherwise ReplaceSymbolIsNullOrUndefined;
-        return Call(context, replacer, searchValue, receiver, replaceValue);
-      }
-      label ReplaceSymbolIsNullOrUndefined {}
+// https://tc39.es/ecma262/#sec-string.prototype.replaceall
+transitioning javascript builtin StringPrototypeReplaceAll(
+    js-implicit context: NativeContext, receiver: JSAny)(
+    searchValue: JSAny, replaceValue: JSAny): JSAny {
+  // 1. Let O be ? RequireObjectCoercible(this value).
+  RequireObjectCoercible(receiver, 'String.prototype.replaceAll');
+
+  // 2. If searchValue is neither undefined nor null, then
+  if (searchValue != Undefined && searchValue != Null) {
+    // a. Let isRegExp be ? IsRegExp(searchString).
+    // b. If isRegExp is true, then
+    //   i. Let flags be ? Get(searchValue, "flags").
+    //  ii. Perform ? RequireObjectCoercible(flags).
+    // iii. If ? ToString(flags) does not contain "g", throw a
+    //      TypeError exception.
+    if (regexp::IsRegExp(searchValue)) {
+      ThrowIfNotGlobal(searchValue);
     }
 
-    // 3. Let string be ? ToString(O).
-    const string = ToString_Inline(receiver);
+    // TODO(joshualitt): We could easily add fast paths for string
+    //                   searchValues and potential FastRegExps.
+    // c. Let replacer be ? GetMethod(searchValue, @@replace).
+    // d. If replacer is not undefined, then
+    //   i. Return ? Call(replacer, searchValue, « O, replaceValue »).
+    try {
+      const replacer = GetMethod(searchValue, ReplaceSymbolConstant())
+          otherwise ReplaceSymbolIsNullOrUndefined;
+      return Call(context, replacer, searchValue, receiver, replaceValue);
+    } label ReplaceSymbolIsNullOrUndefined {}
+  }
 
-    // 4. Let searchString be ? ToString(searchValue).
-    const searchString = ToString_Inline(searchValue);
+  // 3. Let string be ? ToString(O).
+  const string = ToString_Inline(receiver);
 
-    // 5. Let functionalReplace be IsCallable(replaceValue).
-    let replaceValueArg = replaceValue;
-    const functionalReplace = TaggedIsCallable(replaceValue);
+  // 4. Let searchString be ? ToString(searchValue).
+  const searchString = ToString_Inline(searchValue);
 
-    // 6. If functionalReplace is false, then
-    if (!functionalReplace) {
-      // a. Let replaceValue be ? ToString(replaceValue).
-      replaceValueArg = ToString_Inline(replaceValue);
-    }
+  // 5. Let functionalReplace be IsCallable(replaceValue).
+  let replaceValueArg = replaceValue;
+  const functionalReplace = Is<Callable>(replaceValue);
 
-    // 7. Let searchLength be the length of searchString.
-    const searchLength = searchString.length_smi;
-
-    // 8. Let advanceBy be max(1, searchLength).
-    const advanceBy = SmiMax(1, searchLength);
-
-    // We combine the two loops from the spec into one to avoid
-    // needing a growable array.
-    //
-    // 9. Let matchPositions be a new empty List.
-    // 10. Let position be ! StringIndexOf(string, searchString, 0).
-    // 11. Repeat, while position is not -1
-    //   a. Append position to the end of matchPositions.
-    //   b. Let position be ! StringIndexOf(string, searchString,
-    //                                      position + advanceBy).
-    // 12. Let endOfLastMatch be 0.
-    // 13. Let result be the empty string value.
-    // 14. For each position in matchPositions, do
-    let endOfLastMatch: Smi = 0;
-    let result: String = kEmptyString;
-    let position = AbstractStringIndexOf(string, searchString, 0);
-    while (position != -1) {
-      // a. If functionalReplace is true, then
-      // b. Else,
-      let replacement: String;
-      if (functionalReplace) {
-        // i. Let replacement be ? ToString(? Call(replaceValue, undefined,
-        //                                         « searchString, position,
-        //                                           string »).
-        replacement = ToString_Inline(Call(
-            context, UnsafeCast<Callable>(replaceValueArg), Undefined,
-            searchString, position, string));
-      } else {
-        // i. Assert: Type(replaceValue) is String.
-        const replaceValueString = UnsafeCast<String>(replaceValueArg);
-
-        // ii. Let captures be a new empty List.
-        // iii. Let replacement be GetSubstitution(searchString,
-        //                                         string, position, captures,
-        //                                         undefined, replaceValue).
-        // Note: Instead we just call a simpler GetSubstitution primitive.
-        const matchEndPosition = position + searchLength;
-        replacement = GetSubstitution(
-            string, position, matchEndPosition, replaceValueString);
-      }
+  // 6. If functionalReplace is false, then
+  if (!functionalReplace) {
+    // a. Let replaceValue be ? ToString(replaceValue).
+    replaceValueArg = ToString_Inline(replaceValue);
+  }
 
-      // c. Let stringSlice be the substring of string consisting of the code
-      //    units from endOfLastMatch (inclusive) up through position
-      //    (exclusive).
-      const stringSlice = string::SubString(
-          string, Unsigned(SmiUntag(endOfLastMatch)),
-          Unsigned(SmiUntag(position)));
+  // 7. Let searchLength be the length of searchString.
+  const searchLength = searchString.length_smi;
+
+  // 8. Let advanceBy be max(1, searchLength).
+  const advanceBy = SmiMax(1, searchLength);
+
+  // We combine the two loops from the spec into one to avoid
+  // needing a growable array.
+  //
+  // 9. Let matchPositions be a new empty List.
+  // 10. Let position be ! StringIndexOf(string, searchString, 0).
+  // 11. Repeat, while position is not -1
+  //   a. Append position to the end of matchPositions.
+  //   b. Let position be ! StringIndexOf(string, searchString,
+  //                                      position + advanceBy).
+  // 12. Let endOfLastMatch be 0.
+  // 13. Let result be the empty string value.
+  // 14. For each position in matchPositions, do
+  let endOfLastMatch: Smi = 0;
+  let result: String = kEmptyString;
+  let position = AbstractStringIndexOf(string, searchString, 0);
+  while (position != -1) {
+    // a. If functionalReplace is true, then
+    // b. Else,
+    let replacement: String;
+    if (functionalReplace) {
+      // i. Let replacement be ? ToString(? Call(replaceValue, undefined,
+      //                                         « searchString, position,
+      //                                           string »).
+      replacement = ToString_Inline(Call(
+          context, UnsafeCast<Callable>(replaceValueArg), Undefined,
+          searchString, position, string));
+    } else {
+      // i. Assert: Type(replaceValue) is String.
+      const replaceValueString = UnsafeCast<String>(replaceValueArg);
+
+      // ii. Let captures be a new empty List.
+      // iii. Let replacement be GetSubstitution(searchString,
+      //                                         string, position, captures,
+      //                                         undefined, replaceValue).
+      // Note: Instead we just call a simpler GetSubstitution primitive.
+      const matchEndPosition = position + searchLength;
+      replacement = GetSubstitution(
+          string, position, matchEndPosition, replaceValueString);
+    }
 
-      // d. Let result be the string-concatenation of result, stringSlice,
-      //    and replacement.
-      // TODO(joshualitt): This leaves a completely degenerate ConsString tree.
-      //                   We could be smarter here.
-      result = result + stringSlice + replacement;
+    // c. Let stringSlice be the substring of string consisting of the code
+    //    units from endOfLastMatch (inclusive) up through position
+    //    (exclusive).
+    const stringSlice = string::SubString(
+        string, Unsigned(SmiUntag(endOfLastMatch)),
+        Unsigned(SmiUntag(position)));
 
-      // e. Let endOfLastMatch be position + searchLength.
-      endOfLastMatch = position + searchLength;
+    // d. Let result be the string-concatenation of result, stringSlice,
+    //    and replacement.
+    // TODO(joshualitt): This leaves a completely degenerate ConsString tree.
+    //                   We could be smarter here.
+    result = result + stringSlice + replacement;
 
-      position =
-          AbstractStringIndexOf(string, searchString, position + advanceBy);
-    }
+    // e. Let endOfLastMatch be position + searchLength.
+    endOfLastMatch = position + searchLength;
 
-    // 15. If endOfLastMatch < the length of string, then
-    if (endOfLastMatch < string.length_smi) {
-      // a. Let result be the string-concatenation of result and the substring
-      //    of string consisting of the code units from endOfLastMatch
-      //    (inclusive) up through the final code unit of string (inclusive).
-      result = result +
-          string::SubString(
-                   string, Unsigned(SmiUntag(endOfLastMatch)),
-                   Unsigned(string.length_intptr));
-    }
+    position =
+        AbstractStringIndexOf(string, searchString, position + advanceBy);
+  }
 
-    // 16. Return result.
-    return result;
+  // 15. If endOfLastMatch < the length of string, then
+  if (endOfLastMatch < string.length_smi) {
+    // a. Let result be the string-concatenation of result and the substring
+    //    of string consisting of the code units from endOfLastMatch
+    //    (inclusive) up through the final code unit of string (inclusive).
+    result = result +
+        string::SubString(
+                 string, Unsigned(SmiUntag(endOfLastMatch)),
+                 Unsigned(string.length_intptr));
   }
+
+  // 16. Return result.
+  return result;
+}
 }
diff --git a/deps/v8/src/builtins/string-slice.tq b/deps/v8/src/builtins/string-slice.tq
index ea95d44a823..71442a28faa 100644
--- a/deps/v8/src/builtins/string-slice.tq
+++ b/deps/v8/src/builtins/string-slice.tq
@@ -3,33 +3,32 @@
 // found in the LICENSE file.
 
 namespace string {
-  // ES6 #sec-string.prototype.slice ( start, end )
-  // https://tc39.github.io/ecma262/#sec-string.prototype.slice
-  transitioning javascript builtin StringPrototypeSlice(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): String {
-    // 1. Let O be ? RequireObjectCoercible(this value).
-    // 2. Let S be ? ToString(O).
-    const string: String = ToThisString(receiver, 'String.prototype.slice');
+// ES6 #sec-string.prototype.slice ( start, end )
+// https://tc39.github.io/ecma262/#sec-string.prototype.slice
+transitioning javascript builtin StringPrototypeSlice(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  // 1. Let O be ? RequireObjectCoercible(this value).
+  // 2. Let S be ? ToString(O).
+  const string: String = ToThisString(receiver, 'String.prototype.slice');
 
-    // 3. Let len be the number of elements in S.
-    const length: uintptr = string.length_uintptr;
+  // 3. Let len be the number of elements in S.
+  const length: uintptr = string.length_uintptr;
 
-    // Convert {start} to a relative index.
-    const arg0 = arguments[0];
-    const start: uintptr =
-        arg0 != Undefined ? ConvertToRelativeIndex(arg0, length) : 0;
+  // Convert {start} to a relative index.
+  const arg0 = arguments[0];
+  const start: uintptr =
+      arg0 != Undefined ? ConvertToRelativeIndex(arg0, length) : 0;
 
-    // 5. If end is undefined, let intEnd be len;
-    // else Convert {end} to a relative index.
-    const arg1 = arguments[1];
-    const end: uintptr =
-        arg1 != Undefined ? ConvertToRelativeIndex(arg1, length) : length;
+  // 5. If end is undefined, let intEnd be len;
+  // else Convert {end} to a relative index.
+  const arg1 = arguments[1];
+  const end: uintptr =
+      arg1 != Undefined ? ConvertToRelativeIndex(arg1, length) : length;
 
-    if (end <= start) {
-      return kEmptyString;
-    }
-
-    return SubString(string, start, end);
+  if (end <= start) {
+    return kEmptyString;
   }
+
+  return SubString(string, start, end);
+}
 }
diff --git a/deps/v8/src/builtins/string-startswith.tq b/deps/v8/src/builtins/string-startswith.tq
index 045722dd824..a1f99df17b7 100644
--- a/deps/v8/src/builtins/string-startswith.tq
+++ b/deps/v8/src/builtins/string-startswith.tq
@@ -5,57 +5,56 @@
 #include 'src/builtins/builtins-regexp-gen.h'
 
 namespace string {
-  // https://tc39.github.io/ecma262/#sec-string.prototype.startswith
-  transitioning javascript builtin StringPrototypeStartsWith(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): Boolean {
-    const searchString: JSAny = arguments[0];
-    const position: JSAny = arguments[1];
-    const kBuiltinName: constexpr string = 'String.prototype.startsWith';
-
-    // 1. Let O be ? RequireObjectCoercible(this value).
-    // 2. Let S be ? ToString(O).
-    const string: String = ToThisString(receiver, kBuiltinName);
-
-    // 3. Let isRegExp be ? IsRegExp(searchString).
-    // 4. If isRegExp is true, throw a TypeError exception.
-    if (regexp::IsRegExp(searchString)) {
-      ThrowTypeError(MessageTemplate::kFirstArgumentNotRegExp, kBuiltinName);
-    }
-
-    // 5. Let searchStr be ? ToString(searchString).
-    const searchStr: String = ToString_Inline(searchString);
-
-    // 8. Let len be the length of S.
-    const len: uintptr = string.length_uintptr;
-
-    // 6. Let pos be ? ToInteger(position).
-    // 7. Assert: If position is undefined, then pos is 0.
-    // 9. Let start be min(max(pos, 0), len).
-    const start: uintptr =
-        (position != Undefined) ? ClampToIndexRange(position, len) : 0;
-
-    // 10. Let searchLength be the length of searchStr.
-    const searchLength: uintptr = searchStr.length_uintptr;
-
-    // 11. If searchLength + start is greater than len, return false.
-    // The comparison is rephrased to be overflow-friendly with unsigned
-    // indices.
-    if (searchLength > len - start) return False;
-
-    // 12. If the sequence of code units of S starting at start of length
-    // searchLength is the same as the full code unit sequence of searchStr,
-    // return true.
-    // 13. Otherwise, return false.
-    try {
-      // Fast Path: If both strings are direct and relevant indices are Smis.
-      return TryFastStringCompareSequence(
-          string, searchStr, start, searchLength) otherwise Slow;
-    }
-    label Slow {
-      // Slow Path: If either of the string is indirect, bail into runtime.
-      return StringCompareSequence(
-          context, string, searchStr, Convert<Number>(start));
-    }
+// https://tc39.github.io/ecma262/#sec-string.prototype.startswith
+transitioning javascript builtin StringPrototypeStartsWith(
+    js-implicit context: NativeContext,
+    receiver: JSAny)(...arguments): Boolean {
+  const searchString: JSAny = arguments[0];
+  const position: JSAny = arguments[1];
+  const kBuiltinName: constexpr string = 'String.prototype.startsWith';
+
+  // 1. Let O be ? RequireObjectCoercible(this value).
+  // 2. Let S be ? ToString(O).
+  const string: String = ToThisString(receiver, kBuiltinName);
+
+  // 3. Let isRegExp be ? IsRegExp(searchString).
+  // 4. If isRegExp is true, throw a TypeError exception.
+  if (regexp::IsRegExp(searchString)) {
+    ThrowTypeError(MessageTemplate::kFirstArgumentNotRegExp, kBuiltinName);
   }
+
+  // 5. Let searchStr be ? ToString(searchString).
+  const searchStr: String = ToString_Inline(searchString);
+
+  // 8. Let len be the length of S.
+  const len: uintptr = string.length_uintptr;
+
+  // 6. Let pos be ? ToInteger(position).
+  // 7. Assert: If position is undefined, then pos is 0.
+  // 9. Let start be min(max(pos, 0), len).
+  const start: uintptr =
+      (position != Undefined) ? ClampToIndexRange(position, len) : 0;
+
+  // 10. Let searchLength be the length of searchStr.
+  const searchLength: uintptr = searchStr.length_uintptr;
+
+  // 11. If searchLength + start is greater than len, return false.
+  // The comparison is rephrased to be overflow-friendly with unsigned
+  // indices.
+  if (searchLength > len - start) return False;
+
+  // 12. If the sequence of code units of S starting at start of length
+  // searchLength is the same as the full code unit sequence of searchStr,
+  // return true.
+  // 13. Otherwise, return false.
+  try {
+    // Fast Path: If both strings are direct and relevant indices are Smis.
+    return TryFastStringCompareSequence(string, searchStr, start, searchLength)
+        otherwise Slow;
+  } label Slow {
+    // Slow Path: If either of the string is indirect, bail into runtime.
+    return StringCompareSequence(
+        context, string, searchStr, Convert<Number>(start));
+  }
+}
 }
diff --git a/deps/v8/src/builtins/string-substr.tq b/deps/v8/src/builtins/string-substr.tq
index 917bee691e0..068c4437ca6 100644
--- a/deps/v8/src/builtins/string-substr.tq
+++ b/deps/v8/src/builtins/string-substr.tq
@@ -4,40 +4,39 @@
 
 namespace string {
 
-  // String.prototype.substr ( start, length )
-  // ES6 #sec-string.prototype.substr
-  transitioning javascript builtin StringPrototypeSubstr(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): String {
-    const methodName: constexpr string = 'String.prototype.substr';
-    // 1. Let O be ? RequireObjectCoercible(this value).
-    // 2. Let S be ? ToString(O).
-    const string: String = ToThisString(receiver, methodName);
+// String.prototype.substr ( start, length )
+// ES6 #sec-string.prototype.substr
+transitioning javascript builtin StringPrototypeSubstr(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  const methodName: constexpr string = 'String.prototype.substr';
+  // 1. Let O be ? RequireObjectCoercible(this value).
+  // 2. Let S be ? ToString(O).
+  const string: String = ToThisString(receiver, methodName);
 
-    // 5. Let size be the number of code units in S.
-    const size: uintptr = string.length_uintptr;
+  // 5. Let size be the number of code units in S.
+  const size: uintptr = string.length_uintptr;
 
-    // 3. Let intStart be ? ToInteger(start).
-    // 6. If intStart < 0, set intStart to max(size + intStart, 0).
-    const start = arguments[0];
-    const initStart: uintptr =
-        start != Undefined ? ConvertToRelativeIndex(start, size) : 0;
+  // 3. Let intStart be ? ToInteger(start).
+  // 6. If intStart < 0, set intStart to max(size + intStart, 0).
+  const start = arguments[0];
+  const initStart: uintptr =
+      start != Undefined ? ConvertToRelativeIndex(start, size) : 0;
 
-    // 4. If length is undefined,
-    //   let end be +∞; otherwise let end be ? ToInteger(length).
-    // 7. Let resultLength be min(max(end, 0), size - intStart).
-    const length = arguments[1];
-    const lengthLimit = size - initStart;
-    assert(lengthLimit <= size);
-    const resultLength: uintptr = length != Undefined ?
-        ClampToIndexRange(length, lengthLimit) :
-        lengthLimit;
+  // 4. If length is undefined,
+  //   let end be +∞; otherwise let end be ? ToInteger(length).
+  // 7. Let resultLength be min(max(end, 0), size - intStart).
+  const length = arguments[1];
+  const lengthLimit = size - initStart;
+  assert(lengthLimit <= size);
+  const resultLength: uintptr = length != Undefined ?
+      ClampToIndexRange(length, lengthLimit) :
+      lengthLimit;
 
-    // 8. If resultLength ≤ 0, return the empty String "".
-    if (resultLength == 0) return EmptyStringConstant();
+  // 8. If resultLength ≤ 0, return the empty String "".
+  if (resultLength == 0) return EmptyStringConstant();
 
-    // 9. Return the String value containing resultLength consecutive code units
-    // from S beginning with the code unit at index intStart.
-    return SubString(string, initStart, initStart + resultLength);
-  }
+  // 9. Return the String value containing resultLength consecutive code units
+  // from S beginning with the code unit at index intStart.
+  return SubString(string, initStart, initStart + resultLength);
+}
 }
diff --git a/deps/v8/src/builtins/string-substring.tq b/deps/v8/src/builtins/string-substring.tq
index e4e7d700003..099a28b5057 100644
--- a/deps/v8/src/builtins/string-substring.tq
+++ b/deps/v8/src/builtins/string-substring.tq
@@ -4,28 +4,26 @@
 
 namespace string {
 
-  // ES6 #sec-string.prototype.substring
-  transitioning javascript builtin StringPrototypeSubstring(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): String {
-    // Check that {receiver} is coercible to Object and convert it to a String.
-    const string: String = ToThisString(receiver, 'String.prototype.substring');
-    const length: uintptr = string.length_uintptr;
+// ES6 #sec-string.prototype.substring
+transitioning javascript builtin StringPrototypeSubstring(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): String {
+  // Check that {receiver} is coercible to Object and convert it to a String.
+  const string: String = ToThisString(receiver, 'String.prototype.substring');
+  const length: uintptr = string.length_uintptr;
 
-    // Conversion and bounds-checks for {start}.
-    const arg0 = arguments[0];
-    let start: uintptr =
-        arg0 != Undefined ? ClampToIndexRange(arg0, length) : 0;
+  // Conversion and bounds-checks for {start}.
+  const arg0 = arguments[0];
+  let start: uintptr = arg0 != Undefined ? ClampToIndexRange(arg0, length) : 0;
 
-    // Conversion and bounds-checks for {end}.
-    const arg1 = arguments[1];
-    let end: uintptr =
-        arg1 != Undefined ? ClampToIndexRange(arg1, length) : length;
-    if (end < start) {
-      const tmp: uintptr = end;
-      end = start;
-      start = tmp;
-    }
-    return SubString(string, start, end);
+  // Conversion and bounds-checks for {end}.
+  const arg1 = arguments[1];
+  let end: uintptr =
+      arg1 != Undefined ? ClampToIndexRange(arg1, length) : length;
+  if (end < start) {
+    const tmp: uintptr = end;
+    end = start;
+    start = tmp;
   }
+  return SubString(string, start, end);
+}
 }
diff --git a/deps/v8/src/builtins/symbol.tq b/deps/v8/src/builtins/symbol.tq
index cda344471fb..18bdebd380e 100644
--- a/deps/v8/src/builtins/symbol.tq
+++ b/deps/v8/src/builtins/symbol.tq
@@ -3,47 +3,45 @@
 // found in the LICENSE file.
 
 namespace symbol {
-  extern runtime SymbolDescriptiveString(implicit context: Context)(Symbol):
-      String;
+extern runtime SymbolDescriptiveString(implicit context: Context)(Symbol):
+    String;
 
-  transitioning macro ThisSymbolValue(implicit context: Context)(
-      receiver: JSAny, method: constexpr string): Symbol {
-    return UnsafeCast<Symbol>(
-        ToThisValue(receiver, PrimitiveType::kSymbol, method));
-  }
+transitioning macro ThisSymbolValue(implicit context: Context)(
+    receiver: JSAny, method: constexpr string): Symbol {
+  return UnsafeCast<Symbol>(
+      ToThisValue(receiver, PrimitiveType::kSymbol, method));
+}
 
-  // ES #sec-symbol.prototype.description
-  transitioning javascript builtin SymbolPrototypeDescriptionGetter(
-      js-implicit context: NativeContext, receiver: JSAny)(): String|Undefined {
-    // 1. Let s be the this value.
-    // 2. Let sym be ? thisSymbolValue(s).
-    const sym: Symbol =
-        ThisSymbolValue(receiver, 'Symbol.prototype.description');
-    // 3. Return sym.[[Description]].
-    return sym.description;
-  }
+// ES #sec-symbol.prototype.description
+transitioning javascript builtin SymbolPrototypeDescriptionGetter(
+    js-implicit context: NativeContext, receiver: JSAny)(): String|Undefined {
+  // 1. Let s be the this value.
+  // 2. Let sym be ? thisSymbolValue(s).
+  const sym: Symbol = ThisSymbolValue(receiver, 'Symbol.prototype.description');
+  // 3. Return sym.[[Description]].
+  return sym.description;
+}
 
-  // ES6 #sec-symbol.prototype-@@toprimitive
-  transitioning javascript builtin SymbolPrototypeToPrimitive(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(_hint: JSAny): JSAny {
-    // 1. Return ? thisSymbolValue(this value).
-    return ThisSymbolValue(receiver, 'Symbol.prototype [ @@toPrimitive ]');
-  }
+// ES6 #sec-symbol.prototype-@@toprimitive
+transitioning javascript builtin SymbolPrototypeToPrimitive(
+    js-implicit context: NativeContext, receiver: JSAny)(_hint: JSAny): JSAny {
+  // 1. Return ? thisSymbolValue(this value).
+  return ThisSymbolValue(receiver, 'Symbol.prototype [ @@toPrimitive ]');
+}
 
-  // ES6 #sec-symbol.prototype.tostring
-  transitioning javascript builtin SymbolPrototypeToString(
-      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
-    // 1. Let sym be ? thisSymbolValue(this value).
-    const sym: Symbol = ThisSymbolValue(receiver, 'Symbol.prototype.toString');
-    // 2. Return SymbolDescriptiveString(sym).
-    return SymbolDescriptiveString(sym);
-  }
+// ES6 #sec-symbol.prototype.tostring
+transitioning javascript builtin SymbolPrototypeToString(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+  // 1. Let sym be ? thisSymbolValue(this value).
+  const sym: Symbol = ThisSymbolValue(receiver, 'Symbol.prototype.toString');
+  // 2. Return SymbolDescriptiveString(sym).
+  return SymbolDescriptiveString(sym);
+}
 
-  // ES6 #sec-symbol.prototype.valueof
-  transitioning javascript builtin SymbolPrototypeValueOf(
-      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
-    // 1. Return ? thisSymbolValue(this value).
-    return ThisSymbolValue(receiver, 'Symbol.prototype.valueOf');
-  }
+// ES6 #sec-symbol.prototype.valueof
+transitioning javascript builtin SymbolPrototypeValueOf(
+    js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+  // 1. Return ? thisSymbolValue(this value).
+  return ThisSymbolValue(receiver, 'Symbol.prototype.valueOf');
+}
 }
diff --git a/deps/v8/src/builtins/torque-internal.tq b/deps/v8/src/builtins/torque-internal.tq
index 85c43342cf1..d2b107f932d 100644
--- a/deps/v8/src/builtins/torque-internal.tq
+++ b/deps/v8/src/builtins/torque-internal.tq
@@ -3,188 +3,189 @@
 // found in the LICENSE file.
 
 namespace torque_internal {
-  // Unsafe is a marker that we require to be passed when calling internal APIs
-  // that might lead to unsoundness when used incorrectly. Unsafe markers should
-  // therefore not be instantiated anywhere outside of this namespace.
-  struct Unsafe {}
-
-  // Size of a type in memory (on the heap). For class types, this is the size
-  // of the pointer, not of the instance.
-  intrinsic %SizeOf<T: type>(): constexpr int31;
-
-  struct Reference<T: type> {
-    const object: HeapObject;
-    const offset: intptr;
-    unsafeMarker: Unsafe;
-  }
-  type ConstReference<T: type> extends Reference<T>;
-  type MutableReference<T: type> extends ConstReference<T>;
-
-  macro UnsafeNewReference<T: type>(object: HeapObject, offset: intptr):&T {
-    return %RawDownCast<&T>(
-        Reference<T>{object: object, offset: offset, unsafeMarker: Unsafe {}});
-  }
-
-  struct Slice<T: type> {
-    macro TryAtIndex(index: intptr):&T labels OutOfBounds {
-      if (Convert<uintptr>(index) < Convert<uintptr>(this.length)) {
-        return UnsafeNewReference<T>(
-            this.object, this.offset + index * %SizeOf<T>());
-      } else {
-        goto OutOfBounds;
-      }
-    }
+// Unsafe is a marker that we require to be passed when calling internal APIs
+// that might lead to unsoundness when used incorrectly. Unsafe markers should
+// therefore not be instantiated anywhere outside of this namespace.
+struct Unsafe {}
+
+// Size of a type in memory (on the heap). For class types, this is the size
+// of the pointer, not of the instance.
+intrinsic %SizeOf<T: type>(): constexpr int31;
+
+struct Reference<T: type> {
+  const object: HeapObject;
+  const offset: intptr;
+  unsafeMarker: Unsafe;
+}
+type ConstReference<T: type> extends Reference<T>;
+type MutableReference<T: type> extends ConstReference<T>;
 
-    macro AtIndex(index: intptr):&T {
-      return this.TryAtIndex(index) otherwise unreachable;
-    }
+namespace unsafe {
+macro NewReference<T: type>(object: HeapObject, offset: intptr):&T {
+  return %RawDownCast<&T>(
+      Reference<T>{object: object, offset: offset, unsafeMarker: Unsafe {}});
+}
+}  // namespace unsafe
 
-    macro AtIndex(index: uintptr):&T {
-      return this.TryAtIndex(Convert<intptr>(index)) otherwise unreachable;
+struct Slice<T: type> {
+  macro TryAtIndex(index: intptr):&T labels OutOfBounds {
+    if (Convert<uintptr>(index) < Convert<uintptr>(this.length)) {
+      return unsafe::NewReference<T>(
+          this.object, this.offset + index * %SizeOf<T>());
+    } else {
+      goto OutOfBounds;
     }
+  }
 
-    macro AtIndex(index: constexpr int31):&T {
-      const i: intptr = Convert<intptr>(index);
-      return this.TryAtIndex(i) otherwise unreachable;
-    }
+  macro AtIndex(index: intptr):&T {
+    return this.TryAtIndex(index) otherwise unreachable;
+  }
 
-    macro AtIndex(index: Smi):&T {
-      const i: intptr = Convert<intptr>(index);
-      return this.TryAtIndex(i) otherwise unreachable;
-    }
+  macro AtIndex(index: uintptr):&T {
+    return this.TryAtIndex(Convert<intptr>(index)) otherwise unreachable;
+  }
 
-    macro Iterator(): SliceIterator<T> {
-      const end = this.offset + this.length * %SizeOf<T>();
-      return SliceIterator<T>{
-        object: this.object,
-        start: this.offset,
-        end: end,
-        unsafeMarker: Unsafe {}
-      };
-    }
-    macro Iterator(startIndex: intptr, endIndex: intptr): SliceIterator<T> {
-      check(
-          Convert<uintptr>(endIndex) <= Convert<uintptr>(this.length) &&
-          Convert<uintptr>(startIndex) <= Convert<uintptr>(endIndex));
-      const start = this.offset + startIndex * %SizeOf<T>();
-      const end = this.offset + endIndex * %SizeOf<T>();
-      return SliceIterator<T>{
-        object: this.object,
-        start,
-        end,
-        unsafeMarker: Unsafe {}
-      };
-    }
+  macro AtIndex(index: constexpr int31):&T {
+    const i: intptr = Convert<intptr>(index);
+    return this.TryAtIndex(i) otherwise unreachable;
+  }
 
-    const object: HeapObject;
-    const offset: intptr;
-    const length: intptr;
-    unsafeMarker: Unsafe;
+  macro AtIndex(index: Smi):&T {
+    const i: intptr = Convert<intptr>(index);
+    return this.TryAtIndex(i) otherwise unreachable;
   }
 
-  macro UnsafeNewSlice<T: type>(
-      object: HeapObject, offset: intptr, length: intptr): Slice<T> {
-    return Slice<T>{
-      object: object,
-      offset: offset,
-      length: length,
+  macro Iterator(): SliceIterator<T> {
+    const end = this.offset + this.length * %SizeOf<T>();
+    return SliceIterator<T>{
+      object: this.object,
+      start: this.offset,
+      end: end,
+      unsafeMarker: Unsafe {}
+    };
+  }
+  macro Iterator(startIndex: intptr, endIndex: intptr): SliceIterator<T> {
+    check(
+        Convert<uintptr>(endIndex) <= Convert<uintptr>(this.length) &&
+        Convert<uintptr>(startIndex) <= Convert<uintptr>(endIndex));
+    const start = this.offset + startIndex * %SizeOf<T>();
+    const end = this.offset + endIndex * %SizeOf<T>();
+    return SliceIterator<T>{
+      object: this.object,
+      start,
+      end,
       unsafeMarker: Unsafe {}
     };
   }
 
-  struct SliceIterator<T: type> {
-    macro Empty(): bool {
-      return this.start == this.end;
-    }
-
-    macro Next(): T labels NoMore {
-      return * this.NextReference() otherwise NoMore;
-    }
+  const object: HeapObject;
+  const offset: intptr;
+  const length: intptr;
+  unsafeMarker: Unsafe;
+}
 
-    macro NextReference():&T labels NoMore {
-      if (this.Empty()) {
-        goto NoMore;
-      } else {
-        const result = UnsafeNewReference<T>(this.object, this.start);
-        this.start += %SizeOf<T>();
-        return result;
-      }
-    }
+macro UnsafeNewSlice<T: type>(
+    object: HeapObject, offset: intptr, length: intptr): Slice<T> {
+  return Slice<T>{
+    object: object,
+    offset: offset,
+    length: length,
+    unsafeMarker: Unsafe {}
+  };
+}
 
-    object: HeapObject;
-    start: intptr;
-    end: intptr;
-    unsafeMarker: Unsafe;
+struct SliceIterator<T: type> {
+  macro Empty(): bool {
+    return this.start == this.end;
   }
 
-  macro AddIndexedFieldSizeToObjectSize(
-      baseSize: intptr, arrayLength: intptr,
-      fieldSize: constexpr int32): intptr {
-    const arrayLength = Convert<int32>(arrayLength);
-    const byteLength = TryInt32Mul(arrayLength, fieldSize)
-        otherwise unreachable;
-    return TryIntPtrAdd(baseSize, Convert<intptr>(byteLength))
-        otherwise unreachable;
+  macro Next(): T labels NoMore {
+    return * this.NextReference() otherwise NoMore;
   }
 
-  macro AlignTagged(x: intptr): intptr {
-    // Round up to a multiple of kTaggedSize.
-    return (x + kObjectAlignmentMask) & ~kObjectAlignmentMask;
+  macro NextReference():&T labels NoMore {
+    if (this.Empty()) {
+      goto NoMore;
+    } else {
+      const result = unsafe::NewReference<T>(this.object, this.start);
+      this.start += %SizeOf<T>();
+      return result;
+    }
   }
 
-  macro IsTaggedAligned(x: intptr): bool {
-    return (x & kObjectAlignmentMask) == 0;
-  }
+  object: HeapObject;
+  start: intptr;
+  end: intptr;
+  unsafeMarker: Unsafe;
+}
 
-  macro ValidAllocationSize(sizeInBytes: intptr, map: Map): bool {
-    if (sizeInBytes <= 0) return false;
-    if (!IsTaggedAligned(sizeInBytes)) return false;
-    const instanceSizeInWords = Convert<intptr>(map.instance_size_in_words);
-    return instanceSizeInWords == kVariableSizeSentinel ||
-        instanceSizeInWords * kTaggedSize == sizeInBytes;
-  }
+macro AddIndexedFieldSizeToObjectSize(
+    baseSize: intptr, arrayLength: intptr, fieldSize: constexpr int32): intptr {
+  const arrayLength = Convert<int32>(arrayLength);
+  const byteLength = TryInt32Mul(arrayLength, fieldSize)
+      otherwise unreachable;
+  return TryIntPtrAdd(baseSize, Convert<intptr>(byteLength))
+      otherwise unreachable;
+}
 
-  type UninitializedHeapObject extends HeapObject;
+macro AlignTagged(x: intptr): intptr {
+  // Round up to a multiple of kTaggedSize.
+  return (x + kObjectAlignmentMask) & ~kObjectAlignmentMask;
+}
 
-  extern macro AllocateAllowLOS(intptr): UninitializedHeapObject;
-  extern macro GetInstanceTypeMap(constexpr InstanceType): Map;
+macro IsTaggedAligned(x: intptr): bool {
+  return (x & kObjectAlignmentMask) == 0;
+}
 
-  macro Allocate(sizeInBytes: intptr, map: Map): UninitializedHeapObject {
-    assert(ValidAllocationSize(sizeInBytes, map));
-    return AllocateAllowLOS(sizeInBytes);
-  }
+macro ValidAllocationSize(sizeInBytes: intptr, map: Map): bool {
+  if (sizeInBytes <= 0) return false;
+  if (!IsTaggedAligned(sizeInBytes)) return false;
+  const instanceSizeInWords = Convert<intptr>(map.instance_size_in_words);
+  return instanceSizeInWords == kVariableSizeSentinel ||
+      instanceSizeInWords * kTaggedSize == sizeInBytes;
+}
 
-  macro InitializeFieldsFromIterator<T: type, Iterator: type>(
-      target: Slice<T>, originIterator: Iterator) {
-    let targetIterator = target.Iterator();
-    let originIterator = originIterator;
-    while (true) {
-      const ref:&T = targetIterator.NextReference() otherwise break;
-      * ref = originIterator.Next() otherwise unreachable;
-    }
-  }
-  // Dummy implementations: do not initialize for UninitializedIterator.
-  InitializeFieldsFromIterator<char8, UninitializedIterator>(
-      _target: Slice<char8>, _originIterator: UninitializedIterator) {}
-  InitializeFieldsFromIterator<char16, UninitializedIterator>(
-      _target: Slice<char16>, _originIterator: UninitializedIterator) {}
-
-  extern macro IsDoubleHole(HeapObject, intptr): bool;
-  extern macro StoreDoubleHole(HeapObject, intptr);
-
-  macro LoadFloat64OrHole(r:&float64_or_hole): float64_or_hole {
-    return float64_or_hole{
-      is_hole: IsDoubleHole(r.object, r.offset - kHeapObjectTag),
-      value: * UnsafeNewReference<float64>(r.object, r.offset)
-    };
+type UninitializedHeapObject extends HeapObject;
+
+extern macro AllocateAllowLOS(intptr): UninitializedHeapObject;
+extern macro GetInstanceTypeMap(constexpr InstanceType): Map;
+
+macro Allocate(sizeInBytes: intptr, map: Map): UninitializedHeapObject {
+  assert(ValidAllocationSize(sizeInBytes, map));
+  return AllocateAllowLOS(sizeInBytes);
+}
+
+macro InitializeFieldsFromIterator<T: type, Iterator: type>(
+    target: Slice<T>, originIterator: Iterator) {
+  let targetIterator = target.Iterator();
+  let originIterator = originIterator;
+  while (true) {
+    const ref:&T = targetIterator.NextReference() otherwise break;
+    * ref = originIterator.Next() otherwise unreachable;
   }
-  macro StoreFloat64OrHole(r:&float64_or_hole, value: float64_or_hole) {
-    if (value.is_hole) {
-      StoreDoubleHole(r.object, r.offset - kHeapObjectTag);
-    } else {
-      * UnsafeNewReference<float64>(r.object, r.offset) = value.value;
-    }
+}
+// Dummy implementations: do not initialize for UninitializedIterator.
+InitializeFieldsFromIterator<char8, UninitializedIterator>(
+    _target: Slice<char8>, _originIterator: UninitializedIterator) {}
+InitializeFieldsFromIterator<char16, UninitializedIterator>(
+    _target: Slice<char16>, _originIterator: UninitializedIterator) {}
+
+extern macro IsDoubleHole(HeapObject, intptr): bool;
+extern macro StoreDoubleHole(HeapObject, intptr);
+
+macro LoadFloat64OrHole(r:&float64_or_hole): float64_or_hole {
+  return float64_or_hole{
+    is_hole: IsDoubleHole(r.object, r.offset - kHeapObjectTag),
+    value: * unsafe::NewReference<float64>(r.object, r.offset)
+  };
+}
+macro StoreFloat64OrHole(r:&float64_or_hole, value: float64_or_hole) {
+  if (value.is_hole) {
+    StoreDoubleHole(r.object, r.offset - kHeapObjectTag);
+  } else {
+    * unsafe::NewReference<float64>(r.object, r.offset) = value.value;
   }
+}
 }  // namespace torque_internal
 
 // Indicates that an array-field should not be initialized.
diff --git a/deps/v8/src/builtins/typed-array-createtypedarray.tq b/deps/v8/src/builtins/typed-array-createtypedarray.tq
index e5398fc50ac..ec51efc00ab 100644
--- a/deps/v8/src/builtins/typed-array-createtypedarray.tq
+++ b/deps/v8/src/builtins/typed-array-createtypedarray.tq
@@ -5,452 +5,431 @@
 #include 'src/builtins/builtins-constructor-gen.h'
 
 namespace typed_array {
-  extern builtin IterableToListMayPreserveHoles(Context, Object, Callable):
-      JSArray;
-
-  extern macro TypedArrayBuiltinsAssembler::AllocateEmptyOnHeapBuffer(
-      implicit context: Context)(uintptr): JSArrayBuffer;
-  extern macro CodeStubAssembler::AllocateByteArray(uintptr): ByteArray;
-  extern macro TypedArrayBuiltinsAssembler::GetDefaultConstructor(
-      implicit context: Context)(JSTypedArray): JSFunction;
-  extern macro TypedArrayBuiltinsAssembler::SetupTypedArrayEmbedderFields(
-      JSTypedArray): void;
-
-  extern runtime ThrowInvalidTypedArrayAlignment(implicit context: Context)(
-      Map, String): never;
-
-  transitioning macro AllocateTypedArray(implicit context: Context)(
-      isOnHeap: constexpr bool, map: Map, buffer: JSArrayBuffer,
-      byteOffset: uintptr, byteLength: uintptr, length: uintptr): JSTypedArray {
-    let elements: ByteArray;
-    if constexpr (isOnHeap) {
-      elements = AllocateByteArray(byteLength);
-    } else {
-      elements = kEmptyByteArray;
-
-      // The max byteOffset is 8 * MaxSmi on the particular platform. 32 bit
-      // platforms are self-limiting, because we can't allocate an array bigger
-      // than our 32-bit arithmetic range anyway. 64 bit platforms could
-      // theoretically have an offset up to 2^35 - 1.
-      const backingStore: uintptr = Convert<uintptr>(buffer.backing_store);
-
-      // Assert no overflow has occurred. Only assert if the mock array buffer
-      // allocator is NOT used. When the mock array buffer is used, impossibly
-      // large allocations are allowed that would erroneously cause an overflow
-      // and this assertion to fail.
-      assert(
-          IsMockArrayBufferAllocatorFlag() ||
-          (backingStore + byteOffset) >= backingStore);
-    }
-
-    // We can't just build the new object with "new JSTypedArray" here because
-    // Torque doesn't know its full size including embedder fields, so use CSA
-    // for the allocation step.
-    const typedArray =
-        UnsafeCast<JSTypedArray>(AllocateFastOrSlowJSObjectFromMap(map));
-    typedArray.elements = elements;
-    typedArray.buffer = buffer;
-    typedArray.byte_offset = byteOffset;
-    typedArray.byte_length = byteLength;
-    typedArray.length = length;
-    if constexpr (isOnHeap) {
-      typed_array::SetJSTypedArrayOnHeapDataPtr(
-          typedArray, elements, byteOffset);
-    } else {
-      typed_array::SetJSTypedArrayOffHeapDataPtr(
-          typedArray, buffer.backing_store, byteOffset);
-      assert(
-          typedArray.data_ptr ==
-          (buffer.backing_store + Convert<intptr>(byteOffset)));
-    }
-    SetupTypedArrayEmbedderFields(typedArray);
-    return typedArray;
+extern builtin IterableToListMayPreserveHoles(
+    Context, Object, Callable): JSArray;
+
+extern macro TypedArrayBuiltinsAssembler::AllocateEmptyOnHeapBuffer(
+    implicit context: Context)(uintptr): JSArrayBuffer;
+extern macro CodeStubAssembler::AllocateByteArray(uintptr): ByteArray;
+extern macro TypedArrayBuiltinsAssembler::GetDefaultConstructor(
+    implicit context: Context)(JSTypedArray): JSFunction;
+extern macro TypedArrayBuiltinsAssembler::SetupTypedArrayEmbedderFields(
+    JSTypedArray): void;
+
+extern runtime ThrowInvalidTypedArrayAlignment(implicit context: Context)(
+    Map, String): never;
+
+transitioning macro AllocateTypedArray(implicit context: Context)(
+    isOnHeap: constexpr bool, map: Map, buffer: JSArrayBuffer,
+    byteOffset: uintptr, byteLength: uintptr, length: uintptr): JSTypedArray {
+  let elements: ByteArray;
+  if constexpr (isOnHeap) {
+    elements = AllocateByteArray(byteLength);
+  } else {
+    elements = kEmptyByteArray;
+
+    // The max byteOffset is 8 * MaxSmi on the particular platform. 32 bit
+    // platforms are self-limiting, because we can't allocate an array bigger
+    // than our 32-bit arithmetic range anyway. 64 bit platforms could
+    // theoretically have an offset up to 2^35 - 1.
+    const backingStore: uintptr = Convert<uintptr>(buffer.backing_store_ptr);
+
+    // Assert no overflow has occurred. Only assert if the mock array buffer
+    // allocator is NOT used. When the mock array buffer is used, impossibly
+    // large allocations are allowed that would erroneously cause an overflow
+    // and this assertion to fail.
+    assert(
+        IsMockArrayBufferAllocatorFlag() ||
+        (backingStore + byteOffset) >= backingStore);
   }
 
-  transitioning macro TypedArrayInitialize(implicit context: Context)(
-      initialize: constexpr bool, map: Map, length: uintptr,
-      elementsInfo: typed_array::TypedArrayElementsInfo,
-      bufferConstructor: JSReceiver): JSTypedArray labels IfRangeError {
-    const byteLength = elementsInfo.CalculateByteLength(length)
-        otherwise IfRangeError;
-    const byteLengthNum = Convert<Number>(byteLength);
-    const defaultConstructor = GetArrayBufferFunction();
-    const byteOffset: uintptr = 0;
-
-    try {
-      if (bufferConstructor != defaultConstructor) {
-        goto AttachOffHeapBuffer(ConstructWithTarget(
-            defaultConstructor, bufferConstructor, byteLengthNum));
-      }
+  // We can't just build the new object with "new JSTypedArray" here because
+  // Torque doesn't know its full size including embedder fields, so use CSA
+  // for the allocation step.
+  const typedArray =
+      UnsafeCast<JSTypedArray>(AllocateFastOrSlowJSObjectFromMap(map));
+  typedArray.elements = elements;
+  typedArray.buffer = buffer;
+  typedArray.byte_offset = byteOffset;
+  typedArray.byte_length = byteLength;
+  typedArray.length = length;
+  if constexpr (isOnHeap) {
+    typed_array::SetJSTypedArrayOnHeapDataPtr(typedArray, elements, byteOffset);
+  } else {
+    typed_array::SetJSTypedArrayOffHeapDataPtr(
+        typedArray, buffer.backing_store_ptr, byteOffset);
+    assert(
+        typedArray.data_ptr ==
+        (buffer.backing_store_ptr + Convert<intptr>(byteOffset)));
+  }
+  SetupTypedArrayEmbedderFields(typedArray);
+  return typedArray;
+}
 
-      if (byteLength > kMaxTypedArrayInHeap) goto AllocateOffHeap;
+transitioning macro TypedArrayInitialize(implicit context: Context)(
+    initialize: constexpr bool, map: Map, length: uintptr,
+    elementsInfo: typed_array::TypedArrayElementsInfo,
+    bufferConstructor: JSReceiver): JSTypedArray labels IfRangeError {
+  const byteLength = elementsInfo.CalculateByteLength(length)
+      otherwise IfRangeError;
+  const byteLengthNum = Convert<Number>(byteLength);
+  const defaultConstructor = GetArrayBufferFunction();
+  const byteOffset: uintptr = 0;
+
+  try {
+    if (bufferConstructor != defaultConstructor) {
+      goto AttachOffHeapBuffer(ConstructWithTarget(
+          defaultConstructor, bufferConstructor, byteLengthNum));
+    }
 
-      const buffer = AllocateEmptyOnHeapBuffer(byteLength);
+    if (byteLength > kMaxTypedArrayInHeap) goto AllocateOffHeap;
 
-      const isOnHeap: constexpr bool = true;
-      const typedArray = AllocateTypedArray(
-          isOnHeap, map, buffer, byteOffset, byteLength, length);
+    const buffer = AllocateEmptyOnHeapBuffer(byteLength);
 
-      if constexpr (initialize) {
-        const backingStore = typedArray.data_ptr;
-        typed_array::CallCMemset(backingStore, 0, byteLength);
-      }
+    const isOnHeap: constexpr bool = true;
+    const typedArray = AllocateTypedArray(
+        isOnHeap, map, buffer, byteOffset, byteLength, length);
 
-      return typedArray;
+    if constexpr (initialize) {
+      const backingStore = typedArray.data_ptr;
+      typed_array::CallCMemset(backingStore, 0, byteLength);
     }
-    label AllocateOffHeap {
-      if constexpr (initialize) {
-        goto AttachOffHeapBuffer(Construct(defaultConstructor, byteLengthNum));
-      } else {
-        goto AttachOffHeapBuffer(Call(
-            context, GetArrayBufferNoInitFunction(), Undefined, byteLengthNum));
-      }
-    }
-    label AttachOffHeapBuffer(bufferObj: Object) {
-      const buffer = Cast<JSArrayBuffer>(bufferObj) otherwise unreachable;
-      const isOnHeap: constexpr bool = false;
-      return AllocateTypedArray(
-          isOnHeap, map, buffer, byteOffset, byteLength, length);
+
+    return typedArray;
+  } label AllocateOffHeap {
+    if constexpr (initialize) {
+      goto AttachOffHeapBuffer(Construct(defaultConstructor, byteLengthNum));
+    } else {
+      goto AttachOffHeapBuffer(Call(
+          context, GetArrayBufferNoInitFunction(), Undefined, byteLengthNum));
     }
+  } label AttachOffHeapBuffer(bufferObj: Object) {
+    const buffer = Cast<JSArrayBuffer>(bufferObj) otherwise unreachable;
+    const isOnHeap: constexpr bool = false;
+    return AllocateTypedArray(
+        isOnHeap, map, buffer, byteOffset, byteLength, length);
   }
+}
 
-  // 22.2.4.2 TypedArray ( length )
-  // ES #sec-typedarray-length
-  transitioning macro ConstructByLength(implicit context: Context)(
-      map: Map, lengthObj: JSAny,
-      elementsInfo: typed_array::TypedArrayElementsInfo): JSTypedArray {
-    try {
-      const length: uintptr = ToIndex(lengthObj) otherwise RangeError;
-      const defaultConstructor: Constructor = GetArrayBufferFunction();
-      const initialize: constexpr bool = true;
-      return TypedArrayInitialize(
-          initialize, map, length, elementsInfo, defaultConstructor)
-          otherwise RangeError;
-    }
-    label RangeError deferred {
-      ThrowRangeError(MessageTemplate::kInvalidTypedArrayLength, lengthObj);
-    }
+// 22.2.4.2 TypedArray ( length )
+// ES #sec-typedarray-length
+transitioning macro ConstructByLength(implicit context: Context)(
+    map: Map, lengthObj: JSAny,
+    elementsInfo: typed_array::TypedArrayElementsInfo): JSTypedArray {
+  try {
+    const length: uintptr = ToIndex(lengthObj) otherwise RangeError;
+    const defaultConstructor: Constructor = GetArrayBufferFunction();
+    const initialize: constexpr bool = true;
+    return TypedArrayInitialize(
+        initialize, map, length, elementsInfo, defaultConstructor)
+        otherwise RangeError;
+  } label RangeError deferred {
+    ThrowRangeError(MessageTemplate::kInvalidTypedArrayLength, lengthObj);
   }
+}
+
+// 22.2.4.4 TypedArray ( object )
+// ES #sec-typedarray-object
+transitioning macro ConstructByArrayLike(implicit context: Context)(
+    map: Map, arrayLike: HeapObject, length: uintptr,
+    elementsInfo: typed_array::TypedArrayElementsInfo,
+    bufferConstructor: JSReceiver): JSTypedArray {
+  try {
+    const initialize: constexpr bool = false;
+    const typedArray = TypedArrayInitialize(
+        initialize, map, length, elementsInfo, bufferConstructor)
+        otherwise RangeError;
 
-  // 22.2.4.4 TypedArray ( object )
-  // ES #sec-typedarray-object
-  transitioning macro ConstructByArrayLike(implicit context: Context)(
-      map: Map, arrayLike: HeapObject, length: uintptr,
-      elementsInfo: typed_array::TypedArrayElementsInfo,
-      bufferConstructor: JSReceiver): JSTypedArray {
     try {
-      const initialize: constexpr bool = false;
-      const typedArray = TypedArrayInitialize(
-          initialize, map, length, elementsInfo, bufferConstructor)
-          otherwise RangeError;
-
-      try {
-        const src: JSTypedArray =
-            Cast<JSTypedArray>(arrayLike) otherwise IfSlow;
-
-        if (IsDetachedBuffer(src.buffer)) {
-          ThrowTypeError(MessageTemplate::kDetachedOperation, 'Construct');
-
-        } else if (src.elements_kind != elementsInfo.kind) {
-          goto IfSlow;
-
-        } else if (length > 0) {
-          const byteLength = typedArray.byte_length;
-          assert(byteLength <= kArrayBufferMaxByteLength);
-          typed_array::CallCMemcpy(
-              typedArray.data_ptr, src.data_ptr, byteLength);
-        }
+      const src: JSTypedArray = Cast<JSTypedArray>(arrayLike) otherwise IfSlow;
+
+      if (IsDetachedBuffer(src.buffer)) {
+        ThrowTypeError(MessageTemplate::kDetachedOperation, 'Construct');
+
+      } else if (src.elements_kind != elementsInfo.kind) {
+        goto IfSlow;
+
+      } else if (length > 0) {
+        const byteLength = typedArray.byte_length;
+        assert(byteLength <= kArrayBufferMaxByteLength);
+        typed_array::CallCMemcpy(typedArray.data_ptr, src.data_ptr, byteLength);
       }
-      label IfSlow deferred {
-        if (length > 0) {
-          TypedArrayCopyElements(
-              context, typedArray, arrayLike, Convert<Number>(length));
-        }
+    } label IfSlow deferred {
+      if (length > 0) {
+        TypedArrayCopyElements(
+            context, typedArray, arrayLike, Convert<Number>(length));
       }
-      return typedArray;
-    }
-    label RangeError deferred {
-      ThrowRangeError(
-          MessageTemplate::kInvalidTypedArrayLength, Convert<Number>(length));
     }
+    return typedArray;
+  } label RangeError deferred {
+    ThrowRangeError(
+        MessageTemplate::kInvalidTypedArrayLength, Convert<Number>(length));
   }
+}
 
-  // 22.2.4.4 TypedArray ( object )
-  // ES #sec-typedarray-object
-  transitioning macro ConstructByIterable(implicit context: Context)(
-      iterable: JSReceiver, iteratorFn: Callable): never
-      labels IfConstructByArrayLike(JSArray, uintptr, JSReceiver) {
-    const array: JSArray =
-        IterableToListMayPreserveHoles(context, iterable, iteratorFn);
-    // Max JSArray length is a valid JSTypedArray length so we just use it.
-    goto IfConstructByArrayLike(
-        array, array.length_uintptr, GetArrayBufferFunction());
-  }
+// 22.2.4.4 TypedArray ( object )
+// ES #sec-typedarray-object
+transitioning macro ConstructByIterable(implicit context: Context)(
+    iterable: JSReceiver, iteratorFn: Callable): never
+    labels IfConstructByArrayLike(JSArray, uintptr, JSReceiver) {
+  const array: JSArray =
+      IterableToListMayPreserveHoles(context, iterable, iteratorFn);
+  // Max JSArray length is a valid JSTypedArray length so we just use it.
+  goto IfConstructByArrayLike(
+      array, array.length_uintptr, GetArrayBufferFunction());
+}
 
-  // 22.2.4.3 TypedArray ( typedArray )
-  // ES #sec-typedarray-typedarray
-  transitioning macro ConstructByTypedArray(implicit context: Context)(
-      srcTypedArray: JSTypedArray): never
-      labels IfConstructByArrayLike(JSTypedArray, uintptr, JSReceiver) {
-    let bufferConstructor: JSReceiver = GetArrayBufferFunction();
-    const srcBuffer: JSArrayBuffer = srcTypedArray.buffer;
+// 22.2.4.3 TypedArray ( typedArray )
+// ES #sec-typedarray-typedarray
+transitioning macro ConstructByTypedArray(implicit context: Context)(
+    srcTypedArray: JSTypedArray): never
+    labels IfConstructByArrayLike(JSTypedArray, uintptr, JSReceiver) {
+  let bufferConstructor: JSReceiver = GetArrayBufferFunction();
+  const srcBuffer: JSArrayBuffer = srcTypedArray.buffer;
+  // TODO(petermarshall): Throw on detached typedArray.
+  let length: uintptr = IsDetachedBuffer(srcBuffer) ? 0 : srcTypedArray.length;
+
+  // The spec requires that constructing a typed array using a SAB-backed
+  // typed array use the ArrayBuffer constructor, not the species constructor.
+  // See https://tc39.github.io/ecma262/#sec-typedarray-typedarray.
+  if (!IsSharedArrayBuffer(srcBuffer)) {
+    bufferConstructor = SpeciesConstructor(srcBuffer, bufferConstructor);
     // TODO(petermarshall): Throw on detached typedArray.
-    let length: uintptr =
-        IsDetachedBuffer(srcBuffer) ? 0 : srcTypedArray.length;
-
-    // The spec requires that constructing a typed array using a SAB-backed
-    // typed array use the ArrayBuffer constructor, not the species constructor.
-    // See https://tc39.github.io/ecma262/#sec-typedarray-typedarray.
-    if (!IsSharedArrayBuffer(srcBuffer)) {
-      bufferConstructor = SpeciesConstructor(srcBuffer, bufferConstructor);
-      // TODO(petermarshall): Throw on detached typedArray.
-      if (IsDetachedBuffer(srcBuffer)) length = 0;
-    }
-    goto IfConstructByArrayLike(srcTypedArray, length, bufferConstructor);
+    if (IsDetachedBuffer(srcBuffer)) length = 0;
   }
+  goto IfConstructByArrayLike(srcTypedArray, length, bufferConstructor);
+}
 
-  // 22.2.4.5 TypedArray ( buffer, byteOffset, length )
-  // ES #sec-typedarray-buffer-byteoffset-length
-  transitioning macro ConstructByArrayBuffer(implicit context: Context)(
-      map: Map, buffer: JSArrayBuffer, byteOffset: JSAny, length: JSAny,
-      elementsInfo: typed_array::TypedArrayElementsInfo): JSTypedArray {
-    try {
-      // 6. Let offset be ? ToIndex(byteOffset).
-      const offset: uintptr = ToIndex(byteOffset) otherwise IfInvalidOffset;
+// 22.2.4.5 TypedArray ( buffer, byteOffset, length )
+// ES #sec-typedarray-buffer-byteoffset-length
+transitioning macro ConstructByArrayBuffer(implicit context: Context)(
+    map: Map, buffer: JSArrayBuffer, byteOffset: JSAny, length: JSAny,
+    elementsInfo: typed_array::TypedArrayElementsInfo): JSTypedArray {
+  try {
+    // 6. Let offset be ? ToIndex(byteOffset).
+    const offset: uintptr = ToIndex(byteOffset) otherwise IfInvalidOffset;
+
+    // 7. If offset modulo elementSize ≠ 0, throw a RangeError exception.
+    if (elementsInfo.IsUnaligned(offset)) {
+      goto IfInvalidAlignment('start offset');
+    }
 
-      // 7. If offset modulo elementSize ≠ 0, throw a RangeError exception.
-      if (elementsInfo.IsUnaligned(offset)) {
-        goto IfInvalidAlignment('start offset');
-      }
+    // 8. If length is present and length is not undefined, then
+    // a. Let newLength be ? ToIndex(length).
+    let newLength: uintptr = ToIndex(length) otherwise IfInvalidLength;
+    let newByteLength: uintptr;
 
-      // 8. If length is present and length is not undefined, then
-      // a. Let newLength be ? ToIndex(length).
-      let newLength: uintptr = ToIndex(length) otherwise IfInvalidLength;
-      let newByteLength: uintptr;
+    // 9. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+    if (IsDetachedBuffer(buffer)) {
+      ThrowTypeError(MessageTemplate::kDetachedOperation, 'Construct');
+    }
 
-      // 9. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
-      if (IsDetachedBuffer(buffer)) {
-        ThrowTypeError(MessageTemplate::kDetachedOperation, 'Construct');
-      }
+    // 10. Let bufferByteLength be buffer.[[ArrayBufferByteLength]].
+    const bufferByteLength: uintptr = buffer.byte_length;
 
-      // 10. Let bufferByteLength be buffer.[[ArrayBufferByteLength]].
-      const bufferByteLength: uintptr = buffer.byte_length;
-
-      // 11. If length is either not present or undefined, then
-      if (length == Undefined) {
-        // a. If bufferByteLength modulo elementSize ≠ 0, throw a RangeError
-        // exception.
-        if (elementsInfo.IsUnaligned(bufferByteLength)) {
-          goto IfInvalidAlignment('byte length');
-        }
-
-        // b. Let newByteLength be bufferByteLength - offset.
-        // c. If newByteLength < 0, throw a RangeError exception.
-        if (bufferByteLength < offset) goto IfInvalidOffset;
-
-        // Spec step 16 length calculated here to avoid recalculating the length
-        // in the step 12 branch.
-        newByteLength = bufferByteLength - offset;
-        newLength = elementsInfo.CalculateLength(newByteLength)
-            otherwise IfInvalidOffset;
-
-        // 12. Else,
-      } else {
-        // a. Let newByteLength be newLength × elementSize.
-        newByteLength = elementsInfo.CalculateByteLength(newLength)
-            otherwise IfInvalidLength;
-
-        // b. If offset + newByteLength > bufferByteLength, throw a RangeError
-        // exception.
-        if ((bufferByteLength < newByteLength) ||
-            (offset > bufferByteLength - newByteLength))
-          goto IfInvalidLength;
+    // 11. If length is either not present or undefined, then
+    if (length == Undefined) {
+      // a. If bufferByteLength modulo elementSize ≠ 0, throw a RangeError
+      // exception.
+      if (elementsInfo.IsUnaligned(bufferByteLength)) {
+        goto IfInvalidAlignment('byte length');
       }
 
-      const isOnHeap: constexpr bool = false;
-      return AllocateTypedArray(
-          isOnHeap, map, buffer, offset, newByteLength, newLength);
-    }
-    label IfInvalidAlignment(problemString: String) deferred {
-      ThrowInvalidTypedArrayAlignment(map, problemString);
-    }
-    label IfInvalidLength deferred {
-      ThrowRangeError(MessageTemplate::kInvalidTypedArrayLength, length);
-    }
-    label IfInvalidOffset deferred {
-      ThrowRangeError(MessageTemplate::kInvalidOffset, byteOffset);
-    }
-  }
+      // b. Let newByteLength be bufferByteLength - offset.
+      // c. If newByteLength < 0, throw a RangeError exception.
+      if (bufferByteLength < offset) goto IfInvalidOffset;
 
-  // 22.2.4.6 TypedArrayCreate ( constructor, argumentList )
-  // ES #typedarray-create
-  @export
-  transitioning macro TypedArrayCreateByLength(implicit context: Context)(
-      constructor: Constructor, length: Number, methodName: constexpr string):
-      JSTypedArray {
-    assert(IsSafeInteger(length));
+      // Spec step 16 length calculated here to avoid recalculating the length
+      // in the step 12 branch.
+      newByteLength = bufferByteLength - offset;
+      newLength = elementsInfo.CalculateLength(newByteLength)
+          otherwise IfInvalidOffset;
 
-    // 1. Let newTypedArray be ? Construct(constructor, argumentList).
-    const newTypedArrayObj = Construct(constructor, length);
+      // 12. Else,
+    } else {
+      // a. Let newByteLength be newLength × elementSize.
+      newByteLength = elementsInfo.CalculateByteLength(newLength)
+          otherwise IfInvalidLength;
+
+      // b. If offset + newByteLength > bufferByteLength, throw a RangeError
+      // exception.
+      if ((bufferByteLength < newByteLength) ||
+          (offset > bufferByteLength - newByteLength))
+        goto IfInvalidLength;
+    }
 
-    // 2. Perform ? ValidateTypedArray(newTypedArray).
-    //    ValidateTypedArray currently returns the array, not the ViewBuffer.
-    const newTypedArray: JSTypedArray =
-        ValidateTypedArray(context, newTypedArrayObj, methodName);
+    const isOnHeap: constexpr bool = false;
+    return AllocateTypedArray(
+        isOnHeap, map, buffer, offset, newByteLength, newLength);
+  } label IfInvalidAlignment(problemString: String) deferred {
+    ThrowInvalidTypedArrayAlignment(map, problemString);
+  } label IfInvalidLength deferred {
+    ThrowRangeError(MessageTemplate::kInvalidTypedArrayLength, length);
+  } label IfInvalidOffset deferred {
+    ThrowRangeError(MessageTemplate::kInvalidOffset, byteOffset);
+  }
+}
 
-    if (IsDetachedBuffer(newTypedArray.buffer)) deferred {
-        ThrowTypeError(MessageTemplate::kDetachedOperation, methodName);
-      }
+// 22.2.4.6 TypedArrayCreate ( constructor, argumentList )
+// ES #typedarray-create
+@export
+transitioning macro TypedArrayCreateByLength(implicit context: Context)(
+    constructor: Constructor, length: Number, methodName: constexpr string):
+    JSTypedArray {
+  assert(IsSafeInteger(length));
 
-    // 3. If argumentList is a List of a single Number, then
-    //   a. If newTypedArray.[[ArrayLength]] < argumentList[0], throw a
-    //      TypeError exception.
-    if (newTypedArray.length < Convert<uintptr>(length)) deferred {
-        ThrowTypeError(MessageTemplate::kTypedArrayTooShort);
-      }
+  // 1. Let newTypedArray be ? Construct(constructor, argumentList).
+  const newTypedArrayObj = Construct(constructor, length);
 
-    // 4. Return newTypedArray.
-    return newTypedArray;
-  }
+  // 2. Perform ? ValidateTypedArray(newTypedArray).
+  //    ValidateTypedArray currently returns the array, not the ViewBuffer.
+  const newTypedArray: JSTypedArray =
+      ValidateTypedArray(context, newTypedArrayObj, methodName);
 
-  transitioning macro ConstructByJSReceiver(implicit context:
-                                                Context)(obj: JSReceiver): never
-      labels IfConstructByArrayLike(JSReceiver, uintptr, JSReceiver) {
-    try {
-      // TODO(v8:8906): Use iterator::GetIteratorMethod() once it supports
-      // labels.
-      const iteratorMethod = GetMethod(obj, IteratorSymbolConstant())
-          otherwise IfIteratorUndefined, IfIteratorNotCallable;
-      ConstructByIterable(obj, iteratorMethod)
-          otherwise IfConstructByArrayLike;
-    }
-    label IfIteratorUndefined {
-      const lengthObj: JSAny = GetProperty(obj, kLengthString);
-      const lengthNumber: Number = ToLength_Inline(lengthObj);
-      // Throw RangeError here if the length does not fit in uintptr because
-      // such a length will not pass bounds checks in ConstructByArrayLike()
-      // anyway.
-      const length: uintptr = ChangeSafeIntegerNumberToUintPtr(lengthNumber)
-          otherwise goto IfInvalidLength(lengthNumber);
-      goto IfConstructByArrayLike(obj, length, GetArrayBufferFunction());
-    }
-    label IfInvalidLength(length: Number) {
-      ThrowRangeError(MessageTemplate::kInvalidTypedArrayLength, length);
+  if (IsDetachedBuffer(newTypedArray.buffer)) deferred {
+      ThrowTypeError(MessageTemplate::kDetachedOperation, methodName);
     }
-    label IfIteratorNotCallable(_value: JSAny) deferred {
-      ThrowTypeError(MessageTemplate::kIteratorSymbolNonCallable);
+
+  // 3. If argumentList is a List of a single Number, then
+  //   a. If newTypedArray.[[ArrayLength]] < argumentList[0], throw a
+  //      TypeError exception.
+  if (newTypedArray.length < Convert<uintptr>(length)) deferred {
+      ThrowTypeError(MessageTemplate::kTypedArrayTooShort);
     }
-  }
 
-  // 22.2.4 The TypedArray Constructors
-  // ES #sec-typedarray-constructors
-  transitioning builtin CreateTypedArray(
-      context: Context, target: JSFunction, newTarget: JSReceiver, arg1: JSAny,
-      arg2: JSAny, arg3: JSAny): JSTypedArray {
-    assert(IsConstructor(target));
-    // 4. Let O be ? AllocateTypedArray(constructorName, NewTarget,
-    // "%TypedArrayPrototype%").
-    const map = GetDerivedMap(target, newTarget);
+  // 4. Return newTypedArray.
+  return newTypedArray;
+}
 
-    // 5. Let elementSize be the Number value of the Element Size value in Table
-    // 56 for constructorName.
-    const elementsInfo = GetTypedArrayElementsInfo(map);
+transitioning macro ConstructByJSReceiver(implicit context: Context)(
+    obj: JSReceiver): never
+    labels IfConstructByArrayLike(JSReceiver, uintptr, JSReceiver) {
+  try {
+    // TODO(v8:8906): Use iterator::GetIteratorMethod() once it supports
+    // labels.
+    const iteratorMethod = GetMethod(obj, IteratorSymbolConstant())
+        otherwise IfIteratorUndefined, IfIteratorNotCallable;
+    ConstructByIterable(obj, iteratorMethod)
+        otherwise IfConstructByArrayLike;
+  } label IfIteratorUndefined {
+    const lengthObj: JSAny = GetProperty(obj, kLengthString);
+    const lengthNumber: Number = ToLength_Inline(lengthObj);
+    // Throw RangeError here if the length does not fit in uintptr because
+    // such a length will not pass bounds checks in ConstructByArrayLike()
+    // anyway.
+    const length: uintptr = ChangeSafeIntegerNumberToUintPtr(lengthNumber)
+        otherwise goto IfInvalidLength(lengthNumber);
+    goto IfConstructByArrayLike(obj, length, GetArrayBufferFunction());
+  } label IfInvalidLength(length: Number) {
+    ThrowRangeError(MessageTemplate::kInvalidTypedArrayLength, length);
+  } label IfIteratorNotCallable(_value: JSAny) deferred {
+    ThrowTypeError(MessageTemplate::kIteratorSymbolNonCallable);
+  }
+}
 
-    try {
-      typeswitch (arg1) {
-        case (length: Smi): {
-          goto IfConstructByLength(length);
-        }
-        case (buffer: JSArrayBuffer): {
-          return ConstructByArrayBuffer(map, buffer, arg2, arg3, elementsInfo);
-        }
-        case (typedArray: JSTypedArray): {
-          ConstructByTypedArray(typedArray) otherwise IfConstructByArrayLike;
-        }
-        case (obj: JSReceiver): {
-          ConstructByJSReceiver(obj) otherwise IfConstructByArrayLike;
-        }
-        // The first argument was a number or fell through and is treated as
-        // a number. https://tc39.github.io/ecma262/#sec-typedarray-length
-        case (lengthObj: JSAny): {
-          goto IfConstructByLength(lengthObj);
-        }
+// 22.2.4 The TypedArray Constructors
+// ES #sec-typedarray-constructors
+transitioning builtin CreateTypedArray(
+    context: Context, target: JSFunction, newTarget: JSReceiver, arg1: JSAny,
+    arg2: JSAny, arg3: JSAny): JSTypedArray {
+  assert(IsConstructor(target));
+  // 4. Let O be ? AllocateTypedArray(constructorName, NewTarget,
+  // "%TypedArrayPrototype%").
+  const map = GetDerivedMap(target, newTarget);
+
+  // 5. Let elementSize be the Number value of the Element Size value in Table
+  // 56 for constructorName.
+  const elementsInfo = GetTypedArrayElementsInfo(map);
+
+  try {
+    typeswitch (arg1) {
+      case (length: Smi): {
+        goto IfConstructByLength(length);
+      }
+      case (buffer: JSArrayBuffer): {
+        return ConstructByArrayBuffer(map, buffer, arg2, arg3, elementsInfo);
+      }
+      case (typedArray: JSTypedArray): {
+        ConstructByTypedArray(typedArray) otherwise IfConstructByArrayLike;
+      }
+      case (obj: JSReceiver): {
+        ConstructByJSReceiver(obj) otherwise IfConstructByArrayLike;
+      }
+      // The first argument was a number or fell through and is treated as
+      // a number. https://tc39.github.io/ecma262/#sec-typedarray-length
+      case (lengthObj: JSAny): {
+        goto IfConstructByLength(lengthObj);
       }
     }
-    label IfConstructByLength(length: JSAny) {
-      return ConstructByLength(map, length, elementsInfo);
-    }
-    label IfConstructByArrayLike(
-        arrayLike: JSReceiver, length: uintptr, bufferConstructor: JSReceiver) {
-      return ConstructByArrayLike(
-          map, arrayLike, length, elementsInfo, bufferConstructor);
-    }
+  } label IfConstructByLength(length: JSAny) {
+    return ConstructByLength(map, length, elementsInfo);
+  } label IfConstructByArrayLike(
+      arrayLike: JSReceiver, length: uintptr, bufferConstructor: JSReceiver) {
+    return ConstructByArrayLike(
+        map, arrayLike, length, elementsInfo, bufferConstructor);
   }
+}
 
-  transitioning macro TypedArraySpeciesCreate(implicit context: Context)(
-      methodName: constexpr string, numArgs: constexpr int31,
-      exemplar: JSTypedArray, arg0: JSAny, arg1: JSAny,
-      arg2: JSAny): JSTypedArray {
-    const defaultConstructor = GetDefaultConstructor(exemplar);
+transitioning macro TypedArraySpeciesCreate(implicit context: Context)(
+    methodName: constexpr string, numArgs: constexpr int31,
+    exemplar: JSTypedArray, arg0: JSAny, arg1: JSAny,
+    arg2: JSAny): JSTypedArray {
+  const defaultConstructor = GetDefaultConstructor(exemplar);
 
-    try {
-      if (!IsPrototypeTypedArrayPrototype(exemplar.map)) goto IfSlow;
-      if (IsTypedArraySpeciesProtectorCellInvalid()) goto IfSlow;
+  try {
+    if (!IsPrototypeTypedArrayPrototype(exemplar.map)) goto IfSlow;
+    if (IsTypedArraySpeciesProtectorCellInvalid()) goto IfSlow;
 
-      const typedArray = CreateTypedArray(
-          context, defaultConstructor, defaultConstructor, arg0, arg1, arg2);
+    const typedArray = CreateTypedArray(
+        context, defaultConstructor, defaultConstructor, arg0, arg1, arg2);
 
-      // It is assumed that the CreateTypedArray builtin does not produce a
-      // typed array that fails ValidateTypedArray
-      assert(!IsDetachedBuffer(typedArray.buffer));
+    // It is assumed that the CreateTypedArray builtin does not produce a
+    // typed array that fails ValidateTypedArray
+    assert(!IsDetachedBuffer(typedArray.buffer));
 
-      return typedArray;
+    return typedArray;
+  } label IfSlow deferred {
+    const constructor =
+        Cast<Constructor>(SpeciesConstructor(exemplar, defaultConstructor))
+        otherwise unreachable;
+
+    // TODO(pwong): Simplify and remove numArgs when varargs are supported in
+    // macros.
+    let newObj: JSAny = Undefined;
+    if constexpr (numArgs == 1) {
+      newObj = Construct(constructor, arg0);
+    } else {
+      assert(numArgs == 3);
+      newObj = Construct(constructor, arg0, arg1, arg2);
     }
-    label IfSlow deferred {
-      const constructor =
-          Cast<Constructor>(SpeciesConstructor(exemplar, defaultConstructor))
-          otherwise unreachable;
-
-      // TODO(pwong): Simplify and remove numArgs when varargs are supported in
-      // macros.
-      let newObj: JSAny = Undefined;
-      if constexpr (numArgs == 1) {
-        newObj = Construct(constructor, arg0);
-      } else {
-        assert(numArgs == 3);
-        newObj = Construct(constructor, arg0, arg1, arg2);
-      }
 
-      return ValidateTypedArray(context, newObj, methodName);
-    }
+    return ValidateTypedArray(context, newObj, methodName);
   }
+}
 
-  @export
-  transitioning macro TypedArraySpeciesCreateByLength(implicit context:
-                                                          Context)(
-      methodName: constexpr string, exemplar: JSTypedArray, length: uintptr):
-      JSTypedArray {
-    const numArgs: constexpr int31 = 1;
-    // TODO(v8:4153): pass length further as uintptr.
-    const typedArray: JSTypedArray = TypedArraySpeciesCreate(
-        methodName, numArgs, exemplar, Convert<Number>(length), Undefined,
-        Undefined);
-    if (typedArray.length < length) deferred {
-        ThrowTypeError(MessageTemplate::kTypedArrayTooShort);
-      }
-    return typedArray;
-  }
+@export
+transitioning macro TypedArraySpeciesCreateByLength(implicit context: Context)(
+    methodName: constexpr string, exemplar: JSTypedArray, length: uintptr):
+    JSTypedArray {
+  const numArgs: constexpr int31 = 1;
+  // TODO(v8:4153): pass length further as uintptr.
+  const typedArray: JSTypedArray = TypedArraySpeciesCreate(
+      methodName, numArgs, exemplar, Convert<Number>(length), Undefined,
+      Undefined);
+  if (typedArray.length < length) deferred {
+      ThrowTypeError(MessageTemplate::kTypedArrayTooShort);
+    }
+  return typedArray;
+}
 
-  transitioning macro TypedArraySpeciesCreateByBuffer(implicit context:
-                                                          Context)(
-      methodName: constexpr string, exemplar: JSTypedArray,
-      buffer: JSArrayBuffer, beginByteOffset: uintptr,
-      newLength: uintptr): JSTypedArray {
-    const numArgs: constexpr int31 = 3;
-    // TODO(v8:4153): pass length further as uintptr.
-    const typedArray: JSTypedArray = TypedArraySpeciesCreate(
-        methodName, numArgs, exemplar, buffer, Convert<Number>(beginByteOffset),
-        Convert<Number>(newLength));
-    return typedArray;
-  }
+transitioning macro TypedArraySpeciesCreateByBuffer(implicit context: Context)(
+    methodName: constexpr string, exemplar: JSTypedArray, buffer: JSArrayBuffer,
+    beginByteOffset: uintptr, newLength: uintptr): JSTypedArray {
+  const numArgs: constexpr int31 = 3;
+  // TODO(v8:4153): pass length further as uintptr.
+  const typedArray: JSTypedArray = TypedArraySpeciesCreate(
+      methodName, numArgs, exemplar, buffer, Convert<Number>(beginByteOffset),
+      Convert<Number>(newLength));
+  return typedArray;
+}
 }
diff --git a/deps/v8/src/builtins/typed-array-entries.tq b/deps/v8/src/builtins/typed-array-entries.tq
new file mode 100644
index 00000000000..6749a14e90a
--- /dev/null
+++ b/deps/v8/src/builtins/typed-array-entries.tq
@@ -0,0 +1,27 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-typed-array-gen.h'
+
+namespace typed_array {
+const kBuiltinNameEntries: constexpr string = '%TypedArray%.prototype.entries';
+
+// %TypedArray%.entries ()
+// https://tc39.github.io/ecma262/#sec-%typedarray%.entries
+transitioning javascript builtin
+TypedArrayPrototypeEntries(js-implicit context: NativeContext, receiver: JSAny)(
+    ...arguments): JSArrayIterator {
+  try {
+    const array: JSTypedArray = Cast<JSTypedArray>(receiver)
+        otherwise NotTypedArray;
+
+    EnsureAttached(array) otherwise IsDetached;
+    return CreateArrayIterator(array, IterationKind::kEntries);
+  } label NotTypedArray deferred {
+    ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameEntries);
+  } label IsDetached deferred {
+    ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameEntries);
+  }
+}
+}
diff --git a/deps/v8/src/builtins/typed-array-every.tq b/deps/v8/src/builtins/typed-array-every.tq
index cba688244b5..fdd4961dee6 100644
--- a/deps/v8/src/builtins/typed-array-every.tq
+++ b/deps/v8/src/builtins/typed-array-every.tq
@@ -5,52 +5,49 @@
 #include 'src/builtins/builtins-typed-array-gen.h'
 
 namespace typed_array {
-  const kBuiltinNameEvery: constexpr string = '%TypedArray%.prototype.every';
+const kBuiltinNameEvery: constexpr string = '%TypedArray%.prototype.every';
 
-  transitioning macro EveryAllElements(implicit context: Context)(
-      array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      thisArg: JSAny): Boolean {
-    let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
-    const length: uintptr = witness.Get().length;
-    for (let k: uintptr = 0; k < length; k++) {
-      // BUG(4895): We should throw on detached buffers rather than simply exit.
-      witness.Recheck() otherwise break;
-      const value: JSAny = witness.Load(k);
-      // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
-      // indices to optimize Convert<Number>(k) for the most common case.
-      const result = Call(
-          context, callbackfn, thisArg, value, Convert<Number>(k),
-          witness.GetStable());
-      if (!ToBoolean(result)) {
-        return False;
-      }
+transitioning macro EveryAllElements(implicit context: Context)(
+    array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
+    thisArg: JSAny): Boolean {
+  let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
+  const length: uintptr = witness.Get().length;
+  for (let k: uintptr = 0; k < length; k++) {
+    // BUG(4895): We should throw on detached buffers rather than simply exit.
+    witness.Recheck() otherwise break;
+    const value: JSAny = witness.Load(k);
+    // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+    // indices to optimize Convert<Number>(k) for the most common case.
+    const result = Call(
+        context, callbackfn, thisArg, value, Convert<Number>(k),
+        witness.GetStable());
+    if (!ToBoolean(result)) {
+      return False;
     }
-    return True;
   }
+  return True;
+}
 
-  // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.every
-  transitioning javascript builtin
-  TypedArrayPrototypeEvery(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSAny {
-    // arguments[0] = callback
-    // arguments[1] = thisArg
-    try {
-      const array: JSTypedArray = Cast<JSTypedArray>(receiver)
-          otherwise NotTypedArray;
-      const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
+// https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.every
+transitioning javascript builtin
+TypedArrayPrototypeEvery(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // arguments[0] = callback
+  // arguments[1] = thisArg
+  try {
+    const array: JSTypedArray = Cast<JSTypedArray>(receiver)
+        otherwise NotTypedArray;
+    const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
 
-      const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
-      const thisArg = arguments[1];
-      return EveryAllElements(uarray, callbackfn, thisArg);
-    }
-    label NotCallable deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
-    }
-    label NotTypedArray deferred {
-      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameEvery);
-    }
-    label IsDetached deferred {
-      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameEvery);
-    }
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
+    const thisArg = arguments[1];
+    return EveryAllElements(uarray, callbackfn, thisArg);
+  } label NotCallable deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+  } label NotTypedArray deferred {
+    ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameEvery);
+  } label IsDetached deferred {
+    ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameEvery);
   }
 }
+}
diff --git a/deps/v8/src/builtins/typed-array-filter.tq b/deps/v8/src/builtins/typed-array-filter.tq
index dd3b4900dc7..15d40f92ebe 100644
--- a/deps/v8/src/builtins/typed-array-filter.tq
+++ b/deps/v8/src/builtins/typed-array-filter.tq
@@ -3,85 +3,81 @@
 // found in the LICENSE file.
 
 namespace typed_array {
-  const kBuiltinNameFilter: constexpr string = '%TypedArray%.prototype.filter';
+const kBuiltinNameFilter: constexpr string = '%TypedArray%.prototype.filter';
 
-  // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.filter
-  transitioning javascript builtin TypedArrayPrototypeFilter(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    // arguments[0] = callback
-    // arguments[1] = thisArg
-    try {
-      // 1. Let O be the this value.
-      // 2. Perform ? ValidateTypedArray(O).
-      const array: JSTypedArray = Cast<JSTypedArray>(receiver)
-          otherwise ThrowTypeError(
-          MessageTemplate::kNotTypedArray, kBuiltinNameFilter);
-      const src = typed_array::EnsureAttached(array) otherwise IsDetached;
+// https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.filter
+transitioning javascript builtin TypedArrayPrototypeFilter(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // arguments[0] = callback
+  // arguments[1] = thisArg
+  try {
+    // 1. Let O be the this value.
+    // 2. Perform ? ValidateTypedArray(O).
+    const array: JSTypedArray = Cast<JSTypedArray>(receiver)
+        otherwise ThrowTypeError(
+        MessageTemplate::kNotTypedArray, kBuiltinNameFilter);
+    const src = typed_array::EnsureAttached(array) otherwise IsDetached;
 
-      // 3. Let len be O.[[ArrayLength]].
-      const len: uintptr = src.length;
+    // 3. Let len be O.[[ArrayLength]].
+    const len: uintptr = src.length;
 
-      // 4. If IsCallable(callbackfn) is false, throw a TypeError exception.
-      const callbackfn = Cast<Callable>(arguments[0])
-          otherwise ThrowTypeError(
-          MessageTemplate::kCalledNonCallable, arguments[0]);
+    // 4. If IsCallable(callbackfn) is false, throw a TypeError exception.
+    const callbackfn = Cast<Callable>(arguments[0])
+        otherwise ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
 
-      // 5. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: JSAny = arguments[1];
+    // 5. If thisArg is present, let T be thisArg; else let T be undefined.
+    const thisArg: JSAny = arguments[1];
 
-      // 6. Let kept be a new empty List.
-      // TODO(v8:4153): Support huge TypedArrays here. (growable fixed arrays
-      // can't be longer than kMaxSmiValue).
-      let kept = growable_fixed_array::NewGrowableFixedArray();
-      let witness = typed_array::NewAttachedJSTypedArrayWitness(src);
+    // 6. Let kept be a new empty List.
+    // TODO(v8:4153): Support huge TypedArrays here. (growable fixed arrays
+    // can't be longer than kMaxSmiValue).
+    let kept = growable_fixed_array::NewGrowableFixedArray();
+    let witness = typed_array::NewAttachedJSTypedArrayWitness(src);
 
-      // 7. Let k be 0.
-      // 8. Let captured be 0.
-      // 9. Repeat, while k < len
-      for (let k: uintptr = 0; k < len; k++) {
-        witness.Recheck() otherwise IsDetached;
+    // 7. Let k be 0.
+    // 8. Let captured be 0.
+    // 9. Repeat, while k < len
+    for (let k: uintptr = 0; k < len; k++) {
+      witness.Recheck() otherwise IsDetached;
 
-        // a. Let Pk be ! ToString(k).
-        // b. Let kValue be ? Get(O, Pk).
-        const value: JSAny = witness.Load(k);
+      // a. Let Pk be ! ToString(k).
+      // b. Let kValue be ? Get(O, Pk).
+      const value: JSAny = witness.Load(k);
 
-        // c. Let selected be ToBoolean(? Call(callbackfn, T, « kValue, k, O
-        // »)).
-        // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
-        // indices to optimize Convert<Number>(k) for the most common case.
-        const selected: JSAny = Call(
-            context, callbackfn, thisArg, value, Convert<Number>(k),
-            witness.GetStable());
+      // c. Let selected be ToBoolean(? Call(callbackfn, T, « kValue, k, O
+      // »)).
+      // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+      // indices to optimize Convert<Number>(k) for the most common case.
+      const selected: JSAny = Call(
+          context, callbackfn, thisArg, value, Convert<Number>(k),
+          witness.GetStable());
 
-        // d. If selected is true, then
-        //    i. Append kValue to the end of kept.
-        //   ii. Increase captured by 1.
-        if (ToBoolean(selected)) kept.Push(value);
+      // d. If selected is true, then
+      //    i. Append kValue to the end of kept.
+      //   ii. Increase captured by 1.
+      if (ToBoolean(selected)) kept.Push(value);
 
-        // e.Increase k by 1.
-      }
+      // e.Increase k by 1.
+    }
 
-      // 10. Let A be ? TypedArraySpeciesCreate(O, captured).
-      const typedArray: JSTypedArray = TypedArraySpeciesCreateByLength(
-          kBuiltinNameFilter, array, Unsigned(kept.length));
+    // 10. Let A be ? TypedArraySpeciesCreate(O, captured).
+    const typedArray: JSTypedArray = TypedArraySpeciesCreateByLength(
+        kBuiltinNameFilter, array, Unsigned(kept.length));
 
-      // 11. Let n be 0.
-      // 12. For each element e of kept, do
-      //   a. Perform ! Set(A, ! ToString(n), e, true).
-      //   b. Increment n by 1.
-      // TODO(v8:4153): Consider passing growable typed array directly to
-      // TypedArrayCopyElements() to avoid JSArray materialization. Or collect
-      // indices instead of values the loop above.
-      const lengthNumber = Convert<Number>(Unsigned(kept.length));
-      TypedArrayCopyElements(
-          context, typedArray, kept.ToJSArray(), lengthNumber);
+    // 11. Let n be 0.
+    // 12. For each element e of kept, do
+    //   a. Perform ! Set(A, ! ToString(n), e, true).
+    //   b. Increment n by 1.
+    // TODO(v8:4153): Consider passing growable typed array directly to
+    // TypedArrayCopyElements() to avoid JSArray materialization. Or collect
+    // indices instead of values the loop above.
+    const lengthNumber = Convert<Number>(Unsigned(kept.length));
+    TypedArrayCopyElements(context, typedArray, kept.ToJSArray(), lengthNumber);
 
-      // 13. Return A.
-      return typedArray;
-    }
-    label IsDetached deferred {
-      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameFilter);
-    }
+    // 13. Return A.
+    return typedArray;
+  } label IsDetached deferred {
+    ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameFilter);
   }
 }
+}
diff --git a/deps/v8/src/builtins/typed-array-find.tq b/deps/v8/src/builtins/typed-array-find.tq
index ef4954274b2..24a13dbc23e 100644
--- a/deps/v8/src/builtins/typed-array-find.tq
+++ b/deps/v8/src/builtins/typed-array-find.tq
@@ -5,52 +5,49 @@
 #include 'src/builtins/builtins-typed-array-gen.h'
 
 namespace typed_array {
-  const kBuiltinNameFind: constexpr string = '%TypedArray%.prototype.find';
+const kBuiltinNameFind: constexpr string = '%TypedArray%.prototype.find';
 
-  transitioning macro FindAllElements(implicit context: Context)(
-      array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      thisArg: JSAny): JSAny {
-    let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
-    const length: uintptr = witness.Get().length;
-    for (let k: uintptr = 0; k < length; k++) {
-      // BUG(4895): We should throw on detached buffers rather than simply exit.
-      witness.Recheck() otherwise break;
-      const value: JSAny = witness.Load(k);
-      // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
-      // indices to optimize Convert<Number>(k) for the most common case.
-      const result = Call(
-          context, callbackfn, thisArg, value, Convert<Number>(k),
-          witness.GetStable());
-      if (ToBoolean(result)) {
-        return value;
-      }
+transitioning macro FindAllElements(implicit context: Context)(
+    array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
+    thisArg: JSAny): JSAny {
+  let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
+  const length: uintptr = witness.Get().length;
+  for (let k: uintptr = 0; k < length; k++) {
+    // BUG(4895): We should throw on detached buffers rather than simply exit.
+    witness.Recheck() otherwise break;
+    const value: JSAny = witness.Load(k);
+    // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+    // indices to optimize Convert<Number>(k) for the most common case.
+    const result = Call(
+        context, callbackfn, thisArg, value, Convert<Number>(k),
+        witness.GetStable());
+    if (ToBoolean(result)) {
+      return value;
     }
-    return Undefined;
   }
+  return Undefined;
+}
 
-  // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.find
-  transitioning javascript builtin
-  TypedArrayPrototypeFind(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSAny {
-    // arguments[0] = callback
-    // arguments[1] = thisArg
-    try {
-      const array: JSTypedArray = Cast<JSTypedArray>(receiver)
-          otherwise NotTypedArray;
-      const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
+// https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.find
+transitioning javascript builtin
+TypedArrayPrototypeFind(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // arguments[0] = callback
+  // arguments[1] = thisArg
+  try {
+    const array: JSTypedArray = Cast<JSTypedArray>(receiver)
+        otherwise NotTypedArray;
+    const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
 
-      const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
-      const thisArg = arguments[1];
-      return FindAllElements(uarray, callbackfn, thisArg);
-    }
-    label NotCallable deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
-    }
-    label NotTypedArray deferred {
-      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameFind);
-    }
-    label IsDetached deferred {
-      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameFind);
-    }
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
+    const thisArg = arguments[1];
+    return FindAllElements(uarray, callbackfn, thisArg);
+  } label NotCallable deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+  } label NotTypedArray deferred {
+    ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameFind);
+  } label IsDetached deferred {
+    ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameFind);
   }
 }
+}
diff --git a/deps/v8/src/builtins/typed-array-findindex.tq b/deps/v8/src/builtins/typed-array-findindex.tq
index 5af9aede296..7bb01151f35 100644
--- a/deps/v8/src/builtins/typed-array-findindex.tq
+++ b/deps/v8/src/builtins/typed-array-findindex.tq
@@ -5,56 +5,50 @@
 #include 'src/builtins/builtins-typed-array-gen.h'
 
 namespace typed_array {
-  const kBuiltinNameFindIndex: constexpr string =
-      '%TypedArray%.prototype.findIndex';
+const kBuiltinNameFindIndex: constexpr string =
+    '%TypedArray%.prototype.findIndex';
 
-  transitioning macro FindIndexAllElements(implicit context: Context)(
-      array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      thisArg: JSAny): Number {
-    let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
-    const length: uintptr = witness.Get().length;
-    for (let k: uintptr = 0; k < length; k++) {
-      // BUG(4895): We should throw on detached buffers rather than simply exit.
-      witness.Recheck() otherwise break;
-      const value: JSAny = witness.Load(k);
-      // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
-      // indices to optimize Convert<Number>(k) for the most common case.
-      const indexNumber: Number = Convert<Number>(k);
-      const result = Call(
-          context, callbackfn, thisArg, value, indexNumber,
-          witness.GetStable());
-      if (ToBoolean(result)) {
-        return indexNumber;
-      }
+transitioning macro FindIndexAllElements(implicit context: Context)(
+    array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
+    thisArg: JSAny): Number {
+  let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
+  const length: uintptr = witness.Get().length;
+  for (let k: uintptr = 0; k < length; k++) {
+    // BUG(4895): We should throw on detached buffers rather than simply exit.
+    witness.Recheck() otherwise break;
+    const value: JSAny = witness.Load(k);
+    // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+    // indices to optimize Convert<Number>(k) for the most common case.
+    const indexNumber: Number = Convert<Number>(k);
+    const result = Call(
+        context, callbackfn, thisArg, value, indexNumber, witness.GetStable());
+    if (ToBoolean(result)) {
+      return indexNumber;
     }
-    return -1;
   }
+  return -1;
+}
 
-  // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.findIndex
-  transitioning javascript builtin
-  TypedArrayPrototypeFindIndex(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    // arguments[0] = callback
-    // arguments[1] = thisArg.
-    try {
-      const array: JSTypedArray = Cast<JSTypedArray>(receiver)
-          otherwise NotTypedArray;
-      const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
+// https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.findIndex
+transitioning javascript builtin
+TypedArrayPrototypeFindIndex(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // arguments[0] = callback
+  // arguments[1] = thisArg.
+  try {
+    const array: JSTypedArray = Cast<JSTypedArray>(receiver)
+        otherwise NotTypedArray;
+    const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
 
-      const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
-      const thisArg = arguments[1];
-      return FindIndexAllElements(uarray, callbackfn, thisArg);
-    }
-    label NotCallable deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
-    }
-    label NotTypedArray deferred {
-      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameFindIndex);
-    }
-    label IsDetached deferred {
-      ThrowTypeError(
-          MessageTemplate::kDetachedOperation, kBuiltinNameFindIndex);
-    }
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
+    const thisArg = arguments[1];
+    return FindIndexAllElements(uarray, callbackfn, thisArg);
+  } label NotCallable deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+  } label NotTypedArray deferred {
+    ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameFindIndex);
+  } label IsDetached deferred {
+    ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameFindIndex);
   }
 }
+}
diff --git a/deps/v8/src/builtins/typed-array-foreach.tq b/deps/v8/src/builtins/typed-array-foreach.tq
index dd134174568..d696d9c8dd8 100644
--- a/deps/v8/src/builtins/typed-array-foreach.tq
+++ b/deps/v8/src/builtins/typed-array-foreach.tq
@@ -5,52 +5,47 @@
 #include 'src/builtins/builtins-typed-array-gen.h'
 
 namespace typed_array {
-  const kBuiltinNameForEach: constexpr string =
-      '%TypedArray%.prototype.forEach';
+const kBuiltinNameForEach: constexpr string = '%TypedArray%.prototype.forEach';
 
-  transitioning macro ForEachAllElements(implicit context: Context)(
-      array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      thisArg: JSAny): Undefined {
-    let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
-    const length: uintptr = witness.Get().length;
-    for (let k: uintptr = 0; k < length; k++) {
-      // BUG(4895): We should throw on detached buffers rather than simply exit.
-      witness.Recheck() otherwise break;
-      const value: JSAny = witness.Load(k);
-      // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
-      // indices to optimize Convert<Number>(k) for the most common case.
-      Call(
-          context, callbackfn, thisArg, value, Convert<Number>(k),
-          witness.GetStable());
-    }
-    return Undefined;
+transitioning macro ForEachAllElements(implicit context: Context)(
+    array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
+    thisArg: JSAny): Undefined {
+  let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
+  const length: uintptr = witness.Get().length;
+  for (let k: uintptr = 0; k < length; k++) {
+    // BUG(4895): We should throw on detached buffers rather than simply exit.
+    witness.Recheck() otherwise break;
+    const value: JSAny = witness.Load(k);
+    // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+    // indices to optimize Convert<Number>(k) for the most common case.
+    Call(
+        context, callbackfn, thisArg, value, Convert<Number>(k),
+        witness.GetStable());
   }
+  return Undefined;
+}
 
-  // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.every
-  transitioning javascript builtin
-  TypedArrayPrototypeForEach(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): Undefined {
-    // arguments[0] = callback
-    // arguments[1] = this_arg.
+// https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.every
+transitioning javascript builtin
+TypedArrayPrototypeForEach(js-implicit context: NativeContext, receiver: JSAny)(
+    ...arguments): Undefined {
+  // arguments[0] = callback
+  // arguments[1] = this_arg.
 
-    try {
-      const array: JSTypedArray = Cast<JSTypedArray>(receiver)
-          otherwise NotTypedArray;
-      const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
+  try {
+    const array: JSTypedArray = Cast<JSTypedArray>(receiver)
+        otherwise NotTypedArray;
+    const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
 
-      const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
-      const thisArg = arguments[1];
-      return ForEachAllElements(uarray, callbackfn, thisArg);
-    }
-    label NotCallable deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
-    }
-    label NotTypedArray deferred {
-      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameForEach);
-    }
-    label IsDetached deferred {
-      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameForEach);
-    }
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
+    const thisArg = arguments[1];
+    return ForEachAllElements(uarray, callbackfn, thisArg);
+  } label NotCallable deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+  } label NotTypedArray deferred {
+    ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameForEach);
+  } label IsDetached deferred {
+    ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameForEach);
   }
 }
+}
diff --git a/deps/v8/src/builtins/typed-array-from.tq b/deps/v8/src/builtins/typed-array-from.tq
index a0c2fa72a86..56d4d1d6cf7 100644
--- a/deps/v8/src/builtins/typed-array-from.tq
+++ b/deps/v8/src/builtins/typed-array-from.tq
@@ -5,190 +5,179 @@
 #include 'src/builtins/builtins-typed-array-gen.h'
 
 namespace typed_array {
-  const kBuiltinNameFrom: constexpr string = '%TypedArray%.from';
+const kBuiltinNameFrom: constexpr string = '%TypedArray%.from';
+
+type BuiltinsName extends int31 constexpr 'Builtins::Name';
+const kTypedArrayPrototypeValues: constexpr BuiltinsName
+    generates 'Builtins::kTypedArrayPrototypeValues';
+
+extern builtin IterableToList(implicit context: Context)(JSAny, JSAny): JSArray;
+
+// %TypedArray%.from ( source [ , mapfn [ , thisArg ] ] )
+// https://tc39.github.io/ecma262/#sec-%typedarray%.from
+transitioning javascript builtin
+TypedArrayFrom(js-implicit context: NativeContext, receiver: JSAny)(
+    ...arguments): JSTypedArray {
+  try {
+    const source: JSAny = arguments[0];
+    const mapfnObj: JSAny = arguments[1];
+    const thisArg = arguments[2];
+
+    // 1. Let C be the this value.
+    // 2. If IsConstructor(C) is false, throw a TypeError exception.
+    const constructor = Cast<Constructor>(receiver) otherwise NotConstructor;
+
+    // 3. If mapfn is undefined, then let mapping be false.
+    // 4. Else,
+    //   a. If IsCallable(mapfn) is false, throw a TypeError exception.
+    //   b. Let mapping be true.
+    const mapping: bool = mapfnObj != Undefined;
+    if (mapping && !Is<Callable>(mapfnObj)) deferred {
+        ThrowTypeError(MessageTemplate::kCalledNonCallable, mapfnObj);
+      }
 
-  type BuiltinsName extends int31 constexpr 'Builtins::Name';
-  const kTypedArrayPrototypeValues: constexpr BuiltinsName
-  generates 'Builtins::kTypedArrayPrototypeValues';
+    // We split up this builtin differently to the way it is written in the
+    // spec. We already have great code in the elements accessor for copying
+    // from a JSArray into a TypedArray, so we use that when possible. We only
+    // avoid calling into the elements accessor when we have a mapping
+    // function, because we can't handle that. Here, presence of a mapping
+    // function is the slow path. We also combine the two different loops in
+    // the specification (starting at 7.e and 13) because they are essentially
+    // identical. We also save on code-size this way.
 
-  extern builtin IterableToList(implicit context: Context)(JSAny, JSAny):
-      JSArray;
+    let finalLength: uintptr;
+    let finalSource: JSAny;
 
-  // %TypedArray%.from ( source [ , mapfn [ , thisArg ] ] )
-  // https://tc39.github.io/ecma262/#sec-%typedarray%.from
-  transitioning javascript builtin
-  TypedArrayFrom(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSTypedArray {
     try {
-      const source: JSAny = arguments[0];
-
-      // 1. Let C be the this value.
-      // 2. If IsConstructor(C) is false, throw a TypeError exception.
-      const constructor = Cast<Constructor>(receiver) otherwise NotConstructor;
-
-      // 3. If mapfn is present and mapfn is not undefined, then
-      //   a. If IsCallable(mapfn) is false, throw a TypeError exception.
-      //   b. Let mapping be true.
-      // 4. Else, let mapping be false.
-      const mapping: bool = arguments.length > 1;
-      const mapfnObj: JSAny = mapping ? arguments[1] : Undefined;
-      if (mapping && !TaggedIsCallable(mapfnObj)) deferred {
-          ThrowTypeError(MessageTemplate::kCalledNonCallable, mapfnObj);
-        }
-
-      // 5. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg = arguments.length > 2 ? arguments[2] : Undefined;
-
-      // We split up this builtin differently to the way it is written in the
-      // spec. We already have great code in the elements accessor for copying
-      // from a JSArray into a TypedArray, so we use that when possible. We only
-      // avoid calling into the elements accessor when we have a mapping
-      // function, because we can't handle that. Here, presence of a mapping
-      // function is the slow path. We also combine the two different loops in
-      // the specification (starting at 7.e and 13) because they are essentially
-      // identical. We also save on code-size this way.
-
-      let finalLength: uintptr;
-      let finalSource: JSAny;
+      // 5. Let usingIterator be ? GetMethod(source, @@iterator).
+      // TODO(v8:8906): Use iterator::GetIteratorMethod() once it supports
+      // labels.
+      const usingIterator = GetMethod(source, IteratorSymbolConstant())
+          otherwise IteratorIsUndefined, IteratorNotCallable;
 
       try {
-        // 6. Let usingIterator be ? GetMethod(source, @@iterator).
-        // TODO(v8:8906): Use iterator::GetIteratorMethod() once it supports
-        // labels.
-        const usingIterator = GetMethod(source, IteratorSymbolConstant())
-            otherwise IteratorIsUndefined, IteratorNotCallable;
-
-        try {
-          // TypedArrays have iterators, so normally we would go through the
-          // IterableToList case below, which would convert the TypedArray to a
-          // JSArray (boxing the values if they won't fit in a Smi).
-          //
-          // However, if we can guarantee that the source object has the
-          // built-in iterator and that the %ArrayIteratorPrototype%.next method
-          // has not been overridden, then we know the behavior of the iterator:
-          // returning the values in the TypedArray sequentially from index 0 to
-          // length-1.
-          //
-          // In this case, we can avoid creating the intermediate array and the
-          // associated HeapNumbers, and use the fast path in
-          // TypedArrayCopyElements which uses the same ordering as the default
-          // iterator.
-          //
-          // Drop through to the default check_iterator behavior if any of these
-          // checks fail.
-          const sourceTypedArray =
-              Cast<JSTypedArray>(source) otherwise UseUserProvidedIterator;
-          const sourceBuffer = sourceTypedArray.buffer;
-          if (IsDetachedBuffer(sourceBuffer)) goto UseUserProvidedIterator;
-
-          // Check that the iterator function is exactly
-          // Builtins::kTypedArrayPrototypeValues.
-          const iteratorFn =
-              Cast<JSFunction>(usingIterator) otherwise UseUserProvidedIterator;
-          if (!TaggedEqual(
-                  iteratorFn.shared_function_info.function_data,
-                  SmiConstant(kTypedArrayPrototypeValues)))
-            goto UseUserProvidedIterator;
-
-          // Check that the ArrayIterator prototype's "next" method hasn't been
-          // overridden.
-          if (IsArrayIteratorProtectorCellInvalid())
-            goto UseUserProvidedIterator;
-
-          // Source is a TypedArray with unmodified iterator behavior. Use the
-          // source object directly, taking advantage of the special-case code
-          // in TypedArrayCopyElements
-          finalLength = sourceTypedArray.length;
-          finalSource = source;
-        }
-        label UseUserProvidedIterator {
-          // 7. If usingIterator is not undefined, then
-          //  a. Let values be ? IterableToList(source, usingIterator).
-          //  b. Let len be the number of elements in values.
-          const values: JSArray = IterableToList(source, usingIterator);
-
-          finalLength = Convert<uintptr>(values.length);
-          finalSource = values;
-        }
-      }
-      label IteratorIsUndefined {
-        // 8. NOTE: source is not an Iterable so assume it is already an
-        // array-like object.
-
-        // 9. Let arrayLike be ! ToObject(source).
-        const arrayLike: JSReceiver = ToObject_Inline(context, source);
-
-        // 10. Let len be ? ToLength(? Get(arrayLike, "length")).
-        const length = GetLengthProperty(arrayLike);
-
-        try {
-          finalLength = ChangeSafeIntegerNumberToUintPtr(length)
-              otherwise IfInvalidLength;
-          finalSource = arrayLike;
-        }
-        label IfInvalidLength deferred {
-          ThrowRangeError(MessageTemplate::kInvalidTypedArrayLength, length);
-        }
-      }
-      label IteratorNotCallable(_value: JSAny) deferred {
-        ThrowTypeError(MessageTemplate::kIteratorSymbolNonCallable);
+        // TypedArrays have iterators, so normally we would go through the
+        // IterableToList case below, which would convert the TypedArray to a
+        // JSArray (boxing the values if they won't fit in a Smi).
+        //
+        // However, if we can guarantee that the source object has the
+        // built-in iterator and that the %ArrayIteratorPrototype%.next method
+        // has not been overridden, then we know the behavior of the iterator:
+        // returning the values in the TypedArray sequentially from index 0 to
+        // length-1.
+        //
+        // In this case, we can avoid creating the intermediate array and the
+        // associated HeapNumbers, and use the fast path in
+        // TypedArrayCopyElements which uses the same ordering as the default
+        // iterator.
+        //
+        // Drop through to the default check_iterator behavior if any of these
+        // checks fail.
+        const sourceTypedArray =
+            Cast<JSTypedArray>(source) otherwise UseUserProvidedIterator;
+        const sourceBuffer = sourceTypedArray.buffer;
+        if (IsDetachedBuffer(sourceBuffer)) goto UseUserProvidedIterator;
+
+        // Check that the iterator function is exactly
+        // Builtins::kTypedArrayPrototypeValues.
+        const iteratorFn =
+            Cast<JSFunction>(usingIterator) otherwise UseUserProvidedIterator;
+        if (!TaggedEqual(
+                iteratorFn.shared_function_info.function_data,
+                SmiConstant(kTypedArrayPrototypeValues)))
+          goto UseUserProvidedIterator;
+
+        // Check that the ArrayIterator prototype's "next" method hasn't been
+        // overridden.
+        if (IsArrayIteratorProtectorCellInvalid()) goto UseUserProvidedIterator;
+
+        // Source is a TypedArray with unmodified iterator behavior. Use the
+        // source object directly, taking advantage of the special-case code
+        // in TypedArrayCopyElements
+        finalLength = sourceTypedArray.length;
+        finalSource = source;
+      } label UseUserProvidedIterator {
+        // 6. If usingIterator is not undefined, then
+        //  a. Let values be ? IterableToList(source, usingIterator).
+        //  b. Let len be the number of elements in values.
+        const values: JSArray = IterableToList(source, usingIterator);
+
+        finalLength = Convert<uintptr>(values.length);
+        finalSource = values;
       }
+    } label IteratorIsUndefined {
+      // 7. NOTE: source is not an Iterable so assume it is already an
+      // array-like object.
 
-      const finalLengthNum = Convert<Number>(finalLength);
+      // 8. Let arrayLike be ! ToObject(source).
+      const arrayLike: JSReceiver = ToObject_Inline(context, source);
 
-      // 7c/11. Let targetObj be ? TypedArrayCreate(C, «len»).
-      const targetObj = TypedArrayCreateByLength(
-          constructor, finalLengthNum, kBuiltinNameFrom);
+      // 9. Let len be ? LengthOfArrayLike(arrayLike).
+      const length = GetLengthProperty(arrayLike);
 
-      if (!mapping) {
-        // Fast path.
-        if (finalLength != 0) {
-          // Call runtime.
-          TypedArrayCopyElements(
-              context, targetObj, finalSource, finalLengthNum);
-        }
-        return targetObj;
+      try {
+        finalLength = ChangeSafeIntegerNumberToUintPtr(length)
+            otherwise IfInvalidLength;
+        finalSource = arrayLike;
+      } label IfInvalidLength deferred {
+        ThrowRangeError(MessageTemplate::kInvalidTypedArrayLength, length);
       }
-      // Slow path.
-
-      const mapfn: Callable = Cast<Callable>(mapfnObj) otherwise unreachable;
-      const accessor: TypedArrayAccessor =
-          GetTypedArrayAccessor(targetObj.elements_kind);
-
-      // 7d-7e and 12-13.
-      // 12. Let k be 0.
-      // 13. Repeat, while k < len
-      for (let k: uintptr = 0; k < finalLength; k++) {
-        // 13a. Let Pk be ! ToString(k).
-        const kNum = Convert<Number>(k);
-
-        // 13b. Let kValue be ? Get(arrayLike, Pk).
-        const kValue: JSAny = GetProperty(finalSource, kNum);
-
-        let mappedValue: JSAny;
-        // 13c. If mapping is true, then
-        if (mapping) {
-          // i. Let mappedValue be ? Call(mapfn, T, « kValue, k »).
-          mappedValue = Call(context, mapfn, thisArg, kValue, kNum);
-        } else {
-          // 13d. Else, let mappedValue be kValue.
-          mappedValue = kValue;
-        }
-
-        // 13e. Perform ? Set(targetObj, Pk, mappedValue, true).
-        // Buffer may be detached during executing ToNumber/ToBigInt.
-        accessor.StoreJSAny(context, targetObj, k, mappedValue)
-            otherwise IfDetached;
-
-        // 13f. Set k to k + 1. (done by the loop).
+    } label IteratorNotCallable(_value: JSAny) deferred {
+      ThrowTypeError(MessageTemplate::kIteratorSymbolNonCallable);
+    }
+
+    const finalLengthNum = Convert<Number>(finalLength);
+
+    // 6c/10. Let targetObj be ? TypedArrayCreate(C, «len»).
+    const targetObj =
+        TypedArrayCreateByLength(constructor, finalLengthNum, kBuiltinNameFrom);
+
+    if (!mapping) {
+      // Fast path.
+      if (finalLength != 0) {
+        // Call runtime.
+        TypedArrayCopyElements(context, targetObj, finalSource, finalLengthNum);
       }
       return targetObj;
     }
-    label NotConstructor deferred {
-      ThrowTypeError(MessageTemplate::kNotConstructor, receiver);
-    }
-    label IfDetached deferred {
-      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameFrom);
+    // Slow path.
+
+    const mapfn: Callable = Cast<Callable>(mapfnObj) otherwise unreachable;
+    const accessor: TypedArrayAccessor =
+        GetTypedArrayAccessor(targetObj.elements_kind);
+
+    // 6d-6e and 11-12.
+    // 11. Let k be 0.
+    // 12. Repeat, while k < len
+    for (let k: uintptr = 0; k < finalLength; k++) {
+      // 12a. Let Pk be ! ToString(k).
+      const kNum = Convert<Number>(k);
+
+      // 12b. Let kValue be ? Get(arrayLike, Pk).
+      const kValue: JSAny = GetProperty(finalSource, kNum);
+
+      let mappedValue: JSAny;
+      // 12c. If mapping is true, then
+      if (mapping) {
+        // i. Let mappedValue be ? Call(mapfn, T, « kValue, k »).
+        mappedValue = Call(context, mapfn, thisArg, kValue, kNum);
+      } else {
+        // 12d. Else, let mappedValue be kValue.
+        mappedValue = kValue;
+      }
+
+      // 12e. Perform ? Set(targetObj, Pk, mappedValue, true).
+      // Buffer may be detached during executing ToNumber/ToBigInt.
+      accessor.StoreJSAny(context, targetObj, k, mappedValue)
+          otherwise IfDetached;
+
+      // 12f. Set k to k + 1. (done by the loop).
     }
+    return targetObj;
+  } label NotConstructor deferred {
+    ThrowTypeError(MessageTemplate::kNotConstructor, receiver);
+  } label IfDetached deferred {
+    ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameFrom);
   }
 }
+}
diff --git a/deps/v8/src/builtins/typed-array-keys.tq b/deps/v8/src/builtins/typed-array-keys.tq
new file mode 100644
index 00000000000..24c53c71052
--- /dev/null
+++ b/deps/v8/src/builtins/typed-array-keys.tq
@@ -0,0 +1,27 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-typed-array-gen.h'
+
+namespace typed_array {
+const kBuiltinNameKeys: constexpr string = '%TypedArray%.prototype.keys';
+
+// %TypedArray%.keys ()
+// https://tc39.github.io/ecma262/#sec-%typedarray%.keys
+transitioning javascript builtin
+TypedArrayPrototypeKeys(js-implicit context: NativeContext, receiver: JSAny)(
+    ...arguments): JSArrayIterator {
+  try {
+    const array: JSTypedArray = Cast<JSTypedArray>(receiver)
+        otherwise NotTypedArray;
+
+    EnsureAttached(array) otherwise IsDetached;
+    return CreateArrayIterator(array, IterationKind::kKeys);
+  } label NotTypedArray deferred {
+    ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameKeys);
+  } label IsDetached deferred {
+    ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameKeys);
+  }
+}
+}
diff --git a/deps/v8/src/builtins/typed-array-of.tq b/deps/v8/src/builtins/typed-array-of.tq
index c65deeeb150..b5d42ef9a2f 100644
--- a/deps/v8/src/builtins/typed-array-of.tq
+++ b/deps/v8/src/builtins/typed-array-of.tq
@@ -5,52 +5,50 @@
 #include 'src/builtins/builtins-typed-array-gen.h'
 
 namespace typed_array {
-  const kBuiltinNameOf: constexpr string = '%TypedArray%.of';
-
-  // %TypedArray%.of ( ...items )
-  // https://tc39.github.io/ecma262/#sec-%typedarray%.of
-  transitioning javascript builtin
-  TypedArrayOf(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSTypedArray {
-    try {
-      // 1. Let len be the actual number of arguments passed to this function.
-      const len: uintptr = Unsigned(arguments.length);
-
-      // 2. Let items be the List of arguments passed to this function.
-
-      // 3. Let C be the this value.
-      // 4. If IsConstructor(C) is false, throw a TypeError exception.
-      const constructor = Cast<Constructor>(receiver) otherwise NotConstructor;
-
-      // 5. Let newObj be ? TypedArrayCreate(C, len).
-      const newObj = TypedArrayCreateByLength(
-          constructor, Convert<Number>(len), kBuiltinNameOf);
-
-      const accessor: TypedArrayAccessor =
-          GetTypedArrayAccessor(newObj.elements_kind);
-
-      // 6. Let k be 0.
-      // 7. Repeat, while k < len
-      for (let k: uintptr = 0; k < len; k++) {
-        // 7a. Let kValue be items[k].
-        const kValue: JSAny = arguments[Signed(k)];
-
-        // 7b. Let Pk be ! ToString(k).
-        // 7c. Perform ? Set(newObj, Pk, kValue, true).
-        // Buffer may be detached during executing ToNumber/ToBigInt.
-        accessor.StoreJSAny(context, newObj, k, kValue) otherwise IfDetached;
-
-        // 7d. Increase k by 1. (done by the loop).
-      }
-
-      // 8. Return newObj.
-      return newObj;
-    }
-    label NotConstructor deferred {
-      ThrowTypeError(MessageTemplate::kNotConstructor, receiver);
-    }
-    label IfDetached deferred {
-      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameOf);
+const kBuiltinNameOf: constexpr string = '%TypedArray%.of';
+
+// %TypedArray%.of ( ...items )
+// https://tc39.github.io/ecma262/#sec-%typedarray%.of
+transitioning javascript builtin
+TypedArrayOf(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
+    JSTypedArray {
+  try {
+    // 1. Let len be the actual number of arguments passed to this function.
+    const len: uintptr = Unsigned(arguments.length);
+
+    // 2. Let items be the List of arguments passed to this function.
+
+    // 3. Let C be the this value.
+    // 4. If IsConstructor(C) is false, throw a TypeError exception.
+    const constructor = Cast<Constructor>(receiver) otherwise NotConstructor;
+
+    // 5. Let newObj be ? TypedArrayCreate(C, len).
+    const newObj = TypedArrayCreateByLength(
+        constructor, Convert<Number>(len), kBuiltinNameOf);
+
+    const accessor: TypedArrayAccessor =
+        GetTypedArrayAccessor(newObj.elements_kind);
+
+    // 6. Let k be 0.
+    // 7. Repeat, while k < len
+    for (let k: uintptr = 0; k < len; k++) {
+      // 7a. Let kValue be items[k].
+      const kValue: JSAny = arguments[Signed(k)];
+
+      // 7b. Let Pk be ! ToString(k).
+      // 7c. Perform ? Set(newObj, Pk, kValue, true).
+      // Buffer may be detached during executing ToNumber/ToBigInt.
+      accessor.StoreJSAny(context, newObj, k, kValue) otherwise IfDetached;
+
+      // 7d. Increase k by 1. (done by the loop).
     }
+
+    // 8. Return newObj.
+    return newObj;
+  } label NotConstructor deferred {
+    ThrowTypeError(MessageTemplate::kNotConstructor, receiver);
+  } label IfDetached deferred {
+    ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameOf);
   }
 }
+}
diff --git a/deps/v8/src/builtins/typed-array-reduce.tq b/deps/v8/src/builtins/typed-array-reduce.tq
index a2ff53f65c4..a54ed1040e9 100644
--- a/deps/v8/src/builtins/typed-array-reduce.tq
+++ b/deps/v8/src/builtins/typed-array-reduce.tq
@@ -5,65 +5,61 @@
 #include 'src/builtins/builtins-typed-array-gen.h'
 
 namespace typed_array {
-  const kBuiltinNameReduce: constexpr string = '%TypedArray%.prototype.reduce';
+const kBuiltinNameReduce: constexpr string = '%TypedArray%.prototype.reduce';
 
-  transitioning macro ReduceAllElements(implicit context: Context)(
-      array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      initialValue: JSAny|TheHole): JSAny {
-    let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
-    const length: uintptr = witness.Get().length;
-    let accumulator = initialValue;
-    for (let k: uintptr = 0; k < length; k++) {
-      // BUG(4895): We should throw on detached buffers rather than simply exit.
-      witness.Recheck() otherwise break;
-      const value: JSAny = witness.Load(k);
-      typeswitch (accumulator) {
-        case (TheHole): {
-          accumulator = value;
-        }
-        case (accumulatorNotHole: JSAny): {
-          // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
-          // indices to optimize Convert<Number>(k) for the most common case.
-          accumulator = Call(
-              context, callbackfn, Undefined, accumulatorNotHole, value,
-              Convert<Number>(k), witness.GetStable());
-        }
-      }
-    }
+transitioning macro ReduceAllElements(implicit context: Context)(
+    array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
+    initialValue: JSAny|TheHole): JSAny {
+  let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
+  const length: uintptr = witness.Get().length;
+  let accumulator = initialValue;
+  for (let k: uintptr = 0; k < length; k++) {
+    // BUG(4895): We should throw on detached buffers rather than simply exit.
+    witness.Recheck() otherwise break;
+    const value: JSAny = witness.Load(k);
     typeswitch (accumulator) {
       case (TheHole): {
-        ThrowTypeError(MessageTemplate::kReduceNoInitial, kBuiltinNameReduce);
+        accumulator = value;
       }
-      case (accumulator: JSAny): {
-        return accumulator;
+      case (accumulatorNotHole: JSAny): {
+        // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+        // indices to optimize Convert<Number>(k) for the most common case.
+        accumulator = Call(
+            context, callbackfn, Undefined, accumulatorNotHole, value,
+            Convert<Number>(k), witness.GetStable());
       }
     }
   }
-
-  // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.reduce
-  transitioning javascript builtin
-  TypedArrayPrototypeReduce(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    // arguments[0] = callback
-    // arguments[1] = initialValue.
-    try {
-      const array: JSTypedArray = Cast<JSTypedArray>(receiver)
-          otherwise NotTypedArray;
-      const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
-
-      const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
-      const initialValue = arguments.length >= 2 ? arguments[1] : TheHole;
-      return ReduceAllElements(uarray, callbackfn, initialValue);
-    }
-    label NotCallable deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
-    }
-    label NotTypedArray deferred {
-      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameReduce);
+  typeswitch (accumulator) {
+    case (TheHole): {
+      ThrowTypeError(MessageTemplate::kReduceNoInitial, kBuiltinNameReduce);
     }
-    label IsDetached deferred {
-      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameReduce);
+    case (accumulator: JSAny): {
+      return accumulator;
     }
   }
 }
+
+// https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.reduce
+transitioning javascript builtin
+TypedArrayPrototypeReduce(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // arguments[0] = callback
+  // arguments[1] = initialValue.
+  try {
+    const array: JSTypedArray = Cast<JSTypedArray>(receiver)
+        otherwise NotTypedArray;
+    const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
+
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
+    const initialValue = arguments.length >= 2 ? arguments[1] : TheHole;
+    return ReduceAllElements(uarray, callbackfn, initialValue);
+  } label NotCallable deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+  } label NotTypedArray deferred {
+    ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameReduce);
+  } label IsDetached deferred {
+    ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameReduce);
+  }
+}
+}
diff --git a/deps/v8/src/builtins/typed-array-reduceright.tq b/deps/v8/src/builtins/typed-array-reduceright.tq
index ab334a1b866..9ba2f70de4e 100644
--- a/deps/v8/src/builtins/typed-array-reduceright.tq
+++ b/deps/v8/src/builtins/typed-array-reduceright.tq
@@ -5,69 +5,65 @@
 #include 'src/builtins/builtins-typed-array-gen.h'
 
 namespace typed_array {
-  const kBuiltinNameReduceRight: constexpr string =
-      '%TypedArray%.prototype.reduceRight';
+const kBuiltinNameReduceRight: constexpr string =
+    '%TypedArray%.prototype.reduceRight';
 
-  transitioning macro ReduceRightAllElements(implicit context: Context)(
-      array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      initialValue: JSAny|TheHole): JSAny {
-    let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
-    const length: uintptr = witness.Get().length;
-    let accumulator = initialValue;
-    for (let k: uintptr = length; k-- > 0;) {
-      // BUG(4895): We should throw on detached buffers rather than simply exit.
-      witness.Recheck() otherwise break;
-      const value: JSAny = witness.Load(k);
-      typeswitch (accumulator) {
-        case (TheHole): {
-          accumulator = value;
-        }
-        case (accumulatorNotHole: JSAny): {
-          // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
-          // indices to optimize Convert<Number>(k) for the most common case.
-          accumulator = Call(
-              context, callbackfn, Undefined, accumulatorNotHole, value,
-              Convert<Number>(k), witness.GetStable());
-        }
-      }
-    }
+transitioning macro ReduceRightAllElements(implicit context: Context)(
+    array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
+    initialValue: JSAny|TheHole): JSAny {
+  let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
+  const length: uintptr = witness.Get().length;
+  let accumulator = initialValue;
+  for (let k: uintptr = length; k-- > 0;) {
+    // BUG(4895): We should throw on detached buffers rather than simply exit.
+    witness.Recheck() otherwise break;
+    const value: JSAny = witness.Load(k);
     typeswitch (accumulator) {
       case (TheHole): {
-        ThrowTypeError(
-            MessageTemplate::kReduceNoInitial, kBuiltinNameReduceRight);
+        accumulator = value;
       }
-      case (accumulator: JSAny): {
-        return accumulator;
+      case (accumulatorNotHole: JSAny): {
+        // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+        // indices to optimize Convert<Number>(k) for the most common case.
+        accumulator = Call(
+            context, callbackfn, Undefined, accumulatorNotHole, value,
+            Convert<Number>(k), witness.GetStable());
       }
     }
   }
+  typeswitch (accumulator) {
+    case (TheHole): {
+      ThrowTypeError(
+          MessageTemplate::kReduceNoInitial, kBuiltinNameReduceRight);
+    }
+    case (accumulator: JSAny): {
+      return accumulator;
+    }
+  }
+}
 
-  // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.reduceright
-  transitioning javascript builtin
-  TypedArrayPrototypeReduceRight(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    // arguments[0] = callback
-    // arguments[1] = initialValue.
-    try {
-      const array: JSTypedArray = Cast<JSTypedArray>(receiver)
-          otherwise NotTypedArray;
-      const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
+// https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.reduceright
+transitioning javascript builtin
+TypedArrayPrototypeReduceRight(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // arguments[0] = callback
+  // arguments[1] = initialValue.
+  try {
+    const array: JSTypedArray = Cast<JSTypedArray>(receiver)
+        otherwise NotTypedArray;
+    const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
 
-      const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
-      const initialValue = arguments.length >= 2 ? arguments[1] : TheHole;
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
+    const initialValue = arguments.length >= 2 ? arguments[1] : TheHole;
 
-      return ReduceRightAllElements(uarray, callbackfn, initialValue);
-    }
-    label NotCallable deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
-    }
-    label NotTypedArray deferred {
-      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameReduceRight);
-    }
-    label IsDetached deferred {
-      ThrowTypeError(
-          MessageTemplate::kDetachedOperation, kBuiltinNameReduceRight);
-    }
+    return ReduceRightAllElements(uarray, callbackfn, initialValue);
+  } label NotCallable deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+  } label NotTypedArray deferred {
+    ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameReduceRight);
+  } label IsDetached deferred {
+    ThrowTypeError(
+        MessageTemplate::kDetachedOperation, kBuiltinNameReduceRight);
   }
 }
+}
diff --git a/deps/v8/src/builtins/typed-array-set.tq b/deps/v8/src/builtins/typed-array-set.tq
index bb70692e766..b5c9dcb261d 100644
--- a/deps/v8/src/builtins/typed-array-set.tq
+++ b/deps/v8/src/builtins/typed-array-set.tq
@@ -5,315 +5,306 @@
 #include 'src/builtins/builtins-typed-array-gen.h'
 
 namespace typed_array {
-  const kBuiltinNameSet: constexpr string = '%TypedArray%.prototype.set';
-
-  extern runtime TypedArraySet(Context, JSTypedArray, Object, Number, Number):
-      void;
-
-  extern macro
-  TypedArrayBuiltinsAssembler::CallCCopyFastNumberJSArrayElementsToTypedArray(
-      Context,
-      FastJSArray,           // source
-      AttachedJSTypedArray,  // dest
-      uintptr,               // sourceLength
-      uintptr                // destOffset
-      ): void;
-
-  extern macro
-  TypedArrayBuiltinsAssembler::CallCCopyTypedArrayElementsToTypedArray(
-      AttachedJSTypedArray,  // source
-      AttachedJSTypedArray,  // dest
-      uintptr,               // sourceLength
-      uintptr                // destOffset
-      ): void;
-
-  // %TypedArray%.prototype.set ( overloaded [ , offset ] )
-  // https://tc39.es/ecma262/#sec-%typedarray%.prototype.set-overloaded-offset
-  transitioning javascript builtin
-  TypedArrayPrototypeSet(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSAny {
-    // Steps 2-8 are the same for
-    // %TypedArray%.prototype.set ( array [ , offset ] ) and
-    // %TypedArray%.prototype.set ( typedArray [ , offset ] ) overloads.
-
-    let target: JSTypedArray;
-    try {
-      // 2. Let target be the this value.
-      // 3. Perform ? RequireInternalSlot(target, [[TypedArrayName]]).
-      // 4. Assert: target has a [[ViewedArrayBuffer]] internal slot.
-      target = Cast<JSTypedArray>(receiver) otherwise NotTypedArray;
-    }
-    label NotTypedArray deferred {
-      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameSet);
-    }
-
-    try {
-      // 5. Let targetOffset be ? ToInteger(offset).
-      // 6. If targetOffset < 0, throw a RangeError exception.
-      let targetOffsetOverflowed: bool = false;
-      let targetOffset: uintptr = 0;
-      if (arguments.length > 1) {
-        const offsetArg = arguments[1];
-        try {
-          targetOffset = ToUintPtr(offsetArg)
-          // On values less than zero throw RangeError immediately.
-              otherwise OffsetOutOfBounds,
-              // On UintPtr or SafeInteger range overflow throw RangeError after
-              // performing observable steps to follow the spec.
-              OffsetOverflow, OffsetOverflow;
-        }
-        label OffsetOverflow {
-          targetOffsetOverflowed = true;
-        }
-      } else {
-        // If the offset argument is not provided then the targetOffset is 0.
-      }
-
-      // 7. Let targetBuffer be target.[[ViewedArrayBuffer]].
-      // 8. If IsDetachedBuffer(targetBuffer) is true, throw a TypeError
-      //   exception.
-      const utarget = typed_array::EnsureAttached(target) otherwise IsDetached;
+const kBuiltinNameSet: constexpr string = '%TypedArray%.prototype.set';
+
+extern runtime TypedArraySet(
+    Context, JSTypedArray, Object, Number, Number): void;
+
+extern macro
+TypedArrayBuiltinsAssembler::CallCCopyFastNumberJSArrayElementsToTypedArray(
+    Context,
+    FastJSArray,           // source
+    AttachedJSTypedArray,  // dest
+    uintptr,               // sourceLength
+    uintptr                // destOffset
+    ): void;
+
+extern macro
+TypedArrayBuiltinsAssembler::CallCCopyTypedArrayElementsToTypedArray(
+    AttachedJSTypedArray,  // source
+    AttachedJSTypedArray,  // dest
+    uintptr,               // sourceLength
+    uintptr                // destOffset
+    ): void;
+
+// %TypedArray%.prototype.set ( overloaded [ , offset ] )
+// https://tc39.es/ecma262/#sec-%typedarray%.prototype.set-overloaded-offset
+transitioning javascript builtin
+TypedArrayPrototypeSet(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // Steps 2-8 are the same for
+  // %TypedArray%.prototype.set ( array [ , offset ] ) and
+  // %TypedArray%.prototype.set ( typedArray [ , offset ] ) overloads.
+
+  let target: JSTypedArray;
+  try {
+    // 2. Let target be the this value.
+    // 3. Perform ? RequireInternalSlot(target, [[TypedArrayName]]).
+    // 4. Assert: target has a [[ViewedArrayBuffer]] internal slot.
+    target = Cast<JSTypedArray>(receiver) otherwise NotTypedArray;
+  } label NotTypedArray deferred {
+    ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameSet);
+  }
 
-      const overloadedArg = arguments[0];
+  try {
+    // 5. Let targetOffset be ? ToInteger(offset).
+    // 6. If targetOffset < 0, throw a RangeError exception.
+    let targetOffsetOverflowed: bool = false;
+    let targetOffset: uintptr = 0;
+    if (arguments.length > 1) {
+      const offsetArg = arguments[1];
       try {
-        // 1. Choose 22.2.3.23.2 or 22.2.3.23.1 depending on whether the
-        //   overloadedArg has a [[TypedArrayName]] internal slot.
-        //   If it does, the definition in 22.2.3.23.2 applies.
-        //   If it does not, the definition in 22.2.3.23.1 applies.
-        const typedArray =
-            Cast<JSTypedArray>(overloadedArg) otherwise NotTypedArray;
-
-        // Step 9 is not observable, do it later.
-
-        // 10. Let srcBuffer be typedArray.[[ViewedArrayBuffer]].
-        // 11. If IsDetachedBuffer(srcBuffer) is true, throw a TypeError
-        //   exception.
-        const utypedArray =
-            typed_array::EnsureAttached(typedArray) otherwise IsDetached;
-
-        TypedArrayPrototypeSetTypedArray(
-            utarget, utypedArray, targetOffset, targetOffsetOverflowed)
-            otherwise OffsetOutOfBounds;
-        return Undefined;
-      }
-      label NotTypedArray deferred {
-        TypedArrayPrototypeSetArray(
-            utarget, overloadedArg, targetOffset, targetOffsetOverflowed)
-            otherwise OffsetOutOfBounds, IsDetached;
-        return Undefined;
+        targetOffset = ToUintPtr(offsetArg)
+        // On values less than zero throw RangeError immediately.
+            otherwise OffsetOutOfBounds,
+            // On UintPtr or SafeInteger range overflow throw RangeError after
+            // performing observable steps to follow the spec.
+            OffsetOverflow, OffsetOverflow;
+      } label OffsetOverflow {
+        targetOffsetOverflowed = true;
       }
+    } else {
+      // If the offset argument is not provided then the targetOffset is 0.
     }
-    label OffsetOutOfBounds deferred {
-      ThrowRangeError(MessageTemplate::kTypedArraySetOffsetOutOfBounds);
-    }
-    label IsDetached deferred {
-      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameSet);
-    }
-  }
 
-  // %TypedArray%.prototype.set ( array [ , offset ] )
-  // https://tc39.es/ecma262/#sec-%typedarray%.prototype.set-array-offset
-  transitioning macro
-  TypedArrayPrototypeSetArray(implicit context: Context, receiver: JSAny)(
-      target: JSTypedArray, arrayArg: JSAny, targetOffset: uintptr,
-      targetOffsetOverflowed: bool): void labels IfOffsetOutOfBounds,
-      IfDetached {
-    // Steps 9-13 are not observable, do them later.
-
-    // TODO(v8:8906): This ported behaviour is an observable spec violation and
-    // the comment below seems to be outdated. Consider removing this code.
+    // 7. Let targetBuffer be target.[[ViewedArrayBuffer]].
+    // 8. If IsDetachedBuffer(targetBuffer) is true, throw a TypeError
+    //   exception.
+    const utarget = typed_array::EnsureAttached(target) otherwise IsDetached;
+
+    const overloadedArg = arguments[0];
     try {
-      const _arrayArgNum = Cast<Number>(arrayArg) otherwise NotNumber;
-      // For number as a first argument, throw TypeError instead of silently
-      // ignoring the call, so that users know they did something wrong.
-      // (Consistent with Firefox and Blink/WebKit)
-      ThrowTypeError(MessageTemplate::kInvalidArgument);
-    }
-    label NotNumber {
-      // Proceed to step 14.
-    }
+      // 1. Choose 22.2.3.23.2 or 22.2.3.23.1 depending on whether the
+      //   overloadedArg has a [[TypedArrayName]] internal slot.
+      //   If it does, the definition in 22.2.3.23.2 applies.
+      //   If it does not, the definition in 22.2.3.23.1 applies.
+      const typedArray =
+          Cast<JSTypedArray>(overloadedArg) otherwise NotTypedArray;
 
-    // 14. Let src be ? ToObject(array).
-    const src: JSReceiver = ToObject_Inline(context, arrayArg);
+      // Step 9 is not observable, do it later.
 
-    // 15. Let srcLength be ? LengthOfArrayLike(src).
-    const srcLengthNum: Number = GetLengthProperty(src);
+      // 10. Let srcBuffer be typedArray.[[ViewedArrayBuffer]].
+      // 11. If IsDetachedBuffer(srcBuffer) is true, throw a TypeError
+      //   exception.
+      const utypedArray =
+          typed_array::EnsureAttached(typedArray) otherwise IsDetached;
+
+      TypedArrayPrototypeSetTypedArray(
+          utarget, utypedArray, targetOffset, targetOffsetOverflowed)
+          otherwise OffsetOutOfBounds;
+      return Undefined;
+    } label NotTypedArray deferred {
+      TypedArrayPrototypeSetArray(
+          utarget, overloadedArg, targetOffset, targetOffsetOverflowed)
+          otherwise OffsetOutOfBounds, IsDetached;
+      return Undefined;
+    }
+  } label OffsetOutOfBounds deferred {
+    ThrowRangeError(MessageTemplate::kTypedArraySetOffsetOutOfBounds);
+  } label IsDetached deferred {
+    ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameSet);
+  }
+}
 
-    if (targetOffsetOverflowed) goto IfOffsetOutOfBounds;
+// %TypedArray%.prototype.set ( array [ , offset ] )
+// https://tc39.es/ecma262/#sec-%typedarray%.prototype.set-array-offset
+transitioning macro
+TypedArrayPrototypeSetArray(implicit context: Context, receiver: JSAny)(
+    target: JSTypedArray, arrayArg: JSAny, targetOffset: uintptr,
+    targetOffsetOverflowed: bool): void labels IfOffsetOutOfBounds,
+    IfDetached {
+  // Steps 9-13 are not observable, do them later.
+
+  // TODO(v8:8906): This ported behaviour is an observable spec violation and
+  // the comment below seems to be outdated. Consider removing this code.
+  try {
+    const _arrayArgNum = Cast<Number>(arrayArg) otherwise NotNumber;
+    // For number as a first argument, throw TypeError instead of silently
+    // ignoring the call, so that users know they did something wrong.
+    // (Consistent with Firefox and Blink/WebKit)
+    ThrowTypeError(MessageTemplate::kInvalidArgument);
+  } label NotNumber {
+    // Proceed to step 14.
+  }
 
-    // 9. Let targetLength be target.[[ArrayLength]].
-    const targetLength = target.length;
+  // 14. Let src be ? ToObject(array).
+  const src: JSReceiver = ToObject_Inline(context, arrayArg);
+
+  // 15. Let srcLength be ? LengthOfArrayLike(src).
+  const srcLengthNum: Number = GetLengthProperty(src);
+
+  if (targetOffsetOverflowed) goto IfOffsetOutOfBounds;
+
+  // 9. Let targetLength be target.[[ArrayLength]].
+  const targetLength = target.length;
+
+  // 16. If srcLength + targetOffset > targetLength, throw a RangeError
+  //   exception.
+  const srcLength = ChangeSafeIntegerNumberToUintPtr(srcLengthNum)
+      otherwise IfOffsetOutOfBounds;
+  CheckIntegerIndexAdditionOverflow(srcLength, targetOffset, targetLength)
+      otherwise IfOffsetOutOfBounds;
+
+  // All the obvervable side effects are executed, so there's nothing else
+  // to do with the empty source array.
+  if (srcLength == 0) return;
+
+  // 10. Let targetName be the String value of target.[[TypedArrayName]].
+  // 11. Let targetElementSize be the Element Size value specified in
+  //   Table 62 for targetName.
+  // 12. Let targetType be the Element Type value in Table 62 for
+  //   targetName.
+
+  try {
+    // BigInt typed arrays are not handled by
+    // CopyFastNumberJSArrayElementsToTypedArray.
+    if (IsBigInt64ElementsKind(target.elements_kind)) goto IfSlow;
+
+    const fastSrc: FastJSArray = Cast<FastJSArray>(src) otherwise goto IfSlow;
+    const srcKind: ElementsKind = fastSrc.map.elements_kind;
+
+    // CopyFastNumberJSArrayElementsToTypedArray() can be used only with the
+    // following elements kinds:
+    // PACKED_SMI_ELEMENTS, HOLEY_SMI_ELEMENTS, PACKED_DOUBLE_ELEMENTS,
+    // HOLEY_DOUBLE_ELEMENTS.
+    if (IsElementsKindInRange(
+            srcKind, ElementsKind::PACKED_SMI_ELEMENTS,
+            ElementsKind::HOLEY_SMI_ELEMENTS) ||
+        IsElementsKindInRange(
+            srcKind, ElementsKind::PACKED_DOUBLE_ELEMENTS,
+            ElementsKind::HOLEY_DOUBLE_ELEMENTS)) {
+      const utarget = typed_array::EnsureAttached(target) otherwise IfDetached;
+      CallCCopyFastNumberJSArrayElementsToTypedArray(
+          context, fastSrc, utarget, srcLength, targetOffset);
+
+    } else {
+      goto IfSlow;
+    }
+  } label IfSlow deferred {
+    TypedArraySet(
+        context, target, src, srcLengthNum, Convert<Number>(targetOffset));
+  }
+}
 
-    // 16. If srcLength + targetOffset > targetLength, throw a RangeError
-    //   exception.
-    const srcLength = ChangeSafeIntegerNumberToUintPtr(srcLengthNum)
-        otherwise IfOffsetOutOfBounds;
-    CheckIntegerIndexAdditionOverflow(srcLength, targetOffset, targetLength)
-        otherwise IfOffsetOutOfBounds;
+// %TypedArray%.prototype.set ( typedArray [ , offset ] )
+// https://tc39.es/ecma262/#sec-%typedarray%.prototype.set-typedarray-offset
+transitioning macro
+TypedArrayPrototypeSetTypedArray(implicit context: Context, receiver: JSAny)(
+    target: AttachedJSTypedArray, typedArray: AttachedJSTypedArray,
+    targetOffset: uintptr,
+    targetOffsetOverflowed: bool): void labels IfOffsetOutOfBounds {
+  // Steps 12-20 are not observable, so we can handle offset overflow
+  // at step 21 here.
+  if (targetOffsetOverflowed) goto IfOffsetOutOfBounds;
+
+  // 9. Let targetLength be target.[[ArrayLength]].
+  const targetLength = target.length;
+
+  // 19. Let srcLength be typedArray.[[ArrayLength]].
+  const srcLength: uintptr = typedArray.length;
+
+  // Steps 12-20 are not observable, so we can do step 21 here.
+
+  // 21. If srcLength + targetOffset > targetLength, throw a RangeError
+  //   exception.
+  CheckIntegerIndexAdditionOverflow(srcLength, targetOffset, targetLength)
+      otherwise IfOffsetOutOfBounds;
+
+  // 12. Let targetName be the String value of target.[[TypedArrayName]].
+  // 13. Let targetType be the Element Type value in Table 62 for
+  //   targetName.
+  // 14. Let targetElementSize be the Element Size value specified in
+  //   Table 62 for targetName.
+  const targetElementsInfo = GetTypedArrayElementsInfo(target);
+
+  // 16. Let srcName be the String value of typedArray.[[TypedArrayName]].
+  // 17. Let srcType be the Element Type value in Table 62 for srcName.
+  // 18. Let srcElementSize be the Element Size value specified in
+  //   Table 62 for srcName.
+  const srcKind: ElementsKind = typedArray.elements_kind;
+  // const srcElementsInfo = GetTypedArrayElementsInfo(typedArray);
+
+  // We skip steps 23-25 because both memmove and
+  // CopyTypedArrayElementsToTypedArray() properly handle overlapping
+  // regions.
+
+  // 23. If both IsSharedArrayBuffer(srcBuffer) and
+  //   IsSharedArrayBuffer(targetBuffer) are true, then
+  // 23a. If srcBuffer.[[ArrayBufferData]] and
+  //   targetBuffer.[[ArrayBufferData]] are the same Shared Data Block
+  //   values, let same be true; else let same be false.
+  // 24. Else, let same be SameValue(srcBuffer, targetBuffer).
+  // 25. If same is true, then
+  //   a. Let srcByteLength be typedArray.[[ByteLength]].
+  //   b. Set srcBuffer to ? CloneArrayBuffer(srcBuffer, srcByteOffset,
+  //    srcByteLength, %ArrayBuffer%).
+  //   c. NOTE: %ArrayBuffer% is used to clone srcBuffer because is it known
+  //    to not have any observable side-effects.
+  //   d. Let srcByteIndex be 0.
+
+  try {
+    // Use memmove if possible.
+    if (srcKind != targetElementsInfo.kind) {
+      // Uint8/Uint8Clamped elements could still be copied with memmove.
+      if (!IsUint8ElementsKind(srcKind) ||
+          !IsUint8ElementsKind(targetElementsInfo.kind)) {
+        goto IfSlow;
+      }
+    }
 
     // All the obvervable side effects are executed, so there's nothing else
     // to do with the empty source array.
     if (srcLength == 0) return;
 
-    // 10. Let targetName be the String value of target.[[TypedArrayName]].
-    // 11. Let targetElementSize be the Element Size value specified in
-    //   Table 62 for targetName.
-    // 12. Let targetType be the Element Type value in Table 62 for
-    //   targetName.
-
-    try {
-      // BigInt typed arrays are not handled by
-      // CopyFastNumberJSArrayElementsToTypedArray.
-      if (IsBigInt64ElementsKind(target.elements_kind)) goto IfSlow;
-
-      const fastSrc: FastJSArray = Cast<FastJSArray>(src) otherwise goto IfSlow;
-      const srcKind: ElementsKind = fastSrc.map.elements_kind;
-
-      // CopyFastNumberJSArrayElementsToTypedArray() can be used only with the
-      // following elements kinds:
-      // PACKED_SMI_ELEMENTS, HOLEY_SMI_ELEMENTS, PACKED_DOUBLE_ELEMENTS,
-      // HOLEY_DOUBLE_ELEMENTS.
-      if (IsElementsKindInRange(
-              srcKind, ElementsKind::PACKED_SMI_ELEMENTS,
-              ElementsKind::HOLEY_SMI_ELEMENTS) ||
-          IsElementsKindInRange(
-              srcKind, ElementsKind::PACKED_DOUBLE_ELEMENTS,
-              ElementsKind::HOLEY_DOUBLE_ELEMENTS)) {
-        const utarget =
-            typed_array::EnsureAttached(target) otherwise IfDetached;
-        CallCCopyFastNumberJSArrayElementsToTypedArray(
-            context, fastSrc, utarget, srcLength, targetOffset);
-
-      } else {
-        goto IfSlow;
+    // Source and destination typed arrays have same elements kinds (modulo
+    // Uint8-Uint8Clamped difference) so we can use targetElementsInfo for
+    // calculations.
+    const countBytes: uintptr =
+        targetElementsInfo.CalculateByteLength(srcLength)
+        otherwise unreachable;
+    const startOffset: uintptr =
+        targetElementsInfo.CalculateByteLength(targetOffset)
+        otherwise unreachable;
+    const dstPtr: RawPtr = target.data_ptr + Convert<intptr>(startOffset);
+
+    assert(countBytes <= target.byte_length - startOffset);
+    assert(countBytes <= typedArray.byte_length);
+
+    // 29. If srcType is the same as targetType, then
+    //   a. NOTE: If srcType and targetType are the same, the transfer must
+    //      be performed in a manner that preserves the bit-level encoding of
+    //      the source data.
+    //   b. Repeat, while targetByteIndex < limit
+    //      i. Let value be GetValueFromBuffer(srcBuffer, srcByteIndex, Uint8,
+    //                                         true, Unordered).
+    //     ii. Perform SetValueInBuffer(targetBuffer, targetByteIndex, Uint8,
+    //                                  value, true, Unordered).
+    //    iii. Set srcByteIndex to srcByteIndex + 1.
+    //     iv. Set targetByteIndex to targetByteIndex + 1.
+    CallCMemmove(dstPtr, typedArray.data_ptr, countBytes);
+  } label IfSlow deferred {
+    // 22. If target.[[ContentType]] is not equal to
+    //   typedArray.[[ContentType]], throw a TypeError exception.
+    if (IsBigInt64ElementsKind(srcKind) !=
+        IsBigInt64ElementsKind(targetElementsInfo.kind))
+      deferred {
+        ThrowTypeError(MessageTemplate::kBigIntMixedTypes);
       }
-    }
-    label IfSlow deferred {
-      TypedArraySet(
-          context, target, src, srcLengthNum, Convert<Number>(targetOffset));
-    }
-  }
-
-  // %TypedArray%.prototype.set ( typedArray [ , offset ] )
-  // https://tc39.es/ecma262/#sec-%typedarray%.prototype.set-typedarray-offset
-  transitioning macro
-  TypedArrayPrototypeSetTypedArray(implicit context: Context, receiver: JSAny)(
-      target: AttachedJSTypedArray, typedArray: AttachedJSTypedArray,
-      targetOffset: uintptr,
-      targetOffsetOverflowed: bool): void labels IfOffsetOutOfBounds {
-    // Steps 12-20 are not observable, so we can handle offset overflow
-    // at step 21 here.
-    if (targetOffsetOverflowed) goto IfOffsetOutOfBounds;
-
-    // 9. Let targetLength be target.[[ArrayLength]].
-    const targetLength = target.length;
 
-    // 19. Let srcLength be typedArray.[[ArrayLength]].
-    const srcLength: uintptr = typedArray.length;
-
-    // Steps 12-20 are not observable, so we can do step 21 here.
-
-    // 21. If srcLength + targetOffset > targetLength, throw a RangeError
-    //   exception.
-    CheckIntegerIndexAdditionOverflow(srcLength, targetOffset, targetLength)
-        otherwise IfOffsetOutOfBounds;
-
-    // 12. Let targetName be the String value of target.[[TypedArrayName]].
-    // 13. Let targetType be the Element Type value in Table 62 for
-    //   targetName.
-    // 14. Let targetElementSize be the Element Size value specified in
-    //   Table 62 for targetName.
-    const targetElementsInfo = GetTypedArrayElementsInfo(target);
-
-    // 16. Let srcName be the String value of typedArray.[[TypedArrayName]].
-    // 17. Let srcType be the Element Type value in Table 62 for srcName.
-    // 18. Let srcElementSize be the Element Size value specified in
-    //   Table 62 for srcName.
-    const srcKind: ElementsKind = typedArray.elements_kind;
-    // const srcElementsInfo = GetTypedArrayElementsInfo(typedArray);
-
-    // We skip steps 23-25 because both memmove and
-    // CopyTypedArrayElementsToTypedArray() properly handle overlapping
-    // regions.
-
-    // 23. If both IsSharedArrayBuffer(srcBuffer) and
-    //   IsSharedArrayBuffer(targetBuffer) are true, then
-    // 23a. If srcBuffer.[[ArrayBufferData]] and
-    //   targetBuffer.[[ArrayBufferData]] are the same Shared Data Block
-    //   values, let same be true; else let same be false.
-    // 24. Else, let same be SameValue(srcBuffer, targetBuffer).
-    // 25. If same is true, then
-    //   a. Let srcByteLength be typedArray.[[ByteLength]].
-    //   b. Set srcBuffer to ? CloneArrayBuffer(srcBuffer, srcByteOffset,
-    //    srcByteLength, %ArrayBuffer%).
-    //   c. NOTE: %ArrayBuffer% is used to clone srcBuffer because is it known
-    //    to not have any observable side-effects.
-    //   d. Let srcByteIndex be 0.
-
-    try {
-      // Use memmove if possible.
-      if (srcKind != targetElementsInfo.kind) {
-        // Uint8/Uint8Clamped elements could still be copied with memmove.
-        if (!IsUint8ElementsKind(srcKind) ||
-            !IsUint8ElementsKind(targetElementsInfo.kind)) {
-          goto IfSlow;
-        }
-      }
+    // All the obvervable side effects are executed, so there's nothing else
+    // to do with the empty source array.
+    if (srcLength == 0) return;
 
-      // All the obvervable side effects are executed, so there's nothing else
-      // to do with the empty source array.
-      if (srcLength == 0) return;
-
-      // Source and destination typed arrays have same elements kinds (modulo
-      // Uint8-Uint8Clamped difference) so we can use targetElementsInfo for
-      // calculations.
-      const countBytes: uintptr =
-          targetElementsInfo.CalculateByteLength(srcLength)
-          otherwise unreachable;
-      const startOffset: uintptr =
-          targetElementsInfo.CalculateByteLength(targetOffset)
-          otherwise unreachable;
-      const dstPtr: RawPtr = target.data_ptr + Convert<intptr>(startOffset);
-
-      assert(countBytes <= target.byte_length - startOffset);
-      assert(countBytes <= typedArray.byte_length);
-
-      // 29. If srcType is the same as targetType, then
-      //   a. NOTE: If srcType and targetType are the same, the transfer must
-      //      be performed in a manner that preserves the bit-level encoding of
-      //      the source data.
-      //   b. Repeat, while targetByteIndex < limit
-      //      i. Let value be GetValueFromBuffer(srcBuffer, srcByteIndex, Uint8,
-      //                                         true, Unordered).
-      //     ii. Perform SetValueInBuffer(targetBuffer, targetByteIndex, Uint8,
-      //                                  value, true, Unordered).
-      //    iii. Set srcByteIndex to srcByteIndex + 1.
-      //     iv. Set targetByteIndex to targetByteIndex + 1.
-      CallCMemmove(dstPtr, typedArray.data_ptr, countBytes);
-    }
-    label IfSlow deferred {
-      // 22. If target.[[ContentType]] is not equal to
-      //   typedArray.[[ContentType]], throw a TypeError exception.
-      if (IsBigInt64ElementsKind(srcKind) !=
-          IsBigInt64ElementsKind(targetElementsInfo.kind))
-        deferred {
-          ThrowTypeError(MessageTemplate::kBigIntMixedTypes);
-        }
-
-      // All the obvervable side effects are executed, so there's nothing else
-      // to do with the empty source array.
-      if (srcLength == 0) return;
-
-      // 30. Else,
-      //   a. Repeat, while targetByteIndex < limit
-      //      i. Let value be GetValueFromBuffer(srcBuffer, srcByteIndex,
-      //                                         srcType, true, Unordered).
-      //     ii. Perform SetValueInBuffer(targetBuffer, targetByteIndex,
-      //                                  targetType, value, true, Unordered).
-      //    iii. Set srcByteIndex to srcByteIndex + srcElementSize.
-      //     iv. Set targetByteIndex to targetByteIndex + targetElementSize.
-      CallCCopyTypedArrayElementsToTypedArray(
-          typedArray, target, srcLength, targetOffset);
-    }
+    // 30. Else,
+    //   a. Repeat, while targetByteIndex < limit
+    //      i. Let value be GetValueFromBuffer(srcBuffer, srcByteIndex,
+    //                                         srcType, true, Unordered).
+    //     ii. Perform SetValueInBuffer(targetBuffer, targetByteIndex,
+    //                                  targetType, value, true, Unordered).
+    //    iii. Set srcByteIndex to srcByteIndex + srcElementSize.
+    //     iv. Set targetByteIndex to targetByteIndex + targetElementSize.
+    CallCCopyTypedArrayElementsToTypedArray(
+        typedArray, target, srcLength, targetOffset);
   }
 }
+}
diff --git a/deps/v8/src/builtins/typed-array-slice.tq b/deps/v8/src/builtins/typed-array-slice.tq
index 578c2d017ad..60604c548fc 100644
--- a/deps/v8/src/builtins/typed-array-slice.tq
+++ b/deps/v8/src/builtins/typed-array-slice.tq
@@ -5,102 +5,99 @@
 #include 'src/builtins/builtins-typed-array-gen.h'
 
 namespace typed_array {
-  const kBuiltinNameSlice: constexpr string = '%TypedArray%.prototype.slice';
-
-  extern macro TypedArrayBuiltinsAssembler::CallCCopyTypedArrayElementsSlice(
-      JSTypedArray, JSTypedArray, uintptr, uintptr): void;
-
-  macro FastCopy(
-      src: typed_array::AttachedJSTypedArray, dest: JSTypedArray, k: uintptr,
-      count: uintptr) labels IfSlow {
-    if (IsForceSlowPath()) goto IfSlow;
-
-    const srcKind: ElementsKind = src.elements_kind;
-    const destInfo = typed_array::GetTypedArrayElementsInfo(dest);
-
-    // dest could be a different type from src or share the same buffer
-    // with the src because of custom species constructor. If the types
-    // of src and result array are the same and they are not sharing the
-    // same buffer, use memmove.
-    if (srcKind != destInfo.kind) goto IfSlow;
-    if (dest.buffer == src.buffer) {
-      goto IfSlow;
-    }
+const kBuiltinNameSlice: constexpr string = '%TypedArray%.prototype.slice';
+
+extern macro TypedArrayBuiltinsAssembler::CallCCopyTypedArrayElementsSlice(
+    JSTypedArray, JSTypedArray, uintptr, uintptr): void;
+
+macro FastCopy(
+    src: typed_array::AttachedJSTypedArray, dest: JSTypedArray, k: uintptr,
+    count: uintptr) labels IfSlow {
+  if (IsForceSlowPath()) goto IfSlow;
+
+  const srcKind: ElementsKind = src.elements_kind;
+  const destInfo = typed_array::GetTypedArrayElementsInfo(dest);
+
+  // dest could be a different type from src or share the same buffer
+  // with the src because of custom species constructor. If the types
+  // of src and result array are the same and they are not sharing the
+  // same buffer, use memmove.
+  if (srcKind != destInfo.kind) goto IfSlow;
+  if (dest.buffer == src.buffer) {
+    goto IfSlow;
+  }
 
-    const countBytes: uintptr = destInfo.CalculateByteLength(count)
-        otherwise unreachable;
-    const startOffset: uintptr = destInfo.CalculateByteLength(k)
-        otherwise unreachable;
-    const srcPtr: RawPtr = src.data_ptr + Convert<intptr>(startOffset);
+  const countBytes: uintptr = destInfo.CalculateByteLength(count)
+      otherwise unreachable;
+  const startOffset: uintptr = destInfo.CalculateByteLength(k)
+      otherwise unreachable;
+  const srcPtr: RawPtr = src.data_ptr + Convert<intptr>(startOffset);
 
-    assert(countBytes <= dest.byte_length);
-    assert(countBytes <= src.byte_length - startOffset);
+  assert(countBytes <= dest.byte_length);
+  assert(countBytes <= src.byte_length - startOffset);
 
-    typed_array::CallCMemmove(dest.data_ptr, srcPtr, countBytes);
-  }
+  typed_array::CallCMemmove(dest.data_ptr, srcPtr, countBytes);
+}
 
-  macro SlowCopy(implicit context: Context)(
-      src: JSTypedArray, dest: JSTypedArray, k: uintptr, final: uintptr) {
-    if (typed_array::IsBigInt64ElementsKind(src.elements_kind) !=
-        typed_array::IsBigInt64ElementsKind(dest.elements_kind))
-      deferred {
-        ThrowTypeError(MessageTemplate::kBigIntMixedTypes);
-      }
+macro SlowCopy(implicit context: Context)(
+    src: JSTypedArray, dest: JSTypedArray, k: uintptr, final: uintptr) {
+  if (typed_array::IsBigInt64ElementsKind(src.elements_kind) !=
+      typed_array::IsBigInt64ElementsKind(dest.elements_kind))
+    deferred {
+      ThrowTypeError(MessageTemplate::kBigIntMixedTypes);
+    }
 
-    CallCCopyTypedArrayElementsSlice(src, dest, k, final);
-  }
+  CallCCopyTypedArrayElementsSlice(src, dest, k, final);
+}
 
-  // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.slice
-  transitioning javascript builtin TypedArrayPrototypeSlice(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSAny {
-    // arguments[0] = start
-    // arguments[1] = end
-
-    // 1. Let O be the this value.
-    // 2. Perform ? ValidateTypedArray(O).
-    const src: JSTypedArray =
-        ValidateTypedArray(context, receiver, kBuiltinNameSlice);
-
-    // 3. Let len be O.[[ArrayLength]].
-    const len: uintptr = src.length;
-
-    // 4. Let relativeStart be ? ToInteger(start).
-    // 5. If relativeStart < 0, let k be max((len + relativeStart), 0);
-    //    else let k be min(relativeStart, len).
-    const start = arguments[0];
-    const k: uintptr =
-        start != Undefined ? ConvertToRelativeIndex(start, len) : 0;
-
-    // 6. If end is undefined, let relativeEnd be len;
-    //    else let relativeEnd be ? ToInteger(end).
-    // 7. If relativeEnd < 0, let final be max((len + relativeEnd), 0);
-    //    else let final be min(relativeEnd, len).
-    const end = arguments[1];
-    const final: uintptr =
-        end != Undefined ? ConvertToRelativeIndex(end, len) : len;
-
-    // 8. Let count be max(final - k, 0).
-    const count: uintptr = Unsigned(IntPtrMax(Signed(final - k), 0));
-
-    // 9. Let A be ? TypedArraySpeciesCreate(O, « count »).
-    const dest: JSTypedArray =
-        TypedArraySpeciesCreateByLength(kBuiltinNameSlice, src, count);
-
-    if (count > 0) {
-      try {
-        const srcAttached = typed_array::EnsureAttached(src)
-            otherwise IfDetached;
-        FastCopy(srcAttached, dest, k, count) otherwise IfSlow;
-      }
-      label IfDetached deferred {
-        ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameSlice);
-      }
-      label IfSlow deferred {
-        SlowCopy(src, dest, k, final);
-      }
+// https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.slice
+transitioning javascript builtin TypedArrayPrototypeSlice(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // arguments[0] = start
+  // arguments[1] = end
+
+  // 1. Let O be the this value.
+  // 2. Perform ? ValidateTypedArray(O).
+  const src: JSTypedArray =
+      ValidateTypedArray(context, receiver, kBuiltinNameSlice);
+
+  // 3. Let len be O.[[ArrayLength]].
+  const len: uintptr = src.length;
+
+  // 4. Let relativeStart be ? ToInteger(start).
+  // 5. If relativeStart < 0, let k be max((len + relativeStart), 0);
+  //    else let k be min(relativeStart, len).
+  const start = arguments[0];
+  const k: uintptr =
+      start != Undefined ? ConvertToRelativeIndex(start, len) : 0;
+
+  // 6. If end is undefined, let relativeEnd be len;
+  //    else let relativeEnd be ? ToInteger(end).
+  // 7. If relativeEnd < 0, let final be max((len + relativeEnd), 0);
+  //    else let final be min(relativeEnd, len).
+  const end = arguments[1];
+  const final: uintptr =
+      end != Undefined ? ConvertToRelativeIndex(end, len) : len;
+
+  // 8. Let count be max(final - k, 0).
+  const count: uintptr = Unsigned(IntPtrMax(Signed(final - k), 0));
+
+  // 9. Let A be ? TypedArraySpeciesCreate(O, « count »).
+  const dest: JSTypedArray =
+      TypedArraySpeciesCreateByLength(kBuiltinNameSlice, src, count);
+
+  if (count > 0) {
+    try {
+      const srcAttached = typed_array::EnsureAttached(src)
+          otherwise IfDetached;
+      FastCopy(srcAttached, dest, k, count) otherwise IfSlow;
+    } label IfDetached deferred {
+      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameSlice);
+    } label IfSlow deferred {
+      SlowCopy(src, dest, k, final);
     }
-
-    return dest;
   }
+
+  return dest;
+}
 }
diff --git a/deps/v8/src/builtins/typed-array-some.tq b/deps/v8/src/builtins/typed-array-some.tq
index a09ce964d58..ecdfae1e8a5 100644
--- a/deps/v8/src/builtins/typed-array-some.tq
+++ b/deps/v8/src/builtins/typed-array-some.tq
@@ -5,52 +5,49 @@
 #include 'src/builtins/builtins-typed-array-gen.h'
 
 namespace typed_array {
-  const kBuiltinNameSome: constexpr string = '%TypedArray%.prototype.some';
+const kBuiltinNameSome: constexpr string = '%TypedArray%.prototype.some';
 
-  transitioning macro SomeAllElements(implicit context: Context)(
-      array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      thisArg: JSAny): Boolean {
-    let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
-    const length: uintptr = witness.Get().length;
-    for (let k: uintptr = 0; k < length; k++) {
-      // BUG(4895): We should throw on detached buffers rather than simply exit.
-      witness.Recheck() otherwise break;
-      const value: JSAny = witness.Load(k);
-      // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
-      // indices to optimize Convert<Number>(k) for the most common case.
-      const result = Call(
-          context, callbackfn, thisArg, value, Convert<Number>(k),
-          witness.GetStable());
-      if (ToBoolean(result)) {
-        return True;
-      }
+transitioning macro SomeAllElements(implicit context: Context)(
+    array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
+    thisArg: JSAny): Boolean {
+  let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
+  const length: uintptr = witness.Get().length;
+  for (let k: uintptr = 0; k < length; k++) {
+    // BUG(4895): We should throw on detached buffers rather than simply exit.
+    witness.Recheck() otherwise break;
+    const value: JSAny = witness.Load(k);
+    // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+    // indices to optimize Convert<Number>(k) for the most common case.
+    const result = Call(
+        context, callbackfn, thisArg, value, Convert<Number>(k),
+        witness.GetStable());
+    if (ToBoolean(result)) {
+      return True;
     }
-    return False;
   }
+  return False;
+}
 
-  // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.some
-  transitioning javascript builtin
-  TypedArrayPrototypeSome(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSAny {
-    // arguments[0] = callback
-    // arguments[1] = thisArg.
-    try {
-      const array: JSTypedArray = Cast<JSTypedArray>(receiver)
-          otherwise NotTypedArray;
-      const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
+// https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.some
+transitioning javascript builtin
+TypedArrayPrototypeSome(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // arguments[0] = callback
+  // arguments[1] = thisArg.
+  try {
+    const array: JSTypedArray = Cast<JSTypedArray>(receiver)
+        otherwise NotTypedArray;
+    const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
 
-      const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
-      const thisArg = arguments[1];
-      return SomeAllElements(uarray, callbackfn, thisArg);
-    }
-    label NotCallable deferred {
-      ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
-    }
-    label NotTypedArray deferred {
-      ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameSome);
-    }
-    label IsDetached deferred {
-      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameSome);
-    }
+    const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
+    const thisArg = arguments[1];
+    return SomeAllElements(uarray, callbackfn, thisArg);
+  } label NotCallable deferred {
+    ThrowTypeError(MessageTemplate::kCalledNonCallable, arguments[0]);
+  } label NotTypedArray deferred {
+    ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameSome);
+  } label IsDetached deferred {
+    ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameSome);
   }
 }
+}
diff --git a/deps/v8/src/builtins/typed-array-sort.tq b/deps/v8/src/builtins/typed-array-sort.tq
index 171068761d6..c32808038d0 100644
--- a/deps/v8/src/builtins/typed-array-sort.tq
+++ b/deps/v8/src/builtins/typed-array-sort.tq
@@ -5,141 +5,140 @@
 #include 'src/builtins/builtins-typed-array-gen.h'
 
 namespace typed_array {
-  const kBuiltinNameSort: constexpr string = '%TypedArray%.prototype.sort';
+const kBuiltinNameSort: constexpr string = '%TypedArray%.prototype.sort';
 
-  extern runtime TypedArraySortFast(Context, JSAny): JSTypedArray;
+extern runtime TypedArraySortFast(Context, JSAny): JSTypedArray;
 
-  transitioning macro CallCompare(
-      implicit context: Context, array: JSTypedArray,
-      comparefn: Callable)(a: JSAny, b: JSAny): Number {
-    // a. Let v be ? ToNumber(? Call(comparefn, undefined, x, y)).
-    const v: Number =
-        ToNumber_Inline(Call(context, comparefn, Undefined, a, b));
+transitioning macro CallCompare(
+    implicit context: Context, array: JSTypedArray, comparefn: Callable)(
+    a: JSAny, b: JSAny): Number {
+  // a. Let v be ? ToNumber(? Call(comparefn, undefined, x, y)).
+  const v: Number = ToNumber_Inline(Call(context, comparefn, Undefined, a, b));
 
-    // b. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
-    if (IsDetachedBuffer(array.buffer)) {
-      ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameSort);
-    }
+  // b. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+  if (IsDetachedBuffer(array.buffer)) {
+    ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameSort);
+  }
 
-    // c. If v is NaN, return +0.
-    if (NumberIsNaN(v)) return 0;
+  // c. If v is NaN, return +0.
+  if (NumberIsNaN(v)) return 0;
 
-    // d. return v.
-    return v;
-  }
+  // d. return v.
+  return v;
+}
 
-  // Merges two sorted runs [from, middle) and [middle, to)
-  // from "source" into "target".
-  transitioning macro
-  TypedArrayMerge(
-      implicit context: Context, array: JSTypedArray, comparefn: Callable)(
-      source: FixedArray, from: uintptr, middle: uintptr, to: uintptr,
-      target: FixedArray) {
-    let left: uintptr = from;
-    let right: uintptr = middle;
-
-    for (let targetIndex: uintptr = from; targetIndex < to; ++targetIndex) {
-      if (left < middle && right >= to) {
-        // If the left run has elements, but the right does not, we take
-        // from the left.
-        target.objects[targetIndex] = source.objects[left++];
-      } else if (left < middle) {
-        // If both have elements, we need to compare.
-        const leftElement = UnsafeCast<JSAny>(source.objects[left]);
-        const rightElement = UnsafeCast<JSAny>(source.objects[right]);
-        if (CallCompare(leftElement, rightElement) <= 0) {
-          target.objects[targetIndex] = leftElement;
-          left++;
-        } else {
-          target.objects[targetIndex] = rightElement;
-          right++;
-        }
+// Merges two sorted runs [from, middle) and [middle, to)
+// from "source" into "target".
+transitioning macro
+TypedArrayMerge(
+    implicit context: Context, array: JSTypedArray, comparefn: Callable)(
+    source: FixedArray, from: uintptr, middle: uintptr, to: uintptr,
+    target: FixedArray) {
+  let left: uintptr = from;
+  let right: uintptr = middle;
+
+  for (let targetIndex: uintptr = from; targetIndex < to; ++targetIndex) {
+    if (left < middle && right >= to) {
+      // If the left run has elements, but the right does not, we take
+      // from the left.
+      target.objects[targetIndex] = source.objects[left++];
+    } else if (left < middle) {
+      // If both have elements, we need to compare.
+      const leftElement = UnsafeCast<JSAny>(source.objects[left]);
+      const rightElement = UnsafeCast<JSAny>(source.objects[right]);
+      if (CallCompare(leftElement, rightElement) <= 0) {
+        target.objects[targetIndex] = leftElement;
+        left++;
       } else {
-        // No elements on the left, but the right does, so we take
-        // from the right.
-        assert(left == middle);
-        target.objects[targetIndex] = source.objects[right++];
+        target.objects[targetIndex] = rightElement;
+        right++;
       }
+    } else {
+      // No elements on the left, but the right does, so we take
+      // from the right.
+      assert(left == middle);
+      target.objects[targetIndex] = source.objects[right++];
     }
   }
+}
 
-  transitioning builtin
-  TypedArrayMergeSort(implicit context: Context)(
-      source: FixedArray, from: uintptr, to: uintptr, target: FixedArray,
-      array: JSTypedArray, comparefn: Callable): JSAny {
-    assert(to - from > 1);
-    const middle: uintptr = from + ((to - from) >>> 1);
-
-    // On the next recursion step source becomes target and vice versa.
-    // This saves the copy of the relevant range from the original
-    // array into a work array on each recursion step.
-    if (middle - from > 1) {
-      TypedArrayMergeSort(target, from, middle, source, array, comparefn);
-    }
-    if (to - middle > 1) {
-      TypedArrayMergeSort(target, middle, to, source, array, comparefn);
-    }
-
-    TypedArrayMerge(source, from, middle, to, target);
-
-    return Undefined;
+transitioning builtin
+TypedArrayMergeSort(implicit context: Context)(
+    source: FixedArray, from: uintptr, to: uintptr, target: FixedArray,
+    array: JSTypedArray, comparefn: Callable): JSAny {
+  assert(to - from > 1);
+  const middle: uintptr = from + ((to - from) >>> 1);
+
+  // On the next recursion step source becomes target and vice versa.
+  // This saves the copy of the relevant range from the original
+  // array into a work array on each recursion step.
+  if (middle - from > 1) {
+    TypedArrayMergeSort(target, from, middle, source, array, comparefn);
+  }
+  if (to - middle > 1) {
+    TypedArrayMergeSort(target, middle, to, source, array, comparefn);
   }
 
-  // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.sort
-  transitioning javascript builtin TypedArrayPrototypeSort(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSTypedArray {
-    // 1. If comparefn is not undefined and IsCallable(comparefn) is false,
-    //    throw a TypeError exception.
-    const comparefnObj: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    if (comparefnObj != Undefined && !TaggedIsCallable(comparefnObj)) {
-      ThrowTypeError(MessageTemplate::kBadSortComparisonFunction, comparefnObj);
-    }
+  TypedArrayMerge(source, from, middle, to, target);
 
-    // 2. Let obj be the this value.
-    const obj: JSAny = receiver;
+  return Undefined;
+}
 
-    // 3. Let buffer be ? ValidateTypedArray(obj).
-    //    ValidateTypedArray currently returns the array, not the ViewBuffer.
-    const array: JSTypedArray =
-        ValidateTypedArray(context, obj, kBuiltinNameSort);
+// https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.sort
+transitioning javascript builtin TypedArrayPrototypeSort(
+    js-implicit context: NativeContext,
+    receiver: JSAny)(...arguments): JSTypedArray {
+  // 1. If comparefn is not undefined and IsCallable(comparefn) is false,
+  //    throw a TypeError exception.
+  const comparefnObj: JSAny = arguments[0];
+  if (comparefnObj != Undefined && !Is<Callable>(comparefnObj)) {
+    ThrowTypeError(MessageTemplate::kBadSortComparisonFunction, comparefnObj);
+  }
 
-    // 4. Let len be obj.[[ArrayLength]].
-    const len: uintptr = array.length;
+  // 2. Let obj be the this value.
+  const obj: JSAny = receiver;
 
-    // Arrays of length 1 or less are considered sorted.
-    if (len < 2) return array;
+  // 3. Let buffer be ? ValidateTypedArray(obj).
+  //    ValidateTypedArray currently returns the array, not the ViewBuffer.
+  const array: JSTypedArray =
+      ValidateTypedArray(context, obj, kBuiltinNameSort);
 
-    // Default sorting is done in C++ using std::sort
-    if (comparefnObj == Undefined) {
-      return TypedArraySortFast(context, obj);
-    }
+  // 4. Let len be obj.[[ArrayLength]].
+  const len: uintptr = array.length;
 
-    const comparefn: Callable =
-        Cast<Callable>(comparefnObj) otherwise unreachable;
-    const accessor: TypedArrayAccessor =
-        GetTypedArrayAccessor(array.elements_kind);
-
-    // Prepare the two work arrays. All numbers are converted to tagged
-    // objects first, and merge sorted between the two FixedArrays.
-    // The result is then written back into the JSTypedArray.
-    const work1: FixedArray = AllocateZeroedFixedArray(Convert<intptr>(len));
-    const work2: FixedArray = AllocateZeroedFixedArray(Convert<intptr>(len));
-
-    for (let i: uintptr = 0; i < len; ++i) {
-      const element: Numeric = accessor.LoadNumeric(context, array, i);
-      work1.objects[i] = element;
-      work2.objects[i] = element;
-    }
+  // Arrays of length 1 or less are considered sorted.
+  if (len < 2) return array;
+
+  // Default sorting is done in C++ using std::sort
+  if (comparefnObj == Undefined) {
+    return TypedArraySortFast(context, obj);
+  }
 
-    TypedArrayMergeSort(work2, 0, len, work1, array, comparefn);
+  const comparefn: Callable =
+      Cast<Callable>(comparefnObj) otherwise unreachable;
+  const accessor: TypedArrayAccessor =
+      GetTypedArrayAccessor(array.elements_kind);
+
+  // Prepare the two work arrays. All numbers are converted to tagged
+  // objects first, and merge sorted between the two FixedArrays.
+  // The result is then written back into the JSTypedArray.
+  const work1: FixedArray = AllocateZeroedFixedArray(Convert<intptr>(len));
+  const work2: FixedArray = AllocateZeroedFixedArray(Convert<intptr>(len));
+
+  for (let i: uintptr = 0; i < len; ++i) {
+    const element: Numeric = accessor.LoadNumeric(array, i);
+    work1.objects[i] = element;
+    work2.objects[i] = element;
+  }
 
-    // work1 contains the sorted numbers. Write them back.
-    for (let i: uintptr = 0; i < len; ++i) {
-      accessor.StoreNumeric(
-          context, array, i, UnsafeCast<Numeric>(work1.objects[i]));
-    }
+  TypedArrayMergeSort(work2, 0, len, work1, array, comparefn);
 
-    return array;
+  // work1 contains the sorted numbers. Write them back.
+  for (let i: uintptr = 0; i < len; ++i) {
+    accessor.StoreNumeric(
+        context, array, i, UnsafeCast<Numeric>(work1.objects[i]));
   }
+
+  return array;
+}
 }
diff --git a/deps/v8/src/builtins/typed-array-subarray.tq b/deps/v8/src/builtins/typed-array-subarray.tq
index c0adc5f19e3..73d9e80c619 100644
--- a/deps/v8/src/builtins/typed-array-subarray.tq
+++ b/deps/v8/src/builtins/typed-array-subarray.tq
@@ -3,60 +3,60 @@
 // found in the LICENSE file.
 
 namespace typed_array {
-  // ES %TypedArray%.prototype.subarray
-  transitioning javascript builtin TypedArrayPrototypeSubArray(
-      js-implicit context: NativeContext,
-      receiver: JSAny)(...arguments): JSTypedArray {
-    const methodName: constexpr string = '%TypedArray%.prototype.subarray';
-
-    // 1. Let O be the this value.
-    // 3. If O does not have a [[TypedArrayName]] internal slot, throw a
-    // TypeError exception.
-    const source = Cast<JSTypedArray>(receiver)
-        otherwise ThrowTypeError(
-        MessageTemplate::kIncompatibleMethodReceiver, methodName);
-
-    // 5. Let buffer be O.[[ViewedArrayBuffer]].
-    const buffer = typed_array::GetBuffer(source);
-
-    // 6. Let srcLength be O.[[ArrayLength]].
-    const srcLength: uintptr = source.length;
-
-    // 7. Let relativeBegin be ? ToInteger(begin).
-    // 8. If relativeBegin < 0, let beginIndex be max((srcLength +
-    // relativeBegin), 0); else let beginIndex be min(relativeBegin,
-    // srcLength).
-    const arg0 = arguments[0];
-    const begin: uintptr =
-        arg0 != Undefined ? ConvertToRelativeIndex(arg0, srcLength) : 0;
-
-    // 9. If end is undefined, let relativeEnd be srcLength;
-    //      else, let relativeEnd be ? ToInteger(end).
-    // 10. If relativeEnd < 0, let endIndex be max((srcLength + relativeEnd),
-    // 0); else let endIndex be min(relativeEnd, srcLength).
-    const arg1 = arguments[1];
-    const end: uintptr =
-        arg1 != Undefined ? ConvertToRelativeIndex(arg1, srcLength) : srcLength;
-
-    // 11. Let newLength be max(endIndex - beginIndex, 0).
-    const newLength: uintptr = Unsigned(IntPtrMax(Signed(end - begin), 0));
-
-    // 12. Let constructorName be the String value of O.[[TypedArrayName]].
-    // 13. Let elementSize be the Number value of the Element Size value
-    // specified in Table 52 for constructorName.
-    const elementsInfo = typed_array::GetTypedArrayElementsInfo(source);
-
-    // 14. Let srcByteOffset be O.[[ByteOffset]].
-    const srcByteOffset: uintptr = source.byte_offset;
-
-    // 15. Let beginByteOffset be srcByteOffset + beginIndex × elementSize.
-    const beginByteOffset =
-        srcByteOffset + elementsInfo.CalculateByteLength(begin)
-        otherwise ThrowRangeError(MessageTemplate::kInvalidArrayBufferLength);
-
-    // 16. Let argumentsList be « buffer, beginByteOffset, newLength ».
-    // 17. Return ? TypedArraySpeciesCreate(O, argumentsList).
-    return TypedArraySpeciesCreateByBuffer(
-        methodName, source, buffer, beginByteOffset, newLength);
-  }
+// ES %TypedArray%.prototype.subarray
+transitioning javascript builtin TypedArrayPrototypeSubArray(
+    js-implicit context: NativeContext,
+    receiver: JSAny)(...arguments): JSTypedArray {
+  const methodName: constexpr string = '%TypedArray%.prototype.subarray';
+
+  // 1. Let O be the this value.
+  // 3. If O does not have a [[TypedArrayName]] internal slot, throw a
+  // TypeError exception.
+  const source = Cast<JSTypedArray>(receiver)
+      otherwise ThrowTypeError(
+      MessageTemplate::kIncompatibleMethodReceiver, methodName);
+
+  // 5. Let buffer be O.[[ViewedArrayBuffer]].
+  const buffer = typed_array::GetBuffer(source);
+
+  // 6. Let srcLength be O.[[ArrayLength]].
+  const srcLength: uintptr = source.length;
+
+  // 7. Let relativeBegin be ? ToInteger(begin).
+  // 8. If relativeBegin < 0, let beginIndex be max((srcLength +
+  // relativeBegin), 0); else let beginIndex be min(relativeBegin,
+  // srcLength).
+  const arg0 = arguments[0];
+  const begin: uintptr =
+      arg0 != Undefined ? ConvertToRelativeIndex(arg0, srcLength) : 0;
+
+  // 9. If end is undefined, let relativeEnd be srcLength;
+  //      else, let relativeEnd be ? ToInteger(end).
+  // 10. If relativeEnd < 0, let endIndex be max((srcLength + relativeEnd),
+  // 0); else let endIndex be min(relativeEnd, srcLength).
+  const arg1 = arguments[1];
+  const end: uintptr =
+      arg1 != Undefined ? ConvertToRelativeIndex(arg1, srcLength) : srcLength;
+
+  // 11. Let newLength be max(endIndex - beginIndex, 0).
+  const newLength: uintptr = Unsigned(IntPtrMax(Signed(end - begin), 0));
+
+  // 12. Let constructorName be the String value of O.[[TypedArrayName]].
+  // 13. Let elementSize be the Number value of the Element Size value
+  // specified in Table 52 for constructorName.
+  const elementsInfo = typed_array::GetTypedArrayElementsInfo(source);
+
+  // 14. Let srcByteOffset be O.[[ByteOffset]].
+  const srcByteOffset: uintptr = source.byte_offset;
+
+  // 15. Let beginByteOffset be srcByteOffset + beginIndex × elementSize.
+  const beginByteOffset =
+      srcByteOffset + elementsInfo.CalculateByteLength(begin)
+      otherwise ThrowRangeError(MessageTemplate::kInvalidArrayBufferLength);
+
+  // 16. Let argumentsList be « buffer, beginByteOffset, newLength ».
+  // 17. Return ? TypedArraySpeciesCreate(O, argumentsList).
+  return TypedArraySpeciesCreateByBuffer(
+      methodName, source, buffer, beginByteOffset, newLength);
+}
 }
diff --git a/deps/v8/src/builtins/typed-array-values.tq b/deps/v8/src/builtins/typed-array-values.tq
new file mode 100644
index 00000000000..a60aaaf707f
--- /dev/null
+++ b/deps/v8/src/builtins/typed-array-values.tq
@@ -0,0 +1,27 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-typed-array-gen.h'
+
+namespace typed_array {
+const kBuiltinNameValues: constexpr string = '%TypedArray%.prototype.values';
+
+// %TypedArray%.values ()
+// https://tc39.github.io/ecma262/#sec-%typedarray%.values
+transitioning javascript builtin
+TypedArrayPrototypeValues(js-implicit context: NativeContext, receiver: JSAny)(
+    ...arguments): JSArrayIterator {
+  try {
+    const array: JSTypedArray = Cast<JSTypedArray>(receiver)
+        otherwise NotTypedArray;
+
+    EnsureAttached(array) otherwise IsDetached;
+    return CreateArrayIterator(array, IterationKind::kValues);
+  } label NotTypedArray deferred {
+    ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameValues);
+  } label IsDetached deferred {
+    ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameValues);
+  }
+}
+}
diff --git a/deps/v8/src/builtins/typed-array.tq b/deps/v8/src/builtins/typed-array.tq
index 1b23d3f5729..033de32a1d0 100644
--- a/deps/v8/src/builtins/typed-array.tq
+++ b/deps/v8/src/builtins/typed-array.tq
@@ -5,271 +5,267 @@
 #include 'src/builtins/builtins-typed-array-gen.h'
 
 namespace typed_array {
-  // Naming convention from elements.cc. We have a similar intent but implement
-  // fastpaths using generics instead of using a class hierarchy for elements
-  // kinds specific implementations.
-  type Uint8Elements extends ElementsKind;
-  type Int8Elements extends ElementsKind;
-  type Uint16Elements extends ElementsKind;
-  type Int16Elements extends ElementsKind;
-  type Uint32Elements extends ElementsKind;
-  type Int32Elements extends ElementsKind;
-  type Float32Elements extends ElementsKind;
-  type Float64Elements extends ElementsKind;
-  type Uint8ClampedElements extends ElementsKind;
-  type BigUint64Elements extends ElementsKind;
-  type BigInt64Elements extends ElementsKind;
+// Naming convention from elements.cc. We have a similar intent but implement
+// fastpaths using generics instead of using a class hierarchy for elements
+// kinds specific implementations.
+type Uint8Elements extends ElementsKind;
+type Int8Elements extends ElementsKind;
+type Uint16Elements extends ElementsKind;
+type Int16Elements extends ElementsKind;
+type Uint32Elements extends ElementsKind;
+type Int32Elements extends ElementsKind;
+type Float32Elements extends ElementsKind;
+type Float64Elements extends ElementsKind;
+type Uint8ClampedElements extends ElementsKind;
+type BigUint64Elements extends ElementsKind;
+type BigInt64Elements extends ElementsKind;
 
-  @export
-  struct TypedArrayElementsInfo {
-    // Calculates the number of bytes required for specified number of elements.
-    macro CalculateByteLength(length: uintptr): uintptr labels IfInvalid {
-      if (length > kTypedArrayMaxLength) goto IfInvalid;
-      const maxArrayLength = kArrayBufferMaxByteLength >>> this.sizeLog2;
-      if (length > maxArrayLength) goto IfInvalid;
-      const byteLength = length << this.sizeLog2;
-      return byteLength;
-    }
-
-    // Calculates the maximum number of elements supported by a specified number
-    // of bytes.
-    macro CalculateLength(byteLength: uintptr): uintptr labels IfInvalid {
-      const length = byteLength >>> this.sizeLog2;
-      if (length > kTypedArrayMaxLength) goto IfInvalid;
-      return length;
-    }
-
-    // Determines if `bytes` (byte offset or length) cannot be evenly divided by
-    // element size.
-    macro IsUnaligned(bytes: uintptr): bool {
-      // Exploits the fact the element size is a power of 2. Determining whether
-      // there is remainder (not aligned) can be achieved efficiently with bit
-      // masking. Shift is safe as sizeLog2 can be 3 at most (see
-      // ElementsKindToShiftSize).
-      return (bytes & ((1 << this.sizeLog2) - 1)) != 0;
-    }
-
-    sizeLog2: uintptr;
-    kind: ElementsKind;
+@export
+struct TypedArrayElementsInfo {
+  // Calculates the number of bytes required for specified number of elements.
+  macro CalculateByteLength(length: uintptr): uintptr labels IfInvalid {
+    if (length > kTypedArrayMaxLength) goto IfInvalid;
+    const maxArrayLength = kArrayBufferMaxByteLength >>> this.sizeLog2;
+    if (length > maxArrayLength) goto IfInvalid;
+    const byteLength = length << this.sizeLog2;
+    return byteLength;
   }
-  extern runtime TypedArrayCopyElements(Context, JSTypedArray, Object, Number):
-      void;
-  extern macro TypedArrayBuiltinsAssembler::ValidateTypedArray(
-      Context, JSAny, constexpr string): JSTypedArray;
 
-  extern macro TypedArrayBuiltinsAssembler::CallCMemcpy(
-      RawPtr, RawPtr, uintptr): void;
-  extern macro TypedArrayBuiltinsAssembler::CallCMemmove(
-      RawPtr, RawPtr, uintptr): void;
-  extern macro TypedArrayBuiltinsAssembler::CallCMemset(
-      RawPtr, intptr, uintptr): void;
-  extern macro TypedArrayBuiltinsAssembler::GetBuffer(
-      implicit context: Context)(JSTypedArray): JSArrayBuffer;
-  extern macro TypedArrayBuiltinsAssembler::GetTypedArrayElementsInfo(
-      JSTypedArray): TypedArrayElementsInfo;
-  extern macro TypedArrayBuiltinsAssembler::GetTypedArrayElementsInfo(Map):
-      TypedArrayElementsInfo;
-  extern macro TypedArrayBuiltinsAssembler::IsUint8ElementsKind(ElementsKind):
-      bool;
-  extern macro TypedArrayBuiltinsAssembler::IsBigInt64ElementsKind(
-      ElementsKind): bool;
-  extern macro LoadFixedTypedArrayElementAsTagged(
-      RawPtr, uintptr, constexpr ElementsKind): Numeric;
-  extern macro TypedArrayBuiltinsAssembler::StoreJSTypedArrayElementFromNumeric(
-      Context, JSTypedArray, uintptr, Numeric, constexpr ElementsKind);
-  extern macro TypedArrayBuiltinsAssembler::StoreJSTypedArrayElementFromTagged(
-      Context, JSTypedArray, uintptr, JSAny,
-      constexpr ElementsKind) labels IfDetached;
+  // Calculates the maximum number of elements supported by a specified number
+  // of bytes.
+  macro CalculateLength(byteLength: uintptr): uintptr labels IfInvalid {
+    const length = byteLength >>> this.sizeLog2;
+    if (length > kTypedArrayMaxLength) goto IfInvalid;
+    return length;
+  }
 
-  type LoadNumericFn = builtin(Context, JSTypedArray, uintptr) => Numeric;
-  type StoreNumericFn = builtin(Context, JSTypedArray, uintptr, Numeric) => Smi;
-  type StoreJSAnyFn = builtin(Context, JSTypedArray, uintptr, JSAny) => Smi;
+  // Determines if `bytes` (byte offset or length) cannot be evenly divided by
+  // element size.
+  macro IsUnaligned(bytes: uintptr): bool {
+    // Exploits the fact the element size is a power of 2. Determining whether
+    // there is remainder (not aligned) can be achieved efficiently with bit
+    // masking. Shift is safe as sizeLog2 can be 3 at most (see
+    // ElementsKindToShiftSize).
+    return (bytes & ((1 << this.sizeLog2) - 1)) != 0;
+  }
 
-  // The result codes returned by StoreNumericFn and StoreJSAnyFn builtins.
-  const kStoreSucceded: Smi = 0;
-  const kStoreFailureArrayDetached: Smi = 1;
+  sizeLog2: uintptr;
+  kind: ElementsKind;
+}
+extern runtime TypedArrayCopyElements(
+    Context, JSTypedArray, Object, Number): void;
+extern macro TypedArrayBuiltinsAssembler::ValidateTypedArray(
+    Context, JSAny, constexpr string): JSTypedArray;
 
-  struct TypedArrayAccessor {
-    macro LoadNumeric(
-        context: Context, array: JSTypedArray, index: uintptr): Numeric {
-      const loadfn: LoadNumericFn = this.loadNumericFn;
-      return loadfn(context, array, index);
-    }
+extern macro TypedArrayBuiltinsAssembler::CallCMemcpy(
+    RawPtr, RawPtr, uintptr): void;
+extern macro TypedArrayBuiltinsAssembler::CallCMemmove(
+    RawPtr, RawPtr, uintptr): void;
+extern macro TypedArrayBuiltinsAssembler::CallCMemset(
+    RawPtr, intptr, uintptr): void;
+extern macro TypedArrayBuiltinsAssembler::GetBuffer(implicit context: Context)(
+    JSTypedArray): JSArrayBuffer;
+extern macro TypedArrayBuiltinsAssembler::GetTypedArrayElementsInfo(
+    JSTypedArray): TypedArrayElementsInfo;
+extern macro TypedArrayBuiltinsAssembler::GetTypedArrayElementsInfo(Map):
+    TypedArrayElementsInfo;
+extern macro TypedArrayBuiltinsAssembler::IsUint8ElementsKind(ElementsKind):
+    bool;
+extern macro TypedArrayBuiltinsAssembler::IsBigInt64ElementsKind(ElementsKind):
+    bool;
+extern macro LoadFixedTypedArrayElementAsTagged(
+    RawPtr, uintptr, constexpr ElementsKind): Numeric;
+extern macro TypedArrayBuiltinsAssembler::StoreJSTypedArrayElementFromNumeric(
+    Context, JSTypedArray, uintptr, Numeric, constexpr ElementsKind);
+extern macro TypedArrayBuiltinsAssembler::StoreJSTypedArrayElementFromTagged(
+    Context, JSTypedArray, uintptr, JSAny, constexpr ElementsKind)
+    labels IfDetached;
 
-    macro StoreNumeric(
-        context: Context, array: JSTypedArray, index: uintptr, value: Numeric) {
-      const storefn: StoreNumericFn = this.storeNumericFn;
-      const result = storefn(context, array, index, value);
-      assert(result == kStoreSucceded);
-    }
+type LoadNumericFn = builtin(JSTypedArray, uintptr) => Numeric;
+type StoreNumericFn = builtin(Context, JSTypedArray, uintptr, Numeric) => Smi;
+type StoreJSAnyFn = builtin(Context, JSTypedArray, uintptr, JSAny) => Smi;
 
-    macro StoreJSAny(
-        context: Context, array: JSTypedArray, index: uintptr, value: JSAny)
-        labels IfDetached {
-      const storefn: StoreJSAnyFn = this.storeJSAnyFn;
-      const result = storefn(context, array, index, value);
-      if (result == kStoreFailureArrayDetached) {
-        goto IfDetached;
-      }
-      assert(result == kStoreSucceded);
-    }
+// The result codes returned by StoreNumericFn and StoreJSAnyFn builtins.
+const kStoreSucceded: Smi = 0;
+const kStoreFailureArrayDetached: Smi = 1;
 
-    loadNumericFn: LoadNumericFn;
-    storeNumericFn: StoreNumericFn;
-    storeJSAnyFn: StoreJSAnyFn;
+struct TypedArrayAccessor {
+  macro LoadNumeric(array: JSTypedArray, index: uintptr): Numeric {
+    const loadfn: LoadNumericFn = this.loadNumericFn;
+    return loadfn(array, index);
   }
 
-  macro GetTypedArrayAccessor<T : type extends ElementsKind>():
-      TypedArrayAccessor {
-    const loadNumericFn = LoadTypedElement<T>;
-    const storeNumericFn = StoreTypedElementNumeric<T>;
-    const storeJSAnyFn = StoreTypedElementJSAny<T>;
-    return TypedArrayAccessor{loadNumericFn, storeNumericFn, storeJSAnyFn};
+  macro StoreNumeric(
+      context: Context, array: JSTypedArray, index: uintptr, value: Numeric) {
+    const storefn: StoreNumericFn = this.storeNumericFn;
+    const result = storefn(context, array, index, value);
+    assert(result == kStoreSucceded);
   }
 
-  macro GetTypedArrayAccessor(elementsKind: ElementsKind): TypedArrayAccessor {
-    if (IsElementsKindGreaterThan(
-            elementsKind, ElementsKind::UINT32_ELEMENTS)) {
-      if (elementsKind == ElementsKind::INT32_ELEMENTS) {
-        return GetTypedArrayAccessor<Int32Elements>();
-      } else if (elementsKind == ElementsKind::FLOAT32_ELEMENTS) {
-        return GetTypedArrayAccessor<Float32Elements>();
-      } else if (elementsKind == ElementsKind::FLOAT64_ELEMENTS) {
-        return GetTypedArrayAccessor<Float64Elements>();
-      } else if (elementsKind == ElementsKind::UINT8_CLAMPED_ELEMENTS) {
-        return GetTypedArrayAccessor<Uint8ClampedElements>();
-      } else if (elementsKind == ElementsKind::BIGUINT64_ELEMENTS) {
-        return GetTypedArrayAccessor<BigUint64Elements>();
-      } else if (elementsKind == ElementsKind::BIGINT64_ELEMENTS) {
-        return GetTypedArrayAccessor<BigInt64Elements>();
-      }
-    } else {
-      if (elementsKind == ElementsKind::UINT8_ELEMENTS) {
-        return GetTypedArrayAccessor<Uint8Elements>();
-      } else if (elementsKind == ElementsKind::INT8_ELEMENTS) {
-        return GetTypedArrayAccessor<Int8Elements>();
-      } else if (elementsKind == ElementsKind::UINT16_ELEMENTS) {
-        return GetTypedArrayAccessor<Uint16Elements>();
-      } else if (elementsKind == ElementsKind::INT16_ELEMENTS) {
-        return GetTypedArrayAccessor<Int16Elements>();
-      } else if (elementsKind == ElementsKind::UINT32_ELEMENTS) {
-        return GetTypedArrayAccessor<Uint32Elements>();
-      }
+  macro StoreJSAny(
+      context: Context, array: JSTypedArray, index: uintptr, value: JSAny)
+      labels IfDetached {
+    const storefn: StoreJSAnyFn = this.storeJSAnyFn;
+    const result = storefn(context, array, index, value);
+    if (result == kStoreFailureArrayDetached) {
+      goto IfDetached;
     }
-    unreachable;
+    assert(result == kStoreSucceded);
   }
 
-  extern macro TypedArrayBuiltinsAssembler::SetJSTypedArrayOnHeapDataPtr(
-      JSTypedArray, ByteArray, uintptr): void;
-  extern macro TypedArrayBuiltinsAssembler::SetJSTypedArrayOffHeapDataPtr(
-      JSTypedArray, RawPtr, uintptr): void;
-
-  // AttachedJSTypedArray guards that the array's buffer is not detached.
-  transient type AttachedJSTypedArray extends JSTypedArray;
+  loadNumericFn: LoadNumericFn;
+  storeNumericFn: StoreNumericFn;
+  storeJSAnyFn: StoreJSAnyFn;
+}
 
-  macro EnsureAttached(array: JSTypedArray): AttachedJSTypedArray
-      labels Detached {
-    if (IsDetachedBuffer(array.buffer)) goto Detached;
-    return %RawDownCast<AttachedJSTypedArray>(array);
-  }
+macro GetTypedArrayAccessor<T : type extends ElementsKind>():
+    TypedArrayAccessor {
+  const loadNumericFn = LoadTypedElement<T>;
+  const storeNumericFn = StoreTypedElementNumeric<T>;
+  const storeJSAnyFn = StoreTypedElementJSAny<T>;
+  return TypedArrayAccessor{loadNumericFn, storeNumericFn, storeJSAnyFn};
+}
 
-  struct AttachedJSTypedArrayWitness {
-    macro Get(): AttachedJSTypedArray {
-      return this.unstable;
+macro GetTypedArrayAccessor(elementsKind: ElementsKind): TypedArrayAccessor {
+  if (IsElementsKindGreaterThan(elementsKind, ElementsKind::UINT32_ELEMENTS)) {
+    if (elementsKind == ElementsKind::INT32_ELEMENTS) {
+      return GetTypedArrayAccessor<Int32Elements>();
+    } else if (elementsKind == ElementsKind::FLOAT32_ELEMENTS) {
+      return GetTypedArrayAccessor<Float32Elements>();
+    } else if (elementsKind == ElementsKind::FLOAT64_ELEMENTS) {
+      return GetTypedArrayAccessor<Float64Elements>();
+    } else if (elementsKind == ElementsKind::UINT8_CLAMPED_ELEMENTS) {
+      return GetTypedArrayAccessor<Uint8ClampedElements>();
+    } else if (elementsKind == ElementsKind::BIGUINT64_ELEMENTS) {
+      return GetTypedArrayAccessor<BigUint64Elements>();
+    } else if (elementsKind == ElementsKind::BIGINT64_ELEMENTS) {
+      return GetTypedArrayAccessor<BigInt64Elements>();
     }
-
-    macro GetStable(): JSTypedArray {
-      return this.stable;
+  } else {
+    if (elementsKind == ElementsKind::UINT8_ELEMENTS) {
+      return GetTypedArrayAccessor<Uint8Elements>();
+    } else if (elementsKind == ElementsKind::INT8_ELEMENTS) {
+      return GetTypedArrayAccessor<Int8Elements>();
+    } else if (elementsKind == ElementsKind::UINT16_ELEMENTS) {
+      return GetTypedArrayAccessor<Uint16Elements>();
+    } else if (elementsKind == ElementsKind::INT16_ELEMENTS) {
+      return GetTypedArrayAccessor<Int16Elements>();
+    } else if (elementsKind == ElementsKind::UINT32_ELEMENTS) {
+      return GetTypedArrayAccessor<Uint32Elements>();
     }
+  }
+  unreachable;
+}
 
-    macro Recheck() labels Detached {
-      if (IsDetachedBuffer(this.stable.buffer)) goto Detached;
-      this.unstable = %RawDownCast<AttachedJSTypedArray>(this.stable);
-    }
+extern macro TypedArrayBuiltinsAssembler::SetJSTypedArrayOnHeapDataPtr(
+    JSTypedArray, ByteArray, uintptr): void;
+extern macro TypedArrayBuiltinsAssembler::SetJSTypedArrayOffHeapDataPtr(
+    JSTypedArray, RawPtr, uintptr): void;
 
-    macro Load(implicit context: Context)(k: uintptr): JSAny {
-      const lf: LoadNumericFn = this.loadfn;
-      return lf(context, this.unstable, k);
-    }
+// AttachedJSTypedArray guards that the array's buffer is not detached.
+transient type AttachedJSTypedArray extends JSTypedArray;
 
-    stable: JSTypedArray;
-    unstable: AttachedJSTypedArray;
-    loadfn: LoadNumericFn;
-  }
+macro EnsureAttached(array: JSTypedArray): AttachedJSTypedArray
+    labels Detached {
+  if (IsDetachedBuffer(array.buffer)) goto Detached;
+  return %RawDownCast<AttachedJSTypedArray>(array);
+}
 
-  macro NewAttachedJSTypedArrayWitness(array: AttachedJSTypedArray):
-      AttachedJSTypedArrayWitness {
-    const kind = array.elements_kind;
-    const accessor: TypedArrayAccessor = GetTypedArrayAccessor(kind);
-    return AttachedJSTypedArrayWitness{
-      stable: array,
-      unstable: array,
-      loadfn: accessor.loadNumericFn
-    };
+struct AttachedJSTypedArrayWitness {
+  macro Get(): AttachedJSTypedArray {
+    return this.unstable;
   }
 
-  macro KindForArrayType<T : type extends ElementsKind>():
-      constexpr ElementsKind;
-  KindForArrayType<Uint8Elements>(): constexpr ElementsKind {
-    return ElementsKind::UINT8_ELEMENTS;
-  }
-  KindForArrayType<Int8Elements>(): constexpr ElementsKind {
-    return ElementsKind::INT8_ELEMENTS;
-  }
-  KindForArrayType<Uint16Elements>(): constexpr ElementsKind {
-    return ElementsKind::UINT16_ELEMENTS;
-  }
-  KindForArrayType<Int16Elements>(): constexpr ElementsKind {
-    return ElementsKind::INT16_ELEMENTS;
-  }
-  KindForArrayType<Uint32Elements>(): constexpr ElementsKind {
-    return ElementsKind::UINT32_ELEMENTS;
-  }
-  KindForArrayType<Int32Elements>(): constexpr ElementsKind {
-    return ElementsKind::INT32_ELEMENTS;
-  }
-  KindForArrayType<Float32Elements>(): constexpr ElementsKind {
-    return ElementsKind::FLOAT32_ELEMENTS;
-  }
-  KindForArrayType<Float64Elements>(): constexpr ElementsKind {
-    return ElementsKind::FLOAT64_ELEMENTS;
-  }
-  KindForArrayType<Uint8ClampedElements>(): constexpr ElementsKind {
-    return ElementsKind::UINT8_CLAMPED_ELEMENTS;
-  }
-  KindForArrayType<BigUint64Elements>(): constexpr ElementsKind {
-    return ElementsKind::BIGUINT64_ELEMENTS;
-  }
-  KindForArrayType<BigInt64Elements>(): constexpr ElementsKind {
-    return ElementsKind::BIGINT64_ELEMENTS;
+  macro GetStable(): JSTypedArray {
+    return this.stable;
   }
 
-  builtin LoadTypedElement<T : type extends ElementsKind>(
-      _context: Context, array: JSTypedArray, index: uintptr): Numeric {
-    return LoadFixedTypedArrayElementAsTagged(
-        array.data_ptr, index, KindForArrayType<T>());
+  macro Recheck() labels Detached {
+    if (IsDetachedBuffer(this.stable.buffer)) goto Detached;
+    this.unstable = %RawDownCast<AttachedJSTypedArray>(this.stable);
   }
 
-  builtin StoreTypedElementNumeric<T : type extends ElementsKind>(
-      context: Context, typedArray: JSTypedArray, index: uintptr,
-      value: Numeric): Smi {
-    StoreJSTypedArrayElementFromNumeric(
-        context, typedArray, index, value, KindForArrayType<T>());
-    return kStoreSucceded;
+  macro Load(implicit context: Context)(k: uintptr): JSAny {
+    const lf: LoadNumericFn = this.loadfn;
+    return lf(this.unstable, k);
   }
 
-  // Returns True on sucess or False if the typedArrays was detached.
-  builtin StoreTypedElementJSAny<T : type extends ElementsKind>(
-      context: Context, typedArray: JSTypedArray, index: uintptr,
-      value: JSAny): Smi {
-    try {
-      StoreJSTypedArrayElementFromTagged(
-          context, typedArray, index, value, KindForArrayType<T>())
-          otherwise IfDetached;
-    }
-    label IfDetached {
-      return kStoreFailureArrayDetached;
-    }
-    return kStoreSucceded;
+  stable: JSTypedArray;
+  unstable: AttachedJSTypedArray;
+  loadfn: LoadNumericFn;
+}
+
+macro NewAttachedJSTypedArrayWitness(array: AttachedJSTypedArray):
+    AttachedJSTypedArrayWitness {
+  const kind = array.elements_kind;
+  const accessor: TypedArrayAccessor = GetTypedArrayAccessor(kind);
+  return AttachedJSTypedArrayWitness{
+    stable: array,
+    unstable: array,
+    loadfn: accessor.loadNumericFn
+  };
+}
+
+macro KindForArrayType<T : type extends ElementsKind>(): constexpr ElementsKind;
+KindForArrayType<Uint8Elements>(): constexpr ElementsKind {
+  return ElementsKind::UINT8_ELEMENTS;
+}
+KindForArrayType<Int8Elements>(): constexpr ElementsKind {
+  return ElementsKind::INT8_ELEMENTS;
+}
+KindForArrayType<Uint16Elements>(): constexpr ElementsKind {
+  return ElementsKind::UINT16_ELEMENTS;
+}
+KindForArrayType<Int16Elements>(): constexpr ElementsKind {
+  return ElementsKind::INT16_ELEMENTS;
+}
+KindForArrayType<Uint32Elements>(): constexpr ElementsKind {
+  return ElementsKind::UINT32_ELEMENTS;
+}
+KindForArrayType<Int32Elements>(): constexpr ElementsKind {
+  return ElementsKind::INT32_ELEMENTS;
+}
+KindForArrayType<Float32Elements>(): constexpr ElementsKind {
+  return ElementsKind::FLOAT32_ELEMENTS;
+}
+KindForArrayType<Float64Elements>(): constexpr ElementsKind {
+  return ElementsKind::FLOAT64_ELEMENTS;
+}
+KindForArrayType<Uint8ClampedElements>(): constexpr ElementsKind {
+  return ElementsKind::UINT8_CLAMPED_ELEMENTS;
+}
+KindForArrayType<BigUint64Elements>(): constexpr ElementsKind {
+  return ElementsKind::BIGUINT64_ELEMENTS;
+}
+KindForArrayType<BigInt64Elements>(): constexpr ElementsKind {
+  return ElementsKind::BIGINT64_ELEMENTS;
+}
+
+builtin LoadTypedElement<T : type extends ElementsKind>(
+    array: JSTypedArray, index: uintptr): Numeric {
+  return LoadFixedTypedArrayElementAsTagged(
+      array.data_ptr, index, KindForArrayType<T>());
+}
+
+builtin StoreTypedElementNumeric<T : type extends ElementsKind>(
+    context: Context, typedArray: JSTypedArray, index: uintptr,
+    value: Numeric): Smi {
+  StoreJSTypedArrayElementFromNumeric(
+      context, typedArray, index, value, KindForArrayType<T>());
+  return kStoreSucceded;
+}
+
+// Returns True on sucess or False if the typedArrays was detached.
+builtin StoreTypedElementJSAny<T : type extends ElementsKind>(
+    context: Context, typedArray: JSTypedArray, index: uintptr,
+    value: JSAny): Smi {
+  try {
+    StoreJSTypedArrayElementFromTagged(
+        context, typedArray, index, value, KindForArrayType<T>())
+        otherwise IfDetached;
+  } label IfDetached {
+    return kStoreFailureArrayDetached;
   }
+  return kStoreSucceded;
+}
 }
diff --git a/deps/v8/src/builtins/wasm.tq b/deps/v8/src/builtins/wasm.tq
new file mode 100644
index 00000000000..ffce848c78b
--- /dev/null
+++ b/deps/v8/src/builtins/wasm.tq
@@ -0,0 +1,385 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-wasm-gen.h'
+
+namespace runtime {
+extern runtime WasmMemoryGrow(Context, WasmInstanceObject, Smi): Smi;
+extern runtime WasmRefFunc(Context, WasmInstanceObject, Smi): JSAny;
+extern runtime WasmTableInit(
+    Context, WasmInstanceObject, Object, Object, Smi, Smi, Smi): JSAny;
+extern runtime WasmTableCopy(
+    Context, WasmInstanceObject, Object, Object, Smi, Smi, Smi): JSAny;
+extern runtime WasmFunctionTableGet(
+    Context, WasmInstanceObject, Smi, Smi): JSAny;
+extern runtime WasmFunctionTableSet(
+    Context, WasmInstanceObject, Smi, Smi, Object): JSAny;
+extern runtime ThrowWasmError(Context, Smi): JSAny;
+extern runtime Throw(Context, Object): JSAny;
+extern runtime ReThrow(Context, Object): JSAny;
+extern runtime WasmStackGuard(Context): JSAny;
+extern runtime ThrowWasmStackOverflow(Context): JSAny;
+extern runtime WasmTraceMemory(Context, Smi): JSAny;
+extern runtime WasmTraceEnter(Context): JSAny;
+extern runtime WasmAtomicNotify(
+    Context, WasmInstanceObject, Number, Number): Smi;
+extern runtime WasmI32AtomicWait(
+    Context, WasmInstanceObject, Number, Number, BigInt): Smi;
+extern runtime WasmI64AtomicWait(
+    Context, WasmInstanceObject, Number, BigInt, BigInt): Smi;
+}
+
+namespace unsafe {
+extern macro TimesTaggedSize(intptr): intptr;
+extern macro Allocate(intptr): HeapObject;
+}
+
+namespace wasm {
+const kFuncTableType:
+    constexpr int31 generates 'wasm::ValueType::Kind::kFuncRef';
+
+extern macro WasmBuiltinsAssembler::LoadInstanceFromFrame(): WasmInstanceObject;
+
+// WasmInstanceObject has a field layout that Torque can't handle yet.
+// TODO(bbudge) Eliminate these functions when Torque is ready.
+extern macro WasmBuiltinsAssembler::LoadContextFromInstance(WasmInstanceObject):
+    NativeContext;
+extern macro WasmBuiltinsAssembler::LoadTablesFromInstance(WasmInstanceObject):
+    FixedArray;
+extern macro WasmBuiltinsAssembler::LoadExternalFunctionsFromInstance(
+    WasmInstanceObject): FixedArray;
+extern macro WasmBuiltinsAssembler::LoadManagedObjectMapsFromInstance(
+    WasmInstanceObject): FixedArray;
+
+macro LoadContextFromFrame(): NativeContext {
+  return LoadContextFromInstance(LoadInstanceFromFrame());
+}
+
+builtin WasmInt32ToHeapNumber(val: int32): HeapNumber {
+  return AllocateHeapNumberWithValue(Convert<float64>(val));
+}
+
+builtin WasmTaggedNonSmiToInt32(implicit context: Context)(val: JSAnyNotSmi):
+    int32 {
+  return ChangeTaggedNonSmiToInt32(val);
+}
+
+builtin WasmTaggedToFloat64(implicit context: Context)(val: JSAny): float64 {
+  return ChangeTaggedToFloat64(val);
+}
+
+builtin WasmMemoryGrow(numPages: int32): int32 {
+  if (!IsValidPositiveSmi(ChangeInt32ToIntPtr(numPages)))
+    return Int32Constant(-1);
+  const instance: WasmInstanceObject = LoadInstanceFromFrame();
+  const context: NativeContext = LoadContextFromInstance(instance);
+  const result: Smi =
+      runtime::WasmMemoryGrow(context, instance, SmiFromInt32(numPages));
+  return SmiToInt32(result);
+}
+
+builtin WasmTableInit(
+    dstRaw: uint32, srcRaw: uint32, sizeRaw: uint32, tableIndex: Smi,
+    segmentIndex: Smi): JSAny {
+  try {
+    const instance: WasmInstanceObject = LoadInstanceFromFrame();
+    const dst: Smi = Convert<PositiveSmi>(dstRaw) otherwise TableOutOfBounds;
+    const src: Smi = Convert<PositiveSmi>(srcRaw) otherwise TableOutOfBounds;
+    const size: Smi = Convert<PositiveSmi>(sizeRaw) otherwise TableOutOfBounds;
+    tail runtime::WasmTableInit(
+        LoadContextFromInstance(instance), instance, tableIndex, segmentIndex,
+        dst, src, size);
+  } label TableOutOfBounds deferred {
+    tail ThrowWasmTrapTableOutOfBounds();
+  }
+}
+
+builtin WasmTableCopy(
+    dstRaw: uint32, srcRaw: uint32, sizeRaw: uint32, dstTable: Smi,
+    srcTable: Smi): JSAny {
+  try {
+    const instance: WasmInstanceObject = LoadInstanceFromFrame();
+    const dst: Smi = Convert<PositiveSmi>(dstRaw) otherwise TableOutOfBounds;
+    const src: Smi = Convert<PositiveSmi>(srcRaw) otherwise TableOutOfBounds;
+    const size: Smi = Convert<PositiveSmi>(sizeRaw) otherwise TableOutOfBounds;
+    tail runtime::WasmTableCopy(
+        LoadContextFromInstance(instance), instance, dstTable, srcTable, dst,
+        src, size);
+  } label TableOutOfBounds deferred {
+    tail ThrowWasmTrapTableOutOfBounds();
+  }
+}
+
+builtin WasmTableGet(tableIndex: intptr, index: int32): Object {
+  const instance: WasmInstanceObject = LoadInstanceFromFrame();
+  const entryIndex: intptr = ChangeInt32ToIntPtr(index);
+  try {
+    assert(IsValidPositiveSmi(tableIndex));
+    if (!IsValidPositiveSmi(entryIndex)) goto IndexOutOfRange;
+
+    const tables: FixedArray = LoadTablesFromInstance(instance);
+    const table: WasmTableObject = %RawDownCast<WasmTableObject>(
+        LoadFixedArrayElement(tables, tableIndex));
+    const entriesCount: intptr = Convert<intptr, Smi>(table.current_length);
+    if (entryIndex >= entriesCount) goto IndexOutOfRange;
+
+    const entries: FixedArray = table.entries;
+    const entry: Object = LoadFixedArrayElement(entries, entryIndex);
+
+    try {
+      const entryObject: HeapObject =
+          TaggedToHeapObject<HeapObject>(entry) otherwise ReturnEntry;
+      if (IsTuple2Map(entryObject.map)) goto CallRuntime;
+      goto ReturnEntry;
+    } label ReturnEntry {
+      return entry;
+    }
+  } label CallRuntime deferred {
+    tail runtime::WasmFunctionTableGet(
+        LoadContextFromInstance(instance), instance, SmiFromIntPtr(tableIndex),
+        SmiFromIntPtr(entryIndex));
+  } label IndexOutOfRange deferred {
+    tail ThrowWasmTrapTableOutOfBounds();
+  }
+}
+
+builtin WasmTableSet(tableIndex: intptr, index: int32, value: Object): Object {
+  const instance: WasmInstanceObject = LoadInstanceFromFrame();
+  const entryIndex: intptr = ChangeInt32ToIntPtr(index);
+  try {
+    assert(IsValidPositiveSmi(tableIndex));
+    if (!IsValidPositiveSmi(entryIndex)) goto IndexOutOfRange;
+
+    const tables: FixedArray = LoadTablesFromInstance(instance);
+    const table: WasmTableObject = %RawDownCast<WasmTableObject>(
+        LoadFixedArrayElement(tables, tableIndex));
+
+    // Fall back to the runtime to set funcrefs, since we have to update
+    // function dispatch tables.
+    const tableType: Smi = table.raw_type;
+    if (tableType == SmiConstant(kFuncTableType)) goto CallRuntime;
+
+    const entriesCount: intptr = Convert<intptr, Smi>(table.current_length);
+    if (entryIndex >= entriesCount) goto IndexOutOfRange;
+
+    const entries: FixedArray = table.entries;
+    StoreFixedArrayElement(entries, entryIndex, value);
+    return Undefined;
+  } label CallRuntime deferred {
+    tail runtime::WasmFunctionTableSet(
+        LoadContextFromInstance(instance), instance, SmiFromIntPtr(tableIndex),
+        SmiFromIntPtr(entryIndex), value);
+  } label IndexOutOfRange deferred {
+    tail ThrowWasmTrapTableOutOfBounds();
+  }
+}
+
+builtin WasmRefFunc(index: uint32): Object {
+  const instance: WasmInstanceObject = LoadInstanceFromFrame();
+  try {
+    const table: FixedArray = LoadExternalFunctionsFromInstance(instance);
+    if (table == Undefined) goto CallRuntime;
+    const functionIndex: intptr = Signed(ChangeUint32ToWord(index));
+    const result: Object = LoadFixedArrayElement(table, functionIndex);
+    if (result == Undefined) goto CallRuntime;
+    return result;
+  } label CallRuntime deferred {
+    tail runtime::WasmRefFunc(
+        LoadContextFromInstance(instance), instance, SmiFromUint32(index));
+  }
+}
+
+builtin WasmThrow(exception: Object): JSAny {
+  tail runtime::Throw(LoadContextFromFrame(), exception);
+}
+
+builtin WasmRethrow(exception: Object): JSAny {
+  if (exception == Null) tail ThrowWasmTrapRethrowNullRef();
+  tail runtime::ReThrow(LoadContextFromFrame(), exception);
+}
+
+builtin WasmStackGuard(): JSAny {
+  tail runtime::WasmStackGuard(LoadContextFromFrame());
+}
+
+builtin WasmStackOverflow(): JSAny {
+  tail runtime::ThrowWasmStackOverflow(LoadContextFromFrame());
+}
+
+builtin WasmTraceMemory(info: Smi): JSAny {
+  tail runtime::WasmTraceMemory(LoadContextFromFrame(), info);
+}
+
+builtin WasmTraceEnter(): JSAny {
+  tail runtime::WasmTraceEnter(LoadContextFromFrame());
+}
+
+builtin WasmAllocateJSArray(implicit context: Context)(size: Smi): JSArray {
+  const map: Map = GetFastPackedElementsJSArrayMap();
+  return AllocateJSArray(ElementsKind::PACKED_ELEMENTS, map, size, size);
+}
+
+builtin WasmAllocateStruct(implicit context: Context)(mapIndex: Smi):
+    HeapObject {
+  const instance: WasmInstanceObject = LoadInstanceFromFrame();
+  const maps: FixedArray = LoadManagedObjectMapsFromInstance(instance);
+  const map: Map = %RawDownCast<Map>(LoadFixedArrayElement(maps, mapIndex));
+  const instanceSize: intptr =
+      unsafe::TimesTaggedSize(Convert<intptr>(map.instance_size_in_words));
+  const result: HeapObject = unsafe::Allocate(instanceSize);
+  * UnsafeConstCast(& result.map) = map;
+  return result;
+}
+
+builtin WasmInt32ToNumber(value: int32): Number {
+  return ChangeInt32ToTagged(value);
+}
+
+builtin WasmUint32ToNumber(value: uint32): Number {
+  return ChangeUint32ToTagged(value);
+}
+
+extern builtin I64ToBigInt(intptr): BigInt;
+
+builtin WasmAtomicNotify(address: uint32, count: uint32): uint32 {
+  const instance: WasmInstanceObject = LoadInstanceFromFrame();
+  const result: Smi = runtime::WasmAtomicNotify(
+      LoadContextFromInstance(instance), instance, WasmUint32ToNumber(address),
+      WasmUint32ToNumber(count));
+  return Unsigned(SmiToInt32(result));
+}
+
+builtin WasmI32AtomicWait64(
+    address: uint32, expectedValue: int32, timeout: intptr): uint32 {
+  if constexpr (Is64()) {
+    const instance: WasmInstanceObject = LoadInstanceFromFrame();
+    const result: Smi = runtime::WasmI32AtomicWait(
+        LoadContextFromInstance(instance), instance,
+        WasmUint32ToNumber(address), WasmInt32ToNumber(expectedValue),
+        I64ToBigInt(timeout));
+    return Unsigned(SmiToInt32(result));
+  } else {
+    unreachable;
+  }
+}
+
+builtin WasmI64AtomicWait64(
+    address: uint32, expectedValue: intptr, timeout: intptr): uint32 {
+  if constexpr (Is64()) {
+    const instance: WasmInstanceObject = LoadInstanceFromFrame();
+    const result: Smi = runtime::WasmI64AtomicWait(
+        LoadContextFromInstance(instance), instance,
+        WasmUint32ToNumber(address), I64ToBigInt(expectedValue),
+        I64ToBigInt(timeout));
+    return Unsigned(SmiToInt32(result));
+  } else {
+    unreachable;
+  }
+}
+
+extern macro TryHasOwnProperty(HeapObject, Map, InstanceType, Name): never
+    labels Found, NotFound, Bailout;
+type OnNonExistent constexpr 'OnNonExistent';
+const kReturnUndefined: constexpr OnNonExistent
+    generates 'OnNonExistent::kReturnUndefined';
+extern macro SmiConstant(constexpr OnNonExistent): Smi;
+extern transitioning builtin GetPropertyWithReceiver(implicit context: Context)(
+    JSAny, Name, JSAny, Smi): JSAny;
+
+transitioning builtin WasmGetOwnProperty(implicit context: Context)(
+    object: Object, uniqueName: Name): JSAny {
+  try {
+    const heapObject: HeapObject =
+        TaggedToHeapObject(object) otherwise NotFound;
+    const receiver: JSReceiver =
+        Cast<JSReceiver>(heapObject) otherwise NotFound;
+    try {
+      TryHasOwnProperty(
+          receiver, receiver.map, receiver.instanceType, uniqueName)
+          otherwise Found, NotFound, Bailout;
+    } label Found {
+      tail GetPropertyWithReceiver(
+          receiver, uniqueName, receiver, SmiConstant(kReturnUndefined));
+    }
+  } label NotFound deferred {
+    return Undefined;
+  } label Bailout deferred {
+    unreachable;
+  }
+}
+
+// Trap builtins.
+
+builtin WasmTrap(error: Smi): JSAny {
+  tail runtime::ThrowWasmError(LoadContextFromFrame(), error);
+}
+
+builtin ThrowWasmTrapUnreachable(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapUnreachable));
+}
+
+builtin ThrowWasmTrapMemOutOfBounds(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapMemOutOfBounds));
+}
+
+builtin ThrowWasmTrapUnalignedAccess(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapUnalignedAccess));
+}
+
+builtin ThrowWasmTrapDivByZero(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapDivByZero));
+}
+
+builtin ThrowWasmTrapDivUnrepresentable(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapDivUnrepresentable));
+}
+
+builtin ThrowWasmTrapRemByZero(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapRemByZero));
+}
+
+builtin ThrowWasmTrapFloatUnrepresentable(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapFloatUnrepresentable));
+}
+
+builtin ThrowWasmTrapFuncInvalid(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapFuncInvalid));
+}
+
+builtin ThrowWasmTrapFuncSigMismatch(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapFuncSigMismatch));
+}
+
+builtin ThrowWasmTrapDataSegmentDropped(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapDataSegmentDropped));
+}
+
+builtin ThrowWasmTrapElemSegmentDropped(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapElemSegmentDropped));
+}
+
+builtin ThrowWasmTrapTableOutOfBounds(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapTableOutOfBounds));
+}
+
+builtin ThrowWasmTrapBrOnExnNullRef(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapBrOnExnNullRef));
+}
+
+builtin ThrowWasmTrapRethrowNullRef(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapRethrowNullRef));
+}
+
+builtin ThrowWasmTrapNullDereference(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapNullDereference));
+}
+
+builtin ThrowWasmTrapIllegalCast(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapIllegalCast));
+}
+
+builtin ThrowWasmTrapArrayOutOfBounds(): JSAny {
+  tail WasmTrap(SmiConstant(MessageTemplate::kWasmTrapArrayOutOfBounds));
+}
+}
diff --git a/deps/v8/src/builtins/x64/builtins-x64.cc b/deps/v8/src/builtins/x64/builtins-x64.cc
index 8d028c88f00..bfabe26292b 100644
--- a/deps/v8/src/builtins/x64/builtins-x64.cc
+++ b/deps/v8/src/builtins/x64/builtins-x64.cc
@@ -1769,7 +1769,6 @@ void Builtins::Generate_FunctionPrototypeApply(MacroAssembler* masm) {
 }
 
 // static
-// TODO(victor): merge steps 1, 2 and 3 when V8_REVERSE_JSARGS is set.
 void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
   // Stack Layout:
   // rsp[0]           : Return address
@@ -1781,19 +1780,40 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
   // NOTE: The order of args are reversed if V8_REVERSE_JSARGS
   // rax contains the number of arguments, n, not counting the receiver.
 
-  // 1. Make sure we have at least one argument.
+#ifdef V8_REVERSE_JSARGS
+  // 1. Get the callable to call (passed as receiver) from the stack.
+  {
+    StackArgumentsAccessor args(rax);
+    __ movq(rdi, args.GetReceiverOperand());
+  }
+
+  // 2. Save the return address and drop the callable.
+  __ PopReturnAddressTo(rbx);
+  __ Pop(kScratchRegister);
+
+  // 3. Make sure we have at least one argument.
   {
     Label done;
     __ testq(rax, rax);
     __ j(not_zero, &done, Label::kNear);
-    __ PopReturnAddressTo(rbx);
-#ifdef V8_REVERSE_JSARGS
-    __ Pop(kScratchRegister);  // Pop the receiver.
     __ PushRoot(RootIndex::kUndefinedValue);
-    __ Push(kScratchRegister);
+    __ incq(rax);
+    __ bind(&done);
+  }
+
+  // 4. Push back the return address one slot down on the stack (overwriting the
+  // original callable), making the original first argument the new receiver.
+  __ PushReturnAddressFrom(rbx);
+  __ decq(rax);  // One fewer argument (first argument is new receiver).
+
 #else
+  // 1. Make sure we have at least one argument.
+  {
+    Label done;
+    __ testq(rax, rax);
+    __ j(not_zero, &done, Label::kNear);
+    __ PopReturnAddressTo(rbx);
     __ PushRoot(RootIndex::kUndefinedValue);
-#endif
     __ PushReturnAddressFrom(rbx);
     __ incq(rax);
     __ bind(&done);
@@ -1805,14 +1825,6 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
     __ movq(rdi, args.GetReceiverOperand());
   }
 
-#ifdef V8_REVERSE_JSARGS
-  // 3. Shift return address one slot down on the stack (overwriting the
-  // original receiver), making the original first argument the new receiver.
-  {
-    __ DropUnderReturnAddress(1, rbx);  // Drop one slot under return address.
-    __ decq(rax);  // One fewer argument (first argument is new receiver).
-  }
-#else
   // 3. Shift arguments and return address one slot down on the stack
   //    (overwriting the original receiver).  Adjust argument count to make
   //    the original first argument the new receiver.
@@ -2205,10 +2217,8 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
     Label copy, check;
     Register src = r8, dest = rsp, num = r9, current = r11;
     __ movq(src, rsp);
-    __ movq(kScratchRegister, rcx);
-    __ negq(kScratchRegister);
-    __ leaq(rsp, Operand(rsp, kScratchRegister, times_system_pointer_size,
-                         0));       // Update stack pointer.
+    __ leaq(kScratchRegister, Operand(rcx, times_system_pointer_size, 0));
+    __ AllocateStackSpace(kScratchRegister);
     __ leaq(num, Operand(rax, 2));  // Number of words to copy.
                                     // +2 for receiver and return address.
     __ Set(current, 0);
@@ -3500,8 +3510,9 @@ void Builtins::Generate_CallApiGetter(MacroAssembler* masm) {
   DCHECK(api_function_address != name_arg);
   __ LoadTaggedPointerField(
       scratch, FieldOperand(callback, AccessorInfo::kJsGetterOffset));
-  __ movq(api_function_address,
-          FieldOperand(scratch, Foreign::kForeignAddressOffset));
+  __ LoadExternalPointerField(
+      api_function_address,
+      FieldOperand(scratch, Foreign::kForeignAddressOffset));
 
   // +3 is to skip prolog, return address and name handle.
   Operand return_value_operand(
diff --git a/deps/v8/src/codegen/arm/constants-arm.h b/deps/v8/src/codegen/arm/constants-arm.h
index 171de9e1d7d..a7726a8f25e 100644
--- a/deps/v8/src/codegen/arm/constants-arm.h
+++ b/deps/v8/src/codegen/arm/constants-arm.h
@@ -459,23 +459,6 @@ class Instruction {
     return InstructionBits() & (((2 << (hi - lo)) - 1) << lo);
   }
 
-  // Static support.
-
-  // Extract a single bit from the instruction bits and return it as bit 0 in
-  // the result.
-  static inline int Bit(Instr instr, int nr) { return (instr >> nr) & 1; }
-
-  // Extract a bit field <hi:lo> from the instruction bits and return it in the
-  // least-significant bits of the result.
-  static inline int Bits(Instr instr, int hi, int lo) {
-    return (instr >> lo) & ((2 << (hi - lo)) - 1);
-  }
-
-  // Read a bit field <hi:lo>, leaving its position unchanged in the result.
-  static inline int BitField(Instr instr, int hi, int lo) {
-    return instr & (((2 << (hi - lo)) - 1) << lo);
-  }
-
   // Accessors for the different named fields used in the ARM encoding.
   // The naming of these accessor corresponds to figure A3-1.
   //
diff --git a/deps/v8/src/codegen/arm/cpu-arm.cc b/deps/v8/src/codegen/arm/cpu-arm.cc
index 9113de705d2..47fe4bdb740 100644
--- a/deps/v8/src/codegen/arm/cpu-arm.cc
+++ b/deps/v8/src/codegen/arm/cpu-arm.cc
@@ -37,18 +37,6 @@ V8_NOINLINE void CpuFeatures::FlushICache(void* start, size_t size) {
   register uint32_t end asm("r1") = beg + size;
   register uint32_t flg asm("r2") = 0;
 
-#ifdef __clang__
-  // This variant of the asm avoids a constant pool entry, which can be
-  // problematic when LTO'ing. It is also slightly shorter.
-  register uint32_t scno asm("r7") = __ARM_NR_cacheflush;
-
-  asm volatile("svc 0\n"
-               :
-               : "r"(beg), "r"(end), "r"(flg), "r"(scno)
-               : "memory");
-#else
-  // Use a different variant of the asm with GCC because some versions doesn't
-  // support r7 as an asm input.
   asm volatile(
       // This assembly works for both ARM and Thumb targets.
 
@@ -66,7 +54,6 @@ V8_NOINLINE void CpuFeatures::FlushICache(void* start, size_t size) {
       : "r"(beg), "r"(end), "r"(flg), [scno] "i"(__ARM_NR_cacheflush)
       : "memory");
 #endif
-#endif
 #endif  // !USE_SIMULATOR
 }
 
diff --git a/deps/v8/src/codegen/arm/interface-descriptors-arm.cc b/deps/v8/src/codegen/arm/interface-descriptors-arm.cc
index 575fd278057..09b80af2d49 100644
--- a/deps/v8/src/codegen/arm/interface-descriptors-arm.cc
+++ b/deps/v8/src/codegen/arm/interface-descriptors-arm.cc
@@ -191,11 +191,6 @@ void AbortDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  data->InitializePlatformSpecific(0, nullptr);
-}
-
 void CompareDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {r1, r0};
@@ -283,6 +278,54 @@ void RunMicrotasksEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+void BinaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallTrampoline_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void ConstructWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void ConstructWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void Compare_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void UnaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 3);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/arm/macro-assembler-arm.cc b/deps/v8/src/codegen/arm/macro-assembler-arm.cc
index 349c8dc29e7..7b9e73e1d91 100644
--- a/deps/v8/src/codegen/arm/macro-assembler-arm.cc
+++ b/deps/v8/src/codegen/arm/macro-assembler-arm.cc
@@ -17,7 +17,7 @@
 #include "src/codegen/register-configuration.h"
 #include "src/debug/debug.h"
 #include "src/execution/frames-inl.h"
-#include "src/heap/heap-inl.h"  // For MemoryChunk.
+#include "src/heap/memory-chunk.h"
 #include "src/init/bootstrapper.h"
 #include "src/logging/counters.h"
 #include "src/numbers/double.h"
@@ -427,6 +427,35 @@ void TurboAssembler::Push(Smi smi) {
   push(scratch);
 }
 
+void TurboAssembler::PushArray(Register array, Register size, Register scratch,
+                               PushArrayOrder order) {
+  UseScratchRegisterScope temps(this);
+  Register counter = scratch;
+  Register tmp = temps.Acquire();
+  DCHECK(!AreAliased(array, size, counter, tmp));
+  Label loop, entry;
+  if (order == PushArrayOrder::kReverse) {
+    mov(counter, Operand(0));
+    b(&entry);
+    bind(&loop);
+    ldr(tmp, MemOperand(array, counter, LSL, kSystemPointerSizeLog2));
+    push(tmp);
+    add(counter, counter, Operand(1));
+    bind(&entry);
+    cmp(counter, size);
+    b(lt, &loop);
+  } else {
+    mov(counter, size);
+    b(&entry);
+    bind(&loop);
+    ldr(tmp, MemOperand(array, counter, LSL, kSystemPointerSizeLog2));
+    push(tmp);
+    bind(&entry);
+    sub(counter, counter, Operand(1), SetCC);
+    b(ge, &loop);
+  }
+}
+
 void TurboAssembler::Move(Register dst, Smi smi) { mov(dst, Operand(smi)); }
 
 void TurboAssembler::Move(Register dst, Handle<HeapObject> value) {
@@ -1556,7 +1585,7 @@ void MacroAssembler::CallDebugOnFunctionCall(Register fun, Register new_target,
                                              Register expected_parameter_count,
                                              Register actual_parameter_count) {
   // Load receiver to pass it later to DebugOnFunctionCall hook.
-  ldr(r4, MemOperand(sp, actual_parameter_count, LSL, kPointerSizeLog2));
+  ldr(r4, ReceiverOperand(actual_parameter_count));
   FrameScope frame(this, has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
 
   SmiTag(expected_parameter_count);
@@ -2426,7 +2455,7 @@ void TurboAssembler::CheckPageFlag(Register object, int mask, Condition cc,
   Register scratch = temps.Acquire();
   DCHECK(cc == eq || cc == ne);
   Bfc(scratch, object, 0, kPageSizeBits);
-  ldr(scratch, MemOperand(scratch, MemoryChunk::kFlagsOffset));
+  ldr(scratch, MemOperand(scratch, BasicMemoryChunk::kFlagsOffset));
   tst(scratch, Operand(mask));
   b(cc, condition_met);
 }
diff --git a/deps/v8/src/codegen/arm/macro-assembler-arm.h b/deps/v8/src/codegen/arm/macro-assembler-arm.h
index 9ec1bafb580..a7dc5498b8b 100644
--- a/deps/v8/src/codegen/arm/macro-assembler-arm.h
+++ b/deps/v8/src/codegen/arm/macro-assembler-arm.h
@@ -156,6 +156,12 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
     }
   }
 
+  enum class PushArrayOrder { kNormal, kReverse };
+  // `array` points to the first element (the lowest address).
+  // `array` and `size` are not modified.
+  void PushArray(Register array, Register size, Register scratch,
+                 PushArrayOrder order = PushArrayOrder::kNormal);
+
   void Pop(Register dst) { pop(dst); }
 
   // Pop two registers. Pops rightmost register first (from lower address).
@@ -720,6 +726,18 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   void JumpIfIsInRange(Register value, unsigned lower_limit,
                        unsigned higher_limit, Label* on_in_range);
 
+  // It assumes that the arguments are located below the stack pointer.
+  // argc is the number of arguments not including the receiver.
+  // TODO(victorgomes): Remove this function once we stick with the reversed
+  // arguments order.
+  MemOperand ReceiverOperand(Register argc) {
+#ifdef V8_REVERSE_JSARGS
+    return MemOperand(sp, 0);
+#else
+    return MemOperand(sp, argc, LSL, kSystemPointerSizeLog2);
+#endif
+  }
+
   // ---------------------------------------------------------------------------
   // Runtime calls
 
diff --git a/deps/v8/src/codegen/arm/register-arm.h b/deps/v8/src/codegen/arm/register-arm.h
index 0d453ec03ed..77ae14f98cc 100644
--- a/deps/v8/src/codegen/arm/register-arm.h
+++ b/deps/v8/src/codegen/arm/register-arm.h
@@ -351,6 +351,8 @@ constexpr Register kWasmCompileLazyFuncIndexRegister = r4;
 constexpr Register cp = r7;              // JavaScript context pointer.
 constexpr Register kRootRegister = r10;  // Roots array pointer.
 
+constexpr DoubleRegister kFPReturnRegister0 = d0;
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/arm64/assembler-arm64-inl.h b/deps/v8/src/codegen/arm64/assembler-arm64-inl.h
index f3c3e559753..c47f8f1aa54 100644
--- a/deps/v8/src/codegen/arm64/assembler-arm64-inl.h
+++ b/deps/v8/src/codegen/arm64/assembler-arm64-inl.h
@@ -660,6 +660,7 @@ Address RelocInfo::constant_pool_entry_address() {
 HeapObject RelocInfo::target_object() {
   DCHECK(IsCodeTarget(rmode_) || IsEmbeddedObjectMode(rmode_));
   if (IsCompressedEmbeddedObject(rmode_)) {
+    CHECK(!host_.is_null());
     return HeapObject::cast(Object(DecompressTaggedAny(
         host_.address(),
         Assembler::target_compressed_address_at(pc_, constant_pool_))));
diff --git a/deps/v8/src/codegen/arm64/assembler-arm64.cc b/deps/v8/src/codegen/arm64/assembler-arm64.cc
index d5a0295934d..97a57d6f3c6 100644
--- a/deps/v8/src/codegen/arm64/assembler-arm64.cc
+++ b/deps/v8/src/codegen/arm64/assembler-arm64.cc
@@ -140,7 +140,9 @@ bool RelocInfo::IsCodedSpecially() {
 
 bool RelocInfo::IsInConstantPool() {
   Instruction* instr = reinterpret_cast<Instruction*>(pc_);
-  return instr->IsLdrLiteralX();
+  DCHECK_IMPLIES(instr->IsLdrLiteralW(), COMPRESS_POINTERS_BOOL);
+  return instr->IsLdrLiteralX() ||
+         (COMPRESS_POINTERS_BOOL && instr->IsLdrLiteralW());
 }
 
 uint32_t RelocInfo::wasm_call_tag() const {
diff --git a/deps/v8/src/codegen/arm64/instructions-arm64.cc b/deps/v8/src/codegen/arm64/instructions-arm64.cc
index c2224ffe34a..7d986f286d9 100644
--- a/deps/v8/src/codegen/arm64/instructions-arm64.cc
+++ b/deps/v8/src/codegen/arm64/instructions-arm64.cc
@@ -343,6 +343,10 @@ void NEONFormatDecoder::SetFormatMaps(const NEONFormatMap* format0,
   formats_[0] = format0;
   formats_[1] = (format1 == nullptr) ? formats_[0] : format1;
   formats_[2] = (format2 == nullptr) ? formats_[1] : format2;
+  // Support four parameters form (e.i. ld4r)
+  // to avoid using positional arguments in DisassemblingDecoder.
+  // See: https://crbug.com/v8/10365
+  formats_[3] = formats_[2];
 }
 
 void NEONFormatDecoder::SetFormatMap(unsigned index,
@@ -353,15 +357,18 @@ void NEONFormatDecoder::SetFormatMap(unsigned index,
 }
 
 const char* NEONFormatDecoder::SubstitutePlaceholders(const char* string) {
-  return Substitute(string, kPlaceholder, kPlaceholder, kPlaceholder);
+  return Substitute(string, kPlaceholder, kPlaceholder, kPlaceholder,
+                    kPlaceholder);
 }
 
 const char* NEONFormatDecoder::Substitute(const char* string,
                                           SubstitutionMode mode0,
                                           SubstitutionMode mode1,
-                                          SubstitutionMode mode2) {
+                                          SubstitutionMode mode2,
+                                          SubstitutionMode mode3) {
   snprintf(form_buffer_, sizeof(form_buffer_), string, GetSubstitute(0, mode0),
-           GetSubstitute(1, mode1), GetSubstitute(2, mode2));
+           GetSubstitute(1, mode1), GetSubstitute(2, mode2),
+           GetSubstitute(3, mode3));
   return form_buffer_;
 }
 
diff --git a/deps/v8/src/codegen/arm64/instructions-arm64.h b/deps/v8/src/codegen/arm64/instructions-arm64.h
index d2341b972fb..c115fb69246 100644
--- a/deps/v8/src/codegen/arm64/instructions-arm64.h
+++ b/deps/v8/src/codegen/arm64/instructions-arm64.h
@@ -619,7 +619,8 @@ class NEONFormatDecoder {
   // substitution mode.
   const char* Substitute(const char* string, SubstitutionMode mode0 = kFormat,
                          SubstitutionMode mode1 = kFormat,
-                         SubstitutionMode mode2 = kFormat);
+                         SubstitutionMode mode2 = kFormat,
+                         SubstitutionMode mode3 = kFormat);
 
   // Append a "2" to a mnemonic string based of the state of the Q bit.
   const char* Mnemonic(const char* mnemonic);
@@ -738,7 +739,7 @@ class NEONFormatDecoder {
   uint8_t PickBits(const uint8_t bits[]);
 
   Instr instrbits_;
-  const NEONFormatMap* formats_[3];
+  const NEONFormatMap* formats_[4];
   char form_buffer_[64];
   char mne_buffer_[16];
 };
diff --git a/deps/v8/src/codegen/arm64/interface-descriptors-arm64.cc b/deps/v8/src/codegen/arm64/interface-descriptors-arm64.cc
index 2d86ace4bc2..2c60ea2ec04 100644
--- a/deps/v8/src/codegen/arm64/interface-descriptors-arm64.cc
+++ b/deps/v8/src/codegen/arm64/interface-descriptors-arm64.cc
@@ -191,11 +191,6 @@ void AbortDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  data->InitializePlatformSpecific(0, nullptr);
-}
-
 void CompareDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   // x1: left operand
@@ -287,6 +282,54 @@ void RunMicrotasksEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+void BinaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallTrampoline_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void ConstructWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void ConstructWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void Compare_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void UnaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 3);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/arm64/macro-assembler-arm64-inl.h b/deps/v8/src/codegen/arm64/macro-assembler-arm64-inl.h
index 809838bcf9d..93b8136d9a9 100644
--- a/deps/v8/src/codegen/arm64/macro-assembler-arm64-inl.h
+++ b/deps/v8/src/codegen/arm64/macro-assembler-arm64-inl.h
@@ -713,7 +713,7 @@ void TurboAssembler::Fmov(VRegister vd, float imm) {
       } else {
         UseScratchRegisterScope temps(this);
         Register tmp = temps.AcquireW();
-        Mov(tmp, bit_cast<uint32_t>(imm));
+        Mov(tmp, bits);
         Fmov(vd, tmp);
       }
     } else {
diff --git a/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc b/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc
index 1273904c9c2..012774e10bd 100644
--- a/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc
+++ b/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc
@@ -16,7 +16,7 @@
 #include "src/deoptimizer/deoptimizer.h"
 #include "src/execution/frame-constants.h"
 #include "src/execution/frames-inl.h"
-#include "src/heap/heap-inl.h"  // For MemoryChunk.
+#include "src/heap/memory-chunk.h"
 #include "src/init/bootstrapper.h"
 #include "src/logging/counters.h"
 #include "src/runtime/runtime.h"
@@ -1306,7 +1306,14 @@ void TurboAssembler::CopyDoubleWords(Register dst, Register src, Register count,
   static_assert(kSystemPointerSize == kDRegSize,
                 "pointers must be the same size as doubles");
 
-  int direction = (mode == kDstLessThanSrc) ? 1 : -1;
+  if (mode == kDstLessThanSrcAndReverse) {
+    Add(src, src, Operand(count, LSL, kSystemPointerSizeLog2));
+    Sub(src, src, kSystemPointerSize);
+  }
+
+  int src_direction = (mode == kDstLessThanSrc) ? 1 : -1;
+  int dst_direction = (mode == kSrcLessThanDst) ? -1 : 1;
+
   UseScratchRegisterScope scope(this);
   VRegister temp0 = scope.AcquireD();
   VRegister temp1 = scope.AcquireD();
@@ -1314,23 +1321,30 @@ void TurboAssembler::CopyDoubleWords(Register dst, Register src, Register count,
   Label pairs, loop, done;
 
   Tbz(count, 0, &pairs);
-  Ldr(temp0, MemOperand(src, direction * kSystemPointerSize, PostIndex));
+  Ldr(temp0, MemOperand(src, src_direction * kSystemPointerSize, PostIndex));
   Sub(count, count, 1);
-  Str(temp0, MemOperand(dst, direction * kSystemPointerSize, PostIndex));
+  Str(temp0, MemOperand(dst, dst_direction * kSystemPointerSize, PostIndex));
 
   Bind(&pairs);
   if (mode == kSrcLessThanDst) {
     // Adjust pointers for post-index ldp/stp with negative offset:
     Sub(dst, dst, kSystemPointerSize);
     Sub(src, src, kSystemPointerSize);
+  } else if (mode == kDstLessThanSrcAndReverse) {
+    Sub(src, src, kSystemPointerSize);
   }
   Bind(&loop);
   Cbz(count, &done);
   Ldp(temp0, temp1,
-      MemOperand(src, 2 * direction * kSystemPointerSize, PostIndex));
+      MemOperand(src, 2 * src_direction * kSystemPointerSize, PostIndex));
   Sub(count, count, 2);
-  Stp(temp0, temp1,
-      MemOperand(dst, 2 * direction * kSystemPointerSize, PostIndex));
+  if (mode == kDstLessThanSrcAndReverse) {
+    Stp(temp1, temp0,
+        MemOperand(dst, 2 * dst_direction * kSystemPointerSize, PostIndex));
+  } else {
+    Stp(temp0, temp1,
+        MemOperand(dst, 2 * dst_direction * kSystemPointerSize, PostIndex));
+  }
   B(&loop);
 
   // TODO(all): large copies may benefit from using temporary Q registers
@@ -2093,7 +2107,7 @@ void MacroAssembler::CallDebugOnFunctionCall(Register fun, Register new_target,
                                              Register expected_parameter_count,
                                              Register actual_parameter_count) {
   // Load receiver to pass it later to DebugOnFunctionCall hook.
-  Ldr(x4, MemOperand(sp, actual_parameter_count, LSL, kSystemPointerSizeLog2));
+  Peek(x4, ReceiverOperand(actual_parameter_count));
   FrameScope frame(this, has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
 
   if (!new_target.is_valid()) new_target = padreg;
@@ -2165,6 +2179,14 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
   Bind(&done);
 }
 
+Operand MacroAssembler::ReceiverOperand(Register arg_count) {
+#ifdef V8_REVERSE_JSARGS
+  return Operand(0);
+#else
+  return Operand(arg_count, LSL, kXRegSizeLog2);
+#endif
+}
+
 void MacroAssembler::InvokeFunctionWithNewTarget(
     Register function, Register new_target, Register actual_parameter_count,
     InvokeFlag flag) {
@@ -2297,7 +2319,7 @@ void TurboAssembler::EnterFrame(StackFrame::Type type) {
     // sp[2] : fp
     // sp[1] : type
     // sp[0] : for alignment
-  } else if (type == StackFrame::WASM_COMPILED ||
+  } else if (type == StackFrame::WASM ||
              type == StackFrame::WASM_COMPILE_LAZY ||
              type == StackFrame::WASM_EXIT) {
     Register type_reg = temps.AcquireX();
@@ -2628,7 +2650,7 @@ void TurboAssembler::CheckPageFlag(const Register& object, int mask,
   UseScratchRegisterScope temps(this);
   Register scratch = temps.AcquireX();
   And(scratch, object, ~kPageAlignmentMask);
-  Ldr(scratch, MemOperand(scratch, MemoryChunk::kFlagsOffset));
+  Ldr(scratch, MemOperand(scratch, BasicMemoryChunk::kFlagsOffset));
   if (cc == eq) {
     TestAndBranchIfAnySet(scratch, mask, condition_met);
   } else {
@@ -2966,7 +2988,9 @@ void TurboAssembler::PrintfNoPreserve(const char* format,
 
   // Copies of the printf vararg registers that we can pop from.
   CPURegList pcs_varargs = kPCSVarargs;
+#ifndef V8_OS_WIN
   CPURegList pcs_varargs_fp = kPCSVarargsFP;
+#endif
 
   // Place the arguments. There are lots of clever tricks and optimizations we
   // could use here, but Printf is a debug tool so instead we just try to keep
@@ -2981,7 +3005,14 @@ void TurboAssembler::PrintfNoPreserve(const char* format,
       if (args[i].Is32Bits()) pcs[i] = pcs[i].W();
     } else if (args[i].IsVRegister()) {
       // In C, floats are always cast to doubles for varargs calls.
+#ifdef V8_OS_WIN
+      // In case of variadic functions SIMD and Floating-point registers
+      // aren't used. The general x0-x7 should be used instead.
+      // https://docs.microsoft.com/en-us/cpp/build/arm64-windows-abi-conventions
+      pcs[i] = pcs_varargs.PopLowestIndex().X();
+#else
       pcs[i] = pcs_varargs_fp.PopLowestIndex().D();
+#endif
     } else {
       DCHECK(args[i].IsNone());
       arg_count = i;
@@ -3012,6 +3043,22 @@ void TurboAssembler::PrintfNoPreserve(const char* format,
   // Do a second pass to move values into their final positions and perform any
   // conversions that may be required.
   for (int i = 0; i < arg_count; i++) {
+#ifdef V8_OS_WIN
+    if (args[i].IsVRegister()) {
+      if (pcs[i].SizeInBytes() != args[i].SizeInBytes()) {
+        // If the argument is half- or single-precision
+        // converts to double-precision before that is
+        // moved into the one of X scratch register.
+        VRegister temp0 = temps.AcquireD();
+        Fcvt(temp0.VReg(), args[i].VReg());
+        Fmov(pcs[i].Reg(), temp0);
+      } else {
+        Fmov(pcs[i].Reg(), args[i].VReg());
+      }
+    } else {
+      Mov(pcs[i].Reg(), args[i].Reg(), kDiscardForSameWReg);
+    }
+#else
     DCHECK(pcs[i].type() == args[i].type());
     if (pcs[i].IsRegister()) {
       Mov(pcs[i].Reg(), args[i].Reg(), kDiscardForSameWReg);
@@ -3023,6 +3070,7 @@ void TurboAssembler::PrintfNoPreserve(const char* format,
         Fcvt(pcs[i].VReg(), args[i].VReg());
       }
     }
+#endif
   }
 
   // Load the format string into x0, as per the procedure-call standard.
diff --git a/deps/v8/src/codegen/arm64/macro-assembler-arm64.h b/deps/v8/src/codegen/arm64/macro-assembler-arm64.h
index 7b1fb69e954..109e73c3c22 100644
--- a/deps/v8/src/codegen/arm64/macro-assembler-arm64.h
+++ b/deps/v8/src/codegen/arm64/macro-assembler-arm64.h
@@ -703,7 +703,7 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   void CopySlots(Register dst, Register src, Register slot_count);
 
   // Copy count double words from the address in register src to the address
-  // in register dst. There are two modes for this function:
+  // in register dst. There are three modes for this function:
   // 1) Address dst must be less than src, or the gap between them must be
   //    greater than or equal to count double words, otherwise the result is
   //    unpredictable. This is the default mode.
@@ -711,10 +711,15 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   //    greater than or equal to count double words, otherwise the result is
   //    undpredictable. In this mode, src and dst specify the last (highest)
   //    address of the regions to copy from and to.
+  // 3) The same as mode 1, but the words are copied in the reversed order.
   // The case where src == dst is not supported.
   // The function may corrupt its register arguments. The registers must not
   // alias each other.
-  enum CopyDoubleWordsMode { kDstLessThanSrc, kSrcLessThanDst };
+  enum CopyDoubleWordsMode {
+    kDstLessThanSrc,
+    kSrcLessThanDst,
+    kDstLessThanSrcAndReverse
+  };
   void CopyDoubleWords(Register dst, Register src, Register count,
                        CopyDoubleWordsMode mode = kDstLessThanSrc);
 
@@ -1762,6 +1767,10 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
     DecodeField<Field>(reg, reg);
   }
 
+  // TODO(victorgomes): inline this function once we remove V8_REVERSE_JSARGS
+  // flag.
+  Operand ReceiverOperand(const Register arg_count);
+
   // ---- SMI and Number Utilities ----
 
   inline void SmiTag(Register dst, Register src);
diff --git a/deps/v8/src/codegen/arm64/register-arm64.h b/deps/v8/src/codegen/arm64/register-arm64.h
index 9571aa5ab57..090d5424b3a 100644
--- a/deps/v8/src/codegen/arm64/register-arm64.h
+++ b/deps/v8/src/codegen/arm64/register-arm64.h
@@ -470,8 +470,9 @@ ALIAS_REGISTER(Register, padreg, x31);
 // Keeps the 0 double value.
 ALIAS_REGISTER(VRegister, fp_zero, d15);
 // MacroAssembler fixed V Registers.
-ALIAS_REGISTER(VRegister, fp_fixed1, d28);
-ALIAS_REGISTER(VRegister, fp_fixed2, d29);
+// d29 is not part of ALLOCATABLE_DOUBLE_REGISTERS, so use 27 and 28.
+ALIAS_REGISTER(VRegister, fp_fixed1, d27);
+ALIAS_REGISTER(VRegister, fp_fixed2, d28);
 
 // MacroAssembler scratch V registers.
 ALIAS_REGISTER(VRegister, fp_scratch, d30);
@@ -696,6 +697,8 @@ constexpr Register kRuntimeCallArgvRegister = x11;
 constexpr Register kWasmInstanceRegister = x7;
 constexpr Register kWasmCompileLazyFuncIndexRegister = x8;
 
+constexpr DoubleRegister kFPReturnRegister0 = d0;
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/assembler.cc b/deps/v8/src/codegen/assembler.cc
index 4bda1260a90..3b27bf5db9e 100644
--- a/deps/v8/src/codegen/assembler.cc
+++ b/deps/v8/src/codegen/assembler.cc
@@ -41,7 +41,6 @@
 #include "src/execution/isolate.h"
 #include "src/heap/heap-inl.h"  // For MemoryAllocator. TODO(jkummerow): Drop.
 #include "src/snapshot/embedded/embedded-data.h"
-#include "src/snapshot/serializer-common.h"
 #include "src/snapshot/snapshot.h"
 #include "src/utils/ostreams.h"
 #include "src/utils/vector.h"
diff --git a/deps/v8/src/codegen/code-factory.cc b/deps/v8/src/codegen/code-factory.cc
index 060a66edc7a..006b6bee167 100644
--- a/deps/v8/src/codegen/code-factory.cc
+++ b/deps/v8/src/codegen/code-factory.cc
@@ -267,6 +267,23 @@ Callable CodeFactory::Call(Isolate* isolate, ConvertReceiverMode mode) {
   return Callable(isolate->builtins()->Call(mode), CallTrampolineDescriptor{});
 }
 
+// static
+Callable CodeFactory::Call_WithFeedback(Isolate* isolate,
+                                        ConvertReceiverMode mode) {
+  switch (mode) {
+    case ConvertReceiverMode::kNullOrUndefined:
+      return Builtins::CallableFor(
+          isolate, Builtins::kCall_ReceiverIsNullOrUndefined_WithFeedback);
+    case ConvertReceiverMode::kNotNullOrUndefined:
+      return Builtins::CallableFor(
+          isolate, Builtins::kCall_ReceiverIsNotNullOrUndefined_WithFeedback);
+    case ConvertReceiverMode::kAny:
+      return Builtins::CallableFor(isolate,
+                                   Builtins::kCall_ReceiverIsAny_WithFeedback);
+  }
+  UNREACHABLE();
+}
+
 // static
 Callable CodeFactory::CallWithArrayLike(Isolate* isolate) {
   return Builtins::CallableFor(isolate, Builtins::kCallWithArrayLike);
diff --git a/deps/v8/src/codegen/code-factory.h b/deps/v8/src/codegen/code-factory.h
index b8d294ce714..02fc7e4b236 100644
--- a/deps/v8/src/codegen/code-factory.h
+++ b/deps/v8/src/codegen/code-factory.h
@@ -71,6 +71,7 @@ class V8_EXPORT_PRIVATE CodeFactory final {
   static Callable ArgumentAdaptor(Isolate* isolate);
   static Callable Call(Isolate* isolate,
                        ConvertReceiverMode mode = ConvertReceiverMode::kAny);
+  static Callable Call_WithFeedback(Isolate* isolate, ConvertReceiverMode mode);
   static Callable CallWithArrayLike(Isolate* isolate);
   static Callable CallWithSpread(Isolate* isolate);
   static Callable CallFunction(
diff --git a/deps/v8/src/codegen/code-stub-assembler.cc b/deps/v8/src/codegen/code-stub-assembler.cc
index 0464faea3b7..eb5fa76b1f5 100644
--- a/deps/v8/src/codegen/code-stub-assembler.cc
+++ b/deps/v8/src/codegen/code-stub-assembler.cc
@@ -12,7 +12,8 @@
 #include "src/execution/frames-inl.h"
 #include "src/execution/frames.h"
 #include "src/execution/protectors.h"
-#include "src/heap/heap-inl.h"  // For Page/MemoryChunk. TODO(jkummerow): Drop.
+#include "src/heap/heap-inl.h"  // For MemoryChunk. TODO(jkummerow): Drop.
+#include "src/heap/memory-chunk.h"
 #include "src/logging/counters.h"
 #include "src/objects/api-callbacks.h"
 #include "src/objects/cell.h"
@@ -134,175 +135,6 @@ void CodeStubAssembler::Check(SloppyTNode<Word32T> condition_node,
   Check(branch, message, file, line, extra_nodes);
 }
 
-template <>
-TNode<Smi> CodeStubAssembler::IntPtrToParameter<Smi>(TNode<IntPtrT> value) {
-  return SmiTag(value);
-}
-template <>
-TNode<IntPtrT> CodeStubAssembler::IntPtrToParameter<IntPtrT>(
-    TNode<IntPtrT> value) {
-  return value;
-}
-
-void CodeStubAssembler::CollectCallableFeedback(
-    TNode<Object> maybe_target, TNode<Context> context,
-    TNode<FeedbackVector> feedback_vector, TNode<UintPtrT> slot_id,
-    CallableFeedbackMode mode) {
-  Label extra_checks(this, Label::kDeferred), done(this);
-
-  // Check if we have monomorphic {target} feedback already.
-  TNode<MaybeObject> feedback =
-      LoadFeedbackVectorSlot(feedback_vector, slot_id);
-  Comment("check if monomorphic");
-  TNode<BoolT> is_monomorphic = IsWeakReferenceToObject(feedback, maybe_target);
-  GotoIf(is_monomorphic, &done);
-
-  // Check if it is a megamorphic {target}.
-  Comment("check if megamorphic");
-  TNode<BoolT> is_megamorphic = TaggedEqual(
-      feedback, HeapConstant(FeedbackVector::MegamorphicSentinel(isolate())));
-  Branch(is_megamorphic, &done, &extra_checks);
-
-  BIND(&extra_checks);
-  {
-    Label initialize(this), mark_megamorphic(this);
-
-    Comment("check if weak reference");
-    TNode<BoolT> is_uninitialized = TaggedEqual(
-        feedback,
-        HeapConstant(FeedbackVector::UninitializedSentinel(isolate())));
-    GotoIf(is_uninitialized, &initialize);
-    CSA_ASSERT(this, IsWeakOrCleared(feedback));
-
-    // If the weak reference is cleared, we have a new chance to become
-    // monomorphic.
-    Comment("check if weak reference is cleared");
-    GotoIf(IsCleared(feedback), &initialize);
-    GotoIf(TaggedIsSmi(maybe_target), &mark_megamorphic);
-
-    if (mode == CallableFeedbackMode::kDontCollectFeedbackCell) {
-      Goto(&mark_megamorphic);
-    } else {
-      Label try_transition_to_feedback_cell(this);
-
-      // Check if {target} is a JSFunction.
-      Comment("check if target is a JSFunction");
-      TNode<HeapObject> target = CAST(maybe_target);
-      GotoIfNot(IsJSFunction(target), &mark_megamorphic);
-
-      // Check if {target}s feedback vector cell matches the {feedback_value}.
-      TNode<HeapObject> feedback_value = GetHeapObjectAssumeWeak(feedback);
-      TNode<Object> target_feedback_cell =
-          LoadObjectField(target, JSFunction::kFeedbackCellOffset);
-      Branch(TaggedEqual(feedback_value, target_feedback_cell), &done,
-             &try_transition_to_feedback_cell);
-
-      BIND(&try_transition_to_feedback_cell);
-      {
-        // Check if {target} and {feedback_value} are both JSFunctions with
-        // the same feedback vector cell, and that those functions were
-        // actually compiled already.
-        GotoIfNot(IsJSFunction(feedback_value), &mark_megamorphic);
-        TNode<HeapObject> feedback_cell = CAST(
-            LoadObjectField(feedback_value, JSFunction::kFeedbackCellOffset));
-        GotoIfNot(TaggedEqual(feedback_cell, target_feedback_cell),
-                  &mark_megamorphic);
-        GotoIfNot(IsFeedbackCell(feedback_cell), &mark_megamorphic);
-
-        // Record the feedback vector cell.
-        Comment("transition to polymorphic");
-        StoreWeakReferenceInFeedbackVector(feedback_vector, slot_id,
-                                           feedback_cell);
-        ReportFeedbackUpdate(feedback_vector, slot_id,
-                             "Call:FeedbackVectorCell");
-        Goto(&done);
-      }
-    }
-
-    BIND(&initialize);
-    {
-      Comment("check if function in same native context");
-      GotoIf(TaggedIsSmi(maybe_target), &mark_megamorphic);
-      TNode<HeapObject> target = CAST(maybe_target);
-      // Check if the {target} is a JSFunction or JSBoundFunction
-      // in the current native context.
-      TVARIABLE(HeapObject, var_current, target);
-      Label loop(this, &var_current), done_loop(this);
-      Goto(&loop);
-      BIND(&loop);
-      {
-        Label if_boundfunction(this), if_function(this);
-        TNode<HeapObject> current = var_current.value();
-        TNode<Uint16T> current_instance_type = LoadInstanceType(current);
-        GotoIf(InstanceTypeEqual(current_instance_type, JS_BOUND_FUNCTION_TYPE),
-               &if_boundfunction);
-        Branch(InstanceTypeEqual(current_instance_type, JS_FUNCTION_TYPE),
-               &if_function, &mark_megamorphic);
-
-        BIND(&if_function);
-        {
-          // Check that the JSFunction {current} is in the current native
-          // context.
-          TNode<Context> current_context =
-              CAST(LoadObjectField(current, JSFunction::kContextOffset));
-          TNode<NativeContext> current_native_context =
-              LoadNativeContext(current_context);
-          Branch(
-              TaggedEqual(LoadNativeContext(context), current_native_context),
-              &done_loop, &mark_megamorphic);
-        }
-        BIND(&if_boundfunction);
-        {
-          // Continue with the [[BoundTargetFunction]] of {target}.
-          var_current = LoadObjectField<HeapObject>(
-              current, JSBoundFunction::kBoundTargetFunctionOffset);
-          Goto(&loop);
-        }
-      }
-      BIND(&done_loop);
-      StoreWeakReferenceInFeedbackVector(feedback_vector, slot_id, target);
-      ReportFeedbackUpdate(feedback_vector, slot_id, "Call:Initialize");
-      Goto(&done);
-    }
-
-    BIND(&mark_megamorphic);
-    {
-      // MegamorphicSentinel is an immortal immovable object so
-      // write-barrier is not needed.
-      Comment("transition to megamorphic");
-      DCHECK(RootsTable::IsImmortalImmovable(RootIndex::kmegamorphic_symbol));
-      StoreFeedbackVectorSlot(
-          feedback_vector, slot_id,
-          HeapConstant(FeedbackVector::MegamorphicSentinel(isolate())),
-          SKIP_WRITE_BARRIER);
-      ReportFeedbackUpdate(feedback_vector, slot_id,
-                           "Call:TransitionMegamorphic");
-      Goto(&done);
-    }
-  }
-
-  BIND(&done);
-}
-
-void CodeStubAssembler::CollectCallFeedback(
-    TNode<Object> maybe_target, TNode<Context> context,
-    TNode<HeapObject> maybe_feedback_vector, TNode<UintPtrT> slot_id) {
-  Label feedback_done(this);
-  // If feedback_vector is not valid, then nothing to do.
-  GotoIf(IsUndefined(maybe_feedback_vector), &feedback_done);
-
-  // Increment the call count.
-  TNode<FeedbackVector> feedback_vector = CAST(maybe_feedback_vector);
-  IncrementCallCount(feedback_vector, slot_id);
-
-  // Collect the callable {target} feedback.
-  CollectCallableFeedback(maybe_target, context, feedback_vector, slot_id,
-                          CallableFeedbackMode::kCollectFeedbackCell);
-  Goto(&feedback_done);
-
-  BIND(&feedback_done);
-}
-
 void CodeStubAssembler::IncrementCallCount(
     TNode<FeedbackVector> feedback_vector, TNode<UintPtrT> slot_id) {
   Comment("increment call count");
@@ -373,7 +205,7 @@ TNode<Smi> CodeStubAssembler::SelectSmiConstant(SloppyTNode<BoolT> condition,
                              SmiConstant(false_value));
 }
 
-TNode<Object> CodeStubAssembler::NoContextConstant() {
+TNode<Smi> CodeStubAssembler::NoContextConstant() {
   return SmiConstant(Context::kNoContext);
 }
 
@@ -448,33 +280,6 @@ Node* CodeStubAssembler::IntPtrOrSmiConstant(int value, ParameterMode mode) {
   }
 }
 
-bool CodeStubAssembler::IsIntPtrOrSmiConstantZero(TNode<Smi> test) {
-  Smi smi_test;
-  if (ToSmiConstant(test, &smi_test) && smi_test.value() == 0) {
-    return true;
-  }
-  return false;
-}
-
-bool CodeStubAssembler::IsIntPtrOrSmiConstantZero(TNode<IntPtrT> test) {
-  int32_t constant_test;
-  if (ToInt32Constant(test, &constant_test) && constant_test == 0) {
-    return true;
-  }
-  return false;
-}
-
-bool CodeStubAssembler::IsIntPtrOrSmiConstantZero(Node* test,
-                                                  ParameterMode mode) {
-  if (mode == INTPTR_PARAMETERS) {
-    return IsIntPtrOrSmiConstantZero(UncheckedCast<IntPtrT>(test));
-  } else {
-    DCHECK_EQ(mode, SMI_PARAMETERS);
-    return IsIntPtrOrSmiConstantZero(UncheckedCast<Smi>(test));
-  }
-  return false;
-}
-
 bool CodeStubAssembler::TryGetIntPtrOrSmiConstantValue(Node* maybe_constant,
                                                        int* value,
                                                        ParameterMode mode) {
@@ -760,10 +565,20 @@ TNode<BoolT> CodeStubAssembler::IsValidSmiIndex(TNode<Smi> smi) {
   return Int32TrueConstant();
 }
 
+template <>
+TNode<Smi> CodeStubAssembler::TaggedToParameter(TNode<Smi> value) {
+  return value;
+}
+
+template <>
+TNode<IntPtrT> CodeStubAssembler::TaggedToParameter(TNode<Smi> value) {
+  return SmiUntag(value);
+}
+
 TNode<IntPtrT> CodeStubAssembler::TaggedIndexToIntPtr(
     TNode<TaggedIndex> value) {
-  return Signed(WordSar(BitcastTaggedToWordForTagAndSmiBits(value),
-                        IntPtrConstant(kSmiTagSize)));
+  return Signed(WordSarShiftOutZeros(BitcastTaggedToWordForTagAndSmiBits(value),
+                                     IntPtrConstant(kSmiTagSize)));
 }
 
 TNode<TaggedIndex> CodeStubAssembler::IntPtrToTaggedIndex(
@@ -858,16 +673,17 @@ TNode<IntPtrT> CodeStubAssembler::SmiUntag(SloppyTNode<Smi> value) {
   if (ToIntPtrConstant(value, &constant_value)) {
     return IntPtrConstant(constant_value >> (kSmiShiftSize + kSmiTagSize));
   }
+  TNode<IntPtrT> raw_bits = BitcastTaggedToWordForTagAndSmiBits(value);
   if (COMPRESS_POINTERS_BOOL) {
-    return ChangeInt32ToIntPtr(SmiToInt32(value));
+    // Clear the upper half using sign-extension.
+    raw_bits = ChangeInt32ToIntPtr(TruncateIntPtrToInt32(raw_bits));
   }
-  return Signed(WordSar(BitcastTaggedToWordForTagAndSmiBits(value),
-                        SmiShiftBitsConstant()));
+  return Signed(WordSarShiftOutZeros(raw_bits, SmiShiftBitsConstant()));
 }
 
 TNode<Int32T> CodeStubAssembler::SmiToInt32(SloppyTNode<Smi> value) {
   if (COMPRESS_POINTERS_BOOL) {
-    return Signed(Word32Sar(
+    return Signed(Word32SarShiftOutZeros(
         TruncateIntPtrToInt32(BitcastTaggedToWordForTagAndSmiBits(value)),
         SmiShiftBitsConstant32()));
   }
@@ -2226,9 +2042,10 @@ TNode<IntPtrT> CodeStubAssembler::LoadPropertyArrayLength(
 
 TNode<RawPtrT> CodeStubAssembler::LoadJSTypedArrayDataPtr(
     TNode<JSTypedArray> typed_array) {
-  // Data pointer = external_pointer + static_cast<Tagged_t>(base_pointer).
-  TNode<RawPtrT> external_pointer = LoadObjectField<RawPtrT>(
-      typed_array, JSTypedArray::kExternalPointerOffset);
+  // Data pointer = DecodeExternalPointer(external_pointer) +
+  //                static_cast<Tagged_t>(base_pointer).
+  TNode<RawPtrT> external_pointer =
+      DecodeExternalPointer(LoadJSTypedArrayExternalPointer(typed_array));
 
   TNode<IntPtrT> base_pointer;
   if (COMPRESS_POINTERS_BOOL) {
@@ -2567,10 +2384,10 @@ TNode<Int32T> CodeStubAssembler::LoadAndUntagToWord32FixedArrayElement(
 }
 
 TNode<MaybeObject> CodeStubAssembler::LoadWeakFixedArrayElement(
-    TNode<WeakFixedArray> object, Node* index, int additional_offset,
-    ParameterMode parameter_mode, LoadSensitivity needs_poisoning) {
+    TNode<WeakFixedArray> object, TNode<IntPtrT> index, int additional_offset) {
   return LoadArrayElement(object, WeakFixedArray::kHeaderSize, index,
-                          additional_offset, parameter_mode, needs_poisoning);
+                          additional_offset, INTPTR_PARAMETERS,
+                          LoadSensitivity::kSafe);
 }
 
 TNode<Float64T> CodeStubAssembler::LoadFixedDoubleArrayElement(
@@ -3047,17 +2864,17 @@ TNode<Int32T> CodeStubAssembler::EnsureArrayPushable(TNode<Context> context,
 }
 
 void CodeStubAssembler::PossiblyGrowElementsCapacity(
-    ParameterMode mode, ElementsKind kind, TNode<HeapObject> array,
-    Node* length, TVariable<FixedArrayBase>* var_elements, Node* growth,
+    ElementsKind kind, TNode<HeapObject> array, TNode<BInt> length,
+    TVariable<FixedArrayBase>* var_elements, TNode<BInt> growth,
     Label* bailout) {
+  ParameterMode mode = OptimalParameterMode();
   Label fits(this, var_elements);
-  Node* capacity =
-      TaggedToParameter(LoadFixedArrayBaseLength(var_elements->value()), mode);
-  // length and growth nodes are already in a ParameterMode appropriate
-  // representation.
-  Node* new_length = IntPtrOrSmiAdd(growth, length, mode);
-  GotoIfNot(IntPtrOrSmiGreaterThan(new_length, capacity, mode), &fits);
-  Node* new_capacity = CalculateNewElementsCapacity(new_length, mode);
+  TNode<BInt> capacity =
+      TaggedToParameter<BInt>(LoadFixedArrayBaseLength(var_elements->value()));
+
+  TNode<BInt> new_length = IntPtrOrSmiAdd(growth, length);
+  GotoIfNot(IntPtrOrSmiGreaterThan(new_length, capacity), &fits);
+  TNode<BInt> new_capacity = CalculateNewElementsCapacity(new_length);
   *var_elements = GrowElementsCapacity(array, var_elements->value(), kind, kind,
                                        capacity, new_capacity, mode, bailout);
   Goto(&fits);
@@ -3073,15 +2890,14 @@ TNode<Smi> CodeStubAssembler::BuildAppendJSArray(ElementsKind kind,
   Label pre_bailout(this);
   Label success(this);
   TVARIABLE(Smi, var_tagged_length);
-  ParameterMode mode = OptimalParameterMode();
   TVARIABLE(BInt, var_length, SmiToBInt(LoadFastJSArrayLength(array)));
   TVARIABLE(FixedArrayBase, var_elements, LoadElements(array));
 
   // Resize the capacity of the fixed array if it doesn't fit.
   TNode<IntPtrT> first = arg_index->value();
   TNode<BInt> growth = IntPtrToBInt(IntPtrSub(args->GetLength(), first));
-  PossiblyGrowElementsCapacity(mode, kind, array, var_length.value(),
-                               &var_elements, growth, &pre_bailout);
+  PossiblyGrowElementsCapacity(kind, array, var_length.value(), &var_elements,
+                               growth, &pre_bailout);
 
   // Push each argument onto the end of the array now that there is enough
   // capacity.
@@ -3090,8 +2906,8 @@ TNode<Smi> CodeStubAssembler::BuildAppendJSArray(ElementsKind kind,
   args->ForEach(
       push_vars,
       [&](TNode<Object> arg) {
-        TryStoreArrayElement(kind, mode, &pre_bailout, elements,
-                             var_length.value(), arg);
+        TryStoreArrayElement(kind, &pre_bailout, elements, var_length.value(),
+                             arg);
         Increment(&var_length);
       },
       first);
@@ -3104,7 +2920,7 @@ TNode<Smi> CodeStubAssembler::BuildAppendJSArray(ElementsKind kind,
 
   BIND(&pre_bailout);
   {
-    TNode<Smi> length = ParameterToTagged(var_length.value(), mode);
+    TNode<Smi> length = ParameterToTagged(var_length.value());
     var_tagged_length = length;
     TNode<Smi> diff = SmiSub(length, LoadFastJSArrayLength(array));
     StoreObjectFieldNoWriteBarrier(array, JSArray::kLengthOffset, length);
@@ -3116,15 +2932,17 @@ TNode<Smi> CodeStubAssembler::BuildAppendJSArray(ElementsKind kind,
   return var_tagged_length.value();
 }
 
-void CodeStubAssembler::TryStoreArrayElement(ElementsKind kind,
-                                             ParameterMode mode, Label* bailout,
+void CodeStubAssembler::TryStoreArrayElement(ElementsKind kind, Label* bailout,
                                              TNode<FixedArrayBase> elements,
-                                             Node* index, TNode<Object> value) {
+                                             TNode<BInt> index,
+                                             TNode<Object> value) {
   if (IsSmiElementsKind(kind)) {
     GotoIf(TaggedIsNotSmi(value), bailout);
   } else if (IsDoubleElementsKind(kind)) {
     GotoIfNotNumber(value, bailout);
   }
+
+  ParameterMode mode = OptimalParameterMode();
   if (IsDoubleElementsKind(kind)) {
     StoreElement(elements, kind, index, ChangeNumberToFloat64(CAST(value)),
                  mode);
@@ -3138,19 +2956,18 @@ void CodeStubAssembler::BuildAppendJSArray(ElementsKind kind,
                                            TNode<Object> value,
                                            Label* bailout) {
   Comment("BuildAppendJSArray: ", ElementsKindToString(kind));
-  ParameterMode mode = OptimalParameterMode();
   TVARIABLE(BInt, var_length, SmiToBInt(LoadFastJSArrayLength(array)));
   TVARIABLE(FixedArrayBase, var_elements, LoadElements(array));
 
   // Resize the capacity of the fixed array if it doesn't fit.
-  Node* growth = IntPtrOrSmiConstant(1, mode);
-  PossiblyGrowElementsCapacity(mode, kind, array, var_length.value(),
-                               &var_elements, growth, bailout);
+  TNode<BInt> growth = IntPtrOrSmiConstant<BInt>(1);
+  PossiblyGrowElementsCapacity(kind, array, var_length.value(), &var_elements,
+                               growth, bailout);
 
   // Push each argument onto the end of the array now that there is enough
   // capacity.
-  TryStoreArrayElement(kind, mode, bailout, var_elements.value(),
-                       var_length.value(), value);
+  TryStoreArrayElement(kind, bailout, var_elements.value(), var_length.value(),
+                       value);
   Increment(&var_length);
 
   TNode<Smi> length = BIntToSmi(var_length.value());
@@ -3687,6 +3504,17 @@ void CodeStubAssembler::StoreFieldsNoWriteBarrier(TNode<IntPtrT> start_address,
       kTaggedSize, IndexAdvanceMode::kPost);
 }
 
+void CodeStubAssembler::MakeFixedArrayCOW(TNode<FixedArray> array) {
+  CSA_ASSERT(this, IsFixedArrayMap(LoadMap(array)));
+  Label done(this);
+  // The empty fixed array is not modifiable anyway. And we shouldn't change its
+  // Map.
+  GotoIf(TaggedEqual(array, EmptyFixedArrayConstant()), &done);
+  StoreMap(array, FixedCOWArrayMapConstant());
+  Goto(&done);
+  BIND(&done);
+}
+
 TNode<BoolT> CodeStubAssembler::IsValidFastJSArrayCapacity(
     TNode<IntPtrT> capacity) {
   return UintPtrLessThanOrEqual(capacity,
@@ -3695,12 +3523,13 @@ TNode<BoolT> CodeStubAssembler::IsValidFastJSArrayCapacity(
 
 TNode<JSArray> CodeStubAssembler::AllocateJSArray(
     TNode<Map> array_map, TNode<FixedArrayBase> elements, TNode<Smi> length,
-    TNode<AllocationSite> allocation_site, int array_header_size) {
+    base::Optional<TNode<AllocationSite>> allocation_site,
+    int array_header_size) {
   Comment("begin allocation of JSArray passing in elements");
   CSA_SLOW_ASSERT(this, TaggedIsPositiveSmi(length));
 
   int base_size = array_header_size;
-  if (!allocation_site.is_null()) {
+  if (allocation_site) {
     base_size += AllocationMemento::kSize;
   }
 
@@ -3714,8 +3543,9 @@ TNode<JSArray> CodeStubAssembler::AllocateJSArray(
 std::pair<TNode<JSArray>, TNode<FixedArrayBase>>
 CodeStubAssembler::AllocateUninitializedJSArrayWithElements(
     ElementsKind kind, TNode<Map> array_map, TNode<Smi> length,
-    TNode<AllocationSite> allocation_site, TNode<IntPtrT> capacity,
-    AllocationFlags allocation_flags, int array_header_size) {
+    base::Optional<TNode<AllocationSite>> allocation_site,
+    TNode<IntPtrT> capacity, AllocationFlags allocation_flags,
+    int array_header_size) {
   Comment("begin allocation of JSArray with elements");
   CHECK_EQ(allocation_flags & ~kAllowLargeObjectAllocation, 0);
   CSA_SLOW_ASSERT(this, TaggedIsPositiveSmi(length));
@@ -3751,7 +3581,7 @@ CodeStubAssembler::AllocateUninitializedJSArrayWithElements(
   BIND(&nonempty);
   {
     int base_size = array_header_size;
-    if (!allocation_site.is_null()) {
+    if (allocation_site) {
       base_size += AllocationMemento::kSize;
     }
 
@@ -3823,7 +3653,8 @@ CodeStubAssembler::AllocateUninitializedJSArrayWithElements(
 
 TNode<JSArray> CodeStubAssembler::AllocateUninitializedJSArray(
     TNode<Map> array_map, TNode<Smi> length,
-    TNode<AllocationSite> allocation_site, TNode<IntPtrT> size_in_bytes) {
+    base::Optional<TNode<AllocationSite>> allocation_site,
+    TNode<IntPtrT> size_in_bytes) {
   CSA_SLOW_ASSERT(this, TaggedIsPositiveSmi(length));
 
   // Allocate space for the JSArray and the elements FixedArray in one go.
@@ -3834,9 +3665,9 @@ TNode<JSArray> CodeStubAssembler::AllocateUninitializedJSArray(
   StoreObjectFieldRoot(array, JSArray::kPropertiesOrHashOffset,
                        RootIndex::kEmptyFixedArray);
 
-  if (!allocation_site.is_null()) {
+  if (allocation_site) {
     InitializeAllocationMemento(array, IntPtrConstant(JSArray::kHeaderSize),
-                                allocation_site);
+                                *allocation_site);
   }
 
   return CAST(array);
@@ -3844,7 +3675,7 @@ TNode<JSArray> CodeStubAssembler::AllocateUninitializedJSArray(
 
 TNode<JSArray> CodeStubAssembler::AllocateJSArray(
     ElementsKind kind, TNode<Map> array_map, TNode<IntPtrT> capacity,
-    TNode<Smi> length, TNode<AllocationSite> allocation_site,
+    TNode<Smi> length, base::Optional<TNode<AllocationSite>> allocation_site,
     AllocationFlags allocation_flags) {
   CSA_SLOW_ASSERT(this, TaggedIsPositiveSmi(length));
 
@@ -3871,9 +3702,10 @@ TNode<JSArray> CodeStubAssembler::AllocateJSArray(
   return array;
 }
 
-TNode<JSArray> CodeStubAssembler::ExtractFastJSArray(
-    TNode<Context> context, TNode<JSArray> array, Node* begin, Node* count,
-    ParameterMode mode, Node* capacity, TNode<AllocationSite> allocation_site) {
+TNode<JSArray> CodeStubAssembler::ExtractFastJSArray(TNode<Context> context,
+                                                     TNode<JSArray> array,
+                                                     TNode<BInt> begin,
+                                                     TNode<BInt> count) {
   TNode<Map> original_array_map = LoadMap(array);
   TNode<Int32T> elements_kind = LoadMapElementsKind(original_array_map);
 
@@ -3882,17 +3714,18 @@ TNode<JSArray> CodeStubAssembler::ExtractFastJSArray(
   TNode<Map> array_map = LoadJSArrayElementsMap(elements_kind, native_context);
 
   TNode<FixedArrayBase> new_elements = ExtractFixedArray(
-      LoadElements(array), begin, count, capacity,
-      ExtractFixedArrayFlag::kAllFixedArrays, mode, nullptr, elements_kind);
+      LoadElements(array), begin, count, base::nullopt,
+      ExtractFixedArrayFlag::kAllFixedArrays, nullptr, elements_kind);
 
   TNode<JSArray> result = AllocateJSArray(
-      array_map, new_elements, ParameterToTagged(count, mode), allocation_site);
+      array_map, new_elements, ParameterToTagged(count), base::nullopt);
   return result;
 }
 
 TNode<JSArray> CodeStubAssembler::CloneFastJSArray(
     TNode<Context> context, TNode<JSArray> array,
-    TNode<AllocationSite> allocation_site, HoleConversionMode convert_holes) {
+    base::Optional<TNode<AllocationSite>> allocation_site,
+    HoleConversionMode convert_holes) {
   // TODO(dhai): we should be able to assert IsFastJSArray(array) here, but this
   // function is also used to copy boilerplates even when the no-elements
   // protector is invalid. This function should be renamed to reflect its uses.
@@ -3918,7 +3751,7 @@ TNode<JSArray> CodeStubAssembler::CloneFastJSArray(
   // Simple extraction that preserves holes.
   new_elements =
       ExtractFixedArray(LoadElements(array), IntPtrOrSmiConstant(0, mode),
-                        TaggedToParameter(CAST(length), mode), nullptr,
+                        TaggedToParameter<BInt>(CAST(length)), nullptr,
                         ExtractFixedArrayFlag::kAllFixedArraysDontCopyCOW, mode,
                         nullptr, var_elements_kind.value());
   var_new_elements = new_elements;
@@ -3936,7 +3769,7 @@ TNode<JSArray> CodeStubAssembler::CloneFastJSArray(
     // ExtractFixedArrayFlag::kDontCopyCOW.
     new_elements = ExtractFixedArray(
         LoadElements(array), IntPtrOrSmiConstant(0, mode),
-        TaggedToParameter(CAST(length), mode), nullptr,
+        TaggedToParameter<BInt>(CAST(length)), nullptr,
         ExtractFixedArrayFlag::kAllFixedArrays, mode, &var_holes_converted);
     var_new_elements = new_elements;
     // If the array type didn't change, use the original elements kind.
@@ -4427,9 +4260,9 @@ void CodeStubAssembler::FillPropertyArrayWithUndefined(
   CSA_SLOW_ASSERT(this, MatchesParameterMode(to_node, mode));
   ElementsKind kind = PACKED_ELEMENTS;
   TNode<Oddball> value = UndefinedConstant();
-  BuildFastFixedArrayForEach(
+  BuildFastArrayForEach(
       array, kind, from_node, to_node,
-      [this, value](Node* array, Node* offset) {
+      [this, value](TNode<HeapObject> array, TNode<IntPtrT> offset) {
         StoreNoWriteBarrier(MachineRepresentation::kTagged, array, offset,
                             value);
       },
@@ -4455,9 +4288,10 @@ void CodeStubAssembler::FillFixedArrayWithValue(ElementsKind kind,
     float_value = LoadHeapNumberValue(CAST(value));
   }
 
-  BuildFastFixedArrayForEach(
+  BuildFastArrayForEach(
       array, kind, from_node, to_node,
-      [this, value, float_value, kind](Node* array, Node* offset) {
+      [this, value, float_value, kind](TNode<HeapObject> array,
+                                       TNode<IntPtrT> offset) {
         if (IsDoubleElementsKind(kind)) {
           StoreNoWriteBarrier(MachineRepresentation::kFloat64, array, offset,
                               float_value);
@@ -4615,7 +4449,7 @@ void CodeStubAssembler::MoveElements(ElementsKind kind,
       const TNode<IntPtrT> delta =
           IntPtrMul(IntPtrSub(dst_index, begin),
                     IntPtrConstant(ElementsKindToByteSize(kind)));
-      auto loop_body = [&](Node* array, Node* offset) {
+      auto loop_body = [&](TNode<HeapObject> array, TNode<IntPtrT> offset) {
         const TNode<AnyTaggedT> element = Load<AnyTaggedT>(array, offset);
         const TNode<WordT> delta_offset = IntPtrAdd(offset, delta);
         Store(array, delta_offset, element);
@@ -4628,17 +4462,15 @@ void CodeStubAssembler::MoveElements(ElementsKind kind,
       BIND(&iterate_forward);
       {
         // Make a loop for the stores.
-        BuildFastFixedArrayForEach(elements, kind, begin, end, loop_body,
-                                   INTPTR_PARAMETERS,
-                                   ForEachDirection::kForward);
+        BuildFastArrayForEach(elements, kind, begin, end, loop_body,
+                              INTPTR_PARAMETERS, ForEachDirection::kForward);
         Goto(&finished);
       }
 
       BIND(&iterate_backward);
       {
-        BuildFastFixedArrayForEach(elements, kind, begin, end, loop_body,
-                                   INTPTR_PARAMETERS,
-                                   ForEachDirection::kReverse);
+        BuildFastArrayForEach(elements, kind, begin, end, loop_body,
+                              INTPTR_PARAMETERS, ForEachDirection::kReverse);
         Goto(&finished);
       }
     }
@@ -4706,9 +4538,9 @@ void CodeStubAssembler::CopyElements(ElementsKind kind,
       const TNode<IntPtrT> delta =
           IntPtrMul(IntPtrSub(dst_index, src_index),
                     IntPtrConstant(ElementsKindToByteSize(kind)));
-      BuildFastFixedArrayForEach(
+      BuildFastArrayForEach(
           src_elements, kind, begin, end,
-          [&](Node* array, Node* offset) {
+          [&](TNode<HeapObject> array, TNode<IntPtrT> offset) {
             const TNode<AnyTaggedT> element = Load<AnyTaggedT>(array, offset);
             const TNode<WordT> delta_offset = IntPtrAdd(offset, delta);
             if (write_barrier == SKIP_WRITE_BARRIER) {
@@ -4932,10 +4764,10 @@ void CodeStubAssembler::CopyPropertyArrayValues(TNode<HeapObject> from_array,
 
   Node* start = IntPtrOrSmiConstant(0, mode);
   ElementsKind kind = PACKED_ELEMENTS;
-  BuildFastFixedArrayForEach(
+  BuildFastArrayForEach(
       from_array, kind, start, property_count,
-      [this, to_array, needs_write_barrier, destroy_source](Node* array,
-                                                            Node* offset) {
+      [this, to_array, needs_write_barrier, destroy_source](
+          TNode<HeapObject> array, TNode<IntPtrT> offset) {
         TNode<AnyTaggedT> value = Load<AnyTaggedT>(array, offset);
 
         if (destroy_source == DestroySource::kNo) {
@@ -4966,11 +4798,9 @@ void CodeStubAssembler::CopyPropertyArrayValues(TNode<HeapObject> from_array,
   Comment("] CopyPropertyArrayValues");
 }
 
-Node* CodeStubAssembler::LoadElementAndPrepareForStore(Node* array,
-                                                       Node* offset,
-                                                       ElementsKind from_kind,
-                                                       ElementsKind to_kind,
-                                                       Label* if_hole) {
+Node* CodeStubAssembler::LoadElementAndPrepareForStore(
+    TNode<FixedArrayBase> array, TNode<IntPtrT> offset, ElementsKind from_kind,
+    ElementsKind to_kind, Label* if_hole) {
   CSA_ASSERT(this, IsFixedArrayWithKind(array, from_kind));
   if (IsDoubleElementsKind(from_kind)) {
     TNode<Float64T> value =
@@ -5011,28 +4841,32 @@ TNode<FixedArrayBase> CodeStubAssembler::TryGrowElementsCapacity(
   CSA_SLOW_ASSERT(this, IsFixedArrayWithKindOrEmpty(elements, kind));
   TNode<Smi> capacity = LoadFixedArrayBaseLength(elements);
 
-  ParameterMode mode = OptimalParameterMode();
-  return TryGrowElementsCapacity(
-      object, elements, kind, TaggedToParameter(key, mode),
-      TaggedToParameter(capacity, mode), mode, bailout);
+  return TryGrowElementsCapacity(object, elements, kind,
+                                 TaggedToParameter<BInt>(key),
+                                 TaggedToParameter<BInt>(capacity), bailout);
 }
 
+template <typename TIndex>
 TNode<FixedArrayBase> CodeStubAssembler::TryGrowElementsCapacity(
     TNode<HeapObject> object, TNode<FixedArrayBase> elements, ElementsKind kind,
-    Node* key, Node* capacity, ParameterMode mode, Label* bailout) {
+    TNode<TIndex> key, TNode<TIndex> capacity, Label* bailout) {
+  static_assert(
+      std::is_same<TIndex, Smi>::value || std::is_same<TIndex, IntPtrT>::value,
+      "Only Smi or IntPtrT key and capacity nodes are allowed");
   Comment("TryGrowElementsCapacity");
   CSA_SLOW_ASSERT(this, IsFixedArrayWithKindOrEmpty(elements, kind));
-  CSA_SLOW_ASSERT(this, MatchesParameterMode(capacity, mode));
-  CSA_SLOW_ASSERT(this, MatchesParameterMode(key, mode));
 
   // If the gap growth is too big, fall back to the runtime.
-  Node* max_gap = IntPtrOrSmiConstant(JSObject::kMaxGap, mode);
-  Node* max_capacity = IntPtrOrSmiAdd(capacity, max_gap, mode);
-  GotoIf(UintPtrOrSmiGreaterThanOrEqual(key, max_capacity, mode), bailout);
+  TNode<TIndex> max_gap = IntPtrOrSmiConstant<TIndex>(JSObject::kMaxGap);
+  TNode<TIndex> max_capacity = IntPtrOrSmiAdd(capacity, max_gap);
+  GotoIf(UintPtrOrSmiGreaterThanOrEqual(key, max_capacity), bailout);
 
   // Calculate the capacity of the new backing store.
   Node* new_capacity = CalculateNewElementsCapacity(
-      IntPtrOrSmiAdd(key, IntPtrOrSmiConstant(1, mode), mode), mode);
+      IntPtrOrSmiAdd(key, IntPtrOrSmiConstant<TIndex>(1)));
+
+  ParameterMode mode =
+      std::is_same<TIndex, Smi>::value ? SMI_PARAMETERS : INTPTR_PARAMETERS;
   return GrowElementsCapacity(object, elements, kind, kind, capacity,
                               new_capacity, mode, bailout);
 }
@@ -5235,6 +5069,22 @@ void CodeStubAssembler::TaggedToWord32OrBigIntImpl(
   }
 }
 
+TNode<Int32T> CodeStubAssembler::TruncateNumberToWord32(TNode<Number> number) {
+  TVARIABLE(Int32T, var_result);
+  Label done(this), if_heapnumber(this);
+  GotoIfNot(TaggedIsSmi(number), &if_heapnumber);
+  var_result = SmiToInt32(CAST(number));
+  Goto(&done);
+
+  BIND(&if_heapnumber);
+  TNode<Float64T> value = LoadHeapNumberValue(CAST(number));
+  var_result = Signed(TruncateFloat64ToWord32(value));
+  Goto(&done);
+
+  BIND(&done);
+  return var_result.value();
+}
+
 TNode<Int32T> CodeStubAssembler::TruncateHeapNumberValueToWord32(
     TNode<HeapNumber> object) {
   TNode<Float64T> value = LoadHeapNumberValue(object);
@@ -5248,6 +5098,38 @@ void CodeStubAssembler::TryHeapNumberToSmi(TNode<HeapNumber> number,
   TryFloat64ToSmi(value, var_result_smi, if_smi);
 }
 
+void CodeStubAssembler::TryFloat32ToSmi(TNode<Float32T> value,
+                                        TVariable<Smi>* var_result_smi,
+                                        Label* if_smi) {
+  TNode<Int32T> ivalue = TruncateFloat32ToInt32(value);
+  TNode<Float32T> fvalue = RoundInt32ToFloat32(ivalue);
+
+  Label if_int32(this), if_heap_number(this);
+
+  GotoIfNot(Float32Equal(value, fvalue), &if_heap_number);
+  GotoIfNot(Word32Equal(ivalue, Int32Constant(0)), &if_int32);
+  Branch(Int32LessThan(UncheckedCast<Int32T>(BitcastFloat32ToInt32(value)),
+                       Int32Constant(0)),
+         &if_heap_number, &if_int32);
+
+  TVARIABLE(Number, var_result);
+  BIND(&if_int32);
+  {
+    if (SmiValuesAre32Bits()) {
+      *var_result_smi = SmiTag(ChangeInt32ToIntPtr(ivalue));
+    } else {
+      DCHECK(SmiValuesAre31Bits());
+      TNode<PairT<Int32T, BoolT>> pair = Int32AddWithOverflow(ivalue, ivalue);
+      TNode<BoolT> overflow = Projection<1>(pair);
+      GotoIf(overflow, &if_heap_number);
+      *var_result_smi =
+          BitcastWordToTaggedSigned(ChangeInt32ToIntPtr(Projection<0>(pair)));
+    }
+    Goto(if_smi);
+  }
+  BIND(&if_heap_number);
+}
+
 void CodeStubAssembler::TryFloat64ToSmi(TNode<Float64T> value,
                                         TVariable<Smi>* var_result_smi,
                                         Label* if_smi) {
@@ -5280,6 +5162,24 @@ void CodeStubAssembler::TryFloat64ToSmi(TNode<Float64T> value,
   BIND(&if_heap_number);
 }
 
+TNode<Number> CodeStubAssembler::ChangeFloat32ToTagged(TNode<Float32T> value) {
+  Label if_smi(this), done(this);
+  TVARIABLE(Smi, var_smi_result);
+  TVARIABLE(Number, var_result);
+  TryFloat32ToSmi(value, &var_smi_result, &if_smi);
+
+  var_result = AllocateHeapNumberWithValue(ChangeFloat32ToFloat64(value));
+  Goto(&done);
+
+  BIND(&if_smi);
+  {
+    var_result = var_smi_result.value();
+    Goto(&done);
+  }
+  BIND(&done);
+  return var_result.value();
+}
+
 TNode<Number> CodeStubAssembler::ChangeFloat64ToTagged(
     SloppyTNode<Float64T> value) {
   Label if_smi(this), done(this);
@@ -5464,6 +5364,42 @@ TNode<Float64T> CodeStubAssembler::ChangeNumberToFloat64(TNode<Number> value) {
   return result.value();
 }
 
+TNode<Int32T> CodeStubAssembler::ChangeTaggedNonSmiToInt32(
+    TNode<Context> context, TNode<HeapObject> input) {
+  return Select<Int32T>(
+      IsHeapNumber(input),
+      [=] {
+        return Signed(TruncateFloat64ToWord32(LoadHeapNumberValue(input)));
+      },
+      [=] {
+        return TruncateNumberToWord32(
+            CAST(CallBuiltin(Builtins::kNonNumberToNumber, context, input)));
+      });
+}
+
+TNode<Float64T> CodeStubAssembler::ChangeTaggedToFloat64(TNode<Context> context,
+                                                         TNode<Object> input) {
+  TVARIABLE(Float64T, var_result);
+  Label end(this), not_smi(this);
+
+  GotoIfNot(TaggedIsSmi(input), &not_smi);
+  var_result = SmiToFloat64(CAST(input));
+  Goto(&end);
+
+  BIND(&not_smi);
+  var_result = Select<Float64T>(
+      IsHeapNumber(CAST(input)),
+      [=] { return LoadHeapNumberValue(CAST(input)); },
+      [=] {
+        return ChangeNumberToFloat64(
+            CAST(CallBuiltin(Builtins::kNonNumberToNumber, context, input)));
+      });
+  Goto(&end);
+
+  BIND(&end);
+  return var_result.value();
+}
+
 TNode<WordT> CodeStubAssembler::TimesSystemPointerSize(
     SloppyTNode<WordT> value) {
   return WordShl(value, kSystemPointerSizeLog2);
@@ -5759,12 +5695,10 @@ TNode<BoolT> CodeStubAssembler::IsTypedArraySpeciesProtectorCellInvalid() {
   return TaggedEqual(cell_value, invalid);
 }
 
-TNode<BoolT> CodeStubAssembler::IsRegExpSpeciesProtectorCellInvalid(
-    TNode<NativeContext> native_context) {
-  TNode<PropertyCell> cell = CAST(LoadContextElement(
-      native_context, Context::REGEXP_SPECIES_PROTECTOR_INDEX));
-  TNode<Object> cell_value = LoadObjectField(cell, PropertyCell::kValueOffset);
+TNode<BoolT> CodeStubAssembler::IsRegExpSpeciesProtectorCellInvalid() {
   TNode<Smi> invalid = SmiConstant(Protectors::kProtectorInvalid);
+  TNode<PropertyCell> cell = RegExpSpeciesProtectorConstant();
+  TNode<Object> cell_value = LoadObjectField(cell, PropertyCell::kValueOffset);
   return TaggedEqual(cell_value, invalid);
 }
 
@@ -5988,6 +5922,16 @@ TNode<BoolT> CodeStubAssembler::IsJSObject(SloppyTNode<HeapObject> object) {
   return IsJSObjectMap(LoadMap(object));
 }
 
+TNode<BoolT> CodeStubAssembler::IsJSFinalizationRegistryMap(TNode<Map> map) {
+  return InstanceTypeEqual(LoadMapInstanceType(map),
+                           JS_FINALIZATION_REGISTRY_TYPE);
+}
+
+TNode<BoolT> CodeStubAssembler::IsJSFinalizationRegistry(
+    TNode<HeapObject> object) {
+  return IsJSFinalizationRegistryMap(LoadMap(object));
+}
+
 TNode<BoolT> CodeStubAssembler::IsJSPromiseMap(SloppyTNode<Map> map) {
   CSA_ASSERT(this, IsMap(map));
   return InstanceTypeEqual(LoadMapInstanceType(map), JS_PROMISE_TYPE);
@@ -6746,12 +6690,13 @@ TNode<RawPtrT> ToDirectStringAssembler::TryToSequential(
   {
     STATIC_ASSERT(SeqOneByteString::kHeaderSize ==
                   SeqTwoByteString::kHeaderSize);
-    TNode<IntPtrT> result = BitcastTaggedToWord(var_string_.value());
+    TNode<RawPtrT> result =
+        ReinterpretCast<RawPtrT>(BitcastTaggedToWord(var_string_.value()));
     if (ptr_kind == PTR_TO_DATA) {
-      result = IntPtrAdd(result, IntPtrConstant(SeqOneByteString::kHeaderSize -
+      result = RawPtrAdd(result, IntPtrConstant(SeqOneByteString::kHeaderSize -
                                                 kHeapObjectTag));
     }
-    var_result = ReinterpretCast<RawPtrT>(result);
+    var_result = result;
     Goto(&out);
   }
 
@@ -6761,13 +6706,13 @@ TNode<RawPtrT> ToDirectStringAssembler::TryToSequential(
            if_bailout);
 
     TNode<String> string = var_string_.value();
-    TNode<IntPtrT> result =
-        LoadObjectField<IntPtrT>(string, ExternalString::kResourceDataOffset);
+    TNode<RawPtrT> result =
+        DecodeExternalPointer(LoadExternalStringResourceData(CAST(string)));
     if (ptr_kind == PTR_TO_STRING) {
-      result = IntPtrSub(result, IntPtrConstant(SeqOneByteString::kHeaderSize -
+      result = RawPtrSub(result, IntPtrConstant(SeqOneByteString::kHeaderSize -
                                                 kHeapObjectTag));
     }
-    var_result = ReinterpretCast<RawPtrT>(result);
+    var_result = result;
     Goto(&out);
   }
 
@@ -6866,13 +6811,13 @@ TNode<String> CodeStubAssembler::NumberToString(TNode<Number> input,
     TNode<Word32T> hash = Word32And(SmiToInt32(smi_input.value()), mask);
     TNode<IntPtrT> entry_index =
         Signed(ChangeUint32ToWord(Int32Add(hash, hash)));
-    TNode<Object> smi_key = UnsafeLoadFixedArrayElement(
-        number_string_cache, entry_index, 0, INTPTR_PARAMETERS);
+    TNode<Object> smi_key =
+        UnsafeLoadFixedArrayElement(number_string_cache, entry_index);
     GotoIf(TaggedNotEqual(smi_key, smi_input.value()), bailout);
 
     // Smi match, return value from cache entry.
     result = CAST(UnsafeLoadFixedArrayElement(number_string_cache, entry_index,
-                                              kTaggedSize, INTPTR_PARAMETERS));
+                                              kTaggedSize));
     Goto(&done);
   }
   BIND(&done);
@@ -6889,8 +6834,8 @@ TNode<String> CodeStubAssembler::NumberToString(TNode<Number> input) {
   BIND(&runtime);
   {
     // No cache entry, go to the runtime.
-    result =
-        CAST(CallRuntime(Runtime::kNumberToString, NoContextConstant(), input));
+    result = CAST(
+        CallRuntime(Runtime::kNumberToStringSlow, NoContextConstant(), input));
     Goto(&done);
   }
   BIND(&done);
@@ -7319,6 +7264,12 @@ TNode<Number> CodeStubAssembler::ToLength_Inline(SloppyTNode<Context> context,
       [=] { return CAST(CallBuiltin(Builtins::kToLength, context, input)); });
 }
 
+TNode<Object> CodeStubAssembler::OrdinaryToPrimitive(
+    TNode<Context> context, TNode<Object> input, OrdinaryToPrimitiveHint hint) {
+  Callable callable = CodeFactory::OrdinaryToPrimitive(isolate(), hint);
+  return CallStub(callable, context, input);
+}
+
 TNode<Uint32T> CodeStubAssembler::DecodeWord32(SloppyTNode<Word32T> word32,
                                                uint32_t shift, uint32_t mask) {
   DCHECK_EQ((mask >> shift) << shift, mask);
@@ -7327,7 +7278,7 @@ TNode<Uint32T> CodeStubAssembler::DecodeWord32(SloppyTNode<Word32T> word32,
 }
 
 TNode<UintPtrT> CodeStubAssembler::DecodeWord(SloppyTNode<WordT> word,
-                                              uint32_t shift, uint32_t mask) {
+                                              uint32_t shift, uintptr_t mask) {
   DCHECK_EQ((mask >> shift) << shift, mask);
   return Unsigned(WordAnd(WordShr(word, static_cast<int>(shift)),
                           IntPtrConstant(mask >> shift)));
@@ -7335,25 +7286,39 @@ TNode<UintPtrT> CodeStubAssembler::DecodeWord(SloppyTNode<WordT> word,
 
 TNode<Word32T> CodeStubAssembler::UpdateWord32(TNode<Word32T> word,
                                                TNode<Uint32T> value,
-                                               uint32_t shift, uint32_t mask) {
+                                               uint32_t shift, uint32_t mask,
+                                               bool starts_as_zero) {
   DCHECK_EQ((mask >> shift) << shift, mask);
   // Ensure the {value} fits fully in the mask.
   CSA_ASSERT(this, Uint32LessThanOrEqual(value, Uint32Constant(mask >> shift)));
   TNode<Word32T> encoded_value = Word32Shl(value, Int32Constant(shift));
-  TNode<Word32T> inverted_mask = Int32Constant(~mask);
-  return Word32Or(Word32And(word, inverted_mask), encoded_value);
+  TNode<Word32T> masked_word;
+  if (starts_as_zero) {
+    CSA_ASSERT(this, Word32Equal(Word32And(word, Int32Constant(~mask)), word));
+    masked_word = word;
+  } else {
+    masked_word = Word32And(word, Int32Constant(~mask));
+  }
+  return Word32Or(masked_word, encoded_value);
 }
 
 TNode<WordT> CodeStubAssembler::UpdateWord(TNode<WordT> word,
                                            TNode<UintPtrT> value,
-                                           uint32_t shift, uint32_t mask) {
+                                           uint32_t shift, uintptr_t mask,
+                                           bool starts_as_zero) {
   DCHECK_EQ((mask >> shift) << shift, mask);
   // Ensure the {value} fits fully in the mask.
   CSA_ASSERT(this,
              UintPtrLessThanOrEqual(value, UintPtrConstant(mask >> shift)));
   TNode<WordT> encoded_value = WordShl(value, static_cast<int>(shift));
-  TNode<IntPtrT> inverted_mask = IntPtrConstant(~static_cast<intptr_t>(mask));
-  return WordOr(WordAnd(word, inverted_mask), encoded_value);
+  TNode<WordT> masked_word;
+  if (starts_as_zero) {
+    CSA_ASSERT(this, WordEqual(WordAnd(word, UintPtrConstant(~mask)), word));
+    masked_word = word;
+  } else {
+    masked_word = WordAnd(word, UintPtrConstant(~mask));
+  }
+  return WordOr(masked_word, encoded_value);
 }
 
 void CodeStubAssembler::SetCounter(StatsCounter* counter, int value) {
@@ -8430,16 +8395,6 @@ void CodeStubAssembler::Lookup(TNode<Name> unique_name, TNode<Array> array,
   }
 }
 
-TNode<BoolT> CodeStubAssembler::IsSimpleObjectMap(TNode<Map> map) {
-  uint32_t mask = Map::Bits1::HasNamedInterceptorBit::kMask |
-                  Map::Bits1::IsAccessCheckNeededBit::kMask;
-  // !IsSpecialReceiverType && !IsNamedInterceptor && !IsAccessCheckNeeded
-  return Select<BoolT>(
-      IsSpecialReceiverInstanceType(LoadMapInstanceType(map)),
-      [=] { return Int32FalseConstant(); },
-      [=] { return IsClearWord32(LoadMapBitField(map), mask); });
-}
-
 void CodeStubAssembler::TryLookupPropertyInSimpleObject(
     TNode<JSObject> object, TNode<Map> map, TNode<Name> unique_name,
     Label* if_found_fast, Label* if_found_dict,
@@ -10017,9 +9972,8 @@ Node* CodeStubAssembler::CheckForCapacityGrow(
     GotoIf(UintPtrLessThan(key, current_capacity), &fits_capacity);
 
     {
-      Node* new_elements =
-          TryGrowElementsCapacity(object, elements, kind, key, current_capacity,
-                                  INTPTR_PARAMETERS, &grow_bailout);
+      Node* new_elements = TryGrowElementsCapacity(
+          object, elements, kind, key, current_capacity, &grow_bailout);
       checked_elements.Bind(new_elements);
       Goto(&fits_capacity);
     }
@@ -10324,10 +10278,10 @@ template TNode<UintPtrT> CodeStubAssembler::BuildFastLoop<UintPtrT>(
     TNode<UintPtrT> end_index, const FastLoopBody<UintPtrT>& body,
     int increment, IndexAdvanceMode advance_mode);
 
-void CodeStubAssembler::BuildFastFixedArrayForEach(
+void CodeStubAssembler::BuildFastArrayForEach(
     const CodeStubAssembler::VariableList& vars, Node* fixed_array,
     ElementsKind kind, Node* first_element_inclusive,
-    Node* last_element_exclusive, const FastFixedArrayForEachBody& body,
+    Node* last_element_exclusive, const FastArrayForEachBody& body,
     ParameterMode mode, ForEachDirection direction) {
   STATIC_ASSERT(FixedArray::kHeaderSize == FixedDoubleArray::kHeaderSize);
   CSA_SLOW_ASSERT(this, MatchesParameterMode(first_element_inclusive, mode));
@@ -10347,14 +10301,14 @@ void CodeStubAssembler::BuildFastFixedArrayForEach(
           TNode<IntPtrT> index = IntPtrConstant(i);
           TNode<IntPtrT> offset = ElementOffsetFromIndex(
               index, kind, FixedArray::kHeaderSize - kHeapObjectTag);
-          body(fixed_array, offset);
+          body(CAST(fixed_array), offset);
         }
       } else {
         for (int i = last_val - 1; i >= first_val; --i) {
           TNode<IntPtrT> index = IntPtrConstant(i);
           TNode<IntPtrT> offset = ElementOffsetFromIndex(
               index, kind, FixedArray::kHeaderSize - kHeapObjectTag);
-          body(fixed_array, offset);
+          body(CAST(fixed_array), offset);
         }
       }
       return;
@@ -10372,7 +10326,7 @@ void CodeStubAssembler::BuildFastFixedArrayForEach(
   int increment = IsDoubleElementsKind(kind) ? kDoubleSize : kTaggedSize;
   BuildFastLoop<IntPtrT>(
       vars, start, limit,
-      [&](TNode<IntPtrT> offset) { body(fixed_array, offset); },
+      [&](TNode<IntPtrT> offset) { body(CAST(fixed_array), offset); },
       direction == ForEachDirection::kReverse ? -increment : increment,
       direction == ForEachDirection::kReverse ? IndexAdvanceMode::kPre
                                               : IndexAdvanceMode::kPost);
@@ -11021,7 +10975,7 @@ void CodeStubAssembler::GenerateEqual_Same(SloppyTNode<Object> value,
 
       BIND(&if_boolean);
       {
-        CombineFeedback(var_type_feedback, CompareOperationFeedback::kAny);
+        CombineFeedback(var_type_feedback, CompareOperationFeedback::kBoolean);
         Goto(if_equal);
       }
 
@@ -11103,60 +11057,75 @@ TNode<Oddball> CodeStubAssembler::Equal(SloppyTNode<Object> left,
     BIND(&if_left_smi);
     {
       Label if_right_smi(this), if_right_not_smi(this);
+      CombineFeedback(var_type_feedback,
+                      CompareOperationFeedback::kSignedSmall);
       Branch(TaggedIsSmi(right), &if_right_smi, &if_right_not_smi);
 
       BIND(&if_right_smi);
       {
         // We have already checked for {left} and {right} being the same value,
         // so when we get here they must be different Smis.
-        CombineFeedback(var_type_feedback,
-                        CompareOperationFeedback::kSignedSmall);
         Goto(&if_notequal);
       }
 
       BIND(&if_right_not_smi);
-      TNode<Map> right_map = LoadMap(CAST(right));
-      Label if_right_heapnumber(this), if_right_boolean(this),
-          if_right_bigint(this, Label::kDeferred),
-          if_right_receiver(this, Label::kDeferred);
-      GotoIf(IsHeapNumberMap(right_map), &if_right_heapnumber);
-      // {left} is Smi and {right} is not HeapNumber or Smi.
-      if (var_type_feedback != nullptr) {
-        *var_type_feedback = SmiConstant(CompareOperationFeedback::kAny);
-      }
-      GotoIf(IsBooleanMap(right_map), &if_right_boolean);
-      TNode<Uint16T> right_type = LoadMapInstanceType(right_map);
-      GotoIf(IsStringInstanceType(right_type), &do_right_stringtonumber);
-      GotoIf(IsBigIntInstanceType(right_type), &if_right_bigint);
-      Branch(IsJSReceiverInstanceType(right_type), &if_right_receiver,
-             &if_notequal);
-
-      BIND(&if_right_heapnumber);
       {
-        var_left_float = SmiToFloat64(CAST(left));
-        var_right_float = LoadHeapNumberValue(CAST(right));
-        CombineFeedback(var_type_feedback, CompareOperationFeedback::kNumber);
-        Goto(&do_float_comparison);
-      }
+        TNode<Map> right_map = LoadMap(CAST(right));
+        Label if_right_heapnumber(this), if_right_boolean(this),
+            if_right_oddball(this), if_right_bigint(this, Label::kDeferred),
+            if_right_receiver(this, Label::kDeferred);
+        GotoIf(IsHeapNumberMap(right_map), &if_right_heapnumber);
 
-      BIND(&if_right_boolean);
-      {
-        var_right = LoadObjectField(CAST(right), Oddball::kToNumberOffset);
-        Goto(&loop);
-      }
+        // {left} is Smi and {right} is not HeapNumber or Smi.
+        TNode<Uint16T> right_type = LoadMapInstanceType(right_map);
+        GotoIf(IsStringInstanceType(right_type), &do_right_stringtonumber);
+        GotoIf(IsOddballInstanceType(right_type), &if_right_oddball);
+        GotoIf(IsBigIntInstanceType(right_type), &if_right_bigint);
+        GotoIf(IsJSReceiverInstanceType(right_type), &if_right_receiver);
+        CombineFeedback(var_type_feedback, CompareOperationFeedback::kAny);
+        Goto(&if_notequal);
 
-      BIND(&if_right_bigint);
-      {
-        result = CAST(CallRuntime(Runtime::kBigIntEqualToNumber,
-                                  NoContextConstant(), right, left));
-        Goto(&end);
-      }
+        BIND(&if_right_heapnumber);
+        {
+          CombineFeedback(var_type_feedback, CompareOperationFeedback::kNumber);
+          var_left_float = SmiToFloat64(CAST(left));
+          var_right_float = LoadHeapNumberValue(CAST(right));
+          Goto(&do_float_comparison);
+        }
 
-      BIND(&if_right_receiver);
-      {
-        Callable callable = CodeFactory::NonPrimitiveToPrimitive(isolate());
-        var_right = CallStub(callable, context, right);
-        Goto(&loop);
+        BIND(&if_right_oddball);
+        {
+          Label if_right_boolean(this);
+          GotoIf(IsBooleanMap(right_map), &if_right_boolean);
+          CombineFeedback(var_type_feedback,
+                          CompareOperationFeedback::kOddball);
+          Goto(&if_notequal);
+
+          BIND(&if_right_boolean);
+          {
+            CombineFeedback(var_type_feedback,
+                            CompareOperationFeedback::kBoolean);
+            var_right = LoadObjectField(CAST(right), Oddball::kToNumberOffset);
+            Goto(&loop);
+          }
+        }
+
+        BIND(&if_right_bigint);
+        {
+          CombineFeedback(var_type_feedback, CompareOperationFeedback::kBigInt);
+          result = CAST(CallRuntime(Runtime::kBigIntEqualToNumber,
+                                    NoContextConstant(), right, left));
+          Goto(&end);
+        }
+
+        BIND(&if_right_receiver);
+        {
+          CombineFeedback(var_type_feedback,
+                          CompareOperationFeedback::kReceiver);
+          Callable callable = CodeFactory::NonPrimitiveToPrimitive(isolate());
+          var_right = CallStub(callable, context, right);
+          Goto(&loop);
+        }
       }
     }
 
@@ -11195,29 +11164,41 @@ TNode<Oddball> CodeStubAssembler::Equal(SloppyTNode<Object> left,
       BIND(&if_left_number);
       {
         Label if_right_not_number(this);
+
+        CombineFeedback(var_type_feedback, CompareOperationFeedback::kNumber);
         GotoIf(Word32NotEqual(left_type, right_type), &if_right_not_number);
 
         var_left_float = LoadHeapNumberValue(CAST(left));
         var_right_float = LoadHeapNumberValue(CAST(right));
-        CombineFeedback(var_type_feedback, CompareOperationFeedback::kNumber);
         Goto(&do_float_comparison);
 
         BIND(&if_right_not_number);
         {
-          Label if_right_boolean(this);
-          if (var_type_feedback != nullptr) {
-            *var_type_feedback = SmiConstant(CompareOperationFeedback::kAny);
-          }
+          Label if_right_oddball(this);
+
           GotoIf(IsStringInstanceType(right_type), &do_right_stringtonumber);
-          GotoIf(IsBooleanMap(right_map), &if_right_boolean);
+          GotoIf(IsOddballInstanceType(right_type), &if_right_oddball);
           GotoIf(IsBigIntInstanceType(right_type), &use_symmetry);
-          Branch(IsJSReceiverInstanceType(right_type), &use_symmetry,
-                 &if_notequal);
+          GotoIf(IsJSReceiverInstanceType(right_type), &use_symmetry);
+          CombineFeedback(var_type_feedback, CompareOperationFeedback::kAny);
+          Goto(&if_notequal);
 
-          BIND(&if_right_boolean);
+          BIND(&if_right_oddball);
           {
-            var_right = LoadObjectField(CAST(right), Oddball::kToNumberOffset);
-            Goto(&loop);
+            Label if_right_boolean(this);
+            GotoIf(IsBooleanMap(right_map), &if_right_boolean);
+            CombineFeedback(var_type_feedback,
+                            CompareOperationFeedback::kOddball);
+            Goto(&if_notequal);
+
+            BIND(&if_right_boolean);
+            {
+              CombineFeedback(var_type_feedback,
+                              CompareOperationFeedback::kBoolean);
+              var_right =
+                  LoadObjectField(CAST(right), Oddball::kToNumberOffset);
+              Goto(&loop);
+            }
           }
         }
       }
@@ -11226,6 +11207,8 @@ TNode<Oddball> CodeStubAssembler::Equal(SloppyTNode<Object> left,
       {
         Label if_right_heapnumber(this), if_right_bigint(this),
             if_right_string(this), if_right_boolean(this);
+        CombineFeedback(var_type_feedback, CompareOperationFeedback::kBigInt);
+
         GotoIf(IsHeapNumberMap(right_map), &if_right_heapnumber);
         GotoIf(IsBigIntInstanceType(right_type), &if_right_bigint);
         GotoIf(IsStringInstanceType(right_type), &if_right_string);
@@ -11235,9 +11218,7 @@ TNode<Oddball> CodeStubAssembler::Equal(SloppyTNode<Object> left,
 
         BIND(&if_right_heapnumber);
         {
-          if (var_type_feedback != nullptr) {
-            *var_type_feedback = SmiConstant(CompareOperationFeedback::kAny);
-          }
+          CombineFeedback(var_type_feedback, CompareOperationFeedback::kNumber);
           result = CAST(CallRuntime(Runtime::kBigIntEqualToNumber,
                                     NoContextConstant(), left, right));
           Goto(&end);
@@ -11245,7 +11226,7 @@ TNode<Oddball> CodeStubAssembler::Equal(SloppyTNode<Object> left,
 
         BIND(&if_right_bigint);
         {
-          CombineFeedback(var_type_feedback, CompareOperationFeedback::kBigInt);
+          // We already have BigInt feedback.
           result = CAST(CallRuntime(Runtime::kBigIntEqualToBigInt,
                                     NoContextConstant(), left, right));
           Goto(&end);
@@ -11253,9 +11234,7 @@ TNode<Oddball> CodeStubAssembler::Equal(SloppyTNode<Object> left,
 
         BIND(&if_right_string);
         {
-          if (var_type_feedback != nullptr) {
-            *var_type_feedback = SmiConstant(CompareOperationFeedback::kAny);
-          }
+          CombineFeedback(var_type_feedback, CompareOperationFeedback::kString);
           result = CAST(CallRuntime(Runtime::kBigIntEqualToString,
                                     NoContextConstant(), left, right));
           Goto(&end);
@@ -11263,9 +11242,8 @@ TNode<Oddball> CodeStubAssembler::Equal(SloppyTNode<Object> left,
 
         BIND(&if_right_boolean);
         {
-          if (var_type_feedback != nullptr) {
-            *var_type_feedback = SmiConstant(CompareOperationFeedback::kAny);
-          }
+          CombineFeedback(var_type_feedback,
+                          CompareOperationFeedback::kBoolean);
           var_right = LoadObjectField(CAST(right), Oddball::kToNumberOffset);
           Goto(&loop);
         }
@@ -11274,35 +11252,60 @@ TNode<Oddball> CodeStubAssembler::Equal(SloppyTNode<Object> left,
       BIND(&if_left_oddball);
       {
         Label if_left_boolean(this), if_left_not_boolean(this);
-        Branch(IsBooleanMap(left_map), &if_left_boolean, &if_left_not_boolean);
+        GotoIf(IsBooleanMap(left_map), &if_left_boolean);
+        if (var_type_feedback != nullptr) {
+          CombineFeedback(var_type_feedback,
+                          CompareOperationFeedback::kNullOrUndefined);
+          GotoIf(IsUndetectableMap(left_map), &if_left_not_boolean);
+        }
+        Goto(&if_left_not_boolean);
 
         BIND(&if_left_not_boolean);
         {
           // {left} is either Null or Undefined. Check if {right} is
           // undetectable (which includes Null and Undefined).
-          Label if_right_undetectable(this), if_right_not_undetectable(this);
-          Branch(IsUndetectableMap(right_map), &if_right_undetectable,
-                 &if_right_not_undetectable);
+          Label if_right_undetectable(this), if_right_number(this),
+              if_right_oddball(this),
+              if_right_not_number_or_oddball_or_undetectable(this);
+          GotoIf(IsUndetectableMap(right_map), &if_right_undetectable);
+          GotoIf(IsHeapNumberInstanceType(right_type), &if_right_number);
+          GotoIf(IsOddballInstanceType(right_type), &if_right_oddball);
+          Goto(&if_right_not_number_or_oddball_or_undetectable);
 
           BIND(&if_right_undetectable);
           {
-            if (var_type_feedback != nullptr) {
-              // If {right} is undetectable, it must be either also
-              // Null or Undefined, or a Receiver (aka document.all).
-              *var_type_feedback = SmiConstant(
-                  CompareOperationFeedback::kReceiverOrNullOrUndefined);
-            }
+            // If {right} is undetectable, it must be either also
+            // Null or Undefined, or a Receiver (aka document.all).
+            CombineFeedback(
+                var_type_feedback,
+                CompareOperationFeedback::kReceiverOrNullOrUndefined);
             Goto(&if_equal);
           }
 
-          BIND(&if_right_not_undetectable);
+          BIND(&if_right_number);
+          {
+            CombineFeedback(var_type_feedback,
+                            CompareOperationFeedback::kNumber);
+            Goto(&if_notequal);
+          }
+
+          BIND(&if_right_oddball);
+          {
+            CombineFeedback(var_type_feedback,
+                            CompareOperationFeedback::kOddball);
+            Goto(&if_notequal);
+          }
+
+          BIND(&if_right_not_number_or_oddball_or_undetectable);
           {
             if (var_type_feedback != nullptr) {
               // Track whether {right} is Null, Undefined or Receiver.
-              *var_type_feedback = SmiConstant(
+              CombineFeedback(
+                  var_type_feedback,
                   CompareOperationFeedback::kReceiverOrNullOrUndefined);
               GotoIf(IsJSReceiverInstanceType(right_type), &if_notequal);
-              *var_type_feedback = SmiConstant(CompareOperationFeedback::kAny);
+              CombineFeedback(var_type_feedback,
+                              CompareOperationFeedback::kAny);
             }
             Goto(&if_notequal);
           }
@@ -11310,9 +11313,8 @@ TNode<Oddball> CodeStubAssembler::Equal(SloppyTNode<Object> left,
 
         BIND(&if_left_boolean);
         {
-          if (var_type_feedback != nullptr) {
-            *var_type_feedback = SmiConstant(CompareOperationFeedback::kAny);
-          }
+          CombineFeedback(var_type_feedback,
+                          CompareOperationFeedback::kBoolean);
 
           // If {right} is a Boolean too, it must be a different Boolean.
           GotoIf(TaggedEqual(right_map, left_map), &if_notequal);
@@ -11395,9 +11397,7 @@ TNode<Oddball> CodeStubAssembler::Equal(SloppyTNode<Object> left,
           {
             // {right} is a Primitive, and neither Null or Undefined;
             // convert {left} to Primitive too.
-            if (var_type_feedback != nullptr) {
-              *var_type_feedback = SmiConstant(CompareOperationFeedback::kAny);
-            }
+            CombineFeedback(var_type_feedback, CompareOperationFeedback::kAny);
             Callable callable = CodeFactory::NonPrimitiveToPrimitive(isolate());
             var_left = CallStub(callable, context, left);
             Goto(&loop);
@@ -11408,6 +11408,12 @@ TNode<Oddball> CodeStubAssembler::Equal(SloppyTNode<Object> left,
 
     BIND(&do_right_stringtonumber);
     {
+      if (var_type_feedback != nullptr) {
+        TNode<Map> right_map = LoadMap(CAST(right));
+        TNode<Uint16T> right_type = LoadMapInstanceType(right_map);
+        CombineFeedback(var_type_feedback,
+                        CollectFeedbackForString(right_type));
+      }
       var_right = CallBuiltin(Builtins::kStringToNumber, context, right);
       Goto(&loop);
     }
@@ -11686,15 +11692,47 @@ TNode<Oddball> CodeStubAssembler::StrictEqual(
 
               BIND(&if_lhsisoddball);
               {
-                STATIC_ASSERT(LAST_PRIMITIVE_HEAP_OBJECT_TYPE == ODDBALL_TYPE);
-                GotoIf(IsBooleanMap(rhs_map), &if_not_equivalent_types);
-                GotoIf(Int32LessThan(rhs_instance_type,
-                                     Int32Constant(ODDBALL_TYPE)),
-                       &if_not_equivalent_types);
-                OverwriteFeedback(
-                    var_type_feedback,
-                    CompareOperationFeedback::kReceiverOrNullOrUndefined);
-                Goto(&if_notequal);
+                Label if_lhsisboolean(this), if_lhsisnotboolean(this);
+                Branch(IsBooleanMap(lhs_map), &if_lhsisboolean,
+                       &if_lhsisnotboolean);
+
+                BIND(&if_lhsisboolean);
+                {
+                  OverwriteFeedback(var_type_feedback,
+                                    CompareOperationFeedback::kNumberOrOddball);
+                  GotoIf(IsBooleanMap(rhs_map), &if_notequal);
+                  Goto(&if_not_equivalent_types);
+                }
+
+                BIND(&if_lhsisnotboolean);
+                {
+                  Label if_rhsisheapnumber(this), if_rhsisnotheapnumber(this);
+
+                  STATIC_ASSERT(LAST_PRIMITIVE_HEAP_OBJECT_TYPE ==
+                                ODDBALL_TYPE);
+                  GotoIf(Int32LessThan(rhs_instance_type,
+                                       Int32Constant(ODDBALL_TYPE)),
+                         &if_not_equivalent_types);
+
+                  Branch(IsHeapNumberMap(rhs_map), &if_rhsisheapnumber,
+                         &if_rhsisnotheapnumber);
+
+                  BIND(&if_rhsisheapnumber);
+                  {
+                    OverwriteFeedback(
+                        var_type_feedback,
+                        CompareOperationFeedback::kNumberOrOddball);
+                    Goto(&if_not_equivalent_types);
+                  }
+
+                  BIND(&if_rhsisnotheapnumber);
+                  {
+                    OverwriteFeedback(
+                        var_type_feedback,
+                        CompareOperationFeedback::kReceiverOrNullOrUndefined);
+                    Goto(&if_notequal);
+                  }
+                }
               }
 
               BIND(&if_lhsissymbol);
@@ -11750,7 +11788,14 @@ TNode<Oddball> CodeStubAssembler::StrictEqual(
         }
 
         BIND(&if_rhsisnotnumber);
-        Goto(&if_not_equivalent_types);
+        {
+          TNode<Uint16T> rhs_instance_type = LoadMapInstanceType(rhs_map);
+          GotoIfNot(IsOddballInstanceType(rhs_instance_type),
+                    &if_not_equivalent_types);
+          OverwriteFeedback(var_type_feedback,
+                            CompareOperationFeedback::kNumberOrOddball);
+          Goto(&if_notequal);
+        }
       }
     }
   }
@@ -12388,28 +12433,6 @@ TNode<Number> CodeStubAssembler::BitwiseOp(TNode<Word32T> left32,
   UNREACHABLE();
 }
 
-// ES #sec-createarrayiterator
-TNode<JSArrayIterator> CodeStubAssembler::CreateArrayIterator(
-    TNode<Context> context, TNode<Object> object, IterationKind kind) {
-  TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<Map> iterator_map = CAST(LoadContextElement(
-      native_context, Context::INITIAL_ARRAY_ITERATOR_MAP_INDEX));
-  TNode<HeapObject> iterator = Allocate(JSArrayIterator::kHeaderSize);
-  StoreMapNoWriteBarrier(iterator, iterator_map);
-  StoreObjectFieldRoot(iterator, JSArrayIterator::kPropertiesOrHashOffset,
-                       RootIndex::kEmptyFixedArray);
-  StoreObjectFieldRoot(iterator, JSArrayIterator::kElementsOffset,
-                       RootIndex::kEmptyFixedArray);
-  StoreObjectFieldNoWriteBarrier(
-      iterator, JSArrayIterator::kIteratedObjectOffset, object);
-  StoreObjectFieldNoWriteBarrier(iterator, JSArrayIterator::kNextIndexOffset,
-                                 SmiConstant(0));
-  StoreObjectFieldNoWriteBarrier(
-      iterator, JSArrayIterator::kKindOffset,
-      SmiConstant(Smi::FromInt(static_cast<int>(kind))));
-  return CAST(iterator);
-}
-
 TNode<JSObject> CodeStubAssembler::AllocateJSIteratorResult(
     SloppyTNode<Context> context, SloppyTNode<Object> value,
     SloppyTNode<Oddball> done) {
@@ -12487,15 +12510,9 @@ void CodeStubAssembler::ThrowIfArrayBufferViewBufferIsDetached(
   ThrowIfArrayBufferIsDetached(context, buffer, method_name);
 }
 
-TNode<Uint32T> CodeStubAssembler::LoadJSArrayBufferBitField(
-    TNode<JSArrayBuffer> array_buffer) {
-  return LoadObjectField<Uint32T>(array_buffer, JSArrayBuffer::kBitFieldOffset);
-}
-
-TNode<RawPtrT> CodeStubAssembler::LoadJSArrayBufferBackingStore(
+TNode<RawPtrT> CodeStubAssembler::LoadJSArrayBufferBackingStorePtr(
     TNode<JSArrayBuffer> array_buffer) {
-  return LoadObjectField<RawPtrT>(array_buffer,
-                                  JSArrayBuffer::kBackingStoreOffset);
+  return DecodeExternalPointer(LoadJSArrayBufferBackingStore(array_buffer));
 }
 
 TNode<JSArrayBuffer> CodeStubAssembler::LoadJSArrayBufferViewBuffer(
@@ -12522,10 +12539,8 @@ TNode<UintPtrT> CodeStubAssembler::LoadJSTypedArrayLength(
 }
 
 CodeStubArguments::CodeStubArguments(CodeStubAssembler* assembler,
-                                     TNode<IntPtrT> argc, TNode<RawPtrT> fp,
-                                     ReceiverMode receiver_mode)
+                                     TNode<IntPtrT> argc, TNode<RawPtrT> fp)
     : assembler_(assembler),
-      receiver_mode_(receiver_mode),
       argc_(argc),
       base_(),
       fp_(fp != nullptr ? fp : assembler_->LoadFramePointer()) {
@@ -12545,7 +12560,6 @@ CodeStubArguments::CodeStubArguments(CodeStubAssembler* assembler,
 }
 
 TNode<Object> CodeStubArguments::GetReceiver() const {
-  DCHECK_EQ(receiver_mode_, ReceiverMode::kHasReceiver);
 #ifdef V8_REVERSE_JSARGS
   intptr_t offset = -kSystemPointerSize;
 #else
@@ -12555,7 +12569,6 @@ TNode<Object> CodeStubArguments::GetReceiver() const {
 }
 
 void CodeStubArguments::SetReceiver(TNode<Object> object) const {
-  DCHECK_EQ(receiver_mode_, ReceiverMode::kHasReceiver);
 #ifdef V8_REVERSE_JSARGS
   intptr_t offset = -kSystemPointerSize;
 #else
@@ -12588,26 +12601,6 @@ TNode<Object> CodeStubArguments::AtIndex(int index) const {
   return AtIndex(assembler_->IntPtrConstant(index));
 }
 
-TNode<Object> CodeStubArguments::GetOptionalArgumentValue(
-    int index, TNode<Object> default_value) {
-  CodeStubAssembler::TVariable<Object> result(assembler_);
-  CodeStubAssembler::Label argument_missing(assembler_),
-      argument_done(assembler_, &result);
-
-  assembler_->GotoIf(assembler_->UintPtrGreaterThanOrEqual(
-                         assembler_->IntPtrConstant(index), argc_),
-                     &argument_missing);
-  result = AtIndex(index);
-  assembler_->Goto(&argument_done);
-
-  assembler_->BIND(&argument_missing);
-  result = default_value;
-  assembler_->Goto(&argument_done);
-
-  assembler_->BIND(&argument_done);
-  return result.value();
-}
-
 TNode<Object> CodeStubArguments::GetOptionalArgumentValue(
     TNode<IntPtrT> index, TNode<Object> default_value) {
   CodeStubAssembler::TVariable<Object> result(assembler_);
@@ -12655,13 +12648,8 @@ void CodeStubArguments::ForEach(
 }
 
 void CodeStubArguments::PopAndReturn(TNode<Object> value) {
-  TNode<IntPtrT> pop_count;
-  if (receiver_mode_ == ReceiverMode::kHasReceiver) {
-    pop_count = assembler_->IntPtrAdd(argc_, assembler_->IntPtrConstant(1));
-  } else {
-    pop_count = argc_;
-  }
-
+  TNode<IntPtrT> pop_count =
+      assembler_->IntPtrAdd(argc_, assembler_->IntPtrConstant(1));
   assembler_->PopAndReturn(pop_count, value);
 }
 
@@ -12672,6 +12660,18 @@ TNode<BoolT> CodeStubAssembler::IsFastElementsKind(
                                Int32Constant(LAST_FAST_ELEMENTS_KIND));
 }
 
+TNode<BoolT> CodeStubAssembler::IsFastOrNonExtensibleOrSealedElementsKind(
+    TNode<Int32T> elements_kind) {
+  STATIC_ASSERT(FIRST_ELEMENTS_KIND == FIRST_FAST_ELEMENTS_KIND);
+  STATIC_ASSERT(LAST_FAST_ELEMENTS_KIND + 1 == PACKED_NONEXTENSIBLE_ELEMENTS);
+  STATIC_ASSERT(PACKED_NONEXTENSIBLE_ELEMENTS + 1 ==
+                HOLEY_NONEXTENSIBLE_ELEMENTS);
+  STATIC_ASSERT(HOLEY_NONEXTENSIBLE_ELEMENTS + 1 == PACKED_SEALED_ELEMENTS);
+  STATIC_ASSERT(PACKED_SEALED_ELEMENTS + 1 == HOLEY_SEALED_ELEMENTS);
+  return Uint32LessThanOrEqual(elements_kind,
+                               Int32Constant(HOLEY_SEALED_ELEMENTS));
+}
+
 TNode<BoolT> CodeStubAssembler::IsDoubleElementsKind(
     TNode<Int32T> elements_kind) {
   STATIC_ASSERT(FIRST_ELEMENTS_KIND == FIRST_FAST_ELEMENTS_KIND);
@@ -13087,17 +13087,9 @@ TNode<Object> CodeStubAssembler::CallApiCallback(
     TNode<Object> context, TNode<RawPtrT> callback, TNode<IntPtrT> argc,
     TNode<Object> data, TNode<Object> holder, TNode<Object> receiver,
     TNode<Object> value) {
-  // CallApiCallback receives the first four arguments in registers
-  // (callback, argc, data and holder). The last arguments are in the stack in
-  // JS ordering. See ApiCallbackDescriptor.
   Callable callable = CodeFactory::CallApiCallback(isolate());
-#ifdef V8_REVERSE_JSARGS
-  return CallStub(callable, context, callback, argc, data, holder, value,
-                  receiver);
-#else
   return CallStub(callable, context, callback, argc, data, holder, receiver,
                   value);
-#endif
 }
 
 TNode<Object> CodeStubAssembler::CallRuntimeNewArray(
@@ -13240,6 +13232,21 @@ TNode<String> CodeStubAssembler::TaggedToDirectString(TNode<Object> value,
   return CAST(value);
 }
 
+void CodeStubAssembler::RemoveFinalizationRegistryCellFromUnregisterTokenMap(
+    TNode<JSFinalizationRegistry> finalization_registry,
+    TNode<WeakCell> weak_cell) {
+  const TNode<ExternalReference> remove_cell = ExternalConstant(
+      ExternalReference::
+          js_finalization_registry_remove_cell_from_unregister_token_map());
+  const TNode<ExternalReference> isolate_ptr =
+      ExternalConstant(ExternalReference::isolate_address(isolate()));
+
+  CallCFunction(remove_cell, MachineType::Pointer(),
+                std::make_pair(MachineType::Pointer(), isolate_ptr),
+                std::make_pair(MachineType::AnyTagged(), finalization_registry),
+                std::make_pair(MachineType::AnyTagged(), weak_cell));
+}
+
 PrototypeCheckAssembler::PrototypeCheckAssembler(
     compiler::CodeAssemblerState* state, Flags flags,
     TNode<NativeContext> native_context, TNode<Map> initial_prototype_map,
diff --git a/deps/v8/src/codegen/code-stub-assembler.h b/deps/v8/src/codegen/code-stub-assembler.h
index 618481ff47a..592af14c41a 100644
--- a/deps/v8/src/codegen/code-stub-assembler.h
+++ b/deps/v8/src/codegen/code-stub-assembler.h
@@ -9,6 +9,7 @@
 
 #include "src/base/macros.h"
 #include "src/codegen/bailout-reason.h"
+#include "src/common/external-pointer.h"
 #include "src/common/globals.h"
 #include "src/common/message-template.h"
 #include "src/compiler/code-assembler.h"
@@ -20,7 +21,6 @@
 #include "src/objects/smi.h"
 #include "src/objects/tagged-index.h"
 #include "src/roots/roots.h"
-
 #include "torque-generated/exported-macros-assembler-tq.h"
 
 namespace v8 {
@@ -34,28 +34,79 @@ class StubCache;
 
 enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
 
-#define HEAP_MUTABLE_IMMOVABLE_OBJECT_LIST(V)                                 \
-  V(ArrayIteratorProtector, array_iterator_protector, ArrayIteratorProtector) \
-  V(ArraySpeciesProtector, array_species_protector, ArraySpeciesProtector)    \
-  V(MapIteratorProtector, map_iterator_protector, MapIteratorProtector)       \
-  V(NoElementsProtector, no_elements_protector, NoElementsProtector)          \
-  V(NumberStringCache, number_string_cache, NumberStringCache)                \
-  V(PromiseResolveProtector, promise_resolve_protector,                       \
-    PromiseResolveProtector)                                                  \
-  V(PromiseSpeciesProtector, promise_species_protector,                       \
-    PromiseSpeciesProtector)                                                  \
-  V(PromiseThenProtector, promise_then_protector, PromiseThenProtector)       \
-  V(SetIteratorProtector, set_iterator_protector, SetIteratorProtector)       \
-  V(SingleCharacterStringCache, single_character_string_cache,                \
-    SingleCharacterStringCache)                                               \
-  V(StringIteratorProtector, string_iterator_protector,                       \
-    StringIteratorProtector)                                                  \
-  V(TypedArraySpeciesProtector, typed_array_species_protector,                \
+#define HEAP_MUTABLE_IMMOVABLE_OBJECT_LIST(V)                                  \
+  V(ArrayIteratorProtector, array_iterator_protector, ArrayIteratorProtector)  \
+  V(ArraySpeciesProtector, array_species_protector, ArraySpeciesProtector)     \
+  V(AsyncFunctionAwaitRejectSharedFun, async_function_await_reject_shared_fun, \
+    AsyncFunctionAwaitRejectSharedFun)                                         \
+  V(AsyncFunctionAwaitResolveSharedFun,                                        \
+    async_function_await_resolve_shared_fun,                                   \
+    AsyncFunctionAwaitResolveSharedFun)                                        \
+  V(AsyncGeneratorAwaitRejectSharedFun,                                        \
+    async_generator_await_reject_shared_fun,                                   \
+    AsyncGeneratorAwaitRejectSharedFun)                                        \
+  V(AsyncGeneratorAwaitResolveSharedFun,                                       \
+    async_generator_await_resolve_shared_fun,                                  \
+    AsyncGeneratorAwaitResolveSharedFun)                                       \
+  V(AsyncGeneratorReturnClosedRejectSharedFun,                                 \
+    async_generator_return_closed_reject_shared_fun,                           \
+    AsyncGeneratorReturnClosedRejectSharedFun)                                 \
+  V(AsyncGeneratorReturnClosedResolveSharedFun,                                \
+    async_generator_return_closed_resolve_shared_fun,                          \
+    AsyncGeneratorReturnClosedResolveSharedFun)                                \
+  V(AsyncGeneratorReturnResolveSharedFun,                                      \
+    async_generator_return_resolve_shared_fun,                                 \
+    AsyncGeneratorReturnResolveSharedFun)                                      \
+  V(AsyncGeneratorYieldResolveSharedFun,                                       \
+    async_generator_yield_resolve_shared_fun,                                  \
+    AsyncGeneratorYieldResolveSharedFun)                                       \
+  V(AsyncIteratorValueUnwrapSharedFun, async_iterator_value_unwrap_shared_fun, \
+    AsyncIteratorValueUnwrapSharedFun)                                         \
+  V(MapIteratorProtector, map_iterator_protector, MapIteratorProtector)        \
+  V(NoElementsProtector, no_elements_protector, NoElementsProtector)           \
+  V(NumberStringCache, number_string_cache, NumberStringCache)                 \
+  V(PromiseAllResolveElementSharedFun, promise_all_resolve_element_shared_fun, \
+    PromiseAllResolveElementSharedFun)                                         \
+  V(PromiseAllSettledRejectElementSharedFun,                                   \
+    promise_all_settled_reject_element_shared_fun,                             \
+    PromiseAllSettledRejectElementSharedFun)                                   \
+  V(PromiseAllSettledResolveElementSharedFun,                                  \
+    promise_all_settled_resolve_element_shared_fun,                            \
+    PromiseAllSettledResolveElementSharedFun)                                  \
+  V(PromiseAnyRejectElementSharedFun, promise_any_reject_element_shared_fun,   \
+    PromiseAnyRejectElementSharedFun)                                          \
+  V(PromiseCapabilityDefaultRejectSharedFun,                                   \
+    promise_capability_default_reject_shared_fun,                              \
+    PromiseCapabilityDefaultRejectSharedFun)                                   \
+  V(PromiseCapabilityDefaultResolveSharedFun,                                  \
+    promise_capability_default_resolve_shared_fun,                             \
+    PromiseCapabilityDefaultResolveSharedFun)                                  \
+  V(PromiseCatchFinallySharedFun, promise_catch_finally_shared_fun,            \
+    PromiseCatchFinallySharedFun)                                              \
+  V(PromiseGetCapabilitiesExecutorSharedFun,                                   \
+    promise_get_capabilities_executor_shared_fun,                              \
+    PromiseGetCapabilitiesExecutorSharedFun)                                   \
+  V(PromiseResolveProtector, promise_resolve_protector,                        \
+    PromiseResolveProtector)                                                   \
+  V(PromiseSpeciesProtector, promise_species_protector,                        \
+    PromiseSpeciesProtector)                                                   \
+  V(PromiseThenFinallySharedFun, promise_then_finally_shared_fun,              \
+    PromiseThenFinallySharedFun)                                               \
+  V(PromiseThenProtector, promise_then_protector, PromiseThenProtector)        \
+  V(PromiseThrowerFinallySharedFun, promise_thrower_finally_shared_fun,        \
+    PromiseThrowerFinallySharedFun)                                            \
+  V(PromiseValueThunkFinallySharedFun, promise_value_thunk_finally_shared_fun, \
+    PromiseValueThunkFinallySharedFun)                                         \
+  V(ProxyRevokeSharedFun, proxy_revoke_shared_fun, ProxyRevokeSharedFun)       \
+  V(RegExpSpeciesProtector, regexp_species_protector, RegExpSpeciesProtector)  \
+  V(SetIteratorProtector, set_iterator_protector, SetIteratorProtector)        \
+  V(SingleCharacterStringCache, single_character_string_cache,                 \
+    SingleCharacterStringCache)                                                \
+  V(StringIteratorProtector, string_iterator_protector,                        \
+    StringIteratorProtector)                                                   \
+  V(TypedArraySpeciesProtector, typed_array_species_protector,                 \
     TypedArraySpeciesProtector)
 
-#define TORQUE_INTERNAL_CLASS_LIST_CSA_ADAPTER(V, NAME, Name, name) \
-  V(Name##Map, name##_map, Name##Map)
-
 #define HEAP_IMMUTABLE_IMMOVABLE_OBJECT_LIST(V)                                \
   V(AccessorInfoMap, accessor_info_map, AccessorInfoMap)                       \
   V(AccessorPairMap, accessor_pair_map, AccessorPairMap)                       \
@@ -86,6 +137,7 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
     EmptySlowElementDictionary)                                                \
   V(empty_string, empty_string, EmptyString)                                   \
   V(error_to_string, error_to_string, ErrorToString)                           \
+  V(errors_string, errors_string, ErrorsString)                                \
   V(FalseValue, false_value, False)                                            \
   V(FeedbackVectorMap, feedback_vector_map, FeedbackVectorMap)                 \
   V(FixedArrayMap, fixed_array_map, FixedArrayMap)                             \
@@ -106,6 +158,7 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
   V(ManyClosuresCellMap, many_closures_cell_map, ManyClosuresCellMap)          \
   V(match_symbol, match_symbol, MatchSymbol)                                   \
   V(megamorphic_symbol, megamorphic_symbol, MegamorphicSymbol)                 \
+  V(message_string, message_string, MessageString)                             \
   V(MetaMap, meta_map, MetaMap)                                                \
   V(minus_Infinity_string, minus_Infinity_string, MinusInfinityString)         \
   V(MinusZeroValue, minus_zero_value, MinusZero)                               \
@@ -116,7 +169,7 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
   V(NoClosuresCellMap, no_closures_cell_map, NoClosuresCellMap)                \
   V(null_to_string, null_to_string, NullToString)                              \
   V(NullValue, null_value, Null)                                               \
-  V(number_string, number_string, numberString)                                \
+  V(number_string, number_string, NumberString)                                \
   V(number_to_string, number_to_string, NumberToString)                        \
   V(Object_string, Object_string, ObjectString)                                \
   V(object_to_string, object_to_string, ObjectToString)                        \
@@ -143,8 +196,6 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
   V(resolve_string, resolve_string, ResolveString)                             \
   V(return_string, return_string, ReturnString)                                \
   V(SharedFunctionInfoMap, shared_function_info_map, SharedFunctionInfoMap)    \
-  V(SloppyArgumentsElementsMap, sloppy_arguments_elements_map,                 \
-    SloppyArgumentsElementsMap)                                                \
   V(SmallOrderedHashSetMap, small_ordered_hash_set_map,                        \
     SmallOrderedHashSetMap)                                                    \
   V(SmallOrderedHashMapMap, small_ordered_hash_map_map,                        \
@@ -160,6 +211,8 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
   V(SymbolMap, symbol_map, SymbolMap)                                          \
   V(TheHoleValue, the_hole_value, TheHole)                                     \
   V(then_string, then_string, ThenString)                                      \
+  V(toString_string, toString_string, ToStringString)                          \
+  V(to_primitive_symbol, to_primitive_symbol, ToPrimitiveSymbol)               \
   V(to_string_tag_symbol, to_string_tag_symbol, ToStringTagSymbol)             \
   V(TransitionArrayMap, transition_array_map, TransitionArrayMap)              \
   V(TrueValue, true_value, True)                                               \
@@ -176,10 +229,10 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
   V(undefined_to_string, undefined_to_string, UndefinedToString)               \
   V(UndefinedValue, undefined_value, Undefined)                                \
   V(uninitialized_symbol, uninitialized_symbol, UninitializedSymbol)           \
+  V(valueOf_string, valueOf_string, ValueOfString)                             \
   V(WeakFixedArrayMap, weak_fixed_array_map, WeakFixedArrayMap)                \
   V(zero_string, zero_string, ZeroString)                                      \
-  TORQUE_INTERNAL_CLASS_LIST_GENERATOR(TORQUE_INTERNAL_CLASS_LIST_CSA_ADAPTER, \
-                                       V)
+  TORQUE_INTERNAL_MAP_CSA_LIST(V)
 
 #define HEAP_IMMOVABLE_OBJECT_LIST(V)   \
   HEAP_MUTABLE_IMMOVABLE_OBJECT_LIST(V) \
@@ -316,15 +369,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
 #endif
   }
 
-  MachineRepresentation ParameterRepresentation(ParameterMode mode) const {
-    return mode == INTPTR_PARAMETERS ? MachineType::PointerRepresentation()
-                                     : MachineRepresentation::kTaggedSigned;
-  }
-
-  MachineRepresentation OptimalParameterRepresentation() const {
-    return ParameterRepresentation(OptimalParameterMode());
-  }
-
   TNode<IntPtrT> ParameterToIntPtr(TNode<Smi> value) { return SmiUntag(value); }
   TNode<IntPtrT> ParameterToIntPtr(TNode<IntPtrT> value) { return value; }
   // TODO(v8:9708): remove once all uses are ported.
@@ -333,24 +377,20 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     return UncheckedCast<IntPtrT>(value);
   }
 
-  template <typename TIndex>
-  TNode<TIndex> IntPtrToParameter(TNode<IntPtrT> value);
+  TNode<Smi> ParameterToTagged(TNode<Smi> value) { return value; }
 
-  Node* IntPtrToParameter(SloppyTNode<IntPtrT> value, ParameterMode mode) {
-    if (mode == SMI_PARAMETERS) return SmiTag(value);
-    return value;
-  }
-
-  Node* Int32ToParameter(SloppyTNode<Int32T> value, ParameterMode mode) {
-    return IntPtrToParameter(ChangeInt32ToIntPtr(value), mode);
-  }
+  TNode<Smi> ParameterToTagged(TNode<IntPtrT> value) { return SmiTag(value); }
 
   TNode<Smi> ParameterToTagged(Node* value, ParameterMode mode) {
     if (mode != SMI_PARAMETERS) return SmiTag(value);
     return UncheckedCast<Smi>(value);
   }
 
-  Node* TaggedToParameter(SloppyTNode<Smi> value, ParameterMode mode) {
+  template <typename TIndex>
+  TNode<TIndex> TaggedToParameter(TNode<Smi> value);
+
+  // TODO(v8:9708): remove once all uses are ported.
+  Node* TaggedToParameter(TNode<Smi> value, ParameterMode mode) {
     if (mode != SMI_PARAMETERS) return SmiUntag(value);
     return value;
   }
@@ -576,7 +616,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     return Word32BinaryNot(TaggedEqual(a, b));
   }
 
-  TNode<Object> NoContextConstant();
+  TNode<Smi> NoContextConstant();
 
 #define HEAP_CONSTANT_ACCESSOR(rootIndexName, rootAccessorName, name)  \
   TNode<std::remove_pointer<std::remove_reference<decltype(            \
@@ -605,11 +645,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // TODO(v8:9708): remove once all uses are ported.
   Node* IntPtrOrSmiConstant(int value, ParameterMode mode);
 
-  bool IsIntPtrOrSmiConstantZero(TNode<Smi> test);
-  bool IsIntPtrOrSmiConstantZero(TNode<IntPtrT> test);
-  // TODO(v8:9708): remove once all uses are ported.
-  bool IsIntPtrOrSmiConstantZero(Node* test, ParameterMode mode);
-
   bool TryGetIntPtrOrSmiConstantValue(Node* maybe_constant, int* value,
                                       ParameterMode mode);
 
@@ -723,15 +758,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     }
   }
 
-  Node* WordOrSmiShl(Node* a, int shift, ParameterMode mode) {
-    if (mode == SMI_PARAMETERS) {
-      return SmiShl(CAST(a), shift);
-    } else {
-      DCHECK_EQ(INTPTR_PARAMETERS, mode);
-      return WordShl(a, shift);
-    }
-  }
-
   Node* WordOrSmiShr(Node* a, int shift, ParameterMode mode) {
     if (mode == SMI_PARAMETERS) {
       return SmiShr(CAST(a), shift);
@@ -1065,6 +1091,31 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // Works only with V8_ENABLE_FORCE_SLOW_PATH compile time flag. Nop otherwise.
   void GotoIfForceSlowPath(Label* if_true);
 
+  // Convert external pointer from on-V8-heap representation to an actual
+  // external pointer value.
+  TNode<RawPtrT> DecodeExternalPointer(
+      TNode<ExternalPointerT> encoded_pointer) {
+    STATIC_ASSERT(kExternalPointerSize == kSystemPointerSize);
+    TNode<RawPtrT> value = ReinterpretCast<RawPtrT>(encoded_pointer);
+    if (V8_HEAP_SANDBOX_BOOL) {
+      value = UncheckedCast<RawPtrT>(
+          WordXor(value, UintPtrConstant(kExternalPointerSalt)));
+    }
+    return value;
+  }
+
+  // Convert external pointer value to on-V8-heap representation.
+  // This should eventually become a call to a non-allocating runtime function.
+  TNode<ExternalPointerT> EncodeExternalPointer(TNode<RawPtrT> pointer) {
+    STATIC_ASSERT(kExternalPointerSize == kSystemPointerSize);
+    TNode<RawPtrT> encoded_pointer = pointer;
+    if (V8_HEAP_SANDBOX_BOOL) {
+      encoded_pointer = UncheckedCast<RawPtrT>(
+          WordXor(encoded_pointer, UintPtrConstant(kExternalPointerSalt)));
+    }
+    return ReinterpretCast<ExternalPointerT>(encoded_pointer);
+  }
+
   // Load value from current parent frame by given offset in bytes.
   TNode<Object> LoadFromParentFrame(int offset);
 
@@ -1358,11 +1409,10 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // This doesn't emit a bounds-check. As part of the security-performance
   // tradeoff, only use it if it is performance critical.
   TNode<Object> UnsafeLoadFixedArrayElement(
-      TNode<FixedArray> object, Node* index, int additional_offset = 0,
-      ParameterMode parameter_mode = INTPTR_PARAMETERS,
+      TNode<FixedArray> object, TNode<IntPtrT> index, int additional_offset = 0,
       LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
     return LoadFixedArrayElement(object, index, additional_offset,
-                                 parameter_mode, needs_poisoning,
+                                 INTPTR_PARAMETERS, needs_poisoning,
                                  CheckBounds::kDebugOnly);
   }
 
@@ -1373,14 +1423,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     return LoadFixedArrayElement(object, index, 0, INTPTR_PARAMETERS,
                                  needs_poisoning, check_bounds);
   }
-  // This doesn't emit a bounds-check. As part of the security-performance
-  // tradeoff, only use it if it is performance critical.
-  TNode<Object> UnsafeLoadFixedArrayElement(TNode<FixedArray> object,
-                                            TNode<IntPtrT> index,
-                                            LoadSensitivity needs_poisoning) {
-    return LoadFixedArrayElement(object, index, needs_poisoning,
-                                 CheckBounds::kDebugOnly);
-  }
 
   TNode<Object> LoadFixedArrayElement(
       TNode<FixedArray> object, TNode<IntPtrT> index, int additional_offset = 0,
@@ -1435,18 +1477,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   }
 
   // Load an array element from a WeakFixedArray.
-  TNode<MaybeObject> LoadWeakFixedArrayElement(
-      TNode<WeakFixedArray> object, Node* index, int additional_offset = 0,
-      ParameterMode parameter_mode = INTPTR_PARAMETERS,
-      LoadSensitivity needs_poisoning = LoadSensitivity::kSafe);
-
-  TNode<MaybeObject> LoadWeakFixedArrayElement(
-      TNode<WeakFixedArray> object, int index, int additional_offset = 0,
-      LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
-    return LoadWeakFixedArrayElement(object, IntPtrConstant(index),
-                                     additional_offset, INTPTR_PARAMETERS,
-                                     needs_poisoning);
-  }
+  TNode<MaybeObject> LoadWeakFixedArrayElement(TNode<WeakFixedArray> object,
+                                               TNode<IntPtrT> index,
+                                               int additional_offset = 0);
 
   // Load an array element from a FixedDoubleArray.
   TNode<Float64T> LoadFixedDoubleArrayElement(
@@ -1766,9 +1799,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<Int32T> EnsureArrayPushable(TNode<Context> context, TNode<Map> map,
                                     Label* bailout);
 
-  void TryStoreArrayElement(ElementsKind kind, ParameterMode mode,
-                            Label* bailout, TNode<FixedArrayBase> elements,
-                            Node* index, TNode<Object> value);
+  void TryStoreArrayElement(ElementsKind kind, Label* bailout,
+                            TNode<FixedArrayBase> elements, TNode<BInt> index,
+                            TNode<Object> value);
   // Consumes args into the array, and returns tagged new length.
   TNode<Smi> BuildAppendJSArray(ElementsKind kind, TNode<JSArray> array,
                                 CodeStubArguments* args,
@@ -1781,6 +1814,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                  TNode<IntPtrT> end_address,
                                  TNode<Object> value);
 
+  // Marks the FixedArray copy-on-write without moving it.
+  void MakeFixedArrayCOW(TNode<FixedArray> array);
+
   TNode<Cell> AllocateCellWithValue(
       TNode<Object> value, WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
   TNode<Cell> AllocateSmiCell(int value = 0) {
@@ -1879,45 +1915,43 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   //
   // Allocate and return a JSArray with initialized header fields and its
   // uninitialized elements.
-  // The ParameterMode argument is only used for the capacity parameter.
   std::pair<TNode<JSArray>, TNode<FixedArrayBase>>
   AllocateUninitializedJSArrayWithElements(
       ElementsKind kind, TNode<Map> array_map, TNode<Smi> length,
-      TNode<AllocationSite> allocation_site, TNode<IntPtrT> capacity,
-      AllocationFlags allocation_flags = kNone,
+      base::Optional<TNode<AllocationSite>> allocation_site,
+      TNode<IntPtrT> capacity, AllocationFlags allocation_flags = kNone,
       int array_header_size = JSArray::kHeaderSize);
 
   // Allocate a JSArray and fill elements with the hole.
-  TNode<JSArray> AllocateJSArray(ElementsKind kind, TNode<Map> array_map,
-                                 TNode<IntPtrT> capacity, TNode<Smi> length,
-                                 TNode<AllocationSite> allocation_site,
-                                 AllocationFlags allocation_flags = kNone);
-  TNode<JSArray> AllocateJSArray(ElementsKind kind, TNode<Map> array_map,
-                                 TNode<Smi> capacity, TNode<Smi> length,
-                                 TNode<AllocationSite> allocation_site,
-                                 AllocationFlags allocation_flags = kNone) {
+  TNode<JSArray> AllocateJSArray(
+      ElementsKind kind, TNode<Map> array_map, TNode<IntPtrT> capacity,
+      TNode<Smi> length, base::Optional<TNode<AllocationSite>> allocation_site,
+      AllocationFlags allocation_flags = kNone);
+  TNode<JSArray> AllocateJSArray(
+      ElementsKind kind, TNode<Map> array_map, TNode<Smi> capacity,
+      TNode<Smi> length, base::Optional<TNode<AllocationSite>> allocation_site,
+      AllocationFlags allocation_flags = kNone) {
     return AllocateJSArray(kind, array_map, SmiUntag(capacity), length,
                            allocation_site, allocation_flags);
   }
   TNode<JSArray> AllocateJSArray(ElementsKind kind, TNode<Map> array_map,
                                  TNode<Smi> capacity, TNode<Smi> length,
                                  AllocationFlags allocation_flags = kNone) {
-    return AllocateJSArray(kind, array_map, SmiUntag(capacity), length, {},
-                           allocation_flags);
+    return AllocateJSArray(kind, array_map, SmiUntag(capacity), length,
+                           base::nullopt, allocation_flags);
   }
   TNode<JSArray> AllocateJSArray(ElementsKind kind, TNode<Map> array_map,
                                  TNode<IntPtrT> capacity, TNode<Smi> length,
                                  AllocationFlags allocation_flags = kNone) {
-    return AllocateJSArray(kind, array_map, capacity, length, {},
+    return AllocateJSArray(kind, array_map, capacity, length, base::nullopt,
                            allocation_flags);
   }
 
   // Allocate a JSArray and initialize the header fields.
-  TNode<JSArray> AllocateJSArray(TNode<Map> array_map,
-                                 TNode<FixedArrayBase> elements,
-                                 TNode<Smi> length,
-                                 TNode<AllocationSite> allocation_site = {},
-                                 int array_header_size = JSArray::kHeaderSize);
+  TNode<JSArray> AllocateJSArray(
+      TNode<Map> array_map, TNode<FixedArrayBase> elements, TNode<Smi> length,
+      base::Optional<TNode<AllocationSite>> allocation_site = base::nullopt,
+      int array_header_size = JSArray::kHeaderSize);
 
   enum class HoleConversionMode { kDontConvert, kConvertToUndefined };
   // Clone a fast JSArray |array| into a new fast JSArray.
@@ -1932,15 +1966,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // function generates significantly less code in this case.
   TNode<JSArray> CloneFastJSArray(
       TNode<Context> context, TNode<JSArray> array,
-      TNode<AllocationSite> allocation_site = {},
+      base::Optional<TNode<AllocationSite>> allocation_site = base::nullopt,
       HoleConversionMode convert_holes = HoleConversionMode::kDontConvert);
 
   TNode<JSArray> ExtractFastJSArray(TNode<Context> context,
-                                    TNode<JSArray> array, Node* begin,
-                                    Node* count,
-                                    ParameterMode mode = INTPTR_PARAMETERS,
-                                    Node* capacity = nullptr,
-                                    TNode<AllocationSite> allocation_site = {});
+                                    TNode<JSArray> array, TNode<BInt> begin,
+                                    TNode<BInt> count);
 
   TNode<FixedArrayBase> AllocateFixedArray(
       ElementsKind kind, Node* capacity, ParameterMode mode = INTPTR_PARAMETERS,
@@ -2011,11 +2042,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
       Node* capacity, ParameterMode mode = INTPTR_PARAMETERS,
       AllocationFlags flags = kNone);
 
-  // Perform CreateArrayIterator (ES #sec-createarrayiterator).
-  TNode<JSArrayIterator> CreateArrayIterator(TNode<Context> context,
-                                             TNode<Object> object,
-                                             IterationKind mode);
-
   // TODO(v8:9722): Return type should be JSIteratorResult
   TNode<JSObject> AllocateJSIteratorResult(SloppyTNode<Context> context,
                                            SloppyTNode<Object> value,
@@ -2047,35 +2073,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
 
   enum class DestroySource { kNo, kYes };
 
-  // Collect the callable |maybe_target| feedback for either a CALL_IC or
-  // an INSTANCEOF_IC in the |feedback_vector| at |slot_id|. There are
-  // two modes for feedback collection:
-  //
-  //   kCollectFeedbackCell -     collect JSFunctions, but devolve to the
-  //                              FeedbackCell as long as all JSFunctions
-  //                              seen share the same one.
-  //   kDontCollectFeedbackCell - collect JSFunctions without devolving
-  //                              to the FeedbackCell in case a
-  //                              different JSFunction appears. Go directly
-  //                              to the Megamorphic sentinel value in this
-  //                              case.
-  enum class CallableFeedbackMode {
-    kCollectFeedbackCell,
-    kDontCollectFeedbackCell
-  };
-  void CollectCallableFeedback(TNode<Object> maybe_target,
-                               TNode<Context> context,
-                               TNode<FeedbackVector> feedback_vector,
-                               TNode<UintPtrT> slot_id,
-                               CallableFeedbackMode mode);
-
-  // Collect CALL_IC feedback for |maybe_target| function in the
-  // |feedback_vector| at |slot_id|, and the call counts in
-  // the |feedback_vector| at |slot_id+1|.
-  void CollectCallFeedback(TNode<Object> maybe_target, TNode<Context> context,
-                           TNode<HeapObject> maybe_feedback_vector,
-                           TNode<UintPtrT> slot_id);
-
   // Increment the call count for a CALL_IC or construct call.
   // The call count is located at feedback_vector[slot_id + 1].
   void IncrementCallCount(TNode<FeedbackVector> feedback_vector,
@@ -2242,20 +2239,32 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
 
   TNode<FixedArrayBase> ExtractFixedArray(
       TNode<FixedArrayBase> source, TNode<Smi> first, TNode<Smi> count,
-      TNode<Smi> capacity,
+      base::Optional<TNode<Smi>> capacity,
       ExtractFixedArrayFlags extract_flags =
-          ExtractFixedArrayFlag::kAllFixedArrays) {
-    return ExtractFixedArray(source, first, count, capacity, extract_flags,
-                             SMI_PARAMETERS);
+          ExtractFixedArrayFlag::kAllFixedArrays,
+      TVariable<BoolT>* var_holes_converted = nullptr,
+      base::Optional<TNode<Int32T>> source_elements_kind = base::nullopt) {
+    // TODO(solanes): just use capacity when ExtractFixedArray is fully
+    // converted.
+    Node* capacity_node = capacity ? static_cast<Node*>(*capacity) : nullptr;
+    return ExtractFixedArray(source, first, count, capacity_node, extract_flags,
+                             SMI_PARAMETERS, var_holes_converted,
+                             source_elements_kind);
   }
 
-  TNode<FixedArray> ExtractFixedArray(
-      TNode<FixedArray> source, TNode<IntPtrT> first, TNode<IntPtrT> count,
-      TNode<IntPtrT> capacity,
+  TNode<FixedArrayBase> ExtractFixedArray(
+      TNode<FixedArrayBase> source, TNode<IntPtrT> first, TNode<IntPtrT> count,
+      base::Optional<TNode<IntPtrT>> capacity,
       ExtractFixedArrayFlags extract_flags =
-          ExtractFixedArrayFlag::kAllFixedArrays) {
-    return CAST(ExtractFixedArray(source, first, count, capacity, extract_flags,
-                                  INTPTR_PARAMETERS));
+          ExtractFixedArrayFlag::kAllFixedArrays,
+      TVariable<BoolT>* var_holes_converted = nullptr,
+      base::Optional<TNode<Int32T>> source_elements_kind = base::nullopt) {
+    // TODO(solanes): just use capacity when ExtractFixedArray is fully
+    // converted.
+    Node* capacity_node = capacity ? static_cast<Node*>(*capacity) : nullptr;
+    return ExtractFixedArray(source, first, count, capacity_node, extract_flags,
+                             INTPTR_PARAMETERS, var_holes_converted,
+                             source_elements_kind);
   }
 
   // Copy a portion of an existing FixedArray or FixedDoubleArray into a new
@@ -2347,12 +2356,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // (NOTE: not index!), does a hole check if |if_hole| is provided and
   // converts the value so that it becomes ready for storing to array of
   // |to_kind| elements.
-  Node* LoadElementAndPrepareForStore(Node* array, Node* offset,
+  Node* LoadElementAndPrepareForStore(TNode<FixedArrayBase> array,
+                                      TNode<IntPtrT> offset,
                                       ElementsKind from_kind,
                                       ElementsKind to_kind, Label* if_hole);
 
-  Node* CalculateNewElementsCapacity(Node* old_capacity,
-                                     ParameterMode mode = INTPTR_PARAMETERS);
+  Node* CalculateNewElementsCapacity(Node* old_capacity, ParameterMode mode);
 
   TNode<Smi> CalculateNewElementsCapacity(TNode<Smi> old_capacity) {
     return CAST(CalculateNewElementsCapacity(old_capacity, SMI_PARAMETERS));
@@ -2372,11 +2381,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // Tries to grow the |capacity|-length |elements| array of given |object|
   // to store the |key| or bails out if the growing gap is too big. Returns
   // new elements.
+  template <typename TIndex>
   TNode<FixedArrayBase> TryGrowElementsCapacity(TNode<HeapObject> object,
                                                 TNode<FixedArrayBase> elements,
-                                                ElementsKind kind, Node* key,
-                                                Node* capacity,
-                                                ParameterMode mode,
+                                                ElementsKind kind,
+                                                TNode<TIndex> key,
+                                                TNode<TIndex> capacity,
                                                 Label* bailout);
 
   // Grows elements capacity of given object. Returns new elements.
@@ -2388,10 +2398,10 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // Given a need to grow by |growth|, allocate an appropriate new capacity
   // if necessary, and return a new elements FixedArray object. Label |bailout|
   // is followed for allocation failure.
-  void PossiblyGrowElementsCapacity(ParameterMode mode, ElementsKind kind,
-                                    TNode<HeapObject> array, Node* length,
+  void PossiblyGrowElementsCapacity(ElementsKind kind, TNode<HeapObject> array,
+                                    TNode<BInt> length,
                                     TVariable<FixedArrayBase>* var_elements,
-                                    Node* growth, Label* bailout);
+                                    TNode<BInt> growth, Label* bailout);
 
   // Allocation site manipulation
   void InitializeAllocationMemento(TNode<HeapObject> base,
@@ -2415,14 +2425,18 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                           TVariable<BigInt>* var_maybe_bigint,
                                           TVariable<Smi>* var_feedback);
 
+  TNode<Int32T> TruncateNumberToWord32(TNode<Number> value);
   // Truncate the floating point value of a HeapNumber to an Int32.
   TNode<Int32T> TruncateHeapNumberValueToWord32(TNode<HeapNumber> object);
 
   // Conversions.
   void TryHeapNumberToSmi(TNode<HeapNumber> number, TVariable<Smi>* output,
                           Label* if_smi);
+  void TryFloat32ToSmi(TNode<Float32T> number, TVariable<Smi>* output,
+                       Label* if_smi);
   void TryFloat64ToSmi(TNode<Float64T> number, TVariable<Smi>* output,
                        Label* if_smi);
+  TNode<Number> ChangeFloat32ToTagged(TNode<Float32T> value);
   TNode<Number> ChangeFloat64ToTagged(SloppyTNode<Float64T> value);
   TNode<Number> ChangeInt32ToTagged(SloppyTNode<Int32T> value);
   TNode<Number> ChangeUint32ToTagged(SloppyTNode<Uint32T> value);
@@ -2430,6 +2444,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<Uint32T> ChangeNumberToUint32(TNode<Number> value);
   TNode<Float64T> ChangeNumberToFloat64(TNode<Number> value);
 
+  TNode<Int32T> ChangeTaggedNonSmiToInt32(TNode<Context> context,
+                                          TNode<HeapObject> input);
+  TNode<Float64T> ChangeTaggedToFloat64(TNode<Context> context,
+                                        TNode<Object> input);
+
   void TaggedToNumeric(TNode<Context> context, TNode<Object> value,
                        TVariable<Numeric>* var_numeric);
   void TaggedToNumericWithFeedback(TNode<Context> context, TNode<Object> value,
@@ -2565,6 +2584,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<BoolT> IsJSObjectInstanceType(SloppyTNode<Int32T> instance_type);
   TNode<BoolT> IsJSObjectMap(SloppyTNode<Map> map);
   TNode<BoolT> IsJSObject(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSFinalizationRegistryMap(TNode<Map> map);
+  TNode<BoolT> IsJSFinalizationRegistry(TNode<HeapObject> object);
   TNode<BoolT> IsJSPromiseMap(SloppyTNode<Map> map);
   TNode<BoolT> IsJSPromise(SloppyTNode<HeapObject> object);
   TNode<BoolT> IsJSProxy(SloppyTNode<HeapObject> object);
@@ -2620,9 +2641,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<BoolT> IsCustomElementsReceiverInstanceType(
       TNode<Int32T> instance_type);
   TNode<BoolT> IsSpecialReceiverMap(SloppyTNode<Map> map);
-  // Returns true if the map corresponds to non-special fast or dictionary
-  // object.
-  TNode<BoolT> IsSimpleObjectMap(TNode<Map> map);
   TNode<BoolT> IsStringInstanceType(SloppyTNode<Int32T> instance_type);
   TNode<BoolT> IsString(SloppyTNode<HeapObject> object);
   TNode<BoolT> IsSymbolInstanceType(SloppyTNode<Int32T> instance_type);
@@ -2643,8 +2661,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<BoolT> IsPromiseThenProtectorCellInvalid();
   TNode<BoolT> IsArraySpeciesProtectorCellInvalid();
   TNode<BoolT> IsTypedArraySpeciesProtectorCellInvalid();
-  TNode<BoolT> IsRegExpSpeciesProtectorCellInvalid(
-      TNode<NativeContext> native_context);
+  TNode<BoolT> IsRegExpSpeciesProtectorCellInvalid();
   TNode<BoolT> IsPromiseSpeciesProtectorCellInvalid();
 
   TNode<BoolT> IsMockArrayBufferAllocatorFlag() {
@@ -2698,6 +2715,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   bool IsFastElementsKind(ElementsKind kind) {
     return v8::internal::IsFastElementsKind(kind);
   }
+  TNode<BoolT> IsFastOrNonExtensibleOrSealedElementsKind(
+      TNode<Int32T> elements_kind);
+
   TNode<BoolT> IsDictionaryElementsKind(TNode<Int32T> elements_kind) {
     return ElementsKindEqual(elements_kind, Int32Constant(DICTIONARY_ELEMENTS));
   }
@@ -2777,6 +2797,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<Number> ToLength_Inline(SloppyTNode<Context> context,
                                 SloppyTNode<Object> input);
 
+  TNode<Object> OrdinaryToPrimitive(TNode<Context> context, TNode<Object> input,
+                                    OrdinaryToPrimitiveHint hint);
+
   // Returns a node that contains a decoded (unsigned!) value of a bit
   // field |BitField| in |word32|. Returns result as an uint32 node.
   template <typename BitField>
@@ -2812,43 +2835,52 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
 
   // Decodes an unsigned (!) value from |word| to a word-size node.
   TNode<UintPtrT> DecodeWord(SloppyTNode<WordT> word, uint32_t shift,
-                             uint32_t mask);
+                             uintptr_t mask);
 
   // Returns a node that contains the updated values of a |BitField|.
   template <typename BitField>
-  TNode<Word32T> UpdateWord32(TNode<Word32T> word, TNode<Uint32T> value) {
-    return UpdateWord32(word, value, BitField::kShift, BitField::kMask);
+  TNode<Word32T> UpdateWord32(TNode<Word32T> word, TNode<Uint32T> value,
+                              bool starts_as_zero = false) {
+    return UpdateWord32(word, value, BitField::kShift, BitField::kMask,
+                        starts_as_zero);
   }
 
   // Returns a node that contains the updated values of a |BitField|.
   template <typename BitField>
-  TNode<WordT> UpdateWord(TNode<WordT> word, TNode<UintPtrT> value) {
-    return UpdateWord(word, value, BitField::kShift, BitField::kMask);
+  TNode<WordT> UpdateWord(TNode<WordT> word, TNode<UintPtrT> value,
+                          bool starts_as_zero = false) {
+    return UpdateWord(word, value, BitField::kShift, BitField::kMask,
+                      starts_as_zero);
   }
 
   // Returns a node that contains the updated values of a |BitField|.
   template <typename BitField>
-  TNode<Word32T> UpdateWordInWord32(TNode<Word32T> word,
-                                    TNode<UintPtrT> value) {
-    return UncheckedCast<Uint32T>(TruncateIntPtrToInt32(
-        Signed(UpdateWord<BitField>(ChangeUint32ToWord(word), value))));
+  TNode<Word32T> UpdateWordInWord32(TNode<Word32T> word, TNode<UintPtrT> value,
+                                    bool starts_as_zero = false) {
+    return UncheckedCast<Uint32T>(
+        TruncateIntPtrToInt32(Signed(UpdateWord<BitField>(
+            ChangeUint32ToWord(word), value, starts_as_zero))));
   }
 
   // Returns a node that contains the updated values of a |BitField|.
   template <typename BitField>
-  TNode<WordT> UpdateWord32InWord(TNode<WordT> word, TNode<Uint32T> value) {
-    return UpdateWord<BitField>(word, ChangeUint32ToWord(value));
+  TNode<WordT> UpdateWord32InWord(TNode<WordT> word, TNode<Uint32T> value,
+                                  bool starts_as_zero = false) {
+    return UpdateWord<BitField>(word, ChangeUint32ToWord(value),
+                                starts_as_zero);
   }
 
   // Returns a node that contains the updated {value} inside {word} starting
   // at {shift} and fitting in {mask}.
   TNode<Word32T> UpdateWord32(TNode<Word32T> word, TNode<Uint32T> value,
-                              uint32_t shift, uint32_t mask);
+                              uint32_t shift, uint32_t mask,
+                              bool starts_as_zero = false);
 
   // Returns a node that contains the updated {value} inside {word} starting
   // at {shift} and fitting in {mask}.
   TNode<WordT> UpdateWord(TNode<WordT> word, TNode<UintPtrT> value,
-                          uint32_t shift, uint32_t mask);
+                          uint32_t shift, uintptr_t mask,
+                          bool starts_as_zero = false);
 
   // Returns true if any of the |T|'s bits in given |word32| are set.
   template <typename T>
@@ -3436,24 +3468,24 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
 
   enum class ForEachDirection { kForward, kReverse };
 
-  using FastFixedArrayForEachBody =
-      std::function<void(Node* fixed_array, Node* offset)>;
+  using FastArrayForEachBody =
+      std::function<void(TNode<HeapObject> array, TNode<IntPtrT> offset)>;
 
-  void BuildFastFixedArrayForEach(
-      const CodeStubAssembler::VariableList& vars, Node* fixed_array,
+  void BuildFastArrayForEach(
+      const CodeStubAssembler::VariableList& vars, Node* array,
       ElementsKind kind, Node* first_element_inclusive,
-      Node* last_element_exclusive, const FastFixedArrayForEachBody& body,
+      Node* last_element_exclusive, const FastArrayForEachBody& body,
       ParameterMode mode = INTPTR_PARAMETERS,
       ForEachDirection direction = ForEachDirection::kReverse);
 
-  void BuildFastFixedArrayForEach(
-      Node* fixed_array, ElementsKind kind, Node* first_element_inclusive,
-      Node* last_element_exclusive, const FastFixedArrayForEachBody& body,
+  void BuildFastArrayForEach(
+      Node* array, ElementsKind kind, Node* first_element_inclusive,
+      Node* last_element_exclusive, const FastArrayForEachBody& body,
       ParameterMode mode = INTPTR_PARAMETERS,
       ForEachDirection direction = ForEachDirection::kReverse) {
     CodeStubAssembler::VariableList list(0, zone());
-    BuildFastFixedArrayForEach(list, fixed_array, kind, first_element_inclusive,
-                               last_element_exclusive, body, mode, direction);
+    BuildFastArrayForEach(list, array, kind, first_element_inclusive,
+                          last_element_exclusive, body, mode, direction);
   }
 
   TNode<IntPtrT> GetArrayAllocationSize(TNode<IntPtrT> element_count,
@@ -3593,8 +3625,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<BoolT> IsDebugActive();
 
   // JSArrayBuffer helpers
-  TNode<Uint32T> LoadJSArrayBufferBitField(TNode<JSArrayBuffer> array_buffer);
-  TNode<RawPtrT> LoadJSArrayBufferBackingStore(
+  TNode<RawPtrT> LoadJSArrayBufferBackingStorePtr(
       TNode<JSArrayBuffer> array_buffer);
   void ThrowIfArrayBufferIsDetached(SloppyTNode<Context> context,
                                     TNode<JSArrayBuffer> array_buffer,
@@ -3671,10 +3702,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<HeapObject> MakeTypeError(MessageTemplate message,
                                   TNode<Context> context, TArgs... args) {
     STATIC_ASSERT(sizeof...(TArgs) <= 3);
-    const TNode<Object> make_type_error = LoadContextElement(
-        LoadNativeContext(context), Context::MAKE_TYPE_ERROR_INDEX);
-    return CAST(Call(context, make_type_error, UndefinedConstant(),
-                     SmiConstant(message), args...));
+    return CAST(CallRuntime(Runtime::kNewTypeError, context,
+                            SmiConstant(message), args...));
   }
 
   void Abort(AbortReason reason) {
@@ -3844,6 +3873,10 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
 
   TNode<Smi> RefillMathRandom(TNode<NativeContext> native_context);
 
+  void RemoveFinalizationRegistryCellFromUnregisterTokenMap(
+      TNode<JSFinalizationRegistry> finalization_registry,
+      TNode<WeakCell> weak_cell);
+
  private:
   friend class CodeStubArguments;
 
@@ -3866,7 +3899,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // fields initialized.
   TNode<JSArray> AllocateUninitializedJSArray(
       TNode<Map> array_map, TNode<Smi> length,
-      TNode<AllocationSite> allocation_site, TNode<IntPtrT> size_in_bytes);
+      base::Optional<TNode<AllocationSite>> allocation_site,
+      TNode<IntPtrT> size_in_bytes);
 
   TNode<BoolT> IsValidSmi(TNode<Smi> smi);
 
@@ -3940,49 +3974,24 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
       ParameterMode parameter_mode = INTPTR_PARAMETERS);
 };
 
-// template <typename TIndex>
 class V8_EXPORT_PRIVATE CodeStubArguments {
  public:
   using Node = compiler::Node;
-  enum ReceiverMode { kHasReceiver, kNoReceiver };
-
-  // |argc| specifies the number of arguments passed to the builtin excluding
-  // the receiver. The arguments will include a receiver iff |receiver_mode|
-  // is kHasReceiver.
-  CodeStubArguments(CodeStubAssembler* assembler, TNode<IntPtrT> argc,
-                    ReceiverMode receiver_mode = ReceiverMode::kHasReceiver)
-      : CodeStubArguments(assembler, argc, TNode<RawPtrT>(), receiver_mode) {}
-
-  CodeStubArguments(CodeStubAssembler* assembler, TNode<Int32T> argc,
-                    ReceiverMode receiver_mode = ReceiverMode::kHasReceiver)
-      : CodeStubArguments(assembler, assembler->ChangeInt32ToIntPtr(argc),
-                          TNode<RawPtrT>(), receiver_mode) {}
-
-  // TODO(v8:9708): Consider removing this variant
-  CodeStubArguments(CodeStubAssembler* assembler, TNode<Smi> argc,
-                    ReceiverMode receiver_mode = ReceiverMode::kHasReceiver)
-      : CodeStubArguments(assembler, assembler->ParameterToIntPtr(argc),
-                          TNode<RawPtrT>(), receiver_mode) {}
 
   // |argc| specifies the number of arguments passed to the builtin excluding
-  // the receiver. The arguments will include a receiver iff |receiver_mode|
-  // is kHasReceiver.
+  // the receiver. The arguments include the receiver.
+  CodeStubArguments(CodeStubAssembler* assembler, TNode<IntPtrT> argc)
+      : CodeStubArguments(assembler, argc, TNode<RawPtrT>()) {}
+  CodeStubArguments(CodeStubAssembler* assembler, TNode<Int32T> argc)
+      : CodeStubArguments(assembler, assembler->ChangeInt32ToIntPtr(argc)) {}
   CodeStubArguments(CodeStubAssembler* assembler, TNode<IntPtrT> argc,
-                    TNode<RawPtrT> fp,
-                    ReceiverMode receiver_mode = ReceiverMode::kHasReceiver);
-
-  CodeStubArguments(CodeStubAssembler* assembler, TNode<Smi> argc,
-                    TNode<RawPtrT> fp,
-                    ReceiverMode receiver_mode = ReceiverMode::kHasReceiver)
-      : CodeStubArguments(assembler, assembler->ParameterToIntPtr(argc), fp,
-                          receiver_mode) {}
+                    TNode<RawPtrT> fp);
 
   // Used by Torque to construct arguments based on a Torque-defined
   // struct of values.
   CodeStubArguments(CodeStubAssembler* assembler,
                     TorqueStructArguments torque_arguments)
       : assembler_(assembler),
-        receiver_mode_(ReceiverMode::kHasReceiver),
         argc_(torque_arguments.length),
         base_(torque_arguments.base),
         fp_(torque_arguments.frame) {}
@@ -3995,68 +4004,41 @@ class V8_EXPORT_PRIVATE CodeStubArguments {
 
   // Computes address of the index'th argument.
   TNode<RawPtrT> AtIndexPtr(TNode<IntPtrT> index) const;
-  TNode<RawPtrT> AtIndexPtr(TNode<Smi> index) const {
-    return AtIndexPtr(assembler_->ParameterToIntPtr(index));
-  }
 
   // |index| is zero-based and does not include the receiver
   TNode<Object> AtIndex(TNode<IntPtrT> index) const;
-  // TODO(v8:9708): Consider removing this variant
-  TNode<Object> AtIndex(TNode<Smi> index) const {
-    return AtIndex(assembler_->ParameterToIntPtr(index));
-  }
-
   TNode<Object> AtIndex(int index) const;
 
-  TNode<Object> GetOptionalArgumentValue(int index) {
-    return GetOptionalArgumentValue(index, assembler_->UndefinedConstant());
-  }
-  TNode<Object> GetOptionalArgumentValue(int index,
-                                         TNode<Object> default_value);
-
   TNode<IntPtrT> GetLength() const { return argc_; }
 
   TorqueStructArguments GetTorqueArguments() const {
     return TorqueStructArguments{fp_, base_, argc_};
   }
 
+  TNode<Object> GetOptionalArgumentValue(TNode<IntPtrT> index,
+                                         TNode<Object> default_value);
   TNode<Object> GetOptionalArgumentValue(TNode<IntPtrT> index) {
     return GetOptionalArgumentValue(index, assembler_->UndefinedConstant());
   }
-  TNode<Object> GetOptionalArgumentValue(TNode<IntPtrT> index,
-                                         TNode<Object> default_value);
-
-  using ForEachBodyFunction = std::function<void(TNode<Object> arg)>;
+  TNode<Object> GetOptionalArgumentValue(int index) {
+    return GetOptionalArgumentValue(assembler_->IntPtrConstant(index));
+  }
 
   // Iteration doesn't include the receiver. |first| and |last| are zero-based.
-  template <typename TIndex>
-  void ForEach(const ForEachBodyFunction& body, TNode<TIndex> first = {},
-               TNode<TIndex> last = {}) const {
+  using ForEachBodyFunction = std::function<void(TNode<Object> arg)>;
+  void ForEach(const ForEachBodyFunction& body, TNode<IntPtrT> first = {},
+               TNode<IntPtrT> last = {}) const {
     CodeStubAssembler::VariableList list(0, assembler_->zone());
     ForEach(list, body, first, last);
   }
-
-  // Iteration doesn't include the receiver. |first| and |last| are zero-based.
   void ForEach(const CodeStubAssembler::VariableList& vars,
                const ForEachBodyFunction& body, TNode<IntPtrT> first = {},
                TNode<IntPtrT> last = {}) const;
 
-  void ForEach(const CodeStubAssembler::VariableList& vars,
-               const ForEachBodyFunction& body, TNode<Smi> first,
-               TNode<Smi> last = {}) const {
-    TNode<IntPtrT> first_intptr = assembler_->ParameterToIntPtr(first);
-    TNode<IntPtrT> last_intptr;
-    if (last != nullptr) {
-      last_intptr = assembler_->ParameterToIntPtr(last);
-    }
-    return ForEach(vars, body, first_intptr, last_intptr);
-  }
-
   void PopAndReturn(TNode<Object> value);
 
  private:
   CodeStubAssembler* assembler_;
-  ReceiverMode receiver_mode_;
   TNode<IntPtrT> argc_;
   TNode<RawPtrT> base_;
   TNode<RawPtrT> fp_;
diff --git a/deps/v8/src/codegen/compiler.cc b/deps/v8/src/codegen/compiler.cc
index 595e59f5514..c436c57407c 100644
--- a/deps/v8/src/codegen/compiler.cc
+++ b/deps/v8/src/codegen/compiler.cc
@@ -30,6 +30,7 @@
 #include "src/execution/frames-inl.h"
 #include "src/execution/isolate-inl.h"
 #include "src/execution/isolate.h"
+#include "src/execution/off-thread-isolate.h"
 #include "src/execution/runtime-profiler.h"
 #include "src/execution/vm-state-inl.h"
 #include "src/handles/maybe-handles.h"
@@ -42,10 +43,11 @@
 #include "src/objects/map.h"
 #include "src/objects/object-list-macros.h"
 #include "src/objects/shared-function-info.h"
+#include "src/objects/string.h"
 #include "src/parsing/parse-info.h"
 #include "src/parsing/parser.h"
 #include "src/parsing/parsing.h"
-#include "src/parsing/rewriter.h"
+#include "src/parsing/pending-compilation-error-handler.h"
 #include "src/parsing/scanner-character-streams.h"
 #include "src/snapshot/code-serializer.h"
 #include "src/utils/ostreams.h"
@@ -179,13 +181,15 @@ CompilationJob::Status UnoptimizedCompilationJob::FinalizeJob(
   return UpdateState(FinalizeJobImpl(shared_info, isolate), State::kSucceeded);
 }
 
-void UnoptimizedCompilationJob::RecordCompilationStats(Isolate* isolate) const {
+namespace {
+
+void RecordUnoptimizedCompilationStats(Isolate* isolate,
+                                       Handle<SharedFunctionInfo> shared_info) {
   int code_size;
-  if (compilation_info()->has_bytecode_array()) {
-    code_size = compilation_info()->bytecode_array()->SizeIncludingMetadata();
+  if (shared_info->HasBytecodeArray()) {
+    code_size = shared_info->GetBytecodeArray().SizeIncludingMetadata();
   } else {
-    DCHECK(compilation_info()->has_asm_wasm_data());
-    code_size = compilation_info()->asm_wasm_data()->Size();
+    code_size = shared_info->asm_wasm_data().Size();
   }
 
   Counters* counters = isolate->counters();
@@ -197,27 +201,30 @@ void UnoptimizedCompilationJob::RecordCompilationStats(Isolate* isolate) const {
   // Also add total time (there's now already timer_ on the base class).
 }
 
-void UnoptimizedCompilationJob::RecordFunctionCompilation(
-    CodeEventListener::LogEventsAndTags tag, Handle<SharedFunctionInfo> shared,
-    Isolate* isolate) const {
+void RecordUnoptimizedFunctionCompilation(
+    Isolate* isolate, CodeEventListener::LogEventsAndTags tag,
+    Handle<SharedFunctionInfo> shared, base::TimeDelta time_taken_to_execute,
+    base::TimeDelta time_taken_to_finalize) {
   Handle<AbstractCode> abstract_code;
-  if (compilation_info()->has_bytecode_array()) {
+  if (shared->HasBytecodeArray()) {
     abstract_code =
-        Handle<AbstractCode>::cast(compilation_info()->bytecode_array());
+        handle(AbstractCode::cast(shared->GetBytecodeArray()), isolate);
   } else {
-    DCHECK(compilation_info()->has_asm_wasm_data());
+    DCHECK(shared->HasAsmWasmData());
     abstract_code =
         Handle<AbstractCode>::cast(BUILTIN_CODE(isolate, InstantiateAsmJs));
   }
 
-  double time_taken_ms = time_taken_to_execute_.InMillisecondsF() +
-                         time_taken_to_finalize_.InMillisecondsF();
+  double time_taken_ms = time_taken_to_execute.InMillisecondsF() +
+                         time_taken_to_finalize.InMillisecondsF();
 
   Handle<Script> script(Script::cast(shared->script()), isolate);
   LogFunctionCompilation(tag, shared, script, abstract_code, false,
                          time_taken_ms, isolate);
 }
 
+}  // namespace
+
 // ----------------------------------------------------------------------------
 // Implementation of OptimizedCompilationJob
 
@@ -383,13 +390,15 @@ bool UseAsmWasm(FunctionLiteral* literal, bool asm_wasm_broken) {
   return literal->scope()->IsAsmModule();
 }
 
-void InstallBytecodeArray(Handle<BytecodeArray> bytecode_array,
-                          Handle<SharedFunctionInfo> shared_info,
-                          ParseInfo* parse_info, Isolate* isolate) {
-  if (!FLAG_interpreted_frames_native_stack) {
-    shared_info->set_bytecode_array(*bytecode_array);
+void InstallInterpreterTrampolineCopy(Isolate* isolate,
+                                      Handle<SharedFunctionInfo> shared_info) {
+  DCHECK(FLAG_interpreted_frames_native_stack);
+  if (!shared_info->function_data().IsBytecodeArray()) {
+    DCHECK(!shared_info->HasBytecodeArray());
     return;
   }
+  Handle<BytecodeArray> bytecode_array(shared_info->GetBytecodeArray(),
+                                       isolate);
 
   Handle<Code> code = isolate->factory()->CopyCode(Handle<Code>::cast(
       isolate->factory()->interpreter_entry_trampoline_for_profiling()));
@@ -419,9 +428,23 @@ void InstallBytecodeArray(Handle<BytecodeArray> bytecode_array,
                                    script_name, line_num, column_num));
 }
 
+void InstallCoverageInfo(Isolate* isolate, Handle<SharedFunctionInfo> shared,
+                         Handle<CoverageInfo> coverage_info) {
+  DCHECK(isolate->is_block_code_coverage());
+  isolate->debug()->InstallCoverageInfo(shared, coverage_info);
+}
+
+void InstallCoverageInfo(OffThreadIsolate* isolate,
+                         Handle<SharedFunctionInfo> shared,
+                         Handle<CoverageInfo> coverage_info) {
+  // We should only have coverage info when finalizing on the main thread.
+  UNREACHABLE();
+}
+
+template <typename LocalIsolate>
 void InstallUnoptimizedCode(UnoptimizedCompilationInfo* compilation_info,
                             Handle<SharedFunctionInfo> shared_info,
-                            ParseInfo* parse_info, Isolate* isolate) {
+                            LocalIsolate* isolate) {
   DCHECK_EQ(shared_info->language_mode(),
             compilation_info->literal()->language_mode());
 
@@ -440,63 +463,52 @@ void InstallUnoptimizedCode(UnoptimizedCompilationInfo* compilation_info,
       shared_info->set_is_asm_wasm_broken(true);
     }
 
-    InstallBytecodeArray(compilation_info->bytecode_array(), shared_info,
-                         parse_info, isolate);
+    shared_info->set_bytecode_array(*compilation_info->bytecode_array());
 
     Handle<FeedbackMetadata> feedback_metadata = FeedbackMetadata::New(
         isolate, compilation_info->feedback_vector_spec());
     shared_info->set_feedback_metadata(*feedback_metadata);
   } else {
     DCHECK(compilation_info->has_asm_wasm_data());
+    // We should only have asm/wasm data when finalizing on the main thread.
+    DCHECK((std::is_same<LocalIsolate, Isolate>::value));
     shared_info->set_asm_wasm_data(*compilation_info->asm_wasm_data());
     shared_info->set_feedback_metadata(
         ReadOnlyRoots(isolate).empty_feedback_metadata());
   }
 
-  // Install coverage info on the shared function info.
   if (compilation_info->has_coverage_info() &&
       !shared_info->HasCoverageInfo()) {
-    DCHECK(isolate->is_block_code_coverage());
-    isolate->debug()->InstallCoverageInfo(shared_info,
-                                          compilation_info->coverage_info());
+    InstallCoverageInfo(isolate, shared_info,
+                        compilation_info->coverage_info());
   }
 }
 
-void InstallUnoptimizedCode(UnoptimizedCompilationInfo* compilation_info,
-                            Handle<SharedFunctionInfo> shared_info,
-                            ParseInfo* parse_info, OffThreadIsolate* isolate) {
-  DCHECK_EQ(shared_info->language_mode(),
-            compilation_info->literal()->language_mode());
-
-  // Update the shared function info with the scope info.
-  Handle<ScopeInfo> scope_info = compilation_info->scope()->scope_info();
-  shared_info->set_scope_info(*scope_info);
-
-  DCHECK(compilation_info->has_bytecode_array());
-  DCHECK(!shared_info->HasBytecodeArray());  // Only compiled once.
-  DCHECK(!compilation_info->has_asm_wasm_data());
-  DCHECK(!shared_info->HasFeedbackMetadata());
-
-  // If the function failed asm-wasm compilation, mark asm_wasm as broken
-  // to ensure we don't try to compile as asm-wasm.
-  if (compilation_info->literal()->scope()->IsAsmModule()) {
-    shared_info->set_is_asm_wasm_broken(true);
+void LogUnoptimizedCompilation(Isolate* isolate,
+                               Handle<SharedFunctionInfo> shared_info,
+                               UnoptimizedCompileFlags flags,
+                               base::TimeDelta time_taken_to_execute,
+                               base::TimeDelta time_taken_to_finalize) {
+  CodeEventListener::LogEventsAndTags log_tag;
+  if (flags.is_toplevel()) {
+    log_tag = flags.is_eval() ? CodeEventListener::EVAL_TAG
+                              : CodeEventListener::SCRIPT_TAG;
+  } else {
+    log_tag = flags.is_lazy_compile() ? CodeEventListener::LAZY_COMPILE_TAG
+                                      : CodeEventListener::FUNCTION_TAG;
   }
 
-  shared_info->set_bytecode_array(*compilation_info->bytecode_array());
-
-  Handle<FeedbackMetadata> feedback_metadata =
-      FeedbackMetadata::New(isolate, compilation_info->feedback_vector_spec());
-  shared_info->set_feedback_metadata(*feedback_metadata);
-
-  DCHECK(!compilation_info->has_coverage_info());
+  RecordUnoptimizedFunctionCompilation(isolate, log_tag, shared_info,
+                                       time_taken_to_execute,
+                                       time_taken_to_finalize);
+  RecordUnoptimizedCompilationStats(isolate, shared_info);
 }
 
 template <typename LocalIsolate>
 void EnsureSharedFunctionInfosArrayOnScript(Handle<Script> script,
                                             ParseInfo* parse_info,
                                             LocalIsolate* isolate) {
-  DCHECK(parse_info->is_toplevel());
+  DCHECK(parse_info->flags().is_toplevel());
   if (script->shared_function_infos().length() > 0) {
     DCHECK_EQ(script->shared_function_infos().length(),
               parse_info->max_function_literal_id() + 1);
@@ -524,63 +536,32 @@ void SetSharedFunctionFlagsFromLiteral(FunctionLiteral* literal,
       literal->has_static_private_methods_or_accessors());
 }
 
-CompilationJob::Status FinalizeUnoptimizedCompilationJob(
-    UnoptimizedCompilationJob* job, Handle<SharedFunctionInfo> shared_info,
-    Isolate* isolate) {
-  UnoptimizedCompilationInfo* compilation_info = job->compilation_info();
-  ParseInfo* parse_info = job->parse_info();
-
-  SetSharedFunctionFlagsFromLiteral(compilation_info->literal(), *shared_info);
-
-  CompilationJob::Status status = job->FinalizeJob(shared_info, isolate);
-  if (status == CompilationJob::SUCCEEDED) {
-    InstallUnoptimizedCode(compilation_info, shared_info, parse_info, isolate);
-
-    // It's possible that source position collection was enabled after the
-    // background compile was started in which the compiled bytecode will not be
-    // missing source positions (for instance by enabling the cpu profiler). So
-    // force source position collection now in that case.
-    if (!parse_info->collect_source_positions() &&
-        isolate->NeedsDetailedOptimizedCodeLineInfo()) {
-      SharedFunctionInfo::EnsureSourcePositionsAvailable(isolate, shared_info);
-    }
-
-    CodeEventListener::LogEventsAndTags log_tag;
-    if (parse_info->is_toplevel()) {
-      log_tag = compilation_info->is_eval() ? CodeEventListener::EVAL_TAG
-                                            : CodeEventListener::SCRIPT_TAG;
-    } else {
-      log_tag = parse_info->lazy_compile() ? CodeEventListener::LAZY_COMPILE_TAG
-                                           : CodeEventListener::FUNCTION_TAG;
-    }
-    job->RecordFunctionCompilation(log_tag, shared_info, isolate);
-    job->RecordCompilationStats(isolate);
-  }
-  return status;
-}
-
-CompilationJob::Status FinalizeUnoptimizedCompilationJob(
+template <typename LocalIsolate>
+CompilationJob::Status FinalizeSingleUnoptimizedCompilationJob(
     UnoptimizedCompilationJob* job, Handle<SharedFunctionInfo> shared_info,
-    OffThreadIsolate* isolate) {
+    LocalIsolate* isolate,
+    FinalizeUnoptimizedCompilationDataList*
+        finalize_unoptimized_compilation_data_list) {
   UnoptimizedCompilationInfo* compilation_info = job->compilation_info();
-  ParseInfo* parse_info = job->parse_info();
 
   SetSharedFunctionFlagsFromLiteral(compilation_info->literal(), *shared_info);
 
   CompilationJob::Status status = job->FinalizeJob(shared_info, isolate);
   if (status == CompilationJob::SUCCEEDED) {
-    InstallUnoptimizedCode(compilation_info, shared_info, parse_info, isolate);
-
-    // TODO(leszeks): Record the function compilation and compilation stats.
+    InstallUnoptimizedCode(compilation_info, shared_info, isolate);
+    finalize_unoptimized_compilation_data_list->emplace_back(
+        isolate, shared_info, job->time_taken_to_execute(),
+        job->time_taken_to_finalize());
   }
   return status;
 }
 
-std::unique_ptr<UnoptimizedCompilationJob> ExecuteUnoptimizedCompileJobs(
+std::unique_ptr<UnoptimizedCompilationJob>
+ExecuteSingleUnoptimizedCompilationJob(
     ParseInfo* parse_info, FunctionLiteral* literal,
     AccountingAllocator* allocator,
-    UnoptimizedCompilationJobList* inner_function_jobs) {
-  if (UseAsmWasm(literal, parse_info->is_asm_wasm_broken())) {
+    std::vector<FunctionLiteral*>* eager_inner_literals) {
+  if (UseAsmWasm(literal, parse_info->flags().is_asm_wasm_broken())) {
     std::unique_ptr<UnoptimizedCompilationJob> asm_job(
         AsmJs::NewCompilationJob(parse_info, literal, allocator));
     if (asm_job->ExecuteJob() == CompilationJob::SUCCEEDED) {
@@ -592,21 +573,35 @@ std::unique_ptr<UnoptimizedCompilationJob> ExecuteUnoptimizedCompileJobs(
     // with a validation error or another error that could be solve by falling
     // through to standard unoptimized compile.
   }
-  std::vector<FunctionLiteral*> eager_inner_literals;
   std::unique_ptr<UnoptimizedCompilationJob> job(
       interpreter::Interpreter::NewCompilationJob(
-          parse_info, literal, allocator, &eager_inner_literals));
+          parse_info, literal, allocator, eager_inner_literals));
 
   if (job->ExecuteJob() != CompilationJob::SUCCEEDED) {
     // Compilation failed, return null.
     return std::unique_ptr<UnoptimizedCompilationJob>();
   }
 
+  return job;
+}
+
+std::unique_ptr<UnoptimizedCompilationJob>
+RecursivelyExecuteUnoptimizedCompilationJobs(
+    ParseInfo* parse_info, FunctionLiteral* literal,
+    AccountingAllocator* allocator,
+    UnoptimizedCompilationJobList* inner_function_jobs) {
+  std::vector<FunctionLiteral*> eager_inner_literals;
+  std::unique_ptr<UnoptimizedCompilationJob> job =
+      ExecuteSingleUnoptimizedCompilationJob(parse_info, literal, allocator,
+                                             &eager_inner_literals);
+
+  if (!job) return std::unique_ptr<UnoptimizedCompilationJob>();
+
   // Recursively compile eager inner literals.
   for (FunctionLiteral* inner_literal : eager_inner_literals) {
     std::unique_ptr<UnoptimizedCompilationJob> inner_job(
-        ExecuteUnoptimizedCompileJobs(parse_info, inner_literal, allocator,
-                                      inner_function_jobs));
+        RecursivelyExecuteUnoptimizedCompilationJobs(
+            parse_info, inner_literal, allocator, inner_function_jobs));
     // Compilation failed, return null.
     if (!inner_job) return std::unique_ptr<UnoptimizedCompilationJob>();
     inner_function_jobs->emplace_front(std::move(inner_job));
@@ -615,39 +610,14 @@ std::unique_ptr<UnoptimizedCompilationJob> ExecuteUnoptimizedCompileJobs(
   return job;
 }
 
-std::unique_ptr<UnoptimizedCompilationJob> GenerateUnoptimizedCode(
-    ParseInfo* parse_info, AccountingAllocator* allocator,
-    UnoptimizedCompilationJobList* inner_function_jobs) {
-  DisallowHeapAccess no_heap_access;
-  DCHECK(inner_function_jobs->empty());
-
-  std::unique_ptr<UnoptimizedCompilationJob> job;
-  if (Compiler::Analyze(parse_info)) {
-    job = ExecuteUnoptimizedCompileJobs(parse_info, parse_info->literal(),
-                                        allocator, inner_function_jobs);
-  }
-
-  // Character stream shouldn't be used again.
-  parse_info->ResetCharacterStream();
-
-  return job;
-}
-
-MaybeHandle<SharedFunctionInfo> GenerateUnoptimizedCodeForToplevel(
-    Isolate* isolate, Handle<Script> script, ParseInfo* parse_info,
-    AccountingAllocator* allocator, IsCompiledScope* is_compiled_scope) {
-  EnsureSharedFunctionInfosArrayOnScript(script, parse_info, isolate);
-  parse_info->ast_value_factory()->Internalize(isolate);
-
-  if (!Compiler::Analyze(parse_info)) return MaybeHandle<SharedFunctionInfo>();
+bool IterativelyExecuteAndFinalizeUnoptimizedCompilationJobs(
+    Isolate* isolate, Handle<SharedFunctionInfo> outer_shared_info,
+    Handle<Script> script, ParseInfo* parse_info,
+    AccountingAllocator* allocator, IsCompiledScope* is_compiled_scope,
+    FinalizeUnoptimizedCompilationDataList*
+        finalize_unoptimized_compilation_data_list) {
   DeclarationScope::AllocateScopeInfos(parse_info, isolate);
 
-  // Prepare and execute compilation of the outer-most function.
-  // Create the SharedFunctionInfo and add it to the script's list.
-  Handle<SharedFunctionInfo> top_level =
-      isolate->factory()->NewSharedFunctionInfoForLiteral(parse_info->literal(),
-                                                          script, true);
-
   std::vector<FunctionLiteral*> functions_to_compile;
   functions_to_compile.push_back(parse_info->literal());
 
@@ -657,57 +627,42 @@ MaybeHandle<SharedFunctionInfo> GenerateUnoptimizedCodeForToplevel(
     Handle<SharedFunctionInfo> shared_info =
         Compiler::GetSharedFunctionInfo(literal, script, isolate);
     if (shared_info->is_compiled()) continue;
-    if (UseAsmWasm(literal, parse_info->is_asm_wasm_broken())) {
-      std::unique_ptr<UnoptimizedCompilationJob> asm_job(
-          AsmJs::NewCompilationJob(parse_info, literal, allocator));
-      if (asm_job->ExecuteJob() == CompilationJob::SUCCEEDED &&
-          FinalizeUnoptimizedCompilationJob(asm_job.get(), shared_info,
-                                            isolate) ==
-              CompilationJob::SUCCEEDED) {
-        continue;
-      }
-      // asm.js validation failed, fall through to standard unoptimized compile.
-      // Note: we rely on the fact that AsmJs jobs have done all validation in
-      // the PrepareJob and ExecuteJob phases and can't fail in FinalizeJob with
-      // with a validation error or another error that could be solve by falling
-      // through to standard unoptimized compile.
-    }
-
-    std::unique_ptr<UnoptimizedCompilationJob> job(
-        interpreter::Interpreter::NewCompilationJob(
-            parse_info, literal, allocator, &functions_to_compile));
 
-    if (job->ExecuteJob() == CompilationJob::FAILED ||
-        FinalizeUnoptimizedCompilationJob(job.get(), shared_info, isolate) ==
-            CompilationJob::FAILED) {
-      return MaybeHandle<SharedFunctionInfo>();
-    }
+    std::unique_ptr<UnoptimizedCompilationJob> job =
+        ExecuteSingleUnoptimizedCompilationJob(parse_info, literal, allocator,
+                                               &functions_to_compile);
+    if (!job) return false;
 
-    if (FLAG_stress_lazy_source_positions) {
-      // Collect source positions immediately to try and flush out bytecode
-      // mismatches.
-      SharedFunctionInfo::EnsureSourcePositionsAvailable(isolate, shared_info);
+    if (FinalizeSingleUnoptimizedCompilationJob(
+            job.get(), shared_info, isolate,
+            finalize_unoptimized_compilation_data_list) !=
+        CompilationJob::SUCCEEDED) {
+      return false;
     }
 
-    if (shared_info.is_identical_to(top_level)) {
+    if (shared_info.is_identical_to(outer_shared_info)) {
       // Ensure that the top level function is retained.
       *is_compiled_scope = shared_info->is_compiled_scope();
       DCHECK(is_compiled_scope->is_compiled());
     }
   }
 
-  // Character stream shouldn't be used again.
-  parse_info->ResetCharacterStream();
+  // Report any warnings generated during compilation.
+  if (parse_info->pending_error_handler()->has_pending_warnings()) {
+    parse_info->pending_error_handler()->PrepareWarnings(isolate);
+  }
 
-  return top_level;
+  return true;
 }
 
 template <typename LocalIsolate>
-bool FinalizeUnoptimizedCode(
+bool FinalizeAllUnoptimizedCompilationJobs(
     ParseInfo* parse_info, LocalIsolate* isolate,
     Handle<SharedFunctionInfo> shared_info,
     UnoptimizedCompilationJob* outer_function_job,
-    UnoptimizedCompilationJobList* inner_function_jobs) {
+    UnoptimizedCompilationJobList* inner_function_jobs,
+    FinalizeUnoptimizedCompilationDataList*
+        finalize_unoptimized_compilation_data_list) {
   // TODO(leszeks): Re-enable.
   // DCHECK(AllowCompilation::IsAllowed(isolate));
 
@@ -718,8 +673,10 @@ bool FinalizeUnoptimizedCode(
   DeclarationScope::AllocateScopeInfos(parse_info, isolate);
 
   // Finalize the outer-most function's compilation job.
-  if (FinalizeUnoptimizedCompilationJob(outer_function_job, shared_info,
-                                        isolate) != CompilationJob::SUCCEEDED) {
+  if (FinalizeSingleUnoptimizedCompilationJob(
+          outer_function_job, shared_info, isolate,
+          finalize_unoptimized_compilation_data_list) !=
+      CompilationJob::SUCCEEDED) {
     return false;
   }
 
@@ -733,8 +690,9 @@ bool FinalizeUnoptimizedCode(
             inner_job->compilation_info()->literal(), script, isolate);
     // The inner function might be compiled already if compiling for debug.
     if (inner_shared_info->is_compiled()) continue;
-    if (FinalizeUnoptimizedCompilationJob(inner_job.get(), inner_shared_info,
-                                          isolate) !=
+    if (FinalizeSingleUnoptimizedCompilationJob(
+            inner_job.get(), inner_shared_info, isolate,
+            finalize_unoptimized_compilation_data_list) !=
         CompilationJob::SUCCEEDED) {
       return false;
     }
@@ -742,7 +700,7 @@ bool FinalizeUnoptimizedCode(
 
   // Report any warnings generated during compilation.
   if (parse_info->pending_error_handler()->has_pending_warnings()) {
-    parse_info->pending_error_handler()->ReportWarnings(isolate, script);
+    parse_info->pending_error_handler()->PrepareWarnings(isolate);
   }
 
   return true;
@@ -994,15 +952,26 @@ MaybeHandle<Code> GetOptimizedCode(Handle<JSFunction> function,
   return MaybeHandle<Code>();
 }
 
-bool FailWithPendingException(Isolate* isolate, Handle<Script> script,
-                              ParseInfo* parse_info,
-                              Compiler::ClearExceptionFlag flag) {
-  if (flag == Compiler::CLEAR_EXCEPTION) {
-    isolate->clear_pending_exception();
-  } else if (!isolate->has_pending_exception()) {
-    if (parse_info->pending_error_handler()->has_pending_error()) {
-      parse_info->pending_error_handler()->ReportErrors(
-          isolate, script, parse_info->ast_value_factory());
+bool FailAndClearPendingException(Isolate* isolate) {
+  isolate->clear_pending_exception();
+  return false;
+}
+
+template <typename LocalIsolate>
+bool PreparePendingException(LocalIsolate* isolate, ParseInfo* parse_info) {
+  if (parse_info->pending_error_handler()->has_pending_error()) {
+    parse_info->pending_error_handler()->PrepareErrors(
+        isolate, parse_info->ast_value_factory());
+  }
+  return false;
+}
+
+bool FailWithPreparedPendingException(
+    Isolate* isolate, Handle<Script> script,
+    const PendingCompilationErrorHandler* pending_error_handler) {
+  if (!isolate->has_pending_exception()) {
+    if (pending_error_handler->has_pending_error()) {
+      pending_error_handler->ReportErrors(isolate, script);
     } else {
       isolate->StackOverflow();
     }
@@ -1010,25 +979,74 @@ bool FailWithPendingException(Isolate* isolate, Handle<Script> script,
   return false;
 }
 
-bool FailWithPendingException(OffThreadIsolate* isolate, Handle<Script> script,
+bool FailWithPendingException(Isolate* isolate, Handle<Script> script,
                               ParseInfo* parse_info,
                               Compiler::ClearExceptionFlag flag) {
-  // TODO(leszeks): Implement.
-  UNREACHABLE();
+  if (flag == Compiler::CLEAR_EXCEPTION) {
+    return FailAndClearPendingException(isolate);
+  }
+
+  PreparePendingException(isolate, parse_info);
+  return FailWithPreparedPendingException(isolate, script,
+                                          parse_info->pending_error_handler());
+}
+
+void FinalizeUnoptimizedCompilation(
+    Isolate* isolate, Handle<Script> script,
+    const UnoptimizedCompileFlags& flags,
+    const UnoptimizedCompileState* compile_state,
+    const FinalizeUnoptimizedCompilationDataList&
+        finalize_unoptimized_compilation_data_list) {
+  if (compile_state->pending_error_handler()->has_pending_warnings()) {
+    compile_state->pending_error_handler()->ReportWarnings(isolate, script);
+  }
+
+  bool need_source_positions = FLAG_stress_lazy_source_positions ||
+                               (!flags.collect_source_positions() &&
+                                isolate->NeedsSourcePositionsForProfiling());
+
+  for (const auto& finalize_data : finalize_unoptimized_compilation_data_list) {
+    Handle<SharedFunctionInfo> shared_info = finalize_data.function_handle();
+    // It's unlikely, but possible, that the bytecode was flushed between being
+    // allocated and now, so guard against that case, and against it being
+    // flushed in the middle of this loop.
+    IsCompiledScope is_compiled_scope(*shared_info, isolate);
+    if (!is_compiled_scope.is_compiled()) continue;
+
+    if (need_source_positions) {
+      SharedFunctionInfo::EnsureSourcePositionsAvailable(isolate, shared_info);
+    }
+    if (FLAG_interpreted_frames_native_stack) {
+      InstallInterpreterTrampolineCopy(isolate, shared_info);
+    }
+
+    LogUnoptimizedCompilation(isolate, shared_info, flags,
+                              finalize_data.time_taken_to_execute(),
+                              finalize_data.time_taken_to_finalize());
+  }
 }
 
-void FinalizeScriptCompilation(Isolate* isolate, Handle<Script> script,
-                               ParseInfo* parse_info) {
+void FinalizeUnoptimizedScriptCompilation(
+    Isolate* isolate, Handle<Script> script,
+    const UnoptimizedCompileFlags& flags,
+    const UnoptimizedCompileState* compile_state,
+    const FinalizeUnoptimizedCompilationDataList&
+        finalize_unoptimized_compilation_data_list) {
+  FinalizeUnoptimizedCompilation(isolate, script, flags, compile_state,
+                                 finalize_unoptimized_compilation_data_list);
+
   script->set_compilation_state(Script::COMPILATION_STATE_COMPILED);
 
-  // Register any pending parallel tasks with the associated SFI.
-  if (parse_info->parallel_tasks()) {
-    CompilerDispatcher* dispatcher = parse_info->parallel_tasks()->dispatcher();
-    for (auto& it : *parse_info->parallel_tasks()) {
+  UnoptimizedCompileState::ParallelTasks* parallel_tasks =
+      compile_state->parallel_tasks();
+  if (parallel_tasks) {
+    CompilerDispatcher* dispatcher = parallel_tasks->dispatcher();
+    for (auto& it : *parallel_tasks) {
       FunctionLiteral* literal = it.first;
       CompilerDispatcher::JobId job_id = it.second;
       MaybeHandle<SharedFunctionInfo> maybe_shared_for_task =
-          script->FindSharedFunctionInfo(isolate, literal);
+          script->FindSharedFunctionInfo(isolate,
+                                         literal->function_literal_id());
       Handle<SharedFunctionInfo> shared_for_task;
       if (maybe_shared_for_task.ToHandle(&shared_for_task)) {
         dispatcher->RegisterSharedFunctionInfo(job_id, *shared_for_task);
@@ -1037,42 +1055,22 @@ void FinalizeScriptCompilation(Isolate* isolate, Handle<Script> script,
       }
     }
   }
-}
 
-void FinalizeScriptCompilation(OffThreadIsolate* isolate, Handle<Script> script,
-                               ParseInfo* parse_info) {
-  script->set_compilation_state(Script::COMPILATION_STATE_COMPILED);
-  DCHECK(!parse_info->parallel_tasks());
+  if (isolate->NeedsSourcePositionsForProfiling()) {
+    Script::InitLineEnds(isolate, script);
+  }
 }
 
+// Create shared function info for top level and shared function infos array for
+// inner functions.
 template <typename LocalIsolate>
-MaybeHandle<SharedFunctionInfo> FinalizeTopLevel(
-    ParseInfo* parse_info, Handle<Script> script, LocalIsolate* isolate,
-    UnoptimizedCompilationJob* outer_function_job,
-    UnoptimizedCompilationJobList* inner_function_jobs) {
-  // Internalize ast values onto the heap.
-  parse_info->ast_value_factory()->Internalize(isolate);
-
-  // Create shared function infos for top level and shared function infos array
-  // for inner functions.
+Handle<SharedFunctionInfo> CreateTopLevelSharedFunctionInfo(
+    ParseInfo* parse_info, Handle<Script> script, LocalIsolate* isolate) {
   EnsureSharedFunctionInfosArrayOnScript(script, parse_info, isolate);
   DCHECK_EQ(kNoSourcePosition,
             parse_info->literal()->function_token_position());
-  Handle<SharedFunctionInfo> shared_info =
-      isolate->factory()->NewSharedFunctionInfoForLiteral(parse_info->literal(),
-                                                          script, true);
-
-  // Finalize compilation of the unoptimized bytecode or asm-js data.
-  if (!FinalizeUnoptimizedCode(parse_info, isolate, shared_info,
-                               outer_function_job, inner_function_jobs)) {
-    FailWithPendingException(isolate, script, parse_info,
-                             Compiler::ClearExceptionFlag::KEEP_EXCEPTION);
-    return MaybeHandle<SharedFunctionInfo>();
-  }
-
-  FinalizeScriptCompilation(isolate, script, parse_info);
-
-  return shared_info;
+  return isolate->factory()->NewSharedFunctionInfoForLiteral(
+      parse_info->literal(), script, true);
 }
 
 MaybeHandle<SharedFunctionInfo> CompileToplevel(
@@ -1086,8 +1084,9 @@ MaybeHandle<SharedFunctionInfo> CompileToplevel(
   PostponeInterruptsScope postpone(isolate);
   DCHECK(!isolate->native_context().is_null());
   RuntimeCallTimerScope runtimeTimer(
-      isolate, parse_info->is_eval() ? RuntimeCallCounterId::kCompileEval
-                                     : RuntimeCallCounterId::kCompileScript);
+      isolate, parse_info->flags().is_eval()
+                   ? RuntimeCallCounterId::kCompileEval
+                   : RuntimeCallCounterId::kCompileScript);
   VMState<BYTECODE_COMPILER> state(isolate);
   if (parse_info->literal() == nullptr &&
       !parsing::ParseProgram(parse_info, script, maybe_outer_scope_info,
@@ -1097,24 +1096,36 @@ MaybeHandle<SharedFunctionInfo> CompileToplevel(
   // Measure how long it takes to do the compilation; only take the
   // rest of the function into account to avoid overlap with the
   // parsing statistics.
-  HistogramTimer* rate = parse_info->is_eval()
+  HistogramTimer* rate = parse_info->flags().is_eval()
                              ? isolate->counters()->compile_eval()
                              : isolate->counters()->compile();
   HistogramTimerScope timer(rate);
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-               parse_info->is_eval() ? "V8.CompileEval" : "V8.Compile");
+               parse_info->flags().is_eval() ? "V8.CompileEval" : "V8.Compile");
 
-  // Generate the unoptimized bytecode or asm-js data.
-  MaybeHandle<SharedFunctionInfo> shared_info =
-      GenerateUnoptimizedCodeForToplevel(
-          isolate, script, parse_info, isolate->allocator(), is_compiled_scope);
-  if (shared_info.is_null()) {
+  // Prepare and execute compilation of the outer-most function.
+
+  // Create the SharedFunctionInfo and add it to the script's list.
+  Handle<SharedFunctionInfo> shared_info =
+      CreateTopLevelSharedFunctionInfo(parse_info, script, isolate);
+
+  FinalizeUnoptimizedCompilationDataList
+      finalize_unoptimized_compilation_data_list;
+
+  if (!IterativelyExecuteAndFinalizeUnoptimizedCompilationJobs(
+          isolate, shared_info, script, parse_info, isolate->allocator(),
+          is_compiled_scope, &finalize_unoptimized_compilation_data_list)) {
     FailWithPendingException(isolate, script, parse_info,
                              Compiler::ClearExceptionFlag::KEEP_EXCEPTION);
     return MaybeHandle<SharedFunctionInfo>();
   }
 
-  FinalizeScriptCompilation(isolate, script, parse_info);
+  // Character stream shouldn't be used again.
+  parse_info->ResetCharacterStream();
+
+  FinalizeUnoptimizedScriptCompilation(
+      isolate, script, parse_info->flags(), parse_info->state(),
+      finalize_unoptimized_compilation_data_list);
   return shared_info;
 }
 
@@ -1126,15 +1137,25 @@ std::unique_ptr<UnoptimizedCompilationJob> CompileOnBackgroundThread(
                "V8.CompileCodeBackground");
   RuntimeCallTimerScope runtimeTimer(
       parse_info->runtime_call_stats(),
-      parse_info->is_toplevel()
-          ? parse_info->is_eval()
+      parse_info->flags().is_toplevel()
+          ? parse_info->flags().is_eval()
                 ? RuntimeCallCounterId::kCompileBackgroundEval
                 : RuntimeCallCounterId::kCompileBackgroundScript
           : RuntimeCallCounterId::kCompileBackgroundFunction);
 
   // Generate the unoptimized bytecode or asm-js data.
-  std::unique_ptr<UnoptimizedCompilationJob> outer_function_job(
-      GenerateUnoptimizedCode(parse_info, allocator, inner_function_jobs));
+  DCHECK(inner_function_jobs->empty());
+
+  // TODO(leszeks): Once we can handle asm-js without bailing out of
+  // off-thread finalization entirely, and the finalization is off-thread by
+  // default, this can be changed to the iterative version.
+  std::unique_ptr<UnoptimizedCompilationJob> outer_function_job =
+      RecursivelyExecuteUnoptimizedCompilationJobs(
+          parse_info, parse_info->literal(), allocator, inner_function_jobs);
+
+  // Character stream shouldn't be used again.
+  parse_info->ResetCharacterStream();
+
   return outer_function_job;
 }
 
@@ -1149,55 +1170,67 @@ MaybeHandle<SharedFunctionInfo> CompileToplevel(
 
 BackgroundCompileTask::BackgroundCompileTask(ScriptStreamingData* streamed_data,
                                              Isolate* isolate)
-    : info_(new ParseInfo(isolate)),
-      off_thread_isolate_(FLAG_finalize_streaming_on_background
-                              ? new OffThreadIsolate(isolate, info_->zone())
-                              : nullptr),
+    : flags_(UnoptimizedCompileFlags::ForToplevelCompile(
+          isolate, true, construct_language_mode(FLAG_use_strict),
+          REPLMode::kNo)),
+      compile_state_(isolate),
+      info_(std::make_unique<ParseInfo>(isolate, flags_, &compile_state_)),
+      start_position_(0),
+      end_position_(0),
+      function_literal_id_(kFunctionLiteralIdTopLevel),
       stack_size_(i::FLAG_stack_size),
       worker_thread_runtime_call_stats_(
           isolate->counters()->worker_thread_runtime_call_stats()),
-      allocator_(isolate->allocator()),
       timer_(isolate->counters()->compile_script_on_background()),
-      collected_source_positions_(false) {
+      language_mode_(info_->language_mode()) {
   VMState<PARSER> state(isolate);
 
   // Prepare the data for the internalization phase and compilation phase, which
   // will happen in the main thread after parsing.
+
   LOG(isolate, ScriptEvent(Logger::ScriptEventType::kStreamingCompile,
-                           info_->script_id()));
-  info_->SetFlagsForToplevelCompile(isolate->is_collecting_type_profile(), true,
-                                    construct_language_mode(FLAG_use_strict),
-                                    REPLMode::kNo);
-  language_mode_ = info_->language_mode();
+                           info_->flags().script_id()));
 
   std::unique_ptr<Utf16CharacterStream> stream(ScannerStream::For(
       streamed_data->source_stream.get(), streamed_data->encoding));
   info_->set_character_stream(std::move(stream));
 
-  finalize_on_background_thread_ = FLAG_finalize_streaming_on_background;
+  // TODO(leszeks): Add block coverage support to off-thread finalization.
+  finalize_on_background_thread_ =
+      FLAG_finalize_streaming_on_background && !flags_.block_coverage_enabled();
+  if (finalize_on_background_thread()) {
+    off_thread_isolate_ =
+        std::make_unique<OffThreadIsolate>(isolate, info_->zone());
+  }
 }
 
 BackgroundCompileTask::BackgroundCompileTask(
-    AccountingAllocator* allocator, const ParseInfo* outer_parse_info,
-    const AstRawString* function_name, const FunctionLiteral* function_literal,
+    const ParseInfo* outer_parse_info, const AstRawString* function_name,
+    const FunctionLiteral* function_literal,
     WorkerThreadRuntimeCallStats* worker_thread_runtime_stats,
     TimedHistogram* timer, int max_stack_size)
-    : info_(ParseInfo::FromParent(outer_parse_info, allocator, function_literal,
-                                  function_name)),
+    : flags_(UnoptimizedCompileFlags::ForToplevelFunction(
+          outer_parse_info->flags(), function_literal)),
+      compile_state_(*outer_parse_info->state()),
+      info_(ParseInfo::ForToplevelFunction(flags_, &compile_state_,
+                                           function_literal, function_name)),
+      start_position_(function_literal->start_position()),
+      end_position_(function_literal->end_position()),
+      function_literal_id_(function_literal->function_literal_id()),
       stack_size_(max_stack_size),
       worker_thread_runtime_call_stats_(worker_thread_runtime_stats),
-      allocator_(allocator),
       timer_(timer),
       language_mode_(info_->language_mode()),
-      collected_source_positions_(false),
       finalize_on_background_thread_(false) {
-  DCHECK(outer_parse_info->is_toplevel());
+  DCHECK_EQ(outer_parse_info->parameters_end_pos(), kNoSourcePosition);
+  DCHECK_NULL(outer_parse_info->extension());
+
   DCHECK(!function_literal->is_toplevel());
 
   // Clone the character stream so both can be accessed independently.
   std::unique_ptr<Utf16CharacterStream> character_stream =
       outer_parse_info->character_stream()->Clone();
-  character_stream->Seek(function_literal->start_position());
+  character_stream->Seek(start_position_);
   info_->set_character_stream(std::move(character_stream));
 
   // Get preparsed scope data from the function literal.
@@ -1225,14 +1258,14 @@ class OffThreadParseInfoScope {
         original_runtime_call_stats_(parse_info_->runtime_call_stats()),
         original_stack_limit_(parse_info_->stack_limit()),
         worker_thread_scope_(worker_thread_runtime_stats) {
-    parse_info_->set_runtime_call_stats(worker_thread_scope_.Get());
-    parse_info_->set_stack_limit(GetCurrentStackPosition() - stack_size * KB);
+    parse_info_->SetPerThreadState(GetCurrentStackPosition() - stack_size * KB,
+                                   worker_thread_scope_.Get());
   }
 
   ~OffThreadParseInfoScope() {
     DCHECK_NOT_NULL(parse_info_);
-    parse_info_->set_stack_limit(original_stack_limit_);
-    parse_info_->set_runtime_call_stats(original_runtime_call_stats_);
+    parse_info_->SetPerThreadState(original_stack_limit_,
+                                   original_runtime_call_stats_);
   }
 
  private:
@@ -1244,6 +1277,20 @@ class OffThreadParseInfoScope {
   DISALLOW_COPY_AND_ASSIGN(OffThreadParseInfoScope);
 };
 
+bool CanOffThreadFinalizeAllJobs(
+    UnoptimizedCompilationJob* outer_job,
+    const UnoptimizedCompilationJobList& inner_function_jobs) {
+  if (!outer_job->can_off_thread_finalize()) return false;
+
+  for (auto& job : inner_function_jobs) {
+    if (!job->can_off_thread_finalize()) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
 }  // namespace
 
 void BackgroundCompileTask::Run() {
@@ -1270,82 +1317,94 @@ void BackgroundCompileTask::Run() {
   parser_.reset(new Parser(info_.get()));
   parser_->InitializeEmptyScopeChain(info_.get());
 
-  parser_->ParseOnBackground(info_.get());
+  parser_->ParseOnBackground(info_.get(), start_position_, end_position_,
+                             function_literal_id_);
   if (info_->literal() != nullptr) {
     // Parsing has succeeded, compile.
-    outer_function_job_ = CompileOnBackgroundThread(info_.get(), allocator_,
-                                                    &inner_function_jobs_);
-    // Save the language mode and record whether we collected source positions.
-    language_mode_ = info_->language_mode();
-    collected_source_positions_ = info_->collect_source_positions();
-
-    if (finalize_on_background_thread_) {
-      DCHECK(info_->is_toplevel());
+    outer_function_job_ = CompileOnBackgroundThread(
+        info_.get(), compile_state_.allocator(), &inner_function_jobs_);
+  }
+  // Save the language mode and record whether we collected source positions.
+  language_mode_ = info_->language_mode();
 
-      TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-                   "V8.FinalizeCodeBackground");
+  // We don't currently support off-thread finalization for some jobs (namely,
+  // asm.js), so release the off-thread isolate and fall back to main-thread
+  // finalization.
+  // TODO(leszeks): Still finalize Ignition tasks on the background thread,
+  // and fallback to main-thread finalization for asm.js jobs only.
+  finalize_on_background_thread_ =
+      finalize_on_background_thread_ && outer_function_job_ &&
+      CanOffThreadFinalizeAllJobs(outer_function_job(), *inner_function_jobs());
+
+  if (!finalize_on_background_thread_) {
+    off_thread_isolate_.reset();
+    return;
+  }
 
-      off_thread_isolate_->PinToCurrentThread();
+  // ---
+  // At this point, off-thread compilation has completed and we are off-thread
+  // finalizing.
+  // ---
 
-      OffThreadHandleScope handle_scope(off_thread_isolate_.get());
+  DCHECK(info_->flags().is_toplevel());
 
-      // We don't have the script source or the script origin yet, so use a few
-      // default values for them. These will be fixed up during the main-thread
-      // merge.
-      Handle<Script> script =
-          info_->CreateScript(off_thread_isolate_.get(),
-                              off_thread_isolate_->factory()->empty_string(),
-                              ScriptOriginOptions(), NOT_NATIVES_CODE);
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
+               "V8.FinalizeCodeBackground");
 
-      Handle<SharedFunctionInfo> outer_function_sfi =
-          FinalizeTopLevel(info_.get(), script, off_thread_isolate_.get(),
-                           outer_function_job_.get(), &inner_function_jobs_)
-              .ToHandleChecked();
+  OffThreadIsolate* isolate = off_thread_isolate();
+  isolate->PinToCurrentThread();
 
-      parser_->HandleSourceURLComments(off_thread_isolate_.get(), script);
+  OffThreadHandleScope handle_scope(isolate);
 
-      TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-                   "V8.FinalizeCodeBackground.Finish");
-      off_thread_isolate_->FinishOffThread();
+  // We don't have the script source, origin, or details yet, so use default
+  // values for them. These will be fixed up during the main-thread merge.
+  Handle<Script> script =
+      info_->CreateScript(isolate, isolate->factory()->empty_string(),
+                          kNullMaybeHandle, ScriptOriginOptions());
 
-      // Off-thread handles will become invalid after the handle scope closes,
-      // so save the raw object here.
-      outer_function_sfi_ = *outer_function_sfi;
+  MaybeHandle<SharedFunctionInfo> maybe_result;
+  if (info_->literal() != nullptr) {
+    info_->ast_value_factory()->Internalize(isolate);
 
-      TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-                   "V8.FinalizeCodeBackground.ReleaseParser");
-      DCHECK_EQ(language_mode_, info_->language_mode());
-      off_thread_scope.reset();
-      parser_.reset();
-      info_.reset();
-      outer_function_job_.reset();
-      inner_function_jobs_.clear();
+    Handle<SharedFunctionInfo> shared_info =
+        CreateTopLevelSharedFunctionInfo(info_.get(), script, isolate);
+    if (FinalizeAllUnoptimizedCompilationJobs(
+            info_.get(), isolate, shared_info, outer_function_job_.get(),
+            &inner_function_jobs_, &finalize_unoptimized_compilation_data_)) {
+      maybe_result = shared_info;
     }
+
+    parser_->HandleSourceURLComments(isolate, script);
+  } else {
+    DCHECK(!outer_function_job_);
   }
-}
 
-// ----------------------------------------------------------------------------
-// Implementation of Compiler
+  Handle<SharedFunctionInfo> result;
+  if (!maybe_result.ToHandle(&result)) {
+    DCHECK(compile_state_.pending_error_handler()->has_pending_error());
+    PreparePendingException(isolate, info_.get());
+  }
 
-bool Compiler::Analyze(ParseInfo* parse_info) {
-  DCHECK_NOT_NULL(parse_info->literal());
-  RuntimeCallTimerScope runtimeTimer(parse_info->runtime_call_stats(),
-                                     RuntimeCallCounterId::kCompileAnalyse,
-                                     RuntimeCallStats::kThreadSpecific);
-  if (!Rewriter::Rewrite(parse_info)) return false;
-  if (!DeclarationScope::Analyze(parse_info)) return false;
-  return true;
-}
+  outer_function_sfi_ = isolate->TransferHandle(maybe_result);
+  script_ = isolate->TransferHandle(script);
 
-bool Compiler::ParseAndAnalyze(ParseInfo* parse_info,
-                               Handle<SharedFunctionInfo> shared_info,
-                               Isolate* isolate) {
-  if (!parsing::ParseAny(parse_info, shared_info, isolate)) {
-    return false;
-  }
-  return Compiler::Analyze(parse_info);
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
+               "V8.FinalizeCodeBackground.Finish");
+  isolate->FinishOffThread();
+
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
+               "V8.FinalizeCodeBackground.ReleaseParser");
+  DCHECK_EQ(language_mode_, info_->language_mode());
+  off_thread_scope.reset();
+  parser_.reset();
+  info_.reset();
+  outer_function_job_.reset();
+  inner_function_jobs_.clear();
 }
 
+// ----------------------------------------------------------------------------
+// Implementation of Compiler
+
 // static
 bool Compiler::CollectSourcePositions(Isolate* isolate,
                                       Handle<SharedFunctionInfo> shared_info) {
@@ -1385,10 +1444,14 @@ bool Compiler::CollectSourcePositions(Isolate* isolate,
   HistogramTimerScope timer(isolate->counters()->collect_source_positions());
 
   // Set up parse info.
-  ParseInfo parse_info(isolate, *shared_info);
-  parse_info.set_lazy_compile();
-  parse_info.set_collect_source_positions();
-  if (FLAG_allow_natives_syntax) parse_info.set_allow_natives_syntax();
+  UnoptimizedCompileFlags flags =
+      UnoptimizedCompileFlags::ForFunctionCompile(isolate, *shared_info);
+  flags.set_is_lazy_compile(true);
+  flags.set_collect_source_positions(true);
+  flags.set_allow_natives_syntax(FLAG_allow_natives_syntax);
+
+  UnoptimizedCompileState compile_state(isolate);
+  ParseInfo parse_info(isolate, flags, &compile_state);
 
   // Parse and update ParseInfo with the results. Don't update parsing
   // statistics since we've already parsed the code before.
@@ -1396,9 +1459,7 @@ bool Compiler::CollectSourcePositions(Isolate* isolate,
                          parsing::ReportErrorsAndStatisticsMode::kNo)) {
     // Parsing failed probably as a result of stack exhaustion.
     bytecode->SetSourcePositionsFailedToCollect();
-    return FailWithPendingException(
-        isolate, handle(Script::cast(shared_info->script()), isolate),
-        &parse_info, Compiler::ClearExceptionFlag::CLEAR_EXCEPTION);
+    return FailAndClearPendingException(isolate);
   }
 
   // Character stream shouldn't be used again.
@@ -1409,14 +1470,6 @@ bool Compiler::CollectSourcePositions(Isolate* isolate,
   // wasting time fully parsing them when they won't ever be used.
   std::unique_ptr<UnoptimizedCompilationJob> job;
   {
-    if (!Compiler::Analyze(&parse_info)) {
-      // Recompiling failed probably as a result of stack exhaustion.
-      bytecode->SetSourcePositionsFailedToCollect();
-      return FailWithPendingException(
-          isolate, handle(Script::cast(shared_info->script()), isolate),
-          &parse_info, Compiler::ClearExceptionFlag::CLEAR_EXCEPTION);
-    }
-
     job = interpreter::Interpreter::NewSourcePositionCollectionJob(
         &parse_info, parse_info.literal(), bytecode, isolate->allocator());
 
@@ -1424,13 +1477,11 @@ bool Compiler::CollectSourcePositions(Isolate* isolate,
         job->FinalizeJob(shared_info, isolate) != CompilationJob::SUCCEEDED) {
       // Recompiling failed probably as a result of stack exhaustion.
       bytecode->SetSourcePositionsFailedToCollect();
-      return FailWithPendingException(
-          isolate, handle(Script::cast(shared_info->script()), isolate),
-          &parse_info, Compiler::ClearExceptionFlag::CLEAR_EXCEPTION);
+      return FailAndClearPendingException(isolate);
     }
   }
 
-  DCHECK(job->compilation_info()->collect_source_positions());
+  DCHECK(job->compilation_info()->flags().collect_source_positions());
 
   // If debugging, make sure that instrumented bytecode has the source position
   // table set on it as well.
@@ -1467,17 +1518,21 @@ bool Compiler::Compile(Handle<SharedFunctionInfo> shared_info,
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"), "V8.CompileCode");
   AggregatedHistogramTimerScope timer(isolate->counters()->compile_lazy());
 
+  Handle<Script> script(Script::cast(shared_info->script()), isolate);
+
   // Set up parse info.
-  ParseInfo parse_info(isolate, *shared_info);
-  parse_info.set_lazy_compile();
+  UnoptimizedCompileFlags flags =
+      UnoptimizedCompileFlags::ForFunctionCompile(isolate, *shared_info);
+  flags.set_is_lazy_compile(true);
+
+  UnoptimizedCompileState compile_state(isolate);
+  ParseInfo parse_info(isolate, flags, &compile_state);
 
   // Check if the compiler dispatcher has shared_info enqueued for compile.
   CompilerDispatcher* dispatcher = isolate->compiler_dispatcher();
   if (dispatcher->IsEnqueued(shared_info)) {
     if (!dispatcher->FinishNow(shared_info)) {
-      return FailWithPendingException(
-          isolate, handle(Script::cast(shared_info->script()), isolate),
-          &parse_info, flag);
+      return FailWithPendingException(isolate, script, &parse_info, flag);
     }
     *is_compiled_scope = shared_info->is_compiled_scope();
     DCHECK(is_compiled_scope->is_compiled());
@@ -1494,55 +1549,24 @@ bool Compiler::Compile(Handle<SharedFunctionInfo> shared_info,
 
   // Parse and update ParseInfo with the results.
   if (!parsing::ParseAny(&parse_info, shared_info, isolate)) {
-    return FailWithPendingException(
-        isolate, handle(Script::cast(shared_info->script()), isolate),
-        &parse_info, flag);
+    return FailWithPendingException(isolate, script, &parse_info, flag);
   }
 
   // Generate the unoptimized bytecode or asm-js data.
-  UnoptimizedCompilationJobList inner_function_jobs;
-  std::unique_ptr<UnoptimizedCompilationJob> outer_function_job(
-      GenerateUnoptimizedCode(&parse_info, isolate->allocator(),
-                              &inner_function_jobs));
-  if (!outer_function_job) {
-    return FailWithPendingException(
-        isolate, handle(Script::cast(shared_info->script()), isolate),
-        &parse_info, flag);
-  }
-
-  // Internalize ast values onto the heap.
-  parse_info.ast_value_factory()->Internalize(isolate);
+  FinalizeUnoptimizedCompilationDataList
+      finalize_unoptimized_compilation_data_list;
 
-  // Finalize compilation of the unoptimized bytecode or asm-js data.
-  if (!FinalizeUnoptimizedCode(&parse_info, isolate, shared_info,
-                               outer_function_job.get(),
-                               &inner_function_jobs)) {
-    return FailWithPendingException(
-        isolate, handle(Script::cast(shared_info->script()), isolate),
-        &parse_info, flag);
+  if (!IterativelyExecuteAndFinalizeUnoptimizedCompilationJobs(
+          isolate, shared_info, script, &parse_info, isolate->allocator(),
+          is_compiled_scope, &finalize_unoptimized_compilation_data_list)) {
+    return FailWithPendingException(isolate, script, &parse_info, flag);
   }
 
+  FinalizeUnoptimizedCompilation(isolate, script, flags, &compile_state,
+                                 finalize_unoptimized_compilation_data_list);
+
   DCHECK(!isolate->has_pending_exception());
-  *is_compiled_scope = shared_info->is_compiled_scope();
   DCHECK(is_compiled_scope->is_compiled());
-
-  if (FLAG_stress_lazy_source_positions) {
-    // Collect source positions immediately to try and flush out bytecode
-    // mismatches.
-    SharedFunctionInfo::EnsureSourcePositionsAvailable(isolate, shared_info);
-
-    Handle<Script> script(Script::cast(shared_info->script()), isolate);
-
-    // Do the same for eagerly compiled inner functions.
-    for (auto&& inner_job : inner_function_jobs) {
-      Handle<SharedFunctionInfo> inner_shared_info =
-          Compiler::GetSharedFunctionInfo(
-              inner_job->compilation_info()->literal(), script, isolate);
-      SharedFunctionInfo::EnsureSourcePositionsAvailable(isolate,
-                                                         inner_shared_info);
-    }
-  }
-
   return true;
 }
 
@@ -1601,13 +1625,15 @@ bool Compiler::Compile(Handle<JSFunction> function, ClearExceptionFlag flag,
 bool Compiler::FinalizeBackgroundCompileTask(
     BackgroundCompileTask* task, Handle<SharedFunctionInfo> shared_info,
     Isolate* isolate, ClearExceptionFlag flag) {
+  DCHECK(!task->finalize_on_background_thread());
+
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
                "V8.FinalizeBackgroundCompileTask");
   RuntimeCallTimerScope runtimeTimer(
       isolate, RuntimeCallCounterId::kCompileFinalizeBackgroundCompileTask);
   HandleScope scope(isolate);
   ParseInfo* parse_info = task->info();
-  DCHECK(!parse_info->is_toplevel());
+  DCHECK(!parse_info->flags().is_toplevel());
   DCHECK(!shared_info->is_compiled());
 
   Handle<Script> script(Script::cast(shared_info->script()), isolate);
@@ -1623,12 +1649,16 @@ bool Compiler::FinalizeBackgroundCompileTask(
 
   // Parsing has succeeded - finalize compilation.
   parse_info->ast_value_factory()->Internalize(isolate);
-  if (!FinalizeUnoptimizedCode(parse_info, isolate, shared_info,
-                               task->outer_function_job(),
-                               task->inner_function_jobs())) {
+  if (!FinalizeAllUnoptimizedCompilationJobs(
+          parse_info, isolate, shared_info, task->outer_function_job(),
+          task->inner_function_jobs(),
+          task->finalize_unoptimized_compilation_data())) {
     // Finalization failed - throw an exception.
     return FailWithPendingException(isolate, script, parse_info, flag);
   }
+  FinalizeUnoptimizedCompilation(
+      isolate, script, parse_info->flags(), parse_info->state(),
+      *task->finalize_unoptimized_compilation_data());
 
   DCHECK(!isolate->has_pending_exception());
   DCHECK(shared_info->is_compiled());
@@ -1717,22 +1747,23 @@ MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
     is_compiled_scope = shared_info->is_compiled_scope();
     allow_eval_cache = true;
   } else {
-    ParseInfo parse_info(isolate);
-    parse_info.SetFlagsForToplevelCompile(isolate->is_collecting_type_profile(),
-                                          true, language_mode, REPLMode::kNo);
+    UnoptimizedCompileFlags flags = UnoptimizedCompileFlags::ForToplevelCompile(
+        isolate, true, language_mode, REPLMode::kNo);
+    flags.set_is_eval(true);
+    flags.set_parse_restriction(restriction);
 
-    parse_info.set_eval();
-    parse_info.set_parse_restriction(restriction);
+    UnoptimizedCompileState compile_state(isolate);
+    ParseInfo parse_info(isolate, flags, &compile_state);
     parse_info.set_parameters_end_pos(parameters_end_pos);
-    DCHECK(!parse_info.is_module());
+    DCHECK(!parse_info.flags().is_module());
 
     MaybeHandle<ScopeInfo> maybe_outer_scope_info;
     if (!context->IsNativeContext()) {
       maybe_outer_scope_info = handle(context->scope_info(), isolate);
     }
-
-    script = parse_info.CreateScript(
-        isolate, source, OriginOptionsForEval(outer_info->script()));
+    script =
+        parse_info.CreateScript(isolate, source, kNullMaybeHandle,
+                                OriginOptionsForEval(outer_info->script()));
     script->set_eval_from_shared(*outer_info);
     if (eval_position == kNoSourcePosition) {
       // If the position is missing, attempt to get the code offset by
@@ -1817,7 +1848,6 @@ bool CodeGenerationFromStringsAllowed(Isolate* isolate, Handle<Context> context,
 // (via v8::Isolate::SetModifyCodeGenerationFromStringsCallback)
 bool ModifyCodeGenerationFromStrings(Isolate* isolate, Handle<Context> context,
                                      Handle<i::Object>* source) {
-  DCHECK(context->allow_code_gen_from_strings().IsFalse(isolate));
   DCHECK(isolate->modify_code_gen_callback());
   DCHECK(source);
 
@@ -1858,10 +1888,8 @@ std::pair<MaybeHandle<String>, bool> Compiler::ValidateDynamicCompilationSource(
   // allow_code_gen_from_strings can be many things, so we'll always check
   // against the 'false' literal, so that e.g. undefined and 'true' are treated
   // the same.
-  if (!context->allow_code_gen_from_strings().IsFalse(isolate)) {
-    if (!original_source->IsString()) {
-      return {MaybeHandle<String>(), true};
-    }
+  if (!context->allow_code_gen_from_strings().IsFalse(isolate) &&
+      original_source->IsString()) {
     return {Handle<String>::cast(original_source), false};
   }
 
@@ -2138,16 +2166,22 @@ struct ScriptCompileTimerScope {
   }
 };
 
-void SetScriptFieldsFromDetails(Script script,
-                                Compiler::ScriptDetails script_details) {
+void SetScriptFieldsFromDetails(Isolate* isolate, Script script,
+                                Compiler::ScriptDetails script_details,
+                                DisallowHeapAllocation* no_gc) {
   Handle<Object> script_name;
   if (script_details.name_obj.ToHandle(&script_name)) {
     script.set_name(*script_name);
     script.set_line_offset(script_details.line_offset);
     script.set_column_offset(script_details.column_offset);
   }
+  // The API can provide a source map URL, but a source map URL could also have
+  // been inferred by the parser from a magic comment. The latter takes
+  // preference over the former, so we don't want to override the source mapping
+  // URL if it already exists.
   Handle<Object> source_map_url;
-  if (script_details.source_map_url.ToHandle(&source_map_url)) {
+  if (script_details.source_map_url.ToHandle(&source_map_url) &&
+      script.source_mapping_url(isolate).IsUndefined(isolate)) {
     script.set_source_mapping_url(*source_map_url);
   }
   Handle<FixedArray> host_defined_options;
@@ -2156,31 +2190,139 @@ void SetScriptFieldsFromDetails(Script script,
   }
 }
 
-Handle<Script> NewScript(Isolate* isolate, ParseInfo* parse_info,
-                         Handle<String> source,
-                         Compiler::ScriptDetails script_details,
-                         ScriptOriginOptions origin_options,
-                         NativesFlag natives) {
+Handle<Script> NewScript(
+    Isolate* isolate, ParseInfo* parse_info, Handle<String> source,
+    Compiler::ScriptDetails script_details, ScriptOriginOptions origin_options,
+    NativesFlag natives,
+    MaybeHandle<FixedArray> maybe_wrapped_arguments = kNullMaybeHandle) {
   // Create a script object describing the script to be compiled.
-  Handle<Script> script =
-      parse_info->CreateScript(isolate, source, origin_options, natives);
-  SetScriptFieldsFromDetails(*script, script_details);
+  Handle<Script> script = parse_info->CreateScript(
+      isolate, source, maybe_wrapped_arguments, origin_options, natives);
+  DisallowHeapAllocation no_gc;
+  SetScriptFieldsFromDetails(isolate, *script, script_details, &no_gc);
   LOG(isolate, ScriptDetails(*script));
   return script;
 }
 
-void FixUpOffThreadAllocatedScript(Isolate* isolate, Handle<Script> script,
-                                   Handle<String> source,
-                                   Compiler::ScriptDetails script_details,
-                                   ScriptOriginOptions origin_options,
-                                   NativesFlag natives) {
-  DisallowHeapAllocation no_gc;
-  DCHECK_EQ(natives, NOT_NATIVES_CODE);
-  DCHECK_EQ(script_details.repl_mode, REPLMode::kNo);
-  script->set_origin_options(origin_options);
-  script->set_source(*source);
-  SetScriptFieldsFromDetails(*script, script_details);
-  LOG(isolate, ScriptDetails(*script));
+MaybeHandle<SharedFunctionInfo> CompileScriptOnMainThread(
+    const UnoptimizedCompileFlags flags, Handle<String> source,
+    const Compiler::ScriptDetails& script_details,
+    ScriptOriginOptions origin_options, NativesFlag natives,
+    v8::Extension* extension, Isolate* isolate,
+    IsCompiledScope* is_compiled_scope) {
+  UnoptimizedCompileState compile_state(isolate);
+  ParseInfo parse_info(isolate, flags, &compile_state);
+  parse_info.set_extension(extension);
+
+  Handle<Script> script = NewScript(isolate, &parse_info, source,
+                                    script_details, origin_options, natives);
+  DCHECK_IMPLIES(parse_info.flags().collect_type_profile(),
+                 script->IsUserJavaScript());
+  DCHECK_EQ(parse_info.flags().is_repl_mode(), script->is_repl_mode());
+
+  return CompileToplevel(&parse_info, script, isolate, is_compiled_scope);
+}
+
+class StressBackgroundCompileThread : public base::Thread {
+ public:
+  StressBackgroundCompileThread(Isolate* isolate, Handle<String> source)
+      : base::Thread(
+            base::Thread::Options("StressBackgroundCompileThread", 2 * i::MB)),
+        source_(source),
+        streamed_source_(std::make_unique<SourceStream>(source, isolate),
+                         v8::ScriptCompiler::StreamedSource::UTF8) {
+    data()->task = std::make_unique<i::BackgroundCompileTask>(data(), isolate);
+  }
+
+  void Run() override { data()->task->Run(); }
+
+  ScriptStreamingData* data() { return streamed_source_.impl(); }
+
+ private:
+  // Dummy external source stream which returns the whole source in one go.
+  // TODO(leszeks): Also test chunking the data.
+  class SourceStream : public v8::ScriptCompiler::ExternalSourceStream {
+   public:
+    SourceStream(Handle<String> source, Isolate* isolate) : done_(false) {
+      source_buffer_ = source->ToCString(ALLOW_NULLS, FAST_STRING_TRAVERSAL,
+                                         &source_length_);
+    }
+
+    size_t GetMoreData(const uint8_t** src) override {
+      if (done_) {
+        return 0;
+      }
+      *src = reinterpret_cast<uint8_t*>(source_buffer_.release());
+      done_ = true;
+
+      return source_length_;
+    }
+
+   private:
+    int source_length_;
+    std::unique_ptr<char[]> source_buffer_;
+    bool done_;
+  };
+
+  Handle<String> source_;
+  v8::ScriptCompiler::StreamedSource streamed_source_;
+};
+
+bool CanBackgroundCompile(const Compiler::ScriptDetails& script_details,
+                          ScriptOriginOptions origin_options,
+                          v8::Extension* extension,
+                          ScriptCompiler::CompileOptions compile_options,
+                          NativesFlag natives) {
+  // TODO(leszeks): Remove the module check once background compilation of
+  // modules is supported.
+  return !origin_options.IsModule() && !extension &&
+         script_details.repl_mode == REPLMode::kNo &&
+         compile_options == ScriptCompiler::kNoCompileOptions &&
+         natives == NOT_NATIVES_CODE;
+}
+
+MaybeHandle<SharedFunctionInfo> CompileScriptOnBothBackgroundAndMainThread(
+    Handle<String> source, const Compiler::ScriptDetails& script_details,
+    ScriptOriginOptions origin_options, Isolate* isolate,
+    IsCompiledScope* is_compiled_scope) {
+  // Start a background thread compiling the script.
+  StressBackgroundCompileThread background_compile_thread(isolate, source);
+
+  UnoptimizedCompileFlags flags_copy =
+      background_compile_thread.data()->task->flags();
+
+  CHECK(background_compile_thread.Start());
+  MaybeHandle<SharedFunctionInfo> main_thread_maybe_result;
+  // In parallel, compile on the main thread to flush out any data races.
+  {
+    IsCompiledScope inner_is_compiled_scope;
+    // The background thread should also create any relevant exceptions, so we
+    // can ignore the main-thread created ones.
+    // TODO(leszeks): Maybe verify that any thrown (or unthrown) exceptions are
+    // equivalent.
+    TryCatch ignore_try_catch(reinterpret_cast<v8::Isolate*>(isolate));
+    flags_copy.set_script_id(Script::kTemporaryScriptId);
+    main_thread_maybe_result = CompileScriptOnMainThread(
+        flags_copy, source, script_details, origin_options, NOT_NATIVES_CODE,
+        nullptr, isolate, &inner_is_compiled_scope);
+  }
+  // Join with background thread and finalize compilation.
+  background_compile_thread.Join();
+  MaybeHandle<SharedFunctionInfo> maybe_result =
+      Compiler::GetSharedFunctionInfoForStreamedScript(
+          isolate, source, script_details, origin_options,
+          background_compile_thread.data());
+
+  // Either both compiles should succeed, or both should fail.
+  // TODO(leszeks): Compare the contents of the results of the two compiles.
+  CHECK_EQ(maybe_result.is_null(), main_thread_maybe_result.is_null());
+
+  Handle<SharedFunctionInfo> result;
+  if (maybe_result.ToHandle(&result)) {
+    *is_compiled_scope = result->is_compiled_scope();
+  }
+
+  return maybe_result;
 }
 
 }  // namespace
@@ -2254,25 +2396,28 @@ MaybeHandle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForScript(
 
   if (maybe_result.is_null()) {
     // No cache entry found compile the script.
-    ParseInfo parse_info(isolate);
-
-    parse_info.SetFlagsForToplevelCompile(
-        isolate->is_collecting_type_profile(), natives == NOT_NATIVES_CODE,
-        language_mode, script_details.repl_mode);
+    if (FLAG_stress_background_compile &&
+        CanBackgroundCompile(script_details, origin_options, extension,
+                             compile_options, natives)) {
+      // If the --stress-background-compile flag is set, do the actual
+      // compilation on a background thread, and wait for its result.
+      maybe_result = CompileScriptOnBothBackgroundAndMainThread(
+          source, script_details, origin_options, isolate, &is_compiled_scope);
+    } else {
+      UnoptimizedCompileFlags flags =
+          UnoptimizedCompileFlags::ForToplevelCompile(
+              isolate, natives == NOT_NATIVES_CODE, language_mode,
+              script_details.repl_mode);
 
-    parse_info.set_module(origin_options.IsModule());
-    parse_info.set_extension(extension);
-    parse_info.set_eager(compile_options == ScriptCompiler::kEagerCompile);
+      flags.set_is_eager(compile_options == ScriptCompiler::kEagerCompile);
+      flags.set_is_module(origin_options.IsModule());
 
-    Handle<Script> script = NewScript(isolate, &parse_info, source,
-                                      script_details, origin_options, natives);
-    DCHECK_IMPLIES(parse_info.collect_type_profile(),
-                   script->IsUserJavaScript());
-    DCHECK_EQ(parse_info.is_repl_mode(), script->is_repl_mode());
+      maybe_result = CompileScriptOnMainThread(
+          flags, source, script_details, origin_options, natives, extension,
+          isolate, &is_compiled_scope);
+    }
 
-    // Compile the function and add it to the isolate cache.
-    maybe_result =
-        CompileToplevel(&parse_info, script, isolate, &is_compiled_scope);
+    // Add the result to the isolate cache.
     Handle<SharedFunctionInfo> result;
     if (extension == nullptr && maybe_result.ToHandle(&result)) {
       DCHECK(is_compiled_scope.is_compiled());
@@ -2331,18 +2476,18 @@ MaybeHandle<JSFunction> Compiler::GetWrappedFunction(
   Handle<Script> script;
   IsCompiledScope is_compiled_scope;
   if (!maybe_result.ToHandle(&wrapped)) {
-    ParseInfo parse_info(isolate);
-    parse_info.SetFlagsForToplevelCompile(isolate->is_collecting_type_profile(),
-                                          true, language_mode,
-                                          script_details.repl_mode);
-
-    parse_info.set_eval();  // Use an eval scope as declaration scope.
-    parse_info.set_function_syntax_kind(FunctionSyntaxKind::kWrapped);
+    UnoptimizedCompileFlags flags = UnoptimizedCompileFlags::ForToplevelCompile(
+        isolate, true, language_mode, script_details.repl_mode);
+    flags.set_is_eval(true);  // Use an eval scope as declaration scope.
+    flags.set_function_syntax_kind(FunctionSyntaxKind::kWrapped);
     // TODO(delphick): Remove this and instead make the wrapped and wrapper
     // functions fully non-lazy instead thus preventing source positions from
     // being omitted.
-    parse_info.set_collect_source_positions(true);
-    // parse_info.set_eager(compile_options == ScriptCompiler::kEagerCompile);
+    flags.set_collect_source_positions(true);
+    // flags.set_eager(compile_options == ScriptCompiler::kEagerCompile);
+
+    UnoptimizedCompileState compile_state(isolate);
+    ParseInfo parse_info(isolate, flags, &compile_state);
 
     MaybeHandle<ScopeInfo> maybe_outer_scope_info;
     if (!context->IsNativeContext()) {
@@ -2350,8 +2495,7 @@ MaybeHandle<JSFunction> Compiler::GetWrappedFunction(
     }
 
     script = NewScript(isolate, &parse_info, source, script_details,
-                       origin_options, NOT_NATIVES_CODE);
-    script->set_wrapped_arguments(*arguments);
+                       origin_options, NOT_NATIVES_CODE, arguments);
 
     Handle<SharedFunctionInfo> top_level;
     maybe_result = CompileToplevel(&parse_info, script, maybe_outer_scope_info,
@@ -2383,6 +2527,9 @@ Compiler::GetSharedFunctionInfoForStreamedScript(
     Isolate* isolate, Handle<String> source,
     const ScriptDetails& script_details, ScriptOriginOptions origin_options,
     ScriptStreamingData* streaming_data) {
+  DCHECK(!origin_options.IsModule());
+  DCHECK(!origin_options.IsWasm());
+
   ScriptCompileTimerScope compile_timer(
       isolate, ScriptCompiler::kNoCacheBecauseStreamingSource);
   PostponeInterruptsScope postpone(isolate);
@@ -2410,73 +2557,71 @@ Compiler::GetSharedFunctionInfoForStreamedScript(
   }
 
   if (maybe_result.is_null()) {
+    // No cache entry found, finalize compilation of the script and add it to
+    // the isolate cache.
+
+    Handle<Script> script;
     if (task->finalize_on_background_thread()) {
       RuntimeCallTimerScope runtimeTimerScope(
           isolate, RuntimeCallCounterId::kCompilePublishBackgroundFinalization);
       TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
                    "V8.OffThreadFinalization.Publish");
 
-      Handle<SharedFunctionInfo> sfi(task->outer_function_sfi(), isolate);
-      Handle<Script> script(Script::cast(sfi->script()), isolate);
-      task->off_thread_isolate()->factory()->Publish(isolate);
-
-      FixUpOffThreadAllocatedScript(isolate, script, source, script_details,
-                                    origin_options, NOT_NATIVES_CODE);
-
-      // It's possible that source position collection was enabled after the
-      // background compile was started (for instance by enabling the cpu
-      // profiler), and the compiled bytecode is missing source positions. So,
-      // walk all the SharedFunctionInfos in the script and force source
-      // position collection.
-      if (!task->collected_source_positions() &&
-          isolate->NeedsDetailedOptimizedCodeLineInfo()) {
-        Handle<WeakFixedArray> shared_function_infos(
-            script->shared_function_infos(isolate), isolate);
-        int length = shared_function_infos->length();
-        FOR_WITH_HANDLE_SCOPE(isolate, int, i = 0, i, i < length, i++, {
-          Object entry = shared_function_infos->Get(isolate, i)
-                             .GetHeapObjectOrSmi(isolate);
-          if (entry.IsSharedFunctionInfo(isolate)) {
-            SharedFunctionInfo::EnsureSourcePositionsAvailable(
-                isolate, handle(SharedFunctionInfo::cast(entry), isolate));
-          }
-        });
-      }
+      task->off_thread_isolate()->Publish(isolate);
 
-      maybe_result = sfi;
+      maybe_result = task->outer_function_sfi();
+      script = task->script();
+      script->set_source(*source);
+      script->set_origin_options(origin_options);
     } else {
       ParseInfo* parse_info = task->info();
-      DCHECK(parse_info->is_toplevel());
+      DCHECK(parse_info->flags().is_toplevel());
+
+      script = parse_info->CreateScript(isolate, source, kNullMaybeHandle,
+                                        origin_options);
 
-      // No cache entry found, finalize compilation of the script and add it to
-      // the isolate cache.
-      Handle<Script> script =
-          NewScript(isolate, parse_info, source, script_details, origin_options,
-                    NOT_NATIVES_CODE);
       task->parser()->UpdateStatistics(isolate, script);
       task->parser()->HandleSourceURLComments(isolate, script);
 
-      if (parse_info->literal() == nullptr || !task->outer_function_job()) {
-        // Parsing has failed - report error messages.
-        FailWithPendingException(isolate, script, parse_info,
-                                 Compiler::ClearExceptionFlag::KEEP_EXCEPTION);
-      } else {
-        // Parsing has succeeded - finalize compilation.
-        maybe_result = FinalizeTopLevel(parse_info, script, isolate,
-                                        task->outer_function_job(),
-                                        task->inner_function_jobs());
-        if (maybe_result.is_null()) {
-          // Finalization failed - throw an exception.
-          FailWithPendingException(
-              isolate, script, parse_info,
-              Compiler::ClearExceptionFlag::KEEP_EXCEPTION);
+      if (parse_info->literal() != nullptr && task->outer_function_job()) {
+        // Off-thread parse & compile has succeeded - finalize compilation.
+        parse_info->ast_value_factory()->Internalize(isolate);
+
+        Handle<SharedFunctionInfo> shared_info =
+            CreateTopLevelSharedFunctionInfo(parse_info, script, isolate);
+        if (FinalizeAllUnoptimizedCompilationJobs(
+                parse_info, isolate, shared_info, task->outer_function_job(),
+                task->inner_function_jobs(),
+                task->finalize_unoptimized_compilation_data())) {
+          maybe_result = shared_info;
         }
       }
+
+      if (maybe_result.is_null()) {
+        // Compilation failed - prepare to throw an exception after script
+        // fields have been set.
+        PreparePendingException(isolate, parse_info);
+      }
+    }
+
+    // Set the script fields after finalization, to keep this path the same
+    // between main-thread and off-thread finalization.
+    {
+      DisallowHeapAllocation no_gc;
+      SetScriptFieldsFromDetails(isolate, *script, script_details, &no_gc);
+      LOG(isolate, ScriptDetails(*script));
     }
 
-    // Add compiled code to the isolate cache.
     Handle<SharedFunctionInfo> result;
-    if (maybe_result.ToHandle(&result)) {
+    if (!maybe_result.ToHandle(&result)) {
+      FailWithPreparedPendingException(
+          isolate, script, task->compile_state()->pending_error_handler());
+    } else {
+      FinalizeUnoptimizedScriptCompilation(
+          isolate, script, task->flags(), task->compile_state(),
+          *task->finalize_unoptimized_compilation_data());
+
+      // Add compiled code to the isolate cache.
       TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
                    "V8.StreamingFinalization.AddToCache");
       compilation_cache->PutScript(source, isolate->native_context(),
@@ -2497,7 +2642,8 @@ Handle<SharedFunctionInfo> Compiler::GetSharedFunctionInfo(
   MaybeHandle<SharedFunctionInfo> maybe_existing;
 
   // Find any previously allocated shared function info for the given literal.
-  maybe_existing = script->FindSharedFunctionInfo(isolate, literal);
+  maybe_existing =
+      script->FindSharedFunctionInfo(isolate, literal->function_literal_id());
 
   // If we found an existing shared function info, return it.
   Handle<SharedFunctionInfo> existing;
diff --git a/deps/v8/src/codegen/compiler.h b/deps/v8/src/codegen/compiler.h
index 7284003de96..b851d6abd6c 100644
--- a/deps/v8/src/codegen/compiler.h
+++ b/deps/v8/src/codegen/compiler.h
@@ -12,8 +12,11 @@
 #include "src/codegen/bailout-reason.h"
 #include "src/common/globals.h"
 #include "src/execution/isolate.h"
+#include "src/execution/off-thread-isolate.h"
 #include "src/logging/code-events.h"
 #include "src/objects/contexts.h"
+#include "src/parsing/parse-info.h"
+#include "src/parsing/pending-compilation-error-handler.h"
 #include "src/utils/allocation.h"
 #include "src/zone/zone.h"
 
@@ -91,13 +94,6 @@ class V8_EXPORT_PRIVATE Compiler : public AllStatic {
   // offer this chance, optimized closure instantiation will not call this.
   static void PostInstantiation(Handle<JSFunction> function);
 
-  // Parser::Parse, then Compiler::Analyze.
-  static bool ParseAndAnalyze(ParseInfo* parse_info,
-                              Handle<SharedFunctionInfo> shared_info,
-                              Isolate* isolate);
-  // Rewrite and analyze scopes.
-  static bool Analyze(ParseInfo* parse_info);
-
   // ===========================================================================
   // The following family of methods instantiates new functions for scripts or
   // function literals. The decision whether those functions will be compiled,
@@ -245,12 +241,17 @@ class V8_EXPORT_PRIVATE CompilationJob {
 // Either of phases can either fail or succeed.
 class UnoptimizedCompilationJob : public CompilationJob {
  public:
+  enum class CanOffThreadFinalize : bool { kYes = true, kNo = false };
+
   UnoptimizedCompilationJob(uintptr_t stack_limit, ParseInfo* parse_info,
-                            UnoptimizedCompilationInfo* compilation_info)
+                            UnoptimizedCompilationInfo* compilation_info,
+                            CanOffThreadFinalize can_off_thread_finalize)
       : CompilationJob(State::kReadyToExecute),
         stack_limit_(stack_limit),
         parse_info_(parse_info),
-        compilation_info_(compilation_info) {}
+        compilation_info_(compilation_info),
+        can_off_thread_finalize_(can_off_thread_finalize ==
+                                 CanOffThreadFinalize::kYes) {}
 
   // Executes the compile job. Can be called on a background thread.
   V8_WARN_UNUSED_RESULT Status ExecuteJob();
@@ -275,6 +276,15 @@ class UnoptimizedCompilationJob : public CompilationJob {
 
   uintptr_t stack_limit() const { return stack_limit_; }
 
+  base::TimeDelta time_taken_to_execute() const {
+    return time_taken_to_execute_;
+  }
+  base::TimeDelta time_taken_to_finalize() const {
+    return time_taken_to_finalize_;
+  }
+
+  bool can_off_thread_finalize() const { return can_off_thread_finalize_; }
+
  protected:
   // Overridden by the actual implementation.
   virtual Status ExecuteJobImpl() = 0;
@@ -289,6 +299,7 @@ class UnoptimizedCompilationJob : public CompilationJob {
   UnoptimizedCompilationInfo* compilation_info_;
   base::TimeDelta time_taken_to_execute_;
   base::TimeDelta time_taken_to_finalize_;
+  bool can_off_thread_finalize_;
 };
 
 // A base class for optimized compilation jobs.
@@ -350,6 +361,55 @@ class OptimizedCompilationJob : public CompilationJob {
   const char* compiler_name_;
 };
 
+class FinalizeUnoptimizedCompilationData {
+ public:
+  FinalizeUnoptimizedCompilationData(Isolate* isolate,
+                                     Handle<SharedFunctionInfo> function_handle,
+                                     base::TimeDelta time_taken_to_execute,
+                                     base::TimeDelta time_taken_to_finalize)
+      : time_taken_to_execute_(time_taken_to_execute),
+        time_taken_to_finalize_(time_taken_to_finalize),
+        function_handle_(function_handle),
+        handle_state_(kHandle) {}
+
+  FinalizeUnoptimizedCompilationData(OffThreadIsolate* isolate,
+                                     Handle<SharedFunctionInfo> function_handle,
+                                     base::TimeDelta time_taken_to_execute,
+                                     base::TimeDelta time_taken_to_finalize)
+      : time_taken_to_execute_(time_taken_to_execute),
+        time_taken_to_finalize_(time_taken_to_finalize),
+        function_transfer_handle_(isolate->TransferHandle(function_handle)),
+        handle_state_(kTransferHandle) {}
+
+  Handle<SharedFunctionInfo> function_handle() const {
+    switch (handle_state_) {
+      case kHandle:
+        return function_handle_;
+      case kTransferHandle:
+        return function_transfer_handle_.ToHandle();
+    }
+  }
+
+  base::TimeDelta time_taken_to_execute() const {
+    return time_taken_to_execute_;
+  }
+  base::TimeDelta time_taken_to_finalize() const {
+    return time_taken_to_finalize_;
+  }
+
+ private:
+  base::TimeDelta time_taken_to_execute_;
+  base::TimeDelta time_taken_to_finalize_;
+  union {
+    Handle<SharedFunctionInfo> function_handle_;
+    OffThreadTransferHandle<SharedFunctionInfo> function_transfer_handle_;
+  };
+  enum { kHandle, kTransferHandle } handle_state_;
+};
+
+using FinalizeUnoptimizedCompilationDataList =
+    std::vector<FinalizeUnoptimizedCompilationData>;
+
 class V8_EXPORT_PRIVATE BackgroundCompileTask {
  public:
   // Creates a new task that when run will parse and compile the streamed
@@ -363,8 +423,7 @@ class V8_EXPORT_PRIVATE BackgroundCompileTask {
   // |function_literal| and can be finalized with
   // Compiler::FinalizeBackgroundCompileTask.
   BackgroundCompileTask(
-      AccountingAllocator* allocator, const ParseInfo* outer_parse_info,
-      const AstRawString* function_name,
+      const ParseInfo* outer_parse_info, const AstRawString* function_name,
       const FunctionLiteral* function_literal,
       WorkerThreadRuntimeCallStats* worker_thread_runtime_stats,
       TimedHistogram* timer, int max_stack_size);
@@ -382,23 +441,34 @@ class V8_EXPORT_PRIVATE BackgroundCompileTask {
   UnoptimizedCompilationJobList* inner_function_jobs() {
     return &inner_function_jobs_;
   }
+  UnoptimizedCompileFlags flags() const { return flags_; }
+  const UnoptimizedCompileState* compile_state() const {
+    return &compile_state_;
+  }
   LanguageMode language_mode() { return language_mode_; }
-  bool collected_source_positions() { return collected_source_positions_; }
   bool finalize_on_background_thread() {
     return finalize_on_background_thread_;
   }
   OffThreadIsolate* off_thread_isolate() { return off_thread_isolate_.get(); }
-  SharedFunctionInfo outer_function_sfi() {
-    // Make sure that this is an off-thread object, so that it won't have been
-    // moved by the GC.
-    DCHECK(Heap::InOffThreadSpace(outer_function_sfi_));
-    return outer_function_sfi_;
+  MaybeHandle<SharedFunctionInfo> outer_function_sfi() {
+    DCHECK_NOT_NULL(off_thread_isolate_);
+    return outer_function_sfi_.ToHandle();
+  }
+  Handle<Script> script() {
+    DCHECK_NOT_NULL(off_thread_isolate_);
+    return script_.ToHandle();
+  }
+  FinalizeUnoptimizedCompilationDataList*
+  finalize_unoptimized_compilation_data() {
+    return &finalize_unoptimized_compilation_data_;
   }
 
  private:
   // Data needed for parsing, and data needed to to be passed between thread
   // between parsing and compilation. These need to be initialized before the
   // compilation starts.
+  UnoptimizedCompileFlags flags_;
+  UnoptimizedCompileState compile_state_;
   std::unique_ptr<ParseInfo> info_;
   std::unique_ptr<Parser> parser_;
 
@@ -411,15 +481,19 @@ class V8_EXPORT_PRIVATE BackgroundCompileTask {
   // should add some stricter type-safety or DCHECKs to ensure that the user of
   // the task knows this.
   std::unique_ptr<OffThreadIsolate> off_thread_isolate_;
-  // This is a raw pointer to the off-thread allocated SharedFunctionInfo.
-  SharedFunctionInfo outer_function_sfi_;
+  OffThreadTransferMaybeHandle<SharedFunctionInfo> outer_function_sfi_;
+  OffThreadTransferHandle<Script> script_;
+  FinalizeUnoptimizedCompilationDataList finalize_unoptimized_compilation_data_;
+
+  // Single function data for top-level function compilation.
+  int start_position_;
+  int end_position_;
+  int function_literal_id_;
 
   int stack_size_;
   WorkerThreadRuntimeCallStats* worker_thread_runtime_call_stats_;
-  AccountingAllocator* allocator_;
   TimedHistogram* timer_;
   LanguageMode language_mode_;
-  bool collected_source_positions_;
 
   // True if the background compilation should be finalized on the background
   // thread. When this is true, the ParseInfo, Parser and compilation jobs are
diff --git a/deps/v8/src/snapshot/serializer-common.cc b/deps/v8/src/codegen/external-reference-encoder.cc
similarity index 55%
rename from deps/v8/src/snapshot/serializer-common.cc
rename to deps/v8/src/codegen/external-reference-encoder.cc
index 9218d4eaa92..0dfe3e976a4 100644
--- a/deps/v8/src/snapshot/serializer-common.cc
+++ b/deps/v8/src/codegen/external-reference-encoder.cc
@@ -1,14 +1,11 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
+// Copyright 2020 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/snapshot/serializer-common.h"
+#include "src/codegen/external-reference-encoder.h"
 
 #include "src/codegen/external-reference-table.h"
-#include "src/objects/foreign-inl.h"
-#include "src/objects/objects-inl.h"
-#include "src/objects/slots.h"
-#include "third_party/zlib/zlib.h"
+#include "src/execution/isolate.h"
 
 namespace v8 {
 namespace internal {
@@ -45,8 +42,8 @@ ExternalReferenceEncoder::ExternalReferenceEncoder(Isolate* isolate) {
   }
 }
 
-ExternalReferenceEncoder::~ExternalReferenceEncoder() {
 #ifdef DEBUG
+ExternalReferenceEncoder::~ExternalReferenceEncoder() {
   if (!i::FLAG_external_reference_stats) return;
   if (api_references_ == nullptr) return;
   for (uint32_t i = 0; api_references_[i] != 0; ++i) {
@@ -56,8 +53,8 @@ ExternalReferenceEncoder::~ExternalReferenceEncoder() {
         "index=%5d count=%5d  %-60s\n", i, count_[i],
         ExternalReferenceTable::ResolveSymbol(reinterpret_cast<void*>(addr)));
   }
-#endif  // DEBUG
 }
+#endif  // DEBUG
 
 Maybe<ExternalReferenceEncoder::Value> ExternalReferenceEncoder::TryEncode(
     Address address) {
@@ -76,7 +73,8 @@ ExternalReferenceEncoder::Value ExternalReferenceEncoder::Encode(
   if (maybe_index.IsNothing()) {
     void* addr = reinterpret_cast<void*>(address);
     v8::base::OS::PrintError("Unknown external reference %p.\n", addr);
-    v8::base::OS::PrintError("%s", ExternalReferenceTable::ResolveSymbol(addr));
+    v8::base::OS::PrintError("%s\n",
+                             ExternalReferenceTable::ResolveSymbol(addr));
     v8::base::OS::Abort();
   }
   Value result(maybe_index.FromJust());
@@ -95,66 +93,5 @@ const char* ExternalReferenceEncoder::NameOfAddress(Isolate* isolate,
   return isolate->external_reference_table()->name(value.index());
 }
 
-void SerializedData::AllocateData(uint32_t size) {
-  DCHECK(!owns_data_);
-  data_ = NewArray<byte>(size);
-  size_ = size;
-  owns_data_ = true;
-}
-
-// static
-constexpr uint32_t SerializedData::kMagicNumber;
-
-// The partial snapshot cache is terminated by undefined. We visit the
-// partial snapshot...
-//  - during deserialization to populate it.
-//  - during normal GC to keep its content alive.
-//  - not during serialization. The partial serializer adds to it explicitly.
-DISABLE_CFI_PERF
-void SerializerDeserializer::Iterate(Isolate* isolate, RootVisitor* visitor) {
-  std::vector<Object>* cache = isolate->partial_snapshot_cache();
-  for (size_t i = 0;; ++i) {
-    // Extend the array ready to get a value when deserializing.
-    if (cache->size() <= i) cache->push_back(Smi::zero());
-    // During deserialization, the visitor populates the partial snapshot cache
-    // and eventually terminates the cache with undefined.
-    visitor->VisitRootPointer(Root::kPartialSnapshotCache, nullptr,
-                              FullObjectSlot(&cache->at(i)));
-    if (cache->at(i).IsUndefined(isolate)) break;
-  }
-}
-
-bool SerializerDeserializer::CanBeDeferred(HeapObject o) {
-  return !o.IsString() && !o.IsScript() && !o.IsJSTypedArray();
-}
-
-void SerializerDeserializer::RestoreExternalReferenceRedirectors(
-    const std::vector<AccessorInfo>& accessor_infos) {
-  // Restore wiped accessor infos.
-  for (AccessorInfo info : accessor_infos) {
-    Foreign::cast(info.js_getter())
-        .set_foreign_address(info.redirected_getter());
-  }
-}
-
-void SerializerDeserializer::RestoreExternalReferenceRedirectors(
-    const std::vector<CallHandlerInfo>& call_handler_infos) {
-  for (CallHandlerInfo info : call_handler_infos) {
-    Foreign::cast(info.js_callback())
-        .set_foreign_address(info.redirected_callback());
-  }
-}
-
-uint32_t Checksum(Vector<const byte> payload) {
-#ifdef MEMORY_SANITIZER
-  // Computing the checksum includes padding bytes for objects like strings.
-  // Mark every object as initialized in the code serializer.
-  MSAN_MEMORY_IS_INITIALIZED(payload.begin(), payload.length());
-#endif  // MEMORY_SANITIZER
-  // Priming the adler32 call so it can see what CPU features are available.
-  adler32(0, NULL, 0);
-  return static_cast<uint32_t>(adler32(0, payload.begin(), payload.length()));
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/codegen/external-reference-encoder.h b/deps/v8/src/codegen/external-reference-encoder.h
new file mode 100644
index 00000000000..7c41206f07f
--- /dev/null
+++ b/deps/v8/src/codegen/external-reference-encoder.h
@@ -0,0 +1,60 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_CODEGEN_EXTERNAL_REFERENCE_ENCODER_H_
+#define V8_CODEGEN_EXTERNAL_REFERENCE_ENCODER_H_
+
+#include "src/base/bit-field.h"
+#include "src/common/globals.h"
+#include "src/utils/address-map.h"
+
+namespace v8 {
+namespace internal {
+
+class Isolate;
+
+class ExternalReferenceEncoder {
+ public:
+  class Value {
+   public:
+    explicit Value(uint32_t raw) : value_(raw) {}
+    Value() : value_(0) {}
+    static uint32_t Encode(uint32_t index, bool is_from_api) {
+      return Index::encode(index) | IsFromAPI::encode(is_from_api);
+    }
+
+    bool is_from_api() const { return IsFromAPI::decode(value_); }
+    uint32_t index() const { return Index::decode(value_); }
+
+   private:
+    using Index = base::BitField<uint32_t, 0, 31>;
+    using IsFromAPI = base::BitField<bool, 31, 1>;
+    uint32_t value_;
+  };
+
+  explicit ExternalReferenceEncoder(Isolate* isolate);
+#ifdef DEBUG
+  ~ExternalReferenceEncoder();
+#endif  // DEBUG
+
+  Value Encode(Address key);
+  Maybe<Value> TryEncode(Address key);
+
+  const char* NameOfAddress(Isolate* isolate, Address address) const;
+
+ private:
+  AddressToIndexHashMap* map_;
+
+#ifdef DEBUG
+  std::vector<int> count_;
+  const intptr_t* api_references_;
+#endif  // DEBUG
+
+  DISALLOW_COPY_AND_ASSIGN(ExternalReferenceEncoder);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_CODEGEN_EXTERNAL_REFERENCE_ENCODER_H_
diff --git a/deps/v8/src/codegen/external-reference.cc b/deps/v8/src/codegen/external-reference.cc
index 7a42e40461c..c61da2ab7c5 100644
--- a/deps/v8/src/codegen/external-reference.cc
+++ b/deps/v8/src/codegen/external-reference.cc
@@ -277,6 +277,14 @@ FUNCTION_REFERENCE(wasm_float32_to_int64, wasm::float32_to_int64_wrapper)
 FUNCTION_REFERENCE(wasm_float32_to_uint64, wasm::float32_to_uint64_wrapper)
 FUNCTION_REFERENCE(wasm_float64_to_int64, wasm::float64_to_int64_wrapper)
 FUNCTION_REFERENCE(wasm_float64_to_uint64, wasm::float64_to_uint64_wrapper)
+FUNCTION_REFERENCE(wasm_float32_to_int64_sat,
+                   wasm::float32_to_int64_sat_wrapper)
+FUNCTION_REFERENCE(wasm_float32_to_uint64_sat,
+                   wasm::float32_to_uint64_sat_wrapper)
+FUNCTION_REFERENCE(wasm_float64_to_int64_sat,
+                   wasm::float64_to_int64_sat_wrapper)
+FUNCTION_REFERENCE(wasm_float64_to_uint64_sat,
+                   wasm::float64_to_uint64_sat_wrapper)
 FUNCTION_REFERENCE(wasm_int64_div, wasm::int64_div_wrapper)
 FUNCTION_REFERENCE(wasm_int64_mod, wasm::int64_mod_wrapper)
 FUNCTION_REFERENCE(wasm_uint64_div, wasm::uint64_div_wrapper)
@@ -902,6 +910,10 @@ static int EnterMicrotaskContextWrapper(HandleScopeImplementer* hsi,
 
 FUNCTION_REFERENCE(call_enter_context_function, EnterMicrotaskContextWrapper)
 
+FUNCTION_REFERENCE(
+    js_finalization_registry_remove_cell_from_unregister_token_map,
+    JSFinalizationRegistry::RemoveCellFromUnregisterTokenMap)
+
 bool operator==(ExternalReference lhs, ExternalReference rhs) {
   return lhs.address() == rhs.address();
 }
diff --git a/deps/v8/src/codegen/external-reference.h b/deps/v8/src/codegen/external-reference.h
index 2c5c8348f43..6537b3c9b1c 100644
--- a/deps/v8/src/codegen/external-reference.h
+++ b/deps/v8/src/codegen/external-reference.h
@@ -181,9 +181,13 @@ class StatsCounter;
   V(wasm_f64_trunc, "wasm::f64_trunc_wrapper")                                \
   V(wasm_float32_to_int64, "wasm::float32_to_int64_wrapper")                  \
   V(wasm_float32_to_uint64, "wasm::float32_to_uint64_wrapper")                \
+  V(wasm_float32_to_int64_sat, "wasm::float32_to_int64_sat_wrapper")          \
+  V(wasm_float32_to_uint64_sat, "wasm::float32_to_uint64_sat_wrapper")        \
   V(wasm_float64_pow, "wasm::float64_pow")                                    \
   V(wasm_float64_to_int64, "wasm::float64_to_int64_wrapper")                  \
   V(wasm_float64_to_uint64, "wasm::float64_to_uint64_wrapper")                \
+  V(wasm_float64_to_int64_sat, "wasm::float64_to_int64_sat_wrapper")          \
+  V(wasm_float64_to_uint64_sat, "wasm::float64_to_uint64_sat_wrapper")        \
   V(wasm_int64_div, "wasm::int64_div")                                        \
   V(wasm_int64_mod, "wasm::int64_mod")                                        \
   V(wasm_int64_to_float32, "wasm::int64_to_float32_wrapper")                  \
@@ -215,6 +219,8 @@ class StatsCounter;
   V(atomic_pair_exchange_function, "atomic_pair_exchange_function")           \
   V(atomic_pair_compare_exchange_function,                                    \
     "atomic_pair_compare_exchange_function")                                  \
+  V(js_finalization_registry_remove_cell_from_unregister_token_map,           \
+    "JSFinalizationRegistry::RemoveCellFromUnregisterTokenMap")               \
   EXTERNAL_REFERENCE_LIST_INTL(V)
 
 #ifdef V8_INTL_SUPPORT
diff --git a/deps/v8/src/codegen/ia32/assembler-ia32.cc b/deps/v8/src/codegen/ia32/assembler-ia32.cc
index 1d3b9e2644f..551750936db 100644
--- a/deps/v8/src/codegen/ia32/assembler-ia32.cc
+++ b/deps/v8/src/codegen/ia32/assembler-ia32.cc
@@ -1091,6 +1091,25 @@ void Assembler::rcr(Register dst, uint8_t imm8) {
   }
 }
 
+void Assembler::rol(Operand dst, uint8_t imm8) {
+  EnsureSpace ensure_space(this);
+  DCHECK(is_uint5(imm8));  // illegal shift count
+  if (imm8 == 1) {
+    EMIT(0xD1);
+    emit_operand(eax, dst);
+  } else {
+    EMIT(0xC1);
+    emit_operand(eax, dst);
+    EMIT(imm8);
+  }
+}
+
+void Assembler::rol_cl(Operand dst) {
+  EnsureSpace ensure_space(this);
+  EMIT(0xD3);
+  emit_operand(eax, dst);
+}
+
 void Assembler::ror(Operand dst, uint8_t imm8) {
   EnsureSpace ensure_space(this);
   DCHECK(is_uint5(imm8));  // illegal shift count
@@ -2266,6 +2285,14 @@ void Assembler::movmskps(Register dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
+void Assembler::pmovmskb(Register dst, XMMRegister src) {
+  EnsureSpace ensure_space(this);
+  EMIT(0x66);
+  EMIT(0x0F);
+  EMIT(0xD7);
+  emit_sse_operand(dst, src);
+}
+
 void Assembler::maxsd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF2);
@@ -2894,6 +2921,22 @@ void Assembler::vpinsrd(XMMRegister dst, XMMRegister src1, Operand src2,
   EMIT(offset);
 }
 
+void Assembler::vmovmskps(Register dst, XMMRegister src) {
+  DCHECK(IsEnabled(AVX));
+  EnsureSpace ensure_space(this);
+  emit_vex_prefix(xmm0, kL128, kNone, k0F, kWIG);
+  EMIT(0x50);
+  emit_sse_operand(dst, src);
+}
+
+void Assembler::vpmovmskb(Register dst, XMMRegister src) {
+  DCHECK(IsEnabled(AVX));
+  EnsureSpace ensure_space(this);
+  emit_vex_prefix(xmm0, kL128, k66, k0F, kWIG);
+  EMIT(0xD7);
+  emit_sse_operand(dst, src);
+}
+
 void Assembler::bmi1(byte op, Register reg, Register vreg, Operand rm) {
   DCHECK(IsEnabled(BMI1));
   EnsureSpace ensure_space(this);
diff --git a/deps/v8/src/codegen/ia32/assembler-ia32.h b/deps/v8/src/codegen/ia32/assembler-ia32.h
index 246415ba67f..60d978df5be 100644
--- a/deps/v8/src/codegen/ia32/assembler-ia32.h
+++ b/deps/v8/src/codegen/ia32/assembler-ia32.h
@@ -635,6 +635,11 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void rcl(Register dst, uint8_t imm8);
   void rcr(Register dst, uint8_t imm8);
 
+  void rol(Register dst, uint8_t imm8) { rol(Operand(dst), imm8); }
+  void rol(Operand dst, uint8_t imm8);
+  void rol_cl(Register dst) { rol_cl(Operand(dst)); }
+  void rol_cl(Operand dst);
+
   void ror(Register dst, uint8_t imm8) { ror(Operand(dst), imm8); }
   void ror(Operand dst, uint8_t imm8);
   void ror_cl(Register dst) { ror_cl(Operand(dst)); }
@@ -958,6 +963,8 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void movmskpd(Register dst, XMMRegister src);
   void movmskps(Register dst, XMMRegister src);
 
+  void pmovmskb(Register dst, XMMRegister src);
+
   void cmpltsd(XMMRegister dst, XMMRegister src);
 
   void maxsd(XMMRegister dst, XMMRegister src) { maxsd(dst, Operand(src)); }
@@ -1439,6 +1446,10 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
     vinstr(0x7E, src, xmm0, dst, k66, k0F, kWIG);
   }
 
+  void vmovmskps(Register dst, XMMRegister src);
+
+  void vpmovmskb(Register dst, XMMRegister src);
+
   // BMI instruction
   void andn(Register dst, Register src1, Register src2) {
     andn(dst, src1, Operand(src2));
diff --git a/deps/v8/src/codegen/ia32/interface-descriptors-ia32.cc b/deps/v8/src/codegen/ia32/interface-descriptors-ia32.cc
index 428912c7bdd..ee9c3919cd4 100644
--- a/deps/v8/src/codegen/ia32/interface-descriptors-ia32.cc
+++ b/deps/v8/src/codegen/ia32/interface-descriptors-ia32.cc
@@ -195,12 +195,6 @@ void AbortDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  data->InitializePlatformSpecific(0, nullptr);
-}
-
 void CompareDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {edx, eax};
@@ -284,6 +278,70 @@ void RunMicrotasksEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(0, nullptr);
 }
 
+void WasmFloat32ToNumberDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // Work around using eax, whose register code is 0, and leads to the FP
+  // parameter being passed via xmm0, which is not allocatable on ia32.
+  Register registers[] = {ecx};
+  data->InitializePlatformSpecific(arraysize(registers), registers);
+}
+
+void WasmFloat64ToNumberDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // Work around using eax, whose register code is 0, and leads to the FP
+  // parameter being passed via xmm0, which is not allocatable on ia32.
+  Register registers[] = {ecx};
+  data->InitializePlatformSpecific(arraysize(registers), registers);
+}
+
+void BinaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallTrampoline_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void ConstructWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void ConstructWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void Compare_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void UnaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 3);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/ia32/macro-assembler-ia32.cc b/deps/v8/src/codegen/ia32/macro-assembler-ia32.cc
index 6f5778d3cae..407698e19bd 100644
--- a/deps/v8/src/codegen/ia32/macro-assembler-ia32.cc
+++ b/deps/v8/src/codegen/ia32/macro-assembler-ia32.cc
@@ -15,7 +15,7 @@
 #include "src/debug/debug.h"
 #include "src/execution/frame-constants.h"
 #include "src/execution/frames-inl.h"
-#include "src/heap/heap-inl.h"  // For MemoryChunk.
+#include "src/heap/memory-chunk.h"
 #include "src/init/bootstrapper.h"
 #include "src/logging/counters.h"
 #include "src/runtime/runtime.h"
@@ -135,6 +135,31 @@ void MacroAssembler::JumpIfIsInRange(Register value, unsigned lower_limit,
   j(below_equal, on_in_range, near_jump);
 }
 
+void TurboAssembler::PushArray(Register array, Register size, Register scratch,
+                               PushArrayOrder order) {
+  DCHECK(!AreAliased(array, size, scratch));
+  Register counter = scratch;
+  Label loop, entry;
+  if (order == PushArrayOrder::kReverse) {
+    mov(counter, 0);
+    jmp(&entry);
+    bind(&loop);
+    Push(Operand(array, counter, times_system_pointer_size, 0));
+    inc(counter);
+    bind(&entry);
+    cmp(counter, size);
+    j(less, &loop, Label::kNear);
+  } else {
+    mov(counter, size);
+    jmp(&entry);
+    bind(&loop);
+    Push(Operand(array, counter, times_system_pointer_size, 0));
+    bind(&entry);
+    dec(counter);
+    j(greater_equal, &loop, Label::kNear);
+  }
+}
+
 Operand TurboAssembler::ExternalReferenceAsOperand(ExternalReference reference,
                                                    Register scratch) {
   // TODO(jgruber): Add support for enable_root_array_delta_access.
@@ -2020,9 +2045,9 @@ void TurboAssembler::CheckPageFlag(Register object, Register scratch, int mask,
     and_(scratch, object);
   }
   if (mask < (1 << kBitsPerByte)) {
-    test_b(Operand(scratch, MemoryChunk::kFlagsOffset), Immediate(mask));
+    test_b(Operand(scratch, BasicMemoryChunk::kFlagsOffset), Immediate(mask));
   } else {
-    test(Operand(scratch, MemoryChunk::kFlagsOffset), Immediate(mask));
+    test(Operand(scratch, BasicMemoryChunk::kFlagsOffset), Immediate(mask));
   }
   j(cc, condition_met, condition_met_distance);
 }
diff --git a/deps/v8/src/codegen/ia32/macro-assembler-ia32.h b/deps/v8/src/codegen/ia32/macro-assembler-ia32.h
index 40b542f3759..c882a25d472 100644
--- a/deps/v8/src/codegen/ia32/macro-assembler-ia32.h
+++ b/deps/v8/src/codegen/ia32/macro-assembler-ia32.h
@@ -224,6 +224,12 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
 
   void PushPC();
 
+  enum class PushArrayOrder { kNormal, kReverse };
+  // `array` points to the first element (the lowest address).
+  // `array` and `size` are not modified.
+  void PushArray(Register array, Register size, Register scratch,
+                 PushArrayOrder order = PushArrayOrder::kNormal);
+
   // Operand pointing to an external reference.
   // May emit code to set up the scratch register. The operand is
   // only guaranteed to be correct as long as the scratch register
@@ -280,10 +286,16 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   AVX_OP2_WITH_TYPE(Movd, movd, Register, XMMRegister)
   AVX_OP2_WITH_TYPE(Movd, movd, Operand, XMMRegister)
   AVX_OP2_WITH_TYPE(Cvtdq2ps, cvtdq2ps, XMMRegister, Operand)
+  AVX_OP2_WITH_TYPE(Cvtdq2ps, cvtdq2ps, XMMRegister, XMMRegister)
+  AVX_OP2_WITH_TYPE(Cvttps2dq, cvttps2dq, XMMRegister, XMMRegister)
+  AVX_OP2_WITH_TYPE(Sqrtps, sqrtps, XMMRegister, XMMRegister)
+  AVX_OP2_WITH_TYPE(Sqrtpd, sqrtpd, XMMRegister, XMMRegister)
   AVX_OP2_WITH_TYPE(Sqrtpd, sqrtpd, XMMRegister, const Operand&)
   AVX_OP2_WITH_TYPE(Movaps, movaps, XMMRegister, XMMRegister)
   AVX_OP2_WITH_TYPE(Movapd, movapd, XMMRegister, XMMRegister)
   AVX_OP2_WITH_TYPE(Movapd, movapd, XMMRegister, const Operand&)
+  AVX_OP2_WITH_TYPE(Pmovmskb, pmovmskb, Register, XMMRegister)
+  AVX_OP2_WITH_TYPE(Movmskps, movmskps, Register, XMMRegister)
 
 #undef AVX_OP2_WITH_TYPE
 
@@ -325,6 +337,7 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   AVX_OP3_XO(Xorpd, xorpd)
   AVX_OP3_XO(Sqrtss, sqrtss)
   AVX_OP3_XO(Sqrtsd, sqrtsd)
+  AVX_OP3_XO(Orps, orps)
   AVX_OP3_XO(Orpd, orpd)
   AVX_OP3_XO(Andnpd, andnpd)
 
@@ -346,16 +359,22 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   AVX_PACKED_OP3_WITH_TYPE(macro_name, name, XMMRegister, XMMRegister) \
   AVX_PACKED_OP3_WITH_TYPE(macro_name, name, XMMRegister, Operand)
 
+  AVX_PACKED_OP3(Addps, addps)
   AVX_PACKED_OP3(Addpd, addpd)
+  AVX_PACKED_OP3(Subps, subps)
   AVX_PACKED_OP3(Subpd, subpd)
   AVX_PACKED_OP3(Mulpd, mulpd)
   AVX_PACKED_OP3(Divpd, divpd)
   AVX_PACKED_OP3(Cmpeqpd, cmpeqpd)
   AVX_PACKED_OP3(Cmpneqpd, cmpneqpd)
   AVX_PACKED_OP3(Cmpltpd, cmpltpd)
+  AVX_PACKED_OP3(Cmpleps, cmpleps)
   AVX_PACKED_OP3(Cmplepd, cmplepd)
+  AVX_PACKED_OP3(Minps, minps)
   AVX_PACKED_OP3(Minpd, minpd)
+  AVX_PACKED_OP3(Maxps, maxps)
   AVX_PACKED_OP3(Maxpd, maxpd)
+  AVX_PACKED_OP3(Cmpunordps, cmpunordps)
   AVX_PACKED_OP3(Cmpunordpd, cmpunordpd)
   AVX_PACKED_OP3(Psllw, psllw)
   AVX_PACKED_OP3(Pslld, pslld)
@@ -365,6 +384,7 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   AVX_PACKED_OP3(Psrlq, psrlq)
   AVX_PACKED_OP3(Psraw, psraw)
   AVX_PACKED_OP3(Psrad, psrad)
+  AVX_PACKED_OP3(Paddd, paddd)
   AVX_PACKED_OP3(Paddq, paddq)
   AVX_PACKED_OP3(Psubq, psubq)
   AVX_PACKED_OP3(Pmuludq, pmuludq)
@@ -429,6 +449,30 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
 #undef AVX_OP2_WITH_TYPE_SCOPE
 #undef AVX_OP2_XO_SSE4
 
+#define AVX_OP3_WITH_TYPE_SCOPE(macro_name, name, dst_type, src_type, \
+                                sse_scope)                            \
+  void macro_name(dst_type dst, src_type src) {                       \
+    if (CpuFeatures::IsSupported(AVX)) {                              \
+      CpuFeatureScope scope(this, AVX);                               \
+      v##name(dst, dst, src);                                         \
+      return;                                                         \
+    }                                                                 \
+    if (CpuFeatures::IsSupported(sse_scope)) {                        \
+      CpuFeatureScope scope(this, sse_scope);                         \
+      name(dst, src);                                                 \
+      return;                                                         \
+    }                                                                 \
+    UNREACHABLE();                                                    \
+  }
+#define AVX_OP3_XO_SSE4(macro_name, name)                                     \
+  AVX_OP3_WITH_TYPE_SCOPE(macro_name, name, XMMRegister, XMMRegister, SSE4_1) \
+  AVX_OP3_WITH_TYPE_SCOPE(macro_name, name, XMMRegister, Operand, SSE4_1)
+
+  AVX_OP3_XO_SSE4(Pmaxsd, pmaxsd)
+
+#undef AVX_OP3_XO_SSE4
+#undef AVX_OP3_WITH_TYPE_SCOPE
+
   void Pshufb(XMMRegister dst, XMMRegister src) { Pshufb(dst, Operand(src)); }
   void Pshufb(XMMRegister dst, Operand src);
   void Pblendw(XMMRegister dst, XMMRegister src, uint8_t imm8) {
diff --git a/deps/v8/src/codegen/ia32/register-ia32.h b/deps/v8/src/codegen/ia32/register-ia32.h
index dafb8cbcf06..df3117e8d0a 100644
--- a/deps/v8/src/codegen/ia32/register-ia32.h
+++ b/deps/v8/src/codegen/ia32/register-ia32.h
@@ -159,6 +159,8 @@ constexpr Register kRootRegister = ebx;
 // TODO(860429): Remove remaining poisoning infrastructure on ia32.
 constexpr Register kSpeculationPoisonRegister = no_reg;
 
+constexpr DoubleRegister kFPReturnRegister0 = xmm1;  // xmm0 isn't allocatable.
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/interface-descriptors.cc b/deps/v8/src/codegen/interface-descriptors.cc
index 42b45c0f33a..ce12bc61f53 100644
--- a/deps/v8/src/codegen/interface-descriptors.cc
+++ b/deps/v8/src/codegen/interface-descriptors.cc
@@ -30,10 +30,12 @@ void CallInterfaceDescriptorData::InitializePlatformSpecific(
 
 void CallInterfaceDescriptorData::InitializePlatformIndependent(
     Flags flags, int return_count, int parameter_count,
-    const MachineType* machine_types, int machine_types_length) {
+    const MachineType* machine_types, int machine_types_length,
+    StackArgumentOrder stack_order) {
   DCHECK(IsInitializedPlatformSpecific());
 
   flags_ = flags;
+  stack_order_ = stack_order;
   return_count_ = return_count;
   param_count_ = parameter_count;
   const int types_length = return_count_ + param_count_;
@@ -83,8 +85,9 @@ void CallDescriptors::InitializeOncePerProcess() {
   DCHECK(ContextOnlyDescriptor{}.HasContextParameter());
   DCHECK(!NoContextDescriptor{}.HasContextParameter());
   DCHECK(!AllocateDescriptor{}.HasContextParameter());
-  DCHECK(!AllocateHeapNumberDescriptor{}.HasContextParameter());
   DCHECK(!AbortDescriptor{}.HasContextParameter());
+  DCHECK(!WasmFloat32ToNumberDescriptor{}.HasContextParameter());
+  DCHECK(!WasmFloat64ToNumberDescriptor{}.HasContextParameter());
 }
 
 void CallDescriptors::TearDown() {
@@ -375,42 +378,19 @@ void ArrayNArgumentsConstructorDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void WasmMemoryGrowDescriptor::InitializePlatformSpecific(
+#if !V8_TARGET_ARCH_IA32
+// We need a custom descriptor on ia32 to avoid using xmm0.
+void WasmFloat32ToNumberDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   DefaultInitializePlatformSpecific(data, kParameterCount);
 }
 
-void WasmTableInitDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  DefaultInitializePlatformSpecific(data,
-                                    kParameterCount - kStackArgumentsCount);
-}
-
-void WasmTableCopyDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  DefaultInitializePlatformSpecific(data,
-                                    kParameterCount - kStackArgumentsCount);
-}
-
-void WasmTableGetDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  DefaultInitializePlatformSpecific(data, kParameterCount);
-}
-
-void WasmTableSetDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  DefaultInitializePlatformSpecific(data, kParameterCount);
-}
-
-void WasmThrowDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  DefaultInitializePlatformSpecific(data, kParameterCount);
-}
-
-void WasmAtomicNotifyDescriptor::InitializePlatformSpecific(
+// We need a custom descriptor on ia32 to avoid using xmm0.
+void WasmFloat64ToNumberDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   DefaultInitializePlatformSpecific(data, kParameterCount);
 }
+#endif  // !V8_TARGET_ARCH_IA32
 
 #if !defined(V8_TARGET_ARCH_MIPS) && !defined(V8_TARGET_ARCH_MIPS64)
 void WasmI32AtomicWait32Descriptor::InitializePlatformSpecific(
@@ -418,21 +398,11 @@ void WasmI32AtomicWait32Descriptor::InitializePlatformSpecific(
   DefaultInitializePlatformSpecific(data, kParameterCount);
 }
 
-void WasmI32AtomicWait64Descriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  DefaultInitializePlatformSpecific(data, kParameterCount);
-}
-
 void WasmI64AtomicWait32Descriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   DefaultInitializePlatformSpecific(data,
                                     kParameterCount - kStackArgumentsCount);
 }
-
-void WasmI64AtomicWait64Descriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  DefaultInitializePlatformSpecific(data, kParameterCount);
-}
 #endif
 
 void CloneObjectWithVectorDescriptor::InitializePlatformSpecific(
diff --git a/deps/v8/src/codegen/interface-descriptors.h b/deps/v8/src/codegen/interface-descriptors.h
index 36099d57fed..14c021b3b76 100644
--- a/deps/v8/src/codegen/interface-descriptors.h
+++ b/deps/v8/src/codegen/interface-descriptors.h
@@ -20,90 +20,101 @@ namespace internal {
   BUILTIN_LIST_FROM_TORQUE(IGNORE_BUILTIN, IGNORE_BUILTIN, V, IGNORE_BUILTIN, \
                            IGNORE_BUILTIN, IGNORE_BUILTIN)
 
-#define INTERFACE_DESCRIPTOR_LIST(V)  \
-  V(Abort)                            \
-  V(Allocate)                         \
-  V(AllocateHeapNumber)               \
-  V(ApiCallback)                      \
-  V(ApiGetter)                        \
-  V(ArgumentsAdaptor)                 \
-  V(ArrayConstructor)                 \
-  V(ArrayNArgumentsConstructor)       \
-  V(ArrayNoArgumentConstructor)       \
-  V(ArraySingleArgumentConstructor)   \
-  V(AsyncFunctionStackParameter)      \
-  V(BigIntToI64)                      \
-  V(BigIntToI32Pair)                  \
-  V(I64ToBigInt)                      \
-  V(I32PairToBigInt)                  \
-  V(BinaryOp)                         \
-  V(CallForwardVarargs)               \
-  V(CallFunctionTemplate)             \
-  V(CallTrampoline)                   \
-  V(CallVarargs)                      \
-  V(CallWithArrayLike)                \
-  V(CallWithSpread)                   \
-  V(CEntry1ArgvOnStack)               \
-  V(CloneObjectWithVector)            \
-  V(Compare)                          \
-  V(ConstructForwardVarargs)          \
-  V(ConstructStub)                    \
-  V(ConstructVarargs)                 \
-  V(ConstructWithArrayLike)           \
-  V(ConstructWithSpread)              \
-  V(ContextOnly)                      \
-  V(CppBuiltinAdaptor)                \
-  V(EphemeronKeyBarrier)              \
-  V(FastNewFunctionContext)           \
-  V(FastNewObject)                    \
-  V(FrameDropperTrampoline)           \
-  V(GetIteratorStackParameter)        \
-  V(GetProperty)                      \
-  V(GrowArrayElements)                \
-  V(InterpreterCEntry1)               \
-  V(InterpreterCEntry2)               \
-  V(InterpreterDispatch)              \
-  V(InterpreterPushArgsThenCall)      \
-  V(InterpreterPushArgsThenConstruct) \
-  V(JSTrampoline)                     \
-  V(Load)                             \
-  V(LoadGlobal)                       \
-  V(LoadGlobalNoFeedback)             \
-  V(LoadNoFeedback)                   \
-  V(LoadGlobalWithVector)             \
-  V(LoadWithVector)                   \
-  V(NewArgumentsElements)             \
-  V(NoContext)                        \
-  V(RecordWrite)                      \
-  V(ResumeGenerator)                  \
-  V(RunMicrotasksEntry)               \
-  V(RunMicrotasks)                    \
-  V(Store)                            \
-  V(StoreGlobal)                      \
-  V(StoreGlobalWithVector)            \
-  V(StoreTransition)                  \
-  V(StoreWithVector)                  \
-  V(StringAt)                         \
-  V(StringAtAsString)                 \
-  V(StringSubstring)                  \
-  V(TypeConversion)                   \
-  V(TypeConversionStackParameter)     \
-  V(Typeof)                           \
-  V(Void)                             \
-  V(WasmAtomicNotify)                 \
-  V(WasmI32AtomicWait32)              \
-  V(WasmI32AtomicWait64)              \
-  V(WasmI64AtomicWait32)              \
-  V(WasmI64AtomicWait64)              \
-  V(WasmMemoryGrow)                   \
-  V(WasmTableInit)                    \
-  V(WasmTableCopy)                    \
-  V(WasmTableGet)                     \
-  V(WasmTableSet)                     \
-  V(WasmThrow)                        \
-  BUILTIN_LIST_TFS(V)                 \
+#define INTERFACE_DESCRIPTOR_LIST(V)     \
+  V(Abort)                               \
+  V(Allocate)                            \
+  V(ApiCallback)                         \
+  V(ApiGetter)                           \
+  V(ArgumentsAdaptor)                    \
+  V(ArrayConstructor)                    \
+  V(ArrayNArgumentsConstructor)          \
+  V(ArrayNoArgumentConstructor)          \
+  V(ArraySingleArgumentConstructor)      \
+  V(AsyncFunctionStackParameter)         \
+  V(BigIntToI32Pair)                     \
+  V(BigIntToI64)                         \
+  V(BinaryOp)                            \
+  V(BinaryOp_WithFeedback)               \
+  V(CallForwardVarargs)                  \
+  V(CallFunctionTemplate)                \
+  V(CallTrampoline)                      \
+  V(CallTrampoline_WithFeedback)         \
+  V(CallVarargs)                         \
+  V(CallWithArrayLike)                   \
+  V(CallWithArrayLike_WithFeedback)      \
+  V(CallWithSpread)                      \
+  V(CallWithSpread_WithFeedback)         \
+  V(CEntry1ArgvOnStack)                  \
+  V(CloneObjectWithVector)               \
+  V(Compare)                             \
+  V(Compare_WithFeedback)                \
+  V(ConstructForwardVarargs)             \
+  V(ConstructStub)                       \
+  V(ConstructVarargs)                    \
+  V(ConstructWithArrayLike)              \
+  V(ConstructWithArrayLike_WithFeedback) \
+  V(Construct_WithFeedback)              \
+  V(ConstructWithSpread)                 \
+  V(ConstructWithSpread_WithFeedback)    \
+  V(ContextOnly)                         \
+  V(CppBuiltinAdaptor)                   \
+  V(EphemeronKeyBarrier)                 \
+  V(FastNewFunctionContext)              \
+  V(FastNewObject)                       \
+  V(FrameDropperTrampoline)              \
+  V(GetIteratorStackParameter)           \
+  V(GetProperty)                         \
+  V(GrowArrayElements)                   \
+  V(I32PairToBigInt)                     \
+  V(I64ToBigInt)                         \
+  V(InterpreterCEntry1)                  \
+  V(InterpreterCEntry2)                  \
+  V(InterpreterDispatch)                 \
+  V(InterpreterPushArgsThenCall)         \
+  V(InterpreterPushArgsThenConstruct)    \
+  V(JSTrampoline)                        \
+  V(Load)                                \
+  V(LoadGlobal)                          \
+  V(LoadGlobalNoFeedback)                \
+  V(LoadGlobalWithVector)                \
+  V(LoadNoFeedback)                      \
+  V(LoadWithVector)                      \
+  V(NewArgumentsElements)                \
+  V(NoContext)                           \
+  V(RecordWrite)                         \
+  V(ResumeGenerator)                     \
+  V(RunMicrotasks)                       \
+  V(RunMicrotasksEntry)                  \
+  V(Store)                               \
+  V(StoreGlobal)                         \
+  V(StoreGlobalWithVector)               \
+  V(StoreTransition)                     \
+  V(StoreWithVector)                     \
+  V(StringAt)                            \
+  V(StringAtAsString)                    \
+  V(StringSubstring)                     \
+  V(TypeConversion)                      \
+  V(TypeConversionStackParameter)        \
+  V(Typeof)                              \
+  V(UnaryOp_WithFeedback)                \
+  V(Void)                                \
+  V(WasmFloat32ToNumber)                 \
+  V(WasmFloat64ToNumber)                 \
+  V(WasmI32AtomicWait32)                 \
+  V(WasmI64AtomicWait32)                 \
+  BUILTIN_LIST_TFS(V)                    \
   TORQUE_BUILTIN_LIST_TFC(V)
 
+enum class StackArgumentOrder {
+  kDefault,  // Arguments in the stack are pushed in the default/stub order (the
+             // first argument is pushed first).
+  kJS,  // Arguments in the stack are pushed in the same order as the one used
+        // by JS-to-JS function calls. This should be used if calling a
+        // JSFunction or if the builtin is expected to be called directly from a
+        // JSFunction. When V8_REVERSE_JSARGS is set, this order is reversed
+        // compared to kDefault.
+};
+
 class V8_EXPORT_PRIVATE CallInterfaceDescriptorData {
  public:
   enum Flag {
@@ -139,7 +150,8 @@ class V8_EXPORT_PRIVATE CallInterfaceDescriptorData {
   void InitializePlatformIndependent(Flags flags, int return_count,
                                      int parameter_count,
                                      const MachineType* machine_types,
-                                     int machine_types_length);
+                                     int machine_types_length,
+                                     StackArgumentOrder stack_order);
 
   void Reset();
 
@@ -162,6 +174,7 @@ class V8_EXPORT_PRIVATE CallInterfaceDescriptorData {
     DCHECK_LT(index, param_count_);
     return machine_types_[return_count_ + index];
   }
+  StackArgumentOrder stack_order() const { return stack_order_; }
 
   void RestrictAllocatableRegisters(const Register* registers, int num) {
     DCHECK_EQ(allocatable_registers_, 0);
@@ -196,6 +209,7 @@ class V8_EXPORT_PRIVATE CallInterfaceDescriptorData {
   int return_count_ = -1;
   int param_count_ = -1;
   Flags flags_ = kNoFlags;
+  StackArgumentOrder stack_order_ = StackArgumentOrder::kDefault;
 
   // Specifying the set of registers that could be used by the register
   // allocator. Currently, it's only used by RecordWrite code stub.
@@ -292,6 +306,10 @@ class V8_EXPORT_PRIVATE CallInterfaceDescriptor {
     return data()->allocatable_registers();
   }
 
+  StackArgumentOrder GetStackArgumentOrder() const {
+    return data()->stack_order();
+  }
+
   static const Register ContextRegister();
 
   const char* DebugName() const;
@@ -311,9 +329,9 @@ class V8_EXPORT_PRIVATE CallInterfaceDescriptor {
       CallInterfaceDescriptorData* data) {
     // Default descriptor configuration: one result, all parameters are passed
     // in registers and all parameters have MachineType::AnyTagged() type.
-    data->InitializePlatformIndependent(CallInterfaceDescriptorData::kNoFlags,
-                                        1, data->register_param_count(),
-                                        nullptr, 0);
+    data->InitializePlatformIndependent(
+        CallInterfaceDescriptorData::kNoFlags, 1, data->register_param_count(),
+        nullptr, 0, StackArgumentOrder::kDefault);
   }
 
   // Initializes |data| using the platform dependent default set of registers.
@@ -399,7 +417,8 @@ STATIC_ASSERT(kMaxTFSBuiltinRegisterParams <= kMaxBuiltinRegisterParams);
   void InitializePlatformIndependent(CallInterfaceDescriptorData* data)        \
       override {                                                               \
     data->InitializePlatformIndependent(Flags(kDescriptorFlags), kReturnCount, \
-                                        kParameterCount, nullptr, 0);          \
+                                        kParameterCount, nullptr, 0,           \
+                                        kStackArgumentOrder);                  \
   }                                                                            \
   name(CallDescriptors::Key key) : base(key) {}                                \
                                                                                \
@@ -417,9 +436,11 @@ STATIC_ASSERT(kMaxTFSBuiltinRegisterParams <= kMaxBuiltinRegisterParams);
                                                                             \
  public:
 
-#define DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS(flags, return_count, ...) \
+#define DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS(flags, stack_order,       \
+                                               return_count, ...)        \
   static constexpr int kDescriptorFlags = flags;                         \
   static constexpr int kReturnCount = return_count;                      \
+  static constexpr StackArgumentOrder kStackArgumentOrder = stack_order; \
   enum ParameterIndices {                                                \
     __dummy = -1, /* to be able to pass zero arguments */                \
     ##__VA_ARGS__,                                                       \
@@ -428,35 +449,41 @@ STATIC_ASSERT(kMaxTFSBuiltinRegisterParams <= kMaxBuiltinRegisterParams);
     kContext = kParameterCount /* implicit parameter */                  \
   };
 
-#define DEFINE_RESULT_AND_PARAMETERS(return_count, ...) \
-  DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS(               \
-      CallInterfaceDescriptorData::kNoFlags, return_count, ##__VA_ARGS__)
+#define DEFINE_RESULT_AND_PARAMETERS(return_count, ...)                    \
+  DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS(                                  \
+      CallInterfaceDescriptorData::kNoFlags, StackArgumentOrder::kDefault, \
+      return_count, ##__VA_ARGS__)
 
 // This is valid only for builtins that use EntryFrame, which does not scan
 // stack arguments on GC.
-#define DEFINE_PARAMETERS_ENTRY(...)                      \
-  static constexpr int kDescriptorFlags =                 \
-      CallInterfaceDescriptorData::kNoContext |           \
-      CallInterfaceDescriptorData::kNoStackScan;          \
-  static constexpr int kReturnCount = 1;                  \
-  enum ParameterIndices {                                 \
-    __dummy = -1, /* to be able to pass zero arguments */ \
-    ##__VA_ARGS__,                                        \
-                                                          \
-    kParameterCount                                       \
+#define DEFINE_PARAMETERS_ENTRY(...)                        \
+  static constexpr int kDescriptorFlags =                   \
+      CallInterfaceDescriptorData::kNoContext |             \
+      CallInterfaceDescriptorData::kNoStackScan;            \
+  static constexpr StackArgumentOrder kStackArgumentOrder = \
+      StackArgumentOrder::kDefault;                         \
+  static constexpr int kReturnCount = 1;                    \
+  enum ParameterIndices {                                   \
+    __dummy = -1, /* to be able to pass zero arguments */   \
+    ##__VA_ARGS__,                                          \
+                                                            \
+    kParameterCount                                         \
   };
 
-#define DEFINE_PARAMETERS(...)            \
-  DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS( \
-      CallInterfaceDescriptorData::kNoFlags, 1, ##__VA_ARGS__)
+#define DEFINE_PARAMETERS(...)                                                \
+  DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS(                                     \
+      CallInterfaceDescriptorData::kNoFlags, StackArgumentOrder::kDefault, 1, \
+      ##__VA_ARGS__)
 
-#define DEFINE_PARAMETERS_NO_CONTEXT(...) \
-  DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS( \
-      CallInterfaceDescriptorData::kNoContext, 1, ##__VA_ARGS__)
+#define DEFINE_PARAMETERS_NO_CONTEXT(...)                                    \
+  DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS(                                    \
+      CallInterfaceDescriptorData::kNoContext, StackArgumentOrder::kDefault, \
+      1, ##__VA_ARGS__)
 
-#define DEFINE_PARAMETERS_VARARGS(...)    \
-  DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS( \
-      CallInterfaceDescriptorData::kAllowVarArgs, 1, ##__VA_ARGS__)
+#define DEFINE_PARAMETERS_VARARGS(...)                                        \
+  DEFINE_FLAGS_AND_RESULT_AND_PARAMETERS(                                     \
+      CallInterfaceDescriptorData::kAllowVarArgs, StackArgumentOrder::kJS, 1, \
+      ##__VA_ARGS__)
 
 #define DEFINE_RESULT_AND_PARAMETER_TYPES_WITH_FLAG(flag, ...)                \
   void InitializePlatformIndependent(CallInterfaceDescriptorData* data)       \
@@ -467,7 +494,7 @@ STATIC_ASSERT(kMaxTFSBuiltinRegisterParams <= kMaxBuiltinRegisterParams);
         "Parameter names definition is not consistent with parameter types"); \
     data->InitializePlatformIndependent(                                      \
         Flags(flag | kDescriptorFlags), kReturnCount, kParameterCount,        \
-        machine_types, arraysize(machine_types));                             \
+        machine_types, arraysize(machine_types), kStackArgumentOrder);        \
   }
 
 #define DEFINE_RESULT_AND_PARAMETER_TYPES(...) \
@@ -478,18 +505,20 @@ STATIC_ASSERT(kMaxTFSBuiltinRegisterParams <= kMaxBuiltinRegisterParams);
   DEFINE_RESULT_AND_PARAMETER_TYPES(MachineType::AnyTagged() /* result */, \
                                     ##__VA_ARGS__)
 
-#define DEFINE_JS_PARAMETERS(...)                       \
-  static constexpr int kDescriptorFlags =               \
-      CallInterfaceDescriptorData::kAllowVarArgs;       \
-  static constexpr int kReturnCount = 1;                \
-  enum ParameterIndices {                               \
-    kTarget,                                            \
-    kNewTarget,                                         \
-    kActualArgumentsCount,                              \
-    ##__VA_ARGS__,                                      \
-                                                        \
-    kParameterCount,                                    \
-    kContext = kParameterCount /* implicit parameter */ \
+#define DEFINE_JS_PARAMETERS(...)                           \
+  static constexpr int kDescriptorFlags =                   \
+      CallInterfaceDescriptorData::kAllowVarArgs;           \
+  static constexpr int kReturnCount = 1;                    \
+  static constexpr StackArgumentOrder kStackArgumentOrder = \
+      StackArgumentOrder::kJS;                              \
+  enum ParameterIndices {                                   \
+    kTarget,                                                \
+    kNewTarget,                                             \
+    kActualArgumentsCount,                                  \
+    ##__VA_ARGS__,                                          \
+                                                            \
+    kParameterCount,                                        \
+    kContext = kParameterCount /* implicit parameter */     \
   };
 
 #define DEFINE_JS_PARAMETER_TYPES(...)                                         \
@@ -514,10 +543,12 @@ class V8_EXPORT_PRIVATE VoidDescriptor : public CallInterfaceDescriptor {
 };
 
 // This class is subclassed by Torque-generated call interface descriptors.
-template <int parameter_count>
+template <int parameter_count, bool has_context_parameter>
 class TorqueInterfaceDescriptor : public CallInterfaceDescriptor {
  public:
-  static constexpr int kDescriptorFlags = CallInterfaceDescriptorData::kNoFlags;
+  static constexpr int kDescriptorFlags =
+      has_context_parameter ? CallInterfaceDescriptorData::kNoFlags
+                            : CallInterfaceDescriptorData::kNoContext;
   static constexpr int kParameterCount = parameter_count;
   enum ParameterIndices { kContext = kParameterCount };
   template <int i>
@@ -549,7 +580,8 @@ class TorqueInterfaceDescriptor : public CallInterfaceDescriptor {
     DCHECK_EQ(kReturnCount + kParameterCount, machine_types.size());
     data->InitializePlatformIndependent(Flags(kDescriptorFlags), kReturnCount,
                                         kParameterCount, machine_types.data(),
-                                        static_cast<int>(machine_types.size()));
+                                        static_cast<int>(machine_types.size()),
+                                        StackArgumentOrder::kDefault);
   }
 };
 
@@ -943,6 +975,20 @@ class CallWithSpreadDescriptor : public CallInterfaceDescriptor {
   DECLARE_DESCRIPTOR(CallWithSpreadDescriptor, CallInterfaceDescriptor)
 };
 
+// TODO(jgruber): Pass the slot as UintPtr.
+class CallWithSpread_WithFeedbackDescriptor : public CallInterfaceDescriptor {
+ public:
+  DEFINE_PARAMETERS(kTarget, kArgumentsCount, kSpread, kSlot,
+                    kMaybeFeedbackVector)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kTarget
+                         MachineType::Int32(),      // kArgumentsCount
+                         MachineType::AnyTagged(),  // kSpread
+                         MachineType::Int32(),      // kSlot
+                         MachineType::AnyTagged())  // kMaybeFeedbackVector
+  DECLARE_DESCRIPTOR(CallWithSpread_WithFeedbackDescriptor,
+                     CallInterfaceDescriptor)
+};
+
 class CallWithArrayLikeDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kTarget, kArgumentsList)
@@ -951,6 +997,19 @@ class CallWithArrayLikeDescriptor : public CallInterfaceDescriptor {
   DECLARE_DESCRIPTOR(CallWithArrayLikeDescriptor, CallInterfaceDescriptor)
 };
 
+// TODO(jgruber): Pass the slot as UintPtr.
+class CallWithArrayLike_WithFeedbackDescriptor
+    : public CallInterfaceDescriptor {
+ public:
+  DEFINE_PARAMETERS(kTarget, kArgumentsList, kSlot, kMaybeFeedbackVector)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kTarget
+                         MachineType::AnyTagged(),  // kArgumentsList
+                         MachineType::Int32(),      // kSlot
+                         MachineType::AnyTagged())  // kMaybeFeedbackVector
+  DECLARE_DESCRIPTOR(CallWithArrayLike_WithFeedbackDescriptor,
+                     CallInterfaceDescriptor)
+};
+
 class ConstructVarargsDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_JS_PARAMETERS(kArgumentsLength, kArgumentsList)
@@ -974,6 +1033,20 @@ class ConstructWithSpreadDescriptor : public CallInterfaceDescriptor {
   DECLARE_DESCRIPTOR(ConstructWithSpreadDescriptor, CallInterfaceDescriptor)
 };
 
+// TODO(jgruber): Pass the slot as UintPtr.
+class ConstructWithSpread_WithFeedbackDescriptor
+    : public CallInterfaceDescriptor {
+ public:
+  // Note: kSlot comes before kSpread since as an untagged value it must be
+  // passed in a register.
+  DEFINE_JS_PARAMETERS(kSlot, kSpread, kMaybeFeedbackVector)
+  DEFINE_JS_PARAMETER_TYPES(MachineType::Int32(),      // kSlot
+                            MachineType::AnyTagged(),  // kSpread
+                            MachineType::AnyTagged())  // kMaybeFeedbackVector
+  DECLARE_DESCRIPTOR(ConstructWithSpread_WithFeedbackDescriptor,
+                     CallInterfaceDescriptor)
+};
+
 class ConstructWithArrayLikeDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kTarget, kNewTarget, kArgumentsList)
@@ -983,6 +1056,21 @@ class ConstructWithArrayLikeDescriptor : public CallInterfaceDescriptor {
   DECLARE_DESCRIPTOR(ConstructWithArrayLikeDescriptor, CallInterfaceDescriptor)
 };
 
+// TODO(jgruber): Pass the slot as UintPtr.
+class ConstructWithArrayLike_WithFeedbackDescriptor
+    : public CallInterfaceDescriptor {
+ public:
+  DEFINE_PARAMETERS(kTarget, kNewTarget, kArgumentsList, kSlot,
+                    kMaybeFeedbackVector)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kTarget
+                         MachineType::AnyTagged(),  // kNewTarget
+                         MachineType::AnyTagged(),  // kArgumentsList
+                         MachineType::Int32(),      // kSlot
+                         MachineType::AnyTagged())  // kMaybeFeedbackVector
+  DECLARE_DESCRIPTOR(ConstructWithArrayLike_WithFeedbackDescriptor,
+                     CallInterfaceDescriptor)
+};
+
 // TODO(ishell): consider merging this with ArrayConstructorDescriptor
 class ConstructStubDescriptor : public CallInterfaceDescriptor {
  public:
@@ -1001,13 +1089,6 @@ class AbortDescriptor : public CallInterfaceDescriptor {
   DECLARE_DESCRIPTOR(AbortDescriptor, CallInterfaceDescriptor)
 };
 
-class AllocateHeapNumberDescriptor : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS_NO_CONTEXT()
-  DEFINE_PARAMETER_TYPES()
-  DECLARE_DESCRIPTOR(AllocateHeapNumberDescriptor, CallInterfaceDescriptor)
-};
-
 class ArrayConstructorDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_JS_PARAMETERS(kAllocationSite)
@@ -1310,84 +1391,20 @@ class RunMicrotasksDescriptor final : public CallInterfaceDescriptor {
   static Register MicrotaskQueueRegister();
 };
 
-class WasmMemoryGrowDescriptor final : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS_NO_CONTEXT(kNumPages)
-  DEFINE_RESULT_AND_PARAMETER_TYPES(MachineType::Int32(),  // result 1
-                                    MachineType::Int32())  // kNumPages
-  DECLARE_DESCRIPTOR(WasmMemoryGrowDescriptor, CallInterfaceDescriptor)
-};
-
-class WasmTableInitDescriptor final : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS_NO_CONTEXT(kDestination, kSource, kSize, kTableIndex,
-                               kSegmentIndex)
-  DEFINE_PARAMETER_TYPES(MachineType::Int32(),      // kDestination
-                         MachineType::Int32(),      // kSource
-                         MachineType::Int32(),      // kSize
-                         MachineType::AnyTagged(),  // kTableIndex
-                         MachineType::AnyTagged(),  // kSegmentindex
-  )
-
-#if V8_TARGET_ARCH_IA32
-  static constexpr bool kPassLastArgOnStack = true;
-#else
-  static constexpr bool kPassLastArgOnStack = false;
-#endif
-
-  // Pass the last parameter through the stack.
-  static constexpr int kStackArgumentsCount = kPassLastArgOnStack ? 1 : 0;
-
-  DECLARE_DESCRIPTOR(WasmTableInitDescriptor, CallInterfaceDescriptor)
-};
-
-class WasmTableCopyDescriptor final : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS_NO_CONTEXT(kDestination, kSource, kSize, kDestinationTable,
-                               kSourceTable)
-  DEFINE_PARAMETER_TYPES(MachineType::Int32(),      // kDestination
-                         MachineType::Int32(),      // kSource
-                         MachineType::Int32(),      // kSize
-                         MachineType::AnyTagged(),  // kDestinationTable
-                         MachineType::AnyTagged(),  // kSourceTable
-  )
-
-#if V8_TARGET_ARCH_IA32
-  static constexpr bool kPassLastArgOnStack = true;
-#else
-  static constexpr bool kPassLastArgOnStack = false;
-#endif
-
-  // Pass the last parameter through the stack.
-  static constexpr int kStackArgumentsCount = kPassLastArgOnStack ? 1 : 0;
-
-  DECLARE_DESCRIPTOR(WasmTableCopyDescriptor, CallInterfaceDescriptor)
-};
-
-class WasmTableGetDescriptor final : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS_NO_CONTEXT(kTableIndex, kEntryIndex)
-  DEFINE_RESULT_AND_PARAMETER_TYPES(MachineType::AnyTagged(),     // result 1
-                                    MachineType::TaggedSigned(),  // kTableIndex
-                                    MachineType::Int32())         // kEntryIndex
-  DECLARE_DESCRIPTOR(WasmTableGetDescriptor, CallInterfaceDescriptor)
-};
-
-class WasmTableSetDescriptor final : public CallInterfaceDescriptor {
+class WasmFloat32ToNumberDescriptor final : public CallInterfaceDescriptor {
  public:
-  DEFINE_PARAMETERS_NO_CONTEXT(kTableIndex, kEntryIndex, kValue)
-  DEFINE_PARAMETER_TYPES(MachineType::TaggedSigned(),  // kTableIndex
-                         MachineType::Int32(),         // kEntryIndex
-                         MachineType::AnyTagged())     // kValue
-  DECLARE_DESCRIPTOR(WasmTableSetDescriptor, CallInterfaceDescriptor)
+  DEFINE_PARAMETERS_NO_CONTEXT(kValue)
+  DEFINE_RESULT_AND_PARAMETER_TYPES(MachineType::AnyTagged(),  // result
+                                    MachineType::Float32())    // value
+  DECLARE_DESCRIPTOR(WasmFloat32ToNumberDescriptor, CallInterfaceDescriptor)
 };
 
-class WasmThrowDescriptor final : public CallInterfaceDescriptor {
+class WasmFloat64ToNumberDescriptor final : public CallInterfaceDescriptor {
  public:
-  DEFINE_PARAMETERS_NO_CONTEXT(kException)
-  DEFINE_RESULT_AND_PARAMETER_TYPES(MachineType::AnyTagged(),  // result 1
-                                    MachineType::AnyTagged())  // kException
-  DECLARE_DESCRIPTOR(WasmThrowDescriptor, CallInterfaceDescriptor)
+  DEFINE_PARAMETERS_NO_CONTEXT(kValue)
+  DEFINE_RESULT_AND_PARAMETER_TYPES(MachineType::AnyTagged(),  // result
+                                    MachineType::Float64())    // value
+  DECLARE_DESCRIPTOR(WasmFloat64ToNumberDescriptor, CallInterfaceDescriptor)
 };
 
 class V8_EXPORT_PRIVATE I64ToBigIntDescriptor final
@@ -1427,15 +1444,6 @@ class V8_EXPORT_PRIVATE BigIntToI32PairDescriptor final
   DECLARE_DESCRIPTOR(BigIntToI32PairDescriptor, CallInterfaceDescriptor)
 };
 
-class WasmAtomicNotifyDescriptor final : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS_NO_CONTEXT(kAddress, kCount)
-  DEFINE_RESULT_AND_PARAMETER_TYPES(MachineType::Uint32(),  // result 1
-                                    MachineType::Uint32(),  // kAddress
-                                    MachineType::Uint32())  // kCount
-  DECLARE_DESCRIPTOR(WasmAtomicNotifyDescriptor, CallInterfaceDescriptor)
-};
-
 class WasmI32AtomicWait32Descriptor final : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS_NO_CONTEXT(kAddress, kExpectedValue, kTimeoutLow,
@@ -1474,26 +1482,6 @@ class WasmI64AtomicWait32Descriptor final : public CallInterfaceDescriptor {
   DECLARE_DESCRIPTOR(WasmI64AtomicWait32Descriptor, CallInterfaceDescriptor)
 };
 
-class WasmI32AtomicWait64Descriptor final : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS_NO_CONTEXT(kAddress, kExpectedValue, kTimeout)
-  DEFINE_RESULT_AND_PARAMETER_TYPES(MachineType::Uint32(),  // result 1
-                                    MachineType::Uint32(),  // kAddress
-                                    MachineType::Int32(),   // kExpectedValue
-                                    MachineType::Uint64())  // kTimeout
-  DECLARE_DESCRIPTOR(WasmI32AtomicWait64Descriptor, CallInterfaceDescriptor)
-};
-
-class WasmI64AtomicWait64Descriptor final : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS_NO_CONTEXT(kAddress, kExpectedValue, kTimeout)
-  DEFINE_RESULT_AND_PARAMETER_TYPES(MachineType::Uint32(),  // result 1
-                                    MachineType::Uint32(),  // kAddress
-                                    MachineType::Uint64(),  // kExpectedValue
-                                    MachineType::Uint64())  // kTimeout
-  DECLARE_DESCRIPTOR(WasmI64AtomicWait64Descriptor, CallInterfaceDescriptor)
-};
-
 class CloneObjectWithVectorDescriptor final : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kSource, kFlags, kSlot, kVector)
@@ -1505,6 +1493,59 @@ class CloneObjectWithVectorDescriptor final : public CallInterfaceDescriptor {
   DECLARE_DESCRIPTOR(CloneObjectWithVectorDescriptor, CallInterfaceDescriptor)
 };
 
+class BinaryOp_WithFeedbackDescriptor : public CallInterfaceDescriptor {
+ public:
+  DEFINE_PARAMETERS(kLeft, kRight, kSlot, kMaybeFeedbackVector)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kLeft
+                         MachineType::AnyTagged(),  // kRight
+                         MachineType::UintPtr(),    // kSlot
+                         MachineType::AnyTagged())  // kMaybeFeedbackVector
+  DECLARE_DESCRIPTOR(BinaryOp_WithFeedbackDescriptor, CallInterfaceDescriptor)
+};
+
+// TODO(jgruber): Pass the slot as UintPtr.
+class CallTrampoline_WithFeedbackDescriptor : public CallInterfaceDescriptor {
+ public:
+  DEFINE_PARAMETERS_VARARGS(kFunction, kActualArgumentsCount, kSlot,
+                            kMaybeFeedbackVector)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kFunction
+                         MachineType::Int32(),      // kActualArgumentsCount
+                         MachineType::Int32(),      // kSlot
+                         MachineType::AnyTagged())  // kMaybeFeedbackVector
+  DECLARE_DESCRIPTOR(CallTrampoline_WithFeedbackDescriptor,
+                     CallInterfaceDescriptor)
+};
+
+class Compare_WithFeedbackDescriptor : public CallInterfaceDescriptor {
+ public:
+  DEFINE_PARAMETERS(kLeft, kRight, kSlot, kMaybeFeedbackVector)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kLeft
+                         MachineType::AnyTagged(),  // kRight
+                         MachineType::UintPtr(),    // kSlot
+                         MachineType::AnyTagged())  // kMaybeFeedbackVector
+  DECLARE_DESCRIPTOR(Compare_WithFeedbackDescriptor, CallInterfaceDescriptor)
+};
+
+// TODO(jgruber): Pass the slot as UintPtr.
+class Construct_WithFeedbackDescriptor : public CallInterfaceDescriptor {
+ public:
+  // kSlot is passed in a register, kMaybeFeedbackVector on the stack.
+  DEFINE_JS_PARAMETERS(kSlot, kMaybeFeedbackVector)
+  DEFINE_JS_PARAMETER_TYPES(MachineType::Int32(),      // kSlot
+                            MachineType::AnyTagged())  // kMaybeFeedbackVector
+  DECLARE_JS_COMPATIBLE_DESCRIPTOR(Construct_WithFeedbackDescriptor,
+                                   CallInterfaceDescriptor, 1)
+};
+
+class UnaryOp_WithFeedbackDescriptor : public CallInterfaceDescriptor {
+ public:
+  DEFINE_PARAMETERS(kValue, kSlot, kMaybeFeedbackVector)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kValue
+                         MachineType::UintPtr(),    // kSlot
+                         MachineType::AnyTagged())  // kMaybeFeedbackVector
+  DECLARE_DESCRIPTOR(UnaryOp_WithFeedbackDescriptor, CallInterfaceDescriptor)
+};
+
 #define DEFINE_TFS_BUILTIN_DESCRIPTOR(Name, ...)                          \
   class Name##Descriptor : public CallInterfaceDescriptor {               \
    public:                                                                \
diff --git a/deps/v8/src/codegen/mips/interface-descriptors-mips.cc b/deps/v8/src/codegen/mips/interface-descriptors-mips.cc
index 8b8bc1b56d3..c092ebc2c75 100644
--- a/deps/v8/src/codegen/mips/interface-descriptors-mips.cc
+++ b/deps/v8/src/codegen/mips/interface-descriptors-mips.cc
@@ -39,14 +39,6 @@ void WasmI32AtomicWait32Descriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(kParameterCount, default_stub_registers);
 }
 
-void WasmI32AtomicWait64Descriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  const Register default_stub_registers[] = {a0, a1, a2};
-  CHECK_EQ(static_cast<size_t>(kParameterCount),
-           arraysize(default_stub_registers));
-  data->InitializePlatformSpecific(kParameterCount, default_stub_registers);
-}
-
 void WasmI64AtomicWait32Descriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   const Register default_stub_registers[] = {a0, a1, a2, a3, t0};
@@ -56,14 +48,6 @@ void WasmI64AtomicWait32Descriptor::InitializePlatformSpecific(
                                    default_stub_registers);
 }
 
-void WasmI64AtomicWait64Descriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  const Register default_stub_registers[] = {a0, a1, a2};
-  CHECK_EQ(static_cast<size_t>(kParameterCount),
-           arraysize(default_stub_registers));
-  data->InitializePlatformSpecific(kParameterCount, default_stub_registers);
-}
-
 void RecordWriteDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   const Register default_stub_registers[] = {a0, a1, a2, a3, kReturnRegister0};
@@ -233,12 +217,6 @@ void AbortDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  data->InitializePlatformSpecific(0, nullptr);
-}
-
 void CompareDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {a1, a0};
@@ -326,6 +304,54 @@ void RunMicrotasksEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+void BinaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallTrampoline_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void ConstructWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void ConstructWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void Compare_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void UnaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 3);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/mips/macro-assembler-mips.cc b/deps/v8/src/codegen/mips/macro-assembler-mips.cc
index 6ae70798c14..9d9d00fd4f6 100644
--- a/deps/v8/src/codegen/mips/macro-assembler-mips.cc
+++ b/deps/v8/src/codegen/mips/macro-assembler-mips.cc
@@ -16,7 +16,7 @@
 #include "src/codegen/register-configuration.h"
 #include "src/debug/debug.h"
 #include "src/execution/frames-inl.h"
-#include "src/heap/heap-inl.h"  // For MemoryChunk.
+#include "src/heap/memory-chunk.h"
 #include "src/init/bootstrapper.h"
 #include "src/logging/counters.h"
 #include "src/objects/heap-number.h"
@@ -5427,7 +5427,7 @@ void TurboAssembler::CallCFunctionHelper(Register function_base,
 void TurboAssembler::CheckPageFlag(Register object, Register scratch, int mask,
                                    Condition cc, Label* condition_met) {
   And(scratch, object, Operand(~kPageAlignmentMask));
-  lw(scratch, MemOperand(scratch, MemoryChunk::kFlagsOffset));
+  lw(scratch, MemOperand(scratch, BasicMemoryChunk::kFlagsOffset));
   And(scratch, scratch, Operand(mask));
   Branch(condition_met, cc, scratch, Operand(zero_reg));
 }
diff --git a/deps/v8/src/codegen/mips/register-mips.h b/deps/v8/src/codegen/mips/register-mips.h
index f009a3fd0f4..2b5f454dd47 100644
--- a/deps/v8/src/codegen/mips/register-mips.h
+++ b/deps/v8/src/codegen/mips/register-mips.h
@@ -376,6 +376,8 @@ constexpr Register kRuntimeCallArgvRegister = a2;
 constexpr Register kWasmInstanceRegister = a0;
 constexpr Register kWasmCompileLazyFuncIndexRegister = t0;
 
+constexpr DoubleRegister kFPReturnRegister0 = f0;
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/mips64/assembler-mips64.cc b/deps/v8/src/codegen/mips64/assembler-mips64.cc
index 37a05585c4b..751d0f8703e 100644
--- a/deps/v8/src/codegen/mips64/assembler-mips64.cc
+++ b/deps/v8/src/codegen/mips64/assembler-mips64.cc
@@ -84,14 +84,12 @@ void CpuFeatures::ProbeImpl(bool cross_compile) {
   // Probe for additional features at runtime.
   base::CPU cpu;
   if (cpu.has_fpu()) supported_ |= 1u << FPU;
-#if defined(_MIPS_ARCH_MIPS64R6)
 #if defined(_MIPS_MSA)
   supported_ |= 1u << MIPS_SIMD;
 #else
   if (cpu.has_msa()) supported_ |= 1u << MIPS_SIMD;
 #endif
 #endif
-#endif
 }
 
 void CpuFeatures::PrintTarget() {}
@@ -261,6 +259,9 @@ Assembler::Assembler(const AssemblerOptions& options,
                      std::unique_ptr<AssemblerBuffer> buffer)
     : AssemblerBase(options, std::move(buffer)),
       scratch_register_list_(at.bit()) {
+  if (CpuFeatures::IsSupported(MIPS_SIMD)) {
+    EnableCpuFeature(MIPS_SIMD);
+  }
   reloc_info_writer.Reposition(buffer_start_ + buffer_->size(), pc_);
 
   last_trampoline_pool_end_ = 0;
@@ -1169,7 +1170,7 @@ void Assembler::GenInstrJump(Opcode opcode, uint32_t address) {
 // MSA instructions
 void Assembler::GenInstrMsaI8(SecondaryField operation, uint32_t imm8,
                               MSARegister ws, MSARegister wd) {
-  DCHECK((kArchVariant == kMips64r6) && IsEnabled(MIPS_SIMD));
+  DCHECK(IsEnabled(MIPS_SIMD));
   DCHECK(ws.is_valid() && wd.is_valid() && is_uint8(imm8));
   Instr instr = MSA | operation | ((imm8 & kImm8Mask) << kWtShift) |
                 (ws.code() << kWsShift) | (wd.code() << kWdShift);
@@ -1178,7 +1179,7 @@ void Assembler::GenInstrMsaI8(SecondaryField operation, uint32_t imm8,
 
 void Assembler::GenInstrMsaI5(SecondaryField operation, SecondaryField df,
                               int32_t imm5, MSARegister ws, MSARegister wd) {
-  DCHECK((kArchVariant == kMips64r6) && IsEnabled(MIPS_SIMD));
+  DCHECK(IsEnabled(MIPS_SIMD));
   DCHECK(ws.is_valid() && wd.is_valid());
   DCHECK((operation == MAXI_S) || (operation == MINI_S) ||
                  (operation == CEQI) || (operation == CLTI_S) ||
@@ -1192,7 +1193,7 @@ void Assembler::GenInstrMsaI5(SecondaryField operation, SecondaryField df,
 
 void Assembler::GenInstrMsaBit(SecondaryField operation, SecondaryField df,
                                uint32_t m, MSARegister ws, MSARegister wd) {
-  DCHECK((kArchVariant == kMips64r6) && IsEnabled(MIPS_SIMD));
+  DCHECK(IsEnabled(MIPS_SIMD));
   DCHECK(ws.is_valid() && wd.is_valid() && is_valid_msa_df_m(df, m));
   Instr instr = MSA | operation | df | (m << kWtShift) |
                 (ws.code() << kWsShift) | (wd.code() << kWdShift);
@@ -1201,7 +1202,7 @@ void Assembler::GenInstrMsaBit(SecondaryField operation, SecondaryField df,
 
 void Assembler::GenInstrMsaI10(SecondaryField operation, SecondaryField df,
                                int32_t imm10, MSARegister wd) {
-  DCHECK((kArchVariant == kMips64r6) && IsEnabled(MIPS_SIMD));
+  DCHECK(IsEnabled(MIPS_SIMD));
   DCHECK(wd.is_valid() && is_int10(imm10));
   Instr instr = MSA | operation | df | ((imm10 & kImm10Mask) << kWsShift) |
                 (wd.code() << kWdShift);
@@ -1211,7 +1212,7 @@ void Assembler::GenInstrMsaI10(SecondaryField operation, SecondaryField df,
 template <typename RegType>
 void Assembler::GenInstrMsa3R(SecondaryField operation, SecondaryField df,
                               RegType t, MSARegister ws, MSARegister wd) {
-  DCHECK((kArchVariant == kMips64r6) && IsEnabled(MIPS_SIMD));
+  DCHECK(IsEnabled(MIPS_SIMD));
   DCHECK(t.is_valid() && ws.is_valid() && wd.is_valid());
   Instr instr = MSA | operation | df | (t.code() << kWtShift) |
                 (ws.code() << kWsShift) | (wd.code() << kWdShift);
@@ -1221,7 +1222,7 @@ void Assembler::GenInstrMsa3R(SecondaryField operation, SecondaryField df,
 template <typename DstType, typename SrcType>
 void Assembler::GenInstrMsaElm(SecondaryField operation, SecondaryField df,
                                uint32_t n, SrcType src, DstType dst) {
-  DCHECK((kArchVariant == kMips64r6) && IsEnabled(MIPS_SIMD));
+  DCHECK(IsEnabled(MIPS_SIMD));
   DCHECK(src.is_valid() && dst.is_valid() && is_valid_msa_df_n(df, n));
   Instr instr = MSA | operation | df | (n << kWtShift) |
                 (src.code() << kWsShift) | (dst.code() << kWdShift) |
@@ -1231,7 +1232,7 @@ void Assembler::GenInstrMsaElm(SecondaryField operation, SecondaryField df,
 
 void Assembler::GenInstrMsa3RF(SecondaryField operation, uint32_t df,
                                MSARegister wt, MSARegister ws, MSARegister wd) {
-  DCHECK((kArchVariant == kMips64r6) && IsEnabled(MIPS_SIMD));
+  DCHECK(IsEnabled(MIPS_SIMD));
   DCHECK(wt.is_valid() && ws.is_valid() && wd.is_valid());
   DCHECK_LT(df, 2);
   Instr instr = MSA | operation | (df << 21) | (wt.code() << kWtShift) |
@@ -1241,7 +1242,7 @@ void Assembler::GenInstrMsa3RF(SecondaryField operation, uint32_t df,
 
 void Assembler::GenInstrMsaVec(SecondaryField operation, MSARegister wt,
                                MSARegister ws, MSARegister wd) {
-  DCHECK((kArchVariant == kMips64r6) && IsEnabled(MIPS_SIMD));
+  DCHECK(IsEnabled(MIPS_SIMD));
   DCHECK(wt.is_valid() && ws.is_valid() && wd.is_valid());
   Instr instr = MSA | operation | (wt.code() << kWtShift) |
                 (ws.code() << kWsShift) | (wd.code() << kWdShift) |
@@ -1251,7 +1252,7 @@ void Assembler::GenInstrMsaVec(SecondaryField operation, MSARegister wt,
 
 void Assembler::GenInstrMsaMI10(SecondaryField operation, int32_t s10,
                                 Register rs, MSARegister wd) {
-  DCHECK((kArchVariant == kMips64r6) && IsEnabled(MIPS_SIMD));
+  DCHECK(IsEnabled(MIPS_SIMD));
   DCHECK(rs.is_valid() && wd.is_valid() && is_int10(s10));
   Instr instr = MSA | operation | ((s10 & kImm10Mask) << kWtShift) |
                 (rs.code() << kWsShift) | (wd.code() << kWdShift);
@@ -1260,7 +1261,7 @@ void Assembler::GenInstrMsaMI10(SecondaryField operation, int32_t s10,
 
 void Assembler::GenInstrMsa2R(SecondaryField operation, SecondaryField df,
                               MSARegister ws, MSARegister wd) {
-  DCHECK((kArchVariant == kMips64r6) && IsEnabled(MIPS_SIMD));
+  DCHECK(IsEnabled(MIPS_SIMD));
   DCHECK(ws.is_valid() && wd.is_valid());
   Instr instr = MSA | MSA_2R_FORMAT | operation | df | (ws.code() << kWsShift) |
                 (wd.code() << kWdShift) | MSA_VEC_2R_2RF_MINOR;
@@ -1269,7 +1270,7 @@ void Assembler::GenInstrMsa2R(SecondaryField operation, SecondaryField df,
 
 void Assembler::GenInstrMsa2RF(SecondaryField operation, SecondaryField df,
                                MSARegister ws, MSARegister wd) {
-  DCHECK((kArchVariant == kMips64r6) && IsEnabled(MIPS_SIMD));
+  DCHECK(IsEnabled(MIPS_SIMD));
   DCHECK(ws.is_valid() && wd.is_valid());
   Instr instr = MSA | MSA_2RF_FORMAT | operation | df |
                 (ws.code() << kWsShift) | (wd.code() << kWdShift) |
@@ -1279,7 +1280,7 @@ void Assembler::GenInstrMsa2RF(SecondaryField operation, SecondaryField df,
 
 void Assembler::GenInstrMsaBranch(SecondaryField operation, MSARegister wt,
                                   int32_t offset16) {
-  DCHECK((kArchVariant == kMips64r6) && IsEnabled(MIPS_SIMD));
+  DCHECK(IsEnabled(MIPS_SIMD));
   DCHECK(wt.is_valid() && is_int16(offset16));
   BlockTrampolinePoolScope block_trampoline_pool(this);
   Instr instr =
@@ -3157,28 +3158,29 @@ MSA_BRANCH_LIST(MSA_BRANCH)
 #undef MSA_BRANCH_LIST
 
 #define MSA_LD_ST_LIST(V) \
-  V(ld_b, LD_B)           \
-  V(ld_h, LD_H)           \
-  V(ld_w, LD_W)           \
-  V(ld_d, LD_D)           \
-  V(st_b, ST_B)           \
-  V(st_h, ST_H)           \
-  V(st_w, ST_W)           \
-  V(st_d, ST_D)
-
-#define MSA_LD_ST(name, opcode)                                  \
-  void Assembler::name(MSARegister wd, const MemOperand& rs) {   \
-    MemOperand source = rs;                                      \
-    AdjustBaseAndOffset(&source);                                 \
-    if (is_int10(source.offset())) {                             \
-      GenInstrMsaMI10(opcode, source.offset(), source.rm(), wd); \
-    } else {                                                     \
-      UseScratchRegisterScope temps(this);                       \
-      Register scratch = temps.Acquire();                        \
-      DCHECK(rs.rm() != scratch);                                \
-      daddiu(scratch, source.rm(), source.offset());             \
-      GenInstrMsaMI10(opcode, 0, scratch, wd);                   \
-    }                                                            \
+  V(ld_b, LD_B, 1)        \
+  V(ld_h, LD_H, 2)        \
+  V(ld_w, LD_W, 4)        \
+  V(ld_d, LD_D, 8)        \
+  V(st_b, ST_B, 1)        \
+  V(st_h, ST_H, 2)        \
+  V(st_w, ST_W, 4)        \
+  V(st_d, ST_D, 8)
+
+#define MSA_LD_ST(name, opcode, b)                                   \
+  void Assembler::name(MSARegister wd, const MemOperand& rs) {       \
+    MemOperand source = rs;                                          \
+    AdjustBaseAndOffset(&source);                                    \
+    if (is_int10(source.offset())) {                                 \
+      DCHECK_EQ(source.offset() % b, 0);                             \
+      GenInstrMsaMI10(opcode, source.offset() / b, source.rm(), wd); \
+    } else {                                                         \
+      UseScratchRegisterScope temps(this);                           \
+      Register scratch = temps.Acquire();                            \
+      DCHECK_NE(rs.rm(), scratch);                                   \
+      daddiu(scratch, source.rm(), source.offset());                 \
+      GenInstrMsaMI10(opcode, 0, scratch, wd);                       \
+    }                                                                \
   }
 
 MSA_LD_ST_LIST(MSA_LD_ST)
@@ -3291,7 +3293,7 @@ MSA_2R_LIST(MSA_2R)
 
 #define MSA_FILL(format)                                              \
   void Assembler::fill_##format(MSARegister wd, Register rs) {        \
-    DCHECK((kArchVariant == kMips64r6) && IsEnabled(MIPS_SIMD));      \
+    DCHECK(IsEnabled(MIPS_SIMD));                                     \
     DCHECK(rs.is_valid() && wd.is_valid());                           \
     Instr instr = MSA | MSA_2R_FORMAT | FILL | MSA_2R_DF_##format |   \
                   (rs.code() << kWsShift) | (wd.code() << kWdShift) | \
diff --git a/deps/v8/src/codegen/mips64/interface-descriptors-mips64.cc b/deps/v8/src/codegen/mips64/interface-descriptors-mips64.cc
index 84910f1ee93..00067454f1e 100644
--- a/deps/v8/src/codegen/mips64/interface-descriptors-mips64.cc
+++ b/deps/v8/src/codegen/mips64/interface-descriptors-mips64.cc
@@ -39,14 +39,6 @@ void WasmI32AtomicWait32Descriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(kParameterCount, default_stub_registers);
 }
 
-void WasmI32AtomicWait64Descriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  const Register default_stub_registers[] = {a0, a1, a2};
-  CHECK_EQ(static_cast<size_t>(kParameterCount),
-           arraysize(default_stub_registers));
-  data->InitializePlatformSpecific(kParameterCount, default_stub_registers);
-}
-
 void WasmI64AtomicWait32Descriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   const Register default_stub_registers[] = {a0, a1, a2, a3, a4};
@@ -56,14 +48,6 @@ void WasmI64AtomicWait32Descriptor::InitializePlatformSpecific(
                                    default_stub_registers);
 }
 
-void WasmI64AtomicWait64Descriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  const Register default_stub_registers[] = {a0, a1, a2};
-  CHECK_EQ(static_cast<size_t>(kParameterCount),
-           arraysize(default_stub_registers));
-  data->InitializePlatformSpecific(kParameterCount, default_stub_registers);
-}
-
 void RecordWriteDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   const Register default_stub_registers[] = {a0, a1, a2, a3, kReturnRegister0};
@@ -233,12 +217,6 @@ void AbortDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  data->InitializePlatformSpecific(0, nullptr);
-}
-
 void CompareDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {a1, a0};
@@ -326,6 +304,54 @@ void RunMicrotasksEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+void BinaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallTrampoline_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void ConstructWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void ConstructWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void Compare_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void UnaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 3);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/mips64/macro-assembler-mips64.cc b/deps/v8/src/codegen/mips64/macro-assembler-mips64.cc
index 78f3228f248..341365e480d 100644
--- a/deps/v8/src/codegen/mips64/macro-assembler-mips64.cc
+++ b/deps/v8/src/codegen/mips64/macro-assembler-mips64.cc
@@ -16,7 +16,7 @@
 #include "src/codegen/register-configuration.h"
 #include "src/debug/debug.h"
 #include "src/execution/frames-inl.h"
-#include "src/heap/heap-inl.h"  // For MemoryChunk.
+#include "src/heap/memory-chunk.h"
 #include "src/init/bootstrapper.h"
 #include "src/logging/counters.h"
 #include "src/objects/heap-number.h"
@@ -2729,7 +2729,7 @@ void TurboAssembler::BranchMSA(Label* target, MSABranchDF df,
 void TurboAssembler::BranchShortMSA(MSABranchDF df, Label* target,
                                     MSABranchCondition cond, MSARegister wt,
                                     BranchDelaySlot bd) {
-  if (kArchVariant == kMips64r6) {
+  if (IsEnabled(MIPS_SIMD)) {
     BlockTrampolinePoolScope block_trampoline_pool(this);
     if (target) {
       switch (cond) {
@@ -2775,6 +2775,8 @@ void TurboAssembler::BranchShortMSA(MSABranchDF df, Label* target,
           UNREACHABLE();
       }
     }
+  } else {
+    UNREACHABLE();
   }
   if (bd == PROTECT) {
     nop();
@@ -5751,7 +5753,7 @@ void TurboAssembler::CallCFunctionHelper(Register function,
 void TurboAssembler::CheckPageFlag(Register object, Register scratch, int mask,
                                    Condition cc, Label* condition_met) {
   And(scratch, object, Operand(~kPageAlignmentMask));
-  Ld(scratch, MemOperand(scratch, MemoryChunk::kFlagsOffset));
+  Ld(scratch, MemOperand(scratch, BasicMemoryChunk::kFlagsOffset));
   And(scratch, scratch, Operand(mask));
   Branch(condition_met, cc, scratch, Operand(zero_reg));
 }
diff --git a/deps/v8/src/codegen/mips64/register-mips64.h b/deps/v8/src/codegen/mips64/register-mips64.h
index 9915f7d942f..d7b45eda383 100644
--- a/deps/v8/src/codegen/mips64/register-mips64.h
+++ b/deps/v8/src/codegen/mips64/register-mips64.h
@@ -207,6 +207,19 @@ constexpr bool kPadArguments = false;
 constexpr bool kSimpleFPAliasing = true;
 constexpr bool kSimdMaskRegisters = false;
 
+enum MSARegisterCode {
+#define REGISTER_CODE(R) kMsaCode_##R,
+  SIMD128_REGISTERS(REGISTER_CODE)
+#undef REGISTER_CODE
+      kMsaAfterLast
+};
+
+// MIPS SIMD (MSA) register
+class MSARegister : public RegisterBase<MSARegister, kMsaAfterLast> {
+  friend class RegisterBase;
+  explicit constexpr MSARegister(int code) : RegisterBase(code) {}
+};
+
 enum DoubleRegisterCode {
 #define REGISTER_CODE(R) kDoubleCode_##R,
   DOUBLE_REGISTERS(REGISTER_CODE)
@@ -234,24 +247,13 @@ class FPURegister : public RegisterBase<FPURegister, kDoubleAfterLast> {
     return FPURegister::from_code(code() + 1);
   }
 
+  MSARegister toW() const { return MSARegister::from_code(code()); }
+
  private:
   friend class RegisterBase;
   explicit constexpr FPURegister(int code) : RegisterBase(code) {}
 };
 
-enum MSARegisterCode {
-#define REGISTER_CODE(R) kMsaCode_##R,
-  SIMD128_REGISTERS(REGISTER_CODE)
-#undef REGISTER_CODE
-      kMsaAfterLast
-};
-
-// MIPS SIMD (MSA) register
-class MSARegister : public RegisterBase<MSARegister, kMsaAfterLast> {
-  friend class RegisterBase;
-  explicit constexpr MSARegister(int code) : RegisterBase(code) {}
-};
-
 // A few double registers are reserved: one as a scratch register and one to
 // hold 0.0.
 //  f28: 0.0
@@ -294,11 +296,13 @@ constexpr Register cp = s7;
 constexpr Register kScratchReg = s3;
 constexpr Register kScratchReg2 = s4;
 constexpr DoubleRegister kScratchDoubleReg = f30;
+// FPU zero reg is often used to hold 0.0, but it's not hardwired to 0.0.
 constexpr DoubleRegister kDoubleRegZero = f28;
 // Used on mips64r6 for compare operations.
 // We use the last non-callee saved odd register for N64 ABI
 constexpr DoubleRegister kDoubleCompareReg = f23;
 // MSA zero and scratch regs must have the same numbers as FPU zero and scratch
+// MSA zero reg is often used to hold 0, but it's not hardwired to 0.
 constexpr Simd128Register kSimd128RegZero = w28;
 constexpr Simd128Register kSimd128ScratchReg = w30;
 
@@ -383,6 +387,8 @@ constexpr Register kRuntimeCallArgvRegister = a2;
 constexpr Register kWasmInstanceRegister = a0;
 constexpr Register kWasmCompileLazyFuncIndexRegister = t0;
 
+constexpr DoubleRegister kFPReturnRegister0 = f0;
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/optimized-compilation-info.cc b/deps/v8/src/codegen/optimized-compilation-info.cc
index 7cf71e8d0f3..19f93e674e1 100644
--- a/deps/v8/src/codegen/optimized-compilation-info.cc
+++ b/deps/v8/src/codegen/optimized-compilation-info.cc
@@ -162,15 +162,13 @@ StackFrame::Type OptimizedCompilationInfo::GetOutputStackFrameType() const {
     case Code::BUILTIN:
       return StackFrame::STUB;
     case Code::WASM_FUNCTION:
-      return StackFrame::WASM_COMPILED;
+      return StackFrame::WASM;
     case Code::WASM_TO_CAPI_FUNCTION:
       return StackFrame::WASM_EXIT;
     case Code::JS_TO_WASM_FUNCTION:
       return StackFrame::JS_TO_WASM;
     case Code::WASM_TO_JS_FUNCTION:
       return StackFrame::WASM_TO_JS;
-    case Code::WASM_INTERPRETER_ENTRY:
-      return StackFrame::WASM_INTERPRETER_ENTRY;
     case Code::C_WASM_ENTRY:
       return StackFrame::C_WASM_ENTRY;
     default:
diff --git a/deps/v8/src/codegen/optimized-compilation-info.h b/deps/v8/src/codegen/optimized-compilation-info.h
index af3514b8281..34d35dc038b 100644
--- a/deps/v8/src/codegen/optimized-compilation-info.h
+++ b/deps/v8/src/codegen/optimized-compilation-info.h
@@ -11,6 +11,7 @@
 #include "src/codegen/source-position-table.h"
 #include "src/codegen/tick-counter.h"
 #include "src/common/globals.h"
+#include "src/diagnostics/basic-block-profiler.h"
 #include "src/execution/frames.h"
 #include "src/handles/handles.h"
 #include "src/objects/objects.h"
@@ -248,6 +249,12 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
     return optimization_id_;
   }
 
+  unsigned inlined_bytecode_size() const { return inlined_bytecode_size_; }
+
+  void set_inlined_bytecode_size(unsigned size) {
+    inlined_bytecode_size_ = size;
+  }
+
   struct InlinedFunctionHolder {
     Handle<SharedFunctionInfo> shared_info;
     Handle<BytecodeArray> bytecode_array;  // Explicit to prevent flushing.
@@ -284,6 +291,11 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
 
   TickCounter& tick_counter() { return tick_counter_; }
 
+  BasicBlockProfilerData* profiler_data() const { return profiler_data_; }
+  void set_profiler_data(BasicBlockProfilerData* profiler_data) {
+    profiler_data_ = profiler_data;
+  }
+
  private:
   OptimizedCompilationInfo(Code::Kind code_kind, Zone* zone);
   void ConfigureFlags();
@@ -312,6 +324,9 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
   // The compiled code.
   Handle<Code> code_;
 
+  // Basic block profiling support.
+  BasicBlockProfilerData* profiler_data_ = nullptr;
+
   // The WebAssembly compilation result, not published in the NativeModule yet.
   std::unique_ptr<wasm::WasmCompilationResult> wasm_compilation_result_;
 
@@ -329,6 +344,7 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
   InlinedFunctionList inlined_functions_;
 
   int optimization_id_ = -1;
+  unsigned inlined_bytecode_size_ = 0;
 
   // The current OSR frame for specialization or {nullptr}.
   JavaScriptFrame* osr_frame_ = nullptr;
diff --git a/deps/v8/src/codegen/ppc/assembler-ppc-inl.h b/deps/v8/src/codegen/ppc/assembler-ppc-inl.h
index c55a5a9c0bf..f6a2f7849d8 100644
--- a/deps/v8/src/codegen/ppc/assembler-ppc-inl.h
+++ b/deps/v8/src/codegen/ppc/assembler-ppc-inl.h
@@ -120,30 +120,86 @@ Address RelocInfo::constant_pool_entry_address() {
   UNREACHABLE();
 }
 
-int RelocInfo::target_address_size() { return Assembler::kSpecialTargetSize; }
+void Assembler::set_target_compressed_address_at(
+    Address pc, Address constant_pool, Tagged_t target,
+    ICacheFlushMode icache_flush_mode) {
+  Assembler::set_target_address_at(
+      pc, constant_pool, static_cast<Address>(target), icache_flush_mode);
+}
+
+int RelocInfo::target_address_size() {
+  if (IsCodedSpecially()) {
+    return Assembler::kSpecialTargetSize;
+  } else {
+    return kSystemPointerSize;
+  }
+}
+
+Tagged_t Assembler::target_compressed_address_at(Address pc,
+                                                 Address constant_pool) {
+  return static_cast<Tagged_t>(target_address_at(pc, constant_pool));
+}
+
+Handle<Object> Assembler::code_target_object_handle_at(Address pc,
+                                                       Address constant_pool) {
+  int index =
+      static_cast<int>(target_address_at(pc, constant_pool)) & 0xFFFFFFFF;
+  return GetCodeTarget(index);
+}
 
 HeapObject RelocInfo::target_object() {
-  DCHECK(IsCodeTarget(rmode_) || rmode_ == FULL_EMBEDDED_OBJECT);
-  return HeapObject::cast(
-      Object(Assembler::target_address_at(pc_, constant_pool_)));
+  DCHECK(IsCodeTarget(rmode_) || IsEmbeddedObjectMode(rmode_));
+  if (IsCompressedEmbeddedObject(rmode_)) {
+    return HeapObject::cast(Object(DecompressTaggedAny(
+        host_.address(),
+        Assembler::target_compressed_address_at(pc_, constant_pool_))));
+  } else {
+    return HeapObject::cast(
+        Object(Assembler::target_address_at(pc_, constant_pool_)));
+  }
 }
 
 HeapObject RelocInfo::target_object_no_host(Isolate* isolate) {
-  return target_object();
+  if (IsCompressedEmbeddedObject(rmode_)) {
+    return HeapObject::cast(Object(DecompressTaggedAny(
+        isolate,
+        Assembler::target_compressed_address_at(pc_, constant_pool_))));
+  } else {
+    return target_object();
+  }
+}
+
+Handle<HeapObject> Assembler::compressed_embedded_object_handle_at(
+    Address pc, Address const_pool) {
+  return GetEmbeddedObject(target_compressed_address_at(pc, const_pool));
 }
 
 Handle<HeapObject> RelocInfo::target_object_handle(Assembler* origin) {
-  DCHECK(IsCodeTarget(rmode_) || rmode_ == FULL_EMBEDDED_OBJECT);
-  return Handle<HeapObject>(reinterpret_cast<Address*>(
-      Assembler::target_address_at(pc_, constant_pool_)));
+  DCHECK(IsCodeTarget(rmode_) || IsEmbeddedObjectMode(rmode_));
+  if (IsCodeTarget(rmode_)) {
+    return Handle<HeapObject>::cast(
+        origin->code_target_object_handle_at(pc_, constant_pool_));
+  } else {
+    if (IsCompressedEmbeddedObject(rmode_)) {
+      return origin->compressed_embedded_object_handle_at(pc_, constant_pool_);
+    }
+    return Handle<HeapObject>(reinterpret_cast<Address*>(
+        Assembler::target_address_at(pc_, constant_pool_)));
+  }
 }
 
 void RelocInfo::set_target_object(Heap* heap, HeapObject target,
                                   WriteBarrierMode write_barrier_mode,
                                   ICacheFlushMode icache_flush_mode) {
-  DCHECK(IsCodeTarget(rmode_) || rmode_ == FULL_EMBEDDED_OBJECT);
-  Assembler::set_target_address_at(pc_, constant_pool_, target.ptr(),
-                                   icache_flush_mode);
+  DCHECK(IsCodeTarget(rmode_) || IsEmbeddedObjectMode(rmode_));
+  if (IsCompressedEmbeddedObject(rmode_)) {
+    Assembler::set_target_compressed_address_at(
+        pc_, constant_pool_, CompressTagged(target.ptr()), icache_flush_mode);
+  } else {
+    DCHECK(IsFullEmbeddedObject(rmode_));
+    Assembler::set_target_address_at(pc_, constant_pool_, target.ptr(),
+                                     icache_flush_mode);
+  }
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && !host().is_null() &&
       !FLAG_disable_write_barriers) {
     WriteBarrierForCode(host(), this, target);
@@ -181,13 +237,16 @@ Address RelocInfo::target_off_heap_target() {
 }
 
 void RelocInfo::WipeOut() {
-  DCHECK(IsFullEmbeddedObject(rmode_) || IsCodeTarget(rmode_) ||
+  DCHECK(IsEmbeddedObjectMode(rmode_) || IsCodeTarget(rmode_) ||
          IsRuntimeEntry(rmode_) || IsExternalReference(rmode_) ||
          IsInternalReference(rmode_) || IsInternalReferenceEncoded(rmode_) ||
          IsOffHeapTarget(rmode_));
   if (IsInternalReference(rmode_)) {
     // Jump table entry
     Memory<Address>(pc_) = kNullAddress;
+  } else if (IsCompressedEmbeddedObject(rmode_)) {
+    Assembler::set_target_compressed_address_at(pc_, constant_pool_,
+                                                kNullAddress);
   } else if (IsInternalReferenceEncoded(rmode_) || IsOffHeapTarget(rmode_)) {
     // mov sequence
     // Currently used only by deserializer, no need to flush.
diff --git a/deps/v8/src/codegen/ppc/assembler-ppc.cc b/deps/v8/src/codegen/ppc/assembler-ppc.cc
index a305a104f03..5c9bdb5c5d7 100644
--- a/deps/v8/src/codegen/ppc/assembler-ppc.cc
+++ b/deps/v8/src/codegen/ppc/assembler-ppc.cc
@@ -511,7 +511,7 @@ void Assembler::target_at_put(int pos, int target_pos, bool* is_branch) {
     case kUnboundJumpTableEntryOpcode: {
       PatchingAssembler patcher(options(),
                                 reinterpret_cast<byte*>(buffer_start_ + pos),
-                                kPointerSize / kInstrSize);
+                                kSystemPointerSize / kInstrSize);
       // Keep internal references relative until EmitRelocations.
       patcher.dp(target_pos);
       break;
@@ -1757,6 +1757,22 @@ void Assembler::fmsub(const DoubleRegister frt, const DoubleRegister fra,
        frc.code() * B6 | rc);
 }
 
+// Vector instructions
+void Assembler::mfvsrd(const Register ra, const DoubleRegister rs) {
+  int SX = 1;
+  emit(MFVSRD | rs.code() * B21 | ra.code() * B16 | SX);
+}
+
+void Assembler::mfvsrwz(const Register ra, const DoubleRegister rs) {
+  int SX = 1;
+  emit(MFVSRWZ | rs.code() * B21 | ra.code() * B16 | SX);
+}
+
+void Assembler::mtvsrd(const Simd128Register rt, const Register ra) {
+  int TX = 1;
+  emit(MTVSRD | rt.code() * B21 | ra.code() * B16 | TX);
+}
+
 // Pseudo instructions.
 void Assembler::nop(int type) {
   Register reg = r0;
diff --git a/deps/v8/src/codegen/ppc/assembler-ppc.h b/deps/v8/src/codegen/ppc/assembler-ppc.h
index b27a4fd8fe1..7b9c950b1a5 100644
--- a/deps/v8/src/codegen/ppc/assembler-ppc.h
+++ b/deps/v8/src/codegen/ppc/assembler-ppc.h
@@ -254,6 +254,18 @@ class Assembler : public AssemblerBase {
       Address pc, Address constant_pool, Address target,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
 
+  // Read/Modify the code target address in the branch/call instruction at pc.
+  inline static Tagged_t target_compressed_address_at(Address pc,
+                                                      Address constant_pool);
+  inline static void set_target_compressed_address_at(
+      Address pc, Address constant_pool, Tagged_t target,
+      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
+
+  inline Handle<Object> code_target_object_handle_at(Address pc,
+                                                     Address constant_pool);
+  inline Handle<HeapObject> compressed_embedded_object_handle_at(
+      Address pc, Address constant_pool);
+
   // This sets the branch destination.
   // This is for calls and branches within generated code.
   inline static void deserialization_set_special_target_at(
@@ -423,9 +435,10 @@ class Assembler : public AssemblerBase {
 
   inline void xx3_form(Instr instr, DoubleRegister t, DoubleRegister a,
                        DoubleRegister b) {
-    int AX = ((a.code() & 0x20) >> 5) & 0x1;
-    int BX = ((b.code() & 0x20) >> 5) & 0x1;
-    int TX = ((t.code() & 0x20) >> 5) & 0x1;
+    // Using VR (high VSR) registers.
+    int AX = 1;
+    int BX = 1;
+    int TX = 1;
 
     emit(instr | (t.code() & 0x1F) * B21 | (a.code() & 0x1F) * B16 |
          (b.code() & 0x1F) * B11 | AX * B2 | BX * B1 | TX);
@@ -434,6 +447,46 @@ class Assembler : public AssemblerBase {
   PPC_XX3_OPCODE_LIST(DECLARE_PPC_XX3_INSTRUCTIONS)
 #undef DECLARE_PPC_XX3_INSTRUCTIONS
 
+#define DECLARE_PPC_VX_INSTRUCTIONS_A_FORM(name, instr_name, instr_value) \
+  inline void name(const Simd128Register rt, const Simd128Register rb,    \
+                   const Operand& imm) {                                  \
+    vx_form(instr_name, rt, rb, imm);                                     \
+  }
+#define DECLARE_PPC_VX_INSTRUCTIONS_B_FORM(name, instr_name, instr_value) \
+  inline void name(const Simd128Register rt, const Simd128Register ra,    \
+                   const Simd128Register rb) {                            \
+    vx_form(instr_name, rt, ra, rb);                                      \
+  }
+
+  inline void vx_form(Instr instr, Simd128Register rt, Simd128Register rb,
+                      const Operand& imm) {
+    emit(instr | rt.code() * B21 | imm.immediate() * B16 | rb.code() * B11);
+  }
+  inline void vx_form(Instr instr, Simd128Register rt, Simd128Register ra,
+                      Simd128Register rb) {
+    emit(instr | rt.code() * B21 | ra.code() * B16 | rb.code() * B11);
+  }
+
+  PPC_VX_OPCODE_A_FORM_LIST(DECLARE_PPC_VX_INSTRUCTIONS_A_FORM)
+  PPC_VX_OPCODE_B_FORM_LIST(DECLARE_PPC_VX_INSTRUCTIONS_B_FORM)
+#undef DECLARE_PPC_VX_INSTRUCTIONS_A_FORM
+#undef DECLARE_PPC_VX_INSTRUCTIONS_B_FORM
+
+#define DECLARE_PPC_VA_INSTRUCTIONS_A_FORM(name, instr_name, instr_value) \
+  inline void name(const Simd128Register rt, const Simd128Register ra,    \
+                   const Simd128Register rb, const Simd128Register rc) {  \
+    va_form(instr_name, rt, ra, rb, rc);                                  \
+  }
+
+  inline void va_form(Instr instr, Simd128Register rt, Simd128Register ra,
+                      Simd128Register rb, Simd128Register rc) {
+    emit(instr | rt.code() * B21 | ra.code() * B16 | rb.code() * B11 |
+         rc.code() * B6);
+  }
+
+  PPC_VA_OPCODE_A_FORM_LIST(DECLARE_PPC_VA_INSTRUCTIONS_A_FORM)
+#undef DECLARE_PPC_VA_INSTRUCTIONS_A_FORM
+
   RegList* GetScratchRegisterList() { return &scratch_register_list_; }
   // ---------------------------------------------------------------------------
   // Code generation
@@ -920,6 +973,11 @@ class Assembler : public AssemblerBase {
              const DoubleRegister frc, const DoubleRegister frb,
              RCBit rc = LeaveRC);
 
+  // Vector instructions
+  void mfvsrd(const Register ra, const DoubleRegister r);
+  void mfvsrwz(const Register ra, const DoubleRegister r);
+  void mtvsrd(const Simd128Register rt, const Register ra);
+
   // Pseudo instructions
 
   // Different nop operations are used by the code generator to detect certain
@@ -941,9 +999,9 @@ class Assembler : public AssemblerBase {
 
   void push(Register src) {
 #if V8_TARGET_ARCH_PPC64
-    stdu(src, MemOperand(sp, -kPointerSize));
+    stdu(src, MemOperand(sp, -kSystemPointerSize));
 #else
-    stwu(src, MemOperand(sp, -kPointerSize));
+    stwu(src, MemOperand(sp, -kSystemPointerSize));
 #endif
   }
 
@@ -953,10 +1011,10 @@ class Assembler : public AssemblerBase {
 #else
     lwz(dst, MemOperand(sp));
 #endif
-    addi(sp, sp, Operand(kPointerSize));
+    addi(sp, sp, Operand(kSystemPointerSize));
   }
 
-  void pop() { addi(sp, sp, Operand(kPointerSize)); }
+  void pop() { addi(sp, sp, Operand(kSystemPointerSize)); }
 
   // Jump unconditionally to given label.
   void jmp(Label* L) { b(L); }
diff --git a/deps/v8/src/codegen/ppc/constants-ppc.h b/deps/v8/src/codegen/ppc/constants-ppc.h
index fe7df45ae50..23674f2a17a 100644
--- a/deps/v8/src/codegen/ppc/constants-ppc.h
+++ b/deps/v8/src/codegen/ppc/constants-ppc.h
@@ -1229,7 +1229,11 @@ using Instr = uint32_t;
   /* Store Floating-Point Single with Update Indexed */ \
   V(stfsux, STFSUX, 0x7C00056E)                         \
   /* Store Floating-Point Single Indexed */             \
-  V(stfsx, STFSX, 0x7C00052E)
+  V(stfsx, STFSX, 0x7C00052E)                           \
+  /* Load Vector Indexed */                             \
+  V(lvx, LVX, 0x7C0000CE)                               \
+  /* Store Vector Indexed */                            \
+  V(stvx, STVX, 0x7C0001CE)
 
 #define PPC_X_OPCODE_E_FORM_LIST(V)          \
   /* Shift Right Algebraic Word Immediate */ \
@@ -1693,8 +1697,6 @@ using Instr = uint32_t;
   V(lvsl, LVSL, 0x7C00000C)                                                   \
   /* Load Vector for Shift Right */                                           \
   V(lvsr, LVSR, 0x7C00004C)                                                   \
-  /* Load Vector Indexed */                                                   \
-  V(lvx, LVX, 0x7C0000CE)                                                     \
   /* Load Vector Indexed Last */                                              \
   V(lvxl, LVXL, 0x7C0002CE)                                                   \
   /* Store Vector Element Byte Indexed */                                     \
@@ -1703,8 +1705,6 @@ using Instr = uint32_t;
   V(stvehx, STVEHX, 0x7C00014E)                                               \
   /* Store Vector Element Word Indexed */                                     \
   V(stvewx, STVEWX, 0x7C00018E)                                               \
-  /* Store Vector Indexed */                                                  \
-  V(stvx, STVX, 0x7C0001CE)                                                   \
   /* Store Vector Indexed Last */                                             \
   V(stvxl, STVXL, 0x7C0003CE)                                                 \
   /* Vector Minimum Signed Doubleword */                                      \
@@ -1920,7 +1920,13 @@ using Instr = uint32_t;
   /* Floating Reciprocal Square Root Estimate Single */ \
   V(frsqrtes, FRSQRTES, 0xEC000034)
 
-#define PPC_VA_OPCODE_LIST(V)                                    \
+#define PPC_VA_OPCODE_A_FORM_LIST(V)                     \
+  /* Vector Permute */                                   \
+  V(vperm, VPERM, 0x1000002B)                            \
+  /* Vector Multiply-Low-Add Unsigned Halfword Modulo */ \
+  V(vmladduhm, VMLADDUHM, 0x10000022)
+
+#define PPC_VA_OPCODE_UNUSED_LIST(V)                             \
   /* Vector Add Extended & write Carry Unsigned Quadword */      \
   V(vaddecuq, VADDECUQ, 0x1000003D)                              \
   /* Vector Add Extended Unsigned Quadword Modulo */             \
@@ -1931,8 +1937,6 @@ using Instr = uint32_t;
   V(vmhaddshs, VMHADDSHS, 0x10000020)                            \
   /* Vector Multiply-High-Round-Add Signed Halfword Saturate */  \
   V(vmhraddshs, VMHRADDSHS, 0x10000021)                          \
-  /* Vector Multiply-Low-Add Unsigned Halfword Modulo */         \
-  V(vmladduhm, VMLADDUHM, 0x10000022)                            \
   /* Vector Multiply-Sum Mixed Byte Modulo */                    \
   V(vmsummbm, VMSUMMBM, 0x10000025)                              \
   /* Vector Multiply-Sum Signed Halfword Modulo */               \
@@ -1947,8 +1951,6 @@ using Instr = uint32_t;
   V(vmsumuhs, VMSUMUHS, 0x10000027)                              \
   /* Vector Negative Multiply-Subtract Single-Precision */       \
   V(vnmsubfp, VNMSUBFP, 0x1000002F)                              \
-  /* Vector Permute */                                           \
-  V(vperm, VPERM, 0x1000002B)                                    \
   /* Vector Select */                                            \
   V(vsel, VSEL, 0x1000002A)                                      \
   /* Vector Shift Left Double by Octet Immediate */              \
@@ -1960,6 +1962,10 @@ using Instr = uint32_t;
   /* Vector Permute and Exclusive-OR */                          \
   V(vpermxor, VPERMXOR, 0x1000002D)
 
+#define PPC_VA_OPCODE_LIST(V)  \
+  PPC_VA_OPCODE_A_FORM_LIST(V) \
+  PPC_VA_OPCODE_UNUSED_LIST(V)
+
 #define PPC_XX1_OPCODE_LIST(V)                            \
   /* Load VSR Scalar Doubleword Indexed */                \
   V(lxsdx, LXSDX, 0x7C000498)                             \
@@ -2192,7 +2198,55 @@ using Instr = uint32_t;
   /* Rotate Left Word then AND with Mask */           \
   V(rlwnm, RLWNMX, 0x5C000000)
 
-#define PPC_VX_OPCODE_LIST(V)                                             \
+#define PPC_VX_OPCODE_A_FORM_LIST(V) \
+  /* Vector Splat Byte */            \
+  V(vspltb, VSPLTB, 0x1000020C)      \
+  /* Vector Splat Word */            \
+  V(vspltw, VSPLTW, 0x1000028C)      \
+  /* Vector Splat Halfword */        \
+  V(vsplth, VSPLTH, 0x1000024C)
+
+#define PPC_VX_OPCODE_B_FORM_LIST(V)                  \
+  /* Vector Logical OR */                             \
+  V(vor, VOR, 0x10000484)                             \
+  /* Vector Logical XOR */                            \
+  V(vxor, VXOR, 0x100004C4)                           \
+  /* Vector Logical NOR */                            \
+  V(vnor, VNOR, 0x10000504)                           \
+  /* Vector Shift Right by Octet */                   \
+  V(vsro, VSRO, 0x1000044C)                           \
+  /* Vector Shift Left by Octet */                    \
+  V(vslo, VSLO, 0x1000040C)                           \
+  /* Vector Add Unsigned Doubleword Modulo */         \
+  V(vaddudm, VADDUDM, 0x100000C0)                     \
+  /* Vector Add Unsigned Word Modulo */               \
+  V(vadduwm, VADDUWM, 0x10000080)                     \
+  /* Vector Add Unsigned Halfword Modulo */           \
+  V(vadduhm, VADDUHM, 0x10000040)                     \
+  /* Vector Add Unsigned Byte Modulo */               \
+  V(vaddubm, VADDUBM, 0x10000000)                     \
+  /* Vector Add Single-Precision */                   \
+  V(vaddfp, VADDFP, 0x1000000A)                       \
+  /* Vector Subtract Single-Precision */              \
+  V(vsubfp, VSUBFP, 0x1000004A)                       \
+  /* Vector Subtract Unsigned Doubleword Modulo */    \
+  V(vsubudm, VSUBUDM, 0x100004C0)                     \
+  /* Vector Subtract Unsigned Word Modulo */          \
+  V(vsubuwm, VSUBUWM, 0x10000480)                     \
+  /* Vector Subtract Unsigned Halfword Modulo */      \
+  V(vsubuhm, VSUBUHM, 0x10000440)                     \
+  /* Vector Subtract Unsigned Byte Modulo */          \
+  V(vsububm, VSUBUBM, 0x10000400)                     \
+  /* Vector Multiply Unsigned Word Modulo */          \
+  V(vmuluwm, VMULUWM, 0x10000089)                     \
+  /* Vector Pack Unsigned Halfword Unsigned Modulo */ \
+  V(vpkuhum, VPKUHUM, 0x1000000E)                     \
+  /* Vector Multiply Even Unsigned Byte */            \
+  V(vmuleub, VMULEUB, 0x10000208)                     \
+  /* Vector Multiply Odd Unsigned Byte */             \
+  V(vmuloub, VMULOUB, 0x10000008)
+
+#define PPC_VX_OPCODE_UNUSED_LIST(V)                                      \
   /* Decimal Add Modulo */                                                \
   V(bcdadd, BCDADD, 0xF0000400)                                           \
   /* Decimal Subtract Modulo */                                           \
@@ -2205,28 +2259,18 @@ using Instr = uint32_t;
   V(vaddcuq, VADDCUQ, 0x10000140)                                         \
   /* Vector Add and Write Carry-Out Unsigned Word */                      \
   V(vaddcuw, VADDCUW, 0x10000180)                                         \
-  /* Vector Add Single-Precision */                                       \
-  V(vaddfp, VADDFP, 0x1000000A)                                           \
   /* Vector Add Signed Byte Saturate */                                   \
   V(vaddsbs, VADDSBS, 0x10000300)                                         \
   /* Vector Add Signed Halfword Saturate */                               \
   V(vaddshs, VADDSHS, 0x10000340)                                         \
   /* Vector Add Signed Word Saturate */                                   \
   V(vaddsws, VADDSWS, 0x10000380)                                         \
-  /* Vector Add Unsigned Byte Modulo */                                   \
-  V(vaddubm, VADDUBM, 0x10000000)                                         \
   /* Vector Add Unsigned Byte Saturate */                                 \
   V(vaddubs, VADDUBS, 0x10000200)                                         \
-  /* Vector Add Unsigned Doubleword Modulo */                             \
-  V(vaddudm, VADDUDM, 0x100000C0)                                         \
-  /* Vector Add Unsigned Halfword Modulo */                               \
-  V(vadduhm, VADDUHM, 0x10000040)                                         \
   /* Vector Add Unsigned Halfword Saturate */                             \
   V(vadduhs, VADDUHS, 0x10000240)                                         \
   /* Vector Add Unsigned Quadword Modulo */                               \
   V(vadduqm, VADDUQM, 0x10000100)                                         \
-  /* Vector Add Unsigned Word Modulo */                                   \
-  V(vadduwm, VADDUWM, 0x10000080)                                         \
   /* Vector Add Unsigned Word Saturate */                                 \
   V(vadduws, VADDUWS, 0x10000280)                                         \
   /* Vector Logical AND */                                                \
@@ -2325,8 +2369,6 @@ using Instr = uint32_t;
   V(vmulesh, VMULESH, 0x10000348)                                         \
   /* Vector Multiply Even Signed Word */                                  \
   V(vmulesw, VMULESW, 0x10000388)                                         \
-  /* Vector Multiply Even Unsigned Byte */                                \
-  V(vmuleub, VMULEUB, 0x10000208)                                         \
   /* Vector Multiply Even Unsigned Halfword */                            \
   V(vmuleuh, VMULEUH, 0x10000248)                                         \
   /* Vector Multiply Even Unsigned Word */                                \
@@ -2337,20 +2379,12 @@ using Instr = uint32_t;
   V(vmulosh, VMULOSH, 0x10000148)                                         \
   /* Vector Multiply Odd Signed Word */                                   \
   V(vmulosw, VMULOSW, 0x10000188)                                         \
-  /* Vector Multiply Odd Unsigned Byte */                                 \
-  V(vmuloub, VMULOUB, 0x10000008)                                         \
   /* Vector Multiply Odd Unsigned Halfword */                             \
   V(vmulouh, VMULOUH, 0x10000048)                                         \
   /* Vector Multiply Odd Unsigned Word */                                 \
   V(vmulouw, VMULOUW, 0x10000088)                                         \
-  /* Vector Multiply Unsigned Word Modulo */                              \
-  V(vmuluwm, VMULUWM, 0x10000089)                                         \
   /* Vector NAND */                                                       \
   V(vnand, VNAND, 0x10000584)                                             \
-  /* Vector Logical NOR */                                                \
-  V(vnor, VNOR, 0x10000504)                                               \
-  /* Vector Logical OR */                                                 \
-  V(vor, VOR, 0x10000484)                                                 \
   /* Vector OR with Complement */                                         \
   V(vorc, VORC, 0x10000544)                                               \
   /* Vector Pack Pixel */                                                 \
@@ -2371,8 +2405,6 @@ using Instr = uint32_t;
   V(vpkudum, VPKUDUM, 0x1000044E)                                         \
   /* Vector Pack Unsigned Doubleword Unsigned Saturate */                 \
   V(vpkudus, VPKUDUS, 0x100004CE)                                         \
-  /* Vector Pack Unsigned Halfword Unsigned Modulo */                     \
-  V(vpkuhum, VPKUHUM, 0x1000000E)                                         \
   /* Vector Pack Unsigned Halfword Unsigned Saturate */                   \
   V(vpkuhus, VPKUHUS, 0x1000008E)                                         \
   /* Vector Pack Unsigned Word Unsigned Modulo */                         \
@@ -2423,22 +2455,14 @@ using Instr = uint32_t;
   V(vsld, VSLD, 0x100005C4)                                               \
   /* Vector Shift Left Halfword */                                        \
   V(vslh, VSLH, 0x10000144)                                               \
-  /* Vector Shift Left by Octet */                                        \
-  V(vslo, VSLO, 0x1000040C)                                               \
   /* Vector Shift Left Word */                                            \
   V(vslw, VSLW, 0x10000184)                                               \
-  /* Vector Splat Byte */                                                 \
-  V(vspltb, VSPLTB, 0x1000020C)                                           \
-  /* Vector Splat Halfword */                                             \
-  V(vsplth, VSPLTH, 0x1000024C)                                           \
   /* Vector Splat Immediate Signed Byte */                                \
   V(vspltisb, VSPLTISB, 0x1000030C)                                       \
   /* Vector Splat Immediate Signed Halfword */                            \
   V(vspltish, VSPLTISH, 0x1000034C)                                       \
   /* Vector Splat Immediate Signed Word */                                \
   V(vspltisw, VSPLTISW, 0x1000038C)                                       \
-  /* Vector Splat Word */                                                 \
-  V(vspltw, VSPLTW, 0x1000028C)                                           \
   /* Vector Shift Right */                                                \
   V(vsr, VSR, 0x100002C4)                                                 \
   /* Vector Shift Right Algebraic Byte */                                 \
@@ -2455,36 +2479,24 @@ using Instr = uint32_t;
   V(vsrd, VSRD, 0x100006C4)                                               \
   /* Vector Shift Right Halfword */                                       \
   V(vsrh, VSRH, 0x10000244)                                               \
-  /* Vector Shift Right by Octet */                                       \
-  V(vsro, VSRO, 0x1000044C)                                               \
   /* Vector Shift Right Word */                                           \
   V(vsrw, VSRW, 0x10000284)                                               \
   /* Vector Subtract & write Carry Unsigned Quadword */                   \
   V(vsubcuq, VSUBCUQ, 0x10000540)                                         \
   /* Vector Subtract and Write Carry-Out Unsigned Word */                 \
   V(vsubcuw, VSUBCUW, 0x10000580)                                         \
-  /* Vector Subtract Single-Precision */                                  \
-  V(vsubfp, VSUBFP, 0x1000004A)                                           \
   /* Vector Subtract Signed Byte Saturate */                              \
   V(vsubsbs, VSUBSBS, 0x10000700)                                         \
   /* Vector Subtract Signed Halfword Saturate */                          \
   V(vsubshs, VSUBSHS, 0x10000740)                                         \
   /* Vector Subtract Signed Word Saturate */                              \
   V(vsubsws, VSUBSWS, 0x10000780)                                         \
-  /* Vector Subtract Unsigned Byte Modulo */                              \
-  V(vsububm, VSUBUBM, 0x10000400)                                         \
   /* Vector Subtract Unsigned Byte Saturate */                            \
   V(vsububs, VSUBUBS, 0x10000600)                                         \
-  /* Vector Subtract Unsigned Doubleword Modulo */                        \
-  V(vsubudm, VSUBUDM, 0x100004C0)                                         \
-  /* Vector Subtract Unsigned Halfword Modulo */                          \
-  V(vsubuhm, VSUBUHM, 0x10000440)                                         \
   /* Vector Subtract Unsigned Halfword Saturate */                        \
   V(vsubuhs, VSUBUHS, 0x10000640)                                         \
   /* Vector Subtract Unsigned Quadword Modulo */                          \
   V(vsubuqm, VSUBUQM, 0x10000500)                                         \
-  /* Vector Subtract Unsigned Word Modulo */                              \
-  V(vsubuwm, VSUBUWM, 0x10000480)                                         \
   /* Vector Subtract Unsigned Word Saturate */                            \
   V(vsubuws, VSUBUWS, 0x10000680)                                         \
   /* Vector Sum across Half Signed Word Saturate */                       \
@@ -2513,8 +2525,6 @@ using Instr = uint32_t;
   V(vupklsh, VUPKLSH, 0x100002CE)                                         \
   /* Vector Unpack Low Signed Word */                                     \
   V(vupklsw, VUPKLSW, 0x100006CE)                                         \
-  /* Vector Logical XOR */                                                \
-  V(vxor, VXOR, 0x100004C4)                                               \
   /* Vector AES Cipher */                                                 \
   V(vcipher, VCIPHER, 0x10000508)                                         \
   /* Vector AES Cipher Last */                                            \
@@ -2534,6 +2544,11 @@ using Instr = uint32_t;
   /* Vector Merge Odd Word */                                             \
   V(vmrgow, VMRGOW, 0x1000068C)
 
+#define PPC_VX_OPCODE_LIST(V)  \
+  PPC_VX_OPCODE_A_FORM_LIST(V) \
+  PPC_VX_OPCODE_B_FORM_LIST(V) \
+  PPC_VX_OPCODE_UNUSED_LIST(V)
+
 #define PPC_XS_OPCODE_LIST(V)                      \
   /* Shift Right Algebraic Doubleword Immediate */ \
   V(sradi, SRADIX, 0x7C000674)
@@ -2587,7 +2602,8 @@ enum Opcode : uint32_t {
   opcode_name = opcode_value,
   PPC_OPCODE_LIST(DECLARE_INSTRUCTION)
 #undef DECLARE_INSTRUCTION
-      EXT1 = 0x4C000000,  // Extended code set 1
+      EXT0 = 0x10000000,  // Extended code set 0
+  EXT1 = 0x4C000000,      // Extended code set 1
   EXT2 = 0x7C000000,      // Extended code set 2
   EXT3 = 0xEC000000,      // Extended code set 3
   EXT4 = 0xFC000000,      // Extended code set 4
diff --git a/deps/v8/src/codegen/ppc/interface-descriptors-ppc.cc b/deps/v8/src/codegen/ppc/interface-descriptors-ppc.cc
index f2264b05fa9..65f574d1b30 100644
--- a/deps/v8/src/codegen/ppc/interface-descriptors-ppc.cc
+++ b/deps/v8/src/codegen/ppc/interface-descriptors-ppc.cc
@@ -191,11 +191,6 @@ void AbortDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  data->InitializePlatformSpecific(0, nullptr);
-}
-
 void CompareDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {r4, r3};
@@ -283,6 +278,54 @@ void RunMicrotasksEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+void BinaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallTrampoline_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void ConstructWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void ConstructWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void Compare_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void UnaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 3);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/ppc/macro-assembler-ppc.cc b/deps/v8/src/codegen/ppc/macro-assembler-ppc.cc
index ca6d472c93f..14ed9682275 100644
--- a/deps/v8/src/codegen/ppc/macro-assembler-ppc.cc
+++ b/deps/v8/src/codegen/ppc/macro-assembler-ppc.cc
@@ -16,7 +16,7 @@
 #include "src/codegen/register-configuration.h"
 #include "src/debug/debug.h"
 #include "src/execution/frames-inl.h"
-#include "src/heap/heap-inl.h"  // For MemoryChunk.
+#include "src/heap/memory-chunk.h"
 #include "src/init/bootstrapper.h"
 #include "src/logging/counters.h"
 #include "src/runtime/runtime.h"
@@ -50,7 +50,7 @@ int TurboAssembler::RequiredStackSizeForCallerSaved(SaveFPRegsMode fp_mode,
   }
 
   RegList list = kJSCallerSaved & ~exclusions;
-  bytes += NumRegs(list) * kPointerSize;
+  bytes += NumRegs(list) * kSystemPointerSize;
 
   if (fp_mode == kSaveFPRegs) {
     bytes += kNumCallerSavedDoubles * kDoubleSize;
@@ -75,7 +75,7 @@ int TurboAssembler::PushCallerSaved(SaveFPRegsMode fp_mode, Register exclusion1,
 
   RegList list = kJSCallerSaved & ~exclusions;
   MultiPush(list);
-  bytes += NumRegs(list) * kPointerSize;
+  bytes += NumRegs(list) * kSystemPointerSize;
 
   if (fp_mode == kSaveFPRegs) {
     MultiPushDoubles(kCallerSavedDoubles);
@@ -106,7 +106,7 @@ int TurboAssembler::PopCallerSaved(SaveFPRegsMode fp_mode, Register exclusion1,
 
   RegList list = kJSCallerSaved & ~exclusions;
   MultiPop(list);
-  bytes += NumRegs(list) * kPointerSize;
+  bytes += NumRegs(list) * kSystemPointerSize;
 
   return bytes;
 }
@@ -120,13 +120,13 @@ void TurboAssembler::LoadFromConstantsTable(Register destination,
                                             int constant_index) {
   DCHECK(RootsTable::IsImmortalImmovable(RootIndex::kBuiltinsConstantsTable));
 
-  const uint32_t offset =
-      FixedArray::kHeaderSize + constant_index * kPointerSize - kHeapObjectTag;
-
-  CHECK(is_uint19(offset));
   DCHECK_NE(destination, r0);
   LoadRoot(destination, RootIndex::kBuiltinsConstantsTable);
-  LoadP(destination, MemOperand(destination, offset), r0);
+  LoadTaggedPointerField(
+      destination,
+      FieldMemOperand(destination,
+                      FixedArray::OffsetOfElementAt(constant_index)),
+      r0);
 }
 
 void TurboAssembler::LoadRootRelative(Register destination, int32_t offset) {
@@ -202,7 +202,8 @@ void TurboAssembler::Jump(Handle<Code> code, RelocInfo::Mode rmode,
     bind(&skip);
     return;
   }
-  Jump(static_cast<intptr_t>(code.address()), rmode, cond, cr);
+  int32_t target_index = AddCodeTarget(code);
+  Jump(static_cast<intptr_t>(target_index), rmode, cond, cr);
 }
 
 void TurboAssembler::Jump(const ExternalReference& reference) {
@@ -212,7 +213,8 @@ void TurboAssembler::Jump(const ExternalReference& reference) {
   if (ABI_USES_FUNCTION_DESCRIPTORS) {
     // AIX uses a function descriptor. When calling C code be
     // aware of this descriptor and pick up values from it.
-    LoadP(ToRegister(ABI_TOC_REGISTER), MemOperand(scratch, kPointerSize));
+    LoadP(ToRegister(ABI_TOC_REGISTER),
+          MemOperand(scratch, kSystemPointerSize));
     LoadP(scratch, MemOperand(scratch, 0));
   }
   Jump(scratch);
@@ -291,17 +293,18 @@ void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode,
     return;
   }
   DCHECK(code->IsExecutable());
-  Call(code.address(), rmode, cond);
+  int32_t target_index = AddCodeTarget(code);
+  Call(static_cast<Address>(target_index), rmode, cond);
 }
 
 void TurboAssembler::Drop(int count) {
   if (count > 0) {
-    Add(sp, sp, count * kPointerSize, r0);
+    Add(sp, sp, count * kSystemPointerSize, r0);
   }
 }
 
 void TurboAssembler::Drop(Register count, Register scratch) {
-  ShiftLeftImm(scratch, count, Operand(kPointerSizeLog2));
+  ShiftLeftImm(scratch, count, Operand(kSystemPointerSizeLog2));
   add(sp, sp, scratch);
 }
 
@@ -317,15 +320,22 @@ void TurboAssembler::Push(Smi smi) {
   push(r0);
 }
 
-void TurboAssembler::Move(Register dst, Handle<HeapObject> value) {
+void TurboAssembler::Move(Register dst, Handle<HeapObject> value,
+                          RelocInfo::Mode rmode) {
   // TODO(jgruber,v8:8887): Also consider a root-relative load when generating
   // non-isolate-independent code. In many cases it might be cheaper than
   // embedding the relocatable value.
   if (root_array_available_ && options().isolate_independent_code) {
     IndirectLoadConstant(dst, value);
     return;
+  } else if (RelocInfo::IsCompressedEmbeddedObject(rmode)) {
+    EmbeddedObjectIndex index = AddEmbeddedObject(value);
+    DCHECK(is_uint32(index));
+    mov(dst, Operand(static_cast<int>(index), rmode));
+  } else {
+    DCHECK(RelocInfo::IsFullEmbeddedObject(rmode));
+    mov(dst, Operand(value.address(), rmode));
   }
-  mov(dst, Operand(value));
 }
 
 void TurboAssembler::Move(Register dst, ExternalReference reference) {
@@ -354,12 +364,12 @@ void TurboAssembler::Move(DoubleRegister dst, DoubleRegister src) {
 
 void TurboAssembler::MultiPush(RegList regs, Register location) {
   int16_t num_to_push = base::bits::CountPopulation(regs);
-  int16_t stack_offset = num_to_push * kPointerSize;
+  int16_t stack_offset = num_to_push * kSystemPointerSize;
 
   subi(location, location, Operand(stack_offset));
   for (int16_t i = Register::kNumRegisters - 1; i >= 0; i--) {
     if ((regs & (1 << i)) != 0) {
-      stack_offset -= kPointerSize;
+      stack_offset -= kSystemPointerSize;
       StoreP(ToRegister(i), MemOperand(location, stack_offset));
     }
   }
@@ -371,7 +381,7 @@ void TurboAssembler::MultiPop(RegList regs, Register location) {
   for (int16_t i = 0; i < Register::kNumRegisters; i++) {
     if ((regs & (1 << i)) != 0) {
       LoadP(ToRegister(i), MemOperand(location, stack_offset));
-      stack_offset += kPointerSize;
+      stack_offset += kSystemPointerSize;
     }
   }
   addi(location, location, Operand(stack_offset));
@@ -411,6 +421,111 @@ void TurboAssembler::LoadRoot(Register destination, RootIndex index,
         MemOperand(kRootRegister, RootRegisterOffsetForRootIndex(index)), r0);
 }
 
+void TurboAssembler::LoadTaggedPointerField(const Register& destination,
+                                            const MemOperand& field_operand,
+                                            const Register& scratch) {
+  if (COMPRESS_POINTERS_BOOL) {
+    DecompressTaggedPointer(destination, field_operand);
+  } else {
+    LoadP(destination, field_operand, scratch);
+  }
+}
+
+void TurboAssembler::LoadAnyTaggedField(const Register& destination,
+                                        const MemOperand& field_operand,
+                                        const Register& scratch) {
+  if (COMPRESS_POINTERS_BOOL) {
+    DecompressAnyTagged(destination, field_operand);
+  } else {
+    LoadP(destination, field_operand, scratch);
+  }
+}
+
+void TurboAssembler::SmiUntag(Register dst, const MemOperand& src, RCBit rc) {
+  if (SmiValuesAre31Bits()) {
+    lwz(dst, src);
+  } else {
+    LoadP(dst, src);
+  }
+
+  SmiUntag(dst, rc);
+}
+
+void TurboAssembler::SmiUntagField(Register dst, const MemOperand& src,
+                                   RCBit rc) {
+  SmiUntag(dst, src, rc);
+}
+
+void TurboAssembler::StoreTaggedFieldX(const Register& value,
+                                       const MemOperand& dst_field_operand,
+                                       const Register& scratch) {
+  if (COMPRESS_POINTERS_BOOL) {
+    RecordComment("[ StoreTagged");
+    stwx(value, dst_field_operand);
+    RecordComment("]");
+  } else {
+    StorePX(value, dst_field_operand);
+  }
+}
+
+void TurboAssembler::StoreTaggedField(const Register& value,
+                                      const MemOperand& dst_field_operand,
+                                      const Register& scratch) {
+  if (COMPRESS_POINTERS_BOOL) {
+    RecordComment("[ StoreTagged");
+    StoreWord(value, dst_field_operand, scratch);
+    RecordComment("]");
+  } else {
+    StoreP(value, dst_field_operand, scratch);
+  }
+}
+
+void TurboAssembler::DecompressTaggedSigned(Register destination,
+                                            Register src) {
+  RecordComment("[ DecompressTaggedSigned");
+  ZeroExtWord32(destination, src);
+  RecordComment("]");
+}
+
+void TurboAssembler::DecompressTaggedSigned(Register destination,
+                                            MemOperand field_operand) {
+  RecordComment("[ DecompressTaggedSigned");
+  LoadWord(destination, field_operand, r0);
+  RecordComment("]");
+}
+
+void TurboAssembler::DecompressTaggedPointer(Register destination,
+                                             Register source) {
+  RecordComment("[ DecompressTaggedPointer");
+  ZeroExtWord32(destination, source);
+  add(destination, destination, kRootRegister);
+  RecordComment("]");
+}
+
+void TurboAssembler::DecompressTaggedPointer(Register destination,
+                                             MemOperand field_operand) {
+  RecordComment("[ DecompressTaggedPointer");
+  LoadWord(destination, field_operand, r0);
+  add(destination, destination, kRootRegister);
+  RecordComment("]");
+}
+
+void TurboAssembler::DecompressAnyTagged(Register destination,
+                                         MemOperand field_operand) {
+  RecordComment("[ DecompressAnyTagged");
+  LoadWord(destination, field_operand, r0);
+  add(destination, destination, kRootRegister);
+  RecordComment("]");
+}
+
+void TurboAssembler::DecompressAnyTagged(Register destination,
+                                         Register source) {
+  RecordComment("[ DecompressAnyTagged");
+  ZeroExtWord32(destination, source);
+  add(destination, destination, kRootRegister);
+  RecordComment("]");
+}
+
 void MacroAssembler::RecordWriteField(Register object, int offset,
                                       Register value, Register dst,
                                       LinkRegisterStatus lr_status,
@@ -427,13 +542,13 @@ void MacroAssembler::RecordWriteField(Register object, int offset,
   }
 
   // Although the object register is tagged, the offset is relative to the start
-  // of the object, so so offset must be a multiple of kPointerSize.
-  DCHECK(IsAligned(offset, kPointerSize));
+  // of the object, so so offset must be a multiple of kSystemPointerSize.
+  DCHECK(IsAligned(offset, kTaggedSize));
 
   Add(dst, object, offset - kHeapObjectTag, r0);
   if (emit_debug_code()) {
     Label ok;
-    andi(r0, dst, Operand(kPointerSize - 1));
+    andi(r0, dst, Operand(kTaggedSize - 1));
     beq(&ok, cr0);
     stop();
     bind(&ok);
@@ -569,7 +684,7 @@ void MacroAssembler::RecordWrite(Register object, Register address,
                                  SmiCheck smi_check) {
   DCHECK(object != value);
   if (emit_debug_code()) {
-    LoadP(r0, MemOperand(address));
+    LoadTaggedPointerField(r0, MemOperand(address));
     cmp(r0, value);
     Check(eq, AbortReason::kWrongAddressOrValuePassedToRecordWrite);
   }
@@ -636,7 +751,7 @@ void TurboAssembler::PushCommonFrame(Register marker_reg) {
       fp_delta = 0;
     }
   }
-  addi(fp, sp, Operand(fp_delta * kPointerSize));
+  addi(fp, sp, Operand(fp_delta * kSystemPointerSize));
 }
 
 void TurboAssembler::PushStandardFrame(Register function_reg) {
@@ -659,7 +774,7 @@ void TurboAssembler::PushStandardFrame(Register function_reg) {
       fp_delta = 1;
     }
   }
-  addi(fp, sp, Operand(fp_delta * kPointerSize));
+  addi(fp, sp, Operand(fp_delta * kSystemPointerSize));
 }
 
 void TurboAssembler::RestoreFrameStateForTailCall() {
@@ -1012,9 +1127,9 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, int stack_space,
   DCHECK(frame_type == StackFrame::EXIT ||
          frame_type == StackFrame::BUILTIN_EXIT);
   // Set up the frame structure on the stack.
-  DCHECK_EQ(2 * kPointerSize, ExitFrameConstants::kCallerSPDisplacement);
-  DCHECK_EQ(1 * kPointerSize, ExitFrameConstants::kCallerPCOffset);
-  DCHECK_EQ(0 * kPointerSize, ExitFrameConstants::kCallerFPOffset);
+  DCHECK_EQ(2 * kSystemPointerSize, ExitFrameConstants::kCallerSPDisplacement);
+  DCHECK_EQ(1 * kSystemPointerSize, ExitFrameConstants::kCallerPCOffset);
+  DCHECK_EQ(0 * kSystemPointerSize, ExitFrameConstants::kCallerFPOffset);
   DCHECK_GT(stack_space, 0);
 
   // This is an opportunity to build a frame to wrap
@@ -1052,22 +1167,23 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, int stack_space,
     // since the sp slot and code slot were pushed after the fp.
   }
 
-  addi(sp, sp, Operand(-stack_space * kPointerSize));
+  addi(sp, sp, Operand(-stack_space * kSystemPointerSize));
 
   // Allocate and align the frame preparing for calling the runtime
   // function.
   const int frame_alignment = ActivationFrameAlignment();
-  if (frame_alignment > kPointerSize) {
+  if (frame_alignment > kSystemPointerSize) {
     DCHECK(base::bits::IsPowerOfTwo(frame_alignment));
     ClearRightImm(sp, sp,
                   Operand(base::bits::WhichPowerOfTwo(frame_alignment)));
   }
   li(r0, Operand::Zero());
-  StorePU(r0, MemOperand(sp, -kNumRequiredStackFrameSlots * kPointerSize));
+  StorePU(r0,
+          MemOperand(sp, -kNumRequiredStackFrameSlots * kSystemPointerSize));
 
   // Set the exit frame sp value to point just before the return address
   // location.
-  addi(r8, sp, Operand((kStackFrameExtraParamSlot + 1) * kPointerSize));
+  addi(r8, sp, Operand((kStackFrameExtraParamSlot + 1) * kSystemPointerSize));
   StoreP(r8, MemOperand(fp, ExitFrameConstants::kSPOffset));
 }
 
@@ -1123,7 +1239,8 @@ void MacroAssembler::LeaveExitFrame(bool save_doubles, Register argument_count,
 
   if (argument_count.is_valid()) {
     if (!argument_count_is_length) {
-      ShiftLeftImm(argument_count, argument_count, Operand(kPointerSizeLog2));
+      ShiftLeftImm(argument_count, argument_count,
+                   Operand(kSystemPointerSizeLog2));
     }
     add(sp, sp, argument_count);
   }
@@ -1143,19 +1260,19 @@ void TurboAssembler::PrepareForTailCall(Register callee_args_count,
   DCHECK(!AreAliased(callee_args_count, caller_args_count, scratch0, scratch1));
 
   // Calculate the end of destination area where we will put the arguments
-  // after we drop current frame. We add kPointerSize to count the receiver
-  // argument which is not included into formal parameters count.
+  // after we drop current frame. We add kSystemPointerSize to count the
+  // receiver argument which is not included into formal parameters count.
   Register dst_reg = scratch0;
-  ShiftLeftImm(dst_reg, caller_args_count, Operand(kPointerSizeLog2));
+  ShiftLeftImm(dst_reg, caller_args_count, Operand(kSystemPointerSizeLog2));
   add(dst_reg, fp, dst_reg);
   addi(dst_reg, dst_reg,
-       Operand(StandardFrameConstants::kCallerSPOffset + kPointerSize));
+       Operand(StandardFrameConstants::kCallerSPOffset + kSystemPointerSize));
 
   Register src_reg = caller_args_count;
-  // Calculate the end of source area. +kPointerSize is for the receiver.
-  ShiftLeftImm(src_reg, callee_args_count, Operand(kPointerSizeLog2));
+  // Calculate the end of source area. +kSystemPointerSize is for the receiver.
+  ShiftLeftImm(src_reg, callee_args_count, Operand(kSystemPointerSizeLog2));
   add(src_reg, sp, src_reg);
-  addi(src_reg, src_reg, Operand(kPointerSize));
+  addi(src_reg, src_reg, Operand(kSystemPointerSize));
 
   if (FLAG_debug_code) {
     cmpl(src_reg, dst_reg);
@@ -1176,8 +1293,8 @@ void TurboAssembler::PrepareForTailCall(Register callee_args_count,
   addi(tmp_reg, callee_args_count, Operand(1));  // +1 for receiver
   mtctr(tmp_reg);
   bind(&loop);
-  LoadPU(tmp_reg, MemOperand(src_reg, -kPointerSize));
-  StorePU(tmp_reg, MemOperand(dst_reg, -kPointerSize));
+  LoadPU(tmp_reg, MemOperand(src_reg, -kSystemPointerSize));
+  StorePU(tmp_reg, MemOperand(dst_reg, -kSystemPointerSize));
   bdnz(&loop);
 
   // Leave current frame.
@@ -1233,7 +1350,7 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
 
   {
     // Load receiver to pass it later to DebugOnFunctionCall hook.
-    ShiftLeftImm(r7, actual_parameter_count, Operand(kPointerSizeLog2));
+    ShiftLeftImm(r7, actual_parameter_count, Operand(kSystemPointerSizeLog2));
     LoadPX(r7, MemOperand(sp, r7));
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
@@ -1287,7 +1404,8 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
   // allow recompilation to take effect without changing any of the
   // call sites.
   Register code = kJavaScriptCallCodeStartRegister;
-  LoadP(code, FieldMemOperand(function, JSFunction::kCodeOffset));
+  LoadTaggedPointerField(code,
+                         FieldMemOperand(function, JSFunction::kCodeOffset));
   if (flag == CALL_FUNCTION) {
     CallCodeObject(code);
   } else {
@@ -1312,8 +1430,9 @@ void MacroAssembler::InvokeFunctionWithNewTarget(
   Register expected_reg = r5;
   Register temp_reg = r7;
 
-  LoadP(temp_reg, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
-  LoadP(cp, FieldMemOperand(r4, JSFunction::kContextOffset));
+  LoadTaggedPointerField(
+      temp_reg, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
+  LoadTaggedPointerField(cp, FieldMemOperand(r4, JSFunction::kContextOffset));
   LoadHalfWord(expected_reg,
                FieldMemOperand(
                    temp_reg, SharedFunctionInfo::kFormalParameterCountOffset));
@@ -1333,7 +1452,7 @@ void MacroAssembler::InvokeFunction(Register function,
   DCHECK_EQ(function, r4);
 
   // Get the function and setup the context.
-  LoadP(cp, FieldMemOperand(r4, JSFunction::kContextOffset));
+  LoadTaggedPointerField(cp, FieldMemOperand(r4, JSFunction::kContextOffset));
 
   InvokeFunctionCode(r4, no_reg, expected_parameter_count,
                      actual_parameter_count, flag);
@@ -1352,8 +1471,8 @@ void MacroAssembler::MaybeDropFrames() {
 
 void MacroAssembler::PushStackHandler() {
   // Adjust this code if not the case.
-  STATIC_ASSERT(StackHandlerConstants::kSize == 2 * kPointerSize);
-  STATIC_ASSERT(StackHandlerConstants::kNextOffset == 0 * kPointerSize);
+  STATIC_ASSERT(StackHandlerConstants::kSize == 2 * kSystemPointerSize);
+  STATIC_ASSERT(StackHandlerConstants::kNextOffset == 0 * kSystemPointerSize);
 
   Push(Smi::zero());  // Padding.
 
@@ -1369,7 +1488,7 @@ void MacroAssembler::PushStackHandler() {
 }
 
 void MacroAssembler::PopStackHandler() {
-  STATIC_ASSERT(StackHandlerConstants::kSize == 2 * kPointerSize);
+  STATIC_ASSERT(StackHandlerConstants::kSize == 2 * kSystemPointerSize);
   STATIC_ASSERT(StackHandlerConstants::kNextOffset == 0);
 
   pop(r4);
@@ -1604,7 +1723,7 @@ void MacroAssembler::JumpToInstructionStream(Address entry) {
 
 void MacroAssembler::LoadWeakValue(Register out, Register in,
                                    Label* target_if_cleared) {
-  cmpi(in, Operand(kClearedWeakHeapObjectLower32));
+  cmpwi(in, Operand(kClearedWeakHeapObjectLower32));
   beq(target_if_cleared);
 
   mov(r0, Operand(~kWeakHeapObjectMask));
@@ -1690,14 +1809,16 @@ void TurboAssembler::Abort(AbortReason reason) {
 }
 
 void MacroAssembler::LoadMap(Register destination, Register object) {
-  LoadP(destination, FieldMemOperand(object, HeapObject::kMapOffset));
+  LoadTaggedPointerField(destination,
+                         FieldMemOperand(object, HeapObject::kMapOffset));
 }
 
 void MacroAssembler::LoadNativeContextSlot(int index, Register dst) {
   LoadMap(dst, cp);
-  LoadP(dst, FieldMemOperand(
-                 dst, Map::kConstructorOrBackPointerOrNativeContextOffset));
-  LoadP(dst, MemOperand(dst, Context::SlotOffset(index)));
+  LoadTaggedPointerField(
+      dst, FieldMemOperand(
+               dst, Map::kConstructorOrBackPointerOrNativeContextOffset));
+  LoadTaggedPointerField(dst, MemOperand(dst, Context::SlotOffset(index)));
 }
 
 void MacroAssembler::AssertNotSmi(Register object) {
@@ -1821,15 +1942,16 @@ void TurboAssembler::PrepareCallCFunction(int num_reg_arguments,
       CalculateStackPassedWords(num_reg_arguments, num_double_arguments);
   int stack_space = kNumRequiredStackFrameSlots;
 
-  if (frame_alignment > kPointerSize) {
+  if (frame_alignment > kSystemPointerSize) {
     // Make stack end at alignment and make room for stack arguments
     // -- preserving original value of sp.
     mr(scratch, sp);
-    addi(sp, sp, Operand(-(stack_passed_arguments + 1) * kPointerSize));
+    addi(sp, sp, Operand(-(stack_passed_arguments + 1) * kSystemPointerSize));
     DCHECK(base::bits::IsPowerOfTwo(frame_alignment));
     ClearRightImm(sp, sp,
                   Operand(base::bits::WhichPowerOfTwo(frame_alignment)));
-    StoreP(scratch, MemOperand(sp, stack_passed_arguments * kPointerSize));
+    StoreP(scratch,
+           MemOperand(sp, stack_passed_arguments * kSystemPointerSize));
   } else {
     // Make room for stack arguments
     stack_space += stack_passed_arguments;
@@ -1837,7 +1959,7 @@ void TurboAssembler::PrepareCallCFunction(int num_reg_arguments,
 
   // Allocate frame with required slots to make ABI work.
   li(r0, Operand::Zero());
-  StorePU(r0, MemOperand(sp, -stack_space * kPointerSize));
+  StorePU(r0, MemOperand(sp, -stack_space * kSystemPointerSize));
 }
 
 void TurboAssembler::PrepareCallCFunction(int num_reg_arguments,
@@ -1931,7 +2053,8 @@ void TurboAssembler::CallCFunctionHelper(Register function,
   if (ABI_USES_FUNCTION_DESCRIPTORS && has_function_descriptor) {
     // AIX/PPC64BE Linux uses a function descriptor. When calling C code be
     // aware of this descriptor and pick up values from it
-    LoadP(ToRegister(ABI_TOC_REGISTER), MemOperand(function, kPointerSize));
+    LoadP(ToRegister(ABI_TOC_REGISTER),
+          MemOperand(function, kSystemPointerSize));
     LoadP(ip, MemOperand(function, 0));
     dest = ip;
   } else if (ABI_CALL_VIA_IP) {
@@ -1963,10 +2086,10 @@ void TurboAssembler::CallCFunctionHelper(Register function,
   int stack_passed_arguments =
       CalculateStackPassedWords(num_reg_arguments, num_double_arguments);
   int stack_space = kNumRequiredStackFrameSlots + stack_passed_arguments;
-  if (ActivationFrameAlignment() > kPointerSize) {
-    LoadP(sp, MemOperand(sp, stack_space * kPointerSize));
+  if (ActivationFrameAlignment() > kSystemPointerSize) {
+    LoadP(sp, MemOperand(sp, stack_space * kSystemPointerSize));
   } else {
-    addi(sp, sp, Operand(stack_space * kPointerSize));
+    addi(sp, sp, Operand(stack_space * kSystemPointerSize));
   }
 }
 
@@ -1976,7 +2099,7 @@ void TurboAssembler::CheckPageFlag(
     int mask, Condition cc, Label* condition_met) {
   DCHECK(cc == ne || cc == eq);
   ClearRightImm(scratch, object, Operand(kPageSizeBits));
-  LoadP(scratch, MemOperand(scratch, MemoryChunk::kFlagsOffset));
+  LoadP(scratch, MemOperand(scratch, BasicMemoryChunk::kFlagsOffset));
 
   mov(r0, Operand(mask));
   and_(r0, scratch, r0, SetRC);
@@ -2368,7 +2491,7 @@ void MacroAssembler::Xor(Register ra, Register rs, const Operand& rb,
 void MacroAssembler::CmpSmiLiteral(Register src1, Smi smi, Register scratch,
                                    CRegister cr) {
 #if defined(V8_COMPRESS_POINTERS) || defined(V8_31BIT_SMIS_ON_64BIT_ARCH)
-  Cmpi(src1, Operand(smi), scratch, cr);
+  Cmpwi(src1, Operand(smi), scratch, cr);
 #else
   LoadSmiLiteral(scratch, smi);
   cmp(src1, scratch, cr);
@@ -2538,7 +2661,7 @@ void TurboAssembler::LoadWordArith(Register dst, const MemOperand& mem,
 
 // Variable length depending on whether offset fits into immediate field
 // MemOperand currently only supports d-form
-void MacroAssembler::LoadWord(Register dst, const MemOperand& mem,
+void TurboAssembler::LoadWord(Register dst, const MemOperand& mem,
                               Register scratch) {
   Register base = mem.ra();
   int offset = mem.offset();
@@ -2553,7 +2676,7 @@ void MacroAssembler::LoadWord(Register dst, const MemOperand& mem,
 
 // Variable length depending on whether offset fits into immediate field
 // MemOperand current only supports d-form
-void MacroAssembler::StoreWord(Register src, const MemOperand& mem,
+void TurboAssembler::StoreWord(Register src, const MemOperand& mem,
                                Register scratch) {
   Register base = mem.ra();
   int offset = mem.offset();
@@ -2903,14 +3026,14 @@ void TurboAssembler::LoadEntryFromBuiltinIndex(Register builtin_index) {
   STATIC_ASSERT(kSmiTag == 0);
 
   // The builtin_index register contains the builtin index as a Smi.
-  // Untagging is folded into the indexing operand below.
-#if defined(V8_COMPRESS_POINTERS) || defined(V8_31BIT_SMIS_ON_64BIT_ARCH)
-  ShiftLeftImm(builtin_index, builtin_index,
-               Operand(kSystemPointerSizeLog2 - kSmiShift));
-#else
-  ShiftRightArithImm(builtin_index, builtin_index,
-                     kSmiShift - kSystemPointerSizeLog2);
-#endif
+  if (SmiValuesAre32Bits()) {
+    ShiftRightArithImm(builtin_index, builtin_index,
+                       kSmiShift - kSystemPointerSizeLog2);
+  } else {
+    DCHECK(SmiValuesAre31Bits());
+    ShiftLeftImm(builtin_index, builtin_index,
+                 Operand(kSystemPointerSizeLog2 - kSmiShift));
+  }
   addi(builtin_index, builtin_index,
        Operand(IsolateData::builtin_entry_table_offset()));
   LoadPX(builtin_index, MemOperand(kRootRegister, builtin_index));
@@ -2996,7 +3119,7 @@ void TurboAssembler::StoreReturnAddressAndCall(Register target) {
   if (ABI_USES_FUNCTION_DESCRIPTORS) {
     // AIX/PPC64BE Linux uses a function descriptor. When calling C code be
     // aware of this descriptor and pick up values from it
-    LoadP(ToRegister(ABI_TOC_REGISTER), MemOperand(target, kPointerSize));
+    LoadP(ToRegister(ABI_TOC_REGISTER), MemOperand(target, kSystemPointerSize));
     LoadP(ip, MemOperand(target, 0));
     dest = ip;
   } else if (ABI_CALL_VIA_IP && dest != ip) {
@@ -3007,7 +3130,7 @@ void TurboAssembler::StoreReturnAddressAndCall(Register target) {
   LoadPC(r7);
   bind(&start_call);
   addi(r7, r7, Operand(after_call_offset));
-  StoreP(r7, MemOperand(sp, kStackFrameExtraParamSlot * kPointerSize));
+  StoreP(r7, MemOperand(sp, kStackFrameExtraParamSlot * kSystemPointerSize));
   Call(dest);
 
   DCHECK_EQ(after_call_offset - kInstrSize,
diff --git a/deps/v8/src/codegen/ppc/macro-assembler-ppc.h b/deps/v8/src/codegen/ppc/macro-assembler-ppc.h
index 2c46124b24d..cea89a472c9 100644
--- a/deps/v8/src/codegen/ppc/macro-assembler-ppc.h
+++ b/deps/v8/src/codegen/ppc/macro-assembler-ppc.h
@@ -182,6 +182,14 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
              CRegister cr = cr7);
   void Cmpwi(Register src1, const Operand& src2, Register scratch,
              CRegister cr = cr7);
+  void CompareTagged(Register src1, Register src2, CRegister cr = cr7) {
+    if (COMPRESS_POINTERS_BOOL) {
+      cmpw(src1, src2, cr);
+    } else {
+      cmp(src1, src2, cr);
+    }
+  }
+
   // Set new rounding mode RN to FPSCR
   void SetRoundingMode(FPRoundingMode RN);
 
@@ -196,33 +204,33 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
 
   // Push two registers.  Pushes leftmost register first (to highest address).
   void Push(Register src1, Register src2) {
-    StorePU(src2, MemOperand(sp, -2 * kPointerSize));
-    StoreP(src1, MemOperand(sp, kPointerSize));
+    StorePU(src2, MemOperand(sp, -2 * kSystemPointerSize));
+    StoreP(src1, MemOperand(sp, kSystemPointerSize));
   }
 
   // Push three registers.  Pushes leftmost register first (to highest address).
   void Push(Register src1, Register src2, Register src3) {
-    StorePU(src3, MemOperand(sp, -3 * kPointerSize));
-    StoreP(src2, MemOperand(sp, kPointerSize));
-    StoreP(src1, MemOperand(sp, 2 * kPointerSize));
+    StorePU(src3, MemOperand(sp, -3 * kSystemPointerSize));
+    StoreP(src2, MemOperand(sp, kSystemPointerSize));
+    StoreP(src1, MemOperand(sp, 2 * kSystemPointerSize));
   }
 
   // Push four registers.  Pushes leftmost register first (to highest address).
   void Push(Register src1, Register src2, Register src3, Register src4) {
-    StorePU(src4, MemOperand(sp, -4 * kPointerSize));
-    StoreP(src3, MemOperand(sp, kPointerSize));
-    StoreP(src2, MemOperand(sp, 2 * kPointerSize));
-    StoreP(src1, MemOperand(sp, 3 * kPointerSize));
+    StorePU(src4, MemOperand(sp, -4 * kSystemPointerSize));
+    StoreP(src3, MemOperand(sp, kSystemPointerSize));
+    StoreP(src2, MemOperand(sp, 2 * kSystemPointerSize));
+    StoreP(src1, MemOperand(sp, 3 * kSystemPointerSize));
   }
 
   // Push five registers.  Pushes leftmost register first (to highest address).
   void Push(Register src1, Register src2, Register src3, Register src4,
             Register src5) {
-    StorePU(src5, MemOperand(sp, -5 * kPointerSize));
-    StoreP(src4, MemOperand(sp, kPointerSize));
-    StoreP(src3, MemOperand(sp, 2 * kPointerSize));
-    StoreP(src2, MemOperand(sp, 3 * kPointerSize));
-    StoreP(src1, MemOperand(sp, 4 * kPointerSize));
+    StorePU(src5, MemOperand(sp, -5 * kSystemPointerSize));
+    StoreP(src4, MemOperand(sp, kSystemPointerSize));
+    StoreP(src3, MemOperand(sp, 2 * kSystemPointerSize));
+    StoreP(src2, MemOperand(sp, 3 * kSystemPointerSize));
+    StoreP(src1, MemOperand(sp, 4 * kSystemPointerSize));
   }
 
   void Pop(Register dst) { pop(dst); }
@@ -230,36 +238,36 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   // Pop two registers. Pops rightmost register first (from lower address).
   void Pop(Register src1, Register src2) {
     LoadP(src2, MemOperand(sp, 0));
-    LoadP(src1, MemOperand(sp, kPointerSize));
-    addi(sp, sp, Operand(2 * kPointerSize));
+    LoadP(src1, MemOperand(sp, kSystemPointerSize));
+    addi(sp, sp, Operand(2 * kSystemPointerSize));
   }
 
   // Pop three registers.  Pops rightmost register first (from lower address).
   void Pop(Register src1, Register src2, Register src3) {
     LoadP(src3, MemOperand(sp, 0));
-    LoadP(src2, MemOperand(sp, kPointerSize));
-    LoadP(src1, MemOperand(sp, 2 * kPointerSize));
-    addi(sp, sp, Operand(3 * kPointerSize));
+    LoadP(src2, MemOperand(sp, kSystemPointerSize));
+    LoadP(src1, MemOperand(sp, 2 * kSystemPointerSize));
+    addi(sp, sp, Operand(3 * kSystemPointerSize));
   }
 
   // Pop four registers.  Pops rightmost register first (from lower address).
   void Pop(Register src1, Register src2, Register src3, Register src4) {
     LoadP(src4, MemOperand(sp, 0));
-    LoadP(src3, MemOperand(sp, kPointerSize));
-    LoadP(src2, MemOperand(sp, 2 * kPointerSize));
-    LoadP(src1, MemOperand(sp, 3 * kPointerSize));
-    addi(sp, sp, Operand(4 * kPointerSize));
+    LoadP(src3, MemOperand(sp, kSystemPointerSize));
+    LoadP(src2, MemOperand(sp, 2 * kSystemPointerSize));
+    LoadP(src1, MemOperand(sp, 3 * kSystemPointerSize));
+    addi(sp, sp, Operand(4 * kSystemPointerSize));
   }
 
   // Pop five registers.  Pops rightmost register first (from lower address).
   void Pop(Register src1, Register src2, Register src3, Register src4,
            Register src5) {
     LoadP(src5, MemOperand(sp, 0));
-    LoadP(src4, MemOperand(sp, kPointerSize));
-    LoadP(src3, MemOperand(sp, 2 * kPointerSize));
-    LoadP(src2, MemOperand(sp, 3 * kPointerSize));
-    LoadP(src1, MemOperand(sp, 4 * kPointerSize));
-    addi(sp, sp, Operand(5 * kPointerSize));
+    LoadP(src4, MemOperand(sp, kSystemPointerSize));
+    LoadP(src3, MemOperand(sp, 2 * kSystemPointerSize));
+    LoadP(src2, MemOperand(sp, 3 * kSystemPointerSize));
+    LoadP(src1, MemOperand(sp, 4 * kSystemPointerSize));
+    addi(sp, sp, Operand(5 * kSystemPointerSize));
   }
 
   void SaveRegisters(RegList registers);
@@ -469,22 +477,20 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   void MovFloatToInt(Register dst, DoubleRegister src);
   // Register move. May do nothing if the registers are identical.
   void Move(Register dst, Smi smi) { LoadSmiLiteral(dst, smi); }
-  void Move(Register dst, Handle<HeapObject> value);
+  void Move(Register dst, Handle<HeapObject> value,
+            RelocInfo::Mode rmode = RelocInfo::FULL_EMBEDDED_OBJECT);
   void Move(Register dst, ExternalReference reference);
   void Move(Register dst, Register src, Condition cond = al);
   void Move(DoubleRegister dst, DoubleRegister src);
 
-  void SmiUntag(Register reg, RCBit rc = LeaveRC, int scale = 0) {
-    SmiUntag(reg, reg, rc, scale);
-  }
+  void SmiUntag(Register dst, const MemOperand& src, RCBit rc);
+  void SmiUntag(Register reg, RCBit rc = LeaveRC) { SmiUntag(reg, reg, rc); }
 
-  void SmiUntag(Register dst, Register src, RCBit rc = LeaveRC, int scale = 0) {
-    if (scale > kSmiShift) {
-      ShiftLeftImm(dst, src, Operand(scale - kSmiShift), rc);
-    } else if (scale < kSmiShift) {
-      ShiftRightArithImm(dst, src, kSmiShift - scale, rc);
+  void SmiUntag(Register dst, Register src, RCBit rc = LeaveRC) {
+    if (COMPRESS_POINTERS_BOOL) {
+      srawi(dst, src, kSmiShift, rc);
     } else {
-      // do nothing
+      ShiftRightArithImm(dst, src, kSmiShift, rc);
     }
   }
 
@@ -650,6 +656,41 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   // Define an exception handler and bind a label.
   void BindExceptionHandler(Label* label) { bind(label); }
 
+  // ---------------------------------------------------------------------------
+  // Pointer compression Support
+
+  // Loads a field containing a HeapObject and decompresses it if pointer
+  // compression is enabled.
+  void LoadTaggedPointerField(const Register& destination,
+                              const MemOperand& field_operand,
+                              const Register& scratch = no_reg);
+
+  // Loads a field containing any tagged value and decompresses it if necessary.
+  void LoadAnyTaggedField(const Register& destination,
+                          const MemOperand& field_operand,
+                          const Register& scratch = no_reg);
+
+  // Loads a field containing smi value and untags it.
+  void SmiUntagField(Register dst, const MemOperand& src, RCBit rc = LeaveRC);
+
+  // Compresses and stores tagged value to given on-heap location.
+  void StoreTaggedField(const Register& value,
+                        const MemOperand& dst_field_operand,
+                        const Register& scratch = no_reg);
+  void StoreTaggedFieldX(const Register& value,
+                         const MemOperand& dst_field_operand,
+                         const Register& scratch = no_reg);
+
+  void DecompressTaggedSigned(Register destination, MemOperand field_operand);
+  void DecompressTaggedSigned(Register destination, Register src);
+  void DecompressTaggedPointer(Register destination, MemOperand field_operand);
+  void DecompressTaggedPointer(Register destination, Register source);
+  void DecompressAnyTagged(Register destination, MemOperand field_operand);
+  void DecompressAnyTagged(Register destination, Register source);
+
+  void LoadWord(Register dst, const MemOperand& mem, Register scratch);
+  void StoreWord(Register src, const MemOperand& mem, Register scratch);
+
  private:
   static const int kSmiShift = kSmiTagSize + kSmiShiftSize;
 
@@ -718,8 +759,6 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   // than assembler-ppc and may generate variable length sequences
 
   // load a literal double value <value> to FPR <result>
-  void LoadWord(Register dst, const MemOperand& mem, Register scratch);
-  void StoreWord(Register src, const MemOperand& mem, Register scratch);
 
   void LoadHalfWord(Register dst, const MemOperand& mem,
                     Register scratch = no_reg);
@@ -893,11 +932,11 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
 
   void SmiToPtrArrayOffset(Register dst, Register src) {
 #if defined(V8_COMPRESS_POINTERS) || defined(V8_31BIT_SMIS_ON_64BIT_ARCH)
-    STATIC_ASSERT(kSmiTag == 0 && kSmiShift < kPointerSizeLog2);
-    ShiftLeftImm(dst, src, Operand(kPointerSizeLog2 - kSmiShift));
+    STATIC_ASSERT(kSmiTag == 0 && kSmiShift < kSystemPointerSizeLog2);
+    ShiftLeftImm(dst, src, Operand(kSystemPointerSizeLog2 - kSmiShift));
 #else
-    STATIC_ASSERT(kSmiTag == 0 && kSmiShift > kPointerSizeLog2);
-    ShiftRightArithImm(dst, src, kSmiShift - kPointerSizeLog2);
+    STATIC_ASSERT(kSmiTag == 0 && kSmiShift > kSystemPointerSizeLog2);
+    ShiftRightArithImm(dst, src, kSmiShift - kSystemPointerSizeLog2);
 #endif
   }
 
@@ -918,7 +957,7 @@ class V8_EXPORT_PRIVATE MacroAssembler : public TurboAssembler {
   STATIC_ASSERT(kSmiTagSize + kSmiShiftSize == 32);
 #endif
 #if V8_TARGET_ARCH_PPC64 && V8_TARGET_LITTLE_ENDIAN
-#define SmiWordOffset(offset) (offset + kPointerSize / 2)
+#define SmiWordOffset(offset) (offset + kSystemPointerSize / 2)
 #else
 #define SmiWordOffset(offset) offset
 #endif
diff --git a/deps/v8/src/codegen/ppc/register-ppc.h b/deps/v8/src/codegen/ppc/register-ppc.h
index 8c89aecec7a..eded9622c4c 100644
--- a/deps/v8/src/codegen/ppc/register-ppc.h
+++ b/deps/v8/src/codegen/ppc/register-ppc.h
@@ -306,6 +306,8 @@ constexpr Register kRuntimeCallArgvRegister = r5;
 constexpr Register kWasmInstanceRegister = r10;
 constexpr Register kWasmCompileLazyFuncIndexRegister = r15;
 
+constexpr DoubleRegister kFPReturnRegister0 = d1;
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/reloc-info.cc b/deps/v8/src/codegen/reloc-info.cc
index 9f079789326..2e62c6f1f15 100644
--- a/deps/v8/src/codegen/reloc-info.cc
+++ b/deps/v8/src/codegen/reloc-info.cc
@@ -6,11 +6,12 @@
 
 #include "src/codegen/assembler-inl.h"
 #include "src/codegen/code-reference.h"
+#include "src/codegen/external-reference-encoder.h"
 #include "src/deoptimizer/deoptimize-reason.h"
 #include "src/deoptimizer/deoptimizer.h"
 #include "src/heap/heap-write-barrier-inl.h"
 #include "src/objects/code-inl.h"
-#include "src/snapshot/snapshot.h"
+#include "src/snapshot/embedded/embedded-data.h"
 
 namespace v8 {
 namespace internal {
diff --git a/deps/v8/src/codegen/s390/constants-s390.h b/deps/v8/src/codegen/s390/constants-s390.h
index 6cd5e4d9faf..5c524350518 100644
--- a/deps/v8/src/codegen/s390/constants-s390.h
+++ b/deps/v8/src/codegen/s390/constants-s390.h
@@ -567,11 +567,12 @@ using SixByteInstr = uint64_t;
   V(va, VA, 0xE7F3)       /* type = VRR_C VECTOR ADD  */                       \
   V(vscbi, VSCBI,                                                              \
     0xE7F5) /* type = VRR_C VECTOR SUBTRACT COMPUTE BORROW INDICATION  */      \
-  V(vs, VS, 0xE7F7)     /* type = VRR_C VECTOR SUBTRACT  */                    \
-  V(vmnl, VMNL, 0xE7FC) /* type = VRR_C VECTOR MINIMUM LOGICAL  */             \
-  V(vmxl, VMXL, 0xE7FD) /* type = VRR_C VECTOR MAXIMUM LOGICAL  */             \
-  V(vmn, VMN, 0xE7FE)   /* type = VRR_C VECTOR MINIMUM  */                     \
-  V(vmx, VMX, 0xE7FF)   /* type = VRR_C VECTOR MAXIMUM  */
+  V(vs, VS, 0xE7F7)         /* type = VRR_C VECTOR SUBTRACT  */                \
+  V(vmnl, VMNL, 0xE7FC)     /* type = VRR_C VECTOR MINIMUM LOGICAL  */         \
+  V(vmxl, VMXL, 0xE7FD)     /* type = VRR_C VECTOR MAXIMUM LOGICAL  */         \
+  V(vmn, VMN, 0xE7FE)       /* type = VRR_C VECTOR MINIMUM  */                 \
+  V(vmx, VMX, 0xE7FF)       /* type = VRR_C VECTOR MAXIMUM  */                 \
+  V(vbperm, VBPERM, 0xE785) /* type = VRR_C VECTOR BIT PERMUTE  */
 
 #define S390_VRI_A_OPCODE_LIST(V)                                              \
   V(vleib, VLEIB, 0xE740) /* type = VRI_A VECTOR LOAD ELEMENT IMMEDIATE (8) */ \
diff --git a/deps/v8/src/codegen/s390/interface-descriptors-s390.cc b/deps/v8/src/codegen/s390/interface-descriptors-s390.cc
index 1f65065fb7f..b23ecb7289b 100644
--- a/deps/v8/src/codegen/s390/interface-descriptors-s390.cc
+++ b/deps/v8/src/codegen/s390/interface-descriptors-s390.cc
@@ -191,11 +191,6 @@ void AbortDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  data->InitializePlatformSpecific(0, nullptr);
-}
-
 void CompareDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {r3, r2};
@@ -283,6 +278,54 @@ void RunMicrotasksEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+void BinaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallTrampoline_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void CallWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void ConstructWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void ConstructWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void Compare_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 4);
+}
+
+void UnaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // TODO(v8:8888): Implement on this platform.
+  DefaultInitializePlatformSpecific(data, 3);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/s390/macro-assembler-s390.cc b/deps/v8/src/codegen/s390/macro-assembler-s390.cc
index 77bf0ee916b..193f05929c6 100644
--- a/deps/v8/src/codegen/s390/macro-assembler-s390.cc
+++ b/deps/v8/src/codegen/s390/macro-assembler-s390.cc
@@ -16,7 +16,7 @@
 #include "src/codegen/register-configuration.h"
 #include "src/debug/debug.h"
 #include "src/execution/frames-inl.h"
-#include "src/heap/heap-inl.h"  // For MemoryChunk.
+#include "src/heap/memory-chunk.h"
 #include "src/init/bootstrapper.h"
 #include "src/logging/counters.h"
 #include "src/objects/smi.h"
@@ -2024,10 +2024,10 @@ void TurboAssembler::CheckPageFlag(
     // Reverse the byte_offset if emulating on little endian platform
     byte_offset = kSystemPointerSize - byte_offset - 1;
 #endif
-    tm(MemOperand(scratch, MemoryChunk::kFlagsOffset + byte_offset),
+    tm(MemOperand(scratch, BasicMemoryChunk::kFlagsOffset + byte_offset),
        Operand(shifted_mask));
   } else {
-    LoadP(scratch, MemOperand(scratch, MemoryChunk::kFlagsOffset));
+    LoadP(scratch, MemOperand(scratch, BasicMemoryChunk::kFlagsOffset));
     AndP(r0, scratch, Operand(mask));
   }
   // Should be okay to remove rc
diff --git a/deps/v8/src/codegen/s390/register-s390.h b/deps/v8/src/codegen/s390/register-s390.h
index 21094ef3bc9..009248a65ca 100644
--- a/deps/v8/src/codegen/s390/register-s390.h
+++ b/deps/v8/src/codegen/s390/register-s390.h
@@ -263,6 +263,8 @@ constexpr Register kRuntimeCallArgvRegister = r4;
 constexpr Register kWasmInstanceRegister = r6;
 constexpr Register kWasmCompileLazyFuncIndexRegister = r7;
 
+constexpr DoubleRegister kFPReturnRegister0 = d0;
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/tnode.h b/deps/v8/src/codegen/tnode.h
index ecf9afab482..83a05d0d441 100644
--- a/deps/v8/src/codegen/tnode.h
+++ b/deps/v8/src/codegen/tnode.h
@@ -79,6 +79,12 @@ struct UintPtrT : WordT {
   static constexpr MachineType kMachineType = MachineType::UintPtr();
 };
 
+struct ExternalPointerT : UntaggedT {
+  static const MachineRepresentation kMachineRepresentation =
+      MachineType::PointerRepresentation();
+  static constexpr MachineType kMachineType = MachineType::Pointer();
+};
+
 struct Float32T : UntaggedT {
   static const MachineRepresentation kMachineRepresentation =
       MachineRepresentation::kFloat32;
diff --git a/deps/v8/src/codegen/turbo-assembler.cc b/deps/v8/src/codegen/turbo-assembler.cc
index f46ab0ade5b..575529e3994 100644
--- a/deps/v8/src/codegen/turbo-assembler.cc
+++ b/deps/v8/src/codegen/turbo-assembler.cc
@@ -6,9 +6,9 @@
 
 #include "src/builtins/builtins.h"
 #include "src/builtins/constants-table-builder.h"
+#include "src/codegen/external-reference-encoder.h"
 #include "src/execution/isolate-data.h"
 #include "src/execution/isolate-inl.h"
-#include "src/snapshot/serializer-common.h"
 
 namespace v8 {
 namespace internal {
diff --git a/deps/v8/src/codegen/unoptimized-compilation-info.cc b/deps/v8/src/codegen/unoptimized-compilation-info.cc
index f46e9cda212..08cd8181884 100644
--- a/deps/v8/src/codegen/unoptimized-compilation-info.cc
+++ b/deps/v8/src/codegen/unoptimized-compilation-info.cc
@@ -18,7 +18,7 @@ namespace internal {
 UnoptimizedCompilationInfo::UnoptimizedCompilationInfo(Zone* zone,
                                                        ParseInfo* parse_info,
                                                        FunctionLiteral* literal)
-    : flags_(0), zone_(zone), feedback_vector_spec_(zone) {
+    : flags_(parse_info->flags()), feedback_vector_spec_(zone) {
   // NOTE: The parse_info passed here represents the global information gathered
   // during parsing, but does not represent specific details of the actual
   // function literal being compiled for this OptimizedCompilationInfo. As such,
@@ -28,13 +28,6 @@ UnoptimizedCompilationInfo::UnoptimizedCompilationInfo(Zone* zone,
   DCHECK_NOT_NULL(literal);
   literal_ = literal;
   source_range_map_ = parse_info->source_range_map();
-
-  if (parse_info->is_eval()) MarkAsEval();
-  if (parse_info->collect_type_profile()) MarkAsCollectTypeProfile();
-  if (parse_info->might_always_opt()) MarkAsMightAlwaysOpt();
-  if (parse_info->collect_source_positions()) {
-    MarkAsForceCollectSourcePositions();
-  }
 }
 
 DeclarationScope* UnoptimizedCompilationInfo::scope() const {
@@ -52,7 +45,7 @@ int UnoptimizedCompilationInfo::num_parameters_including_this() const {
 
 SourcePositionTableBuilder::RecordingMode
 UnoptimizedCompilationInfo::SourcePositionRecordingMode() const {
-  if (collect_source_positions()) {
+  if (flags().collect_source_positions()) {
     return SourcePositionTableBuilder::RECORD_SOURCE_POSITIONS;
   }
 
diff --git a/deps/v8/src/codegen/unoptimized-compilation-info.h b/deps/v8/src/codegen/unoptimized-compilation-info.h
index fe8dbe66c6f..bb431dc98d2 100644
--- a/deps/v8/src/codegen/unoptimized-compilation-info.h
+++ b/deps/v8/src/codegen/unoptimized-compilation-info.h
@@ -12,6 +12,7 @@
 #include "src/handles/handles.h"
 #include "src/objects/feedback-vector.h"
 #include "src/objects/objects.h"
+#include "src/parsing/parse-info.h"
 #include "src/utils/utils.h"
 
 namespace v8 {
@@ -33,23 +34,7 @@ class V8_EXPORT_PRIVATE UnoptimizedCompilationInfo final {
   UnoptimizedCompilationInfo(Zone* zone, ParseInfo* parse_info,
                              FunctionLiteral* literal);
 
-  Zone* zone() { return zone_; }
-
-  // Compilation flag accessors.
-
-  void MarkAsEval() { SetFlag(kIsEval); }
-  bool is_eval() const { return GetFlag(kIsEval); }
-
-  void MarkAsCollectTypeProfile() { SetFlag(kCollectTypeProfile); }
-  bool collect_type_profile() const { return GetFlag(kCollectTypeProfile); }
-
-  void MarkAsForceCollectSourcePositions() { SetFlag(kCollectSourcePositions); }
-  bool collect_source_positions() const {
-    return GetFlag(kCollectSourcePositions);
-  }
-
-  void MarkAsMightAlwaysOpt() { SetFlag(kMightAlwaysOpt); }
-  bool might_always_opt() const { return GetFlag(kMightAlwaysOpt); }
+  const UnoptimizedCompileFlags& flags() const { return flags_; }
 
   // Accessors for the input data of the function being compiled.
 
@@ -97,24 +82,8 @@ class V8_EXPORT_PRIVATE UnoptimizedCompilationInfo final {
   FeedbackVectorSpec* feedback_vector_spec() { return &feedback_vector_spec_; }
 
  private:
-  // Various configuration flags for a compilation, as well as some properties
-  // of the compiled code produced by a compilation.
-  enum Flag {
-    kIsEval = 1 << 0,
-    kCollectTypeProfile = 1 << 1,
-    kMightAlwaysOpt = 1 << 2,
-    kCollectSourcePositions = 1 << 3,
-  };
-
-  void SetFlag(Flag flag) { flags_ |= flag; }
-  bool GetFlag(Flag flag) const { return (flags_ & flag) != 0; }
-
   // Compilation flags.
-  unsigned flags_;
-
-  // The zone from which the compilation pipeline working on this
-  // OptimizedCompilationInfo allocates.
-  Zone* zone_;
+  const UnoptimizedCompileFlags flags_;
 
   // The root AST node of the function literal being compiled.
   FunctionLiteral* literal_;
diff --git a/deps/v8/src/codegen/x64/assembler-x64.cc b/deps/v8/src/codegen/x64/assembler-x64.cc
index 1106626a13c..6a8f77d1d2d 100644
--- a/deps/v8/src/codegen/x64/assembler-x64.cc
+++ b/deps/v8/src/codegen/x64/assembler-x64.cc
@@ -3424,6 +3424,13 @@ void Assembler::roundsd(XMMRegister dst, XMMRegister src, RoundingMode mode) {
   emit(static_cast<byte>(mode) | 0x8);
 }
 
+void Assembler::roundps(XMMRegister dst, XMMRegister src, RoundingMode mode) {
+  DCHECK(!IsEnabled(AVX));
+  sse4_instr(dst, src, 0x66, 0x0F, 0x3A, 0x08);
+  // Mask precision exception.
+  emit(static_cast<byte>(mode) | 0x8);
+}
+
 void Assembler::movmskpd(Register dst, XMMRegister src) {
   EnsureSpace ensure_space(this);
   emit(0x66);
@@ -3441,6 +3448,15 @@ void Assembler::movmskps(Register dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
+void Assembler::pmovmskb(Register dst, XMMRegister src) {
+  EnsureSpace ensure_space(this);
+  emit_optional_rex_32(dst, src);
+  emit(0x66);
+  emit(0x0F);
+  emit(0xD7);
+  emit_sse_operand(dst, src);
+}
+
 // AVX instructions
 
 void Assembler::vmovddup(XMMRegister dst, XMMRegister src) {
@@ -3634,6 +3650,15 @@ void Assembler::vucomiss(XMMRegister dst, Operand src) {
   emit_sse_operand(dst, src);
 }
 
+void Assembler::vpmovmskb(Register dst, XMMRegister src) {
+  XMMRegister idst = XMMRegister::from_code(dst.code());
+  DCHECK(IsEnabled(AVX));
+  EnsureSpace ensure_space(this);
+  emit_vex_prefix(idst, xmm0, src, kL128, k66, k0F, kWIG);
+  emit(0xD7);
+  emit_sse_operand(idst, src);
+}
+
 void Assembler::vss(byte op, XMMRegister dst, XMMRegister src1,
                     XMMRegister src2) {
   DCHECK(IsEnabled(AVX));
diff --git a/deps/v8/src/codegen/x64/assembler-x64.h b/deps/v8/src/codegen/x64/assembler-x64.h
index 3f58e3b4280..2df90c3d1d1 100644
--- a/deps/v8/src/codegen/x64/assembler-x64.h
+++ b/deps/v8/src/codegen/x64/assembler-x64.h
@@ -1124,6 +1124,8 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
 
   void movmskpd(Register dst, XMMRegister src);
 
+  void pmovmskb(Register dst, XMMRegister src);
+
   // SSE 4.1 instruction
   void insertps(XMMRegister dst, XMMRegister src, byte imm8);
   void insertps(XMMRegister dst, Operand src, byte imm8);
@@ -1139,6 +1141,7 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
 
   void roundss(XMMRegister dst, XMMRegister src, RoundingMode mode);
   void roundsd(XMMRegister dst, XMMRegister src, RoundingMode mode);
+  void roundps(XMMRegister dst, XMMRegister src, RoundingMode mode);
 
   void cmpps(XMMRegister dst, XMMRegister src, int8_t cmp);
   void cmpps(XMMRegister dst, Operand src, int8_t cmp);
@@ -1356,6 +1359,11 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
     vinstr(0x0b, dst, src1, src2, k66, k0F3A, kWIG);
     emit(static_cast<byte>(mode) | 0x8);  // Mask precision exception.
   }
+  void vroundps(XMMRegister dst, XMMRegister src1, XMMRegister src2,
+                RoundingMode mode) {
+    vinstr(0x08, dst, src1, src2, k66, k0F3A, kWIG);
+    emit(static_cast<byte>(mode) | 0x8);  // Mask precision exception.
+  }
 
   void vsd(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vinstr(op, dst, src1, src2, kF2, k0F, kWIG);
@@ -1393,6 +1401,7 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
     XMMRegister idst = XMMRegister::from_code(dst.code());
     vpd(0x50, idst, xmm0, src);
   }
+  void vpmovmskb(Register dst, XMMRegister src);
   void vcmpps(XMMRegister dst, XMMRegister src1, XMMRegister src2, int8_t cmp) {
     vps(0xC2, dst, src1, src2);
     emit(cmp);
diff --git a/deps/v8/src/codegen/x64/interface-descriptors-x64.cc b/deps/v8/src/codegen/x64/interface-descriptors-x64.cc
index 0fd62d46a45..da48713247a 100644
--- a/deps/v8/src/codegen/x64/interface-descriptors-x64.cc
+++ b/deps/v8/src/codegen/x64/interface-descriptors-x64.cc
@@ -129,6 +129,16 @@ void CallWithSpreadDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+void CallWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // rax : number of arguments (on the stack, not including receiver)
+  // rdi : the target to call
+  // rbx : the object to spread
+  // rdx : the feedback slot
+  Register registers[] = {rdi, rax, rbx, rdx};
+  data->InitializePlatformSpecific(arraysize(registers), registers);
+}
+
 void CallWithArrayLikeDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   // rdi : the target to call
@@ -137,6 +147,16 @@ void CallWithArrayLikeDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+void CallWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // rdi : the target to call
+  // rbx : the arguments list
+  // rdx : the feedback slot
+  // rax : the feedback vector
+  Register registers[] = {rdi, rbx, rdx, rax};
+  data->InitializePlatformSpecific(arraysize(registers), registers);
+}
+
 void ConstructVarargsDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   // rax : number of arguments (on the stack, not including receiver)
@@ -168,6 +188,16 @@ void ConstructWithSpreadDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+void ConstructWithSpread_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // rax : number of arguments (on the stack, not including receiver)
+  // rdi : the target to call
+  // rdx : the new target
+  // rbx : the feedback slot
+  Register registers[] = {rdi, rdx, rax, rbx};
+  data->InitializePlatformSpecific(arraysize(registers), registers);
+}
+
 void ConstructWithArrayLikeDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   // rdi : the target to call
@@ -177,6 +207,16 @@ void ConstructWithArrayLikeDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+void ConstructWithArrayLike_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  // rdi : the target to call
+  // rdx : the new target
+  // rbx : the arguments list
+  // rax : the feedback slot
+  Register registers[] = {rdi, rdx, rbx, rax};
+  data->InitializePlatformSpecific(arraysize(registers), registers);
+}
+
 void ConstructStubDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   // rax : number of arguments
@@ -193,11 +233,6 @@ void AbortDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  data->InitializePlatformSpecific(0, nullptr);
-}
-
 void CompareDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {rdx, rax};
@@ -285,6 +320,41 @@ void RunMicrotasksEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+void BinaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  Register registers[] = {rdx,   // kLeft
+                          rax,   // kRight
+                          rdi,   // Slot
+                          rbx};  // kMaybeFeedbackVector
+  data->InitializePlatformSpecific(arraysize(registers), registers);
+}
+
+void CallTrampoline_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  Register registers[] = {rdi,   // kFunction
+                          rax,   // kActualArgumentsCount
+                          rcx,   // kSlot
+                          rbx};  // kMaybeFeedbackVector
+  data->InitializePlatformSpecific(arraysize(registers), registers);
+}
+
+void Compare_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  Register registers[] = {rdx,   // kLeft
+                          rax,   // kRight
+                          rdi,   // Slot
+                          rbx};  // kMaybeFeedbackVector
+  data->InitializePlatformSpecific(arraysize(registers), registers);
+}
+
+void UnaryOp_WithFeedbackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  Register registers[] = {rdx,   // kValue
+                          rax,   // kSlot
+                          rdi};  // kMaybeFeedbackVector
+  data->InitializePlatformSpecific(arraysize(registers), registers);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/codegen/x64/macro-assembler-x64.cc b/deps/v8/src/codegen/x64/macro-assembler-x64.cc
index a3389f1bb04..fabf70bb036 100644
--- a/deps/v8/src/codegen/x64/macro-assembler-x64.cc
+++ b/deps/v8/src/codegen/x64/macro-assembler-x64.cc
@@ -14,10 +14,11 @@
 #include "src/codegen/register-configuration.h"
 #include "src/codegen/string-constants.h"
 #include "src/codegen/x64/assembler-x64.h"
+#include "src/common/external-pointer.h"
 #include "src/common/globals.h"
 #include "src/debug/debug.h"
 #include "src/execution/frames-inl.h"
-#include "src/heap/heap-inl.h"  // For MemoryChunk.
+#include "src/heap/memory-chunk.h"
 #include "src/init/bootstrapper.h"
 #include "src/logging/counters.h"
 #include "src/objects/objects-inl.h"
@@ -341,6 +342,14 @@ void TurboAssembler::SaveRegisters(RegList registers) {
   }
 }
 
+void TurboAssembler::LoadExternalPointerField(Register destination,
+                                              Operand field_operand) {
+  movq(destination, field_operand);
+  if (V8_HEAP_SANDBOX_BOOL) {
+    xorq(destination, Immediate(kExternalPointerSalt));
+  }
+}
+
 void TurboAssembler::RestoreRegisters(RegList registers) {
   DCHECK_GT(NumRegs(registers), 0);
   for (int i = Register::kNumRegisters - 1; i >= 0; --i) {
@@ -2747,10 +2756,10 @@ void TurboAssembler::CheckPageFlag(Register object, Register scratch, int mask,
     andq(scratch, object);
   }
   if (mask < (1 << kBitsPerByte)) {
-    testb(Operand(scratch, MemoryChunk::kFlagsOffset),
+    testb(Operand(scratch, BasicMemoryChunk::kFlagsOffset),
           Immediate(static_cast<uint8_t>(mask)));
   } else {
-    testl(Operand(scratch, MemoryChunk::kFlagsOffset), Immediate(mask));
+    testl(Operand(scratch, BasicMemoryChunk::kFlagsOffset), Immediate(mask));
   }
   j(cc, condition_met, condition_met_distance);
 }
diff --git a/deps/v8/src/codegen/x64/macro-assembler-x64.h b/deps/v8/src/codegen/x64/macro-assembler-x64.h
index da9ab5da323..ab1745a7602 100644
--- a/deps/v8/src/codegen/x64/macro-assembler-x64.h
+++ b/deps/v8/src/codegen/x64/macro-assembler-x64.h
@@ -141,6 +141,7 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   AVX_OP(Movups, movups)
   AVX_OP(Movmskps, movmskps)
   AVX_OP(Movmskpd, movmskpd)
+  AVX_OP(Pmovmskb, pmovmskb)
   AVX_OP(Movss, movss)
   AVX_OP(Movsd, movsd)
   AVX_OP(Movdqu, movdqu)
@@ -175,6 +176,7 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   AVX_OP(Cmpnlepd, cmpnlepd)
   AVX_OP(Roundss, roundss)
   AVX_OP(Roundsd, roundsd)
+  AVX_OP(Roundps, roundps)
   AVX_OP(Sqrtss, sqrtss)
   AVX_OP(Sqrtsd, sqrtsd)
   AVX_OP(Sqrtps, sqrtps)
@@ -227,7 +229,6 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   AVX_OP(Rcpps, rcpps)
   AVX_OP(Rsqrtps, rsqrtps)
   AVX_OP(Addps, addps)
-  AVX_OP(Haddps, haddps)
   AVX_OP(Subps, subps)
   AVX_OP(Mulps, mulps)
   AVX_OP(Divps, divps)
@@ -248,6 +249,7 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   AVX_OP(Cmpps, cmpps)
   AVX_OP(Cmppd, cmppd)
   AVX_OP(Movlhps, movlhps)
+  AVX_OP_SSE3(Haddps, haddps)
   AVX_OP_SSE3(Movddup, movddup)
   AVX_OP_SSSE3(Phaddd, phaddd)
   AVX_OP_SSSE3(Phaddw, phaddw)
@@ -676,6 +678,13 @@ class V8_EXPORT_PRIVATE TurboAssembler : public TurboAssemblerBase {
   void DecompressTaggedPointer(Register destination, Register source);
   void DecompressAnyTagged(Register destination, Operand field_operand);
 
+  // ---------------------------------------------------------------------------
+  // V8 Heap sandbox support
+
+  // Loads a field containing off-heap pointer and does necessary decoding
+  // if V8 heap sandbox is enabled.
+  void LoadExternalPointerField(Register destination, Operand field_operand);
+
  protected:
   static const int kSmiShift = kSmiTagSize + kSmiShiftSize;
 
diff --git a/deps/v8/src/codegen/x64/register-x64.h b/deps/v8/src/codegen/x64/register-x64.h
index 39e8c02b3fe..7d5aaab6829 100644
--- a/deps/v8/src/codegen/x64/register-x64.h
+++ b/deps/v8/src/codegen/x64/register-x64.h
@@ -217,6 +217,8 @@ constexpr Register kRootRegister = r13;  // callee save
 
 constexpr Register kOffHeapTrampolineRegister = kScratchRegister;
 
+constexpr DoubleRegister kFPReturnRegister0 = xmm0;
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/common/external-pointer-inl.h b/deps/v8/src/common/external-pointer-inl.h
new file mode 100644
index 00000000000..32a78002e15
--- /dev/null
+++ b/deps/v8/src/common/external-pointer-inl.h
@@ -0,0 +1,32 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMMON_EXTERNAL_POINTER_INL_H_
+#define V8_COMMON_EXTERNAL_POINTER_INL_H_
+
+#include "include/v8-internal.h"
+#include "src/common/external-pointer.h"
+#include "src/execution/isolate.h"
+
+namespace v8 {
+namespace internal {
+
+V8_INLINE ExternalPointer_t EncodeExternalPointer(Isolate* isolate,
+                                                  Address external_pointer) {
+  STATIC_ASSERT(kExternalPointerSize == kSystemPointerSize);
+  if (!V8_HEAP_SANDBOX_BOOL) return external_pointer;
+  return external_pointer ^ kExternalPointerSalt;
+}
+
+V8_INLINE Address DecodeExternalPointer(const Isolate* isolate,
+                                        ExternalPointer_t encoded_pointer) {
+  STATIC_ASSERT(kExternalPointerSize == kSystemPointerSize);
+  if (!V8_HEAP_SANDBOX_BOOL) return encoded_pointer;
+  return encoded_pointer ^ kExternalPointerSalt;
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMMON_EXTERNAL_POINTER_INL_H_
diff --git a/deps/v8/src/common/external-pointer.h b/deps/v8/src/common/external-pointer.h
new file mode 100644
index 00000000000..9b5b061997e
--- /dev/null
+++ b/deps/v8/src/common/external-pointer.h
@@ -0,0 +1,33 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMMON_EXTERNAL_POINTER_H_
+#define V8_COMMON_EXTERNAL_POINTER_H_
+
+#include "src/common/globals.h"
+
+namespace v8 {
+namespace internal {
+
+// See v8:10391 for details about V8 heap sandbox.
+constexpr uint32_t kExternalPointerSalt =
+    0x7fffffff & ~static_cast<uint32_t>(kHeapObjectTagMask);
+
+static_assert(static_cast<int32_t>(kExternalPointerSalt) >= 0,
+              "Salt value must be positive for better assembly code");
+
+// Convert external pointer value into encoded form suitable for being stored
+// on V8 heap.
+V8_INLINE ExternalPointer_t EncodeExternalPointer(Isolate* isolate,
+                                                  Address external_pointer);
+
+// Convert external pointer from on-V8-heap representation to an actual external
+// pointer value.
+V8_INLINE Address DecodeExternalPointer(const Isolate* isolate,
+                                        ExternalPointer_t encoded_pointer);
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMMON_EXTERNAL_POINTER_H_
diff --git a/deps/v8/src/common/globals.h b/deps/v8/src/common/globals.h
index c79b3b633cd..21151a2a6b6 100644
--- a/deps/v8/src/common/globals.h
+++ b/deps/v8/src/common/globals.h
@@ -151,6 +151,8 @@ constexpr int kMaxInt16 = (1 << 15) - 1;
 constexpr int kMinInt16 = -(1 << 15);
 constexpr int kMaxUInt16 = (1 << 16) - 1;
 constexpr int kMinUInt16 = 0;
+constexpr int kMaxInt31 = kMaxInt / 2;
+constexpr int kMinInt31 = kMinInt / 2;
 
 constexpr uint32_t kMaxUInt32 = 0xFFFFFFFFu;
 constexpr int kMinUInt32 = 0;
@@ -279,6 +281,11 @@ constexpr int kPointerSizeLog2 = kSystemPointerSizeLog2;
 STATIC_ASSERT(kPointerSize == (1 << kPointerSizeLog2));
 #endif
 
+// This type defines raw storage type for external (or off-V8 heap) pointers
+// stored on V8 heap.
+using ExternalPointer_t = Address;
+constexpr int kExternalPointerSize = sizeof(ExternalPointer_t);
+
 constexpr int kEmbedderDataSlotSize = kSystemPointerSize;
 
 constexpr int kEmbedderDataSlotSizeInTaggedSlots =
@@ -646,6 +653,7 @@ class NewSpace;
 class NewLargeObjectSpace;
 class NumberDictionary;
 class Object;
+class OffThreadIsolate;
 class OldLargeObjectSpace;
 template <HeapObjectReferenceType kRefType, typename StorageType>
 class TaggedImpl;
@@ -805,17 +813,6 @@ enum class LocalSpaceKind {
 
 enum Executability { NOT_EXECUTABLE, EXECUTABLE };
 
-enum VisitMode {
-  VISIT_ALL,
-  VISIT_ALL_IN_MINOR_MC_MARK,
-  VISIT_ALL_IN_MINOR_MC_UPDATE,
-  VISIT_ALL_IN_SCAVENGE,
-  VISIT_ALL_IN_SWEEP_NEWSPACE,
-  VISIT_ONLY_STRONG,
-  VISIT_ONLY_STRONG_IGNORE_STACK,
-  VISIT_FOR_SERIALIZATION,
-};
-
 enum class BytecodeFlushMode {
   kDoNotFlushBytecode,
   kFlushBytecode,
@@ -837,7 +834,7 @@ enum NativesFlag { NOT_NATIVES_CODE, EXTENSION_CODE, INSPECTOR_CODE };
 
 // ParseRestriction is used to restrict the set of valid statements in a
 // unit of compilation.  Restriction violations cause a syntax error.
-enum ParseRestriction {
+enum ParseRestriction : bool {
   NO_PARSE_RESTRICTION,         // All expressions are allowed.
   ONLY_SINGLE_FUNCTION_LITERAL  // Only a single FunctionLiteral expression.
 };
@@ -1342,31 +1339,46 @@ class BinaryOperationFeedback {
 };
 
 // Type feedback is encoded in such a way that, we can combine the feedback
-// at different points by performing an 'OR' operation. Type feedback moves
-// to a more generic type when we combine feedback.
-//
-//   kSignedSmall -> kNumber             -> kNumberOrOddball           -> kAny
-//                   kReceiver           -> kReceiverOrNullOrUndefined -> kAny
-//                   kInternalizedString -> kString                    -> kAny
-//                                          kSymbol                    -> kAny
-//                                          kBigInt                    -> kAny
-//
+// at different points by performing an 'OR' operation.
 // This is distinct from BinaryOperationFeedback on purpose, because the
 // feedback that matters differs greatly as well as the way it is consumed.
 class CompareOperationFeedback {
- public:
   enum {
-    kNone = 0x000,
-    kSignedSmall = 0x001,
-    kNumber = 0x003,
-    kNumberOrOddball = 0x007,
-    kInternalizedString = 0x008,
-    kString = 0x018,
-    kSymbol = 0x020,
-    kBigInt = 0x040,
-    kReceiver = 0x080,
-    kReceiverOrNullOrUndefined = 0x180,
-    kAny = 0x1ff
+    kSignedSmallFlag = 1 << 0,
+    kOtherNumberFlag = 1 << 1,
+    kBooleanFlag = 1 << 2,
+    kNullOrUndefinedFlag = 1 << 3,
+    kInternalizedStringFlag = 1 << 4,
+    kOtherStringFlag = 1 << 5,
+    kSymbolFlag = 1 << 6,
+    kBigIntFlag = 1 << 7,
+    kReceiverFlag = 1 << 8,
+    kAnyMask = 0x1FF,
+  };
+
+ public:
+  enum Type {
+    kNone = 0,
+
+    kBoolean = kBooleanFlag,
+    kNullOrUndefined = kNullOrUndefinedFlag,
+    kOddball = kBoolean | kNullOrUndefined,
+
+    kSignedSmall = kSignedSmallFlag,
+    kNumber = kSignedSmall | kOtherNumberFlag,
+    kNumberOrBoolean = kNumber | kBoolean,
+    kNumberOrOddball = kNumber | kOddball,
+
+    kInternalizedString = kInternalizedStringFlag,
+    kString = kInternalizedString | kOtherStringFlag,
+
+    kReceiver = kReceiverFlag,
+    kReceiverOrNullOrUndefined = kReceiver | kNullOrUndefined,
+
+    kBigInt = kBigIntFlag,
+    kSymbol = kSymbolFlag,
+
+    kAny = kAnyMask,
   };
 };
 
@@ -1598,7 +1610,10 @@ enum class LoadSensitivity {
   V(TrapElemSegmentDropped)        \
   V(TrapTableOutOfBounds)          \
   V(TrapBrOnExnNullRef)            \
-  V(TrapRethrowNullRef)
+  V(TrapRethrowNullRef)            \
+  V(TrapNullDereference)           \
+  V(TrapIllegalCast)               \
+  V(TrapArrayOutOfBounds)
 
 enum KeyedAccessLoadMode {
   STANDARD_LOAD,
diff --git a/deps/v8/src/common/message-template.h b/deps/v8/src/common/message-template.h
index 13d5310d929..e6a25de2663 100644
--- a/deps/v8/src/common/message-template.h
+++ b/deps/v8/src/common/message-template.h
@@ -223,8 +223,6 @@ namespace internal {
   T(ProxyGetPrototypeOfNonExtensible,                                          \
     "'getPrototypeOf' on proxy: proxy target is non-extensible but the "       \
     "trap did not return its actual prototype")                                \
-  T(ProxyHandlerOrTargetRevoked,                                               \
-    "Cannot create proxy with a revoked proxy as target or handler")           \
   T(ProxyHasNonConfigurable,                                                   \
     "'has' on proxy: trap returned falsish for property '%' which exists in "  \
     "the proxy target as non-configurable")                                    \
@@ -500,7 +498,8 @@ namespace internal {
   T(TooManySpreads,                                                            \
     "Literal containing too many nested spreads (up to 65534 allowed)")        \
   T(TooManyVariables, "Too many variables declared (only 4194303 allowed)")    \
-  T(TooManyElementsInPromiseAll, "Too many elements passed to Promise.all")    \
+  T(TooManyElementsInPromiseCombinator,                                        \
+    "Too many elements passed to Promise.%")                                   \
   T(TypedArrayTooShort,                                                        \
     "Derived TypedArray constructor created an array which was too small")     \
   T(UnexpectedEOS, "Unexpected end of input")                                  \
@@ -554,6 +553,9 @@ namespace internal {
   T(WasmTrapTableOutOfBounds, "table access out of bounds")                    \
   T(WasmTrapBrOnExnNullRef, "br_on_exn on nullref value")                      \
   T(WasmTrapRethrowNullRef, "rethrowing nullref value")                        \
+  T(WasmTrapNullDereference, "dereferencing a null pointer")                   \
+  T(WasmTrapIllegalCast, "illegal cast")                                       \
+  T(WasmTrapArrayOutOfBounds, "array element access out of bounds")            \
   T(WasmExceptionError, "wasm exception")                                      \
   /* Asm.js validation related */                                              \
   T(AsmJsInvalid, "Invalid asm.js: %")                                         \
@@ -593,7 +595,9 @@ namespace internal {
     "WeakRef: target must be an object")                                       \
   T(OptionalChainingNoNew, "Invalid optional chain from new expression")       \
   T(OptionalChainingNoSuper, "Invalid optional chain from super property")     \
-  T(OptionalChainingNoTemplate, "Invalid tagged template on optional chain")
+  T(OptionalChainingNoTemplate, "Invalid tagged template on optional chain")   \
+  /* AggregateError */                                                         \
+  T(AllPromisesRejected, "All promises were rejected")
 
 enum class MessageTemplate {
 #define TEMPLATE(NAME, STRING) k##NAME,
diff --git a/deps/v8/src/common/ptr-compr-inl.h b/deps/v8/src/common/ptr-compr-inl.h
index 75ea2e069fc..18989303198 100644
--- a/deps/v8/src/common/ptr-compr-inl.h
+++ b/deps/v8/src/common/ptr-compr-inl.h
@@ -8,6 +8,7 @@
 #include "include/v8-internal.h"
 #include "src/common/ptr-compr.h"
 #include "src/execution/isolate.h"
+#include "src/execution/off-thread-isolate-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -36,6 +37,15 @@ V8_INLINE Address GetIsolateRoot(const Isolate* isolate) {
   return isolate_root;
 }
 
+V8_INLINE Address GetIsolateRoot(const OffThreadIsolate* isolate) {
+  Address isolate_root = isolate->isolate_root();
+#ifdef V8_COMPRESS_POINTERS
+  isolate_root = reinterpret_cast<Address>(V8_ASSUME_ALIGNED(
+      reinterpret_cast<void*>(isolate_root), kPtrComprIsolateRootAlignment));
+#endif
+  return isolate_root;
+}
+
 // Decompresses smi value.
 V8_INLINE Address DecompressTaggedSigned(Tagged_t raw_value) {
   // For runtime code the upper 32-bits of the Smi value do not matter.
diff --git a/deps/v8/src/compiler-dispatcher/compiler-dispatcher.cc b/deps/v8/src/compiler-dispatcher/compiler-dispatcher.cc
index 42d64b66145..c20a38a7e4b 100644
--- a/deps/v8/src/compiler-dispatcher/compiler-dispatcher.cc
+++ b/deps/v8/src/compiler-dispatcher/compiler-dispatcher.cc
@@ -27,7 +27,6 @@ CompilerDispatcher::Job::~Job() = default;
 CompilerDispatcher::CompilerDispatcher(Isolate* isolate, Platform* platform,
                                        size_t max_stack_size)
     : isolate_(isolate),
-      allocator_(isolate->allocator()),
       worker_thread_runtime_call_stats_(
           isolate->counters()->worker_thread_runtime_call_stats()),
       background_compile_timer_(
@@ -66,7 +65,7 @@ base::Optional<CompilerDispatcher::JobId> CompilerDispatcher::Enqueue(
   if (!IsEnabled()) return base::nullopt;
 
   std::unique_ptr<Job> job = std::make_unique<Job>(new BackgroundCompileTask(
-      allocator_, outer_parse_info, function_name, function_literal,
+      outer_parse_info, function_name, function_literal,
       worker_thread_runtime_call_stats_, background_compile_timer_,
       static_cast<int>(max_stack_size_)));
   JobMap::const_iterator it = InsertJob(std::move(job));
diff --git a/deps/v8/src/compiler-dispatcher/compiler-dispatcher.h b/deps/v8/src/compiler-dispatcher/compiler-dispatcher.h
index 544e9c8ba7b..108e3cca49d 100644
--- a/deps/v8/src/compiler-dispatcher/compiler-dispatcher.h
+++ b/deps/v8/src/compiler-dispatcher/compiler-dispatcher.h
@@ -151,7 +151,6 @@ class V8_EXPORT_PRIVATE CompilerDispatcher {
   JobMap::const_iterator RemoveJob(JobMap::const_iterator job);
 
   Isolate* isolate_;
-  AccountingAllocator* allocator_;
   WorkerThreadRuntimeCallStats* worker_thread_runtime_call_stats_;
   TimedHistogram* background_compile_timer_;
   std::shared_ptr<v8::TaskRunner> taskrunner_;
diff --git a/deps/v8/src/compiler/OWNERS b/deps/v8/src/compiler/OWNERS
index 8eac0495047..809f36741f0 100644
--- a/deps/v8/src/compiler/OWNERS
+++ b/deps/v8/src/compiler/OWNERS
@@ -1,6 +1,4 @@
 bmeurer@chromium.org
-jarin@chromium.org
-titzer@chromium.org
 danno@chromium.org
 sigurds@chromium.org
 tebbi@chromium.org
@@ -8,6 +6,7 @@ neis@chromium.org
 mvstanton@chromium.org
 mslekova@chromium.org
 jgruber@chromium.org
+nicohartmann@chromium.org
 
 per-file wasm-*=ahaas@chromium.org
 per-file wasm-*=bbudge@chromium.org
diff --git a/deps/v8/src/compiler/access-builder.cc b/deps/v8/src/compiler/access-builder.cc
index f820b3db4ca..09603fd16c5 100644
--- a/deps/v8/src/compiler/access-builder.cc
+++ b/deps/v8/src/compiler/access-builder.cc
@@ -17,6 +17,7 @@
 #include "src/objects/objects-inl.h"
 #include "src/objects/ordered-hash-table.h"
 #include "src/objects/source-text-module.h"
+#include "torque-generated/exported-class-definitions-tq.h"
 
 namespace v8 {
 namespace internal {
@@ -420,7 +421,8 @@ FieldAccess AccessBuilder::ForJSTypedArrayExternalPointer() {
                         JSTypedArray::kExternalPointerOffset,
                         MaybeHandle<Name>(),
                         MaybeHandle<Map>(),
-                        Type::ExternalPointer(),
+                        V8_HEAP_SANDBOX_BOOL ? Type::SandboxedExternalPointer()
+                                             : Type::ExternalPointer(),
                         MachineType::Pointer(),
                         kNoWriteBarrier,
                         LoadSensitivity::kCritical};
@@ -429,9 +431,13 @@ FieldAccess AccessBuilder::ForJSTypedArrayExternalPointer() {
 
 // static
 FieldAccess AccessBuilder::ForJSDataViewDataPointer() {
-  FieldAccess access = {kTaggedBase,           JSDataView::kDataPointerOffset,
-                        MaybeHandle<Name>(),   MaybeHandle<Map>(),
-                        Type::OtherInternal(), MachineType::Pointer(),
+  FieldAccess access = {kTaggedBase,
+                        JSDataView::kDataPointerOffset,
+                        MaybeHandle<Name>(),
+                        MaybeHandle<Map>(),
+                        V8_HEAP_SANDBOX_BOOL ? Type::SandboxedExternalPointer()
+                                             : Type::ExternalPointer(),
+                        MachineType::Pointer(),
                         kNoWriteBarrier};
   return access;
 }
@@ -524,6 +530,26 @@ FieldAccess AccessBuilder::ForFixedArrayLength() {
   return access;
 }
 
+// static
+FieldAccess AccessBuilder::ForSloppyArgumentsElementsContext() {
+  FieldAccess access = {
+      kTaggedBase,         SloppyArgumentsElements::kContextOffset,
+      MaybeHandle<Name>(), MaybeHandle<Map>(),
+      Type::Any(),         MachineType::TaggedPointer(),
+      kPointerWriteBarrier};
+  return access;
+}
+
+// static
+FieldAccess AccessBuilder::ForSloppyArgumentsElementsArguments() {
+  FieldAccess access = {
+      kTaggedBase,         SloppyArgumentsElements::kArgumentsOffset,
+      MaybeHandle<Name>(), MaybeHandle<Map>(),
+      Type::Any(),         MachineType::TaggedPointer(),
+      kPointerWriteBarrier};
+  return access;
+}
+
 // static
 FieldAccess AccessBuilder::ForPropertyArrayLengthAndHash() {
   FieldAccess access = {
@@ -690,7 +716,8 @@ FieldAccess AccessBuilder::ForExternalStringResourceData() {
                         ExternalString::kResourceDataOffset,
                         Handle<Name>(),
                         MaybeHandle<Map>(),
-                        Type::ExternalPointer(),
+                        V8_HEAP_SANDBOX_BOOL ? Type::SandboxedExternalPointer()
+                                             : Type::ExternalPointer(),
                         MachineType::Pointer(),
                         kNoWriteBarrier};
   return access;
@@ -861,6 +888,14 @@ ElementAccess AccessBuilder::ForFixedArrayElement() {
 }
 
 // static
+ElementAccess AccessBuilder::ForSloppyArgumentsElementsMappedEntry() {
+  ElementAccess access = {
+      kTaggedBase, SloppyArgumentsElements::kMappedEntriesOffset, Type::Any(),
+      MachineType::AnyTagged(), kFullWriteBarrier};
+  return access;
+}
+
+// statics
 ElementAccess AccessBuilder::ForFixedArrayElement(
     ElementsKind kind, LoadSensitivity load_sensitivity) {
   ElementAccess access = {kTaggedBase,       FixedArray::kHeaderSize,
diff --git a/deps/v8/src/compiler/access-builder.h b/deps/v8/src/compiler/access-builder.h
index 622dc1d76c2..7207e129b00 100644
--- a/deps/v8/src/compiler/access-builder.h
+++ b/deps/v8/src/compiler/access-builder.h
@@ -179,6 +179,12 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   // Provides access to FixedArray::length() field.
   static FieldAccess ForFixedArrayLength();
 
+  // Provides access to SloppyArgumentsElements::context() field.
+  static FieldAccess ForSloppyArgumentsElementsContext();
+
+  // Provides access to SloppyArgumentsElements::arguments() field.
+  static FieldAccess ForSloppyArgumentsElementsArguments();
+
   // Provides access to PropertyArray::length() field.
   static FieldAccess ForPropertyArrayLengthAndHash();
 
@@ -283,6 +289,9 @@ class V8_EXPORT_PRIVATE AccessBuilder final
       ElementsKind kind,
       LoadSensitivity load_sensitivity = LoadSensitivity::kUnsafe);
 
+  // Provides access to SloppyArgumentsElements elements.
+  static ElementAccess ForSloppyArgumentsElementsMappedEntry();
+
   // Provides access to stack arguments
   static ElementAccess ForStackArgument();
 
diff --git a/deps/v8/src/compiler/access-info.cc b/deps/v8/src/compiler/access-info.cc
index dcdd1de831a..9a2a56cd8b1 100644
--- a/deps/v8/src/compiler/access-info.cc
+++ b/deps/v8/src/compiler/access-info.cc
@@ -390,6 +390,10 @@ PropertyAccessInfo AccessInfoFactory::ComputeDataFieldAccessInfo(
   PropertyConstness constness;
   if (details.IsReadOnly() && !details.IsConfigurable()) {
     constness = PropertyConstness::kConst;
+  } else if (FLAG_turboprop && !map->is_prototype_map()) {
+    // The constness feedback is too unstable for the aggresive compilation
+    // of turboprop.
+    constness = PropertyConstness::kMutable;
   } else {
     map_ref.SerializeOwnDescriptor(descriptor);
     constness = dependencies()->DependOnFieldConstness(map_ref, descriptor);
@@ -583,11 +587,7 @@ PropertyAccessInfo AccessInfoFactory::ComputePropertyAccessInfo(
       }
     }
     Handle<JSObject> map_prototype(JSObject::cast(map->prototype()), isolate());
-    if (map_prototype->map().is_deprecated()) {
-      // Try to migrate the prototype object so we don't embed the deprecated
-      // map into the optimized code.
-      JSObject::TryMigrateInstance(isolate(), map_prototype);
-    }
+    CHECK(!map_prototype->map().is_deprecated());
     map = handle(map_prototype->map(), isolate());
     holder = map_prototype;
 
diff --git a/deps/v8/src/compiler/allocation-builder-inl.h b/deps/v8/src/compiler/allocation-builder-inl.h
index 26fbe503c36..2b6109f49e2 100644
--- a/deps/v8/src/compiler/allocation-builder-inl.h
+++ b/deps/v8/src/compiler/allocation-builder-inl.h
@@ -5,10 +5,11 @@
 #ifndef V8_COMPILER_ALLOCATION_BUILDER_INL_H_
 #define V8_COMPILER_ALLOCATION_BUILDER_INL_H_
 
-#include "src/compiler/allocation-builder.h"
-
 #include "src/compiler/access-builder.h"
+#include "src/compiler/allocation-builder.h"
 #include "src/objects/map-inl.h"
+#include "torque-generated/exported-class-definitions-tq-inl.h"
+#include "torque-generated/exported-class-definitions-tq.h"
 
 namespace v8 {
 namespace internal {
@@ -40,6 +41,14 @@ void AllocationBuilder::AllocateArray(int length, MapRef map,
   Store(AccessBuilder::ForFixedArrayLength(), jsgraph()->Constant(length));
 }
 
+void AllocationBuilder::AllocateSloppyArgumentElements(
+    int length, MapRef map, AllocationType allocation) {
+  int size = SloppyArgumentsElements::SizeFor(length);
+  Allocate(size, allocation, Type::OtherInternal());
+  Store(AccessBuilder::ForMap(), map);
+  Store(AccessBuilder::ForFixedArrayLength(), jsgraph()->Constant(length));
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/allocation-builder.h b/deps/v8/src/compiler/allocation-builder.h
index 040dd014051..709146950c6 100644
--- a/deps/v8/src/compiler/allocation-builder.h
+++ b/deps/v8/src/compiler/allocation-builder.h
@@ -55,6 +55,11 @@ class AllocationBuilder final {
   inline void AllocateArray(int length, MapRef map,
                             AllocationType allocation = AllocationType::kYoung);
 
+  // Compound allocation of a SloppyArgumentsElements
+  inline void AllocateSloppyArgumentElements(
+      int length, MapRef map,
+      AllocationType allocation = AllocationType::kYoung);
+
   // Compound store of a constant into a field.
   void Store(const FieldAccess& access, const ObjectRef& value) {
     Store(access, jsgraph()->Constant(value));
diff --git a/deps/v8/src/compiler/backend/arm/code-generator-arm.cc b/deps/v8/src/compiler/backend/arm/code-generator-arm.cc
index 5b0c74799b6..6ef31c8e6bf 100644
--- a/deps/v8/src/compiler/backend/arm/code-generator-arm.cc
+++ b/deps/v8/src/compiler/backend/arm/code-generator-arm.cc
@@ -2,17 +2,16 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/compiler/backend/code-generator.h"
-
 #include "src/codegen/assembler-inl.h"
 #include "src/codegen/macro-assembler.h"
 #include "src/codegen/optimized-compilation-info.h"
 #include "src/compiler/backend/code-generator-impl.h"
+#include "src/compiler/backend/code-generator.h"
 #include "src/compiler/backend/gap-resolver.h"
 #include "src/compiler/backend/instruction-codes.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/osr.h"
-#include "src/heap/heap-inl.h"  // crbug.com/v8/8499
+#include "src/heap/memory-chunk.h"
 #include "src/numbers/double.h"
 #include "src/utils/boxed-float.h"
 #include "src/wasm/wasm-code-manager.h"
@@ -1961,43 +1960,61 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArmF64x2Lt: {
       UseScratchRegisterScope temps(tasm());
       Register scratch = temps.Acquire();
-      __ mov(scratch, Operand(0));
       __ VFPCompareAndSetFlags(i.InputSimd128Register(0).low(),
                                i.InputSimd128Register(1).low());
-      __ mov(scratch, Operand(-1), LeaveCC, lt);
-      // Check for NaN.
-      __ mov(scratch, Operand(0), LeaveCC, vs);
+      __ mov(scratch, Operand(0), LeaveCC, cs);
+      __ mov(scratch, Operand(-1), LeaveCC, mi);
       __ vmov(i.OutputSimd128Register().low(), scratch, scratch);
 
-      __ mov(scratch, Operand(0));
       __ VFPCompareAndSetFlags(i.InputSimd128Register(0).high(),
                                i.InputSimd128Register(1).high());
-      __ mov(scratch, Operand(-1), LeaveCC, lt);
-      // Check for NaN.
-      __ mov(scratch, Operand(0), LeaveCC, vs);
+      __ mov(scratch, Operand(0), LeaveCC, cs);
+      __ mov(scratch, Operand(-1), LeaveCC, mi);
       __ vmov(i.OutputSimd128Register().high(), scratch, scratch);
       break;
     }
     case kArmF64x2Le: {
       UseScratchRegisterScope temps(tasm());
       Register scratch = temps.Acquire();
-      __ mov(scratch, Operand(0));
       __ VFPCompareAndSetFlags(i.InputSimd128Register(0).low(),
                                i.InputSimd128Register(1).low());
-      __ mov(scratch, Operand(-1), LeaveCC, le);
-      // Check for NaN.
-      __ mov(scratch, Operand(0), LeaveCC, vs);
+      __ mov(scratch, Operand(0), LeaveCC, hi);
+      __ mov(scratch, Operand(-1), LeaveCC, ls);
       __ vmov(i.OutputSimd128Register().low(), scratch, scratch);
 
-      __ mov(scratch, Operand(0));
       __ VFPCompareAndSetFlags(i.InputSimd128Register(0).high(),
                                i.InputSimd128Register(1).high());
-      __ mov(scratch, Operand(-1), LeaveCC, le);
-      // Check for NaN.
-      __ mov(scratch, Operand(0), LeaveCC, vs);
+      __ mov(scratch, Operand(0), LeaveCC, hi);
+      __ mov(scratch, Operand(-1), LeaveCC, ls);
       __ vmov(i.OutputSimd128Register().high(), scratch, scratch);
       break;
     }
+    case kArmF64x2Pmin: {
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register lhs = i.InputSimd128Register(0);
+      Simd128Register rhs = i.InputSimd128Register(1);
+      DCHECK_EQ(dst, lhs);
+
+      // Move rhs only when rhs is strictly greater (mi).
+      __ VFPCompareAndSetFlags(rhs.low(), lhs.low());
+      __ vmov(dst.low(), rhs.low(), mi);
+      __ VFPCompareAndSetFlags(rhs.high(), lhs.high());
+      __ vmov(dst.high(), rhs.high(), mi);
+      break;
+    }
+    case kArmF64x2Pmax: {
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register lhs = i.InputSimd128Register(0);
+      Simd128Register rhs = i.InputSimd128Register(1);
+      DCHECK_EQ(dst, lhs);
+
+      // Move rhs only when rhs is strictly greater (mi).
+      __ VFPCompareAndSetFlags(rhs.low(), lhs.low());
+      __ vmov(dst.low(), rhs.low(), gt);
+      __ VFPCompareAndSetFlags(rhs.high(), lhs.high());
+      __ vmov(dst.high(), rhs.high(), gt);
+      break;
+    }
     case kArmI64x2SplatI32Pair: {
       Simd128Register dst = i.OutputSimd128Register();
       __ vdup(Neon32, dst, i.InputRegister(0));
@@ -2221,6 +2238,33 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
               i.InputSimd128Register(0));
       break;
     }
+    case kArmF32x4Pmin: {
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register lhs = i.InputSimd128Register(0);
+      Simd128Register rhs = i.InputSimd128Register(1);
+      DCHECK_NE(dst, lhs);
+      DCHECK_NE(dst, rhs);
+
+      // f32x4.pmin(lhs, rhs)
+      // = v128.bitselect(rhs, lhs, f32x4.lt(rhs, lhs))
+      // = v128.bitselect(rhs, lhs, f32x4.gt(lhs, rhs))
+      __ vcgt(dst, lhs, rhs);
+      __ vbsl(dst, rhs, lhs);
+      break;
+    }
+    case kArmF32x4Pmax: {
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register lhs = i.InputSimd128Register(0);
+      Simd128Register rhs = i.InputSimd128Register(1);
+      DCHECK_NE(dst, lhs);
+      DCHECK_NE(dst, rhs);
+
+      // f32x4.pmax(lhs, rhs)
+      // = v128.bitselect(rhs, lhs, f32x4.gt(rhs, lhs))
+      __ vcgt(dst, rhs, lhs);
+      __ vbsl(dst, rhs, lhs);
+      break;
+    }
     case kArmI32x4Splat: {
       __ vdup(Neon32, i.OutputSimd128Register(), i.InputRegister(0));
       break;
@@ -3029,7 +3073,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ vrev16(Neon8, i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
     }
-    case kArmS1x4AnyTrue: {
+    case kArmV32x4AnyTrue:
+    case kArmV16x8AnyTrue:
+    case kArmV8x16AnyTrue: {
       const QwNeonRegister& src = i.InputSimd128Register(0);
       UseScratchRegisterScope temps(tasm());
       DwVfpRegister scratch = temps.AcquireD();
@@ -3040,7 +3086,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ mov(i.OutputRegister(), Operand(1), LeaveCC, ne);
       break;
     }
-    case kArmS1x4AllTrue: {
+    case kArmV32x4AllTrue: {
       const QwNeonRegister& src = i.InputSimd128Register(0);
       UseScratchRegisterScope temps(tasm());
       DwVfpRegister scratch = temps.AcquireD();
@@ -3051,19 +3097,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ mov(i.OutputRegister(), Operand(1), LeaveCC, ne);
       break;
     }
-    case kArmS1x8AnyTrue: {
-      const QwNeonRegister& src = i.InputSimd128Register(0);
-      UseScratchRegisterScope temps(tasm());
-      DwVfpRegister scratch = temps.AcquireD();
-      __ vpmax(NeonU16, scratch, src.low(), src.high());
-      __ vpmax(NeonU16, scratch, scratch, scratch);
-      __ vpmax(NeonU16, scratch, scratch, scratch);
-      __ ExtractLane(i.OutputRegister(), scratch, NeonS16, 0);
-      __ cmp(i.OutputRegister(), Operand(0));
-      __ mov(i.OutputRegister(), Operand(1), LeaveCC, ne);
-      break;
-    }
-    case kArmS1x8AllTrue: {
+    case kArmV16x8AllTrue: {
       const QwNeonRegister& src = i.InputSimd128Register(0);
       UseScratchRegisterScope temps(tasm());
       DwVfpRegister scratch = temps.AcquireD();
@@ -3075,23 +3109,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ mov(i.OutputRegister(), Operand(1), LeaveCC, ne);
       break;
     }
-    case kArmS1x16AnyTrue: {
-      const QwNeonRegister& src = i.InputSimd128Register(0);
-      UseScratchRegisterScope temps(tasm());
-      QwNeonRegister q_scratch = temps.AcquireQ();
-      DwVfpRegister d_scratch = q_scratch.low();
-      __ vpmax(NeonU8, d_scratch, src.low(), src.high());
-      __ vpmax(NeonU8, d_scratch, d_scratch, d_scratch);
-      // vtst to detect any bits in the bottom 32 bits of d_scratch.
-      // This saves an instruction vs. the naive sequence of vpmax.
-      // kDoubleRegZero is not changed, since it is 0.
-      __ vtst(Neon32, q_scratch, q_scratch, q_scratch);
-      __ ExtractLane(i.OutputRegister(), d_scratch, NeonS32, 0);
-      __ cmp(i.OutputRegister(), Operand(0));
-      __ mov(i.OutputRegister(), Operand(1), LeaveCC, ne);
-      break;
-    }
-    case kArmS1x16AllTrue: {
+    case kArmV8x16AllTrue: {
       const QwNeonRegister& src = i.InputSimd128Register(0);
       UseScratchRegisterScope temps(tasm());
       DwVfpRegister scratch = temps.AcquireD();
@@ -3283,13 +3301,25 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArmWord32AtomicPairStore: {
       Label store;
-      __ add(i.TempRegister(0), i.InputRegister(0), i.InputRegister(1));
+      Register base = i.InputRegister(0);
+      Register offset = i.InputRegister(1);
+      Register value_low = i.InputRegister(2);
+      Register value_high = i.InputRegister(3);
+      Register actual_addr = i.TempRegister(0);
+      // The {ldrexd} instruction needs two temp registers. We do not need the
+      // result of {ldrexd}, but {strexd} likely fails without the {ldrexd}.
+      Register tmp1 = i.TempRegister(1);
+      Register tmp2 = i.TempRegister(2);
+      // Reuse one of the temp registers for the result of {strexd}.
+      Register store_result = tmp1;
+      __ add(actual_addr, base, offset);
       __ dmb(ISH);
       __ bind(&store);
-      __ ldrexd(i.TempRegister(1), i.TempRegister(2), i.TempRegister(0));
-      __ strexd(i.TempRegister(1), i.InputRegister(2), i.InputRegister(3),
-                i.TempRegister(0));
-      __ teq(i.TempRegister(1), Operand(0));
+      // Add this {ldrexd} instruction here so that {strexd} below can succeed.
+      // We don't need the result of {ldrexd} itself.
+      __ ldrexd(tmp1, tmp2, actual_addr);
+      __ strexd(store_result, value_low, value_high, actual_addr);
+      __ cmp(store_result, Operand(0));
       __ b(ne, &store);
       __ dmb(ISH);
       break;
@@ -3421,7 +3451,7 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         __ PrepareCallCFunction(0, 0);
         __ CallCFunction(
             ExternalReference::wasm_call_trap_callback_for_testing(), 0);
-        __ LeaveFrame(StackFrame::WASM_COMPILED);
+        __ LeaveFrame(StackFrame::WASM);
         auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
         int pop_count =
             static_cast<int>(call_descriptor->StackParameterCount());
diff --git a/deps/v8/src/compiler/backend/arm/instruction-codes-arm.h b/deps/v8/src/compiler/backend/arm/instruction-codes-arm.h
index c6365bf7a50..39ed658fc4b 100644
--- a/deps/v8/src/compiler/backend/arm/instruction-codes-arm.h
+++ b/deps/v8/src/compiler/backend/arm/instruction-codes-arm.h
@@ -144,6 +144,8 @@ namespace compiler {
   V(ArmF64x2Ne)                    \
   V(ArmF64x2Lt)                    \
   V(ArmF64x2Le)                    \
+  V(ArmF64x2Pmin)                  \
+  V(ArmF64x2Pmax)                  \
   V(ArmF32x4Splat)                 \
   V(ArmF32x4ExtractLane)           \
   V(ArmF32x4ReplaceLane)           \
@@ -165,6 +167,8 @@ namespace compiler {
   V(ArmF32x4Ne)                    \
   V(ArmF32x4Lt)                    \
   V(ArmF32x4Le)                    \
+  V(ArmF32x4Pmin)                  \
+  V(ArmF32x4Pmax)                  \
   V(ArmI64x2SplatI32Pair)          \
   V(ArmI64x2ReplaceLaneI32Pair)    \
   V(ArmI64x2Neg)                   \
@@ -304,12 +308,12 @@ namespace compiler {
   V(ArmS8x8Reverse)                \
   V(ArmS8x4Reverse)                \
   V(ArmS8x2Reverse)                \
-  V(ArmS1x4AnyTrue)                \
-  V(ArmS1x4AllTrue)                \
-  V(ArmS1x8AnyTrue)                \
-  V(ArmS1x8AllTrue)                \
-  V(ArmS1x16AnyTrue)               \
-  V(ArmS1x16AllTrue)               \
+  V(ArmV32x4AnyTrue)               \
+  V(ArmV32x4AllTrue)               \
+  V(ArmV16x8AnyTrue)               \
+  V(ArmV16x8AllTrue)               \
+  V(ArmV8x16AnyTrue)               \
+  V(ArmV8x16AllTrue)               \
   V(ArmS8x16LoadSplat)             \
   V(ArmS16x8LoadSplat)             \
   V(ArmS32x4LoadSplat)             \
diff --git a/deps/v8/src/compiler/backend/arm/instruction-scheduler-arm.cc b/deps/v8/src/compiler/backend/arm/instruction-scheduler-arm.cc
index 8c09acd6df8..196aa1ce6c0 100644
--- a/deps/v8/src/compiler/backend/arm/instruction-scheduler-arm.cc
+++ b/deps/v8/src/compiler/backend/arm/instruction-scheduler-arm.cc
@@ -124,6 +124,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArmF64x2Ne:
     case kArmF64x2Lt:
     case kArmF64x2Le:
+    case kArmF64x2Pmin:
+    case kArmF64x2Pmax:
     case kArmF32x4Splat:
     case kArmF32x4ExtractLane:
     case kArmF32x4ReplaceLane:
@@ -145,6 +147,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArmF32x4Ne:
     case kArmF32x4Lt:
     case kArmF32x4Le:
+    case kArmF32x4Pmin:
+    case kArmF32x4Pmax:
     case kArmI64x2SplatI32Pair:
     case kArmI64x2ReplaceLaneI32Pair:
     case kArmI64x2Neg:
@@ -284,12 +288,12 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArmS8x8Reverse:
     case kArmS8x4Reverse:
     case kArmS8x2Reverse:
-    case kArmS1x4AnyTrue:
-    case kArmS1x4AllTrue:
-    case kArmS1x8AnyTrue:
-    case kArmS1x8AllTrue:
-    case kArmS1x16AnyTrue:
-    case kArmS1x16AllTrue:
+    case kArmV32x4AnyTrue:
+    case kArmV32x4AllTrue:
+    case kArmV16x8AnyTrue:
+    case kArmV16x8AllTrue:
+    case kArmV8x16AnyTrue:
+    case kArmV8x16AllTrue:
       return kNoOpcodeFlags;
 
     case kArmVldrF32:
diff --git a/deps/v8/src/compiler/backend/arm/instruction-selector-arm.cc b/deps/v8/src/compiler/backend/arm/instruction-selector-arm.cc
index 38a4dd8db4a..0fdc919927e 100644
--- a/deps/v8/src/compiler/backend/arm/instruction-selector-arm.cc
+++ b/deps/v8/src/compiler/backend/arm/instruction-selector-arm.cc
@@ -1233,6 +1233,8 @@ void InstructionSelector::VisitWord32PairSar(Node* node) {
   VisitWord32PairShift(this, kArmAsrPair, node);
 }
 
+void InstructionSelector::VisitWord32Rol(Node* node) { UNREACHABLE(); }
+
 void InstructionSelector::VisitWord32Ror(Node* node) {
   VisitShift(this, node, TryMatchROR);
 }
@@ -2437,23 +2439,24 @@ void InstructionSelector::VisitWord32AtomicPairExchange(Node* node) {
                          AddressingModeField::encode(addressing_mode);
   Node* projection0 = NodeProperties::FindProjection(node, 0);
   Node* projection1 = NodeProperties::FindProjection(node, 1);
+  InstructionOperand outputs[2];
+  size_t output_count = 0;
+  InstructionOperand temps[4];
+  size_t temp_count = 0;
+  temps[temp_count++] = g.TempRegister();
+  temps[temp_count++] = g.TempRegister();
+  if (projection0) {
+    outputs[output_count++] = g.DefineAsFixed(projection0, r6);
+  } else {
+    temps[temp_count++] = g.TempRegister(r6);
+  }
   if (projection1) {
-    InstructionOperand outputs[] = {g.DefineAsFixed(projection0, r6),
-                                    g.DefineAsFixed(projection1, r7)};
-    InstructionOperand temps[] = {g.TempRegister(), g.TempRegister()};
-    Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
-         arraysize(temps), temps);
-  } else if (projection0) {
-    InstructionOperand outputs[] = {g.DefineAsFixed(projection0, r6)};
-    InstructionOperand temps[] = {g.TempRegister(), g.TempRegister(),
-                                  g.TempRegister(r7)};
-    Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
-         arraysize(temps), temps);
+    outputs[output_count++] = g.DefineAsFixed(projection1, r7);
   } else {
-    InstructionOperand temps[] = {g.TempRegister(), g.TempRegister(),
-                                  g.TempRegister(r6), g.TempRegister(r7)};
-    Emit(code, 0, nullptr, arraysize(inputs), inputs, arraysize(temps), temps);
+    temps[temp_count++] = g.TempRegister(r7);
   }
+  Emit(code, output_count, outputs, arraysize(inputs), inputs, temp_count,
+       temps);
 }
 
 void InstructionSelector::VisitWord32AtomicPairCompareExchange(Node* node) {
@@ -2522,12 +2525,12 @@ void InstructionSelector::VisitWord32AtomicPairCompareExchange(Node* node) {
   V(I8x16Neg, kArmI8x16Neg)                             \
   V(I8x16Abs, kArmI8x16Abs)                             \
   V(S128Not, kArmS128Not)                               \
-  V(S1x4AnyTrue, kArmS1x4AnyTrue)                       \
-  V(S1x4AllTrue, kArmS1x4AllTrue)                       \
-  V(S1x8AnyTrue, kArmS1x8AnyTrue)                       \
-  V(S1x8AllTrue, kArmS1x8AllTrue)                       \
-  V(S1x16AnyTrue, kArmS1x16AnyTrue)                     \
-  V(S1x16AllTrue, kArmS1x16AllTrue)
+  V(V32x4AnyTrue, kArmV32x4AnyTrue)                     \
+  V(V32x4AllTrue, kArmV32x4AllTrue)                     \
+  V(V16x8AnyTrue, kArmV16x8AnyTrue)                     \
+  V(V16x8AllTrue, kArmV16x8AllTrue)                     \
+  V(V8x16AnyTrue, kArmV8x16AnyTrue)                     \
+  V(V8x16AllTrue, kArmV8x16AllTrue)
 
 #define SIMD_SHIFT_OP_LIST(V) \
   V(I64x2Shl, 64)             \
@@ -2938,6 +2941,42 @@ void InstructionSelector::VisitI32x4BitMask(Node* node) {
   VisitBitMask<kArmI32x4BitMask>(this, node);
 }
 
+namespace {
+void VisitF32x4PminOrPmax(InstructionSelector* selector, ArchOpcode opcode,
+                          Node* node) {
+  ArmOperandGenerator g(selector);
+  // Need all unique registers because we first compare the two inputs, then we
+  // need the inputs to remain unchanged for the bitselect later.
+  selector->Emit(opcode, g.DefineAsRegister(node),
+                 g.UseUniqueRegister(node->InputAt(0)),
+                 g.UseUniqueRegister(node->InputAt(1)));
+}
+
+void VisitF64x2PminOrPMax(InstructionSelector* selector, ArchOpcode opcode,
+                          Node* node) {
+  ArmOperandGenerator g(selector);
+  selector->Emit(opcode, g.DefineSameAsFirst(node),
+                 g.UseRegister(node->InputAt(0)),
+                 g.UseRegister(node->InputAt(1)));
+}
+}  // namespace
+
+void InstructionSelector::VisitF32x4Pmin(Node* node) {
+  VisitF32x4PminOrPmax(this, kArmF32x4Pmin, node);
+}
+
+void InstructionSelector::VisitF32x4Pmax(Node* node) {
+  VisitF32x4PminOrPmax(this, kArmF32x4Pmax, node);
+}
+
+void InstructionSelector::VisitF64x2Pmin(Node* node) {
+  VisitF64x2PminOrPMax(this, kArmF64x2Pmin, node);
+}
+
+void InstructionSelector::VisitF64x2Pmax(Node* node) {
+  VisitF64x2PminOrPMax(this, kArmF64x2Pmax, node);
+}
+
 // static
 MachineOperatorBuilder::Flags
 InstructionSelector::SupportedMachineOperatorFlags() {
diff --git a/deps/v8/src/compiler/backend/arm64/code-generator-arm64.cc b/deps/v8/src/compiler/backend/arm64/code-generator-arm64.cc
index f01181e955c..66895c71e85 100644
--- a/deps/v8/src/compiler/backend/arm64/code-generator-arm64.cc
+++ b/deps/v8/src/compiler/backend/arm64/code-generator-arm64.cc
@@ -2,17 +2,16 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/compiler/backend/code-generator.h"
-
 #include "src/codegen/arm64/assembler-arm64-inl.h"
 #include "src/codegen/arm64/macro-assembler-arm64-inl.h"
 #include "src/codegen/optimized-compilation-info.h"
 #include "src/compiler/backend/code-generator-impl.h"
+#include "src/compiler/backend/code-generator.h"
 #include "src/compiler/backend/gap-resolver.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/osr.h"
 #include "src/execution/frame-constants.h"
-#include "src/heap/heap-inl.h"  // crbug.com/v8/8499
+#include "src/heap/memory-chunk.h"
 #include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-objects.h"
 
@@ -1846,6 +1845,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
              i.InputSimd128Register(0).V##FORMAT(),  \
              i.InputSimd128Register(1).V##FORMAT()); \
     break;
+#define SIMD_DESTRUCTIVE_BINOP_CASE(Op, Instr, FORMAT)     \
+  case Op: {                                               \
+    VRegister dst = i.OutputSimd128Register().V##FORMAT(); \
+    DCHECK_EQ(dst, i.InputSimd128Register(0).V##FORMAT()); \
+    __ Instr(dst, i.InputSimd128Register(1).V##FORMAT(),   \
+             i.InputSimd128Register(2).V##FORMAT());       \
+    break;                                                 \
+  }
 
     case kArm64F64x2Splat: {
       __ Dup(i.OutputSimd128Register().V2D(), i.InputSimd128Register(0).D(), 0);
@@ -1892,16 +1899,27 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                i.InputSimd128Register(0).V2D());
       break;
     }
-    case kArm64F64x2Qfma: {
-      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      __ Fmla(i.OutputSimd128Register().V2D(), i.InputSimd128Register(1).V2D(),
-              i.InputSimd128Register(2).V2D());
+      SIMD_DESTRUCTIVE_BINOP_CASE(kArm64F64x2Qfma, Fmla, 2D);
+      SIMD_DESTRUCTIVE_BINOP_CASE(kArm64F64x2Qfms, Fmls, 2D);
+    case kArm64F64x2Pmin: {
+      VRegister dst = i.OutputSimd128Register().V2D();
+      VRegister lhs = i.InputSimd128Register(0).V2D();
+      VRegister rhs = i.InputSimd128Register(1).V2D();
+      // f64x2.pmin(lhs, rhs)
+      // = v128.bitselect(rhs, lhs, f64x2.lt(rhs,lhs))
+      // = v128.bitselect(rhs, lhs, f64x2.gt(lhs,rhs))
+      __ Fcmgt(dst, lhs, rhs);
+      __ Bsl(dst.V16B(), rhs.V16B(), lhs.V16B());
       break;
     }
-    case kArm64F64x2Qfms: {
-      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      __ Fmls(i.OutputSimd128Register().V2D(), i.InputSimd128Register(1).V2D(),
-              i.InputSimd128Register(2).V2D());
+    case kArm64F64x2Pmax: {
+      VRegister dst = i.OutputSimd128Register().V2D();
+      VRegister lhs = i.InputSimd128Register(0).V2D();
+      VRegister rhs = i.InputSimd128Register(1).V2D();
+      // f64x2.pmax(lhs, rhs)
+      // = v128.bitselect(rhs, lhs, f64x2.gt(rhs, lhs))
+      __ Fcmgt(dst, rhs, lhs);
+      __ Bsl(dst.V16B(), rhs.V16B(), lhs.V16B());
       break;
     }
     case kArm64F32x4Splat: {
@@ -1954,16 +1972,27 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                i.InputSimd128Register(0).V4S());
       break;
     }
-    case kArm64F32x4Qfma: {
-      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      __ Fmla(i.OutputSimd128Register().V4S(), i.InputSimd128Register(1).V4S(),
-              i.InputSimd128Register(2).V4S());
+      SIMD_DESTRUCTIVE_BINOP_CASE(kArm64F32x4Qfma, Fmla, 4S);
+      SIMD_DESTRUCTIVE_BINOP_CASE(kArm64F32x4Qfms, Fmls, 4S);
+    case kArm64F32x4Pmin: {
+      VRegister dst = i.OutputSimd128Register().V4S();
+      VRegister lhs = i.InputSimd128Register(0).V4S();
+      VRegister rhs = i.InputSimd128Register(1).V4S();
+      // f32x4.pmin(lhs, rhs)
+      // = v128.bitselect(rhs, lhs, f32x4.lt(rhs, lhs))
+      // = v128.bitselect(rhs, lhs, f32x4.gt(lhs, rhs))
+      __ Fcmgt(dst, lhs, rhs);
+      __ Bsl(dst.V16B(), rhs.V16B(), lhs.V16B());
       break;
     }
-    case kArm64F32x4Qfms: {
-      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      __ Fmls(i.OutputSimd128Register().V4S(), i.InputSimd128Register(1).V4S(),
-              i.InputSimd128Register(2).V4S());
+    case kArm64F32x4Pmax: {
+      VRegister dst = i.OutputSimd128Register().V4S();
+      VRegister lhs = i.InputSimd128Register(0).V4S();
+      VRegister rhs = i.InputSimd128Register(1).V4S();
+      // f32x4.pmax(lhs, rhs)
+      // = v128.bitselect(rhs, lhs, f32x4.gt(rhs, lhs))
+      __ Fcmgt(dst, rhs, lhs);
+      __ Bsl(dst.V16B(), rhs.V16B(), lhs.V16B());
       break;
     }
     case kArm64I64x2Splat: {
@@ -2104,6 +2133,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       SIMD_BINOP_CASE(kArm64I32x4AddHoriz, Addp, 4S);
       SIMD_BINOP_CASE(kArm64I32x4Sub, Sub, 4S);
       SIMD_BINOP_CASE(kArm64I32x4Mul, Mul, 4S);
+      SIMD_DESTRUCTIVE_BINOP_CASE(kArm64I32x4Mla, Mla, 4S);
+      SIMD_DESTRUCTIVE_BINOP_CASE(kArm64I32x4Mls, Mls, 4S);
       SIMD_BINOP_CASE(kArm64I32x4MinS, Smin, 4S);
       SIMD_BINOP_CASE(kArm64I32x4MaxS, Smax, 4S);
       SIMD_BINOP_CASE(kArm64I32x4Eq, Cmeq, 4S);
@@ -2197,6 +2228,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       SIMD_BINOP_CASE(kArm64I16x8Sub, Sub, 8H);
       SIMD_BINOP_CASE(kArm64I16x8SubSaturateS, Sqsub, 8H);
       SIMD_BINOP_CASE(kArm64I16x8Mul, Mul, 8H);
+      SIMD_DESTRUCTIVE_BINOP_CASE(kArm64I16x8Mla, Mla, 8H);
+      SIMD_DESTRUCTIVE_BINOP_CASE(kArm64I16x8Mls, Mls, 8H);
       SIMD_BINOP_CASE(kArm64I16x8MinS, Smin, 8H);
       SIMD_BINOP_CASE(kArm64I16x8MaxS, Smax, 8H);
       SIMD_BINOP_CASE(kArm64I16x8Eq, Cmeq, 8H);
@@ -2310,6 +2343,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       SIMD_BINOP_CASE(kArm64I8x16Sub, Sub, 16B);
       SIMD_BINOP_CASE(kArm64I8x16SubSaturateS, Sqsub, 16B);
       SIMD_BINOP_CASE(kArm64I8x16Mul, Mul, 16B);
+      SIMD_DESTRUCTIVE_BINOP_CASE(kArm64I8x16Mla, Mla, 16B);
+      SIMD_DESTRUCTIVE_BINOP_CASE(kArm64I8x16Mls, Mls, 16B);
       SIMD_BINOP_CASE(kArm64I8x16MinS, Smin, 16B);
       SIMD_BINOP_CASE(kArm64I8x16MaxS, Smax, 16B);
       SIMD_BINOP_CASE(kArm64I8x16Eq, Cmeq, 16B);
@@ -2394,13 +2429,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     }
-    case kArm64S128Select: {
-      VRegister dst = i.OutputSimd128Register().V16B();
-      DCHECK_EQ(dst, i.InputSimd128Register(0).V16B());
-      __ Bsl(dst, i.InputSimd128Register(1).V16B(),
-             i.InputSimd128Register(2).V16B());
-      break;
-    }
+      SIMD_DESTRUCTIVE_BINOP_CASE(kArm64S128Select, Bsl, 16B);
       SIMD_BINOP_CASE(kArm64S128AndNot, Bic, 16B);
     case kArm64S32x4Shuffle: {
       Simd128Register dst = i.OutputSimd128Register().V4S(),
@@ -2493,7 +2522,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       SIMD_UNOP_CASE(kArm64S8x8Reverse, Rev64, 16B);
       SIMD_UNOP_CASE(kArm64S8x4Reverse, Rev32, 16B);
       SIMD_UNOP_CASE(kArm64S8x2Reverse, Rev16, 16B);
-    case kArm64S1x2AllTrue: {
+    case kArm64V64x2AllTrue: {
       UseScratchRegisterScope scope(tasm());
       VRegister temp1 = scope.AcquireV(kFormat2D);
       VRegister temp2 = scope.AcquireV(kFormatS);
@@ -2521,32 +2550,32 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kArm64I16x8Load8x8S: {
-      __ ld1(i.OutputSimd128Register().V8B(), i.MemoryOperand(0));
+      __ Ldr(i.OutputSimd128Register().V8B(), i.MemoryOperand(0));
       __ Sxtl(i.OutputSimd128Register().V8H(), i.OutputSimd128Register().V8B());
       break;
     }
     case kArm64I16x8Load8x8U: {
-      __ ld1(i.OutputSimd128Register().V8B(), i.MemoryOperand(0));
+      __ Ldr(i.OutputSimd128Register().V8B(), i.MemoryOperand(0));
       __ Uxtl(i.OutputSimd128Register().V8H(), i.OutputSimd128Register().V8B());
       break;
     }
     case kArm64I32x4Load16x4S: {
-      __ ld1(i.OutputSimd128Register().V4H(), i.MemoryOperand(0));
+      __ Ldr(i.OutputSimd128Register().V4H(), i.MemoryOperand(0));
       __ Sxtl(i.OutputSimd128Register().V4S(), i.OutputSimd128Register().V4H());
       break;
     }
     case kArm64I32x4Load16x4U: {
-      __ ld1(i.OutputSimd128Register().V4H(), i.MemoryOperand(0));
+      __ Ldr(i.OutputSimd128Register().V4H(), i.MemoryOperand(0));
       __ Uxtl(i.OutputSimd128Register().V4S(), i.OutputSimd128Register().V4H());
       break;
     }
     case kArm64I64x2Load32x2S: {
-      __ ld1(i.OutputSimd128Register().V2S(), i.MemoryOperand(0));
+      __ Ldr(i.OutputSimd128Register().V2S(), i.MemoryOperand(0));
       __ Sxtl(i.OutputSimd128Register().V2D(), i.OutputSimd128Register().V2S());
       break;
     }
     case kArm64I64x2Load32x2U: {
-      __ ld1(i.OutputSimd128Register().V2S(), i.MemoryOperand(0));
+      __ Ldr(i.OutputSimd128Register().V2S(), i.MemoryOperand(0));
       __ Uxtl(i.OutputSimd128Register().V2D(), i.OutputSimd128Register().V2S());
       break;
     }
@@ -2561,13 +2590,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     break;                                                 \
   }
       // for AnyTrue, the format does not matter, umaxv does not support 2D
-      SIMD_REDUCE_OP_CASE(kArm64S1x2AnyTrue, Umaxv, kFormatS, 4S);
-      SIMD_REDUCE_OP_CASE(kArm64S1x4AnyTrue, Umaxv, kFormatS, 4S);
-      SIMD_REDUCE_OP_CASE(kArm64S1x4AllTrue, Uminv, kFormatS, 4S);
-      SIMD_REDUCE_OP_CASE(kArm64S1x8AnyTrue, Umaxv, kFormatH, 8H);
-      SIMD_REDUCE_OP_CASE(kArm64S1x8AllTrue, Uminv, kFormatH, 8H);
-      SIMD_REDUCE_OP_CASE(kArm64S1x16AnyTrue, Umaxv, kFormatB, 16B);
-      SIMD_REDUCE_OP_CASE(kArm64S1x16AllTrue, Uminv, kFormatB, 16B);
+      SIMD_REDUCE_OP_CASE(kArm64V64x2AnyTrue, Umaxv, kFormatS, 4S);
+      SIMD_REDUCE_OP_CASE(kArm64V32x4AnyTrue, Umaxv, kFormatS, 4S);
+      SIMD_REDUCE_OP_CASE(kArm64V32x4AllTrue, Uminv, kFormatS, 4S);
+      SIMD_REDUCE_OP_CASE(kArm64V16x8AnyTrue, Umaxv, kFormatH, 8H);
+      SIMD_REDUCE_OP_CASE(kArm64V16x8AllTrue, Uminv, kFormatH, 8H);
+      SIMD_REDUCE_OP_CASE(kArm64V8x16AnyTrue, Umaxv, kFormatB, 16B);
+      SIMD_REDUCE_OP_CASE(kArm64V8x16AllTrue, Uminv, kFormatB, 16B);
   }
   return kSuccess;
 }  // NOLINT(readability/fn_size)
@@ -2575,6 +2604,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
 #undef SIMD_UNOP_CASE
 #undef SIMD_WIDENING_UNOP_CASE
 #undef SIMD_BINOP_CASE
+#undef SIMD_DESTRUCTIVE_BINOP_CASE
 #undef SIMD_REDUCE_OP_CASE
 #undef ASSEMBLE_SIMD_SHIFT_LEFT
 #undef ASSEMBLE_SIMD_SHIFT_RIGHT
@@ -2684,7 +2714,7 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         // Therefore we emit a call to C here instead of a call to the runtime.
         __ CallCFunction(
             ExternalReference::wasm_call_trap_callback_for_testing(), 0);
-        __ LeaveFrame(StackFrame::WASM_COMPILED);
+        __ LeaveFrame(StackFrame::WASM);
         auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
         int pop_count =
             static_cast<int>(call_descriptor->StackParameterCount());
diff --git a/deps/v8/src/compiler/backend/arm64/instruction-codes-arm64.h b/deps/v8/src/compiler/backend/arm64/instruction-codes-arm64.h
index e24812f8844..f77267a4d7f 100644
--- a/deps/v8/src/compiler/backend/arm64/instruction-codes-arm64.h
+++ b/deps/v8/src/compiler/backend/arm64/instruction-codes-arm64.h
@@ -186,6 +186,8 @@ namespace compiler {
   V(Arm64F64x2Le)                           \
   V(Arm64F64x2Qfma)                         \
   V(Arm64F64x2Qfms)                         \
+  V(Arm64F64x2Pmin)                         \
+  V(Arm64F64x2Pmax)                         \
   V(Arm64F32x4Splat)                        \
   V(Arm64F32x4ExtractLane)                  \
   V(Arm64F32x4ReplaceLane)                  \
@@ -209,6 +211,8 @@ namespace compiler {
   V(Arm64F32x4Le)                           \
   V(Arm64F32x4Qfma)                         \
   V(Arm64F32x4Qfms)                         \
+  V(Arm64F32x4Pmin)                         \
+  V(Arm64F32x4Pmax)                         \
   V(Arm64I64x2Splat)                        \
   V(Arm64I64x2ExtractLane)                  \
   V(Arm64I64x2ReplaceLane)                  \
@@ -238,6 +242,8 @@ namespace compiler {
   V(Arm64I32x4AddHoriz)                     \
   V(Arm64I32x4Sub)                          \
   V(Arm64I32x4Mul)                          \
+  V(Arm64I32x4Mla)                          \
+  V(Arm64I32x4Mls)                          \
   V(Arm64I32x4MinS)                         \
   V(Arm64I32x4MaxS)                         \
   V(Arm64I32x4Eq)                           \
@@ -270,6 +276,8 @@ namespace compiler {
   V(Arm64I16x8Sub)                          \
   V(Arm64I16x8SubSaturateS)                 \
   V(Arm64I16x8Mul)                          \
+  V(Arm64I16x8Mla)                          \
+  V(Arm64I16x8Mls)                          \
   V(Arm64I16x8MinS)                         \
   V(Arm64I16x8MaxS)                         \
   V(Arm64I16x8Eq)                           \
@@ -302,6 +310,8 @@ namespace compiler {
   V(Arm64I8x16Sub)                          \
   V(Arm64I8x16SubSaturateS)                 \
   V(Arm64I8x16Mul)                          \
+  V(Arm64I8x16Mla)                          \
+  V(Arm64I8x16Mls)                          \
   V(Arm64I8x16MinS)                         \
   V(Arm64I8x16MaxS)                         \
   V(Arm64I8x16Eq)                           \
@@ -355,14 +365,14 @@ namespace compiler {
   V(Arm64S8x8Reverse)                       \
   V(Arm64S8x4Reverse)                       \
   V(Arm64S8x2Reverse)                       \
-  V(Arm64S1x2AnyTrue)                       \
-  V(Arm64S1x2AllTrue)                       \
-  V(Arm64S1x4AnyTrue)                       \
-  V(Arm64S1x4AllTrue)                       \
-  V(Arm64S1x8AnyTrue)                       \
-  V(Arm64S1x8AllTrue)                       \
-  V(Arm64S1x16AnyTrue)                      \
-  V(Arm64S1x16AllTrue)                      \
+  V(Arm64V64x2AnyTrue)                      \
+  V(Arm64V64x2AllTrue)                      \
+  V(Arm64V32x4AnyTrue)                      \
+  V(Arm64V32x4AllTrue)                      \
+  V(Arm64V16x8AnyTrue)                      \
+  V(Arm64V16x8AllTrue)                      \
+  V(Arm64V8x16AnyTrue)                      \
+  V(Arm64V8x16AllTrue)                      \
   V(Arm64S8x16LoadSplat)                    \
   V(Arm64S16x8LoadSplat)                    \
   V(Arm64S32x4LoadSplat)                    \
diff --git a/deps/v8/src/compiler/backend/arm64/instruction-scheduler-arm64.cc b/deps/v8/src/compiler/backend/arm64/instruction-scheduler-arm64.cc
index 72a0b1b0126..2bdebb455da 100644
--- a/deps/v8/src/compiler/backend/arm64/instruction-scheduler-arm64.cc
+++ b/deps/v8/src/compiler/backend/arm64/instruction-scheduler-arm64.cc
@@ -156,6 +156,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64F64x2Le:
     case kArm64F64x2Qfma:
     case kArm64F64x2Qfms:
+    case kArm64F64x2Pmin:
+    case kArm64F64x2Pmax:
     case kArm64F32x4Splat:
     case kArm64F32x4ExtractLane:
     case kArm64F32x4ReplaceLane:
@@ -179,6 +181,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64F32x4Le:
     case kArm64F32x4Qfma:
     case kArm64F32x4Qfms:
+    case kArm64F32x4Pmin:
+    case kArm64F32x4Pmax:
     case kArm64I64x2Splat:
     case kArm64I64x2ExtractLane:
     case kArm64I64x2ReplaceLane:
@@ -208,6 +212,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64I32x4AddHoriz:
     case kArm64I32x4Sub:
     case kArm64I32x4Mul:
+    case kArm64I32x4Mla:
+    case kArm64I32x4Mls:
     case kArm64I32x4MinS:
     case kArm64I32x4MaxS:
     case kArm64I32x4Eq:
@@ -240,6 +246,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64I16x8Sub:
     case kArm64I16x8SubSaturateS:
     case kArm64I16x8Mul:
+    case kArm64I16x8Mla:
+    case kArm64I16x8Mls:
     case kArm64I16x8MinS:
     case kArm64I16x8MaxS:
     case kArm64I16x8Eq:
@@ -272,6 +280,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64I8x16Sub:
     case kArm64I8x16SubSaturateS:
     case kArm64I8x16Mul:
+    case kArm64I8x16Mla:
+    case kArm64I8x16Mls:
     case kArm64I8x16MinS:
     case kArm64I8x16MaxS:
     case kArm64I8x16Eq:
@@ -325,14 +335,14 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64S8x8Reverse:
     case kArm64S8x4Reverse:
     case kArm64S8x2Reverse:
-    case kArm64S1x2AnyTrue:
-    case kArm64S1x2AllTrue:
-    case kArm64S1x4AnyTrue:
-    case kArm64S1x4AllTrue:
-    case kArm64S1x8AnyTrue:
-    case kArm64S1x8AllTrue:
-    case kArm64S1x16AnyTrue:
-    case kArm64S1x16AllTrue:
+    case kArm64V64x2AnyTrue:
+    case kArm64V64x2AllTrue:
+    case kArm64V32x4AnyTrue:
+    case kArm64V32x4AllTrue:
+    case kArm64V16x8AnyTrue:
+    case kArm64V16x8AllTrue:
+    case kArm64V8x16AnyTrue:
+    case kArm64V8x16AllTrue:
     case kArm64TestAndBranch32:
     case kArm64TestAndBranch:
     case kArm64CompareAndBranch32:
diff --git a/deps/v8/src/compiler/backend/arm64/instruction-selector-arm64.cc b/deps/v8/src/compiler/backend/arm64/instruction-selector-arm64.cc
index bb204f62a68..3a3767ce0a2 100644
--- a/deps/v8/src/compiler/backend/arm64/instruction-selector-arm64.cc
+++ b/deps/v8/src/compiler/backend/arm64/instruction-selector-arm64.cc
@@ -608,18 +608,23 @@ void EmitLoad(InstructionSelector* selector, Node* node, InstructionCode opcode,
 void InstructionSelector::VisitLoadTransform(Node* node) {
   LoadTransformParameters params = LoadTransformParametersOf(node->op());
   InstructionCode opcode = kArchNop;
+  bool require_add = false;
   switch (params.transformation) {
     case LoadTransformation::kS8x16LoadSplat:
       opcode = kArm64S8x16LoadSplat;
+      require_add = true;
       break;
     case LoadTransformation::kS16x8LoadSplat:
       opcode = kArm64S16x8LoadSplat;
+      require_add = true;
       break;
     case LoadTransformation::kS32x4LoadSplat:
       opcode = kArm64S32x4LoadSplat;
+      require_add = true;
       break;
     case LoadTransformation::kS64x2LoadSplat:
       opcode = kArm64S64x2LoadSplat;
+      require_add = true;
       break;
     case LoadTransformation::kI16x8Load8x8S:
       opcode = kArm64I16x8Load8x8S;
@@ -655,13 +660,17 @@ void InstructionSelector::VisitLoadTransform(Node* node) {
   inputs[1] = g.UseRegister(index);
   outputs[0] = g.DefineAsRegister(node);
 
-  // ld1r uses post-index, so construct address first.
-  // TODO(v8:9886) If index can be immediate, use vldr without this add.
-  InstructionOperand addr = g.TempRegister();
-  Emit(kArm64Add, 1, &addr, 2, inputs);
-  inputs[0] = addr;
-  inputs[1] = g.TempImmediate(0);
-  opcode |= AddressingModeField::encode(kMode_MRI);
+  if (require_add) {
+    // ld1r uses post-index, so construct address first.
+    // TODO(v8:9886) If index can be immediate, use vldr without this add.
+    InstructionOperand addr = g.TempRegister();
+    Emit(kArm64Add, 1, &addr, 2, inputs);
+    inputs[0] = addr;
+    inputs[1] = g.TempImmediate(0);
+    opcode |= AddressingModeField::encode(kMode_MRI);
+  } else {
+    opcode |= AddressingModeField::encode(kMode_MRR);
+  }
   Emit(opcode, 1, outputs, 2, inputs);
 }
 
@@ -1301,6 +1310,10 @@ void InstructionSelector::VisitWord64Sar(Node* node) {
   VisitRRO(this, kArm64Asr, node, kShift64Imm);
 }
 
+void InstructionSelector::VisitWord32Rol(Node* node) { UNREACHABLE(); }
+
+void InstructionSelector::VisitWord64Rol(Node* node) { UNREACHABLE(); }
+
 void InstructionSelector::VisitWord32Ror(Node* node) {
   VisitRRO(this, kArm64Ror32, node, kShift32Imm);
 }
@@ -3180,14 +3193,14 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   V(I8x16Neg, kArm64I8x16Neg)                             \
   V(I8x16Abs, kArm64I8x16Abs)                             \
   V(S128Not, kArm64S128Not)                               \
-  V(S1x2AnyTrue, kArm64S1x2AnyTrue)                       \
-  V(S1x2AllTrue, kArm64S1x2AllTrue)                       \
-  V(S1x4AnyTrue, kArm64S1x4AnyTrue)                       \
-  V(S1x4AllTrue, kArm64S1x4AllTrue)                       \
-  V(S1x8AnyTrue, kArm64S1x8AnyTrue)                       \
-  V(S1x8AllTrue, kArm64S1x8AllTrue)                       \
-  V(S1x16AnyTrue, kArm64S1x16AnyTrue)                     \
-  V(S1x16AllTrue, kArm64S1x16AllTrue)
+  V(V64x2AnyTrue, kArm64V64x2AnyTrue)                     \
+  V(V64x2AllTrue, kArm64V64x2AllTrue)                     \
+  V(V32x4AnyTrue, kArm64V32x4AnyTrue)                     \
+  V(V32x4AllTrue, kArm64V32x4AllTrue)                     \
+  V(V16x8AnyTrue, kArm64V16x8AnyTrue)                     \
+  V(V16x8AllTrue, kArm64V16x8AllTrue)                     \
+  V(V8x16AnyTrue, kArm64V8x16AnyTrue)                     \
+  V(V8x16AllTrue, kArm64V8x16AllTrue)
 
 #define SIMD_SHIFT_OP_LIST(V) \
   V(I64x2Shl, 64)             \
@@ -3233,9 +3246,7 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   V(I64x2GeS, kArm64I64x2GeS)                           \
   V(I64x2GtU, kArm64I64x2GtU)                           \
   V(I64x2GeU, kArm64I64x2GeU)                           \
-  V(I32x4Add, kArm64I32x4Add)                           \
   V(I32x4AddHoriz, kArm64I32x4AddHoriz)                 \
-  V(I32x4Sub, kArm64I32x4Sub)                           \
   V(I32x4Mul, kArm64I32x4Mul)                           \
   V(I32x4MinS, kArm64I32x4MinS)                         \
   V(I32x4MaxS, kArm64I32x4MaxS)                         \
@@ -3248,10 +3259,8 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   V(I32x4GtU, kArm64I32x4GtU)                           \
   V(I32x4GeU, kArm64I32x4GeU)                           \
   V(I16x8SConvertI32x4, kArm64I16x8SConvertI32x4)       \
-  V(I16x8Add, kArm64I16x8Add)                           \
   V(I16x8AddSaturateS, kArm64I16x8AddSaturateS)         \
   V(I16x8AddHoriz, kArm64I16x8AddHoriz)                 \
-  V(I16x8Sub, kArm64I16x8Sub)                           \
   V(I16x8SubSaturateS, kArm64I16x8SubSaturateS)         \
   V(I16x8Mul, kArm64I16x8Mul)                           \
   V(I16x8MinS, kArm64I16x8MinS)                         \
@@ -3269,9 +3278,7 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   V(I16x8GeU, kArm64I16x8GeU)                           \
   V(I16x8RoundingAverageU, kArm64I16x8RoundingAverageU) \
   V(I8x16SConvertI16x8, kArm64I8x16SConvertI16x8)       \
-  V(I8x16Add, kArm64I8x16Add)                           \
   V(I8x16AddSaturateS, kArm64I8x16AddSaturateS)         \
-  V(I8x16Sub, kArm64I8x16Sub)                           \
   V(I8x16SubSaturateS, kArm64I8x16SubSaturateS)         \
   V(I8x16Mul, kArm64I8x16Mul)                           \
   V(I8x16MinS, kArm64I8x16MinS)                         \
@@ -3359,6 +3366,52 @@ void InstructionSelector::VisitI64x2Mul(Node* node) {
        arraysize(temps), temps);
 }
 
+#define VISIT_SIMD_ADD(Type)                                                   \
+  void InstructionSelector::Visit##Type##Add(Node* node) {                     \
+    Arm64OperandGenerator g(this);                                             \
+    Node* left = node->InputAt(0);                                             \
+    Node* right = node->InputAt(1);                                            \
+    /* Select Mla(z, x, y) for Add(Mul(x, y), z). */                           \
+    if (left->opcode() == IrOpcode::k##Type##Mul && CanCover(node, left)) {    \
+      Emit(kArm64##Type##Mla, g.DefineSameAsFirst(node), g.UseRegister(right), \
+           g.UseRegister(left->InputAt(0)), g.UseRegister(left->InputAt(1)));  \
+      return;                                                                  \
+    }                                                                          \
+    /* Select Mla(z, x, y) for Add(z, Mul(x, y)). */                           \
+    if (right->opcode() == IrOpcode::k##Type##Mul && CanCover(node, right)) {  \
+      Emit(kArm64##Type##Mla, g.DefineSameAsFirst(node), g.UseRegister(left),  \
+           g.UseRegister(right->InputAt(0)),                                   \
+           g.UseRegister(right->InputAt(1)));                                  \
+      return;                                                                  \
+    }                                                                          \
+    VisitRRR(this, kArm64##Type##Add, node);                                   \
+  }
+
+VISIT_SIMD_ADD(I32x4)
+VISIT_SIMD_ADD(I16x8)
+VISIT_SIMD_ADD(I8x16)
+#undef VISIT_SIMD_ADD
+
+#define VISIT_SIMD_SUB(Type)                                                  \
+  void InstructionSelector::Visit##Type##Sub(Node* node) {                    \
+    Arm64OperandGenerator g(this);                                            \
+    Node* left = node->InputAt(0);                                            \
+    Node* right = node->InputAt(1);                                           \
+    /* Select Mls(z, x, y) for Sub(z, Mul(x, y)). */                          \
+    if (right->opcode() == IrOpcode::k##Type##Mul && CanCover(node, right)) { \
+      Emit(kArm64##Type##Mls, g.DefineSameAsFirst(node), g.UseRegister(left), \
+           g.UseRegister(right->InputAt(0)),                                  \
+           g.UseRegister(right->InputAt(1)));                                 \
+      return;                                                                 \
+    }                                                                         \
+    VisitRRR(this, kArm64##Type##Sub, node);                                  \
+  }
+
+VISIT_SIMD_SUB(I32x4)
+VISIT_SIMD_SUB(I16x8)
+VISIT_SIMD_SUB(I8x16)
+#undef VISIT_SIMD_SUB
+
 void InstructionSelector::VisitS128Select(Node* node) {
   Arm64OperandGenerator g(this);
   Emit(kArm64S128Select, g.DefineSameAsFirst(node),
@@ -3569,6 +3622,34 @@ void InstructionSelector::VisitSignExtendWord32ToInt64(Node* node) {
   VisitRR(this, kArm64Sxtw, node);
 }
 
+namespace {
+void VisitPminOrPmax(InstructionSelector* selector, ArchOpcode opcode,
+                     Node* node) {
+  Arm64OperandGenerator g(selector);
+  // Need all unique registers because we first compare the two inputs, then we
+  // need the inputs to remain unchanged for the bitselect later.
+  selector->Emit(opcode, g.DefineAsRegister(node),
+                 g.UseUniqueRegister(node->InputAt(0)),
+                 g.UseUniqueRegister(node->InputAt(1)));
+}
+}  // namespace
+
+void InstructionSelector::VisitF32x4Pmin(Node* node) {
+  VisitPminOrPmax(this, kArm64F32x4Pmin, node);
+}
+
+void InstructionSelector::VisitF32x4Pmax(Node* node) {
+  VisitPminOrPmax(this, kArm64F32x4Pmax, node);
+}
+
+void InstructionSelector::VisitF64x2Pmin(Node* node) {
+  VisitPminOrPmax(this, kArm64F64x2Pmin, node);
+}
+
+void InstructionSelector::VisitF64x2Pmax(Node* node) {
+  VisitPminOrPmax(this, kArm64F64x2Pmax, node);
+}
+
 // static
 MachineOperatorBuilder::Flags
 InstructionSelector::SupportedMachineOperatorFlags() {
diff --git a/deps/v8/src/compiler/backend/code-generator.cc b/deps/v8/src/compiler/backend/code-generator.cc
index 9dbd5fac333..6b877a29587 100644
--- a/deps/v8/src/compiler/backend/code-generator.cc
+++ b/deps/v8/src/compiler/backend/code-generator.cc
@@ -93,7 +93,6 @@ CodeGenerator::CodeGenerator(
   if (code_kind == Code::WASM_FUNCTION ||
       code_kind == Code::WASM_TO_CAPI_FUNCTION ||
       code_kind == Code::WASM_TO_JS_FUNCTION ||
-      code_kind == Code::WASM_INTERPRETER_ENTRY ||
       code_kind == Code::JS_TO_WASM_FUNCTION) {
     tasm_.set_abort_hard(true);
   }
@@ -499,10 +498,12 @@ MaybeHandle<Code> CodeGenerator::FinalizeCode() {
   MaybeHandle<Code> maybe_code =
       Factory::CodeBuilder(isolate(), desc, info()->code_kind())
           .set_builtin_index(info()->builtin_index())
+          .set_inlined_bytecode_size(info()->inlined_bytecode_size())
           .set_source_position_table(source_positions)
           .set_deoptimization_data(deopt_data)
           .set_is_turbofanned()
           .set_stack_slots(frame()->GetTotalFrameSlotCount())
+          .set_profiler_data(info()->profiler_data())
           .TryBuild();
 
   Handle<Code> code;
@@ -996,8 +997,10 @@ void CodeGenerator::RecordCallPosition(Instruction* instr) {
 }
 
 int CodeGenerator::DefineDeoptimizationLiteral(DeoptimizationLiteral literal) {
+  literal.Validate();
   int result = static_cast<int>(deoptimization_literals_.size());
   for (unsigned i = 0; i < deoptimization_literals_.size(); ++i) {
+    deoptimization_literals_[i].Validate();
     if (deoptimization_literals_[i] == literal) return i;
   }
   deoptimization_literals_.push_back(literal);
@@ -1349,6 +1352,7 @@ OutOfLineCode::OutOfLineCode(CodeGenerator* gen)
 OutOfLineCode::~OutOfLineCode() = default;
 
 Handle<Object> DeoptimizationLiteral::Reify(Isolate* isolate) const {
+  Validate();
   switch (kind_) {
     case DeoptimizationLiteralKind::kObject: {
       return object_;
@@ -1359,6 +1363,9 @@ Handle<Object> DeoptimizationLiteral::Reify(Isolate* isolate) const {
     case DeoptimizationLiteralKind::kString: {
       return string_->AllocateStringConstant(isolate);
     }
+    case DeoptimizationLiteralKind::kInvalid: {
+      UNREACHABLE();
+    }
   }
   UNREACHABLE();
 }
diff --git a/deps/v8/src/compiler/backend/code-generator.h b/deps/v8/src/compiler/backend/code-generator.h
index 0caefddd970..f9f410dd39f 100644
--- a/deps/v8/src/compiler/backend/code-generator.h
+++ b/deps/v8/src/compiler/backend/code-generator.h
@@ -51,12 +51,16 @@ class InstructionOperandIterator {
   size_t pos_;
 };
 
-enum class DeoptimizationLiteralKind { kObject, kNumber, kString };
+enum class DeoptimizationLiteralKind { kObject, kNumber, kString, kInvalid };
 
 // Either a non-null Handle<Object>, a double or a StringConstantBase.
 class DeoptimizationLiteral {
  public:
-  DeoptimizationLiteral() : object_(), number_(0), string_(nullptr) {}
+  DeoptimizationLiteral()
+      : kind_(DeoptimizationLiteralKind::kInvalid),
+        object_(),
+        number_(0),
+        string_(nullptr) {}
   explicit DeoptimizationLiteral(Handle<Object> object)
       : kind_(DeoptimizationLiteralKind::kObject), object_(object) {
     CHECK(!object_.is_null());
@@ -77,7 +81,14 @@ class DeoptimizationLiteral {
 
   Handle<Object> Reify(Isolate* isolate) const;
 
-  DeoptimizationLiteralKind kind() const { return kind_; }
+  void Validate() const {
+    CHECK_NE(kind_, DeoptimizationLiteralKind::kInvalid);
+  }
+
+  DeoptimizationLiteralKind kind() const {
+    Validate();
+    return kind_;
+  }
 
  private:
   DeoptimizationLiteralKind kind_;
diff --git a/deps/v8/src/compiler/backend/ia32/code-generator-ia32.cc b/deps/v8/src/compiler/backend/ia32/code-generator-ia32.cc
index d397ba82415..cefc806dbf1 100644
--- a/deps/v8/src/compiler/backend/ia32/code-generator-ia32.cc
+++ b/deps/v8/src/compiler/backend/ia32/code-generator-ia32.cc
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/compiler/backend/code-generator.h"
-
 #include "src/base/overflowing-math.h"
 #include "src/codegen/assembler-inl.h"
 #include "src/codegen/callable.h"
@@ -11,12 +9,13 @@
 #include "src/codegen/macro-assembler.h"
 #include "src/codegen/optimized-compilation-info.h"
 #include "src/compiler/backend/code-generator-impl.h"
+#include "src/compiler/backend/code-generator.h"
 #include "src/compiler/backend/gap-resolver.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/osr.h"
 #include "src/execution/frame-constants.h"
 #include "src/execution/frames.h"
-#include "src/heap/heap-inl.h"  // crbug.com/v8/8499
+#include "src/heap/memory-chunk.h"
 #include "src/objects/smi.h"
 #include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-objects.h"
@@ -493,20 +492,21 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
     __ cmov(zero, dst, tmp);                         \
   } while (false)
 
-#define ASSEMBLE_SIMD_SHIFT(opcode, width)                          \
-  do {                                                              \
-    XMMRegister dst = i.OutputSimd128Register();                    \
-    DCHECK_EQ(dst, i.InputSimd128Register(0));                      \
-    if (HasImmediateInput(instr, 1)) {                              \
-      __ opcode(dst, dst, static_cast<byte>(i.InputInt##width(1))); \
-    } else {                                                        \
-      XMMRegister tmp = i.TempSimd128Register(0);                   \
-      Register shift = i.InputRegister(1);                          \
-      constexpr int mask = (1 << width) - 1;                        \
-      __ and_(shift, Immediate(mask));                              \
-      __ Movd(tmp, shift);                                          \
-      __ opcode(dst, dst, tmp);                                     \
-    }                                                               \
+#define ASSEMBLE_SIMD_SHIFT(opcode, width)             \
+  do {                                                 \
+    XMMRegister dst = i.OutputSimd128Register();       \
+    DCHECK_EQ(dst, i.InputSimd128Register(0));         \
+    if (HasImmediateInput(instr, 1)) {                 \
+      __ opcode(dst, dst, byte{i.InputInt##width(1)}); \
+    } else {                                           \
+      XMMRegister tmp = i.TempSimd128Register(0);      \
+      Register tmp_shift = i.TempRegister(1);          \
+      constexpr int mask = (1 << width) - 1;           \
+      __ mov(tmp_shift, i.InputRegister(1));           \
+      __ and_(tmp_shift, Immediate(mask));             \
+      __ Movd(tmp, tmp_shift);                         \
+      __ opcode(dst, dst, tmp);                        \
+    }                                                  \
   } while (false)
 
 void CodeGenerator::AssembleDeconstructFrame() {
@@ -1234,6 +1234,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ SarPair_cl(i.InputRegister(1), i.InputRegister(0));
       }
       break;
+    case kIA32Rol:
+      if (HasImmediateInput(instr, 1)) {
+        __ rol(i.OutputOperand(), i.InputInt5(1));
+      } else {
+        __ rol_cl(i.OutputOperand());
+      }
+      break;
     case kIA32Ror:
       if (HasImmediateInput(instr, 1)) {
         __ ror(i.OutputOperand(), i.InputInt5(1));
@@ -2013,6 +2020,18 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                  i.InputOperand(1));
       break;
     }
+    case kIA32F64x2Pmin: {
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      __ Minpd(dst, dst, i.InputSimd128Register(1));
+      break;
+    }
+    case kIA32F64x2Pmax: {
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      __ Maxpd(dst, dst, i.InputSimd128Register(1));
+      break;
+    }
     case kIA32I64x2SplatI32Pair: {
       XMMRegister dst = i.OutputSimd128Register();
       __ Pinsrd(dst, i.InputRegister(0), 0);
@@ -2224,12 +2243,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kSSEF32x4Sqrt: {
-      __ sqrtps(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      __ sqrtps(i.OutputSimd128Register(), i.InputOperand(0));
       break;
     }
     case kAVXF32x4Sqrt: {
       CpuFeatureScope avx_scope(tasm(), AVX);
-      __ vsqrtps(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      __ vsqrtps(i.OutputSimd128Register(), i.InputOperand(0));
       break;
     }
     case kIA32F32x4RecipApprox: {
@@ -2317,11 +2336,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kAVXF32x4Min: {
       CpuFeatureScope avx_scope(tasm(), AVX);
       XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src0 = i.InputSimd128Register(0);
       Operand src1 = i.InputOperand(1);
       // See comment above for correction of minps.
       __ movups(kScratchDoubleReg, src1);
       __ vminps(kScratchDoubleReg, kScratchDoubleReg, dst);
-      __ vminps(dst, dst, src1);
+      __ vminps(dst, src0, src1);
       __ vorps(dst, dst, kScratchDoubleReg);
       __ vcmpneqps(kScratchDoubleReg, dst, dst);
       __ vorps(dst, dst, kScratchDoubleReg);
@@ -2410,6 +2430,18 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                   i.InputOperand(1));
       break;
     }
+    case kIA32F32x4Pmin: {
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      __ Minps(dst, dst, i.InputSimd128Register(1));
+      break;
+    }
+    case kIA32F32x4Pmax: {
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      __ Maxps(dst, dst, i.InputSimd128Register(1));
+      break;
+    }
     case kIA32I32x4Splat: {
       XMMRegister dst = i.OutputSimd128Register();
       __ Movd(dst, i.InputOperand(0));
@@ -2759,6 +2791,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Pabsd(i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
     }
+    case kIA32I32x4BitMask: {
+      __ Movmskps(i.OutputRegister(), i.InputSimd128Register(0));
+      break;
+    }
     case kIA32I16x8Splat: {
       XMMRegister dst = i.OutputSimd128Register();
       __ Movd(dst, i.InputOperand(0));
@@ -3093,6 +3129,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Pabsw(i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
     }
+    case kIA32I16x8BitMask: {
+      Register dst = i.OutputRegister();
+      XMMRegister tmp = i.TempSimd128Register(0);
+      __ Packsswb(tmp, i.InputSimd128Register(0));
+      __ Pmovmskb(dst, tmp);
+      __ shr(dst, 8);
+      break;
+    }
     case kIA32I8x16Splat: {
       XMMRegister dst = i.OutputSimd128Register();
       __ Movd(dst, i.InputOperand(0));
@@ -3155,7 +3199,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       if (HasImmediateInput(instr, 1)) {
         // Perform 16-bit shift, then mask away low bits.
         uint8_t shift = i.InputInt3(1);
-        __ Psllw(dst, dst, static_cast<byte>(shift));
+        __ Psllw(dst, dst, byte{shift});
 
         uint8_t bmask = static_cast<uint8_t>(0xff << shift);
         uint32_t mask = bmask << 24 | bmask << 16 | bmask << 8 | bmask;
@@ -3164,18 +3208,20 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ Pshufd(tmp_simd, tmp_simd, 0);
         __ Pand(dst, tmp_simd);
       } else {
-        Register shift = i.InputRegister(1);
         // Take shift value modulo 8.
-        __ and_(shift, 7);
+        __ mov(tmp, i.InputRegister(1));
+        __ and_(tmp, 7);
         // Mask off the unwanted bits before word-shifting.
         __ Pcmpeqw(kScratchDoubleReg, kScratchDoubleReg);
-        __ mov(tmp, shift);
         __ add(tmp, Immediate(8));
         __ Movd(tmp_simd, tmp);
         __ Psrlw(kScratchDoubleReg, kScratchDoubleReg, tmp_simd);
         __ Packuswb(kScratchDoubleReg, kScratchDoubleReg);
         __ Pand(dst, kScratchDoubleReg);
-        __ Movd(tmp_simd, shift);
+        // TODO(zhin): sub here to avoid asking for another temporary register,
+        // examine codegen for other i8x16 shifts, they use less instructions.
+        __ sub(tmp, Immediate(8));
+        __ Movd(tmp_simd, tmp);
         __ Psllw(dst, dst, tmp_simd);
       }
       break;
@@ -3454,7 +3500,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       if (HasImmediateInput(instr, 1)) {
         // Perform 16-bit shift, then mask away high bits.
         uint8_t shift = i.InputInt3(1);
-        __ Psrlw(dst, dst, static_cast<byte>(shift));
+        __ Psrlw(dst, dst, byte{shift});
 
         uint8_t bmask = 0xff >> shift;
         uint32_t mask = bmask << 24 | bmask << 16 | bmask << 8 | bmask;
@@ -3546,6 +3592,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Pabsb(i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
     }
+    case kIA32I8x16BitMask: {
+      __ Pmovmskb(i.OutputRegister(), i.InputSimd128Register(0));
+      break;
+    }
     case kIA32S128Zero: {
       XMMRegister dst = i.OutputSimd128Register();
       __ Pxor(dst, dst);
@@ -3696,7 +3746,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kIA32S16x8LoadSplat: {
       __ Pinsrw(i.OutputSimd128Register(), i.MemoryOperand(), 0);
       __ Pshuflw(i.OutputSimd128Register(), i.OutputSimd128Register(),
-                 static_cast<uint8_t>(0));
+                 uint8_t{0});
       __ Punpcklqdq(i.OutputSimd128Register(), i.OutputSimd128Register());
       break;
     }
@@ -4044,9 +4094,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ vpor(dst, dst, kScratchDoubleReg);
       break;
     }
-    case kIA32S1x4AnyTrue:
-    case kIA32S1x8AnyTrue:
-    case kIA32S1x16AnyTrue: {
+    case kIA32V32x4AnyTrue:
+    case kIA32V16x8AnyTrue:
+    case kIA32V8x16AnyTrue: {
       Register dst = i.OutputRegister();
       XMMRegister src = i.InputSimd128Register(0);
       Register tmp = i.TempRegister(0);
@@ -4060,13 +4110,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     // comparison instruction used matters, e.g. given 0xff00, pcmpeqb returns
     // 0x0011, pcmpeqw returns 0x0000, ptest will set ZF to 0 and 1
     // respectively.
-    case kIA32S1x4AllTrue:
+    case kIA32V32x4AllTrue:
       ASSEMBLE_SIMD_ALL_TRUE(Pcmpeqd);
       break;
-    case kIA32S1x8AllTrue:
+    case kIA32V16x8AllTrue:
       ASSEMBLE_SIMD_ALL_TRUE(pcmpeqw);
       break;
-    case kIA32S1x16AllTrue: {
+    case kIA32V8x16AllTrue: {
       ASSEMBLE_SIMD_ALL_TRUE(pcmpeqb);
       break;
     }
@@ -4354,7 +4404,7 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         __ PrepareCallCFunction(0, esi);
         __ CallCFunction(
             ExternalReference::wasm_call_trap_callback_for_testing(), 0);
-        __ LeaveFrame(StackFrame::WASM_COMPILED);
+        __ LeaveFrame(StackFrame::WASM);
         auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
         size_t pop_size =
             call_descriptor->StackParameterCount() * kSystemPointerSize;
diff --git a/deps/v8/src/compiler/backend/ia32/instruction-codes-ia32.h b/deps/v8/src/compiler/backend/ia32/instruction-codes-ia32.h
index b4c90e27117..58f3ef02e53 100644
--- a/deps/v8/src/compiler/backend/ia32/instruction-codes-ia32.h
+++ b/deps/v8/src/compiler/backend/ia32/instruction-codes-ia32.h
@@ -39,6 +39,7 @@ namespace compiler {
   V(IA32ShlPair)                   \
   V(IA32ShrPair)                   \
   V(IA32SarPair)                   \
+  V(IA32Rol)                       \
   V(IA32Ror)                       \
   V(IA32Lzcnt)                     \
   V(IA32Tzcnt)                     \
@@ -133,6 +134,8 @@ namespace compiler {
   V(IA32F64x2Ne)                   \
   V(IA32F64x2Lt)                   \
   V(IA32F64x2Le)                   \
+  V(IA32F64x2Pmin)                 \
+  V(IA32F64x2Pmax)                 \
   V(IA32I64x2SplatI32Pair)         \
   V(IA32I64x2ReplaceLaneI32Pair)   \
   V(IA32I64x2Neg)                  \
@@ -181,6 +184,8 @@ namespace compiler {
   V(AVXF32x4Lt)                    \
   V(SSEF32x4Le)                    \
   V(AVXF32x4Le)                    \
+  V(IA32F32x4Pmin)                 \
+  V(IA32F32x4Pmax)                 \
   V(IA32I32x4Splat)                \
   V(IA32I32x4ExtractLane)          \
   V(SSEI32x4ReplaceLane)           \
@@ -226,6 +231,7 @@ namespace compiler {
   V(SSEI32x4GeU)                   \
   V(AVXI32x4GeU)                   \
   V(IA32I32x4Abs)                  \
+  V(IA32I32x4BitMask)              \
   V(IA32I16x8Splat)                \
   V(IA32I16x8ExtractLaneU)         \
   V(IA32I16x8ExtractLaneS)         \
@@ -281,6 +287,7 @@ namespace compiler {
   V(AVXI16x8GeU)                   \
   V(IA32I16x8RoundingAverageU)     \
   V(IA32I16x8Abs)                  \
+  V(IA32I16x8BitMask)              \
   V(IA32I8x16Splat)                \
   V(IA32I8x16ExtractLaneU)         \
   V(IA32I8x16ExtractLaneS)         \
@@ -330,6 +337,7 @@ namespace compiler {
   V(AVXI8x16GeU)                   \
   V(IA32I8x16RoundingAverageU)     \
   V(IA32I8x16Abs)                  \
+  V(IA32I8x16BitMask)              \
   V(IA32S128Zero)                  \
   V(SSES128Not)                    \
   V(AVXS128Not)                    \
@@ -388,12 +396,12 @@ namespace compiler {
   V(AVXS8x4Reverse)                \
   V(SSES8x2Reverse)                \
   V(AVXS8x2Reverse)                \
-  V(IA32S1x4AnyTrue)               \
-  V(IA32S1x4AllTrue)               \
-  V(IA32S1x8AnyTrue)               \
-  V(IA32S1x8AllTrue)               \
-  V(IA32S1x16AnyTrue)              \
-  V(IA32S1x16AllTrue)              \
+  V(IA32V32x4AnyTrue)              \
+  V(IA32V32x4AllTrue)              \
+  V(IA32V16x8AnyTrue)              \
+  V(IA32V16x8AllTrue)              \
+  V(IA32V8x16AnyTrue)              \
+  V(IA32V8x16AllTrue)              \
   V(IA32Word32AtomicPairLoad)      \
   V(IA32Word32AtomicPairStore)     \
   V(IA32Word32AtomicPairAdd)       \
diff --git a/deps/v8/src/compiler/backend/ia32/instruction-scheduler-ia32.cc b/deps/v8/src/compiler/backend/ia32/instruction-scheduler-ia32.cc
index 020136403a9..152690c1a30 100644
--- a/deps/v8/src/compiler/backend/ia32/instruction-scheduler-ia32.cc
+++ b/deps/v8/src/compiler/backend/ia32/instruction-scheduler-ia32.cc
@@ -38,6 +38,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kIA32ShlPair:
     case kIA32ShrPair:
     case kIA32SarPair:
+    case kIA32Rol:
     case kIA32Ror:
     case kIA32Lzcnt:
     case kIA32Tzcnt:
@@ -114,6 +115,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kIA32F64x2Ne:
     case kIA32F64x2Lt:
     case kIA32F64x2Le:
+    case kIA32F64x2Pmin:
+    case kIA32F64x2Pmax:
     case kIA32I64x2SplatI32Pair:
     case kIA32I64x2ReplaceLaneI32Pair:
     case kIA32I64x2Neg:
@@ -162,6 +165,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kAVXF32x4Lt:
     case kSSEF32x4Le:
     case kAVXF32x4Le:
+    case kIA32F32x4Pmin:
+    case kIA32F32x4Pmax:
     case kIA32I32x4Splat:
     case kIA32I32x4ExtractLane:
     case kSSEI32x4ReplaceLane:
@@ -207,6 +212,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kSSEI32x4GeU:
     case kAVXI32x4GeU:
     case kIA32I32x4Abs:
+    case kIA32I32x4BitMask:
     case kIA32I16x8Splat:
     case kIA32I16x8ExtractLaneU:
     case kIA32I16x8ExtractLaneS:
@@ -262,6 +268,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kAVXI16x8GeU:
     case kIA32I16x8RoundingAverageU:
     case kIA32I16x8Abs:
+    case kIA32I16x8BitMask:
     case kIA32I8x16Splat:
     case kIA32I8x16ExtractLaneU:
     case kIA32I8x16ExtractLaneS:
@@ -311,6 +318,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kAVXI8x16GeU:
     case kIA32I8x16RoundingAverageU:
     case kIA32I8x16Abs:
+    case kIA32I8x16BitMask:
     case kIA32S128Zero:
     case kSSES128Not:
     case kAVXS128Not:
@@ -359,12 +367,12 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kAVXS8x4Reverse:
     case kSSES8x2Reverse:
     case kAVXS8x2Reverse:
-    case kIA32S1x4AnyTrue:
-    case kIA32S1x4AllTrue:
-    case kIA32S1x8AnyTrue:
-    case kIA32S1x8AllTrue:
-    case kIA32S1x16AnyTrue:
-    case kIA32S1x16AllTrue:
+    case kIA32V32x4AnyTrue:
+    case kIA32V32x4AllTrue:
+    case kIA32V16x8AnyTrue:
+    case kIA32V16x8AllTrue:
+    case kIA32V8x16AnyTrue:
+    case kIA32V8x16AllTrue:
       return (instr->addressing_mode() == kMode_None)
                  ? kNoOpcodeFlags
                  : kIsLoadOperation | kHasSideEffect;
diff --git a/deps/v8/src/compiler/backend/ia32/instruction-selector-ia32.cc b/deps/v8/src/compiler/backend/ia32/instruction-selector-ia32.cc
index 36a70c8fa89..a5a1864827f 100644
--- a/deps/v8/src/compiler/backend/ia32/instruction-selector-ia32.cc
+++ b/deps/v8/src/compiler/backend/ia32/instruction-selector-ia32.cc
@@ -314,7 +314,7 @@ void VisitRROSimdShift(InstructionSelector* selector, Node* node,
   } else {
     InstructionOperand operand0 = g.UseUniqueRegister(node->InputAt(0));
     InstructionOperand operand1 = g.UseUniqueRegister(node->InputAt(1));
-    InstructionOperand temps[] = {g.TempSimd128Register()};
+    InstructionOperand temps[] = {g.TempSimd128Register(), g.TempRegister()};
     selector->Emit(opcode, g.DefineSameAsFirst(node), operand0, operand1,
                    arraysize(temps), temps);
   }
@@ -895,6 +895,10 @@ void InstructionSelector::VisitWord32PairSar(Node* node) {
   VisitWord32PairShift(this, kIA32SarPair, node);
 }
 
+void InstructionSelector::VisitWord32Rol(Node* node) {
+  VisitShift(this, node, kIA32Rol);
+}
+
 void InstructionSelector::VisitWord32Ror(Node* node) {
   VisitShift(this, node, kIA32Ror);
 }
@@ -2109,6 +2113,7 @@ void InstructionSelector::VisitWord32AtomicPairCompareExchange(Node* node) {
   V(I32x4UConvertI16x8Low)  \
   V(I32x4UConvertI16x8High) \
   V(I32x4Abs)               \
+  V(I32x4BitMask)           \
   V(I16x8SConvertI8x16Low)  \
   V(I16x8SConvertI8x16High) \
   V(I16x8Neg)               \
@@ -2116,7 +2121,8 @@ void InstructionSelector::VisitWord32AtomicPairCompareExchange(Node* node) {
   V(I16x8UConvertI8x16High) \
   V(I16x8Abs)               \
   V(I8x16Neg)               \
-  V(I8x16Abs)
+  V(I8x16Abs)               \
+  V(I8x16BitMask)
 
 #define SIMD_UNOP_PREFIX_LIST(V) \
   V(F32x4Abs)                    \
@@ -2125,14 +2131,14 @@ void InstructionSelector::VisitWord32AtomicPairCompareExchange(Node* node) {
   V(S128Not)
 
 #define SIMD_ANYTRUE_LIST(V) \
-  V(S1x4AnyTrue)             \
-  V(S1x8AnyTrue)             \
-  V(S1x16AnyTrue)
+  V(V32x4AnyTrue)            \
+  V(V16x8AnyTrue)            \
+  V(V8x16AnyTrue)
 
 #define SIMD_ALLTRUE_LIST(V) \
-  V(S1x4AllTrue)             \
-  V(S1x8AllTrue)             \
-  V(S1x16AllTrue)
+  V(V32x4AllTrue)            \
+  V(V16x8AllTrue)            \
+  V(V8x16AllTrue)
 
 #define SIMD_SHIFT_OPCODES_UNIFED_SSE_AVX(V) \
   V(I64x2Shl)                                \
@@ -2401,7 +2407,7 @@ SIMD_ANYTRUE_LIST(VISIT_SIMD_ANYTRUE)
     IA32OperandGenerator g(this);                                             \
     InstructionOperand temps[] = {g.TempRegister(), g.TempSimd128Register()}; \
     Emit(kIA32##Opcode, g.DefineAsRegister(node),                             \
-         g.UseUnique(node->InputAt(0)), arraysize(temps), temps);             \
+         g.UseUniqueRegister(node->InputAt(0)), arraysize(temps), temps);     \
   }
 SIMD_ALLTRUE_LIST(VISIT_SIMD_ALLTRUE)
 #undef VISIT_SIMD_ALLTRUE
@@ -2439,6 +2445,13 @@ void InstructionSelector::VisitI16x8UConvertI32x4(Node* node) {
   VisitPack(this, node, kAVXI16x8UConvertI32x4, kSSEI16x8UConvertI32x4);
 }
 
+void InstructionSelector::VisitI16x8BitMask(Node* node) {
+  IA32OperandGenerator g(this);
+  InstructionOperand temps[] = {g.TempSimd128Register()};
+  Emit(kIA32I16x8BitMask, g.DefineAsRegister(node),
+       g.UseUniqueRegister(node->InputAt(0)), arraysize(temps), temps);
+}
+
 void InstructionSelector::VisitI8x16UConvertI16x8(Node* node) {
   VisitPack(this, node, kAVXI8x16UConvertI16x8, kSSEI8x16UConvertI16x8);
 }
@@ -2797,12 +2810,40 @@ void InstructionSelector::VisitS8x16Swizzle(Node* node) {
        arraysize(temps), temps);
 }
 
+namespace {
+void VisitPminOrPmax(InstructionSelector* selector, Node* node,
+                     ArchOpcode opcode) {
+  // Due to the way minps/minpd work, we want the dst to be same as the second
+  // input: b = pmin(a, b) directly maps to minps b a.
+  IA32OperandGenerator g(selector);
+  selector->Emit(opcode, g.DefineSameAsFirst(node),
+                 g.UseRegister(node->InputAt(1)),
+                 g.UseRegister(node->InputAt(0)));
+}
+}  // namespace
+
+void InstructionSelector::VisitF32x4Pmin(Node* node) {
+  VisitPminOrPmax(this, node, kIA32F32x4Pmin);
+}
+
+void InstructionSelector::VisitF32x4Pmax(Node* node) {
+  VisitPminOrPmax(this, node, kIA32F32x4Pmax);
+}
+
+void InstructionSelector::VisitF64x2Pmin(Node* node) {
+  VisitPminOrPmax(this, node, kIA32F64x2Pmin);
+}
+
+void InstructionSelector::VisitF64x2Pmax(Node* node) {
+  VisitPminOrPmax(this, node, kIA32F64x2Pmax);
+}
+
 // static
 MachineOperatorBuilder::Flags
 InstructionSelector::SupportedMachineOperatorFlags() {
   MachineOperatorBuilder::Flags flags =
       MachineOperatorBuilder::kWord32ShiftIsSafe |
-      MachineOperatorBuilder::kWord32Ctz;
+      MachineOperatorBuilder::kWord32Ctz | MachineOperatorBuilder::kWord32Rol;
   if (CpuFeatures::IsSupported(POPCNT)) {
     flags |= MachineOperatorBuilder::kWord32Popcnt;
   }
diff --git a/deps/v8/src/compiler/backend/instruction-selector-impl.h b/deps/v8/src/compiler/backend/instruction-selector-impl.h
index aa7da85e42b..7e1f183fb71 100644
--- a/deps/v8/src/compiler/backend/instruction-selector-impl.h
+++ b/deps/v8/src/compiler/backend/instruction-selector-impl.h
@@ -356,6 +356,8 @@ class OperandGenerator {
           case MachineRepresentation::kCompressed:
           case MachineRepresentation::kCompressedPointer:
             return Constant(static_cast<int32_t>(0));
+          case MachineRepresentation::kWord64:
+            return Constant(static_cast<int64_t>(0));
           case MachineRepresentation::kFloat64:
             return Constant(static_cast<double>(0));
           case MachineRepresentation::kFloat32:
diff --git a/deps/v8/src/compiler/backend/instruction-selector.cc b/deps/v8/src/compiler/backend/instruction-selector.cc
index 7d72dbbf2d0..7f6354d2d15 100644
--- a/deps/v8/src/compiler/backend/instruction-selector.cc
+++ b/deps/v8/src/compiler/backend/instruction-selector.cc
@@ -12,6 +12,7 @@
 #include "src/compiler/backend/instruction-selector-impl.h"
 #include "src/compiler/compiler-source-position-table.h"
 #include "src/compiler/node-matchers.h"
+#include "src/compiler/node-properties.h"
 #include "src/compiler/pipeline.h"
 #include "src/compiler/schedule.h"
 #include "src/compiler/state-values-utils.h"
@@ -1042,7 +1043,8 @@ void InstructionSelector::InitializeCallBuffer(Node* call, CallBuffer* buffer,
     InstructionOperand op = g.UseLocation(*iter, location);
     UnallocatedOperand unallocated = UnallocatedOperand::cast(op);
     if (unallocated.HasFixedSlotPolicy() && !call_tail) {
-      int stack_index = -unallocated.fixed_slot_index() - 1;
+      int stack_index = buffer->descriptor->GetStackIndexFromSlot(
+          unallocated.fixed_slot_index());
       // This can insert empty slots before stack_index and will insert enough
       // slots after stack_index to store the parameter.
       if (static_cast<size_t>(stack_index) >= buffer->pushed_nodes.size()) {
@@ -1416,6 +1418,8 @@ void InstructionSelector::VisitNode(Node* node) {
       return MarkAsWord32(node), VisitWord32Shr(node);
     case IrOpcode::kWord32Sar:
       return MarkAsWord32(node), VisitWord32Sar(node);
+    case IrOpcode::kWord32Rol:
+      return MarkAsWord32(node), VisitWord32Rol(node);
     case IrOpcode::kWord32Ror:
       return MarkAsWord32(node), VisitWord32Ror(node);
     case IrOpcode::kWord32Equal:
@@ -1446,6 +1450,8 @@ void InstructionSelector::VisitNode(Node* node) {
       return MarkAsWord64(node), VisitWord64Shr(node);
     case IrOpcode::kWord64Sar:
       return MarkAsWord64(node), VisitWord64Sar(node);
+    case IrOpcode::kWord64Rol:
+      return MarkAsWord64(node), VisitWord64Rol(node);
     case IrOpcode::kWord64Ror:
       return MarkAsWord64(node), VisitWord64Ror(node);
     case IrOpcode::kWord64Clz:
@@ -1879,6 +1885,10 @@ void InstructionSelector::VisitNode(Node* node) {
       return MarkAsSimd128(node), VisitF64x2Qfma(node);
     case IrOpcode::kF64x2Qfms:
       return MarkAsSimd128(node), VisitF64x2Qfms(node);
+    case IrOpcode::kF64x2Pmin:
+      return MarkAsSimd128(node), VisitF64x2Pmin(node);
+    case IrOpcode::kF64x2Pmax:
+      return MarkAsSimd128(node), VisitF64x2Pmax(node);
     case IrOpcode::kF32x4Splat:
       return MarkAsSimd128(node), VisitF32x4Splat(node);
     case IrOpcode::kF32x4ExtractLane:
@@ -1925,6 +1935,18 @@ void InstructionSelector::VisitNode(Node* node) {
       return MarkAsSimd128(node), VisitF32x4Qfma(node);
     case IrOpcode::kF32x4Qfms:
       return MarkAsSimd128(node), VisitF32x4Qfms(node);
+    case IrOpcode::kF32x4Pmin:
+      return MarkAsSimd128(node), VisitF32x4Pmin(node);
+    case IrOpcode::kF32x4Pmax:
+      return MarkAsSimd128(node), VisitF32x4Pmax(node);
+    case IrOpcode::kF32x4Ceil:
+      return MarkAsSimd128(node), VisitF32x4Ceil(node);
+    case IrOpcode::kF32x4Floor:
+      return MarkAsSimd128(node), VisitF32x4Floor(node);
+    case IrOpcode::kF32x4Trunc:
+      return MarkAsSimd128(node), VisitF32x4Trunc(node);
+    case IrOpcode::kF32x4NearestInt:
+      return MarkAsSimd128(node), VisitF32x4NearestInt(node);
     case IrOpcode::kI64x2Splat:
       return MarkAsSimd128(node), VisitI64x2Splat(node);
     case IrOpcode::kI64x2SplatI32Pair:
@@ -2175,22 +2197,22 @@ void InstructionSelector::VisitNode(Node* node) {
       return MarkAsSimd128(node), VisitS8x16Swizzle(node);
     case IrOpcode::kS8x16Shuffle:
       return MarkAsSimd128(node), VisitS8x16Shuffle(node);
-    case IrOpcode::kS1x2AnyTrue:
-      return MarkAsWord32(node), VisitS1x2AnyTrue(node);
-    case IrOpcode::kS1x2AllTrue:
-      return MarkAsWord32(node), VisitS1x2AllTrue(node);
-    case IrOpcode::kS1x4AnyTrue:
-      return MarkAsWord32(node), VisitS1x4AnyTrue(node);
-    case IrOpcode::kS1x4AllTrue:
-      return MarkAsWord32(node), VisitS1x4AllTrue(node);
-    case IrOpcode::kS1x8AnyTrue:
-      return MarkAsWord32(node), VisitS1x8AnyTrue(node);
-    case IrOpcode::kS1x8AllTrue:
-      return MarkAsWord32(node), VisitS1x8AllTrue(node);
-    case IrOpcode::kS1x16AnyTrue:
-      return MarkAsWord32(node), VisitS1x16AnyTrue(node);
-    case IrOpcode::kS1x16AllTrue:
-      return MarkAsWord32(node), VisitS1x16AllTrue(node);
+    case IrOpcode::kV64x2AnyTrue:
+      return MarkAsWord32(node), VisitV64x2AnyTrue(node);
+    case IrOpcode::kV64x2AllTrue:
+      return MarkAsWord32(node), VisitV64x2AllTrue(node);
+    case IrOpcode::kV32x4AnyTrue:
+      return MarkAsWord32(node), VisitV32x4AnyTrue(node);
+    case IrOpcode::kV32x4AllTrue:
+      return MarkAsWord32(node), VisitV32x4AllTrue(node);
+    case IrOpcode::kV16x8AnyTrue:
+      return MarkAsWord32(node), VisitV16x8AnyTrue(node);
+    case IrOpcode::kV16x8AllTrue:
+      return MarkAsWord32(node), VisitV16x8AllTrue(node);
+    case IrOpcode::kV8x16AnyTrue:
+      return MarkAsWord32(node), VisitV8x16AnyTrue(node);
+    case IrOpcode::kV8x16AllTrue:
+      return MarkAsWord32(node), VisitV8x16AllTrue(node);
     default:
       FATAL("Unexpected operator #%d:%s @ node #%d", node->opcode(),
             node->op()->mnemonic(), node->id());
@@ -2386,6 +2408,8 @@ void InstructionSelector::VisitWord64Shr(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitWord64Sar(Node* node) { UNIMPLEMENTED(); }
 
+void InstructionSelector::VisitWord64Rol(Node* node) { UNIMPLEMENTED(); }
+
 void InstructionSelector::VisitWord64Ror(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitWord64Clz(Node* node) { UNIMPLEMENTED(); }
@@ -2612,17 +2636,19 @@ void InstructionSelector::VisitI64x2ReplaceLaneI32Pair(Node* node) {
 
 #if !V8_TARGET_ARCH_X64 && !V8_TARGET_ARCH_S390X
 #if !V8_TARGET_ARCH_ARM64
+#if !V8_TARGET_ARCH_MIPS64
 void InstructionSelector::VisitI64x2Splat(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI64x2ExtractLane(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI64x2ReplaceLane(Node* node) { UNIMPLEMENTED(); }
+#endif  // !V8_TARGET_ARCH_MIPS64
 void InstructionSelector::VisitI64x2Eq(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI64x2Ne(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI64x2GtS(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI64x2GeS(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI64x2GtU(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI64x2GeU(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitS1x2AnyTrue(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitS1x2AllTrue(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitV64x2AnyTrue(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitV64x2AllTrue(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitF64x2Qfma(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitF64x2Qfms(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitF32x4Qfma(Node* node) { UNIMPLEMENTED(); }
@@ -2634,11 +2660,23 @@ void InstructionSelector::VisitI64x2MinU(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI64x2MaxU(Node* node) { UNIMPLEMENTED(); }
 #endif  // !V8_TARGET_ARCH_X64 && !V8_TARGET_ARCH_S390X
 
-#if !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_ARM
-void InstructionSelector::VisitI8x16BitMask(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitI16x8BitMask(Node* node) { UNIMPLEMENTED(); }
-void InstructionSelector::VisitI32x4BitMask(Node* node) { UNIMPLEMENTED(); }
-#endif  // !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_ARM
+#if !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_IA32 && \
+    !V8_TARGET_ARCH_X64
+// TODO(v8:10501) Prototyping pmin and pmax instructions.
+void InstructionSelector::VisitF32x4Pmin(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF32x4Pmax(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF64x2Pmin(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF64x2Pmax(Node* node) { UNIMPLEMENTED(); }
+#endif  // !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_IA32
+        // && !V8_TARGET_ARCH_X64
+
+#if !V8_TARGET_ARCH_X64
+// TODO(v8:10553) Prototyping floating point rounding instructions.
+void InstructionSelector::VisitF32x4Ceil(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF32x4Floor(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF32x4Trunc(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF32x4NearestInt(Node* node) { UNIMPLEMENTED(); }
+#endif  // !V8_TARGET_ARCH_X64
 
 void InstructionSelector::VisitFinishRegion(Node* node) { EmitIdentity(node); }
 
@@ -3008,7 +3046,8 @@ void InstructionSelector::VisitUnreachable(Node* node) {
 }
 
 void InstructionSelector::VisitStaticAssert(Node* node) {
-  node->InputAt(0)->Print();
+  Node* asserted = node->InputAt(0);
+  asserted->Print(4);
   FATAL("Expected turbofan static assert to hold, but got non-true input!\n");
 }
 
diff --git a/deps/v8/src/compiler/backend/instruction.h b/deps/v8/src/compiler/backend/instruction.h
index e189100c346..f40a4198f81 100644
--- a/deps/v8/src/compiler/backend/instruction.h
+++ b/deps/v8/src/compiler/backend/instruction.h
@@ -1536,7 +1536,7 @@ class V8_EXPORT_PRIVATE InstructionSequence final
     return virtual_register;
   }
   Constant GetConstant(int virtual_register) const {
-    ConstantMap::const_iterator it = constants_.find(virtual_register);
+    auto it = constants_.find(virtual_register);
     DCHECK(it != constants_.end());
     DCHECK_EQ(virtual_register, it->first);
     return it->second;
diff --git a/deps/v8/src/compiler/backend/mips/code-generator-mips.cc b/deps/v8/src/compiler/backend/mips/code-generator-mips.cc
index 8e1ce0f2a34..2d120028f06 100644
--- a/deps/v8/src/compiler/backend/mips/code-generator-mips.cc
+++ b/deps/v8/src/compiler/backend/mips/code-generator-mips.cc
@@ -11,7 +11,7 @@
 #include "src/compiler/backend/gap-resolver.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/osr.h"
-#include "src/heap/heap-inl.h"  // crbug.com/v8/8499
+#include "src/heap/memory-chunk.h"
 #include "src/wasm/wasm-code-manager.h"
 
 namespace v8 {
@@ -2800,9 +2800,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                i.InputSimd128Register(0));
       break;
     }
-    case kMipsS1x4AnyTrue:
-    case kMipsS1x8AnyTrue:
-    case kMipsS1x16AnyTrue: {
+    case kMipsV32x4AnyTrue:
+    case kMipsV16x8AnyTrue:
+    case kMipsV8x16AnyTrue: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       Register dst = i.OutputRegister();
       Label all_false;
@@ -2814,7 +2814,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ bind(&all_false);
       break;
     }
-    case kMipsS1x4AllTrue: {
+    case kMipsV32x4AllTrue: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       Register dst = i.OutputRegister();
       Label all_true;
@@ -2825,7 +2825,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ bind(&all_true);
       break;
     }
-    case kMipsS1x8AllTrue: {
+    case kMipsV16x8AllTrue: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       Register dst = i.OutputRegister();
       Label all_true;
@@ -2836,7 +2836,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ bind(&all_true);
       break;
     }
-    case kMipsS1x16AllTrue: {
+    case kMipsV8x16AllTrue: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       Register dst = i.OutputRegister();
       Label all_true;
@@ -3508,7 +3508,7 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         __ PrepareCallCFunction(0, 0, cp);
         __ CallCFunction(
             ExternalReference::wasm_call_trap_callback_for_testing(), 0);
-        __ LeaveFrame(StackFrame::WASM_COMPILED);
+        __ LeaveFrame(StackFrame::WASM);
         auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
         int pop_count =
             static_cast<int>(call_descriptor->StackParameterCount());
diff --git a/deps/v8/src/compiler/backend/mips/instruction-codes-mips.h b/deps/v8/src/compiler/backend/mips/instruction-codes-mips.h
index 0a37dd70683..a08b6f0d261 100644
--- a/deps/v8/src/compiler/backend/mips/instruction-codes-mips.h
+++ b/deps/v8/src/compiler/backend/mips/instruction-codes-mips.h
@@ -265,12 +265,12 @@ namespace compiler {
   V(MipsS128Not)                   \
   V(MipsS128Select)                \
   V(MipsS128AndNot)                \
-  V(MipsS1x4AnyTrue)               \
-  V(MipsS1x4AllTrue)               \
-  V(MipsS1x8AnyTrue)               \
-  V(MipsS1x8AllTrue)               \
-  V(MipsS1x16AnyTrue)              \
-  V(MipsS1x16AllTrue)              \
+  V(MipsV32x4AnyTrue)              \
+  V(MipsV32x4AllTrue)              \
+  V(MipsV16x8AnyTrue)              \
+  V(MipsV16x8AllTrue)              \
+  V(MipsV8x16AnyTrue)              \
+  V(MipsV8x16AllTrue)              \
   V(MipsS32x4InterleaveRight)      \
   V(MipsS32x4InterleaveLeft)       \
   V(MipsS32x4PackEven)             \
diff --git a/deps/v8/src/compiler/backend/mips/instruction-scheduler-mips.cc b/deps/v8/src/compiler/backend/mips/instruction-scheduler-mips.cc
index 81bbfbbfb9b..b0b75dba168 100644
--- a/deps/v8/src/compiler/backend/mips/instruction-scheduler-mips.cc
+++ b/deps/v8/src/compiler/backend/mips/instruction-scheduler-mips.cc
@@ -238,12 +238,12 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMipsS16x8InterleaveRight:
     case kMipsS16x8PackEven:
     case kMipsS16x8PackOdd:
-    case kMipsS1x16AllTrue:
-    case kMipsS1x16AnyTrue:
-    case kMipsS1x4AllTrue:
-    case kMipsS1x4AnyTrue:
-    case kMipsS1x8AllTrue:
-    case kMipsS1x8AnyTrue:
+    case kMipsV8x16AllTrue:
+    case kMipsV8x16AnyTrue:
+    case kMipsV32x4AllTrue:
+    case kMipsV32x4AnyTrue:
+    case kMipsV16x8AllTrue:
+    case kMipsV16x8AnyTrue:
     case kMipsS32x4InterleaveEven:
     case kMipsS32x4InterleaveLeft:
     case kMipsS32x4InterleaveOdd:
diff --git a/deps/v8/src/compiler/backend/mips/instruction-selector-mips.cc b/deps/v8/src/compiler/backend/mips/instruction-selector-mips.cc
index cd87f369133..f72ea0b8123 100644
--- a/deps/v8/src/compiler/backend/mips/instruction-selector-mips.cc
+++ b/deps/v8/src/compiler/backend/mips/instruction-selector-mips.cc
@@ -714,6 +714,8 @@ void InstructionSelector::VisitWord32PairSar(Node* node) {
   VisitWord32PairShift(this, kMipsSarPair, node);
 }
 
+void InstructionSelector::VisitWord32Rol(Node* node) { UNREACHABLE(); }
+
 void InstructionSelector::VisitWord32Ror(Node* node) {
   VisitRRO(this, kMipsRor, node);
 }
@@ -2109,12 +2111,12 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   V(I16x8UConvertI8x16High, kMipsI16x8UConvertI8x16High) \
   V(I8x16Neg, kMipsI8x16Neg)                             \
   V(S128Not, kMipsS128Not)                               \
-  V(S1x4AnyTrue, kMipsS1x4AnyTrue)                       \
-  V(S1x4AllTrue, kMipsS1x4AllTrue)                       \
-  V(S1x8AnyTrue, kMipsS1x8AnyTrue)                       \
-  V(S1x8AllTrue, kMipsS1x8AllTrue)                       \
-  V(S1x16AnyTrue, kMipsS1x16AnyTrue)                     \
-  V(S1x16AllTrue, kMipsS1x16AllTrue)
+  V(V32x4AnyTrue, kMipsV32x4AnyTrue)                     \
+  V(V32x4AllTrue, kMipsV32x4AllTrue)                     \
+  V(V16x8AnyTrue, kMipsV16x8AnyTrue)                     \
+  V(V16x8AllTrue, kMipsV16x8AllTrue)                     \
+  V(V8x16AnyTrue, kMipsV8x16AnyTrue)                     \
+  V(V8x16AllTrue, kMipsV8x16AllTrue)
 
 #define SIMD_SHIFT_OP_LIST(V) \
   V(I64x2Shl)                 \
diff --git a/deps/v8/src/compiler/backend/mips64/code-generator-mips64.cc b/deps/v8/src/compiler/backend/mips64/code-generator-mips64.cc
index 224b23fffc3..b90bed4001c 100644
--- a/deps/v8/src/compiler/backend/mips64/code-generator-mips64.cc
+++ b/deps/v8/src/compiler/backend/mips64/code-generator-mips64.cc
@@ -12,7 +12,7 @@
 #include "src/compiler/backend/gap-resolver.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/osr.h"
-#include "src/heap/heap-inl.h"  // crbug.com/v8/8499
+#include "src/heap/memory-chunk.h"
 #include "src/wasm/wasm-code-manager.h"
 
 namespace v8 {
@@ -1893,6 +1893,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kMips64I16x8Load8x8U: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       Simd128Register dst = i.OutputSimd128Register();
+      __ xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
       __ Ld(kScratchReg, i.MemoryOperand());
       __ fill_d(dst, kScratchReg);
       __ ilvr_b(dst, kSimd128RegZero, dst);
@@ -1911,6 +1912,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kMips64I32x4Load16x4U: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       Simd128Register dst = i.OutputSimd128Register();
+      __ xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
       __ Ld(kScratchReg, i.MemoryOperand());
       __ fill_d(dst, kScratchReg);
       __ ilvr_h(dst, kSimd128RegZero, dst);
@@ -1929,6 +1931,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kMips64I64x2Load32x2U: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       Simd128Register dst = i.OutputSimd128Register();
+      __ xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
       __ Ld(kScratchReg, i.MemoryOperand());
       __ fill_d(dst, kScratchReg);
       __ ilvr_w(dst, kSimd128RegZero, dst);
@@ -2158,12 +2161,50 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMips64F64x2Min: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      ASSEMBLE_F64X2_ARITHMETIC_BINOP(fmin_d);
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register src0 = i.InputSimd128Register(0);
+      Simd128Register src1 = i.InputSimd128Register(1);
+      Simd128Register scratch0 = kSimd128RegZero;
+      Simd128Register scratch1 = kSimd128ScratchReg;
+      // MSA follows IEEE 754-2008 comparision rules:
+      // 1. All NaN-related comparsions get false.
+      // 2. +0.0 equals to -0.0.
+
+      // If inputs are -0.0. and +0.0, then write -0.0 to scratch1.
+      // scratch1 = (src0 == src1) ?  (src0 | src1) : (src1 | src1).
+      __ fseq_d(scratch0, src0, src1);
+      __ bsel_v(scratch0, src1, src0);
+      __ or_v(scratch1, scratch0, src1);
+      // scratch0 = isNaN(src0) ? src0 : scratch1.
+      __ fseq_d(scratch0, src0, src0);
+      __ bsel_v(scratch0, src0, scratch1);
+      // dst = (src0 < scratch0) ? src0 : scratch0.
+      __ fslt_d(dst, src0, scratch0);
+      __ bsel_v(dst, scratch0, src0);
       break;
     }
     case kMips64F64x2Max: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      ASSEMBLE_F64X2_ARITHMETIC_BINOP(fmax_d);
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register src0 = i.InputSimd128Register(0);
+      Simd128Register src1 = i.InputSimd128Register(1);
+      Simd128Register scratch0 = kSimd128RegZero;
+      Simd128Register scratch1 = kSimd128ScratchReg;
+      // MSA follows IEEE 754-2008 comparision rules:
+      // 1. All NaN-related comparsions get false.
+      // 2. +0.0 equals to -0.0.
+
+      // If inputs are -0.0. and +0.0, then write +0.0 to scratch1.
+      // scratch1 = (src0 == src1) ?  (src0 & src1) : (src1 & src1).
+      __ fseq_d(scratch0, src0, src1);
+      __ bsel_v(scratch0, src1, src0);
+      __ and_v(scratch1, scratch0, src1);
+      // scratch0 = isNaN(src0) ? src0 : scratch1.
+      __ fseq_d(scratch0, src0, src0);
+      __ bsel_v(scratch0, src0, scratch1);
+      // dst = (scratch0 < src0) ? src0 : scratch0.
+      __ fslt_d(dst, scratch0, src0);
+      __ bsel_v(dst, scratch0, src0);
       break;
     }
     case kMips64F64x2Eq: {
@@ -2174,8 +2215,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMips64F64x2Ne: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ fcne_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputSimd128Register(1));
+      __ fcune_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
       break;
     }
     case kMips64F64x2Lt: {
@@ -2206,13 +2247,34 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       Simd128Register src = i.InputSimd128Register(0);
       Simd128Register dst = i.OutputSimd128Register();
-      if (src != dst) {
+      __ Move(kScratchReg, i.InputDoubleRegister(2));
+      if (dst != src) {
         __ move_v(dst, src);
       }
-      __ Move(kScratchReg, i.InputDoubleRegister(2));
       __ insert_d(dst, i.InputInt8(1), kScratchReg);
       break;
     }
+    case kMips64I64x2Splat: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ fill_d(i.OutputSimd128Register(), i.InputRegister(0));
+      break;
+    }
+    case kMips64I64x2ExtractLane: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ copy_s_d(i.OutputRegister(), i.InputSimd128Register(0),
+                  i.InputInt8(1));
+      break;
+    }
+    case kMips64I64x2ReplaceLane: {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      Simd128Register src = i.InputSimd128Register(0);
+      Simd128Register dst = i.OutputSimd128Register();
+      if (src != dst) {
+        __ move_v(dst, src);
+      }
+      __ insert_d(dst, i.InputInt8(1), i.InputRegister(2));
+      break;
+    }
     case kMips64I64x2Add: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       __ addv_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
@@ -2240,20 +2302,38 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMips64I64x2Shl: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ slli_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputInt6(1));
+      if (instr->InputAt(1)->IsRegister()) {
+        __ fill_d(kSimd128ScratchReg, i.InputRegister(1));
+        __ sll_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 kSimd128ScratchReg);
+      } else {
+        __ slli_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                  i.InputInt6(1));
+      }
       break;
     }
     case kMips64I64x2ShrS: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ srai_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputInt6(1));
+      if (instr->InputAt(1)->IsRegister()) {
+        __ fill_d(kSimd128ScratchReg, i.InputRegister(1));
+        __ sra_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 kSimd128ScratchReg);
+      } else {
+        __ srai_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                  i.InputInt6(1));
+      }
       break;
     }
     case kMips64I64x2ShrU: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ srli_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputInt6(1));
+      if (instr->InputAt(1)->IsRegister()) {
+        __ fill_d(kSimd128ScratchReg, i.InputRegister(1));
+        __ srl_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 kSimd128ScratchReg);
+      } else {
+        __ srli_d(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                  i.InputInt6(1));
+      }
       break;
     }
     case kMips64F32x4Splat: {
@@ -2272,10 +2352,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       Simd128Register src = i.InputSimd128Register(0);
       Simd128Register dst = i.OutputSimd128Register();
-      if (src != dst) {
+      __ FmoveLow(kScratchReg, i.InputSingleRegister(2));
+      if (dst != src) {
         __ move_v(dst, src);
       }
-      __ FmoveLow(kScratchReg, i.InputSingleRegister(2));
       __ insert_w(dst, i.InputInt8(1), kScratchReg);
       break;
     }
@@ -2322,20 +2402,38 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMips64I32x4Shl: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ slli_w(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputInt5(1));
+      if (instr->InputAt(1)->IsRegister()) {
+        __ fill_w(kSimd128ScratchReg, i.InputRegister(1));
+        __ sll_w(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 kSimd128ScratchReg);
+      } else {
+        __ slli_w(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                  i.InputInt5(1));
+      }
       break;
     }
     case kMips64I32x4ShrS: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ srai_w(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputInt5(1));
+      if (instr->InputAt(1)->IsRegister()) {
+        __ fill_w(kSimd128ScratchReg, i.InputRegister(1));
+        __ sra_w(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 kSimd128ScratchReg);
+      } else {
+        __ srai_w(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                  i.InputInt5(1));
+      }
       break;
     }
     case kMips64I32x4ShrU: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ srli_w(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputInt5(1));
+      if (instr->InputAt(1)->IsRegister()) {
+        __ fill_w(kSimd128ScratchReg, i.InputRegister(1));
+        __ srl_w(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 kSimd128ScratchReg);
+      } else {
+        __ srli_w(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                  i.InputInt5(1));
+      }
       break;
     }
     case kMips64I32x4MaxU: {
@@ -2359,9 +2457,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMips64S128AndNot: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      Simd128Register dst = i.OutputSimd128Register();
-      __ nor_v(dst, i.InputSimd128Register(1), i.InputSimd128Register(1));
-      __ and_v(dst, dst, i.InputSimd128Register(0));
+      Simd128Register scratch = kSimd128ScratchReg,
+                      dst = i.OutputSimd128Register(),
+                      src0 = i.InputSimd128Register(0),
+                      src1 = i.InputSimd128Register(1);
+      __ nor_v(scratch, src1, src1);
+      __ and_v(dst, scratch, src0);
       break;
     }
     case kMips64F32x4Abs: {
@@ -2410,14 +2511,50 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMips64F32x4Max: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ fmax_w(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputSimd128Register(1));
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register src0 = i.InputSimd128Register(0);
+      Simd128Register src1 = i.InputSimd128Register(1);
+      Simd128Register scratch0 = kSimd128RegZero;
+      Simd128Register scratch1 = kSimd128ScratchReg;
+      // MSA follows IEEE 754-2008 comparision rules:
+      // 1. All NaN-related comparsions get false.
+      // 2. +0.0 equals to -0.0.
+
+      // If inputs are -0.0. and +0.0, then write +0.0 to scratch1.
+      // scratch1 = (src0 == src1) ?  (src0 & src1) : (src1 & src1).
+      __ fseq_w(scratch0, src0, src1);
+      __ bsel_v(scratch0, src1, src0);
+      __ and_v(scratch1, scratch0, src1);
+      // scratch0 = isNaN(src0) ? src0 : scratch1.
+      __ fseq_w(scratch0, src0, src0);
+      __ bsel_v(scratch0, src0, scratch1);
+      // dst = (scratch0 < src0) ? src0 : scratch0.
+      __ fslt_w(dst, scratch0, src0);
+      __ bsel_v(dst, scratch0, src0);
       break;
     }
     case kMips64F32x4Min: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ fmin_w(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputSimd128Register(1));
+      Simd128Register dst = i.OutputSimd128Register();
+      Simd128Register src0 = i.InputSimd128Register(0);
+      Simd128Register src1 = i.InputSimd128Register(1);
+      Simd128Register scratch0 = kSimd128RegZero;
+      Simd128Register scratch1 = kSimd128ScratchReg;
+      // MSA follows IEEE 754-2008 comparision rules:
+      // 1. All NaN-related comparsions get false.
+      // 2. +0.0 equals to -0.0.
+
+      // If inputs are -0.0. and +0.0, then write -0.0 to scratch1.
+      // scratch1 = (src0 == src1) ?  (src0 | src1) : (src1 | src1).
+      __ fseq_w(scratch0, src0, src1);
+      __ bsel_v(scratch0, src1, src0);
+      __ or_v(scratch1, scratch0, src1);
+      // scratch0 = isNaN(src0) ? src0 : scratch1.
+      __ fseq_w(scratch0, src0, src0);
+      __ bsel_v(scratch0, src0, scratch1);
+      // dst = (src0 < scratch0) ? src0 : scratch0.
+      __ fslt_w(dst, src0, scratch0);
+      __ bsel_v(dst, scratch0, src0);
       break;
     }
     case kMips64F32x4Eq: {
@@ -2428,8 +2565,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMips64F32x4Ne: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ fcne_w(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputSimd128Register(1));
+      __ fcune_w(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
       break;
     }
     case kMips64F32x4Lt: {
@@ -2492,6 +2629,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMips64I32x4Abs: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
       __ asub_s_w(i.OutputSimd128Register(), i.InputSimd128Register(0),
                   kSimd128RegZero);
       break;
@@ -2532,20 +2670,38 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMips64I16x8Shl: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ slli_h(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputInt4(1));
+      if (instr->InputAt(1)->IsRegister()) {
+        __ fill_h(kSimd128ScratchReg, i.InputRegister(1));
+        __ sll_h(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 kSimd128ScratchReg);
+      } else {
+        __ slli_h(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                  i.InputInt4(1));
+      }
       break;
     }
     case kMips64I16x8ShrS: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ srai_h(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputInt4(1));
+      if (instr->InputAt(1)->IsRegister()) {
+        __ fill_h(kSimd128ScratchReg, i.InputRegister(1));
+        __ sra_h(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 kSimd128ScratchReg);
+      } else {
+        __ srai_h(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                  i.InputInt4(1));
+      }
       break;
     }
     case kMips64I16x8ShrU: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ srli_h(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputInt4(1));
+      if (instr->InputAt(1)->IsRegister()) {
+        __ fill_h(kSimd128ScratchReg, i.InputRegister(1));
+        __ srl_h(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 kSimd128ScratchReg);
+      } else {
+        __ srli_h(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                  i.InputInt4(1));
+      }
       break;
     }
     case kMips64I16x8Add: {
@@ -2659,6 +2815,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMips64I16x8Abs: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
       __ asub_s_h(i.OutputSimd128Register(), i.InputSimd128Register(0),
                   kSimd128RegZero);
       break;
@@ -2699,14 +2856,26 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMips64I8x16Shl: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ slli_b(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputInt3(1));
+      if (instr->InputAt(1)->IsRegister()) {
+        __ fill_b(kSimd128ScratchReg, i.InputRegister(1));
+        __ sll_b(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 kSimd128ScratchReg);
+      } else {
+        __ slli_b(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                  i.InputInt3(1));
+      }
       break;
     }
     case kMips64I8x16ShrS: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ srai_b(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputInt3(1));
+      if (instr->InputAt(1)->IsRegister()) {
+        __ fill_b(kSimd128ScratchReg, i.InputRegister(1));
+        __ sra_b(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 kSimd128ScratchReg);
+      } else {
+        __ srai_b(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                  i.InputInt3(1));
+      }
       break;
     }
     case kMips64I8x16Add: {
@@ -2778,8 +2947,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMips64I8x16ShrU: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
-      __ srli_b(i.OutputSimd128Register(), i.InputSimd128Register(0),
-                i.InputInt3(1));
+      if (instr->InputAt(1)->IsRegister()) {
+        __ fill_b(kSimd128ScratchReg, i.InputRegister(1));
+        __ srl_b(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 kSimd128ScratchReg);
+      } else {
+        __ srli_b(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                  i.InputInt3(1));
+      }
       break;
     }
     case kMips64I8x16AddSaturateU: {
@@ -2826,6 +3001,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMips64I8x16Abs: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      __ xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
       __ asub_s_b(i.OutputSimd128Register(), i.InputSimd128Register(0),
                   kSimd128RegZero);
       break;
@@ -2854,48 +3030,48 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                i.InputSimd128Register(0));
       break;
     }
-    case kMips64S1x4AnyTrue:
-    case kMips64S1x8AnyTrue:
-    case kMips64S1x16AnyTrue: {
+    case kMips64V32x4AnyTrue:
+    case kMips64V16x8AnyTrue:
+    case kMips64V8x16AnyTrue: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       Register dst = i.OutputRegister();
       Label all_false;
       __ BranchMSA(&all_false, MSA_BRANCH_V, all_zero,
                    i.InputSimd128Register(0), USE_DELAY_SLOT);
       __ li(dst, 0l);  // branch delay slot
-      __ li(dst, -1);
+      __ li(dst, 1);
       __ bind(&all_false);
       break;
     }
-    case kMips64S1x4AllTrue: {
+    case kMips64V32x4AllTrue: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       Register dst = i.OutputRegister();
       Label all_true;
       __ BranchMSA(&all_true, MSA_BRANCH_W, all_not_zero,
                    i.InputSimd128Register(0), USE_DELAY_SLOT);
-      __ li(dst, -1);  // branch delay slot
+      __ li(dst, 1);  // branch delay slot
       __ li(dst, 0l);
       __ bind(&all_true);
       break;
     }
-    case kMips64S1x8AllTrue: {
+    case kMips64V16x8AllTrue: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       Register dst = i.OutputRegister();
       Label all_true;
       __ BranchMSA(&all_true, MSA_BRANCH_H, all_not_zero,
                    i.InputSimd128Register(0), USE_DELAY_SLOT);
-      __ li(dst, -1);  // branch delay slot
+      __ li(dst, 1);  // branch delay slot
       __ li(dst, 0l);
       __ bind(&all_true);
       break;
     }
-    case kMips64S1x16AllTrue: {
+    case kMips64V8x16AllTrue: {
       CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
       Register dst = i.OutputRegister();
       Label all_true;
       __ BranchMSA(&all_true, MSA_BRANCH_B, all_not_zero,
                    i.InputSimd128Register(0), USE_DELAY_SLOT);
-      __ li(dst, -1);  // branch delay slot
+      __ li(dst, 1);  // branch delay slot
       __ li(dst, 0l);
       __ bind(&all_true);
       break;
@@ -3196,9 +3372,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                       ctl = i.InputSimd128Register(1);
       DCHECK(dst != ctl && dst != tbl);
       Simd128Register zeroReg = i.TempSimd128Register(0);
-      __ fill_d(zeroReg, zero_reg);
+      __ xor_v(zeroReg, zeroReg, zeroReg);
       __ move_v(dst, ctl);
-      __ vshf_b(dst, tbl, zeroReg);
+      __ vshf_b(dst, zeroReg, tbl);
       break;
     }
     case kMips64S8x8Reverse: {
@@ -3290,9 +3466,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       Simd128Register dst = i.OutputSimd128Register();
       Simd128Register src0 = i.InputSimd128Register(0);
       Simd128Register src1 = i.InputSimd128Register(1);
-      __ sat_u_w(kSimd128ScratchReg, src0, 15);
-      __ sat_u_w(kSimd128RegZero, src1, 15);  // kSimd128RegZero as scratch
-      __ pckev_h(dst, kSimd128RegZero, kSimd128ScratchReg);
+      __ xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+      __ max_s_w(kSimd128ScratchReg, kSimd128RegZero, src0);
+      __ sat_u_w(kSimd128ScratchReg, kSimd128ScratchReg, 15);
+      __ max_s_w(dst, kSimd128RegZero, src1);
+      __ sat_u_w(dst, dst, 15);
+      __ pckev_h(dst, dst, kSimd128ScratchReg);
       break;
     }
     case kMips64I16x8UConvertI8x16Low: {
@@ -3324,9 +3503,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       Simd128Register dst = i.OutputSimd128Register();
       Simd128Register src0 = i.InputSimd128Register(0);
       Simd128Register src1 = i.InputSimd128Register(1);
-      __ sat_u_h(kSimd128ScratchReg, src0, 7);
-      __ sat_u_h(kSimd128RegZero, src1, 7);  // kSimd128RegZero as scratch
-      __ pckev_b(dst, kSimd128RegZero, kSimd128ScratchReg);
+      __ xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+      __ max_s_h(kSimd128ScratchReg, kSimd128RegZero, src0);
+      __ sat_u_h(kSimd128ScratchReg, kSimd128ScratchReg, 7);
+      __ max_s_h(dst, kSimd128RegZero, src1);
+      __ sat_u_h(dst, dst, 7);
+      __ pckev_b(dst, dst, kSimd128ScratchReg);
       break;
     }
     case kMips64F32x4AddHoriz: {
@@ -3593,7 +3775,7 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         __ PrepareCallCFunction(0, 0, cp);
         __ CallCFunction(
             ExternalReference::wasm_call_trap_callback_for_testing(), 0);
-        __ LeaveFrame(StackFrame::WASM_COMPILED);
+        __ LeaveFrame(StackFrame::WASM);
         auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
         int pop_count =
             static_cast<int>(call_descriptor->StackParameterCount());
diff --git a/deps/v8/src/compiler/backend/mips64/instruction-codes-mips64.h b/deps/v8/src/compiler/backend/mips64/instruction-codes-mips64.h
index c752381c8cb..98352ddba81 100644
--- a/deps/v8/src/compiler/backend/mips64/instruction-codes-mips64.h
+++ b/deps/v8/src/compiler/backend/mips64/instruction-codes-mips64.h
@@ -203,6 +203,9 @@ namespace compiler {
   V(Mips64F64x2Splat)                        \
   V(Mips64F64x2ExtractLane)                  \
   V(Mips64F64x2ReplaceLane)                  \
+  V(Mips64I64x2Splat)                        \
+  V(Mips64I64x2ExtractLane)                  \
+  V(Mips64I64x2ReplaceLane)                  \
   V(Mips64I64x2Add)                          \
   V(Mips64I64x2Sub)                          \
   V(Mips64I64x2Mul)                          \
@@ -295,12 +298,12 @@ namespace compiler {
   V(Mips64S128Not)                           \
   V(Mips64S128Select)                        \
   V(Mips64S128AndNot)                        \
-  V(Mips64S1x4AnyTrue)                       \
-  V(Mips64S1x4AllTrue)                       \
-  V(Mips64S1x8AnyTrue)                       \
-  V(Mips64S1x8AllTrue)                       \
-  V(Mips64S1x16AnyTrue)                      \
-  V(Mips64S1x16AllTrue)                      \
+  V(Mips64V32x4AnyTrue)                      \
+  V(Mips64V32x4AllTrue)                      \
+  V(Mips64V16x8AnyTrue)                      \
+  V(Mips64V16x8AllTrue)                      \
+  V(Mips64V8x16AnyTrue)                      \
+  V(Mips64V8x16AllTrue)                      \
   V(Mips64S32x4InterleaveRight)              \
   V(Mips64S32x4InterleaveLeft)               \
   V(Mips64S32x4PackEven)                     \
diff --git a/deps/v8/src/compiler/backend/mips64/instruction-scheduler-mips64.cc b/deps/v8/src/compiler/backend/mips64/instruction-scheduler-mips64.cc
index 0261d915fbc..2c02f9791e5 100644
--- a/deps/v8/src/compiler/backend/mips64/instruction-scheduler-mips64.cc
+++ b/deps/v8/src/compiler/backend/mips64/instruction-scheduler-mips64.cc
@@ -82,6 +82,9 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMips64F64x2Ne:
     case kMips64F64x2Lt:
     case kMips64F64x2Le:
+    case kMips64I64x2Splat:
+    case kMips64I64x2ExtractLane:
+    case kMips64I64x2ReplaceLane:
     case kMips64I64x2Add:
     case kMips64I64x2Sub:
     case kMips64I64x2Mul:
@@ -262,12 +265,12 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kMips64S16x8PackOdd:
     case kMips64S16x2Reverse:
     case kMips64S16x4Reverse:
-    case kMips64S1x16AllTrue:
-    case kMips64S1x16AnyTrue:
-    case kMips64S1x4AllTrue:
-    case kMips64S1x4AnyTrue:
-    case kMips64S1x8AllTrue:
-    case kMips64S1x8AnyTrue:
+    case kMips64V8x16AllTrue:
+    case kMips64V8x16AnyTrue:
+    case kMips64V32x4AllTrue:
+    case kMips64V32x4AnyTrue:
+    case kMips64V16x8AllTrue:
+    case kMips64V16x8AnyTrue:
     case kMips64S32x4InterleaveEven:
     case kMips64S32x4InterleaveOdd:
     case kMips64S32x4InterleaveLeft:
diff --git a/deps/v8/src/compiler/backend/mips64/instruction-selector-mips64.cc b/deps/v8/src/compiler/backend/mips64/instruction-selector-mips64.cc
index 5a0e41ccbe9..9c448a27653 100644
--- a/deps/v8/src/compiler/backend/mips64/instruction-selector-mips64.cc
+++ b/deps/v8/src/compiler/backend/mips64/instruction-selector-mips64.cc
@@ -132,6 +132,20 @@ static void VisitRRI(InstructionSelector* selector, ArchOpcode opcode,
                  g.UseRegister(node->InputAt(0)), g.UseImmediate(imm));
 }
 
+static void VisitSimdShift(InstructionSelector* selector, ArchOpcode opcode,
+                           Node* node) {
+  Mips64OperandGenerator g(selector);
+  if (g.IsIntegerConstant(node->InputAt(1))) {
+    selector->Emit(opcode, g.DefineAsRegister(node),
+                   g.UseRegister(node->InputAt(0)),
+                   g.UseImmediate(node->InputAt(1)));
+  } else {
+    selector->Emit(opcode, g.DefineAsRegister(node),
+                   g.UseRegister(node->InputAt(0)),
+                   g.UseRegister(node->InputAt(1)));
+  }
+}
+
 static void VisitRRIR(InstructionSelector* selector, ArchOpcode opcode,
                       Node* node) {
   Mips64OperandGenerator g(selector);
@@ -838,6 +852,10 @@ void InstructionSelector::VisitWord64Sar(Node* node) {
   VisitRRO(this, kMips64Dsar, node);
 }
 
+void InstructionSelector::VisitWord32Rol(Node* node) { UNREACHABLE(); }
+
+void InstructionSelector::VisitWord64Rol(Node* node) { UNREACHABLE(); }
+
 void InstructionSelector::VisitWord32Ror(Node* node) {
   VisitRRO(this, kMips64Ror, node);
 }
@@ -2733,7 +2751,9 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
 }
 
 #define SIMD_TYPE_LIST(V) \
+  V(F64x2)                \
   V(F32x4)                \
+  V(I64x2)                \
   V(I32x4)                \
   V(I16x8)                \
   V(I8x16)
@@ -2767,12 +2787,12 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   V(I8x16Neg, kMips64I8x16Neg)                             \
   V(I8x16Abs, kMips64I8x16Abs)                             \
   V(S128Not, kMips64S128Not)                               \
-  V(S1x4AnyTrue, kMips64S1x4AnyTrue)                       \
-  V(S1x4AllTrue, kMips64S1x4AllTrue)                       \
-  V(S1x8AnyTrue, kMips64S1x8AnyTrue)                       \
-  V(S1x8AllTrue, kMips64S1x8AllTrue)                       \
-  V(S1x16AnyTrue, kMips64S1x16AnyTrue)                     \
-  V(S1x16AllTrue, kMips64S1x16AllTrue)
+  V(V32x4AnyTrue, kMips64V32x4AnyTrue)                     \
+  V(V32x4AllTrue, kMips64V32x4AllTrue)                     \
+  V(V16x8AnyTrue, kMips64V16x8AnyTrue)                     \
+  V(V16x8AllTrue, kMips64V16x8AllTrue)                     \
+  V(V8x16AnyTrue, kMips64V8x16AnyTrue)                     \
+  V(V8x16AllTrue, kMips64V8x16AllTrue)
 
 #define SIMD_SHIFT_OP_LIST(V) \
   V(I64x2Shl)                 \
@@ -2875,7 +2895,7 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
 
 void InstructionSelector::VisitS128Zero(Node* node) {
   Mips64OperandGenerator g(this);
-  Emit(kMips64S128Zero, g.DefineSameAsFirst(node));
+  Emit(kMips64S128Zero, g.DefineAsRegister(node));
 }
 
 #define SIMD_VISIT_SPLAT(Type)                               \
@@ -2883,7 +2903,6 @@ void InstructionSelector::VisitS128Zero(Node* node) {
     VisitRR(this, kMips64##Type##Splat, node);               \
   }
 SIMD_TYPE_LIST(SIMD_VISIT_SPLAT)
-SIMD_VISIT_SPLAT(F64x2)
 #undef SIMD_VISIT_SPLAT
 
 #define SIMD_VISIT_EXTRACT_LANE(Type, Sign)                              \
@@ -2892,6 +2911,7 @@ SIMD_VISIT_SPLAT(F64x2)
   }
 SIMD_VISIT_EXTRACT_LANE(F64x2, )
 SIMD_VISIT_EXTRACT_LANE(F32x4, )
+SIMD_VISIT_EXTRACT_LANE(I64x2, )
 SIMD_VISIT_EXTRACT_LANE(I32x4, )
 SIMD_VISIT_EXTRACT_LANE(I16x8, U)
 SIMD_VISIT_EXTRACT_LANE(I16x8, S)
@@ -2904,7 +2924,6 @@ SIMD_VISIT_EXTRACT_LANE(I8x16, S)
     VisitRRIR(this, kMips64##Type##ReplaceLane, node);             \
   }
 SIMD_TYPE_LIST(SIMD_VISIT_REPLACE_LANE)
-SIMD_VISIT_REPLACE_LANE(F64x2)
 #undef SIMD_VISIT_REPLACE_LANE
 
 #define SIMD_VISIT_UNOP(Name, instruction)            \
@@ -2916,7 +2935,7 @@ SIMD_UNOP_LIST(SIMD_VISIT_UNOP)
 
 #define SIMD_VISIT_SHIFT_OP(Name)                     \
   void InstructionSelector::Visit##Name(Node* node) { \
-    VisitRRI(this, kMips64##Name, node);              \
+    VisitSimdShift(this, kMips64##Name, node);        \
   }
 SIMD_SHIFT_OP_LIST(SIMD_VISIT_SHIFT_OP)
 #undef SIMD_VISIT_SHIFT_OP
diff --git a/deps/v8/src/compiler/backend/ppc/code-generator-ppc.cc b/deps/v8/src/compiler/backend/ppc/code-generator-ppc.cc
index addbd76ffba..5407334ba5b 100644
--- a/deps/v8/src/compiler/backend/ppc/code-generator-ppc.cc
+++ b/deps/v8/src/compiler/backend/ppc/code-generator-ppc.cc
@@ -2,17 +2,16 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/compiler/backend/code-generator.h"
-
 #include "src/codegen/assembler-inl.h"
 #include "src/codegen/callable.h"
 #include "src/codegen/macro-assembler.h"
 #include "src/codegen/optimized-compilation-info.h"
 #include "src/compiler/backend/code-generator-impl.h"
+#include "src/compiler/backend/code-generator.h"
 #include "src/compiler/backend/gap-resolver.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/osr.h"
-#include "src/heap/heap-inl.h"  // crbug.com/v8/8499
+#include "src/heap/memory-chunk.h"
 #include "src/numbers/double.h"
 #include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-objects.h"
@@ -89,8 +88,9 @@ class PPCOperandConverter final : public InstructionOperandConverter {
 
   MemOperand MemoryOperand(AddressingMode* mode, size_t* first_index) {
     const size_t index = *first_index;
-    *mode = AddressingModeField::decode(instr_->opcode());
-    switch (*mode) {
+    AddressingMode addr_mode = AddressingModeField::decode(instr_->opcode());
+    if (mode) *mode = addr_mode;
+    switch (addr_mode) {
       case kMode_None:
         break;
       case kMode_MRI:
@@ -103,7 +103,8 @@ class PPCOperandConverter final : public InstructionOperandConverter {
     UNREACHABLE();
   }
 
-  MemOperand MemoryOperand(AddressingMode* mode, size_t first_index = 0) {
+  MemOperand MemoryOperand(AddressingMode* mode = NULL,
+                           size_t first_index = 0) {
     return MemoryOperand(mode, &first_index);
   }
 
@@ -166,6 +167,9 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
     if (mode_ > RecordWriteMode::kValueIsPointer) {
       __ JumpIfSmi(value_, exit());
     }
+    if (COMPRESS_POINTERS_BOOL) {
+      __ DecompressTaggedPointer(value_, value_);
+    }
     __ CheckPageFlag(value_, scratch0_,
                      MemoryChunk::kPointersToHereAreInterestingMask, eq,
                      exit());
@@ -831,7 +835,8 @@ void CodeGenerator::BailoutIfDeoptimized() {
   }
 
   int offset = Code::kCodeDataContainerOffset - Code::kHeaderSize;
-  __ LoadP(r11, MemOperand(kJavaScriptCallCodeStartRegister, offset));
+  __ LoadTaggedPointerField(
+      r11, MemOperand(kJavaScriptCallCodeStartRegister, offset));
   __ LoadWordArith(
       r11, FieldMemOperand(r11, CodeDataContainer::kKindSpecificFlagsOffset));
   __ TestBit(r11, Code::kMarkedForDeoptimizationBit);
@@ -938,7 +943,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       // they might need to be patched individually.
       if (instr->InputAt(0)->IsImmediate()) {
         Constant constant = i.ToConstant(instr->InputAt(0));
-#ifdef V8_TARGET_ARCH_S390X
+#ifdef V8_TARGET_ARCH_PPC64
         Address wasm_code = static_cast<Address>(constant.ToInt64());
 #else
         Address wasm_code = static_cast<Address>(constant.ToInt32());
@@ -969,13 +974,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       Register func = i.InputRegister(0);
       if (FLAG_debug_code) {
         // Check the function's context matches the context argument.
-        __ LoadP(kScratchReg,
-                 FieldMemOperand(func, JSFunction::kContextOffset));
+        __ LoadTaggedPointerField(
+            kScratchReg, FieldMemOperand(func, JSFunction::kContextOffset));
         __ cmp(cp, kScratchReg);
         __ Assert(eq, AbortReason::kWrongFunctionContext);
       }
       static_assert(kJavaScriptCallCodeStartRegister == r5, "ABI mismatch");
-      __ LoadP(r5, FieldMemOperand(func, JSFunction::kCodeOffset));
+      __ LoadTaggedPointerField(r5,
+                                FieldMemOperand(func, JSFunction::kCodeOffset));
       __ CallCodeObject(r5);
       RecordCallPosition(instr);
       DCHECK_EQ(LeaveRC, i.OutputRCBit());
@@ -1031,7 +1037,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       Label start_call;
       bool isWasmCapiFunction =
           linkage()->GetIncomingDescriptor()->IsWasmCapiFunction();
-      int offset = 20 * kInstrSize;
+      int offset = (FLAG_enable_embedded_constant_pool ? 20 : 23) * kInstrSize;
+
 #if defined(_AIX)
       // AIX/PPC64BE Linux uses a function descriptor
       int kNumParametersMask = kHasFunctionDescriptorBitMask - 1;
@@ -1041,7 +1048,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       // AIX may emit 2 extra Load instructions under CallCFunctionHelper
       // due to having function descriptor.
       if (has_function_descriptor) {
-        offset = 22 * kInstrSize;
+        offset += 2 * kInstrSize;
       }
 #endif
       if (isWasmCapiFunction) {
@@ -1190,14 +1197,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         ool = new (zone()) OutOfLineRecordWrite(
             this, object, offset, value, scratch0, scratch1, mode,
             DetermineStubCallMode(), &unwinding_info_writer_);
-        __ StoreP(value, MemOperand(object, offset));
+        __ StoreTaggedField(value, MemOperand(object, offset), r0);
       } else {
         DCHECK_EQ(kMode_MRR, addressing_mode);
         Register offset(i.InputRegister(1));
         ool = new (zone()) OutOfLineRecordWrite(
             this, object, offset, value, scratch0, scratch1, mode,
             DetermineStubCallMode(), &unwinding_info_writer_);
-        __ StorePX(value, MemOperand(object, offset));
+        __ StoreTaggedFieldX(value, MemOperand(object, offset), r0);
       }
       __ CheckPageFlag(object, scratch0,
                        MemoryChunk::kPointersFromHereAreInterestingMask, ne,
@@ -1991,6 +1998,18 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kPPC_LoadDouble:
       ASSEMBLE_LOAD_FLOAT(lfd, lfdx);
       break;
+    case kPPC_LoadSimd128: {
+      Simd128Register result = i.OutputSimd128Register();
+      AddressingMode mode = kMode_None;
+      MemOperand operand = i.MemoryOperand(&mode);
+      bool is_atomic = i.InputInt32(2);
+      // lvx only supports MRR.
+      DCHECK_EQ(mode, kMode_MRR);
+      __ lvx(result, operand);
+      if (is_atomic) __ lwsync();
+      DCHECK_EQ(LeaveRC, i.OutputRCBit());
+      break;
+    }
     case kPPC_StoreWord8:
       ASSEMBLE_STORE_INTEGER(stb, stbx);
       break;
@@ -2011,6 +2030,20 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kPPC_StoreDouble:
       ASSEMBLE_STORE_FLOAT(stfd, stfdx);
       break;
+    case kPPC_StoreSimd128: {
+      size_t index = 0;
+      AddressingMode mode = kMode_None;
+      MemOperand operand = i.MemoryOperand(&mode, &index);
+      Simd128Register value = i.InputSimd128Register(index);
+      bool is_atomic = i.InputInt32(3);
+      if (is_atomic) __ lwsync();
+      // stvx only supports MRR.
+      DCHECK_EQ(mode, kMode_MRR);
+      __ stvx(value, operand);
+      if (is_atomic) __ sync();
+      DCHECK_EQ(LeaveRC, i.OutputRCBit());
+      break;
+    }
     case kWord32AtomicLoadInt8:
     case kPPC_AtomicLoadUint8:
     case kWord32AtomicLoadInt16:
@@ -2120,6 +2153,364 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
 #endif  // V8_TARGET_ARCH_PPC64
+    case kPPC_F64x2Splat: {
+      Simd128Register dst = i.OutputSimd128Register();
+      constexpr int shift_bits = 64;
+      __ MovDoubleToInt64(r0, i.InputDoubleRegister(0));
+      __ mtvsrd(dst, r0);
+      // right shift
+      __ li(ip, Operand(shift_bits));
+      __ mtvsrd(kScratchDoubleReg, ip);
+      __ vspltb(kScratchDoubleReg, kScratchDoubleReg, Operand(7));
+      __ vsro(dst, dst, kScratchDoubleReg);
+      // reload
+      __ vxor(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
+      __ mtvsrd(kScratchDoubleReg, r0);
+      __ vor(dst, dst, kScratchDoubleReg);
+      break;
+    }
+    case kPPC_F32x4Splat: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ MovFloatToInt(kScratchReg, i.InputDoubleRegister(0));
+      __ mtvsrd(dst, kScratchReg);
+      __ vspltw(dst, dst, Operand(1));
+      break;
+    }
+    case kPPC_I64x2Splat: {
+      Register src = i.InputRegister(0);
+      Simd128Register dst = i.OutputSimd128Register();
+      constexpr int shift_bits = 64;
+      __ mtvsrd(dst, src);
+      // right shift
+      __ li(ip, Operand(shift_bits));
+      __ mtvsrd(kScratchDoubleReg, ip);
+      __ vspltb(kScratchDoubleReg, kScratchDoubleReg, Operand(7));
+      __ vsro(dst, dst, kScratchDoubleReg);
+      // reload
+      __ vxor(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
+      __ mtvsrd(kScratchDoubleReg, src);
+      __ vor(dst, dst, kScratchDoubleReg);
+      break;
+    }
+    case kPPC_I32x4Splat: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ mtvsrd(dst, i.InputRegister(0));
+      __ vspltw(dst, dst, Operand(1));
+      break;
+    }
+    case kPPC_I16x8Splat: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ mtvsrd(dst, i.InputRegister(0));
+      __ vsplth(dst, dst, Operand(3));
+      break;
+    }
+    case kPPC_I8x16Splat: {
+      Simd128Register dst = i.OutputSimd128Register();
+      __ mtvsrd(dst, i.InputRegister(0));
+      __ vspltb(dst, dst, Operand(7));
+      break;
+    }
+#define SHIFT_TO_CORRECT_LANE(starting_lane_nummber, lane_input,   \
+                              lane_width_in_bytes, input_register) \
+  int shift_bits = abs(lane_input - starting_lane_nummber) *       \
+                   lane_width_in_bytes * kBitsPerByte;             \
+  if (shift_bits > 0) {                                            \
+    __ li(ip, Operand(shift_bits));                                \
+    __ mtvsrd(kScratchDoubleReg, ip);                              \
+    __ vspltb(kScratchDoubleReg, kScratchDoubleReg, Operand(7));   \
+    if (lane_input < starting_lane_nummber) {                      \
+      __ vsro(input_register, input_register, kScratchDoubleReg);  \
+    } else if (lane_input > starting_lane_nummber) {               \
+      __ vslo(input_register, input_register, kScratchDoubleReg);  \
+    }                                                              \
+  }
+    case kPPC_F64x2ExtractLane: {
+      int32_t lane = 1 - i.InputInt8(1);
+      SHIFT_TO_CORRECT_LANE(0, lane, 8, i.InputSimd128Register(0))
+      __ mfvsrd(kScratchReg, i.InputSimd128Register(0));
+      __ MovInt64ToDouble(i.OutputDoubleRegister(), kScratchReg);
+      break;
+    }
+    case kPPC_F32x4ExtractLane: {
+      int32_t lane = 3 - i.InputInt8(1);
+      SHIFT_TO_CORRECT_LANE(1, lane, 4, i.InputSimd128Register(0))
+      __ mfvsrwz(kScratchReg, i.InputSimd128Register(0));
+      __ MovIntToFloat(i.OutputDoubleRegister(), kScratchReg);
+      break;
+    }
+    case kPPC_I64x2ExtractLane: {
+      int32_t lane = 1 - i.InputInt8(1);
+      SHIFT_TO_CORRECT_LANE(0, lane, 8, i.InputSimd128Register(0))
+      __ mfvsrd(i.OutputRegister(), i.InputSimd128Register(0));
+      break;
+    }
+    case kPPC_I32x4ExtractLane: {
+      int32_t lane = 3 - i.InputInt8(1);
+      SHIFT_TO_CORRECT_LANE(1, lane, 4, i.InputSimd128Register(0))
+      __ mfvsrwz(i.OutputRegister(), i.InputSimd128Register(0));
+      break;
+    }
+    case kPPC_I16x8ExtractLaneU: {
+      int32_t lane = 7 - i.InputInt8(1);
+      SHIFT_TO_CORRECT_LANE(2, lane, 2, i.InputSimd128Register(0))
+      __ mfvsrwz(r0, i.InputSimd128Register(0));
+      __ li(ip, Operand(16));
+      __ srd(i.OutputRegister(), r0, ip);
+      break;
+    }
+    case kPPC_I16x8ExtractLaneS: {
+      int32_t lane = 7 - i.InputInt8(1);
+      SHIFT_TO_CORRECT_LANE(2, lane, 2, i.InputSimd128Register(0))
+      __ mfvsrwz(kScratchReg, i.InputSimd128Register(0));
+      __ sradi(i.OutputRegister(), kScratchReg, 16);
+      break;
+    }
+    case kPPC_I8x16ExtractLaneU: {
+      int32_t lane = 15 - i.InputInt8(1);
+      SHIFT_TO_CORRECT_LANE(4, lane, 1, i.InputSimd128Register(0))
+      __ mfvsrwz(r0, i.InputSimd128Register(0));
+      __ li(ip, Operand(24));
+      __ srd(i.OutputRegister(), r0, ip);
+      break;
+    }
+    case kPPC_I8x16ExtractLaneS: {
+      int32_t lane = 15 - i.InputInt8(1);
+      SHIFT_TO_CORRECT_LANE(4, lane, 1, i.InputSimd128Register(0))
+      __ mfvsrwz(kScratchReg, i.InputSimd128Register(0));
+      __ sradi(i.OutputRegister(), kScratchReg, 24);
+      break;
+    }
+#undef SHIFT_TO_CORRECT_LANE
+#define GENERATE_REPLACE_LANE_MASK(lane, replacement_value_byte_lane, \
+                                   lane_width_in_bytes)               \
+  uint64_t mask = 0;                                                  \
+  for (int i = 0, j = 0; i <= kSimd128Size - 1; i++) {                \
+    mask <<= kBitsPerByte;                                            \
+    if (i >= lane * lane_width_in_bytes &&                            \
+        i < lane * lane_width_in_bytes + lane_width_in_bytes) {       \
+      mask |= replacement_value_byte_lane + j;                        \
+      j++;                                                            \
+    } else {                                                          \
+      mask |= i;                                                      \
+    }                                                                 \
+    if (i == (kSimd128Size / 2) - 1) {                                \
+      __ mov(r0, Operand(mask));                                      \
+      mask = 0;                                                       \
+    } else if (i >= kSimd128Size - 1) {                               \
+      __ mov(ip, Operand(mask));                                      \
+    }                                                                 \
+  }                                                                   \
+  /* Need to maintain 16 byte alignment for lvx */                    \
+  __ addi(sp, sp, Operand(-24));                                      \
+  __ StoreP(ip, MemOperand(sp, 0));                                   \
+  __ StoreP(r0, MemOperand(sp, 8));                                   \
+  __ li(r0, Operand(0));                                              \
+  __ lvx(kScratchDoubleReg, MemOperand(sp, r0));                      \
+  __ addi(sp, sp, Operand(24));
+    case kPPC_F64x2ReplaceLane: {
+      Simd128Register src = i.InputSimd128Register(0);
+      Simd128Register dst = i.OutputSimd128Register();
+      int32_t lane = 1 - i.InputInt8(1);
+      constexpr int replacement_value_byte_lane = 16;
+      constexpr int lane_width_in_bytes = 8;
+      GENERATE_REPLACE_LANE_MASK(lane, replacement_value_byte_lane,
+                                 lane_width_in_bytes)
+      __ MovDoubleToInt64(r0, i.InputDoubleRegister(2));
+      __ mtvsrd(dst, r0);
+      __ vperm(dst, src, dst, kScratchDoubleReg);
+      break;
+    }
+    case kPPC_F32x4ReplaceLane: {
+      Simd128Register src = i.InputSimd128Register(0);
+      Simd128Register dst = i.OutputSimd128Register();
+      int32_t lane = 3 - i.InputInt8(1);
+      constexpr int replacement_value_byte_lane = 20;
+      constexpr int lane_width_in_bytes = 4;
+      GENERATE_REPLACE_LANE_MASK(lane, replacement_value_byte_lane,
+                                 lane_width_in_bytes)
+      __ MovFloatToInt(kScratchReg, i.InputDoubleRegister(2));
+      __ mtvsrd(dst, kScratchReg);
+      __ vperm(dst, src, dst, kScratchDoubleReg);
+      break;
+    }
+    case kPPC_I64x2ReplaceLane: {
+      Simd128Register src = i.InputSimd128Register(0);
+      Simd128Register dst = i.OutputSimd128Register();
+      int32_t lane = 1 - i.InputInt8(1);
+      constexpr int replacement_value_byte_lane = 16;
+      constexpr int lane_width_in_bytes = 8;
+      GENERATE_REPLACE_LANE_MASK(lane, replacement_value_byte_lane,
+                                 lane_width_in_bytes)
+      __ mtvsrd(dst, i.InputRegister(2));
+      __ vperm(dst, src, dst, kScratchDoubleReg);
+      break;
+    }
+    case kPPC_I32x4ReplaceLane: {
+      Simd128Register src = i.InputSimd128Register(0);
+      Simd128Register dst = i.OutputSimd128Register();
+      int32_t lane = 3 - i.InputInt8(1);
+      constexpr int replacement_value_byte_lane = 20;
+      constexpr int lane_width_in_bytes = 4;
+      GENERATE_REPLACE_LANE_MASK(lane, replacement_value_byte_lane,
+                                 lane_width_in_bytes)
+      __ mtvsrd(dst, i.InputRegister(2));
+      __ vperm(dst, src, dst, kScratchDoubleReg);
+      break;
+    }
+    case kPPC_I16x8ReplaceLane: {
+      Simd128Register src = i.InputSimd128Register(0);
+      Simd128Register dst = i.OutputSimd128Register();
+      int32_t lane = 7 - i.InputInt8(1);
+      constexpr int replacement_value_byte_lane = 22;
+      constexpr int lane_width_in_bytes = 2;
+      GENERATE_REPLACE_LANE_MASK(lane, replacement_value_byte_lane,
+                                 lane_width_in_bytes)
+      __ mtvsrd(dst, i.InputRegister(2));
+      __ vperm(dst, src, dst, kScratchDoubleReg);
+      break;
+    }
+    case kPPC_I8x16ReplaceLane: {
+      Simd128Register src = i.InputSimd128Register(0);
+      Simd128Register dst = i.OutputSimd128Register();
+      int32_t lane = 15 - i.InputInt8(1);
+      constexpr int replacement_value_byte_lane = 23;
+      constexpr int lane_width_in_bytes = 1;
+      GENERATE_REPLACE_LANE_MASK(lane, replacement_value_byte_lane,
+                                 lane_width_in_bytes)
+      __ mtvsrd(dst, i.InputRegister(2));
+      __ vperm(dst, src, dst, kScratchDoubleReg);
+      break;
+    }
+#undef GENERATE_REPLACE_LANE_MASK
+    case kPPC_F64x2Add: {
+      __ xvadddp(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
+      break;
+    }
+    case kPPC_F64x2Sub: {
+      __ xvsubdp(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
+      break;
+    }
+    case kPPC_F64x2Mul: {
+      __ xvmuldp(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
+      break;
+    }
+    case kPPC_F32x4Add: {
+      __ vaddfp(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kPPC_F32x4Sub: {
+      __ vsubfp(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                i.InputSimd128Register(1));
+      break;
+    }
+    case kPPC_F32x4Mul: {
+      __ xvmulsp(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
+      break;
+    }
+    case kPPC_I64x2Add: {
+      __ vaddudm(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
+      break;
+    }
+    case kPPC_I64x2Sub: {
+      __ vsubudm(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
+      break;
+    }
+    case kPPC_I64x2Mul: {
+      // Need to maintain 16 byte alignment for stvx and lvx.
+      __ addi(sp, sp, Operand(-40));
+      __ li(r0, Operand(0));
+      __ stvx(i.InputSimd128Register(0), MemOperand(sp, r0));
+      __ li(r0, Operand(16));
+      __ stvx(i.InputSimd128Register(1), MemOperand(sp, r0));
+      for (int i = 0; i < 2; i++) {
+        __ LoadP(r0, MemOperand(sp, kBitsPerByte * i));
+        __ LoadP(ip, MemOperand(sp, (kBitsPerByte * i) + kSimd128Size));
+        __ mulld(r0, r0, ip);
+        __ StoreP(r0, MemOperand(sp, i * kBitsPerByte));
+      }
+      __ li(r0, Operand(0));
+      __ lvx(i.OutputSimd128Register(), MemOperand(sp, r0));
+      __ addi(sp, sp, Operand(40));
+      break;
+    }
+    case kPPC_I32x4Add: {
+      __ vadduwm(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
+      break;
+    }
+    case kPPC_I32x4Sub: {
+      __ vsubuwm(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
+      break;
+    }
+    case kPPC_I32x4Mul: {
+      __ vmuluwm(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
+      break;
+    }
+    case kPPC_I16x8Add: {
+      __ vadduhm(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
+      break;
+    }
+    case kPPC_I16x8Sub: {
+      __ vsubuhm(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
+      break;
+    }
+    case kPPC_I16x8Mul: {
+      __ vxor(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
+      __ vmladduhm(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                   i.InputSimd128Register(1), kScratchDoubleReg);
+      break;
+    }
+    case kPPC_I8x16Add: {
+      __ vaddubm(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
+      break;
+    }
+    case kPPC_I8x16Sub: {
+      __ vsububm(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
+      break;
+    }
+    case kPPC_I8x16Mul: {
+      __ vmuleub(kScratchDoubleReg, i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
+      __ vmuloub(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                 i.InputSimd128Register(1));
+      __ vpkuhum(i.OutputSimd128Register(), kScratchDoubleReg,
+                 i.OutputSimd128Register());
+      break;
+    }
+    case kPPC_StoreCompressTagged: {
+      ASSEMBLE_STORE_INTEGER(StoreTaggedField, StoreTaggedFieldX);
+      break;
+    }
+    case kPPC_LoadDecompressTaggedSigned: {
+      CHECK(instr->HasOutput());
+      ASSEMBLE_LOAD_INTEGER(lwz, lwzx);
+      break;
+    }
+    case kPPC_LoadDecompressTaggedPointer: {
+      CHECK(instr->HasOutput());
+      ASSEMBLE_LOAD_INTEGER(lwz, lwzx);
+      __ add(i.OutputRegister(), i.OutputRegister(), kRootRegister);
+      break;
+    }
+    case kPPC_LoadDecompressAnyTagged: {
+      CHECK(instr->HasOutput());
+      ASSEMBLE_LOAD_INTEGER(lwz, lwzx);
+      __ add(i.OutputRegister(), i.OutputRegister(), kRootRegister);
+      break;
+    }
     default:
       UNREACHABLE();
   }
@@ -2198,7 +2589,7 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         __ PrepareCallCFunction(0, 0, cp);
         __ CallCFunction(
             ExternalReference::wasm_call_trap_callback_for_testing(), 0);
-        __ LeaveFrame(StackFrame::WASM_COMPILED);
+        __ LeaveFrame(StackFrame::WASM);
         auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
         int pop_count =
             static_cast<int>(call_descriptor->StackParameterCount());
@@ -2391,10 +2782,12 @@ void CodeGenerator::AssembleConstructFrame() {
         // Unpack the tuple into the instance and the target callable.
         // This must be done here in the codegen because it cannot be expressed
         // properly in the graph.
-        __ LoadP(kJSFunctionRegister,
-                 FieldMemOperand(kWasmInstanceRegister, Tuple2::kValue2Offset));
-        __ LoadP(kWasmInstanceRegister,
-                 FieldMemOperand(kWasmInstanceRegister, Tuple2::kValue1Offset));
+        __ LoadTaggedPointerField(
+            kJSFunctionRegister,
+            FieldMemOperand(kWasmInstanceRegister, Tuple2::kValue2Offset));
+        __ LoadTaggedPointerField(
+            kWasmInstanceRegister,
+            FieldMemOperand(kWasmInstanceRegister, Tuple2::kValue1Offset));
         __ Push(kWasmInstanceRegister);
         if (call_descriptor->IsWasmCapiFunction()) {
           // Reserve space for saving the PC later.
@@ -2623,8 +3016,19 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
           }
           break;
         }
-        case Constant::kCompressedHeapObject:
-          UNREACHABLE();
+        case Constant::kCompressedHeapObject: {
+          Handle<HeapObject> src_object = src.ToHeapObject();
+          RootIndex index;
+          if (IsMaterializableFromRoot(src_object, &index)) {
+            __ LoadRoot(dst, index);
+          } else {
+            // TODO(v8:7703, jyan@ca.ibm.com): Turn into a
+            // COMPRESSED_EMBEDDED_OBJECT when the constant pool entry size is
+            // tagged size.
+            __ Move(dst, src_object, RelocInfo::FULL_EMBEDDED_OBJECT);
+          }
+          break;
+        }
         case Constant::kRpoNumber:
           UNREACHABLE();  // TODO(dcarney): loading RPO constants on PPC.
           break;
diff --git a/deps/v8/src/compiler/backend/ppc/instruction-codes-ppc.h b/deps/v8/src/compiler/backend/ppc/instruction-codes-ppc.h
index 82d1d40b5bc..8a44d88a026 100644
--- a/deps/v8/src/compiler/backend/ppc/instruction-codes-ppc.h
+++ b/deps/v8/src/compiler/backend/ppc/instruction-codes-ppc.h
@@ -121,12 +121,14 @@ namespace compiler {
   V(PPC_LoadWord64)                  \
   V(PPC_LoadFloat32)                 \
   V(PPC_LoadDouble)                  \
+  V(PPC_LoadSimd128)                 \
   V(PPC_StoreWord8)                  \
   V(PPC_StoreWord16)                 \
   V(PPC_StoreWord32)                 \
   V(PPC_StoreWord64)                 \
   V(PPC_StoreFloat32)                \
   V(PPC_StoreDouble)                 \
+  V(PPC_StoreSimd128)                \
   V(PPC_ByteRev32)                   \
   V(PPC_ByteRev64)                   \
   V(PPC_CompressSigned)              \
@@ -187,7 +189,49 @@ namespace compiler {
   V(PPC_AtomicXorInt8)               \
   V(PPC_AtomicXorInt16)              \
   V(PPC_AtomicXorInt32)              \
-  V(PPC_AtomicXorInt64)
+  V(PPC_AtomicXorInt64)              \
+  V(PPC_F64x2Splat)                  \
+  V(PPC_F64x2ExtractLane)            \
+  V(PPC_F64x2ReplaceLane)            \
+  V(PPC_F64x2Add)                    \
+  V(PPC_F64x2Sub)                    \
+  V(PPC_F64x2Mul)                    \
+  V(PPC_F32x4Splat)                  \
+  V(PPC_F32x4ExtractLane)            \
+  V(PPC_F32x4ReplaceLane)            \
+  V(PPC_F32x4Add)                    \
+  V(PPC_F32x4Sub)                    \
+  V(PPC_F32x4Mul)                    \
+  V(PPC_I64x2Splat)                  \
+  V(PPC_I64x2ExtractLane)            \
+  V(PPC_I64x2ReplaceLane)            \
+  V(PPC_I64x2Add)                    \
+  V(PPC_I64x2Sub)                    \
+  V(PPC_I64x2Mul)                    \
+  V(PPC_I32x4Splat)                  \
+  V(PPC_I32x4ExtractLane)            \
+  V(PPC_I32x4ReplaceLane)            \
+  V(PPC_I32x4Add)                    \
+  V(PPC_I32x4Sub)                    \
+  V(PPC_I32x4Mul)                    \
+  V(PPC_I16x8Splat)                  \
+  V(PPC_I16x8ExtractLaneU)           \
+  V(PPC_I16x8ExtractLaneS)           \
+  V(PPC_I16x8ReplaceLane)            \
+  V(PPC_I16x8Add)                    \
+  V(PPC_I16x8Sub)                    \
+  V(PPC_I16x8Mul)                    \
+  V(PPC_I8x16Splat)                  \
+  V(PPC_I8x16ExtractLaneU)           \
+  V(PPC_I8x16ExtractLaneS)           \
+  V(PPC_I8x16ReplaceLane)            \
+  V(PPC_I8x16Add)                    \
+  V(PPC_I8x16Sub)                    \
+  V(PPC_I8x16Mul)                    \
+  V(PPC_StoreCompressTagged)         \
+  V(PPC_LoadDecompressTaggedSigned)  \
+  V(PPC_LoadDecompressTaggedPointer) \
+  V(PPC_LoadDecompressAnyTagged)
 
 // Addressing modes represent the "shape" of inputs to an instruction.
 // Many instructions support multiple addressing modes. Addressing modes
diff --git a/deps/v8/src/compiler/backend/ppc/instruction-scheduler-ppc.cc b/deps/v8/src/compiler/backend/ppc/instruction-scheduler-ppc.cc
index 3062dfb53d0..7187ab5b126 100644
--- a/deps/v8/src/compiler/backend/ppc/instruction-scheduler-ppc.cc
+++ b/deps/v8/src/compiler/backend/ppc/instruction-scheduler-ppc.cc
@@ -113,6 +113,44 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kPPC_CompressSigned:
     case kPPC_CompressPointer:
     case kPPC_CompressAny:
+    case kPPC_F64x2Splat:
+    case kPPC_F64x2ExtractLane:
+    case kPPC_F64x2ReplaceLane:
+    case kPPC_F64x2Add:
+    case kPPC_F64x2Sub:
+    case kPPC_F64x2Mul:
+    case kPPC_F32x4Splat:
+    case kPPC_F32x4ExtractLane:
+    case kPPC_F32x4ReplaceLane:
+    case kPPC_F32x4Add:
+    case kPPC_F32x4Sub:
+    case kPPC_F32x4Mul:
+    case kPPC_I64x2Splat:
+    case kPPC_I64x2ExtractLane:
+    case kPPC_I64x2ReplaceLane:
+    case kPPC_I64x2Add:
+    case kPPC_I64x2Sub:
+    case kPPC_I64x2Mul:
+    case kPPC_I32x4Splat:
+    case kPPC_I32x4ExtractLane:
+    case kPPC_I32x4ReplaceLane:
+    case kPPC_I32x4Add:
+    case kPPC_I32x4Sub:
+    case kPPC_I32x4Mul:
+    case kPPC_I16x8Splat:
+    case kPPC_I16x8ExtractLaneU:
+    case kPPC_I16x8ExtractLaneS:
+    case kPPC_I16x8ReplaceLane:
+    case kPPC_I16x8Add:
+    case kPPC_I16x8Sub:
+    case kPPC_I16x8Mul:
+    case kPPC_I8x16Splat:
+    case kPPC_I8x16ExtractLaneU:
+    case kPPC_I8x16ExtractLaneS:
+    case kPPC_I8x16ReplaceLane:
+    case kPPC_I8x16Add:
+    case kPPC_I8x16Sub:
+    case kPPC_I8x16Mul:
       return kNoOpcodeFlags;
 
     case kPPC_LoadWordS8:
@@ -124,11 +162,15 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kPPC_LoadWord64:
     case kPPC_LoadFloat32:
     case kPPC_LoadDouble:
+    case kPPC_LoadSimd128:
     case kPPC_AtomicLoadUint8:
     case kPPC_AtomicLoadUint16:
     case kPPC_AtomicLoadWord32:
     case kPPC_AtomicLoadWord64:
     case kPPC_Peek:
+    case kPPC_LoadDecompressTaggedSigned:
+    case kPPC_LoadDecompressTaggedPointer:
+    case kPPC_LoadDecompressAnyTagged:
       return kIsLoadOperation;
 
     case kPPC_StoreWord8:
@@ -137,6 +179,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kPPC_StoreWord64:
     case kPPC_StoreFloat32:
     case kPPC_StoreDouble:
+    case kPPC_StoreSimd128:
+    case kPPC_StoreCompressTagged:
     case kPPC_Push:
     case kPPC_PushFrame:
     case kPPC_StoreToStackSlot:
diff --git a/deps/v8/src/compiler/backend/ppc/instruction-selector-ppc.cc b/deps/v8/src/compiler/backend/ppc/instruction-selector-ppc.cc
index 7e29b00c312..003d05f7b88 100644
--- a/deps/v8/src/compiler/backend/ppc/instruction-selector-ppc.cc
+++ b/deps/v8/src/compiler/backend/ppc/instruction-selector-ppc.cc
@@ -191,16 +191,39 @@ void InstructionSelector::VisitLoad(Node* node) {
     case MachineRepresentation::kWord32:
       opcode = kPPC_LoadWordU32;
       break;
+    case MachineRepresentation::kCompressedPointer:  // Fall through.
+    case MachineRepresentation::kCompressed:
+#ifdef V8_COMPRESS_POINTERS
+      opcode = kPPC_LoadWordS32;
+      mode = kInt16Imm_4ByteAligned;
+      break;
+#else
+      UNREACHABLE();
+#endif
+#ifdef V8_COMPRESS_POINTERS
+    case MachineRepresentation::kTaggedSigned:
+      opcode = kPPC_LoadDecompressTaggedSigned;
+      break;
+    case MachineRepresentation::kTaggedPointer:
+      opcode = kPPC_LoadDecompressTaggedPointer;
+      break;
+    case MachineRepresentation::kTagged:
+      opcode = kPPC_LoadDecompressAnyTagged;
+      break;
+#else
     case MachineRepresentation::kTaggedSigned:   // Fall through.
     case MachineRepresentation::kTaggedPointer:  // Fall through.
     case MachineRepresentation::kTagged:         // Fall through.
+#endif
     case MachineRepresentation::kWord64:
       opcode = kPPC_LoadWord64;
       mode = kInt16Imm_4ByteAligned;
       break;
-    case MachineRepresentation::kCompressedPointer:  // Fall through.
-    case MachineRepresentation::kCompressed:         // Fall through.
-    case MachineRepresentation::kSimd128:  // Fall through.
+    case MachineRepresentation::kSimd128:
+      opcode = kPPC_LoadSimd128;
+      // Vectors do not support MRI mode, only MRR is available.
+      mode = kNoImmediate;
+      break;
     case MachineRepresentation::kNone:
       UNREACHABLE();
   }
@@ -257,7 +280,7 @@ void InstructionSelector::VisitStore(Node* node) {
 
   if (write_barrier_kind != kNoWriteBarrier &&
       V8_LIKELY(!FLAG_disable_write_barriers)) {
-    DCHECK(CanBeTaggedPointer(rep));
+    DCHECK(CanBeTaggedOrCompressedPointer(rep));
     AddressingMode addressing_mode;
     InstructionOperand inputs[3];
     size_t input_count = 0;
@@ -302,28 +325,33 @@ void InstructionSelector::VisitStore(Node* node) {
       case MachineRepresentation::kWord16:
         opcode = kPPC_StoreWord16;
         break;
-#if !V8_TARGET_ARCH_PPC64
-      case MachineRepresentation::kTaggedSigned:   // Fall through.
-      case MachineRepresentation::kTaggedPointer:  // Fall through.
-      case MachineRepresentation::kTagged:         // Fall through.
-#endif
       case MachineRepresentation::kWord32:
         opcode = kPPC_StoreWord32;
         break;
-#if V8_TARGET_ARCH_PPC64
+      case MachineRepresentation::kCompressedPointer:  // Fall through.
+      case MachineRepresentation::kCompressed:
+#ifdef V8_COMPRESS_POINTERS
+        opcode = kPPC_StoreCompressTagged;
+        break;
+#else
+        UNREACHABLE();
+        break;
+#endif
       case MachineRepresentation::kTaggedSigned:   // Fall through.
       case MachineRepresentation::kTaggedPointer:  // Fall through.
-      case MachineRepresentation::kTagged:         // Fall through.
+      case MachineRepresentation::kTagged:
+        mode = kInt16Imm_4ByteAligned;
+        opcode = kPPC_StoreCompressTagged;
+        break;
       case MachineRepresentation::kWord64:
         opcode = kPPC_StoreWord64;
         mode = kInt16Imm_4ByteAligned;
         break;
-#else
-      case MachineRepresentation::kWord64:  // Fall through.
-#endif
-      case MachineRepresentation::kCompressedPointer:  // Fall through.
-      case MachineRepresentation::kCompressed:         // Fall through.
-      case MachineRepresentation::kSimd128:  // Fall through.
+      case MachineRepresentation::kSimd128:
+        opcode = kPPC_StoreSimd128;
+        // Vectors do not support MRI mode, only MRR is available.
+        mode = kNoImmediate;
+        break;
       case MachineRepresentation::kNone:
         UNREACHABLE();
         return;
@@ -881,6 +909,10 @@ void InstructionSelector::VisitWord64Sar(Node* node) {
 }
 #endif
 
+void InstructionSelector::VisitWord32Rol(Node* node) { UNREACHABLE(); }
+
+void InstructionSelector::VisitWord64Rol(Node* node) { UNREACHABLE(); }
+
 // TODO(mbrandy): Absorb logical-and into rlwinm?
 void InstructionSelector::VisitWord32Ror(Node* node) {
   VisitRRO(this, kPPC_RotRight32, node, kShift32Imm);
@@ -2088,9 +2120,48 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   UNREACHABLE();
 }
 
+#define SIMD_TYPES(V) \
+  V(F64x2)            \
+  V(F32x4)            \
+  V(I32x4)            \
+  V(I16x8)            \
+  V(I8x16)
+
+#define SIMD_BINOP_LIST(V) \
+  V(F64x2Add)              \
+  V(F64x2Sub)              \
+  V(F64x2Mul)              \
+  V(F32x4Add)              \
+  V(F32x4Sub)              \
+  V(F32x4Mul)              \
+  V(I64x2Add)              \
+  V(I64x2Sub)              \
+  V(I64x2Mul)              \
+  V(I32x4Add)              \
+  V(I32x4Sub)              \
+  V(I32x4Mul)              \
+  V(I16x8Add)              \
+  V(I16x8Sub)              \
+  V(I16x8Mul)              \
+  V(I8x16Add)              \
+  V(I8x16Sub)              \
+  V(I8x16Mul)
+
+#define SIMD_VISIT_SPLAT(Type)                               \
+  void InstructionSelector::Visit##Type##Splat(Node* node) { \
+    PPCOperandGenerator g(this);                             \
+    Emit(kPPC_##Type##Splat, g.DefineAsRegister(node),       \
+         g.UseRegister(node->InputAt(0)));                   \
+  }
+SIMD_TYPES(SIMD_VISIT_SPLAT)
+#undef SIMD_VISIT_SPLAT
+
 #define SIMD_VISIT_EXTRACT_LANE(Type, Sign)                              \
   void InstructionSelector::Visit##Type##ExtractLane##Sign(Node* node) { \
-    UNIMPLEMENTED();                                                     \
+    PPCOperandGenerator g(this);                                         \
+    int32_t lane = OpParameter<int32_t>(node->op());                     \
+    Emit(kPPC_##Type##ExtractLane##Sign, g.DefineAsRegister(node),       \
+         g.UseRegister(node->InputAt(0)), g.UseImmediate(lane));         \
   }
 SIMD_VISIT_EXTRACT_LANE(F64x2, )
 SIMD_VISIT_EXTRACT_LANE(F32x4, )
@@ -2101,20 +2172,41 @@ SIMD_VISIT_EXTRACT_LANE(I8x16, U)
 SIMD_VISIT_EXTRACT_LANE(I8x16, S)
 #undef SIMD_VISIT_EXTRACT_LANE
 
-void InstructionSelector::VisitI32x4Splat(Node* node) { UNIMPLEMENTED(); }
+#define SIMD_VISIT_REPLACE_LANE(Type)                                 \
+  void InstructionSelector::Visit##Type##ReplaceLane(Node* node) {    \
+    PPCOperandGenerator g(this);                                      \
+    int32_t lane = OpParameter<int32_t>(node->op());                  \
+    Emit(kPPC_##Type##ReplaceLane, g.DefineAsRegister(node),          \
+         g.UseUniqueRegister(node->InputAt(0)), g.UseImmediate(lane), \
+         g.UseUniqueRegister(node->InputAt(1)));                      \
+  }
+SIMD_TYPES(SIMD_VISIT_REPLACE_LANE)
+#undef SIMD_VISIT_REPLACE_LANE
+
+#define SIMD_VISIT_BINOP(Opcode)                                          \
+  void InstructionSelector::Visit##Opcode(Node* node) {                   \
+    PPCOperandGenerator g(this);                                          \
+    InstructionOperand temps[] = {g.TempSimd128Register(),                \
+                                  g.TempSimd128Register()};               \
+    Emit(kPPC_##Opcode, g.DefineAsRegister(node),                         \
+         g.UseUniqueRegister(node->InputAt(0)),                           \
+         g.UseUniqueRegister(node->InputAt(1)), arraysize(temps), temps); \
+  }
+SIMD_BINOP_LIST(SIMD_VISIT_BINOP)
+#undef SIMD_VISIT_BINOP
+#undef SIMD_BINOP_LIST
+#undef SIMD_TYPES
 
-void InstructionSelector::VisitI32x4ReplaceLane(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitI32x4BitMask(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitI32x4Add(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitI16x8BitMask(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitI32x4Sub(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitI8x16BitMask(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI32x4Shl(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI32x4ShrS(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitI32x4Mul(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitI32x4MaxS(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI32x4MinS(Node* node) { UNIMPLEMENTED(); }
@@ -2139,30 +2231,20 @@ void InstructionSelector::VisitI32x4GtU(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI32x4GeU(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitI16x8Splat(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI16x8ReplaceLane(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitI16x8Shl(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI16x8ShrS(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI16x8ShrU(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitI16x8Add(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitI16x8AddSaturateS(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitI16x8Sub(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitI16x8SubSaturateS(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitI16x8Mul(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitI16x8MinS(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI16x8MaxS(Node* node) { UNIMPLEMENTED(); }
@@ -2203,18 +2285,10 @@ void InstructionSelector::VisitI8x16RoundingAverageU(Node* node) {
 
 void InstructionSelector::VisitI8x16Neg(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitI8x16Splat(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16ReplaceLane(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16Add(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitI8x16AddSaturateS(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitI8x16Sub(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitI8x16SubSaturateS(Node* node) {
   UNIMPLEMENTED();
 }
@@ -2267,10 +2341,6 @@ void InstructionSelector::VisitF32x4Lt(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitF32x4Le(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitF32x4Splat(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4ReplaceLane(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::EmitPrepareResults(
     ZoneVector<PushParameter>* results, const CallDescriptor* call_descriptor,
     Node* node) {
@@ -2294,12 +2364,6 @@ void InstructionSelector::EmitPrepareResults(
   }
 }
 
-void InstructionSelector::VisitF32x4Add(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4Sub(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF32x4Mul(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitF32x4Sqrt(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitF32x4Div(Node* node) { UNIMPLEMENTED(); }
@@ -2387,17 +2451,17 @@ void InstructionSelector::VisitI8x16UConvertI16x8(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitS1x4AnyTrue(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitV32x4AnyTrue(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitS1x4AllTrue(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitV32x4AllTrue(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitS1x8AnyTrue(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitV16x8AnyTrue(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitS1x8AllTrue(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitV16x8AllTrue(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitS1x16AnyTrue(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitV8x16AnyTrue(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitS1x16AllTrue(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitV8x16AllTrue(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI8x16Shl(Node* node) { UNIMPLEMENTED(); }
 
@@ -2405,28 +2469,16 @@ void InstructionSelector::VisitI8x16ShrS(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI8x16ShrU(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitI8x16Mul(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitS8x16Shuffle(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitS8x16Swizzle(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitF64x2Splat(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF64x2ReplaceLane(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitF64x2Abs(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitF64x2Neg(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitF64x2Sqrt(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitF64x2Add(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF64x2Sub(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitF64x2Mul(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitF64x2Div(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitF64x2Eq(Node* node) { UNIMPLEMENTED(); }
@@ -2439,18 +2491,12 @@ void InstructionSelector::VisitF64x2Le(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI64x2Neg(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitI64x2Add(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI64x2Sub(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitI64x2Shl(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI64x2ShrS(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI64x2ShrU(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitI64x2Mul(Node* node) { UNIMPLEMENTED(); }
-
 void InstructionSelector::VisitF64x2Min(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitF64x2Max(Node* node) { UNIMPLEMENTED(); }
diff --git a/deps/v8/src/compiler/backend/register-allocator.cc b/deps/v8/src/compiler/backend/register-allocator.cc
index 9420269ca0a..8b74ef68b14 100644
--- a/deps/v8/src/compiler/backend/register-allocator.cc
+++ b/deps/v8/src/compiler/backend/register-allocator.cc
@@ -519,6 +519,16 @@ UsePosition* LiveRange::PreviousUsePositionRegisterIsBeneficial(
   return prev;
 }
 
+UsePosition* LiveRange::NextUsePositionSpillDetrimental(
+    LifetimePosition start) const {
+  UsePosition* pos = NextUsePosition(start);
+  while (pos != nullptr && pos->type() != UsePositionType::kRequiresRegister &&
+         !pos->SpillDetrimental()) {
+    pos = pos->next();
+  }
+  return pos;
+}
+
 UsePosition* LiveRange::NextRegisterPosition(LifetimePosition start) const {
   UsePosition* pos = NextUsePosition(start);
   while (pos != nullptr && pos->type() != UsePositionType::kRequiresRegister) {
@@ -2424,6 +2434,15 @@ void LiveRangeBuilder::ProcessInstructions(const InstructionBlock* block,
         if (from.IsUnallocated()) {
           live->Add(UnallocatedOperand::cast(from).virtual_register());
         }
+        // When the value is moved to a register to meet input constraints,
+        // we should consider this value use similar as a register use in the
+        // backward spilling heuristics, even though this value use is not
+        // register benefical at the AllocateBlockedReg stage.
+        if (to.IsAnyRegister() ||
+            (to.IsUnallocated() &&
+             UnallocatedOperand::cast(&to)->HasRegisterPolicy())) {
+          from_use->set_spill_detrimental();
+        }
         // Resolve use position hints just created.
         if (to_use != nullptr && from_use != nullptr) {
           to_use->ResolveHint(from_use);
@@ -2769,6 +2788,7 @@ void BundleBuilder::BuildBundles() {
       }
       TRACE("Processing phi for v%d with %d:%d\n", phi->virtual_register(),
             out_range->TopLevel()->vreg(), out_range->relative_id());
+      bool phi_interferes_with_backedge_input = false;
       for (auto input : phi->operands()) {
         LiveRange* input_range = data()->GetOrCreateLiveRangeFor(input);
         TRACE("Input value v%d with range %d:%d\n", input,
@@ -2776,16 +2796,32 @@ void BundleBuilder::BuildBundles() {
         LiveRangeBundle* input_bundle = input_range->get_bundle();
         if (input_bundle != nullptr) {
           TRACE("Merge\n");
-          if (out->TryMerge(input_bundle, data()->is_trace_alloc()))
+          if (out->TryMerge(input_bundle, data()->is_trace_alloc())) {
             TRACE("Merged %d and %d to %d\n", phi->virtual_register(), input,
                   out->id());
+          } else if (input_range->Start() > out_range->Start()) {
+            // We are only interested in values defined after the phi, because
+            // those are values that will go over a back-edge.
+            phi_interferes_with_backedge_input = true;
+          }
         } else {
           TRACE("Add\n");
-          if (out->TryAddRange(input_range))
+          if (out->TryAddRange(input_range)) {
             TRACE("Added %d and %d to %d\n", phi->virtual_register(), input,
                   out->id());
+          } else if (input_range->Start() > out_range->Start()) {
+            // We are only interested in values defined after the phi, because
+            // those are values that will go over a back-edge.
+            phi_interferes_with_backedge_input = true;
+          }
         }
       }
+      // Spilling the phi at the loop header is not beneficial if there is
+      // a back-edge with an input for the phi that interferes with the phi's
+      // value, because in case that input gets spilled it might introduce
+      // a stack-to-stack move at the back-edge.
+      if (phi_interferes_with_backedge_input)
+        out_range->TopLevel()->set_spilling_at_loop_header_not_beneficial();
     }
     TRACE("Done block B%d\n", block_id);
   }
@@ -3006,6 +3042,12 @@ LifetimePosition RegisterAllocator::FindOptimalSpillingPos(
       // This will reduce number of memory moves on the back edge.
       LifetimePosition loop_start = LifetimePosition::GapFromInstructionIndex(
           loop_header->first_instruction_index());
+      // Stop if we moved to a loop header before the value is defined or
+      // at the define position that is not beneficial to spill.
+      if (range->TopLevel()->Start() > loop_start ||
+          (range->TopLevel()->Start() == loop_start &&
+           range->TopLevel()->SpillAtLoopHeaderNotBeneficial()))
+        return pos;
       auto& loop_header_state =
           data()->GetSpillState(loop_header->rpo_number());
       for (LiveRange* live_at_header : loop_header_state) {
@@ -3016,14 +3058,17 @@ LifetimePosition RegisterAllocator::FindOptimalSpillingPos(
         LiveRange* check_use = live_at_header;
         for (; check_use != nullptr && check_use->Start() < pos;
              check_use = check_use->next()) {
-          UsePosition* next_use = check_use->NextRegisterPosition(loop_start);
+          // If we find a use for which spilling is detrimental, don't spill
+          // at the loop header
+          UsePosition* next_use =
+              check_use->NextUsePositionSpillDetrimental(loop_start);
           // UsePosition at the end of a UseInterval may
           // have the same value as the start of next range.
           if (next_use != nullptr && next_use->pos() <= pos) {
             return pos;
           }
         }
-        // No register use inside the loop before the pos.
+        // No register beneficial use inside the loop before the pos.
         *begin_spill_out = live_at_header;
         pos = loop_start;
         break;
@@ -3825,11 +3870,15 @@ void LinearScanAllocator::AllocateRegisters() {
               auto& spill_state = data()->GetSpillState(pred);
               TRACE("Not a fallthrough. Adding %zu elements...\n",
                     spill_state.size());
+              LifetimePosition pred_end =
+                  LifetimePosition::GapFromInstructionIndex(
+                      this->code()->InstructionBlockAt(pred)->code_end());
               for (const auto range : spill_state) {
-                // Filter out ranges that had their register stolen by backwards
-                // working spill heuristics. These have been spilled after the
-                // fact, so ignore them.
-                if (!range->HasRegisterAssigned()) continue;
+                // Filter out ranges that were split or had their register
+                // stolen by backwards working spill heuristics. These have
+                // been spilled after the fact, so ignore them.
+                if (range->End() < pred_end || !range->HasRegisterAssigned())
+                  continue;
                 to_be_live->emplace(range);
               }
             }
diff --git a/deps/v8/src/compiler/backend/register-allocator.h b/deps/v8/src/compiler/backend/register-allocator.h
index 9e1a7beff9f..f890bd868b7 100644
--- a/deps/v8/src/compiler/backend/register-allocator.h
+++ b/deps/v8/src/compiler/backend/register-allocator.h
@@ -459,6 +459,10 @@ class V8_EXPORT_PRIVATE UsePosition final
   bool RegisterIsBeneficial() const {
     return RegisterBeneficialField::decode(flags_);
   }
+  bool SpillDetrimental() const {
+    return SpillDetrimentalField::decode(flags_);
+  }
+
   UsePositionType type() const { return TypeField::decode(flags_); }
   void set_type(UsePositionType type, bool register_beneficial);
 
@@ -471,6 +475,9 @@ class V8_EXPORT_PRIVATE UsePosition final
   void set_assigned_register(int register_code) {
     flags_ = AssignedRegisterField::update(flags_, register_code);
   }
+  void set_spill_detrimental() {
+    flags_ = SpillDetrimentalField::update(flags_, true);
+  }
 
   UsePositionHintType hint_type() const {
     return HintTypeField::decode(flags_);
@@ -489,6 +496,7 @@ class V8_EXPORT_PRIVATE UsePosition final
   using HintTypeField = base::BitField<UsePositionHintType, 2, 3>;
   using RegisterBeneficialField = base::BitField<bool, 5, 1>;
   using AssignedRegisterField = base::BitField<int32_t, 6, 6>;
+  using SpillDetrimentalField = base::BitField<int32_t, 12, 1>;
 
   InstructionOperand* const operand_;
   void* hint_;
@@ -584,6 +592,10 @@ class V8_EXPORT_PRIVATE LiveRange : public NON_EXPORTED_BASE(ZoneObject) {
   UsePosition* PreviousUsePositionRegisterIsBeneficial(
       LifetimePosition start) const;
 
+  // Returns use position for which spilling is detrimental in this live
+  // range and which follows both start and last processed use position
+  UsePosition* NextUsePositionSpillDetrimental(LifetimePosition start) const;
+
   // Can this live range be spilled at this position.
   bool CanBeSpilled(LifetimePosition pos) const;
 
@@ -675,7 +687,7 @@ class V8_EXPORT_PRIVATE LiveRange : public NON_EXPORTED_BASE(ZoneObject) {
   using RepresentationField = base::BitField<MachineRepresentation, 13, 8>;
   using RecombineField = base::BitField<bool, 21, 1>;
   using ControlFlowRegisterHint = base::BitField<uint8_t, 22, 6>;
-  // Bit 28 is used by TopLevelLiveRange.
+  // Bits 28,29 are used by TopLevelLiveRange.
 
   // Unique among children and splinters of the same virtual register.
   int relative_id_;
@@ -785,6 +797,12 @@ class V8_EXPORT_PRIVATE TopLevelLiveRange final : public LiveRange {
   void set_is_non_loop_phi(bool value) {
     bits_ = IsNonLoopPhiField::update(bits_, value);
   }
+  bool SpillAtLoopHeaderNotBeneficial() const {
+    return SpillAtLoopHeaderNotBeneficialField::decode(bits_);
+  }
+  void set_spilling_at_loop_header_not_beneficial() {
+    bits_ = SpillAtLoopHeaderNotBeneficialField::update(bits_, true);
+  }
 
   enum SlotUseKind { kNoSlotUse, kDeferredSlotUse, kGeneralSlotUse };
 
@@ -991,6 +1009,7 @@ class V8_EXPORT_PRIVATE TopLevelLiveRange final : public LiveRange {
   using IsNonLoopPhiField = base::BitField<bool, 4, 1>;
   using SpillTypeField = base::BitField<SpillType, 5, 2>;
   using DeferredFixedField = base::BitField<bool, 28, 1>;
+  using SpillAtLoopHeaderNotBeneficialField = base::BitField<bool, 29, 1>;
 
   int vreg_;
   int last_child_id_;
diff --git a/deps/v8/src/compiler/backend/s390/code-generator-s390.cc b/deps/v8/src/compiler/backend/s390/code-generator-s390.cc
index 24552cf6327..60d90f6d7e2 100644
--- a/deps/v8/src/compiler/backend/s390/code-generator-s390.cc
+++ b/deps/v8/src/compiler/backend/s390/code-generator-s390.cc
@@ -2,17 +2,16 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/compiler/backend/code-generator.h"
-
 #include "src/codegen/assembler-inl.h"
 #include "src/codegen/callable.h"
 #include "src/codegen/macro-assembler.h"
 #include "src/codegen/optimized-compilation-info.h"
 #include "src/compiler/backend/code-generator-impl.h"
+#include "src/compiler/backend/code-generator.h"
 #include "src/compiler/backend/gap-resolver.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/osr.h"
-#include "src/heap/heap-inl.h"  // crbug.com/v8/8499
+#include "src/heap/memory-chunk.h"
 #include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-objects.h"
 
@@ -3854,10 +3853,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     // vector boolean unops
-    case kS390_S1x2AnyTrue:
-    case kS390_S1x4AnyTrue:
-    case kS390_S1x8AnyTrue:
-    case kS390_S1x16AnyTrue: {
+    case kS390_V64x2AnyTrue:
+    case kS390_V32x4AnyTrue:
+    case kS390_V16x8AnyTrue:
+    case kS390_V8x16AnyTrue: {
       Simd128Register src = i.InputSimd128Register(0);
       Register dst = i.OutputRegister();
       Register temp = i.TempRegister(0);
@@ -3880,19 +3879,19 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
   __ vtm(kScratchDoubleReg, kScratchDoubleReg, Condition(0), Condition(0),     \
          Condition(0));                                                        \
   __ locgr(Condition(8), dst, temp);
-    case kS390_S1x2AllTrue: {
+    case kS390_V64x2AllTrue: {
       SIMD_ALL_TRUE(3)
       break;
     }
-    case kS390_S1x4AllTrue: {
+    case kS390_V32x4AllTrue: {
       SIMD_ALL_TRUE(2)
       break;
     }
-    case kS390_S1x8AllTrue: {
+    case kS390_V16x8AllTrue: {
       SIMD_ALL_TRUE(1)
       break;
     }
-    case kS390_S1x16AllTrue: {
+    case kS390_V8x16AllTrue: {
       SIMD_ALL_TRUE(0)
       break;
     }
@@ -4155,10 +4154,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       for (int i = 0, j = 0; i < 2; i++, j = +2) {
 #ifdef V8_TARGET_BIG_ENDIAN
         __ lgfi(i < 1 ? ip : r0, Operand(k8x16_indices[j + 1]));
-        __ aih(i < 1 ? ip : r0, Operand(k8x16_indices[j]));
+        __ iihf(i < 1 ? ip : r0, Operand(k8x16_indices[j]));
 #else
         __ lgfi(i < 1 ? ip : r0, Operand(k8x16_indices[j]));
-        __ aih(i < 1 ? ip : r0, Operand(k8x16_indices[j + 1]));
+        __ iihf(i < 1 ? ip : r0, Operand(k8x16_indices[j + 1]));
 #endif
       }
       __ vlvgp(kScratchDoubleReg, ip, r0);
@@ -4186,6 +4185,55 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
 #endif
       break;
     }
+    case kS390_I32x4BitMask: {
+#ifdef V8_TARGET_BIG_ENDIAN
+      __ lgfi(kScratchReg, Operand(0x204060));
+      __ iihf(kScratchReg, Operand(0x80808080));  // Zeroing the high bits.
+#else
+      __ lgfi(kScratchReg, Operand(0x80808080));
+      __ iihf(kScratchReg, Operand(0x60402000));
+#endif
+      __ vlvg(kScratchDoubleReg, kScratchReg, MemOperand(r0, 1), Condition(3));
+      __ vbperm(kScratchDoubleReg, i.InputSimd128Register(0), kScratchDoubleReg,
+                Condition(0), Condition(0), Condition(0));
+      __ vlgv(i.OutputRegister(), kScratchDoubleReg, MemOperand(r0, 7),
+              Condition(0));
+      break;
+    }
+    case kS390_I16x8BitMask: {
+#ifdef V8_TARGET_BIG_ENDIAN
+      __ lgfi(kScratchReg, Operand(0x40506070));
+      __ iihf(kScratchReg, Operand(0x102030));
+#else
+      __ lgfi(kScratchReg, Operand(0x30201000));
+      __ iihf(kScratchReg, Operand(0x70605040));
+#endif
+      __ vlvg(kScratchDoubleReg, kScratchReg, MemOperand(r0, 1), Condition(3));
+      __ vbperm(kScratchDoubleReg, i.InputSimd128Register(0), kScratchDoubleReg,
+                Condition(0), Condition(0), Condition(0));
+      __ vlgv(i.OutputRegister(), kScratchDoubleReg, MemOperand(r0, 7),
+              Condition(0));
+      break;
+    }
+    case kS390_I8x16BitMask: {
+#ifdef V8_TARGET_BIG_ENDIAN
+      __ lgfi(r0, Operand(0x60687078));
+      __ iihf(r0, Operand(0x40485058));
+      __ lgfi(ip, Operand(0x20283038));
+      __ iihf(ip, Operand(0x81018));
+#else
+      __ lgfi(ip, Operand(0x58504840));
+      __ iihf(ip, Operand(0x78706860));
+      __ lgfi(r0, Operand(0x18100800));
+      __ iihf(r0, Operand(0x38302820));
+#endif
+      __ vlvgp(kScratchDoubleReg, ip, r0);
+      __ vbperm(kScratchDoubleReg, i.InputSimd128Register(0), kScratchDoubleReg,
+                Condition(0), Condition(0), Condition(0));
+      __ vlgv(i.OutputRegister(), kScratchDoubleReg, MemOperand(r0, 3),
+              Condition(1));
+      break;
+    }
     case kS390_StoreCompressTagged: {
       CHECK(!instr->HasOutput());
       size_t index = 0;
@@ -4285,7 +4333,7 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         __ PrepareCallCFunction(0, 0, cp);
         __ CallCFunction(
             ExternalReference::wasm_call_trap_callback_for_testing(), 0);
-        __ LeaveFrame(StackFrame::WASM_COMPILED);
+        __ LeaveFrame(StackFrame::WASM);
         auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
         int pop_count =
             static_cast<int>(call_descriptor->StackParameterCount());
diff --git a/deps/v8/src/compiler/backend/s390/instruction-codes-s390.h b/deps/v8/src/compiler/backend/s390/instruction-codes-s390.h
index 6101b22166c..a88de2b822c 100644
--- a/deps/v8/src/compiler/backend/s390/instruction-codes-s390.h
+++ b/deps/v8/src/compiler/backend/s390/instruction-codes-s390.h
@@ -286,6 +286,7 @@ namespace compiler {
   V(S390_I32x4UConvertI16x8Low)             \
   V(S390_I32x4UConvertI16x8High)            \
   V(S390_I32x4Abs)                          \
+  V(S390_I32x4BitMask)                      \
   V(S390_I16x8Splat)                        \
   V(S390_I16x8ExtractLaneU)                 \
   V(S390_I16x8ExtractLaneS)                 \
@@ -320,6 +321,7 @@ namespace compiler {
   V(S390_I16x8SubSaturateU)                 \
   V(S390_I16x8RoundingAverageU)             \
   V(S390_I16x8Abs)                          \
+  V(S390_I16x8BitMask)                      \
   V(S390_I8x16Splat)                        \
   V(S390_I8x16ExtractLaneU)                 \
   V(S390_I8x16ExtractLaneS)                 \
@@ -349,16 +351,17 @@ namespace compiler {
   V(S390_I8x16SubSaturateU)                 \
   V(S390_I8x16RoundingAverageU)             \
   V(S390_I8x16Abs)                          \
+  V(S390_I8x16BitMask)                      \
   V(S390_S8x16Shuffle)                      \
   V(S390_S8x16Swizzle)                      \
-  V(S390_S1x2AnyTrue)                       \
-  V(S390_S1x4AnyTrue)                       \
-  V(S390_S1x8AnyTrue)                       \
-  V(S390_S1x16AnyTrue)                      \
-  V(S390_S1x2AllTrue)                       \
-  V(S390_S1x4AllTrue)                       \
-  V(S390_S1x8AllTrue)                       \
-  V(S390_S1x16AllTrue)                      \
+  V(S390_V64x2AnyTrue)                      \
+  V(S390_V32x4AnyTrue)                      \
+  V(S390_V16x8AnyTrue)                      \
+  V(S390_V8x16AnyTrue)                      \
+  V(S390_V64x2AllTrue)                      \
+  V(S390_V32x4AllTrue)                      \
+  V(S390_V16x8AllTrue)                      \
+  V(S390_V8x16AllTrue)                      \
   V(S390_S128And)                           \
   V(S390_S128Or)                            \
   V(S390_S128Xor)                           \
diff --git a/deps/v8/src/compiler/backend/s390/instruction-scheduler-s390.cc b/deps/v8/src/compiler/backend/s390/instruction-scheduler-s390.cc
index 502ce229f50..6fd8935fe37 100644
--- a/deps/v8/src/compiler/backend/s390/instruction-scheduler-s390.cc
+++ b/deps/v8/src/compiler/backend/s390/instruction-scheduler-s390.cc
@@ -232,6 +232,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kS390_I32x4UConvertI16x8Low:
     case kS390_I32x4UConvertI16x8High:
     case kS390_I32x4Abs:
+    case kS390_I32x4BitMask:
     case kS390_I16x8Splat:
     case kS390_I16x8ExtractLaneU:
     case kS390_I16x8ExtractLaneS:
@@ -266,6 +267,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kS390_I16x8SubSaturateU:
     case kS390_I16x8RoundingAverageU:
     case kS390_I16x8Abs:
+    case kS390_I16x8BitMask:
     case kS390_I8x16Splat:
     case kS390_I8x16ExtractLaneU:
     case kS390_I8x16ExtractLaneS:
@@ -295,16 +297,17 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kS390_I8x16SubSaturateU:
     case kS390_I8x16RoundingAverageU:
     case kS390_I8x16Abs:
+    case kS390_I8x16BitMask:
     case kS390_S8x16Shuffle:
     case kS390_S8x16Swizzle:
-    case kS390_S1x2AnyTrue:
-    case kS390_S1x4AnyTrue:
-    case kS390_S1x8AnyTrue:
-    case kS390_S1x16AnyTrue:
-    case kS390_S1x2AllTrue:
-    case kS390_S1x4AllTrue:
-    case kS390_S1x8AllTrue:
-    case kS390_S1x16AllTrue:
+    case kS390_V64x2AnyTrue:
+    case kS390_V32x4AnyTrue:
+    case kS390_V16x8AnyTrue:
+    case kS390_V8x16AnyTrue:
+    case kS390_V64x2AllTrue:
+    case kS390_V32x4AllTrue:
+    case kS390_V16x8AllTrue:
+    case kS390_V8x16AllTrue:
     case kS390_S128And:
     case kS390_S128Or:
     case kS390_S128Xor:
diff --git a/deps/v8/src/compiler/backend/s390/instruction-selector-s390.cc b/deps/v8/src/compiler/backend/s390/instruction-selector-s390.cc
index fdffb30e006..eaec01d4343 100644
--- a/deps/v8/src/compiler/backend/s390/instruction-selector-s390.cc
+++ b/deps/v8/src/compiler/backend/s390/instruction-selector-s390.cc
@@ -1156,6 +1156,10 @@ void InstructionSelector::VisitWord32PairSar(Node* node) {
 }
 #endif
 
+void InstructionSelector::VisitWord32Rol(Node* node) { UNREACHABLE(); }
+
+void InstructionSelector::VisitWord64Rol(Node* node) { UNREACHABLE(); }
+
 void InstructionSelector::VisitWord32Ctz(Node* node) { UNREACHABLE(); }
 
 #if V8_TARGET_ARCH_S390X
@@ -2668,14 +2672,14 @@ void InstructionSelector::VisitWord64AtomicStore(Node* node) {
   V(I8x16ShrU)
 
 #define SIMD_BOOL_LIST(V) \
-  V(S1x2AnyTrue)          \
-  V(S1x4AnyTrue)          \
-  V(S1x8AnyTrue)          \
-  V(S1x16AnyTrue)         \
-  V(S1x2AllTrue)          \
-  V(S1x4AllTrue)          \
-  V(S1x8AllTrue)          \
-  V(S1x16AllTrue)
+  V(V64x2AnyTrue)         \
+  V(V32x4AnyTrue)         \
+  V(V16x8AnyTrue)         \
+  V(V8x16AnyTrue)         \
+  V(V64x2AllTrue)         \
+  V(V32x4AllTrue)         \
+  V(V16x8AllTrue)         \
+  V(V8x16AllTrue)
 
 #define SIMD_CONVERSION_LIST(V) \
   V(I32x4SConvertF32x4)         \
@@ -2790,6 +2794,17 @@ SIMD_VISIT_QFMOP(F64x2Qfms)
 SIMD_VISIT_QFMOP(F32x4Qfma)
 SIMD_VISIT_QFMOP(F32x4Qfms)
 #undef SIMD_VISIT_QFMOP
+
+#define SIMD_VISIT_BITMASK(Opcode)                      \
+  void InstructionSelector::Visit##Opcode(Node* node) { \
+    S390OperandGenerator g(this);                       \
+    Emit(kS390_##Opcode, g.DefineAsRegister(node),      \
+         g.UseUniqueRegister(node->InputAt(0)));        \
+  }
+SIMD_VISIT_BITMASK(I8x16BitMask)
+SIMD_VISIT_BITMASK(I16x8BitMask)
+SIMD_VISIT_BITMASK(I32x4BitMask)
+#undef SIMD_VISIT_BITMASK
 #undef SIMD_TYPES
 
 void InstructionSelector::VisitS8x16Shuffle(Node* node) {
diff --git a/deps/v8/src/compiler/backend/x64/code-generator-x64.cc b/deps/v8/src/compiler/backend/x64/code-generator-x64.cc
index 472ffaa5085..baf0ad438b8 100644
--- a/deps/v8/src/compiler/backend/x64/code-generator-x64.cc
+++ b/deps/v8/src/compiler/backend/x64/code-generator-x64.cc
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/compiler/backend/code-generator.h"
-
 #include <limits>
 
 #include "src/base/overflowing-math.h"
@@ -11,10 +9,11 @@
 #include "src/codegen/optimized-compilation-info.h"
 #include "src/codegen/x64/assembler-x64.h"
 #include "src/compiler/backend/code-generator-impl.h"
+#include "src/compiler/backend/code-generator.h"
 #include "src/compiler/backend/gap-resolver.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/osr.h"
-#include "src/heap/heap-inl.h"  // crbug.com/v8/8499
+#include "src/heap/memory-chunk.h"
 #include "src/objects/smi.h"
 #include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-objects.h"
@@ -323,7 +322,7 @@ class WasmOutOfLineTrap : public OutOfLineCode {
       __ PrepareCallCFunction(0);
       __ CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(),
                        0);
-      __ LeaveFrame(StackFrame::WASM_COMPILED);
+      __ LeaveFrame(StackFrame::WASM);
       auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
       size_t pop_size =
           call_descriptor->StackParameterCount() * kSystemPointerSize;
@@ -588,7 +587,6 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
 
 #define ASSEMBLE_SIMD_ALL_TRUE(opcode)          \
   do {                                          \
-    CpuFeatureScope sse_scope(tasm(), SSE4_1);  \
     Register dst = i.OutputRegister();          \
     XMMRegister tmp = i.TempSimd128Register(0); \
     __ xorq(dst, dst);                          \
@@ -601,20 +599,21 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
 // This macro will directly emit the opcode if the shift is an immediate - the
 // shift value will be taken modulo 2^width. Otherwise, it will emit code to
 // perform the modulus operation.
-#define ASSEMBLE_SIMD_SHIFT(opcode, width)                     \
-  do {                                                         \
-    XMMRegister dst = i.OutputSimd128Register();               \
-    DCHECK_EQ(dst, i.InputSimd128Register(0));                 \
-    if (HasImmediateInput(instr, 1)) {                         \
-      __ opcode(dst, static_cast<byte>(i.InputInt##width(1))); \
-    } else {                                                   \
-      XMMRegister tmp = i.TempSimd128Register(0);              \
-      Register shift = i.InputRegister(1);                     \
-      constexpr int mask = (1 << width) - 1;                   \
-      __ andq(shift, Immediate(mask));                         \
-      __ Movq(tmp, shift);                                     \
-      __ opcode(dst, tmp);                                     \
-    }                                                          \
+#define ASSEMBLE_SIMD_SHIFT(opcode, width)        \
+  do {                                            \
+    XMMRegister dst = i.OutputSimd128Register();  \
+    DCHECK_EQ(dst, i.InputSimd128Register(0));    \
+    if (HasImmediateInput(instr, 1)) {            \
+      __ opcode(dst, byte{i.InputInt##width(1)}); \
+    } else {                                      \
+      XMMRegister tmp = i.TempSimd128Register(0); \
+      Register tmp_shift = i.TempRegister(1);     \
+      constexpr int mask = (1 << width) - 1;      \
+      __ movq(tmp_shift, i.InputRegister(1));     \
+      __ andq(tmp_shift, Immediate(mask));        \
+      __ Movq(tmp, tmp_shift);                    \
+      __ opcode(dst, tmp);                        \
+    }                                             \
   } while (false)
 
 void CodeGenerator::AssembleDeconstructFrame() {
@@ -670,13 +669,13 @@ void AdjustStackPointerForTailCall(TurboAssembler* assembler,
   }
 }
 
-void SetupShuffleMaskOnStack(TurboAssembler* assembler, uint32_t* mask) {
-  int64_t shuffle_mask = (mask[2]) | (static_cast<uint64_t>(mask[3]) << 32);
+void SetupShuffleMaskInTempRegister(TurboAssembler* assembler, uint32_t* mask,
+                                    XMMRegister tmp) {
+  uint64_t shuffle_mask = (mask[0]) | (uint64_t{mask[1]} << 32);
+  assembler->Move(tmp, shuffle_mask);
+  shuffle_mask = (mask[2]) | (uint64_t{mask[3]} << 32);
   assembler->movq(kScratchRegister, shuffle_mask);
-  assembler->Push(kScratchRegister);
-  shuffle_mask = (mask[0]) | (static_cast<uint64_t>(mask[1]) << 32);
-  assembler->movq(kScratchRegister, shuffle_mask);
-  assembler->Push(kScratchRegister);
+  assembler->Pinsrq(tmp, kScratchRegister, int8_t{1});
 }
 
 }  // namespace
@@ -1292,6 +1291,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kX64Sar:
       ASSEMBLE_SHIFT(sarq, 6);
       break;
+    case kX64Rol32:
+      ASSEMBLE_SHIFT(roll, 5);
+      break;
+    case kX64Rol:
+      ASSEMBLE_SHIFT(rolq, 6);
+      break;
     case kX64Ror32:
       ASSEMBLE_SHIFT(rorl, 5);
       break;
@@ -2277,7 +2282,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kX64F64x2Splat: {
-      CpuFeatureScope sse_scope(tasm(), SSE3);
       XMMRegister dst = i.OutputSimd128Register();
       if (instr->InputAt(0)->IsFPRegister()) {
         __ Movddup(dst, i.InputDoubleRegister(0));
@@ -2287,7 +2291,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kX64F64x2ReplaceLane: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       if (instr->InputAt(2)->IsFPRegister()) {
         __ Movq(kScratchRegister, i.InputDoubleRegister(2));
         __ Pinsrq(i.OutputSimd128Register(), kScratchRegister, i.InputInt8(1));
@@ -2297,7 +2300,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kX64F64x2ExtractLane: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       __ Pextrq(kScratchRegister, i.InputSimd128Register(0), i.InputInt8(1));
       __ Movq(i.OutputDoubleRegister(), kScratchRegister);
       break;
@@ -2334,7 +2336,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       // propagate -0's and NaNs, which may be non-canonical.
       __ Orpd(kScratchDoubleReg, dst);
       // Canonicalize NaNs by quieting and clearing the payload.
-      __ Cmppd(dst, kScratchDoubleReg, static_cast<int8_t>(3));
+      __ Cmppd(dst, kScratchDoubleReg, int8_t{3});
       __ Orpd(kScratchDoubleReg, dst);
       __ Psrlq(dst, 13);
       __ Andnpd(dst, kScratchDoubleReg);
@@ -2356,7 +2358,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       // Propagate sign discrepancy and (subtle) quiet NaNs.
       __ Subpd(kScratchDoubleReg, dst);
       // Canonicalize NaNs by clearing the payload. Sign is non-deterministic.
-      __ Cmppd(dst, kScratchDoubleReg, static_cast<int8_t>(3));
+      __ Cmppd(dst, kScratchDoubleReg, int8_t{3});
       __ Psrlq(dst, 13);
       __ Andnpd(dst, kScratchDoubleReg);
       break;
@@ -2415,7 +2417,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       } else {
         __ Movss(dst, i.InputOperand(0));
       }
-      __ Shufps(dst, dst, static_cast<byte>(0x0));
+      __ Shufps(dst, dst, byte{0x0});
       break;
     }
     case kX64F32x4ExtractLane: {
@@ -2442,15 +2444,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kX64F32x4UConvertI32x4: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       DCHECK_NE(i.OutputSimd128Register(), kScratchDoubleReg);
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       XMMRegister dst = i.OutputSimd128Register();
       __ Pxor(kScratchDoubleReg, kScratchDoubleReg);  // zeros
-      __ Pblendw(kScratchDoubleReg, dst,
-                 static_cast<uint8_t>(0x55));             // get lo 16 bits
+      __ Pblendw(kScratchDoubleReg, dst, uint8_t{0x55});  // get lo 16 bits
       __ Psubd(dst, kScratchDoubleReg);                   // get hi 16 bits
       __ Cvtdq2ps(kScratchDoubleReg, kScratchDoubleReg);  // convert lo exactly
-      __ Psrld(dst,
-               static_cast<byte>(1));    // divide by 2 to get in unsigned range
+      __ Psrld(dst, byte{1});            // divide by 2 to get in unsigned range
       __ Cvtdq2ps(dst, dst);             // convert hi exactly
       __ Addps(dst, dst);                // double hi, exactly
       __ Addps(dst, kScratchDoubleReg);  // add hi and lo, may round.
@@ -2461,11 +2460,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       XMMRegister src = i.InputSimd128Register(0);
       if (dst == src) {
         __ Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
-        __ Psrld(kScratchDoubleReg, static_cast<byte>(1));
+        __ Psrld(kScratchDoubleReg, byte{1});
         __ Andps(i.OutputSimd128Register(), kScratchDoubleReg);
       } else {
         __ Pcmpeqd(dst, dst);
-        __ Psrld(dst, static_cast<byte>(1));
+        __ Psrld(dst, byte{1});
         __ Andps(dst, i.InputSimd128Register(0));
       }
       break;
@@ -2475,11 +2474,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       XMMRegister src = i.InputSimd128Register(0);
       if (dst == src) {
         __ Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
-        __ Pslld(kScratchDoubleReg, static_cast<byte>(31));
+        __ Pslld(kScratchDoubleReg, byte{31});
         __ Xorps(i.OutputSimd128Register(), kScratchDoubleReg);
       } else {
         __ Pcmpeqd(dst, dst);
-        __ Pslld(dst, static_cast<byte>(31));
+        __ Pslld(dst, byte{31});
         __ Xorps(dst, i.InputSimd128Register(0));
       }
       break;
@@ -2503,7 +2502,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kX64F32x4AddHoriz: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      CpuFeatureScope sse_scope(tasm(), SSE3);
       __ Haddps(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
@@ -2534,9 +2532,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       // propagate -0's and NaNs, which may be non-canonical.
       __ Orps(kScratchDoubleReg, dst);
       // Canonicalize NaNs by quieting and clearing the payload.
-      __ Cmpps(dst, kScratchDoubleReg, static_cast<int8_t>(3));
+      __ Cmpps(dst, kScratchDoubleReg, int8_t{3});
       __ Orps(kScratchDoubleReg, dst);
-      __ Psrld(dst, static_cast<byte>(10));
+      __ Psrld(dst, byte{10});
       __ Andnps(dst, kScratchDoubleReg);
       break;
     }
@@ -2556,21 +2554,21 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       // Propagate sign discrepancy and (subtle) quiet NaNs.
       __ Subps(kScratchDoubleReg, dst);
       // Canonicalize NaNs by clearing the payload. Sign is non-deterministic.
-      __ Cmpps(dst, kScratchDoubleReg, static_cast<int8_t>(3));
-      __ Psrld(dst, static_cast<byte>(10));
+      __ Cmpps(dst, kScratchDoubleReg, int8_t{3});
+      __ Psrld(dst, byte{10});
       __ Andnps(dst, kScratchDoubleReg);
       break;
     }
     case kX64F32x4Eq: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       __ Cmpps(i.OutputSimd128Register(), i.InputSimd128Register(1),
-               static_cast<int8_t>(0x0));
+               int8_t{0x0});
       break;
     }
     case kX64F32x4Ne: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       __ Cmpps(i.OutputSimd128Register(), i.InputSimd128Register(1),
-               static_cast<int8_t>(0x4));
+               int8_t{0x4});
       break;
     }
     case kX64F32x4Lt: {
@@ -2609,8 +2607,37 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     }
+    case kX64F32x4Pmin: {
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      __ Minps(dst, i.InputSimd128Register(1));
+      break;
+    }
+    case kX64F32x4Pmax: {
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      __ Maxps(dst, i.InputSimd128Register(1));
+      break;
+    }
+    case kX64F32x4Round: {
+      RoundingMode const mode =
+          static_cast<RoundingMode>(MiscField::decode(instr->opcode()));
+      __ Roundps(i.OutputSimd128Register(), i.InputSimd128Register(0), mode);
+      break;
+    }
+    case kX64F64x2Pmin: {
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      __ Minpd(dst, i.InputSimd128Register(1));
+      break;
+    }
+    case kX64F64x2Pmax: {
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      __ Maxpd(dst, i.InputSimd128Register(1));
+      break;
+    }
     case kX64I64x2Splat: {
-      CpuFeatureScope sse_scope(tasm(), SSE3);
       XMMRegister dst = i.OutputSimd128Register();
       if (HasRegisterInput(instr, 0)) {
         __ Movq(dst, i.InputRegister(0));
@@ -2621,12 +2648,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kX64I64x2ExtractLane: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       __ Pextrq(i.OutputRegister(), i.InputSimd128Register(0), i.InputInt8(1));
       break;
     }
     case kX64I64x2ReplaceLane: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       if (HasRegisterInput(instr, 2)) {
         __ Pinsrq(i.OutputSimd128Register(), i.InputRegister(2),
                   i.InputInt8(1));
@@ -2653,7 +2678,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kX64I64x2ShrS: {
       // TODO(zhin): there is vpsraq but requires AVX512
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       // ShrS on each quadword one at a time
       XMMRegister dst = i.OutputSimd128Register();
       XMMRegister src = i.InputSimd128Register(0);
@@ -2661,14 +2685,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       // Modulo 64 not required as sarq_cl will mask cl to 6 bits.
 
       // lower quadword
-      __ Pextrq(tmp, src, static_cast<int8_t>(0x0));
+      __ Pextrq(tmp, src, int8_t{0x0});
       __ sarq_cl(tmp);
-      __ Pinsrq(dst, tmp, static_cast<int8_t>(0x0));
+      __ Pinsrq(dst, tmp, int8_t{0x0});
 
       // upper quadword
-      __ Pextrq(tmp, src, static_cast<int8_t>(0x1));
+      __ Pextrq(tmp, src, int8_t{0x1});
       __ sarq_cl(tmp);
-      __ Pinsrq(dst, tmp, static_cast<int8_t>(0x1));
+      __ Pinsrq(dst, tmp, int8_t{0x1});
       break;
     }
     case kX64I64x2Add: {
@@ -2886,16 +2910,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       } else {
         __ Movd(dst, i.InputOperand(0));
       }
-      __ Pshufd(dst, dst, static_cast<uint8_t>(0x0));
+      __ Pshufd(dst, dst, uint8_t{0x0});
       break;
     }
     case kX64I32x4ExtractLane: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       __ Pextrd(i.OutputRegister(), i.InputSimd128Register(0), i.InputInt8(1));
       break;
     }
     case kX64I32x4ReplaceLane: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       if (HasRegisterInput(instr, 2)) {
         __ Pinsrd(i.OutputSimd128Register(), i.InputRegister(2),
                   i.InputInt8(1));
@@ -2918,24 +2940,22 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Cvttps2dq(dst, dst);
       // Set top bit if >=0 is now < 0
       __ Pand(tmp, dst);
-      __ Psrad(tmp, static_cast<byte>(31));
+      __ Psrad(tmp, byte{31});
       // Set positive overflow lanes to 0x7FFFFFFF
       __ Pxor(dst, tmp);
       break;
     }
     case kX64I32x4SConvertI16x8Low: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       __ Pmovsxwd(i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
     }
     case kX64I32x4SConvertI16x8High: {
       XMMRegister dst = i.OutputSimd128Register();
-      __ Palignr(dst, i.InputSimd128Register(0), static_cast<uint8_t>(8));
+      __ Palignr(dst, i.InputSimd128Register(0), uint8_t{8});
       __ Pmovsxwd(dst, dst);
       break;
     }
     case kX64I32x4Neg: {
-      CpuFeatureScope sse_scope(tasm(), SSSE3);
       XMMRegister dst = i.OutputSimd128Register();
       XMMRegister src = i.InputSimd128Register(0);
       if (dst == src) {
@@ -2962,7 +2982,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kX64I32x4AddHoriz: {
-      CpuFeatureScope sse_scope(tasm(), SSSE3);
       __ Phaddd(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
@@ -2971,17 +2990,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kX64I32x4Mul: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       __ Pmulld(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64I32x4MinS: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       __ Pminsd(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64I32x4MaxS: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       __ Pmaxsd(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
@@ -3001,7 +3017,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kX64I32x4GeS: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       XMMRegister dst = i.OutputSimd128Register();
       XMMRegister src = i.InputSimd128Register(1);
       __ Pminsd(dst, src);
@@ -3010,7 +3025,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kX64I32x4UConvertF32x4: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       XMMRegister dst = i.OutputSimd128Register();
       XMMRegister tmp = i.TempSimd128Register(0);
       XMMRegister tmp2 = i.TempSimd128Register(1);
@@ -3019,7 +3033,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Maxps(dst, tmp2);
       // scratch: float representation of max_signed
       __ Pcmpeqd(tmp2, tmp2);
-      __ Psrld(tmp2, static_cast<uint8_t>(1));  // 0x7fffffff
+      __ Psrld(tmp2, uint8_t{1});               // 0x7fffffff
       __ Cvtdq2ps(tmp2, tmp2);                  // 0x4f000000
       // tmp: convert (src-max_signed).
       // Positive overflow lanes -> 0x7FFFFFFF
@@ -3043,7 +3057,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kX64I32x4UConvertI16x8High: {
       XMMRegister dst = i.OutputSimd128Register();
-      __ Palignr(dst, i.InputSimd128Register(0), static_cast<uint8_t>(8));
+      __ Palignr(dst, i.InputSimd128Register(0), uint8_t{8});
       __ Pmovzxwd(dst, dst);
       break;
     }
@@ -3053,17 +3067,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kX64I32x4MinU: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       __ Pminud(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64I32x4MaxU: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       __ Pmaxud(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
     case kX64I32x4GtU: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       XMMRegister dst = i.OutputSimd128Register();
       XMMRegister src = i.InputSimd128Register(1);
       XMMRegister tmp = i.TempSimd128Register(0);
@@ -3074,7 +3085,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kX64I32x4GeU: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       XMMRegister dst = i.OutputSimd128Register();
       XMMRegister src = i.InputSimd128Register(1);
       __ Pminud(dst, src);
@@ -3085,6 +3095,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Pabsd(i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
     }
+    case kX64I32x4BitMask: {
+      __ Movmskps(i.OutputRegister(), i.InputSimd128Register(0));
+      break;
+    }
     case kX64S128Zero: {
       XMMRegister dst = i.OutputSimd128Register();
       __ Xorps(dst, dst);
@@ -3097,8 +3111,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       } else {
         __ Movd(dst, i.InputOperand(0));
       }
-      __ Pshuflw(dst, dst, static_cast<uint8_t>(0x0));
-      __ Pshufd(dst, dst, static_cast<uint8_t>(0x0));
+      __ Pshuflw(dst, dst, uint8_t{0x0});
+      __ Pshufd(dst, dst, uint8_t{0x0});
       break;
     }
     case kX64I16x8ExtractLaneU: {
@@ -3127,7 +3141,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kX64I16x8SConvertI8x16High: {
       XMMRegister dst = i.OutputSimd128Register();
-      __ Palignr(dst, i.InputSimd128Register(0), static_cast<uint8_t>(8));
+      __ Palignr(dst, i.InputSimd128Register(0), uint8_t{8});
       __ Pmovsxbw(dst, dst);
       break;
     }
@@ -3218,7 +3232,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kX64I16x8UConvertI8x16High: {
       XMMRegister dst = i.OutputSimd128Register();
-      __ Palignr(dst, i.InputSimd128Register(0), static_cast<uint8_t>(8));
+      __ Palignr(dst, i.InputSimd128Register(0), uint8_t{8});
       __ Pmovzxbw(dst, dst);
       break;
     }
@@ -3273,6 +3287,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Pabsw(i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
     }
+    case kX64I16x8BitMask: {
+      Register dst = i.OutputRegister();
+      XMMRegister tmp = i.TempSimd128Register(0);
+      __ Packsswb(tmp, i.InputSimd128Register(0));
+      __ Pmovmskb(dst, tmp);
+      __ shrq(dst, Immediate(8));
+      break;
+    }
     case kX64I8x16Splat: {
       XMMRegister dst = i.OutputSimd128Register();
       if (HasRegisterInput(instr, 0)) {
@@ -3330,27 +3352,29 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       if (HasImmediateInput(instr, 1)) {
         // Perform 16-bit shift, then mask away low bits.
         uint8_t shift = i.InputInt3(1);
-        __ Psllw(dst, static_cast<byte>(shift));
+        __ Psllw(dst, byte{shift});
 
         uint8_t bmask = static_cast<uint8_t>(0xff << shift);
         uint32_t mask = bmask << 24 | bmask << 16 | bmask << 8 | bmask;
         __ movl(tmp, Immediate(mask));
         __ Movd(tmp_simd, tmp);
-        __ Pshufd(tmp_simd, tmp_simd, static_cast<uint8_t>(0));
+        __ Pshufd(tmp_simd, tmp_simd, uint8_t{0});
         __ Pand(dst, tmp_simd);
       } else {
-        Register shift = i.InputRegister(1);
         // Mask off the unwanted bits before word-shifting.
         __ Pcmpeqw(kScratchDoubleReg, kScratchDoubleReg);
         // Take shift value modulo 8.
-        __ andq(shift, Immediate(7));
-        __ movq(tmp, shift);
+        __ movq(tmp, i.InputRegister(1));
+        __ andq(tmp, Immediate(7));
         __ addq(tmp, Immediate(8));
         __ Movq(tmp_simd, tmp);
         __ Psrlw(kScratchDoubleReg, tmp_simd);
         __ Packuswb(kScratchDoubleReg, kScratchDoubleReg);
         __ Pand(dst, kScratchDoubleReg);
-        __ Movq(tmp_simd, shift);
+        // TODO(zhin): subq here to avoid asking for another temporary register,
+        // examine codegen for other i8x16 shifts, they use less instructions.
+        __ subq(tmp, Immediate(8));
+        __ Movq(tmp_simd, tmp);
         __ Psllw(dst, tmp_simd);
       }
       break;
@@ -3412,10 +3436,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       // s = 00BB 00BB ... 00BB 00BB
       __ Movaps(tmp, dst);
       __ Movaps(kScratchDoubleReg, right);
-      __ Psrlw(tmp, static_cast<byte>(8));
-      __ Psrlw(kScratchDoubleReg, static_cast<byte>(8));
+      __ Psrlw(tmp, byte{8});
+      __ Psrlw(kScratchDoubleReg, byte{8});
       // dst = left * 256
-      __ Psllw(dst, static_cast<byte>(8));
+      __ Psllw(dst, byte{8});
       // t = I16x8Mul(t, s)
       //    => __PP __PP ...  __PP  __PP
       __ Pmullw(tmp, kScratchDoubleReg);
@@ -3424,10 +3448,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Pmullw(dst, right);
       // t = I16x8Shl(t, 8)
       //    => PP00 PP00 ...  PP00  PP00
-      __ Psllw(tmp, static_cast<byte>(8));
+      __ Psllw(tmp, byte{8});
       // dst = I16x8Shr(dst, 8)
       //    => 00pp 00pp ...  00pp  00pp
-      __ Psrlw(dst, static_cast<byte>(8));
+      __ Psrlw(dst, byte{8});
       // dst = I16x8Or(dst, t)
       //    => PPpp PPpp ...  PPpp  PPpp
       __ Por(dst, tmp);
@@ -3478,13 +3502,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       if (HasImmediateInput(instr, 1)) {
         // Perform 16-bit shift, then mask away high bits.
         uint8_t shift = i.InputInt3(1);
-        __ Psrlw(dst, static_cast<byte>(shift));
+        __ Psrlw(dst, byte{shift});
 
         uint8_t bmask = 0xff >> shift;
         uint32_t mask = bmask << 24 | bmask << 16 | bmask << 8 | bmask;
         __ movl(tmp, Immediate(mask));
         __ Movd(tmp_simd, tmp);
-        __ Pshufd(tmp_simd, tmp_simd, static_cast<byte>(0));
+        __ Pshufd(tmp_simd, tmp_simd, byte{0});
         __ Pand(dst, tmp_simd);
       } else {
         __ Punpckhbw(kScratchDoubleReg, dst);
@@ -3542,6 +3566,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Pabsb(i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
     }
+    case kX64I8x16BitMask: {
+      __ Pmovmskb(i.OutputRegister(), i.InputSimd128Register(0));
+      break;
+    }
     case kX64S128And: {
       __ Pand(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
@@ -3592,18 +3620,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
 
       // Out-of-range indices should return 0, add 112 so that any value > 15
       // saturates to 128 (top bit set), so pshufb will zero that lane.
-      __ Move(mask, static_cast<uint32_t>(0x70707070));
-      __ Pshufd(mask, mask, static_cast<uint8_t>(0x0));
+      __ Move(mask, uint32_t{0x70707070});
+      __ Pshufd(mask, mask, uint8_t{0x0});
       __ Paddusb(mask, i.InputSimd128Register(1));
       __ Pshufb(dst, mask);
       break;
     }
     case kX64S8x16Shuffle: {
       XMMRegister dst = i.OutputSimd128Register();
-      Register tmp = i.TempRegister(0);
-      // Prepare 16 byte aligned buffer for shuffle control mask
-      __ movq(tmp, rsp);
-      __ andq(rsp, Immediate(-16));
+      XMMRegister tmp_simd = i.TempSimd128Register(0);
       if (instr->InputCount() == 5) {  // only one input operand
         uint32_t mask[4] = {};
         DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
@@ -3611,22 +3636,22 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
           mask[j - 1] = i.InputUint32(j);
         }
 
-        SetupShuffleMaskOnStack(tasm(), mask);
-        __ Pshufb(dst, Operand(rsp, 0));
+        SetupShuffleMaskInTempRegister(tasm(), mask, tmp_simd);
+        __ Pshufb(dst, tmp_simd);
       } else {  // two input operands
         DCHECK_EQ(6, instr->InputCount());
         ASSEMBLE_SIMD_INSTR(Movups, kScratchDoubleReg, 0);
-        uint32_t mask[4] = {};
+        uint32_t mask1[4] = {};
         for (int j = 5; j > 1; j--) {
           uint32_t lanes = i.InputUint32(j);
           for (int k = 0; k < 32; k += 8) {
             uint8_t lane = lanes >> k;
-            mask[j - 2] |= (lane < kSimd128Size ? lane : 0x80) << k;
+            mask1[j - 2] |= (lane < kSimd128Size ? lane : 0x80) << k;
           }
         }
-        SetupShuffleMaskOnStack(tasm(), mask);
-        __ Pshufb(kScratchDoubleReg, Operand(rsp, 0));
-        uint32_t mask1[4] = {};
+        SetupShuffleMaskInTempRegister(tasm(), mask1, tmp_simd);
+        __ Pshufb(kScratchDoubleReg, tmp_simd);
+        uint32_t mask2[4] = {};
         if (instr->InputAt(1)->IsSimd128Register()) {
           XMMRegister src1 = i.InputSimd128Register(1);
           if (src1 != dst) __ movups(dst, src1);
@@ -3637,14 +3662,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
           uint32_t lanes = i.InputUint32(j);
           for (int k = 0; k < 32; k += 8) {
             uint8_t lane = lanes >> k;
-            mask1[j - 2] |= (lane >= kSimd128Size ? (lane & 0x0F) : 0x80) << k;
+            mask2[j - 2] |= (lane >= kSimd128Size ? (lane & 0x0F) : 0x80) << k;
           }
         }
-        SetupShuffleMaskOnStack(tasm(), mask1);
-        __ Pshufb(dst, Operand(rsp, 0));
+        SetupShuffleMaskInTempRegister(tasm(), mask2, tmp_simd);
+        __ Pshufb(dst, tmp_simd);
         __ Por(dst, kScratchDoubleReg);
       }
-      __ movq(rsp, tmp);
       break;
     }
     case kX64S8x16LoadSplat: {
@@ -3658,7 +3682,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
       __ Pinsrw(i.OutputSimd128Register(), i.MemoryOperand(), 0);
       __ Pshuflw(i.OutputSimd128Register(), i.OutputSimd128Register(),
-                 static_cast<uint8_t>(0));
+                 uint8_t{0});
       __ Punpcklqdq(i.OutputSimd128Register(), i.OutputSimd128Register());
       break;
     }
@@ -3670,7 +3694,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       } else {
         __ Movss(i.OutputSimd128Register(), i.MemoryOperand());
         __ Shufps(i.OutputSimd128Register(), i.OutputSimd128Register(),
-                  static_cast<byte>(0));
+                  byte{0});
       }
       break;
     }
@@ -3680,37 +3704,31 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kX64I16x8Load8x8S: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
       __ Pmovsxbw(i.OutputSimd128Register(), i.MemoryOperand());
       break;
     }
     case kX64I16x8Load8x8U: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
       __ Pmovzxbw(i.OutputSimd128Register(), i.MemoryOperand());
       break;
     }
     case kX64I32x4Load16x4S: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
       __ Pmovsxwd(i.OutputSimd128Register(), i.MemoryOperand());
       break;
     }
     case kX64I32x4Load16x4U: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
       __ Pmovzxwd(i.OutputSimd128Register(), i.MemoryOperand());
       break;
     }
     case kX64I64x2Load32x2S: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
       __ Pmovsxdq(i.OutputSimd128Register(), i.MemoryOperand());
       break;
     }
     case kX64I64x2Load32x2U: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, __ pc_offset());
       __ Pmovzxdq(i.OutputSimd128Register(), i.MemoryOperand());
       break;
@@ -3760,10 +3778,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       uint8_t half_dup = lane4 | (lane4 << 2) | (lane4 << 4) | (lane4 << 6);
       if (lane < 4) {
         ASSEMBLE_SIMD_IMM_INSTR(Pshuflw, dst, 0, half_dup);
-        __ Pshufd(dst, dst, static_cast<uint8_t>(0));
+        __ Pshufd(dst, dst, uint8_t{0});
       } else {
         ASSEMBLE_SIMD_IMM_INSTR(Pshufhw, dst, 0, half_dup);
-        __ Pshufd(dst, dst, static_cast<uint8_t>(0xaa));
+        __ Pshufd(dst, dst, uint8_t{0xaa});
       }
       break;
     }
@@ -3781,10 +3799,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       uint8_t half_dup = lane4 | (lane4 << 2) | (lane4 << 4) | (lane4 << 6);
       if (lane < 4) {
         __ Pshuflw(dst, dst, half_dup);
-        __ Pshufd(dst, dst, static_cast<uint8_t>(0));
+        __ Pshufd(dst, dst, uint8_t{0});
       } else {
         __ Pshufhw(dst, dst, half_dup);
-        __ Pshufd(dst, dst, static_cast<uint8_t>(0xaa));
+        __ Pshufd(dst, dst, uint8_t{0xaa});
       }
       break;
     }
@@ -3818,10 +3836,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       DCHECK_EQ(dst, i.InputSimd128Register(0));
       if (instr->InputCount() == 2) {
         ASSEMBLE_SIMD_INSTR(Movups, kScratchDoubleReg, 1);
-        __ Psrld(kScratchDoubleReg, static_cast<byte>(16));
+        __ Psrld(kScratchDoubleReg, byte{16});
         src2 = kScratchDoubleReg;
       }
-      __ Psrld(dst, static_cast<byte>(16));
+      __ Psrld(dst, byte{16});
       __ Packusdw(dst, src2);
       break;
     }
@@ -3831,11 +3849,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       DCHECK_EQ(dst, i.InputSimd128Register(0));
       __ Pxor(kScratchDoubleReg, kScratchDoubleReg);
       if (instr->InputCount() == 2) {
-        ASSEMBLE_SIMD_IMM_INSTR(Pblendw, kScratchDoubleReg, 1,
-                                static_cast<uint8_t>(0x55));
+        ASSEMBLE_SIMD_IMM_INSTR(Pblendw, kScratchDoubleReg, 1, uint8_t{0x55});
         src2 = kScratchDoubleReg;
       }
-      __ Pblendw(dst, kScratchDoubleReg, static_cast<uint8_t>(0xaa));
+      __ Pblendw(dst, kScratchDoubleReg, uint8_t{0xaa});
       __ Packusdw(dst, src2);
       break;
     }
@@ -3845,10 +3862,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       DCHECK_EQ(dst, i.InputSimd128Register(0));
       if (instr->InputCount() == 2) {
         ASSEMBLE_SIMD_INSTR(Movups, kScratchDoubleReg, 1);
-        __ Psrlw(kScratchDoubleReg, static_cast<byte>(8));
+        __ Psrlw(kScratchDoubleReg, byte{8});
         src2 = kScratchDoubleReg;
       }
-      __ Psrlw(dst, static_cast<byte>(8));
+      __ Psrlw(dst, byte{8});
       __ Packuswb(dst, src2);
       break;
     }
@@ -3858,42 +3875,42 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       DCHECK_EQ(dst, i.InputSimd128Register(0));
       if (instr->InputCount() == 2) {
         ASSEMBLE_SIMD_INSTR(Movups, kScratchDoubleReg, 1);
-        __ Psllw(kScratchDoubleReg, static_cast<byte>(8));
-        __ Psrlw(kScratchDoubleReg, static_cast<byte>(8));
+        __ Psllw(kScratchDoubleReg, byte{8});
+        __ Psrlw(kScratchDoubleReg, byte{8});
         src2 = kScratchDoubleReg;
       }
-      __ Psllw(dst, static_cast<byte>(8));
-      __ Psrlw(dst, static_cast<byte>(8));
+      __ Psllw(dst, byte{8});
+      __ Psrlw(dst, byte{8});
       __ Packuswb(dst, src2);
       break;
     }
     case kX64S8x16TransposeLow: {
       XMMRegister dst = i.OutputSimd128Register();
       DCHECK_EQ(dst, i.InputSimd128Register(0));
-      __ Psllw(dst, static_cast<byte>(8));
+      __ Psllw(dst, byte{8});
       if (instr->InputCount() == 1) {
         __ Movups(kScratchDoubleReg, dst);
       } else {
         DCHECK_EQ(2, instr->InputCount());
         ASSEMBLE_SIMD_INSTR(Movups, kScratchDoubleReg, 1);
-        __ Psllw(kScratchDoubleReg, static_cast<byte>(8));
+        __ Psllw(kScratchDoubleReg, byte{8});
       }
-      __ Psrlw(dst, static_cast<byte>(8));
+      __ Psrlw(dst, byte{8});
       __ Por(dst, kScratchDoubleReg);
       break;
     }
     case kX64S8x16TransposeHigh: {
       XMMRegister dst = i.OutputSimd128Register();
       DCHECK_EQ(dst, i.InputSimd128Register(0));
-      __ Psrlw(dst, static_cast<byte>(8));
+      __ Psrlw(dst, byte{8});
       if (instr->InputCount() == 1) {
         __ Movups(kScratchDoubleReg, dst);
       } else {
         DCHECK_EQ(2, instr->InputCount());
         ASSEMBLE_SIMD_INSTR(Movups, kScratchDoubleReg, 1);
-        __ Psrlw(kScratchDoubleReg, static_cast<byte>(8));
+        __ Psrlw(kScratchDoubleReg, byte{8});
       }
-      __ Psllw(kScratchDoubleReg, static_cast<byte>(8));
+      __ Psllw(kScratchDoubleReg, byte{8});
       __ Por(dst, kScratchDoubleReg);
       break;
     }
@@ -3910,16 +3927,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ Pshufhw(dst, dst, shuffle_mask);
       }
       __ Movaps(kScratchDoubleReg, dst);
-      __ Psrlw(kScratchDoubleReg, static_cast<byte>(8));
-      __ Psllw(dst, static_cast<byte>(8));
+      __ Psrlw(kScratchDoubleReg, byte{8});
+      __ Psllw(dst, byte{8});
       __ Por(dst, kScratchDoubleReg);
       break;
     }
-    case kX64S1x2AnyTrue:
-    case kX64S1x4AnyTrue:
-    case kX64S1x8AnyTrue:
-    case kX64S1x16AnyTrue: {
-      CpuFeatureScope sse_scope(tasm(), SSE4_1);
+    case kX64V64x2AnyTrue:
+    case kX64V32x4AnyTrue:
+    case kX64V16x8AnyTrue:
+    case kX64V8x16AnyTrue: {
       Register dst = i.OutputRegister();
       XMMRegister src = i.InputSimd128Register(0);
 
@@ -3932,19 +3948,19 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     // comparison instruction used matters, e.g. given 0xff00, pcmpeqb returns
     // 0x0011, pcmpeqw returns 0x0000, ptest will set ZF to 0 and 1
     // respectively.
-    case kX64S1x2AllTrue: {
-      ASSEMBLE_SIMD_ALL_TRUE(pcmpeqq);
+    case kX64V64x2AllTrue: {
+      ASSEMBLE_SIMD_ALL_TRUE(Pcmpeqq);
       break;
     }
-    case kX64S1x4AllTrue: {
+    case kX64V32x4AllTrue: {
       ASSEMBLE_SIMD_ALL_TRUE(Pcmpeqd);
       break;
     }
-    case kX64S1x8AllTrue: {
+    case kX64V16x8AllTrue: {
       ASSEMBLE_SIMD_ALL_TRUE(Pcmpeqw);
       break;
     }
-    case kX64S1x16AllTrue: {
+    case kX64V8x16AllTrue: {
       ASSEMBLE_SIMD_ALL_TRUE(Pcmpeqb);
       break;
     }
diff --git a/deps/v8/src/compiler/backend/x64/instruction-codes-x64.h b/deps/v8/src/compiler/backend/x64/instruction-codes-x64.h
index be5ac0d6c30..e3a0fff5b77 100644
--- a/deps/v8/src/compiler/backend/x64/instruction-codes-x64.h
+++ b/deps/v8/src/compiler/backend/x64/instruction-codes-x64.h
@@ -48,6 +48,8 @@ namespace compiler {
   V(X64Shr32)                             \
   V(X64Sar)                               \
   V(X64Sar32)                             \
+  V(X64Rol)                               \
+  V(X64Rol32)                             \
   V(X64Ror)                               \
   V(X64Ror32)                             \
   V(X64Lzcnt)                             \
@@ -170,6 +172,8 @@ namespace compiler {
   V(X64F64x2Le)                           \
   V(X64F64x2Qfma)                         \
   V(X64F64x2Qfms)                         \
+  V(X64F64x2Pmin)                         \
+  V(X64F64x2Pmax)                         \
   V(X64F32x4Splat)                        \
   V(X64F32x4ExtractLane)                  \
   V(X64F32x4ReplaceLane)                  \
@@ -193,6 +197,9 @@ namespace compiler {
   V(X64F32x4Le)                           \
   V(X64F32x4Qfma)                         \
   V(X64F32x4Qfms)                         \
+  V(X64F32x4Pmin)                         \
+  V(X64F32x4Pmax)                         \
+  V(X64F32x4Round)                        \
   V(X64I64x2Splat)                        \
   V(X64I64x2ExtractLane)                  \
   V(X64I64x2ReplaceLane)                  \
@@ -241,6 +248,7 @@ namespace compiler {
   V(X64I32x4GtU)                          \
   V(X64I32x4GeU)                          \
   V(X64I32x4Abs)                          \
+  V(X64I32x4BitMask)                      \
   V(X64I16x8Splat)                        \
   V(X64I16x8ExtractLaneU)                 \
   V(X64I16x8ExtractLaneS)                 \
@@ -275,6 +283,7 @@ namespace compiler {
   V(X64I16x8GeU)                          \
   V(X64I16x8RoundingAverageU)             \
   V(X64I16x8Abs)                          \
+  V(X64I16x8BitMask)                      \
   V(X64I8x16Splat)                        \
   V(X64I8x16ExtractLaneU)                 \
   V(X64I8x16ExtractLaneS)                 \
@@ -304,6 +313,7 @@ namespace compiler {
   V(X64I8x16GeU)                          \
   V(X64I8x16RoundingAverageU)             \
   V(X64I8x16Abs)                          \
+  V(X64I8x16BitMask)                      \
   V(X64S128Zero)                          \
   V(X64S128Not)                           \
   V(X64S128And)                           \
@@ -348,14 +358,14 @@ namespace compiler {
   V(X64S8x8Reverse)                       \
   V(X64S8x4Reverse)                       \
   V(X64S8x2Reverse)                       \
-  V(X64S1x2AnyTrue)                       \
-  V(X64S1x2AllTrue)                       \
-  V(X64S1x4AnyTrue)                       \
-  V(X64S1x4AllTrue)                       \
-  V(X64S1x8AnyTrue)                       \
-  V(X64S1x8AllTrue)                       \
-  V(X64S1x16AnyTrue)                      \
-  V(X64S1x16AllTrue)                      \
+  V(X64V64x2AnyTrue)                      \
+  V(X64V64x2AllTrue)                      \
+  V(X64V32x4AnyTrue)                      \
+  V(X64V32x4AllTrue)                      \
+  V(X64V16x8AnyTrue)                      \
+  V(X64V16x8AllTrue)                      \
+  V(X64V8x16AnyTrue)                      \
+  V(X64V8x16AllTrue)                      \
   V(X64Word64AtomicLoadUint8)             \
   V(X64Word64AtomicLoadUint16)            \
   V(X64Word64AtomicLoadUint32)            \
diff --git a/deps/v8/src/compiler/backend/x64/instruction-scheduler-x64.cc b/deps/v8/src/compiler/backend/x64/instruction-scheduler-x64.cc
index f4a74a4050c..b9af3f6279e 100644
--- a/deps/v8/src/compiler/backend/x64/instruction-scheduler-x64.cc
+++ b/deps/v8/src/compiler/backend/x64/instruction-scheduler-x64.cc
@@ -45,6 +45,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kX64Shr32:
     case kX64Sar:
     case kX64Sar32:
+    case kX64Rol:
+    case kX64Rol32:
     case kX64Ror:
     case kX64Ror32:
     case kX64Lzcnt:
@@ -142,6 +144,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kX64F64x2Le:
     case kX64F64x2Qfma:
     case kX64F64x2Qfms:
+    case kX64F64x2Pmin:
+    case kX64F64x2Pmax:
     case kX64F32x4Splat:
     case kX64F32x4ExtractLane:
     case kX64F32x4ReplaceLane:
@@ -165,6 +169,9 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kX64F32x4Le:
     case kX64F32x4Qfma:
     case kX64F32x4Qfms:
+    case kX64F32x4Pmin:
+    case kX64F32x4Pmax:
+    case kX64F32x4Round:
     case kX64I64x2Splat:
     case kX64I64x2ExtractLane:
     case kX64I64x2ReplaceLane:
@@ -213,6 +220,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kX64I32x4GtU:
     case kX64I32x4GeU:
     case kX64I32x4Abs:
+    case kX64I32x4BitMask:
     case kX64I16x8Splat:
     case kX64I16x8ExtractLaneU:
     case kX64I16x8ExtractLaneS:
@@ -247,6 +255,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kX64I16x8GeU:
     case kX64I16x8RoundingAverageU:
     case kX64I16x8Abs:
+    case kX64I16x8BitMask:
     case kX64I8x16Splat:
     case kX64I8x16ExtractLaneU:
     case kX64I8x16ExtractLaneS:
@@ -276,6 +285,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kX64I8x16GeU:
     case kX64I8x16RoundingAverageU:
     case kX64I8x16Abs:
+    case kX64I8x16BitMask:
     case kX64S128And:
     case kX64S128Or:
     case kX64S128Xor:
@@ -283,12 +293,12 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kX64S128Select:
     case kX64S128Zero:
     case kX64S128AndNot:
-    case kX64S1x2AnyTrue:
-    case kX64S1x2AllTrue:
-    case kX64S1x4AnyTrue:
-    case kX64S1x4AllTrue:
-    case kX64S1x8AnyTrue:
-    case kX64S1x8AllTrue:
+    case kX64V64x2AnyTrue:
+    case kX64V64x2AllTrue:
+    case kX64V32x4AnyTrue:
+    case kX64V32x4AllTrue:
+    case kX64V16x8AnyTrue:
+    case kX64V16x8AllTrue:
     case kX64S8x16Swizzle:
     case kX64S8x16Shuffle:
     case kX64S32x4Swizzle:
@@ -316,8 +326,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kX64S8x8Reverse:
     case kX64S8x4Reverse:
     case kX64S8x2Reverse:
-    case kX64S1x16AnyTrue:
-    case kX64S1x16AllTrue:
+    case kX64V8x16AnyTrue:
+    case kX64V8x16AllTrue:
       return (instr->addressing_mode() == kMode_None)
                  ? kNoOpcodeFlags
                  : kIsLoadOperation | kHasSideEffect;
diff --git a/deps/v8/src/compiler/backend/x64/instruction-selector-x64.cc b/deps/v8/src/compiler/backend/x64/instruction-selector-x64.cc
index 392b207c8ee..b0af7e361c5 100644
--- a/deps/v8/src/compiler/backend/x64/instruction-selector-x64.cc
+++ b/deps/v8/src/compiler/backend/x64/instruction-selector-x64.cc
@@ -911,6 +911,14 @@ void InstructionSelector::VisitWord64Sar(Node* node) {
   VisitWord64Shift(this, node, kX64Sar);
 }
 
+void InstructionSelector::VisitWord32Rol(Node* node) {
+  VisitWord32Shift(this, node, kX64Rol32);
+}
+
+void InstructionSelector::VisitWord64Rol(Node* node) {
+  VisitWord64Shift(this, node, kX64Rol);
+}
+
 void InstructionSelector::VisitWord32Ror(Node* node) {
   VisitWord32Shift(this, node, kX64Ror32);
 }
@@ -1290,6 +1298,7 @@ bool ZeroExtendsWord32ToWord64(Node* node) {
     case IrOpcode::kWord32Shl:
     case IrOpcode::kWord32Shr:
     case IrOpcode::kWord32Sar:
+    case IrOpcode::kWord32Rol:
     case IrOpcode::kWord32Ror:
     case IrOpcode::kWord32Equal:
     case IrOpcode::kInt32Add:
@@ -1452,7 +1461,12 @@ void VisitFloatUnop(InstructionSelector* selector, Node* node, Node* input,
   V(Float64RoundTruncate, kSSEFloat64Round | MiscField::encode(kRoundToZero)) \
   V(Float32RoundTiesEven,                                                     \
     kSSEFloat32Round | MiscField::encode(kRoundToNearest))                    \
-  V(Float64RoundTiesEven, kSSEFloat64Round | MiscField::encode(kRoundToNearest))
+  V(Float64RoundTiesEven,                                                     \
+    kSSEFloat64Round | MiscField::encode(kRoundToNearest))                    \
+  V(F32x4Ceil, kX64F32x4Round | MiscField::encode(kRoundUp))                  \
+  V(F32x4Floor, kX64F32x4Round | MiscField::encode(kRoundDown))               \
+  V(F32x4Trunc, kX64F32x4Round | MiscField::encode(kRoundToZero))             \
+  V(F32x4NearestInt, kX64F32x4Round | MiscField::encode(kRoundToNearest))
 
 #define RO_VISITOR(Name, opcode)                      \
   void InstructionSelector::Visit##Name(Node* node) { \
@@ -1889,16 +1903,33 @@ void VisitWord32EqualImpl(InstructionSelector* selector, Node* node,
     X64OperandGenerator g(selector);
     const RootsTable& roots_table = selector->isolate()->roots_table();
     RootIndex root_index;
-    CompressedHeapObjectBinopMatcher m(node);
-    if (m.right().HasValue() &&
-        roots_table.IsRootHandle(m.right().Value(), &root_index)) {
+    Node* left = nullptr;
+    Handle<HeapObject> right;
+    // HeapConstants and CompressedHeapConstants can be treated the same when
+    // using them as an input to a 32-bit comparison. Check whether either is
+    // present.
+    {
+      CompressedHeapObjectBinopMatcher m(node);
+      if (m.right().HasValue()) {
+        left = m.left().node();
+        right = m.right().Value();
+      } else {
+        HeapObjectBinopMatcher m2(node);
+        if (m2.right().HasValue()) {
+          left = m2.left().node();
+          right = m2.right().Value();
+        }
+      }
+    }
+    if (!right.is_null() && roots_table.IsRootHandle(right, &root_index)) {
+      DCHECK_NE(left, nullptr);
       InstructionCode opcode =
           kX64Cmp32 | AddressingModeField::encode(kMode_Root);
       return VisitCompare(
           selector, opcode,
           g.TempImmediate(
               TurboAssemblerBase::RootRegisterOffsetForRootIndex(root_index)),
-          g.UseRegister(m.left().node()), cont);
+          g.UseRegister(left), cont);
     }
   }
   VisitWordCompare(selector, node, kX64Cmp32, cont);
@@ -2730,6 +2761,7 @@ VISIT_ATOMIC_BINOP(Xor)
   V(I32x4UConvertI16x8Low)  \
   V(I32x4UConvertI16x8High) \
   V(I32x4Abs)               \
+  V(I32x4BitMask)           \
   V(I16x8SConvertI8x16Low)  \
   V(I16x8SConvertI8x16High) \
   V(I16x8Neg)               \
@@ -2738,6 +2770,7 @@ VISIT_ATOMIC_BINOP(Xor)
   V(I16x8Abs)               \
   V(I8x16Neg)               \
   V(I8x16Abs)               \
+  V(I8x16BitMask)           \
   V(S128Not)
 
 #define SIMD_SHIFT_OPCODES(V) \
@@ -2755,16 +2788,16 @@ VISIT_ATOMIC_BINOP(Xor)
   V(I8x16ShrU)
 
 #define SIMD_ANYTRUE_LIST(V) \
-  V(S1x2AnyTrue)             \
-  V(S1x4AnyTrue)             \
-  V(S1x8AnyTrue)             \
-  V(S1x16AnyTrue)
+  V(V64x2AnyTrue)            \
+  V(V32x4AnyTrue)            \
+  V(V16x8AnyTrue)            \
+  V(V8x16AnyTrue)
 
 #define SIMD_ALLTRUE_LIST(V) \
-  V(S1x2AllTrue)             \
-  V(S1x4AllTrue)             \
-  V(S1x8AllTrue)             \
-  V(S1x16AllTrue)
+  V(V64x2AllTrue)            \
+  V(V32x4AllTrue)            \
+  V(V16x8AllTrue)            \
+  V(V8x16AllTrue)
 
 void InstructionSelector::VisitS128Zero(Node* node) {
   X64OperandGenerator g(this);
@@ -2815,7 +2848,8 @@ SIMD_TYPES(VISIT_SIMD_REPLACE_LANE)
       Emit(kX64##Opcode, g.DefineSameAsFirst(node),                            \
            g.UseRegister(node->InputAt(0)), g.UseImmediate(node->InputAt(1))); \
     } else {                                                                   \
-      InstructionOperand temps[] = {g.TempSimd128Register()};                  \
+      InstructionOperand temps[] = {g.TempSimd128Register(),                   \
+                                    g.TempRegister()};                         \
       Emit(kX64##Opcode, g.DefineSameAsFirst(node),                            \
            g.UseUniqueRegister(node->InputAt(0)),                              \
            g.UseUniqueRegister(node->InputAt(1)), arraysize(temps), temps);    \
@@ -3033,6 +3067,13 @@ void InstructionSelector::VisitI16x8UConvertI32x4(Node* node) {
        g.UseRegister(node->InputAt(0)), g.UseRegister(node->InputAt(1)));
 }
 
+void InstructionSelector::VisitI16x8BitMask(Node* node) {
+  X64OperandGenerator g(this);
+  InstructionOperand temps[] = {g.TempSimd128Register()};
+  Emit(kX64I16x8BitMask, g.DefineAsRegister(node),
+       g.UseUniqueRegister(node->InputAt(0)), arraysize(temps), temps);
+}
+
 void InstructionSelector::VisitI8x16UConvertI16x8(Node* node) {
   X64OperandGenerator g(this);
   Emit(kX64I8x16UConvertI16x8, g.DefineSameAsFirst(node),
@@ -3328,7 +3369,7 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
     imms[imm_count++] = Pack4Lanes(shuffle + 4);
     imms[imm_count++] = Pack4Lanes(shuffle + 8);
     imms[imm_count++] = Pack4Lanes(shuffle + 12);
-    temps[temp_count++] = g.TempRegister();
+    temps[temp_count++] = g.TempSimd128Register();
   }
 
   // Use DefineAsRegister(node) and Use(src0) if we can without forcing an extra
@@ -3337,7 +3378,7 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
   InstructionOperand dst =
       no_same_as_first ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node);
   InstructionOperand src0 =
-      src0_needs_reg ? g.UseRegister(input0) : g.Use(input0);
+      src0_needs_reg ? g.UseUniqueRegister(input0) : g.UseUnique(input0);
 
   int input_count = 0;
   InstructionOperand inputs[2 + kMaxImms + kMaxTemps];
@@ -3345,7 +3386,7 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
   if (!is_swizzle) {
     Node* input1 = node->InputAt(1);
     inputs[input_count++] =
-        src1_needs_reg ? g.UseRegister(input1) : g.Use(input1);
+        src1_needs_reg ? g.UseUniqueRegister(input1) : g.UseUnique(input1);
   }
   for (int i = 0; i < imm_count; ++i) {
     inputs[input_count++] = g.UseImmediate(imms[i]);
@@ -3361,12 +3402,41 @@ void InstructionSelector::VisitS8x16Swizzle(Node* node) {
        arraysize(temps), temps);
 }
 
+namespace {
+void VisitPminOrPmax(InstructionSelector* selector, Node* node,
+                     ArchOpcode opcode) {
+  // Due to the way minps/minpd work, we want the dst to be same as the second
+  // input: b = pmin(a, b) directly maps to minps b a.
+  X64OperandGenerator g(selector);
+  selector->Emit(opcode, g.DefineSameAsFirst(node),
+                 g.UseRegister(node->InputAt(1)),
+                 g.UseRegister(node->InputAt(0)));
+}
+}  // namespace
+
+void InstructionSelector::VisitF32x4Pmin(Node* node) {
+  VisitPminOrPmax(this, node, kX64F32x4Pmin);
+}
+
+void InstructionSelector::VisitF32x4Pmax(Node* node) {
+  VisitPminOrPmax(this, node, kX64F32x4Pmax);
+}
+
+void InstructionSelector::VisitF64x2Pmin(Node* node) {
+  VisitPminOrPmax(this, node, kX64F64x2Pmin);
+}
+
+void InstructionSelector::VisitF64x2Pmax(Node* node) {
+  VisitPminOrPmax(this, node, kX64F64x2Pmax);
+}
+
 // static
 MachineOperatorBuilder::Flags
 InstructionSelector::SupportedMachineOperatorFlags() {
   MachineOperatorBuilder::Flags flags =
       MachineOperatorBuilder::kWord32ShiftIsSafe |
-      MachineOperatorBuilder::kWord32Ctz | MachineOperatorBuilder::kWord64Ctz;
+      MachineOperatorBuilder::kWord32Ctz | MachineOperatorBuilder::kWord64Ctz |
+      MachineOperatorBuilder::kWord32Rol | MachineOperatorBuilder::kWord64Rol;
   if (CpuFeatures::IsSupported(POPCNT)) {
     flags |= MachineOperatorBuilder::kWord32Popcnt |
              MachineOperatorBuilder::kWord64Popcnt;
diff --git a/deps/v8/src/compiler/basic-block-instrumentor.cc b/deps/v8/src/compiler/basic-block-instrumentor.cc
index c2548b77267..d383e76fa7c 100644
--- a/deps/v8/src/compiler/basic-block-instrumentor.cc
+++ b/deps/v8/src/compiler/basic-block-instrumentor.cc
@@ -37,16 +37,16 @@ static NodeVector::iterator FindInsertionPoint(BasicBlock* block) {
   return i;
 }
 
-
 // TODO(dcarney): need to mark code as non-serializable.
 static const Operator* PointerConstant(CommonOperatorBuilder* common,
-                                       intptr_t ptr) {
+                                       const void* ptr) {
+  intptr_t ptr_as_int = reinterpret_cast<intptr_t>(ptr);
   return kSystemPointerSize == 8
-             ? common->Int64Constant(ptr)
-             : common->Int32Constant(static_cast<int32_t>(ptr));
+             ? common->Int64Constant(ptr_as_int)
+             : common->Int32Constant(static_cast<int32_t>(ptr_as_int));
 }
 
-BasicBlockProfiler::Data* BasicBlockInstrumentor::Instrument(
+BasicBlockProfilerData* BasicBlockInstrumentor::Instrument(
     OptimizedCompilationInfo* info, Graph* graph, Schedule* schedule,
     Isolate* isolate) {
   // Basic block profiling disables concurrent compilation, so handle deref is
@@ -54,41 +54,68 @@ BasicBlockProfiler::Data* BasicBlockInstrumentor::Instrument(
   AllowHandleDereference allow_handle_dereference;
   // Skip the exit block in profiles, since the register allocator can't handle
   // it and entry into it means falling off the end of the function anyway.
-  size_t n_blocks = static_cast<size_t>(schedule->RpoBlockCount()) - 1;
-  BasicBlockProfiler::Data* data = BasicBlockProfiler::Get()->NewData(n_blocks);
+  size_t n_blocks = schedule->RpoBlockCount() - 1;
+  BasicBlockProfilerData* data = BasicBlockProfiler::Get()->NewData(n_blocks);
   // Set the function name.
   data->SetFunctionName(info->GetDebugName());
   // Capture the schedule string before instrumentation.
   {
     std::ostringstream os;
     os << *schedule;
-    data->SetSchedule(&os);
+    data->SetSchedule(os);
   }
+  // Check whether we should write counts to a JS heap object or to the
+  // BasicBlockProfilerData directly. The JS heap object is only used for
+  // builtins.
+  bool on_heap_counters = isolate && isolate->IsGeneratingEmbeddedBuiltins();
   // Add the increment instructions to the start of every block.
   CommonOperatorBuilder common(graph->zone());
-  Node* zero = graph->NewNode(common.Int32Constant(0));
-  Node* one = graph->NewNode(common.Int32Constant(1));
   MachineOperatorBuilder machine(graph->zone());
+  Node* counters_array = nullptr;
+  if (on_heap_counters) {
+    // Allocation is disallowed here, so rather than referring to an actual
+    // counters array, create a reference to a special marker object. This
+    // object will get fixed up later in the constants table (see
+    // PatchBasicBlockCountersReference). An important and subtle point: we
+    // cannot use the root handle basic_block_counters_marker_handle() and must
+    // create a new separate handle. Otherwise
+    // TurboAssemblerBase::IndirectLoadConstant would helpfully emit a
+    // root-relative load rather than putting this value in the constants table
+    // where we expect it to be for patching.
+    counters_array = graph->NewNode(common.HeapConstant(Handle<HeapObject>::New(
+        ReadOnlyRoots(isolate).basic_block_counters_marker(), isolate)));
+  } else {
+    counters_array = graph->NewNode(PointerConstant(&common, data->counts()));
+  }
+  Node* one = graph->NewNode(common.Int32Constant(1));
   BasicBlockVector* blocks = schedule->rpo_order();
   size_t block_number = 0;
   for (BasicBlockVector::iterator it = blocks->begin(); block_number < n_blocks;
        ++it, ++block_number) {
     BasicBlock* block = (*it);
     data->SetBlockRpoNumber(block_number, block->rpo_number());
-    // TODO(dcarney): wire effect and control deps for load and store.
+    // It is unnecessary to wire effect and control deps for load and store
+    // since this happens after scheduling.
     // Construct increment operation.
-    Node* base = graph->NewNode(
-        PointerConstant(&common, data->GetCounterAddress(block_number)));
-    Node* load = graph->NewNode(machine.Load(MachineType::Uint32()), base, zero,
-                                graph->start(), graph->start());
+    int offset_to_counter_value = static_cast<int>(block_number) * kInt32Size;
+    if (on_heap_counters) {
+      offset_to_counter_value += ByteArray::kHeaderSize - kHeapObjectTag;
+    }
+    Node* offset_to_counter =
+        graph->NewNode(common.Int32Constant(offset_to_counter_value));
+    Node* load =
+        graph->NewNode(machine.Load(MachineType::Uint32()), counters_array,
+                       offset_to_counter, graph->start(), graph->start());
     Node* inc = graph->NewNode(machine.Int32Add(), load, one);
-    Node* store =
-        graph->NewNode(machine.Store(StoreRepresentation(
-                           MachineRepresentation::kWord32, kNoWriteBarrier)),
-                       base, zero, inc, graph->start(), graph->start());
+    Node* store = graph->NewNode(
+        machine.Store(StoreRepresentation(MachineRepresentation::kWord32,
+                                          kNoWriteBarrier)),
+        counters_array, offset_to_counter, inc, graph->start(), graph->start());
     // Insert the new nodes.
     static const int kArraySize = 6;
-    Node* to_insert[kArraySize] = {zero, one, base, load, inc, store};
+    Node* to_insert[kArraySize] = {counters_array, one, offset_to_counter,
+                                   load,           inc, store};
+    // The first two Nodes are constant across all blocks.
     int insertion_start = block_number == 0 ? 0 : 2;
     NodeVector::iterator insertion_point = FindInsertionPoint(block);
     block->InsertNodes(insertion_point, &to_insert[insertion_start],
diff --git a/deps/v8/src/compiler/basic-block-instrumentor.h b/deps/v8/src/compiler/basic-block-instrumentor.h
index c8bc94c16bf..e63a2cac5d9 100644
--- a/deps/v8/src/compiler/basic-block-instrumentor.h
+++ b/deps/v8/src/compiler/basic-block-instrumentor.h
@@ -20,9 +20,9 @@ class Schedule;
 
 class BasicBlockInstrumentor : public AllStatic {
  public:
-  static BasicBlockProfiler::Data* Instrument(OptimizedCompilationInfo* info,
-                                              Graph* graph, Schedule* schedule,
-                                              Isolate* isolate);
+  static BasicBlockProfilerData* Instrument(OptimizedCompilationInfo* info,
+                                            Graph* graph, Schedule* schedule,
+                                            Isolate* isolate);
 };
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/bytecode-graph-builder.cc b/deps/v8/src/compiler/bytecode-graph-builder.cc
index b59b5a1b844..5e2ac005a46 100644
--- a/deps/v8/src/compiler/bytecode-graph-builder.cc
+++ b/deps/v8/src/compiler/bytecode-graph-builder.cc
@@ -2210,10 +2210,7 @@ void BytecodeGraphBuilder::VisitGetTemplateObject() {
 Node* const* BytecodeGraphBuilder::GetCallArgumentsFromRegisters(
     Node* callee, Node* receiver, interpreter::Register first_arg,
     int arg_count) {
-  // The arity of the Call node -- includes the callee, receiver and function
-  // arguments.
-  int arity = 2 + arg_count;
-
+  int arity = kTargetAndReceiver + arg_count;
   Node** all = local_zone()->NewArray<Node*>(static_cast<size_t>(arity));
 
   all[0] = callee;
@@ -2222,7 +2219,7 @@ Node* const* BytecodeGraphBuilder::GetCallArgumentsFromRegisters(
   // The function arguments are in consecutive registers.
   int arg_base = first_arg.index();
   for (int i = 0; i < arg_count; ++i) {
-    all[2 + i] =
+    all[kTargetAndReceiver + i] =
         environment()->LookupRegister(interpreter::Register(arg_base + i));
   }
 
@@ -2247,7 +2244,8 @@ Node* BytecodeGraphBuilder::ProcessCallArguments(const Operator* call_op,
 
   Node* const* call_args = GetCallArgumentsFromRegisters(callee, receiver_node,
                                                          first_arg, arg_count);
-  return ProcessCallArguments(call_op, call_args, 2 + arg_count);
+  return ProcessCallArguments(call_op, call_args,
+                              kTargetAndReceiver + arg_count);
 }
 
 void BytecodeGraphBuilder::BuildCall(ConvertReceiverMode receiver_mode,
@@ -2318,8 +2316,8 @@ void BytecodeGraphBuilder::BuildCallVarArgs(ConvertReceiverMode receiver_mode) {
                       : static_cast<int>(reg_count) - 1;
   Node* const* call_args =
       ProcessCallVarArgs(receiver_mode, callee, first_reg, arg_count);
-  BuildCall(receiver_mode, call_args, static_cast<size_t>(2 + arg_count),
-            slot_id);
+  BuildCall(receiver_mode, call_args,
+            static_cast<size_t>(kTargetAndReceiver + arg_count), slot_id);
 }
 
 void BytecodeGraphBuilder::VisitCallAnyReceiver() {
@@ -2341,9 +2339,7 @@ void BytecodeGraphBuilder::VisitCallNoFeedback() {
   // The receiver is the first register, followed by the arguments in the
   // consecutive registers.
   int arg_count = static_cast<int>(reg_count) - 1;
-  // The arity of the Call node -- includes the callee, receiver and function
-  // arguments.
-  int arity = 2 + arg_count;
+  int arity = kTargetAndReceiver + arg_count;
 
   // Setting call frequency to a value less than min_inlining frequency to
   // prevent inlining of one-shot call node.
@@ -2459,7 +2455,7 @@ void BytecodeGraphBuilder::VisitCallWithSpread() {
     node = lowering.value();
   } else {
     DCHECK(!lowering.Changed());
-    node = ProcessCallArguments(op, args, 2 + arg_count);
+    node = ProcessCallArguments(op, args, kTargetAndReceiver + arg_count);
   }
   environment()->BindAccumulator(node, Environment::kAttachFrameState);
 }
@@ -2472,10 +2468,11 @@ void BytecodeGraphBuilder::VisitCallJSRuntime() {
   size_t reg_count = bytecode_iterator().GetRegisterCountOperand(2);
   int arg_count = static_cast<int>(reg_count);
 
-  const Operator* call = javascript()->Call(2 + arg_count);
+  const Operator* call = javascript()->Call(kTargetAndReceiver + arg_count);
   Node* const* call_args = ProcessCallVarArgs(
       ConvertReceiverMode::kNullOrUndefined, callee, first_reg, arg_count);
-  Node* value = ProcessCallArguments(call, call_args, 2 + arg_count);
+  Node* value =
+      ProcessCallArguments(call, call_args, kTargetAndReceiver + arg_count);
   environment()->BindAccumulator(value, Environment::kAttachFrameState);
 }
 
@@ -2532,8 +2529,7 @@ void BytecodeGraphBuilder::VisitCallRuntimeForPair() {
 Node* const* BytecodeGraphBuilder::GetConstructArgumentsFromRegister(
     Node* target, Node* new_target, interpreter::Register first_arg,
     int arg_count) {
-  // arity is args + callee and new target.
-  int arity = arg_count + 2;
+  int arity = kTargetAndNewTarget + arg_count;
   Node** all = local_zone()->NewArray<Node*>(static_cast<size_t>(arity));
   all[0] = target;
   int first_arg_index = first_arg.index();
@@ -2563,9 +2559,10 @@ void BytecodeGraphBuilder::VisitConstruct() {
   Node* callee = environment()->LookupRegister(callee_reg);
 
   CallFrequency frequency = ComputeCallFrequency(slot_id);
-  const Operator* op = javascript()->Construct(
-      static_cast<uint32_t>(reg_count + 2), frequency, feedback);
-  int arg_count = static_cast<int>(reg_count);
+  const uint32_t arg_count = static_cast<uint32_t>(reg_count);
+  const uint32_t arg_count_with_extra_args = kTargetAndNewTarget + arg_count;
+  const Operator* op =
+      javascript()->Construct(arg_count_with_extra_args, frequency, feedback);
   Node* const* args = GetConstructArgumentsFromRegister(callee, new_target,
                                                         first_reg, arg_count);
   JSTypeHintLowering::LoweringResult lowering = TryBuildSimplifiedConstruct(
@@ -2577,7 +2574,7 @@ void BytecodeGraphBuilder::VisitConstruct() {
     node = lowering.value();
   } else {
     DCHECK(!lowering.Changed());
-    node = ProcessConstructArguments(op, args, 2 + arg_count);
+    node = ProcessConstructArguments(op, args, arg_count_with_extra_args);
   }
   environment()->BindAccumulator(node, Environment::kAttachFrameState);
 }
@@ -2594,9 +2591,10 @@ void BytecodeGraphBuilder::VisitConstructWithSpread() {
   Node* callee = environment()->LookupRegister(callee_reg);
 
   CallFrequency frequency = ComputeCallFrequency(slot_id);
+  const uint32_t arg_count = static_cast<uint32_t>(reg_count);
+  const uint32_t arg_count_with_extra_args = kTargetAndNewTarget + arg_count;
   const Operator* op = javascript()->ConstructWithSpread(
-      static_cast<uint32_t>(reg_count + 2), frequency, feedback);
-  int arg_count = static_cast<int>(reg_count);
+      arg_count_with_extra_args, frequency, feedback);
   Node* const* args = GetConstructArgumentsFromRegister(callee, new_target,
                                                         first_reg, arg_count);
   JSTypeHintLowering::LoweringResult lowering = TryBuildSimplifiedConstruct(
@@ -2608,7 +2606,7 @@ void BytecodeGraphBuilder::VisitConstructWithSpread() {
     node = lowering.value();
   } else {
     DCHECK(!lowering.Changed());
-    node = ProcessConstructArguments(op, args, 2 + arg_count);
+    node = ProcessConstructArguments(op, args, arg_count_with_extra_args);
   }
   environment()->BindAccumulator(node, Environment::kAttachFrameState);
 }
@@ -2810,19 +2808,27 @@ SpeculationMode BytecodeGraphBuilder::GetSpeculationMode(int slot_id) const {
 }
 
 void BytecodeGraphBuilder::VisitBitwiseNot() {
-  BuildUnaryOp(javascript()->BitwiseNot());
+  FeedbackSource feedback = CreateFeedbackSource(
+      bytecode_iterator().GetSlotOperand(kUnaryOperationHintIndex).ToInt());
+  BuildUnaryOp(javascript()->BitwiseNot(feedback));
 }
 
 void BytecodeGraphBuilder::VisitDec() {
-  BuildUnaryOp(javascript()->Decrement());
+  FeedbackSource feedback = CreateFeedbackSource(
+      bytecode_iterator().GetSlotOperand(kUnaryOperationHintIndex).ToInt());
+  BuildUnaryOp(javascript()->Decrement(feedback));
 }
 
 void BytecodeGraphBuilder::VisitInc() {
-  BuildUnaryOp(javascript()->Increment());
+  FeedbackSource feedback = CreateFeedbackSource(
+      bytecode_iterator().GetSlotOperand(kUnaryOperationHintIndex).ToInt());
+  BuildUnaryOp(javascript()->Increment(feedback));
 }
 
 void BytecodeGraphBuilder::VisitNegate() {
-  BuildUnaryOp(javascript()->Negate());
+  FeedbackSource feedback = CreateFeedbackSource(
+      bytecode_iterator().GetSlotOperand(kUnaryOperationHintIndex).ToInt());
+  BuildUnaryOp(javascript()->Negate(feedback));
 }
 
 void BytecodeGraphBuilder::VisitAdd() {
diff --git a/deps/v8/src/compiler/code-assembler.cc b/deps/v8/src/compiler/code-assembler.cc
index 302c429f0fc..44177c16b5b 100644
--- a/deps/v8/src/compiler/code-assembler.cc
+++ b/deps/v8/src/compiler/code-assembler.cc
@@ -308,6 +308,10 @@ TNode<ExternalReference> CodeAssembler::ExternalConstant(
       raw_assembler()->ExternalConstant(address));
 }
 
+TNode<Float32T> CodeAssembler::Float32Constant(double value) {
+  return UncheckedCast<Float32T>(jsgraph()->Float32Constant(value));
+}
+
 TNode<Float64T> CodeAssembler::Float64Constant(double value) {
   return UncheckedCast<Float64T>(jsgraph()->Float64Constant(value));
 }
@@ -435,6 +439,20 @@ void CodeAssembler::Return(TNode<WordT> value) {
   return raw_assembler()->Return(value);
 }
 
+void CodeAssembler::Return(TNode<Float32T> value) {
+  DCHECK_EQ(1, raw_assembler()->call_descriptor()->ReturnCount());
+  DCHECK_EQ(MachineType::Float32(),
+            raw_assembler()->call_descriptor()->GetReturnType(0));
+  return raw_assembler()->Return(value);
+}
+
+void CodeAssembler::Return(TNode<Float64T> value) {
+  DCHECK_EQ(1, raw_assembler()->call_descriptor()->ReturnCount());
+  DCHECK_EQ(MachineType::Float64(),
+            raw_assembler()->call_descriptor()->GetReturnType(0));
+  return raw_assembler()->Return(value);
+}
+
 void CodeAssembler::Return(TNode<WordT> value1, TNode<WordT> value2) {
   DCHECK_EQ(2, raw_assembler()->call_descriptor()->ReturnCount());
   DCHECK_EQ(
@@ -1009,11 +1027,7 @@ Node* CodeAssembler::CallJSStubImpl(const CallInterfaceDescriptor& descriptor,
     inputs.Add(new_target);
   }
   inputs.Add(arity);
-#ifdef V8_REVERSE_JSARGS
-  for (auto arg : base::Reversed(args)) inputs.Add(arg);
-#else
   for (auto arg : args) inputs.Add(arg);
-#endif
   if (descriptor.HasContextParameter()) {
     inputs.Add(context);
   }
@@ -1375,6 +1389,7 @@ void CodeAssemblerLabel::MergeVariables() {
     }
     // If the following asserts, then you've jumped to a label without a bound
     // variable along that path that expects to merge its value into a phi.
+    // This can also occur if a label is bound that is never jumped to.
     DCHECK(variable_phis_.find(var) == variable_phis_.end() ||
            count == merge_count_);
     USE(count);
diff --git a/deps/v8/src/compiler/code-assembler.h b/deps/v8/src/compiler/code-assembler.h
index 3a137fdee2a..d9d81cfe30c 100644
--- a/deps/v8/src/compiler/code-assembler.h
+++ b/deps/v8/src/compiler/code-assembler.h
@@ -65,7 +65,6 @@ class JSSegmenter;
 class JSV8BreakIterator;
 class JSWeakCollection;
 class JSFinalizationRegistry;
-class JSFinalizationRegistryCleanupIterator;
 class JSWeakMap;
 class JSWeakRef;
 class JSWeakSet;
@@ -76,8 +75,8 @@ class PromiseReactionJobTask;
 class PromiseRejectReactionJobTask;
 class WasmDebugInfo;
 class Zone;
-#define MAKE_FORWARD_DECLARATION(V, NAME, Name, name) class Name;
-TORQUE_INTERNAL_CLASS_LIST_GENERATOR(MAKE_FORWARD_DECLARATION, UNUSED)
+#define MAKE_FORWARD_DECLARATION(Name) class Name;
+TORQUE_INTERNAL_CLASS_LIST(MAKE_FORWARD_DECLARATION)
 #undef MAKE_FORWARD_DECLARATION
 
 template <typename T>
@@ -274,6 +273,7 @@ class CodeAssemblerParameterizedLabel;
   V(WordShl, WordT, WordT, IntegralT)                                   \
   V(WordShr, WordT, WordT, IntegralT)                                   \
   V(WordSar, WordT, WordT, IntegralT)                                   \
+  V(WordSarShiftOutZeros, WordT, WordT, IntegralT)                      \
   V(Word32Or, Word32T, Word32T, Word32T)                                \
   V(Word32And, Word32T, Word32T, Word32T)                               \
   V(Word32Xor, Word32T, Word32T, Word32T)                               \
@@ -281,6 +281,7 @@ class CodeAssemblerParameterizedLabel;
   V(Word32Shl, Word32T, Word32T, Word32T)                               \
   V(Word32Shr, Word32T, Word32T, Word32T)                               \
   V(Word32Sar, Word32T, Word32T, Word32T)                               \
+  V(Word32SarShiftOutZeros, Word32T, Word32T, Word32T)                  \
   V(Word64And, Word64T, Word64T, Word64T)                               \
   V(Word64Or, Word64T, Word64T, Word64T)                                \
   V(Word64Xor, Word64T, Word64T, Word64T)                               \
@@ -321,6 +322,7 @@ TNode<Float64T> Float64Add(TNode<Float64T> a, TNode<Float64T> b);
   V(BitcastMaybeObjectToWord, IntPtrT, MaybeObject)            \
   V(BitcastWordToTagged, Object, WordT)                        \
   V(BitcastWordToTaggedSigned, Smi, WordT)                     \
+  V(TruncateFloat32ToInt32, Int32T, Float32T)                  \
   V(TruncateFloat64ToFloat32, Float32T, Float64T)              \
   V(TruncateFloat64ToWord32, Uint32T, Float64T)                \
   V(TruncateInt64ToInt32, Int32T, Int64T)                      \
@@ -533,6 +535,7 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   TNode<String> StringConstant(const char* str);
   TNode<Oddball> BooleanConstant(bool value);
   TNode<ExternalReference> ExternalConstant(ExternalReference address);
+  TNode<Float32T> Float32Constant(double value);
   TNode<Float64T> Float64Constant(double value);
   TNode<BoolT> Int32TrueConstant() {
     return ReinterpretCast<BoolT>(Int32Constant(1));
@@ -572,6 +575,8 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   void Return(TNode<Int32T> value);
   void Return(TNode<Uint32T> value);
   void Return(TNode<WordT> value);
+  void Return(TNode<Float32T> value);
+  void Return(TNode<Float64T> value);
   void Return(TNode<WordT> value1, TNode<WordT> value2);
   void PopAndReturn(Node* pop, Node* value);
 
diff --git a/deps/v8/src/compiler/common-operator-reducer.cc b/deps/v8/src/compiler/common-operator-reducer.cc
index 95ecb0f8206..c04617c2444 100644
--- a/deps/v8/src/compiler/common-operator-reducer.cc
+++ b/deps/v8/src/compiler/common-operator-reducer.cc
@@ -307,8 +307,7 @@ Reduction CommonOperatorReducer::ReduceReturn(Node* node) {
     // hence checkpoints can be cut out of the effect chain flowing into it.
     effect = NodeProperties::GetEffectInput(effect);
     NodeProperties::ReplaceEffectInput(node, effect);
-    Reduction const reduction = ReduceReturn(node);
-    return reduction.Changed() ? reduction : Changed(node);
+    return Changed(node).FollowedBy(ReduceReturn(node));
   }
   // TODO(ahaas): Extend the reduction below to multiple return values.
   if (ValueInputCountOfReturn(node->op()) != 1) {
diff --git a/deps/v8/src/compiler/compilation-dependencies.cc b/deps/v8/src/compiler/compilation-dependencies.cc
index 33990dfa480..b9ed54256a6 100644
--- a/deps/v8/src/compiler/compilation-dependencies.cc
+++ b/deps/v8/src/compiler/compilation-dependencies.cc
@@ -176,7 +176,7 @@ class FieldRepresentationDependency final : public CompilationDependency {
   void Install(const MaybeObjectHandle& code) const override {
     SLOW_DCHECK(IsValid());
     DependentCode::InstallDependency(owner_.isolate(), code, owner_.object(),
-                                     DependentCode::kFieldOwnerGroup);
+                                     DependentCode::kFieldRepresentationGroup);
   }
 
  private:
@@ -206,7 +206,7 @@ class FieldTypeDependency final : public CompilationDependency {
   void Install(const MaybeObjectHandle& code) const override {
     SLOW_DCHECK(IsValid());
     DependentCode::InstallDependency(owner_.isolate(), code, owner_.object(),
-                                     DependentCode::kFieldOwnerGroup);
+                                     DependentCode::kFieldTypeGroup);
   }
 
  private:
@@ -234,7 +234,7 @@ class FieldConstnessDependency final : public CompilationDependency {
   void Install(const MaybeObjectHandle& code) const override {
     SLOW_DCHECK(IsValid());
     DependentCode::InstallDependency(owner_.isolate(), code, owner_.object(),
-                                     DependentCode::kFieldOwnerGroup);
+                                     DependentCode::kFieldConstGroup);
   }
 
  private:
@@ -534,8 +534,7 @@ bool CompilationDependencies::Commit(Handle<Code> code) {
   // that triggers its deoptimization.
   if (FLAG_stress_gc_during_compilation) {
     broker_->isolate()->heap()->PreciseCollectAllGarbage(
-        Heap::kNoGCFlags, GarbageCollectionReason::kTesting,
-        kGCCallbackFlagForced);
+        Heap::kForcedGC, GarbageCollectionReason::kTesting, kNoGCCallbackFlags);
   }
 #ifdef DEBUG
   for (auto dep : dependencies_) {
diff --git a/deps/v8/src/compiler/effect-control-linearizer.cc b/deps/v8/src/compiler/effect-control-linearizer.cc
index d3344b95459..65bb2eaf053 100644
--- a/deps/v8/src/compiler/effect-control-linearizer.cc
+++ b/deps/v8/src/compiler/effect-control-linearizer.cc
@@ -564,6 +564,12 @@ void EffectControlLinearizer::Run() {
   // TODO(rmcilroy) We should not depend on having rpo_order on schedule, and
   // instead just do our own RPO walk here.
   for (BasicBlock* block : *(schedule()->rpo_order())) {
+    if (block != schedule()->start() && block->PredecessorCount() == 0) {
+      // Block has been removed from the schedule by a preceeding unreachable
+      // node, just skip it.
+      continue;
+    }
+
     gasm()->Reset(block);
 
     BasicBlock::iterator instr = block->begin();
@@ -2370,25 +2376,21 @@ Node* EffectControlLinearizer::LowerCheckedUint32Bounds(Node* node,
   const CheckBoundsParameters& params = CheckBoundsParametersOf(node->op());
 
   Node* check = __ Uint32LessThan(index, limit);
-  switch (params.mode()) {
-    case CheckBoundsParameters::kDeoptOnOutOfBounds:
-      __ DeoptimizeIfNot(DeoptimizeReason::kOutOfBounds,
-                         params.check_parameters().feedback(), check,
-                         frame_state, IsSafetyCheck::kCriticalSafetyCheck);
-      break;
-    case CheckBoundsParameters::kAbortOnOutOfBounds: {
-      auto if_abort = __ MakeDeferredLabel();
-      auto done = __ MakeLabel();
+  if (!(params.flags() & CheckBoundsFlag::kAbortOnOutOfBounds)) {
+    __ DeoptimizeIfNot(DeoptimizeReason::kOutOfBounds,
+                       params.check_parameters().feedback(), check, frame_state,
+                       IsSafetyCheck::kCriticalSafetyCheck);
+  } else {
+    auto if_abort = __ MakeDeferredLabel();
+    auto done = __ MakeLabel();
 
-      __ Branch(check, &done, &if_abort);
+    __ Branch(check, &done, &if_abort);
 
-      __ Bind(&if_abort);
-      __ Unreachable();
-      __ Goto(&done);
+    __ Bind(&if_abort);
+    __ Unreachable();
+    __ Goto(&done);
 
-      __ Bind(&done);
-      break;
-    }
+    __ Bind(&done);
   }
 
   return index;
@@ -2421,25 +2423,21 @@ Node* EffectControlLinearizer::LowerCheckedUint64Bounds(Node* node,
   const CheckBoundsParameters& params = CheckBoundsParametersOf(node->op());
 
   Node* check = __ Uint64LessThan(index, limit);
-  switch (params.mode()) {
-    case CheckBoundsParameters::kDeoptOnOutOfBounds:
-      __ DeoptimizeIfNot(DeoptimizeReason::kOutOfBounds,
-                         params.check_parameters().feedback(), check,
-                         frame_state, IsSafetyCheck::kCriticalSafetyCheck);
-      break;
-    case CheckBoundsParameters::kAbortOnOutOfBounds: {
-      auto if_abort = __ MakeDeferredLabel();
-      auto done = __ MakeLabel();
+  if (!(params.flags() & CheckBoundsFlag::kAbortOnOutOfBounds)) {
+    __ DeoptimizeIfNot(DeoptimizeReason::kOutOfBounds,
+                       params.check_parameters().feedback(), check, frame_state,
+                       IsSafetyCheck::kCriticalSafetyCheck);
+  } else {
+    auto if_abort = __ MakeDeferredLabel();
+    auto done = __ MakeLabel();
 
-      __ Branch(check, &done, &if_abort);
+    __ Branch(check, &done, &if_abort);
 
-      __ Bind(&if_abort);
-      __ Unreachable();
-      __ Goto(&done);
+    __ Bind(&if_abort);
+    __ Unreachable();
+    __ Goto(&done);
 
-      __ Bind(&done);
-      break;
-    }
+    __ Bind(&done);
   }
   return index;
 }
@@ -2702,6 +2700,20 @@ Node* EffectControlLinearizer::BuildCheckedHeapNumberOrOddballToFloat64(
                          check_number, frame_state);
       break;
     }
+    case CheckTaggedInputMode::kNumberOrBoolean: {
+      auto check_done = __ MakeLabel();
+
+      __ GotoIf(check_number, &check_done);
+      __ DeoptimizeIfNot(DeoptimizeReason::kNotANumberOrBoolean, feedback,
+                         __ TaggedEqual(value_map, __ BooleanMapConstant()),
+                         frame_state);
+      STATIC_ASSERT_FIELD_OFFSETS_EQUAL(HeapNumber::kValueOffset,
+                                        Oddball::kToNumberRawOffset);
+      __ Goto(&check_done);
+
+      __ Bind(&check_done);
+      break;
+    }
     case CheckTaggedInputMode::kNumberOrOddball: {
       auto check_done = __ MakeLabel();
 
@@ -3758,7 +3770,7 @@ Node* EffectControlLinearizer::LowerDeadValue(Node* node) {
     Node* unreachable = __ Unreachable();
     NodeProperties::ReplaceValueInput(node, unreachable, 0);
   }
-  return node;
+  return gasm()->AddNode(node);
 }
 
 Node* EffectControlLinearizer::LowerStringToNumber(Node* node) {
@@ -4552,18 +4564,20 @@ Node* EffectControlLinearizer::ChangeUint32ToSmi(Node* value) {
 }
 
 Node* EffectControlLinearizer::ChangeSmiToIntPtr(Node* value) {
-  // Do shift on 32bit values if Smis are stored in the lower word.
   if (machine()->Is64() && SmiValuesAre31Bits()) {
-    return __ ChangeInt32ToInt64(
-        __ Word32Sar(__ TruncateInt64ToInt32(value), SmiShiftBitsConstant()));
+    // First sign-extend the upper half, then shift away the Smi tag.
+    return __ WordSarShiftOutZeros(
+        __ ChangeInt32ToInt64(__ TruncateInt64ToInt32(value)),
+        SmiShiftBitsConstant());
   }
-  return __ WordSar(value, SmiShiftBitsConstant());
+  return __ WordSarShiftOutZeros(value, SmiShiftBitsConstant());
 }
 
 Node* EffectControlLinearizer::ChangeSmiToInt32(Node* value) {
   // Do shift on 32bit values if Smis are stored in the lower word.
   if (machine()->Is64() && SmiValuesAre31Bits()) {
-    return __ Word32Sar(__ TruncateInt64ToInt32(value), SmiShiftBitsConstant());
+    return __ Word32SarShiftOutZeros(__ TruncateInt64ToInt32(value),
+                                     SmiShiftBitsConstant());
   }
   if (machine()->Is64()) {
     return __ TruncateInt64ToInt32(ChangeSmiToIntPtr(value));
diff --git a/deps/v8/src/compiler/globals.h b/deps/v8/src/compiler/globals.h
index a8d8a47c59c..7c4eae7eb25 100644
--- a/deps/v8/src/compiler/globals.h
+++ b/deps/v8/src/compiler/globals.h
@@ -6,11 +6,22 @@
 #define V8_COMPILER_GLOBALS_H_
 
 #include "src/common/globals.h"
+#include "src/flags/flags.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
+// The nci flag is currently used to experiment with feedback collection in
+// optimized code produced by generic lowering.
+// Considerations:
+// - Should we increment the call count? https://crbug.com/v8/10524
+// - Is feedback already megamorphic in all these cases?
+//
+// TODO(jgruber): Remove once we've made a decision whether to collect feedback
+// unconditionally.
+inline bool CollectFeedbackInGenericLowering() { return FLAG_turbo_nci; }
+
 enum class StackCheckKind {
   kJSFunctionEntry = 0,
   kJSIterationBody,
diff --git a/deps/v8/src/compiler/graph-assembler.cc b/deps/v8/src/compiler/graph-assembler.cc
index 246bf1e2291..27a4bca9d43 100644
--- a/deps/v8/src/compiler/graph-assembler.cc
+++ b/deps/v8/src/compiler/graph-assembler.cc
@@ -19,7 +19,8 @@ namespace compiler {
 
 class GraphAssembler::BasicBlockUpdater {
  public:
-  BasicBlockUpdater(Schedule* schedule, Graph* graph, Zone* temp_zone);
+  BasicBlockUpdater(Schedule* schedule, Graph* graph,
+                    CommonOperatorBuilder* common, Zone* temp_zone);
 
   Node* AddNode(Node* node);
   Node* AddNode(Node* node, BasicBlock* to);
@@ -31,7 +32,6 @@ class GraphAssembler::BasicBlockUpdater {
   void AddBranch(Node* branch, BasicBlock* tblock, BasicBlock* fblock);
   void AddGoto(BasicBlock* to);
   void AddGoto(BasicBlock* from, BasicBlock* to);
-  void AddThrow(Node* node);
 
   void StartBlock(BasicBlock* block);
   BasicBlock* Finalize(BasicBlock* original);
@@ -48,6 +48,7 @@ class GraphAssembler::BasicBlockUpdater {
   bool IsOriginalNode(Node* node);
   void UpdateSuccessors(BasicBlock* block);
   void SetBlockDeferredFromPredecessors();
+  void RemoveSuccessorsFromSchedule();
   void CopyForChange();
 
   Zone* temp_zone_;
@@ -64,6 +65,7 @@ class GraphAssembler::BasicBlockUpdater {
 
   Schedule* schedule_;
   Graph* graph_;
+  CommonOperatorBuilder* common_;
 
   // The nodes in the original block if we are in 'changed' state. Retained to
   // avoid invalidating iterators that are iterating over the original nodes of
@@ -85,14 +87,15 @@ class GraphAssembler::BasicBlockUpdater {
   State state_;
 };
 
-GraphAssembler::BasicBlockUpdater::BasicBlockUpdater(Schedule* schedule,
-                                                     Graph* graph,
-                                                     Zone* temp_zone)
+GraphAssembler::BasicBlockUpdater::BasicBlockUpdater(
+    Schedule* schedule, Graph* graph, CommonOperatorBuilder* common,
+    Zone* temp_zone)
     : temp_zone_(temp_zone),
       current_block_(nullptr),
       original_block_(nullptr),
       schedule_(schedule),
       graph_(graph),
+      common_(common),
       saved_nodes_(schedule->zone()),
       saved_successors_(schedule->zone()),
       original_control_(BasicBlock::kNone),
@@ -264,28 +267,6 @@ void GraphAssembler::BasicBlockUpdater::AddGoto(BasicBlock* from,
   current_block_ = nullptr;
 }
 
-void GraphAssembler::BasicBlockUpdater::AddThrow(Node* node) {
-  if (state_ == kUnchanged) {
-    CopyForChange();
-  }
-  schedule_->AddThrow(current_block_, node);
-
-  // Clear original successors and replace the block's original control and
-  // control input to the throw, since this block is now connected directly to
-  // the end.
-  if (original_control_input_ != nullptr) {
-    NodeProperties::ReplaceUses(original_control_input_, node, nullptr, node);
-    original_control_input_->Kill();
-  }
-  original_control_input_ = node;
-  original_control_ = BasicBlock::kThrow;
-
-  for (SuccessorInfo succ : saved_successors_) {
-    succ.block->RemovePredecessor(succ.index);
-  }
-  saved_successors_.clear();
-}
-
 void GraphAssembler::BasicBlockUpdater::UpdateSuccessors(BasicBlock* block) {
   for (SuccessorInfo succ : saved_successors_) {
     (succ.block->predecessors())[succ.index] = block;
@@ -341,9 +322,10 @@ GraphAssembler::GraphAssembler(MachineGraph* mcgraph, Zone* zone,
       mcgraph_(mcgraph),
       effect_(nullptr),
       control_(nullptr),
-      block_updater_(schedule != nullptr ? new BasicBlockUpdater(
-                                               schedule, mcgraph->graph(), zone)
-                                         : nullptr),
+      block_updater_(schedule != nullptr
+                         ? new BasicBlockUpdater(schedule, mcgraph->graph(),
+                                                 mcgraph->common(), zone)
+                         : nullptr),
       loop_headers_(zone),
       mark_loop_exits_(mark_loop_exits) {}
 
@@ -590,6 +572,11 @@ TNode<Boolean> JSGraphAssembler::ObjectIsCallable(TNode<Object> value) {
       graph()->NewNode(simplified()->ObjectIsCallable(), value));
 }
 
+TNode<Boolean> JSGraphAssembler::ObjectIsUndetectable(TNode<Object> value) {
+  return AddNode<Boolean>(
+      graph()->NewNode(simplified()->ObjectIsUndetectable(), value));
+}
+
 Node* JSGraphAssembler::CheckIf(Node* cond, DeoptimizeReason reason) {
   return AddNode(graph()->NewNode(simplified()->CheckIf(reason), cond, effect(),
                                   control()));
@@ -832,11 +819,15 @@ BasicBlock* GraphAssembler::FinalizeCurrentBlock(BasicBlock* block) {
 
 void GraphAssembler::ConnectUnreachableToEnd() {
   DCHECK_EQ(effect()->opcode(), IrOpcode::kUnreachable);
-  Node* throw_node = graph()->NewNode(common()->Throw(), effect(), control());
-  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
-  effect_ = control_ = mcgraph()->Dead();
-  if (block_updater_) {
-    block_updater_->AddThrow(throw_node);
+  // When maintaining the schedule we can't easily rewire the successor blocks
+  // to disconnect them from the graph, so we just leave the unreachable nodes
+  // in the schedule.
+  // TODO(9684): Add a scheduled dead-code elimination phase to remove all the
+  // subsiquent unreacahble code from the schedule.
+  if (!block_updater_) {
+    Node* throw_node = graph()->NewNode(common()->Throw(), effect(), control());
+    NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
+    effect_ = control_ = mcgraph()->Dead();
   }
 }
 
diff --git a/deps/v8/src/compiler/graph-assembler.h b/deps/v8/src/compiler/graph-assembler.h
index b9f605ae6e9..f57c732912b 100644
--- a/deps/v8/src/compiler/graph-assembler.h
+++ b/deps/v8/src/compiler/graph-assembler.h
@@ -82,6 +82,7 @@ class BasicBlock;
   V(Word32Equal)                          \
   V(Word32Or)                             \
   V(Word32Sar)                            \
+  V(Word32SarShiftOutZeros)               \
   V(Word32Shl)                            \
   V(Word32Shr)                            \
   V(Word32Xor)                            \
@@ -91,7 +92,9 @@ class BasicBlock;
   V(WordAnd)                              \
   V(WordEqual)                            \
   V(WordSar)                              \
-  V(WordShl)
+  V(WordSarShiftOutZeros)                 \
+  V(WordShl)                              \
+  V(WordXor)
 
 #define CHECKED_ASSEMBLER_MACH_BINOP_LIST(V) \
   V(Int32AddWithOverflow)                    \
@@ -579,6 +582,7 @@ void GraphAssembler::MergeState(GraphAssemblerLabel<sizeof...(Vars)>* label,
       label->effect_->ReplaceInput(1, effect());
       for (size_t i = 0; i < kVarCount; i++) {
         label->bindings_[i]->ReplaceInput(1, var_array[i]);
+        CHECK(!NodeProperties::IsTyped(var_array[i]));  // Unsupported.
       }
     }
   } else {
@@ -622,6 +626,13 @@ void GraphAssembler::MergeState(GraphAssemblerLabel<sizeof...(Vars)>* label,
         NodeProperties::ChangeOp(
             label->bindings_[i],
             common()->Phi(label->representations_[i], merged_count + 1));
+        if (NodeProperties::IsTyped(label->bindings_[i])) {
+          CHECK(NodeProperties::IsTyped(var_array[i]));
+          Type old_type = NodeProperties::GetType(label->bindings_[i]);
+          Type new_type = Type::Union(
+              old_type, NodeProperties::GetType(var_array[i]), graph()->zone());
+          NodeProperties::SetType(label->bindings_[i], new_type);
+        }
       }
     }
   }
@@ -822,6 +833,7 @@ class V8_EXPORT_PRIVATE JSGraphAssembler : public GraphAssembler {
   TNode<String> StringSubstring(TNode<String> string, TNode<Number> from,
                                 TNode<Number> to);
   TNode<Boolean> ObjectIsCallable(TNode<Object> value);
+  TNode<Boolean> ObjectIsUndetectable(TNode<Object> value);
   Node* CheckIf(Node* cond, DeoptimizeReason reason);
   TNode<Boolean> NumberIsFloat64Hole(TNode<Number> value);
   TNode<Boolean> ToBoolean(TNode<Object> value);
diff --git a/deps/v8/src/compiler/graph-reducer.cc b/deps/v8/src/compiler/graph-reducer.cc
index 91b4b51c91b..d9bc9d6c22b 100644
--- a/deps/v8/src/compiler/graph-reducer.cc
+++ b/deps/v8/src/compiler/graph-reducer.cc
@@ -161,6 +161,11 @@ void GraphReducer::ReduceTop() {
   // Check if the reduction is an in-place update of the {node}.
   Node* const replacement = reduction.replacement();
   if (replacement == node) {
+    for (Node* const user : node->uses()) {
+      DCHECK_IMPLIES(user == node, state_.Get(node) != State::kVisited);
+      Revisit(user);
+    }
+
     // In-place update of {node}, may need to recurse on an input.
     Node::Inputs node_inputs = node->inputs();
     for (int i = 0; i < node_inputs.count(); ++i) {
@@ -178,12 +183,6 @@ void GraphReducer::ReduceTop() {
   // Check if we have a new replacement.
   if (replacement != node) {
     Replace(node, replacement, max_id);
-  } else {
-    // Revisit all uses of the node.
-    for (Node* const user : node->uses()) {
-      // Don't revisit this node if it refers to itself.
-      if (user != node) Revisit(user);
-    }
   }
 }
 
diff --git a/deps/v8/src/compiler/graph-reducer.h b/deps/v8/src/compiler/graph-reducer.h
index bbcc67b0748..3c15214d932 100644
--- a/deps/v8/src/compiler/graph-reducer.h
+++ b/deps/v8/src/compiler/graph-reducer.h
@@ -35,6 +35,10 @@ class Reduction final {
 
   Node* replacement() const { return replacement_; }
   bool Changed() const { return replacement() != nullptr; }
+  Reduction FollowedBy(Reduction next) const {
+    if (next.Changed()) return next;
+    return *this;
+  }
 
  private:
   Node* replacement_;
diff --git a/deps/v8/src/compiler/graph-visualizer.cc b/deps/v8/src/compiler/graph-visualizer.cc
index 86e3da9d27a..39e921c0e0f 100644
--- a/deps/v8/src/compiler/graph-visualizer.cc
+++ b/deps/v8/src/compiler/graph-visualizer.cc
@@ -964,6 +964,97 @@ void PrintScheduledGraph(std::ostream& os, const Schedule* schedule) {
 
 }  // namespace
 
+std::ostream& operator<<(std::ostream& os,
+                         const LiveRangeAsJSON& live_range_json) {
+  const LiveRange& range = live_range_json.range_;
+  os << "{\"id\":" << range.relative_id() << ",\"type\":";
+  if (range.HasRegisterAssigned()) {
+    const InstructionOperand op = range.GetAssignedOperand();
+    os << "\"assigned\",\"op\":"
+       << InstructionOperandAsJSON{&op, &(live_range_json.code_)};
+  } else if (range.spilled() && !range.TopLevel()->HasNoSpillType()) {
+    const TopLevelLiveRange* top = range.TopLevel();
+    if (top->HasSpillOperand()) {
+      os << "\"assigned\",\"op\":"
+         << InstructionOperandAsJSON{top->GetSpillOperand(),
+                                     &(live_range_json.code_)};
+    } else {
+      int index = top->GetSpillRange()->assigned_slot();
+      os << "\"spilled\",\"op\":";
+      if (IsFloatingPoint(top->representation())) {
+        os << "\"fp_stack:" << index << "\"";
+      } else {
+        os << "\"stack:" << index << "\"";
+      }
+    }
+  } else {
+    os << "\"none\"";
+  }
+
+  os << ",\"intervals\":[";
+  bool first = true;
+  for (const UseInterval* interval = range.first_interval();
+       interval != nullptr; interval = interval->next()) {
+    if (!first) os << ",";
+    first = false;
+    os << "[" << interval->start().value() << "," << interval->end().value()
+       << "]";
+  }
+
+  os << "]}";
+  return os;
+}
+
+std::ostream& operator<<(
+    std::ostream& os,
+    const TopLevelLiveRangeAsJSON& top_level_live_range_json) {
+  int vreg = top_level_live_range_json.range_.vreg();
+  bool first = true;
+  os << "\"" << (vreg > 0 ? vreg : -vreg) << "\":{ \"child_ranges\":[";
+  for (const LiveRange* child = &(top_level_live_range_json.range_);
+       child != nullptr; child = child->next()) {
+    if (!top_level_live_range_json.range_.IsEmpty()) {
+      if (!first) os << ",";
+      first = false;
+      os << LiveRangeAsJSON{*child, top_level_live_range_json.code_};
+    }
+  }
+  os << "]";
+  if (top_level_live_range_json.range_.IsFixed()) {
+    os << ", \"is_deferred\": "
+       << (top_level_live_range_json.range_.IsDeferredFixed() ? "true"
+                                                              : "false");
+  }
+  os << "}";
+  return os;
+}
+
+void PrintTopLevelLiveRanges(std::ostream& os,
+                             const ZoneVector<TopLevelLiveRange*> ranges,
+                             const InstructionSequence& code) {
+  bool first = true;
+  os << "{";
+  for (const TopLevelLiveRange* range : ranges) {
+    if (range != nullptr && !range->IsEmpty()) {
+      if (!first) os << ",";
+      first = false;
+      os << TopLevelLiveRangeAsJSON{*range, code};
+    }
+  }
+  os << "}";
+}
+
+std::ostream& operator<<(std::ostream& os,
+                         const RegisterAllocationDataAsJSON& ac) {
+  os << "\"fixed_double_live_ranges\": ";
+  PrintTopLevelLiveRanges(os, ac.data_.fixed_double_live_ranges(), ac.code_);
+  os << ",\"fixed_live_ranges\": ";
+  PrintTopLevelLiveRanges(os, ac.data_.fixed_live_ranges(), ac.code_);
+  os << ",\"live_ranges\": ";
+  PrintTopLevelLiveRanges(os, ac.data_.live_ranges(), ac.code_);
+  return os;
+}
+
 std::ostream& operator<<(std::ostream& os, const AsScheduledGraph& scheduled) {
   PrintScheduledGraph(os, scheduled.schedule);
   return os;
@@ -1228,7 +1319,7 @@ std::ostream& operator<<(std::ostream& os, const InstructionBlockAsJSON& b) {
 std::ostream& operator<<(std::ostream& os, const InstructionSequenceAsJSON& s) {
   const InstructionSequence* code = s.sequence_;
 
-  os << "\"blocks\": [";
+  os << "[";
 
   bool need_comma = false;
   for (int i = 0; i < code->InstructionBlockCount(); i++) {
diff --git a/deps/v8/src/compiler/graph-visualizer.h b/deps/v8/src/compiler/graph-visualizer.h
index 05f522b6bca..55859330157 100644
--- a/deps/v8/src/compiler/graph-visualizer.h
+++ b/deps/v8/src/compiler/graph-visualizer.h
@@ -22,6 +22,8 @@ class SourcePosition;
 namespace compiler {
 
 class Graph;
+class LiveRange;
+class TopLevelLiveRange;
 class Instruction;
 class InstructionBlock;
 class InstructionOperand;
@@ -155,6 +157,30 @@ std::ostream& operator<<(std::ostream& os, const AsC1V& ac);
 std::ostream& operator<<(std::ostream& os,
                          const AsC1VRegisterAllocationData& ac);
 
+struct LiveRangeAsJSON {
+  const LiveRange& range_;
+  const InstructionSequence& code_;
+};
+
+std::ostream& operator<<(std::ostream& os,
+                         const LiveRangeAsJSON& live_range_json);
+
+struct TopLevelLiveRangeAsJSON {
+  const TopLevelLiveRange& range_;
+  const InstructionSequence& code_;
+};
+
+std::ostream& operator<<(
+    std::ostream& os, const TopLevelLiveRangeAsJSON& top_level_live_range_json);
+
+struct RegisterAllocationDataAsJSON {
+  const RegisterAllocationData& data_;
+  const InstructionSequence& code_;
+};
+
+std::ostream& operator<<(std::ostream& os,
+                         const RegisterAllocationDataAsJSON& ac);
+
 struct InstructionOperandAsJSON {
   const InstructionOperand* op_;
   const InstructionSequence* code_;
diff --git a/deps/v8/src/compiler/heap-refs.h b/deps/v8/src/compiler/heap-refs.h
index deeaa89c1e3..ef0da29a05c 100644
--- a/deps/v8/src/compiler/heap-refs.h
+++ b/deps/v8/src/compiler/heap-refs.h
@@ -319,6 +319,7 @@ class V8_EXPORT_PRIVATE JSFunctionRef : public JSObjectRef {
   bool has_feedback_vector() const;
   bool has_initial_map() const;
   bool has_prototype() const;
+  bool IsOptimized() const;
   bool PrototypeRequiresRuntimeLookup() const;
 
   void Serialize();
@@ -331,6 +332,7 @@ class V8_EXPORT_PRIVATE JSFunctionRef : public JSObjectRef {
   NativeContextRef native_context() const;
   SharedFunctionInfoRef shared() const;
   FeedbackVectorRef feedback_vector() const;
+  CodeRef code() const;
   int InitialMapInstanceSizeWithMinSlack() const;
 };
 
@@ -383,45 +385,41 @@ class ContextRef : public HeapObjectRef {
   base::Optional<ScopeInfoRef> scope_info() const;
 };
 
-#define BROKER_COMPULSORY_NATIVE_CONTEXT_FIELDS(V)                    \
-  V(JSFunction, array_function)                                       \
-  V(JSFunction, boolean_function)                                     \
-  V(JSFunction, bigint_function)                                      \
-  V(JSFunction, number_function)                                      \
-  V(JSFunction, object_function)                                      \
-  V(JSFunction, promise_function)                                     \
-  V(JSFunction, promise_then)                                         \
-  V(JSFunction, regexp_function)                                      \
-  V(JSFunction, string_function)                                      \
-  V(JSFunction, symbol_function)                                      \
-  V(JSGlobalObject, global_object)                                    \
-  V(JSGlobalProxy, global_proxy_object)                               \
-  V(JSObject, promise_prototype)                                      \
-  V(Map, block_context_map)                                           \
-  V(Map, bound_function_with_constructor_map)                         \
-  V(Map, bound_function_without_constructor_map)                      \
-  V(Map, catch_context_map)                                           \
-  V(Map, eval_context_map)                                            \
-  V(Map, fast_aliased_arguments_map)                                  \
-  V(Map, function_context_map)                                        \
-  V(Map, initial_array_iterator_map)                                  \
-  V(Map, initial_string_iterator_map)                                 \
-  V(Map, iterator_result_map)                                         \
-  V(Map, js_array_holey_double_elements_map)                          \
-  V(Map, js_array_holey_elements_map)                                 \
-  V(Map, js_array_holey_smi_elements_map)                             \
-  V(Map, js_array_packed_double_elements_map)                         \
-  V(Map, js_array_packed_elements_map)                                \
-  V(Map, js_array_packed_smi_elements_map)                            \
-  V(Map, sloppy_arguments_map)                                        \
-  V(Map, slow_object_with_null_prototype_map)                         \
-  V(Map, strict_arguments_map)                                        \
-  V(Map, with_context_map)                                            \
-  V(ScriptContextTable, script_context_table)                         \
-  V(SharedFunctionInfo, promise_capability_default_reject_shared_fun) \
-  V(SharedFunctionInfo, promise_catch_finally_shared_fun)             \
-  V(SharedFunctionInfo, promise_then_finally_shared_fun)              \
-  V(SharedFunctionInfo, promise_capability_default_resolve_shared_fun)
+#define BROKER_COMPULSORY_NATIVE_CONTEXT_FIELDS(V) \
+  V(JSFunction, array_function)                    \
+  V(JSFunction, boolean_function)                  \
+  V(JSFunction, bigint_function)                   \
+  V(JSFunction, number_function)                   \
+  V(JSFunction, object_function)                   \
+  V(JSFunction, promise_function)                  \
+  V(JSFunction, promise_then)                      \
+  V(JSFunction, regexp_function)                   \
+  V(JSFunction, string_function)                   \
+  V(JSFunction, symbol_function)                   \
+  V(JSGlobalObject, global_object)                 \
+  V(JSGlobalProxy, global_proxy_object)            \
+  V(JSObject, promise_prototype)                   \
+  V(Map, block_context_map)                        \
+  V(Map, bound_function_with_constructor_map)      \
+  V(Map, bound_function_without_constructor_map)   \
+  V(Map, catch_context_map)                        \
+  V(Map, eval_context_map)                         \
+  V(Map, fast_aliased_arguments_map)               \
+  V(Map, function_context_map)                     \
+  V(Map, initial_array_iterator_map)               \
+  V(Map, initial_string_iterator_map)              \
+  V(Map, iterator_result_map)                      \
+  V(Map, js_array_holey_double_elements_map)       \
+  V(Map, js_array_holey_elements_map)              \
+  V(Map, js_array_holey_smi_elements_map)          \
+  V(Map, js_array_packed_double_elements_map)      \
+  V(Map, js_array_packed_elements_map)             \
+  V(Map, js_array_packed_smi_elements_map)         \
+  V(Map, sloppy_arguments_map)                     \
+  V(Map, slow_object_with_null_prototype_map)      \
+  V(Map, strict_arguments_map)                     \
+  V(Map, with_context_map)                         \
+  V(ScriptContextTable, script_context_table)
 
 // Those are set by Bootstrapper::ExportFromRuntime, which may not yet have
 // happened when Turbofan is invoked via --always-opt.
@@ -470,14 +468,6 @@ class ScriptContextTableRef : public HeapObjectRef {
   DEFINE_REF_CONSTRUCTOR(ScriptContextTable, HeapObjectRef)
 
   Handle<ScriptContextTable> object() const;
-
-  struct LookupResult {
-    ContextRef context;
-    bool immutable;
-    int index;
-  };
-
-  base::Optional<LookupResult> lookup(const NameRef& name) const;
 };
 
 class DescriptorArrayRef : public HeapObjectRef {
@@ -920,6 +910,8 @@ class CodeRef : public HeapObjectRef {
   DEFINE_REF_CONSTRUCTOR(Code, HeapObjectRef)
 
   Handle<Code> object() const;
+
+  unsigned inlined_bytecode_size() const;
 };
 
 class InternalizedStringRef : public StringRef {
diff --git a/deps/v8/src/compiler/int64-lowering.cc b/deps/v8/src/compiler/int64-lowering.cc
index ad68d34d038..a6bbd563a0e 100644
--- a/deps/v8/src/compiler/int64-lowering.cc
+++ b/deps/v8/src/compiler/int64-lowering.cc
@@ -670,6 +670,9 @@ void Int64Lowering::LowerNode(Node* node) {
       ReplaceNode(node, low_node, high_node);
       break;
     }
+    case IrOpcode::kWord64Rol:
+      DCHECK(machine()->Word32Rol().IsSupported());
+      V8_FALLTHROUGH;
     case IrOpcode::kWord64Ror: {
       DCHECK_EQ(2, node->InputCount());
       Node* input = node->InputAt(0);
@@ -702,14 +705,19 @@ void Int64Lowering::LowerNode(Node* node) {
           Node* inv_shift = graph()->NewNode(
               common()->Int32Constant(32 - masked_shift_value));
 
-          Node* low_node = graph()->NewNode(
-              machine()->Word32Or(),
-              graph()->NewNode(machine()->Word32Shr(), low_input, masked_shift),
-              graph()->NewNode(machine()->Word32Shl(), high_input, inv_shift));
-          Node* high_node = graph()->NewNode(
-              machine()->Word32Or(), graph()->NewNode(machine()->Word32Shr(),
-                                                      high_input, masked_shift),
-              graph()->NewNode(machine()->Word32Shl(), low_input, inv_shift));
+          auto* op1 = machine()->Word32Shr();
+          auto* op2 = machine()->Word32Shl();
+          bool is_ror = node->opcode() == IrOpcode::kWord64Ror;
+          if (!is_ror) std::swap(op1, op2);
+
+          Node* low_node =
+              graph()->NewNode(machine()->Word32Or(),
+                               graph()->NewNode(op1, low_input, masked_shift),
+                               graph()->NewNode(op2, high_input, inv_shift));
+          Node* high_node =
+              graph()->NewNode(machine()->Word32Or(),
+                               graph()->NewNode(op1, high_input, masked_shift),
+                               graph()->NewNode(op2, low_input, inv_shift));
           ReplaceNode(node, low_node, high_node);
         }
       } else {
@@ -720,15 +728,19 @@ void Int64Lowering::LowerNode(Node* node) {
                                graph()->NewNode(common()->Int32Constant(0x1F)));
         }
 
-        // By creating this bit-mask with SAR and SHL we do not have to deal
-        // with shift == 0 as a special case.
-        Node* inv_mask = graph()->NewNode(
-            machine()->Word32Shl(),
-            graph()->NewNode(machine()->Word32Sar(),
-                             graph()->NewNode(common()->Int32Constant(
-                                 std::numeric_limits<int32_t>::min())),
+        bool is_ror = node->opcode() == IrOpcode::kWord64Ror;
+        Node* inv_mask =
+            is_ror ? graph()->NewNode(
+                         machine()->Word32Xor(),
+                         graph()->NewNode(
+                             machine()->Word32Shr(),
+                             graph()->NewNode(common()->Int32Constant(-1)),
                              safe_shift),
-            graph()->NewNode(common()->Int32Constant(1)));
+                         graph()->NewNode(common()->Int32Constant(-1)))
+                   : graph()->NewNode(
+                         machine()->Word32Shl(),
+                         graph()->NewNode(common()->Int32Constant(-1)),
+                         safe_shift);
 
         Node* bit_mask =
             graph()->NewNode(machine()->Word32Xor(), inv_mask,
@@ -759,21 +771,24 @@ void Int64Lowering::LowerNode(Node* node) {
             lt32.Phi(MachineRepresentation::kWord32, GetReplacementHigh(input),
                      GetReplacementLow(input));
 
-        Node* rotate_low =
-            graph()->NewNode(machine()->Word32Ror(), input_low, safe_shift);
-        Node* rotate_high =
-            graph()->NewNode(machine()->Word32Ror(), input_high, safe_shift);
+        const Operator* oper =
+            is_ror ? machine()->Word32Ror() : machine()->Word32Rol().op();
+
+        Node* rotate_low = graph()->NewNode(oper, input_low, safe_shift);
+        Node* rotate_high = graph()->NewNode(oper, input_high, safe_shift);
+
+        auto* mask1 = bit_mask;
+        auto* mask2 = inv_mask;
+        if (!is_ror) std::swap(mask1, mask2);
 
         Node* low_node = graph()->NewNode(
             machine()->Word32Or(),
-            graph()->NewNode(machine()->Word32And(), rotate_low, bit_mask),
-            graph()->NewNode(machine()->Word32And(), rotate_high, inv_mask));
-
+            graph()->NewNode(machine()->Word32And(), rotate_low, mask1),
+            graph()->NewNode(machine()->Word32And(), rotate_high, mask2));
         Node* high_node = graph()->NewNode(
             machine()->Word32Or(),
-            graph()->NewNode(machine()->Word32And(), rotate_high, bit_mask),
-            graph()->NewNode(machine()->Word32And(), rotate_low, inv_mask));
-
+            graph()->NewNode(machine()->Word32And(), rotate_high, mask1),
+            graph()->NewNode(machine()->Word32And(), rotate_low, mask2));
         ReplaceNode(node, low_node, high_node);
       }
       break;
diff --git a/deps/v8/src/compiler/js-call-reducer.cc b/deps/v8/src/compiler/js-call-reducer.cc
index 3fb41a88092..719fc56d7ff 100644
--- a/deps/v8/src/compiler/js-call-reducer.cc
+++ b/deps/v8/src/compiler/js-call-reducer.cc
@@ -65,7 +65,6 @@ class JSCallReducerAssembler : public JSGraphAssembler {
     outermost_catch_scope_.set_has_handler(has_handler);
     outermost_catch_scope_.set_gasm(this);
   }
-  virtual ~JSCallReducerAssembler() {}
 
   TNode<Object> ReduceMathUnary(const Operator* op);
   TNode<Object> ReduceMathBinary(const Operator* op);
@@ -781,8 +780,9 @@ class IteratingArrayBuiltinReducerAssembler : public JSCallReducerAssembler {
 
 class PromiseBuiltinReducerAssembler : public JSCallReducerAssembler {
  public:
-  PromiseBuiltinReducerAssembler(JSGraph* jsgraph, Zone* zone, Node* node)
-      : JSCallReducerAssembler(jsgraph, zone, node) {
+  PromiseBuiltinReducerAssembler(JSGraph* jsgraph, Zone* zone, Node* node,
+                                 JSHeapBroker* broker)
+      : JSCallReducerAssembler(jsgraph, zone, node), broker_(broker) {
     DCHECK_EQ(IrOpcode::kJSConstruct, node->opcode());
   }
 
@@ -792,11 +792,7 @@ class PromiseBuiltinReducerAssembler : public JSCallReducerAssembler {
   int ConstructArity() const {
     DCHECK_EQ(IrOpcode::kJSConstruct, node_ptr()->opcode());
     ConstructParameters const& p = ConstructParametersOf(node_ptr()->op());
-    static constexpr int kTarget = 1;     // The first input.
-    static constexpr int kNewTarget = 1;  // The last input.
-    static constexpr int kExtraArgs = kTarget + kNewTarget;
-    DCHECK_GE(p.arity(), kExtraArgs);
-    return static_cast<int>(p.arity() - kExtraArgs);
+    return p.arity_without_implicit_args();
   }
 
   TNode<Object> NewTargetInput() const {
@@ -845,7 +841,8 @@ class PromiseBuiltinReducerAssembler : public JSCallReducerAssembler {
     FeedbackSource no_feedback_source{};
     MayThrow(_ {
       return AddNode<Object>(graph()->NewNode(
-          javascript()->Call(4, p.frequency(), no_feedback_source,
+          javascript()->Call(2 + kTargetAndReceiver, p.frequency(),
+                             no_feedback_source,
                              ConvertReceiverMode::kNullOrUndefined),
           executor, UndefinedConstant(), resolve, reject, ContextInput(),
           frame_state, effect(), control()));
@@ -858,12 +855,15 @@ class PromiseBuiltinReducerAssembler : public JSCallReducerAssembler {
     FeedbackSource no_feedback_source{};
     MayThrow(_ {
       return AddNode<Object>(graph()->NewNode(
-          javascript()->Call(3, p.frequency(), no_feedback_source,
+          javascript()->Call(1 + kTargetAndReceiver, p.frequency(),
+                             no_feedback_source,
                              ConvertReceiverMode::kNullOrUndefined),
           reject, UndefinedConstant(), exception, ContextInput(), frame_state,
           effect(), control()));
     });
   }
+
+  JSHeapBroker* const broker_;
 };
 
 class FastApiCallReducerAssembler : public JSCallReducerAssembler {
@@ -921,9 +921,10 @@ class FastApiCallReducerAssembler : public JSCallReducerAssembler {
         Internals::kJSObjectHeaderSize +
         (Internals::kEmbedderDataSlotSize * wrapper_object_index);
 
-    FieldAccess access(kTaggedBase, offset, MaybeHandle<Name>(),
-                       MaybeHandle<Map>(), Type::Any(), MachineType::Pointer(),
-                       WriteBarrierKind::kNoWriteBarrier);
+    FieldAccess access(
+        kTaggedBase, offset, MaybeHandle<Name>(), MaybeHandle<Map>(),
+        V8_HEAP_SANDBOX_BOOL ? Type::SandboxedExternalPointer() : Type::Any(),
+        MachineType::Pointer(), WriteBarrierKind::kNoWriteBarrier);
     TNode<RawPtrT> load = AddNode<RawPtrT>(graph()->NewNode(
         simplified()->LoadField(access), node, effect(), control()));
     return load;
@@ -1008,7 +1009,7 @@ TNode<Object> JSCallReducerAssembler::JSCall3(
   CallParameters const& p = CallParametersOf(node_ptr()->op());
   return MayThrow(_ {
     return AddNode<Object>(graph()->NewNode(
-        javascript()->Call(5, p.frequency(), p.feedback(),
+        javascript()->Call(3 + kTargetAndReceiver, p.frequency(), p.feedback(),
                            ConvertReceiverMode::kAny, p.speculation_mode(),
                            CallFeedbackRelation::kUnrelated),
         function, this_arg, arg0, arg1, arg2, ContextInput(), frame_state,
@@ -1023,7 +1024,7 @@ TNode<Object> JSCallReducerAssembler::JSCall4(
   CallParameters const& p = CallParametersOf(node_ptr()->op());
   return MayThrow(_ {
     return AddNode<Object>(graph()->NewNode(
-        javascript()->Call(6, p.frequency(), p.feedback(),
+        javascript()->Call(4 + kTargetAndReceiver, p.frequency(), p.feedback(),
                            ConvertReceiverMode::kAny, p.speculation_mode(),
                            CallFeedbackRelation::kUnrelated),
         function, this_arg, arg0, arg1, arg2, arg3, ContextInput(), frame_state,
@@ -2100,12 +2101,19 @@ TNode<Object> PromiseBuiltinReducerAssembler::ReducePromiseConstructor(
                    TrueConstant());
 
   // Allocate closures for the resolve and reject cases.
-  TNode<JSFunction> resolve = CreateClosureFromBuiltinSharedFunctionInfo(
-      native_context.promise_capability_default_resolve_shared_fun(),
-      promise_context);
-  TNode<JSFunction> reject = CreateClosureFromBuiltinSharedFunctionInfo(
-      native_context.promise_capability_default_reject_shared_fun(),
-      promise_context);
+  SharedFunctionInfoRef resolve_sfi(
+      broker_, broker_->isolate()
+                   ->factory()
+                   ->promise_capability_default_resolve_shared_fun());
+  TNode<JSFunction> resolve =
+      CreateClosureFromBuiltinSharedFunctionInfo(resolve_sfi, promise_context);
+
+  SharedFunctionInfoRef reject_sfi(
+      broker_, broker_->isolate()
+                   ->factory()
+                   ->promise_capability_default_reject_shared_fun());
+  TNode<JSFunction> reject =
+      CreateClosureFromBuiltinSharedFunctionInfo(reject_sfi, promise_context);
 
   FrameState lazy_with_catch_frame_state =
       PromiseConstructorLazyWithCatchFrameState(
@@ -2329,8 +2337,7 @@ Reduction JSCallReducer::ReduceArrayConstructor(Node* node) {
   CallParameters const& p = CallParametersOf(node->op());
 
   // Turn the {node} into a {JSCreateArray} call.
-  DCHECK_LE(2u, p.arity());
-  size_t const arity = p.arity() - 2;
+  size_t const arity = p.arity_without_implicit_args();
   NodeProperties::ReplaceValueInput(node, target, 0);
   NodeProperties::ReplaceValueInput(node, target, 1);
   NodeProperties::ChangeOp(
@@ -2344,9 +2351,9 @@ Reduction JSCallReducer::ReduceBooleanConstructor(Node* node) {
   CallParameters const& p = CallParametersOf(node->op());
 
   // Replace the {node} with a proper {ToBoolean} operator.
-  DCHECK_LE(2u, p.arity());
-  Node* value = (p.arity() == 2) ? jsgraph()->UndefinedConstant()
-                                 : NodeProperties::GetValueInput(node, 2);
+  Node* value = (p.arity_without_implicit_args() == 0)
+                    ? jsgraph()->UndefinedConstant()
+                    : NodeProperties::GetValueInput(node, 2);
   value = graph()->NewNode(simplified()->ToBoolean(), value);
   ReplaceWithValue(node, value);
   return Replace(value);
@@ -2356,9 +2363,8 @@ Reduction JSCallReducer::ReduceBooleanConstructor(Node* node) {
 Reduction JSCallReducer::ReduceObjectConstructor(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  if (p.arity() < 3) return NoChange();
-  Node* value = (p.arity() >= 3) ? NodeProperties::GetValueInput(node, 2)
-                                 : jsgraph()->UndefinedConstant();
+  if (p.arity_without_implicit_args() < 1) return NoChange();
+  Node* value = NodeProperties::GetValueInput(node, 2);
   Node* effect = NodeProperties::GetEffectInput(node);
 
   // We can fold away the Object(x) call if |x| is definitely not a primitive.
@@ -2383,15 +2389,14 @@ Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
 
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  size_t arity = p.arity();
-  DCHECK_LE(2u, arity);
+  size_t arity = p.arity_without_implicit_args();
   ConvertReceiverMode convert_mode = ConvertReceiverMode::kAny;
-  if (arity == 2) {
+  if (arity == 0) {
     // Neither thisArg nor argArray was provided.
     convert_mode = ConvertReceiverMode::kNullOrUndefined;
     node->ReplaceInput(0, node->InputAt(1));
     node->ReplaceInput(1, jsgraph()->UndefinedConstant());
-  } else if (arity == 3) {
+  } else if (arity == 1) {
     // The argArray was not provided, just remove the {target}.
     node->RemoveInput(0);
     --arity;
@@ -2412,15 +2417,14 @@ Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
       node->ReplaceInput(0, target);
       node->ReplaceInput(1, this_argument);
       node->ReplaceInput(2, arguments_list);
-      while (arity-- > 3) node->RemoveInput(3);
+      while (arity-- > 1) node->RemoveInput(3);
 
       // Morph the {node} to a {JSCallWithArrayLike}.
       NodeProperties::ChangeOp(
           node, javascript()->CallWithArrayLike(
                     p.frequency(), p.feedback(), p.speculation_mode(),
                     CallFeedbackRelation::kUnrelated));
-      Reduction const reduction = ReduceJSCallWithArrayLike(node);
-      return reduction.Changed() ? reduction : Changed(node);
+      return Changed(node).FollowedBy(ReduceJSCallWithArrayLike(node));
     } else {
       // Check whether {arguments_list} is null.
       Node* check_null =
@@ -2455,9 +2459,9 @@ Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
       Node* effect1 = effect;
       Node* control1 =
           graph()->NewNode(common()->Merge(2), if_null, if_undefined);
-      Node* value1 = effect1 = control1 =
-          graph()->NewNode(javascript()->Call(2), target, this_argument,
-                           context, frame_state, effect1, control1);
+      Node* value1 = effect1 = control1 = graph()->NewNode(
+          javascript()->Call(0 + kTargetAndReceiver), target, this_argument,
+          context, frame_state, effect1, control1);
 
       // Rewire potential exception edges.
       Node* if_exception = nullptr;
@@ -2494,12 +2498,11 @@ Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
   }
   // Change {node} to the new {JSCall} operator.
   NodeProperties::ChangeOp(
-      node, javascript()->Call(arity, p.frequency(), p.feedback(), convert_mode,
-                               p.speculation_mode(),
+      node, javascript()->Call(arity + kTargetAndReceiver, p.frequency(),
+                               p.feedback(), convert_mode, p.speculation_mode(),
                                CallFeedbackRelation::kUnrelated));
   // Try to further reduce the JSCall {node}.
-  Reduction const reduction = ReduceJSCall(node);
-  return reduction.Changed() ? reduction : Changed(node);
+  return Changed(node).FollowedBy(ReduceJSCall(node));
 }
 
 // ES section #sec-function.prototype.bind
@@ -2616,17 +2619,19 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
                                       control, p.feedback());
 
   // Replace the {node} with a JSCreateBoundFunction.
-  int const arity = std::max(0, node->op()->ValueInputCount() - 3);
-  int const input_count = 2 + arity + 3;
+  static constexpr int kContextEffectAndControl = 3;
+  int const arity =
+      std::max(0, node->op()->ValueInputCount() - kContextEffectAndControl);
+  int const input_count = kTargetAndReceiver + arity + kContextEffectAndControl;
   Node** inputs = graph()->zone()->NewArray<Node*>(input_count);
   inputs[0] = receiver;
   inputs[1] = bound_this;
   for (int i = 0; i < arity; ++i) {
-    inputs[2 + i] = NodeProperties::GetValueInput(node, 3 + i);
+    inputs[kTargetAndReceiver + i] = NodeProperties::GetValueInput(node, 3 + i);
   }
-  inputs[2 + arity + 0] = context;
-  inputs[2 + arity + 1] = effect;
-  inputs[2 + arity + 2] = control;
+  inputs[kTargetAndReceiver + arity + 0] = context;
+  inputs[kTargetAndReceiver + arity + 1] = effect;
+  inputs[kTargetAndReceiver + arity + 2] = control;
   Node* value = effect =
       graph()->NewNode(javascript()->CreateBoundFunction(arity, map.object()),
                        input_count, inputs);
@@ -2666,10 +2671,9 @@ Reduction JSCallReducer::ReduceFunctionPrototypeCall(Node* node) {
   // Remove the target from {node} and use the receiver as target instead, and
   // the thisArg becomes the new target.  If thisArg was not provided, insert
   // undefined instead.
-  size_t arity = p.arity();
-  DCHECK_LE(2u, arity);
+  size_t arity = p.arity_without_implicit_args();
   ConvertReceiverMode convert_mode;
-  if (arity == 2) {
+  if (arity == 0) {
     // The thisArg was not provided, use undefined as receiver.
     convert_mode = ConvertReceiverMode::kNullOrUndefined;
     node->ReplaceInput(0, node->InputAt(1));
@@ -2681,12 +2685,11 @@ Reduction JSCallReducer::ReduceFunctionPrototypeCall(Node* node) {
     --arity;
   }
   NodeProperties::ChangeOp(
-      node, javascript()->Call(arity, p.frequency(), p.feedback(), convert_mode,
-                               p.speculation_mode(),
+      node, javascript()->Call(arity + kTargetAndReceiver, p.frequency(),
+                               p.feedback(), convert_mode, p.speculation_mode(),
                                CallFeedbackRelation::kUnrelated));
   // Try to further reduce the JSCall {node}.
-  Reduction const reduction = ReduceJSCall(node);
-  return reduction.Changed() ? reduction : Changed(node);
+  return Changed(node).FollowedBy(ReduceJSCall(node));
 }
 
 // ES6 section 19.2.3.6 Function.prototype [ @@hasInstance ] (V)
@@ -2772,7 +2775,7 @@ Reduction JSCallReducer::ReduceObjectGetPrototypeOf(Node* node) {
 Reduction JSCallReducer::ReduceObjectIs(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& params = CallParametersOf(node->op());
-  int const argc = static_cast<int>(params.arity() - 2);
+  int const argc = params.arity_without_implicit_args();
   Node* lhs = (argc >= 1) ? NodeProperties::GetValueInput(node, 2)
                           : jsgraph()->UndefinedConstant();
   Node* rhs = (argc >= 2) ? NodeProperties::GetValueInput(node, 3)
@@ -2793,7 +2796,7 @@ Reduction JSCallReducer::ReduceObjectPrototypeGetProto(Node* node) {
 Reduction JSCallReducer::ReduceObjectPrototypeHasOwnProperty(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& params = CallParametersOf(node->op());
-  int const argc = static_cast<int>(params.arity() - 2);
+  int const argc = params.arity_without_implicit_args();
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Node* name = (argc >= 1) ? NodeProperties::GetValueInput(node, 2)
                            : jsgraph()->UndefinedConstant();
@@ -2903,8 +2906,7 @@ Reduction JSCallReducer::ReduceObjectPrototypeIsPrototypeOf(Node* node) {
 Reduction JSCallReducer::ReduceReflectApply(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  int arity = static_cast<int>(p.arity() - 2);
-  DCHECK_LE(0, arity);
+  int arity = p.arity_without_implicit_args();
   // Massage value inputs appropriately.
   node->RemoveInput(0);
   node->RemoveInput(0);
@@ -2918,16 +2920,14 @@ Reduction JSCallReducer::ReduceReflectApply(Node* node) {
       node, javascript()->CallWithArrayLike(p.frequency(), p.feedback(),
                                             p.speculation_mode(),
                                             CallFeedbackRelation::kUnrelated));
-  Reduction const reduction = ReduceJSCallWithArrayLike(node);
-  return reduction.Changed() ? reduction : Changed(node);
+  return Changed(node).FollowedBy(ReduceJSCallWithArrayLike(node));
 }
 
 // ES6 section 26.1.2 Reflect.construct ( target, argumentsList [, newTarget] )
 Reduction JSCallReducer::ReduceReflectConstruct(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  int arity = static_cast<int>(p.arity() - 2);
-  DCHECK_LE(0, arity);
+  int arity = p.arity_without_implicit_args();
   // Massage value inputs appropriately.
   node->RemoveInput(0);
   node->RemoveInput(0);
@@ -2940,10 +2940,9 @@ Reduction JSCallReducer::ReduceReflectConstruct(Node* node) {
   while (arity-- > 3) {
     node->RemoveInput(arity);
   }
-  NodeProperties::ChangeOp(node,
-                           javascript()->ConstructWithArrayLike(p.frequency()));
-  Reduction const reduction = ReduceJSConstructWithArrayLike(node);
-  return reduction.Changed() ? reduction : Changed(node);
+  NodeProperties::ChangeOp(
+      node, javascript()->ConstructWithArrayLike(p.frequency(), p.feedback()));
+  return Changed(node).FollowedBy(ReduceJSConstructWithArrayLike(node));
 }
 
 // ES6 section 26.1.7 Reflect.getPrototypeOf ( target )
@@ -2982,7 +2981,7 @@ Reduction JSCallReducer::ReduceObjectCreate(Node* node) {
 Reduction JSCallReducer::ReduceReflectGet(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  int arity = static_cast<int>(p.arity() - 2);
+  int arity = p.arity_without_implicit_args();
   if (arity != 2) return NoChange();
   Node* target = NodeProperties::GetValueInput(node, 2);
   Node* key = NodeProperties::GetValueInput(node, 3);
@@ -3057,8 +3056,7 @@ Reduction JSCallReducer::ReduceReflectGet(Node* node) {
 Reduction JSCallReducer::ReduceReflectHas(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  int arity = static_cast<int>(p.arity() - 2);
-  DCHECK_LE(0, arity);
+  int arity = p.arity_without_implicit_args();
   Node* target = (arity >= 1) ? NodeProperties::GetValueInput(node, 2)
                               : jsgraph()->UndefinedConstant();
   Node* key = (arity >= 2) ? NodeProperties::GetValueInput(node, 3)
@@ -3397,7 +3395,7 @@ Reduction JSCallReducer::ReduceCallApiFunction(
 
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  int const argc = static_cast<int>(p.arity()) - 2;
+  int const argc = p.arity_without_implicit_args();
   Node* target = NodeProperties::GetValueInput(node, 0);
   Node* global_proxy =
       jsgraph()->Constant(native_context().global_proxy_object());
@@ -3485,10 +3483,14 @@ Reduction JSCallReducer::ReduceCallApiFunction(
             function_template_info.LookupHolderOfExpectedType(receiver_map);
 
         if (api_holder.lookup != holder_i.lookup) return inference.NoChange();
-        if (!(api_holder.holder.has_value() && holder_i.holder.has_value()))
-          return inference.NoChange();
-        if (!api_holder.holder->equals(*holder_i.holder))
-          return inference.NoChange();
+        DCHECK(holder_i.lookup == CallOptimization::kHolderFound ||
+               holder_i.lookup == CallOptimization::kHolderIsReceiver);
+        if (holder_i.lookup == CallOptimization::kHolderFound) {
+          DCHECK(api_holder.holder.has_value() && holder_i.holder.has_value());
+          if (!api_holder.holder->equals(*holder_i.holder)) {
+            return inference.NoChange();
+          }
+        }
 
         CHECK(receiver_map.IsJSReceiverMap());
         CHECK(!receiver_map.is_access_check_needed() ||
@@ -3671,14 +3673,14 @@ Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
       case IrOpcode::kJSCallWithSpread: {
         // Ignore uses as spread input to calls with spread.
         CallParameters p = CallParametersOf(user->op());
-        int const arity = static_cast<int>(p.arity() - 1);
-        if (user->InputAt(arity) == arguments_list) continue;
+        int const arity = p.arity_without_implicit_args();
+        if (user->InputAt(arity + 1) == arguments_list) continue;
         break;
       }
       case IrOpcode::kJSConstructWithSpread: {
         // Ignore uses as spread input to construct with spread.
         ConstructParameters p = ConstructParametersOf(user->op());
-        int const arity = static_cast<int>(p.arity() - 2);
+        int const arity = p.arity_without_implicit_args();
         if (user->InputAt(arity) == arguments_list) continue;
         break;
       }
@@ -3766,11 +3768,11 @@ Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
         node, javascript()->Call(arity + 1, frequency, feedback,
                                  ConvertReceiverMode::kAny, speculation_mode,
                                  CallFeedbackRelation::kUnrelated));
-    Reduction const reduction = ReduceJSCall(node);
-    return reduction.Changed() ? reduction : Changed(node);
+    return Changed(node).FollowedBy(ReduceJSCall(node));
   } else {
     NodeProperties::ChangeOp(
-        node, javascript()->Construct(arity + 2, frequency, feedback));
+        node, javascript()->Construct(arity + kTargetAndNewTarget, frequency,
+                                      feedback));
     Node* new_target = NodeProperties::GetValueInput(node, arity + 1);
     Node* frame_state = NodeProperties::GetFrameStateInput(node);
     Node* context = NodeProperties::GetContextInput(node);
@@ -3821,8 +3823,7 @@ Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
         graph()->NewNode(common()->Throw(), check_throw, check_fail);
     NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
 
-    Reduction const reduction = ReduceJSConstruct(node);
-    return reduction.Changed() ? reduction : Changed(node);
+    return Changed(node).FollowedBy(ReduceJSConstruct(node));
   }
 }
 
@@ -3852,14 +3853,26 @@ bool ShouldUseCallICFeedback(Node* node) {
 
 }  // namespace
 
+bool JSCallReducer::IsBuiltinOrApiFunction(JSFunctionRef function) const {
+  if (should_disallow_heap_access() && !function.serialized()) {
+    TRACE_BROKER_MISSING(broker(), "data for function " << function);
+    return false;
+  }
+
+  // TODO(neis): Add a way to check if function template info isn't serialized
+  // and add a warning in such cases. Currently we can't tell if function
+  // template info doesn't exist or wasn't serialized.
+  return function.shared().HasBuiltinId() ||
+         function.shared().function_template_info().has_value();
+}
+
 Reduction JSCallReducer::ReduceJSCall(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
   Node* target = NodeProperties::GetValueInput(node, 0);
   Node* control = NodeProperties::GetControlInput(node);
   Node* effect = NodeProperties::GetEffectInput(node);
-  size_t arity = p.arity();
-  DCHECK_LE(2u, arity);
+  size_t arity = p.arity_without_implicit_args();
 
   // Try to specialize JSCall {node}s with constant {target}s.
   HeapObjectMatcher m(target);
@@ -3906,13 +3919,13 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
       }
 
       NodeProperties::ChangeOp(
-          node, javascript()->Call(arity, p.frequency(), p.feedback(),
-                                   convert_mode, p.speculation_mode(),
-                                   CallFeedbackRelation::kUnrelated));
+          node,
+          javascript()->Call(arity + kTargetAndReceiver, p.frequency(),
+                             p.feedback(), convert_mode, p.speculation_mode(),
+                             CallFeedbackRelation::kUnrelated));
 
       // Try to further reduce the JSCall {node}.
-      Reduction const reduction = ReduceJSCall(node);
-      return reduction.Changed() ? reduction : Changed(node);
+      return Changed(node).FollowedBy(ReduceJSCall(node));
     }
 
     // Don't mess with other {node}s that have a constant {target}.
@@ -3960,13 +3973,13 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
             ? ConvertReceiverMode::kAny
             : ConvertReceiverMode::kNotNullOrUndefined;
     NodeProperties::ChangeOp(
-        node, javascript()->Call(arity, p.frequency(), p.feedback(),
-                                 convert_mode, p.speculation_mode(),
-                                 CallFeedbackRelation::kUnrelated));
+        node,
+        javascript()->Call(arity + kTargetAndReceiver, p.frequency(),
+                           p.feedback(), convert_mode, p.speculation_mode(),
+                           CallFeedbackRelation::kUnrelated));
 
     // Try to further reduce the JSCall {node}.
-    Reduction const reduction = ReduceJSCall(node);
-    return reduction.Changed() ? reduction : Changed(node);
+    return Changed(node).FollowedBy(ReduceJSCall(node));
   }
 
   if (!ShouldUseCallICFeedback(target) ||
@@ -3978,7 +3991,7 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
   ProcessedFeedback const& feedback =
       broker()->GetFeedbackForCall(p.feedback());
   if (feedback.IsInsufficient()) {
-    return ReduceSoftDeoptimize(
+    return ReduceForInsufficientFeedback(
         node, DeoptimizeReason::kInsufficientTypeFeedbackForCall);
   }
 
@@ -3986,6 +3999,13 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
   if (feedback_target.has_value() && feedback_target->map().is_callable()) {
     Node* target_function = jsgraph()->Constant(*feedback_target);
 
+    if (FLAG_turboprop) {
+      if (!feedback_target->IsJSFunction()) return NoChange();
+      if (!IsBuiltinOrApiFunction(feedback_target->AsJSFunction())) {
+        return NoChange();
+      }
+    }
+
     // Check that the {target} is still the {target_function}.
     Node* check = graph()->NewNode(simplified()->ReferenceEqual(), target,
                                    target_function);
@@ -3998,8 +4018,7 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
     NodeProperties::ReplaceEffectInput(node, effect);
 
     // Try to further reduce the JSCall {node}.
-    Reduction const reduction = ReduceJSCall(node);
-    return reduction.Changed() ? reduction : Changed(node);
+    return Changed(node).FollowedBy(ReduceJSCall(node));
   } else if (feedback_target.has_value() && feedback_target->IsFeedbackCell()) {
     FeedbackCellRef feedback_cell(
         broker(), feedback_target.value().AsFeedbackCell().object());
@@ -4013,6 +4032,12 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
             broker(), "feedback vector, not serialized: " << feedback_vector);
         return NoChange();
       }
+
+      if (FLAG_turboprop &&
+          !feedback_vector.shared_function_info().HasBuiltinId()) {
+        return NoChange();
+      }
+
       Node* target_closure = effect =
           graph()->NewNode(simplified()->CheckClosure(feedback_cell.object()),
                            target, effect, control);
@@ -4022,8 +4047,7 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
       NodeProperties::ReplaceEffectInput(node, effect);
 
       // Try to further reduce the JSCall {node}.
-      Reduction const reduction = ReduceJSCall(node);
-      return reduction.Changed() ? reduction : Changed(node);
+      return Changed(node).FollowedBy(ReduceJSCall(node));
     }
   }
   return NoChange();
@@ -4118,11 +4142,14 @@ Reduction JSCallReducer::ReduceJSCall(Node* node,
     case Builtins::kArrayPrototypeSlice:
       return ReduceArrayPrototypeSlice(node);
     case Builtins::kArrayPrototypeEntries:
-      return ReduceArrayIterator(node, IterationKind::kEntries);
+      return ReduceArrayIterator(node, ArrayIteratorKind::kArrayLike,
+                                 IterationKind::kEntries);
     case Builtins::kArrayPrototypeKeys:
-      return ReduceArrayIterator(node, IterationKind::kKeys);
+      return ReduceArrayIterator(node, ArrayIteratorKind::kArrayLike,
+                                 IterationKind::kKeys);
     case Builtins::kArrayPrototypeValues:
-      return ReduceArrayIterator(node, IterationKind::kValues);
+      return ReduceArrayIterator(node, ArrayIteratorKind::kArrayLike,
+                                 IterationKind::kValues);
     case Builtins::kArrayIteratorPrototypeNext:
       return ReduceArrayIteratorPrototypeNext(node);
     case Builtins::kArrayIsArray:
@@ -4323,11 +4350,14 @@ Reduction JSCallReducer::ReduceJSCall(Node* node,
     case Builtins::kStringPrototypeConcat:
       return ReduceStringPrototypeConcat(node);
     case Builtins::kTypedArrayPrototypeEntries:
-      return ReduceArrayIterator(node, IterationKind::kEntries);
+      return ReduceArrayIterator(node, ArrayIteratorKind::kTypedArray,
+                                 IterationKind::kEntries);
     case Builtins::kTypedArrayPrototypeKeys:
-      return ReduceArrayIterator(node, IterationKind::kKeys);
+      return ReduceArrayIterator(node, ArrayIteratorKind::kTypedArray,
+                                 IterationKind::kKeys);
     case Builtins::kTypedArrayPrototypeValues:
-      return ReduceArrayIterator(node, IterationKind::kValues);
+      return ReduceArrayIterator(node, ArrayIteratorKind::kTypedArray,
+                                 IterationKind::kValues);
     case Builtins::kPromisePrototypeCatch:
       return ReducePromisePrototypeCatch(node);
     case Builtins::kPromisePrototypeFinally:
@@ -4384,30 +4414,29 @@ Reduction JSCallReducer::ReduceJSCall(Node* node,
 Reduction JSCallReducer::ReduceJSCallWithArrayLike(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCallWithArrayLike, node->opcode());
   const CallParameters& p = CallParametersOf(node->op());
-  int arity = static_cast<int>(p.arity());
-  DCHECK_EQ(arity, 2);
+  int arity = p.arity_without_implicit_args();
+  DCHECK_EQ(arity, 0);
   return ReduceCallOrConstructWithArrayLikeOrSpread(
-      node, arity, p.frequency(), p.feedback(), p.speculation_mode(),
-      p.feedback_relation());
+      node, arity + kTargetAndReceiver, p.frequency(), p.feedback(),
+      p.speculation_mode(), p.feedback_relation());
 }
 
 Reduction JSCallReducer::ReduceJSCallWithSpread(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCallWithSpread, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  DCHECK_LE(3u, p.arity());
-  int arity = static_cast<int>(p.arity() - 1);
+  int arity = p.arity_without_implicit_args();
+  DCHECK_GE(p.arity(), 1);
   CallFrequency frequency = p.frequency();
   FeedbackSource feedback = p.feedback();
   return ReduceCallOrConstructWithArrayLikeOrSpread(
-      node, arity, frequency, feedback, p.speculation_mode(),
-      p.feedback_relation());
+      node, arity + kTargetAndReceiver - 1, frequency, feedback,
+      p.speculation_mode(), p.feedback_relation());
 }
 
 Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
   DCHECK_EQ(IrOpcode::kJSConstruct, node->opcode());
   ConstructParameters const& p = ConstructParametersOf(node->op());
-  DCHECK_LE(2u, p.arity());
-  int arity = static_cast<int>(p.arity() - 2);
+  int arity = p.arity_without_implicit_args();
   Node* target = NodeProperties::GetValueInput(node, 0);
   Node* new_target = NodeProperties::GetValueInput(node, arity + 1);
   Node* effect = NodeProperties::GetEffectInput(node);
@@ -4417,7 +4446,7 @@ Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
     ProcessedFeedback const& feedback =
         broker()->GetFeedbackForCall(p.feedback());
     if (feedback.IsInsufficient()) {
-      return ReduceSoftDeoptimize(
+      return ReduceForInsufficientFeedback(
           node, DeoptimizeReason::kInsufficientTypeFeedbackForConstruct);
     }
 
@@ -4469,8 +4498,7 @@ Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
       }
 
       // Try to further reduce the JSConstruct {node}.
-      Reduction const reduction = ReduceJSConstruct(node);
-      return reduction.Changed() ? reduction : Changed(node);
+      return Changed(node).FollowedBy(ReduceJSConstruct(node));
     }
   }
 
@@ -4584,12 +4612,11 @@ Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
 
       // Update the JSConstruct operator on {node}.
       NodeProperties::ChangeOp(
-          node,
-          javascript()->Construct(arity + 2, p.frequency(), FeedbackSource()));
+          node, javascript()->Construct(arity + kTargetAndNewTarget,
+                                        p.frequency(), FeedbackSource()));
 
       // Try to further reduce the JSConstruct {node}.
-      Reduction const reduction = ReduceJSConstruct(node);
-      return reduction.Changed() ? reduction : Changed(node);
+      return Changed(node).FollowedBy(ReduceJSConstruct(node));
     }
 
     // TODO(bmeurer): Also support optimizing proxies here.
@@ -4625,12 +4652,11 @@ Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
 
     // Update the JSConstruct operator on {node}.
     NodeProperties::ChangeOp(
-        node,
-        javascript()->Construct(arity + 2, p.frequency(), FeedbackSource()));
+        node, javascript()->Construct(arity + kTargetAndNewTarget,
+                                      p.frequency(), FeedbackSource()));
 
     // Try to further reduce the JSConstruct {node}.
-    Reduction const reduction = ReduceJSConstruct(node);
-    return reduction.Changed() ? reduction : Changed(node);
+    return Changed(node).FollowedBy(ReduceJSConstruct(node));
   }
 
   return NoChange();
@@ -4806,17 +4832,19 @@ Reduction JSCallReducer::ReduceStringPrototypeSubstr(Node* node) {
 
 Reduction JSCallReducer::ReduceJSConstructWithArrayLike(Node* node) {
   DCHECK_EQ(IrOpcode::kJSConstructWithArrayLike, node->opcode());
-  CallFrequency frequency = CallFrequencyOf(node->op());
+  ConstructParameters const& p = ConstructParametersOf(node->op());
+  const int arity = p.arity_without_implicit_args();
+  DCHECK_EQ(arity, 1);
   return ReduceCallOrConstructWithArrayLikeOrSpread(
-      node, 1, frequency, FeedbackSource(),
+      node, arity, p.frequency(), p.feedback(),
       SpeculationMode::kDisallowSpeculation, CallFeedbackRelation::kRelated);
 }
 
 Reduction JSCallReducer::ReduceJSConstructWithSpread(Node* node) {
   DCHECK_EQ(IrOpcode::kJSConstructWithSpread, node->opcode());
   ConstructParameters const& p = ConstructParametersOf(node->op());
-  DCHECK_LE(3u, p.arity());
-  int arity = static_cast<int>(p.arity() - 2);
+  int arity = p.arity_without_implicit_args();
+  DCHECK_LE(1u, arity);
   CallFrequency frequency = p.frequency();
   FeedbackSource feedback = p.feedback();
   return ReduceCallOrConstructWithArrayLikeOrSpread(
@@ -4831,9 +4859,15 @@ Reduction JSCallReducer::ReduceReturnReceiver(Node* node) {
   return Replace(receiver);
 }
 
-Reduction JSCallReducer::ReduceSoftDeoptimize(Node* node,
-                                              DeoptimizeReason reason) {
+Reduction JSCallReducer::ReduceForInsufficientFeedback(
+    Node* node, DeoptimizeReason reason) {
+  DCHECK(node->opcode() == IrOpcode::kJSCall ||
+         node->opcode() == IrOpcode::kJSConstruct);
   if (!(flags() & kBailoutOnUninitialized)) return NoChange();
+  // TODO(mythria): May be add additional flags to specify if we need to deopt
+  // on calls / construct rather than checking for TurboProp here. We may need
+  // it for NativeContextIndependent code too.
+  if (FLAG_turboprop) return NoChange();
 
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
@@ -5490,7 +5524,9 @@ Reduction JSCallReducer::ReduceArrayIsArray(Node* node) {
   return Changed(node);
 }
 
-Reduction JSCallReducer::ReduceArrayIterator(Node* node, IterationKind kind) {
+Reduction JSCallReducer::ReduceArrayIterator(Node* node,
+                                             ArrayIteratorKind array_kind,
+                                             IterationKind iteration_kind) {
   DisallowHeapAccessIf disallow_heap_access(should_disallow_heap_access());
 
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
@@ -5505,6 +5541,39 @@ Reduction JSCallReducer::ReduceArrayIterator(Node* node, IterationKind kind) {
     return NoChange();
   }
 
+  // TypedArray iteration is stricter: it throws if the receiver is not a typed
+  // array. So don't bother optimizing in that case.
+  if (array_kind == ArrayIteratorKind::kTypedArray &&
+      !inference.AllOfInstanceTypesAre(InstanceType::JS_TYPED_ARRAY_TYPE)) {
+    return NoChange();
+  }
+
+  if (array_kind == ArrayIteratorKind::kTypedArray) {
+    // Make sure we deopt when the JSArrayBuffer is detached.
+    if (!dependencies()->DependOnArrayBufferDetachingProtector()) {
+      CallParameters const& p = CallParametersOf(node->op());
+      if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+        return NoChange();
+      }
+      Node* buffer = effect = graph()->NewNode(
+          simplified()->LoadField(AccessBuilder::ForJSArrayBufferViewBuffer()),
+          receiver, effect, control);
+      Node* buffer_bit_field = effect = graph()->NewNode(
+          simplified()->LoadField(AccessBuilder::ForJSArrayBufferBitField()),
+          buffer, effect, control);
+      Node* check = graph()->NewNode(
+          simplified()->NumberEqual(),
+          graph()->NewNode(
+              simplified()->NumberBitwiseAnd(), buffer_bit_field,
+              jsgraph()->Constant(JSArrayBuffer::WasDetachedBit::kMask)),
+          jsgraph()->ZeroConstant());
+      effect = graph()->NewNode(
+          simplified()->CheckIf(DeoptimizeReason::kArrayBufferWasDetached,
+                                p.feedback()),
+          check, effect, control);
+    }
+  }
+
   // Morph the {node} into a JSCreateArrayIterator with the given {kind}.
   RelaxControls(node);
   node->ReplaceInput(0, receiver);
@@ -5512,7 +5581,8 @@ Reduction JSCallReducer::ReduceArrayIterator(Node* node, IterationKind kind) {
   node->ReplaceInput(2, effect);
   node->ReplaceInput(3, control);
   node->TrimInputCount(4);
-  NodeProperties::ChangeOp(node, javascript()->CreateArrayIterator(kind));
+  NodeProperties::ChangeOp(node,
+                           javascript()->CreateArrayIterator(iteration_kind));
   return Changed(node);
 }
 
@@ -5810,19 +5880,24 @@ Reduction JSCallReducer::ReduceStringPrototypeStartsWith(Node* node) {
   if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
     return NoChange();
   }
+
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
   if (node->op()->ValueInputCount() < 3) {
+    effect = graph()->NewNode(simplified()->CheckString(p.feedback()), receiver,
+                              effect, control);
+
     Node* value = jsgraph()->FalseConstant();
-    ReplaceWithValue(node, value);
+    ReplaceWithValue(node, value, effect, control);
     return Replace(value);
   }
 
-  Node* string = NodeProperties::GetValueInput(node, 1);
   Node* search_string = NodeProperties::GetValueInput(node, 2);
   Node* position = node->op()->ValueInputCount() >= 4
                        ? NodeProperties::GetValueInput(node, 3)
                        : jsgraph()->ZeroConstant();
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
 
   HeapObjectMatcher m(search_string);
   if (m.HasValue()) {
@@ -5830,13 +5905,14 @@ Reduction JSCallReducer::ReduceStringPrototypeStartsWith(Node* node) {
     if (target_ref.IsString()) {
       StringRef str = target_ref.AsString();
       if (str.length() == 1) {
-        string = effect = graph()->NewNode(
-            simplified()->CheckString(p.feedback()), string, effect, control);
+        receiver = effect = graph()->NewNode(
+            simplified()->CheckString(p.feedback()), receiver, effect, control);
+
         position = effect = graph()->NewNode(
             simplified()->CheckSmi(p.feedback()), position, effect, control);
 
         Node* string_length =
-            graph()->NewNode(simplified()->StringLength(), string);
+            graph()->NewNode(simplified()->StringLength(), receiver);
         Node* unsigned_position = graph()->NewNode(
             simplified()->NumberMax(), position, jsgraph()->ZeroConstant());
 
@@ -5856,7 +5932,7 @@ Reduction JSCallReducer::ReduceStringPrototypeStartsWith(Node* node) {
           Node* masked_position =
               graph()->NewNode(simplified()->PoisonIndex(), unsigned_position);
           Node* string_first = etrue =
-              graph()->NewNode(simplified()->StringCharCodeAt(), string,
+              graph()->NewNode(simplified()->StringCharCodeAt(), receiver,
                                masked_position, etrue, if_true);
 
           Node* search_first = jsgraph()->Constant(str.GetFirstChar());
@@ -6003,9 +6079,10 @@ Reduction JSCallReducer::ReduceStringFromCodePoint(Node* node) {
     Node* control = NodeProperties::GetControlInput(node);
     Node* input = NodeProperties::GetValueInput(node, 2);
 
-    input = effect =
-        graph()->NewNode(simplified()->CheckBounds(p.feedback()), input,
-                         jsgraph()->Constant(0x10FFFF + 1), effect, control);
+    input = effect = graph()->NewNode(
+        simplified()->CheckBounds(p.feedback(),
+                                  CheckBoundsFlag::kConvertStringAndMinusZero),
+        input, jsgraph()->Constant(0x10FFFF + 1), effect, control);
 
     Node* value =
         graph()->NewNode(simplified()->StringFromSingleCodePoint(), input);
@@ -6142,7 +6219,7 @@ Reduction JSCallReducer::ReduceStringPrototypeConcat(Node* node) {
 
 Reduction JSCallReducer::ReducePromiseConstructor(Node* node) {
   DisallowHeapAccessIf no_heap_access(should_disallow_heap_access());
-  PromiseBuiltinReducerAssembler a(jsgraph(), temp_zone(), node);
+  PromiseBuiltinReducerAssembler a(jsgraph(), temp_zone(), node, broker());
 
   // We only inline when we have the executor.
   if (a.ConstructArity() < 1) return NoChange();
@@ -6183,7 +6260,7 @@ Reduction JSCallReducer::ReducePromisePrototypeCatch(Node* node) {
   if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
     return NoChange();
   }
-  int arity = static_cast<int>(p.arity() - 2);
+  int arity = p.arity_without_implicit_args();
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
@@ -6207,12 +6284,11 @@ Reduction JSCallReducer::ReducePromisePrototypeCatch(Node* node) {
     node->InsertInput(graph()->zone(), 2, jsgraph()->UndefinedConstant());
   }
   NodeProperties::ChangeOp(
-      node, javascript()->Call(2 + arity, p.frequency(), p.feedback(),
-                               ConvertReceiverMode::kNotNullOrUndefined,
-                               p.speculation_mode(),
-                               CallFeedbackRelation::kUnrelated));
-  Reduction const reduction = ReducePromisePrototypeThen(node);
-  return reduction.Changed() ? reduction : Changed(node);
+      node, javascript()->Call(
+                arity + kTargetAndReceiver, p.frequency(), p.feedback(),
+                ConvertReceiverMode::kNotNullOrUndefined, p.speculation_mode(),
+                CallFeedbackRelation::kUnrelated));
+  return Changed(node).FollowedBy(ReducePromisePrototypeThen(node));
 }
 
 Node* JSCallReducer::CreateClosureFromBuiltinSharedFunctionInfo(
@@ -6232,7 +6308,7 @@ Reduction JSCallReducer::ReducePromisePrototypeFinally(Node* node) {
 
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  int arity = static_cast<int>(p.arity() - 2);
+  int arity = p.arity_without_implicit_args();
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Node* on_finally = arity >= 1 ? NodeProperties::GetValueInput(node, 2)
                                 : jsgraph()->UndefinedConstant();
@@ -6288,14 +6364,16 @@ Reduction JSCallReducer::ReducePromisePrototypeFinally(Node* node) {
         context, constructor, etrue, if_true);
 
     // Allocate the closure for the reject case.
+    SharedFunctionInfoRef promise_catch_finally(
+        broker(), factory()->promise_catch_finally_shared_fun());
     catch_true = etrue = CreateClosureFromBuiltinSharedFunctionInfo(
-        native_context().promise_catch_finally_shared_fun(), context, etrue,
-        if_true);
+        promise_catch_finally, context, etrue, if_true);
 
     // Allocate the closure for the fulfill case.
+    SharedFunctionInfoRef promise_then_finally(
+        broker(), factory()->promise_then_finally_shared_fun());
     then_true = etrue = CreateClosureFromBuiltinSharedFunctionInfo(
-        native_context().promise_then_finally_shared_fun(), context, etrue,
-        if_true);
+        promise_then_finally, context, etrue, if_true);
   }
 
   Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
@@ -6335,12 +6413,11 @@ Reduction JSCallReducer::ReducePromisePrototypeFinally(Node* node) {
   node->ReplaceInput(2, then_finally);
   node->ReplaceInput(3, catch_finally);
   NodeProperties::ChangeOp(
-      node, javascript()->Call(2 + arity, p.frequency(), p.feedback(),
-                               ConvertReceiverMode::kNotNullOrUndefined,
-                               p.speculation_mode(),
-                               CallFeedbackRelation::kUnrelated));
-  Reduction const reduction = ReducePromisePrototypeThen(node);
-  return reduction.Changed() ? reduction : Changed(node);
+      node, javascript()->Call(
+                arity + kTargetAndReceiver, p.frequency(), p.feedback(),
+                ConvertReceiverMode::kNotNullOrUndefined, p.speculation_mode(),
+                CallFeedbackRelation::kUnrelated));
+  return Changed(node).FollowedBy(ReducePromisePrototypeThen(node));
 }
 
 Reduction JSCallReducer::ReducePromisePrototypeThen(Node* node) {
@@ -6447,7 +6524,7 @@ Reduction JSCallReducer::ReduceTypedArrayConstructor(
     Node* node, const SharedFunctionInfoRef& shared) {
   DCHECK_EQ(IrOpcode::kJSConstruct, node->opcode());
   ConstructParameters const& p = ConstructParametersOf(node->op());
-  int arity = static_cast<int>(p.arity() - 2);
+  int arity = p.arity_without_implicit_args();
   Node* target = NodeProperties::GetValueInput(node, 0);
   Node* arg1 = (arity >= 1) ? NodeProperties::GetValueInput(node, 1)
                             : jsgraph()->UndefinedConstant();
@@ -7113,6 +7190,7 @@ uint32_t ExternalArrayElementSize(const ExternalArrayType element_type) {
 
 Reduction JSCallReducer::ReduceDataViewAccess(Node* node, DataViewAccess access,
                                               ExternalArrayType element_type) {
+  DCHECK_EQ(node->opcode(), IrOpcode::kJSCall);
   size_t const element_size = ExternalArrayElementSize(element_type);
   CallParameters const& p = CallParametersOf(node->op());
   Node* effect = NodeProperties::GetEffectInput(node);
@@ -7121,18 +7199,17 @@ Reduction JSCallReducer::ReduceDataViewAccess(Node* node, DataViewAccess access,
   Node* offset = node->op()->ValueInputCount() > 2
                      ? NodeProperties::GetValueInput(node, 2)
                      : jsgraph()->ZeroConstant();
-  Node* value = (access == DataViewAccess::kGet)
-                    ? nullptr
-                    : (node->op()->ValueInputCount() > 3
-                           ? NodeProperties::GetValueInput(node, 3)
-                           : jsgraph()->ZeroConstant());
-  Node* is_little_endian = (access == DataViewAccess::kGet)
-                               ? (node->op()->ValueInputCount() > 3
-                                      ? NodeProperties::GetValueInput(node, 3)
-                                      : jsgraph()->FalseConstant())
-                               : (node->op()->ValueInputCount() > 4
-                                      ? NodeProperties::GetValueInput(node, 4)
-                                      : jsgraph()->FalseConstant());
+  Node* value = nullptr;
+  if (access == DataViewAccess::kSet) {
+    value = node->op()->ValueInputCount() > 3
+                ? NodeProperties::GetValueInput(node, 3)
+                : jsgraph()->UndefinedConstant();
+  }
+  const int endian_index = (access == DataViewAccess::kGet ? 3 : 4);
+  Node* is_little_endian =
+      (node->op()->ValueInputCount() > endian_index
+           ? NodeProperties::GetValueInput(node, endian_index)
+           : jsgraph()->FalseConstant());
 
   if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
     return NoChange();
diff --git a/deps/v8/src/compiler/js-call-reducer.h b/deps/v8/src/compiler/js-call-reducer.h
index 09e8159cfec..142e42789d6 100644
--- a/deps/v8/src/compiler/js-call-reducer.h
+++ b/deps/v8/src/compiler/js-call-reducer.h
@@ -106,8 +106,9 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
                                    const SharedFunctionInfoRef& shared);
   Reduction ReduceArraySome(Node* node, const SharedFunctionInfoRef& shared);
 
-  enum class ArrayIteratorKind { kArray, kTypedArray };
-  Reduction ReduceArrayIterator(Node* node, IterationKind kind);
+  enum class ArrayIteratorKind { kArrayLike, kTypedArray };
+  Reduction ReduceArrayIterator(Node* node, ArrayIteratorKind array_kind,
+                                IterationKind iteration_kind);
   Reduction ReduceArrayIteratorPrototypeNext(Node* node);
   Reduction ReduceFastArrayIteratorNext(InstanceType type, Node* node,
                                         IterationKind kind);
@@ -158,7 +159,7 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
                                         const SharedFunctionInfoRef& shared);
   Reduction ReduceTypedArrayPrototypeToStringTag(Node* node);
 
-  Reduction ReduceSoftDeoptimize(Node* node, DeoptimizeReason reason);
+  Reduction ReduceForInsufficientFeedback(Node* node, DeoptimizeReason reason);
 
   Reduction ReduceMathUnary(Node* node, const Operator* op);
   Reduction ReduceMathBinary(Node* node, const Operator* op);
@@ -217,6 +218,8 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
                            Node* control, Node** if_true, Node** if_false);
   Node* LoadReceiverElementsKind(Node* receiver, Node** effect, Node** control);
 
+  bool IsBuiltinOrApiFunction(JSFunctionRef target_ref) const;
+
   Graph* graph() const;
   JSGraph* jsgraph() const { return jsgraph_; }
   JSHeapBroker* broker() const { return broker_; }
diff --git a/deps/v8/src/compiler/js-create-lowering.cc b/deps/v8/src/compiler/js-create-lowering.cc
index d0059030d50..9674a436adb 100644
--- a/deps/v8/src/compiler/js-create-lowering.cc
+++ b/deps/v8/src/compiler/js-create-lowering.cc
@@ -28,6 +28,7 @@
 #include "src/objects/js-regexp-inl.h"
 #include "src/objects/objects-inl.h"
 #include "src/objects/template-objects.h"
+#include "torque-generated/exported-class-definitions-tq.h"
 
 namespace v8 {
 namespace internal {
@@ -1507,16 +1508,15 @@ Node* JSCreateLowering::AllocateAliasedArguments(
 
   // Actually allocate the backing store.
   AllocationBuilder a(jsgraph(), arguments, control);
-  a.AllocateArray(mapped_count + 2,
-                  MapRef(broker(), factory()->sloppy_arguments_elements_map()));
-  a.Store(AccessBuilder::ForFixedArrayElement(), jsgraph()->Constant(0),
-          context);
-  a.Store(AccessBuilder::ForFixedArrayElement(), jsgraph()->Constant(1),
-          arguments);
+  a.AllocateSloppyArgumentElements(
+      mapped_count,
+      MapRef(broker(), factory()->sloppy_arguments_elements_map()));
+  a.Store(AccessBuilder::ForSloppyArgumentsElementsContext(), context);
+  a.Store(AccessBuilder::ForSloppyArgumentsElementsArguments(), arguments);
   for (int i = 0; i < mapped_count; ++i) {
     int idx = shared.context_header_size() + parameter_count - 1 - i;
-    a.Store(AccessBuilder::ForFixedArrayElement(), jsgraph()->Constant(i + 2),
-            jsgraph()->Constant(idx));
+    a.Store(AccessBuilder::ForSloppyArgumentsElementsMappedEntry(),
+            jsgraph()->Constant(i), jsgraph()->Constant(idx));
   }
   return a.Finish();
 }
@@ -1553,12 +1553,11 @@ Node* JSCreateLowering::AllocateAliasedArguments(
 
   // Actually allocate the backing store.
   AllocationBuilder a(jsgraph(), effect, control);
-  a.AllocateArray(mapped_count + 2,
-                  MapRef(broker(), factory()->sloppy_arguments_elements_map()));
-  a.Store(AccessBuilder::ForFixedArrayElement(), jsgraph()->Constant(0),
-          context);
-  a.Store(AccessBuilder::ForFixedArrayElement(), jsgraph()->Constant(1),
-          arguments);
+  a.AllocateSloppyArgumentElements(
+      mapped_count,
+      MapRef(broker(), factory()->sloppy_arguments_elements_map()));
+  a.Store(AccessBuilder::ForSloppyArgumentsElementsContext(), context);
+  a.Store(AccessBuilder::ForSloppyArgumentsElementsArguments(), arguments);
   for (int i = 0; i < mapped_count; ++i) {
     int idx = shared.context_header_size() + parameter_count - 1 - i;
     Node* value = graph()->NewNode(
@@ -1566,8 +1565,8 @@ Node* JSCreateLowering::AllocateAliasedArguments(
         graph()->NewNode(simplified()->NumberLessThan(), jsgraph()->Constant(i),
                          arguments_length),
         jsgraph()->Constant(idx), jsgraph()->TheHoleConstant());
-    a.Store(AccessBuilder::ForFixedArrayElement(), jsgraph()->Constant(i + 2),
-            value);
+    a.Store(AccessBuilder::ForSloppyArgumentsElementsMappedEntry(),
+            jsgraph()->Constant(i), value);
   }
   return a.Finish();
 }
diff --git a/deps/v8/src/compiler/js-generic-lowering.cc b/deps/v8/src/compiler/js-generic-lowering.cc
index 7a3610fff25..fb31f1247eb 100644
--- a/deps/v8/src/compiler/js-generic-lowering.cc
+++ b/deps/v8/src/compiler/js-generic-lowering.cc
@@ -77,10 +77,6 @@ REPLACE_STUB_CALL(LessThan)
 REPLACE_STUB_CALL(LessThanOrEqual)
 REPLACE_STUB_CALL(GreaterThan)
 REPLACE_STUB_CALL(GreaterThanOrEqual)
-REPLACE_STUB_CALL(BitwiseNot)
-REPLACE_STUB_CALL(Decrement)
-REPLACE_STUB_CALL(Increment)
-REPLACE_STUB_CALL(Negate)
 REPLACE_STUB_CALL(HasProperty)
 REPLACE_STUB_CALL(Equal)
 REPLACE_STUB_CALL(ToLength)
@@ -101,6 +97,8 @@ REPLACE_STUB_CALL(RejectPromise)
 REPLACE_STUB_CALL(ResolvePromise)
 #undef REPLACE_STUB_CALL
 
+// TODO(jgruber): Hook in binary and compare op builtins with feedback.
+
 void JSGenericLowering::ReplaceWithStubCall(Node* node,
                                             Callable callable,
                                             CallDescriptor::Flags flags) {
@@ -147,6 +145,42 @@ void JSGenericLowering::LowerJSStrictEqual(Node* node) {
                       Operator::kEliminatable);
 }
 
+void JSGenericLowering::ReplaceUnaryOpWithBuiltinCall(
+    Node* node, Builtins::Name builtin_without_feedback,
+    Builtins::Name builtin_with_feedback) {
+  const FeedbackParameter& p = FeedbackParameterOf(node->op());
+  CallDescriptor::Flags flags = FrameStateFlagForCall(node);
+  if (CollectFeedbackInGenericLowering() && p.feedback().IsValid()) {
+    Callable callable = Builtins::CallableFor(isolate(), builtin_with_feedback);
+    Node* feedback_vector = jsgraph()->HeapConstant(p.feedback().vector);
+    Node* slot = jsgraph()->UintPtrConstant(p.feedback().slot.ToInt());
+    const CallInterfaceDescriptor& descriptor = callable.descriptor();
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        zone(), descriptor, descriptor.GetStackParameterCount(), flags,
+        node->op()->properties());
+    Node* stub_code = jsgraph()->HeapConstant(callable.code());
+    node->InsertInput(zone(), 0, stub_code);
+    node->InsertInput(zone(), 2, slot);
+    node->InsertInput(zone(), 3, feedback_vector);
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  } else {
+    Callable callable =
+        Builtins::CallableFor(isolate(), builtin_without_feedback);
+    ReplaceWithStubCall(node, callable, flags);
+  }
+}
+
+#define DEF_UNARY_LOWERING(Name)                                     \
+  void JSGenericLowering::LowerJS##Name(Node* node) {                \
+    ReplaceUnaryOpWithBuiltinCall(node, Builtins::k##Name,           \
+                                  Builtins::k##Name##_WithFeedback); \
+  }
+DEF_UNARY_LOWERING(BitwiseNot)
+DEF_UNARY_LOWERING(Decrement)
+DEF_UNARY_LOWERING(Increment)
+DEF_UNARY_LOWERING(Negate)
+#undef DEF_UNARY_LOWERING
+
 namespace {
 bool ShouldUseMegamorphicLoadBuiltin(FeedbackSource const& source,
                                      JSHeapBroker* broker) {
@@ -412,7 +446,7 @@ void JSGenericLowering::LowerJSCreateArguments(Node* node) {
   CreateArgumentsType const type = CreateArgumentsTypeOf(node->op());
   switch (type) {
     case CreateArgumentsType::kMappedArguments:
-      ReplaceWithRuntimeCall(node, Runtime::kNewSloppyArguments_Generic);
+      ReplaceWithRuntimeCall(node, Runtime::kNewSloppyArguments);
       break;
     case CreateArgumentsType::kUnmappedArguments:
       ReplaceWithRuntimeCall(node, Runtime::kNewStrictArguments);
@@ -688,64 +722,178 @@ void JSGenericLowering::LowerJSConstructForwardVarargs(Node* node) {
 
 void JSGenericLowering::LowerJSConstruct(Node* node) {
   ConstructParameters const& p = ConstructParametersOf(node->op());
-  int const arg_count = static_cast<int>(p.arity() - 2);
+  int const arg_count = p.arity_without_implicit_args();
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
-  Callable callable = CodeFactory::Construct(isolate());
-  auto call_descriptor = Linkage::GetStubCallDescriptor(
-      zone(), callable.descriptor(), arg_count + 1, flags);
-  Node* stub_code = jsgraph()->HeapConstant(callable.code());
-  Node* stub_arity = jsgraph()->Int32Constant(arg_count);
-  Node* new_target = node->InputAt(arg_count + 1);
-  Node* receiver = jsgraph()->UndefinedConstant();
-  node->RemoveInput(arg_count + 1);  // Drop new target.
-  node->InsertInput(zone(), 0, stub_code);
-  node->InsertInput(zone(), 2, new_target);
-  node->InsertInput(zone(), 3, stub_arity);
-  node->InsertInput(zone(), 4, receiver);
-  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+
+  // TODO(jgruber): Understand and document how stack_argument_count is
+  // calculated. I've made some educated guesses below but they should be
+  // verified and documented in other lowerings as well.
+  static constexpr int kReceiver = 1;
+  static constexpr int kMaybeFeedbackVector = 1;
+
+  if (CollectFeedbackInGenericLowering() && p.feedback().IsValid()) {
+    const int stack_argument_count =
+        arg_count + kReceiver + kMaybeFeedbackVector;
+    Callable callable =
+        Builtins::CallableFor(isolate(), Builtins::kConstruct_WithFeedback);
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        zone(), callable.descriptor(), stack_argument_count, flags);
+    Node* feedback_vector = jsgraph()->HeapConstant(p.feedback().vector);
+    Node* stub_code = jsgraph()->HeapConstant(callable.code());
+    Node* new_target = node->InputAt(arg_count + 1);
+    Node* stub_arity = jsgraph()->Int32Constant(arg_count);
+    Node* slot = jsgraph()->Int32Constant(p.feedback().index());
+    Node* receiver = jsgraph()->UndefinedConstant();
+    node->RemoveInput(arg_count + 1);  // Drop new target.
+    // Register argument inputs are followed by stack argument inputs (such as
+    // feedback_vector). Both are listed in ascending order. Note that
+    // the receiver is implicitly placed on the stack and is thus inserted
+    // between explicitly-specified register and stack arguments.
+    // TODO(jgruber): Implement a simpler way to specify these mutations.
+    node->InsertInput(zone(), arg_count + 1, feedback_vector);
+    node->InsertInput(zone(), 0, stub_code);
+    node->InsertInput(zone(), 2, new_target);
+    node->InsertInput(zone(), 3, stub_arity);
+    node->InsertInput(zone(), 4, slot);
+    node->InsertInput(zone(), 5, receiver);
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  } else {
+    const int stack_argument_count = arg_count + kReceiver;
+    Callable callable = Builtins::CallableFor(isolate(), Builtins::kConstruct);
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        zone(), callable.descriptor(), stack_argument_count, flags);
+    Node* stub_code = jsgraph()->HeapConstant(callable.code());
+    Node* stub_arity = jsgraph()->Int32Constant(arg_count);
+    Node* new_target = node->InputAt(arg_count + 1);
+    Node* receiver = jsgraph()->UndefinedConstant();
+    node->RemoveInput(arg_count + 1);  // Drop new target.
+    node->InsertInput(zone(), 0, stub_code);
+    node->InsertInput(zone(), 2, new_target);
+    node->InsertInput(zone(), 3, stub_arity);
+    node->InsertInput(zone(), 4, receiver);
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  }
 }
 
 void JSGenericLowering::LowerJSConstructWithArrayLike(Node* node) {
-  Callable callable =
-      Builtins::CallableFor(isolate(), Builtins::kConstructWithArrayLike);
+  ConstructParameters const& p = ConstructParametersOf(node->op());
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
-  auto call_descriptor =
-      Linkage::GetStubCallDescriptor(zone(), callable.descriptor(), 1, flags);
-  Node* stub_code = jsgraph()->HeapConstant(callable.code());
-  Node* receiver = jsgraph()->UndefinedConstant();
-  Node* arguments_list = node->InputAt(1);
-  Node* new_target = node->InputAt(2);
-  node->InsertInput(zone(), 0, stub_code);
-  node->ReplaceInput(2, new_target);
-  node->ReplaceInput(3, arguments_list);
-  node->InsertInput(zone(), 4, receiver);
-  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  const int arg_count = p.arity_without_implicit_args();
+  DCHECK_EQ(arg_count, 1);
+
+  static constexpr int kReceiver = 1;
+  static constexpr int kArgumentList = 1;
+  static constexpr int kMaybeFeedbackVector = 1;
+
+  if (CollectFeedbackInGenericLowering() && p.feedback().IsValid()) {
+    const int stack_argument_count =
+        arg_count - kArgumentList + kReceiver + kMaybeFeedbackVector;
+    Callable callable = Builtins::CallableFor(
+        isolate(), Builtins::kConstructWithArrayLike_WithFeedback);
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        zone(), callable.descriptor(), stack_argument_count, flags);
+    Node* stub_code = jsgraph()->HeapConstant(callable.code());
+    Node* receiver = jsgraph()->UndefinedConstant();
+    Node* arguments_list = node->InputAt(1);
+    Node* new_target = node->InputAt(2);
+    Node* feedback_vector = jsgraph()->HeapConstant(p.feedback().vector);
+    Node* slot = jsgraph()->Int32Constant(p.feedback().index());
+
+    node->InsertInput(zone(), 0, stub_code);
+    node->ReplaceInput(2, new_target);
+    node->ReplaceInput(3, arguments_list);
+    // Register argument inputs are followed by stack argument inputs (such as
+    // feedback_vector). Both are listed in ascending order. Note that
+    // the receiver is implicitly placed on the stack and is thus inserted
+    // between explicitly-specified register and stack arguments.
+    // TODO(jgruber): Implement a simpler way to specify these mutations.
+    node->InsertInput(zone(), 4, slot);
+    node->InsertInput(zone(), 5, receiver);
+    node->InsertInput(zone(), 6, feedback_vector);
+
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  } else {
+    const int stack_argument_count = arg_count - kArgumentList + kReceiver;
+    Callable callable =
+        Builtins::CallableFor(isolate(), Builtins::kConstructWithArrayLike);
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        zone(), callable.descriptor(), stack_argument_count, flags);
+    Node* stub_code = jsgraph()->HeapConstant(callable.code());
+    Node* receiver = jsgraph()->UndefinedConstant();
+    Node* arguments_list = node->InputAt(1);
+    Node* new_target = node->InputAt(2);
+    node->InsertInput(zone(), 0, stub_code);
+    node->ReplaceInput(2, new_target);
+    node->ReplaceInput(3, arguments_list);
+    node->InsertInput(zone(), 4, receiver);
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  }
 }
 
 void JSGenericLowering::LowerJSConstructWithSpread(Node* node) {
   ConstructParameters const& p = ConstructParametersOf(node->op());
-  int const arg_count = static_cast<int>(p.arity() - 2);
+  int const arg_count = p.arity_without_implicit_args();
   int const spread_index = arg_count;
   int const new_target_index = arg_count + 1;
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
-  Callable callable = CodeFactory::ConstructWithSpread(isolate());
-  auto call_descriptor = Linkage::GetStubCallDescriptor(
-      zone(), callable.descriptor(), arg_count, flags);
-  Node* stub_code = jsgraph()->HeapConstant(callable.code());
-  Node* stack_arg_count = jsgraph()->Int32Constant(arg_count - 1);
-  Node* new_target = node->InputAt(new_target_index);
-  Node* spread = node->InputAt(spread_index);
-  Node* receiver = jsgraph()->UndefinedConstant();
-  DCHECK(new_target_index > spread_index);
-  node->RemoveInput(new_target_index);  // Drop new target.
-  node->RemoveInput(spread_index);
 
-  node->InsertInput(zone(), 0, stub_code);
-  node->InsertInput(zone(), 2, new_target);
-  node->InsertInput(zone(), 3, stack_arg_count);
-  node->InsertInput(zone(), 4, spread);
-  node->InsertInput(zone(), 5, receiver);
-  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  static constexpr int kReceiver = 1;
+  static constexpr int kTheSpread = 1;  // Included in `arg_count`.
+  static constexpr int kMaybeFeedbackVector = 1;
+
+  if (CollectFeedbackInGenericLowering() && p.feedback().IsValid()) {
+    const int stack_argument_count =
+        arg_count + kReceiver + kMaybeFeedbackVector;
+    Callable callable = Builtins::CallableFor(
+        isolate(), Builtins::kConstructWithSpread_WithFeedback);
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        zone(), callable.descriptor(), stack_argument_count, flags);
+    Node* stub_code = jsgraph()->HeapConstant(callable.code());
+    Node* feedback_vector = jsgraph()->HeapConstant(p.feedback().vector);
+    Node* slot = jsgraph()->Int32Constant(p.feedback().index());
+
+    // The single available register is needed for `slot`, thus `spread` remains
+    // on the stack here.
+    Node* stub_arity = jsgraph()->Int32Constant(arg_count - kTheSpread);
+    Node* new_target = node->InputAt(new_target_index);
+    Node* receiver = jsgraph()->UndefinedConstant();
+    node->RemoveInput(new_target_index);
+
+    // Register argument inputs are followed by stack argument inputs (such as
+    // feedback_vector). Both are listed in ascending order. Note that
+    // the receiver is implicitly placed on the stack and is thus inserted
+    // between explicitly-specified register and stack arguments.
+    // TODO(jgruber): Implement a simpler way to specify these mutations.
+    node->InsertInput(zone(), arg_count + 1, feedback_vector);
+    node->InsertInput(zone(), 0, stub_code);
+    node->InsertInput(zone(), 2, new_target);
+    node->InsertInput(zone(), 3, stub_arity);
+    node->InsertInput(zone(), 4, slot);
+    node->InsertInput(zone(), 5, receiver);
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  } else {
+    const int stack_argument_count = arg_count + kReceiver - kTheSpread;
+    Callable callable = CodeFactory::ConstructWithSpread(isolate());
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        zone(), callable.descriptor(), stack_argument_count, flags);
+    Node* stub_code = jsgraph()->HeapConstant(callable.code());
+
+    // We pass the spread in a register, not on the stack.
+    Node* stub_arity = jsgraph()->Int32Constant(arg_count - kTheSpread);
+    Node* new_target = node->InputAt(new_target_index);
+    Node* spread = node->InputAt(spread_index);
+    Node* receiver = jsgraph()->UndefinedConstant();
+    DCHECK(new_target_index > spread_index);
+    node->RemoveInput(new_target_index);
+    node->RemoveInput(spread_index);
+
+    node->InsertInput(zone(), 0, stub_code);
+    node->InsertInput(zone(), 2, new_target);
+    node->InsertInput(zone(), 3, stub_arity);
+    node->InsertInput(zone(), 4, spread);
+    node->InsertInput(zone(), 5, receiver);
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  }
 }
 
 void JSGenericLowering::LowerJSCallForwardVarargs(Node* node) {
@@ -766,49 +914,126 @@ void JSGenericLowering::LowerJSCallForwardVarargs(Node* node) {
 
 void JSGenericLowering::LowerJSCall(Node* node) {
   CallParameters const& p = CallParametersOf(node->op());
-  int const arg_count = static_cast<int>(p.arity() - 2);
+  int const arg_count = p.arity_without_implicit_args();
   ConvertReceiverMode const mode = p.convert_mode();
-  Callable callable = CodeFactory::Call(isolate(), mode);
-  CallDescriptor::Flags flags = FrameStateFlagForCall(node);
-  auto call_descriptor = Linkage::GetStubCallDescriptor(
-      zone(), callable.descriptor(), arg_count + 1, flags);
-  Node* stub_code = jsgraph()->HeapConstant(callable.code());
-  Node* stub_arity = jsgraph()->Int32Constant(arg_count);
-  node->InsertInput(zone(), 0, stub_code);
-  node->InsertInput(zone(), 2, stub_arity);
-  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+
+  if (CollectFeedbackInGenericLowering() && p.feedback().IsValid()) {
+    Callable callable = CodeFactory::Call_WithFeedback(isolate(), mode);
+    CallDescriptor::Flags flags = FrameStateFlagForCall(node);
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        zone(), callable.descriptor(), arg_count + 1, flags);
+    Node* stub_code = jsgraph()->HeapConstant(callable.code());
+    Node* stub_arity = jsgraph()->Int32Constant(arg_count);
+    Node* feedback_vector = jsgraph()->HeapConstant(p.feedback().vector);
+    Node* slot = jsgraph()->Int32Constant(p.feedback().index());
+    node->InsertInput(zone(), 0, stub_code);
+    node->InsertInput(zone(), 2, stub_arity);
+    node->InsertInput(zone(), 3, slot);
+    node->InsertInput(zone(), 4, feedback_vector);
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  } else {
+    Callable callable = CodeFactory::Call(isolate(), mode);
+    CallDescriptor::Flags flags = FrameStateFlagForCall(node);
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        zone(), callable.descriptor(), arg_count + 1, flags);
+    Node* stub_code = jsgraph()->HeapConstant(callable.code());
+    Node* stub_arity = jsgraph()->Int32Constant(arg_count);
+    node->InsertInput(zone(), 0, stub_code);
+    node->InsertInput(zone(), 2, stub_arity);
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  }
 }
 
 void JSGenericLowering::LowerJSCallWithArrayLike(Node* node) {
-  Callable callable = CodeFactory::CallWithArrayLike(isolate());
+  CallParameters const& p = CallParametersOf(node->op());
+  const int arg_count = p.arity_without_implicit_args();
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
-  auto call_descriptor =
-      Linkage::GetStubCallDescriptor(zone(), callable.descriptor(), 1, flags);
-  Node* stub_code = jsgraph()->HeapConstant(callable.code());
-  Node* receiver = node->InputAt(1);
-  Node* arguments_list = node->InputAt(2);
-  node->InsertInput(zone(), 0, stub_code);
-  node->ReplaceInput(3, receiver);
-  node->ReplaceInput(2, arguments_list);
-  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+
+  DCHECK_EQ(arg_count, 0);
+  static constexpr int kReceiver = 1;
+
+  if (CollectFeedbackInGenericLowering() && p.feedback().IsValid()) {
+    Callable callable = Builtins::CallableFor(
+        isolate(), Builtins::kCallWithArrayLike_WithFeedback);
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        zone(), callable.descriptor(), arg_count + kReceiver, flags);
+    Node* stub_code = jsgraph()->HeapConstant(callable.code());
+    Node* receiver = node->InputAt(1);
+    Node* arguments_list = node->InputAt(2);
+    Node* feedback_vector = jsgraph()->HeapConstant(p.feedback().vector);
+    Node* slot = jsgraph()->Int32Constant(p.feedback().index());
+    node->InsertInput(zone(), 0, stub_code);
+    node->ReplaceInput(2, arguments_list);
+    node->ReplaceInput(3, receiver);
+    node->InsertInput(zone(), 3, slot);
+    node->InsertInput(zone(), 4, feedback_vector);
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  } else {
+    Callable callable = CodeFactory::CallWithArrayLike(isolate());
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        zone(), callable.descriptor(), arg_count + kReceiver, flags);
+    Node* stub_code = jsgraph()->HeapConstant(callable.code());
+    Node* receiver = node->InputAt(1);
+    Node* arguments_list = node->InputAt(2);
+    node->InsertInput(zone(), 0, stub_code);
+    node->ReplaceInput(2, arguments_list);
+    node->ReplaceInput(3, receiver);
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  }
 }
 
 void JSGenericLowering::LowerJSCallWithSpread(Node* node) {
   CallParameters const& p = CallParametersOf(node->op());
-  int const arg_count = static_cast<int>(p.arity() - 2);
-  int const spread_index = static_cast<int>(p.arity() + 1);
+  int const arg_count = p.arity_without_implicit_args();
+  int const spread_index = arg_count + 1;
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
-  Callable callable = CodeFactory::CallWithSpread(isolate());
-  auto call_descriptor = Linkage::GetStubCallDescriptor(
-      zone(), callable.descriptor(), arg_count, flags);
-  Node* stub_code = jsgraph()->HeapConstant(callable.code());
-  // We pass the spread in a register, not on the stack.
-  Node* stack_arg_count = jsgraph()->Int32Constant(arg_count - 1);
-  node->InsertInput(zone(), 0, stub_code);
-  node->InsertInput(zone(), 2, stack_arg_count);
-  node->InsertInput(zone(), 3, node->InputAt(spread_index));
-  node->RemoveInput(spread_index + 1);
-  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+
+  static constexpr int kTheSpread = 1;
+  static constexpr int kMaybeFeedbackVector = 1;
+
+  if (CollectFeedbackInGenericLowering() && p.feedback().IsValid()) {
+    const int stack_argument_count = arg_count + kMaybeFeedbackVector;
+    Callable callable = Builtins::CallableFor(
+        isolate(), Builtins::kCallWithSpread_WithFeedback);
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        zone(), callable.descriptor(), stack_argument_count, flags);
+    Node* stub_code = jsgraph()->HeapConstant(callable.code());
+    Node* feedback_vector = jsgraph()->HeapConstant(p.feedback().vector);
+    Node* slot = jsgraph()->Int32Constant(p.feedback().index());
+
+    // We pass the spread in a register, not on the stack.
+    Node* stub_arity = jsgraph()->Int32Constant(arg_count - kTheSpread);
+    Node* spread = node->InputAt(spread_index);
+    node->RemoveInput(spread_index);
+
+    // Register argument inputs are followed by stack argument inputs (such as
+    // feedback_vector). Both are listed in ascending order. Note that
+    // the receiver is implicitly placed on the stack and is thus inserted
+    // between explicitly-specified register and stack arguments.
+    // TODO(jgruber): Implement a simpler way to specify these mutations.
+    node->InsertInput(zone(), arg_count + 1, feedback_vector);
+    node->InsertInput(zone(), 0, stub_code);
+    node->InsertInput(zone(), 2, stub_arity);
+    node->InsertInput(zone(), 3, spread);
+    node->InsertInput(zone(), 4, slot);
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  } else {
+    const int stack_argument_count = arg_count;
+    Callable callable = CodeFactory::CallWithSpread(isolate());
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        zone(), callable.descriptor(), stack_argument_count, flags);
+    Node* stub_code = jsgraph()->HeapConstant(callable.code());
+
+    // We pass the spread in a register, not on the stack.
+    Node* stub_arity = jsgraph()->Int32Constant(arg_count - kTheSpread);
+    Node* spread = node->InputAt(spread_index);
+    node->RemoveInput(spread_index);
+
+    node->InsertInput(zone(), 0, stub_code);
+    node->InsertInput(zone(), 2, stub_arity);
+    node->InsertInput(zone(), 3, spread);
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  }
 }
 
 void JSGenericLowering::LowerJSCallRuntime(Node* node) {
diff --git a/deps/v8/src/compiler/js-generic-lowering.h b/deps/v8/src/compiler/js-generic-lowering.h
index 2a4ac808b1a..5edcc9f4b97 100644
--- a/deps/v8/src/compiler/js-generic-lowering.h
+++ b/deps/v8/src/compiler/js-generic-lowering.h
@@ -42,6 +42,10 @@ class JSGenericLowering final : public AdvancedReducer {
                            Operator::Properties properties);
   void ReplaceWithRuntimeCall(Node* node, Runtime::FunctionId f, int args = -1);
 
+  void ReplaceUnaryOpWithBuiltinCall(Node* node,
+                                     Builtins::Name builtin_without_feedback,
+                                     Builtins::Name builtin_with_feedback);
+
   Zone* zone() const;
   Isolate* isolate() const;
   JSGraph* jsgraph() const { return jsgraph_; }
diff --git a/deps/v8/src/compiler/js-heap-broker.cc b/deps/v8/src/compiler/js-heap-broker.cc
index 2c46b346084..ce18f59b7f7 100644
--- a/deps/v8/src/compiler/js-heap-broker.cc
+++ b/deps/v8/src/compiler/js-heap-broker.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "src/compiler/js-heap-broker.h"
+#include "src/common/globals.h"
 #include "src/compiler/heap-refs.h"
 
 #ifdef ENABLE_SLOW_DCHECKS
@@ -609,6 +610,7 @@ class JSFunctionData : public JSObjectData {
   bool has_feedback_vector() const { return has_feedback_vector_; }
   bool has_initial_map() const { return has_initial_map_; }
   bool has_prototype() const { return has_prototype_; }
+  bool IsOptimized() const { return is_optimized_; }
   bool PrototypeRequiresRuntimeLookup() const {
     return PrototypeRequiresRuntimeLookup_;
   }
@@ -622,6 +624,7 @@ class JSFunctionData : public JSObjectData {
   ObjectData* prototype() const { return prototype_; }
   SharedFunctionInfoData* shared() const { return shared_; }
   FeedbackVectorData* feedback_vector() const { return feedback_vector_; }
+  CodeData* code() const { return code_; }
   int initial_map_instance_size_with_min_slack() const {
     CHECK(serialized_);
     return initial_map_instance_size_with_min_slack_;
@@ -631,6 +634,7 @@ class JSFunctionData : public JSObjectData {
   bool has_feedback_vector_;
   bool has_initial_map_;
   bool has_prototype_;
+  bool is_optimized_;
   bool PrototypeRequiresRuntimeLookup_;
 
   bool serialized_ = false;
@@ -641,6 +645,7 @@ class JSFunctionData : public JSObjectData {
   ObjectData* prototype_ = nullptr;
   SharedFunctionInfoData* shared_ = nullptr;
   FeedbackVectorData* feedback_vector_ = nullptr;
+  CodeData* code_ = nullptr;
   int initial_map_instance_size_with_min_slack_;
 };
 
@@ -1260,6 +1265,7 @@ JSFunctionData::JSFunctionData(JSHeapBroker* broker, ObjectData** storage,
       has_initial_map_(object->has_prototype_slot() &&
                        object->has_initial_map()),
       has_prototype_(object->has_prototype_slot() && object->has_prototype()),
+      is_optimized_(object->IsOptimized()),
       PrototypeRequiresRuntimeLookup_(
           object->PrototypeRequiresRuntimeLookup()) {}
 
@@ -1276,6 +1282,7 @@ void JSFunctionData::Serialize(JSHeapBroker* broker) {
   DCHECK_NULL(prototype_);
   DCHECK_NULL(shared_);
   DCHECK_NULL(feedback_vector_);
+  DCHECK_NULL(code_);
 
   context_ = broker->GetOrCreateData(function->context())->AsContext();
   native_context_ =
@@ -1285,6 +1292,7 @@ void JSFunctionData::Serialize(JSHeapBroker* broker) {
                          ? broker->GetOrCreateData(function->feedback_vector())
                                ->AsFeedbackVector()
                          : nullptr;
+  code_ = broker->GetOrCreateData(function->code())->AsCode();
   initial_map_ = has_initial_map()
                      ? broker->GetOrCreateData(function->initial_map())->AsMap()
                      : nullptr;
@@ -2023,7 +2031,13 @@ class TemplateObjectDescriptionData : public HeapObjectData {
 class CodeData : public HeapObjectData {
  public:
   CodeData(JSHeapBroker* broker, ObjectData** storage, Handle<Code> object)
-      : HeapObjectData(broker, storage, object) {}
+      : HeapObjectData(broker, storage, object),
+        inlined_bytecode_size_(object->inlined_bytecode_size()) {}
+
+  unsigned inlined_bytecode_size() const { return inlined_bytecode_size_; }
+
+ private:
+  unsigned const inlined_bytecode_size_;
 };
 
 #define DEFINE_IS_AND_AS(Name)                                          \
@@ -2393,9 +2407,11 @@ JSHeapBroker::JSHeapBroker(Isolate* isolate, Zone* broker_zone,
   TRACE(this, "Constructing heap broker");
 }
 
-std::ostream& JSHeapBroker::Trace() const {
-  return trace_out_ << "[" << this << "] "
-                    << std::string(trace_indentation_ * 2, ' ');
+std::string JSHeapBroker::Trace() const {
+  std::ostringstream oss;
+  oss << "[" << this << "] ";
+  for (unsigned i = 0; i < trace_indentation_ * 2; ++i) oss.put(' ');
+  return oss.str();
 }
 
 void JSHeapBroker::StopSerializing() {
@@ -2845,28 +2861,6 @@ int JSFunctionRef::InitialMapInstanceSizeWithMinSlack() const {
   return data()->AsJSFunction()->initial_map_instance_size_with_min_slack();
 }
 
-// Not needed for TypedLowering.
-base::Optional<ScriptContextTableRef::LookupResult>
-ScriptContextTableRef::lookup(const NameRef& name) const {
-  AllowHandleAllocationIf allow_handle_allocation(data()->kind(),
-                                                  broker()->mode());
-  AllowHandleDereferenceIf allow_handle_dereference(data()->kind(),
-                                                    broker()->mode());
-  if (!name.IsString()) return {};
-  ScriptContextTable::LookupResult lookup_result;
-  auto table = object();
-  if (!ScriptContextTable::Lookup(broker()->isolate(), *table,
-                                  *name.AsString().object(), &lookup_result)) {
-    return {};
-  }
-  Handle<Context> script_context = ScriptContextTable::GetContext(
-      broker()->isolate(), table, lookup_result.context_index);
-  LookupResult result{ContextRef(broker(), script_context),
-                      lookup_result.mode == VariableMode::kConst,
-                      lookup_result.slot_index};
-  return result;
-}
-
 OddballType MapRef::oddball_type() const {
   if (instance_type() != ODDBALL_TYPE) {
     return OddballType::kNone;
@@ -3370,6 +3364,7 @@ BIMODAL_ACCESSOR_C(JSDataView, size_t, byte_offset)
 BIMODAL_ACCESSOR_C(JSFunction, bool, has_feedback_vector)
 BIMODAL_ACCESSOR_C(JSFunction, bool, has_initial_map)
 BIMODAL_ACCESSOR_C(JSFunction, bool, has_prototype)
+BIMODAL_ACCESSOR_C(JSFunction, bool, IsOptimized)
 BIMODAL_ACCESSOR_C(JSFunction, bool, PrototypeRequiresRuntimeLookup)
 BIMODAL_ACCESSOR(JSFunction, Context, context)
 BIMODAL_ACCESSOR(JSFunction, NativeContext, native_context)
@@ -3377,6 +3372,7 @@ BIMODAL_ACCESSOR(JSFunction, Map, initial_map)
 BIMODAL_ACCESSOR(JSFunction, Object, prototype)
 BIMODAL_ACCESSOR(JSFunction, SharedFunctionInfo, shared)
 BIMODAL_ACCESSOR(JSFunction, FeedbackVector, feedback_vector)
+BIMODAL_ACCESSOR(JSFunction, Code, code)
 
 BIMODAL_ACCESSOR_C(JSGlobalObject, bool, IsDetached)
 
@@ -3412,6 +3408,8 @@ BIMODAL_ACCESSOR(Map, Object, GetConstructor)
 BIMODAL_ACCESSOR(Map, HeapObject, GetBackPointer)
 BIMODAL_ACCESSOR_C(Map, bool, is_abandoned_prototype_map)
 
+BIMODAL_ACCESSOR_C(Code, unsigned, inlined_bytecode_size)
+
 #define DEF_NATIVE_CONTEXT_ACCESSOR(type, name) \
   BIMODAL_ACCESSOR(NativeContext, type, name)
 BROKER_NATIVE_CONTEXT_FIELDS(DEF_NATIVE_CONTEXT_ACCESSOR)
@@ -4669,17 +4667,25 @@ bool JSHeapBroker::FeedbackIsInsufficient(FeedbackSource const& source) const {
 }
 
 namespace {
-MapHandles GetRelevantReceiverMaps(Isolate* isolate, MapHandles const& maps) {
-  MapHandles result;
-  for (Handle<Map> map : maps) {
+// Remove unupdatable and abandoned prototype maps in-place.
+void FilterRelevantReceiverMaps(Isolate* isolate, MapHandles* maps) {
+  auto in = maps->begin();
+  auto out = in;
+  auto end = maps->end();
+
+  for (; in != end; ++in) {
+    Handle<Map> map = *in;
     if (Map::TryUpdate(isolate, map).ToHandle(&map) &&
         !map->is_abandoned_prototype_map()) {
       DCHECK(!map->is_deprecated());
-      result.push_back(map);
+      *out = *in;
+      ++out;
     }
   }
-  return result;
-}  // namespace
+
+  // Remove everything between the last valid map and the end of the vector.
+  maps->erase(out, end);
+}
 }  // namespace
 
 ProcessedFeedback const& JSHeapBroker::ReadFeedbackForPropertyAccess(
@@ -4691,14 +4697,19 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForPropertyAccess(
 
   MapHandles maps;
   nexus.ExtractMaps(&maps);
-  if (!maps.empty()) {
-    maps = GetRelevantReceiverMaps(isolate(), maps);
-    if (maps.empty()) return *new (zone()) InsufficientFeedback(kind);
+  FilterRelevantReceiverMaps(isolate(), &maps);
+
+  // If no maps were found for a non-megamorphic access, then our maps died and
+  // we should soft-deopt.
+  if (maps.empty() && nexus.ic_state() != MEGAMORPHIC) {
+    return *new (zone()) InsufficientFeedback(kind);
   }
 
   base::Optional<NameRef> name =
       static_name.has_value() ? static_name : GetNameFeedback(nexus);
   if (name.has_value()) {
+    // We rely on this invariant in JSGenericLowering.
+    DCHECK_IMPLIES(maps.empty(), nexus.ic_state() == MEGAMORPHIC);
     return *new (zone()) NamedAccessFeedback(
         *name, ZoneVector<Handle<Map>>(maps.begin(), maps.end(), zone()), kind);
   } else if (nexus.GetKeyType() == ELEMENT && !maps.empty()) {
@@ -4707,8 +4718,7 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForPropertyAccess(
   } else {
     // No actionable feedback.
     DCHECK(maps.empty());
-    // TODO(neis): Investigate if we really want to treat cleared the same as
-    // megamorphic (also for global accesses).
+    DCHECK_EQ(nexus.ic_state(), MEGAMORPHIC);
     // TODO(neis): Using ElementAccessFeedback here is kind of an abuse.
     return *new (zone())
         ElementAccessFeedback(zone(), KeyedAccessMode::FromNexus(nexus), kind);
diff --git a/deps/v8/src/compiler/js-heap-broker.h b/deps/v8/src/compiler/js-heap-broker.h
index 424da1df55b..cd6ed5979a8 100644
--- a/deps/v8/src/compiler/js-heap-broker.h
+++ b/deps/v8/src/compiler/js-heap-broker.h
@@ -33,20 +33,20 @@ std::ostream& operator<<(std::ostream& os, const ObjectRef& ref);
 #define TRACE_BROKER(broker, x)                                      \
   do {                                                               \
     if (broker->tracing_enabled() && FLAG_trace_heap_broker_verbose) \
-      broker->Trace() << x << '\n';                                  \
+      StdoutStream{} << broker->Trace() << x << '\n';                \
   } while (false)
 
 #define TRACE_BROKER_MEMORY(broker, x)                              \
   do {                                                              \
     if (broker->tracing_enabled() && FLAG_trace_heap_broker_memory) \
-      broker->Trace() << x << std::endl;                            \
+      StdoutStream{} << broker->Trace() << x << std::endl;          \
   } while (false)
 
-#define TRACE_BROKER_MISSING(broker, x)                             \
-  do {                                                              \
-    if (broker->tracing_enabled())                                  \
-      broker->Trace() << "Missing " << x << " (" << __FILE__ << ":" \
-                      << __LINE__ << ")" << std::endl;              \
+#define TRACE_BROKER_MISSING(broker, x)                                        \
+  do {                                                                         \
+    if (broker->tracing_enabled())                                             \
+      StdoutStream{} << broker->Trace() << "Missing " << x << " (" << __FILE__ \
+                     << ":" << __LINE__ << ")" << std::endl;                   \
   } while (false)
 
 struct PropertyAccessTarget {
@@ -193,7 +193,7 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   bool IsSerializedForCompilation(const SharedFunctionInfoRef& shared,
                                   const FeedbackVectorRef& feedback) const;
 
-  std::ostream& Trace() const;
+  std::string Trace() const;
   void IncrementTracingIndentation();
   void DecrementTracingIndentation();
 
@@ -242,7 +242,6 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   BrokerMode mode_ = kDisabled;
   bool const tracing_enabled_;
   bool const is_concurrent_inlining_;
-  mutable StdoutStream trace_out_;
   unsigned trace_indentation_ = 0;
   PerIsolateCompilerCache* compiler_cache_ = nullptr;
   ZoneUnorderedMap<FeedbackSource, ProcessedFeedback const*,
diff --git a/deps/v8/src/compiler/js-inlining-heuristic.cc b/deps/v8/src/compiler/js-inlining-heuristic.cc
index f38cb51c1f8..1c2bf5bc0ea 100644
--- a/deps/v8/src/compiler/js-inlining-heuristic.cc
+++ b/deps/v8/src/compiler/js-inlining-heuristic.cc
@@ -22,8 +22,8 @@ namespace compiler {
   } while (false)
 
 namespace {
-bool IsSmall(BytecodeArrayRef const& bytecode) {
-  return bytecode.length() <= FLAG_max_inlined_bytecode_size_small;
+bool IsSmall(int const size) {
+  return size <= FLAG_max_inlined_bytecode_size_small;
 }
 
 bool CanConsiderForInlining(JSHeapBroker* broker,
@@ -200,7 +200,16 @@ Reduction JSInliningHeuristic::Reduce(Node* node) {
       can_inline_candidate = true;
       BytecodeArrayRef bytecode = candidate.bytecode[i].value();
       candidate.total_size += bytecode.length();
-      candidate_is_small = candidate_is_small && IsSmall(bytecode);
+      unsigned inlined_bytecode_size = 0;
+      if (candidate.functions[i].has_value()) {
+        JSFunctionRef function = candidate.functions[i].value();
+        if (function.IsOptimized()) {
+          inlined_bytecode_size = function.code().inlined_bytecode_size();
+          candidate.total_size += inlined_bytecode_size;
+        }
+      }
+      candidate_is_small = candidate_is_small &&
+                           IsSmall(bytecode.length() + inlined_bytecode_size);
     }
   }
   if (!can_inline_candidate) return NoChange();
@@ -775,6 +784,13 @@ void JSInliningHeuristic::PrintCandidates() {
       os << "  - target: " << shared;
       if (candidate.bytecode[i].has_value()) {
         os << ", bytecode size: " << candidate.bytecode[i]->length();
+        if (candidate.functions[i].has_value()) {
+          JSFunctionRef function = candidate.functions[i].value();
+          if (function.IsOptimized()) {
+            os << ", existing opt code's inlined bytecode size: "
+               << function.code().inlined_bytecode_size();
+          }
+        }
       } else {
         os << ", no bytecode";
       }
diff --git a/deps/v8/src/compiler/js-inlining-heuristic.h b/deps/v8/src/compiler/js-inlining-heuristic.h
index 3830be44454..a613dacaaa1 100644
--- a/deps/v8/src/compiler/js-inlining-heuristic.h
+++ b/deps/v8/src/compiler/js-inlining-heuristic.h
@@ -33,6 +33,10 @@ class JSInliningHeuristic final : public AdvancedReducer {
   // and inlines call sites that the heuristic determines to be important.
   void Finalize() final;
 
+  int total_inlined_bytecode_size() const {
+    return total_inlined_bytecode_size_;
+  }
+
  private:
   // This limit currently matches what the old compiler did. We may want to
   // re-evaluate and come up with a proper limit for TurboFan.
diff --git a/deps/v8/src/compiler/js-native-context-specialization.cc b/deps/v8/src/compiler/js-native-context-specialization.cc
index 3963edcbbd9..73b10435e27 100644
--- a/deps/v8/src/compiler/js-native-context-specialization.cc
+++ b/deps/v8/src/compiler/js-native-context-specialization.cc
@@ -442,8 +442,7 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
     NodeProperties::ReplaceValueInput(node, object, 1);
     NodeProperties::ReplaceEffectInput(node, effect);
     NodeProperties::ChangeOp(node, javascript()->OrdinaryHasInstance());
-    Reduction const reduction = ReduceJSOrdinaryHasInstance(node);
-    return reduction.Changed() ? reduction : Changed(node);
+    return Changed(node).FollowedBy(ReduceJSOrdinaryHasInstance(node));
   }
 
   if (access_info.IsDataConstant()) {
@@ -489,7 +488,8 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
     node->ReplaceInput(4, continuation_frame_state);
     node->ReplaceInput(5, effect);
     NodeProperties::ChangeOp(
-        node, javascript()->Call(3, CallFrequency(), FeedbackSource(),
+        node, javascript()->Call(1 + kTargetAndReceiver, CallFrequency(),
+                                 FeedbackSource(),
                                  ConvertReceiverMode::kNotNullOrUndefined));
 
     // Rewire the value uses of {node} to ToBoolean conversion of the result.
@@ -623,8 +623,7 @@ Reduction JSNativeContextSpecialization::ReduceJSOrdinaryHasInstance(
     NodeProperties::ReplaceValueInput(
         node, jsgraph()->Constant(bound_target_function), 1);
     NodeProperties::ChangeOp(node, javascript()->InstanceOf(FeedbackSource()));
-    Reduction const reduction = ReduceJSInstanceOf(node);
-    return reduction.Changed() ? reduction : Changed(node);
+    return Changed(node).FollowedBy(ReduceJSInstanceOf(node));
   }
 
   if (m.Ref(broker()).IsJSFunction()) {
@@ -650,8 +649,7 @@ Reduction JSNativeContextSpecialization::ReduceJSOrdinaryHasInstance(
     NodeProperties::ReplaceValueInput(node, object, 0);
     NodeProperties::ReplaceValueInput(node, prototype_constant, 1);
     NodeProperties::ChangeOp(node, javascript()->HasInPrototypeChain());
-    Reduction const reduction = ReduceJSHasInPrototypeChain(node);
-    return reduction.Changed() ? reduction : Changed(node);
+    return Changed(node).FollowedBy(ReduceJSHasInPrototypeChain(node));
   }
 
   return NoChange();
@@ -1431,10 +1429,10 @@ Reduction JSNativeContextSpecialization::ReduceJSGetIterator(Node* node) {
   SpeculationMode mode = feedback.IsInsufficient()
                              ? SpeculationMode::kDisallowSpeculation
                              : feedback.AsCall().speculation_mode();
-  const Operator* call_op =
-      javascript()->Call(2, CallFrequency(), p.callFeedback(),
-                         ConvertReceiverMode::kNotNullOrUndefined, mode,
-                         CallFeedbackRelation::kRelated);
+  const Operator* call_op = javascript()->Call(
+      0 + kTargetAndReceiver, CallFrequency(), p.callFeedback(),
+      ConvertReceiverMode::kNotNullOrUndefined, mode,
+      CallFeedbackRelation::kRelated);
   Node* call_property = graph()->NewNode(call_op, load_property, receiver,
                                          context, frame_state, effect, control);
 
@@ -2051,7 +2049,8 @@ Node* JSNativeContextSpecialization::InlinePropertyGetterCall(
   Node* value;
   if (constant.IsJSFunction()) {
     value = *effect = *control = graph()->NewNode(
-        jsgraph()->javascript()->Call(2, CallFrequency(), FeedbackSource(),
+        jsgraph()->javascript()->Call(0 + kTargetAndReceiver, CallFrequency(),
+                                      FeedbackSource(),
                                       ConvertReceiverMode::kNotNullOrUndefined),
         target, receiver, context, frame_state, *effect, *control);
   } else {
@@ -2088,7 +2087,8 @@ void JSNativeContextSpecialization::InlinePropertySetterCall(
   // Introduce the call to the setter function.
   if (constant.IsJSFunction()) {
     *effect = *control = graph()->NewNode(
-        jsgraph()->javascript()->Call(3, CallFrequency(), FeedbackSource(),
+        jsgraph()->javascript()->Call(1 + kTargetAndReceiver, CallFrequency(),
+                                      FeedbackSource(),
                                       ConvertReceiverMode::kNotNullOrUndefined),
         target, receiver, value, context, frame_state, *effect, *control);
   } else {
@@ -2455,8 +2455,16 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreDataPropertyInLiteral(
   FeedbackParameter const& p = FeedbackParameterOf(node->op());
   Node* const key = NodeProperties::GetValueInput(node, 1);
   Node* const value = NodeProperties::GetValueInput(node, 2);
+  Node* const flags = NodeProperties::GetValueInput(node, 3);
 
   if (!p.feedback().IsValid()) return NoChange();
+
+  NumberMatcher mflags(flags);
+  CHECK(mflags.HasValue());
+  DataPropertyInLiteralFlags cflags(mflags.Value());
+  DCHECK(!(cflags & DataPropertyInLiteralFlag::kDontEnum));
+  if (cflags & DataPropertyInLiteralFlag::kSetFunctionName) return NoChange();
+
   return ReducePropertyAccess(node, key, base::nullopt, value,
                               FeedbackSource(p.feedback()),
                               AccessMode::kStoreInLiteral);
@@ -2612,9 +2620,10 @@ JSNativeContextSpecialization::BuildElementAccess(
       situation = kHandleOOB_SmiCheckDone;
     } else {
       // Check that the {index} is in the valid range for the {receiver}.
-      index = effect =
-          graph()->NewNode(simplified()->CheckBounds(FeedbackSource()), index,
-                           length, effect, control);
+      index = effect = graph()->NewNode(
+          simplified()->CheckBounds(
+              FeedbackSource(), CheckBoundsFlag::kConvertStringAndMinusZero),
+          index, length, effect, control);
       situation = kBoundsCheckDone;
     }
 
@@ -2642,7 +2651,8 @@ JSNativeContextSpecialization::BuildElementAccess(
             index = etrue = graph()->NewNode(
                 simplified()->CheckBounds(
                     FeedbackSource(),
-                    CheckBoundsParameters::kAbortOnOutOfBounds),
+                    CheckBoundsFlag::kConvertStringAndMinusZero |
+                        CheckBoundsFlag::kAbortOnOutOfBounds),
                 index, length, etrue, if_true);
 
             // Perform the actual load
@@ -2712,7 +2722,8 @@ JSNativeContextSpecialization::BuildElementAccess(
             index = etrue = graph()->NewNode(
                 simplified()->CheckBounds(
                     FeedbackSource(),
-                    CheckBoundsParameters::kAbortOnOutOfBounds),
+                    CheckBoundsFlag::kConvertStringAndMinusZero |
+                        CheckBoundsFlag::kAbortOnOutOfBounds),
                 index, length, etrue, if_true);
 
             // Perform the actual store.
@@ -2796,13 +2807,15 @@ JSNativeContextSpecialization::BuildElementAccess(
       // bounds check below and just skip the store below if it's out of
       // bounds for the {receiver}.
       index = effect = graph()->NewNode(
-          simplified()->CheckBounds(FeedbackSource()), index,
-          jsgraph()->Constant(Smi::kMaxValue), effect, control);
+          simplified()->CheckBounds(
+              FeedbackSource(), CheckBoundsFlag::kConvertStringAndMinusZero),
+          index, jsgraph()->Constant(Smi::kMaxValue), effect, control);
     } else {
       // Check that the {index} is in the valid range for the {receiver}.
-      index = effect =
-          graph()->NewNode(simplified()->CheckBounds(FeedbackSource()), index,
-                           length, effect, control);
+      index = effect = graph()->NewNode(
+          simplified()->CheckBounds(
+              FeedbackSource(), CheckBoundsFlag::kConvertStringAndMinusZero),
+          index, length, effect, control);
     }
 
     // Compute the element access.
@@ -2850,10 +2863,12 @@ JSNativeContextSpecialization::BuildElementAccess(
           // Do a real bounds check against {length}. This is in order to
           // protect against a potential typer bug leading to the elimination of
           // the NumberLessThan above.
-          index = etrue = graph()->NewNode(
-              simplified()->CheckBounds(
-                  FeedbackSource(), CheckBoundsParameters::kAbortOnOutOfBounds),
-              index, length, etrue, if_true);
+          index = etrue =
+              graph()->NewNode(simplified()->CheckBounds(
+                                   FeedbackSource(),
+                                   CheckBoundsFlag::kConvertStringAndMinusZero |
+                                       CheckBoundsFlag::kAbortOnOutOfBounds),
+                               index, length, etrue, if_true);
 
           // Perform the actual load
           vtrue = etrue =
@@ -2952,9 +2967,10 @@ JSNativeContextSpecialization::BuildElementAccess(
         Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
         Node* etrue = effect;
 
-        Node* checked = etrue =
-            graph()->NewNode(simplified()->CheckBounds(FeedbackSource()), index,
-                             length, etrue, if_true);
+        Node* checked = etrue = graph()->NewNode(
+            simplified()->CheckBounds(
+                FeedbackSource(), CheckBoundsFlag::kConvertStringAndMinusZero),
+            index, length, etrue, if_true);
 
         Node* element = etrue =
             graph()->NewNode(simplified()->LoadElement(element_access),
@@ -3041,9 +3057,10 @@ JSNativeContextSpecialization::BuildElementAccess(
                                    jsgraph()->Constant(JSObject::kMaxGap))
                 : graph()->NewNode(simplified()->NumberAdd(), length,
                                    jsgraph()->OneConstant());
-        index = effect =
-            graph()->NewNode(simplified()->CheckBounds(FeedbackSource()), index,
-                             limit, effect, control);
+        index = effect = graph()->NewNode(
+            simplified()->CheckBounds(
+                FeedbackSource(), CheckBoundsFlag::kConvertStringAndMinusZero),
+            index, limit, effect, control);
 
         // Grow {elements} backing store if necessary.
         GrowFastElementsMode mode =
@@ -3111,8 +3128,9 @@ Node* JSNativeContextSpecialization::BuildIndexedStringLoad(
       dependencies()->DependOnNoElementsProtector()) {
     // Ensure that the {index} is a valid String length.
     index = *effect = graph()->NewNode(
-        simplified()->CheckBounds(FeedbackSource()), index,
-        jsgraph()->Constant(String::kMaxLength), *effect, *control);
+        simplified()->CheckBounds(FeedbackSource(),
+                                  CheckBoundsFlag::kConvertStringAndMinusZero),
+        index, jsgraph()->Constant(String::kMaxLength), *effect, *control);
 
     // Load the single character string from {receiver} or yield
     // undefined if the {index} is not within the valid bounds.
@@ -3129,7 +3147,8 @@ Node* JSNativeContextSpecialization::BuildIndexedStringLoad(
     // NumberLessThan above.
     Node* etrue = index = graph()->NewNode(
         simplified()->CheckBounds(FeedbackSource(),
-                                  CheckBoundsParameters::kAbortOnOutOfBounds),
+                                  CheckBoundsFlag::kConvertStringAndMinusZero |
+                                      CheckBoundsFlag::kAbortOnOutOfBounds),
         index, length, *effect, if_true);
     Node* masked_index = graph()->NewNode(simplified()->PoisonIndex(), index);
     Node* vtrue = etrue =
@@ -3147,9 +3166,10 @@ Node* JSNativeContextSpecialization::BuildIndexedStringLoad(
                             vtrue, vfalse, *control);
   } else {
     // Ensure that {index} is less than {receiver} length.
-    index = *effect =
-        graph()->NewNode(simplified()->CheckBounds(FeedbackSource()), index,
-                         length, *effect, *control);
+    index = *effect = graph()->NewNode(
+        simplified()->CheckBounds(FeedbackSource(),
+                                  CheckBoundsFlag::kConvertStringAndMinusZero),
+        index, length, *effect, *control);
 
     Node* masked_index = graph()->NewNode(simplified()->PoisonIndex(), index);
 
diff --git a/deps/v8/src/compiler/js-operator.cc b/deps/v8/src/compiler/js-operator.cc
index 45e144094b9..62fd8ec4196 100644
--- a/deps/v8/src/compiler/js-operator.cc
+++ b/deps/v8/src/compiler/js-operator.cc
@@ -22,11 +22,6 @@ std::ostream& operator<<(std::ostream& os, CallFrequency const& f) {
   return os << f.value();
 }
 
-CallFrequency CallFrequencyOf(Operator const* op) {
-  DCHECK_EQ(op->opcode(), IrOpcode::kJSConstructWithArrayLike);
-  return OpParameter<CallFrequency>(op);
-}
-
 std::ostream& operator<<(std::ostream& os,
                          ConstructForwardVarargsParameters const& p) {
   return os << p.arity() << ", " << p.start_index();
@@ -60,6 +55,7 @@ std::ostream& operator<<(std::ostream& os, ConstructParameters const& p) {
 
 ConstructParameters const& ConstructParametersOf(Operator const* op) {
   DCHECK(op->opcode() == IrOpcode::kJSConstruct ||
+         op->opcode() == IrOpcode::kJSConstructWithArrayLike ||
          op->opcode() == IrOpcode::kJSConstructWithSpread);
   return OpParameter<ConstructParameters>(op);
 }
@@ -230,8 +226,12 @@ std::ostream& operator<<(std::ostream& os, FeedbackParameter const& p) {
 }
 
 FeedbackParameter const& FeedbackParameterOf(const Operator* op) {
-  DCHECK(op->opcode() == IrOpcode::kJSCreateEmptyLiteralArray ||
+  DCHECK(op->opcode() == IrOpcode::kJSDecrement ||
+         op->opcode() == IrOpcode::kJSBitwiseNot ||
+         op->opcode() == IrOpcode::kJSCreateEmptyLiteralArray ||
+         op->opcode() == IrOpcode::kJSIncrement ||
          op->opcode() == IrOpcode::kJSInstanceOf ||
+         op->opcode() == IrOpcode::kJSNegate ||
          op->opcode() == IrOpcode::kJSStoreDataPropertyInLiteral ||
          op->opcode() == IrOpcode::kJSStoreInArrayLiteral);
   return OpParameter<FeedbackParameter>(op);
@@ -663,10 +663,6 @@ CompareOperationHint CompareOperationHintOf(const Operator* op) {
   V(Divide, Operator::kNoProperties, 2, 1)                               \
   V(Modulus, Operator::kNoProperties, 2, 1)                              \
   V(Exponentiate, Operator::kNoProperties, 2, 1)                         \
-  V(BitwiseNot, Operator::kNoProperties, 1, 1)                           \
-  V(Decrement, Operator::kNoProperties, 1, 1)                            \
-  V(Increment, Operator::kNoProperties, 1, 1)                            \
-  V(Negate, Operator::kNoProperties, 1, 1)                               \
   V(ToLength, Operator::kNoProperties, 1, 1)                             \
   V(ToName, Operator::kNoProperties, 1, 1)                               \
   V(ToNumber, Operator::kNoProperties, 1, 1)                             \
@@ -703,11 +699,19 @@ CompareOperationHint CompareOperationHintOf(const Operator* op) {
   V(ParseInt, Operator::kNoProperties, 2, 1)                             \
   V(RegExpTest, Operator::kNoProperties, 2, 1)
 
+#define UNARY_OP_LIST(V) \
+  V(BitwiseNot)          \
+  V(Decrement)           \
+  V(Increment)           \
+  V(Negate)
+
 #define BINARY_OP_LIST(V) V(Add)
 
+#define COMPARE_EQUAL_OP_LIST(V)    \
+  V(Equal, Operator::kNoProperties) \
+  V(StrictEqual, Operator::kPure)
+
 #define COMPARE_OP_LIST(V)                    \
-  V(Equal, Operator::kNoProperties)           \
-  V(StrictEqual, Operator::kPure)             \
   V(LessThan, Operator::kNoProperties)        \
   V(GreaterThan, Operator::kNoProperties)     \
   V(LessThanOrEqual, Operator::kNoProperties) \
@@ -774,6 +778,12 @@ struct JSOperatorGlobalCache final {
       k##Name##ReceiverOrNullOrUndefinedOperator;                            \
   Name##Operator<CompareOperationHint::kAny> k##Name##AnyOperator;
   COMPARE_OP_LIST(COMPARE_OP)
+  COMPARE_EQUAL_OP_LIST(COMPARE_OP)
+  // Only equality provides an additional operator for NumberOrBoolean.
+  EqualOperator<CompareOperationHint::kNumberOrBoolean>
+      kEqualNumberOrBooleanOperator;
+  StrictEqualOperator<CompareOperationHint::kNumberOrBoolean>
+      kStrictEqualNumberOrBooleanOperator;
 #undef COMPARE_OP
 };
 
@@ -819,6 +829,16 @@ CACHED_OP_LIST(CACHED_OP)
 BINARY_OP_LIST(BINARY_OP)
 #undef BINARY_OP
 
+#define UNARY_OP(Name)                                                        \
+  const Operator* JSOperatorBuilder::Name(FeedbackSource const& feedback) {   \
+    FeedbackParameter parameters(feedback);                                   \
+    return new (zone()) Operator1<FeedbackParameter>(                         \
+        IrOpcode::kJS##Name, Operator::kNoProperties, "JS" #Name, 1, 1, 1, 1, \
+        1, 2, parameters);                                                    \
+  }
+UNARY_OP_LIST(UNARY_OP)
+#undef UNARY_OP
+
 #define COMPARE_OP(Name, ...)                                          \
   const Operator* JSOperatorBuilder::Name(CompareOperationHint hint) { \
     switch (hint) {                                                    \
@@ -828,6 +848,9 @@ BINARY_OP_LIST(BINARY_OP)
         return &cache_.k##Name##SignedSmallOperator;                   \
       case CompareOperationHint::kNumber:                              \
         return &cache_.k##Name##NumberOperator;                        \
+      case CompareOperationHint::kNumberOrBoolean:                     \
+        /* Not supported for operations other than equality */         \
+        UNIMPLEMENTED();                                               \
       case CompareOperationHint::kNumberOrOddball:                     \
         return &cache_.k##Name##NumberOrOddballOperator;               \
       case CompareOperationHint::kInternalizedString:                  \
@@ -851,6 +874,40 @@ BINARY_OP_LIST(BINARY_OP)
 COMPARE_OP_LIST(COMPARE_OP)
 #undef COMPARE_OP
 
+#define COMPARE_EQUAL_OP(Name, ...)                                    \
+  const Operator* JSOperatorBuilder::Name(CompareOperationHint hint) { \
+    switch (hint) {                                                    \
+      case CompareOperationHint::kNone:                                \
+        return &cache_.k##Name##NoneOperator;                          \
+      case CompareOperationHint::kSignedSmall:                         \
+        return &cache_.k##Name##SignedSmallOperator;                   \
+      case CompareOperationHint::kNumber:                              \
+        return &cache_.k##Name##NumberOperator;                        \
+      case CompareOperationHint::kNumberOrBoolean:                     \
+        return &cache_.k##Name##NumberOrBooleanOperator;               \
+      case CompareOperationHint::kNumberOrOddball:                     \
+        return &cache_.k##Name##NumberOrOddballOperator;               \
+      case CompareOperationHint::kInternalizedString:                  \
+        return &cache_.k##Name##InternalizedStringOperator;            \
+      case CompareOperationHint::kString:                              \
+        return &cache_.k##Name##StringOperator;                        \
+      case CompareOperationHint::kSymbol:                              \
+        return &cache_.k##Name##SymbolOperator;                        \
+      case CompareOperationHint::kBigInt:                              \
+        return &cache_.k##Name##BigIntOperator;                        \
+      case CompareOperationHint::kReceiver:                            \
+        return &cache_.k##Name##ReceiverOperator;                      \
+      case CompareOperationHint::kReceiverOrNullOrUndefined:           \
+        return &cache_.k##Name##ReceiverOrNullOrUndefinedOperator;     \
+      case CompareOperationHint::kAny:                                 \
+        return &cache_.k##Name##AnyOperator;                           \
+    }                                                                  \
+    UNREACHABLE();                                                     \
+    return nullptr;                                                    \
+  }
+COMPARE_EQUAL_OP_LIST(COMPARE_EQUAL_OP)
+#undef COMPARE_EQUAL_OP
+
 const Operator* JSOperatorBuilder::StoreDataPropertyInLiteral(
     const FeedbackSource& feedback) {
   FeedbackParameter parameters(feedback);
@@ -972,13 +1029,15 @@ const Operator* JSOperatorBuilder::Construct(uint32_t arity,
 }
 
 const Operator* JSOperatorBuilder::ConstructWithArrayLike(
-    CallFrequency const& frequency) {
-  return new (zone()) Operator1<CallFrequency>(  // --
-      IrOpcode::kJSConstructWithArrayLike,       // opcode
-      Operator::kNoProperties,                   // properties
-      "JSConstructWithArrayLike",                // name
-      3, 1, 1, 1, 1, 2,                          // counts
-      frequency);                                // parameter
+    CallFrequency const& frequency, FeedbackSource const& feedback) {
+  static constexpr uint32_t arity = 3;
+  ConstructParameters parameters(arity, frequency, feedback);
+  return new (zone()) Operator1<ConstructParameters>(  // --
+      IrOpcode::kJSConstructWithArrayLike,             // opcode
+      Operator::kNoProperties,                         // properties
+      "JSConstructWithArrayLike",                      // name
+      parameters.arity(), 1, 1, 1, 1, 2,               // counts
+      parameters);                                     // parameter
 }
 
 const Operator* JSOperatorBuilder::ConstructWithSpread(
@@ -1420,9 +1479,11 @@ Handle<ScopeInfo> ScopeInfoOf(const Operator* op) {
   return OpParameter<Handle<ScopeInfo>>(op);
 }
 
+#undef UNARY_OP_LIST
 #undef BINARY_OP_LIST
 #undef CACHED_OP_LIST
 #undef COMPARE_OP_LIST
+#undef COMPARE_EQUAL_OP_LIST
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/src/compiler/js-operator.h b/deps/v8/src/compiler/js-operator.h
index 1f9230d22b6..8f9b523f5a7 100644
--- a/deps/v8/src/compiler/js-operator.h
+++ b/deps/v8/src/compiler/js-operator.h
@@ -60,8 +60,6 @@ class CallFrequency final {
 
 std::ostream& operator<<(std::ostream&, CallFrequency const&);
 
-CallFrequency CallFrequencyOf(Operator const* op) V8_WARN_UNUSED_RESULT;
-
 // Defines the flags for a JavaScript call forwarding parameters. This
 // is used as parameter by JSConstructForwardVarargs operators.
 class ConstructForwardVarargsParameters final {
@@ -97,15 +95,32 @@ std::ostream& operator<<(std::ostream&,
 ConstructForwardVarargsParameters const& ConstructForwardVarargsParametersOf(
     Operator const*) V8_WARN_UNUSED_RESULT;
 
-// Defines the arity and the feedback for a JavaScript constructor call. This is
-// used as a parameter by JSConstruct and JSConstructWithSpread operators.
+// Part of ConstructParameters::arity.
+static constexpr int kTargetAndNewTarget = 2;
+
+// Defines the arity (parameters plus the target and new target) and the
+// feedback for a JavaScript constructor call. This is used as a parameter by
+// JSConstruct, JSConstructWithArrayLike, and JSConstructWithSpread operators.
 class ConstructParameters final {
  public:
   ConstructParameters(uint32_t arity, CallFrequency const& frequency,
                       FeedbackSource const& feedback)
-      : arity_(arity), frequency_(frequency), feedback_(feedback) {}
+      : arity_(arity), frequency_(frequency), feedback_(feedback) {
+    DCHECK_GE(arity, kTargetAndNewTarget);
+    DCHECK(is_int32(arity));
+  }
 
+  // TODO(jgruber): Consider removing `arity()` and just storing the arity
+  // without extra args in ConstructParameters. Every spot that creates
+  // ConstructParameters artifically adds the extra args. Every spot that uses
+  // ConstructParameters artificially subtracts the extra args.
+  // We keep them for now for consistency with other spots
+  // that expect `arity()` to include extra args.
   uint32_t arity() const { return arity_; }
+  int arity_without_implicit_args() const {
+    return static_cast<int>(arity_ - kTargetAndNewTarget);
+  }
+
   CallFrequency const& frequency() const { return frequency_; }
   FeedbackSource const& feedback() const { return feedback_; }
 
@@ -158,8 +173,12 @@ std::ostream& operator<<(std::ostream&, CallForwardVarargsParameters const&);
 CallForwardVarargsParameters const& CallForwardVarargsParametersOf(
     Operator const*) V8_WARN_UNUSED_RESULT;
 
-// Defines the arity and the call flags for a JavaScript function call. This is
-// used as a parameter by JSCall and JSCallWithSpread operators.
+// Part of CallParameters::arity.
+static constexpr int kTargetAndReceiver = 2;
+
+// Defines the arity (parameters plus the target and receiver) and the call
+// flags for a JavaScript function call. This is used as a parameter by JSCall,
+// JSCallWithArrayLike and JSCallWithSpread operators.
 class CallParameters final {
  public:
   CallParameters(size_t arity, CallFrequency const& frequency,
@@ -178,9 +197,17 @@ class CallParameters final {
                    feedback.IsValid());
     DCHECK_IMPLIES(!feedback.IsValid(),
                    feedback_relation == CallFeedbackRelation::kUnrelated);
+    DCHECK_GE(arity, kTargetAndReceiver);
+    DCHECK(is_int32(arity));
   }
 
+  // TODO(jgruber): Consider removing `arity()` and just storing the arity
+  // without extra args in CallParameters.
   size_t arity() const { return ArityField::decode(bit_field_); }
+  int arity_without_implicit_args() const {
+    return static_cast<int>(arity() - kTargetAndReceiver);
+  }
+
   CallFrequency const& frequency() const { return frequency_; }
   ConvertReceiverMode convert_mode() const {
     return ConvertReceiverModeField::decode(bit_field_);
@@ -772,10 +799,10 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
   const Operator* Modulus();
   const Operator* Exponentiate();
 
-  const Operator* BitwiseNot();
-  const Operator* Decrement();
-  const Operator* Increment();
-  const Operator* Negate();
+  const Operator* BitwiseNot(FeedbackSource const& feedback);
+  const Operator* Decrement(FeedbackSource const& feedback);
+  const Operator* Increment(FeedbackSource const& feedback);
+  const Operator* Negate(FeedbackSource const& feedback);
 
   const Operator* ToLength();
   const Operator* ToName();
@@ -849,7 +876,8 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
   const Operator* Construct(uint32_t arity,
                             CallFrequency const& frequency = CallFrequency(),
                             FeedbackSource const& feedback = FeedbackSource());
-  const Operator* ConstructWithArrayLike(CallFrequency const& frequency);
+  const Operator* ConstructWithArrayLike(CallFrequency const& frequency,
+                                         FeedbackSource const& feedback);
   const Operator* ConstructWithSpread(
       uint32_t arity, CallFrequency const& frequency = CallFrequency(),
       FeedbackSource const& feedback = FeedbackSource());
diff --git a/deps/v8/src/compiler/js-type-hint-lowering.cc b/deps/v8/src/compiler/js-type-hint-lowering.cc
index 5be5f2148aa..4875a17cb51 100644
--- a/deps/v8/src/compiler/js-type-hint-lowering.cc
+++ b/deps/v8/src/compiler/js-type-hint-lowering.cc
@@ -97,6 +97,9 @@ class JSSpeculativeBinopBuilder final {
       case CompareOperationHint::kNumber:
         *hint = NumberOperationHint::kNumber;
         return true;
+      case CompareOperationHint::kNumberOrBoolean:
+        *hint = NumberOperationHint::kNumberOrBoolean;
+        return true;
       case CompareOperationHint::kNumberOrOddball:
         *hint = NumberOperationHint::kNumberOrOddball;
         return true;
@@ -568,6 +571,13 @@ Node* JSTypeHintLowering::TryBuildSoftDeopt(FeedbackSlot slot, Node* effect,
   if (!(flags() & kBailoutOnUninitialized)) return nullptr;
 
   FeedbackSource source(feedback_vector(), slot);
+  // TODO(mythria): Think of adding flags to specify if we need a soft deopt for
+  // calls instead of using FLAG_turboprop here.
+  if (FLAG_turboprop &&
+      broker()->GetFeedbackSlotKind(source) == FeedbackSlotKind::kCall) {
+    return nullptr;
+  }
+
   if (!broker()->FeedbackIsInsufficient(source)) return nullptr;
 
   Node* deoptimize = jsgraph()->graph()->NewNode(
diff --git a/deps/v8/src/compiler/js-typed-lowering.cc b/deps/v8/src/compiler/js-typed-lowering.cc
index 47f931317e7..db05ef01397 100644
--- a/deps/v8/src/compiler/js-typed-lowering.cc
+++ b/deps/v8/src/compiler/js-typed-lowering.cc
@@ -9,6 +9,7 @@
 #include "src/codegen/code-factory.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/allocation-builder.h"
+#include "src/compiler/graph-assembler.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-heap-broker.h"
 #include "src/compiler/linkage.h"
@@ -44,6 +45,9 @@ class JSBinopReduction final {
       case CompareOperationHint::kNumber:
         *hint = NumberOperationHint::kNumber;
         return true;
+      case CompareOperationHint::kNumberOrBoolean:
+        *hint = NumberOperationHint::kNumberOrBoolean;
+        return true;
       case CompareOperationHint::kNumberOrOddball:
         *hint = NumberOperationHint::kNumberOrOddball;
         return true;
@@ -540,16 +544,14 @@ Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
       NodeProperties::ChangeOp(node, javascript()->ToString());
       NodeProperties::SetType(
           node, Type::Intersect(r.type(), Type::String(), graph()->zone()));
-      Reduction const reduction = ReduceJSToString(node);
-      return reduction.Changed() ? reduction : Changed(node);
+      return Changed(node).FollowedBy(ReduceJSToString(node));
     } else if (r.RightInputIs(empty_string_type_)) {
       // JSAdd(x:primitive, "") => JSToString(x)
       NodeProperties::ReplaceValueInputs(node, r.left());
       NodeProperties::ChangeOp(node, javascript()->ToString());
       NodeProperties::SetType(
           node, Type::Intersect(r.type(), Type::String(), graph()->zone()));
-      Reduction const reduction = ReduceJSToString(node);
-      return reduction.Changed() ? reduction : Changed(node);
+      return Changed(node).FollowedBy(ReduceJSToString(node));
     }
   }
 
@@ -780,9 +782,9 @@ Reduction JSTypedLowering::ReduceJSEqual(Node* node) {
   if (r.BothInputsAre(Type::Receiver())) {
     return r.ChangeToPureOperator(simplified()->ReferenceEqual());
   }
-  if (r.OneInputIs(Type::Undetectable())) {
+  if (r.OneInputIs(Type::NullOrUndefined())) {
     RelaxEffectsAndControls(node);
-    node->RemoveInput(r.LeftInputIs(Type::Undetectable()) ? 0 : 1);
+    node->RemoveInput(r.LeftInputIs(Type::NullOrUndefined()) ? 0 : 1);
     node->TrimInputCount(1);
     NodeProperties::ChangeOp(node, simplified()->ObjectIsUndetectable());
     return Changed(node);
@@ -810,32 +812,40 @@ Reduction JSTypedLowering::ReduceJSEqual(Node* node) {
     // Known that both sides are Receiver, Null or Undefined, the
     // abstract equality operation can be performed like this:
     //
-    //   if ObjectIsUndetectable(left)
-    //     then ObjectIsUndetectable(right)
-    //     else ReferenceEqual(left, right)
-    //
-    Node* left = r.left();
-    Node* right = r.right();
-    Node* effect = r.effect();
-    Node* control = r.control();
-
-    Node* check = graph()->NewNode(simplified()->ObjectIsUndetectable(), left);
-    Node* branch =
-        graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-
-    Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-    Node* vtrue = graph()->NewNode(simplified()->ObjectIsUndetectable(), right);
-
-    Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-    Node* vfalse =
-        graph()->NewNode(simplified()->ReferenceEqual(), left, right);
-
-    control = graph()->NewNode(common()->Merge(2), if_true, if_false);
-    Node* value =
-        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                         vtrue, vfalse, control);
-    ReplaceWithValue(node, value, effect, control);
+    // if left == undefined || left == null
+    //    then ObjectIsUndetectable(right)
+    // else if right == undefined || right == null
+    //    then ObjectIsUndetectable(left)
+    // else ReferenceEqual(left, right)
+#define __ gasm.
+    JSGraphAssembler gasm(jsgraph(), jsgraph()->zone());
+    gasm.InitializeEffectControl(r.effect(), r.control());
+
+    auto lhs = TNode<Object>::UncheckedCast(r.left());
+    auto rhs = TNode<Object>::UncheckedCast(r.right());
+
+    auto done = __ MakeLabel(MachineRepresentation::kTagged);
+    auto check_undetectable = __ MakeLabel(MachineRepresentation::kTagged);
+
+    __ GotoIf(__ ReferenceEqual(lhs, __ UndefinedConstant()),
+              &check_undetectable, rhs);
+    __ GotoIf(__ ReferenceEqual(lhs, __ NullConstant()), &check_undetectable,
+              rhs);
+    __ GotoIf(__ ReferenceEqual(rhs, __ UndefinedConstant()),
+              &check_undetectable, lhs);
+    __ GotoIf(__ ReferenceEqual(rhs, __ NullConstant()), &check_undetectable,
+              lhs);
+    __ Goto(&done, __ ReferenceEqual(lhs, rhs));
+
+    __ Bind(&check_undetectable);
+    __ Goto(&done,
+            __ ObjectIsUndetectable(check_undetectable.PhiAt<Object>(0)));
+
+    __ Bind(&done);
+    Node* value = done.PhiAt(0);
+    ReplaceWithValue(node, value, gasm.effect(), gasm.control());
     return Replace(value);
+#undef __
   } else if (r.IsStringCompareOperation()) {
     r.CheckInputsToString();
     return r.ChangeToPureOperator(simplified()->StringEqual());
@@ -880,7 +890,14 @@ Reduction JSTypedLowering::ReduceJSStrictEqual(Node* node) {
   if (r.BothInputsAre(Type::Signed32()) ||
       r.BothInputsAre(Type::Unsigned32())) {
     return r.ChangeToPureOperator(simplified()->NumberEqual());
-  } else if (r.GetCompareNumberOperationHint(&hint)) {
+  } else if (r.GetCompareNumberOperationHint(&hint) &&
+             hint != NumberOperationHint::kNumberOrOddball &&
+             hint != NumberOperationHint::kNumberOrBoolean) {
+    // SpeculativeNumberEqual performs implicit conversion of oddballs to
+    // numbers, so me must not generate it for strict equality with respective
+    // hint.
+    DCHECK(hint == NumberOperationHint::kNumber ||
+           hint == NumberOperationHint::kSignedSmall);
     return r.ChangeToSpeculativeOperator(
         simplified()->SpeculativeNumberEqual(hint), Type::Boolean());
   } else if (r.BothInputsAre(Type::Number())) {
@@ -1009,8 +1026,7 @@ Reduction JSTypedLowering::ReduceJSToNumeric(Node* node) {
   if (input_type.Is(Type::NonBigIntPrimitive())) {
     // ToNumeric(x:primitive\bigint) => ToNumber(x)
     NodeProperties::ChangeOp(node, javascript()->ToNumber());
-    Reduction const reduction = ReduceJSToNumber(node);
-    return reduction.Changed() ? reduction : Changed(node);
+    return Changed(node).FollowedBy(ReduceJSToNumber(node));
   }
   return NoChange();
 }
@@ -1571,8 +1587,7 @@ Reduction JSTypedLowering::ReduceJSConstructForwardVarargs(Node* node) {
 Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
   DCHECK_EQ(IrOpcode::kJSConstruct, node->opcode());
   ConstructParameters const& p = ConstructParametersOf(node->op());
-  DCHECK_LE(2u, p.arity());
-  int const arity = static_cast<int>(p.arity() - 2);
+  int const arity = p.arity_without_implicit_args();
   Node* target = NodeProperties::GetValueInput(node, 0);
   Type target_type = NodeProperties::GetType(target);
   Node* new_target = NodeProperties::GetValueInput(node, arity + 1);
@@ -1643,7 +1658,7 @@ Reduction JSTypedLowering::ReduceJSCallForwardVarargs(Node* node) {
 Reduction JSTypedLowering::ReduceJSCall(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  int arity = static_cast<int>(p.arity() - 2);
+  int arity = p.arity_without_implicit_args();
   ConvertReceiverMode convert_mode = p.convert_mode();
   Node* target = NodeProperties::GetValueInput(node, 0);
   Type target_type = NodeProperties::GetType(target);
diff --git a/deps/v8/src/compiler/linkage.cc b/deps/v8/src/compiler/linkage.cc
index e97ee820f3c..8933fb06e14 100644
--- a/deps/v8/src/compiler/linkage.cc
+++ b/deps/v8/src/compiler/linkage.cc
@@ -21,6 +21,10 @@ inline LinkageLocation regloc(Register reg, MachineType type) {
   return LinkageLocation::ForRegister(reg.code(), type);
 }
 
+inline LinkageLocation regloc(DoubleRegister reg, MachineType type) {
+  return LinkageLocation::ForRegister(reg.code(), type);
+}
+
 }  // namespace
 
 
@@ -149,7 +153,7 @@ int CallDescriptor::CalculateFixedFrameSize(Code::Kind code_kind) const {
       return TypedFrameConstants::kFixedSlotCount;
     case kCallWasmFunction:
     case kCallWasmImportWrapper:
-      return WasmCompiledFrameConstants::kFixedSlotCount;
+      return WasmFrameConstants::kFixedSlotCount;
     case kCallWasmCapiFunction:
       return WasmExitFrameConstants::kFixedSlotCount;
   }
@@ -321,7 +325,11 @@ CallDescriptor* Linkage::GetJSCallDescriptor(Zone* zone, bool is_osr,
 
   // All parameters to JS calls go on the stack.
   for (int i = 0; i < js_parameter_count; i++) {
+#ifdef V8_REVERSE_JSARGS
+    int spill_slot_index = -i - 1;
+#else
     int spill_slot_index = i - js_parameter_count;
+#endif
     locations.AddParam(LinkageLocation::ForCallerFrameSlot(
         spill_slot_index, MachineType::AnyTagged()));
   }
@@ -354,7 +362,8 @@ CallDescriptor* Linkage::GetJSCallDescriptor(Zone* zone, bool is_osr,
       kNoCalleeSaved,                   // callee-saved
       kNoCalleeSaved,                   // callee-saved fp
       flags,                            // flags
-      "js-call");
+      "js-call",                        // debug name
+      StackArgumentOrder::kJS);         // stack order
 }
 
 // TODO(turbofan): cache call descriptors for code stub calls.
@@ -380,20 +389,33 @@ CallDescriptor* Linkage::GetStubCallDescriptor(
   LocationSignature::Builder locations(zone, return_count, parameter_count);
 
   // Add returns.
-  if (locations.return_count_ > 0) {
-    locations.AddReturn(regloc(kReturnRegister0, descriptor.GetReturnType(0)));
-  }
-  if (locations.return_count_ > 1) {
-    locations.AddReturn(regloc(kReturnRegister1, descriptor.GetReturnType(1)));
-  }
-  if (locations.return_count_ > 2) {
-    locations.AddReturn(regloc(kReturnRegister2, descriptor.GetReturnType(2)));
+  static constexpr Register return_registers[] = {
+      kReturnRegister0, kReturnRegister1, kReturnRegister2};
+  size_t num_returns = 0;
+  size_t num_fp_returns = 0;
+  for (size_t i = 0; i < locations.return_count_; i++) {
+    MachineType type = descriptor.GetReturnType(static_cast<int>(i));
+    if (IsFloatingPoint(type.representation())) {
+      DCHECK_LT(num_fp_returns, 1);  // Only 1 FP return is supported.
+      locations.AddReturn(regloc(kFPReturnRegister0, type));
+      num_fp_returns++;
+    } else {
+      DCHECK_LT(num_returns, arraysize(return_registers));
+      locations.AddReturn(regloc(return_registers[num_returns], type));
+      num_returns++;
+    }
   }
 
   // Add parameters in registers and on the stack.
   for (int i = 0; i < js_parameter_count; i++) {
     if (i < register_parameter_count) {
       // The first parameters go in registers.
+      // TODO(bbudge) Add floating point registers to the InterfaceDescriptor
+      // and use them for FP types. Currently, this works because on most
+      // platforms, all FP registers are available for use. On ia32, xmm0 is
+      // not allocatable and so we must work around that with platform-specific
+      // descriptors, adjusting the GP register set to avoid eax, which has
+      // register code 0.
       Register reg = descriptor.GetRegisterParameter(i);
       MachineType type = descriptor.GetParameterType(i);
       locations.AddParam(regloc(reg, type));
@@ -441,6 +463,7 @@ CallDescriptor* Linkage::GetStubCallDescriptor(
       kNoCalleeSaved,                        // callee-saved fp
       CallDescriptor::kCanUseRoots | flags,  // flags
       descriptor.DebugName(),                // debug name
+      descriptor.GetStackArgumentOrder(),    // stack order
       descriptor.allocatable_registers());
 }
 
diff --git a/deps/v8/src/compiler/linkage.h b/deps/v8/src/compiler/linkage.h
index b55f3cdcb7c..777364c26d7 100644
--- a/deps/v8/src/compiler/linkage.h
+++ b/deps/v8/src/compiler/linkage.h
@@ -237,6 +237,7 @@ class V8_EXPORT_PRIVATE CallDescriptor final
                  RegList callee_saved_registers,
                  RegList callee_saved_fp_registers, Flags flags,
                  const char* debug_name = "",
+                 StackArgumentOrder stack_order = StackArgumentOrder::kDefault,
                  const RegList allocatable_registers = 0,
                  size_t stack_return_count = 0)
       : kind_(kind),
@@ -250,6 +251,7 @@ class V8_EXPORT_PRIVATE CallDescriptor final
         callee_saved_fp_registers_(callee_saved_fp_registers),
         allocatable_registers_(allocatable_registers),
         flags_(flags),
+        stack_order_(stack_order),
         debug_name_(debug_name) {}
 
   // Returns the kind of this call.
@@ -292,6 +294,19 @@ class V8_EXPORT_PRIVATE CallDescriptor final
     return stack_param_count_;
   }
 
+  int GetStackIndexFromSlot(int slot_index) const {
+#ifdef V8_REVERSE_JSARGS
+    switch (GetStackArgumentOrder()) {
+      case StackArgumentOrder::kDefault:
+        return -slot_index - 1;
+      case StackArgumentOrder::kJS:
+        return slot_index + static_cast<int>(StackParameterCount());
+    }
+#else
+    return -slot_index - 1;
+#endif
+  }
+
   // The total number of inputs to this call, which includes the target,
   // receiver, context, etc.
   // TODO(titzer): this should input the framestate input too.
@@ -338,6 +353,8 @@ class V8_EXPORT_PRIVATE CallDescriptor final
     return location_sig_->GetParam(index).GetType();
   }
 
+  StackArgumentOrder GetStackArgumentOrder() const { return stack_order_; }
+
   // Operator properties describe how this call can be optimized, if at all.
   Operator::Properties properties() const { return properties_; }
 
@@ -391,6 +408,7 @@ class V8_EXPORT_PRIVATE CallDescriptor final
   // register allocator to use.
   const RegList allocatable_registers_;
   const Flags flags_;
+  const StackArgumentOrder stack_order_;
   const char* const debug_name_;
   const CFunctionInfo* c_function_info_ = nullptr;
 
diff --git a/deps/v8/src/compiler/machine-graph.cc b/deps/v8/src/compiler/machine-graph.cc
index 0a00392f4b2..34464cfb052 100644
--- a/deps/v8/src/compiler/machine-graph.cc
+++ b/deps/v8/src/compiler/machine-graph.cc
@@ -32,6 +32,11 @@ Node* MachineGraph::IntPtrConstant(intptr_t value) {
                            : Int64Constant(static_cast<int64_t>(value));
 }
 
+Node* MachineGraph::UintPtrConstant(uintptr_t value) {
+  return machine()->Is32() ? Uint32Constant(static_cast<uint32_t>(value))
+                           : Uint64Constant(static_cast<uint64_t>(value));
+}
+
 Node* MachineGraph::TaggedIndexConstant(intptr_t value) {
   int32_t value32 = static_cast<int32_t>(value);
   Node** loc = cache_.FindTaggedIndexConstant(value32);
diff --git a/deps/v8/src/compiler/machine-graph.h b/deps/v8/src/compiler/machine-graph.h
index 9eb5998dfc7..87175847f54 100644
--- a/deps/v8/src/compiler/machine-graph.h
+++ b/deps/v8/src/compiler/machine-graph.h
@@ -43,6 +43,7 @@ class V8_EXPORT_PRIVATE MachineGraph : public NON_EXPORTED_BASE(ZoneObject) {
   // TODO(turbofan): Code using Int32Constant/Int64Constant to store pointer
   // constants is probably not serializable.
   Node* IntPtrConstant(intptr_t value);
+  Node* UintPtrConstant(uintptr_t value);
 
   Node* TaggedIndexConstant(intptr_t value);
 
diff --git a/deps/v8/src/compiler/machine-operator-reducer.cc b/deps/v8/src/compiler/machine-operator-reducer.cc
index 95270748256..127c7681099 100644
--- a/deps/v8/src/compiler/machine-operator-reducer.cc
+++ b/deps/v8/src/compiler/machine-operator-reducer.cc
@@ -4,6 +4,7 @@
 
 #include "src/compiler/machine-operator-reducer.h"
 #include <cmath>
+#include <limits>
 
 #include "src/base/bits.h"
 #include "src/base/division-by-constant.h"
@@ -14,6 +15,7 @@
 #include "src/compiler/machine-graph.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
+#include "src/compiler/opcodes.h"
 #include "src/numbers/conversions-inl.h"
 
 namespace v8 {
@@ -43,6 +45,14 @@ class Word32Adapter {
     return x.IsWord32Shl();
   }
   template <typename T>
+  static bool IsWordNShr(const T& x) {
+    return x.IsWord32Shr();
+  }
+  template <typename T>
+  static bool IsWordNSar(const T& x) {
+    return x.IsWord32Sar();
+  }
+  template <typename T>
   static bool IsWordNXor(const T& x) {
     return x.IsWord32Xor();
   }
@@ -65,6 +75,7 @@ class Word32Adapter {
   Reduction TryMatchWordNRor(Node* node) { return r_->TryMatchWord32Ror(node); }
 
   Node* IntNConstant(int32_t value) { return r_->Int32Constant(value); }
+  Node* UintNConstant(uint32_t value) { return r_->Uint32Constant(value); }
   Node* WordNAnd(Node* lhs, Node* rhs) { return r_->Word32And(lhs, rhs); }
 
  private:
@@ -94,6 +105,14 @@ class Word64Adapter {
     return x.IsWord64Shl();
   }
   template <typename T>
+  static bool IsWordNShr(const T& x) {
+    return x.IsWord64Shr();
+  }
+  template <typename T>
+  static bool IsWordNSar(const T& x) {
+    return x.IsWord64Sar();
+  }
+  template <typename T>
   static bool IsWordNXor(const T& x) {
     return x.IsWord64Xor();
   }
@@ -119,6 +138,7 @@ class Word64Adapter {
   }
 
   Node* IntNConstant(int64_t value) { return r_->Int64Constant(value); }
+  Node* UintNConstant(uint64_t value) { return r_->Uint64Constant(value); }
   Node* WordNAnd(Node* lhs, Node* rhs) { return r_->Word64And(lhs, rhs); }
 
  private:
@@ -246,6 +266,12 @@ Node* MachineOperatorReducer::Uint32Div(Node* dividend, uint32_t divisor) {
   return quotient;
 }
 
+Node* MachineOperatorReducer::TruncateInt64ToInt32(Node* value) {
+  Node* const node = graph()->NewNode(machine()->TruncateInt64ToInt32(), value);
+  Reduction const reduction = ReduceTruncateInt64ToInt32(node);
+  return reduction.Changed() ? reduction.replacement() : node;
+}
+
 // Perform constant folding and strength reduction on machine operators.
 Reduction MachineOperatorReducer::Reduce(Node* node) {
   switch (node->opcode()) {
@@ -285,40 +311,7 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
       break;
     }
     case IrOpcode::kWord32Equal: {
-      Int32BinopMatcher m(node);
-      if (m.IsFoldable()) {  // K == K => K
-        return ReplaceBool(m.left().Value() == m.right().Value());
-      }
-      if (m.left().IsInt32Sub() && m.right().Is(0)) {  // x - y == 0 => x == y
-        Int32BinopMatcher msub(m.left().node());
-        node->ReplaceInput(0, msub.left().node());
-        node->ReplaceInput(1, msub.right().node());
-        return Changed(node);
-      }
-      // TODO(turbofan): fold HeapConstant, ExternalReference, pointer compares
-      if (m.LeftEqualsRight()) return ReplaceBool(true);  // x == x => true
-      if (m.left().IsWord32And() && m.right().HasValue()) {
-        Uint32BinopMatcher mand(m.left().node());
-        if ((mand.left().IsWord32Shr() || mand.left().IsWord32Sar()) &&
-            mand.right().HasValue()) {
-          Uint32BinopMatcher mshift(mand.left().node());
-          // ((x >> K1) & K2) == K3 => (x & (K2 << K1)) == (K3 << K1)
-          if (mshift.right().HasValue()) {
-            auto shift_bits = mshift.right().Value();
-            auto mask = mand.right().Value();
-            auto rhs = static_cast<uint32_t>(m.right().Value());
-            // Make sure that we won't shift data off the end.
-            if (shift_bits <= base::bits::CountLeadingZeros(mask) &&
-                shift_bits <= base::bits::CountLeadingZeros(rhs)) {
-              node->ReplaceInput(
-                  0, Word32And(mshift.left().node(), mask << shift_bits));
-              node->ReplaceInput(1, Int32Constant(rhs << shift_bits));
-              return Changed(node);
-            }
-          }
-        }
-      }
-      break;
+      return ReduceWord32Equal(node);
     }
     case IrOpcode::kWord64Equal: {
       Int64BinopMatcher m(node);
@@ -361,8 +354,7 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
         node->ReplaceInput(
             1, Int32Constant(base::bits::WhichPowerOfTwo(m.right().Value())));
         NodeProperties::ChangeOp(node, machine()->Word32Shl());
-        Reduction reduction = ReduceWord32Shl(node);
-        return reduction.Changed() ? reduction : Changed(node);
+        return Changed(node).FollowedBy(ReduceWord32Shl(node));
       }
       break;
     }
@@ -405,7 +397,7 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
           return ReplaceBool(true);
         }
       }
-      break;
+      return ReduceWord32Comparisons(node);
     }
     case IrOpcode::kInt32LessThanOrEqual: {
       Int32BinopMatcher m(node);
@@ -413,7 +405,7 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
         return ReplaceBool(m.left().Value() <= m.right().Value());
       }
       if (m.LeftEqualsRight()) return ReplaceBool(true);  // x <= x => true
-      break;
+      return ReduceWord32Comparisons(node);
     }
     case IrOpcode::kUint32LessThan: {
       Uint32BinopMatcher m(node);
@@ -438,7 +430,7 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
           // TODO(turbofan): else the comparison is always true.
         }
       }
-      break;
+      return ReduceWord32Comparisons(node);
     }
     case IrOpcode::kUint32LessThanOrEqual: {
       Uint32BinopMatcher m(node);
@@ -448,7 +440,7 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
         return ReplaceBool(m.left().Value() <= m.right().Value());
       }
       if (m.LeftEqualsRight()) return ReplaceBool(true);  // x <= x => true
-      break;
+      return ReduceWord32Comparisons(node);
     }
     case IrOpcode::kFloat32Sub: {
       Float32BinopMatcher m(node);
@@ -804,12 +796,8 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
       if (m.IsChangeInt32ToFloat64()) return Replace(m.node()->InputAt(0));
       return NoChange();
     }
-    case IrOpcode::kTruncateInt64ToInt32: {
-      Int64Matcher m(node->InputAt(0));
-      if (m.HasValue()) return ReplaceInt32(static_cast<int32_t>(m.Value()));
-      if (m.IsChangeInt32ToInt64()) return Replace(m.node()->InputAt(0));
-      break;
-    }
+    case IrOpcode::kTruncateInt64ToInt32:
+      return ReduceTruncateInt64ToInt32(node);
     case IrOpcode::kTruncateFloat64ToFloat32: {
       Float64Matcher m(node->InputAt(0));
       if (m.HasValue()) {
@@ -859,12 +847,24 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
     case IrOpcode::kTrapIf:
     case IrOpcode::kTrapUnless:
       return ReduceConditional(node);
+    case IrOpcode::kInt64LessThan:
+    case IrOpcode::kInt64LessThanOrEqual:
+    case IrOpcode::kUint64LessThan:
+    case IrOpcode::kUint64LessThanOrEqual:
+      return ReduceWord64Comparisons(node);
     default:
       break;
   }
   return NoChange();
 }
 
+Reduction MachineOperatorReducer::ReduceTruncateInt64ToInt32(Node* node) {
+  Int64Matcher m(node->InputAt(0));
+  if (m.HasValue()) return ReplaceInt32(static_cast<int32_t>(m.Value()));
+  if (m.IsChangeInt32ToInt64()) return Replace(m.node()->InputAt(0));
+  return NoChange();
+}
+
 Reduction MachineOperatorReducer::ReduceInt32Add(Node* node) {
   DCHECK_EQ(IrOpcode::kInt32Add, node->opcode());
   Int32BinopMatcher m(node);
@@ -879,8 +879,7 @@ Reduction MachineOperatorReducer::ReduceInt32Add(Node* node) {
       node->ReplaceInput(0, m.right().node());
       node->ReplaceInput(1, mleft.right().node());
       NodeProperties::ChangeOp(node, machine()->Int32Sub());
-      Reduction const reduction = ReduceInt32Sub(node);
-      return reduction.Changed() ? reduction : Changed(node);
+      return Changed(node).FollowedBy(ReduceInt32Sub(node));
     }
   }
   if (m.right().IsInt32Sub()) {
@@ -888,8 +887,7 @@ Reduction MachineOperatorReducer::ReduceInt32Add(Node* node) {
     if (mright.left().Is(0)) {  // y + (0 - x) => y - x
       node->ReplaceInput(1, mright.right().node());
       NodeProperties::ChangeOp(node, machine()->Int32Sub());
-      Reduction const reduction = ReduceInt32Sub(node);
-      return reduction.Changed() ? reduction : Changed(node);
+      return Changed(node).FollowedBy(ReduceInt32Sub(node));
     }
   }
   // (x + Int32Constant(a)) + Int32Constant(b)) => x + Int32Constant(a + b)
@@ -940,8 +938,7 @@ Reduction MachineOperatorReducer::ReduceInt32Sub(Node* node) {
     node->ReplaceInput(
         1, Int32Constant(base::NegateWithWraparound(m.right().Value())));
     NodeProperties::ChangeOp(node, machine()->Int32Add());
-    Reduction const reduction = ReduceInt32Add(node);
-    return reduction.Changed() ? reduction : Changed(node);
+    return Changed(node).FollowedBy(ReduceInt32Add(node));
   }
   return NoChange();
 }
@@ -959,8 +956,7 @@ Reduction MachineOperatorReducer::ReduceInt64Sub(Node* node) {
     node->ReplaceInput(
         1, Int64Constant(base::NegateWithWraparound(m.right().Value())));
     NodeProperties::ChangeOp(node, machine()->Int64Add());
-    Reduction const reduction = ReduceInt64Add(node);
-    return reduction.Changed() ? reduction : Changed(node);
+    return Changed(node).FollowedBy(ReduceInt64Add(node));
   }
   return NoChange();
 }
@@ -984,8 +980,7 @@ Reduction MachineOperatorReducer::ReduceInt64Mul(Node* node) {
     node->ReplaceInput(
         1, Int64Constant(base::bits::WhichPowerOfTwo(m.right().Value())));
     NodeProperties::ChangeOp(node, machine()->Word64Shl());
-    Reduction reduction = ReduceWord64Shl(node);
-    return reduction.Changed() ? reduction : Changed(node);
+    return Changed(node).FollowedBy(ReduceWord64Shl(node));
   }
   return NoChange();
 }
@@ -1231,6 +1226,78 @@ Reduction MachineOperatorReducer::ReduceProjection(size_t index, Node* node) {
   return NoChange();
 }
 
+Reduction MachineOperatorReducer::ReduceWord32Comparisons(Node* node) {
+  DCHECK(node->opcode() == IrOpcode::kInt32LessThan ||
+         node->opcode() == IrOpcode::kInt32LessThanOrEqual ||
+         node->opcode() == IrOpcode::kUint32LessThan ||
+         node->opcode() == IrOpcode::kUint32LessThanOrEqual);
+  Int32BinopMatcher m(node);
+  // (x >>> K) < (y >>> K) => x < y   if only zeros shifted out
+  if (m.left().op() == machine()->Word32SarShiftOutZeros() &&
+      m.right().op() == machine()->Word32SarShiftOutZeros()) {
+    Int32BinopMatcher mleft(m.left().node());
+    Int32BinopMatcher mright(m.right().node());
+    if (mleft.right().HasValue() && mright.right().Is(mleft.right().Value())) {
+      node->ReplaceInput(0, mleft.left().node());
+      node->ReplaceInput(1, mright.left().node());
+      return Changed(node);
+    }
+  }
+  return NoChange();
+}
+
+const Operator* MachineOperatorReducer::Map64To32Comparison(
+    const Operator* op, bool sign_extended) {
+  switch (op->opcode()) {
+    case IrOpcode::kInt64LessThan:
+      return sign_extended ? machine()->Int32LessThan()
+                           : machine()->Uint32LessThan();
+    case IrOpcode::kInt64LessThanOrEqual:
+      return sign_extended ? machine()->Int32LessThanOrEqual()
+                           : machine()->Uint32LessThanOrEqual();
+    case IrOpcode::kUint64LessThan:
+      return machine()->Uint32LessThan();
+    case IrOpcode::kUint64LessThanOrEqual:
+      return machine()->Uint32LessThanOrEqual();
+    default:
+      UNREACHABLE();
+  }
+}
+
+Reduction MachineOperatorReducer::ReduceWord64Comparisons(Node* node) {
+  DCHECK(node->opcode() == IrOpcode::kInt64LessThan ||
+         node->opcode() == IrOpcode::kInt64LessThanOrEqual ||
+         node->opcode() == IrOpcode::kUint64LessThan ||
+         node->opcode() == IrOpcode::kUint64LessThanOrEqual);
+  Int64BinopMatcher m(node);
+
+  bool sign_extended =
+      m.left().IsChangeInt32ToInt64() && m.right().IsChangeInt32ToInt64();
+  if (sign_extended || (m.left().IsChangeUint32ToUint64() &&
+                        m.right().IsChangeUint32ToUint64())) {
+    node->ReplaceInput(0, NodeProperties::GetValueInput(m.left().node(), 0));
+    node->ReplaceInput(1, NodeProperties::GetValueInput(m.right().node(), 0));
+    NodeProperties::ChangeOp(node,
+                             Map64To32Comparison(node->op(), sign_extended));
+    return Changed(node).FollowedBy(Reduce(node));
+  }
+
+  // (x >>> K) < (y >>> K) => x < y   if only zeros shifted out
+  // This is useful for Smi untagging, which results in such a shift.
+  if (m.left().op() == machine()->Word64SarShiftOutZeros() &&
+      m.right().op() == machine()->Word64SarShiftOutZeros()) {
+    Int64BinopMatcher mleft(m.left().node());
+    Int64BinopMatcher mright(m.right().node());
+    if (mleft.right().HasValue() && mright.right().Is(mleft.right().Value())) {
+      node->ReplaceInput(0, mleft.left().node());
+      node->ReplaceInput(1, mright.left().node());
+      return Changed(node);
+    }
+  }
+
+  return NoChange();
+}
+
 Reduction MachineOperatorReducer::ReduceWord32Shifts(Node* node) {
   DCHECK((node->opcode() == IrOpcode::kWord32Shl) ||
          (node->opcode() == IrOpcode::kWord32Shr) ||
@@ -1259,17 +1326,44 @@ Reduction MachineOperatorReducer::ReduceWord32Shl(Node* node) {
         base::ShlWithWraparound(m.left().Value(), m.right().Value()));
   }
   if (m.right().IsInRange(1, 31)) {
-    // (x >>> K) << K => x & ~(2^K - 1)
-    // (x >> K) << K => x & ~(2^K - 1)
     if (m.left().IsWord32Sar() || m.left().IsWord32Shr()) {
       Int32BinopMatcher mleft(m.left().node());
+
+      // If x >> K only shifted out zeros:
+      // (x >> K) << L => x           if K == L
+      // (x >> K) << L => x >> (K-L) if K > L
+      // (x >> K) << L => x << (L-K)  if K < L
+      // Since this is used for Smi untagging, we currently only need it for
+      // signed shifts.
+      if (mleft.op() == machine()->Word32SarShiftOutZeros() &&
+          mleft.right().IsInRange(1, 31)) {
+        Node* x = mleft.left().node();
+        int k = mleft.right().Value();
+        int l = m.right().Value();
+        if (k == l) {
+          return Replace(x);
+        } else if (k > l) {
+          node->ReplaceInput(0, x);
+          node->ReplaceInput(1, Uint32Constant(k - l));
+          NodeProperties::ChangeOp(node, machine()->Word32Sar());
+          return Changed(node).FollowedBy(ReduceWord32Sar(node));
+        } else {
+          DCHECK(k < l);
+          node->ReplaceInput(0, x);
+          node->ReplaceInput(1, Uint32Constant(l - k));
+          return Changed(node);
+        }
+      }
+
+      // (x >>> K) << K => x & ~(2^K - 1)
+      // (x >> K) << K => x & ~(2^K - 1)
       if (mleft.right().Is(m.right().Value())) {
         node->ReplaceInput(0, mleft.left().node());
         node->ReplaceInput(1,
-                           Uint32Constant(~((1U << m.right().Value()) - 1U)));
+                           Uint32Constant(std::numeric_limits<uint32_t>::max()
+                                          << m.right().Value()));
         NodeProperties::ChangeOp(node, machine()->Word32And());
-        Reduction reduction = ReduceWord32And(node);
-        return reduction.Changed() ? reduction : Changed(node);
+        return Changed(node).FollowedBy(ReduceWord32And(node));
       }
     }
   }
@@ -1284,6 +1378,46 @@ Reduction MachineOperatorReducer::ReduceWord64Shl(Node* node) {
     return ReplaceInt64(
         base::ShlWithWraparound(m.left().Value(), m.right().Value()));
   }
+  if (m.right().IsInRange(1, 63) &&
+      (m.left().IsWord64Sar() || m.left().IsWord64Shr())) {
+    Int64BinopMatcher mleft(m.left().node());
+
+    // If x >> K only shifted out zeros:
+    // (x >> K) << L => x           if K == L
+    // (x >> K) << L => x >> (K-L) if K > L
+    // (x >> K) << L => x << (L-K)  if K < L
+    // Since this is used for Smi untagging, we currently only need it for
+    // signed shifts.
+    if (mleft.op() == machine()->Word64SarShiftOutZeros() &&
+        mleft.right().IsInRange(1, 63)) {
+      Node* x = mleft.left().node();
+      int64_t k = mleft.right().Value();
+      int64_t l = m.right().Value();
+      if (k == l) {
+        return Replace(x);
+      } else if (k > l) {
+        node->ReplaceInput(0, x);
+        node->ReplaceInput(1, Uint64Constant(k - l));
+        NodeProperties::ChangeOp(node, machine()->Word64Sar());
+        return Changed(node).FollowedBy(ReduceWord64Sar(node));
+      } else {
+        DCHECK(k < l);
+        node->ReplaceInput(0, x);
+        node->ReplaceInput(1, Uint64Constant(l - k));
+        return Changed(node);
+      }
+    }
+
+    // (x >>> K) << K => x & ~(2^K - 1)
+    // (x >> K) << K => x & ~(2^K - 1)
+    if (mleft.right().Is(m.right().Value())) {
+      node->ReplaceInput(0, mleft.left().node());
+      node->ReplaceInput(1, Uint64Constant(std::numeric_limits<uint64_t>::max()
+                                           << m.right().Value()));
+      NodeProperties::ChangeOp(node, machine()->Word64And());
+      return Changed(node).FollowedBy(ReduceWord64And(node));
+    }
+  }
   return NoChange();
 }
 
@@ -1331,8 +1465,7 @@ Reduction MachineOperatorReducer::ReduceWord32Sar(Node* node) {
         node->ReplaceInput(0, Int32Constant(0));
         node->ReplaceInput(1, mleft.left().node());
         NodeProperties::ChangeOp(node, machine()->Int32Sub());
-        Reduction const reduction = ReduceInt32Sub(node);
-        return reduction.Changed() ? reduction : Changed(node);
+        return Changed(node).FollowedBy(ReduceInt32Sub(node));
       }
     } else if (mleft.left().IsLoad()) {
       LoadRepresentation const rep =
@@ -1382,8 +1515,7 @@ Reduction MachineOperatorReducer::ReduceWordNAnd(Node* node) {
       node->ReplaceInput(0, mleft.left().node());
       node->ReplaceInput(
           1, a.IntNConstant(m.right().Value() & mleft.right().Value()));
-      Reduction const reduction = a.ReduceWordNAnd(node);
-      return reduction.Changed() ? reduction : Changed(node);
+      return Changed(node).FollowedBy(a.ReduceWordNAnd(node));
     }
   }
   if (m.right().IsNegativePowerOf2()) {
@@ -1406,8 +1538,7 @@ Reduction MachineOperatorReducer::ReduceWordNAnd(Node* node) {
                            a.WordNAnd(mleft.left().node(), m.right().node()));
         node->ReplaceInput(1, mleft.right().node());
         NodeProperties::ChangeOp(node, a.IntNAdd(machine()));
-        Reduction const reduction = a.ReduceIntNAdd(node);
-        return reduction.Changed() ? reduction : Changed(node);
+        return Changed(node).FollowedBy(a.ReduceIntNAdd(node));
       }
       if (A::IsIntNMul(mleft.left())) {
         typename A::IntNBinopMatcher mleftleft(mleft.left().node());
@@ -1417,8 +1548,7 @@ Reduction MachineOperatorReducer::ReduceWordNAnd(Node* node) {
               0, a.WordNAnd(mleft.right().node(), m.right().node()));
           node->ReplaceInput(1, mleftleft.node());
           NodeProperties::ChangeOp(node, a.IntNAdd(machine()));
-          Reduction const reduction = a.ReduceIntNAdd(node);
-          return reduction.Changed() ? reduction : Changed(node);
+          return Changed(node).FollowedBy(a.ReduceIntNAdd(node));
         }
       }
       if (A::IsIntNMul(mleft.right())) {
@@ -1429,8 +1559,7 @@ Reduction MachineOperatorReducer::ReduceWordNAnd(Node* node) {
                              a.WordNAnd(mleft.left().node(), m.right().node()));
           node->ReplaceInput(1, mleftright.node());
           NodeProperties::ChangeOp(node, a.IntNAdd(machine()));
-          Reduction const reduction = a.ReduceIntNAdd(node);
-          return reduction.Changed() ? reduction : Changed(node);
+          return Changed(node).FollowedBy(a.ReduceIntNAdd(node));
         }
       }
       if (A::IsWordNShl(mleft.left())) {
@@ -1441,8 +1570,7 @@ Reduction MachineOperatorReducer::ReduceWordNAnd(Node* node) {
               0, a.WordNAnd(mleft.right().node(), m.right().node()));
           node->ReplaceInput(1, mleftleft.node());
           NodeProperties::ChangeOp(node, a.IntNAdd(machine()));
-          Reduction const reduction = a.ReduceIntNAdd(node);
-          return reduction.Changed() ? reduction : Changed(node);
+          return Changed(node).FollowedBy(a.ReduceIntNAdd(node));
         }
       }
       if (A::IsWordNShl(mleft.right())) {
@@ -1453,8 +1581,7 @@ Reduction MachineOperatorReducer::ReduceWordNAnd(Node* node) {
                              a.WordNAnd(mleft.left().node(), m.right().node()));
           node->ReplaceInput(1, mleftright.node());
           NodeProperties::ChangeOp(node, a.IntNAdd(machine()));
-          Reduction const reduction = a.ReduceIntNAdd(node);
-          return reduction.Changed() ? reduction : Changed(node);
+          return Changed(node).FollowedBy(a.ReduceIntNAdd(node));
         }
       }
     } else if (A::IsIntNMul(m.left())) {
@@ -1468,9 +1595,117 @@ Reduction MachineOperatorReducer::ReduceWordNAnd(Node* node) {
   return NoChange();
 }
 
+namespace {
+
+// Represents an operation of the form `(source & mask) == masked_value`.
+struct BitfieldCheck {
+  Node* source;
+  uint32_t mask;
+  uint32_t masked_value;
+  bool truncate_from_64_bit;
+
+  static base::Optional<BitfieldCheck> Detect(Node* node) {
+    // There are two patterns to check for here:
+    // 1. Single-bit checks: `(val >> shift) & 1`, where:
+    //    - the shift may be omitted, and/or
+    //    - the result may be truncated from 64 to 32
+    // 2. Equality checks: `(val & mask) == expected`, where:
+    //    - val may be truncated from 64 to 32 before masking (see
+    //      ReduceWord32EqualForConstantRhs)
+    if (node->opcode() == IrOpcode::kWord32Equal) {
+      Uint32BinopMatcher eq(node);
+      if (eq.left().IsWord32And()) {
+        Uint32BinopMatcher mand(eq.left().node());
+        if (mand.right().HasValue()) {
+          BitfieldCheck result{mand.left().node(), mand.right().Value(),
+                               eq.right().Value(), false};
+          if (mand.left().IsTruncateInt64ToInt32()) {
+            result.truncate_from_64_bit = true;
+            result.source =
+                NodeProperties::GetValueInput(mand.left().node(), 0);
+          }
+          return result;
+        }
+      }
+    } else {
+      if (node->opcode() == IrOpcode::kTruncateInt64ToInt32) {
+        return TryDetectShiftAndMaskOneBit<Word64Adapter>(
+            NodeProperties::GetValueInput(node, 0));
+      } else {
+        return TryDetectShiftAndMaskOneBit<Word32Adapter>(node);
+      }
+    }
+    return {};
+  }
+
+  base::Optional<BitfieldCheck> TryCombine(const BitfieldCheck& other) {
+    if (source != other.source ||
+        truncate_from_64_bit != other.truncate_from_64_bit)
+      return {};
+    uint32_t overlapping_bits = mask & other.mask;
+    // It would be kind of strange to have any overlapping bits, but they can be
+    // allowed as long as they don't require opposite values in the same
+    // positions.
+    if ((masked_value & overlapping_bits) !=
+        (other.masked_value & overlapping_bits))
+      return {};
+    return BitfieldCheck{source, mask | other.mask,
+                         masked_value | other.masked_value,
+                         truncate_from_64_bit};
+  }
+
+ private:
+  template <typename WordNAdapter>
+  static base::Optional<BitfieldCheck> TryDetectShiftAndMaskOneBit(Node* node) {
+    // Look for the pattern `(val >> shift) & 1`. The shift may be omitted.
+    if (WordNAdapter::IsWordNAnd(NodeMatcher(node))) {
+      typename WordNAdapter::IntNBinopMatcher mand(node);
+      if (mand.right().HasValue() && mand.right().Value() == 1) {
+        if (WordNAdapter::IsWordNShr(mand.left()) ||
+            WordNAdapter::IsWordNSar(mand.left())) {
+          typename WordNAdapter::UintNBinopMatcher shift(mand.left().node());
+          if (shift.right().HasValue() && shift.right().Value() < 32u) {
+            uint32_t mask = 1 << shift.right().Value();
+            return BitfieldCheck{shift.left().node(), mask, mask,
+                                 WordNAdapter::WORD_SIZE == 64};
+          }
+        }
+        return BitfieldCheck{mand.left().node(), 1, 1,
+                             WordNAdapter::WORD_SIZE == 64};
+      }
+    }
+    return {};
+  }
+};
+
+}  // namespace
+
 Reduction MachineOperatorReducer::ReduceWord32And(Node* node) {
   DCHECK_EQ(IrOpcode::kWord32And, node->opcode());
-  return ReduceWordNAnd<Word32Adapter>(node);
+  Reduction reduction = ReduceWordNAnd<Word32Adapter>(node);
+  if (reduction.Changed()) {
+    return reduction;
+  }
+
+  // Attempt to detect multiple bitfield checks from the same bitfield struct
+  // and fold them into a single check.
+  Int32BinopMatcher m(node);
+  if (auto right_bitfield = BitfieldCheck::Detect(m.right().node())) {
+    if (auto left_bitfield = BitfieldCheck::Detect(m.left().node())) {
+      if (auto combined_bitfield = left_bitfield->TryCombine(*right_bitfield)) {
+        Node* source = combined_bitfield->source;
+        if (combined_bitfield->truncate_from_64_bit) {
+          source = TruncateInt64ToInt32(source);
+        }
+        node->ReplaceInput(0, Word32And(source, combined_bitfield->mask));
+        node->ReplaceInput(1, Int32Constant(combined_bitfield->masked_value));
+        NodeProperties::ChangeOp(node, machine()->Word32Equal());
+        return Changed(node).FollowedBy(ReduceWord32Equal(node));
+      }
+    }
+  }
+
+  return NoChange();
 }
 
 Reduction MachineOperatorReducer::ReduceWord64And(Node* node) {
@@ -1543,6 +1778,20 @@ Reduction MachineOperatorReducer::ReduceWordNOr(Node* node) {
   }
   if (m.LeftEqualsRight()) return Replace(m.left().node());  // x | x => x
 
+  // (x & K1) | K2 => x | K2 if K2 has ones for every zero bit in K1.
+  // This case can be constructed by UpdateWord and UpdateWord32 in CSA.
+  if (m.right().HasValue()) {
+    if (A::IsWordNAnd(m.left())) {
+      typename A::IntNBinopMatcher mand(m.left().node());
+      if (mand.right().HasValue()) {
+        if ((m.right().Value() | mand.right().Value()) == -1) {
+          node->ReplaceInput(0, mand.left().node());
+          return Changed(node);
+        }
+      }
+    }
+  }
+
   return a.TryMatchWordNRor(node);
 }
 
@@ -1587,6 +1836,39 @@ Reduction MachineOperatorReducer::ReduceWord64Xor(Node* node) {
   return ReduceWordNXor<Word64Adapter>(node);
 }
 
+Reduction MachineOperatorReducer::ReduceWord32Equal(Node* node) {
+  Int32BinopMatcher m(node);
+  if (m.IsFoldable()) {  // K == K => K
+    return ReplaceBool(m.left().Value() == m.right().Value());
+  }
+  if (m.left().IsInt32Sub() && m.right().Is(0)) {  // x - y == 0 => x == y
+    Int32BinopMatcher msub(m.left().node());
+    node->ReplaceInput(0, msub.left().node());
+    node->ReplaceInput(1, msub.right().node());
+    return Changed(node);
+  }
+  // TODO(turbofan): fold HeapConstant, ExternalReference, pointer compares
+  if (m.LeftEqualsRight()) return ReplaceBool(true);  // x == x => true
+  if (m.right().HasValue()) {
+    base::Optional<std::pair<Node*, uint32_t>> replacements;
+    if (m.left().IsTruncateInt64ToInt32()) {
+      replacements = ReduceWord32EqualForConstantRhs<Word64Adapter>(
+          NodeProperties::GetValueInput(m.left().node(), 0),
+          static_cast<uint32_t>(m.right().Value()));
+    } else {
+      replacements = ReduceWord32EqualForConstantRhs<Word32Adapter>(
+          m.left().node(), static_cast<uint32_t>(m.right().Value()));
+    }
+    if (replacements) {
+      node->ReplaceInput(0, replacements->first);
+      node->ReplaceInput(1, Uint32Constant(replacements->second));
+      return Changed(node);
+    }
+  }
+
+  return NoChange();
+}
+
 Reduction MachineOperatorReducer::ReduceFloat64InsertLowWord32(Node* node) {
   DCHECK_EQ(IrOpcode::kFloat64InsertLowWord32, node->opcode());
   Float64Matcher mlhs(node->InputAt(0));
@@ -1696,25 +1978,64 @@ Reduction MachineOperatorReducer::ReduceConditional(Node* node) {
   // Reductions involving control flow happen elsewhere. Non-zero inputs are
   // considered true in all conditional ops.
   NodeMatcher condition(NodeProperties::GetValueInput(node, 0));
-  if (condition.IsWord32And()) {
-    Uint32BinopMatcher mand(condition.node());
-    if ((mand.left().IsWord32Shr() || mand.left().IsWord32Sar()) &&
+  if (condition.IsTruncateInt64ToInt32()) {
+    if (auto replacement =
+            ReduceConditionalN<Word64Adapter>(condition.node())) {
+      NodeProperties::ReplaceValueInput(node, *replacement, 0);
+      return Changed(node);
+    }
+  } else if (auto replacement = ReduceConditionalN<Word32Adapter>(node)) {
+    NodeProperties::ReplaceValueInput(node, *replacement, 0);
+    return Changed(node);
+  }
+  return NoChange();
+}
+
+template <typename WordNAdapter>
+base::Optional<Node*> MachineOperatorReducer::ReduceConditionalN(Node* node) {
+  NodeMatcher condition(NodeProperties::GetValueInput(node, 0));
+  // Branch conditions are 32-bit comparisons against zero, so they are the
+  // opposite of a 32-bit `x == 0` node. To avoid repetition, we can reuse logic
+  // for Word32Equal: if `x == 0` can reduce to `y == 0`, then branch(x) can
+  // reduce to branch(y).
+  auto replacements =
+      ReduceWord32EqualForConstantRhs<WordNAdapter>(condition.node(), 0);
+  if (replacements && replacements->second == 0) return replacements->first;
+  return {};
+}
+
+template <typename WordNAdapter>
+base::Optional<std::pair<Node*, uint32_t>>
+MachineOperatorReducer::ReduceWord32EqualForConstantRhs(Node* lhs,
+                                                        uint32_t rhs) {
+  if (WordNAdapter::IsWordNAnd(NodeMatcher(lhs))) {
+    typename WordNAdapter::UintNBinopMatcher mand(lhs);
+    if ((WordNAdapter::IsWordNShr(mand.left()) ||
+         WordNAdapter::IsWordNSar(mand.left())) &&
         mand.right().HasValue()) {
-      Uint32BinopMatcher mshift(mand.left().node());
-      // Branch condition (x >> K1) & K2 => x & (K2 << K1)
+      typename WordNAdapter::UintNBinopMatcher mshift(mand.left().node());
+      // ((x >> K1) & K2) == K3 => (x & (K2 << K1)) == (K3 << K1)
       if (mshift.right().HasValue()) {
         auto shift_bits = mshift.right().Value();
         auto mask = mand.right().Value();
-        // Make sure that we won't shift data off the end.
-        if (shift_bits <= base::bits::CountLeadingZeros(mask)) {
-          NodeProperties::ReplaceValueInput(
-              node, Word32And(mshift.left().node(), mask << shift_bits), 0);
-          return Changed(node);
+        // Make sure that we won't shift data off the end, and that all of the
+        // data ends up in the lower 32 bits for 64-bit mode.
+        if (shift_bits <= base::bits::CountLeadingZeros(mask) &&
+            shift_bits <= base::bits::CountLeadingZeros(rhs) &&
+            mask << shift_bits <= std::numeric_limits<uint32_t>::max()) {
+          Node* new_input = mshift.left().node();
+          uint32_t new_mask = static_cast<uint32_t>(mask << shift_bits);
+          uint32_t new_rhs = rhs << shift_bits;
+          if (WordNAdapter::WORD_SIZE == 64) {
+            // We can truncate before performing the And.
+            new_input = TruncateInt64ToInt32(new_input);
+          }
+          return std::make_pair(Word32And(new_input, new_mask), new_rhs);
         }
       }
     }
   }
-  return NoChange();
+  return {};
 }
 
 CommonOperatorBuilder* MachineOperatorReducer::common() const {
diff --git a/deps/v8/src/compiler/machine-operator-reducer.h b/deps/v8/src/compiler/machine-operator-reducer.h
index 53c5d6fa686..9f12f818374 100644
--- a/deps/v8/src/compiler/machine-operator-reducer.h
+++ b/deps/v8/src/compiler/machine-operator-reducer.h
@@ -62,6 +62,7 @@ class V8_EXPORT_PRIVATE MachineOperatorReducer final
   Node* Int32Mul(Node* lhs, Node* rhs);
   Node* Int32Div(Node* dividend, int32_t divisor);
   Node* Uint32Div(Node* dividend, uint32_t divisor);
+  Node* TruncateInt64ToInt32(Node* value);
 
   Reduction ReplaceBool(bool value) { return ReplaceInt32(value ? 1 : 0); }
   Reduction ReplaceFloat32(volatile float value) {
@@ -91,6 +92,9 @@ class V8_EXPORT_PRIVATE MachineOperatorReducer final
   Reduction ReduceUint32Mod(Node* node);
   Reduction ReduceStore(Node* node);
   Reduction ReduceProjection(size_t index, Node* node);
+  const Operator* Map64To32Comparison(const Operator* op, bool sign_extended);
+  Reduction ReduceWord32Comparisons(Node* node);
+  Reduction ReduceWord64Comparisons(Node* node);
   Reduction ReduceWord32Shifts(Node* node);
   Reduction ReduceWord32Shl(Node* node);
   Reduction ReduceWord64Shl(Node* node);
@@ -105,10 +109,12 @@ class V8_EXPORT_PRIVATE MachineOperatorReducer final
   Reduction ReduceWord64Or(Node* node);
   Reduction ReduceWord32Xor(Node* node);
   Reduction ReduceWord64Xor(Node* node);
+  Reduction ReduceWord32Equal(Node* node);
   Reduction ReduceFloat64InsertLowWord32(Node* node);
   Reduction ReduceFloat64InsertHighWord32(Node* node);
   Reduction ReduceFloat64Compare(Node* node);
   Reduction ReduceFloat64RoundDown(Node* node);
+  Reduction ReduceTruncateInt64ToInt32(Node* node);
   Reduction ReduceConditional(Node* node);
 
   Graph* graph() const;
@@ -125,6 +131,18 @@ class V8_EXPORT_PRIVATE MachineOperatorReducer final
   template <typename WordNAdapter>
   Reduction ReduceWordNXor(Node* node);
 
+  // Helper for ReduceConditional. Does not perform the actual reduction; just
+  // returns a new Node that could be used as the input to the condition.
+  template <typename WordNAdapter>
+  base::Optional<Node*> ReduceConditionalN(Node* node);
+
+  // Helper for finding a reduced equality condition. Does not perform the
+  // actual reduction; just returns a new pair that could be compared for the
+  // same outcome.
+  template <typename WordNAdapter>
+  base::Optional<std::pair<Node*, uint32_t>> ReduceWord32EqualForConstantRhs(
+      Node* lhs, uint32_t rhs);
+
   MachineGraph* mcgraph_;
   bool allow_signalling_nan_;
 };
diff --git a/deps/v8/src/compiler/machine-operator.cc b/deps/v8/src/compiler/machine-operator.cc
index 898182db313..f2fa35e2560 100644
--- a/deps/v8/src/compiler/machine-operator.cc
+++ b/deps/v8/src/compiler/machine-operator.cc
@@ -3,8 +3,8 @@
 // found in the LICENSE file.
 
 #include "src/compiler/machine-operator.h"
+#include <type_traits>
 
-#include "src/base/lazy-instance.h"
 #include "src/compiler/opcodes.h"
 #include "src/compiler/operator.h"
 
@@ -106,7 +106,6 @@ LoadRepresentation LoadRepresentationOf(Operator const* op) {
   return OpParameter<LoadRepresentation>(op);
 }
 
-
 StoreRepresentation const& StoreRepresentationOf(Operator const* op) {
   DCHECK(IrOpcode::kStore == op->opcode() ||
          IrOpcode::kProtectedStore == op->opcode());
@@ -150,6 +149,22 @@ MachineType AtomicOpType(Operator const* op) {
   return OpParameter<MachineType>(op);
 }
 
+size_t hash_value(ShiftKind kind) { return static_cast<size_t>(kind); }
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os, ShiftKind kind) {
+  switch (kind) {
+    case ShiftKind::kNormal:
+      return os << "Normal";
+    case ShiftKind::kShiftOutZeros:
+      return os << "ShiftOutZeros";
+  }
+}
+
+ShiftKind ShiftKindOf(Operator const* op) {
+  DCHECK(IrOpcode::kWord32Sar == op->opcode() ||
+         IrOpcode::kWord64Sar == op->opcode());
+  return OpParameter<ShiftKind>(op);
+}
+
 // The format is:
 // V(Name, properties, value_input_count, control_input_count, output_count)
 #define PURE_BINARY_OP_LIST_32(V)                                           \
@@ -158,7 +173,6 @@ MachineType AtomicOpType(Operator const* op) {
   V(Word32Xor, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)    \
   V(Word32Shl, Operator::kNoProperties, 2, 0, 1)                            \
   V(Word32Shr, Operator::kNoProperties, 2, 0, 1)                            \
-  V(Word32Sar, Operator::kNoProperties, 2, 0, 1)                            \
   V(Word32Ror, Operator::kNoProperties, 2, 0, 1)                            \
   V(Word32Equal, Operator::kCommutative, 2, 0, 1)                           \
   V(Int32Add, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)     \
@@ -183,7 +197,6 @@ MachineType AtomicOpType(Operator const* op) {
   V(Word64Xor, Operator::kAssociative | Operator::kCommutative, 2, 0, 1) \
   V(Word64Shl, Operator::kNoProperties, 2, 0, 1)                         \
   V(Word64Shr, Operator::kNoProperties, 2, 0, 1)                         \
-  V(Word64Sar, Operator::kNoProperties, 2, 0, 1)                         \
   V(Word64Ror, Operator::kNoProperties, 2, 0, 1)                         \
   V(Word64Equal, Operator::kCommutative, 2, 0, 1)                        \
   V(Int64Add, Operator::kAssociative | Operator::kCommutative, 2, 0, 1)  \
@@ -324,6 +337,8 @@ MachineType AtomicOpType(Operator const* op) {
   V(F64x2Le, Operator::kNoProperties, 2, 0, 1)                             \
   V(F64x2Qfma, Operator::kNoProperties, 3, 0, 1)                           \
   V(F64x2Qfms, Operator::kNoProperties, 3, 0, 1)                           \
+  V(F64x2Pmin, Operator::kNoProperties, 2, 0, 1)                           \
+  V(F64x2Pmax, Operator::kNoProperties, 2, 0, 1)                           \
   V(F32x4Splat, Operator::kNoProperties, 1, 0, 1)                          \
   V(F32x4SConvertI32x4, Operator::kNoProperties, 1, 0, 1)                  \
   V(F32x4UConvertI32x4, Operator::kNoProperties, 1, 0, 1)                  \
@@ -345,6 +360,12 @@ MachineType AtomicOpType(Operator const* op) {
   V(F32x4Le, Operator::kNoProperties, 2, 0, 1)                             \
   V(F32x4Qfma, Operator::kNoProperties, 3, 0, 1)                           \
   V(F32x4Qfms, Operator::kNoProperties, 3, 0, 1)                           \
+  V(F32x4Pmin, Operator::kNoProperties, 2, 0, 1)                           \
+  V(F32x4Pmax, Operator::kNoProperties, 2, 0, 1)                           \
+  V(F32x4Ceil, Operator::kNoProperties, 1, 0, 1)                           \
+  V(F32x4Floor, Operator::kNoProperties, 1, 0, 1)                          \
+  V(F32x4Trunc, Operator::kNoProperties, 1, 0, 1)                          \
+  V(F32x4NearestInt, Operator::kNoProperties, 1, 0, 1)                     \
   V(I64x2Splat, Operator::kNoProperties, 1, 0, 1)                          \
   V(I64x2SplatI32Pair, Operator::kNoProperties, 2, 0, 1)                   \
   V(I64x2Neg, Operator::kNoProperties, 1, 0, 1)                            \
@@ -459,14 +480,14 @@ MachineType AtomicOpType(Operator const* op) {
   V(S128Not, Operator::kNoProperties, 1, 0, 1)                             \
   V(S128Select, Operator::kNoProperties, 3, 0, 1)                          \
   V(S128AndNot, Operator::kNoProperties, 2, 0, 1)                          \
-  V(S1x2AnyTrue, Operator::kNoProperties, 1, 0, 1)                         \
-  V(S1x2AllTrue, Operator::kNoProperties, 1, 0, 1)                         \
-  V(S1x4AnyTrue, Operator::kNoProperties, 1, 0, 1)                         \
-  V(S1x4AllTrue, Operator::kNoProperties, 1, 0, 1)                         \
-  V(S1x8AnyTrue, Operator::kNoProperties, 1, 0, 1)                         \
-  V(S1x8AllTrue, Operator::kNoProperties, 1, 0, 1)                         \
-  V(S1x16AnyTrue, Operator::kNoProperties, 1, 0, 1)                        \
-  V(S1x16AllTrue, Operator::kNoProperties, 1, 0, 1)                        \
+  V(V64x2AnyTrue, Operator::kNoProperties, 1, 0, 1)                        \
+  V(V64x2AllTrue, Operator::kNoProperties, 1, 0, 1)                        \
+  V(V32x4AnyTrue, Operator::kNoProperties, 1, 0, 1)                        \
+  V(V32x4AllTrue, Operator::kNoProperties, 1, 0, 1)                        \
+  V(V16x8AnyTrue, Operator::kNoProperties, 1, 0, 1)                        \
+  V(V16x8AllTrue, Operator::kNoProperties, 1, 0, 1)                        \
+  V(V8x16AnyTrue, Operator::kNoProperties, 1, 0, 1)                        \
+  V(V8x16AllTrue, Operator::kNoProperties, 1, 0, 1)                        \
   V(S8x16Swizzle, Operator::kNoProperties, 2, 0, 1)
 
 // The format is:
@@ -474,6 +495,8 @@ MachineType AtomicOpType(Operator const* op) {
 #define PURE_OPTIONAL_OP_LIST(V)                            \
   V(Word32Ctz, Operator::kNoProperties, 1, 0, 1)            \
   V(Word64Ctz, Operator::kNoProperties, 1, 0, 1)            \
+  V(Word32Rol, Operator::kNoProperties, 2, 0, 1)            \
+  V(Word64Rol, Operator::kNoProperties, 2, 0, 1)            \
   V(Word32ReverseBits, Operator::kNoProperties, 1, 0, 1)    \
   V(Word64ReverseBits, Operator::kNoProperties, 1, 0, 1)    \
   V(Int32AbsWithOverflow, Operator::kNoProperties, 1, 0, 2) \
@@ -568,14 +591,6 @@ MachineType AtomicOpType(Operator const* op) {
   ATOMIC_REPRESENTATION_LIST(V)         \
   V(kWord64)
 
-#define ATOMIC_PAIR_BINOP_LIST(V) \
-  V(Add)                          \
-  V(Sub)                          \
-  V(And)                          \
-  V(Or)                           \
-  V(Xor)                          \
-  V(Exchange)
-
 #define SIMD_LANE_OP_LIST(V) \
   V(F64x2, 2)                \
   V(F32x4, 4)                \
@@ -587,443 +602,372 @@ MachineType AtomicOpType(Operator const* op) {
 #define STACK_SLOT_CACHED_SIZES_ALIGNMENTS_LIST(V) \
   V(4, 0) V(8, 0) V(16, 0) V(4, 4) V(8, 8) V(16, 16)
 
+template <IrOpcode::Value op, int value_input_count, int effect_input_count,
+          int control_input_count, int value_output_count,
+          int effect_output_count, int control_output_count>
+struct CachedOperator : public Operator {
+  CachedOperator(Operator::Properties properties, const char* mnemonic)
+      : Operator(op, properties, mnemonic, value_input_count,
+                 effect_input_count, control_input_count, value_output_count,
+                 effect_output_count, control_output_count) {}
+};
+
+template <IrOpcode::Value op, int value_input_count, int control_input_count,
+          int value_output_count>
+struct CachedPureOperator : public Operator {
+  CachedPureOperator(Operator::Properties properties, const char* mnemonic)
+      : Operator(op, Operator::kPure | properties, mnemonic, value_input_count,
+                 0, control_input_count, value_output_count, 0, 0) {}
+};
+
+template <class Op>
+const Operator* GetCachedOperator() {
+  STATIC_ASSERT(std::is_trivially_destructible<Op>::value);
+  static const Op op;
+  return &op;
+}
+
+template <class Op>
+const Operator* GetCachedOperator(Operator::Properties properties,
+                                  const char* mnemonic) {
+#ifdef DEBUG
+  static Operator::Properties const initial_properties = properties;
+  static const char* const initial_mnemonic = mnemonic;
+  DCHECK_EQ(properties, initial_properties);
+  DCHECK_EQ(mnemonic, initial_mnemonic);
+#endif
+  STATIC_ASSERT(std::is_trivially_destructible<Op>::value);
+  static const Op op(properties, mnemonic);
+  return &op;
+}
+
 struct StackSlotOperator : public Operator1<StackSlotRepresentation> {
   explicit StackSlotOperator(int size, int alignment)
-      : Operator1<StackSlotRepresentation>(
-            IrOpcode::kStackSlot, Operator::kNoDeopt | Operator::kNoThrow,
-            "StackSlot", 0, 0, 0, 1, 0, 0,
-            StackSlotRepresentation(size, alignment)) {}
+      : Operator1(IrOpcode::kStackSlot, Operator::kNoDeopt | Operator::kNoThrow,
+                  "StackSlot", 0, 0, 0, 1, 0, 0,
+                  StackSlotRepresentation(size, alignment)) {}
+};
+
+template <int size, int alignment>
+struct CachedStackSlotOperator : StackSlotOperator {
+  CachedStackSlotOperator() : StackSlotOperator(size, alignment) {}
 };
 
-struct MachineOperatorGlobalCache {
 #define PURE(Name, properties, value_input_count, control_input_count,         \
              output_count)                                                     \
-  struct Name##Operator final : public Operator {                              \
-    Name##Operator()                                                           \
-        : Operator(IrOpcode::k##Name, Operator::kPure | properties, #Name,     \
-                   value_input_count, 0, control_input_count, output_count, 0, \
-                   0) {}                                                       \
-  };                                                                           \
-  Name##Operator k##Name;
-  MACHINE_PURE_OP_LIST(PURE)
-  PURE_OPTIONAL_OP_LIST(PURE)
+  const OptionalOperator MachineOperatorBuilder::Name() {                      \
+    return OptionalOperator(                                                   \
+        flags_ & k##Name,                                                      \
+        GetCachedOperator<                                                     \
+            CachedPureOperator<IrOpcode::k##Name, value_input_count,           \
+                               control_input_count, output_count>>(properties, \
+                                                                   #Name));    \
+  }
+PURE_OPTIONAL_OP_LIST(PURE)
 #undef PURE
 
-#define OVERFLOW_OP(Name, properties)                                        \
-  struct Name##Operator final : public Operator {                            \
-    Name##Operator()                                                         \
-        : Operator(IrOpcode::k##Name,                                        \
-                   Operator::kEliminatable | Operator::kNoRead | properties, \
-                   #Name, 2, 0, 1, 2, 0, 0) {}                               \
-  };                                                                         \
-  Name##Operator k##Name;
-  OVERFLOW_OP_LIST(OVERFLOW_OP)
+#define OVERFLOW_OP(Name, properties)                                     \
+  const Operator* MachineOperatorBuilder::Name() {                        \
+    return GetCachedOperator<                                             \
+        CachedOperator<IrOpcode::k##Name, 2, 0, 1, 2, 0, 0>>(             \
+        Operator::kEliminatable | Operator::kNoRead | properties, #Name); \
+  }
+OVERFLOW_OP_LIST(OVERFLOW_OP)
 #undef OVERFLOW_OP
 
-#define LOAD(Type)                                                             \
-  struct Load##Type##Operator final : public Operator1<LoadRepresentation> {   \
-    Load##Type##Operator()                                                     \
-        : Operator1<LoadRepresentation>(IrOpcode::kLoad,                       \
-                                        Operator::kEliminatable, "Load", 2, 1, \
-                                        1, 1, 1, 0, MachineType::Type()) {}    \
-  };                                                                           \
-  struct PoisonedLoad##Type##Operator final                                    \
-      : public Operator1<LoadRepresentation> {                                 \
-    PoisonedLoad##Type##Operator()                                             \
-        : Operator1<LoadRepresentation>(                                       \
-              IrOpcode::kPoisonedLoad, Operator::kEliminatable,                \
-              "PoisonedLoad", 2, 1, 1, 1, 1, 0, MachineType::Type()) {}        \
-  };                                                                           \
-  struct UnalignedLoad##Type##Operator final                                   \
-      : public Operator1<LoadRepresentation> {                                 \
-    UnalignedLoad##Type##Operator()                                            \
-        : Operator1<LoadRepresentation>(                                       \
-              IrOpcode::kUnalignedLoad, Operator::kEliminatable,               \
-              "UnalignedLoad", 2, 1, 1, 1, 1, 0, MachineType::Type()) {}       \
-  };                                                                           \
-  struct ProtectedLoad##Type##Operator final                                   \
-      : public Operator1<LoadRepresentation> {                                 \
-    ProtectedLoad##Type##Operator()                                            \
-        : Operator1<LoadRepresentation>(                                       \
-              IrOpcode::kProtectedLoad,                                        \
-              Operator::kNoDeopt | Operator::kNoThrow, "ProtectedLoad", 2, 1,  \
-              1, 1, 1, 0, MachineType::Type()) {}                              \
-  };                                                                           \
-  Load##Type##Operator kLoad##Type;                                            \
-  PoisonedLoad##Type##Operator kPoisonedLoad##Type;                            \
-  UnalignedLoad##Type##Operator kUnalignedLoad##Type;                          \
-  ProtectedLoad##Type##Operator kProtectedLoad##Type;
-  MACHINE_TYPE_LIST(LOAD)
-#undef LOAD
+template <ShiftKind kind>
+struct Word32SarOperator : Operator1<ShiftKind> {
+  Word32SarOperator()
+      : Operator1(IrOpcode::kWord32Sar, Operator::kPure, "Word32Sar", 2, 0, 0,
+                  1, 0, 0, kind) {}
+};
 
-#define LOAD_TRANSFORM_KIND(TYPE, KIND)                                \
-  struct KIND##LoadTransform##TYPE##Operator final                     \
-      : public Operator1<LoadTransformParameters> {                    \
-    KIND##LoadTransform##TYPE##Operator()                              \
-        : Operator1<LoadTransformParameters>(                          \
-              IrOpcode::kLoadTransform, Operator::kEliminatable,       \
-              #KIND "LoadTransform", 2, 1, 1, 1, 1, 0,                 \
-              LoadTransformParameters{LoadKind::k##KIND,               \
-                                      LoadTransformation::k##TYPE}) {} \
-  };                                                                   \
-  KIND##LoadTransform##TYPE##Operator k##KIND##LoadTransform##TYPE;
+const Operator* MachineOperatorBuilder::Word32Sar(ShiftKind kind) {
+  switch (kind) {
+    case ShiftKind::kNormal:
+      return GetCachedOperator<Word32SarOperator<ShiftKind::kNormal>>();
+    case ShiftKind::kShiftOutZeros:
+      return GetCachedOperator<Word32SarOperator<ShiftKind::kShiftOutZeros>>();
+  }
+}
 
-#define LOAD_TRANSFORM(TYPE)           \
-  LOAD_TRANSFORM_KIND(TYPE, Normal)    \
-  LOAD_TRANSFORM_KIND(TYPE, Unaligned) \
-  LOAD_TRANSFORM_KIND(TYPE, Protected)
+template <ShiftKind kind>
+struct Word64SarOperator : Operator1<ShiftKind> {
+  Word64SarOperator()
+      : Operator1(IrOpcode::kWord64Sar, Operator::kPure, "Word64Sar", 2, 0, 0,
+                  1, 0, 0, kind) {}
+};
 
-  LOAD_TRANSFORM_LIST(LOAD_TRANSFORM)
-#undef LOAD_TRANSFORM
-#undef LOAD_TRANSFORM_KIND
+const Operator* MachineOperatorBuilder::Word64Sar(ShiftKind kind) {
+  switch (kind) {
+    case ShiftKind::kNormal:
+      return GetCachedOperator<Word64SarOperator<ShiftKind::kNormal>>();
+    case ShiftKind::kShiftOutZeros:
+      return GetCachedOperator<Word64SarOperator<ShiftKind::kShiftOutZeros>>();
+  }
+}
 
-#define STACKSLOT(Size, Alignment)                                     \
-  struct StackSlotOfSize##Size##OfAlignment##Alignment##Operator final \
-      : public StackSlotOperator {                                     \
-    StackSlotOfSize##Size##OfAlignment##Alignment##Operator()          \
-        : StackSlotOperator(Size, Alignment) {}                        \
-  };                                                                   \
-  StackSlotOfSize##Size##OfAlignment##Alignment##Operator              \
-      kStackSlotOfSize##Size##OfAlignment##Alignment;
-  STACK_SLOT_CACHED_SIZES_ALIGNMENTS_LIST(STACKSLOT)
-#undef STACKSLOT
-
-#define STORE(Type)                                                        \
-  struct Store##Type##Operator : public Operator1<StoreRepresentation> {   \
-    explicit Store##Type##Operator(WriteBarrierKind write_barrier_kind)    \
-        : Operator1<StoreRepresentation>(                                  \
-              IrOpcode::kStore,                                            \
-              Operator::kNoDeopt | Operator::kNoRead | Operator::kNoThrow, \
-              "Store", 3, 1, 1, 0, 1, 0,                                   \
-              StoreRepresentation(MachineRepresentation::Type,             \
-                                  write_barrier_kind)) {}                  \
-  };                                                                       \
-  struct Store##Type##NoWriteBarrier##Operator final                       \
-      : public Store##Type##Operator {                                     \
-    Store##Type##NoWriteBarrier##Operator()                                \
-        : Store##Type##Operator(kNoWriteBarrier) {}                        \
-  };                                                                       \
-  struct Store##Type##AssertNoWriteBarrier##Operator final                 \
-      : public Store##Type##Operator {                                     \
-    Store##Type##AssertNoWriteBarrier##Operator()                          \
-        : Store##Type##Operator(kAssertNoWriteBarrier) {}                  \
-  };                                                                       \
-  struct Store##Type##MapWriteBarrier##Operator final                      \
-      : public Store##Type##Operator {                                     \
-    Store##Type##MapWriteBarrier##Operator()                               \
-        : Store##Type##Operator(kMapWriteBarrier) {}                       \
-  };                                                                       \
-  struct Store##Type##PointerWriteBarrier##Operator final                  \
-      : public Store##Type##Operator {                                     \
-    Store##Type##PointerWriteBarrier##Operator()                           \
-        : Store##Type##Operator(kPointerWriteBarrier) {}                   \
-  };                                                                       \
-  struct Store##Type##EphemeronKeyWriteBarrier##Operator final             \
-      : public Store##Type##Operator {                                     \
-    Store##Type##EphemeronKeyWriteBarrier##Operator()                      \
-        : Store##Type##Operator(kEphemeronKeyWriteBarrier) {}              \
-  };                                                                       \
-  struct Store##Type##FullWriteBarrier##Operator final                     \
-      : public Store##Type##Operator {                                     \
-    Store##Type##FullWriteBarrier##Operator()                              \
-        : Store##Type##Operator(kFullWriteBarrier) {}                      \
-  };                                                                       \
-  struct UnalignedStore##Type##Operator final                              \
-      : public Operator1<UnalignedStoreRepresentation> {                   \
-    UnalignedStore##Type##Operator()                                       \
-        : Operator1<UnalignedStoreRepresentation>(                         \
-              IrOpcode::kUnalignedStore,                                   \
-              Operator::kNoDeopt | Operator::kNoRead | Operator::kNoThrow, \
-              "UnalignedStore", 3, 1, 1, 0, 1, 0,                          \
-              MachineRepresentation::Type) {}                              \
-  };                                                                       \
-  struct ProtectedStore##Type##Operator                                    \
-      : public Operator1<StoreRepresentation> {                            \
-    explicit ProtectedStore##Type##Operator()                              \
-        : Operator1<StoreRepresentation>(                                  \
-              IrOpcode::kProtectedStore,                                   \
-              Operator::kNoDeopt | Operator::kNoRead | Operator::kNoThrow, \
-              "Store", 3, 1, 1, 0, 1, 0,                                   \
-              StoreRepresentation(MachineRepresentation::Type,             \
-                                  kNoWriteBarrier)) {}                     \
-  };                                                                       \
-  Store##Type##NoWriteBarrier##Operator kStore##Type##NoWriteBarrier;      \
-  Store##Type##AssertNoWriteBarrier##Operator                              \
-      kStore##Type##AssertNoWriteBarrier;                                  \
-  Store##Type##MapWriteBarrier##Operator kStore##Type##MapWriteBarrier;    \
-  Store##Type##PointerWriteBarrier##Operator                               \
-      kStore##Type##PointerWriteBarrier;                                   \
-  Store##Type##EphemeronKeyWriteBarrier##Operator                          \
-      kStore##Type##EphemeronKeyWriteBarrier;                              \
-  Store##Type##FullWriteBarrier##Operator kStore##Type##FullWriteBarrier;  \
-  UnalignedStore##Type##Operator kUnalignedStore##Type;                    \
-  ProtectedStore##Type##Operator kProtectedStore##Type;
-  MACHINE_REPRESENTATION_LIST(STORE)
-#undef STORE
+template <MachineRepresentation rep, MachineSemantic sem>
+struct LoadOperator : public Operator1<LoadRepresentation> {
+  LoadOperator()
+      : Operator1(IrOpcode::kLoad, Operator::kEliminatable, "Load", 2, 1, 1, 1,
+                  1, 0, LoadRepresentation(rep, sem)) {}
+};
 
-#define ATOMIC_LOAD(Type)                                                   \
-  struct Word32AtomicLoad##Type##Operator final                             \
-      : public Operator1<LoadRepresentation> {                              \
-    Word32AtomicLoad##Type##Operator()                                      \
-        : Operator1<LoadRepresentation>(                                    \
-              IrOpcode::kWord32AtomicLoad, Operator::kEliminatable,         \
-              "Word32AtomicLoad", 2, 1, 1, 1, 1, 0, MachineType::Type()) {} \
-  };                                                                        \
-  Word32AtomicLoad##Type##Operator kWord32AtomicLoad##Type;
-  ATOMIC_TYPE_LIST(ATOMIC_LOAD)
-#undef ATOMIC_LOAD
-
-#define ATOMIC_LOAD(Type)                                                   \
-  struct Word64AtomicLoad##Type##Operator final                             \
-      : public Operator1<LoadRepresentation> {                              \
-    Word64AtomicLoad##Type##Operator()                                      \
-        : Operator1<LoadRepresentation>(                                    \
-              IrOpcode::kWord64AtomicLoad, Operator::kEliminatable,         \
-              "Word64AtomicLoad", 2, 1, 1, 1, 1, 0, MachineType::Type()) {} \
-  };                                                                        \
-  Word64AtomicLoad##Type##Operator kWord64AtomicLoad##Type;
-  ATOMIC_U64_TYPE_LIST(ATOMIC_LOAD)
-#undef ATOMIC_LOAD
-
-#define ATOMIC_STORE(Type)                                                 \
-  struct Word32AtomicStore##Type##Operator                                 \
-      : public Operator1<MachineRepresentation> {                          \
-    Word32AtomicStore##Type##Operator()                                    \
-        : Operator1<MachineRepresentation>(                                \
-              IrOpcode::kWord32AtomicStore,                                \
-              Operator::kNoDeopt | Operator::kNoRead | Operator::kNoThrow, \
-              "Word32AtomicStore", 3, 1, 1, 0, 1, 0,                       \
-              MachineRepresentation::Type) {}                              \
-  };                                                                       \
-  Word32AtomicStore##Type##Operator kWord32AtomicStore##Type;
-  ATOMIC_REPRESENTATION_LIST(ATOMIC_STORE)
-#undef ATOMIC_STORE
-
-#define ATOMIC_STORE(Type)                                                 \
-  struct Word64AtomicStore##Type##Operator                                 \
-      : public Operator1<MachineRepresentation> {                          \
-    Word64AtomicStore##Type##Operator()                                    \
-        : Operator1<MachineRepresentation>(                                \
-              IrOpcode::kWord64AtomicStore,                                \
-              Operator::kNoDeopt | Operator::kNoRead | Operator::kNoThrow, \
-              "Word64AtomicStore", 3, 1, 1, 0, 1, 0,                       \
-              MachineRepresentation::Type) {}                              \
-  };                                                                       \
-  Word64AtomicStore##Type##Operator kWord64AtomicStore##Type;
-  ATOMIC64_REPRESENTATION_LIST(ATOMIC_STORE)
-#undef ATOMIC_STORE
-
-#define ATOMIC_OP(op, type)                                                    \
-  struct op##type##Operator : public Operator1<MachineType> {                  \
-    op##type##Operator()                                                       \
-        : Operator1<MachineType>(IrOpcode::k##op,                              \
-                                 Operator::kNoDeopt | Operator::kNoThrow, #op, \
-                                 3, 1, 1, 1, 1, 0, MachineType::type()) {}     \
-  };                                                                           \
-  op##type##Operator k##op##type;
-#define ATOMIC_OP_LIST(type)       \
-  ATOMIC_OP(Word32AtomicAdd, type) \
-  ATOMIC_OP(Word32AtomicSub, type) \
-  ATOMIC_OP(Word32AtomicAnd, type) \
-  ATOMIC_OP(Word32AtomicOr, type)  \
-  ATOMIC_OP(Word32AtomicXor, type) \
-  ATOMIC_OP(Word32AtomicExchange, type)
-  ATOMIC_TYPE_LIST(ATOMIC_OP_LIST)
-#undef ATOMIC_OP_LIST
-#define ATOMIC64_OP_LIST(type)     \
-  ATOMIC_OP(Word64AtomicAdd, type) \
-  ATOMIC_OP(Word64AtomicSub, type) \
-  ATOMIC_OP(Word64AtomicAnd, type) \
-  ATOMIC_OP(Word64AtomicOr, type)  \
-  ATOMIC_OP(Word64AtomicXor, type) \
-  ATOMIC_OP(Word64AtomicExchange, type)
-  ATOMIC_U64_TYPE_LIST(ATOMIC64_OP_LIST)
-#undef ATOMIC64_OP_LIST
-#undef ATOMIC_OP
+template <MachineRepresentation rep, MachineSemantic sem>
+struct PoisonedLoadOperator : public Operator1<LoadRepresentation> {
+  PoisonedLoadOperator()
+      : Operator1(IrOpcode::kPoisonedLoad, Operator::kEliminatable,
+                  "PoisonedLoad", 2, 1, 1, 1, 1, 0,
+                  LoadRepresentation(rep, sem)) {}
+};
 
-#define ATOMIC_COMPARE_EXCHANGE(Type)                                          \
-  struct Word32AtomicCompareExchange##Type##Operator                           \
-      : public Operator1<MachineType> {                                        \
-    Word32AtomicCompareExchange##Type##Operator()                              \
-        : Operator1<MachineType>(IrOpcode::kWord32AtomicCompareExchange,       \
-                                 Operator::kNoDeopt | Operator::kNoThrow,      \
-                                 "Word32AtomicCompareExchange", 4, 1, 1, 1, 1, \
-                                 0, MachineType::Type()) {}                    \
-  };                                                                           \
-  Word32AtomicCompareExchange##Type##Operator                                  \
-      kWord32AtomicCompareExchange##Type;
-  ATOMIC_TYPE_LIST(ATOMIC_COMPARE_EXCHANGE)
-#undef ATOMIC_COMPARE_EXCHANGE
-
-#define ATOMIC_COMPARE_EXCHANGE(Type)                                          \
-  struct Word64AtomicCompareExchange##Type##Operator                           \
-      : public Operator1<MachineType> {                                        \
-    Word64AtomicCompareExchange##Type##Operator()                              \
-        : Operator1<MachineType>(IrOpcode::kWord64AtomicCompareExchange,       \
-                                 Operator::kNoDeopt | Operator::kNoThrow,      \
-                                 "Word64AtomicCompareExchange", 4, 1, 1, 1, 1, \
-                                 0, MachineType::Type()) {}                    \
-  };                                                                           \
-  Word64AtomicCompareExchange##Type##Operator                                  \
-      kWord64AtomicCompareExchange##Type;
-  ATOMIC_U64_TYPE_LIST(ATOMIC_COMPARE_EXCHANGE)
-#undef ATOMIC_COMPARE_EXCHANGE
-
-  struct Word32AtomicPairLoadOperator : public Operator {
-    Word32AtomicPairLoadOperator()
-        : Operator(IrOpcode::kWord32AtomicPairLoad,
-                   Operator::kNoDeopt | Operator::kNoThrow,
-                   "Word32AtomicPairLoad", 2, 1, 1, 2, 1, 0) {}
-  };
-  Word32AtomicPairLoadOperator kWord32AtomicPairLoad;
+template <MachineRepresentation rep, MachineSemantic sem>
+struct UnalignedLoadOperator : public Operator1<LoadRepresentation> {
+  UnalignedLoadOperator()
+      : Operator1(IrOpcode::kUnalignedLoad, Operator::kEliminatable,
+                  "UnalignedLoad", 2, 1, 1, 1, 1, 0,
+                  LoadRepresentation(rep, sem)) {}
+};
+
+template <MachineRepresentation rep, MachineSemantic sem>
+struct ProtectedLoadOperator : public Operator1<LoadRepresentation> {
+  ProtectedLoadOperator()
+      : Operator1(IrOpcode::kProtectedLoad,
+                  Operator::kNoDeopt | Operator::kNoThrow, "ProtectedLoad", 2,
+                  1, 1, 1, 1, 0, LoadRepresentation(rep, sem)) {}
+};
+
+template <LoadKind kind, LoadTransformation type>
+struct LoadTransformOperator : public Operator1<LoadTransformParameters> {
+  LoadTransformOperator()
+      : Operator1(IrOpcode::kLoadTransform, Operator::kEliminatable,
+                  "LoadTransform", 2, 1, 1, 1, 1, 0,
+                  LoadTransformParameters{kind, type}) {}
+};
+
+template <MachineRepresentation rep, WriteBarrierKind write_barrier_kind>
+struct StoreOperator : public Operator1<StoreRepresentation> {
+  StoreOperator()
+      : Operator1(IrOpcode::kStore,
+                  Operator::kNoDeopt | Operator::kNoRead | Operator::kNoThrow,
+                  "Store", 3, 1, 1, 0, 1, 0,
+                  StoreRepresentation(rep, write_barrier_kind)) {}
+};
+
+template <MachineRepresentation rep>
+struct UnalignedStoreOperator : public Operator1<UnalignedStoreRepresentation> {
+  UnalignedStoreOperator()
+      : Operator1(IrOpcode::kUnalignedStore,
+                  Operator::kNoDeopt | Operator::kNoRead | Operator::kNoThrow,
+                  "UnalignedStore", 3, 1, 1, 0, 1, 0, rep) {}
+};
+
+template <MachineRepresentation rep>
+struct ProtectedStoreOperator : public Operator1<StoreRepresentation> {
+  ProtectedStoreOperator()
+      : Operator1(IrOpcode::kProtectedStore,
+                  Operator::kNoDeopt | Operator::kNoRead | Operator::kNoThrow,
+                  "Store", 3, 1, 1, 0, 1, 0,
+                  StoreRepresentation(rep, kNoWriteBarrier)) {}
+};
 
-  struct Word32AtomicPairStoreOperator : public Operator {
-    Word32AtomicPairStoreOperator()
-        : Operator(IrOpcode::kWord32AtomicPairStore,
-                   Operator::kNoDeopt | Operator::kNoThrow,
-                   "Word32AtomicPairStore", 4, 1, 1, 0, 1, 0) {}
+template <MachineRepresentation rep, MachineSemantic sem>
+struct Word32AtomicLoadOperator : public Operator1<LoadRepresentation> {
+  Word32AtomicLoadOperator()
+      : Operator1(IrOpcode::kWord32AtomicLoad, Operator::kEliminatable,
+                  "Word32AtomicLoad", 2, 1, 1, 1, 1, 0, MachineType(rep, sem)) {
+  }
+};
+
+template <MachineRepresentation rep, MachineSemantic sem>
+struct Word64AtomicLoadOperator : public Operator1<LoadRepresentation> {
+  Word64AtomicLoadOperator()
+      : Operator1(IrOpcode::kWord64AtomicLoad, Operator::kEliminatable,
+                  "Word64AtomicLoad", 2, 1, 1, 1, 1, 0, MachineType(rep, sem)) {
+  }
+};
+
+template <MachineRepresentation rep>
+struct Word32AtomicStoreOperator : public Operator1<MachineRepresentation> {
+  Word32AtomicStoreOperator()
+      : Operator1(IrOpcode::kWord32AtomicStore,
+                  Operator::kNoDeopt | Operator::kNoRead | Operator::kNoThrow,
+                  "Word32AtomicStore", 3, 1, 1, 0, 1, 0, rep) {}
+};
+
+template <MachineRepresentation rep>
+struct Word64AtomicStoreOperator : public Operator1<MachineRepresentation> {
+  Word64AtomicStoreOperator()
+      : Operator1(IrOpcode::kWord64AtomicStore,
+                  Operator::kNoDeopt | Operator::kNoRead | Operator::kNoThrow,
+                  "Word64AtomicStore", 3, 1, 1, 0, 1, 0, rep) {}
+};
+
+#define ATOMIC_OP(op)                                                         \
+  template <MachineRepresentation rep, MachineSemantic sem>                   \
+  struct op##Operator : public Operator1<MachineType> {                       \
+    op##Operator()                                                            \
+        : Operator1(IrOpcode::k##op, Operator::kNoDeopt | Operator::kNoThrow, \
+                    #op, 3, 1, 1, 1, 1, 0, MachineType(rep, sem)) {}          \
   };
-  Word32AtomicPairStoreOperator kWord32AtomicPairStore;
+ATOMIC_OP(Word32AtomicAdd)
+ATOMIC_OP(Word32AtomicSub)
+ATOMIC_OP(Word32AtomicAnd)
+ATOMIC_OP(Word32AtomicOr)
+ATOMIC_OP(Word32AtomicXor)
+ATOMIC_OP(Word32AtomicExchange)
+ATOMIC_OP(Word64AtomicAdd)
+ATOMIC_OP(Word64AtomicSub)
+ATOMIC_OP(Word64AtomicAnd)
+ATOMIC_OP(Word64AtomicOr)
+ATOMIC_OP(Word64AtomicXor)
+ATOMIC_OP(Word64AtomicExchange)
+#undef ATOMIC_OP
+
+template <MachineRepresentation rep, MachineSemantic sem>
+struct Word32AtomicCompareExchangeOperator : public Operator1<MachineType> {
+  Word32AtomicCompareExchangeOperator()
+      : Operator1(IrOpcode::kWord32AtomicCompareExchange,
+                  Operator::kNoDeopt | Operator::kNoThrow,
+                  "Word32AtomicCompareExchange", 4, 1, 1, 1, 1, 0,
+                  MachineType(rep, sem)) {}
+};
+
+template <MachineRepresentation rep, MachineSemantic sem>
+struct Word64AtomicCompareExchangeOperator : public Operator1<MachineType> {
+  Word64AtomicCompareExchangeOperator()
+      : Operator1(IrOpcode::kWord64AtomicCompareExchange,
+                  Operator::kNoDeopt | Operator::kNoThrow,
+                  "Word64AtomicCompareExchange", 4, 1, 1, 1, 1, 0,
+                  MachineType(rep, sem)) {}
+};
+
+struct Word32AtomicPairLoadOperator : public Operator {
+  Word32AtomicPairLoadOperator()
+      : Operator(IrOpcode::kWord32AtomicPairLoad,
+                 Operator::kNoDeopt | Operator::kNoThrow,
+                 "Word32AtomicPairLoad", 2, 1, 1, 2, 1, 0) {}
+};
+
+struct Word32AtomicPairStoreOperator : public Operator {
+  Word32AtomicPairStoreOperator()
+      : Operator(IrOpcode::kWord32AtomicPairStore,
+                 Operator::kNoDeopt | Operator::kNoThrow,
+                 "Word32AtomicPairStore", 4, 1, 1, 0, 1, 0) {}
+};
 
 #define ATOMIC_PAIR_OP(op)                                      \
   struct Word32AtomicPair##op##Operator : public Operator {     \
     Word32AtomicPair##op##Operator()                            \
         : Operator(IrOpcode::kWord32AtomicPair##op,             \
                    Operator::kNoDeopt | Operator::kNoThrow,     \
-                   "Word32AtomicPair##op", 4, 1, 1, 2, 1, 0) {} \
-  };                                                            \
-  Word32AtomicPair##op##Operator kWord32AtomicPair##op;
-  ATOMIC_PAIR_BINOP_LIST(ATOMIC_PAIR_OP)
+                   "Word32AtomicPair" #op, 4, 1, 1, 2, 1, 0) {} \
+  };
+ATOMIC_PAIR_OP(Add)
+ATOMIC_PAIR_OP(Sub)
+ATOMIC_PAIR_OP(And)
+ATOMIC_PAIR_OP(Or)
+ATOMIC_PAIR_OP(Xor)
+ATOMIC_PAIR_OP(Exchange)
 #undef ATOMIC_PAIR_OP
-#undef ATOMIC_PAIR_BINOP_LIST
 
-  struct Word32AtomicPairCompareExchangeOperator : public Operator {
-    Word32AtomicPairCompareExchangeOperator()
-        : Operator(IrOpcode::kWord32AtomicPairCompareExchange,
-                   Operator::kNoDeopt | Operator::kNoThrow,
-                   "Word32AtomicPairCompareExchange", 6, 1, 1, 2, 1, 0) {}
-  };
-  Word32AtomicPairCompareExchangeOperator kWord32AtomicPairCompareExchange;
+struct Word32AtomicPairCompareExchangeOperator : public Operator {
+  Word32AtomicPairCompareExchangeOperator()
+      : Operator(IrOpcode::kWord32AtomicPairCompareExchange,
+                 Operator::kNoDeopt | Operator::kNoThrow,
+                 "Word32AtomicPairCompareExchange", 6, 1, 1, 2, 1, 0) {}
+};
 
-  struct MemoryBarrierOperator : public Operator {
-    MemoryBarrierOperator()
-        : Operator(IrOpcode::kMemoryBarrier,
-                   Operator::kNoDeopt | Operator::kNoThrow, "MemoryBarrier", 0,
-                   1, 1, 0, 1, 0) {}
-  };
-  MemoryBarrierOperator kMemoryBarrier;
-
-  // The {BitcastWordToTagged} operator must not be marked as pure (especially
-  // not idempotent), because otherwise the splitting logic in the Scheduler
-  // might decide to split these operators, thus potentially creating live
-  // ranges of allocation top across calls or other things that might allocate.
-  // See https://bugs.chromium.org/p/v8/issues/detail?id=6059 for more details.
-  struct BitcastWordToTaggedOperator : public Operator {
-    BitcastWordToTaggedOperator()
-        : Operator(IrOpcode::kBitcastWordToTagged,
-                   Operator::kEliminatable | Operator::kNoWrite,
-                   "BitcastWordToTagged", 1, 1, 1, 1, 1, 0) {}
-  };
-  BitcastWordToTaggedOperator kBitcastWordToTagged;
+struct MemoryBarrierOperator : public Operator {
+  MemoryBarrierOperator()
+      : Operator(IrOpcode::kMemoryBarrier,
+                 Operator::kNoDeopt | Operator::kNoThrow, "MemoryBarrier", 0, 1,
+                 1, 0, 1, 0) {}
+};
 
-  struct BitcastTaggedToWordOperator : public Operator {
-    BitcastTaggedToWordOperator()
-        : Operator(IrOpcode::kBitcastTaggedToWord,
-                   Operator::kEliminatable | Operator::kNoWrite,
-                   "BitcastTaggedToWord", 1, 1, 1, 1, 1, 0) {}
-  };
-  BitcastTaggedToWordOperator kBitcastTaggedToWord;
+// The {BitcastWordToTagged} operator must not be marked as pure (especially
+// not idempotent), because otherwise the splitting logic in the Scheduler
+// might decide to split these operators, thus potentially creating live
+// ranges of allocation top across calls or other things that might allocate.
+// See https://bugs.chromium.org/p/v8/issues/detail?id=6059 for more details.
+struct BitcastWordToTaggedOperator : public Operator {
+  BitcastWordToTaggedOperator()
+      : Operator(IrOpcode::kBitcastWordToTagged,
+                 Operator::kEliminatable | Operator::kNoWrite,
+                 "BitcastWordToTagged", 1, 1, 1, 1, 1, 0) {}
+};
 
-  struct BitcastMaybeObjectToWordOperator : public Operator {
-    BitcastMaybeObjectToWordOperator()
-        : Operator(IrOpcode::kBitcastTaggedToWord,
-                   Operator::kEliminatable | Operator::kNoWrite,
-                   "BitcastMaybeObjectToWord", 1, 1, 1, 1, 1, 0) {}
-  };
-  BitcastMaybeObjectToWordOperator kBitcastMaybeObjectToWord;
+struct BitcastTaggedToWordOperator : public Operator {
+  BitcastTaggedToWordOperator()
+      : Operator(IrOpcode::kBitcastTaggedToWord,
+                 Operator::kEliminatable | Operator::kNoWrite,
+                 "BitcastTaggedToWord", 1, 1, 1, 1, 1, 0) {}
+};
 
-  struct TaggedPoisonOnSpeculation : public Operator {
-    TaggedPoisonOnSpeculation()
-        : Operator(IrOpcode::kTaggedPoisonOnSpeculation,
-                   Operator::kEliminatable | Operator::kNoWrite,
-                   "TaggedPoisonOnSpeculation", 1, 1, 1, 1, 1, 0) {}
-  };
-  TaggedPoisonOnSpeculation kTaggedPoisonOnSpeculation;
+struct BitcastMaybeObjectToWordOperator : public Operator {
+  BitcastMaybeObjectToWordOperator()
+      : Operator(IrOpcode::kBitcastTaggedToWord,
+                 Operator::kEliminatable | Operator::kNoWrite,
+                 "BitcastMaybeObjectToWord", 1, 1, 1, 1, 1, 0) {}
+};
 
-  struct Word32PoisonOnSpeculation : public Operator {
-    Word32PoisonOnSpeculation()
-        : Operator(IrOpcode::kWord32PoisonOnSpeculation,
-                   Operator::kEliminatable | Operator::kNoWrite,
-                   "Word32PoisonOnSpeculation", 1, 1, 1, 1, 1, 0) {}
-  };
-  Word32PoisonOnSpeculation kWord32PoisonOnSpeculation;
+struct TaggedPoisonOnSpeculationOperator : public Operator {
+  TaggedPoisonOnSpeculationOperator()
+      : Operator(IrOpcode::kTaggedPoisonOnSpeculation,
+                 Operator::kEliminatable | Operator::kNoWrite,
+                 "TaggedPoisonOnSpeculation", 1, 1, 1, 1, 1, 0) {}
+};
 
-  struct Word64PoisonOnSpeculation : public Operator {
-    Word64PoisonOnSpeculation()
-        : Operator(IrOpcode::kWord64PoisonOnSpeculation,
-                   Operator::kEliminatable | Operator::kNoWrite,
-                   "Word64PoisonOnSpeculation", 1, 1, 1, 1, 1, 0) {}
-  };
-  Word64PoisonOnSpeculation kWord64PoisonOnSpeculation;
+struct Word32PoisonOnSpeculationOperator : public Operator {
+  Word32PoisonOnSpeculationOperator()
+      : Operator(IrOpcode::kWord32PoisonOnSpeculation,
+                 Operator::kEliminatable | Operator::kNoWrite,
+                 "Word32PoisonOnSpeculation", 1, 1, 1, 1, 1, 0) {}
+};
 
-  struct AbortCSAAssertOperator : public Operator {
-    AbortCSAAssertOperator()
-        : Operator(IrOpcode::kAbortCSAAssert, Operator::kNoThrow,
-                   "AbortCSAAssert", 1, 1, 1, 0, 1, 0) {}
-  };
-  AbortCSAAssertOperator kAbortCSAAssert;
+struct Word64PoisonOnSpeculationOperator : public Operator {
+  Word64PoisonOnSpeculationOperator()
+      : Operator(IrOpcode::kWord64PoisonOnSpeculation,
+                 Operator::kEliminatable | Operator::kNoWrite,
+                 "Word64PoisonOnSpeculation", 1, 1, 1, 1, 1, 0) {}
+};
 
-  struct DebugBreakOperator : public Operator {
-    DebugBreakOperator()
-        : Operator(IrOpcode::kDebugBreak, Operator::kNoThrow, "DebugBreak", 0,
-                   1, 1, 0, 1, 0) {}
-  };
-  DebugBreakOperator kDebugBreak;
+struct AbortCSAAssertOperator : public Operator {
+  AbortCSAAssertOperator()
+      : Operator(IrOpcode::kAbortCSAAssert, Operator::kNoThrow,
+                 "AbortCSAAssert", 1, 1, 1, 0, 1, 0) {}
+};
 
-  struct UnsafePointerAddOperator final : public Operator {
-    UnsafePointerAddOperator()
-        : Operator(IrOpcode::kUnsafePointerAdd, Operator::kKontrol,
-                   "UnsafePointerAdd", 2, 1, 1, 1, 1, 0) {}
-  };
-  UnsafePointerAddOperator kUnsafePointerAdd;
+struct DebugBreakOperator : public Operator {
+  DebugBreakOperator()
+      : Operator(IrOpcode::kDebugBreak, Operator::kNoThrow, "DebugBreak", 0, 1,
+                 1, 0, 1, 0) {}
+};
 
-  struct StackPointerGreaterThanOperator : public Operator1<StackCheckKind> {
-    explicit StackPointerGreaterThanOperator(StackCheckKind kind)
-        : Operator1<StackCheckKind>(
-              IrOpcode::kStackPointerGreaterThan, Operator::kEliminatable,
-              "StackPointerGreaterThan", 1, 1, 0, 1, 1, 0, kind) {}
-  };
-#define STACK_POINTER_GREATER_THAN(Kind)                              \
-  struct StackPointerGreaterThan##Kind##Operator final                \
-      : public StackPointerGreaterThanOperator {                      \
-    StackPointerGreaterThan##Kind##Operator()                         \
-        : StackPointerGreaterThanOperator(StackCheckKind::k##Kind) {} \
-  };                                                                  \
-  StackPointerGreaterThan##Kind##Operator kStackPointerGreaterThan##Kind;
-
-  STACK_POINTER_GREATER_THAN(JSFunctionEntry)
-  STACK_POINTER_GREATER_THAN(JSIterationBody)
-  STACK_POINTER_GREATER_THAN(CodeStubAssembler)
-  STACK_POINTER_GREATER_THAN(Wasm)
-#undef STACK_POINTER_GREATER_THAN
+struct UnsafePointerAddOperator : public Operator {
+  UnsafePointerAddOperator()
+      : Operator(IrOpcode::kUnsafePointerAdd, Operator::kKontrol,
+                 "UnsafePointerAdd", 2, 1, 1, 1, 1, 0) {}
+};
+
+template <StackCheckKind kind>
+struct StackPointerGreaterThanOperator : public Operator1<StackCheckKind> {
+  StackPointerGreaterThanOperator()
+      : Operator1(IrOpcode::kStackPointerGreaterThan, Operator::kEliminatable,
+                  "StackPointerGreaterThan", 1, 1, 0, 1, 1, 0, kind) {}
 };
 
 struct CommentOperator : public Operator1<const char*> {
   explicit CommentOperator(const char* msg)
-      : Operator1<const char*>(IrOpcode::kComment, Operator::kNoThrow,
-                               "Comment", 0, 1, 1, 0, 1, 0, msg) {}
+      : Operator1(IrOpcode::kComment, Operator::kNoThrow, "Comment", 0, 1, 1, 0,
+                  1, 0, msg) {}
 };
 
-namespace {
-DEFINE_LAZY_LEAKY_OBJECT_GETTER(MachineOperatorGlobalCache,
-                                GetMachineOperatorGlobalCache)
-}
-
 MachineOperatorBuilder::MachineOperatorBuilder(
     Zone* zone, MachineRepresentation word, Flags flags,
     AlignmentRequirements alignmentRequirements)
     : zone_(zone),
-      cache_(*GetMachineOperatorGlobalCache()),
       word_(word),
       flags_(flags),
       alignment_requirements_(alignmentRequirements) {
@@ -1032,9 +976,11 @@ MachineOperatorBuilder::MachineOperatorBuilder(
 }
 
 const Operator* MachineOperatorBuilder::UnalignedLoad(LoadRepresentation rep) {
-#define LOAD(Type)                       \
-  if (rep == MachineType::Type()) {      \
-    return &cache_.kUnalignedLoad##Type; \
+#define LOAD(Type)                                                  \
+  if (rep == MachineType::Type()) {                                 \
+    return GetCachedOperator<                                       \
+        UnalignedLoadOperator<MachineType::Type().representation(), \
+                              MachineType::Type().semantic()>>();   \
   }
   MACHINE_TYPE_LIST(LOAD)
 #undef LOAD
@@ -1046,7 +992,8 @@ const Operator* MachineOperatorBuilder::UnalignedStore(
   switch (rep) {
 #define STORE(kRep)                 \
   case MachineRepresentation::kRep: \
-    return &cache_.kUnalignedStore##kRep;
+    return GetCachedOperator<       \
+        UnalignedStoreOperator<MachineRepresentation::kRep>>();
     MACHINE_REPRESENTATION_LIST(STORE)
 #undef STORE
     case MachineRepresentation::kBit:
@@ -1056,39 +1003,35 @@ const Operator* MachineOperatorBuilder::UnalignedStore(
   UNREACHABLE();
 }
 
-#define PURE(Name, properties, value_input_count, control_input_count, \
-             output_count)                                             \
-  const Operator* MachineOperatorBuilder::Name() { return &cache_.k##Name; }
-MACHINE_PURE_OP_LIST(PURE)
-#undef PURE
-
-#define PURE(Name, properties, value_input_count, control_input_count, \
-             output_count)                                             \
-  const OptionalOperator MachineOperatorBuilder::Name() {              \
-    return OptionalOperator(flags_ & k##Name, &cache_.k##Name);        \
+#define PURE(Name, properties, value_input_count, control_input_count,     \
+             output_count)                                                 \
+  const Operator* MachineOperatorBuilder::Name() {                         \
+    return GetCachedOperator<                                              \
+        CachedPureOperator<IrOpcode::k##Name, value_input_count,           \
+                           control_input_count, output_count>>(properties, \
+                                                               #Name);     \
   }
-PURE_OPTIONAL_OP_LIST(PURE)
+MACHINE_PURE_OP_LIST(PURE)
 #undef PURE
 
-#define OVERFLOW_OP(Name, properties) \
-  const Operator* MachineOperatorBuilder::Name() { return &cache_.k##Name; }
-OVERFLOW_OP_LIST(OVERFLOW_OP)
-#undef OVERFLOW_OP
-
 const Operator* MachineOperatorBuilder::Load(LoadRepresentation rep) {
-#define LOAD(Type)                  \
-  if (rep == MachineType::Type()) { \
-    return &cache_.kLoad##Type;     \
+#define LOAD(Type)                                         \
+  if (rep == MachineType::Type()) {                        \
+    return GetCachedOperator<                              \
+        LoadOperator<MachineType::Type().representation(), \
+                     MachineType::Type().semantic()>>();   \
   }
-    MACHINE_TYPE_LIST(LOAD)
+  MACHINE_TYPE_LIST(LOAD)
 #undef LOAD
   UNREACHABLE();
 }
 
 const Operator* MachineOperatorBuilder::PoisonedLoad(LoadRepresentation rep) {
-#define LOAD(Type)                      \
-  if (rep == MachineType::Type()) {     \
-    return &cache_.kPoisonedLoad##Type; \
+#define LOAD(Type)                                                 \
+  if (rep == MachineType::Type()) {                                \
+    return GetCachedOperator<                                      \
+        PoisonedLoadOperator<MachineType::Type().representation(), \
+                             MachineType::Type().semantic()>>();   \
   }
   MACHINE_TYPE_LIST(LOAD)
 #undef LOAD
@@ -1096,9 +1039,11 @@ const Operator* MachineOperatorBuilder::PoisonedLoad(LoadRepresentation rep) {
 }
 
 const Operator* MachineOperatorBuilder::ProtectedLoad(LoadRepresentation rep) {
-#define LOAD(Type)                       \
-  if (rep == MachineType::Type()) {      \
-    return &cache_.kProtectedLoad##Type; \
+#define LOAD(Type)                                                  \
+  if (rep == MachineType::Type()) {                                 \
+    return GetCachedOperator<                                       \
+        ProtectedLoadOperator<MachineType::Type().representation(), \
+                              MachineType::Type().semantic()>>();   \
   }
   MACHINE_TYPE_LIST(LOAD)
 #undef LOAD
@@ -1109,7 +1054,8 @@ const Operator* MachineOperatorBuilder::LoadTransform(
     LoadKind kind, LoadTransformation transform) {
 #define LOAD_TRANSFORM_KIND(TYPE, KIND)                                        \
   if (kind == LoadKind::k##KIND && transform == LoadTransformation::k##TYPE) { \
-    return &cache_.k##KIND##LoadTransform##TYPE;                               \
+    return GetCachedOperator<LoadTransformOperator<                            \
+        LoadKind::k##KIND, LoadTransformation::k##TYPE>>();                    \
   }
 #define LOAD_TRANSFORM(TYPE)           \
   LOAD_TRANSFORM_KIND(TYPE, Normal)    \
@@ -1125,9 +1071,9 @@ const Operator* MachineOperatorBuilder::LoadTransform(
 const Operator* MachineOperatorBuilder::StackSlot(int size, int alignment) {
   DCHECK_LE(0, size);
   DCHECK(alignment == 0 || alignment == 4 || alignment == 8 || alignment == 16);
-#define CASE_CACHED_SIZE(Size, Alignment)                          \
-  if (size == Size && alignment == Alignment) {                    \
-    return &cache_.kStackSlotOfSize##Size##OfAlignment##Alignment; \
+#define CASE_CACHED_SIZE(Size, Alignment)                                 \
+  if (size == Size && alignment == Alignment) {                           \
+    return GetCachedOperator<CachedStackSlotOperator<Size, Alignment>>(); \
   }
 
   STACK_SLOT_CACHED_SIZES_ALIGNMENTS_LIST(CASE_CACHED_SIZE)
@@ -1143,22 +1089,28 @@ const Operator* MachineOperatorBuilder::StackSlot(MachineRepresentation rep,
 
 const Operator* MachineOperatorBuilder::Store(StoreRepresentation store_rep) {
   switch (store_rep.representation()) {
-#define STORE(kRep)                                              \
-  case MachineRepresentation::kRep:                              \
-    switch (store_rep.write_barrier_kind()) {                    \
-      case kNoWriteBarrier:                                      \
-        return &cache_.k##Store##kRep##NoWriteBarrier;           \
-      case kAssertNoWriteBarrier:                                \
-        return &cache_.k##Store##kRep##AssertNoWriteBarrier;     \
-      case kMapWriteBarrier:                                     \
-        return &cache_.k##Store##kRep##MapWriteBarrier;          \
-      case kPointerWriteBarrier:                                 \
-        return &cache_.k##Store##kRep##PointerWriteBarrier;      \
-      case kEphemeronKeyWriteBarrier:                            \
-        return &cache_.k##Store##kRep##EphemeronKeyWriteBarrier; \
-      case kFullWriteBarrier:                                    \
-        return &cache_.k##Store##kRep##FullWriteBarrier;         \
-    }                                                            \
+#define STORE(kRep)                                                           \
+  case MachineRepresentation::kRep:                                           \
+    switch (store_rep.write_barrier_kind()) {                                 \
+      case kNoWriteBarrier:                                                   \
+        return GetCachedOperator<                                             \
+            StoreOperator<MachineRepresentation::kRep, kNoWriteBarrier>>();   \
+      case kAssertNoWriteBarrier:                                             \
+        return GetCachedOperator<StoreOperator<MachineRepresentation::kRep,   \
+                                               kAssertNoWriteBarrier>>();     \
+      case kMapWriteBarrier:                                                  \
+        return GetCachedOperator<                                             \
+            StoreOperator<MachineRepresentation::kRep, kMapWriteBarrier>>();  \
+      case kPointerWriteBarrier:                                              \
+        return GetCachedOperator<StoreOperator<MachineRepresentation::kRep,   \
+                                               kPointerWriteBarrier>>();      \
+      case kEphemeronKeyWriteBarrier:                                         \
+        return GetCachedOperator<StoreOperator<MachineRepresentation::kRep,   \
+                                               kEphemeronKeyWriteBarrier>>(); \
+      case kFullWriteBarrier:                                                 \
+        return GetCachedOperator<                                             \
+            StoreOperator<MachineRepresentation::kRep, kFullWriteBarrier>>(); \
+    }                                                                         \
     break;
     MACHINE_REPRESENTATION_LIST(STORE)
 #undef STORE
@@ -1172,9 +1124,10 @@ const Operator* MachineOperatorBuilder::Store(StoreRepresentation store_rep) {
 const Operator* MachineOperatorBuilder::ProtectedStore(
     MachineRepresentation rep) {
   switch (rep) {
-#define STORE(kRep)                       \
-  case MachineRepresentation::kRep:       \
-    return &cache_.kProtectedStore##kRep; \
+#define STORE(kRep)                                             \
+  case MachineRepresentation::kRep:                             \
+    return GetCachedOperator<                                   \
+        ProtectedStoreOperator<MachineRepresentation::kRep>>(); \
     break;
     MACHINE_REPRESENTATION_LIST(STORE)
 #undef STORE
@@ -1186,42 +1139,46 @@ const Operator* MachineOperatorBuilder::ProtectedStore(
 }
 
 const Operator* MachineOperatorBuilder::UnsafePointerAdd() {
-  return &cache_.kUnsafePointerAdd;
+  return GetCachedOperator<UnsafePointerAddOperator>();
 }
 
 const Operator* MachineOperatorBuilder::StackPointerGreaterThan(
     StackCheckKind kind) {
   switch (kind) {
     case StackCheckKind::kJSFunctionEntry:
-      return &cache_.kStackPointerGreaterThanJSFunctionEntry;
+      return GetCachedOperator<
+          StackPointerGreaterThanOperator<StackCheckKind::kJSFunctionEntry>>();
     case StackCheckKind::kJSIterationBody:
-      return &cache_.kStackPointerGreaterThanJSIterationBody;
+      return GetCachedOperator<
+          StackPointerGreaterThanOperator<StackCheckKind::kJSIterationBody>>();
     case StackCheckKind::kCodeStubAssembler:
-      return &cache_.kStackPointerGreaterThanCodeStubAssembler;
+      return GetCachedOperator<StackPointerGreaterThanOperator<
+          StackCheckKind::kCodeStubAssembler>>();
     case StackCheckKind::kWasm:
-      return &cache_.kStackPointerGreaterThanWasm;
+      return GetCachedOperator<
+          StackPointerGreaterThanOperator<StackCheckKind::kWasm>>();
   }
   UNREACHABLE();
 }
 
 const Operator* MachineOperatorBuilder::BitcastWordToTagged() {
-  return &cache_.kBitcastWordToTagged;
+  return GetCachedOperator<BitcastWordToTaggedOperator>();
 }
 
 const Operator* MachineOperatorBuilder::BitcastTaggedToWord() {
-  return &cache_.kBitcastTaggedToWord;
+  return GetCachedOperator<BitcastTaggedToWordOperator>();
 }
 
 const Operator* MachineOperatorBuilder::BitcastMaybeObjectToWord() {
-  return &cache_.kBitcastMaybeObjectToWord;
+  return GetCachedOperator<BitcastMaybeObjectToWordOperator>();
 }
 
 const Operator* MachineOperatorBuilder::AbortCSAAssert() {
-  return &cache_.kAbortCSAAssert;
+  return GetCachedOperator<AbortCSAAssertOperator>();
 }
 
 const Operator* MachineOperatorBuilder::DebugBreak() {
-  return &cache_.kDebugBreak;
+  return GetCachedOperator<DebugBreakOperator>();
 }
 
 const Operator* MachineOperatorBuilder::Comment(const char* msg) {
@@ -1229,14 +1186,16 @@ const Operator* MachineOperatorBuilder::Comment(const char* msg) {
 }
 
 const Operator* MachineOperatorBuilder::MemBarrier() {
-  return &cache_.kMemoryBarrier;
+  return GetCachedOperator<MemoryBarrierOperator>();
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicLoad(
     LoadRepresentation rep) {
-#define LOAD(Type)                          \
-  if (rep == MachineType::Type()) {         \
-    return &cache_.kWord32AtomicLoad##Type; \
+#define LOAD(Type)                                                     \
+  if (rep == MachineType::Type()) {                                    \
+    return GetCachedOperator<                                          \
+        Word32AtomicLoadOperator<MachineType::Type().representation(), \
+                                 MachineType::Type().semantic()>>();   \
   }
   ATOMIC_TYPE_LIST(LOAD)
 #undef LOAD
@@ -1245,9 +1204,10 @@ const Operator* MachineOperatorBuilder::Word32AtomicLoad(
 
 const Operator* MachineOperatorBuilder::Word32AtomicStore(
     MachineRepresentation rep) {
-#define STORE(kRep)                          \
-  if (rep == MachineRepresentation::kRep) {  \
-    return &cache_.kWord32AtomicStore##kRep; \
+#define STORE(kRep)                                                \
+  if (rep == MachineRepresentation::kRep) {                        \
+    return GetCachedOperator<                                      \
+        Word32AtomicStoreOperator<MachineRepresentation::kRep>>(); \
   }
   ATOMIC_REPRESENTATION_LIST(STORE)
 #undef STORE
@@ -1255,9 +1215,11 @@ const Operator* MachineOperatorBuilder::Word32AtomicStore(
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicExchange(MachineType type) {
-#define EXCHANGE(kType)                          \
-  if (type == MachineType::kType()) {            \
-    return &cache_.kWord32AtomicExchange##kType; \
+#define EXCHANGE(Type)                                                     \
+  if (type == MachineType::Type()) {                                       \
+    return GetCachedOperator<                                              \
+        Word32AtomicExchangeOperator<MachineType::Type().representation(), \
+                                     MachineType::Type().semantic()>>();   \
   }
   ATOMIC_TYPE_LIST(EXCHANGE)
 #undef EXCHANGE
@@ -1266,9 +1228,11 @@ const Operator* MachineOperatorBuilder::Word32AtomicExchange(MachineType type) {
 
 const Operator* MachineOperatorBuilder::Word32AtomicCompareExchange(
     MachineType type) {
-#define COMPARE_EXCHANGE(kType)                         \
-  if (type == MachineType::kType()) {                   \
-    return &cache_.kWord32AtomicCompareExchange##kType; \
+#define COMPARE_EXCHANGE(Type)                                    \
+  if (type == MachineType::Type()) {                              \
+    return GetCachedOperator<Word32AtomicCompareExchangeOperator< \
+        MachineType::Type().representation(),                     \
+        MachineType::Type().semantic()>>();                       \
   }
   ATOMIC_TYPE_LIST(COMPARE_EXCHANGE)
 #undef COMPARE_EXCHANGE
@@ -1276,9 +1240,11 @@ const Operator* MachineOperatorBuilder::Word32AtomicCompareExchange(
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicAdd(MachineType type) {
-#define ADD(kType)                          \
-  if (type == MachineType::kType()) {       \
-    return &cache_.kWord32AtomicAdd##kType; \
+#define ADD(Type)                                                     \
+  if (type == MachineType::Type()) {                                  \
+    return GetCachedOperator<                                         \
+        Word32AtomicAddOperator<MachineType::Type().representation(), \
+                                MachineType::Type().semantic()>>();   \
   }
   ATOMIC_TYPE_LIST(ADD)
 #undef ADD
@@ -1286,9 +1252,11 @@ const Operator* MachineOperatorBuilder::Word32AtomicAdd(MachineType type) {
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicSub(MachineType type) {
-#define SUB(kType)                          \
-  if (type == MachineType::kType()) {       \
-    return &cache_.kWord32AtomicSub##kType; \
+#define SUB(Type)                                                     \
+  if (type == MachineType::Type()) {                                  \
+    return GetCachedOperator<                                         \
+        Word32AtomicSubOperator<MachineType::Type().representation(), \
+                                MachineType::Type().semantic()>>();   \
   }
   ATOMIC_TYPE_LIST(SUB)
 #undef SUB
@@ -1296,9 +1264,11 @@ const Operator* MachineOperatorBuilder::Word32AtomicSub(MachineType type) {
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicAnd(MachineType type) {
-#define AND(kType)                          \
-  if (type == MachineType::kType()) {       \
-    return &cache_.kWord32AtomicAnd##kType; \
+#define AND(Type)                                                     \
+  if (type == MachineType::Type()) {                                  \
+    return GetCachedOperator<                                         \
+        Word32AtomicAndOperator<MachineType::Type().representation(), \
+                                MachineType::Type().semantic()>>();   \
   }
   ATOMIC_TYPE_LIST(AND)
 #undef AND
@@ -1306,9 +1276,11 @@ const Operator* MachineOperatorBuilder::Word32AtomicAnd(MachineType type) {
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicOr(MachineType type) {
-#define OR(kType)                          \
-  if (type == MachineType::kType()) {      \
-    return &cache_.kWord32AtomicOr##kType; \
+#define OR(Type)                                                     \
+  if (type == MachineType::Type()) {                                 \
+    return GetCachedOperator<                                        \
+        Word32AtomicOrOperator<MachineType::Type().representation(), \
+                               MachineType::Type().semantic()>>();   \
   }
   ATOMIC_TYPE_LIST(OR)
 #undef OR
@@ -1316,9 +1288,11 @@ const Operator* MachineOperatorBuilder::Word32AtomicOr(MachineType type) {
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicXor(MachineType type) {
-#define XOR(kType)                          \
-  if (type == MachineType::kType()) {       \
-    return &cache_.kWord32AtomicXor##kType; \
+#define XOR(Type)                                                     \
+  if (type == MachineType::Type()) {                                  \
+    return GetCachedOperator<                                         \
+        Word32AtomicXorOperator<MachineType::Type().representation(), \
+                                MachineType::Type().semantic()>>();   \
   }
   ATOMIC_TYPE_LIST(XOR)
 #undef XOR
@@ -1327,9 +1301,11 @@ const Operator* MachineOperatorBuilder::Word32AtomicXor(MachineType type) {
 
 const Operator* MachineOperatorBuilder::Word64AtomicLoad(
     LoadRepresentation rep) {
-#define LOAD(Type)                          \
-  if (rep == MachineType::Type()) {         \
-    return &cache_.kWord64AtomicLoad##Type; \
+#define LOAD(Type)                                                     \
+  if (rep == MachineType::Type()) {                                    \
+    return GetCachedOperator<                                          \
+        Word64AtomicLoadOperator<MachineType::Type().representation(), \
+                                 MachineType::Type().semantic()>>();   \
   }
   ATOMIC_U64_TYPE_LIST(LOAD)
 #undef LOAD
@@ -1338,9 +1314,10 @@ const Operator* MachineOperatorBuilder::Word64AtomicLoad(
 
 const Operator* MachineOperatorBuilder::Word64AtomicStore(
     MachineRepresentation rep) {
-#define STORE(kRep)                          \
-  if (rep == MachineRepresentation::kRep) {  \
-    return &cache_.kWord64AtomicStore##kRep; \
+#define STORE(kRep)                                                \
+  if (rep == MachineRepresentation::kRep) {                        \
+    return GetCachedOperator<                                      \
+        Word64AtomicStoreOperator<MachineRepresentation::kRep>>(); \
   }
   ATOMIC64_REPRESENTATION_LIST(STORE)
 #undef STORE
@@ -1348,9 +1325,11 @@ const Operator* MachineOperatorBuilder::Word64AtomicStore(
 }
 
 const Operator* MachineOperatorBuilder::Word64AtomicAdd(MachineType type) {
-#define ADD(kType)                          \
-  if (type == MachineType::kType()) {       \
-    return &cache_.kWord64AtomicAdd##kType; \
+#define ADD(Type)                                                     \
+  if (type == MachineType::Type()) {                                  \
+    return GetCachedOperator<                                         \
+        Word64AtomicAddOperator<MachineType::Type().representation(), \
+                                MachineType::Type().semantic()>>();   \
   }
   ATOMIC_U64_TYPE_LIST(ADD)
 #undef ADD
@@ -1358,9 +1337,11 @@ const Operator* MachineOperatorBuilder::Word64AtomicAdd(MachineType type) {
 }
 
 const Operator* MachineOperatorBuilder::Word64AtomicSub(MachineType type) {
-#define SUB(kType)                          \
-  if (type == MachineType::kType()) {       \
-    return &cache_.kWord64AtomicSub##kType; \
+#define SUB(Type)                                                     \
+  if (type == MachineType::Type()) {                                  \
+    return GetCachedOperator<                                         \
+        Word64AtomicSubOperator<MachineType::Type().representation(), \
+                                MachineType::Type().semantic()>>();   \
   }
   ATOMIC_U64_TYPE_LIST(SUB)
 #undef SUB
@@ -1368,9 +1349,11 @@ const Operator* MachineOperatorBuilder::Word64AtomicSub(MachineType type) {
 }
 
 const Operator* MachineOperatorBuilder::Word64AtomicAnd(MachineType type) {
-#define AND(kType)                          \
-  if (type == MachineType::kType()) {       \
-    return &cache_.kWord64AtomicAnd##kType; \
+#define AND(Type)                                                     \
+  if (type == MachineType::Type()) {                                  \
+    return GetCachedOperator<                                         \
+        Word64AtomicAndOperator<MachineType::Type().representation(), \
+                                MachineType::Type().semantic()>>();   \
   }
   ATOMIC_U64_TYPE_LIST(AND)
 #undef AND
@@ -1378,9 +1361,11 @@ const Operator* MachineOperatorBuilder::Word64AtomicAnd(MachineType type) {
 }
 
 const Operator* MachineOperatorBuilder::Word64AtomicOr(MachineType type) {
-#define OR(kType)                          \
-  if (type == MachineType::kType()) {      \
-    return &cache_.kWord64AtomicOr##kType; \
+#define OR(Type)                                                     \
+  if (type == MachineType::Type()) {                                 \
+    return GetCachedOperator<                                        \
+        Word64AtomicOrOperator<MachineType::Type().representation(), \
+                               MachineType::Type().semantic()>>();   \
   }
   ATOMIC_U64_TYPE_LIST(OR)
 #undef OR
@@ -1388,9 +1373,11 @@ const Operator* MachineOperatorBuilder::Word64AtomicOr(MachineType type) {
 }
 
 const Operator* MachineOperatorBuilder::Word64AtomicXor(MachineType type) {
-#define XOR(kType)                          \
-  if (type == MachineType::kType()) {       \
-    return &cache_.kWord64AtomicXor##kType; \
+#define XOR(Type)                                                     \
+  if (type == MachineType::Type()) {                                  \
+    return GetCachedOperator<                                         \
+        Word64AtomicXorOperator<MachineType::Type().representation(), \
+                                MachineType::Type().semantic()>>();   \
   }
   ATOMIC_U64_TYPE_LIST(XOR)
 #undef XOR
@@ -1398,9 +1385,11 @@ const Operator* MachineOperatorBuilder::Word64AtomicXor(MachineType type) {
 }
 
 const Operator* MachineOperatorBuilder::Word64AtomicExchange(MachineType type) {
-#define EXCHANGE(kType)                          \
-  if (type == MachineType::kType()) {            \
-    return &cache_.kWord64AtomicExchange##kType; \
+#define EXCHANGE(Type)                                                     \
+  if (type == MachineType::Type()) {                                       \
+    return GetCachedOperator<                                              \
+        Word64AtomicExchangeOperator<MachineType::Type().representation(), \
+                                     MachineType::Type().semantic()>>();   \
   }
   ATOMIC_U64_TYPE_LIST(EXCHANGE)
 #undef EXCHANGE
@@ -1409,9 +1398,11 @@ const Operator* MachineOperatorBuilder::Word64AtomicExchange(MachineType type) {
 
 const Operator* MachineOperatorBuilder::Word64AtomicCompareExchange(
     MachineType type) {
-#define COMPARE_EXCHANGE(kType)                         \
-  if (type == MachineType::kType()) {                   \
-    return &cache_.kWord64AtomicCompareExchange##kType; \
+#define COMPARE_EXCHANGE(Type)                                    \
+  if (type == MachineType::Type()) {                              \
+    return GetCachedOperator<Word64AtomicCompareExchangeOperator< \
+        MachineType::Type().representation(),                     \
+        MachineType::Type().semantic()>>();                       \
   }
   ATOMIC_U64_TYPE_LIST(COMPARE_EXCHANGE)
 #undef COMPARE_EXCHANGE
@@ -1419,51 +1410,51 @@ const Operator* MachineOperatorBuilder::Word64AtomicCompareExchange(
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicPairLoad() {
-  return &cache_.kWord32AtomicPairLoad;
+  return GetCachedOperator<Word32AtomicPairLoadOperator>();
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicPairStore() {
-  return &cache_.kWord32AtomicPairStore;
+  return GetCachedOperator<Word32AtomicPairStoreOperator>();
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicPairAdd() {
-  return &cache_.kWord32AtomicPairAdd;
+  return GetCachedOperator<Word32AtomicPairAddOperator>();
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicPairSub() {
-  return &cache_.kWord32AtomicPairSub;
+  return GetCachedOperator<Word32AtomicPairSubOperator>();
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicPairAnd() {
-  return &cache_.kWord32AtomicPairAnd;
+  return GetCachedOperator<Word32AtomicPairAndOperator>();
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicPairOr() {
-  return &cache_.kWord32AtomicPairOr;
+  return GetCachedOperator<Word32AtomicPairOrOperator>();
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicPairXor() {
-  return &cache_.kWord32AtomicPairXor;
+  return GetCachedOperator<Word32AtomicPairXorOperator>();
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicPairExchange() {
-  return &cache_.kWord32AtomicPairExchange;
+  return GetCachedOperator<Word32AtomicPairExchangeOperator>();
 }
 
 const Operator* MachineOperatorBuilder::Word32AtomicPairCompareExchange() {
-  return &cache_.kWord32AtomicPairCompareExchange;
+  return GetCachedOperator<Word32AtomicPairCompareExchangeOperator>();
 }
 
 const Operator* MachineOperatorBuilder::TaggedPoisonOnSpeculation() {
-  return &cache_.kTaggedPoisonOnSpeculation;
+  return GetCachedOperator<TaggedPoisonOnSpeculationOperator>();
 }
 
 const Operator* MachineOperatorBuilder::Word32PoisonOnSpeculation() {
-  return &cache_.kWord32PoisonOnSpeculation;
+  return GetCachedOperator<Word32PoisonOnSpeculationOperator>();
 }
 
 const Operator* MachineOperatorBuilder::Word64PoisonOnSpeculation() {
-  return &cache_.kWord64PoisonOnSpeculation;
+  return GetCachedOperator<Word64PoisonOnSpeculationOperator>();
 }
 
 #define EXTRACT_LANE_OP(Type, Sign, lane_count)                                \
diff --git a/deps/v8/src/compiler/machine-operator.h b/deps/v8/src/compiler/machine-operator.h
index d4f9ffa0fdc..68c55a60151 100644
--- a/deps/v8/src/compiler/machine-operator.h
+++ b/deps/v8/src/compiler/machine-operator.h
@@ -18,7 +18,6 @@ namespace internal {
 namespace compiler {
 
 // Forward declarations.
-struct MachineOperatorGlobalCache;
 class Operator;
 
 
@@ -181,6 +180,16 @@ V8_EXPORT_PRIVATE S8x16ShuffleParameter const& S8x16ShuffleParameterOf(
 
 StackCheckKind StackCheckKindOf(Operator const* op) V8_WARN_UNUSED_RESULT;
 
+// ShiftKind::kShiftOutZeros means that it is guaranteed that the bits shifted
+// out of the left operand are all zeros. If this is not the case, undefined
+// behavior (i.e., incorrect optimizations) will happen.
+// This is mostly useful for Smi untagging.
+enum class ShiftKind { kNormal, kShiftOutZeros };
+
+size_t hash_value(ShiftKind);
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, ShiftKind);
+ShiftKind ShiftKindOf(Operator const*) V8_WARN_UNUSED_RESULT;
+
 // Interface for building machine-level operators. These operators are
 // machine-level but machine-independent and thus define a language suitable
 // for generating code to run on architectures such as ia32, x64, arm, etc.
@@ -211,13 +220,15 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
     kWord64ReverseBits = 1u << 17,
     kInt32AbsWithOverflow = 1u << 20,
     kInt64AbsWithOverflow = 1u << 21,
-    kAllOptionalOps = kFloat32RoundDown | kFloat64RoundDown | kFloat32RoundUp |
-                      kFloat64RoundUp | kFloat32RoundTruncate |
-                      kFloat64RoundTruncate | kFloat64RoundTiesAway |
-                      kFloat32RoundTiesEven | kFloat64RoundTiesEven |
-                      kWord32Ctz | kWord64Ctz | kWord32Popcnt | kWord64Popcnt |
-                      kWord32ReverseBits | kWord64ReverseBits |
-                      kInt32AbsWithOverflow | kInt64AbsWithOverflow
+    kWord32Rol = 1u << 22,
+    kWord64Rol = 1u << 23,
+    kAllOptionalOps =
+        kFloat32RoundDown | kFloat64RoundDown | kFloat32RoundUp |
+        kFloat64RoundUp | kFloat32RoundTruncate | kFloat64RoundTruncate |
+        kFloat64RoundTiesAway | kFloat32RoundTiesEven | kFloat64RoundTiesEven |
+        kWord32Ctz | kWord64Ctz | kWord32Popcnt | kWord64Popcnt |
+        kWord32ReverseBits | kWord64ReverseBits | kInt32AbsWithOverflow |
+        kInt64AbsWithOverflow | kWord32Rol | kWord64Rol
   };
   using Flags = base::Flags<Flag, unsigned>;
 
@@ -294,7 +305,12 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* Word32Xor();
   const Operator* Word32Shl();
   const Operator* Word32Shr();
-  const Operator* Word32Sar();
+  const Operator* Word32Sar(ShiftKind kind);
+  const Operator* Word32Sar() { return Word32Sar(ShiftKind::kNormal); }
+  const Operator* Word32SarShiftOutZeros() {
+    return Word32Sar(ShiftKind::kShiftOutZeros);
+  }
+  const OptionalOperator Word32Rol();
   const Operator* Word32Ror();
   const Operator* Word32Equal();
   const Operator* Word32Clz();
@@ -319,7 +335,12 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* Word64Xor();
   const Operator* Word64Shl();
   const Operator* Word64Shr();
-  const Operator* Word64Sar();
+  const Operator* Word64Sar(ShiftKind kind);
+  const Operator* Word64Sar() { return Word64Sar(ShiftKind::kNormal); }
+  const Operator* Word64SarShiftOutZeros() {
+    return Word64Sar(ShiftKind::kShiftOutZeros);
+  }
+  const OptionalOperator Word64Rol();
   const Operator* Word64Ror();
   const Operator* Word64Clz();
   const OptionalOperator Word64Ctz();
@@ -553,6 +574,8 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* F64x2Le();
   const Operator* F64x2Qfma();
   const Operator* F64x2Qfms();
+  const Operator* F64x2Pmin();
+  const Operator* F64x2Pmax();
 
   const Operator* F32x4Splat();
   const Operator* F32x4ExtractLane(int32_t);
@@ -577,6 +600,12 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* F32x4Le();
   const Operator* F32x4Qfma();
   const Operator* F32x4Qfms();
+  const Operator* F32x4Pmin();
+  const Operator* F32x4Pmax();
+  const Operator* F32x4Ceil();
+  const Operator* F32x4Floor();
+  const Operator* F32x4Trunc();
+  const Operator* F32x4NearestInt();
 
   const Operator* I64x2Splat();
   const Operator* I64x2SplatI32Pair();
@@ -715,14 +744,14 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* S8x16Swizzle();
   const Operator* S8x16Shuffle(const uint8_t shuffle[16]);
 
-  const Operator* S1x2AnyTrue();
-  const Operator* S1x2AllTrue();
-  const Operator* S1x4AnyTrue();
-  const Operator* S1x4AllTrue();
-  const Operator* S1x8AnyTrue();
-  const Operator* S1x8AllTrue();
-  const Operator* S1x16AnyTrue();
-  const Operator* S1x16AllTrue();
+  const Operator* V64x2AnyTrue();
+  const Operator* V64x2AllTrue();
+  const Operator* V32x4AnyTrue();
+  const Operator* V32x4AllTrue();
+  const Operator* V16x8AnyTrue();
+  const Operator* V16x8AllTrue();
+  const Operator* V8x16AnyTrue();
+  const Operator* V8x16AllTrue();
 
   // load [base + index]
   const Operator* Load(LoadRepresentation rep);
@@ -842,7 +871,6 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   V(Word, Xor)                 \
   V(Word, Shl)                 \
   V(Word, Shr)                 \
-  V(Word, Sar)                 \
   V(Word, Ror)                 \
   V(Word, Clz)                 \
   V(Word, Equal)               \
@@ -865,9 +893,15 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
 #undef PSEUDO_OP
 #undef PSEUDO_OP_LIST
 
+  const Operator* WordSar(ShiftKind kind = ShiftKind::kNormal) {
+    return Is32() ? Word32Sar(kind) : Word64Sar(kind);
+  }
+  const Operator* WordSarShiftOutZeros() {
+    return WordSar(ShiftKind::kShiftOutZeros);
+  }
+
  private:
   Zone* zone_;
-  MachineOperatorGlobalCache const& cache_;
   MachineRepresentation const word_;
   Flags const flags_;
   AlignmentRequirements const alignment_requirements_;
diff --git a/deps/v8/src/compiler/memory-lowering.cc b/deps/v8/src/compiler/memory-lowering.cc
index 6012ae62c57..8c230b6efd2 100644
--- a/deps/v8/src/compiler/memory-lowering.cc
+++ b/deps/v8/src/compiler/memory-lowering.cc
@@ -5,6 +5,7 @@
 #include "src/compiler/memory-lowering.h"
 
 #include "src/codegen/interface-descriptors.h"
+#include "src/common/external-pointer.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
@@ -51,7 +52,7 @@ MemoryLowering::MemoryLowering(JSGraph* jsgraph, Zone* zone,
                                const char* function_debug_name)
     : isolate_(jsgraph->isolate()),
       zone_(zone),
-      graph_zone_(jsgraph->graph()->zone()),
+      graph_(jsgraph->graph()),
       common_(jsgraph->common()),
       machine_(jsgraph->machine()),
       graph_assembler_(graph_assembler),
@@ -60,6 +61,8 @@ MemoryLowering::MemoryLowering(JSGraph* jsgraph, Zone* zone,
       write_barrier_assert_failed_(callback),
       function_debug_name_(function_debug_name) {}
 
+Zone* MemoryLowering::graph_zone() const { return graph()->zone(); }
+
 Reduction MemoryLowering::Reduce(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kAllocate:
@@ -303,6 +306,29 @@ Reduction MemoryLowering::ReduceLoadElement(Node* node) {
   return Changed(node);
 }
 
+Node* MemoryLowering::DecodeExternalPointer(Node* node) {
+  DCHECK(V8_HEAP_SANDBOX_BOOL);
+  DCHECK(node->opcode() == IrOpcode::kLoad ||
+         node->opcode() == IrOpcode::kPoisonedLoad);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  __ InitializeEffectControl(effect, control);
+
+  // Clone the load node and put it here.
+  // TODO(turbofan): consider adding GraphAssembler::Clone() suitable for
+  // cloning nodes from arbitrary locaions in effect/control chains.
+  Node* node_copy = __ AddNode(graph()->CloneNode(node));
+
+  // Uncomment this to generate a breakpoint for debugging purposes.
+  // __ DebugBreak();
+
+  // Decode loaded enternal pointer.
+  STATIC_ASSERT(kExternalPointerSize == kSystemPointerSize);
+  Node* salt = __ IntPtrConstant(kExternalPointerSalt);
+  Node* decoded_ptr = __ WordXor(node_copy, salt);
+  return decoded_ptr;
+}
+
 Reduction MemoryLowering::ReduceLoadField(Node* node) {
   DCHECK_EQ(IrOpcode::kLoadField, node->opcode());
   FieldAccess const& access = FieldAccessOf(node->op());
@@ -314,6 +340,13 @@ Reduction MemoryLowering::ReduceLoadField(Node* node) {
   } else {
     NodeProperties::ChangeOp(node, machine()->Load(type));
   }
+  if (V8_HEAP_SANDBOX_BOOL &&
+      access.type.Is(Type::SandboxedExternalPointer())) {
+    node = DecodeExternalPointer(node);
+    return Replace(node);
+  } else {
+    DCHECK(!access.type.Is(Type::SandboxedExternalPointer()));
+  }
   return Changed(node);
 }
 
@@ -351,6 +384,10 @@ Reduction MemoryLowering::ReduceStoreField(Node* node,
                                            AllocationState const* state) {
   DCHECK_EQ(IrOpcode::kStoreField, node->opcode());
   FieldAccess const& access = FieldAccessOf(node->op());
+  // External pointer must never be stored by optimized code.
+  DCHECK_IMPLIES(V8_HEAP_SANDBOX_BOOL,
+                 !access.type.Is(Type::ExternalPointer()) &&
+                     !access.type.Is(Type::SandboxedExternalPointer()));
   Node* object = node->InputAt(0);
   Node* value = node->InputAt(1);
   WriteBarrierKind write_barrier_kind = ComputeWriteBarrierKind(
diff --git a/deps/v8/src/compiler/memory-lowering.h b/deps/v8/src/compiler/memory-lowering.h
index 2c9a0accdba..1c6ef8a3722 100644
--- a/deps/v8/src/compiler/memory-lowering.h
+++ b/deps/v8/src/compiler/memory-lowering.h
@@ -78,7 +78,6 @@ class MemoryLowering final : public Reducer {
       WriteBarrierAssertFailedCallback callback = [](Node*, Node*, const char*,
                                                      Zone*) { UNREACHABLE(); },
       const char* function_debug_name = nullptr);
-  ~MemoryLowering() = default;
 
   const char* reducer_name() const override { return "MemoryReducer"; }
 
@@ -107,13 +106,14 @@ class MemoryLowering final : public Reducer {
                                            Node* value,
                                            AllocationState const* state,
                                            WriteBarrierKind);
+  Node* DecodeExternalPointer(Node* encoded_pointer);
   Node* ComputeIndex(ElementAccess const& access, Node* node);
   bool NeedsPoisoning(LoadSensitivity load_sensitivity) const;
 
-  Graph* graph() const;
+  Graph* graph() const { return graph_; }
   Isolate* isolate() const { return isolate_; }
   Zone* zone() const { return zone_; }
-  Zone* graph_zone() const { return graph_zone_; }
+  inline Zone* graph_zone() const;
   CommonOperatorBuilder* common() const { return common_; }
   MachineOperatorBuilder* machine() const { return machine_; }
   JSGraphAssembler* gasm() const { return graph_assembler_; }
@@ -121,7 +121,7 @@ class MemoryLowering final : public Reducer {
   SetOncePointer<const Operator> allocate_operator_;
   Isolate* isolate_;
   Zone* zone_;
-  Zone* graph_zone_;
+  Graph* graph_;
   CommonOperatorBuilder* common_;
   MachineOperatorBuilder* machine_;
   JSGraphAssembler* graph_assembler_;
diff --git a/deps/v8/src/compiler/memory-optimizer.cc b/deps/v8/src/compiler/memory-optimizer.cc
index c335b815aa0..a54d89ffb0f 100644
--- a/deps/v8/src/compiler/memory-optimizer.cc
+++ b/deps/v8/src/compiler/memory-optimizer.cc
@@ -4,6 +4,7 @@
 
 #include "src/compiler/memory-optimizer.h"
 
+#include "src/base/logging.h"
 #include "src/codegen/interface-descriptors.h"
 #include "src/codegen/tick-counter.h"
 #include "src/compiler/js-graph.h"
@@ -321,8 +322,23 @@ void MemoryOptimizer::VisitLoadElement(Node* node,
 
 void MemoryOptimizer::VisitLoadField(Node* node, AllocationState const* state) {
   DCHECK_EQ(IrOpcode::kLoadField, node->opcode());
-  memory_lowering()->ReduceLoadField(node);
+  Reduction reduction = memory_lowering()->ReduceLoadField(node);
+  DCHECK(reduction.Changed());
+  // In case of replacement, the replacement graph should not require futher
+  // lowering, so we can proceed iterating the graph from the node uses.
   EnqueueUses(node, state);
+
+  // Node can be replaced only when V8_HEAP_SANDBOX_BOOL is enabled and
+  // when loading an external pointer value.
+  DCHECK_IMPLIES(!V8_HEAP_SANDBOX_BOOL, reduction.replacement() == node);
+  if (V8_HEAP_SANDBOX_BOOL && reduction.replacement() != node) {
+    // Replace all uses of node and kill the node to make sure we don't leave
+    // dangling dead uses.
+    NodeProperties::ReplaceUses(node, reduction.replacement(),
+                                graph_assembler_.effect(),
+                                graph_assembler_.control());
+    node->Kill();
+  }
 }
 
 void MemoryOptimizer::VisitStoreElement(Node* node,
diff --git a/deps/v8/src/compiler/node-matchers.h b/deps/v8/src/compiler/node-matchers.h
index 8c4e5e76d51..cf0df2d6360 100644
--- a/deps/v8/src/compiler/node-matchers.h
+++ b/deps/v8/src/compiler/node-matchers.h
@@ -6,6 +6,7 @@
 #define V8_COMPILER_NODE_MATCHERS_H_
 
 #include <cmath>
+#include <limits>
 
 #include "src/base/compiler-specific.h"
 #include "src/codegen/external-reference.h"
@@ -160,7 +161,7 @@ struct IntMatcher final : public ValueMatcher<T, kOpcode> {
   }
   bool IsNegativePowerOf2() const {
     return this->HasValue() && this->Value() < 0 &&
-           ((this->Value() == kMinInt) ||
+           ((this->Value() == std::numeric_limits<T>::min()) ||
             (-this->Value() & (-this->Value() - 1)) == 0);
   }
   bool IsNegative() const { return this->HasValue() && this->Value() < 0; }
diff --git a/deps/v8/src/compiler/node-properties.cc b/deps/v8/src/compiler/node-properties.cc
index ab4ced69ab6..3b78872437c 100644
--- a/deps/v8/src/compiler/node-properties.cc
+++ b/deps/v8/src/compiler/node-properties.cc
@@ -158,6 +158,21 @@ void NodeProperties::MergeControlToEnd(Graph* graph,
   graph->end()->set_op(common->End(graph->end()->InputCount()));
 }
 
+void NodeProperties::RemoveControlFromEnd(Graph* graph,
+                                          CommonOperatorBuilder* common,
+                                          Node* node) {
+  int index_to_remove = -1;
+  for (int i = 0; i < graph->end()->op()->ControlInputCount(); i++) {
+    int index = NodeProperties::FirstControlIndex(graph->end()) + i;
+    if (graph->end()->InputAt(index) == node) {
+      index_to_remove = index;
+      break;
+    }
+  }
+  CHECK_NE(-1, index_to_remove);
+  graph->end()->RemoveInput(index_to_remove);
+  graph->end()->set_op(common->End(graph->end()->InputCount()));
+}
 
 // static
 void NodeProperties::ReplaceUses(Node* node, Node* value, Node* effect,
diff --git a/deps/v8/src/compiler/node-properties.h b/deps/v8/src/compiler/node-properties.h
index 1d6e957d045..5b31f15d486 100644
--- a/deps/v8/src/compiler/node-properties.h
+++ b/deps/v8/src/compiler/node-properties.h
@@ -140,6 +140,11 @@ class V8_EXPORT_PRIVATE NodeProperties final {
   static void MergeControlToEnd(Graph* graph, CommonOperatorBuilder* common,
                                 Node* node);
 
+  // Removes the control node {node} from the end of the graph, reducing the
+  // existing merge node's input count.
+  static void RemoveControlFromEnd(Graph* graph, CommonOperatorBuilder* common,
+                                   Node* node);
+
   // Replace all uses of {node} with the given replacement nodes. All occurring
   // use kinds need to be replaced, {nullptr} is only valid if a use kind is
   // guaranteed not to exist.
diff --git a/deps/v8/src/compiler/node.cc b/deps/v8/src/compiler/node.cc
index 1bff71495cc..5e7c9fcc396 100644
--- a/deps/v8/src/compiler/node.cc
+++ b/deps/v8/src/compiler/node.cc
@@ -314,22 +314,32 @@ bool Node::OwnedBy(Node const* owner1, Node const* owner2) const {
   return mask == 3;
 }
 
-void Node::Print() const {
+void Node::Print(int depth) const {
   StdoutStream os;
-  Print(os);
+  Print(os, depth);
 }
 
-void Node::Print(std::ostream& os) const {
-  os << *this << std::endl;
-  for (Node* input : this->inputs()) {
+namespace {
+void PrintNode(const Node* node, std::ostream& os, int depth,
+               int indentation = 0) {
+  for (int i = 0; i < indentation; ++i) {
     os << "  ";
-    if (input) {
-      os << *input;
-    } else {
-      os << "(NULL)";
-    }
-    os << std::endl;
   }
+  if (node) {
+    os << *node;
+  } else {
+    os << "(NULL)";
+  }
+  os << std::endl;
+  if (depth <= 0) return;
+  for (Node* input : node->inputs()) {
+    PrintNode(input, os, depth - 1, indentation + 1);
+  }
+}
+}  // namespace
+
+void Node::Print(std::ostream& os, int depth) const {
+  PrintNode(this, os, depth);
 }
 
 std::ostream& operator<<(std::ostream& os, const Node& n) {
diff --git a/deps/v8/src/compiler/node.h b/deps/v8/src/compiler/node.h
index 41dca441f20..8072bab46eb 100644
--- a/deps/v8/src/compiler/node.h
+++ b/deps/v8/src/compiler/node.h
@@ -144,8 +144,9 @@ class V8_EXPORT_PRIVATE Node final {
   // Returns true if {owner1} and {owner2} are the only users of {this} node.
   bool OwnedBy(Node const* owner1, Node const* owner2) const;
 
-  void Print() const;
-  void Print(std::ostream&) const;
+  void Print() const { Print(1); }
+  void Print(int depth) const;
+  void Print(std::ostream&, int depth = 1) const;
 
  private:
   struct Use;
diff --git a/deps/v8/src/compiler/opcodes.h b/deps/v8/src/compiler/opcodes.h
index 61af28841ab..d60e5303171 100644
--- a/deps/v8/src/compiler/opcodes.h
+++ b/deps/v8/src/compiler/opcodes.h
@@ -532,6 +532,7 @@
   V(Word32Shl)                   \
   V(Word32Shr)                   \
   V(Word32Sar)                   \
+  V(Word32Rol)                   \
   V(Word32Ror)                   \
   V(Int32Add)                    \
   V(Int32AddWithOverflow)        \
@@ -553,6 +554,7 @@
   V(Word64Shl)                   \
   V(Word64Shr)                   \
   V(Word64Sar)                   \
+  V(Word64Rol)                   \
   V(Word64Ror)                   \
   V(Int64Add)                    \
   V(Int64AddWithOverflow)        \
@@ -761,6 +763,8 @@
   V(F64x2Le)                    \
   V(F64x2Qfma)                  \
   V(F64x2Qfms)                  \
+  V(F64x2Pmin)                  \
+  V(F64x2Pmax)                  \
   V(F32x4Splat)                 \
   V(F32x4ExtractLane)           \
   V(F32x4ReplaceLane)           \
@@ -786,6 +790,12 @@
   V(F32x4Ge)                    \
   V(F32x4Qfma)                  \
   V(F32x4Qfms)                  \
+  V(F32x4Pmin)                  \
+  V(F32x4Pmax)                  \
+  V(F32x4Ceil)                  \
+  V(F32x4Floor)                 \
+  V(F32x4Trunc)                 \
+  V(F32x4NearestInt)            \
   V(I64x2Splat)                 \
   V(I64x2SplatI32Pair)          \
   V(I64x2ExtractLane)           \
@@ -925,14 +935,14 @@
   V(S128AndNot)                 \
   V(S8x16Swizzle)               \
   V(S8x16Shuffle)               \
-  V(S1x2AnyTrue)                \
-  V(S1x2AllTrue)                \
-  V(S1x4AnyTrue)                \
-  V(S1x4AllTrue)                \
-  V(S1x8AnyTrue)                \
-  V(S1x8AllTrue)                \
-  V(S1x16AnyTrue)               \
-  V(S1x16AllTrue)               \
+  V(V64x2AnyTrue)               \
+  V(V64x2AllTrue)               \
+  V(V32x4AnyTrue)               \
+  V(V32x4AllTrue)               \
+  V(V16x8AnyTrue)               \
+  V(V16x8AllTrue)               \
+  V(V8x16AnyTrue)               \
+  V(V8x16AllTrue)               \
   V(LoadTransform)
 
 #define VALUE_OP_LIST(V)  \
diff --git a/deps/v8/src/compiler/operation-typer.cc b/deps/v8/src/compiler/operation-typer.cc
index 229c7864b24..2397811577e 100644
--- a/deps/v8/src/compiler/operation-typer.cc
+++ b/deps/v8/src/compiler/operation-typer.cc
@@ -1249,7 +1249,10 @@ Type OperationTyper::StrictEqual(Type lhs, Type rhs) {
     // Types are equal and are inhabited only by a single semantic value,
     // which is not nan due to the earlier check.
     DCHECK(lhs.Is(rhs));
-    DCHECK(lhs.Is(Type::NonInternal()) || lhs.Is(Type::Hole()));
+    // TODO(neis): The last condition in this DCHECK is due the unittest
+    // throwing arbitrary types at the typer. This is not easy to fix.
+    DCHECK(lhs.Is(Type::NonInternal()) || lhs.Is(Type::Hole()) ||
+           FLAG_testing_d8_test_runner);
     return singleton_true();
   }
   if ((lhs.Is(Type::Unique()) || rhs.Is(Type::Unique())) && !lhs.Maybe(rhs)) {
diff --git a/deps/v8/src/compiler/operator-properties.cc b/deps/v8/src/compiler/operator-properties.cc
index 6b2fb8bf579..a4892cdb2a2 100644
--- a/deps/v8/src/compiler/operator-properties.cc
+++ b/deps/v8/src/compiler/operator-properties.cc
@@ -53,7 +53,6 @@ bool OperatorProperties::NeedsExactContext(const Operator* op) {
     case IrOpcode::kJSLoadGlobal:
     case IrOpcode::kJSLoadMessage:
     case IrOpcode::kJSStackCheck:
-    case IrOpcode::kJSStoreGlobal:
     case IrOpcode::kJSStoreMessage:
     case IrOpcode::kJSGetIterator:
       return false;
@@ -83,6 +82,7 @@ bool OperatorProperties::NeedsExactContext(const Operator* op) {
     case IrOpcode::kJSLoadProperty:
     case IrOpcode::kJSStoreContext:
     case IrOpcode::kJSStoreDataPropertyInLiteral:
+    case IrOpcode::kJSStoreGlobal:
     case IrOpcode::kJSStoreInArrayLiteral:
     case IrOpcode::kJSStoreModule:
     case IrOpcode::kJSStoreNamed:
diff --git a/deps/v8/src/compiler/operator.h b/deps/v8/src/compiler/operator.h
index 23e844e1649..7227c92cd86 100644
--- a/deps/v8/src/compiler/operator.h
+++ b/deps/v8/src/compiler/operator.h
@@ -66,8 +66,6 @@ class V8_EXPORT_PRIVATE Operator : public NON_EXPORTED_BASE(ZoneObject) {
            size_t value_in, size_t effect_in, size_t control_in,
            size_t value_out, size_t effect_out, size_t control_out);
 
-  virtual ~Operator() = default;
-
   // A small integer unique to all instances of a particular kind of operator,
   // useful for quick matching for specific kinds of operators. For fast access
   // the opcode is stored directly in the operator object.
diff --git a/deps/v8/src/compiler/pipeline-statistics.cc b/deps/v8/src/compiler/pipeline-statistics.cc
index 9cfd1cf94d9..5e2c7feffd1 100644
--- a/deps/v8/src/compiler/pipeline-statistics.cc
+++ b/deps/v8/src/compiler/pipeline-statistics.cc
@@ -19,7 +19,7 @@ namespace {
 
 // We log detailed phase information about the pipeline
 // in both the v8.turbofan and the v8.wasm categories.
-const char kTraceCategory[] =                     // --
+constexpr const char kTraceCategory[] =           // --
     TRACE_DISABLED_BY_DEFAULT("v8.turbofan") ","  // --
     TRACE_DISABLED_BY_DEFAULT("v8.wasm");
 
diff --git a/deps/v8/src/compiler/pipeline.cc b/deps/v8/src/compiler/pipeline.cc
index 71cef6fd700..033fa3e8a22 100644
--- a/deps/v8/src/compiler/pipeline.cc
+++ b/deps/v8/src/compiler/pipeline.cc
@@ -349,11 +349,6 @@ class PipelineData {
     return register_allocation_data_;
   }
 
-  BasicBlockProfiler::Data* profiler_data() const { return profiler_data_; }
-  void set_profiler_data(BasicBlockProfiler::Data* profiler_data) {
-    profiler_data_ = profiler_data;
-  }
-
   std::string const& source_position_output() const {
     return source_position_output_;
   }
@@ -599,9 +594,6 @@ class PipelineData {
   Zone* register_allocation_zone_;
   RegisterAllocationData* register_allocation_data_ = nullptr;
 
-  // Basic block profiling support.
-  BasicBlockProfiler::Data* profiler_data_ = nullptr;
-
   // Source position output for --trace-turbo.
   std::string source_position_output_;
 
@@ -680,9 +672,9 @@ void PrintFunctionSource(OptimizedCompilationInfo* info, Isolate* isolate,
     Handle<Script> script(Script::cast(shared->script()), isolate);
 
     if (!script->source().IsUndefined(isolate)) {
-      CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
+      CodeTracer::StreamScope tracing_scope(isolate->GetCodeTracer());
       Object source_name = script->name();
-      OFStream os(tracing_scope.file());
+      auto& os = tracing_scope.stream();
       os << "--- FUNCTION SOURCE (";
       if (source_name.IsString()) {
         os << String::cast(source_name).ToCString().get() << ":";
@@ -711,8 +703,8 @@ void PrintFunctionSource(OptimizedCompilationInfo* info, Isolate* isolate,
 void PrintInlinedFunctionInfo(
     OptimizedCompilationInfo* info, Isolate* isolate, int source_id,
     int inlining_id, const OptimizedCompilationInfo::InlinedFunctionHolder& h) {
-  CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
-  OFStream os(tracing_scope.file());
+  CodeTracer::StreamScope tracing_scope(isolate->GetCodeTracer());
+  auto& os = tracing_scope.stream();
   os << "INLINE (" << h.shared_info->DebugName().ToCString().get() << ") id{"
      << info->optimization_id() << "," << source_id << "} AS " << inlining_id
      << " AT ";
@@ -753,8 +745,8 @@ void PrintCode(Isolate* isolate, Handle<Code> code,
        info->shared_info()->PassesFilter(FLAG_print_opt_code_filter));
   if (print_code) {
     std::unique_ptr<char[]> debug_name = info->GetDebugName();
-    CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
-    OFStream os(tracing_scope.file());
+    CodeTracer::StreamScope tracing_scope(isolate->GetCodeTracer());
+    auto& os = tracing_scope.stream();
 
     // Print the source code if available.
     bool print_source = code->kind() == Code::OPTIMIZED_FUNCTION;
@@ -810,9 +802,10 @@ void TraceScheduleAndVerify(OptimizedCompilationInfo* info, PipelineData* data,
   }
   if (info->trace_turbo_graph_enabled() || FLAG_trace_turbo_scheduler) {
     AllowHandleDereference allow_deref;
-    CodeTracer::Scope tracing_scope(data->GetCodeTracer());
-    OFStream os(tracing_scope.file());
-    os << "-- Schedule --------------------------------------\n" << *schedule;
+    CodeTracer::StreamScope tracing_scope(data->GetCodeTracer());
+    tracing_scope.stream()
+        << "-- Schedule --------------------------------------\n"
+        << *schedule;
   }
 
   if (FLAG_turbo_verify) ScheduleVerifier::Run(schedule);
@@ -988,7 +981,9 @@ class PipelineCompilationJob final : public OptimizedCompilationJob {
   Status FinalizeJobImpl(Isolate* isolate) final;
 
   // Registers weak object to optimized code dependencies.
-  void RegisterWeakObjectsInOptimizedCode(Handle<Code> code, Isolate* isolate);
+  void RegisterWeakObjectsInOptimizedCode(Isolate* isolate,
+                                          Handle<NativeContext> context,
+                                          Handle<Code> code);
 
  private:
   Zone zone_;
@@ -1167,13 +1162,14 @@ PipelineCompilationJob::Status PipelineCompilationJob::FinalizeJobImpl(
   }
 
   compilation_info()->SetCode(code);
-  compilation_info()->native_context().AddOptimizedCode(*code);
-  RegisterWeakObjectsInOptimizedCode(code, isolate);
+  Handle<NativeContext> context(compilation_info()->native_context(), isolate);
+  context->AddOptimizedCode(*code);
+  RegisterWeakObjectsInOptimizedCode(isolate, context, code);
   return SUCCEEDED;
 }
 
 void PipelineCompilationJob::RegisterWeakObjectsInOptimizedCode(
-    Handle<Code> code, Isolate* isolate) {
+    Isolate* isolate, Handle<NativeContext> context, Handle<Code> code) {
   std::vector<Handle<Map>> maps;
   DCHECK(code->is_optimized_code());
   {
@@ -1191,7 +1187,7 @@ void PipelineCompilationJob::RegisterWeakObjectsInOptimizedCode(
     }
   }
   for (Handle<Map> map : maps) {
-    isolate->heap()->AddRetainedMap(map);
+    isolate->heap()->AddRetainedMap(context, map);
   }
   code->set_can_have_weak_objects(true);
 }
@@ -1267,11 +1263,11 @@ CompilationJob::Status WasmHeapStubCompilationJob::ExecuteJobImpl(
     pipeline_statistics->BeginPhaseKind("V8.WasmStubCodegen");
   }
   if (info_.trace_turbo_json_enabled() || info_.trace_turbo_graph_enabled()) {
-    CodeTracer::Scope tracing_scope(data_.GetCodeTracer());
-    OFStream os(tracing_scope.file());
-    os << "---------------------------------------------------\n"
-       << "Begin compiling method " << info_.GetDebugName().get()
-       << " using TurboFan" << std::endl;
+    CodeTracer::StreamScope tracing_scope(data_.GetCodeTracer());
+    tracing_scope.stream()
+        << "---------------------------------------------------\n"
+        << "Begin compiling method " << info_.GetDebugName().get()
+        << " using TurboFan" << std::endl;
   }
   if (info_.trace_turbo_graph_enabled()) {  // Simple textual RPO.
     StdoutStream{} << "-- wasm stub " << Code::Kind2String(info_.code_kind())
@@ -1303,9 +1299,9 @@ CompilationJob::Status WasmHeapStubCompilationJob::FinalizeJobImpl(
     info_.SetCode(code);
 #ifdef ENABLE_DISASSEMBLER
     if (FLAG_print_opt_code) {
-      CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
-      OFStream os(tracing_scope.file());
-      code->Disassemble(compilation_info()->GetDebugName().get(), os, isolate);
+      CodeTracer::StreamScope tracing_scope(isolate->GetCodeTracer());
+      code->Disassemble(compilation_info()->GetDebugName().get(),
+                        tracing_scope.stream(), isolate);
     }
 #endif
     return SUCCEEDED;
@@ -1409,6 +1405,7 @@ struct InliningPhase {
       AddReducer(data, &graph_reducer, &inlining);
     }
     graph_reducer.ReduceGraph();
+    info->set_inlined_bytecode_size(inlining.total_inlined_bytecode_size());
   }
 };
 
@@ -1951,10 +1948,12 @@ struct CsaOptimizationPhase {
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
                                          data->broker(), data->common(),
                                          data->machine(), temp_zone);
+    ValueNumberingReducer value_numbering(temp_zone, data->graph()->zone());
     AddReducer(data, &graph_reducer, &branch_condition_elimination);
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &machine_reducer);
     AddReducer(data, &graph_reducer, &common_reducer);
+    AddReducer(data, &graph_reducer, &value_numbering);
     graph_reducer.ReduceGraph();
   }
 };
@@ -2296,16 +2295,16 @@ struct PrintGraphPhase {
       }
 
       AllowHandleDereference allow_deref;
-      CodeTracer::Scope tracing_scope(data->GetCodeTracer());
-      OFStream os(tracing_scope.file());
-      os << "-- Graph after " << phase << " -- " << std::endl;
-      os << AsScheduledGraph(schedule);
+      CodeTracer::StreamScope tracing_scope(data->GetCodeTracer());
+      tracing_scope.stream()
+          << "-- Graph after " << phase << " -- " << std::endl
+          << AsScheduledGraph(schedule);
     } else if (info->trace_turbo_graph_enabled()) {  // Simple textual RPO.
       AllowHandleDereference allow_deref;
-      CodeTracer::Scope tracing_scope(data->GetCodeTracer());
-      OFStream os(tracing_scope.file());
-      os << "-- Graph after " << phase << " -- " << std::endl;
-      os << AsRPO(*graph);
+      CodeTracer::StreamScope tracing_scope(data->GetCodeTracer());
+      tracing_scope.stream()
+          << "-- Graph after " << phase << " -- " << std::endl
+          << AsRPO(*graph);
     }
   }
 };
@@ -2322,7 +2321,6 @@ struct VerifyGraphPhase {
       case Code::WASM_TO_CAPI_FUNCTION:
       case Code::WASM_TO_JS_FUNCTION:
       case Code::JS_TO_WASM_FUNCTION:
-      case Code::WASM_INTERPRETER_ENTRY:
       case Code::C_WASM_ENTRY:
         code_type = Verifier::kWasm;
         break;
@@ -2356,11 +2354,11 @@ void PipelineImpl::Serialize() {
 
   if (info()->trace_turbo_json_enabled() ||
       info()->trace_turbo_graph_enabled()) {
-    CodeTracer::Scope tracing_scope(data->GetCodeTracer());
-    OFStream os(tracing_scope.file());
-    os << "---------------------------------------------------\n"
-       << "Begin compiling method " << info()->GetDebugName().get()
-       << " using TurboFan" << std::endl;
+    CodeTracer::StreamScope tracing_scope(data->GetCodeTracer());
+    tracing_scope.stream()
+        << "---------------------------------------------------\n"
+        << "Begin compiling method " << info()->GetDebugName().get()
+        << " using TurboFan" << std::endl;
   }
   if (info()->trace_turbo_json_enabled()) {
     TurboCfgFile tcf(isolate());
@@ -2616,8 +2614,9 @@ MaybeHandle<Code> Pipeline::GenerateCodeForCodeStub(
   ZoneStats zone_stats(isolate->allocator());
   NodeOriginTable node_origins(graph);
   JumpOptimizationInfo jump_opt;
-  bool should_optimize_jumps =
-      isolate->serializer_enabled() && FLAG_turbo_rewrite_far_jumps;
+  bool should_optimize_jumps = isolate->serializer_enabled() &&
+                               FLAG_turbo_rewrite_far_jumps &&
+                               !FLAG_turbo_profiling;
   PipelineData data(&zone_stats, &info, isolate, isolate->allocator(), graph,
                     jsgraph, nullptr, source_positions, &node_origins,
                     should_optimize_jumps ? &jump_opt : nullptr, options);
@@ -2635,10 +2634,10 @@ MaybeHandle<Code> Pipeline::GenerateCodeForCodeStub(
   PipelineImpl pipeline(&data);
 
   if (info.trace_turbo_json_enabled() || info.trace_turbo_graph_enabled()) {
-    CodeTracer::Scope tracing_scope(data.GetCodeTracer());
-    OFStream os(tracing_scope.file());
-    os << "---------------------------------------------------\n"
-       << "Begin compiling " << debug_name << " using TurboFan" << std::endl;
+    CodeTracer::StreamScope tracing_scope(data.GetCodeTracer());
+    tracing_scope.stream()
+        << "---------------------------------------------------\n"
+        << "Begin compiling " << debug_name << " using TurboFan" << std::endl;
     if (info.trace_turbo_json_enabled()) {
       TurboJsonFile json_of(&info, std::ios_base::trunc);
       json_of << "{\"function\" : ";
@@ -2737,11 +2736,11 @@ wasm::WasmCompilationResult Pipeline::GenerateCodeForWasmNativeStub(
   PipelineImpl pipeline(&data);
 
   if (info.trace_turbo_json_enabled() || info.trace_turbo_graph_enabled()) {
-    CodeTracer::Scope tracing_scope(data.GetCodeTracer());
-    OFStream os(tracing_scope.file());
-    os << "---------------------------------------------------\n"
-       << "Begin compiling method " << info.GetDebugName().get()
-       << " using TurboFan" << std::endl;
+    CodeTracer::StreamScope tracing_scope(data.GetCodeTracer());
+    tracing_scope.stream()
+        << "---------------------------------------------------\n"
+        << "Begin compiling method " << info.GetDebugName().get()
+        << " using TurboFan" << std::endl;
   }
 
   if (info.trace_turbo_graph_enabled()) {  // Simple textual RPO.
@@ -2798,11 +2797,11 @@ wasm::WasmCompilationResult Pipeline::GenerateCodeForWasmNativeStub(
   }
 
   if (info.trace_turbo_json_enabled() || info.trace_turbo_graph_enabled()) {
-    CodeTracer::Scope tracing_scope(data.GetCodeTracer());
-    OFStream os(tracing_scope.file());
-    os << "---------------------------------------------------\n"
-       << "Finished compiling method " << info.GetDebugName().get()
-       << " using TurboFan" << std::endl;
+    CodeTracer::StreamScope tracing_scope(data.GetCodeTracer());
+    tracing_scope.stream()
+        << "---------------------------------------------------\n"
+        << "Finished compiling method " << info.GetDebugName().get()
+        << " using TurboFan" << std::endl;
   }
 
   return result;
@@ -2912,11 +2911,11 @@ void Pipeline::GenerateCodeForWasmFunction(
 
   if (data.info()->trace_turbo_json_enabled() ||
       data.info()->trace_turbo_graph_enabled()) {
-    CodeTracer::Scope tracing_scope(data.GetCodeTracer());
-    OFStream os(tracing_scope.file());
-    os << "---------------------------------------------------\n"
-       << "Begin compiling method " << data.info()->GetDebugName().get()
-       << " using TurboFan" << std::endl;
+    CodeTracer::StreamScope tracing_scope(data.GetCodeTracer());
+    tracing_scope.stream()
+        << "---------------------------------------------------\n"
+        << "Begin compiling method " << data.info()->GetDebugName().get()
+        << " using TurboFan" << std::endl;
   }
 
   pipeline.RunPrintAndVerify("V8.WasmMachineCode", true);
@@ -3003,11 +3002,11 @@ void Pipeline::GenerateCodeForWasmFunction(
 
   if (data.info()->trace_turbo_json_enabled() ||
       data.info()->trace_turbo_graph_enabled()) {
-    CodeTracer::Scope tracing_scope(data.GetCodeTracer());
-    OFStream os(tracing_scope.file());
-    os << "---------------------------------------------------\n"
-       << "Finished compiling method " << data.info()->GetDebugName().get()
-       << " using TurboFan" << std::endl;
+    CodeTracer::StreamScope tracing_scope(data.GetCodeTracer());
+    tracing_scope.stream()
+        << "---------------------------------------------------\n"
+        << "Finished compiling method " << data.info()->GetDebugName().get()
+        << " using TurboFan" << std::endl;
   }
 
   DCHECK(result->succeeded());
@@ -3049,7 +3048,7 @@ bool PipelineImpl::SelectInstructions(Linkage* linkage) {
   DCHECK_NOT_NULL(data->schedule());
 
   if (FLAG_turbo_profiling) {
-    data->set_profiler_data(BasicBlockInstrumentor::Instrument(
+    data->info()->set_profiler_data(BasicBlockInstrumentor::Instrument(
         info(), data->graph(), data->schedule(), data->isolate()));
   }
 
@@ -3069,15 +3068,16 @@ bool PipelineImpl::SelectInstructions(Linkage* linkage) {
   if (verify_stub_graph) {
     if (FLAG_trace_verify_csa) {
       AllowHandleDereference allow_deref;
-      CodeTracer::Scope tracing_scope(data->GetCodeTracer());
-      OFStream os(tracing_scope.file());
-      os << "--------------------------------------------------\n"
-         << "--- Verifying " << data->debug_name() << " generated by TurboFan\n"
-         << "--------------------------------------------------\n"
-         << *data->schedule()
-         << "--------------------------------------------------\n"
-         << "--- End of " << data->debug_name() << " generated by TurboFan\n"
-         << "--------------------------------------------------\n";
+      CodeTracer::StreamScope tracing_scope(data->GetCodeTracer());
+      tracing_scope.stream()
+          << "--------------------------------------------------\n"
+          << "--- Verifying " << data->debug_name()
+          << " generated by TurboFan\n"
+          << "--------------------------------------------------\n"
+          << *data->schedule()
+          << "--------------------------------------------------\n"
+          << "--- End of " << data->debug_name() << " generated by TurboFan\n"
+          << "--------------------------------------------------\n";
     }
     Zone temp_zone(data->allocator(), kMachineGraphVerifierZoneName);
     MachineGraphVerifier::Run(
@@ -3266,14 +3266,6 @@ MaybeHandle<Code> PipelineImpl::FinalizeCode(bool retire_broker) {
     return maybe_code;
   }
 
-  if (data->profiler_data()) {
-#ifdef ENABLE_DISASSEMBLER
-    std::ostringstream os;
-    code->Disassemble(nullptr, os, isolate());
-    data->profiler_data()->SetCode(&os);
-#endif  // ENABLE_DISASSEMBLER
-  }
-
   info()->SetCode(code);
   PrintCode(isolate(), code, info());
 
@@ -3299,11 +3291,11 @@ MaybeHandle<Code> PipelineImpl::FinalizeCode(bool retire_broker) {
   }
   if (info()->trace_turbo_json_enabled() ||
       info()->trace_turbo_graph_enabled()) {
-    CodeTracer::Scope tracing_scope(data->GetCodeTracer());
-    OFStream os(tracing_scope.file());
-    os << "---------------------------------------------------\n"
-       << "Finished compiling method " << info()->GetDebugName().get()
-       << " using TurboFan" << std::endl;
+    CodeTracer::StreamScope tracing_scope(data->GetCodeTracer());
+    tracing_scope.stream()
+        << "---------------------------------------------------\n"
+        << "Finished compiling method " << info()->GetDebugName().get()
+        << " using TurboFan" << std::endl;
   }
   data->EndPhaseKind();
   return code;
@@ -3340,16 +3332,19 @@ void TraceSequence(OptimizedCompilationInfo* info, PipelineData* data,
   if (info->trace_turbo_json_enabled()) {
     AllowHandleDereference allow_deref;
     TurboJsonFile json_of(info, std::ios_base::app);
-    json_of << "{\"name\":\"" << phase_name << "\",\"type\":\"sequence\",";
-    json_of << InstructionSequenceAsJSON{data->sequence()};
-    json_of << "},\n";
+    json_of << "{\"name\":\"" << phase_name << "\",\"type\":\"sequence\""
+            << ",\"blocks\":" << InstructionSequenceAsJSON{data->sequence()}
+            << ",\"register_allocation\":{"
+            << RegisterAllocationDataAsJSON{*(data->register_allocation_data()),
+                                            *(data->sequence())}
+            << "}},\n";
   }
   if (info->trace_turbo_graph_enabled()) {
     AllowHandleDereference allow_deref;
-    CodeTracer::Scope tracing_scope(data->GetCodeTracer());
-    OFStream os(tracing_scope.file());
-    os << "----- Instruction sequence " << phase_name << " -----\n"
-       << *data->sequence();
+    CodeTracer::StreamScope tracing_scope(data->GetCodeTracer());
+    tracing_scope.stream() << "----- Instruction sequence " << phase_name
+                           << " -----\n"
+                           << *data->sequence();
   }
 }
 
diff --git a/deps/v8/src/compiler/raw-machine-assembler.h b/deps/v8/src/compiler/raw-machine-assembler.h
index 6298513f55e..cbd7722dd20 100644
--- a/deps/v8/src/compiler/raw-machine-assembler.h
+++ b/deps/v8/src/compiler/raw-machine-assembler.h
@@ -311,6 +311,9 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
   Node* WordSar(Node* a, Node* b) {
     return AddNode(machine()->WordSar(), a, b);
   }
+  Node* WordSarShiftOutZeros(Node* a, Node* b) {
+    return AddNode(machine()->WordSarShiftOutZeros(), a, b);
+  }
   Node* WordRor(Node* a, Node* b) {
     return AddNode(machine()->WordRor(), a, b);
   }
@@ -346,6 +349,9 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
   Node* Word32Sar(Node* a, Node* b) {
     return AddNode(machine()->Word32Sar(), a, b);
   }
+  Node* Word32SarShiftOutZeros(Node* a, Node* b) {
+    return AddNode(machine()->Word32SarShiftOutZeros(), a, b);
+  }
   Node* Word32Ror(Node* a, Node* b) {
     return AddNode(machine()->Word32Ror(), a, b);
   }
diff --git a/deps/v8/src/compiler/redundancy-elimination.cc b/deps/v8/src/compiler/redundancy-elimination.cc
index d0bac9bfc02..13611e08835 100644
--- a/deps/v8/src/compiler/redundancy-elimination.cc
+++ b/deps/v8/src/compiler/redundancy-elimination.cc
@@ -238,7 +238,9 @@ Node* RedundancyElimination::EffectPathChecks::LookupBoundsCheckFor(
     Node* node) const {
   for (Check const* check = head_; check != nullptr; check = check->next) {
     if (check->node->opcode() == IrOpcode::kCheckBounds &&
-        check->node->InputAt(0) == node && TypeSubsumes(node, check->node)) {
+        check->node->InputAt(0) == node && TypeSubsumes(node, check->node) &&
+        !(CheckBoundsParametersOf(check->node->op()).flags() &
+          CheckBoundsFlag::kConvertStringAndMinusZero)) {
       return check->node;
     }
   }
@@ -333,8 +335,8 @@ Reduction RedundancyElimination::ReduceSpeculativeNumberComparison(Node* node) {
           // the regular Number comparisons in JavaScript also identify
           // 0 and -0 (unlike special comparisons as Object.is).
           NodeProperties::ReplaceValueInput(node, check, 0);
-          Reduction const reduction = ReduceSpeculativeNumberComparison(node);
-          return reduction.Changed() ? reduction : Changed(node);
+          return Changed(node).FollowedBy(
+              ReduceSpeculativeNumberComparison(node));
         }
       }
     }
@@ -351,8 +353,8 @@ Reduction RedundancyElimination::ReduceSpeculativeNumberComparison(Node* node) {
           // the regular Number comparisons in JavaScript also identify
           // 0 and -0 (unlike special comparisons as Object.is).
           NodeProperties::ReplaceValueInput(node, check, 1);
-          Reduction const reduction = ReduceSpeculativeNumberComparison(node);
-          return reduction.Changed() ? reduction : Changed(node);
+          return Changed(node).FollowedBy(
+              ReduceSpeculativeNumberComparison(node));
         }
       }
     }
diff --git a/deps/v8/src/compiler/representation-change.cc b/deps/v8/src/compiler/representation-change.cc
index 45d0ec994cc..b74012eaf58 100644
--- a/deps/v8/src/compiler/representation-change.cc
+++ b/deps/v8/src/compiler/representation-change.cc
@@ -11,6 +11,7 @@
 #include "src/compiler/js-heap-broker.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-matchers.h"
+#include "src/compiler/simplified-operator.h"
 #include "src/compiler/type-cache.h"
 #include "src/heap/factory-inl.h"
 
@@ -170,7 +171,12 @@ Node* RepresentationChanger::GetRepresentationFor(
 
   // Handle the no-op shortcuts when no checking is necessary.
   if (use_info.type_check() == TypeCheckKind::kNone ||
-      output_rep != MachineRepresentation::kWord32) {
+      // TODO(nicohartmann@, chromium:1077804): Ignoring {use_info.type_check()}
+      // in case the representation already matches is not correct. For now,
+      // this behavior is disabled only for TypeCheckKind::kBigInt, but should
+      // be fixed for all other type checks.
+      (output_rep != MachineRepresentation::kWord32 &&
+       use_info.type_check() != TypeCheckKind::kBigInt)) {
     if (use_info.representation() == output_rep) {
       // Representations are the same. That's a no-op.
       return node;
@@ -381,6 +387,7 @@ Node* RepresentationChanger::GetTaggedPointerRepresentationFor(
   switch (node->opcode()) {
     case IrOpcode::kHeapConstant:
     case IrOpcode::kDelayedStringConstant:
+      if (use_info.type_check() == TypeCheckKind::kBigInt) break;
       return node;  // No change necessary.
     case IrOpcode::kInt32Constant:
     case IrOpcode::kFloat64Constant:
@@ -656,6 +663,7 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
     switch (use_info.type_check()) {
       case TypeCheckKind::kNone:
       case TypeCheckKind::kNumber:
+      case TypeCheckKind::kNumberOrBoolean:
       case TypeCheckKind::kNumberOrOddball:
         return jsgraph()->Float64Constant(m.Value());
       case TypeCheckKind::kBigInt:
@@ -689,6 +697,7 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
   } else if (output_rep == MachineRepresentation::kBit) {
     CHECK(output_type.Is(Type::Boolean()));
     if (use_info.truncation().TruncatesOddballAndBigIntToNumber() ||
+        use_info.type_check() == TypeCheckKind::kNumberOrBoolean ||
         use_info.type_check() == TypeCheckKind::kNumberOrOddball) {
       op = machine()->ChangeUint32ToFloat64();
     } else {
@@ -701,9 +710,16 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
     }
   } else if (IsAnyTagged(output_rep)) {
     if (output_type.Is(Type::Undefined())) {
-      return jsgraph()->Float64Constant(
-          std::numeric_limits<double>::quiet_NaN());
-
+      if (use_info.type_check() == TypeCheckKind::kNumberOrBoolean) {
+        Node* unreachable = InsertUnconditionalDeopt(
+            use_node, DeoptimizeReason::kNotANumberOrBoolean);
+        return jsgraph()->graph()->NewNode(
+            jsgraph()->common()->DeadValue(MachineRepresentation::kFloat64),
+            unreachable);
+      } else {
+        return jsgraph()->Float64Constant(
+            std::numeric_limits<double>::quiet_NaN());
+      }
     } else if (output_rep == MachineRepresentation::kTaggedSigned) {
       node = InsertChangeTaggedSignedToInt32(node);
       op = machine()->ChangeInt32ToFloat64();
@@ -726,6 +742,9 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
                 !output_type.Maybe(Type::BooleanOrNullOrNumber()))) {
       op = simplified()->CheckedTaggedToFloat64(CheckTaggedInputMode::kNumber,
                                                 use_info.feedback());
+    } else if (use_info.type_check() == TypeCheckKind::kNumberOrBoolean) {
+      op = simplified()->CheckedTaggedToFloat64(
+          CheckTaggedInputMode::kNumberOrBoolean, use_info.feedback());
     } else if (use_info.type_check() == TypeCheckKind::kNumberOrOddball) {
       op = simplified()->CheckedTaggedToFloat64(
           CheckTaggedInputMode::kNumberOrOddball, use_info.feedback());
@@ -1160,6 +1179,14 @@ Node* RepresentationChanger::GetWord64RepresentationFor(
       return TypeError(node, output_rep, output_type,
                        MachineRepresentation::kWord64);
     }
+  } else if (output_rep == MachineRepresentation::kWord64) {
+    DCHECK_EQ(use_info.type_check(), TypeCheckKind::kBigInt);
+    if (output_type.Is(Type::BigInt())) {
+      return node;
+    } else {
+      return TypeError(node, output_rep, output_type,
+                       MachineRepresentation::kWord64);
+    }
   } else {
     return TypeError(node, output_rep, output_type,
                      MachineRepresentation::kWord64);
diff --git a/deps/v8/src/compiler/representation-change.h b/deps/v8/src/compiler/representation-change.h
index 78fa1fbe9dc..3654b089fca 100644
--- a/deps/v8/src/compiler/representation-change.h
+++ b/deps/v8/src/compiler/representation-change.h
@@ -119,6 +119,7 @@ enum class TypeCheckKind : uint8_t {
   kSigned32,
   kSigned64,
   kNumber,
+  kNumberOrBoolean,
   kNumberOrOddball,
   kHeapObject,
   kBigInt,
@@ -137,6 +138,8 @@ inline std::ostream& operator<<(std::ostream& os, TypeCheckKind type_check) {
       return os << "Signed64";
     case TypeCheckKind::kNumber:
       return os << "Number";
+    case TypeCheckKind::kNumberOrBoolean:
+      return os << "NumberOrBoolean";
     case TypeCheckKind::kNumberOrOddball:
       return os << "NumberOrOddball";
     case TypeCheckKind::kHeapObject:
@@ -266,6 +269,12 @@ class UseInfo {
     return UseInfo(MachineRepresentation::kWord32, Truncation::Word32(),
                    TypeCheckKind::kNumber, feedback);
   }
+  static UseInfo CheckedNumberOrBooleanAsFloat64(
+      IdentifyZeros identify_zeros, const FeedbackSource& feedback) {
+    return UseInfo(MachineRepresentation::kFloat64,
+                   Truncation::Any(identify_zeros),
+                   TypeCheckKind::kNumberOrBoolean, feedback);
+  }
   static UseInfo CheckedNumberOrOddballAsFloat64(
       IdentifyZeros identify_zeros, const FeedbackSource& feedback) {
     return UseInfo(MachineRepresentation::kFloat64,
diff --git a/deps/v8/src/compiler/schedule.cc b/deps/v8/src/compiler/schedule.cc
index 8bdcef511b6..cc3243cb2e1 100644
--- a/deps/v8/src/compiler/schedule.cc
+++ b/deps/v8/src/compiler/schedule.cc
@@ -218,7 +218,7 @@ void Schedule::AddNode(BasicBlock* block, Node* node) {
 }
 
 void Schedule::AddGoto(BasicBlock* block, BasicBlock* succ) {
-  DCHECK_EQ(BasicBlock::kNone, block->control());
+  CHECK_EQ(BasicBlock::kNone, block->control());
   block->set_control(BasicBlock::kGoto);
   AddSuccessor(block, succ);
 }
@@ -243,7 +243,7 @@ bool IsPotentiallyThrowingCall(IrOpcode::Value opcode) {
 
 void Schedule::AddCall(BasicBlock* block, Node* call, BasicBlock* success_block,
                        BasicBlock* exception_block) {
-  DCHECK_EQ(BasicBlock::kNone, block->control());
+  CHECK_EQ(BasicBlock::kNone, block->control());
   DCHECK(IsPotentiallyThrowingCall(call->opcode()));
   block->set_control(BasicBlock::kCall);
   AddSuccessor(block, success_block);
@@ -253,7 +253,7 @@ void Schedule::AddCall(BasicBlock* block, Node* call, BasicBlock* success_block,
 
 void Schedule::AddBranch(BasicBlock* block, Node* branch, BasicBlock* tblock,
                          BasicBlock* fblock) {
-  DCHECK_EQ(BasicBlock::kNone, block->control());
+  CHECK_EQ(BasicBlock::kNone, block->control());
   DCHECK_EQ(IrOpcode::kBranch, branch->opcode());
   block->set_control(BasicBlock::kBranch);
   AddSuccessor(block, tblock);
@@ -263,7 +263,7 @@ void Schedule::AddBranch(BasicBlock* block, Node* branch, BasicBlock* tblock,
 
 void Schedule::AddSwitch(BasicBlock* block, Node* sw, BasicBlock** succ_blocks,
                          size_t succ_count) {
-  DCHECK_EQ(BasicBlock::kNone, block->control());
+  CHECK_EQ(BasicBlock::kNone, block->control());
   DCHECK_EQ(IrOpcode::kSwitch, sw->opcode());
   block->set_control(BasicBlock::kSwitch);
   for (size_t index = 0; index < succ_count; ++index) {
@@ -273,28 +273,28 @@ void Schedule::AddSwitch(BasicBlock* block, Node* sw, BasicBlock** succ_blocks,
 }
 
 void Schedule::AddTailCall(BasicBlock* block, Node* input) {
-  DCHECK_EQ(BasicBlock::kNone, block->control());
+  CHECK_EQ(BasicBlock::kNone, block->control());
   block->set_control(BasicBlock::kTailCall);
   SetControlInput(block, input);
   if (block != end()) AddSuccessor(block, end());
 }
 
 void Schedule::AddReturn(BasicBlock* block, Node* input) {
-  DCHECK_EQ(BasicBlock::kNone, block->control());
+  CHECK_EQ(BasicBlock::kNone, block->control());
   block->set_control(BasicBlock::kReturn);
   SetControlInput(block, input);
   if (block != end()) AddSuccessor(block, end());
 }
 
 void Schedule::AddDeoptimize(BasicBlock* block, Node* input) {
-  DCHECK_EQ(BasicBlock::kNone, block->control());
+  CHECK_EQ(BasicBlock::kNone, block->control());
   block->set_control(BasicBlock::kDeoptimize);
   SetControlInput(block, input);
   if (block != end()) AddSuccessor(block, end());
 }
 
 void Schedule::AddThrow(BasicBlock* block, Node* input) {
-  DCHECK_EQ(BasicBlock::kNone, block->control());
+  CHECK_EQ(BasicBlock::kNone, block->control());
   block->set_control(BasicBlock::kThrow);
   SetControlInput(block, input);
   if (block != end()) AddSuccessor(block, end());
@@ -302,8 +302,8 @@ void Schedule::AddThrow(BasicBlock* block, Node* input) {
 
 void Schedule::InsertBranch(BasicBlock* block, BasicBlock* end, Node* branch,
                             BasicBlock* tblock, BasicBlock* fblock) {
-  DCHECK_NE(BasicBlock::kNone, block->control());
-  DCHECK_EQ(BasicBlock::kNone, end->control());
+  CHECK_NE(BasicBlock::kNone, block->control());
+  CHECK_EQ(BasicBlock::kNone, end->control());
   end->set_control(block->control());
   block->set_control(BasicBlock::kBranch);
   MoveSuccessors(block, end);
@@ -317,8 +317,8 @@ void Schedule::InsertBranch(BasicBlock* block, BasicBlock* end, Node* branch,
 
 void Schedule::InsertSwitch(BasicBlock* block, BasicBlock* end, Node* sw,
                             BasicBlock** succ_blocks, size_t succ_count) {
-  DCHECK_NE(BasicBlock::kNone, block->control());
-  DCHECK_EQ(BasicBlock::kNone, end->control());
+  CHECK_NE(BasicBlock::kNone, block->control());
+  CHECK_EQ(BasicBlock::kNone, end->control());
   end->set_control(block->control());
   block->set_control(BasicBlock::kSwitch);
   MoveSuccessors(block, end);
diff --git a/deps/v8/src/compiler/serializer-for-background-compilation.cc b/deps/v8/src/compiler/serializer-for-background-compilation.cc
index c6e352d90a6..4c968d21c88 100644
--- a/deps/v8/src/compiler/serializer-for-background-compilation.cc
+++ b/deps/v8/src/compiler/serializer-for-background-compilation.cc
@@ -1090,6 +1090,9 @@ bool SerializerForBackgroundCompilation::BailoutOnUninitialized(
     // OSR entry point. TODO(neis): Support OSR?
     return false;
   }
+  if (FLAG_turboprop && feedback.slot_kind() == FeedbackSlotKind::kCall) {
+    return false;
+  }
   if (feedback.IsInsufficient()) {
     environment()->Kill();
     return true;
@@ -2299,6 +2302,12 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
         if (arguments.size() >= 1) {
           ProcessMapHintsForPromises(arguments[0]);
         }
+        SharedFunctionInfoRef(
+            broker(),
+            broker()->isolate()->factory()->promise_catch_finally_shared_fun());
+        SharedFunctionInfoRef(
+            broker(),
+            broker()->isolate()->factory()->promise_then_finally_shared_fun());
       }
       break;
     }
@@ -2433,6 +2442,17 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
               kMissingArgumentsAreUnknown, result_hints);
         }
       }
+      SharedFunctionInfoRef(
+          broker(), broker()
+                        ->isolate()
+                        ->factory()
+                        ->promise_capability_default_reject_shared_fun());
+      SharedFunctionInfoRef(
+          broker(), broker()
+                        ->isolate()
+                        ->factory()
+                        ->promise_capability_default_resolve_shared_fun());
+
       break;
     case Builtins::kFunctionPrototypeCall:
       if (arguments.size() >= 1) {
diff --git a/deps/v8/src/compiler/simd-scalar-lowering.cc b/deps/v8/src/compiler/simd-scalar-lowering.cc
index db5a7368553..2aaf9bb7b6d 100644
--- a/deps/v8/src/compiler/simd-scalar-lowering.cc
+++ b/deps/v8/src/compiler/simd-scalar-lowering.cc
@@ -26,7 +26,31 @@ static const int32_t kMask16 = 0xFFFF;
 static const int32_t kMask8 = 0xFF;
 static const int32_t kShift16 = 16;
 static const int32_t kShift8 = 24;
-}  // anonymous
+static const int32_t kShiftMask8 = 0x7;
+static const int32_t kShiftMask16 = 0xF;
+static const int32_t kShiftMask32 = 0x1F;
+
+// Shift values are taken modulo lane size. This helper calculates the mask
+// required for different shift opcodes.
+int GetMaskForShift(Node* node) {
+  switch (node->opcode()) {
+    case IrOpcode::kI8x16Shl:
+    case IrOpcode::kI8x16ShrS:
+    case IrOpcode::kI8x16ShrU:
+      return kShiftMask8;
+    case IrOpcode::kI16x8Shl:
+    case IrOpcode::kI16x8ShrS:
+    case IrOpcode::kI16x8ShrU:
+      return kShiftMask16;
+    case IrOpcode::kI32x4Shl:
+    case IrOpcode::kI32x4ShrS:
+    case IrOpcode::kI32x4ShrU:
+      return kShiftMask32;
+    default:
+      UNIMPLEMENTED();
+  }
+}
+}  // anonymous namespace
 
 SimdScalarLowering::SimdScalarLowering(
     MachineGraph* mcgraph, Signature<MachineRepresentation>* signature)
@@ -118,12 +142,12 @@ void SimdScalarLowering::LowerGraph() {
   V(S128Or)                       \
   V(S128Xor)                      \
   V(S128Not)                      \
-  V(S1x4AnyTrue)                  \
-  V(S1x4AllTrue)                  \
-  V(S1x8AnyTrue)                  \
-  V(S1x8AllTrue)                  \
-  V(S1x16AnyTrue)                 \
-  V(S1x16AllTrue)
+  V(V32x4AnyTrue)                 \
+  V(V32x4AllTrue)                 \
+  V(V16x8AnyTrue)                 \
+  V(V16x8AllTrue)                 \
+  V(V8x16AnyTrue)                 \
+  V(V8x16AllTrue)
 
 #define FOREACH_FLOAT64X2_OPCODE(V) V(F64x2Splat)
 
@@ -934,9 +958,8 @@ void SimdScalarLowering::LowerPack(Node* node, SimdType input_rep_type,
 }
 
 void SimdScalarLowering::LowerShiftOp(Node* node, SimdType type) {
-  DCHECK_EQ(1, node->InputCount());
-  int32_t shift_amount = OpParameter<int32_t>(node->op());
-  Node* shift_node = graph()->NewNode(common()->Int32Constant(shift_amount));
+  DCHECK_EQ(2, node->InputCount());
+  Node* shift_node = Mask(node->InputAt(1), GetMaskForShift(node));
   Node** rep = GetReplacementsWithType(node->InputAt(0), type);
   int num_lanes = NumLanes(type);
   Node** rep_node = zone()->NewArray<Node*>(num_lanes);
@@ -1604,32 +1627,40 @@ void SimdScalarLowering::LowerNode(Node* node) {
       ReplaceNode(node, rep_node, 16);
       break;
     }
-    case IrOpcode::kS1x4AnyTrue:
-    case IrOpcode::kS1x4AllTrue:
-    case IrOpcode::kS1x8AnyTrue:
-    case IrOpcode::kS1x8AllTrue:
-    case IrOpcode::kS1x16AnyTrue:
-    case IrOpcode::kS1x16AllTrue: {
+    case IrOpcode::kV32x4AnyTrue:
+    case IrOpcode::kV32x4AllTrue:
+    case IrOpcode::kV16x8AnyTrue:
+    case IrOpcode::kV16x8AllTrue:
+    case IrOpcode::kV8x16AnyTrue:
+    case IrOpcode::kV8x16AllTrue: {
       DCHECK_EQ(1, node->InputCount());
       SimdType input_rep_type = ReplacementType(node->InputAt(0));
+      Node** rep;
+      // If the input is a SIMD float, bitcast it to a SIMD int of the same
+      // shape, because the comparisons below use Word32.
+      if (input_rep_type == SimdType::kFloat32x4) {
+        // TODO(v8:9418): f64x2 lowering is not implemented yet.
+        rep = GetReplacementsWithType(node->InputAt(0), SimdType::kInt32x4);
+      } else {
+        rep = GetReplacements(node->InputAt(0));
+      }
       int input_num_lanes = NumLanes(input_rep_type);
-      Node** rep = GetReplacements(node->InputAt(0));
       Node** rep_node = zone()->NewArray<Node*>(num_lanes);
       Node* true_node = mcgraph_->Int32Constant(1);
       Node* false_node = mcgraph_->Int32Constant(0);
       Node* tmp_result = false_node;
-      if (node->opcode() == IrOpcode::kS1x4AllTrue ||
-          node->opcode() == IrOpcode::kS1x8AllTrue ||
-          node->opcode() == IrOpcode::kS1x16AllTrue) {
+      if (node->opcode() == IrOpcode::kV32x4AllTrue ||
+          node->opcode() == IrOpcode::kV16x8AllTrue ||
+          node->opcode() == IrOpcode::kV8x16AllTrue) {
         tmp_result = true_node;
       }
       for (int i = 0; i < input_num_lanes; ++i) {
         Diamond is_false(
             graph(), common(),
             graph()->NewNode(machine()->Word32Equal(), rep[i], false_node));
-        if (node->opcode() == IrOpcode::kS1x4AllTrue ||
-            node->opcode() == IrOpcode::kS1x8AllTrue ||
-            node->opcode() == IrOpcode::kS1x16AllTrue) {
+        if (node->opcode() == IrOpcode::kV32x4AllTrue ||
+            node->opcode() == IrOpcode::kV16x8AllTrue ||
+            node->opcode() == IrOpcode::kV8x16AllTrue) {
           tmp_result = is_false.Phi(MachineRepresentation::kWord32, false_node,
                                     tmp_result);
         } else {
@@ -1810,6 +1841,9 @@ Node** SimdScalarLowering::GetReplacementsWithType(Node* node, SimdType type) {
       Int32ToFloat32(replacements, result);
     } else if (ReplacementType(node) == SimdType::kInt16x8) {
       UNIMPLEMENTED();
+    } else if (ReplacementType(node) == SimdType::kInt8x16) {
+      SmallerIntToInt32<int8_t>(replacements, result);
+      Int32ToFloat32(result, result);
     } else {
       UNREACHABLE();
     }
diff --git a/deps/v8/src/compiler/simplified-lowering.cc b/deps/v8/src/compiler/simplified-lowering.cc
index aa222af96cf..2563d6e94ef 100644
--- a/deps/v8/src/compiler/simplified-lowering.cc
+++ b/deps/v8/src/compiler/simplified-lowering.cc
@@ -105,6 +105,9 @@ UseInfo CheckedUseInfoAsWord32FromHint(
       return UseInfo::CheckedSigned32AsWord32(identify_zeros, feedback);
     case NumberOperationHint::kNumber:
       return UseInfo::CheckedNumberAsWord32(feedback);
+    case NumberOperationHint::kNumberOrBoolean:
+      // Not used currently.
+      UNREACHABLE();
     case NumberOperationHint::kNumberOrOddball:
       return UseInfo::CheckedNumberOrOddballAsWord32(feedback);
   }
@@ -122,6 +125,8 @@ UseInfo CheckedUseInfoAsFloat64FromHint(
       UNREACHABLE();
     case NumberOperationHint::kNumber:
       return UseInfo::CheckedNumberAsFloat64(identify_zeros, feedback);
+    case NumberOperationHint::kNumberOrBoolean:
+      return UseInfo::CheckedNumberOrBooleanAsFloat64(identify_zeros, feedback);
     case NumberOperationHint::kNumberOrOddball:
       return UseInfo::CheckedNumberOrOddballAsFloat64(identify_zeros, feedback);
   }
@@ -251,6 +256,7 @@ class RepresentationSelector {
     void reset_state() { state_ = kUnvisited; }
     bool visited() const { return state_ == kVisited; }
     bool queued() const { return state_ == kQueued; }
+    bool pushed() const { return state_ == kPushed; }
     bool unvisited() const { return state_ == kUnvisited; }
     Truncation truncation() const { return truncation_; }
     void set_output(MachineRepresentation output) { representation_ = output; }
@@ -284,17 +290,16 @@ class RepresentationSelector {
                          TickCounter* tick_counter)
       : jsgraph_(jsgraph),
         zone_(zone),
+        might_need_revisit_(zone),
         count_(jsgraph->graph()->NodeCount()),
         info_(count_, zone),
 #ifdef DEBUG
         node_input_use_infos_(count_, InputUseInfos(zone), zone),
 #endif
-        nodes_(zone),
         replacements_(zone),
-        phase_(PROPAGATE),
         changer_(changer),
-        queue_(zone),
-        typing_stack_(zone),
+        revisit_queue_(zone),
+        traversal_nodes_(zone),
         source_positions_(source_positions),
         node_origins_(node_origins),
         type_cache_(TypeCache::Get()),
@@ -306,68 +311,55 @@ class RepresentationSelector {
   void RunTypePropagationPhase() {
     // Run type propagation.
     TRACE("--{Type propagation phase}--\n");
-    phase_ = RETYPE;
     ResetNodeInfoState();
+    DCHECK(revisit_queue_.empty());
 
-    DCHECK(typing_stack_.empty());
-    typing_stack_.push({graph()->end(), 0});
-    GetInfo(graph()->end())->set_pushed();
-    while (!typing_stack_.empty()) {
-      NodeState& current = typing_stack_.top();
-
-      // If there is an unvisited input, push it and continue.
-      bool pushed_unvisited = false;
-      while (current.input_index < current.node->InputCount()) {
-        Node* input = current.node->InputAt(current.input_index);
-        NodeInfo* input_info = GetInfo(input);
-        current.input_index++;
-        if (input_info->unvisited()) {
-          input_info->set_pushed();
-          typing_stack_.push({input, 0});
-          pushed_unvisited = true;
-          break;
-        }
-      }
-      if (pushed_unvisited) continue;
-
-      // Process the top of the stack.
-      Node* node = current.node;
-      typing_stack_.pop();
+    for (auto it = traversal_nodes_.cbegin(); it != traversal_nodes_.cend();
+         ++it) {
+      Node* node = *it;
       NodeInfo* info = GetInfo(node);
       info->set_visited();
       bool updated = UpdateFeedbackType(node);
       TRACE(" visit #%d: %s\n", node->id(), node->op()->mnemonic());
-      VisitNode(node, info->truncation(), nullptr);
+      VisitNode<RETYPE>(node, info->truncation(), nullptr);
       TRACE("  ==> output ");
       PrintOutputInfo(info);
       TRACE("\n");
       if (updated) {
-        for (Node* const user : node->uses()) {
+        auto revisit_it = might_need_revisit_.find(node);
+        if (revisit_it == might_need_revisit_.end()) continue;
+
+        for (Node* const user : revisit_it->second) {
           if (GetInfo(user)->visited()) {
+            TRACE(" QUEUEING #%d: %s\n", user->id(), user->op()->mnemonic());
             GetInfo(user)->set_queued();
-            queue_.push(user);
+            revisit_queue_.push(user);
           }
         }
       }
     }
 
     // Process the revisit queue.
-    while (!queue_.empty()) {
-      Node* node = queue_.front();
-      queue_.pop();
+    while (!revisit_queue_.empty()) {
+      Node* node = revisit_queue_.front();
+      revisit_queue_.pop();
       NodeInfo* info = GetInfo(node);
       info->set_visited();
       bool updated = UpdateFeedbackType(node);
-      TRACE(" visit #%d: %s\n", node->id(), node->op()->mnemonic());
-      VisitNode(node, info->truncation(), nullptr);
+      TRACE(" revisit #%d: %s\n", node->id(), node->op()->mnemonic());
+      VisitNode<RETYPE>(node, info->truncation(), nullptr);
       TRACE("  ==> output ");
       PrintOutputInfo(info);
       TRACE("\n");
       if (updated) {
+        // Here we need to check all uses since we can't easily know which
+        // nodes will need to be revisited due to having an input which was
+        // a revisited node.
         for (Node* const user : node->uses()) {
           if (GetInfo(user)->visited()) {
+            TRACE(" QUEUEING #%d: %s\n", user->id(), user->op()->mnemonic());
             GetInfo(user)->set_queued();
-            queue_.push(user);
+            revisit_queue_.push(user);
           }
         }
       }
@@ -595,31 +587,86 @@ class RepresentationSelector {
   void RunTruncationPropagationPhase() {
     // Run propagation phase to a fixpoint.
     TRACE("--{Propagation phase}--\n");
-    phase_ = PROPAGATE;
-    EnqueueInitial(jsgraph_->graph()->end());
-    // Process nodes from the queue until it is empty.
-    while (!queue_.empty()) {
-      Node* node = queue_.front();
+    ResetNodeInfoState();
+    DCHECK(revisit_queue_.empty());
+
+    // Process nodes in reverse post order, with End as the root.
+    for (auto it = traversal_nodes_.crbegin(); it != traversal_nodes_.crend();
+         ++it) {
+      Node* node = *it;
       NodeInfo* info = GetInfo(node);
-      queue_.pop();
       info->set_visited();
       TRACE(" visit #%d: %s (trunc: %s)\n", node->id(), node->op()->mnemonic(),
             info->truncation().description());
-      VisitNode(node, info->truncation(), nullptr);
+      VisitNode<PROPAGATE>(node, info->truncation(), nullptr);
+    }
+
+    // Revisit queue
+    while (!revisit_queue_.empty()) {
+      Node* node = revisit_queue_.front();
+      NodeInfo* info = GetInfo(node);
+      revisit_queue_.pop();
+      info->set_visited();
+      TRACE(" visit #%d: %s (trunc: %s)\n", node->id(), node->op()->mnemonic(),
+            info->truncation().description());
+      VisitNode<PROPAGATE>(node, info->truncation(), nullptr);
+    }
+  }
+
+  // Generates a pre-order traversal of the nodes, starting with End.
+  void GenerateTraversal() {
+    ZoneStack<NodeState> stack(zone_);
+
+    stack.push({graph()->end(), 0});
+    GetInfo(graph()->end())->set_pushed();
+    while (!stack.empty()) {
+      NodeState& current = stack.top();
+      Node* node = current.node;
+
+      // If there is an unvisited input, push it and continue with that node.
+      bool pushed_unvisited = false;
+      while (current.input_index < node->InputCount()) {
+        Node* input = node->InputAt(current.input_index);
+        NodeInfo* input_info = GetInfo(input);
+        current.input_index++;
+        if (input_info->unvisited()) {
+          input_info->set_pushed();
+          stack.push({input, 0});
+          pushed_unvisited = true;
+          break;
+        } else if (input_info->pushed()) {
+          // Optimization for the Retype phase.
+          // If we had already pushed (and not visited) an input, it means that
+          // the current node will be visited in the Retype phase before one of
+          // its inputs. If this happens, the current node might need to be
+          // revisited.
+          MarkAsPossibleRevisit(node, input);
+        }
+      }
+
+      if (pushed_unvisited) continue;
+
+      stack.pop();
+      NodeInfo* info = GetInfo(node);
+      info->set_visited();
+
+      // Generate the traversal
+      traversal_nodes_.push_back(node);
     }
   }
 
   void Run(SimplifiedLowering* lowering) {
+    GenerateTraversal();
+
     RunTruncationPropagationPhase();
 
     RunTypePropagationPhase();
 
     // Run lowering and change insertion phase.
     TRACE("--{Simplified lowering phase}--\n");
-    phase_ = LOWER;
-    // Process nodes from the collected {nodes_} vector.
-    for (NodeVector::iterator i = nodes_.begin(); i != nodes_.end(); ++i) {
-      Node* node = *i;
+    for (auto it = traversal_nodes_.cbegin(); it != traversal_nodes_.cend();
+         ++it) {
+      Node* node = *it;
       NodeInfo* info = GetInfo(node);
       TRACE(" visit #%d: %s\n", node->id(), node->op()->mnemonic());
       // Reuse {VisitNode()} so the representation rules are in one place.
@@ -627,7 +674,7 @@ class RepresentationSelector {
           source_positions_, source_positions_->GetSourcePosition(node));
       NodeOriginTable::Scope origin_scope(node_origins_, "simplified lowering",
                                           node);
-      VisitNode(node, info->truncation(), lowering);
+      VisitNode<LOWER>(node, info->truncation(), lowering);
     }
 
     // Perform the final replacements.
@@ -645,75 +692,34 @@ class RepresentationSelector {
     }
   }
 
-  void EnqueueInitial(Node* node) {
-    NodeInfo* info = GetInfo(node);
-    info->set_queued();
-    nodes_.push_back(node);
-    queue_.push(node);
-  }
-
-  // Enqueue {use_node}'s {index} input if the {use} contains new information
-  // for that input node. Add the input to {nodes_} if this is the first time
-  // it's been visited.
+  // Just assert for Retype and Lower. Propagate specialized below.
+  template <Phase T>
   void EnqueueInput(Node* use_node, int index,
                     UseInfo use_info = UseInfo::None()) {
-    Node* node = use_node->InputAt(index);
-    if (phase_ != PROPAGATE) return;
-    NodeInfo* info = GetInfo(node);
-#ifdef DEBUG
-    // Check monotonicity of input requirements.
-    node_input_use_infos_[use_node->id()].SetAndCheckInput(use_node, index,
-                                                           use_info);
-#endif  // DEBUG
-    if (info->unvisited()) {
-      // First visit of this node.
-      info->set_queued();
-      nodes_.push_back(node);
-      queue_.push(node);
-      TRACE("  initial #%i: ", node->id());
-      info->AddUse(use_info);
-      PrintTruncation(info->truncation());
-      return;
-    }
-    TRACE("   queue #%i?: ", node->id());
-    PrintTruncation(info->truncation());
-    if (info->AddUse(use_info)) {
-      // New usage information for the node is available.
-      if (!info->queued()) {
-        queue_.push(node);
-        info->set_queued();
-        TRACE("   added: ");
-      } else {
-        TRACE(" inqueue: ");
-      }
-      PrintTruncation(info->truncation());
-    }
+    static_assert(retype<T>() || lower<T>(),
+                  "This version of ProcessRemainingInputs has to be called in "
+                  "the Retype or Lower phase.");
   }
 
-  bool lower() const { return phase_ == LOWER; }
-  bool retype() const { return phase_ == RETYPE; }
-  bool propagate() const { return phase_ == PROPAGATE; }
+  template <Phase T>
+  static constexpr bool propagate() {
+    return T == PROPAGATE;
+  }
 
-  void SetOutput(Node* node, MachineRepresentation representation,
-                 Type restriction_type = Type::Any()) {
-    NodeInfo* const info = GetInfo(node);
-    switch (phase_) {
-      case PROPAGATE:
-        info->set_restriction_type(restriction_type);
-        break;
-      case RETYPE:
-        DCHECK(info->restriction_type().Is(restriction_type));
-        DCHECK(restriction_type.Is(info->restriction_type()));
-        info->set_output(representation);
-        break;
-      case LOWER:
-        DCHECK_EQ(info->representation(), representation);
-        DCHECK(info->restriction_type().Is(restriction_type));
-        DCHECK(restriction_type.Is(info->restriction_type()));
-        break;
-    }
+  template <Phase T>
+  static constexpr bool retype() {
+    return T == RETYPE;
+  }
+
+  template <Phase T>
+  static constexpr bool lower() {
+    return T == LOWER;
   }
 
+  template <Phase T>
+  void SetOutput(Node* node, MachineRepresentation representation,
+                 Type restriction_type = Type::Any());
+
   Type GetUpperBound(Node* node) { return NodeProperties::GetType(node); }
 
   bool InputCannotBe(Node* node, Type type) {
@@ -842,148 +848,147 @@ class RepresentationSelector {
     }
   }
 
-  void ProcessInput(Node* node, int index, UseInfo use) {
-    DCHECK_IMPLIES(use.type_check() != TypeCheckKind::kNone,
-                   !node->op()->HasProperty(Operator::kNoDeopt) &&
-                       node->op()->EffectInputCount() > 0);
-
-    switch (phase_) {
-      case PROPAGATE:
-        EnqueueInput(node, index, use);
-        break;
-      case RETYPE:
-        break;
-      case LOWER:
-        ConvertInput(node, index, use);
-        break;
-    }
-  }
+  template <Phase T>
+  void ProcessInput(Node* node, int index, UseInfo use);
 
+  // Just assert for Retype and Lower. Propagate specialized below.
+  template <Phase T>
   void ProcessRemainingInputs(Node* node, int index) {
+    static_assert(retype<T>() || lower<T>(),
+                  "This version of ProcessRemainingInputs has to be called in "
+                  "the Retype or Lower phase.");
     DCHECK_GE(index, NodeProperties::PastValueIndex(node));
     DCHECK_GE(index, NodeProperties::PastContextIndex(node));
-    for (int i = std::max(index, NodeProperties::FirstEffectIndex(node));
-         i < NodeProperties::PastEffectIndex(node); ++i) {
-      EnqueueInput(node, i);  // Effect inputs: just visit
-    }
-    for (int i = std::max(index, NodeProperties::FirstControlIndex(node));
-         i < NodeProperties::PastControlIndex(node); ++i) {
-      EnqueueInput(node, i);  // Control inputs: just visit
+  }
+
+  // Marks node as a possible revisit since it is a use of input that will be
+  // visited before input is visited.
+  void MarkAsPossibleRevisit(Node* node, Node* input) {
+    auto it = might_need_revisit_.find(input);
+    if (it == might_need_revisit_.end()) {
+      it = might_need_revisit_.insert({input, ZoneVector<Node*>(zone())}).first;
     }
+    it->second.push_back(node);
+    TRACE(" Marking #%d: %s as needing revisit due to #%d: %s\n", node->id(),
+          node->op()->mnemonic(), input->id(), input->op()->mnemonic());
   }
 
-  // The default, most general visitation case. For {node}, process all value,
-  // context, frame state, effect, and control inputs, assuming that value
-  // inputs should have {kRepTagged} representation and can observe all output
-  // values {kTypeAny}.
+  // Just assert for Retype. Propagate and Lower specialized below.
+  template <Phase T>
   void VisitInputs(Node* node) {
-    int tagged_count = node->op()->ValueInputCount() +
-                       OperatorProperties::GetContextInputCount(node->op()) +
-                       OperatorProperties::GetFrameStateInputCount(node->op());
-    // Visit value, context and frame state inputs as tagged.
-    for (int i = 0; i < tagged_count; i++) {
-      ProcessInput(node, i, UseInfo::AnyTagged());
-    }
-    // Only enqueue other inputs (effects, control).
-    for (int i = tagged_count; i < node->InputCount(); i++) {
-      EnqueueInput(node, i);
-    }
+    static_assert(
+        retype<T>(),
+        "This version of VisitInputs has to be called in the Retype phase.");
   }
 
+  template <Phase T>
   void VisitReturn(Node* node) {
     int tagged_limit = node->op()->ValueInputCount() +
                        OperatorProperties::GetContextInputCount(node->op()) +
                        OperatorProperties::GetFrameStateInputCount(node->op());
     // Visit integer slot count to pop
-    ProcessInput(node, 0, UseInfo::TruncatingWord32());
+    ProcessInput<T>(node, 0, UseInfo::TruncatingWord32());
 
     // Visit value, context and frame state inputs as tagged.
     for (int i = 1; i < tagged_limit; i++) {
-      ProcessInput(node, i, UseInfo::AnyTagged());
+      ProcessInput<T>(node, i, UseInfo::AnyTagged());
     }
     // Only enqueue other inputs (effects, control).
     for (int i = tagged_limit; i < node->InputCount(); i++) {
-      EnqueueInput(node, i);
+      EnqueueInput<T>(node, i);
     }
   }
 
   // Helper for an unused node.
+  template <Phase T>
   void VisitUnused(Node* node) {
     int value_count = node->op()->ValueInputCount() +
                       OperatorProperties::GetContextInputCount(node->op()) +
                       OperatorProperties::GetFrameStateInputCount(node->op());
     for (int i = 0; i < value_count; i++) {
-      ProcessInput(node, i, UseInfo::None());
+      ProcessInput<T>(node, i, UseInfo::None());
     }
-    ProcessRemainingInputs(node, value_count);
-    if (lower()) Kill(node);
+    ProcessRemainingInputs<T>(node, value_count);
+    if (lower<T>()) Kill(node);
   }
 
   // Helper for no-op node.
+  template <Phase T>
   void VisitNoop(Node* node, Truncation truncation) {
-    if (truncation.IsUnused()) return VisitUnused(node);
+    if (truncation.IsUnused()) return VisitUnused<T>(node);
     MachineRepresentation representation =
         GetOutputInfoForPhi(node, TypeOf(node), truncation);
-    VisitUnop(node, UseInfo(representation, truncation), representation);
-    if (lower()) DeferReplacement(node, node->InputAt(0));
+    VisitUnop<T>(node, UseInfo(representation, truncation), representation);
+    if (lower<T>()) DeferReplacement(node, node->InputAt(0));
   }
 
   // Helper for binops of the R x L -> O variety.
+  template <Phase T>
   void VisitBinop(Node* node, UseInfo left_use, UseInfo right_use,
                   MachineRepresentation output,
                   Type restriction_type = Type::Any()) {
     DCHECK_EQ(2, node->op()->ValueInputCount());
-    ProcessInput(node, 0, left_use);
-    ProcessInput(node, 1, right_use);
+    ProcessInput<T>(node, 0, left_use);
+    ProcessInput<T>(node, 1, right_use);
     for (int i = 2; i < node->InputCount(); i++) {
-      EnqueueInput(node, i);
+      EnqueueInput<T>(node, i);
     }
-    SetOutput(node, output, restriction_type);
+    SetOutput<T>(node, output, restriction_type);
   }
 
   // Helper for binops of the I x I -> O variety.
+  template <Phase T>
   void VisitBinop(Node* node, UseInfo input_use, MachineRepresentation output,
                   Type restriction_type = Type::Any()) {
-    VisitBinop(node, input_use, input_use, output, restriction_type);
+    VisitBinop<T>(node, input_use, input_use, output, restriction_type);
   }
 
+  template <Phase T>
   void VisitSpeculativeInt32Binop(Node* node) {
     DCHECK_EQ(2, node->op()->ValueInputCount());
     if (BothInputsAre(node, Type::NumberOrOddball())) {
-      return VisitBinop(node, UseInfo::TruncatingWord32(),
-                        MachineRepresentation::kWord32);
+      return VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                           MachineRepresentation::kWord32);
     }
     NumberOperationHint hint = NumberOperationHintOf(node->op());
-    return VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
-                      MachineRepresentation::kWord32);
+    return VisitBinop<T>(node, CheckedUseInfoAsWord32FromHint(hint),
+                         MachineRepresentation::kWord32);
   }
 
   // Helper for unops of the I -> O variety.
+  template <Phase T>
   void VisitUnop(Node* node, UseInfo input_use, MachineRepresentation output,
                  Type restriction_type = Type::Any()) {
     DCHECK_EQ(1, node->op()->ValueInputCount());
-    ProcessInput(node, 0, input_use);
-    ProcessRemainingInputs(node, 1);
-    SetOutput(node, output, restriction_type);
+    ProcessInput<T>(node, 0, input_use);
+    ProcessRemainingInputs<T>(node, 1);
+    SetOutput<T>(node, output, restriction_type);
   }
 
   // Helper for leaf nodes.
+  template <Phase T>
   void VisitLeaf(Node* node, MachineRepresentation output) {
     DCHECK_EQ(0, node->InputCount());
-    SetOutput(node, output);
+    SetOutput<T>(node, output);
   }
 
   // Helpers for specific types of binops.
+
+  template <Phase T>
   void VisitFloat64Binop(Node* node) {
-    VisitBinop(node, UseInfo::TruncatingFloat64(),
-               MachineRepresentation::kFloat64);
+    VisitBinop<T>(node, UseInfo::TruncatingFloat64(),
+                  MachineRepresentation::kFloat64);
   }
+
+  template <Phase T>
   void VisitInt64Binop(Node* node) {
-    VisitBinop(node, UseInfo::Word64(), MachineRepresentation::kWord64);
+    VisitBinop<T>(node, UseInfo::Word64(), MachineRepresentation::kWord64);
   }
+
+  template <Phase T>
   void VisitWord32TruncatingBinop(Node* node) {
-    VisitBinop(node, UseInfo::TruncatingWord32(),
-               MachineRepresentation::kWord32);
+    VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                  MachineRepresentation::kWord32);
   }
 
   // Infer representation for phi-like nodes.
@@ -1014,23 +1019,25 @@ class RepresentationSelector {
       return MachineRepresentation::kFloat64;
     } else if (type.Is(Type::BigInt()) && use.IsUsedAsWord64()) {
       return MachineRepresentation::kWord64;
-    } else if (type.Is(Type::ExternalPointer())) {
+    } else if (type.Is(Type::ExternalPointer()) ||
+               type.Is(Type::SandboxedExternalPointer())) {
       return MachineType::PointerRepresentation();
     }
     return MachineRepresentation::kTagged;
   }
 
   // Helper for handling selects.
+  template <Phase T>
   void VisitSelect(Node* node, Truncation truncation,
                    SimplifiedLowering* lowering) {
     DCHECK(TypeOf(node->InputAt(0)).Is(Type::Boolean()));
-    ProcessInput(node, 0, UseInfo::Bool());
+    ProcessInput<T>(node, 0, UseInfo::Bool());
 
     MachineRepresentation output =
         GetOutputInfoForPhi(node, TypeOf(node), truncation);
-    SetOutput(node, output);
+    SetOutput<T>(node, output);
 
-    if (lower()) {
+    if (lower<T>()) {
       // Update the select operator.
       SelectParameters p = SelectParametersOf(node->op());
       if (output != p.representation()) {
@@ -1041,21 +1048,22 @@ class RepresentationSelector {
     // Convert inputs to the output representation of this phi, pass the
     // truncation truncation along.
     UseInfo input_use(output, truncation);
-    ProcessInput(node, 1, input_use);
-    ProcessInput(node, 2, input_use);
+    ProcessInput<T>(node, 1, input_use);
+    ProcessInput<T>(node, 2, input_use);
   }
 
   // Helper for handling phis.
+  template <Phase T>
   void VisitPhi(Node* node, Truncation truncation,
                 SimplifiedLowering* lowering) {
     MachineRepresentation output =
         GetOutputInfoForPhi(node, TypeOf(node), truncation);
     // Only set the output representation if not running with type
     // feedback. (Feedback typing will set the representation.)
-    SetOutput(node, output);
+    SetOutput<T>(node, output);
 
     int values = node->op()->ValueInputCount();
-    if (lower()) {
+    if (lower<T>()) {
       // Update the phi operator.
       if (output != PhiRepresentationOf(node->op())) {
         NodeProperties::ChangeOp(node, lowering->common()->Phi(output, values));
@@ -1066,37 +1074,40 @@ class RepresentationSelector {
     // truncation along.
     UseInfo input_use(output, truncation);
     for (int i = 0; i < node->InputCount(); i++) {
-      ProcessInput(node, i, i < values ? input_use : UseInfo::None());
+      ProcessInput<T>(node, i, i < values ? input_use : UseInfo::None());
     }
   }
 
+  template <Phase T>
   void VisitObjectIs(Node* node, Type type, SimplifiedLowering* lowering) {
     Type const input_type = TypeOf(node->InputAt(0));
     if (input_type.Is(type)) {
-      VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
-      if (lower()) {
+      VisitUnop<T>(node, UseInfo::None(), MachineRepresentation::kBit);
+      if (lower<T>()) {
         DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
       }
     } else {
-      VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
-      if (lower() && !input_type.Maybe(type)) {
+      VisitUnop<T>(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
+      if (lower<T>() && !input_type.Maybe(type)) {
         DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
       }
     }
   }
 
+  template <Phase T>
   void VisitCheck(Node* node, Type type, SimplifiedLowering* lowering) {
     if (InputIs(node, type)) {
-      VisitUnop(node, UseInfo::AnyTagged(),
-                MachineRepresentation::kTaggedPointer);
-      if (lower()) DeferReplacement(node, node->InputAt(0));
+      VisitUnop<T>(node, UseInfo::AnyTagged(),
+                   MachineRepresentation::kTaggedPointer);
+      if (lower<T>()) DeferReplacement(node, node->InputAt(0));
     } else {
-      VisitUnop(node,
-                UseInfo::CheckedHeapObjectAsTaggedPointer(FeedbackSource()),
-                MachineRepresentation::kTaggedPointer);
+      VisitUnop<T>(node,
+                   UseInfo::CheckedHeapObjectAsTaggedPointer(FeedbackSource()),
+                   MachineRepresentation::kTaggedPointer);
     }
   }
 
+  template <Phase T>
   void VisitCall(Node* node, SimplifiedLowering* lowering) {
     auto call_descriptor = CallDescriptorOf(node->op());
     int params = static_cast<int>(call_descriptor->ParameterCount());
@@ -1105,21 +1116,21 @@ class RepresentationSelector {
     for (int i = 0; i < value_input_count; i++) {
       if (i == 0) {
         // The target of the call.
-        ProcessInput(node, i, UseInfo::Any());
+        ProcessInput<T>(node, i, UseInfo::Any());
       } else if ((i - 1) < params) {
-        ProcessInput(node, i,
-                     TruncatingUseInfoFromRepresentation(
-                         call_descriptor->GetInputType(i).representation()));
+        ProcessInput<T>(node, i,
+                        TruncatingUseInfoFromRepresentation(
+                            call_descriptor->GetInputType(i).representation()));
       } else {
-        ProcessInput(node, i, UseInfo::AnyTagged());
+        ProcessInput<T>(node, i, UseInfo::AnyTagged());
       }
     }
-    ProcessRemainingInputs(node, value_input_count);
+    ProcessRemainingInputs<T>(node, value_input_count);
 
     if (call_descriptor->ReturnCount() > 0) {
-      SetOutput(node, call_descriptor->GetReturnType(0).representation());
+      SetOutput<T>(node, call_descriptor->GetReturnType(0).representation());
     } else {
-      SetOutput(node, MachineRepresentation::kTagged);
+      SetOutput<T>(node, MachineRepresentation::kTagged);
     }
   }
 
@@ -1168,8 +1179,9 @@ class RepresentationSelector {
     return machine_type;
   }
 
+  template <Phase T>
   void VisitStateValues(Node* node) {
-    if (propagate()) {
+    if (propagate<T>()) {
       for (int i = 0; i < node->InputCount(); i++) {
         // When lowering 64 bit BigInts to Word64 representation, we have to
         // make sure they are rematerialized before deoptimization. By
@@ -1178,12 +1190,12 @@ class RepresentationSelector {
         // TODO(nicohartmann): Remove, once the deoptimizer can rematerialize
         // truncated BigInts.
         if (TypeOf(node->InputAt(i)).Is(Type::BigInt())) {
-          EnqueueInput(node, i, UseInfo::AnyTagged());
+          EnqueueInput<T>(node, i, UseInfo::AnyTagged());
         } else {
-          EnqueueInput(node, i, UseInfo::Any());
+          EnqueueInput<T>(node, i, UseInfo::Any());
         }
       }
-    } else if (lower()) {
+    } else if (lower<T>()) {
       Zone* zone = jsgraph_->zone();
       ZoneVector<MachineType>* types =
           new (zone->New(sizeof(ZoneVector<MachineType>)))
@@ -1203,29 +1215,30 @@ class RepresentationSelector {
       NodeProperties::ChangeOp(
           node, jsgraph_->common()->TypedStateValues(types, mask));
     }
-    SetOutput(node, MachineRepresentation::kTagged);
+    SetOutput<T>(node, MachineRepresentation::kTagged);
   }
 
+  template <Phase T>
   void VisitFrameState(Node* node) {
     DCHECK_EQ(5, node->op()->ValueInputCount());
     DCHECK_EQ(1, OperatorProperties::GetFrameStateInputCount(node->op()));
 
-    ProcessInput(node, 0, UseInfo::AnyTagged());  // Parameters.
-    ProcessInput(node, 1, UseInfo::AnyTagged());  // Registers.
+    ProcessInput<T>(node, 0, UseInfo::AnyTagged());  // Parameters.
+    ProcessInput<T>(node, 1, UseInfo::AnyTagged());  // Registers.
 
     // Accumulator is a special flower - we need to remember its type in
     // a singleton typed-state-values node (as if it was a singleton
     // state-values node).
     Node* accumulator = node->InputAt(2);
-    if (propagate()) {
+    if (propagate<T>()) {
       // TODO(nicohartmann): Remove, once the deoptimizer can rematerialize
       // truncated BigInts.
       if (TypeOf(accumulator).Is(Type::BigInt())) {
-        EnqueueInput(node, 2, UseInfo::AnyTagged());
+        EnqueueInput<T>(node, 2, UseInfo::AnyTagged());
       } else {
-        EnqueueInput(node, 2, UseInfo::Any());
+        EnqueueInput<T>(node, 2, UseInfo::Any());
       }
-    } else if (lower()) {
+    } else if (lower<T>()) {
       // TODO(nicohartmann): Remove, once the deoptimizer can rematerialize
       // truncated BigInts.
       if (TypeOf(accumulator).Is(Type::BigInt())) {
@@ -1248,24 +1261,25 @@ class RepresentationSelector {
       }
     }
 
-    ProcessInput(node, 3, UseInfo::AnyTagged());  // Context.
-    ProcessInput(node, 4, UseInfo::AnyTagged());  // Closure.
-    ProcessInput(node, 5, UseInfo::AnyTagged());  // Outer frame state.
-    return SetOutput(node, MachineRepresentation::kTagged);
+    ProcessInput<T>(node, 3, UseInfo::AnyTagged());  // Context.
+    ProcessInput<T>(node, 4, UseInfo::AnyTagged());  // Closure.
+    ProcessInput<T>(node, 5, UseInfo::AnyTagged());  // Outer frame state.
+    return SetOutput<T>(node, MachineRepresentation::kTagged);
   }
 
+  template <Phase T>
   void VisitObjectState(Node* node) {
-    if (propagate()) {
+    if (propagate<T>()) {
       for (int i = 0; i < node->InputCount(); i++) {
         // TODO(nicohartmann): Remove, once the deoptimizer can rematerialize
         // truncated BigInts.
         if (TypeOf(node->InputAt(i)).Is(Type::BigInt())) {
-          EnqueueInput(node, i, UseInfo::AnyTagged());
+          EnqueueInput<T>(node, i, UseInfo::AnyTagged());
         } else {
-          EnqueueInput(node, i, UseInfo::Any());
+          EnqueueInput<T>(node, i, UseInfo::Any());
         }
       }
-    } else if (lower()) {
+    } else if (lower<T>()) {
       Zone* zone = jsgraph_->zone();
       ZoneVector<MachineType>* types =
           new (zone->New(sizeof(ZoneVector<MachineType>)))
@@ -1283,7 +1297,7 @@ class RepresentationSelector {
       NodeProperties::ChangeOp(node, jsgraph_->common()->TypedObjectState(
                                          ObjectIdOf(node->op()), types));
     }
-    SetOutput(node, MachineRepresentation::kTagged);
+    SetOutput<T>(node, MachineRepresentation::kTagged);
   }
 
   const Operator* Int32Op(Node* node) {
@@ -1402,6 +1416,7 @@ class RepresentationSelector {
     NodeProperties::ChangeOp(node, Uint32OverflowOp(node));
   }
 
+  template <Phase T>
   void VisitSpeculativeIntegerAdditiveOp(Node* node, Truncation truncation,
                                          SimplifiedLowering* lowering) {
     Type left_upper = GetUpperBound(node->InputAt(0));
@@ -1411,7 +1426,7 @@ class RepresentationSelector {
         right_upper.Is(type_cache_->kAdditiveSafeIntegerOrMinusZero)) {
       // Only eliminate the node if its typing rule can be satisfied, namely
       // that a safe integer is produced.
-      if (truncation.IsUnused()) return VisitUnused(node);
+      if (truncation.IsUnused()) return VisitUnused<T>(node);
 
       // If we know how to interpret the result or if the users only care
       // about the low 32-bits, we can truncate to Word32 do a wrapping
@@ -1420,8 +1435,8 @@ class RepresentationSelector {
           GetUpperBound(node).Is(Type::Unsigned32()) ||
           truncation.IsUsedAsWord32()) {
         // => Int32Add/Sub
-        VisitWord32TruncatingBinop(node);
-        if (lower()) ChangeToPureOp(node, Int32Op(node));
+        VisitWord32TruncatingBinop<T>(node);
+        if (lower<T>()) ChangeToPureOp(node, Int32Op(node));
         return;
       }
     }
@@ -1445,8 +1460,8 @@ class RepresentationSelector {
     if (left_upper.Is(left_constraint_type) &&
         right_upper.Is(Type::Signed32OrMinusZero()) &&
         (left_upper.Is(Type::Signed32()) || right_upper.Is(Type::Signed32()))) {
-      VisitBinop(node, UseInfo::TruncatingWord32(),
-                 MachineRepresentation::kWord32, Type::Signed32());
+      VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                    MachineRepresentation::kWord32, Type::Signed32());
     } else {
       // If the output's truncation is identify-zeros, we can pass it
       // along. Moreover, if the operation is addition and we know the
@@ -1465,10 +1480,10 @@ class RepresentationSelector {
       // potentially guarded by a check.
       UseInfo right_use = CheckedUseInfoAsWord32FromHint(hint, FeedbackSource(),
                                                          kIdentifyZeros);
-      VisitBinop(node, left_use, right_use, MachineRepresentation::kWord32,
-                 Type::Signed32());
+      VisitBinop<T>(node, left_use, right_use, MachineRepresentation::kWord32,
+                    Type::Signed32());
     }
-    if (lower()) {
+    if (lower<T>()) {
       if (truncation.IsUsedAsWord32() ||
           !CanOverflowSigned32(node->op(), left_feedback_type,
                                right_feedback_type, graph_zone())) {
@@ -1481,6 +1496,7 @@ class RepresentationSelector {
     return;
   }
 
+  template <Phase T>
   void VisitSpeculativeAdditiveOp(Node* node, Truncation truncation,
                                   SimplifiedLowering* lowering) {
     if (BothInputsAre(node, type_cache_->kAdditiveSafeIntegerOrMinusZero) &&
@@ -1488,38 +1504,39 @@ class RepresentationSelector {
          GetUpperBound(node).Is(Type::Unsigned32()) ||
          truncation.IsUsedAsWord32())) {
       // => Int32Add/Sub
-      VisitWord32TruncatingBinop(node);
-      if (lower()) ChangeToPureOp(node, Int32Op(node));
+      VisitWord32TruncatingBinop<T>(node);
+      if (lower<T>()) ChangeToPureOp(node, Int32Op(node));
       return;
     }
 
     // default case => Float64Add/Sub
-    VisitBinop(node,
-               UseInfo::CheckedNumberOrOddballAsFloat64(kDistinguishZeros,
-                                                        FeedbackSource()),
-               MachineRepresentation::kFloat64, Type::Number());
-    if (lower()) {
+    VisitBinop<T>(node,
+                  UseInfo::CheckedNumberOrOddballAsFloat64(kDistinguishZeros,
+                                                           FeedbackSource()),
+                  MachineRepresentation::kFloat64, Type::Number());
+    if (lower<T>()) {
       ChangeToPureOp(node, Float64Op(node));
     }
     return;
   }
 
+  template <Phase T>
   void VisitSpeculativeNumberModulus(Node* node, Truncation truncation,
                                      SimplifiedLowering* lowering) {
     if (BothInputsAre(node, Type::Unsigned32OrMinusZeroOrNaN()) &&
         (truncation.IsUsedAsWord32() ||
          NodeProperties::GetType(node).Is(Type::Unsigned32()))) {
       // => unsigned Uint32Mod
-      VisitWord32TruncatingBinop(node);
-      if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
+      VisitWord32TruncatingBinop<T>(node);
+      if (lower<T>()) DeferReplacement(node, lowering->Uint32Mod(node));
       return;
     }
     if (BothInputsAre(node, Type::Signed32OrMinusZeroOrNaN()) &&
         (truncation.IsUsedAsWord32() ||
          NodeProperties::GetType(node).Is(Type::Signed32()))) {
       // => signed Int32Mod
-      VisitWord32TruncatingBinop(node);
-      if (lower()) DeferReplacement(node, lowering->Int32Mod(node));
+      VisitWord32TruncatingBinop<T>(node);
+      if (lower<T>()) DeferReplacement(node, lowering->Int32Mod(node));
       return;
     }
 
@@ -1531,9 +1548,9 @@ class RepresentationSelector {
     if (BothInputsAreUnsigned32(node)) {
       if (hint == NumberOperationHint::kSignedSmall ||
           hint == NumberOperationHint::kSigned32) {
-        VisitBinop(node, UseInfo::TruncatingWord32(),
-                   MachineRepresentation::kWord32, Type::Unsigned32());
-        if (lower()) ChangeToUint32OverflowOp(node);
+        VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                      MachineRepresentation::kWord32, Type::Unsigned32());
+        if (lower<T>()) ChangeToUint32OverflowOp(node);
         return;
       }
     }
@@ -1544,9 +1561,9 @@ class RepresentationSelector {
       // If both the inputs the feedback are int32, use the overflow op.
       if (hint == NumberOperationHint::kSignedSmall ||
           hint == NumberOperationHint::kSigned32) {
-        VisitBinop(node, UseInfo::TruncatingWord32(),
-                   MachineRepresentation::kWord32, Type::Signed32());
-        if (lower()) ChangeToInt32OverflowOp(node);
+        VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                      MachineRepresentation::kWord32, Type::Signed32());
+        if (lower<T>()) ChangeToInt32OverflowOp(node);
         return;
       }
     }
@@ -1563,16 +1580,16 @@ class RepresentationSelector {
       UseInfo const rhs_use = CheckedUseInfoAsWord32FromHint(
           hint, FeedbackSource(), kIdentifyZeros);
       if (truncation.IsUsedAsWord32()) {
-        VisitBinop(node, lhs_use, rhs_use, MachineRepresentation::kWord32);
-        if (lower()) DeferReplacement(node, lowering->Int32Mod(node));
+        VisitBinop<T>(node, lhs_use, rhs_use, MachineRepresentation::kWord32);
+        if (lower<T>()) DeferReplacement(node, lowering->Int32Mod(node));
       } else if (BothInputsAre(node, Type::Unsigned32OrMinusZeroOrNaN())) {
-        VisitBinop(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
-                   Type::Unsigned32());
-        if (lower()) ChangeToUint32OverflowOp(node);
+        VisitBinop<T>(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
+                      Type::Unsigned32());
+        if (lower<T>()) ChangeToUint32OverflowOp(node);
       } else {
-        VisitBinop(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
-                   Type::Signed32());
-        if (lower()) ChangeToInt32OverflowOp(node);
+        VisitBinop<T>(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
+                      Type::Signed32());
+        if (lower<T>()) ChangeToInt32OverflowOp(node);
       }
       return;
     }
@@ -1581,18 +1598,18 @@ class RepresentationSelector {
         TypeOf(node->InputAt(1)).Is(Type::Unsigned32()) &&
         (truncation.IsUsedAsWord32() ||
          NodeProperties::GetType(node).Is(Type::Unsigned32()))) {
-      VisitBinop(node, UseInfo::TruncatingWord32(),
-                 MachineRepresentation::kWord32, Type::Number());
-      if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
+      VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                    MachineRepresentation::kWord32, Type::Number());
+      if (lower<T>()) DeferReplacement(node, lowering->Uint32Mod(node));
       return;
     }
     if (TypeOf(node->InputAt(0)).Is(Type::Signed32()) &&
         TypeOf(node->InputAt(1)).Is(Type::Signed32()) &&
         (truncation.IsUsedAsWord32() ||
          NodeProperties::GetType(node).Is(Type::Signed32()))) {
-      VisitBinop(node, UseInfo::TruncatingWord32(),
-                 MachineRepresentation::kWord32, Type::Number());
-      if (lower()) DeferReplacement(node, lowering->Int32Mod(node));
+      VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                    MachineRepresentation::kWord32, Type::Number());
+      if (lower<T>()) DeferReplacement(node, lowering->Int32Mod(node));
       return;
     }
 
@@ -1605,60 +1622,42 @@ class RepresentationSelector {
         truncation.identify_zeros(), FeedbackSource());
     UseInfo const rhs_use = UseInfo::CheckedNumberOrOddballAsFloat64(
         kIdentifyZeros, FeedbackSource());
-    VisitBinop(node, lhs_use, rhs_use, MachineRepresentation::kFloat64,
-               Type::Number());
-    if (lower()) ChangeToPureOp(node, Float64Op(node));
+    VisitBinop<T>(node, lhs_use, rhs_use, MachineRepresentation::kFloat64,
+                  Type::Number());
+    if (lower<T>()) ChangeToPureOp(node, Float64Op(node));
     return;
   }
 
+  // Just assert for Propagate and Retype. Lower specialized below.
+  template <Phase T>
   void InsertUnreachableIfNecessary(Node* node) {
-    DCHECK(lower());
-    // If the node is effectful and it produces an impossible value, then we
-    // insert Unreachable node after it.
-    if (node->op()->ValueOutputCount() > 0 &&
-        node->op()->EffectOutputCount() > 0 &&
-        node->opcode() != IrOpcode::kUnreachable && TypeOf(node).IsNone()) {
-      Node* control =
-          (node->op()->ControlOutputCount() == 0)
-              ? NodeProperties::GetControlInput(node, 0)
-              : NodeProperties::FindSuccessfulControlProjection(node);
-
-      Node* unreachable =
-          graph()->NewNode(common()->Unreachable(), node, control);
-
-      // Insert unreachable node and replace all the effect uses of the {node}
-      // with the new unreachable node.
-      for (Edge edge : node->use_edges()) {
-        if (!NodeProperties::IsEffectEdge(edge)) continue;
-        // Make sure to not overwrite the unreachable node's input. That would
-        // create a cycle.
-        if (edge.from() == unreachable) continue;
-        // Avoid messing up the exceptional path.
-        if (edge.from()->opcode() == IrOpcode::kIfException) {
-          DCHECK(!node->op()->HasProperty(Operator::kNoThrow));
-          DCHECK_EQ(NodeProperties::GetControlInput(edge.from()), node);
-          continue;
-        }
-
-        edge.UpdateTo(unreachable);
-      }
-    }
+    static_assert(propagate<T>() || retype<T>(),
+                  "This version of InsertUnreachableIfNecessary has to be "
+                  "called in the Propagate or Retype phase.");
   }
 
+  template <Phase T>
   void VisitCheckBounds(Node* node, SimplifiedLowering* lowering) {
     CheckBoundsParameters const& p = CheckBoundsParametersOf(node->op());
     FeedbackSource const& feedback = p.check_parameters().feedback();
     Type const index_type = TypeOf(node->InputAt(0));
     Type const length_type = TypeOf(node->InputAt(1));
+
+    // Conversions, if requested and needed, will be handled by the
+    // representation changer, not by the lower-level Checked*Bounds operators.
+    CheckBoundsFlags new_flags =
+        p.flags().without(CheckBoundsFlag::kConvertStringAndMinusZero);
+
     if (length_type.Is(Type::Unsigned31())) {
-      if (index_type.Is(Type::Integral32OrMinusZero())) {
-        // Map -0 to 0, and the values in the [-2^31,-1] range to the
-        // [2^31,2^32-1] range, which will be considered out-of-bounds
-        // as well, because the {length_type} is limited to Unsigned31.
-        VisitBinop(node, UseInfo::TruncatingWord32(),
-                   MachineRepresentation::kWord32);
-        if (lower()) {
-          CheckBoundsParameters::Mode mode = p.mode();
+      if (index_type.Is(Type::Integral32()) ||
+          (index_type.Is(Type::Integral32OrMinusZero()) &&
+           p.flags() & CheckBoundsFlag::kConvertStringAndMinusZero)) {
+        // Map the values in the [-2^31,-1] range to the [2^31,2^32-1] range,
+        // which will be considered out-of-bounds because the {length_type} is
+        // limited to Unsigned31. This also converts -0 to 0.
+        VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                      MachineRepresentation::kWord32);
+        if (lower<T>()) {
           if (lowering->poisoning_level_ ==
                   PoisoningMitigationLevel::kDontPoison &&
               (index_type.IsNone() || length_type.IsNone() ||
@@ -1666,32 +1665,45 @@ class RepresentationSelector {
                 index_type.Max() < length_type.Min()))) {
             // The bounds check is redundant if we already know that
             // the index is within the bounds of [0.0, length[.
-            mode = CheckBoundsParameters::kAbortOnOutOfBounds;
+            // TODO(neis): Move this into TypedOptimization?
+            new_flags |= CheckBoundsFlag::kAbortOnOutOfBounds;
           }
           NodeProperties::ChangeOp(
-              node, simplified()->CheckedUint32Bounds(feedback, mode));
+              node, simplified()->CheckedUint32Bounds(feedback, new_flags));
         }
-      } else {
-        VisitBinop(node, UseInfo::CheckedTaggedAsArrayIndex(feedback),
-                   UseInfo::Word(), MachineType::PointerRepresentation());
-        if (lower()) {
+      } else if (p.flags() & CheckBoundsFlag::kConvertStringAndMinusZero) {
+        VisitBinop<T>(node, UseInfo::CheckedTaggedAsArrayIndex(feedback),
+                      UseInfo::Word(), MachineType::PointerRepresentation());
+        if (lower<T>()) {
           if (jsgraph_->machine()->Is64()) {
             NodeProperties::ChangeOp(
-                node, simplified()->CheckedUint64Bounds(feedback, p.mode()));
+                node, simplified()->CheckedUint64Bounds(feedback, new_flags));
           } else {
             NodeProperties::ChangeOp(
-                node, simplified()->CheckedUint32Bounds(feedback, p.mode()));
+                node, simplified()->CheckedUint32Bounds(feedback, new_flags));
           }
         }
+      } else {
+        VisitBinop<T>(
+            node, UseInfo::CheckedSigned32AsWord32(kDistinguishZeros, feedback),
+            UseInfo::TruncatingWord32(), MachineRepresentation::kWord32);
+        if (lower<T>()) {
+          NodeProperties::ChangeOp(
+              node, simplified()->CheckedUint32Bounds(feedback, new_flags));
+        }
       }
     } else {
       CHECK(length_type.Is(type_cache_->kPositiveSafeInteger));
-      VisitBinop(node,
-                 UseInfo::CheckedSigned64AsWord64(kIdentifyZeros, feedback),
-                 UseInfo::Word64(), MachineRepresentation::kWord64);
-      if (lower()) {
+      IdentifyZeros zero_handling =
+          (p.flags() & CheckBoundsFlag::kConvertStringAndMinusZero)
+              ? kIdentifyZeros
+              : kDistinguishZeros;
+      VisitBinop<T>(node,
+                    UseInfo::CheckedSigned64AsWord64(zero_handling, feedback),
+                    UseInfo::Word64(), MachineRepresentation::kWord64);
+      if (lower<T>()) {
         NodeProperties::ChangeOp(
-            node, simplified()->CheckedUint64Bounds(feedback, p.mode()));
+            node, simplified()->CheckedUint64Bounds(feedback, new_flags));
       }
     }
   }
@@ -1748,6 +1760,7 @@ class RepresentationSelector {
 
   static constexpr int kInitialArgumentsCount = 10;
 
+  template <Phase T>
   void VisitFastApiCall(Node* node) {
     FastApiCallParameters const& params = FastApiCallParametersOf(node->op());
     const CFunctionInfo* c_signature = params.signature();
@@ -1758,19 +1771,19 @@ class RepresentationSelector {
 
     base::SmallVector<UseInfo, kInitialArgumentsCount> arg_use_info(
         c_arg_count);
-    ProcessInput(node, 0, UseInfo::Word());
+    ProcessInput<T>(node, 0, UseInfo::Word());
     // Propagate representation information from TypeInfo.
     for (int i = 0; i < c_arg_count; i++) {
       arg_use_info[i] = UseInfoForFastApiCallArgument(
           c_signature->ArgumentInfo(i).GetType(), params.feedback());
-      ProcessInput(node, i + 1, arg_use_info[i]);
+      ProcessInput<T>(node, i + 1, arg_use_info[i]);
     }
 
     MachineType return_type =
         MachineTypeFor(c_signature->ReturnInfo().GetType());
-    SetOutput(node, return_type.representation());
+    SetOutput<T>(node, return_type.representation());
 
-    if (lower()) {
+    if (lower<T>()) {
       MachineSignature::Builder builder(graph()->zone(), 1, c_arg_count);
       builder.AddReturn(return_type);
       for (int i = 0; i < c_arg_count; ++i) {
@@ -1794,6 +1807,7 @@ class RepresentationSelector {
 
   // Dispatching routine for visiting the node {node} with the usage {use}.
   // Depending on the operator, propagate new usage info to the inputs.
+  template <Phase T>
   void VisitNode(Node* node, Truncation truncation,
                  SimplifiedLowering* lowering) {
     tick_counter_->DoTick();
@@ -1809,10 +1823,10 @@ class RepresentationSelector {
     // Dead as well.
     if (node->op()->ValueInputCount() > 0 &&
         node->op()->HasProperty(Operator::kPure) && truncation.IsUnused()) {
-      return VisitUnused(node);
+      return VisitUnused<T>(node);
     }
 
-    if (lower()) InsertUnreachableIfNecessary(node);
+    if (lower<T>()) InsertUnreachableIfNecessary<T>(node);
 
     switch (node->opcode()) {
       //------------------------------------------------------------------
@@ -1822,36 +1836,37 @@ class RepresentationSelector {
         // We use Start as a terminator for the frame state chain, so even
         // tho Start doesn't really produce a value, we have to say Tagged
         // here, otherwise the input conversion will fail.
-        return VisitLeaf(node, MachineRepresentation::kTagged);
+        return VisitLeaf<T>(node, MachineRepresentation::kTagged);
       case IrOpcode::kParameter:
         // TODO(titzer): use representation from linkage.
-        return VisitUnop(node, UseInfo::None(), MachineRepresentation::kTagged);
+        return VisitUnop<T>(node, UseInfo::None(),
+                            MachineRepresentation::kTagged);
       case IrOpcode::kInt32Constant:
-        return VisitLeaf(node, MachineRepresentation::kWord32);
+        return VisitLeaf<T>(node, MachineRepresentation::kWord32);
       case IrOpcode::kInt64Constant:
-        return VisitLeaf(node, MachineRepresentation::kWord64);
+        return VisitLeaf<T>(node, MachineRepresentation::kWord64);
       case IrOpcode::kExternalConstant:
-        return VisitLeaf(node, MachineType::PointerRepresentation());
+        return VisitLeaf<T>(node, MachineType::PointerRepresentation());
       case IrOpcode::kNumberConstant: {
         double const value = OpParameter<double>(node->op());
         int value_as_int;
         if (DoubleToSmiInteger(value, &value_as_int)) {
-          VisitLeaf(node, MachineRepresentation::kTaggedSigned);
-          if (lower()) {
+          VisitLeaf<T>(node, MachineRepresentation::kTaggedSigned);
+          if (lower<T>()) {
             intptr_t smi = bit_cast<intptr_t>(Smi::FromInt(value_as_int));
             DeferReplacement(node, lowering->jsgraph()->IntPtrConstant(smi));
           }
           return;
         }
-        VisitLeaf(node, MachineRepresentation::kTagged);
+        VisitLeaf<T>(node, MachineRepresentation::kTagged);
         return;
       }
       case IrOpcode::kHeapConstant:
       case IrOpcode::kDelayedStringConstant:
-        return VisitLeaf(node, MachineRepresentation::kTaggedPointer);
+        return VisitLeaf<T>(node, MachineRepresentation::kTaggedPointer);
       case IrOpcode::kPointerConstant: {
-        VisitLeaf(node, MachineType::PointerRepresentation());
-        if (lower()) {
+        VisitLeaf<T>(node, MachineType::PointerRepresentation());
+        if (lower<T>()) {
           intptr_t const value = OpParameter<intptr_t>(node->op());
           DeferReplacement(node, lowering->jsgraph()->IntPtrConstant(value));
         }
@@ -1860,32 +1875,32 @@ class RepresentationSelector {
 
       case IrOpcode::kBranch: {
         DCHECK(TypeOf(node->InputAt(0)).Is(Type::Boolean()));
-        ProcessInput(node, 0, UseInfo::Bool());
-        EnqueueInput(node, NodeProperties::FirstControlIndex(node));
+        ProcessInput<T>(node, 0, UseInfo::Bool());
+        EnqueueInput<T>(node, NodeProperties::FirstControlIndex(node));
         return;
       }
       case IrOpcode::kSwitch:
-        ProcessInput(node, 0, UseInfo::TruncatingWord32());
-        EnqueueInput(node, NodeProperties::FirstControlIndex(node));
+        ProcessInput<T>(node, 0, UseInfo::TruncatingWord32());
+        EnqueueInput<T>(node, NodeProperties::FirstControlIndex(node));
         return;
       case IrOpcode::kSelect:
-        return VisitSelect(node, truncation, lowering);
+        return VisitSelect<T>(node, truncation, lowering);
       case IrOpcode::kPhi:
-        return VisitPhi(node, truncation, lowering);
+        return VisitPhi<T>(node, truncation, lowering);
       case IrOpcode::kCall:
-        return VisitCall(node, lowering);
+        return VisitCall<T>(node, lowering);
 
       //------------------------------------------------------------------
       // JavaScript operators.
       //------------------------------------------------------------------
       case IrOpcode::kToBoolean: {
         if (truncation.IsUsedAsBool()) {
-          ProcessInput(node, 0, UseInfo::Bool());
-          SetOutput(node, MachineRepresentation::kBit);
-          if (lower()) DeferReplacement(node, node->InputAt(0));
+          ProcessInput<T>(node, 0, UseInfo::Bool());
+          SetOutput<T>(node, MachineRepresentation::kBit);
+          if (lower<T>()) DeferReplacement(node, node->InputAt(0));
         } else {
-          VisitInputs(node);
-          SetOutput(node, MachineRepresentation::kTaggedPointer);
+          VisitInputs<T>(node);
+          SetOutput<T>(node, MachineRepresentation::kTaggedPointer);
         }
         return;
       }
@@ -1894,18 +1909,18 @@ class RepresentationSelector {
       case IrOpcode::kJSToNumeric: {
         DCHECK(NodeProperties::GetType(node).Is(Type::Union(
             Type::BigInt(), Type::NumberOrOddball(), graph()->zone())));
-        VisitInputs(node);
+        VisitInputs<T>(node);
         // TODO(bmeurer): Optimize somewhat based on input type?
         if (truncation.IsUsedAsWord32()) {
-          SetOutput(node, MachineRepresentation::kWord32);
-          if (lower())
+          SetOutput<T>(node, MachineRepresentation::kWord32);
+          if (lower<T>())
             lowering->DoJSToNumberOrNumericTruncatesToWord32(node, this);
         } else if (truncation.TruncatesOddballAndBigIntToNumber()) {
-          SetOutput(node, MachineRepresentation::kFloat64);
-          if (lower())
+          SetOutput<T>(node, MachineRepresentation::kFloat64);
+          if (lower<T>())
             lowering->DoJSToNumberOrNumericTruncatesToFloat64(node, this);
         } else {
-          SetOutput(node, MachineRepresentation::kTagged);
+          SetOutput<T>(node, MachineRepresentation::kTagged);
         }
         return;
       }
@@ -1914,7 +1929,7 @@ class RepresentationSelector {
       // Simplified operators.
       //------------------------------------------------------------------
       case IrOpcode::kBooleanNot: {
-        if (lower()) {
+        if (lower<T>()) {
           NodeInfo* input_info = GetInfo(node->InputAt(0));
           if (input_info->representation() == MachineRepresentation::kBit) {
             // BooleanNot(x: kRepBit) => Word32Equal(x, #0)
@@ -1930,8 +1945,8 @@ class RepresentationSelector {
           }
         } else {
           // No input representation requirement; adapt during lowering.
-          ProcessInput(node, 0, UseInfo::AnyTruncatingToBool());
-          SetOutput(node, MachineRepresentation::kBit);
+          ProcessInput<T>(node, 0, UseInfo::AnyTruncatingToBool());
+          SetOutput<T>(node, MachineRepresentation::kBit);
         }
         return;
       }
@@ -1949,9 +1964,9 @@ class RepresentationSelector {
              rhs_type.Is(Type::Unsigned32OrMinusZeroOrNaN()) &&
              OneInputCannotBe(node, type_cache_->kZeroish))) {
           // => unsigned Int32Cmp
-          VisitBinop(node, UseInfo::TruncatingWord32(),
-                     MachineRepresentation::kBit);
-          if (lower()) NodeProperties::ChangeOp(node, Uint32Op(node));
+          VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                        MachineRepresentation::kBit);
+          if (lower<T>()) NodeProperties::ChangeOp(node, Uint32Op(node));
           return;
         }
         if ((lhs_type.Is(Type::Signed32OrMinusZero()) &&
@@ -1960,15 +1975,15 @@ class RepresentationSelector {
              rhs_type.Is(Type::Signed32OrMinusZeroOrNaN()) &&
              OneInputCannotBe(node, type_cache_->kZeroish))) {
           // => signed Int32Cmp
-          VisitBinop(node, UseInfo::TruncatingWord32(),
-                     MachineRepresentation::kBit);
-          if (lower()) NodeProperties::ChangeOp(node, Int32Op(node));
+          VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                        MachineRepresentation::kBit);
+          if (lower<T>()) NodeProperties::ChangeOp(node, Int32Op(node));
           return;
         }
         // => Float64Cmp
-        VisitBinop(node, UseInfo::TruncatingFloat64(kIdentifyZeros),
-                   MachineRepresentation::kBit);
-        if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
+        VisitBinop<T>(node, UseInfo::TruncatingFloat64(kIdentifyZeros),
+                      MachineRepresentation::kBit);
+        if (lower<T>()) NodeProperties::ChangeOp(node, Float64Op(node));
         return;
       }
       case IrOpcode::kNumberLessThan:
@@ -1981,31 +1996,31 @@ class RepresentationSelector {
         if (lhs_type.Is(Type::Unsigned32OrMinusZero()) &&
             rhs_type.Is(Type::Unsigned32OrMinusZero())) {
           // => unsigned Int32Cmp
-          VisitBinop(node, UseInfo::TruncatingWord32(),
-                     MachineRepresentation::kBit);
-          if (lower()) NodeProperties::ChangeOp(node, Uint32Op(node));
+          VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                        MachineRepresentation::kBit);
+          if (lower<T>()) NodeProperties::ChangeOp(node, Uint32Op(node));
         } else if (lhs_type.Is(Type::Signed32OrMinusZero()) &&
                    rhs_type.Is(Type::Signed32OrMinusZero())) {
           // => signed Int32Cmp
-          VisitBinop(node, UseInfo::TruncatingWord32(),
-                     MachineRepresentation::kBit);
-          if (lower()) NodeProperties::ChangeOp(node, Int32Op(node));
+          VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                        MachineRepresentation::kBit);
+          if (lower<T>()) NodeProperties::ChangeOp(node, Int32Op(node));
         } else {
           // => Float64Cmp
-          VisitBinop(node, UseInfo::TruncatingFloat64(kIdentifyZeros),
-                     MachineRepresentation::kBit);
-          if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
+          VisitBinop<T>(node, UseInfo::TruncatingFloat64(kIdentifyZeros),
+                        MachineRepresentation::kBit);
+          if (lower<T>()) NodeProperties::ChangeOp(node, Float64Op(node));
         }
         return;
       }
 
       case IrOpcode::kSpeculativeSafeIntegerAdd:
       case IrOpcode::kSpeculativeSafeIntegerSubtract:
-        return VisitSpeculativeIntegerAdditiveOp(node, truncation, lowering);
+        return VisitSpeculativeIntegerAdditiveOp<T>(node, truncation, lowering);
 
       case IrOpcode::kSpeculativeNumberAdd:
       case IrOpcode::kSpeculativeNumberSubtract:
-        return VisitSpeculativeAdditiveOp(node, truncation, lowering);
+        return VisitSpeculativeAdditiveOp<T>(node, truncation, lowering);
 
       case IrOpcode::kSpeculativeNumberLessThan:
       case IrOpcode::kSpeculativeNumberLessThanOrEqual:
@@ -2018,16 +2033,16 @@ class RepresentationSelector {
         if (lhs_type.Is(Type::Unsigned32OrMinusZero()) &&
             rhs_type.Is(Type::Unsigned32OrMinusZero())) {
           // => unsigned Int32Cmp
-          VisitBinop(node, UseInfo::TruncatingWord32(),
-                     MachineRepresentation::kBit);
-          if (lower()) ChangeToPureOp(node, Uint32Op(node));
+          VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                        MachineRepresentation::kBit);
+          if (lower<T>()) ChangeToPureOp(node, Uint32Op(node));
           return;
         } else if (lhs_type.Is(Type::Signed32OrMinusZero()) &&
                    rhs_type.Is(Type::Signed32OrMinusZero())) {
           // => signed Int32Cmp
-          VisitBinop(node, UseInfo::TruncatingWord32(),
-                     MachineRepresentation::kBit);
-          if (lower()) ChangeToPureOp(node, Int32Op(node));
+          VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                        MachineRepresentation::kBit);
+          if (lower<T>()) ChangeToPureOp(node, Int32Op(node));
           return;
         }
         // Try to use type feedback.
@@ -2035,31 +2050,31 @@ class RepresentationSelector {
         switch (hint) {
           case NumberOperationHint::kSigned32:
           case NumberOperationHint::kSignedSmall:
-            if (propagate()) {
-              VisitBinop(node,
-                         CheckedUseInfoAsWord32FromHint(hint, FeedbackSource(),
-                                                        kIdentifyZeros),
-                         MachineRepresentation::kBit);
-            } else if (retype()) {
-              SetOutput(node, MachineRepresentation::kBit, Type::Any());
+            if (propagate<T>()) {
+              VisitBinop<T>(node,
+                            CheckedUseInfoAsWord32FromHint(
+                                hint, FeedbackSource(), kIdentifyZeros),
+                            MachineRepresentation::kBit);
+            } else if (retype<T>()) {
+              SetOutput<T>(node, MachineRepresentation::kBit, Type::Any());
             } else {
-              DCHECK(lower());
+              DCHECK(lower<T>());
               Node* lhs = node->InputAt(0);
               Node* rhs = node->InputAt(1);
               if (IsNodeRepresentationTagged(lhs) &&
                   IsNodeRepresentationTagged(rhs)) {
-                VisitBinop(node,
-                           UseInfo::CheckedSignedSmallAsTaggedSigned(
-                               FeedbackSource(), kIdentifyZeros),
-                           MachineRepresentation::kBit);
+                VisitBinop<T>(node,
+                              UseInfo::CheckedSignedSmallAsTaggedSigned(
+                                  FeedbackSource(), kIdentifyZeros),
+                              MachineRepresentation::kBit);
                 ChangeToPureOp(
                     node, changer_->TaggedSignedOperatorFor(node->opcode()));
 
               } else {
-                VisitBinop(node,
-                           CheckedUseInfoAsWord32FromHint(
-                               hint, FeedbackSource(), kIdentifyZeros),
-                           MachineRepresentation::kBit);
+                VisitBinop<T>(node,
+                              CheckedUseInfoAsWord32FromHint(
+                                  hint, FeedbackSource(), kIdentifyZeros),
+                              MachineRepresentation::kBit);
                 ChangeToPureOp(node, Int32Op(node));
               }
             }
@@ -2073,12 +2088,13 @@ class RepresentationSelector {
             // hint with Oddball feedback here.
             DCHECK_NE(IrOpcode::kSpeculativeNumberEqual, node->opcode());
             V8_FALLTHROUGH;
+          case NumberOperationHint::kNumberOrBoolean:
           case NumberOperationHint::kNumber:
-            VisitBinop(node,
-                       CheckedUseInfoAsFloat64FromHint(hint, FeedbackSource(),
-                                                       kIdentifyZeros),
-                       MachineRepresentation::kBit);
-            if (lower()) ChangeToPureOp(node, Float64Op(node));
+            VisitBinop<T>(node,
+                          CheckedUseInfoAsFloat64FromHint(
+                              hint, FeedbackSource(), kIdentifyZeros),
+                          MachineRepresentation::kBit);
+            if (lower<T>()) ChangeToPureOp(node, Float64Op(node));
             return;
         }
         UNREACHABLE();
@@ -2095,18 +2111,18 @@ class RepresentationSelector {
              TypeOf(node).Is(Type::Unsigned32()) ||
              truncation.IsUsedAsWord32())) {
           // => Int32Add/Sub
-          VisitWord32TruncatingBinop(node);
-          if (lower()) ChangeToPureOp(node, Int32Op(node));
+          VisitWord32TruncatingBinop<T>(node);
+          if (lower<T>()) ChangeToPureOp(node, Int32Op(node));
         } else if (jsgraph_->machine()->Is64() &&
                    BothInputsAre(node, type_cache_->kSafeInteger) &&
                    GetUpperBound(node).Is(type_cache_->kSafeInteger)) {
           // => Int64Add/Sub
-          VisitInt64Binop(node);
-          if (lower()) ChangeToPureOp(node, Int64Op(node));
+          VisitInt64Binop<T>(node);
+          if (lower<T>()) ChangeToPureOp(node, Int64Op(node));
         } else {
           // => Float64Add/Sub
-          VisitFloat64Binop(node);
-          if (lower()) ChangeToPureOp(node, Float64Op(node));
+          VisitFloat64Binop<T>(node);
+          if (lower<T>()) ChangeToPureOp(node, Float64Op(node));
         }
         return;
       }
@@ -2122,8 +2138,8 @@ class RepresentationSelector {
           // (b) the output is known to be Unsigned32, or
           // (c) the uses are truncating and the result is in the safe
           //     integer range.
-          VisitWord32TruncatingBinop(node);
-          if (lower()) ChangeToPureOp(node, Int32Op(node));
+          VisitWord32TruncatingBinop<T>(node);
+          if (lower<T>()) ChangeToPureOp(node, Int32Op(node));
           return;
         }
         // Try to use type feedback.
@@ -2137,9 +2153,9 @@ class RepresentationSelector {
           // If both inputs and feedback are int32, use the overflow op.
           if (hint == NumberOperationHint::kSignedSmall ||
               hint == NumberOperationHint::kSigned32) {
-            VisitBinop(node, UseInfo::TruncatingWord32(),
-                       MachineRepresentation::kWord32, Type::Signed32());
-            if (lower()) {
+            VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                          MachineRepresentation::kWord32, Type::Signed32());
+            if (lower<T>()) {
               LowerToCheckedInt32Mul(node, truncation, input0_type,
                                      input1_type);
             }
@@ -2149,20 +2165,20 @@ class RepresentationSelector {
 
         if (hint == NumberOperationHint::kSignedSmall ||
             hint == NumberOperationHint::kSigned32) {
-          VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
-                     MachineRepresentation::kWord32, Type::Signed32());
-          if (lower()) {
+          VisitBinop<T>(node, CheckedUseInfoAsWord32FromHint(hint),
+                        MachineRepresentation::kWord32, Type::Signed32());
+          if (lower<T>()) {
             LowerToCheckedInt32Mul(node, truncation, input0_type, input1_type);
           }
           return;
         }
 
         // Checked float64 x float64 => float64
-        VisitBinop(node,
-                   UseInfo::CheckedNumberOrOddballAsFloat64(kDistinguishZeros,
-                                                            FeedbackSource()),
-                   MachineRepresentation::kFloat64, Type::Number());
-        if (lower()) ChangeToPureOp(node, Float64Op(node));
+        VisitBinop<T>(node,
+                      UseInfo::CheckedNumberOrOddballAsFloat64(
+                          kDistinguishZeros, FeedbackSource()),
+                      MachineRepresentation::kFloat64, Type::Number());
+        if (lower<T>()) ChangeToPureOp(node, Float64Op(node));
         return;
       }
       case IrOpcode::kNumberMultiply: {
@@ -2177,33 +2193,33 @@ class RepresentationSelector {
           // (b) the output is known to be Unsigned32, or
           // (c) the uses are truncating and the result is in the safe
           //     integer range.
-          VisitWord32TruncatingBinop(node);
-          if (lower()) ChangeToPureOp(node, Int32Op(node));
+          VisitWord32TruncatingBinop<T>(node);
+          if (lower<T>()) ChangeToPureOp(node, Int32Op(node));
           return;
         }
         // Number x Number => Float64Mul
-        VisitFloat64Binop(node);
-        if (lower()) ChangeToPureOp(node, Float64Op(node));
+        VisitFloat64Binop<T>(node);
+        if (lower<T>()) ChangeToPureOp(node, Float64Op(node));
         return;
       }
       case IrOpcode::kSpeculativeNumberDivide: {
         if (BothInputsAreUnsigned32(node) && truncation.IsUsedAsWord32()) {
           // => unsigned Uint32Div
-          VisitWord32TruncatingBinop(node);
-          if (lower()) DeferReplacement(node, lowering->Uint32Div(node));
+          VisitWord32TruncatingBinop<T>(node);
+          if (lower<T>()) DeferReplacement(node, lowering->Uint32Div(node));
           return;
         }
         if (BothInputsAreSigned32(node)) {
           if (NodeProperties::GetType(node).Is(Type::Signed32())) {
             // => signed Int32Div
-            VisitWord32TruncatingBinop(node);
-            if (lower()) DeferReplacement(node, lowering->Int32Div(node));
+            VisitWord32TruncatingBinop<T>(node);
+            if (lower<T>()) DeferReplacement(node, lowering->Int32Div(node));
             return;
           }
           if (truncation.IsUsedAsWord32()) {
             // => signed Int32Div
-            VisitWord32TruncatingBinop(node);
-            if (lower()) DeferReplacement(node, lowering->Int32Div(node));
+            VisitWord32TruncatingBinop<T>(node);
+            if (lower<T>()) DeferReplacement(node, lowering->Int32Div(node));
             return;
           }
         }
@@ -2216,9 +2232,9 @@ class RepresentationSelector {
         if (BothInputsAreUnsigned32(node)) {
           if (hint == NumberOperationHint::kSignedSmall ||
               hint == NumberOperationHint::kSigned32) {
-            VisitBinop(node, UseInfo::TruncatingWord32(),
-                       MachineRepresentation::kWord32, Type::Unsigned32());
-            if (lower()) ChangeToUint32OverflowOp(node);
+            VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                          MachineRepresentation::kWord32, Type::Unsigned32());
+            if (lower<T>()) ChangeToUint32OverflowOp(node);
             return;
           }
         }
@@ -2229,9 +2245,9 @@ class RepresentationSelector {
           // If both the inputs the feedback are int32, use the overflow op.
           if (hint == NumberOperationHint::kSignedSmall ||
               hint == NumberOperationHint::kSigned32) {
-            VisitBinop(node, UseInfo::TruncatingWord32(),
-                       MachineRepresentation::kWord32, Type::Signed32());
-            if (lower()) ChangeToInt32OverflowOp(node);
+            VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                          MachineRepresentation::kWord32, Type::Signed32());
+            if (lower<T>()) ChangeToInt32OverflowOp(node);
             return;
           }
         }
@@ -2241,24 +2257,24 @@ class RepresentationSelector {
             hint == NumberOperationHint::kSignedSmallInputs) {
           // If the result is truncated, we only need to check the inputs.
           if (truncation.IsUsedAsWord32()) {
-            VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
-                       MachineRepresentation::kWord32);
-            if (lower()) DeferReplacement(node, lowering->Int32Div(node));
+            VisitBinop<T>(node, CheckedUseInfoAsWord32FromHint(hint),
+                          MachineRepresentation::kWord32);
+            if (lower<T>()) DeferReplacement(node, lowering->Int32Div(node));
             return;
           } else if (hint != NumberOperationHint::kSignedSmallInputs) {
-            VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
-                       MachineRepresentation::kWord32, Type::Signed32());
-            if (lower()) ChangeToInt32OverflowOp(node);
+            VisitBinop<T>(node, CheckedUseInfoAsWord32FromHint(hint),
+                          MachineRepresentation::kWord32, Type::Signed32());
+            if (lower<T>()) ChangeToInt32OverflowOp(node);
             return;
           }
         }
 
         // default case => Float64Div
-        VisitBinop(node,
-                   UseInfo::CheckedNumberOrOddballAsFloat64(kDistinguishZeros,
-                                                            FeedbackSource()),
-                   MachineRepresentation::kFloat64, Type::Number());
-        if (lower()) ChangeToPureOp(node, Float64Op(node));
+        VisitBinop<T>(node,
+                      UseInfo::CheckedNumberOrOddballAsFloat64(
+                          kDistinguishZeros, FeedbackSource()),
+                      MachineRepresentation::kFloat64, Type::Number());
+        if (lower<T>()) ChangeToPureOp(node, Float64Op(node));
         return;
       }
       case IrOpcode::kNumberDivide: {
@@ -2267,8 +2283,8 @@ class RepresentationSelector {
             (truncation.IsUsedAsWord32() ||
              TypeOf(node).Is(Type::Unsigned32()))) {
           // => unsigned Uint32Div
-          VisitWord32TruncatingBinop(node);
-          if (lower()) DeferReplacement(node, lowering->Uint32Div(node));
+          VisitWord32TruncatingBinop<T>(node);
+          if (lower<T>()) DeferReplacement(node, lowering->Uint32Div(node));
           return;
         }
         if (TypeOf(node->InputAt(0)).Is(Type::Signed32()) &&
@@ -2276,17 +2292,17 @@ class RepresentationSelector {
             (truncation.IsUsedAsWord32() ||
              TypeOf(node).Is(Type::Signed32()))) {
           // => signed Int32Div
-          VisitWord32TruncatingBinop(node);
-          if (lower()) DeferReplacement(node, lowering->Int32Div(node));
+          VisitWord32TruncatingBinop<T>(node);
+          if (lower<T>()) DeferReplacement(node, lowering->Int32Div(node));
           return;
         }
         // Number x Number => Float64Div
-        VisitFloat64Binop(node);
-        if (lower()) ChangeToPureOp(node, Float64Op(node));
+        VisitFloat64Binop<T>(node);
+        if (lower<T>()) ChangeToPureOp(node, Float64Op(node));
         return;
       }
       case IrOpcode::kSpeculativeNumberModulus:
-        return VisitSpeculativeNumberModulus(node, truncation, lowering);
+        return VisitSpeculativeNumberModulus<T>(node, truncation, lowering);
       case IrOpcode::kNumberModulus: {
         Type const lhs_type = TypeOf(node->InputAt(0));
         Type const rhs_type = TypeOf(node->InputAt(1));
@@ -2295,8 +2311,8 @@ class RepresentationSelector {
             (truncation.IsUsedAsWord32() ||
              TypeOf(node).Is(Type::Unsigned32()))) {
           // => unsigned Uint32Mod
-          VisitWord32TruncatingBinop(node);
-          if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
+          VisitWord32TruncatingBinop<T>(node);
+          if (lower<T>()) DeferReplacement(node, lowering->Uint32Mod(node));
           return;
         }
         if ((lhs_type.Is(Type::Signed32OrMinusZeroOrNaN()) &&
@@ -2305,8 +2321,8 @@ class RepresentationSelector {
              (truncation.IdentifiesZeroAndMinusZero() &&
               TypeOf(node).Is(Type::Signed32OrMinusZero())))) {
           // => signed Int32Mod
-          VisitWord32TruncatingBinop(node);
-          if (lower()) DeferReplacement(node, lowering->Int32Mod(node));
+          VisitWord32TruncatingBinop<T>(node);
+          if (lower<T>()) DeferReplacement(node, lowering->Int32Mod(node));
           return;
         }
         // => Float64Mod
@@ -2317,30 +2333,31 @@ class RepresentationSelector {
         UseInfo const lhs_use =
             UseInfo::TruncatingFloat64(truncation.identify_zeros());
         UseInfo const rhs_use = UseInfo::TruncatingFloat64(kIdentifyZeros);
-        VisitBinop(node, lhs_use, rhs_use, MachineRepresentation::kFloat64);
-        if (lower()) ChangeToPureOp(node, Float64Op(node));
+        VisitBinop<T>(node, lhs_use, rhs_use, MachineRepresentation::kFloat64);
+        if (lower<T>()) ChangeToPureOp(node, Float64Op(node));
         return;
       }
       case IrOpcode::kNumberBitwiseOr:
       case IrOpcode::kNumberBitwiseXor:
       case IrOpcode::kNumberBitwiseAnd: {
-        VisitWord32TruncatingBinop(node);
-        if (lower()) NodeProperties::ChangeOp(node, Int32Op(node));
+        VisitWord32TruncatingBinop<T>(node);
+        if (lower<T>()) NodeProperties::ChangeOp(node, Int32Op(node));
         return;
       }
       case IrOpcode::kSpeculativeNumberBitwiseOr:
       case IrOpcode::kSpeculativeNumberBitwiseXor:
       case IrOpcode::kSpeculativeNumberBitwiseAnd:
-        VisitSpeculativeInt32Binop(node);
-        if (lower()) {
+        VisitSpeculativeInt32Binop<T>(node);
+        if (lower<T>()) {
           ChangeToPureOp(node, Int32Op(node));
         }
         return;
       case IrOpcode::kNumberShiftLeft: {
         Type rhs_type = GetUpperBound(node->InputAt(1));
-        VisitBinop(node, UseInfo::TruncatingWord32(),
-                   UseInfo::TruncatingWord32(), MachineRepresentation::kWord32);
-        if (lower()) {
+        VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                      UseInfo::TruncatingWord32(),
+                      MachineRepresentation::kWord32);
+        if (lower<T>()) {
           MaskShiftOperand(node, rhs_type);
           ChangeToPureOp(node, lowering->machine()->Word32Shl());
         }
@@ -2349,10 +2366,10 @@ class RepresentationSelector {
       case IrOpcode::kSpeculativeNumberShiftLeft: {
         if (BothInputsAre(node, Type::NumberOrOddball())) {
           Type rhs_type = GetUpperBound(node->InputAt(1));
-          VisitBinop(node, UseInfo::TruncatingWord32(),
-                     UseInfo::TruncatingWord32(),
-                     MachineRepresentation::kWord32);
-          if (lower()) {
+          VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                        UseInfo::TruncatingWord32(),
+                        MachineRepresentation::kWord32);
+          if (lower<T>()) {
             MaskShiftOperand(node, rhs_type);
             ChangeToPureOp(node, lowering->machine()->Word32Shl());
           }
@@ -2360,9 +2377,9 @@ class RepresentationSelector {
         }
         NumberOperationHint hint = NumberOperationHintOf(node->op());
         Type rhs_type = GetUpperBound(node->InputAt(1));
-        VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
-                   MachineRepresentation::kWord32, Type::Signed32());
-        if (lower()) {
+        VisitBinop<T>(node, CheckedUseInfoAsWord32FromHint(hint),
+                      MachineRepresentation::kWord32, Type::Signed32());
+        if (lower<T>()) {
           MaskShiftOperand(node, rhs_type);
           ChangeToPureOp(node, lowering->machine()->Word32Shl());
         }
@@ -2370,9 +2387,10 @@ class RepresentationSelector {
       }
       case IrOpcode::kNumberShiftRight: {
         Type rhs_type = GetUpperBound(node->InputAt(1));
-        VisitBinop(node, UseInfo::TruncatingWord32(),
-                   UseInfo::TruncatingWord32(), MachineRepresentation::kWord32);
-        if (lower()) {
+        VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                      UseInfo::TruncatingWord32(),
+                      MachineRepresentation::kWord32);
+        if (lower<T>()) {
           MaskShiftOperand(node, rhs_type);
           ChangeToPureOp(node, lowering->machine()->Word32Sar());
         }
@@ -2381,10 +2399,10 @@ class RepresentationSelector {
       case IrOpcode::kSpeculativeNumberShiftRight: {
         if (BothInputsAre(node, Type::NumberOrOddball())) {
           Type rhs_type = GetUpperBound(node->InputAt(1));
-          VisitBinop(node, UseInfo::TruncatingWord32(),
-                     UseInfo::TruncatingWord32(),
-                     MachineRepresentation::kWord32);
-          if (lower()) {
+          VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                        UseInfo::TruncatingWord32(),
+                        MachineRepresentation::kWord32);
+          if (lower<T>()) {
             MaskShiftOperand(node, rhs_type);
             ChangeToPureOp(node, lowering->machine()->Word32Sar());
           }
@@ -2392,9 +2410,9 @@ class RepresentationSelector {
         }
         NumberOperationHint hint = NumberOperationHintOf(node->op());
         Type rhs_type = GetUpperBound(node->InputAt(1));
-        VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
-                   MachineRepresentation::kWord32, Type::Signed32());
-        if (lower()) {
+        VisitBinop<T>(node, CheckedUseInfoAsWord32FromHint(hint),
+                      MachineRepresentation::kWord32, Type::Signed32());
+        if (lower<T>()) {
           MaskShiftOperand(node, rhs_type);
           ChangeToPureOp(node, lowering->machine()->Word32Sar());
         }
@@ -2402,9 +2420,10 @@ class RepresentationSelector {
       }
       case IrOpcode::kNumberShiftRightLogical: {
         Type rhs_type = GetUpperBound(node->InputAt(1));
-        VisitBinop(node, UseInfo::TruncatingWord32(),
-                   UseInfo::TruncatingWord32(), MachineRepresentation::kWord32);
-        if (lower()) {
+        VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                      UseInfo::TruncatingWord32(),
+                      MachineRepresentation::kWord32);
+        if (lower<T>()) {
           MaskShiftOperand(node, rhs_type);
           ChangeToPureOp(node, lowering->machine()->Word32Shr());
         }
@@ -2421,9 +2440,9 @@ class RepresentationSelector {
           // have seen so far were of type Unsigned31.  We speculate that this
           // will continue to hold.  Moreover, since the RHS is 0, the result
           // will just be the (converted) LHS.
-          VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
-                     MachineRepresentation::kWord32, Type::Unsigned31());
-          if (lower()) {
+          VisitBinop<T>(node, CheckedUseInfoAsWord32FromHint(hint),
+                        MachineRepresentation::kWord32, Type::Unsigned31());
+          if (lower<T>()) {
             node->RemoveInput(1);
             NodeProperties::ChangeOp(
                 node, simplified()->CheckedUint32ToInt32(FeedbackSource()));
@@ -2431,18 +2450,18 @@ class RepresentationSelector {
           return;
         }
         if (BothInputsAre(node, Type::NumberOrOddball())) {
-          VisitBinop(node, UseInfo::TruncatingWord32(),
-                     UseInfo::TruncatingWord32(),
-                     MachineRepresentation::kWord32);
-          if (lower()) {
+          VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                        UseInfo::TruncatingWord32(),
+                        MachineRepresentation::kWord32);
+          if (lower<T>()) {
             MaskShiftOperand(node, rhs_type);
             ChangeToPureOp(node, lowering->machine()->Word32Shr());
           }
           return;
         }
-        VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
-                   MachineRepresentation::kWord32, Type::Unsigned32());
-        if (lower()) {
+        VisitBinop<T>(node, CheckedUseInfoAsWord32FromHint(hint),
+                      MachineRepresentation::kWord32, Type::Unsigned32());
+        if (lower<T>()) {
           MaskShiftOperand(node, rhs_type);
           ChangeToPureOp(node, lowering->machine()->Word32Shr());
         }
@@ -2454,40 +2473,41 @@ class RepresentationSelector {
         // choose to ignore minus zero in all cases.
         Type const input_type = TypeOf(node->InputAt(0));
         if (input_type.Is(Type::Unsigned32OrMinusZero())) {
-          VisitUnop(node, UseInfo::TruncatingWord32(),
-                    MachineRepresentation::kWord32);
-          if (lower()) DeferReplacement(node, node->InputAt(0));
+          VisitUnop<T>(node, UseInfo::TruncatingWord32(),
+                       MachineRepresentation::kWord32);
+          if (lower<T>()) DeferReplacement(node, node->InputAt(0));
         } else if (input_type.Is(Type::Signed32OrMinusZero())) {
-          VisitUnop(node, UseInfo::TruncatingWord32(),
-                    MachineRepresentation::kWord32);
-          if (lower()) DeferReplacement(node, lowering->Int32Abs(node));
+          VisitUnop<T>(node, UseInfo::TruncatingWord32(),
+                       MachineRepresentation::kWord32);
+          if (lower<T>()) DeferReplacement(node, lowering->Int32Abs(node));
         } else if (input_type.Is(type_cache_->kPositiveIntegerOrNaN)) {
-          VisitUnop(node, UseInfo::TruncatingFloat64(kIdentifyZeros),
-                    MachineRepresentation::kFloat64);
-          if (lower()) DeferReplacement(node, node->InputAt(0));
+          VisitUnop<T>(node, UseInfo::TruncatingFloat64(kIdentifyZeros),
+                       MachineRepresentation::kFloat64);
+          if (lower<T>()) DeferReplacement(node, node->InputAt(0));
         } else {
-          VisitUnop(node, UseInfo::TruncatingFloat64(kIdentifyZeros),
-                    MachineRepresentation::kFloat64);
-          if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
+          VisitUnop<T>(node, UseInfo::TruncatingFloat64(kIdentifyZeros),
+                       MachineRepresentation::kFloat64);
+          if (lower<T>()) NodeProperties::ChangeOp(node, Float64Op(node));
         }
         return;
       }
       case IrOpcode::kNumberClz32: {
-        VisitUnop(node, UseInfo::TruncatingWord32(),
-                  MachineRepresentation::kWord32);
-        if (lower()) NodeProperties::ChangeOp(node, Uint32Op(node));
+        VisitUnop<T>(node, UseInfo::TruncatingWord32(),
+                     MachineRepresentation::kWord32);
+        if (lower<T>()) NodeProperties::ChangeOp(node, Uint32Op(node));
         return;
       }
       case IrOpcode::kNumberImul: {
-        VisitBinop(node, UseInfo::TruncatingWord32(),
-                   UseInfo::TruncatingWord32(), MachineRepresentation::kWord32);
-        if (lower()) NodeProperties::ChangeOp(node, Uint32Op(node));
+        VisitBinop<T>(node, UseInfo::TruncatingWord32(),
+                      UseInfo::TruncatingWord32(),
+                      MachineRepresentation::kWord32);
+        if (lower<T>()) NodeProperties::ChangeOp(node, Uint32Op(node));
         return;
       }
       case IrOpcode::kNumberFround: {
-        VisitUnop(node, UseInfo::TruncatingFloat64(),
-                  MachineRepresentation::kFloat32);
-        if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
+        VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                     MachineRepresentation::kFloat32);
+        if (lower<T>()) NodeProperties::ChangeOp(node, Float64Op(node));
         return;
       }
       case IrOpcode::kNumberMax: {
@@ -2504,8 +2524,8 @@ class RepresentationSelector {
             (lhs_type.Is(Type::Unsigned32OrMinusZero()) &&
              rhs_type.Is(Type::Unsigned32OrMinusZero()) &&
              truncation.IdentifiesZeroAndMinusZero())) {
-          VisitWord32TruncatingBinop(node);
-          if (lower()) {
+          VisitWord32TruncatingBinop<T>(node);
+          if (lower<T>()) {
             lowering->DoMax(node, lowering->machine()->Uint32LessThan(),
                             MachineRepresentation::kWord32);
           }
@@ -2514,24 +2534,24 @@ class RepresentationSelector {
                    (lhs_type.Is(Type::Signed32OrMinusZero()) &&
                     rhs_type.Is(Type::Signed32OrMinusZero()) &&
                     truncation.IdentifiesZeroAndMinusZero())) {
-          VisitWord32TruncatingBinop(node);
-          if (lower()) {
+          VisitWord32TruncatingBinop<T>(node);
+          if (lower<T>()) {
             lowering->DoMax(node, lowering->machine()->Int32LessThan(),
                             MachineRepresentation::kWord32);
           }
         } else if (jsgraph_->machine()->Is64() &&
                    lhs_type.Is(type_cache_->kSafeInteger) &&
                    rhs_type.Is(type_cache_->kSafeInteger)) {
-          VisitInt64Binop(node);
-          if (lower()) {
+          VisitInt64Binop<T>(node);
+          if (lower<T>()) {
             lowering->DoMax(node, lowering->machine()->Int64LessThan(),
                             MachineRepresentation::kWord64);
           }
         } else {
-          VisitBinop(node,
-                     UseInfo::TruncatingFloat64(truncation.identify_zeros()),
-                     MachineRepresentation::kFloat64);
-          if (lower()) {
+          VisitBinop<T>(node,
+                        UseInfo::TruncatingFloat64(truncation.identify_zeros()),
+                        MachineRepresentation::kFloat64);
+          if (lower<T>()) {
             // If the right hand side is not NaN, and the left hand side
             // is not NaN (or -0 if the difference between the zeros is
             // observed), we can do a simple floating point comparison here.
@@ -2562,8 +2582,8 @@ class RepresentationSelector {
             (lhs_type.Is(Type::Unsigned32OrMinusZero()) &&
              rhs_type.Is(Type::Unsigned32OrMinusZero()) &&
              truncation.IdentifiesZeroAndMinusZero())) {
-          VisitWord32TruncatingBinop(node);
-          if (lower()) {
+          VisitWord32TruncatingBinop<T>(node);
+          if (lower<T>()) {
             lowering->DoMin(node, lowering->machine()->Uint32LessThan(),
                             MachineRepresentation::kWord32);
           }
@@ -2572,24 +2592,24 @@ class RepresentationSelector {
                    (lhs_type.Is(Type::Signed32OrMinusZero()) &&
                     rhs_type.Is(Type::Signed32OrMinusZero()) &&
                     truncation.IdentifiesZeroAndMinusZero())) {
-          VisitWord32TruncatingBinop(node);
-          if (lower()) {
+          VisitWord32TruncatingBinop<T>(node);
+          if (lower<T>()) {
             lowering->DoMin(node, lowering->machine()->Int32LessThan(),
                             MachineRepresentation::kWord32);
           }
         } else if (jsgraph_->machine()->Is64() &&
                    lhs_type.Is(type_cache_->kSafeInteger) &&
                    rhs_type.Is(type_cache_->kSafeInteger)) {
-          VisitInt64Binop(node);
-          if (lower()) {
+          VisitInt64Binop<T>(node);
+          if (lower<T>()) {
             lowering->DoMin(node, lowering->machine()->Int64LessThan(),
                             MachineRepresentation::kWord64);
           }
         } else {
-          VisitBinop(node,
-                     UseInfo::TruncatingFloat64(truncation.identify_zeros()),
-                     MachineRepresentation::kFloat64);
-          if (lower()) {
+          VisitBinop<T>(node,
+                        UseInfo::TruncatingFloat64(truncation.identify_zeros()),
+                        MachineRepresentation::kFloat64);
+          if (lower<T>()) {
             // If the left hand side is not NaN, and the right hand side
             // is not NaN (or -0 if the difference between the zeros is
             // observed), we can do a simple floating point comparison here.
@@ -2609,9 +2629,9 @@ class RepresentationSelector {
       }
       case IrOpcode::kNumberAtan2:
       case IrOpcode::kNumberPow: {
-        VisitBinop(node, UseInfo::TruncatingFloat64(),
-                   MachineRepresentation::kFloat64);
-        if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
+        VisitBinop<T>(node, UseInfo::TruncatingFloat64(),
+                      MachineRepresentation::kFloat64);
+        if (lower<T>()) NodeProperties::ChangeOp(node, Float64Op(node));
         return;
       }
       case IrOpcode::kNumberCeil:
@@ -2623,9 +2643,10 @@ class RepresentationSelector {
         // no-ops if we figure out (late) that their input is already an
         // integer, NaN or -0.
         Type const input_type = TypeOf(node->InputAt(0));
-        VisitUnop(node, UseInfo::TruncatingFloat64(truncation.identify_zeros()),
-                  MachineRepresentation::kFloat64);
-        if (lower()) {
+        VisitUnop<T>(node,
+                     UseInfo::TruncatingFloat64(truncation.identify_zeros()),
+                     MachineRepresentation::kFloat64);
+        if (lower<T>()) {
           if (input_type.Is(type_cache_->kIntegerOrMinusZeroOrNaN)) {
             DeferReplacement(node, node->InputAt(0));
           } else if (node->opcode() == IrOpcode::kNumberRound) {
@@ -2638,16 +2659,16 @@ class RepresentationSelector {
       }
       case IrOpcode::kCheckBigInt: {
         if (InputIs(node, Type::BigInt())) {
-          VisitNoop(node, truncation);
+          VisitNoop<T>(node, truncation);
         } else {
-          VisitUnop(node, UseInfo::AnyTagged(),
-                    MachineRepresentation::kTaggedPointer);
+          VisitUnop<T>(node, UseInfo::AnyTagged(),
+                       MachineRepresentation::kTaggedPointer);
         }
         return;
       }
       case IrOpcode::kBigIntAsUintN: {
-        ProcessInput(node, 0, UseInfo::TruncatingWord64());
-        SetOutput(node, MachineRepresentation::kWord64, Type::BigInt());
+        ProcessInput<T>(node, 0, UseInfo::TruncatingWord64());
+        SetOutput<T>(node, MachineRepresentation::kWord64, Type::BigInt());
         return;
       }
       case IrOpcode::kNumberAcos:
@@ -2669,20 +2690,20 @@ class RepresentationSelector {
       case IrOpcode::kNumberSinh:
       case IrOpcode::kNumberTan:
       case IrOpcode::kNumberTanh: {
-        VisitUnop(node, UseInfo::TruncatingFloat64(),
-                  MachineRepresentation::kFloat64);
-        if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
+        VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                     MachineRepresentation::kFloat64);
+        if (lower<T>()) NodeProperties::ChangeOp(node, Float64Op(node));
         return;
       }
       case IrOpcode::kNumberSign: {
         if (InputIs(node, Type::Signed32())) {
-          VisitUnop(node, UseInfo::TruncatingWord32(),
-                    MachineRepresentation::kWord32);
-          if (lower()) DeferReplacement(node, lowering->Int32Sign(node));
+          VisitUnop<T>(node, UseInfo::TruncatingWord32(),
+                       MachineRepresentation::kWord32);
+          if (lower<T>()) DeferReplacement(node, lowering->Int32Sign(node));
         } else {
-          VisitUnop(node, UseInfo::TruncatingFloat64(),
-                    MachineRepresentation::kFloat64);
-          if (lower()) DeferReplacement(node, lowering->Float64Sign(node));
+          VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                       MachineRepresentation::kFloat64);
+          if (lower<T>()) DeferReplacement(node, lowering->Float64Sign(node));
         }
         return;
       }
@@ -2690,20 +2711,20 @@ class RepresentationSelector {
         Type const input_type = TypeOf(node->InputAt(0));
         if (input_type.Is(Type::OrderedNumber())) {
           // No need to silence anything if the input cannot be NaN.
-          VisitUnop(node, UseInfo::TruncatingFloat64(),
-                    MachineRepresentation::kFloat64);
-          if (lower()) DeferReplacement(node, node->InputAt(0));
+          VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                       MachineRepresentation::kFloat64);
+          if (lower<T>()) DeferReplacement(node, node->InputAt(0));
         } else {
-          VisitUnop(node, UseInfo::TruncatingFloat64(),
-                    MachineRepresentation::kFloat64);
-          if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
+          VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                       MachineRepresentation::kFloat64);
+          if (lower<T>()) NodeProperties::ChangeOp(node, Float64Op(node));
         }
         return;
       }
       case IrOpcode::kNumberSqrt: {
-        VisitUnop(node, UseInfo::TruncatingFloat64(),
-                  MachineRepresentation::kFloat64);
-        if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
+        VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                     MachineRepresentation::kFloat64);
+        if (lower<T>()) NodeProperties::ChangeOp(node, Float64Op(node));
         return;
       }
       case IrOpcode::kNumberToBoolean: {
@@ -2714,67 +2735,67 @@ class RepresentationSelector {
         if (input_type.Is(Type::Integral32OrMinusZeroOrNaN())) {
           // 0, -0 and NaN all map to false, so we can safely truncate
           // all of them to zero here.
-          VisitUnop(node, UseInfo::TruncatingWord32(),
-                    MachineRepresentation::kBit);
-          if (lower()) lowering->DoIntegral32ToBit(node);
+          VisitUnop<T>(node, UseInfo::TruncatingWord32(),
+                       MachineRepresentation::kBit);
+          if (lower<T>()) lowering->DoIntegral32ToBit(node);
         } else if (input_type.Is(Type::OrderedNumber())) {
-          VisitUnop(node, UseInfo::TruncatingFloat64(kIdentifyZeros),
-                    MachineRepresentation::kBit);
-          if (lower()) lowering->DoOrderedNumberToBit(node);
+          VisitUnop<T>(node, UseInfo::TruncatingFloat64(kIdentifyZeros),
+                       MachineRepresentation::kBit);
+          if (lower<T>()) lowering->DoOrderedNumberToBit(node);
         } else {
-          VisitUnop(node, UseInfo::TruncatingFloat64(kIdentifyZeros),
-                    MachineRepresentation::kBit);
-          if (lower()) lowering->DoNumberToBit(node);
+          VisitUnop<T>(node, UseInfo::TruncatingFloat64(kIdentifyZeros),
+                       MachineRepresentation::kBit);
+          if (lower<T>()) lowering->DoNumberToBit(node);
         }
         return;
       }
       case IrOpcode::kNumberToInt32: {
         // Just change representation if necessary.
-        VisitUnop(node, UseInfo::TruncatingWord32(),
-                  MachineRepresentation::kWord32);
-        if (lower()) DeferReplacement(node, node->InputAt(0));
+        VisitUnop<T>(node, UseInfo::TruncatingWord32(),
+                     MachineRepresentation::kWord32);
+        if (lower<T>()) DeferReplacement(node, node->InputAt(0));
         return;
       }
       case IrOpcode::kNumberToString: {
-        VisitUnop(node, UseInfo::AnyTagged(),
-                  MachineRepresentation::kTaggedPointer);
+        VisitUnop<T>(node, UseInfo::AnyTagged(),
+                     MachineRepresentation::kTaggedPointer);
         return;
       }
       case IrOpcode::kNumberToUint32: {
         // Just change representation if necessary.
-        VisitUnop(node, UseInfo::TruncatingWord32(),
-                  MachineRepresentation::kWord32);
-        if (lower()) DeferReplacement(node, node->InputAt(0));
+        VisitUnop<T>(node, UseInfo::TruncatingWord32(),
+                     MachineRepresentation::kWord32);
+        if (lower<T>()) DeferReplacement(node, node->InputAt(0));
         return;
       }
       case IrOpcode::kNumberToUint8Clamped: {
         Type const input_type = TypeOf(node->InputAt(0));
         if (input_type.Is(type_cache_->kUint8OrMinusZeroOrNaN)) {
-          VisitUnop(node, UseInfo::TruncatingWord32(),
-                    MachineRepresentation::kWord32);
-          if (lower()) DeferReplacement(node, node->InputAt(0));
+          VisitUnop<T>(node, UseInfo::TruncatingWord32(),
+                       MachineRepresentation::kWord32);
+          if (lower<T>()) DeferReplacement(node, node->InputAt(0));
         } else if (input_type.Is(Type::Unsigned32OrMinusZeroOrNaN())) {
-          VisitUnop(node, UseInfo::TruncatingWord32(),
-                    MachineRepresentation::kWord32);
-          if (lower()) lowering->DoUnsigned32ToUint8Clamped(node);
+          VisitUnop<T>(node, UseInfo::TruncatingWord32(),
+                       MachineRepresentation::kWord32);
+          if (lower<T>()) lowering->DoUnsigned32ToUint8Clamped(node);
         } else if (input_type.Is(Type::Signed32OrMinusZeroOrNaN())) {
-          VisitUnop(node, UseInfo::TruncatingWord32(),
-                    MachineRepresentation::kWord32);
-          if (lower()) lowering->DoSigned32ToUint8Clamped(node);
+          VisitUnop<T>(node, UseInfo::TruncatingWord32(),
+                       MachineRepresentation::kWord32);
+          if (lower<T>()) lowering->DoSigned32ToUint8Clamped(node);
         } else if (input_type.Is(type_cache_->kIntegerOrMinusZeroOrNaN)) {
-          VisitUnop(node, UseInfo::TruncatingFloat64(),
-                    MachineRepresentation::kFloat64);
-          if (lower()) lowering->DoIntegerToUint8Clamped(node);
+          VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                       MachineRepresentation::kFloat64);
+          if (lower<T>()) lowering->DoIntegerToUint8Clamped(node);
         } else {
-          VisitUnop(node, UseInfo::TruncatingFloat64(),
-                    MachineRepresentation::kFloat64);
-          if (lower()) lowering->DoNumberToUint8Clamped(node);
+          VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                       MachineRepresentation::kFloat64);
+          if (lower<T>()) lowering->DoNumberToUint8Clamped(node);
         }
         return;
       }
       case IrOpcode::kReferenceEqual: {
-        VisitBinop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
-        if (lower()) {
+        VisitBinop<T>(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
+        if (lower<T>()) {
           if (COMPRESS_POINTERS_BOOL) {
             NodeProperties::ChangeOp(node, lowering->machine()->Word32Equal());
           } else {
@@ -2784,49 +2805,49 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kSameValueNumbersOnly: {
-        VisitBinop(node, UseInfo::AnyTagged(),
-                   MachineRepresentation::kTaggedPointer);
+        VisitBinop<T>(node, UseInfo::AnyTagged(),
+                      MachineRepresentation::kTaggedPointer);
         return;
       }
       case IrOpcode::kSameValue: {
-        if (truncation.IsUnused()) return VisitUnused(node);
+        if (truncation.IsUnused()) return VisitUnused<T>(node);
         if (BothInputsAre(node, Type::Number())) {
-          VisitBinop(node, UseInfo::TruncatingFloat64(),
-                     MachineRepresentation::kBit);
-          if (lower()) {
+          VisitBinop<T>(node, UseInfo::TruncatingFloat64(),
+                        MachineRepresentation::kBit);
+          if (lower<T>()) {
             NodeProperties::ChangeOp(node,
                                      lowering->simplified()->NumberSameValue());
           }
         } else {
-          VisitBinop(node, UseInfo::AnyTagged(),
-                     MachineRepresentation::kTaggedPointer);
+          VisitBinop<T>(node, UseInfo::AnyTagged(),
+                        MachineRepresentation::kTaggedPointer);
         }
         return;
       }
       case IrOpcode::kTypeOf: {
-        return VisitUnop(node, UseInfo::AnyTagged(),
-                         MachineRepresentation::kTaggedPointer);
+        return VisitUnop<T>(node, UseInfo::AnyTagged(),
+                            MachineRepresentation::kTaggedPointer);
       }
       case IrOpcode::kNewConsString: {
-        ProcessInput(node, 0, UseInfo::TruncatingWord32());  // length
-        ProcessInput(node, 1, UseInfo::AnyTagged());         // first
-        ProcessInput(node, 2, UseInfo::AnyTagged());         // second
-        SetOutput(node, MachineRepresentation::kTaggedPointer);
+        ProcessInput<T>(node, 0, UseInfo::TruncatingWord32());  // length
+        ProcessInput<T>(node, 1, UseInfo::AnyTagged());         // first
+        ProcessInput<T>(node, 2, UseInfo::AnyTagged());         // second
+        SetOutput<T>(node, MachineRepresentation::kTaggedPointer);
         return;
       }
       case IrOpcode::kSpeculativeBigIntAdd: {
         if (truncation.IsUsedAsWord64()) {
-          VisitBinop(node,
-                     UseInfo::CheckedBigIntTruncatingWord64(FeedbackSource{}),
-                     MachineRepresentation::kWord64);
-          if (lower()) {
+          VisitBinop<T>(
+              node, UseInfo::CheckedBigIntTruncatingWord64(FeedbackSource{}),
+              MachineRepresentation::kWord64);
+          if (lower<T>()) {
             ChangeToPureOp(node, lowering->machine()->Int64Add());
           }
         } else {
-          VisitBinop(node,
-                     UseInfo::CheckedBigIntAsTaggedPointer(FeedbackSource{}),
-                     MachineRepresentation::kTaggedPointer);
-          if (lower()) {
+          VisitBinop<T>(node,
+                        UseInfo::CheckedBigIntAsTaggedPointer(FeedbackSource{}),
+                        MachineRepresentation::kTaggedPointer);
+          if (lower<T>()) {
             NodeProperties::ChangeOp(node, lowering->simplified()->BigIntAdd());
           }
         }
@@ -2834,17 +2855,17 @@ class RepresentationSelector {
       }
       case IrOpcode::kSpeculativeBigIntSubtract: {
         if (truncation.IsUsedAsWord64()) {
-          VisitBinop(node,
-                     UseInfo::CheckedBigIntTruncatingWord64(FeedbackSource{}),
-                     MachineRepresentation::kWord64);
-          if (lower()) {
+          VisitBinop<T>(
+              node, UseInfo::CheckedBigIntTruncatingWord64(FeedbackSource{}),
+              MachineRepresentation::kWord64);
+          if (lower<T>()) {
             ChangeToPureOp(node, lowering->machine()->Int64Sub());
           }
         } else {
-          VisitBinop(node,
-                     UseInfo::CheckedBigIntAsTaggedPointer(FeedbackSource{}),
-                     MachineRepresentation::kTaggedPointer);
-          if (lower()) {
+          VisitBinop<T>(node,
+                        UseInfo::CheckedBigIntAsTaggedPointer(FeedbackSource{}),
+                        MachineRepresentation::kTaggedPointer);
+          if (lower<T>()) {
             NodeProperties::ChangeOp(node,
                                      lowering->simplified()->BigIntSubtract());
           }
@@ -2853,18 +2874,18 @@ class RepresentationSelector {
       }
       case IrOpcode::kSpeculativeBigIntNegate: {
         if (truncation.IsUsedAsWord64()) {
-          VisitUnop(node,
-                    UseInfo::CheckedBigIntTruncatingWord64(FeedbackSource{}),
-                    MachineRepresentation::kWord64);
-          if (lower()) {
+          VisitUnop<T>(node,
+                       UseInfo::CheckedBigIntTruncatingWord64(FeedbackSource{}),
+                       MachineRepresentation::kWord64);
+          if (lower<T>()) {
             ChangeUnaryToPureBinaryOp(node, lowering->machine()->Int64Sub(), 0,
                                       jsgraph_->Int64Constant(0));
           }
         } else {
-          VisitUnop(node,
-                    UseInfo::CheckedBigIntAsTaggedPointer(FeedbackSource{}),
-                    MachineRepresentation::kTaggedPointer);
-          if (lower()) {
+          VisitUnop<T>(node,
+                       UseInfo::CheckedBigIntAsTaggedPointer(FeedbackSource{}),
+                       MachineRepresentation::kTaggedPointer);
+          if (lower<T>()) {
             ChangeToPureOp(node, lowering->simplified()->BigIntNegate());
           }
         }
@@ -2876,138 +2897,140 @@ class RepresentationSelector {
         // actual string concatenation. We should also use the length to pass it
         // to the builtin or decide in optimized code how to construct the
         // resulting string (i.e. cons string or sequential string).
-        ProcessInput(node, 0, UseInfo::TaggedSigned());  // length
-        ProcessInput(node, 1, UseInfo::AnyTagged());     // first
-        ProcessInput(node, 2, UseInfo::AnyTagged());     // second
-        SetOutput(node, MachineRepresentation::kTaggedPointer);
+        ProcessInput<T>(node, 0, UseInfo::TaggedSigned());  // length
+        ProcessInput<T>(node, 1, UseInfo::AnyTagged());     // first
+        ProcessInput<T>(node, 2, UseInfo::AnyTagged());     // second
+        SetOutput<T>(node, MachineRepresentation::kTaggedPointer);
         return;
       }
       case IrOpcode::kStringEqual:
       case IrOpcode::kStringLessThan:
       case IrOpcode::kStringLessThanOrEqual: {
-        return VisitBinop(node, UseInfo::AnyTagged(),
-                          MachineRepresentation::kTaggedPointer);
+        return VisitBinop<T>(node, UseInfo::AnyTagged(),
+                             MachineRepresentation::kTaggedPointer);
       }
       case IrOpcode::kStringCharCodeAt: {
-        return VisitBinop(node, UseInfo::AnyTagged(), UseInfo::Word(),
-                          MachineRepresentation::kWord32);
+        return VisitBinop<T>(node, UseInfo::AnyTagged(), UseInfo::Word(),
+                             MachineRepresentation::kWord32);
       }
       case IrOpcode::kStringCodePointAt: {
-        return VisitBinop(node, UseInfo::AnyTagged(), UseInfo::Word(),
-                          MachineRepresentation::kTaggedSigned);
+        return VisitBinop<T>(node, UseInfo::AnyTagged(), UseInfo::Word(),
+                             MachineRepresentation::kTaggedSigned);
       }
       case IrOpcode::kStringFromSingleCharCode: {
-        VisitUnop(node, UseInfo::TruncatingWord32(),
-                  MachineRepresentation::kTaggedPointer);
+        VisitUnop<T>(node, UseInfo::TruncatingWord32(),
+                     MachineRepresentation::kTaggedPointer);
         return;
       }
       case IrOpcode::kStringFromSingleCodePoint: {
-        VisitUnop(node, UseInfo::TruncatingWord32(),
-                  MachineRepresentation::kTaggedPointer);
+        VisitUnop<T>(node, UseInfo::TruncatingWord32(),
+                     MachineRepresentation::kTaggedPointer);
         return;
       }
       case IrOpcode::kStringFromCodePointAt: {
-        return VisitBinop(node, UseInfo::AnyTagged(), UseInfo::Word(),
-                          MachineRepresentation::kTaggedPointer);
+        return VisitBinop<T>(node, UseInfo::AnyTagged(), UseInfo::Word(),
+                             MachineRepresentation::kTaggedPointer);
       }
       case IrOpcode::kStringIndexOf: {
-        ProcessInput(node, 0, UseInfo::AnyTagged());
-        ProcessInput(node, 1, UseInfo::AnyTagged());
-        ProcessInput(node, 2, UseInfo::TaggedSigned());
-        SetOutput(node, MachineRepresentation::kTaggedSigned);
+        ProcessInput<T>(node, 0, UseInfo::AnyTagged());
+        ProcessInput<T>(node, 1, UseInfo::AnyTagged());
+        ProcessInput<T>(node, 2, UseInfo::TaggedSigned());
+        SetOutput<T>(node, MachineRepresentation::kTaggedSigned);
         return;
       }
       case IrOpcode::kStringLength: {
         // TODO(bmeurer): The input representation should be TaggedPointer.
         // Fix this once we have a dedicated StringConcat/JSStringAdd
         // operator, which marks it's output as TaggedPointer properly.
-        VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kWord32);
+        VisitUnop<T>(node, UseInfo::AnyTagged(),
+                     MachineRepresentation::kWord32);
         return;
       }
       case IrOpcode::kStringSubstring: {
-        ProcessInput(node, 0, UseInfo::AnyTagged());
-        ProcessInput(node, 1, UseInfo::TruncatingWord32());
-        ProcessInput(node, 2, UseInfo::TruncatingWord32());
-        ProcessRemainingInputs(node, 3);
-        SetOutput(node, MachineRepresentation::kTaggedPointer);
+        ProcessInput<T>(node, 0, UseInfo::AnyTagged());
+        ProcessInput<T>(node, 1, UseInfo::TruncatingWord32());
+        ProcessInput<T>(node, 2, UseInfo::TruncatingWord32());
+        ProcessRemainingInputs<T>(node, 3);
+        SetOutput<T>(node, MachineRepresentation::kTaggedPointer);
         return;
       }
       case IrOpcode::kStringToLowerCaseIntl:
       case IrOpcode::kStringToUpperCaseIntl: {
-        VisitUnop(node, UseInfo::AnyTagged(),
-                  MachineRepresentation::kTaggedPointer);
+        VisitUnop<T>(node, UseInfo::AnyTagged(),
+                     MachineRepresentation::kTaggedPointer);
         return;
       }
       case IrOpcode::kCheckBounds:
-        return VisitCheckBounds(node, lowering);
+        return VisitCheckBounds<T>(node, lowering);
       case IrOpcode::kPoisonIndex: {
-        VisitUnop(node, UseInfo::TruncatingWord32(),
-                  MachineRepresentation::kWord32);
+        VisitUnop<T>(node, UseInfo::TruncatingWord32(),
+                     MachineRepresentation::kWord32);
         return;
       }
       case IrOpcode::kCheckHeapObject: {
         if (InputCannotBe(node, Type::SignedSmall())) {
-          VisitUnop(node, UseInfo::AnyTagged(),
-                    MachineRepresentation::kTaggedPointer);
+          VisitUnop<T>(node, UseInfo::AnyTagged(),
+                       MachineRepresentation::kTaggedPointer);
         } else {
-          VisitUnop(node,
-                    UseInfo::CheckedHeapObjectAsTaggedPointer(FeedbackSource()),
-                    MachineRepresentation::kTaggedPointer);
+          VisitUnop<T>(
+              node, UseInfo::CheckedHeapObjectAsTaggedPointer(FeedbackSource()),
+              MachineRepresentation::kTaggedPointer);
         }
-        if (lower()) DeferReplacement(node, node->InputAt(0));
+        if (lower<T>()) DeferReplacement(node, node->InputAt(0));
         return;
       }
       case IrOpcode::kCheckIf: {
-        ProcessInput(node, 0, UseInfo::Bool());
-        ProcessRemainingInputs(node, 1);
-        SetOutput(node, MachineRepresentation::kNone);
+        ProcessInput<T>(node, 0, UseInfo::Bool());
+        ProcessRemainingInputs<T>(node, 1);
+        SetOutput<T>(node, MachineRepresentation::kNone);
         return;
       }
       case IrOpcode::kCheckInternalizedString: {
-        VisitCheck(node, Type::InternalizedString(), lowering);
+        VisitCheck<T>(node, Type::InternalizedString(), lowering);
         return;
       }
       case IrOpcode::kCheckNumber: {
         Type const input_type = TypeOf(node->InputAt(0));
         if (input_type.Is(Type::Number())) {
-          VisitNoop(node, truncation);
+          VisitNoop<T>(node, truncation);
         } else {
-          VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged);
+          VisitUnop<T>(node, UseInfo::AnyTagged(),
+                       MachineRepresentation::kTagged);
         }
         return;
       }
       case IrOpcode::kCheckReceiver: {
-        VisitCheck(node, Type::Receiver(), lowering);
+        VisitCheck<T>(node, Type::Receiver(), lowering);
         return;
       }
       case IrOpcode::kCheckReceiverOrNullOrUndefined: {
-        VisitCheck(node, Type::ReceiverOrNullOrUndefined(), lowering);
+        VisitCheck<T>(node, Type::ReceiverOrNullOrUndefined(), lowering);
         return;
       }
       case IrOpcode::kCheckSmi: {
         const CheckParameters& params = CheckParametersOf(node->op());
         if (SmiValuesAre32Bits() && truncation.IsUsedAsWord32()) {
-          VisitUnop(node,
-                    UseInfo::CheckedSignedSmallAsWord32(kDistinguishZeros,
-                                                        params.feedback()),
-                    MachineRepresentation::kWord32);
+          VisitUnop<T>(node,
+                       UseInfo::CheckedSignedSmallAsWord32(kDistinguishZeros,
+                                                           params.feedback()),
+                       MachineRepresentation::kWord32);
         } else {
-          VisitUnop(
+          VisitUnop<T>(
               node,
               UseInfo::CheckedSignedSmallAsTaggedSigned(params.feedback()),
               MachineRepresentation::kTaggedSigned);
         }
-        if (lower()) DeferReplacement(node, node->InputAt(0));
+        if (lower<T>()) DeferReplacement(node, node->InputAt(0));
         return;
       }
       case IrOpcode::kCheckString: {
         const CheckParameters& params = CheckParametersOf(node->op());
         if (InputIs(node, Type::String())) {
-          VisitUnop(node, UseInfo::AnyTagged(),
-                    MachineRepresentation::kTaggedPointer);
-          if (lower()) DeferReplacement(node, node->InputAt(0));
+          VisitUnop<T>(node, UseInfo::AnyTagged(),
+                       MachineRepresentation::kTaggedPointer);
+          if (lower<T>()) DeferReplacement(node, node->InputAt(0));
         } else {
-          VisitUnop(
+          VisitUnop<T>(
               node,
               UseInfo::CheckedHeapObjectAsTaggedPointer(params.feedback()),
               MachineRepresentation::kTaggedPointer);
@@ -3015,40 +3038,40 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kCheckSymbol: {
-        VisitCheck(node, Type::Symbol(), lowering);
+        VisitCheck<T>(node, Type::Symbol(), lowering);
         return;
       }
 
       case IrOpcode::kAllocate: {
-        ProcessInput(node, 0, UseInfo::Word());
-        ProcessRemainingInputs(node, 1);
-        SetOutput(node, MachineRepresentation::kTaggedPointer);
+        ProcessInput<T>(node, 0, UseInfo::Word());
+        ProcessRemainingInputs<T>(node, 1);
+        SetOutput<T>(node, MachineRepresentation::kTaggedPointer);
         return;
       }
       case IrOpcode::kLoadMessage: {
-        if (truncation.IsUnused()) return VisitUnused(node);
-        VisitUnop(node, UseInfo::Word(), MachineRepresentation::kTagged);
+        if (truncation.IsUnused()) return VisitUnused<T>(node);
+        VisitUnop<T>(node, UseInfo::Word(), MachineRepresentation::kTagged);
         return;
       }
       case IrOpcode::kStoreMessage: {
-        ProcessInput(node, 0, UseInfo::Word());
-        ProcessInput(node, 1, UseInfo::AnyTagged());
-        ProcessRemainingInputs(node, 2);
-        SetOutput(node, MachineRepresentation::kNone);
+        ProcessInput<T>(node, 0, UseInfo::Word());
+        ProcessInput<T>(node, 1, UseInfo::AnyTagged());
+        ProcessRemainingInputs<T>(node, 2);
+        SetOutput<T>(node, MachineRepresentation::kNone);
         return;
       }
       case IrOpcode::kLoadFieldByIndex: {
-        if (truncation.IsUnused()) return VisitUnused(node);
-        VisitBinop(node, UseInfo::AnyTagged(), UseInfo::TruncatingWord32(),
-                   MachineRepresentation::kTagged);
+        if (truncation.IsUnused()) return VisitUnused<T>(node);
+        VisitBinop<T>(node, UseInfo::AnyTagged(), UseInfo::TruncatingWord32(),
+                      MachineRepresentation::kTagged);
         return;
       }
       case IrOpcode::kLoadField: {
-        if (truncation.IsUnused()) return VisitUnused(node);
+        if (truncation.IsUnused()) return VisitUnused<T>(node);
         FieldAccess access = FieldAccessOf(node->op());
         MachineRepresentation const representation =
             access.machine_type.representation();
-        VisitUnop(node, UseInfoForBasePointer(access), representation);
+        VisitUnop<T>(node, UseInfoForBasePointer(access), representation);
         return;
       }
       case IrOpcode::kStoreField: {
@@ -3067,12 +3090,12 @@ class RepresentationSelector {
             access.base_is_tagged, field_representation, access.offset,
             access.type, input_info->representation(), value_node);
 
-        ProcessInput(node, 0, UseInfoForBasePointer(access));
-        ProcessInput(node, 1,
-                     TruncatingUseInfoFromRepresentation(field_representation));
-        ProcessRemainingInputs(node, 2);
-        SetOutput(node, MachineRepresentation::kNone);
-        if (lower()) {
+        ProcessInput<T>(node, 0, UseInfoForBasePointer(access));
+        ProcessInput<T>(
+            node, 1, TruncatingUseInfoFromRepresentation(field_representation));
+        ProcessRemainingInputs<T>(node, 2);
+        SetOutput<T>(node, MachineRepresentation::kNone);
+        if (lower<T>()) {
           if (write_barrier_kind < access.write_barrier_kind) {
             access.write_barrier_kind = write_barrier_kind;
             NodeProperties::ChangeOp(
@@ -3082,15 +3105,15 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kLoadElement: {
-        if (truncation.IsUnused()) return VisitUnused(node);
+        if (truncation.IsUnused()) return VisitUnused<T>(node);
         ElementAccess access = ElementAccessOf(node->op());
-        VisitBinop(node, UseInfoForBasePointer(access), UseInfo::Word(),
-                   access.machine_type.representation());
+        VisitBinop<T>(node, UseInfoForBasePointer(access), UseInfo::Word(),
+                      access.machine_type.representation());
         return;
       }
       case IrOpcode::kLoadStackArgument: {
-        if (truncation.IsUnused()) return VisitUnused(node);
-        VisitBinop(node, UseInfo::Word(), MachineRepresentation::kTagged);
+        if (truncation.IsUnused()) return VisitUnused<T>(node);
+        VisitBinop<T>(node, UseInfo::Word(), MachineRepresentation::kTagged);
         return;
       }
       case IrOpcode::kStoreElement: {
@@ -3108,14 +3131,14 @@ class RepresentationSelector {
         WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
             access.base_is_tagged, element_representation, access.type,
             input_info->representation(), value_node);
-        ProcessInput(node, 0, UseInfoForBasePointer(access));  // base
-        ProcessInput(node, 1, UseInfo::Word());                // index
-        ProcessInput(node, 2,
-                     TruncatingUseInfoFromRepresentation(
-                         element_representation));  // value
-        ProcessRemainingInputs(node, 3);
-        SetOutput(node, MachineRepresentation::kNone);
-        if (lower()) {
+        ProcessInput<T>(node, 0, UseInfoForBasePointer(access));  // base
+        ProcessInput<T>(node, 1, UseInfo::Word());                // index
+        ProcessInput<T>(node, 2,
+                        TruncatingUseInfoFromRepresentation(
+                            element_representation));  // value
+        ProcessRemainingInputs<T>(node, 3);
+        SetOutput<T>(node, MachineRepresentation::kNone);
+        if (lower<T>()) {
           if (write_barrier_kind < access.write_barrier_kind) {
             access.write_barrier_kind = write_barrier_kind;
             NodeProperties::ChangeOp(
@@ -3125,99 +3148,99 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kNumberIsFloat64Hole: {
-        VisitUnop(node, UseInfo::TruncatingFloat64(),
-                  MachineRepresentation::kBit);
+        VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                     MachineRepresentation::kBit);
         return;
       }
       case IrOpcode::kTransitionAndStoreElement: {
         Type value_type = TypeOf(node->InputAt(2));
 
-        ProcessInput(node, 0, UseInfo::AnyTagged());  // array
-        ProcessInput(node, 1, UseInfo::Word());       // index
+        ProcessInput<T>(node, 0, UseInfo::AnyTagged());  // array
+        ProcessInput<T>(node, 1, UseInfo::Word());       // index
 
         if (value_type.Is(Type::SignedSmall())) {
-          ProcessInput(node, 2, UseInfo::TruncatingWord32());  // value
-          if (lower()) {
+          ProcessInput<T>(node, 2, UseInfo::TruncatingWord32());  // value
+          if (lower<T>()) {
             NodeProperties::ChangeOp(node,
                                      simplified()->StoreSignedSmallElement());
           }
         } else if (value_type.Is(Type::Number())) {
-          ProcessInput(node, 2, UseInfo::TruncatingFloat64());  // value
-          if (lower()) {
+          ProcessInput<T>(node, 2, UseInfo::TruncatingFloat64());  // value
+          if (lower<T>()) {
             Handle<Map> double_map = DoubleMapParameterOf(node->op());
             NodeProperties::ChangeOp(
                 node,
                 simplified()->TransitionAndStoreNumberElement(double_map));
           }
         } else if (value_type.Is(Type::NonNumber())) {
-          ProcessInput(node, 2, UseInfo::AnyTagged());  // value
-          if (lower()) {
+          ProcessInput<T>(node, 2, UseInfo::AnyTagged());  // value
+          if (lower<T>()) {
             Handle<Map> fast_map = FastMapParameterOf(node->op());
             NodeProperties::ChangeOp(
                 node, simplified()->TransitionAndStoreNonNumberElement(
                           fast_map, value_type));
           }
         } else {
-          ProcessInput(node, 2, UseInfo::AnyTagged());  // value
+          ProcessInput<T>(node, 2, UseInfo::AnyTagged());  // value
         }
 
-        ProcessRemainingInputs(node, 3);
-        SetOutput(node, MachineRepresentation::kNone);
+        ProcessRemainingInputs<T>(node, 3);
+        SetOutput<T>(node, MachineRepresentation::kNone);
         return;
       }
       case IrOpcode::kLoadTypedElement: {
         MachineRepresentation const rep =
             MachineRepresentationFromArrayType(ExternalArrayTypeOf(node->op()));
-        ProcessInput(node, 0, UseInfo::AnyTagged());  // buffer
-        ProcessInput(node, 1, UseInfo::AnyTagged());  // base pointer
-        ProcessInput(node, 2, UseInfo::Word());       // external pointer
-        ProcessInput(node, 3, UseInfo::Word());       // index
-        ProcessRemainingInputs(node, 4);
-        SetOutput(node, rep);
+        ProcessInput<T>(node, 0, UseInfo::AnyTagged());  // buffer
+        ProcessInput<T>(node, 1, UseInfo::AnyTagged());  // base pointer
+        ProcessInput<T>(node, 2, UseInfo::Word());       // external pointer
+        ProcessInput<T>(node, 3, UseInfo::Word());       // index
+        ProcessRemainingInputs<T>(node, 4);
+        SetOutput<T>(node, rep);
         return;
       }
       case IrOpcode::kLoadDataViewElement: {
         MachineRepresentation const rep =
             MachineRepresentationFromArrayType(ExternalArrayTypeOf(node->op()));
-        ProcessInput(node, 0, UseInfo::AnyTagged());  // object
-        ProcessInput(node, 1, UseInfo::Word());       // base
-        ProcessInput(node, 2, UseInfo::Word());       // index
-        ProcessInput(node, 3, UseInfo::Bool());       // little-endian
-        ProcessRemainingInputs(node, 4);
-        SetOutput(node, rep);
+        ProcessInput<T>(node, 0, UseInfo::AnyTagged());  // object
+        ProcessInput<T>(node, 1, UseInfo::Word());       // base
+        ProcessInput<T>(node, 2, UseInfo::Word());       // index
+        ProcessInput<T>(node, 3, UseInfo::Bool());       // little-endian
+        ProcessRemainingInputs<T>(node, 4);
+        SetOutput<T>(node, rep);
         return;
       }
       case IrOpcode::kStoreTypedElement: {
         MachineRepresentation const rep =
             MachineRepresentationFromArrayType(ExternalArrayTypeOf(node->op()));
-        ProcessInput(node, 0, UseInfo::AnyTagged());  // buffer
-        ProcessInput(node, 1, UseInfo::AnyTagged());  // base pointer
-        ProcessInput(node, 2, UseInfo::Word());       // external pointer
-        ProcessInput(node, 3, UseInfo::Word());       // index
-        ProcessInput(node, 4,
-                     TruncatingUseInfoFromRepresentation(rep));  // value
-        ProcessRemainingInputs(node, 5);
-        SetOutput(node, MachineRepresentation::kNone);
+        ProcessInput<T>(node, 0, UseInfo::AnyTagged());  // buffer
+        ProcessInput<T>(node, 1, UseInfo::AnyTagged());  // base pointer
+        ProcessInput<T>(node, 2, UseInfo::Word());       // external pointer
+        ProcessInput<T>(node, 3, UseInfo::Word());       // index
+        ProcessInput<T>(node, 4,
+                        TruncatingUseInfoFromRepresentation(rep));  // value
+        ProcessRemainingInputs<T>(node, 5);
+        SetOutput<T>(node, MachineRepresentation::kNone);
         return;
       }
       case IrOpcode::kStoreDataViewElement: {
         MachineRepresentation const rep =
             MachineRepresentationFromArrayType(ExternalArrayTypeOf(node->op()));
-        ProcessInput(node, 0, UseInfo::AnyTagged());  // object
-        ProcessInput(node, 1, UseInfo::Word());       // base
-        ProcessInput(node, 2, UseInfo::Word());       // index
-        ProcessInput(node, 3,
-                     TruncatingUseInfoFromRepresentation(rep));  // value
-        ProcessInput(node, 4, UseInfo::Bool());  // little-endian
-        ProcessRemainingInputs(node, 5);
-        SetOutput(node, MachineRepresentation::kNone);
+        ProcessInput<T>(node, 0, UseInfo::AnyTagged());  // object
+        ProcessInput<T>(node, 1, UseInfo::Word());       // base
+        ProcessInput<T>(node, 2, UseInfo::Word());       // index
+        ProcessInput<T>(node, 3,
+                        TruncatingUseInfoFromRepresentation(rep));  // value
+        ProcessInput<T>(node, 4, UseInfo::Bool());  // little-endian
+        ProcessRemainingInputs<T>(node, 5);
+        SetOutput<T>(node, MachineRepresentation::kNone);
         return;
       }
       case IrOpcode::kConvertReceiver: {
         Type input_type = TypeOf(node->InputAt(0));
-        VisitBinop(node, UseInfo::AnyTagged(),
-                   MachineRepresentation::kTaggedPointer);
-        if (lower()) {
+        VisitBinop<T>(node, UseInfo::AnyTagged(),
+                      MachineRepresentation::kTaggedPointer);
+        if (lower<T>()) {
           // Try to optimize the {node} based on the input type.
           if (input_type.Is(Type::Receiver())) {
             DeferReplacement(node, node->InputAt(0));
@@ -3233,41 +3256,43 @@ class RepresentationSelector {
       }
       case IrOpcode::kPlainPrimitiveToNumber: {
         if (InputIs(node, Type::Boolean())) {
-          VisitUnop(node, UseInfo::Bool(), MachineRepresentation::kWord32);
-          if (lower()) DeferReplacement(node, node->InputAt(0));
+          VisitUnop<T>(node, UseInfo::Bool(), MachineRepresentation::kWord32);
+          if (lower<T>()) DeferReplacement(node, node->InputAt(0));
         } else if (InputIs(node, Type::String())) {
-          VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::AnyTagged(),
+                       MachineRepresentation::kTagged);
+          if (lower<T>()) {
             NodeProperties::ChangeOp(node, simplified()->StringToNumber());
           }
         } else if (truncation.IsUsedAsWord32()) {
           if (InputIs(node, Type::NumberOrOddball())) {
-            VisitUnop(node, UseInfo::TruncatingWord32(),
-                      MachineRepresentation::kWord32);
-            if (lower()) DeferReplacement(node, node->InputAt(0));
+            VisitUnop<T>(node, UseInfo::TruncatingWord32(),
+                         MachineRepresentation::kWord32);
+            if (lower<T>()) DeferReplacement(node, node->InputAt(0));
           } else {
-            VisitUnop(node, UseInfo::AnyTagged(),
-                      MachineRepresentation::kWord32);
-            if (lower()) {
+            VisitUnop<T>(node, UseInfo::AnyTagged(),
+                         MachineRepresentation::kWord32);
+            if (lower<T>()) {
               NodeProperties::ChangeOp(node,
                                        simplified()->PlainPrimitiveToWord32());
             }
           }
         } else if (truncation.TruncatesOddballAndBigIntToNumber()) {
           if (InputIs(node, Type::NumberOrOddball())) {
-            VisitUnop(node, UseInfo::TruncatingFloat64(),
-                      MachineRepresentation::kFloat64);
-            if (lower()) DeferReplacement(node, node->InputAt(0));
+            VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                         MachineRepresentation::kFloat64);
+            if (lower<T>()) DeferReplacement(node, node->InputAt(0));
           } else {
-            VisitUnop(node, UseInfo::AnyTagged(),
-                      MachineRepresentation::kFloat64);
-            if (lower()) {
+            VisitUnop<T>(node, UseInfo::AnyTagged(),
+                         MachineRepresentation::kFloat64);
+            if (lower<T>()) {
               NodeProperties::ChangeOp(node,
                                        simplified()->PlainPrimitiveToFloat64());
             }
           }
         } else {
-          VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged);
+          VisitUnop<T>(node, UseInfo::AnyTagged(),
+                       MachineRepresentation::kTagged);
         }
         return;
       }
@@ -3278,92 +3303,93 @@ class RepresentationSelector {
           case NumberOperationHint::kSigned32:
           case NumberOperationHint::kSignedSmall:
           case NumberOperationHint::kSignedSmallInputs:
-            VisitUnop(node,
-                      CheckedUseInfoAsWord32FromHint(p.hint(), p.feedback()),
-                      MachineRepresentation::kWord32, Type::Signed32());
+            VisitUnop<T>(node,
+                         CheckedUseInfoAsWord32FromHint(p.hint(), p.feedback()),
+                         MachineRepresentation::kWord32, Type::Signed32());
             break;
           case NumberOperationHint::kNumber:
+          case NumberOperationHint::kNumberOrBoolean:
           case NumberOperationHint::kNumberOrOddball:
-            VisitUnop(node,
-                      CheckedUseInfoAsFloat64FromHint(p.hint(), p.feedback()),
-                      MachineRepresentation::kFloat64);
+            VisitUnop<T>(
+                node, CheckedUseInfoAsFloat64FromHint(p.hint(), p.feedback()),
+                MachineRepresentation::kFloat64);
             break;
         }
-        if (lower()) DeferReplacement(node, node->InputAt(0));
+        if (lower<T>()) DeferReplacement(node, node->InputAt(0));
         return;
       }
       case IrOpcode::kObjectIsArrayBufferView: {
         // TODO(turbofan): Introduce a Type::ArrayBufferView?
-        VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
+        VisitUnop<T>(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
         return;
       }
       case IrOpcode::kObjectIsBigInt: {
-        VisitObjectIs(node, Type::BigInt(), lowering);
+        VisitObjectIs<T>(node, Type::BigInt(), lowering);
         return;
       }
       case IrOpcode::kObjectIsCallable: {
-        VisitObjectIs(node, Type::Callable(), lowering);
+        VisitObjectIs<T>(node, Type::Callable(), lowering);
         return;
       }
       case IrOpcode::kObjectIsConstructor: {
         // TODO(turbofan): Introduce a Type::Constructor?
-        VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
+        VisitUnop<T>(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
         return;
       }
       case IrOpcode::kObjectIsDetectableCallable: {
-        VisitObjectIs(node, Type::DetectableCallable(), lowering);
+        VisitObjectIs<T>(node, Type::DetectableCallable(), lowering);
         return;
       }
       case IrOpcode::kObjectIsFiniteNumber: {
         Type const input_type = GetUpperBound(node->InputAt(0));
         if (input_type.Is(type_cache_->kSafeInteger)) {
-          VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::None(), MachineRepresentation::kBit);
+          if (lower<T>()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
           }
         } else if (!input_type.Maybe(Type::Number())) {
-          VisitUnop(node, UseInfo::Any(), MachineRepresentation::kBit);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::Any(), MachineRepresentation::kBit);
+          if (lower<T>()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
           }
         } else if (input_type.Is(Type::Number())) {
-          VisitUnop(node, UseInfo::TruncatingFloat64(),
-                    MachineRepresentation::kBit);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                       MachineRepresentation::kBit);
+          if (lower<T>()) {
             NodeProperties::ChangeOp(node,
                                      lowering->simplified()->NumberIsFinite());
           }
         } else {
-          VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
+          VisitUnop<T>(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
         }
         return;
       }
       case IrOpcode::kNumberIsFinite: {
-        VisitUnop(node, UseInfo::TruncatingFloat64(),
-                  MachineRepresentation::kBit);
+        VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                     MachineRepresentation::kBit);
         return;
       }
       case IrOpcode::kObjectIsSafeInteger: {
         Type const input_type = GetUpperBound(node->InputAt(0));
         if (input_type.Is(type_cache_->kSafeInteger)) {
-          VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::None(), MachineRepresentation::kBit);
+          if (lower<T>()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
           }
         } else if (!input_type.Maybe(Type::Number())) {
-          VisitUnop(node, UseInfo::Any(), MachineRepresentation::kBit);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::Any(), MachineRepresentation::kBit);
+          if (lower<T>()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
           }
         } else if (input_type.Is(Type::Number())) {
-          VisitUnop(node, UseInfo::TruncatingFloat64(),
-                    MachineRepresentation::kBit);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                       MachineRepresentation::kBit);
+          if (lower<T>()) {
             NodeProperties::ChangeOp(
                 node, lowering->simplified()->NumberIsSafeInteger());
           }
         } else {
-          VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
+          VisitUnop<T>(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
         }
         return;
       }
@@ -3373,128 +3399,130 @@ class RepresentationSelector {
       case IrOpcode::kObjectIsInteger: {
         Type const input_type = GetUpperBound(node->InputAt(0));
         if (input_type.Is(type_cache_->kSafeInteger)) {
-          VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::None(), MachineRepresentation::kBit);
+          if (lower<T>()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
           }
         } else if (!input_type.Maybe(Type::Number())) {
-          VisitUnop(node, UseInfo::Any(), MachineRepresentation::kBit);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::Any(), MachineRepresentation::kBit);
+          if (lower<T>()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
           }
         } else if (input_type.Is(Type::Number())) {
-          VisitUnop(node, UseInfo::TruncatingFloat64(),
-                    MachineRepresentation::kBit);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                       MachineRepresentation::kBit);
+          if (lower<T>()) {
             NodeProperties::ChangeOp(node,
                                      lowering->simplified()->NumberIsInteger());
           }
         } else {
-          VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
+          VisitUnop<T>(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
         }
         return;
       }
       case IrOpcode::kNumberIsInteger: {
-        VisitUnop(node, UseInfo::TruncatingFloat64(),
-                  MachineRepresentation::kBit);
+        VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                     MachineRepresentation::kBit);
         return;
       }
       case IrOpcode::kObjectIsMinusZero: {
         Type const input_type = GetUpperBound(node->InputAt(0));
         if (input_type.Is(Type::MinusZero())) {
-          VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::None(), MachineRepresentation::kBit);
+          if (lower<T>()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
           }
         } else if (!input_type.Maybe(Type::MinusZero())) {
-          VisitUnop(node, UseInfo::Any(), MachineRepresentation::kBit);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::Any(), MachineRepresentation::kBit);
+          if (lower<T>()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
           }
         } else if (input_type.Is(Type::Number())) {
-          VisitUnop(node, UseInfo::TruncatingFloat64(),
-                    MachineRepresentation::kBit);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                       MachineRepresentation::kBit);
+          if (lower<T>()) {
             NodeProperties::ChangeOp(node, simplified()->NumberIsMinusZero());
           }
         } else {
-          VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
+          VisitUnop<T>(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
         }
         return;
       }
       case IrOpcode::kObjectIsNaN: {
         Type const input_type = GetUpperBound(node->InputAt(0));
         if (input_type.Is(Type::NaN())) {
-          VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::None(), MachineRepresentation::kBit);
+          if (lower<T>()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
           }
         } else if (!input_type.Maybe(Type::NaN())) {
-          VisitUnop(node, UseInfo::Any(), MachineRepresentation::kBit);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::Any(), MachineRepresentation::kBit);
+          if (lower<T>()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
           }
         } else if (input_type.Is(Type::Number())) {
-          VisitUnop(node, UseInfo::TruncatingFloat64(),
-                    MachineRepresentation::kBit);
-          if (lower()) {
+          VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                       MachineRepresentation::kBit);
+          if (lower<T>()) {
             NodeProperties::ChangeOp(node, simplified()->NumberIsNaN());
           }
         } else {
-          VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
+          VisitUnop<T>(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
         }
         return;
       }
       case IrOpcode::kNumberIsNaN: {
-        VisitUnop(node, UseInfo::TruncatingFloat64(),
-                  MachineRepresentation::kBit);
+        VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                     MachineRepresentation::kBit);
         return;
       }
       case IrOpcode::kObjectIsNonCallable: {
-        VisitObjectIs(node, Type::NonCallable(), lowering);
+        VisitObjectIs<T>(node, Type::NonCallable(), lowering);
         return;
       }
       case IrOpcode::kObjectIsNumber: {
-        VisitObjectIs(node, Type::Number(), lowering);
+        VisitObjectIs<T>(node, Type::Number(), lowering);
         return;
       }
       case IrOpcode::kObjectIsReceiver: {
-        VisitObjectIs(node, Type::Receiver(), lowering);
+        VisitObjectIs<T>(node, Type::Receiver(), lowering);
         return;
       }
       case IrOpcode::kObjectIsSmi: {
         // TODO(turbofan): Optimize based on input representation.
-        VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
+        VisitUnop<T>(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
         return;
       }
       case IrOpcode::kObjectIsString: {
-        VisitObjectIs(node, Type::String(), lowering);
+        VisitObjectIs<T>(node, Type::String(), lowering);
         return;
       }
       case IrOpcode::kObjectIsSymbol: {
-        VisitObjectIs(node, Type::Symbol(), lowering);
+        VisitObjectIs<T>(node, Type::Symbol(), lowering);
         return;
       }
       case IrOpcode::kObjectIsUndetectable: {
-        VisitObjectIs(node, Type::Undetectable(), lowering);
+        VisitObjectIs<T>(node, Type::Undetectable(), lowering);
         return;
       }
       case IrOpcode::kArgumentsFrame: {
-        SetOutput(node, MachineType::PointerRepresentation());
+        SetOutput<T>(node, MachineType::PointerRepresentation());
         return;
       }
       case IrOpcode::kArgumentsLength: {
-        VisitUnop(node, UseInfo::Word(), MachineRepresentation::kTaggedSigned);
+        VisitUnop<T>(node, UseInfo::Word(),
+                     MachineRepresentation::kTaggedSigned);
         return;
       }
       case IrOpcode::kNewDoubleElements:
       case IrOpcode::kNewSmiOrObjectElements: {
-        VisitUnop(node, UseInfo::Word(), MachineRepresentation::kTaggedPointer);
+        VisitUnop<T>(node, UseInfo::Word(),
+                     MachineRepresentation::kTaggedPointer);
         return;
       }
       case IrOpcode::kNewArgumentsElements: {
-        VisitBinop(node, UseInfo::Word(), UseInfo::TaggedSigned(),
-                   MachineRepresentation::kTaggedPointer);
+        VisitBinop<T>(node, UseInfo::Word(), UseInfo::TaggedSigned(),
+                      MachineRepresentation::kTaggedPointer);
         return;
       }
       case IrOpcode::kCheckFloat64Hole: {
@@ -3505,114 +3533,104 @@ class RepresentationSelector {
           // If {mode} is allow-return-hole _and_ the {truncation}
           // identifies NaN and undefined, we can just pass along
           // the {truncation} and completely wipe the {node}.
-          if (truncation.IsUnused()) return VisitUnused(node);
+          if (truncation.IsUnused()) return VisitUnused<T>(node);
           if (truncation.TruncatesOddballAndBigIntToNumber()) {
-            VisitUnop(node, UseInfo::TruncatingFloat64(),
-                      MachineRepresentation::kFloat64);
-            if (lower()) DeferReplacement(node, node->InputAt(0));
+            VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                         MachineRepresentation::kFloat64);
+            if (lower<T>()) DeferReplacement(node, node->InputAt(0));
             return;
           }
         }
-        VisitUnop(node,
-                  UseInfo(MachineRepresentation::kFloat64, Truncation::Any()),
-                  MachineRepresentation::kFloat64, Type::Number());
-        if (lower() && input_type.Is(Type::Number())) {
+        VisitUnop<T>(
+            node, UseInfo(MachineRepresentation::kFloat64, Truncation::Any()),
+            MachineRepresentation::kFloat64, Type::Number());
+        if (lower<T>() && input_type.Is(Type::Number())) {
           DeferReplacement(node, node->InputAt(0));
         }
         return;
       }
       case IrOpcode::kCheckNotTaggedHole: {
-        VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged);
+        VisitUnop<T>(node, UseInfo::AnyTagged(),
+                     MachineRepresentation::kTagged);
         return;
       }
       case IrOpcode::kCheckClosure: {
-        VisitUnop(node,
-                  UseInfo::CheckedHeapObjectAsTaggedPointer(FeedbackSource()),
-                  MachineRepresentation::kTaggedPointer);
+        VisitUnop<T>(
+            node, UseInfo::CheckedHeapObjectAsTaggedPointer(FeedbackSource()),
+            MachineRepresentation::kTaggedPointer);
         return;
       }
       case IrOpcode::kConvertTaggedHoleToUndefined: {
         if (InputIs(node, Type::NumberOrOddball()) &&
             truncation.IsUsedAsWord32()) {
           // Propagate the Word32 truncation.
-          VisitUnop(node, UseInfo::TruncatingWord32(),
-                    MachineRepresentation::kWord32);
-          if (lower()) DeferReplacement(node, node->InputAt(0));
+          VisitUnop<T>(node, UseInfo::TruncatingWord32(),
+                       MachineRepresentation::kWord32);
+          if (lower<T>()) DeferReplacement(node, node->InputAt(0));
         } else if (InputIs(node, Type::NumberOrOddball()) &&
                    truncation.TruncatesOddballAndBigIntToNumber()) {
           // Propagate the Float64 truncation.
-          VisitUnop(node, UseInfo::TruncatingFloat64(),
-                    MachineRepresentation::kFloat64);
-          if (lower()) DeferReplacement(node, node->InputAt(0));
+          VisitUnop<T>(node, UseInfo::TruncatingFloat64(),
+                       MachineRepresentation::kFloat64);
+          if (lower<T>()) DeferReplacement(node, node->InputAt(0));
         } else if (InputIs(node, Type::NonInternal())) {
-          VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged);
-          if (lower()) DeferReplacement(node, node->InputAt(0));
+          VisitUnop<T>(node, UseInfo::AnyTagged(),
+                       MachineRepresentation::kTagged);
+          if (lower<T>()) DeferReplacement(node, node->InputAt(0));
         } else {
           // TODO(turbofan): Add a (Tagged) truncation that identifies hole
           // and undefined, i.e. for a[i] === obj cases.
-          VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged);
+          VisitUnop<T>(node, UseInfo::AnyTagged(),
+                       MachineRepresentation::kTagged);
         }
         return;
       }
       case IrOpcode::kCheckEqualsSymbol:
       case IrOpcode::kCheckEqualsInternalizedString:
-        return VisitBinop(node, UseInfo::AnyTagged(),
-                          MachineRepresentation::kNone);
+        return VisitBinop<T>(node, UseInfo::AnyTagged(),
+                             MachineRepresentation::kNone);
       case IrOpcode::kMapGuard:
         // Eliminate MapGuard nodes here.
-        return VisitUnused(node);
+        return VisitUnused<T>(node);
       case IrOpcode::kCheckMaps: {
         CheckMapsParameters const& p = CheckMapsParametersOf(node->op());
-        return VisitUnop(
+        return VisitUnop<T>(
             node, UseInfo::CheckedHeapObjectAsTaggedPointer(p.feedback()),
             MachineRepresentation::kNone);
       }
       case IrOpcode::kTransitionElementsKind: {
-        return VisitUnop(
+        return VisitUnop<T>(
             node, UseInfo::CheckedHeapObjectAsTaggedPointer(FeedbackSource()),
             MachineRepresentation::kNone);
       }
       case IrOpcode::kCompareMaps:
-        return VisitUnop(
+        return VisitUnop<T>(
             node, UseInfo::CheckedHeapObjectAsTaggedPointer(FeedbackSource()),
             MachineRepresentation::kBit);
       case IrOpcode::kEnsureWritableFastElements:
-        return VisitBinop(node, UseInfo::AnyTagged(),
-                          MachineRepresentation::kTaggedPointer);
+        return VisitBinop<T>(node, UseInfo::AnyTagged(),
+                             MachineRepresentation::kTaggedPointer);
       case IrOpcode::kMaybeGrowFastElements: {
-        Type const index_type = TypeOf(node->InputAt(2));
-        Type const length_type = TypeOf(node->InputAt(3));
-        ProcessInput(node, 0, UseInfo::AnyTagged());         // object
-        ProcessInput(node, 1, UseInfo::AnyTagged());         // elements
-        ProcessInput(node, 2, UseInfo::TruncatingWord32());  // index
-        ProcessInput(node, 3, UseInfo::TruncatingWord32());  // length
-        ProcessRemainingInputs(node, 4);
-        SetOutput(node, MachineRepresentation::kTaggedPointer);
-        if (lower()) {
-          // If the index is known to be less than the length (or if
-          // we're in dead code), we know that we don't need to grow
-          // the elements, so we can just remove this operation all
-          // together and replace it with the elements that we have
-          // on the inputs.
-          if (index_type.IsNone() || length_type.IsNone() ||
-              index_type.Max() < length_type.Min()) {
-            DeferReplacement(node, node->InputAt(1));
-          }
-        }
+        ProcessInput<T>(node, 0, UseInfo::AnyTagged());         // object
+        ProcessInput<T>(node, 1, UseInfo::AnyTagged());         // elements
+        ProcessInput<T>(node, 2, UseInfo::TruncatingWord32());  // index
+        ProcessInput<T>(node, 3, UseInfo::TruncatingWord32());  // length
+        ProcessRemainingInputs<T>(node, 4);
+        SetOutput<T>(node, MachineRepresentation::kTaggedPointer);
         return;
       }
 
       case IrOpcode::kDateNow:
-        VisitInputs(node);
-        return SetOutput(node, MachineRepresentation::kTaggedPointer);
+        VisitInputs<T>(node);
+        return SetOutput<T>(node, MachineRepresentation::kTaggedPointer);
       case IrOpcode::kFrameState:
-        return VisitFrameState(node);
+        return VisitFrameState<T>(node);
       case IrOpcode::kStateValues:
-        return VisitStateValues(node);
+        return VisitStateValues<T>(node);
       case IrOpcode::kObjectState:
-        return VisitObjectState(node);
+        return VisitObjectState<T>(node);
       case IrOpcode::kObjectId:
-        return SetOutput(node, MachineRepresentation::kTaggedPointer);
+        return SetOutput<T>(node, MachineRepresentation::kTaggedPointer);
 
       case IrOpcode::kTypeGuard: {
         // We just get rid of the sigma here, choosing the best representation
@@ -3624,49 +3642,49 @@ class RepresentationSelector {
         // Here we pretend that the input has the sigma's type for the
         // conversion.
         UseInfo use(representation, truncation);
-        if (propagate()) {
-          EnqueueInput(node, 0, use);
-        } else if (lower()) {
+        if (propagate<T>()) {
+          EnqueueInput<T>(node, 0, use);
+        } else if (lower<T>()) {
           ConvertInput(node, 0, use, type);
         }
-        ProcessRemainingInputs(node, 1);
-        SetOutput(node, representation);
+        ProcessRemainingInputs<T>(node, 1);
+        SetOutput<T>(node, representation);
         return;
       }
 
       case IrOpcode::kFoldConstant:
-        VisitInputs(node);
-        return SetOutput(node, MachineRepresentation::kTaggedPointer);
+        VisitInputs<T>(node);
+        return SetOutput<T>(node, MachineRepresentation::kTaggedPointer);
 
       case IrOpcode::kFinishRegion:
-        VisitInputs(node);
+        VisitInputs<T>(node);
         // Assume the output is tagged pointer.
-        return SetOutput(node, MachineRepresentation::kTaggedPointer);
+        return SetOutput<T>(node, MachineRepresentation::kTaggedPointer);
 
       case IrOpcode::kReturn:
-        VisitReturn(node);
+        VisitReturn<T>(node);
         // Assume the output is tagged.
-        return SetOutput(node, MachineRepresentation::kTagged);
+        return SetOutput<T>(node, MachineRepresentation::kTagged);
 
       case IrOpcode::kFindOrderedHashMapEntry: {
         Type const key_type = TypeOf(node->InputAt(1));
         if (key_type.Is(Type::Signed32OrMinusZero())) {
-          VisitBinop(node, UseInfo::AnyTagged(), UseInfo::TruncatingWord32(),
-                     MachineType::PointerRepresentation());
-          if (lower()) {
+          VisitBinop<T>(node, UseInfo::AnyTagged(), UseInfo::TruncatingWord32(),
+                        MachineType::PointerRepresentation());
+          if (lower<T>()) {
             NodeProperties::ChangeOp(
                 node,
                 lowering->simplified()->FindOrderedHashMapEntryForInt32Key());
           }
         } else {
-          VisitBinop(node, UseInfo::AnyTagged(),
-                     MachineRepresentation::kTaggedSigned);
+          VisitBinop<T>(node, UseInfo::AnyTagged(),
+                        MachineRepresentation::kTaggedSigned);
         }
         return;
       }
 
       case IrOpcode::kFastApiCall: {
-        VisitFastApiCall(node);
+        VisitFastApiCall<T>(node);
         return;
       }
 
@@ -3709,17 +3727,18 @@ class RepresentationSelector {
       case IrOpcode::kJSToObject:
       case IrOpcode::kJSToString:
       case IrOpcode::kJSParseInt:
-        VisitInputs(node);
+        VisitInputs<T>(node);
         // Assume the output is tagged.
-        return SetOutput(node, MachineRepresentation::kTagged);
+        return SetOutput<T>(node, MachineRepresentation::kTagged);
       case IrOpcode::kDeadValue:
-        ProcessInput(node, 0, UseInfo::Any());
-        return SetOutput(node, MachineRepresentation::kNone);
+        ProcessInput<T>(node, 0, UseInfo::Any());
+        return SetOutput<T>(node, MachineRepresentation::kNone);
       case IrOpcode::kStaticAssert:
-        return VisitUnop(node, UseInfo::Any(), MachineRepresentation::kTagged);
+        return VisitUnop<T>(node, UseInfo::Any(),
+                            MachineRepresentation::kTagged);
       case IrOpcode::kAssertType:
-        return VisitUnop(node, UseInfo::AnyTagged(),
-                         MachineRepresentation::kTagged);
+        return VisitUnop<T>(node, UseInfo::AnyTagged(),
+                            MachineRepresentation::kTagged);
       default:
         FATAL(
             "Representation inference: unsupported opcode %i (%s), node #%i\n.",
@@ -3797,23 +3816,23 @@ class RepresentationSelector {
  private:
   JSGraph* jsgraph_;
   Zone* zone_;                      // Temporary zone.
+  // Map from node to its uses that might need to be revisited.
+  ZoneMap<Node*, ZoneVector<Node*>> might_need_revisit_;
   size_t const count_;              // number of nodes in the graph
   ZoneVector<NodeInfo> info_;       // node id -> usage information
 #ifdef DEBUG
   ZoneVector<InputUseInfos> node_input_use_infos_;  // Debug information about
                                                     // requirements on inputs.
 #endif                                              // DEBUG
-  NodeVector nodes_;                // collected nodes
   NodeVector replacements_;         // replacements to be done after lowering
-  Phase phase_;                     // current phase of algorithm
   RepresentationChanger* changer_;  // for inserting representation changes
-  ZoneQueue<Node*> queue_;          // queue for traversing the graph
+  ZoneQueue<Node*> revisit_queue_;  // Queue for revisiting nodes.
 
   struct NodeState {
     Node* node;
     int input_index;
   };
-  ZoneStack<NodeState> typing_stack_;  // stack for graph typing.
+  NodeVector traversal_nodes_;  // Order in which to traverse the nodes.
   // TODO(danno): RepresentationSelector shouldn't know anything about the
   // source positions table, but must for now since there currently is no other
   // way to pass down source position information to nodes created during
@@ -3833,6 +3852,174 @@ class RepresentationSelector {
   Zone* graph_zone() { return jsgraph_->zone(); }
 };
 
+// Template specializations
+
+// Enqueue {use_node}'s {index} input if the {use_info} contains new information
+// for that input node.
+template <>
+void RepresentationSelector::EnqueueInput<PROPAGATE>(Node* use_node, int index,
+                                                     UseInfo use_info) {
+  Node* node = use_node->InputAt(index);
+  NodeInfo* info = GetInfo(node);
+#ifdef DEBUG
+  // Check monotonicity of input requirements.
+  node_input_use_infos_[use_node->id()].SetAndCheckInput(use_node, index,
+                                                         use_info);
+#endif  // DEBUG
+  if (info->unvisited()) {
+    // First visit of this node.
+    info->set_queued();
+    TRACE("  initial #%i: ", node->id());
+    info->AddUse(use_info);
+    PrintTruncation(info->truncation());
+    return;
+  }
+  TRACE("   queue #%i?: ", node->id());
+  PrintTruncation(info->truncation());
+  if (info->AddUse(use_info)) {
+    // New usage information for the node is available.
+    if (!info->queued()) {
+      DCHECK(info->visited());
+      revisit_queue_.push(node);
+      info->set_queued();
+      TRACE("   added: ");
+    } else {
+      TRACE(" inqueue: ");
+    }
+    PrintTruncation(info->truncation());
+  }
+}
+
+template <>
+void RepresentationSelector::SetOutput<PROPAGATE>(
+    Node* node, MachineRepresentation representation, Type restriction_type) {
+  NodeInfo* const info = GetInfo(node);
+  info->set_restriction_type(restriction_type);
+}
+
+template <>
+void RepresentationSelector::SetOutput<RETYPE>(
+    Node* node, MachineRepresentation representation, Type restriction_type) {
+  NodeInfo* const info = GetInfo(node);
+  DCHECK(info->restriction_type().Is(restriction_type));
+  DCHECK(restriction_type.Is(info->restriction_type()));
+  info->set_output(representation);
+}
+
+template <>
+void RepresentationSelector::SetOutput<LOWER>(
+    Node* node, MachineRepresentation representation, Type restriction_type) {
+  NodeInfo* const info = GetInfo(node);
+  DCHECK_EQ(info->representation(), representation);
+  DCHECK(info->restriction_type().Is(restriction_type));
+  DCHECK(restriction_type.Is(info->restriction_type()));
+  USE(info);
+}
+
+template <>
+void RepresentationSelector::ProcessInput<PROPAGATE>(Node* node, int index,
+                                                     UseInfo use) {
+  DCHECK_IMPLIES(use.type_check() != TypeCheckKind::kNone,
+                 !node->op()->HasProperty(Operator::kNoDeopt) &&
+                     node->op()->EffectInputCount() > 0);
+  EnqueueInput<PROPAGATE>(node, index, use);
+}
+
+template <>
+void RepresentationSelector::ProcessInput<RETYPE>(Node* node, int index,
+                                                  UseInfo use) {
+  DCHECK_IMPLIES(use.type_check() != TypeCheckKind::kNone,
+                 !node->op()->HasProperty(Operator::kNoDeopt) &&
+                     node->op()->EffectInputCount() > 0);
+}
+
+template <>
+void RepresentationSelector::ProcessInput<LOWER>(Node* node, int index,
+                                                 UseInfo use) {
+  DCHECK_IMPLIES(use.type_check() != TypeCheckKind::kNone,
+                 !node->op()->HasProperty(Operator::kNoDeopt) &&
+                     node->op()->EffectInputCount() > 0);
+  ConvertInput(node, index, use);
+}
+
+template <>
+void RepresentationSelector::ProcessRemainingInputs<PROPAGATE>(Node* node,
+                                                               int index) {
+  DCHECK_GE(index, NodeProperties::PastValueIndex(node));
+  DCHECK_GE(index, NodeProperties::PastContextIndex(node));
+  for (int i = std::max(index, NodeProperties::FirstEffectIndex(node));
+       i < NodeProperties::PastEffectIndex(node); ++i) {
+    EnqueueInput<PROPAGATE>(node, i);  // Effect inputs: just visit
+  }
+  for (int i = std::max(index, NodeProperties::FirstControlIndex(node));
+       i < NodeProperties::PastControlIndex(node); ++i) {
+    EnqueueInput<PROPAGATE>(node, i);  // Control inputs: just visit
+  }
+}
+
+// The default, most general visitation case. For {node}, process all value,
+// context, frame state, effect, and control inputs, assuming that value
+// inputs should have {kRepTagged} representation and can observe all output
+// values {kTypeAny}.
+template <>
+void RepresentationSelector::VisitInputs<PROPAGATE>(Node* node) {
+  int tagged_count = node->op()->ValueInputCount() +
+                     OperatorProperties::GetContextInputCount(node->op()) +
+                     OperatorProperties::GetFrameStateInputCount(node->op());
+  // Visit value, context and frame state inputs as tagged.
+  for (int i = 0; i < tagged_count; i++) {
+    ProcessInput<PROPAGATE>(node, i, UseInfo::AnyTagged());
+  }
+  // Only enqueue other inputs (effects, control).
+  for (int i = tagged_count; i < node->InputCount(); i++) {
+    EnqueueInput<PROPAGATE>(node, i);
+  }
+}
+
+template <>
+void RepresentationSelector::VisitInputs<LOWER>(Node* node) {
+  int tagged_count = node->op()->ValueInputCount() +
+                     OperatorProperties::GetContextInputCount(node->op()) +
+                     OperatorProperties::GetFrameStateInputCount(node->op());
+  // Visit value, context and frame state inputs as tagged.
+  for (int i = 0; i < tagged_count; i++) {
+    ProcessInput<LOWER>(node, i, UseInfo::AnyTagged());
+  }
+}
+
+template <>
+void RepresentationSelector::InsertUnreachableIfNecessary<LOWER>(Node* node) {
+  // If the node is effectful and it produces an impossible value, then we
+  // insert Unreachable node after it.
+  if (node->op()->ValueOutputCount() > 0 &&
+      node->op()->EffectOutputCount() > 0 &&
+      node->opcode() != IrOpcode::kUnreachable && TypeOf(node).IsNone()) {
+    Node* control = (node->op()->ControlOutputCount() == 0)
+                        ? NodeProperties::GetControlInput(node, 0)
+                        : NodeProperties::FindSuccessfulControlProjection(node);
+
+    Node* unreachable =
+        graph()->NewNode(common()->Unreachable(), node, control);
+
+    // Insert unreachable node and replace all the effect uses of the {node}
+    // with the new unreachable node.
+    for (Edge edge : node->use_edges()) {
+      if (!NodeProperties::IsEffectEdge(edge)) continue;
+      // Make sure to not overwrite the unreachable node's input. That would
+      // create a cycle.
+      if (edge.from() == unreachable) continue;
+      // Avoid messing up the exceptional path.
+      if (edge.from()->opcode() == IrOpcode::kIfException) {
+        DCHECK(!node->op()->HasProperty(Operator::kNoThrow));
+        DCHECK_EQ(NodeProperties::GetControlInput(edge.from()), node);
+        continue;
+      }
+
+      edge.UpdateTo(unreachable);
+    }
+  }
+}
+
 SimplifiedLowering::SimplifiedLowering(JSGraph* jsgraph, JSHeapBroker* broker,
                                        Zone* zone,
                                        SourcePositionTable* source_positions,
diff --git a/deps/v8/src/compiler/simplified-operator.cc b/deps/v8/src/compiler/simplified-operator.cc
index 2b1e0ab99e4..86dd9cb2de0 100644
--- a/deps/v8/src/compiler/simplified-operator.cc
+++ b/deps/v8/src/compiler/simplified-operator.cc
@@ -304,6 +304,8 @@ std::ostream& operator<<(std::ostream& os, CheckTaggedInputMode mode) {
   switch (mode) {
     case CheckTaggedInputMode::kNumber:
       return os << "Number";
+    case CheckTaggedInputMode::kNumberOrBoolean:
+      return os << "NumberOrBoolean";
     case CheckTaggedInputMode::kNumberOrOddball:
       return os << "NumberOrOddball";
   }
@@ -532,6 +534,8 @@ std::ostream& operator<<(std::ostream& os, NumberOperationHint hint) {
       return os << "Signed32";
     case NumberOperationHint::kNumber:
       return os << "Number";
+    case NumberOperationHint::kNumberOrBoolean:
+      return os << "NumberOrBoolean";
     case NumberOperationHint::kNumberOrOddball:
       return os << "NumberOrOddball";
   }
@@ -839,7 +843,6 @@ bool operator==(CheckMinusZeroParameters const& lhs,
   V(CheckedUint64ToTaggedSigned, 1, 1)
 
 #define CHECKED_BOUNDS_OP_LIST(V) \
-  V(CheckBounds)                  \
   V(CheckedUint32Bounds)          \
   V(CheckedUint64Bounds)
 
@@ -889,19 +892,26 @@ struct SimplifiedOperatorGlobalCache final {
   CHECKED_WITH_FEEDBACK_OP_LIST(CHECKED_WITH_FEEDBACK)
 #undef CHECKED_WITH_FEEDBACK
 
-#define CHECKED_BOUNDS(Name)                                                  \
-  struct Name##Operator final : public Operator1<CheckBoundsParameters> {     \
-    Name##Operator(FeedbackSource feedback, CheckBoundsParameters::Mode mode) \
-        : Operator1<CheckBoundsParameters>(                                   \
-              IrOpcode::k##Name, Operator::kFoldable | Operator::kNoThrow,    \
-              #Name, 2, 1, 1, 1, 1, 0,                                        \
-              CheckBoundsParameters(feedback, mode)) {}                       \
-  };                                                                          \
-  Name##Operator k##Name##Deopting = {                                        \
-      FeedbackSource(), CheckBoundsParameters::kDeoptOnOutOfBounds};          \
-  Name##Operator k##Name##Aborting = {                                        \
-      FeedbackSource(), CheckBoundsParameters::kAbortOnOutOfBounds};
+#define CHECKED_BOUNDS(Name)                                               \
+  struct Name##Operator final : public Operator1<CheckBoundsParameters> {  \
+    Name##Operator(FeedbackSource feedback, CheckBoundsFlags flags)        \
+        : Operator1<CheckBoundsParameters>(                                \
+              IrOpcode::k##Name, Operator::kFoldable | Operator::kNoThrow, \
+              #Name, 2, 1, 1, 1, 1, 0,                                     \
+              CheckBoundsParameters(feedback, flags)) {}                   \
+  };                                                                       \
+  Name##Operator k##Name = {FeedbackSource(), CheckBoundsFlags()};         \
+  Name##Operator k##Name##Aborting = {FeedbackSource(),                    \
+                                      CheckBoundsFlag::kAbortOnOutOfBounds};
   CHECKED_BOUNDS_OP_LIST(CHECKED_BOUNDS)
+  CHECKED_BOUNDS(CheckBounds)
+  // For IrOpcode::kCheckBounds, we allow additional flags:
+  CheckBoundsOperator kCheckBoundsConverting = {
+      FeedbackSource(), CheckBoundsFlag::kConvertStringAndMinusZero};
+  CheckBoundsOperator kCheckBoundsAbortingAndConverting = {
+      FeedbackSource(),
+      CheckBoundsFlags(CheckBoundsFlag::kAbortOnOutOfBounds) |
+          CheckBoundsFlags(CheckBoundsFlag::kConvertStringAndMinusZero)};
 #undef CHECKED_BOUNDS
 
   template <DeoptimizeReason kDeoptimizeReason>
@@ -1039,6 +1049,8 @@ struct SimplifiedOperatorGlobalCache final {
   };
   CheckedTaggedToFloat64Operator<CheckTaggedInputMode::kNumber>
       kCheckedTaggedToFloat64NumberOperator;
+  CheckedTaggedToFloat64Operator<CheckTaggedInputMode::kNumberOrBoolean>
+      kCheckedTaggedToFloat64NumberOrBooleanOperator;
   CheckedTaggedToFloat64Operator<CheckTaggedInputMode::kNumberOrOddball>
       kCheckedTaggedToFloat64NumberOrOddballOperator;
 
@@ -1151,6 +1163,8 @@ struct SimplifiedOperatorGlobalCache final {
       k##Name##NumberOrOddballOperator;
   SPECULATIVE_NUMBER_BINOP_LIST(SPECULATIVE_NUMBER_BINOP)
 #undef SPECULATIVE_NUMBER_BINOP
+  SpeculativeNumberEqualOperator<NumberOperationHint::kNumberOrBoolean>
+      kSpeculativeNumberEqualNumberOrBooleanOperator;
 
   template <NumberOperationHint kHint>
   struct SpeculativeToNumberOperator final
@@ -1206,23 +1220,45 @@ GET_FROM_CACHE(LoadFieldByIndex)
 CHECKED_WITH_FEEDBACK_OP_LIST(GET_FROM_CACHE_WITH_FEEDBACK)
 #undef GET_FROM_CACHE_WITH_FEEDBACK
 
-#define GET_FROM_CACHE_WITH_FEEDBACK(Name)                                \
-  const Operator* SimplifiedOperatorBuilder::Name(                        \
-      const FeedbackSource& feedback, CheckBoundsParameters::Mode mode) { \
-    if (!feedback.IsValid()) {                                            \
-      switch (mode) {                                                     \
-        case CheckBoundsParameters::kDeoptOnOutOfBounds:                  \
-          return &cache_.k##Name##Deopting;                               \
-        case CheckBoundsParameters::kAbortOnOutOfBounds:                  \
-          return &cache_.k##Name##Aborting;                               \
-      }                                                                   \
-    }                                                                     \
-    return new (zone())                                                   \
-        SimplifiedOperatorGlobalCache::Name##Operator(feedback, mode);    \
+#define GET_FROM_CACHE_WITH_FEEDBACK(Name)                              \
+  const Operator* SimplifiedOperatorBuilder::Name(                      \
+      const FeedbackSource& feedback, CheckBoundsFlags flags) {         \
+    DCHECK(!(flags & CheckBoundsFlag::kConvertStringAndMinusZero));     \
+    if (!feedback.IsValid()) {                                          \
+      if (flags & CheckBoundsFlag::kAbortOnOutOfBounds) {               \
+        return &cache_.k##Name##Aborting;                               \
+      } else {                                                          \
+        return &cache_.k##Name;                                         \
+      }                                                                 \
+    }                                                                   \
+    return new (zone())                                                 \
+        SimplifiedOperatorGlobalCache::Name##Operator(feedback, flags); \
   }
 CHECKED_BOUNDS_OP_LIST(GET_FROM_CACHE_WITH_FEEDBACK)
 #undef GET_FROM_CACHE_WITH_FEEDBACK
 
+// For IrOpcode::kCheckBounds, we allow additional flags:
+const Operator* SimplifiedOperatorBuilder::CheckBounds(
+    const FeedbackSource& feedback, CheckBoundsFlags flags) {
+  if (!feedback.IsValid()) {
+    if (flags & CheckBoundsFlag::kAbortOnOutOfBounds) {
+      if (flags & CheckBoundsFlag::kConvertStringAndMinusZero) {
+        return &cache_.kCheckBoundsAbortingAndConverting;
+      } else {
+        return &cache_.kCheckBoundsAborting;
+      }
+    } else {
+      if (flags & CheckBoundsFlag::kConvertStringAndMinusZero) {
+        return &cache_.kCheckBoundsConverting;
+      } else {
+        return &cache_.kCheckBounds;
+      }
+    }
+  }
+  return new (zone())
+      SimplifiedOperatorGlobalCache::CheckBoundsOperator(feedback, flags);
+}
+
 bool IsCheckedWithFeedback(const Operator* op) {
 #define CASE(Name, ...) case IrOpcode::k##Name:
   switch (op->opcode()) {
@@ -1374,6 +1410,8 @@ const Operator* SimplifiedOperatorBuilder::CheckedTaggedToFloat64(
     switch (mode) {
       case CheckTaggedInputMode::kNumber:
         return &cache_.kCheckedTaggedToFloat64NumberOperator;
+      case CheckTaggedInputMode::kNumberOrBoolean:
+        return &cache_.kCheckedTaggedToFloat64NumberOrBooleanOperator;
       case CheckTaggedInputMode::kNumberOrOddball:
         return &cache_.kCheckedTaggedToFloat64NumberOrOddballOperator;
     }
@@ -1390,6 +1428,9 @@ const Operator* SimplifiedOperatorBuilder::CheckedTruncateTaggedToWord32(
     switch (mode) {
       case CheckTaggedInputMode::kNumber:
         return &cache_.kCheckedTruncateTaggedToWord32NumberOperator;
+      case CheckTaggedInputMode::kNumberOrBoolean:
+        // Not used currently.
+        UNREACHABLE();
       case CheckTaggedInputMode::kNumberOrOddball:
         return &cache_.kCheckedTruncateTaggedToWord32NumberOrOddballOperator;
     }
@@ -1513,6 +1554,9 @@ const Operator* SimplifiedOperatorBuilder::SpeculativeToNumber(
         return &cache_.kSpeculativeToNumberSigned32Operator;
       case NumberOperationHint::kNumber:
         return &cache_.kSpeculativeToNumberNumberOperator;
+      case NumberOperationHint::kNumberOrBoolean:
+        // Not used currently.
+        UNREACHABLE();
       case NumberOperationHint::kNumberOrOddball:
         return &cache_.kSpeculativeToNumberNumberOrOddballOperator;
     }
@@ -1628,23 +1672,15 @@ CheckParameters const& CheckParametersOf(Operator const* op) {
 bool operator==(CheckBoundsParameters const& lhs,
                 CheckBoundsParameters const& rhs) {
   return lhs.check_parameters() == rhs.check_parameters() &&
-         lhs.mode() == rhs.mode();
+         lhs.flags() == rhs.flags();
 }
 
 size_t hash_value(CheckBoundsParameters const& p) {
-  return base::hash_combine(hash_value(p.check_parameters()), p.mode());
+  return base::hash_combine(hash_value(p.check_parameters()), p.flags());
 }
 
 std::ostream& operator<<(std::ostream& os, CheckBoundsParameters const& p) {
-  os << p.check_parameters() << ", ";
-  switch (p.mode()) {
-    case CheckBoundsParameters::kDeoptOnOutOfBounds:
-      os << "deopt";
-      break;
-    case CheckBoundsParameters::kAbortOnOutOfBounds:
-      os << "abort";
-      break;
-  }
+  os << p.check_parameters() << ", " << p.flags();
   return os;
 }
 
@@ -1758,14 +1794,38 @@ const Operator* SimplifiedOperatorBuilder::AllocateRaw(
         return &cache_.k##Name##Signed32Operator;                             \
       case NumberOperationHint::kNumber:                                      \
         return &cache_.k##Name##NumberOperator;                               \
+      case NumberOperationHint::kNumberOrBoolean:                             \
+        /* Not used currenly. */                                              \
+        UNREACHABLE();                                                        \
       case NumberOperationHint::kNumberOrOddball:                             \
         return &cache_.k##Name##NumberOrOddballOperator;                      \
     }                                                                         \
     UNREACHABLE();                                                            \
     return nullptr;                                                           \
   }
-SPECULATIVE_NUMBER_BINOP_LIST(SPECULATIVE_NUMBER_BINOP)
+SIMPLIFIED_SPECULATIVE_NUMBER_BINOP_LIST(SPECULATIVE_NUMBER_BINOP)
+SPECULATIVE_NUMBER_BINOP(SpeculativeNumberLessThan)
+SPECULATIVE_NUMBER_BINOP(SpeculativeNumberLessThanOrEqual)
 #undef SPECULATIVE_NUMBER_BINOP
+const Operator* SimplifiedOperatorBuilder::SpeculativeNumberEqual(
+    NumberOperationHint hint) {
+  switch (hint) {
+    case NumberOperationHint::kSignedSmall:
+      return &cache_.kSpeculativeNumberEqualSignedSmallOperator;
+    case NumberOperationHint::kSignedSmallInputs:
+      return &cache_.kSpeculativeNumberEqualSignedSmallInputsOperator;
+    case NumberOperationHint::kSigned32:
+      return &cache_.kSpeculativeNumberEqualSigned32Operator;
+    case NumberOperationHint::kNumber:
+      return &cache_.kSpeculativeNumberEqualNumberOperator;
+    case NumberOperationHint::kNumberOrBoolean:
+      return &cache_.kSpeculativeNumberEqualNumberOrBooleanOperator;
+    case NumberOperationHint::kNumberOrOddball:
+      return &cache_.kSpeculativeNumberEqualNumberOrOddballOperator;
+  }
+  UNREACHABLE();
+  return nullptr;
+}
 
 #define ACCESS_OP_LIST(V)                                                \
   V(LoadField, FieldAccess, Operator::kNoWrite, 1, 1, 1)                 \
diff --git a/deps/v8/src/compiler/simplified-operator.h b/deps/v8/src/compiler/simplified-operator.h
index 251bb43678c..649aea0d0b9 100644
--- a/deps/v8/src/compiler/simplified-operator.h
+++ b/deps/v8/src/compiler/simplified-operator.h
@@ -220,19 +220,24 @@ std::ostream& operator<<(std::ostream&, CheckParameters const&);
 
 CheckParameters const& CheckParametersOf(Operator const*) V8_WARN_UNUSED_RESULT;
 
+enum class CheckBoundsFlag : uint8_t {
+  kConvertStringAndMinusZero = 1 << 0,  // instead of deopting on such inputs
+  kAbortOnOutOfBounds = 1 << 1,         // instead of deopting if input is OOB
+};
+using CheckBoundsFlags = base::Flags<CheckBoundsFlag>;
+DEFINE_OPERATORS_FOR_FLAGS(CheckBoundsFlags)
+
 class CheckBoundsParameters final {
  public:
-  enum Mode { kAbortOnOutOfBounds, kDeoptOnOutOfBounds };
+  CheckBoundsParameters(const FeedbackSource& feedback, CheckBoundsFlags flags)
+      : check_parameters_(feedback), flags_(flags) {}
 
-  CheckBoundsParameters(const FeedbackSource& feedback, Mode mode)
-      : check_parameters_(feedback), mode_(mode) {}
-
-  Mode mode() const { return mode_; }
+  CheckBoundsFlags flags() const { return flags_; }
   const CheckParameters& check_parameters() const { return check_parameters_; }
 
  private:
   CheckParameters check_parameters_;
-  Mode mode_;
+  CheckBoundsFlags flags_;
 };
 
 bool operator==(CheckBoundsParameters const&, CheckBoundsParameters const&);
@@ -307,6 +312,7 @@ Handle<FeedbackCell> FeedbackCellOf(const Operator* op);
 
 enum class CheckTaggedInputMode : uint8_t {
   kNumber,
+  kNumberOrBoolean,
   kNumberOrOddball,
 };
 
@@ -377,10 +383,9 @@ size_t hash_value(const CheckMinusZeroParameters& params);
 bool operator==(CheckMinusZeroParameters const&,
                 CheckMinusZeroParameters const&);
 
-// Flags for map checks.
 enum class CheckMapsFlag : uint8_t {
   kNone = 0u,
-  kTryMigrateInstance = 1u << 0,  // Try instance migration.
+  kTryMigrateInstance = 1u << 0,
 };
 using CheckMapsFlags = base::Flags<CheckMapsFlag>;
 
@@ -503,6 +508,7 @@ enum class NumberOperationHint : uint8_t {
   kSignedSmallInputs,  // Inputs were Smi, output was Number.
   kSigned32,           // Inputs were Signed32, output was Number.
   kNumber,             // Inputs were Number, output was Number.
+  kNumberOrBoolean,    // Inputs were Number or Boolean, output was Number.
   kNumberOrOddball,    // Inputs were Number or Oddball, output was Number.
 };
 
@@ -784,12 +790,11 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* MapGuard(ZoneHandleSet<Map> maps);
 
   const Operator* CheckBounds(const FeedbackSource& feedback,
-                              CheckBoundsParameters::Mode mode =
-                                  CheckBoundsParameters::kDeoptOnOutOfBounds);
+                              CheckBoundsFlags flags = {});
   const Operator* CheckedUint32Bounds(const FeedbackSource& feedback,
-                                      CheckBoundsParameters::Mode mode);
+                                      CheckBoundsFlags flags);
   const Operator* CheckedUint64Bounds(const FeedbackSource& feedback,
-                                      CheckBoundsParameters::Mode mode);
+                                      CheckBoundsFlags flags);
 
   const Operator* CheckClosure(const Handle<FeedbackCell>& feedback_cell);
   const Operator* CheckEqualsInternalizedString();
diff --git a/deps/v8/src/compiler/typed-optimization.cc b/deps/v8/src/compiler/typed-optimization.cc
index 50e2a640f63..c8c422f66bf 100644
--- a/deps/v8/src/compiler/typed-optimization.cc
+++ b/deps/v8/src/compiler/typed-optimization.cc
@@ -38,8 +38,12 @@ Reduction TypedOptimization::Reduce(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kConvertReceiver:
       return ReduceConvertReceiver(node);
+    case IrOpcode::kMaybeGrowFastElements:
+      return ReduceMaybeGrowFastElements(node);
     case IrOpcode::kCheckHeapObject:
       return ReduceCheckHeapObject(node);
+    case IrOpcode::kCheckBounds:
+      return ReduceCheckBounds(node);
     case IrOpcode::kCheckNotTaggedHole:
       return ReduceCheckNotTaggedHole(node);
     case IrOpcode::kCheckMaps:
@@ -159,6 +163,48 @@ Reduction TypedOptimization::ReduceCheckHeapObject(Node* node) {
   return NoChange();
 }
 
+Reduction TypedOptimization::ReduceMaybeGrowFastElements(Node* node) {
+  Node* const elements = NodeProperties::GetValueInput(node, 1);
+  Node* const index = NodeProperties::GetValueInput(node, 2);
+  Node* const length = NodeProperties::GetValueInput(node, 3);
+  Node* const effect = NodeProperties::GetEffectInput(node);
+  Node* const control = NodeProperties::GetControlInput(node);
+
+  Type const index_type = NodeProperties::GetType(index);
+  Type const length_type = NodeProperties::GetType(length);
+  CHECK(index_type.Is(Type::Unsigned31()));
+  CHECK(length_type.Is(Type::Unsigned31()));
+
+  if (!index_type.IsNone() && !length_type.IsNone() &&
+      index_type.Max() < length_type.Min()) {
+    Node* check_bounds = graph()->NewNode(
+        simplified()->CheckBounds(FeedbackSource{},
+                                  CheckBoundsFlag::kAbortOnOutOfBounds),
+        index, length, effect, control);
+    ReplaceWithValue(node, elements);
+    return Replace(check_bounds);
+  }
+
+  return NoChange();
+}
+
+Reduction TypedOptimization::ReduceCheckBounds(Node* node) {
+  CheckBoundsParameters const& p = CheckBoundsParametersOf(node->op());
+  Node* const input = NodeProperties::GetValueInput(node, 0);
+  Type const input_type = NodeProperties::GetType(input);
+  if (p.flags() & CheckBoundsFlag::kConvertStringAndMinusZero &&
+      !input_type.Maybe(Type::String()) &&
+      !input_type.Maybe(Type::MinusZero())) {
+    NodeProperties::ChangeOp(
+        node,
+        simplified()->CheckBounds(
+            p.check_parameters().feedback(),
+            p.flags().without(CheckBoundsFlag::kConvertStringAndMinusZero)));
+    return Changed(node);
+  }
+  return NoChange();
+}
+
 Reduction TypedOptimization::ReduceCheckNotTaggedHole(Node* node) {
   Node* const input = NodeProperties::GetValueInput(node, 0);
   Type const input_type = NodeProperties::GetType(input);
@@ -285,7 +331,7 @@ Reduction TypedOptimization::ReduceNumberFloor(Node* node) {
       //   NumberToUint32(NumberDivide(lhs, rhs))
       //
       // and just smash the type [0...lhs.Max] on the {node},
-      // as the truncated result must be loewr than {lhs}'s maximum
+      // as the truncated result must be lower than {lhs}'s maximum
       // value (note that {rhs} cannot be less than 1 due to the
       // plain-number type constraint on the {node}).
       NodeProperties::ChangeOp(node, simplified()->NumberToUint32());
diff --git a/deps/v8/src/compiler/typed-optimization.h b/deps/v8/src/compiler/typed-optimization.h
index 58efff918f1..336c29540d2 100644
--- a/deps/v8/src/compiler/typed-optimization.h
+++ b/deps/v8/src/compiler/typed-optimization.h
@@ -37,6 +37,8 @@ class V8_EXPORT_PRIVATE TypedOptimization final
 
  private:
   Reduction ReduceConvertReceiver(Node* node);
+  Reduction ReduceMaybeGrowFastElements(Node* node);
+  Reduction ReduceCheckBounds(Node* node);
   Reduction ReduceCheckHeapObject(Node* node);
   Reduction ReduceCheckMaps(Node* node);
   Reduction ReduceCheckNumber(Node* node);
diff --git a/deps/v8/src/compiler/types.cc b/deps/v8/src/compiler/types.cc
index 08e6e8023d6..4f0948903a3 100644
--- a/deps/v8/src/compiler/types.cc
+++ b/deps/v8/src/compiler/types.cc
@@ -240,16 +240,17 @@ Type::bitset BitsetType::Lub(const MapRefLike& map) {
     case JS_STRING_ITERATOR_TYPE:
     case JS_ASYNC_FROM_SYNC_ITERATOR_TYPE:
     case JS_FINALIZATION_REGISTRY_TYPE:
-    case JS_FINALIZATION_REGISTRY_CLEANUP_ITERATOR_TYPE:
     case JS_WEAK_MAP_TYPE:
     case JS_WEAK_REF_TYPE:
     case JS_WEAK_SET_TYPE:
     case JS_PROMISE_TYPE:
+    case WASM_ARRAY_TYPE:
     case WASM_EXCEPTION_OBJECT_TYPE:
     case WASM_GLOBAL_OBJECT_TYPE:
     case WASM_INSTANCE_OBJECT_TYPE:
     case WASM_MEMORY_OBJECT_TYPE:
     case WASM_MODULE_OBJECT_TYPE:
+    case WASM_STRUCT_TYPE:
     case WASM_TABLE_OBJECT_TYPE:
     case WEAK_CELL_TYPE:
       DCHECK(!map.is_callable());
@@ -351,6 +352,7 @@ Type::bitset BitsetType::Lub(const MapRefLike& map) {
     case TUPLE2_TYPE:
     case BREAK_POINT_TYPE:
     case BREAK_POINT_INFO_TYPE:
+    case WASM_VALUE_TYPE:
     case CACHED_TEMPLATE_OBJECT_TYPE:
     case ENUM_CACHE_TYPE:
     case WASM_CAPI_FUNCTION_DATA_TYPE:
@@ -368,8 +370,8 @@ Type::bitset BitsetType::Lub(const MapRefLike& map) {
     case PROMISE_FULFILL_REACTION_JOB_TASK_TYPE:
     case PROMISE_REJECT_REACTION_JOB_TASK_TYPE:
     case PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE:
-#define MAKE_TORQUE_CLASS_TYPE(V) case V:
-      TORQUE_INSTANCE_TYPES(MAKE_TORQUE_CLASS_TYPE)
+#define MAKE_TORQUE_CLASS_TYPE(INSTANCE_TYPE, Name, name) case INSTANCE_TYPE:
+      TORQUE_INTERNAL_INSTANCE_TYPE_LIST(MAKE_TORQUE_CLASS_TYPE)
 #undef MAKE_TORQUE_CLASS_TYPE
       UNREACHABLE();
   }
diff --git a/deps/v8/src/compiler/types.h b/deps/v8/src/compiler/types.h
index fb1fa37d9d5..49775a38567 100644
--- a/deps/v8/src/compiler/types.h
+++ b/deps/v8/src/compiler/types.h
@@ -112,7 +112,7 @@ namespace compiler {
   V(Null,                     1u << 7)   \
   V(Undefined,                1u << 8)   \
   V(Boolean,                  1u << 9)   \
-  V(Unsigned30,               1u << 10)   \
+  V(Unsigned30,               1u << 10)  \
   V(MinusZero,                1u << 11)  \
   V(NaN,                      1u << 12)  \
   V(Symbol,                   1u << 13)  \
@@ -129,6 +129,9 @@ namespace compiler {
   V(ExternalPointer,          1u << 25)  \
   V(Array,                    1u << 26)  \
   V(BigInt,                   1u << 27)  \
+  /* TODO(v8:10391): Remove this type once all ExternalPointer usages are */ \
+  /* sandbox-ready. */                   \
+  V(SandboxedExternalPointer, 1u << 28)  \
   \
   V(Signed31,                     kUnsigned30 | kNegative31) \
   V(Signed32,                     kSigned31 | kOtherUnsigned31 | \
@@ -192,7 +195,8 @@ namespace compiler {
   V(StringOrReceiver,             kString | kReceiver) \
   V(Unique,                       kBoolean | kUniqueName | kNull | \
                                   kUndefined | kHole | kReceiver) \
-  V(Internal,                     kHole | kExternalPointer | kOtherInternal) \
+  V(Internal,                     kHole | kExternalPointer | \
+                                  kSandboxedExternalPointer | kOtherInternal) \
   V(NonInternal,                  kPrimitive | kReceiver) \
   V(NonBigInt,                    kNonBigIntPrimitive | kReceiver) \
   V(NonNumber,                    kBigInt | kUnique | kString | kInternal) \
diff --git a/deps/v8/src/compiler/verifier.cc b/deps/v8/src/compiler/verifier.cc
index 1be87c94635..de560da00c8 100644
--- a/deps/v8/src/compiler/verifier.cc
+++ b/deps/v8/src/compiler/verifier.cc
@@ -1623,6 +1623,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kWord32Shl:
     case IrOpcode::kWord32Shr:
     case IrOpcode::kWord32Sar:
+    case IrOpcode::kWord32Rol:
     case IrOpcode::kWord32Ror:
     case IrOpcode::kWord32Equal:
     case IrOpcode::kWord32Clz:
@@ -1637,6 +1638,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kWord64Shl:
     case IrOpcode::kWord64Shr:
     case IrOpcode::kWord64Sar:
+    case IrOpcode::kWord64Rol:
     case IrOpcode::kWord64Ror:
     case IrOpcode::kWord64Clz:
     case IrOpcode::kWord64Popcnt:
diff --git a/deps/v8/src/compiler/wasm-compiler.cc b/deps/v8/src/compiler/wasm-compiler.cc
index 9373a2b4b91..a2d4d2e12ab 100644
--- a/deps/v8/src/compiler/wasm-compiler.cc
+++ b/deps/v8/src/compiler/wasm-compiler.cc
@@ -11,7 +11,6 @@
 #include "src/base/platform/platform.h"
 #include "src/base/small-vector.h"
 #include "src/base/v8-fallthrough.h"
-#include "src/builtins/builtins.h"
 #include "src/codegen/assembler-inl.h"
 #include "src/codegen/assembler.h"
 #include "src/codegen/code-factory.h"
@@ -40,6 +39,7 @@
 #include "src/logging/counters.h"
 #include "src/logging/log.h"
 #include "src/objects/heap-number.h"
+#include "src/roots/roots.h"
 #include "src/tracing/trace-event.h"
 #include "src/trap-handler/trap-handler.h"
 #include "src/utils/vector.h"
@@ -50,6 +50,7 @@
 #include "src/wasm/memory-tracing.h"
 #include "src/wasm/object-access.h"
 #include "src/wasm/wasm-code-manager.h"
+#include "src/wasm/wasm-constants.h"
 #include "src/wasm/wasm-limits.h"
 #include "src/wasm/wasm-linkage.h"
 #include "src/wasm/wasm-module.h"
@@ -78,6 +79,17 @@ MachineType assert_size(int expected_size, MachineType type) {
 #define WASM_INSTANCE_OBJECT_OFFSET(name) \
   wasm::ObjectAccess::ToTagged(WasmInstanceObject::k##name##Offset)
 
+// We would like to use gasm_->Call() to implement this macro,
+// but this doesn't work currently when we try to call it from functions
+// which set IfSuccess/IfFailure control paths (e.g. within Throw()).
+// TODO(manoskouk): Maybe clean this up at some point?
+#define CALL_BUILTIN(name, ...)                                             \
+  SetEffect(graph()->NewNode(                                               \
+      mcgraph()->common()->Call(GetBuiltinCallDescriptor<name##Descriptor>( \
+          this, StubCallMode::kCallBuiltinPointer)),                        \
+      GetBuiltinPointerTarget(Builtins::k##name), ##__VA_ARGS__, effect(),  \
+      control()))
+
 #define LOAD_INSTANCE_FIELD(name, type)                           \
   gasm_->Load(assert_size(WASM_INSTANCE_OBJECT_SIZE(name), type), \
               instance_node_.get(), WASM_INSTANCE_OBJECT_OFFSET(name))
@@ -144,6 +156,19 @@ bool ContainsInt64(const wasm::FunctionSig* sig) {
   }
   return false;
 }
+
+template <typename BuiltinDescriptor>
+CallDescriptor* GetBuiltinCallDescriptor(WasmGraphBuilder* builder,
+                                         StubCallMode stub_mode) {
+  BuiltinDescriptor interface_descriptor;
+  return Linkage::GetStubCallDescriptor(
+      builder->mcgraph()->zone(),                     // zone
+      interface_descriptor,                           // descriptor
+      interface_descriptor.GetStackParameterCount(),  // stack parameter count
+      CallDescriptor::kNoFlags,                       // flags
+      Operator::kNoProperties,                        // properties
+      stub_mode);                                     // stub call mode
+}
 }  // namespace
 
 class WasmGraphAssembler : public GraphAssembler {
@@ -256,17 +281,29 @@ Node* WasmGraphBuilder::EffectPhi(unsigned count, Node** effects_and_control) {
 }
 
 Node* WasmGraphBuilder::RefNull() {
-  Node* isolate_root = BuildLoadIsolateRoot();
   return LOAD_FULL_POINTER(
-      isolate_root, IsolateData::root_slot_offset(RootIndex::kNullValue));
+      BuildLoadIsolateRoot(),
+      IsolateData::root_slot_offset(RootIndex::kNullValue));
 }
 
 Node* WasmGraphBuilder::RefFunc(uint32_t function_index) {
-  Node* args[] = {
-      graph()->NewNode(mcgraph()->common()->NumberConstant(function_index))};
-  Node* result =
-      BuildCallToRuntime(Runtime::kWasmRefFunc, args, arraysize(args));
-  return result;
+  auto call_descriptor = GetBuiltinCallDescriptor<WasmRefFuncDescriptor>(
+      this, StubCallMode::kCallWasmRuntimeStub);
+  // A direct call to a wasm runtime stub defined in this module.
+  // Just encode the stub index. This will be patched at relocation.
+  Node* call_target = mcgraph()->RelocatableIntPtrConstant(
+      wasm::WasmCode::kWasmRefFunc, RelocInfo::WASM_STUB_CALL);
+
+  return SetEffectControl(
+      graph()->NewNode(mcgraph()->common()->Call(call_descriptor), call_target,
+                       Uint32Constant(function_index), effect(), control()));
+}
+
+Node* WasmGraphBuilder::RefAsNonNull(Node* arg,
+                                     wasm::WasmCodePosition position) {
+  TrapIfTrue(wasm::kTrapIllegalCast, gasm_->WordEqual(arg, RefNull()),
+             position);
+  return arg;
 }
 
 Node* WasmGraphBuilder::NoContextConstant() {
@@ -414,7 +451,11 @@ Node* WasmGraphBuilder::Binop(wasm::WasmOpcode opcode, Node* left, Node* right,
       right = MaskShiftCount32(right);
       break;
     case wasm::kExprI32Rol:
-      right = MaskShiftCount32(right);
+      if (m->Word32Rol().IsSupported()) {
+        op = m->Word32Rol().op();
+        right = MaskShiftCount32(right);
+        break;
+      }
       return BuildI32Rol(left, right);
     case wasm::kExprI32Eq:
       op = m->Word32Equal();
@@ -525,6 +566,14 @@ Node* WasmGraphBuilder::Binop(wasm::WasmOpcode opcode, Node* left, Node* right,
       right = MaskShiftCount64(right);
       break;
     case wasm::kExprI64Rol:
+      if (m->Word64Rol().IsSupported()) {
+        op = m->Word64Rol().op();
+        right = MaskShiftCount64(right);
+        break;
+      } else if (m->Word32Rol().IsSupported()) {
+        op = m->Word64Rol().placeholder();
+        break;
+      }
       return BuildI64Rol(left, right);
     case wasm::kExprF32CopySign:
       return BuildF32CopySign(left, right);
@@ -611,6 +660,8 @@ Node* WasmGraphBuilder::Binop(wasm::WasmOpcode opcode, Node* left, Node* right,
       break;
     case wasm::kExprF64Mod:
       return BuildF64Mod(left, right);
+    case wasm::kExprRefEq:
+      return gasm_->TaggedEqual(left, right);
     case wasm::kExprI32AsmjsDivS:
       return BuildI32AsmjsDivS(left, right);
     case wasm::kExprI32AsmjsDivU:
@@ -1073,8 +1124,9 @@ Node* WasmGraphBuilder::Return(Vector<Node*> vals) {
   return ret;
 }
 
-Node* WasmGraphBuilder::Unreachable(wasm::WasmCodePosition position) {
-  TrapIfFalse(wasm::TrapReason::kTrapUnreachable, Int32Constant(0), position);
+Node* WasmGraphBuilder::Trap(wasm::TrapReason reason,
+                             wasm::WasmCodePosition position) {
+  TrapIfFalse(reason, Int32Constant(0), position);
   Return(Vector<Node*>{});
   return nullptr;
 }
@@ -1111,8 +1163,9 @@ Node* WasmGraphBuilder::MaskShiftCount64(Node* node) {
   return node;
 }
 
-static bool ReverseBytesSupported(MachineOperatorBuilder* m,
-                                  size_t size_in_bytes) {
+namespace {
+
+bool ReverseBytesSupported(MachineOperatorBuilder* m, size_t size_in_bytes) {
   switch (size_in_bytes) {
     case 4:
     case 16:
@@ -1125,6 +1178,8 @@ static bool ReverseBytesSupported(MachineOperatorBuilder* m,
   return false;
 }
 
+}  // namespace
+
 Node* WasmGraphBuilder::BuildChangeEndiannessStore(
     Node* node, MachineRepresentation mem_rep, wasm::ValueType wasmtype) {
   Node* result;
@@ -2017,8 +2072,12 @@ Node* WasmGraphBuilder::Throw(uint32_t exception_index,
       BuildCallToRuntime(Runtime::kWasmThrowCreate, create_parameters,
                          arraysize(create_parameters));
   SetSourcePosition(except_obj, position);
-  Node* values_array =
-      BuildCallToRuntime(Runtime::kWasmExceptionGetValues, &except_obj, 1);
+  Node* values_array = CALL_BUILTIN(
+      WasmGetOwnProperty, except_obj,
+      LOAD_FULL_POINTER(BuildLoadIsolateRoot(),
+                        IsolateData::root_slot_offset(
+                            RootIndex::kwasm_exception_values_symbol)),
+      LOAD_INSTANCE_FIELD(NativeContext, MachineType::TaggedPointer()));
   uint32_t index = 0;
   const wasm::WasmExceptionSig* sig = exception->sig;
   MachineOperatorBuilder* m = mcgraph()->machine();
@@ -2061,9 +2120,14 @@ Node* WasmGraphBuilder::Throw(uint32_t exception_index,
       case wasm::ValueType::kFuncRef:
       case wasm::ValueType::kNullRef:
       case wasm::ValueType::kExnRef:
+      case wasm::ValueType::kRef:
+      case wasm::ValueType::kOptRef:
+      case wasm::ValueType::kEqRef:
         STORE_FIXED_ARRAY_SLOT_ANY(values_array, index, value);
         ++index;
         break;
+      case wasm::ValueType::kI8:
+      case wasm::ValueType::kI16:
       case wasm::ValueType::kStmt:
       case wasm::ValueType::kBottom:
         UNREACHABLE();
@@ -2154,14 +2218,23 @@ Node* WasmGraphBuilder::GetExceptionTag(Node* except_obj,
                                         wasm::WasmCodePosition position) {
   TrapIfTrue(wasm::kTrapBrOnExnNullRef, gasm_->WordEqual(RefNull(), except_obj),
              position);
-  return BuildCallToRuntime(Runtime::kWasmExceptionGetTag, &except_obj, 1);
+  return CALL_BUILTIN(
+      WasmGetOwnProperty, except_obj,
+      LOAD_FULL_POINTER(
+          BuildLoadIsolateRoot(),
+          IsolateData::root_slot_offset(RootIndex::kwasm_exception_tag_symbol)),
+      LOAD_INSTANCE_FIELD(NativeContext, MachineType::TaggedPointer()));
 }
 
 Node* WasmGraphBuilder::GetExceptionValues(Node* except_obj,
                                            const wasm::WasmException* exception,
                                            Vector<Node*> values) {
-  Node* values_array =
-      BuildCallToRuntime(Runtime::kWasmExceptionGetValues, &except_obj, 1);
+  Node* values_array = CALL_BUILTIN(
+      WasmGetOwnProperty, except_obj,
+      LOAD_FULL_POINTER(BuildLoadIsolateRoot(),
+                        IsolateData::root_slot_offset(
+                            RootIndex::kwasm_exception_values_symbol)),
+      LOAD_INSTANCE_FIELD(NativeContext, MachineType::TaggedPointer()));
   uint32_t index = 0;
   const wasm::WasmExceptionSig* sig = exception->sig;
   DCHECK_EQ(sig->parameter_count(), values.size());
@@ -2202,9 +2275,14 @@ Node* WasmGraphBuilder::GetExceptionValues(Node* except_obj,
       case wasm::ValueType::kFuncRef:
       case wasm::ValueType::kNullRef:
       case wasm::ValueType::kExnRef:
+      case wasm::ValueType::kRef:
+      case wasm::ValueType::kOptRef:
+      case wasm::ValueType::kEqRef:
         value = LOAD_FIXED_ARRAY_SLOT_ANY(values_array, index);
         ++index;
         break;
+      case wasm::ValueType::kI8:
+      case wasm::ValueType::kI16:
       case wasm::ValueType::kStmt:
       case wasm::ValueType::kBottom:
         UNREACHABLE();
@@ -2504,6 +2582,11 @@ Node* WasmGraphBuilder::BuildI64RemU(Node* left, Node* right,
                           ZeroCheck64(wasm::kTrapRemByZero, right, position));
 }
 
+Node* WasmGraphBuilder::GetBuiltinPointerTarget(int builtin_id) {
+  static_assert(std::is_same<Smi, BuiltinPtr>(), "BuiltinPtr must be Smi");
+  return graph()->NewNode(mcgraph()->common()->NumberConstant(builtin_id));
+}
+
 Node* WasmGraphBuilder::BuildDiv64Call(Node* left, Node* right,
                                        ExternalReference ref,
                                        MachineType result_type,
@@ -2779,7 +2862,7 @@ Node* WasmGraphBuilder::BuildIndirectCall(uint32_t table_index,
   LoadIndirectFunctionTable(table_index, &ift_size, &ift_sig_ids, &ift_targets,
                             &ift_instances);
 
-  const wasm::FunctionSig* sig = env_->module->signatures[sig_index];
+  const wasm::FunctionSig* sig = env_->module->signature(sig_index);
 
   MachineOperatorBuilder* machine = mcgraph()->machine();
   Node* key = args[0];
@@ -2882,6 +2965,15 @@ Node* WasmGraphBuilder::ReturnCallIndirect(uint32_t table_index,
                            kReturnCall);
 }
 
+Node* WasmGraphBuilder::BrOnNull(Node* ref_object, Node** null_node,
+                                 Node** non_null_node) {
+  BranchExpectFalse(gasm_->WordEqual(ref_object, RefNull()), null_node,
+                    non_null_node);
+  // Return value is not used, but we need it for compatibility
+  // with graph-builder-interface.
+  return nullptr;
+}
+
 Node* WasmGraphBuilder::BuildI32Rol(Node* left, Node* right) {
   // Implement Rol by Ror since TurboFan does not have Rol opcode.
   // TODO(weiliang): support Word32Rol opcode in TurboFan.
@@ -2910,19 +3002,6 @@ Node* WasmGraphBuilder::Invert(Node* node) {
   return Unop(wasm::kExprI32Eqz, node);
 }
 
-bool CanCover(Node* value, IrOpcode::Value opcode) {
-  if (value->opcode() != opcode) return false;
-  bool first = true;
-  for (Edge const edge : value->use_edges()) {
-    if (NodeProperties::IsControlEdge(edge)) continue;
-    if (NodeProperties::IsEffectEdge(edge)) continue;
-    DCHECK(NodeProperties::IsValueEdge(edge));
-    if (!first) return false;
-    first = false;
-  }
-  return true;
-}
-
 Node* WasmGraphBuilder::BuildTruncateIntPtrToInt32(Node* value) {
   if (mcgraph()->machine()->Is64()) {
     value =
@@ -3342,73 +3421,10 @@ Node* WasmGraphBuilder::GlobalSet(uint32_t index, Node* val) {
       graph()->NewNode(op, base, offset, val, effect(), control()));
 }
 
-void WasmGraphBuilder::BoundsCheckTable(uint32_t table_index, Node* entry_index,
-                                        wasm::WasmCodePosition position,
-                                        wasm::TrapReason trap_reason,
-                                        Node** base_node) {
-  Node* tables = LOAD_INSTANCE_FIELD(Tables, MachineType::TaggedPointer());
-  Node* table = LOAD_FIXED_ARRAY_SLOT_ANY(tables, table_index);
-
-  int length_field_size = WasmTableObject::kCurrentLengthOffsetEnd -
-                          WasmTableObject::kCurrentLengthOffset + 1;
-  Node* length_smi = gasm_->Load(
-      assert_size(length_field_size, MachineType::TaggedSigned()), table,
-      wasm::ObjectAccess::ToTagged(WasmTableObject::kCurrentLengthOffset));
-  Node* length = BuildChangeSmiToInt32(length_smi);
-
-  // Bounds check against the table size.
-  Node* in_bounds = graph()->NewNode(mcgraph()->machine()->Uint32LessThan(),
-                                     entry_index, length);
-  TrapIfFalse(trap_reason, in_bounds, position);
-
-  if (base_node) {
-    int storage_field_size = WasmTableObject::kEntriesOffsetEnd -
-                             WasmTableObject::kEntriesOffset + 1;
-    *base_node = gasm_->Load(
-        assert_size(storage_field_size, MachineType::TaggedPointer()), table,
-        wasm::ObjectAccess::ToTagged(WasmTableObject::kEntriesOffset));
-  }
-}
-
-void WasmGraphBuilder::GetTableBaseAndOffset(uint32_t table_index,
-                                             Node* entry_index,
-                                             wasm::WasmCodePosition position,
-                                             Node** base_node,
-                                             Node** offset_node) {
-  BoundsCheckTable(table_index, entry_index, position,
-                   wasm::kTrapTableOutOfBounds, base_node);
-  // From the index, calculate the actual offset in the FixeArray. This
-  // is kHeaderSize + (index * kTaggedSize). kHeaderSize can be acquired with
-  // wasm::ObjectAccess::ElementOffsetInTaggedFixedArray(0).
-  Node* index_times_tagged_size = graph()->NewNode(
-      mcgraph()->machine()->IntMul(), Uint32ToUintptr(entry_index),
-      mcgraph()->Int32Constant(kTaggedSize));
-
-  *offset_node = graph()->NewNode(
-      mcgraph()->machine()->IntAdd(), index_times_tagged_size,
-      mcgraph()->IntPtrConstant(
-          wasm::ObjectAccess::ElementOffsetInTaggedFixedArray(0)));
-}
-
 Node* WasmGraphBuilder::TableGet(uint32_t table_index, Node* index,
                                  wasm::WasmCodePosition position) {
-  if (env_->module->tables[table_index].type == wasm::kWasmAnyRef ||
-      env_->module->tables[table_index].type == wasm::kWasmNullRef ||
-      env_->module->tables[table_index].type == wasm::kWasmExnRef) {
-    Node* base = nullptr;
-    Node* offset = nullptr;
-    GetTableBaseAndOffset(table_index, index, position, &base, &offset);
-    return gasm_->Load(MachineType::AnyTagged(), base, offset);
-  }
-  // We access funcref tables through runtime calls.
-  WasmTableGetDescriptor interface_descriptor;
-  auto call_descriptor = Linkage::GetStubCallDescriptor(
-      mcgraph()->zone(),                              // zone
-      interface_descriptor,                           // descriptor
-      interface_descriptor.GetStackParameterCount(),  // stack parameter count
-      CallDescriptor::kNoFlags,                       // flags
-      Operator::kNoProperties,                        // properties
-      StubCallMode::kCallWasmRuntimeStub);            // stub call mode
+  auto call_descriptor = GetBuiltinCallDescriptor<WasmTableGetDescriptor>(
+      this, StubCallMode::kCallWasmRuntimeStub);
   // A direct call to a wasm runtime stub defined in this module.
   // Just encode the stub index. This will be patched at relocation.
   Node* call_target = mcgraph()->RelocatableIntPtrConstant(
@@ -3416,40 +3432,21 @@ Node* WasmGraphBuilder::TableGet(uint32_t table_index, Node* index,
 
   return SetEffectControl(graph()->NewNode(
       mcgraph()->common()->Call(call_descriptor), call_target,
-      graph()->NewNode(mcgraph()->common()->NumberConstant(table_index)), index,
-      effect(), control()));
+      IntPtrConstant(table_index), index, effect(), control()));
 }
 
 Node* WasmGraphBuilder::TableSet(uint32_t table_index, Node* index, Node* val,
                                  wasm::WasmCodePosition position) {
-  if (env_->module->tables[table_index].type == wasm::kWasmAnyRef ||
-      env_->module->tables[table_index].type == wasm::kWasmNullRef ||
-      env_->module->tables[table_index].type == wasm::kWasmExnRef) {
-    Node* base = nullptr;
-    Node* offset = nullptr;
-    GetTableBaseAndOffset(table_index, index, position, &base, &offset);
-    return STORE_RAW_NODE_OFFSET(
-        base, offset, val, MachineRepresentation::kTagged, kFullWriteBarrier);
-  } else {
-    // We access funcref tables through runtime calls.
-    WasmTableSetDescriptor interface_descriptor;
-    auto call_descriptor = Linkage::GetStubCallDescriptor(
-        mcgraph()->zone(),                              // zone
-        interface_descriptor,                           // descriptor
-        interface_descriptor.GetStackParameterCount(),  // stack parameter count
-        CallDescriptor::kNoFlags,                       // flags
-        Operator::kNoProperties,                        // properties
-        StubCallMode::kCallWasmRuntimeStub);            // stub call mode
-    // A direct call to a wasm runtime stub defined in this module.
-    // Just encode the stub index. This will be patched at relocation.
-    Node* call_target = mcgraph()->RelocatableIntPtrConstant(
-        wasm::WasmCode::kWasmTableSet, RelocInfo::WASM_STUB_CALL);
+  auto call_descriptor = GetBuiltinCallDescriptor<WasmTableSetDescriptor>(
+      this, StubCallMode::kCallWasmRuntimeStub);
+  // A direct call to a wasm runtime stub defined in this module.
+  // Just encode the stub index. This will be patched at relocation.
+  Node* call_target = mcgraph()->RelocatableIntPtrConstant(
+      wasm::WasmCode::kWasmTableSet, RelocInfo::WASM_STUB_CALL);
 
-    return SetEffectControl(graph()->NewNode(
-        mcgraph()->common()->Call(call_descriptor), call_target,
-        graph()->NewNode(mcgraph()->common()->NumberConstant(table_index)),
-        index, val, effect(), control()));
-  }
+  return SetEffectControl(graph()->NewNode(
+      mcgraph()->common()->Call(call_descriptor), call_target,
+      IntPtrConstant(table_index), index, val, effect(), control()));
 }
 
 Node* WasmGraphBuilder::CheckBoundsAndAlignment(
@@ -3706,31 +3703,66 @@ LoadKind GetLoadKind(MachineGraph* mcgraph, MachineType memtype,
 // TODO(miladfar): Remove SIM once V8_TARGET_BIG_ENDIAN includes the Sim.
 #if defined(V8_TARGET_BIG_ENDIAN) || defined(V8_TARGET_ARCH_S390_LE_SIM)
 Node* WasmGraphBuilder::LoadTransformBigEndian(
-    MachineType memtype, wasm::LoadTransformationKind transform, Node* value) {
+    wasm::ValueType type, MachineType memtype,
+    wasm::LoadTransformationKind transform, Node* index, uint32_t offset,
+    uint32_t alignment, wasm::WasmCodePosition position) {
+#define LOAD_EXTEND(num_lanes, bytes_per_load, replace_lane)                   \
+  result = graph()->NewNode(mcgraph()->machine()->S128Zero());                 \
+  Node* values[num_lanes];                                                     \
+  for (int i = 0; i < num_lanes; i++) {                                        \
+    values[i] = LoadMem(type, memtype, index, offset + i * bytes_per_load,     \
+                        alignment, position);                                  \
+    if (memtype.IsSigned()) {                                                  \
+      /* sign extend */                                                        \
+      values[i] = graph()->NewNode(mcgraph()->machine()->ChangeInt32ToInt64(), \
+                                   values[i]);                                 \
+    } else {                                                                   \
+      /* zero extend */                                                        \
+      values[i] = graph()->NewNode(                                            \
+          mcgraph()->machine()->ChangeUint32ToUint64(), values[i]);            \
+    }                                                                          \
+  }                                                                            \
+  for (int lane = 0; lane < num_lanes; lane++) {                               \
+    result = graph()->NewNode(mcgraph()->machine()->replace_lane(lane),        \
+                              result, values[lane]);                           \
+  }
   Node* result;
   LoadTransformation transformation = GetLoadTransformation(memtype, transform);
 
   switch (transformation) {
     case LoadTransformation::kS8x16LoadSplat: {
-      result = graph()->NewNode(mcgraph()->machine()->I8x16Splat(), value);
+      result = LoadMem(type, memtype, index, offset, alignment, position);
+      result = graph()->NewNode(mcgraph()->machine()->I8x16Splat(), result);
       break;
     }
     case LoadTransformation::kI16x8Load8x8S:
-    case LoadTransformation::kI16x8Load8x8U:
+    case LoadTransformation::kI16x8Load8x8U: {
+      LOAD_EXTEND(8, 1, I16x8ReplaceLane)
+      break;
+    }
     case LoadTransformation::kS16x8LoadSplat: {
-      result = graph()->NewNode(mcgraph()->machine()->I16x8Splat(), value);
+      result = LoadMem(type, memtype, index, offset, alignment, position);
+      result = graph()->NewNode(mcgraph()->machine()->I16x8Splat(), result);
       break;
     }
     case LoadTransformation::kI32x4Load16x4S:
-    case LoadTransformation::kI32x4Load16x4U:
+    case LoadTransformation::kI32x4Load16x4U: {
+      LOAD_EXTEND(4, 2, I32x4ReplaceLane)
+      break;
+    }
     case LoadTransformation::kS32x4LoadSplat: {
-      result = graph()->NewNode(mcgraph()->machine()->I32x4Splat(), value);
+      result = LoadMem(type, memtype, index, offset, alignment, position);
+      result = graph()->NewNode(mcgraph()->machine()->I32x4Splat(), result);
       break;
     }
     case LoadTransformation::kI64x2Load32x2S:
-    case LoadTransformation::kI64x2Load32x2U:
+    case LoadTransformation::kI64x2Load32x2U: {
+      LOAD_EXTEND(2, 4, I64x2ReplaceLane)
+      break;
+    }
     case LoadTransformation::kS64x2LoadSplat: {
-      result = graph()->NewNode(mcgraph()->machine()->I64x2Splat(), value);
+      result = LoadMem(type, memtype, index, offset, alignment, position);
+      result = graph()->NewNode(mcgraph()->machine()->I64x2Splat(), result);
       break;
     }
     default:
@@ -3738,6 +3770,7 @@ Node* WasmGraphBuilder::LoadTransformBigEndian(
   }
 
   return result;
+#undef LOAD_EXTEND
 }
 #endif
 
@@ -3756,8 +3789,8 @@ Node* WasmGraphBuilder::LoadTransform(wasm::ValueType type, MachineType memtype,
   // LoadTransform cannot efficiently be executed on BE machines as a
   // single operation since loaded bytes need to be reversed first,
   // therefore we divide them into separate "load" and "operation" nodes.
-  load = LoadMem(type, memtype, index, offset, alignment, position);
-  load = LoadTransformBigEndian(memtype, transform, load);
+  load = LoadTransformBigEndian(type, memtype, transform, index, offset,
+                                alignment, position);
   USE(GetLoadKind);
 #else
   // Wasm semantics throw on OOB. Introduce explicit bounds check and
@@ -4023,19 +4056,6 @@ Signature<MachineRepresentation>* CreateMachineSignature(
   return builder.Build();
 }
 
-template <typename BuiltinDescriptor>
-CallDescriptor* GetBuiltinCallDescriptor(WasmGraphBuilder* builder,
-                                         StubCallMode stub_mode) {
-  BuiltinDescriptor interface_descriptor;
-  return Linkage::GetStubCallDescriptor(
-      builder->mcgraph()->zone(),                     // zone
-      interface_descriptor,                           // descriptor
-      interface_descriptor.GetStackParameterCount(),  // stack parameter count
-      CallDescriptor::kNoFlags,                       // flags
-      Operator::kNoProperties,                        // properties
-      stub_mode);                                     // stub call mode
-}
-
 }  // namespace
 
 void WasmGraphBuilder::AddInt64LoweringReplacement(
@@ -4157,6 +4177,12 @@ Node* WasmGraphBuilder::SimdOp(wasm::WasmOpcode opcode, Node* const* inputs) {
     case wasm::kExprF64x2Qfms:
       return graph()->NewNode(mcgraph()->machine()->F64x2Qfms(), inputs[0],
                               inputs[1], inputs[2]);
+    case wasm::kExprF64x2Pmin:
+      return graph()->NewNode(mcgraph()->machine()->F64x2Pmin(), inputs[0],
+                              inputs[1]);
+    case wasm::kExprF64x2Pmax:
+      return graph()->NewNode(mcgraph()->machine()->F64x2Pmax(), inputs[0],
+                              inputs[1]);
     case wasm::kExprF32x4Splat:
       return graph()->NewNode(mcgraph()->machine()->F32x4Splat(), inputs[0]);
     case wasm::kExprF32x4SConvertI32x4:
@@ -4222,6 +4248,21 @@ Node* WasmGraphBuilder::SimdOp(wasm::WasmOpcode opcode, Node* const* inputs) {
     case wasm::kExprF32x4Qfms:
       return graph()->NewNode(mcgraph()->machine()->F32x4Qfms(), inputs[0],
                               inputs[1], inputs[2]);
+    case wasm::kExprF32x4Pmin:
+      return graph()->NewNode(mcgraph()->machine()->F32x4Pmin(), inputs[0],
+                              inputs[1]);
+    case wasm::kExprF32x4Pmax:
+      return graph()->NewNode(mcgraph()->machine()->F32x4Pmax(), inputs[0],
+                              inputs[1]);
+    case wasm::kExprF32x4Ceil:
+      return graph()->NewNode(mcgraph()->machine()->F32x4Ceil(), inputs[0]);
+    case wasm::kExprF32x4Floor:
+      return graph()->NewNode(mcgraph()->machine()->F32x4Floor(), inputs[0]);
+    case wasm::kExprF32x4Trunc:
+      return graph()->NewNode(mcgraph()->machine()->F32x4Trunc(), inputs[0]);
+    case wasm::kExprF32x4NearestInt:
+      return graph()->NewNode(mcgraph()->machine()->F32x4NearestInt(),
+                              inputs[0]);
     case wasm::kExprI64x2Splat:
       return graph()->NewNode(mcgraph()->machine()->I64x2Splat(), inputs[0]);
     case wasm::kExprI64x2Neg:
@@ -4585,22 +4626,22 @@ Node* WasmGraphBuilder::SimdOp(wasm::WasmOpcode opcode, Node* const* inputs) {
     case wasm::kExprS128AndNot:
       return graph()->NewNode(mcgraph()->machine()->S128AndNot(), inputs[0],
                               inputs[1]);
-    case wasm::kExprS1x2AnyTrue:
-      return graph()->NewNode(mcgraph()->machine()->S1x2AnyTrue(), inputs[0]);
-    case wasm::kExprS1x2AllTrue:
-      return graph()->NewNode(mcgraph()->machine()->S1x2AllTrue(), inputs[0]);
-    case wasm::kExprS1x4AnyTrue:
-      return graph()->NewNode(mcgraph()->machine()->S1x4AnyTrue(), inputs[0]);
-    case wasm::kExprS1x4AllTrue:
-      return graph()->NewNode(mcgraph()->machine()->S1x4AllTrue(), inputs[0]);
-    case wasm::kExprS1x8AnyTrue:
-      return graph()->NewNode(mcgraph()->machine()->S1x8AnyTrue(), inputs[0]);
-    case wasm::kExprS1x8AllTrue:
-      return graph()->NewNode(mcgraph()->machine()->S1x8AllTrue(), inputs[0]);
-    case wasm::kExprS1x16AnyTrue:
-      return graph()->NewNode(mcgraph()->machine()->S1x16AnyTrue(), inputs[0]);
-    case wasm::kExprS1x16AllTrue:
-      return graph()->NewNode(mcgraph()->machine()->S1x16AllTrue(), inputs[0]);
+    case wasm::kExprV64x2AnyTrue:
+      return graph()->NewNode(mcgraph()->machine()->V64x2AnyTrue(), inputs[0]);
+    case wasm::kExprV64x2AllTrue:
+      return graph()->NewNode(mcgraph()->machine()->V64x2AllTrue(), inputs[0]);
+    case wasm::kExprV32x4AnyTrue:
+      return graph()->NewNode(mcgraph()->machine()->V32x4AnyTrue(), inputs[0]);
+    case wasm::kExprV32x4AllTrue:
+      return graph()->NewNode(mcgraph()->machine()->V32x4AllTrue(), inputs[0]);
+    case wasm::kExprV16x8AnyTrue:
+      return graph()->NewNode(mcgraph()->machine()->V16x8AnyTrue(), inputs[0]);
+    case wasm::kExprV16x8AllTrue:
+      return graph()->NewNode(mcgraph()->machine()->V16x8AllTrue(), inputs[0]);
+    case wasm::kExprV8x16AnyTrue:
+      return graph()->NewNode(mcgraph()->machine()->V8x16AnyTrue(), inputs[0]);
+    case wasm::kExprV8x16AllTrue:
+      return graph()->NewNode(mcgraph()->machine()->V8x16AllTrue(), inputs[0]);
     case wasm::kExprS8x16Swizzle:
       return graph()->NewNode(mcgraph()->machine()->S8x16Swizzle(), inputs[0],
                               inputs[1]);
@@ -5048,6 +5089,194 @@ Node* WasmGraphBuilder::TableFill(uint32_t table_index, Node* start,
   return BuildCallToRuntime(Runtime::kWasmTableFill, args, arraysize(args));
 }
 
+namespace {
+
+MachineType FieldType(const wasm::StructType* type, uint32_t field_index) {
+  return MachineType::TypeForRepresentation(
+      type->field(field_index).machine_representation());
+}
+
+Node* FieldOffset(MachineGraph* graph, const wasm::StructType* type,
+                  uint32_t field_index) {
+  int offset = WasmStruct::kHeaderSize + type->field_offset(field_index) -
+               kHeapObjectTag;
+  return graph->IntPtrConstant(offset);
+}
+
+// Set a field of a struct, without checking if the struct is null.
+// Helper method for StructNew and StructSet.
+Node* StoreStructFieldUnchecked(MachineGraph* graph, WasmGraphAssembler* gasm,
+                                Node* struct_object,
+                                const wasm::StructType* type,
+                                uint32_t field_index, Node* value) {
+  WriteBarrierKind write_barrier = type->field(field_index).IsReferenceType()
+                                       ? kPointerWriteBarrier
+                                       : kNoWriteBarrier;
+  StoreRepresentation rep(type->field(field_index).machine_representation(),
+                          write_barrier);
+  Node* offset = FieldOffset(graph, type, field_index);
+  return gasm->Store(rep, struct_object, offset, value);
+}
+
+Node* ArrayElementOffset(GraphAssembler* gasm, Node* index,
+                         wasm::ValueType element_type) {
+  return gasm->Int32Add(
+      gasm->Int32Constant(WasmArray::kHeaderSize - kHeapObjectTag),
+      gasm->Int32Mul(index,
+                     gasm->Int32Constant(element_type.element_size_bytes())));
+}
+
+Node* ArrayLength(GraphAssembler* gasm, Node* array) {
+  return gasm->Load(
+      MachineType::Uint32(), array,
+      gasm->Int32Constant(WasmArray::kLengthOffset - kHeapObjectTag));
+}
+
+}  // namespace
+
+Node* WasmGraphBuilder::StructNew(uint32_t struct_index,
+                                  const wasm::StructType* type,
+                                  Vector<Node*> fields) {
+  // This logic is duplicated from module-instantiate.cc.
+  // TODO(jkummerow): Find a nicer solution.
+  int map_index = 0;
+  const std::vector<uint8_t>& type_kinds = env_->module->type_kinds;
+  for (uint32_t i = 0; i < struct_index; i++) {
+    if (type_kinds[i] == wasm::kWasmStructTypeCode ||
+        type_kinds[i] == wasm::kWasmArrayTypeCode) {
+      map_index++;
+    }
+  }
+  Node* s = CALL_BUILTIN(
+      WasmAllocateStruct,
+      graph()->NewNode(mcgraph()->common()->NumberConstant(map_index)),
+      LOAD_INSTANCE_FIELD(NativeContext, MachineType::TaggedPointer()));
+  for (uint32_t i = 0; i < type->field_count(); i++) {
+    StoreStructFieldUnchecked(mcgraph(), gasm_.get(), s, type, i, fields[i]);
+  }
+  return s;
+}
+
+Node* WasmGraphBuilder::ArrayNew(uint32_t array_index,
+                                 const wasm::ArrayType* type, Node* length,
+                                 Node* initial_value) {
+  // This logic is duplicated from module-instantiate.cc.
+  // TODO(jkummerow): Find a nicer solution.
+  int map_index = 0;
+  const std::vector<uint8_t>& type_kinds = env_->module->type_kinds;
+  for (uint32_t i = 0; i < array_index; i++) {
+    if (type_kinds[i] == wasm::kWasmStructTypeCode ||
+        type_kinds[i] == wasm::kWasmArrayTypeCode) {
+      map_index++;
+    }
+  }
+
+  wasm::ValueType element_type = type->element_type();
+  Node* a = CALL_BUILTIN(
+      WasmAllocateArray,
+      graph()->NewNode(mcgraph()->common()->NumberConstant(map_index)),
+      BuildChangeUint31ToSmi(length),
+      graph()->NewNode(mcgraph()->common()->NumberConstant(
+          element_type.element_size_bytes())),
+      LOAD_INSTANCE_FIELD(NativeContext, MachineType::TaggedPointer()));
+  WriteBarrierKind write_barrier =
+      element_type.IsReferenceType() ? kPointerWriteBarrier : kNoWriteBarrier;
+  StoreRepresentation rep(element_type.machine_representation(), write_barrier);
+
+  auto loop = gasm_->MakeLoopLabel(MachineRepresentation::kWord32);
+  auto done = gasm_->MakeLabel();
+  Node* start_offset =
+      gasm_->Int32Constant(WasmArray::kHeaderSize - kHeapObjectTag);
+  Node* element_size = gasm_->Int32Constant(element_type.element_size_bytes());
+  Node* end_offset =
+      gasm_->Int32Add(start_offset, gasm_->Int32Mul(element_size, length));
+  // "Goto" requires the graph's end to have been set up.
+  // TODO(jkummerow): Figure out if there's a more elegant solution.
+  Graph* g = mcgraph()->graph();
+  if (!g->end()) {
+    g->SetEnd(g->NewNode(mcgraph()->common()->End(0)));
+  }
+  gasm_->Goto(&loop, start_offset);
+  gasm_->Bind(&loop);
+  {
+    Node* offset = loop.PhiAt(0);
+    Node* check = gasm_->Uint32LessThan(offset, end_offset);
+    gasm_->GotoIfNot(check, &done);
+    gasm_->Store(rep, a, offset, initial_value);
+    offset = gasm_->Int32Add(offset, element_size);
+    gasm_->Goto(&loop, offset);
+  }
+  gasm_->Bind(&done);
+  return a;
+}
+
+Node* WasmGraphBuilder::StructGet(Node* struct_object,
+                                  const wasm::StructType* struct_type,
+                                  uint32_t field_index, CheckForNull null_check,
+                                  wasm::WasmCodePosition position) {
+  if (null_check == kWithNullCheck) {
+    TrapIfTrue(wasm::kTrapNullDereference,
+               gasm_->WordEqual(struct_object, RefNull()), position);
+  }
+  MachineType machine_type = FieldType(struct_type, field_index);
+  Node* offset = FieldOffset(mcgraph(), struct_type, field_index);
+  return gasm_->Load(machine_type, struct_object, offset);
+}
+
+Node* WasmGraphBuilder::StructSet(Node* struct_object,
+                                  const wasm::StructType* struct_type,
+                                  uint32_t field_index, Node* field_value,
+                                  CheckForNull null_check,
+                                  wasm::WasmCodePosition position) {
+  if (null_check == kWithNullCheck) {
+    TrapIfTrue(wasm::kTrapNullDereference,
+               gasm_->WordEqual(struct_object, RefNull()), position);
+  }
+  return StoreStructFieldUnchecked(mcgraph(), gasm_.get(), struct_object,
+                                   struct_type, field_index, field_value);
+}
+
+void WasmGraphBuilder::BoundsCheck(Node* array, Node* index,
+                                   wasm::WasmCodePosition position) {
+  Node* length = ArrayLength(gasm_.get(), array);
+  TrapIfFalse(wasm::kTrapArrayOutOfBounds, gasm_->Uint32LessThan(index, length),
+              position);
+}
+
+Node* WasmGraphBuilder::ArrayGet(Node* array_object,
+                                 const wasm::ArrayType* type, Node* index,
+                                 wasm::WasmCodePosition position) {
+  TrapIfTrue(wasm::kTrapNullDereference,
+             gasm_->WordEqual(array_object, RefNull()), position);
+  BoundsCheck(array_object, index, position);
+  MachineType machine_type = MachineType::TypeForRepresentation(
+      type->element_type().machine_representation());
+  Node* offset = ArrayElementOffset(gasm_.get(), index, type->element_type());
+  return gasm_->Load(machine_type, array_object, offset);
+}
+
+Node* WasmGraphBuilder::ArraySet(Node* array_object,
+                                 const wasm::ArrayType* type, Node* index,
+                                 Node* value, wasm::WasmCodePosition position) {
+  TrapIfTrue(wasm::kTrapNullDereference,
+             gasm_->WordEqual(array_object, RefNull()), position);
+  BoundsCheck(array_object, index, position);
+  WriteBarrierKind write_barrier = type->element_type().IsReferenceType()
+                                       ? kPointerWriteBarrier
+                                       : kNoWriteBarrier;
+  StoreRepresentation rep(type->element_type().machine_representation(),
+                          write_barrier);
+  Node* offset = ArrayElementOffset(gasm_.get(), index, type->element_type());
+  return gasm_->Store(rep, array_object, offset, value);
+}
+
+Node* WasmGraphBuilder::ArrayLen(Node* array_object,
+                                 wasm::WasmCodePosition position) {
+  TrapIfTrue(wasm::kTrapNullDereference,
+             gasm_->WordEqual(array_object, RefNull()), position);
+  return ArrayLength(gasm_.get(), array_object);
+}
+
 class WasmDecorator final : public GraphDecorator {
  public:
   explicit WasmDecorator(NodeOriginTable* origins, wasm::Decoder* decoder)
@@ -5113,11 +5342,6 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     return bigint_to_i64_descriptor_;
   }
 
-  Node* GetBuiltinPointerTarget(Builtins::Name builtin_id) {
-    static_assert(std::is_same<Smi, BuiltinPtr>(), "BuiltinPtr must be Smi");
-    return graph()->NewNode(mcgraph()->common()->NumberConstant(builtin_id));
-  }
-
   Node* GetTargetForBuiltinCall(wasm::WasmCode::RuntimeStubId wasm_stub,
                                 Builtins::Name builtin_id) {
     return (stub_mode_ == StubCallMode::kCallWasmRuntimeStub)
@@ -5126,52 +5350,6 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
                : GetBuiltinPointerTarget(builtin_id);
   }
 
-  Node* BuildAllocateHeapNumberWithValue(Node* value) {
-    MachineOperatorBuilder* machine = mcgraph()->machine();
-    CommonOperatorBuilder* common = mcgraph()->common();
-    Node* target = GetTargetForBuiltinCall(wasm::WasmCode::kAllocateHeapNumber,
-                                           Builtins::kAllocateHeapNumber);
-    if (!allocate_heap_number_operator_.is_set()) {
-      auto call_descriptor = Linkage::GetStubCallDescriptor(
-          mcgraph()->zone(), AllocateHeapNumberDescriptor(), 0,
-          CallDescriptor::kNoFlags, Operator::kNoThrow, stub_mode_);
-      allocate_heap_number_operator_.set(common->Call(call_descriptor));
-    }
-    Node* heap_number = graph()->NewNode(allocate_heap_number_operator_.get(),
-                                         target, effect(), control());
-    SetEffect(
-        graph()->NewNode(machine->Store(StoreRepresentation(
-                             MachineRepresentation::kFloat64, kNoWriteBarrier)),
-                         heap_number, BuildHeapNumberValueIndexConstant(),
-                         value, heap_number, control()));
-    return heap_number;
-  }
-
-  Node* BuildChangeSmiToFloat32(Node* value) {
-    return graph()->NewNode(mcgraph()->machine()->RoundInt32ToFloat32(),
-                            BuildChangeSmiToInt32(value));
-  }
-
-  Node* BuildChangeSmiToFloat64(Node* value) {
-    return graph()->NewNode(mcgraph()->machine()->ChangeInt32ToFloat64(),
-                            BuildChangeSmiToInt32(value));
-  }
-
-  Node* BuildTestHeapObject(Node* value) {
-    return graph()->NewNode(mcgraph()->machine()->WordAnd(), value,
-                            mcgraph()->IntPtrConstant(kHeapObjectTag));
-  }
-
-  Node* BuildLoadHeapNumberValue(Node* value) {
-    return SetEffect(graph()->NewNode(
-        mcgraph()->machine()->Load(MachineType::Float64()), value,
-        BuildHeapNumberValueIndexConstant(), effect(), control()));
-  }
-
-  Node* BuildHeapNumberValueIndexConstant() {
-    return mcgraph()->IntPtrConstant(HeapNumber::kValueOffset - kHeapObjectTag);
-  }
-
   Node* BuildLoadUndefinedValueFromInstance() {
     if (undefined_value_node_ == nullptr) {
       Node* isolate_root = graph()->NewNode(
@@ -5188,93 +5366,122 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     return undefined_value_node_.get();
   }
 
-  Node* BuildChangeInt32ToTagged(Node* value) {
+  Node* BuildChangeInt32ToNumber(Node* value) {
+    // We expect most integers at runtime to be Smis, so it is important for
+    // wrapper performance that Smi conversion be inlined.
     if (SmiValuesAre32Bits()) {
       return BuildChangeInt32ToSmi(value);
     }
     DCHECK(SmiValuesAre31Bits());
 
-    auto allocate_heap_number = gasm_->MakeDeferredLabel();
+    auto builtin = gasm_->MakeDeferredLabel();
     auto done = gasm_->MakeLabel(MachineRepresentation::kTagged);
 
-    // The smi value is {2 * value}. If that overflows, we need to allocate a
-    // heap number.
+    // Double value to test if value can be a Smi, and if so, to convert it.
     Node* add = gasm_->Int32AddWithOverflow(value, value);
     Node* ovf = gasm_->Projection(1, add);
-    gasm_->GotoIf(ovf, &allocate_heap_number);
+    gasm_->GotoIf(ovf, &builtin);
 
     // If it didn't overflow, the result is {2 * value} as pointer-sized value.
     Node* smi_tagged = BuildChangeInt32ToIntPtr(gasm_->Projection(0, add));
     gasm_->Goto(&done, smi_tagged);
 
-    gasm_->Bind(&allocate_heap_number);
-    Node* heap_number =
-        BuildAllocateHeapNumberWithValue(gasm_->ChangeInt32ToFloat64(value));
-    gasm_->Goto(&done, heap_number);
-
+    // Otherwise, call builtin, to convert to a HeapNumber.
+    gasm_->Bind(&builtin);
+    CommonOperatorBuilder* common = mcgraph()->common();
+    Node* target =
+        GetTargetForBuiltinCall(wasm::WasmCode::kWasmInt32ToHeapNumber,
+                                Builtins::kWasmInt32ToHeapNumber);
+    if (!int32_to_heapnumber_operator_.is_set()) {
+      auto call_descriptor = Linkage::GetStubCallDescriptor(
+          mcgraph()->zone(), WasmInt32ToHeapNumberDescriptor(), 0,
+          CallDescriptor::kNoFlags, Operator::kNoProperties, stub_mode_);
+      int32_to_heapnumber_operator_.set(common->Call(call_descriptor));
+    }
+    Node* call =
+        gasm_->Call(int32_to_heapnumber_operator_.get(), target, value);
+    gasm_->Goto(&done, call);
     gasm_->Bind(&done);
     return done.PhiAt(0);
   }
 
-  Node* BuildChangeFloat64ToTagged(Node* value) {
-    // Check several conditions:
-    //  i32?
-    //  ├─ true: zero?
-    //  │        ├─ true: positive?
-    //  │        │        ├─ true: potentially Smi
-    //  │        │        └─ false: box (-0)
-    //  │        └─ false: potentially Smi
-    //  └─ false: box (non-int)
-    // For potential Smi values, depending on whether Smis are 31 or 32 bit, we
-    // still need to check whether the value fits in a Smi.
-
-    auto box_value = gasm_->MakeDeferredLabel();
-    auto potentially_smi = gasm_->MakeLabel();
-    auto done = gasm_->MakeLabel(MachineRepresentation::kTagged);
-
-    Node* value32 = gasm_->RoundFloat64ToInt32(value);
-    Node* check_i32 =
-        gasm_->Float64Equal(value, gasm_->ChangeInt32ToFloat64(value32));
-    gasm_->GotoIfNot(check_i32, &box_value);
+  Node* BuildChangeTaggedToInt32(Node* value, Node* context) {
+    // We expect most integers at runtime to be Smis, so it is important for
+    // wrapper performance that Smi conversion be inlined.
+    auto builtin = gasm_->MakeDeferredLabel();
+    auto done = gasm_->MakeLabel(MachineRepresentation::kWord32);
 
-    // We only need to check for -0 if the {value} can potentially contain -0.
-    Node* check_zero = gasm_->Word32Equal(value32, gasm_->Int32Constant(0));
-    gasm_->GotoIfNot(check_zero, &potentially_smi);
+    // Test if value is a Smi.
+    Node* is_smi =
+        gasm_->Word32Equal(gasm_->Word32And(BuildTruncateIntPtrToInt32(value),
+                                            gasm_->Int32Constant(kSmiTagMask)),
+                           gasm_->Int32Constant(0));
+    gasm_->GotoIfNot(is_smi, &builtin);
 
-    // In case of 0, we need to check the MSB (sign bit).
-    Node* check_positive = gasm_->Word32Equal(
-        gasm_->Float64ExtractHighWord32(value), gasm_->Int32Constant(0));
-    gasm_->Branch(check_positive, &potentially_smi, &box_value);
+    // If Smi, convert to int32.
+    Node* smi = BuildChangeSmiToInt32(value);
+    gasm_->Goto(&done, smi);
 
-    gasm_->Bind(&potentially_smi);
-
-    // On 64-bit machines we can just wrap the 32-bit integer in a smi, for
-    // 32-bit machines we need to deal with potential overflow and fallback to
-    // boxing.
-    if (SmiValuesAre32Bits()) {
-      gasm_->Goto(&done, BuildChangeInt32ToSmi(value32));
-    } else {
-      DCHECK(SmiValuesAre31Bits());
-      // The smi value is {2 * value}. If that overflows, we need to box.
-      Node* smi_tag = gasm_->Int32AddWithOverflow(value32, value32);
-
-      Node* check_ovf = gasm_->Projection(1, smi_tag);
-      gasm_->GotoIf(check_ovf, &box_value);
+    // Otherwise, call builtin which changes non-Smi to Int32.
+    gasm_->Bind(&builtin);
+    CommonOperatorBuilder* common = mcgraph()->common();
+    Node* target =
+        GetTargetForBuiltinCall(wasm::WasmCode::kWasmTaggedNonSmiToInt32,
+                                Builtins::kWasmTaggedNonSmiToInt32);
+    if (!tagged_non_smi_to_int32_operator_.is_set()) {
+      auto call_descriptor = Linkage::GetStubCallDescriptor(
+          mcgraph()->zone(), WasmTaggedNonSmiToInt32Descriptor(), 0,
+          CallDescriptor::kNoFlags, Operator::kNoProperties, stub_mode_);
+      tagged_non_smi_to_int32_operator_.set(common->Call(call_descriptor));
+    }
+    Node* call = gasm_->Call(tagged_non_smi_to_int32_operator_.get(), target,
+                             value, context);
+    SetSourcePosition(call, 1);
+    gasm_->Goto(&done, call);
+    gasm_->Bind(&done);
+    return done.PhiAt(0);
+  }
 
-      Node* smi_value = gasm_->Projection(0, smi_tag);
-      // With pointer compression, only the lower 32 bits are used.
-      if (!COMPRESS_POINTERS_BOOL) {
-        smi_value = BuildChangeInt32ToIntPtr(smi_value);
-      }
-      gasm_->Goto(&done, smi_value);
+  Node* BuildChangeFloat32ToNumber(Node* value) {
+    CommonOperatorBuilder* common = mcgraph()->common();
+    Node* target = GetTargetForBuiltinCall(wasm::WasmCode::kWasmFloat32ToNumber,
+                                           Builtins::kWasmFloat32ToNumber);
+    if (!float32_to_number_operator_.is_set()) {
+      auto call_descriptor = Linkage::GetStubCallDescriptor(
+          mcgraph()->zone(), WasmFloat32ToNumberDescriptor(), 0,
+          CallDescriptor::kNoFlags, Operator::kNoProperties, stub_mode_);
+      float32_to_number_operator_.set(common->Call(call_descriptor));
     }
+    return gasm_->Call(float32_to_number_operator_.get(), target, value);
+  }
 
-    // Allocate the box for the {value}.
-    gasm_->Bind(&box_value);
-    gasm_->Goto(&done, BuildAllocateHeapNumberWithValue(value));
+  Node* BuildChangeFloat64ToNumber(Node* value) {
+    CommonOperatorBuilder* common = mcgraph()->common();
+    Node* target = GetTargetForBuiltinCall(wasm::WasmCode::kWasmFloat64ToNumber,
+                                           Builtins::kWasmFloat64ToNumber);
+    if (!float64_to_number_operator_.is_set()) {
+      auto call_descriptor = Linkage::GetStubCallDescriptor(
+          mcgraph()->zone(), WasmFloat64ToNumberDescriptor(), 0,
+          CallDescriptor::kNoFlags, Operator::kNoProperties, stub_mode_);
+      float64_to_number_operator_.set(common->Call(call_descriptor));
+    }
+    return gasm_->Call(float64_to_number_operator_.get(), target, value);
+  }
 
-    gasm_->Bind(&done);
-    return done.PhiAt(0);
+  Node* BuildChangeTaggedToFloat64(Node* value, Node* context) {
+    CommonOperatorBuilder* common = mcgraph()->common();
+    Node* target = GetTargetForBuiltinCall(wasm::WasmCode::kWasmTaggedToFloat64,
+                                           Builtins::kWasmTaggedToFloat64);
+    if (!tagged_to_float64_operator_.is_set()) {
+      auto call_descriptor = Linkage::GetStubCallDescriptor(
+          mcgraph()->zone(), WasmTaggedToFloat64Descriptor(), 0,
+          CallDescriptor::kNoFlags, Operator::kNoProperties, stub_mode_);
+      tagged_to_float64_operator_.set(common->Call(call_descriptor));
+    }
+    Node* call =
+        gasm_->Call(tagged_to_float64_operator_.get(), target, value, context);
+    SetSourcePosition(call, 1);
+    return call;
   }
 
   int AddArgumentNodes(Vector<Node*> args, int pos, int param_count,
@@ -5288,33 +5495,10 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     return pos;
   }
 
-  // Converts a number (Smi or HeapNumber) to float64.
-  Node* BuildChangeNumberToFloat64(Node* value) {
-    // If the input is a HeapNumber, we load the value from it.
-    Node* check_heap_object = BuildTestHeapObject(value);
-    Diamond is_heapnumber(graph(), mcgraph()->common(), check_heap_object,
-                          BranchHint::kFalse);
-    is_heapnumber.Chain(control());
-
-    SetControl(is_heapnumber.if_true);
-    Node* effect_orig = effect();
-    Node* v_heapnumber = BuildLoadHeapNumberValue(value);
-    Node* effect_heapnumber = effect();
-
-    SetControl(is_heapnumber.merge);
-    // If the input is Smi, just convert to float64.
-    Node* v_smi = BuildChangeSmiToFloat64(value);
-
-    SetEffect(is_heapnumber.EffectPhi(effect_heapnumber, effect_orig));
-
-    return is_heapnumber.Phi(MachineRepresentation::kFloat64, v_heapnumber,
-                             v_smi);
-  }
-
   Node* ToJS(Node* node, wasm::ValueType type) {
     switch (type.kind()) {
       case wasm::ValueType::kI32:
-        return BuildChangeInt32ToTagged(node);
+        return BuildChangeInt32ToNumber(node);
       case wasm::ValueType::kS128:
         UNREACHABLE();
       case wasm::ValueType::kI64: {
@@ -5322,16 +5506,23 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
         return BuildChangeInt64ToBigInt(node);
       }
       case wasm::ValueType::kF32:
-        node = graph()->NewNode(mcgraph()->machine()->ChangeFloat32ToFloat64(),
-                                node);
-        return BuildChangeFloat64ToTagged(node);
+        return BuildChangeFloat32ToNumber(node);
       case wasm::ValueType::kF64:
-        return BuildChangeFloat64ToTagged(node);
+        return BuildChangeFloat64ToNumber(node);
       case wasm::ValueType::kAnyRef:
       case wasm::ValueType::kFuncRef:
       case wasm::ValueType::kNullRef:
       case wasm::ValueType::kExnRef:
         return node;
+      case wasm::ValueType::kRef:
+      case wasm::ValueType::kOptRef:
+      case wasm::ValueType::kEqRef:
+        // TODO(7748): Implement properly. For now, we just expose the raw
+        // object for testing.
+        return node;
+      case wasm::ValueType::kI8:
+      case wasm::ValueType::kI16:
+        UNIMPLEMENTED();
       case wasm::ValueType::kStmt:
       case wasm::ValueType::kBottom:
         UNREACHABLE();
@@ -5380,41 +5571,6 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
         graph()->NewNode(call, target, input, context, effect(), control()));
   }
 
-  Node* BuildTestSmi(Node* value) {
-    return gasm_->Word32Equal(
-        gasm_->Word32And(BuildTruncateIntPtrToInt32(value),
-                         gasm_->Int32Constant(kSmiTagMask)),
-        gasm_->Int32Constant(0));
-  }
-
-  Node* BuildFloat64ToWasm(Node* value, wasm::ValueType type) {
-    switch (type.kind()) {
-      case wasm::ValueType::kI32:
-        return graph()->NewNode(mcgraph()->machine()->TruncateFloat64ToWord32(),
-                                value);
-      case wasm::ValueType::kF32:
-        return graph()->NewNode(
-            mcgraph()->machine()->TruncateFloat64ToFloat32(), value);
-      case wasm::ValueType::kF64:
-        return value;
-      default:
-        UNREACHABLE();
-    }
-  }
-
-  Node* BuildSmiToWasm(Node* smi, wasm::ValueType type) {
-    switch (type.kind()) {
-      case wasm::ValueType::kI32:
-        return BuildChangeSmiToInt32(smi);
-      case wasm::ValueType::kF32:
-        return BuildChangeSmiToFloat32(smi);
-      case wasm::ValueType::kF64:
-        return BuildChangeSmiToFloat64(smi);
-      default:
-        UNREACHABLE();
-    }
-  }
-
   Node* FromJS(Node* input, Node* js_context, wasm::ValueType type) {
     switch (type.kind()) {
       case wasm::ValueType::kAnyRef:
@@ -5460,65 +5616,33 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
         return input;
       }
 
+      case wasm::ValueType::kF32:
+        return graph()->NewNode(
+            mcgraph()->machine()->TruncateFloat64ToFloat32(),
+            BuildChangeTaggedToFloat64(input, js_context));
+
+      case wasm::ValueType::kF64:
+        return BuildChangeTaggedToFloat64(input, js_context);
+
+      case wasm::ValueType::kI32:
+        return BuildChangeTaggedToInt32(input, js_context);
+
       case wasm::ValueType::kI64:
         // i64 values can only come from BigInt.
         DCHECK(enabled_features_.has_bigint());
         return BuildChangeBigIntToInt64(input, js_context);
 
-      default:
+      case wasm::ValueType::kS128:
+      case wasm::ValueType::kRef:
+      case wasm::ValueType::kOptRef:
+      case wasm::ValueType::kEqRef:
+      case wasm::ValueType::kI8:
+      case wasm::ValueType::kI16:
+      case wasm::ValueType::kBottom:
+      case wasm::ValueType::kStmt:
+        UNREACHABLE();
         break;
     }
-
-    gasm_->InitializeEffectControl(effect(), control());
-
-    // Handle Smis first. The rest goes through the ToNumber stub.
-    // TODO(clemensb): Also handle HeapNumbers specially.
-    STATIC_ASSERT(kSmiTagMask < kMaxUInt32);
-
-    // Build a graph implementing this diagram:
-    //   input smi?
-    //    ├─ true: ──<fast path>──────────┬─ smi-to-wasm ──────┬─ result
-    //    └─ false: ToNumber -> smi?      │                    │
-    //                          ├─ true: ─┘                    │
-    //                          └─ false: load -> f64-to-wasm ─┘
-
-    auto smi_to_wasm = gasm_->MakeLabel(MachineRepresentation::kTaggedSigned);
-    auto call_to_number =
-        gasm_->MakeDeferredLabel(MachineRepresentation::kTaggedPointer);
-    auto done = gasm_->MakeLabel(type.machine_representation());
-
-    // Branch to smi conversion or the ToNumber call.
-    gasm_->Branch(BuildTestSmi(input), &smi_to_wasm, &call_to_number, input);
-
-    // Build the ToNumber path.
-    gasm_->Bind(&call_to_number);
-    auto to_number_descriptor = Linkage::GetStubCallDescriptor(
-        mcgraph()->zone(), TypeConversionDescriptor{}, 0,
-        CallDescriptor::kNoFlags, Operator::kNoProperties, stub_mode_);
-    Node* to_number_target =
-        GetTargetForBuiltinCall(wasm::WasmCode::kToNumber, Builtins::kToNumber);
-    Node* number =
-        gasm_->Call(to_number_descriptor, to_number_target, input, js_context);
-    SetSourcePosition(number, 1);
-
-    // If the ToNumber result is Smi, convert to wasm.
-    gasm_->GotoIf(BuildTestSmi(number), &smi_to_wasm, number);
-
-    // Otherwise the ToNumber result is a HeapNumber. Load its value and convert
-    // to wasm.
-    Node* heap_number_value = gasm_->LoadHeapNumberValue(number);
-    Node* converted_heap_number_value =
-        BuildFloat64ToWasm(heap_number_value, type);
-    gasm_->Goto(&done, converted_heap_number_value);
-
-    // Implement the smi to wasm conversion.
-    gasm_->Bind(&smi_to_wasm);
-    Node* smi_to_wasm_result = BuildSmiToWasm(smi_to_wasm.PhiAt(0), type);
-    gasm_->Goto(&done, smi_to_wasm_result);
-
-    // Done. Update effect and control and return the final Phi.
-    gasm_->Bind(&done);
-    return done.PhiAt(0);
   }
 
   void BuildModifyThreadInWasmFlag(bool new_value) {
@@ -5595,18 +5719,25 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
 
   Node* BuildMultiReturnFixedArrayFromIterable(const wasm::FunctionSig* sig,
                                                Node* iterable, Node* context) {
-    Node* iterable_to_fixed_array =
-        GetBuiltinPointerTarget(Builtins::kIterableToFixedArrayForWasm);
-    IterableToFixedArrayForWasmDescriptor interface_descriptor;
     Node* length = BuildChangeUint31ToSmi(
         Uint32Constant(static_cast<uint32_t>(sig->return_count())));
-    auto call_descriptor = Linkage::GetStubCallDescriptor(
-        mcgraph()->zone(), interface_descriptor,
-        interface_descriptor.GetStackParameterCount(), CallDescriptor::kNoFlags,
-        Operator::kNoProperties, StubCallMode::kCallBuiltinPointer);
-    return SetEffect(graph()->NewNode(
-        mcgraph()->common()->Call(call_descriptor), iterable_to_fixed_array,
-        iterable, length, context, effect(), control()));
+    return CALL_BUILTIN(IterableToFixedArrayForWasm, iterable, length, context);
+  }
+
+  // Extract the FixedArray implementing
+  // the backing storage of a JavaScript array.
+  Node* BuildLoadArrayBackingStorage(Node* js_array) {
+    return gasm_->Load(MachineType::AnyTagged(), js_array,
+                       JSObject::kElementsOffset - kHeapObjectTag);
+  }
+
+  // Generate a call to the AllocateJSArray builtin.
+  Node* BuildCallAllocateJSArray(Node* array_length, Node* context) {
+    // Since we don't check that args will fit in an array,
+    // we make sure this is true based on statically known limits.
+    STATIC_ASSERT(wasm::kV8MaxWasmFunctionMultiReturns <=
+                  JSArray::kInitialMaxFastElementArray);
+    return SetControl(CALL_BUILTIN(WasmAllocateJSArray, array_length, context));
   }
 
   void BuildJSToWasmWrapper(bool is_import) {
@@ -5692,15 +5823,15 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
       int32_t return_count = static_cast<int32_t>(sig_->return_count());
       Node* size =
           graph()->NewNode(mcgraph()->common()->NumberConstant(return_count));
-      // TODO(thibaudm): Replace runtime calls with TurboFan code.
-      Node* fixed_array =
-          BuildCallToRuntime(Runtime::kWasmNewMultiReturnFixedArray, &size, 1);
+
+      jsval = BuildCallAllocateJSArray(size, js_context);
+
+      Node* fixed_array = BuildLoadArrayBackingStorage(jsval);
+
       for (int i = 0; i < return_count; ++i) {
         Node* value = ToJS(rets[i], sig_->GetReturn(i));
         STORE_FIXED_ARRAY_SLOT_ANY(fixed_array, i, value);
       }
-      jsval = BuildCallToRuntimeWithContext(Runtime::kWasmNewMultiReturnJSArray,
-                                            js_context, &fixed_array, 1);
     }
     Return(jsval);
     if (ContainsInt64(sig_)) LowerInt64(kCalledFromJS);
@@ -6014,78 +6145,6 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     if (ContainsInt64(sig_)) LowerInt64(kCalledFromWasm);
   }
 
-  void BuildWasmInterpreterEntry(int func_index) {
-    int param_count = static_cast<int>(sig_->parameter_count());
-
-    // Build the start and the parameter nodes.
-    SetEffectControl(Start(param_count + 3));
-
-    // Create the instance_node from the passed parameter.
-    instance_node_.set(Param(wasm::kWasmInstanceParameterIndex));
-
-    // Compute size for the argument buffer.
-    int args_size_bytes = 0;
-    for (wasm::ValueType type : sig_->parameters()) {
-      args_size_bytes += type.element_size_bytes();
-    }
-
-    // The return value is also passed via this buffer:
-    int return_size_bytes = 0;
-    for (wasm::ValueType type : sig_->returns()) {
-      return_size_bytes += type.element_size_bytes();
-    }
-
-    // Get a stack slot for the arguments.
-    Node* arg_buffer =
-        args_size_bytes == 0 && return_size_bytes == 0
-            ? mcgraph()->IntPtrConstant(0)
-            : graph()->NewNode(mcgraph()->machine()->StackSlot(
-                  std::max(args_size_bytes, return_size_bytes), 8));
-
-    // Now store all our arguments to the buffer.
-    int offset = 0;
-
-    for (int i = 0; i < param_count; ++i) {
-      wasm::ValueType type = sig_->GetParam(i);
-      // Start from the parameter with index 1 to drop the instance_node.
-      SetEffect(graph()->NewNode(GetSafeStoreOperator(offset, type), arg_buffer,
-                                 Int32Constant(offset), Param(i + 1), effect(),
-                                 control()));
-      offset += type.element_size_bytes();
-    }
-    DCHECK_EQ(args_size_bytes, offset);
-
-    // We are passing the raw arg_buffer here. To the GC and other parts, it
-    // looks like a Smi (lowest bit not set). In the runtime function however,
-    // don't call Smi::value on it, but just cast it to a byte pointer.
-    Node* parameters[] = {
-        graph()->NewNode(mcgraph()->common()->NumberConstant(func_index)),
-        arg_buffer};
-    BuildCallToRuntime(Runtime::kWasmRunInterpreter, parameters,
-                       arraysize(parameters));
-
-    // Read back the return value.
-    DCHECK_LT(sig_->return_count(), wasm::kV8MaxWasmFunctionMultiReturns);
-    size_t return_count = sig_->return_count();
-    if (return_count == 0) {
-      Return(Int32Constant(0));
-    } else {
-      base::SmallVector<Node*, 8> returns(return_count);
-      offset = 0;
-      for (size_t i = 0; i < return_count; ++i) {
-        wasm::ValueType type = sig_->GetReturn(i);
-        Node* val = SetEffect(
-            graph()->NewNode(GetSafeLoadOperator(offset, type), arg_buffer,
-                             Int32Constant(offset), effect(), control()));
-        returns[i] = val;
-        offset += type.element_size_bytes();
-      }
-      Return(VectorOf(returns));
-    }
-
-    if (ContainsInt64(sig_)) LowerInt64(kCalledFromWasm);
-  }
-
   void BuildJSToJSWrapper(Isolate* isolate) {
     int wasm_count = static_cast<int>(sig_->parameter_count());
 
@@ -6161,16 +6220,14 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
       int32_t return_count = static_cast<int32_t>(sig_->return_count());
       Node* size =
           graph()->NewNode(mcgraph()->common()->NumberConstant(return_count));
-      Node* result_fixed_array =
-          BuildCallToRuntime(Runtime::kWasmNewMultiReturnFixedArray, &size, 1);
+      jsval = BuildCallAllocateJSArray(size, context);
+      Node* result_fixed_array = BuildLoadArrayBackingStorage(jsval);
       for (unsigned i = 0; i < sig_->return_count(); ++i) {
         const auto& type = sig_->GetReturn(i);
         Node* elem = LOAD_FIXED_ARRAY_SLOT_ANY(fixed_array, i);
         Node* cast = ToJS(FromJS(elem, context, type), type);
         STORE_FIXED_ARRAY_SLOT_ANY(result_fixed_array, i, cast);
       }
-      jsval = BuildCallToRuntimeWithContext(Runtime::kWasmNewMultiReturnJSArray,
-                                            context, &result_fixed_array, 1);
     }
     Return(jsval);
   }
@@ -6262,7 +6319,11 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
  private:
   StubCallMode stub_mode_;
   SetOncePointer<Node> undefined_value_node_;
-  SetOncePointer<const Operator> allocate_heap_number_operator_;
+  SetOncePointer<const Operator> int32_to_heapnumber_operator_;
+  SetOncePointer<const Operator> tagged_non_smi_to_int32_operator_;
+  SetOncePointer<const Operator> float32_to_number_operator_;
+  SetOncePointer<const Operator> float64_to_number_operator_;
+  SetOncePointer<const Operator> tagged_to_float64_operator_;
   wasm::WasmFeatures enabled_features_;
   CallDescriptor* bigint_to_i64_descriptor_ = nullptr;
   CallDescriptor* i64_to_bigint_descriptor_ = nullptr;
@@ -6425,6 +6486,8 @@ std::pair<WasmImportCallKind, Handle<JSReceiver>> ResolveWasmImportCall(
   return std::make_pair(WasmImportCallKind::kUseCallBuiltin, callable);
 }
 
+namespace {
+
 wasm::WasmOpcode GetMathIntrinsicOpcode(WasmImportCallKind kind,
                                         const char** name_ptr) {
 #define CASE(name)                          \
@@ -6525,6 +6588,8 @@ wasm::WasmCompilationResult CompileWasmMathIntrinsic(
   return result;
 }
 
+}  // namespace
+
 wasm::WasmCompilationResult CompileWasmImportCallWrapper(
     wasm::WasmEngine* wasm_engine, wasm::CompilationEnv* env,
     WasmImportCallKind kind, const wasm::FunctionSig* sig,
@@ -6626,50 +6691,10 @@ wasm::WasmCode* CompileWasmCapiCallWrapper(wasm::WasmEngine* wasm_engine,
       result.tagged_parameter_slots,
       result.protected_instructions_data.as_vector(),
       result.source_positions.as_vector(), wasm::WasmCode::kWasmToCapiWrapper,
-      wasm::ExecutionTier::kNone);
+      wasm::ExecutionTier::kNone, wasm::kNoDebugging);
   return native_module->PublishCode(std::move(wasm_code));
 }
 
-wasm::WasmCompilationResult CompileWasmInterpreterEntry(
-    wasm::WasmEngine* wasm_engine, const wasm::WasmFeatures& enabled_features,
-    uint32_t func_index, const wasm::FunctionSig* sig) {
-  //----------------------------------------------------------------------------
-  // Create the Graph
-  //----------------------------------------------------------------------------
-  Zone zone(wasm_engine->allocator(), ZONE_NAME);
-  Graph* graph = new (&zone) Graph(&zone);
-  CommonOperatorBuilder* common = new (&zone) CommonOperatorBuilder(&zone);
-  MachineOperatorBuilder* machine = new (&zone) MachineOperatorBuilder(
-      &zone, MachineType::PointerRepresentation(),
-      InstructionSelector::SupportedMachineOperatorFlags(),
-      InstructionSelector::AlignmentRequirements());
-  MachineGraph* mcgraph = new (&zone) MachineGraph(graph, common, machine);
-
-  WasmWrapperGraphBuilder builder(&zone, mcgraph, sig, nullptr,
-                                  StubCallMode::kCallWasmRuntimeStub,
-                                  enabled_features);
-  builder.BuildWasmInterpreterEntry(func_index);
-
-  // Schedule and compile to machine code.
-  CallDescriptor* incoming = GetWasmCallDescriptor(&zone, sig);
-  if (machine->Is32()) {
-    incoming = GetI32WasmCallDescriptor(&zone, incoming);
-  }
-
-  EmbeddedVector<char, 32> func_name;
-  func_name.Truncate(
-      SNPrintF(func_name, "wasm-interpreter-entry#%d", func_index));
-
-  wasm::WasmCompilationResult result = Pipeline::GenerateCodeForWasmNativeStub(
-      wasm_engine, incoming, mcgraph, Code::WASM_INTERPRETER_ENTRY,
-      wasm::WasmCode::kInterpreterEntry, func_name.begin(),
-      WasmStubAssemblerOptions());
-  result.result_tier = wasm::ExecutionTier::kInterpreter;
-  result.kind = wasm::WasmCompilationResult::kInterpreterEntry;
-
-  return result;
-}
-
 MaybeHandle<Code> CompileJSToJSWrapper(Isolate* isolate,
                                        const wasm::FunctionSig* sig) {
   std::unique_ptr<Zone> zone =
@@ -6886,34 +6911,16 @@ wasm::WasmCompilationResult ExecuteTurbofanWasmCompilation(
       &info, wasm_engine, mcgraph, call_descriptor, source_positions,
       node_origins, func_body, env->module, func_index);
 
-  // TODO(bradnelson): Improve histogram handling of size_t.
-  counters->wasm_compile_function_peak_memory_bytes()->AddSample(
-      static_cast<int>(mcgraph->graph()->zone()->allocation_size()));
+  if (counters) {
+    counters->wasm_compile_function_peak_memory_bytes()->AddSample(
+        static_cast<int>(mcgraph->graph()->zone()->allocation_size()));
+  }
   auto result = info.ReleaseWasmCompilationResult();
   CHECK_NOT_NULL(result);  // Compilation expected to succeed.
   DCHECK_EQ(wasm::ExecutionTier::kTurbofan, result->result_tier);
   return std::move(*result);
 }
 
-wasm::WasmCompilationResult ExecuteInterpreterEntryCompilation(
-    wasm::WasmEngine* wasm_engine, wasm::CompilationEnv* env,
-    const wasm::FunctionBody& func_body, int func_index, Counters* counters,
-    wasm::WasmFeatures* detected) {
-  Zone zone(wasm_engine->allocator(), ZONE_NAME);
-  const wasm::WasmModule* module = env ? env->module : nullptr;
-  wasm::WasmFullDecoder<wasm::Decoder::kValidate, wasm::EmptyInterface> decoder(
-      &zone, module, env->enabled_features, detected, func_body);
-  decoder.Decode();
-  if (decoder.failed()) return wasm::WasmCompilationResult{};
-
-  wasm::WasmCompilationResult result = CompileWasmInterpreterEntry(
-      wasm_engine, env->enabled_features, func_index, func_body.sig);
-  DCHECK(result.succeeded());
-  DCHECK_EQ(wasm::ExecutionTier::kInterpreter, result.result_tier);
-
-  return result;
-}
-
 namespace {
 // Helper for allocating either an GP or FP reg, or the next stack slot.
 class LinkageLocationAllocator {
@@ -7028,18 +7035,19 @@ CallDescriptor* GetWasmCallDescriptor(
 
   CallDescriptor::Flags flags =
       use_retpoline ? CallDescriptor::kRetpoline : CallDescriptor::kNoFlags;
-  return new (zone) CallDescriptor(             // --
-      descriptor_kind,                          // kind
-      target_type,                              // target MachineType
-      target_loc,                               // target location
-      locations.Build(),                        // location_sig
-      parameter_slots,                          // stack_parameter_count
-      compiler::Operator::kNoProperties,        // properties
-      kCalleeSaveRegisters,                     // callee-saved registers
-      kCalleeSaveFPRegisters,                   // callee-saved fp regs
-      flags,                                    // flags
-      "wasm-call",                              // debug name
-      0,                                        // allocatable registers
+  return new (zone) CallDescriptor(       // --
+      descriptor_kind,                    // kind
+      target_type,                        // target MachineType
+      target_loc,                         // target location
+      locations.Build(),                  // location_sig
+      parameter_slots,                    // stack_parameter_count
+      compiler::Operator::kNoProperties,  // properties
+      kCalleeSaveRegisters,               // callee-saved registers
+      kCalleeSaveFPRegisters,             // callee-saved fp regs
+      flags,                              // flags
+      "wasm-call",                        // debug name
+      StackArgumentOrder::kDefault,       // order of the arguments in the stack
+      0,                                  // allocatable registers
       rets.NumStackSlots() - parameter_slots);  // stack_return_count
 }
 
@@ -7117,6 +7125,7 @@ CallDescriptor* ReplaceTypeInCallDescriptorWith(
       call_descriptor->CalleeSavedFPRegisters(),       // callee-saved fp regs
       call_descriptor->flags(),                        // flags
       call_descriptor->debug_name(),                   // debug name
+      call_descriptor->GetStackArgumentOrder(),        // stack order
       call_descriptor->AllocatableRegisters(),         // allocatable registers
       rets.NumStackSlots() - params.NumStackSlots());  // stack_return_count
 }
@@ -7153,6 +7162,7 @@ AssemblerOptions WasmStubAssemblerOptions() {
 }
 
 #undef FATAL_UNSUPPORTED_OPCODE
+#undef CALL_BUILTIN
 #undef WASM_INSTANCE_OBJECT_SIZE
 #undef WASM_INSTANCE_OBJECT_OFFSET
 #undef LOAD_INSTANCE_FIELD
diff --git a/deps/v8/src/compiler/wasm-compiler.h b/deps/v8/src/compiler/wasm-compiler.h
index 176fdb63c4d..078b3382dcc 100644
--- a/deps/v8/src/compiler/wasm-compiler.h
+++ b/deps/v8/src/compiler/wasm-compiler.h
@@ -54,10 +54,6 @@ wasm::WasmCompilationResult ExecuteTurbofanWasmCompilation(
     wasm::WasmEngine*, wasm::CompilationEnv*, const wasm::FunctionBody&,
     int func_index, Counters*, wasm::WasmFeatures* detected);
 
-wasm::WasmCompilationResult ExecuteInterpreterEntryCompilation(
-    wasm::WasmEngine*, wasm::CompilationEnv*, const wasm::FunctionBody&,
-    int func_index, Counters*, wasm::WasmFeatures* detected);
-
 // Calls to Wasm imports are handled in several different ways, depending on the
 // type of the target function/callable and whether the signature matches the
 // argument arity.
@@ -126,12 +122,6 @@ std::unique_ptr<OptimizedCompilationJob> NewJSToWasmCompilationJob(
     const wasm::FunctionSig* sig, bool is_import,
     const wasm::WasmFeatures& enabled_features);
 
-// Compiles a stub that redirects a call to a wasm function to the wasm
-// interpreter. It's ABI compatible with the compiled wasm function.
-V8_EXPORT_PRIVATE wasm::WasmCompilationResult CompileWasmInterpreterEntry(
-    wasm::WasmEngine*, const wasm::WasmFeatures& enabled_features,
-    uint32_t func_index, const wasm::FunctionSig*);
-
 // Compiles a stub with JS linkage that serves as an adapter for function
 // objects constructed via {WebAssembly.Function}. It performs a round-trip
 // simulating a JS-to-Wasm-to-JS coercion of parameter and return values.
@@ -172,6 +162,10 @@ class WasmGraphBuilder {
     kRetpoline = true,
     kNoRetpoline = false
   };
+  enum CheckForNull : bool {  // --
+    kWithNullCheck = true,
+    kWithoutNullCheck = false
+  };
 
   V8_EXPORT_PRIVATE WasmGraphBuilder(
       wasm::CompilationEnv* env, Zone* zone, MachineGraph* mcgraph,
@@ -197,6 +191,7 @@ class WasmGraphBuilder {
   Node* EffectPhi(unsigned count, Node** effects_and_control);
   Node* RefNull();
   Node* RefFunc(uint32_t function_index);
+  Node* RefAsNonNull(Node* arg, wasm::WasmCodePosition position);
   Node* Uint32Constant(uint32_t value);
   Node* Int32Constant(int32_t value);
   Node* Int64Constant(int64_t value);
@@ -255,7 +250,7 @@ class WasmGraphBuilder {
     Node* arr[] = {fst, more...};
     return Return(ArrayVector(arr));
   }
-  Node* Unreachable(wasm::WasmCodePosition position);
+  Node* Trap(wasm::TrapReason reason, wasm::WasmCodePosition position);
 
   Node* CallDirect(uint32_t index, Vector<Node*> args, Vector<Node*> rets,
                    wasm::WasmCodePosition position);
@@ -267,6 +262,9 @@ class WasmGraphBuilder {
                    wasm::WasmCodePosition position);
   Node* ReturnCallIndirect(uint32_t table_index, uint32_t sig_index,
                            Vector<Node*> args, wasm::WasmCodePosition position);
+  // Return value is not expected to be used,
+  // but we need it for compatibility with graph-builder-interface.
+  Node* BrOnNull(Node* ref_object, Node** non_null_node, Node** null_node);
 
   Node* Invert(Node* node);
 
@@ -286,9 +284,10 @@ class WasmGraphBuilder {
                 uint32_t offset, uint32_t alignment,
                 wasm::WasmCodePosition position);
 #if defined(V8_TARGET_BIG_ENDIAN) || defined(V8_TARGET_ARCH_S390_LE_SIM)
-  Node* LoadTransformBigEndian(MachineType memtype,
+  Node* LoadTransformBigEndian(wasm::ValueType type, MachineType memtype,
                                wasm::LoadTransformationKind transform,
-                               Node* value);
+                               Node* index, uint32_t offset, uint32_t alignment,
+                               wasm::WasmCodePosition position);
 #endif
   Node* LoadTransform(wasm::ValueType type, MachineType memtype,
                       wasm::LoadTransformationKind transform, Node* index,
@@ -321,14 +320,6 @@ class WasmGraphBuilder {
   void GetBaseAndOffsetForImportedMutableAnyRefGlobal(
       const wasm::WasmGlobal& global, Node** base, Node** offset);
 
-  void BoundsCheckTable(uint32_t table_index, Node* index,
-                        wasm::WasmCodePosition position,
-                        wasm::TrapReason trap_reason, Node** base_node);
-
-  void GetTableBaseAndOffset(uint32_t table_index, Node* index,
-                             wasm::WasmCodePosition position, Node** base_node,
-                             Node** offset_node);
-
   // Utilities to manipulate sets of instance cache nodes.
   void InitInstanceCache(WasmInstanceCacheNodes* instance_cache);
   void PrepareInstanceCacheForLoop(WasmInstanceCacheNodes* instance_cache,
@@ -385,6 +376,23 @@ class WasmGraphBuilder {
   Node* TableSize(uint32_t table_index);
   Node* TableFill(uint32_t table_index, Node* start, Node* value, Node* count);
 
+  Node* StructNew(uint32_t struct_index, const wasm::StructType* type,
+                  Vector<Node*> fields);
+  Node* StructGet(Node* struct_object, const wasm::StructType* struct_type,
+                  uint32_t field_index, CheckForNull null_check,
+                  wasm::WasmCodePosition position);
+  Node* StructSet(Node* struct_object, const wasm::StructType* struct_type,
+                  uint32_t field_index, Node* value, CheckForNull null_check,
+                  wasm::WasmCodePosition position);
+  Node* ArrayNew(uint32_t array_index, const wasm::ArrayType* type,
+                 Node* length, Node* initial_value);
+  void BoundsCheck(Node* array, Node* index, wasm::WasmCodePosition position);
+  Node* ArrayGet(Node* array_object, const wasm::ArrayType* type, Node* index,
+                 wasm::WasmCodePosition position);
+  Node* ArraySet(Node* array_object, const wasm::ArrayType* type, Node* index,
+                 Node* value, wasm::WasmCodePosition position);
+  Node* ArrayLen(Node* array_object, wasm::WasmCodePosition position);
+
   bool has_simd() const { return has_simd_; }
 
   wasm::UseTrapHandler use_trap_handler() const {
@@ -460,6 +468,7 @@ class WasmGraphBuilder {
   Node* BuildImportCall(const wasm::FunctionSig* sig, Vector<Node*> args,
                         Vector<Node*> rets, wasm::WasmCodePosition position,
                         Node* func_index, IsReturnCall continuation);
+  Node* GetBuiltinPointerTarget(int builtin_id);
 
   Node* BuildF32CopySign(Node* left, Node* right);
   Node* BuildF64CopySign(Node* left, Node* right);
diff --git a/deps/v8/src/d8/d8-platforms.cc b/deps/v8/src/d8/d8-platforms.cc
index 48ea3c94814..5ea43b14760 100644
--- a/deps/v8/src/d8/d8-platforms.cc
+++ b/deps/v8/src/d8/d8-platforms.cc
@@ -43,9 +43,17 @@ class PredictablePlatform : public Platform {
   int NumberOfWorkerThreads() override { return 0; }
 
   void CallOnWorkerThread(std::unique_ptr<Task> task) override {
-    // It's not defined when background tasks are being executed, so we can just
-    // execute them right away.
-    task->Run();
+    // We post worker tasks on the foreground task runner of the
+    // {kProcessGlobalPredictablePlatformWorkerTaskQueue} isolate. The task
+    // queue of the {kProcessGlobalPredictablePlatformWorkerTaskQueue} isolate
+    // is then executed on the main thread to achieve predictable behavior.
+    //
+    // In this context here it is okay to call {GetForegroundTaskRunner} from a
+    // background thread. The reason is that code is executed sequentially with
+    // the PredictablePlatform, and that the {DefaultPlatform} does not access
+    // the isolate but only uses it as the key in a HashMap.
+    GetForegroundTaskRunner(kProcessGlobalPredictablePlatformWorkerTaskQueue)
+        ->PostTask(std::move(task));
   }
 
   void CallDelayedOnWorkerThread(std::unique_ptr<Task> task,
diff --git a/deps/v8/src/d8/d8-platforms.h b/deps/v8/src/d8/d8-platforms.h
index a658f0a47cd..3d7d3f8cabe 100644
--- a/deps/v8/src/d8/d8-platforms.h
+++ b/deps/v8/src/d8/d8-platforms.h
@@ -10,6 +10,7 @@
 
 namespace v8 {
 
+class Isolate;
 class Platform;
 
 // Returns a predictable v8::Platform implementation.
@@ -24,6 +25,13 @@ std::unique_ptr<Platform> MakePredictablePlatform(
 std::unique_ptr<Platform> MakeDelayedTasksPlatform(
     std::unique_ptr<Platform> platform, int64_t random_seed);
 
+// We use the task queue of {kProcessGlobalPredictablePlatformWorkerTaskQueue}
+// for worker tasks of the {PredictablePlatform}. At the moment, {nullptr} is a
+// valid value for the isolate. If this ever changes, we either have to allocate
+// a core isolate, or refactor the implementation of worker tasks in the
+// {PredictablePlatform}.
+constexpr Isolate* kProcessGlobalPredictablePlatformWorkerTaskQueue = nullptr;
+
 }  // namespace v8
 
 #endif  // V8_D8_D8_PLATFORMS_H_
diff --git a/deps/v8/src/d8/d8.cc b/deps/v8/src/d8/d8.cc
index dd00c58288f..ad988f44d94 100644
--- a/deps/v8/src/d8/d8.cc
+++ b/deps/v8/src/d8/d8.cc
@@ -49,6 +49,7 @@
 #include "src/parsing/scanner-character-streams.h"
 #include "src/profiler/profile-generator.h"
 #include "src/sanitizer/msan.h"
+#include "src/snapshot/snapshot.h"
 #include "src/trap-handler/trap-handler.h"
 #include "src/utils/ostreams.h"
 #include "src/utils/utils.h"
@@ -443,6 +444,7 @@ std::unordered_set<std::shared_ptr<Worker>> Shell::running_workers_;
 std::atomic<bool> Shell::script_executed_{false};
 base::LazyMutex Shell::isolate_status_lock_;
 std::map<v8::Isolate*, bool> Shell::isolate_status_;
+std::map<v8::Isolate*, int> Shell::isolate_running_streaming_tasks_;
 base::LazyMutex Shell::cached_code_mutex_;
 std::map<std::string, std::unique_ptr<ScriptCompiler::CachedData>>
     Shell::cached_code_map_;
@@ -452,54 +454,6 @@ ArrayBuffer::Allocator* Shell::array_buffer_allocator;
 ShellOptions Shell::options;
 base::OnceType Shell::quit_once_ = V8_ONCE_INIT;
 
-// Dummy external source stream which returns the whole source in one go.
-class DummySourceStream : public v8::ScriptCompiler::ExternalSourceStream {
- public:
-  DummySourceStream(Local<String> source, Isolate* isolate) : done_(false) {
-    source_length_ = source->Utf8Length(isolate);
-    source_buffer_.reset(new uint8_t[source_length_]);
-    source->WriteUtf8(isolate, reinterpret_cast<char*>(source_buffer_.get()),
-                      source_length_);
-  }
-
-  size_t GetMoreData(const uint8_t** src) override {
-    if (done_) {
-      return 0;
-    }
-    *src = source_buffer_.release();
-    done_ = true;
-
-    return source_length_;
-  }
-
- private:
-  int source_length_;
-  std::unique_ptr<uint8_t[]> source_buffer_;
-  bool done_;
-};
-
-class BackgroundCompileThread : public base::Thread {
- public:
-  BackgroundCompileThread(Isolate* isolate, Local<String> source)
-      : base::Thread(GetThreadOptions("BackgroundCompileThread")),
-        source_(source),
-        streamed_source_(std::make_unique<DummySourceStream>(source, isolate),
-                         v8::ScriptCompiler::StreamedSource::UTF8),
-        task_(v8::ScriptCompiler::StartStreamingScript(isolate,
-                                                       &streamed_source_)) {}
-
-  void Run() override { task_->Run(); }
-
-  v8::ScriptCompiler::StreamedSource* streamed_source() {
-    return &streamed_source_;
-  }
-
- private:
-  Local<String> source_;
-  v8::ScriptCompiler::StreamedSource streamed_source_;
-  std::unique_ptr<v8::ScriptCompiler::ScriptStreamingTask> task_;
-};
-
 ScriptCompiler::CachedData* Shell::LookupCodeCache(Isolate* isolate,
                                                    Local<Value> source) {
   base::MutexGuard lock_guard(cached_code_mutex_.Pointer());
@@ -533,6 +487,61 @@ void Shell::StoreInCodeCache(Isolate* isolate, Local<Value> source,
                                      ScriptCompiler::CachedData::BufferOwned));
 }
 
+// Dummy external source stream which returns the whole source in one go.
+// TODO(leszeks): Also test chunking the data.
+class DummySourceStream : public v8::ScriptCompiler::ExternalSourceStream {
+ public:
+  explicit DummySourceStream(Local<String> source) : done_(false) {
+    source_buffer_ = Utils::OpenHandle(*source)->ToCString(
+        i::ALLOW_NULLS, i::FAST_STRING_TRAVERSAL, &source_length_);
+  }
+
+  size_t GetMoreData(const uint8_t** src) override {
+    if (done_) {
+      return 0;
+    }
+    *src = reinterpret_cast<uint8_t*>(source_buffer_.release());
+    done_ = true;
+
+    return source_length_;
+  }
+
+ private:
+  int source_length_;
+  std::unique_ptr<char[]> source_buffer_;
+  bool done_;
+};
+
+class StreamingCompileTask final : public v8::Task {
+ public:
+  StreamingCompileTask(Isolate* isolate,
+                       v8::ScriptCompiler::StreamedSource* streamed_source)
+      : isolate_(isolate),
+        script_streaming_task_(v8::ScriptCompiler::StartStreamingScript(
+            isolate, streamed_source)) {
+    Shell::NotifyStartStreamingTask(isolate_);
+  }
+
+  void Run() override {
+    script_streaming_task_->Run();
+    // Signal that the task has finished using the task runner to wake the
+    // message loop.
+    Shell::PostForegroundTask(isolate_, std::make_unique<FinishTask>(isolate_));
+  }
+
+ private:
+  class FinishTask final : public v8::Task {
+   public:
+    explicit FinishTask(Isolate* isolate) : isolate_(isolate) {}
+    void Run() final { Shell::NotifyFinishStreamingTask(isolate_); }
+    Isolate* isolate_;
+  };
+
+  Isolate* isolate_;
+  std::unique_ptr<v8::ScriptCompiler::ScriptStreamingTask>
+      script_streaming_task_;
+};
+
 // Executes a string within the current v8 context.
 bool Shell::ExecuteString(Isolate* isolate, Local<String> source,
                           Local<Value> name, PrintResult print_result,
@@ -544,16 +553,22 @@ bool Shell::ExecuteString(Isolate* isolate, Local<String> source,
     i::Handle<i::String> str = Utils::OpenHandle(*(source));
 
     // Set up ParseInfo.
-    i::ParseInfo parse_info(i_isolate);
-    parse_info.set_toplevel();
-    parse_info.set_allow_lazy_parsing();
-    parse_info.set_language_mode(
-        i::construct_language_mode(i::FLAG_use_strict));
-
-    i::Handle<i::Script> script =
-        parse_info.CreateScript(i_isolate, str, options.compile_options);
-    if (!i::parsing::ParseProgram(&parse_info, script, i::kNullMaybeHandle,
-                                  i_isolate)) {
+    i::UnoptimizedCompileState compile_state(i_isolate);
+
+    i::UnoptimizedCompileFlags flags =
+        i::UnoptimizedCompileFlags::ForToplevelCompile(
+            i_isolate, true, i::construct_language_mode(i::FLAG_use_strict),
+            i::REPLMode::kNo);
+
+    if (options.compile_options == v8::ScriptCompiler::kEagerCompile) {
+      flags.set_is_eager(true);
+    }
+
+    i::ParseInfo parse_info(i_isolate, flags, &compile_state);
+
+    i::Handle<i::Script> script = parse_info.CreateScript(
+        i_isolate, str, i::kNullMaybeHandle, ScriptOriginOptions());
+    if (!i::parsing::ParseProgram(&parse_info, script, i_isolate)) {
       fprintf(stderr, "Failed parsing\n");
       return false;
     }
@@ -588,23 +603,19 @@ bool Shell::ExecuteString(Isolate* isolate, Local<String> source,
         maybe_script = ScriptCompiler::Compile(
             context, &script_source, ScriptCompiler::kNoCompileOptions);
       }
-    } else if (options.stress_background_compile) {
-      // Start a background thread compiling the script.
-      BackgroundCompileThread background_compile_thread(isolate, source);
-      CHECK(background_compile_thread.Start());
+    } else if (options.streaming_compile) {
+      v8::ScriptCompiler::StreamedSource streamed_source(
+          std::make_unique<DummySourceStream>(source),
+          v8::ScriptCompiler::StreamedSource::UTF8);
 
-      // In parallel, compile on the main thread to flush out any data races.
-      {
-        TryCatch ignore_try_catch(isolate);
-        ScriptCompiler::Source script_source(source, origin);
-        USE(ScriptCompiler::Compile(context, &script_source,
-                                    ScriptCompiler::kNoCompileOptions));
-      }
+      PostBlockingBackgroundTask(
+          std::make_unique<StreamingCompileTask>(isolate, &streamed_source));
+
+      // Pump the loop until the streaming task completes.
+      Shell::CompleteMessageLoop(isolate);
 
-      // Join with background thread and finalize compilation.
-      background_compile_thread.Join();
-      maybe_script = v8::ScriptCompiler::Compile(
-          context, background_compile_thread.streamed_source(), source, origin);
+      maybe_script =
+          ScriptCompiler::Compile(context, &streamed_source, source, origin);
     } else {
       ScriptCompiler::Source script_source(source, origin);
       maybe_script = ScriptCompiler::Compile(context, &script_source,
@@ -2227,8 +2238,9 @@ void Shell::WriteLcovData(v8::Isolate* isolate, const char* file) {
 void Shell::OnExit(v8::Isolate* isolate) {
   // Dump basic block profiling data.
   if (i::FLAG_turbo_profiling) {
-    i::BasicBlockProfiler* profiler = i::BasicBlockProfiler::Get();
-    i::StdoutStream{} << *profiler;
+    i::StdoutStream out;
+    i::BasicBlockProfiler::Get()->Print(out,
+                                        reinterpret_cast<i::Isolate*>(isolate));
   }
   isolate->Dispose();
 
@@ -2239,7 +2251,7 @@ void Shell::OnExit(v8::Isolate* isolate) {
 
     if (i::FLAG_dump_counters_nvp) {
       // Dump counters as name-value pairs.
-      for (auto pair : counters) {
+      for (const auto& pair : counters) {
         std::string key = pair.first;
         Counter* counter = pair.second;
         if (counter->is_histogram()) {
@@ -2260,7 +2272,7 @@ void Shell::OnExit(v8::Isolate* isolate) {
                 << std::string(kValueBoxSize - 6, ' ') << "|\n";
       std::cout << "+" << std::string(kNameBoxSize, '-') << "+"
                 << std::string(kValueBoxSize, '-') << "+\n";
-      for (auto pair : counters) {
+      for (const auto& pair : counters) {
         std::string key = pair.first;
         Counter* counter = pair.second;
         if (counter->is_histogram()) {
@@ -2909,12 +2921,12 @@ bool Shell::SetOptions(int argc, char* argv[]) {
                strcmp(argv[i], "--no-stress-opt") == 0) {
       options.stress_opt = false;
       argv[i] = nullptr;
-    } else if (strcmp(argv[i], "--stress-background-compile") == 0) {
-      options.stress_background_compile = true;
+    } else if (strcmp(argv[i], "--stress-snapshot") == 0) {
+      options.stress_snapshot = true;
       argv[i] = nullptr;
-    } else if (strcmp(argv[i], "--nostress-background-compile") == 0 ||
-               strcmp(argv[i], "--no-stress-background-compile") == 0) {
-      options.stress_background_compile = false;
+    } else if (strcmp(argv[i], "--nostress-snapshot") == 0 ||
+               strcmp(argv[i], "--no-stress-snapshot") == 0) {
+      options.stress_snapshot = false;
       argv[i] = nullptr;
     } else if (strcmp(argv[i], "--noalways-opt") == 0 ||
                strcmp(argv[i], "--no-always-opt") == 0) {
@@ -2993,6 +3005,13 @@ bool Shell::SetOptions(int argc, char* argv[]) {
         return false;
       }
       argv[i] = nullptr;
+    } else if (strcmp(argv[i], "--streaming-compile") == 0) {
+      options.streaming_compile = true;
+      argv[i] = nullptr;
+    } else if ((strcmp(argv[i], "--no-streaming-compile") == 0) ||
+               (strcmp(argv[i], "--nostreaming-compile") == 0)) {
+      options.streaming_compile = false;
+      argv[i] = nullptr;
     } else if (strcmp(argv[i], "--enable-tracing") == 0) {
       options.trace_enabled = true;
       argv[i] = nullptr;
@@ -3080,7 +3099,7 @@ bool Shell::SetOptions(int argc, char* argv[]) {
   return true;
 }
 
-int Shell::RunMain(Isolate* isolate, int argc, char* argv[], bool last_run) {
+int Shell::RunMain(Isolate* isolate, bool last_run) {
   for (int i = 1; i < options.num_isolates; ++i) {
     options.isolate_sources[i].StartExecuteInThread();
   }
@@ -3108,6 +3127,18 @@ int Shell::RunMain(Isolate* isolate, int argc, char* argv[], bool last_run) {
       DisposeModuleEmbedderData(context);
     }
     WriteLcovData(isolate, options.lcov_file);
+    if (last_run && options.stress_snapshot) {
+      static constexpr bool kClearRecompilableData = true;
+      i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+      i::Handle<i::Context> i_context = Utils::OpenHandle(*context);
+      // TODO(jgruber,v8:10500): Don't deoptimize once we support serialization
+      // of optimized code.
+      i::Deoptimizer::DeoptimizeAll(i_isolate);
+      i::Snapshot::ClearReconstructableDataForSerialization(
+          i_isolate, kClearRecompilableData);
+      i::Snapshot::SerializeDeserializeAndVerifyForTesting(i_isolate,
+                                                           i_context);
+    }
   }
   CollectGarbage(isolate);
   for (int i = 1; i < options.num_isolates; ++i) {
@@ -3139,11 +3170,20 @@ void Shell::CollectGarbage(Isolate* isolate) {
 
 void Shell::SetWaitUntilDone(Isolate* isolate, bool value) {
   base::MutexGuard guard(isolate_status_lock_.Pointer());
-  if (isolate_status_.count(isolate) == 0) {
-    isolate_status_.insert(std::make_pair(isolate, value));
-  } else {
-    isolate_status_[isolate] = value;
-  }
+  isolate_status_[isolate] = value;
+}
+
+void Shell::NotifyStartStreamingTask(Isolate* isolate) {
+  DCHECK(options.streaming_compile);
+  base::MutexGuard guard(isolate_status_lock_.Pointer());
+  ++isolate_running_streaming_tasks_[isolate];
+}
+
+void Shell::NotifyFinishStreamingTask(Isolate* isolate) {
+  DCHECK(options.streaming_compile);
+  base::MutexGuard guard(isolate_status_lock_.Pointer());
+  --isolate_running_streaming_tasks_[isolate];
+  DCHECK_GE(isolate_running_streaming_tasks_[isolate], 0);
 }
 
 namespace {
@@ -3174,6 +3214,17 @@ bool ProcessMessages(
     while (v8::platform::PumpMessageLoop(g_default_platform, isolate,
                                          behavior())) {
       MicrotasksScope::PerformCheckpoint(isolate);
+
+      if (i::FLAG_verify_predictable) {
+        // In predictable mode we push all background tasks into the foreground
+        // task queue of the {kProcessGlobalPredictablePlatformWorkerTaskQueue}
+        // isolate. We execute the tasks after one foreground task has been
+        // executed.
+        while (v8::platform::PumpMessageLoop(
+            g_default_platform,
+            kProcessGlobalPredictablePlatformWorkerTaskQueue, behavior())) {
+        }
+      }
     }
     if (g_default_platform->IdleTasksEnabled(isolate)) {
       v8::platform::RunIdleTasks(g_default_platform, isolate,
@@ -3198,7 +3249,8 @@ bool Shell::CompleteMessageLoop(Isolate* isolate) {
     i::wasm::WasmEngine* wasm_engine = i_isolate->wasm_engine();
     bool should_wait = (options.wait_for_wasm &&
                         wasm_engine->HasRunningCompileJob(i_isolate)) ||
-                       isolate_status_[isolate];
+                       isolate_status_[isolate] ||
+                       isolate_running_streaming_tasks_[isolate] > 0;
     return should_wait ? platform::MessageLoopBehavior::kWaitForWork
                        : platform::MessageLoopBehavior::kDoNotWait;
   };
@@ -3210,6 +3262,15 @@ bool Shell::EmptyMessageQueues(Isolate* isolate) {
       isolate, []() { return platform::MessageLoopBehavior::kDoNotWait; });
 }
 
+void Shell::PostForegroundTask(Isolate* isolate, std::unique_ptr<Task> task) {
+  g_default_platform->GetForegroundTaskRunner(isolate)->PostTask(
+      std::move(task));
+}
+
+void Shell::PostBlockingBackgroundTask(std::unique_ptr<Task> task) {
+  g_default_platform->CallBlockingTaskOnWorkerThread(std::move(task));
+}
+
 class Serializer : public ValueSerializer::Delegate {
  public:
   explicit Serializer(Isolate* isolate)
@@ -3675,7 +3736,7 @@ int Shell::Main(int argc, char* argv[]) {
                options.stress_runs);
         D8Testing::PrepareStressRun(i);
         bool last_run = i == options.stress_runs - 1;
-        result = RunMain(isolate, argc, argv, last_run);
+        result = RunMain(isolate, last_run);
       }
       printf("======== Full Deoptimization =======\n");
       D8Testing::DeoptimizeAll(isolate);
@@ -3685,7 +3746,7 @@ int Shell::Main(int argc, char* argv[]) {
         printf("============ Run %d/%d ============\n", i + 1,
                options.stress_runs);
         bool last_run = i == options.stress_runs - 1;
-        result = RunMain(isolate, argc, argv, last_run);
+        result = RunMain(isolate, last_run);
       }
     } else if (options.code_cache_options !=
                ShellOptions::CodeCacheOptions::kNoProduceCache) {
@@ -3702,7 +3763,7 @@ int Shell::Main(int argc, char* argv[]) {
         PerIsolateData data(isolate2);
         Isolate::Scope isolate_scope(isolate2);
 
-        result = RunMain(isolate2, argc, argv, false);
+        result = RunMain(isolate2, false);
       }
       isolate2->Dispose();
 
@@ -3715,11 +3776,11 @@ int Shell::Main(int argc, char* argv[]) {
 
       printf("============ Run: Consume code cache ============\n");
       // Second run to consume the cache in current isolate
-      result = RunMain(isolate, argc, argv, true);
+      result = RunMain(isolate, true);
       options.compile_options = v8::ScriptCompiler::kNoCompileOptions;
     } else {
       bool last_run = true;
-      result = RunMain(isolate, argc, argv, last_run);
+      result = RunMain(isolate, last_run);
     }
 
     // Run interactive shell if explicitly requested or if no script has been
diff --git a/deps/v8/src/d8/d8.h b/deps/v8/src/d8/d8.h
index 2d27f62e588..1b100f391bb 100644
--- a/deps/v8/src/d8/d8.h
+++ b/deps/v8/src/d8/d8.h
@@ -268,6 +268,7 @@ class ShellOptions {
   bool wait_for_wasm = true;
   bool stress_opt = false;
   int stress_runs = 1;
+  bool stress_snapshot = false;
   bool interactive_shell = false;
   bool test_shell = false;
   bool expected_to_throw = false;
@@ -278,8 +279,8 @@ class ShellOptions {
   int num_isolates = 1;
   v8::ScriptCompiler::CompileOptions compile_options =
       v8::ScriptCompiler::kNoCompileOptions;
-  bool stress_background_compile = false;
   CodeCacheOptions code_cache_options = CodeCacheOptions::kNoProduceCache;
+  bool streaming_compile = false;
   SourceGroup* isolate_sources = nullptr;
   const char* icu_data_file = nullptr;
   const char* icu_locale = nullptr;
@@ -323,7 +324,7 @@ class Shell : public i::AllStatic {
   static void ReportException(Isolate* isolate, TryCatch* try_catch);
   static Local<String> ReadFile(Isolate* isolate, const char* name);
   static Local<Context> CreateEvaluationContext(Isolate* isolate);
-  static int RunMain(Isolate* isolate, int argc, char* argv[], bool last_run);
+  static int RunMain(Isolate* isolate, bool last_run);
   static int Main(int argc, char* argv[]);
   static void Exit(int exit_code);
   static void OnExit(Isolate* isolate);
@@ -331,6 +332,9 @@ class Shell : public i::AllStatic {
   static bool EmptyMessageQueues(Isolate* isolate);
   static bool CompleteMessageLoop(Isolate* isolate);
 
+  static void PostForegroundTask(Isolate* isolate, std::unique_ptr<Task> task);
+  static void PostBlockingBackgroundTask(std::unique_ptr<Task> task);
+
   static std::unique_ptr<SerializationData> SerializeValue(
       Isolate* isolate, Local<Value> value, Local<Value> transfer);
   static MaybeLocal<Value> DeserializeValue(
@@ -446,6 +450,8 @@ class Shell : public i::AllStatic {
   static ArrayBuffer::Allocator* array_buffer_allocator;
 
   static void SetWaitUntilDone(Isolate* isolate, bool value);
+  static void NotifyStartStreamingTask(Isolate* isolate);
+  static void NotifyFinishStreamingTask(Isolate* isolate);
 
   static char* ReadCharsFromTcpPort(const char* name, int* size_out);
 
@@ -506,6 +512,7 @@ class Shell : public i::AllStatic {
   // the isolate_status_ needs to be concurrency-safe.
   static base::LazyMutex isolate_status_lock_;
   static std::map<Isolate*, bool> isolate_status_;
+  static std::map<Isolate*, int> isolate_running_streaming_tasks_;
 
   static base::LazyMutex cached_code_mutex_;
   static std::map<std::string, std::unique_ptr<ScriptCompiler::CachedData>>
diff --git a/deps/v8/src/debug/debug-evaluate.cc b/deps/v8/src/debug/debug-evaluate.cc
index fcf9b8448a8..cd0d227935d 100644
--- a/deps/v8/src/debug/debug-evaluate.cc
+++ b/deps/v8/src/debug/debug-evaluate.cc
@@ -256,7 +256,7 @@ bool IntrinsicHasNoSideEffect(Runtime::FunctionId id) {
 // Use macro to include only the non-inlined version of an intrinsic.
 #define INTRINSIC_WHITELIST(V)                \
   /* Conversions */                           \
-  V(NumberToString)                           \
+  V(NumberToStringSlow)                       \
   V(ToBigInt)                                 \
   V(ToLength)                                 \
   V(ToNumber)                                 \
@@ -313,7 +313,6 @@ bool IntrinsicHasNoSideEffect(Runtime::FunctionId id) {
   V(ArrayIncludes_Slow)                       \
   V(ArrayIndexOf)                             \
   V(ArrayIsArray)                             \
-  V(ClassOf)                                  \
   V(GetFunctionName)                          \
   V(GetOwnPropertyDescriptor)                 \
   V(GlobalPrint)                              \
@@ -673,7 +672,6 @@ DebugInfo::SideEffectState BuiltinGetSideEffectState(Builtins::Name id) {
     case Builtins::kMathMax:
     case Builtins::kMathMin:
     case Builtins::kMathPow:
-    case Builtins::kMathRandom:
     case Builtins::kMathRound:
     case Builtins::kMathSign:
     case Builtins::kMathSin:
@@ -782,11 +780,6 @@ DebugInfo::SideEffectState BuiltinGetSideEffectState(Builtins::Name id) {
     case Builtins::kFunctionPrototypeApply:
     // Error builtins.
     case Builtins::kErrorConstructor:
-    case Builtins::kMakeError:
-    case Builtins::kMakeTypeError:
-    case Builtins::kMakeSyntaxError:
-    case Builtins::kMakeRangeError:
-    case Builtins::kMakeURIError:
     // RegExp builtins.
     case Builtins::kRegExpConstructor:
     // Internal.
diff --git a/deps/v8/src/debug/debug-frames.cc b/deps/v8/src/debug/debug-frames.cc
index 19178d34ce0..3f79f5ee3f8 100644
--- a/deps/v8/src/debug/debug-frames.cc
+++ b/deps/v8/src/debug/debug-frames.cc
@@ -43,12 +43,6 @@ FrameInspector::FrameInspector(StandardFrame* frame, int inlined_frame_index,
     DCHECK_NOT_NULL(js_frame);
     deoptimized_frame_.reset(Deoptimizer::DebuggerInspectableFrame(
         js_frame, inlined_frame_index, isolate));
-  } else if (frame_->is_wasm_interpreter_entry()) {
-    wasm_interpreted_frame_ =
-        WasmInterpreterEntryFrame::cast(frame_)
-            ->debug_info()
-            .GetInterpretedFrame(frame_->fp(), inlined_frame_index);
-    DCHECK(wasm_interpreted_frame_);
   }
 }
 
@@ -63,14 +57,11 @@ JavaScriptFrame* FrameInspector::javascript_frame() {
 
 int FrameInspector::GetParametersCount() {
   if (is_optimized_) return deoptimized_frame_->parameters_count();
-  if (wasm_interpreted_frame_)
-    return wasm_interpreted_frame_->GetParameterCount();
   return frame_->ComputeParametersCount();
 }
 
 Handle<Object> FrameInspector::GetParameter(int index) {
   if (is_optimized_) return deoptimized_frame_->GetParameter(index);
-  // TODO(clemensb): Handle wasm_interpreted_frame_.
   return handle(frame_->GetParameter(index), isolate_);
 }
 
diff --git a/deps/v8/src/debug/debug-frames.h b/deps/v8/src/debug/debug-frames.h
index 78248614e20..541ee1dc1d3 100644
--- a/deps/v8/src/debug/debug-frames.h
+++ b/deps/v8/src/debug/debug-frames.h
@@ -11,13 +11,13 @@
 #include "src/execution/isolate.h"
 #include "src/execution/v8threads.h"
 #include "src/objects/objects.h"
-#include "src/wasm/wasm-interpreter.h"
 
 namespace v8 {
 namespace internal {
 
 class JavaScriptFrame;
 class StandardFrame;
+class WasmFrame;
 
 class FrameInspector {
  public:
@@ -52,7 +52,6 @@ class FrameInspector {
   StandardFrame* frame_;
   int inlined_frame_index_;
   std::unique_ptr<DeoptimizedFrameInfo> deoptimized_frame_;
-  wasm::WasmInterpreter::FramePtr wasm_interpreted_frame_;
   Isolate* isolate_;
   Handle<Script> script_;
   Handle<Object> receiver_;
diff --git a/deps/v8/src/debug/debug-interface.h b/deps/v8/src/debug/debug-interface.h
index f6cfe31d32d..3a46cf9b391 100644
--- a/deps/v8/src/debug/debug-interface.h
+++ b/deps/v8/src/debug/debug-interface.h
@@ -10,9 +10,9 @@
 #include "include/v8-inspector.h"
 #include "include/v8-util.h"
 #include "include/v8.h"
-
 #include "src/common/globals.h"
 #include "src/debug/interface-types.h"
+#include "src/utils/vector.h"
 
 namespace v8 {
 
@@ -173,6 +173,9 @@ class WasmScript : public Script {
  public:
   static WasmScript* Cast(Script* script);
 
+  enum class DebugSymbolsType { None, SourceMap, EmbeddedDWARF, ExternalDWARF };
+  DebugSymbolsType GetDebugSymbolType() const;
+  MemorySpan<const char> ExternalSymbolsURL() const;
   int NumFunctions() const;
   int NumImportedFunctions() const;
   MemorySpan<const uint8_t> Bytecode() const;
@@ -446,6 +449,7 @@ class V8_EXPORT_PRIVATE ScopeIterator {
 
 class V8_EXPORT_PRIVATE StackTraceIterator {
  public:
+  static bool SupportsWasmDebugEvaluate();
   static std::unique_ptr<StackTraceIterator> Create(Isolate* isolate,
                                                     int index = 0);
   StackTraceIterator() = default;
@@ -466,6 +470,8 @@ class V8_EXPORT_PRIVATE StackTraceIterator {
   virtual bool Restart() = 0;
   virtual v8::MaybeLocal<v8::Value> Evaluate(v8::Local<v8::String> source,
                                              bool throw_on_side_effect) = 0;
+  virtual v8::MaybeLocal<v8::String> EvaluateWasm(
+      internal::Vector<const internal::byte> source, int frame_index) = 0;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(StackTraceIterator);
@@ -587,6 +593,23 @@ class PropertyIterator {
   virtual bool is_array_index() = 0;
 };
 
+// Wrapper around v8::internal::WasmValue.
+class V8_EXPORT_PRIVATE WasmValue : public v8::Value {
+ public:
+  static bool IsWasmValue(v8::Local<v8::Value> obj);
+  V8_INLINE static WasmValue* Cast(v8::Value* obj);
+  int value_type();
+  // Get the underlying values as a byte array, this is only valid if value_type
+  // is i32, i64, f32, f64, or s128.
+  v8::Local<v8::Array> bytes();
+  // Get the underlying anyref, only valid if value_type is anyref.
+  v8::Local<v8::Value> ref();
+
+ private:
+  WasmValue();
+  static void CheckCast(v8::Value* obj);
+};
+
 AccessorPair* AccessorPair::Cast(v8::Value* value) {
 #ifdef V8_ENABLE_CHECKS
   CheckCast(value);
@@ -594,6 +617,13 @@ AccessorPair* AccessorPair::Cast(v8::Value* value) {
   return static_cast<AccessorPair*>(value);
 }
 
+WasmValue* WasmValue::Cast(v8::Value* value) {
+#ifdef V8_ENABLE_CHECKS
+  CheckCast(value);
+#endif
+  return static_cast<WasmValue*>(value);
+}
+
 MaybeLocal<Message> GetMessageFromPromise(Local<Promise> promise);
 
 }  // namespace debug
diff --git a/deps/v8/src/debug/debug-scope-iterator.cc b/deps/v8/src/debug/debug-scope-iterator.cc
index 28d8ed0c8f6..ab3191d11d2 100644
--- a/deps/v8/src/debug/debug-scope-iterator.cc
+++ b/deps/v8/src/debug/debug-scope-iterator.cc
@@ -129,12 +129,10 @@ bool DebugScopeIterator::SetVariableValue(v8::Local<v8::String> name,
 }
 
 DebugWasmScopeIterator::DebugWasmScopeIterator(Isolate* isolate,
-                                               StandardFrame* frame,
-                                               int inlined_frame_index)
+                                               WasmFrame* frame)
     : isolate_(isolate),
       frame_(frame),
-      inlined_frame_index_(inlined_frame_index),
-      type_(debug::ScopeIterator::ScopeTypeGlobal) {}
+      type_(debug::ScopeIterator::ScopeTypeModule) {}
 
 bool DebugWasmScopeIterator::Done() {
   return type_ == debug::ScopeIterator::ScopeTypeWith;
@@ -143,8 +141,11 @@ bool DebugWasmScopeIterator::Done() {
 void DebugWasmScopeIterator::Advance() {
   DCHECK(!Done());
   switch (type_) {
-    case ScopeTypeGlobal:
-      type_ = debug::ScopeIterator::ScopeTypeLocal;
+    case ScopeTypeModule:
+      // Skip local scope and expression stack scope if the frame is not
+      // inspectable.
+      type_ = frame_->is_inspectable() ? debug::ScopeIterator::ScopeTypeLocal
+                                       : debug::ScopeIterator::ScopeTypeWith;
       break;
     case ScopeTypeLocal:
       type_ = debug::ScopeIterator::ScopeTypeWasmExpressionStack;
@@ -166,36 +167,20 @@ v8::debug::ScopeIterator::ScopeType DebugWasmScopeIterator::GetType() {
 v8::Local<v8::Object> DebugWasmScopeIterator::GetObject() {
   DCHECK(!Done());
   switch (type_) {
-    case debug::ScopeIterator::ScopeTypeGlobal: {
+    case debug::ScopeIterator::ScopeTypeModule: {
       Handle<WasmInstanceObject> instance =
           FrameSummary::GetTop(frame_).AsWasm().wasm_instance();
-      return Utils::ToLocal(wasm::GetGlobalScopeObject(instance));
+      return Utils::ToLocal(wasm::GetModuleScopeObject(instance));
     }
     case debug::ScopeIterator::ScopeTypeLocal: {
-      if (frame_->is_wasm_interpreter_entry()) {
-        Handle<WasmDebugInfo> debug_info(
-            WasmInterpreterEntryFrame::cast(frame_)->debug_info(), isolate_);
-        return Utils::ToLocal(WasmDebugInfo::GetLocalScopeObject(
-            debug_info, frame_->fp(), inlined_frame_index_));
-      }
-      // Compiled code.
-      DCHECK(frame_->is_wasm_compiled());
-      wasm::DebugInfo* debug_info =
-          WasmCompiledFrame::cast(frame_)->native_module()->GetDebugInfo();
+      DCHECK(frame_->is_wasm());
+      wasm::DebugInfo* debug_info = frame_->native_module()->GetDebugInfo();
       return Utils::ToLocal(debug_info->GetLocalScopeObject(
           isolate_, frame_->pc(), frame_->fp(), frame_->callee_fp()));
     }
     case debug::ScopeIterator::ScopeTypeWasmExpressionStack: {
-      if (frame_->is_wasm_interpreter_entry()) {
-        Handle<WasmDebugInfo> debug_info(
-            WasmInterpreterEntryFrame::cast(frame_)->debug_info(), isolate_);
-        return Utils::ToLocal(WasmDebugInfo::GetStackScopeObject(
-            debug_info, frame_->fp(), inlined_frame_index_));
-      }
-      // Compiled code.
-      DCHECK(frame_->is_wasm_compiled());
-      wasm::DebugInfo* debug_info =
-          WasmCompiledFrame::cast(frame_)->native_module()->GetDebugInfo();
+      DCHECK(frame_->is_wasm());
+      wasm::DebugInfo* debug_info = frame_->native_module()->GetDebugInfo();
       return Utils::ToLocal(debug_info->GetStackScopeObject(
           isolate_, frame_->pc(), frame_->fp(), frame_->callee_fp()));
     }
diff --git a/deps/v8/src/debug/debug-scope-iterator.h b/deps/v8/src/debug/debug-scope-iterator.h
index 44d6c498602..a2b5ebcdf81 100644
--- a/deps/v8/src/debug/debug-scope-iterator.h
+++ b/deps/v8/src/debug/debug-scope-iterator.h
@@ -39,8 +39,7 @@ class DebugScopeIterator final : public debug::ScopeIterator {
 
 class DebugWasmScopeIterator final : public debug::ScopeIterator {
  public:
-  DebugWasmScopeIterator(Isolate* isolate, StandardFrame* frame,
-                         int inlined_frame_index);
+  DebugWasmScopeIterator(Isolate* isolate, WasmFrame* frame);
 
   bool Done() override;
   void Advance() override;
@@ -56,8 +55,7 @@ class DebugWasmScopeIterator final : public debug::ScopeIterator {
                         v8::Local<v8::Value> value) override;
  private:
   Isolate* isolate_;
-  StandardFrame* frame_;
-  int inlined_frame_index_;
+  WasmFrame* frame_;
   ScopeType type_;
 };
 }  // namespace internal
diff --git a/deps/v8/src/debug/debug-scopes.cc b/deps/v8/src/debug/debug-scopes.cc
index c5061ecb81a..6b838a69af0 100644
--- a/deps/v8/src/debug/debug-scopes.cc
+++ b/deps/v8/src/debug/debug-scopes.cc
@@ -40,7 +40,7 @@ ScopeIterator::ScopeIterator(Isolate* isolate, FrameInspector* frame_inspector,
   TryParseAndRetrieveScopes(strategy);
 }
 
-ScopeIterator::~ScopeIterator() { delete info_; }
+ScopeIterator::~ScopeIterator() = default;
 
 Handle<Object> ScopeIterator::GetFunctionDebugName() const {
   if (!function_.is_null()) return JSFunction::GetDebugName(function_);
@@ -236,37 +236,43 @@ void ScopeIterator::TryParseAndRetrieveScopes(ReparseStrategy strategy) {
   // Depending on the choosen strategy, the whole script or just
   // the closure is re-parsed for function scopes.
   Handle<Script> script(Script::cast(shared_info->script()), isolate_);
-  if (scope_info->scope_type() == FUNCTION_SCOPE &&
-      strategy == ReparseStrategy::kFunctionLiteral) {
-    info_ = new ParseInfo(isolate_, *shared_info);
-  } else {
-    info_ = new ParseInfo(isolate_, *script);
-    info_->set_eager();
-  }
+
+  // Pick between flags for a single function compilation, or an eager
+  // compilation of the whole script.
+  UnoptimizedCompileFlags flags =
+      (scope_info->scope_type() == FUNCTION_SCOPE &&
+       strategy == ReparseStrategy::kFunctionLiteral)
+          ? UnoptimizedCompileFlags::ForFunctionCompile(isolate_, *shared_info)
+          : UnoptimizedCompileFlags::ForScriptCompile(isolate_, *script)
+                .set_is_eager(true);
 
   MaybeHandle<ScopeInfo> maybe_outer_scope;
   if (scope_info->scope_type() == EVAL_SCOPE || script->is_wrapped()) {
-    info_->set_eval();
+    flags.set_is_eval(true);
     if (!context_->IsNativeContext()) {
       maybe_outer_scope = handle(context_->scope_info(), isolate_);
     }
     // Language mode may be inherited from the eval caller.
     // Retrieve it from shared function info.
-    info_->set_language_mode(shared_info->language_mode());
+    flags.set_outer_language_mode(shared_info->language_mode());
   } else if (scope_info->scope_type() == MODULE_SCOPE) {
-    DCHECK(info_->is_module());
+    DCHECK(flags.is_module());
   } else {
     DCHECK(scope_info->scope_type() == SCRIPT_SCOPE ||
            scope_info->scope_type() == FUNCTION_SCOPE);
   }
 
+  UnoptimizedCompileState compile_state(isolate_);
+
+  info_ = std::make_unique<ParseInfo>(isolate_, flags, &compile_state);
+
   const bool parse_result =
-      info_->is_toplevel()
-          ? parsing::ParseProgram(info_, script, maybe_outer_scope, isolate_)
-          : parsing::ParseFunction(info_, shared_info, isolate_);
+      flags.is_toplevel()
+          ? parsing::ParseProgram(info_.get(), script, maybe_outer_scope,
+                                  isolate_)
+          : parsing::ParseFunction(info_.get(), shared_info, isolate_);
 
-  if (parse_result && Rewriter::Rewrite(info_)) {
-    info_->ast_value_factory()->Internalize(isolate_);
+  if (parse_result) {
     DeclarationScope* literal_scope = info_->literal()->scope();
 
     ScopeChainRetriever scope_chain_retriever(literal_scope, function_,
@@ -280,10 +286,12 @@ void ScopeIterator::TryParseAndRetrieveScopes(ReparseStrategy strategy) {
                          ? scope_chain_retriever.ClosureScope()
                          : literal_scope;
 
-    CHECK(DeclarationScope::Analyze(info_));
     if (ignore_nested_scopes) {
       current_scope_ = closure_scope_;
       start_scope_ = current_scope_;
+      // ignore_nested_scopes is only used for the return-position breakpoint,
+      // so we can safely assume that the closure context for the current
+      // function exists if it needs one.
       if (closure_scope_->NeedsContext()) {
         context_ = handle(context_->closure_context(), isolate_);
       }
@@ -305,7 +313,7 @@ void ScopeIterator::TryParseAndRetrieveScopes(ReparseStrategy strategy) {
 }
 
 void ScopeIterator::UnwrapEvaluationContext() {
-  if (context_->is_null() || !context_->IsDebugEvaluateContext()) return;
+  if (!context_->IsDebugEvaluateContext()) return;
   Context current = *context_;
   do {
     Object wrapped = current.get(Context::WRAPPED_CONTEXT_INDEX);
@@ -374,11 +382,25 @@ bool ScopeIterator::DeclaresLocals(Mode mode) const {
 }
 
 bool ScopeIterator::HasContext() const {
-  return !InInnerScope() || current_scope_->NeedsContext();
+  return !InInnerScope() || NeedsAndHasContext();
+}
+
+bool ScopeIterator::NeedsAndHasContext() const {
+  if (!current_scope_->NeedsContext()) return false;
+  // Generally, if a scope needs a context, then we can assume that it has a
+  // context. However, the stack check during function entry happens before the
+  // function has a chance to create and push its own context, so we must check
+  // for the case where the function is executing in its parent context. This
+  // case is only possible in function scopes; top-level code (modules and
+  // non-module scripts) begin execution in the context they need and don't have
+  // a separate step to push the correct context.
+  return !(current_scope_ == closure_scope_ &&
+           current_scope_->is_function_scope() && !function_.is_null() &&
+           function_->context() == *context_);
 }
 
 void ScopeIterator::AdvanceOneScope() {
-  if (current_scope_->NeedsContext()) {
+  if (NeedsAndHasContext()) {
     DCHECK(!context_->previous().is_null());
     context_ = handle(context_->previous(), isolate_);
   }
@@ -406,7 +428,7 @@ void ScopeIterator::AdvanceContext() {
 
     current_scope_ = current_scope_->outer_scope();
     CollectLocalsFromCurrentScope();
-  } while (!current_scope_->NeedsContext());
+  } while (!NeedsAndHasContext());
 }
 
 void ScopeIterator::Next() {
@@ -422,22 +444,23 @@ void ScopeIterator::Next() {
     return;
   }
 
-  bool inner = InInnerScope();
-  if (current_scope_ == closure_scope_) function_ = Handle<JSFunction>();
+  bool leaving_closure = current_scope_ == closure_scope_;
 
   if (scope_type == ScopeTypeScript) {
-    DCHECK_IMPLIES(InInnerScope(), current_scope_->is_script_scope());
+    DCHECK_IMPLIES(InInnerScope() && !leaving_closure,
+                   current_scope_->is_script_scope());
     seen_script_scope_ = true;
     if (context_->IsScriptContext()) {
       context_ = handle(context_->previous(), isolate_);
     }
-  } else if (!inner) {
+  } else if (!InInnerScope()) {
     AdvanceContext();
   } else {
     DCHECK_NOT_NULL(current_scope_);
     AdvanceToNonHiddenScope();
 
-    if (!InInnerScope() && current_scope_ != closure_scope_) {
+    if (leaving_closure) {
+      DCHECK(current_scope_ != closure_scope_);
       // Edge case when we just go past {closure_scope_}. This case
       // already needs to start collecting locals for the blacklist.
       locals_ = StringSet::New(isolate_);
@@ -445,6 +468,8 @@ void ScopeIterator::Next() {
     }
   }
 
+  if (leaving_closure) function_ = Handle<JSFunction>();
+
   UnwrapEvaluationContext();
 }
 
@@ -454,34 +479,29 @@ ScopeIterator::ScopeType ScopeIterator::Type() const {
   if (InInnerScope()) {
     switch (current_scope_->scope_type()) {
       case FUNCTION_SCOPE:
-        DCHECK_IMPLIES(current_scope_->NeedsContext(),
+        DCHECK_IMPLIES(NeedsAndHasContext(),
                        context_->IsFunctionContext() ||
                            context_->IsDebugEvaluateContext());
         return ScopeTypeLocal;
       case MODULE_SCOPE:
-        DCHECK_IMPLIES(current_scope_->NeedsContext(),
-                       context_->IsModuleContext());
+        DCHECK_IMPLIES(NeedsAndHasContext(), context_->IsModuleContext());
         return ScopeTypeModule;
       case SCRIPT_SCOPE:
-        DCHECK_IMPLIES(
-            current_scope_->NeedsContext(),
-            context_->IsScriptContext() || context_->IsNativeContext());
+        DCHECK_IMPLIES(NeedsAndHasContext(), context_->IsScriptContext() ||
+                                                 context_->IsNativeContext());
         return ScopeTypeScript;
       case WITH_SCOPE:
-        DCHECK_IMPLIES(current_scope_->NeedsContext(),
-                       context_->IsWithContext());
+        DCHECK_IMPLIES(NeedsAndHasContext(), context_->IsWithContext());
         return ScopeTypeWith;
       case CATCH_SCOPE:
         DCHECK(context_->IsCatchContext());
         return ScopeTypeCatch;
       case BLOCK_SCOPE:
       case CLASS_SCOPE:
-        DCHECK_IMPLIES(current_scope_->NeedsContext(),
-                       context_->IsBlockContext());
+        DCHECK_IMPLIES(NeedsAndHasContext(), context_->IsBlockContext());
         return ScopeTypeBlock;
       case EVAL_SCOPE:
-        DCHECK_IMPLIES(current_scope_->NeedsContext(),
-                       context_->IsEvalContext());
+        DCHECK_IMPLIES(NeedsAndHasContext(), context_->IsEvalContext());
         return ScopeTypeEval;
     }
     UNREACHABLE();
@@ -583,7 +603,7 @@ bool ScopeIterator::SetVariableValue(Handle<String> name,
         DCHECK_EQ(ScopeTypeLocal, Type());
         if (SetLocalVariableValue(name, value)) return true;
         // There may not be an associated context since we're InInnerScope().
-        if (!current_scope_->NeedsContext()) return false;
+        if (!NeedsAndHasContext()) return false;
       } else {
         DCHECK_EQ(ScopeTypeClosure, Type());
         if (SetContextVariableValue(name, value)) return true;
@@ -627,7 +647,7 @@ void ScopeIterator::DebugPrint() {
 
     case ScopeIterator::ScopeTypeLocal: {
       os << "Local:\n";
-      if (current_scope_->NeedsContext()) {
+      if (NeedsAndHasContext()) {
         context_->Print(os);
         if (context_->has_extension()) {
           Handle<HeapObject> extension(context_->extension(), isolate_);
@@ -766,7 +786,9 @@ bool ScopeIterator::VisitLocals(const Visitor& visitor, Mode mode) const {
     Variable* function_var =
         current_scope_->AsDeclarationScope()->function_var();
     if (function_var != nullptr) {
-      Handle<JSFunction> function = frame_inspector_->GetFunction();
+      Handle<JSFunction> function = frame_inspector_ == nullptr
+                                        ? function_
+                                        : frame_inspector_->GetFunction();
       Handle<String> name = function_var->name();
       if (visitor(name, function)) return true;
     }
diff --git a/deps/v8/src/debug/debug-scopes.h b/deps/v8/src/debug/debug-scopes.h
index f53457ef46e..a0357c73838 100644
--- a/deps/v8/src/debug/debug-scopes.h
+++ b/deps/v8/src/debug/debug-scopes.h
@@ -102,6 +102,7 @@ class ScopeIterator {
 
   bool InInnerScope() const { return !function_.is_null(); }
   bool HasContext() const;
+  bool NeedsAndHasContext() const;
   Handle<Context> CurrentContext() const {
     DCHECK(HasContext());
     return context_;
@@ -109,10 +110,14 @@ class ScopeIterator {
 
  private:
   Isolate* isolate_;
-  ParseInfo* info_ = nullptr;
+  std::unique_ptr<ParseInfo> info_;
   FrameInspector* const frame_inspector_ = nullptr;
   Handle<JSGeneratorObject> generator_;
+
+  // The currently-executing function from the inspected frame, or null if this
+  // ScopeIterator has already iterated to any Scope outside that function.
   Handle<JSFunction> function_;
+
   Handle<Context> context_;
   Handle<Script> script_;
   Handle<StringSet> locals_;
diff --git a/deps/v8/src/debug/debug-stack-trace-iterator.cc b/deps/v8/src/debug/debug-stack-trace-iterator.cc
index 04a2e63ae52..28d595853cd 100644
--- a/deps/v8/src/debug/debug-stack-trace-iterator.cc
+++ b/deps/v8/src/debug/debug-stack-trace-iterator.cc
@@ -6,14 +6,22 @@
 
 #include "src/api/api-inl.h"
 #include "src/debug/debug-evaluate.h"
+#include "src/debug/debug-interface.h"
 #include "src/debug/debug-scope-iterator.h"
 #include "src/debug/debug.h"
 #include "src/debug/liveedit.h"
 #include "src/execution/frames-inl.h"
+#include "src/execution/frames.h"
 #include "src/execution/isolate.h"
+#include "src/wasm/wasm-debug-evaluate.h"
+#include "src/wasm/wasm-debug.h"
 
 namespace v8 {
 
+bool debug::StackTraceIterator::SupportsWasmDebugEvaluate() {
+  return i::FLAG_wasm_expose_debug_eval;
+}
+
 std::unique_ptr<debug::StackTraceIterator> debug::StackTraceIterator::Create(
     v8::Isolate* isolate, int index) {
   return std::unique_ptr<debug::StackTraceIterator>(
@@ -160,8 +168,8 @@ DebugStackTraceIterator::GetScopeIterator() const {
   DCHECK(!Done());
   StandardFrame* frame = iterator_.frame();
   if (frame->is_wasm()) {
-    return std::make_unique<DebugWasmScopeIterator>(isolate_, iterator_.frame(),
-                                                    inlined_frame_index_);
+    return std::make_unique<DebugWasmScopeIterator>(isolate_,
+                                                    WasmFrame::cast(frame));
   }
   return std::make_unique<DebugScopeIterator>(isolate_, frame_inspector_.get());
 }
@@ -186,5 +194,26 @@ v8::MaybeLocal<v8::Value> DebugStackTraceIterator::Evaluate(
   }
   return Utils::ToLocal(value);
 }
+
+v8::MaybeLocal<v8::String> DebugStackTraceIterator::EvaluateWasm(
+    internal::Vector<const internal::byte> source, int frame_index) {
+  DCHECK(!Done());
+  if (!i::FLAG_wasm_expose_debug_eval || !iterator_.is_wasm()) {
+    return v8::MaybeLocal<v8::String>();
+  }
+  Handle<String> value;
+  i::SafeForInterruptsScope safe_for_interrupt_scope(isolate_);
+
+  FrameSummary summary = FrameSummary::Get(iterator_.frame(), 0);
+  const FrameSummary::WasmFrameSummary& wasmSummary = summary.AsWasm();
+  Handle<WasmInstanceObject> instance = wasmSummary.wasm_instance();
+
+  if (!v8::internal::wasm::DebugEvaluate(source, instance, iterator_.frame())
+           .ToHandle(&value)) {
+    isolate_->OptionalRescheduleException(false);
+    return v8::MaybeLocal<v8::String>();
+  }
+  return Utils::ToLocal(value);
+}
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/debug/debug-stack-trace-iterator.h b/deps/v8/src/debug/debug-stack-trace-iterator.h
index 3319bc15f50..2317af35f5a 100644
--- a/deps/v8/src/debug/debug-stack-trace-iterator.h
+++ b/deps/v8/src/debug/debug-stack-trace-iterator.h
@@ -34,6 +34,8 @@ class DebugStackTraceIterator final : public debug::StackTraceIterator {
   bool Restart() override;
   v8::MaybeLocal<v8::Value> Evaluate(v8::Local<v8::String> source,
                                      bool throw_on_side_effect) override;
+  v8::MaybeLocal<v8::String> EvaluateWasm(
+      internal::Vector<const internal::byte> source, int frame_index) override;
 
  private:
   Isolate* isolate_;
diff --git a/deps/v8/src/debug/debug.cc b/deps/v8/src/debug/debug.cc
index a7a3d2fd814..627ccc7c567 100644
--- a/deps/v8/src/debug/debug.cc
+++ b/deps/v8/src/debug/debug.cc
@@ -622,6 +622,7 @@ bool Debug::SetBreakPointForScript(Handle<Script> script,
   Handle<BreakPoint> break_point =
       isolate_->factory()->NewBreakPoint(*id, condition);
   if (script->type() == Script::TYPE_WASM) {
+    RecordWasmScriptWithBreakpoints(script);
     return WasmScript::SetBreakPoint(script, source_position, break_point);
   }
 
@@ -777,12 +778,53 @@ void Debug::RemoveBreakpointForWasmScript(Handle<Script> script, int id) {
   }
 }
 
+void Debug::RecordWasmScriptWithBreakpoints(Handle<Script> script) {
+  if (wasm_scripts_with_breakpoints_.is_null()) {
+    Handle<WeakArrayList> new_list = isolate_->factory()->NewWeakArrayList(4);
+    wasm_scripts_with_breakpoints_ =
+        isolate_->global_handles()->Create(*new_list);
+  }
+  {
+    DisallowHeapAllocation no_gc;
+    for (int idx = wasm_scripts_with_breakpoints_->length() - 1; idx >= 0;
+         --idx) {
+      HeapObject wasm_script;
+      if (wasm_scripts_with_breakpoints_->Get(idx).GetHeapObject(
+              &wasm_script) &&
+          wasm_script == *script) {
+        return;
+      }
+    }
+  }
+  Handle<WeakArrayList> new_list = WeakArrayList::Append(
+      isolate_, wasm_scripts_with_breakpoints_, MaybeObjectHandle{script});
+  if (*new_list != *wasm_scripts_with_breakpoints_) {
+    isolate_->global_handles()->Destroy(
+        wasm_scripts_with_breakpoints_.location());
+    wasm_scripts_with_breakpoints_ =
+        isolate_->global_handles()->Create(*new_list);
+  }
+}
+
 // Clear out all the debug break code.
 void Debug::ClearAllBreakPoints() {
   ClearAllDebugInfos([=](Handle<DebugInfo> info) {
     ClearBreakPoints(info);
     info->ClearBreakInfo(isolate_);
   });
+  // Clear all wasm breakpoints.
+  if (!wasm_scripts_with_breakpoints_.is_null()) {
+    DisallowHeapAllocation no_gc;
+    for (int idx = wasm_scripts_with_breakpoints_->length() - 1; idx >= 0;
+         --idx) {
+      HeapObject raw_wasm_script;
+      if (wasm_scripts_with_breakpoints_->Get(idx).GetHeapObject(
+              &raw_wasm_script)) {
+        WasmScript::ClearAllBreakpoints(Script::cast(raw_wasm_script));
+      }
+    }
+    wasm_scripts_with_breakpoints_ = Handle<WeakArrayList>{};
+  }
 }
 
 void Debug::FloodWithOneShot(Handle<SharedFunctionInfo> shared,
@@ -872,20 +914,6 @@ void Debug::PrepareStepIn(Handle<JSFunction> function) {
   if (in_debug_scope()) return;
   if (break_disabled()) return;
   Handle<SharedFunctionInfo> shared(function->shared(), isolate_);
-  // If stepping from JS into Wasm, and we are using the wasm interpreter for
-  // debugging, prepare the interpreter for step in.
-  if (shared->HasWasmExportedFunctionData() && !FLAG_debug_in_liftoff) {
-    auto imported_function = Handle<WasmExportedFunction>::cast(function);
-    Handle<WasmInstanceObject> wasm_instance(imported_function->instance(),
-                                             isolate_);
-    Handle<WasmDebugInfo> wasm_debug_info =
-        WasmInstanceObject::GetOrCreateDebugInfo(wasm_instance);
-    int func_index = shared->wasm_exported_function_data().function_index();
-    WasmDebugInfo::PrepareStepIn(wasm_debug_info, func_index);
-    // We need to reset all of this since break would be
-    // handled in Wasm Interpreter now. Otherwise it would be a loop here.
-    ClearStepping();
-  }
   if (IsBlackboxed(shared)) return;
   if (*function == thread_local_.ignore_step_into_function_) return;
   thread_local_.ignore_step_into_function_ = Smi::zero();
@@ -1040,17 +1068,9 @@ void Debug::PrepareStep(StepAction step_action) {
     thread_local_.last_frame_count_ = current_frame_count;
     // No longer perform the current async step.
     clear_suspended_generator();
-  } else if (frame->is_wasm_interpreter_entry()) {
-    // Handle stepping in wasm functions via the wasm interpreter.
-    WasmInterpreterEntryFrame* wasm_frame =
-        WasmInterpreterEntryFrame::cast(frame);
-    if (wasm_frame->NumberOfActiveFrames() > 0) {
-      wasm_frame->debug_info().PrepareStep(step_action);
-      return;
-    }
-  } else if (FLAG_debug_in_liftoff && frame->is_wasm_compiled()) {
+  } else if (frame->is_wasm()) {
     // Handle stepping in Liftoff code.
-    WasmCompiledFrame* wasm_frame = WasmCompiledFrame::cast(frame);
+    WasmFrame* wasm_frame = WasmFrame::cast(frame);
     wasm::WasmCodeRefScope code_ref_scope;
     wasm::WasmCode* code = wasm_frame->wasm_code();
     if (code->is_liftoff()) {
diff --git a/deps/v8/src/debug/debug.h b/deps/v8/src/debug/debug.h
index 4bb2008c4d0..a8adb77697f 100644
--- a/deps/v8/src/debug/debug.h
+++ b/deps/v8/src/debug/debug.h
@@ -248,6 +248,8 @@ class V8_EXPORT_PRIVATE Debug {
   void RemoveBreakpoint(int id);
   void RemoveBreakpointForWasmScript(Handle<Script> script, int id);
 
+  void RecordWasmScriptWithBreakpoints(Handle<Script> script);
+
   // Find breakpoints from the debug info and the break location and check
   // whether they are hit. Return an empty handle if not, or a FixedArray with
   // hit BreakPoint objects.
@@ -546,6 +548,9 @@ class V8_EXPORT_PRIVATE Debug {
   // Storage location for registers when handling debug break calls
   ThreadLocal thread_local_;
 
+  // This is a global handle, lazily initialized.
+  Handle<WeakArrayList> wasm_scripts_with_breakpoints_;
+
   Isolate* isolate_;
 
   friend class Isolate;
diff --git a/deps/v8/src/debug/liveedit.cc b/deps/v8/src/debug/liveedit.cc
index aad5f5d9e6d..cd40eae6561 100644
--- a/deps/v8/src/debug/liveedit.cc
+++ b/deps/v8/src/debug/liveedit.cc
@@ -750,7 +750,6 @@ class CollectFunctionLiterals final
 bool ParseScript(Isolate* isolate, Handle<Script> script, ParseInfo* parse_info,
                  bool compile_as_well, std::vector<FunctionLiteral*>* literals,
                  debug::LiveEditResult* result) {
-  parse_info->set_eager();
   v8::TryCatch try_catch(reinterpret_cast<v8::Isolate*>(isolate));
   Handle<SharedFunctionInfo> shared;
   bool success = false;
@@ -759,10 +758,6 @@ bool ParseScript(Isolate* isolate, Handle<Script> script, ParseInfo* parse_info,
                   .ToHandle(&shared);
   } else {
     success = parsing::ParseProgram(parse_info, script, isolate);
-    if (success) {
-      success = Compiler::Analyze(parse_info);
-      parse_info->ast_value_factory()->Internalize(isolate);
-    }
   }
   if (!success) {
     isolate->OptionalRescheduleException(false);
@@ -1058,15 +1053,23 @@ void LiveEdit::PatchScript(Isolate* isolate, Handle<Script> script,
     return;
   }
 
-  ParseInfo parse_info(isolate, *script);
+  UnoptimizedCompileState compile_state(isolate);
+  UnoptimizedCompileFlags flags =
+      UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+  flags.set_is_eager(true);
+  ParseInfo parse_info(isolate, flags, &compile_state);
   std::vector<FunctionLiteral*> literals;
   if (!ParseScript(isolate, script, &parse_info, false, &literals, result))
     return;
 
   Handle<Script> new_script = isolate->factory()->CloneScript(script);
   new_script->set_source(*new_source);
+  UnoptimizedCompileState new_compile_state(isolate);
+  UnoptimizedCompileFlags new_flags =
+      UnoptimizedCompileFlags::ForScriptCompile(isolate, *new_script);
+  new_flags.set_is_eager(true);
+  ParseInfo new_parse_info(isolate, new_flags, &new_compile_state);
   std::vector<FunctionLiteral*> new_literals;
-  ParseInfo new_parse_info(isolate, *new_script);
   if (!ParseScript(isolate, new_script, &new_parse_info, true, &new_literals,
                    result)) {
     return;
diff --git a/deps/v8/src/debug/ppc/debug-ppc.cc b/deps/v8/src/debug/ppc/debug-ppc.cc
index be32d3ba28b..eeed2d8e3ed 100644
--- a/deps/v8/src/debug/ppc/debug-ppc.cc
+++ b/deps/v8/src/debug/ppc/debug-ppc.cc
@@ -36,7 +36,8 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   __ mr(fp, r4);
   __ LoadP(r4, MemOperand(fp, StandardFrameConstants::kFunctionOffset));
   __ LeaveFrame(StackFrame::INTERNAL);
-  __ LoadP(r3, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
+  __ LoadTaggedPointerField(
+      r3, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
   __ lhz(r3,
          FieldMemOperand(r3, SharedFunctionInfo::kFormalParameterCountOffset));
   __ mr(r5, r3);
diff --git a/deps/v8/src/debug/wasm/gdb-server/OWNERS b/deps/v8/src/debug/wasm/gdb-server/OWNERS
new file mode 100644
index 00000000000..4b8c1919e84
--- /dev/null
+++ b/deps/v8/src/debug/wasm/gdb-server/OWNERS
@@ -0,0 +1,3 @@
+paolosev@microsoft.com
+
+# COMPONENT: Blink>JavaScript>WebAssembly
\ No newline at end of file
diff --git a/deps/v8/src/debug/wasm/gdb-server/gdb-remote-util.cc b/deps/v8/src/debug/wasm/gdb-server/gdb-remote-util.cc
new file mode 100644
index 00000000000..b4880ed1ff3
--- /dev/null
+++ b/deps/v8/src/debug/wasm/gdb-server/gdb-remote-util.cc
@@ -0,0 +1,104 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/debug/wasm/gdb-server/gdb-remote-util.h"
+using std::string;
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+namespace gdb_server {
+
+// GDB expects lower case values.
+static const char kHexChars[] = "0123456789abcdef";
+
+void UInt8ToHex(uint8_t byte, char chars[2]) {
+  DCHECK(chars);
+  chars[0] = kHexChars[byte >> 4];
+  chars[1] = kHexChars[byte & 0xF];
+}
+
+bool HexToUInt8(const char chars[2], uint8_t* byte) {
+  uint8_t o1, o2;
+  if (NibbleToUInt8(chars[0], &o1) && NibbleToUInt8(chars[1], &o2)) {
+    *byte = (o1 << 4) + o2;
+    return true;
+  }
+
+  return false;
+}
+
+bool NibbleToUInt8(char ch, uint8_t* byte) {
+  DCHECK(byte);
+
+  // Check for nibble of a-f
+  if ((ch >= 'a') && (ch <= 'f')) {
+    *byte = (ch - 'a' + 10);
+    return true;
+  }
+
+  // Check for nibble of A-F
+  if ((ch >= 'A') && (ch <= 'F')) {
+    *byte = (ch - 'A' + 10);
+    return true;
+  }
+
+  // Check for nibble of 0-9
+  if ((ch >= '0') && (ch <= '9')) {
+    *byte = (ch - '0');
+    return true;
+  }
+
+  // Not a valid nibble representation
+  return false;
+}
+
+std::vector<std::string> StringSplit(const string& instr, const char* delim) {
+  std::vector<std::string> result;
+
+  const char* in = instr.data();
+  if (nullptr == in) return result;
+
+  // Check if we have nothing to do
+  if (nullptr == delim) {
+    result.push_back(string(in));
+    return result;
+  }
+
+  while (*in) {
+    // Toss all preceeding delimiters
+    while (*in && strchr(delim, *in)) in++;
+
+    // If we still have something to process
+    if (*in) {
+      const char* start = in;
+      size_t len = 0;
+      // Keep moving forward for all valid chars
+      while (*in && (strchr(delim, *in) == nullptr)) {
+        len++;
+        in++;
+      }
+
+      // Build this token and add it to the array.
+      result.push_back(string{start, len});
+    }
+  }
+  return result;
+}
+
+std::string Mem2Hex(const uint8_t* mem, size_t count) {
+  std::vector<char> result(count * 2 + 1);
+  for (size_t i = 0; i < count; i++) UInt8ToHex(*mem++, &result[i * 2]);
+  result[count * 2] = '\0';
+  return result.data();
+}
+
+std::string Mem2Hex(const std::string& str) {
+  return Mem2Hex(reinterpret_cast<const uint8_t*>(str.data()), str.size());
+}
+
+}  // namespace gdb_server
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/debug/wasm/gdb-server/gdb-remote-util.h b/deps/v8/src/debug/wasm/gdb-server/gdb-remote-util.h
new file mode 100644
index 00000000000..88a2715ff6f
--- /dev/null
+++ b/deps/v8/src/debug/wasm/gdb-server/gdb-remote-util.h
@@ -0,0 +1,72 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_DEBUG_WASM_GDB_SERVER_GDB_REMOTE_UTIL_H_
+#define V8_DEBUG_WASM_GDB_SERVER_GDB_REMOTE_UTIL_H_
+
+#include <string>
+#include <vector>
+#include "src/flags/flags.h"
+#include "src/utils/utils.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+namespace gdb_server {
+
+#define TRACE_GDB_REMOTE(...)                                            \
+  do {                                                                   \
+    if (FLAG_trace_wasm_gdb_remote) PrintF("[gdb-remote] " __VA_ARGS__); \
+  } while (false)
+
+// Convert from 0-255 to a pair of ASCII chars (0-9,a-f).
+void UInt8ToHex(uint8_t byte, char chars[2]);
+
+// Convert a pair of hex chars into a value 0-255 or return false if either
+// input character is not a valid nibble.
+bool HexToUInt8(const char chars[2], uint8_t* byte);
+
+// Convert from ASCII (0-9,a-f,A-F) to 4b unsigned or return false if the
+// input char is unexpected.
+bool NibbleToUInt8(char ch, uint8_t* byte);
+
+std::vector<std::string> V8_EXPORT_PRIVATE StringSplit(const std::string& instr,
+                                                       const char* delim);
+
+// Convert the memory pointed to by {mem} into a hex string in GDB-remote
+// format.
+std::string Mem2Hex(const uint8_t* mem, size_t count);
+std::string Mem2Hex(const std::string& str);
+
+// For LLDB debugging, an address in a Wasm module code space is represented
+// with 64 bits, where the first 32 bits identify the module id:
+// +--------------------+--------------------+
+// |     module_id      |       offset       |
+// +--------------------+--------------------+
+//  <----- 32 bit -----> <----- 32 bit ----->
+class wasm_addr_t {
+ public:
+  wasm_addr_t(uint32_t module_id, uint32_t offset)
+      : module_id_(module_id), offset_(offset) {}
+  explicit wasm_addr_t(uint64_t address)
+      : module_id_(address >> 32), offset_(address & 0xffffffff) {}
+
+  inline uint32_t ModuleId() const { return module_id_; }
+  inline uint32_t Offset() const { return offset_; }
+
+  inline operator uint64_t() const {
+    return static_cast<uint64_t>(module_id_) << 32 | offset_;
+  }
+
+ private:
+  uint32_t module_id_;
+  uint32_t offset_;
+};
+
+}  // namespace gdb_server
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_DEBUG_WASM_GDB_SERVER_GDB_REMOTE_UTIL_H_
diff --git a/deps/v8/src/debug/wasm/gdb-server/gdb-server-thread.cc b/deps/v8/src/debug/wasm/gdb-server/gdb-server-thread.cc
index a9f1b58f6c3..03b9b8fd3e3 100644
--- a/deps/v8/src/debug/wasm/gdb-server/gdb-server-thread.cc
+++ b/deps/v8/src/debug/wasm/gdb-server/gdb-server-thread.cc
@@ -32,7 +32,7 @@ bool GdbServerThread::StartAndInitialize() {
   // this operation happensat most once per process and only when the
   // --wasm-gdb-remote flag is set.
   start_semaphore_.Wait();
-  return true;
+  return !!target_;
 }
 
 void GdbServerThread::CleanupThread() {
diff --git a/deps/v8/src/debug/wasm/gdb-server/gdb-server-thread.h b/deps/v8/src/debug/wasm/gdb-server/gdb-server-thread.h
index f31756cbb38..cca1e4a6de0 100644
--- a/deps/v8/src/debug/wasm/gdb-server/gdb-server-thread.h
+++ b/deps/v8/src/debug/wasm/gdb-server/gdb-server-thread.h
@@ -34,6 +34,8 @@ class GdbServerThread : public v8::base::Thread {
   // closes any active debugging session.
   void Stop();
 
+  Target& GetTarget() { return *target_; }
+
  private:
   void CleanupThread();
 
@@ -47,7 +49,7 @@ class GdbServerThread : public v8::base::Thread {
 
   base::Mutex mutex_;
   // Protected by {mutex_}:
-  std::unique_ptr<Transport> transport_;
+  std::unique_ptr<TransportBase> transport_;
   std::unique_ptr<Target> target_;
 
   DISALLOW_COPY_AND_ASSIGN(GdbServerThread);
diff --git a/deps/v8/src/debug/wasm/gdb-server/gdb-server.cc b/deps/v8/src/debug/wasm/gdb-server/gdb-server.cc
index bad7f439eb5..96e2308cee7 100644
--- a/deps/v8/src/debug/wasm/gdb-server/gdb-server.cc
+++ b/deps/v8/src/debug/wasm/gdb-server/gdb-server.cc
@@ -4,34 +4,420 @@
 
 #include "src/debug/wasm/gdb-server/gdb-server.h"
 
+#include <inttypes.h>
+#include <functional>
+#include "src/api/api-inl.h"
+#include "src/api/api.h"
+#include "src/debug/debug.h"
 #include "src/debug/wasm/gdb-server/gdb-server-thread.h"
-#include "src/wasm/wasm-engine.h"
+#include "src/utils/locked-queue-inl.h"
 
 namespace v8 {
 namespace internal {
 namespace wasm {
 namespace gdb_server {
 
-GdbServer::GdbServer() {
-  DCHECK(!thread_);
+static const uint32_t kMaxWasmCallStack = 20;
+
+// A TaskRunner is an object that runs posted tasks (in the form of closure
+// objects). Tasks are queued and run, in order, in the thread where the
+// TaskRunner::RunMessageLoop() is called.
+class TaskRunner {
+ public:
+  // Class Task wraps a std::function with a semaphore to signal its completion.
+  // This logic would be neatly implemented with std::packaged_tasks but we
+  // cannot use <future> in V8.
+  class Task {
+   public:
+    Task(base::Semaphore* ready_semaphore, std::function<void()> func)
+        : ready_semaphore_(ready_semaphore), func_(func) {}
+
+    void Run() {
+      func_();
+      ready_semaphore_->Signal();
+    }
+
+    // A semaphore object passed by the thread that posts a task.
+    // The sender can Wait on this semaphore to block until the task has
+    // completed execution in the TaskRunner thread.
+    base::Semaphore* ready_semaphore_;
+
+    // The function to run.
+    std::function<void()> func_;
+  };
+
+  TaskRunner()
+      : process_queue_semaphore_(0),
+        nested_loop_count_(0),
+        is_terminated_(false) {}
+
+  // Starts the task runner. All tasks posted are run, in order, in the thread
+  // that calls this function.
+  void Run() {
+    is_terminated_ = false;
+    int loop_number = ++nested_loop_count_;
+    while (nested_loop_count_ == loop_number && !is_terminated_) {
+      std::shared_ptr<Task> task = GetNext();
+      if (task) {
+        task->Run();
+      }
+    }
+  }
+
+  // Terminates the task runner. Tasks that are still pending in the queue are
+  // not discarded and will be executed when the task runner is restarted.
+  void Terminate() {
+    DCHECK_LT(0, nested_loop_count_);
+    --nested_loop_count_;
+
+    is_terminated_ = true;
+    process_queue_semaphore_.Signal();
+  }
+
+  // Posts a task to the task runner, to be executed in the task runner thread.
+  template <typename Functor>
+  auto Append(base::Semaphore* ready_semaphore, Functor&& task) {
+    queue_.Enqueue(std::make_shared<Task>(ready_semaphore, task));
+    process_queue_semaphore_.Signal();
+  }
+
+ private:
+  std::shared_ptr<Task> GetNext() {
+    while (!is_terminated_) {
+      if (queue_.IsEmpty()) {
+        process_queue_semaphore_.Wait();
+      }
+
+      std::shared_ptr<Task> task;
+      if (queue_.Dequeue(&task)) {
+        return task;
+      }
+    }
+    return nullptr;
+  }
+
+  LockedQueue<std::shared_ptr<Task>> queue_;
+  v8::base::Semaphore process_queue_semaphore_;
+  int nested_loop_count_;
+  std::atomic<bool> is_terminated_;
+
+  DISALLOW_COPY_AND_ASSIGN(TaskRunner);
+};
+
+GdbServer::GdbServer() { task_runner_ = std::make_unique<TaskRunner>(); }
+
+template <typename Functor>
+auto GdbServer::RunSyncTask(Functor&& callback) const {
+  // Executed in the GDBServerThread.
+  v8::base::Semaphore ready_semaphore(0);
+  task_runner_->Append(&ready_semaphore, callback);
+  ready_semaphore.Wait();
+}
+
+// static
+std::unique_ptr<GdbServer> GdbServer::Create() {
   DCHECK(FLAG_wasm_gdb_remote);
 
-  thread_ = std::make_unique<GdbServerThread>(this);
-  // TODO(paolosev): does StartSynchronously hurt performances?
-  if (!thread_->StartAndInitialize()) {
+  std::unique_ptr<GdbServer> gdb_server(new GdbServer());
+
+  // Spawns the GDB-stub thread where all the communication with the debugger
+  // happens.
+  gdb_server->thread_ = std::make_unique<GdbServerThread>(gdb_server.get());
+  if (!gdb_server->thread_->StartAndInitialize()) {
     TRACE_GDB_REMOTE(
         "Cannot initialize thread, GDB-remote debugging will be disabled.\n");
-    thread_ = nullptr;
+    return nullptr;
   }
+  return gdb_server;
 }
 
 GdbServer::~GdbServer() {
+  // All Isolates have been deregistered.
+  DCHECK(isolate_delegates_.empty());
+
   if (thread_) {
+    // Waits for the GDB-stub thread to terminate.
     thread_->Stop();
     thread_->Join();
   }
 }
 
+void GdbServer::RunMessageLoopOnPause() { task_runner_->Run(); }
+
+void GdbServer::QuitMessageLoopOnPause() { task_runner_->Terminate(); }
+
+std::vector<GdbServer::WasmModuleInfo> GdbServer::GetLoadedModules() {
+  // Executed in the GDBServerThread.
+  std::vector<GdbServer::WasmModuleInfo> modules;
+
+  RunSyncTask([this, &modules]() {
+    // Executed in the isolate thread.
+    for (const auto& pair : scripts_) {
+      uint32_t module_id = pair.first;
+      const WasmModuleDebug& module_debug = pair.second;
+      modules.push_back({module_id, module_debug.GetModuleName()});
+    }
+  });
+  return modules;
+}
+
+bool GdbServer::GetModuleDebugHandler(uint32_t module_id,
+                                      WasmModuleDebug** wasm_module_debug) {
+  // Always executed in the isolate thread.
+  ScriptsMap::iterator scriptIterator = scripts_.find(module_id);
+  if (scriptIterator != scripts_.end()) {
+    *wasm_module_debug = &scriptIterator->second;
+    return true;
+  }
+  wasm_module_debug = nullptr;
+  return false;
+}
+
+bool GdbServer::GetWasmGlobal(uint32_t frame_index, uint32_t index,
+                              uint8_t* buffer, uint32_t buffer_size,
+                              uint32_t* size) {
+  // Executed in the GDBServerThread.
+  bool result = false;
+  RunSyncTask([this, &result, frame_index, index, buffer, buffer_size, size]() {
+    // Executed in the isolate thread.
+    result = WasmModuleDebug::GetWasmGlobal(GetTarget().GetCurrentIsolate(),
+                                            frame_index, index, buffer,
+                                            buffer_size, size);
+  });
+  return result;
+}
+
+bool GdbServer::GetWasmLocal(uint32_t frame_index, uint32_t index,
+                             uint8_t* buffer, uint32_t buffer_size,
+                             uint32_t* size) {
+  // Executed in the GDBServerThread.
+  bool result = false;
+  RunSyncTask([this, &result, frame_index, index, buffer, buffer_size, size]() {
+    // Executed in the isolate thread.
+    result = WasmModuleDebug::GetWasmLocal(GetTarget().GetCurrentIsolate(),
+                                           frame_index, index, buffer,
+                                           buffer_size, size);
+  });
+  return result;
+}
+
+bool GdbServer::GetWasmStackValue(uint32_t frame_index, uint32_t index,
+                                  uint8_t* buffer, uint32_t buffer_size,
+                                  uint32_t* size) {
+  // Executed in the GDBServerThread.
+  bool result = false;
+  RunSyncTask([this, &result, frame_index, index, buffer, buffer_size, size]() {
+    // Executed in the isolate thread.
+    result = WasmModuleDebug::GetWasmStackValue(GetTarget().GetCurrentIsolate(),
+                                                frame_index, index, buffer,
+                                                buffer_size, size);
+  });
+  return result;
+}
+
+uint32_t GdbServer::GetWasmMemory(uint32_t frame_index, uint32_t offset,
+                                  uint8_t* buffer, uint32_t size) {
+  // Executed in the GDBServerThread.
+  uint32_t bytes_read = 0;
+  RunSyncTask([this, &bytes_read, frame_index, offset, buffer, size]() {
+    // Executed in the isolate thread.
+    bytes_read = WasmModuleDebug::GetWasmMemory(
+        GetTarget().GetCurrentIsolate(), frame_index, offset, buffer, size);
+  });
+  return bytes_read;
+}
+
+uint32_t GdbServer::GetWasmModuleBytes(wasm_addr_t wasm_addr, uint8_t* buffer,
+                                       uint32_t size) {
+  // Executed in the GDBServerThread.
+  uint32_t bytes_read = 0;
+  RunSyncTask([this, &bytes_read, wasm_addr, buffer, size]() {
+    // Executed in the isolate thread.
+    WasmModuleDebug* module_debug;
+    if (GetModuleDebugHandler(wasm_addr.ModuleId(), &module_debug)) {
+      bytes_read = module_debug->GetWasmModuleBytes(wasm_addr, buffer, size);
+    }
+  });
+  return bytes_read;
+}
+
+bool GdbServer::AddBreakpoint(uint32_t wasm_module_id, uint32_t offset) {
+  // Executed in the GDBServerThread.
+  bool result = false;
+  RunSyncTask([this, &result, wasm_module_id, offset]() {
+    // Executed in the isolate thread.
+    WasmModuleDebug* module_debug;
+    if (GetModuleDebugHandler(wasm_module_id, &module_debug)) {
+      int breakpoint_id = 0;
+      if (module_debug->AddBreakpoint(offset, &breakpoint_id)) {
+        breakpoints_[wasm_addr_t(wasm_module_id, offset)] = breakpoint_id;
+        result = true;
+      }
+    }
+  });
+  return result;
+}
+
+bool GdbServer::RemoveBreakpoint(uint32_t wasm_module_id, uint32_t offset) {
+  // Executed in the GDBServerThread.
+  bool result = false;
+  RunSyncTask([this, &result, wasm_module_id, offset]() {
+    // Executed in the isolate thread.
+    BreakpointsMap::iterator it =
+        breakpoints_.find(wasm_addr_t(wasm_module_id, offset));
+    if (it != breakpoints_.end()) {
+      int breakpoint_id = it->second;
+      breakpoints_.erase(it);
+
+      WasmModuleDebug* module_debug;
+      if (GetModuleDebugHandler(wasm_module_id, &module_debug)) {
+        module_debug->RemoveBreakpoint(offset, breakpoint_id);
+        result = true;
+      }
+    }
+  });
+  return result;
+}
+
+std::vector<wasm_addr_t> GdbServer::GetWasmCallStack() const {
+  // Executed in the GDBServerThread.
+  std::vector<wasm_addr_t> result;
+  RunSyncTask([this, &result]() {
+    // Executed in the isolate thread.
+    result = GetTarget().GetCallStack();
+  });
+  return result;
+}
+
+void GdbServer::AddIsolate(Isolate* isolate) {
+  // Executed in the isolate thread.
+  if (isolate_delegates_.find(isolate) == isolate_delegates_.end()) {
+    isolate_delegates_[isolate] =
+        std::make_unique<DebugDelegate>(isolate, this);
+  }
+}
+
+void GdbServer::RemoveIsolate(Isolate* isolate) {
+  // Executed in the isolate thread.
+  auto it = isolate_delegates_.find(isolate);
+  if (it != isolate_delegates_.end()) {
+    for (auto it = scripts_.begin(); it != scripts_.end();) {
+      if (it->second.GetIsolate() == isolate) {
+        it = scripts_.erase(it);
+      } else {
+        ++it;
+      }
+    }
+    isolate_delegates_.erase(it);
+  }
+}
+
+void GdbServer::Suspend() {
+  // Executed in the GDBServerThread.
+  auto it = isolate_delegates_.begin();
+  if (it != isolate_delegates_.end()) {
+    Isolate* isolate = it->first;
+    v8::Isolate* v8Isolate = (v8::Isolate*)isolate;
+    v8Isolate->RequestInterrupt(
+        // Executed in the isolate thread.
+        [](v8::Isolate* isolate, void*) {
+          if (v8::debug::AllFramesOnStackAreBlackboxed(isolate)) {
+            v8::debug::SetBreakOnNextFunctionCall(isolate);
+          } else {
+            v8::debug::BreakRightNow(isolate);
+          }
+        },
+        this);
+  }
+}
+
+void GdbServer::PrepareStep() {
+  // Executed in the GDBServerThread.
+  wasm_addr_t pc = GetTarget().GetCurrentPc();
+  RunSyncTask([this, pc]() {
+    // Executed in the isolate thread.
+    WasmModuleDebug* module_debug;
+    if (GetModuleDebugHandler(pc.ModuleId(), &module_debug)) {
+      module_debug->PrepareStep();
+    }
+  });
+}
+
+void GdbServer::AddWasmModule(uint32_t module_id,
+                              Local<debug::WasmScript> wasm_script) {
+  // Executed in the isolate thread.
+  DCHECK_EQ(Script::TYPE_WASM, Utils::OpenHandle(*wasm_script)->type());
+  v8::Isolate* isolate = wasm_script->GetIsolate();
+  scripts_.insert(
+      std::make_pair(module_id, WasmModuleDebug(isolate, wasm_script)));
+
+  if (FLAG_wasm_pause_waiting_for_debugger && scripts_.size() == 1) {
+    TRACE_GDB_REMOTE("Paused, waiting for a debugger to attach...\n");
+    Suspend();
+  }
+}
+
+Target& GdbServer::GetTarget() const { return thread_->GetTarget(); }
+
+// static
+std::atomic<uint32_t> GdbServer::DebugDelegate::id_s;
+
+GdbServer::DebugDelegate::DebugDelegate(Isolate* isolate, GdbServer* gdb_server)
+    : isolate_(isolate), id_(id_s++), gdb_server_(gdb_server) {
+  isolate_->SetCaptureStackTraceForUncaughtExceptions(
+      true, kMaxWasmCallStack, v8::StackTrace::kOverview);
+
+  // Register the delegate
+  isolate_->debug()->SetDebugDelegate(this);
+  v8::debug::TierDownAllModulesPerIsolate((v8::Isolate*)isolate_);
+  v8::debug::ChangeBreakOnException((v8::Isolate*)isolate_,
+                                    v8::debug::BreakOnUncaughtException);
+}
+
+GdbServer::DebugDelegate::~DebugDelegate() {
+  // Deregister the delegate
+  isolate_->debug()->SetDebugDelegate(nullptr);
+}
+
+void GdbServer::DebugDelegate::ScriptCompiled(Local<debug::Script> script,
+                                              bool is_live_edited,
+                                              bool has_compile_error) {
+  // Executed in the isolate thread.
+  if (script->IsWasm()) {
+    DCHECK_EQ(reinterpret_cast<v8::Isolate*>(isolate_), script->GetIsolate());
+    gdb_server_->AddWasmModule(GetModuleId(script->Id()),
+                               script.As<debug::WasmScript>());
+  }
+}
+
+void GdbServer::DebugDelegate::BreakProgramRequested(
+    // Executed in the isolate thread.
+    Local<v8::Context> paused_context,
+    const std::vector<debug::BreakpointId>& inspector_break_points_hit) {
+  gdb_server_->GetTarget().OnProgramBreak(
+      isolate_, WasmModuleDebug::GetCallStack(id_, isolate_));
+  gdb_server_->RunMessageLoopOnPause();
+}
+
+void GdbServer::DebugDelegate::ExceptionThrown(
+    // Executed in the isolate thread.
+    Local<v8::Context> paused_context, Local<Value> exception,
+    Local<Value> promise, bool is_uncaught,
+    debug::ExceptionType exception_type) {
+  if (exception_type == v8::debug::kException && is_uncaught) {
+    gdb_server_->GetTarget().OnException(
+        isolate_, WasmModuleDebug::GetCallStack(id_, isolate_));
+    gdb_server_->RunMessageLoopOnPause();
+  }
+}
+
+bool GdbServer::DebugDelegate::IsFunctionBlackboxed(
+    // Executed in the isolate thread.
+    Local<debug::Script> script, const debug::Location& start,
+    const debug::Location& end) {
+  return false;
+}
+
 }  // namespace gdb_server
 }  // namespace wasm
 }  // namespace internal
diff --git a/deps/v8/src/debug/wasm/gdb-server/gdb-server.h b/deps/v8/src/debug/wasm/gdb-server/gdb-server.h
index 59d8a173751..50939af69cc 100644
--- a/deps/v8/src/debug/wasm/gdb-server/gdb-server.h
+++ b/deps/v8/src/debug/wasm/gdb-server/gdb-server.h
@@ -5,14 +5,18 @@
 #ifndef V8_DEBUG_WASM_GDB_SERVER_GDB_SERVER_H_
 #define V8_DEBUG_WASM_GDB_SERVER_GDB_SERVER_H_
 
+#include <map>
 #include <memory>
 #include "src/debug/wasm/gdb-server/gdb-server-thread.h"
+#include "src/debug/wasm/gdb-server/wasm-module-debug.h"
 
 namespace v8 {
 namespace internal {
 namespace wasm {
 namespace gdb_server {
 
+class TaskRunner;
+
 // class GdbServer acts as a manager for the GDB-remote stub. It is instantiated
 // as soon as the first Wasm module is loaded in the Wasm engine and spawns a
 // separate thread to accept connections and exchange messages with a debugger.
@@ -20,18 +24,172 @@ namespace gdb_server {
 // the Wasm engine.
 class GdbServer {
  public:
-  // Spawns a "GDB-remote" thread that will be used to communicate with the
-  // debugger. This should be called once, the first time a Wasm module is
-  // loaded in the Wasm engine.
-  GdbServer();
+  // Factory method: creates and returns a GdbServer. Spawns a "GDB-remote"
+  // thread that will be used to communicate with the debugger.
+  // May return null on failure.
+  // This should be called once, the first time a Wasm module is loaded in the
+  // Wasm engine.
+  static std::unique_ptr<GdbServer> Create();
 
   // Stops the "GDB-remote" thread and waits for it to complete. This should be
   // called once, when the Wasm engine shuts down.
   ~GdbServer();
 
+  // Queries the set of the Wasm modules currently loaded. Each module is
+  // identified by a unique integer module id.
+  struct WasmModuleInfo {
+    uint32_t module_id;
+    std::string module_name;
+  };
+  std::vector<WasmModuleInfo> GetLoadedModules();
+
+  // Queries the value of the {index} global value in the Wasm module identified
+  // by {frame_index}.
+  //
+  bool GetWasmGlobal(uint32_t frame_index, uint32_t index, uint8_t* buffer,
+                     uint32_t buffer_size, uint32_t* size);
+
+  // Queries the value of the {index} local value in the {frame_index}th stack
+  // frame in the Wasm module identified by {frame_index}.
+  //
+  bool GetWasmLocal(uint32_t frame_index, uint32_t index, uint8_t* buffer,
+                    uint32_t buffer_size, uint32_t* size);
+
+  // Queries the value of the {index} value in the operand stack.
+  //
+  bool GetWasmStackValue(uint32_t frame_index, uint32_t index, uint8_t* buffer,
+                         uint32_t buffer_size, uint32_t* size);
+
+  // Reads {size} bytes, starting from {offset}, from the Memory instance
+  // associated to the Wasm module identified by {frame_index}.
+  // Returns the number of bytes copied to {buffer}, or 0 is case of error.
+  // Note: only one Memory for Module is currently supported.
+  //
+  uint32_t GetWasmMemory(uint32_t frame_index, uint32_t offset, uint8_t* buffer,
+                         uint32_t size);
+
+  // Reads {size} bytes, starting from the low dword of {address}, from the Code
+  // space of th Wasm module identified by high dword of {address}.
+  // Returns the number of bytes copied to {buffer}, or 0 is case of error.
+  uint32_t GetWasmModuleBytes(wasm_addr_t address, uint8_t* buffer,
+                              uint32_t size);
+
+  // Inserts a breakpoint at the offset {offset} of the Wasm module identified
+  // by {wasm_module_id}.
+  // Returns true if the breakpoint was successfully added.
+  bool AddBreakpoint(uint32_t wasm_module_id, uint32_t offset);
+
+  // Removes a breakpoint at the offset {offset} of the Wasm module identified
+  // by {wasm_module_id}.
+  // Returns true if the breakpoint was successfully removed.
+  bool RemoveBreakpoint(uint32_t wasm_module_id, uint32_t offset);
+
+  // Returns the current call stack as a vector of program counters.
+  std::vector<wasm_addr_t> GetWasmCallStack() const;
+
+  // Manage the set of Isolates for this GdbServer.
+  void AddIsolate(Isolate* isolate);
+  void RemoveIsolate(Isolate* isolate);
+
+  // Requests that the thread suspend execution at the next Wasm instruction.
+  void Suspend();
+
+  // Handle stepping in wasm functions via the wasm interpreter.
+  void PrepareStep();
+
+  // Called when the target debuggee can resume execution (for example after
+  // having been suspended on a breakpoint). Terminates the task runner leaving
+  // all pending tasks in the queue.
+  void QuitMessageLoopOnPause();
+
  private:
+  GdbServer();
+
+  // When the target debuggee is suspended for a breakpoint or exception, blocks
+  // the main (isolate) thread and enters in a message loop. Here it waits on a
+  // queue of Task objects that are posted by the GDB-stub thread and that
+  // represent queries received from the debugger via the GDB-remote protocol.
+  void RunMessageLoopOnPause();
+
+  // Post a task to run a callback in the isolate thread.
+  template <typename Callback>
+  auto RunSyncTask(Callback&& callback) const;
+
+  void AddWasmModule(uint32_t module_id, Local<debug::WasmScript> wasm_script);
+
+  // Given a Wasm module id, retrieves the corresponding debugging WasmScript
+  // object.
+  bool GetModuleDebugHandler(uint32_t module_id,
+                             WasmModuleDebug** wasm_module_debug);
+
+  // Returns the debugging target.
+  Target& GetTarget() const;
+
+  // Class DebugDelegate implements the debug::DebugDelegate interface to
+  // receive notifications when debug events happen in a given isolate, like a
+  // script being loaded, a breakpoint being hit, an exception being thrown.
+  class DebugDelegate : public debug::DebugDelegate {
+   public:
+    DebugDelegate(Isolate* isolate, GdbServer* gdb_server);
+    ~DebugDelegate();
+
+    // debug::DebugDelegate
+    void ScriptCompiled(Local<debug::Script> script, bool is_live_edited,
+                        bool has_compile_error) override;
+    void BreakProgramRequested(Local<v8::Context> paused_context,
+                               const std::vector<debug::BreakpointId>&
+                                   inspector_break_points_hit) override;
+    void ExceptionThrown(Local<v8::Context> paused_context,
+                         Local<Value> exception, Local<Value> promise,
+                         bool is_uncaught,
+                         debug::ExceptionType exception_type) override;
+    bool IsFunctionBlackboxed(Local<debug::Script> script,
+                              const debug::Location& start,
+                              const debug::Location& end) override;
+
+   private:
+    // Calculates module_id as:
+    // +--------------------+------------------- +
+    // | DebugDelegate::id_ |    Script::Id()    |
+    // +--------------------+------------------- +
+    //  <----- 16 bit -----> <----- 16 bit ----->
+    uint32_t GetModuleId(uint32_t script_id) const {
+      DCHECK_LT(script_id, 0x10000);
+      DCHECK_LT(id_, 0x10000);
+      return id_ << 16 | script_id;
+    }
+
+    Isolate* isolate_;
+    uint32_t id_;
+    GdbServer* gdb_server_;
+
+    static std::atomic<uint32_t> id_s;
+  };
+
+  // The GDB-stub thread where all the communication with the debugger happens.
   std::unique_ptr<GdbServerThread> thread_;
 
+  // Used to transform the queries that arrive in the GDB-stub thread into
+  // tasks executed in the main (isolate) thread.
+  std::unique_ptr<TaskRunner> task_runner_;
+
+  //////////////////////////////////////////////////////////////////////////////
+  // Always accessed in the isolate thread.
+
+  // Set of breakpoints currently defines in Wasm code.
+  typedef std::map<uint64_t, int> BreakpointsMap;
+  BreakpointsMap breakpoints_;
+
+  typedef std::map<uint32_t, WasmModuleDebug> ScriptsMap;
+  ScriptsMap scripts_;
+
+  typedef std::map<Isolate*, std::unique_ptr<DebugDelegate>>
+      IsolateDebugDelegateMap;
+  IsolateDebugDelegateMap isolate_delegates_;
+
+  // End of fields always accessed in the isolate thread.
+  //////////////////////////////////////////////////////////////////////////////
+
   DISALLOW_COPY_AND_ASSIGN(GdbServer);
 };
 
diff --git a/deps/v8/src/debug/wasm/gdb-server/packet.cc b/deps/v8/src/debug/wasm/gdb-server/packet.cc
new file mode 100644
index 00000000000..f8306c4b1e5
--- /dev/null
+++ b/deps/v8/src/debug/wasm/gdb-server/packet.cc
@@ -0,0 +1,364 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/debug/wasm/gdb-server/packet.h"
+#include "src/debug/wasm/gdb-server/gdb-remote-util.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+namespace gdb_server {
+
+Packet::Packet() {
+  seq_ = -1;
+  Clear();
+}
+
+void Packet::Clear() {
+  data_.clear();
+  read_index_ = 0;
+}
+
+void Packet::Rewind() { read_index_ = 0; }
+
+bool Packet::EndOfPacket() const { return (read_index_ >= GetPayloadSize()); }
+
+void Packet::AddRawChar(char ch) { data_.push_back(ch); }
+
+void Packet::AddWord8(uint8_t byte) {
+  char seq[2];
+  UInt8ToHex(byte, seq);
+  AddRawChar(seq[0]);
+  AddRawChar(seq[1]);
+}
+
+void Packet::AddBlock(const void* ptr, uint32_t len) {
+  DCHECK(ptr);
+
+  const char* p = (const char*)ptr;
+
+  for (uint32_t offs = 0; offs < len; offs++) {
+    AddWord8(p[offs]);
+  }
+}
+
+void Packet::AddString(const char* str) {
+  DCHECK(str);
+
+  while (*str) {
+    AddRawChar(*str);
+    str++;
+  }
+}
+
+void Packet::AddHexString(const char* str) {
+  DCHECK(str);
+
+  while (*str) {
+    AddWord8(*str);
+    str++;
+  }
+}
+
+void Packet::AddNumberSep(uint64_t val, char sep) {
+  char out[sizeof(val) * 2];
+  char temp[2];
+
+  // Check for -1 optimization
+  if (val == static_cast<uint64_t>(-1)) {
+    AddRawChar('-');
+    AddRawChar('1');
+  } else {
+    int nibbles = 0;
+
+    // In the GDB remote protocol numbers are formatted as big-endian hex
+    // strings. Leading zeros can be skipped.
+    // For example the value 0x00001234 is formatted as "1234".
+    for (size_t a = 0; a < sizeof(val); a++) {
+      uint8_t byte = static_cast<uint8_t>(val & 0xFF);
+
+      // Stream in with bytes reversed, starting with the least significant.
+      // So if we have the value 0x00001234, we store 4, then 3, 2, 1.
+      // Note that the characters are later reversed to be in big-endian order.
+      UInt8ToHex(byte, temp);
+      out[nibbles++] = temp[1];
+      out[nibbles++] = temp[0];
+
+      // Get the next 8 bits;
+      val >>= 8;
+
+      // Suppress leading zeros, so we are done when val hits zero
+      if (val == 0) {
+        break;
+      }
+    }
+
+    // Strip the high zero for this byte if present.
+    if ((nibbles > 1) && (out[nibbles - 1] == '0')) nibbles--;
+
+    // Now write it out reverse to correct the order
+    while (nibbles) {
+      nibbles--;
+      AddRawChar(out[nibbles]);
+    }
+  }
+
+  // If we asked for a separator, insert it
+  if (sep) AddRawChar(sep);
+}
+
+bool Packet::GetNumberSep(uint64_t* val, char* sep) {
+  uint64_t out = 0;
+  char ch;
+  if (!GetRawChar(&ch)) {
+    return false;
+  }
+
+  // Numbers are formatted as a big-endian hex strings.
+  // The literals "0" and "-1" as special cases.
+
+  // Check for -1
+  if (ch == '-') {
+    if (!GetRawChar(&ch)) {
+      return false;
+    }
+
+    if (ch == '1') {
+      *val = (uint64_t)-1;
+
+      ch = 0;
+      GetRawChar(&ch);
+      if (sep) {
+        *sep = ch;
+      }
+      return true;
+    }
+    return false;
+  }
+
+  do {
+    uint8_t nib;
+
+    // Check for separator
+    if (!NibbleToUInt8(ch, &nib)) {
+      break;
+    }
+
+    // Add this nibble.
+    out = (out << 4) + nib;
+
+    // Get the next character (if availible)
+    ch = 0;
+    if (!GetRawChar(&ch)) {
+      break;
+    }
+  } while (1);
+
+  // Set the value;
+  *val = out;
+
+  // Add the separator if the user wants it...
+  if (sep != nullptr) *sep = ch;
+
+  return true;
+}
+
+bool Packet::GetRawChar(char* ch) {
+  DCHECK(ch != nullptr);
+
+  if (read_index_ >= GetPayloadSize()) return false;
+
+  *ch = data_[read_index_++];
+
+  // Check for RLE X*N, where X is the value, N is the reps.
+  if (*ch == '*') {
+    if (read_index_ < 2) {
+      TRACE_GDB_REMOTE("Unexpected RLE at start of packet.\n");
+      return false;
+    }
+
+    if (read_index_ >= GetPayloadSize()) {
+      TRACE_GDB_REMOTE("Unexpected EoP during RLE.\n");
+      return false;
+    }
+
+    // GDB does not use "CTRL" characters in the stream, so the
+    // number of reps is encoded as the ASCII value beyond 28
+    // (which when you add a min rep size of 4, forces the rep
+    // character to be ' ' (32) or greater).
+    int32_t cnt = (data_[read_index_] - 28);
+    if (cnt < 3) {
+      TRACE_GDB_REMOTE("Unexpected RLE length.\n");
+      return false;
+    }
+
+    // We have just read '*' and incremented the read pointer,
+    // so here is the old state, and expected new state.
+    //
+    //   Assume N = 5, we grow by N - size of encoding (3).
+    //
+    // OldP:       R  W
+    // OldD:  012X*N89 = 8 chars
+    // Size:  012X*N89__ = 10 chars
+    // Move:  012X*__N89 = 10 chars
+    // Fill:  012XXXXX89 = 10 chars
+    // NewP:       R    W  (shifted 5 - 3)
+
+    // First, store the remaining characters to the right into a temp string.
+    std::string right = data_.substr(read_index_ + 1);
+    // Discard the '*' we just read
+    data_.erase(read_index_ - 1);
+    // Append (N-1) 'X' chars
+    *ch = data_[read_index_ - 2];
+    data_.append(cnt - 1, *ch);
+    // Finally, append the remaining characters
+    data_.append(right);
+  }
+  return true;
+}
+
+bool Packet::GetWord8(uint8_t* value) {
+  DCHECK(value);
+
+  // Get two ASCII hex values and convert them to ints
+  char seq[2];
+  if (!GetRawChar(&seq[0]) || !GetRawChar(&seq[1])) {
+    return false;
+  }
+  return HexToUInt8(seq, value);
+}
+
+bool Packet::GetBlock(void* ptr, uint32_t len) {
+  DCHECK(ptr);
+
+  uint8_t* p = reinterpret_cast<uint8_t*>(ptr);
+  bool res = true;
+
+  for (uint32_t offs = 0; offs < len; offs++) {
+    res = GetWord8(&p[offs]);
+    if (false == res) {
+      break;
+    }
+  }
+
+  return res;
+}
+
+bool Packet::GetString(std::string* str) {
+  if (EndOfPacket()) {
+    return false;
+  }
+
+  *str = data_.substr(read_index_);
+  read_index_ = GetPayloadSize();
+  return true;
+}
+
+bool Packet::GetHexString(std::string* str) {
+  // Decode a string encoded as a series of 2-hex digit pairs.
+
+  if (EndOfPacket()) {
+    return false;
+  }
+
+  // Pull values until we hit a separator
+  str->clear();
+  char ch1;
+  while (GetRawChar(&ch1)) {
+    uint8_t nib1;
+    if (!NibbleToUInt8(ch1, &nib1)) {
+      read_index_--;
+      break;
+    }
+    char ch2;
+    uint8_t nib2;
+    if (!GetRawChar(&ch2) || !NibbleToUInt8(ch2, &nib2)) {
+      return false;
+    }
+    *str += static_cast<char>((nib1 << 4) + nib2);
+  }
+  return true;
+}
+
+const char* Packet::GetPayload() const { return data_.c_str(); }
+
+size_t Packet::GetPayloadSize() const { return data_.size(); }
+
+bool Packet::GetSequence(int32_t* ch) const {
+  DCHECK(ch);
+
+  if (seq_ != -1) {
+    *ch = seq_;
+    return true;
+  }
+
+  return false;
+}
+
+void Packet::ParseSequence() {
+  size_t saved_read_index = read_index_;
+  unsigned char seq;
+  char ch;
+  if (GetWord8(&seq) && GetRawChar(&ch)) {
+    if (ch == ':') {
+      SetSequence(seq);
+      return;
+    }
+  }
+  // No sequence number present, so reset to original position.
+  read_index_ = saved_read_index;
+}
+
+void Packet::SetSequence(int32_t val) { seq_ = val; }
+
+void Packet::SetError(ErrDef error) {
+  Clear();
+  AddRawChar('E');
+  AddWord8(static_cast<uint8_t>(error));
+}
+
+std::string Packet::GetPacketData() const {
+  char chars[2];
+  const char* ptr = GetPayload();
+  size_t size = GetPayloadSize();
+
+  std::stringstream outstr;
+
+  // Signal start of response
+  outstr << '$';
+
+  char run_xsum = 0;
+
+  // If there is a sequence, send as two nibble 8bit value + ':'
+  int32_t seq;
+  if (GetSequence(&seq)) {
+    UInt8ToHex(seq, chars);
+    outstr << chars[0];
+    run_xsum += chars[0];
+    outstr << chars[1];
+    run_xsum += chars[1];
+
+    outstr << ':';
+    run_xsum += ':';
+  }
+
+  // Send the main payload
+  for (size_t offs = 0; offs < size; ++offs) {
+    outstr << ptr[offs];
+    run_xsum += ptr[offs];
+  }
+
+  // Send XSUM as two nibble 8bit value preceeded by '#'
+  outstr << '#';
+  UInt8ToHex(run_xsum, chars);
+  outstr << chars[0];
+  outstr << chars[1];
+
+  return outstr.str();
+}
+
+}  // namespace gdb_server
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/debug/wasm/gdb-server/packet.h b/deps/v8/src/debug/wasm/gdb-server/packet.h
new file mode 100644
index 00000000000..4308081cadc
--- /dev/null
+++ b/deps/v8/src/debug/wasm/gdb-server/packet.h
@@ -0,0 +1,105 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_DEBUG_WASM_GDB_SERVER_PACKET_H_
+#define V8_DEBUG_WASM_GDB_SERVER_PACKET_H_
+
+#include <string>
+#include <vector>
+#include "src/base/macros.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+namespace gdb_server {
+
+class V8_EXPORT_PRIVATE Packet {
+ public:
+  Packet();
+
+  // Empty the vector and reset the read/write pointers.
+  void Clear();
+
+  // Reset the read pointer, allowing the packet to be re-read.
+  void Rewind();
+
+  // Return true of the read pointer has reached the write pointer.
+  bool EndOfPacket() const;
+
+  // Store a single raw 8 bit value
+  void AddRawChar(char ch);
+
+  // Store a block of data as hex pairs per byte
+  void AddBlock(const void* ptr, uint32_t len);
+
+  // Store a byte as a 2 chars block.
+  void AddWord8(uint8_t val);
+
+  // Store a number up to 64 bits, formatted as a big-endian hex string with
+  // preceeding zeros removed.  Since zeros can be removed, the width of this
+  // number is unknown, and the number is always followed by a NULL or a
+  // separator (non hex digit).
+  void AddNumberSep(uint64_t val, char sep);
+
+  // Add a raw string.
+  void AddString(const char* str);
+
+  // Add a string stored as a stream of ASCII hex digit pairs.  It is safe
+  // to use any non-null character in this stream.  If this does not terminate
+  // the packet, there should be a separator (non hex digit) immediately
+  // following.
+  void AddHexString(const char* str);
+
+  // Retrieve a single character if available
+  bool GetRawChar(char* ch);
+
+  // Retrieve "len" ASCII character pairs.
+  bool GetBlock(void* ptr, uint32_t len);
+
+  // Retrieve a 8, 16, 32, or 64 bit word as pairs of hex digits.  These
+  // functions will always consume bits/4 characters from the stream.
+  bool GetWord8(uint8_t* val);
+
+  // Retrieve a number (formatted as a big-endian hex string) and a separator.
+  // If 'sep' is null, the separator is consumed but thrown away.
+  bool GetNumberSep(uint64_t* val, char* sep);
+
+  // Get a string from the stream
+  bool GetString(std::string* str);
+  bool GetHexString(std::string* str);
+
+  // Return a pointer to the entire packet payload
+  const char* GetPayload() const;
+  size_t GetPayloadSize() const;
+
+  // Returns true and the sequence number, or false if it is unset.
+  bool GetSequence(int32_t* seq) const;
+
+  // Parses sequence number in package data and moves read pointer past it.
+  void ParseSequence();
+
+  // Set the sequence number.
+  void SetSequence(int32_t seq);
+
+  enum class ErrDef { None = 0, BadFormat = 1, BadArgs = 2, Failed = 3 };
+  void SetError(ErrDef);
+
+  // Returns the full content of a GDB-remote packet, in the format:
+  //    $payload#checksum
+  // where the two-digit checksum is computed as the modulo 256 sum of all
+  // characters between the leading ‘$’ and the trailing ‘#’.
+  std::string GetPacketData() const;
+
+ private:
+  int32_t seq_;
+  std::string data_;
+  size_t read_index_;
+};
+
+}  // namespace gdb_server
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_DEBUG_WASM_GDB_SERVER_PACKET_H_
diff --git a/deps/v8/src/debug/wasm/gdb-server/session.cc b/deps/v8/src/debug/wasm/gdb-server/session.cc
index 3e98e093afe..b0529340717 100644
--- a/deps/v8/src/debug/wasm/gdb-server/session.cc
+++ b/deps/v8/src/debug/wasm/gdb-server/session.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "src/debug/wasm/gdb-server/session.h"
+#include "src/debug/wasm/gdb-server/packet.h"
 #include "src/debug/wasm/gdb-server/transport.h"
 
 namespace v8 {
@@ -10,7 +11,8 @@ namespace internal {
 namespace wasm {
 namespace gdb_server {
 
-Session::Session(Transport* transport) : io_(transport), connected_(true) {}
+Session::Session(TransportBase* transport)
+    : io_(transport), connected_(true), ack_enabled_(true) {}
 
 void Session::WaitForDebugStubEvent() { io_->WaitForDebugStubEvent(); }
 
@@ -34,14 +36,112 @@ bool Session::GetChar(char* ch) {
   return true;
 }
 
-bool Session::GetPacket() {
+bool Session::SendPacket(Packet* pkt, bool expect_ack) {
   char ch;
-  if (!GetChar(&ch)) return false;
+  do {
+    std::string data = pkt->GetPacketData();
+
+    TRACE_GDB_REMOTE("TX %s\n", data.size() < 160
+                                    ? data.c_str()
+                                    : (data.substr(0, 160) + "...").c_str());
+    if (!io_->Write(data.data(), static_cast<int32_t>(data.length()))) {
+      return false;
+    }
+
+    // If ACKs are off, we are done.
+    if (!expect_ack || !ack_enabled_) {
+      break;
+    }
+
+    // Otherwise, poll for '+'
+    if (!GetChar(&ch)) {
+      return false;
+    }
+
+    // Retry if we didn't get a '+'
+  } while (ch != '+');
 
-  // discard the input
   return true;
 }
 
+bool Session::GetPayload(Packet* pkt, uint8_t* checksum) {
+  pkt->Clear();
+  *checksum = 0;
+
+  // Stream in the characters
+  char ch;
+  while (GetChar(&ch)) {
+    if (ch == '#') {
+      // If we see a '#' we must be done with the data.
+      return true;
+    } else if (ch == '$') {
+      // If we see a '$' we must have missed the last cmd, let's retry.
+      TRACE_GDB_REMOTE("RX Missing $, retry.\n");
+      *checksum = 0;
+      pkt->Clear();
+    } else {
+      // Keep a running XSUM.
+      *checksum += ch;
+      pkt->AddRawChar(ch);
+    }
+  }
+  return false;
+}
+
+bool Session::GetPacket(Packet* pkt) {
+  while (true) {
+    // Toss characters until we see a start of command
+    char ch;
+    do {
+      if (!GetChar(&ch)) {
+        return false;
+      }
+    } while (ch != '$');
+
+    uint8_t running_checksum = 0;
+    if (!GetPayload(pkt, &running_checksum)) {
+      return false;
+    }
+
+    // Get two nibble checksum
+    uint8_t trailing_checksum = 0;
+    char chars[2];
+    if (!GetChar(&chars[0]) || !GetChar(&chars[1]) ||
+        !HexToUInt8(chars, &trailing_checksum)) {
+      return false;
+    }
+
+    TRACE_GDB_REMOTE("RX $%s#%c%c\n", pkt->GetPayload(), chars[0], chars[1]);
+
+    pkt->ParseSequence();
+
+    // If ACKs are off, we are done.
+    if (!ack_enabled_) {
+      return true;
+    }
+
+    // If the XSUMs don't match, signal bad packet
+    if (trailing_checksum == running_checksum) {
+      char out[3] = {'+', 0, 0};
+
+      // If we have a sequence number
+      int32_t seq;
+      if (pkt->GetSequence(&seq)) {
+        // Respond with sequence number
+        UInt8ToHex(seq, &out[1]);
+        return io_->Write(out, 3);
+      } else {
+        return io_->Write(out, 1);
+      }
+    } else {
+      // Resend a bad XSUM and look for retransmit
+      TRACE_GDB_REMOTE("RX Bad XSUM, retry\n");
+      io_->Write("-", 1);
+      // retry...
+    }
+  }
+}
+
 }  // namespace gdb_server
 }  // namespace wasm
 }  // namespace internal
diff --git a/deps/v8/src/debug/wasm/gdb-server/session.h b/deps/v8/src/debug/wasm/gdb-server/session.h
index a76bb4a3b46..d7c22638e61 100644
--- a/deps/v8/src/debug/wasm/gdb-server/session.h
+++ b/deps/v8/src/debug/wasm/gdb-server/session.h
@@ -12,22 +12,24 @@ namespace internal {
 namespace wasm {
 namespace gdb_server {
 
-class Transport;
+class Packet;
+class TransportBase;
 
 // Represents a gdb-remote debugging session.
-class Session {
+class V8_EXPORT_PRIVATE Session {
  public:
-  explicit Session(Transport* transport);
+  explicit Session(TransportBase* transport);
+
+  // Attempt to send a packet and optionally wait for an ACK from the receiver.
+  bool SendPacket(Packet* packet, bool expect_ack = true);
 
   // Attempt to receive a packet.
-  // For the moment this method is only used to check whether the TCP connection
-  // is still active; all bytes read are discarded.
-  bool GetPacket();
+  bool GetPacket(Packet* packet);
 
   // Return true if there is data to read.
   bool IsDataAvailable() const;
 
-  // Return true if the connection still valid.
+  // Return true if the connection is still valid.
   bool IsConnected() const;
 
   // Shutdown the connection.
@@ -42,11 +44,23 @@ class Session {
   // Signal that the debuggee execution stopped because of a trap or breakpoint.
   bool SignalThreadEvent();
 
+  // By default, when either the debugger or the GDB-stub sends a packet,
+  // the first response expected is an acknowledgment: either '+' (to indicate
+  // the packet was received correctly) or '-' (to request retransmission).
+  // When a transport is reliable, the debugger may request that acknowledgement
+  // be disabled by means of the 'QStartNoAckMode' packet.
+  void EnableAck(bool ack_enabled) { ack_enabled_ = ack_enabled; }
+
  private:
+  // Read a single character from the transport.
   bool GetChar(char* ch);
 
-  Transport* io_;   // Transport object not owned by the Session.
-  bool connected_;  // Is the connection still valid.
+  // Read the content of a packet, from a leading '$' to a trailing '#'.
+  bool GetPayload(Packet* pkt, uint8_t* checksum);
+
+  TransportBase* io_;  // Transport object not owned by the Session.
+  bool connected_;     // Is the connection still valid.
+  bool ack_enabled_;   // If true, emit or wait for '+' from RSP stream.
 
   DISALLOW_COPY_AND_ASSIGN(Session);
 };
diff --git a/deps/v8/src/debug/wasm/gdb-server/target.cc b/deps/v8/src/debug/wasm/gdb-server/target.cc
index ac5bf10a0e3..6992fd1192d 100644
--- a/deps/v8/src/debug/wasm/gdb-server/target.cc
+++ b/deps/v8/src/debug/wasm/gdb-server/target.cc
@@ -4,31 +4,96 @@
 
 #include "src/debug/wasm/gdb-server/target.h"
 
+#include <inttypes.h>
 #include "src/base/platform/time.h"
+#include "src/debug/wasm/gdb-server/gdb-remote-util.h"
 #include "src/debug/wasm/gdb-server/gdb-server.h"
+#include "src/debug/wasm/gdb-server/packet.h"
 #include "src/debug/wasm/gdb-server/session.h"
 #include "src/debug/wasm/gdb-server/transport.h"
-#include "src/debug/wasm/gdb-server/util.h"
 
 namespace v8 {
 namespace internal {
 namespace wasm {
 namespace gdb_server {
 
+static const int kThreadId = 1;
+
+// Signals.
+static const int kSigTrace = 5;
+static const int kSigSegv = 11;
+
 Target::Target(GdbServer* gdb_server)
-    : status_(Status::Running), session_(nullptr) {}
+    : gdb_server_(gdb_server),
+      status_(Status::Running),
+      cur_signal_(0),
+      session_(nullptr),
+      debugger_initial_suspension_(true),
+      semaphore_(0),
+      current_isolate_(nullptr) {
+  InitQueryPropertyMap();
+}
+
+void Target::InitQueryPropertyMap() {
+  // Request LLDB to send packets up to 4000 bytes for bulk transfers.
+  query_properties_["Supported"] =
+      "PacketSize=1000;vContSupported-;qXfer:libraries:read+;";
+
+  query_properties_["Attached"] = "1";
+
+  // There is only one register, named 'pc', in this architecture
+  query_properties_["RegisterInfo0"] =
+      "name:pc;alt-name:pc;bitsize:64;offset:0;encoding:uint;format:hex;set:"
+      "General Purpose Registers;gcc:16;dwarf:16;generic:pc;";
+  query_properties_["RegisterInfo1"] = "E45";
+
+  // ProcessInfo for wasm32
+  query_properties_["ProcessInfo"] =
+      "pid:1;ppid:1;uid:1;gid:1;euid:1;egid:1;name:6c6c6462;triple:" +
+      Mem2Hex("wasm32-unknown-unknown-wasm") + ";ptrsize:4;";
+  query_properties_["Symbol"] = "OK";
+
+  // Current thread info
+  char buff[16];
+  snprintf(buff, sizeof(buff), "QC%x", kThreadId);
+  query_properties_["C"] = buff;
+}
 
 void Target::Terminate() {
-  // Executed in the Isolate thread.
-  status_ = Status::Terminated;
+  // Executed in the Isolate thread, when the process shuts down.
+  SetStatus(Status::Terminated);
+}
+
+void Target::OnProgramBreak(Isolate* isolate,
+                            const std::vector<wasm_addr_t>& call_frames) {
+  OnSuspended(isolate, kSigTrace, call_frames);
+}
+void Target::OnException(Isolate* isolate,
+                         const std::vector<wasm_addr_t>& call_frames) {
+  OnSuspended(isolate, kSigSegv, call_frames);
+}
+void Target::OnSuspended(Isolate* isolate, int signal,
+                         const std::vector<wasm_addr_t>& call_frames) {
+  // This function will be called in the isolate thread, when the wasm
+  // interpreter gets suspended.
+
+  bool isWaitingForSuspension = (status_ == Status::WaitingForSuspension);
+  SetStatus(Status::Suspended, signal, call_frames, isolate);
+  if (isWaitingForSuspension) {
+    // Wake the GdbServer thread that was blocked waiting for the Target
+    // to suspend.
+    semaphore_.Signal();
+  } else if (session_) {
+    session_->SignalThreadEvent();
+  }
 }
 
 void Target::Run(Session* session) {
   // Executed in the GdbServer thread.
-
   session_ = session;
   do {
     WaitForDebugEvent();
+    ProcessDebugEvent();
     ProcessCommands();
   } while (!IsTerminated() && session_->IsConnected());
   session_ = nullptr;
@@ -37,7 +102,7 @@ void Target::Run(Session* session) {
 void Target::WaitForDebugEvent() {
   // Executed in the GdbServer thread.
 
-  if (status_ != Status::Terminated) {
+  if (status_ == Status::Running) {
     // Wait for either:
     //   * the thread to fault (or single-step)
     //   * an interrupt from LLDB
@@ -45,18 +110,567 @@ void Target::WaitForDebugEvent() {
   }
 }
 
+void Target::ProcessDebugEvent() {
+  // Executed in the GdbServer thread
+
+  if (status_ == Status::Running) {
+    // Blocks, waiting for the engine to suspend.
+    Suspend();
+  }
+
+  // Here, the wasm interpreter has suspended and we have updated the current
+  // thread info.
+
+  if (debugger_initial_suspension_) {
+    // First time on a connection, we don't send the signal.
+    // All other times, send the signal that triggered us.
+    debugger_initial_suspension_ = false;
+  } else {
+    Packet pktOut;
+    SetStopReply(&pktOut);
+    session_->SendPacket(&pktOut, false);
+  }
+}
+
+void Target::Suspend() {
+  // Executed in the GdbServer thread
+  if (status_ == Status::Running) {
+    // TODO(paolosev) - this only suspends the wasm interpreter.
+    gdb_server_->Suspend();
+
+    status_ = Status::WaitingForSuspension;
+  }
+
+  while (status_ == Status::WaitingForSuspension) {
+    if (semaphore_.WaitFor(base::TimeDelta::FromMilliseconds(500))) {
+      // Here the wasm interpreter is suspended.
+      return;
+    }
+  }
+}
+
 void Target::ProcessCommands() {
   // GDB-remote messages are processed in the GDBServer thread.
 
   if (IsTerminated()) {
     return;
+  } else if (status_ != Status::Suspended) {
+    // Don't process commands if we haven't stopped.
+    return;
   }
 
-  // TODO(paolosev)
-  // For the moment just discard any packet we receive from the debugger.
-  do {
-    if (!session_->GetPacket()) continue;
-  } while (session_->IsConnected());
+  // Now we are ready to process commands.
+  // Loop through packets until we process a continue packet or a detach.
+  Packet recv, reply;
+  while (session_->IsConnected()) {
+    if (!session_->GetPacket(&recv)) {
+      continue;
+    }
+
+    reply.Clear();
+    ProcessPacketResult result = ProcessPacket(&recv, &reply);
+    switch (result) {
+      case ProcessPacketResult::Paused:
+        session_->SendPacket(&reply);
+        break;
+
+      case ProcessPacketResult::Continue:
+        DCHECK_EQ(status_, Status::Running);
+        // If this is a continue type command, break out of this loop.
+        gdb_server_->QuitMessageLoopOnPause();
+        return;
+
+      case ProcessPacketResult::Detach:
+        SetStatus(Status::Running);
+        session_->SendPacket(&reply);
+        session_->Disconnect();
+        gdb_server_->QuitMessageLoopOnPause();
+        return;
+
+      case ProcessPacketResult::Kill:
+        session_->SendPacket(&reply);
+        exit(-9);
+
+      default:
+        UNREACHABLE();
+    }
+  }
+
+  if (!session_->IsConnected()) {
+    debugger_initial_suspension_ = true;
+  }
+}
+
+Target::ProcessPacketResult Target::ProcessPacket(Packet* pkt_in,
+                                                  Packet* pkt_out) {
+  ErrorCode err = ErrorCode::None;
+
+  // Clear the outbound message.
+  pkt_out->Clear();
+
+  // Set the sequence number, if present.
+  int32_t seq = -1;
+  if (pkt_in->GetSequence(&seq)) {
+    pkt_out->SetSequence(seq);
+  }
+
+  // A GDB-remote packet begins with an upper- or lower-case letter, which
+  // generally represents a single command.
+  // The letters 'q' and 'Q' introduce a "General query packets" and are used
+  // to extend the protocol with custom commands.
+  // The format of GDB-remote commands is documented here:
+  // https://sourceware.org/gdb/onlinedocs/gdb/Overview.html#Overview.
+  char cmd;
+  pkt_in->GetRawChar(&cmd);
+
+  switch (cmd) {
+    // Queries the reason the target halted.
+    // IN : $?
+    // OUT: A Stop-reply packet
+    case '?':
+      SetStopReply(pkt_out);
+      break;
+
+    // Resumes execution
+    // IN : $c
+    // OUT: A Stop-reply packet is sent later, when the execution halts.
+    case 'c':
+      SetStatus(Status::Running);
+      return ProcessPacketResult::Continue;
+
+    // Detaches the debugger from this target
+    // IN : $D
+    // OUT: $OK
+    case 'D':
+      TRACE_GDB_REMOTE("Requested Detach.\n");
+      pkt_out->AddString("OK");
+      return ProcessPacketResult::Detach;
+
+    // Read general registers (We only support register 'pc' that contains
+    // the current instruction pointer).
+    // IN : $g
+    // OUT: $xx...xx
+    case 'g': {
+      uint64_t pc = GetCurrentPc();
+      pkt_out->AddBlock(&pc, sizeof(pc));
+      break;
+    }
+
+    // Write general registers - NOT SUPPORTED
+    // IN : $Gxx..xx
+    // OUT: $ (empty string)
+    case 'G': {
+      break;
+    }
+
+    // Set thread for subsequent operations. For Wasm targets, we currently
+    // assume that there is only one thread with id = kThreadId (= 1).
+    // IN : $H(c/g)(-1,0,xxxx)
+    // OUT: $OK
+    case 'H': {
+      // Type of the operation (‘m’, ‘M’, ‘g’, ‘G’, ...)
+      char operation;
+      if (!pkt_in->GetRawChar(&operation)) {
+        err = ErrorCode::BadFormat;
+        break;
+      }
+
+      uint64_t thread_id;
+      if (!pkt_in->GetNumberSep(&thread_id, 0)) {
+        err = ErrorCode::BadFormat;
+        break;
+      }
+
+      // Ignore, only one thread supported for now.
+      pkt_out->AddString("OK");
+      break;
+    }
+
+    // Kills the debuggee.
+    // IN : $k
+    // OUT: $OK
+    case 'k':
+      TRACE_GDB_REMOTE("Requested Kill.\n");
+      pkt_out->AddString("OK");
+      return ProcessPacketResult::Kill;
+
+    // Reads {llll} addressable memory units starting at address {aaaa}.
+    // IN : $maaaa,llll
+    // OUT: $xx..xx
+    case 'm': {
+      uint64_t address;
+      if (!pkt_in->GetNumberSep(&address, 0)) {
+        err = ErrorCode::BadFormat;
+        break;
+      }
+      wasm_addr_t wasm_addr(address);
+
+      uint64_t len;
+      if (!pkt_in->GetNumberSep(&len, 0)) {
+        err = ErrorCode::BadFormat;
+        break;
+      }
+
+      if (len > Transport::kBufSize / 2) {
+        err = ErrorCode::BadArgs;
+        break;
+      }
+
+      uint32_t length = static_cast<uint32_t>(len);
+      uint8_t buff[Transport::kBufSize];
+      if (wasm_addr.ModuleId() > 0) {
+        uint32_t read =
+            gdb_server_->GetWasmModuleBytes(wasm_addr, buff, length);
+        if (read > 0) {
+          pkt_out->AddBlock(buff, read);
+        } else {
+          err = ErrorCode::Failed;
+        }
+      } else {
+        err = ErrorCode::BadArgs;
+      }
+      break;
+    }
+
+    // Writes {llll} addressable memory units starting at address {aaaa}.
+    // IN : $Maaaa,llll:xx..xx
+    // OUT: $OK
+    case 'M': {
+      // Writing to memory not supported for Wasm.
+      err = ErrorCode::Failed;
+      break;
+    }
+
+    // pN: Reads the value of register N.
+    // IN : $pxx
+    // OUT: $xx..xx
+    case 'p': {
+      uint64_t pc = GetCurrentPc();
+      pkt_out->AddBlock(&pc, sizeof(pc));
+    } break;
+
+    case 'q': {
+      err = ProcessQueryPacket(pkt_in, pkt_out);
+      break;
+    }
+
+    // Single step
+    // IN : $s
+    // OUT: A Stop-reply packet is sent later, when the execution halts.
+    case 's': {
+      if (status_ == Status::Suspended) {
+        gdb_server_->PrepareStep();
+        SetStatus(Status::Running);
+      }
+      return ProcessPacketResult::Continue;
+    }
+
+    // Find out if the thread 'id' is alive.
+    // IN : $T
+    // OUT: $OK if alive, $Enn if thread is dead.
+    case 'T': {
+      uint64_t id;
+      if (!pkt_in->GetNumberSep(&id, 0)) {
+        err = ErrorCode::BadFormat;
+        break;
+      }
+      if (id != kThreadId) {
+        err = ErrorCode::BadArgs;
+        break;
+      }
+      pkt_out->AddString("OK");
+      break;
+    }
+
+    // Z: Adds a breakpoint
+    // IN : $Z<type>,<addr>,<kind>
+    //      <type>: 0: sw breakpoint, 1: hw breakpoint, 2: watchpoint
+    // OUT: $OK (success) or $Enn (error)
+    case 'Z': {
+      uint64_t breakpoint_type;
+      uint64_t breakpoint_address;
+      uint64_t breakpoint_kind;
+      // Only software breakpoints are supported.
+      if (!pkt_in->GetNumberSep(&breakpoint_type, 0) || breakpoint_type != 0 ||
+          !pkt_in->GetNumberSep(&breakpoint_address, 0) ||
+          !pkt_in->GetNumberSep(&breakpoint_kind, 0)) {
+        err = ErrorCode::BadFormat;
+        break;
+      }
+
+      wasm_addr_t wasm_breakpoint_addr(breakpoint_address);
+      if (!gdb_server_->AddBreakpoint(wasm_breakpoint_addr.ModuleId(),
+                                      wasm_breakpoint_addr.Offset())) {
+        err = ErrorCode::Failed;
+        break;
+      }
+
+      pkt_out->AddString("OK");
+      break;
+    }
+
+    // z: Removes a breakpoint
+    // IN : $z<type>,<addr>,<kind>
+    //      <type>: 0: sw breakpoint, 1: hw breakpoint, 2: watchpoint
+    // OUT: $OK (success) or $Enn (error)
+    case 'z': {
+      uint64_t breakpoint_type;
+      uint64_t breakpoint_address;
+      uint64_t breakpoint_kind;
+      if (!pkt_in->GetNumberSep(&breakpoint_type, 0) || breakpoint_type != 0 ||
+          !pkt_in->GetNumberSep(&breakpoint_address, 0) ||
+          !pkt_in->GetNumberSep(&breakpoint_kind, 0)) {
+        err = ErrorCode::BadFormat;
+        break;
+      }
+
+      wasm_addr_t wasm_breakpoint_addr(breakpoint_address);
+      if (!gdb_server_->RemoveBreakpoint(wasm_breakpoint_addr.ModuleId(),
+                                         wasm_breakpoint_addr.Offset())) {
+        err = ErrorCode::Failed;
+        break;
+      }
+
+      pkt_out->AddString("OK");
+      break;
+    }
+
+    // If the command is not recognized, ignore it by sending an empty reply.
+    default: {
+      TRACE_GDB_REMOTE("Unknown command: %s\n", pkt_in->GetPayload());
+    }
+  }
+
+  // If there is an error, return the error code instead of a payload
+  if (err != ErrorCode::None) {
+    pkt_out->Clear();
+    pkt_out->AddRawChar('E');
+    pkt_out->AddWord8(static_cast<uint8_t>(err));
+  }
+  return ProcessPacketResult::Paused;
+}
+
+Target::ErrorCode Target::ProcessQueryPacket(const Packet* pkt_in,
+                                             Packet* pkt_out) {
+  const char* str = &pkt_in->GetPayload()[1];
+
+  // Get first thread query
+  // IN : $qfThreadInfo
+  // OUT: $m<tid>
+  //
+  // Get next thread query
+  // IN : $qsThreadInfo
+  // OUT: $m<tid> or l to denote end of list.
+  if (!strcmp(str, "fThreadInfo") || !strcmp(str, "sThreadInfo")) {
+    if (str[0] == 'f') {
+      pkt_out->AddString("m");
+      pkt_out->AddNumberSep(kThreadId, 0);
+    } else {
+      pkt_out->AddString("l");
+    }
+    return ErrorCode::None;
+  }
+
+  // Get a list of loaded libraries
+  // IN : $qXfer:libraries:read
+  // OUT: an XML document which lists loaded libraries, with this format:
+  // <library-list>
+  //   <library name="foo.wasm">
+  //     <section address="0x100000000"/>
+  //   </library>
+  //   <library name="bar.wasm">
+  //     <section address="0x200000000"/>
+  //   </library>
+  // </library-list>
+  // Note that LLDB must be compiled with libxml2 support to handle this packet.
+  std::string tmp = "Xfer:libraries:read";
+  if (!strncmp(str, tmp.data(), tmp.length())) {
+    std::vector<GdbServer::WasmModuleInfo> modules =
+        gdb_server_->GetLoadedModules();
+    std::string result("l<library-list>");
+    for (const auto& module : modules) {
+      wasm_addr_t address(module.module_id, 0);
+      char address_string[32];
+      snprintf(address_string, sizeof(address_string), "%" PRIu64,
+               static_cast<uint64_t>(address));
+      result += "<library name=\"";
+      result += module.module_name;
+      result += "\"><section address=\"";
+      result += address_string;
+      result += "\"/></library>";
+    }
+    result += "</library-list>";
+    pkt_out->AddString(result.c_str());
+    return ErrorCode::None;
+  }
+
+  // Get the current call stack.
+  // IN : $qWasmCallStack
+  // OUT: $xx..xxyy..yyzz..zz (A sequence of uint64_t values represented as
+  //                           consecutive 8-bytes blocks).
+  std::vector<std::string> toks = StringSplit(str, ":;");
+  if (toks[0] == "WasmCallStack") {
+    std::vector<wasm_addr_t> call_stack_pcs = gdb_server_->GetWasmCallStack();
+    std::vector<uint64_t> buffer;
+    for (wasm_addr_t pc : call_stack_pcs) {
+      buffer.push_back(pc);
+    }
+    pkt_out->AddBlock(buffer.data(),
+                      static_cast<uint32_t>(sizeof(uint64_t) * buffer.size()));
+    return ErrorCode::None;
+  }
+
+  // Get a Wasm global value in the Wasm module specified.
+  // IN : $qWasmGlobal:frame_index;index
+  // OUT: $xx..xx
+  if (toks[0] == "WasmGlobal") {
+    if (toks.size() == 3) {
+      uint32_t frame_index =
+          static_cast<uint32_t>(strtol(toks[1].data(), nullptr, 10));
+      uint32_t index =
+          static_cast<uint32_t>(strtol(toks[2].data(), nullptr, 10));
+      uint8_t buff[16];
+      uint32_t size = 0;
+      if (gdb_server_->GetWasmGlobal(frame_index, index, buff, 16, &size)) {
+        pkt_out->AddBlock(buff, size);
+        return ErrorCode::None;
+      } else {
+        return ErrorCode::Failed;
+      }
+    }
+    return ErrorCode::BadFormat;
+  }
+
+  // Get a Wasm local value in the stack frame specified.
+  // IN : $qWasmLocal:frame_index;index
+  // OUT: $xx..xx
+  if (toks[0] == "WasmLocal") {
+    if (toks.size() == 3) {
+      uint32_t frame_index =
+          static_cast<uint32_t>(strtol(toks[1].data(), nullptr, 10));
+      uint32_t index =
+          static_cast<uint32_t>(strtol(toks[2].data(), nullptr, 10));
+      uint8_t buff[16];
+      uint32_t size = 0;
+      if (gdb_server_->GetWasmLocal(frame_index, index, buff, 16, &size)) {
+        pkt_out->AddBlock(buff, size);
+        return ErrorCode::None;
+      } else {
+        return ErrorCode::Failed;
+      }
+    }
+    return ErrorCode::BadFormat;
+  }
+
+  // Get a Wasm local from the operand stack at the index specified.
+  // IN : qWasmStackValue:frame_index;index
+  // OUT: $xx..xx
+  if (toks[0] == "WasmStackValue") {
+    if (toks.size() == 3) {
+      uint32_t frame_index =
+          static_cast<uint32_t>(strtol(toks[1].data(), nullptr, 10));
+      uint32_t index =
+          static_cast<uint32_t>(strtol(toks[2].data(), nullptr, 10));
+      uint8_t buff[16];
+      uint32_t size = 0;
+      if (gdb_server_->GetWasmStackValue(frame_index, index, buff, 16, &size)) {
+        pkt_out->AddBlock(buff, size);
+        return ErrorCode::None;
+      } else {
+        return ErrorCode::Failed;
+      }
+    }
+    return ErrorCode::BadFormat;
+  }
+
+  // Read Wasm memory.
+  // IN : $qWasmMem:frame_index;addr;len
+  // OUT: $xx..xx
+  if (toks[0] == "WasmMem") {
+    if (toks.size() == 4) {
+      uint32_t frame_index =
+          static_cast<uint32_t>(strtol(toks[1].data(), nullptr, 10));
+      uint32_t address =
+          static_cast<uint32_t>(strtol(toks[2].data(), nullptr, 16));
+      uint32_t length =
+          static_cast<uint32_t>(strtol(toks[3].data(), nullptr, 16));
+      if (length > Transport::kBufSize / 2) {
+        return ErrorCode::BadArgs;
+      }
+      uint8_t buff[Transport::kBufSize];
+      uint32_t read =
+          gdb_server_->GetWasmMemory(frame_index, address, buff, length);
+      if (read > 0) {
+        pkt_out->AddBlock(buff, read);
+        return ErrorCode::None;
+      } else {
+        return ErrorCode::Failed;
+      }
+    }
+    return ErrorCode::BadFormat;
+  }
+
+  // No match so far, check the property cache.
+  QueryPropertyMap::const_iterator it = query_properties_.find(toks[0]);
+  if (it != query_properties_.end()) {
+    pkt_out->AddString(it->second.data());
+  }
+  // If not found, just send an empty response.
+  return ErrorCode::None;
+}
+
+// A Stop-reply packet has the format:
+//   Sxx
+// or:
+//   Txx<name1>:<value1>;...;<nameN>:<valueN>
+// where 'xx' is a two-digit hex number that represents the stop signal
+// and the <name>:<value> pairs are used to report additional information,
+// like the thread id.
+void Target::SetStopReply(Packet* pkt_out) const {
+  pkt_out->AddRawChar('T');
+  pkt_out->AddWord8(cur_signal_);
+
+  // Adds 'thread-pcs:<pc1>,...,<pcN>;' A list of pc values for all threads that
+  // currently exist in the process.
+  char buff[64];
+  snprintf(buff, sizeof(buff), "thread-pcs:%" PRIx64 ";",
+           static_cast<uint64_t>(GetCurrentPc()));
+  pkt_out->AddString(buff);
+
+  // Adds 'thread:<tid>;' pair. Note that a terminating ';' is required.
+  pkt_out->AddString("thread:");
+  pkt_out->AddNumberSep(kThreadId, ';');
+}
+
+void Target::SetStatus(Status status, int8_t signal,
+                       std::vector<wasm_addr_t> call_frames, Isolate* isolate) {
+  v8::base::MutexGuard guard(&mutex_);
+
+  DCHECK((status == Status::Suspended && signal != 0 &&
+          call_frames.size() > 0 && isolate != nullptr) ||
+         (status != Status::Suspended && signal == 0 &&
+          call_frames.size() == 0 && isolate == nullptr));
+
+  current_isolate_ = isolate;
+  status_ = status;
+  cur_signal_ = signal;
+  call_frames_ = call_frames;
+}
+
+const std::vector<wasm_addr_t> Target::GetCallStack() const {
+  v8::base::MutexGuard guard(&mutex_);
+
+  return call_frames_;
+}
+
+wasm_addr_t Target::GetCurrentPc() const {
+  v8::base::MutexGuard guard(&mutex_);
+
+  wasm_addr_t pc{0};
+  if (call_frames_.size() > 0) {
+    pc = call_frames_[0];
+  }
+  return pc;
 }
 
 }  // namespace gdb_server
diff --git a/deps/v8/src/debug/wasm/gdb-server/target.h b/deps/v8/src/debug/wasm/gdb-server/target.h
index 93d02489c5b..1af81d3dbec 100644
--- a/deps/v8/src/debug/wasm/gdb-server/target.h
+++ b/deps/v8/src/debug/wasm/gdb-server/target.h
@@ -6,7 +6,9 @@
 #define V8_DEBUG_WASM_GDB_SERVER_TARGET_H_
 
 #include <atomic>
+#include <map>
 #include "src/base/macros.h"
+#include "src/debug/wasm/gdb-server/gdb-remote-util.h"
 
 namespace v8 {
 namespace internal {
@@ -14,6 +16,7 @@ namespace wasm {
 namespace gdb_server {
 
 class GdbServer;
+class Packet;
 class Session;
 
 // Class Target represents a debugging target. It contains the logic to decode
@@ -30,21 +33,101 @@ class Target {
   void Terminate();
   bool IsTerminated() const { return status_ == Status::Terminated; }
 
+  // Notifies that the debuggee thread suspended at a breakpoint.
+  void OnProgramBreak(Isolate* isolate,
+                      const std::vector<wasm_addr_t>& call_frames);
+  // Notifies that the debuggee thread suspended because of an unhandled
+  // exception.
+  void OnException(Isolate* isolate,
+                   const std::vector<wasm_addr_t>& call_frames);
+
+  // Returns the state at the moment of the thread suspension.
+  const std::vector<wasm_addr_t> GetCallStack() const;
+  wasm_addr_t GetCurrentPc() const;
+  Isolate* GetCurrentIsolate() const { return current_isolate_; }
+
  private:
+  void OnSuspended(Isolate* isolate, int signal,
+                   const std::vector<wasm_addr_t>& call_frames);
+
+  // Initializes a map used to make fast lookups when handling query packets
+  // that have a constant response.
+  void InitQueryPropertyMap();
+
   // Blocks waiting for one of these two events to occur:
   // - A network packet arrives from the debugger, or the debugger connection is
   //   closed;
   // - The debuggee suspends execution because of a trap or breakpoint.
   void WaitForDebugEvent();
+  void ProcessDebugEvent();
 
   // Processes GDB-remote packets that arrive from the debugger.
   // This method should be called when the debuggee has suspended its execution.
   void ProcessCommands();
 
-  enum class Status { Running, Terminated };
+  // Requests that the thread suspends execution at the next Wasm instruction.
+  void Suspend();
+
+  enum class ErrorCode { None = 0, BadFormat = 1, BadArgs = 2, Failed = 3 };
+
+  enum class ProcessPacketResult {
+    Paused,    // The command was processed, debuggee still paused.
+    Continue,  // The debuggee should resume execution.
+    Detach,    // Request to detach from the debugger.
+    Kill       // Request to terminate the debuggee process.
+  };
+  // This function always succeedes, since all errors are reported as an error
+  // string "Exx" where xx is a two digit number.
+  // The return value indicates if the target can resume execution or it is
+  // still paused.
+  ProcessPacketResult ProcessPacket(Packet* pkt_in, Packet* pkt_out);
+
+  // Processes a general query packet
+  ErrorCode ProcessQueryPacket(const Packet* pkt_in, Packet* pkt_out);
+
+  // Formats a 'Stop-reply' packet, which is sent in response of a 'c'
+  // (continue), 's' (step) and '?' (query halt reason) commands.
+  void SetStopReply(Packet* pkt_out) const;
+
+  enum class Status { Running, WaitingForSuspension, Suspended, Terminated };
+
+  void SetStatus(Status status, int8_t signal = 0,
+                 std::vector<wasm_addr_t> call_frames_ = {},
+                 Isolate* isolate = nullptr);
+
+  GdbServer* gdb_server_;
+
   std::atomic<Status> status_;
 
-  Session* session_;  // Session object not owned by the Target.
+  // Signal being processed.
+  std::atomic<int8_t> cur_signal_;
+
+  // Session object not owned by the Target.
+  Session* session_;
+
+  // Map used to make fast lookups when handling query packets.
+  typedef std::map<std::string, std::string> QueryPropertyMap;
+  QueryPropertyMap query_properties_;
+
+  bool debugger_initial_suspension_;
+
+  // Used to block waiting for suspension
+  v8::base::Semaphore semaphore_;
+
+  mutable v8::base::Mutex mutex_;
+  //////////////////////////////////////////////////////////////////////////////
+  // Protected by {mutex_}:
+
+  // Current isolate. This is not null only when the target is in a Suspended
+  // state and it is the isolate associated to the current call stack and used
+  // for all debugging activities.
+  Isolate* current_isolate_;
+
+  // Call stack when the execution is suspended.
+  std::vector<wasm_addr_t> call_frames_;
+
+  // End of fields protected by {mutex_}.
+  //////////////////////////////////////////////////////////////////////////////
 
   DISALLOW_COPY_AND_ASSIGN(Target);
 };
diff --git a/deps/v8/src/debug/wasm/gdb-server/transport.cc b/deps/v8/src/debug/wasm/gdb-server/transport.cc
index 385828ff69f..f1aed96e5b2 100644
--- a/deps/v8/src/debug/wasm/gdb-server/transport.cc
+++ b/deps/v8/src/debug/wasm/gdb-server/transport.cc
@@ -73,8 +73,8 @@ SocketBinding SocketBinding::Bind(uint16_t tcp_port) {
   return SocketBinding(socket_handle);
 }
 
-std::unique_ptr<Transport> SocketBinding::CreateTransport() {
-  return std::make_unique<Transport>(socket_handle_);
+std::unique_ptr<SocketTransport> SocketBinding::CreateTransport() {
+  return std::make_unique<SocketTransport>(socket_handle_);
 }
 
 uint16_t SocketBinding::GetBoundPort() {
@@ -101,20 +101,20 @@ void DisableNagleAlgorithm(SocketHandle socket) {
   }
 }
 
-TransportBase::TransportBase(SocketHandle s)
+Transport::Transport(SocketHandle s)
     : buf_(new char[kBufSize]),
       pos_(0),
       size_(0),
       handle_bind_(s),
       handle_accept_(InvalidSocket) {}
 
-TransportBase::~TransportBase() {
+Transport::~Transport() {
   if (handle_accept_ != InvalidSocket) {
     CloseSocket(handle_accept_);
   }
 }
 
-void TransportBase::CopyFromBuffer(char** dst, int32_t* len) {
+void Transport::CopyFromBuffer(char** dst, int32_t* len) {
   int32_t copy_bytes = std::min(*len, size_ - pos_);
   memcpy(*dst, buf_.get() + pos_, copy_bytes);
   pos_ += copy_bytes;
@@ -122,7 +122,7 @@ void TransportBase::CopyFromBuffer(char** dst, int32_t* len) {
   *dst += copy_bytes;
 }
 
-bool TransportBase::Read(char* dst, int32_t len) {
+bool Transport::Read(char* dst, int32_t len) {
   if (pos_ < size_) {
     CopyFromBuffer(&dst, &len);
   }
@@ -137,7 +137,7 @@ bool TransportBase::Read(char* dst, int32_t len) {
   return true;
 }
 
-bool TransportBase::Write(const char* src, int32_t len) {
+bool Transport::Write(const char* src, int32_t len) {
   while (len > 0) {
     ssize_t result = ::send(handle_accept_, src, len, 0);
     if (result > 0) {
@@ -156,7 +156,7 @@ bool TransportBase::Write(const char* src, int32_t len) {
 }
 
 // Return true if there is data to read.
-bool TransportBase::IsDataAvailable() const {
+bool Transport::IsDataAvailable() const {
   if (pos_ < size_) {
     return true;
   }
@@ -180,18 +180,17 @@ bool TransportBase::IsDataAvailable() const {
   return false;
 }
 
-void TransportBase::Close() {
+void Transport::Close() {
   ::shutdown(handle_bind_, SD_BOTH);
   CloseSocket(handle_bind_);
   Disconnect();
 }
 
-void TransportBase::Disconnect() {
+void Transport::Disconnect() {
   if (handle_accept_ != InvalidSocket) {
     // Shutdown the connection in both directions.  This should
     // always succeed, and nothing we can do if this fails.
     ::shutdown(handle_accept_, SD_BOTH);
-
     CloseSocket(handle_accept_);
     handle_accept_ = InvalidSocket;
   }
@@ -199,29 +198,33 @@ void TransportBase::Disconnect() {
 
 #if _WIN32
 
-Transport::Transport(SocketHandle s) : TransportBase(s) {
+SocketTransport::SocketTransport(SocketHandle s) : Transport(s) {
   socket_event_ = WSA_INVALID_EVENT;
   faulted_thread_event_ = ::CreateEvent(NULL, TRUE, FALSE, NULL);
   if (faulted_thread_event_ == NULL) {
     TRACE_GDB_REMOTE(
-        "Transport::Transport: Failed to create event object for faulted"
-        "thread\n");
+        "SocketTransport::SocketTransport: Failed to create event object for "
+        "faulted thread\n");
   }
 }
 
-Transport::~Transport() {
+SocketTransport::~SocketTransport() {
   if (!CloseHandle(faulted_thread_event_)) {
-    TRACE_GDB_REMOTE("Transport::~Transport: Failed to close event\n");
+    TRACE_GDB_REMOTE(
+        "SocketTransport::~SocketTransport: Failed to close "
+        "event\n");
   }
 
   if (socket_event_) {
     if (!::WSACloseEvent(socket_event_)) {
-      TRACE_GDB_REMOTE("Transport::~Transport: Failed to close socket event\n");
+      TRACE_GDB_REMOTE(
+          "SocketTransport::~SocketTransport: Failed to close "
+          "socket event\n");
     }
   }
 }
 
-bool Transport::AcceptConnection() {
+bool SocketTransport::AcceptConnection() {
   CHECK(handle_accept_ == InvalidSocket);
   handle_accept_ = ::accept(handle_bind_, NULL, 0);
   if (handle_accept_ != InvalidSocket) {
@@ -231,7 +234,7 @@ bool Transport::AcceptConnection() {
     socket_event_ = ::WSACreateEvent();
     if (socket_event_ == WSA_INVALID_EVENT) {
       TRACE_GDB_REMOTE(
-          "Transport::AcceptConnection: Failed to create socket event\n");
+          "SocketTransport::AcceptConnection: Failed to create socket event\n");
     }
 
     // Listen for close events in order to handle them correctly.
@@ -241,14 +244,15 @@ bool Transport::AcceptConnection() {
     if (::WSAEventSelect(handle_accept_, socket_event_, FD_CLOSE | FD_READ) ==
         SOCKET_ERROR) {
       TRACE_GDB_REMOTE(
-          "Transport::AcceptConnection: Failed to bind event to socket\n");
+          "SocketTransport::AcceptConnection: Failed to bind event to "
+          "socket\n");
     }
     return true;
   }
   return false;
 }
 
-bool Transport::ReadSomeData() {
+bool SocketTransport::ReadSomeData() {
   while (true) {
     ssize_t result =
         ::recv(handle_accept_, buf_.get() + size_, kBufSize - size_, 0);
@@ -259,7 +263,6 @@ bool Transport::ReadSomeData() {
     if (result == 0) {
       return false;  // The connection was gracefully closed.
     }
-
     // WSAEventSelect sets socket to non-blocking mode. This is essential
     // for socket event notification to work, there is no workaround.
     // See remarks section at the page
@@ -267,11 +270,11 @@ bool Transport::ReadSomeData() {
     if (SocketGetLastError() == WSAEWOULDBLOCK) {
       if (::WaitForSingleObject(socket_event_, INFINITE) == WAIT_FAILED) {
         TRACE_GDB_REMOTE(
-            "Transport::ReadSomeData: Failed to wait on socket event\n");
+            "SocketTransport::ReadSomeData: Failed to wait on socket event\n");
       }
       if (!::ResetEvent(socket_event_)) {
         TRACE_GDB_REMOTE(
-            "Transport::ReadSomeData: Failed to reset socket event\n");
+            "SocketTransport::ReadSomeData: Failed to reset socket event\n");
       }
       continue;
     }
@@ -282,7 +285,7 @@ bool Transport::ReadSomeData() {
   }
 }
 
-void Transport::WaitForDebugStubEvent() {
+void SocketTransport::WaitForDebugStubEvent() {
   // Don't wait if we already have data to read.
   bool wait = !(pos_ < size_);
 
@@ -295,34 +298,37 @@ void Transport::WaitForDebugStubEvent() {
   if (result == WAIT_OBJECT_0 + 1) {
     if (!ResetEvent(socket_event_)) {
       TRACE_GDB_REMOTE(
-          "Transport::WaitForDebugStubEvent: Failed to reset socket event\n");
+          "SocketTransport::WaitForDebugStubEvent: Failed to reset socket "
+          "event\n");
     }
     return;
   } else if (result == WAIT_OBJECT_0) {
     if (!ResetEvent(faulted_thread_event_)) {
       TRACE_GDB_REMOTE(
-          "Transport::WaitForDebugStubEvent: Failed to reset event\n");
+          "SocketTransport::WaitForDebugStubEvent: Failed to reset event\n");
     }
     return;
   } else if (result == WAIT_TIMEOUT) {
     return;
   }
   TRACE_GDB_REMOTE(
-      "Transport::WaitForDebugStubEvent: Wait for events failed\n");
+      "SocketTransport::WaitForDebugStubEvent: Wait for events failed\n");
 }
 
-bool Transport::SignalThreadEvent() {
+bool SocketTransport::SignalThreadEvent() {
   if (!SetEvent(faulted_thread_event_)) {
     return false;
   }
   return true;
 }
 
-void Transport::Disconnect() {
-  TransportBase::Disconnect();
+void SocketTransport::Disconnect() {
+  Transport::Disconnect();
 
   if (socket_event_ != WSA_INVALID_EVENT && !::WSACloseEvent(socket_event_)) {
-    TRACE_GDB_REMOTE("Transport::~Transport: Failed to close socket event\n");
+    TRACE_GDB_REMOTE(
+        "SocketTransport::~SocketTransport: Failed to close "
+        "socket event\n");
   }
   socket_event_ = WSA_INVALID_EVENT;
   SignalThreadEvent();
@@ -330,7 +336,7 @@ void Transport::Disconnect() {
 
 #else  // _WIN32
 
-Transport::Transport(SocketHandle s) : TransportBase(s) {
+SocketTransport::SocketTransport(SocketHandle s) : Transport(s) {
   int fds[2];
 #if defined(__linux__)
   int ret = pipe2(fds, O_CLOEXEC);
@@ -339,22 +345,27 @@ Transport::Transport(SocketHandle s) : TransportBase(s) {
 #endif
   if (ret < 0) {
     TRACE_GDB_REMOTE(
-        "Transport::Transport: Failed to allocate pipe for faulted thread\n");
+        "SocketTransport::SocketTransport: Failed to allocate pipe for faulted "
+        "thread\n");
   }
   faulted_thread_fd_read_ = fds[0];
   faulted_thread_fd_write_ = fds[1];
 }
 
-Transport::~Transport() {
+SocketTransport::~SocketTransport() {
   if (close(faulted_thread_fd_read_) != 0) {
-    TRACE_GDB_REMOTE("Transport::~Transport: Failed to close event\n");
+    TRACE_GDB_REMOTE(
+        "SocketTransport::~SocketTransport: Failed to close "
+        "event\n");
   }
   if (close(faulted_thread_fd_write_) != 0) {
-    TRACE_GDB_REMOTE("Transport::~Transport: Failed to close event\n");
+    TRACE_GDB_REMOTE(
+        "SocketTransport::~SocketTransport: Failed to close "
+        "event\n");
   }
 }
 
-bool Transport::AcceptConnection() {
+bool SocketTransport::AcceptConnection() {
   CHECK(handle_accept_ == InvalidSocket);
   handle_accept_ = ::accept(handle_bind_, NULL, 0);
   if (handle_accept_ != InvalidSocket) {
@@ -364,7 +375,7 @@ bool Transport::AcceptConnection() {
   return false;
 }
 
-bool Transport::ReadSomeData() {
+bool SocketTransport::ReadSomeData() {
   while (true) {
     ssize_t result =
         ::recv(handle_accept_, buf_.get() + size_, kBufSize - size_, 0);
@@ -381,7 +392,7 @@ bool Transport::ReadSomeData() {
   }
 }
 
-void Transport::WaitForDebugStubEvent() {
+void SocketTransport::WaitForDebugStubEvent() {
   // Don't wait if we already have data to read.
   bool wait = !(pos_ < size_);
 
@@ -407,7 +418,7 @@ void Transport::WaitForDebugStubEvent() {
   }
   if (ret < 0) {
     TRACE_GDB_REMOTE(
-        "Transport::WaitForDebugStubEvent: Failed to wait for "
+        "SocketTransport::WaitForDebugStubEvent: Failed to wait for "
         "debug stub event\n");
   }
 
@@ -416,7 +427,7 @@ void Transport::WaitForDebugStubEvent() {
       char buf[16];
       if (read(faulted_thread_fd_read_, &buf, sizeof(buf)) < 0) {
         TRACE_GDB_REMOTE(
-            "Transport::WaitForDebugStubEvent: Failed to read from "
+            "SocketTransport::WaitForDebugStubEvent: Failed to read from "
             "debug stub event pipe fd\n");
       }
     }
@@ -424,11 +435,13 @@ void Transport::WaitForDebugStubEvent() {
   }
 }
 
-bool Transport::SignalThreadEvent() {
+bool SocketTransport::SignalThreadEvent() {
   // Notify the debug stub by marking the thread as faulted.
   char buf = 0;
   if (write(faulted_thread_fd_write_, &buf, sizeof(buf)) != sizeof(buf)) {
-    TRACE_GDB_REMOTE("SignalThreadEvent: Can't send debug stub event\n");
+    TRACE_GDB_REMOTE(
+        "SocketTransport:SignalThreadEvent: Can't send debug stub "
+        "event\n");
     return false;
   }
   return true;
diff --git a/deps/v8/src/debug/wasm/gdb-server/transport.h b/deps/v8/src/debug/wasm/gdb-server/transport.h
index 077b1d10975..42bf4383bbc 100644
--- a/deps/v8/src/debug/wasm/gdb-server/transport.h
+++ b/deps/v8/src/debug/wasm/gdb-server/transport.h
@@ -8,7 +8,7 @@
 #include <sstream>
 #include <vector>
 #include "src/base/macros.h"
-#include "src/debug/wasm/gdb-server/util.h"
+#include "src/debug/wasm/gdb-server/gdb-remote-util.h"
 
 #if _WIN32
 #include <windows.h>
@@ -47,7 +47,7 @@ namespace internal {
 namespace wasm {
 namespace gdb_server {
 
-class Transport;
+class SocketTransport;
 
 // Acts as a factory for Transport objects bound to a specified TCP port.
 class SocketBinding {
@@ -61,7 +61,7 @@ class SocketBinding {
   bool IsValid() const { return socket_handle_ != InvalidSocket; }
 
   // Create a transport object from this socket binding
-  std::unique_ptr<Transport> CreateTransport();
+  std::unique_ptr<SocketTransport> CreateTransport();
 
   // Get port the socket is bound to.
   uint16_t GetBoundPort();
@@ -70,10 +70,12 @@ class SocketBinding {
   SocketHandle socket_handle_;
 };
 
-class TransportBase {
+class V8_EXPORT_PRIVATE TransportBase {
  public:
-  explicit TransportBase(SocketHandle s);
-  virtual ~TransportBase();
+  virtual ~TransportBase() {}
+
+  // Waits for an incoming connection on the bound port.
+  virtual bool AcceptConnection() = 0;
 
   // Read {len} bytes from this transport, possibly blocking until enough data
   // is available.
@@ -81,23 +83,48 @@ class TransportBase {
   // Returns true on success.
   // Returns false if the connection is closed; in that case the {dst} may have
   // been partially overwritten.
-  bool Read(char* dst, int32_t len);
+  virtual bool Read(char* dst, int32_t len) = 0;
 
   // Write {len} bytes to this transport.
   // Return true on success, false if the connection is closed.
-  bool Write(const char* src, int32_t len);
+  virtual bool Write(const char* src, int32_t len) = 0;
 
   // Return true if there is data to read.
-  bool IsDataAvailable() const;
+  virtual bool IsDataAvailable() const = 0;
+
+  // If we are connected to a debugger, gracefully closes the connection.
+  // This should be called when a debugging session gets closed.
+  virtual void Disconnect() = 0;
 
   // Shuts down this transport, gracefully closing the existing connection and
   // also closing the listening socket. This should be called when the GDB stub
   // shuts down, when the program terminates.
-  void Close();
+  virtual void Close() = 0;
 
-  // If a socket connection with a debugger is present, gracefully closes it.
-  // This should be called when a debugging session gets closed.
-  virtual void Disconnect();
+  // Blocks waiting for one of these two events to occur:
+  // - A network event (a new packet arrives, or the connection is dropped),
+  // - A thread event is signaled (the execution stopped because of a trap or
+  // breakpoint).
+  virtual void WaitForDebugStubEvent() = 0;
+
+  // Signal that this transport should leave an alertable wait state because
+  // the execution of the debuggee was stopped because of a trap or breakpoint.
+  virtual bool SignalThreadEvent() = 0;
+};
+
+class Transport : public TransportBase {
+ public:
+  explicit Transport(SocketHandle s);
+  ~Transport() override;
+
+  // TransportBase
+  bool Read(char* dst, int32_t len) override;
+  bool Write(const char* src, int32_t len) override;
+  bool IsDataAvailable() const override;
+  void Disconnect() override;
+  void Close() override;
+
+  static const int kBufSize = 4096;
 
  protected:
   // Copy buffered data to *dst up to len bytes and update dst and len.
@@ -106,7 +133,6 @@ class TransportBase {
   // Read available data from the socket. Return false on EOF or error.
   virtual bool ReadSomeData() = 0;
 
-  static const int kBufSize = 4096;
   std::unique_ptr<char[]> buf_;
   int32_t pos_;
   int32_t size_;
@@ -116,25 +142,16 @@ class TransportBase {
 
 #if _WIN32
 
-class Transport : public TransportBase {
+class SocketTransport : public Transport {
  public:
-  explicit Transport(SocketHandle s);
-  ~Transport() override;
-
-  // Waits for an incoming connection on the bound port.
-  bool AcceptConnection();
-
-  // Blocks waiting for one of these two events to occur:
-  // - A network event (a new packet arrives, or the connection is dropped),
-  // - A thread event is signaled (the execution stopped because of a trap or
-  // breakpoint).
-  void WaitForDebugStubEvent();
-
-  // Signal that this transport should leave an alertable wait state because
-  // the execution of the debuggee was stopped because of a trap or breakpoint.
-  bool SignalThreadEvent();
+  explicit SocketTransport(SocketHandle s);
+  ~SocketTransport() override;
 
+  // TransportBase
+  bool AcceptConnection() override;
   void Disconnect() override;
+  void WaitForDebugStubEvent() override;
+  bool SignalThreadEvent() override;
 
  private:
   bool ReadSomeData() override;
@@ -142,27 +159,20 @@ class Transport : public TransportBase {
   HANDLE socket_event_;
   HANDLE faulted_thread_event_;
 
-  DISALLOW_COPY_AND_ASSIGN(Transport);
+  DISALLOW_COPY_AND_ASSIGN(SocketTransport);
 };
 
 #else  // _WIN32
 
-class Transport : public TransportBase {
+class SocketTransport : public Transport {
  public:
-  explicit Transport(SocketHandle s);
-  ~Transport() override;
-
-  // Waits for an incoming connection on the bound port.
-  bool AcceptConnection();
+  explicit SocketTransport(SocketHandle s);
+  ~SocketTransport() override;
 
-  // Blocks waiting for one of these two events to occur:
-  // - A network event (a new packet arrives, or the connection is dropped),
-  // - The debuggee suspends execution because of a trap or breakpoint.
-  void WaitForDebugStubEvent();
-
-  // Signal that this transport should leave an alertable wait state because
-  // the execution of the debuggee was stopped because of a trap or breakpoint.
-  bool SignalThreadEvent();
+  // TransportBase
+  bool AcceptConnection() override;
+  void WaitForDebugStubEvent() override;
+  bool SignalThreadEvent() override;
 
  private:
   bool ReadSomeData() override;
@@ -170,7 +180,7 @@ class Transport : public TransportBase {
   int faulted_thread_fd_read_;
   int faulted_thread_fd_write_;
 
-  DISALLOW_COPY_AND_ASSIGN(Transport);
+  DISALLOW_COPY_AND_ASSIGN(SocketTransport);
 };
 
 #endif  // _WIN32
diff --git a/deps/v8/src/debug/wasm/gdb-server/util.h b/deps/v8/src/debug/wasm/gdb-server/util.h
deleted file mode 100644
index 5e977741d8b..00000000000
--- a/deps/v8/src/debug/wasm/gdb-server/util.h
+++ /dev/null
@@ -1,27 +0,0 @@
-// Copyright 2020 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_DEBUG_WASM_GDB_SERVER_UTIL_H_
-#define V8_DEBUG_WASM_GDB_SERVER_UTIL_H_
-
-#include <string>
-#include "src/flags/flags.h"
-#include "src/utils/utils.h"
-
-namespace v8 {
-namespace internal {
-namespace wasm {
-namespace gdb_server {
-
-#define TRACE_GDB_REMOTE(...)                                            \
-  do {                                                                   \
-    if (FLAG_trace_wasm_gdb_remote) PrintF("[gdb-remote] " __VA_ARGS__); \
-  } while (false)
-
-}  // namespace gdb_server
-}  // namespace wasm
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_DEBUG_WASM_GDB_SERVER_UTIL_H_
diff --git a/deps/v8/src/debug/wasm/gdb-server/wasm-module-debug.cc b/deps/v8/src/debug/wasm/gdb-server/wasm-module-debug.cc
new file mode 100644
index 00000000000..2bd9b1e5d49
--- /dev/null
+++ b/deps/v8/src/debug/wasm/gdb-server/wasm-module-debug.cc
@@ -0,0 +1,388 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/debug/wasm/gdb-server/wasm-module-debug.h"
+
+#include "src/api/api-inl.h"
+#include "src/api/api.h"
+#include "src/execution/frames-inl.h"
+#include "src/execution/frames.h"
+#include "src/objects/script.h"
+#include "src/wasm/wasm-debug.h"
+#include "src/wasm/wasm-value.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+namespace gdb_server {
+
+WasmModuleDebug::WasmModuleDebug(v8::Isolate* isolate,
+                                 Local<debug::WasmScript> wasm_script) {
+  DCHECK_EQ(Script::TYPE_WASM, Utils::OpenHandle(*wasm_script)->type());
+
+  isolate_ = isolate;
+  wasm_script_ = Global<debug::WasmScript>(isolate, wasm_script);
+}
+
+std::string WasmModuleDebug::GetModuleName() const {
+  v8::Local<debug::WasmScript> wasm_script = wasm_script_.Get(isolate_);
+  v8::Local<v8::String> name;
+  std::string module_name;
+  if (wasm_script->Name().ToLocal(&name)) {
+    module_name = *(v8::String::Utf8Value(isolate_, name));
+  }
+  return module_name;
+}
+
+Handle<WasmInstanceObject> WasmModuleDebug::GetFirstWasmInstance() {
+  v8::Local<debug::WasmScript> wasm_script = wasm_script_.Get(isolate_);
+  Handle<Script> script = Utils::OpenHandle(*wasm_script);
+
+  Handle<WeakArrayList> weak_instance_list(script->wasm_weak_instance_list(),
+                                           GetIsolate());
+  if (weak_instance_list->length() > 0) {
+    MaybeObject maybe_instance = weak_instance_list->Get(0);
+    if (maybe_instance->IsWeak()) {
+      Handle<WasmInstanceObject> instance(
+          WasmInstanceObject::cast(maybe_instance->GetHeapObjectAssumeWeak()),
+          GetIsolate());
+      return instance;
+    }
+  }
+  return Handle<WasmInstanceObject>::null();
+}
+
+int GetLEB128Size(Vector<const uint8_t> module_bytes, int offset) {
+  int index = offset;
+  while (module_bytes[index] & 0x80) index++;
+  return index + 1 - offset;
+}
+
+int ReturnPc(const NativeModule* native_module, int pc) {
+  Vector<const uint8_t> wire_bytes = native_module->wire_bytes();
+  uint8_t opcode = wire_bytes[pc];
+  switch (opcode) {
+    case kExprCallFunction: {
+      // skip opcode
+      pc++;
+      // skip function index
+      return pc + GetLEB128Size(wire_bytes, pc);
+    }
+    case kExprCallIndirect: {
+      // skip opcode
+      pc++;
+      // skip signature index
+      pc += GetLEB128Size(wire_bytes, pc);
+      // skip table index
+      return pc + GetLEB128Size(wire_bytes, pc);
+    }
+    default:
+      UNREACHABLE();
+  }
+}
+
+// static
+std::vector<wasm_addr_t> WasmModuleDebug::GetCallStack(
+    uint32_t debug_context_id, Isolate* isolate) {
+  std::vector<wasm_addr_t> call_stack;
+  for (StackFrameIterator frame_it(isolate); !frame_it.done();
+       frame_it.Advance()) {
+    StackFrame* const frame = frame_it.frame();
+    switch (frame->type()) {
+      case StackFrame::JAVA_SCRIPT_BUILTIN_CONTINUATION:
+      case StackFrame::JAVA_SCRIPT_BUILTIN_CONTINUATION_WITH_CATCH:
+      case StackFrame::OPTIMIZED:
+      case StackFrame::INTERPRETED:
+      case StackFrame::BUILTIN:
+      case StackFrame::WASM: {
+        // A standard frame may include many summarized frames, due to inlining.
+        std::vector<FrameSummary> frames;
+        StandardFrame::cast(frame)->Summarize(&frames);
+        for (size_t i = frames.size(); i-- != 0;) {
+          int offset = 0;
+          Handle<Script> script;
+
+          auto& summary = frames[i];
+          if (summary.IsJavaScript()) {
+            FrameSummary::JavaScriptFrameSummary const& java_script =
+                summary.AsJavaScript();
+            offset = java_script.code_offset();
+            script = Handle<Script>::cast(java_script.script());
+          } else if (summary.IsWasm()) {
+            FrameSummary::WasmFrameSummary const& wasm = summary.AsWasm();
+            offset = GetWasmFunctionOffset(wasm.wasm_instance()->module(),
+                                           wasm.function_index()) +
+                     wasm.byte_offset();
+            script = wasm.script();
+
+            bool zeroth_frame = call_stack.empty();
+            if (!zeroth_frame) {
+              const NativeModule* native_module =
+                  wasm.wasm_instance()->module_object().native_module();
+              offset = ReturnPc(native_module, offset);
+            }
+          }
+
+          if (offset > 0) {
+            call_stack.push_back(
+                {debug_context_id << 16 | script->id(), uint32_t(offset)});
+          }
+        }
+        break;
+      }
+
+      case StackFrame::BUILTIN_EXIT:
+      default:
+        // ignore the frame.
+        break;
+    }
+  }
+  if (call_stack.empty()) call_stack.push_back({1, 0});
+  return call_stack;
+}
+
+// static
+std::vector<FrameSummary> WasmModuleDebug::FindWasmFrame(
+    StackTraceFrameIterator* frame_it, uint32_t* frame_index) {
+  while (!frame_it->done()) {
+    StackFrame* const frame = frame_it->frame();
+    switch (frame->type()) {
+      case StackFrame::JAVA_SCRIPT_BUILTIN_CONTINUATION:
+      case StackFrame::JAVA_SCRIPT_BUILTIN_CONTINUATION_WITH_CATCH:
+      case StackFrame::OPTIMIZED:
+      case StackFrame::INTERPRETED:
+      case StackFrame::BUILTIN:
+      case StackFrame::WASM: {
+        // A standard frame may include many summarized frames, due to inlining.
+        std::vector<FrameSummary> frames;
+        StandardFrame::cast(frame)->Summarize(&frames);
+        const size_t frame_count = frames.size();
+        DCHECK_GT(frame_count, 0);
+
+        if (frame_count > *frame_index) {
+          if (frame_it->is_wasm())
+            return frames;
+          else
+            return {};
+        } else {
+          *frame_index -= frame_count;
+          frame_it->Advance();
+        }
+        break;
+      }
+
+      case StackFrame::BUILTIN_EXIT:
+      default:
+        // ignore the frame.
+        break;
+    }
+  }
+  return {};
+}
+
+// static
+Handle<WasmInstanceObject> WasmModuleDebug::GetWasmInstance(
+    Isolate* isolate, uint32_t frame_index) {
+  StackTraceFrameIterator frame_it(isolate);
+  std::vector<FrameSummary> frames = FindWasmFrame(&frame_it, &frame_index);
+  if (frames.empty()) {
+    return Handle<WasmInstanceObject>::null();
+  }
+
+  int reversed_index = static_cast<int>(frames.size() - 1 - frame_index);
+  const FrameSummary::WasmFrameSummary& summary =
+      frames[reversed_index].AsWasm();
+  return summary.wasm_instance();
+}
+
+// static
+bool WasmModuleDebug::GetWasmGlobal(Isolate* isolate, uint32_t frame_index,
+                                    uint32_t index, uint8_t* buffer,
+                                    uint32_t buffer_size, uint32_t* size) {
+  HandleScope handles(isolate);
+
+  Handle<WasmInstanceObject> instance = GetWasmInstance(isolate, frame_index);
+  if (!instance.is_null()) {
+    Handle<WasmModuleObject> module_object(instance->module_object(), isolate);
+    const wasm::WasmModule* module = module_object->module();
+    if (index < module->globals.size()) {
+      wasm::WasmValue wasm_value =
+          WasmInstanceObject::GetGlobalValue(instance, module->globals[index]);
+      return GetWasmValue(wasm_value, buffer, buffer_size, size);
+    }
+  }
+  return false;
+}
+
+// static
+bool WasmModuleDebug::GetWasmLocal(Isolate* isolate, uint32_t frame_index,
+                                   uint32_t index, uint8_t* buffer,
+                                   uint32_t buffer_size, uint32_t* size) {
+  HandleScope handles(isolate);
+
+  StackTraceFrameIterator frame_it(isolate);
+  std::vector<FrameSummary> frames = FindWasmFrame(&frame_it, &frame_index);
+  if (frames.empty()) {
+    return false;
+  }
+
+  int reversed_index = static_cast<int>(frames.size() - 1 - frame_index);
+  const FrameSummary& summary = frames[reversed_index];
+  if (summary.IsWasm()) {
+    Handle<WasmInstanceObject> instance = summary.AsWasm().wasm_instance();
+    if (!instance.is_null()) {
+      Handle<WasmModuleObject> module_object(instance->module_object(),
+                                             isolate);
+      wasm::NativeModule* native_module = module_object->native_module();
+      DebugInfo* debug_info = native_module->GetDebugInfo();
+      if (static_cast<uint32_t>(debug_info->GetNumLocals(
+              isolate, frame_it.frame()->pc())) > index) {
+        wasm::WasmValue wasm_value = debug_info->GetLocalValue(
+            index, isolate, frame_it.frame()->pc(), frame_it.frame()->fp(),
+            frame_it.frame()->callee_fp());
+        return GetWasmValue(wasm_value, buffer, buffer_size, size);
+      }
+    }
+  }
+  return false;
+}
+
+// static
+bool WasmModuleDebug::GetWasmStackValue(Isolate* isolate, uint32_t frame_index,
+                                        uint32_t index, uint8_t* buffer,
+                                        uint32_t buffer_size, uint32_t* size) {
+  HandleScope handles(isolate);
+
+  StackTraceFrameIterator frame_it(isolate);
+  std::vector<FrameSummary> frames = FindWasmFrame(&frame_it, &frame_index);
+  if (frames.empty()) {
+    return false;
+  }
+
+  int reversed_index = static_cast<int>(frames.size() - 1 - frame_index);
+  const FrameSummary& summary = frames[reversed_index];
+  if (summary.IsWasm()) {
+    Handle<WasmInstanceObject> instance = summary.AsWasm().wasm_instance();
+    if (!instance.is_null()) {
+      Handle<WasmModuleObject> module_object(instance->module_object(),
+                                             isolate);
+      wasm::NativeModule* native_module = module_object->native_module();
+      DebugInfo* debug_info = native_module->GetDebugInfo();
+      if (static_cast<uint32_t>(debug_info->GetStackDepth(
+              isolate, frame_it.frame()->pc())) > index) {
+        WasmValue wasm_value = debug_info->GetStackValue(
+            index, isolate, frame_it.frame()->pc(), frame_it.frame()->fp(),
+            frame_it.frame()->callee_fp());
+        return GetWasmValue(wasm_value, buffer, buffer_size, size);
+      }
+    }
+  }
+  return false;
+}
+
+// static
+uint32_t WasmModuleDebug::GetWasmMemory(Isolate* isolate, uint32_t frame_index,
+                                        uint32_t offset, uint8_t* buffer,
+                                        uint32_t size) {
+  HandleScope handles(isolate);
+
+  uint32_t bytes_read = 0;
+  Handle<WasmInstanceObject> instance = GetWasmInstance(isolate, frame_index);
+  if (!instance.is_null()) {
+    uint8_t* mem_start = instance->memory_start();
+    size_t mem_size = instance->memory_size();
+    if (static_cast<uint64_t>(offset) + size <= mem_size) {
+      memcpy(buffer, mem_start + offset, size);
+      bytes_read = size;
+    } else if (offset < mem_size) {
+      bytes_read = static_cast<uint32_t>(mem_size) - offset;
+      memcpy(buffer, mem_start + offset, bytes_read);
+    }
+  }
+  return bytes_read;
+}
+
+uint32_t WasmModuleDebug::GetWasmModuleBytes(wasm_addr_t wasm_addr,
+                                             uint8_t* buffer, uint32_t size) {
+  uint32_t bytes_read = 0;
+  // Any instance will work.
+  Handle<WasmInstanceObject> instance = GetFirstWasmInstance();
+  if (!instance.is_null()) {
+    Handle<WasmModuleObject> module_object(instance->module_object(),
+                                           GetIsolate());
+    wasm::NativeModule* native_module = module_object->native_module();
+    const wasm::ModuleWireBytes wire_bytes(native_module->wire_bytes());
+    uint32_t offset = wasm_addr.Offset();
+    if (offset < wire_bytes.length()) {
+      uint32_t module_size = static_cast<uint32_t>(wire_bytes.length());
+      bytes_read = module_size - offset >= size ? size : module_size - offset;
+      memcpy(buffer, wire_bytes.start() + offset, bytes_read);
+    }
+  }
+  return bytes_read;
+}
+
+bool WasmModuleDebug::AddBreakpoint(uint32_t offset, int* breakpoint_id) {
+  v8::Local<debug::WasmScript> wasm_script = wasm_script_.Get(isolate_);
+  Handle<Script> script = Utils::OpenHandle(*wasm_script);
+  Handle<String> condition = GetIsolate()->factory()->empty_string();
+  int breakpoint_address = static_cast<int>(offset);
+  return GetIsolate()->debug()->SetBreakPointForScript(
+      script, condition, &breakpoint_address, breakpoint_id);
+}
+
+void WasmModuleDebug::RemoveBreakpoint(uint32_t offset, int breakpoint_id) {
+  v8::Local<debug::WasmScript> wasm_script = wasm_script_.Get(isolate_);
+  Handle<Script> script = Utils::OpenHandle(*wasm_script);
+  GetIsolate()->debug()->RemoveBreakpointForWasmScript(script, breakpoint_id);
+}
+
+void WasmModuleDebug::PrepareStep() {
+  i::Isolate* isolate = GetIsolate();
+  DebugScope debug_scope(isolate->debug());
+  debug::PrepareStep(reinterpret_cast<v8::Isolate*>(isolate),
+                     debug::StepAction::StepIn);
+}
+
+template <typename T>
+bool StoreValue(const T& value, uint8_t* buffer, uint32_t buffer_size,
+                uint32_t* size) {
+  *size = sizeof(value);
+  if (*size > buffer_size) return false;
+  memcpy(buffer, &value, *size);
+  return true;
+}
+
+// static
+bool WasmModuleDebug::GetWasmValue(const wasm::WasmValue& wasm_value,
+                                   uint8_t* buffer, uint32_t buffer_size,
+                                   uint32_t* size) {
+  switch (wasm_value.type().kind()) {
+    case wasm::kWasmI32.kind():
+      return StoreValue(wasm_value.to_i32(), buffer, buffer_size, size);
+    case wasm::kWasmI64.kind():
+      return StoreValue(wasm_value.to_i64(), buffer, buffer_size, size);
+    case wasm::kWasmF32.kind():
+      return StoreValue(wasm_value.to_f32(), buffer, buffer_size, size);
+    case wasm::kWasmF64.kind():
+      return StoreValue(wasm_value.to_f64(), buffer, buffer_size, size);
+    case wasm::kWasmS128.kind():
+      return StoreValue(wasm_value.to_s128(), buffer, buffer_size, size);
+
+    case wasm::kWasmStmt.kind():
+    case wasm::kWasmAnyRef.kind():
+    case wasm::kWasmFuncRef.kind():
+    case wasm::kWasmNullRef.kind():
+    case wasm::kWasmExnRef.kind():
+    case wasm::kWasmBottom.kind():
+    default:
+      // Not supported
+      return false;
+  }
+}
+
+}  // namespace gdb_server
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/debug/wasm/gdb-server/wasm-module-debug.h b/deps/v8/src/debug/wasm/gdb-server/wasm-module-debug.h
new file mode 100644
index 00000000000..10e6a5da161
--- /dev/null
+++ b/deps/v8/src/debug/wasm/gdb-server/wasm-module-debug.h
@@ -0,0 +1,105 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_DEBUG_WASM_GDB_SERVER_WASM_MODULE_DEBUG_H_
+#define V8_DEBUG_WASM_GDB_SERVER_WASM_MODULE_DEBUG_H_
+
+#include "src/debug/debug.h"
+#include "src/debug/wasm/gdb-server/gdb-remote-util.h"
+#include "src/execution/frames.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+
+class WasmValue;
+
+namespace gdb_server {
+
+// Represents the interface to access the Wasm engine state for a given module.
+// For the moment it only works with interpreted functions, in the future it
+// could be extended to also support Liftoff.
+class WasmModuleDebug {
+ public:
+  WasmModuleDebug(v8::Isolate* isolate, Local<debug::WasmScript> script);
+
+  std::string GetModuleName() const;
+  i::Isolate* GetIsolate() const {
+    return reinterpret_cast<i::Isolate*>(isolate_);
+  }
+
+  // Gets the value of the {index}th global value.
+  static bool GetWasmGlobal(Isolate* isolate, uint32_t frame_index,
+                            uint32_t index, uint8_t* buffer,
+                            uint32_t buffer_size, uint32_t* size);
+
+  // Gets the value of the {index}th local value in the {frame_index}th stack
+  // frame.
+  static bool GetWasmLocal(Isolate* isolate, uint32_t frame_index,
+                           uint32_t index, uint8_t* buffer,
+                           uint32_t buffer_size, uint32_t* size);
+
+  // Gets the value of the {index}th value in the operand stack.
+  static bool GetWasmStackValue(Isolate* isolate, uint32_t frame_index,
+                                uint32_t index, uint8_t* buffer,
+                                uint32_t buffer_size, uint32_t* size);
+
+  // Reads {size} bytes, starting from {offset}, from the Memory instance
+  // associated to this module.
+  // Returns the number of byte copied to {buffer}, or 0 is case of error.
+  // Note: only one Memory for Module is currently supported.
+  static uint32_t GetWasmMemory(Isolate* isolate, uint32_t frame_index,
+                                uint32_t offset, uint8_t* buffer,
+                                uint32_t size);
+
+  // Gets {size} bytes, starting from {offset}, from the Code space of this
+  // module.
+  // Returns the number of byte copied to {buffer}, or 0 is case of error.
+  uint32_t GetWasmModuleBytes(wasm_addr_t wasm_addr, uint8_t* buffer,
+                              uint32_t size);
+
+  // Inserts a breakpoint at the offset {offset} of this module.
+  // Returns {true} if the breakpoint was successfully added.
+  bool AddBreakpoint(uint32_t offset, int* breakpoint_id);
+
+  // Removes a breakpoint at the offset {offset} of the this module.
+  void RemoveBreakpoint(uint32_t offset, int breakpoint_id);
+
+  // Handle stepping in wasm functions via the wasm interpreter.
+  void PrepareStep();
+
+  // Returns the current stack trace as a vector of instruction pointers.
+  static std::vector<wasm_addr_t> GetCallStack(uint32_t debug_context_id,
+                                               Isolate* isolate);
+
+ private:
+  // Returns the module WasmInstance associated to the {frame_index}th frame
+  // in the call stack.
+  static Handle<WasmInstanceObject> GetWasmInstance(Isolate* isolate,
+                                                    uint32_t frame_index);
+
+  // Returns its first WasmInstance for this Wasm module.
+  Handle<WasmInstanceObject> GetFirstWasmInstance();
+
+  // Iterates on current stack frames and return frame information for the
+  // {frame_index} specified.
+  // Returns an empty array if the frame specified does not correspond to a Wasm
+  // stack frame.
+  static std::vector<FrameSummary> FindWasmFrame(
+      StackTraceFrameIterator* frame_it, uint32_t* frame_index);
+
+  // Converts a WasmValue into an array of bytes.
+  static bool GetWasmValue(const wasm::WasmValue& wasm_value, uint8_t* buffer,
+                           uint32_t buffer_size, uint32_t* size);
+
+  v8::Isolate* isolate_;
+  Global<debug::WasmScript> wasm_script_;
+};
+
+}  // namespace gdb_server
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_DEBUG_WASM_GDB_SERVER_WASM_MODULE_DEBUG_H_
diff --git a/deps/v8/src/deoptimizer/deoptimize-reason.h b/deps/v8/src/deoptimizer/deoptimize-reason.h
index 4a23da8532e..413112371f5 100644
--- a/deps/v8/src/deoptimizer/deoptimize-reason.h
+++ b/deps/v8/src/deoptimizer/deoptimize-reason.h
@@ -42,6 +42,7 @@ namespace internal {
   V(NotAJavaScriptObject, "not a JavaScript object")                           \
   V(NotAJavaScriptObjectOrNullOrUndefined,                                     \
     "not a JavaScript object, Null or Undefined")                              \
+  V(NotANumberOrBoolean, "not a Number or Boolean")                            \
   V(NotANumberOrOddball, "not a Number or Oddball")                            \
   V(NotAnArrayIndex, "not an array index")                                     \
   V(NotASmi, "not a Smi")                                                      \
diff --git a/deps/v8/src/deoptimizer/deoptimizer.cc b/deps/v8/src/deoptimizer/deoptimizer.cc
index 9fcccd483c6..b63bb6649fb 100644
--- a/deps/v8/src/deoptimizer/deoptimizer.cc
+++ b/deps/v8/src/deoptimizer/deoptimizer.cc
@@ -26,6 +26,7 @@
 #include "src/objects/heap-number-inl.h"
 #include "src/objects/smi.h"
 #include "src/tracing/trace-event.h"
+#include "torque-generated/exported-class-definitions-tq.h"
 
 // Has to be the last include (doesn't have include guards)
 #include "src/objects/object-macros.h"
@@ -3473,6 +3474,7 @@ void TranslatedState::InitializeCapturedObjectAt(
     case STRING_TABLE_TYPE:
     case PROPERTY_ARRAY_TYPE:
     case SCRIPT_CONTEXT_TABLE_TYPE:
+    case SLOPPY_ARGUMENTS_ELEMENTS_TYPE:
       InitializeObjectWithTaggedFieldsAt(frame, &value_index, slot, map,
                                          no_allocation);
       break;
@@ -3633,6 +3635,19 @@ void TranslatedState::EnsureCapturedObjectAllocatedAt(
                                      &value_index, worklist);
     }
 
+    case SLOPPY_ARGUMENTS_ELEMENTS_TYPE: {
+      // Verify that the arguments size is correct.
+      Smi args_length = Smi::cast(frame->values_[value_index].GetRawValue());
+      int args_size = SloppyArgumentsElements::SizeFor(args_length.value());
+      CHECK_EQ(args_size, slot->GetChildrenCount() * kTaggedSize);
+
+      slot->set_storage(AllocateStorageFor(slot));
+
+      // Make sure all the remaining children (after the map) are allocated.
+      return EnsureChildrenAllocated(slot->GetChildrenCount() - 1, frame,
+                                     &value_index, worklist);
+    }
+
     case PROPERTY_ARRAY_TYPE: {
       // Check we have the right size.
       int length_or_hash =
diff --git a/deps/v8/src/deoptimizer/ppc/deoptimizer-ppc.cc b/deps/v8/src/deoptimizer/ppc/deoptimizer-ppc.cc
index 0a8798dcc87..f8959752b71 100644
--- a/deps/v8/src/deoptimizer/ppc/deoptimizer-ppc.cc
+++ b/deps/v8/src/deoptimizer/ppc/deoptimizer-ppc.cc
@@ -45,10 +45,10 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
 
   // Push saved_regs (needed to populate FrameDescription::registers_).
   // Leave gaps for other registers.
-  __ subi(sp, sp, Operand(kNumberOfRegisters * kPointerSize));
+  __ subi(sp, sp, Operand(kNumberOfRegisters * kSystemPointerSize));
   for (int16_t i = kNumberOfRegisters - 1; i >= 0; i--) {
     if ((saved_regs & (1 << i)) != 0) {
-      __ StoreP(ToRegister(i), MemOperand(sp, kPointerSize * i));
+      __ StoreP(ToRegister(i), MemOperand(sp, kSystemPointerSize * i));
     }
   }
   {
@@ -59,7 +59,7 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
     __ StoreP(fp, MemOperand(scratch));
   }
   const int kSavedRegistersAreaSize =
-      (kNumberOfRegisters * kPointerSize) + kDoubleRegsSize;
+      (kNumberOfRegisters * kSystemPointerSize) + kDoubleRegsSize;
 
   // Get the bailout id is passed as r29 by the caller.
   __ mr(r5, r29);
@@ -98,8 +98,9 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
   // Copy core registers into FrameDescription::registers_[kNumRegisters].
   DCHECK_EQ(Register::kNumRegisters, kNumberOfRegisters);
   for (int i = 0; i < kNumberOfRegisters; i++) {
-    int offset = (i * kPointerSize) + FrameDescription::registers_offset();
-    __ LoadP(r5, MemOperand(sp, i * kPointerSize));
+    int offset =
+        (i * kSystemPointerSize) + FrameDescription::registers_offset();
+    __ LoadP(r5, MemOperand(sp, i * kSystemPointerSize));
     __ StoreP(r5, MemOperand(r4, offset));
   }
 
@@ -109,7 +110,8 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
   for (int i = 0; i < config->num_allocatable_double_registers(); ++i) {
     int code = config->GetAllocatableDoubleCode(i);
     int dst_offset = code * kDoubleSize + double_regs_offset;
-    int src_offset = code * kDoubleSize + kNumberOfRegisters * kPointerSize;
+    int src_offset =
+        code * kDoubleSize + kNumberOfRegisters * kSystemPointerSize;
     __ lfd(d0, MemOperand(sp, src_offset));
     __ stfd(d0, MemOperand(r4, dst_offset));
   }
@@ -143,7 +145,7 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
   __ bind(&pop_loop);
   __ pop(r7);
   __ StoreP(r7, MemOperand(r6, 0));
-  __ addi(r6, r6, Operand(kPointerSize));
+  __ addi(r6, r6, Operand(kSystemPointerSize));
   __ bind(&pop_loop_header);
   __ cmp(r5, sp);
   __ bne(&pop_loop);
@@ -167,7 +169,7 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
   // r4 = one past the last FrameDescription**.
   __ lwz(r4, MemOperand(r3, Deoptimizer::output_count_offset()));
   __ LoadP(r7, MemOperand(r3, Deoptimizer::output_offset()));  // r7 is output_.
-  __ ShiftLeftImm(r4, r4, Operand(kPointerSizeLog2));
+  __ ShiftLeftImm(r4, r4, Operand(kSystemPointerSizeLog2));
   __ add(r4, r7, r4);
   __ b(&outer_loop_header);
 
@@ -187,7 +189,7 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
   __ cmpi(r6, Operand::Zero());
   __ bne(&inner_push_loop);  // test for gt?
 
-  __ addi(r7, r7, Operand(kPointerSize));
+  __ addi(r7, r7, Operand(kSystemPointerSize));
   __ bind(&outer_loop_header);
   __ cmp(r7, r4);
   __ blt(&outer_push_loop);
@@ -213,7 +215,8 @@ void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
     DCHECK(!(scratch.bit() & restored_regs));
     __ mr(scratch, r5);
     for (int i = kNumberOfRegisters - 1; i >= 0; i--) {
-      int offset = (i * kPointerSize) + FrameDescription::registers_offset();
+      int offset =
+          (i * kSystemPointerSize) + FrameDescription::registers_offset();
       if ((restored_regs & (1 << i)) != 0) {
         __ LoadP(ToRegister(i), MemOperand(scratch, offset));
       }
diff --git a/deps/v8/src/diagnostics/arm64/disasm-arm64.cc b/deps/v8/src/diagnostics/arm64/disasm-arm64.cc
index c2a82a58376..3f8f40a244d 100644
--- a/deps/v8/src/diagnostics/arm64/disasm-arm64.cc
+++ b/deps/v8/src/diagnostics/arm64/disasm-arm64.cc
@@ -2252,10 +2252,10 @@ void DisassemblingDecoder::VisitNEONExtract(Instruction* instr) {
 void DisassemblingDecoder::VisitNEONLoadStoreMultiStruct(Instruction* instr) {
   const char* mnemonic = nullptr;
   const char* form = nullptr;
-  const char* form_1v = "{'Vt.%1$s}, ['Xns]";
-  const char* form_2v = "{'Vt.%1$s, 'Vt2.%1$s}, ['Xns]";
-  const char* form_3v = "{'Vt.%1$s, 'Vt2.%1$s, 'Vt3.%1$s}, ['Xns]";
-  const char* form_4v = "{'Vt.%1$s, 'Vt2.%1$s, 'Vt3.%1$s, 'Vt4.%1$s}, ['Xns]";
+  const char* form_1v = "{'Vt.%s}, ['Xns]";
+  const char* form_2v = "{'Vt.%s, 'Vt2.%s}, ['Xns]";
+  const char* form_3v = "{'Vt.%s, 'Vt2.%s, 'Vt3.%s}, ['Xns]";
+  const char* form_4v = "{'Vt.%s, 'Vt2.%s, 'Vt3.%s, 'Vt4.%s}, ['Xns]";
   NEONFormatDecoder nfd(instr, NEONFormatDecoder::LoadStoreFormatMap());
 
   switch (instr->Mask(NEONLoadStoreMultiStructMask)) {
@@ -2349,11 +2349,10 @@ void DisassemblingDecoder::VisitNEONLoadStoreMultiStructPostIndex(
     Instruction* instr) {
   const char* mnemonic = nullptr;
   const char* form = nullptr;
-  const char* form_1v = "{'Vt.%1$s}, ['Xns], 'Xmr1";
-  const char* form_2v = "{'Vt.%1$s, 'Vt2.%1$s}, ['Xns], 'Xmr2";
-  const char* form_3v = "{'Vt.%1$s, 'Vt2.%1$s, 'Vt3.%1$s}, ['Xns], 'Xmr3";
-  const char* form_4v =
-      "{'Vt.%1$s, 'Vt2.%1$s, 'Vt3.%1$s, 'Vt4.%1$s}, ['Xns], 'Xmr4";
+  const char* form_1v = "{'Vt.%s}, ['Xns], 'Xmr1";
+  const char* form_2v = "{'Vt.%s, 'Vt2.%s}, ['Xns], 'Xmr2";
+  const char* form_3v = "{'Vt.%s, 'Vt2.%s, 'Vt3.%s}, ['Xns], 'Xmr3";
+  const char* form_4v = "{'Vt.%s, 'Vt2.%s, 'Vt3.%s, 'Vt4.%s}, ['Xns], 'Xmr4";
   NEONFormatDecoder nfd(instr, NEONFormatDecoder::LoadStoreFormatMap());
 
   switch (instr->Mask(NEONLoadStoreMultiStructPostIndexMask)) {
@@ -2561,7 +2560,7 @@ void DisassemblingDecoder::VisitNEONLoadStoreSingleStruct(Instruction* instr) {
       break;
     case NEON_LD4R:
       mnemonic = "ld4r";
-      form = "{'Vt.%1$s, 'Vt2.%1$s, 'Vt3.%1$s, 'Vt4.%1$s}, ['Xns]";
+      form = "{'Vt.%s, 'Vt2.%s, 'Vt3.%s, 'Vt4.%s}, ['Xns]";
       break;
     default:
       break;
@@ -2722,7 +2721,7 @@ void DisassemblingDecoder::VisitNEONLoadStoreSingleStructPostIndex(
       break;
     case NEON_LD4R_post:
       mnemonic = "ld4r";
-      form = "{'Vt.%1$s, 'Vt2.%1$s, 'Vt3.%1$s, 'Vt4.%1$s}, ['Xns], 'Xmz4";
+      form = "{'Vt.%s, 'Vt2.%s, 'Vt3.%s, 'Vt4.%s}, ['Xns], 'Xmz4";
       break;
     default:
       break;
diff --git a/deps/v8/src/diagnostics/basic-block-profiler.cc b/deps/v8/src/diagnostics/basic-block-profiler.cc
index 262a5364b5e..3d1c2e586e4 100644
--- a/deps/v8/src/diagnostics/basic-block-profiler.cc
+++ b/deps/v8/src/diagnostics/basic-block-profiler.cc
@@ -9,84 +9,132 @@
 #include <sstream>
 
 #include "src/base/lazy-instance.h"
+#include "src/heap/heap-inl.h"
+#include "torque-generated/exported-class-definitions-tq-inl.h"
 
 namespace v8 {
 namespace internal {
 
 DEFINE_LAZY_LEAKY_OBJECT_GETTER(BasicBlockProfiler, BasicBlockProfiler::Get)
 
-BasicBlockProfiler::Data::Data(size_t n_blocks)
-    : n_blocks_(n_blocks),
-      block_rpo_numbers_(n_blocks_),
-      counts_(n_blocks_, 0) {}
+BasicBlockProfilerData::BasicBlockProfilerData(size_t n_blocks)
+    : block_rpo_numbers_(n_blocks), counts_(n_blocks, 0) {}
 
-static void InsertIntoString(std::ostringstream* os, std::string* string) {
-  string->insert(0, os->str());
+void BasicBlockProfilerData::SetCode(const std::ostringstream& os) {
+  code_ = os.str();
 }
 
-static void InsertIntoString(const char* data, std::string* string) {
-  string->insert(0, data);
+void BasicBlockProfilerData::SetFunctionName(std::unique_ptr<char[]> name) {
+  function_name_ = name.get();
 }
 
-void BasicBlockProfiler::Data::SetCode(std::ostringstream* os) {
-  InsertIntoString(os, &code_);
+void BasicBlockProfilerData::SetSchedule(const std::ostringstream& os) {
+  schedule_ = os.str();
 }
 
-void BasicBlockProfiler::Data::SetFunctionName(std::unique_ptr<char[]> name) {
-  InsertIntoString(name.get(), &function_name_);
+void BasicBlockProfilerData::SetBlockRpoNumber(size_t offset,
+                                               int32_t block_rpo) {
+  DCHECK(offset < n_blocks());
+  block_rpo_numbers_[offset] = block_rpo;
 }
 
-void BasicBlockProfiler::Data::SetSchedule(std::ostringstream* os) {
-  InsertIntoString(os, &schedule_);
+void BasicBlockProfilerData::ResetCounts() {
+  for (size_t i = 0; i < n_blocks(); ++i) {
+    counts_[i] = 0;
+  }
 }
 
-void BasicBlockProfiler::Data::SetBlockRpoNumber(size_t offset,
-                                                 int32_t block_rpo) {
-  DCHECK(offset < n_blocks_);
-  block_rpo_numbers_[offset] = block_rpo;
+BasicBlockProfilerData* BasicBlockProfiler::NewData(size_t n_blocks) {
+  base::MutexGuard lock(&data_list_mutex_);
+  auto data = std::make_unique<BasicBlockProfilerData>(n_blocks);
+  BasicBlockProfilerData* data_ptr = data.get();
+  data_list_.push_back(std::move(data));
+  return data_ptr;
 }
 
-intptr_t BasicBlockProfiler::Data::GetCounterAddress(size_t offset) {
-  DCHECK(offset < n_blocks_);
-  return reinterpret_cast<intptr_t>(&(counts_[offset]));
+namespace {
+Handle<String> CopyStringToJSHeap(const std::string& source, Isolate* isolate) {
+  return isolate->factory()->NewStringFromAsciiChecked(source.c_str(),
+                                                       AllocationType::kOld);
 }
 
-void BasicBlockProfiler::Data::ResetCounts() {
-  for (size_t i = 0; i < n_blocks_; ++i) {
-    counts_[i] = 0;
+// Size of entries in both block_rpo_numbers and counts.
+constexpr int kBasicBlockSlotSize = kInt32Size;
+}  // namespace
+
+BasicBlockProfilerData::BasicBlockProfilerData(
+    Handle<OnHeapBasicBlockProfilerData> js_heap_data, Isolate* isolate) {
+  function_name_ = js_heap_data->name().ToCString().get();
+  schedule_ = js_heap_data->schedule().ToCString().get();
+  code_ = js_heap_data->code().ToCString().get();
+  Handle<ByteArray> counts(js_heap_data->counts(), isolate);
+  for (int i = 0; i < counts->length() / kBasicBlockSlotSize; ++i) {
+    counts_.push_back(counts->get_uint32(i));
   }
+  Handle<ByteArray> rpo_numbers(js_heap_data->block_rpo_numbers(), isolate);
+  for (int i = 0; i < rpo_numbers->length() / kBasicBlockSlotSize; ++i) {
+    block_rpo_numbers_.push_back(rpo_numbers->get_int(i));
+  }
+  CHECK_EQ(block_rpo_numbers_.size(), counts_.size());
 }
 
-BasicBlockProfiler::Data* BasicBlockProfiler::NewData(size_t n_blocks) {
-  base::MutexGuard lock(&data_list_mutex_);
-  Data* data = new Data(n_blocks);
-  data_list_.push_back(data);
-  return data;
-}
-
-BasicBlockProfiler::~BasicBlockProfiler() {
-  for (DataList::iterator i = data_list_.begin(); i != data_list_.end(); ++i) {
-    delete (*i);
+Handle<OnHeapBasicBlockProfilerData> BasicBlockProfilerData::CopyToJSHeap(
+    Isolate* isolate) {
+  int array_size_in_bytes = static_cast<int>(n_blocks() * kBasicBlockSlotSize);
+  CHECK(array_size_in_bytes >= 0 &&
+        static_cast<size_t>(array_size_in_bytes) / kBasicBlockSlotSize ==
+            n_blocks());  // Overflow
+  Handle<ByteArray> block_rpo_numbers = isolate->factory()->NewByteArray(
+      array_size_in_bytes, AllocationType::kOld);
+  for (int i = 0; i < static_cast<int>(n_blocks()); ++i) {
+    block_rpo_numbers->set_int(i, block_rpo_numbers_[i]);
   }
+  Handle<ByteArray> counts = isolate->factory()->NewByteArray(
+      array_size_in_bytes, AllocationType::kOld);
+  for (int i = 0; i < static_cast<int>(n_blocks()); ++i) {
+    counts->set_uint32(i, counts_[i]);
+  }
+  Handle<String> name = CopyStringToJSHeap(function_name_, isolate);
+  Handle<String> schedule = CopyStringToJSHeap(schedule_, isolate);
+  Handle<String> code = CopyStringToJSHeap(code_, isolate);
+
+  return isolate->factory()->NewOnHeapBasicBlockProfilerData(
+      block_rpo_numbers, counts, name, schedule, code, AllocationType::kOld);
 }
 
-void BasicBlockProfiler::ResetCounts() {
-  for (DataList::iterator i = data_list_.begin(); i != data_list_.end(); ++i) {
-    (*i)->ResetCounts();
+void BasicBlockProfiler::ResetCounts(Isolate* isolate) {
+  for (const auto& data : data_list_) {
+    data->ResetCounts();
+  }
+  Handle<ArrayList> list(isolate->heap()->basic_block_profiling_data(),
+                         isolate);
+  for (int i = 0; i < list->Length(); ++i) {
+    Handle<ByteArray> counts(
+        OnHeapBasicBlockProfilerData::cast(list->Get(i)).counts(), isolate);
+    for (int j = 0; j < counts->length() / kBasicBlockSlotSize; ++j) {
+      counts->set_uint32(j, 0);
+    }
   }
 }
 
-std::ostream& operator<<(std::ostream& os, const BasicBlockProfiler& p) {
+void BasicBlockProfiler::Print(std::ostream& os, Isolate* isolate) {
   os << "---- Start Profiling Data ----" << std::endl;
-  using iterator = BasicBlockProfiler::DataList::const_iterator;
-  for (iterator i = p.data_list_.begin(); i != p.data_list_.end(); ++i) {
-    os << **i;
+  for (const auto& data : data_list_) {
+    os << *data;
+  }
+  HandleScope scope(isolate);
+  Handle<ArrayList> list(isolate->heap()->basic_block_profiling_data(),
+                         isolate);
+  for (int i = 0; i < list->Length(); ++i) {
+    BasicBlockProfilerData data(
+        handle(OnHeapBasicBlockProfilerData::cast(list->Get(i)), isolate),
+        isolate);
+    os << data;
   }
   os << "---- End Profiling Data ----" << std::endl;
-  return os;
 }
 
-std::ostream& operator<<(std::ostream& os, const BasicBlockProfiler::Data& d) {
+std::ostream& operator<<(std::ostream& os, const BasicBlockProfilerData& d) {
   int block_count_sum = std::accumulate(d.counts_.begin(), d.counts_.end(), 0);
   if (block_count_sum == 0) return os;
   const char* name = "unknown function";
@@ -100,8 +148,8 @@ std::ostream& operator<<(std::ostream& os, const BasicBlockProfiler::Data& d) {
   }
   os << "block counts for " << name << ":" << std::endl;
   std::vector<std::pair<int32_t, uint32_t>> pairs;
-  pairs.reserve(d.n_blocks_);
-  for (size_t i = 0; i < d.n_blocks_; ++i) {
+  pairs.reserve(d.n_blocks());
+  for (size_t i = 0; i < d.n_blocks(); ++i) {
     pairs.push_back(std::make_pair(d.block_rpo_numbers_[i], d.counts_[i]));
   }
   std::sort(pairs.begin(), pairs.end(),
diff --git a/deps/v8/src/diagnostics/basic-block-profiler.h b/deps/v8/src/diagnostics/basic-block-profiler.h
index 9639e0b6615..365c98258ab 100644
--- a/deps/v8/src/diagnostics/basic-block-profiler.h
+++ b/deps/v8/src/diagnostics/basic-block-profiler.h
@@ -14,66 +14,70 @@
 #include "src/base/macros.h"
 #include "src/base/platform/mutex.h"
 #include "src/common/globals.h"
+#include "torque-generated/exported-class-definitions-tq.h"
 
 namespace v8 {
 namespace internal {
 
+class BasicBlockProfilerData {
+ public:
+  explicit BasicBlockProfilerData(size_t n_blocks);
+  V8_EXPORT_PRIVATE BasicBlockProfilerData(
+      Handle<OnHeapBasicBlockProfilerData> js_heap_data, Isolate* isolate);
+
+  size_t n_blocks() const {
+    DCHECK_EQ(block_rpo_numbers_.size(), counts_.size());
+    return block_rpo_numbers_.size();
+  }
+  const uint32_t* counts() const { return &counts_[0]; }
+
+  void SetCode(const std::ostringstream& os);
+  void SetFunctionName(std::unique_ptr<char[]> name);
+  void SetSchedule(const std::ostringstream& os);
+  void SetBlockRpoNumber(size_t offset, int32_t block_rpo);
+
+  // Copy the data from this object into an equivalent object stored on the JS
+  // heap, so that it can survive snapshotting and relocation. This must
+  // happen on the main thread during finalization of the compilation.
+  Handle<OnHeapBasicBlockProfilerData> CopyToJSHeap(Isolate* isolate);
+
+ private:
+  friend class BasicBlockProfiler;
+  friend std::ostream& operator<<(std::ostream& os,
+                                  const BasicBlockProfilerData& s);
+
+  V8_EXPORT_PRIVATE void ResetCounts();
+
+  std::vector<int32_t> block_rpo_numbers_;
+  std::vector<uint32_t> counts_;
+  std::string function_name_;
+  std::string schedule_;
+  std::string code_;
+  DISALLOW_COPY_AND_ASSIGN(BasicBlockProfilerData);
+};
+
 class BasicBlockProfiler {
  public:
-  class Data {
-   public:
-    size_t n_blocks() const { return n_blocks_; }
-    const uint32_t* counts() const { return &counts_[0]; }
-
-    void SetCode(std::ostringstream* os);
-    void SetFunctionName(std::unique_ptr<char[]> name);
-    void SetSchedule(std::ostringstream* os);
-    void SetBlockRpoNumber(size_t offset, int32_t block_rpo);
-    intptr_t GetCounterAddress(size_t offset);
-
-   private:
-    friend class BasicBlockProfiler;
-    friend std::ostream& operator<<(std::ostream& os,
-                                    const BasicBlockProfiler::Data& s);
-
-    explicit Data(size_t n_blocks);
-    ~Data() = default;
-
-    V8_EXPORT_PRIVATE void ResetCounts();
-
-    const size_t n_blocks_;
-    std::vector<int32_t> block_rpo_numbers_;
-    std::vector<uint32_t> counts_;
-    std::string function_name_;
-    std::string schedule_;
-    std::string code_;
-    DISALLOW_COPY_AND_ASSIGN(Data);
-  };
-
-  using DataList = std::list<Data*>;
+  using DataList = std::list<std::unique_ptr<BasicBlockProfilerData>>;
 
   BasicBlockProfiler() = default;
-  ~BasicBlockProfiler();
+  ~BasicBlockProfiler() = default;
 
   V8_EXPORT_PRIVATE static BasicBlockProfiler* Get();
-  Data* NewData(size_t n_blocks);
-  V8_EXPORT_PRIVATE void ResetCounts();
+  BasicBlockProfilerData* NewData(size_t n_blocks);
+  V8_EXPORT_PRIVATE void ResetCounts(Isolate* isolate);
+  V8_EXPORT_PRIVATE void Print(std::ostream& os, Isolate* isolate);
 
   const DataList* data_list() { return &data_list_; }
 
  private:
-  friend V8_EXPORT_PRIVATE std::ostream& operator<<(
-      std::ostream& os, const BasicBlockProfiler& s);
-
   DataList data_list_;
   base::Mutex data_list_mutex_;
 
   DISALLOW_COPY_AND_ASSIGN(BasicBlockProfiler);
 };
 
-V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
-                                           const BasicBlockProfiler& s);
-std::ostream& operator<<(std::ostream& os, const BasicBlockProfiler::Data& s);
+std::ostream& operator<<(std::ostream& os, const BasicBlockProfilerData& s);
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/diagnostics/code-tracer.h b/deps/v8/src/diagnostics/code-tracer.h
index a9f276bf448..194d3cbe667 100644
--- a/deps/v8/src/diagnostics/code-tracer.h
+++ b/deps/v8/src/diagnostics/code-tracer.h
@@ -5,9 +5,11 @@
 #ifndef V8_DIAGNOSTICS_CODE_TRACER_H_
 #define V8_DIAGNOSTICS_CODE_TRACER_H_
 
+#include "src/base/optional.h"
 #include "src/common/globals.h"
 #include "src/flags/flags.h"
 #include "src/utils/allocation.h"
+#include "src/utils/ostreams.h"
 #include "src/utils/utils.h"
 #include "src/utils/vector.h"
 
@@ -45,6 +47,28 @@ class CodeTracer final : public Malloced {
     CodeTracer* tracer_;
   };
 
+  class StreamScope : public Scope {
+   public:
+    explicit StreamScope(CodeTracer* tracer) : Scope(tracer) {
+      FILE* file = this->file();
+      if (file == stdout) {
+        stdout_stream_.emplace();
+      } else {
+        file_stream_.emplace(file);
+      }
+    }
+
+    std::ostream& stream() {
+      if (stdout_stream_.has_value()) return stdout_stream_.value();
+      return file_stream_.value();
+    }
+
+   private:
+    // Exactly one of these two will be initialized.
+    base::Optional<StdoutStream> stdout_stream_;
+    base::Optional<OFStream> file_stream_;
+  };
+
   void OpenFile() {
     if (!ShouldRedirect()) {
       return;
diff --git a/deps/v8/src/diagnostics/disassembler.cc b/deps/v8/src/diagnostics/disassembler.cc
index 785c535e0ac..2b3c9ede006 100644
--- a/deps/v8/src/diagnostics/disassembler.cc
+++ b/deps/v8/src/diagnostics/disassembler.cc
@@ -12,6 +12,7 @@
 #include "src/codegen/assembler-inl.h"
 #include "src/codegen/code-comments.h"
 #include "src/codegen/code-reference.h"
+#include "src/codegen/external-reference-encoder.h"
 #include "src/codegen/macro-assembler.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer/deoptimizer.h"
@@ -20,7 +21,6 @@
 #include "src/ic/ic.h"
 #include "src/objects/objects-inl.h"
 #include "src/snapshot/embedded/embedded-data.h"
-#include "src/snapshot/serializer-common.h"
 #include "src/strings/string-stream.h"
 #include "src/utils/vector.h"
 #include "src/wasm/wasm-code-manager.h"
@@ -222,7 +222,11 @@ static void PrintRelocInfo(StringBuilder* out, Isolate* isolate,
   } else if (RelocInfo::IsEmbeddedObjectMode(rmode)) {
     HeapStringAllocator allocator;
     StringStream accumulator(&allocator);
-    relocinfo->target_object().ShortPrint(&accumulator);
+    if (relocinfo->host().is_null()) {
+      relocinfo->target_object_no_host(isolate).ShortPrint(&accumulator);
+    } else {
+      relocinfo->target_object().ShortPrint(&accumulator);
+    }
     std::unique_ptr<char[]> obj_name = accumulator.ToCString();
     const bool is_compressed = RelocInfo::IsCompressedEmbeddedObject(rmode);
     out->AddFormatted("    ;; %sobject: %s",
@@ -245,9 +249,9 @@ static void PrintRelocInfo(StringBuilder* out, Isolate* isolate,
     }
   } else if (RelocInfo::IsWasmStubCall(rmode) && host.is_wasm_code()) {
     // Host is isolate-independent, try wasm native module instead.
-    const char* runtime_stub_name =
-        host.as_wasm_code()->native_module()->GetRuntimeStubName(
-            relocinfo->wasm_stub_call_address());
+    const char* runtime_stub_name = GetRuntimeStubName(
+        host.as_wasm_code()->native_module()->GetRuntimeStubId(
+            relocinfo->wasm_stub_call_address()));
     out->AddFormatted("    ;; wasm stub: %s", runtime_stub_name);
   } else if (RelocInfo::IsRuntimeEntry(rmode) && isolate &&
              isolate->deoptimizer_data() != nullptr) {
diff --git a/deps/v8/src/diagnostics/ia32/disasm-ia32.cc b/deps/v8/src/diagnostics/ia32/disasm-ia32.cc
index 129c2d72e19..5e0c5c65e23 100644
--- a/deps/v8/src/diagnostics/ia32/disasm-ia32.cc
+++ b/deps/v8/src/diagnostics/ia32/disasm-ia32.cc
@@ -1066,6 +1066,11 @@ int DisassemblerIA32::AVXInstruction(byte* data) {
         AppendToBuffer("vmovaps %s,", NameOfXMMRegister(regop));
         current += PrintRightXMMOperand(current);
         break;
+      case 0x50:
+        AppendToBuffer("vmovmskps %s,%s", NameOfCPURegister(regop),
+                       NameOfXMMRegister(rm));
+        current++;
+        break;
       case 0x51:
         AppendToBuffer("vsqrtps %s,", NameOfXMMRegister(regop));
         current += PrintRightXMMOperand(current);
@@ -1266,6 +1271,11 @@ int DisassemblerIA32::AVXInstruction(byte* data) {
         AppendToBuffer(",%d", Imm8(current));
         current++;
         break;
+      case 0xD7:
+        AppendToBuffer("vpmovmskb %s,%s", NameOfCPURegister(regop),
+                       NameOfXMMRegister(rm));
+        current++;
+        break;
 #define DECLARE_SSE_AVX_DIS_CASE(instruction, notUsed1, notUsed2, opcode) \
   case 0x##opcode: {                                                      \
     AppendToBuffer("v" #instruction " %s,%s,", NameOfXMMRegister(regop),  \
@@ -2347,6 +2357,13 @@ int DisassemblerIA32::InstructionDecode(v8::internal::Vector<char> out_buffer,
           } else if (*data == 0xB1) {
             data++;
             data += PrintOperands("cmpxchg_w", OPER_REG_OP_ORDER, data);
+          } else if (*data == 0xD7) {
+            data++;
+            int mod, regop, rm;
+            get_modrm(*data, &mod, &regop, &rm);
+            AppendToBuffer("pmovmskb %s,%s", NameOfCPURegister(regop),
+                           NameOfXMMRegister(rm));
+            data++;
           } else {
             byte op = *data;
             data++;
diff --git a/deps/v8/src/diagnostics/objects-debug.cc b/deps/v8/src/diagnostics/objects-debug.cc
index 4a9d029a056..e3390bdc5d1 100644
--- a/deps/v8/src/diagnostics/objects-debug.cc
+++ b/deps/v8/src/diagnostics/objects-debug.cc
@@ -72,6 +72,7 @@
 #include "src/utils/ostreams.h"
 #include "src/wasm/wasm-objects-inl.h"
 #include "torque-generated/class-verifiers-tq.h"
+#include "torque-generated/exported-class-definitions-tq-inl.h"
 #include "torque-generated/internal-class-definitions-tq-inl.h"
 
 namespace v8 {
@@ -279,8 +280,6 @@ void Symbol::SymbolVerify(Isolate* isolate) {
   CHECK_IMPLIES(IsPrivateBrand(), IsPrivateName());
 }
 
-USE_TORQUE_VERIFIER(ByteArray)
-
 void BytecodeArray::BytecodeArrayVerify(Isolate* isolate) {
   // TODO(oth): Walk bytecodes and immediate values to validate sanity.
   // - All bytecodes are known and well formed.
@@ -296,10 +295,6 @@ void BytecodeArray::BytecodeArrayVerify(Isolate* isolate) {
   CHECK(handler_table().IsByteArray());
 }
 
-USE_TORQUE_VERIFIER(FreeSpace)
-
-USE_TORQUE_VERIFIER(HeapNumber)
-
 USE_TORQUE_VERIFIER(FeedbackVector)
 
 USE_TORQUE_VERIFIER(JSReceiver)
@@ -330,6 +325,11 @@ void VerifyJSObjectElements(Isolate* isolate, JSObject object) {
     return;
   }
 
+  if (object.HasSloppyArgumentsElements()) {
+    CHECK(object.elements().IsSloppyArgumentsElements());
+    return;
+  }
+
   FixedArray elements = FixedArray::cast(object.elements());
   if (object.HasSmiElements()) {
     // We might have a partially initialized backing store, in which case we
@@ -519,10 +519,6 @@ void EmbedderDataArray::EmbedderDataArrayVerify(Isolate* isolate) {
   }
 }
 
-USE_TORQUE_VERIFIER(FixedArrayBase)
-
-USE_TORQUE_VERIFIER(FixedArray)
-
 void WeakFixedArray::WeakFixedArrayVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::WeakFixedArrayVerify(*this, isolate);
   for (int i = 0; i < length(); i++) {
@@ -530,8 +526,6 @@ void WeakFixedArray::WeakFixedArrayVerify(Isolate* isolate) {
   }
 }
 
-USE_TORQUE_VERIFIER(WeakArrayList)
-
 void PropertyArray::PropertyArrayVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::PropertyArrayVerify(*this, isolate);
   if (length() == 0) {
@@ -636,39 +630,15 @@ void TransitionArray::TransitionArrayVerify(Isolate* isolate) {
   CHECK_LE(LengthFor(number_of_transitions()), length());
 }
 
-void JSArgumentsObject::JSArgumentsObjectVerify(Isolate* isolate) {
-  TorqueGeneratedClassVerifiers::JSArgumentsObjectVerify(*this, isolate);
-  if (IsSloppyArgumentsElementsKind(GetElementsKind())) {
-    SloppyArgumentsElements::cast(elements())
-        .SloppyArgumentsElementsVerify(isolate, *this);
-  }
-  if (isolate->IsInAnyContext(map(), Context::SLOPPY_ARGUMENTS_MAP_INDEX) ||
-      isolate->IsInAnyContext(map(),
-                              Context::SLOW_ALIASED_ARGUMENTS_MAP_INDEX) ||
-      isolate->IsInAnyContext(map(),
-                              Context::FAST_ALIASED_ARGUMENTS_MAP_INDEX)) {
-    VerifyObjectField(isolate, JSSloppyArgumentsObject::kLengthOffset);
-    VerifyObjectField(isolate, JSSloppyArgumentsObject::kCalleeOffset);
-  } else if (isolate->IsInAnyContext(map(),
-                                     Context::STRICT_ARGUMENTS_MAP_INDEX)) {
-    VerifyObjectField(isolate, JSStrictArgumentsObject::kLengthOffset);
-  }
-}
-
-void SloppyArgumentsElements::SloppyArgumentsElementsVerify(Isolate* isolate,
-                                                            JSObject holder) {
-  FixedArrayVerify(isolate);
-  // Abort verification if only partially initialized (can't use arguments()
-  // getter because it does FixedArray::cast()).
-  if (get(kArgumentsIndex).IsUndefined(isolate)) return;
-
+namespace {
+void SloppyArgumentsElementsVerify(Isolate* isolate,
+                                   SloppyArgumentsElements elements,
+                                   JSObject holder) {
+  elements.SloppyArgumentsElementsVerify(isolate);
   ElementsKind kind = holder.GetElementsKind();
   bool is_fast = kind == FAST_SLOPPY_ARGUMENTS_ELEMENTS;
-  CHECK(IsFixedArray());
-  CHECK_GE(length(), 2);
-  CHECK_EQ(map(), ReadOnlyRoots(isolate).sloppy_arguments_elements_map());
-  Context context_object = context();
-  FixedArray arg_elements = FixedArray::cast(arguments());
+  Context context_object = elements.context();
+  FixedArray arg_elements = elements.arguments();
   if (arg_elements.length() == 0) {
     CHECK(arg_elements == ReadOnlyRoots(isolate).empty_fixed_array());
     return;
@@ -684,7 +654,7 @@ void SloppyArgumentsElements::SloppyArgumentsElementsVerify(Isolate* isolate,
   for (int i = 0; i < nofMappedParameters; i++) {
     // Verify that each context-mapped argument is either the hole or a valid
     // Smi within context length range.
-    Object mapped = get_mapped_entry(i);
+    Object mapped = elements.mapped_entries(i);
     if (mapped.IsTheHole(isolate)) {
       // Slow sloppy arguments can be holey.
       if (!is_fast) continue;
@@ -708,6 +678,26 @@ void SloppyArgumentsElements::SloppyArgumentsElementsVerify(Isolate* isolate,
   CHECK_LE(maxMappedIndex, context_object.length());
   CHECK_LE(maxMappedIndex, arg_elements.length());
 }
+}  // namespace
+
+void JSArgumentsObject::JSArgumentsObjectVerify(Isolate* isolate) {
+  TorqueGeneratedClassVerifiers::JSArgumentsObjectVerify(*this, isolate);
+  if (IsSloppyArgumentsElementsKind(GetElementsKind())) {
+    SloppyArgumentsElementsVerify(
+        isolate, SloppyArgumentsElements::cast(elements()), *this);
+  }
+  if (isolate->IsInAnyContext(map(), Context::SLOPPY_ARGUMENTS_MAP_INDEX) ||
+      isolate->IsInAnyContext(map(),
+                              Context::SLOW_ALIASED_ARGUMENTS_MAP_INDEX) ||
+      isolate->IsInAnyContext(map(),
+                              Context::FAST_ALIASED_ARGUMENTS_MAP_INDEX)) {
+    VerifyObjectField(isolate, JSSloppyArgumentsObject::kLengthOffset);
+    VerifyObjectField(isolate, JSSloppyArgumentsObject::kCalleeOffset);
+  } else if (isolate->IsInAnyContext(map(),
+                                     Context::STRICT_ARGUMENTS_MAP_INDEX)) {
+    VerifyObjectField(isolate, JSStrictArgumentsObject::kLengthOffset);
+  }
+}
 
 void JSAsyncFunctionObject::JSAsyncFunctionObjectVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::JSAsyncFunctionObjectVerify(*this, isolate);
@@ -936,6 +926,8 @@ void Oddball::OddballVerify(Isolate* isolate) {
   } else if (map() == roots.self_reference_marker_map()) {
     // Multiple instances of this oddball may exist at once.
     CHECK_EQ(kind(), Oddball::kSelfReferenceMarker);
+  } else if (map() == roots.basic_block_counters_marker_map()) {
+    CHECK(*this == roots.basic_block_counters_marker());
   } else {
     UNREACHABLE();
   }
@@ -1097,13 +1089,6 @@ void JSFinalizationRegistry::JSFinalizationRegistryVerify(Isolate* isolate) {
         next_dirty().IsJSFinalizationRegistry());
 }
 
-void JSFinalizationRegistryCleanupIterator::
-    JSFinalizationRegistryCleanupIteratorVerify(Isolate* isolate) {
-  CHECK(IsJSFinalizationRegistryCleanupIterator());
-  JSObjectVerify(isolate);
-  VerifyHeapPointer(isolate, finalization_registry());
-}
-
 void JSWeakMap::JSWeakMapVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::JSWeakMapVerify(*this, isolate);
   CHECK(table().IsEphemeronHashTable() || table().IsUndefined(isolate));
@@ -1317,8 +1302,6 @@ void JSDataView::JSDataViewVerify(Isolate* isolate) {
   }
 }
 
-USE_TORQUE_VERIFIER(Foreign)
-
 void AsyncGeneratorRequest::AsyncGeneratorRequestVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::AsyncGeneratorRequestVerify(*this, isolate);
   CHECK_GE(resume_mode(), JSGeneratorObject::kNext);
@@ -1501,8 +1484,6 @@ void StoreHandler::StoreHandlerVerify(Isolate* isolate) {
   // TODO(ishell): check handler integrity
 }
 
-USE_TORQUE_VERIFIER(AccessorInfo)
-
 void CallHandlerInfo::CallHandlerInfoVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::CallHandlerInfoVerify(*this, isolate);
   CHECK(map() == ReadOnlyRoots(isolate).side_effect_call_handler_info_map() ||
@@ -1526,8 +1507,6 @@ void AllocationSite::AllocationSiteVerify(Isolate* isolate) {
   CHECK(nested_site().IsAllocationSite() || nested_site() == Smi::zero());
 }
 
-USE_TORQUE_VERIFIER(AllocationMemento)
-
 void Script::ScriptVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::ScriptVerify(*this, isolate);
   for (int i = 0; i < shared_function_infos().length(); ++i) {
@@ -1555,8 +1534,6 @@ void NormalizedMapCache::NormalizedMapCacheVerify(Isolate* isolate) {
   }
 }
 
-USE_TORQUE_VERIFIER(StackFrameInfo)
-
 void PreparseData::PreparseDataVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::PreparseDataVerify(*this, isolate);
   CHECK_LE(0, data_length());
@@ -1571,32 +1548,6 @@ void PreparseData::PreparseDataVerify(Isolate* isolate) {
 
 USE_TORQUE_VERIFIER(InterpreterData)
 
-#ifdef V8_INTL_SUPPORT
-
-USE_TORQUE_VERIFIER(JSV8BreakIterator)
-
-USE_TORQUE_VERIFIER(JSCollator)
-
-USE_TORQUE_VERIFIER(JSDateTimeFormat)
-
-USE_TORQUE_VERIFIER(JSDisplayNames)
-
-USE_TORQUE_VERIFIER(JSListFormat)
-
-USE_TORQUE_VERIFIER(JSLocale)
-
-USE_TORQUE_VERIFIER(JSNumberFormat)
-
-USE_TORQUE_VERIFIER(JSPluralRules)
-
-USE_TORQUE_VERIFIER(JSRelativeTimeFormat)
-
-USE_TORQUE_VERIFIER(JSSegmentIterator)
-
-USE_TORQUE_VERIFIER(JSSegmenter)
-
-#endif  // V8_INTL_SUPPORT
-
 #endif  // VERIFY_HEAP
 
 #ifdef DEBUG
@@ -1708,8 +1659,7 @@ void JSObject::SpillInformation::Print() {
   PrintF("\n");
 }
 
-bool DescriptorArray::IsSortedNoDuplicates(int valid_entries) {
-  if (valid_entries == -1) valid_entries = number_of_descriptors();
+bool DescriptorArray::IsSortedNoDuplicates() {
   Name current_key;
   uint32_t current = 0;
   for (int i = 0; i < number_of_descriptors(); i++) {
@@ -1729,8 +1679,7 @@ bool DescriptorArray::IsSortedNoDuplicates(int valid_entries) {
   return true;
 }
 
-bool TransitionArray::IsSortedNoDuplicates(int valid_entries) {
-  DCHECK_EQ(valid_entries, -1);
+bool TransitionArray::IsSortedNoDuplicates() {
   Name prev_key;
   PropertyKind prev_kind = kData;
   PropertyAttributes prev_attributes = NONE;
diff --git a/deps/v8/src/diagnostics/objects-printer.cc b/deps/v8/src/diagnostics/objects-printer.cc
index e36171edfdb..ca70859aa9a 100644
--- a/deps/v8/src/diagnostics/objects-printer.cc
+++ b/deps/v8/src/diagnostics/objects-printer.cc
@@ -69,6 +69,7 @@
 #include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-objects-inl.h"
 #include "torque-generated/class-definitions-tq-inl.h"
+#include "torque-generated/exported-class-definitions-tq-inl.h"
 #include "torque-generated/internal-class-definitions-tq-inl.h"
 
 namespace v8 {
@@ -434,11 +435,9 @@ void PrintSloppyArgumentElements(std::ostream& os, ElementsKind kind,
   os << "\n    0: context: " << Brief(elements.context())
      << "\n    1: arguments_store: " << Brief(arguments_store)
      << "\n    parameter to context slot map:";
-  for (uint32_t i = 0; i < elements.parameter_map_length(); i++) {
-    uint32_t raw_index = i + SloppyArgumentsElements::kParameterMapStart;
-    Object mapped_entry = elements.get_mapped_entry(i);
-    os << "\n    " << raw_index << ": param(" << i
-       << "): " << Brief(mapped_entry);
+  for (int i = 0; i < elements.length(); i++) {
+    Object mapped_entry = elements.mapped_entries(i);
+    os << "\n    " << i << ": param(" << i << "): " << Brief(mapped_entry);
     if (mapped_entry.IsTheHole()) {
       os << " in the arguments_store[" << i << "]";
     } else {
@@ -457,12 +456,13 @@ void PrintSloppyArgumentElements(std::ostream& os, ElementsKind kind,
   }
 }
 
-void PrintEmbedderData(std::ostream& os, EmbedderDataSlot slot) {
+void PrintEmbedderData(const Isolate* isolate, std::ostream& os,
+                       EmbedderDataSlot slot) {
   DisallowHeapAllocation no_gc;
   Object value = slot.load_tagged();
   os << Brief(value);
   void* raw_pointer;
-  if (slot.ToAlignedPointer(&raw_pointer)) {
+  if (slot.ToAlignedPointer(isolate, &raw_pointer)) {
     os << ", aligned pointer: " << raw_pointer;
   }
 }
@@ -566,10 +566,11 @@ static void JSObjectPrintBody(std::ostream& os,
   }
   int embedder_fields = obj.GetEmbedderFieldCount();
   if (embedder_fields > 0) {
+    const Isolate* isolate = GetIsolateForPtrCompr(obj);
     os << " - embedder fields = {";
     for (int i = 0; i < embedder_fields; i++) {
       os << "\n    ";
-      PrintEmbedderData(os, EmbedderDataSlot(obj, i));
+      PrintEmbedderData(isolate, os, EmbedderDataSlot(obj, i));
     }
     os << "\n }\n";
   }
@@ -705,12 +706,6 @@ void DescriptorArray::DescriptorArrayPrint(std::ostream& os) {
   PrintDescriptors(os);
 }
 
-void AliasedArgumentsEntry::AliasedArgumentsEntryPrint(
-    std::ostream& os) {  // NOLINT
-  PrintHeader(os, "AliasedArgumentsEntry");
-  os << "\n - aliased_context_slot: " << aliased_context_slot();
-}
-
 namespace {
 void PrintFixedArrayWithHeader(std::ostream& os, FixedArray array,
                                const char* type) {
@@ -765,13 +760,14 @@ void PrintWeakArrayElements(std::ostream& os, T* array) {
 }  // namespace
 
 void EmbedderDataArray::EmbedderDataArrayPrint(std::ostream& os) {
+  const Isolate* isolate = GetIsolateForPtrCompr(*this);
   PrintHeader(os, "EmbedderDataArray");
   os << "\n - length: " << length();
   EmbedderDataSlot start(*this, 0);
   EmbedderDataSlot end(*this, length());
   for (EmbedderDataSlot slot = start; slot < end; ++slot) {
     os << "\n    ";
-    PrintEmbedderData(os, slot);
+    PrintEmbedderData(isolate, os, slot);
   }
   os << "\n";
 }
@@ -1187,13 +1183,6 @@ void JSFinalizationRegistry::JSFinalizationRegistryPrint(std::ostream& os) {
   JSObjectPrintBody(os, *this);
 }
 
-void JSFinalizationRegistryCleanupIterator::
-    JSFinalizationRegistryCleanupIteratorPrint(std::ostream& os) {
-  JSObjectPrintHeader(os, *this, "JSFinalizationRegistryCleanupIterator");
-  os << "\n - finalization_registry: " << Brief(finalization_registry());
-  JSObjectPrintBody(os, *this);
-}
-
 void JSWeakMap::JSWeakMapPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, *this, "JSWeakMap");
   os << "\n - table: " << Brief(table());
@@ -1384,7 +1373,12 @@ void SharedFunctionInfo::SharedFunctionInfoPrint(std::ostream& os) {  // NOLINT
   os << "\n - expected_nof_properties: " << expected_nof_properties();
   os << "\n - language_mode: " << language_mode();
   os << "\n - data: " << Brief(function_data());
-  os << "\n - code (from data): " << Brief(GetCode());
+  os << "\n - code (from data): ";
+  if (Heap::InOffThreadSpace(*this)) {
+    os << "<not available off-thread>";
+  } else {
+    os << Brief(GetCode());
+  }
   PrintSourceCode(os);
   // Script files are often large, thus only print their {Brief} representation.
   os << "\n - script: " << Brief(script());
@@ -1427,12 +1421,6 @@ void JSGlobalObject::JSGlobalObjectPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintBody(os, *this);
 }
 
-void Cell::CellPrint(std::ostream& os) {  // NOLINT
-  PrintHeader(os, "Cell");
-  os << "\n - value: " << Brief(value());
-  os << "\n";
-}
-
 void PropertyCell::PropertyCellPrint(std::ostream& os) {  // NOLINT
   PrintHeader(os, "PropertyCell");
   os << "\n - name: ";
@@ -1505,17 +1493,6 @@ void Foreign::ForeignPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-void AccessorInfo::AccessorInfoPrint(std::ostream& os) {  // NOLINT
-  PrintHeader(os, "AccessorInfo");
-  os << "\n - name: " << Brief(name());
-  os << "\n - flags: " << flags();
-  os << "\n - getter: " << Brief(getter());
-  os << "\n - setter: " << Brief(setter());
-  os << "\n - js_getter: " << Brief(js_getter());
-  os << "\n - data: " << Brief(data());
-  os << "\n";
-}
-
 void CallbackTask::CallbackTaskPrint(std::ostream& os) {  // NOLINT
   PrintHeader(os, "CallbackTask");
   os << "\n - callback: " << Brief(callback());
@@ -1684,6 +1661,89 @@ void AsmWasmData::AsmWasmDataPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
+void WasmStruct::WasmStructPrint(std::ostream& os) {  // NOLINT
+  PrintHeader(os, "WasmStruct");
+  wasm::StructType* struct_type = type();
+  os << "\n - fields (" << struct_type->field_count() << "):";
+  for (uint32_t i = 0; i < struct_type->field_count(); i++) {
+    wasm::ValueType field = struct_type->field(i);
+    os << "\n   - " << field.short_name() << ": ";
+    uint32_t field_offset = struct_type->field_offset(i);
+    Address field_address = RawField(field_offset).address();
+    switch (field.kind()) {
+      case wasm::ValueType::kI32:
+        os << base::ReadUnalignedValue<int32_t>(field_address);
+        break;
+      case wasm::ValueType::kI64:
+        os << base::ReadUnalignedValue<int64_t>(field_address);
+        break;
+      case wasm::ValueType::kF32:
+        os << base::ReadUnalignedValue<float>(field_address);
+        break;
+      case wasm::ValueType::kF64:
+        os << base::ReadUnalignedValue<double>(field_address);
+        break;
+      case wasm::ValueType::kI8:
+      case wasm::ValueType::kI16:
+      case wasm::ValueType::kS128:
+      case wasm::ValueType::kAnyRef:
+      case wasm::ValueType::kFuncRef:
+      case wasm::ValueType::kNullRef:
+      case wasm::ValueType::kExnRef:
+      case wasm::ValueType::kRef:
+      case wasm::ValueType::kOptRef:
+      case wasm::ValueType::kEqRef:
+      case wasm::ValueType::kBottom:
+      case wasm::ValueType::kStmt:
+        UNIMPLEMENTED();  // TODO(7748): Implement.
+        break;
+    }
+  }
+  os << "\n";
+}
+
+void WasmArray::WasmArrayPrint(std::ostream& os) {  // NOLINT
+  PrintHeader(os, "WasmArray");
+  wasm::ArrayType* array_type = type();
+  uint32_t len = length();
+  os << "\n - type: " << array_type->element_type().type_name();
+  os << "\n - length: " << len;
+  Address data_ptr = ptr() + WasmArray::kHeaderSize - kHeapObjectTag;
+  switch (array_type->element_type().kind()) {
+    case wasm::ValueType::kI32:
+      PrintTypedArrayElements(os, reinterpret_cast<int32_t*>(data_ptr), len,
+                              true);
+      break;
+    case wasm::ValueType::kI64:
+      PrintTypedArrayElements(os, reinterpret_cast<int64_t*>(data_ptr), len,
+                              true);
+      break;
+    case wasm::ValueType::kF32:
+      PrintTypedArrayElements(os, reinterpret_cast<float*>(data_ptr), len,
+                              true);
+      break;
+    case wasm::ValueType::kF64:
+      PrintTypedArrayElements(os, reinterpret_cast<double*>(data_ptr), len,
+                              true);
+      break;
+    case wasm::ValueType::kI8:
+    case wasm::ValueType::kI16:
+    case wasm::ValueType::kS128:
+    case wasm::ValueType::kAnyRef:
+    case wasm::ValueType::kFuncRef:
+    case wasm::ValueType::kNullRef:
+    case wasm::ValueType::kExnRef:
+    case wasm::ValueType::kRef:
+    case wasm::ValueType::kOptRef:
+    case wasm::ValueType::kEqRef:
+    case wasm::ValueType::kBottom:
+    case wasm::ValueType::kStmt:
+      UNIMPLEMENTED();  // TODO(7748): Implement.
+      break;
+  }
+  os << "\n";
+}
+
 void WasmDebugInfo::WasmDebugInfoPrint(std::ostream& os) {  // NOLINT
   PrintHeader(os, "WasmDebugInfo");
   os << "\n - wasm_instance: " << Brief(wasm_instance());
@@ -1850,15 +1910,6 @@ void AccessorPair::AccessorPairPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-void AccessCheckInfo::AccessCheckInfoPrint(std::ostream& os) {  // NOLINT
-  PrintHeader(os, "AccessCheckInfo");
-  os << "\n - callback: " << Brief(callback());
-  os << "\n - named_interceptor: " << Brief(named_interceptor());
-  os << "\n - indexed_interceptor: " << Brief(indexed_interceptor());
-  os << "\n - data: " << Brief(data());
-  os << "\n";
-}
-
 void CallHandlerInfo::CallHandlerInfoPrint(std::ostream& os) {  // NOLINT
   PrintHeader(os, "CallHandlerInfo");
   os << "\n - callback: " << Brief(callback());
@@ -1869,23 +1920,12 @@ void CallHandlerInfo::CallHandlerInfoPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-void InterceptorInfo::InterceptorInfoPrint(std::ostream& os) {  // NOLINT
-  PrintHeader(os, "InterceptorInfo");
-  os << "\n - getter: " << Brief(getter());
-  os << "\n - setter: " << Brief(setter());
-  os << "\n - query: " << Brief(query());
-  os << "\n - deleter: " << Brief(deleter());
-  os << "\n - enumerator: " << Brief(enumerator());
-  os << "\n - data: " << Brief(data());
-  os << "\n";
-}
-
 void FunctionTemplateInfo::FunctionTemplateInfoPrint(
     std::ostream& os) {  // NOLINT
   PrintHeader(os, "FunctionTemplateInfo");
   os << "\n - class name: " << Brief(class_name());
-  os << "\n - tag: " << Brief(tag());
-  os << "\n - serial_number: " << Brief(serial_number());
+  os << "\n - tag: " << tag();
+  os << "\n - serial_number: " << serial_number();
   os << "\n - property_list: " << Brief(property_list());
   os << "\n - call_code: " << Brief(call_code());
   os << "\n - property_accessors: " << Brief(property_accessors());
@@ -1898,21 +1938,6 @@ void FunctionTemplateInfo::FunctionTemplateInfoPrint(
   os << "\n";
 }
 
-void FunctionTemplateRareData::FunctionTemplateRareDataPrint(
-    std::ostream& os) {  // NOLINT
-  PrintHeader(os, "FunctionTemplateRareData");
-  os << "\n - prototype_template: " << Brief(prototype_template());
-  os << "\n - prototype_provider_template: "
-     << Brief(prototype_provider_template());
-  os << "\n - parent_template: " << Brief(parent_template());
-  os << "\n - named_property_handler: " << Brief(named_property_handler());
-  os << "\n - indexed_property_handler: " << Brief(indexed_property_handler());
-  os << "\n - instance_template: " << Brief(instance_template());
-  os << "\n - instance_call_handler: " << Brief(instance_call_handler());
-  os << "\n - access_check_info: " << Brief(access_check_info());
-  os << "\n";
-}
-
 void WasmCapiFunctionData::WasmCapiFunctionDataPrint(
     std::ostream& os) {  // NOLINT
   PrintHeader(os, "WasmCapiFunctionData");
@@ -1939,8 +1964,8 @@ void WasmIndirectFunctionTable::WasmIndirectFunctionTablePrint(
 
 void ObjectTemplateInfo::ObjectTemplateInfoPrint(std::ostream& os) {  // NOLINT
   PrintHeader(os, "ObjectTemplateInfo");
-  os << "\n - tag: " << Brief(tag());
-  os << "\n - serial_number: " << Brief(serial_number());
+  os << "\n - tag: " << tag();
+  os << "\n - serial_number: " << serial_number();
   os << "\n - property_list: " << Brief(property_list());
   os << "\n - property_accessors: " << Brief(property_accessors());
   os << "\n - constructor: " << Brief(constructor());
@@ -2186,24 +2211,12 @@ void ScopeInfo::ScopeInfoPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-void DebugInfo::DebugInfoPrint(std::ostream& os) {  // NOLINT
-  PrintHeader(os, "DebugInfo");
-  os << "\n - flags: " << flags();
-  os << "\n - debugger_hints: " << debugger_hints();
-  os << "\n - shared: " << Brief(shared());
-  os << "\n - script: " << Brief(script());
-  os << "\n - original bytecode array: " << Brief(original_bytecode_array());
-  os << "\n - debug bytecode array: " << Brief(debug_bytecode_array());
-  os << "\n - break_points: ";
-  break_points().FixedArrayPrint(os);
-  os << "\n - coverage_info: " << Brief(coverage_info());
-}
-
 void StackTraceFrame::StackTraceFramePrint(std::ostream& os) {  // NOLINT
   PrintHeader(os, "StackTraceFrame");
   os << "\n - frame_index: " << frame_index();
   os << "\n - id: " << id();
   os << "\n - frame_info: " << Brief(frame_info());
+  os << "\n";
 }
 
 void StackFrameInfo::StackFrameInfoPrint(std::ostream& os) {  // NOLINT
diff --git a/deps/v8/src/diagnostics/ppc/disasm-ppc.cc b/deps/v8/src/diagnostics/ppc/disasm-ppc.cc
index 99767f17dc4..8394a05f89b 100644
--- a/deps/v8/src/diagnostics/ppc/disasm-ppc.cc
+++ b/deps/v8/src/diagnostics/ppc/disasm-ppc.cc
@@ -74,6 +74,7 @@ class Decoder {
   void Unknown(Instruction* instr);
   void UnknownFormat(Instruction* instr, const char* opcname);
 
+  void DecodeExt0(Instruction* instr);
   void DecodeExt1(Instruction* instr);
   void DecodeExt2(Instruction* instr);
   void DecodeExt3(Instruction* instr);
@@ -219,6 +220,11 @@ int Decoder::FormatOption(Instruction* instr, const char* format) {
       out_buffer_pos_ += SNPrintF(out_buffer_ + out_buffer_pos_, "%d", value);
       return 6;
     }
+    case 'U': {  // UIM
+      int32_t value = instr->Bits(20, 16);
+      out_buffer_pos_ += SNPrintF(out_buffer_ + out_buffer_pos_, "%d", value);
+      return 3;
+    }
     case 'l': {
       // Link (LK) Bit 0
       if (instr->Bit(0) == 1) {
@@ -351,6 +357,110 @@ void Decoder::UnknownFormat(Instruction* instr, const char* name) {
   Format(instr, buffer);
 }
 
+void Decoder::DecodeExt0(Instruction* instr) {
+  // Some encodings are 5-0 bits, handle those first
+  switch (EXT0 | (instr->BitField(5, 0))) {
+    case VPERM: {
+      Format(instr, "vperm   'Dt, 'Da, 'Db, 'Dc");
+      return;
+    }
+    case VMLADDUHM: {
+      Format(instr, "vmladduhm 'Dt, 'Da, 'Db, 'Dc");
+      return;
+    }
+  }
+  switch (EXT0 | (instr->BitField(10, 0))) {
+    case VSPLTB: {
+      Format(instr, "vspltb  'Dt, 'Db, 'UIM");
+      break;
+    }
+    case VSPLTW: {
+      Format(instr, "vspltw  'Dt, 'Db, 'UIM");
+      break;
+    }
+    case VSPLTH: {
+      Format(instr, "vsplth  'Dt, 'Db, 'UIM");
+      break;
+    }
+    case VSRO: {
+      Format(instr, "vsro    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VOR: {
+      Format(instr, "vor     'Dt, 'Da, 'Db");
+      break;
+    }
+    case VXOR: {
+      Format(instr, "vxor    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VNOR: {
+      Format(instr, "vnor    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VSLO: {
+      Format(instr, "vslo    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VADDUDM: {
+      Format(instr, "vaddudm    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VADDUWM: {
+      Format(instr, "vadduwm    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VADDUHM: {
+      Format(instr, "vadduhm    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VADDUBM: {
+      Format(instr, "vaddubm    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VADDFP: {
+      Format(instr, "vaddfp    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VSUBFP: {
+      Format(instr, "vsubfp    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VSUBUDM: {
+      Format(instr, "vsubudm    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VSUBUWM: {
+      Format(instr, "vsubuwm    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VSUBUHM: {
+      Format(instr, "vsubuhm    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VSUBUBM: {
+      Format(instr, "vsububm    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VMULUWM: {
+      Format(instr, "vmuluwm    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VPKUHUM: {
+      Format(instr, "vpkuhum    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VMULEUB: {
+      Format(instr, "vmuleub    'Dt, 'Da, 'Db");
+      break;
+    }
+    case VMULOUB: {
+      Format(instr, "vmuloub    'Dt, 'Da, 'Db");
+      break;
+    }
+  }
+}
+
 void Decoder::DecodeExt1(Instruction* instr) {
   switch (EXT1 | (instr->BitField(10, 1))) {
     case MCRF: {
@@ -832,6 +942,10 @@ void Decoder::DecodeExt2(Instruction* instr) {
       Format(instr, "sthux   'rs, 'ra, 'rb");
       return;
     }
+    case STVX: {
+      Format(instr, "stvx    'Dt, 'ra, 'rb");
+      return;
+    }
     case LWZX: {
       Format(instr, "lwzx    'rt, 'ra, 'rb");
       return;
@@ -876,6 +990,10 @@ void Decoder::DecodeExt2(Instruction* instr) {
       Format(instr, "lwarx   'rt, 'ra, 'rb");
       return;
     }
+    case LVX: {
+      Format(instr, "lvx     'Dt, 'ra, 'rb");
+      return;
+    }
 #if V8_TARGET_ARCH_PPC64
     case LDX: {
       Format(instr, "ldx     'rt, 'ra, 'rb");
@@ -1268,6 +1386,10 @@ int Decoder::InstructionDecode(byte* instr_ptr) {
       Format(instr, "b'l'a 'target26");
       break;
     }
+    case EXT0: {
+      DecodeExt0(instr);
+      break;
+    }
     case EXT1: {
       DecodeExt1(instr);
       break;
diff --git a/deps/v8/src/diagnostics/x64/disasm-x64.cc b/deps/v8/src/diagnostics/x64/disasm-x64.cc
index d603e6169cf..4d0760b17c0 100644
--- a/deps/v8/src/diagnostics/x64/disasm-x64.cc
+++ b/deps/v8/src/diagnostics/x64/disasm-x64.cc
@@ -1490,6 +1490,10 @@ int DisassemblerX64::AVXInstruction(byte* data) {
         current += PrintRightXMMOperand(current);
         AppendToBuffer(",0x%x", *current++);
         break;
+      case 0xD7:
+        AppendToBuffer("vpmovmskb %s,", NameOfCPURegister(regop));
+        current += PrintRightXMMOperand(current);
+        break;
 #define DECLARE_SSE_AVX_DIS_CASE(instruction, notUsed1, notUsed2, opcode) \
   case 0x##opcode: {                                                      \
     AppendToBuffer("v" #instruction " %s,%s,", NameOfXMMRegister(regop),  \
@@ -2124,7 +2128,10 @@ int DisassemblerX64::TwoByteOpcodeInstruction(byte* data) {
         } else {
           UnimplementedInstruction();
         }
-        AppendToBuffer("%s %s,", mnemonic, NameOfXMMRegister(regop));
+        // Not every opcode here has an XMM register as the dst operand.
+        const char* regop_reg = opcode == 0xD7 ? NameOfCPURegister(regop)
+                                               : NameOfXMMRegister(regop);
+        AppendToBuffer("%s %s,", mnemonic, regop_reg);
         current += PrintRightXMMOperand(current);
         if (opcode == 0xC2) {
           const char* const pseudo_op[] = {"eq",  "lt",  "le",  "unord",
diff --git a/deps/v8/src/execution/arm/simulator-arm.cc b/deps/v8/src/execution/arm/simulator-arm.cc
index a409dc97d29..019542b12d4 100644
--- a/deps/v8/src/execution/arm/simulator-arm.cc
+++ b/deps/v8/src/execution/arm/simulator-arm.cc
@@ -4589,7 +4589,7 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
           case 0: {
             // vmov.i32 Qd, #<imm>
             int vd = instr->VFPDRegValue(kSimd128Precision);
-            uint64_t imm = instr->Bit(24, 24) << 7;  // i
+            uint64_t imm = instr->Bit(24) << 7;      // i
             imm |= instr->Bits(18, 16) << 4;         // imm3
             imm |= instr->Bits(3, 0);                // imm4
             imm |= imm << 32;
@@ -5405,7 +5405,7 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
           int Vm = instr->VFPMRegValue(kSimd128Precision);
           NeonSize size = static_cast<NeonSize>(instr->Bits(19, 18));
           bool dst_unsigned = instr->Bit(6) != 0;
-          bool src_unsigned = instr->Bit(7, 6) == 0b11;
+          bool src_unsigned = instr->Bits(7, 6) == 0b11;
           DCHECK_IMPLIES(src_unsigned, dst_unsigned);
           switch (size) {
             case Neon8: {
diff --git a/deps/v8/src/execution/frame-constants.h b/deps/v8/src/execution/frame-constants.h
index 8c3f7743192..4809eeca805 100644
--- a/deps/v8/src/execution/frame-constants.h
+++ b/deps/v8/src/execution/frame-constants.h
@@ -258,14 +258,14 @@ class CWasmEntryFrameConstants : public TypedFrameConstants {
   DEFINE_TYPED_FRAME_SIZES(1);
 };
 
-class WasmCompiledFrameConstants : public TypedFrameConstants {
+class WasmFrameConstants : public TypedFrameConstants {
  public:
   // FP-relative.
   static constexpr int kWasmInstanceOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
   DEFINE_TYPED_FRAME_SIZES(1);
 };
 
-class WasmExitFrameConstants : public WasmCompiledFrameConstants {
+class WasmExitFrameConstants : public WasmFrameConstants {
  public:
   // FP-relative.
   static const int kCallingPCOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(1);
diff --git a/deps/v8/src/execution/frames-inl.h b/deps/v8/src/execution/frames-inl.h
index e73cca4f056..ecd45abeb19 100644
--- a/deps/v8/src/execution/frames-inl.h
+++ b/deps/v8/src/execution/frames-inl.h
@@ -236,15 +236,11 @@ inline ArgumentsAdaptorFrame::ArgumentsAdaptorFrame(
 inline BuiltinFrame::BuiltinFrame(StackFrameIteratorBase* iterator)
     : JavaScriptFrame(iterator) {}
 
-inline WasmCompiledFrame::WasmCompiledFrame(StackFrameIteratorBase* iterator)
+inline WasmFrame::WasmFrame(StackFrameIteratorBase* iterator)
     : StandardFrame(iterator) {}
 
 inline WasmExitFrame::WasmExitFrame(StackFrameIteratorBase* iterator)
-    : WasmCompiledFrame(iterator) {}
-
-inline WasmInterpreterEntryFrame::WasmInterpreterEntryFrame(
-    StackFrameIteratorBase* iterator)
-    : StandardFrame(iterator) {}
+    : WasmFrame(iterator) {}
 
 inline WasmDebugBreakFrame::WasmDebugBreakFrame(
     StackFrameIteratorBase* iterator)
diff --git a/deps/v8/src/execution/frames.cc b/deps/v8/src/execution/frames.cc
index 7d405efa5ed..b6fc4cb7540 100644
--- a/deps/v8/src/execution/frames.cc
+++ b/deps/v8/src/execution/frames.cc
@@ -21,7 +21,7 @@
 #include "src/objects/slots.h"
 #include "src/objects/smi.h"
 #include "src/objects/visitors.h"
-#include "src/snapshot/snapshot.h"
+#include "src/snapshot/embedded/embedded-data.h"
 #include "src/strings/string-stream.h"
 #include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-engine.h"
@@ -553,13 +553,11 @@ StackFrame::Type StackFrame::ComputeType(const StackFrameIteratorBase* iterator,
     if (wasm_code != nullptr) {
       switch (wasm_code->kind()) {
         case wasm::WasmCode::kFunction:
-          return WASM_COMPILED;
+          return WASM;
         case wasm::WasmCode::kWasmToCapiWrapper:
           return WASM_EXIT;
         case wasm::WasmCode::kWasmToJsWrapper:
           return WASM_TO_JS;
-        case wasm::WasmCode::kInterpreterEntry:
-          return WASM_INTERPRETER_ENTRY;
         default:
           UNREACHABLE();
       }
@@ -592,7 +590,6 @@ StackFrame::Type StackFrame::ComputeType(const StackFrameIteratorBase* iterator,
           case Code::WASM_FUNCTION:
           case Code::WASM_TO_CAPI_FUNCTION:
           case Code::WASM_TO_JS_FUNCTION:
-          case Code::WASM_INTERPRETER_ENTRY:
             // Never appear as on-heap {Code} objects.
             UNREACHABLE();
           default:
@@ -619,7 +616,7 @@ StackFrame::Type StackFrame::ComputeType(const StackFrameIteratorBase* iterator,
     case CONSTRUCT:
     case ARGUMENTS_ADAPTOR:
     case WASM_TO_JS:
-    case WASM_COMPILED:
+    case WASM:
     case WASM_COMPILE_LAZY:
     case WASM_EXIT:
     case WASM_DEBUG_BREAK:
@@ -974,18 +971,17 @@ void StandardFrame::IterateCompiledFrame(RootVisitor* v) const {
         frame_header_size = TypedFrameConstants::kFixedFrameSizeFromFp;
         break;
       case WASM_TO_JS:
-      case WASM_COMPILED:
-      case WASM_INTERPRETER_ENTRY:
+      case WASM:
       case WASM_COMPILE_LAZY:
-        frame_header_size = WasmCompiledFrameConstants::kFixedFrameSizeFromFp;
+        frame_header_size = WasmFrameConstants::kFixedFrameSizeFromFp;
         break;
       case WASM_EXIT:
         // The last value in the frame header is the calling PC, which should
         // not be visited.
         static_assert(WasmExitFrameConstants::kFixedSlotCountFromFp ==
-                          WasmCompiledFrameConstants::kFixedSlotCountFromFp + 1,
-                      "WasmExitFrame has one slot more than WasmCompiledFrame");
-        frame_header_size = WasmCompiledFrameConstants::kFixedFrameSizeFromFp;
+                          WasmFrameConstants::kFixedSlotCountFromFp + 1,
+                      "WasmExitFrame has one slot more than WasmFrame");
+        frame_header_size = WasmFrameConstants::kFixedFrameSizeFromFp;
         break;
       case OPTIMIZED:
       case INTERPRETED:
@@ -1396,29 +1392,25 @@ Handle<Context> FrameSummary::JavaScriptFrameSummary::native_context() const {
 }
 
 FrameSummary::WasmFrameSummary::WasmFrameSummary(
-    Isolate* isolate, FrameSummary::Kind kind,
-    Handle<WasmInstanceObject> instance, bool at_to_number_conversion)
-    : FrameSummaryBase(isolate, kind),
+    Isolate* isolate, Handle<WasmInstanceObject> instance, wasm::WasmCode* code,
+    int code_offset, bool at_to_number_conversion)
+    : FrameSummaryBase(isolate, WASM),
       wasm_instance_(instance),
-      at_to_number_conversion_(at_to_number_conversion) {}
+      at_to_number_conversion_(at_to_number_conversion),
+      code_(code),
+      code_offset_(code_offset) {}
 
 Handle<Object> FrameSummary::WasmFrameSummary::receiver() const {
   return wasm_instance_->GetIsolate()->global_proxy();
 }
 
-#define WASM_SUMMARY_DISPATCH(type, name)                                      \
-  type FrameSummary::WasmFrameSummary::name() const {                          \
-    DCHECK(kind() == Kind::WASM_COMPILED || kind() == Kind::WASM_INTERPRETED); \
-    return kind() == Kind::WASM_COMPILED                                       \
-               ? static_cast<const WasmCompiledFrameSummary*>(this)->name()    \
-               : static_cast<const WasmInterpretedFrameSummary*>(this)         \
-                     ->name();                                                 \
-  }
-
-WASM_SUMMARY_DISPATCH(uint32_t, function_index)
-WASM_SUMMARY_DISPATCH(int, byte_offset)
+uint32_t FrameSummary::WasmFrameSummary::function_index() const {
+  return code()->index();
+}
 
-#undef WASM_SUMMARY_DISPATCH
+int FrameSummary::WasmFrameSummary::byte_offset() const {
+  return code_->GetSourcePositionBefore(code_offset());
+}
 
 int FrameSummary::WasmFrameSummary::SourcePosition() const {
   const wasm::WasmModule* module = wasm_instance()->module_object().module();
@@ -1442,42 +1434,6 @@ Handle<Context> FrameSummary::WasmFrameSummary::native_context() const {
   return handle(wasm_instance()->native_context(), isolate());
 }
 
-FrameSummary::WasmCompiledFrameSummary::WasmCompiledFrameSummary(
-    Isolate* isolate, Handle<WasmInstanceObject> instance, wasm::WasmCode* code,
-    int code_offset, bool at_to_number_conversion)
-    : WasmFrameSummary(isolate, WASM_COMPILED, instance,
-                       at_to_number_conversion),
-      code_(code),
-      code_offset_(code_offset) {}
-
-uint32_t FrameSummary::WasmCompiledFrameSummary::function_index() const {
-  return code()->index();
-}
-
-int FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
-    const wasm::WasmCode* code, int offset) {
-  int position = 0;
-  // Subtract one because the current PC is one instruction after the call site.
-  offset--;
-  for (SourcePositionTableIterator iterator(code->source_positions());
-       !iterator.done() && iterator.code_offset() <= offset;
-       iterator.Advance()) {
-    position = iterator.source_position().ScriptOffset();
-  }
-  return position;
-}
-
-int FrameSummary::WasmCompiledFrameSummary::byte_offset() const {
-  return GetWasmSourcePosition(code_, code_offset());
-}
-
-FrameSummary::WasmInterpretedFrameSummary::WasmInterpretedFrameSummary(
-    Isolate* isolate, Handle<WasmInstanceObject> instance,
-    uint32_t function_index, int byte_offset)
-    : WasmFrameSummary(isolate, WASM_INTERPRETED, instance, false),
-      function_index_(function_index),
-      byte_offset_(byte_offset) {}
-
 FrameSummary::~FrameSummary() {
 #define FRAME_SUMMARY_DESTR(kind, type, field, desc) \
   case kind:                                         \
@@ -1517,19 +1473,16 @@ FrameSummary FrameSummary::Get(const StandardFrame* frame, int index) {
   return frames[index];
 }
 
-#define FRAME_SUMMARY_DISPATCH(ret, name)        \
-  ret FrameSummary::name() const {               \
-    switch (base_.kind()) {                      \
-      case JAVA_SCRIPT:                          \
-        return java_script_summary_.name();      \
-      case WASM_COMPILED:                        \
-        return wasm_compiled_summary_.name();    \
-      case WASM_INTERPRETED:                     \
-        return wasm_interpreted_summary_.name(); \
-      default:                                   \
-        UNREACHABLE();                           \
-        return ret{};                            \
-    }                                            \
+#define FRAME_SUMMARY_DISPATCH(ret, name)   \
+  ret FrameSummary::name() const {          \
+    switch (base_.kind()) {                 \
+      case JAVA_SCRIPT:                     \
+        return java_script_summary_.name(); \
+      case WASM:                            \
+        return wasm_summary_.name();        \
+      default:                              \
+        UNREACHABLE();                      \
+    }                                       \
   }
 
 FRAME_SUMMARY_DISPATCH(Handle<Object>, receiver)
@@ -1857,8 +1810,8 @@ Address InternalFrame::GetCallerStackPointer() const {
 
 Code InternalFrame::unchecked_code() const { return Code(); }
 
-void WasmCompiledFrame::Print(StringStream* accumulator, PrintMode mode,
-                              int index) const {
+void WasmFrame::Print(StringStream* accumulator, PrintMode mode,
+                      int index) const {
   PrintIndex(accumulator, mode, index);
   accumulator->Add("WASM [");
   accumulator->PrintName(script().name());
@@ -1885,51 +1838,61 @@ void WasmCompiledFrame::Print(StringStream* accumulator, PrintMode mode,
   if (mode != OVERVIEW) accumulator->Add("\n");
 }
 
-Code WasmCompiledFrame::unchecked_code() const {
+Code WasmFrame::unchecked_code() const {
   return isolate()->FindCodeObject(pc());
 }
 
-void WasmCompiledFrame::Iterate(RootVisitor* v) const {
-  IterateCompiledFrame(v);
-}
+void WasmFrame::Iterate(RootVisitor* v) const { IterateCompiledFrame(v); }
 
-Address WasmCompiledFrame::GetCallerStackPointer() const {
+Address WasmFrame::GetCallerStackPointer() const {
   return fp() + ExitFrameConstants::kCallerSPOffset;
 }
 
-wasm::WasmCode* WasmCompiledFrame::wasm_code() const {
+wasm::WasmCode* WasmFrame::wasm_code() const {
   return isolate()->wasm_engine()->code_manager()->LookupCode(pc());
 }
 
-WasmInstanceObject WasmCompiledFrame::wasm_instance() const {
-  const int offset = WasmCompiledFrameConstants::kWasmInstanceOffset;
+WasmInstanceObject WasmFrame::wasm_instance() const {
+  const int offset = WasmFrameConstants::kWasmInstanceOffset;
   Object instance(Memory<Address>(fp() + offset));
   return WasmInstanceObject::cast(instance);
 }
 
-wasm::NativeModule* WasmCompiledFrame::native_module() const {
+wasm::NativeModule* WasmFrame::native_module() const {
   return module_object().native_module();
 }
 
-WasmModuleObject WasmCompiledFrame::module_object() const {
+WasmModuleObject WasmFrame::module_object() const {
   return wasm_instance().module_object();
 }
 
-uint32_t WasmCompiledFrame::function_index() const {
-  return FrameSummary::GetSingle(this).AsWasmCompiled().function_index();
+uint32_t WasmFrame::function_index() const {
+  return FrameSummary::GetSingle(this).AsWasm().function_index();
 }
 
-Script WasmCompiledFrame::script() const { return module_object().script(); }
+Script WasmFrame::script() const { return module_object().script(); }
 
-int WasmCompiledFrame::position() const {
-  return FrameSummary::GetSingle(this).SourcePosition();
+int WasmFrame::position() const {
+  wasm::WasmCodeRefScope code_ref_scope;
+  const wasm::WasmModule* module = wasm_instance().module_object().module();
+  return GetSourcePosition(module, function_index(), byte_offset(),
+                           at_to_number_conversion());
+}
+
+int WasmFrame::byte_offset() const {
+  wasm::WasmCode* code = wasm_code();
+  int offset = static_cast<int>(pc() - code->instruction_start());
+  return code->GetSourcePositionBefore(offset);
 }
 
-Object WasmCompiledFrame::context() const {
-  return wasm_instance().native_context();
+bool WasmFrame::is_inspectable() const {
+  wasm::WasmCodeRefScope code_ref_scope;
+  return wasm_code()->is_inspectable();
 }
 
-void WasmCompiledFrame::Summarize(std::vector<FrameSummary>* functions) const {
+Object WasmFrame::context() const { return wasm_instance().native_context(); }
+
+void WasmFrame::Summarize(std::vector<FrameSummary>* functions) const {
   DCHECK(functions->empty());
   // The {WasmCode*} escapes this scope via the {FrameSummary}, which is fine,
   // since this code object is part of our stack.
@@ -1937,12 +1900,12 @@ void WasmCompiledFrame::Summarize(std::vector<FrameSummary>* functions) const {
   wasm::WasmCode* code = wasm_code();
   int offset = static_cast<int>(pc() - code->instruction_start());
   Handle<WasmInstanceObject> instance(wasm_instance(), isolate());
-  FrameSummary::WasmCompiledFrameSummary summary(
-      isolate(), instance, code, offset, at_to_number_conversion());
+  FrameSummary::WasmFrameSummary summary(isolate(), instance, code, offset,
+                                         at_to_number_conversion());
   functions->push_back(summary);
 }
 
-bool WasmCompiledFrame::at_to_number_conversion() const {
+bool WasmFrame::at_to_number_conversion() const {
   // Check whether our callee is a WASM_TO_JS frame, and this frame is at the
   // ToNumber conversion call.
   wasm::WasmCode* code =
@@ -1951,14 +1914,14 @@ bool WasmCompiledFrame::at_to_number_conversion() const {
           : nullptr;
   if (!code || code->kind() != wasm::WasmCode::kWasmToJsWrapper) return false;
   int offset = static_cast<int>(callee_pc() - code->instruction_start());
-  int pos = FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
-      code, offset);
-  DCHECK(pos == 0 || pos == 1);
+  int pos = code->GetSourcePositionBefore(offset);
   // The imported call has position 0, ToNumber has position 1.
-  return !!pos;
+  // If there is no source position available, this is also not a ToNumber call.
+  DCHECK(pos == wasm::kNoCodePosition || pos == 0 || pos == 1);
+  return pos == 1;
 }
 
-int WasmCompiledFrame::LookupExceptionHandlerInTable() {
+int WasmFrame::LookupExceptionHandlerInTable() {
   wasm::WasmCode* code =
       isolate()->wasm_engine()->code_manager()->LookupCode(pc());
   if (!code->IsAnonymous() && code->handler_table_size() > 0) {
@@ -1970,70 +1933,6 @@ int WasmCompiledFrame::LookupExceptionHandlerInTable() {
   return -1;
 }
 
-void WasmInterpreterEntryFrame::Iterate(RootVisitor* v) const {
-  IterateCompiledFrame(v);
-}
-
-void WasmInterpreterEntryFrame::Print(StringStream* accumulator, PrintMode mode,
-                                      int index) const {
-  PrintIndex(accumulator, mode, index);
-  accumulator->Add("WASM INTERPRETER ENTRY [");
-  Script script = this->script();
-  accumulator->PrintName(script.name());
-  accumulator->Add("]");
-  if (mode != OVERVIEW) accumulator->Add("\n");
-}
-
-void WasmInterpreterEntryFrame::Summarize(
-    std::vector<FrameSummary>* functions) const {
-  Handle<WasmInstanceObject> instance(wasm_instance(), isolate());
-  std::vector<std::pair<uint32_t, int>> interpreted_stack =
-      instance->debug_info().GetInterpretedStack(fp());
-
-  for (auto& e : interpreted_stack) {
-    FrameSummary::WasmInterpretedFrameSummary summary(isolate(), instance,
-                                                      e.first, e.second);
-    functions->push_back(summary);
-  }
-}
-
-Code WasmInterpreterEntryFrame::unchecked_code() const { return Code(); }
-
-int WasmInterpreterEntryFrame::NumberOfActiveFrames() const {
-  Handle<WasmInstanceObject> instance(wasm_instance(), isolate());
-  return instance->debug_info().NumberOfActiveFrames(fp());
-}
-
-WasmInstanceObject WasmInterpreterEntryFrame::wasm_instance() const {
-  const int offset = WasmCompiledFrameConstants::kWasmInstanceOffset;
-  Object instance(Memory<Address>(fp() + offset));
-  return WasmInstanceObject::cast(instance);
-}
-
-WasmDebugInfo WasmInterpreterEntryFrame::debug_info() const {
-  return wasm_instance().debug_info();
-}
-
-WasmModuleObject WasmInterpreterEntryFrame::module_object() const {
-  return wasm_instance().module_object();
-}
-
-Script WasmInterpreterEntryFrame::script() const {
-  return module_object().script();
-}
-
-int WasmInterpreterEntryFrame::position() const {
-  return FrameSummary::GetBottom(this).AsWasmInterpreted().SourcePosition();
-}
-
-Object WasmInterpreterEntryFrame::context() const {
-  return wasm_instance().native_context();
-}
-
-Address WasmInterpreterEntryFrame::GetCallerStackPointer() const {
-  return fp() + ExitFrameConstants::kCallerSPOffset;
-}
-
 void WasmDebugBreakFrame::Iterate(RootVisitor* v) const {
   // Nothing to iterate here. This will change once we support references in
   // Liftoff.
diff --git a/deps/v8/src/execution/frames.h b/deps/v8/src/execution/frames.h
index bd50cda8f83..cd0156a8877 100644
--- a/deps/v8/src/execution/frames.h
+++ b/deps/v8/src/execution/frames.h
@@ -66,10 +66,9 @@ class StackHandler {
   V(CONSTRUCT_ENTRY, ConstructEntryFrame)                                 \
   V(EXIT, ExitFrame)                                                      \
   V(OPTIMIZED, OptimizedFrame)                                            \
-  V(WASM_COMPILED, WasmCompiledFrame)                                     \
+  V(WASM, WasmFrame)                                                      \
   V(WASM_TO_JS, WasmToJsFrame)                                            \
   V(JS_TO_WASM, JsToWasmFrame)                                            \
-  V(WASM_INTERPRETER_ENTRY, WasmInterpreterEntryFrame)                    \
   V(WASM_DEBUG_BREAK, WasmDebugBreakFrame)                                \
   V(C_WASM_ENTRY, CWasmEntryFrame)                                        \
   V(WASM_EXIT, WasmExitFrame)                                             \
@@ -181,12 +180,9 @@ class StackFrame {
   bool is_exit() const { return type() == EXIT; }
   bool is_optimized() const { return type() == OPTIMIZED; }
   bool is_interpreted() const { return type() == INTERPRETED; }
-  bool is_wasm_compiled() const { return type() == WASM_COMPILED; }
+  bool is_wasm() const { return this->type() == WASM; }
   bool is_wasm_compile_lazy() const { return type() == WASM_COMPILE_LAZY; }
   bool is_wasm_debug_break() const { return type() == WASM_DEBUG_BREAK; }
-  bool is_wasm_interpreter_entry() const {
-    return type() == WASM_INTERPRETER_ENTRY;
-  }
   bool is_arguments_adaptor() const { return type() == ARGUMENTS_ADAPTOR; }
   bool is_builtin() const { return type() == BUILTIN; }
   bool is_internal() const { return type() == INTERNAL; }
@@ -209,10 +205,6 @@ class StackFrame {
            (type == JAVA_SCRIPT_BUILTIN_CONTINUATION) ||
            (type == JAVA_SCRIPT_BUILTIN_CONTINUATION_WITH_CATCH);
   }
-  bool is_wasm() const {
-    Type type = this->type();
-    return type == WASM_COMPILED || type == WASM_INTERPRETER_ENTRY;
-  }
   bool is_wasm_to_js() const { return type() == WASM_TO_JS; }
 
   // Accessors.
@@ -458,12 +450,9 @@ class StandardFrame;
 class V8_EXPORT_PRIVATE FrameSummary {
  public:
 // Subclasses for the different summary kinds:
-#define FRAME_SUMMARY_VARIANTS(F)                                             \
-  F(JAVA_SCRIPT, JavaScriptFrameSummary, java_script_summary_, JavaScript)    \
-  F(WASM_COMPILED, WasmCompiledFrameSummary, wasm_compiled_summary_,          \
-    WasmCompiled)                                                             \
-  F(WASM_INTERPRETED, WasmInterpretedFrameSummary, wasm_interpreted_summary_, \
-    WasmInterpreted)
+#define FRAME_SUMMARY_VARIANTS(F)                                          \
+  F(JAVA_SCRIPT, JavaScriptFrameSummary, java_script_summary_, JavaScript) \
+  F(WASM, WasmFrameSummary, wasm_summary_, Wasm)
 
 #define FRAME_SUMMARY_KIND(kind, type, field, desc) kind,
   enum Kind { FRAME_SUMMARY_VARIANTS(FRAME_SUMMARY_KIND) };
@@ -514,14 +503,15 @@ class V8_EXPORT_PRIVATE FrameSummary {
   };
 
   class WasmFrameSummary : public FrameSummaryBase {
-   protected:
-    WasmFrameSummary(Isolate*, Kind, Handle<WasmInstanceObject>,
-                     bool at_to_number_conversion);
-
    public:
+    WasmFrameSummary(Isolate*, Handle<WasmInstanceObject>, wasm::WasmCode*,
+                     int code_offset, bool at_to_number_conversion);
+
     Handle<Object> receiver() const;
     uint32_t function_index() const;
-    int byte_offset() const;
+    wasm::WasmCode* code() const { return code_; }
+    int code_offset() const { return code_offset_; }
+    V8_EXPORT_PRIVATE int byte_offset() const;
     bool is_constructor() const { return false; }
     bool is_subject_to_debugging() const { return true; }
     int SourcePosition() const;
@@ -535,37 +525,10 @@ class V8_EXPORT_PRIVATE FrameSummary {
    private:
     Handle<WasmInstanceObject> wasm_instance_;
     bool at_to_number_conversion_;
-  };
-
-  class WasmCompiledFrameSummary : public WasmFrameSummary {
-   public:
-    WasmCompiledFrameSummary(Isolate*, Handle<WasmInstanceObject>,
-                             wasm::WasmCode*, int code_offset,
-                             bool at_to_number_conversion);
-    uint32_t function_index() const;
-    wasm::WasmCode* code() const { return code_; }
-    int code_offset() const { return code_offset_; }
-    int byte_offset() const;
-    static int GetWasmSourcePosition(const wasm::WasmCode* code, int offset);
-
-   private:
     wasm::WasmCode* const code_;
     int code_offset_;
   };
 
-  class WasmInterpretedFrameSummary : public WasmFrameSummary {
-   public:
-    WasmInterpretedFrameSummary(Isolate*, Handle<WasmInstanceObject>,
-                                uint32_t function_index, int byte_offset);
-    uint32_t function_index() const { return function_index_; }
-    int code_offset() const { return byte_offset_; }
-    int byte_offset() const { return byte_offset_; }
-
-   private:
-    uint32_t function_index_;
-    int byte_offset_;
-  };
-
 #define FRAME_SUMMARY_CONS(kind, type, field, desc) \
   FrameSummary(type summ) : field(summ) {}  // NOLINT
   FRAME_SUMMARY_VARIANTS(FRAME_SUMMARY_CONS)
@@ -601,12 +564,6 @@ class V8_EXPORT_PRIVATE FrameSummary {
   FRAME_SUMMARY_VARIANTS(FRAME_SUMMARY_CAST)
 #undef FRAME_SUMMARY_CAST
 
-  bool IsWasm() const { return IsWasmCompiled() || IsWasmInterpreted(); }
-  const WasmFrameSummary& AsWasm() const {
-    if (IsWasmCompiled()) return AsWasmCompiled();
-    return AsWasmInterpreted();
-  }
-
  private:
 #define FRAME_SUMMARY_FIELD(kind, type, field, desc) type field;
   union {
@@ -938,9 +895,9 @@ class BuiltinFrame final : public JavaScriptFrame {
   friend class StackFrameIteratorBase;
 };
 
-class WasmCompiledFrame : public StandardFrame {
+class WasmFrame : public StandardFrame {
  public:
-  Type type() const override { return WASM_COMPILED; }
+  Type type() const override { return WASM; }
 
   // GC support.
   void Iterate(RootVisitor* v) const override;
@@ -956,24 +913,28 @@ class WasmCompiledFrame : public StandardFrame {
   Code unchecked_code() const override;
 
   // Accessors.
-  WasmInstanceObject wasm_instance() const;
-  wasm::NativeModule* native_module() const;
+  V8_EXPORT_PRIVATE WasmInstanceObject wasm_instance() const;
+  V8_EXPORT_PRIVATE wasm::NativeModule* native_module() const;
   wasm::WasmCode* wasm_code() const;
   uint32_t function_index() const;
   Script script() const override;
+  // Byte position in the module, or asm.js source position.
   int position() const override;
   Object context() const override;
   bool at_to_number_conversion() const;
+  // Byte offset in the function.
+  int byte_offset() const;
+  bool is_inspectable() const;
 
   void Summarize(std::vector<FrameSummary>* frames) const override;
 
-  static WasmCompiledFrame* cast(StackFrame* frame) {
-    DCHECK(frame->is_wasm_compiled());
-    return static_cast<WasmCompiledFrame*>(frame);
+  static WasmFrame* cast(StackFrame* frame) {
+    DCHECK(frame->is_wasm());
+    return static_cast<WasmFrame*>(frame);
   }
 
  protected:
-  inline explicit WasmCompiledFrame(StackFrameIteratorBase* iterator);
+  inline explicit WasmFrame(StackFrameIteratorBase* iterator);
 
   Address GetCallerStackPointer() const override;
 
@@ -982,7 +943,7 @@ class WasmCompiledFrame : public StandardFrame {
   WasmModuleObject module_object() const;
 };
 
-class WasmExitFrame : public WasmCompiledFrame {
+class WasmExitFrame : public WasmFrame {
  public:
   Type type() const override { return WASM_EXIT; }
   static Address ComputeStackPointer(Address fp);
@@ -994,46 +955,6 @@ class WasmExitFrame : public WasmCompiledFrame {
   friend class StackFrameIteratorBase;
 };
 
-class WasmInterpreterEntryFrame final : public StandardFrame {
- public:
-  Type type() const override { return WASM_INTERPRETER_ENTRY; }
-
-  // GC support.
-  void Iterate(RootVisitor* v) const override;
-
-  // Printing support.
-  void Print(StringStream* accumulator, PrintMode mode,
-             int index) const override;
-
-  void Summarize(std::vector<FrameSummary>* frames) const override;
-
-  // Determine the code for the frame.
-  Code unchecked_code() const override;
-
-  // Accessors.
-  int NumberOfActiveFrames() const;
-  WasmDebugInfo debug_info() const;
-  WasmInstanceObject wasm_instance() const;
-
-  Script script() const override;
-  int position() const override;
-  Object context() const override;
-
-  static WasmInterpreterEntryFrame* cast(StackFrame* frame) {
-    DCHECK(frame->is_wasm_interpreter_entry());
-    return static_cast<WasmInterpreterEntryFrame*>(frame);
-  }
-
- protected:
-  inline explicit WasmInterpreterEntryFrame(StackFrameIteratorBase* iterator);
-
-  Address GetCallerStackPointer() const override;
-
- private:
-  friend class StackFrameIteratorBase;
-  WasmModuleObject module_object() const;
-};
-
 class WasmDebugBreakFrame final : public StandardFrame {
  public:
   Type type() const override { return WASM_DEBUG_BREAK; }
diff --git a/deps/v8/src/execution/futex-emulation.cc b/deps/v8/src/execution/futex-emulation.cc
index 9861454d8cc..6804f473091 100644
--- a/deps/v8/src/execution/futex-emulation.cc
+++ b/deps/v8/src/execution/futex-emulation.cc
@@ -89,11 +89,11 @@ Object WaitJsTranslateReturn(Isolate* isolate, Object res) {
     int val = Smi::ToInt(res);
     switch (val) {
       case WaitReturnValue::kOk:
-        return ReadOnlyRoots(isolate).ok();
+        return ReadOnlyRoots(isolate).ok_string();
       case WaitReturnValue::kNotEqual:
-        return ReadOnlyRoots(isolate).not_equal();
+        return ReadOnlyRoots(isolate).not_equal_string();
       case WaitReturnValue::kTimedOut:
-        return ReadOnlyRoots(isolate).timed_out();
+        return ReadOnlyRoots(isolate).timed_out_string();
       default:
         UNREACHABLE();
     }
@@ -188,13 +188,14 @@ Object FutexEmulation::Wait(Isolate* isolate,
     return isolate->PromoteScheduledException();
   }
 
-  Object result;
+  Handle<Object> result;
   AtomicsWaitEvent callback_result = AtomicsWaitEvent::kWokenUp;
 
   do {  // Not really a loop, just makes it easier to break out early.
     base::MutexGuard lock_guard(mutex_.Pointer());
-    void* backing_store = array_buffer->backing_store();
-
+    std::shared_ptr<BackingStore> backing_store =
+        array_buffer->GetBackingStore();
+    DCHECK(backing_store);
     FutexWaitListNode* node = isolate->futex_wait_list_node();
     node->backing_store_ = backing_store;
     node->wait_addr_ = addr;
@@ -204,9 +205,10 @@ Object FutexEmulation::Wait(Isolate* isolate,
     // still holding the lock).
     ResetWaitingOnScopeExit reset_waiting(node);
 
-    T* p = reinterpret_cast<T*>(static_cast<int8_t*>(backing_store) + addr);
+    T* p = reinterpret_cast<T*>(
+        static_cast<int8_t*>(backing_store->buffer_start()) + addr);
     if (*p != value) {
-      result = Smi::FromInt(WaitReturnValue::kNotEqual);
+      result = handle(Smi::FromInt(WaitReturnValue::kNotEqual), isolate);
       callback_result = AtomicsWaitEvent::kNotEqual;
       break;
     }
@@ -244,7 +246,7 @@ Object FutexEmulation::Wait(Isolate* isolate,
       if (interrupted) {
         Object interrupt_object = isolate->stack_guard()->HandleInterrupts();
         if (interrupt_object.IsException(isolate)) {
-          result = interrupt_object;
+          result = handle(interrupt_object, isolate);
           callback_result = AtomicsWaitEvent::kTerminatedExecution;
           mutex_.Pointer()->Lock();
           break;
@@ -264,7 +266,7 @@ Object FutexEmulation::Wait(Isolate* isolate,
       }
 
       if (!node->waiting_) {
-        result = Smi::FromInt(WaitReturnValue::kOk);
+        result = handle(Smi::FromInt(WaitReturnValue::kOk), isolate);
         break;
       }
 
@@ -272,7 +274,7 @@ Object FutexEmulation::Wait(Isolate* isolate,
       if (use_timeout) {
         current_time = base::TimeTicks::Now();
         if (current_time >= timeout_time) {
-          result = Smi::FromInt(WaitReturnValue::kTimedOut);
+          result = handle(Smi::FromInt(WaitReturnValue::kTimedOut), isolate);
           callback_result = AtomicsWaitEvent::kTimedOut;
           break;
         }
@@ -297,10 +299,10 @@ Object FutexEmulation::Wait(Isolate* isolate,
 
   if (isolate->has_scheduled_exception()) {
     CHECK_NE(callback_result, AtomicsWaitEvent::kTerminatedExecution);
-    result = isolate->PromoteScheduledException();
+    result = handle(isolate->PromoteScheduledException(), isolate);
   }
 
-  return result;
+  return *result;
 }
 
 Object FutexEmulation::Wake(Handle<JSArrayBuffer> array_buffer, size_t addr,
@@ -308,13 +310,16 @@ Object FutexEmulation::Wake(Handle<JSArrayBuffer> array_buffer, size_t addr,
   DCHECK_LT(addr, array_buffer->byte_length());
 
   int waiters_woken = 0;
-  void* backing_store = array_buffer->backing_store();
+  std::shared_ptr<BackingStore> backing_store = array_buffer->GetBackingStore();
 
   base::MutexGuard lock_guard(mutex_.Pointer());
   FutexWaitListNode* node = wait_list_.Pointer()->head_;
   while (node && num_waiters_to_wake > 0) {
-    if (backing_store == node->backing_store_ && addr == node->wait_addr_ &&
-        node->waiting_) {
+    std::shared_ptr<BackingStore> node_backing_store =
+        node->backing_store_.lock();
+    DCHECK(node_backing_store);
+    if (backing_store.get() == node_backing_store.get() &&
+        addr == node->wait_addr_ && node->waiting_) {
       node->waiting_ = false;
       node->cond_.NotifyOne();
       if (num_waiters_to_wake != kWakeAll) {
@@ -332,15 +337,18 @@ Object FutexEmulation::Wake(Handle<JSArrayBuffer> array_buffer, size_t addr,
 Object FutexEmulation::NumWaitersForTesting(Handle<JSArrayBuffer> array_buffer,
                                             size_t addr) {
   DCHECK_LT(addr, array_buffer->byte_length());
-  void* backing_store = array_buffer->backing_store();
+  std::shared_ptr<BackingStore> backing_store = array_buffer->GetBackingStore();
 
   base::MutexGuard lock_guard(mutex_.Pointer());
 
   int waiters = 0;
   FutexWaitListNode* node = wait_list_.Pointer()->head_;
   while (node) {
-    if (backing_store == node->backing_store_ && addr == node->wait_addr_ &&
-        node->waiting_) {
+    std::shared_ptr<BackingStore> node_backing_store =
+        node->backing_store_.lock();
+    DCHECK(node_backing_store);
+    if (backing_store.get() == node_backing_store.get() &&
+        addr == node->wait_addr_ && node->waiting_) {
       waiters++;
     }
 
diff --git a/deps/v8/src/execution/futex-emulation.h b/deps/v8/src/execution/futex-emulation.h
index 2d005bcfd19..e65c2fc3625 100644
--- a/deps/v8/src/execution/futex-emulation.h
+++ b/deps/v8/src/execution/futex-emulation.h
@@ -30,6 +30,7 @@ class TimeDelta;
 
 namespace internal {
 
+class BackingStore;
 template <typename T>
 class Handle;
 class Isolate;
@@ -52,7 +53,6 @@ class FutexWaitListNode {
   FutexWaitListNode()
       : prev_(nullptr),
         next_(nullptr),
-        backing_store_(nullptr),
         wait_addr_(0),
         waiting_(false),
         interrupted_(false) {}
@@ -68,7 +68,7 @@ class FutexWaitListNode {
   // prev_ and next_ are protected by FutexEmulation::mutex_.
   FutexWaitListNode* prev_;
   FutexWaitListNode* next_;
-  void* backing_store_;
+  std::weak_ptr<BackingStore> backing_store_;
   size_t wait_addr_;
   // waiting_ and interrupted_ are protected by FutexEmulation::mutex_
   // if this node is currently contained in FutexEmulation::wait_list_
diff --git a/deps/v8/src/execution/isolate.cc b/deps/v8/src/execution/isolate.cc
index c9c6225eb8f..0d809f14d3b 100644
--- a/deps/v8/src/execution/isolate.cc
+++ b/deps/v8/src/execution/isolate.cc
@@ -42,6 +42,7 @@
 #include "src/execution/simulator.h"
 #include "src/execution/v8threads.h"
 #include "src/execution/vm-state-inl.h"
+#include "src/handles/persistent-handles.h"
 #include "src/heap/heap-inl.h"
 #include "src/heap/read-only-heap.h"
 #include "src/ic/stub-cache.h"
@@ -79,6 +80,7 @@
 #include "src/tasks/cancelable-task.h"
 #include "src/tracing/tracing-category-observer.h"
 #include "src/trap-handler/trap-handler.h"
+#include "src/utils/address-map.h"
 #include "src/utils/ostreams.h"
 #include "src/utils/version.h"
 #include "src/wasm/wasm-code-manager.h"
@@ -586,21 +588,28 @@ class FrameArrayBuilder {
                                           offset, flags, parameters);
   }
 
-  void AppendPromiseAllFrame(Handle<Context> context, int offset) {
+  void AppendPromiseCombinatorFrame(Handle<JSFunction> element_function,
+                                    Handle<JSFunction> combinator,
+                                    FrameArray::Flag combinator_flag,
+                                    Handle<Context> context) {
     if (full()) return;
-    int flags = FrameArray::kIsAsync | FrameArray::kIsPromiseAll;
+    int flags = FrameArray::kIsAsync | combinator_flag;
 
     Handle<Context> native_context(context->native_context(), isolate_);
-    Handle<JSFunction> function(native_context->promise_all(), isolate_);
-    if (!IsVisibleInStackTrace(function)) return;
+    if (!IsVisibleInStackTrace(combinator)) return;
 
     Handle<Object> receiver(native_context->promise_function(), isolate_);
-    Handle<AbstractCode> code(AbstractCode::cast(function->code()), isolate_);
+    Handle<AbstractCode> code(AbstractCode::cast(combinator->code()), isolate_);
 
-    // TODO(mmarchini) save Promises list from Promise.all()
+    // TODO(mmarchini) save Promises list from the Promise combinator
     Handle<FixedArray> parameters = isolate_->factory()->empty_fixed_array();
 
-    elements_ = FrameArray::AppendJSFrame(elements_, receiver, function, code,
+    // We store the offset of the promise into the element function's
+    // hash field for element callbacks.
+    int const offset =
+        Smi::ToInt(Smi::cast(element_function->GetIdentityHash())) - 1;
+
+    elements_ = FrameArray::AppendJSFrame(elements_, receiver, combinator, code,
                                           offset, flags, parameters);
   }
 
@@ -620,16 +629,16 @@ class FrameArrayBuilder {
     if (is_constructor) flags |= FrameArray::kIsConstructor;
 
     Handle<FixedArray> parameters = isolate_->factory()->empty_fixed_array();
-    if (V8_UNLIKELY(FLAG_detailed_error_stack_trace))
+    if (V8_UNLIKELY(FLAG_detailed_error_stack_trace)) {
       parameters = summary.parameters();
+    }
 
     elements_ = FrameArray::AppendJSFrame(
         elements_, TheHoleToUndefined(isolate_, summary.receiver()), function,
         abstract_code, offset, flags, parameters);
   }
 
-  void AppendWasmCompiledFrame(
-      FrameSummary::WasmCompiledFrameSummary const& summary) {
+  void AppendWasmFrame(FrameSummary::WasmFrameSummary const& summary) {
     if (summary.code()->kind() != wasm::WasmCode::kFunction) return;
     Handle<WasmInstanceObject> instance = summary.wasm_instance();
     int flags = 0;
@@ -639,7 +648,7 @@ class FrameArrayBuilder {
         flags |= FrameArray::kAsmJsAtNumberConversion;
       }
     } else {
-      flags |= FrameArray::kIsWasmCompiledFrame;
+      flags |= FrameArray::kIsWasmFrame;
     }
 
     elements_ = FrameArray::AppendWasmFrame(
@@ -647,16 +656,6 @@ class FrameArrayBuilder {
         summary.code_offset(), flags);
   }
 
-  void AppendWasmInterpretedFrame(
-      FrameSummary::WasmInterpretedFrameSummary const& summary) {
-    Handle<WasmInstanceObject> instance = summary.wasm_instance();
-    int flags = FrameArray::kIsWasmInterpretedFrame;
-    DCHECK(!instance->module_object().is_asm_js());
-    elements_ = FrameArray::AppendWasmFrame(elements_, instance,
-                                            summary.function_index(), {},
-                                            summary.byte_offset(), flags);
-  }
-
   void AppendBuiltinExitFrame(BuiltinExitFrame* exit_frame) {
     Handle<JSFunction> function = handle(exit_frame->function(), isolate_);
 
@@ -869,11 +868,10 @@ void CaptureAsyncStackTrace(Isolate* isolate, Handle<JSPromise> promise,
       Handle<JSFunction> function(JSFunction::cast(reaction->fulfill_handler()),
                                   isolate);
       Handle<Context> context(function->context(), isolate);
-
-      // We store the offset of the promise into the {function}'s
-      // hash field for promise resolve element callbacks.
-      int const offset = Smi::ToInt(Smi::cast(function->GetIdentityHash())) - 1;
-      builder->AppendPromiseAllFrame(context, offset);
+      Handle<JSFunction> combinator(context->native_context().promise_all(),
+                                    isolate);
+      builder->AppendPromiseCombinatorFrame(function, combinator,
+                                            FrameArray::kIsPromiseAll, context);
 
       // Now peak into the Promise.all() resolve element context to
       // find the promise capability that's being resolved when all
@@ -884,6 +882,24 @@ void CaptureAsyncStackTrace(Isolate* isolate, Handle<JSPromise> promise,
           PromiseCapability::cast(context->get(index)), isolate);
       if (!capability->promise().IsJSPromise()) return;
       promise = handle(JSPromise::cast(capability->promise()), isolate);
+    } else if (IsBuiltinFunction(isolate, reaction->reject_handler(),
+                                 Builtins::kPromiseAnyRejectElementClosure)) {
+      Handle<JSFunction> function(JSFunction::cast(reaction->reject_handler()),
+                                  isolate);
+      Handle<Context> context(function->context(), isolate);
+      Handle<JSFunction> combinator(context->native_context().promise_any(),
+                                    isolate);
+      builder->AppendPromiseCombinatorFrame(function, combinator,
+                                            FrameArray::kIsPromiseAny, context);
+
+      // Now peak into the Promise.any() reject element context to
+      // find the promise capability that's being resolved when any of
+      // the concurrent promises resolve.
+      int const index = PromiseBuiltins::kPromiseAnyRejectElementCapabilitySlot;
+      Handle<PromiseCapability> capability(
+          PromiseCapability::cast(context->get(index)), isolate);
+      if (!capability->promise().IsJSPromise()) return;
+      promise = handle(JSPromise::cast(capability->promise()), isolate);
     } else if (IsBuiltinFunction(isolate, reaction->fulfill_handler(),
                                  Builtins::kPromiseCapabilityDefaultResolve)) {
       Handle<JSFunction> function(JSFunction::cast(reaction->fulfill_handler()),
@@ -949,8 +965,7 @@ Handle<Object> CaptureStackTrace(Isolate* isolate, Handle<Object> caller,
       case StackFrame::OPTIMIZED:
       case StackFrame::INTERPRETED:
       case StackFrame::BUILTIN:
-      case StackFrame::WASM_COMPILED:
-      case StackFrame::WASM_INTERPRETER_ENTRY: {
+      case StackFrame::WASM: {
         // A standard frame may include many summarized frames (due to
         // inlining).
         std::vector<FrameSummary> frames;
@@ -968,18 +983,12 @@ Handle<Object> CaptureStackTrace(Isolate* isolate, Handle<Object> caller,
             //=========================================================
             auto const& java_script = summary.AsJavaScript();
             builder.AppendJavaScriptFrame(java_script);
-          } else if (summary.IsWasmCompiled()) {
+          } else if (summary.IsWasm()) {
             //=========================================================
-            // Handle a Wasm compiled frame.
+            // Handle a Wasm frame.
             //=========================================================
-            auto const& wasm_compiled = summary.AsWasmCompiled();
-            builder.AppendWasmCompiledFrame(wasm_compiled);
-          } else if (summary.IsWasmInterpreted()) {
-            //=========================================================
-            // Handle a Wasm interpreted frame.
-            //=========================================================
-            auto const& wasm_interpreted = summary.AsWasmInterpreted();
-            builder.AppendWasmInterpretedFrame(wasm_interpreted);
+            auto const& wasm = summary.AsWasm();
+            builder.AppendWasmFrame(wasm);
           }
         }
         break;
@@ -1061,7 +1070,6 @@ Handle<Object> CaptureStackTrace(Isolate* isolate, Handle<Object> caller,
     }
   }
 
-  // TODO(yangguo): Queue this structured stack trace for preprocessing on GC.
   return builder.GetElementsAsStackTraceFrameArray();
 }
 
@@ -1412,6 +1420,8 @@ void Isolate::InvokeApiInterruptCallbacks() {
   }
 }
 
+namespace {
+
 void ReportBootstrappingException(Handle<Object> exception,
                                   MessageLocation* location) {
   base::OS::PrintError("Exception thrown during bootstrapping\n");
@@ -1467,6 +1477,36 @@ void ReportBootstrappingException(Handle<Object> exception,
 #endif
 }
 
+}  // anonymous namespace
+
+Handle<JSMessageObject> Isolate::CreateMessageOrAbort(
+    Handle<Object> exception, MessageLocation* location) {
+  Handle<JSMessageObject> message_obj = CreateMessage(exception, location);
+
+  // If the abort-on-uncaught-exception flag is specified, and if the
+  // embedder didn't specify a custom uncaught exception callback,
+  // or if the custom callback determined that V8 should abort, then
+  // abort.
+  if (FLAG_abort_on_uncaught_exception) {
+    CatchType prediction = PredictExceptionCatcher();
+    if ((prediction == NOT_CAUGHT || prediction == CAUGHT_BY_EXTERNAL) &&
+        (!abort_on_uncaught_exception_callback_ ||
+         abort_on_uncaught_exception_callback_(
+             reinterpret_cast<v8::Isolate*>(this)))) {
+      // Prevent endless recursion.
+      FLAG_abort_on_uncaught_exception = false;
+      // This flag is intended for use by JavaScript developers, so
+      // print a user-friendly stack trace (not an internal one).
+      PrintF(stderr, "%s\n\nFROM\n",
+             MessageHandler::GetLocalizedMessage(this, message_obj).get());
+      PrintCurrentStackTrace(stderr);
+      base::OS::Abort();
+    }
+  }
+
+  return message_obj;
+}
+
 Object Isolate::Throw(Object raw_exception, MessageLocation* location) {
   DCHECK(!has_pending_exception());
 
@@ -1538,38 +1578,14 @@ Object Isolate::Throw(Object raw_exception, MessageLocation* location) {
     if (location == nullptr && ComputeLocation(&computed_location)) {
       location = &computed_location;
     }
-
     if (bootstrapper()->IsActive()) {
       // It's not safe to try to make message objects or collect stack traces
       // while the bootstrapper is active since the infrastructure may not have
       // been properly initialized.
       ReportBootstrappingException(exception, location);
     } else {
-      Handle<Object> message_obj = CreateMessage(exception, location);
+      Handle<Object> message_obj = CreateMessageOrAbort(exception, location);
       thread_local_top()->pending_message_obj_ = *message_obj;
-
-      // For any exception not caught by JavaScript, even when an external
-      // handler is present:
-      // If the abort-on-uncaught-exception flag is specified, and if the
-      // embedder didn't specify a custom uncaught exception callback,
-      // or if the custom callback determined that V8 should abort, then
-      // abort.
-      if (FLAG_abort_on_uncaught_exception) {
-        CatchType prediction = PredictExceptionCatcher();
-        if ((prediction == NOT_CAUGHT || prediction == CAUGHT_BY_EXTERNAL) &&
-            (!abort_on_uncaught_exception_callback_ ||
-             abort_on_uncaught_exception_callback_(
-                 reinterpret_cast<v8::Isolate*>(this)))) {
-          // Prevent endless recursion.
-          FLAG_abort_on_uncaught_exception = false;
-          // This flag is intended for use by JavaScript developers, so
-          // print a user-friendly stack trace (not an internal one).
-          PrintF(stderr, "%s\n\nFROM\n",
-                 MessageHandler::GetLocalizedMessage(this, message_obj).get());
-          PrintCurrentStackTrace(stderr);
-          base::OS::Abort();
-        }
-      }
     }
   }
 
@@ -1660,7 +1676,7 @@ Object Isolate::UnwindAndFindHandler() {
                             code.constant_pool(), return_sp, frame->fp());
       }
 
-      case StackFrame::WASM_COMPILED: {
+      case StackFrame::WASM: {
         if (trap_handler::IsThreadInWasm()) {
           trap_handler::ClearThreadInWasm();
         }
@@ -1672,7 +1688,7 @@ Object Isolate::UnwindAndFindHandler() {
         // the code. It's not actually necessary to keep the code alive as it's
         // currently being executed.
         wasm::WasmCodeRefScope code_ref_scope;
-        WasmCompiledFrame* wasm_frame = static_cast<WasmCompiledFrame*>(frame);
+        WasmFrame* wasm_frame = static_cast<WasmFrame*>(frame);
         wasm::WasmCode* wasm_code =
             wasm_engine()->code_manager()->LookupCode(frame->pc());
         int offset = wasm_frame->LookupExceptionHandlerInTable();
@@ -1798,12 +1814,6 @@ Object Isolate::UnwindAndFindHandler() {
         }
         break;
 
-      case StackFrame::WASM_INTERPRETER_ENTRY: {
-        if (trap_handler::IsThreadInWasm()) {
-          trap_handler::ClearThreadInWasm();
-        }
-      } break;
-
       case StackFrame::JAVA_SCRIPT_BUILTIN_CONTINUATION_WITH_CATCH: {
         // Builtin continuation frames with catch can handle exceptions.
         if (!catchable_by_js) break;
@@ -2106,14 +2116,13 @@ bool Isolate::ComputeLocationFromStackTrace(MessageLocation* target,
       bool is_at_number_conversion =
           elements->IsAsmJsWasmFrame(i) &&
           elements->Flags(i).value() & FrameArray::kAsmJsAtNumberConversion;
-      if (elements->IsWasmCompiledFrame(i)) {
+      if (elements->IsWasmFrame(i) || elements->IsAsmJsWasmFrame(i)) {
         // WasmCode* held alive by the {GlobalWasmCodeRef}.
         wasm::WasmCode* code =
             Managed<wasm::GlobalWasmCodeRef>::cast(elements->WasmCodeObject(i))
                 .get()
                 ->code();
-        offset = FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
-            code, offset);
+        offset = code->GetSourcePositionBefore(offset);
       }
       Handle<WasmInstanceObject> instance(elements->WasmInstance(i), this);
       const wasm::WasmModule* module = elements->WasmInstance(i).module();
@@ -2230,9 +2239,28 @@ bool Isolate::IsExternalHandlerOnTop(Object exception) {
   return (entry_handler > external_handler);
 }
 
-void Isolate::ReportPendingMessagesImpl(bool report_externally) {
+std::vector<MemoryRange>* Isolate::GetCodePages() const {
+  return code_pages_.load(std::memory_order_acquire);
+}
+
+void Isolate::SetCodePages(std::vector<MemoryRange>* new_code_pages) {
+  code_pages_.store(new_code_pages, std::memory_order_release);
+}
+
+void Isolate::ReportPendingMessages() {
+  DCHECK(AllowExceptions::IsAllowed(this));
+
+  // The embedder might run script in response to an exception.
+  AllowJavascriptExecutionDebugOnly allow_script(this);
+
   Object exception_obj = pending_exception();
 
+  // Try to propagate the exception to an external v8::TryCatch handler. If
+  // propagation was unsuccessful, then we will get another chance at reporting
+  // the pending message if the exception is re-thrown.
+  bool has_been_propagated = PropagatePendingExceptionToExternalTryCatch();
+  if (!has_been_propagated) return;
+
   // Clear the pending message object early to avoid endless recursion.
   Object message_obj = thread_local_top()->pending_message_obj_;
   clear_pending_message();
@@ -2245,7 +2273,7 @@ void Isolate::ReportPendingMessagesImpl(bool report_externally) {
   // depending on whether and external v8::TryCatch or an internal JavaScript
   // handler is on top.
   bool should_report_exception;
-  if (report_externally) {
+  if (IsExternalHandlerOnTop(exception_obj)) {
     // Only report the exception if the external handler is verbose.
     should_report_exception = try_catch_handler()->is_verbose_;
   } else {
@@ -2271,93 +2299,6 @@ void Isolate::ReportPendingMessagesImpl(bool report_externally) {
   }
 }
 
-std::vector<MemoryRange>* Isolate::GetCodePages() const {
-  return code_pages_.load(std::memory_order_acquire);
-}
-
-void Isolate::SetCodePages(std::vector<MemoryRange>* new_code_pages) {
-  code_pages_.store(new_code_pages, std::memory_order_release);
-}
-
-void Isolate::ReportPendingMessages() {
-  DCHECK(AllowExceptions::IsAllowed(this));
-
-  // The embedder might run script in response to an exception.
-  AllowJavascriptExecutionDebugOnly allow_script(this);
-
-  Object exception = pending_exception();
-
-  // Try to propagate the exception to an external v8::TryCatch handler. If
-  // propagation was unsuccessful, then we will get another chance at reporting
-  // the pending message if the exception is re-thrown.
-  bool has_been_propagated = PropagatePendingExceptionToExternalTryCatch();
-  if (!has_been_propagated) return;
-
-  ReportPendingMessagesImpl(IsExternalHandlerOnTop(exception));
-}
-
-void Isolate::ReportPendingMessagesFromJavaScript() {
-  DCHECK(AllowExceptions::IsAllowed(this));
-
-  auto IsHandledByJavaScript = [=]() {
-    // In this situation, the exception is always a non-terminating exception.
-
-    // Get the top-most JS_ENTRY handler, cannot be on top if it doesn't exist.
-    Address entry_handler = Isolate::handler(thread_local_top());
-    DCHECK_NE(entry_handler, kNullAddress);
-    entry_handler = StackHandler::FromAddress(entry_handler)->next_address();
-
-    // Get the address of the external handler so we can compare the address to
-    // determine which one is closer to the top of the stack.
-    Address external_handler = thread_local_top()->try_catch_handler_address();
-    if (external_handler == kNullAddress) return true;
-
-    return (entry_handler < external_handler);
-  };
-
-  auto IsHandledExternally = [=]() {
-    Address external_handler = thread_local_top()->try_catch_handler_address();
-    if (external_handler == kNullAddress) return false;
-
-    // Get the top-most JS_ENTRY handler, cannot be on top if it doesn't exist.
-    Address entry_handler = Isolate::handler(thread_local_top());
-    DCHECK_NE(entry_handler, kNullAddress);
-    entry_handler = StackHandler::FromAddress(entry_handler)->next_address();
-    return (entry_handler > external_handler);
-  };
-
-  auto PropagateToExternalHandler = [=]() {
-    if (IsHandledByJavaScript()) {
-      thread_local_top()->external_caught_exception_ = false;
-      return false;
-    }
-
-    if (!IsHandledExternally()) {
-      thread_local_top()->external_caught_exception_ = false;
-      return true;
-    }
-
-    thread_local_top()->external_caught_exception_ = true;
-    v8::TryCatch* handler = try_catch_handler();
-    DCHECK(thread_local_top()->pending_message_obj_.IsJSMessageObject() ||
-           thread_local_top()->pending_message_obj_.IsTheHole(this));
-    handler->can_continue_ = true;
-    handler->has_terminated_ = false;
-    handler->exception_ = reinterpret_cast<void*>(pending_exception().ptr());
-    // Propagate to the external try-catch only if we got an actual message.
-    if (thread_local_top()->pending_message_obj_.IsTheHole(this)) return true;
-
-    handler->message_obj_ =
-        reinterpret_cast<void*>(thread_local_top()->pending_message_obj_.ptr());
-    return true;
-  };
-
-  // Try to propagate to an external v8::TryCatch handler.
-  if (!PropagateToExternalHandler()) return;
-
-  ReportPendingMessagesImpl(true);
-}
-
 bool Isolate::OptionalRescheduleException(bool clear_exception) {
   DCHECK(has_pending_exception());
   PropagatePendingExceptionToExternalTryCatch();
@@ -2587,6 +2528,14 @@ bool Isolate::AreWasmThreadsEnabled(Handle<Context> context) {
   return FLAG_experimental_wasm_threads;
 }
 
+bool Isolate::IsWasmSimdEnabled(Handle<Context> context) {
+  if (wasm_simd_enabled_callback()) {
+    v8::Local<v8::Context> api_context = v8::Utils::ToLocal(context);
+    return wasm_simd_enabled_callback()(api_context);
+  }
+  return FLAG_experimental_wasm_simd;
+}
+
 Handle<Context> Isolate::GetIncumbentContext() {
   JavaScriptFrameIterator it(this);
 
@@ -2837,7 +2786,11 @@ void Isolate::Delete(Isolate* isolate) {
   SetIsolateThreadLocals(saved_isolate, saved_data);
 }
 
-void Isolate::SetUpFromReadOnlyHeap(ReadOnlyHeap* ro_heap) {
+void Isolate::SetUpFromReadOnlyArtifacts(
+    std::shared_ptr<ReadOnlyArtifacts> artifacts) {
+  artifacts_ = artifacts;
+  DCHECK_NOT_NULL(artifacts);
+  ReadOnlyHeap* ro_heap = artifacts->read_only_heap();
   DCHECK_NOT_NULL(ro_heap);
   DCHECK_IMPLIES(read_only_heap_ != nullptr, read_only_heap_ == ro_heap);
   read_only_heap_ = ro_heap;
@@ -2858,6 +2811,7 @@ Isolate::Isolate(std::unique_ptr<i::IsolateAllocator> isolate_allocator)
       builtins_(this),
       rail_mode_(PERFORMANCE_ANIMATION),
       code_event_dispatcher_(new CodeEventDispatcher()),
+      persistent_handles_list_(new PersistentHandlesList(this)),
       jitless_(FLAG_jitless),
 #if V8_SFI_HAS_UNIQUE_ID
       next_unique_sfi_id_(0),
@@ -3414,8 +3368,8 @@ bool Isolate::Init(ReadOnlyDeserializer* read_only_deserializer,
   }
 
   if (create_heap_objects) {
-    // Terminate the partial snapshot cache so we can iterate.
-    partial_snapshot_cache_.push_back(ReadOnlyRoots(this).undefined_value());
+    // Terminate the startup object cache so we can iterate.
+    startup_object_cache_.push_back(ReadOnlyRoots(this).undefined_value());
   }
 
   InitializeThreadLocal();
@@ -3431,15 +3385,15 @@ bool Isolate::Init(ReadOnlyDeserializer* read_only_deserializer,
 
     setup_delegate_->SetupBuiltins(this);
 
-#if !defined(V8_TARGET_ARCH_ARM) && !defined(V8_TARGET_ARCH_S390X)
+#ifndef V8_TARGET_ARCH_ARM
     // Store the interpreter entry trampoline on the root list. It is used as a
     // template for further copies that may later be created to help profile
     // interpreted code.
-    // We currently cannot do this on above architectures due to
-    // RELATIVE_CODE_TARGETs assuming that all possible Code targets may be
-    // addressed with an int24 offset, effectively limiting code space size to
-    // 32MB. We can guarantee this at mksnapshot-time, but not at runtime. See
-    // also: https://crbug.com/v8/8713.
+    // We currently cannot do this on arm due to RELATIVE_CODE_TARGETs
+    // assuming that all possible Code targets may be addressed with an int24
+    // offset, effectively limiting code space size to 32MB. We can guarantee
+    // this at mksnapshot-time, but not at runtime.
+    // See also: https://crbug.com/v8/8713.
     heap_.SetInterpreterEntryTrampolineForProfiling(
         heap_.builtin(Builtins::kInterpreterEntryTrampoline));
 #endif
@@ -3514,11 +3468,11 @@ bool Isolate::Init(ReadOnlyDeserializer* read_only_deserializer,
   }
 #endif  // DEBUG
 
-#if !defined(V8_TARGET_ARCH_ARM) && !defined(V8_TARGET_ARCH_S390X)
+#ifndef V8_TARGET_ARCH_ARM
   // The IET for profiling should always be a full on-heap Code object.
   DCHECK(!Code::cast(heap_.interpreter_entry_trampoline_for_profiling())
               .is_off_heap_trampoline());
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_S390X
+#endif  // V8_TARGET_ARCH_ARM
 
   if (FLAG_print_builtin_code) builtins()->PrintBuiltinCode();
   if (FLAG_print_builtin_size) builtins()->PrintBuiltinSize();
@@ -3655,6 +3609,10 @@ void Isolate::UnlinkDeferredHandles(DeferredHandles* deferred) {
   }
 }
 
+std::unique_ptr<PersistentHandles> Isolate::NewPersistentHandles() {
+  return std::make_unique<PersistentHandles>(this);
+}
+
 void Isolate::DumpAndResetStats() {
   if (turbo_statistics() != nullptr) {
     DCHECK(FLAG_turbo_stats || FLAG_turbo_stats_nvp);
@@ -4018,21 +3976,6 @@ MaybeHandle<JSPromise> Isolate::RunHostImportModuleDynamicallyCallback(
 
 void Isolate::ClearKeptObjects() { heap()->ClearKeptObjects(); }
 
-void Isolate::SetHostCleanupFinalizationGroupCallback(
-    HostCleanupFinalizationGroupCallback callback) {
-  host_cleanup_finalization_group_callback_ = callback;
-}
-
-void Isolate::RunHostCleanupFinalizationGroupCallback(
-    Handle<JSFinalizationRegistry> fr) {
-  if (host_cleanup_finalization_group_callback_ != nullptr) {
-    v8::Local<v8::Context> api_context =
-        v8::Utils::ToLocal(handle(Context::cast(fr->native_context()), this));
-    host_cleanup_finalization_group_callback_(api_context,
-                                              v8::Utils::ToLocal(fr));
-  }
-}
-
 void Isolate::SetHostImportModuleDynamicallyCallback(
     HostImportModuleDynamicallyCallback callback) {
   host_import_module_dynamically_callback_ = callback;
@@ -4040,19 +3983,17 @@ void Isolate::SetHostImportModuleDynamicallyCallback(
 
 Handle<JSObject> Isolate::RunHostInitializeImportMetaObjectCallback(
     Handle<SourceTextModule> module) {
-  Handle<HeapObject> host_meta(module->import_meta(), this);
-  if (host_meta->IsTheHole(this)) {
-    host_meta = factory()->NewJSObjectWithNullProto();
-    if (host_initialize_import_meta_object_callback_ != nullptr) {
-      v8::Local<v8::Context> api_context =
-          v8::Utils::ToLocal(Handle<Context>(native_context()));
-      host_initialize_import_meta_object_callback_(
-          api_context, Utils::ToLocal(Handle<Module>::cast(module)),
-          v8::Local<v8::Object>::Cast(v8::Utils::ToLocal(host_meta)));
-    }
-    module->set_import_meta(*host_meta);
+  CHECK(module->import_meta().IsTheHole(this));
+  Handle<JSObject> import_meta = factory()->NewJSObjectWithNullProto();
+  if (host_initialize_import_meta_object_callback_ != nullptr) {
+    v8::Local<v8::Context> api_context =
+        v8::Utils::ToLocal(Handle<Context>(native_context()));
+    host_initialize_import_meta_object_callback_(
+        api_context, Utils::ToLocal(Handle<Module>::cast(module)),
+        v8::Local<v8::Object>::Cast(v8::Utils::ToLocal(import_meta)));
+    CHECK(!has_scheduled_exception());
   }
-  return Handle<JSObject>::cast(host_meta);
+  return import_meta;
 }
 
 void Isolate::SetHostInitializeImportMetaObjectCallback(
@@ -4243,9 +4184,15 @@ void Isolate::SetUseCounterCallback(v8::Isolate::UseCounterCallback callback) {
 }
 
 void Isolate::CountUsage(v8::Isolate::UseCounterFeature feature) {
-  // The counter callback may cause the embedder to call into V8, which is not
-  // generally possible during GC.
-  if (heap_.gc_state() == Heap::NOT_IN_GC) {
+  // The counter callback
+  // - may cause the embedder to call into V8, which is not generally possible
+  //   during GC.
+  // - requires a current native context, which may not always exist.
+  // TODO(jgruber): Consider either removing the native context requirement in
+  // blink, or passing it to the callback explicitly.
+  if (heap_.gc_state() == Heap::NOT_IN_GC && !context().is_null()) {
+    DCHECK(context().IsContext());
+    DCHECK(context().native_context().IsNativeContext());
     if (use_counter_callback_) {
       HandleScope handle_scope(this);
       use_counter_callback_(reinterpret_cast<v8::Isolate*>(this), feature);
@@ -4257,6 +4204,13 @@ void Isolate::CountUsage(v8::Isolate::UseCounterFeature feature) {
 
 int Isolate::GetNextScriptId() { return heap()->NextScriptId(); }
 
+int Isolate::GetNextStackFrameInfoId() {
+  int id = last_stack_frame_info_id();
+  int next_id = id == Smi::kMaxValue ? 0 : (id + 1);
+  set_last_stack_frame_info_id(next_id);
+  return next_id;
+}
+
 // static
 std::string Isolate::GetTurboCfgFileName(Isolate* isolate) {
   if (FLAG_trace_turbo_cfg_file == nullptr) {
@@ -4416,6 +4370,9 @@ void Isolate::set_icu_object_in_cache(ICUObjectCacheType cache_type,
 void Isolate::clear_cached_icu_object(ICUObjectCacheType cache_type) {
   icu_object_cache_.erase(cache_type);
 }
+
+void Isolate::ClearCachedIcuObjects() { icu_object_cache_.clear(); }
+
 #endif  // V8_INTL_SUPPORT
 
 bool StackLimitCheck::JsHasOverflowed(uintptr_t gap) const {
diff --git a/deps/v8/src/execution/isolate.h b/deps/v8/src/execution/isolate.h
index 037e6ea7f59..3917d8cb4ba 100644
--- a/deps/v8/src/execution/isolate.h
+++ b/deps/v8/src/execution/isolate.h
@@ -85,6 +85,9 @@ class MaterializedObjectStore;
 class Microtask;
 class MicrotaskQueue;
 class OptimizingCompileDispatcher;
+class PersistentHandles;
+class PersistentHandlesList;
+class ReadOnlyArtifacts;
 class ReadOnlyDeserializer;
 class RegExpStack;
 class RootVisitor;
@@ -405,6 +408,7 @@ using DebugObjectCache = std::vector<Handle<HeapObject>>;
   V(WasmStreamingCallback, wasm_streaming_callback, nullptr)                   \
   V(WasmThreadsEnabledCallback, wasm_threads_enabled_callback, nullptr)        \
   V(WasmLoadSourceMapCallback, wasm_load_source_map_callback, nullptr)         \
+  V(WasmSimdEnabledCallback, wasm_simd_enabled_callback, nullptr)              \
   /* State for Relocatable. */                                                 \
   V(Relocatable*, relocatable_top, nullptr)                                    \
   V(DebugObjectCache*, string_stream_debug_object_cache, nullptr)              \
@@ -460,6 +464,8 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
 
  public:
   using HandleScopeType = HandleScope;
+  void* operator new(size_t) = delete;
+  void operator delete(void*) = delete;
 
   // A thread has a PerIsolateThreadData instance for each isolate that it has
   // entered. That instance is allocated when the isolate is initially entered
@@ -522,7 +528,7 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
   // for legacy API reasons.
   static void Delete(Isolate* isolate);
 
-  void SetUpFromReadOnlyHeap(ReadOnlyHeap* ro_heap);
+  void SetUpFromReadOnlyArtifacts(std::shared_ptr<ReadOnlyArtifacts> artifacts);
 
   // Returns allocation mode of this isolate.
   V8_INLINE IsolateAllocationMode isolate_allocation_mode();
@@ -618,6 +624,7 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
   inline void clear_pending_exception();
 
   bool AreWasmThreadsEnabled(Handle<Context> context);
+  bool IsWasmSimdEnabled(Handle<Context> context);
 
   THREAD_LOCAL_TOP_ADDRESS(Object, pending_exception)
 
@@ -822,10 +829,6 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
   // Un-schedule an exception that was caught by a TryCatch handler.
   void CancelScheduledExceptionFromTryCatch(v8::TryCatch* handler);
   void ReportPendingMessages();
-  void ReportPendingMessagesFromJavaScript();
-
-  // Implements code shared between the two above methods
-  void ReportPendingMessagesImpl(bool report_externally);
 
   // Promote a scheduled exception to pending. Asserts has_scheduled_exception.
   Object PromoteScheduledException();
@@ -842,6 +845,8 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
 
   Handle<JSMessageObject> CreateMessage(Handle<Object> exception,
                                         MessageLocation* location);
+  Handle<JSMessageObject> CreateMessageOrAbort(Handle<Object> exception,
+                                               MessageLocation* location);
 
   // Out of resource exception helpers.
   Object StackOverflow();
@@ -1171,6 +1176,7 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
   void set_icu_object_in_cache(ICUObjectCacheType cache_type,
                                std::shared_ptr<icu::UMemory> obj);
   void clear_cached_icu_object(ICUObjectCacheType cache_type);
+  void ClearCachedIcuObjects();
 
 #endif  // V8_INTL_SUPPORT
 
@@ -1200,6 +1206,12 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
   void LinkDeferredHandles(DeferredHandles* deferred_handles);
   void UnlinkDeferredHandles(DeferredHandles* deferred_handles);
 
+  std::unique_ptr<PersistentHandles> NewPersistentHandles();
+
+  PersistentHandlesList* persistent_handles_list() {
+    return persistent_handles_list_.get();
+  }
+
 #ifdef DEBUG
   bool IsDeferredHandle(Address* location);
 #endif  // DEBUG
@@ -1281,6 +1293,8 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
 
   int GetNextScriptId();
 
+  int GetNextStackFrameInfoId();
+
 #if V8_SFI_HAS_UNIQUE_ID
   int GetNextUniqueSharedFunctionInfoId() {
     int current_id = next_unique_sfi_id_.load(std::memory_order_relaxed);
@@ -1336,9 +1350,7 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
 
   void AddSharedWasmMemory(Handle<WasmMemoryObject> memory_object);
 
-  std::vector<Object>* partial_snapshot_cache() {
-    return &partial_snapshot_cache_;
-  }
+  std::vector<Object>* startup_object_cache() { return &startup_object_cache_; }
 
   bool IsGeneratingEmbeddedBuiltins() const {
     return builtins_constants_table_builder() != nullptr;
@@ -1408,14 +1420,6 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
   bool IsInAnyContext(Object object, uint32_t index);
 
   void ClearKeptObjects();
-  void SetHostCleanupFinalizationGroupCallback(
-      HostCleanupFinalizationGroupCallback callback);
-  HostCleanupFinalizationGroupCallback
-  host_cleanup_finalization_group_callback() const {
-    return host_cleanup_finalization_group_callback_;
-  }
-  void RunHostCleanupFinalizationGroupCallback(
-      Handle<JSFinalizationRegistry> fr);
 
   void SetHostImportModuleDynamicallyCallback(
       HostImportModuleDynamicallyCallback callback);
@@ -1623,6 +1627,7 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
   std::unique_ptr<IsolateAllocator> isolate_allocator_;
   Heap heap_;
   ReadOnlyHeap* read_only_heap_ = nullptr;
+  std::shared_ptr<ReadOnlyArtifacts> artifacts_;
 
   const int id_;
   EntryStackItem* entry_stack_ = nullptr;
@@ -1671,8 +1676,6 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
   v8::Isolate::AtomicsWaitCallback atomics_wait_callback_ = nullptr;
   void* atomics_wait_callback_data_ = nullptr;
   PromiseHook promise_hook_ = nullptr;
-  HostCleanupFinalizationGroupCallback
-      host_cleanup_finalization_group_callback_ = nullptr;
   HostImportModuleDynamicallyCallback host_import_module_dynamically_callback_ =
       nullptr;
   HostInitializeImportMetaObjectCallback
@@ -1764,6 +1767,8 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
   DeferredHandles* deferred_handles_head_ = nullptr;
   OptimizingCompileDispatcher* optimizing_compile_dispatcher_ = nullptr;
 
+  std::unique_ptr<PersistentHandlesList> persistent_handles_list_;
+
   // Counts deopt points if deopt_every_n_times is enabled.
   unsigned int stress_deopt_count_ = 0;
 
@@ -1785,7 +1790,7 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
 
   v8::Isolate::UseCounterCallback use_counter_callback_ = nullptr;
 
-  std::vector<Object> partial_snapshot_cache_;
+  std::vector<Object> startup_object_cache_;
 
   // Used during builtins compilation to build the builtins constants table,
   // which is stored on the root list prior to serialization.
@@ -1859,8 +1864,6 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
   // Delete new/delete operators to ensure that Isolate::New() and
   // Isolate::Delete() are used for Isolate creation and deletion.
   void* operator new(size_t, void* ptr) { return ptr; }
-  void* operator new(size_t) = delete;
-  void operator delete(void*) = delete;
 
   friend class heap::HeapTester;
   friend class TestSerializer;
diff --git a/deps/v8/src/execution/local-isolate-wrapper-inl.h b/deps/v8/src/execution/local-isolate-wrapper-inl.h
new file mode 100644
index 00000000000..2f573130491
--- /dev/null
+++ b/deps/v8/src/execution/local-isolate-wrapper-inl.h
@@ -0,0 +1,148 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_EXECUTION_LOCAL_ISOLATE_WRAPPER_INL_H_
+#define V8_EXECUTION_LOCAL_ISOLATE_WRAPPER_INL_H_
+
+#include "src/execution/isolate.h"
+#include "src/execution/local-isolate-wrapper.h"
+#include "src/execution/off-thread-isolate.h"
+#include "src/heap/heap-inl.h"
+#include "src/heap/off-thread-heap.h"
+#include "src/logging/log.h"
+#include "src/logging/off-thread-logger.h"
+
+namespace v8 {
+namespace internal {
+
+class HeapMethodCaller {
+ public:
+  explicit HeapMethodCaller(LocalHeapWrapper* heap) : heap_(heap) {}
+
+  ReadOnlySpace* read_only_space() {
+    return heap_->is_off_thread() ? heap_->off_thread()->read_only_space()
+                                  : heap_->main_thread()->read_only_space();
+  }
+
+  void OnAllocationEvent(HeapObject obj, int size) {
+    return heap_->is_off_thread()
+               ? heap_->off_thread()->OnAllocationEvent(obj, size)
+               : heap_->main_thread()->OnAllocationEvent(obj, size);
+  }
+
+  bool Contains(HeapObject obj) {
+    return heap_->is_off_thread() ? heap_->off_thread()->Contains(obj)
+                                  : heap_->main_thread()->Contains(obj);
+  }
+
+ private:
+  LocalHeapWrapper* heap_;
+};
+
+class LoggerMethodCaller {
+ public:
+  explicit LoggerMethodCaller(LocalLoggerWrapper* logger) : logger_(logger) {}
+
+  bool is_logging() const {
+    return logger_->is_off_thread() ? logger_->off_thread()->is_logging()
+                                    : logger_->main_thread()->is_logging();
+  }
+
+  void ScriptEvent(Logger::ScriptEventType type, int script_id) {
+    return logger_->is_off_thread()
+               ? logger_->off_thread()->ScriptEvent(type, script_id)
+               : logger_->main_thread()->ScriptEvent(type, script_id);
+  }
+  void ScriptDetails(Script script) {
+    return logger_->is_off_thread()
+               ? logger_->off_thread()->ScriptDetails(script)
+               : logger_->main_thread()->ScriptDetails(script);
+  }
+
+ private:
+  LocalLoggerWrapper* logger_;
+};
+
+class IsolateMethodCaller {
+ public:
+  explicit IsolateMethodCaller(LocalIsolateWrapper* isolate)
+      : isolate_(isolate) {}
+
+  LocalLoggerWrapper logger() {
+    return isolate_->is_off_thread()
+               ? LocalLoggerWrapper(isolate_->off_thread()->logger())
+               : LocalLoggerWrapper(isolate_->main_thread()->logger());
+  }
+
+  LocalHeapWrapper heap() {
+    return isolate_->is_off_thread()
+               ? LocalHeapWrapper(isolate_->off_thread()->heap())
+               : LocalHeapWrapper(isolate_->main_thread()->heap());
+  }
+
+  ReadOnlyHeap* read_only_heap() {
+    return isolate_->is_off_thread()
+               ? isolate_->off_thread()->read_only_heap()
+               : isolate_->main_thread()->read_only_heap();
+  }
+
+  Object root(RootIndex index) {
+    return isolate_->is_off_thread() ? isolate_->off_thread()->root(index)
+                                     : isolate_->main_thread()->root(index);
+  }
+
+  int GetNextScriptId() {
+    return isolate_->is_off_thread()
+               ? isolate_->off_thread()->GetNextScriptId()
+               : isolate_->main_thread()->GetNextScriptId();
+  }
+
+ private:
+  LocalIsolateWrapper* isolate_;
+};
+
+// Helper wrapper for HandleScope behaviour with a LocalIsolateWrapper.
+class LocalHandleScopeWrapper {
+ public:
+  explicit LocalHandleScopeWrapper(LocalIsolateWrapper local_isolate)
+      : is_off_thread_(local_isolate.is_off_thread()) {
+    if (is_off_thread_) {
+      new (off_thread()) OffThreadHandleScope(local_isolate.off_thread());
+    } else {
+      new (main_thread()) HandleScope(local_isolate.main_thread());
+    }
+  }
+  ~LocalHandleScopeWrapper() {
+    if (is_off_thread_) {
+      off_thread()->~OffThreadHandleScope();
+    } else {
+      main_thread()->~HandleScope();
+    }
+  }
+
+  template <typename T>
+  Handle<T> CloseAndEscape(Handle<T> handle) {
+    if (is_off_thread_) {
+      return off_thread()->CloseAndEscape(handle);
+    } else {
+      return main_thread()->CloseAndEscape(handle);
+    }
+  }
+
+ private:
+  HandleScope* main_thread() {
+    return reinterpret_cast<HandleScope*>(&scope_storage_);
+  }
+  OffThreadHandleScope* off_thread() {
+    return reinterpret_cast<OffThreadHandleScope*>(&scope_storage_);
+  }
+
+  std::aligned_union_t<0, HandleScope, OffThreadHandleScope> scope_storage_;
+  bool is_off_thread_;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_EXECUTION_LOCAL_ISOLATE_WRAPPER_INL_H_
diff --git a/deps/v8/src/execution/local-isolate-wrapper.h b/deps/v8/src/execution/local-isolate-wrapper.h
new file mode 100644
index 00000000000..8dbf0c23919
--- /dev/null
+++ b/deps/v8/src/execution/local-isolate-wrapper.h
@@ -0,0 +1,85 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_EXECUTION_LOCAL_ISOLATE_WRAPPER_H_
+#define V8_EXECUTION_LOCAL_ISOLATE_WRAPPER_H_
+
+#include "src/utils/pointer-with-payload.h"
+
+namespace v8 {
+namespace internal {
+
+// LocalWrapperBase is the base-class for wrapper classes around a main-thread
+// and off-thread type, e.g. Isolate and OffThreadIsolate, and a bit stating
+// which of the two the wrapper wraps.
+//
+// The shared methods are defined on MethodCaller, which will dispatch to the
+// right type depending on the state of the wrapper. The reason for a separate
+// MethodCaller is to
+//
+//   a) Move the method definitions into an -inl.h so that this header can have
+//      minimal dependencies, and
+//   b) To allow the type methods to be called with operator-> (e.g.
+//      isolate_wrapper->heap()), while forcing the wrapper methods to be called
+//      with a dot (e.g. isolate_wrapper.is_main_thread()).
+template <typename MainThreadType, typename OffThreadType,
+          typename MethodCaller>
+class LocalWrapperBase {
+ public:
+  // Helper for returning a MethodCaller* by value from operator->.
+  class MethodCallerRef {
+   public:
+    MethodCaller* operator->() { return &caller_; }
+
+   private:
+    friend class LocalWrapperBase;
+    explicit MethodCallerRef(LocalWrapperBase* wrapper) : caller_(wrapper) {}
+
+    MethodCaller caller_;
+  };
+
+  explicit LocalWrapperBase(std::nullptr_t) : pointer_and_tag_(nullptr) {}
+  explicit LocalWrapperBase(MainThreadType* pointer)
+      : pointer_and_tag_(pointer, false) {}
+  explicit LocalWrapperBase(OffThreadType* pointer)
+      : pointer_and_tag_(pointer, true) {}
+
+  MainThreadType* main_thread() {
+    DCHECK(is_main_thread());
+    return static_cast<MainThreadType*>(
+        pointer_and_tag_.GetPointerWithKnownPayload(false));
+  }
+  OffThreadType* off_thread() {
+    DCHECK(is_off_thread());
+    return static_cast<OffThreadType*>(
+        pointer_and_tag_.GetPointerWithKnownPayload(true));
+  }
+
+  bool is_main_thread() const {
+    return !is_null() && !pointer_and_tag_.GetPayload();
+  }
+  bool is_off_thread() const {
+    return !is_null() && pointer_and_tag_.GetPayload();
+  }
+  bool is_null() const { return pointer_and_tag_.GetPointer() == nullptr; }
+
+  // Access the methods via wrapper->Method.
+  MethodCallerRef operator->() { return MethodCallerRef(this); }
+
+ private:
+  PointerWithPayload<void, bool, 1> pointer_and_tag_;
+};
+
+using LocalHeapWrapper =
+    LocalWrapperBase<class Heap, class OffThreadHeap, class HeapMethodCaller>;
+using LocalLoggerWrapper = LocalWrapperBase<class Logger, class OffThreadLogger,
+                                            class LoggerMethodCaller>;
+using LocalIsolateWrapper =
+    LocalWrapperBase<class Isolate, class OffThreadIsolate,
+                     class IsolateMethodCaller>;
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_EXECUTION_LOCAL_ISOLATE_WRAPPER_H_
diff --git a/deps/v8/src/execution/messages.cc b/deps/v8/src/execution/messages.cc
index d1a76f654ca..5df2b65acc9 100644
--- a/deps/v8/src/execution/messages.cc
+++ b/deps/v8/src/execution/messages.cc
@@ -87,7 +87,7 @@ Handle<JSMessageObject> MessageHandler::MakeMessageObject(
   int bytecode_offset = -1;
   Handle<Script> script_handle = isolate->factory()->empty_script();
   Handle<SharedFunctionInfo> shared_info;
-  if (location != nullptr) {
+  if (location != nullptr && !FLAG_correctness_fuzzer_suppressions) {
     start = location->start_pos();
     end = location->end_pos();
     script_handle = location->script();
@@ -311,18 +311,18 @@ MaybeHandle<String> FormatEvalOrigin(Isolate* isolate, Handle<Script> script) {
 
 }  // namespace
 
-Handle<Object> StackFrameBase::GetEvalOrigin() {
+Handle<PrimitiveHeapObject> StackFrameBase::GetEvalOrigin() {
   if (!HasScript() || !IsEval()) return isolate_->factory()->undefined_value();
   return FormatEvalOrigin(isolate_, GetScript()).ToHandleChecked();
 }
 
-Handle<Object> StackFrameBase::GetWasmModuleName() {
+Handle<PrimitiveHeapObject> StackFrameBase::GetWasmModuleName() {
   return isolate_->factory()->undefined_value();
 }
 
 int StackFrameBase::GetWasmFunctionIndex() { return StackFrameBase::kNone; }
 
-Handle<Object> StackFrameBase::GetWasmInstance() {
+Handle<HeapObject> StackFrameBase::GetWasmInstance() {
   return isolate_->factory()->undefined_value();
 }
 
@@ -351,6 +351,7 @@ void JSStackFrame::FromFrameArray(Isolate* isolate, Handle<FrameArray> array,
   is_strict_ = (flags & FrameArray::kIsStrict) != 0;
   is_async_ = (flags & FrameArray::kIsAsync) != 0;
   is_promise_all_ = (flags & FrameArray::kIsPromiseAll) != 0;
+  is_promise_any_ = (flags & FrameArray::kIsPromiseAny) != 0;
 }
 
 JSStackFrame::JSStackFrame(Isolate* isolate, Handle<Object> receiver,
@@ -375,7 +376,7 @@ Handle<Object> JSStackFrame::GetFileName() {
   return handle(GetScript()->name(), isolate_);
 }
 
-Handle<Object> JSStackFrame::GetFunctionName() {
+Handle<PrimitiveHeapObject> JSStackFrame::GetFunctionName() {
   Handle<String> result = JSFunction::GetDebugName(function_);
   if (result->length() != 0) return result;
 
@@ -418,7 +419,7 @@ Handle<Object> JSStackFrame::GetScriptNameOrSourceUrl() {
   return ScriptNameOrSourceUrl(GetScript(), isolate_);
 }
 
-Handle<Object> JSStackFrame::GetMethodName() {
+Handle<PrimitiveHeapObject> JSStackFrame::GetMethodName() {
   if (receiver_->IsNullOrUndefined(isolate_)) {
     return isolate_->factory()->null_value();
   }
@@ -452,7 +453,7 @@ Handle<Object> JSStackFrame::GetMethodName() {
   }
 
   HandleScope outer_scope(isolate_);
-  Handle<Object> result;
+  Handle<PrimitiveHeapObject> result;
   for (PrototypeIterator iter(isolate_, receiver, kStartAtReceiver);
        !iter.IsAtEnd(); iter.Advance()) {
     Handle<Object> current = PrototypeIterator::GetCurrent(iter);
@@ -478,7 +479,7 @@ Handle<Object> JSStackFrame::GetMethodName() {
   return isolate_->factory()->null_value();
 }
 
-Handle<Object> JSStackFrame::GetTypeName() {
+Handle<PrimitiveHeapObject> JSStackFrame::GetTypeName() {
   // TODO(jgruber): Check for strict/constructor here as in
   // CallSitePrototypeGetThis.
 
@@ -514,7 +515,7 @@ int JSStackFrame::GetColumnNumber() {
 }
 
 int JSStackFrame::GetPromiseIndex() const {
-  return is_promise_all_ ? offset_ : kNone;
+  return (is_promise_all_ || is_promise_any_) ? offset_ : kNone;
 }
 
 bool JSStackFrame::IsNative() {
@@ -547,19 +548,14 @@ void WasmStackFrame::FromFrameArray(Isolate* isolate, Handle<FrameArray> array,
   // This function is called for compiled and interpreted wasm frames, and for
   // asm.js->wasm frames.
   DCHECK(array->IsWasmFrame(frame_ix) ||
-         array->IsWasmInterpretedFrame(frame_ix) ||
          array->IsAsmJsWasmFrame(frame_ix));
   isolate_ = isolate;
   wasm_instance_ = handle(array->WasmInstance(frame_ix), isolate);
   wasm_func_index_ = array->WasmFunctionIndex(frame_ix).value();
-  if (array->IsWasmInterpretedFrame(frame_ix)) {
-    code_ = nullptr;
-  } else {
-    // The {WasmCode*} is held alive by the {GlobalWasmCodeRef}.
-    auto global_wasm_code_ref =
-        Managed<wasm::GlobalWasmCodeRef>::cast(array->WasmCodeObject(frame_ix));
-    code_ = global_wasm_code_ref.get()->code();
-  }
+  // The {WasmCode*} is held alive by the {GlobalWasmCodeRef}.
+  auto global_wasm_code_ref =
+      Managed<wasm::GlobalWasmCodeRef>::cast(array->WasmCodeObject(frame_ix));
+  code_ = global_wasm_code_ref.get()->code();
   offset_ = array->Offset(frame_ix).value();
 }
 
@@ -569,8 +565,8 @@ Handle<Object> WasmStackFrame::GetFunction() const {
   return handle(Smi::FromInt(wasm_func_index_), isolate_);
 }
 
-Handle<Object> WasmStackFrame::GetFunctionName() {
-  Handle<Object> name;
+Handle<PrimitiveHeapObject> WasmStackFrame::GetFunctionName() {
+  Handle<PrimitiveHeapObject> name;
   Handle<WasmModuleObject> module_object(wasm_instance_->module_object(),
                                          isolate_);
   if (!WasmModuleObject::GetFunctionNameOrNull(isolate_, module_object,
@@ -587,8 +583,8 @@ Handle<Object> WasmStackFrame::GetScriptNameOrSourceUrl() {
   return ScriptNameOrSourceUrl(script, isolate_);
 }
 
-Handle<Object> WasmStackFrame::GetWasmModuleName() {
-  Handle<Object> module_name;
+Handle<PrimitiveHeapObject> WasmStackFrame::GetWasmModuleName() {
+  Handle<PrimitiveHeapObject> module_name;
   Handle<WasmModuleObject> module_object(wasm_instance_->module_object(),
                                          isolate_);
   if (!WasmModuleObject::GetModuleNameOrNull(isolate_, module_object)
@@ -598,13 +594,10 @@ Handle<Object> WasmStackFrame::GetWasmModuleName() {
   return module_name;
 }
 
-Handle<Object> WasmStackFrame::GetWasmInstance() { return wasm_instance_; }
+Handle<HeapObject> WasmStackFrame::GetWasmInstance() { return wasm_instance_; }
 
 int WasmStackFrame::GetPosition() const {
-  return IsInterpreted()
-             ? offset_
-             : FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
-                   code_, offset_);
+  return IsInterpreted() ? offset_ : code_->GetSourcePositionBefore(offset_);
 }
 
 int WasmStackFrame::GetColumnNumber() { return GetModuleOffset(); }
@@ -615,7 +608,9 @@ int WasmStackFrame::GetModuleOffset() const {
   return function_offset + GetPosition();
 }
 
-Handle<Object> WasmStackFrame::Null() const {
+Handle<Object> WasmStackFrame::GetFileName() { return Null(); }
+
+Handle<PrimitiveHeapObject> WasmStackFrame::Null() const {
   return isolate_->factory()->null_value();
 }
 
@@ -657,9 +652,7 @@ Handle<Object> AsmJsWasmStackFrame::GetScriptNameOrSourceUrl() {
 
 int AsmJsWasmStackFrame::GetPosition() const {
   DCHECK_LE(0, offset_);
-  int byte_offset =
-      FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(code_,
-                                                                    offset_);
+  int byte_offset = code_->GetSourcePositionBefore(offset_);
   const wasm::WasmModule* module = wasm_instance_->module();
   return GetSourcePosition(module, wasm_func_index_, byte_offset,
                            is_at_number_conversion_);
@@ -692,21 +685,15 @@ void FrameArrayIterator::Advance() { frame_ix_++; }
 StackFrameBase* FrameArrayIterator::Frame() {
   DCHECK(HasFrame());
   const int flags = array_->Flags(frame_ix_).value();
-  int flag_mask = FrameArray::kIsWasmCompiledFrame |
-                  FrameArray::kIsWasmInterpretedFrame |
-                  FrameArray::kIsAsmJsWasmFrame;
+  int flag_mask = FrameArray::kIsWasmFrame | FrameArray::kIsAsmJsWasmFrame;
   switch (flags & flag_mask) {
     case 0:
-      // JavaScript Frame.
       js_frame_.FromFrameArray(isolate_, array_, frame_ix_);
       return &js_frame_;
-    case FrameArray::kIsWasmCompiledFrame:
-    case FrameArray::kIsWasmInterpretedFrame:
-      // Wasm Frame:
+    case FrameArray::kIsWasmFrame:
       wasm_frame_.FromFrameArray(isolate_, array_, frame_ix_);
       return &wasm_frame_;
     case FrameArray::kIsAsmJsWasmFrame:
-      // Asm.js Wasm Frame:
       asm_wasm_frame_.FromFrameArray(isolate_, array_, frame_ix_);
       return &asm_wasm_frame_;
     default:
@@ -930,12 +917,25 @@ MaybeHandle<Object> ErrorUtils::FormatStackTrace(Isolate* isolate,
 }
 
 Handle<String> MessageFormatter::Format(Isolate* isolate, MessageTemplate index,
-                                        Handle<Object> arg) {
+                                        Handle<Object> arg0,
+                                        Handle<Object> arg1,
+                                        Handle<Object> arg2) {
   Factory* factory = isolate->factory();
-  Handle<String> result_string = Object::NoSideEffectsToString(isolate, arg);
+  Handle<String> arg0_string = factory->empty_string();
+  if (!arg0.is_null()) {
+    arg0_string = Object::NoSideEffectsToString(isolate, arg0);
+  }
+  Handle<String> arg1_string = factory->empty_string();
+  if (!arg1.is_null()) {
+    arg1_string = Object::NoSideEffectsToString(isolate, arg1);
+  }
+  Handle<String> arg2_string = factory->empty_string();
+  if (!arg2.is_null()) {
+    arg2_string = Object::NoSideEffectsToString(isolate, arg2);
+  }
   MaybeHandle<String> maybe_result_string = MessageFormatter::Format(
-      isolate, index, result_string, factory->empty_string(),
-      factory->empty_string());
+      isolate, index, arg0_string, arg1_string, arg2_string);
+  Handle<String> result_string;
   if (!maybe_result_string.ToHandle(&result_string)) {
     DCHECK(isolate->has_pending_exception());
     isolate->clear_pending_exception();
@@ -996,6 +996,26 @@ MaybeHandle<String> MessageFormatter::Format(Isolate* isolate,
   return builder.Finish();
 }
 
+MaybeHandle<JSObject> ErrorUtils::Construct(Isolate* isolate,
+                                            Handle<JSFunction> target,
+                                            Handle<Object> new_target,
+                                            Handle<Object> message) {
+  FrameSkipMode mode = SKIP_FIRST;
+  Handle<Object> caller;
+
+  // When we're passed a JSFunction as new target, we can skip frames until that
+  // specific function is seen instead of unconditionally skipping the first
+  // frame.
+  if (new_target->IsJSFunction()) {
+    mode = SKIP_UNTIL_SEEN;
+    caller = new_target;
+  }
+
+  return ErrorUtils::Construct(isolate, target, new_target, message, mode,
+                               caller,
+                               ErrorUtils::StackTraceCollection::kDetailed);
+}
+
 MaybeHandle<JSObject> ErrorUtils::Construct(
     Isolate* isolate, Handle<JSFunction> target, Handle<Object> new_target,
     Handle<Object> message, FrameSkipMode mode, Handle<Object> caller,
@@ -1237,7 +1257,10 @@ Handle<String> RenderCallSite(Isolate* isolate, Handle<Object> object,
                               MessageLocation* location,
                               CallPrinter::ErrorHint* hint) {
   if (ComputeLocation(isolate, location)) {
-    ParseInfo info(isolate, *location->shared());
+    UnoptimizedCompileFlags flags = UnoptimizedCompileFlags::ForFunctionCompile(
+        isolate, *location->shared());
+    UnoptimizedCompileState compile_state(isolate);
+    ParseInfo info(isolate, flags, &compile_state);
     if (parsing::ParseAny(&info, location->shared(), isolate)) {
       info.ast_value_factory()->Internalize(isolate);
       CallPrinter printer(isolate, location->shared()->IsUserJavaScript());
@@ -1290,12 +1313,15 @@ Handle<Object> ErrorUtils::NewIteratorError(Isolate* isolate,
   return isolate->factory()->NewTypeError(id, callsite);
 }
 
-Object ErrorUtils::ThrowSpreadArgIsNullOrUndefinedError(Isolate* isolate,
-                                                        Handle<Object> object) {
+Object ErrorUtils::ThrowSpreadArgError(Isolate* isolate, MessageTemplate id,
+                                       Handle<Object> object) {
   MessageLocation location;
   Handle<String> callsite;
   if (ComputeLocation(isolate, &location)) {
-    ParseInfo info(isolate, *location.shared());
+    UnoptimizedCompileFlags flags = UnoptimizedCompileFlags::ForFunctionCompile(
+        isolate, *location.shared());
+    UnoptimizedCompileState compile_state(isolate);
+    ParseInfo info(isolate, flags, &compile_state);
     if (parsing::ParseAny(&info, location.shared(), isolate)) {
       info.ast_value_factory()->Internalize(isolate);
       CallPrinter printer(isolate, location.shared()->IsUserJavaScript(),
@@ -1316,7 +1342,6 @@ Object ErrorUtils::ThrowSpreadArgIsNullOrUndefinedError(Isolate* isolate,
     }
   }
 
-  MessageTemplate id = MessageTemplate::kNotIterableNoSymbolLoad;
   Handle<Object> exception =
       isolate->factory()->NewTypeError(id, callsite, object);
   return isolate->Throw(*exception, &location);
@@ -1370,7 +1395,10 @@ Object ErrorUtils::ThrowLoadFromNullOrUndefined(Isolate* isolate,
   if (ComputeLocation(isolate, &location)) {
     location_computed = true;
 
-    ParseInfo info(isolate, *location.shared());
+    UnoptimizedCompileFlags flags = UnoptimizedCompileFlags::ForFunctionCompile(
+        isolate, *location.shared());
+    UnoptimizedCompileState compile_state(isolate);
+    ParseInfo info(isolate, flags, &compile_state);
     if (parsing::ParseAny(&info, location.shared(), isolate)) {
       info.ast_value_factory()->Internalize(isolate);
       CallPrinter printer(isolate, location.shared()->IsUserJavaScript());
diff --git a/deps/v8/src/execution/messages.h b/deps/v8/src/execution/messages.h
index cf54cac8526..fbcc7310bc7 100644
--- a/deps/v8/src/execution/messages.h
+++ b/deps/v8/src/execution/messages.h
@@ -27,6 +27,7 @@ class AbstractCode;
 class FrameArray;
 class JSMessageObject;
 class LookupIterator;
+class PrimitiveHeapObject;
 class SharedFunctionInfo;
 class SourceInfo;
 class WasmInstanceObject;
@@ -67,13 +68,13 @@ class StackFrameBase {
   virtual Handle<Object> GetFunction() const = 0;
 
   virtual Handle<Object> GetFileName() = 0;
-  virtual Handle<Object> GetFunctionName() = 0;
+  virtual Handle<PrimitiveHeapObject> GetFunctionName() = 0;
   virtual Handle<Object> GetScriptNameOrSourceUrl() = 0;
-  virtual Handle<Object> GetMethodName() = 0;
-  virtual Handle<Object> GetTypeName() = 0;
-  virtual Handle<Object> GetEvalOrigin();
-  virtual Handle<Object> GetWasmModuleName();
-  virtual Handle<Object> GetWasmInstance();
+  virtual Handle<PrimitiveHeapObject> GetMethodName() = 0;
+  virtual Handle<PrimitiveHeapObject> GetTypeName() = 0;
+  virtual Handle<PrimitiveHeapObject> GetEvalOrigin();
+  virtual Handle<PrimitiveHeapObject> GetWasmModuleName();
+  virtual Handle<HeapObject> GetWasmInstance();
 
   // Returns the script ID if one is attached, -1 otherwise.
   int GetScriptId() const;
@@ -86,7 +87,8 @@ class StackFrameBase {
   // Return 0-based Wasm function index. Returns -1 for non-Wasm frames.
   virtual int GetWasmFunctionIndex();
 
-  // Returns index for Promise.all() async frames, or -1 for other frames.
+  // Returns the index of the rejected promise in the Promise combinator input,
+  // or -1 if this frame is not a Promise combinator frame.
   virtual int GetPromiseIndex() const = 0;
 
   virtual bool IsNative() = 0;
@@ -94,6 +96,7 @@ class StackFrameBase {
   virtual bool IsEval();
   virtual bool IsAsync() const = 0;
   virtual bool IsPromiseAll() const = 0;
+  virtual bool IsPromiseAny() const = 0;
   virtual bool IsConstructor() = 0;
   virtual bool IsStrict() const = 0;
 
@@ -121,10 +124,10 @@ class JSStackFrame : public StackFrameBase {
   Handle<Object> GetFunction() const override;
 
   Handle<Object> GetFileName() override;
-  Handle<Object> GetFunctionName() override;
+  Handle<PrimitiveHeapObject> GetFunctionName() override;
   Handle<Object> GetScriptNameOrSourceUrl() override;
-  Handle<Object> GetMethodName() override;
-  Handle<Object> GetTypeName() override;
+  Handle<PrimitiveHeapObject> GetMethodName() override;
+  Handle<PrimitiveHeapObject> GetTypeName() override;
 
   int GetPosition() const override;
   int GetLineNumber() override;
@@ -136,6 +139,7 @@ class JSStackFrame : public StackFrameBase {
   bool IsToplevel() override;
   bool IsAsync() const override { return is_async_; }
   bool IsPromiseAll() const override { return is_promise_all_; }
+  bool IsPromiseAny() const override { return is_promise_any_; }
   bool IsConstructor() override { return is_constructor_; }
   bool IsStrict() const override { return is_strict_; }
 
@@ -155,6 +159,7 @@ class JSStackFrame : public StackFrameBase {
   bool is_async_ : 1;
   bool is_constructor_ : 1;
   bool is_promise_all_ : 1;
+  bool is_promise_any_ : 1;
   bool is_strict_ : 1;
 
   friend class FrameArrayIterator;
@@ -167,13 +172,13 @@ class WasmStackFrame : public StackFrameBase {
   Handle<Object> GetReceiver() const override;
   Handle<Object> GetFunction() const override;
 
-  Handle<Object> GetFileName() override { return Null(); }
-  Handle<Object> GetFunctionName() override;
+  Handle<Object> GetFileName() override;
+  Handle<PrimitiveHeapObject> GetFunctionName() override;
   Handle<Object> GetScriptNameOrSourceUrl() override;
-  Handle<Object> GetMethodName() override { return Null(); }
-  Handle<Object> GetTypeName() override { return Null(); }
-  Handle<Object> GetWasmModuleName() override;
-  Handle<Object> GetWasmInstance() override;
+  Handle<PrimitiveHeapObject> GetMethodName() override { return Null(); }
+  Handle<PrimitiveHeapObject> GetTypeName() override { return Null(); }
+  Handle<PrimitiveHeapObject> GetWasmModuleName() override;
+  Handle<HeapObject> GetWasmInstance() override;
 
   int GetPosition() const override;
   int GetLineNumber() override { return 0; }
@@ -186,12 +191,13 @@ class WasmStackFrame : public StackFrameBase {
   bool IsToplevel() override { return false; }
   bool IsAsync() const override { return false; }
   bool IsPromiseAll() const override { return false; }
+  bool IsPromiseAny() const override { return false; }
   bool IsConstructor() override { return false; }
   bool IsStrict() const override { return false; }
   bool IsInterpreted() const { return code_ == nullptr; }
 
  protected:
-  Handle<Object> Null() const;
+  Handle<PrimitiveHeapObject> Null() const;
 
   bool HasScript() const override;
   Handle<Script> GetScript() const override;
@@ -269,6 +275,10 @@ class ErrorUtils : public AllStatic {
   // |kNone| is useful when you don't need the stack information at all, for
   // example when creating a deserialized error.
   enum class StackTraceCollection { kDetailed, kSimple, kNone };
+  static MaybeHandle<JSObject> Construct(Isolate* isolate,
+                                         Handle<JSFunction> target,
+                                         Handle<Object> new_target,
+                                         Handle<Object> message);
   static MaybeHandle<JSObject> Construct(
       Isolate* isolate, Handle<JSFunction> target, Handle<Object> new_target,
       Handle<Object> message, FrameSkipMode mode, Handle<Object> caller,
@@ -293,8 +303,8 @@ class ErrorUtils : public AllStatic {
                                                   Handle<Object> source);
   static Handle<Object> NewConstructedNonConstructable(Isolate* isolate,
                                                        Handle<Object> source);
-  static Object ThrowSpreadArgIsNullOrUndefinedError(Isolate* isolate,
-                                                     Handle<Object> object);
+  static Object ThrowSpreadArgError(Isolate* isolate, MessageTemplate id,
+                                    Handle<Object> object);
   static Object ThrowLoadFromNullOrUndefined(Isolate* isolate,
                                              Handle<Object> object);
   static Object ThrowLoadFromNullOrUndefined(Isolate* isolate,
@@ -313,7 +323,9 @@ class MessageFormatter {
                                                       Handle<String> arg2);
 
   static Handle<String> Format(Isolate* isolate, MessageTemplate index,
-                               Handle<Object> arg);
+                               Handle<Object> arg0,
+                               Handle<Object> arg1 = Handle<Object>(),
+                               Handle<Object> arg2 = Handle<Object>());
 };
 
 // A message handler is a convenience interface for accessing the list
diff --git a/deps/v8/src/execution/microtask-queue.h b/deps/v8/src/execution/microtask-queue.h
index 4ce1498279c..82840c2bed5 100644
--- a/deps/v8/src/execution/microtask-queue.h
+++ b/deps/v8/src/execution/microtask-queue.h
@@ -26,7 +26,7 @@ class V8_EXPORT_PRIVATE MicrotaskQueue final : public v8::MicrotaskQueue {
   static void SetUpDefaultMicrotaskQueue(Isolate* isolate);
   static std::unique_ptr<MicrotaskQueue> New(Isolate* isolate);
 
-  ~MicrotaskQueue();
+  ~MicrotaskQueue() override;
 
   // Uses raw Address values because it's called via ExternalReference.
   // {raw_microtask} is a tagged Microtask pointer.
diff --git a/deps/v8/src/execution/off-thread-isolate-inl.h b/deps/v8/src/execution/off-thread-isolate-inl.h
new file mode 100644
index 00000000000..9e82ad9b73b
--- /dev/null
+++ b/deps/v8/src/execution/off-thread-isolate-inl.h
@@ -0,0 +1,30 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_EXECUTION_OFF_THREAD_ISOLATE_INL_H_
+#define V8_EXECUTION_OFF_THREAD_ISOLATE_INL_H_
+
+#include "src/execution/isolate.h"
+#include "src/execution/off-thread-isolate.h"
+#include "src/roots/roots-inl.h"
+
+namespace v8 {
+namespace internal {
+
+Address OffThreadIsolate::isolate_root() const {
+  return isolate_->isolate_root();
+}
+ReadOnlyHeap* OffThreadIsolate::read_only_heap() {
+  return isolate_->read_only_heap();
+}
+
+Object OffThreadIsolate::root(RootIndex index) {
+  DCHECK(RootsTable::IsImmortalImmovable(index));
+  return isolate_->root(index);
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_EXECUTION_OFF_THREAD_ISOLATE_INL_H_
diff --git a/deps/v8/src/execution/off-thread-isolate.cc b/deps/v8/src/execution/off-thread-isolate.cc
index c08d51d7b47..08675493723 100644
--- a/deps/v8/src/execution/off-thread-isolate.cc
+++ b/deps/v8/src/execution/off-thread-isolate.cc
@@ -6,17 +6,34 @@
 
 #include "src/execution/isolate.h"
 #include "src/execution/thread-id.h"
+#include "src/handles/handles-inl.h"
+#include "src/handles/off-thread-transfer-handle-storage-inl.h"
 #include "src/logging/off-thread-logger.h"
 
 namespace v8 {
 namespace internal {
 
+Address* OffThreadTransferHandleBase::ToHandleLocation() const {
+  return storage_ == nullptr ? nullptr : storage_->handle_location();
+}
+
 OffThreadIsolate::OffThreadIsolate(Isolate* isolate, Zone* zone)
     : HiddenOffThreadFactory(isolate),
+      heap_(isolate->heap()),
       isolate_(isolate),
       logger_(new OffThreadLogger()),
       handle_zone_(zone) {}
-OffThreadIsolate::~OffThreadIsolate() { delete logger_; }
+
+OffThreadIsolate::~OffThreadIsolate() = default;
+
+void OffThreadIsolate::FinishOffThread() {
+  heap()->FinishOffThread();
+  handle_zone_ = nullptr;
+}
+
+void OffThreadIsolate::Publish(Isolate* isolate) {
+  heap()->Publish(isolate->heap());
+}
 
 int OffThreadIsolate::GetNextScriptId() { return isolate_->GetNextScriptId(); }
 
@@ -26,11 +43,6 @@ int OffThreadIsolate::GetNextUniqueSharedFunctionInfoId() {
 }
 #endif  // V8_SFI_HAS_UNIQUE_ID
 
-bool OffThreadIsolate::NeedsSourcePositionsForProfiling() {
-  // TODO(leszeks): Figure out if it makes sense to check this asynchronously.
-  return isolate_->NeedsSourcePositionsForProfiling();
-}
-
 bool OffThreadIsolate::is_collecting_type_profile() {
   // TODO(leszeks): Figure out if it makes sense to check this asynchronously.
   return isolate_->is_collecting_type_profile();
diff --git a/deps/v8/src/execution/off-thread-isolate.h b/deps/v8/src/execution/off-thread-isolate.h
index 9a75c328591..ecb03d7ebf7 100644
--- a/deps/v8/src/execution/off-thread-isolate.h
+++ b/deps/v8/src/execution/off-thread-isolate.h
@@ -5,16 +5,58 @@
 #ifndef V8_EXECUTION_OFF_THREAD_ISOLATE_H_
 #define V8_EXECUTION_OFF_THREAD_ISOLATE_H_
 
-#include "src/base/logging.h"
+#include "src/base/macros.h"
 #include "src/execution/thread-id.h"
 #include "src/handles/handles.h"
+#include "src/handles/maybe-handles.h"
 #include "src/heap/off-thread-factory.h"
+#include "src/heap/off-thread-heap.h"
+#include "src/handles/off-thread-transfer-handle-storage.h"
 
 namespace v8 {
 namespace internal {
 
 class Isolate;
 class OffThreadLogger;
+class OffThreadTransferHandleStorage;
+
+class OffThreadTransferHandleBase {
+ protected:
+  explicit OffThreadTransferHandleBase(OffThreadTransferHandleStorage* storage)
+      : storage_(storage) {}
+
+  V8_EXPORT_PRIVATE Address* ToHandleLocation() const;
+
+ private:
+  OffThreadTransferHandleStorage* storage_;
+};
+
+// Helper class for transferring ownership of an off-thread allocated object's
+// handler to the main thread. OffThreadTransferHandles should be created before
+// the OffThreadIsolate is finished, and can be accessed as a Handle after the
+// OffThreadIsolate is published.
+template <typename T>
+class OffThreadTransferHandle : public OffThreadTransferHandleBase {
+ public:
+  OffThreadTransferHandle() : OffThreadTransferHandleBase(nullptr) {}
+  explicit OffThreadTransferHandle(OffThreadTransferHandleStorage* storage)
+      : OffThreadTransferHandleBase(storage) {}
+
+  Handle<T> ToHandle() const { return Handle<T>(ToHandleLocation()); }
+};
+
+template <typename T>
+class OffThreadTransferMaybeHandle : public OffThreadTransferHandleBase {
+ public:
+  OffThreadTransferMaybeHandle() : OffThreadTransferHandleBase(nullptr) {}
+  explicit OffThreadTransferMaybeHandle(OffThreadTransferHandleStorage* storage)
+      : OffThreadTransferHandleBase(storage) {}
+
+  MaybeHandle<T> ToHandle() const {
+    Address* location = ToHandleLocation();
+    return location ? Handle<T>(location) : MaybeHandle<T>();
+  }
+};
 
 // HiddenOffThreadFactory parallels Isolate's HiddenFactory
 class V8_EXPORT_PRIVATE HiddenOffThreadFactory : private OffThreadFactory {
@@ -37,6 +79,17 @@ class V8_EXPORT_PRIVATE OffThreadIsolate final
   explicit OffThreadIsolate(Isolate* isolate, Zone* zone);
   ~OffThreadIsolate();
 
+  static OffThreadIsolate* FromHeap(OffThreadHeap* heap) {
+    return reinterpret_cast<OffThreadIsolate*>(
+        reinterpret_cast<Address>(heap) - OFFSET_OF(OffThreadIsolate, heap_));
+  }
+
+  OffThreadHeap* heap() { return &heap_; }
+
+  inline Address isolate_root() const;
+  inline ReadOnlyHeap* read_only_heap();
+  inline Object root(RootIndex index);
+
   v8::internal::OffThreadFactory* factory() {
     // Upcast to the privately inherited base-class using c-style casts to avoid
     // undefined behavior (as static_cast cannot cast across private bases).
@@ -47,10 +100,15 @@ class V8_EXPORT_PRIVATE OffThreadIsolate final
 
   // This method finishes the use of the off-thread Isolate, and can be safely
   // called off-thread.
-  void FinishOffThread() {
-    factory()->FinishOffThread();
-    handle_zone_ = nullptr;
-  }
+  void FinishOffThread();
+
+  // This method publishes the off-thread Isolate to the main-thread Isolate,
+  // moving all off-thread allocated objects to be visible to the GC, and fixing
+  // up any other state (e.g. internalized strings). This method must be called
+  // on the main thread.
+  void Publish(Isolate* isolate);
+
+  bool has_pending_exception() const { return false; }
 
   template <typename T>
   Handle<T> Throw(Handle<Object> exception) {
@@ -68,15 +126,34 @@ class V8_EXPORT_PRIVATE OffThreadIsolate final
     return location;
   }
 
+  template <typename T>
+  OffThreadTransferHandle<T> TransferHandle(Handle<T> handle) {
+    DCHECK_NOT_NULL(handle_zone_);
+    if (handle.is_null()) {
+      return OffThreadTransferHandle<T>();
+    }
+    return OffThreadTransferHandle<T>(heap()->AddTransferHandleStorage(handle));
+  }
+
+  template <typename T>
+  OffThreadTransferMaybeHandle<T> TransferHandle(MaybeHandle<T> maybe_handle) {
+    DCHECK_NOT_NULL(handle_zone_);
+    Handle<T> handle;
+    if (!maybe_handle.ToHandle(&handle)) {
+      return OffThreadTransferMaybeHandle<T>();
+    }
+    return OffThreadTransferMaybeHandle<T>(
+        heap()->AddTransferHandleStorage(handle));
+  }
+
   int GetNextScriptId();
 #if V8_SFI_HAS_UNIQUE_ID
   int GetNextUniqueSharedFunctionInfoId();
 #endif  // V8_SFI_HAS_UNIQUE_ID
 
-  bool NeedsSourcePositionsForProfiling();
   bool is_collecting_type_profile();
 
-  OffThreadLogger* logger() { return logger_; }
+  OffThreadLogger* logger() { return logger_.get(); }
 
   void PinToCurrentThread();
   ThreadId thread_id() { return thread_id_; }
@@ -84,11 +161,13 @@ class V8_EXPORT_PRIVATE OffThreadIsolate final
  private:
   friend class v8::internal::OffThreadFactory;
 
+  OffThreadHeap heap_;
+
   // TODO(leszeks): Extract out the fields of the Isolate we want and store
   // those instead of the whole thing.
   Isolate* isolate_;
 
-  OffThreadLogger* logger_;
+  std::unique_ptr<OffThreadLogger> logger_;
   ThreadId thread_id_;
   Zone* handle_zone_;
 };
diff --git a/deps/v8/src/execution/ppc/frame-constants-ppc.h b/deps/v8/src/execution/ppc/frame-constants-ppc.h
index 47f3b9e410e..24ef5850310 100644
--- a/deps/v8/src/execution/ppc/frame-constants-ppc.h
+++ b/deps/v8/src/execution/ppc/frame-constants-ppc.h
@@ -15,7 +15,7 @@ namespace internal {
 class EntryFrameConstants : public AllStatic {
  public:
   static constexpr int kCallerFPOffset =
-      -(StandardFrameConstants::kFixedFrameSizeFromFp + kPointerSize);
+      -(StandardFrameConstants::kFixedFrameSizeFromFp + kSystemPointerSize);
 };
 
 class WasmCompileLazyFrameConstants : public TypedFrameConstants {
@@ -27,7 +27,7 @@ class WasmCompileLazyFrameConstants : public TypedFrameConstants {
   static constexpr int kWasmInstanceOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
   static constexpr int kFixedFrameSizeFromFp =
       TypedFrameConstants::kFixedFrameSizeFromFp +
-      kNumberOfSavedGpParamRegs * kPointerSize +
+      kNumberOfSavedGpParamRegs * kSystemPointerSize +
       kNumberOfSavedFpParamRegs * kDoubleSize;
 };
 
diff --git a/deps/v8/src/execution/ppc/simulator-ppc.cc b/deps/v8/src/execution/ppc/simulator-ppc.cc
index 2a9aa6486be..a0da6dd6342 100644
--- a/deps/v8/src/execution/ppc/simulator-ppc.cc
+++ b/deps/v8/src/execution/ppc/simulator-ppc.cc
@@ -481,7 +481,7 @@ void PPCDebugger::Debug() {
         PrintF("FPSCR: %08x\n", sim_->fp_condition_reg_);
       } else if (strcmp(cmd, "stop") == 0) {
         intptr_t value;
-        intptr_t stop_pc = sim_->get_pc() - (kInstrSize + kPointerSize);
+        intptr_t stop_pc = sim_->get_pc() - (kInstrSize + kSystemPointerSize);
         Instruction* stop_instr = reinterpret_cast<Instruction*>(stop_pc);
         Instruction* msg_address =
             reinterpret_cast<Instruction*>(stop_pc + kInstrSize);
@@ -1230,7 +1230,7 @@ void Simulator::SoftwareInterrupt(Instruction* instr) {
           }
           DebugAtNextPC();
         } else {
-          set_pc(get_pc() + kInstrSize + kPointerSize);
+          set_pc(get_pc() + kInstrSize + kSystemPointerSize);
         }
       } else {
         // This is not a valid svc code.
diff --git a/deps/v8/src/execution/ppc/simulator-ppc.h b/deps/v8/src/execution/ppc/simulator-ppc.h
index 76f836b1965..acdf7c290be 100644
--- a/deps/v8/src/execution/ppc/simulator-ppc.h
+++ b/deps/v8/src/execution/ppc/simulator-ppc.h
@@ -344,7 +344,7 @@ class Simulator : public SimulatorBase {
 
   // Simulator support.
   char* stack_;
-  static const size_t stack_protection_size_ = 256 * kPointerSize;
+  static const size_t stack_protection_size_ = 256 * kSystemPointerSize;
   bool pc_modified_;
   int icount_;
 
diff --git a/deps/v8/src/execution/protectors-inl.h b/deps/v8/src/execution/protectors-inl.h
index b2428063e1e..8fe8bed107c 100644
--- a/deps/v8/src/execution/protectors-inl.h
+++ b/deps/v8/src/execution/protectors-inl.h
@@ -13,14 +13,6 @@
 namespace v8 {
 namespace internal {
 
-#define DEFINE_PROTECTOR_ON_NATIVE_CONTEXT_CHECK(name, cell)                \
-  bool Protectors::Is##name##Intact(Handle<NativeContext> native_context) { \
-    PropertyCell species_cell = native_context->cell();                     \
-    return species_cell.value().IsSmi() &&                                  \
-           Smi::ToInt(species_cell.value()) == kProtectorValid;             \
-  }
-DECLARED_PROTECTORS_ON_NATIVE_CONTEXT(DEFINE_PROTECTOR_ON_NATIVE_CONTEXT_CHECK)
-
 #define DEFINE_PROTECTOR_ON_ISOLATE_CHECK(name, root_index, unused_cell) \
   bool Protectors::Is##name##Intact(Isolate* isolate) {                  \
     PropertyCell cell =                                                  \
@@ -29,6 +21,7 @@ DECLARED_PROTECTORS_ON_NATIVE_CONTEXT(DEFINE_PROTECTOR_ON_NATIVE_CONTEXT_CHECK)
            Smi::ToInt(cell.value()) == kProtectorValid;                  \
   }
 DECLARED_PROTECTORS_ON_ISOLATE(DEFINE_PROTECTOR_ON_ISOLATE_CHECK)
+#undef DEFINE_PROTECTORS_ON_ISOLATE_CHECK
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/execution/protectors.cc b/deps/v8/src/execution/protectors.cc
index c8ba05a8f91..9d3afd1ded9 100644
--- a/deps/v8/src/execution/protectors.cc
+++ b/deps/v8/src/execution/protectors.cc
@@ -17,6 +17,7 @@ namespace v8 {
 namespace internal {
 
 namespace {
+
 void TraceProtectorInvalidation(const char* protector_name) {
   DCHECK(FLAG_trace_protector_invalidation);
   static constexpr char kInvalidateProtectorTracingCategory[] =
@@ -26,30 +27,23 @@ void TraceProtectorInvalidation(const char* protector_name) {
   DCHECK(FLAG_trace_protector_invalidation);
 
   // TODO(jgruber): Remove the PrintF once tracing can output to stdout.
-  i::PrintF("Invalidating protector cell %s", protector_name);
+  i::PrintF("Invalidating protector cell %s\n", protector_name);
   TRACE_EVENT_INSTANT1("v8", kInvalidateProtectorTracingCategory,
                        TRACE_EVENT_SCOPE_THREAD, kInvalidateProtectorTracingArg,
                        protector_name);
 }
-}  // namespace
 
-#define INVALIDATE_PROTECTOR_ON_NATIVE_CONTEXT_DEFINITION(name, cell)       \
-  void Protectors::Invalidate##name(Isolate* isolate,                       \
-                                    Handle<NativeContext> native_context) { \
-    DCHECK(native_context->cell().value().IsSmi());                         \
-    DCHECK(Is##name##Intact(native_context));                               \
-    if (FLAG_trace_protector_invalidation) {                                \
-      TraceProtectorInvalidation(#name);                                    \
-    }                                                                       \
-    Handle<PropertyCell> species_cell(native_context->cell(), isolate);     \
-    PropertyCell::SetValueWithInvalidation(                                 \
-        isolate, #cell, species_cell,                                       \
-        handle(Smi::FromInt(kProtectorInvalid), isolate));                  \
-    DCHECK(!Is##name##Intact(native_context));                              \
-  }
-DECLARED_PROTECTORS_ON_NATIVE_CONTEXT(
-    INVALIDATE_PROTECTOR_ON_NATIVE_CONTEXT_DEFINITION)
-#undef INVALIDATE_PROTECTOR_ON_NATIVE_CONTEXT_DEFINITION
+// Static asserts to ensure we have a use counter for every protector. If this
+// fails, add the use counter in V8 and chromium. Note: IsDefined is not
+// strictly needed but clarifies the intent of the static assert.
+constexpr bool IsDefined(v8::Isolate::UseCounterFeature) { return true; }
+#define V(Name, ...) \
+  STATIC_ASSERT(IsDefined(v8::Isolate::kInvalidated##Name##Protector));
+
+DECLARED_PROTECTORS_ON_ISOLATE(V)
+#undef V
+
+}  // namespace
 
 #define INVALIDATE_PROTECTOR_ON_ISOLATE_DEFINITION(name, unused_index, cell) \
   void Protectors::Invalidate##name(Isolate* isolate) {                      \
@@ -58,6 +52,7 @@ DECLARED_PROTECTORS_ON_NATIVE_CONTEXT(
     if (FLAG_trace_protector_invalidation) {                                 \
       TraceProtectorInvalidation(#name);                                     \
     }                                                                        \
+    isolate->CountUsage(v8::Isolate::kInvalidated##name##Protector);         \
     PropertyCell::SetValueWithInvalidation(                                  \
         isolate, #cell, isolate->factory()->cell(),                          \
         handle(Smi::FromInt(kProtectorInvalid), isolate));                   \
diff --git a/deps/v8/src/execution/protectors.h b/deps/v8/src/execution/protectors.h
index 4601f16cf01..c4ca49d948a 100644
--- a/deps/v8/src/execution/protectors.h
+++ b/deps/v8/src/execution/protectors.h
@@ -15,9 +15,6 @@ class Protectors : public AllStatic {
   static const int kProtectorValid = 1;
   static const int kProtectorInvalid = 0;
 
-#define DECLARED_PROTECTORS_ON_NATIVE_CONTEXT(V) \
-  V(RegExpSpeciesLookupChainProtector, regexp_species_protector)
-
 #define DECLARED_PROTECTORS_ON_ISOLATE(V)                                     \
   V(ArrayBufferDetaching, ArrayBufferDetachingProtector,                      \
     array_buffer_detaching_protector)                                         \
@@ -41,6 +38,8 @@ class Protectors : public AllStatic {
   /*   property holder is the %IteratorPrototype%. Note that this also     */ \
   /*   invalidates the SetIterator protector (see below).                  */ \
   V(MapIteratorLookupChain, MapIteratorProtector, map_iterator_protector)     \
+  V(RegExpSpeciesLookupChain, RegExpSpeciesProtector,                         \
+    regexp_species_protector)                                                 \
   V(PromiseHook, PromiseHookProtector, promise_hook_protector)                \
   V(PromiseThenLookupChain, PromiseThenProtector, promise_then_protector)     \
   V(PromiseResolveLookupChain, PromiseResolveProtector,                       \
@@ -82,19 +81,9 @@ class Protectors : public AllStatic {
   V(TypedArraySpeciesLookupChain, TypedArraySpeciesProtector,                 \
     typed_array_species_protector)
 
-#define DECLARE_PROTECTOR_ON_NATIVE_CONTEXT(name, unused_cell) \
-  V8_EXPORT_PRIVATE static inline bool Is##name##Intact(       \
-      Handle<NativeContext> native_context);                   \
-  V8_EXPORT_PRIVATE static void Invalidate##name(              \
-      Isolate* isolate, Handle<NativeContext> native_context);
-
-  DECLARED_PROTECTORS_ON_NATIVE_CONTEXT(DECLARE_PROTECTOR_ON_NATIVE_CONTEXT)
-#undef DECLARE_PROTECTOR_ON_NATIVE_CONTEXT
-
 #define DECLARE_PROTECTOR_ON_ISOLATE(name, unused_root_index, unused_cell) \
   V8_EXPORT_PRIVATE static inline bool Is##name##Intact(Isolate* isolate); \
   V8_EXPORT_PRIVATE static void Invalidate##name(Isolate* isolate);
-
   DECLARED_PROTECTORS_ON_ISOLATE(DECLARE_PROTECTOR_ON_ISOLATE)
 #undef DECLARE_PROTECTOR_ON_ISOLATE
 };
diff --git a/deps/v8/src/execution/s390/simulator-s390.cc b/deps/v8/src/execution/s390/simulator-s390.cc
index f41288f6a96..0f74168ffe5 100644
--- a/deps/v8/src/execution/s390/simulator-s390.cc
+++ b/deps/v8/src/execution/s390/simulator-s390.cc
@@ -785,9 +785,10 @@ void Simulator::EvalTableInit() {
   V(vlc, VLC, 0xE7DE)     /* type = VRR_A VECTOR LOAD COMPLEMENT  */           \
   V(vsel, VSEL, 0xE78D)   /* type = VRR_E VECTOR SELECT  */                    \
   V(vperm, VPERM, 0xE78C) /* type = VRR_E VECTOR PERMUTE  */                   \
-  V(vtm, VTM, 0xE7D8)     /* type = VRR_A VECTOR TEST UNDER MASK  */           \
-  V(vesl, VESL, 0xE730)   /* type = VRS_A VECTOR ELEMENT SHIFT LEFT  */        \
-  V(veslv, VESLV, 0xE770) /* type = VRR_C VECTOR ELEMENT SHIFT LEFT  */        \
+  V(vbperm, VBPERM, 0xE785) /* type = VRR_C VECTOR BIT PERMUTE   */            \
+  V(vtm, VTM, 0xE7D8)       /* type = VRR_A VECTOR TEST UNDER MASK  */         \
+  V(vesl, VESL, 0xE730)     /* type = VRS_A VECTOR ELEMENT SHIFT LEFT  */      \
+  V(veslv, VESLV, 0xE770)   /* type = VRR_C VECTOR ELEMENT SHIFT LEFT  */      \
   V(vesrl, VESRL,                                                              \
     0xE738) /* type = VRS_A VECTOR ELEMENT SHIFT RIGHT LOGICAL  */             \
   V(vesrlv, VESRLV,                                                            \
@@ -3702,6 +3703,34 @@ EVALUATE(VPERM) {
   return length;
 }
 
+EVALUATE(VBPERM) {
+  DCHECK_OPCODE(VBPERM);
+  DECODE_VRR_C_INSTRUCTION(r1, r2, r3, m6, m5, m4);
+  USE(m4);
+  USE(m5);
+  USE(m6);
+  uint16_t result_bits = 0;
+  for (int i = 0; i < kSimd128Size; i++) {
+    result_bits <<= 1;
+    uint8_t selected_bit_index = get_simd_register_by_lane<uint8_t>(r3, i);
+    unsigned __int128 src_bits =
+        *(reinterpret_cast<__int128*>(get_simd_register(r2).int8));
+    if (selected_bit_index < (kSimd128Size * kBitsPerByte)) {
+      unsigned __int128 bit_value =
+          (src_bits << selected_bit_index) >> (kSimd128Size * kBitsPerByte - 1);
+      result_bits |= bit_value;
+    }
+  }
+  set_simd_register_by_lane<uint64_t>(r1, 0, 0);
+  set_simd_register_by_lane<uint64_t>(r1, 1, 0);
+  // Write back in bytes to avoid endianness problems.
+  set_simd_register_by_lane<uint8_t>(r1, 6,
+                                     static_cast<uint8_t>(result_bits >> 8));
+  set_simd_register_by_lane<uint8_t>(
+      r1, 7, static_cast<uint8_t>((result_bits << 8) >> 8));
+  return length;
+}
+
 EVALUATE(VSEL) {
   DCHECK_OPCODE(VSEL);
   DECODE_VRR_E_INSTRUCTION(r1, r2, r3, r4, m6, m5);
diff --git a/deps/v8/src/extensions/gc-extension.cc b/deps/v8/src/extensions/gc-extension.cc
index fddd40b3525..fd0cf913334 100644
--- a/deps/v8/src/extensions/gc-extension.cc
+++ b/deps/v8/src/extensions/gc-extension.cc
@@ -105,7 +105,7 @@ class AsyncGC final : public CancelableTask {
   void RunInternal() final {
     v8::HandleScope scope(isolate_);
     InvokeGC(isolate_, type_,
-             v8::EmbedderHeapTracer::EmbedderStackState::kEmpty);
+             v8::EmbedderHeapTracer::EmbedderStackState::kNoHeapPointers);
     auto resolver = v8::Local<v8::Promise::Resolver>::New(isolate_, resolver_);
     auto ctx = Local<v8::Context>::New(isolate_, ctx_);
     resolver->Resolve(ctx, v8::Undefined(isolate_)).ToChecked();
@@ -132,9 +132,9 @@ void GCExtension::GC(const v8::FunctionCallbackInfo<v8::Value>& args) {
 
   // Immediate bailout if no arguments are provided.
   if (args.Length() == 0) {
-    InvokeGC(isolate,
-             v8::Isolate::GarbageCollectionType::kFullGarbageCollection,
-             v8::EmbedderHeapTracer::EmbedderStackState::kUnknown);
+    InvokeGC(
+        isolate, v8::Isolate::GarbageCollectionType::kFullGarbageCollection,
+        v8::EmbedderHeapTracer::EmbedderStackState::kMayContainHeapPointers);
     return;
   }
 
@@ -143,8 +143,9 @@ void GCExtension::GC(const v8::FunctionCallbackInfo<v8::Value>& args) {
   GCOptions options = maybe_options.ToChecked();
   switch (options.execution) {
     case ExecutionType::kSync:
-      InvokeGC(isolate, options.type,
-               v8::EmbedderHeapTracer::EmbedderStackState::kUnknown);
+      InvokeGC(
+          isolate, options.type,
+          v8::EmbedderHeapTracer::EmbedderStackState::kMayContainHeapPointers);
       break;
     case ExecutionType::kAsync: {
       v8::HandleScope scope(isolate);
diff --git a/deps/v8/src/flags/flag-definitions.h b/deps/v8/src/flags/flag-definitions.h
index c3f360cdf0d..628541c5534 100644
--- a/deps/v8/src/flags/flag-definitions.h
+++ b/deps/v8/src/flags/flag-definitions.h
@@ -134,6 +134,12 @@ struct MaybeBoolFlag {
 #define COMPRESS_POINTERS_BOOL false
 #endif
 
+#ifdef V8_HEAP_SANDBOX
+#define V8_HEAP_SANDBOX_BOOL true
+#else
+#define V8_HEAP_SANDBOX_BOOL false
+#endif
+
 #ifdef V8_ENABLE_CONTROL_FLOW_INTEGRITY
 #define ENABLE_CONTROL_FLOW_INTEGRITY_BOOL true
 #else
@@ -207,16 +213,17 @@ DEFINE_BOOL(harmony_shipping, true, "enable all shipped harmony features")
 DEFINE_IMPLICATION(es_staging, harmony)
 // Enabling import.meta requires to also enable import()
 DEFINE_IMPLICATION(harmony_import_meta, harmony_dynamic_import)
+// Enabling FinalizationRegistry#cleanupSome also enables weak refs
+DEFINE_IMPLICATION(harmony_weak_refs_with_cleanup_some, harmony_weak_refs)
 
 // Update bootstrapper.cc whenever adding a new feature flag.
 
 // Features that are still work in progress (behind individual flags).
-#define HARMONY_INPROGRESS_BASE(V)                                    \
-  V(harmony_string_replaceall, "harmony String.prototype.replaceAll") \
-  V(harmony_regexp_sequence, "RegExp Unicode sequence properties")    \
-  V(harmony_weak_refs, "harmony weak references")                     \
-  V(harmony_regexp_match_indices, "harmony regexp match indices")     \
-  V(harmony_top_level_await, "harmony top level await")
+#define HARMONY_INPROGRESS_BASE(V)                                             \
+  V(harmony_regexp_sequence, "RegExp Unicode sequence properties")             \
+  V(harmony_weak_refs_with_cleanup_some,                                       \
+    "harmony weak references with FinalizationRegistry.prototype.cleanupSome") \
+  V(harmony_regexp_match_indices, "harmony regexp match indices")
 
 #ifdef V8_INTL_SUPPORT
 #define HARMONY_INPROGRESS(V)                       \
@@ -227,39 +234,38 @@ DEFINE_IMPLICATION(harmony_import_meta, harmony_dynamic_import)
 #endif
 
 // Features that are complete (but still behind --harmony/es-staging flag).
-#define HARMONY_STAGED_BASE(V)                                     \
-  V(harmony_private_methods, "harmony private methods in class literals")
+#define HARMONY_STAGED_BASE(V)                                        \
+  V(harmony_top_level_await, "harmony top level await")
 
 #ifdef V8_INTL_SUPPORT
 #define HARMONY_STAGED(V)                                  \
   HARMONY_STAGED_BASE(V)                                   \
   V(harmony_intl_dateformat_day_period,                    \
     "Add dayPeriod option to DateTimeFormat")              \
-  V(harmony_intl_dateformat_fractional_second_digits,      \
-    "Add fractionalSecondDigits option to DateTimeFormat") \
   V(harmony_intl_segmenter, "Intl.Segmenter")
 #else
 #define HARMONY_STAGED(V) HARMONY_STAGED_BASE(V)
 #endif
 
 // Features that are shipping (turned on by default, but internal flag remains).
-#define HARMONY_SHIPPING_BASE(V)                               \
-  V(harmony_namespace_exports,                                 \
-    "harmony namespace exports (export * as foo from 'bar')")  \
-  V(harmony_sharedarraybuffer, "harmony sharedarraybuffer")    \
-  V(harmony_import_meta, "harmony import.meta property")       \
-  V(harmony_dynamic_import, "harmony dynamic import")          \
-  V(harmony_promise_all_settled, "harmony Promise.allSettled") \
-  V(harmony_nullish, "harmony nullish operator")               \
-  V(harmony_optional_chaining, "harmony optional chaining syntax")
+#define HARMONY_SHIPPING_BASE(V)                                          \
+  V(harmony_namespace_exports,                                            \
+    "harmony namespace exports (export * as foo from 'bar')")             \
+  V(harmony_sharedarraybuffer, "harmony sharedarraybuffer")               \
+  V(harmony_import_meta, "harmony import.meta property")                  \
+  V(harmony_dynamic_import, "harmony dynamic import")                     \
+  V(harmony_promise_all_settled, "harmony Promise.allSettled")            \
+  V(harmony_promise_any, "harmony Promise.any")                           \
+  V(harmony_private_methods, "harmony private methods in class literals") \
+  V(harmony_weak_refs, "harmony weak references")                         \
+  V(harmony_string_replaceall, "harmony String.prototype.replaceAll")     \
+  V(harmony_logical_assignment, "harmony logical assignment")
 
 #ifdef V8_INTL_SUPPORT
-#define HARMONY_SHIPPING(V)                               \
-  HARMONY_SHIPPING_BASE(V)                                \
-  V(harmony_intl_add_calendar_numbering_system,           \
-    "Add calendar and numberingSystem to DateTimeFormat") \
-  V(harmony_intl_displaynames, "Intl.DisplayNames")       \
-  V(harmony_intl_other_calendars, "DateTimeFormat other calendars")
+#define HARMONY_SHIPPING(V)                           \
+  HARMONY_SHIPPING_BASE(V)                            \
+  V(harmony_intl_dateformat_fractional_second_digits, \
+    "Add fractionalSecondDigits option to DateTimeFormat")
 #else
 #define HARMONY_SHIPPING(V) HARMONY_SHIPPING_BASE(V)
 #endif
@@ -368,6 +374,7 @@ DEFINE_BOOL(future, FUTURE_BOOL,
             "not-too-far future")
 
 DEFINE_IMPLICATION(future, write_protect_code_memory)
+DEFINE_IMPLICATION(future, finalize_streaming_on_background)
 
 DEFINE_BOOL(assert_types, false,
             "generate runtime type assertions to test the typer")
@@ -433,11 +440,6 @@ DEFINE_NEG_IMPLICATION(jitless, track_heap_object_fields)
 DEFINE_IMPLICATION(jitless, regexp_interpret_all)
 // asm.js validation is disabled since it triggers wasm code generation.
 DEFINE_NEG_IMPLICATION(jitless, validate_asm)
-// Wasm is put into interpreter-only mode. We repeat flag implications down
-// here to ensure they're applied correctly by setting the --jitless flag.
-DEFINE_IMPLICATION(jitless, wasm_interpret_all)
-DEFINE_NEG_IMPLICATION(jitless, asm_wasm_lazy_compilation)
-DEFINE_NEG_IMPLICATION(jitless, wasm_lazy_compilation)
 // --jitless also implies --no-expose-wasm, see InitializeOncePerProcessImpl.
 
 // Flags for inline caching and feedback vectors.
@@ -495,6 +497,7 @@ DEFINE_BOOL(turboprop, false,
 DEFINE_NEG_IMPLICATION(turboprop, turbo_inlining)
 DEFINE_IMPLICATION(turboprop, concurrent_inlining)
 DEFINE_VALUE_IMPLICATION(turboprop, interrupt_budget, 15 * KB)
+DEFINE_VALUE_IMPLICATION(turboprop, reuse_opt_code_count, 2)
 
 // Flags for concurrent recompilation.
 DEFINE_BOOL(concurrent_recompilation, true,
@@ -645,6 +648,17 @@ DEFINE_BOOL(
     stress_gc_during_compilation, false,
     "simulate GC/compiler thread race related to https://crbug.com/v8/8520")
 DEFINE_BOOL(turbo_fast_api_calls, false, "enable fast API calls from TurboFan")
+DEFINE_INT(reuse_opt_code_count, 0,
+           "don't discard optimized code for the specified number of deopts.")
+
+// Native context independent (NCI) code.
+DEFINE_BOOL(turbo_nci, false,
+            "enable experimental native context independent code.")
+DEFINE_BOOL(turbo_nci_as_highest_tier, false,
+            "replace default TF with NCI code as the highest tier for testing "
+            "purposes.")
+DEFINE_BOOL(print_nci_code, false, "print native context independent code.")
+DEFINE_BOOL(trace_turbo_nci, false, "trace native context independent code.")
 
 // Favor memory over execution speed.
 DEFINE_BOOL(optimize_for_size, false,
@@ -691,6 +705,7 @@ DEFINE_BOOL(wasm_tier_up, true,
             "enable tier up to the optimizing compiler (requires --liftoff to "
             "have an effect)")
 DEFINE_DEBUG_BOOL(trace_wasm_decoder, false, "trace decoding of wasm code")
+DEFINE_IMPLICATION(trace_wasm_decoder, single_threaded)
 DEFINE_DEBUG_BOOL(trace_wasm_compiler, false, "trace compiling of wasm code")
 DEFINE_DEBUG_BOOL(trace_wasm_interpreter, false,
                   "trace interpretation of wasm code")
@@ -709,6 +724,11 @@ DEFINE_BOOL(liftoff, false,
             "enable Liftoff, the baseline compiler for WebAssembly")
 DEFINE_IMPLICATION(future, liftoff)
 #endif
+// We can't tier up (from Liftoff to TurboFan) in single-threaded mode, hence
+// disable Liftoff in that configuration for now. The alternative is disabling
+// TurboFan, which would reduce peak performance considerably.
+// Note that for debugging, Liftoff will still be used.
+DEFINE_NEG_IMPLICATION(single_threaded, liftoff)
 DEFINE_DEBUG_BOOL(trace_liftoff, false,
                   "trace Liftoff, the baseline compiler for WebAssembly")
 DEFINE_BOOL(trace_wasm_memory, false,
@@ -718,10 +738,8 @@ DEFINE_BOOL(trace_wasm_memory, false,
 DEFINE_INT(wasm_tier_mask_for_testing, 0,
            "bitmask of functions to compile with TurboFan instead of Liftoff")
 
-DEFINE_BOOL(debug_in_liftoff, false,
-            "use Liftoff instead of the C++ interpreter for debugging "
-            "WebAssembly (experimental)")
-DEFINE_IMPLICATION(future, debug_in_liftoff)
+DEFINE_BOOL(wasm_expose_debug_eval, false,
+            "Expose wasm evaluator support on the CDP")
 
 DEFINE_BOOL(validate_asm, true, "validate asm.js modules before compiling")
 DEFINE_BOOL(suppress_asm_messages, false,
@@ -771,8 +789,6 @@ DEFINE_BOOL(wasm_fuzzer_gen_test, false,
 DEFINE_IMPLICATION(wasm_fuzzer_gen_test, single_threaded)
 DEFINE_BOOL(print_wasm_code, false, "Print WebAssembly code")
 DEFINE_BOOL(print_wasm_stub_code, false, "Print WebAssembly stub code")
-DEFINE_BOOL(wasm_interpret_all, false,
-            "execute all wasm code in the wasm interpreter")
 DEFINE_BOOL(asm_wasm_lazy_compilation, false,
             "enable lazy compilation for asm-wasm modules")
 DEFINE_IMPLICATION(validate_asm, asm_wasm_lazy_compilation)
@@ -794,10 +810,6 @@ DEFINE_BOOL(wasm_simd_post_mvp, false,
             "included in the current proposal")
 DEFINE_IMPLICATION(wasm_simd_post_mvp, experimental_wasm_simd)
 
-// wasm-interpret-all resets {asm-,}wasm-lazy-compilation.
-DEFINE_NEG_IMPLICATION(wasm_interpret_all, asm_wasm_lazy_compilation)
-DEFINE_NEG_IMPLICATION(wasm_interpret_all, wasm_lazy_compilation)
-DEFINE_NEG_IMPLICATION(wasm_interpret_all, wasm_tier_up)
 DEFINE_BOOL(wasm_code_gc, true, "enable garbage collection of wasm code")
 DEFINE_BOOL(trace_wasm_code_gc, false, "trace garbage collection of wasm code")
 DEFINE_BOOL(stress_wasm_code_gc, false,
@@ -883,14 +895,28 @@ DEFINE_INT(trace_duplicate_threshold_kb, 0,
 DEFINE_BOOL(trace_fragmentation, false, "report fragmentation for old space")
 DEFINE_BOOL(trace_fragmentation_verbose, false,
             "report fragmentation for old space (detailed)")
+DEFINE_BOOL(minor_mc_trace_fragmentation, false,
+            "trace fragmentation after marking")
 DEFINE_BOOL(trace_evacuation, false, "report evacuation statistics")
 DEFINE_BOOL(trace_mutator_utilization, false,
             "print mutator utilization, allocation speed, gc speed")
 DEFINE_BOOL(incremental_marking, true, "use incremental marking")
 DEFINE_BOOL(incremental_marking_wrappers, true,
             "use incremental marking for marking wrappers")
+DEFINE_BOOL(incremental_marking_task, true, "use tasks for incremental marking")
+DEFINE_INT(incremental_marking_soft_trigger, 0,
+           "threshold for starting incremental marking via a task in percent "
+           "of available space: limit - size")
+DEFINE_INT(incremental_marking_hard_trigger, 0,
+           "threshold for starting incremental marking immediately in percent "
+           "of available space: limit - size")
 DEFINE_BOOL(trace_unmapper, false, "Trace the unmapping")
 DEFINE_BOOL(parallel_scavenge, true, "parallel scavenge")
+DEFINE_BOOL(scavenge_task, true, "schedule scavenge tasks")
+DEFINE_INT(scavenge_task_trigger, 80,
+           "scavenge task trigger in percent of the current heap limit")
+DEFINE_BOOL(scavenge_separate_stack_scanning, false,
+            "use a separate phase for stack scanning in scavenge")
 DEFINE_BOOL(trace_parallel_scavenge, false, "trace parallel scavenge")
 DEFINE_BOOL(write_protect_code_memory, true, "write protect code memory")
 #ifdef V8_CONCURRENT_MARKING
@@ -910,7 +936,9 @@ DEFINE_BOOL_READONLY(array_buffer_extension, V8_ARRAY_BUFFER_EXTENSION_BOOL,
 DEFINE_IMPLICATION(array_buffer_extension, always_promote_young_mc)
 DEFINE_BOOL(concurrent_array_buffer_sweeping, true,
             "concurrently sweep array buffers")
+DEFINE_BOOL(concurrent_allocation, false, "concurrently allocate in old space")
 DEFINE_BOOL(local_heaps, false, "allow heap access from background tasks")
+DEFINE_NEG_NEG_IMPLICATION(array_buffer_extension, local_heaps)
 DEFINE_BOOL(parallel_marking, true, "use parallel marking in atomic pause")
 DEFINE_INT(ephemeron_fixpoint_iterations, 10,
            "number of fixpoint iterations it takes to switch to linear "
@@ -1078,6 +1106,8 @@ DEFINE_BOOL(enable_regexp_unaligned_accesses, true,
 
 // api.cc
 DEFINE_BOOL(script_streaming, true, "enable parsing on background")
+DEFINE_BOOL(stress_background_compile, false,
+            "stress test parsing on background")
 DEFINE_BOOL(
     finalize_streaming_on_background, false,
     "perform the script streaming finalization on the background thread")
@@ -1119,7 +1149,8 @@ DEFINE_BOOL(inline_new, true, "use fast inline allocation")
 DEFINE_NEG_NEG_IMPLICATION(inline_new, turbo_allocation_folding)
 
 // codegen-ia32.cc / codegen-arm.cc
-DEFINE_BOOL(trace, false, "trace function calls")
+DEFINE_BOOL(trace, false, "trace javascript function calls")
+DEFINE_BOOL(trace_wasm, false, "trace wasm function calls")
 
 // codegen.cc
 DEFINE_BOOL(lazy, true, "use lazy compilation")
@@ -1358,9 +1389,14 @@ DEFINE_INT(testing_prng_seed, 42, "Seed used for threading test randomness")
 // Test flag for a check in %OptimizeFunctionOnNextCall
 DEFINE_BOOL(
     testing_d8_test_runner, false,
-    "test runner turns on this flag to enable a check that the funciton was "
+    "test runner turns on this flag to enable a check that the function was "
     "prepared for optimization before marking it for optimization")
 
+DEFINE_BOOL(
+    fuzzing, false,
+    "Fuzzers use this flag to signal that they are ... fuzzing. This causes "
+    "intrinsics to fail silently (e.g. return undefined) on invalid usage.")
+
 // mksnapshot.cc
 DEFINE_STRING(embedded_src, nullptr,
               "Path for the generated embedded data file. (mksnapshot only)")
@@ -1419,6 +1455,7 @@ DEFINE_BOOL(multi_mapped_mock_allocator, false,
 #define DEFAULT_WASM_GDB_REMOTE_PORT 8765
 DEFINE_BOOL(wasm_gdb_remote, false,
             "enable GDB-remote for WebAssembly debugging")
+DEFINE_NEG_IMPLICATION(wasm_gdb_remote, wasm_tier_up)
 DEFINE_INT(wasm_gdb_remote_port, DEFAULT_WASM_GDB_REMOTE_PORT,
            "default port for WebAssembly debugging with LLDB.")
 DEFINE_BOOL(wasm_pause_waiting_for_debugger, false,
@@ -1625,8 +1662,8 @@ DEFINE_BOOL(vtune_prof_annotate_wasm, false,
 
 DEFINE_BOOL(win64_unwinding_info, true, "Enable unwinding info for Windows/x64")
 
-#if defined(V8_TARGET_ARCH_ARM) || defined(V8_TARGET_ARCH_S390X)
-// Unsupported on above architectures. See https://crbug.com/v8/8713.
+#ifdef V8_TARGET_ARCH_ARM
+// Unsupported on arm. See https://crbug.com/v8/8713.
 DEFINE_BOOL_READONLY(
     interpreted_frames_native_stack, false,
     "Show interpreted frames on the native stack (useful for external "
diff --git a/deps/v8/src/handles/global-handles.cc b/deps/v8/src/handles/global-handles.cc
index df4042e8ebd..e6dbd6ad450 100644
--- a/deps/v8/src/handles/global-handles.cc
+++ b/deps/v8/src/handles/global-handles.cc
@@ -381,10 +381,11 @@ namespace {
 
 void ExtractInternalFields(JSObject jsobject, void** embedder_fields, int len) {
   int field_count = jsobject.GetEmbedderFieldCount();
+  const Isolate* isolate = GetIsolateForPtrCompr(jsobject);
   for (int i = 0; i < len; ++i) {
     if (field_count == i) break;
     void* pointer;
-    if (EmbedderDataSlot(jsobject, i).ToAlignedPointer(&pointer)) {
+    if (EmbedderDataSlot(jsobject, i).ToAlignedPointer(isolate, &pointer)) {
       embedder_fields[i] = pointer;
     }
   }
diff --git a/deps/v8/src/handles/handles-inl.h b/deps/v8/src/handles/handles-inl.h
index c8b4b4556bc..b16044871c4 100644
--- a/deps/v8/src/handles/handles-inl.h
+++ b/deps/v8/src/handles/handles-inl.h
@@ -6,6 +6,7 @@
 #define V8_HANDLES_HANDLES_INL_H_
 
 #include "src/execution/isolate.h"
+#include "src/execution/local-isolate-wrapper.h"
 #include "src/execution/off-thread-isolate.h"
 #include "src/handles/handles.h"
 #include "src/handles/local-handles-inl.h"
@@ -66,19 +67,11 @@ V8_INLINE Handle<T> handle(T object, LocalHeap* local_heap) {
   return Handle<T>(object, local_heap);
 }
 
-// Convenience overloads for when we already have a Handle, but want
-// either a Handle or an Handle.
 template <typename T>
-V8_INLINE Handle<T> handle(Handle<T> handle, Isolate* isolate) {
-  return handle;
-}
-template <typename T>
-V8_INLINE Handle<T> handle(Handle<T> handle, OffThreadIsolate* isolate) {
-  return Handle<T>(*handle);
-}
-template <typename T>
-V8_INLINE Handle<T> handle(Handle<T> handle, LocalHeap* local_heap) {
-  return Handle<T>(*handle, local_heap);
+V8_INLINE Handle<T> handle(T object, LocalIsolateWrapper local_isolate) {
+  return local_isolate.is_off_thread()
+             ? handle(object, local_isolate.off_thread())
+             : handle(object, local_isolate.main_thread());
 }
 
 template <typename T>
diff --git a/deps/v8/src/handles/handles.h b/deps/v8/src/handles/handles.h
index b90a942df13..a6a83dcca2d 100644
--- a/deps/v8/src/handles/handles.h
+++ b/deps/v8/src/handles/handles.h
@@ -148,7 +148,7 @@ class Handle final : public HandleBase {
   template <typename S>
   inline static const Handle<T> cast(Handle<S> that);
 
-  // TODO(yangguo): Values that contain empty handles should be declared as
+  // Consider declaring values that contain empty handles as
   // MaybeHandle to force validation before being used as handles.
   static const Handle<T> null() { return Handle<T>(); }
 
@@ -199,6 +199,15 @@ class HandleScope {
   explicit inline HandleScope(Isolate* isolate);
   inline HandleScope(HandleScope&& other) V8_NOEXCEPT;
 
+  // Allow placement new.
+  void* operator new(size_t size, void* storage) {
+    return ::operator new(size, storage);
+  }
+
+  // Prevent heap allocation or illegal handle scopes.
+  void* operator new(size_t size) = delete;
+  void operator delete(void* size_t) = delete;
+
   inline ~HandleScope();
 
   inline HandleScope& operator=(HandleScope&& other) V8_NOEXCEPT;
@@ -234,10 +243,6 @@ class HandleScope {
   static const int kCheckHandleThreshold = 30 * 1024;
 
  private:
-  // Prevent heap allocation or illegal handle scopes.
-  void* operator new(size_t size);
-  void operator delete(void* size_t);
-
   Isolate* isolate_;
   Address* prev_next_;
   Address* prev_limit_;
diff --git a/deps/v8/src/handles/off-thread-transfer-handle-storage-inl.h b/deps/v8/src/handles/off-thread-transfer-handle-storage-inl.h
new file mode 100644
index 00000000000..8a0682d9c76
--- /dev/null
+++ b/deps/v8/src/handles/off-thread-transfer-handle-storage-inl.h
@@ -0,0 +1,77 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HANDLES_OFF_THREAD_TRANSFER_HANDLE_STORAGE_INL_H_
+#define V8_HANDLES_OFF_THREAD_TRANSFER_HANDLE_STORAGE_INL_H_
+
+#include "src/handles/handles-inl.h"
+#include "src/handles/off-thread-transfer-handle-storage.h"
+
+namespace v8 {
+namespace internal {
+
+OffThreadTransferHandleStorage::OffThreadTransferHandleStorage(
+    Address* off_thread_handle_location,
+    std::unique_ptr<OffThreadTransferHandleStorage> next)
+    : handle_location_(off_thread_handle_location),
+      next_(std::move(next)),
+      state_(kOffThreadHandle) {
+  CheckValid();
+}
+
+void OffThreadTransferHandleStorage::ConvertFromOffThreadHandleOnFinish() {
+  CheckValid();
+  DCHECK_EQ(state_, kOffThreadHandle);
+  raw_obj_ptr_ = *handle_location_;
+  state_ = kRawObject;
+  CheckValid();
+}
+
+void OffThreadTransferHandleStorage::ConvertToHandleOnPublish(
+    Isolate* isolate, DisallowHeapAllocation* no_gc) {
+  CheckValid();
+  DCHECK_EQ(state_, kRawObject);
+  handle_location_ = handle(Object(raw_obj_ptr_), isolate).location();
+  state_ = kHandle;
+  CheckValid();
+}
+
+Address* OffThreadTransferHandleStorage::handle_location() const {
+  CheckValid();
+  DCHECK_EQ(state_, kHandle);
+  return handle_location_;
+}
+
+void OffThreadTransferHandleStorage::CheckValid() const {
+#ifdef DEBUG
+  Object obj;
+
+  switch (state_) {
+    case kHandle:
+    case kOffThreadHandle:
+      DCHECK_NOT_NULL(handle_location_);
+      obj = Object(*handle_location_);
+      break;
+    case kRawObject:
+      obj = Object(raw_obj_ptr_);
+      break;
+  }
+
+  // Smis are always fine.
+  if (obj.IsSmi()) return;
+
+  // The main-thread handle should not be in off-thread space, and vice verse.
+  // Raw object pointers can point to the main-thread heap during Publish, so
+  // we don't check that.
+  DCHECK_IMPLIES(state_ == kOffThreadHandle,
+                 Heap::InOffThreadSpace(HeapObject::cast(obj)));
+  DCHECK_IMPLIES(state_ == kHandle,
+                 !Heap::InOffThreadSpace(HeapObject::cast(obj)));
+#endif
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HANDLES_OFF_THREAD_TRANSFER_HANDLE_STORAGE_INL_H_
diff --git a/deps/v8/src/handles/off-thread-transfer-handle-storage.h b/deps/v8/src/handles/off-thread-transfer-handle-storage.h
new file mode 100644
index 00000000000..608ad69693d
--- /dev/null
+++ b/deps/v8/src/handles/off-thread-transfer-handle-storage.h
@@ -0,0 +1,47 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HANDLES_OFF_THREAD_TRANSFER_HANDLE_STORAGE_H_
+#define V8_HANDLES_OFF_THREAD_TRANSFER_HANDLE_STORAGE_H_
+
+#include "src/common/assert-scope.h"
+#include "src/handles/handles.h"
+
+namespace v8 {
+namespace internal {
+
+class OffThreadTransferHandleStorage {
+ public:
+  enum State { kOffThreadHandle, kRawObject, kHandle };
+
+  inline explicit OffThreadTransferHandleStorage(
+      Address* off_thread_handle_location,
+      std::unique_ptr<OffThreadTransferHandleStorage> next);
+
+  inline void ConvertFromOffThreadHandleOnFinish();
+
+  inline void ConvertToHandleOnPublish(Isolate* isolate,
+                                       DisallowHeapAllocation* no_gc);
+
+  inline Address* handle_location() const;
+
+  OffThreadTransferHandleStorage* next() { return next_.get(); }
+
+  State state() const { return state_; }
+
+ private:
+  inline void CheckValid() const;
+
+  union {
+    Address* handle_location_;
+    Address raw_obj_ptr_;
+  };
+  std::unique_ptr<OffThreadTransferHandleStorage> next_;
+  State state_;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HANDLES_OFF_THREAD_TRANSFER_HANDLE_STORAGE_H_
diff --git a/deps/v8/src/handles/persistent-handles.cc b/deps/v8/src/handles/persistent-handles.cc
new file mode 100644
index 00000000000..3ef2dee6f17
--- /dev/null
+++ b/deps/v8/src/handles/persistent-handles.cc
@@ -0,0 +1,122 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/handles/persistent-handles.h"
+
+#include "src/api/api.h"
+#include "src/heap/heap-inl.h"
+#include "src/heap/safepoint.h"
+#include "src/utils/allocation.h"
+
+namespace v8 {
+namespace internal {
+
+PersistentHandles::PersistentHandles(Isolate* isolate, size_t block_size)
+    : isolate_(isolate),
+      block_size_(block_size),
+      block_next_(nullptr),
+      block_limit_(nullptr),
+      prev_(nullptr),
+      next_(nullptr) {
+  isolate->persistent_handles_list()->Add(this);
+}
+
+PersistentHandles::~PersistentHandles() {
+  isolate_->persistent_handles_list()->Remove(this);
+
+  for (Address* block_start : blocks_) {
+    DeleteArray(block_start);
+  }
+}
+
+#ifdef DEBUG
+void PersistentHandles::Attach(LocalHeap* local_heap) {
+  DCHECK_NULL(owner_);
+  owner_ = local_heap;
+}
+
+void PersistentHandles::Detach() {
+  DCHECK_NOT_NULL(owner_);
+  owner_ = nullptr;
+}
+#endif
+
+void PersistentHandles::AddBlock() {
+  DCHECK_EQ(block_next_, block_limit_);
+
+  Address* block_start = NewArray<Address>(block_size_);
+  blocks_.push_back(block_start);
+
+  block_next_ = block_start;
+  block_limit_ = block_start + block_size_;
+}
+
+Handle<Object> PersistentHandles::NewHandle(Address value) {
+#ifdef DEBUG
+  if (owner_) DCHECK(!owner_->IsParked());
+#endif
+  return Handle<Object>(GetHandle(value));
+}
+
+Address* PersistentHandles::GetHandle(Address value) {
+  if (block_next_ == block_limit_) {
+    AddBlock();
+  }
+
+  DCHECK_LT(block_next_, block_limit_);
+  *block_next_ = value;
+  return block_next_++;
+}
+
+void PersistentHandles::Iterate(RootVisitor* visitor) {
+  for (int i = 0; i < static_cast<int>(blocks_.size()) - 1; i++) {
+    Address* block_start = blocks_[i];
+    Address* block_end = block_start + block_size_;
+    visitor->VisitRootPointers(Root::kHandleScope, nullptr,
+                               FullObjectSlot(block_start),
+                               FullObjectSlot(block_end));
+  }
+
+  if (!blocks_.empty()) {
+    Address* block_start = blocks_.back();
+    visitor->VisitRootPointers(Root::kHandleScope, nullptr,
+                               FullObjectSlot(block_start),
+                               FullObjectSlot(block_next_));
+  }
+}
+
+void PersistentHandlesList::Add(PersistentHandles* persistent_handles) {
+  base::MutexGuard guard(&persistent_handles_mutex_);
+  if (persistent_handles_head_)
+    persistent_handles_head_->prev_ = persistent_handles;
+  persistent_handles->prev_ = nullptr;
+  persistent_handles->next_ = persistent_handles_head_;
+  persistent_handles_head_ = persistent_handles;
+}
+
+void PersistentHandlesList::Remove(PersistentHandles* persistent_handles) {
+  base::MutexGuard guard(&persistent_handles_mutex_);
+  if (persistent_handles->next_)
+    persistent_handles->next_->prev_ = persistent_handles->prev_;
+  if (persistent_handles->prev_)
+    persistent_handles->prev_->next_ = persistent_handles->next_;
+  else
+    persistent_handles_head_ = persistent_handles->next_;
+}
+
+void PersistentHandlesList::Iterate(RootVisitor* visitor) {
+#if DEBUG
+  DCHECK(isolate_->heap()->safepoint()->IsActive());
+#else
+  USE(isolate_);
+#endif
+  base::MutexGuard guard(&persistent_handles_mutex_);
+  for (PersistentHandles* current = persistent_handles_head_; current;
+       current = current->next_) {
+    current->Iterate(visitor);
+  }
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/handles/persistent-handles.h b/deps/v8/src/handles/persistent-handles.h
new file mode 100644
index 00000000000..eb0e65fb85c
--- /dev/null
+++ b/deps/v8/src/handles/persistent-handles.h
@@ -0,0 +1,88 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HANDLES_PERSISTENT_HANDLES_H_
+#define V8_HANDLES_PERSISTENT_HANDLES_H_
+
+#include <vector>
+
+#include "include/v8-internal.h"
+#include "src/api/api.h"
+#include "src/base/macros.h"
+#include "src/objects/visitors.h"
+
+namespace v8 {
+namespace internal {
+
+class Heap;
+
+// PersistentHandles serves as a container for handles that can be passed back
+// and forth between threads. Allocation and deallocation of this class is
+// thread-safe and the isolate tracks all PersistentHandles containers.
+class PersistentHandles {
+ public:
+  V8_EXPORT_PRIVATE explicit PersistentHandles(
+      Isolate* isolate, size_t block_size = kHandleBlockSize);
+  V8_EXPORT_PRIVATE ~PersistentHandles();
+
+  PersistentHandles(const PersistentHandles&) = delete;
+  PersistentHandles& operator=(const PersistentHandles&) = delete;
+
+  void Iterate(RootVisitor* visitor);
+
+  V8_EXPORT_PRIVATE Handle<Object> NewHandle(Address value);
+
+ private:
+  void AddBlock();
+  Address* GetHandle(Address value);
+
+#ifdef DEBUG
+  void Attach(LocalHeap* local_heap);
+  void Detach();
+
+  LocalHeap* owner_ = nullptr;
+
+#else
+  void Attach(LocalHeap*) {}
+  void Detach() {}
+#endif
+
+  Isolate* isolate_;
+  std::vector<Address*> blocks_;
+  size_t block_size_;
+
+  Address* block_next_;
+  Address* block_limit_;
+
+  PersistentHandles* prev_;
+  PersistentHandles* next_;
+
+  friend class PersistentHandlesList;
+  friend class LocalHeap;
+};
+
+class PersistentHandlesList {
+ public:
+  explicit PersistentHandlesList(Isolate* isolate)
+      : isolate_(isolate), persistent_handles_head_(nullptr) {}
+
+  // Iteration is only safe during a safepoint
+  void Iterate(RootVisitor* visitor);
+
+ private:
+  void Add(PersistentHandles* persistent_handles);
+  void Remove(PersistentHandles* persistent_handles);
+
+  Isolate* isolate_;
+
+  base::Mutex persistent_handles_mutex_;
+  PersistentHandles* persistent_handles_head_ = nullptr;
+
+  friend class PersistentHandles;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HANDLES_PERSISTENT_HANDLES_H_
diff --git a/deps/v8/src/heap/OWNERS b/deps/v8/src/heap/OWNERS
index 5a02732930c..51a6b414160 100644
--- a/deps/v8/src/heap/OWNERS
+++ b/deps/v8/src/heap/OWNERS
@@ -6,5 +6,6 @@ omerkatz@chromium.org
 ulan@chromium.org
 
 per-file *factory*=leszeks@chromium.org
+per-file read-only-*=delphick@chromium.org
 
 # COMPONENT: Blink>JavaScript>GC
diff --git a/deps/v8/src/heap/array-buffer-tracker.cc b/deps/v8/src/heap/array-buffer-tracker.cc
index e79f86942fb..88d81ca9cfe 100644
--- a/deps/v8/src/heap/array-buffer-tracker.cc
+++ b/deps/v8/src/heap/array-buffer-tracker.cc
@@ -9,6 +9,7 @@
 #include "src/heap/array-buffer-collector.h"
 #include "src/heap/array-buffer-tracker-inl.h"
 #include "src/heap/heap.h"
+#include "src/heap/memory-chunk-inl.h"
 #include "src/heap/spaces.h"
 
 #define TRACE_BS(...)                                  \
diff --git a/deps/v8/src/heap/basic-memory-chunk.cc b/deps/v8/src/heap/basic-memory-chunk.cc
index fa94f60f4ec..14a1f34c6c4 100644
--- a/deps/v8/src/heap/basic-memory-chunk.cc
+++ b/deps/v8/src/heap/basic-memory-chunk.cc
@@ -8,7 +8,6 @@
 
 #include "src/heap/heap-write-barrier-inl.h"
 #include "src/objects/heap-object.h"
-#include "src/objects/slots-inl.h"
 
 namespace v8 {
 namespace internal {
diff --git a/deps/v8/src/heap/basic-memory-chunk.h b/deps/v8/src/heap/basic-memory-chunk.h
index 205d02ce247..3f46974485b 100644
--- a/deps/v8/src/heap/basic-memory-chunk.h
+++ b/deps/v8/src/heap/basic-memory-chunk.h
@@ -10,7 +10,6 @@
 #include "src/base/atomic-utils.h"
 #include "src/common/globals.h"
 #include "src/heap/marking.h"
-#include "src/heap/slot-set.h"
 
 namespace v8 {
 namespace internal {
@@ -112,8 +111,6 @@ class BasicMemoryChunk {
   size_t size() const { return size_; }
   void set_size(size_t size) { size_ = size; }
 
-  size_t buckets() const { return SlotSet::BucketsForSize(size()); }
-
   Address area_start() const { return area_start_; }
 
   Address area_end() const { return area_end_; }
@@ -177,8 +174,6 @@ class BasicMemoryChunk {
   static const intptr_t kHeapOffset = kMarkBitmapOffset + kSystemPointerSize;
   static const intptr_t kAreaStartOffset = kHeapOffset + kSystemPointerSize;
   static const intptr_t kAreaEndOffset = kAreaStartOffset + kSystemPointerSize;
-  static const intptr_t kOldToNewSlotSetOffset =
-      kAreaEndOffset + kSystemPointerSize;
 
   static const size_t kHeaderSize =
       kSizeOffset + kSizetSize  // size_t size
@@ -186,8 +181,7 @@ class BasicMemoryChunk {
       + kSystemPointerSize      // Bitmap* marking_bitmap_
       + kSystemPointerSize      // Heap* heap_
       + kSystemPointerSize      // Address area_start_
-      + kSystemPointerSize      // Address area_end_
-      + kSystemPointerSize * NUMBER_OF_REMEMBERED_SET_TYPES;  // SlotSet* array
+      + kSystemPointerSize;     // Address area_end_
 
  protected:
   // Overall size of the chunk, including the header and guards.
@@ -207,11 +201,6 @@ class BasicMemoryChunk {
   Address area_start_;
   Address area_end_;
 
-  // A single slot set for small pages (of size kPageSize) or an array of slot
-  // set for large pages. In the latter case the number of entries in the array
-  // is ceil(size() / kPageSize).
-  SlotSet* slot_set_[NUMBER_OF_REMEMBERED_SET_TYPES];
-
   friend class BasicMemoryChunkValidator;
 };
 
@@ -227,8 +216,6 @@ class BasicMemoryChunkValidator {
                 offsetof(BasicMemoryChunk, marking_bitmap_));
   STATIC_ASSERT(BasicMemoryChunk::kHeapOffset ==
                 offsetof(BasicMemoryChunk, heap_));
-  STATIC_ASSERT(BasicMemoryChunk::kOldToNewSlotSetOffset ==
-                offsetof(BasicMemoryChunk, slot_set_));
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/code-object-registry.cc b/deps/v8/src/heap/code-object-registry.cc
new file mode 100644
index 00000000000..ebaa29fbaeb
--- /dev/null
+++ b/deps/v8/src/heap/code-object-registry.cc
@@ -0,0 +1,75 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/code-object-registry.h"
+
+#include <algorithm>
+
+#include "src/base/logging.h"
+
+namespace v8 {
+namespace internal {
+
+void CodeObjectRegistry::RegisterNewlyAllocatedCodeObject(Address code) {
+  auto result = code_object_registry_newly_allocated_.insert(code);
+  USE(result);
+  DCHECK(result.second);
+}
+
+void CodeObjectRegistry::RegisterAlreadyExistingCodeObject(Address code) {
+  code_object_registry_already_existing_.push_back(code);
+}
+
+void CodeObjectRegistry::Clear() {
+  code_object_registry_already_existing_.clear();
+  code_object_registry_newly_allocated_.clear();
+}
+
+void CodeObjectRegistry::Finalize() {
+  code_object_registry_already_existing_.shrink_to_fit();
+}
+
+bool CodeObjectRegistry::Contains(Address object) const {
+  return (code_object_registry_newly_allocated_.find(object) !=
+          code_object_registry_newly_allocated_.end()) ||
+         (std::binary_search(code_object_registry_already_existing_.begin(),
+                             code_object_registry_already_existing_.end(),
+                             object));
+}
+
+Address CodeObjectRegistry::GetCodeObjectStartFromInnerAddress(
+    Address address) const {
+  // Let's first find the object which comes right before address in the vector
+  // of already existing code objects.
+  Address already_existing_set_ = 0;
+  Address newly_allocated_set_ = 0;
+  if (!code_object_registry_already_existing_.empty()) {
+    auto it =
+        std::upper_bound(code_object_registry_already_existing_.begin(),
+                         code_object_registry_already_existing_.end(), address);
+    if (it != code_object_registry_already_existing_.begin()) {
+      already_existing_set_ = *(--it);
+    }
+  }
+
+  // Next, let's find the object which comes right before address in the set
+  // of newly allocated code objects.
+  if (!code_object_registry_newly_allocated_.empty()) {
+    auto it = code_object_registry_newly_allocated_.upper_bound(address);
+    if (it != code_object_registry_newly_allocated_.begin()) {
+      newly_allocated_set_ = *(--it);
+    }
+  }
+
+  // The code objects which contains address has to be in one of the two
+  // data structures.
+  DCHECK(already_existing_set_ != 0 || newly_allocated_set_ != 0);
+
+  // The address which is closest to the given address is the code object.
+  return already_existing_set_ > newly_allocated_set_ ? already_existing_set_
+                                                      : newly_allocated_set_;
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/heap/code-object-registry.h b/deps/v8/src/heap/code-object-registry.h
new file mode 100644
index 00000000000..beab1766256
--- /dev/null
+++ b/deps/v8/src/heap/code-object-registry.h
@@ -0,0 +1,38 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CODE_OBJECT_REGISTRY_H_
+#define V8_HEAP_CODE_OBJECT_REGISTRY_H_
+
+#include <set>
+#include <vector>
+
+#include "src/base/macros.h"
+#include "src/common/globals.h"
+
+namespace v8 {
+namespace internal {
+
+// The CodeObjectRegistry holds all start addresses of code objects of a given
+// MemoryChunk. Each MemoryChunk owns a separate CodeObjectRegistry. The
+// CodeObjectRegistry allows fast lookup from an inner pointer of a code object
+// to the actual code object.
+class V8_EXPORT_PRIVATE CodeObjectRegistry {
+ public:
+  void RegisterNewlyAllocatedCodeObject(Address code);
+  void RegisterAlreadyExistingCodeObject(Address code);
+  void Clear();
+  void Finalize();
+  bool Contains(Address code) const;
+  Address GetCodeObjectStartFromInnerAddress(Address address) const;
+
+ private:
+  std::vector<Address> code_object_registry_already_existing_;
+  std::set<Address> code_object_registry_newly_allocated_;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_CODE_OBJECT_REGISTRY_H_
diff --git a/deps/v8/src/heap/code-stats.cc b/deps/v8/src/heap/code-stats.cc
index 058e48397ee..6e685c47b38 100644
--- a/deps/v8/src/heap/code-stats.cc
+++ b/deps/v8/src/heap/code-stats.cc
@@ -6,7 +6,8 @@
 
 #include "src/codegen/code-comments.h"
 #include "src/codegen/reloc-info.h"
-#include "src/heap/spaces-inl.h"  // For PagedSpaceObjectIterator.
+#include "src/heap/large-spaces.h"
+#include "src/heap/paged-spaces-inl.h"  // For PagedSpaceObjectIterator.
 #include "src/objects/objects-inl.h"
 
 namespace v8 {
diff --git a/deps/v8/src/heap/concurrent-allocator-inl.h b/deps/v8/src/heap/concurrent-allocator-inl.h
new file mode 100644
index 00000000000..15a4ef5f89c
--- /dev/null
+++ b/deps/v8/src/heap/concurrent-allocator-inl.h
@@ -0,0 +1,84 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CONCURRENT_ALLOCATOR_INL_H_
+#define V8_HEAP_CONCURRENT_ALLOCATOR_INL_H_
+
+#include "include/v8-internal.h"
+#include "src/common/globals.h"
+#include "src/heap/concurrent-allocator.h"
+#include "src/heap/heap.h"
+#include "src/heap/incremental-marking.h"
+#include "src/heap/spaces-inl.h"
+#include "src/heap/spaces.h"
+#include "src/objects/heap-object.h"
+
+namespace v8 {
+namespace internal {
+
+AllocationResult ConcurrentAllocator::Allocate(int object_size,
+                                               AllocationAlignment alignment,
+                                               AllocationOrigin origin) {
+  // TODO(dinfuehr): Add support for allocation observers
+  CHECK(FLAG_concurrent_allocation);
+  if (object_size > kMaxLabObjectSize) {
+    return AllocateOutsideLab(object_size, alignment, origin);
+  }
+
+  return AllocateInLab(object_size, alignment, origin);
+}
+
+Address ConcurrentAllocator::AllocateOrFail(int object_size,
+                                            AllocationAlignment alignment,
+                                            AllocationOrigin origin) {
+  AllocationResult result = Allocate(object_size, alignment, origin);
+  if (!result.IsRetry()) return result.ToObjectChecked().address();
+  return PerformCollectionAndAllocateAgain(object_size, alignment, origin);
+}
+
+AllocationResult ConcurrentAllocator::AllocateInLab(
+    int object_size, AllocationAlignment alignment, AllocationOrigin origin) {
+  AllocationResult allocation;
+  if (!lab_.IsValid() && !EnsureLab(origin)) {
+    return AllocationResult::Retry(space_->identity());
+  }
+  allocation = lab_.AllocateRawAligned(object_size, alignment);
+  if (allocation.IsRetry()) {
+    if (!EnsureLab(origin)) {
+      return AllocationResult::Retry(space_->identity());
+    } else {
+      allocation = lab_.AllocateRawAligned(object_size, alignment);
+      CHECK(!allocation.IsRetry());
+    }
+  }
+  return allocation;
+}
+
+bool ConcurrentAllocator::EnsureLab(AllocationOrigin origin) {
+  auto result = space_->SlowGetLinearAllocationAreaBackground(
+      local_heap_, kLabSize, kMaxLabSize, kWordAligned, origin);
+
+  if (!result) return false;
+
+  if (local_heap_->heap()->incremental_marking()->black_allocation()) {
+    Address top = result->first;
+    Address limit = top + result->second;
+    Page::FromAllocationAreaAddress(top)->CreateBlackAreaBackground(top, limit);
+  }
+
+  HeapObject object = HeapObject::FromAddress(result->first);
+  LocalAllocationBuffer saved_lab = std::move(lab_);
+  lab_ = LocalAllocationBuffer::FromResult(
+      local_heap_->heap(), AllocationResult(object), result->second);
+  DCHECK(lab_.IsValid());
+  if (!lab_.TryMerge(&saved_lab)) {
+    saved_lab.CloseAndMakeIterable();
+  }
+  return true;
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_CONCURRENT_ALLOCATOR_INL_H_
diff --git a/deps/v8/src/heap/concurrent-allocator.cc b/deps/v8/src/heap/concurrent-allocator.cc
new file mode 100644
index 00000000000..ab00d2b16d1
--- /dev/null
+++ b/deps/v8/src/heap/concurrent-allocator.cc
@@ -0,0 +1,82 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/concurrent-allocator.h"
+
+#include "src/heap/concurrent-allocator-inl.h"
+#include "src/heap/local-heap.h"
+#include "src/heap/marking.h"
+
+namespace v8 {
+namespace internal {
+
+Address ConcurrentAllocator::PerformCollectionAndAllocateAgain(
+    int object_size, AllocationAlignment alignment, AllocationOrigin origin) {
+  Heap* heap = local_heap_->heap();
+  local_heap_->allocation_failed_ = true;
+
+  for (int i = 0; i < 3; i++) {
+    {
+      ParkedScope scope(local_heap_);
+      heap->RequestAndWaitForCollection();
+    }
+
+    AllocationResult result = Allocate(object_size, alignment, origin);
+    if (!result.IsRetry()) {
+      local_heap_->allocation_failed_ = false;
+      return result.ToObjectChecked().address();
+    }
+  }
+
+  heap->FatalProcessOutOfMemory("ConcurrentAllocator: allocation failed");
+}
+
+void ConcurrentAllocator::FreeLinearAllocationArea() {
+  lab_.CloseAndMakeIterable();
+}
+
+void ConcurrentAllocator::MakeLinearAllocationAreaIterable() {
+  lab_.MakeIterable();
+}
+
+void ConcurrentAllocator::MarkLinearAllocationAreaBlack() {
+  Address top = lab_.top();
+  Address limit = lab_.limit();
+
+  if (top != kNullAddress && top != limit) {
+    Page::FromAllocationAreaAddress(top)->CreateBlackAreaBackground(top, limit);
+  }
+}
+
+void ConcurrentAllocator::UnmarkLinearAllocationArea() {
+  Address top = lab_.top();
+  Address limit = lab_.limit();
+
+  if (top != kNullAddress && top != limit) {
+    Page::FromAllocationAreaAddress(top)->DestroyBlackAreaBackground(top,
+                                                                     limit);
+  }
+}
+
+AllocationResult ConcurrentAllocator::AllocateOutsideLab(
+    int object_size, AllocationAlignment alignment, AllocationOrigin origin) {
+  auto result = space_->SlowGetLinearAllocationAreaBackground(
+      local_heap_, object_size, object_size, alignment, origin);
+
+  if (result) {
+    HeapObject object = HeapObject::FromAddress(result->first);
+
+    if (local_heap_->heap()->incremental_marking()->black_allocation()) {
+      local_heap_->heap()->incremental_marking()->MarkBlackBackground(
+          object, object_size);
+    }
+
+    return AllocationResult(object);
+  } else {
+    return AllocationResult::Retry(OLD_SPACE);
+  }
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/heap/concurrent-allocator.h b/deps/v8/src/heap/concurrent-allocator.h
new file mode 100644
index 00000000000..f877bd9f5d2
--- /dev/null
+++ b/deps/v8/src/heap/concurrent-allocator.h
@@ -0,0 +1,62 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CONCURRENT_ALLOCATOR_H_
+#define V8_HEAP_CONCURRENT_ALLOCATOR_H_
+
+#include "src/common/globals.h"
+#include "src/heap/heap.h"
+#include "src/heap/spaces.h"
+
+namespace v8 {
+namespace internal {
+
+class LocalHeap;
+
+// Concurrent allocator for allocation from background threads/tasks.
+// Allocations are served from a TLAB if possible.
+class ConcurrentAllocator {
+ public:
+  static const int kLabSize = 4 * KB;
+  static const int kMaxLabSize = 32 * KB;
+  static const int kMaxLabObjectSize = 2 * KB;
+
+  explicit ConcurrentAllocator(LocalHeap* local_heap, PagedSpace* space)
+      : local_heap_(local_heap),
+        space_(space),
+        lab_(LocalAllocationBuffer::InvalidBuffer()) {}
+
+  inline AllocationResult Allocate(int object_size,
+                                   AllocationAlignment alignment,
+                                   AllocationOrigin origin);
+
+  inline Address AllocateOrFail(int object_size, AllocationAlignment alignment,
+                                AllocationOrigin origin);
+
+  void FreeLinearAllocationArea();
+  void MakeLinearAllocationAreaIterable();
+  void MarkLinearAllocationAreaBlack();
+  void UnmarkLinearAllocationArea();
+
+ private:
+  inline bool EnsureLab(AllocationOrigin origin);
+  inline AllocationResult AllocateInLab(int object_size,
+                                        AllocationAlignment alignment,
+                                        AllocationOrigin origin);
+
+  V8_EXPORT_PRIVATE AllocationResult AllocateOutsideLab(
+      int object_size, AllocationAlignment alignment, AllocationOrigin origin);
+
+  V8_EXPORT_PRIVATE Address PerformCollectionAndAllocateAgain(
+      int object_size, AllocationAlignment alignment, AllocationOrigin origin);
+
+  LocalHeap* const local_heap_;
+  PagedSpace* const space_;
+  LocalAllocationBuffer lab_;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_CONCURRENT_ALLOCATOR_H_
diff --git a/deps/v8/src/heap/concurrent-marking.cc b/deps/v8/src/heap/concurrent-marking.cc
index 562719c07fc..45485cf41f0 100644
--- a/deps/v8/src/heap/concurrent-marking.cc
+++ b/deps/v8/src/heap/concurrent-marking.cc
@@ -17,6 +17,7 @@
 #include "src/heap/marking-visitor-inl.h"
 #include "src/heap/marking-visitor.h"
 #include "src/heap/marking.h"
+#include "src/heap/memory-chunk.h"
 #include "src/heap/memory-measurement-inl.h"
 #include "src/heap/memory-measurement.h"
 #include "src/heap/objects-visiting-inl.h"
@@ -43,7 +44,7 @@ class ConcurrentMarkingState final
   ConcurrentBitmap<AccessMode::ATOMIC>* bitmap(const MemoryChunk* chunk) {
     DCHECK_EQ(reinterpret_cast<intptr_t>(&chunk->marking_bitmap_) -
                   reinterpret_cast<intptr_t>(chunk),
-              MemoryChunk::kMarkBitmapOffset);
+              BasicMemoryChunk::kMarkBitmapOffset);
     return chunk->marking_bitmap<AccessMode::ATOMIC>();
   }
 
diff --git a/deps/v8/src/heap/concurrent-marking.h b/deps/v8/src/heap/concurrent-marking.h
index 24bcae20a67..3ab07a60731 100644
--- a/deps/v8/src/heap/concurrent-marking.h
+++ b/deps/v8/src/heap/concurrent-marking.h
@@ -28,6 +28,7 @@ namespace internal {
 class Heap;
 class Isolate;
 class MajorNonAtomicMarkingState;
+class MemoryChunk;
 struct WeakObjects;
 
 struct MemoryChunkData {
diff --git a/deps/v8/src/heap/cppgc/allocation.cc b/deps/v8/src/heap/cppgc/allocation.cc
index 7e98d1eec98..32f917da5ac 100644
--- a/deps/v8/src/heap/cppgc/allocation.cc
+++ b/deps/v8/src/heap/cppgc/allocation.cc
@@ -11,6 +11,9 @@
 namespace cppgc {
 namespace internal {
 
+STATIC_ASSERT(api_constants::kLargeObjectSizeThreshold ==
+              kLargeObjectSizeThreshold);
+
 // static
 void* MakeGarbageCollectedTraitInternal::Allocate(cppgc::Heap* heap,
                                                   size_t size,
@@ -19,5 +22,13 @@ void* MakeGarbageCollectedTraitInternal::Allocate(cppgc::Heap* heap,
   return Heap::From(heap)->Allocate(size, index);
 }
 
+// static
+void* MakeGarbageCollectedTraitInternal::Allocate(
+    cppgc::Heap* heap, size_t size, GCInfoIndex index,
+    CustomSpaceIndex space_index) {
+  DCHECK_NOT_NULL(heap);
+  return Heap::From(heap)->Allocate(size, index, space_index);
+}
+
 }  // namespace internal
 }  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/asm/arm/push_registers_asm.cc b/deps/v8/src/heap/cppgc/asm/arm/push_registers_asm.cc
new file mode 100644
index 00000000000..5246c3f6c3e
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/asm/arm/push_registers_asm.cc
@@ -0,0 +1,39 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Push all callee-saved registers to get them on the stack for conservative
+// stack scanning.
+//
+// See asm/x64/push_registers_clang.cc for why the function is not generated
+// using clang.
+//
+// Do not depend on V8_TARGET_OS_* defines as some embedders may override the
+// GN toolchain (e.g. ChromeOS) and not provide them.
+
+// We maintain 8-byte alignment at calls by pushing an additional
+// non-callee-saved register (r3).
+//
+// Calling convention source:
+// https://en.wikipedia.org/wiki/Calling_convention#ARM_(A32)
+// http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.faqs/ka4127.html
+asm(".globl PushAllRegistersAndIterateStack             \n"
+    ".type PushAllRegistersAndIterateStack, %function   \n"
+    ".hidden PushAllRegistersAndIterateStack            \n"
+    "PushAllRegistersAndIterateStack:                   \n"
+    // Push all callee-saved registers and save return address.
+    // Only {r4-r11} are callee-saved registers. Push r3 in addition to align
+    // the stack back to 8 bytes.
+    "  push {r3-r11, lr}                                \n"
+    // Pass 1st parameter (r0) unchanged (Stack*).
+    // Pass 2nd parameter (r1) unchanged (StackVisitor*).
+    // Save 3rd parameter (r2; IterateStackCallback).
+    "  mov r3, r2                                       \n"
+    // Pass 3rd parameter as sp (stack pointer).
+    "  mov r2, sp                                       \n"
+    // Call the callback.
+    "  blx r3                                           \n"
+    // Discard all the registers.
+    "  add sp, sp, #36                                  \n"
+    // Pop lr into pc which returns and switches mode if needed.
+    "  pop {pc}                                         \n");
diff --git a/deps/v8/src/heap/cppgc/asm/arm64/push_registers_asm.cc b/deps/v8/src/heap/cppgc/asm/arm64/push_registers_asm.cc
new file mode 100644
index 00000000000..30d4de1f308
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/asm/arm64/push_registers_asm.cc
@@ -0,0 +1,52 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Push all callee-saved registers to get them on the stack for conservative
+// stack scanning.
+//
+// See asm/x64/push_registers_clang.cc for why the function is not generated
+// using clang.
+//
+// Do not depend on V8_TARGET_OS_* defines as some embedders may override the
+// GN toolchain (e.g. ChromeOS) and not provide them.
+
+// We maintain 16-byte alignment.
+//
+// Calling convention source:
+// https://en.wikipedia.org/wiki/Calling_convention#ARM_(A64)
+
+asm(
+#if defined(__APPLE__)
+    ".globl _PushAllRegistersAndIterateStack            \n"
+    ".private_extern _PushAllRegistersAndIterateStack   \n"
+    "_PushAllRegistersAndIterateStack:                  \n"
+#else  // !defined(__APPLE__)
+    ".globl PushAllRegistersAndIterateStack             \n"
+#if !defined(_WIN64)
+    ".type PushAllRegistersAndIterateStack, %function   \n"
+    ".hidden PushAllRegistersAndIterateStack            \n"
+#endif  // !defined(_WIN64)
+    "PushAllRegistersAndIterateStack:                   \n"
+#endif  // !defined(__APPLE__)
+    // x19-x29 are callee-saved.
+    "  stp x19, x20, [sp, #-16]!                        \n"
+    "  stp x21, x22, [sp, #-16]!                        \n"
+    "  stp x23, x24, [sp, #-16]!                        \n"
+    "  stp x25, x26, [sp, #-16]!                        \n"
+    "  stp x27, x28, [sp, #-16]!                        \n"
+    "  stp fp, lr,   [sp, #-16]!                        \n"
+    // Maintain frame pointer.
+    "  mov fp, sp                                       \n"
+    // Pass 1st parameter (x0) unchanged (Stack*).
+    // Pass 2nd parameter (x1) unchanged (StackVisitor*).
+    // Save 3rd parameter (x2; IterateStackCallback)
+    "  mov x7, x2                                       \n"
+    // Pass 3rd parameter as sp (stack pointer).
+    "  mov x2, sp                                       \n"
+    "  blr x7                                           \n"
+    // Load return address.
+    "  ldr lr, [sp, #8]                                 \n"
+    // Restore frame pointer and pop all callee-saved registers.
+    "  ldr fp, [sp], #96                                \n"
+    "  ret                                              \n");
diff --git a/deps/v8/src/heap/cppgc/asm/arm64/push_registers_masm.S b/deps/v8/src/heap/cppgc/asm/arm64/push_registers_masm.S
new file mode 100644
index 00000000000..9773654ffcf
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/asm/arm64/push_registers_masm.S
@@ -0,0 +1,32 @@
+; Copyright 2020 the V8 project authors. All rights reserved.
+; Use of this source code is governed by a BSD-style license that can be
+; found in the LICENSE file.
+
+; This file is exactly the same as push_registers_asm.cc, just formatted for
+; the Microsoft Arm Assembler.
+
+    AREA |.text|, CODE, ALIGN=4, READONLY
+    EXPORT PushAllRegistersAndIterateStack
+PushAllRegistersAndIterateStack
+    ; x19-x29 are callee-saved
+    STP x19, x20, [sp, #-16]!
+    STP x21, x22, [sp, #-16]!
+    STP x23, x24, [sp, #-16]!
+    STP x25, x26, [sp, #-16]!
+    STP x27, x28, [sp, #-16]!
+    STP fp, lr, [sp, #-16]!
+    ; Maintain frame pointer
+    MOV fp, sp
+    ; Pass 1st parameter (x0) unchanged (Stack*).
+    ; Pass 2nd parameter (x1) unchanged (StackVisitor*).
+    ; Save 3rd parameter (x2; IterateStackCallback)
+    MOV x7, x2
+    ; Pass 3rd parameter as sp (stack pointer)
+    MOV x2, sp
+    BLR x7
+    ; Load return address
+    LDR lr, [sp, #8]
+    ; Restore frame pointer and pop all callee-saved registers.
+    LDR fp, [sp], #96
+    RET
+    END
\ No newline at end of file
diff --git a/deps/v8/src/heap/cppgc/asm/ia32/push_registers_asm.cc b/deps/v8/src/heap/cppgc/asm/ia32/push_registers_asm.cc
new file mode 100644
index 00000000000..ed9c14a50e9
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/asm/ia32/push_registers_asm.cc
@@ -0,0 +1,53 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Push all callee-saved registers to get them on the stack for conservative
+// stack scanning.
+//
+// See asm/x64/push_registers_clang.cc for why the function is not generated
+// using clang.
+//
+// Do not depend on V8_TARGET_OS_* defines as some embedders may override the
+// GN toolchain (e.g. ChromeOS) and not provide them.
+
+// We maintain 16-byte alignment at calls. There is an 4-byte return address
+// on the stack and we push 28 bytes which maintains 16-byte stack alignment
+// at the call.
+//
+// The following assumes cdecl calling convention.
+// Source: https://en.wikipedia.org/wiki/X86_calling_conventions#cdecl
+asm(
+#ifdef _WIN32
+    ".globl _PushAllRegistersAndIterateStack            \n"
+    "_PushAllRegistersAndIterateStack:                  \n"
+#else   // !_WIN32
+    ".globl PushAllRegistersAndIterateStack             \n"
+    ".type PushAllRegistersAndIterateStack, %function   \n"
+    ".hidden PushAllRegistersAndIterateStack            \n"
+    "PushAllRegistersAndIterateStack:                   \n"
+#endif  // !_WIN32
+    // [ IterateStackCallback ]
+    // [ StackVisitor*        ]
+    // [ Stack*               ]
+    // [ ret                  ]
+    // ebp is callee-saved. Maintain proper frame pointer for debugging.
+    "  push %ebp                                        \n"
+    "  movl %esp, %ebp                                  \n"
+    "  push %ebx                                        \n"
+    "  push %esi                                        \n"
+    "  push %edi                                        \n"
+    // Save 3rd parameter (IterateStackCallback).
+    "  movl 28(%esp), %ecx                              \n"
+    // Pass 3rd parameter as esp (stack pointer).
+    "  push %esp                                        \n"
+    // Pass 2nd parameter (StackVisitor*).
+    "  push 28(%esp)                                    \n"
+    // Pass 1st parameter (Stack*).
+    "  push 28(%esp)                                    \n"
+    "  call *%ecx                                       \n"
+    // Pop the callee-saved registers.
+    "  addl $24, %esp                                   \n"
+    // Restore rbp as it was used as frame pointer.
+    "  pop %ebp                                         \n"
+    "  ret                                              \n");
diff --git a/deps/v8/src/heap/cppgc/asm/ia32/push_registers_masm.S b/deps/v8/src/heap/cppgc/asm/ia32/push_registers_masm.S
new file mode 100644
index 00000000000..a35fd6e527d
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/asm/ia32/push_registers_masm.S
@@ -0,0 +1,48 @@
+;; Copyright 2020 the V8 project authors. All rights reserved.
+;; Use of this source code is governed by a BSD-style license that can be
+;; found in the LICENSE file.
+
+;; MASM syntax
+;; https://docs.microsoft.com/en-us/cpp/assembler/masm/microsoft-macro-assembler-reference?view=vs-2019
+
+.model flat, C
+
+public PushAllRegistersAndIterateStack
+
+.code
+PushAllRegistersAndIterateStack:
+    ;; Push all callee-saved registers to get them on the stack for conservative
+    ;; stack scanning.
+    ;;
+    ;; We maintain 16-byte alignment at calls. There is an 8-byte return address
+    ;; on the stack and we push 72 bytes which maintains 16-byte stack alignment
+    ;; at the call.
+    ;;
+    ;; The following assumes cdecl calling convention.
+    ;; Source: https://docs.microsoft.com/en-us/cpp/cpp/cdecl?view=vs-2019
+    ;;
+    ;; [ IterateStackCallback ]
+    ;; [ StackVisitor*        ]
+    ;; [ Stack*               ]
+    ;; [ ret                  ]
+    push ebp
+    mov ebp, esp
+    push ebx
+    push esi
+    push edi
+    ;; Save 3rd parameter (IterateStackCallback).
+    mov ecx, [ esp + 28 ]
+    ;; Pass 3rd parameter as esp (stack pointer).
+    push esp
+    ;; Pass 2nd parameter (StackVisitor*).
+    push [ esp + 28 ]
+    ;; Pass 1st parameter (Stack*).
+    push [ esp + 28 ]
+    call ecx
+    ;; Pop the callee-saved registers.
+    add esp, 24
+    ;; Restore rbp as it was used as frame pointer.
+    pop ebp
+    ret
+
+end
diff --git a/deps/v8/src/heap/cppgc/asm/mips/push_registers_asm.cc b/deps/v8/src/heap/cppgc/asm/mips/push_registers_asm.cc
new file mode 100644
index 00000000000..4a46caa6c52
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/asm/mips/push_registers_asm.cc
@@ -0,0 +1,48 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Push all callee-saved registers to get them on the stack for conservative
+// stack scanning.
+//
+// See asm/x64/push_registers_clang.cc for why the function is not generated
+// using clang.
+//
+// Do not depend on V8_TARGET_OS_* defines as some embedders may override the
+// GN toolchain (e.g. ChromeOS) and not provide them.
+asm(".set noreorder                                      \n"
+    ".global PushAllRegistersAndIterateStack             \n"
+    ".type PushAllRegistersAndIterateStack, %function    \n"
+    ".hidden PushAllRegistersAndIterateStack             \n"
+    "PushAllRegistersAndIterateStack:                    \n"
+    // Push all callee-saved registers and save return address.
+    "  addiu $sp, $sp, -48                               \n"
+    "  sw $ra, 44($sp)                                   \n"
+    "  sw $s8, 40($sp)                                   \n"
+    "  sw $sp, 36($sp)                                   \n"
+    "  sw $gp, 32($sp)                                   \n"
+    "  sw $s7, 28($sp)                                   \n"
+    "  sw $s6, 24($sp)                                   \n"
+    "  sw $s5, 20($sp)                                   \n"
+    "  sw $s4, 16($sp)                                   \n"
+    "  sw $s3, 12($sp)                                   \n"
+    "  sw $s2,  8($sp)                                   \n"
+    "  sw $s1,  4($sp)                                   \n"
+    "  sw $s0,  0($sp)                                   \n"
+    // Maintain frame pointer.
+    "  move $s8, $sp                                     \n"
+    // Pass 1st parameter (a0) unchanged (Stack*).
+    // Pass 2nd parameter (a1) unchanged (StackVisitor*).
+    // Save 3rd parameter (a2; IterateStackCallback).
+    "  move $a3, $a2                                     \n"
+    // Call the callback.
+    "  jalr $a3                                          \n"
+    // Delay slot: Pass 3rd parameter as sp (stack pointer).
+    "  move $a2, $sp                                     \n"
+    // Load return address.
+    "  lw $ra, 44($sp)                                   \n"
+    // Restore frame pointer.
+    "  lw $s8, 40($sp)                                   \n"
+    "  jr $ra                                            \n"
+    // Delay slot: Discard all callee-saved registers.
+    "  addiu $sp, $sp, 48                                \n");
diff --git a/deps/v8/src/heap/cppgc/asm/mips64/push_registers_asm.cc b/deps/v8/src/heap/cppgc/asm/mips64/push_registers_asm.cc
new file mode 100644
index 00000000000..6befa3bcc0c
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/asm/mips64/push_registers_asm.cc
@@ -0,0 +1,48 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Push all callee-saved registers to get them on the stack for conservative
+// stack scanning.
+//
+// See asm/x64/push_registers_clang.cc for why the function is not generated
+// using clang.
+//
+// Do not depend on V8_TARGET_OS_* defines as some embedders may override the
+// GN toolchain (e.g. ChromeOS) and not provide them.
+asm(".set noreorder                                      \n"
+    ".global PushAllRegistersAndIterateStack             \n"
+    ".type PushAllRegistersAndIterateStack, %function    \n"
+    ".hidden PushAllRegistersAndIterateStack             \n"
+    "PushAllRegistersAndIterateStack:                    \n"
+    // Push all callee-saved registers and save return address.
+    "  daddiu $sp, $sp, -96                              \n"
+    "  sd $ra, 88($sp)                                   \n"
+    "  sd $s8, 80($sp)                                   \n"
+    "  sd $sp, 72($sp)                                   \n"
+    "  sd $gp, 64($sp)                                   \n"
+    "  sd $s7, 56($sp)                                   \n"
+    "  sd $s6, 48($sp)                                   \n"
+    "  sd $s5, 40($sp)                                   \n"
+    "  sd $s4, 32($sp)                                   \n"
+    "  sd $s3, 24($sp)                                   \n"
+    "  sd $s2, 16($sp)                                   \n"
+    "  sd $s1,  8($sp)                                   \n"
+    "  sd $s0,  0($sp)                                   \n"
+    // Maintain frame pointer.
+    "  move $s8, $sp                                     \n"
+    // Pass 1st parameter (a0) unchanged (Stack*).
+    // Pass 2nd parameter (a1) unchanged (StackVisitor*).
+    // Save 3rd parameter (a2; IterateStackCallback).
+    "  move $a3, $a2                                     \n"
+    // Call the callback.
+    "  jalr $a3                                          \n"
+    // Delay slot: Pass 3rd parameter as sp (stack pointer).
+    "  move $a2, $sp                                     \n"
+    // Load return address.
+    "  ld $ra, 88($sp)                                   \n"
+    // Restore frame pointer.
+    "  ld $s8, 80($sp)                                   \n"
+    "  jr $ra                                            \n"
+    // Delay slot: Discard all callee-saved registers.
+    "  daddiu $sp, $sp, 96                               \n");
diff --git a/deps/v8/src/heap/cppgc/asm/ppc/push_registers_asm.cc b/deps/v8/src/heap/cppgc/asm/ppc/push_registers_asm.cc
new file mode 100644
index 00000000000..6936819ba2b
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/asm/ppc/push_registers_asm.cc
@@ -0,0 +1,94 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Push all callee-saved registers to get them on the stack for conservative
+// stack scanning.
+//
+// See asm/x64/push_registers_clang.cc for why the function is not generated
+// using clang.
+
+// Do not depend on V8_TARGET_OS_* defines as some embedders may override the
+// GN toolchain (e.g. ChromeOS) and not provide them.
+
+// PPC ABI source:
+// http://refspecs.linuxfoundation.org/ELF/ppc64/PPC-elf64abi.html
+
+// AIX Runtime process stack:
+// https://www.ibm.com/support/knowledgecenter/ssw_aix_71/assembler/idalangref_runtime_process.html
+asm(
+#if defined(_AIX)
+    ".globl .PushAllRegistersAndIterateStack, hidden    \n"
+    ".csect .text[PR]                                   \n"
+    ".PushAllRegistersAndIterateStack:                  \n"
+#else
+    ".globl PushAllRegistersAndIterateStack             \n"
+    ".type PushAllRegistersAndIterateStack, %function   \n"
+    ".hidden PushAllRegistersAndIterateStack            \n"
+    "PushAllRegistersAndIterateStack:                   \n"
+#endif
+    // Push all callee-saved registers.
+    // lr, TOC pointer, r16 to r31. 160 bytes.
+    // The parameter save area shall be allocated by the caller. 112 btes.
+    // At anytime, SP (r1) needs to be multiple of 16 (i.e. 16-aligned).
+    "  mflr 0                                          \n"
+    "  std 0, 16(1)                                    \n"
+#if defined(_AIX)
+    "  std 2, 40(1)                                    \n"
+#else
+    "  std 2, 24(1)                                    \n"
+#endif
+    "  stdu 1, -256(1)                                 \n"
+    "  std 14, 112(1)                                  \n"
+    "  std 15, 120(1)                                  \n"
+    "  std 16, 128(1)                                  \n"
+    "  std 17, 136(1)                                  \n"
+    "  std 18, 144(1)                                  \n"
+    "  std 19, 152(1)                                  \n"
+    "  std 20, 160(1)                                  \n"
+    "  std 21, 168(1)                                  \n"
+    "  std 22, 176(1)                                  \n"
+    "  std 23, 184(1)                                  \n"
+    "  std 24, 192(1)                                  \n"
+    "  std 25, 200(1)                                  \n"
+    "  std 26, 208(1)                                  \n"
+    "  std 27, 216(1)                                  \n"
+    "  std 28, 224(1)                                  \n"
+    "  std 29, 232(1)                                  \n"
+    "  std 30, 240(1)                                  \n"
+    "  std 31, 248(1)                                  \n"
+    // Pass 1st parameter (r3) unchanged (Stack*).
+    // Pass 2nd parameter (r4) unchanged (StackVisitor*).
+    // Save 3rd parameter (r5; IterateStackCallback).
+    "  mr 6, 5                                         \n"
+#if defined(_AIX)
+    // Set up TOC for callee.
+    "  ld 2,8(5)                                       \n"
+    // AIX uses function decorators, which means that
+    // pointers to functions do not point to code, but
+    //  instead point to metadata about them, hence
+    // need to deterrence.
+    "  ld 6,0(6)                                       \n"
+#endif
+    // Pass 3rd parameter as sp (stack pointer).
+    "  mr 5, 1                                         \n"
+#if !defined(_AIX)
+    // Set up r12 to be equal to the callee address (in order for TOC
+    // relocation). Only needed on LE Linux.
+    "  mr 12, 6                                        \n"
+#endif
+    // Call the callback.
+    "  mtctr 6                                         \n"
+    "  bctrl                                           \n"
+    // Discard all the registers.
+    "  addi 1, 1, 256                                  \n"
+    // Restore lr.
+    "  ld 0, 16(1)                                     \n"
+    "  mtlr  0                                         \n"
+#if defined(_AIX)
+    // Restore TOC pointer.
+    "  ld 2, 40(1)                                     \n"
+#else
+    "  ld 2, 24(1)                                     \n"
+#endif
+    "  blr                                             \n");
diff --git a/deps/v8/src/heap/cppgc/asm/s390/push_registers_asm.cc b/deps/v8/src/heap/cppgc/asm/s390/push_registers_asm.cc
new file mode 100644
index 00000000000..6b9b2c08536
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/asm/s390/push_registers_asm.cc
@@ -0,0 +1,35 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Push all callee-saved registers to get them on the stack for conservative
+// stack scanning.
+
+// See asm/x64/push_registers_clang.cc for why the function is not generated
+// using clang.
+
+// Do not depend on V8_TARGET_OS_* defines as some embedders may override the
+// GN toolchain (e.g. ChromeOS) and not provide them.
+
+// S390 ABI source:
+// http://refspecs.linuxbase.org/ELF/zSeries/lzsabi0_zSeries.html
+asm(".globl PushAllRegistersAndIterateStack             \n"
+    ".type PushAllRegistersAndIterateStack, %function   \n"
+    ".hidden PushAllRegistersAndIterateStack            \n"
+    "PushAllRegistersAndIterateStack:                   \n"
+    // Push all callee-saved registers.
+    // r6-r13, r14 and sp(r15)
+    "  stmg %r6, %sp, 48(%sp)                           \n"
+    // Allocate frame.
+    "  lay %sp, -160(%sp)                               \n"
+    // Pass 1st parameter (r2) unchanged (Stack*).
+    // Pass 2nd parameter (r3) unchanged (StackVisitor*).
+    // Save 3rd parameter (r4; IterateStackCallback).
+    "  lgr %r5, %r4                                     \n"
+    // Pass sp as 3rd parameter. 160+48 to point
+    // to callee saved region stored above.
+    "  lay %r4, 208(%sp)                                \n"
+    // Call the callback.
+    "  basr %r14, %r5                                   \n"
+    "  lmg %r14,%sp, 272(%sp)                           \n"
+    "  br %r14                                          \n");
diff --git a/deps/v8/src/heap/cppgc/asm/x64/push_registers.S b/deps/v8/src/heap/cppgc/asm/x64/push_registers.S
deleted file mode 100644
index 018859d5c09..00000000000
--- a/deps/v8/src/heap/cppgc/asm/x64/push_registers.S
+++ /dev/null
@@ -1,52 +0,0 @@
-// Copyright 2020 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-.att_syntax
-
-.text
-
-#ifdef V8_TARGET_OS_MACOSX
-
-.globl _PushAllRegistersAndIterateStack
-_PushAllRegistersAndIterateStack:
-
-#else  // !V8_TARGET_OS_MACOSX
-
-.type PushAllRegistersAndIterateStack, %function
-.global PushAllRegistersAndIterateStack
-.hidden PushAllRegistersAndIterateStack
-PushAllRegistersAndIterateStack:
-
-#endif  // !V8_TARGET_OS_MACOSX
-
-    // Push all callee-saved registers to get them on the stack for conservative
-    // stack scanning.
-    //
-    // We maintain 16-byte alignment at calls. There is an 8-byte return address
-    // on the stack and we push 56 bytes which maintains 16-byte stack alignment
-    // at the call.
-    // Source: https://github.com/hjl-tools/x86-psABI/wiki/x86-64-psABI-1.0.pdf
-    //
-    // rbp is callee-saved. Maintain proper frame pointer for debugging.
-    push %rbp
-    mov %rsp, %rbp
-    push $0xCDCDCD  // Dummy for alignment.
-    push %rbx
-    push %r12
-    push %r13
-    push %r14
-    push %r15
-    // Pass 1st parameter (rdi) unchanged (Stack*).
-    // Pass 2nd parameter (rsi) unchanged (StackVisitor*).
-    // Save 3rd parameter (rdx; IterateStackCallback)
-    mov %rdx, %r8
-    // Pass 3rd parameter as rsp (stack pointer).
-    mov %rsp, %rdx
-    // Call the callback.
-    call *%r8
-    // Pop the callee-saved registers.
-    add $48, %rsp
-    // Restore rbp as it was used as frame pointer.
-    pop %rbp
-    ret
diff --git a/deps/v8/src/heap/cppgc/asm/x64/push_registers_asm.cc b/deps/v8/src/heap/cppgc/asm/x64/push_registers_asm.cc
new file mode 100644
index 00000000000..68f7918c93c
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/asm/x64/push_registers_asm.cc
@@ -0,0 +1,94 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Push all callee-saved registers to get them on the stack for conservative
+// stack scanning.
+//
+// We cannot rely on clang generating the function and right symbol mangling
+// as `__attribite__((naked))` does not prevent clang from generating TSAN
+// function entry stubs (`__tsan_func_entry`). Even with
+// `__attribute__((no_sanitize_thread)` annotation clang generates the entry
+// stub.
+// See https://bugs.llvm.org/show_bug.cgi?id=45400.
+
+// Do not depend on V8_TARGET_OS_* defines as some embedders may override the
+// GN toolchain (e.g. ChromeOS) and not provide them.
+// _WIN64 Defined as 1 when the compilation target is 64-bit ARM or x64.
+// Otherwise, undefined.
+#ifdef _WIN64
+
+// We maintain 16-byte alignment at calls. There is an 8-byte return address
+// on the stack and we push 72 bytes which maintains 16-byte stack alignment
+// at the call.
+// Source: https://docs.microsoft.com/en-us/cpp/build/x64-calling-convention
+asm(".globl PushAllRegistersAndIterateStack             \n"
+    "PushAllRegistersAndIterateStack:                   \n"
+    // rbp is callee-saved. Maintain proper frame pointer for debugging.
+    "  push %rbp                                        \n"
+    "  mov %rsp, %rbp                                   \n"
+    // Dummy for alignment.
+    "  push $0xCDCDCD                                   \n"
+    "  push %rsi                                        \n"
+    "  push %rdi                                        \n"
+    "  push %rbx                                        \n"
+    "  push %r12                                        \n"
+    "  push %r13                                        \n"
+    "  push %r14                                        \n"
+    "  push %r15                                        \n"
+    // Pass 1st parameter (rcx) unchanged (Stack*).
+    // Pass 2nd parameter (rdx) unchanged (StackVisitor*).
+    // Save 3rd parameter (r8; IterateStackCallback)
+    "  mov %r8, %r9                                     \n"
+    // Pass 3rd parameter as rsp (stack pointer).
+    "  mov %rsp, %r8                                    \n"
+    // Call the callback.
+    "  call *%r9                                        \n"
+    // Pop the callee-saved registers.
+    "  add $64, %rsp                                    \n"
+    // Restore rbp as it was used as frame pointer.
+    "  pop %rbp                                         \n"
+    "  ret                                              \n");
+
+#else  // !_WIN64
+
+// We maintain 16-byte alignment at calls. There is an 8-byte return address
+// on the stack and we push 56 bytes which maintains 16-byte stack alignment
+// at the call.
+// Source: https://github.com/hjl-tools/x86-psABI/wiki/x86-64-psABI-1.0.pdf
+asm(
+#ifdef __APPLE__
+    ".globl _PushAllRegistersAndIterateStack            \n"
+    ".private_extern _PushAllRegistersAndIterateStack   \n"
+    "_PushAllRegistersAndIterateStack:                  \n"
+#else   // !__APPLE__
+    ".globl PushAllRegistersAndIterateStack             \n"
+    ".type PushAllRegistersAndIterateStack, %function   \n"
+    ".hidden PushAllRegistersAndIterateStack            \n"
+    "PushAllRegistersAndIterateStack:                   \n"
+#endif  // !__APPLE__
+    // rbp is callee-saved. Maintain proper frame pointer for debugging.
+    "  push %rbp                                        \n"
+    "  mov %rsp, %rbp                                   \n"
+    // Dummy for alignment.
+    "  push $0xCDCDCD                                   \n"
+    "  push %rbx                                        \n"
+    "  push %r12                                        \n"
+    "  push %r13                                        \n"
+    "  push %r14                                        \n"
+    "  push %r15                                        \n"
+    // Pass 1st parameter (rdi) unchanged (Stack*).
+    // Pass 2nd parameter (rsi) unchanged (StackVisitor*).
+    // Save 3rd parameter (rdx; IterateStackCallback)
+    "  mov %rdx, %r8                                    \n"
+    // Pass 3rd parameter as rsp (stack pointer).
+    "  mov %rsp, %rdx                                   \n"
+    // Call the callback.
+    "  call *%r8                                        \n"
+    // Pop the callee-saved registers.
+    "  add $48, %rsp                                    \n"
+    // Restore rbp as it was used as frame pointer.
+    "  pop %rbp                                         \n"
+    "  ret                                              \n");
+
+#endif  // !_WIN64
diff --git a/deps/v8/src/heap/cppgc/asm/x64/push_registers_win.S b/deps/v8/src/heap/cppgc/asm/x64/push_registers_masm.S
similarity index 100%
rename from deps/v8/src/heap/cppgc/asm/x64/push_registers_win.S
rename to deps/v8/src/heap/cppgc/asm/x64/push_registers_masm.S
diff --git a/deps/v8/src/heap/cppgc/free-list.cc b/deps/v8/src/heap/cppgc/free-list.cc
new file mode 100644
index 00000000000..e5e6b70793d
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/free-list.cc
@@ -0,0 +1,190 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/free-list.h"
+
+#include <algorithm>
+
+#include "include/cppgc/internal/logging.h"
+#include "src/base/bits.h"
+#include "src/heap/cppgc/globals.h"
+#include "src/heap/cppgc/heap-object-header-inl.h"
+#include "src/heap/cppgc/sanitizers.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+uint32_t BucketIndexForSize(uint32_t size) {
+  return v8::base::bits::WhichPowerOfTwo(
+      v8::base::bits::RoundDownToPowerOfTwo32(size));
+}
+}  // namespace
+
+class FreeList::Entry : public HeapObjectHeader {
+ public:
+  explicit Entry(size_t size) : HeapObjectHeader(size, kFreeListGCInfoIndex) {
+    static_assert(sizeof(Entry) == kFreeListEntrySize, "Sizes must match");
+  }
+
+  Entry* Next() const { return next_; }
+  void SetNext(Entry* next) { next_ = next; }
+
+  void Link(Entry** previous_next) {
+    next_ = *previous_next;
+    *previous_next = this;
+  }
+  void Unlink(Entry** previous_next) {
+    *previous_next = next_;
+    next_ = nullptr;
+  }
+
+ private:
+  Entry* next_ = nullptr;
+};
+
+FreeList::FreeList() { Clear(); }
+
+FreeList::FreeList(FreeList&& other) V8_NOEXCEPT
+    : free_list_heads_(std::move(other.free_list_heads_)),
+      free_list_tails_(std::move(other.free_list_tails_)),
+      biggest_free_list_index_(std::move(other.biggest_free_list_index_)) {
+  other.Clear();
+}
+
+FreeList& FreeList::operator=(FreeList&& other) V8_NOEXCEPT {
+  Clear();
+  Append(std::move(other));
+  DCHECK(other.IsEmpty());
+  return *this;
+}
+
+void FreeList::Add(FreeList::Block block) {
+  const size_t size = block.size;
+  DCHECK_GT(kPageSize, size);
+  DCHECK_LE(sizeof(HeapObjectHeader), size);
+
+  if (block.size < sizeof(Entry)) {
+    // Create wasted entry. This can happen when an almost emptied linear
+    // allocation buffer is returned to the freelist.
+    new (block.address) HeapObjectHeader(size, kFreeListGCInfoIndex);
+    return;
+  }
+
+  // Make sure the freelist header is writable.
+  SET_MEMORY_ACCESIBLE(block.address, sizeof(Entry));
+  Entry* entry = new (block.address) Entry(size);
+  const size_t index = BucketIndexForSize(static_cast<uint32_t>(size));
+  entry->Link(&free_list_heads_[index]);
+  biggest_free_list_index_ = std::max(biggest_free_list_index_, index);
+  if (!entry->Next()) {
+    free_list_tails_[index] = entry;
+  }
+}
+
+void FreeList::Append(FreeList&& other) {
+#if DEBUG
+  const size_t expected_size = Size() + other.Size();
+#endif
+  // Newly created entries get added to the head.
+  for (size_t index = 0; index < free_list_tails_.size(); ++index) {
+    Entry* other_tail = other.free_list_tails_[index];
+    Entry*& this_head = this->free_list_heads_[index];
+    if (other_tail) {
+      other_tail->SetNext(this_head);
+      if (!this_head) {
+        this->free_list_tails_[index] = other_tail;
+      }
+      this_head = other.free_list_heads_[index];
+      other.free_list_heads_[index] = nullptr;
+      other.free_list_tails_[index] = nullptr;
+    }
+  }
+
+  biggest_free_list_index_ =
+      std::max(biggest_free_list_index_, other.biggest_free_list_index_);
+  other.biggest_free_list_index_ = 0;
+#if DEBUG
+  DCHECK_EQ(expected_size, Size());
+#endif
+  DCHECK(other.IsEmpty());
+}
+
+FreeList::Block FreeList::Allocate(size_t allocation_size) {
+  // Try reusing a block from the largest bin. The underlying reasoning
+  // being that we want to amortize this slow allocation call by carving
+  // off as a large a free block as possible in one go; a block that will
+  // service this block and let following allocations be serviced quickly
+  // by bump allocation.
+  // bucket_size represents minimal size of entries in a bucket.
+  size_t bucket_size = static_cast<size_t>(1) << biggest_free_list_index_;
+  size_t index = biggest_free_list_index_;
+  for (; index > 0; --index, bucket_size >>= 1) {
+    DCHECK(IsConsistent(index));
+    Entry* entry = free_list_heads_[index];
+    if (allocation_size > bucket_size) {
+      // Final bucket candidate; check initial entry if it is able
+      // to service this allocation. Do not perform a linear scan,
+      // as it is considered too costly.
+      if (!entry || entry->GetSize() < allocation_size) break;
+    }
+    if (entry) {
+      if (!entry->Next()) {
+        DCHECK_EQ(entry, free_list_tails_[index]);
+        free_list_tails_[index] = nullptr;
+      }
+      entry->Unlink(&free_list_heads_[index]);
+      biggest_free_list_index_ = index;
+      return {entry, entry->GetSize()};
+    }
+  }
+  biggest_free_list_index_ = index;
+  return {nullptr, 0u};
+}
+
+void FreeList::Clear() {
+  std::fill(free_list_heads_.begin(), free_list_heads_.end(), nullptr);
+  std::fill(free_list_tails_.begin(), free_list_tails_.end(), nullptr);
+  biggest_free_list_index_ = 0;
+}
+
+size_t FreeList::Size() const {
+  size_t size = 0;
+  for (auto* entry : free_list_heads_) {
+    while (entry) {
+      size += entry->GetSize();
+      entry = entry->Next();
+    }
+  }
+  return size;
+}
+
+bool FreeList::IsEmpty() const {
+  return std::all_of(free_list_heads_.cbegin(), free_list_heads_.cend(),
+                     [](const auto* entry) { return !entry; });
+}
+
+bool FreeList::Contains(Block block) const {
+  for (Entry* list : free_list_heads_) {
+    for (Entry* entry = list; entry; entry = entry->Next()) {
+      if (entry <= block.address &&
+          (reinterpret_cast<Address>(block.address) + block.size <=
+           reinterpret_cast<Address>(entry) + entry->GetSize()))
+        return true;
+    }
+  }
+  return false;
+}
+
+bool FreeList::IsConsistent(size_t index) const {
+  // Check that freelist head and tail pointers are consistent, i.e.
+  // - either both are nulls (no entries in the bucket);
+  // - or both are non-nulls and the tail points to the end.
+  return (!free_list_heads_[index] && !free_list_tails_[index]) ||
+         (free_list_heads_[index] && free_list_tails_[index] &&
+          !free_list_tails_[index]->Next());
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/free-list.h b/deps/v8/src/heap/cppgc/free-list.h
new file mode 100644
index 00000000000..ba578f38203
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/free-list.h
@@ -0,0 +1,62 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_FREE_LIST_H_
+#define V8_HEAP_CPPGC_FREE_LIST_H_
+
+#include <array>
+
+#include "src/base/macros.h"
+#include "src/heap/cppgc/globals.h"
+#include "src/heap/cppgc/heap-object-header.h"
+
+namespace cppgc {
+namespace internal {
+
+class V8_EXPORT_PRIVATE FreeList {
+ public:
+  struct Block {
+    void* address;
+    size_t size;
+  };
+
+  FreeList();
+
+  FreeList(const FreeList&) = delete;
+  FreeList& operator=(const FreeList&) = delete;
+
+  FreeList(FreeList&& freelist) V8_NOEXCEPT;
+  FreeList& operator=(FreeList&& freelist) V8_NOEXCEPT;
+
+  // Allocates entries which are at least of the provided size.
+  Block Allocate(size_t);
+
+  // Adds block to the freelist. The minimal block size is two words.
+  void Add(Block);
+
+  // Append other freelist into this.
+  void Append(FreeList&&);
+
+  void Clear();
+
+  size_t Size() const;
+  bool IsEmpty() const;
+
+  bool Contains(Block) const;
+
+ private:
+  class Entry;
+
+  bool IsConsistent(size_t) const;
+
+  // All |Entry|s in the nth list have size >= 2^n.
+  std::array<Entry*, kPageSizeLog2> free_list_heads_;
+  std::array<Entry*, kPageSizeLog2> free_list_tails_;
+  size_t biggest_free_list_index_ = 0;
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_FREE_LIST_H_
diff --git a/deps/v8/src/heap/cppgc/gc-info-table.cc b/deps/v8/src/heap/cppgc/gc-info-table.cc
index 580ff4d0699..8f2ee965011 100644
--- a/deps/v8/src/heap/cppgc/gc-info-table.cc
+++ b/deps/v8/src/heap/cppgc/gc-info-table.cc
@@ -8,7 +8,7 @@
 #include <limits>
 #include <memory>
 
-#include "include/cppgc/gc-info.h"
+#include "include/cppgc/internal/gc-info.h"
 #include "include/cppgc/platform.h"
 #include "src/base/bits.h"
 #include "src/base/lazy-instance.h"
@@ -18,6 +18,11 @@ namespace internal {
 
 namespace {
 
+// GCInfoTable::table_, the table which holds GCInfos, is maintained as a
+// contiguous array reserved upfront. Subparts of the array are (re-)committed
+// as read/write or read-only in OS pages, whose size is a power of 2. To avoid
+// having GCInfos that cross the boundaries between these subparts we force the
+// size of GCInfo to be a power of 2 as well.
 constexpr size_t kEntrySize = sizeof(GCInfo);
 static_assert(v8::base::bits::IsPowerOfTwo(kEntrySize),
               "GCInfoTable entries size must be power of "
diff --git a/deps/v8/src/heap/cppgc/gc-info-table.h b/deps/v8/src/heap/cppgc/gc-info-table.h
index c5ccec2a381..749f30b258c 100644
--- a/deps/v8/src/heap/cppgc/gc-info-table.h
+++ b/deps/v8/src/heap/cppgc/gc-info-table.h
@@ -7,7 +7,7 @@
 
 #include <stdint.h>
 
-#include "include/cppgc/gc-info.h"
+#include "include/cppgc/internal/gc-info.h"
 #include "include/cppgc/platform.h"
 #include "include/v8config.h"
 #include "src/base/logging.h"
@@ -22,7 +22,10 @@ namespace internal {
 // inherit from GarbageCollected.
 struct GCInfo final {
   FinalizationCallback finalize;
+  TraceCallback trace;
   bool has_v_table;
+  // Keep sizeof(GCInfo) a power of 2.
+  size_t padding = 0;
 };
 
 class V8_EXPORT GCInfoTable final {
diff --git a/deps/v8/src/heap/cppgc/gc-info.cc b/deps/v8/src/heap/cppgc/gc-info.cc
index 21492825cc9..70970139b17 100644
--- a/deps/v8/src/heap/cppgc/gc-info.cc
+++ b/deps/v8/src/heap/cppgc/gc-info.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "include/cppgc/gc-info.h"
+#include "include/cppgc/internal/gc-info.h"
 #include "include/v8config.h"
 #include "src/heap/cppgc/gc-info-table.h"
 
@@ -10,9 +10,10 @@ namespace cppgc {
 namespace internal {
 
 RegisteredGCInfoIndex::RegisteredGCInfoIndex(
-    FinalizationCallback finalization_callback, bool has_v_table)
+    FinalizationCallback finalization_callback, TraceCallback trace_callback,
+    bool has_v_table)
     : index_(GlobalGCInfoTable::GetMutable().RegisterNewGCInfo(
-          {finalization_callback, has_v_table})) {}
+          {finalization_callback, trace_callback, has_v_table})) {}
 
 }  // namespace internal
 }  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/globals.h b/deps/v8/src/heap/cppgc/globals.h
index 18a7e3189ec..081fd34d4f7 100644
--- a/deps/v8/src/heap/cppgc/globals.h
+++ b/deps/v8/src/heap/cppgc/globals.h
@@ -8,12 +8,18 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "include/cppgc/internal/gc-info.h"
+
 namespace cppgc {
 namespace internal {
 
 using Address = uint8_t*;
 using ConstAddress = const uint8_t*;
 
+constexpr size_t kKB = 1024;
+constexpr size_t kMB = kKB * 1024;
+constexpr size_t kGB = kMB * 1024;
+
 // See 6.7.6 (http://eel.is/c++draft/basic.align) for alignment restrictions. We
 // do not fully support all alignment restrictions (following
 // alignof(std​::​max_­align_­t)) but limit to alignof(double).
@@ -31,8 +37,20 @@ constexpr size_t kPageSize = 1 << kPageSizeLog2;
 constexpr size_t kPageOffsetMask = kPageSize - 1;
 constexpr size_t kPageBaseMask = ~kPageOffsetMask;
 
+// Guard pages are always put into memory. Whether they are actually protected
+// depends on the allocator provided to the garbage collector.
+constexpr size_t kGuardPageSize = 4096;
+
 constexpr size_t kLargeObjectSizeThreshold = kPageSize / 2;
 
+constexpr GCInfoIndex kFreeListGCInfoIndex = 0;
+constexpr size_t kFreeListEntrySize = 2 * sizeof(uintptr_t);
+
+#if defined(CPPGC_CAGED_HEAP)
+constexpr size_t kCagedHeapReservationSize = static_cast<size_t>(4) * kGB;
+constexpr size_t kCagedHeapReservationAlignment = kCagedHeapReservationSize;
+#endif
+
 }  // namespace internal
 }  // namespace cppgc
 
diff --git a/deps/v8/src/heap/cppgc/heap-inl.h b/deps/v8/src/heap/cppgc/heap-inl.h
index 28a4a14139e..a2a084308db 100644
--- a/deps/v8/src/heap/cppgc/heap-inl.h
+++ b/deps/v8/src/heap/cppgc/heap-inl.h
@@ -2,32 +2,25 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/heap/cppgc/heap.h"
-
-#include "src/heap/cppgc/globals.h"
-#include "src/heap/cppgc/heap-object-header-inl.h"
-
 #ifndef V8_HEAP_CPPGC_HEAP_INL_H_
 #define V8_HEAP_CPPGC_HEAP_INL_H_
 
+#include "src/heap/cppgc/globals.h"
+#include "src/heap/cppgc/heap.h"
+#include "src/heap/cppgc/object-allocator-inl.h"
+
 namespace cppgc {
 namespace internal {
 
 void* Heap::Allocate(size_t size, GCInfoIndex index) {
-  // TODO(chromium:1056170): This is merely a dummy implementation and will be
-  // replaced with proper allocation code throughout the migration.
-  size_t allocation_size = size + sizeof(HeapObjectHeader);
-  // The allocation size calculation can overflow for large sizes.
-  CHECK_GT(allocation_size, size);
-  // calloc() provides stricter alignment guarantees than the GC. Allocate
-  // a multiple of kAllocationGranularity to follow restrictions of
-  // HeapObjectHeader.
-  allocation_size = (allocation_size + kAllocationMask) & ~kAllocationMask;
-  void* memory = calloc(1, allocation_size);
-  HeapObjectHeader* header =
-      new (memory) HeapObjectHeader(allocation_size, index);
-  objects_.push_back(header);
-  return header->Payload();
+  DCHECK(is_allocation_allowed());
+  return object_allocator_.AllocateObject(size, index);
+}
+
+void* Heap::Allocate(size_t size, GCInfoIndex index,
+                     CustomSpaceIndex space_index) {
+  DCHECK(is_allocation_allowed());
+  return object_allocator_.AllocateObject(size, index, space_index);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/cppgc/heap-object-header-inl.h b/deps/v8/src/heap/cppgc/heap-object-header-inl.h
index a0bcda464b0..cba7b24a4cb 100644
--- a/deps/v8/src/heap/cppgc/heap-object-header-inl.h
+++ b/deps/v8/src/heap/cppgc/heap-object-header-inl.h
@@ -6,11 +6,12 @@
 #define V8_HEAP_CPPGC_HEAP_OBJECT_HEADER_INL_H_
 
 #include "include/cppgc/allocation.h"
-#include "include/cppgc/gc-info.h"
+#include "include/cppgc/internal/gc-info.h"
 #include "src/base/atomic-utils.h"
 #include "src/base/logging.h"
 #include "src/base/macros.h"
 #include "src/heap/cppgc/gc-info-table.h"
+#include "src/heap/cppgc/globals.h"
 #include "src/heap/cppgc/heap-object-header.h"
 
 namespace cppgc {
@@ -33,7 +34,7 @@ HeapObjectHeader::HeapObjectHeader(size_t size, GCInfoIndex gc_info_index) {
   USE(padding_);
 #endif  // defined(V8_TARGET_ARCH_64_BIT)
   DCHECK_LT(gc_info_index, GCInfoTable::kMaxIndex);
-  DCHECK_EQ(0u, size & kAllocationMask);
+  DCHECK_EQ(0u, size & (sizeof(HeapObjectHeader) - 1));
   DCHECK_GE(kMaxSize, size);
   encoded_high_ = GCInfoIndexField::encode(gc_info_index);
   encoded_low_ = EncodeSize(size);
@@ -111,6 +112,16 @@ bool HeapObjectHeader::TryMarkAtomic() {
                                                  std::memory_order_relaxed);
 }
 
+template <HeapObjectHeader::AccessMode mode>
+bool HeapObjectHeader::IsFree() const {
+  return GetGCInfoIndex() == kFreeListGCInfoIndex;
+}
+
+bool HeapObjectHeader::IsFinalizable() const {
+  const GCInfo& gc_info = GlobalGCInfoTable::GCInfoFromIndex(GetGCInfoIndex());
+  return gc_info.finalize;
+}
+
 template <HeapObjectHeader::AccessMode mode, HeapObjectHeader::EncodedHalf part,
           std::memory_order memory_order>
 uint16_t HeapObjectHeader::LoadEncoded() const {
diff --git a/deps/v8/src/heap/cppgc/heap-object-header.cc b/deps/v8/src/heap/cppgc/heap-object-header.cc
index bd90d5930c1..ccc660fcee8 100644
--- a/deps/v8/src/heap/cppgc/heap-object-header.cc
+++ b/deps/v8/src/heap/cppgc/heap-object-header.cc
@@ -4,7 +4,7 @@
 
 #include "src/heap/cppgc/heap-object-header.h"
 
-#include "include/cppgc/internals.h"
+#include "include/cppgc/internal/api-constants.h"
 #include "src/base/macros.h"
 #include "src/heap/cppgc/gc-info-table.h"
 #include "src/heap/cppgc/heap-object-header-inl.h"
@@ -12,6 +12,8 @@
 namespace cppgc {
 namespace internal {
 
+STATIC_ASSERT((kAllocationGranularity % sizeof(HeapObjectHeader)) == 0);
+
 void HeapObjectHeader::CheckApiConstants() {
   STATIC_ASSERT(api_constants::kFullyConstructedBitMask ==
                 FullyConstructedField::kMask);
diff --git a/deps/v8/src/heap/cppgc/heap-object-header.h b/deps/v8/src/heap/cppgc/heap-object-header.h
index 738f9d9ab9e..b517617dd1e 100644
--- a/deps/v8/src/heap/cppgc/heap-object-header.h
+++ b/deps/v8/src/heap/cppgc/heap-object-header.h
@@ -6,9 +6,10 @@
 #define V8_HEAP_CPPGC_HEAP_OBJECT_HEADER_H_
 
 #include <stdint.h>
+
 #include <atomic>
 
-#include "include/cppgc/gc-info.h"
+#include "include/cppgc/internal/gc-info.h"
 #include "src/base/bit-field.h"
 #include "src/heap/cppgc/globals.h"
 
@@ -41,12 +42,13 @@ namespace internal {
 //   stored in |LargeObjectPage::PayloadSize()|.
 // - |mark bit| and |in construction| bits are located in separate 16-bit halves
 //    to allow potentially accessing them non-atomically.
-class HeapObjectHeader final {
+class HeapObjectHeader {
  public:
   enum class AccessMode : uint8_t { kNonAtomic, kAtomic };
 
   static constexpr size_t kSizeLog2 = 17;
   static constexpr size_t kMaxSize = (size_t{1} << kSizeLog2) - 1;
+  static constexpr uint16_t kLargeObjectSizeInHeader = 0;
 
   inline static HeapObjectHeader& FromPayload(void* address);
   inline static const HeapObjectHeader& FromPayload(const void* address);
@@ -77,13 +79,15 @@ class HeapObjectHeader final {
   void Unmark();
   inline bool TryMarkAtomic();
 
+  template <AccessMode = AccessMode::kNonAtomic>
+  bool IsFree() const;
+
+  inline bool IsFinalizable() const;
   void Finalize();
 
  private:
   enum class EncodedHalf : uint8_t { kLow, kHigh };
 
-  static constexpr uint16_t kLargeObjectSizeInHeader = 0;
-
   // Used in |encoded_high_|.
   using FullyConstructedField = v8::base::BitField16<bool, 0, 1>;
   using UnusedField1 = FullyConstructedField::Next<bool, 1>;
@@ -102,7 +106,7 @@ class HeapObjectHeader final {
   static constexpr uint16_t EncodeSize(size_t size) {
     // Essentially, gets optimized to >> 1.
     using SizeField = UnusedField2::Next<size_t, 14>;
-    return SizeField::encode(size) / kAllocationGranularity;
+    return SizeField::encode(size / kAllocationGranularity);
   }
 
   V8_EXPORT_PRIVATE void CheckApiConstants();
diff --git a/deps/v8/src/heap/cppgc/heap-page.cc b/deps/v8/src/heap/cppgc/heap-page.cc
new file mode 100644
index 00000000000..53db357ea1b
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/heap-page.cc
@@ -0,0 +1,260 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/heap-page.h"
+
+#include <algorithm>
+
+#include "include/cppgc/internal/api-constants.h"
+#include "src/base/logging.h"
+#include "src/heap/cppgc/globals.h"
+#include "src/heap/cppgc/heap-object-header-inl.h"
+#include "src/heap/cppgc/heap-space.h"
+#include "src/heap/cppgc/heap.h"
+#include "src/heap/cppgc/object-start-bitmap-inl.h"
+#include "src/heap/cppgc/object-start-bitmap.h"
+#include "src/heap/cppgc/page-memory-inl.h"
+#include "src/heap/cppgc/raw-heap.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+Address AlignAddress(Address address, size_t alignment) {
+  return reinterpret_cast<Address>(
+      RoundUp(reinterpret_cast<uintptr_t>(address), alignment));
+}
+
+const HeapObjectHeader* ObjectHeaderFromInnerAddressImpl(const BasePage* page,
+                                                         const void* address) {
+  if (page->is_large()) {
+    return LargePage::From(page)->ObjectHeader();
+  }
+  const ObjectStartBitmap& bitmap =
+      NormalPage::From(page)->object_start_bitmap();
+  const HeapObjectHeader* header =
+      bitmap.FindHeader(static_cast<ConstAddress>(address));
+  DCHECK_LT(address,
+            reinterpret_cast<ConstAddress>(header) +
+                header->GetSize<HeapObjectHeader::AccessMode::kAtomic>());
+  return header;
+}
+
+}  // namespace
+
+STATIC_ASSERT(kPageSize == api_constants::kPageAlignment);
+
+// static
+BasePage* BasePage::FromPayload(void* payload) {
+  return reinterpret_cast<BasePage*>(
+      (reinterpret_cast<uintptr_t>(payload) & kPageBaseMask) + kGuardPageSize);
+}
+
+// static
+const BasePage* BasePage::FromPayload(const void* payload) {
+  return reinterpret_cast<const BasePage*>(
+      (reinterpret_cast<uintptr_t>(const_cast<void*>(payload)) &
+       kPageBaseMask) +
+      kGuardPageSize);
+}
+
+// static
+BasePage* BasePage::FromInnerAddress(const Heap* heap, void* address) {
+  return const_cast<BasePage*>(
+      FromInnerAddress(heap, const_cast<const void*>(address)));
+}
+
+// static
+const BasePage* BasePage::FromInnerAddress(const Heap* heap,
+                                           const void* address) {
+  return reinterpret_cast<const BasePage*>(
+      heap->page_backend()->Lookup(static_cast<ConstAddress>(address)));
+}
+
+// static
+void BasePage::Destroy(BasePage* page) {
+  if (page->is_large()) {
+    LargePage::Destroy(LargePage::From(page));
+  } else {
+    NormalPage::Destroy(NormalPage::From(page));
+  }
+}
+
+HeapObjectHeader& BasePage::ObjectHeaderFromInnerAddress(void* address) const {
+  return const_cast<HeapObjectHeader&>(
+      ObjectHeaderFromInnerAddress(const_cast<const void*>(address)));
+}
+
+const HeapObjectHeader& BasePage::ObjectHeaderFromInnerAddress(
+    const void* address) const {
+  const HeapObjectHeader* header =
+      ObjectHeaderFromInnerAddressImpl(this, address);
+  DCHECK_NE(kFreeListGCInfoIndex, header->GetGCInfoIndex());
+  return *header;
+}
+
+HeapObjectHeader* BasePage::TryObjectHeaderFromInnerAddress(
+    void* address) const {
+  return const_cast<HeapObjectHeader*>(
+      TryObjectHeaderFromInnerAddress(const_cast<const void*>(address)));
+}
+
+const HeapObjectHeader* BasePage::TryObjectHeaderFromInnerAddress(
+    const void* address) const {
+  if (is_large()) {
+    if (!LargePage::From(this)->PayloadContains(
+            static_cast<ConstAddress>(address)))
+      return nullptr;
+  } else {
+    const NormalPage* normal_page = NormalPage::From(this);
+    if (!normal_page->PayloadContains(static_cast<ConstAddress>(address)))
+      return nullptr;
+    // Check that the space has no linear allocation buffer.
+    DCHECK(!NormalPageSpace::From(normal_page->space())
+                ->linear_allocation_buffer()
+                .size());
+  }
+
+  // |address| is on the heap, so we FromInnerAddress can get the header.
+  const HeapObjectHeader* header =
+      ObjectHeaderFromInnerAddressImpl(this, address);
+  if (header->IsFree()) return nullptr;
+  DCHECK_NE(kFreeListGCInfoIndex, header->GetGCInfoIndex());
+  return header;
+}
+
+BasePage::BasePage(Heap* heap, BaseSpace* space, PageType type)
+    : heap_(heap), space_(space), type_(type) {
+  DCHECK_EQ(0u, (reinterpret_cast<uintptr_t>(this) - kGuardPageSize) &
+                    kPageOffsetMask);
+  DCHECK_EQ(reinterpret_cast<void*>(&heap_),
+            FromPayload(this) + api_constants::kHeapOffset);
+  DCHECK_EQ(&heap_->raw_heap(), space_->raw_heap());
+}
+
+// static
+NormalPage* NormalPage::Create(NormalPageSpace* space) {
+  DCHECK(space);
+  Heap* heap = space->raw_heap()->heap();
+  DCHECK(heap);
+  void* memory = heap->page_backend()->AllocateNormalPageMemory(space->index());
+  auto* normal_page = new (memory) NormalPage(heap, space);
+  space->AddPage(normal_page);
+  space->AddToFreeList(normal_page->PayloadStart(), normal_page->PayloadSize());
+  return normal_page;
+}
+
+// static
+void NormalPage::Destroy(NormalPage* page) {
+  DCHECK(page);
+  BaseSpace* space = page->space();
+  DCHECK_EQ(space->end(), std::find(space->begin(), space->end(), page));
+  page->~NormalPage();
+  PageBackend* backend = page->heap()->page_backend();
+  backend->FreeNormalPageMemory(space->index(),
+                                reinterpret_cast<Address>(page));
+}
+
+NormalPage::NormalPage(Heap* heap, BaseSpace* space)
+    : BasePage(heap, space, PageType::kNormal),
+      object_start_bitmap_(PayloadStart()) {
+  DCHECK_LT(kLargeObjectSizeThreshold,
+            static_cast<size_t>(PayloadEnd() - PayloadStart()));
+}
+
+NormalPage::~NormalPage() = default;
+
+NormalPage::iterator NormalPage::begin() {
+  const auto& lab = NormalPageSpace::From(space())->linear_allocation_buffer();
+  return iterator(reinterpret_cast<HeapObjectHeader*>(PayloadStart()),
+                  lab.start(), lab.size());
+}
+
+NormalPage::const_iterator NormalPage::begin() const {
+  const auto& lab = NormalPageSpace::From(space())->linear_allocation_buffer();
+  return const_iterator(
+      reinterpret_cast<const HeapObjectHeader*>(PayloadStart()), lab.start(),
+      lab.size());
+}
+
+Address NormalPage::PayloadStart() {
+  return AlignAddress((reinterpret_cast<Address>(this + 1)),
+                      kAllocationGranularity);
+}
+
+ConstAddress NormalPage::PayloadStart() const {
+  return const_cast<NormalPage*>(this)->PayloadStart();
+}
+
+Address NormalPage::PayloadEnd() { return PayloadStart() + PayloadSize(); }
+
+ConstAddress NormalPage::PayloadEnd() const {
+  return const_cast<NormalPage*>(this)->PayloadEnd();
+}
+
+// static
+size_t NormalPage::PayloadSize() {
+  const size_t header_size =
+      RoundUp(sizeof(NormalPage), kAllocationGranularity);
+  return kPageSize - 2 * kGuardPageSize - header_size;
+}
+
+LargePage::LargePage(Heap* heap, BaseSpace* space, size_t size)
+    : BasePage(heap, space, PageType::kLarge), payload_size_(size) {}
+
+LargePage::~LargePage() = default;
+
+// static
+LargePage* LargePage::Create(LargePageSpace* space, size_t size) {
+  DCHECK(space);
+  DCHECK_LE(kLargeObjectSizeThreshold, size);
+  const size_t page_header_size =
+      RoundUp(sizeof(LargePage), kAllocationGranularity);
+  const size_t allocation_size = page_header_size + size;
+
+  Heap* heap = space->raw_heap()->heap();
+  void* memory = heap->page_backend()->AllocateLargePageMemory(allocation_size);
+  LargePage* page = new (memory) LargePage(heap, space, size);
+  space->AddPage(page);
+  return page;
+}
+
+// static
+void LargePage::Destroy(LargePage* page) {
+  DCHECK(page);
+#if DEBUG
+  BaseSpace* space = page->space();
+  DCHECK_EQ(space->end(), std::find(space->begin(), space->end(), page));
+#endif
+  page->~LargePage();
+  PageBackend* backend = page->heap()->page_backend();
+  backend->FreeLargePageMemory(reinterpret_cast<Address>(page));
+}
+
+HeapObjectHeader* LargePage::ObjectHeader() {
+  return reinterpret_cast<HeapObjectHeader*>(PayloadStart());
+}
+
+const HeapObjectHeader* LargePage::ObjectHeader() const {
+  return reinterpret_cast<const HeapObjectHeader*>(PayloadStart());
+}
+
+Address LargePage::PayloadStart() {
+  return AlignAddress((reinterpret_cast<Address>(this + 1)),
+                      kAllocationGranularity);
+}
+
+ConstAddress LargePage::PayloadStart() const {
+  return const_cast<LargePage*>(this)->PayloadStart();
+}
+
+Address LargePage::PayloadEnd() { return PayloadStart() + PayloadSize(); }
+
+ConstAddress LargePage::PayloadEnd() const {
+  return const_cast<LargePage*>(this)->PayloadEnd();
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/heap-page.h b/deps/v8/src/heap/cppgc/heap-page.h
new file mode 100644
index 00000000000..bfddbe6cb4b
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/heap-page.h
@@ -0,0 +1,202 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_HEAP_PAGE_H_
+#define V8_HEAP_CPPGC_HEAP_PAGE_H_
+
+#include "src/base/iterator.h"
+#include "src/base/macros.h"
+#include "src/heap/cppgc/globals.h"
+#include "src/heap/cppgc/heap-object-header.h"
+#include "src/heap/cppgc/object-start-bitmap.h"
+
+namespace cppgc {
+namespace internal {
+
+class BaseSpace;
+class NormalPageSpace;
+class LargePageSpace;
+class Heap;
+class PageBackend;
+
+class V8_EXPORT_PRIVATE BasePage {
+ public:
+  static BasePage* FromPayload(void*);
+  static const BasePage* FromPayload(const void*);
+
+  static BasePage* FromInnerAddress(const Heap*, void*);
+  static const BasePage* FromInnerAddress(const Heap*, const void*);
+
+  static void Destroy(BasePage*);
+
+  BasePage(const BasePage&) = delete;
+  BasePage& operator=(const BasePage&) = delete;
+
+  Heap* heap() { return heap_; }
+  const Heap* heap() const { return heap_; }
+
+  BaseSpace* space() { return space_; }
+  const BaseSpace* space() const { return space_; }
+  void set_space(BaseSpace* space) { space_ = space; }
+
+  bool is_large() const { return type_ == PageType::kLarge; }
+
+  // |address| must refer to real object.
+  HeapObjectHeader& ObjectHeaderFromInnerAddress(void* address) const;
+  const HeapObjectHeader& ObjectHeaderFromInnerAddress(
+      const void* address) const;
+
+  // |address| is guaranteed to point into the page but not payload. Returns
+  // nullptr when pointing into free list entries and the valid header
+  // otherwise.
+  HeapObjectHeader* TryObjectHeaderFromInnerAddress(void* address) const;
+  const HeapObjectHeader* TryObjectHeaderFromInnerAddress(
+      const void* address) const;
+
+ protected:
+  enum class PageType { kNormal, kLarge };
+  BasePage(Heap*, BaseSpace*, PageType);
+
+ private:
+  Heap* heap_;
+  BaseSpace* space_;
+  PageType type_;
+};
+
+class V8_EXPORT_PRIVATE NormalPage final : public BasePage {
+  template <typename T>
+  class IteratorImpl : v8::base::iterator<std::forward_iterator_tag, T> {
+   public:
+    explicit IteratorImpl(T* p, ConstAddress lab_start = nullptr,
+                          size_t lab_size = 0)
+        : p_(p), lab_start_(lab_start), lab_size_(lab_size) {
+      DCHECK(p);
+      DCHECK_EQ(0, (lab_size & (sizeof(T) - 1)));
+      if (reinterpret_cast<ConstAddress>(p_) == lab_start_) {
+        p_ += (lab_size_ / sizeof(T));
+      }
+    }
+
+    T& operator*() { return *p_; }
+    const T& operator*() const { return *p_; }
+
+    bool operator==(IteratorImpl other) const { return p_ == other.p_; }
+    bool operator!=(IteratorImpl other) const { return !(*this == other); }
+
+    IteratorImpl& operator++() {
+      const size_t size = p_->GetSize();
+      DCHECK_EQ(0, (size & (sizeof(T) - 1)));
+      p_ += (size / sizeof(T));
+      if (reinterpret_cast<ConstAddress>(p_) == lab_start_) {
+        p_ += (lab_size_ / sizeof(T));
+      }
+      return *this;
+    }
+    IteratorImpl operator++(int) {
+      IteratorImpl temp(*this);
+      ++(*this);
+      return temp;
+    }
+
+    T* base() const { return p_; }
+
+   private:
+    T* p_;
+    ConstAddress lab_start_;
+    size_t lab_size_;
+  };
+
+ public:
+  using iterator = IteratorImpl<HeapObjectHeader>;
+  using const_iterator = IteratorImpl<const HeapObjectHeader>;
+
+  // Allocates a new page.
+  static NormalPage* Create(NormalPageSpace*);
+  // Destroys and frees the page. The page must be detached from the
+  // corresponding space (i.e. be swept when called).
+  static void Destroy(NormalPage*);
+
+  static NormalPage* From(BasePage* page) {
+    DCHECK(!page->is_large());
+    return static_cast<NormalPage*>(page);
+  }
+  static const NormalPage* From(const BasePage* page) {
+    return From(const_cast<BasePage*>(page));
+  }
+
+  iterator begin();
+  const_iterator begin() const;
+
+  iterator end() {
+    return iterator(reinterpret_cast<HeapObjectHeader*>(PayloadEnd()));
+  }
+  const_iterator end() const {
+    return const_iterator(
+        reinterpret_cast<const HeapObjectHeader*>(PayloadEnd()));
+  }
+
+  Address PayloadStart();
+  ConstAddress PayloadStart() const;
+  Address PayloadEnd();
+  ConstAddress PayloadEnd() const;
+
+  static size_t PayloadSize();
+
+  bool PayloadContains(ConstAddress address) const {
+    return (PayloadStart() <= address) && (address < PayloadEnd());
+  }
+
+  ObjectStartBitmap& object_start_bitmap() { return object_start_bitmap_; }
+  const ObjectStartBitmap& object_start_bitmap() const {
+    return object_start_bitmap_;
+  }
+
+ private:
+  NormalPage(Heap* heap, BaseSpace* space);
+  ~NormalPage();
+
+  ObjectStartBitmap object_start_bitmap_;
+};
+
+class V8_EXPORT_PRIVATE LargePage final : public BasePage {
+ public:
+  // Allocates a new page.
+  static LargePage* Create(LargePageSpace*, size_t);
+  // Destroys and frees the page. The page must be detached from the
+  // corresponding space (i.e. be swept when called).
+  static void Destroy(LargePage*);
+
+  static LargePage* From(BasePage* page) {
+    DCHECK(page->is_large());
+    return static_cast<LargePage*>(page);
+  }
+  static const LargePage* From(const BasePage* page) {
+    return From(const_cast<BasePage*>(page));
+  }
+
+  HeapObjectHeader* ObjectHeader();
+  const HeapObjectHeader* ObjectHeader() const;
+
+  Address PayloadStart();
+  ConstAddress PayloadStart() const;
+  Address PayloadEnd();
+  ConstAddress PayloadEnd() const;
+
+  size_t PayloadSize() const { return payload_size_; }
+
+  bool PayloadContains(ConstAddress address) const {
+    return (PayloadStart() <= address) && (address < PayloadEnd());
+  }
+
+ private:
+  LargePage(Heap* heap, BaseSpace* space, size_t);
+  ~LargePage();
+
+  size_t payload_size_;
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_HEAP_PAGE_H_
diff --git a/deps/v8/src/heap/cppgc/heap-space.cc b/deps/v8/src/heap/cppgc/heap-space.cc
new file mode 100644
index 00000000000..5fa8cf691ef
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/heap-space.cc
@@ -0,0 +1,61 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/heap-space.h"
+
+#include <algorithm>
+
+#include "src/base/logging.h"
+#include "src/base/platform/mutex.h"
+#include "src/heap/cppgc/heap-page.h"
+#include "src/heap/cppgc/object-start-bitmap-inl.h"
+
+namespace cppgc {
+namespace internal {
+
+BaseSpace::BaseSpace(RawHeap* heap, size_t index, PageType type)
+    : heap_(heap), index_(index), type_(type) {}
+
+void BaseSpace::AddPage(BasePage* page) {
+  v8::base::LockGuard<v8::base::Mutex> lock(&pages_mutex_);
+  DCHECK_EQ(pages_.cend(), std::find(pages_.cbegin(), pages_.cend(), page));
+  pages_.push_back(page);
+}
+
+void BaseSpace::RemovePage(BasePage* page) {
+  v8::base::LockGuard<v8::base::Mutex> lock(&pages_mutex_);
+  auto it = std::find(pages_.cbegin(), pages_.cend(), page);
+  DCHECK_NE(pages_.cend(), it);
+  pages_.erase(it);
+}
+
+BaseSpace::Pages BaseSpace::RemoveAllPages() {
+  Pages pages = std::move(pages_);
+  pages_.clear();
+  return pages;
+}
+
+NormalPageSpace::NormalPageSpace(RawHeap* heap, size_t index)
+    : BaseSpace(heap, index, PageType::kNormal) {}
+
+void NormalPageSpace::AddToFreeList(void* address, size_t size) {
+  free_list_.Add({address, size});
+  NormalPage::From(BasePage::FromPayload(address))
+      ->object_start_bitmap()
+      .SetBit(static_cast<Address>(address));
+}
+
+void NormalPageSpace::ResetLinearAllocationBuffer() {
+  if (current_lab_.size()) {
+    DCHECK_NOT_NULL(current_lab_.start());
+    AddToFreeList(current_lab_.start(), current_lab_.size());
+    current_lab_.Set(nullptr, 0);
+  }
+}
+
+LargePageSpace::LargePageSpace(RawHeap* heap, size_t index)
+    : BaseSpace(heap, index, PageType::kLarge) {}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/heap-space.h b/deps/v8/src/heap/cppgc/heap-space.h
new file mode 100644
index 00000000000..63e8d90d7b9
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/heap-space.h
@@ -0,0 +1,129 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_HEAP_SPACE_H_
+#define V8_HEAP_CPPGC_HEAP_SPACE_H_
+
+#include <vector>
+
+#include "src/base/logging.h"
+#include "src/base/macros.h"
+#include "src/base/platform/mutex.h"
+#include "src/heap/cppgc/free-list.h"
+
+namespace cppgc {
+namespace internal {
+
+class RawHeap;
+class BasePage;
+
+// BaseSpace is responsible for page management.
+class V8_EXPORT_PRIVATE BaseSpace {
+ public:
+  using Pages = std::vector<BasePage*>;
+
+  using iterator = Pages::iterator;
+  using const_iterator = Pages::const_iterator;
+
+  BaseSpace(const BaseSpace&) = delete;
+  BaseSpace& operator=(const BaseSpace&) = delete;
+
+  iterator begin() { return pages_.begin(); }
+  const_iterator begin() const { return pages_.begin(); }
+  iterator end() { return pages_.end(); }
+  const_iterator end() const { return pages_.end(); }
+
+  size_t size() const { return pages_.size(); }
+
+  bool is_large() const { return type_ == PageType::kLarge; }
+  size_t index() const { return index_; }
+
+  RawHeap* raw_heap() { return heap_; }
+  const RawHeap* raw_heap() const { return heap_; }
+
+  // Page manipulation functions.
+  void AddPage(BasePage*);
+  void RemovePage(BasePage*);
+  Pages RemoveAllPages();
+
+ protected:
+  enum class PageType { kNormal, kLarge };
+  explicit BaseSpace(RawHeap* heap, size_t index, PageType type);
+
+ private:
+  RawHeap* heap_;
+  Pages pages_;
+  v8::base::Mutex pages_mutex_;
+  const size_t index_;
+  const PageType type_;
+};
+
+class V8_EXPORT_PRIVATE NormalPageSpace final : public BaseSpace {
+ public:
+  class LinearAllocationBuffer {
+   public:
+    Address Allocate(size_t alloc_size) {
+      DCHECK_GE(size_, alloc_size);
+      Address result = start_;
+      start_ += alloc_size;
+      size_ -= alloc_size;
+      return result;
+    }
+
+    void Set(Address ptr, size_t size) {
+      start_ = ptr;
+      size_ = size;
+    }
+
+    Address start() const { return start_; }
+    size_t size() const { return size_; }
+
+   private:
+    Address start_ = nullptr;
+    size_t size_ = 0;
+  };
+
+  static NormalPageSpace* From(BaseSpace* space) {
+    DCHECK(!space->is_large());
+    return static_cast<NormalPageSpace*>(space);
+  }
+  static const NormalPageSpace* From(const BaseSpace* space) {
+    return From(const_cast<BaseSpace*>(space));
+  }
+
+  NormalPageSpace(RawHeap* heap, size_t index);
+
+  void AddToFreeList(void*, size_t);
+  void ResetLinearAllocationBuffer();
+
+  LinearAllocationBuffer& linear_allocation_buffer() { return current_lab_; }
+  const LinearAllocationBuffer& linear_allocation_buffer() const {
+    return current_lab_;
+  }
+
+  FreeList& free_list() { return free_list_; }
+  const FreeList& free_list() const { return free_list_; }
+
+ private:
+  LinearAllocationBuffer current_lab_;
+  FreeList free_list_;
+};
+
+class V8_EXPORT_PRIVATE LargePageSpace final : public BaseSpace {
+ public:
+  static LargePageSpace* From(BaseSpace* space) {
+    DCHECK(space->is_large());
+    return static_cast<LargePageSpace*>(space);
+  }
+  static const LargePageSpace* From(const BaseSpace* space) {
+    return From(const_cast<BaseSpace*>(space));
+  }
+
+  LargePageSpace(RawHeap* heap, size_t index);
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_HEAP_SPACE_H_
diff --git a/deps/v8/src/heap/cppgc/heap-visitor.h b/deps/v8/src/heap/cppgc/heap-visitor.h
new file mode 100644
index 00000000000..7fcbc1b980b
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/heap-visitor.h
@@ -0,0 +1,88 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_HEAP_VISITOR_H_
+#define V8_HEAP_CPPGC_HEAP_VISITOR_H_
+
+#include "src/heap/cppgc/heap-page.h"
+#include "src/heap/cppgc/heap-space.h"
+#include "src/heap/cppgc/raw-heap.h"
+
+namespace cppgc {
+namespace internal {
+
+// Visitor for heap, which also implements the accept (traverse) interface.
+// Implements preorder traversal of the heap. The order of traversal is defined.
+// Implemented as a CRTP visitor to avoid virtual calls and support better
+// inlining.
+template <typename Derived>
+class HeapVisitor {
+ public:
+  void Traverse(RawHeap* heap) {
+    if (VisitHeapImpl(heap)) return;
+    for (auto& space : *heap) {
+      Traverse(space.get());
+    }
+  }
+
+  void Traverse(BaseSpace* space) {
+    const bool is_stopped =
+        space->is_large()
+            ? VisitLargePageSpaceImpl(LargePageSpace::From(space))
+            : VisitNormalPageSpaceImpl(NormalPageSpace::From(space));
+    if (is_stopped) return;
+    for (auto* page : *space) {
+      Traverse(page);
+    }
+  }
+
+  void Traverse(BasePage* page) {
+    if (page->is_large()) {
+      auto* large_page = LargePage::From(page);
+      if (VisitLargePageImpl(large_page)) return;
+      VisitHeapObjectHeaderImpl(large_page->ObjectHeader());
+    } else {
+      auto* normal_page = NormalPage::From(page);
+      if (VisitNormalPageImpl(normal_page)) return;
+      for (auto& header : *normal_page) {
+        VisitHeapObjectHeaderImpl(&header);
+      }
+    }
+  }
+
+ protected:
+  // Visitor functions return true if no deeper processing is required.
+  // Users are supposed to override functions that need special treatment.
+  bool VisitHeap(RawHeap*) { return false; }
+  bool VisitNormalPageSpace(NormalPageSpace*) { return false; }
+  bool VisitLargePageSpace(LargePageSpace*) { return false; }
+  bool VisitNormalPage(NormalPage*) { return false; }
+  bool VisitLargePage(LargePage*) { return false; }
+  bool VisitHeapObjectHeader(HeapObjectHeader*) { return false; }
+
+ private:
+  Derived& ToDerived() { return static_cast<Derived&>(*this); }
+
+  bool VisitHeapImpl(RawHeap* heap) { return ToDerived().VisitHeap(heap); }
+  bool VisitNormalPageSpaceImpl(NormalPageSpace* space) {
+    return ToDerived().VisitNormalPageSpace(space);
+  }
+  bool VisitLargePageSpaceImpl(LargePageSpace* space) {
+    return ToDerived().VisitLargePageSpace(space);
+  }
+  bool VisitNormalPageImpl(NormalPage* page) {
+    return ToDerived().VisitNormalPage(page);
+  }
+  bool VisitLargePageImpl(LargePage* page) {
+    return ToDerived().VisitLargePage(page);
+  }
+  bool VisitHeapObjectHeaderImpl(HeapObjectHeader* hoh) {
+    return ToDerived().VisitHeapObjectHeader(hoh);
+  }
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_HEAP_VISITOR_H_
diff --git a/deps/v8/src/heap/cppgc/heap.cc b/deps/v8/src/heap/cppgc/heap.cc
index e60cb155738..1c27c23629a 100644
--- a/deps/v8/src/heap/cppgc/heap.cc
+++ b/deps/v8/src/heap/cppgc/heap.cc
@@ -6,23 +6,181 @@
 
 #include <memory>
 
+#include "src/base/bounded-page-allocator.h"
+#include "src/base/page-allocator.h"
+#include "src/base/platform/platform.h"
+#include "src/heap/cppgc/heap-object-header-inl.h"
 #include "src/heap/cppgc/heap-object-header.h"
+#include "src/heap/cppgc/heap-page.h"
+#include "src/heap/cppgc/heap-visitor.h"
+#include "src/heap/cppgc/page-memory.h"
+#include "src/heap/cppgc/stack.h"
+#include "src/heap/cppgc/sweeper.h"
+#include "src/heap/cppgc/virtual-memory.h"
 
 namespace cppgc {
 
-std::unique_ptr<Heap> Heap::Create() {
-  return std::make_unique<internal::Heap>();
+namespace {
+
+void VerifyCustomSpaces(
+    const std::vector<std::unique_ptr<CustomSpaceBase>>& custom_spaces) {
+  // Ensures that user-provided custom spaces have indices that form a sequence
+  // starting at 0.
+#ifdef DEBUG
+  for (size_t i = 0; i < custom_spaces.size(); ++i) {
+    DCHECK_EQ(i, custom_spaces[i]->GetCustomSpaceIndex().value);
+  }
+#endif  // DEBUG
+}
+
+}  // namespace
+
+std::unique_ptr<Heap> Heap::Create(std::shared_ptr<cppgc::Platform> platform,
+                                   cppgc::Heap::HeapOptions options) {
+  DCHECK(platform.get());
+  VerifyCustomSpaces(options.custom_spaces);
+  return std::make_unique<internal::Heap>(std::move(platform),
+                                          options.custom_spaces.size());
+}
+
+void Heap::ForceGarbageCollectionSlow(const char* source, const char* reason,
+                                      Heap::StackState stack_state) {
+  internal::Heap::From(this)->CollectGarbage({stack_state});
 }
 
 namespace internal {
 
-void Heap::CollectGarbage() {
-  for (HeapObjectHeader* header : objects_) {
-    header->Finalize();
-    free(header);
+namespace {
+
+class ObjectSizeCounter : private HeapVisitor<ObjectSizeCounter> {
+  friend class HeapVisitor<ObjectSizeCounter>;
+
+ public:
+  size_t GetSize(RawHeap* heap) {
+    Traverse(heap);
+    return accumulated_size_;
+  }
+
+ private:
+  static size_t ObjectSize(const HeapObjectHeader* header) {
+    const size_t size =
+        header->IsLargeObject()
+            ? static_cast<const LargePage*>(BasePage::FromPayload(header))
+                  ->PayloadSize()
+            : header->GetSize();
+    DCHECK_GE(size, sizeof(HeapObjectHeader));
+    return size - sizeof(HeapObjectHeader);
+  }
+
+  bool VisitHeapObjectHeader(HeapObjectHeader* header) {
+    if (header->IsFree()) return true;
+    accumulated_size_ += ObjectSize(header);
+    return true;
+  }
+
+  size_t accumulated_size_ = 0;
+};
+
+#if defined(CPPGC_CAGED_HEAP)
+VirtualMemory ReserveCagedHeap(v8::PageAllocator* platform_allocator) {
+  DCHECK_EQ(0u,
+            kCagedHeapReservationSize % platform_allocator->AllocatePageSize());
+
+  static constexpr size_t kAllocationTries = 4;
+  for (size_t i = 0; i < kAllocationTries; ++i) {
+    void* hint = reinterpret_cast<void*>(RoundDown(
+        reinterpret_cast<uintptr_t>(platform_allocator->GetRandomMmapAddr()),
+        kCagedHeapReservationAlignment));
+
+    VirtualMemory memory(platform_allocator, kCagedHeapReservationSize,
+                         kCagedHeapReservationAlignment, hint);
+    if (memory.IsReserved()) return memory;
+  }
+
+  FATAL("Fatal process out of memory: Failed to reserve memory for caged heap");
+  UNREACHABLE();
+}
+
+std::unique_ptr<v8::base::BoundedPageAllocator> CreateBoundedAllocator(
+    v8::PageAllocator* platform_allocator, void* caged_heap_start) {
+  DCHECK(caged_heap_start);
+
+  auto start = reinterpret_cast<v8::base::BoundedPageAllocator::Address>(
+      caged_heap_start);
+
+  return std::make_unique<v8::base::BoundedPageAllocator>(
+      platform_allocator, start, kCagedHeapReservationSize, kPageSize);
+}
+#endif
+
+}  // namespace
+
+// static
+cppgc::LivenessBroker LivenessBrokerFactory::Create() {
+  return cppgc::LivenessBroker();
+}
+
+Heap::Heap(std::shared_ptr<cppgc::Platform> platform, size_t custom_spaces)
+    : raw_heap_(this, custom_spaces),
+      platform_(std::move(platform)),
+#if defined(CPPGC_CAGED_HEAP)
+      reserved_area_(ReserveCagedHeap(platform_->GetPageAllocator())),
+      bounded_allocator_(CreateBoundedAllocator(platform_->GetPageAllocator(),
+                                                reserved_area_.address())),
+      page_backend_(std::make_unique<PageBackend>(bounded_allocator_.get())),
+#else
+      page_backend_(
+          std::make_unique<PageBackend>(platform_->GetPageAllocator())),
+#endif
+      object_allocator_(&raw_heap_),
+      sweeper_(&raw_heap_, platform_.get()),
+      stack_(std::make_unique<Stack>(v8::base::Stack::GetStackStart())),
+      prefinalizer_handler_(std::make_unique<PreFinalizerHandler>()) {
+}
+
+Heap::~Heap() {
+  NoGCScope no_gc(this);
+  // Finish already running GC if any, but don't finalize live objects.
+  sweeper_.Finish();
+}
+
+void Heap::CollectGarbage(GCConfig config) {
+  if (in_no_gc_scope()) return;
+
+  epoch_++;
+
+  // TODO(chromium:1056170): Replace with proper mark-sweep algorithm.
+  // "Marking".
+  marker_ = std::make_unique<Marker>(this);
+  Marker::MarkingConfig marking_config(config.stack_state);
+  marker_->StartMarking(marking_config);
+  marker_->FinishMarking(marking_config);
+  // "Sweeping and finalization".
+  {
+    // Pre finalizers are forbidden from allocating objects
+    NoAllocationScope no_allocation_scope_(this);
+    marker_->ProcessWeakness();
+    prefinalizer_handler_->InvokePreFinalizers();
   }
-  objects_.clear();
+  marker_.reset();
+  {
+    NoGCScope no_gc(this);
+    sweeper_.Start(config.sweep_type);
+  }
+}
+
+size_t Heap::ObjectPayloadSize() const {
+  return ObjectSizeCounter().GetSize(const_cast<RawHeap*>(&raw_heap()));
+}
+
+Heap::NoGCScope::NoGCScope(Heap* heap) : heap_(heap) { heap_->no_gc_scope_++; }
+
+Heap::NoGCScope::~NoGCScope() { heap_->no_gc_scope_--; }
+
+Heap::NoAllocationScope::NoAllocationScope(Heap* heap) : heap_(heap) {
+  heap_->no_allocation_scope_++;
 }
+Heap::NoAllocationScope::~NoAllocationScope() { heap_->no_allocation_scope_--; }
 
 }  // namespace internal
 }  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/heap.h b/deps/v8/src/heap/cppgc/heap.h
index baf70d8f4e4..60b1d0d5691 100644
--- a/deps/v8/src/heap/cppgc/heap.h
+++ b/deps/v8/src/heap/cppgc/heap.h
@@ -5,28 +5,155 @@
 #ifndef V8_HEAP_CPPGC_HEAP_H_
 #define V8_HEAP_CPPGC_HEAP_H_
 
+#include <memory>
 #include <vector>
 
-#include "include/cppgc/gc-info.h"
 #include "include/cppgc/heap.h"
+#include "include/cppgc/internal/gc-info.h"
+#include "include/cppgc/internal/persistent-node.h"
+#include "include/cppgc/liveness-broker.h"
+#include "include/cppgc/macros.h"
+#include "src/base/page-allocator.h"
 #include "src/heap/cppgc/heap-object-header.h"
+#include "src/heap/cppgc/marker.h"
+#include "src/heap/cppgc/object-allocator.h"
+#include "src/heap/cppgc/page-memory.h"
+#include "src/heap/cppgc/prefinalizer-handler.h"
+#include "src/heap/cppgc/raw-heap.h"
+#include "src/heap/cppgc/sweeper.h"
+#include "src/heap/cppgc/virtual-memory.h"
+
+#if defined(CPPGC_CAGED_HEAP)
+#include "src/base/bounded-page-allocator.h"
+#endif
 
 namespace cppgc {
 namespace internal {
 
+class Stack;
+
+class V8_EXPORT_PRIVATE LivenessBrokerFactory {
+ public:
+  static LivenessBroker Create();
+};
+
 class V8_EXPORT_PRIVATE Heap final : public cppgc::Heap {
  public:
+  // NoGCScope allows going over limits and avoids triggering garbage
+  // collection triggered through allocations or even explicitly.
+  class V8_EXPORT_PRIVATE NoGCScope final {
+    CPPGC_STACK_ALLOCATED();
+
+   public:
+    explicit NoGCScope(Heap* heap);
+    ~NoGCScope();
+
+    NoGCScope(const NoGCScope&) = delete;
+    NoGCScope& operator=(const NoGCScope&) = delete;
+
+   private:
+    Heap* const heap_;
+  };
+
+  // NoAllocationScope is used in debug mode to catch unwanted allocations. E.g.
+  // allocations during GC.
+  class V8_EXPORT_PRIVATE NoAllocationScope final {
+    CPPGC_STACK_ALLOCATED();
+
+   public:
+    explicit NoAllocationScope(Heap* heap);
+    ~NoAllocationScope();
+
+    NoAllocationScope(const NoAllocationScope&) = delete;
+    NoAllocationScope& operator=(const NoAllocationScope&) = delete;
+
+   private:
+    Heap* const heap_;
+  };
+
+  struct GCConfig {
+    using StackState = Heap::StackState;
+    using SweepType = Sweeper::Config;
+
+    static GCConfig Default() {
+      return {StackState::kMayContainHeapPointers, SweepType::kAtomic};
+    }
+
+    StackState stack_state = StackState::kMayContainHeapPointers;
+    SweepType sweep_type = SweepType::kAtomic;
+  };
+
   static Heap* From(cppgc::Heap* heap) { return static_cast<Heap*>(heap); }
 
-  Heap() = default;
-  ~Heap() final = default;
+  explicit Heap(std::shared_ptr<cppgc::Platform> platform,
+                size_t custom_spaces);
+  ~Heap() final;
 
   inline void* Allocate(size_t size, GCInfoIndex index);
+  inline void* Allocate(size_t size, GCInfoIndex index,
+                        CustomSpaceIndex space_index);
+
+  void CollectGarbage(GCConfig config = GCConfig::Default());
+
+  PreFinalizerHandler* prefinalizer_handler() {
+    return prefinalizer_handler_.get();
+  }
+
+  PersistentRegion& GetStrongPersistentRegion() {
+    return strong_persistent_region_;
+  }
+  const PersistentRegion& GetStrongPersistentRegion() const {
+    return strong_persistent_region_;
+  }
+  PersistentRegion& GetWeakPersistentRegion() {
+    return weak_persistent_region_;
+  }
+  const PersistentRegion& GetWeakPersistentRegion() const {
+    return weak_persistent_region_;
+  }
+
+  RawHeap& raw_heap() { return raw_heap_; }
+  const RawHeap& raw_heap() const { return raw_heap_; }
+
+  Stack* stack() { return stack_.get(); }
+
+  PageBackend* page_backend() { return page_backend_.get(); }
+  const PageBackend* page_backend() const { return page_backend_.get(); }
+
+  Sweeper& sweeper() { return sweeper_; }
 
-  void CollectGarbage();
+  size_t epoch() const { return epoch_; }
+
+  size_t ObjectPayloadSize() const;
 
  private:
-  std::vector<HeapObjectHeader*> objects_;
+  bool in_no_gc_scope() const { return no_gc_scope_ > 0; }
+  bool is_allocation_allowed() const { return no_allocation_scope_ == 0; }
+
+  RawHeap raw_heap_;
+
+  std::shared_ptr<cppgc::Platform> platform_;
+#if defined(CPPGC_CAGED_HEAP)
+  // The order is important: page_backend_ must be destroyed before
+  // reserved_area_ is freed.
+  VirtualMemory reserved_area_;
+  std::unique_ptr<v8::base::BoundedPageAllocator> bounded_allocator_;
+#endif
+  std::unique_ptr<PageBackend> page_backend_;
+  ObjectAllocator object_allocator_;
+  Sweeper sweeper_;
+
+  std::unique_ptr<Stack> stack_;
+  std::unique_ptr<PreFinalizerHandler> prefinalizer_handler_;
+  std::unique_ptr<Marker> marker_;
+
+  PersistentRegion strong_persistent_region_;
+  PersistentRegion weak_persistent_region_;
+
+  size_t epoch_ = 0;
+
+  size_t no_gc_scope_ = 0;
+  size_t no_allocation_scope_ = 0;
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/cppgc/liveness-broker.cc b/deps/v8/src/heap/cppgc/liveness-broker.cc
new file mode 100644
index 00000000000..bb912eb329e
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/liveness-broker.cc
@@ -0,0 +1,15 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "include/cppgc/liveness-broker.h"
+
+#include "src/heap/cppgc/heap-object-header-inl.h"
+
+namespace cppgc {
+
+bool LivenessBroker::IsHeapObjectAliveImpl(const void* payload) const {
+  return internal::HeapObjectHeader::FromPayload(payload).IsMarked();
+}
+
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/logging.cc b/deps/v8/src/heap/cppgc/logging.cc
new file mode 100644
index 00000000000..e98ca28dfb8
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/logging.cc
@@ -0,0 +1,29 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "include/cppgc/internal/logging.h"
+#include "include/cppgc/source-location.h"
+
+#include "src/base/logging.h"
+
+namespace cppgc {
+namespace internal {
+
+void DCheckImpl(const char* message, const SourceLocation& loc) {
+  V8_Dcheck(loc.FileName(), static_cast<int>(loc.Line()), message);
+}
+
+void FatalImpl(const char* message, const SourceLocation& loc) {
+#if DEBUG
+  V8_Fatal(loc.FileName(), static_cast<int>(loc.Line()), "Check failed: %s.",
+           message);
+#elif !defined(OFFICIAL_BUILD)
+  V8_Fatal("Check failed: %s.", message);
+#else
+  V8_Fatal("ignored");
+#endif
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/marker.cc b/deps/v8/src/heap/cppgc/marker.cc
new file mode 100644
index 00000000000..3986841800b
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/marker.cc
@@ -0,0 +1,189 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/marker.h"
+
+#include "src/heap/cppgc/heap-object-header-inl.h"
+#include "src/heap/cppgc/heap-visitor.h"
+#include "src/heap/cppgc/heap.h"
+#include "src/heap/cppgc/marking-visitor.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+class ResetLocalAllocationBufferVisitor final
+    : public HeapVisitor<ResetLocalAllocationBufferVisitor> {
+ public:
+  bool VisitLargePageSpace(LargePageSpace*) { return true; }
+  bool VisitNormalPageSpace(NormalPageSpace* space) {
+    space->ResetLinearAllocationBuffer();
+    return true;
+  }
+};
+
+void ResetLocalAllocationBuffers(Heap* heap) {
+  ResetLocalAllocationBufferVisitor visitor;
+  visitor.Traverse(&heap->raw_heap());
+}
+}  // namespace
+
+namespace {
+template <typename Worklist, typename Callback>
+bool DrainWorklistWithDeadline(v8::base::TimeTicks deadline, Worklist* worklist,
+                               Callback callback, int task_id) {
+  const size_t kDeadlineCheckInterval = 1250;
+
+  size_t processed_callback_count = 0;
+  typename Worklist::View view(worklist, task_id);
+  typename Worklist::EntryType item;
+  while (view.Pop(&item)) {
+    callback(item);
+    if (++processed_callback_count == kDeadlineCheckInterval) {
+      if (deadline <= v8::base::TimeTicks::Now()) {
+        return false;
+      }
+      processed_callback_count = 0;
+    }
+  }
+  return true;
+}
+}  // namespace
+
+constexpr int Marker::kMutatorThreadId;
+
+Marker::Marker(Heap* heap)
+    : heap_(heap), marking_visitor_(CreateMutatorThreadMarkingVisitor()) {}
+
+Marker::~Marker() {
+  // The fixed point iteration may have found not-fully-constructed objects.
+  // Such objects should have already been found through the stack scan though
+  // and should thus already be marked.
+  if (!not_fully_constructed_worklist_.IsEmpty()) {
+#if DEBUG
+    DCHECK_NE(MarkingConfig::StackState::kNoHeapPointers, config_.stack_state_);
+    NotFullyConstructedItem item;
+    NotFullyConstructedWorklist::View view(&not_fully_constructed_worklist_,
+                                           kMutatorThreadId);
+    while (view.Pop(&item)) {
+      const HeapObjectHeader& header =
+          BasePage::FromPayload(item)->ObjectHeaderFromInnerAddress(
+              static_cast<ConstAddress>(item));
+      DCHECK(header.IsMarked());
+    }
+#else
+    not_fully_constructed_worklist_.Clear();
+#endif
+  }
+}
+
+void Marker::StartMarking(MarkingConfig config) {
+  config_ = config;
+  VisitRoots();
+}
+
+void Marker::FinishMarking(MarkingConfig config) {
+  config_ = config;
+
+  // Reset LABs before trying to conservatively mark in-construction objects.
+  // This is also needed in preparation for sweeping.
+  ResetLocalAllocationBuffers(heap_);
+  if (config_.stack_state_ == MarkingConfig::StackState::kNoHeapPointers) {
+    FlushNotFullyConstructedObjects();
+  } else {
+    MarkNotFullyConstructedObjects();
+  }
+  AdvanceMarkingWithDeadline(v8::base::TimeDelta::Max());
+}
+
+void Marker::ProcessWeakness() {
+  heap_->GetWeakPersistentRegion().Trace(marking_visitor_.get());
+
+  // Call weak callbacks on objects that may now be pointing to dead objects.
+  WeakCallbackItem item;
+  LivenessBroker broker = LivenessBrokerFactory::Create();
+  WeakCallbackWorklist::View view(&weak_callback_worklist_, kMutatorThreadId);
+  while (view.Pop(&item)) {
+    item.callback(broker, item.parameter);
+  }
+  // Weak callbacks should not add any new objects for marking.
+  DCHECK(marking_worklist_.IsEmpty());
+}
+
+void Marker::VisitRoots() {
+  // Reset LABs before scanning roots. LABs are cleared to allow
+  // ObjectStartBitmap handling without considering LABs.
+  ResetLocalAllocationBuffers(heap_);
+
+  heap_->GetStrongPersistentRegion().Trace(marking_visitor_.get());
+  if (config_.stack_state_ != MarkingConfig::StackState::kNoHeapPointers)
+    heap_->stack()->IteratePointers(marking_visitor_.get());
+}
+
+std::unique_ptr<MutatorThreadMarkingVisitor>
+Marker::CreateMutatorThreadMarkingVisitor() {
+  return std::make_unique<MutatorThreadMarkingVisitor>(this);
+}
+
+bool Marker::AdvanceMarkingWithDeadline(v8::base::TimeDelta duration) {
+  MutatorThreadMarkingVisitor* visitor = marking_visitor_.get();
+  v8::base::TimeTicks deadline = v8::base::TimeTicks::Now() + duration;
+
+  do {
+    // Convert |previously_not_fully_constructed_worklist_| to
+    // |marking_worklist_|. This merely re-adds items with the proper
+    // callbacks.
+    if (!DrainWorklistWithDeadline(
+            deadline, &previously_not_fully_constructed_worklist_,
+            [visitor](NotFullyConstructedItem& item) {
+              visitor->DynamicallyMarkAddress(
+                  reinterpret_cast<ConstAddress>(item));
+            },
+            kMutatorThreadId))
+      return false;
+
+    if (!DrainWorklistWithDeadline(
+            deadline, &marking_worklist_,
+            [visitor](const MarkingItem& item) {
+              const HeapObjectHeader& header =
+                  HeapObjectHeader::FromPayload(item.base_object_payload);
+              DCHECK(!MutatorThreadMarkingVisitor::IsInConstruction(header));
+              item.callback(visitor, item.base_object_payload);
+              visitor->AccountMarkedBytes(header);
+            },
+            kMutatorThreadId))
+      return false;
+  } while (!marking_worklist_.IsLocalViewEmpty(kMutatorThreadId));
+
+  return true;
+}
+
+void Marker::FlushNotFullyConstructedObjects() {
+  if (!not_fully_constructed_worklist_.IsLocalViewEmpty(kMutatorThreadId)) {
+    not_fully_constructed_worklist_.FlushToGlobal(kMutatorThreadId);
+    previously_not_fully_constructed_worklist_.MergeGlobalPool(
+        &not_fully_constructed_worklist_);
+  }
+  DCHECK(not_fully_constructed_worklist_.IsLocalViewEmpty(kMutatorThreadId));
+}
+
+void Marker::MarkNotFullyConstructedObjects() {
+  NotFullyConstructedItem item;
+  NotFullyConstructedWorklist::View view(&not_fully_constructed_worklist_,
+                                         kMutatorThreadId);
+  while (view.Pop(&item)) {
+    marking_visitor_->ConservativelyMarkAddress(
+        BasePage::FromPayload(item), reinterpret_cast<ConstAddress>(item));
+  }
+}
+
+void Marker::ClearAllWorklistsForTesting() {
+  marking_worklist_.Clear();
+  not_fully_constructed_worklist_.Clear();
+  previously_not_fully_constructed_worklist_.Clear();
+  weak_callback_worklist_.Clear();
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/marker.h b/deps/v8/src/heap/cppgc/marker.h
new file mode 100644
index 00000000000..f26b12eea05
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/marker.h
@@ -0,0 +1,127 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_MARKER_H_
+#define V8_HEAP_CPPGC_MARKER_H_
+
+#include <memory>
+
+#include "include/cppgc/heap.h"
+#include "include/cppgc/trace-trait.h"
+#include "include/cppgc/visitor.h"
+#include "src/base/platform/time.h"
+#include "src/heap/cppgc/worklist.h"
+
+namespace cppgc {
+namespace internal {
+
+class Heap;
+class MutatorThreadMarkingVisitor;
+
+class V8_EXPORT_PRIVATE Marker {
+  static constexpr int kNumConcurrentMarkers = 0;
+  static constexpr int kNumMarkers = 1 + kNumConcurrentMarkers;
+
+ public:
+  static constexpr int kMutatorThreadId = 0;
+
+  using MarkingItem = cppgc::TraceDescriptor;
+  using NotFullyConstructedItem = const void*;
+  struct WeakCallbackItem {
+    cppgc::WeakCallback callback;
+    const void* parameter;
+  };
+
+  // Segment size of 512 entries necessary to avoid throughput regressions.
+  // Since the work list is currently a temporary object this is not a problem.
+  using MarkingWorklist =
+      Worklist<MarkingItem, 512 /* local entries */, kNumMarkers>;
+  using NotFullyConstructedWorklist =
+      Worklist<NotFullyConstructedItem, 16 /* local entries */, kNumMarkers>;
+  using WeakCallbackWorklist =
+      Worklist<WeakCallbackItem, 64 /* local entries */, kNumMarkers>;
+
+  struct MarkingConfig {
+    using StackState = cppgc::Heap::StackState;
+    enum class IncrementalMarking : uint8_t { kDisabled };
+    enum class ConcurrentMarking : uint8_t { kDisabled };
+
+    static MarkingConfig Default() {
+      return {StackState::kMayContainHeapPointers,
+              IncrementalMarking::kDisabled, ConcurrentMarking::kDisabled};
+    }
+
+    explicit MarkingConfig(StackState stack_state)
+        : MarkingConfig(stack_state, IncrementalMarking::kDisabled,
+                        ConcurrentMarking::kDisabled) {}
+
+    MarkingConfig(StackState stack_state,
+                  IncrementalMarking incremental_marking_state,
+                  ConcurrentMarking concurrent_marking_state)
+        : stack_state_(stack_state),
+          incremental_marking_state_(incremental_marking_state),
+          concurrent_marking_state_(concurrent_marking_state) {}
+
+    StackState stack_state_;
+    IncrementalMarking incremental_marking_state_;
+    ConcurrentMarking concurrent_marking_state_;
+  };
+
+  explicit Marker(Heap* heap);
+  virtual ~Marker();
+
+  Marker(const Marker&) = delete;
+  Marker& operator=(const Marker&) = delete;
+
+  // Initialize marking according to the given config. This method will
+  // trigger incremental/concurrent marking if needed.
+  void StartMarking(MarkingConfig config);
+  // Finalize marking. This method stops incremental/concurrent marking
+  // if exsists and performs atomic pause marking. FinishMarking may
+  // update the MarkingConfig, e.g. if the stack state has changed.
+  void FinishMarking(MarkingConfig config);
+
+  void ProcessWeakness();
+
+  Heap* heap() { return heap_; }
+  MarkingWorklist* marking_worklist() { return &marking_worklist_; }
+  NotFullyConstructedWorklist* not_fully_constructed_worklist() {
+    return &not_fully_constructed_worklist_;
+  }
+  WeakCallbackWorklist* weak_callback_worklist() {
+    return &weak_callback_worklist_;
+  }
+
+  void ClearAllWorklistsForTesting();
+
+  MutatorThreadMarkingVisitor* GetMarkingVisitorForTesting() {
+    return marking_visitor_.get();
+  }
+
+ protected:
+  virtual std::unique_ptr<MutatorThreadMarkingVisitor>
+  CreateMutatorThreadMarkingVisitor();
+
+ private:
+  void VisitRoots();
+
+  bool AdvanceMarkingWithDeadline(v8::base::TimeDelta);
+  void FlushNotFullyConstructedObjects();
+  void MarkNotFullyConstructedObjects();
+
+  Heap* const heap_;
+  MarkingConfig config_ = MarkingConfig::Default();
+
+  std::unique_ptr<MutatorThreadMarkingVisitor> marking_visitor_;
+
+  MarkingWorklist marking_worklist_;
+  NotFullyConstructedWorklist not_fully_constructed_worklist_;
+  NotFullyConstructedWorklist previously_not_fully_constructed_worklist_;
+  WeakCallbackWorklist weak_callback_worklist_;
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_MARKER_H_
diff --git a/deps/v8/src/heap/cppgc/marking-visitor.cc b/deps/v8/src/heap/cppgc/marking-visitor.cc
new file mode 100644
index 00000000000..119546ce726
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/marking-visitor.cc
@@ -0,0 +1,195 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/marking-visitor.h"
+
+#include "include/cppgc/garbage-collected.h"
+#include "include/cppgc/internal/accessors.h"
+#include "src/heap/cppgc/heap-object-header-inl.h"
+#include "src/heap/cppgc/heap-page.h"
+#include "src/heap/cppgc/heap.h"
+#include "src/heap/cppgc/page-memory-inl.h"
+#include "src/heap/cppgc/sanitizers.h"
+
+namespace cppgc {
+namespace internal {
+
+// static
+bool MarkingVisitor::IsInConstruction(const HeapObjectHeader& header) {
+  return header.IsInConstruction<HeapObjectHeader::AccessMode::kNonAtomic>();
+}
+
+MarkingVisitor::MarkingVisitor(Marker* marking_handler, int task_id)
+    : marker_(marking_handler),
+      marking_worklist_(marking_handler->marking_worklist(), task_id),
+      not_fully_constructed_worklist_(
+          marking_handler->not_fully_constructed_worklist(), task_id),
+      weak_callback_worklist_(marking_handler->weak_callback_worklist(),
+                              task_id) {}
+
+void MarkingVisitor::AccountMarkedBytes(const HeapObjectHeader& header) {
+  marked_bytes_ +=
+      header.IsLargeObject()
+          ? reinterpret_cast<const LargePage*>(BasePage::FromPayload(&header))
+                ->PayloadSize()
+          : header.GetSize();
+}
+
+void MarkingVisitor::Visit(const void* object, TraceDescriptor desc) {
+  DCHECK_NOT_NULL(object);
+  if (desc.base_object_payload ==
+      cppgc::GarbageCollectedMixin::kNotFullyConstructedObject) {
+    // This means that the objects are not-yet-fully-constructed. See comments
+    // on GarbageCollectedMixin for how those objects are handled.
+    not_fully_constructed_worklist_.Push(object);
+    return;
+  }
+  MarkHeader(&HeapObjectHeader::FromPayload(
+                 const_cast<void*>(desc.base_object_payload)),
+             desc);
+}
+
+void MarkingVisitor::VisitWeak(const void* object, TraceDescriptor desc,
+                               WeakCallback weak_callback,
+                               const void* weak_member) {
+  // Filter out already marked values. The write barrier for WeakMember
+  // ensures that any newly set value after this point is kept alive and does
+  // not require the callback.
+  if (desc.base_object_payload !=
+          cppgc::GarbageCollectedMixin::kNotFullyConstructedObject &&
+      HeapObjectHeader::FromPayload(desc.base_object_payload)
+          .IsMarked<HeapObjectHeader::AccessMode::kAtomic>())
+    return;
+  RegisterWeakCallback(weak_callback, weak_member);
+}
+
+void MarkingVisitor::VisitRoot(const void* object, TraceDescriptor desc) {
+  Visit(object, desc);
+}
+
+void MarkingVisitor::VisitWeakRoot(const void* object, TraceDescriptor desc,
+                                   WeakCallback weak_callback,
+                                   const void* weak_root) {
+  if (desc.base_object_payload ==
+      cppgc::GarbageCollectedMixin::kNotFullyConstructedObject) {
+    // This method is only called at the end of marking. If the object is in
+    // construction, then it should be reachable from the stack.
+    return;
+  }
+  // Since weak roots arev only traced at the end of marking, we can execute
+  // the callback instead of registering it.
+  weak_callback(LivenessBrokerFactory::Create(), weak_root);
+}
+
+void MarkingVisitor::MarkHeader(HeapObjectHeader* header,
+                                TraceDescriptor desc) {
+  DCHECK(header);
+  DCHECK_NOT_NULL(desc.callback);
+
+  if (IsInConstruction(*header)) {
+    not_fully_constructed_worklist_.Push(header->Payload());
+  } else if (MarkHeaderNoTracing(header)) {
+    marking_worklist_.Push(desc);
+  }
+}
+
+bool MarkingVisitor::MarkHeaderNoTracing(HeapObjectHeader* header) {
+  DCHECK(header);
+  // A GC should only mark the objects that belong in its heap.
+  DCHECK_EQ(marker_->heap(), BasePage::FromPayload(header)->heap());
+  // Never mark free space objects. This would e.g. hint to marking a promptly
+  // freed backing store.
+  DCHECK(!header->IsFree());
+
+  return header->TryMarkAtomic();
+}
+
+void MarkingVisitor::RegisterWeakCallback(WeakCallback callback,
+                                          const void* object) {
+  weak_callback_worklist_.Push({callback, object});
+}
+
+void MarkingVisitor::FlushWorklists() {
+  marking_worklist_.FlushToGlobal();
+  not_fully_constructed_worklist_.FlushToGlobal();
+  weak_callback_worklist_.FlushToGlobal();
+}
+
+void MarkingVisitor::DynamicallyMarkAddress(ConstAddress address) {
+  HeapObjectHeader& header =
+      BasePage::FromPayload(address)->ObjectHeaderFromInnerAddress(
+          const_cast<Address>(address));
+  DCHECK(!IsInConstruction(header));
+  if (MarkHeaderNoTracing(&header)) {
+    marking_worklist_.Push(
+        {reinterpret_cast<void*>(header.Payload()),
+         GlobalGCInfoTable::GCInfoFromIndex(header.GetGCInfoIndex()).trace});
+  }
+}
+
+void MarkingVisitor::ConservativelyMarkAddress(const BasePage* page,
+                                               ConstAddress address) {
+  HeapObjectHeader* const header =
+      page->TryObjectHeaderFromInnerAddress(const_cast<Address>(address));
+
+  if (!header || header->IsMarked()) return;
+
+  // Simple case for fully constructed objects. This just adds the object to the
+  // regular marking worklist.
+  if (!IsInConstruction(*header)) {
+    MarkHeader(
+        header,
+        {header->Payload(),
+         GlobalGCInfoTable::GCInfoFromIndex(header->GetGCInfoIndex()).trace});
+    return;
+  }
+
+  // This case is reached for not-fully-constructed objects with vtables.
+  // We can differentiate multiple cases:
+  // 1. No vtable set up. Example:
+  //      class A : public GarbageCollected<A> { virtual void f() = 0; };
+  //      class B : public A { B() : A(foo()) {}; };
+  //    The vtable for A is not set up if foo() allocates and triggers a GC.
+  //
+  // 2. Vtables properly set up (non-mixin case).
+  // 3. Vtables not properly set up (mixin) if GC is allowed during mixin
+  //    construction.
+  //
+  // We use a simple conservative approach for these cases as they are not
+  // performance critical.
+  MarkHeaderNoTracing(header);
+  Address* payload = reinterpret_cast<Address*>(header->Payload());
+  const size_t payload_size = header->GetSize();
+  for (size_t i = 0; i < (payload_size / sizeof(Address)); ++i) {
+    Address maybe_ptr = payload[i];
+#if defined(MEMORY_SANITIZER)
+    // |payload| may be uninitialized by design or just contain padding bytes.
+    // Copy into a local variable that is unpoisoned for conservative marking.
+    // Copy into a temporary variable to maintain the original MSAN state.
+    MSAN_UNPOISON(&maybe_ptr, sizeof(maybe_ptr));
+#endif
+    if (maybe_ptr) VisitPointer(maybe_ptr);
+  }
+  AccountMarkedBytes(*header);
+}
+
+void MarkingVisitor::VisitPointer(const void* address) {
+  // TODO(chromium:1056170): Add page bloom filter
+
+  const BasePage* page =
+      reinterpret_cast<const BasePage*>(marker_->heap()->page_backend()->Lookup(
+          static_cast<ConstAddress>(address)));
+
+  if (!page) return;
+
+  DCHECK_EQ(marker_->heap(), page->heap());
+
+  ConservativelyMarkAddress(page, reinterpret_cast<ConstAddress>(address));
+}
+
+MutatorThreadMarkingVisitor::MutatorThreadMarkingVisitor(Marker* marker)
+    : MarkingVisitor(marker, Marker::kMutatorThreadId) {}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/marking-visitor.h b/deps/v8/src/heap/cppgc/marking-visitor.h
new file mode 100644
index 00000000000..3678d743850
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/marking-visitor.h
@@ -0,0 +1,72 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_MARKING_VISITOR_H_
+#define V8_HEAP_CPPGC_MARKING_VISITOR_H_
+
+#include "include/cppgc/source-location.h"
+#include "include/cppgc/trace-trait.h"
+#include "include/v8config.h"
+#include "src/heap/cppgc/globals.h"
+#include "src/heap/cppgc/heap.h"
+#include "src/heap/cppgc/marker.h"
+#include "src/heap/cppgc/stack.h"
+#include "src/heap/cppgc/visitor.h"
+
+namespace cppgc {
+namespace internal {
+
+class BasePage;
+class HeapObjectHeader;
+
+class MarkingVisitor : public VisitorBase, public StackVisitor {
+ public:
+  MarkingVisitor(Marker*, int);
+  virtual ~MarkingVisitor() = default;
+
+  MarkingVisitor(const MarkingVisitor&) = delete;
+  MarkingVisitor& operator=(const MarkingVisitor&) = delete;
+
+  void FlushWorklists();
+
+  void DynamicallyMarkAddress(ConstAddress);
+  void ConservativelyMarkAddress(const BasePage*, ConstAddress);
+
+  void AccountMarkedBytes(const HeapObjectHeader&);
+  size_t marked_bytes() const { return marked_bytes_; }
+
+  static bool IsInConstruction(const HeapObjectHeader&);
+
+ protected:
+  void Visit(const void*, TraceDescriptor) override;
+  void VisitWeak(const void*, TraceDescriptor, WeakCallback,
+                 const void*) override;
+  void VisitRoot(const void*, TraceDescriptor) override;
+  void VisitWeakRoot(const void*, TraceDescriptor, WeakCallback,
+                     const void*) override;
+
+  void VisitPointer(const void*) override;
+
+ private:
+  void MarkHeader(HeapObjectHeader*, TraceDescriptor);
+  bool MarkHeaderNoTracing(HeapObjectHeader*);
+  void RegisterWeakCallback(WeakCallback, const void*) override;
+
+  Marker* const marker_;
+  Marker::MarkingWorklist::View marking_worklist_;
+  Marker::NotFullyConstructedWorklist::View not_fully_constructed_worklist_;
+  Marker::WeakCallbackWorklist::View weak_callback_worklist_;
+
+  size_t marked_bytes_;
+};
+
+class V8_EXPORT_PRIVATE MutatorThreadMarkingVisitor : public MarkingVisitor {
+ public:
+  explicit MutatorThreadMarkingVisitor(Marker*);
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_MARKING_VISITOR_H_
diff --git a/deps/v8/src/heap/cppgc/object-allocator-inl.h b/deps/v8/src/heap/cppgc/object-allocator-inl.h
new file mode 100644
index 00000000000..7d8d126d633
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/object-allocator-inl.h
@@ -0,0 +1,74 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_OBJECT_ALLOCATOR_INL_H_
+#define V8_HEAP_CPPGC_OBJECT_ALLOCATOR_INL_H_
+
+#include <new>
+
+#include "src/base/logging.h"
+#include "src/heap/cppgc/heap-object-header-inl.h"
+#include "src/heap/cppgc/heap-object-header.h"
+#include "src/heap/cppgc/heap-page.h"
+#include "src/heap/cppgc/object-allocator.h"
+#include "src/heap/cppgc/object-start-bitmap-inl.h"
+#include "src/heap/cppgc/object-start-bitmap.h"
+#include "src/heap/cppgc/sanitizers.h"
+
+namespace cppgc {
+namespace internal {
+
+void* ObjectAllocator::AllocateObject(size_t size, GCInfoIndex gcinfo) {
+  const size_t allocation_size =
+      RoundUp<kAllocationGranularity>(size + sizeof(HeapObjectHeader));
+  const RawHeap::RegularSpaceType type =
+      GetInitialSpaceIndexForSize(allocation_size);
+  return AllocateObjectOnSpace(NormalPageSpace::From(raw_heap_->Space(type)),
+                               allocation_size, gcinfo);
+}
+
+void* ObjectAllocator::AllocateObject(size_t size, GCInfoIndex gcinfo,
+                                      CustomSpaceIndex space_index) {
+  const size_t allocation_size =
+      RoundUp<kAllocationGranularity>(size + sizeof(HeapObjectHeader));
+  return AllocateObjectOnSpace(
+      NormalPageSpace::From(raw_heap_->CustomSpace(space_index)),
+      allocation_size, gcinfo);
+}
+
+// static
+RawHeap::RegularSpaceType ObjectAllocator::GetInitialSpaceIndexForSize(
+    size_t size) {
+  if (size < 64) {
+    if (size < 32) return RawHeap::RegularSpaceType::kNormal1;
+    return RawHeap::RegularSpaceType::kNormal2;
+  }
+  if (size < 128) return RawHeap::RegularSpaceType::kNormal3;
+  return RawHeap::RegularSpaceType::kNormal4;
+}
+
+void* ObjectAllocator::AllocateObjectOnSpace(NormalPageSpace* space,
+                                             size_t size, GCInfoIndex gcinfo) {
+  DCHECK_LT(0u, gcinfo);
+
+  NormalPageSpace::LinearAllocationBuffer& current_lab =
+      space->linear_allocation_buffer();
+  if (current_lab.size() < size) {
+    return OutOfLineAllocate(space, size, gcinfo);
+  }
+
+  void* raw = current_lab.Allocate(size);
+  SET_MEMORY_ACCESIBLE(raw, size);
+  auto* header = new (raw) HeapObjectHeader(size, gcinfo);
+
+  NormalPage::From(BasePage::FromPayload(header))
+      ->object_start_bitmap()
+      .SetBit(reinterpret_cast<ConstAddress>(header));
+
+  return header->Payload();
+}
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_OBJECT_ALLOCATOR_INL_H_
diff --git a/deps/v8/src/heap/cppgc/object-allocator.cc b/deps/v8/src/heap/cppgc/object-allocator.cc
new file mode 100644
index 00000000000..df83d8ee9d3
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/object-allocator.cc
@@ -0,0 +1,87 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/object-allocator.h"
+
+#include "src/heap/cppgc/globals.h"
+#include "src/heap/cppgc/heap-object-header-inl.h"
+#include "src/heap/cppgc/heap-object-header.h"
+#include "src/heap/cppgc/heap-page.h"
+#include "src/heap/cppgc/heap-space.h"
+#include "src/heap/cppgc/heap.h"
+#include "src/heap/cppgc/object-allocator-inl.h"
+#include "src/heap/cppgc/object-start-bitmap.h"
+#include "src/heap/cppgc/page-memory.h"
+#include "src/heap/cppgc/sweeper.h"
+
+namespace cppgc {
+namespace internal {
+namespace {
+
+void* AllocateLargeObject(RawHeap* raw_heap, LargePageSpace* space, size_t size,
+                          GCInfoIndex gcinfo) {
+  LargePage* page = LargePage::Create(space, size);
+  auto* header = new (page->ObjectHeader())
+      HeapObjectHeader(HeapObjectHeader::kLargeObjectSizeInHeader, gcinfo);
+
+  return header->Payload();
+}
+
+}  // namespace
+
+ObjectAllocator::ObjectAllocator(RawHeap* heap) : raw_heap_(heap) {}
+
+void* ObjectAllocator::OutOfLineAllocate(NormalPageSpace* space, size_t size,
+                                         GCInfoIndex gcinfo) {
+  DCHECK_EQ(0, size & kAllocationMask);
+  DCHECK_LE(kFreeListEntrySize, size);
+
+  // 1. If this allocation is big enough, allocate a large object.
+  if (size >= kLargeObjectSizeThreshold) {
+    auto* large_space = LargePageSpace::From(
+        raw_heap_->Space(RawHeap::RegularSpaceType::kLarge));
+    return AllocateLargeObject(raw_heap_, large_space, size, gcinfo);
+  }
+
+  // 2. Try to allocate from the freelist.
+  if (void* result = AllocateFromFreeList(space, size, gcinfo)) {
+    return result;
+  }
+
+  // 3. Lazily sweep pages of this heap until we find a freed area for
+  // this allocation or we finish sweeping all pages of this heap.
+  // TODO(chromium:1056170): Add lazy sweep.
+
+  // 4. Complete sweeping.
+  raw_heap_->heap()->sweeper().Finish();
+
+  // 5. Add a new page to this heap.
+  NormalPage::Create(space);
+
+  // 6. Try to allocate from the freelist. This allocation must succeed.
+  void* result = AllocateFromFreeList(space, size, gcinfo);
+  CPPGC_CHECK(result);
+
+  return result;
+}
+
+void* ObjectAllocator::AllocateFromFreeList(NormalPageSpace* space, size_t size,
+                                            GCInfoIndex gcinfo) {
+  const FreeList::Block entry = space->free_list().Allocate(size);
+  if (!entry.address) return nullptr;
+
+  auto& current_lab = space->linear_allocation_buffer();
+  if (current_lab.size()) {
+    space->AddToFreeList(current_lab.start(), current_lab.size());
+  }
+
+  current_lab.Set(static_cast<Address>(entry.address), entry.size);
+  NormalPage::From(BasePage::FromPayload(current_lab.start()))
+      ->object_start_bitmap()
+      .ClearBit(current_lab.start());
+  return AllocateObjectOnSpace(space, size, gcinfo);
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/object-allocator.h b/deps/v8/src/heap/cppgc/object-allocator.h
new file mode 100644
index 00000000000..510a935f565
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/object-allocator.h
@@ -0,0 +1,40 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_OBJECT_ALLOCATOR_H_
+#define V8_HEAP_CPPGC_OBJECT_ALLOCATOR_H_
+
+#include "include/cppgc/internal/gc-info.h"
+#include "src/heap/cppgc/heap-space.h"
+#include "src/heap/cppgc/raw-heap.h"
+
+namespace cppgc {
+namespace internal {
+
+class V8_EXPORT_PRIVATE ObjectAllocator final {
+ public:
+  explicit ObjectAllocator(RawHeap* heap);
+
+  inline void* AllocateObject(size_t size, GCInfoIndex gcinfo);
+  inline void* AllocateObject(size_t size, GCInfoIndex gcinfo,
+                              CustomSpaceIndex space_index);
+
+ private:
+  // Returns the initially tried SpaceType to allocate an object of |size| bytes
+  // on. Returns the largest regular object size bucket for large objects.
+  inline static RawHeap::RegularSpaceType GetInitialSpaceIndexForSize(
+      size_t size);
+
+  inline void* AllocateObjectOnSpace(NormalPageSpace* space, size_t size,
+                                     GCInfoIndex gcinfo);
+  void* OutOfLineAllocate(NormalPageSpace*, size_t, GCInfoIndex);
+  void* AllocateFromFreeList(NormalPageSpace*, size_t, GCInfoIndex);
+
+  RawHeap* raw_heap_;
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_OBJECT_ALLOCATOR_H_
diff --git a/deps/v8/src/heap/cppgc/object-start-bitmap-inl.h b/deps/v8/src/heap/cppgc/object-start-bitmap-inl.h
new file mode 100644
index 00000000000..6d963cc9486
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/object-start-bitmap-inl.h
@@ -0,0 +1,96 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_OBJECT_START_BITMAP_INL_H_
+#define V8_HEAP_CPPGC_OBJECT_START_BITMAP_INL_H_
+
+#include <algorithm>
+
+#include "src/base/bits.h"
+#include "src/heap/cppgc/object-start-bitmap.h"
+
+namespace cppgc {
+namespace internal {
+
+ObjectStartBitmap::ObjectStartBitmap(Address offset) : offset_(offset) {
+  Clear();
+}
+
+HeapObjectHeader* ObjectStartBitmap::FindHeader(
+    ConstAddress address_maybe_pointing_to_the_middle_of_object) const {
+  DCHECK_LE(offset_, address_maybe_pointing_to_the_middle_of_object);
+  size_t object_offset =
+      address_maybe_pointing_to_the_middle_of_object - offset_;
+  size_t object_start_number = object_offset / kAllocationGranularity;
+  size_t cell_index = object_start_number / kBitsPerCell;
+  DCHECK_GT(object_start_bit_map_.size(), cell_index);
+  const size_t bit = object_start_number & kCellMask;
+  uint8_t byte = object_start_bit_map_[cell_index] & ((1 << (bit + 1)) - 1);
+  while (!byte && cell_index) {
+    DCHECK_LT(0u, cell_index);
+    byte = object_start_bit_map_[--cell_index];
+  }
+  const int leading_zeroes = v8::base::bits::CountLeadingZeros(byte);
+  object_start_number =
+      (cell_index * kBitsPerCell) + (kBitsPerCell - 1) - leading_zeroes;
+  object_offset = object_start_number * kAllocationGranularity;
+  return reinterpret_cast<HeapObjectHeader*>(object_offset + offset_);
+}
+
+void ObjectStartBitmap::SetBit(ConstAddress header_address) {
+  size_t cell_index, object_bit;
+  ObjectStartIndexAndBit(header_address, &cell_index, &object_bit);
+  object_start_bit_map_[cell_index] |= (1 << object_bit);
+}
+
+void ObjectStartBitmap::ClearBit(ConstAddress header_address) {
+  size_t cell_index, object_bit;
+  ObjectStartIndexAndBit(header_address, &cell_index, &object_bit);
+  object_start_bit_map_[cell_index] &= ~(1 << object_bit);
+}
+
+bool ObjectStartBitmap::CheckBit(ConstAddress header_address) const {
+  size_t cell_index, object_bit;
+  ObjectStartIndexAndBit(header_address, &cell_index, &object_bit);
+  return object_start_bit_map_[cell_index] & (1 << object_bit);
+}
+
+void ObjectStartBitmap::ObjectStartIndexAndBit(ConstAddress header_address,
+                                               size_t* cell_index,
+                                               size_t* bit) const {
+  const size_t object_offset = header_address - offset_;
+  DCHECK(!(object_offset & kAllocationMask));
+  const size_t object_start_number = object_offset / kAllocationGranularity;
+  *cell_index = object_start_number / kBitsPerCell;
+  DCHECK_GT(kBitmapSize, *cell_index);
+  *bit = object_start_number & kCellMask;
+}
+
+template <typename Callback>
+inline void ObjectStartBitmap::Iterate(Callback callback) const {
+  for (size_t cell_index = 0; cell_index < kReservedForBitmap; cell_index++) {
+    if (!object_start_bit_map_[cell_index]) continue;
+
+    uint8_t value = object_start_bit_map_[cell_index];
+    while (value) {
+      const int trailing_zeroes = v8::base::bits::CountTrailingZeros(value);
+      const size_t object_start_number =
+          (cell_index * kBitsPerCell) + trailing_zeroes;
+      const Address object_address =
+          offset_ + (kAllocationGranularity * object_start_number);
+      callback(object_address);
+      // Clear current object bit in temporary value to advance iteration.
+      value &= ~(1 << (object_start_number & kCellMask));
+    }
+  }
+}
+
+void ObjectStartBitmap::Clear() {
+  std::fill(object_start_bit_map_.begin(), object_start_bit_map_.end(), 0);
+}
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_OBJECT_START_BITMAP_INL_H_
diff --git a/deps/v8/src/heap/cppgc/object-start-bitmap.h b/deps/v8/src/heap/cppgc/object-start-bitmap.h
new file mode 100644
index 00000000000..1a180a552e9
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/object-start-bitmap.h
@@ -0,0 +1,80 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_OBJECT_START_BITMAP_H_
+#define V8_HEAP_CPPGC_OBJECT_START_BITMAP_H_
+
+#include <limits.h>
+#include <stdint.h>
+
+#include <array>
+
+#include "src/base/macros.h"
+#include "src/heap/cppgc/globals.h"
+
+namespace cppgc {
+namespace internal {
+
+class HeapObjectHeader;
+
+// A bitmap for recording object starts. Objects have to be allocated at
+// minimum granularity of kGranularity.
+//
+// Depends on internals such as:
+// - kBlinkPageSize
+// - kAllocationGranularity
+class V8_EXPORT_PRIVATE ObjectStartBitmap {
+ public:
+  // Granularity of addresses added to the bitmap.
+  static constexpr size_t Granularity() { return kAllocationGranularity; }
+
+  // Maximum number of entries in the bitmap.
+  static constexpr size_t MaxEntries() {
+    return kReservedForBitmap * kBitsPerCell;
+  }
+
+  explicit inline ObjectStartBitmap(Address offset);
+
+  // Finds an object header based on a
+  // address_maybe_pointing_to_the_middle_of_object. Will search for an object
+  // start in decreasing address order.
+  inline HeapObjectHeader* FindHeader(
+      ConstAddress address_maybe_pointing_to_the_middle_of_object) const;
+
+  inline void SetBit(ConstAddress);
+  inline void ClearBit(ConstAddress);
+  inline bool CheckBit(ConstAddress) const;
+
+  // Iterates all object starts recorded in the bitmap.
+  //
+  // The callback is of type
+  //   void(Address)
+  // and is passed the object start address as parameter.
+  template <typename Callback>
+  inline void Iterate(Callback) const;
+
+  // Clear the object start bitmap.
+  inline void Clear();
+
+ private:
+  static constexpr size_t kBitsPerCell = sizeof(uint8_t) * CHAR_BIT;
+  static constexpr size_t kCellMask = kBitsPerCell - 1;
+  static constexpr size_t kBitmapSize =
+      (kPageSize + ((kBitsPerCell * kAllocationGranularity) - 1)) /
+      (kBitsPerCell * kAllocationGranularity);
+  static constexpr size_t kReservedForBitmap =
+      ((kBitmapSize + kAllocationMask) & ~kAllocationMask);
+
+  inline void ObjectStartIndexAndBit(ConstAddress, size_t*, size_t*) const;
+
+  Address offset_;
+  // The bitmap contains a bit for every kGranularity aligned address on a
+  // a NormalPage, i.e., for a page of size kBlinkPageSize.
+  std::array<uint8_t, kReservedForBitmap> object_start_bit_map_;
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_OBJECT_START_BITMAP_H_
diff --git a/deps/v8/src/heap/cppgc/page-memory-inl.h b/deps/v8/src/heap/cppgc/page-memory-inl.h
new file mode 100644
index 00000000000..8b2022eeb26
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/page-memory-inl.h
@@ -0,0 +1,57 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_PAGE_MEMORY_INL_H_
+#define V8_HEAP_CPPGC_PAGE_MEMORY_INL_H_
+
+#include "src/heap/cppgc/page-memory.h"
+
+namespace cppgc {
+namespace internal {
+
+// Returns true if the provided allocator supports committing at the required
+// granularity.
+inline bool SupportsCommittingGuardPages(PageAllocator* allocator) {
+  return kGuardPageSize % allocator->CommitPageSize() == 0;
+}
+
+Address NormalPageMemoryRegion::Lookup(ConstAddress address) const {
+  size_t index = GetIndex(address);
+  if (!page_memories_in_use_[index]) return nullptr;
+  const MemoryRegion writeable_region = GetPageMemory(index).writeable_region();
+  return writeable_region.Contains(address) ? writeable_region.base() : nullptr;
+}
+
+Address LargePageMemoryRegion::Lookup(ConstAddress address) const {
+  const MemoryRegion writeable_region = GetPageMemory().writeable_region();
+  return writeable_region.Contains(address) ? writeable_region.base() : nullptr;
+}
+
+Address PageMemoryRegion::Lookup(ConstAddress address) const {
+  DCHECK(reserved_region().Contains(address));
+  return is_large()
+             ? static_cast<const LargePageMemoryRegion*>(this)->Lookup(address)
+             : static_cast<const NormalPageMemoryRegion*>(this)->Lookup(
+                   address);
+}
+
+PageMemoryRegion* PageMemoryRegionTree::Lookup(ConstAddress address) const {
+  auto it = set_.upper_bound(address);
+  // This check also covers set_.size() > 0, since for empty vectors it is
+  // guaranteed that begin() == end().
+  if (it == set_.begin()) return nullptr;
+  auto* result = std::next(it, -1)->second;
+  if (address < result->reserved_region().end()) return result;
+  return nullptr;
+}
+
+Address PageBackend::Lookup(ConstAddress address) const {
+  PageMemoryRegion* pmr = page_memory_region_tree_.Lookup(address);
+  return pmr ? pmr->Lookup(address) : nullptr;
+}
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_PAGE_MEMORY_INL_H_
diff --git a/deps/v8/src/heap/cppgc/page-memory.cc b/deps/v8/src/heap/cppgc/page-memory.cc
new file mode 100644
index 00000000000..66e2812f5c6
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/page-memory.cc
@@ -0,0 +1,211 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/page-memory.h"
+
+#include "src/base/macros.h"
+#include "src/heap/cppgc/page-memory-inl.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+void Unprotect(PageAllocator* allocator, const PageMemory& page_memory) {
+  if (SupportsCommittingGuardPages(allocator)) {
+    CHECK(allocator->SetPermissions(page_memory.writeable_region().base(),
+                                    page_memory.writeable_region().size(),
+                                    PageAllocator::Permission::kReadWrite));
+  } else {
+    // No protection in case the allocator cannot commit at the required
+    // granularity. Only protect if the allocator supports committing at that
+    // granularity.
+    //
+    // The allocator needs to support committing the overall range.
+    CHECK_EQ(0u,
+             page_memory.overall_region().size() % allocator->CommitPageSize());
+    CHECK(allocator->SetPermissions(page_memory.overall_region().base(),
+                                    page_memory.overall_region().size(),
+                                    PageAllocator::Permission::kReadWrite));
+  }
+}
+
+void Protect(PageAllocator* allocator, const PageMemory& page_memory) {
+  if (SupportsCommittingGuardPages(allocator)) {
+    // Swap the same region, providing the OS with a chance for fast lookup and
+    // change.
+    CHECK(allocator->SetPermissions(page_memory.writeable_region().base(),
+                                    page_memory.writeable_region().size(),
+                                    PageAllocator::Permission::kNoAccess));
+  } else {
+    // See Unprotect().
+    CHECK_EQ(0u,
+             page_memory.overall_region().size() % allocator->CommitPageSize());
+    CHECK(allocator->SetPermissions(page_memory.overall_region().base(),
+                                    page_memory.overall_region().size(),
+                                    PageAllocator::Permission::kNoAccess));
+  }
+}
+
+MemoryRegion ReserveMemoryRegion(PageAllocator* allocator,
+                                 size_t allocation_size) {
+  void* region_memory =
+      allocator->AllocatePages(nullptr, allocation_size, kPageSize,
+                               PageAllocator::Permission::kNoAccess);
+  const MemoryRegion reserved_region(static_cast<Address>(region_memory),
+                                     allocation_size);
+  DCHECK_EQ(reserved_region.base() + allocation_size, reserved_region.end());
+  return reserved_region;
+}
+
+void FreeMemoryRegion(PageAllocator* allocator,
+                      const MemoryRegion& reserved_region) {
+  allocator->FreePages(reserved_region.base(), reserved_region.size());
+}
+
+}  // namespace
+
+PageMemoryRegion::PageMemoryRegion(PageAllocator* allocator,
+                                   MemoryRegion reserved_region, bool is_large)
+    : allocator_(allocator),
+      reserved_region_(reserved_region),
+      is_large_(is_large) {}
+
+PageMemoryRegion::~PageMemoryRegion() {
+  FreeMemoryRegion(allocator_, reserved_region());
+}
+
+// static
+constexpr size_t NormalPageMemoryRegion::kNumPageRegions;
+
+NormalPageMemoryRegion::NormalPageMemoryRegion(PageAllocator* allocator)
+    : PageMemoryRegion(allocator,
+                       ReserveMemoryRegion(
+                           allocator, RoundUp(kPageSize * kNumPageRegions,
+                                              allocator->AllocatePageSize())),
+                       false) {
+#ifdef DEBUG
+  for (size_t i = 0; i < kNumPageRegions; ++i) {
+    DCHECK_EQ(false, page_memories_in_use_[i]);
+  }
+#endif  // DEBUG
+}
+
+NormalPageMemoryRegion::~NormalPageMemoryRegion() = default;
+
+void NormalPageMemoryRegion::Allocate(Address writeable_base) {
+  const size_t index = GetIndex(writeable_base);
+  ChangeUsed(index, true);
+  Unprotect(allocator_, GetPageMemory(index));
+}
+
+void NormalPageMemoryRegion::Free(Address writeable_base) {
+  const size_t index = GetIndex(writeable_base);
+  ChangeUsed(index, false);
+  Protect(allocator_, GetPageMemory(index));
+}
+
+void NormalPageMemoryRegion::UnprotectForTesting() {
+  for (size_t i = 0; i < kNumPageRegions; ++i) {
+    Unprotect(allocator_, GetPageMemory(i));
+  }
+}
+
+LargePageMemoryRegion::LargePageMemoryRegion(PageAllocator* allocator,
+                                             size_t length)
+    : PageMemoryRegion(allocator,
+                       ReserveMemoryRegion(
+                           allocator, RoundUp(length + 2 * kGuardPageSize,
+                                              allocator->AllocatePageSize())),
+                       true) {}
+
+LargePageMemoryRegion::~LargePageMemoryRegion() = default;
+
+void LargePageMemoryRegion::UnprotectForTesting() {
+  Unprotect(allocator_, GetPageMemory());
+}
+
+PageMemoryRegionTree::PageMemoryRegionTree() = default;
+
+PageMemoryRegionTree::~PageMemoryRegionTree() = default;
+
+void PageMemoryRegionTree::Add(PageMemoryRegion* region) {
+  DCHECK(region);
+  auto result = set_.emplace(region->reserved_region().base(), region);
+  USE(result);
+  DCHECK(result.second);
+}
+
+void PageMemoryRegionTree::Remove(PageMemoryRegion* region) {
+  DCHECK(region);
+  auto size = set_.erase(region->reserved_region().base());
+  USE(size);
+  DCHECK_EQ(1u, size);
+}
+
+NormalPageMemoryPool::NormalPageMemoryPool() = default;
+
+NormalPageMemoryPool::~NormalPageMemoryPool() = default;
+
+void NormalPageMemoryPool::Add(size_t bucket, NormalPageMemoryRegion* pmr,
+                               Address writeable_base) {
+  DCHECK_LT(bucket, kNumPoolBuckets);
+  pool_[bucket].push_back(std::make_pair(pmr, writeable_base));
+}
+
+std::pair<NormalPageMemoryRegion*, Address> NormalPageMemoryPool::Take(
+    size_t bucket) {
+  DCHECK_LT(bucket, kNumPoolBuckets);
+  if (pool_[bucket].empty()) return {nullptr, nullptr};
+  std::pair<NormalPageMemoryRegion*, Address> pair = pool_[bucket].back();
+  pool_[bucket].pop_back();
+  return pair;
+}
+
+PageBackend::PageBackend(PageAllocator* allocator) : allocator_(allocator) {}
+
+PageBackend::~PageBackend() = default;
+
+Address PageBackend::AllocateNormalPageMemory(size_t bucket) {
+  std::pair<NormalPageMemoryRegion*, Address> result = page_pool_.Take(bucket);
+  if (!result.first) {
+    auto pmr = std::make_unique<NormalPageMemoryRegion>(allocator_);
+    for (size_t i = 0; i < NormalPageMemoryRegion::kNumPageRegions; ++i) {
+      page_pool_.Add(bucket, pmr.get(),
+                     pmr->GetPageMemory(i).writeable_region().base());
+    }
+    page_memory_region_tree_.Add(pmr.get());
+    normal_page_memory_regions_.push_back(std::move(pmr));
+    return AllocateNormalPageMemory(bucket);
+  }
+  result.first->Allocate(result.second);
+  return result.second;
+}
+
+void PageBackend::FreeNormalPageMemory(size_t bucket, Address writeable_base) {
+  auto* pmr = static_cast<NormalPageMemoryRegion*>(
+      page_memory_region_tree_.Lookup(writeable_base));
+  pmr->Free(writeable_base);
+  page_pool_.Add(bucket, pmr, writeable_base);
+}
+
+Address PageBackend::AllocateLargePageMemory(size_t size) {
+  auto pmr = std::make_unique<LargePageMemoryRegion>(allocator_, size);
+  const PageMemory pm = pmr->GetPageMemory();
+  Unprotect(allocator_, pm);
+  page_memory_region_tree_.Add(pmr.get());
+  large_page_memory_regions_.insert(std::make_pair(pmr.get(), std::move(pmr)));
+  return pm.writeable_region().base();
+}
+
+void PageBackend::FreeLargePageMemory(Address writeable_base) {
+  PageMemoryRegion* pmr = page_memory_region_tree_.Lookup(writeable_base);
+  page_memory_region_tree_.Remove(pmr);
+  auto size = large_page_memory_regions_.erase(pmr);
+  USE(size);
+  DCHECK_EQ(1u, size);
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/page-memory.h b/deps/v8/src/heap/cppgc/page-memory.h
new file mode 100644
index 00000000000..b7f1917be7f
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/page-memory.h
@@ -0,0 +1,237 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_PAGE_MEMORY_H_
+#define V8_HEAP_CPPGC_PAGE_MEMORY_H_
+
+#include <array>
+#include <map>
+#include <memory>
+#include <unordered_map>
+#include <vector>
+
+#include "include/cppgc/platform.h"
+#include "src/base/macros.h"
+#include "src/heap/cppgc/globals.h"
+
+namespace cppgc {
+namespace internal {
+
+class V8_EXPORT_PRIVATE MemoryRegion final {
+ public:
+  MemoryRegion() = default;
+  MemoryRegion(Address base, size_t size) : base_(base), size_(size) {
+    DCHECK(base);
+    DCHECK_LT(0u, size);
+  }
+
+  Address base() const { return base_; }
+  size_t size() const { return size_; }
+  Address end() const { return base_ + size_; }
+
+  bool Contains(ConstAddress addr) const {
+    return (reinterpret_cast<uintptr_t>(addr) -
+            reinterpret_cast<uintptr_t>(base_)) < size_;
+  }
+
+  bool Contains(const MemoryRegion& other) const {
+    return base_ <= other.base() && other.end() <= end();
+  }
+
+ private:
+  Address base_ = nullptr;
+  size_t size_ = 0;
+};
+
+// PageMemory provides the backing of a single normal or large page.
+class V8_EXPORT_PRIVATE PageMemory final {
+ public:
+  PageMemory(MemoryRegion overall, MemoryRegion writeable)
+      : overall_(overall), writable_(writeable) {
+    DCHECK(overall.Contains(writeable));
+  }
+
+  const MemoryRegion writeable_region() const { return writable_; }
+  const MemoryRegion overall_region() const { return overall_; }
+
+ private:
+  MemoryRegion overall_;
+  MemoryRegion writable_;
+};
+
+class V8_EXPORT_PRIVATE PageMemoryRegion {
+ public:
+  virtual ~PageMemoryRegion();
+
+  const MemoryRegion reserved_region() const { return reserved_region_; }
+  bool is_large() const { return is_large_; }
+
+  // Lookup writeable base for an |address| that's contained in
+  // PageMemoryRegion. Filters out addresses that are contained in non-writeable
+  // regions (e.g. guard pages).
+  inline Address Lookup(ConstAddress address) const;
+
+  // Disallow copy/move.
+  PageMemoryRegion(const PageMemoryRegion&) = delete;
+  PageMemoryRegion& operator=(const PageMemoryRegion&) = delete;
+
+  virtual void UnprotectForTesting() = 0;
+
+ protected:
+  PageMemoryRegion(PageAllocator*, MemoryRegion, bool);
+
+  PageAllocator* const allocator_;
+  const MemoryRegion reserved_region_;
+  const bool is_large_;
+};
+
+// NormalPageMemoryRegion serves kNumPageRegions normal-sized PageMemory object.
+class V8_EXPORT_PRIVATE NormalPageMemoryRegion final : public PageMemoryRegion {
+ public:
+  static constexpr size_t kNumPageRegions = 10;
+
+  explicit NormalPageMemoryRegion(PageAllocator*);
+  ~NormalPageMemoryRegion() override;
+
+  const PageMemory GetPageMemory(size_t index) const {
+    DCHECK_LT(index, kNumPageRegions);
+    return PageMemory(
+        MemoryRegion(reserved_region().base() + kPageSize * index, kPageSize),
+        MemoryRegion(
+            reserved_region().base() + kPageSize * index + kGuardPageSize,
+            kPageSize - 2 * kGuardPageSize));
+  }
+
+  // Allocates a normal page at |writeable_base| address. Changes page
+  // protection.
+  void Allocate(Address writeable_base);
+
+  // Frees a normal page at at |writeable_base| address. Changes page
+  // protection.
+  void Free(Address);
+
+  inline Address Lookup(ConstAddress) const;
+
+  void UnprotectForTesting() final;
+
+ private:
+  void ChangeUsed(size_t index, bool value) {
+    DCHECK_LT(index, kNumPageRegions);
+    DCHECK_EQ(value, !page_memories_in_use_[index]);
+    page_memories_in_use_[index] = value;
+  }
+
+  size_t GetIndex(ConstAddress address) const {
+    return static_cast<size_t>(address - reserved_region().base()) >>
+           kPageSizeLog2;
+  }
+
+  std::array<bool, kNumPageRegions> page_memories_in_use_ = {};
+};
+
+// LargePageMemoryRegion serves a single large PageMemory object.
+class V8_EXPORT_PRIVATE LargePageMemoryRegion final : public PageMemoryRegion {
+ public:
+  LargePageMemoryRegion(PageAllocator*, size_t);
+  ~LargePageMemoryRegion() override;
+
+  const PageMemory GetPageMemory() const {
+    return PageMemory(
+        MemoryRegion(reserved_region().base(), reserved_region().size()),
+        MemoryRegion(reserved_region().base() + kGuardPageSize,
+                     reserved_region().size() - 2 * kGuardPageSize));
+  }
+
+  inline Address Lookup(ConstAddress) const;
+
+  void UnprotectForTesting() final;
+};
+
+// A PageMemoryRegionTree is a binary search tree of PageMemoryRegions sorted
+// by reserved base addresses.
+//
+// The tree does not keep its elements alive but merely provides indexing
+// capabilities.
+class V8_EXPORT_PRIVATE PageMemoryRegionTree final {
+ public:
+  PageMemoryRegionTree();
+  ~PageMemoryRegionTree();
+
+  void Add(PageMemoryRegion*);
+  void Remove(PageMemoryRegion*);
+
+  inline PageMemoryRegion* Lookup(ConstAddress) const;
+
+ private:
+  std::map<ConstAddress, PageMemoryRegion*> set_;
+};
+
+// A pool of PageMemory objects represented by the writeable base addresses.
+//
+// The pool does not keep its elements alive but merely provides pooling
+// capabilities.
+class V8_EXPORT_PRIVATE NormalPageMemoryPool final {
+ public:
+  static constexpr size_t kNumPoolBuckets = 16;
+
+  using Result = std::pair<NormalPageMemoryRegion*, Address>;
+
+  NormalPageMemoryPool();
+  ~NormalPageMemoryPool();
+
+  void Add(size_t, NormalPageMemoryRegion*, Address);
+  Result Take(size_t);
+
+ private:
+  std::vector<Result> pool_[kNumPoolBuckets];
+};
+
+// A backend that is used for allocating and freeing normal and large pages.
+//
+// Internally maintaints a set of PageMemoryRegions. The backend keeps its used
+// regions alive.
+class V8_EXPORT_PRIVATE PageBackend final {
+ public:
+  explicit PageBackend(PageAllocator*);
+  ~PageBackend();
+
+  // Allocates a normal page from the backend.
+  //
+  // Returns the writeable base of the region.
+  Address AllocateNormalPageMemory(size_t);
+
+  // Returns normal page memory back to the backend. Expects the
+  // |writeable_base| returned by |AllocateNormalMemory()|.
+  void FreeNormalPageMemory(size_t, Address writeable_base);
+
+  // Allocates a large page from the backend.
+  //
+  // Returns the writeable base of the region.
+  Address AllocateLargePageMemory(size_t size);
+
+  // Returns large page memory back to the backend. Expects the |writeable_base|
+  // returned by |AllocateLargePageMemory()|.
+  void FreeLargePageMemory(Address writeable_base);
+
+  // Returns the writeable base if |address| is contained in a valid page
+  // memory.
+  inline Address Lookup(ConstAddress) const;
+
+  // Disallow copy/move.
+  PageBackend(const PageBackend&) = delete;
+  PageBackend& operator=(const PageBackend&) = delete;
+
+ private:
+  PageAllocator* allocator_;
+  NormalPageMemoryPool page_pool_;
+  PageMemoryRegionTree page_memory_region_tree_;
+  std::vector<std::unique_ptr<PageMemoryRegion>> normal_page_memory_regions_;
+  std::unordered_map<PageMemoryRegion*, std::unique_ptr<PageMemoryRegion>>
+      large_page_memory_regions_;
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_PAGE_MEMORY_H_
diff --git a/deps/v8/src/heap/cppgc/persistent-node.cc b/deps/v8/src/heap/cppgc/persistent-node.cc
new file mode 100644
index 00000000000..299cefc5210
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/persistent-node.cc
@@ -0,0 +1,60 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "include/cppgc/internal/persistent-node.h"
+
+#include <algorithm>
+#include <numeric>
+
+namespace cppgc {
+namespace internal {
+
+size_t PersistentRegion::NodesInUse() const {
+  return std::accumulate(
+      nodes_.cbegin(), nodes_.cend(), 0u, [](size_t acc, const auto& slots) {
+        return acc + std::count_if(slots->cbegin(), slots->cend(),
+                                   [](const PersistentNode& node) {
+                                     return node.IsUsed();
+                                   });
+      });
+}
+
+void PersistentRegion::EnsureNodeSlots() {
+  nodes_.push_back(std::make_unique<PersistentNodeSlots>());
+  for (auto& node : *nodes_.back()) {
+    node.InitializeAsFreeNode(free_list_head_);
+    free_list_head_ = &node;
+  }
+}
+
+void PersistentRegion::Trace(Visitor* visitor) {
+  free_list_head_ = nullptr;
+  for (auto& slots : nodes_) {
+    bool is_empty = true;
+    for (auto& node : *slots) {
+      if (node.IsUsed()) {
+        node.Trace(visitor);
+        is_empty = false;
+      } else {
+        node.InitializeAsFreeNode(free_list_head_);
+        free_list_head_ = &node;
+      }
+    }
+    if (is_empty) {
+      PersistentNode* first_next = (*slots)[0].FreeListNext();
+      // First next was processed first in the loop above, guaranteeing that it
+      // either points to null or into a different node block.
+      CPPGC_DCHECK(!first_next || first_next < &slots->front() ||
+                   first_next > &slots->back());
+      free_list_head_ = first_next;
+      slots.reset();
+    }
+  }
+  nodes_.erase(std::remove_if(nodes_.begin(), nodes_.end(),
+                              [](const auto& ptr) { return !ptr; }),
+               nodes_.end());
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/platform.cc b/deps/v8/src/heap/cppgc/platform.cc
index 3b20060392d..e96d69b2257 100644
--- a/deps/v8/src/heap/cppgc/platform.cc
+++ b/deps/v8/src/heap/cppgc/platform.cc
@@ -8,18 +8,12 @@
 #include "src/heap/cppgc/gc-info-table.h"
 
 namespace cppgc {
-namespace internal {
-
-static PageAllocator* g_page_allocator;
-
-}  // namespace internal
 
-void InitializePlatform(PageAllocator* page_allocator) {
-  internal::g_page_allocator = page_allocator;
+void InitializeProcess(PageAllocator* page_allocator) {
   internal::GlobalGCInfoTable::Create(page_allocator);
 }
 
-void ShutdownPlatform() { internal::g_page_allocator = nullptr; }
+void ShutdownProcess() {}
 
 namespace internal {
 
diff --git a/deps/v8/src/heap/cppgc/pointer-policies.cc b/deps/v8/src/heap/cppgc/pointer-policies.cc
new file mode 100644
index 00000000000..e9dfcecdf3e
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/pointer-policies.cc
@@ -0,0 +1,35 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "include/cppgc/internal/pointer-policies.h"
+#include "include/cppgc/internal/persistent-node.h"
+
+#include "src/base/macros.h"
+#include "src/heap/cppgc/heap-page.h"
+#include "src/heap/cppgc/heap.h"
+
+namespace cppgc {
+namespace internal {
+
+EnabledCheckingPolicy::EnabledCheckingPolicy() {
+  USE(impl_);
+  // TODO(chromium:1056170): Save creating heap state.
+}
+
+void EnabledCheckingPolicy::CheckPointer(const void* ptr) {
+  // TODO(chromium:1056170): Provide implementation.
+}
+
+PersistentRegion& StrongPersistentPolicy::GetPersistentRegion(void* object) {
+  auto* heap = BasePage::FromPayload(object)->heap();
+  return heap->GetStrongPersistentRegion();
+}
+
+PersistentRegion& WeakPersistentPolicy::GetPersistentRegion(void* object) {
+  auto* heap = BasePage::FromPayload(object)->heap();
+  return heap->GetWeakPersistentRegion();
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/prefinalizer-handler.cc b/deps/v8/src/heap/cppgc/prefinalizer-handler.cc
new file mode 100644
index 00000000000..40107c15262
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/prefinalizer-handler.cc
@@ -0,0 +1,66 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/prefinalizer-handler.h"
+
+#include <algorithm>
+#include <memory>
+
+#include "src/base/platform/platform.h"
+#include "src/heap/cppgc/heap.h"
+
+namespace cppgc {
+namespace internal {
+
+// static
+void PreFinalizerRegistrationDispatcher::RegisterPrefinalizer(
+    cppgc::Heap* heap, PreFinalizer prefinalzier) {
+  internal::Heap::From(heap)->prefinalizer_handler()->RegisterPrefinalizer(
+      prefinalzier);
+}
+
+bool PreFinalizerRegistrationDispatcher::PreFinalizer::operator==(
+    const PreFinalizer& other) {
+  return (object_ == other.object_) && (callback_ == other.callback_);
+}
+
+PreFinalizerHandler::PreFinalizerHandler()
+#ifdef DEBUG
+    : creation_thread_id_(v8::base::OS::GetCurrentThreadId())
+#endif
+{
+}
+
+void PreFinalizerHandler::RegisterPrefinalizer(PreFinalizer prefinalizer) {
+  DCHECK(CurrentThreadIsCreationThread());
+  DCHECK_EQ(ordered_pre_finalizers_.end(),
+            std::find(ordered_pre_finalizers_.begin(),
+                      ordered_pre_finalizers_.end(), prefinalizer));
+  ordered_pre_finalizers_.push_back(prefinalizer);
+}
+
+void PreFinalizerHandler::InvokePreFinalizers() {
+  DCHECK(CurrentThreadIsCreationThread());
+  LivenessBroker liveness_broker = LivenessBrokerFactory::Create();
+  ordered_pre_finalizers_.erase(
+      ordered_pre_finalizers_.begin(),
+      std::remove_if(ordered_pre_finalizers_.rbegin(),
+                     ordered_pre_finalizers_.rend(),
+                     [liveness_broker](const PreFinalizer& pf) {
+                       return (pf.callback_)(liveness_broker, pf.object_);
+                     })
+          .base());
+  ordered_pre_finalizers_.shrink_to_fit();
+}
+
+bool PreFinalizerHandler::CurrentThreadIsCreationThread() {
+#ifdef DEBUG
+  return creation_thread_id_ == v8::base::OS::GetCurrentThreadId();
+#else
+  return true;
+#endif
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/prefinalizer-handler.h b/deps/v8/src/heap/cppgc/prefinalizer-handler.h
new file mode 100644
index 00000000000..a6255534710
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/prefinalizer-handler.h
@@ -0,0 +1,44 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_PREFINALIZER_HANDLER_H_
+#define V8_HEAP_CPPGC_PREFINALIZER_HANDLER_H_
+
+#include <vector>
+
+#include "include/cppgc/prefinalizer.h"
+
+namespace cppgc {
+namespace internal {
+
+class PreFinalizerHandler final {
+ public:
+  using PreFinalizer =
+      cppgc::internal::PreFinalizerRegistrationDispatcher::PreFinalizer;
+
+  PreFinalizerHandler();
+
+  void RegisterPrefinalizer(PreFinalizer prefinalzier);
+
+  void InvokePreFinalizers();
+
+ private:
+  // Checks that the current thread is the thread that created the heap.
+  bool CurrentThreadIsCreationThread();
+
+  // Pre-finalizers are called in the reverse order in which they are
+  // registered by the constructors (including constructors of Mixin
+  // objects) for an object, by processing the ordered_pre_finalizers_
+  // back-to-front.
+  std::vector<PreFinalizer> ordered_pre_finalizers_;
+
+#ifdef DEBUG
+  int creation_thread_id_;
+#endif
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_PREFINALIZER_HANDLER_H_
diff --git a/deps/v8/src/heap/cppgc/raw-heap.cc b/deps/v8/src/heap/cppgc/raw-heap.cc
new file mode 100644
index 00000000000..cf7311b46f2
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/raw-heap.cc
@@ -0,0 +1,32 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/raw-heap.h"
+
+#include "src/heap/cppgc/heap-space.h"
+
+namespace cppgc {
+namespace internal {
+
+// static
+constexpr size_t RawHeap::kNumberOfRegularSpaces;
+
+RawHeap::RawHeap(Heap* heap, size_t custom_spaces) : main_heap_(heap) {
+  size_t i = 0;
+  for (; i < static_cast<size_t>(RegularSpaceType::kLarge); ++i) {
+    spaces_.push_back(std::make_unique<NormalPageSpace>(this, i));
+  }
+  spaces_.push_back(std::make_unique<LargePageSpace>(
+      this, static_cast<size_t>(RegularSpaceType::kLarge)));
+  DCHECK_EQ(kNumberOfRegularSpaces, spaces_.size());
+  for (size_t j = 0; j < custom_spaces; j++) {
+    spaces_.push_back(
+        std::make_unique<NormalPageSpace>(this, kNumberOfRegularSpaces + j));
+  }
+}
+
+RawHeap::~RawHeap() = default;
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/raw-heap.h b/deps/v8/src/heap/cppgc/raw-heap.h
new file mode 100644
index 00000000000..0591fa87ab7
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/raw-heap.h
@@ -0,0 +1,106 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_RAW_HEAP_H_
+#define V8_HEAP_CPPGC_RAW_HEAP_H_
+
+#include <iterator>
+#include <memory>
+#include <vector>
+
+#include "include/cppgc/heap.h"
+#include "src/base/logging.h"
+#include "src/base/macros.h"
+
+namespace cppgc {
+namespace internal {
+
+class Heap;
+class BaseSpace;
+
+// RawHeap is responsible for space management.
+class V8_EXPORT_PRIVATE RawHeap final {
+ public:
+  // Normal spaces are used to store objects of different size classes:
+  // - kNormal1:  < 32 bytes
+  // - kNormal2:  < 64 bytes
+  // - kNormal3:  < 128 bytes
+  // - kNormal4: >= 128 bytes
+  //
+  // Objects of size greater than 2^16 get stored in the large space.
+  //
+  // Users can override where objects are allocated via cppgc::CustomSpace to
+  // force allocation in a custom space.
+  enum class RegularSpaceType : uint8_t {
+    kNormal1,
+    kNormal2,
+    kNormal3,
+    kNormal4,
+    kLarge,
+  };
+
+  static constexpr size_t kNumberOfRegularSpaces =
+      static_cast<size_t>(RegularSpaceType::kLarge) + 1;
+
+  using Spaces = std::vector<std::unique_ptr<BaseSpace>>;
+  using iterator = Spaces::iterator;
+  using const_iterator = Spaces::const_iterator;
+
+  explicit RawHeap(Heap* heap, size_t custom_spaces);
+  ~RawHeap();
+
+  // Space iteration support.
+  iterator begin() { return spaces_.begin(); }
+  const_iterator begin() const { return spaces_.begin(); }
+  iterator end() { return spaces_.end(); }
+  const_iterator end() const { return spaces_.end(); }
+
+  iterator custom_begin() { return std::next(begin(), kNumberOfRegularSpaces); }
+  iterator custom_end() { return end(); }
+
+  size_t size() const { return spaces_.size(); }
+
+  BaseSpace* Space(RegularSpaceType type) {
+    const size_t index = static_cast<size_t>(type);
+    DCHECK_GT(kNumberOfRegularSpaces, index);
+    return Space(index);
+  }
+  const BaseSpace* Space(RegularSpaceType space) const {
+    return const_cast<RawHeap&>(*this).Space(space);
+  }
+
+  BaseSpace* CustomSpace(CustomSpaceIndex space_index) {
+    return Space(SpaceIndexForCustomSpace(space_index));
+  }
+  const BaseSpace* CustomSpace(CustomSpaceIndex space_index) const {
+    return const_cast<RawHeap&>(*this).CustomSpace(space_index);
+  }
+
+  Heap* heap() { return main_heap_; }
+  const Heap* heap() const { return main_heap_; }
+
+ private:
+  size_t SpaceIndexForCustomSpace(CustomSpaceIndex space_index) const {
+    DCHECK_LT(space_index.value, spaces_.size() - kNumberOfRegularSpaces);
+    return kNumberOfRegularSpaces + space_index.value;
+  }
+
+  BaseSpace* Space(size_t space_index) {
+    DCHECK_GT(spaces_.size(), space_index);
+    BaseSpace* space = spaces_[space_index].get();
+    DCHECK(space);
+    return space;
+  }
+  const BaseSpace* Space(size_t space_index) const {
+    return const_cast<RawHeap&>(*this).Space(space_index);
+  }
+
+  Heap* main_heap_;
+  Spaces spaces_;
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_RAW_HEAP_H_
diff --git a/deps/v8/src/heap/cppgc/sanitizers.h b/deps/v8/src/heap/cppgc/sanitizers.h
index e3102b01ed4..17f6cd7306d 100644
--- a/deps/v8/src/heap/cppgc/sanitizers.h
+++ b/deps/v8/src/heap/cppgc/sanitizers.h
@@ -5,6 +5,9 @@
 #ifndef V8_HEAP_CPPGC_SANITIZERS_H_
 #define V8_HEAP_CPPGC_SANITIZERS_H_
 
+#include <stdint.h>
+#include <string.h>
+
 #include "src/base/macros.h"
 
 //
@@ -16,10 +19,15 @@
 #include <sanitizer/asan_interface.h>
 
 #define NO_SANITIZE_ADDRESS __attribute__((no_sanitize_address))
+#if !defined(ASAN_POISON_MEMORY_REGION) || !defined(ASAN_UNPOISON_MEMORY_REGION)
+#error "ASAN_POISON_MEMORY_REGION must be defined"
+#endif
 
 #else  // !V8_USE_ADDRESS_SANITIZER
 
 #define NO_SANITIZE_ADDRESS
+#define ASAN_POISON_MEMORY_REGION(addr, size) ((void)(addr), (void)(size))
+#define ASAN_UNPOISON_MEMORY_REGION(addr, size) ((void)(addr), (void)(size))
 
 #endif  // V8_USE_ADDRESS_SANITIZER
 
@@ -27,12 +35,43 @@
 
 #include <sanitizer/msan_interface.h>
 
+#define MSAN_POISON(addr, size) __msan_allocated_memory(addr, size)
 #define MSAN_UNPOISON(addr, size) __msan_unpoison(addr, size)
 
 #else  // !V8_USE_MEMORY_SANITIZER
 
+#define MSAN_POISON(addr, size) ((void)(addr), (void)(size))
 #define MSAN_UNPOISON(addr, size) ((void)(addr), (void)(size))
 
 #endif  // V8_USE_MEMORY_SANITIZER
 
+// API for newly allocated or reclaimed memory.
+#if defined(V8_USE_MEMORY_SANITIZER)
+#define SET_MEMORY_ACCESIBLE(address, size) \
+  MSAN_UNPOISON(address, size);             \
+  memset((address), 0, (size))
+#define SET_MEMORY_INACCESIBLE(address, size) MSAN_POISON((address), (size))
+#elif DEBUG || defined(V8_USE_ADDRESS_SANITIZER)
+#define SET_MEMORY_ACCESIBLE(address, size)   \
+  ASAN_UNPOISON_MEMORY_REGION(address, size); \
+  memset((address), 0, (size))
+#define SET_MEMORY_INACCESIBLE(address, size)      \
+  ::cppgc::internal::ZapMemory((address), (size)); \
+  ASAN_POISON_MEMORY_REGION(address, size)
+#else
+#define SET_MEMORY_ACCESIBLE(address, size) memset((address), 0, (size))
+#define SET_MEMORY_INACCESIBLE(address, size) ((void)(address), (void)(size))
+#endif
+
+namespace cppgc {
+namespace internal {
+
+inline void ZapMemory(void* address, size_t size) {
+  static constexpr uint8_t kZappedValue = 0xcd;
+  memset(address, kZappedValue, size);
+}
+
+}  // namespace internal
+}  // namespace cppgc
+
 #endif  // V8_HEAP_CPPGC_SANITIZERS_H_
diff --git a/deps/v8/src/heap/cppgc/source-location.cc b/deps/v8/src/heap/cppgc/source-location.cc
new file mode 100644
index 00000000000..95154cf6d5d
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/source-location.cc
@@ -0,0 +1,16 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "include/cppgc/source-location.h"
+
+namespace cppgc {
+
+std::string SourceLocation::ToString() const {
+  if (!file_) {
+    return {};
+  }
+  return std::string(function_) + "@" + file_ + ":" + std::to_string(line_);
+}
+
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/stack.cc b/deps/v8/src/heap/cppgc/stack.cc
index a8217689176..b99693708c6 100644
--- a/deps/v8/src/heap/cppgc/stack.cc
+++ b/deps/v8/src/heap/cppgc/stack.cc
@@ -13,7 +13,7 @@
 namespace cppgc {
 namespace internal {
 
-using IterateStackCallback = void (Stack::*)(StackVisitor*, intptr_t*) const;
+using IterateStackCallback = void (*)(const Stack*, StackVisitor*, intptr_t*);
 extern "C" void PushAllRegistersAndIterateStack(const Stack*, StackVisitor*,
                                                 IterateStackCallback);
 
@@ -63,8 +63,6 @@ void IterateAsanFakeFrameIfNecessary(StackVisitor* visitor,
 
 #endif  // V8_USE_ADDRESS_SANITIZER
 
-#ifdef CPPGC_SUPPORTS_CONSERVATIVE_STACK_SCAN
-
 void IterateSafeStackIfNecessary(StackVisitor* visitor) {
 #if defined(__has_feature)
 #if __has_feature(safe_stack)
@@ -88,49 +86,44 @@ void IterateSafeStackIfNecessary(StackVisitor* visitor) {
 #endif  // defined(__has_feature)
 }
 
-#endif  // CPPGC_SUPPORTS_CONSERVATIVE_STACK_SCAN
-
-}  // namespace
-
-#ifdef CPPGC_SUPPORTS_CONSERVATIVE_STACK_SCAN
-void Stack::IteratePointers(StackVisitor* visitor) const {
-  PushAllRegistersAndIterateStack(this, visitor, &Stack::IteratePointersImpl);
-  // No need to deal with callee-saved registers as they will be kept alive by
-  // the regular conservative stack iteration.
-  IterateSafeStackIfNecessary(visitor);
-}
-#endif  // CPPGC_SUPPORTS_CONSERVATIVE_STACK_SCAN
-
+// Called by the trampoline that pushes registers on the stack. This method
+// should never be inlined to ensure that a possible redzone cannot contain
+// any data that needs to be scanned.
+V8_NOINLINE
 // No ASAN support as method accesses redzones while walking the stack.
 NO_SANITIZE_ADDRESS
-void Stack::IteratePointersImpl(StackVisitor* visitor,
-                                intptr_t* stack_end) const {
+void IteratePointersImpl(const Stack* stack, StackVisitor* visitor,
+                         intptr_t* stack_end) {
 #ifdef V8_USE_ADDRESS_SANITIZER
   void* asan_fake_stack = __asan_get_current_fake_stack();
 #endif  // V8_USE_ADDRESS_SANITIZER
   // All supported platforms should have their stack aligned to at least
   // sizeof(void*).
   constexpr size_t kMinStackAlignment = sizeof(void*);
-  // Redzone should not contain any pointers as the iteration is always called
-  // from the assembly trampoline. If inline assembly is ever inlined through
-  // LTO this may become necessary.
-  constexpr size_t kRedZoneBytes = 128;
-  void** current = reinterpret_cast<void**>(
-      reinterpret_cast<uintptr_t>(stack_end - kRedZoneBytes));
+  void** current = reinterpret_cast<void**>(stack_end);
   CHECK_EQ(0u, reinterpret_cast<uintptr_t>(current) & (kMinStackAlignment - 1));
-  for (; current < stack_start_; ++current) {
+  for (; current < stack->stack_start(); ++current) {
     // MSAN: Instead of unpoisoning the whole stack, the slot's value is copied
     // into a local which is unpoisoned.
     void* address = *current;
-    MSAN_UNPOISON(address, sizeof(address));
+    MSAN_UNPOISON(&address, sizeof(address));
     if (address == nullptr) continue;
     visitor->VisitPointer(address);
 #ifdef V8_USE_ADDRESS_SANITIZER
-    IterateAsanFakeFrameIfNecessary(visitor, asan_fake_stack, stack_start_,
-                                    stack_end, address);
+    IterateAsanFakeFrameIfNecessary(visitor, asan_fake_stack,
+                                    stack->stack_start(), stack_end, address);
 #endif  // V8_USE_ADDRESS_SANITIZER
   }
 }
 
+}  // namespace
+
+void Stack::IteratePointers(StackVisitor* visitor) const {
+  PushAllRegistersAndIterateStack(this, visitor, &IteratePointersImpl);
+  // No need to deal with callee-saved registers as they will be kept alive by
+  // the regular conservative stack iteration.
+  IterateSafeStackIfNecessary(visitor);
+}
+
 }  // namespace internal
 }  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/stack.h b/deps/v8/src/heap/cppgc/stack.h
index 599bf3a54a0..3f561aed08e 100644
--- a/deps/v8/src/heap/cppgc/stack.h
+++ b/deps/v8/src/heap/cppgc/stack.h
@@ -7,11 +7,6 @@
 
 #include "src/base/macros.h"
 
-// TODO(chromium:1056170): Implement all platforms.
-#if defined(V8_TARGET_ARCH_X64)
-#define CPPGC_SUPPORTS_CONSERVATIVE_STACK_SCAN 1
-#endif
-
 namespace cppgc {
 namespace internal {
 
@@ -33,13 +28,12 @@ class V8_EXPORT_PRIVATE Stack final {
 
   // Word-aligned iteration of the stack. Slot values are passed on to
   // |visitor|.
-#ifdef CPPGC_SUPPORTS_CONSERVATIVE_STACK_SCAN
   void IteratePointers(StackVisitor* visitor) const;
-#endif  // CPPGC_SUPPORTS_CONSERVATIVE_STACK_SCAN
 
- private:
-  void IteratePointersImpl(StackVisitor* visitor, intptr_t* stack_end) const;
+  // Returns the start of the stack.
+  const void* stack_start() const { return stack_start_; }
 
+ private:
   const void* stack_start_;
 };
 
diff --git a/deps/v8/src/heap/cppgc/sweeper.cc b/deps/v8/src/heap/cppgc/sweeper.cc
new file mode 100644
index 00000000000..2660af563a0
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/sweeper.cc
@@ -0,0 +1,617 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/sweeper.h"
+
+#include <atomic>
+#include <memory>
+#include <vector>
+
+#include "include/cppgc/platform.h"
+#include "src/base/optional.h"
+#include "src/base/platform/mutex.h"
+#include "src/heap/cppgc/free-list.h"
+#include "src/heap/cppgc/globals.h"
+#include "src/heap/cppgc/heap-object-header-inl.h"
+#include "src/heap/cppgc/heap-object-header.h"
+#include "src/heap/cppgc/heap-page.h"
+#include "src/heap/cppgc/heap-space.h"
+#include "src/heap/cppgc/heap-visitor.h"
+#include "src/heap/cppgc/object-start-bitmap-inl.h"
+#include "src/heap/cppgc/object-start-bitmap.h"
+#include "src/heap/cppgc/raw-heap.h"
+#include "src/heap/cppgc/sanitizers.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+using v8::base::Optional;
+
+class ObjectStartBitmapVerifier
+    : private HeapVisitor<ObjectStartBitmapVerifier> {
+  friend class HeapVisitor<ObjectStartBitmapVerifier>;
+
+ public:
+  void Verify(RawHeap* heap) { Traverse(heap); }
+
+ private:
+  bool VisitNormalPage(NormalPage* page) {
+    // Remember bitmap and reset previous pointer.
+    bitmap_ = &page->object_start_bitmap();
+    prev_ = nullptr;
+    return false;
+  }
+
+  bool VisitHeapObjectHeader(HeapObjectHeader* header) {
+    if (header->IsLargeObject()) return true;
+
+    auto* raw_header = reinterpret_cast<ConstAddress>(header);
+    CHECK(bitmap_->CheckBit(raw_header));
+    if (prev_) {
+      CHECK_EQ(prev_, bitmap_->FindHeader(raw_header - 1));
+    }
+    prev_ = header;
+    return true;
+  }
+
+  ObjectStartBitmap* bitmap_ = nullptr;
+  HeapObjectHeader* prev_ = nullptr;
+};
+
+template <typename T>
+class ThreadSafeStack {
+ public:
+  ThreadSafeStack() = default;
+
+  void Push(T t) {
+    v8::base::LockGuard<v8::base::Mutex> lock(&mutex_);
+    vector_.push_back(std::move(t));
+  }
+
+  Optional<T> Pop() {
+    v8::base::LockGuard<v8::base::Mutex> lock(&mutex_);
+    if (vector_.empty()) return v8::base::nullopt;
+    T top = std::move(vector_.back());
+    vector_.pop_back();
+    // std::move is redundant but is needed to avoid the bug in gcc-7.
+    return std::move(top);
+  }
+
+  template <typename It>
+  void Insert(It begin, It end) {
+    v8::base::LockGuard<v8::base::Mutex> lock(&mutex_);
+    vector_.insert(vector_.end(), begin, end);
+  }
+
+  bool IsEmpty() const {
+    v8::base::LockGuard<v8::base::Mutex> lock(&mutex_);
+    return vector_.empty();
+  }
+
+ private:
+  std::vector<T> vector_;
+  mutable v8::base::Mutex mutex_;
+};
+
+struct SpaceState {
+  struct SweptPageState {
+    BasePage* page = nullptr;
+    std::vector<HeapObjectHeader*> unfinalized_objects;
+    FreeList cached_free_list;
+    std::vector<FreeList::Block> unfinalized_free_list;
+    bool is_empty = false;
+  };
+
+  ThreadSafeStack<BasePage*> unswept_pages;
+  ThreadSafeStack<SweptPageState> swept_unfinalized_pages;
+};
+
+using SpaceStates = std::vector<SpaceState>;
+
+// Builder that finalizes objects and adds freelist entries right away.
+class InlinedFinalizationBuilder final {
+ public:
+  using ResultType = bool;
+
+  explicit InlinedFinalizationBuilder(BasePage* page) : page_(page) {}
+
+  void AddFinalizer(HeapObjectHeader* header, size_t size) {
+    header->Finalize();
+    SET_MEMORY_INACCESIBLE(header, size);
+  }
+
+  void AddFreeListEntry(Address start, size_t size) {
+    auto* space = NormalPageSpace::From(page_->space());
+    space->free_list().Add({start, size});
+  }
+
+  ResultType GetResult(bool is_empty) { return is_empty; }
+
+ private:
+  BasePage* page_;
+};
+
+// Builder that produces results for deferred processing.
+class DeferredFinalizationBuilder final {
+ public:
+  using ResultType = SpaceState::SweptPageState;
+
+  explicit DeferredFinalizationBuilder(BasePage* page) { result_.page = page; }
+
+  void AddFinalizer(HeapObjectHeader* header, size_t size) {
+    if (header->IsFinalizable()) {
+      result_.unfinalized_objects.push_back({header});
+      found_finalizer_ = true;
+    } else {
+      SET_MEMORY_INACCESIBLE(header, size);
+    }
+  }
+
+  void AddFreeListEntry(Address start, size_t size) {
+    if (found_finalizer_) {
+      result_.unfinalized_free_list.push_back({start, size});
+    } else {
+      result_.cached_free_list.Add({start, size});
+    }
+    found_finalizer_ = false;
+  }
+
+  ResultType&& GetResult(bool is_empty) {
+    result_.is_empty = is_empty;
+    return std::move(result_);
+  }
+
+ private:
+  ResultType result_;
+  bool found_finalizer_ = false;
+};
+
+template <typename FinalizationBuilder>
+typename FinalizationBuilder::ResultType SweepNormalPage(NormalPage* page) {
+  constexpr auto kAtomicAccess = HeapObjectHeader::AccessMode::kAtomic;
+  FinalizationBuilder builder(page);
+
+  ObjectStartBitmap& bitmap = page->object_start_bitmap();
+  bitmap.Clear();
+
+  Address start_of_gap = page->PayloadStart();
+  for (Address begin = page->PayloadStart(), end = page->PayloadEnd();
+       begin != end;) {
+    HeapObjectHeader* header = reinterpret_cast<HeapObjectHeader*>(begin);
+    const size_t size = header->GetSize();
+    // Check if this is a free list entry.
+    if (header->IsFree<kAtomicAccess>()) {
+      SET_MEMORY_INACCESIBLE(header, std::min(kFreeListEntrySize, size));
+      begin += size;
+      continue;
+    }
+    // Check if object is not marked (not reachable).
+    if (!header->IsMarked<kAtomicAccess>()) {
+      builder.AddFinalizer(header, size);
+      begin += size;
+      continue;
+    }
+    // The object is alive.
+    const Address header_address = reinterpret_cast<Address>(header);
+    if (start_of_gap != header_address) {
+      builder.AddFreeListEntry(
+          start_of_gap, static_cast<size_t>(header_address - start_of_gap));
+      bitmap.SetBit(start_of_gap);
+    }
+    header->Unmark<kAtomicAccess>();
+    bitmap.SetBit(begin);
+    begin += size;
+    start_of_gap = begin;
+  }
+
+  if (start_of_gap != page->PayloadStart() &&
+      start_of_gap != page->PayloadEnd()) {
+    builder.AddFreeListEntry(
+        start_of_gap, static_cast<size_t>(page->PayloadEnd() - start_of_gap));
+    bitmap.SetBit(start_of_gap);
+  }
+
+  const bool is_empty = (start_of_gap == page->PayloadStart());
+  return builder.GetResult(is_empty);
+}
+
+// SweepFinalizer is responsible for heap/space/page finalization. Finalization
+// is defined as a step following concurrent sweeping which:
+// - calls finalizers;
+// - returns (unmaps) empty pages;
+// - merges freelists to the space's freelist.
+class SweepFinalizer final {
+ public:
+  explicit SweepFinalizer(cppgc::Platform* platform) : platform_(platform) {}
+
+  void FinalizeHeap(SpaceStates* space_states) {
+    for (SpaceState& space_state : *space_states) {
+      FinalizeSpace(&space_state);
+    }
+  }
+
+  void FinalizeSpace(SpaceState* space_state) {
+    while (auto page_state = space_state->swept_unfinalized_pages.Pop()) {
+      FinalizePage(&*page_state);
+    }
+  }
+
+  bool FinalizeSpaceWithDeadline(SpaceState* space_state,
+                                 double deadline_in_seconds) {
+    DCHECK(platform_);
+    static constexpr size_t kDeadlineCheckInterval = 8;
+    size_t page_count = 1;
+
+    while (auto page_state = space_state->swept_unfinalized_pages.Pop()) {
+      FinalizePage(&*page_state);
+
+      if (page_count % kDeadlineCheckInterval == 0 &&
+          deadline_in_seconds <= platform_->MonotonicallyIncreasingTime()) {
+        return false;
+      }
+
+      page_count++;
+    }
+
+    return true;
+  }
+
+  void FinalizePage(SpaceState::SweptPageState* page_state) {
+    DCHECK(page_state);
+    DCHECK(page_state->page);
+    BasePage* page = page_state->page;
+
+    // Call finalizers.
+    for (HeapObjectHeader* object : page_state->unfinalized_objects) {
+      object->Finalize();
+    }
+
+    // Unmap page if empty.
+    if (page_state->is_empty) {
+      BasePage::Destroy(page);
+      return;
+    }
+
+    DCHECK(!page->is_large());
+
+    // Merge freelists without finalizers.
+    FreeList& space_freelist =
+        NormalPageSpace::From(page->space())->free_list();
+    space_freelist.Append(std::move(page_state->cached_free_list));
+
+    // Merge freelist with finalizers.
+    for (auto entry : page_state->unfinalized_free_list) {
+      space_freelist.Add(std::move(entry));
+    }
+
+    // Add the page to the space.
+    page->space()->AddPage(page);
+  }
+
+ private:
+  cppgc::Platform* platform_;
+};
+
+class MutatorThreadSweeper final : private HeapVisitor<MutatorThreadSweeper> {
+  friend class HeapVisitor<MutatorThreadSweeper>;
+
+ public:
+  explicit MutatorThreadSweeper(SpaceStates* states, cppgc::Platform* platform)
+      : states_(states), platform_(platform) {}
+
+  void Sweep() {
+    for (SpaceState& state : *states_) {
+      while (auto page = state.unswept_pages.Pop()) {
+        Traverse(*page);
+      }
+    }
+  }
+
+  bool SweepWithDeadline(double deadline_in_seconds) {
+    DCHECK(platform_);
+    static constexpr double kSlackInSeconds = 0.001;
+    for (SpaceState& state : *states_) {
+      // FinalizeSpaceWithDeadline() and SweepSpaceWithDeadline() won't check
+      // the deadline until it sweeps 10 pages. So we give a small slack for
+      // safety.
+      const double remaining_budget = deadline_in_seconds - kSlackInSeconds -
+                                      platform_->MonotonicallyIncreasingTime();
+      if (remaining_budget <= 0.) return false;
+
+      // First, prioritize finalization of pages that were swept concurrently.
+      SweepFinalizer finalizer(platform_);
+      if (!finalizer.FinalizeSpaceWithDeadline(&state, deadline_in_seconds)) {
+        return false;
+      }
+
+      // Help out the concurrent sweeper.
+      if (!SweepSpaceWithDeadline(&state, deadline_in_seconds)) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+ private:
+  bool SweepSpaceWithDeadline(SpaceState* state, double deadline_in_seconds) {
+    static constexpr size_t kDeadlineCheckInterval = 8;
+    size_t page_count = 1;
+    while (auto page = state->unswept_pages.Pop()) {
+      Traverse(*page);
+      if (page_count % kDeadlineCheckInterval == 0 &&
+          deadline_in_seconds <= platform_->MonotonicallyIncreasingTime()) {
+        return false;
+      }
+      page_count++;
+    }
+
+    return true;
+  }
+
+  bool VisitNormalPage(NormalPage* page) {
+    const bool is_empty = SweepNormalPage<InlinedFinalizationBuilder>(page);
+    if (is_empty) {
+      NormalPage::Destroy(page);
+    } else {
+      page->space()->AddPage(page);
+    }
+    return true;
+  }
+
+  bool VisitLargePage(LargePage* page) {
+    HeapObjectHeader* header = page->ObjectHeader();
+    if (header->IsMarked()) {
+      header->Unmark();
+      page->space()->AddPage(page);
+    } else {
+      header->Finalize();
+      LargePage::Destroy(page);
+    }
+    return true;
+  }
+
+  SpaceStates* states_;
+  cppgc::Platform* platform_;
+};
+
+class ConcurrentSweepTask final : public v8::JobTask,
+                                  private HeapVisitor<ConcurrentSweepTask> {
+  friend class HeapVisitor<ConcurrentSweepTask>;
+
+ public:
+  explicit ConcurrentSweepTask(SpaceStates* states) : states_(states) {}
+
+  void Run(v8::JobDelegate* delegate) final {
+    for (SpaceState& state : *states_) {
+      while (auto page = state.unswept_pages.Pop()) {
+        Traverse(*page);
+        if (delegate->ShouldYield()) return;
+      }
+    }
+    is_completed_.store(true, std::memory_order_relaxed);
+  }
+
+  size_t GetMaxConcurrency() const final {
+    return is_completed_.load(std::memory_order_relaxed) ? 0 : 1;
+  }
+
+ private:
+  bool VisitNormalPage(NormalPage* page) {
+    SpaceState::SweptPageState sweep_result =
+        SweepNormalPage<DeferredFinalizationBuilder>(page);
+    const size_t space_index = page->space()->index();
+    DCHECK_GT(states_->size(), space_index);
+    SpaceState& space_state = (*states_)[space_index];
+    space_state.swept_unfinalized_pages.Push(std::move(sweep_result));
+    return true;
+  }
+
+  bool VisitLargePage(LargePage* page) {
+    HeapObjectHeader* header = page->ObjectHeader();
+    if (header->IsMarked()) {
+      header->Unmark();
+      page->space()->AddPage(page);
+      return true;
+    }
+    if (!header->IsFinalizable()) {
+      LargePage::Destroy(page);
+      return true;
+    }
+    const size_t space_index = page->space()->index();
+    DCHECK_GT(states_->size(), space_index);
+    SpaceState& state = (*states_)[space_index];
+    state.swept_unfinalized_pages.Push(
+        {page, {page->ObjectHeader()}, {}, {}, true});
+    return true;
+  }
+
+  SpaceStates* states_;
+  std::atomic_bool is_completed_{false};
+};
+
+// This visitor:
+// - resets linear allocation buffers and clears free lists for all spaces;
+// - moves all Heap pages to local Sweeper's state (SpaceStates).
+class PrepareForSweepVisitor final
+    : public HeapVisitor<PrepareForSweepVisitor> {
+ public:
+  explicit PrepareForSweepVisitor(SpaceStates* states) : states_(states) {}
+
+  bool VisitNormalPageSpace(NormalPageSpace* space) {
+    DCHECK(!space->linear_allocation_buffer().size());
+    space->free_list().Clear();
+    ExtractPages(space);
+    return true;
+  }
+
+  bool VisitLargePageSpace(LargePageSpace* space) {
+    ExtractPages(space);
+    return true;
+  }
+
+ private:
+  void ExtractPages(BaseSpace* space) {
+    BaseSpace::Pages space_pages = space->RemoveAllPages();
+    (*states_)[space->index()].unswept_pages.Insert(space_pages.begin(),
+                                                    space_pages.end());
+  }
+
+  SpaceStates* states_;
+};
+
+}  // namespace
+
+class Sweeper::SweeperImpl final {
+ public:
+  explicit SweeperImpl(RawHeap* heap, cppgc::Platform* platform)
+      : heap_(heap),
+        space_states_(heap->size()),
+        platform_(platform),
+        foreground_task_runner_(platform_->GetForegroundTaskRunner()) {}
+
+  ~SweeperImpl() { CancelSweepers(); }
+
+  void Start(Config config) {
+    is_in_progress_ = true;
+#if DEBUG
+    ObjectStartBitmapVerifier().Verify(heap_);
+#endif
+    PrepareForSweepVisitor(&space_states_).Traverse(heap_);
+
+    if (config == Config::kAtomic) {
+      Finish();
+    } else {
+      DCHECK_EQ(Config::kIncrementalAndConcurrent, config);
+      ScheduleIncrementalSweeping();
+      ScheduleConcurrentSweeping();
+    }
+  }
+
+  void Finish() {
+    if (!is_in_progress_) return;
+
+    // First, call finalizers on the mutator thread.
+    SweepFinalizer finalizer(platform_);
+    finalizer.FinalizeHeap(&space_states_);
+
+    // Then, help out the concurrent thread.
+    MutatorThreadSweeper sweeper(&space_states_, platform_);
+    sweeper.Sweep();
+
+    // Synchronize with the concurrent sweeper and call remaining finalizers.
+    SynchronizeAndFinalizeConcurrentSweeping();
+
+    is_in_progress_ = false;
+  }
+
+ private:
+  class IncrementalSweepTask : public v8::IdleTask {
+   public:
+    struct Handle {
+      Handle() = default;
+
+      void Cancel() {
+        DCHECK(is_cancelled_);
+        *is_cancelled_ = true;
+      }
+
+      bool IsCanceled() const {
+        DCHECK(is_cancelled_);
+        return *is_cancelled_;
+      }
+
+      explicit operator bool() const { return is_cancelled_.get(); }
+
+     private:
+      struct NonEmptyTag {};
+
+      explicit Handle(NonEmptyTag)
+          : is_cancelled_(std::make_shared<bool>(false)) {}
+
+      std::shared_ptr<bool> is_cancelled_;
+
+      friend class IncrementalSweepTask;
+    };
+
+    explicit IncrementalSweepTask(SweeperImpl* sweeper)
+        : sweeper_(sweeper), handle_(Handle::NonEmptyTag{}) {}
+
+    static Handle Post(SweeperImpl* sweeper, v8::TaskRunner* runner) {
+      auto task = std::make_unique<IncrementalSweepTask>(sweeper);
+      auto handle = task->GetHandle();
+      runner->PostIdleTask(std::move(task));
+      return handle;
+    }
+
+   private:
+    void Run(double deadline_in_seconds) override {
+      if (handle_.IsCanceled() || !sweeper_->is_in_progress_) return;
+
+      MutatorThreadSweeper sweeper(&sweeper_->space_states_,
+                                   sweeper_->platform_);
+      const bool sweep_complete =
+          sweeper.SweepWithDeadline(deadline_in_seconds);
+
+      if (sweep_complete) {
+        sweeper_->SynchronizeAndFinalizeConcurrentSweeping();
+      } else {
+        sweeper_->ScheduleIncrementalSweeping();
+      }
+    }
+
+    Handle GetHandle() const { return handle_; }
+
+    SweeperImpl* sweeper_;
+    // TODO(chromium:1056170): Change to CancelableTask.
+    Handle handle_;
+  };
+
+  void ScheduleIncrementalSweeping() {
+    if (!platform_ || !foreground_task_runner_) return;
+
+    incremental_sweeper_handle_ =
+        IncrementalSweepTask::Post(this, foreground_task_runner_.get());
+  }
+
+  void ScheduleConcurrentSweeping() {
+    if (!platform_) return;
+
+    concurrent_sweeper_handle_ = platform_->PostJob(
+        v8::TaskPriority::kUserVisible,
+        std::make_unique<ConcurrentSweepTask>(&space_states_));
+  }
+
+  void CancelSweepers() {
+    if (incremental_sweeper_handle_) incremental_sweeper_handle_.Cancel();
+    if (concurrent_sweeper_handle_) concurrent_sweeper_handle_->Cancel();
+  }
+
+  void SynchronizeAndFinalizeConcurrentSweeping() {
+    CancelSweepers();
+
+    SweepFinalizer finalizer(platform_);
+    finalizer.FinalizeHeap(&space_states_);
+  }
+
+  RawHeap* heap_;
+  SpaceStates space_states_;
+  cppgc::Platform* platform_;
+  std::shared_ptr<v8::TaskRunner> foreground_task_runner_;
+  IncrementalSweepTask::Handle incremental_sweeper_handle_;
+  std::unique_ptr<v8::JobHandle> concurrent_sweeper_handle_;
+  bool is_in_progress_ = false;
+};
+
+Sweeper::Sweeper(RawHeap* heap, cppgc::Platform* platform)
+    : impl_(std::make_unique<SweeperImpl>(heap, platform)) {}
+
+Sweeper::~Sweeper() = default;
+
+void Sweeper::Start(Config config) { impl_->Start(config); }
+void Sweeper::Finish() { impl_->Finish(); }
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/sweeper.h b/deps/v8/src/heap/cppgc/sweeper.h
new file mode 100644
index 00000000000..b19ee1eda3d
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/sweeper.h
@@ -0,0 +1,42 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_SWEEPER_H_
+#define V8_HEAP_CPPGC_SWEEPER_H_
+
+#include <memory>
+
+#include "src/base/macros.h"
+
+namespace cppgc {
+
+class Platform;
+
+namespace internal {
+
+class RawHeap;
+
+class V8_EXPORT_PRIVATE Sweeper final {
+ public:
+  enum class Config { kAtomic, kIncrementalAndConcurrent };
+
+  explicit Sweeper(RawHeap*, cppgc::Platform*);
+  ~Sweeper();
+
+  Sweeper(const Sweeper&) = delete;
+  Sweeper& operator=(const Sweeper&) = delete;
+
+  // Sweeper::Start assumes the heap holds no linear allocation buffers.
+  void Start(Config);
+  void Finish();
+
+ private:
+  class SweeperImpl;
+  std::unique_ptr<SweeperImpl> impl_;
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_SWEEPER_H_
diff --git a/deps/v8/src/heap/cppgc/virtual-memory.cc b/deps/v8/src/heap/cppgc/virtual-memory.cc
new file mode 100644
index 00000000000..070baa71192
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/virtual-memory.cc
@@ -0,0 +1,56 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/virtual-memory.h"
+
+#include "include/cppgc/platform.h"
+#include "src/base/macros.h"
+
+namespace cppgc {
+namespace internal {
+
+VirtualMemory::VirtualMemory(PageAllocator* page_allocator, size_t size,
+                             size_t alignment, void* hint)
+    : page_allocator_(page_allocator) {
+  DCHECK_NOT_NULL(page_allocator);
+  DCHECK(IsAligned(size, page_allocator->CommitPageSize()));
+
+  const size_t page_size = page_allocator_->AllocatePageSize();
+  start_ = page_allocator->AllocatePages(hint, RoundUp(size, page_size),
+                                         RoundUp(alignment, page_size),
+                                         PageAllocator::kNoAccess);
+  if (start_) {
+    size_ = RoundUp(size, page_size);
+  }
+}
+
+VirtualMemory::~VirtualMemory() V8_NOEXCEPT {
+  if (IsReserved()) {
+    page_allocator_->FreePages(start_, size_);
+  }
+}
+
+VirtualMemory::VirtualMemory(VirtualMemory&& other) V8_NOEXCEPT
+    : page_allocator_(std::move(other.page_allocator_)),
+      start_(std::move(other.start_)),
+      size_(std::move(other.size_)) {
+  other.Reset();
+}
+
+VirtualMemory& VirtualMemory::operator=(VirtualMemory&& other) V8_NOEXCEPT {
+  DCHECK(!IsReserved());
+  page_allocator_ = std::move(other.page_allocator_);
+  start_ = std::move(other.start_);
+  size_ = std::move(other.size_);
+  other.Reset();
+  return *this;
+}
+
+void VirtualMemory::Reset() {
+  start_ = nullptr;
+  size_ = 0;
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/virtual-memory.h b/deps/v8/src/heap/cppgc/virtual-memory.h
new file mode 100644
index 00000000000..1489abb9dea
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/virtual-memory.h
@@ -0,0 +1,60 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_VIRTUAL_MEMORY_H_
+#define V8_HEAP_CPPGC_VIRTUAL_MEMORY_H_
+
+#include <cstdint>
+
+#include "include/cppgc/platform.h"
+#include "src/base/macros.h"
+
+namespace cppgc {
+namespace internal {
+
+// Represents and controls an area of reserved memory.
+class V8_EXPORT_PRIVATE VirtualMemory {
+ public:
+  // Empty VirtualMemory object, controlling no reserved memory.
+  VirtualMemory() = default;
+
+  // Reserves virtual memory containing an area of the given size that is
+  // aligned per |alignment| rounded up to the |page_allocator|'s allocate page
+  // size. The |size| is aligned with |page_allocator|'s commit page size.
+  VirtualMemory(PageAllocator*, size_t size, size_t alignment,
+                void* hint = nullptr);
+
+  // Releases the reserved memory, if any, controlled by this VirtualMemory
+  // object.
+  ~VirtualMemory() V8_NOEXCEPT;
+
+  VirtualMemory(VirtualMemory&&) V8_NOEXCEPT;
+  VirtualMemory& operator=(VirtualMemory&&) V8_NOEXCEPT;
+
+  // Returns whether the memory has been reserved.
+  bool IsReserved() const { return start_ != nullptr; }
+
+  void* address() const {
+    DCHECK(IsReserved());
+    return start_;
+  }
+
+  size_t size() const {
+    DCHECK(IsReserved());
+    return size_;
+  }
+
+ private:
+  // Resets to the default state.
+  void Reset();
+
+  PageAllocator* page_allocator_ = nullptr;
+  void* start_ = nullptr;
+  size_t size_ = 0;
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_VIRTUAL_MEMORY_H_
diff --git a/deps/v8/src/heap/cppgc/visitor.cc b/deps/v8/src/heap/cppgc/visitor.cc
new file mode 100644
index 00000000000..18033ae3d8a
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/visitor.cc
@@ -0,0 +1,16 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/visitor.h"
+
+namespace cppgc {
+
+#ifdef V8_ENABLE_CHECKS
+void Visitor::CheckObjectNotInConstruction(const void* address) {
+  // TODO(chromium:1056170): |address| is an inner pointer of an object. Check
+  // that the object is not in construction.
+}
+#endif  // V8_ENABLE_CHECKS
+
+}  // namespace cppgc
diff --git a/deps/v8/src/heap/cppgc/visitor.h b/deps/v8/src/heap/cppgc/visitor.h
new file mode 100644
index 00000000000..caa840b4dc3
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/visitor.h
@@ -0,0 +1,23 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_VISITOR_H_
+#define V8_HEAP_CPPGC_VISITOR_H_
+
+#include "include/cppgc/visitor.h"
+
+namespace cppgc {
+namespace internal {
+
+// Base visitor that is allowed to create a public cppgc::Visitor object and
+// use its internals.
+class VisitorBase : public cppgc::Visitor {
+ public:
+  VisitorBase() = default;
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_VISITOR_H_
diff --git a/deps/v8/src/heap/cppgc/worklist.h b/deps/v8/src/heap/cppgc/worklist.h
new file mode 100644
index 00000000000..5993d6a04e3
--- /dev/null
+++ b/deps/v8/src/heap/cppgc/worklist.h
@@ -0,0 +1,473 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_CPPGC_WORKLIST_H_
+#define V8_HEAP_CPPGC_WORKLIST_H_
+
+#include <cstddef>
+#include <utility>
+
+#include "src/base/atomic-utils.h"
+#include "src/base/logging.h"
+#include "src/base/platform/mutex.h"
+#include "testing/gtest/include/gtest/gtest_prod.h"  // nogncheck
+
+namespace cppgc {
+namespace internal {
+
+// A concurrent worklist based on segments. Each tasks gets private
+// push and pop segments. Empty pop segments are swapped with their
+// corresponding push segments. Full push segments are published to a global
+// pool of segments and replaced with empty segments.
+//
+// Work stealing is best effort, i.e., there is no way to inform other tasks
+// of the need of items.
+template <typename EntryType_, int SEGMENT_SIZE, int max_num_tasks = 8>
+class Worklist {
+  using WorklistType = Worklist<EntryType_, SEGMENT_SIZE, max_num_tasks>;
+
+ public:
+  using EntryType = EntryType_;
+  static constexpr int kMaxNumTasks = max_num_tasks;
+  static constexpr size_t kSegmentCapacity = SEGMENT_SIZE;
+
+  class View {
+   public:
+    View(WorklistType* worklist, int task_id)
+        : worklist_(worklist), task_id_(task_id) {}
+
+    // Pushes an entry onto the worklist.
+    bool Push(EntryType entry) { return worklist_->Push(task_id_, entry); }
+
+    // Pops an entry from the worklist.
+    bool Pop(EntryType* entry) { return worklist_->Pop(task_id_, entry); }
+
+    // Returns true if the local portion of the worklist is empty.
+    bool IsLocalEmpty() const { return worklist_->IsLocalEmpty(task_id_); }
+
+    // Returns true if the worklist is empty. Can only be used from the main
+    // thread without concurrent access.
+    bool IsEmpty() const { return worklist_->IsEmpty(); }
+
+    bool IsGlobalPoolEmpty() const { return worklist_->IsGlobalPoolEmpty(); }
+
+    // Returns true if the local portion and the global pool are empty (i.e.
+    // whether the current view cannot pop anymore).
+    bool IsLocalViewEmpty() const {
+      return worklist_->IsLocalViewEmpty(task_id_);
+    }
+
+    void FlushToGlobal() { worklist_->FlushToGlobal(task_id_); }
+
+    void* operator new(size_t, void* location) = delete;
+    void* operator new(size_t) = delete;
+
+   private:
+    WorklistType* const worklist_;
+    const int task_id_;
+  };
+
+  Worklist() : Worklist(kMaxNumTasks) {}
+
+  explicit Worklist(int num_tasks) : num_tasks_(num_tasks) {
+    DCHECK_LE(num_tasks_, kMaxNumTasks);
+    for (int i = 0; i < num_tasks_; i++) {
+      private_push_segment(i) = NewSegment();
+      private_pop_segment(i) = NewSegment();
+    }
+  }
+
+  ~Worklist() {
+    CHECK(IsEmpty());
+    for (int i = 0; i < num_tasks_; i++) {
+      DCHECK_NOT_NULL(private_push_segment(i));
+      DCHECK_NOT_NULL(private_pop_segment(i));
+      delete private_push_segment(i);
+      delete private_pop_segment(i);
+    }
+  }
+
+  // Swaps content with the given worklist. Local buffers need to
+  // be empty, not thread safe.
+  void Swap(Worklist<EntryType, SEGMENT_SIZE>& other) {
+    CHECK(AreLocalsEmpty());
+    CHECK(other.AreLocalsEmpty());
+
+    global_pool_.Swap(other.global_pool_);
+  }
+
+  bool Push(int task_id, EntryType entry) {
+    DCHECK_LT(task_id, num_tasks_);
+    DCHECK_NOT_NULL(private_push_segment(task_id));
+    if (!private_push_segment(task_id)->Push(entry)) {
+      PublishPushSegmentToGlobal(task_id);
+      bool success = private_push_segment(task_id)->Push(entry);
+      USE(success);
+      DCHECK(success);
+    }
+    return true;
+  }
+
+  bool Pop(int task_id, EntryType* entry) {
+    DCHECK_LT(task_id, num_tasks_);
+    DCHECK_NOT_NULL(private_pop_segment(task_id));
+    if (!private_pop_segment(task_id)->Pop(entry)) {
+      if (!private_push_segment(task_id)->IsEmpty()) {
+        Segment* tmp = private_pop_segment(task_id);
+        private_pop_segment(task_id) = private_push_segment(task_id);
+        private_push_segment(task_id) = tmp;
+      } else if (!StealPopSegmentFromGlobal(task_id)) {
+        return false;
+      }
+      bool success = private_pop_segment(task_id)->Pop(entry);
+      USE(success);
+      DCHECK(success);
+    }
+    return true;
+  }
+
+  size_t LocalPushSegmentSize(int task_id) const {
+    return private_push_segment(task_id)->Size();
+  }
+
+  bool IsLocalEmpty(int task_id) const {
+    return private_pop_segment(task_id)->IsEmpty() &&
+           private_push_segment(task_id)->IsEmpty();
+  }
+
+  bool IsGlobalPoolEmpty() const { return global_pool_.IsEmpty(); }
+
+  bool IsEmpty() const {
+    if (!AreLocalsEmpty()) return false;
+    return IsGlobalPoolEmpty();
+  }
+
+  bool AreLocalsEmpty() const {
+    for (int i = 0; i < num_tasks_; i++) {
+      if (!IsLocalEmpty(i)) return false;
+    }
+    return true;
+  }
+
+  bool IsLocalViewEmpty(int task_id) const {
+    return IsLocalEmpty(task_id) && IsGlobalPoolEmpty();
+  }
+
+  size_t LocalSize(int task_id) const {
+    return private_pop_segment(task_id)->Size() +
+           private_push_segment(task_id)->Size();
+  }
+
+  // Thread-safe but may return an outdated result.
+  size_t GlobalPoolSize() const { return global_pool_.Size(); }
+
+  // Clears all segments. Frees the global segment pool.
+  //
+  // Assumes that no other tasks are running.
+  void Clear() {
+    for (int i = 0; i < num_tasks_; i++) {
+      private_pop_segment(i)->Clear();
+      private_push_segment(i)->Clear();
+    }
+    global_pool_.Clear();
+  }
+
+  // Calls the specified callback on each element of the deques and replaces
+  // the element with the result of the callback.
+  // The signature of the callback is
+  //   bool Callback(EntryType old, EntryType* new).
+  // If the callback returns |false| then the element is removed from the
+  // worklist. Otherwise the |new| entry is updated.
+  //
+  // Assumes that no other tasks are running.
+  template <typename Callback>
+  void Update(Callback callback) {
+    for (int i = 0; i < num_tasks_; i++) {
+      private_pop_segment(i)->Update(callback);
+      private_push_segment(i)->Update(callback);
+    }
+    global_pool_.Update(callback);
+  }
+
+  // Calls the specified callback on each element of the deques.
+  // The signature of the callback is:
+  //   void Callback(EntryType entry).
+  //
+  // Assumes that no other tasks are running.
+  template <typename Callback>
+  void Iterate(Callback callback) {
+    for (int i = 0; i < num_tasks_; i++) {
+      private_pop_segment(i)->Iterate(callback);
+      private_push_segment(i)->Iterate(callback);
+    }
+    global_pool_.Iterate(callback);
+  }
+
+  template <typename Callback>
+  void IterateGlobalPool(Callback callback) {
+    global_pool_.Iterate(callback);
+  }
+
+  void FlushToGlobal(int task_id) {
+    PublishPushSegmentToGlobal(task_id);
+    PublishPopSegmentToGlobal(task_id);
+  }
+
+  void MergeGlobalPool(Worklist* other) {
+    global_pool_.Merge(&other->global_pool_);
+  }
+
+ private:
+  FRIEND_TEST(CppgcWorkListTest, SegmentCreate);
+  FRIEND_TEST(CppgcWorkListTest, SegmentPush);
+  FRIEND_TEST(CppgcWorkListTest, SegmentPushPop);
+  FRIEND_TEST(CppgcWorkListTest, SegmentIsEmpty);
+  FRIEND_TEST(CppgcWorkListTest, SegmentIsFull);
+  FRIEND_TEST(CppgcWorkListTest, SegmentClear);
+  FRIEND_TEST(CppgcWorkListTest, SegmentFullPushFails);
+  FRIEND_TEST(CppgcWorkListTest, SegmentEmptyPopFails);
+  FRIEND_TEST(CppgcWorkListTest, SegmentUpdateFalse);
+  FRIEND_TEST(CppgcWorkListTest, SegmentUpdate);
+
+  class Segment {
+   public:
+    static const size_t kCapacity = kSegmentCapacity;
+
+    Segment() : index_(0) {}
+
+    bool Push(EntryType entry) {
+      if (IsFull()) return false;
+      entries_[index_++] = entry;
+      return true;
+    }
+
+    bool Pop(EntryType* entry) {
+      if (IsEmpty()) return false;
+      *entry = entries_[--index_];
+      return true;
+    }
+
+    size_t Size() const { return index_; }
+    bool IsEmpty() const { return index_ == 0; }
+    bool IsFull() const { return index_ == kCapacity; }
+    void Clear() { index_ = 0; }
+
+    template <typename Callback>
+    void Update(Callback callback) {
+      size_t new_index = 0;
+      for (size_t i = 0; i < index_; i++) {
+        if (callback(entries_[i], &entries_[new_index])) {
+          new_index++;
+        }
+      }
+      index_ = new_index;
+    }
+
+    template <typename Callback>
+    void Iterate(Callback callback) const {
+      for (size_t i = 0; i < index_; i++) {
+        callback(entries_[i]);
+      }
+    }
+
+    Segment* next() const { return next_; }
+    void set_next(Segment* segment) { next_ = segment; }
+
+   private:
+    Segment* next_;
+    size_t index_;
+    EntryType entries_[kCapacity];
+  };
+
+  struct PrivateSegmentHolder {
+    Segment* private_push_segment;
+    Segment* private_pop_segment;
+    char cache_line_padding[64];
+  };
+
+  class GlobalPool {
+   public:
+    GlobalPool() : top_(nullptr) {}
+
+    // Swaps contents, not thread safe.
+    void Swap(GlobalPool& other) {
+      Segment* temp = top_;
+      set_top(other.top_);
+      other.set_top(temp);
+      size_t other_size = other.size_.exchange(
+          size_.load(std::memory_order_relaxed), std::memory_order_relaxed);
+      size_.store(other_size, std::memory_order_relaxed);
+    }
+
+    V8_INLINE void Push(Segment* segment) {
+      v8::base::MutexGuard guard(&lock_);
+      segment->set_next(top_);
+      set_top(segment);
+      size_.fetch_add(1, std::memory_order_relaxed);
+    }
+
+    V8_INLINE bool Pop(Segment** segment) {
+      v8::base::MutexGuard guard(&lock_);
+      if (top_) {
+        DCHECK_LT(0U, size_);
+        size_.fetch_sub(1, std::memory_order_relaxed);
+        *segment = top_;
+        set_top(top_->next());
+        return true;
+      }
+      return false;
+    }
+
+    V8_INLINE bool IsEmpty() const {
+      return v8::base::AsAtomicPtr(&top_)->load(std::memory_order_relaxed) ==
+             nullptr;
+    }
+
+    V8_INLINE size_t Size() const {
+      // It is safe to read |size_| without a lock since this variable is
+      // atomic, keeping in mind that threads may not immediately see the new
+      // value when it is updated.
+      return size_.load(std::memory_order_relaxed);
+    }
+
+    void Clear() {
+      v8::base::MutexGuard guard(&lock_);
+      size_.store(0, std::memory_order_relaxed);
+      Segment* current = top_;
+      while (current) {
+        Segment* tmp = current;
+        current = current->next();
+        delete tmp;
+      }
+      set_top(nullptr);
+    }
+
+    // See Worklist::Update.
+    template <typename Callback>
+    void Update(Callback callback) {
+      v8::base::MutexGuard guard(&lock_);
+      Segment* prev = nullptr;
+      Segment* current = top_;
+      while (current) {
+        current->Update(callback);
+        if (current->IsEmpty()) {
+          DCHECK_LT(0U, size_);
+          size_.fetch_sub(1, std::memory_order_relaxed);
+          if (!prev) {
+            top_ = current->next();
+          } else {
+            prev->set_next(current->next());
+          }
+          Segment* tmp = current;
+          current = current->next();
+          delete tmp;
+        } else {
+          prev = current;
+          current = current->next();
+        }
+      }
+    }
+
+    // See Worklist::Iterate.
+    template <typename Callback>
+    void Iterate(Callback callback) {
+      v8::base::MutexGuard guard(&lock_);
+      for (Segment* current = top_; current; current = current->next()) {
+        current->Iterate(callback);
+      }
+    }
+
+    void Merge(GlobalPool* other) {
+      Segment* top = nullptr;
+      size_t other_size = 0;
+      {
+        v8::base::MutexGuard guard(&other->lock_);
+        if (!other->top_) return;
+        top = other->top_;
+        other_size = other->size_.load(std::memory_order_relaxed);
+        other->size_.store(0, std::memory_order_relaxed);
+        other->set_top(nullptr);
+      }
+
+      // It's safe to iterate through these segments because the top was
+      // extracted from |other|.
+      Segment* end = top;
+      while (end->next()) end = end->next();
+
+      {
+        v8::base::MutexGuard guard(&lock_);
+        size_.fetch_add(other_size, std::memory_order_relaxed);
+        end->set_next(top_);
+        set_top(top);
+      }
+    }
+
+    void* operator new(size_t, void* location) = delete;
+    void* operator new(size_t) = delete;
+
+   private:
+    void set_top(Segment* segment) {
+      v8::base::AsAtomicPtr(&top_)->store(segment, std::memory_order_relaxed);
+    }
+
+    v8::base::Mutex lock_;
+    Segment* top_;
+    std::atomic<size_t> size_{0};
+  };
+
+  V8_INLINE Segment*& private_push_segment(int task_id) {
+    return private_segments_[task_id].private_push_segment;
+  }
+
+  V8_INLINE Segment* const& private_push_segment(int task_id) const {
+    return private_segments_[task_id].private_push_segment;
+  }
+
+  V8_INLINE Segment*& private_pop_segment(int task_id) {
+    return private_segments_[task_id].private_pop_segment;
+  }
+
+  V8_INLINE Segment* const& private_pop_segment(int task_id) const {
+    return private_segments_[task_id].private_pop_segment;
+  }
+
+  V8_INLINE void PublishPushSegmentToGlobal(int task_id) {
+    if (!private_push_segment(task_id)->IsEmpty()) {
+      global_pool_.Push(private_push_segment(task_id));
+      private_push_segment(task_id) = NewSegment();
+    }
+  }
+
+  V8_INLINE void PublishPopSegmentToGlobal(int task_id) {
+    if (!private_pop_segment(task_id)->IsEmpty()) {
+      global_pool_.Push(private_pop_segment(task_id));
+      private_pop_segment(task_id) = NewSegment();
+    }
+  }
+
+  V8_INLINE bool StealPopSegmentFromGlobal(int task_id) {
+    if (global_pool_.IsEmpty()) return false;
+    Segment* new_segment = nullptr;
+    if (global_pool_.Pop(&new_segment)) {
+      delete private_pop_segment(task_id);
+      private_pop_segment(task_id) = new_segment;
+      return true;
+    }
+    return false;
+  }
+
+  V8_INLINE Segment* NewSegment() {
+    // Bottleneck for filtering in crash dumps.
+    return new Segment();
+  }
+
+  PrivateSegmentHolder private_segments_[kMaxNumTasks];
+  GlobalPool global_pool_;
+  int num_tasks_;
+};
+
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_HEAP_CPPGC_WORKLIST_H_
diff --git a/deps/v8/src/heap/embedder-tracing.cc b/deps/v8/src/heap/embedder-tracing.cc
index 2b46da1feb6..9c926bed69f 100644
--- a/deps/v8/src/heap/embedder-tracing.cc
+++ b/deps/v8/src/heap/embedder-tracing.cc
@@ -50,7 +50,8 @@ void LocalEmbedderHeapTracer::EnterFinalPause() {
   remote_tracer_->EnterFinalPause(embedder_stack_state_);
   // Resetting to state unknown as there may be follow up garbage collections
   // triggered from callbacks that have a different stack state.
-  embedder_stack_state_ = EmbedderHeapTracer::kUnknown;
+  embedder_stack_state_ =
+      EmbedderHeapTracer::EmbedderStackState::kMayContainHeapPointers;
 }
 
 bool LocalEmbedderHeapTracer::Trace(double deadline) {
@@ -68,7 +69,7 @@ void LocalEmbedderHeapTracer::SetEmbedderStackStateForNextFinalization(
   if (!InUse()) return;
 
   embedder_stack_state_ = stack_state;
-  if (EmbedderHeapTracer::EmbedderStackState::kEmpty == stack_state) {
+  if (EmbedderHeapTracer::EmbedderStackState::kNoHeapPointers == stack_state) {
     remote_tracer()->NotifyEmptyEmbedderStack();
   }
 }
@@ -92,8 +93,11 @@ void LocalEmbedderHeapTracer::ProcessingScope::TracePossibleWrapper(
 
   void* pointer0;
   void* pointer1;
-  if (EmbedderDataSlot(js_object, 0).ToAlignedPointer(&pointer0) && pointer0 &&
-      EmbedderDataSlot(js_object, 1).ToAlignedPointer(&pointer1)) {
+  if (EmbedderDataSlot(js_object, 0)
+          .ToAlignedPointer(tracer_->isolate_, &pointer0) &&
+      pointer0 &&
+      EmbedderDataSlot(js_object, 1)
+          .ToAlignedPointer(tracer_->isolate_, &pointer1)) {
     wrapper_cache_.push_back({pointer0, pointer1});
   }
   FlushWrapperCacheIfFull();
diff --git a/deps/v8/src/heap/embedder-tracing.h b/deps/v8/src/heap/embedder-tracing.h
index cc3801e4797..728ede44526 100644
--- a/deps/v8/src/heap/embedder-tracing.h
+++ b/deps/v8/src/heap/embedder-tracing.h
@@ -109,7 +109,7 @@ class V8_EXPORT_PRIVATE LocalEmbedderHeapTracer final {
   EmbedderHeapTracer* remote_tracer_ = nullptr;
 
   EmbedderHeapTracer::EmbedderStackState embedder_stack_state_ =
-      EmbedderHeapTracer::kUnknown;
+      EmbedderHeapTracer::EmbedderStackState::kMayContainHeapPointers;
   // Indicates whether the embedder worklist was observed empty on the main
   // thread. This is opportunistic as concurrent marking tasks may hold local
   // segments of potential embedder fields to move to the main thread.
@@ -138,7 +138,8 @@ class V8_EXPORT_PRIVATE EmbedderStackStateScope final {
       : local_tracer_(local_tracer),
         old_stack_state_(local_tracer_->embedder_stack_state_) {
     local_tracer_->embedder_stack_state_ = stack_state;
-    if (EmbedderHeapTracer::EmbedderStackState::kEmpty == stack_state) {
+    if (EmbedderHeapTracer::EmbedderStackState::kNoHeapPointers ==
+        stack_state) {
       if (local_tracer->remote_tracer())
         local_tracer->remote_tracer()->NotifyEmptyEmbedderStack();
     }
diff --git a/deps/v8/src/heap/factory-base.cc b/deps/v8/src/heap/factory-base.cc
index e2ef3318ce8..028949e861d 100644
--- a/deps/v8/src/heap/factory-base.cc
+++ b/deps/v8/src/heap/factory-base.cc
@@ -10,6 +10,7 @@
 #include "src/handles/handles-inl.h"
 #include "src/heap/factory.h"
 #include "src/heap/heap-inl.h"
+#include "src/heap/memory-chunk.h"
 #include "src/heap/off-thread-factory-inl.h"
 #include "src/heap/read-only-heap.h"
 #include "src/logging/log.h"
@@ -228,7 +229,9 @@ Handle<Script> FactoryBase<Impl>::NewScriptWithId(Handle<String> source,
   script->set_flags(0);
   script->set_host_defined_options(roots.empty_fixed_array());
 
-  impl()->AddToScriptList(script);
+  if (script_id != Script::kTemporaryScriptId) {
+    impl()->AddToScriptList(script);
+  }
 
   LOG(isolate(), ScriptEvent(Logger::ScriptEventType::kCreate, script_id));
   return script;
diff --git a/deps/v8/src/heap/factory.cc b/deps/v8/src/heap/factory.cc
index 933a51425f9..f63d2fdd925 100644
--- a/deps/v8/src/heap/factory.cc
+++ b/deps/v8/src/heap/factory.cc
@@ -15,11 +15,13 @@
 #include "src/builtins/constants-table-builder.h"
 #include "src/codegen/compiler.h"
 #include "src/common/globals.h"
+#include "src/diagnostics/basic-block-profiler.h"
 #include "src/execution/isolate-inl.h"
 #include "src/execution/protectors-inl.h"
 #include "src/heap/heap-inl.h"
 #include "src/heap/incremental-marking.h"
 #include "src/heap/mark-compact-inl.h"
+#include "src/heap/memory-chunk.h"
 #include "src/heap/read-only-heap.h"
 #include "src/ic/handler-configuration-inl.h"
 #include "src/init/bootstrapper.h"
@@ -117,6 +119,22 @@ MaybeHandle<Code> Factory::CodeBuilder::BuildInternal(
     data_container->set_kind_specific_flags(kind_specific_flags_);
   }
 
+  // Basic block profiling data for builtins is stored in the JS heap rather
+  // than in separately-allocated C++ objects. Allocate that data now if
+  // appropriate.
+  Handle<OnHeapBasicBlockProfilerData> on_heap_profiler_data;
+  if (profiler_data_ && isolate_->IsGeneratingEmbeddedBuiltins()) {
+    on_heap_profiler_data = profiler_data_->CopyToJSHeap(isolate_);
+
+    // Add the on-heap data to a global list, which keeps it alive and allows
+    // iteration.
+    Handle<ArrayList> list(isolate_->heap()->basic_block_profiling_data(),
+                           isolate_);
+    Handle<ArrayList> new_list =
+        ArrayList::Add(isolate_, list, on_heap_profiler_data);
+    isolate_->heap()->SetBasicBlockProfilingData(new_list);
+  }
+
   Handle<Code> code;
   {
     int object_size = ComputeCodeObjectSize(code_desc_);
@@ -165,6 +183,7 @@ MaybeHandle<Code> Factory::CodeBuilder::BuildInternal(
     code->initialize_flags(kind_, has_unwinding_info, is_turbofanned_,
                            stack_slots_, kIsNotOffHeapTrampoline);
     code->set_builtin_index(builtin_index_);
+    code->set_inlined_bytecode_size(inlined_bytecode_size_);
     code->set_code_data_container(*data_container);
     code->set_deoptimization_data(*deoptimization_data_);
     code->set_source_position_table(*source_position_table_);
@@ -187,6 +206,14 @@ MaybeHandle<Code> Factory::CodeBuilder::BuildInternal(
       *(self_reference.location()) = code->ptr();
     }
 
+    // Likewise, any references to the basic block counters marker need to be
+    // updated to point to the newly-allocated counters array.
+    if (!on_heap_profiler_data.is_null()) {
+      isolate_->builtins_constants_table_builder()
+          ->PatchBasicBlockCountersReference(
+              handle(on_heap_profiler_data->counts(), isolate_));
+    }
+
     // Migrate generated code.
     // The generated code can contain embedded objects (typically from handles)
     // in a pointer-to-tagged-value format (i.e. with indirection like a handle)
@@ -209,6 +236,21 @@ MaybeHandle<Code> Factory::CodeBuilder::BuildInternal(
     code->FlushICache();
   }
 
+  if (profiler_data_) {
+#ifdef ENABLE_DISASSEMBLER
+    std::ostringstream os;
+    code->Disassemble(nullptr, os, isolate_);
+    if (!on_heap_profiler_data.is_null()) {
+      Handle<String> disassembly =
+          isolate_->factory()->NewStringFromAsciiChecked(os.str().c_str(),
+                                                         AllocationType::kOld);
+      on_heap_profiler_data->set_code(*disassembly);
+    } else {
+      profiler_data_->SetCode(os);
+    }
+#endif  // ENABLE_DISASSEMBLER
+  }
+
   return code;
 }
 
@@ -323,6 +365,13 @@ Handle<Oddball> Factory::NewSelfReferenceMarker() {
                     Oddball::kSelfReferenceMarker);
 }
 
+Handle<Oddball> Factory::NewBasicBlockCountersMarker() {
+  return NewOddball(basic_block_counters_marker_map(),
+                    "basic_block_counters_marker",
+                    handle(Smi::FromInt(-1), isolate()), "undefined",
+                    Oddball::kBasicBlockCountersMarker);
+}
+
 Handle<PropertyArray> Factory::NewPropertyArray(int length) {
   DCHECK_LE(0, length);
   if (length == 0) return empty_property_array();
@@ -530,19 +579,19 @@ Handle<String> Factory::InternalizeUtf8String(
       Vector<const uc16>(buffer.get(), decoder.utf16_length()));
 }
 
-template <typename Char>
-Handle<String> Factory::InternalizeString(const Vector<const Char>& string,
+Handle<String> Factory::InternalizeString(Vector<const uint8_t> string,
                                           bool convert_encoding) {
-  SequentialStringKey<Char> key(string, HashSeed(isolate()), convert_encoding);
+  SequentialStringKey<uint8_t> key(string, HashSeed(isolate()),
+                                   convert_encoding);
   return InternalizeStringWithKey(&key);
 }
 
-template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
-    Handle<String> Factory::InternalizeString(
-        const Vector<const uint8_t>& string, bool convert_encoding);
-template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
-    Handle<String> Factory::InternalizeString(
-        const Vector<const uint16_t>& string, bool convert_encoding);
+Handle<String> Factory::InternalizeString(Vector<const uint16_t> string,
+                                          bool convert_encoding) {
+  SequentialStringKey<uint16_t> key(string, HashSeed(isolate()),
+                                    convert_encoding);
+  return InternalizeStringWithKey(&key);
+}
 
 template <typename SeqString>
 Handle<String> Factory::InternalizeString(Handle<SeqString> string, int from,
@@ -1049,8 +1098,9 @@ Handle<NativeContext> Factory::NewNativeContext() {
   context->set_errors_thrown(Smi::zero());
   context->set_math_random_index(Smi::zero());
   context->set_serialized_objects(*empty_fixed_array());
-  context->set_microtask_queue(nullptr);
+  context->set_microtask_queue(isolate(), nullptr);
   context->set_osr_code_cache(*empty_weak_fixed_array());
+  context->set_retained_maps(*empty_weak_array_list());
   return context;
 }
 
@@ -1272,15 +1322,15 @@ Handle<CallbackTask> Factory::NewCallbackTask(Handle<Foreign> callback,
 }
 
 Handle<PromiseResolveThenableJobTask> Factory::NewPromiseResolveThenableJobTask(
-    Handle<JSPromise> promise_to_resolve, Handle<JSReceiver> then,
-    Handle<JSReceiver> thenable, Handle<Context> context) {
+    Handle<JSPromise> promise_to_resolve, Handle<JSReceiver> thenable,
+    Handle<JSReceiver> then, Handle<Context> context) {
   DCHECK(then->IsCallable());
   Handle<PromiseResolveThenableJobTask> microtask =
       Handle<PromiseResolveThenableJobTask>::cast(
           NewStruct(PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE));
   microtask->set_promise_to_resolve(*promise_to_resolve);
-  microtask->set_then(*then);
   microtask->set_thenable(*thenable);
+  microtask->set_then(*then);
   microtask->set_context(*context);
   return microtask;
 }
@@ -1292,7 +1342,7 @@ Handle<Foreign> Factory::NewForeign(Address addr) {
   HeapObject result = AllocateRawWithImmortalMap(map.instance_size(),
                                                  AllocationType::kYoung, map);
   Handle<Foreign> foreign(Foreign::cast(result), isolate());
-  foreign->set_foreign_address(addr);
+  foreign->set_foreign_address(isolate(), addr);
   return foreign;
 }
 
@@ -1434,7 +1484,7 @@ Map Factory::InitializeMap(Map map, InstanceType type, int instance_size,
   // Must be called only after |instance_type|, |instance_size| and
   // |layout_descriptor| are set.
   map.set_visitor_id(Map::GetVisitorId(map));
-  map.set_bit_field(0);
+  map.set_relaxed_bit_field(0);
   map.set_bit_field2(Map::Bits2::NewTargetIsBaseBit::encode(true));
   int bit_field3 =
       Map::Bits3::EnumLengthBits::encode(kInvalidEnumCacheSentinel) |
@@ -2437,6 +2487,13 @@ Handle<JSGeneratorObject> Factory::NewJSGeneratorObject(
   return Handle<JSGeneratorObject>::cast(NewJSObjectFromMap(map));
 }
 
+Handle<WasmStruct> Factory::NewWasmStruct(Handle<Map> map) {
+  int size = map->instance_size();
+  HeapObject result = AllocateRaw(size, AllocationType::kYoung);
+  result.set_map_after_allocation(*map);
+  return handle(WasmStruct::cast(result), isolate());
+}
+
 Handle<SourceTextModule> Factory::NewSourceTextModule(
     Handle<SharedFunctionInfo> code) {
   Handle<SourceTextModuleInfo> module_info(
@@ -2666,7 +2723,8 @@ Handle<JSTypedArray> Factory::NewJSTypedArray(ExternalArrayType type,
       Handle<JSTypedArray>::cast(NewJSArrayBufferView(
           map, empty_byte_array(), buffer, byte_offset, byte_length));
   typed_array->set_length(length);
-  typed_array->SetOffHeapDataPtr(buffer->backing_store(), byte_offset);
+  typed_array->SetOffHeapDataPtr(isolate(), buffer->backing_store(),
+                                 byte_offset);
   return typed_array;
 }
 
@@ -2677,8 +2735,8 @@ Handle<JSDataView> Factory::NewJSDataView(Handle<JSArrayBuffer> buffer,
                   isolate());
   Handle<JSDataView> obj = Handle<JSDataView>::cast(NewJSArrayBufferView(
       map, empty_fixed_array(), buffer, byte_offset, byte_length));
-  obj->set_data_pointer(static_cast<uint8_t*>(buffer->backing_store()) +
-                        byte_offset);
+  obj->set_data_pointer(
+      isolate(), static_cast<uint8_t*>(buffer->backing_store()) + byte_offset);
   return obj;
 }
 
@@ -2761,8 +2819,12 @@ Handle<JSGlobalProxy> Factory::NewUninitializedJSGlobalProxy(int size) {
   map->set_is_access_check_needed(true);
   map->set_may_have_interesting_symbols(true);
   LOG(isolate(), MapDetails(*map));
-  return Handle<JSGlobalProxy>::cast(
+  Handle<JSGlobalProxy> proxy = Handle<JSGlobalProxy>::cast(
       NewJSObjectFromMap(map, AllocationType::kYoung));
+  // Create identity hash early in case there is any JS collection containing
+  // a global proxy key and needs to be rehashed after deserialization.
+  proxy->GetOrCreateIdentityHash(isolate());
+  return proxy;
 }
 
 void Factory::ReinitializeJSGlobalProxy(Handle<JSGlobalProxy> object,
@@ -2858,38 +2920,42 @@ Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfoForBuiltin(
 }
 
 namespace {
-inline int NumberToStringCacheHash(Handle<FixedArray> cache, Smi number) {
+V8_INLINE int NumberToStringCacheHash(Handle<FixedArray> cache, Smi number) {
   int mask = (cache->length() >> 1) - 1;
   return number.value() & mask;
 }
-inline int NumberToStringCacheHash(Handle<FixedArray> cache, double number) {
+
+V8_INLINE int NumberToStringCacheHash(Handle<FixedArray> cache, double number) {
   int mask = (cache->length() >> 1) - 1;
   int64_t bits = bit_cast<int64_t>(number);
   return (static_cast<int>(bits) ^ static_cast<int>(bits >> 32)) & mask;
 }
-}  // namespace
 
-Handle<String> Factory::NumberToStringCacheSet(Handle<Object> number, int hash,
-                                               const char* string,
-                                               bool check_cache) {
+V8_INLINE Handle<String> CharToString(Factory* factory, const char* string,
+                                      NumberCacheMode mode) {
   // We tenure the allocated string since it is referenced from the
   // number-string cache which lives in the old space.
-  Handle<String> js_string = NewStringFromAsciiChecked(
-      string, check_cache ? AllocationType::kOld : AllocationType::kYoung);
-  if (!check_cache) return js_string;
+  AllocationType type = mode == NumberCacheMode::kIgnore
+                            ? AllocationType::kYoung
+                            : AllocationType::kOld;
+  return factory->NewStringFromAsciiChecked(string, type);
+}
+
+}  // namespace
 
+void Factory::NumberToStringCacheSet(Handle<Object> number, int hash,
+                                     Handle<String> js_string) {
   if (!number_string_cache()->get(hash * 2).IsUndefined(isolate())) {
     int full_size = isolate()->heap()->MaxNumberToStringCacheSize();
     if (number_string_cache()->length() != full_size) {
       Handle<FixedArray> new_cache =
           NewFixedArray(full_size, AllocationType::kOld);
       isolate()->heap()->set_number_string_cache(*new_cache);
-      return js_string;
+      return;
     }
   }
   number_string_cache()->set(hash * 2, *number);
   number_string_cache()->set(hash * 2 + 1, *js_string);
-  return js_string;
 }
 
 Handle<Object> Factory::NumberToStringCacheGet(Object number, int hash) {
@@ -2904,27 +2970,29 @@ Handle<Object> Factory::NumberToStringCacheGet(Object number, int hash) {
 }
 
 Handle<String> Factory::NumberToString(Handle<Object> number,
-                                       bool check_cache) {
-  if (number->IsSmi()) return SmiToString(Smi::cast(*number), check_cache);
+                                       NumberCacheMode mode) {
+  if (number->IsSmi()) return SmiToString(Smi::cast(*number), mode);
 
   double double_value = Handle<HeapNumber>::cast(number)->value();
   // Try to canonicalize doubles.
   int smi_value;
   if (DoubleToSmiInteger(double_value, &smi_value)) {
-    return SmiToString(Smi::FromInt(smi_value), check_cache);
+    return SmiToString(Smi::FromInt(smi_value), mode);
   }
   return HeapNumberToString(Handle<HeapNumber>::cast(number), double_value,
-                            check_cache);
+                            mode);
 }
 
 // Must be large enough to fit any double, int, or size_t.
 static const int kNumberToStringBufferSize = 32;
 
 Handle<String> Factory::HeapNumberToString(Handle<HeapNumber> number,
-                                           double value, bool check_cache) {
+                                           double value, NumberCacheMode mode) {
   int hash = 0;
-  if (check_cache) {
+  if (mode != NumberCacheMode::kIgnore) {
     hash = NumberToStringCacheHash(number_string_cache(), value);
+  }
+  if (mode == NumberCacheMode::kBoth) {
     Handle<Object> cached = NumberToStringCacheGet(*number, hash);
     if (!cached->IsUndefined(isolate())) return Handle<String>::cast(cached);
   }
@@ -2932,14 +3000,16 @@ Handle<String> Factory::HeapNumberToString(Handle<HeapNumber> number,
   char arr[kNumberToStringBufferSize];
   Vector<char> buffer(arr, arraysize(arr));
   const char* string = DoubleToCString(value, buffer);
-
-  return NumberToStringCacheSet(number, hash, string, check_cache);
+  Handle<String> result = CharToString(this, string, mode);
+  if (mode != NumberCacheMode::kIgnore) {
+    NumberToStringCacheSet(number, hash, result);
+  }
+  return result;
 }
 
-Handle<String> Factory::SmiToString(Smi number, bool check_cache) {
-  int hash = 0;
-  if (check_cache) {
-    hash = NumberToStringCacheHash(number_string_cache(), number);
+inline Handle<String> Factory::SmiToString(Smi number, NumberCacheMode mode) {
+  int hash = NumberToStringCacheHash(number_string_cache(), number);
+  if (mode == NumberCacheMode::kBoth) {
     Handle<Object> cached = NumberToStringCacheGet(number, hash);
     if (!cached->IsUndefined(isolate())) return Handle<String>::cast(cached);
   }
@@ -2947,9 +3017,11 @@ Handle<String> Factory::SmiToString(Smi number, bool check_cache) {
   char arr[kNumberToStringBufferSize];
   Vector<char> buffer(arr, arraysize(arr));
   const char* string = IntToCString(number.value(), buffer);
+  Handle<String> result = CharToString(this, string, mode);
+  if (mode != NumberCacheMode::kIgnore) {
+    NumberToStringCacheSet(handle(number, isolate()), hash, result);
+  }
 
-  Handle<String> result = NumberToStringCacheSet(handle(number, isolate()),
-                                                 hash, string, check_cache);
   // Compute the hash here (rather than letting the caller take care of it) so
   // that the "cache hit" case above doesn't have to bother with it.
   STATIC_ASSERT(Smi::kMaxValue <= std::numeric_limits<uint32_t>::max());
@@ -2963,15 +3035,16 @@ Handle<String> Factory::SmiToString(Smi number, bool check_cache) {
 
 Handle<String> Factory::SizeToString(size_t value, bool check_cache) {
   Handle<String> result;
+  NumberCacheMode cache_mode =
+      check_cache ? NumberCacheMode::kBoth : NumberCacheMode::kIgnore;
   if (value <= Smi::kMaxValue) {
     int32_t int32v = static_cast<int32_t>(static_cast<uint32_t>(value));
     // SmiToString sets the hash when needed, we can return immediately.
-    return SmiToString(Smi::FromInt(int32v), check_cache);
+    return SmiToString(Smi::FromInt(int32v), cache_mode);
   } else if (value <= kMaxSafeInteger) {
     // TODO(jkummerow): Refactor the cache to not require Objects as keys.
     double double_value = static_cast<double>(value);
-    result =
-        HeapNumberToString(NewHeapNumber(double_value), value, check_cache);
+    result = HeapNumberToString(NewHeapNumber(double_value), value, cache_mode);
   } else {
     char arr[kNumberToStringBufferSize];
     Vector<char> buffer(arr, arraysize(arr));
@@ -3019,6 +3092,15 @@ Handle<DebugInfo> Factory::NewDebugInfo(Handle<SharedFunctionInfo> shared) {
   return debug_info;
 }
 
+Handle<WasmValue> Factory::NewWasmValue(int value_type, Handle<Object> ref) {
+  DCHECK(value_type == 6 || ref->IsByteArray());
+  Handle<WasmValue> wasm_value =
+      Handle<WasmValue>::cast(NewStruct(WASM_VALUE_TYPE, AllocationType::kOld));
+  wasm_value->set_value_type(value_type);
+  wasm_value->set_bytes_or_ref(*ref);
+  return wasm_value;
+}
+
 Handle<BreakPointInfo> Factory::NewBreakPointInfo(int source_position) {
   Handle<BreakPointInfo> new_break_point_info = Handle<BreakPointInfo>::cast(
       NewStruct(BREAK_POINT_INFO_TYPE, AllocationType::kOld));
@@ -3043,9 +3125,7 @@ Handle<StackTraceFrame> Factory::NewStackTraceFrame(
   frame->set_frame_index(index);
   frame->set_frame_info(*undefined_value());
 
-  int id = isolate()->last_stack_frame_info_id() + 1;
-  isolate()->set_last_stack_frame_info_id(id);
-  frame->set_id(id);
+  frame->set_id(isolate()->GetNextStackFrameInfoId());
   return frame;
 }
 
@@ -3069,7 +3149,7 @@ Handle<StackFrameInfo> Factory::NewStackFrameInfo(
   // TODO(szuend): Adjust this, once it is decided what name to use in both
   //               "simple" and "detailed" stack traces. This code is for
   //               backwards compatibility to fullfill test expectations.
-  auto function_name = frame->GetFunctionName();
+  Handle<PrimitiveHeapObject> function_name = frame->GetFunctionName();
   bool is_user_java_script = false;
   if (!is_wasm) {
     Handle<Object> function = frame->GetFunction();
@@ -3080,11 +3160,11 @@ Handle<StackFrameInfo> Factory::NewStackFrameInfo(
     }
   }
 
-  Handle<Object> method_name = undefined_value();
-  Handle<Object> type_name = undefined_value();
-  Handle<Object> eval_origin = frame->GetEvalOrigin();
-  Handle<Object> wasm_module_name = frame->GetWasmModuleName();
-  Handle<Object> wasm_instance = frame->GetWasmInstance();
+  Handle<PrimitiveHeapObject> method_name = undefined_value();
+  Handle<PrimitiveHeapObject> type_name = undefined_value();
+  Handle<PrimitiveHeapObject> eval_origin = frame->GetEvalOrigin();
+  Handle<PrimitiveHeapObject> wasm_module_name = frame->GetWasmModuleName();
+  Handle<HeapObject> wasm_instance = frame->GetWasmInstance();
 
   // MethodName and TypeName are expensive to look up, so they are only
   // included when they are strictly needed by the stack trace
@@ -3128,7 +3208,8 @@ Handle<StackFrameInfo> Factory::NewStackFrameInfo(
   info->set_is_toplevel(is_toplevel);
   info->set_is_async(frame->IsAsync());
   info->set_is_promise_all(frame->IsPromiseAll());
-  info->set_promise_all_index(frame->GetPromiseIndex());
+  info->set_is_promise_any(frame->IsPromiseAny());
+  info->set_promise_combinator_index(frame->GetPromiseIndex());
 
   return info;
 }
diff --git a/deps/v8/src/heap/factory.h b/deps/v8/src/heap/factory.h
index 81041f7f40a..2f1a340cce8 100644
--- a/deps/v8/src/heap/factory.h
+++ b/deps/v8/src/heap/factory.h
@@ -26,6 +26,7 @@ namespace internal {
 // Forward declarations.
 class AliasedArgumentsEntry;
 class ObjectBoilerplateDescription;
+class BasicBlockProfilerData;
 class BreakPoint;
 class BreakPointInfo;
 class CallableTask;
@@ -98,6 +99,8 @@ enum FunctionMode {
       kWithReadonlyPrototypeBit | kWithNameBit,
 };
 
+enum class NumberCacheMode { kIgnore, kSetOnly, kBoth };
+
 // Interface for handle based allocation.
 class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
  public:
@@ -117,6 +120,10 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
   // Marks self references within code generation.
   Handle<Oddball> NewSelfReferenceMarker();
 
+  // Marks references to a function's basic-block usage counters array during
+  // code generation.
+  Handle<Oddball> NewBasicBlockCountersMarker();
+
   // Allocates a property array initialized with undefined values.
   Handle<PropertyArray> NewPropertyArray(int length);
   // Tries allocating a fixed array initialized with undefined values.
@@ -184,10 +191,14 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
     return InternalizeUtf8String(CStrVector(str));
   }
 
-  template <typename Char>
-  EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
-  Handle<String> InternalizeString(const Vector<const Char>& str,
+  Handle<String> InternalizeString(Vector<const uint8_t> str,
+                                   bool convert_encoding = false);
+  Handle<String> InternalizeString(Vector<const uint16_t> str,
                                    bool convert_encoding = false);
+  Handle<String> InternalizeString(Vector<const char> str,
+                                   bool convert_encoding = false) {
+    return InternalizeString(Vector<const uint8_t>::cast(str));
+  }
 
   template <typename SeqString>
   Handle<String> InternalizeString(Handle<SeqString>, int from, int length,
@@ -230,7 +241,7 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
       const char (&str)[N],
       AllocationType allocation = AllocationType::kYoung) {
     DCHECK_EQ(N, strlen(str) + 1);
-    return NewStringFromOneByte(StaticCharVector(str), allocation)
+    return NewStringFromOneByte(StaticOneByteVector(str), allocation)
         .ToHandleChecked();
   }
 
@@ -370,8 +381,8 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
   Handle<CallbackTask> NewCallbackTask(Handle<Foreign> callback,
                                        Handle<Foreign> data);
   Handle<PromiseResolveThenableJobTask> NewPromiseResolveThenableJobTask(
-      Handle<JSPromise> promise_to_resolve, Handle<JSReceiver> then,
-      Handle<JSReceiver> thenable, Handle<Context> context);
+      Handle<JSPromise> promise_to_resolve, Handle<JSReceiver> thenable,
+      Handle<JSReceiver> then, Handle<Context> context);
 
   // Foreign objects are pretenured when allocated by the bootstrapper.
   Handle<Foreign> NewForeign(Address addr);
@@ -542,6 +553,8 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
 
   Handle<JSModuleNamespace> NewJSModuleNamespace();
 
+  Handle<WasmStruct> NewWasmStruct(Handle<Map> map);
+
   Handle<SourceTextModule> NewSourceTextModule(Handle<SharedFunctionInfo> code);
   Handle<SyntheticModule> NewSyntheticModule(
       Handle<String> module_name, Handle<FixedArray> export_names,
@@ -675,10 +688,13 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
   DECLARE_ERROR(WasmRuntimeError)
 #undef DECLARE_ERROR
 
-  Handle<String> NumberToString(Handle<Object> number, bool check_cache = true);
-  Handle<String> SmiToString(Smi number, bool check_cache = true);
-  Handle<String> HeapNumberToString(Handle<HeapNumber> number, double value,
-                                    bool check_cache = true);
+  Handle<String> NumberToString(Handle<Object> number,
+                                NumberCacheMode mode = NumberCacheMode::kBoth);
+  Handle<String> SmiToString(Smi number,
+                             NumberCacheMode mode = NumberCacheMode::kBoth);
+  Handle<String> HeapNumberToString(
+      Handle<HeapNumber> number, double value,
+      NumberCacheMode mode = NumberCacheMode::kBoth);
 
   Handle<String> SizeToString(size_t value, bool check_cache = true);
   inline Handle<String> Uint32ToString(uint32_t value,
@@ -734,6 +750,8 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
 
   Handle<DebugInfo> NewDebugInfo(Handle<SharedFunctionInfo> shared);
 
+  Handle<WasmValue> NewWasmValue(int32_t value_type, Handle<Object> ref);
+
   // Return a map for given number of properties using the map cache in the
   // native context.
   Handle<Map> ObjectLiteralMapFromCache(Handle<NativeContext> native_context,
@@ -801,6 +819,11 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
       return *this;
     }
 
+    CodeBuilder& set_inlined_bytecode_size(uint32_t size) {
+      inlined_bytecode_size_ = size;
+      return *this;
+    }
+
     CodeBuilder& set_source_position_table(Handle<ByteArray> table) {
       DCHECK(!table.is_null());
       source_position_table_ = table;
@@ -843,6 +866,11 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
       return *this;
     }
 
+    CodeBuilder& set_profiler_data(BasicBlockProfilerData* profiler_data) {
+      profiler_data_ = profiler_data;
+      return *this;
+    }
+
    private:
     MaybeHandle<Code> BuildInternal(bool retry_allocation_or_fail);
 
@@ -852,10 +880,12 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
 
     MaybeHandle<Object> self_reference_;
     int32_t builtin_index_ = Builtins::kNoBuiltinId;
+    uint32_t inlined_bytecode_size_ = 0;
     int32_t kind_specific_flags_ = 0;
     Handle<ByteArray> source_position_table_;
     Handle<DeoptimizationData> deoptimization_data_ =
         DeoptimizationData::Empty(isolate_);
+    BasicBlockProfilerData* profiler_data_ = nullptr;
     bool is_executable_ = true;
     bool read_only_data_container_ = false;
     bool is_movable_ = true;
@@ -927,11 +957,11 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
 
   // Attempt to find the number in a small cache.  If we finds it, return
   // the string representation of the number.  Otherwise return undefined.
-  Handle<Object> NumberToStringCacheGet(Object number, int hash);
+  V8_INLINE Handle<Object> NumberToStringCacheGet(Object number, int hash);
 
   // Update the cache with a new number-string pair.
-  Handle<String> NumberToStringCacheSet(Handle<Object> number, int hash,
-                                        const char* string, bool check_cache);
+  V8_INLINE void NumberToStringCacheSet(Handle<Object> number, int hash,
+                                        Handle<String> js_string);
 
   // Creates a new JSArray with the given backing storage. Performs no
   // verification of the backing storage because it may not yet be filled.
diff --git a/deps/v8/src/heap/finalization-registry-cleanup-task.cc b/deps/v8/src/heap/finalization-registry-cleanup-task.cc
index c1868d48624..2acfa31ffba 100644
--- a/deps/v8/src/heap/finalization-registry-cleanup-task.cc
+++ b/deps/v8/src/heap/finalization-registry-cleanup-task.cc
@@ -37,7 +37,6 @@ void FinalizationRegistryCleanupTask::SlowAssertNoActiveJavaScript() {
 
 void FinalizationRegistryCleanupTask::RunInternal() {
   Isolate* isolate = heap_->isolate();
-  DCHECK(!isolate->host_cleanup_finalization_group_callback());
   SlowAssertNoActiveJavaScript();
 
   TRACE_EVENT_CALL_STATS_SCOPED(isolate, "v8",
@@ -65,8 +64,21 @@ void FinalizationRegistryCleanupTask::RunInternal() {
 
   // Exceptions are reported via the message handler. This is ensured by the
   // verbose TryCatch.
+  //
+  // Cleanup is interrupted if there is an exception. The HTML spec calls for a
+  // microtask checkpoint after each cleanup task, so the task should return
+  // after an exception so the host can perform a microtask checkpoint. In case
+  // of exception, check if the FinalizationRegistry still needs cleanup
+  // and should be requeued.
+  //
+  // TODO(syg): Implement better scheduling for finalizers.
   InvokeFinalizationRegistryCleanupFromTask(context, finalization_registry,
                                             callback);
+  if (finalization_registry->NeedsCleanup() &&
+      !finalization_registry->scheduled_for_cleanup()) {
+    auto nop = [](HeapObject, ObjectSlot, Object) {};
+    heap_->EnqueueDirtyJSFinalizationRegistry(*finalization_registry, nop);
+  }
 
   // Repost if there are remaining dirty FinalizationRegistries.
   heap_->set_is_finalization_registry_cleanup_task_posted(false);
diff --git a/deps/v8/src/heap/gc-tracer.cc b/deps/v8/src/heap/gc-tracer.cc
index f023bd7c74a..ce682f9c1f6 100644
--- a/deps/v8/src/heap/gc-tracer.cc
+++ b/deps/v8/src/heap/gc-tracer.cc
@@ -253,11 +253,10 @@ void GCTracer::Start(GarbageCollector collector,
 
   current_.reduce_memory = heap_->ShouldReduceMemory();
   current_.start_time = start_time;
-  current_.start_object_size = heap_->SizeOfObjects();
-  current_.start_memory_size = heap_->memory_allocator()->Size();
-  current_.start_holes_size = CountTotalHolesSize(heap_);
-  current_.young_object_size =
-      heap_->new_space()->Size() + heap_->new_lo_space()->SizeOfObjects();
+  current_.start_object_size = 0;
+  current_.start_memory_size = 0;
+  current_.start_holes_size = 0;
+  current_.young_object_size = 0;
 
   current_.incremental_marking_bytes = 0;
   current_.incremental_marking_duration = 0;
@@ -281,6 +280,14 @@ void GCTracer::Start(GarbageCollector collector,
   }
 }
 
+void GCTracer::StartInSafepoint() {
+  current_.start_object_size = heap_->SizeOfObjects();
+  current_.start_memory_size = heap_->memory_allocator()->Size();
+  current_.start_holes_size = CountTotalHolesSize(heap_);
+  current_.young_object_size =
+      heap_->new_space()->Size() + heap_->new_lo_space()->SizeOfObjects();
+}
+
 void GCTracer::ResetIncrementalMarkingCounters() {
   incremental_marking_bytes_ = 0;
   incremental_marking_duration_ = 0;
@@ -289,6 +296,13 @@ void GCTracer::ResetIncrementalMarkingCounters() {
   }
 }
 
+void GCTracer::StopInSafepoint() {
+  current_.end_object_size = heap_->SizeOfObjects();
+  current_.end_memory_size = heap_->memory_allocator()->Size();
+  current_.end_holes_size = CountTotalHolesSize(heap_);
+  current_.survived_young_object_size = heap_->SurvivedYoungObjectSize();
+}
+
 void GCTracer::Stop(GarbageCollector collector) {
   start_counter_--;
   if (start_counter_ != 0) {
@@ -309,10 +323,6 @@ void GCTracer::Stop(GarbageCollector collector) {
            current_.type == Event::INCREMENTAL_MARK_COMPACTOR)));
 
   current_.end_time = heap_->MonotonicallyIncreasingTimeInMs();
-  current_.end_object_size = heap_->SizeOfObjects();
-  current_.end_memory_size = heap_->memory_allocator()->Size();
-  current_.end_holes_size = CountTotalHolesSize(heap_);
-  current_.survived_young_object_size = heap_->SurvivedYoungObjectSize();
 
   AddAllocation(current_.end_time);
 
diff --git a/deps/v8/src/heap/gc-tracer.h b/deps/v8/src/heap/gc-tracer.h
index 6ff6e18a59f..628e7ca4bb9 100644
--- a/deps/v8/src/heap/gc-tracer.h
+++ b/deps/v8/src/heap/gc-tracer.h
@@ -25,19 +25,20 @@ inline BytesAndDuration MakeBytesAndDuration(uint64_t bytes, double duration) {
 
 enum ScavengeSpeedMode { kForAllObjects, kForSurvivedObjects };
 
+#define TRACE_GC_CATEGORIES \
+  "devtools.timeline," TRACE_DISABLED_BY_DEFAULT("v8.gc")
+
 #define TRACE_GC(tracer, scope_id)                             \
   GCTracer::Scope::ScopeId gc_tracer_scope_id(scope_id);       \
   GCTracer::Scope gc_tracer_scope(tracer, gc_tracer_scope_id); \
-  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),             \
-               GCTracer::Scope::Name(gc_tracer_scope_id))
+  TRACE_EVENT0(TRACE_GC_CATEGORIES, GCTracer::Scope::Name(gc_tracer_scope_id))
 
 #define TRACE_BACKGROUND_GC(tracer, scope_id)                                 \
   WorkerThreadRuntimeCallStatsScope runtime_call_stats_scope(                 \
       tracer->worker_thread_runtime_call_stats());                            \
   GCTracer::BackgroundScope background_scope(tracer, scope_id,                \
                                              runtime_call_stats_scope.Get()); \
-  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),                            \
-               GCTracer::BackgroundScope::Name(scope_id))
+  TRACE_EVENT0(TRACE_GC_CATEGORIES, GCTracer::BackgroundScope::Name(scope_id))
 
 // GCTracer collects and prints ONE line after each garbage collector
 // invocation IFF --trace_gc is used.
@@ -218,9 +219,11 @@ class V8_EXPORT_PRIVATE GCTracer {
   // Start collecting data.
   void Start(GarbageCollector collector, GarbageCollectionReason gc_reason,
              const char* collector_reason);
+  void StartInSafepoint();
 
   // Stop collecting data and print results.
   void Stop(GarbageCollector collector);
+  void StopInSafepoint();
 
   void NotifySweepingCompleted();
 
diff --git a/deps/v8/src/heap/heap-inl.h b/deps/v8/src/heap/heap-inl.h
index e618b910584..bf7d697e5e8 100644
--- a/deps/v8/src/heap/heap-inl.h
+++ b/deps/v8/src/heap/heap-inl.h
@@ -23,6 +23,12 @@
 // leak heap internals to users of this interface!
 #include "src/execution/isolate-data.h"
 #include "src/execution/isolate.h"
+#include "src/heap/code-object-registry.h"
+#include "src/heap/memory-allocator.h"
+#include "src/heap/memory-chunk.h"
+#include "src/heap/new-spaces-inl.h"
+#include "src/heap/paged-spaces-inl.h"
+#include "src/heap/read-only-spaces.h"
 #include "src/heap/spaces-inl.h"
 #include "src/objects/allocation-site-inl.h"
 #include "src/objects/api-callbacks-inl.h"
@@ -376,7 +382,7 @@ void Heap::FinalizeExternalString(String string) {
       ExternalBackingStoreType::kExternalString,
       ext_string.ExternalPayloadSize());
 
-  ext_string.DisposeResource();
+  ext_string.DisposeResource(isolate());
 }
 
 Address Heap::NewSpaceTop() { return new_space_->top(); }
diff --git a/deps/v8/src/heap/heap.cc b/deps/v8/src/heap/heap.cc
index 518bbcf1625..6099551b362 100644
--- a/deps/v8/src/heap/heap.cc
+++ b/deps/v8/src/heap/heap.cc
@@ -13,6 +13,7 @@
 #include "src/base/bits.h"
 #include "src/base/flags.h"
 #include "src/base/once.h"
+#include "src/base/platform/mutex.h"
 #include "src/base/utils/random-number-generator.h"
 #include "src/builtins/accessors.h"
 #include "src/codegen/assembler-inl.h"
@@ -29,6 +30,7 @@
 #include "src/heap/array-buffer-sweeper.h"
 #include "src/heap/array-buffer-tracker-inl.h"
 #include "src/heap/barrier.h"
+#include "src/heap/code-object-registry.h"
 #include "src/heap/code-stats.h"
 #include "src/heap/combined-heap.h"
 #include "src/heap/concurrent-marking.h"
@@ -40,16 +42,19 @@
 #include "src/heap/heap-write-barrier-inl.h"
 #include "src/heap/incremental-marking-inl.h"
 #include "src/heap/incremental-marking.h"
+#include "src/heap/large-spaces.h"
 #include "src/heap/local-heap.h"
 #include "src/heap/mark-compact-inl.h"
 #include "src/heap/mark-compact.h"
+#include "src/heap/memory-chunk-inl.h"
 #include "src/heap/memory-measurement.h"
 #include "src/heap/memory-reducer.h"
 #include "src/heap/object-stats.h"
 #include "src/heap/objects-visiting-inl.h"
 #include "src/heap/objects-visiting.h"
+#include "src/heap/paged-spaces-inl.h"
 #include "src/heap/read-only-heap.h"
-#include "src/heap/remembered-set.h"
+#include "src/heap/remembered-set-inl.h"
 #include "src/heap/safepoint.h"
 #include "src/heap/scavenge-job.h"
 #include "src/heap/scavenger-inl.h"
@@ -71,7 +76,7 @@
 #include "src/objects/slots-inl.h"
 #include "src/regexp/regexp.h"
 #include "src/snapshot/embedded/embedded-data.h"
-#include "src/snapshot/serializer-common.h"
+#include "src/snapshot/serializer-deserializer.h"
 #include "src/snapshot/snapshot.h"
 #include "src/strings/string-stream.h"
 #include "src/strings/unicode-decoder.h"
@@ -171,6 +176,10 @@ void Heap::SetSerializedGlobalProxySizes(FixedArray sizes) {
   set_serialized_global_proxy_sizes(sizes);
 }
 
+void Heap::SetBasicBlockProfilingData(Handle<ArrayList> list) {
+  set_basic_block_profiling_data(*list);
+}
+
 bool Heap::GCCallbackTuple::operator==(
     const Heap::GCCallbackTuple& other) const {
   return other.callback == callback && other.data == data;
@@ -202,8 +211,9 @@ Heap::Heap()
     : isolate_(isolate()),
       memory_pressure_level_(MemoryPressureLevel::kNone),
       global_pretenuring_feedback_(kInitialFeedbackCapacity),
-      safepoint_(new Safepoint(this)),
-      external_string_table_(this) {
+      safepoint_(new GlobalSafepoint(this)),
+      external_string_table_(this),
+      collection_barrier_(this) {
   // Ensure old_generation_size_ is a multiple of kPageSize.
   DCHECK_EQ(0, max_old_generation_size_ & (Page::kPageSize - 1));
 
@@ -411,7 +421,12 @@ bool Heap::CanExpandOldGeneration(size_t size) {
   return memory_allocator()->Size() + size <= MaxReserved();
 }
 
-bool Heap::HasBeenSetUp() {
+bool Heap::CanExpandOldGenerationBackground(size_t size) {
+  if (force_oom_) return false;
+  return memory_allocator()->Size() + size <= MaxReserved();
+}
+
+bool Heap::HasBeenSetUp() const {
   // We will always have a new space when the heap is set up.
   return new_space_ != nullptr;
 }
@@ -1108,14 +1123,32 @@ void Heap::DeoptMarkedAllocationSites() {
   Deoptimizer::DeoptimizeMarkedCode(isolate_);
 }
 
-
-void Heap::GarbageCollectionEpilogue() {
-  TRACE_GC(tracer(), GCTracer::Scope::HEAP_EPILOGUE);
-  if (Heap::ShouldZapGarbage() || FLAG_clear_free_memory) {
-    ZapFromSpace();
+void Heap::GarbageCollectionEpilogueInSafepoint() {
+#define UPDATE_COUNTERS_FOR_SPACE(space)                \
+  isolate_->counters()->space##_bytes_available()->Set( \
+      static_cast<int>(space()->Available()));          \
+  isolate_->counters()->space##_bytes_committed()->Set( \
+      static_cast<int>(space()->CommittedMemory()));    \
+  isolate_->counters()->space##_bytes_used()->Set(      \
+      static_cast<int>(space()->SizeOfObjects()));
+#define UPDATE_FRAGMENTATION_FOR_SPACE(space)                          \
+  if (space()->CommittedMemory() > 0) {                                \
+    isolate_->counters()->external_fragmentation_##space()->AddSample( \
+        static_cast<int>(100 - (space()->SizeOfObjects() * 100.0) /    \
+                                   space()->CommittedMemory()));       \
   }
+#define UPDATE_COUNTERS_AND_FRAGMENTATION_FOR_SPACE(space) \
+  UPDATE_COUNTERS_FOR_SPACE(space)                         \
+  UPDATE_FRAGMENTATION_FOR_SPACE(space)
 
-  AllowHeapAllocation for_the_rest_of_the_epilogue;
+  UPDATE_COUNTERS_FOR_SPACE(new_space)
+  UPDATE_COUNTERS_AND_FRAGMENTATION_FOR_SPACE(old_space)
+  UPDATE_COUNTERS_AND_FRAGMENTATION_FOR_SPACE(code_space)
+  UPDATE_COUNTERS_AND_FRAGMENTATION_FOR_SPACE(map_space)
+  UPDATE_COUNTERS_AND_FRAGMENTATION_FOR_SPACE(lo_space)
+#undef UPDATE_COUNTERS_FOR_SPACE
+#undef UPDATE_FRAGMENTATION_FOR_SPACE
+#undef UPDATE_COUNTERS_AND_FRAGMENTATION_FOR_SPACE
 
 #ifdef DEBUG
   // Old-to-new slot sets must be empty after each collection.
@@ -1133,6 +1166,15 @@ void Heap::GarbageCollectionEpilogue() {
   if (FLAG_code_stats) ReportCodeStatistics("After GC");
   if (FLAG_check_handle_count) CheckHandleCount();
 #endif
+}
+
+void Heap::GarbageCollectionEpilogue() {
+  TRACE_GC(tracer(), GCTracer::Scope::HEAP_EPILOGUE);
+  if (Heap::ShouldZapGarbage() || FLAG_clear_free_memory) {
+    ZapFromSpace();
+  }
+
+  AllowHeapAllocation for_the_rest_of_the_epilogue;
 
   UpdateMaximumCommitted();
 
@@ -1160,33 +1202,6 @@ void Heap::GarbageCollectionEpilogue() {
         static_cast<int>(MaximumCommittedMemory() / KB));
   }
 
-#define UPDATE_COUNTERS_FOR_SPACE(space)                \
-  isolate_->counters()->space##_bytes_available()->Set( \
-      static_cast<int>(space()->Available()));          \
-  isolate_->counters()->space##_bytes_committed()->Set( \
-      static_cast<int>(space()->CommittedMemory()));    \
-  isolate_->counters()->space##_bytes_used()->Set(      \
-      static_cast<int>(space()->SizeOfObjects()));
-#define UPDATE_FRAGMENTATION_FOR_SPACE(space)                          \
-  if (space()->CommittedMemory() > 0) {                                \
-    isolate_->counters()->external_fragmentation_##space()->AddSample( \
-        static_cast<int>(100 -                                         \
-                         (space()->SizeOfObjects() * 100.0) /          \
-                             space()->CommittedMemory()));             \
-  }
-#define UPDATE_COUNTERS_AND_FRAGMENTATION_FOR_SPACE(space) \
-  UPDATE_COUNTERS_FOR_SPACE(space)                         \
-  UPDATE_FRAGMENTATION_FOR_SPACE(space)
-
-  UPDATE_COUNTERS_FOR_SPACE(new_space)
-  UPDATE_COUNTERS_AND_FRAGMENTATION_FOR_SPACE(old_space)
-  UPDATE_COUNTERS_AND_FRAGMENTATION_FOR_SPACE(code_space)
-  UPDATE_COUNTERS_AND_FRAGMENTATION_FOR_SPACE(map_space)
-  UPDATE_COUNTERS_AND_FRAGMENTATION_FOR_SPACE(lo_space)
-#undef UPDATE_COUNTERS_FOR_SPACE
-#undef UPDATE_FRAGMENTATION_FOR_SPACE
-#undef UPDATE_COUNTERS_AND_FRAGMENTATION_FOR_SPACE
-
 #ifdef DEBUG
   ReportStatisticsAfterGC();
 #endif  // DEBUG
@@ -1197,16 +1212,6 @@ void Heap::GarbageCollectionEpilogue() {
     TRACE_GC(tracer(), GCTracer::Scope::HEAP_EPILOGUE_REDUCE_NEW_SPACE);
     ReduceNewSpaceSize();
   }
-
-  if (FLAG_harmony_weak_refs &&
-      isolate()->host_cleanup_finalization_group_callback()) {
-    HandleScope handle_scope(isolate());
-    Handle<JSFinalizationRegistry> finalization_registry;
-    while (
-        DequeueDirtyJSFinalizationRegistry().ToHandle(&finalization_registry)) {
-      isolate()->RunHostCleanupFinalizationGroupCallback(finalization_registry);
-    }
-  }
 }
 
 class GCCallbacksScope {
@@ -1387,16 +1392,15 @@ void Heap::CollectAllAvailableGarbage(GarbageCollectionReason gc_reason) {
   // The optimizing compiler may be unnecessarily holding on to memory.
   isolate()->AbortConcurrentOptimization(BlockingBehavior::kDontBlock);
   isolate()->ClearSerializerData();
-  set_current_gc_flags(kReduceMemoryFootprintMask);
+  set_current_gc_flags(
+      kReduceMemoryFootprintMask |
+      (gc_reason == GarbageCollectionReason::kLowMemoryNotification ? kForcedGC
+                                                                    : 0));
   isolate_->compilation_cache()->Clear();
   const int kMaxNumberOfAttempts = 7;
   const int kMinNumberOfAttempts = 2;
-  const v8::GCCallbackFlags callback_flags =
-      gc_reason == GarbageCollectionReason::kLowMemoryNotification
-          ? v8::kGCCallbackFlagForced
-          : v8::kGCCallbackFlagCollectAllAvailableGarbage;
   for (int attempt = 0; attempt < kMaxNumberOfAttempts; attempt++) {
-    if (!CollectGarbage(OLD_SPACE, gc_reason, callback_flags) &&
+    if (!CollectGarbage(OLD_SPACE, gc_reason, kNoGCCallbackFlags) &&
         attempt + 1 >= kMinNumberOfAttempts) {
       break;
     }
@@ -1446,9 +1450,15 @@ void Heap::ReportExternalMemoryPressure() {
       static_cast<GCCallbackFlags>(
           kGCCallbackFlagSynchronousPhantomCallbackProcessing |
           kGCCallbackFlagCollectAllExternalMemory);
-  if (isolate()->isolate_data()->external_memory_ >
-      (isolate()->isolate_data()->external_memory_low_since_mark_compact_ +
-       external_memory_hard_limit())) {
+  int64_t current = isolate()->isolate_data()->external_memory_;
+  int64_t baseline =
+      isolate()->isolate_data()->external_memory_low_since_mark_compact_;
+  int64_t limit = isolate()->isolate_data()->external_memory_limit_;
+  TRACE_EVENT2(
+      "devtools.timeline,v8", "V8.ExternalMemoryPressure", "external_memory_mb",
+      static_cast<int>((current - baseline) / MB), "external_memory_limit_mb",
+      static_cast<int>((limit - baseline) / MB));
+  if (current > baseline + external_memory_hard_limit()) {
     CollectAllGarbage(
         kReduceMemoryFootprintMask,
         GarbageCollectionReason::kExternalMemoryPressure,
@@ -1472,10 +1482,7 @@ void Heap::ReportExternalMemoryPressure() {
     const double kMaxStepSize = 10;
     const double ms_step = Min(
         kMaxStepSize,
-        Max(kMinStepSize,
-            static_cast<double>(isolate()->isolate_data()->external_memory_) /
-                isolate()->isolate_data()->external_memory_limit_ *
-                kMinStepSize));
+        Max(kMinStepSize, static_cast<double>(current) / limit * kMinStepSize));
     const double deadline = MonotonicallyIncreasingTimeInMs() + ms_step;
     // Extend the gc callback flags with external memory flags.
     current_gc_callback_flags_ = static_cast<GCCallbackFlags>(
@@ -1516,7 +1523,8 @@ bool Heap::CollectGarbage(AllocationSpace space,
                           const v8::GCCallbackFlags gc_callback_flags) {
   const char* collector_reason = nullptr;
   GarbageCollector collector = SelectGarbageCollector(space, &collector_reason);
-  is_current_gc_forced_ = gc_callback_flags & v8::kGCCallbackFlagForced;
+  is_current_gc_forced_ = gc_callback_flags & v8::kGCCallbackFlagForced ||
+                          current_gc_flags_ & kForcedGC;
 
   DevToolsTraceEventScope devtools_trace_event_scope(
       this, IsYoungGenerationCollector(collector) ? "MinorGC" : "MajorGC",
@@ -1558,7 +1566,8 @@ bool Heap::CollectGarbage(AllocationSpace space,
     }
   }
 
-  bool next_gc_likely_to_collect_more = false;
+  size_t freed_global_handles = 0;
+
   size_t committed_memory_before = 0;
 
   if (collector == MARK_COMPACTOR) {
@@ -1584,18 +1593,69 @@ bool Heap::CollectGarbage(AllocationSpace space,
       OptionalTimedHistogramScope histogram_timer_priority_scope(
           gc_type_priority_timer, isolate_, mode);
 
-      next_gc_likely_to_collect_more =
-          PerformGarbageCollection(collector, gc_callback_flags);
+      if (!IsYoungGenerationCollector(collector)) {
+        PROFILE(isolate_, CodeMovingGCEvent());
+      }
+
+      GCType gc_type = collector == MARK_COMPACTOR ? kGCTypeMarkSweepCompact
+                                                   : kGCTypeScavenge;
+      {
+        GCCallbacksScope scope(this);
+        // Temporary override any embedder stack state as callbacks may create
+        // their own state on the stack and recursively trigger GC.
+        EmbedderStackStateScope embedder_scope(
+            local_embedder_heap_tracer(),
+            EmbedderHeapTracer::EmbedderStackState::kMayContainHeapPointers);
+        if (scope.CheckReenter()) {
+          AllowHeapAllocation allow_allocation;
+          AllowJavascriptExecution allow_js(isolate());
+          TRACE_GC(tracer(), GCTracer::Scope::HEAP_EXTERNAL_PROLOGUE);
+          VMState<EXTERNAL> state(isolate_);
+          HandleScope handle_scope(isolate_);
+          CallGCPrologueCallbacks(gc_type, kNoGCCallbackFlags);
+        }
+      }
+
+      if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+        tp_heap_->CollectGarbage();
+      } else {
+        freed_global_handles +=
+            PerformGarbageCollection(collector, gc_callback_flags);
+      }
+      // Clear is_current_gc_forced now that the current GC is complete. Do this
+      // before GarbageCollectionEpilogue() since that could trigger another
+      // unforced GC.
+      is_current_gc_forced_ = false;
+
+      {
+        TRACE_GC(tracer(), GCTracer::Scope::HEAP_EXTERNAL_WEAK_GLOBAL_HANDLES);
+        gc_post_processing_depth_++;
+        {
+          AllowHeapAllocation allow_allocation;
+          AllowJavascriptExecution allow_js(isolate());
+          freed_global_handles +=
+              isolate_->global_handles()->PostGarbageCollectionProcessing(
+                  collector, gc_callback_flags);
+        }
+        gc_post_processing_depth_--;
+      }
+
+      {
+        GCCallbacksScope scope(this);
+        if (scope.CheckReenter()) {
+          AllowHeapAllocation allow_allocation;
+          AllowJavascriptExecution allow_js(isolate());
+          TRACE_GC(tracer(), GCTracer::Scope::HEAP_EXTERNAL_EPILOGUE);
+          VMState<EXTERNAL> state(isolate_);
+          HandleScope handle_scope(isolate_);
+          CallGCEpilogueCallbacks(gc_type, gc_callback_flags);
+        }
+      }
       if (collector == MARK_COMPACTOR || collector == SCAVENGER) {
         tracer()->RecordGCPhasesHistograms(gc_type_timer);
       }
     }
 
-    // Clear is_current_gc_forced now that the current GC is complete. Do this
-    // before GarbageCollectionEpilogue() since that could trigger another
-    // unforced GC.
-    is_current_gc_forced_ = false;
-
     GarbageCollectionEpilogue();
     if (collector == MARK_COMPACTOR && FLAG_track_detached_contexts) {
       isolate()->CheckDetachedContextsAfterGC();
@@ -1610,11 +1670,9 @@ bool Heap::CollectGarbage(AllocationSpace space,
       // Trigger one more GC if
       // - this GC decreased committed memory,
       // - there is high fragmentation,
-      // - there are live detached contexts.
       event.next_gc_likely_to_collect_more =
           (committed_memory_before > committed_memory_after + MB) ||
-          HasHighFragmentation(used_memory_after, committed_memory_after) ||
-          (detached_contexts().length() > 0);
+          HasHighFragmentation(used_memory_after, committed_memory_after);
       event.committed_memory = committed_memory_after;
       if (deserialization_complete_) {
         memory_reducer_->NotifyMarkCompact(event);
@@ -1634,6 +1692,8 @@ bool Heap::CollectGarbage(AllocationSpace space,
     isolate()->CountUsage(v8::Isolate::kForcedGC);
   }
 
+  collection_barrier_.Increment();
+
   // Start incremental marking for the next cycle. We do this only for scavenger
   // to avoid a loop where mark-compact causes another mark-compact.
   if (IsYoungGenerationCollector(collector)) {
@@ -1642,7 +1702,7 @@ bool Heap::CollectGarbage(AllocationSpace space,
         kGCCallbackScheduleIdleGarbageCollection);
   }
 
-  return next_gc_likely_to_collect_more;
+  return freed_global_handles > 0;
 }
 
 
@@ -1659,9 +1719,10 @@ int Heap::NotifyContextDisposed(bool dependant_context) {
   isolate()->AbortConcurrentOptimization(BlockingBehavior::kDontBlock);
   if (!isolate()->context().is_null()) {
     RemoveDirtyFinalizationRegistriesOnContext(isolate()->raw_native_context());
+    isolate()->raw_native_context().set_retained_maps(
+        ReadOnlyRoots(this).empty_weak_array_list());
   }
 
-  number_of_disposed_maps_ = retained_maps().length();
   tracer()->AddContextDisposalTime(MonotonicallyIncreasingTimeInMs());
   return ++contexts_disposed_;
 }
@@ -1670,6 +1731,7 @@ void Heap::StartIncrementalMarking(int gc_flags,
                                    GarbageCollectionReason gc_reason,
                                    GCCallbackFlags gc_callback_flags) {
   DCHECK(incremental_marking()->IsStopped());
+  SafepointScope safepoint(this);
   set_current_gc_flags(gc_flags);
   current_gc_callback_flags_ = gc_callback_flags;
   incremental_marking()->Start(gc_reason);
@@ -1692,6 +1754,21 @@ void Heap::StartIncrementalMarkingIfAllocationLimitIsReached(
   }
 }
 
+void Heap::StartIncrementalMarkingIfAllocationLimitIsReachedBackground() {
+  if (!incremental_marking()->IsStopped() ||
+      !incremental_marking()->CanBeActivated()) {
+    return;
+  }
+
+  const size_t old_generation_space_available = OldGenerationSpaceAvailable();
+  const size_t global_memory_available = GlobalMemoryAvailable();
+
+  if (old_generation_space_available < new_space_->Capacity() ||
+      global_memory_available < new_space_->Capacity()) {
+    incremental_marking()->incremental_marking_job()->ScheduleTask(this);
+  }
+}
+
 void Heap::StartIdleIncrementalMarking(
     GarbageCollectionReason gc_reason,
     const GCCallbackFlags gc_callback_flags) {
@@ -1947,6 +2024,26 @@ void Heap::EnsureFromSpaceIsCommitted() {
   FatalProcessOutOfMemory("Committing semi space failed.");
 }
 
+void Heap::CollectionBarrier::Increment() {
+  base::MutexGuard guard(&mutex_);
+  requested_ = false;
+  cond_.NotifyAll();
+}
+
+void Heap::CollectionBarrier::Wait() {
+  base::MutexGuard guard(&mutex_);
+
+  if (!requested_) {
+    heap_->MemoryPressureNotification(MemoryPressureLevel::kCritical, false);
+    requested_ = true;
+  }
+
+  while (requested_) {
+    cond_.Wait(&mutex_);
+  }
+}
+
+void Heap::RequestAndWaitForCollection() { collection_barrier_.Wait(); }
 
 void Heap::UpdateSurvivalStatistics(int start_new_space_size) {
   if (start_new_space_size == 0) return;
@@ -1970,52 +2067,19 @@ void Heap::UpdateSurvivalStatistics(int start_new_space_size) {
   tracer()->AddSurvivalRatio(survival_rate);
 }
 
-bool Heap::PerformGarbageCollection(
+size_t Heap::PerformGarbageCollection(
     GarbageCollector collector, const v8::GCCallbackFlags gc_callback_flags) {
   DisallowJavascriptExecution no_js(isolate());
-
-  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
-    return tp_heap_->CollectGarbage();
-  }
-
-  size_t freed_global_handles = 0;
-
-  if (!IsYoungGenerationCollector(collector)) {
-    PROFILE(isolate_, CodeMovingGCEvent());
-  }
-
-#ifdef VERIFY_HEAP
-  if (FLAG_verify_heap) {
-    VerifyStringTable(this->isolate());
+  base::Optional<SafepointScope> optional_safepoint_scope;
+  if (FLAG_local_heaps) {
+    optional_safepoint_scope.emplace(this);
   }
-#endif
-
-  GCType gc_type =
-      collector == MARK_COMPACTOR ? kGCTypeMarkSweepCompact : kGCTypeScavenge;
-
-  {
-    GCCallbacksScope scope(this);
-    // Temporary override any embedder stack state as callbacks may create their
-    // own state on the stack and recursively trigger GC.
-    EmbedderStackStateScope embedder_scope(
-        local_embedder_heap_tracer(),
-        EmbedderHeapTracer::EmbedderStackState::kUnknown);
-    if (scope.CheckReenter()) {
-      AllowHeapAllocation allow_allocation;
-      AllowJavascriptExecution allow_js(isolate());
-      TRACE_GC(tracer(), GCTracer::Scope::HEAP_EXTERNAL_PROLOGUE);
-      VMState<EXTERNAL> state(isolate_);
-      HandleScope handle_scope(isolate_);
-      CallGCPrologueCallbacks(gc_type, kNoGCCallbackFlags);
-    }
-  }
-
-  if (FLAG_local_heaps) safepoint()->Start();
 #ifdef VERIFY_HEAP
   if (FLAG_verify_heap) {
     Verify();
   }
 #endif
+  tracer()->StartInSafepoint();
 
   EnsureFromSpaceIsCommitted();
 
@@ -2024,33 +2088,13 @@ bool Heap::PerformGarbageCollection(
 
   switch (collector) {
     case MARK_COMPACTOR:
-      UpdateOldGenerationAllocationCounter();
-      // Perform mark-sweep with optional compaction.
       MarkCompact();
-      old_generation_size_configured_ = true;
-      // This should be updated before PostGarbageCollectionProcessing, which
-      // can cause another GC. Take into account the objects promoted during
-      // GC.
-      old_generation_allocation_counter_at_last_gc_ +=
-          static_cast<size_t>(promoted_objects_size_);
-      old_generation_size_at_last_gc_ = OldGenerationSizeOfObjects();
       break;
     case MINOR_MARK_COMPACTOR:
       MinorMarkCompact();
       break;
     case SCAVENGER:
-      if ((fast_promotion_mode_ &&
-           CanExpandOldGeneration(new_space()->Size() +
-                                  new_lo_space()->Size()))) {
-        tracer()->NotifyYoungGenerationHandling(
-            YoungGenerationHandling::kFastPromotionDuringScavenge);
-        EvacuateYoungGeneration();
-      } else {
-        tracer()->NotifyYoungGenerationHandling(
-            YoungGenerationHandling::kRegularScavenge);
-
-        Scavenge();
-      }
+      Scavenge();
       break;
   }
 
@@ -2072,6 +2116,13 @@ bool Heap::PerformGarbageCollection(
 
   isolate_->counters()->objs_since_last_young()->Set(0);
 
+  isolate_->eternal_handles()->PostGarbageCollectionProcessing();
+
+  // Update relocatables.
+  Relocatable::PostGarbageCollectionProcessing(isolate_);
+
+  size_t freed_global_handles;
+
   {
     TRACE_GC(tracer(), GCTracer::Scope::HEAP_EXTERNAL_WEAK_GLOBAL_HANDLES);
     // First round weak callbacks are not supposed to allocate and trigger
@@ -2095,47 +2146,14 @@ bool Heap::PerformGarbageCollection(
     Verify();
   }
 #endif
-  if (FLAG_local_heaps) safepoint()->End();
-
-  {
-    TRACE_GC(tracer(), GCTracer::Scope::HEAP_EXTERNAL_WEAK_GLOBAL_HANDLES);
-    gc_post_processing_depth_++;
-    {
-      AllowHeapAllocation allow_allocation;
-      AllowJavascriptExecution allow_js(isolate());
-      freed_global_handles +=
-          isolate_->global_handles()->PostGarbageCollectionProcessing(
-              collector, gc_callback_flags);
-    }
-    gc_post_processing_depth_--;
-  }
-
-  isolate_->eternal_handles()->PostGarbageCollectionProcessing();
-
-  // Update relocatables.
-  Relocatable::PostGarbageCollectionProcessing(isolate_);
 
   RecomputeLimits(collector);
 
-  {
-    GCCallbacksScope scope(this);
-    if (scope.CheckReenter()) {
-      AllowHeapAllocation allow_allocation;
-      AllowJavascriptExecution allow_js(isolate());
-      TRACE_GC(tracer(), GCTracer::Scope::HEAP_EXTERNAL_EPILOGUE);
-      VMState<EXTERNAL> state(isolate_);
-      HandleScope handle_scope(isolate_);
-      CallGCEpilogueCallbacks(gc_type, gc_callback_flags);
-    }
-  }
+  GarbageCollectionEpilogueInSafepoint();
 
-#ifdef VERIFY_HEAP
-  if (FLAG_verify_heap) {
-    VerifyStringTable(this->isolate());
-  }
-#endif
+  tracer()->StopInSafepoint();
 
-  return freed_global_handles > 0;
+  return freed_global_handles;
 }
 
 void Heap::RecomputeLimits(GarbageCollector collector) {
@@ -2247,10 +2265,11 @@ void Heap::MarkCompact() {
 
   LOG(isolate_, ResourceEvent("markcompact", "begin"));
 
-  uint64_t size_of_objects_before_gc = SizeOfObjects();
-
   CodeSpaceMemoryModificationScope code_modifcation(this);
 
+  UpdateOldGenerationAllocationCounter();
+  uint64_t size_of_objects_before_gc = SizeOfObjects();
+
   mark_compact_collector()->Prepare();
 
   ms_count_++;
@@ -2266,6 +2285,14 @@ void Heap::MarkCompact() {
   if (FLAG_allocation_site_pretenuring) {
     EvaluateOldSpaceLocalPretenuring(size_of_objects_before_gc);
   }
+  old_generation_size_configured_ = true;
+  // This should be updated before PostGarbageCollectionProcessing, which
+  // can cause another GC. Take into account the objects promoted during
+  // GC.
+  old_generation_allocation_counter_at_last_gc_ +=
+      static_cast<size_t>(promoted_objects_size_);
+  old_generation_size_at_last_gc_ = OldGenerationSizeOfObjects();
+  global_memory_at_last_gc_ = GlobalSizeOfObjects();
 }
 
 void Heap::MinorMarkCompact() {
@@ -2380,6 +2407,16 @@ void Heap::EvacuateYoungGeneration() {
 }
 
 void Heap::Scavenge() {
+  if ((fast_promotion_mode_ &&
+       CanExpandOldGeneration(new_space()->Size() + new_lo_space()->Size()))) {
+    tracer()->NotifyYoungGenerationHandling(
+        YoungGenerationHandling::kFastPromotionDuringScavenge);
+    EvacuateYoungGeneration();
+    return;
+  }
+  tracer()->NotifyYoungGenerationHandling(
+      YoungGenerationHandling::kRegularScavenge);
+
   TRACE_GC(tracer(), GCTracer::Scope::SCAVENGER_SCAVENGE);
   base::MutexGuard guard(relocation_mutex());
   ConcurrentMarking::PauseScope pause_scope(concurrent_marking());
@@ -2813,7 +2850,7 @@ int Heap::GetMaximumFillToAlign(AllocationAlignment alignment) {
   return 0;
 }
 
-
+// static
 int Heap::GetFillToAlign(Address address, AllocationAlignment alignment) {
   if (alignment == kDoubleAligned && (address & kDoubleAlignmentMask) != 0)
     return kTaggedSize;
@@ -2826,24 +2863,28 @@ size_t Heap::GetCodeRangeReservedAreaSize() {
   return kReservedCodeRangePages * MemoryAllocator::GetCommitPageSize();
 }
 
-HeapObject Heap::PrecedeWithFiller(HeapObject object, int filler_size) {
-  CreateFillerObjectAt(object.address(), filler_size, ClearRecordedSlots::kNo);
+// static
+HeapObject Heap::PrecedeWithFiller(ReadOnlyRoots roots, HeapObject object,
+                                   int filler_size) {
+  CreateFillerObjectAt(roots, object.address(), filler_size,
+                       ClearFreedMemoryMode::kDontClearFreedMemory);
   return HeapObject::FromAddress(object.address() + filler_size);
 }
 
-HeapObject Heap::AlignWithFiller(HeapObject object, int object_size,
-                                 int allocation_size,
+// static
+HeapObject Heap::AlignWithFiller(ReadOnlyRoots roots, HeapObject object,
+                                 int object_size, int allocation_size,
                                  AllocationAlignment alignment) {
   int filler_size = allocation_size - object_size;
   DCHECK_LT(0, filler_size);
   int pre_filler = GetFillToAlign(object.address(), alignment);
   if (pre_filler) {
-    object = PrecedeWithFiller(object, pre_filler);
+    object = PrecedeWithFiller(roots, object, pre_filler);
     filler_size -= pre_filler;
   }
   if (filler_size) {
-    CreateFillerObjectAt(object.address() + object_size, filler_size,
-                         ClearRecordedSlots::kNo);
+    CreateFillerObjectAt(roots, object.address() + object_size, filler_size,
+                         ClearFreedMemoryMode::kDontClearFreedMemory);
   }
   return object;
 }
@@ -2929,47 +2970,83 @@ void Heap::FlushNumberStringCache() {
   }
 }
 
-HeapObject Heap::CreateFillerObjectAt(Address addr, int size,
-                                      ClearRecordedSlots clear_slots_mode,
-                                      ClearFreedMemoryMode clear_memory_mode) {
+namespace {
+
+HeapObject CreateFillerObjectAtImpl(ReadOnlyRoots roots, Address addr, int size,
+                                    ClearFreedMemoryMode clear_memory_mode) {
   if (size == 0) return HeapObject();
   HeapObject filler = HeapObject::FromAddress(addr);
-  bool clear_memory =
-      (clear_memory_mode == ClearFreedMemoryMode::kClearFreedMemory ||
-       clear_slots_mode == ClearRecordedSlots::kYes);
   if (size == kTaggedSize) {
-    filler.set_map_after_allocation(
-        Map::unchecked_cast(isolate()->root(RootIndex::kOnePointerFillerMap)),
-        SKIP_WRITE_BARRIER);
+    filler.set_map_after_allocation(roots.unchecked_one_pointer_filler_map(),
+                                    SKIP_WRITE_BARRIER);
   } else if (size == 2 * kTaggedSize) {
-    filler.set_map_after_allocation(
-        Map::unchecked_cast(isolate()->root(RootIndex::kTwoPointerFillerMap)),
-        SKIP_WRITE_BARRIER);
-    if (clear_memory) {
+    filler.set_map_after_allocation(roots.unchecked_two_pointer_filler_map(),
+                                    SKIP_WRITE_BARRIER);
+    if (clear_memory_mode == ClearFreedMemoryMode::kClearFreedMemory) {
       AtomicSlot slot(ObjectSlot(addr) + 1);
       *slot = static_cast<Tagged_t>(kClearedFreeMemoryValue);
     }
   } else {
     DCHECK_GT(size, 2 * kTaggedSize);
-    filler.set_map_after_allocation(
-        Map::unchecked_cast(isolate()->root(RootIndex::kFreeSpaceMap)),
-        SKIP_WRITE_BARRIER);
+    filler.set_map_after_allocation(roots.unchecked_free_space_map(),
+                                    SKIP_WRITE_BARRIER);
     FreeSpace::cast(filler).relaxed_write_size(size);
-    if (clear_memory) {
+    if (clear_memory_mode == ClearFreedMemoryMode::kClearFreedMemory) {
       MemsetTagged(ObjectSlot(addr) + 2, Object(kClearedFreeMemoryValue),
                    (size / kTaggedSize) - 2);
     }
   }
-  if (clear_slots_mode == ClearRecordedSlots::kYes &&
-      !V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
-    ClearRecordedSlotRange(addr, addr + size);
-  }
 
   // At this point, we may be deserializing the heap from a snapshot, and
   // none of the maps have been created yet and are nullptr.
   DCHECK((filler.map_slot().contains_value(kNullAddress) &&
-          !deserialization_complete_) ||
+          !Heap::FromWritableHeapObject(filler)->deserialization_complete()) ||
          filler.map().IsMap());
+
+  return filler;
+}
+
+#ifdef DEBUG
+void VerifyNoNeedToClearSlots(Address start, Address end) {
+  MemoryChunk* chunk = MemoryChunk::FromAddress(start);
+  // TODO(ulan): Support verification of large pages.
+  if (chunk->InYoungGeneration() || chunk->IsLargePage()) return;
+  Space* space = chunk->owner();
+  if (static_cast<PagedSpace*>(space)->is_off_thread_space()) return;
+  space->heap()->VerifySlotRangeHasNoRecordedSlots(start, end);
+}
+#else
+void VerifyNoNeedToClearSlots(Address start, Address end) {}
+#endif  // DEBUG
+
+}  // namespace
+
+// static
+HeapObject Heap::CreateFillerObjectAt(ReadOnlyRoots roots, Address addr,
+                                      int size,
+                                      ClearFreedMemoryMode clear_memory_mode) {
+  // TODO(leszeks): Verify that no slots need to be recorded.
+  HeapObject filler =
+      CreateFillerObjectAtImpl(roots, addr, size, clear_memory_mode);
+  VerifyNoNeedToClearSlots(addr, addr + size);
+  return filler;
+}
+
+HeapObject Heap::CreateFillerObjectAt(Address addr, int size,
+                                      ClearRecordedSlots clear_slots_mode) {
+  if (size == 0) return HeapObject();
+  HeapObject filler = CreateFillerObjectAtImpl(
+      ReadOnlyRoots(this), addr, size,
+      clear_slots_mode == ClearRecordedSlots::kYes
+          ? ClearFreedMemoryMode::kClearFreedMemory
+          : ClearFreedMemoryMode::kDontClearFreedMemory);
+  if (!V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    if (clear_slots_mode == ClearRecordedSlots::kYes) {
+      ClearRecordedSlotRange(addr, addr + size);
+    } else {
+      VerifyNoNeedToClearSlots(addr, addr + size);
+    }
+  }
   return filler;
 }
 
@@ -3158,7 +3235,7 @@ FixedArrayBase Heap::LeftTrimFixedArray(FixedArrayBase object,
     // to the original FixedArray (which is now the filler object).
     LeftTrimmerVerifierRootVisitor root_visitor(object);
     ReadOnlyRoots(this).Iterate(&root_visitor);
-    IterateRoots(&root_visitor, VISIT_ALL);
+    IterateRoots(&root_visitor, {});
   }
 #endif  // ENABLE_SLOW_DCHECKS
 
@@ -3440,6 +3517,28 @@ void Heap::FinalizeIncrementalMarkingAtomically(
   CollectAllGarbage(current_gc_flags_, gc_reason, current_gc_callback_flags_);
 }
 
+void Heap::InvokeIncrementalMarkingPrologueCallbacks() {
+  GCCallbacksScope scope(this);
+  if (scope.CheckReenter()) {
+    AllowHeapAllocation allow_allocation;
+    TRACE_GC(tracer(), GCTracer::Scope::MC_INCREMENTAL_EXTERNAL_PROLOGUE);
+    VMState<EXTERNAL> state(isolate_);
+    HandleScope handle_scope(isolate_);
+    CallGCPrologueCallbacks(kGCTypeIncrementalMarking, kNoGCCallbackFlags);
+  }
+}
+
+void Heap::InvokeIncrementalMarkingEpilogueCallbacks() {
+  GCCallbacksScope scope(this);
+  if (scope.CheckReenter()) {
+    AllowHeapAllocation allow_allocation;
+    TRACE_GC(tracer(), GCTracer::Scope::MC_INCREMENTAL_EXTERNAL_EPILOGUE);
+    VMState<EXTERNAL> state(isolate_);
+    HandleScope handle_scope(isolate_);
+    CallGCEpilogueCallbacks(kGCTypeIncrementalMarking, kNoGCCallbackFlags);
+  }
+}
+
 void Heap::FinalizeIncrementalMarkingIncrementally(
     GarbageCollectionReason gc_reason) {
   if (FLAG_trace_incremental_marking) {
@@ -3456,27 +3555,10 @@ void Heap::FinalizeIncrementalMarkingIncrementally(
   TRACE_EVENT0("v8", "V8.GCIncrementalMarkingFinalize");
   TRACE_GC(tracer(), GCTracer::Scope::MC_INCREMENTAL_FINALIZE);
 
-  {
-    GCCallbacksScope scope(this);
-    if (scope.CheckReenter()) {
-      AllowHeapAllocation allow_allocation;
-      TRACE_GC(tracer(), GCTracer::Scope::MC_INCREMENTAL_EXTERNAL_PROLOGUE);
-      VMState<EXTERNAL> state(isolate_);
-      HandleScope handle_scope(isolate_);
-      CallGCPrologueCallbacks(kGCTypeIncrementalMarking, kNoGCCallbackFlags);
-    }
-  }
+  SafepointScope safepoint(this);
+  InvokeIncrementalMarkingPrologueCallbacks();
   incremental_marking()->FinalizeIncrementally();
-  {
-    GCCallbacksScope scope(this);
-    if (scope.CheckReenter()) {
-      AllowHeapAllocation allow_allocation;
-      TRACE_GC(tracer(), GCTracer::Scope::MC_INCREMENTAL_EXTERNAL_EPILOGUE);
-      VMState<EXTERNAL> state(isolate_);
-      HandleScope handle_scope(isolate_);
-      CallGCEpilogueCallbacks(kGCTypeIncrementalMarking, kNoGCCallbackFlags);
-    }
-  }
+  InvokeIncrementalMarkingEpilogueCallbacks();
 }
 
 void Heap::RegisterDeserializedObjectsForBlackAllocation(
@@ -3758,19 +3840,15 @@ void Heap::CheckMemoryPressure() {
   // the finalizers.
   memory_pressure_level_ = MemoryPressureLevel::kNone;
   if (memory_pressure_level == MemoryPressureLevel::kCritical) {
+    TRACE_EVENT0("devtools.timeline,v8", "V8.CheckMemoryPressure");
     CollectGarbageOnMemoryPressure();
   } else if (memory_pressure_level == MemoryPressureLevel::kModerate) {
     if (FLAG_incremental_marking && incremental_marking()->IsStopped()) {
+      TRACE_EVENT0("devtools.timeline,v8", "V8.CheckMemoryPressure");
       StartIncrementalMarking(kReduceMemoryFootprintMask,
                               GarbageCollectionReason::kMemoryPressure);
     }
   }
-  if (memory_reducer_) {
-    MemoryReducer::Event event;
-    event.type = MemoryReducer::kPossibleGarbage;
-    event.time_ms = MonotonicallyIncreasingTimeInMs();
-    memory_reducer_->NotifyPossibleGarbage(event);
-  }
 }
 
 void Heap::CollectGarbageOnMemoryPressure() {
@@ -3811,6 +3889,8 @@ void Heap::CollectGarbageOnMemoryPressure() {
 
 void Heap::MemoryPressureNotification(MemoryPressureLevel level,
                                       bool is_isolate_locked) {
+  TRACE_EVENT1("devtools.timeline,v8", "V8.MemoryPressureNotification", "level",
+               static_cast<int>(level));
   MemoryPressureLevel previous = memory_pressure_level_;
   memory_pressure_level_ = level;
   if ((previous != MemoryPressureLevel::kCritical &&
@@ -3830,12 +3910,17 @@ void Heap::MemoryPressureNotification(MemoryPressureLevel level,
 }
 
 void Heap::EagerlyFreeExternalMemory() {
-  for (Page* page : *old_space()) {
-    if (!page->SweepingDone()) {
-      base::MutexGuard guard(page->mutex());
+  if (FLAG_array_buffer_extension) {
+    array_buffer_sweeper()->EnsureFinished();
+  } else {
+    CHECK(!FLAG_local_heaps);
+    for (Page* page : *old_space()) {
       if (!page->SweepingDone()) {
-        ArrayBufferTracker::FreeDead(
-            page, mark_compact_collector()->non_atomic_marking_state());
+        base::MutexGuard guard(page->mutex());
+        if (!page->SweepingDone()) {
+          ArrayBufferTracker::FreeDead(
+              page, mark_compact_collector()->non_atomic_marking_state());
+        }
       }
     }
   }
@@ -4002,7 +4087,7 @@ const char* Heap::GarbageCollectionReasonToString(
   UNREACHABLE();
 }
 
-bool Heap::Contains(HeapObject value) {
+bool Heap::Contains(HeapObject value) const {
   if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
     return true;
   }
@@ -4019,7 +4104,7 @@ bool Heap::Contains(HeapObject value) {
           new_lo_space_->Contains(value));
 }
 
-bool Heap::InSpace(HeapObject value, AllocationSpace space) {
+bool Heap::InSpace(HeapObject value, AllocationSpace space) const {
   if (memory_allocator()->IsOutsideAllocatedSpace(value.address())) {
     return false;
   }
@@ -4046,7 +4131,7 @@ bool Heap::InSpace(HeapObject value, AllocationSpace space) {
   UNREACHABLE();
 }
 
-bool Heap::InSpaceSlow(Address addr, AllocationSpace space) {
+bool Heap::InSpaceSlow(Address addr, AllocationSpace space) const {
   if (memory_allocator()->IsOutsideAllocatedSpace(addr)) {
     return false;
   }
@@ -4116,12 +4201,19 @@ void Heap::Verify() {
   CHECK(HasBeenSetUp());
   HandleScope scope(isolate());
 
+  if (FLAG_local_heaps) {
+    // Ensure heap is iterable
+    safepoint()->IterateLocalHeaps([](LocalHeap* local_heap) {
+      local_heap->MakeLinearAllocationAreaIterable();
+    });
+  }
+
   // We have to wait here for the sweeper threads to have an iterable heap.
   mark_compact_collector()->EnsureSweepingCompleted();
   array_buffer_sweeper()->EnsureFinished();
 
   VerifyPointersVisitor visitor(this);
-  IterateRoots(&visitor, VISIT_ONLY_STRONG);
+  IterateRoots(&visitor, {});
 
   if (!isolate()->context().is_null() &&
       !isolate()->normalized_map_cache()->IsUndefined(isolate())) {
@@ -4143,6 +4235,7 @@ void Heap::Verify() {
   lo_space_->Verify(isolate());
   code_lo_space_->Verify(isolate());
   new_lo_space_->Verify(isolate());
+  VerifyStringTable(isolate());
 }
 
 void Heap::VerifyReadOnlyHeap() {
@@ -4191,10 +4284,14 @@ class SlotVerifyingVisitor : public ObjectVisitor {
   void VisitEmbeddedPointer(Code host, RelocInfo* rinfo) override {
     Object target = rinfo->target_object();
     if (ShouldHaveBeenRecorded(host, MaybeObject::FromObject(target))) {
-      CHECK(InTypedSet(FULL_EMBEDDED_OBJECT_SLOT, rinfo->pc()) ||
-            InTypedSet(COMPRESSED_EMBEDDED_OBJECT_SLOT, rinfo->pc()) ||
-            (rinfo->IsInConstantPool() &&
-             InTypedSet(OBJECT_SLOT, rinfo->constant_pool_entry_address())));
+      CHECK(
+          InTypedSet(FULL_EMBEDDED_OBJECT_SLOT, rinfo->pc()) ||
+          InTypedSet(COMPRESSED_EMBEDDED_OBJECT_SLOT, rinfo->pc()) ||
+          (rinfo->IsInConstantPool() &&
+           InTypedSet(COMPRESSED_OBJECT_SLOT,
+                      rinfo->constant_pool_entry_address())) ||
+          (rinfo->IsInConstantPool() &&
+           InTypedSet(FULL_OBJECT_SLOT, rinfo->constant_pool_entry_address())));
     }
   }
 
@@ -4308,6 +4405,13 @@ void Heap::VerifyRememberedSetFor(HeapObject object) {
 
 #ifdef DEBUG
 void Heap::VerifyCountersAfterSweeping() {
+  if (FLAG_local_heaps) {
+    // Ensure heap is iterable
+    safepoint()->IterateLocalHeaps([](LocalHeap* local_heap) {
+      local_heap->MakeLinearAllocationAreaIterable();
+    });
+  }
+
   PagedSpaceIterator spaces(this);
   for (PagedSpace* space = spaces.Next(); space != nullptr;
        space = spaces.Next()) {
@@ -4361,20 +4465,13 @@ void Heap::set_builtin(int index, Code builtin) {
   isolate()->builtins_table()[index] = builtin.ptr();
 }
 
-void Heap::IterateRoots(RootVisitor* v, VisitMode mode) {
-  IterateStrongRoots(v, mode);
-  IterateWeakRoots(v, mode);
-}
-
-void Heap::IterateWeakRoots(RootVisitor* v, VisitMode mode) {
-  const bool isMinorGC = mode == VISIT_ALL_IN_SCAVENGE ||
-                         mode == VISIT_ALL_IN_MINOR_MC_MARK ||
-                         mode == VISIT_ALL_IN_MINOR_MC_UPDATE;
+void Heap::IterateWeakRoots(RootVisitor* v, base::EnumSet<SkipRoot> options) {
+  DCHECK(!options.contains(SkipRoot::kWeak));
   v->VisitRootPointer(Root::kStringTable, nullptr,
                       FullObjectSlot(&roots_table()[RootIndex::kStringTable]));
   v->Synchronize(VisitorSynchronization::kStringTable);
-  if (!isMinorGC && mode != VISIT_ALL_IN_SWEEP_NEWSPACE &&
-      mode != VISIT_FOR_SERIALIZATION) {
+  if (!options.contains(SkipRoot::kExternalStringTable) &&
+      !options.contains(SkipRoot::kUnserializable)) {
     // Scavenge collections have special processing for this.
     // Do not visit for serialization, since the external string table will
     // be populated from scratch upon deserialization.
@@ -4441,10 +4538,7 @@ class FixStaleLeftTrimmedHandlesVisitor : public RootVisitor {
   Heap* heap_;
 };
 
-void Heap::IterateStrongRoots(RootVisitor* v, VisitMode mode) {
-  const bool isMinorGC = mode == VISIT_ALL_IN_SCAVENGE ||
-                         mode == VISIT_ALL_IN_MINOR_MC_MARK ||
-                         mode == VISIT_ALL_IN_MINOR_MC_UPDATE;
+void Heap::IterateRoots(RootVisitor* v, base::EnumSet<SkipRoot> options) {
   v->VisitRootPointers(Root::kStrongRootList, nullptr,
                        roots_table().strong_roots_begin(),
                        roots_table().strong_roots_end());
@@ -4452,11 +4546,6 @@ void Heap::IterateStrongRoots(RootVisitor* v, VisitMode mode) {
 
   isolate_->bootstrapper()->Iterate(v);
   v->Synchronize(VisitorSynchronization::kBootstrapper);
-  if (mode != VISIT_ONLY_STRONG_IGNORE_STACK) {
-    isolate_->Iterate(v);
-    isolate_->global_handles()->IterateStrongStackRoots(v);
-    v->Synchronize(VisitorSynchronization::kTop);
-  }
   Relocatable::Iterate(isolate_, v);
   v->Synchronize(VisitorSynchronization::kRelocatable);
   isolate_->debug()->Iterate(v);
@@ -4465,87 +4554,107 @@ void Heap::IterateStrongRoots(RootVisitor* v, VisitMode mode) {
   isolate_->compilation_cache()->Iterate(v);
   v->Synchronize(VisitorSynchronization::kCompilationCache);
 
-  // Iterate over local handles in handle scopes.
-  FixStaleLeftTrimmedHandlesVisitor left_trim_visitor(this);
-  isolate_->handle_scope_implementer()->Iterate(&left_trim_visitor);
-  isolate_->handle_scope_implementer()->Iterate(v);
-
-  if (FLAG_local_heaps) {
-    safepoint_->Iterate(&left_trim_visitor);
-    safepoint_->Iterate(v);
-  }
-
-  isolate_->IterateDeferredHandles(&left_trim_visitor);
-  isolate_->IterateDeferredHandles(v);
-  v->Synchronize(VisitorSynchronization::kHandleScope);
-
-  // Iterate over the builtin code objects in the heap. Note that it is not
-  // necessary to iterate over code objects on scavenge collections.
-  if (!isMinorGC) {
+  if (!options.contains(SkipRoot::kOldGeneration)) {
     IterateBuiltins(v);
     v->Synchronize(VisitorSynchronization::kBuiltins);
   }
 
-  // Iterate over global handles.
-  switch (mode) {
-    case VISIT_FOR_SERIALIZATION:
-      // Global handles are not iterated by the serializer. Values referenced by
-      // global handles need to be added manually.
-      break;
-    case VISIT_ONLY_STRONG:
-    case VISIT_ONLY_STRONG_IGNORE_STACK:
-      isolate_->global_handles()->IterateStrongRoots(v);
-      break;
-    case VISIT_ALL_IN_SCAVENGE:
-    case VISIT_ALL_IN_MINOR_MC_MARK:
-      isolate_->global_handles()->IterateYoungStrongAndDependentRoots(v);
-      break;
-    case VISIT_ALL_IN_MINOR_MC_UPDATE:
-      isolate_->global_handles()->IterateAllYoungRoots(v);
-      break;
-    case VISIT_ALL_IN_SWEEP_NEWSPACE:
-    case VISIT_ALL:
-      isolate_->global_handles()->IterateAllRoots(v);
-      break;
-  }
-  v->Synchronize(VisitorSynchronization::kGlobalHandles);
+  // Iterate over pointers being held by inactive threads.
+  isolate_->thread_manager()->Iterate(v);
+  v->Synchronize(VisitorSynchronization::kThreadManager);
 
-  // Iterate over eternal handles. Eternal handles are not iterated by the
-  // serializer. Values referenced by eternal handles need to be added manually.
-  if (mode != VISIT_FOR_SERIALIZATION) {
-    if (isMinorGC) {
+  // Visitors in this block only run when not serializing. These include:
+  //
+  // - Thread-local and stack.
+  // - Handles.
+  // - Microtasks.
+  // - The startup object cache.
+  //
+  // When creating real startup snapshot, these areas are expected to be empty.
+  // It is also possible to create a snapshot of a *running* isolate for testing
+  // purposes. In this case, these areas are likely not empty and will simply be
+  // skipped.
+  //
+  // The general guideline for adding visitors to this section vs. adding them
+  // above is that non-transient heap state is always visited, transient heap
+  // state is visited only when not serializing.
+  if (!options.contains(SkipRoot::kUnserializable)) {
+    if (!options.contains(SkipRoot::kGlobalHandles)) {
+      if (options.contains(SkipRoot::kWeak)) {
+        if (options.contains(SkipRoot::kOldGeneration)) {
+          // Skip handles that are either weak or old.
+          isolate_->global_handles()->IterateYoungStrongAndDependentRoots(v);
+        } else {
+          // Skip handles that are weak.
+          isolate_->global_handles()->IterateStrongRoots(v);
+        }
+      } else {
+        // Do not skip weak handles.
+        if (options.contains(SkipRoot::kOldGeneration)) {
+          // Skip handles that are old.
+          isolate_->global_handles()->IterateAllYoungRoots(v);
+        } else {
+          // Do not skip any handles.
+          isolate_->global_handles()->IterateAllRoots(v);
+        }
+      }
+    }
+    v->Synchronize(VisitorSynchronization::kGlobalHandles);
+
+    if (!options.contains(SkipRoot::kStack)) {
+      IterateStackRoots(v);
+      v->Synchronize(VisitorSynchronization::kTop);
+    }
+
+    // Iterate over local handles in handle scopes.
+    FixStaleLeftTrimmedHandlesVisitor left_trim_visitor(this);
+    isolate_->handle_scope_implementer()->Iterate(&left_trim_visitor);
+    isolate_->handle_scope_implementer()->Iterate(v);
+
+    if (FLAG_local_heaps) {
+      safepoint_->Iterate(&left_trim_visitor);
+      safepoint_->Iterate(v);
+      isolate_->persistent_handles_list()->Iterate(&left_trim_visitor);
+      isolate_->persistent_handles_list()->Iterate(v);
+    }
+
+    isolate_->IterateDeferredHandles(&left_trim_visitor);
+    isolate_->IterateDeferredHandles(v);
+    v->Synchronize(VisitorSynchronization::kHandleScope);
+
+    if (options.contains(SkipRoot::kOldGeneration)) {
       isolate_->eternal_handles()->IterateYoungRoots(v);
     } else {
       isolate_->eternal_handles()->IterateAllRoots(v);
     }
-  }
-  v->Synchronize(VisitorSynchronization::kEternalHandles);
+    v->Synchronize(VisitorSynchronization::kEternalHandles);
 
-  // Iterate over pointers being held by inactive threads.
-  isolate_->thread_manager()->Iterate(v);
-  v->Synchronize(VisitorSynchronization::kThreadManager);
+    // Iterate over pending Microtasks stored in MicrotaskQueues.
+    MicrotaskQueue* default_microtask_queue =
+        isolate_->default_microtask_queue();
+    if (default_microtask_queue) {
+      MicrotaskQueue* microtask_queue = default_microtask_queue;
+      do {
+        microtask_queue->IterateMicrotasks(v);
+        microtask_queue = microtask_queue->next();
+      } while (microtask_queue != default_microtask_queue);
+    }
 
-  // Iterate over other strong roots (currently only identity maps).
-  for (StrongRootsList* list = strong_roots_list_; list; list = list->next) {
-    v->VisitRootPointers(Root::kStrongRoots, nullptr, list->start, list->end);
-  }
-  v->Synchronize(VisitorSynchronization::kStrongRoots);
+    // Iterate over other strong roots (currently only identity maps and
+    // deoptimization entries).
+    for (StrongRootsList* list = strong_roots_list_; list; list = list->next) {
+      v->VisitRootPointers(Root::kStrongRoots, nullptr, list->start, list->end);
+    }
+    v->Synchronize(VisitorSynchronization::kStrongRoots);
 
-  // Iterate over pending Microtasks stored in MicrotaskQueues.
-  MicrotaskQueue* default_microtask_queue = isolate_->default_microtask_queue();
-  if (default_microtask_queue) {
-    MicrotaskQueue* microtask_queue = default_microtask_queue;
-    do {
-      microtask_queue->IterateMicrotasks(v);
-      microtask_queue = microtask_queue->next();
-    } while (microtask_queue != default_microtask_queue);
+    // Iterate over the startup object cache unless serializing or
+    // deserializing.
+    SerializerDeserializer::Iterate(isolate_, v);
+    v->Synchronize(VisitorSynchronization::kStartupObjectCache);
   }
 
-  // Iterate over the partial snapshot cache unless serializing or
-  // deserializing.
-  if (mode != VISIT_FOR_SERIALIZATION) {
-    SerializerDeserializer::Iterate(isolate_, v);
-    v->Synchronize(VisitorSynchronization::kPartialSnapshotCache);
+  if (!options.contains(SkipRoot::kWeak)) {
+    IterateWeakRoots(v, options);
   }
 }
 
@@ -4563,6 +4672,11 @@ void Heap::IterateBuiltins(RootVisitor* v) {
   STATIC_ASSERT(Builtins::AllBuiltinsAreIsolateIndependent());
 }
 
+void Heap::IterateStackRoots(RootVisitor* v) {
+  isolate_->Iterate(v);
+  isolate_->global_handles()->IterateStrongStackRoots(v);
+}
+
 namespace {
 size_t GlobalMemorySizeFromV8Size(size_t v8_size) {
   const size_t kGlobalMemoryToV8Ratio = 2;
@@ -4866,10 +4980,13 @@ bool Heap::ShouldOptimizeForLoadTime() {
 // major GC. It happens when the old generation allocation limit is reached and
 // - either we need to optimize for memory usage,
 // - or the incremental marking is not in progress and we cannot start it.
-bool Heap::ShouldExpandOldGenerationOnSlowAllocation() {
+bool Heap::ShouldExpandOldGenerationOnSlowAllocation(LocalHeap* local_heap) {
   if (always_allocate() || OldGenerationSpaceAvailable() > 0) return true;
   // We reached the old generation allocation limit.
 
+  // Ensure that retry of allocation on background thread succeeds
+  if (IsRetryOfFailedAllocation(local_heap)) return true;
+
   if (ShouldOptimizeForMemoryUsage()) return false;
 
   if (ShouldOptimizeForLoadTime()) return true;
@@ -4886,6 +5003,11 @@ bool Heap::ShouldExpandOldGenerationOnSlowAllocation() {
   return true;
 }
 
+bool Heap::IsRetryOfFailedAllocation(LocalHeap* local_heap) {
+  if (!local_heap) return false;
+  return local_heap->allocation_failed_;
+}
+
 Heap::HeapGrowingMode Heap::CurrentHeapGrowingMode() {
   if (ShouldReduceMemory() || FLAG_stress_compaction) {
     return Heap::HeapGrowingMode::kMinimal;
@@ -4910,6 +5032,22 @@ size_t Heap::GlobalMemoryAvailable() {
              : new_space_->Capacity() + 1;
 }
 
+double Heap::PercentToOldGenerationLimit() {
+  double size_at_gc = old_generation_size_at_last_gc_;
+  double size_now = OldGenerationObjectsAndPromotedExternalMemorySize();
+  double current_bytes = size_now - size_at_gc;
+  double total_bytes = old_generation_allocation_limit_ - size_at_gc;
+  return total_bytes > 0 ? (current_bytes / total_bytes) * 100.0 : 0;
+}
+
+double Heap::PercentToGlobalMemoryLimit() {
+  double size_at_gc = old_generation_size_at_last_gc_;
+  double size_now = OldGenerationObjectsAndPromotedExternalMemorySize();
+  double current_bytes = size_now - size_at_gc;
+  double total_bytes = old_generation_allocation_limit_ - size_at_gc;
+  return total_bytes > 0 ? (current_bytes / total_bytes) * 100.0 : 0;
+}
+
 // This function returns either kNoLimit, kSoftLimit, or kHardLimit.
 // The kNoLimit means that either incremental marking is disabled or it is too
 // early to start incremental marking.
@@ -4937,37 +5075,42 @@ Heap::IncrementalMarkingLimit Heap::IncrementalMarkingLimitReached() {
   }
 
   if (FLAG_stress_marking > 0) {
-    double gained_since_last_gc =
-        PromotedSinceLastGC() +
-        (isolate()->isolate_data()->external_memory_ -
-         isolate()->isolate_data()->external_memory_low_since_mark_compact_);
-    double size_before_gc =
-        OldGenerationObjectsAndPromotedExternalMemorySize() -
-        gained_since_last_gc;
-    double bytes_to_limit = old_generation_allocation_limit_ - size_before_gc;
-    if (bytes_to_limit > 0) {
-      double current_percent = (gained_since_last_gc / bytes_to_limit) * 100.0;
-
+    int current_percent = static_cast<int>(
+        std::max(PercentToOldGenerationLimit(), PercentToGlobalMemoryLimit()));
+    if (current_percent > 0) {
       if (FLAG_trace_stress_marking) {
         isolate()->PrintWithTimestamp(
-            "[IncrementalMarking] %.2lf%% of the memory limit reached\n",
+            "[IncrementalMarking] %d%% of the memory limit reached\n",
             current_percent);
       }
-
       if (FLAG_fuzzer_gc_analysis) {
         // Skips values >=100% since they already trigger marking.
-        if (current_percent < 100.0) {
+        if (current_percent < 100) {
           max_marking_limit_reached_ =
-              std::max(max_marking_limit_reached_, current_percent);
+              std::max<double>(max_marking_limit_reached_, current_percent);
         }
-      } else if (static_cast<int>(current_percent) >=
-                 stress_marking_percentage_) {
+      } else if (current_percent >= stress_marking_percentage_) {
         stress_marking_percentage_ = NextStressMarkingLimit();
         return IncrementalMarkingLimit::kHardLimit;
       }
     }
   }
 
+  if (FLAG_incremental_marking_soft_trigger > 0 ||
+      FLAG_incremental_marking_hard_trigger > 0) {
+    int current_percent = static_cast<int>(
+        std::max(PercentToOldGenerationLimit(), PercentToGlobalMemoryLimit()));
+    if (current_percent > FLAG_incremental_marking_hard_trigger &&
+        FLAG_incremental_marking_hard_trigger > 0) {
+      return IncrementalMarkingLimit::kHardLimit;
+    }
+    if (current_percent > FLAG_incremental_marking_soft_trigger &&
+        FLAG_incremental_marking_soft_trigger > 0) {
+      return IncrementalMarkingLimit::kSoftLimit;
+    }
+    return IncrementalMarkingLimit::kNoLimit;
+  }
+
   size_t old_generation_space_available = OldGenerationSpaceAvailable();
   const size_t global_memory_available = GlobalMemoryAvailable();
 
@@ -5173,6 +5316,12 @@ void Heap::SetUpFromReadOnlyHeap(ReadOnlyHeap* ro_heap) {
   space_[RO_SPACE] = read_only_space_ = ro_heap->read_only_space();
 }
 
+void Heap::ReplaceReadOnlySpace(SharedReadOnlySpace* space) {
+  CHECK(V8_SHARED_RO_HEAP_BOOL);
+  delete read_only_space_;
+  space_[RO_SPACE] = read_only_space_ = space;
+}
+
 void Heap::SetUpSpaces() {
   // Ensure SetUpFromReadOnlySpace has been ran.
   DCHECK_NOT_NULL(read_only_space_);
@@ -5309,7 +5458,15 @@ void Heap::NotifyBootstrapComplete() {
   }
 }
 
-void Heap::NotifyOldGenerationExpansion() {
+void Heap::NotifyOldGenerationExpansion(AllocationSpace space,
+                                        MemoryChunk* chunk) {
+  // Pages created during bootstrapping may contain immortal immovable objects.
+  if (!deserialization_complete()) {
+    chunk->MarkNeverEvacuate();
+  }
+  if (space == CODE_SPACE || space == CODE_LO_SPACE) {
+    isolate()->AddCodeMemoryChunk(chunk);
+  }
   const size_t kMemoryReducerActivationThreshold = 1 * MB;
   if (old_generation_capacity_after_bootstrap_ && ms_count_ == 0 &&
       OldGenerationCapacity() >= old_generation_capacity_after_bootstrap_ +
@@ -5322,20 +5479,6 @@ void Heap::NotifyOldGenerationExpansion() {
   }
 }
 
-void Heap::NotifyOffThreadSpaceMerged() {
-  // TODO(leszeks): Ideally we would do this check during off-thread page
-  // allocation too, to proactively do GC. We should also probably do this check
-  // before merging rather than after.
-  if (!CanExpandOldGeneration(0)) {
-    // TODO(leszeks): We should try to invoke the near-heap limit callback and
-    // do a last-resort GC first.
-    FatalProcessOutOfMemory("Failed to merge off-thread pages into heap.");
-  }
-  StartIncrementalMarkingIfAllocationLimitIsReached(
-      GCFlagsForIncrementalMarking(), kGCCallbackScheduleIdleGarbageCollection);
-  NotifyOldGenerationExpansion();
-}
-
 void Heap::SetEmbedderHeapTracer(EmbedderHeapTracer* tracer) {
   DCHECK_EQ(gc_state_, HeapState::NOT_IN_GC);
   local_embedder_heap_tracer()->SetRemoteTracer(tracer);
@@ -5346,8 +5489,11 @@ EmbedderHeapTracer* Heap::GetEmbedderHeapTracer() const {
 }
 
 EmbedderHeapTracer::TraceFlags Heap::flags_for_embedder_tracer() const {
-  if (ShouldReduceMemory())
+  if (is_current_gc_forced()) {
+    return EmbedderHeapTracer::TraceFlags::kForced;
+  } else if (ShouldReduceMemory()) {
     return EmbedderHeapTracer::TraceFlags::kReduceMemory;
+  }
   return EmbedderHeapTracer::TraceFlags::kNoFlags;
 }
 
@@ -5376,6 +5522,7 @@ void Heap::StartTearDown() {
   // a good time to run heap verification (if requested), before starting to
   // tear down parts of the Isolate.
   if (FLAG_verify_heap) {
+    SafepointScope scope(this);
     Verify();
   }
 #endif
@@ -5590,11 +5737,11 @@ void Heap::CompactWeakArrayLists(AllocationType allocation) {
   set_script_list(*scripts);
 }
 
-void Heap::AddRetainedMap(Handle<Map> map) {
+void Heap::AddRetainedMap(Handle<NativeContext> context, Handle<Map> map) {
   if (map->is_in_retained_map_list()) {
     return;
   }
-  Handle<WeakArrayList> array(retained_maps(), isolate());
+  Handle<WeakArrayList> array(context->retained_maps(), isolate());
   if (array->IsFull()) {
     CompactRetainedMaps(*array);
   }
@@ -5603,17 +5750,15 @@ void Heap::AddRetainedMap(Handle<Map> map) {
   array = WeakArrayList::AddToEnd(
       isolate(), array,
       MaybeObjectHandle(Smi::FromInt(FLAG_retain_maps_for_n_gc), isolate()));
-  if (*array != retained_maps()) {
-    set_retained_maps(*array);
+  if (*array != context->retained_maps()) {
+    context->set_retained_maps(*array);
   }
   map->set_is_in_retained_map_list(true);
 }
 
 void Heap::CompactRetainedMaps(WeakArrayList retained_maps) {
-  DCHECK_EQ(retained_maps, this->retained_maps());
   int length = retained_maps.length();
   int new_length = 0;
-  int new_number_of_disposed_maps = 0;
   // This loop compacts the array by removing cleared weak cells.
   for (int i = 0; i < length; i += 2) {
     MaybeObject maybe_object = retained_maps.Get(i);
@@ -5629,12 +5774,8 @@ void Heap::CompactRetainedMaps(WeakArrayList retained_maps) {
       retained_maps.Set(new_length, maybe_object);
       retained_maps.Set(new_length + 1, age);
     }
-    if (i < number_of_disposed_maps_) {
-      new_number_of_disposed_maps += 2;
-    }
     new_length += 2;
   }
-  number_of_disposed_maps_ = new_number_of_disposed_maps;
   HeapObject undefined = ReadOnlyRoots(this).undefined_value();
   for (int i = new_length; i < length; i++) {
     retained_maps.Set(i, HeapObjectReference::Strong(undefined));
@@ -5722,6 +5863,15 @@ void Heap::VerifyClearedSlot(HeapObject object, ObjectSlot slot) {
                 page->RegisteredObjectWithInvalidatedSlots<OLD_TO_OLD>(object));
 #endif
 }
+
+void Heap::VerifySlotRangeHasNoRecordedSlots(Address start, Address end) {
+#ifndef V8_DISABLE_WRITE_BARRIERS
+  Page* page = Page::FromAddress(start);
+  DCHECK(!page->IsLargePage());
+  DCHECK(!page->InYoungGeneration());
+  RememberedSet<OLD_TO_NEW>::CheckNoneInRange(page, start, end);
+#endif
+}
 #endif
 
 void Heap::ClearRecordedSlotRange(Address start, Address end) {
@@ -5875,7 +6025,7 @@ class UnreachableObjectsFilter : public HeapObjectsFilter {
 
   void MarkReachableObjects() {
     MarkingVisitor visitor(this);
-    heap_->IterateRoots(&visitor, VISIT_ALL);
+    heap_->IterateRoots(&visitor, {});
     visitor.TransitiveClosure();
   }
 
@@ -6071,13 +6221,16 @@ void Heap::SetBuiltinsConstantsTable(FixedArray cache) {
   set_builtins_constants_table(cache);
 }
 
+void Heap::SetDetachedContexts(WeakArrayList detached_contexts) {
+  set_detached_contexts(detached_contexts);
+}
+
 void Heap::SetInterpreterEntryTrampolineForProfiling(Code code) {
   DCHECK_EQ(Builtins::kInterpreterEntryTrampoline, code.builtin_index());
   set_interpreter_entry_trampoline_for_profiling(code);
 }
 
 void Heap::PostFinalizationRegistryCleanupTaskIfNeeded() {
-  DCHECK(!isolate()->host_cleanup_finalization_group_callback());
   // Only one cleanup task is posted at a time.
   if (!HasDirtyJSFinalizationRegistries() ||
       is_finalization_registry_cleanup_task_posted_) {
@@ -6109,10 +6262,9 @@ void Heap::EnqueueDirtyJSFinalizationRegistry(
     JSFinalizationRegistry tail = JSFinalizationRegistry::cast(
         dirty_js_finalization_registries_list_tail());
     tail.set_next_dirty(finalization_registry);
-    gc_notify_updated_slot(tail,
-                           finalization_registry.RawField(
-                               JSFinalizationRegistry::kNextDirtyOffset),
-                           finalization_registry);
+    gc_notify_updated_slot(
+        tail, tail.RawField(JSFinalizationRegistry::kNextDirtyOffset),
+        finalization_registry);
   }
   set_dirty_js_finalization_registries_list_tail(finalization_registry);
   // dirty_js_finalization_registries_list_tail_ is rescanned by
@@ -6138,7 +6290,6 @@ MaybeHandle<JSFinalizationRegistry> Heap::DequeueDirtyJSFinalizationRegistry() {
 
 void Heap::RemoveDirtyFinalizationRegistriesOnContext(NativeContext context) {
   if (!FLAG_harmony_weak_refs) return;
-  if (isolate()->host_cleanup_finalization_group_callback()) return;
 
   DisallowHeapAllocation no_gc;
 
@@ -6252,6 +6403,17 @@ std::vector<Handle<NativeContext>> Heap::FindAllNativeContexts() {
   return result;
 }
 
+std::vector<WeakArrayList> Heap::FindAllRetainedMaps() {
+  std::vector<WeakArrayList> result;
+  Object context = native_contexts_list();
+  while (!context.IsUndefined(isolate())) {
+    NativeContext native_context = NativeContext::cast(context);
+    result.push_back(native_context.retained_maps());
+    context = native_context.next_context_link();
+  }
+  return result;
+}
+
 size_t Heap::NumberOfDetachedContexts() {
   // The detached_contexts() array has two entries per detached context.
   return detached_contexts().length() / 2;
@@ -6609,12 +6771,11 @@ void Heap::GenerationalBarrierForCodeSlow(Code host, RelocInfo* rinfo,
     addr = rinfo->constant_pool_entry_address();
     if (RelocInfo::IsCodeTargetMode(rmode)) {
       slot_type = CODE_ENTRY_SLOT;
+    } else if (RelocInfo::IsCompressedEmbeddedObject(rmode)) {
+      slot_type = COMPRESSED_OBJECT_SLOT;
     } else {
-      // Constant pools don't currently support compressed objects, as
-      // their values are all pointer sized (though this could change
-      // therefore we have a DCHECK).
       DCHECK(RelocInfo::IsFullEmbeddedObject(rmode));
-      slot_type = OBJECT_SLOT;
+      slot_type = FULL_OBJECT_SLOT;
     }
   }
   uintptr_t offset = addr - source_page->address();
diff --git a/deps/v8/src/heap/heap.h b/deps/v8/src/heap/heap.h
index 6d6eddf61ab..7a540e9612a 100644
--- a/deps/v8/src/heap/heap.h
+++ b/deps/v8/src/heap/heap.h
@@ -17,6 +17,8 @@
 #include "include/v8-internal.h"
 #include "include/v8.h"
 #include "src/base/atomic-utils.h"
+#include "src/base/enum-set.h"
+#include "src/base/platform/condition-variable.h"
 #include "src/builtins/accessors.h"
 #include "src/common/assert-scope.h"
 #include "src/common/globals.h"
@@ -66,6 +68,7 @@ class ConcurrentMarking;
 class GCIdleTimeHandler;
 class GCIdleTimeHeapState;
 class GCTracer;
+class GlobalSafepoint;
 class HeapObjectAllocationTracker;
 class HeapObjectsFilter;
 class HeapStats;
@@ -74,19 +77,21 @@ class JSFinalizationRegistry;
 class LocalEmbedderHeapTracer;
 class LocalHeap;
 class MemoryAllocator;
+class MemoryChunk;
 class MemoryMeasurement;
 class MemoryReducer;
 class MinorMarkCompactCollector;
 class ObjectIterator;
 class ObjectStats;
+class OffThreadHeap;
 class Page;
 class PagedSpace;
 class ReadOnlyHeap;
 class RootVisitor;
-class Safepoint;
 class ScavengeJob;
 class Scavenger;
 class ScavengerCollector;
+class SharedReadOnlySpace;
 class Space;
 class StressScavengeObserver;
 class TimedHistogram;
@@ -160,6 +165,15 @@ enum class YoungGenerationHandling {
 
 enum class GCIdleTimeAction : uint8_t;
 
+enum class SkipRoot {
+  kExternalStringTable,
+  kGlobalHandles,
+  kOldGeneration,
+  kStack,
+  kUnserializable,
+  kWeak
+};
+
 class AllocationResult {
  public:
   static inline AllocationResult Retry(AllocationSpace space = NEW_SPACE) {
@@ -252,7 +266,7 @@ class Heap {
   // object references.
   base::Mutex* relocation_mutex() { return &relocation_mutex_; }
 
-  // Support for partial snapshots.  After calling this we have a linear
+  // Support for context snapshots.  After calling this we have a linear
   // space to write objects in each space.
   struct Chunk {
     uint32_t size;
@@ -298,6 +312,9 @@ class Heap {
 
   static const int kNoGCFlags = 0;
   static const int kReduceMemoryFootprintMask = 1;
+  // GCs that are forced, either through testing configurations (requring
+  // --expose-gc) or through DevTools (using LowMemoryNotificaton).
+  static const int kForcedGC = 2;
 
   // The minimum size of a HeapObject on the heap.
   static const int kMinObjectSizeInTaggedWords = 2;
@@ -432,10 +449,7 @@ class Heap {
 
   void NotifyBootstrapComplete();
 
-  void NotifyOldGenerationExpansion();
-
-  // Notifies the heap that an off-thread space has been merged into it.
-  void NotifyOffThreadSpaceMerged();
+  void NotifyOldGenerationExpansion(AllocationSpace space, MemoryChunk* chunk);
 
   inline Address* NewSpaceAllocationTopAddress();
   inline Address* NewSpaceAllocationLimitAddress();
@@ -456,13 +470,9 @@ class Heap {
   // Initialize a filler object to keep the ability to iterate over the heap
   // when introducing gaps within pages. If slots could have been recorded in
   // the freed area, then pass ClearRecordedSlots::kYes as the mode. Otherwise,
-  // pass ClearRecordedSlots::kNo. If the memory after the object header of
-  // the filler should be cleared, pass in kClearFreedMemory. The default is
-  // kDontClearFreedMemory.
+  // pass ClearRecordedSlots::kNo. Clears memory if clearing slots.
   V8_EXPORT_PRIVATE HeapObject CreateFillerObjectAt(
-      Address addr, int size, ClearRecordedSlots clear_slots_mode,
-      ClearFreedMemoryMode clear_memory_mode =
-          ClearFreedMemoryMode::kDontClearFreedMemory);
+      Address addr, int size, ClearRecordedSlots clear_slots_mode);
 
   template <typename T>
   void CreateFillerForArray(T object, int elements_to_trim, int bytes_to_trim);
@@ -596,6 +606,8 @@ class Heap {
   // Returns false if not able to reserve.
   bool ReserveSpace(Reservation* reservations, std::vector<Address>* maps);
 
+  void RequestAndWaitForCollection();
+
   //
   // Support for the API.
   //
@@ -620,7 +632,7 @@ class Heap {
   void AppendArrayBufferExtension(JSArrayBuffer object,
                                   ArrayBufferExtension* extension);
 
-  Safepoint* safepoint() { return safepoint_.get(); }
+  GlobalSafepoint* safepoint() { return safepoint_.get(); }
 
   V8_EXPORT_PRIVATE double MonotonicallyIncreasingTimeInMs();
 
@@ -651,6 +663,8 @@ class Heap {
   void SetSerializedObjects(FixedArray objects);
   void SetSerializedGlobalProxySizes(FixedArray sizes);
 
+  void SetBasicBlockProfilingData(Handle<ArrayList> list);
+
   // For post mortem debugging.
   void RememberUnmappedPage(Address page, bool compacted);
 
@@ -668,7 +682,8 @@ class Heap {
 
   void CompactWeakArrayLists(AllocationType allocation);
 
-  V8_EXPORT_PRIVATE void AddRetainedMap(Handle<Map> map);
+  V8_EXPORT_PRIVATE void AddRetainedMap(Handle<NativeContext> context,
+                                        Handle<Map> map);
 
   // This event is triggered after successful allocation of a new object made
   // by runtime. Allocations of target space for object evacuation do not
@@ -714,6 +729,8 @@ class Heap {
   // Sets read-only heap and space.
   void SetUpFromReadOnlyHeap(ReadOnlyHeap* ro_heap);
 
+  void ReplaceReadOnlySpace(SharedReadOnlySpace* shared_ro_space);
+
   // Sets up the heap memory without creating any objects.
   void SetUpSpaces();
 
@@ -734,7 +751,7 @@ class Heap {
   void TearDown();
 
   // Returns whether SetUp has been called.
-  bool HasBeenSetUp();
+  bool HasBeenSetUp() const;
 
   // ===========================================================================
   // Getters for spaces. =======================================================
@@ -764,6 +781,9 @@ class Heap {
   GCTracer* tracer() { return tracer_.get(); }
 
   MemoryAllocator* memory_allocator() { return memory_allocator_.get(); }
+  const MemoryAllocator* memory_allocator() const {
+    return memory_allocator_.get();
+  }
 
   inline Isolate* isolate();
 
@@ -808,6 +828,7 @@ class Heap {
   void UnregisterStrongRoots(FullObjectSlot start);
 
   void SetBuiltinsConstantsTable(FixedArray cache);
+  void SetDetachedContexts(WeakArrayList detached_contexts);
 
   // A full copy of the interpreter entry trampoline, used as a template to
   // create copies of the builtin at runtime. The copies are used to create
@@ -916,18 +937,15 @@ class Heap {
   // (de)serialization or heap verification.
 
   // Iterates over the strong roots and the weak roots.
-  void IterateRoots(RootVisitor* v, VisitMode mode);
-  // Iterates over the strong roots.
-  void IterateStrongRoots(RootVisitor* v, VisitMode mode);
+  void IterateRoots(RootVisitor* v, base::EnumSet<SkipRoot> options);
   // Iterates over entries in the smi roots list.  Only interesting to the
   // serializer/deserializer, since GC does not care about smis.
   void IterateSmiRoots(RootVisitor* v);
   // Iterates over weak string tables.
-  void IterateWeakRoots(RootVisitor* v, VisitMode mode);
-  // Iterates over weak global handles.
+  void IterateWeakRoots(RootVisitor* v, base::EnumSet<SkipRoot> options);
   void IterateWeakGlobalHandles(RootVisitor* v);
-  // Iterates over builtins.
   void IterateBuiltins(RootVisitor* v);
+  void IterateStackRoots(RootVisitor* v);
 
   // ===========================================================================
   // Store buffer API. =========================================================
@@ -950,6 +968,7 @@ class Heap {
 
 #ifdef DEBUG
   void VerifyClearedSlot(HeapObject object, ObjectSlot slot);
+  void VerifySlotRangeHasNoRecordedSlots(Address start, Address end);
 #endif
 
   // ===========================================================================
@@ -976,6 +995,7 @@ class Heap {
   void StartIncrementalMarkingIfAllocationLimitIsReached(
       int gc_flags,
       GCCallbackFlags gc_callback_flags = GCCallbackFlags::kNoGCCallbackFlags);
+  void StartIncrementalMarkingIfAllocationLimitIsReachedBackground();
 
   void FinalizeIncrementalMarkingIfComplete(GarbageCollectionReason gc_reason);
   // Synchronously finalizes incremental marking.
@@ -1092,15 +1112,15 @@ class Heap {
   // Checks whether an address/object is in the non-read-only heap (including
   // auxiliary area and unused area). Use IsValidHeapObject if checking both
   // heaps is required.
-  V8_EXPORT_PRIVATE bool Contains(HeapObject value);
+  V8_EXPORT_PRIVATE bool Contains(HeapObject value) const;
 
   // Checks whether an address/object in a space.
   // Currently used by tests, serialization and heap verification only.
-  V8_EXPORT_PRIVATE bool InSpace(HeapObject value, AllocationSpace space);
+  V8_EXPORT_PRIVATE bool InSpace(HeapObject value, AllocationSpace space) const;
 
   // Slow methods that can be used for verification as they can also be used
   // with off-heap Addresses.
-  V8_EXPORT_PRIVATE bool InSpaceSlow(Address addr, AllocationSpace space);
+  V8_EXPORT_PRIVATE bool InSpaceSlow(Address addr, AllocationSpace space) const;
 
   static inline Heap* FromWritableHeapObject(HeapObject obj);
 
@@ -1323,15 +1343,15 @@ class Heap {
   // ===========================================================================
 
   // Creates a filler object and returns a heap object immediately after it.
-  V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT HeapObject
-  PrecedeWithFiller(HeapObject object, int filler_size);
+  V8_EXPORT_PRIVATE static V8_WARN_UNUSED_RESULT HeapObject
+  PrecedeWithFiller(ReadOnlyRoots roots, HeapObject object, int filler_size);
 
   // Creates a filler object if needed for alignment and returns a heap object
   // immediately after it. If any space is left after the returned object,
   // another filler object is created so the over allocated memory is iterable.
-  V8_WARN_UNUSED_RESULT HeapObject
-  AlignWithFiller(HeapObject object, int object_size, int allocation_size,
-                  AllocationAlignment alignment);
+  static V8_WARN_UNUSED_RESULT HeapObject
+  AlignWithFiller(ReadOnlyRoots roots, HeapObject object, int object_size,
+                  int allocation_size, AllocationAlignment alignment);
 
   // Allocate an external backing store with the given allocation callback.
   // If the callback fails (indicated by a nullptr result) then this function
@@ -1520,6 +1540,19 @@ class Heap {
     DISALLOW_COPY_AND_ASSIGN(ExternalStringTable);
   };
 
+  class CollectionBarrier {
+    Heap* heap_;
+    base::Mutex mutex_;
+    base::ConditionVariable cond_;
+    bool requested_;
+
+   public:
+    explicit CollectionBarrier(Heap* heap) : heap_(heap), requested_(false) {}
+
+    void Increment();
+    void Wait();
+  };
+
   struct StrongRootsList;
 
   struct StringTypeTable {
@@ -1607,10 +1640,9 @@ class Heap {
   // over all objects.  May cause a GC.
   void MakeHeapIterable();
 
-  // Performs garbage collection
-  // Returns whether there is a chance another major GC could
-  // collect more garbage.
-  bool PerformGarbageCollection(
+  // Performs garbage collection in a safepoint.
+  // Returns the number of freed global handles.
+  size_t PerformGarbageCollection(
       GarbageCollector collector,
       const GCCallbackFlags gc_callback_flags = kNoGCCallbackFlags);
 
@@ -1633,6 +1665,15 @@ class Heap {
   V8_EXPORT_PRIVATE void ZapCodeObject(Address start_address,
                                        int size_in_bytes);
 
+  // Initialize a filler object to keep the ability to iterate over the heap
+  // when introducing gaps within pages. If the memory after the object header
+  // of the filler should be cleared, pass in kClearFreedMemory. The default is
+  // kDontClearFreedMemory.
+  V8_EXPORT_PRIVATE static HeapObject CreateFillerObjectAt(
+      ReadOnlyRoots roots, Address addr, int size,
+      ClearFreedMemoryMode clear_memory_mode =
+          ClearFreedMemoryMode::kDontClearFreedMemory);
+
   // Range write barrier implementation.
   template <int kModeMask, typename TSlot>
   V8_INLINE void WriteBarrierForRangeImpl(MemoryChunk* source_page,
@@ -1704,6 +1745,9 @@ class Heap {
   void FinalizeIncrementalMarkingIncrementally(
       GarbageCollectionReason gc_reason);
 
+  void InvokeIncrementalMarkingPrologueCallbacks();
+  void InvokeIncrementalMarkingEpilogueCallbacks();
+
   // Returns the timer used for a given GC type.
   // - GCScavenger: young generation GC
   // - GCCompactor: full GC
@@ -1733,6 +1777,7 @@ class Heap {
   // reporting/verification activities when compiled with DEBUG set.
   void GarbageCollectionPrologue();
   void GarbageCollectionEpilogue();
+  void GarbageCollectionEpilogueInSafepoint();
 
   // Performs a major collection in the whole heap.
   void MarkCompact();
@@ -1811,11 +1856,16 @@ class Heap {
   bool always_allocate() { return always_allocate_scope_count_ != 0; }
 
   V8_EXPORT_PRIVATE bool CanExpandOldGeneration(size_t size);
+  V8_EXPORT_PRIVATE bool CanExpandOldGenerationBackground(size_t size);
 
-  bool ShouldExpandOldGenerationOnSlowAllocation();
+  bool ShouldExpandOldGenerationOnSlowAllocation(
+      LocalHeap* local_heap = nullptr);
+  bool IsRetryOfFailedAllocation(LocalHeap* local_heap);
 
   HeapGrowingMode CurrentHeapGrowingMode();
 
+  double PercentToOldGenerationLimit();
+  double PercentToGlobalMemoryLimit();
   enum class IncrementalMarkingLimit { kNoLimit, kSoftLimit, kHardLimit };
   IncrementalMarkingLimit IncrementalMarkingLimitReached();
 
@@ -1922,6 +1972,7 @@ class Heap {
 #endif  // DEBUG
 
   std::vector<Handle<NativeContext>> FindAllNativeContexts();
+  std::vector<WeakArrayList> FindAllRetainedMaps();
   MemoryMeasurement* memory_measurement() { return memory_measurement_.get(); }
 
   // The amount of memory that has been freed concurrently.
@@ -1978,11 +2029,6 @@ class Heap {
   // For keeping track of context disposals.
   int contexts_disposed_ = 0;
 
-  // The length of the retained_maps array at the time of context disposal.
-  // This separates maps in the retained_maps array that were created before
-  // and after context disposal.
-  int number_of_disposed_maps_ = 0;
-
   NewSpace* new_space_ = nullptr;
   OldSpace* old_space_ = nullptr;
   CodeSpace* code_space_ = nullptr;
@@ -2136,6 +2182,9 @@ class Heap {
   // The size of objects in old generation after the last MarkCompact GC.
   size_t old_generation_size_at_last_gc_ = 0;
 
+  // The size of global memory after the last MarkCompact GC.
+  size_t global_memory_at_last_gc_ = 0;
+
   // The feedback storage is used to store allocation sites (keys) and how often
   // they have been visited (values) by finding a memento behind an object. The
   // storage is only alive temporary during a GC. The invariant is that all
@@ -2166,7 +2215,7 @@ class Heap {
   GCCallbackFlags current_gc_callback_flags_ =
       GCCallbackFlags::kNoGCCallbackFlags;
 
-  std::unique_ptr<Safepoint> safepoint_;
+  std::unique_ptr<GlobalSafepoint> safepoint_;
 
   bool is_current_gc_forced_ = false;
 
@@ -2174,6 +2223,8 @@ class Heap {
 
   base::Mutex relocation_mutex_;
 
+  CollectionBarrier collection_barrier_;
+
   int gc_callbacks_depth_ = 0;
 
   bool deserialization_complete_ = false;
@@ -2223,6 +2274,8 @@ class Heap {
   friend class ScavengeTaskObserver;
   friend class IncrementalMarking;
   friend class IncrementalMarkingJob;
+  friend class OffThreadHeap;
+  friend class OffThreadSpace;
   friend class OldLargeObjectSpace;
   template <typename ConcreteVisitor, typename MarkingState>
   friend class MarkingVisitorBase;
@@ -2243,6 +2296,7 @@ class Heap {
 
   // The allocator interface.
   friend class Factory;
+  friend class OffThreadFactory;
 
   // The Isolate constructs us.
   friend class Isolate;
diff --git a/deps/v8/src/heap/incremental-marking-job.cc b/deps/v8/src/heap/incremental-marking-job.cc
index 63e47ca313f..e1979a2aeaa 100644
--- a/deps/v8/src/heap/incremental-marking-job.cc
+++ b/deps/v8/src/heap/incremental-marking-job.cc
@@ -4,6 +4,7 @@
 
 #include "src/heap/incremental-marking-job.h"
 
+#include "src/base/platform/mutex.h"
 #include "src/base/platform/time.h"
 #include "src/execution/isolate.h"
 #include "src/execution/vm-state-inl.h"
@@ -47,15 +48,18 @@ void IncrementalMarkingJob::Start(Heap* heap) {
 }
 
 void IncrementalMarkingJob::ScheduleTask(Heap* heap, TaskType task_type) {
-  if (!IsTaskPending(task_type) && !heap->IsTearingDown()) {
+  base::MutexGuard guard(&mutex_);
+
+  if (!IsTaskPending(task_type) && !heap->IsTearingDown() &&
+      FLAG_incremental_marking_task) {
     v8::Isolate* isolate = reinterpret_cast<v8::Isolate*>(heap->isolate());
     SetTaskPending(task_type, true);
     auto taskrunner =
         V8::GetCurrentPlatform()->GetForegroundTaskRunner(isolate);
     const EmbedderHeapTracer::EmbedderStackState stack_state =
         taskrunner->NonNestableTasksEnabled()
-            ? EmbedderHeapTracer::EmbedderStackState::kEmpty
-            : EmbedderHeapTracer::EmbedderStackState::kUnknown;
+            ? EmbedderHeapTracer::EmbedderStackState::kNoHeapPointers
+            : EmbedderHeapTracer::EmbedderStackState::kMayContainHeapPointers;
     auto task =
         std::make_unique<Task>(heap->isolate(), this, stack_state, task_type);
     if (task_type == TaskType::kNormal) {
@@ -111,8 +115,11 @@ void IncrementalMarkingJob::Task::RunInternal() {
   }
 
   // Clear this flag after StartIncrementalMarking call to avoid
-  // scheduling a new task when startining incremental marking.
-  job_->SetTaskPending(task_type_, false);
+  // scheduling a new task when starting incremental marking.
+  {
+    base::MutexGuard guard(&job_->mutex_);
+    job_->SetTaskPending(task_type_, false);
+  }
 
   if (!incremental_marking->IsStopped()) {
     StepResult step_result = Step(heap);
diff --git a/deps/v8/src/heap/incremental-marking-job.h b/deps/v8/src/heap/incremental-marking-job.h
index ed133e88e5b..63c700be4f0 100644
--- a/deps/v8/src/heap/incremental-marking-job.h
+++ b/deps/v8/src/heap/incremental-marking-job.h
@@ -28,15 +28,15 @@ class IncrementalMarkingJob final {
 
   double CurrentTimeToTask(Heap* heap) const;
 
+ private:
+  class Task;
+  static constexpr double kDelayInSeconds = 10.0 / 1000.0;
+
   bool IsTaskPending(TaskType task_type) const {
     return task_type == TaskType::kNormal ? normal_task_pending_
                                           : delayed_task_pending_;
   }
 
- private:
-  class Task;
-  static constexpr double kDelayInSeconds = 10.0 / 1000.0;
-
   void SetTaskPending(TaskType task_type, bool value) {
     if (task_type == TaskType::kNormal) {
       normal_task_pending_ = value;
@@ -45,6 +45,7 @@ class IncrementalMarkingJob final {
     }
   }
 
+  base::Mutex mutex_;
   double scheduled_time_ = 0.0;
   bool normal_task_pending_ = false;
   bool delayed_task_pending_ = false;
diff --git a/deps/v8/src/heap/incremental-marking.cc b/deps/v8/src/heap/incremental-marking.cc
index 76fdbc80c83..cb1eff27b27 100644
--- a/deps/v8/src/heap/incremental-marking.cc
+++ b/deps/v8/src/heap/incremental-marking.cc
@@ -16,9 +16,11 @@
 #include "src/heap/mark-compact-inl.h"
 #include "src/heap/marking-visitor-inl.h"
 #include "src/heap/marking-visitor.h"
+#include "src/heap/memory-chunk.h"
 #include "src/heap/object-stats.h"
 #include "src/heap/objects-visiting-inl.h"
 #include "src/heap/objects-visiting.h"
+#include "src/heap/safepoint.h"
 #include "src/heap/sweeper.h"
 #include "src/init/v8.h"
 #include "src/numbers/conversions.h"
@@ -91,6 +93,13 @@ void IncrementalMarking::MarkBlackAndVisitObjectDueToLayoutChange(
   collector_->VisitObject(obj);
 }
 
+void IncrementalMarking::MarkBlackBackground(HeapObject obj, int object_size) {
+  MarkBit mark_bit = atomic_marking_state()->MarkBitFrom(obj);
+  Marking::MarkBlack<AccessMode::ATOMIC>(mark_bit);
+  MemoryChunk* chunk = MemoryChunk::FromHeapObject(obj);
+  IncrementLiveBytesBackground(chunk, static_cast<intptr_t>(object_size));
+}
+
 void IncrementalMarking::NotifyLeftTrimming(HeapObject from, HeapObject to) {
   DCHECK(IsMarking());
   DCHECK(MemoryChunk::FromHeapObject(from)->SweepingDone());
@@ -321,6 +330,9 @@ void IncrementalMarking::StartMarking() {
     heap()->isolate()->PrintWithTimestamp(
         "[IncrementalMarking] Start marking\n");
   }
+
+  heap_->InvokeIncrementalMarkingPrologueCallbacks();
+
   is_compacting_ = !FLAG_never_compact && collector_->StartCompaction();
   collector_->StartMarking();
 
@@ -351,6 +363,8 @@ void IncrementalMarking::StartMarking() {
     heap_->local_embedder_heap_tracer()->TracePrologue(
         heap_->flags_for_embedder_tracer());
   }
+
+  heap_->InvokeIncrementalMarkingEpilogueCallbacks();
 }
 
 void IncrementalMarking::StartBlackAllocation() {
@@ -360,6 +374,11 @@ void IncrementalMarking::StartBlackAllocation() {
   heap()->old_space()->MarkLinearAllocationAreaBlack();
   heap()->map_space()->MarkLinearAllocationAreaBlack();
   heap()->code_space()->MarkLinearAllocationAreaBlack();
+  if (FLAG_local_heaps) {
+    heap()->safepoint()->IterateLocalHeaps([](LocalHeap* local_heap) {
+      local_heap->MarkLinearAllocationAreaBlack();
+    });
+  }
   if (FLAG_trace_incremental_marking) {
     heap()->isolate()->PrintWithTimestamp(
         "[IncrementalMarking] Black allocation started\n");
@@ -371,6 +390,11 @@ void IncrementalMarking::PauseBlackAllocation() {
   heap()->old_space()->UnmarkLinearAllocationArea();
   heap()->map_space()->UnmarkLinearAllocationArea();
   heap()->code_space()->UnmarkLinearAllocationArea();
+  if (FLAG_local_heaps) {
+    heap()->safepoint()->IterateLocalHeaps([](LocalHeap* local_heap) {
+      local_heap->UnmarkLinearAllocationArea();
+    });
+  }
   if (FLAG_trace_incremental_marking) {
     heap()->isolate()->PrintWithTimestamp(
         "[IncrementalMarking] Black allocation paused\n");
@@ -407,7 +431,8 @@ void IncrementalMarking::MarkRoots() {
   DCHECK(IsMarking());
 
   IncrementalMarkingRootMarkingVisitor visitor(this);
-  heap_->IterateStrongRoots(&visitor, VISIT_ONLY_STRONG_IGNORE_STACK);
+  heap_->IterateRoots(
+      &visitor, base::EnumSet<SkipRoot>{SkipRoot::kStack, SkipRoot::kWeak});
 }
 
 bool IncrementalMarking::ShouldRetainMap(Map map, int age) {
@@ -432,42 +457,41 @@ void IncrementalMarking::RetainMaps() {
   // - GC is requested by tests or dev-tools (abort_incremental_marking_).
   bool map_retaining_is_disabled = heap()->ShouldReduceMemory() ||
                                    FLAG_retain_maps_for_n_gc == 0;
-  WeakArrayList retained_maps = heap()->retained_maps();
-  int length = retained_maps.length();
-  // The number_of_disposed_maps separates maps in the retained_maps
-  // array that were created before and after context disposal.
-  // We do not age and retain disposed maps to avoid memory leaks.
-  int number_of_disposed_maps = heap()->number_of_disposed_maps_;
-  for (int i = 0; i < length; i += 2) {
-    MaybeObject value = retained_maps.Get(i);
-    HeapObject map_heap_object;
-    if (!value->GetHeapObjectIfWeak(&map_heap_object)) {
-      continue;
-    }
-    int age = retained_maps.Get(i + 1).ToSmi().value();
-    int new_age;
-    Map map = Map::cast(map_heap_object);
-    if (i >= number_of_disposed_maps && !map_retaining_is_disabled &&
-        marking_state()->IsWhite(map)) {
-      if (ShouldRetainMap(map, age)) {
-        WhiteToGreyAndPush(map);
+  std::vector<WeakArrayList> retained_maps_list = heap()->FindAllRetainedMaps();
+
+  for (WeakArrayList retained_maps : retained_maps_list) {
+    int length = retained_maps.length();
+
+    for (int i = 0; i < length; i += 2) {
+      MaybeObject value = retained_maps.Get(i);
+      HeapObject map_heap_object;
+      if (!value->GetHeapObjectIfWeak(&map_heap_object)) {
+        continue;
       }
-      Object prototype = map.prototype();
-      if (age > 0 && prototype.IsHeapObject() &&
-          marking_state()->IsWhite(HeapObject::cast(prototype))) {
-        // The prototype is not marked, age the map.
-        new_age = age - 1;
+      int age = retained_maps.Get(i + 1).ToSmi().value();
+      int new_age;
+      Map map = Map::cast(map_heap_object);
+      if (!map_retaining_is_disabled && marking_state()->IsWhite(map)) {
+        if (ShouldRetainMap(map, age)) {
+          WhiteToGreyAndPush(map);
+        }
+        Object prototype = map.prototype();
+        if (age > 0 && prototype.IsHeapObject() &&
+            marking_state()->IsWhite(HeapObject::cast(prototype))) {
+          // The prototype is not marked, age the map.
+          new_age = age - 1;
+        } else {
+          // The prototype and the constructor are marked, this map keeps only
+          // transition tree alive, not JSObjects. Do not age the map.
+          new_age = age;
+        }
       } else {
-        // The prototype and the constructor are marked, this map keeps only
-        // transition tree alive, not JSObjects. Do not age the map.
-        new_age = age;
+        new_age = FLAG_retain_maps_for_n_gc;
+      }
+      // Compact the array and update the age.
+      if (new_age != age) {
+        retained_maps.Set(i + 1, MaybeObject::FromSmi(Smi::FromInt(new_age)));
       }
-    } else {
-      new_age = FLAG_retain_maps_for_n_gc;
-    }
-    // Compact the array and update the age.
-    if (new_age != age) {
-      retained_maps.Set(i + 1, MaybeObject::FromSmi(Smi::FromInt(new_age)));
     }
   }
 }
@@ -656,6 +680,27 @@ void IncrementalMarking::UpdateWeakReferencesAfterScavenge() {
         DCHECK(!Heap::InYoungGeneration(candidate));
       });
 #endif
+
+  if (FLAG_harmony_weak_refs) {
+    weak_objects_->js_weak_refs.Update(
+        [](JSWeakRef js_weak_ref_in, JSWeakRef* js_weak_ref_out) -> bool {
+          JSWeakRef forwarded = ForwardingAddress(js_weak_ref_in);
+
+          if (!forwarded.is_null()) {
+            *js_weak_ref_out = forwarded;
+            return true;
+          }
+
+          return false;
+        });
+
+#ifdef DEBUG
+    // TODO(syg, marja): Support WeakCells in the young generation.
+    weak_objects_->weak_cells.Iterate([](WeakCell weak_cell) {
+      DCHECK(!Heap::InYoungGeneration(weak_cell));
+    });
+#endif
+  }
 }
 
 void IncrementalMarking::UpdateMarkedBytesAfterScavenge(
@@ -677,33 +722,35 @@ StepResult IncrementalMarking::EmbedderStep(double expected_duration_ms,
     return StepResult::kNoImmediateWork;
   }
 
-  constexpr size_t kObjectsToProcessBeforeInterrupt = 500;
+  constexpr size_t kObjectsToProcessBeforeDeadlineCheck = 500;
 
   TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_INCREMENTAL_EMBEDDER_TRACING);
   LocalEmbedderHeapTracer* local_tracer = heap_->local_embedder_heap_tracer();
   const double start = heap_->MonotonicallyIncreasingTimeInMs();
   const double deadline = start + expected_duration_ms;
-  double current;
   bool empty_worklist;
-  bool remote_tracing_done = false;
-  do {
-    {
-      LocalEmbedderHeapTracer::ProcessingScope scope(local_tracer);
-      HeapObject object;
-      size_t cnt = 0;
-      empty_worklist = true;
-      while (marking_worklists()->PopEmbedder(&object)) {
-        scope.TracePossibleWrapper(JSObject::cast(object));
-        if (++cnt == kObjectsToProcessBeforeInterrupt) {
-          cnt = 0;
+  {
+    LocalEmbedderHeapTracer::ProcessingScope scope(local_tracer);
+    HeapObject object;
+    size_t cnt = 0;
+    empty_worklist = true;
+    while (marking_worklists()->PopEmbedder(&object)) {
+      scope.TracePossibleWrapper(JSObject::cast(object));
+      if (++cnt == kObjectsToProcessBeforeDeadlineCheck) {
+        if (deadline <= heap_->MonotonicallyIncreasingTimeInMs()) {
           empty_worklist = false;
           break;
         }
+        cnt = 0;
       }
     }
-    remote_tracing_done = local_tracer->Trace(deadline);
-    current = heap_->MonotonicallyIncreasingTimeInMs();
-  } while (!empty_worklist && !remote_tracing_done && (current < deadline));
+  }
+  // |deadline - heap_->MonotonicallyIncreasingTimeInMs()| could be negative,
+  // which means |local_tracer| won't do any actual tracing, so there is no
+  // need to check for |deadline <= heap_->MonotonicallyIncreasingTimeInMs()|.
+  bool remote_tracing_done =
+      local_tracer->Trace(deadline - heap_->MonotonicallyIncreasingTimeInMs());
+  double current = heap_->MonotonicallyIncreasingTimeInMs();
   local_tracer->SetEmbedderWorklistEmpty(empty_worklist);
   *duration_ms = current - start;
   return (empty_worklist && remote_tracing_done)
@@ -763,6 +810,20 @@ void IncrementalMarking::Stop() {
   SetState(STOPPED);
   is_compacting_ = false;
   FinishBlackAllocation();
+
+  if (FLAG_local_heaps) {
+    // Merge live bytes counters of background threads
+    for (auto pair : background_live_bytes_) {
+      MemoryChunk* memory_chunk = pair.first;
+      intptr_t live_bytes = pair.second;
+
+      if (live_bytes) {
+        marking_state()->IncrementLiveBytes(memory_chunk, live_bytes);
+      }
+    }
+
+    background_live_bytes_.clear();
+  }
 }
 
 
@@ -931,17 +992,32 @@ StepResult IncrementalMarking::AdvanceWithDeadline(
 
 void IncrementalMarking::FinalizeSweeping() {
   DCHECK(state_ == SWEEPING);
-  if (collector_->sweeping_in_progress() &&
-      (!FLAG_concurrent_sweeping ||
-       !collector_->sweeper()->AreSweeperTasksRunning())) {
-    collector_->EnsureSweepingCompleted();
+  if (ContinueConcurrentSweeping()) {
+    if (FLAG_stress_incremental_marking) {
+      // To start concurrent marking a bit earlier, support concurrent sweepers
+      // from main thread by sweeping some pages.
+      SupportConcurrentSweeping();
+    }
+    return;
   }
-  if (!collector_->sweeping_in_progress()) {
+
+  SafepointScope scope(heap());
+  collector_->EnsureSweepingCompleted();
+  DCHECK(!collector_->sweeping_in_progress());
 #ifdef DEBUG
-    heap_->VerifyCountersAfterSweeping();
+  heap_->VerifyCountersAfterSweeping();
 #endif
-    StartMarking();
-  }
+  StartMarking();
+}
+
+bool IncrementalMarking::ContinueConcurrentSweeping() {
+  if (!collector_->sweeping_in_progress()) return false;
+  return FLAG_concurrent_sweeping &&
+         collector_->sweeper()->AreSweeperTasksRunning();
+}
+
+void IncrementalMarking::SupportConcurrentSweeping() {
+  collector_->sweeper()->SupportConcurrentSweeping();
 }
 
 size_t IncrementalMarking::StepSizeToKeepUpWithAllocations() {
diff --git a/deps/v8/src/heap/incremental-marking.h b/deps/v8/src/heap/incremental-marking.h
index 04000be352c..c507c022a70 100644
--- a/deps/v8/src/heap/incremental-marking.h
+++ b/deps/v8/src/heap/incremental-marking.h
@@ -5,6 +5,7 @@
 #ifndef V8_HEAP_INCREMENTAL_MARKING_H_
 #define V8_HEAP_INCREMENTAL_MARKING_H_
 
+#include "src/base/platform/mutex.h"
 #include "src/heap/heap.h"
 #include "src/heap/incremental-marking-job.h"
 #include "src/heap/mark-compact.h"
@@ -28,7 +29,7 @@ enum class StepResult {
 
 class V8_EXPORT_PRIVATE IncrementalMarking final {
  public:
-  enum State { STOPPED, SWEEPING, MARKING, COMPLETE };
+  enum State : uint8_t { STOPPED, SWEEPING, MARKING, COMPLETE };
 
   enum CompletionAction { GC_VIA_STACK_GUARD, NO_GC_VIA_STACK_GUARD };
 
@@ -168,6 +169,8 @@ class V8_EXPORT_PRIVATE IncrementalMarking final {
                                  StepOrigin step_origin);
 
   void FinalizeSweeping();
+  bool ContinueConcurrentSweeping();
+  void SupportConcurrentSweeping();
 
   StepResult Step(double max_step_size_in_ms, CompletionAction action,
                   StepOrigin step_origin);
@@ -205,6 +208,8 @@ class V8_EXPORT_PRIVATE IncrementalMarking final {
   // the concurrent marker.
   void MarkBlackAndVisitObjectDueToLayoutChange(HeapObject obj);
 
+  void MarkBlackBackground(HeapObject obj, int object_size);
+
   bool IsCompacting() { return IsMarking() && is_compacting_; }
 
   void ProcessBlackAllocatedObject(HeapObject obj);
@@ -235,6 +240,11 @@ class V8_EXPORT_PRIVATE IncrementalMarking final {
 
   bool IsBelowActivationThresholds() const;
 
+  void IncrementLiveBytesBackground(MemoryChunk* chunk, intptr_t by) {
+    base::MutexGuard guard(&background_live_bytes_mutex_);
+    background_live_bytes_[chunk] += by;
+  }
+
  private:
   class Observer : public AllocationObserver {
    public:
@@ -317,7 +327,10 @@ class V8_EXPORT_PRIVATE IncrementalMarking final {
   size_t bytes_marked_concurrently_ = 0;
 
   // Must use SetState() above to update state_
-  State state_;
+  // Atomic since main thread can complete marking (= changing state), while a
+  // background thread's slow allocation path will check whether incremental
+  // marking is currently running.
+  std::atomic<State> state_;
 
   bool is_compacting_ = false;
   bool was_activated_ = false;
@@ -325,7 +338,7 @@ class V8_EXPORT_PRIVATE IncrementalMarking final {
   bool finalize_marking_completed_ = false;
   IncrementalMarkingJob incremental_marking_job_;
 
-  GCRequestType request_type_ = NONE;
+  std::atomic<GCRequestType> request_type_{NONE};
 
   Observer new_generation_observer_;
   Observer old_generation_observer_;
@@ -334,6 +347,9 @@ class V8_EXPORT_PRIVATE IncrementalMarking final {
   AtomicMarkingState atomic_marking_state_;
   NonAtomicMarkingState non_atomic_marking_state_;
 
+  base::Mutex background_live_bytes_mutex_;
+  std::unordered_map<MemoryChunk*, intptr_t> background_live_bytes_;
+
   DISALLOW_IMPLICIT_CONSTRUCTORS(IncrementalMarking);
 };
 }  // namespace internal
diff --git a/deps/v8/src/heap/invalidated-slots.cc b/deps/v8/src/heap/invalidated-slots.cc
index 9f29af218bc..b3655aaad85 100644
--- a/deps/v8/src/heap/invalidated-slots.cc
+++ b/deps/v8/src/heap/invalidated-slots.cc
@@ -3,7 +3,9 @@
 // found in the LICENSE file.
 
 #include "src/heap/invalidated-slots.h"
+
 #include "src/heap/invalidated-slots-inl.h"
+#include "src/heap/memory-chunk.h"
 #include "src/heap/spaces.h"
 #include "src/objects/objects-inl.h"
 
diff --git a/deps/v8/src/heap/large-spaces.cc b/deps/v8/src/heap/large-spaces.cc
new file mode 100644
index 00000000000..e3af0c35465
--- /dev/null
+++ b/deps/v8/src/heap/large-spaces.cc
@@ -0,0 +1,547 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/large-spaces.h"
+
+#include "src/execution/isolate.h"
+#include "src/heap/combined-heap.h"
+#include "src/heap/incremental-marking.h"
+#include "src/heap/list.h"
+#include "src/heap/marking.h"
+#include "src/heap/memory-allocator.h"
+#include "src/heap/memory-chunk-inl.h"
+#include "src/heap/remembered-set-inl.h"
+#include "src/heap/slot-set.h"
+#include "src/heap/spaces-inl.h"
+#include "src/logging/log.h"
+#include "src/objects/objects-inl.h"
+#include "src/sanitizer/msan.h"
+#include "src/utils/ostreams.h"
+
+namespace v8 {
+namespace internal {
+
+// This check is here to ensure that the lower 32 bits of any real heap object
+// can't overlap with the lower 32 bits of cleared weak reference value and
+// therefore it's enough to compare only the lower 32 bits of a MaybeObject in
+// order to figure out if it's a cleared weak reference or not.
+STATIC_ASSERT(kClearedWeakHeapObjectLower32 < LargePage::kHeaderSize);
+
+LargePage* LargePage::Initialize(Heap* heap, MemoryChunk* chunk,
+                                 Executability executable) {
+  if (executable && chunk->size() > LargePage::kMaxCodePageSize) {
+    STATIC_ASSERT(LargePage::kMaxCodePageSize <= TypedSlotSet::kMaxOffset);
+    FATAL("Code page is too large.");
+  }
+
+  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(chunk->area_start(), chunk->area_size());
+
+  LargePage* page = static_cast<LargePage*>(chunk);
+  page->SetFlag(MemoryChunk::LARGE_PAGE);
+  page->list_node().Initialize();
+  return page;
+}
+
+size_t LargeObjectSpace::Available() {
+  // We return zero here since we cannot take advantage of already allocated
+  // large object memory.
+  return 0;
+}
+
+Address LargePage::GetAddressToShrink(Address object_address,
+                                      size_t object_size) {
+  if (executable() == EXECUTABLE) {
+    return 0;
+  }
+  size_t used_size = ::RoundUp((object_address - address()) + object_size,
+                               MemoryAllocator::GetCommitPageSize());
+  if (used_size < CommittedPhysicalMemory()) {
+    return address() + used_size;
+  }
+  return 0;
+}
+
+void LargePage::ClearOutOfLiveRangeSlots(Address free_start) {
+  DCHECK_NULL(this->sweeping_slot_set());
+  RememberedSet<OLD_TO_NEW>::RemoveRange(this, free_start, area_end(),
+                                         SlotSet::FREE_EMPTY_BUCKETS);
+  RememberedSet<OLD_TO_OLD>::RemoveRange(this, free_start, area_end(),
+                                         SlotSet::FREE_EMPTY_BUCKETS);
+  RememberedSet<OLD_TO_NEW>::RemoveRangeTyped(this, free_start, area_end());
+  RememberedSet<OLD_TO_OLD>::RemoveRangeTyped(this, free_start, area_end());
+}
+
+// -----------------------------------------------------------------------------
+// LargeObjectSpaceObjectIterator
+
+LargeObjectSpaceObjectIterator::LargeObjectSpaceObjectIterator(
+    LargeObjectSpace* space) {
+  current_ = space->first_page();
+}
+
+HeapObject LargeObjectSpaceObjectIterator::Next() {
+  if (current_ == nullptr) return HeapObject();
+
+  HeapObject object = current_->GetObject();
+  current_ = current_->next_page();
+  return object;
+}
+
+// -----------------------------------------------------------------------------
+// OldLargeObjectSpace
+
+LargeObjectSpace::LargeObjectSpace(Heap* heap, AllocationSpace id)
+    : Space(heap, id, new NoFreeList()),
+      size_(0),
+      page_count_(0),
+      objects_size_(0) {}
+
+void LargeObjectSpace::TearDown() {
+  while (!memory_chunk_list_.Empty()) {
+    LargePage* page = first_page();
+    LOG(heap()->isolate(),
+        DeleteEvent("LargeObjectChunk",
+                    reinterpret_cast<void*>(page->address())));
+    memory_chunk_list_.Remove(page);
+    heap()->memory_allocator()->Free<MemoryAllocator::kFull>(page);
+  }
+}
+
+AllocationResult OldLargeObjectSpace::AllocateRaw(int object_size) {
+  return AllocateRaw(object_size, NOT_EXECUTABLE);
+}
+
+AllocationResult OldLargeObjectSpace::AllocateRaw(int object_size,
+                                                  Executability executable) {
+  // Check if we want to force a GC before growing the old space further.
+  // If so, fail the allocation.
+  if (!heap()->CanExpandOldGeneration(object_size) ||
+      !heap()->ShouldExpandOldGenerationOnSlowAllocation()) {
+    return AllocationResult::Retry(identity());
+  }
+
+  LargePage* page = AllocateLargePage(object_size, executable);
+  if (page == nullptr) return AllocationResult::Retry(identity());
+  page->SetOldGenerationPageFlags(heap()->incremental_marking()->IsMarking());
+  HeapObject object = page->GetObject();
+  heap()->StartIncrementalMarkingIfAllocationLimitIsReached(
+      heap()->GCFlagsForIncrementalMarking(),
+      kGCCallbackScheduleIdleGarbageCollection);
+  if (heap()->incremental_marking()->black_allocation()) {
+    heap()->incremental_marking()->marking_state()->WhiteToBlack(object);
+  }
+  DCHECK_IMPLIES(
+      heap()->incremental_marking()->black_allocation(),
+      heap()->incremental_marking()->marking_state()->IsBlack(object));
+  page->InitializationMemoryFence();
+  heap()->NotifyOldGenerationExpansion(identity(), page);
+  AllocationStep(object_size, object.address(), object_size);
+  return object;
+}
+
+LargePage* LargeObjectSpace::AllocateLargePage(int object_size,
+                                               Executability executable) {
+  LargePage* page = heap()->memory_allocator()->AllocateLargePage(
+      object_size, this, executable);
+  if (page == nullptr) return nullptr;
+  DCHECK_GE(page->area_size(), static_cast<size_t>(object_size));
+
+  AddPage(page, object_size);
+
+  HeapObject object = page->GetObject();
+
+  heap()->CreateFillerObjectAt(object.address(), object_size,
+                               ClearRecordedSlots::kNo);
+  return page;
+}
+
+size_t LargeObjectSpace::CommittedPhysicalMemory() {
+  // On a platform that provides lazy committing of memory, we over-account
+  // the actually committed memory. There is no easy way right now to support
+  // precise accounting of committed memory in large object space.
+  return CommittedMemory();
+}
+
+LargePage* CodeLargeObjectSpace::FindPage(Address a) {
+  const Address key = MemoryChunk::FromAddress(a)->address();
+  auto it = chunk_map_.find(key);
+  if (it != chunk_map_.end()) {
+    LargePage* page = it->second;
+    CHECK(page->Contains(a));
+    return page;
+  }
+  return nullptr;
+}
+
+void OldLargeObjectSpace::ClearMarkingStateOfLiveObjects() {
+  IncrementalMarking::NonAtomicMarkingState* marking_state =
+      heap()->incremental_marking()->non_atomic_marking_state();
+  LargeObjectSpaceObjectIterator it(this);
+  for (HeapObject obj = it.Next(); !obj.is_null(); obj = it.Next()) {
+    if (marking_state->IsBlackOrGrey(obj)) {
+      Marking::MarkWhite(marking_state->MarkBitFrom(obj));
+      MemoryChunk* chunk = MemoryChunk::FromHeapObject(obj);
+      RememberedSet<OLD_TO_NEW>::FreeEmptyBuckets(chunk);
+      chunk->ResetProgressBar();
+      marking_state->SetLiveBytes(chunk, 0);
+    }
+    DCHECK(marking_state->IsWhite(obj));
+  }
+}
+
+void CodeLargeObjectSpace::InsertChunkMapEntries(LargePage* page) {
+  for (Address current = reinterpret_cast<Address>(page);
+       current < reinterpret_cast<Address>(page) + page->size();
+       current += MemoryChunk::kPageSize) {
+    chunk_map_[current] = page;
+  }
+}
+
+void CodeLargeObjectSpace::RemoveChunkMapEntries(LargePage* page) {
+  for (Address current = page->address();
+       current < reinterpret_cast<Address>(page) + page->size();
+       current += MemoryChunk::kPageSize) {
+    chunk_map_.erase(current);
+  }
+}
+
+void OldLargeObjectSpace::PromoteNewLargeObject(LargePage* page) {
+  DCHECK_EQ(page->owner_identity(), NEW_LO_SPACE);
+  DCHECK(page->IsLargePage());
+  DCHECK(page->IsFlagSet(MemoryChunk::FROM_PAGE));
+  DCHECK(!page->IsFlagSet(MemoryChunk::TO_PAGE));
+  size_t object_size = static_cast<size_t>(page->GetObject().Size());
+  static_cast<LargeObjectSpace*>(page->owner())->RemovePage(page, object_size);
+  page->ClearFlag(MemoryChunk::FROM_PAGE);
+  AddPage(page, object_size);
+}
+
+void LargeObjectSpace::AddPage(LargePage* page, size_t object_size) {
+  size_ += static_cast<int>(page->size());
+  AccountCommitted(page->size());
+  objects_size_ += object_size;
+  page_count_++;
+  memory_chunk_list_.PushBack(page);
+  page->set_owner(this);
+  page->SetOldGenerationPageFlags(heap()->incremental_marking()->IsMarking());
+}
+
+void LargeObjectSpace::RemovePage(LargePage* page, size_t object_size) {
+  size_ -= static_cast<int>(page->size());
+  AccountUncommitted(page->size());
+  objects_size_ -= object_size;
+  page_count_--;
+  memory_chunk_list_.Remove(page);
+  page->set_owner(nullptr);
+}
+
+void LargeObjectSpace::FreeUnmarkedObjects() {
+  LargePage* current = first_page();
+  IncrementalMarking::NonAtomicMarkingState* marking_state =
+      heap()->incremental_marking()->non_atomic_marking_state();
+  // Right-trimming does not update the objects_size_ counter. We are lazily
+  // updating it after every GC.
+  size_t surviving_object_size = 0;
+  while (current) {
+    LargePage* next_current = current->next_page();
+    HeapObject object = current->GetObject();
+    DCHECK(!marking_state->IsGrey(object));
+    size_t size = static_cast<size_t>(object.Size());
+    if (marking_state->IsBlack(object)) {
+      Address free_start;
+      surviving_object_size += size;
+      if ((free_start = current->GetAddressToShrink(object.address(), size)) !=
+          0) {
+        DCHECK(!current->IsFlagSet(Page::IS_EXECUTABLE));
+        current->ClearOutOfLiveRangeSlots(free_start);
+        const size_t bytes_to_free =
+            current->size() - (free_start - current->address());
+        heap()->memory_allocator()->PartialFreeMemory(
+            current, free_start, bytes_to_free,
+            current->area_start() + object.Size());
+        size_ -= bytes_to_free;
+        AccountUncommitted(bytes_to_free);
+      }
+    } else {
+      RemovePage(current, size);
+      heap()->memory_allocator()->Free<MemoryAllocator::kPreFreeAndQueue>(
+          current);
+    }
+    current = next_current;
+  }
+  objects_size_ = surviving_object_size;
+}
+
+bool LargeObjectSpace::Contains(HeapObject object) {
+  MemoryChunk* chunk = MemoryChunk::FromHeapObject(object);
+
+  bool owned = (chunk->owner() == this);
+
+  SLOW_DCHECK(!owned || ContainsSlow(object.address()));
+
+  return owned;
+}
+
+bool LargeObjectSpace::ContainsSlow(Address addr) {
+  for (LargePage* page : *this) {
+    if (page->Contains(addr)) return true;
+  }
+  return false;
+}
+
+std::unique_ptr<ObjectIterator> LargeObjectSpace::GetObjectIterator(
+    Heap* heap) {
+  return std::unique_ptr<ObjectIterator>(
+      new LargeObjectSpaceObjectIterator(this));
+}
+
+#ifdef VERIFY_HEAP
+// We do not assume that the large object iterator works, because it depends
+// on the invariants we are checking during verification.
+void LargeObjectSpace::Verify(Isolate* isolate) {
+  size_t external_backing_store_bytes[kNumTypes];
+
+  for (int i = 0; i < kNumTypes; i++) {
+    external_backing_store_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
+  }
+
+  for (LargePage* chunk = first_page(); chunk != nullptr;
+       chunk = chunk->next_page()) {
+    // Each chunk contains an object that starts at the large object page's
+    // object area start.
+    HeapObject object = chunk->GetObject();
+    Page* page = Page::FromHeapObject(object);
+    CHECK(object.address() == page->area_start());
+
+    // The first word should be a map, and we expect all map pointers to be
+    // in map space or read-only space.
+    Map map = object.map();
+    CHECK(map.IsMap());
+    CHECK(ReadOnlyHeap::Contains(map) || heap()->map_space()->Contains(map));
+
+    // We have only the following types in the large object space:
+    if (!(object.IsAbstractCode() || object.IsSeqString() ||
+          object.IsExternalString() || object.IsThinString() ||
+          object.IsFixedArray() || object.IsFixedDoubleArray() ||
+          object.IsWeakFixedArray() || object.IsWeakArrayList() ||
+          object.IsPropertyArray() || object.IsByteArray() ||
+          object.IsFeedbackVector() || object.IsBigInt() ||
+          object.IsFreeSpace() || object.IsFeedbackMetadata() ||
+          object.IsContext() || object.IsUncompiledDataWithoutPreparseData() ||
+          object.IsPreparseData()) &&
+        !FLAG_young_generation_large_objects) {
+      FATAL("Found invalid Object (instance_type=%i) in large object space.",
+            object.map().instance_type());
+    }
+
+    // The object itself should look OK.
+    object.ObjectVerify(isolate);
+
+    if (!FLAG_verify_heap_skip_remembered_set) {
+      heap()->VerifyRememberedSetFor(object);
+    }
+
+    // Byte arrays and strings don't have interior pointers.
+    if (object.IsAbstractCode()) {
+      VerifyPointersVisitor code_visitor(heap());
+      object.IterateBody(map, object.Size(), &code_visitor);
+    } else if (object.IsFixedArray()) {
+      FixedArray array = FixedArray::cast(object);
+      for (int j = 0; j < array.length(); j++) {
+        Object element = array.get(j);
+        if (element.IsHeapObject()) {
+          HeapObject element_object = HeapObject::cast(element);
+          CHECK(IsValidHeapObject(heap(), element_object));
+          CHECK(element_object.map().IsMap());
+        }
+      }
+    } else if (object.IsPropertyArray()) {
+      PropertyArray array = PropertyArray::cast(object);
+      for (int j = 0; j < array.length(); j++) {
+        Object property = array.get(j);
+        if (property.IsHeapObject()) {
+          HeapObject property_object = HeapObject::cast(property);
+          CHECK(heap()->Contains(property_object));
+          CHECK(property_object.map().IsMap());
+        }
+      }
+    }
+    for (int i = 0; i < kNumTypes; i++) {
+      ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+      external_backing_store_bytes[t] += chunk->ExternalBackingStoreBytes(t);
+    }
+  }
+  for (int i = 0; i < kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    CHECK_EQ(external_backing_store_bytes[t], ExternalBackingStoreBytes(t));
+  }
+}
+#endif
+
+#ifdef DEBUG
+void LargeObjectSpace::Print() {
+  StdoutStream os;
+  LargeObjectSpaceObjectIterator it(this);
+  for (HeapObject obj = it.Next(); !obj.is_null(); obj = it.Next()) {
+    obj.Print(os);
+  }
+}
+#endif  // DEBUG
+
+OldLargeObjectSpace::OldLargeObjectSpace(Heap* heap)
+    : LargeObjectSpace(heap, LO_SPACE) {}
+
+OldLargeObjectSpace::OldLargeObjectSpace(Heap* heap, AllocationSpace id)
+    : LargeObjectSpace(heap, id) {}
+
+void OldLargeObjectSpace::MergeOffThreadSpace(
+    OffThreadLargeObjectSpace* other) {
+  DCHECK(identity() == other->identity());
+
+  while (!other->memory_chunk_list().Empty()) {
+    LargePage* page = other->first_page();
+    HeapObject object = page->GetObject();
+    int size = object.Size();
+    other->RemovePage(page, size);
+    AddPage(page, size);
+
+    // TODO(leszeks): Here we should AllocationStep, see the TODO in
+    // PagedSpace::MergeOffThreadSpace.
+
+    if (heap()->incremental_marking()->black_allocation()) {
+      heap()->incremental_marking()->marking_state()->WhiteToBlack(object);
+    }
+    DCHECK_IMPLIES(
+        heap()->incremental_marking()->black_allocation(),
+        heap()->incremental_marking()->marking_state()->IsBlack(object));
+  }
+}
+
+NewLargeObjectSpace::NewLargeObjectSpace(Heap* heap, size_t capacity)
+    : LargeObjectSpace(heap, NEW_LO_SPACE),
+      pending_object_(0),
+      capacity_(capacity) {}
+
+AllocationResult NewLargeObjectSpace::AllocateRaw(int object_size) {
+  // Do not allocate more objects if promoting the existing object would exceed
+  // the old generation capacity.
+  if (!heap()->CanExpandOldGeneration(SizeOfObjects())) {
+    return AllocationResult::Retry(identity());
+  }
+
+  // Allocation for the first object must succeed independent from the capacity.
+  if (SizeOfObjects() > 0 && static_cast<size_t>(object_size) > Available()) {
+    return AllocationResult::Retry(identity());
+  }
+
+  LargePage* page = AllocateLargePage(object_size, NOT_EXECUTABLE);
+  if (page == nullptr) return AllocationResult::Retry(identity());
+
+  // The size of the first object may exceed the capacity.
+  capacity_ = Max(capacity_, SizeOfObjects());
+
+  HeapObject result = page->GetObject();
+  page->SetYoungGenerationPageFlags(heap()->incremental_marking()->IsMarking());
+  page->SetFlag(MemoryChunk::TO_PAGE);
+  pending_object_.store(result.address(), std::memory_order_relaxed);
+#ifdef ENABLE_MINOR_MC
+  if (FLAG_minor_mc) {
+    page->AllocateYoungGenerationBitmap();
+    heap()
+        ->minor_mark_compact_collector()
+        ->non_atomic_marking_state()
+        ->ClearLiveness(page);
+  }
+#endif  // ENABLE_MINOR_MC
+  page->InitializationMemoryFence();
+  DCHECK(page->IsLargePage());
+  DCHECK_EQ(page->owner_identity(), NEW_LO_SPACE);
+  AllocationStep(object_size, result.address(), object_size);
+  return result;
+}
+
+size_t NewLargeObjectSpace::Available() { return capacity_ - SizeOfObjects(); }
+
+void NewLargeObjectSpace::Flip() {
+  for (LargePage* chunk = first_page(); chunk != nullptr;
+       chunk = chunk->next_page()) {
+    chunk->SetFlag(MemoryChunk::FROM_PAGE);
+    chunk->ClearFlag(MemoryChunk::TO_PAGE);
+  }
+}
+
+void NewLargeObjectSpace::FreeDeadObjects(
+    const std::function<bool(HeapObject)>& is_dead) {
+  bool is_marking = heap()->incremental_marking()->IsMarking();
+  size_t surviving_object_size = 0;
+  bool freed_pages = false;
+  for (auto it = begin(); it != end();) {
+    LargePage* page = *it;
+    it++;
+    HeapObject object = page->GetObject();
+    size_t size = static_cast<size_t>(object.Size());
+    if (is_dead(object)) {
+      freed_pages = true;
+      RemovePage(page, size);
+      heap()->memory_allocator()->Free<MemoryAllocator::kPreFreeAndQueue>(page);
+      if (FLAG_concurrent_marking && is_marking) {
+        heap()->concurrent_marking()->ClearMemoryChunkData(page);
+      }
+    } else {
+      surviving_object_size += size;
+    }
+  }
+  // Right-trimming does not update the objects_size_ counter. We are lazily
+  // updating it after every GC.
+  objects_size_ = surviving_object_size;
+  if (freed_pages) {
+    heap()->memory_allocator()->unmapper()->FreeQueuedChunks();
+  }
+}
+
+void NewLargeObjectSpace::SetCapacity(size_t capacity) {
+  capacity_ = Max(capacity, SizeOfObjects());
+}
+
+CodeLargeObjectSpace::CodeLargeObjectSpace(Heap* heap)
+    : OldLargeObjectSpace(heap, CODE_LO_SPACE),
+      chunk_map_(kInitialChunkMapCapacity) {}
+
+AllocationResult CodeLargeObjectSpace::AllocateRaw(int object_size) {
+  return OldLargeObjectSpace::AllocateRaw(object_size, EXECUTABLE);
+}
+
+void CodeLargeObjectSpace::AddPage(LargePage* page, size_t object_size) {
+  OldLargeObjectSpace::AddPage(page, object_size);
+  InsertChunkMapEntries(page);
+}
+
+void CodeLargeObjectSpace::RemovePage(LargePage* page, size_t object_size) {
+  RemoveChunkMapEntries(page);
+  heap()->isolate()->RemoveCodeMemoryChunk(page);
+  OldLargeObjectSpace::RemovePage(page, object_size);
+}
+
+OffThreadLargeObjectSpace::OffThreadLargeObjectSpace(Heap* heap)
+    : LargeObjectSpace(heap, LO_SPACE) {
+#ifdef V8_ENABLE_THIRD_PARTY_HEAP
+  // OffThreadLargeObjectSpace doesn't work with third-party heap.
+  UNREACHABLE();
+#endif
+}
+
+AllocationResult OffThreadLargeObjectSpace::AllocateRaw(int object_size) {
+  LargePage* page = AllocateLargePage(object_size, NOT_EXECUTABLE);
+  if (page == nullptr) return AllocationResult::Retry(identity());
+
+  return page->GetObject();
+}
+
+void OffThreadLargeObjectSpace::FreeUnmarkedObjects() {
+  // We should never try to free objects in this space.
+  UNREACHABLE();
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/heap/large-spaces.h b/deps/v8/src/heap/large-spaces.h
new file mode 100644
index 00000000000..207b76a0934
--- /dev/null
+++ b/deps/v8/src/heap/large-spaces.h
@@ -0,0 +1,232 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_LARGE_SPACES_H_
+#define V8_HEAP_LARGE_SPACES_H_
+
+#include <atomic>
+#include <functional>
+#include <memory>
+#include <unordered_map>
+
+#include "src/base/macros.h"
+#include "src/common/globals.h"
+#include "src/heap/heap.h"
+#include "src/heap/memory-chunk.h"
+#include "src/heap/spaces.h"
+#include "src/objects/heap-object.h"
+
+namespace v8 {
+namespace internal {
+
+class Isolate;
+
+class LargePage : public MemoryChunk {
+ public:
+  // A limit to guarantee that we do not overflow typed slot offset in the old
+  // to old remembered set. Note that this limit is higher than what assembler
+  // already imposes on x64 and ia32 architectures.
+  static const int kMaxCodePageSize = 512 * MB;
+
+  static LargePage* FromHeapObject(HeapObject o) {
+    return static_cast<LargePage*>(MemoryChunk::FromHeapObject(o));
+  }
+
+  HeapObject GetObject() { return HeapObject::FromAddress(area_start()); }
+
+  LargePage* next_page() { return static_cast<LargePage*>(list_node_.next()); }
+
+  // Uncommit memory that is not in use anymore by the object. If the object
+  // cannot be shrunk 0 is returned.
+  Address GetAddressToShrink(Address object_address, size_t object_size);
+
+  void ClearOutOfLiveRangeSlots(Address free_start);
+
+ private:
+  static LargePage* Initialize(Heap* heap, MemoryChunk* chunk,
+                               Executability executable);
+
+  friend class MemoryAllocator;
+};
+
+STATIC_ASSERT(sizeof(LargePage) <= MemoryChunk::kHeaderSize);
+
+// -----------------------------------------------------------------------------
+// Large objects ( > kMaxRegularHeapObjectSize ) are allocated and managed by
+// the large object space. Large objects do not move during garbage collections.
+
+class V8_EXPORT_PRIVATE LargeObjectSpace : public Space {
+ public:
+  using iterator = LargePageIterator;
+
+  ~LargeObjectSpace() override { TearDown(); }
+
+  // Releases internal resources, frees objects in this space.
+  void TearDown();
+
+  // Available bytes for objects in this space.
+  size_t Available() override;
+
+  size_t Size() override { return size_; }
+  size_t SizeOfObjects() override { return objects_size_; }
+
+  // Approximate amount of physical memory committed for this space.
+  size_t CommittedPhysicalMemory() override;
+
+  int PageCount() { return page_count_; }
+
+  // Frees unmarked objects.
+  virtual void FreeUnmarkedObjects();
+
+  // Checks whether a heap object is in this space; O(1).
+  bool Contains(HeapObject obj);
+  // Checks whether an address is in the object area in this space. Iterates all
+  // objects in the space. May be slow.
+  bool ContainsSlow(Address addr);
+
+  // Checks whether the space is empty.
+  bool IsEmpty() { return first_page() == nullptr; }
+
+  virtual void AddPage(LargePage* page, size_t object_size);
+  virtual void RemovePage(LargePage* page, size_t object_size);
+
+  LargePage* first_page() {
+    return reinterpret_cast<LargePage*>(Space::first_page());
+  }
+
+  iterator begin() { return iterator(first_page()); }
+  iterator end() { return iterator(nullptr); }
+
+  std::unique_ptr<ObjectIterator> GetObjectIterator(Heap* heap) override;
+
+  virtual bool is_off_thread() const { return false; }
+
+#ifdef VERIFY_HEAP
+  virtual void Verify(Isolate* isolate);
+#endif
+
+#ifdef DEBUG
+  void Print() override;
+#endif
+
+ protected:
+  LargeObjectSpace(Heap* heap, AllocationSpace id);
+
+  LargePage* AllocateLargePage(int object_size, Executability executable);
+
+  size_t size_;          // allocated bytes
+  int page_count_;       // number of chunks
+  size_t objects_size_;  // size of objects
+
+ private:
+  friend class LargeObjectSpaceObjectIterator;
+};
+
+class OffThreadLargeObjectSpace;
+
+class OldLargeObjectSpace : public LargeObjectSpace {
+ public:
+  explicit OldLargeObjectSpace(Heap* heap);
+
+  V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT AllocationResult
+  AllocateRaw(int object_size);
+
+  // Clears the marking state of live objects.
+  void ClearMarkingStateOfLiveObjects();
+
+  void PromoteNewLargeObject(LargePage* page);
+
+  V8_EXPORT_PRIVATE void MergeOffThreadSpace(OffThreadLargeObjectSpace* other);
+
+ protected:
+  explicit OldLargeObjectSpace(Heap* heap, AllocationSpace id);
+  V8_WARN_UNUSED_RESULT AllocationResult AllocateRaw(int object_size,
+                                                     Executability executable);
+};
+
+class NewLargeObjectSpace : public LargeObjectSpace {
+ public:
+  NewLargeObjectSpace(Heap* heap, size_t capacity);
+
+  V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT AllocationResult
+  AllocateRaw(int object_size);
+
+  // Available bytes for objects in this space.
+  size_t Available() override;
+
+  void Flip();
+
+  void FreeDeadObjects(const std::function<bool(HeapObject)>& is_dead);
+
+  void SetCapacity(size_t capacity);
+
+  // The last allocated object that is not guaranteed to be initialized when the
+  // concurrent marker visits it.
+  Address pending_object() {
+    return pending_object_.load(std::memory_order_relaxed);
+  }
+
+  void ResetPendingObject() { pending_object_.store(0); }
+
+ private:
+  std::atomic<Address> pending_object_;
+  size_t capacity_;
+};
+
+class CodeLargeObjectSpace : public OldLargeObjectSpace {
+ public:
+  explicit CodeLargeObjectSpace(Heap* heap);
+
+  V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT AllocationResult
+  AllocateRaw(int object_size);
+
+  // Finds a large object page containing the given address, returns nullptr if
+  // such a page doesn't exist.
+  LargePage* FindPage(Address a);
+
+ protected:
+  void AddPage(LargePage* page, size_t object_size) override;
+  void RemovePage(LargePage* page, size_t object_size) override;
+
+ private:
+  static const size_t kInitialChunkMapCapacity = 1024;
+  void InsertChunkMapEntries(LargePage* page);
+  void RemoveChunkMapEntries(LargePage* page);
+
+  // Page-aligned addresses to their corresponding LargePage.
+  std::unordered_map<Address, LargePage*> chunk_map_;
+};
+
+class V8_EXPORT_PRIVATE OffThreadLargeObjectSpace : public LargeObjectSpace {
+ public:
+  explicit OffThreadLargeObjectSpace(Heap* heap);
+
+  V8_WARN_UNUSED_RESULT AllocationResult AllocateRaw(int object_size);
+
+  void FreeUnmarkedObjects() override;
+
+  bool is_off_thread() const override { return true; }
+
+ protected:
+  // OldLargeObjectSpace can mess with OffThreadLargeObjectSpace during merging.
+  friend class OldLargeObjectSpace;
+
+  V8_WARN_UNUSED_RESULT AllocationResult AllocateRaw(int object_size,
+                                                     Executability executable);
+};
+
+class LargeObjectSpaceObjectIterator : public ObjectIterator {
+ public:
+  explicit LargeObjectSpaceObjectIterator(LargeObjectSpace* space);
+
+  HeapObject Next() override;
+
+ private:
+  LargePage* current_;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_LARGE_SPACES_H_
diff --git a/deps/v8/src/base/list.h b/deps/v8/src/heap/list.h
similarity index 76%
rename from deps/v8/src/base/list.h
rename to deps/v8/src/heap/list.h
index 18e45318a24..a8a75045074 100644
--- a/deps/v8/src/base/list.h
+++ b/deps/v8/src/heap/list.h
@@ -2,20 +2,33 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_BASE_LIST_H_
-#define V8_BASE_LIST_H_
+#ifndef V8_HEAP_LIST_H_
+#define V8_HEAP_LIST_H_
 
 #include <atomic>
 
 #include "src/base/logging.h"
 
 namespace v8 {
-namespace base {
+namespace internal {
+namespace heap {
 
 template <class T>
 class List {
  public:
   List() : front_(nullptr), back_(nullptr) {}
+  List(List&& other) V8_NOEXCEPT : front_(std::exchange(other.front_, nullptr)),
+                                   back_(std::exchange(other.back_, nullptr)) {}
+  List& operator=(List&& other) V8_NOEXCEPT {
+    front_ = std::exchange(other.front_, nullptr);
+    back_ = std::exchange(other.back_, nullptr);
+    return *this;
+  }
+
+  void ShallowCopyTo(List* other) const {
+    other->front_ = front_;
+    other->back_ = back_;
+  }
 
   void PushBack(T* element) {
     DCHECK(!element->list_node().next());
@@ -55,8 +68,8 @@ class List {
     element->list_node().set_next(nullptr);
   }
 
-  bool Contains(T* element) {
-    T* it = front_;
+  bool Contains(T* element) const {
+    const T* it = front_;
     while (it) {
       if (it == element) return true;
       it = it->list_node().next();
@@ -64,11 +77,14 @@ class List {
     return false;
   }
 
-  bool Empty() { return !front_ && !back_; }
+  bool Empty() const { return !front_ && !back_; }
 
   T* front() { return front_; }
   T* back() { return back_; }
 
+  const T* front() const { return front_; }
+  const T* back() const { return back_; }
+
  private:
   void AddFirstElement(T* element) {
     DCHECK(!back_);
@@ -116,6 +132,9 @@ class ListNode {
   T* next() { return next_; }
   T* prev() { return prev_; }
 
+  const T* next() const { return next_; }
+  const T* prev() const { return prev_; }
+
   void Initialize() {
     next_ = nullptr;
     prev_ = nullptr;
@@ -130,7 +149,8 @@ class ListNode {
 
   friend class List<T>;
 };
-}  // namespace base
+}  // namespace heap
+}  // namespace internal
 }  // namespace v8
 
-#endif  // V8_BASE_LIST_H_
+#endif  // V8_HEAP_LIST_H_
diff --git a/deps/v8/src/heap/local-allocator-inl.h b/deps/v8/src/heap/local-allocator-inl.h
index 10d6ce7370f..0f6f7e54539 100644
--- a/deps/v8/src/heap/local-allocator-inl.h
+++ b/deps/v8/src/heap/local-allocator-inl.h
@@ -12,10 +12,10 @@
 namespace v8 {
 namespace internal {
 
-AllocationResult LocalAllocator::Allocate(AllocationSpace space,
-                                          int object_size,
-                                          AllocationOrigin origin,
-                                          AllocationAlignment alignment) {
+AllocationResult EvacuationAllocator::Allocate(AllocationSpace space,
+                                               int object_size,
+                                               AllocationOrigin origin,
+                                               AllocationAlignment alignment) {
   switch (space) {
     case NEW_SPACE:
       return AllocateInNewSpace(object_size, origin, alignment);
@@ -30,8 +30,8 @@ AllocationResult LocalAllocator::Allocate(AllocationSpace space,
   }
 }
 
-void LocalAllocator::FreeLast(AllocationSpace space, HeapObject object,
-                              int object_size) {
+void EvacuationAllocator::FreeLast(AllocationSpace space, HeapObject object,
+                                   int object_size) {
   switch (space) {
     case NEW_SPACE:
       FreeLastInNewSpace(object, object_size);
@@ -45,7 +45,8 @@ void LocalAllocator::FreeLast(AllocationSpace space, HeapObject object,
   }
 }
 
-void LocalAllocator::FreeLastInNewSpace(HeapObject object, int object_size) {
+void EvacuationAllocator::FreeLastInNewSpace(HeapObject object,
+                                             int object_size) {
   if (!new_space_lab_.TryFreeLast(object, object_size)) {
     // We couldn't free the last object so we have to write a proper filler.
     heap_->CreateFillerObjectAt(object.address(), object_size,
@@ -53,7 +54,8 @@ void LocalAllocator::FreeLastInNewSpace(HeapObject object, int object_size) {
   }
 }
 
-void LocalAllocator::FreeLastInOldSpace(HeapObject object, int object_size) {
+void EvacuationAllocator::FreeLastInOldSpace(HeapObject object,
+                                             int object_size) {
   if (!compaction_spaces_.Get(OLD_SPACE)->TryFreeLast(object, object_size)) {
     // We couldn't free the last object so we have to write a proper filler.
     heap_->CreateFillerObjectAt(object.address(), object_size,
@@ -61,8 +63,8 @@ void LocalAllocator::FreeLastInOldSpace(HeapObject object, int object_size) {
   }
 }
 
-AllocationResult LocalAllocator::AllocateInLAB(int object_size,
-                                               AllocationAlignment alignment) {
+AllocationResult EvacuationAllocator::AllocateInLAB(
+    int object_size, AllocationAlignment alignment) {
   AllocationResult allocation;
   if (!new_space_lab_.IsValid() && !NewLocalAllocationBuffer()) {
     return AllocationResult::Retry(OLD_SPACE);
@@ -79,22 +81,24 @@ AllocationResult LocalAllocator::AllocateInLAB(int object_size,
   return allocation;
 }
 
-bool LocalAllocator::NewLocalAllocationBuffer() {
+bool EvacuationAllocator::NewLocalAllocationBuffer() {
   if (lab_allocation_will_fail_) return false;
-  LocalAllocationBuffer saved_lab_ = new_space_lab_;
   AllocationResult result =
       new_space_->AllocateRawSynchronized(kLabSize, kWordAligned);
+  if (result.IsRetry()) {
+    lab_allocation_will_fail_ = true;
+    return false;
+  }
+  LocalAllocationBuffer saved_lab = std::move(new_space_lab_);
   new_space_lab_ = LocalAllocationBuffer::FromResult(heap_, result, kLabSize);
-  if (new_space_lab_.IsValid()) {
-    new_space_lab_.TryMerge(&saved_lab_);
-    return true;
+  DCHECK(new_space_lab_.IsValid());
+  if (!new_space_lab_.TryMerge(&saved_lab)) {
+    saved_lab.CloseAndMakeIterable();
   }
-  new_space_lab_ = saved_lab_;
-  lab_allocation_will_fail_ = true;
-  return false;
+  return true;
 }
 
-AllocationResult LocalAllocator::AllocateInNewSpace(
+AllocationResult EvacuationAllocator::AllocateInNewSpace(
     int object_size, AllocationOrigin origin, AllocationAlignment alignment) {
   if (object_size > kMaxLabObjectSize) {
     return new_space_->AllocateRawSynchronized(object_size, alignment, origin);
diff --git a/deps/v8/src/heap/local-allocator.h b/deps/v8/src/heap/local-allocator.h
index 5ecfe7d8c1a..9e4d5f688cb 100644
--- a/deps/v8/src/heap/local-allocator.h
+++ b/deps/v8/src/heap/local-allocator.h
@@ -7,32 +7,35 @@
 
 #include "src/common/globals.h"
 #include "src/heap/heap.h"
+#include "src/heap/new-spaces.h"
+#include "src/heap/paged-spaces.h"
 #include "src/heap/spaces.h"
 
 namespace v8 {
 namespace internal {
 
-// Allocator encapsulating thread-local allocation. Assumes that all other
-// allocations also go through LocalAllocator.
-class LocalAllocator {
+// Allocator encapsulating thread-local allocation durning collection. Assumes
+// that all other allocations also go through EvacuationAllocator.
+class EvacuationAllocator {
  public:
   static const int kLabSize = 32 * KB;
   static const int kMaxLabObjectSize = 8 * KB;
 
-  explicit LocalAllocator(Heap* heap, LocalSpaceKind local_space_kind)
+  explicit EvacuationAllocator(Heap* heap, LocalSpaceKind local_space_kind)
       : heap_(heap),
         new_space_(heap->new_space()),
         compaction_spaces_(heap, local_space_kind),
         new_space_lab_(LocalAllocationBuffer::InvalidBuffer()),
         lab_allocation_will_fail_(false) {}
 
-  // Needs to be called from the main thread to finalize this LocalAllocator.
+  // Needs to be called from the main thread to finalize this
+  // EvacuationAllocator.
   void Finalize() {
     heap_->old_space()->MergeLocalSpace(compaction_spaces_.Get(OLD_SPACE));
     heap_->code_space()->MergeLocalSpace(compaction_spaces_.Get(CODE_SPACE));
-    // Give back remaining LAB space if this LocalAllocator's new space LAB
+    // Give back remaining LAB space if this EvacuationAllocator's new space LAB
     // sits right next to new space allocation top.
-    const LinearAllocationArea info = new_space_lab_.Close();
+    const LinearAllocationArea info = new_space_lab_.CloseAndMakeIterable();
     const Address top = new_space_->top();
     if (info.limit() != kNullAddress && info.limit() == top) {
       DCHECK_NE(info.top(), kNullAddress);
diff --git a/deps/v8/src/heap/local-heap.cc b/deps/v8/src/heap/local-heap.cc
index 392b3432361..55076bee25d 100644
--- a/deps/v8/src/heap/local-heap.cc
+++ b/deps/v8/src/heap/local-heap.cc
@@ -3,30 +3,62 @@
 // found in the LICENSE file.
 
 #include "src/heap/local-heap.h"
+
+#include <memory>
+
+#include "src/base/platform/mutex.h"
 #include "src/handles/local-handles.h"
-#include "src/heap/heap.h"
+#include "src/heap/heap-inl.h"
 #include "src/heap/safepoint.h"
 
 namespace v8 {
 namespace internal {
 
-LocalHeap::LocalHeap(Heap* heap)
+LocalHeap::LocalHeap(Heap* heap,
+                     std::unique_ptr<PersistentHandles> persistent_handles)
     : heap_(heap),
       state_(ThreadState::Running),
       safepoint_requested_(false),
+      allocation_failed_(false),
       prev_(nullptr),
       next_(nullptr),
-      handles_(new LocalHandles) {
+      handles_(new LocalHandles),
+      persistent_handles_(std::move(persistent_handles)),
+      old_space_allocator_(this, heap->old_space()) {
   heap_->safepoint()->AddLocalHeap(this);
+  if (persistent_handles_) {
+    persistent_handles_->Attach(this);
+  }
 }
 
 LocalHeap::~LocalHeap() {
+  // Give up LAB before parking thread
+  old_space_allocator_.FreeLinearAllocationArea();
+
   // Park thread since removing the local heap could block.
   EnsureParkedBeforeDestruction();
 
   heap_->safepoint()->RemoveLocalHeap(this);
 }
 
+Handle<Object> LocalHeap::NewPersistentHandle(Address value) {
+  if (!persistent_handles_) {
+    persistent_handles_.reset(
+        heap_->isolate()->NewPersistentHandles().release());
+  }
+  return persistent_handles_->NewHandle(value);
+}
+
+std::unique_ptr<PersistentHandles> LocalHeap::DetachPersistentHandles() {
+  if (persistent_handles_) persistent_handles_->Detach();
+  return std::move(persistent_handles_);
+}
+
+bool LocalHeap::IsParked() {
+  base::MutexGuard guard(&state_mutex_);
+  return state_ == ThreadState::Parked;
+}
+
 void LocalHeap::Park() {
   base::MutexGuard guard(&state_mutex_);
   CHECK(state_ == ThreadState::Running);
@@ -67,5 +99,21 @@ void LocalHeap::ClearSafepointRequested() {
 
 void LocalHeap::EnterSafepoint() { heap_->safepoint()->EnterFromThread(this); }
 
+void LocalHeap::FreeLinearAllocationArea() {
+  old_space_allocator_.FreeLinearAllocationArea();
+}
+
+void LocalHeap::MakeLinearAllocationAreaIterable() {
+  old_space_allocator_.MakeLinearAllocationAreaIterable();
+}
+
+void LocalHeap::MarkLinearAllocationAreaBlack() {
+  old_space_allocator_.MarkLinearAllocationAreaBlack();
+}
+
+void LocalHeap::UnmarkLinearAllocationArea() {
+  old_space_allocator_.UnmarkLinearAllocationArea();
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/heap/local-heap.h b/deps/v8/src/heap/local-heap.h
index a6eed1d928a..69522f2d940 100644
--- a/deps/v8/src/heap/local-heap.h
+++ b/deps/v8/src/heap/local-heap.h
@@ -10,6 +10,8 @@
 
 #include "src/base/platform/condition-variable.h"
 #include "src/base/platform/mutex.h"
+#include "src/execution/isolate.h"
+#include "src/heap/concurrent-allocator.h"
 
 namespace v8 {
 namespace internal {
@@ -17,10 +19,13 @@ namespace internal {
 class Heap;
 class Safepoint;
 class LocalHandles;
+class PersistentHandles;
 
 class LocalHeap {
  public:
-  V8_EXPORT_PRIVATE explicit LocalHeap(Heap* heap);
+  V8_EXPORT_PRIVATE explicit LocalHeap(
+      Heap* heap,
+      std::unique_ptr<PersistentHandles> persistent_handles = nullptr);
   V8_EXPORT_PRIVATE ~LocalHeap();
 
   // Invoked by main thread to signal this thread that it needs to halt in a
@@ -33,6 +38,27 @@ class LocalHeap {
 
   LocalHandles* handles() { return handles_.get(); }
 
+  V8_EXPORT_PRIVATE Handle<Object> NewPersistentHandle(Address value);
+  V8_EXPORT_PRIVATE std::unique_ptr<PersistentHandles>
+  DetachPersistentHandles();
+
+  bool IsParked();
+
+  Heap* heap() { return heap_; }
+
+  ConcurrentAllocator* old_space_allocator() { return &old_space_allocator_; }
+
+  // Mark/Unmark linear allocation areas black. Used for black allocation.
+  void MarkLinearAllocationAreaBlack();
+  void UnmarkLinearAllocationArea();
+
+  // Give up linear allocation areas. Used for mark-compact GC.
+  void FreeLinearAllocationArea();
+
+  // Create filler object in linear allocation areas. Verifying requires
+  // iterable heap.
+  void MakeLinearAllocationAreaIterable();
+
  private:
   enum class ThreadState {
     // Threads in this state need to be stopped in a safepoint.
@@ -61,14 +87,20 @@ class LocalHeap {
 
   std::atomic<bool> safepoint_requested_;
 
+  bool allocation_failed_;
+
   LocalHeap* prev_;
   LocalHeap* next_;
 
   std::unique_ptr<LocalHandles> handles_;
+  std::unique_ptr<PersistentHandles> persistent_handles_;
+
+  ConcurrentAllocator old_space_allocator_;
 
   friend class Heap;
-  friend class Safepoint;
+  friend class GlobalSafepoint;
   friend class ParkedScope;
+  friend class ConcurrentAllocator;
 };
 
 class ParkedScope {
diff --git a/deps/v8/src/heap/mark-compact-inl.h b/deps/v8/src/heap/mark-compact-inl.h
index 295982beb54..7c06286f97a 100644
--- a/deps/v8/src/heap/mark-compact-inl.h
+++ b/deps/v8/src/heap/mark-compact-inl.h
@@ -5,14 +5,13 @@
 #ifndef V8_HEAP_MARK_COMPACT_INL_H_
 #define V8_HEAP_MARK_COMPACT_INL_H_
 
-#include "src/heap/mark-compact.h"
-
 #include "src/base/bits.h"
 #include "src/codegen/assembler-inl.h"
 #include "src/heap/heap-inl.h"
 #include "src/heap/incremental-marking.h"
+#include "src/heap/mark-compact.h"
 #include "src/heap/objects-visiting-inl.h"
-#include "src/heap/remembered-set.h"
+#include "src/heap/remembered-set-inl.h"
 #include "src/objects/js-collection-inl.h"
 #include "src/objects/js-weak-refs-inl.h"
 #include "src/objects/slots-inl.h"
diff --git a/deps/v8/src/heap/mark-compact.cc b/deps/v8/src/heap/mark-compact.cc
index 7a87adb5f6f..9c2fc2d68d0 100644
--- a/deps/v8/src/heap/mark-compact.cc
+++ b/deps/v8/src/heap/mark-compact.cc
@@ -16,10 +16,12 @@
 #include "src/heap/array-buffer-collector.h"
 #include "src/heap/array-buffer-sweeper.h"
 #include "src/heap/array-buffer-tracker-inl.h"
+#include "src/heap/code-object-registry.h"
 #include "src/heap/gc-tracer.h"
 #include "src/heap/incremental-marking-inl.h"
 #include "src/heap/invalidated-slots-inl.h"
 #include "src/heap/item-parallel-job.h"
+#include "src/heap/large-spaces.h"
 #include "src/heap/local-allocator-inl.h"
 #include "src/heap/mark-compact-inl.h"
 #include "src/heap/marking-visitor-inl.h"
@@ -29,6 +31,8 @@
 #include "src/heap/object-stats.h"
 #include "src/heap/objects-visiting-inl.h"
 #include "src/heap/read-only-heap.h"
+#include "src/heap/read-only-spaces.h"
+#include "src/heap/safepoint.h"
 #include "src/heap/spaces-inl.h"
 #include "src/heap/sweeper.h"
 #include "src/heap/worklist.h"
@@ -96,7 +100,7 @@ class MarkingVerifier : public ObjectVisitor, public RootVisitor {
     VerifyRootPointers(start, end);
   }
 
-  void VerifyRoots(VisitMode mode);
+  void VerifyRoots();
   void VerifyMarkingOnPage(const Page* page, Address start, Address end);
   void VerifyMarking(NewSpace* new_space);
   void VerifyMarking(PagedSpace* paged_space);
@@ -105,8 +109,8 @@ class MarkingVerifier : public ObjectVisitor, public RootVisitor {
   Heap* heap_;
 };
 
-void MarkingVerifier::VerifyRoots(VisitMode mode) {
-  heap_->IterateStrongRoots(this, mode);
+void MarkingVerifier::VerifyRoots() {
+  heap_->IterateRoots(this, base::EnumSet<SkipRoot>{SkipRoot::kWeak});
 }
 
 void MarkingVerifier::VerifyMarkingOnPage(const Page* page, Address start,
@@ -177,7 +181,7 @@ class FullMarkingVerifier : public MarkingVerifier {
             heap->mark_compact_collector()->non_atomic_marking_state()) {}
 
   void Run() override {
-    VerifyRoots(VISIT_ONLY_STRONG);
+    VerifyRoots();
     VerifyMarking(heap_->new_space());
     VerifyMarking(heap_->new_lo_space());
     VerifyMarking(heap_->old_space());
@@ -273,7 +277,7 @@ class EvacuationVerifier : public ObjectVisitor, public RootVisitor {
   virtual void VerifyPointers(MaybeObjectSlot start, MaybeObjectSlot end) = 0;
   virtual void VerifyRootPointers(FullObjectSlot start, FullObjectSlot end) = 0;
 
-  void VerifyRoots(VisitMode mode);
+  void VerifyRoots();
   void VerifyEvacuationOnPage(Address start, Address end);
   void VerifyEvacuation(NewSpace* new_space);
   void VerifyEvacuation(PagedSpace* paged_space);
@@ -281,8 +285,8 @@ class EvacuationVerifier : public ObjectVisitor, public RootVisitor {
   Heap* heap_;
 };
 
-void EvacuationVerifier::VerifyRoots(VisitMode mode) {
-  heap_->IterateStrongRoots(this, mode);
+void EvacuationVerifier::VerifyRoots() {
+  heap_->IterateRoots(this, base::EnumSet<SkipRoot>{SkipRoot::kWeak});
 }
 
 void EvacuationVerifier::VerifyEvacuationOnPage(Address start, Address end) {
@@ -323,7 +327,7 @@ class FullEvacuationVerifier : public EvacuationVerifier {
   explicit FullEvacuationVerifier(Heap* heap) : EvacuationVerifier(heap) {}
 
   void Run() override {
-    VerifyRoots(VISIT_ALL);
+    VerifyRoots();
     VerifyEvacuation(heap_->new_space());
     VerifyEvacuation(heap_->old_space());
     VerifyEvacuation(heap_->code_space());
@@ -866,6 +870,13 @@ void MarkCompactCollector::Prepare() {
        space = spaces.Next()) {
     space->PrepareForMarkCompact();
   }
+
+  if (FLAG_local_heaps) {
+    // Fill and reset all background thread LABs
+    heap_->safepoint()->IterateLocalHeaps(
+        [](LocalHeap* local_heap) { local_heap->FreeLinearAllocationArea(); });
+  }
+
   heap()->account_external_memory_concurrently_freed();
 }
 
@@ -1323,7 +1334,7 @@ class EvacuateVisitorBase : public HeapObjectVisitor {
     src.set_map_word(MapWord::FromForwardingAddress(dst));
   }
 
-  EvacuateVisitorBase(Heap* heap, LocalAllocator* local_allocator,
+  EvacuateVisitorBase(Heap* heap, EvacuationAllocator* local_allocator,
                       RecordMigratedSlotVisitor* record_visitor)
       : heap_(heap),
         local_allocator_(local_allocator),
@@ -1382,7 +1393,7 @@ class EvacuateVisitorBase : public HeapObjectVisitor {
 #endif  // VERIFY_HEAP
 
   Heap* heap_;
-  LocalAllocator* local_allocator_;
+  EvacuationAllocator* local_allocator_;
   RecordMigratedSlotVisitor* record_visitor_;
   std::vector<MigrationObserver*> observers_;
   MigrateFunction migration_function_;
@@ -1391,7 +1402,7 @@ class EvacuateVisitorBase : public HeapObjectVisitor {
 class EvacuateNewSpaceVisitor final : public EvacuateVisitorBase {
  public:
   explicit EvacuateNewSpaceVisitor(
-      Heap* heap, LocalAllocator* local_allocator,
+      Heap* heap, EvacuationAllocator* local_allocator,
       RecordMigratedSlotVisitor* record_visitor,
       Heap::PretenuringFeedbackMap* local_pretenuring_feedback,
       bool always_promote_young)
@@ -1545,7 +1556,7 @@ class EvacuateNewSpacePageVisitor final : public HeapObjectVisitor {
 
 class EvacuateOldSpaceVisitor final : public EvacuateVisitorBase {
  public:
-  EvacuateOldSpaceVisitor(Heap* heap, LocalAllocator* local_allocator,
+  EvacuateOldSpaceVisitor(Heap* heap, EvacuationAllocator* local_allocator,
                           RecordMigratedSlotVisitor* record_visitor)
       : EvacuateVisitorBase(heap, local_allocator, record_visitor) {}
 
@@ -1602,7 +1613,7 @@ void MarkCompactCollector::MarkRoots(RootVisitor* root_visitor,
                                      ObjectVisitor* custom_root_body_visitor) {
   // Mark the heap roots including global variables, stack variables,
   // etc., and all objects reachable from them.
-  heap()->IterateStrongRoots(root_visitor, VISIT_ONLY_STRONG);
+  heap()->IterateRoots(root_visitor, base::EnumSet<SkipRoot>{SkipRoot::kWeak});
 
   // Custom marking for string table and top optimized frame.
   MarkStringTable(custom_root_body_visitor);
@@ -2535,9 +2546,7 @@ void MarkCompactCollector::ClearJSWeakRefs() {
       RecordSlot(weak_cell, slot, HeapObject::cast(*slot));
     }
   }
-  if (!isolate()->host_cleanup_finalization_group_callback()) {
-    heap()->PostFinalizationRegistryCleanupTaskIfNeeded();
-  }
+  heap()->PostFinalizationRegistryCleanupTaskIfNeeded();
 }
 
 void MarkCompactCollector::AbortWeakObjects() {
@@ -2575,11 +2584,11 @@ MarkCompactCollector::PrepareRecordRelocSlot(Code host, RelocInfo* rinfo,
       addr = rinfo->constant_pool_entry_address();
       if (RelocInfo::IsCodeTargetMode(rmode)) {
         slot_type = CODE_ENTRY_SLOT;
+      } else if (RelocInfo::IsCompressedEmbeddedObject(rmode)) {
+        slot_type = COMPRESSED_OBJECT_SLOT;
       } else {
-        // Constant pools don't support compressed values at this time
-        // (this may change, therefore use a DCHECK).
         DCHECK(RelocInfo::IsFullEmbeddedObject(rmode));
-        slot_type = OBJECT_SLOT;
+        slot_type = FULL_OBJECT_SLOT;
       }
     }
     uintptr_t offset = addr - source_page->address();
@@ -2869,7 +2878,7 @@ class Evacuator : public Malloced {
   }
 
   Evacuator(Heap* heap, RecordMigratedSlotVisitor* record_visitor,
-            LocalAllocator* local_allocator, bool always_promote_young)
+            EvacuationAllocator* local_allocator, bool always_promote_young)
       : heap_(heap),
         local_pretenuring_feedback_(kInitialLocalPretenuringFeedbackCapacity),
         new_space_visitor_(heap_, local_allocator, record_visitor,
@@ -2927,7 +2936,7 @@ class Evacuator : public Malloced {
   EvacuateOldSpaceVisitor old_space_visitor_;
 
   // Locally cached collector data.
-  LocalAllocator* local_allocator_;
+  EvacuationAllocator* local_allocator_;
 
   // Book keeping info.
   double duration_;
@@ -3015,7 +3024,7 @@ class FullEvacuator : public Evacuator {
   void RawEvacuatePage(MemoryChunk* chunk, intptr_t* live_bytes) override;
   EphemeronRememberedSet ephemeron_remembered_set_;
   RecordMigratedSlotVisitor record_visitor_;
-  LocalAllocator local_allocator_;
+  EvacuationAllocator local_allocator_;
 
   MarkCompactCollector* collector_;
 };
@@ -3877,7 +3886,9 @@ void MarkCompactCollector::UpdatePointersAfterEvacuation() {
   {
     TRACE_GC(heap()->tracer(),
              GCTracer::Scope::MC_EVACUATE_UPDATE_POINTERS_TO_NEW_ROOTS);
-    heap_->IterateRoots(&updating_visitor, VISIT_ALL_IN_SWEEP_NEWSPACE);
+    // The external string table is updated at the end.
+    heap_->IterateRoots(&updating_visitor, base::EnumSet<SkipRoot>{
+                                               SkipRoot::kExternalStringTable});
   }
 
   {
@@ -4131,7 +4142,7 @@ class YoungGenerationMarkingVerifier : public MarkingVerifier {
   }
 
   void Run() override {
-    VerifyRoots(VISIT_ALL_IN_SCAVENGE);
+    VerifyRoots();
     VerifyMarking(heap_->new_space());
   }
 
@@ -4181,7 +4192,7 @@ class YoungGenerationEvacuationVerifier : public EvacuationVerifier {
       : EvacuationVerifier(heap) {}
 
   void Run() override {
-    VerifyRoots(VISIT_ALL_IN_SCAVENGE);
+    VerifyRoots();
     VerifyEvacuation(heap_->new_space());
     VerifyEvacuation(heap_->old_space());
     VerifyEvacuation(heap_->code_space());
@@ -4461,7 +4472,9 @@ void MinorMarkCompactCollector::UpdatePointersAfterEvacuation() {
   {
     TRACE_GC(heap()->tracer(),
              GCTracer::Scope::MINOR_MC_EVACUATE_UPDATE_POINTERS_TO_NEW_ROOTS);
-    heap_->IterateRoots(&updating_visitor, VISIT_ALL_IN_MINOR_MC_UPDATE);
+    heap()->IterateRoots(&updating_visitor,
+                         base::EnumSet<SkipRoot>{SkipRoot::kExternalStringTable,
+                                                 SkipRoot::kOldGeneration});
   }
   {
     TRACE_GC(heap()->tracer(),
@@ -4703,6 +4716,7 @@ void MinorMarkCompactCollector::EvacuatePrologue() {
        PageRange(new_space->first_allocatable_address(), new_space->top())) {
     new_space_evacuation_pages_.push_back(p);
   }
+
   new_space->Flip();
   new_space->ResetLinearAllocationArea();
 
@@ -4915,7 +4929,15 @@ void MinorMarkCompactCollector::MarkRootSetInParallel(
       TRACE_GC(heap()->tracer(), GCTracer::Scope::MINOR_MC_MARK_SEED);
       isolate()->global_handles()->IdentifyWeakUnmodifiedObjects(
           &JSObject::IsUnmodifiedApiObject);
-      heap()->IterateRoots(root_visitor, VISIT_ALL_IN_MINOR_MC_MARK);
+      // MinorMC treats all weak roots except for global handles as strong.
+      // That is why we don't set skip_weak = true here and instead visit
+      // global handles separately.
+      heap()->IterateRoots(
+          root_visitor, base::EnumSet<SkipRoot>{SkipRoot::kExternalStringTable,
+                                                SkipRoot::kGlobalHandles,
+                                                SkipRoot::kOldGeneration});
+      isolate()->global_handles()->IterateYoungStrongAndDependentRoots(
+          root_visitor);
       // Create items for each page.
       RememberedSet<OLD_TO_NEW>::IterateMemoryChunks(
           heap(), [&job, &slots](MemoryChunk* chunk) {
@@ -4967,6 +4989,10 @@ void MinorMarkCompactCollector::MarkLiveObjects() {
             &root_visitor, &IsUnmarkedObjectForYoungGeneration);
     DrainMarkingWorklist();
   }
+
+  if (FLAG_minor_mc_trace_fragmentation) {
+    TraceFragmentation();
+  }
 }
 
 void MinorMarkCompactCollector::DrainMarkingWorklist() {
@@ -4982,6 +5008,57 @@ void MinorMarkCompactCollector::DrainMarkingWorklist() {
   DCHECK(marking_worklist.IsLocalEmpty());
 }
 
+void MinorMarkCompactCollector::TraceFragmentation() {
+  NewSpace* new_space = heap()->new_space();
+  const std::array<size_t, 4> free_size_class_limits = {0, 1024, 2048, 4096};
+  size_t free_bytes_of_class[free_size_class_limits.size()] = {0};
+  size_t live_bytes = 0;
+  size_t allocatable_bytes = 0;
+  for (Page* p :
+       PageRange(new_space->first_allocatable_address(), new_space->top())) {
+    Address free_start = p->area_start();
+    for (auto object_and_size : LiveObjectRange<kGreyObjects>(
+             p, non_atomic_marking_state()->bitmap(p))) {
+      HeapObject const object = object_and_size.first;
+      Address free_end = object.address();
+      if (free_end != free_start) {
+        size_t free_bytes = free_end - free_start;
+        int free_bytes_index = 0;
+        for (auto free_size_class_limit : free_size_class_limits) {
+          if (free_bytes >= free_size_class_limit) {
+            free_bytes_of_class[free_bytes_index] += free_bytes;
+          }
+          free_bytes_index++;
+        }
+      }
+      Map map = object.synchronized_map();
+      int size = object.SizeFromMap(map);
+      live_bytes += size;
+      free_start = free_end + size;
+    }
+    size_t area_end =
+        p->Contains(new_space->top()) ? new_space->top() : p->area_end();
+    if (free_start != area_end) {
+      size_t free_bytes = area_end - free_start;
+      int free_bytes_index = 0;
+      for (auto free_size_class_limit : free_size_class_limits) {
+        if (free_bytes >= free_size_class_limit) {
+          free_bytes_of_class[free_bytes_index] += free_bytes;
+        }
+        free_bytes_index++;
+      }
+    }
+    allocatable_bytes += area_end - p->area_start();
+    CHECK_EQ(allocatable_bytes, live_bytes + free_bytes_of_class[0]);
+  }
+  PrintIsolate(
+      isolate(),
+      "Minor Mark-Compact Fragmentation: allocatable_bytes=%zu live_bytes=%zu "
+      "free_bytes=%zu free_bytes_1K=%zu free_bytes_2K=%zu free_bytes_4K=%zu\n",
+      allocatable_bytes, live_bytes, free_bytes_of_class[0],
+      free_bytes_of_class[1], free_bytes_of_class[2], free_bytes_of_class[3]);
+}
+
 void MinorMarkCompactCollector::Evacuate() {
   TRACE_GC(heap()->tracer(), GCTracer::Scope::MINOR_MC_EVACUATE);
   base::MutexGuard guard(heap()->relocation_mutex());
@@ -5049,7 +5126,7 @@ class YoungGenerationEvacuator : public Evacuator {
   void RawEvacuatePage(MemoryChunk* chunk, intptr_t* live_bytes) override;
 
   YoungGenerationRecordMigratedSlotVisitor record_visitor_;
-  LocalAllocator local_allocator_;
+  EvacuationAllocator local_allocator_;
   MinorMarkCompactCollector* collector_;
 };
 
diff --git a/deps/v8/src/heap/mark-compact.h b/deps/v8/src/heap/mark-compact.h
index 7e13db21457..fec16ceee69 100644
--- a/deps/v8/src/heap/mark-compact.h
+++ b/deps/v8/src/heap/mark-compact.h
@@ -24,6 +24,7 @@ class EvacuationJobTraits;
 class HeapObjectVisitor;
 class ItemParallelJob;
 class MigrationObserver;
+class ReadOnlySpace;
 class RecordMigratedSlotVisitor;
 class UpdatingItem;
 class YoungGenerationMarkingVisitor;
@@ -295,22 +296,22 @@ class MajorMarkingState final
   ConcurrentBitmap<AccessMode::ATOMIC>* bitmap(const MemoryChunk* chunk) const {
     DCHECK_EQ(reinterpret_cast<intptr_t>(&chunk->marking_bitmap_) -
                   reinterpret_cast<intptr_t>(chunk),
-              MemoryChunk::kMarkBitmapOffset);
+              BasicMemoryChunk::kMarkBitmapOffset);
     return chunk->marking_bitmap<AccessMode::ATOMIC>();
   }
 
   // Concurrent marking uses local live bytes so we may do these accesses
   // non-atomically.
   void IncrementLiveBytes(MemoryChunk* chunk, intptr_t by) {
-    chunk->live_byte_count_ += by;
+    chunk->live_byte_count_.fetch_add(by, std::memory_order_relaxed);
   }
 
   intptr_t live_bytes(MemoryChunk* chunk) const {
-    return chunk->live_byte_count_;
+    return chunk->live_byte_count_.load(std::memory_order_relaxed);
   }
 
   void SetLiveBytes(MemoryChunk* chunk, intptr_t value) {
-    chunk->live_byte_count_ = value;
+    chunk->live_byte_count_.store(value, std::memory_order_relaxed);
   }
 };
 
@@ -322,13 +323,12 @@ class MajorAtomicMarkingState final
   ConcurrentBitmap<AccessMode::ATOMIC>* bitmap(const MemoryChunk* chunk) const {
     DCHECK_EQ(reinterpret_cast<intptr_t>(&chunk->marking_bitmap_) -
                   reinterpret_cast<intptr_t>(chunk),
-              MemoryChunk::kMarkBitmapOffset);
+              BasicMemoryChunk::kMarkBitmapOffset);
     return chunk->marking_bitmap<AccessMode::ATOMIC>();
   }
 
   void IncrementLiveBytes(MemoryChunk* chunk, intptr_t by) {
-    std::atomic_fetch_add(
-        reinterpret_cast<std::atomic<intptr_t>*>(&chunk->live_byte_count_), by);
+    chunk->live_byte_count_.fetch_add(by);
   }
 };
 
@@ -340,20 +340,20 @@ class MajorNonAtomicMarkingState final
       const MemoryChunk* chunk) const {
     DCHECK_EQ(reinterpret_cast<intptr_t>(&chunk->marking_bitmap_) -
                   reinterpret_cast<intptr_t>(chunk),
-              MemoryChunk::kMarkBitmapOffset);
+              BasicMemoryChunk::kMarkBitmapOffset);
     return chunk->marking_bitmap<AccessMode::NON_ATOMIC>();
   }
 
   void IncrementLiveBytes(MemoryChunk* chunk, intptr_t by) {
-    chunk->live_byte_count_ += by;
+    chunk->live_byte_count_.fetch_add(by, std::memory_order_relaxed);
   }
 
   intptr_t live_bytes(MemoryChunk* chunk) const {
-    return chunk->live_byte_count_;
+    return chunk->live_byte_count_.load(std::memory_order_relaxed);
   }
 
   void SetLiveBytes(MemoryChunk* chunk, intptr_t value) {
-    chunk->live_byte_count_ = value;
+    chunk->live_byte_count_.store(value, std::memory_order_relaxed);
   }
 };
 
@@ -514,9 +514,6 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
                                    HeapObjectSlot slot, HeapObject target);
   void RecordLiveSlotsOnPage(Page* page);
 
-  void UpdateSlots(SlotsBuffer* buffer);
-  void UpdateSlotsRecordedIn(SlotsBuffer* buffer);
-
   bool is_compacting() const { return compacting_; }
 
   // Ensures that sweeping is finished.
@@ -566,7 +563,6 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
 
   void VerifyMarking();
 #ifdef VERIFY_HEAP
-  void VerifyValidStoreAndSlotsBufferEntries();
   void VerifyMarkbitsAreClean();
   void VerifyMarkbitsAreDirty(ReadOnlySpace* space);
   void VerifyMarkbitsAreClean(PagedSpace* space);
@@ -855,6 +851,7 @@ class MinorMarkCompactCollector final : public MarkCompactCollectorBase {
   void MarkRootSetInParallel(RootMarkingVisitor* root_visitor);
   V8_INLINE void MarkRootObject(HeapObject obj);
   void DrainMarkingWorklist() override;
+  void TraceFragmentation();
   void ClearNonLiveReferences() override;
 
   void EvacuatePrologue() override;
diff --git a/deps/v8/src/heap/marking-visitor-inl.h b/deps/v8/src/heap/marking-visitor-inl.h
index e162268e303..ba45bf16748 100644
--- a/deps/v8/src/heap/marking-visitor-inl.h
+++ b/deps/v8/src/heap/marking-visitor-inl.h
@@ -323,26 +323,23 @@ int MarkingVisitorBase<ConcreteVisitor, MarkingState>::VisitWeakCell(
   int size = WeakCell::BodyDescriptor::SizeOf(map, weak_cell);
   this->VisitMapPointer(weak_cell);
   WeakCell::BodyDescriptor::IterateBody(map, weak_cell, size, this);
-  if (weak_cell.target().IsHeapObject()) {
-    HeapObject target = HeapObject::cast(weak_cell.target());
-    HeapObject unregister_token =
-        HeapObject::cast(weak_cell.unregister_token());
-    concrete_visitor()->SynchronizePageAccess(target);
-    concrete_visitor()->SynchronizePageAccess(unregister_token);
-    if (concrete_visitor()->marking_state()->IsBlackOrGrey(target) &&
-        concrete_visitor()->marking_state()->IsBlackOrGrey(unregister_token)) {
-      // Record the slots inside the WeakCell, since the IterateBody above
-      // didn't visit it.
-      ObjectSlot slot = weak_cell.RawField(WeakCell::kTargetOffset);
-      concrete_visitor()->RecordSlot(weak_cell, slot, target);
-      slot = weak_cell.RawField(WeakCell::kUnregisterTokenOffset);
-      concrete_visitor()->RecordSlot(weak_cell, slot, unregister_token);
-    } else {
-      // WeakCell points to a potentially dead object or a dead unregister
-      // token. We have to process them when we know the liveness of the whole
-      // transitive closure.
-      weak_objects_->weak_cells.Push(task_id_, weak_cell);
-    }
+  HeapObject target = weak_cell.relaxed_target();
+  HeapObject unregister_token = HeapObject::cast(weak_cell.unregister_token());
+  concrete_visitor()->SynchronizePageAccess(target);
+  concrete_visitor()->SynchronizePageAccess(unregister_token);
+  if (concrete_visitor()->marking_state()->IsBlackOrGrey(target) &&
+      concrete_visitor()->marking_state()->IsBlackOrGrey(unregister_token)) {
+    // Record the slots inside the WeakCell, since the IterateBody above
+    // didn't visit it.
+    ObjectSlot slot = weak_cell.RawField(WeakCell::kTargetOffset);
+    concrete_visitor()->RecordSlot(weak_cell, slot, target);
+    slot = weak_cell.RawField(WeakCell::kUnregisterTokenOffset);
+    concrete_visitor()->RecordSlot(weak_cell, slot, unregister_token);
+  } else {
+    // WeakCell points to a potentially dead object or a dead unregister
+    // token. We have to process them when we know the liveness of the whole
+    // transitive closure.
+    weak_objects_->weak_cells.Push(task_id_, weak_cell);
   }
   return size;
 }
diff --git a/deps/v8/src/heap/marking-visitor.h b/deps/v8/src/heap/marking-visitor.h
index a94978a8b29..a4c2a9f522c 100644
--- a/deps/v8/src/heap/marking-visitor.h
+++ b/deps/v8/src/heap/marking-visitor.h
@@ -8,6 +8,7 @@
 #include "src/common/globals.h"
 #include "src/heap/marking-worklist.h"
 #include "src/heap/marking.h"
+#include "src/heap/memory-chunk.h"
 #include "src/heap/objects-visiting.h"
 #include "src/heap/spaces.h"
 #include "src/heap/worklist.h"
diff --git a/deps/v8/src/heap/marking.cc b/deps/v8/src/heap/marking.cc
index ceda7d68d21..af76bbb12ec 100644
--- a/deps/v8/src/heap/marking.cc
+++ b/deps/v8/src/heap/marking.cc
@@ -7,6 +7,8 @@
 namespace v8 {
 namespace internal {
 
+const size_t Bitmap::kSize = Bitmap::CellsCount() * Bitmap::kBytesPerCell;
+
 template <>
 bool ConcurrentBitmap<AccessMode::NON_ATOMIC>::AllBitsSetInRange(
     uint32_t start_index, uint32_t end_index) {
@@ -77,7 +79,7 @@ class CellPrinter {
  public:
   CellPrinter() : seq_start(0), seq_type(0), seq_length(0) {}
 
-  void Print(uint32_t pos, uint32_t cell) {
+  void Print(size_t pos, uint32_t cell) {
     if (cell == seq_type) {
       seq_length++;
       return;
@@ -92,14 +94,14 @@ class CellPrinter {
       return;
     }
 
-    PrintF("%d: ", pos);
+    PrintF("%zu: ", pos);
     PrintWord(cell);
     PrintF("\n");
   }
 
   void Flush() {
     if (seq_length > 0) {
-      PrintF("%d: %dx%d\n", seq_start, seq_type == 0 ? 0 : 1,
+      PrintF("%zu: %dx%zu\n", seq_start, seq_type == 0 ? 0 : 1,
              seq_length * Bitmap::kBitsPerCell);
       seq_length = 0;
     }
@@ -108,9 +110,9 @@ class CellPrinter {
   static bool IsSeq(uint32_t cell) { return cell == 0 || cell == 0xFFFFFFFF; }
 
  private:
-  uint32_t seq_start;
+  size_t seq_start;
   uint32_t seq_type;
-  uint32_t seq_length;
+  size_t seq_length;
 };
 
 }  // anonymous namespace
@@ -118,7 +120,7 @@ class CellPrinter {
 template <>
 void ConcurrentBitmap<AccessMode::NON_ATOMIC>::Print() {
   CellPrinter printer;
-  for (int i = 0; i < CellsCount(); i++) {
+  for (size_t i = 0; i < CellsCount(); i++) {
     printer.Print(i, cells()[i]);
   }
   printer.Flush();
@@ -127,7 +129,7 @@ void ConcurrentBitmap<AccessMode::NON_ATOMIC>::Print() {
 
 template <>
 bool ConcurrentBitmap<AccessMode::NON_ATOMIC>::IsClean() {
-  for (int i = 0; i < CellsCount(); i++) {
+  for (size_t i = 0; i < CellsCount(); i++) {
     if (cells()[i] != 0) {
       return false;
     }
diff --git a/deps/v8/src/heap/marking.h b/deps/v8/src/heap/marking.h
index 6d73b0c4b4b..fc87041d4eb 100644
--- a/deps/v8/src/heap/marking.h
+++ b/deps/v8/src/heap/marking.h
@@ -98,16 +98,18 @@ class V8_EXPORT_PRIVATE Bitmap {
   static const uint32_t kBytesPerCell = kBitsPerCell / kBitsPerByte;
   static const uint32_t kBytesPerCellLog2 = kBitsPerCellLog2 - kBitsPerByteLog2;
 
-  static const size_t kLength = (1 << kPageSizeBits) >> (kTaggedSizeLog2);
-
-  static const size_t kSize = (1 << kPageSizeBits) >>
-                              (kTaggedSizeLog2 + kBitsPerByteLog2);
-
-  static int CellsForLength(int length) {
+  // The length is the number of bits in this bitmap. (+1) accounts for
+  // the case where the markbits are queried for a one-word filler at the
+  // end of the page.
+  static const size_t kLength = ((1 << kPageSizeBits) >> kTaggedSizeLog2) + 1;
+  // The size of the bitmap in bytes is CellsCount() * kBytesPerCell.
+  static const size_t kSize;
+
+  static constexpr size_t CellsForLength(int length) {
     return (length + kBitsPerCell - 1) >> kBitsPerCellLog2;
   }
 
-  int CellsCount() { return CellsForLength(kLength); }
+  static constexpr size_t CellsCount() { return CellsForLength(kLength); }
 
   V8_INLINE static uint32_t IndexToCell(uint32_t index) {
     return index >> kBitsPerCellLog2;
diff --git a/deps/v8/src/heap/memory-allocator.cc b/deps/v8/src/heap/memory-allocator.cc
new file mode 100644
index 00000000000..9bef95a7341
--- /dev/null
+++ b/deps/v8/src/heap/memory-allocator.cc
@@ -0,0 +1,734 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/memory-allocator.h"
+
+#include <cinttypes>
+
+#include "src/base/address-region.h"
+#include "src/execution/isolate.h"
+#include "src/flags/flags.h"
+#include "src/heap/gc-tracer.h"
+#include "src/heap/heap-inl.h"
+#include "src/heap/memory-chunk.h"
+#include "src/logging/log.h"
+
+namespace v8 {
+namespace internal {
+
+static base::LazyInstance<CodeRangeAddressHint>::type code_range_address_hint =
+    LAZY_INSTANCE_INITIALIZER;
+
+Address CodeRangeAddressHint::GetAddressHint(size_t code_range_size) {
+  base::MutexGuard guard(&mutex_);
+  auto it = recently_freed_.find(code_range_size);
+  if (it == recently_freed_.end() || it->second.empty()) {
+    return reinterpret_cast<Address>(GetRandomMmapAddr());
+  }
+  Address result = it->second.back();
+  it->second.pop_back();
+  return result;
+}
+
+void CodeRangeAddressHint::NotifyFreedCodeRange(Address code_range_start,
+                                                size_t code_range_size) {
+  base::MutexGuard guard(&mutex_);
+  recently_freed_[code_range_size].push_back(code_range_start);
+}
+
+// -----------------------------------------------------------------------------
+// MemoryAllocator
+//
+
+MemoryAllocator::MemoryAllocator(Isolate* isolate, size_t capacity,
+                                 size_t code_range_size)
+    : isolate_(isolate),
+      data_page_allocator_(isolate->page_allocator()),
+      code_page_allocator_(nullptr),
+      capacity_(RoundUp(capacity, Page::kPageSize)),
+      size_(0),
+      size_executable_(0),
+      lowest_ever_allocated_(static_cast<Address>(-1ll)),
+      highest_ever_allocated_(kNullAddress),
+      unmapper_(isolate->heap(), this) {
+  InitializeCodePageAllocator(data_page_allocator_, code_range_size);
+}
+
+void MemoryAllocator::InitializeCodePageAllocator(
+    v8::PageAllocator* page_allocator, size_t requested) {
+  DCHECK_NULL(code_page_allocator_instance_.get());
+
+  code_page_allocator_ = page_allocator;
+
+  if (requested == 0) {
+    if (!isolate_->RequiresCodeRange()) return;
+    // When a target requires the code range feature, we put all code objects
+    // in a kMaximalCodeRangeSize range of virtual address space, so that
+    // they can call each other with near calls.
+    requested = kMaximalCodeRangeSize;
+  } else if (requested <= kMinimumCodeRangeSize) {
+    requested = kMinimumCodeRangeSize;
+  }
+
+  const size_t reserved_area =
+      kReservedCodeRangePages * MemoryAllocator::GetCommitPageSize();
+  if (requested < (kMaximalCodeRangeSize - reserved_area)) {
+    requested += RoundUp(reserved_area, MemoryChunk::kPageSize);
+    // Fullfilling both reserved pages requirement and huge code area
+    // alignments is not supported (requires re-implementation).
+    DCHECK_LE(kMinExpectedOSPageSize, page_allocator->AllocatePageSize());
+  }
+  DCHECK(!isolate_->RequiresCodeRange() || requested <= kMaximalCodeRangeSize);
+
+  Address hint =
+      RoundDown(code_range_address_hint.Pointer()->GetAddressHint(requested),
+                page_allocator->AllocatePageSize());
+  VirtualMemory reservation(
+      page_allocator, requested, reinterpret_cast<void*>(hint),
+      Max(kMinExpectedOSPageSize, page_allocator->AllocatePageSize()));
+  if (!reservation.IsReserved()) {
+    V8::FatalProcessOutOfMemory(isolate_,
+                                "CodeRange setup: allocate virtual memory");
+  }
+  code_range_ = reservation.region();
+  isolate_->AddCodeRange(code_range_.begin(), code_range_.size());
+
+  // We are sure that we have mapped a block of requested addresses.
+  DCHECK_GE(reservation.size(), requested);
+  Address base = reservation.address();
+
+  // On some platforms, specifically Win64, we need to reserve some pages at
+  // the beginning of an executable space. See
+  //   https://cs.chromium.org/chromium/src/components/crash/content/
+  //     app/crashpad_win.cc?rcl=fd680447881449fba2edcf0589320e7253719212&l=204
+  // for details.
+  if (reserved_area > 0) {
+    if (!reservation.SetPermissions(base, reserved_area,
+                                    PageAllocator::kReadWrite))
+      V8::FatalProcessOutOfMemory(isolate_, "CodeRange setup: set permissions");
+
+    base += reserved_area;
+  }
+  Address aligned_base = RoundUp(base, MemoryChunk::kAlignment);
+  size_t size =
+      RoundDown(reservation.size() - (aligned_base - base) - reserved_area,
+                MemoryChunk::kPageSize);
+  DCHECK(IsAligned(aligned_base, kMinExpectedOSPageSize));
+
+  LOG(isolate_,
+      NewEvent("CodeRange", reinterpret_cast<void*>(reservation.address()),
+               requested));
+
+  code_reservation_ = std::move(reservation);
+  code_page_allocator_instance_ = std::make_unique<base::BoundedPageAllocator>(
+      page_allocator, aligned_base, size,
+      static_cast<size_t>(MemoryChunk::kAlignment));
+  code_page_allocator_ = code_page_allocator_instance_.get();
+}
+
+void MemoryAllocator::TearDown() {
+  unmapper()->TearDown();
+
+  // Check that spaces were torn down before MemoryAllocator.
+  DCHECK_EQ(size_, 0u);
+  // TODO(gc) this will be true again when we fix FreeMemory.
+  // DCHECK_EQ(0, size_executable_);
+  capacity_ = 0;
+
+  if (last_chunk_.IsReserved()) {
+    last_chunk_.Free();
+  }
+
+  if (code_page_allocator_instance_.get()) {
+    DCHECK(!code_range_.is_empty());
+    code_range_address_hint.Pointer()->NotifyFreedCodeRange(code_range_.begin(),
+                                                            code_range_.size());
+    code_range_ = base::AddressRegion();
+    code_page_allocator_instance_.reset();
+  }
+  code_page_allocator_ = nullptr;
+  data_page_allocator_ = nullptr;
+}
+
+class MemoryAllocator::Unmapper::UnmapFreeMemoryTask : public CancelableTask {
+ public:
+  explicit UnmapFreeMemoryTask(Isolate* isolate, Unmapper* unmapper)
+      : CancelableTask(isolate),
+        unmapper_(unmapper),
+        tracer_(isolate->heap()->tracer()) {}
+
+ private:
+  void RunInternal() override {
+    TRACE_BACKGROUND_GC(tracer_,
+                        GCTracer::BackgroundScope::BACKGROUND_UNMAPPER);
+    unmapper_->PerformFreeMemoryOnQueuedChunks<FreeMode::kUncommitPooled>();
+    unmapper_->active_unmapping_tasks_--;
+    unmapper_->pending_unmapping_tasks_semaphore_.Signal();
+    if (FLAG_trace_unmapper) {
+      PrintIsolate(unmapper_->heap_->isolate(),
+                   "UnmapFreeMemoryTask Done: id=%" PRIu64 "\n", id());
+    }
+  }
+
+  Unmapper* const unmapper_;
+  GCTracer* const tracer_;
+  DISALLOW_COPY_AND_ASSIGN(UnmapFreeMemoryTask);
+};
+
+void MemoryAllocator::Unmapper::FreeQueuedChunks() {
+  if (!heap_->IsTearingDown() && FLAG_concurrent_sweeping) {
+    if (!MakeRoomForNewTasks()) {
+      // kMaxUnmapperTasks are already running. Avoid creating any more.
+      if (FLAG_trace_unmapper) {
+        PrintIsolate(heap_->isolate(),
+                     "Unmapper::FreeQueuedChunks: reached task limit (%d)\n",
+                     kMaxUnmapperTasks);
+      }
+      return;
+    }
+    auto task = std::make_unique<UnmapFreeMemoryTask>(heap_->isolate(), this);
+    if (FLAG_trace_unmapper) {
+      PrintIsolate(heap_->isolate(),
+                   "Unmapper::FreeQueuedChunks: new task id=%" PRIu64 "\n",
+                   task->id());
+    }
+    DCHECK_LT(pending_unmapping_tasks_, kMaxUnmapperTasks);
+    DCHECK_LE(active_unmapping_tasks_, pending_unmapping_tasks_);
+    DCHECK_GE(active_unmapping_tasks_, 0);
+    active_unmapping_tasks_++;
+    task_ids_[pending_unmapping_tasks_++] = task->id();
+    V8::GetCurrentPlatform()->CallOnWorkerThread(std::move(task));
+  } else {
+    PerformFreeMemoryOnQueuedChunks<FreeMode::kUncommitPooled>();
+  }
+}
+
+void MemoryAllocator::Unmapper::CancelAndWaitForPendingTasks() {
+  for (int i = 0; i < pending_unmapping_tasks_; i++) {
+    if (heap_->isolate()->cancelable_task_manager()->TryAbort(task_ids_[i]) !=
+        TryAbortResult::kTaskAborted) {
+      pending_unmapping_tasks_semaphore_.Wait();
+    }
+  }
+  pending_unmapping_tasks_ = 0;
+  active_unmapping_tasks_ = 0;
+
+  if (FLAG_trace_unmapper) {
+    PrintIsolate(
+        heap_->isolate(),
+        "Unmapper::CancelAndWaitForPendingTasks: no tasks remaining\n");
+  }
+}
+
+void MemoryAllocator::Unmapper::PrepareForGC() {
+  // Free non-regular chunks because they cannot be re-used.
+  PerformFreeMemoryOnQueuedNonRegularChunks();
+}
+
+void MemoryAllocator::Unmapper::EnsureUnmappingCompleted() {
+  CancelAndWaitForPendingTasks();
+  PerformFreeMemoryOnQueuedChunks<FreeMode::kReleasePooled>();
+}
+
+bool MemoryAllocator::Unmapper::MakeRoomForNewTasks() {
+  DCHECK_LE(pending_unmapping_tasks_, kMaxUnmapperTasks);
+
+  if (active_unmapping_tasks_ == 0 && pending_unmapping_tasks_ > 0) {
+    // All previous unmapping tasks have been run to completion.
+    // Finalize those tasks to make room for new ones.
+    CancelAndWaitForPendingTasks();
+  }
+  return pending_unmapping_tasks_ != kMaxUnmapperTasks;
+}
+
+void MemoryAllocator::Unmapper::PerformFreeMemoryOnQueuedNonRegularChunks() {
+  MemoryChunk* chunk = nullptr;
+  while ((chunk = GetMemoryChunkSafe<kNonRegular>()) != nullptr) {
+    allocator_->PerformFreeMemory(chunk);
+  }
+}
+
+template <MemoryAllocator::Unmapper::FreeMode mode>
+void MemoryAllocator::Unmapper::PerformFreeMemoryOnQueuedChunks() {
+  MemoryChunk* chunk = nullptr;
+  if (FLAG_trace_unmapper) {
+    PrintIsolate(
+        heap_->isolate(),
+        "Unmapper::PerformFreeMemoryOnQueuedChunks: %d queued chunks\n",
+        NumberOfChunks());
+  }
+  // Regular chunks.
+  while ((chunk = GetMemoryChunkSafe<kRegular>()) != nullptr) {
+    bool pooled = chunk->IsFlagSet(MemoryChunk::POOLED);
+    allocator_->PerformFreeMemory(chunk);
+    if (pooled) AddMemoryChunkSafe<kPooled>(chunk);
+  }
+  if (mode == MemoryAllocator::Unmapper::FreeMode::kReleasePooled) {
+    // The previous loop uncommitted any pages marked as pooled and added them
+    // to the pooled list. In case of kReleasePooled we need to free them
+    // though.
+    while ((chunk = GetMemoryChunkSafe<kPooled>()) != nullptr) {
+      allocator_->Free<MemoryAllocator::kAlreadyPooled>(chunk);
+    }
+  }
+  PerformFreeMemoryOnQueuedNonRegularChunks();
+}
+
+void MemoryAllocator::Unmapper::TearDown() {
+  CHECK_EQ(0, pending_unmapping_tasks_);
+  PerformFreeMemoryOnQueuedChunks<FreeMode::kReleasePooled>();
+  for (int i = 0; i < kNumberOfChunkQueues; i++) {
+    DCHECK(chunks_[i].empty());
+  }
+}
+
+size_t MemoryAllocator::Unmapper::NumberOfCommittedChunks() {
+  base::MutexGuard guard(&mutex_);
+  return chunks_[kRegular].size() + chunks_[kNonRegular].size();
+}
+
+int MemoryAllocator::Unmapper::NumberOfChunks() {
+  base::MutexGuard guard(&mutex_);
+  size_t result = 0;
+  for (int i = 0; i < kNumberOfChunkQueues; i++) {
+    result += chunks_[i].size();
+  }
+  return static_cast<int>(result);
+}
+
+size_t MemoryAllocator::Unmapper::CommittedBufferedMemory() {
+  base::MutexGuard guard(&mutex_);
+
+  size_t sum = 0;
+  // kPooled chunks are already uncommited. We only have to account for
+  // kRegular and kNonRegular chunks.
+  for (auto& chunk : chunks_[kRegular]) {
+    sum += chunk->size();
+  }
+  for (auto& chunk : chunks_[kNonRegular]) {
+    sum += chunk->size();
+  }
+  return sum;
+}
+
+bool MemoryAllocator::CommitMemory(VirtualMemory* reservation) {
+  Address base = reservation->address();
+  size_t size = reservation->size();
+  if (!reservation->SetPermissions(base, size, PageAllocator::kReadWrite)) {
+    return false;
+  }
+  UpdateAllocatedSpaceLimits(base, base + size);
+  return true;
+}
+
+bool MemoryAllocator::UncommitMemory(VirtualMemory* reservation) {
+  size_t size = reservation->size();
+  if (!reservation->SetPermissions(reservation->address(), size,
+                                   PageAllocator::kNoAccess)) {
+    return false;
+  }
+  return true;
+}
+
+void MemoryAllocator::FreeMemory(v8::PageAllocator* page_allocator,
+                                 Address base, size_t size) {
+  CHECK(FreePages(page_allocator, reinterpret_cast<void*>(base), size));
+}
+
+Address MemoryAllocator::AllocateAlignedMemory(
+    size_t reserve_size, size_t commit_size, size_t alignment,
+    Executability executable, void* hint, VirtualMemory* controller) {
+  v8::PageAllocator* page_allocator = this->page_allocator(executable);
+  DCHECK(commit_size <= reserve_size);
+  VirtualMemory reservation(page_allocator, reserve_size, hint, alignment);
+  if (!reservation.IsReserved()) return kNullAddress;
+  Address base = reservation.address();
+  size_ += reservation.size();
+
+  if (executable == EXECUTABLE) {
+    if (!CommitExecutableMemory(&reservation, base, commit_size,
+                                reserve_size)) {
+      base = kNullAddress;
+    }
+  } else {
+    if (reservation.SetPermissions(base, commit_size,
+                                   PageAllocator::kReadWrite)) {
+      UpdateAllocatedSpaceLimits(base, base + commit_size);
+    } else {
+      base = kNullAddress;
+    }
+  }
+
+  if (base == kNullAddress) {
+    // Failed to commit the body. Free the mapping and any partially committed
+    // regions inside it.
+    reservation.Free();
+    size_ -= reserve_size;
+    return kNullAddress;
+  }
+
+  *controller = std::move(reservation);
+  return base;
+}
+
+MemoryChunk* MemoryAllocator::AllocateChunk(size_t reserve_area_size,
+                                            size_t commit_area_size,
+                                            Executability executable,
+                                            Space* owner) {
+  DCHECK_LE(commit_area_size, reserve_area_size);
+
+  size_t chunk_size;
+  Heap* heap = isolate_->heap();
+  Address base = kNullAddress;
+  VirtualMemory reservation;
+  Address area_start = kNullAddress;
+  Address area_end = kNullAddress;
+  void* address_hint =
+      AlignedAddress(heap->GetRandomMmapAddr(), MemoryChunk::kAlignment);
+
+  //
+  // MemoryChunk layout:
+  //
+  //             Executable
+  // +----------------------------+<- base aligned with MemoryChunk::kAlignment
+  // |           Header           |
+  // +----------------------------+<- base + CodePageGuardStartOffset
+  // |           Guard            |
+  // +----------------------------+<- area_start_
+  // |           Area             |
+  // +----------------------------+<- area_end_ (area_start + commit_area_size)
+  // |   Committed but not used   |
+  // +----------------------------+<- aligned at OS page boundary
+  // | Reserved but not committed |
+  // +----------------------------+<- aligned at OS page boundary
+  // |           Guard            |
+  // +----------------------------+<- base + chunk_size
+  //
+  //           Non-executable
+  // +----------------------------+<- base aligned with MemoryChunk::kAlignment
+  // |          Header            |
+  // +----------------------------+<- area_start_ (base + area_start_)
+  // |           Area             |
+  // +----------------------------+<- area_end_ (area_start + commit_area_size)
+  // |  Committed but not used    |
+  // +----------------------------+<- aligned at OS page boundary
+  // | Reserved but not committed |
+  // +----------------------------+<- base + chunk_size
+  //
+
+  if (executable == EXECUTABLE) {
+    chunk_size = ::RoundUp(MemoryChunkLayout::ObjectStartOffsetInCodePage() +
+                               reserve_area_size +
+                               MemoryChunkLayout::CodePageGuardSize(),
+                           GetCommitPageSize());
+
+    // Size of header (not executable) plus area (executable).
+    size_t commit_size = ::RoundUp(
+        MemoryChunkLayout::CodePageGuardStartOffset() + commit_area_size,
+        GetCommitPageSize());
+    base =
+        AllocateAlignedMemory(chunk_size, commit_size, MemoryChunk::kAlignment,
+                              executable, address_hint, &reservation);
+    if (base == kNullAddress) return nullptr;
+    // Update executable memory size.
+    size_executable_ += reservation.size();
+
+    if (Heap::ShouldZapGarbage()) {
+      ZapBlock(base, MemoryChunkLayout::CodePageGuardStartOffset(), kZapValue);
+      ZapBlock(base + MemoryChunkLayout::ObjectStartOffsetInCodePage(),
+               commit_area_size, kZapValue);
+    }
+
+    area_start = base + MemoryChunkLayout::ObjectStartOffsetInCodePage();
+    area_end = area_start + commit_area_size;
+  } else {
+    chunk_size = ::RoundUp(
+        MemoryChunkLayout::ObjectStartOffsetInDataPage() + reserve_area_size,
+        GetCommitPageSize());
+    size_t commit_size = ::RoundUp(
+        MemoryChunkLayout::ObjectStartOffsetInDataPage() + commit_area_size,
+        GetCommitPageSize());
+    base =
+        AllocateAlignedMemory(chunk_size, commit_size, MemoryChunk::kAlignment,
+                              executable, address_hint, &reservation);
+
+    if (base == kNullAddress) return nullptr;
+
+    if (Heap::ShouldZapGarbage()) {
+      ZapBlock(
+          base,
+          MemoryChunkLayout::ObjectStartOffsetInDataPage() + commit_area_size,
+          kZapValue);
+    }
+
+    area_start = base + MemoryChunkLayout::ObjectStartOffsetInDataPage();
+    area_end = area_start + commit_area_size;
+  }
+
+  // Use chunk_size for statistics because we assume that  treat reserved but
+  // not-yet committed memory regions of chunks as allocated.
+  LOG(isolate_,
+      NewEvent("MemoryChunk", reinterpret_cast<void*>(base), chunk_size));
+
+  // We cannot use the last chunk in the address space because we would
+  // overflow when comparing top and limit if this chunk is used for a
+  // linear allocation area.
+  if ((base + chunk_size) == 0u) {
+    CHECK(!last_chunk_.IsReserved());
+    last_chunk_ = std::move(reservation);
+    UncommitMemory(&last_chunk_);
+    size_ -= chunk_size;
+    if (executable == EXECUTABLE) {
+      size_executable_ -= chunk_size;
+    }
+    CHECK(last_chunk_.IsReserved());
+    return AllocateChunk(reserve_area_size, commit_area_size, executable,
+                         owner);
+  }
+
+  MemoryChunk* chunk =
+      MemoryChunk::Initialize(heap, base, chunk_size, area_start, area_end,
+                              executable, owner, std::move(reservation));
+
+  if (chunk->executable()) RegisterExecutableMemoryChunk(chunk);
+  return chunk;
+}
+
+void MemoryAllocator::PartialFreeMemory(MemoryChunk* chunk, Address start_free,
+                                        size_t bytes_to_free,
+                                        Address new_area_end) {
+  VirtualMemory* reservation = chunk->reserved_memory();
+  DCHECK(reservation->IsReserved());
+  chunk->set_size(chunk->size() - bytes_to_free);
+  chunk->set_area_end(new_area_end);
+  if (chunk->IsFlagSet(MemoryChunk::IS_EXECUTABLE)) {
+    // Add guard page at the end.
+    size_t page_size = GetCommitPageSize();
+    DCHECK_EQ(0, chunk->area_end() % static_cast<Address>(page_size));
+    DCHECK_EQ(chunk->address() + chunk->size(),
+              chunk->area_end() + MemoryChunkLayout::CodePageGuardSize());
+    reservation->SetPermissions(chunk->area_end(), page_size,
+                                PageAllocator::kNoAccess);
+  }
+  // On e.g. Windows, a reservation may be larger than a page and releasing
+  // partially starting at |start_free| will also release the potentially
+  // unused part behind the current page.
+  const size_t released_bytes = reservation->Release(start_free);
+  DCHECK_GE(size_, released_bytes);
+  size_ -= released_bytes;
+}
+
+void MemoryAllocator::UnregisterMemory(MemoryChunk* chunk) {
+  DCHECK(!chunk->IsFlagSet(MemoryChunk::UNREGISTERED));
+  VirtualMemory* reservation = chunk->reserved_memory();
+  const size_t size =
+      reservation->IsReserved() ? reservation->size() : chunk->size();
+  DCHECK_GE(size_, static_cast<size_t>(size));
+  size_ -= size;
+  if (chunk->executable() == EXECUTABLE) {
+    DCHECK_GE(size_executable_, size);
+    size_executable_ -= size;
+  }
+
+  if (chunk->executable()) UnregisterExecutableMemoryChunk(chunk);
+  chunk->SetFlag(MemoryChunk::UNREGISTERED);
+}
+
+void MemoryAllocator::PreFreeMemory(MemoryChunk* chunk) {
+  DCHECK(!chunk->IsFlagSet(MemoryChunk::PRE_FREED));
+  LOG(isolate_, DeleteEvent("MemoryChunk", chunk));
+  UnregisterMemory(chunk);
+  isolate_->heap()->RememberUnmappedPage(reinterpret_cast<Address>(chunk),
+                                         chunk->IsEvacuationCandidate());
+  chunk->SetFlag(MemoryChunk::PRE_FREED);
+}
+
+void MemoryAllocator::PerformFreeMemory(MemoryChunk* chunk) {
+  DCHECK(chunk->IsFlagSet(MemoryChunk::UNREGISTERED));
+  DCHECK(chunk->IsFlagSet(MemoryChunk::PRE_FREED));
+  chunk->ReleaseAllAllocatedMemory();
+
+  VirtualMemory* reservation = chunk->reserved_memory();
+  if (chunk->IsFlagSet(MemoryChunk::POOLED)) {
+    UncommitMemory(reservation);
+  } else {
+    if (reservation->IsReserved()) {
+      reservation->Free();
+    } else {
+      // Only read-only pages can have non-initialized reservation object.
+      DCHECK_EQ(RO_SPACE, chunk->owner_identity());
+      FreeMemory(page_allocator(chunk->executable()), chunk->address(),
+                 chunk->size());
+    }
+  }
+}
+
+template <MemoryAllocator::FreeMode mode>
+void MemoryAllocator::Free(MemoryChunk* chunk) {
+  switch (mode) {
+    case kFull:
+      PreFreeMemory(chunk);
+      PerformFreeMemory(chunk);
+      break;
+    case kAlreadyPooled:
+      // Pooled pages cannot be touched anymore as their memory is uncommitted.
+      // Pooled pages are not-executable.
+      FreeMemory(data_page_allocator(), chunk->address(),
+                 static_cast<size_t>(MemoryChunk::kPageSize));
+      break;
+    case kPooledAndQueue:
+      DCHECK_EQ(chunk->size(), static_cast<size_t>(MemoryChunk::kPageSize));
+      DCHECK_EQ(chunk->executable(), NOT_EXECUTABLE);
+      chunk->SetFlag(MemoryChunk::POOLED);
+      V8_FALLTHROUGH;
+    case kPreFreeAndQueue:
+      PreFreeMemory(chunk);
+      // The chunks added to this queue will be freed by a concurrent thread.
+      unmapper()->AddMemoryChunkSafe(chunk);
+      break;
+  }
+}
+
+template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE) void MemoryAllocator::Free<
+    MemoryAllocator::kFull>(MemoryChunk* chunk);
+
+template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE) void MemoryAllocator::Free<
+    MemoryAllocator::kAlreadyPooled>(MemoryChunk* chunk);
+
+template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE) void MemoryAllocator::Free<
+    MemoryAllocator::kPreFreeAndQueue>(MemoryChunk* chunk);
+
+template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE) void MemoryAllocator::Free<
+    MemoryAllocator::kPooledAndQueue>(MemoryChunk* chunk);
+
+template <MemoryAllocator::AllocationMode alloc_mode, typename SpaceType>
+Page* MemoryAllocator::AllocatePage(size_t size, SpaceType* owner,
+                                    Executability executable) {
+  MemoryChunk* chunk = nullptr;
+  if (alloc_mode == kPooled) {
+    DCHECK_EQ(size, static_cast<size_t>(
+                        MemoryChunkLayout::AllocatableMemoryInMemoryChunk(
+                            owner->identity())));
+    DCHECK_EQ(executable, NOT_EXECUTABLE);
+    chunk = AllocatePagePooled(owner);
+  }
+  if (chunk == nullptr) {
+    chunk = AllocateChunk(size, size, executable, owner);
+  }
+  if (chunk == nullptr) return nullptr;
+  return owner->InitializePage(chunk);
+}
+
+template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
+    Page* MemoryAllocator::AllocatePage<MemoryAllocator::kRegular, PagedSpace>(
+        size_t size, PagedSpace* owner, Executability executable);
+template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
+    Page* MemoryAllocator::AllocatePage<MemoryAllocator::kRegular, SemiSpace>(
+        size_t size, SemiSpace* owner, Executability executable);
+template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
+    Page* MemoryAllocator::AllocatePage<MemoryAllocator::kPooled, SemiSpace>(
+        size_t size, SemiSpace* owner, Executability executable);
+
+LargePage* MemoryAllocator::AllocateLargePage(size_t size,
+                                              LargeObjectSpace* owner,
+                                              Executability executable) {
+  MemoryChunk* chunk = AllocateChunk(size, size, executable, owner);
+  if (chunk == nullptr) return nullptr;
+  return LargePage::Initialize(isolate_->heap(), chunk, executable);
+}
+
+template <typename SpaceType>
+MemoryChunk* MemoryAllocator::AllocatePagePooled(SpaceType* owner) {
+  MemoryChunk* chunk = unmapper()->TryGetPooledMemoryChunkSafe();
+  if (chunk == nullptr) return nullptr;
+  const int size = MemoryChunk::kPageSize;
+  const Address start = reinterpret_cast<Address>(chunk);
+  const Address area_start =
+      start +
+      MemoryChunkLayout::ObjectStartOffsetInMemoryChunk(owner->identity());
+  const Address area_end = start + size;
+  // Pooled pages are always regular data pages.
+  DCHECK_NE(CODE_SPACE, owner->identity());
+  VirtualMemory reservation(data_page_allocator(), start, size);
+  if (!CommitMemory(&reservation)) return nullptr;
+  if (Heap::ShouldZapGarbage()) {
+    ZapBlock(start, size, kZapValue);
+  }
+  MemoryChunk::Initialize(isolate_->heap(), start, size, area_start, area_end,
+                          NOT_EXECUTABLE, owner, std::move(reservation));
+  size_ += size;
+  return chunk;
+}
+
+void MemoryAllocator::ZapBlock(Address start, size_t size,
+                               uintptr_t zap_value) {
+  DCHECK(IsAligned(start, kTaggedSize));
+  DCHECK(IsAligned(size, kTaggedSize));
+  MemsetTagged(ObjectSlot(start), Object(static_cast<Address>(zap_value)),
+               size >> kTaggedSizeLog2);
+}
+
+intptr_t MemoryAllocator::GetCommitPageSize() {
+  if (FLAG_v8_os_page_size != 0) {
+    DCHECK(base::bits::IsPowerOfTwo(FLAG_v8_os_page_size));
+    return FLAG_v8_os_page_size * KB;
+  } else {
+    return CommitPageSize();
+  }
+}
+
+base::AddressRegion MemoryAllocator::ComputeDiscardMemoryArea(Address addr,
+                                                              size_t size) {
+  size_t page_size = MemoryAllocator::GetCommitPageSize();
+  if (size < page_size + FreeSpace::kSize) {
+    return base::AddressRegion(0, 0);
+  }
+  Address discardable_start = RoundUp(addr + FreeSpace::kSize, page_size);
+  Address discardable_end = RoundDown(addr + size, page_size);
+  if (discardable_start >= discardable_end) return base::AddressRegion(0, 0);
+  return base::AddressRegion(discardable_start,
+                             discardable_end - discardable_start);
+}
+
+bool MemoryAllocator::CommitExecutableMemory(VirtualMemory* vm, Address start,
+                                             size_t commit_size,
+                                             size_t reserved_size) {
+  const size_t page_size = GetCommitPageSize();
+  // All addresses and sizes must be aligned to the commit page size.
+  DCHECK(IsAligned(start, page_size));
+  DCHECK_EQ(0, commit_size % page_size);
+  DCHECK_EQ(0, reserved_size % page_size);
+  const size_t guard_size = MemoryChunkLayout::CodePageGuardSize();
+  const size_t pre_guard_offset = MemoryChunkLayout::CodePageGuardStartOffset();
+  const size_t code_area_offset =
+      MemoryChunkLayout::ObjectStartOffsetInCodePage();
+  // reserved_size includes two guard regions, commit_size does not.
+  DCHECK_LE(commit_size, reserved_size - 2 * guard_size);
+  const Address pre_guard_page = start + pre_guard_offset;
+  const Address code_area = start + code_area_offset;
+  const Address post_guard_page = start + reserved_size - guard_size;
+  // Commit the non-executable header, from start to pre-code guard page.
+  if (vm->SetPermissions(start, pre_guard_offset, PageAllocator::kReadWrite)) {
+    // Create the pre-code guard page, following the header.
+    if (vm->SetPermissions(pre_guard_page, page_size,
+                           PageAllocator::kNoAccess)) {
+      // Commit the executable code body.
+      if (vm->SetPermissions(code_area, commit_size - pre_guard_offset,
+                             PageAllocator::kReadWrite)) {
+        // Create the post-code guard page.
+        if (vm->SetPermissions(post_guard_page, page_size,
+                               PageAllocator::kNoAccess)) {
+          UpdateAllocatedSpaceLimits(start, code_area + commit_size);
+          return true;
+        }
+        vm->SetPermissions(code_area, commit_size, PageAllocator::kNoAccess);
+      }
+    }
+    vm->SetPermissions(start, pre_guard_offset, PageAllocator::kNoAccess);
+  }
+  return false;
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/heap/memory-allocator.h b/deps/v8/src/heap/memory-allocator.h
new file mode 100644
index 00000000000..74d9b6bca56
--- /dev/null
+++ b/deps/v8/src/heap/memory-allocator.h
@@ -0,0 +1,434 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_MEMORY_ALLOCATOR_H_
+#define V8_HEAP_MEMORY_ALLOCATOR_H_
+
+#include <atomic>
+#include <memory>
+#include <unordered_map>
+#include <unordered_set>
+#include <vector>
+
+#include "src/base/bounded-page-allocator.h"
+#include "src/base/export-template.h"
+#include "src/base/macros.h"
+#include "src/base/platform/mutex.h"
+#include "src/base/platform/semaphore.h"
+#include "src/heap/heap.h"
+#include "src/heap/memory-chunk.h"
+#include "src/heap/spaces.h"
+#include "src/tasks/cancelable-task.h"
+#include "src/utils/allocation.h"
+
+namespace v8 {
+namespace internal {
+
+class Heap;
+class Isolate;
+
+// The process-wide singleton that keeps track of code range regions with the
+// intention to reuse free code range regions as a workaround for CFG memory
+// leaks (see crbug.com/870054).
+class CodeRangeAddressHint {
+ public:
+  // Returns the most recently freed code range start address for the given
+  // size. If there is no such entry, then a random address is returned.
+  V8_EXPORT_PRIVATE Address GetAddressHint(size_t code_range_size);
+
+  V8_EXPORT_PRIVATE void NotifyFreedCodeRange(Address code_range_start,
+                                              size_t code_range_size);
+
+ private:
+  base::Mutex mutex_;
+  // A map from code range size to an array of recently freed code range
+  // addresses. There should be O(1) different code range sizes.
+  // The length of each array is limited by the peak number of code ranges,
+  // which should be also O(1).
+  std::unordered_map<size_t, std::vector<Address>> recently_freed_;
+};
+
+// ----------------------------------------------------------------------------
+// A space acquires chunks of memory from the operating system. The memory
+// allocator allocates and deallocates pages for the paged heap spaces and large
+// pages for large object space.
+class MemoryAllocator {
+ public:
+  // Unmapper takes care of concurrently unmapping and uncommitting memory
+  // chunks.
+  class Unmapper {
+   public:
+    class UnmapFreeMemoryTask;
+
+    Unmapper(Heap* heap, MemoryAllocator* allocator)
+        : heap_(heap),
+          allocator_(allocator),
+          pending_unmapping_tasks_semaphore_(0),
+          pending_unmapping_tasks_(0),
+          active_unmapping_tasks_(0) {
+      chunks_[kRegular].reserve(kReservedQueueingSlots);
+      chunks_[kPooled].reserve(kReservedQueueingSlots);
+    }
+
+    void AddMemoryChunkSafe(MemoryChunk* chunk) {
+      if (!chunk->IsLargePage() && chunk->executable() != EXECUTABLE) {
+        AddMemoryChunkSafe<kRegular>(chunk);
+      } else {
+        AddMemoryChunkSafe<kNonRegular>(chunk);
+      }
+    }
+
+    MemoryChunk* TryGetPooledMemoryChunkSafe() {
+      // Procedure:
+      // (1) Try to get a chunk that was declared as pooled and already has
+      // been uncommitted.
+      // (2) Try to steal any memory chunk of kPageSize that would've been
+      // unmapped.
+      MemoryChunk* chunk = GetMemoryChunkSafe<kPooled>();
+      if (chunk == nullptr) {
+        chunk = GetMemoryChunkSafe<kRegular>();
+        if (chunk != nullptr) {
+          // For stolen chunks we need to manually free any allocated memory.
+          chunk->ReleaseAllAllocatedMemory();
+        }
+      }
+      return chunk;
+    }
+
+    V8_EXPORT_PRIVATE void FreeQueuedChunks();
+    void CancelAndWaitForPendingTasks();
+    void PrepareForGC();
+    V8_EXPORT_PRIVATE void EnsureUnmappingCompleted();
+    V8_EXPORT_PRIVATE void TearDown();
+    size_t NumberOfCommittedChunks();
+    V8_EXPORT_PRIVATE int NumberOfChunks();
+    size_t CommittedBufferedMemory();
+
+   private:
+    static const int kReservedQueueingSlots = 64;
+    static const int kMaxUnmapperTasks = 4;
+
+    enum ChunkQueueType {
+      kRegular,     // Pages of kPageSize that do not live in a CodeRange and
+                    // can thus be used for stealing.
+      kNonRegular,  // Large chunks and executable chunks.
+      kPooled,      // Pooled chunks, already uncommited and ready for reuse.
+      kNumberOfChunkQueues,
+    };
+
+    enum class FreeMode {
+      kUncommitPooled,
+      kReleasePooled,
+    };
+
+    template <ChunkQueueType type>
+    void AddMemoryChunkSafe(MemoryChunk* chunk) {
+      base::MutexGuard guard(&mutex_);
+      chunks_[type].push_back(chunk);
+    }
+
+    template <ChunkQueueType type>
+    MemoryChunk* GetMemoryChunkSafe() {
+      base::MutexGuard guard(&mutex_);
+      if (chunks_[type].empty()) return nullptr;
+      MemoryChunk* chunk = chunks_[type].back();
+      chunks_[type].pop_back();
+      return chunk;
+    }
+
+    bool MakeRoomForNewTasks();
+
+    template <FreeMode mode>
+    void PerformFreeMemoryOnQueuedChunks();
+
+    void PerformFreeMemoryOnQueuedNonRegularChunks();
+
+    Heap* const heap_;
+    MemoryAllocator* const allocator_;
+    base::Mutex mutex_;
+    std::vector<MemoryChunk*> chunks_[kNumberOfChunkQueues];
+    CancelableTaskManager::Id task_ids_[kMaxUnmapperTasks];
+    base::Semaphore pending_unmapping_tasks_semaphore_;
+    intptr_t pending_unmapping_tasks_;
+    std::atomic<intptr_t> active_unmapping_tasks_;
+
+    friend class MemoryAllocator;
+  };
+
+  enum AllocationMode {
+    kRegular,
+    kPooled,
+  };
+
+  enum FreeMode {
+    kFull,
+    kAlreadyPooled,
+    kPreFreeAndQueue,
+    kPooledAndQueue,
+  };
+
+  V8_EXPORT_PRIVATE static intptr_t GetCommitPageSize();
+
+  // Computes the memory area of discardable memory within a given memory area
+  // [addr, addr+size) and returns the result as base::AddressRegion. If the
+  // memory is not discardable base::AddressRegion is an empty region.
+  V8_EXPORT_PRIVATE static base::AddressRegion ComputeDiscardMemoryArea(
+      Address addr, size_t size);
+
+  V8_EXPORT_PRIVATE MemoryAllocator(Isolate* isolate, size_t max_capacity,
+                                    size_t code_range_size);
+
+  V8_EXPORT_PRIVATE void TearDown();
+
+  // Allocates a Page from the allocator. AllocationMode is used to indicate
+  // whether pooled allocation, which only works for MemoryChunk::kPageSize,
+  // should be tried first.
+  template <MemoryAllocator::AllocationMode alloc_mode = kRegular,
+            typename SpaceType>
+  EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
+  Page* AllocatePage(size_t size, SpaceType* owner, Executability executable);
+
+  LargePage* AllocateLargePage(size_t size, LargeObjectSpace* owner,
+                               Executability executable);
+
+  template <MemoryAllocator::FreeMode mode = kFull>
+  EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
+  void Free(MemoryChunk* chunk);
+
+  // Returns allocated spaces in bytes.
+  size_t Size() const { return size_; }
+
+  // Returns allocated executable spaces in bytes.
+  size_t SizeExecutable() const { return size_executable_; }
+
+  // Returns the maximum available bytes of heaps.
+  size_t Available() const {
+    const size_t size = Size();
+    return capacity_ < size ? 0 : capacity_ - size;
+  }
+
+  // Returns an indication of whether a pointer is in a space that has
+  // been allocated by this MemoryAllocator.
+  V8_INLINE bool IsOutsideAllocatedSpace(Address address) const {
+    return address < lowest_ever_allocated_ ||
+           address >= highest_ever_allocated_;
+  }
+
+  // Returns a MemoryChunk in which the memory region from commit_area_size to
+  // reserve_area_size of the chunk area is reserved but not committed, it
+  // could be committed later by calling MemoryChunk::CommitArea.
+  V8_EXPORT_PRIVATE MemoryChunk* AllocateChunk(size_t reserve_area_size,
+                                               size_t commit_area_size,
+                                               Executability executable,
+                                               Space* space);
+
+  Address AllocateAlignedMemory(size_t reserve_size, size_t commit_size,
+                                size_t alignment, Executability executable,
+                                void* hint, VirtualMemory* controller);
+
+  void FreeMemory(v8::PageAllocator* page_allocator, Address addr, size_t size);
+
+  // Partially release |bytes_to_free| bytes starting at |start_free|. Note that
+  // internally memory is freed from |start_free| to the end of the reservation.
+  // Additional memory beyond the page is not accounted though, so
+  // |bytes_to_free| is computed by the caller.
+  void PartialFreeMemory(MemoryChunk* chunk, Address start_free,
+                         size_t bytes_to_free, Address new_area_end);
+
+  // Checks if an allocated MemoryChunk was intended to be used for executable
+  // memory.
+  bool IsMemoryChunkExecutable(MemoryChunk* chunk) {
+    return executable_memory_.find(chunk) != executable_memory_.end();
+  }
+
+  // Commit memory region owned by given reservation object.  Returns true if
+  // it succeeded and false otherwise.
+  bool CommitMemory(VirtualMemory* reservation);
+
+  // Uncommit memory region owned by given reservation object. Returns true if
+  // it succeeded and false otherwise.
+  bool UncommitMemory(VirtualMemory* reservation);
+
+  // Zaps a contiguous block of memory [start..(start+size)[ with
+  // a given zap value.
+  void ZapBlock(Address start, size_t size, uintptr_t zap_value);
+
+  V8_WARN_UNUSED_RESULT bool CommitExecutableMemory(VirtualMemory* vm,
+                                                    Address start,
+                                                    size_t commit_size,
+                                                    size_t reserved_size);
+
+  // Page allocator instance for allocating non-executable pages.
+  // Guaranteed to be a valid pointer.
+  v8::PageAllocator* data_page_allocator() { return data_page_allocator_; }
+
+  // Page allocator instance for allocating executable pages.
+  // Guaranteed to be a valid pointer.
+  v8::PageAllocator* code_page_allocator() { return code_page_allocator_; }
+
+  // Returns page allocator suitable for allocating pages with requested
+  // executability.
+  v8::PageAllocator* page_allocator(Executability executable) {
+    return executable == EXECUTABLE ? code_page_allocator_
+                                    : data_page_allocator_;
+  }
+
+  // A region of memory that may contain executable code including reserved
+  // OS page with read-write access in the beginning.
+  const base::AddressRegion& code_range() const {
+    // |code_range_| >= |optional RW pages| + |code_page_allocator_instance_|
+    DCHECK_IMPLIES(!code_range_.is_empty(), code_page_allocator_instance_);
+    DCHECK_IMPLIES(!code_range_.is_empty(),
+                   code_range_.contains(code_page_allocator_instance_->begin(),
+                                        code_page_allocator_instance_->size()));
+    return code_range_;
+  }
+
+  Unmapper* unmapper() { return &unmapper_; }
+
+  // Performs all necessary bookkeeping to free the memory, but does not free
+  // it.
+  void UnregisterMemory(MemoryChunk* chunk);
+
+ private:
+  void InitializeCodePageAllocator(v8::PageAllocator* page_allocator,
+                                   size_t requested);
+
+  // PreFreeMemory logically frees the object, i.e., it unregisters the memory,
+  // logs a delete event and adds the chunk to remembered unmapped pages.
+  void PreFreeMemory(MemoryChunk* chunk);
+
+  // PerformFreeMemory can be called concurrently when PreFree was executed
+  // before.
+  void PerformFreeMemory(MemoryChunk* chunk);
+
+  // See AllocatePage for public interface. Note that currently we only support
+  // pools for NOT_EXECUTABLE pages of size MemoryChunk::kPageSize.
+  template <typename SpaceType>
+  MemoryChunk* AllocatePagePooled(SpaceType* owner);
+
+  // Initializes pages in a chunk. Returns the first page address.
+  // This function and GetChunkId() are provided for the mark-compact
+  // collector to rebuild page headers in the from space, which is
+  // used as a marking stack and its page headers are destroyed.
+  Page* InitializePagesInChunk(int chunk_id, int pages_in_chunk,
+                               PagedSpace* owner);
+
+  void UpdateAllocatedSpaceLimits(Address low, Address high) {
+    // The use of atomic primitives does not guarantee correctness (wrt.
+    // desired semantics) by default. The loop here ensures that we update the
+    // values only if they did not change in between.
+    Address ptr = lowest_ever_allocated_.load(std::memory_order_relaxed);
+    while ((low < ptr) && !lowest_ever_allocated_.compare_exchange_weak(
+                              ptr, low, std::memory_order_acq_rel)) {
+    }
+    ptr = highest_ever_allocated_.load(std::memory_order_relaxed);
+    while ((high > ptr) && !highest_ever_allocated_.compare_exchange_weak(
+                               ptr, high, std::memory_order_acq_rel)) {
+    }
+  }
+
+  void RegisterExecutableMemoryChunk(MemoryChunk* chunk) {
+    base::MutexGuard guard(&executable_memory_mutex_);
+    DCHECK(chunk->IsFlagSet(MemoryChunk::IS_EXECUTABLE));
+    DCHECK_EQ(executable_memory_.find(chunk), executable_memory_.end());
+    executable_memory_.insert(chunk);
+  }
+
+  void UnregisterExecutableMemoryChunk(MemoryChunk* chunk) {
+    base::MutexGuard guard(&executable_memory_mutex_);
+    DCHECK_NE(executable_memory_.find(chunk), executable_memory_.end());
+    executable_memory_.erase(chunk);
+    chunk->heap()->UnregisterUnprotectedMemoryChunk(chunk);
+  }
+
+  Isolate* isolate_;
+
+  // This object controls virtual space reserved for code on the V8 heap. This
+  // is only valid for 64-bit architectures where kRequiresCodeRange.
+  VirtualMemory code_reservation_;
+
+  // Page allocator used for allocating data pages. Depending on the
+  // configuration it may be a page allocator instance provided by v8::Platform
+  // or a BoundedPageAllocator (when pointer compression is enabled).
+  v8::PageAllocator* data_page_allocator_;
+
+  // Page allocator used for allocating code pages. Depending on the
+  // configuration it may be a page allocator instance provided by v8::Platform
+  // or a BoundedPageAllocator (when pointer compression is enabled or
+  // on those 64-bit architectures where pc-relative 32-bit displacement
+  // can be used for call and jump instructions).
+  v8::PageAllocator* code_page_allocator_;
+
+  // A part of the |code_reservation_| that may contain executable code
+  // including reserved page with read-write access in the beginning.
+  // See details below.
+  base::AddressRegion code_range_;
+
+  // This unique pointer owns the instance of bounded code allocator
+  // that controls executable pages allocation. It does not control the
+  // optionally existing page in the beginning of the |code_range_|.
+  // So, summarizing all above, the following conditions hold:
+  // 1) |code_reservation_| >= |code_range_|
+  // 2) |code_range_| >= |optional RW pages| + |code_page_allocator_instance_|.
+  // 3) |code_reservation_| is AllocatePageSize()-aligned
+  // 4) |code_page_allocator_instance_| is MemoryChunk::kAlignment-aligned
+  // 5) |code_range_| is CommitPageSize()-aligned
+  std::unique_ptr<base::BoundedPageAllocator> code_page_allocator_instance_;
+
+  // Maximum space size in bytes.
+  size_t capacity_;
+
+  // Allocated space size in bytes.
+  std::atomic<size_t> size_;
+  // Allocated executable space size in bytes.
+  std::atomic<size_t> size_executable_;
+
+  // We keep the lowest and highest addresses allocated as a quick way
+  // of determining that pointers are outside the heap. The estimate is
+  // conservative, i.e. not all addresses in 'allocated' space are allocated
+  // to our heap. The range is [lowest, highest[, inclusive on the low end
+  // and exclusive on the high end.
+  std::atomic<Address> lowest_ever_allocated_;
+  std::atomic<Address> highest_ever_allocated_;
+
+  VirtualMemory last_chunk_;
+  Unmapper unmapper_;
+
+  // Data structure to remember allocated executable memory chunks.
+  std::unordered_set<MemoryChunk*> executable_memory_;
+  base::Mutex executable_memory_mutex_;
+
+  friend class heap::TestCodePageAllocatorScope;
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(MemoryAllocator);
+};
+
+extern template EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
+    Page* MemoryAllocator::AllocatePage<MemoryAllocator::kRegular, PagedSpace>(
+        size_t size, PagedSpace* owner, Executability executable);
+extern template EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
+    Page* MemoryAllocator::AllocatePage<MemoryAllocator::kRegular, SemiSpace>(
+        size_t size, SemiSpace* owner, Executability executable);
+extern template EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
+    Page* MemoryAllocator::AllocatePage<MemoryAllocator::kPooled, SemiSpace>(
+        size_t size, SemiSpace* owner, Executability executable);
+
+extern template EXPORT_TEMPLATE_DECLARE(
+    V8_EXPORT_PRIVATE) void MemoryAllocator::
+    Free<MemoryAllocator::kFull>(MemoryChunk* chunk);
+extern template EXPORT_TEMPLATE_DECLARE(
+    V8_EXPORT_PRIVATE) void MemoryAllocator::
+    Free<MemoryAllocator::kAlreadyPooled>(MemoryChunk* chunk);
+extern template EXPORT_TEMPLATE_DECLARE(
+    V8_EXPORT_PRIVATE) void MemoryAllocator::
+    Free<MemoryAllocator::kPreFreeAndQueue>(MemoryChunk* chunk);
+extern template EXPORT_TEMPLATE_DECLARE(
+    V8_EXPORT_PRIVATE) void MemoryAllocator::
+    Free<MemoryAllocator::kPooledAndQueue>(MemoryChunk* chunk);
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_MEMORY_ALLOCATOR_H_
diff --git a/deps/v8/src/heap/memory-chunk-inl.h b/deps/v8/src/heap/memory-chunk-inl.h
new file mode 100644
index 00000000000..045de5ea377
--- /dev/null
+++ b/deps/v8/src/heap/memory-chunk-inl.h
@@ -0,0 +1,50 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_MEMORY_CHUNK_INL_H_
+#define V8_HEAP_MEMORY_CHUNK_INL_H_
+
+#include "src/heap/memory-chunk.h"
+#include "src/heap/spaces-inl.h"
+
+namespace v8 {
+namespace internal {
+
+void MemoryChunk::IncrementExternalBackingStoreBytes(
+    ExternalBackingStoreType type, size_t amount) {
+#ifndef V8_ENABLE_THIRD_PARTY_HEAP
+  base::CheckedIncrement(&external_backing_store_bytes_[type], amount);
+  owner()->IncrementExternalBackingStoreBytes(type, amount);
+#endif
+}
+
+void MemoryChunk::DecrementExternalBackingStoreBytes(
+    ExternalBackingStoreType type, size_t amount) {
+#ifndef V8_ENABLE_THIRD_PARTY_HEAP
+  base::CheckedDecrement(&external_backing_store_bytes_[type], amount);
+  owner()->DecrementExternalBackingStoreBytes(type, amount);
+#endif
+}
+
+void MemoryChunk::MoveExternalBackingStoreBytes(ExternalBackingStoreType type,
+                                                MemoryChunk* from,
+                                                MemoryChunk* to,
+                                                size_t amount) {
+  DCHECK_NOT_NULL(from->owner());
+  DCHECK_NOT_NULL(to->owner());
+  base::CheckedDecrement(&(from->external_backing_store_bytes_[type]), amount);
+  base::CheckedIncrement(&(to->external_backing_store_bytes_[type]), amount);
+  Space::MoveExternalBackingStoreBytes(type, from->owner(), to->owner(),
+                                       amount);
+}
+
+AllocationSpace MemoryChunk::owner_identity() const {
+  if (InReadOnlySpace()) return RO_SPACE;
+  return owner()->identity();
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_MEMORY_CHUNK_INL_H_
diff --git a/deps/v8/src/heap/memory-chunk.cc b/deps/v8/src/heap/memory-chunk.cc
new file mode 100644
index 00000000000..891e2c09d56
--- /dev/null
+++ b/deps/v8/src/heap/memory-chunk.cc
@@ -0,0 +1,481 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/memory-chunk.h"
+
+#include "src/base/platform/platform.h"
+#include "src/heap/array-buffer-tracker.h"
+#include "src/heap/code-object-registry.h"
+#include "src/heap/memory-allocator.h"
+#include "src/heap/memory-chunk-inl.h"
+#include "src/heap/spaces.h"
+#include "src/objects/heap-object.h"
+
+namespace v8 {
+namespace internal {
+
+void MemoryChunk::DiscardUnusedMemory(Address addr, size_t size) {
+  base::AddressRegion memory_area =
+      MemoryAllocator::ComputeDiscardMemoryArea(addr, size);
+  if (memory_area.size() != 0) {
+    MemoryAllocator* memory_allocator = heap_->memory_allocator();
+    v8::PageAllocator* page_allocator =
+        memory_allocator->page_allocator(executable());
+    CHECK(page_allocator->DiscardSystemPages(
+        reinterpret_cast<void*>(memory_area.begin()), memory_area.size()));
+  }
+}
+
+size_t MemoryChunkLayout::CodePageGuardStartOffset() {
+  // We are guarding code pages: the first OS page after the header
+  // will be protected as non-writable.
+  return ::RoundUp(Page::kHeaderSize, MemoryAllocator::GetCommitPageSize());
+}
+
+size_t MemoryChunkLayout::CodePageGuardSize() {
+  return MemoryAllocator::GetCommitPageSize();
+}
+
+intptr_t MemoryChunkLayout::ObjectStartOffsetInCodePage() {
+  // We are guarding code pages: the first OS page after the header
+  // will be protected as non-writable.
+  return CodePageGuardStartOffset() + CodePageGuardSize();
+}
+
+intptr_t MemoryChunkLayout::ObjectEndOffsetInCodePage() {
+  // We are guarding code pages: the last OS page will be protected as
+  // non-writable.
+  return Page::kPageSize -
+         static_cast<int>(MemoryAllocator::GetCommitPageSize());
+}
+
+size_t MemoryChunkLayout::AllocatableMemoryInCodePage() {
+  size_t memory = ObjectEndOffsetInCodePage() - ObjectStartOffsetInCodePage();
+  DCHECK_LE(kMaxRegularHeapObjectSize, memory);
+  return memory;
+}
+
+intptr_t MemoryChunkLayout::ObjectStartOffsetInDataPage() {
+  return RoundUp(MemoryChunk::kHeaderSize, kTaggedSize);
+}
+
+size_t MemoryChunkLayout::ObjectStartOffsetInMemoryChunk(
+    AllocationSpace space) {
+  if (space == CODE_SPACE) {
+    return ObjectStartOffsetInCodePage();
+  }
+  return ObjectStartOffsetInDataPage();
+}
+
+size_t MemoryChunkLayout::AllocatableMemoryInDataPage() {
+  size_t memory = MemoryChunk::kPageSize - ObjectStartOffsetInDataPage();
+  DCHECK_LE(kMaxRegularHeapObjectSize, memory);
+  return memory;
+}
+
+size_t MemoryChunkLayout::AllocatableMemoryInMemoryChunk(
+    AllocationSpace space) {
+  if (space == CODE_SPACE) {
+    return AllocatableMemoryInCodePage();
+  }
+  return AllocatableMemoryInDataPage();
+}
+
+#ifdef THREAD_SANITIZER
+void MemoryChunk::SynchronizedHeapLoad() {
+  CHECK(reinterpret_cast<Heap*>(base::Acquire_Load(
+            reinterpret_cast<base::AtomicWord*>(&heap_))) != nullptr ||
+        InReadOnlySpace());
+}
+#endif
+
+void MemoryChunk::InitializationMemoryFence() {
+  base::SeqCst_MemoryFence();
+#ifdef THREAD_SANITIZER
+  // Since TSAN does not process memory fences, we use the following annotation
+  // to tell TSAN that there is no data race when emitting a
+  // InitializationMemoryFence. Note that the other thread still needs to
+  // perform MemoryChunk::synchronized_heap().
+  base::Release_Store(reinterpret_cast<base::AtomicWord*>(&heap_),
+                      reinterpret_cast<base::AtomicWord>(heap_));
+#endif
+}
+
+void MemoryChunk::DecrementWriteUnprotectCounterAndMaybeSetPermissions(
+    PageAllocator::Permission permission) {
+  DCHECK(permission == PageAllocator::kRead ||
+         permission == PageAllocator::kReadExecute);
+  DCHECK(IsFlagSet(MemoryChunk::IS_EXECUTABLE));
+  DCHECK(owner_identity() == CODE_SPACE || owner_identity() == CODE_LO_SPACE);
+  // Decrementing the write_unprotect_counter_ and changing the page
+  // protection mode has to be atomic.
+  base::MutexGuard guard(page_protection_change_mutex_);
+  if (write_unprotect_counter_ == 0) {
+    // This is a corner case that may happen when we have a
+    // CodeSpaceMemoryModificationScope open and this page was newly
+    // added.
+    return;
+  }
+  write_unprotect_counter_--;
+  DCHECK_LT(write_unprotect_counter_, kMaxWriteUnprotectCounter);
+  if (write_unprotect_counter_ == 0) {
+    Address protect_start =
+        address() + MemoryChunkLayout::ObjectStartOffsetInCodePage();
+    size_t page_size = MemoryAllocator::GetCommitPageSize();
+    DCHECK(IsAligned(protect_start, page_size));
+    size_t protect_size = RoundUp(area_size(), page_size);
+    CHECK(reservation_.SetPermissions(protect_start, protect_size, permission));
+  }
+}
+
+void MemoryChunk::SetReadable() {
+  DecrementWriteUnprotectCounterAndMaybeSetPermissions(PageAllocator::kRead);
+}
+
+void MemoryChunk::SetReadAndExecutable() {
+  DCHECK(!FLAG_jitless);
+  DecrementWriteUnprotectCounterAndMaybeSetPermissions(
+      PageAllocator::kReadExecute);
+}
+
+void MemoryChunk::SetReadAndWritable() {
+  DCHECK(IsFlagSet(MemoryChunk::IS_EXECUTABLE));
+  DCHECK(owner_identity() == CODE_SPACE || owner_identity() == CODE_LO_SPACE);
+  // Incrementing the write_unprotect_counter_ and changing the page
+  // protection mode has to be atomic.
+  base::MutexGuard guard(page_protection_change_mutex_);
+  write_unprotect_counter_++;
+  DCHECK_LE(write_unprotect_counter_, kMaxWriteUnprotectCounter);
+  if (write_unprotect_counter_ == 1) {
+    Address unprotect_start =
+        address() + MemoryChunkLayout::ObjectStartOffsetInCodePage();
+    size_t page_size = MemoryAllocator::GetCommitPageSize();
+    DCHECK(IsAligned(unprotect_start, page_size));
+    size_t unprotect_size = RoundUp(area_size(), page_size);
+    CHECK(reservation_.SetPermissions(unprotect_start, unprotect_size,
+                                      PageAllocator::kReadWrite));
+  }
+}
+
+namespace {
+
+PageAllocator::Permission DefaultWritableCodePermissions() {
+  return FLAG_jitless ? PageAllocator::kReadWrite
+                      : PageAllocator::kReadWriteExecute;
+}
+
+}  // namespace
+
+MemoryChunk* MemoryChunk::Initialize(Heap* heap, Address base, size_t size,
+                                     Address area_start, Address area_end,
+                                     Executability executable, Space* owner,
+                                     VirtualMemory reservation) {
+  MemoryChunk* chunk = FromAddress(base);
+  DCHECK_EQ(base, chunk->address());
+  new (chunk) BasicMemoryChunk(size, area_start, area_end);
+
+  chunk->heap_ = heap;
+  chunk->set_owner(owner);
+  chunk->InitializeReservedMemory();
+  base::AsAtomicPointer::Release_Store(&chunk->slot_set_[OLD_TO_NEW], nullptr);
+  base::AsAtomicPointer::Release_Store(&chunk->slot_set_[OLD_TO_OLD], nullptr);
+  base::AsAtomicPointer::Release_Store(&chunk->sweeping_slot_set_, nullptr);
+  base::AsAtomicPointer::Release_Store(&chunk->typed_slot_set_[OLD_TO_NEW],
+                                       nullptr);
+  base::AsAtomicPointer::Release_Store(&chunk->typed_slot_set_[OLD_TO_OLD],
+                                       nullptr);
+  chunk->invalidated_slots_[OLD_TO_NEW] = nullptr;
+  chunk->invalidated_slots_[OLD_TO_OLD] = nullptr;
+  chunk->progress_bar_ = 0;
+  chunk->high_water_mark_ = static_cast<intptr_t>(area_start - base);
+  chunk->set_concurrent_sweeping_state(ConcurrentSweepingState::kDone);
+  chunk->page_protection_change_mutex_ = new base::Mutex();
+  chunk->write_unprotect_counter_ = 0;
+  chunk->mutex_ = new base::Mutex();
+  chunk->allocated_bytes_ = chunk->area_size();
+  chunk->wasted_memory_ = 0;
+  chunk->young_generation_bitmap_ = nullptr;
+  chunk->local_tracker_ = nullptr;
+
+  chunk->external_backing_store_bytes_[ExternalBackingStoreType::kArrayBuffer] =
+      0;
+  chunk->external_backing_store_bytes_
+      [ExternalBackingStoreType::kExternalString] = 0;
+
+  chunk->categories_ = nullptr;
+
+  heap->incremental_marking()->non_atomic_marking_state()->SetLiveBytes(chunk,
+                                                                        0);
+  if (owner->identity() == RO_SPACE) {
+    heap->incremental_marking()
+        ->non_atomic_marking_state()
+        ->bitmap(chunk)
+        ->MarkAllBits();
+    chunk->SetFlag(READ_ONLY_HEAP);
+  }
+
+  if (executable == EXECUTABLE) {
+    chunk->SetFlag(IS_EXECUTABLE);
+    if (heap->write_protect_code_memory()) {
+      chunk->write_unprotect_counter_ =
+          heap->code_space_memory_modification_scope_depth();
+    } else {
+      size_t page_size = MemoryAllocator::GetCommitPageSize();
+      DCHECK(IsAligned(area_start, page_size));
+      size_t area_size = RoundUp(area_end - area_start, page_size);
+      CHECK(reservation.SetPermissions(area_start, area_size,
+                                       DefaultWritableCodePermissions()));
+    }
+  }
+
+  chunk->reservation_ = std::move(reservation);
+
+  if (owner->identity() == CODE_SPACE) {
+    chunk->code_object_registry_ = new CodeObjectRegistry();
+  } else {
+    chunk->code_object_registry_ = nullptr;
+  }
+
+  chunk->possibly_empty_buckets_.Initialize();
+
+  return chunk;
+}
+
+size_t MemoryChunk::CommittedPhysicalMemory() {
+  if (!base::OS::HasLazyCommits() || owner_identity() == LO_SPACE)
+    return size();
+  return high_water_mark_;
+}
+
+bool MemoryChunk::InOldSpace() const { return owner_identity() == OLD_SPACE; }
+
+bool MemoryChunk::InLargeObjectSpace() const {
+  return owner_identity() == LO_SPACE;
+}
+
+void MemoryChunk::SetOldGenerationPageFlags(bool is_marking) {
+  if (is_marking) {
+    SetFlag(MemoryChunk::POINTERS_TO_HERE_ARE_INTERESTING);
+    SetFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
+    SetFlag(MemoryChunk::INCREMENTAL_MARKING);
+  } else {
+    ClearFlag(MemoryChunk::POINTERS_TO_HERE_ARE_INTERESTING);
+    SetFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
+    ClearFlag(MemoryChunk::INCREMENTAL_MARKING);
+  }
+}
+
+void MemoryChunk::SetYoungGenerationPageFlags(bool is_marking) {
+  SetFlag(MemoryChunk::POINTERS_TO_HERE_ARE_INTERESTING);
+  if (is_marking) {
+    SetFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
+    SetFlag(MemoryChunk::INCREMENTAL_MARKING);
+  } else {
+    ClearFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
+    ClearFlag(MemoryChunk::INCREMENTAL_MARKING);
+  }
+}
+// -----------------------------------------------------------------------------
+// MemoryChunk implementation
+
+void MemoryChunk::ReleaseAllocatedMemoryNeededForWritableChunk() {
+  if (mutex_ != nullptr) {
+    delete mutex_;
+    mutex_ = nullptr;
+  }
+  if (page_protection_change_mutex_ != nullptr) {
+    delete page_protection_change_mutex_;
+    page_protection_change_mutex_ = nullptr;
+  }
+  if (code_object_registry_ != nullptr) {
+    delete code_object_registry_;
+    code_object_registry_ = nullptr;
+  }
+
+  possibly_empty_buckets_.Release();
+  ReleaseSlotSet<OLD_TO_NEW>();
+  ReleaseSweepingSlotSet();
+  ReleaseSlotSet<OLD_TO_OLD>();
+  ReleaseTypedSlotSet<OLD_TO_NEW>();
+  ReleaseTypedSlotSet<OLD_TO_OLD>();
+  ReleaseInvalidatedSlots<OLD_TO_NEW>();
+  ReleaseInvalidatedSlots<OLD_TO_OLD>();
+
+  if (local_tracker_ != nullptr) ReleaseLocalTracker();
+  if (young_generation_bitmap_ != nullptr) ReleaseYoungGenerationBitmap();
+
+  if (!IsLargePage()) {
+    Page* page = static_cast<Page*>(this);
+    page->ReleaseFreeListCategories();
+  }
+}
+
+void MemoryChunk::ReleaseAllAllocatedMemory() {
+  ReleaseAllocatedMemoryNeededForWritableChunk();
+  if (marking_bitmap_ != nullptr) ReleaseMarkingBitmap();
+}
+
+template V8_EXPORT_PRIVATE SlotSet* MemoryChunk::AllocateSlotSet<OLD_TO_NEW>();
+template V8_EXPORT_PRIVATE SlotSet* MemoryChunk::AllocateSlotSet<OLD_TO_OLD>();
+
+template <RememberedSetType type>
+SlotSet* MemoryChunk::AllocateSlotSet() {
+  return AllocateSlotSet(&slot_set_[type]);
+}
+
+SlotSet* MemoryChunk::AllocateSweepingSlotSet() {
+  return AllocateSlotSet(&sweeping_slot_set_);
+}
+
+SlotSet* MemoryChunk::AllocateSlotSet(SlotSet** slot_set) {
+  SlotSet* new_slot_set = SlotSet::Allocate(buckets());
+  SlotSet* old_slot_set = base::AsAtomicPointer::AcquireRelease_CompareAndSwap(
+      slot_set, nullptr, new_slot_set);
+  if (old_slot_set != nullptr) {
+    SlotSet::Delete(new_slot_set, buckets());
+    new_slot_set = old_slot_set;
+  }
+  DCHECK(new_slot_set);
+  return new_slot_set;
+}
+
+template void MemoryChunk::ReleaseSlotSet<OLD_TO_NEW>();
+template void MemoryChunk::ReleaseSlotSet<OLD_TO_OLD>();
+
+template <RememberedSetType type>
+void MemoryChunk::ReleaseSlotSet() {
+  ReleaseSlotSet(&slot_set_[type]);
+}
+
+void MemoryChunk::ReleaseSweepingSlotSet() {
+  ReleaseSlotSet(&sweeping_slot_set_);
+}
+
+void MemoryChunk::ReleaseSlotSet(SlotSet** slot_set) {
+  if (*slot_set) {
+    SlotSet::Delete(*slot_set, buckets());
+    *slot_set = nullptr;
+  }
+}
+
+template TypedSlotSet* MemoryChunk::AllocateTypedSlotSet<OLD_TO_NEW>();
+template TypedSlotSet* MemoryChunk::AllocateTypedSlotSet<OLD_TO_OLD>();
+
+template <RememberedSetType type>
+TypedSlotSet* MemoryChunk::AllocateTypedSlotSet() {
+  TypedSlotSet* typed_slot_set = new TypedSlotSet(address());
+  TypedSlotSet* old_value = base::AsAtomicPointer::Release_CompareAndSwap(
+      &typed_slot_set_[type], nullptr, typed_slot_set);
+  if (old_value != nullptr) {
+    delete typed_slot_set;
+    typed_slot_set = old_value;
+  }
+  DCHECK(typed_slot_set);
+  return typed_slot_set;
+}
+
+template void MemoryChunk::ReleaseTypedSlotSet<OLD_TO_NEW>();
+template void MemoryChunk::ReleaseTypedSlotSet<OLD_TO_OLD>();
+
+template <RememberedSetType type>
+void MemoryChunk::ReleaseTypedSlotSet() {
+  TypedSlotSet* typed_slot_set = typed_slot_set_[type];
+  if (typed_slot_set) {
+    typed_slot_set_[type] = nullptr;
+    delete typed_slot_set;
+  }
+}
+
+template InvalidatedSlots* MemoryChunk::AllocateInvalidatedSlots<OLD_TO_NEW>();
+template InvalidatedSlots* MemoryChunk::AllocateInvalidatedSlots<OLD_TO_OLD>();
+
+template <RememberedSetType type>
+InvalidatedSlots* MemoryChunk::AllocateInvalidatedSlots() {
+  DCHECK_NULL(invalidated_slots_[type]);
+  invalidated_slots_[type] = new InvalidatedSlots();
+  return invalidated_slots_[type];
+}
+
+template void MemoryChunk::ReleaseInvalidatedSlots<OLD_TO_NEW>();
+template void MemoryChunk::ReleaseInvalidatedSlots<OLD_TO_OLD>();
+
+template <RememberedSetType type>
+void MemoryChunk::ReleaseInvalidatedSlots() {
+  if (invalidated_slots_[type]) {
+    delete invalidated_slots_[type];
+    invalidated_slots_[type] = nullptr;
+  }
+}
+
+template V8_EXPORT_PRIVATE void
+MemoryChunk::RegisterObjectWithInvalidatedSlots<OLD_TO_NEW>(HeapObject object);
+template V8_EXPORT_PRIVATE void
+MemoryChunk::RegisterObjectWithInvalidatedSlots<OLD_TO_OLD>(HeapObject object);
+
+template <RememberedSetType type>
+void MemoryChunk::RegisterObjectWithInvalidatedSlots(HeapObject object) {
+  bool skip_slot_recording;
+
+  if (type == OLD_TO_NEW) {
+    skip_slot_recording = InYoungGeneration();
+  } else {
+    skip_slot_recording = ShouldSkipEvacuationSlotRecording();
+  }
+
+  if (skip_slot_recording) {
+    return;
+  }
+
+  if (invalidated_slots<type>() == nullptr) {
+    AllocateInvalidatedSlots<type>();
+  }
+
+  invalidated_slots<type>()->insert(object);
+}
+
+void MemoryChunk::InvalidateRecordedSlots(HeapObject object) {
+  if (V8_DISABLE_WRITE_BARRIERS_BOOL) return;
+  if (heap()->incremental_marking()->IsCompacting()) {
+    // We cannot check slot_set_[OLD_TO_OLD] here, since the
+    // concurrent markers might insert slots concurrently.
+    RegisterObjectWithInvalidatedSlots<OLD_TO_OLD>(object);
+  }
+
+  if (!FLAG_always_promote_young_mc || slot_set_[OLD_TO_NEW] != nullptr)
+    RegisterObjectWithInvalidatedSlots<OLD_TO_NEW>(object);
+}
+
+template bool MemoryChunk::RegisteredObjectWithInvalidatedSlots<OLD_TO_NEW>(
+    HeapObject object);
+template bool MemoryChunk::RegisteredObjectWithInvalidatedSlots<OLD_TO_OLD>(
+    HeapObject object);
+
+template <RememberedSetType type>
+bool MemoryChunk::RegisteredObjectWithInvalidatedSlots(HeapObject object) {
+  if (invalidated_slots<type>() == nullptr) {
+    return false;
+  }
+  return invalidated_slots<type>()->find(object) !=
+         invalidated_slots<type>()->end();
+}
+
+void MemoryChunk::ReleaseLocalTracker() {
+  DCHECK_NOT_NULL(local_tracker_);
+  delete local_tracker_;
+  local_tracker_ = nullptr;
+}
+
+void MemoryChunk::AllocateYoungGenerationBitmap() {
+  DCHECK_NULL(young_generation_bitmap_);
+  young_generation_bitmap_ = static_cast<Bitmap*>(calloc(1, Bitmap::kSize));
+}
+
+void MemoryChunk::ReleaseYoungGenerationBitmap() {
+  DCHECK_NOT_NULL(young_generation_bitmap_);
+  free(young_generation_bitmap_);
+  young_generation_bitmap_ = nullptr;
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/heap/memory-chunk.h b/deps/v8/src/heap/memory-chunk.h
new file mode 100644
index 00000000000..f80107c1926
--- /dev/null
+++ b/deps/v8/src/heap/memory-chunk.h
@@ -0,0 +1,485 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_MEMORY_CHUNK_H_
+#define V8_HEAP_MEMORY_CHUNK_H_
+
+#include <atomic>
+
+#include "src/base/macros.h"
+#include "src/base/platform/mutex.h"
+#include "src/common/globals.h"
+#include "src/heap/basic-memory-chunk.h"
+#include "src/heap/heap.h"
+#include "src/heap/invalidated-slots.h"
+#include "src/heap/list.h"
+#include "src/heap/marking.h"
+#include "src/heap/slot-set.h"
+
+namespace v8 {
+namespace internal {
+
+class CodeObjectRegistry;
+class FreeListCategory;
+class LocalArrayBufferTracker;
+
+class V8_EXPORT_PRIVATE MemoryChunkLayout {
+ public:
+  static size_t CodePageGuardStartOffset();
+  static size_t CodePageGuardSize();
+  static intptr_t ObjectStartOffsetInCodePage();
+  static intptr_t ObjectEndOffsetInCodePage();
+  static size_t AllocatableMemoryInCodePage();
+  static intptr_t ObjectStartOffsetInDataPage();
+  static size_t AllocatableMemoryInDataPage();
+  static size_t ObjectStartOffsetInMemoryChunk(AllocationSpace space);
+  static size_t AllocatableMemoryInMemoryChunk(AllocationSpace space);
+};
+
+// MemoryChunk represents a memory region owned by a specific space.
+// It is divided into the header and the body. Chunk start is always
+// 1MB aligned. Start of the body is aligned so it can accommodate
+// any heap object.
+class MemoryChunk : public BasicMemoryChunk {
+ public:
+  // Use with std data structures.
+  struct Hasher {
+    size_t operator()(MemoryChunk* const chunk) const {
+      return reinterpret_cast<size_t>(chunk) >> kPageSizeBits;
+    }
+  };
+
+  using Flags = uintptr_t;
+
+  static const Flags kPointersToHereAreInterestingMask =
+      POINTERS_TO_HERE_ARE_INTERESTING;
+
+  static const Flags kPointersFromHereAreInterestingMask =
+      POINTERS_FROM_HERE_ARE_INTERESTING;
+
+  static const Flags kEvacuationCandidateMask = EVACUATION_CANDIDATE;
+
+  static const Flags kIsInYoungGenerationMask = FROM_PAGE | TO_PAGE;
+
+  static const Flags kIsLargePageMask = LARGE_PAGE;
+
+  static const Flags kSkipEvacuationSlotsRecordingMask =
+      kEvacuationCandidateMask | kIsInYoungGenerationMask;
+
+  // |kDone|: The page state when sweeping is complete or sweeping must not be
+  //   performed on that page. Sweeper threads that are done with their work
+  //   will set this value and not touch the page anymore.
+  // |kPending|: This page is ready for parallel sweeping.
+  // |kInProgress|: This page is currently swept by a sweeper thread.
+  enum class ConcurrentSweepingState : intptr_t {
+    kDone,
+    kPending,
+    kInProgress,
+  };
+
+  static const size_t kHeaderSize =
+      BasicMemoryChunk::kHeaderSize                          // Parent size.
+      + kSystemPointerSize * NUMBER_OF_REMEMBERED_SET_TYPES  // SlotSet* array
+      + 3 * kSystemPointerSize  // VirtualMemory reservation_
+      + kSystemPointerSize      // Address owner_
+      + kSizetSize              // size_t progress_bar_
+      + kIntptrSize             // intptr_t live_byte_count_
+      + kSystemPointerSize      // SlotSet* sweeping_slot_set_
+      + kSystemPointerSize *
+            NUMBER_OF_REMEMBERED_SET_TYPES  // TypedSlotSet* array
+      + kSystemPointerSize *
+            NUMBER_OF_REMEMBERED_SET_TYPES  // InvalidatedSlots* array
+      + kSystemPointerSize  // std::atomic<intptr_t> high_water_mark_
+      + kSystemPointerSize  // base::Mutex* mutex_
+      + kSystemPointerSize  // std::atomic<ConcurrentSweepingState>
+                            // concurrent_sweeping_
+      + kSystemPointerSize  // base::Mutex* page_protection_change_mutex_
+      + kSystemPointerSize  // unitptr_t write_unprotect_counter_
+      + kSizetSize * ExternalBackingStoreType::kNumTypes
+      // std::atomic<size_t> external_backing_store_bytes_
+      + kSizetSize              // size_t allocated_bytes_
+      + kSizetSize              // size_t wasted_memory_
+      + kSystemPointerSize * 2  // heap::ListNode
+      + kSystemPointerSize      // FreeListCategory** categories__
+      + kSystemPointerSize      // LocalArrayBufferTracker* local_tracker_
+      + kIntptrSize  // std::atomic<intptr_t> young_generation_live_byte_count_
+      + kSystemPointerSize   // Bitmap* young_generation_bitmap_
+      + kSystemPointerSize   // CodeObjectRegistry* code_object_registry_
+      + kSystemPointerSize;  // PossiblyEmptyBuckets possibly_empty_buckets_
+
+  static const intptr_t kOldToNewSlotSetOffset = BasicMemoryChunk::kHeaderSize;
+
+  // Page size in bytes.  This must be a multiple of the OS page size.
+  static const int kPageSize = 1 << kPageSizeBits;
+
+  // Maximum number of nested code memory modification scopes.
+  static const int kMaxWriteUnprotectCounter = 3;
+
+  // Only works if the pointer is in the first kPageSize of the MemoryChunk.
+  static MemoryChunk* FromAddress(Address a) {
+    DCHECK(!V8_ENABLE_THIRD_PARTY_HEAP_BOOL);
+    return reinterpret_cast<MemoryChunk*>(BaseAddress(a));
+  }
+  // Only works if the object is in the first kPageSize of the MemoryChunk.
+  static MemoryChunk* FromHeapObject(HeapObject o) {
+    DCHECK(!V8_ENABLE_THIRD_PARTY_HEAP_BOOL);
+    return reinterpret_cast<MemoryChunk*>(BaseAddress(o.ptr()));
+  }
+
+  size_t buckets() const { return SlotSet::BucketsForSize(size()); }
+
+  void SetOldGenerationPageFlags(bool is_marking);
+  void SetYoungGenerationPageFlags(bool is_marking);
+
+  static inline void UpdateHighWaterMark(Address mark) {
+    if (mark == kNullAddress) return;
+    // Need to subtract one from the mark because when a chunk is full the
+    // top points to the next address after the chunk, which effectively belongs
+    // to another chunk. See the comment to Page::FromAllocationAreaAddress.
+    MemoryChunk* chunk = MemoryChunk::FromAddress(mark - 1);
+    intptr_t new_mark = static_cast<intptr_t>(mark - chunk->address());
+    intptr_t old_mark = chunk->high_water_mark_.load(std::memory_order_relaxed);
+    while ((new_mark > old_mark) &&
+           !chunk->high_water_mark_.compare_exchange_weak(
+               old_mark, new_mark, std::memory_order_acq_rel)) {
+    }
+  }
+
+  static inline void MoveExternalBackingStoreBytes(
+      ExternalBackingStoreType type, MemoryChunk* from, MemoryChunk* to,
+      size_t amount);
+
+  void DiscardUnusedMemory(Address addr, size_t size);
+
+  base::Mutex* mutex() { return mutex_; }
+
+  void set_concurrent_sweeping_state(ConcurrentSweepingState state) {
+    concurrent_sweeping_ = state;
+  }
+
+  ConcurrentSweepingState concurrent_sweeping_state() {
+    return static_cast<ConcurrentSweepingState>(concurrent_sweeping_.load());
+  }
+
+  bool SweepingDone() {
+    return concurrent_sweeping_ == ConcurrentSweepingState::kDone;
+  }
+
+  inline Heap* heap() const {
+    DCHECK_NOT_NULL(heap_);
+    return heap_;
+  }
+
+#ifdef THREAD_SANITIZER
+  // Perform a dummy acquire load to tell TSAN that there is no data race in
+  // mark-bit initialization. See MemoryChunk::Initialize for the corresponding
+  // release store.
+  void SynchronizedHeapLoad();
+#endif
+
+  template <RememberedSetType type>
+  bool ContainsSlots() {
+    return slot_set<type>() != nullptr || typed_slot_set<type>() != nullptr ||
+           invalidated_slots<type>() != nullptr;
+  }
+
+  template <RememberedSetType type, AccessMode access_mode = AccessMode::ATOMIC>
+  SlotSet* slot_set() {
+    if (access_mode == AccessMode::ATOMIC)
+      return base::AsAtomicPointer::Acquire_Load(&slot_set_[type]);
+    return slot_set_[type];
+  }
+
+  template <AccessMode access_mode = AccessMode::ATOMIC>
+  SlotSet* sweeping_slot_set() {
+    if (access_mode == AccessMode::ATOMIC)
+      return base::AsAtomicPointer::Acquire_Load(&sweeping_slot_set_);
+    return sweeping_slot_set_;
+  }
+
+  template <RememberedSetType type, AccessMode access_mode = AccessMode::ATOMIC>
+  TypedSlotSet* typed_slot_set() {
+    if (access_mode == AccessMode::ATOMIC)
+      return base::AsAtomicPointer::Acquire_Load(&typed_slot_set_[type]);
+    return typed_slot_set_[type];
+  }
+
+  template <RememberedSetType type>
+  V8_EXPORT_PRIVATE SlotSet* AllocateSlotSet();
+  SlotSet* AllocateSweepingSlotSet();
+  SlotSet* AllocateSlotSet(SlotSet** slot_set);
+
+  // Not safe to be called concurrently.
+  template <RememberedSetType type>
+  void ReleaseSlotSet();
+  void ReleaseSlotSet(SlotSet** slot_set);
+  void ReleaseSweepingSlotSet();
+  template <RememberedSetType type>
+  TypedSlotSet* AllocateTypedSlotSet();
+  // Not safe to be called concurrently.
+  template <RememberedSetType type>
+  void ReleaseTypedSlotSet();
+
+  template <RememberedSetType type>
+  InvalidatedSlots* AllocateInvalidatedSlots();
+  template <RememberedSetType type>
+  void ReleaseInvalidatedSlots();
+  template <RememberedSetType type>
+  V8_EXPORT_PRIVATE void RegisterObjectWithInvalidatedSlots(HeapObject object);
+  void InvalidateRecordedSlots(HeapObject object);
+  template <RememberedSetType type>
+  bool RegisteredObjectWithInvalidatedSlots(HeapObject object);
+  template <RememberedSetType type>
+  InvalidatedSlots* invalidated_slots() {
+    return invalidated_slots_[type];
+  }
+
+  void ReleaseLocalTracker();
+
+  void AllocateYoungGenerationBitmap();
+  void ReleaseYoungGenerationBitmap();
+
+  int FreeListsLength();
+
+  // Approximate amount of physical memory committed for this chunk.
+  V8_EXPORT_PRIVATE size_t CommittedPhysicalMemory();
+
+  Address HighWaterMark() { return address() + high_water_mark_; }
+
+  size_t ProgressBar() {
+    DCHECK(IsFlagSet<AccessMode::ATOMIC>(HAS_PROGRESS_BAR));
+    return progress_bar_.load(std::memory_order_acquire);
+  }
+
+  bool TrySetProgressBar(size_t old_value, size_t new_value) {
+    DCHECK(IsFlagSet<AccessMode::ATOMIC>(HAS_PROGRESS_BAR));
+    return progress_bar_.compare_exchange_strong(old_value, new_value,
+                                                 std::memory_order_acq_rel);
+  }
+
+  void ResetProgressBar() {
+    if (IsFlagSet(MemoryChunk::HAS_PROGRESS_BAR)) {
+      progress_bar_.store(0, std::memory_order_release);
+    }
+  }
+
+  inline void IncrementExternalBackingStoreBytes(ExternalBackingStoreType type,
+                                                 size_t amount);
+
+  inline void DecrementExternalBackingStoreBytes(ExternalBackingStoreType type,
+                                                 size_t amount);
+
+  size_t ExternalBackingStoreBytes(ExternalBackingStoreType type) {
+    return external_backing_store_bytes_[type];
+  }
+
+  // Some callers rely on the fact that this can operate on both
+  // tagged and aligned object addresses.
+  inline uint32_t AddressToMarkbitIndex(Address addr) const {
+    return static_cast<uint32_t>(addr - this->address()) >> kTaggedSizeLog2;
+  }
+
+  inline Address MarkbitIndexToAddress(uint32_t index) const {
+    return this->address() + (index << kTaggedSizeLog2);
+  }
+
+  bool NeverEvacuate() { return IsFlagSet(NEVER_EVACUATE); }
+
+  void MarkNeverEvacuate() { SetFlag(NEVER_EVACUATE); }
+
+  bool CanAllocate() {
+    return !IsEvacuationCandidate() && !IsFlagSet(NEVER_ALLOCATE_ON_PAGE);
+  }
+
+  template <AccessMode access_mode = AccessMode::NON_ATOMIC>
+  bool IsEvacuationCandidate() {
+    DCHECK(!(IsFlagSet<access_mode>(NEVER_EVACUATE) &&
+             IsFlagSet<access_mode>(EVACUATION_CANDIDATE)));
+    return IsFlagSet<access_mode>(EVACUATION_CANDIDATE);
+  }
+
+  template <AccessMode access_mode = AccessMode::NON_ATOMIC>
+  bool ShouldSkipEvacuationSlotRecording() {
+    uintptr_t flags = GetFlags<access_mode>();
+    return ((flags & kSkipEvacuationSlotsRecordingMask) != 0) &&
+           ((flags & COMPACTION_WAS_ABORTED) == 0);
+  }
+
+  Executability executable() {
+    return IsFlagSet(IS_EXECUTABLE) ? EXECUTABLE : NOT_EXECUTABLE;
+  }
+
+  bool IsFromPage() const { return IsFlagSet(FROM_PAGE); }
+  bool IsToPage() const { return IsFlagSet(TO_PAGE); }
+  bool IsLargePage() const { return IsFlagSet(LARGE_PAGE); }
+  bool InYoungGeneration() const {
+    return (GetFlags() & kIsInYoungGenerationMask) != 0;
+  }
+  bool InNewSpace() const { return InYoungGeneration() && !IsLargePage(); }
+  bool InNewLargeObjectSpace() const {
+    return InYoungGeneration() && IsLargePage();
+  }
+  bool InOldSpace() const;
+  V8_EXPORT_PRIVATE bool InLargeObjectSpace() const;
+
+  // Gets the chunk's owner or null if the space has been detached.
+  Space* owner() const { return owner_; }
+
+  void set_owner(Space* space) { owner_ = space; }
+
+  bool IsWritable() const {
+    // If this is a read-only space chunk but heap_ is non-null, it has not yet
+    // been sealed and can be written to.
+    return !InReadOnlySpace() || heap_ != nullptr;
+  }
+
+  // Gets the chunk's allocation space, potentially dealing with a null owner_
+  // (like read-only chunks have).
+  inline AllocationSpace owner_identity() const;
+
+  // Emits a memory barrier. For TSAN builds the other thread needs to perform
+  // MemoryChunk::synchronized_heap() to simulate the barrier.
+  void InitializationMemoryFence();
+
+  V8_EXPORT_PRIVATE void SetReadable();
+  V8_EXPORT_PRIVATE void SetReadAndExecutable();
+  V8_EXPORT_PRIVATE void SetReadAndWritable();
+
+  void SetDefaultCodePermissions() {
+    if (FLAG_jitless) {
+      SetReadable();
+    } else {
+      SetReadAndExecutable();
+    }
+  }
+
+  heap::ListNode<MemoryChunk>& list_node() { return list_node_; }
+  const heap::ListNode<MemoryChunk>& list_node() const { return list_node_; }
+
+  CodeObjectRegistry* GetCodeObjectRegistry() { return code_object_registry_; }
+
+  PossiblyEmptyBuckets* possibly_empty_buckets() {
+    return &possibly_empty_buckets_;
+  }
+
+  // Release memory allocated by the chunk, except that which is needed by
+  // read-only space chunks.
+  void ReleaseAllocatedMemoryNeededForWritableChunk();
+
+ protected:
+  static MemoryChunk* Initialize(Heap* heap, Address base, size_t size,
+                                 Address area_start, Address area_end,
+                                 Executability executable, Space* owner,
+                                 VirtualMemory reservation);
+
+  // Release all memory allocated by the chunk. Should be called when memory
+  // chunk is about to be freed.
+  void ReleaseAllAllocatedMemory();
+
+  // Sets the requested page permissions only if the write unprotect counter
+  // has reached 0.
+  void DecrementWriteUnprotectCounterAndMaybeSetPermissions(
+      PageAllocator::Permission permission);
+
+  VirtualMemory* reserved_memory() { return &reservation_; }
+
+  template <AccessMode mode>
+  ConcurrentBitmap<mode>* marking_bitmap() const {
+    return reinterpret_cast<ConcurrentBitmap<mode>*>(marking_bitmap_);
+  }
+
+  template <AccessMode mode>
+  ConcurrentBitmap<mode>* young_generation_bitmap() const {
+    return reinterpret_cast<ConcurrentBitmap<mode>*>(young_generation_bitmap_);
+  }
+
+  // A single slot set for small pages (of size kPageSize) or an array of slot
+  // set for large pages. In the latter case the number of entries in the array
+  // is ceil(size() / kPageSize).
+  SlotSet* slot_set_[NUMBER_OF_REMEMBERED_SET_TYPES];
+
+  // If the chunk needs to remember its memory reservation, it is stored here.
+  VirtualMemory reservation_;
+
+  // The space owning this memory chunk.
+  std::atomic<Space*> owner_;
+
+  // Used by the incremental marker to keep track of the scanning progress in
+  // large objects that have a progress bar and are scanned in increments.
+  std::atomic<size_t> progress_bar_;
+
+  // Count of bytes marked black on page.
+  std::atomic<intptr_t> live_byte_count_;
+
+  // A single slot set for small pages (of size kPageSize) or an array of slot
+  // set for large pages. In the latter case the number of entries in the array
+  // is ceil(size() / kPageSize).
+  SlotSet* sweeping_slot_set_;
+  TypedSlotSet* typed_slot_set_[NUMBER_OF_REMEMBERED_SET_TYPES];
+  InvalidatedSlots* invalidated_slots_[NUMBER_OF_REMEMBERED_SET_TYPES];
+
+  // Assuming the initial allocation on a page is sequential,
+  // count highest number of bytes ever allocated on the page.
+  std::atomic<intptr_t> high_water_mark_;
+
+  base::Mutex* mutex_;
+
+  std::atomic<ConcurrentSweepingState> concurrent_sweeping_;
+
+  base::Mutex* page_protection_change_mutex_;
+
+  // This field is only relevant for code pages. It depicts the number of
+  // times a component requested this page to be read+writeable. The
+  // counter is decremented when a component resets to read+executable.
+  // If Value() == 0 => The memory is read and executable.
+  // If Value() >= 1 => The Memory is read and writable (and maybe executable).
+  // The maximum value is limited by {kMaxWriteUnprotectCounter} to prevent
+  // excessive nesting of scopes.
+  // All executable MemoryChunks are allocated rw based on the assumption that
+  // they will be used immediately for an allocation. They are initialized
+  // with the number of open CodeSpaceMemoryModificationScopes. The caller
+  // that triggers the page allocation is responsible for decrementing the
+  // counter.
+  uintptr_t write_unprotect_counter_;
+
+  // Byte allocated on the page, which includes all objects on the page
+  // and the linear allocation area.
+  size_t allocated_bytes_;
+
+  // Tracks off-heap memory used by this memory chunk.
+  std::atomic<size_t> external_backing_store_bytes_[kNumTypes];
+
+  // Freed memory that was not added to the free list.
+  size_t wasted_memory_;
+
+  heap::ListNode<MemoryChunk> list_node_;
+
+  FreeListCategory** categories_;
+
+  LocalArrayBufferTracker* local_tracker_;
+
+  std::atomic<intptr_t> young_generation_live_byte_count_;
+  Bitmap* young_generation_bitmap_;
+
+  CodeObjectRegistry* code_object_registry_;
+
+  PossiblyEmptyBuckets possibly_empty_buckets_;
+
+ private:
+  void InitializeReservedMemory() { reservation_.Reset(); }
+
+  friend class ConcurrentMarkingState;
+  friend class MajorMarkingState;
+  friend class MajorAtomicMarkingState;
+  friend class MajorNonAtomicMarkingState;
+  friend class MemoryAllocator;
+  friend class MinorMarkingState;
+  friend class MinorNonAtomicMarkingState;
+  friend class PagedSpace;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_MEMORY_CHUNK_H_
diff --git a/deps/v8/src/heap/new-spaces-inl.h b/deps/v8/src/heap/new-spaces-inl.h
new file mode 100644
index 00000000000..889d1672455
--- /dev/null
+++ b/deps/v8/src/heap/new-spaces-inl.h
@@ -0,0 +1,179 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_NEW_SPACES_INL_H_
+#define V8_HEAP_NEW_SPACES_INL_H_
+
+#include "src/heap/new-spaces.h"
+#include "src/heap/spaces-inl.h"
+#include "src/objects/tagged-impl.h"
+#include "src/sanitizer/msan.h"
+
+namespace v8 {
+namespace internal {
+
+// -----------------------------------------------------------------------------
+// SemiSpace
+
+bool SemiSpace::Contains(HeapObject o) const {
+  MemoryChunk* memory_chunk = MemoryChunk::FromHeapObject(o);
+  if (memory_chunk->IsLargePage()) return false;
+  return id_ == kToSpace ? memory_chunk->IsToPage()
+                         : memory_chunk->IsFromPage();
+}
+
+bool SemiSpace::Contains(Object o) const {
+  return o.IsHeapObject() && Contains(HeapObject::cast(o));
+}
+
+bool SemiSpace::ContainsSlow(Address a) const {
+  for (const Page* p : *this) {
+    if (p == MemoryChunk::FromAddress(a)) return true;
+  }
+  return false;
+}
+
+// --------------------------------------------------------------------------
+// NewSpace
+
+bool NewSpace::Contains(Object o) const {
+  return o.IsHeapObject() && Contains(HeapObject::cast(o));
+}
+
+bool NewSpace::Contains(HeapObject o) const {
+  return MemoryChunk::FromHeapObject(o)->InNewSpace();
+}
+
+bool NewSpace::ContainsSlow(Address a) const {
+  return from_space_.ContainsSlow(a) || to_space_.ContainsSlow(a);
+}
+
+bool NewSpace::ToSpaceContainsSlow(Address a) const {
+  return to_space_.ContainsSlow(a);
+}
+
+bool NewSpace::ToSpaceContains(Object o) const { return to_space_.Contains(o); }
+bool NewSpace::FromSpaceContains(Object o) const {
+  return from_space_.Contains(o);
+}
+
+// -----------------------------------------------------------------------------
+// SemiSpaceObjectIterator
+
+HeapObject SemiSpaceObjectIterator::Next() {
+  while (current_ != limit_) {
+    if (Page::IsAlignedToPageSize(current_)) {
+      Page* page = Page::FromAllocationAreaAddress(current_);
+      page = page->next_page();
+      DCHECK(page);
+      current_ = page->area_start();
+      if (current_ == limit_) return HeapObject();
+    }
+    HeapObject object = HeapObject::FromAddress(current_);
+    current_ += object.Size();
+    if (!object.IsFreeSpaceOrFiller()) {
+      return object;
+    }
+  }
+  return HeapObject();
+}
+
+// -----------------------------------------------------------------------------
+// NewSpace
+
+AllocationResult NewSpace::AllocateRawAligned(int size_in_bytes,
+                                              AllocationAlignment alignment,
+                                              AllocationOrigin origin) {
+  Address top = allocation_info_.top();
+  int filler_size = Heap::GetFillToAlign(top, alignment);
+  int aligned_size_in_bytes = size_in_bytes + filler_size;
+
+  if (allocation_info_.limit() - top <
+      static_cast<uintptr_t>(aligned_size_in_bytes)) {
+    // See if we can create room.
+    if (!EnsureAllocation(size_in_bytes, alignment)) {
+      return AllocationResult::Retry();
+    }
+
+    top = allocation_info_.top();
+    filler_size = Heap::GetFillToAlign(top, alignment);
+    aligned_size_in_bytes = size_in_bytes + filler_size;
+  }
+
+  HeapObject obj = HeapObject::FromAddress(top);
+  allocation_info_.set_top(top + aligned_size_in_bytes);
+  DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
+
+  if (filler_size > 0) {
+    obj = Heap::PrecedeWithFiller(ReadOnlyRoots(heap()), obj, filler_size);
+  }
+
+  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(obj.address(), size_in_bytes);
+
+  if (FLAG_trace_allocations_origins) {
+    UpdateAllocationOrigins(origin);
+  }
+
+  return obj;
+}
+
+AllocationResult NewSpace::AllocateRawUnaligned(int size_in_bytes,
+                                                AllocationOrigin origin) {
+  Address top = allocation_info_.top();
+  if (allocation_info_.limit() < top + size_in_bytes) {
+    // See if we can create room.
+    if (!EnsureAllocation(size_in_bytes, kWordAligned)) {
+      return AllocationResult::Retry();
+    }
+
+    top = allocation_info_.top();
+  }
+
+  HeapObject obj = HeapObject::FromAddress(top);
+  allocation_info_.set_top(top + size_in_bytes);
+  DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
+
+  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(obj.address(), size_in_bytes);
+
+  if (FLAG_trace_allocations_origins) {
+    UpdateAllocationOrigins(origin);
+  }
+
+  return obj;
+}
+
+AllocationResult NewSpace::AllocateRaw(int size_in_bytes,
+                                       AllocationAlignment alignment,
+                                       AllocationOrigin origin) {
+  if (top() < top_on_previous_step_) {
+    // Generated code decreased the top() pointer to do folded allocations
+    DCHECK_EQ(Page::FromAllocationAreaAddress(top()),
+              Page::FromAllocationAreaAddress(top_on_previous_step_));
+    top_on_previous_step_ = top();
+  }
+#ifdef V8_HOST_ARCH_32_BIT
+  return alignment != kWordAligned
+             ? AllocateRawAligned(size_in_bytes, alignment, origin)
+             : AllocateRawUnaligned(size_in_bytes, origin);
+#else
+#ifdef V8_COMPRESS_POINTERS
+  // TODO(ishell, v8:8875): Consider using aligned allocations once the
+  // allocation alignment inconsistency is fixed. For now we keep using
+  // unaligned access since both x64 and arm64 architectures (where pointer
+  // compression is supported) allow unaligned access to doubles and full words.
+#endif  // V8_COMPRESS_POINTERS
+  return AllocateRawUnaligned(size_in_bytes, origin);
+#endif
+}
+
+V8_WARN_UNUSED_RESULT inline AllocationResult NewSpace::AllocateRawSynchronized(
+    int size_in_bytes, AllocationAlignment alignment, AllocationOrigin origin) {
+  base::MutexGuard guard(&mutex_);
+  return AllocateRaw(size_in_bytes, alignment, origin);
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_NEW_SPACES_INL_H_
diff --git a/deps/v8/src/heap/new-spaces.cc b/deps/v8/src/heap/new-spaces.cc
new file mode 100644
index 00000000000..f99734f6251
--- /dev/null
+++ b/deps/v8/src/heap/new-spaces.cc
@@ -0,0 +1,653 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/new-spaces.h"
+
+#include "src/heap/array-buffer-sweeper.h"
+#include "src/heap/array-buffer-tracker-inl.h"
+#include "src/heap/heap-inl.h"
+#include "src/heap/incremental-marking.h"
+#include "src/heap/mark-compact.h"
+#include "src/heap/memory-allocator.h"
+#include "src/heap/paged-spaces.h"
+#include "src/heap/spaces-inl.h"
+
+namespace v8 {
+namespace internal {
+
+Page* SemiSpace::InitializePage(MemoryChunk* chunk) {
+  bool in_to_space = (id() != kFromSpace);
+  chunk->SetFlag(in_to_space ? MemoryChunk::TO_PAGE : MemoryChunk::FROM_PAGE);
+  Page* page = static_cast<Page*>(chunk);
+  page->SetYoungGenerationPageFlags(heap()->incremental_marking()->IsMarking());
+  page->AllocateLocalTracker();
+  page->list_node().Initialize();
+#ifdef ENABLE_MINOR_MC
+  if (FLAG_minor_mc) {
+    page->AllocateYoungGenerationBitmap();
+    heap()
+        ->minor_mark_compact_collector()
+        ->non_atomic_marking_state()
+        ->ClearLiveness(page);
+  }
+#endif  // ENABLE_MINOR_MC
+  page->InitializationMemoryFence();
+  return page;
+}
+
+bool SemiSpace::EnsureCurrentCapacity() {
+  if (is_committed()) {
+    const int expected_pages =
+        static_cast<int>(current_capacity_ / Page::kPageSize);
+    MemoryChunk* current_page = first_page();
+    int actual_pages = 0;
+
+    // First iterate through the pages list until expected pages if so many
+    // pages exist.
+    while (current_page != nullptr && actual_pages < expected_pages) {
+      actual_pages++;
+      current_page = current_page->list_node().next();
+    }
+
+    // Free all overallocated pages which are behind current_page.
+    while (current_page) {
+      MemoryChunk* next_current = current_page->list_node().next();
+      memory_chunk_list_.Remove(current_page);
+      // Clear new space flags to avoid this page being treated as a new
+      // space page that is potentially being swept.
+      current_page->SetFlags(0, Page::kIsInYoungGenerationMask);
+      heap()->memory_allocator()->Free<MemoryAllocator::kPooledAndQueue>(
+          current_page);
+      current_page = next_current;
+    }
+
+    // Add more pages if we have less than expected_pages.
+    IncrementalMarking::NonAtomicMarkingState* marking_state =
+        heap()->incremental_marking()->non_atomic_marking_state();
+    while (actual_pages < expected_pages) {
+      actual_pages++;
+      current_page =
+          heap()->memory_allocator()->AllocatePage<MemoryAllocator::kPooled>(
+              MemoryChunkLayout::AllocatableMemoryInDataPage(), this,
+              NOT_EXECUTABLE);
+      if (current_page == nullptr) return false;
+      DCHECK_NOT_NULL(current_page);
+      memory_chunk_list_.PushBack(current_page);
+      marking_state->ClearLiveness(current_page);
+      current_page->SetFlags(first_page()->GetFlags(),
+                             static_cast<uintptr_t>(Page::kCopyAllFlags));
+      heap()->CreateFillerObjectAt(current_page->area_start(),
+                                   static_cast<int>(current_page->area_size()),
+                                   ClearRecordedSlots::kNo);
+    }
+  }
+  return true;
+}
+
+// -----------------------------------------------------------------------------
+// SemiSpace implementation
+
+void SemiSpace::SetUp(size_t initial_capacity, size_t maximum_capacity) {
+  DCHECK_GE(maximum_capacity, static_cast<size_t>(Page::kPageSize));
+  minimum_capacity_ = RoundDown(initial_capacity, Page::kPageSize);
+  current_capacity_ = minimum_capacity_;
+  maximum_capacity_ = RoundDown(maximum_capacity, Page::kPageSize);
+  committed_ = false;
+}
+
+void SemiSpace::TearDown() {
+  // Properly uncommit memory to keep the allocator counters in sync.
+  if (is_committed()) {
+    Uncommit();
+  }
+  current_capacity_ = maximum_capacity_ = 0;
+}
+
+bool SemiSpace::Commit() {
+  DCHECK(!is_committed());
+  const int num_pages = static_cast<int>(current_capacity_ / Page::kPageSize);
+  for (int pages_added = 0; pages_added < num_pages; pages_added++) {
+    // Pages in the new spaces can be moved to the old space by the full
+    // collector. Therefore, they must be initialized with the same FreeList as
+    // old pages.
+    Page* new_page =
+        heap()->memory_allocator()->AllocatePage<MemoryAllocator::kPooled>(
+            MemoryChunkLayout::AllocatableMemoryInDataPage(), this,
+            NOT_EXECUTABLE);
+    if (new_page == nullptr) {
+      if (pages_added) RewindPages(pages_added);
+      return false;
+    }
+    memory_chunk_list_.PushBack(new_page);
+  }
+  Reset();
+  AccountCommitted(current_capacity_);
+  if (age_mark_ == kNullAddress) {
+    age_mark_ = first_page()->area_start();
+  }
+  committed_ = true;
+  return true;
+}
+
+bool SemiSpace::Uncommit() {
+  DCHECK(is_committed());
+  while (!memory_chunk_list_.Empty()) {
+    MemoryChunk* chunk = memory_chunk_list_.front();
+    memory_chunk_list_.Remove(chunk);
+    heap()->memory_allocator()->Free<MemoryAllocator::kPooledAndQueue>(chunk);
+  }
+  current_page_ = nullptr;
+  AccountUncommitted(current_capacity_);
+  committed_ = false;
+  heap()->memory_allocator()->unmapper()->FreeQueuedChunks();
+  return true;
+}
+
+size_t SemiSpace::CommittedPhysicalMemory() {
+  if (!is_committed()) return 0;
+  size_t size = 0;
+  for (Page* p : *this) {
+    size += p->CommittedPhysicalMemory();
+  }
+  return size;
+}
+
+bool SemiSpace::GrowTo(size_t new_capacity) {
+  if (!is_committed()) {
+    if (!Commit()) return false;
+  }
+  DCHECK_EQ(new_capacity & kPageAlignmentMask, 0u);
+  DCHECK_LE(new_capacity, maximum_capacity_);
+  DCHECK_GT(new_capacity, current_capacity_);
+  const size_t delta = new_capacity - current_capacity_;
+  DCHECK(IsAligned(delta, AllocatePageSize()));
+  const int delta_pages = static_cast<int>(delta / Page::kPageSize);
+  DCHECK(last_page());
+  IncrementalMarking::NonAtomicMarkingState* marking_state =
+      heap()->incremental_marking()->non_atomic_marking_state();
+  for (int pages_added = 0; pages_added < delta_pages; pages_added++) {
+    Page* new_page =
+        heap()->memory_allocator()->AllocatePage<MemoryAllocator::kPooled>(
+            MemoryChunkLayout::AllocatableMemoryInDataPage(), this,
+            NOT_EXECUTABLE);
+    if (new_page == nullptr) {
+      if (pages_added) RewindPages(pages_added);
+      return false;
+    }
+    memory_chunk_list_.PushBack(new_page);
+    marking_state->ClearLiveness(new_page);
+    // Duplicate the flags that was set on the old page.
+    new_page->SetFlags(last_page()->GetFlags(), Page::kCopyOnFlipFlagsMask);
+  }
+  AccountCommitted(delta);
+  current_capacity_ = new_capacity;
+  return true;
+}
+
+void SemiSpace::RewindPages(int num_pages) {
+  DCHECK_GT(num_pages, 0);
+  DCHECK(last_page());
+  while (num_pages > 0) {
+    MemoryChunk* last = last_page();
+    memory_chunk_list_.Remove(last);
+    heap()->memory_allocator()->Free<MemoryAllocator::kPooledAndQueue>(last);
+    num_pages--;
+  }
+}
+
+bool SemiSpace::ShrinkTo(size_t new_capacity) {
+  DCHECK_EQ(new_capacity & kPageAlignmentMask, 0u);
+  DCHECK_GE(new_capacity, minimum_capacity_);
+  DCHECK_LT(new_capacity, current_capacity_);
+  if (is_committed()) {
+    const size_t delta = current_capacity_ - new_capacity;
+    DCHECK(IsAligned(delta, Page::kPageSize));
+    int delta_pages = static_cast<int>(delta / Page::kPageSize);
+    RewindPages(delta_pages);
+    AccountUncommitted(delta);
+    heap()->memory_allocator()->unmapper()->FreeQueuedChunks();
+  }
+  current_capacity_ = new_capacity;
+  return true;
+}
+
+void SemiSpace::FixPagesFlags(intptr_t flags, intptr_t mask) {
+  for (Page* page : *this) {
+    page->set_owner(this);
+    page->SetFlags(flags, mask);
+    if (id_ == kToSpace) {
+      page->ClearFlag(MemoryChunk::FROM_PAGE);
+      page->SetFlag(MemoryChunk::TO_PAGE);
+      page->ClearFlag(MemoryChunk::NEW_SPACE_BELOW_AGE_MARK);
+      heap()->incremental_marking()->non_atomic_marking_state()->SetLiveBytes(
+          page, 0);
+    } else {
+      page->SetFlag(MemoryChunk::FROM_PAGE);
+      page->ClearFlag(MemoryChunk::TO_PAGE);
+    }
+    DCHECK(page->InYoungGeneration());
+  }
+}
+
+void SemiSpace::Reset() {
+  DCHECK(first_page());
+  DCHECK(last_page());
+  current_page_ = first_page();
+  pages_used_ = 0;
+}
+
+void SemiSpace::RemovePage(Page* page) {
+  if (current_page_ == page) {
+    if (page->prev_page()) {
+      current_page_ = page->prev_page();
+    }
+  }
+  memory_chunk_list_.Remove(page);
+  for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    DecrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
+  }
+}
+
+void SemiSpace::PrependPage(Page* page) {
+  page->SetFlags(current_page()->GetFlags(),
+                 static_cast<uintptr_t>(Page::kCopyAllFlags));
+  page->set_owner(this);
+  memory_chunk_list_.PushFront(page);
+  pages_used_++;
+  for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    IncrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
+  }
+}
+
+void SemiSpace::Swap(SemiSpace* from, SemiSpace* to) {
+  // We won't be swapping semispaces without data in them.
+  DCHECK(from->first_page());
+  DCHECK(to->first_page());
+
+  intptr_t saved_to_space_flags = to->current_page()->GetFlags();
+
+  // We swap all properties but id_.
+  std::swap(from->current_capacity_, to->current_capacity_);
+  std::swap(from->maximum_capacity_, to->maximum_capacity_);
+  std::swap(from->minimum_capacity_, to->minimum_capacity_);
+  std::swap(from->age_mark_, to->age_mark_);
+  std::swap(from->committed_, to->committed_);
+  std::swap(from->memory_chunk_list_, to->memory_chunk_list_);
+  std::swap(from->current_page_, to->current_page_);
+  std::swap(from->external_backing_store_bytes_,
+            to->external_backing_store_bytes_);
+
+  to->FixPagesFlags(saved_to_space_flags, Page::kCopyOnFlipFlagsMask);
+  from->FixPagesFlags(0, 0);
+}
+
+void SemiSpace::set_age_mark(Address mark) {
+  DCHECK_EQ(Page::FromAllocationAreaAddress(mark)->owner(), this);
+  age_mark_ = mark;
+  // Mark all pages up to the one containing mark.
+  for (Page* p : PageRange(space_start(), mark)) {
+    p->SetFlag(MemoryChunk::NEW_SPACE_BELOW_AGE_MARK);
+  }
+}
+
+std::unique_ptr<ObjectIterator> SemiSpace::GetObjectIterator(Heap* heap) {
+  // Use the NewSpace::NewObjectIterator to iterate the ToSpace.
+  UNREACHABLE();
+}
+
+#ifdef DEBUG
+void SemiSpace::Print() {}
+#endif
+
+#ifdef VERIFY_HEAP
+void SemiSpace::Verify() {
+  bool is_from_space = (id_ == kFromSpace);
+  size_t external_backing_store_bytes[kNumTypes];
+
+  for (int i = 0; i < kNumTypes; i++) {
+    external_backing_store_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
+  }
+
+  for (Page* page : *this) {
+    CHECK_EQ(page->owner(), this);
+    CHECK(page->InNewSpace());
+    CHECK(page->IsFlagSet(is_from_space ? MemoryChunk::FROM_PAGE
+                                        : MemoryChunk::TO_PAGE));
+    CHECK(!page->IsFlagSet(is_from_space ? MemoryChunk::TO_PAGE
+                                         : MemoryChunk::FROM_PAGE));
+    CHECK(page->IsFlagSet(MemoryChunk::POINTERS_TO_HERE_ARE_INTERESTING));
+    if (!is_from_space) {
+      // The pointers-from-here-are-interesting flag isn't updated dynamically
+      // on from-space pages, so it might be out of sync with the marking state.
+      if (page->heap()->incremental_marking()->IsMarking()) {
+        CHECK(page->IsFlagSet(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING));
+      } else {
+        CHECK(
+            !page->IsFlagSet(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING));
+      }
+    }
+    for (int i = 0; i < kNumTypes; i++) {
+      ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+      external_backing_store_bytes[t] += page->ExternalBackingStoreBytes(t);
+    }
+
+    CHECK_IMPLIES(page->list_node().prev(),
+                  page->list_node().prev()->list_node().next() == page);
+  }
+  for (int i = 0; i < kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    CHECK_EQ(external_backing_store_bytes[t], ExternalBackingStoreBytes(t));
+  }
+}
+#endif
+
+#ifdef DEBUG
+void SemiSpace::AssertValidRange(Address start, Address end) {
+  // Addresses belong to same semi-space
+  Page* page = Page::FromAllocationAreaAddress(start);
+  Page* end_page = Page::FromAllocationAreaAddress(end);
+  SemiSpace* space = reinterpret_cast<SemiSpace*>(page->owner());
+  DCHECK_EQ(space, end_page->owner());
+  // Start address is before end address, either on same page,
+  // or end address is on a later page in the linked list of
+  // semi-space pages.
+  if (page == end_page) {
+    DCHECK_LE(start, end);
+  } else {
+    while (page != end_page) {
+      page = page->next_page();
+    }
+    DCHECK(page);
+  }
+}
+#endif
+
+// -----------------------------------------------------------------------------
+// SemiSpaceObjectIterator implementation.
+
+SemiSpaceObjectIterator::SemiSpaceObjectIterator(NewSpace* space) {
+  Initialize(space->first_allocatable_address(), space->top());
+}
+
+void SemiSpaceObjectIterator::Initialize(Address start, Address end) {
+  SemiSpace::AssertValidRange(start, end);
+  current_ = start;
+  limit_ = end;
+}
+
+size_t NewSpace::CommittedPhysicalMemory() {
+  if (!base::OS::HasLazyCommits()) return CommittedMemory();
+  MemoryChunk::UpdateHighWaterMark(allocation_info_.top());
+  size_t size = to_space_.CommittedPhysicalMemory();
+  if (from_space_.is_committed()) {
+    size += from_space_.CommittedPhysicalMemory();
+  }
+  return size;
+}
+
+// -----------------------------------------------------------------------------
+// NewSpace implementation
+
+NewSpace::NewSpace(Heap* heap, v8::PageAllocator* page_allocator,
+                   size_t initial_semispace_capacity,
+                   size_t max_semispace_capacity)
+    : SpaceWithLinearArea(heap, NEW_SPACE, new NoFreeList()),
+      to_space_(heap, kToSpace),
+      from_space_(heap, kFromSpace) {
+  DCHECK(initial_semispace_capacity <= max_semispace_capacity);
+
+  to_space_.SetUp(initial_semispace_capacity, max_semispace_capacity);
+  from_space_.SetUp(initial_semispace_capacity, max_semispace_capacity);
+  if (!to_space_.Commit()) {
+    V8::FatalProcessOutOfMemory(heap->isolate(), "New space setup");
+  }
+  DCHECK(!from_space_.is_committed());  // No need to use memory yet.
+  ResetLinearAllocationArea();
+}
+
+void NewSpace::TearDown() {
+  allocation_info_.Reset(kNullAddress, kNullAddress);
+
+  to_space_.TearDown();
+  from_space_.TearDown();
+}
+
+void NewSpace::Flip() { SemiSpace::Swap(&from_space_, &to_space_); }
+
+void NewSpace::Grow() {
+  // Double the semispace size but only up to maximum capacity.
+  DCHECK(TotalCapacity() < MaximumCapacity());
+  size_t new_capacity =
+      Min(MaximumCapacity(),
+          static_cast<size_t>(FLAG_semi_space_growth_factor) * TotalCapacity());
+  if (to_space_.GrowTo(new_capacity)) {
+    // Only grow from space if we managed to grow to-space.
+    if (!from_space_.GrowTo(new_capacity)) {
+      // If we managed to grow to-space but couldn't grow from-space,
+      // attempt to shrink to-space.
+      if (!to_space_.ShrinkTo(from_space_.current_capacity())) {
+        // We are in an inconsistent state because we could not
+        // commit/uncommit memory from new space.
+        FATAL("inconsistent state");
+      }
+    }
+  }
+  DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
+}
+
+void NewSpace::Shrink() {
+  size_t new_capacity = Max(InitialTotalCapacity(), 2 * Size());
+  size_t rounded_new_capacity = ::RoundUp(new_capacity, Page::kPageSize);
+  if (rounded_new_capacity < TotalCapacity() &&
+      to_space_.ShrinkTo(rounded_new_capacity)) {
+    // Only shrink from-space if we managed to shrink to-space.
+    from_space_.Reset();
+    if (!from_space_.ShrinkTo(rounded_new_capacity)) {
+      // If we managed to shrink to-space but couldn't shrink from
+      // space, attempt to grow to-space again.
+      if (!to_space_.GrowTo(from_space_.current_capacity())) {
+        // We are in an inconsistent state because we could not
+        // commit/uncommit memory from new space.
+        FATAL("inconsistent state");
+      }
+    }
+  }
+  DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
+}
+
+bool NewSpace::Rebalance() {
+  // Order here is important to make use of the page pool.
+  return to_space_.EnsureCurrentCapacity() &&
+         from_space_.EnsureCurrentCapacity();
+}
+
+void NewSpace::UpdateLinearAllocationArea() {
+  // Make sure there is no unaccounted allocations.
+  DCHECK(!AllocationObserversActive() || top_on_previous_step_ == top());
+
+  Address new_top = to_space_.page_low();
+  MemoryChunk::UpdateHighWaterMark(allocation_info_.top());
+  allocation_info_.Reset(new_top, to_space_.page_high());
+  // The order of the following two stores is important.
+  // See the corresponding loads in ConcurrentMarking::Run.
+  original_limit_.store(limit(), std::memory_order_relaxed);
+  original_top_.store(top(), std::memory_order_release);
+  StartNextInlineAllocationStep();
+  DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
+}
+
+void NewSpace::ResetLinearAllocationArea() {
+  // Do a step to account for memory allocated so far before resetting.
+  InlineAllocationStep(top(), top(), kNullAddress, 0);
+  to_space_.Reset();
+  UpdateLinearAllocationArea();
+  // Clear all mark-bits in the to-space.
+  IncrementalMarking::NonAtomicMarkingState* marking_state =
+      heap()->incremental_marking()->non_atomic_marking_state();
+  for (Page* p : to_space_) {
+    marking_state->ClearLiveness(p);
+    // Concurrent marking may have local live bytes for this page.
+    heap()->concurrent_marking()->ClearMemoryChunkData(p);
+  }
+}
+
+void NewSpace::UpdateInlineAllocationLimit(size_t min_size) {
+  Address new_limit = ComputeLimit(top(), to_space_.page_high(), min_size);
+  allocation_info_.set_limit(new_limit);
+  DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
+}
+
+bool NewSpace::AddFreshPage() {
+  Address top = allocation_info_.top();
+  DCHECK(!OldSpace::IsAtPageStart(top));
+
+  // Do a step to account for memory allocated on previous page.
+  InlineAllocationStep(top, top, kNullAddress, 0);
+
+  if (!to_space_.AdvancePage()) {
+    // No more pages left to advance.
+    return false;
+  }
+
+  // Clear remainder of current page.
+  Address limit = Page::FromAllocationAreaAddress(top)->area_end();
+  int remaining_in_page = static_cast<int>(limit - top);
+  heap()->CreateFillerObjectAt(top, remaining_in_page, ClearRecordedSlots::kNo);
+  UpdateLinearAllocationArea();
+
+  return true;
+}
+
+bool NewSpace::AddFreshPageSynchronized() {
+  base::MutexGuard guard(&mutex_);
+  return AddFreshPage();
+}
+
+bool NewSpace::EnsureAllocation(int size_in_bytes,
+                                AllocationAlignment alignment) {
+  Address old_top = allocation_info_.top();
+  Address high = to_space_.page_high();
+  int filler_size = Heap::GetFillToAlign(old_top, alignment);
+  int aligned_size_in_bytes = size_in_bytes + filler_size;
+
+  if (old_top + aligned_size_in_bytes > high) {
+    // Not enough room in the page, try to allocate a new one.
+    if (!AddFreshPage()) {
+      return false;
+    }
+
+    old_top = allocation_info_.top();
+    high = to_space_.page_high();
+    filler_size = Heap::GetFillToAlign(old_top, alignment);
+  }
+
+  DCHECK(old_top + aligned_size_in_bytes <= high);
+
+  if (allocation_info_.limit() < high) {
+    // Either the limit has been lowered because linear allocation was disabled
+    // or because incremental marking wants to get a chance to do a step,
+    // or because idle scavenge job wants to get a chance to post a task.
+    // Set the new limit accordingly.
+    Address new_top = old_top + aligned_size_in_bytes;
+    Address soon_object = old_top + filler_size;
+    InlineAllocationStep(new_top, new_top, soon_object, size_in_bytes);
+    UpdateInlineAllocationLimit(aligned_size_in_bytes);
+  }
+  return true;
+}
+
+std::unique_ptr<ObjectIterator> NewSpace::GetObjectIterator(Heap* heap) {
+  return std::unique_ptr<ObjectIterator>(new SemiSpaceObjectIterator(this));
+}
+
+#ifdef VERIFY_HEAP
+// We do not use the SemiSpaceObjectIterator because verification doesn't assume
+// that it works (it depends on the invariants we are checking).
+void NewSpace::Verify(Isolate* isolate) {
+  // The allocation pointer should be in the space or at the very end.
+  DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
+
+  // There should be objects packed in from the low address up to the
+  // allocation pointer.
+  Address current = to_space_.first_page()->area_start();
+  CHECK_EQ(current, to_space_.space_start());
+
+  size_t external_space_bytes[kNumTypes];
+  for (int i = 0; i < kNumTypes; i++) {
+    external_space_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
+  }
+
+  while (current != top()) {
+    if (!Page::IsAlignedToPageSize(current)) {
+      // The allocation pointer should not be in the middle of an object.
+      CHECK(!Page::FromAllocationAreaAddress(current)->ContainsLimit(top()) ||
+            current < top());
+
+      HeapObject object = HeapObject::FromAddress(current);
+
+      // The first word should be a map, and we expect all map pointers to
+      // be in map space or read-only space.
+      Map map = object.map();
+      CHECK(map.IsMap());
+      CHECK(ReadOnlyHeap::Contains(map) || heap()->map_space()->Contains(map));
+
+      // The object should not be code or a map.
+      CHECK(!object.IsMap());
+      CHECK(!object.IsAbstractCode());
+
+      // The object itself should look OK.
+      object.ObjectVerify(isolate);
+
+      // All the interior pointers should be contained in the heap.
+      VerifyPointersVisitor visitor(heap());
+      int size = object.Size();
+      object.IterateBody(map, size, &visitor);
+
+      if (object.IsExternalString()) {
+        ExternalString external_string = ExternalString::cast(object);
+        size_t size = external_string.ExternalPayloadSize();
+        external_space_bytes[ExternalBackingStoreType::kExternalString] += size;
+      } else if (object.IsJSArrayBuffer()) {
+        JSArrayBuffer array_buffer = JSArrayBuffer::cast(object);
+        if (ArrayBufferTracker::IsTracked(array_buffer)) {
+          size_t size = ArrayBufferTracker::Lookup(heap(), array_buffer)
+                            ->PerIsolateAccountingLength();
+          external_space_bytes[ExternalBackingStoreType::kArrayBuffer] += size;
+        }
+      }
+
+      current += size;
+    } else {
+      // At end of page, switch to next page.
+      Page* page = Page::FromAllocationAreaAddress(current)->next_page();
+      current = page->area_start();
+    }
+  }
+
+  for (int i = 0; i < kNumTypes; i++) {
+    if (V8_ARRAY_BUFFER_EXTENSION_BOOL &&
+        i == ExternalBackingStoreType::kArrayBuffer)
+      continue;
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    CHECK_EQ(external_space_bytes[t], ExternalBackingStoreBytes(t));
+  }
+
+  if (V8_ARRAY_BUFFER_EXTENSION_BOOL) {
+    size_t bytes = heap()->array_buffer_sweeper()->young().BytesSlow();
+    CHECK_EQ(bytes,
+             ExternalBackingStoreBytes(ExternalBackingStoreType::kArrayBuffer));
+  }
+
+  // Check semi-spaces.
+  CHECK_EQ(from_space_.id(), kFromSpace);
+  CHECK_EQ(to_space_.id(), kToSpace);
+  from_space_.Verify();
+  to_space_.Verify();
+}
+#endif
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/heap/new-spaces.h b/deps/v8/src/heap/new-spaces.h
new file mode 100644
index 00000000000..73613152fa0
--- /dev/null
+++ b/deps/v8/src/heap/new-spaces.h
@@ -0,0 +1,501 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_NEW_SPACES_H_
+#define V8_HEAP_NEW_SPACES_H_
+
+#include <atomic>
+#include <memory>
+
+#include "src/base/macros.h"
+#include "src/base/platform/mutex.h"
+#include "src/heap/heap.h"
+#include "src/heap/spaces.h"
+#include "src/logging/log.h"
+#include "src/objects/heap-object.h"
+
+namespace v8 {
+namespace internal {
+
+class Heap;
+class MemoryChunk;
+
+enum SemiSpaceId { kFromSpace = 0, kToSpace = 1 };
+
+// -----------------------------------------------------------------------------
+// SemiSpace in young generation
+//
+// A SemiSpace is a contiguous chunk of memory holding page-like memory chunks.
+// The mark-compact collector  uses the memory of the first page in the from
+// space as a marking stack when tracing live objects.
+class SemiSpace : public Space {
+ public:
+  using iterator = PageIterator;
+  using const_iterator = ConstPageIterator;
+
+  static void Swap(SemiSpace* from, SemiSpace* to);
+
+  SemiSpace(Heap* heap, SemiSpaceId semispace)
+      : Space(heap, NEW_SPACE, new NoFreeList()),
+        current_capacity_(0),
+        maximum_capacity_(0),
+        minimum_capacity_(0),
+        age_mark_(kNullAddress),
+        committed_(false),
+        id_(semispace),
+        current_page_(nullptr),
+        pages_used_(0) {}
+
+  inline bool Contains(HeapObject o) const;
+  inline bool Contains(Object o) const;
+  inline bool ContainsSlow(Address a) const;
+
+  void SetUp(size_t initial_capacity, size_t maximum_capacity);
+  void TearDown();
+
+  bool Commit();
+  bool Uncommit();
+  bool is_committed() { return committed_; }
+
+  // Grow the semispace to the new capacity.  The new capacity requested must
+  // be larger than the current capacity and less than the maximum capacity.
+  bool GrowTo(size_t new_capacity);
+
+  // Shrinks the semispace to the new capacity.  The new capacity requested
+  // must be more than the amount of used memory in the semispace and less
+  // than the current capacity.
+  bool ShrinkTo(size_t new_capacity);
+
+  bool EnsureCurrentCapacity();
+
+  Address space_end() { return memory_chunk_list_.back()->area_end(); }
+
+  // Returns the start address of the first page of the space.
+  Address space_start() {
+    DCHECK_NE(memory_chunk_list_.front(), nullptr);
+    return memory_chunk_list_.front()->area_start();
+  }
+
+  Page* current_page() { return current_page_; }
+  int pages_used() { return pages_used_; }
+
+  // Returns the start address of the current page of the space.
+  Address page_low() { return current_page_->area_start(); }
+
+  // Returns one past the end address of the current page of the space.
+  Address page_high() { return current_page_->area_end(); }
+
+  bool AdvancePage() {
+    Page* next_page = current_page_->next_page();
+    // We cannot expand if we reached the maximum number of pages already. Note
+    // that we need to account for the next page already for this check as we
+    // could potentially fill the whole page after advancing.
+    const bool reached_max_pages = (pages_used_ + 1) == max_pages();
+    if (next_page == nullptr || reached_max_pages) {
+      return false;
+    }
+    current_page_ = next_page;
+    pages_used_++;
+    return true;
+  }
+
+  // Resets the space to using the first page.
+  void Reset();
+
+  void RemovePage(Page* page);
+  void PrependPage(Page* page);
+
+  Page* InitializePage(MemoryChunk* chunk);
+
+  // Age mark accessors.
+  Address age_mark() { return age_mark_; }
+  void set_age_mark(Address mark);
+
+  // Returns the current capacity of the semispace.
+  size_t current_capacity() { return current_capacity_; }
+
+  // Returns the maximum capacity of the semispace.
+  size_t maximum_capacity() { return maximum_capacity_; }
+
+  // Returns the initial capacity of the semispace.
+  size_t minimum_capacity() { return minimum_capacity_; }
+
+  SemiSpaceId id() { return id_; }
+
+  // Approximate amount of physical memory committed for this space.
+  size_t CommittedPhysicalMemory() override;
+
+  // If we don't have these here then SemiSpace will be abstract.  However
+  // they should never be called:
+
+  size_t Size() override { UNREACHABLE(); }
+
+  size_t SizeOfObjects() override { return Size(); }
+
+  size_t Available() override { UNREACHABLE(); }
+
+  Page* first_page() { return reinterpret_cast<Page*>(Space::first_page()); }
+  Page* last_page() { return reinterpret_cast<Page*>(Space::last_page()); }
+
+  const Page* first_page() const {
+    return reinterpret_cast<const Page*>(Space::first_page());
+  }
+  const Page* last_page() const {
+    return reinterpret_cast<const Page*>(Space::last_page());
+  }
+
+  iterator begin() { return iterator(first_page()); }
+  iterator end() { return iterator(nullptr); }
+
+  const_iterator begin() const { return const_iterator(first_page()); }
+  const_iterator end() const { return const_iterator(nullptr); }
+
+  std::unique_ptr<ObjectIterator> GetObjectIterator(Heap* heap) override;
+
+#ifdef DEBUG
+  V8_EXPORT_PRIVATE void Print() override;
+  // Validate a range of of addresses in a SemiSpace.
+  // The "from" address must be on a page prior to the "to" address,
+  // in the linked page order, or it must be earlier on the same page.
+  static void AssertValidRange(Address from, Address to);
+#else
+  // Do nothing.
+  inline static void AssertValidRange(Address from, Address to) {}
+#endif
+
+#ifdef VERIFY_HEAP
+  virtual void Verify();
+#endif
+
+ private:
+  void RewindPages(int num_pages);
+
+  inline int max_pages() {
+    return static_cast<int>(current_capacity_ / Page::kPageSize);
+  }
+
+  // Copies the flags into the masked positions on all pages in the space.
+  void FixPagesFlags(intptr_t flags, intptr_t flag_mask);
+
+  // The currently committed space capacity.
+  size_t current_capacity_;
+
+  // The maximum capacity that can be used by this space. A space cannot grow
+  // beyond that size.
+  size_t maximum_capacity_;
+
+  // The minimum capacity for the space. A space cannot shrink below this size.
+  size_t minimum_capacity_;
+
+  // Used to govern object promotion during mark-compact collection.
+  Address age_mark_;
+
+  bool committed_;
+  SemiSpaceId id_;
+
+  Page* current_page_;
+
+  int pages_used_;
+
+  friend class NewSpace;
+  friend class SemiSpaceObjectIterator;
+};
+
+// A SemiSpaceObjectIterator is an ObjectIterator that iterates over the active
+// semispace of the heap's new space.  It iterates over the objects in the
+// semispace from a given start address (defaulting to the bottom of the
+// semispace) to the top of the semispace.  New objects allocated after the
+// iterator is created are not iterated.
+class SemiSpaceObjectIterator : public ObjectIterator {
+ public:
+  // Create an iterator over the allocated objects in the given to-space.
+  explicit SemiSpaceObjectIterator(NewSpace* space);
+
+  inline HeapObject Next() override;
+
+ private:
+  void Initialize(Address start, Address end);
+
+  // The current iteration point.
+  Address current_;
+  // The end of iteration.
+  Address limit_;
+};
+
+// -----------------------------------------------------------------------------
+// The young generation space.
+//
+// The new space consists of a contiguous pair of semispaces.  It simply
+// forwards most functions to the appropriate semispace.
+
+class V8_EXPORT_PRIVATE NewSpace
+    : NON_EXPORTED_BASE(public SpaceWithLinearArea) {
+ public:
+  using iterator = PageIterator;
+  using const_iterator = ConstPageIterator;
+
+  NewSpace(Heap* heap, v8::PageAllocator* page_allocator,
+           size_t initial_semispace_capacity, size_t max_semispace_capacity);
+
+  ~NewSpace() override { TearDown(); }
+
+  inline bool ContainsSlow(Address a) const;
+  inline bool Contains(Object o) const;
+  inline bool Contains(HeapObject o) const;
+
+  // Tears down the space.  Heap memory was not allocated by the space, so it
+  // is not deallocated here.
+  void TearDown();
+
+  // Flip the pair of spaces.
+  void Flip();
+
+  // Grow the capacity of the semispaces.  Assumes that they are not at
+  // their maximum capacity.
+  void Grow();
+
+  // Shrink the capacity of the semispaces.
+  void Shrink();
+
+  // Return the allocated bytes in the active semispace.
+  size_t Size() final {
+    DCHECK_GE(top(), to_space_.page_low());
+    return to_space_.pages_used() *
+               MemoryChunkLayout::AllocatableMemoryInDataPage() +
+           static_cast<size_t>(top() - to_space_.page_low());
+  }
+
+  size_t SizeOfObjects() final { return Size(); }
+
+  // Return the allocatable capacity of a semispace.
+  size_t Capacity() {
+    SLOW_DCHECK(to_space_.current_capacity() == from_space_.current_capacity());
+    return (to_space_.current_capacity() / Page::kPageSize) *
+           MemoryChunkLayout::AllocatableMemoryInDataPage();
+  }
+
+  // Return the current size of a semispace, allocatable and non-allocatable
+  // memory.
+  size_t TotalCapacity() {
+    DCHECK(to_space_.current_capacity() == from_space_.current_capacity());
+    return to_space_.current_capacity();
+  }
+
+  // Committed memory for NewSpace is the committed memory of both semi-spaces
+  // combined.
+  size_t CommittedMemory() final {
+    return from_space_.CommittedMemory() + to_space_.CommittedMemory();
+  }
+
+  size_t MaximumCommittedMemory() final {
+    return from_space_.MaximumCommittedMemory() +
+           to_space_.MaximumCommittedMemory();
+  }
+
+  // Approximate amount of physical memory committed for this space.
+  size_t CommittedPhysicalMemory() final;
+
+  // Return the available bytes without growing.
+  size_t Available() final {
+    DCHECK_GE(Capacity(), Size());
+    return Capacity() - Size();
+  }
+
+  size_t ExternalBackingStoreBytes(ExternalBackingStoreType type) const final {
+    if (V8_ARRAY_BUFFER_EXTENSION_BOOL &&
+        type == ExternalBackingStoreType::kArrayBuffer)
+      return heap()->YoungArrayBufferBytes();
+    DCHECK_EQ(0, from_space_.ExternalBackingStoreBytes(type));
+    return to_space_.ExternalBackingStoreBytes(type);
+  }
+
+  size_t ExternalBackingStoreBytes() {
+    size_t result = 0;
+    for (int i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
+      result +=
+          ExternalBackingStoreBytes(static_cast<ExternalBackingStoreType>(i));
+    }
+    return result;
+  }
+
+  size_t AllocatedSinceLastGC() {
+    const Address age_mark = to_space_.age_mark();
+    DCHECK_NE(age_mark, kNullAddress);
+    DCHECK_NE(top(), kNullAddress);
+    Page* const age_mark_page = Page::FromAllocationAreaAddress(age_mark);
+    Page* const last_page = Page::FromAllocationAreaAddress(top());
+    Page* current_page = age_mark_page;
+    size_t allocated = 0;
+    if (current_page != last_page) {
+      DCHECK_EQ(current_page, age_mark_page);
+      DCHECK_GE(age_mark_page->area_end(), age_mark);
+      allocated += age_mark_page->area_end() - age_mark;
+      current_page = current_page->next_page();
+    } else {
+      DCHECK_GE(top(), age_mark);
+      return top() - age_mark;
+    }
+    while (current_page != last_page) {
+      DCHECK_NE(current_page, age_mark_page);
+      allocated += MemoryChunkLayout::AllocatableMemoryInDataPage();
+      current_page = current_page->next_page();
+    }
+    DCHECK_GE(top(), current_page->area_start());
+    allocated += top() - current_page->area_start();
+    DCHECK_LE(allocated, Size());
+    return allocated;
+  }
+
+  void MovePageFromSpaceToSpace(Page* page) {
+    DCHECK(page->IsFromPage());
+    from_space_.RemovePage(page);
+    to_space_.PrependPage(page);
+  }
+
+  bool Rebalance();
+
+  // Return the maximum capacity of a semispace.
+  size_t MaximumCapacity() {
+    DCHECK(to_space_.maximum_capacity() == from_space_.maximum_capacity());
+    return to_space_.maximum_capacity();
+  }
+
+  bool IsAtMaximumCapacity() { return TotalCapacity() == MaximumCapacity(); }
+
+  // Returns the initial capacity of a semispace.
+  size_t InitialTotalCapacity() {
+    DCHECK(to_space_.minimum_capacity() == from_space_.minimum_capacity());
+    return to_space_.minimum_capacity();
+  }
+
+  void ResetOriginalTop() {
+    DCHECK_GE(top(), original_top_);
+    DCHECK_LE(top(), original_limit_);
+    original_top_.store(top(), std::memory_order_release);
+  }
+
+  Address original_top_acquire() {
+    return original_top_.load(std::memory_order_acquire);
+  }
+  Address original_limit_relaxed() {
+    return original_limit_.load(std::memory_order_relaxed);
+  }
+
+  // Return the address of the first allocatable address in the active
+  // semispace. This may be the address where the first object resides.
+  Address first_allocatable_address() { return to_space_.space_start(); }
+
+  // Get the age mark of the inactive semispace.
+  Address age_mark() { return from_space_.age_mark(); }
+  // Set the age mark in the active semispace.
+  void set_age_mark(Address mark) { to_space_.set_age_mark(mark); }
+
+  V8_WARN_UNUSED_RESULT V8_INLINE AllocationResult
+  AllocateRawAligned(int size_in_bytes, AllocationAlignment alignment,
+                     AllocationOrigin origin = AllocationOrigin::kRuntime);
+
+  V8_WARN_UNUSED_RESULT V8_INLINE AllocationResult AllocateRawUnaligned(
+      int size_in_bytes, AllocationOrigin origin = AllocationOrigin::kRuntime);
+
+  V8_WARN_UNUSED_RESULT V8_INLINE AllocationResult
+  AllocateRaw(int size_in_bytes, AllocationAlignment alignment,
+              AllocationOrigin origin = AllocationOrigin::kRuntime);
+
+  V8_WARN_UNUSED_RESULT inline AllocationResult AllocateRawSynchronized(
+      int size_in_bytes, AllocationAlignment alignment,
+      AllocationOrigin origin = AllocationOrigin::kRuntime);
+
+  // Reset the allocation pointer to the beginning of the active semispace.
+  void ResetLinearAllocationArea();
+
+  // When inline allocation stepping is active, either because of incremental
+  // marking, idle scavenge, or allocation statistics gathering, we 'interrupt'
+  // inline allocation every once in a while. This is done by setting
+  // allocation_info_.limit to be lower than the actual limit and and increasing
+  // it in steps to guarantee that the observers are notified periodically.
+  void UpdateInlineAllocationLimit(size_t size_in_bytes) override;
+
+  inline bool ToSpaceContainsSlow(Address a) const;
+  inline bool ToSpaceContains(Object o) const;
+  inline bool FromSpaceContains(Object o) const;
+
+  // Try to switch the active semispace to a new, empty, page.
+  // Returns false if this isn't possible or reasonable (i.e., there
+  // are no pages, or the current page is already empty), or true
+  // if successful.
+  bool AddFreshPage();
+  bool AddFreshPageSynchronized();
+
+#ifdef VERIFY_HEAP
+  // Verify the active semispace.
+  virtual void Verify(Isolate* isolate);
+#endif
+
+#ifdef DEBUG
+  // Print the active semispace.
+  void Print() override { to_space_.Print(); }
+#endif
+
+  // Return whether the operation succeeded.
+  bool CommitFromSpaceIfNeeded() {
+    if (from_space_.is_committed()) return true;
+    return from_space_.Commit();
+  }
+
+  bool UncommitFromSpace() {
+    if (!from_space_.is_committed()) return true;
+    return from_space_.Uncommit();
+  }
+
+  bool IsFromSpaceCommitted() { return from_space_.is_committed(); }
+
+  SemiSpace* active_space() { return &to_space_; }
+
+  Page* first_page() { return to_space_.first_page(); }
+  Page* last_page() { return to_space_.last_page(); }
+
+  iterator begin() { return to_space_.begin(); }
+  iterator end() { return to_space_.end(); }
+
+  const_iterator begin() const { return to_space_.begin(); }
+  const_iterator end() const { return to_space_.end(); }
+
+  std::unique_ptr<ObjectIterator> GetObjectIterator(Heap* heap) override;
+
+  SemiSpace& from_space() { return from_space_; }
+  SemiSpace& to_space() { return to_space_; }
+
+ private:
+  // Update linear allocation area to match the current to-space page.
+  void UpdateLinearAllocationArea();
+
+  base::Mutex mutex_;
+
+  // The top and the limit at the time of setting the linear allocation area.
+  // These values can be accessed by background tasks.
+  std::atomic<Address> original_top_;
+  std::atomic<Address> original_limit_;
+
+  // The semispaces.
+  SemiSpace to_space_;
+  SemiSpace from_space_;
+  VirtualMemory reservation_;
+
+  bool EnsureAllocation(int size_in_bytes, AllocationAlignment alignment);
+  bool SupportsInlineAllocation() override { return true; }
+
+  friend class SemiSpaceObjectIterator;
+};
+
+// For contiguous spaces, top should be in the space (or at the end) and limit
+// should be the end of the space.
+#define DCHECK_SEMISPACE_ALLOCATION_INFO(info, space) \
+  SLOW_DCHECK((space).page_low() <= (info).top() &&   \
+              (info).top() <= (space).page_high() &&  \
+              (info).limit() <= (space).page_high())
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_NEW_SPACES_H_
diff --git a/deps/v8/src/heap/object-stats.cc b/deps/v8/src/heap/object-stats.cc
index 04a7cee33b5..e7c614655cf 100644
--- a/deps/v8/src/heap/object-stats.cc
+++ b/deps/v8/src/heap/object-stats.cc
@@ -821,8 +821,6 @@ void ObjectStatsCollectorImpl::CollectGlobalStatistics() {
                                  ObjectStats::STRING_SPLIT_CACHE_TYPE);
   RecordSimpleVirtualObjectStats(HeapObject(), heap_->regexp_multiple_cache(),
                                  ObjectStats::REGEXP_MULTIPLE_CACHE_TYPE);
-  RecordSimpleVirtualObjectStats(HeapObject(), heap_->retained_maps(),
-                                 ObjectStats::RETAINED_MAPS_TYPE);
 
   // WeakArrayList.
   RecordSimpleVirtualObjectStats(HeapObject(),
@@ -841,7 +839,6 @@ void ObjectStatsCollectorImpl::RecordObjectStats(HeapObject obj,
 bool ObjectStatsCollectorImpl::CanRecordFixedArray(FixedArrayBase array) {
   ReadOnlyRoots roots(heap_);
   return array != roots.empty_fixed_array() &&
-         array != roots.empty_sloppy_arguments_elements() &&
          array != roots.empty_slow_element_dictionary() &&
          array != roots.empty_property_dictionary();
 }
@@ -1075,6 +1072,9 @@ void ObjectStatsCollectorImpl::RecordVirtualCodeDetails(Code code) {
 void ObjectStatsCollectorImpl::RecordVirtualContext(Context context) {
   if (context.IsNativeContext()) {
     RecordObjectStats(context, NATIVE_CONTEXT_TYPE, context.Size());
+    RecordSimpleVirtualObjectStats(context, context.retained_maps(),
+                                   ObjectStats::RETAINED_MAPS_TYPE);
+
   } else if (context.IsFunctionContext()) {
     RecordObjectStats(context, FUNCTION_CONTEXT_TYPE, context.Size());
   } else {
diff --git a/deps/v8/src/heap/objects-visiting-inl.h b/deps/v8/src/heap/objects-visiting-inl.h
index 03df9a175d5..30e72d18b6a 100644
--- a/deps/v8/src/heap/objects-visiting-inl.h
+++ b/deps/v8/src/heap/objects-visiting-inl.h
@@ -18,7 +18,6 @@
 #include "src/objects/oddball.h"
 #include "src/objects/ordered-hash-table.h"
 #include "src/wasm/wasm-objects.h"
-#include "torque-generated/objects-body-descriptors-tq-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -61,8 +60,6 @@ ResultType HeapVisitor<ResultType, ConcreteVisitor>::Visit(Map map,
       return visitor->VisitStruct(map, object);
     case kVisitFreeSpace:
       return visitor->VisitFreeSpace(map, FreeSpace::cast(object));
-    case kVisitWeakArray:
-      return visitor->VisitWeakArray(map, object);
     case kDataOnlyVisitorIdCount:
     case kVisitorIdCount:
       UNREACHABLE();
@@ -169,19 +166,6 @@ ResultType HeapVisitor<ResultType, ConcreteVisitor>::VisitFreeSpace(
   return static_cast<ResultType>(object.size());
 }
 
-template <typename ResultType, typename ConcreteVisitor>
-ResultType HeapVisitor<ResultType, ConcreteVisitor>::VisitWeakArray(
-    Map map, HeapObject object) {
-  ConcreteVisitor* visitor = static_cast<ConcreteVisitor*>(this);
-  if (!visitor->ShouldVisit(object)) return ResultType();
-  int size = WeakArrayBodyDescriptor::SizeOf(map, object);
-  if (visitor->ShouldVisitMapPointer()) {
-    visitor->VisitMapPointer(object);
-  }
-  WeakArrayBodyDescriptor::IterateBody(map, object, size, visitor);
-  return size;
-}
-
 template <typename ConcreteVisitor>
 int NewSpaceVisitor<ConcreteVisitor>::VisitNativeContext(Map map,
                                                          NativeContext object) {
diff --git a/deps/v8/src/heap/objects-visiting.h b/deps/v8/src/heap/objects-visiting.h
index ea70f36ac02..c962e6eaaf8 100644
--- a/deps/v8/src/heap/objects-visiting.h
+++ b/deps/v8/src/heap/objects-visiting.h
@@ -9,6 +9,7 @@
 #include "src/objects/map.h"
 #include "src/objects/objects.h"
 #include "src/objects/visitors.h"
+#include "torque-generated/field-offsets-tq.h"
 
 namespace v8 {
 namespace internal {
@@ -21,7 +22,6 @@ namespace internal {
   V(Cell)                              \
   V(Code)                              \
   V(CodeDataContainer)                 \
-  V(ConsString)                        \
   V(Context)                           \
   V(CoverageInfo)                      \
   V(DataHandler)                       \
@@ -31,7 +31,6 @@ namespace internal {
   V(FeedbackCell)                      \
   V(FeedbackMetadata)                  \
   V(FeedbackVector)                    \
-  V(FixedArray)                        \
   V(FixedDoubleArray)                  \
   V(JSArrayBuffer)                     \
   V(JSDataView)                        \
@@ -48,23 +47,21 @@ namespace internal {
   V(PropertyArray)                     \
   V(PropertyCell)                      \
   V(PrototypeInfo)                     \
-  V(SeqOneByteString)                  \
-  V(SeqTwoByteString)                  \
   V(SharedFunctionInfo)                \
-  V(SlicedString)                      \
   V(SmallOrderedHashMap)               \
   V(SmallOrderedHashSet)               \
   V(SmallOrderedNameDictionary)        \
   V(SourceTextModule)                  \
   V(Symbol)                            \
   V(SyntheticModule)                   \
-  V(ThinString)                        \
   V(TransitionArray)                   \
   V(UncompiledDataWithoutPreparseData) \
   V(UncompiledDataWithPreparseData)    \
+  V(WasmArray)                         \
   V(WasmCapiFunctionData)              \
   V(WasmIndirectFunctionTable)         \
-  V(WasmInstanceObject)
+  V(WasmInstanceObject)                \
+  V(WasmStruct)
 
 #define FORWARD_DECLARE(TypeName) class TypeName;
 TYPED_VISITOR_ID_LIST(FORWARD_DECLARE)
@@ -112,7 +109,6 @@ class HeapVisitor : public ObjectVisitor {
   V8_INLINE ResultType VisitJSApiObject(Map map, JSObject object);
   V8_INLINE ResultType VisitStruct(Map map, HeapObject object);
   V8_INLINE ResultType VisitFreeSpace(Map map, FreeSpace object);
-  V8_INLINE ResultType VisitWeakArray(Map map, HeapObject object);
 
   template <typename T>
   static V8_INLINE T Cast(HeapObject object);
diff --git a/deps/v8/src/heap/off-thread-factory.cc b/deps/v8/src/heap/off-thread-factory.cc
index d8cab5df695..053e9a0ce75 100644
--- a/deps/v8/src/heap/off-thread-factory.cc
+++ b/deps/v8/src/heap/off-thread-factory.cc
@@ -4,192 +4,19 @@
 
 #include "src/heap/off-thread-factory.h"
 
-#include "src/ast/ast-value-factory.h"
-#include "src/ast/ast.h"
-#include "src/base/logging.h"
 #include "src/common/globals.h"
-#include "src/execution/isolate.h"
 #include "src/handles/handles.h"
-#include "src/heap/spaces-inl.h"
-#include "src/heap/spaces.h"
+#include "src/numbers/hash-seed-inl.h"
 #include "src/objects/fixed-array.h"
 #include "src/objects/heap-object.h"
-#include "src/objects/map-inl.h"
-#include "src/objects/objects-body-descriptors-inl.h"
-#include "src/objects/shared-function-info.h"
 #include "src/objects/string.h"
-#include "src/objects/visitors.h"
 #include "src/roots/roots-inl.h"
-#include "src/roots/roots.h"
-#include "src/tracing/trace-event.h"
+#include "src/strings/string-hasher.h"
 
 namespace v8 {
 namespace internal {
 
-OffThreadFactory::OffThreadFactory(Isolate* isolate)
-    : roots_(isolate), space_(isolate->heap()), lo_space_(isolate->heap()) {}
-
-namespace {
-
-class StringSlotCollectingVisitor : public ObjectVisitor {
- public:
-  explicit StringSlotCollectingVisitor(ReadOnlyRoots roots) : roots_(roots) {}
-
-  void VisitPointers(HeapObject host, ObjectSlot start,
-                     ObjectSlot end) override {
-    for (ObjectSlot slot = start; slot != end; ++slot) {
-      Object obj = *slot;
-      if (obj.IsInternalizedString() &&
-          !ReadOnlyHeap::Contains(HeapObject::cast(obj))) {
-        string_slots.emplace_back(host.ptr(), slot.address() - host.ptr());
-      }
-    }
-  }
-  void VisitPointers(HeapObject host, MaybeObjectSlot start,
-                     MaybeObjectSlot end) override {
-    for (MaybeObjectSlot slot = start; slot != end; ++slot) {
-      MaybeObject maybe_obj = *slot;
-      HeapObject obj;
-      if (maybe_obj.GetHeapObjectIfStrong(&obj)) {
-        if (obj.IsInternalizedString() && !ReadOnlyHeap::Contains(obj)) {
-          string_slots.emplace_back(host.ptr(), slot.address() - host.ptr());
-        }
-      }
-    }
-  }
-
-  void VisitCodeTarget(Code host, RelocInfo* rinfo) override { UNREACHABLE(); }
-  void VisitEmbeddedPointer(Code host, RelocInfo* rinfo) override {
-    UNREACHABLE();
-  }
-
-  std::vector<RelativeSlot> string_slots;
-
- private:
-  ReadOnlyRoots roots_;
-};
-
-}  // namespace
-
-void OffThreadFactory::FinishOffThread() {
-  DCHECK(!is_finished);
-
-  StringSlotCollectingVisitor string_slot_collector(read_only_roots());
-
-  // First iterate all objects in the spaces to find string slots. At this point
-  // all string slots have to point to off-thread strings or read-only strings.
-  {
-    PagedSpaceObjectIterator it(&space_);
-    for (HeapObject obj = it.Next(); !obj.is_null(); obj = it.Next()) {
-      obj.IterateBodyFast(&string_slot_collector);
-    }
-  }
-  {
-    LargeObjectSpaceObjectIterator it(&lo_space_);
-    for (HeapObject obj = it.Next(); !obj.is_null(); obj = it.Next()) {
-      obj.IterateBodyFast(&string_slot_collector);
-    }
-  }
-
-  string_slots_ = std::move(string_slot_collector.string_slots);
-
-  is_finished = true;
-}
-
-void OffThreadFactory::Publish(Isolate* isolate) {
-  DCHECK(is_finished);
-
-  HandleScope handle_scope(isolate);
-
-  // First, handlify all the string slot holder objects, so that we can keep
-  // track of them if they move.
-  //
-  // TODO(leszeks): We might be able to create a HandleScope-compatible
-  // structure off-thread and merge it into the current handle scope all in one
-  // go (DeferredHandles maybe?).
-  std::vector<Handle<HeapObject>> heap_object_handles;
-  std::vector<Handle<Script>> script_handles;
-  {
-    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-                 "V8.OffThreadFinalization.Publish.CollectHandles");
-    heap_object_handles.reserve(string_slots_.size());
-    for (RelativeSlot relative_slot : string_slots_) {
-      // TODO(leszeks): Group slots in the same parent object to avoid creating
-      // multiple duplicate handles.
-      heap_object_handles.push_back(handle(
-          HeapObject::cast(Object(relative_slot.object_address)), isolate));
-
-      // De-internalize the string so that we can re-internalize it later.
-      ObjectSlot slot(relative_slot.object_address + relative_slot.slot_offset);
-      String string = String::cast(slot.Acquire_Load());
-      bool one_byte = string.IsOneByteRepresentation();
-      Map map = one_byte ? read_only_roots().one_byte_string_map()
-                         : read_only_roots().string_map();
-      string.set_map_no_write_barrier(map);
-    }
-
-    script_handles.reserve(script_list_.size());
-    for (Script script : script_list_) {
-      script_handles.push_back(handle(script, isolate));
-    }
-  }
-
-  // Then merge the spaces. At this point, we are allowed to point between (no
-  // longer) off-thread pages and main-thread heap pages, and objects in the
-  // previously off-thread page can move.
-  {
-    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-                 "V8.OffThreadFinalization.Publish.Merge");
-    isolate->heap()->old_space()->MergeLocalSpace(&space_);
-    isolate->heap()->lo_space()->MergeOffThreadSpace(&lo_space_);
-  }
-
-  // Iterate the string slots, as an offset from the holders we have handles to.
-  {
-    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-                 "V8.OffThreadFinalization.Publish.UpdateHandles");
-    for (size_t i = 0; i < string_slots_.size(); ++i) {
-      int slot_offset = string_slots_[i].slot_offset;
-
-      // There's currently no cases where the holder object could have been
-      // resized.
-      DCHECK_LT(slot_offset, heap_object_handles[i]->Size());
-
-      ObjectSlot slot(heap_object_handles[i]->ptr() + slot_offset);
-
-      String string = String::cast(slot.Acquire_Load());
-      if (string.IsThinString()) {
-        // We may have already internalized this string via another slot.
-        slot.Release_Store(ThinString::cast(string).GetUnderlying());
-      } else {
-        HandleScope handle_scope(isolate);
-
-        Handle<String> string_handle = handle(string, isolate);
-        Handle<String> internalized_string =
-            isolate->factory()->InternalizeString(string_handle);
-
-        // Recalculate the slot in case there was GC and the holder moved.
-        ObjectSlot slot(heap_object_handles[i]->ptr() + slot_offset);
-
-        DCHECK(string_handle->IsThinString() ||
-               string_handle->IsInternalizedString());
-        if (*string_handle != *internalized_string) {
-          slot.Release_Store(*internalized_string);
-        }
-      }
-    }
-
-    // Merge the recorded scripts into the isolate's script list.
-    // This for loop may seem expensive, but practically there's unlikely to be
-    // more than one script in the OffThreadFactory.
-    Handle<WeakArrayList> scripts = isolate->factory()->script_list();
-    for (Handle<Script> script_handle : script_handles) {
-      scripts = WeakArrayList::Append(isolate, scripts,
-                                      MaybeObjectHandle::Weak(script_handle));
-    }
-    isolate->heap()->SetRootScriptList(*scripts);
-  }
-}
+OffThreadFactory::OffThreadFactory(Isolate* isolate) : roots_(isolate) {}
 
 // Hacky method for creating a simple object with a slot pointing to a string.
 // TODO(leszeks): Remove once we have full FixedArray support.
@@ -237,21 +64,12 @@ Handle<String> OffThreadFactory::InternalizeString(
 }
 
 void OffThreadFactory::AddToScriptList(Handle<Script> shared) {
-  script_list_.push_back(*shared);
+  isolate()->heap()->AddToScriptList(shared);
 }
 
 HeapObject OffThreadFactory::AllocateRaw(int size, AllocationType allocation,
                                          AllocationAlignment alignment) {
-  DCHECK(!is_finished);
-
-  DCHECK_EQ(allocation, AllocationType::kOld);
-  AllocationResult result;
-  if (size > kMaxRegularHeapObjectSize) {
-    result = lo_space_.AllocateRaw(size);
-  } else {
-    result = space_.AllocateRaw(size, alignment);
-  }
-  return result.ToObjectChecked();
+  return isolate()->heap()->AllocateRaw(size, allocation, alignment);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/off-thread-factory.h b/deps/v8/src/heap/off-thread-factory.h
index f297bd30c68..738511f7729 100644
--- a/deps/v8/src/heap/off-thread-factory.h
+++ b/deps/v8/src/heap/off-thread-factory.h
@@ -28,15 +28,6 @@ class AstRawString;
 class AstConsString;
 class OffThreadIsolate;
 
-struct RelativeSlot {
-  RelativeSlot() = default;
-  RelativeSlot(Address object_address, int slot_offset)
-      : object_address(object_address), slot_offset(slot_offset) {}
-
-  Address object_address;
-  int slot_offset;
-};
-
 class V8_EXPORT_PRIVATE OffThreadFactory
     : public FactoryBase<OffThreadFactory> {
  public:
@@ -56,9 +47,6 @@ class V8_EXPORT_PRIVATE OffThreadFactory
   Handle<String> InternalizeString(const Vector<const uint8_t>& string);
   Handle<String> InternalizeString(const Vector<const uint16_t>& string);
 
-  void FinishOffThread();
-  void Publish(Isolate* isolate);
-
   // The parser shouldn't allow the OffThreadFactory to get into a state where
   // it generates errors.
   Handle<Object> NewInvalidStringLengthError() { UNREACHABLE(); }
@@ -93,11 +81,6 @@ class V8_EXPORT_PRIVATE OffThreadFactory
   // ------
 
   ReadOnlyRoots roots_;
-  OffThreadSpace space_;
-  OffThreadLargeObjectSpace lo_space_;
-  std::vector<RelativeSlot> string_slots_;
-  std::vector<Script> script_list_;
-  bool is_finished = false;
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/off-thread-heap.cc b/deps/v8/src/heap/off-thread-heap.cc
new file mode 100644
index 00000000000..bfbe1bb28ef
--- /dev/null
+++ b/deps/v8/src/heap/off-thread-heap.cc
@@ -0,0 +1,326 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/off-thread-heap.h"
+
+#include "src/common/assert-scope.h"
+#include "src/common/globals.h"
+#include "src/handles/off-thread-transfer-handle-storage-inl.h"
+#include "src/heap/paged-spaces-inl.h"
+#include "src/heap/spaces-inl.h"
+#include "src/objects/objects-body-descriptors-inl.h"
+#include "src/roots/roots.h"
+#include "src/snapshot/references.h"
+
+// Has to be the last include (doesn't have include guards)
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+OffThreadHeap::OffThreadHeap(Heap* heap)
+    : space_(heap),
+      lo_space_(heap),
+      off_thread_transfer_handles_head_(nullptr) {}
+
+bool OffThreadHeap::Contains(HeapObject obj) {
+  return space_.Contains(obj) || lo_space_.Contains(obj);
+}
+
+class OffThreadHeap::StringSlotCollectingVisitor : public ObjectVisitor {
+ public:
+  void VisitPointers(HeapObject host, ObjectSlot start,
+                     ObjectSlot end) override {
+    for (ObjectSlot slot = start; slot != end; ++slot) {
+      Object obj = *slot;
+      if (obj.IsInternalizedString() &&
+          !ReadOnlyHeap::Contains(HeapObject::cast(obj))) {
+        string_slots.emplace_back(host.address(),
+                                  slot.address() - host.address());
+      }
+    }
+  }
+  void VisitPointers(HeapObject host, MaybeObjectSlot start,
+                     MaybeObjectSlot end) override {
+    for (MaybeObjectSlot slot = start; slot != end; ++slot) {
+      MaybeObject maybe_obj = *slot;
+      HeapObject obj;
+      if (maybe_obj.GetHeapObjectIfStrong(&obj)) {
+        if (obj.IsInternalizedString() && !ReadOnlyHeap::Contains(obj)) {
+          string_slots.emplace_back(host.address(),
+                                    slot.address() - host.address());
+        }
+      }
+    }
+  }
+
+  void VisitCodeTarget(Code host, RelocInfo* rinfo) override { UNREACHABLE(); }
+  void VisitEmbeddedPointer(Code host, RelocInfo* rinfo) override {
+    UNREACHABLE();
+  }
+
+  std::vector<RelativeSlot> string_slots;
+};
+
+void OffThreadHeap::FinishOffThread() {
+  DCHECK(!is_finished);
+
+  StringSlotCollectingVisitor string_slot_collector;
+
+  // First iterate all objects in the spaces to find string slots. At this point
+  // all string slots have to point to off-thread strings or read-only strings.
+  {
+    PagedSpaceObjectIterator it(&space_);
+    for (HeapObject obj = it.Next(); !obj.is_null(); obj = it.Next()) {
+      obj.IterateBodyFast(&string_slot_collector);
+    }
+  }
+  {
+    LargeObjectSpaceObjectIterator it(&lo_space_);
+    for (HeapObject obj = it.Next(); !obj.is_null(); obj = it.Next()) {
+      obj.IterateBodyFast(&string_slot_collector);
+    }
+  }
+
+  string_slots_ = std::move(string_slot_collector.string_slots);
+
+  OffThreadTransferHandleStorage* storage =
+      off_thread_transfer_handles_head_.get();
+  while (storage != nullptr) {
+    storage->ConvertFromOffThreadHandleOnFinish();
+    storage = storage->next();
+  }
+
+  is_finished = true;
+}
+
+void OffThreadHeap::Publish(Heap* heap) {
+  DCHECK(is_finished);
+  Isolate* isolate = heap->isolate();
+  ReadOnlyRoots roots(isolate);
+
+  // Before we do anything else, ensure that the old-space can expand to the
+  // size needed for the off-thread objects. Use capacity rather than size since
+  // we're adding entire pages.
+  size_t off_thread_size = space_.Capacity() + lo_space_.Size();
+  if (!heap->CanExpandOldGeneration(off_thread_size)) {
+    heap->CollectAllAvailableGarbage(GarbageCollectionReason::kLastResort);
+    if (!heap->CanExpandOldGeneration(off_thread_size)) {
+      heap->FatalProcessOutOfMemory(
+          "Can't expand old-space enough to merge off-thread pages.");
+    }
+  }
+
+  // Merging and transferring handles should be atomic from the point of view
+  // of the GC, since we neither want the GC to walk main-thread handles that
+  // point into off-thread pages, nor do we want the GC to move the raw
+  // pointers we have into off-thread pages before we've had a chance to turn
+  // them into real handles.
+  // TODO(leszeks): This could be a stronger assertion, that we don't GC at
+  // all.
+  DisallowHeapAllocation no_gc;
+
+  // Merge the spaces.
+  {
+    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
+                 "V8.OffThreadFinalization.Publish.Merge");
+
+    heap->old_space()->MergeLocalSpace(&space_);
+    heap->lo_space()->MergeOffThreadSpace(&lo_space_);
+
+    DCHECK(heap->CanExpandOldGeneration(0));
+  }
+
+  // Transfer all the transfer handles to be real handles. Make sure to do this
+  // before creating any handle scopes, to allow these handles to live in the
+  // caller's handle scope.
+  OffThreadTransferHandleStorage* storage =
+      off_thread_transfer_handles_head_.get();
+  while (storage != nullptr) {
+    storage->ConvertToHandleOnPublish(isolate, &no_gc);
+    storage = storage->next();
+  }
+
+  // Create a new handle scope after transferring handles, for the slot holder
+  // handles below.
+  HandleScope handle_scope(isolate);
+
+  // Handlify all the string slot holder objects, so that we can keep track of
+  // them if they move.
+  //
+  // TODO(leszeks): We might be able to create a HandleScope-compatible
+  // structure off-thread and merge it into the current handle scope all in
+  // one go (DeferredHandles maybe?).
+  std::vector<std::pair<Handle<HeapObject>, Handle<Map>>> heap_object_handles;
+  std::vector<Handle<Script>> script_handles;
+  {
+    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
+                 "V8.OffThreadFinalization.Publish.CollectHandles");
+    heap_object_handles.reserve(string_slots_.size());
+    for (RelativeSlot relative_slot : string_slots_) {
+      // TODO(leszeks): Group slots in the same parent object to avoid
+      // creating multiple duplicate handles.
+      HeapObject obj = HeapObject::FromAddress(relative_slot.object_address);
+      heap_object_handles.push_back(
+          {handle(obj, isolate), handle(obj.map(), isolate)});
+
+      // De-internalize the string so that we can re-internalize it later.
+      String string =
+          String::cast(RELAXED_READ_FIELD(obj, relative_slot.slot_offset));
+      bool one_byte = string.IsOneByteRepresentation();
+      Map map = one_byte ? roots.one_byte_string_map() : roots.string_map();
+      string.set_map_no_write_barrier(map);
+    }
+
+    script_handles.reserve(script_list_.size());
+    for (Script script : script_list_) {
+      script_handles.push_back(handle(script, isolate));
+    }
+  }
+
+  // After this point, all objects are transferred and all handles are valid,
+  // so we can GC again.
+  no_gc.Release();
+
+  // Possibly trigger a GC if we're close to exhausting the old generation.
+  // TODO(leszeks): Adjust the heuristics here.
+  heap->StartIncrementalMarkingIfAllocationLimitIsReached(
+      heap->GCFlagsForIncrementalMarking(),
+      kGCCallbackScheduleIdleGarbageCollection);
+
+  if (!heap->ShouldExpandOldGenerationOnSlowAllocation() ||
+      !heap->CanExpandOldGeneration(1 * MB)) {
+    heap->CollectGarbage(OLD_SPACE,
+                         GarbageCollectionReason::kAllocationFailure);
+  }
+
+  // Iterate the string slots, as an offset from the holders we have handles to.
+  {
+    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
+                 "V8.OffThreadFinalization.Publish.UpdateHandles");
+    for (size_t i = 0; i < string_slots_.size(); ++i) {
+      HeapObject obj = *heap_object_handles[i].first;
+      int slot_offset = string_slots_[i].slot_offset;
+
+      // There's currently no cases where the holder object could have been
+      // resized.
+      CHECK_EQ(obj.map(), *heap_object_handles[i].second);
+      CHECK_LT(slot_offset, obj.Size());
+
+      String string = String::cast(RELAXED_READ_FIELD(obj, slot_offset));
+      if (string.IsThinString()) {
+        // We may have already internalized this string via another slot.
+        String value = ThinString::cast(string).GetUnderlying();
+        RELAXED_WRITE_FIELD(obj, slot_offset, value);
+        WRITE_BARRIER(obj, slot_offset, value);
+      } else {
+        HandleScope handle_scope(isolate);
+
+        Handle<String> string_handle = handle(string, isolate);
+        Handle<String> internalized_string =
+            isolate->factory()->InternalizeString(string_handle);
+
+        DCHECK(string_handle->IsThinString() ||
+               string_handle->IsInternalizedString());
+        if (*string_handle != *internalized_string) {
+          // Re-read the object from the handle in case there was GC during
+          // internalization and it moved.
+          HeapObject obj = *heap_object_handles[i].first;
+          String value = *internalized_string;
+
+          // Sanity checks that the object or string slot value hasn't changed.
+          CHECK_EQ(obj.map(), *heap_object_handles[i].second);
+          CHECK_LT(slot_offset, obj.Size());
+          CHECK_EQ(RELAXED_READ_FIELD(obj, slot_offset), *string_handle);
+
+          RELAXED_WRITE_FIELD(obj, slot_offset, value);
+          WRITE_BARRIER(obj, slot_offset, value);
+        }
+      }
+    }
+
+    // Merge the recorded scripts into the isolate's script list.
+    // This for loop may seem expensive, but practically there's unlikely to be
+    // more than one script in the OffThreadFactory.
+    Handle<WeakArrayList> scripts = isolate->factory()->script_list();
+    for (Handle<Script> script_handle : script_handles) {
+      scripts = WeakArrayList::Append(isolate, scripts,
+                                      MaybeObjectHandle::Weak(script_handle));
+    }
+    heap->SetRootScriptList(*scripts);
+  }
+}
+
+void OffThreadHeap::AddToScriptList(Handle<Script> shared) {
+  script_list_.push_back(*shared);
+}
+
+HeapObject OffThreadHeap::AllocateRaw(int size, AllocationType allocation,
+                                      AllocationAlignment alignment) {
+  DCHECK(!is_finished);
+
+  DCHECK_EQ(allocation, AllocationType::kOld);
+  AllocationResult result;
+  if (size > kMaxRegularHeapObjectSize) {
+    result = lo_space_.AllocateRaw(size);
+  } else {
+    result = space_.AllocateRaw(size, alignment);
+  }
+  HeapObject obj = result.ToObjectChecked();
+  OnAllocationEvent(obj, size);
+  return obj;
+}
+
+bool OffThreadHeap::ReserveSpace(Heap::Reservation* reservations) {
+#ifdef DEBUG
+  for (int space = FIRST_SPACE;
+       space < static_cast<int>(SnapshotSpace::kNumberOfHeapSpaces); space++) {
+    if (space == OLD_SPACE || space == LO_SPACE) continue;
+    Heap::Reservation* reservation = &reservations[space];
+    DCHECK_EQ(reservation->size(), 1);
+    DCHECK_EQ(reservation->at(0).size, 0);
+  }
+#endif
+
+  for (auto& chunk : reservations[OLD_SPACE]) {
+    int size = chunk.size;
+    AllocationResult allocation = space_.AllocateRawUnaligned(size);
+    HeapObject free_space = allocation.ToObjectChecked();
+
+    // Mark with a free list node, in case we have a GC before
+    // deserializing.
+    Address free_space_address = free_space.address();
+    CreateFillerObjectAt(free_space_address, size,
+                         ClearFreedMemoryMode::kDontClearFreedMemory);
+    chunk.start = free_space_address;
+    chunk.end = free_space_address + size;
+  }
+
+  return true;
+}
+
+HeapObject OffThreadHeap::CreateFillerObjectAt(
+    Address addr, int size, ClearFreedMemoryMode clear_memory_mode) {
+  ReadOnlyRoots roots(this);
+  HeapObject filler =
+      Heap::CreateFillerObjectAt(roots, addr, size, clear_memory_mode);
+  return filler;
+}
+
+OffThreadTransferHandleStorage* OffThreadHeap::AddTransferHandleStorage(
+    HandleBase handle) {
+  DCHECK_IMPLIES(off_thread_transfer_handles_head_ != nullptr,
+                 off_thread_transfer_handles_head_->state() ==
+                     OffThreadTransferHandleStorage::kOffThreadHandle);
+  off_thread_transfer_handles_head_ =
+      std::make_unique<OffThreadTransferHandleStorage>(
+          handle.location(), std::move(off_thread_transfer_handles_head_));
+  return off_thread_transfer_handles_head_.get();
+}
+
+}  // namespace internal
+}  // namespace v8
+
+// Undefine the heap manipulation macros.
+#include "src/objects/object-macros-undef.h"
diff --git a/deps/v8/src/heap/off-thread-heap.h b/deps/v8/src/heap/off-thread-heap.h
new file mode 100644
index 00000000000..f5a520cdcbf
--- /dev/null
+++ b/deps/v8/src/heap/off-thread-heap.h
@@ -0,0 +1,76 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_OFF_THREAD_HEAP_H_
+#define V8_HEAP_OFF_THREAD_HEAP_H_
+
+#include <vector>
+
+#include "src/common/globals.h"
+#include "src/heap/large-spaces.h"
+#include "src/heap/paged-spaces.h"
+#include "src/heap/spaces.h"
+#include "src/objects/heap-object.h"
+
+namespace v8 {
+namespace internal {
+
+class OffThreadTransferHandleStorage;
+
+class V8_EXPORT_PRIVATE OffThreadHeap {
+ public:
+  explicit OffThreadHeap(Heap* heap);
+
+  HeapObject AllocateRaw(int size, AllocationType allocation,
+                         AllocationAlignment alignment = kWordAligned);
+  void AddToScriptList(Handle<Script> shared);
+
+  void OnAllocationEvent(HeapObject obj, int size) {
+    // TODO(leszeks): Do something here.
+  }
+
+  ReadOnlySpace* read_only_space() const {
+    // Access the main-thread heap via the spaces.
+    return space_.heap()->read_only_space();
+  }
+
+  bool Contains(HeapObject obj);
+
+  bool ReserveSpace(Heap::Reservation* reservations);
+
+  HeapObject CreateFillerObjectAt(Address addr, int size,
+                                  ClearFreedMemoryMode clear_memory_mode);
+
+  OffThreadTransferHandleStorage* AddTransferHandleStorage(HandleBase handle);
+
+  void FinishOffThread();
+  void Publish(Heap* heap);
+
+ private:
+  friend class DeserializerAllocator;
+
+  class StringSlotCollectingVisitor;
+
+  struct RelativeSlot {
+    RelativeSlot() = default;
+    RelativeSlot(Address object_address, int slot_offset)
+        : object_address(object_address), slot_offset(slot_offset) {}
+
+    Address object_address;
+    int slot_offset;
+  };
+
+  OffThreadSpace space_;
+  OffThreadLargeObjectSpace lo_space_;
+  std::vector<RelativeSlot> string_slots_;
+  std::vector<Script> script_list_;
+  std::unique_ptr<OffThreadTransferHandleStorage>
+      off_thread_transfer_handles_head_;
+  bool is_finished = false;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_OFF_THREAD_HEAP_H_
diff --git a/deps/v8/src/heap/paged-spaces-inl.h b/deps/v8/src/heap/paged-spaces-inl.h
new file mode 100644
index 00000000000..d9f07b96649
--- /dev/null
+++ b/deps/v8/src/heap/paged-spaces-inl.h
@@ -0,0 +1,212 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_PAGED_SPACES_INL_H_
+#define V8_HEAP_PAGED_SPACES_INL_H_
+
+#include "src/heap/incremental-marking.h"
+#include "src/heap/paged-spaces.h"
+#include "src/objects/code-inl.h"
+#include "src/objects/heap-object.h"
+#include "src/objects/objects-inl.h"
+
+namespace v8 {
+namespace internal {
+
+// -----------------------------------------------------------------------------
+// PagedSpaceObjectIterator
+
+HeapObject PagedSpaceObjectIterator::Next() {
+  do {
+    HeapObject next_obj = FromCurrentPage();
+    if (!next_obj.is_null()) return next_obj;
+  } while (AdvanceToNextPage());
+  return HeapObject();
+}
+
+HeapObject PagedSpaceObjectIterator::FromCurrentPage() {
+  while (cur_addr_ != cur_end_) {
+    HeapObject obj = HeapObject::FromAddress(cur_addr_);
+    const int obj_size = obj.Size();
+    cur_addr_ += obj_size;
+    DCHECK_LE(cur_addr_, cur_end_);
+    if (!obj.IsFreeSpaceOrFiller()) {
+      if (obj.IsCode()) {
+        DCHECK_IMPLIES(
+            space_->identity() != CODE_SPACE,
+            space_->identity() == RO_SPACE && Code::cast(obj).is_builtin());
+        DCHECK_CODEOBJECT_SIZE(obj_size, space_);
+      } else {
+        DCHECK_OBJECT_SIZE(obj_size);
+      }
+      return obj;
+    }
+  }
+  return HeapObject();
+}
+
+bool PagedSpace::Contains(Address addr) const {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    return true;
+  }
+  return Page::FromAddress(addr)->owner() == this;
+}
+
+bool PagedSpace::Contains(Object o) const {
+  if (!o.IsHeapObject()) return false;
+  return Page::FromAddress(o.ptr())->owner() == this;
+}
+
+void PagedSpace::UnlinkFreeListCategories(Page* page) {
+  DCHECK_EQ(this, page->owner());
+  page->ForAllFreeListCategories([this](FreeListCategory* category) {
+    free_list()->RemoveCategory(category);
+  });
+}
+
+size_t PagedSpace::RelinkFreeListCategories(Page* page) {
+  DCHECK_EQ(this, page->owner());
+  size_t added = 0;
+  page->ForAllFreeListCategories([this, &added](FreeListCategory* category) {
+    added += category->available();
+    category->Relink(free_list());
+  });
+
+  DCHECK_IMPLIES(!page->IsFlagSet(Page::NEVER_ALLOCATE_ON_PAGE),
+                 page->AvailableInFreeList() ==
+                     page->AvailableInFreeListFromAllocatedBytes());
+  return added;
+}
+
+bool PagedSpace::TryFreeLast(HeapObject object, int object_size) {
+  if (allocation_info_.top() != kNullAddress) {
+    const Address object_address = object.address();
+    if ((allocation_info_.top() - object_size) == object_address) {
+      allocation_info_.set_top(object_address);
+      return true;
+    }
+  }
+  return false;
+}
+
+bool PagedSpace::EnsureLinearAllocationArea(int size_in_bytes,
+                                            AllocationOrigin origin) {
+  if (allocation_info_.top() + size_in_bytes <= allocation_info_.limit()) {
+    return true;
+  }
+  return SlowRefillLinearAllocationArea(size_in_bytes, origin);
+}
+
+HeapObject PagedSpace::AllocateLinearly(int size_in_bytes) {
+  Address current_top = allocation_info_.top();
+  Address new_top = current_top + size_in_bytes;
+  DCHECK_LE(new_top, allocation_info_.limit());
+  allocation_info_.set_top(new_top);
+  return HeapObject::FromAddress(current_top);
+}
+
+HeapObject PagedSpace::TryAllocateLinearlyAligned(
+    int* size_in_bytes, AllocationAlignment alignment) {
+  Address current_top = allocation_info_.top();
+  int filler_size = Heap::GetFillToAlign(current_top, alignment);
+
+  Address new_top = current_top + filler_size + *size_in_bytes;
+  if (new_top > allocation_info_.limit()) return HeapObject();
+
+  allocation_info_.set_top(new_top);
+  if (filler_size > 0) {
+    *size_in_bytes += filler_size;
+    return Heap::PrecedeWithFiller(ReadOnlyRoots(heap()),
+                                   HeapObject::FromAddress(current_top),
+                                   filler_size);
+  }
+
+  return HeapObject::FromAddress(current_top);
+}
+
+AllocationResult PagedSpace::AllocateRawUnaligned(int size_in_bytes,
+                                                  AllocationOrigin origin) {
+  DCHECK_IMPLIES(identity() == RO_SPACE, !IsDetached());
+  if (!EnsureLinearAllocationArea(size_in_bytes, origin)) {
+    return AllocationResult::Retry(identity());
+  }
+  HeapObject object = AllocateLinearly(size_in_bytes);
+  DCHECK(!object.is_null());
+  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(object.address(), size_in_bytes);
+
+  if (FLAG_trace_allocations_origins) {
+    UpdateAllocationOrigins(origin);
+  }
+
+  return object;
+}
+
+AllocationResult PagedSpace::AllocateRawAligned(int size_in_bytes,
+                                                AllocationAlignment alignment,
+                                                AllocationOrigin origin) {
+  DCHECK(identity() == OLD_SPACE || identity() == RO_SPACE);
+  DCHECK_IMPLIES(identity() == RO_SPACE, !IsDetached());
+  int allocation_size = size_in_bytes;
+  HeapObject object = TryAllocateLinearlyAligned(&allocation_size, alignment);
+  if (object.is_null()) {
+    // We don't know exactly how much filler we need to align until space is
+    // allocated, so assume the worst case.
+    int filler_size = Heap::GetMaximumFillToAlign(alignment);
+    allocation_size += filler_size;
+    if (!EnsureLinearAllocationArea(allocation_size, origin)) {
+      return AllocationResult::Retry(identity());
+    }
+    allocation_size = size_in_bytes;
+    object = TryAllocateLinearlyAligned(&allocation_size, alignment);
+    DCHECK(!object.is_null());
+  }
+  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(object.address(), size_in_bytes);
+
+  if (FLAG_trace_allocations_origins) {
+    UpdateAllocationOrigins(origin);
+  }
+
+  return object;
+}
+
+AllocationResult PagedSpace::AllocateRaw(int size_in_bytes,
+                                         AllocationAlignment alignment,
+                                         AllocationOrigin origin) {
+  if (top_on_previous_step_ && top() < top_on_previous_step_ &&
+      SupportsInlineAllocation()) {
+    // Generated code decreased the top() pointer to do folded allocations.
+    // The top_on_previous_step_ can be one byte beyond the current page.
+    DCHECK_NE(top(), kNullAddress);
+    DCHECK_EQ(Page::FromAllocationAreaAddress(top()),
+              Page::FromAllocationAreaAddress(top_on_previous_step_ - 1));
+    top_on_previous_step_ = top();
+  }
+  size_t bytes_since_last =
+      top_on_previous_step_ ? top() - top_on_previous_step_ : 0;
+
+  DCHECK_IMPLIES(!SupportsInlineAllocation(), bytes_since_last == 0);
+#ifdef V8_HOST_ARCH_32_BIT
+  AllocationResult result =
+      alignment != kWordAligned
+          ? AllocateRawAligned(size_in_bytes, alignment, origin)
+          : AllocateRawUnaligned(size_in_bytes, origin);
+#else
+  AllocationResult result = AllocateRawUnaligned(size_in_bytes, origin);
+#endif
+  HeapObject heap_obj;
+  if (!result.IsRetry() && result.To(&heap_obj) && !is_local_space()) {
+    AllocationStep(static_cast<int>(size_in_bytes + bytes_since_last),
+                   heap_obj.address(), size_in_bytes);
+    StartNextInlineAllocationStep();
+    DCHECK_IMPLIES(
+        heap()->incremental_marking()->black_allocation(),
+        heap()->incremental_marking()->marking_state()->IsBlack(heap_obj));
+  }
+  return result;
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_PAGED_SPACES_INL_H_
diff --git a/deps/v8/src/heap/paged-spaces.cc b/deps/v8/src/heap/paged-spaces.cc
new file mode 100644
index 00000000000..2024b971ce5
--- /dev/null
+++ b/deps/v8/src/heap/paged-spaces.cc
@@ -0,0 +1,1057 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/paged-spaces.h"
+
+#include "src/base/optional.h"
+#include "src/base/platform/mutex.h"
+#include "src/execution/isolate.h"
+#include "src/execution/vm-state-inl.h"
+#include "src/heap/array-buffer-sweeper.h"
+#include "src/heap/array-buffer-tracker-inl.h"
+#include "src/heap/heap.h"
+#include "src/heap/incremental-marking.h"
+#include "src/heap/memory-allocator.h"
+#include "src/heap/memory-chunk-inl.h"
+#include "src/heap/paged-spaces-inl.h"
+#include "src/heap/read-only-heap.h"
+#include "src/logging/counters.h"
+#include "src/objects/string.h"
+#include "src/utils/utils.h"
+
+namespace v8 {
+namespace internal {
+
+// ----------------------------------------------------------------------------
+// PagedSpaceObjectIterator
+
+PagedSpaceObjectIterator::PagedSpaceObjectIterator(Heap* heap,
+                                                   PagedSpace* space)
+    : cur_addr_(kNullAddress),
+      cur_end_(kNullAddress),
+      space_(space),
+      page_range_(space->first_page(), nullptr),
+      current_page_(page_range_.begin()) {
+  space_->MakeLinearAllocationAreaIterable();
+  heap->mark_compact_collector()->EnsureSweepingCompleted();
+}
+
+PagedSpaceObjectIterator::PagedSpaceObjectIterator(Heap* heap,
+                                                   PagedSpace* space,
+                                                   Page* page)
+    : cur_addr_(kNullAddress),
+      cur_end_(kNullAddress),
+      space_(space),
+      page_range_(page),
+      current_page_(page_range_.begin()) {
+  space_->MakeLinearAllocationAreaIterable();
+  heap->mark_compact_collector()->EnsureSweepingCompleted();
+#ifdef DEBUG
+  AllocationSpace owner = page->owner_identity();
+  DCHECK(owner == RO_SPACE || owner == OLD_SPACE || owner == MAP_SPACE ||
+         owner == CODE_SPACE);
+#endif  // DEBUG
+}
+
+PagedSpaceObjectIterator::PagedSpaceObjectIterator(OffThreadSpace* space)
+    : cur_addr_(kNullAddress),
+      cur_end_(kNullAddress),
+      space_(space),
+      page_range_(space->first_page(), nullptr),
+      current_page_(page_range_.begin()) {
+  space_->MakeLinearAllocationAreaIterable();
+}
+
+// We have hit the end of the page and should advance to the next block of
+// objects.  This happens at the end of the page.
+bool PagedSpaceObjectIterator::AdvanceToNextPage() {
+  DCHECK_EQ(cur_addr_, cur_end_);
+  if (current_page_ == page_range_.end()) return false;
+  Page* cur_page = *(current_page_++);
+
+  cur_addr_ = cur_page->area_start();
+  cur_end_ = cur_page->area_end();
+  DCHECK(cur_page->SweepingDone());
+  return true;
+}
+Page* PagedSpace::InitializePage(MemoryChunk* chunk) {
+  Page* page = static_cast<Page*>(chunk);
+  DCHECK_EQ(
+      MemoryChunkLayout::AllocatableMemoryInMemoryChunk(page->owner_identity()),
+      page->area_size());
+  // Make sure that categories are initialized before freeing the area.
+  page->ResetAllocationStatistics();
+  page->SetOldGenerationPageFlags(!is_off_thread_space() &&
+                                  heap()->incremental_marking()->IsMarking());
+  page->AllocateFreeListCategories();
+  page->InitializeFreeListCategories();
+  page->list_node().Initialize();
+  page->InitializationMemoryFence();
+  return page;
+}
+
+PagedSpace::PagedSpace(Heap* heap, AllocationSpace space,
+                       Executability executable, FreeList* free_list,
+                       LocalSpaceKind local_space_kind)
+    : SpaceWithLinearArea(heap, space, free_list),
+      executable_(executable),
+      local_space_kind_(local_space_kind) {
+  area_size_ = MemoryChunkLayout::AllocatableMemoryInMemoryChunk(space);
+  accounting_stats_.Clear();
+}
+
+void PagedSpace::TearDown() {
+  while (!memory_chunk_list_.Empty()) {
+    MemoryChunk* chunk = memory_chunk_list_.front();
+    memory_chunk_list_.Remove(chunk);
+    heap()->memory_allocator()->Free<MemoryAllocator::kFull>(chunk);
+  }
+  accounting_stats_.Clear();
+}
+
+void PagedSpace::RefillFreeList() {
+  // Any PagedSpace might invoke RefillFreeList. We filter all but our old
+  // generation spaces out.
+  if (identity() != OLD_SPACE && identity() != CODE_SPACE &&
+      identity() != MAP_SPACE && identity() != RO_SPACE) {
+    return;
+  }
+  DCHECK_NE(local_space_kind(), LocalSpaceKind::kOffThreadSpace);
+  DCHECK_IMPLIES(is_local_space(), is_compaction_space());
+  DCHECK(!IsDetached());
+  MarkCompactCollector* collector = heap()->mark_compact_collector();
+  size_t added = 0;
+
+  {
+    Page* p = nullptr;
+    while ((p = collector->sweeper()->GetSweptPageSafe(this)) != nullptr) {
+      // We regularly sweep NEVER_ALLOCATE_ON_PAGE pages. We drop the freelist
+      // entries here to make them unavailable for allocations.
+      if (p->IsFlagSet(Page::NEVER_ALLOCATE_ON_PAGE)) {
+        p->ForAllFreeListCategories([this](FreeListCategory* category) {
+          category->Reset(free_list());
+        });
+      }
+
+      // Also merge old-to-new remembered sets if not scavenging because of
+      // data races: One thread might iterate remembered set, while another
+      // thread merges them.
+      if (local_space_kind() != LocalSpaceKind::kCompactionSpaceForScavenge) {
+        p->MergeOldToNewRememberedSets();
+      }
+
+      // Only during compaction pages can actually change ownership. This is
+      // safe because there exists no other competing action on the page links
+      // during compaction.
+      if (is_compaction_space()) {
+        DCHECK_NE(this, p->owner());
+        PagedSpace* owner = reinterpret_cast<PagedSpace*>(p->owner());
+        base::MutexGuard guard(owner->mutex());
+        owner->RefineAllocatedBytesAfterSweeping(p);
+        owner->RemovePage(p);
+        added += AddPage(p);
+      } else {
+        base::MutexGuard guard(mutex());
+        DCHECK_EQ(this, p->owner());
+        RefineAllocatedBytesAfterSweeping(p);
+        added += RelinkFreeListCategories(p);
+      }
+      added += p->wasted_memory();
+      if (is_compaction_space() && (added > kCompactionMemoryWanted)) break;
+    }
+  }
+}
+
+void OffThreadSpace::RefillFreeList() {
+  // We should never try to refill the free list in off-thread space, because
+  // we know it will always be fully linear.
+  UNREACHABLE();
+}
+
+void PagedSpace::MergeLocalSpace(LocalSpace* other) {
+  base::MutexGuard guard(mutex());
+
+  DCHECK(identity() == other->identity());
+
+  // Unmerged fields:
+  //   area_size_
+  other->FreeLinearAllocationArea();
+
+  for (int i = static_cast<int>(AllocationOrigin::kFirstAllocationOrigin);
+       i <= static_cast<int>(AllocationOrigin::kLastAllocationOrigin); i++) {
+    allocations_origins_[i] += other->allocations_origins_[i];
+  }
+
+  // The linear allocation area of {other} should be destroyed now.
+  DCHECK_EQ(kNullAddress, other->top());
+  DCHECK_EQ(kNullAddress, other->limit());
+
+  bool merging_from_off_thread = other->is_off_thread_space();
+
+  // Move over pages.
+  for (auto it = other->begin(); it != other->end();) {
+    Page* p = *(it++);
+
+    if (merging_from_off_thread) {
+      DCHECK_NULL(p->sweeping_slot_set());
+
+      // Make sure the page is entirely white.
+      CHECK(heap()
+                ->incremental_marking()
+                ->non_atomic_marking_state()
+                ->bitmap(p)
+                ->IsClean());
+
+      p->SetOldGenerationPageFlags(heap()->incremental_marking()->IsMarking());
+      if (heap()->incremental_marking()->black_allocation()) {
+        p->CreateBlackArea(p->area_start(), p->HighWaterMark());
+      }
+    } else {
+      p->MergeOldToNewRememberedSets();
+    }
+
+    // Ensure that pages are initialized before objects on it are discovered by
+    // concurrent markers.
+    p->InitializationMemoryFence();
+
+    // Relinking requires the category to be unlinked.
+    other->RemovePage(p);
+    AddPage(p);
+    heap()->NotifyOldGenerationExpansion(identity(), p);
+    DCHECK_IMPLIES(
+        !p->IsFlagSet(Page::NEVER_ALLOCATE_ON_PAGE),
+        p->AvailableInFreeList() == p->AvailableInFreeListFromAllocatedBytes());
+
+    // TODO(leszeks): Here we should allocation step, but:
+    //   1. Allocation groups are currently not handled properly by the sampling
+    //      allocation profiler, and
+    //   2. Observers might try to take the space lock, which isn't reentrant.
+    // We'll have to come up with a better solution for allocation stepping
+    // before shipping, which will likely be using LocalHeap.
+  }
+
+  DCHECK_EQ(0u, other->Size());
+  DCHECK_EQ(0u, other->Capacity());
+}
+
+size_t PagedSpace::CommittedPhysicalMemory() {
+  if (!base::OS::HasLazyCommits()) return CommittedMemory();
+  MemoryChunk::UpdateHighWaterMark(allocation_info_.top());
+  size_t size = 0;
+  for (Page* page : *this) {
+    size += page->CommittedPhysicalMemory();
+  }
+  return size;
+}
+
+bool PagedSpace::ContainsSlow(Address addr) const {
+  Page* p = Page::FromAddress(addr);
+  for (const Page* page : *this) {
+    if (page == p) return true;
+  }
+  return false;
+}
+
+void PagedSpace::RefineAllocatedBytesAfterSweeping(Page* page) {
+  CHECK(page->SweepingDone());
+  auto marking_state =
+      heap()->incremental_marking()->non_atomic_marking_state();
+  // The live_byte on the page was accounted in the space allocated
+  // bytes counter. After sweeping allocated_bytes() contains the
+  // accurate live byte count on the page.
+  size_t old_counter = marking_state->live_bytes(page);
+  size_t new_counter = page->allocated_bytes();
+  DCHECK_GE(old_counter, new_counter);
+  if (old_counter > new_counter) {
+    DecreaseAllocatedBytes(old_counter - new_counter, page);
+    // Give the heap a chance to adjust counters in response to the
+    // more precise and smaller old generation size.
+    heap()->NotifyRefinedOldGenerationSize(old_counter - new_counter);
+  }
+  marking_state->SetLiveBytes(page, 0);
+}
+
+Page* PagedSpace::RemovePageSafe(int size_in_bytes) {
+  base::MutexGuard guard(mutex());
+  Page* page = free_list()->GetPageForSize(size_in_bytes);
+  if (!page) return nullptr;
+  RemovePage(page);
+  return page;
+}
+
+size_t PagedSpace::AddPage(Page* page) {
+  CHECK(page->SweepingDone());
+  page->set_owner(this);
+  memory_chunk_list_.PushBack(page);
+  AccountCommitted(page->size());
+  IncreaseCapacity(page->area_size());
+  IncreaseAllocatedBytes(page->allocated_bytes(), page);
+  for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    IncrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
+  }
+  return RelinkFreeListCategories(page);
+}
+
+void PagedSpace::RemovePage(Page* page) {
+  CHECK(page->SweepingDone());
+  memory_chunk_list_.Remove(page);
+  UnlinkFreeListCategories(page);
+  DecreaseAllocatedBytes(page->allocated_bytes(), page);
+  DecreaseCapacity(page->area_size());
+  AccountUncommitted(page->size());
+  for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    DecrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
+  }
+}
+
+size_t PagedSpace::ShrinkPageToHighWaterMark(Page* page) {
+  size_t unused = page->ShrinkToHighWaterMark();
+  accounting_stats_.DecreaseCapacity(static_cast<intptr_t>(unused));
+  AccountUncommitted(unused);
+  return unused;
+}
+
+void PagedSpace::ResetFreeList() {
+  for (Page* page : *this) {
+    free_list_->EvictFreeListItems(page);
+  }
+  DCHECK(free_list_->IsEmpty());
+}
+
+void PagedSpace::ShrinkImmortalImmovablePages() {
+  DCHECK(!heap()->deserialization_complete());
+  MemoryChunk::UpdateHighWaterMark(allocation_info_.top());
+  FreeLinearAllocationArea();
+  ResetFreeList();
+  for (Page* page : *this) {
+    DCHECK(page->IsFlagSet(Page::NEVER_EVACUATE));
+    ShrinkPageToHighWaterMark(page);
+  }
+}
+
+Page* PagedSpace::AllocatePage() {
+  return heap()->memory_allocator()->AllocatePage(AreaSize(), this,
+                                                  executable());
+}
+
+Page* PagedSpace::Expand() {
+  Page* page = AllocatePage();
+  if (page == nullptr) return nullptr;
+  AddPage(page);
+  Free(page->area_start(), page->area_size(),
+       SpaceAccountingMode::kSpaceAccounted);
+  return page;
+}
+
+Page* PagedSpace::ExpandBackground() {
+  Page* page = AllocatePage();
+  if (page == nullptr) return nullptr;
+  base::MutexGuard guard(&allocation_mutex_);
+  AddPage(page);
+  Free(page->area_start(), page->area_size(),
+       SpaceAccountingMode::kSpaceAccounted);
+  return page;
+}
+
+int PagedSpace::CountTotalPages() {
+  int count = 0;
+  for (Page* page : *this) {
+    count++;
+    USE(page);
+  }
+  return count;
+}
+
+void PagedSpace::SetLinearAllocationArea(Address top, Address limit) {
+  SetTopAndLimit(top, limit);
+  if (top != kNullAddress && top != limit && !is_off_thread_space() &&
+      heap()->incremental_marking()->black_allocation()) {
+    Page::FromAllocationAreaAddress(top)->CreateBlackArea(top, limit);
+  }
+}
+
+void PagedSpace::DecreaseLimit(Address new_limit) {
+  Address old_limit = limit();
+  DCHECK_LE(top(), new_limit);
+  DCHECK_GE(old_limit, new_limit);
+  if (new_limit != old_limit) {
+    SetTopAndLimit(top(), new_limit);
+    Free(new_limit, old_limit - new_limit,
+         SpaceAccountingMode::kSpaceAccounted);
+    if (heap()->incremental_marking()->black_allocation()) {
+      Page::FromAllocationAreaAddress(new_limit)->DestroyBlackArea(new_limit,
+                                                                   old_limit);
+    }
+  }
+}
+
+void PagedSpace::MarkLinearAllocationAreaBlack() {
+  DCHECK(heap()->incremental_marking()->black_allocation());
+  Address current_top = top();
+  Address current_limit = limit();
+  if (current_top != kNullAddress && current_top != current_limit) {
+    Page::FromAllocationAreaAddress(current_top)
+        ->CreateBlackArea(current_top, current_limit);
+  }
+}
+
+void PagedSpace::UnmarkLinearAllocationArea() {
+  Address current_top = top();
+  Address current_limit = limit();
+  if (current_top != kNullAddress && current_top != current_limit) {
+    Page::FromAllocationAreaAddress(current_top)
+        ->DestroyBlackArea(current_top, current_limit);
+  }
+}
+
+void PagedSpace::MakeLinearAllocationAreaIterable() {
+  Address current_top = top();
+  Address current_limit = limit();
+  if (current_top != kNullAddress && current_top != current_limit) {
+    base::Optional<CodePageMemoryModificationScope> optional_scope;
+
+    if (identity() == CODE_SPACE) {
+      MemoryChunk* chunk = MemoryChunk::FromAddress(current_top);
+      optional_scope.emplace(chunk);
+    }
+
+    heap_->CreateFillerObjectAt(current_top,
+                                static_cast<int>(current_limit - current_top),
+                                ClearRecordedSlots::kNo);
+  }
+}
+
+void PagedSpace::FreeLinearAllocationArea() {
+  // Mark the old linear allocation area with a free space map so it can be
+  // skipped when scanning the heap.
+  Address current_top = top();
+  Address current_limit = limit();
+  if (current_top == kNullAddress) {
+    DCHECK_EQ(kNullAddress, current_limit);
+    return;
+  }
+
+  if (!is_off_thread_space() &&
+      heap()->incremental_marking()->black_allocation()) {
+    Page* page = Page::FromAllocationAreaAddress(current_top);
+
+    // Clear the bits in the unused black area.
+    if (current_top != current_limit) {
+      IncrementalMarking::MarkingState* marking_state =
+          heap()->incremental_marking()->marking_state();
+      marking_state->bitmap(page)->ClearRange(
+          page->AddressToMarkbitIndex(current_top),
+          page->AddressToMarkbitIndex(current_limit));
+      marking_state->IncrementLiveBytes(
+          page, -static_cast<int>(current_limit - current_top));
+    }
+  }
+
+  if (!is_local_space()) {
+    InlineAllocationStep(current_top, kNullAddress, kNullAddress, 0);
+  }
+
+  SetTopAndLimit(kNullAddress, kNullAddress);
+  DCHECK_GE(current_limit, current_top);
+
+  // The code page of the linear allocation area needs to be unprotected
+  // because we are going to write a filler into that memory area below.
+  if (identity() == CODE_SPACE) {
+    heap()->UnprotectAndRegisterMemoryChunk(
+        MemoryChunk::FromAddress(current_top));
+  }
+  Free(current_top, current_limit - current_top,
+       SpaceAccountingMode::kSpaceAccounted);
+}
+
+void PagedSpace::ReleasePage(Page* page) {
+  DCHECK_EQ(
+      0, heap()->incremental_marking()->non_atomic_marking_state()->live_bytes(
+             page));
+  DCHECK_EQ(page->owner(), this);
+
+  free_list_->EvictFreeListItems(page);
+
+  if (Page::FromAllocationAreaAddress(allocation_info_.top()) == page) {
+    DCHECK(!top_on_previous_step_);
+    allocation_info_.Reset(kNullAddress, kNullAddress);
+  }
+
+  heap()->isolate()->RemoveCodeMemoryChunk(page);
+
+  AccountUncommitted(page->size());
+  accounting_stats_.DecreaseCapacity(page->area_size());
+  heap()->memory_allocator()->Free<MemoryAllocator::kPreFreeAndQueue>(page);
+}
+
+void PagedSpace::SetReadable() {
+  DCHECK(identity() == CODE_SPACE);
+  for (Page* page : *this) {
+    CHECK(heap()->memory_allocator()->IsMemoryChunkExecutable(page));
+    page->SetReadable();
+  }
+}
+
+void PagedSpace::SetReadAndExecutable() {
+  DCHECK(identity() == CODE_SPACE);
+  for (Page* page : *this) {
+    CHECK(heap()->memory_allocator()->IsMemoryChunkExecutable(page));
+    page->SetReadAndExecutable();
+  }
+}
+
+void PagedSpace::SetReadAndWritable() {
+  DCHECK(identity() == CODE_SPACE);
+  for (Page* page : *this) {
+    CHECK(heap()->memory_allocator()->IsMemoryChunkExecutable(page));
+    page->SetReadAndWritable();
+  }
+}
+
+std::unique_ptr<ObjectIterator> PagedSpace::GetObjectIterator(Heap* heap) {
+  return std::unique_ptr<ObjectIterator>(
+      new PagedSpaceObjectIterator(heap, this));
+}
+
+bool PagedSpace::RefillLinearAllocationAreaFromFreeList(
+    size_t size_in_bytes, AllocationOrigin origin) {
+  DCHECK(IsAligned(size_in_bytes, kTaggedSize));
+  DCHECK_LE(top(), limit());
+#ifdef DEBUG
+  if (top() != limit()) {
+    DCHECK_EQ(Page::FromAddress(top()), Page::FromAddress(limit() - 1));
+  }
+#endif
+  // Don't free list allocate if there is linear space available.
+  DCHECK_LT(static_cast<size_t>(limit() - top()), size_in_bytes);
+
+  // Mark the old linear allocation area with a free space map so it can be
+  // skipped when scanning the heap.  This also puts it back in the free list
+  // if it is big enough.
+  FreeLinearAllocationArea();
+
+  if (!is_local_space()) {
+    heap()->StartIncrementalMarkingIfAllocationLimitIsReached(
+        heap()->GCFlagsForIncrementalMarking(),
+        kGCCallbackScheduleIdleGarbageCollection);
+  }
+
+  size_t new_node_size = 0;
+  FreeSpace new_node =
+      free_list_->Allocate(size_in_bytes, &new_node_size, origin);
+  if (new_node.is_null()) return false;
+  DCHECK_GE(new_node_size, size_in_bytes);
+
+  // The old-space-step might have finished sweeping and restarted marking.
+  // Verify that it did not turn the page of the new node into an evacuation
+  // candidate.
+  DCHECK(!MarkCompactCollector::IsOnEvacuationCandidate(new_node));
+
+  // Memory in the linear allocation area is counted as allocated.  We may free
+  // a little of this again immediately - see below.
+  Page* page = Page::FromHeapObject(new_node);
+  IncreaseAllocatedBytes(new_node_size, page);
+
+  Address start = new_node.address();
+  Address end = new_node.address() + new_node_size;
+  Address limit = ComputeLimit(start, end, size_in_bytes);
+  DCHECK_LE(limit, end);
+  DCHECK_LE(size_in_bytes, limit - start);
+  if (limit != end) {
+    if (identity() == CODE_SPACE) {
+      heap()->UnprotectAndRegisterMemoryChunk(page);
+    }
+    Free(limit, end - limit, SpaceAccountingMode::kSpaceAccounted);
+  }
+  SetLinearAllocationArea(start, limit);
+
+  return true;
+}
+
+base::Optional<std::pair<Address, size_t>>
+PagedSpace::SlowGetLinearAllocationAreaBackground(LocalHeap* local_heap,
+                                                  size_t min_size_in_bytes,
+                                                  size_t max_size_in_bytes,
+                                                  AllocationAlignment alignment,
+                                                  AllocationOrigin origin) {
+  DCHECK(!is_local_space() && identity() == OLD_SPACE);
+  DCHECK_EQ(origin, AllocationOrigin::kRuntime);
+
+  auto result = TryAllocationFromFreeListBackground(
+      min_size_in_bytes, max_size_in_bytes, alignment, origin);
+  if (result) return result;
+
+  MarkCompactCollector* collector = heap()->mark_compact_collector();
+  // Sweeping is still in progress.
+  if (collector->sweeping_in_progress()) {
+    // First try to refill the free-list, concurrent sweeper threads
+    // may have freed some objects in the meantime.
+    {
+      base::MutexGuard lock(&allocation_mutex_);
+      RefillFreeList();
+    }
+
+    // Retry the free list allocation.
+    auto result = TryAllocationFromFreeListBackground(
+        min_size_in_bytes, max_size_in_bytes, alignment, origin);
+    if (result) return result;
+
+    Sweeper::FreeSpaceMayContainInvalidatedSlots
+        invalidated_slots_in_free_space =
+            Sweeper::FreeSpaceMayContainInvalidatedSlots::kNo;
+
+    const int kMaxPagesToSweep = 1;
+    int max_freed = collector->sweeper()->ParallelSweepSpace(
+        identity(), static_cast<int>(min_size_in_bytes), kMaxPagesToSweep,
+        invalidated_slots_in_free_space);
+
+    {
+      base::MutexGuard lock(&allocation_mutex_);
+      RefillFreeList();
+    }
+
+    if (static_cast<size_t>(max_freed) >= min_size_in_bytes) {
+      auto result = TryAllocationFromFreeListBackground(
+          min_size_in_bytes, max_size_in_bytes, alignment, origin);
+      if (result) return result;
+    }
+  }
+
+  if (heap()->ShouldExpandOldGenerationOnSlowAllocation(local_heap) &&
+      heap()->CanExpandOldGenerationBackground(AreaSize()) &&
+      ExpandBackground()) {
+    DCHECK((CountTotalPages() > 1) ||
+           (min_size_in_bytes <= free_list_->Available()));
+    auto result = TryAllocationFromFreeListBackground(
+        min_size_in_bytes, max_size_in_bytes, alignment, origin);
+    if (result) return result;
+  }
+
+  // TODO(dinfuehr): Complete sweeping here and try allocation again.
+
+  return {};
+}
+
+base::Optional<std::pair<Address, size_t>>
+PagedSpace::TryAllocationFromFreeListBackground(size_t min_size_in_bytes,
+                                                size_t max_size_in_bytes,
+                                                AllocationAlignment alignment,
+                                                AllocationOrigin origin) {
+  base::MutexGuard lock(&allocation_mutex_);
+  DCHECK_LE(min_size_in_bytes, max_size_in_bytes);
+  DCHECK_EQ(identity(), OLD_SPACE);
+
+  size_t new_node_size = 0;
+  FreeSpace new_node =
+      free_list_->Allocate(min_size_in_bytes, &new_node_size, origin);
+  if (new_node.is_null()) return {};
+  DCHECK_GE(new_node_size, min_size_in_bytes);
+
+  // The old-space-step might have finished sweeping and restarted marking.
+  // Verify that it did not turn the page of the new node into an evacuation
+  // candidate.
+  DCHECK(!MarkCompactCollector::IsOnEvacuationCandidate(new_node));
+
+  // Memory in the linear allocation area is counted as allocated.  We may free
+  // a little of this again immediately - see below.
+  Page* page = Page::FromHeapObject(new_node);
+  IncreaseAllocatedBytes(new_node_size, page);
+
+  heap()->StartIncrementalMarkingIfAllocationLimitIsReachedBackground();
+
+  size_t used_size_in_bytes = Min(new_node_size, max_size_in_bytes);
+
+  Address start = new_node.address();
+  Address end = new_node.address() + new_node_size;
+  Address limit = new_node.address() + used_size_in_bytes;
+  DCHECK_LE(limit, end);
+  DCHECK_LE(min_size_in_bytes, limit - start);
+  if (limit != end) {
+    Free(limit, end - limit, SpaceAccountingMode::kSpaceAccounted);
+  }
+
+  return std::make_pair(start, used_size_in_bytes);
+}
+
+#ifdef DEBUG
+void PagedSpace::Print() {}
+#endif
+
+#ifdef VERIFY_HEAP
+void PagedSpace::Verify(Isolate* isolate, ObjectVisitor* visitor) {
+  bool allocation_pointer_found_in_space =
+      (allocation_info_.top() == allocation_info_.limit());
+  size_t external_space_bytes[kNumTypes];
+  size_t external_page_bytes[kNumTypes];
+
+  for (int i = 0; i < kNumTypes; i++) {
+    external_space_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
+  }
+
+  for (Page* page : *this) {
+#ifdef V8_SHARED_RO_HEAP
+    if (identity() == RO_SPACE) {
+      CHECK_NULL(page->owner());
+    } else {
+      CHECK_EQ(page->owner(), this);
+    }
+#else
+    CHECK_EQ(page->owner(), this);
+#endif
+
+    for (int i = 0; i < kNumTypes; i++) {
+      external_page_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
+    }
+
+    if (page == Page::FromAllocationAreaAddress(allocation_info_.top())) {
+      allocation_pointer_found_in_space = true;
+    }
+    CHECK(page->SweepingDone());
+    PagedSpaceObjectIterator it(isolate->heap(), this, page);
+    Address end_of_previous_object = page->area_start();
+    Address top = page->area_end();
+
+    for (HeapObject object = it.Next(); !object.is_null(); object = it.Next()) {
+      CHECK(end_of_previous_object <= object.address());
+
+      // The first word should be a map, and we expect all map pointers to
+      // be in map space.
+      Map map = object.map();
+      CHECK(map.IsMap());
+      CHECK(ReadOnlyHeap::Contains(map) ||
+            isolate->heap()->map_space()->Contains(map));
+
+      // Perform space-specific object verification.
+      VerifyObject(object);
+
+      // The object itself should look OK.
+      object.ObjectVerify(isolate);
+
+      if (!FLAG_verify_heap_skip_remembered_set) {
+        isolate->heap()->VerifyRememberedSetFor(object);
+      }
+
+      // All the interior pointers should be contained in the heap.
+      int size = object.Size();
+      object.IterateBody(map, size, visitor);
+      CHECK(object.address() + size <= top);
+      end_of_previous_object = object.address() + size;
+
+      if (object.IsExternalString()) {
+        ExternalString external_string = ExternalString::cast(object);
+        size_t size = external_string.ExternalPayloadSize();
+        external_page_bytes[ExternalBackingStoreType::kExternalString] += size;
+      } else if (object.IsJSArrayBuffer()) {
+        JSArrayBuffer array_buffer = JSArrayBuffer::cast(object);
+        if (ArrayBufferTracker::IsTracked(array_buffer)) {
+          size_t size =
+              ArrayBufferTracker::Lookup(isolate->heap(), array_buffer)
+                  ->PerIsolateAccountingLength();
+          external_page_bytes[ExternalBackingStoreType::kArrayBuffer] += size;
+        }
+      }
+    }
+    for (int i = 0; i < kNumTypes; i++) {
+      ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+      CHECK_EQ(external_page_bytes[t], page->ExternalBackingStoreBytes(t));
+      external_space_bytes[t] += external_page_bytes[t];
+    }
+  }
+  for (int i = 0; i < kNumTypes; i++) {
+    if (V8_ARRAY_BUFFER_EXTENSION_BOOL &&
+        i == ExternalBackingStoreType::kArrayBuffer)
+      continue;
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    CHECK_EQ(external_space_bytes[t], ExternalBackingStoreBytes(t));
+  }
+  CHECK(allocation_pointer_found_in_space);
+
+  if (identity() == OLD_SPACE && V8_ARRAY_BUFFER_EXTENSION_BOOL) {
+    size_t bytes = heap()->array_buffer_sweeper()->old().BytesSlow();
+    CHECK_EQ(bytes,
+             ExternalBackingStoreBytes(ExternalBackingStoreType::kArrayBuffer));
+  }
+
+#ifdef DEBUG
+  VerifyCountersAfterSweeping(isolate->heap());
+#endif
+}
+
+void PagedSpace::VerifyLiveBytes() {
+  DCHECK_NE(identity(), RO_SPACE);
+  IncrementalMarking::MarkingState* marking_state =
+      heap()->incremental_marking()->marking_state();
+  for (Page* page : *this) {
+    CHECK(page->SweepingDone());
+    PagedSpaceObjectIterator it(heap(), this, page);
+    int black_size = 0;
+    for (HeapObject object = it.Next(); !object.is_null(); object = it.Next()) {
+      // All the interior pointers should be contained in the heap.
+      if (marking_state->IsBlack(object)) {
+        black_size += object.Size();
+      }
+    }
+    CHECK_LE(black_size, marking_state->live_bytes(page));
+  }
+}
+#endif  // VERIFY_HEAP
+
+#ifdef DEBUG
+void PagedSpace::VerifyCountersAfterSweeping(Heap* heap) {
+  size_t total_capacity = 0;
+  size_t total_allocated = 0;
+  for (Page* page : *this) {
+    DCHECK(page->SweepingDone());
+    total_capacity += page->area_size();
+    PagedSpaceObjectIterator it(heap, this, page);
+    size_t real_allocated = 0;
+    for (HeapObject object = it.Next(); !object.is_null(); object = it.Next()) {
+      if (!object.IsFreeSpaceOrFiller()) {
+        real_allocated += object.Size();
+      }
+    }
+    total_allocated += page->allocated_bytes();
+    // The real size can be smaller than the accounted size if array trimming,
+    // object slack tracking happened after sweeping.
+    DCHECK_LE(real_allocated, accounting_stats_.AllocatedOnPage(page));
+    DCHECK_EQ(page->allocated_bytes(), accounting_stats_.AllocatedOnPage(page));
+  }
+  DCHECK_EQ(total_capacity, accounting_stats_.Capacity());
+  DCHECK_EQ(total_allocated, accounting_stats_.Size());
+}
+
+void PagedSpace::VerifyCountersBeforeConcurrentSweeping() {
+  // We need to refine the counters on pages that are already swept and have
+  // not been moved over to the actual space. Otherwise, the AccountingStats
+  // are just an over approximation.
+  RefillFreeList();
+
+  size_t total_capacity = 0;
+  size_t total_allocated = 0;
+  auto marking_state =
+      heap()->incremental_marking()->non_atomic_marking_state();
+  for (Page* page : *this) {
+    size_t page_allocated =
+        page->SweepingDone()
+            ? page->allocated_bytes()
+            : static_cast<size_t>(marking_state->live_bytes(page));
+    total_capacity += page->area_size();
+    total_allocated += page_allocated;
+    DCHECK_EQ(page_allocated, accounting_stats_.AllocatedOnPage(page));
+  }
+  DCHECK_EQ(total_capacity, accounting_stats_.Capacity());
+  DCHECK_EQ(total_allocated, accounting_stats_.Size());
+}
+#endif
+
+void PagedSpace::UpdateInlineAllocationLimit(size_t min_size) {
+  Address new_limit = ComputeLimit(top(), limit(), min_size);
+  DCHECK_LE(new_limit, limit());
+  DecreaseLimit(new_limit);
+}
+
+// -----------------------------------------------------------------------------
+// OldSpace implementation
+
+void PagedSpace::PrepareForMarkCompact() {
+  // We don't have a linear allocation area while sweeping.  It will be restored
+  // on the first allocation after the sweep.
+  FreeLinearAllocationArea();
+
+  // Clear the free list before a full GC---it will be rebuilt afterward.
+  free_list_->Reset();
+}
+
+size_t PagedSpace::SizeOfObjects() {
+  CHECK_GE(limit(), top());
+  DCHECK_GE(Size(), static_cast<size_t>(limit() - top()));
+  return Size() - (limit() - top());
+}
+
+bool PagedSpace::EnsureSweptAndRetryAllocation(int size_in_bytes,
+                                               AllocationOrigin origin) {
+  DCHECK(!is_local_space());
+  MarkCompactCollector* collector = heap()->mark_compact_collector();
+  if (collector->sweeping_in_progress()) {
+    // Wait for the sweeper threads here and complete the sweeping phase.
+    collector->EnsureSweepingCompleted();
+
+    // After waiting for the sweeper threads, there may be new free-list
+    // entries.
+    return RefillLinearAllocationAreaFromFreeList(size_in_bytes, origin);
+  }
+  return false;
+}
+
+bool PagedSpace::SlowRefillLinearAllocationArea(int size_in_bytes,
+                                                AllocationOrigin origin) {
+  VMState<GC> state(heap()->isolate());
+  RuntimeCallTimerScope runtime_timer(
+      heap()->isolate(), RuntimeCallCounterId::kGC_Custom_SlowAllocateRaw);
+  base::Optional<base::MutexGuard> optional_mutex;
+
+  if (FLAG_concurrent_allocation && origin != AllocationOrigin::kGC &&
+      identity() == OLD_SPACE) {
+    optional_mutex.emplace(&allocation_mutex_);
+  }
+
+  return RawSlowRefillLinearAllocationArea(size_in_bytes, origin);
+}
+
+bool CompactionSpace::SlowRefillLinearAllocationArea(int size_in_bytes,
+                                                     AllocationOrigin origin) {
+  return RawSlowRefillLinearAllocationArea(size_in_bytes, origin);
+}
+
+bool OffThreadSpace::SlowRefillLinearAllocationArea(int size_in_bytes,
+                                                    AllocationOrigin origin) {
+  if (RefillLinearAllocationAreaFromFreeList(size_in_bytes, origin))
+    return true;
+
+  if (heap()->CanExpandOldGenerationBackground(size_in_bytes) && Expand()) {
+    DCHECK((CountTotalPages() > 1) ||
+           (static_cast<size_t>(size_in_bytes) <= free_list_->Available()));
+    return RefillLinearAllocationAreaFromFreeList(
+        static_cast<size_t>(size_in_bytes), origin);
+  }
+
+  return false;
+}
+
+bool PagedSpace::RawSlowRefillLinearAllocationArea(int size_in_bytes,
+                                                   AllocationOrigin origin) {
+  // Non-compaction local spaces are not supported.
+  DCHECK_IMPLIES(is_local_space(), is_compaction_space());
+
+  // Allocation in this space has failed.
+  DCHECK_GE(size_in_bytes, 0);
+  const int kMaxPagesToSweep = 1;
+
+  if (RefillLinearAllocationAreaFromFreeList(size_in_bytes, origin))
+    return true;
+
+  MarkCompactCollector* collector = heap()->mark_compact_collector();
+  // Sweeping is still in progress.
+  if (collector->sweeping_in_progress()) {
+    if (FLAG_concurrent_sweeping && !is_compaction_space() &&
+        !collector->sweeper()->AreSweeperTasksRunning()) {
+      collector->EnsureSweepingCompleted();
+    }
+
+    // First try to refill the free-list, concurrent sweeper threads
+    // may have freed some objects in the meantime.
+    RefillFreeList();
+
+    // Retry the free list allocation.
+    if (RefillLinearAllocationAreaFromFreeList(
+            static_cast<size_t>(size_in_bytes), origin))
+      return true;
+
+    if (SweepAndRetryAllocation(size_in_bytes, kMaxPagesToSweep, size_in_bytes,
+                                origin))
+      return true;
+  }
+
+  if (is_compaction_space()) {
+    // The main thread may have acquired all swept pages. Try to steal from
+    // it. This can only happen during young generation evacuation.
+    PagedSpace* main_space = heap()->paged_space(identity());
+    Page* page = main_space->RemovePageSafe(size_in_bytes);
+    if (page != nullptr) {
+      AddPage(page);
+      if (RefillLinearAllocationAreaFromFreeList(
+              static_cast<size_t>(size_in_bytes), origin))
+        return true;
+    }
+  }
+
+  if (heap()->ShouldExpandOldGenerationOnSlowAllocation() &&
+      heap()->CanExpandOldGeneration(AreaSize())) {
+    Page* page = Expand();
+    if (page) {
+      if (!is_compaction_space()) {
+        heap()->NotifyOldGenerationExpansion(identity(), page);
+      }
+      DCHECK((CountTotalPages() > 1) ||
+             (static_cast<size_t>(size_in_bytes) <= free_list_->Available()));
+      return RefillLinearAllocationAreaFromFreeList(
+          static_cast<size_t>(size_in_bytes), origin);
+    }
+  }
+
+  if (is_compaction_space()) {
+    return SweepAndRetryAllocation(0, 0, size_in_bytes, origin);
+
+  } else {
+    // If sweeper threads are active, wait for them at that point and steal
+    // elements from their free-lists. Allocation may still fail here which
+    // would indicate that there is not enough memory for the given allocation.
+    return EnsureSweptAndRetryAllocation(size_in_bytes, origin);
+  }
+}
+
+bool PagedSpace::SweepAndRetryAllocation(int required_freed_bytes,
+                                         int max_pages, int size_in_bytes,
+                                         AllocationOrigin origin) {
+  // Cleanup invalidated old-to-new refs for compaction space in the
+  // final atomic pause.
+  Sweeper::FreeSpaceMayContainInvalidatedSlots invalidated_slots_in_free_space =
+      is_compaction_space() ? Sweeper::FreeSpaceMayContainInvalidatedSlots::kYes
+                            : Sweeper::FreeSpaceMayContainInvalidatedSlots::kNo;
+
+  MarkCompactCollector* collector = heap()->mark_compact_collector();
+  if (collector->sweeping_in_progress()) {
+    int max_freed = collector->sweeper()->ParallelSweepSpace(
+        identity(), required_freed_bytes, max_pages,
+        invalidated_slots_in_free_space);
+    RefillFreeList();
+    if (max_freed >= size_in_bytes)
+      return RefillLinearAllocationAreaFromFreeList(size_in_bytes, origin);
+  }
+  return false;
+}
+
+// -----------------------------------------------------------------------------
+// MapSpace implementation
+
+// TODO(dmercadier): use a heap instead of sorting like that.
+// Using a heap will have multiple benefits:
+//   - for now, SortFreeList is only called after sweeping, which is somewhat
+//   late. Using a heap, sorting could be done online: FreeListCategories would
+//   be inserted in a heap (ie, in a sorted manner).
+//   - SortFreeList is a bit fragile: any change to FreeListMap (or to
+//   MapSpace::free_list_) could break it.
+void MapSpace::SortFreeList() {
+  using LiveBytesPagePair = std::pair<size_t, Page*>;
+  std::vector<LiveBytesPagePair> pages;
+  pages.reserve(CountTotalPages());
+
+  for (Page* p : *this) {
+    free_list()->RemoveCategory(p->free_list_category(kFirstCategory));
+    pages.push_back(std::make_pair(p->allocated_bytes(), p));
+  }
+
+  // Sorting by least-allocated-bytes first.
+  std::sort(pages.begin(), pages.end(),
+            [](const LiveBytesPagePair& a, const LiveBytesPagePair& b) {
+              return a.first < b.first;
+            });
+
+  for (LiveBytesPagePair const& p : pages) {
+    // Since AddCategory inserts in head position, it reverts the order produced
+    // by the sort above: least-allocated-bytes will be Added first, and will
+    // therefore be the last element (and the first one will be
+    // most-allocated-bytes).
+    free_list()->AddCategory(p.second->free_list_category(kFirstCategory));
+  }
+}
+
+#ifdef VERIFY_HEAP
+void MapSpace::VerifyObject(HeapObject object) { CHECK(object.IsMap()); }
+#endif
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/heap/paged-spaces.h b/deps/v8/src/heap/paged-spaces.h
new file mode 100644
index 00000000000..42fc49b9c35
--- /dev/null
+++ b/deps/v8/src/heap/paged-spaces.h
@@ -0,0 +1,585 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_PAGED_SPACES_H_
+#define V8_HEAP_PAGED_SPACES_H_
+
+#include <memory>
+#include <utility>
+
+#include "src/base/bounds.h"
+#include "src/base/macros.h"
+#include "src/base/optional.h"
+#include "src/base/platform/mutex.h"
+#include "src/common/globals.h"
+#include "src/flags/flags.h"
+#include "src/heap/memory-chunk.h"
+#include "src/heap/spaces.h"
+
+namespace v8 {
+namespace internal {
+
+class Heap;
+class HeapObject;
+class Isolate;
+class LocalSpace;
+class OffThreadSpace;
+class ObjectVisitor;
+
+// -----------------------------------------------------------------------------
+// Heap object iterator in old/map spaces.
+//
+// A PagedSpaceObjectIterator iterates objects from the bottom of the given
+// space to its top or from the bottom of the given page to its top.
+//
+// If objects are allocated in the page during iteration the iterator may
+// or may not iterate over those objects.  The caller must create a new
+// iterator in order to be sure to visit these new objects.
+class V8_EXPORT_PRIVATE PagedSpaceObjectIterator : public ObjectIterator {
+ public:
+  // Creates a new object iterator in a given space.
+  PagedSpaceObjectIterator(Heap* heap, PagedSpace* space);
+  PagedSpaceObjectIterator(Heap* heap, PagedSpace* space, Page* page);
+
+  // Creates a new object iterator in a given off-thread space.
+  explicit PagedSpaceObjectIterator(OffThreadSpace* space);
+
+  // Advance to the next object, skipping free spaces and other fillers and
+  // skipping the special garbage section of which there is one per space.
+  // Returns nullptr when the iteration has ended.
+  inline HeapObject Next() override;
+
+ private:
+  // Fast (inlined) path of next().
+  inline HeapObject FromCurrentPage();
+
+  // Slow path of next(), goes into the next page.  Returns false if the
+  // iteration has ended.
+  bool AdvanceToNextPage();
+
+  Address cur_addr_;  // Current iteration point.
+  Address cur_end_;   // End iteration point.
+  PagedSpace* space_;
+  PageRange page_range_;
+  PageRange::iterator current_page_;
+};
+
+class V8_EXPORT_PRIVATE PagedSpace
+    : NON_EXPORTED_BASE(public SpaceWithLinearArea) {
+ public:
+  using iterator = PageIterator;
+  using const_iterator = ConstPageIterator;
+
+  static const size_t kCompactionMemoryWanted = 500 * KB;
+
+  // Creates a space with an id.
+  PagedSpace(Heap* heap, AllocationSpace id, Executability executable,
+             FreeList* free_list,
+             LocalSpaceKind local_space_kind = LocalSpaceKind::kNone);
+
+  ~PagedSpace() override { TearDown(); }
+
+  // Checks whether an object/address is in this space.
+  inline bool Contains(Address a) const;
+  inline bool Contains(Object o) const;
+  bool ContainsSlow(Address addr) const;
+
+  // Does the space need executable memory?
+  Executability executable() { return executable_; }
+
+  // Prepares for a mark-compact GC.
+  void PrepareForMarkCompact();
+
+  // Current capacity without growing (Size() + Available()).
+  size_t Capacity() { return accounting_stats_.Capacity(); }
+
+  // Approximate amount of physical memory committed for this space.
+  size_t CommittedPhysicalMemory() override;
+
+  // Sets the capacity, the available space and the wasted space to zero.
+  // The stats are rebuilt during sweeping by adding each page to the
+  // capacity and the size when it is encountered.  As free spaces are
+  // discovered during the sweeping they are subtracted from the size and added
+  // to the available and wasted totals. The free list is cleared as well.
+  void ClearAllocatorState() {
+    accounting_stats_.ClearSize();
+    free_list_->Reset();
+  }
+
+  // Available bytes without growing.  These are the bytes on the free list.
+  // The bytes in the linear allocation area are not included in this total
+  // because updating the stats would slow down allocation.  New pages are
+  // immediately added to the free list so they show up here.
+  size_t Available() override { return free_list_->Available(); }
+
+  // Allocated bytes in this space.  Garbage bytes that were not found due to
+  // concurrent sweeping are counted as being allocated!  The bytes in the
+  // current linear allocation area (between top and limit) are also counted
+  // here.
+  size_t Size() override { return accounting_stats_.Size(); }
+
+  // As size, but the bytes in lazily swept pages are estimated and the bytes
+  // in the current linear allocation area are not included.
+  size_t SizeOfObjects() override;
+
+  // Wasted bytes in this space.  These are just the bytes that were thrown away
+  // due to being too small to use for allocation.
+  virtual size_t Waste() { return free_list_->wasted_bytes(); }
+
+  // Allocate the requested number of bytes in the space if possible, return a
+  // failure object if not.
+  V8_WARN_UNUSED_RESULT inline AllocationResult AllocateRawUnaligned(
+      int size_in_bytes, AllocationOrigin origin = AllocationOrigin::kRuntime);
+
+  // Allocate the requested number of bytes in the space double aligned if
+  // possible, return a failure object if not.
+  V8_WARN_UNUSED_RESULT inline AllocationResult AllocateRawAligned(
+      int size_in_bytes, AllocationAlignment alignment,
+      AllocationOrigin origin = AllocationOrigin::kRuntime);
+
+  // Allocate the requested number of bytes in the space and consider allocation
+  // alignment if needed.
+  V8_WARN_UNUSED_RESULT inline AllocationResult AllocateRaw(
+      int size_in_bytes, AllocationAlignment alignment,
+      AllocationOrigin origin = AllocationOrigin::kRuntime);
+
+  // Allocate the requested number of bytes in the space from a background
+  // thread.
+  V8_WARN_UNUSED_RESULT base::Optional<std::pair<Address, size_t>>
+  SlowGetLinearAllocationAreaBackground(LocalHeap* local_heap,
+                                        size_t min_size_in_bytes,
+                                        size_t max_size_in_bytes,
+                                        AllocationAlignment alignment,
+                                        AllocationOrigin origin);
+
+  size_t Free(Address start, size_t size_in_bytes, SpaceAccountingMode mode) {
+    if (size_in_bytes == 0) return 0;
+    heap()->CreateFillerObjectAt(start, static_cast<int>(size_in_bytes),
+                                 ClearRecordedSlots::kNo);
+    if (mode == SpaceAccountingMode::kSpaceAccounted) {
+      return AccountedFree(start, size_in_bytes);
+    } else {
+      return UnaccountedFree(start, size_in_bytes);
+    }
+  }
+
+  // Give a block of memory to the space's free list.  It might be added to
+  // the free list or accounted as waste.
+  // If add_to_freelist is false then just accounting stats are updated and
+  // no attempt to add area to free list is made.
+  size_t AccountedFree(Address start, size_t size_in_bytes) {
+    size_t wasted = free_list_->Free(start, size_in_bytes, kLinkCategory);
+    Page* page = Page::FromAddress(start);
+    accounting_stats_.DecreaseAllocatedBytes(size_in_bytes, page);
+    DCHECK_GE(size_in_bytes, wasted);
+    return size_in_bytes - wasted;
+  }
+
+  size_t UnaccountedFree(Address start, size_t size_in_bytes) {
+    size_t wasted = free_list_->Free(start, size_in_bytes, kDoNotLinkCategory);
+    DCHECK_GE(size_in_bytes, wasted);
+    return size_in_bytes - wasted;
+  }
+
+  inline bool TryFreeLast(HeapObject object, int object_size);
+
+  void ResetFreeList();
+
+  // Empty space linear allocation area, returning unused area to free list.
+  void FreeLinearAllocationArea();
+
+  void MakeLinearAllocationAreaIterable();
+
+  void MarkLinearAllocationAreaBlack();
+  void UnmarkLinearAllocationArea();
+
+  void DecreaseAllocatedBytes(size_t bytes, Page* page) {
+    accounting_stats_.DecreaseAllocatedBytes(bytes, page);
+  }
+  void IncreaseAllocatedBytes(size_t bytes, Page* page) {
+    accounting_stats_.IncreaseAllocatedBytes(bytes, page);
+  }
+  void DecreaseCapacity(size_t bytes) {
+    accounting_stats_.DecreaseCapacity(bytes);
+  }
+  void IncreaseCapacity(size_t bytes) {
+    accounting_stats_.IncreaseCapacity(bytes);
+  }
+
+  void RefineAllocatedBytesAfterSweeping(Page* page);
+
+  Page* InitializePage(MemoryChunk* chunk);
+
+  void ReleasePage(Page* page);
+
+  // Adds the page to this space and returns the number of bytes added to the
+  // free list of the space.
+  size_t AddPage(Page* page);
+  void RemovePage(Page* page);
+  // Remove a page if it has at least |size_in_bytes| bytes available that can
+  // be used for allocation.
+  Page* RemovePageSafe(int size_in_bytes);
+
+  void SetReadable();
+  void SetReadAndExecutable();
+  void SetReadAndWritable();
+
+  void SetDefaultCodePermissions() {
+    if (FLAG_jitless) {
+      SetReadable();
+    } else {
+      SetReadAndExecutable();
+    }
+  }
+
+#ifdef VERIFY_HEAP
+  // Verify integrity of this space.
+  virtual void Verify(Isolate* isolate, ObjectVisitor* visitor);
+
+  void VerifyLiveBytes();
+
+  // Overridden by subclasses to verify space-specific object
+  // properties (e.g., only maps or free-list nodes are in map space).
+  virtual void VerifyObject(HeapObject obj) {}
+#endif
+
+#ifdef DEBUG
+  void VerifyCountersAfterSweeping(Heap* heap);
+  void VerifyCountersBeforeConcurrentSweeping();
+  // Print meta info and objects in this space.
+  void Print() override;
+
+  // Report code object related statistics
+  static void ReportCodeStatistics(Isolate* isolate);
+  static void ResetCodeStatistics(Isolate* isolate);
+#endif
+
+  bool CanExpand(size_t size);
+
+  // Returns the number of total pages in this space.
+  int CountTotalPages();
+
+  // Return size of allocatable area on a page in this space.
+  inline int AreaSize() { return static_cast<int>(area_size_); }
+
+  bool is_local_space() { return local_space_kind_ != LocalSpaceKind::kNone; }
+
+  bool is_off_thread_space() {
+    return local_space_kind_ == LocalSpaceKind::kOffThreadSpace;
+  }
+
+  bool is_compaction_space() {
+    return base::IsInRange(local_space_kind_,
+                           LocalSpaceKind::kFirstCompactionSpace,
+                           LocalSpaceKind::kLastCompactionSpace);
+  }
+
+  LocalSpaceKind local_space_kind() { return local_space_kind_; }
+
+  // Merges {other} into the current space. Note that this modifies {other},
+  // e.g., removes its bump pointer area and resets statistics.
+  void MergeLocalSpace(LocalSpace* other);
+
+  // Refills the free list from the corresponding free list filled by the
+  // sweeper.
+  virtual void RefillFreeList();
+
+  base::Mutex* mutex() { return &space_mutex_; }
+
+  inline void UnlinkFreeListCategories(Page* page);
+  inline size_t RelinkFreeListCategories(Page* page);
+
+  Page* first_page() { return reinterpret_cast<Page*>(Space::first_page()); }
+  const Page* first_page() const {
+    return reinterpret_cast<const Page*>(Space::first_page());
+  }
+
+  iterator begin() { return iterator(first_page()); }
+  iterator end() { return iterator(nullptr); }
+
+  const_iterator begin() const { return const_iterator(first_page()); }
+  const_iterator end() const { return const_iterator(nullptr); }
+
+  // Shrink immortal immovable pages of the space to be exactly the size needed
+  // using the high water mark.
+  void ShrinkImmortalImmovablePages();
+
+  size_t ShrinkPageToHighWaterMark(Page* page);
+
+  std::unique_ptr<ObjectIterator> GetObjectIterator(Heap* heap) override;
+
+  void SetLinearAllocationArea(Address top, Address limit);
+
+ private:
+  // Set space linear allocation area.
+  void SetTopAndLimit(Address top, Address limit) {
+    DCHECK(top == limit ||
+           Page::FromAddress(top) == Page::FromAddress(limit - 1));
+    MemoryChunk::UpdateHighWaterMark(allocation_info_.top());
+    allocation_info_.Reset(top, limit);
+  }
+  void DecreaseLimit(Address new_limit);
+  void UpdateInlineAllocationLimit(size_t min_size) override;
+  bool SupportsInlineAllocation() override {
+    return identity() == OLD_SPACE && !is_local_space();
+  }
+
+ protected:
+  // PagedSpaces that should be included in snapshots have different, i.e.,
+  // smaller, initial pages.
+  virtual bool snapshotable() { return true; }
+
+  bool HasPages() { return first_page() != nullptr; }
+
+  // Cleans up the space, frees all pages in this space except those belonging
+  // to the initial chunk, uncommits addresses in the initial chunk.
+  void TearDown();
+
+  // Expands the space by allocating a fixed number of pages. Returns false if
+  // it cannot allocate requested number of pages from OS, or if the hard heap
+  // size limit has been hit.
+  Page* Expand();
+  Page* ExpandBackground();
+  Page* AllocatePage();
+
+  // Sets up a linear allocation area that fits the given number of bytes.
+  // Returns false if there is not enough space and the caller has to retry
+  // after collecting garbage.
+  inline bool EnsureLinearAllocationArea(int size_in_bytes,
+                                         AllocationOrigin origin);
+  // Allocates an object from the linear allocation area. Assumes that the
+  // linear allocation area is large enought to fit the object.
+  inline HeapObject AllocateLinearly(int size_in_bytes);
+  // Tries to allocate an aligned object from the linear allocation area.
+  // Returns nullptr if the linear allocation area does not fit the object.
+  // Otherwise, returns the object pointer and writes the allocation size
+  // (object size + alignment filler size) to the size_in_bytes.
+  inline HeapObject TryAllocateLinearlyAligned(int* size_in_bytes,
+                                               AllocationAlignment alignment);
+
+  V8_WARN_UNUSED_RESULT bool RefillLinearAllocationAreaFromFreeList(
+      size_t size_in_bytes, AllocationOrigin origin);
+
+  // If sweeping is still in progress try to sweep unswept pages. If that is
+  // not successful, wait for the sweeper threads and retry free-list
+  // allocation. Returns false if there is not enough space and the caller
+  // has to retry after collecting garbage.
+  V8_WARN_UNUSED_RESULT bool EnsureSweptAndRetryAllocation(
+      int size_in_bytes, AllocationOrigin origin);
+
+  V8_WARN_UNUSED_RESULT bool SweepAndRetryAllocation(int required_freed_bytes,
+                                                     int max_pages,
+                                                     int size_in_bytes,
+                                                     AllocationOrigin origin);
+
+  // Slow path of AllocateRaw. This function is space-dependent. Returns false
+  // if there is not enough space and the caller has to retry after
+  // collecting garbage.
+  V8_WARN_UNUSED_RESULT virtual bool SlowRefillLinearAllocationArea(
+      int size_in_bytes, AllocationOrigin origin);
+
+  // Implementation of SlowAllocateRaw. Returns false if there is not enough
+  // space and the caller has to retry after collecting garbage.
+  V8_WARN_UNUSED_RESULT bool RawSlowRefillLinearAllocationArea(
+      int size_in_bytes, AllocationOrigin origin);
+
+  V8_WARN_UNUSED_RESULT base::Optional<std::pair<Address, size_t>>
+  TryAllocationFromFreeListBackground(size_t min_size_in_bytes,
+                                      size_t max_size_in_bytes,
+                                      AllocationAlignment alignment,
+                                      AllocationOrigin origin);
+
+  Executability executable_;
+
+  LocalSpaceKind local_space_kind_;
+
+  size_t area_size_;
+
+  // Accounting information for this space.
+  AllocationStats accounting_stats_;
+
+  // Mutex guarding any concurrent access to the space.
+  base::Mutex space_mutex_;
+
+  // Mutex guarding concurrent allocation.
+  base::Mutex allocation_mutex_;
+
+  friend class IncrementalMarking;
+  friend class MarkCompactCollector;
+
+  // Used in cctest.
+  friend class heap::HeapTester;
+};
+
+// -----------------------------------------------------------------------------
+// Base class for compaction space and off-thread space.
+
+class V8_EXPORT_PRIVATE LocalSpace : public PagedSpace {
+ public:
+  LocalSpace(Heap* heap, AllocationSpace id, Executability executable,
+             LocalSpaceKind local_space_kind)
+      : PagedSpace(heap, id, executable, FreeList::CreateFreeList(),
+                   local_space_kind) {
+    DCHECK_NE(local_space_kind, LocalSpaceKind::kNone);
+  }
+
+ protected:
+  // The space is temporary and not included in any snapshots.
+  bool snapshotable() override { return false; }
+};
+
+// -----------------------------------------------------------------------------
+// Compaction space that is used temporarily during compaction.
+
+class V8_EXPORT_PRIVATE CompactionSpace : public LocalSpace {
+ public:
+  CompactionSpace(Heap* heap, AllocationSpace id, Executability executable,
+                  LocalSpaceKind local_space_kind)
+      : LocalSpace(heap, id, executable, local_space_kind) {
+    DCHECK(is_compaction_space());
+  }
+
+ protected:
+  V8_WARN_UNUSED_RESULT bool SlowRefillLinearAllocationArea(
+      int size_in_bytes, AllocationOrigin origin) override;
+};
+
+// A collection of |CompactionSpace|s used by a single compaction task.
+class CompactionSpaceCollection : public Malloced {
+ public:
+  explicit CompactionSpaceCollection(Heap* heap,
+                                     LocalSpaceKind local_space_kind)
+      : old_space_(heap, OLD_SPACE, Executability::NOT_EXECUTABLE,
+                   local_space_kind),
+        code_space_(heap, CODE_SPACE, Executability::EXECUTABLE,
+                    local_space_kind) {}
+
+  CompactionSpace* Get(AllocationSpace space) {
+    switch (space) {
+      case OLD_SPACE:
+        return &old_space_;
+      case CODE_SPACE:
+        return &code_space_;
+      default:
+        UNREACHABLE();
+    }
+    UNREACHABLE();
+  }
+
+ private:
+  CompactionSpace old_space_;
+  CompactionSpace code_space_;
+};
+
+// -----------------------------------------------------------------------------
+// Old generation regular object space.
+
+class OldSpace : public PagedSpace {
+ public:
+  // Creates an old space object. The constructor does not allocate pages
+  // from OS.
+  explicit OldSpace(Heap* heap)
+      : PagedSpace(heap, OLD_SPACE, NOT_EXECUTABLE,
+                   FreeList::CreateFreeList()) {}
+
+  static bool IsAtPageStart(Address addr) {
+    return static_cast<intptr_t>(addr & kPageAlignmentMask) ==
+           MemoryChunkLayout::ObjectStartOffsetInDataPage();
+  }
+
+  size_t ExternalBackingStoreBytes(ExternalBackingStoreType type) const final {
+    if (V8_ARRAY_BUFFER_EXTENSION_BOOL &&
+        type == ExternalBackingStoreType::kArrayBuffer)
+      return heap()->OldArrayBufferBytes();
+    return external_backing_store_bytes_[type];
+  }
+};
+
+// -----------------------------------------------------------------------------
+// Old generation code object space.
+
+class CodeSpace : public PagedSpace {
+ public:
+  // Creates an old space object. The constructor does not allocate pages
+  // from OS.
+  explicit CodeSpace(Heap* heap)
+      : PagedSpace(heap, CODE_SPACE, EXECUTABLE, FreeList::CreateFreeList()) {}
+};
+
+// -----------------------------------------------------------------------------
+// Old space for all map objects
+
+class MapSpace : public PagedSpace {
+ public:
+  // Creates a map space object.
+  explicit MapSpace(Heap* heap)
+      : PagedSpace(heap, MAP_SPACE, NOT_EXECUTABLE, new FreeListMap()) {}
+
+  int RoundSizeDownToObjectAlignment(int size) override {
+    if (base::bits::IsPowerOfTwo(Map::kSize)) {
+      return RoundDown(size, Map::kSize);
+    } else {
+      return (size / Map::kSize) * Map::kSize;
+    }
+  }
+
+  void SortFreeList();
+
+#ifdef VERIFY_HEAP
+  void VerifyObject(HeapObject obj) override;
+#endif
+};
+
+// -----------------------------------------------------------------------------
+// Off-thread space that is used for folded allocation on a different thread.
+
+class V8_EXPORT_PRIVATE OffThreadSpace : public LocalSpace {
+ public:
+  explicit OffThreadSpace(Heap* heap)
+      : LocalSpace(heap, OLD_SPACE, NOT_EXECUTABLE,
+                   LocalSpaceKind::kOffThreadSpace) {
+#ifdef V8_ENABLE_THIRD_PARTY_HEAP
+    // OffThreadSpace doesn't work with third-party heap.
+    UNREACHABLE();
+#endif
+  }
+
+ protected:
+  V8_WARN_UNUSED_RESULT bool SlowRefillLinearAllocationArea(
+      int size_in_bytes, AllocationOrigin origin) override;
+
+  void RefillFreeList() override;
+};
+
+// Iterates over the chunks (pages and large object pages) that can contain
+// pointers to new space or to evacuation candidates.
+class OldGenerationMemoryChunkIterator {
+ public:
+  inline explicit OldGenerationMemoryChunkIterator(Heap* heap);
+
+  // Return nullptr when the iterator is done.
+  inline MemoryChunk* next();
+
+ private:
+  enum State {
+    kOldSpaceState,
+    kMapState,
+    kCodeState,
+    kLargeObjectState,
+    kCodeLargeObjectState,
+    kFinishedState
+  };
+  Heap* heap_;
+  State state_;
+  PageIterator old_iterator_;
+  PageIterator code_iterator_;
+  PageIterator map_iterator_;
+  LargePageIterator lo_iterator_;
+  LargePageIterator code_lo_iterator_;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_PAGED_SPACES_H_
diff --git a/deps/v8/src/heap/read-only-heap.cc b/deps/v8/src/heap/read-only-heap.cc
index 5b0e29bf120..e2387984ccd 100644
--- a/deps/v8/src/heap/read-only-heap.cc
+++ b/deps/v8/src/heap/read-only-heap.cc
@@ -6,11 +6,14 @@
 
 #include <cstring>
 
+#include "include/v8.h"
+#include "src/base/lazy-instance.h"
 #include "src/base/lsan.h"
-#include "src/base/once.h"
-#include "src/heap/heap-inl.h"
+#include "src/base/platform/mutex.h"
 #include "src/heap/heap-write-barrier-inl.h"
-#include "src/heap/spaces.h"
+#include "src/heap/memory-chunk.h"
+#include "src/heap/read-only-spaces.h"
+#include "src/heap/third-party/heap-api.h"
 #include "src/objects/heap-object-inl.h"
 #include "src/objects/objects-inl.h"
 #include "src/objects/smi.h"
@@ -20,7 +23,28 @@ namespace v8 {
 namespace internal {
 
 #ifdef V8_SHARED_RO_HEAP
-V8_DECLARE_ONCE(setup_ro_heap_once);
+namespace {
+// Mutex used to ensure that ReadOnlyArtifacts creation is only done once.
+base::LazyMutex read_only_heap_creation_mutex_ = LAZY_MUTEX_INITIALIZER;
+
+// Weak pointer holding ReadOnlyArtifacts. ReadOnlyHeap::SetUp creates a
+// std::shared_ptr from this when it attempts to reuse it. Since all Isolates
+// hold a std::shared_ptr to this, the object is destroyed when no Isolates
+// remain.
+base::LazyInstance<std::weak_ptr<ReadOnlyArtifacts>>::type
+    read_only_artifacts_ = LAZY_INSTANCE_INITIALIZER;
+
+std::shared_ptr<ReadOnlyArtifacts> InitializeSharedReadOnlyArtifacts() {
+  auto artifacts = std::make_shared<ReadOnlyArtifacts>();
+  *read_only_artifacts_.Pointer() = artifacts;
+  return artifacts;
+}
+}  // namespace
+
+// This ReadOnlyHeap instance will only be accessed by Isolates that are already
+// set up. As such it doesn't need to be guarded by a mutex or shared_ptrs,
+// since an already set up Isolate will hold a shared_ptr to
+// read_only_artifacts_.
 ReadOnlyHeap* ReadOnlyHeap::shared_ro_heap_ = nullptr;
 #endif
 
@@ -28,45 +52,54 @@ ReadOnlyHeap* ReadOnlyHeap::shared_ro_heap_ = nullptr;
 void ReadOnlyHeap::SetUp(Isolate* isolate, ReadOnlyDeserializer* des) {
   DCHECK_NOT_NULL(isolate);
 #ifdef V8_SHARED_RO_HEAP
-  bool call_once_ran = false;
-  base::Optional<uint32_t> des_checksum;
-#ifdef DEBUG
-  if (des != nullptr) des_checksum = des->GetChecksum();
-#endif  // DEBUG
 
-  base::CallOnce(&setup_ro_heap_once,
-                 [isolate, des, des_checksum, &call_once_ran]() {
-                   USE(des_checksum);
-                   shared_ro_heap_ = CreateAndAttachToIsolate(isolate);
-                   if (des != nullptr) {
+  bool read_only_heap_created = false;
+
+  if (des != nullptr) {
+    base::MutexGuard guard(read_only_heap_creation_mutex_.Pointer());
+    std::shared_ptr<ReadOnlyArtifacts> artifacts =
+        read_only_artifacts_.Get().lock();
+    if (!artifacts) {
+      artifacts = InitializeSharedReadOnlyArtifacts();
+      shared_ro_heap_ = CreateAndAttachToIsolate(isolate, artifacts);
 #ifdef DEBUG
-                     shared_ro_heap_->read_only_blob_checksum_ = des_checksum;
+      shared_ro_heap_->read_only_blob_checksum_ = des->GetChecksum();
 #endif  // DEBUG
-                     shared_ro_heap_->DeseralizeIntoIsolate(isolate, des);
-                   }
-                   call_once_ran = true;
-                 });
+      shared_ro_heap_->DeseralizeIntoIsolate(isolate, des);
+      read_only_heap_created = true;
+    } else {
+      isolate->SetUpFromReadOnlyArtifacts(artifacts);
+    }
+  } else {
+    // This path should only be taken in mksnapshot, should only be run once
+    // before tearing down the Isolate that holds this ReadOnlyArtifacts and is
+    // not thread-safe.
+    std::shared_ptr<ReadOnlyArtifacts> artifacts =
+        read_only_artifacts_.Get().lock();
+    CHECK(!artifacts);
+    artifacts = InitializeSharedReadOnlyArtifacts();
+    shared_ro_heap_ = CreateAndAttachToIsolate(isolate, artifacts);
+    read_only_heap_created = true;
+  }
 
-  USE(call_once_ran);
-  USE(des_checksum);
 #ifdef DEBUG
   const base::Optional<uint32_t> last_checksum =
       shared_ro_heap_->read_only_blob_checksum_;
   if (last_checksum) {
     // The read-only heap was set up from a snapshot. Make sure it's the always
     // the same snapshot.
-    CHECK_WITH_MSG(des_checksum,
-                   "Attempt to create the read-only heap after "
-                   "already creating from a snapshot.");
-    CHECK_EQ(last_checksum, des_checksum);
+    CHECK_WITH_MSG(des->GetChecksum(),
+                   "Attempt to create the read-only heap after already "
+                   "creating from a snapshot.");
+    CHECK_EQ(last_checksum, des->GetChecksum());
   } else {
     // The read-only heap objects were created. Make sure this happens only
     // once, during this call.
-    CHECK(call_once_ran);
+    CHECK(read_only_heap_created);
   }
 #endif  // DEBUG
+  USE(read_only_heap_created);
 
-  isolate->SetUpFromReadOnlyHeap(shared_ro_heap_);
   if (des != nullptr) {
     void* const isolate_ro_roots = reinterpret_cast<void*>(
         isolate->roots_table().read_only_roots_begin().address());
@@ -74,7 +107,8 @@ void ReadOnlyHeap::SetUp(Isolate* isolate, ReadOnlyDeserializer* des) {
                 kEntriesCount * sizeof(Address));
   }
 #else
-  auto* ro_heap = CreateAndAttachToIsolate(isolate);
+  auto artifacts = std::make_shared<ReadOnlyArtifacts>();
+  auto* ro_heap = CreateAndAttachToIsolate(isolate, artifacts);
   if (des != nullptr) ro_heap->DeseralizeIntoIsolate(isolate, des);
 #endif  // V8_SHARED_RO_HEAP
 }
@@ -92,24 +126,30 @@ void ReadOnlyHeap::OnCreateHeapObjectsComplete(Isolate* isolate) {
 }
 
 // static
-ReadOnlyHeap* ReadOnlyHeap::CreateAndAttachToIsolate(Isolate* isolate) {
-  auto* ro_heap = new ReadOnlyHeap(new ReadOnlySpace(isolate->heap()));
-  isolate->SetUpFromReadOnlyHeap(ro_heap);
-  return ro_heap;
+ReadOnlyHeap* ReadOnlyHeap::CreateAndAttachToIsolate(
+    Isolate* isolate, std::shared_ptr<ReadOnlyArtifacts> artifacts) {
+  std::unique_ptr<ReadOnlyHeap> ro_heap(
+      new ReadOnlyHeap(new ReadOnlySpace(isolate->heap())));
+  artifacts->set_read_only_heap(std::move(ro_heap));
+  isolate->SetUpFromReadOnlyArtifacts(artifacts);
+  return artifacts->read_only_heap();
 }
 
 void ReadOnlyHeap::InitFromIsolate(Isolate* isolate) {
   DCHECK(!init_complete_);
   read_only_space_->ShrinkImmortalImmovablePages();
 #ifdef V8_SHARED_RO_HEAP
+  std::shared_ptr<ReadOnlyArtifacts> artifacts(*read_only_artifacts_.Pointer());
+  read_only_space()->DetachPagesAndAddToArtifacts(artifacts);
+  read_only_space_ = artifacts->shared_read_only_space();
+
   void* const isolate_ro_roots = reinterpret_cast<void*>(
       isolate->roots_table().read_only_roots_begin().address());
   std::memcpy(read_only_roots_, isolate_ro_roots,
               kEntriesCount * sizeof(Address));
-  // N.B. Since pages are manually allocated with mmap, Lsan doesn't track
-  // their pointers. Seal explicitly ignores the necessary objects.
+  // N.B. Since pages are manually allocated with mmap, Lsan doesn't track their
+  // pointers. Seal explicitly ignores the necessary objects.
   LSAN_IGNORE_OBJECT(this);
-  read_only_space_->Seal(ReadOnlySpace::SealMode::kDetachFromHeapAndForget);
 #else
   read_only_space_->Seal(ReadOnlySpace::SealMode::kDoNotDetachFromHeap);
 #endif
@@ -119,24 +159,26 @@ void ReadOnlyHeap::InitFromIsolate(Isolate* isolate) {
 void ReadOnlyHeap::OnHeapTearDown() {
 #ifndef V8_SHARED_RO_HEAP
   delete read_only_space_;
-  delete this;
 #endif
 }
 
-#ifdef V8_SHARED_RO_HEAP
 // static
-const ReadOnlyHeap* ReadOnlyHeap::Instance() { return shared_ro_heap_; }
-#endif
-
-// static
-void ReadOnlyHeap::ClearSharedHeapForTest() {
+void ReadOnlyHeap::PopulateReadOnlySpaceStatistics(
+    SharedMemoryStatistics* statistics) {
+  statistics->read_only_space_size_ = 0;
+  statistics->read_only_space_used_size_ = 0;
+  statistics->read_only_space_physical_size_ = 0;
 #ifdef V8_SHARED_RO_HEAP
-  DCHECK_NOT_NULL(shared_ro_heap_);
-  // TODO(v8:7464): Just leak read-only space for now. The paged-space heap
-  // is null so there isn't a nice way to do this.
-  shared_ro_heap_ = nullptr;
-  setup_ro_heap_once = 0;
-#endif
+  std::shared_ptr<ReadOnlyArtifacts> artifacts =
+      read_only_artifacts_.Get().lock();
+  if (artifacts) {
+    auto ro_space = artifacts->shared_read_only_space();
+    statistics->read_only_space_size_ = ro_space->CommittedMemory();
+    statistics->read_only_space_used_size_ = ro_space->SizeOfObjects();
+    statistics->read_only_space_physical_size_ =
+        ro_space->CommittedPhysicalMemory();
+  }
+#endif  // V8_SHARED_RO_HEAP
 }
 
 // static
diff --git a/deps/v8/src/heap/read-only-heap.h b/deps/v8/src/heap/read-only-heap.h
index 27d34b4c034..ed105211296 100644
--- a/deps/v8/src/heap/read-only-heap.h
+++ b/deps/v8/src/heap/read-only-heap.h
@@ -5,6 +5,7 @@
 #ifndef V8_HEAP_READ_ONLY_HEAP_H_
 #define V8_HEAP_READ_ONLY_HEAP_H_
 
+#include <memory>
 #include <utility>
 
 #include "src/base/macros.h"
@@ -14,10 +15,14 @@
 #include "src/roots/roots.h"
 
 namespace v8 {
+
+class SharedMemoryStatistics;
+
 namespace internal {
 
 class Isolate;
 class Page;
+class ReadOnlyArtifacts;
 class ReadOnlyDeserializer;
 class ReadOnlySpace;
 
@@ -28,23 +33,27 @@ class ReadOnlyHeap final {
   static constexpr size_t kEntriesCount =
       static_cast<size_t>(RootIndex::kReadOnlyRootsCount);
 
-  // If necessary creates read-only heap and initializes its artifacts (if
-  // the deserializer is provided). Then attaches the read-only heap to the
-  // isolate.
+  // If necessary creates read-only heap and initializes its artifacts (if the
+  // deserializer is provided). Then attaches the read-only heap to the isolate.
+  // If the deserializer is not provided, then the read-only heap will be only
+  // finish initializing when initial heap object creation in the Isolate is
+  // completed, which is signalled by calling OnCreateHeapObjectsComplete. When
+  // V8_SHARED_RO_HEAP is enabled, a lock will be held until that method is
+  // called.
   // TODO(v8:7464): Ideally we'd create this without needing a heap.
   static void SetUp(Isolate* isolate, ReadOnlyDeserializer* des);
   // Indicates that the isolate has been set up and all read-only space objects
-  // have been created and will not be written to. This is not thread safe, and
-  // should really only be used during snapshot creation or when read-only heap
-  // sharing is disabled.
+  // have been created and will not be written to. This should only be called if
+  // a deserializer was not previously provided to Setup. When V8_SHARED_RO_HEAP
+  // is enabled, this releases the ReadOnlyHeap creation lock.
   void OnCreateHeapObjectsComplete(Isolate* isolate);
   // Indicates that the current isolate no longer requires the read-only heap
   // and it may be safely disposed of.
   void OnHeapTearDown();
-
-#ifdef V8_SHARED_RO_HEAP
-  static const ReadOnlyHeap* Instance();
-#endif
+  // If the read-only heap is shared, then populate |statistics| with its stats,
+  // otherwise the read-only heap stats are set to 0.
+  static void PopulateReadOnlySpaceStatistics(
+      SharedMemoryStatistics* statistics);
 
   // Returns whether the address is within the read-only space.
   V8_EXPORT_PRIVATE static bool Contains(Address address);
@@ -56,10 +65,6 @@ class ReadOnlyHeap final {
   V8_EXPORT_PRIVATE inline static ReadOnlyRoots GetReadOnlyRoots(
       HeapObject object);
 
-  // Clears any shared read-only heap artifacts for testing, forcing read-only
-  // heap to be re-created on next set up.
-  V8_EXPORT_PRIVATE static void ClearSharedHeapForTest();
-
   // Extends the read-only object cache with new zero smi and returns a
   // reference to it.
   Object* ExtendReadOnlyObjectCache();
@@ -71,14 +76,15 @@ class ReadOnlyHeap final {
 
  private:
   // Creates a new read-only heap and attaches it to the provided isolate.
-  static ReadOnlyHeap* CreateAndAttachToIsolate(Isolate* isolate);
-  // Runs the read-only deserailizer and calls InitFromIsolate to complete
+  static ReadOnlyHeap* CreateAndAttachToIsolate(
+      Isolate* isolate, std::shared_ptr<ReadOnlyArtifacts> artifacts);
+  // Runs the read-only deserializer and calls InitFromIsolate to complete
   // read-only heap initialization.
   void DeseralizeIntoIsolate(Isolate* isolate, ReadOnlyDeserializer* des);
   // Initializes read-only heap from an already set-up isolate, copying
   // read-only roots from the isolate. This then seals the space off from
-  // further writes, marks it as read-only and detaches it from the heap (unless
-  // sharing is disabled).
+  // further writes, marks it as read-only and detaches it from the heap
+  // (unless sharing is disabled).
   void InitFromIsolate(Isolate* isolate);
 
   bool init_complete_ = false;
diff --git a/deps/v8/src/heap/read-only-spaces.cc b/deps/v8/src/heap/read-only-spaces.cc
new file mode 100644
index 00000000000..8cbff3eadef
--- /dev/null
+++ b/deps/v8/src/heap/read-only-spaces.cc
@@ -0,0 +1,173 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/read-only-spaces.h"
+
+#include "src/base/lsan.h"
+#include "src/execution/isolate.h"
+#include "src/heap/combined-heap.h"
+#include "src/heap/heap-inl.h"
+#include "src/heap/memory-allocator.h"
+#include "src/heap/memory-chunk.h"
+#include "src/heap/read-only-heap.h"
+#include "src/objects/objects-inl.h"
+#include "src/objects/string.h"
+
+namespace v8 {
+namespace internal {
+
+// -----------------------------------------------------------------------------
+// ReadOnlySpace implementation
+
+ReadOnlySpace::ReadOnlySpace(Heap* heap)
+    : PagedSpace(heap, RO_SPACE, NOT_EXECUTABLE, FreeList::CreateFreeList()),
+      is_string_padding_cleared_(heap->isolate()->initialized_from_snapshot()) {
+}
+
+ReadOnlyArtifacts::~ReadOnlyArtifacts() {
+  v8::PageAllocator* page_allocator = GetPlatformPageAllocator();
+
+  MemoryChunk* next_chunk;
+  for (MemoryChunk* chunk = pages_.front(); chunk != nullptr;
+       chunk = next_chunk) {
+    void* chunk_address = reinterpret_cast<void*>(chunk->address());
+    page_allocator->SetPermissions(chunk_address, chunk->size(),
+                                   PageAllocator::kReadWrite);
+    next_chunk = chunk->list_node().next();
+    size_t size = RoundUp(chunk->size(), page_allocator->AllocatePageSize());
+    CHECK(page_allocator->FreePages(chunk_address, size));
+  }
+}
+
+void ReadOnlyArtifacts::set_read_only_heap(
+    std::unique_ptr<ReadOnlyHeap> read_only_heap) {
+  read_only_heap_ = std::move(read_only_heap);
+}
+
+SharedReadOnlySpace::~SharedReadOnlySpace() {
+  // Clear the memory chunk list before the space is deleted, so that the
+  // inherited destructors don't try to destroy the MemoryChunks themselves.
+  memory_chunk_list_ = heap::List<MemoryChunk>();
+}
+
+SharedReadOnlySpace::SharedReadOnlySpace(
+    Heap* heap, std::shared_ptr<ReadOnlyArtifacts> artifacts)
+    : ReadOnlySpace(heap) {
+  artifacts->pages().ShallowCopyTo(&memory_chunk_list_);
+  is_marked_read_only_ = true;
+  accounting_stats_ = artifacts->accounting_stats();
+}
+
+void ReadOnlySpace::DetachPagesAndAddToArtifacts(
+    std::shared_ptr<ReadOnlyArtifacts> artifacts) {
+  Heap* heap = ReadOnlySpace::heap();
+  Seal(SealMode::kDetachFromHeapAndForget);
+  artifacts->set_accounting_stats(accounting_stats_);
+  artifacts->TransferPages(std::move(memory_chunk_list_));
+  artifacts->set_shared_read_only_space(
+      std::make_unique<SharedReadOnlySpace>(heap, artifacts));
+  heap->ReplaceReadOnlySpace(artifacts->shared_read_only_space());
+}
+
+void ReadOnlyPage::MakeHeaderRelocatable() {
+  ReleaseAllocatedMemoryNeededForWritableChunk();
+  // Detached read-only space needs to have a valid marking bitmap. Instruct
+  // Lsan to ignore it if required.
+  LSAN_IGNORE_OBJECT(marking_bitmap_);
+  heap_ = nullptr;
+  owner_ = nullptr;
+}
+
+void ReadOnlySpace::SetPermissionsForPages(MemoryAllocator* memory_allocator,
+                                           PageAllocator::Permission access) {
+  for (Page* p : *this) {
+    // Read only pages don't have valid reservation object so we get proper
+    // page allocator manually.
+    v8::PageAllocator* page_allocator =
+        memory_allocator->page_allocator(p->executable());
+    CHECK(SetPermissions(page_allocator, p->address(), p->size(), access));
+  }
+}
+
+// After we have booted, we have created a map which represents free space
+// on the heap.  If there was already a free list then the elements on it
+// were created with the wrong FreeSpaceMap (normally nullptr), so we need to
+// fix them.
+void ReadOnlySpace::RepairFreeListsAfterDeserialization() {
+  free_list_->RepairLists(heap());
+  // Each page may have a small free space that is not tracked by a free list.
+  // Those free spaces still contain null as their map pointer.
+  // Overwrite them with new fillers.
+  for (Page* page : *this) {
+    int size = static_cast<int>(page->wasted_memory());
+    if (size == 0) {
+      // If there is no wasted memory then all free space is in the free list.
+      continue;
+    }
+    Address start = page->HighWaterMark();
+    Address end = page->area_end();
+    if (start < end - size) {
+      // A region at the high watermark is already in free list.
+      HeapObject filler = HeapObject::FromAddress(start);
+      CHECK(filler.IsFreeSpaceOrFiller());
+      start += filler.Size();
+    }
+    CHECK_EQ(size, static_cast<int>(end - start));
+    heap()->CreateFillerObjectAt(start, size, ClearRecordedSlots::kNo);
+  }
+}
+
+void ReadOnlySpace::ClearStringPaddingIfNeeded() {
+  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
+    // TODO(ulan): Revisit this once third-party heap supports iteration.
+    return;
+  }
+  if (is_string_padding_cleared_) return;
+
+  ReadOnlyHeapObjectIterator iterator(this);
+  for (HeapObject o = iterator.Next(); !o.is_null(); o = iterator.Next()) {
+    if (o.IsSeqOneByteString()) {
+      SeqOneByteString::cast(o).clear_padding();
+    } else if (o.IsSeqTwoByteString()) {
+      SeqTwoByteString::cast(o).clear_padding();
+    }
+  }
+  is_string_padding_cleared_ = true;
+}
+
+void ReadOnlySpace::Seal(SealMode ro_mode) {
+  DCHECK(!is_marked_read_only_);
+
+  FreeLinearAllocationArea();
+  is_marked_read_only_ = true;
+  auto* memory_allocator = heap()->memory_allocator();
+
+  if (ro_mode == SealMode::kDetachFromHeapAndForget) {
+    DetachFromHeap();
+    for (Page* p : *this) {
+      memory_allocator->UnregisterMemory(p);
+      static_cast<ReadOnlyPage*>(p)->MakeHeaderRelocatable();
+    }
+  } else {
+    for (Page* p : *this) {
+      p->ReleaseAllocatedMemoryNeededForWritableChunk();
+    }
+  }
+
+  free_list_.reset();
+
+  SetPermissionsForPages(memory_allocator, PageAllocator::kRead);
+}
+
+void ReadOnlySpace::Unseal() {
+  DCHECK(is_marked_read_only_);
+  if (HasPages()) {
+    SetPermissionsForPages(heap()->memory_allocator(),
+                           PageAllocator::kReadWrite);
+  }
+  is_marked_read_only_ = false;
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/heap/read-only-spaces.h b/deps/v8/src/heap/read-only-spaces.h
new file mode 100644
index 00000000000..17dad23bffd
--- /dev/null
+++ b/deps/v8/src/heap/read-only-spaces.h
@@ -0,0 +1,127 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_READ_ONLY_SPACES_H_
+#define V8_HEAP_READ_ONLY_SPACES_H_
+
+#include <memory>
+#include <utility>
+
+#include "include/v8-platform.h"
+#include "src/base/macros.h"
+#include "src/heap/list.h"
+#include "src/heap/memory-chunk.h"
+#include "src/heap/paged-spaces.h"
+#include "src/heap/spaces.h"
+
+namespace v8 {
+namespace internal {
+
+class MemoryAllocator;
+class ReadOnlyHeap;
+
+class ReadOnlyPage : public Page {
+ public:
+  // Clears any pointers in the header that point out of the page that would
+  // otherwise make the header non-relocatable.
+  void MakeHeaderRelocatable();
+
+ private:
+  friend class ReadOnlySpace;
+};
+
+// -----------------------------------------------------------------------------
+// Artifacts used to construct a new SharedReadOnlySpace
+class ReadOnlyArtifacts {
+ public:
+  ~ReadOnlyArtifacts();
+
+  void set_accounting_stats(const AllocationStats& stats) { stats_ = stats; }
+
+  void set_shared_read_only_space(
+      std::unique_ptr<SharedReadOnlySpace> shared_space) {
+    shared_read_only_space_ = std::move(shared_space);
+  }
+  SharedReadOnlySpace* shared_read_only_space() {
+    return shared_read_only_space_.get();
+  }
+
+  heap::List<MemoryChunk>& pages() { return pages_; }
+  void TransferPages(heap::List<MemoryChunk>&& pages) {
+    pages_ = std::move(pages);
+  }
+
+  const AllocationStats& accounting_stats() const { return stats_; }
+
+  void set_read_only_heap(std::unique_ptr<ReadOnlyHeap> read_only_heap);
+  ReadOnlyHeap* read_only_heap() { return read_only_heap_.get(); }
+
+ private:
+  heap::List<MemoryChunk> pages_;
+  AllocationStats stats_;
+  std::unique_ptr<SharedReadOnlySpace> shared_read_only_space_;
+  std::unique_ptr<ReadOnlyHeap> read_only_heap_;
+};
+
+// -----------------------------------------------------------------------------
+// Read Only space for all Immortal Immovable and Immutable objects
+class ReadOnlySpace : public PagedSpace {
+ public:
+  explicit ReadOnlySpace(Heap* heap);
+
+  // Detach the pages and them to artifacts for using in creating a
+  // SharedReadOnlySpace.
+  void DetachPagesAndAddToArtifacts(
+      std::shared_ptr<ReadOnlyArtifacts> artifacts);
+
+  ~ReadOnlySpace() override { Unseal(); }
+
+  bool writable() const { return !is_marked_read_only_; }
+
+  bool Contains(Address a) = delete;
+  bool Contains(Object o) = delete;
+
+  V8_EXPORT_PRIVATE void ClearStringPaddingIfNeeded();
+
+  enum class SealMode { kDetachFromHeapAndForget, kDoNotDetachFromHeap };
+
+  // Seal the space by marking it read-only, optionally detaching it
+  // from the heap and forgetting it for memory bookkeeping purposes (e.g.
+  // prevent space's memory from registering as leaked).
+  void Seal(SealMode ro_mode);
+
+  // During boot the free_space_map is created, and afterwards we may need
+  // to write it into the free list nodes that were already created.
+  void RepairFreeListsAfterDeserialization();
+
+  size_t Available() override { return 0; }
+
+ protected:
+  void SetPermissionsForPages(MemoryAllocator* memory_allocator,
+                              PageAllocator::Permission access);
+
+  bool is_marked_read_only_ = false;
+
+ private:
+  // Unseal the space after is has been sealed, by making it writable.
+  // TODO(v8:7464): Only possible if the space hasn't been detached.
+  void Unseal();
+
+  //
+  // String padding must be cleared just before serialization and therefore the
+  // string padding in the space will already have been cleared if the space was
+  // deserialized.
+  bool is_string_padding_cleared_;
+};
+
+class SharedReadOnlySpace : public ReadOnlySpace {
+ public:
+  SharedReadOnlySpace(Heap* heap, std::shared_ptr<ReadOnlyArtifacts> artifacts);
+  ~SharedReadOnlySpace() override;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_READ_ONLY_SPACES_H_
diff --git a/deps/v8/src/heap/remembered-set.h b/deps/v8/src/heap/remembered-set-inl.h
similarity index 87%
rename from deps/v8/src/heap/remembered-set.h
rename to deps/v8/src/heap/remembered-set-inl.h
index b5e92d6ec61..034e98a06fb 100644
--- a/deps/v8/src/heap/remembered-set.h
+++ b/deps/v8/src/heap/remembered-set-inl.h
@@ -2,14 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_HEAP_REMEMBERED_SET_H_
-#define V8_HEAP_REMEMBERED_SET_H_
+#ifndef V8_HEAP_REMEMBERED_SET_INL_H_
+#define V8_HEAP_REMEMBERED_SET_INL_H_
 
 #include <memory>
 
+#include "src/base/bounds.h"
 #include "src/base/memory.h"
 #include "src/codegen/reloc-info.h"
+#include "src/common/globals.h"
+#include "src/common/ptr-compr-inl.h"
 #include "src/heap/heap.h"
+#include "src/heap/memory-chunk.h"
 #include "src/heap/slot-set.h"
 #include "src/heap/spaces.h"
 #include "src/heap/worklist.h"
@@ -35,8 +39,8 @@ class RememberedSetOperations {
                      SlotSet::EmptyBucketMode mode) {
     int slots = 0;
     if (slot_set != nullptr) {
-      slots +=
-          slot_set->Iterate(chunk->address(), chunk->buckets(), callback, mode);
+      slots += slot_set->Iterate(chunk->address(), 0, chunk->buckets(),
+                                 callback, mode);
     }
     return slots;
   }
@@ -59,6 +63,25 @@ class RememberedSetOperations {
                             mode);
     }
   }
+
+  static void CheckNoneInRange(SlotSet* slot_set, MemoryChunk* chunk,
+                               Address start, Address end) {
+    if (slot_set != nullptr) {
+      size_t start_bucket = SlotSet::BucketForSlot(start - chunk->address());
+      // Both 'end' and 'end_bucket' are exclusive limits, so do some index
+      // juggling to make sure we get the right bucket even if the end address
+      // is at the start of a bucket.
+      size_t end_bucket =
+          SlotSet::BucketForSlot(end - chunk->address() - kTaggedSize) + 1;
+      slot_set->Iterate(
+          chunk->address(), start_bucket, end_bucket,
+          [start, end](MaybeObjectSlot slot) {
+            CHECK(!base::IsInRange(slot.address(), start, end + 1));
+            return KEEP_SLOT;
+          },
+          SlotSet::KEEP_EMPTY_BUCKETS);
+    }
+  }
 };
 
 // TODO(ulan): Investigate performance of de-templatizing this class.
@@ -89,6 +112,11 @@ class RememberedSet : public AllStatic {
     return slot_set->Contains(offset);
   }
 
+  static void CheckNoneInRange(MemoryChunk* chunk, Address start, Address end) {
+    SlotSet* slot_set = chunk->slot_set<type>();
+    RememberedSetOperations::CheckNoneInRange(slot_set, chunk, start, end);
+  }
+
   // Given a page and a slot in that page, this function removes the slot from
   // the remembered set.
   // If the slot was never added, then the function does nothing.
@@ -159,8 +187,9 @@ class RememberedSet : public AllStatic {
     if (slot_set != nullptr) {
       PossiblyEmptyBuckets* possibly_empty_buckets =
           chunk->possibly_empty_buckets();
-      slots += slot_set->IterateAndTrackEmptyBuckets(
-          chunk->address(), chunk->buckets(), callback, possibly_empty_buckets);
+      slots += slot_set->IterateAndTrackEmptyBuckets(chunk->address(), 0,
+                                                     chunk->buckets(), callback,
+                                                     possibly_empty_buckets);
       if (!possibly_empty_buckets->IsEmpty()) empty_chunks.Push(chunk);
     }
     return slots;
@@ -286,7 +315,18 @@ class UpdateTypedSlotHelper {
         RelocInfo rinfo(addr, RelocInfo::FULL_EMBEDDED_OBJECT, 0, Code());
         return UpdateEmbeddedPointer(heap, &rinfo, callback);
       }
-      case OBJECT_SLOT: {
+      case COMPRESSED_OBJECT_SLOT: {
+        HeapObject old_target = HeapObject::cast(Object(DecompressTaggedAny(
+            heap->isolate(), base::Memory<Tagged_t>(addr))));
+        HeapObject new_target = old_target;
+        SlotCallbackResult result = callback(FullMaybeObjectSlot(&new_target));
+        DCHECK(!HasWeakHeapObjectTag(new_target));
+        if (new_target != old_target) {
+          base::Memory<Tagged_t>(addr) = CompressTagged(new_target.ptr());
+        }
+        return result;
+      }
+      case FULL_OBJECT_SLOT: {
         return callback(FullMaybeObjectSlot(addr));
       }
       case CLEARED_SLOT:
@@ -398,4 +438,4 @@ inline SlotType SlotTypeForRelocInfoMode(RelocInfo::Mode rmode) {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_HEAP_REMEMBERED_SET_H_
+#endif  // V8_HEAP_REMEMBERED_SET_INL_H_
diff --git a/deps/v8/src/heap/safepoint.cc b/deps/v8/src/heap/safepoint.cc
index f524b30e742..e6ccf642c09 100644
--- a/deps/v8/src/heap/safepoint.cc
+++ b/deps/v8/src/heap/safepoint.cc
@@ -5,19 +5,21 @@
 #include "src/heap/safepoint.h"
 
 #include "src/handles/local-handles.h"
+#include "src/handles/persistent-handles.h"
 #include "src/heap/heap.h"
 #include "src/heap/local-heap.h"
 
 namespace v8 {
 namespace internal {
 
-Safepoint::Safepoint(Heap* heap) : heap_(heap), local_heaps_head_(nullptr) {}
+GlobalSafepoint::GlobalSafepoint(Heap* heap)
+    : heap_(heap), local_heaps_head_(nullptr), is_active_(false) {}
 
-void Safepoint::Start() { StopThreads(); }
+void GlobalSafepoint::Start() { StopThreads(); }
 
-void Safepoint::End() { ResumeThreads(); }
+void GlobalSafepoint::End() { ResumeThreads(); }
 
-void Safepoint::StopThreads() {
+void GlobalSafepoint::StopThreads() {
   local_heaps_mutex_.Lock();
 
   barrier_.Arm();
@@ -35,9 +37,13 @@ void Safepoint::StopThreads() {
       current->state_change_.Wait(&current->state_mutex_);
     }
   }
+
+  is_active_ = true;
 }
 
-void Safepoint::ResumeThreads() {
+void GlobalSafepoint::ResumeThreads() {
+  is_active_ = false;
+
   for (LocalHeap* current = local_heaps_head_; current;
        current = current->next_) {
     current->state_mutex_.Unlock();
@@ -48,7 +54,7 @@ void Safepoint::ResumeThreads() {
   local_heaps_mutex_.Unlock();
 }
 
-void Safepoint::EnterFromThread(LocalHeap* local_heap) {
+void GlobalSafepoint::EnterFromThread(LocalHeap* local_heap) {
   {
     base::MutexGuard guard(&local_heap->state_mutex_);
     local_heap->state_ = LocalHeap::ThreadState::Safepoint;
@@ -63,20 +69,20 @@ void Safepoint::EnterFromThread(LocalHeap* local_heap) {
   }
 }
 
-void Safepoint::Barrier::Arm() {
+void GlobalSafepoint::Barrier::Arm() {
   base::MutexGuard guard(&mutex_);
   CHECK(!armed_);
   armed_ = true;
 }
 
-void Safepoint::Barrier::Disarm() {
+void GlobalSafepoint::Barrier::Disarm() {
   base::MutexGuard guard(&mutex_);
   CHECK(armed_);
   armed_ = false;
   cond_.NotifyAll();
 }
 
-void Safepoint::Barrier::Wait() {
+void GlobalSafepoint::Barrier::Wait() {
   base::MutexGuard guard(&mutex_);
   while (armed_) {
     cond_.Wait(&mutex_);
@@ -84,12 +90,14 @@ void Safepoint::Barrier::Wait() {
 }
 
 SafepointScope::SafepointScope(Heap* heap) : safepoint_(heap->safepoint()) {
-  safepoint_->StopThreads();
+  if (FLAG_local_heaps) safepoint_->StopThreads();
 }
 
-SafepointScope::~SafepointScope() { safepoint_->ResumeThreads(); }
+SafepointScope::~SafepointScope() {
+  if (FLAG_local_heaps) safepoint_->ResumeThreads();
+}
 
-void Safepoint::AddLocalHeap(LocalHeap* local_heap) {
+void GlobalSafepoint::AddLocalHeap(LocalHeap* local_heap) {
   base::MutexGuard guard(&local_heaps_mutex_);
   if (local_heaps_head_) local_heaps_head_->prev_ = local_heap;
   local_heap->prev_ = nullptr;
@@ -97,7 +105,7 @@ void Safepoint::AddLocalHeap(LocalHeap* local_heap) {
   local_heaps_head_ = local_heap;
 }
 
-void Safepoint::RemoveLocalHeap(LocalHeap* local_heap) {
+void GlobalSafepoint::RemoveLocalHeap(LocalHeap* local_heap) {
   base::MutexGuard guard(&local_heaps_mutex_);
   if (local_heap->next_) local_heap->next_->prev_ = local_heap->prev_;
   if (local_heap->prev_)
@@ -106,7 +114,7 @@ void Safepoint::RemoveLocalHeap(LocalHeap* local_heap) {
     local_heaps_head_ = local_heap->next_;
 }
 
-bool Safepoint::ContainsLocalHeap(LocalHeap* local_heap) {
+bool GlobalSafepoint::ContainsLocalHeap(LocalHeap* local_heap) {
   base::MutexGuard guard(&local_heaps_mutex_);
   LocalHeap* current = local_heaps_head_;
 
@@ -118,12 +126,13 @@ bool Safepoint::ContainsLocalHeap(LocalHeap* local_heap) {
   return false;
 }
 
-bool Safepoint::ContainsAnyLocalHeap() {
+bool GlobalSafepoint::ContainsAnyLocalHeap() {
   base::MutexGuard guard(&local_heaps_mutex_);
   return local_heaps_head_ != nullptr;
 }
 
-void Safepoint::Iterate(RootVisitor* visitor) {
+void GlobalSafepoint::Iterate(RootVisitor* visitor) {
+  DCHECK(IsActive());
   for (LocalHeap* current = local_heaps_head_; current;
        current = current->next_) {
     current->handles()->Iterate(visitor);
diff --git a/deps/v8/src/heap/safepoint.h b/deps/v8/src/heap/safepoint.h
index 4b0036c047d..3ba96e11d59 100644
--- a/deps/v8/src/heap/safepoint.h
+++ b/deps/v8/src/heap/safepoint.h
@@ -7,6 +7,9 @@
 
 #include "src/base/platform/condition-variable.h"
 #include "src/base/platform/mutex.h"
+#include "src/handles/persistent-handles.h"
+#include "src/heap/local-heap.h"
+#include "src/objects/visitors.h"
 
 namespace v8 {
 namespace internal {
@@ -15,9 +18,11 @@ class Heap;
 class LocalHeap;
 class RootVisitor;
 
-class Safepoint {
+// Used to bring all background threads with heap access to a safepoint such
+// that e.g. a garbage collection can be performed.
+class GlobalSafepoint {
  public:
-  explicit Safepoint(Heap* heap);
+  explicit GlobalSafepoint(Heap* heap);
 
   // Enter the safepoint from a thread
   void EnterFromThread(LocalHeap* local_heap);
@@ -28,10 +33,22 @@ class Safepoint {
   // Iterate handles in local heaps
   void Iterate(RootVisitor* visitor);
 
+  // Iterate local heaps
+  template <typename Callback>
+  void IterateLocalHeaps(Callback callback) {
+    DCHECK(IsActive());
+    for (LocalHeap* current = local_heaps_head_; current;
+         current = current->next_) {
+      callback(current);
+    }
+  }
+
   // Use these methods now instead of the more intrusive SafepointScope
   void Start();
   void End();
 
+  bool IsActive() { return is_active_; }
+
  private:
   class Barrier {
     base::Mutex mutex_;
@@ -58,8 +75,11 @@ class Safepoint {
   base::Mutex local_heaps_mutex_;
   LocalHeap* local_heaps_head_;
 
+  bool is_active_;
+
   friend class SafepointScope;
   friend class LocalHeap;
+  friend class PersistentHandles;
 };
 
 class SafepointScope {
@@ -68,7 +88,7 @@ class SafepointScope {
   V8_EXPORT_PRIVATE ~SafepointScope();
 
  private:
-  Safepoint* safepoint_;
+  GlobalSafepoint* safepoint_;
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/scavenge-job.cc b/deps/v8/src/heap/scavenge-job.cc
index a731e37be06..89451be076e 100644
--- a/deps/v8/src/heap/scavenge-job.cc
+++ b/deps/v8/src/heap/scavenge-job.cc
@@ -30,8 +30,7 @@ class ScavengeJob::Task : public CancelableTask {
 };
 
 size_t ScavengeJob::YoungGenerationTaskTriggerSize(Heap* heap) {
-  static constexpr double kTaskTriggerFactor = 0.8;
-  return heap->new_space()->Capacity() * kTaskTriggerFactor;
+  return heap->new_space()->Capacity() * FLAG_scavenge_task_trigger / 100;
 }
 
 bool ScavengeJob::YoungGenerationSizeTaskTriggerReached(Heap* heap) {
@@ -39,7 +38,7 @@ bool ScavengeJob::YoungGenerationSizeTaskTriggerReached(Heap* heap) {
 }
 
 void ScavengeJob::ScheduleTaskIfNeeded(Heap* heap) {
-  if (!task_pending_ && !heap->IsTearingDown() &&
+  if (FLAG_scavenge_task && !task_pending_ && !heap->IsTearingDown() &&
       YoungGenerationSizeTaskTriggerReached(heap)) {
     v8::Isolate* isolate = reinterpret_cast<v8::Isolate*>(heap->isolate());
     auto taskrunner =
diff --git a/deps/v8/src/heap/scavenger-inl.h b/deps/v8/src/heap/scavenger-inl.h
index de80d2a2905..3b3cc77b312 100644
--- a/deps/v8/src/heap/scavenger-inl.h
+++ b/deps/v8/src/heap/scavenger-inl.h
@@ -5,10 +5,10 @@
 #ifndef V8_HEAP_SCAVENGER_INL_H_
 #define V8_HEAP_SCAVENGER_INL_H_
 
-#include "src/heap/scavenger.h"
-
 #include "src/heap/incremental-marking-inl.h"
 #include "src/heap/local-allocator-inl.h"
+#include "src/heap/memory-chunk.h"
+#include "src/heap/scavenger.h"
 #include "src/objects/map.h"
 #include "src/objects/objects-inl.h"
 #include "src/objects/slots-inl.h"
diff --git a/deps/v8/src/heap/scavenger.cc b/deps/v8/src/heap/scavenger.cc
index 08f32e037c5..d0d0a30fb13 100644
--- a/deps/v8/src/heap/scavenger.cc
+++ b/deps/v8/src/heap/scavenger.cc
@@ -12,6 +12,7 @@
 #include "src/heap/invalidated-slots-inl.h"
 #include "src/heap/item-parallel-job.h"
 #include "src/heap/mark-compact-inl.h"
+#include "src/heap/memory-chunk-inl.h"
 #include "src/heap/objects-visiting-inl.h"
 #include "src/heap/scavenger-inl.h"
 #include "src/heap/sweeper.h"
@@ -295,7 +296,18 @@ void ScavengerCollector::CollectGarbage() {
     {
       // Copy roots.
       TRACE_GC(heap_->tracer(), GCTracer::Scope::SCAVENGER_SCAVENGE_ROOTS);
-      heap_->IterateRoots(&root_scavenge_visitor, VISIT_ALL_IN_SCAVENGE);
+      // Scavenger treats all weak roots except for global handles as strong.
+      // That is why we don't set skip_weak = true here and instead visit
+      // global handles separately.
+      base::EnumSet<SkipRoot> options({SkipRoot::kExternalStringTable,
+                                       SkipRoot::kGlobalHandles,
+                                       SkipRoot::kOldGeneration});
+      if (V8_UNLIKELY(FLAG_scavenge_separate_stack_scanning)) {
+        options.Add(SkipRoot::kStack);
+      }
+      heap_->IterateRoots(&root_scavenge_visitor, options);
+      isolate_->global_handles()->IterateYoungStrongAndDependentRoots(
+          &root_scavenge_visitor);
     }
     {
       // Parallel phase scavenging all copied and promoted objects.
@@ -304,6 +316,14 @@ void ScavengerCollector::CollectGarbage() {
       DCHECK(copied_list.IsEmpty());
       DCHECK(promotion_list.IsEmpty());
     }
+
+    if (V8_UNLIKELY(FLAG_scavenge_separate_stack_scanning)) {
+      IterateStackAndScavenge(&root_scavenge_visitor, scavengers,
+                              num_scavenge_tasks, kMainThreadId);
+      DCHECK(copied_list.IsEmpty());
+      DCHECK(promotion_list.IsEmpty());
+    }
+
     {
       // Scavenge weak global handles.
       TRACE_GC(heap_->tracer(),
@@ -395,6 +415,39 @@ void ScavengerCollector::CollectGarbage() {
   heap_->IncrementYoungSurvivorsCounter(heap_->SurvivedYoungObjectSize());
 }
 
+void ScavengerCollector::IterateStackAndScavenge(
+    RootScavengeVisitor* root_scavenge_visitor, Scavenger** scavengers,
+    int num_scavenge_tasks, int main_thread_id) {
+  // Scan the stack, scavenge the newly discovered objects, and report
+  // the survival statistics before and afer the stack scanning.
+  // This code is not intended for production.
+  TRACE_GC(heap_->tracer(), GCTracer::Scope::SCAVENGER_SCAVENGE_STACK_ROOTS);
+  size_t survived_bytes_before = 0;
+  for (int i = 0; i < num_scavenge_tasks; i++) {
+    survived_bytes_before +=
+        scavengers[i]->bytes_copied() + scavengers[i]->bytes_promoted();
+  }
+  heap_->IterateStackRoots(root_scavenge_visitor);
+  scavengers[main_thread_id]->Process();
+  size_t survived_bytes_after = 0;
+  for (int i = 0; i < num_scavenge_tasks; i++) {
+    survived_bytes_after +=
+        scavengers[i]->bytes_copied() + scavengers[i]->bytes_promoted();
+  }
+  TRACE_EVENT2(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+               "V8.GCScavengerStackScanning", "survived_bytes_before",
+               survived_bytes_before, "survived_bytes_after",
+               survived_bytes_after);
+  if (FLAG_trace_gc_verbose && !FLAG_trace_gc_ignore_scavenger) {
+    isolate_->PrintWithTimestamp(
+        "Scavenge stack scanning: survived_before=%4zuKB, "
+        "survived_after=%4zuKB delta=%.1f%%\n",
+        survived_bytes_before / KB, survived_bytes_after / KB,
+        (survived_bytes_after - survived_bytes_before) * 100.0 /
+            survived_bytes_after);
+  }
+}
+
 void ScavengerCollector::SweepArrayBufferExtensions() {
   heap_->array_buffer_sweeper()->RequestSweepYoung();
 }
diff --git a/deps/v8/src/heap/scavenger.h b/deps/v8/src/heap/scavenger.h
index 189bd490ce3..d96219fd513 100644
--- a/deps/v8/src/heap/scavenger.h
+++ b/deps/v8/src/heap/scavenger.h
@@ -15,6 +15,8 @@ namespace v8 {
 namespace internal {
 
 class OneshotBarrier;
+class RootScavengeVisitor;
+class Scavenger;
 
 enum class CopyAndForwardResult {
   SUCCESS_YOUNG_GENERATION,
@@ -53,6 +55,9 @@ class ScavengerCollector {
 
   void SweepArrayBufferExtensions();
 
+  void IterateStackAndScavenge(RootScavengeVisitor* root_scavenge_visitor,
+                               Scavenger** scavengers, int num_scavenge_tasks,
+                               int main_thread_id);
   Isolate* const isolate_;
   Heap* const heap_;
   base::Semaphore parallel_scavenge_semaphore_;
@@ -216,7 +221,7 @@ class Scavenger {
   Heap::PretenuringFeedbackMap local_pretenuring_feedback_;
   size_t copied_size_;
   size_t promoted_size_;
-  LocalAllocator allocator_;
+  EvacuationAllocator allocator_;
   SurvivingNewLargeObjectsMap surviving_new_large_objects_;
 
   EphemeronRememberedSet ephemeron_remembered_set_;
diff --git a/deps/v8/src/heap/setup-heap-internal.cc b/deps/v8/src/heap/setup-heap-internal.cc
index 8c9d8cd4568..d188b6575d3 100644
--- a/deps/v8/src/heap/setup-heap-internal.cc
+++ b/deps/v8/src/heap/setup-heap-internal.cc
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/init/setup-isolate.h"
-
 #include "src/builtins/accessors.h"
 #include "src/codegen/compilation-cache.h"
 #include "src/execution/isolate.h"
@@ -12,6 +10,7 @@
 #include "src/heap/heap-inl.h"
 #include "src/ic/handler-configuration.h"
 #include "src/init/heap-symbols.h"
+#include "src/init/setup-isolate.h"
 #include "src/interpreter/interpreter.h"
 #include "src/objects/arguments.h"
 #include "src/objects/cell-inl.h"
@@ -46,11 +45,27 @@
 #include "src/regexp/regexp.h"
 #include "src/wasm/wasm-objects.h"
 #include "torque-generated/class-definitions-tq.h"
+#include "torque-generated/exported-class-definitions-tq-inl.h"
 #include "torque-generated/internal-class-definitions-tq-inl.h"
 
 namespace v8 {
 namespace internal {
 
+namespace {
+
+Handle<SharedFunctionInfo> CreateSharedFunctionInfo(
+    Isolate* isolate, Builtins::Name builtin_id, int len,
+    FunctionKind kind = FunctionKind::kNormalFunction) {
+  Handle<SharedFunctionInfo> shared =
+      isolate->factory()->NewSharedFunctionInfoForBuiltin(
+          isolate->factory()->empty_string(), builtin_id, kind);
+  shared->set_internal_formal_parameter_count(len);
+  shared->set_length(len);
+  return shared;
+}
+
+}  // namespace
+
 bool SetupIsolateDelegate::SetupHeapInternal(Heap* heap) {
   return heap->CreateHeapObjects();
 }
@@ -348,7 +363,7 @@ bool Heap::CreateInitialMaps() {
   }
 
 #define ALLOCATE_VARSIZE_MAP(instance_type, field_name) \
-    ALLOCATE_MAP(instance_type, kVariableSizeSentinel, field_name)
+  ALLOCATE_MAP(instance_type, kVariableSizeSentinel, field_name)
 
 #define ALLOCATE_PRIMITIVE_MAP(instance_type, size, field_name, \
                                constructor_function_index)      \
@@ -378,6 +393,7 @@ bool Heap::CreateInitialMaps() {
     ALLOCATE_MAP(ODDBALL_TYPE, Oddball::kSize, optimized_out);
     ALLOCATE_MAP(ODDBALL_TYPE, Oddball::kSize, stale_register);
     ALLOCATE_MAP(ODDBALL_TYPE, Oddball::kSize, self_reference_marker);
+    ALLOCATE_MAP(ODDBALL_TYPE, Oddball::kSize, basic_block_counters_marker);
     ALLOCATE_VARSIZE_MAP(BIGINT_TYPE, bigint);
 
     for (unsigned i = 0; i < arraysize(string_type_table); i++) {
@@ -403,19 +419,15 @@ bool Heap::CreateInitialMaps() {
     ALLOCATE_VARSIZE_MAP(SMALL_ORDERED_NAME_DICTIONARY_TYPE,
                          small_ordered_name_dictionary)
 
-#define TORQUE_INTERNAL_CLASS_LIST_MAP_ALLOCATOR(V, NAME, Name, name) \
+#define TORQUE_ALLOCATE_MAP(NAME, Name, name) \
   ALLOCATE_MAP(NAME, Name::kSize, name)
-    TORQUE_INTERNAL_FIXED_CLASS_LIST_GENERATOR(
-        TORQUE_INTERNAL_CLASS_LIST_MAP_ALLOCATOR, _);
-#undef TORQUE_INTERNAL_CLASS_LIST_MAP_ALLOCATOR
+    TORQUE_INTERNAL_FIXED_INSTANCE_TYPE_LIST(TORQUE_ALLOCATE_MAP);
+#undef TORQUE_ALLOCATE_MAP
 
-#define TORQUE_INTERNAL_CLASS_LIST_MAP_ALLOCATOR(V, NAME, Name, name) \
+#define TORQUE_ALLOCATE_VARSIZE_MAP(NAME, Name, name) \
   ALLOCATE_VARSIZE_MAP(NAME, name)
-    TORQUE_INTERNAL_VARSIZE_CLASS_LIST_GENERATOR(
-        TORQUE_INTERNAL_CLASS_LIST_MAP_ALLOCATOR, _);
-#undef TORQUE_INTERNAL_CLASS_LIST_MAP_ALLOCATOR
-
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, sloppy_arguments_elements)
+    TORQUE_INTERNAL_VARSIZE_INSTANCE_TYPE_LIST(TORQUE_ALLOCATE_VARSIZE_MAP);
+#undef TORQUE_ALLOCATE_VARSIZE_MAP
 
     ALLOCATE_VARSIZE_MAP(CODE_TYPE, code)
 
@@ -436,14 +448,14 @@ bool Heap::CreateInitialMaps() {
 
     // The "no closures" and "one closure" FeedbackCell maps need
     // to be marked unstable because their objects can change maps.
-    ALLOCATE_MAP(
-      FEEDBACK_CELL_TYPE, FeedbackCell::kAlignedSize, no_closures_cell)
+    ALLOCATE_MAP(FEEDBACK_CELL_TYPE, FeedbackCell::kAlignedSize,
+                 no_closures_cell)
     roots.no_closures_cell_map().mark_unstable();
-    ALLOCATE_MAP(
-      FEEDBACK_CELL_TYPE, FeedbackCell::kAlignedSize, one_closure_cell)
+    ALLOCATE_MAP(FEEDBACK_CELL_TYPE, FeedbackCell::kAlignedSize,
+                 one_closure_cell)
     roots.one_closure_cell_map().mark_unstable();
-    ALLOCATE_MAP(
-      FEEDBACK_CELL_TYPE, FeedbackCell::kAlignedSize, many_closures_cell)
+    ALLOCATE_MAP(FEEDBACK_CELL_TYPE, FeedbackCell::kAlignedSize,
+                 many_closures_cell)
 
     ALLOCATE_VARSIZE_MAP(TRANSITION_ARRAY_TYPE, transition_array)
 
@@ -704,8 +716,9 @@ void Heap::CreateInitialObjects() {
                            handle(Smi::FromInt(-7), isolate()), "undefined",
                            Oddball::kStaleRegister));
 
-  // Initialize the self-reference marker.
+  // Initialize marker objects used during compilation.
   set_self_reference_marker(*factory->NewSelfReferenceMarker());
+  set_basic_block_counters_marker(*factory->NewBasicBlockCountersMarker());
 
   set_interpreter_entry_trampoline_for_profiling(roots.undefined_value());
 
@@ -756,6 +769,8 @@ void Heap::CreateInitialObjects() {
   set_number_string_cache(*factory->NewFixedArray(
       kInitialNumberStringCacheSize * 2, AllocationType::kOld));
 
+  set_basic_block_profiling_data(ArrayList::cast(roots.empty_fixed_array()));
+
   // Allocate cache for string split and regexp-multiple.
   set_string_split_cache(*factory->NewFixedArray(
       RegExpResultsCache::kRegExpResultsCacheSize, AllocationType::kOld));
@@ -767,16 +782,7 @@ void Heap::CreateInitialObjects() {
       factory->NewManyClosuresCell(factory->undefined_value());
   set_many_closures_cell(*many_closures_cell);
 
-  {
-    Handle<FixedArray> empty_sloppy_arguments_elements =
-        factory->NewFixedArray(2, AllocationType::kReadOnly);
-    empty_sloppy_arguments_elements->set_map_after_allocation(
-        roots.sloppy_arguments_elements_map(), SKIP_WRITE_BARRIER);
-    set_empty_sloppy_arguments_elements(*empty_sloppy_arguments_elements);
-  }
-
   set_detached_contexts(roots.empty_weak_array_list());
-  set_retained_maps(roots.empty_weak_array_list());
   set_retaining_path_targets(roots.empty_weak_array_list());
 
   set_feedback_vectors_for_profiling_tools(roots.undefined_value());
@@ -914,6 +920,13 @@ void Heap::CreateInitialObjects() {
     set_promise_species_protector(*cell);
   }
 
+  {
+    Handle<PropertyCell> cell =
+        factory->NewPropertyCell(factory->empty_string());
+    cell->set_value(Smi::FromInt(Protectors::kProtectorValid));
+    set_regexp_species_protector(*cell);
+  }
+
   {
     Handle<PropertyCell> cell =
         factory->NewPropertyCell(factory->empty_string());
@@ -984,6 +997,123 @@ void Heap::CreateInitialObjects() {
 
   // Initialize compilation cache.
   isolate_->compilation_cache()->Clear();
+
+  // Create internal SharedFunctionInfos.
+
+  // Async functions:
+  {
+    Handle<SharedFunctionInfo> info = CreateSharedFunctionInfo(
+        isolate(), Builtins::kAsyncFunctionAwaitRejectClosure, 1);
+    set_async_function_await_reject_shared_fun(*info);
+
+    info = CreateSharedFunctionInfo(
+        isolate(), Builtins::kAsyncFunctionAwaitResolveClosure, 1);
+    set_async_function_await_resolve_shared_fun(*info);
+  }
+
+  // Async generators:
+  {
+    Handle<SharedFunctionInfo> info = CreateSharedFunctionInfo(
+        isolate(), Builtins::kAsyncGeneratorAwaitResolveClosure, 1);
+    set_async_generator_await_resolve_shared_fun(*info);
+
+    info = CreateSharedFunctionInfo(
+        isolate(), Builtins::kAsyncGeneratorAwaitRejectClosure, 1);
+    set_async_generator_await_reject_shared_fun(*info);
+
+    info = CreateSharedFunctionInfo(
+        isolate(), Builtins::kAsyncGeneratorYieldResolveClosure, 1);
+    set_async_generator_yield_resolve_shared_fun(*info);
+
+    info = CreateSharedFunctionInfo(
+        isolate(), Builtins::kAsyncGeneratorReturnResolveClosure, 1);
+    set_async_generator_return_resolve_shared_fun(*info);
+
+    info = CreateSharedFunctionInfo(
+        isolate(), Builtins::kAsyncGeneratorReturnClosedResolveClosure, 1);
+    set_async_generator_return_closed_resolve_shared_fun(*info);
+
+    info = CreateSharedFunctionInfo(
+        isolate(), Builtins::kAsyncGeneratorReturnClosedRejectClosure, 1);
+    set_async_generator_return_closed_reject_shared_fun(*info);
+  }
+
+  // AsyncIterator:
+  {
+    Handle<SharedFunctionInfo> info = CreateSharedFunctionInfo(
+        isolate_, Builtins::kAsyncIteratorValueUnwrap, 1);
+    set_async_iterator_value_unwrap_shared_fun(*info);
+  }
+
+  // Promises:
+  {
+    Handle<SharedFunctionInfo> info = CreateSharedFunctionInfo(
+        isolate_, Builtins::kPromiseCapabilityDefaultResolve, 1,
+        FunctionKind::kConciseMethod);
+    info->set_native(true);
+    info->set_function_map_index(
+        Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
+    set_promise_capability_default_resolve_shared_fun(*info);
+
+    info = CreateSharedFunctionInfo(isolate_,
+                                    Builtins::kPromiseCapabilityDefaultReject,
+                                    1, FunctionKind::kConciseMethod);
+    info->set_native(true);
+    info->set_function_map_index(
+        Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
+    set_promise_capability_default_reject_shared_fun(*info);
+
+    info = CreateSharedFunctionInfo(
+        isolate_, Builtins::kPromiseGetCapabilitiesExecutor, 2);
+    set_promise_get_capabilities_executor_shared_fun(*info);
+  }
+
+  // Promises / finally:
+  {
+    Handle<SharedFunctionInfo> info =
+        CreateSharedFunctionInfo(isolate(), Builtins::kPromiseThenFinally, 1);
+    info->set_native(true);
+    set_promise_then_finally_shared_fun(*info);
+
+    info =
+        CreateSharedFunctionInfo(isolate(), Builtins::kPromiseCatchFinally, 1);
+    info->set_native(true);
+    set_promise_catch_finally_shared_fun(*info);
+
+    info = CreateSharedFunctionInfo(isolate(),
+                                    Builtins::kPromiseValueThunkFinally, 0);
+    set_promise_value_thunk_finally_shared_fun(*info);
+
+    info = CreateSharedFunctionInfo(isolate(), Builtins::kPromiseThrowerFinally,
+                                    0);
+    set_promise_thrower_finally_shared_fun(*info);
+  }
+
+  // Promise combinators:
+  {
+    Handle<SharedFunctionInfo> info = CreateSharedFunctionInfo(
+        isolate_, Builtins::kPromiseAllResolveElementClosure, 1);
+    set_promise_all_resolve_element_shared_fun(*info);
+
+    info = CreateSharedFunctionInfo(
+        isolate_, Builtins::kPromiseAllSettledResolveElementClosure, 1);
+    set_promise_all_settled_resolve_element_shared_fun(*info);
+
+    info = CreateSharedFunctionInfo(
+        isolate_, Builtins::kPromiseAllSettledRejectElementClosure, 1);
+    set_promise_all_settled_reject_element_shared_fun(*info);
+
+    info = CreateSharedFunctionInfo(
+        isolate_, Builtins::kPromiseAnyRejectElementClosure, 1);
+    set_promise_any_reject_element_shared_fun(*info);
+  }
+
+  // ProxyRevoke:
+  {
+    Handle<SharedFunctionInfo> info =
+        CreateSharedFunctionInfo(isolate_, Builtins::kProxyRevoke, 0);
+    set_proxy_revoke_shared_fun(*info);
+  }
 }
 
 void Heap::CreateInternalAccessorInfoObjects() {
diff --git a/deps/v8/src/heap/slot-set.h b/deps/v8/src/heap/slot-set.h
index 3275d6278e9..ca7eef9b7ab 100644
--- a/deps/v8/src/heap/slot-set.h
+++ b/deps/v8/src/heap/slot-set.h
@@ -190,6 +190,12 @@ class SlotSet {
            (kTaggedSizeLog2 + kBitsPerBucketLog2);
   }
 
+  // Converts the slot offset into bucket index.
+  static size_t BucketForSlot(size_t slot_offset) {
+    DCHECK(IsAligned(slot_offset, kTaggedSize));
+    return slot_offset >> (kTaggedSizeLog2 + kBitsPerBucketLog2);
+  }
+
   // The slot offset specifies a slot at address page_start_ + slot_offset.
   // AccessMode defines whether there can be concurrent access on the buckets
   // or not.
@@ -335,9 +341,9 @@ class SlotSet {
   //
   // Releases memory for empty buckets with FREE_EMPTY_BUCKETS.
   template <typename Callback>
-  size_t Iterate(Address chunk_start, size_t buckets, Callback callback,
-                 EmptyBucketMode mode) {
-    return Iterate(chunk_start, buckets, callback,
+  size_t Iterate(Address chunk_start, size_t start_bucket, size_t end_bucket,
+                 Callback callback, EmptyBucketMode mode) {
+    return Iterate(chunk_start, start_bucket, end_bucket, callback,
                    [this, mode](size_t bucket_index) {
                      if (mode == EmptyBucketMode::FREE_EMPTY_BUCKETS) {
                        ReleaseBucket(bucket_index);
@@ -351,11 +357,11 @@ class SlotSet {
   // CheckPossiblyEmptyBuckets.
   template <typename Callback>
   size_t IterateAndTrackEmptyBuckets(
-      Address chunk_start, size_t buckets, Callback callback,
-      PossiblyEmptyBuckets* possibly_empty_buckets) {
-    return Iterate(chunk_start, buckets, callback,
-                   [possibly_empty_buckets, buckets](size_t bucket_index) {
-                     possibly_empty_buckets->Insert(bucket_index, buckets);
+      Address chunk_start, size_t start_bucket, size_t end_bucket,
+      Callback callback, PossiblyEmptyBuckets* possibly_empty_buckets) {
+    return Iterate(chunk_start, start_bucket, end_bucket, callback,
+                   [possibly_empty_buckets, end_bucket](size_t bucket_index) {
+                     possibly_empty_buckets->Insert(bucket_index, end_bucket);
                    });
   }
 
@@ -461,10 +467,11 @@ class SlotSet {
 
  private:
   template <typename Callback, typename EmptyBucketCallback>
-  size_t Iterate(Address chunk_start, size_t buckets, Callback callback,
-                 EmptyBucketCallback empty_bucket_callback) {
+  size_t Iterate(Address chunk_start, size_t start_bucket, size_t end_bucket,
+                 Callback callback, EmptyBucketCallback empty_bucket_callback) {
     size_t new_count = 0;
-    for (size_t bucket_index = 0; bucket_index < buckets; bucket_index++) {
+    for (size_t bucket_index = start_bucket; bucket_index < end_bucket;
+         bucket_index++) {
       Bucket* bucket = LoadBucket(bucket_index);
       if (bucket != nullptr) {
         size_t in_bucket_count = 0;
@@ -597,7 +604,8 @@ STATIC_ASSERT(std::is_standard_layout<SlotSet::Bucket>::value);
 enum SlotType {
   FULL_EMBEDDED_OBJECT_SLOT,
   COMPRESSED_EMBEDDED_OBJECT_SLOT,
-  OBJECT_SLOT,
+  FULL_OBJECT_SLOT,
+  COMPRESSED_OBJECT_SLOT,
   CODE_TARGET_SLOT,
   CODE_ENTRY_SLOT,
   CLEARED_SLOT
diff --git a/deps/v8/src/heap/spaces-inl.h b/deps/v8/src/heap/spaces-inl.h
index a73ea6fe0ce..07965877522 100644
--- a/deps/v8/src/heap/spaces-inl.h
+++ b/deps/v8/src/heap/spaces-inl.h
@@ -5,16 +5,16 @@
 #ifndef V8_HEAP_SPACES_INL_H_
 #define V8_HEAP_SPACES_INL_H_
 
-#include "src/common/globals.h"
-#include "src/heap/spaces.h"
-
 #include "src/base/atomic-utils.h"
-#include "src/base/bounded-page-allocator.h"
 #include "src/base/v8-fallthrough.h"
+#include "src/common/globals.h"
 #include "src/heap/heap-inl.h"
 #include "src/heap/incremental-marking.h"
+#include "src/heap/memory-chunk-inl.h"
+#include "src/heap/new-spaces.h"
+#include "src/heap/paged-spaces.h"
+#include "src/heap/spaces.h"
 #include "src/objects/code-inl.h"
-#include "src/sanitizer/msan.h"
 
 namespace v8 {
 namespace internal {
@@ -42,63 +42,6 @@ PageRange::PageRange(Address start, Address limit)
 #endif  // DEBUG
 }
 
-// -----------------------------------------------------------------------------
-// SemiSpaceObjectIterator
-
-HeapObject SemiSpaceObjectIterator::Next() {
-  while (current_ != limit_) {
-    if (Page::IsAlignedToPageSize(current_)) {
-      Page* page = Page::FromAllocationAreaAddress(current_);
-      page = page->next_page();
-      DCHECK(page);
-      current_ = page->area_start();
-      if (current_ == limit_) return HeapObject();
-    }
-    HeapObject object = HeapObject::FromAddress(current_);
-    current_ += object.Size();
-    if (!object.IsFreeSpaceOrFiller()) {
-      return object;
-    }
-  }
-  return HeapObject();
-}
-
-// -----------------------------------------------------------------------------
-// PagedSpaceObjectIterator
-
-HeapObject PagedSpaceObjectIterator::Next() {
-  do {
-    HeapObject next_obj = FromCurrentPage();
-    if (!next_obj.is_null()) return next_obj;
-  } while (AdvanceToNextPage());
-  return HeapObject();
-}
-
-HeapObject PagedSpaceObjectIterator::FromCurrentPage() {
-  while (cur_addr_ != cur_end_) {
-    if (cur_addr_ == space_->top() && cur_addr_ != space_->limit()) {
-      cur_addr_ = space_->limit();
-      continue;
-    }
-    HeapObject obj = HeapObject::FromAddress(cur_addr_);
-    const int obj_size = obj.Size();
-    cur_addr_ += obj_size;
-    DCHECK_LE(cur_addr_, cur_end_);
-    if (!obj.IsFreeSpaceOrFiller()) {
-      if (obj.IsCode()) {
-        DCHECK_IMPLIES(
-            space_->identity() != CODE_SPACE,
-            space_->identity() == RO_SPACE && Code::cast(obj).is_builtin());
-        DCHECK_CODEOBJECT_SIZE(obj_size, space_);
-      } else {
-        DCHECK_OBJECT_SIZE(obj_size);
-      }
-      return obj;
-    }
-  }
-  return HeapObject();
-}
-
 void Space::IncrementExternalBackingStoreBytes(ExternalBackingStoreType type,
                                                size_t amount) {
   base::CheckedIncrement(&external_backing_store_bytes_[type], amount);
@@ -120,126 +63,6 @@ void Space::MoveExternalBackingStoreBytes(ExternalBackingStoreType type,
   base::CheckedIncrement(&(to->external_backing_store_bytes_[type]), amount);
 }
 
-// -----------------------------------------------------------------------------
-// SemiSpace
-
-bool SemiSpace::Contains(HeapObject o) {
-  MemoryChunk* memory_chunk = MemoryChunk::FromHeapObject(o);
-  if (memory_chunk->IsLargePage()) return false;
-  return id_ == kToSpace ? memory_chunk->IsToPage()
-                         : memory_chunk->IsFromPage();
-}
-
-bool SemiSpace::Contains(Object o) {
-  return o.IsHeapObject() && Contains(HeapObject::cast(o));
-}
-
-bool SemiSpace::ContainsSlow(Address a) {
-  for (Page* p : *this) {
-    if (p == MemoryChunk::FromAddress(a)) return true;
-  }
-  return false;
-}
-
-// --------------------------------------------------------------------------
-// NewSpace
-
-bool NewSpace::Contains(Object o) {
-  return o.IsHeapObject() && Contains(HeapObject::cast(o));
-}
-
-bool NewSpace::Contains(HeapObject o) {
-  return MemoryChunk::FromHeapObject(o)->InNewSpace();
-}
-
-bool NewSpace::ContainsSlow(Address a) {
-  return from_space_.ContainsSlow(a) || to_space_.ContainsSlow(a);
-}
-
-bool NewSpace::ToSpaceContainsSlow(Address a) {
-  return to_space_.ContainsSlow(a);
-}
-
-bool NewSpace::ToSpaceContains(Object o) { return to_space_.Contains(o); }
-bool NewSpace::FromSpaceContains(Object o) { return from_space_.Contains(o); }
-
-bool PagedSpace::Contains(Address addr) {
-  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
-    return true;
-  }
-  return Page::FromAddress(addr)->owner() == this;
-}
-
-bool PagedSpace::Contains(Object o) {
-  if (!o.IsHeapObject()) return false;
-  return Page::FromAddress(o.ptr())->owner() == this;
-}
-
-void PagedSpace::UnlinkFreeListCategories(Page* page) {
-  DCHECK_EQ(this, page->owner());
-  page->ForAllFreeListCategories([this](FreeListCategory* category) {
-    free_list()->RemoveCategory(category);
-  });
-}
-
-size_t PagedSpace::RelinkFreeListCategories(Page* page) {
-  DCHECK_EQ(this, page->owner());
-  size_t added = 0;
-  page->ForAllFreeListCategories([this, &added](FreeListCategory* category) {
-    added += category->available();
-    category->Relink(free_list());
-  });
-
-  DCHECK_IMPLIES(!page->IsFlagSet(Page::NEVER_ALLOCATE_ON_PAGE),
-                 page->AvailableInFreeList() ==
-                     page->AvailableInFreeListFromAllocatedBytes());
-  return added;
-}
-
-bool PagedSpace::TryFreeLast(HeapObject object, int object_size) {
-  if (allocation_info_.top() != kNullAddress) {
-    const Address object_address = object.address();
-    if ((allocation_info_.top() - object_size) == object_address) {
-      allocation_info_.set_top(object_address);
-      return true;
-    }
-  }
-  return false;
-}
-
-void MemoryChunk::IncrementExternalBackingStoreBytes(
-    ExternalBackingStoreType type, size_t amount) {
-#ifndef V8_ENABLE_THIRD_PARTY_HEAP
-  base::CheckedIncrement(&external_backing_store_bytes_[type], amount);
-  owner()->IncrementExternalBackingStoreBytes(type, amount);
-#endif
-}
-
-void MemoryChunk::DecrementExternalBackingStoreBytes(
-    ExternalBackingStoreType type, size_t amount) {
-#ifndef V8_ENABLE_THIRD_PARTY_HEAP
-  base::CheckedDecrement(&external_backing_store_bytes_[type], amount);
-  owner()->DecrementExternalBackingStoreBytes(type, amount);
-#endif
-}
-
-void MemoryChunk::MoveExternalBackingStoreBytes(ExternalBackingStoreType type,
-                                                MemoryChunk* from,
-                                                MemoryChunk* to,
-                                                size_t amount) {
-  DCHECK_NOT_NULL(from->owner());
-  DCHECK_NOT_NULL(to->owner());
-  base::CheckedDecrement(&(from->external_backing_store_bytes_[type]), amount);
-  base::CheckedIncrement(&(to->external_backing_store_bytes_[type]), amount);
-  Space::MoveExternalBackingStoreBytes(type, from->owner(), to->owner(),
-                                       amount);
-}
-
-AllocationSpace MemoryChunk::owner_identity() const {
-  if (InReadOnlySpace()) return RO_SPACE;
-  return owner()->identity();
-}
-
 void Page::MarkNeverAllocateForTesting() {
   DCHECK(this->owner_identity() != NEW_SPACE);
   DCHECK(!IsFlagSet(NEVER_ALLOCATE_ON_PAGE));
@@ -265,10 +88,6 @@ void Page::ClearEvacuationCandidate() {
   InitializeFreeListCategories();
 }
 
-HeapObject LargePage::GetObject() {
-  return HeapObject::FromAddress(area_start());
-}
-
 OldGenerationMemoryChunkIterator::OldGenerationMemoryChunkIterator(Heap* heap)
     : heap_(heap),
       state_(kOldSpaceState),
@@ -372,222 +191,14 @@ AllocationResult LocalAllocationBuffer::AllocateRawAligned(
 
   allocation_info_.set_top(new_top);
   if (filler_size > 0) {
-    return heap_->PrecedeWithFiller(HeapObject::FromAddress(current_top),
-                                    filler_size);
+    return Heap::PrecedeWithFiller(ReadOnlyRoots(heap_),
+                                   HeapObject::FromAddress(current_top),
+                                   filler_size);
   }
 
   return AllocationResult(HeapObject::FromAddress(current_top));
 }
 
-bool PagedSpace::EnsureLinearAllocationArea(int size_in_bytes,
-                                            AllocationOrigin origin) {
-  if (allocation_info_.top() + size_in_bytes <= allocation_info_.limit()) {
-    return true;
-  }
-  return SlowRefillLinearAllocationArea(size_in_bytes, origin);
-}
-
-HeapObject PagedSpace::AllocateLinearly(int size_in_bytes) {
-  Address current_top = allocation_info_.top();
-  Address new_top = current_top + size_in_bytes;
-  DCHECK_LE(new_top, allocation_info_.limit());
-  allocation_info_.set_top(new_top);
-  return HeapObject::FromAddress(current_top);
-}
-
-HeapObject PagedSpace::TryAllocateLinearlyAligned(
-    int* size_in_bytes, AllocationAlignment alignment) {
-  Address current_top = allocation_info_.top();
-  int filler_size = Heap::GetFillToAlign(current_top, alignment);
-
-  Address new_top = current_top + filler_size + *size_in_bytes;
-  if (new_top > allocation_info_.limit()) return HeapObject();
-
-  allocation_info_.set_top(new_top);
-  if (filler_size > 0) {
-    *size_in_bytes += filler_size;
-    return heap()->PrecedeWithFiller(HeapObject::FromAddress(current_top),
-                                     filler_size);
-  }
-
-  return HeapObject::FromAddress(current_top);
-}
-
-AllocationResult PagedSpace::AllocateRawUnaligned(int size_in_bytes,
-                                                  AllocationOrigin origin) {
-  DCHECK_IMPLIES(identity() == RO_SPACE, !IsDetached());
-  if (!EnsureLinearAllocationArea(size_in_bytes, origin)) {
-    return AllocationResult::Retry(identity());
-  }
-  HeapObject object = AllocateLinearly(size_in_bytes);
-  DCHECK(!object.is_null());
-  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(object.address(), size_in_bytes);
-
-  if (FLAG_trace_allocations_origins) {
-    UpdateAllocationOrigins(origin);
-  }
-
-  return object;
-}
-
-AllocationResult PagedSpace::AllocateRawAligned(int size_in_bytes,
-                                                AllocationAlignment alignment,
-                                                AllocationOrigin origin) {
-  DCHECK(identity() == OLD_SPACE || identity() == RO_SPACE);
-  DCHECK_IMPLIES(identity() == RO_SPACE, !IsDetached());
-  int allocation_size = size_in_bytes;
-  HeapObject object = TryAllocateLinearlyAligned(&allocation_size, alignment);
-  if (object.is_null()) {
-    // We don't know exactly how much filler we need to align until space is
-    // allocated, so assume the worst case.
-    int filler_size = Heap::GetMaximumFillToAlign(alignment);
-    allocation_size += filler_size;
-    if (!EnsureLinearAllocationArea(allocation_size, origin)) {
-      return AllocationResult::Retry(identity());
-    }
-    allocation_size = size_in_bytes;
-    object = TryAllocateLinearlyAligned(&allocation_size, alignment);
-    DCHECK(!object.is_null());
-  }
-  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(object.address(), size_in_bytes);
-
-  if (FLAG_trace_allocations_origins) {
-    UpdateAllocationOrigins(origin);
-  }
-
-  return object;
-}
-
-AllocationResult PagedSpace::AllocateRaw(int size_in_bytes,
-                                         AllocationAlignment alignment,
-                                         AllocationOrigin origin) {
-  if (top_on_previous_step_ && top() < top_on_previous_step_ &&
-      SupportsInlineAllocation()) {
-    // Generated code decreased the top() pointer to do folded allocations.
-    // The top_on_previous_step_ can be one byte beyond the current page.
-    DCHECK_NE(top(), kNullAddress);
-    DCHECK_EQ(Page::FromAllocationAreaAddress(top()),
-              Page::FromAllocationAreaAddress(top_on_previous_step_ - 1));
-    top_on_previous_step_ = top();
-  }
-  size_t bytes_since_last =
-      top_on_previous_step_ ? top() - top_on_previous_step_ : 0;
-
-  DCHECK_IMPLIES(!SupportsInlineAllocation(), bytes_since_last == 0);
-#ifdef V8_HOST_ARCH_32_BIT
-  AllocationResult result =
-      alignment != kWordAligned
-          ? AllocateRawAligned(size_in_bytes, alignment, origin)
-          : AllocateRawUnaligned(size_in_bytes, origin);
-#else
-  AllocationResult result = AllocateRawUnaligned(size_in_bytes, origin);
-#endif
-  HeapObject heap_obj;
-  if (!result.IsRetry() && result.To(&heap_obj) && !is_local_space()) {
-    AllocationStep(static_cast<int>(size_in_bytes + bytes_since_last),
-                   heap_obj.address(), size_in_bytes);
-    StartNextInlineAllocationStep();
-    DCHECK_IMPLIES(
-        heap()->incremental_marking()->black_allocation(),
-        heap()->incremental_marking()->marking_state()->IsBlack(heap_obj));
-  }
-  return result;
-}
-
-// -----------------------------------------------------------------------------
-// NewSpace
-
-AllocationResult NewSpace::AllocateRawAligned(int size_in_bytes,
-                                              AllocationAlignment alignment,
-                                              AllocationOrigin origin) {
-  Address top = allocation_info_.top();
-  int filler_size = Heap::GetFillToAlign(top, alignment);
-  int aligned_size_in_bytes = size_in_bytes + filler_size;
-
-  if (allocation_info_.limit() - top <
-      static_cast<uintptr_t>(aligned_size_in_bytes)) {
-    // See if we can create room.
-    if (!EnsureAllocation(size_in_bytes, alignment)) {
-      return AllocationResult::Retry();
-    }
-
-    top = allocation_info_.top();
-    filler_size = Heap::GetFillToAlign(top, alignment);
-    aligned_size_in_bytes = size_in_bytes + filler_size;
-  }
-
-  HeapObject obj = HeapObject::FromAddress(top);
-  allocation_info_.set_top(top + aligned_size_in_bytes);
-  DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
-
-  if (filler_size > 0) {
-    obj = heap()->PrecedeWithFiller(obj, filler_size);
-  }
-
-  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(obj.address(), size_in_bytes);
-
-  if (FLAG_trace_allocations_origins) {
-    UpdateAllocationOrigins(origin);
-  }
-
-  return obj;
-}
-
-AllocationResult NewSpace::AllocateRawUnaligned(int size_in_bytes,
-                                                AllocationOrigin origin) {
-  Address top = allocation_info_.top();
-  if (allocation_info_.limit() < top + size_in_bytes) {
-    // See if we can create room.
-    if (!EnsureAllocation(size_in_bytes, kWordAligned)) {
-      return AllocationResult::Retry();
-    }
-
-    top = allocation_info_.top();
-  }
-
-  HeapObject obj = HeapObject::FromAddress(top);
-  allocation_info_.set_top(top + size_in_bytes);
-  DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
-
-  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(obj.address(), size_in_bytes);
-
-  if (FLAG_trace_allocations_origins) {
-    UpdateAllocationOrigins(origin);
-  }
-
-  return obj;
-}
-
-AllocationResult NewSpace::AllocateRaw(int size_in_bytes,
-                                       AllocationAlignment alignment,
-                                       AllocationOrigin origin) {
-  if (top() < top_on_previous_step_) {
-    // Generated code decreased the top() pointer to do folded allocations
-    DCHECK_EQ(Page::FromAllocationAreaAddress(top()),
-              Page::FromAllocationAreaAddress(top_on_previous_step_));
-    top_on_previous_step_ = top();
-  }
-#ifdef V8_HOST_ARCH_32_BIT
-  return alignment != kWordAligned
-             ? AllocateRawAligned(size_in_bytes, alignment, origin)
-             : AllocateRawUnaligned(size_in_bytes, origin);
-#else
-#ifdef V8_COMPRESS_POINTERS
-  // TODO(ishell, v8:8875): Consider using aligned allocations once the
-  // allocation alignment inconsistency is fixed. For now we keep using
-  // unaligned access since both x64 and arm64 architectures (where pointer
-  // compression is supported) allow unaligned access to doubles and full words.
-#endif  // V8_COMPRESS_POINTERS
-  return AllocateRawUnaligned(size_in_bytes, origin);
-#endif
-}
-
-V8_WARN_UNUSED_RESULT inline AllocationResult NewSpace::AllocateRawSynchronized(
-    int size_in_bytes, AllocationAlignment alignment, AllocationOrigin origin) {
-  base::MutexGuard guard(&mutex_);
-  return AllocateRaw(size_in_bytes, alignment, origin);
-}
-
 LocalAllocationBuffer LocalAllocationBuffer::FromResult(Heap* heap,
                                                         AllocationResult result,
                                                         intptr_t size) {
diff --git a/deps/v8/src/heap/spaces.cc b/deps/v8/src/heap/spaces.cc
index a7aec2ff1f3..5b815de5dd8 100644
--- a/deps/v8/src/heap/spaces.cc
+++ b/deps/v8/src/heap/spaces.cc
@@ -9,27 +9,26 @@
 #include <utility>
 
 #include "src/base/bits.h"
-#include "src/base/lsan.h"
+#include "src/base/bounded-page-allocator.h"
 #include "src/base/macros.h"
-#include "src/base/platform/semaphore.h"
 #include "src/common/globals.h"
-#include "src/execution/vm-state-inl.h"
-#include "src/heap/array-buffer-sweeper.h"
 #include "src/heap/array-buffer-tracker-inl.h"
 #include "src/heap/combined-heap.h"
 #include "src/heap/concurrent-marking.h"
 #include "src/heap/gc-tracer.h"
 #include "src/heap/heap-controller.h"
+#include "src/heap/heap.h"
 #include "src/heap/incremental-marking-inl.h"
 #include "src/heap/invalidated-slots-inl.h"
+#include "src/heap/large-spaces.h"
 #include "src/heap/mark-compact.h"
 #include "src/heap/read-only-heap.h"
-#include "src/heap/remembered-set.h"
+#include "src/heap/remembered-set-inl.h"
 #include "src/heap/slot-set.h"
-#include "src/heap/sweeper.h"
 #include "src/init/v8.h"
 #include "src/logging/counters.h"
 #include "src/objects/free-space-inl.h"
+#include "src/objects/heap-object.h"
 #include "src/objects/js-array-buffer-inl.h"
 #include "src/objects/objects-inl.h"
 #include "src/sanitizer/msan.h"
@@ -45,56 +44,6 @@ namespace internal {
 // in order to figure out if it's a cleared weak reference or not.
 STATIC_ASSERT(kClearedWeakHeapObjectLower32 > 0);
 STATIC_ASSERT(kClearedWeakHeapObjectLower32 < Page::kHeaderSize);
-STATIC_ASSERT(kClearedWeakHeapObjectLower32 < LargePage::kHeaderSize);
-
-// ----------------------------------------------------------------------------
-// PagedSpaceObjectIterator
-
-PagedSpaceObjectIterator::PagedSpaceObjectIterator(Heap* heap,
-                                                   PagedSpace* space)
-    : cur_addr_(kNullAddress),
-      cur_end_(kNullAddress),
-      space_(space),
-      page_range_(space->first_page(), nullptr),
-      current_page_(page_range_.begin()) {
-  heap->mark_compact_collector()->EnsureSweepingCompleted();
-}
-
-PagedSpaceObjectIterator::PagedSpaceObjectIterator(Heap* heap,
-                                                   PagedSpace* space,
-                                                   Page* page)
-    : cur_addr_(kNullAddress),
-      cur_end_(kNullAddress),
-      space_(space),
-      page_range_(page),
-      current_page_(page_range_.begin()) {
-  heap->mark_compact_collector()->EnsureSweepingCompleted();
-#ifdef DEBUG
-  AllocationSpace owner = page->owner_identity();
-  DCHECK(owner == RO_SPACE || owner == OLD_SPACE || owner == MAP_SPACE ||
-         owner == CODE_SPACE);
-#endif  // DEBUG
-}
-
-PagedSpaceObjectIterator::PagedSpaceObjectIterator(OffThreadSpace* space)
-    : cur_addr_(kNullAddress),
-      cur_end_(kNullAddress),
-      space_(space),
-      page_range_(space->first_page(), nullptr),
-      current_page_(page_range_.begin()) {}
-
-// We have hit the end of the page and should advance to the next block of
-// objects.  This happens at the end of the page.
-bool PagedSpaceObjectIterator::AdvanceToNextPage() {
-  DCHECK_EQ(cur_addr_, cur_end_);
-  if (current_page_ == page_range_.end()) return false;
-  Page* cur_page = *(current_page_++);
-
-  cur_addr_ = cur_page->area_start();
-  cur_end_ = cur_page->area_end();
-  DCHECK(cur_page->SweepingDone());
-  return true;
-}
 
 PauseAllocationObserversScope::PauseAllocationObserversScope(Heap* heap)
     : heap_(heap) {
@@ -111,719 +60,28 @@ PauseAllocationObserversScope::~PauseAllocationObserversScope() {
   }
 }
 
-static base::LazyInstance<CodeRangeAddressHint>::type code_range_address_hint =
-    LAZY_INSTANCE_INITIALIZER;
-
-Address CodeRangeAddressHint::GetAddressHint(size_t code_range_size) {
-  base::MutexGuard guard(&mutex_);
-  auto it = recently_freed_.find(code_range_size);
-  if (it == recently_freed_.end() || it->second.empty()) {
-    return reinterpret_cast<Address>(GetRandomMmapAddr());
-  }
-  Address result = it->second.back();
-  it->second.pop_back();
-  return result;
-}
-
-void CodeRangeAddressHint::NotifyFreedCodeRange(Address code_range_start,
-                                                size_t code_range_size) {
-  base::MutexGuard guard(&mutex_);
-  recently_freed_[code_range_size].push_back(code_range_start);
-}
-
-// -----------------------------------------------------------------------------
-// MemoryAllocator
-//
-
-MemoryAllocator::MemoryAllocator(Isolate* isolate, size_t capacity,
-                                 size_t code_range_size)
-    : isolate_(isolate),
-      data_page_allocator_(isolate->page_allocator()),
-      code_page_allocator_(nullptr),
-      capacity_(RoundUp(capacity, Page::kPageSize)),
-      size_(0),
-      size_executable_(0),
-      lowest_ever_allocated_(static_cast<Address>(-1ll)),
-      highest_ever_allocated_(kNullAddress),
-      unmapper_(isolate->heap(), this) {
-  InitializeCodePageAllocator(data_page_allocator_, code_range_size);
-}
-
-void MemoryAllocator::InitializeCodePageAllocator(
-    v8::PageAllocator* page_allocator, size_t requested) {
-  DCHECK_NULL(code_page_allocator_instance_.get());
-
-  code_page_allocator_ = page_allocator;
-
-  if (requested == 0) {
-    if (!isolate_->RequiresCodeRange()) return;
-    // When a target requires the code range feature, we put all code objects
-    // in a kMaximalCodeRangeSize range of virtual address space, so that
-    // they can call each other with near calls.
-    requested = kMaximalCodeRangeSize;
-  } else if (requested <= kMinimumCodeRangeSize) {
-    requested = kMinimumCodeRangeSize;
-  }
-
-  const size_t reserved_area =
-      kReservedCodeRangePages * MemoryAllocator::GetCommitPageSize();
-  if (requested < (kMaximalCodeRangeSize - reserved_area)) {
-    requested += RoundUp(reserved_area, MemoryChunk::kPageSize);
-    // Fullfilling both reserved pages requirement and huge code area
-    // alignments is not supported (requires re-implementation).
-    DCHECK_LE(kMinExpectedOSPageSize, page_allocator->AllocatePageSize());
-  }
-  DCHECK(!isolate_->RequiresCodeRange() || requested <= kMaximalCodeRangeSize);
-
-  Address hint =
-      RoundDown(code_range_address_hint.Pointer()->GetAddressHint(requested),
-                page_allocator->AllocatePageSize());
-  VirtualMemory reservation(
-      page_allocator, requested, reinterpret_cast<void*>(hint),
-      Max(kMinExpectedOSPageSize, page_allocator->AllocatePageSize()));
-  if (!reservation.IsReserved()) {
-    V8::FatalProcessOutOfMemory(isolate_,
-                                "CodeRange setup: allocate virtual memory");
-  }
-  code_range_ = reservation.region();
-  isolate_->AddCodeRange(code_range_.begin(), code_range_.size());
-
-  // We are sure that we have mapped a block of requested addresses.
-  DCHECK_GE(reservation.size(), requested);
-  Address base = reservation.address();
-
-  // On some platforms, specifically Win64, we need to reserve some pages at
-  // the beginning of an executable space. See
-  //   https://cs.chromium.org/chromium/src/components/crash/content/
-  //     app/crashpad_win.cc?rcl=fd680447881449fba2edcf0589320e7253719212&l=204
-  // for details.
-  if (reserved_area > 0) {
-    if (!reservation.SetPermissions(base, reserved_area,
-                                    PageAllocator::kReadWrite))
-      V8::FatalProcessOutOfMemory(isolate_, "CodeRange setup: set permissions");
-
-    base += reserved_area;
-  }
-  Address aligned_base = RoundUp(base, MemoryChunk::kAlignment);
-  size_t size =
-      RoundDown(reservation.size() - (aligned_base - base) - reserved_area,
-                MemoryChunk::kPageSize);
-  DCHECK(IsAligned(aligned_base, kMinExpectedOSPageSize));
-
-  LOG(isolate_,
-      NewEvent("CodeRange", reinterpret_cast<void*>(reservation.address()),
-               requested));
-
-  code_reservation_ = std::move(reservation);
-  code_page_allocator_instance_ = std::make_unique<base::BoundedPageAllocator>(
-      page_allocator, aligned_base, size,
-      static_cast<size_t>(MemoryChunk::kAlignment));
-  code_page_allocator_ = code_page_allocator_instance_.get();
-}
-
-void MemoryAllocator::TearDown() {
-  unmapper()->TearDown();
-
-  // Check that spaces were torn down before MemoryAllocator.
-  DCHECK_EQ(size_, 0u);
-  // TODO(gc) this will be true again when we fix FreeMemory.
-  // DCHECK_EQ(0, size_executable_);
-  capacity_ = 0;
-
-  if (last_chunk_.IsReserved()) {
-    last_chunk_.Free();
-  }
-
-  if (code_page_allocator_instance_.get()) {
-    DCHECK(!code_range_.is_empty());
-    code_range_address_hint.Pointer()->NotifyFreedCodeRange(code_range_.begin(),
-                                                            code_range_.size());
-    code_range_ = base::AddressRegion();
-    code_page_allocator_instance_.reset();
-  }
-  code_page_allocator_ = nullptr;
-  data_page_allocator_ = nullptr;
-}
-
-class MemoryAllocator::Unmapper::UnmapFreeMemoryTask : public CancelableTask {
- public:
-  explicit UnmapFreeMemoryTask(Isolate* isolate, Unmapper* unmapper)
-      : CancelableTask(isolate),
-        unmapper_(unmapper),
-        tracer_(isolate->heap()->tracer()) {}
-
- private:
-  void RunInternal() override {
-    TRACE_BACKGROUND_GC(tracer_,
-                        GCTracer::BackgroundScope::BACKGROUND_UNMAPPER);
-    unmapper_->PerformFreeMemoryOnQueuedChunks<FreeMode::kUncommitPooled>();
-    unmapper_->active_unmapping_tasks_--;
-    unmapper_->pending_unmapping_tasks_semaphore_.Signal();
-    if (FLAG_trace_unmapper) {
-      PrintIsolate(unmapper_->heap_->isolate(),
-                   "UnmapFreeMemoryTask Done: id=%" PRIu64 "\n", id());
-    }
-  }
-
-  Unmapper* const unmapper_;
-  GCTracer* const tracer_;
-  DISALLOW_COPY_AND_ASSIGN(UnmapFreeMemoryTask);
-};
-
-void MemoryAllocator::Unmapper::FreeQueuedChunks() {
-  if (!heap_->IsTearingDown() && FLAG_concurrent_sweeping) {
-    if (!MakeRoomForNewTasks()) {
-      // kMaxUnmapperTasks are already running. Avoid creating any more.
-      if (FLAG_trace_unmapper) {
-        PrintIsolate(heap_->isolate(),
-                     "Unmapper::FreeQueuedChunks: reached task limit (%d)\n",
-                     kMaxUnmapperTasks);
-      }
-      return;
-    }
-    auto task = std::make_unique<UnmapFreeMemoryTask>(heap_->isolate(), this);
-    if (FLAG_trace_unmapper) {
-      PrintIsolate(heap_->isolate(),
-                   "Unmapper::FreeQueuedChunks: new task id=%" PRIu64 "\n",
-                   task->id());
-    }
-    DCHECK_LT(pending_unmapping_tasks_, kMaxUnmapperTasks);
-    DCHECK_LE(active_unmapping_tasks_, pending_unmapping_tasks_);
-    DCHECK_GE(active_unmapping_tasks_, 0);
-    active_unmapping_tasks_++;
-    task_ids_[pending_unmapping_tasks_++] = task->id();
-    V8::GetCurrentPlatform()->CallOnWorkerThread(std::move(task));
-  } else {
-    PerformFreeMemoryOnQueuedChunks<FreeMode::kUncommitPooled>();
-  }
-}
-
-void MemoryAllocator::Unmapper::CancelAndWaitForPendingTasks() {
-  for (int i = 0; i < pending_unmapping_tasks_; i++) {
-    if (heap_->isolate()->cancelable_task_manager()->TryAbort(task_ids_[i]) !=
-        TryAbortResult::kTaskAborted) {
-      pending_unmapping_tasks_semaphore_.Wait();
-    }
-  }
-  pending_unmapping_tasks_ = 0;
-  active_unmapping_tasks_ = 0;
-
-  if (FLAG_trace_unmapper) {
-    PrintIsolate(
-        heap_->isolate(),
-        "Unmapper::CancelAndWaitForPendingTasks: no tasks remaining\n");
-  }
-}
-
-void MemoryAllocator::Unmapper::PrepareForGC() {
-  // Free non-regular chunks because they cannot be re-used.
-  PerformFreeMemoryOnQueuedNonRegularChunks();
-}
-
-void MemoryAllocator::Unmapper::EnsureUnmappingCompleted() {
-  CancelAndWaitForPendingTasks();
-  PerformFreeMemoryOnQueuedChunks<FreeMode::kReleasePooled>();
-}
-
-bool MemoryAllocator::Unmapper::MakeRoomForNewTasks() {
-  DCHECK_LE(pending_unmapping_tasks_, kMaxUnmapperTasks);
-
-  if (active_unmapping_tasks_ == 0 && pending_unmapping_tasks_ > 0) {
-    // All previous unmapping tasks have been run to completion.
-    // Finalize those tasks to make room for new ones.
-    CancelAndWaitForPendingTasks();
-  }
-  return pending_unmapping_tasks_ != kMaxUnmapperTasks;
-}
-
-void MemoryAllocator::Unmapper::PerformFreeMemoryOnQueuedNonRegularChunks() {
-  MemoryChunk* chunk = nullptr;
-  while ((chunk = GetMemoryChunkSafe<kNonRegular>()) != nullptr) {
-    allocator_->PerformFreeMemory(chunk);
-  }
-}
-
-template <MemoryAllocator::Unmapper::FreeMode mode>
-void MemoryAllocator::Unmapper::PerformFreeMemoryOnQueuedChunks() {
-  MemoryChunk* chunk = nullptr;
-  if (FLAG_trace_unmapper) {
-    PrintIsolate(
-        heap_->isolate(),
-        "Unmapper::PerformFreeMemoryOnQueuedChunks: %d queued chunks\n",
-        NumberOfChunks());
-  }
-  // Regular chunks.
-  while ((chunk = GetMemoryChunkSafe<kRegular>()) != nullptr) {
-    bool pooled = chunk->IsFlagSet(MemoryChunk::POOLED);
-    allocator_->PerformFreeMemory(chunk);
-    if (pooled) AddMemoryChunkSafe<kPooled>(chunk);
-  }
-  if (mode == MemoryAllocator::Unmapper::FreeMode::kReleasePooled) {
-    // The previous loop uncommitted any pages marked as pooled and added them
-    // to the pooled list. In case of kReleasePooled we need to free them
-    // though.
-    while ((chunk = GetMemoryChunkSafe<kPooled>()) != nullptr) {
-      allocator_->Free<MemoryAllocator::kAlreadyPooled>(chunk);
-    }
-  }
-  PerformFreeMemoryOnQueuedNonRegularChunks();
-}
-
-void MemoryAllocator::Unmapper::TearDown() {
-  CHECK_EQ(0, pending_unmapping_tasks_);
-  PerformFreeMemoryOnQueuedChunks<FreeMode::kReleasePooled>();
-  for (int i = 0; i < kNumberOfChunkQueues; i++) {
-    DCHECK(chunks_[i].empty());
-  }
-}
-
-size_t MemoryAllocator::Unmapper::NumberOfCommittedChunks() {
-  base::MutexGuard guard(&mutex_);
-  return chunks_[kRegular].size() + chunks_[kNonRegular].size();
-}
-
-int MemoryAllocator::Unmapper::NumberOfChunks() {
-  base::MutexGuard guard(&mutex_);
-  size_t result = 0;
-  for (int i = 0; i < kNumberOfChunkQueues; i++) {
-    result += chunks_[i].size();
-  }
-  return static_cast<int>(result);
-}
-
-size_t MemoryAllocator::Unmapper::CommittedBufferedMemory() {
-  base::MutexGuard guard(&mutex_);
-
-  size_t sum = 0;
-  // kPooled chunks are already uncommited. We only have to account for
-  // kRegular and kNonRegular chunks.
-  for (auto& chunk : chunks_[kRegular]) {
-    sum += chunk->size();
-  }
-  for (auto& chunk : chunks_[kNonRegular]) {
-    sum += chunk->size();
-  }
-  return sum;
-}
-
-bool MemoryAllocator::CommitMemory(VirtualMemory* reservation) {
-  Address base = reservation->address();
-  size_t size = reservation->size();
-  if (!reservation->SetPermissions(base, size, PageAllocator::kReadWrite)) {
-    return false;
-  }
-  UpdateAllocatedSpaceLimits(base, base + size);
-  isolate_->counters()->memory_allocated()->Increment(static_cast<int>(size));
-  return true;
-}
-
-bool MemoryAllocator::UncommitMemory(VirtualMemory* reservation) {
-  size_t size = reservation->size();
-  if (!reservation->SetPermissions(reservation->address(), size,
-                                   PageAllocator::kNoAccess)) {
-    return false;
-  }
-  isolate_->counters()->memory_allocated()->Decrement(static_cast<int>(size));
-  return true;
-}
-
-void MemoryAllocator::FreeMemory(v8::PageAllocator* page_allocator,
-                                 Address base, size_t size) {
-  CHECK(FreePages(page_allocator, reinterpret_cast<void*>(base), size));
-}
-
-Address MemoryAllocator::AllocateAlignedMemory(
-    size_t reserve_size, size_t commit_size, size_t alignment,
-    Executability executable, void* hint, VirtualMemory* controller) {
-  v8::PageAllocator* page_allocator = this->page_allocator(executable);
-  DCHECK(commit_size <= reserve_size);
-  VirtualMemory reservation(page_allocator, reserve_size, hint, alignment);
-  if (!reservation.IsReserved()) return kNullAddress;
-  Address base = reservation.address();
-  size_ += reservation.size();
-
-  if (executable == EXECUTABLE) {
-    if (!CommitExecutableMemory(&reservation, base, commit_size,
-                                reserve_size)) {
-      base = kNullAddress;
-    }
-  } else {
-    if (reservation.SetPermissions(base, commit_size,
-                                   PageAllocator::kReadWrite)) {
-      UpdateAllocatedSpaceLimits(base, base + commit_size);
-    } else {
-      base = kNullAddress;
-    }
-  }
-
-  if (base == kNullAddress) {
-    // Failed to commit the body. Free the mapping and any partially committed
-    // regions inside it.
-    reservation.Free();
-    size_ -= reserve_size;
-    return kNullAddress;
-  }
-
-  *controller = std::move(reservation);
-  return base;
-}
-
-void MemoryChunk::DiscardUnusedMemory(Address addr, size_t size) {
-  base::AddressRegion memory_area =
-      MemoryAllocator::ComputeDiscardMemoryArea(addr, size);
-  if (memory_area.size() != 0) {
-    MemoryAllocator* memory_allocator = heap_->memory_allocator();
-    v8::PageAllocator* page_allocator =
-        memory_allocator->page_allocator(executable());
-    CHECK(page_allocator->DiscardSystemPages(
-        reinterpret_cast<void*>(memory_area.begin()), memory_area.size()));
-  }
-}
-
-size_t MemoryChunkLayout::CodePageGuardStartOffset() {
-  // We are guarding code pages: the first OS page after the header
-  // will be protected as non-writable.
-  return ::RoundUp(Page::kHeaderSize, MemoryAllocator::GetCommitPageSize());
-}
-
-size_t MemoryChunkLayout::CodePageGuardSize() {
-  return MemoryAllocator::GetCommitPageSize();
-}
-
-intptr_t MemoryChunkLayout::ObjectStartOffsetInCodePage() {
-  // We are guarding code pages: the first OS page after the header
-  // will be protected as non-writable.
-  return CodePageGuardStartOffset() + CodePageGuardSize();
-}
-
-intptr_t MemoryChunkLayout::ObjectEndOffsetInCodePage() {
-  // We are guarding code pages: the last OS page will be protected as
-  // non-writable.
-  return Page::kPageSize -
-         static_cast<int>(MemoryAllocator::GetCommitPageSize());
-}
-
-size_t MemoryChunkLayout::AllocatableMemoryInCodePage() {
-  size_t memory = ObjectEndOffsetInCodePage() - ObjectStartOffsetInCodePage();
-  DCHECK_LE(kMaxRegularHeapObjectSize, memory);
-  return memory;
-}
-
-intptr_t MemoryChunkLayout::ObjectStartOffsetInDataPage() {
-  return RoundUp(MemoryChunk::kHeaderSize, kTaggedSize);
-}
-
-size_t MemoryChunkLayout::ObjectStartOffsetInMemoryChunk(
-    AllocationSpace space) {
-  if (space == CODE_SPACE) {
-    return ObjectStartOffsetInCodePage();
-  }
-  return ObjectStartOffsetInDataPage();
-}
-
-size_t MemoryChunkLayout::AllocatableMemoryInDataPage() {
-  size_t memory = MemoryChunk::kPageSize - ObjectStartOffsetInDataPage();
-  DCHECK_LE(kMaxRegularHeapObjectSize, memory);
-  return memory;
-}
-
-size_t MemoryChunkLayout::AllocatableMemoryInMemoryChunk(
-    AllocationSpace space) {
-  if (space == CODE_SPACE) {
-    return AllocatableMemoryInCodePage();
-  }
-  return AllocatableMemoryInDataPage();
-}
-
-#ifdef THREAD_SANITIZER
-void MemoryChunk::SynchronizedHeapLoad() {
-  CHECK(reinterpret_cast<Heap*>(base::Acquire_Load(
-            reinterpret_cast<base::AtomicWord*>(&heap_))) != nullptr ||
-        InReadOnlySpace());
-}
-#endif
-
-void MemoryChunk::InitializationMemoryFence() {
-  base::SeqCst_MemoryFence();
-#ifdef THREAD_SANITIZER
-  // Since TSAN does not process memory fences, we use the following annotation
-  // to tell TSAN that there is no data race when emitting a
-  // InitializationMemoryFence. Note that the other thread still needs to
-  // perform MemoryChunk::synchronized_heap().
-  base::Release_Store(reinterpret_cast<base::AtomicWord*>(&heap_),
-                      reinterpret_cast<base::AtomicWord>(heap_));
-#endif
-}
-
-void MemoryChunk::DecrementWriteUnprotectCounterAndMaybeSetPermissions(
-    PageAllocator::Permission permission) {
-  DCHECK(permission == PageAllocator::kRead ||
-         permission == PageAllocator::kReadExecute);
-  DCHECK(IsFlagSet(MemoryChunk::IS_EXECUTABLE));
-  DCHECK(owner_identity() == CODE_SPACE || owner_identity() == CODE_LO_SPACE);
-  // Decrementing the write_unprotect_counter_ and changing the page
-  // protection mode has to be atomic.
-  base::MutexGuard guard(page_protection_change_mutex_);
-  if (write_unprotect_counter_ == 0) {
-    // This is a corner case that may happen when we have a
-    // CodeSpaceMemoryModificationScope open and this page was newly
-    // added.
-    return;
-  }
-  write_unprotect_counter_--;
-  DCHECK_LT(write_unprotect_counter_, kMaxWriteUnprotectCounter);
-  if (write_unprotect_counter_ == 0) {
-    Address protect_start =
-        address() + MemoryChunkLayout::ObjectStartOffsetInCodePage();
-    size_t page_size = MemoryAllocator::GetCommitPageSize();
-    DCHECK(IsAligned(protect_start, page_size));
-    size_t protect_size = RoundUp(area_size(), page_size);
-    CHECK(reservation_.SetPermissions(protect_start, protect_size, permission));
-  }
-}
-
-void MemoryChunk::SetReadable() {
-  DecrementWriteUnprotectCounterAndMaybeSetPermissions(PageAllocator::kRead);
-}
-
-void MemoryChunk::SetReadAndExecutable() {
-  DCHECK(!FLAG_jitless);
-  DecrementWriteUnprotectCounterAndMaybeSetPermissions(
-      PageAllocator::kReadExecute);
-}
-
-void MemoryChunk::SetReadAndWritable() {
-  DCHECK(IsFlagSet(MemoryChunk::IS_EXECUTABLE));
-  DCHECK(owner_identity() == CODE_SPACE || owner_identity() == CODE_LO_SPACE);
-  // Incrementing the write_unprotect_counter_ and changing the page
-  // protection mode has to be atomic.
-  base::MutexGuard guard(page_protection_change_mutex_);
-  write_unprotect_counter_++;
-  DCHECK_LE(write_unprotect_counter_, kMaxWriteUnprotectCounter);
-  if (write_unprotect_counter_ == 1) {
-    Address unprotect_start =
-        address() + MemoryChunkLayout::ObjectStartOffsetInCodePage();
-    size_t page_size = MemoryAllocator::GetCommitPageSize();
-    DCHECK(IsAligned(unprotect_start, page_size));
-    size_t unprotect_size = RoundUp(area_size(), page_size);
-    CHECK(reservation_.SetPermissions(unprotect_start, unprotect_size,
-                                      PageAllocator::kReadWrite));
-  }
-}
-
-void CodeObjectRegistry::RegisterNewlyAllocatedCodeObject(Address code) {
-  auto result = code_object_registry_newly_allocated_.insert(code);
-  USE(result);
-  DCHECK(result.second);
-}
-
-void CodeObjectRegistry::RegisterAlreadyExistingCodeObject(Address code) {
-  code_object_registry_already_existing_.push_back(code);
-}
-
-void CodeObjectRegistry::Clear() {
-  code_object_registry_already_existing_.clear();
-  code_object_registry_newly_allocated_.clear();
-}
-
-void CodeObjectRegistry::Finalize() {
-  code_object_registry_already_existing_.shrink_to_fit();
-}
-
-bool CodeObjectRegistry::Contains(Address object) const {
-  return (code_object_registry_newly_allocated_.find(object) !=
-          code_object_registry_newly_allocated_.end()) ||
-         (std::binary_search(code_object_registry_already_existing_.begin(),
-                             code_object_registry_already_existing_.end(),
-                             object));
-}
-
-Address CodeObjectRegistry::GetCodeObjectStartFromInnerAddress(
-    Address address) const {
-  // Let's first find the object which comes right before address in the vector
-  // of already existing code objects.
-  Address already_existing_set_ = 0;
-  Address newly_allocated_set_ = 0;
-  if (!code_object_registry_already_existing_.empty()) {
-    auto it =
-        std::upper_bound(code_object_registry_already_existing_.begin(),
-                         code_object_registry_already_existing_.end(), address);
-    if (it != code_object_registry_already_existing_.begin()) {
-      already_existing_set_ = *(--it);
-    }
-  }
-
-  // Next, let's find the object which comes right before address in the set
-  // of newly allocated code objects.
-  if (!code_object_registry_newly_allocated_.empty()) {
-    auto it = code_object_registry_newly_allocated_.upper_bound(address);
-    if (it != code_object_registry_newly_allocated_.begin()) {
-      newly_allocated_set_ = *(--it);
-    }
-  }
-
-  // The code objects which contains address has to be in one of the two
-  // data structures.
-  DCHECK(already_existing_set_ != 0 || newly_allocated_set_ != 0);
-
-  // The address which is closest to the given address is the code object.
-  return already_existing_set_ > newly_allocated_set_ ? already_existing_set_
-                                                      : newly_allocated_set_;
-}
-
-namespace {
-
-PageAllocator::Permission DefaultWritableCodePermissions() {
-  return FLAG_jitless ? PageAllocator::kReadWrite
-                      : PageAllocator::kReadWriteExecute;
-}
-
-}  // namespace
-
-MemoryChunk* MemoryChunk::Initialize(Heap* heap, Address base, size_t size,
-                                     Address area_start, Address area_end,
-                                     Executability executable, Space* owner,
-                                     VirtualMemory reservation) {
-  MemoryChunk* chunk = FromAddress(base);
-  DCHECK_EQ(base, chunk->address());
-  new (chunk) BasicMemoryChunk(size, area_start, area_end);
-
-  chunk->heap_ = heap;
-  chunk->set_owner(owner);
-  chunk->InitializeReservedMemory();
-  base::AsAtomicPointer::Release_Store(&chunk->slot_set_[OLD_TO_NEW], nullptr);
-  base::AsAtomicPointer::Release_Store(&chunk->slot_set_[OLD_TO_OLD], nullptr);
-  base::AsAtomicPointer::Release_Store(&chunk->sweeping_slot_set_, nullptr);
-  base::AsAtomicPointer::Release_Store(&chunk->typed_slot_set_[OLD_TO_NEW],
-                                       nullptr);
-  base::AsAtomicPointer::Release_Store(&chunk->typed_slot_set_[OLD_TO_OLD],
-                                       nullptr);
-  chunk->invalidated_slots_[OLD_TO_NEW] = nullptr;
-  chunk->invalidated_slots_[OLD_TO_OLD] = nullptr;
-  chunk->progress_bar_ = 0;
-  chunk->high_water_mark_ = static_cast<intptr_t>(area_start - base);
-  chunk->set_concurrent_sweeping_state(ConcurrentSweepingState::kDone);
-  chunk->page_protection_change_mutex_ = new base::Mutex();
-  chunk->write_unprotect_counter_ = 0;
-  chunk->mutex_ = new base::Mutex();
-  chunk->allocated_bytes_ = chunk->area_size();
-  chunk->wasted_memory_ = 0;
-  chunk->young_generation_bitmap_ = nullptr;
-  chunk->local_tracker_ = nullptr;
-
-  chunk->external_backing_store_bytes_[ExternalBackingStoreType::kArrayBuffer] =
-      0;
-  chunk->external_backing_store_bytes_
-      [ExternalBackingStoreType::kExternalString] = 0;
-
-  chunk->categories_ = nullptr;
-
-  heap->incremental_marking()->non_atomic_marking_state()->SetLiveBytes(chunk,
-                                                                        0);
-  if (owner->identity() == RO_SPACE) {
-    heap->incremental_marking()
-        ->non_atomic_marking_state()
-        ->bitmap(chunk)
-        ->MarkAllBits();
-    chunk->SetFlag(READ_ONLY_HEAP);
-  }
-
-  if (executable == EXECUTABLE) {
-    chunk->SetFlag(IS_EXECUTABLE);
-    if (heap->write_protect_code_memory()) {
-      chunk->write_unprotect_counter_ =
-          heap->code_space_memory_modification_scope_depth();
-    } else {
-      size_t page_size = MemoryAllocator::GetCommitPageSize();
-      DCHECK(IsAligned(area_start, page_size));
-      size_t area_size = RoundUp(area_end - area_start, page_size);
-      CHECK(reservation.SetPermissions(area_start, area_size,
-                                       DefaultWritableCodePermissions()));
-    }
-  }
-
-  chunk->reservation_ = std::move(reservation);
-
-  if (owner->identity() == CODE_SPACE) {
-    chunk->code_object_registry_ = new CodeObjectRegistry();
-  } else {
-    chunk->code_object_registry_ = nullptr;
-  }
-
-  chunk->possibly_empty_buckets_.Initialize();
-
-  return chunk;
-}
-
-Page* PagedSpace::InitializePage(MemoryChunk* chunk) {
-  Page* page = static_cast<Page*>(chunk);
-  DCHECK_EQ(
-      MemoryChunkLayout::AllocatableMemoryInMemoryChunk(page->owner_identity()),
-      page->area_size());
-  // Make sure that categories are initialized before freeing the area.
-  page->ResetAllocationStatistics();
-  page->SetOldGenerationPageFlags(!is_off_thread_space() &&
-                                  heap()->incremental_marking()->IsMarking());
-  page->AllocateFreeListCategories();
-  page->InitializeFreeListCategories();
-  page->list_node().Initialize();
-  page->InitializationMemoryFence();
-  return page;
-}
-
-Page* SemiSpace::InitializePage(MemoryChunk* chunk) {
-  bool in_to_space = (id() != kFromSpace);
-  chunk->SetFlag(in_to_space ? MemoryChunk::TO_PAGE : MemoryChunk::FROM_PAGE);
-  Page* page = static_cast<Page*>(chunk);
-  page->SetYoungGenerationPageFlags(heap()->incremental_marking()->IsMarking());
-  page->AllocateLocalTracker();
-  page->list_node().Initialize();
-#ifdef ENABLE_MINOR_MC
-  if (FLAG_minor_mc) {
-    page->AllocateYoungGenerationBitmap();
-    heap()
-        ->minor_mark_compact_collector()
-        ->non_atomic_marking_state()
-        ->ClearLiveness(page);
-  }
-#endif  // ENABLE_MINOR_MC
-  page->InitializationMemoryFence();
-  return page;
-}
-
-LargePage* LargePage::Initialize(Heap* heap, MemoryChunk* chunk,
-                                 Executability executable) {
-  if (executable && chunk->size() > LargePage::kMaxCodePageSize) {
-    STATIC_ASSERT(LargePage::kMaxCodePageSize <= TypedSlotSet::kMaxOffset);
-    FATAL("Code page is too large.");
-  }
-
-  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(chunk->area_start(), chunk->area_size());
-
-  LargePage* page = static_cast<LargePage*>(chunk);
-  page->SetFlag(MemoryChunk::LARGE_PAGE);
-  page->list_node().Initialize();
-  return page;
-}
-
 void Page::AllocateFreeListCategories() {
   DCHECK_NULL(categories_);
-  categories_ = new FreeListCategory*[free_list()->number_of_categories()]();
-  for (int i = kFirstCategory; i <= free_list()->last_category(); i++) {
+  categories_ =
+      new FreeListCategory*[owner()->free_list()->number_of_categories()]();
+  for (int i = kFirstCategory; i <= owner()->free_list()->last_category();
+       i++) {
     DCHECK_NULL(categories_[i]);
     categories_[i] = new FreeListCategory();
   }
 }
 
 void Page::InitializeFreeListCategories() {
-  for (int i = kFirstCategory; i <= free_list()->last_category(); i++) {
+  for (int i = kFirstCategory; i <= owner()->free_list()->last_category();
+       i++) {
     categories_[i]->Initialize(static_cast<FreeListCategoryType>(i));
   }
 }
 
 void Page::ReleaseFreeListCategories() {
   if (categories_ != nullptr) {
-    for (int i = kFirstCategory; i <= free_list()->last_category(); i++) {
+    for (int i = kFirstCategory; i <= owner()->free_list()->last_category();
+         i++) {
       if (categories_[i] != nullptr) {
         delete categories_[i];
         categories_[i] = nullptr;
@@ -872,167 +130,6 @@ void Page::MergeOldToNewRememberedSets() {
   sweeping_slot_set_ = nullptr;
 }
 
-size_t MemoryChunk::CommittedPhysicalMemory() {
-  if (!base::OS::HasLazyCommits() || owner_identity() == LO_SPACE)
-    return size();
-  return high_water_mark_;
-}
-
-bool MemoryChunk::InOldSpace() const { return owner_identity() == OLD_SPACE; }
-
-bool MemoryChunk::InLargeObjectSpace() const {
-  return owner_identity() == LO_SPACE;
-}
-
-MemoryChunk* MemoryAllocator::AllocateChunk(size_t reserve_area_size,
-                                            size_t commit_area_size,
-                                            Executability executable,
-                                            Space* owner) {
-  DCHECK_LE(commit_area_size, reserve_area_size);
-
-  size_t chunk_size;
-  Heap* heap = isolate_->heap();
-  Address base = kNullAddress;
-  VirtualMemory reservation;
-  Address area_start = kNullAddress;
-  Address area_end = kNullAddress;
-  void* address_hint =
-      AlignedAddress(heap->GetRandomMmapAddr(), MemoryChunk::kAlignment);
-
-  //
-  // MemoryChunk layout:
-  //
-  //             Executable
-  // +----------------------------+<- base aligned with MemoryChunk::kAlignment
-  // |           Header           |
-  // +----------------------------+<- base + CodePageGuardStartOffset
-  // |           Guard            |
-  // +----------------------------+<- area_start_
-  // |           Area             |
-  // +----------------------------+<- area_end_ (area_start + commit_area_size)
-  // |   Committed but not used   |
-  // +----------------------------+<- aligned at OS page boundary
-  // | Reserved but not committed |
-  // +----------------------------+<- aligned at OS page boundary
-  // |           Guard            |
-  // +----------------------------+<- base + chunk_size
-  //
-  //           Non-executable
-  // +----------------------------+<- base aligned with MemoryChunk::kAlignment
-  // |          Header            |
-  // +----------------------------+<- area_start_ (base + area_start_)
-  // |           Area             |
-  // +----------------------------+<- area_end_ (area_start + commit_area_size)
-  // |  Committed but not used    |
-  // +----------------------------+<- aligned at OS page boundary
-  // | Reserved but not committed |
-  // +----------------------------+<- base + chunk_size
-  //
-
-  if (executable == EXECUTABLE) {
-    chunk_size = ::RoundUp(MemoryChunkLayout::ObjectStartOffsetInCodePage() +
-                               reserve_area_size +
-                               MemoryChunkLayout::CodePageGuardSize(),
-                           GetCommitPageSize());
-
-    // Size of header (not executable) plus area (executable).
-    size_t commit_size = ::RoundUp(
-        MemoryChunkLayout::CodePageGuardStartOffset() + commit_area_size,
-        GetCommitPageSize());
-    base =
-        AllocateAlignedMemory(chunk_size, commit_size, MemoryChunk::kAlignment,
-                              executable, address_hint, &reservation);
-    if (base == kNullAddress) return nullptr;
-    // Update executable memory size.
-    size_executable_ += reservation.size();
-
-    if (Heap::ShouldZapGarbage()) {
-      ZapBlock(base, MemoryChunkLayout::CodePageGuardStartOffset(), kZapValue);
-      ZapBlock(base + MemoryChunkLayout::ObjectStartOffsetInCodePage(),
-               commit_area_size, kZapValue);
-    }
-
-    area_start = base + MemoryChunkLayout::ObjectStartOffsetInCodePage();
-    area_end = area_start + commit_area_size;
-  } else {
-    chunk_size = ::RoundUp(
-        MemoryChunkLayout::ObjectStartOffsetInDataPage() + reserve_area_size,
-        GetCommitPageSize());
-    size_t commit_size = ::RoundUp(
-        MemoryChunkLayout::ObjectStartOffsetInDataPage() + commit_area_size,
-        GetCommitPageSize());
-    base =
-        AllocateAlignedMemory(chunk_size, commit_size, MemoryChunk::kAlignment,
-                              executable, address_hint, &reservation);
-
-    if (base == kNullAddress) return nullptr;
-
-    if (Heap::ShouldZapGarbage()) {
-      ZapBlock(
-          base,
-          MemoryChunkLayout::ObjectStartOffsetInDataPage() + commit_area_size,
-          kZapValue);
-    }
-
-    area_start = base + MemoryChunkLayout::ObjectStartOffsetInDataPage();
-    area_end = area_start + commit_area_size;
-  }
-
-  // Use chunk_size for statistics and callbacks because we assume that they
-  // treat reserved but not-yet committed memory regions of chunks as allocated.
-  isolate_->counters()->memory_allocated()->Increment(
-      static_cast<int>(chunk_size));
-
-  LOG(isolate_,
-      NewEvent("MemoryChunk", reinterpret_cast<void*>(base), chunk_size));
-
-  // We cannot use the last chunk in the address space because we would
-  // overflow when comparing top and limit if this chunk is used for a
-  // linear allocation area.
-  if ((base + chunk_size) == 0u) {
-    CHECK(!last_chunk_.IsReserved());
-    last_chunk_ = std::move(reservation);
-    UncommitMemory(&last_chunk_);
-    size_ -= chunk_size;
-    if (executable == EXECUTABLE) {
-      size_executable_ -= chunk_size;
-    }
-    CHECK(last_chunk_.IsReserved());
-    return AllocateChunk(reserve_area_size, commit_area_size, executable,
-                         owner);
-  }
-
-  MemoryChunk* chunk =
-      MemoryChunk::Initialize(heap, base, chunk_size, area_start, area_end,
-                              executable, owner, std::move(reservation));
-
-  if (chunk->executable()) RegisterExecutableMemoryChunk(chunk);
-  return chunk;
-}
-
-void MemoryChunk::SetOldGenerationPageFlags(bool is_marking) {
-  if (is_marking) {
-    SetFlag(MemoryChunk::POINTERS_TO_HERE_ARE_INTERESTING);
-    SetFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
-    SetFlag(MemoryChunk::INCREMENTAL_MARKING);
-  } else {
-    ClearFlag(MemoryChunk::POINTERS_TO_HERE_ARE_INTERESTING);
-    SetFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
-    ClearFlag(MemoryChunk::INCREMENTAL_MARKING);
-  }
-}
-
-void MemoryChunk::SetYoungGenerationPageFlags(bool is_marking) {
-  SetFlag(MemoryChunk::POINTERS_TO_HERE_ARE_INTERESTING);
-  if (is_marking) {
-    SetFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
-    SetFlag(MemoryChunk::INCREMENTAL_MARKING);
-  } else {
-    ClearFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
-    ClearFlag(MemoryChunk::INCREMENTAL_MARKING);
-  }
-}
-
 void Page::ResetAllocationStatistics() {
   allocated_bytes_ = area_size();
   wasted_memory_ = 0;
@@ -1129,6 +226,19 @@ void Page::CreateBlackArea(Address start, Address end) {
   marking_state->IncrementLiveBytes(this, static_cast<intptr_t>(end - start));
 }
 
+void Page::CreateBlackAreaBackground(Address start, Address end) {
+  DCHECK(heap()->incremental_marking()->black_allocation());
+  DCHECK_EQ(Page::FromAddress(start), this);
+  DCHECK_LT(start, end);
+  DCHECK_EQ(Page::FromAddress(end - 1), this);
+  IncrementalMarking::AtomicMarkingState* marking_state =
+      heap()->incremental_marking()->atomic_marking_state();
+  marking_state->bitmap(this)->SetRange(AddressToMarkbitIndex(start),
+                                        AddressToMarkbitIndex(end));
+  heap()->incremental_marking()->IncrementLiveBytesBackground(
+      this, static_cast<intptr_t>(end - start));
+}
+
 void Page::DestroyBlackArea(Address start, Address end) {
   DCHECK(heap()->incremental_marking()->black_allocation());
   DCHECK_EQ(Page::FromAddress(start), this);
@@ -1141,472 +251,45 @@ void Page::DestroyBlackArea(Address start, Address end) {
   marking_state->IncrementLiveBytes(this, -static_cast<intptr_t>(end - start));
 }
 
-void MemoryAllocator::PartialFreeMemory(MemoryChunk* chunk, Address start_free,
-                                        size_t bytes_to_free,
-                                        Address new_area_end) {
-  VirtualMemory* reservation = chunk->reserved_memory();
-  DCHECK(reservation->IsReserved());
-  chunk->set_size(chunk->size() - bytes_to_free);
-  chunk->set_area_end(new_area_end);
-  if (chunk->IsFlagSet(MemoryChunk::IS_EXECUTABLE)) {
-    // Add guard page at the end.
-    size_t page_size = GetCommitPageSize();
-    DCHECK_EQ(0, chunk->area_end() % static_cast<Address>(page_size));
-    DCHECK_EQ(chunk->address() + chunk->size(),
-              chunk->area_end() + MemoryChunkLayout::CodePageGuardSize());
-    reservation->SetPermissions(chunk->area_end(), page_size,
-                                PageAllocator::kNoAccess);
-  }
-  // On e.g. Windows, a reservation may be larger than a page and releasing
-  // partially starting at |start_free| will also release the potentially
-  // unused part behind the current page.
-  const size_t released_bytes = reservation->Release(start_free);
-  DCHECK_GE(size_, released_bytes);
-  size_ -= released_bytes;
-  isolate_->counters()->memory_allocated()->Decrement(
-      static_cast<int>(released_bytes));
+void Page::DestroyBlackAreaBackground(Address start, Address end) {
+  DCHECK(heap()->incremental_marking()->black_allocation());
+  DCHECK_EQ(Page::FromAddress(start), this);
+  DCHECK_LT(start, end);
+  DCHECK_EQ(Page::FromAddress(end - 1), this);
+  IncrementalMarking::AtomicMarkingState* marking_state =
+      heap()->incremental_marking()->atomic_marking_state();
+  marking_state->bitmap(this)->ClearRange(AddressToMarkbitIndex(start),
+                                          AddressToMarkbitIndex(end));
+  heap()->incremental_marking()->IncrementLiveBytesBackground(
+      this, -static_cast<intptr_t>(end - start));
 }
 
-void MemoryAllocator::UnregisterMemory(MemoryChunk* chunk) {
-  DCHECK(!chunk->IsFlagSet(MemoryChunk::UNREGISTERED));
-  VirtualMemory* reservation = chunk->reserved_memory();
-  const size_t size =
-      reservation->IsReserved() ? reservation->size() : chunk->size();
-  DCHECK_GE(size_, static_cast<size_t>(size));
-  size_ -= size;
-  isolate_->counters()->memory_allocated()->Decrement(static_cast<int>(size));
-  if (chunk->executable() == EXECUTABLE) {
-    DCHECK_GE(size_executable_, size);
-    size_executable_ -= size;
-  }
+// -----------------------------------------------------------------------------
+// PagedSpace implementation
 
-  if (chunk->executable()) UnregisterExecutableMemoryChunk(chunk);
-  chunk->SetFlag(MemoryChunk::UNREGISTERED);
+void Space::AddAllocationObserver(AllocationObserver* observer) {
+  allocation_observers_.push_back(observer);
+  StartNextInlineAllocationStep();
 }
 
-void MemoryAllocator::PreFreeMemory(MemoryChunk* chunk) {
-  DCHECK(!chunk->IsFlagSet(MemoryChunk::PRE_FREED));
-  LOG(isolate_, DeleteEvent("MemoryChunk", chunk));
-  UnregisterMemory(chunk);
-  isolate_->heap()->RememberUnmappedPage(reinterpret_cast<Address>(chunk),
-                                         chunk->IsEvacuationCandidate());
-  chunk->SetFlag(MemoryChunk::PRE_FREED);
+void Space::RemoveAllocationObserver(AllocationObserver* observer) {
+  auto it = std::find(allocation_observers_.begin(),
+                      allocation_observers_.end(), observer);
+  DCHECK(allocation_observers_.end() != it);
+  allocation_observers_.erase(it);
+  StartNextInlineAllocationStep();
 }
 
-void MemoryAllocator::PerformFreeMemory(MemoryChunk* chunk) {
-  DCHECK(chunk->IsFlagSet(MemoryChunk::UNREGISTERED));
-  DCHECK(chunk->IsFlagSet(MemoryChunk::PRE_FREED));
-  chunk->ReleaseAllAllocatedMemory();
+void Space::PauseAllocationObservers() { allocation_observers_paused_ = true; }
 
-  VirtualMemory* reservation = chunk->reserved_memory();
-  if (chunk->IsFlagSet(MemoryChunk::POOLED)) {
-    UncommitMemory(reservation);
-  } else {
-    if (reservation->IsReserved()) {
-      reservation->Free();
-    } else {
-      // Only read-only pages can have non-initialized reservation object.
-      DCHECK_EQ(RO_SPACE, chunk->owner_identity());
-      FreeMemory(page_allocator(chunk->executable()), chunk->address(),
-                 chunk->size());
-    }
-  }
+void Space::ResumeAllocationObservers() {
+  allocation_observers_paused_ = false;
 }
 
-template <MemoryAllocator::FreeMode mode>
-void MemoryAllocator::Free(MemoryChunk* chunk) {
-  switch (mode) {
-    case kFull:
-      PreFreeMemory(chunk);
-      PerformFreeMemory(chunk);
-      break;
-    case kAlreadyPooled:
-      // Pooled pages cannot be touched anymore as their memory is uncommitted.
-      // Pooled pages are not-executable.
-      FreeMemory(data_page_allocator(), chunk->address(),
-                 static_cast<size_t>(MemoryChunk::kPageSize));
-      break;
-    case kPooledAndQueue:
-      DCHECK_EQ(chunk->size(), static_cast<size_t>(MemoryChunk::kPageSize));
-      DCHECK_EQ(chunk->executable(), NOT_EXECUTABLE);
-      chunk->SetFlag(MemoryChunk::POOLED);
-      V8_FALLTHROUGH;
-    case kPreFreeAndQueue:
-      PreFreeMemory(chunk);
-      // The chunks added to this queue will be freed by a concurrent thread.
-      unmapper()->AddMemoryChunkSafe(chunk);
-      break;
-  }
-}
-
-template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE) void MemoryAllocator::Free<
-    MemoryAllocator::kFull>(MemoryChunk* chunk);
-
-template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE) void MemoryAllocator::Free<
-    MemoryAllocator::kAlreadyPooled>(MemoryChunk* chunk);
-
-template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE) void MemoryAllocator::Free<
-    MemoryAllocator::kPreFreeAndQueue>(MemoryChunk* chunk);
-
-template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE) void MemoryAllocator::Free<
-    MemoryAllocator::kPooledAndQueue>(MemoryChunk* chunk);
-
-template <MemoryAllocator::AllocationMode alloc_mode, typename SpaceType>
-Page* MemoryAllocator::AllocatePage(size_t size, SpaceType* owner,
-                                    Executability executable) {
-  MemoryChunk* chunk = nullptr;
-  if (alloc_mode == kPooled) {
-    DCHECK_EQ(size, static_cast<size_t>(
-                        MemoryChunkLayout::AllocatableMemoryInMemoryChunk(
-                            owner->identity())));
-    DCHECK_EQ(executable, NOT_EXECUTABLE);
-    chunk = AllocatePagePooled(owner);
-  }
-  if (chunk == nullptr) {
-    chunk = AllocateChunk(size, size, executable, owner);
-  }
-  if (chunk == nullptr) return nullptr;
-  return owner->InitializePage(chunk);
-}
-
-template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
-    Page* MemoryAllocator::AllocatePage<MemoryAllocator::kRegular, PagedSpace>(
-        size_t size, PagedSpace* owner, Executability executable);
-template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
-    Page* MemoryAllocator::AllocatePage<MemoryAllocator::kRegular, SemiSpace>(
-        size_t size, SemiSpace* owner, Executability executable);
-template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
-    Page* MemoryAllocator::AllocatePage<MemoryAllocator::kPooled, SemiSpace>(
-        size_t size, SemiSpace* owner, Executability executable);
-
-LargePage* MemoryAllocator::AllocateLargePage(size_t size,
-                                              LargeObjectSpace* owner,
-                                              Executability executable) {
-  MemoryChunk* chunk = AllocateChunk(size, size, executable, owner);
-  if (chunk == nullptr) return nullptr;
-  return LargePage::Initialize(isolate_->heap(), chunk, executable);
-}
-
-template <typename SpaceType>
-MemoryChunk* MemoryAllocator::AllocatePagePooled(SpaceType* owner) {
-  MemoryChunk* chunk = unmapper()->TryGetPooledMemoryChunkSafe();
-  if (chunk == nullptr) return nullptr;
-  const int size = MemoryChunk::kPageSize;
-  const Address start = reinterpret_cast<Address>(chunk);
-  const Address area_start =
-      start +
-      MemoryChunkLayout::ObjectStartOffsetInMemoryChunk(owner->identity());
-  const Address area_end = start + size;
-  // Pooled pages are always regular data pages.
-  DCHECK_NE(CODE_SPACE, owner->identity());
-  VirtualMemory reservation(data_page_allocator(), start, size);
-  if (!CommitMemory(&reservation)) return nullptr;
-  if (Heap::ShouldZapGarbage()) {
-    ZapBlock(start, size, kZapValue);
-  }
-  MemoryChunk::Initialize(isolate_->heap(), start, size, area_start, area_end,
-                          NOT_EXECUTABLE, owner, std::move(reservation));
-  size_ += size;
-  return chunk;
-}
-
-void MemoryAllocator::ZapBlock(Address start, size_t size,
-                               uintptr_t zap_value) {
-  DCHECK(IsAligned(start, kTaggedSize));
-  DCHECK(IsAligned(size, kTaggedSize));
-  MemsetTagged(ObjectSlot(start), Object(static_cast<Address>(zap_value)),
-               size >> kTaggedSizeLog2);
-}
-
-intptr_t MemoryAllocator::GetCommitPageSize() {
-  if (FLAG_v8_os_page_size != 0) {
-    DCHECK(base::bits::IsPowerOfTwo(FLAG_v8_os_page_size));
-    return FLAG_v8_os_page_size * KB;
-  } else {
-    return CommitPageSize();
-  }
-}
-
-base::AddressRegion MemoryAllocator::ComputeDiscardMemoryArea(Address addr,
-                                                              size_t size) {
-  size_t page_size = MemoryAllocator::GetCommitPageSize();
-  if (size < page_size + FreeSpace::kSize) {
-    return base::AddressRegion(0, 0);
-  }
-  Address discardable_start = RoundUp(addr + FreeSpace::kSize, page_size);
-  Address discardable_end = RoundDown(addr + size, page_size);
-  if (discardable_start >= discardable_end) return base::AddressRegion(0, 0);
-  return base::AddressRegion(discardable_start,
-                             discardable_end - discardable_start);
-}
-
-bool MemoryAllocator::CommitExecutableMemory(VirtualMemory* vm, Address start,
-                                             size_t commit_size,
-                                             size_t reserved_size) {
-  const size_t page_size = GetCommitPageSize();
-  // All addresses and sizes must be aligned to the commit page size.
-  DCHECK(IsAligned(start, page_size));
-  DCHECK_EQ(0, commit_size % page_size);
-  DCHECK_EQ(0, reserved_size % page_size);
-  const size_t guard_size = MemoryChunkLayout::CodePageGuardSize();
-  const size_t pre_guard_offset = MemoryChunkLayout::CodePageGuardStartOffset();
-  const size_t code_area_offset =
-      MemoryChunkLayout::ObjectStartOffsetInCodePage();
-  // reserved_size includes two guard regions, commit_size does not.
-  DCHECK_LE(commit_size, reserved_size - 2 * guard_size);
-  const Address pre_guard_page = start + pre_guard_offset;
-  const Address code_area = start + code_area_offset;
-  const Address post_guard_page = start + reserved_size - guard_size;
-  // Commit the non-executable header, from start to pre-code guard page.
-  if (vm->SetPermissions(start, pre_guard_offset, PageAllocator::kReadWrite)) {
-    // Create the pre-code guard page, following the header.
-    if (vm->SetPermissions(pre_guard_page, page_size,
-                           PageAllocator::kNoAccess)) {
-      // Commit the executable code body.
-      if (vm->SetPermissions(code_area, commit_size - pre_guard_offset,
-                             PageAllocator::kReadWrite)) {
-        // Create the post-code guard page.
-        if (vm->SetPermissions(post_guard_page, page_size,
-                               PageAllocator::kNoAccess)) {
-          UpdateAllocatedSpaceLimits(start, code_area + commit_size);
-          return true;
-        }
-        vm->SetPermissions(code_area, commit_size, PageAllocator::kNoAccess);
-      }
-    }
-    vm->SetPermissions(start, pre_guard_offset, PageAllocator::kNoAccess);
-  }
-  return false;
-}
-
-
-// -----------------------------------------------------------------------------
-// MemoryChunk implementation
-
-void MemoryChunk::ReleaseAllocatedMemoryNeededForWritableChunk() {
-  if (mutex_ != nullptr) {
-    delete mutex_;
-    mutex_ = nullptr;
-  }
-  if (page_protection_change_mutex_ != nullptr) {
-    delete page_protection_change_mutex_;
-    page_protection_change_mutex_ = nullptr;
-  }
-  if (code_object_registry_ != nullptr) {
-    delete code_object_registry_;
-    code_object_registry_ = nullptr;
-  }
-
-  possibly_empty_buckets_.Release();
-  ReleaseSlotSet<OLD_TO_NEW>();
-  ReleaseSweepingSlotSet();
-  ReleaseSlotSet<OLD_TO_OLD>();
-  ReleaseTypedSlotSet<OLD_TO_NEW>();
-  ReleaseTypedSlotSet<OLD_TO_OLD>();
-  ReleaseInvalidatedSlots<OLD_TO_NEW>();
-  ReleaseInvalidatedSlots<OLD_TO_OLD>();
-
-  if (local_tracker_ != nullptr) ReleaseLocalTracker();
-  if (young_generation_bitmap_ != nullptr) ReleaseYoungGenerationBitmap();
-}
-
-void MemoryChunk::ReleaseAllAllocatedMemory() {
-  if (!IsLargePage()) {
-    Page* page = static_cast<Page*>(this);
-    page->ReleaseFreeListCategories();
-  }
-
-  ReleaseAllocatedMemoryNeededForWritableChunk();
-  if (marking_bitmap_ != nullptr) ReleaseMarkingBitmap();
-}
-
-template V8_EXPORT_PRIVATE SlotSet* MemoryChunk::AllocateSlotSet<OLD_TO_NEW>();
-template V8_EXPORT_PRIVATE SlotSet* MemoryChunk::AllocateSlotSet<OLD_TO_OLD>();
-
-template <RememberedSetType type>
-SlotSet* MemoryChunk::AllocateSlotSet() {
-  return AllocateSlotSet(&slot_set_[type]);
-}
-
-SlotSet* MemoryChunk::AllocateSweepingSlotSet() {
-  return AllocateSlotSet(&sweeping_slot_set_);
-}
-
-SlotSet* MemoryChunk::AllocateSlotSet(SlotSet** slot_set) {
-  SlotSet* new_slot_set = SlotSet::Allocate(buckets());
-  SlotSet* old_slot_set = base::AsAtomicPointer::AcquireRelease_CompareAndSwap(
-      slot_set, nullptr, new_slot_set);
-  if (old_slot_set != nullptr) {
-    SlotSet::Delete(new_slot_set, buckets());
-    new_slot_set = old_slot_set;
-  }
-  DCHECK(new_slot_set);
-  return new_slot_set;
-}
-
-template void MemoryChunk::ReleaseSlotSet<OLD_TO_NEW>();
-template void MemoryChunk::ReleaseSlotSet<OLD_TO_OLD>();
-
-template <RememberedSetType type>
-void MemoryChunk::ReleaseSlotSet() {
-  ReleaseSlotSet(&slot_set_[type]);
-}
-
-void MemoryChunk::ReleaseSweepingSlotSet() {
-  ReleaseSlotSet(&sweeping_slot_set_);
-}
-
-void MemoryChunk::ReleaseSlotSet(SlotSet** slot_set) {
-  if (*slot_set) {
-    SlotSet::Delete(*slot_set, buckets());
-    *slot_set = nullptr;
-  }
-}
-
-template TypedSlotSet* MemoryChunk::AllocateTypedSlotSet<OLD_TO_NEW>();
-template TypedSlotSet* MemoryChunk::AllocateTypedSlotSet<OLD_TO_OLD>();
-
-template <RememberedSetType type>
-TypedSlotSet* MemoryChunk::AllocateTypedSlotSet() {
-  TypedSlotSet* typed_slot_set = new TypedSlotSet(address());
-  TypedSlotSet* old_value = base::AsAtomicPointer::Release_CompareAndSwap(
-      &typed_slot_set_[type], nullptr, typed_slot_set);
-  if (old_value != nullptr) {
-    delete typed_slot_set;
-    typed_slot_set = old_value;
-  }
-  DCHECK(typed_slot_set);
-  return typed_slot_set;
-}
-
-template void MemoryChunk::ReleaseTypedSlotSet<OLD_TO_NEW>();
-template void MemoryChunk::ReleaseTypedSlotSet<OLD_TO_OLD>();
-
-template <RememberedSetType type>
-void MemoryChunk::ReleaseTypedSlotSet() {
-  TypedSlotSet* typed_slot_set = typed_slot_set_[type];
-  if (typed_slot_set) {
-    typed_slot_set_[type] = nullptr;
-    delete typed_slot_set;
-  }
-}
-
-template InvalidatedSlots* MemoryChunk::AllocateInvalidatedSlots<OLD_TO_NEW>();
-template InvalidatedSlots* MemoryChunk::AllocateInvalidatedSlots<OLD_TO_OLD>();
-
-template <RememberedSetType type>
-InvalidatedSlots* MemoryChunk::AllocateInvalidatedSlots() {
-  DCHECK_NULL(invalidated_slots_[type]);
-  invalidated_slots_[type] = new InvalidatedSlots();
-  return invalidated_slots_[type];
-}
-
-template void MemoryChunk::ReleaseInvalidatedSlots<OLD_TO_NEW>();
-template void MemoryChunk::ReleaseInvalidatedSlots<OLD_TO_OLD>();
-
-template <RememberedSetType type>
-void MemoryChunk::ReleaseInvalidatedSlots() {
-  if (invalidated_slots_[type]) {
-    delete invalidated_slots_[type];
-    invalidated_slots_[type] = nullptr;
-  }
-}
-
-template V8_EXPORT_PRIVATE void
-MemoryChunk::RegisterObjectWithInvalidatedSlots<OLD_TO_NEW>(HeapObject object);
-template V8_EXPORT_PRIVATE void
-MemoryChunk::RegisterObjectWithInvalidatedSlots<OLD_TO_OLD>(HeapObject object);
-
-template <RememberedSetType type>
-void MemoryChunk::RegisterObjectWithInvalidatedSlots(HeapObject object) {
-  bool skip_slot_recording;
-
-  if (type == OLD_TO_NEW) {
-    skip_slot_recording = InYoungGeneration();
-  } else {
-    skip_slot_recording = ShouldSkipEvacuationSlotRecording();
-  }
-
-  if (skip_slot_recording) {
-    return;
-  }
-
-  if (invalidated_slots<type>() == nullptr) {
-    AllocateInvalidatedSlots<type>();
-  }
-
-  invalidated_slots<type>()->insert(object);
-}
-
-void MemoryChunk::InvalidateRecordedSlots(HeapObject object) {
-  if (V8_DISABLE_WRITE_BARRIERS_BOOL) return;
-  if (heap()->incremental_marking()->IsCompacting()) {
-    // We cannot check slot_set_[OLD_TO_OLD] here, since the
-    // concurrent markers might insert slots concurrently.
-    RegisterObjectWithInvalidatedSlots<OLD_TO_OLD>(object);
-  }
-
-  if (!FLAG_always_promote_young_mc || slot_set_[OLD_TO_NEW] != nullptr)
-    RegisterObjectWithInvalidatedSlots<OLD_TO_NEW>(object);
-}
-
-template bool MemoryChunk::RegisteredObjectWithInvalidatedSlots<OLD_TO_NEW>(
-    HeapObject object);
-template bool MemoryChunk::RegisteredObjectWithInvalidatedSlots<OLD_TO_OLD>(
-    HeapObject object);
-
-template <RememberedSetType type>
-bool MemoryChunk::RegisteredObjectWithInvalidatedSlots(HeapObject object) {
-  if (invalidated_slots<type>() == nullptr) {
-    return false;
-  }
-  return invalidated_slots<type>()->find(object) !=
-         invalidated_slots<type>()->end();
-}
-
-void MemoryChunk::ReleaseLocalTracker() {
-  DCHECK_NOT_NULL(local_tracker_);
-  delete local_tracker_;
-  local_tracker_ = nullptr;
-}
-
-void MemoryChunk::AllocateYoungGenerationBitmap() {
-  DCHECK_NULL(young_generation_bitmap_);
-  young_generation_bitmap_ = static_cast<Bitmap*>(calloc(1, Bitmap::kSize));
-}
-
-void MemoryChunk::ReleaseYoungGenerationBitmap() {
-  DCHECK_NOT_NULL(young_generation_bitmap_);
-  free(young_generation_bitmap_);
-  young_generation_bitmap_ = nullptr;
-}
-
-// -----------------------------------------------------------------------------
-// PagedSpace implementation
-
-void Space::AddAllocationObserver(AllocationObserver* observer) {
-  allocation_observers_.push_back(observer);
-  StartNextInlineAllocationStep();
-}
-
-void Space::RemoveAllocationObserver(AllocationObserver* observer) {
-  auto it = std::find(allocation_observers_.begin(),
-                      allocation_observers_.end(), observer);
-  DCHECK(allocation_observers_.end() != it);
-  allocation_observers_.erase(it);
-  StartNextInlineAllocationStep();
-}
-
-void Space::PauseAllocationObservers() { allocation_observers_paused_ = true; }
-
-void Space::ResumeAllocationObservers() {
-  allocation_observers_paused_ = false;
-}
-
-void Space::AllocationStep(int bytes_since_last, Address soon_object,
-                           int size) {
-  if (!AllocationObserversActive()) {
-    return;
+void Space::AllocationStep(int bytes_since_last, Address soon_object,
+                           int size) {
+  if (!AllocationObserversActive()) {
+    return;
   }
 
   DCHECK(!heap()->allocation_step_in_progress());
@@ -1641,300 +324,6 @@ intptr_t Space::GetNextInlineAllocationStepSize() {
   return next_step;
 }
 
-PagedSpace::PagedSpace(Heap* heap, AllocationSpace space,
-                       Executability executable, FreeList* free_list,
-                       LocalSpaceKind local_space_kind)
-    : SpaceWithLinearArea(heap, space, free_list),
-      executable_(executable),
-      local_space_kind_(local_space_kind) {
-  area_size_ = MemoryChunkLayout::AllocatableMemoryInMemoryChunk(space);
-  accounting_stats_.Clear();
-}
-
-void PagedSpace::TearDown() {
-  while (!memory_chunk_list_.Empty()) {
-    MemoryChunk* chunk = memory_chunk_list_.front();
-    memory_chunk_list_.Remove(chunk);
-    heap()->memory_allocator()->Free<MemoryAllocator::kFull>(chunk);
-  }
-  accounting_stats_.Clear();
-}
-
-void PagedSpace::RefillFreeList() {
-  // Any PagedSpace might invoke RefillFreeList. We filter all but our old
-  // generation spaces out.
-  if (identity() != OLD_SPACE && identity() != CODE_SPACE &&
-      identity() != MAP_SPACE && identity() != RO_SPACE) {
-    return;
-  }
-  DCHECK_NE(local_space_kind(), LocalSpaceKind::kOffThreadSpace);
-  DCHECK_IMPLIES(is_local_space(), is_compaction_space());
-  DCHECK(!IsDetached());
-  MarkCompactCollector* collector = heap()->mark_compact_collector();
-  size_t added = 0;
-
-  {
-    Page* p = nullptr;
-    while ((p = collector->sweeper()->GetSweptPageSafe(this)) != nullptr) {
-      // We regularly sweep NEVER_ALLOCATE_ON_PAGE pages. We drop the freelist
-      // entries here to make them unavailable for allocations.
-      if (p->IsFlagSet(Page::NEVER_ALLOCATE_ON_PAGE)) {
-        p->ForAllFreeListCategories([this](FreeListCategory* category) {
-          category->Reset(free_list());
-        });
-      }
-
-      // Also merge old-to-new remembered sets if not scavenging because of
-      // data races: One thread might iterate remembered set, while another
-      // thread merges them.
-      if (local_space_kind() != LocalSpaceKind::kCompactionSpaceForScavenge) {
-        p->MergeOldToNewRememberedSets();
-      }
-
-      // Only during compaction pages can actually change ownership. This is
-      // safe because there exists no other competing action on the page links
-      // during compaction.
-      if (is_compaction_space()) {
-        DCHECK_NE(this, p->owner());
-        PagedSpace* owner = reinterpret_cast<PagedSpace*>(p->owner());
-        base::MutexGuard guard(owner->mutex());
-        owner->RefineAllocatedBytesAfterSweeping(p);
-        owner->RemovePage(p);
-        added += AddPage(p);
-      } else {
-        base::MutexGuard guard(mutex());
-        DCHECK_EQ(this, p->owner());
-        RefineAllocatedBytesAfterSweeping(p);
-        added += RelinkFreeListCategories(p);
-      }
-      added += p->wasted_memory();
-      if (is_compaction_space() && (added > kCompactionMemoryWanted)) break;
-    }
-  }
-}
-
-void OffThreadSpace::RefillFreeList() {
-  // We should never try to refill the free list in off-thread space, because
-  // we know it will always be fully linear.
-  UNREACHABLE();
-}
-
-void PagedSpace::MergeLocalSpace(LocalSpace* other) {
-  base::MutexGuard guard(mutex());
-
-  DCHECK(identity() == other->identity());
-
-  // Unmerged fields:
-  //   area_size_
-  other->FreeLinearAllocationArea();
-
-  for (int i = static_cast<int>(AllocationOrigin::kFirstAllocationOrigin);
-       i <= static_cast<int>(AllocationOrigin::kLastAllocationOrigin); i++) {
-    allocations_origins_[i] += other->allocations_origins_[i];
-  }
-
-  // The linear allocation area of {other} should be destroyed now.
-  DCHECK_EQ(kNullAddress, other->top());
-  DCHECK_EQ(kNullAddress, other->limit());
-
-  bool merging_from_off_thread = other->is_off_thread_space();
-
-  // Move over pages.
-  for (auto it = other->begin(); it != other->end();) {
-    Page* p = *(it++);
-
-    if (merging_from_off_thread) {
-      DCHECK_NULL(p->sweeping_slot_set());
-      p->SetOldGenerationPageFlags(heap()->incremental_marking()->IsMarking());
-      if (heap()->incremental_marking()->black_allocation()) {
-        p->CreateBlackArea(p->area_start(), p->HighWaterMark());
-      }
-    } else {
-      p->MergeOldToNewRememberedSets();
-    }
-
-    // Relinking requires the category to be unlinked.
-    other->RemovePage(p);
-    AddPage(p);
-    // These code pages were allocated by the CompactionSpace.
-    if (identity() == CODE_SPACE) heap()->isolate()->AddCodeMemoryChunk(p);
-    DCHECK_IMPLIES(
-        !p->IsFlagSet(Page::NEVER_ALLOCATE_ON_PAGE),
-        p->AvailableInFreeList() == p->AvailableInFreeListFromAllocatedBytes());
-
-    if (merging_from_off_thread) {
-      // TODO(leszeks): Allocation groups are currently not handled properly by
-      // the sampling allocation profiler. We'll have to come up with a better
-      // solution for allocation stepping before shipping.
-      AllocationStepAfterMerge(
-          p->area_start(),
-          static_cast<int>(p->HighWaterMark() - p->area_start()));
-    }
-  }
-
-  if (merging_from_off_thread) {
-    heap()->NotifyOffThreadSpaceMerged();
-  }
-
-  DCHECK_EQ(0u, other->Size());
-  DCHECK_EQ(0u, other->Capacity());
-}
-
-size_t PagedSpace::CommittedPhysicalMemory() {
-  if (!base::OS::HasLazyCommits()) return CommittedMemory();
-  MemoryChunk::UpdateHighWaterMark(allocation_info_.top());
-  size_t size = 0;
-  for (Page* page : *this) {
-    size += page->CommittedPhysicalMemory();
-  }
-  return size;
-}
-
-bool PagedSpace::ContainsSlow(Address addr) {
-  Page* p = Page::FromAddress(addr);
-  for (Page* page : *this) {
-    if (page == p) return true;
-  }
-  return false;
-}
-
-void PagedSpace::RefineAllocatedBytesAfterSweeping(Page* page) {
-  CHECK(page->SweepingDone());
-  auto marking_state =
-      heap()->incremental_marking()->non_atomic_marking_state();
-  // The live_byte on the page was accounted in the space allocated
-  // bytes counter. After sweeping allocated_bytes() contains the
-  // accurate live byte count on the page.
-  size_t old_counter = marking_state->live_bytes(page);
-  size_t new_counter = page->allocated_bytes();
-  DCHECK_GE(old_counter, new_counter);
-  if (old_counter > new_counter) {
-    DecreaseAllocatedBytes(old_counter - new_counter, page);
-    // Give the heap a chance to adjust counters in response to the
-    // more precise and smaller old generation size.
-    heap()->NotifyRefinedOldGenerationSize(old_counter - new_counter);
-  }
-  marking_state->SetLiveBytes(page, 0);
-}
-
-Page* PagedSpace::RemovePageSafe(int size_in_bytes) {
-  base::MutexGuard guard(mutex());
-  Page* page = free_list()->GetPageForSize(size_in_bytes);
-  if (!page) return nullptr;
-  RemovePage(page);
-  return page;
-}
-
-size_t PagedSpace::AddPage(Page* page) {
-  CHECK(page->SweepingDone());
-  page->set_owner(this);
-  memory_chunk_list_.PushBack(page);
-  AccountCommitted(page->size());
-  IncreaseCapacity(page->area_size());
-  IncreaseAllocatedBytes(page->allocated_bytes(), page);
-  for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
-    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
-    IncrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
-  }
-  return RelinkFreeListCategories(page);
-}
-
-void PagedSpace::RemovePage(Page* page) {
-  CHECK(page->SweepingDone());
-  memory_chunk_list_.Remove(page);
-  UnlinkFreeListCategories(page);
-  DecreaseAllocatedBytes(page->allocated_bytes(), page);
-  DecreaseCapacity(page->area_size());
-  AccountUncommitted(page->size());
-  for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
-    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
-    DecrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
-  }
-}
-
-size_t PagedSpace::ShrinkPageToHighWaterMark(Page* page) {
-  size_t unused = page->ShrinkToHighWaterMark();
-  accounting_stats_.DecreaseCapacity(static_cast<intptr_t>(unused));
-  AccountUncommitted(unused);
-  return unused;
-}
-
-void PagedSpace::ResetFreeList() {
-  for (Page* page : *this) {
-    free_list_->EvictFreeListItems(page);
-  }
-  DCHECK(free_list_->IsEmpty());
-}
-
-void PagedSpace::ShrinkImmortalImmovablePages() {
-  DCHECK(!heap()->deserialization_complete());
-  MemoryChunk::UpdateHighWaterMark(allocation_info_.top());
-  FreeLinearAllocationArea();
-  ResetFreeList();
-  for (Page* page : *this) {
-    DCHECK(page->IsFlagSet(Page::NEVER_EVACUATE));
-    ShrinkPageToHighWaterMark(page);
-  }
-}
-
-bool PagedSpace::Expand() {
-  // Always lock against the main space as we can only adjust capacity and
-  // pages concurrently for the main paged space.
-  base::MutexGuard guard(heap()->paged_space(identity())->mutex());
-
-  const int size = AreaSize();
-
-  if (!heap()->CanExpandOldGeneration(size)) return false;
-
-  Page* page =
-      heap()->memory_allocator()->AllocatePage(size, this, executable());
-  if (page == nullptr) return false;
-  // Pages created during bootstrapping may contain immortal immovable objects.
-  if (!heap()->deserialization_complete()) page->MarkNeverEvacuate();
-  AddPage(page);
-  // If this is a non-compaction code space, this is a previously unseen page.
-  if (identity() == CODE_SPACE && !is_compaction_space()) {
-    heap()->isolate()->AddCodeMemoryChunk(page);
-  }
-  Free(page->area_start(), page->area_size(),
-       SpaceAccountingMode::kSpaceAccounted);
-  heap()->NotifyOldGenerationExpansion();
-  return true;
-}
-
-
-int PagedSpace::CountTotalPages() {
-  int count = 0;
-  for (Page* page : *this) {
-    count++;
-    USE(page);
-  }
-  return count;
-}
-
-void PagedSpace::SetLinearAllocationArea(Address top, Address limit) {
-  SetTopAndLimit(top, limit);
-  if (top != kNullAddress && top != limit && !is_off_thread_space() &&
-      heap()->incremental_marking()->black_allocation()) {
-    Page::FromAllocationAreaAddress(top)->CreateBlackArea(top, limit);
-  }
-}
-
-void PagedSpace::DecreaseLimit(Address new_limit) {
-  Address old_limit = limit();
-  DCHECK_LE(top(), new_limit);
-  DCHECK_GE(old_limit, new_limit);
-  if (new_limit != old_limit) {
-    SetTopAndLimit(top(), new_limit);
-    Free(new_limit, old_limit - new_limit,
-         SpaceAccountingMode::kSpaceAccounted);
-    if (heap()->incremental_marking()->black_allocation()) {
-      Page::FromAllocationAreaAddress(new_limit)->DestroyBlackArea(new_limit,
-                                                                   old_limit);
-    }
-  }
-}
-
 Address SpaceWithLinearArea::ComputeLimit(Address start, Address end,
                                           size_t min_size) {
   DCHECK_GE(end - start, min_size);
@@ -1969,631 +358,61 @@ void SpaceWithLinearArea::PrintAllocationsOrigins() {
       allocations_origins_[2]);
 }
 
-void PagedSpace::MarkLinearAllocationAreaBlack() {
-  DCHECK(heap()->incremental_marking()->black_allocation());
-  Address current_top = top();
-  Address current_limit = limit();
-  if (current_top != kNullAddress && current_top != current_limit) {
-    Page::FromAllocationAreaAddress(current_top)
-        ->CreateBlackArea(current_top, current_limit);
+LinearAllocationArea LocalAllocationBuffer::CloseAndMakeIterable() {
+  if (IsValid()) {
+    MakeIterable();
+    const LinearAllocationArea old_info = allocation_info_;
+    allocation_info_ = LinearAllocationArea(kNullAddress, kNullAddress);
+    return old_info;
   }
+  return LinearAllocationArea(kNullAddress, kNullAddress);
 }
 
-void PagedSpace::UnmarkLinearAllocationArea() {
-  Address current_top = top();
-  Address current_limit = limit();
-  if (current_top != kNullAddress && current_top != current_limit) {
-    Page::FromAllocationAreaAddress(current_top)
-        ->DestroyBlackArea(current_top, current_limit);
+void LocalAllocationBuffer::MakeIterable() {
+  if (IsValid()) {
+    heap_->CreateFillerObjectAt(
+        allocation_info_.top(),
+        static_cast<int>(allocation_info_.limit() - allocation_info_.top()),
+        ClearRecordedSlots::kNo);
   }
 }
 
-void PagedSpace::FreeLinearAllocationArea() {
-  // Mark the old linear allocation area with a free space map so it can be
-  // skipped when scanning the heap.
-  Address current_top = top();
-  Address current_limit = limit();
-  if (current_top == kNullAddress) {
-    DCHECK_EQ(kNullAddress, current_limit);
-    return;
-  }
-
-  if (!is_off_thread_space() &&
-      heap()->incremental_marking()->black_allocation()) {
-    Page* page = Page::FromAllocationAreaAddress(current_top);
-
-    // Clear the bits in the unused black area.
-    if (current_top != current_limit) {
-      IncrementalMarking::MarkingState* marking_state =
-          heap()->incremental_marking()->marking_state();
-      marking_state->bitmap(page)->ClearRange(
-          page->AddressToMarkbitIndex(current_top),
-          page->AddressToMarkbitIndex(current_limit));
-      marking_state->IncrementLiveBytes(
-          page, -static_cast<int>(current_limit - current_top));
-    }
-  }
-
-  InlineAllocationStep(current_top, kNullAddress, kNullAddress, 0);
-  SetTopAndLimit(kNullAddress, kNullAddress);
-  DCHECK_GE(current_limit, current_top);
-
-  // The code page of the linear allocation area needs to be unprotected
-  // because we are going to write a filler into that memory area below.
-  if (identity() == CODE_SPACE) {
-    heap()->UnprotectAndRegisterMemoryChunk(
-        MemoryChunk::FromAddress(current_top));
+LocalAllocationBuffer::LocalAllocationBuffer(
+    Heap* heap, LinearAllocationArea allocation_info) V8_NOEXCEPT
+    : heap_(heap),
+      allocation_info_(allocation_info) {
+  if (IsValid()) {
+    heap_->CreateFillerObjectAt(
+        allocation_info_.top(),
+        static_cast<int>(allocation_info_.limit() - allocation_info_.top()),
+        ClearRecordedSlots::kNo);
   }
-  Free(current_top, current_limit - current_top,
-       SpaceAccountingMode::kSpaceAccounted);
 }
 
-void PagedSpace::ReleasePage(Page* page) {
-  DCHECK_EQ(
-      0, heap()->incremental_marking()->non_atomic_marking_state()->live_bytes(
-             page));
-  DCHECK_EQ(page->owner(), this);
-
-  free_list_->EvictFreeListItems(page);
-
-  if (Page::FromAllocationAreaAddress(allocation_info_.top()) == page) {
-    DCHECK(!top_on_previous_step_);
-    allocation_info_.Reset(kNullAddress, kNullAddress);
-  }
+LocalAllocationBuffer::LocalAllocationBuffer(LocalAllocationBuffer&& other)
+    V8_NOEXCEPT {
+  *this = std::move(other);
+}
 
-  heap()->isolate()->RemoveCodeMemoryChunk(page);
+LocalAllocationBuffer& LocalAllocationBuffer::operator=(
+    LocalAllocationBuffer&& other) V8_NOEXCEPT {
+  heap_ = other.heap_;
+  allocation_info_ = other.allocation_info_;
 
-  AccountUncommitted(page->size());
-  accounting_stats_.DecreaseCapacity(page->area_size());
-  heap()->memory_allocator()->Free<MemoryAllocator::kPreFreeAndQueue>(page);
+  other.allocation_info_.Reset(kNullAddress, kNullAddress);
+  return *this;
 }
-
-void PagedSpace::SetReadable() {
-  DCHECK(identity() == CODE_SPACE);
-  for (Page* page : *this) {
-    CHECK(heap()->memory_allocator()->IsMemoryChunkExecutable(page));
-    page->SetReadable();
+void SpaceWithLinearArea::StartNextInlineAllocationStep() {
+  if (heap()->allocation_step_in_progress()) {
+    // If we are mid-way through an existing step, don't start a new one.
+    return;
   }
-}
 
-void PagedSpace::SetReadAndExecutable() {
-  DCHECK(identity() == CODE_SPACE);
-  for (Page* page : *this) {
-    CHECK(heap()->memory_allocator()->IsMemoryChunkExecutable(page));
-    page->SetReadAndExecutable();
-  }
-}
-
-void PagedSpace::SetReadAndWritable() {
-  DCHECK(identity() == CODE_SPACE);
-  for (Page* page : *this) {
-    CHECK(heap()->memory_allocator()->IsMemoryChunkExecutable(page));
-    page->SetReadAndWritable();
-  }
-}
-
-std::unique_ptr<ObjectIterator> PagedSpace::GetObjectIterator(Heap* heap) {
-  return std::unique_ptr<ObjectIterator>(
-      new PagedSpaceObjectIterator(heap, this));
-}
-
-bool PagedSpace::RefillLinearAllocationAreaFromFreeList(
-    size_t size_in_bytes, AllocationOrigin origin) {
-  DCHECK(IsAligned(size_in_bytes, kTaggedSize));
-  DCHECK_LE(top(), limit());
-#ifdef DEBUG
-  if (top() != limit()) {
-    DCHECK_EQ(Page::FromAddress(top()), Page::FromAddress(limit() - 1));
-  }
-#endif
-  // Don't free list allocate if there is linear space available.
-  DCHECK_LT(static_cast<size_t>(limit() - top()), size_in_bytes);
-
-  // Mark the old linear allocation area with a free space map so it can be
-  // skipped when scanning the heap.  This also puts it back in the free list
-  // if it is big enough.
-  FreeLinearAllocationArea();
-
-  if (!is_local_space()) {
-    heap()->StartIncrementalMarkingIfAllocationLimitIsReached(
-        heap()->GCFlagsForIncrementalMarking(),
-        kGCCallbackScheduleIdleGarbageCollection);
-  }
-
-  size_t new_node_size = 0;
-  FreeSpace new_node =
-      free_list_->Allocate(size_in_bytes, &new_node_size, origin);
-  if (new_node.is_null()) return false;
-  DCHECK_GE(new_node_size, size_in_bytes);
-
-  // The old-space-step might have finished sweeping and restarted marking.
-  // Verify that it did not turn the page of the new node into an evacuation
-  // candidate.
-  DCHECK(!MarkCompactCollector::IsOnEvacuationCandidate(new_node));
-
-  // Memory in the linear allocation area is counted as allocated.  We may free
-  // a little of this again immediately - see below.
-  Page* page = Page::FromHeapObject(new_node);
-  IncreaseAllocatedBytes(new_node_size, page);
-
-  Address start = new_node.address();
-  Address end = new_node.address() + new_node_size;
-  Address limit = ComputeLimit(start, end, size_in_bytes);
-  DCHECK_LE(limit, end);
-  DCHECK_LE(size_in_bytes, limit - start);
-  if (limit != end) {
-    if (identity() == CODE_SPACE) {
-      heap()->UnprotectAndRegisterMemoryChunk(page);
-    }
-    Free(limit, end - limit, SpaceAccountingMode::kSpaceAccounted);
-  }
-  SetLinearAllocationArea(start, limit);
-
-  return true;
-}
-
-#ifdef DEBUG
-void PagedSpace::Print() {}
-#endif
-
-#ifdef VERIFY_HEAP
-void PagedSpace::Verify(Isolate* isolate, ObjectVisitor* visitor) {
-  bool allocation_pointer_found_in_space =
-      (allocation_info_.top() == allocation_info_.limit());
-  size_t external_space_bytes[kNumTypes];
-  size_t external_page_bytes[kNumTypes];
-
-  for (int i = 0; i < kNumTypes; i++) {
-    external_space_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
-  }
-
-  for (Page* page : *this) {
-#ifdef V8_SHARED_RO_HEAP
-    if (identity() == RO_SPACE) {
-      CHECK_NULL(page->owner());
-    } else {
-      CHECK_EQ(page->owner(), this);
-    }
-#else
-    CHECK_EQ(page->owner(), this);
-#endif
-
-    for (int i = 0; i < kNumTypes; i++) {
-      external_page_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
-    }
-
-    if (page == Page::FromAllocationAreaAddress(allocation_info_.top())) {
-      allocation_pointer_found_in_space = true;
-    }
-    CHECK(page->SweepingDone());
-    PagedSpaceObjectIterator it(isolate->heap(), this, page);
-    Address end_of_previous_object = page->area_start();
-    Address top = page->area_end();
-
-    for (HeapObject object = it.Next(); !object.is_null(); object = it.Next()) {
-      CHECK(end_of_previous_object <= object.address());
-
-      // The first word should be a map, and we expect all map pointers to
-      // be in map space.
-      Map map = object.map();
-      CHECK(map.IsMap());
-      CHECK(ReadOnlyHeap::Contains(map) ||
-            isolate->heap()->map_space()->Contains(map));
-
-      // Perform space-specific object verification.
-      VerifyObject(object);
-
-      // The object itself should look OK.
-      object.ObjectVerify(isolate);
-
-      if (!FLAG_verify_heap_skip_remembered_set) {
-        isolate->heap()->VerifyRememberedSetFor(object);
-      }
-
-      // All the interior pointers should be contained in the heap.
-      int size = object.Size();
-      object.IterateBody(map, size, visitor);
-      CHECK(object.address() + size <= top);
-      end_of_previous_object = object.address() + size;
-
-      if (object.IsExternalString()) {
-        ExternalString external_string = ExternalString::cast(object);
-        size_t size = external_string.ExternalPayloadSize();
-        external_page_bytes[ExternalBackingStoreType::kExternalString] += size;
-      } else if (object.IsJSArrayBuffer()) {
-        JSArrayBuffer array_buffer = JSArrayBuffer::cast(object);
-        if (ArrayBufferTracker::IsTracked(array_buffer)) {
-          size_t size =
-              ArrayBufferTracker::Lookup(isolate->heap(), array_buffer)
-                  ->PerIsolateAccountingLength();
-          external_page_bytes[ExternalBackingStoreType::kArrayBuffer] += size;
-        }
-      }
-    }
-    for (int i = 0; i < kNumTypes; i++) {
-      ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
-      CHECK_EQ(external_page_bytes[t], page->ExternalBackingStoreBytes(t));
-      external_space_bytes[t] += external_page_bytes[t];
-    }
-  }
-  for (int i = 0; i < kNumTypes; i++) {
-    if (V8_ARRAY_BUFFER_EXTENSION_BOOL &&
-        i == ExternalBackingStoreType::kArrayBuffer)
-      continue;
-    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
-    CHECK_EQ(external_space_bytes[t], ExternalBackingStoreBytes(t));
-  }
-  CHECK(allocation_pointer_found_in_space);
-
-  if (identity() == OLD_SPACE && V8_ARRAY_BUFFER_EXTENSION_BOOL) {
-    size_t bytes = heap()->array_buffer_sweeper()->old().BytesSlow();
-    CHECK_EQ(bytes,
-             ExternalBackingStoreBytes(ExternalBackingStoreType::kArrayBuffer));
-  }
-
-#ifdef DEBUG
-  VerifyCountersAfterSweeping(isolate->heap());
-#endif
-}
-
-void PagedSpace::VerifyLiveBytes() {
-  DCHECK_NE(identity(), RO_SPACE);
-  IncrementalMarking::MarkingState* marking_state =
-      heap()->incremental_marking()->marking_state();
-  for (Page* page : *this) {
-    CHECK(page->SweepingDone());
-    PagedSpaceObjectIterator it(heap(), this, page);
-    int black_size = 0;
-    for (HeapObject object = it.Next(); !object.is_null(); object = it.Next()) {
-      // All the interior pointers should be contained in the heap.
-      if (marking_state->IsBlack(object)) {
-        black_size += object.Size();
-      }
-    }
-    CHECK_LE(black_size, marking_state->live_bytes(page));
-  }
-}
-#endif  // VERIFY_HEAP
-
-#ifdef DEBUG
-void PagedSpace::VerifyCountersAfterSweeping(Heap* heap) {
-  size_t total_capacity = 0;
-  size_t total_allocated = 0;
-  for (Page* page : *this) {
-    DCHECK(page->SweepingDone());
-    total_capacity += page->area_size();
-    PagedSpaceObjectIterator it(heap, this, page);
-    size_t real_allocated = 0;
-    for (HeapObject object = it.Next(); !object.is_null(); object = it.Next()) {
-      if (!object.IsFreeSpaceOrFiller()) {
-        real_allocated += object.Size();
-      }
-    }
-    total_allocated += page->allocated_bytes();
-    // The real size can be smaller than the accounted size if array trimming,
-    // object slack tracking happened after sweeping.
-    DCHECK_LE(real_allocated, accounting_stats_.AllocatedOnPage(page));
-    DCHECK_EQ(page->allocated_bytes(), accounting_stats_.AllocatedOnPage(page));
-  }
-  DCHECK_EQ(total_capacity, accounting_stats_.Capacity());
-  DCHECK_EQ(total_allocated, accounting_stats_.Size());
-}
-
-void PagedSpace::VerifyCountersBeforeConcurrentSweeping() {
-  // We need to refine the counters on pages that are already swept and have
-  // not been moved over to the actual space. Otherwise, the AccountingStats
-  // are just an over approximation.
-  RefillFreeList();
-
-  size_t total_capacity = 0;
-  size_t total_allocated = 0;
-  auto marking_state =
-      heap()->incremental_marking()->non_atomic_marking_state();
-  for (Page* page : *this) {
-    size_t page_allocated =
-        page->SweepingDone()
-            ? page->allocated_bytes()
-            : static_cast<size_t>(marking_state->live_bytes(page));
-    total_capacity += page->area_size();
-    total_allocated += page_allocated;
-    DCHECK_EQ(page_allocated, accounting_stats_.AllocatedOnPage(page));
-  }
-  DCHECK_EQ(total_capacity, accounting_stats_.Capacity());
-  DCHECK_EQ(total_allocated, accounting_stats_.Size());
-}
-#endif
-
-// -----------------------------------------------------------------------------
-// NewSpace implementation
-
-NewSpace::NewSpace(Heap* heap, v8::PageAllocator* page_allocator,
-                   size_t initial_semispace_capacity,
-                   size_t max_semispace_capacity)
-    : SpaceWithLinearArea(heap, NEW_SPACE, new NoFreeList()),
-      to_space_(heap, kToSpace),
-      from_space_(heap, kFromSpace) {
-  DCHECK(initial_semispace_capacity <= max_semispace_capacity);
-
-  to_space_.SetUp(initial_semispace_capacity, max_semispace_capacity);
-  from_space_.SetUp(initial_semispace_capacity, max_semispace_capacity);
-  if (!to_space_.Commit()) {
-    V8::FatalProcessOutOfMemory(heap->isolate(), "New space setup");
-  }
-  DCHECK(!from_space_.is_committed());  // No need to use memory yet.
-  ResetLinearAllocationArea();
-}
-
-void NewSpace::TearDown() {
-  allocation_info_.Reset(kNullAddress, kNullAddress);
-
-  to_space_.TearDown();
-  from_space_.TearDown();
-}
-
-void NewSpace::Flip() { SemiSpace::Swap(&from_space_, &to_space_); }
-
-
-void NewSpace::Grow() {
-  // Double the semispace size but only up to maximum capacity.
-  DCHECK(TotalCapacity() < MaximumCapacity());
-  size_t new_capacity =
-      Min(MaximumCapacity(),
-          static_cast<size_t>(FLAG_semi_space_growth_factor) * TotalCapacity());
-  if (to_space_.GrowTo(new_capacity)) {
-    // Only grow from space if we managed to grow to-space.
-    if (!from_space_.GrowTo(new_capacity)) {
-      // If we managed to grow to-space but couldn't grow from-space,
-      // attempt to shrink to-space.
-      if (!to_space_.ShrinkTo(from_space_.current_capacity())) {
-        // We are in an inconsistent state because we could not
-        // commit/uncommit memory from new space.
-        FATAL("inconsistent state");
-      }
-    }
-  }
-  DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
-}
-
-
-void NewSpace::Shrink() {
-  size_t new_capacity = Max(InitialTotalCapacity(), 2 * Size());
-  size_t rounded_new_capacity = ::RoundUp(new_capacity, Page::kPageSize);
-  if (rounded_new_capacity < TotalCapacity() &&
-      to_space_.ShrinkTo(rounded_new_capacity)) {
-    // Only shrink from-space if we managed to shrink to-space.
-    from_space_.Reset();
-    if (!from_space_.ShrinkTo(rounded_new_capacity)) {
-      // If we managed to shrink to-space but couldn't shrink from
-      // space, attempt to grow to-space again.
-      if (!to_space_.GrowTo(from_space_.current_capacity())) {
-        // We are in an inconsistent state because we could not
-        // commit/uncommit memory from new space.
-        FATAL("inconsistent state");
-      }
-    }
-  }
-  DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
-}
-
-bool NewSpace::Rebalance() {
-  // Order here is important to make use of the page pool.
-  return to_space_.EnsureCurrentCapacity() &&
-         from_space_.EnsureCurrentCapacity();
-}
-
-bool SemiSpace::EnsureCurrentCapacity() {
-  if (is_committed()) {
-    const int expected_pages =
-        static_cast<int>(current_capacity_ / Page::kPageSize);
-    MemoryChunk* current_page = first_page();
-    int actual_pages = 0;
-
-    // First iterate through the pages list until expected pages if so many
-    // pages exist.
-    while (current_page != nullptr && actual_pages < expected_pages) {
-      actual_pages++;
-      current_page = current_page->list_node().next();
-    }
-
-    // Free all overallocated pages which are behind current_page.
-    while (current_page) {
-      MemoryChunk* next_current = current_page->list_node().next();
-      memory_chunk_list_.Remove(current_page);
-      // Clear new space flags to avoid this page being treated as a new
-      // space page that is potentially being swept.
-      current_page->SetFlags(0, Page::kIsInYoungGenerationMask);
-      heap()->memory_allocator()->Free<MemoryAllocator::kPooledAndQueue>(
-          current_page);
-      current_page = next_current;
-    }
-
-    // Add more pages if we have less than expected_pages.
-    IncrementalMarking::NonAtomicMarkingState* marking_state =
-        heap()->incremental_marking()->non_atomic_marking_state();
-    while (actual_pages < expected_pages) {
-      actual_pages++;
-      current_page =
-          heap()->memory_allocator()->AllocatePage<MemoryAllocator::kPooled>(
-              MemoryChunkLayout::AllocatableMemoryInDataPage(), this,
-              NOT_EXECUTABLE);
-      if (current_page == nullptr) return false;
-      DCHECK_NOT_NULL(current_page);
-      memory_chunk_list_.PushBack(current_page);
-      marking_state->ClearLiveness(current_page);
-      current_page->SetFlags(first_page()->GetFlags(),
-                             static_cast<uintptr_t>(Page::kCopyAllFlags));
-      heap()->CreateFillerObjectAt(current_page->area_start(),
-                                   static_cast<int>(current_page->area_size()),
-                                   ClearRecordedSlots::kNo);
-    }
-  }
-  return true;
-}
-
-LinearAllocationArea LocalAllocationBuffer::Close() {
-  if (IsValid()) {
-    heap_->CreateFillerObjectAt(
-        allocation_info_.top(),
-        static_cast<int>(allocation_info_.limit() - allocation_info_.top()),
-        ClearRecordedSlots::kNo);
-    const LinearAllocationArea old_info = allocation_info_;
-    allocation_info_ = LinearAllocationArea(kNullAddress, kNullAddress);
-    return old_info;
-  }
-  return LinearAllocationArea(kNullAddress, kNullAddress);
-}
-
-LocalAllocationBuffer::LocalAllocationBuffer(
-    Heap* heap, LinearAllocationArea allocation_info) V8_NOEXCEPT
-    : heap_(heap),
-      allocation_info_(allocation_info) {
-  if (IsValid()) {
-    heap_->CreateFillerObjectAt(
-        allocation_info_.top(),
-        static_cast<int>(allocation_info_.limit() - allocation_info_.top()),
-        ClearRecordedSlots::kNo);
-  }
-}
-
-LocalAllocationBuffer::LocalAllocationBuffer(const LocalAllocationBuffer& other)
-    V8_NOEXCEPT {
-  *this = other;
-}
-
-LocalAllocationBuffer& LocalAllocationBuffer::operator=(
-    const LocalAllocationBuffer& other) V8_NOEXCEPT {
-  Close();
-  heap_ = other.heap_;
-  allocation_info_ = other.allocation_info_;
-
-  // This is needed since we (a) cannot yet use move-semantics, and (b) want
-  // to make the use of the class easy by it as value and (c) implicitly call
-  // {Close} upon copy.
-  const_cast<LocalAllocationBuffer&>(other).allocation_info_.Reset(
-      kNullAddress, kNullAddress);
-  return *this;
-}
-
-void NewSpace::UpdateLinearAllocationArea() {
-  // Make sure there is no unaccounted allocations.
-  DCHECK(!AllocationObserversActive() || top_on_previous_step_ == top());
-
-  Address new_top = to_space_.page_low();
-  MemoryChunk::UpdateHighWaterMark(allocation_info_.top());
-  allocation_info_.Reset(new_top, to_space_.page_high());
-  // The order of the following two stores is important.
-  // See the corresponding loads in ConcurrentMarking::Run.
-  original_limit_.store(limit(), std::memory_order_relaxed);
-  original_top_.store(top(), std::memory_order_release);
-  StartNextInlineAllocationStep();
-  DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
-}
-
-void NewSpace::ResetLinearAllocationArea() {
-  // Do a step to account for memory allocated so far before resetting.
-  InlineAllocationStep(top(), top(), kNullAddress, 0);
-  to_space_.Reset();
-  UpdateLinearAllocationArea();
-  // Clear all mark-bits in the to-space.
-  IncrementalMarking::NonAtomicMarkingState* marking_state =
-      heap()->incremental_marking()->non_atomic_marking_state();
-  for (Page* p : to_space_) {
-    marking_state->ClearLiveness(p);
-    // Concurrent marking may have local live bytes for this page.
-    heap()->concurrent_marking()->ClearMemoryChunkData(p);
-  }
-}
-
-void NewSpace::UpdateInlineAllocationLimit(size_t min_size) {
-  Address new_limit = ComputeLimit(top(), to_space_.page_high(), min_size);
-  allocation_info_.set_limit(new_limit);
-  DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
-}
-
-void PagedSpace::UpdateInlineAllocationLimit(size_t min_size) {
-  Address new_limit = ComputeLimit(top(), limit(), min_size);
-  DCHECK_LE(new_limit, limit());
-  DecreaseLimit(new_limit);
-}
-
-bool NewSpace::AddFreshPage() {
-  Address top = allocation_info_.top();
-  DCHECK(!OldSpace::IsAtPageStart(top));
-
-  // Do a step to account for memory allocated on previous page.
-  InlineAllocationStep(top, top, kNullAddress, 0);
-
-  if (!to_space_.AdvancePage()) {
-    // No more pages left to advance.
-    return false;
-  }
-
-  // Clear remainder of current page.
-  Address limit = Page::FromAllocationAreaAddress(top)->area_end();
-  int remaining_in_page = static_cast<int>(limit - top);
-  heap()->CreateFillerObjectAt(top, remaining_in_page, ClearRecordedSlots::kNo);
-  UpdateLinearAllocationArea();
-
-  return true;
-}
-
-
-bool NewSpace::AddFreshPageSynchronized() {
-  base::MutexGuard guard(&mutex_);
-  return AddFreshPage();
-}
-
-
-bool NewSpace::EnsureAllocation(int size_in_bytes,
-                                AllocationAlignment alignment) {
-  Address old_top = allocation_info_.top();
-  Address high = to_space_.page_high();
-  int filler_size = Heap::GetFillToAlign(old_top, alignment);
-  int aligned_size_in_bytes = size_in_bytes + filler_size;
-
-  if (old_top + aligned_size_in_bytes > high) {
-    // Not enough room in the page, try to allocate a new one.
-    if (!AddFreshPage()) {
-      return false;
-    }
-
-    old_top = allocation_info_.top();
-    high = to_space_.page_high();
-    filler_size = Heap::GetFillToAlign(old_top, alignment);
-  }
-
-  DCHECK(old_top + aligned_size_in_bytes <= high);
-
-  if (allocation_info_.limit() < high) {
-    // Either the limit has been lowered because linear allocation was disabled
-    // or because incremental marking wants to get a chance to do a step,
-    // or because idle scavenge job wants to get a chance to post a task.
-    // Set the new limit accordingly.
-    Address new_top = old_top + aligned_size_in_bytes;
-    Address soon_object = old_top + filler_size;
-    InlineAllocationStep(new_top, new_top, soon_object, size_in_bytes);
-    UpdateInlineAllocationLimit(aligned_size_in_bytes);
-  }
-  return true;
-}
-
-size_t LargeObjectSpace::Available() {
-  // We return zero here since we cannot take advantage of already allocated
-  // large object memory.
-  return 0;
-}
-
-void SpaceWithLinearArea::StartNextInlineAllocationStep() {
-  if (heap()->allocation_step_in_progress()) {
-    // If we are mid-way through an existing step, don't start a new one.
-    return;
-  }
-
-  if (AllocationObserversActive()) {
-    top_on_previous_step_ = top();
-    UpdateInlineAllocationLimit(0);
-  } else {
-    DCHECK_EQ(kNullAddress, top_on_previous_step_);
+  if (AllocationObserversActive()) {
+    top_on_previous_step_ = top();
+    UpdateInlineAllocationLimit(0);
+  } else {
+    DCHECK_EQ(kNullAddress, top_on_previous_step_);
   }
 }
 
@@ -2610,444 +429,45 @@ void SpaceWithLinearArea::RemoveAllocationObserver(
   InlineAllocationStep(top(), top_for_next_step, kNullAddress, 0);
   Space::RemoveAllocationObserver(observer);
   DCHECK_IMPLIES(top_on_previous_step_, AllocationObserversActive());
-}
-
-void SpaceWithLinearArea::PauseAllocationObservers() {
-  // Do a step to account for memory allocated so far.
-  InlineAllocationStep(top(), kNullAddress, kNullAddress, 0);
-  Space::PauseAllocationObservers();
-  DCHECK_EQ(kNullAddress, top_on_previous_step_);
-  UpdateInlineAllocationLimit(0);
-}
-
-void SpaceWithLinearArea::ResumeAllocationObservers() {
-  DCHECK_EQ(kNullAddress, top_on_previous_step_);
-  Space::ResumeAllocationObservers();
-  StartNextInlineAllocationStep();
-}
-
-void SpaceWithLinearArea::InlineAllocationStep(Address top,
-                                               Address top_for_next_step,
-                                               Address soon_object,
-                                               size_t size) {
-  if (heap()->allocation_step_in_progress()) {
-    // Avoid starting a new step if we are mid-way through an existing one.
-    return;
-  }
-
-  if (top_on_previous_step_) {
-    if (top < top_on_previous_step_) {
-      // Generated code decreased the top pointer to do folded allocations.
-      DCHECK_NE(top, kNullAddress);
-      DCHECK_EQ(Page::FromAllocationAreaAddress(top),
-                Page::FromAllocationAreaAddress(top_on_previous_step_));
-      top_on_previous_step_ = top;
-    }
-    int bytes_allocated = static_cast<int>(top - top_on_previous_step_);
-    AllocationStep(bytes_allocated, soon_object, static_cast<int>(size));
-    top_on_previous_step_ = top_for_next_step;
-  }
-}
-
-std::unique_ptr<ObjectIterator> NewSpace::GetObjectIterator(Heap* heap) {
-  return std::unique_ptr<ObjectIterator>(new SemiSpaceObjectIterator(this));
-}
-
-#ifdef VERIFY_HEAP
-// We do not use the SemiSpaceObjectIterator because verification doesn't assume
-// that it works (it depends on the invariants we are checking).
-void NewSpace::Verify(Isolate* isolate) {
-  // The allocation pointer should be in the space or at the very end.
-  DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
-
-  // There should be objects packed in from the low address up to the
-  // allocation pointer.
-  Address current = to_space_.first_page()->area_start();
-  CHECK_EQ(current, to_space_.space_start());
-
-  size_t external_space_bytes[kNumTypes];
-  for (int i = 0; i < kNumTypes; i++) {
-    external_space_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
-  }
-
-  while (current != top()) {
-    if (!Page::IsAlignedToPageSize(current)) {
-      // The allocation pointer should not be in the middle of an object.
-      CHECK(!Page::FromAllocationAreaAddress(current)->ContainsLimit(top()) ||
-            current < top());
-
-      HeapObject object = HeapObject::FromAddress(current);
-
-      // The first word should be a map, and we expect all map pointers to
-      // be in map space or read-only space.
-      Map map = object.map();
-      CHECK(map.IsMap());
-      CHECK(ReadOnlyHeap::Contains(map) || heap()->map_space()->Contains(map));
-
-      // The object should not be code or a map.
-      CHECK(!object.IsMap());
-      CHECK(!object.IsAbstractCode());
-
-      // The object itself should look OK.
-      object.ObjectVerify(isolate);
-
-      // All the interior pointers should be contained in the heap.
-      VerifyPointersVisitor visitor(heap());
-      int size = object.Size();
-      object.IterateBody(map, size, &visitor);
-
-      if (object.IsExternalString()) {
-        ExternalString external_string = ExternalString::cast(object);
-        size_t size = external_string.ExternalPayloadSize();
-        external_space_bytes[ExternalBackingStoreType::kExternalString] += size;
-      } else if (object.IsJSArrayBuffer()) {
-        JSArrayBuffer array_buffer = JSArrayBuffer::cast(object);
-        if (ArrayBufferTracker::IsTracked(array_buffer)) {
-          size_t size = ArrayBufferTracker::Lookup(heap(), array_buffer)
-                            ->PerIsolateAccountingLength();
-          external_space_bytes[ExternalBackingStoreType::kArrayBuffer] += size;
-        }
-      }
-
-      current += size;
-    } else {
-      // At end of page, switch to next page.
-      Page* page = Page::FromAllocationAreaAddress(current)->next_page();
-      current = page->area_start();
-    }
-  }
-
-  for (int i = 0; i < kNumTypes; i++) {
-    if (V8_ARRAY_BUFFER_EXTENSION_BOOL &&
-        i == ExternalBackingStoreType::kArrayBuffer)
-      continue;
-    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
-    CHECK_EQ(external_space_bytes[t], ExternalBackingStoreBytes(t));
-  }
-
-  if (V8_ARRAY_BUFFER_EXTENSION_BOOL) {
-    size_t bytes = heap()->array_buffer_sweeper()->young().BytesSlow();
-    CHECK_EQ(bytes,
-             ExternalBackingStoreBytes(ExternalBackingStoreType::kArrayBuffer));
-  }
-
-  // Check semi-spaces.
-  CHECK_EQ(from_space_.id(), kFromSpace);
-  CHECK_EQ(to_space_.id(), kToSpace);
-  from_space_.Verify();
-  to_space_.Verify();
-}
-#endif
-
-// -----------------------------------------------------------------------------
-// SemiSpace implementation
-
-void SemiSpace::SetUp(size_t initial_capacity, size_t maximum_capacity) {
-  DCHECK_GE(maximum_capacity, static_cast<size_t>(Page::kPageSize));
-  minimum_capacity_ = RoundDown(initial_capacity, Page::kPageSize);
-  current_capacity_ = minimum_capacity_;
-  maximum_capacity_ = RoundDown(maximum_capacity, Page::kPageSize);
-  committed_ = false;
-}
-
-
-void SemiSpace::TearDown() {
-  // Properly uncommit memory to keep the allocator counters in sync.
-  if (is_committed()) {
-    Uncommit();
-  }
-  current_capacity_ = maximum_capacity_ = 0;
-}
-
-
-bool SemiSpace::Commit() {
-  DCHECK(!is_committed());
-  const int num_pages = static_cast<int>(current_capacity_ / Page::kPageSize);
-  for (int pages_added = 0; pages_added < num_pages; pages_added++) {
-    // Pages in the new spaces can be moved to the old space by the full
-    // collector. Therefore, they must be initialized with the same FreeList as
-    // old pages.
-    Page* new_page =
-        heap()->memory_allocator()->AllocatePage<MemoryAllocator::kPooled>(
-            MemoryChunkLayout::AllocatableMemoryInDataPage(), this,
-            NOT_EXECUTABLE);
-    if (new_page == nullptr) {
-      if (pages_added) RewindPages(pages_added);
-      return false;
-    }
-    memory_chunk_list_.PushBack(new_page);
-  }
-  Reset();
-  AccountCommitted(current_capacity_);
-  if (age_mark_ == kNullAddress) {
-    age_mark_ = first_page()->area_start();
-  }
-  committed_ = true;
-  return true;
-}
-
-
-bool SemiSpace::Uncommit() {
-  DCHECK(is_committed());
-  while (!memory_chunk_list_.Empty()) {
-    MemoryChunk* chunk = memory_chunk_list_.front();
-    memory_chunk_list_.Remove(chunk);
-    heap()->memory_allocator()->Free<MemoryAllocator::kPooledAndQueue>(chunk);
-  }
-  current_page_ = nullptr;
-  AccountUncommitted(current_capacity_);
-  committed_ = false;
-  heap()->memory_allocator()->unmapper()->FreeQueuedChunks();
-  return true;
-}
-
-
-size_t SemiSpace::CommittedPhysicalMemory() {
-  if (!is_committed()) return 0;
-  size_t size = 0;
-  for (Page* p : *this) {
-    size += p->CommittedPhysicalMemory();
-  }
-  return size;
-}
-
-bool SemiSpace::GrowTo(size_t new_capacity) {
-  if (!is_committed()) {
-    if (!Commit()) return false;
-  }
-  DCHECK_EQ(new_capacity & kPageAlignmentMask, 0u);
-  DCHECK_LE(new_capacity, maximum_capacity_);
-  DCHECK_GT(new_capacity, current_capacity_);
-  const size_t delta = new_capacity - current_capacity_;
-  DCHECK(IsAligned(delta, AllocatePageSize()));
-  const int delta_pages = static_cast<int>(delta / Page::kPageSize);
-  DCHECK(last_page());
-  IncrementalMarking::NonAtomicMarkingState* marking_state =
-      heap()->incremental_marking()->non_atomic_marking_state();
-  for (int pages_added = 0; pages_added < delta_pages; pages_added++) {
-    Page* new_page =
-        heap()->memory_allocator()->AllocatePage<MemoryAllocator::kPooled>(
-            MemoryChunkLayout::AllocatableMemoryInDataPage(), this,
-            NOT_EXECUTABLE);
-    if (new_page == nullptr) {
-      if (pages_added) RewindPages(pages_added);
-      return false;
-    }
-    memory_chunk_list_.PushBack(new_page);
-    marking_state->ClearLiveness(new_page);
-    // Duplicate the flags that was set on the old page.
-    new_page->SetFlags(last_page()->GetFlags(), Page::kCopyOnFlipFlagsMask);
-  }
-  AccountCommitted(delta);
-  current_capacity_ = new_capacity;
-  return true;
-}
-
-void SemiSpace::RewindPages(int num_pages) {
-  DCHECK_GT(num_pages, 0);
-  DCHECK(last_page());
-  while (num_pages > 0) {
-    MemoryChunk* last = last_page();
-    memory_chunk_list_.Remove(last);
-    heap()->memory_allocator()->Free<MemoryAllocator::kPooledAndQueue>(last);
-    num_pages--;
-  }
-}
-
-bool SemiSpace::ShrinkTo(size_t new_capacity) {
-  DCHECK_EQ(new_capacity & kPageAlignmentMask, 0u);
-  DCHECK_GE(new_capacity, minimum_capacity_);
-  DCHECK_LT(new_capacity, current_capacity_);
-  if (is_committed()) {
-    const size_t delta = current_capacity_ - new_capacity;
-    DCHECK(IsAligned(delta, Page::kPageSize));
-    int delta_pages = static_cast<int>(delta / Page::kPageSize);
-    RewindPages(delta_pages);
-    AccountUncommitted(delta);
-    heap()->memory_allocator()->unmapper()->FreeQueuedChunks();
-  }
-  current_capacity_ = new_capacity;
-  return true;
-}
-
-void SemiSpace::FixPagesFlags(intptr_t flags, intptr_t mask) {
-  for (Page* page : *this) {
-    page->set_owner(this);
-    page->SetFlags(flags, mask);
-    if (id_ == kToSpace) {
-      page->ClearFlag(MemoryChunk::FROM_PAGE);
-      page->SetFlag(MemoryChunk::TO_PAGE);
-      page->ClearFlag(MemoryChunk::NEW_SPACE_BELOW_AGE_MARK);
-      heap()->incremental_marking()->non_atomic_marking_state()->SetLiveBytes(
-          page, 0);
-    } else {
-      page->SetFlag(MemoryChunk::FROM_PAGE);
-      page->ClearFlag(MemoryChunk::TO_PAGE);
-    }
-    DCHECK(page->InYoungGeneration());
-  }
-}
-
-
-void SemiSpace::Reset() {
-  DCHECK(first_page());
-  DCHECK(last_page());
-  current_page_ = first_page();
-  pages_used_ = 0;
-}
-
-void SemiSpace::RemovePage(Page* page) {
-  if (current_page_ == page) {
-    if (page->prev_page()) {
-      current_page_ = page->prev_page();
-    }
-  }
-  memory_chunk_list_.Remove(page);
-  for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
-    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
-    DecrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
-  }
-}
-
-void SemiSpace::PrependPage(Page* page) {
-  page->SetFlags(current_page()->GetFlags(),
-                 static_cast<uintptr_t>(Page::kCopyAllFlags));
-  page->set_owner(this);
-  memory_chunk_list_.PushFront(page);
-  pages_used_++;
-  for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
-    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
-    IncrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
-  }
-}
-
-void SemiSpace::Swap(SemiSpace* from, SemiSpace* to) {
-  // We won't be swapping semispaces without data in them.
-  DCHECK(from->first_page());
-  DCHECK(to->first_page());
-
-  intptr_t saved_to_space_flags = to->current_page()->GetFlags();
-
-  // We swap all properties but id_.
-  std::swap(from->current_capacity_, to->current_capacity_);
-  std::swap(from->maximum_capacity_, to->maximum_capacity_);
-  std::swap(from->minimum_capacity_, to->minimum_capacity_);
-  std::swap(from->age_mark_, to->age_mark_);
-  std::swap(from->committed_, to->committed_);
-  std::swap(from->memory_chunk_list_, to->memory_chunk_list_);
-  std::swap(from->current_page_, to->current_page_);
-  std::swap(from->external_backing_store_bytes_,
-            to->external_backing_store_bytes_);
-
-  to->FixPagesFlags(saved_to_space_flags, Page::kCopyOnFlipFlagsMask);
-  from->FixPagesFlags(0, 0);
-}
-
-void SemiSpace::set_age_mark(Address mark) {
-  DCHECK_EQ(Page::FromAllocationAreaAddress(mark)->owner(), this);
-  age_mark_ = mark;
-  // Mark all pages up to the one containing mark.
-  for (Page* p : PageRange(space_start(), mark)) {
-    p->SetFlag(MemoryChunk::NEW_SPACE_BELOW_AGE_MARK);
-  }
-}
-
-std::unique_ptr<ObjectIterator> SemiSpace::GetObjectIterator(Heap* heap) {
-  // Use the NewSpace::NewObjectIterator to iterate the ToSpace.
-  UNREACHABLE();
-}
-
-#ifdef DEBUG
-void SemiSpace::Print() {}
-#endif
-
-#ifdef VERIFY_HEAP
-void SemiSpace::Verify() {
-  bool is_from_space = (id_ == kFromSpace);
-  size_t external_backing_store_bytes[kNumTypes];
-
-  for (int i = 0; i < kNumTypes; i++) {
-    external_backing_store_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
-  }
-
-  for (Page* page : *this) {
-    CHECK_EQ(page->owner(), this);
-    CHECK(page->InNewSpace());
-    CHECK(page->IsFlagSet(is_from_space ? MemoryChunk::FROM_PAGE
-                                        : MemoryChunk::TO_PAGE));
-    CHECK(!page->IsFlagSet(is_from_space ? MemoryChunk::TO_PAGE
-                                         : MemoryChunk::FROM_PAGE));
-    CHECK(page->IsFlagSet(MemoryChunk::POINTERS_TO_HERE_ARE_INTERESTING));
-    if (!is_from_space) {
-      // The pointers-from-here-are-interesting flag isn't updated dynamically
-      // on from-space pages, so it might be out of sync with the marking state.
-      if (page->heap()->incremental_marking()->IsMarking()) {
-        CHECK(page->IsFlagSet(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING));
-      } else {
-        CHECK(
-            !page->IsFlagSet(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING));
-      }
-    }
-    for (int i = 0; i < kNumTypes; i++) {
-      ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
-      external_backing_store_bytes[t] += page->ExternalBackingStoreBytes(t);
-    }
-
-    CHECK_IMPLIES(page->list_node().prev(),
-                  page->list_node().prev()->list_node().next() == page);
-  }
-  for (int i = 0; i < kNumTypes; i++) {
-    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
-    CHECK_EQ(external_backing_store_bytes[t], ExternalBackingStoreBytes(t));
-  }
-}
-#endif
-
-#ifdef DEBUG
-void SemiSpace::AssertValidRange(Address start, Address end) {
-  // Addresses belong to same semi-space
-  Page* page = Page::FromAllocationAreaAddress(start);
-  Page* end_page = Page::FromAllocationAreaAddress(end);
-  SemiSpace* space = reinterpret_cast<SemiSpace*>(page->owner());
-  DCHECK_EQ(space, end_page->owner());
-  // Start address is before end address, either on same page,
-  // or end address is on a later page in the linked list of
-  // semi-space pages.
-  if (page == end_page) {
-    DCHECK_LE(start, end);
-  } else {
-    while (page != end_page) {
-      page = page->next_page();
-    }
-    DCHECK(page);
-  }
-}
-#endif
-
-// -----------------------------------------------------------------------------
-// SemiSpaceObjectIterator implementation.
+}
 
-SemiSpaceObjectIterator::SemiSpaceObjectIterator(NewSpace* space) {
-  Initialize(space->first_allocatable_address(), space->top());
+void SpaceWithLinearArea::PauseAllocationObservers() {
+  // Do a step to account for memory allocated so far.
+  InlineAllocationStep(top(), kNullAddress, kNullAddress, 0);
+  Space::PauseAllocationObservers();
+  DCHECK_EQ(kNullAddress, top_on_previous_step_);
+  UpdateInlineAllocationLimit(0);
 }
 
-void SemiSpaceObjectIterator::Initialize(Address start, Address end) {
-  SemiSpace::AssertValidRange(start, end);
-  current_ = start;
-  limit_ = end;
+void SpaceWithLinearArea::ResumeAllocationObservers() {
+  DCHECK_EQ(kNullAddress, top_on_previous_step_);
+  Space::ResumeAllocationObservers();
+  StartNextInlineAllocationStep();
 }
 
-size_t NewSpace::CommittedPhysicalMemory() {
-  if (!base::OS::HasLazyCommits()) return CommittedMemory();
-  MemoryChunk::UpdateHighWaterMark(allocation_info_.top());
-  size_t size = to_space_.CommittedPhysicalMemory();
-  if (from_space_.is_committed()) {
-    size += from_space_.CommittedPhysicalMemory();
+void SpaceWithLinearArea::InlineAllocationStep(Address top,
+                                               Address top_for_next_step,
+                                               Address soon_object,
+                                               size_t size) {
+  if (heap()->allocation_step_in_progress()) {
+    // Avoid starting a new step if we are mid-way through an existing one.
+    return;
+  }
+
+  if (top_on_previous_step_) {
+    if (top < top_on_previous_step_) {
+      // Generated code decreased the top pointer to do folded allocations.
+      DCHECK_NE(top, kNullAddress);
+      DCHECK_EQ(Page::FromAllocationAreaAddress(top),
+                Page::FromAllocationAreaAddress(top_on_previous_step_));
+      top_on_previous_step_ = top;
+    }
+    int bytes_allocated = static_cast<int>(top - top_on_previous_step_);
+    AllocationStep(bytes_allocated, soon_object, static_cast<int>(size));
+    top_on_previous_step_ = top_for_next_step;
   }
-  return size;
 }
 
-
 // -----------------------------------------------------------------------------
 // Free lists for old object spaces implementation
 
@@ -3689,7 +1109,8 @@ void FreeList::PrintCategories(FreeListCategoryType type) {
 
 int MemoryChunk::FreeListsLength() {
   int length = 0;
-  for (int cat = kFirstCategory; cat <= free_list()->last_category(); cat++) {
+  for (int cat = kFirstCategory; cat <= owner()->free_list()->last_category();
+       cat++) {
     if (categories_[cat] != nullptr) {
       length += categories_[cat]->FreeListLength();
     }
@@ -3748,789 +1169,5 @@ size_t FreeList::SumFreeLists() {
 }
 #endif
 
-
-// -----------------------------------------------------------------------------
-// OldSpace implementation
-
-void PagedSpace::PrepareForMarkCompact() {
-  // We don't have a linear allocation area while sweeping.  It will be restored
-  // on the first allocation after the sweep.
-  FreeLinearAllocationArea();
-
-  // Clear the free list before a full GC---it will be rebuilt afterward.
-  free_list_->Reset();
-}
-
-size_t PagedSpace::SizeOfObjects() {
-  CHECK_GE(limit(), top());
-  DCHECK_GE(Size(), static_cast<size_t>(limit() - top()));
-  return Size() - (limit() - top());
-}
-
-bool PagedSpace::EnsureSweptAndRetryAllocation(int size_in_bytes,
-                                               AllocationOrigin origin) {
-  DCHECK(!is_local_space());
-  MarkCompactCollector* collector = heap()->mark_compact_collector();
-  if (collector->sweeping_in_progress()) {
-    // Wait for the sweeper threads here and complete the sweeping phase.
-    collector->EnsureSweepingCompleted();
-
-    // After waiting for the sweeper threads, there may be new free-list
-    // entries.
-    return RefillLinearAllocationAreaFromFreeList(size_in_bytes, origin);
-  }
-  return false;
-}
-
-bool PagedSpace::SlowRefillLinearAllocationArea(int size_in_bytes,
-                                                AllocationOrigin origin) {
-  VMState<GC> state(heap()->isolate());
-  RuntimeCallTimerScope runtime_timer(
-      heap()->isolate(), RuntimeCallCounterId::kGC_Custom_SlowAllocateRaw);
-  return RawSlowRefillLinearAllocationArea(size_in_bytes, origin);
-}
-
-bool CompactionSpace::SlowRefillLinearAllocationArea(int size_in_bytes,
-                                                     AllocationOrigin origin) {
-  return RawSlowRefillLinearAllocationArea(size_in_bytes, origin);
-}
-
-bool OffThreadSpace::SlowRefillLinearAllocationArea(int size_in_bytes,
-                                                    AllocationOrigin origin) {
-  if (RefillLinearAllocationAreaFromFreeList(size_in_bytes, origin))
-    return true;
-
-  if (Expand()) {
-    DCHECK((CountTotalPages() > 1) ||
-           (static_cast<size_t>(size_in_bytes) <= free_list_->Available()));
-    return RefillLinearAllocationAreaFromFreeList(
-        static_cast<size_t>(size_in_bytes), origin);
-  }
-
-  return false;
-}
-
-bool PagedSpace::RawSlowRefillLinearAllocationArea(int size_in_bytes,
-                                                   AllocationOrigin origin) {
-  // Non-compaction local spaces are not supported.
-  DCHECK_IMPLIES(is_local_space(), is_compaction_space());
-
-  // Allocation in this space has failed.
-  DCHECK_GE(size_in_bytes, 0);
-  const int kMaxPagesToSweep = 1;
-
-  if (RefillLinearAllocationAreaFromFreeList(size_in_bytes, origin))
-    return true;
-
-  MarkCompactCollector* collector = heap()->mark_compact_collector();
-  // Sweeping is still in progress.
-  if (collector->sweeping_in_progress()) {
-    if (FLAG_concurrent_sweeping && !is_compaction_space() &&
-        !collector->sweeper()->AreSweeperTasksRunning()) {
-      collector->EnsureSweepingCompleted();
-    }
-
-    // First try to refill the free-list, concurrent sweeper threads
-    // may have freed some objects in the meantime.
-    RefillFreeList();
-
-    // Retry the free list allocation.
-    if (RefillLinearAllocationAreaFromFreeList(
-            static_cast<size_t>(size_in_bytes), origin))
-      return true;
-
-    if (SweepAndRetryAllocation(size_in_bytes, kMaxPagesToSweep, size_in_bytes,
-                                origin))
-      return true;
-  }
-
-  if (is_compaction_space()) {
-    // The main thread may have acquired all swept pages. Try to steal from
-    // it. This can only happen during young generation evacuation.
-    PagedSpace* main_space = heap()->paged_space(identity());
-    Page* page = main_space->RemovePageSafe(size_in_bytes);
-    if (page != nullptr) {
-      AddPage(page);
-      if (RefillLinearAllocationAreaFromFreeList(
-              static_cast<size_t>(size_in_bytes), origin))
-        return true;
-    }
-  }
-
-  if (heap()->ShouldExpandOldGenerationOnSlowAllocation() && Expand()) {
-    DCHECK((CountTotalPages() > 1) ||
-           (static_cast<size_t>(size_in_bytes) <= free_list_->Available()));
-    return RefillLinearAllocationAreaFromFreeList(
-        static_cast<size_t>(size_in_bytes), origin);
-  }
-
-  if (is_compaction_space()) {
-    return SweepAndRetryAllocation(0, 0, size_in_bytes, origin);
-
-  } else {
-    // If sweeper threads are active, wait for them at that point and steal
-    // elements from their free-lists. Allocation may still fail here which
-    // would indicate that there is not enough memory for the given allocation.
-    return EnsureSweptAndRetryAllocation(size_in_bytes, origin);
-  }
-}
-
-bool PagedSpace::SweepAndRetryAllocation(int required_freed_bytes,
-                                         int max_pages, int size_in_bytes,
-                                         AllocationOrigin origin) {
-  // Cleanup invalidated old-to-new refs for compaction space in the
-  // final atomic pause.
-  Sweeper::FreeSpaceMayContainInvalidatedSlots invalidated_slots_in_free_space =
-      is_compaction_space() ? Sweeper::FreeSpaceMayContainInvalidatedSlots::kYes
-                            : Sweeper::FreeSpaceMayContainInvalidatedSlots::kNo;
-
-  MarkCompactCollector* collector = heap()->mark_compact_collector();
-  if (collector->sweeping_in_progress()) {
-    int max_freed = collector->sweeper()->ParallelSweepSpace(
-        identity(), required_freed_bytes, max_pages,
-        invalidated_slots_in_free_space);
-    RefillFreeList();
-    if (max_freed >= size_in_bytes)
-      return RefillLinearAllocationAreaFromFreeList(size_in_bytes, origin);
-  }
-  return false;
-}
-
-// -----------------------------------------------------------------------------
-// MapSpace implementation
-
-// TODO(dmercadier): use a heap instead of sorting like that.
-// Using a heap will have multiple benefits:
-//   - for now, SortFreeList is only called after sweeping, which is somewhat
-//   late. Using a heap, sorting could be done online: FreeListCategories would
-//   be inserted in a heap (ie, in a sorted manner).
-//   - SortFreeList is a bit fragile: any change to FreeListMap (or to
-//   MapSpace::free_list_) could break it.
-void MapSpace::SortFreeList() {
-  using LiveBytesPagePair = std::pair<size_t, Page*>;
-  std::vector<LiveBytesPagePair> pages;
-  pages.reserve(CountTotalPages());
-
-  for (Page* p : *this) {
-    free_list()->RemoveCategory(p->free_list_category(kFirstCategory));
-    pages.push_back(std::make_pair(p->allocated_bytes(), p));
-  }
-
-  // Sorting by least-allocated-bytes first.
-  std::sort(pages.begin(), pages.end(),
-            [](const LiveBytesPagePair& a, const LiveBytesPagePair& b) {
-              return a.first < b.first;
-            });
-
-  for (LiveBytesPagePair const& p : pages) {
-    // Since AddCategory inserts in head position, it reverts the order produced
-    // by the sort above: least-allocated-bytes will be Added first, and will
-    // therefore be the last element (and the first one will be
-    // most-allocated-bytes).
-    free_list()->AddCategory(p.second->free_list_category(kFirstCategory));
-  }
-}
-
-#ifdef VERIFY_HEAP
-void MapSpace::VerifyObject(HeapObject object) { CHECK(object.IsMap()); }
-#endif
-
-// -----------------------------------------------------------------------------
-// ReadOnlySpace implementation
-
-ReadOnlySpace::ReadOnlySpace(Heap* heap)
-    : PagedSpace(heap, RO_SPACE, NOT_EXECUTABLE, FreeList::CreateFreeList()),
-      is_string_padding_cleared_(heap->isolate()->initialized_from_snapshot()) {
-}
-
-void ReadOnlyPage::MakeHeaderRelocatable() {
-  ReleaseAllocatedMemoryNeededForWritableChunk();
-  // Detached read-only space needs to have a valid marking bitmap and free list
-  // categories. Instruct Lsan to ignore them if required.
-  LSAN_IGNORE_OBJECT(categories_);
-  for (int i = kFirstCategory; i < free_list()->number_of_categories(); i++) {
-    LSAN_IGNORE_OBJECT(categories_[i]);
-  }
-  LSAN_IGNORE_OBJECT(marking_bitmap_);
-  heap_ = nullptr;
-  owner_ = nullptr;
-}
-
-void ReadOnlySpace::SetPermissionsForPages(MemoryAllocator* memory_allocator,
-                                           PageAllocator::Permission access) {
-  for (Page* p : *this) {
-    // Read only pages don't have valid reservation object so we get proper
-    // page allocator manually.
-    v8::PageAllocator* page_allocator =
-        memory_allocator->page_allocator(p->executable());
-    CHECK(SetPermissions(page_allocator, p->address(), p->size(), access));
-  }
-}
-
-// After we have booted, we have created a map which represents free space
-// on the heap.  If there was already a free list then the elements on it
-// were created with the wrong FreeSpaceMap (normally nullptr), so we need to
-// fix them.
-void ReadOnlySpace::RepairFreeListsAfterDeserialization() {
-  free_list_->RepairLists(heap());
-  // Each page may have a small free space that is not tracked by a free list.
-  // Those free spaces still contain null as their map pointer.
-  // Overwrite them with new fillers.
-  for (Page* page : *this) {
-    int size = static_cast<int>(page->wasted_memory());
-    if (size == 0) {
-      // If there is no wasted memory then all free space is in the free list.
-      continue;
-    }
-    Address start = page->HighWaterMark();
-    Address end = page->area_end();
-    if (start < end - size) {
-      // A region at the high watermark is already in free list.
-      HeapObject filler = HeapObject::FromAddress(start);
-      CHECK(filler.IsFreeSpaceOrFiller());
-      start += filler.Size();
-    }
-    CHECK_EQ(size, static_cast<int>(end - start));
-    heap()->CreateFillerObjectAt(start, size, ClearRecordedSlots::kNo);
-  }
-}
-
-void ReadOnlySpace::ClearStringPaddingIfNeeded() {
-  if (V8_ENABLE_THIRD_PARTY_HEAP_BOOL) {
-    // TODO(ulan): Revisit this once third-party heap supports iteration.
-    return;
-  }
-  if (is_string_padding_cleared_) return;
-
-  ReadOnlyHeapObjectIterator iterator(this);
-  for (HeapObject o = iterator.Next(); !o.is_null(); o = iterator.Next()) {
-    if (o.IsSeqOneByteString()) {
-      SeqOneByteString::cast(o).clear_padding();
-    } else if (o.IsSeqTwoByteString()) {
-      SeqTwoByteString::cast(o).clear_padding();
-    }
-  }
-  is_string_padding_cleared_ = true;
-}
-
-void ReadOnlySpace::Seal(SealMode ro_mode) {
-  DCHECK(!is_marked_read_only_);
-
-  FreeLinearAllocationArea();
-  is_marked_read_only_ = true;
-  auto* memory_allocator = heap()->memory_allocator();
-
-  if (ro_mode == SealMode::kDetachFromHeapAndForget) {
-    DetachFromHeap();
-    for (Page* p : *this) {
-      memory_allocator->UnregisterMemory(p);
-      static_cast<ReadOnlyPage*>(p)->MakeHeaderRelocatable();
-    }
-  }
-
-  SetPermissionsForPages(memory_allocator, PageAllocator::kRead);
-}
-
-void ReadOnlySpace::Unseal() {
-  DCHECK(is_marked_read_only_);
-  SetPermissionsForPages(heap()->memory_allocator(), PageAllocator::kReadWrite);
-  is_marked_read_only_ = false;
-}
-
-Address LargePage::GetAddressToShrink(Address object_address,
-                                      size_t object_size) {
-  if (executable() == EXECUTABLE) {
-    return 0;
-  }
-  size_t used_size = ::RoundUp((object_address - address()) + object_size,
-                               MemoryAllocator::GetCommitPageSize());
-  if (used_size < CommittedPhysicalMemory()) {
-    return address() + used_size;
-  }
-  return 0;
-}
-
-void LargePage::ClearOutOfLiveRangeSlots(Address free_start) {
-  DCHECK_NULL(this->sweeping_slot_set());
-  RememberedSet<OLD_TO_NEW>::RemoveRange(this, free_start, area_end(),
-                                         SlotSet::FREE_EMPTY_BUCKETS);
-  RememberedSet<OLD_TO_OLD>::RemoveRange(this, free_start, area_end(),
-                                         SlotSet::FREE_EMPTY_BUCKETS);
-  RememberedSet<OLD_TO_NEW>::RemoveRangeTyped(this, free_start, area_end());
-  RememberedSet<OLD_TO_OLD>::RemoveRangeTyped(this, free_start, area_end());
-}
-
-// -----------------------------------------------------------------------------
-// LargeObjectSpaceObjectIterator
-
-LargeObjectSpaceObjectIterator::LargeObjectSpaceObjectIterator(
-    LargeObjectSpace* space) {
-  current_ = space->first_page();
-}
-
-HeapObject LargeObjectSpaceObjectIterator::Next() {
-  if (current_ == nullptr) return HeapObject();
-
-  HeapObject object = current_->GetObject();
-  current_ = current_->next_page();
-  return object;
-}
-
-// -----------------------------------------------------------------------------
-// OldLargeObjectSpace
-
-LargeObjectSpace::LargeObjectSpace(Heap* heap, AllocationSpace id)
-    : Space(heap, id, new NoFreeList()),
-      size_(0),
-      page_count_(0),
-      objects_size_(0) {}
-
-void LargeObjectSpace::TearDown() {
-  while (!memory_chunk_list_.Empty()) {
-    LargePage* page = first_page();
-    LOG(heap()->isolate(),
-        DeleteEvent("LargeObjectChunk",
-                    reinterpret_cast<void*>(page->address())));
-    memory_chunk_list_.Remove(page);
-    heap()->memory_allocator()->Free<MemoryAllocator::kFull>(page);
-  }
-}
-
-AllocationResult OldLargeObjectSpace::AllocateRaw(int object_size) {
-  return AllocateRaw(object_size, NOT_EXECUTABLE);
-}
-
-AllocationResult OldLargeObjectSpace::AllocateRaw(int object_size,
-                                                  Executability executable) {
-  // Check if we want to force a GC before growing the old space further.
-  // If so, fail the allocation.
-  if (!heap()->CanExpandOldGeneration(object_size) ||
-      !heap()->ShouldExpandOldGenerationOnSlowAllocation()) {
-    return AllocationResult::Retry(identity());
-  }
-
-  LargePage* page = AllocateLargePage(object_size, executable);
-  if (page == nullptr) return AllocationResult::Retry(identity());
-  page->SetOldGenerationPageFlags(heap()->incremental_marking()->IsMarking());
-  HeapObject object = page->GetObject();
-  heap()->StartIncrementalMarkingIfAllocationLimitIsReached(
-      heap()->GCFlagsForIncrementalMarking(),
-      kGCCallbackScheduleIdleGarbageCollection);
-  if (heap()->incremental_marking()->black_allocation()) {
-    heap()->incremental_marking()->marking_state()->WhiteToBlack(object);
-  }
-  DCHECK_IMPLIES(
-      heap()->incremental_marking()->black_allocation(),
-      heap()->incremental_marking()->marking_state()->IsBlack(object));
-  page->InitializationMemoryFence();
-  heap()->NotifyOldGenerationExpansion();
-  AllocationStep(object_size, object.address(), object_size);
-  return object;
-}
-
-LargePage* LargeObjectSpace::AllocateLargePage(int object_size,
-                                               Executability executable) {
-  LargePage* page = heap()->memory_allocator()->AllocateLargePage(
-      object_size, this, executable);
-  if (page == nullptr) return nullptr;
-  DCHECK_GE(page->area_size(), static_cast<size_t>(object_size));
-
-  AddPage(page, object_size);
-
-  HeapObject object = page->GetObject();
-
-  heap()->CreateFillerObjectAt(object.address(), object_size,
-                               ClearRecordedSlots::kNo);
-  return page;
-}
-
-size_t LargeObjectSpace::CommittedPhysicalMemory() {
-  // On a platform that provides lazy committing of memory, we over-account
-  // the actually committed memory. There is no easy way right now to support
-  // precise accounting of committed memory in large object space.
-  return CommittedMemory();
-}
-
-LargePage* CodeLargeObjectSpace::FindPage(Address a) {
-  const Address key = MemoryChunk::FromAddress(a)->address();
-  auto it = chunk_map_.find(key);
-  if (it != chunk_map_.end()) {
-    LargePage* page = it->second;
-    CHECK(page->Contains(a));
-    return page;
-  }
-  return nullptr;
-}
-
-void OldLargeObjectSpace::ClearMarkingStateOfLiveObjects() {
-  IncrementalMarking::NonAtomicMarkingState* marking_state =
-      heap()->incremental_marking()->non_atomic_marking_state();
-  LargeObjectSpaceObjectIterator it(this);
-  for (HeapObject obj = it.Next(); !obj.is_null(); obj = it.Next()) {
-    if (marking_state->IsBlackOrGrey(obj)) {
-      Marking::MarkWhite(marking_state->MarkBitFrom(obj));
-      MemoryChunk* chunk = MemoryChunk::FromHeapObject(obj);
-      RememberedSet<OLD_TO_NEW>::FreeEmptyBuckets(chunk);
-      chunk->ResetProgressBar();
-      marking_state->SetLiveBytes(chunk, 0);
-    }
-    DCHECK(marking_state->IsWhite(obj));
-  }
-}
-
-void CodeLargeObjectSpace::InsertChunkMapEntries(LargePage* page) {
-  for (Address current = reinterpret_cast<Address>(page);
-       current < reinterpret_cast<Address>(page) + page->size();
-       current += MemoryChunk::kPageSize) {
-    chunk_map_[current] = page;
-  }
-}
-
-void CodeLargeObjectSpace::RemoveChunkMapEntries(LargePage* page) {
-  for (Address current = page->address();
-       current < reinterpret_cast<Address>(page) + page->size();
-       current += MemoryChunk::kPageSize) {
-    chunk_map_.erase(current);
-  }
-}
-
-void OldLargeObjectSpace::PromoteNewLargeObject(LargePage* page) {
-  DCHECK_EQ(page->owner_identity(), NEW_LO_SPACE);
-  DCHECK(page->IsLargePage());
-  DCHECK(page->IsFlagSet(MemoryChunk::FROM_PAGE));
-  DCHECK(!page->IsFlagSet(MemoryChunk::TO_PAGE));
-  size_t object_size = static_cast<size_t>(page->GetObject().Size());
-  static_cast<LargeObjectSpace*>(page->owner())->RemovePage(page, object_size);
-  page->ClearFlag(MemoryChunk::FROM_PAGE);
-  page->SetOldGenerationPageFlags(heap()->incremental_marking()->IsMarking());
-  AddPage(page, object_size);
-}
-
-void LargeObjectSpace::AddPage(LargePage* page, size_t object_size) {
-  size_ += static_cast<int>(page->size());
-  AccountCommitted(page->size());
-  objects_size_ += object_size;
-  page_count_++;
-  memory_chunk_list_.PushBack(page);
-  page->set_owner(this);
-}
-
-void LargeObjectSpace::RemovePage(LargePage* page, size_t object_size) {
-  size_ -= static_cast<int>(page->size());
-  AccountUncommitted(page->size());
-  objects_size_ -= object_size;
-  page_count_--;
-  memory_chunk_list_.Remove(page);
-  page->set_owner(nullptr);
-}
-
-void LargeObjectSpace::FreeUnmarkedObjects() {
-  LargePage* current = first_page();
-  IncrementalMarking::NonAtomicMarkingState* marking_state =
-      heap()->incremental_marking()->non_atomic_marking_state();
-  // Right-trimming does not update the objects_size_ counter. We are lazily
-  // updating it after every GC.
-  size_t surviving_object_size = 0;
-  while (current) {
-    LargePage* next_current = current->next_page();
-    HeapObject object = current->GetObject();
-    DCHECK(!marking_state->IsGrey(object));
-    size_t size = static_cast<size_t>(object.Size());
-    if (marking_state->IsBlack(object)) {
-      Address free_start;
-      surviving_object_size += size;
-      if ((free_start = current->GetAddressToShrink(object.address(), size)) !=
-          0) {
-        DCHECK(!current->IsFlagSet(Page::IS_EXECUTABLE));
-        current->ClearOutOfLiveRangeSlots(free_start);
-        const size_t bytes_to_free =
-            current->size() - (free_start - current->address());
-        heap()->memory_allocator()->PartialFreeMemory(
-            current, free_start, bytes_to_free,
-            current->area_start() + object.Size());
-        size_ -= bytes_to_free;
-        AccountUncommitted(bytes_to_free);
-      }
-    } else {
-      RemovePage(current, size);
-      heap()->memory_allocator()->Free<MemoryAllocator::kPreFreeAndQueue>(
-          current);
-    }
-    current = next_current;
-  }
-  objects_size_ = surviving_object_size;
-}
-
-bool LargeObjectSpace::Contains(HeapObject object) {
-  MemoryChunk* chunk = MemoryChunk::FromHeapObject(object);
-
-  bool owned = (chunk->owner() == this);
-
-  SLOW_DCHECK(!owned || ContainsSlow(object.address()));
-
-  return owned;
-}
-
-bool LargeObjectSpace::ContainsSlow(Address addr) {
-  for (LargePage* page : *this) {
-    if (page->Contains(addr)) return true;
-  }
-  return false;
-}
-
-std::unique_ptr<ObjectIterator> LargeObjectSpace::GetObjectIterator(
-    Heap* heap) {
-  return std::unique_ptr<ObjectIterator>(
-      new LargeObjectSpaceObjectIterator(this));
-}
-
-#ifdef VERIFY_HEAP
-// We do not assume that the large object iterator works, because it depends
-// on the invariants we are checking during verification.
-void LargeObjectSpace::Verify(Isolate* isolate) {
-  size_t external_backing_store_bytes[kNumTypes];
-
-  for (int i = 0; i < kNumTypes; i++) {
-    external_backing_store_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
-  }
-
-  for (LargePage* chunk = first_page(); chunk != nullptr;
-       chunk = chunk->next_page()) {
-    // Each chunk contains an object that starts at the large object page's
-    // object area start.
-    HeapObject object = chunk->GetObject();
-    Page* page = Page::FromHeapObject(object);
-    CHECK(object.address() == page->area_start());
-
-    // The first word should be a map, and we expect all map pointers to be
-    // in map space or read-only space.
-    Map map = object.map();
-    CHECK(map.IsMap());
-    CHECK(ReadOnlyHeap::Contains(map) || heap()->map_space()->Contains(map));
-
-    // We have only the following types in the large object space:
-    if (!(object.IsAbstractCode() || object.IsSeqString() ||
-          object.IsExternalString() || object.IsThinString() ||
-          object.IsFixedArray() || object.IsFixedDoubleArray() ||
-          object.IsWeakFixedArray() || object.IsWeakArrayList() ||
-          object.IsPropertyArray() || object.IsByteArray() ||
-          object.IsFeedbackVector() || object.IsBigInt() ||
-          object.IsFreeSpace() || object.IsFeedbackMetadata() ||
-          object.IsContext() || object.IsUncompiledDataWithoutPreparseData() ||
-          object.IsPreparseData()) &&
-        !FLAG_young_generation_large_objects) {
-      FATAL("Found invalid Object (instance_type=%i) in large object space.",
-            object.map().instance_type());
-    }
-
-    // The object itself should look OK.
-    object.ObjectVerify(isolate);
-
-    if (!FLAG_verify_heap_skip_remembered_set) {
-      heap()->VerifyRememberedSetFor(object);
-    }
-
-    // Byte arrays and strings don't have interior pointers.
-    if (object.IsAbstractCode()) {
-      VerifyPointersVisitor code_visitor(heap());
-      object.IterateBody(map, object.Size(), &code_visitor);
-    } else if (object.IsFixedArray()) {
-      FixedArray array = FixedArray::cast(object);
-      for (int j = 0; j < array.length(); j++) {
-        Object element = array.get(j);
-        if (element.IsHeapObject()) {
-          HeapObject element_object = HeapObject::cast(element);
-          CHECK(IsValidHeapObject(heap(), element_object));
-          CHECK(element_object.map().IsMap());
-        }
-      }
-    } else if (object.IsPropertyArray()) {
-      PropertyArray array = PropertyArray::cast(object);
-      for (int j = 0; j < array.length(); j++) {
-        Object property = array.get(j);
-        if (property.IsHeapObject()) {
-          HeapObject property_object = HeapObject::cast(property);
-          CHECK(heap()->Contains(property_object));
-          CHECK(property_object.map().IsMap());
-        }
-      }
-    }
-    for (int i = 0; i < kNumTypes; i++) {
-      ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
-      external_backing_store_bytes[t] += chunk->ExternalBackingStoreBytes(t);
-    }
-  }
-  for (int i = 0; i < kNumTypes; i++) {
-    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
-    CHECK_EQ(external_backing_store_bytes[t], ExternalBackingStoreBytes(t));
-  }
-}
-#endif
-
-#ifdef DEBUG
-void LargeObjectSpace::Print() {
-  StdoutStream os;
-  LargeObjectSpaceObjectIterator it(this);
-  for (HeapObject obj = it.Next(); !obj.is_null(); obj = it.Next()) {
-    obj.Print(os);
-  }
-}
-#endif  // DEBUG
-
-OldLargeObjectSpace::OldLargeObjectSpace(Heap* heap)
-    : LargeObjectSpace(heap, LO_SPACE) {}
-
-OldLargeObjectSpace::OldLargeObjectSpace(Heap* heap, AllocationSpace id)
-    : LargeObjectSpace(heap, id) {}
-
-void OldLargeObjectSpace::MergeOffThreadSpace(
-    OffThreadLargeObjectSpace* other) {
-  DCHECK(identity() == other->identity());
-
-  while (!other->memory_chunk_list().Empty()) {
-    LargePage* page = other->first_page();
-    HeapObject object = page->GetObject();
-    int size = object.Size();
-    other->RemovePage(page, size);
-    AddPage(page, size);
-
-    AllocationStepAfterMerge(object.address(), size);
-    if (heap()->incremental_marking()->black_allocation()) {
-      heap()->incremental_marking()->marking_state()->WhiteToBlack(object);
-    }
-    DCHECK_IMPLIES(
-        heap()->incremental_marking()->black_allocation(),
-        heap()->incremental_marking()->marking_state()->IsBlack(object));
-  }
-
-  heap()->NotifyOffThreadSpaceMerged();
-}
-
-NewLargeObjectSpace::NewLargeObjectSpace(Heap* heap, size_t capacity)
-    : LargeObjectSpace(heap, NEW_LO_SPACE),
-      pending_object_(0),
-      capacity_(capacity) {}
-
-AllocationResult NewLargeObjectSpace::AllocateRaw(int object_size) {
-  // Do not allocate more objects if promoting the existing object would exceed
-  // the old generation capacity.
-  if (!heap()->CanExpandOldGeneration(SizeOfObjects())) {
-    return AllocationResult::Retry(identity());
-  }
-
-  // Allocation for the first object must succeed independent from the capacity.
-  if (SizeOfObjects() > 0 && static_cast<size_t>(object_size) > Available()) {
-    return AllocationResult::Retry(identity());
-  }
-
-  LargePage* page = AllocateLargePage(object_size, NOT_EXECUTABLE);
-  if (page == nullptr) return AllocationResult::Retry(identity());
-
-  // The size of the first object may exceed the capacity.
-  capacity_ = Max(capacity_, SizeOfObjects());
-
-  HeapObject result = page->GetObject();
-  page->SetYoungGenerationPageFlags(heap()->incremental_marking()->IsMarking());
-  page->SetFlag(MemoryChunk::TO_PAGE);
-  pending_object_.store(result.address(), std::memory_order_relaxed);
-#ifdef ENABLE_MINOR_MC
-  if (FLAG_minor_mc) {
-    page->AllocateYoungGenerationBitmap();
-    heap()
-        ->minor_mark_compact_collector()
-        ->non_atomic_marking_state()
-        ->ClearLiveness(page);
-  }
-#endif  // ENABLE_MINOR_MC
-  page->InitializationMemoryFence();
-  DCHECK(page->IsLargePage());
-  DCHECK_EQ(page->owner_identity(), NEW_LO_SPACE);
-  AllocationStep(object_size, result.address(), object_size);
-  return result;
-}
-
-size_t NewLargeObjectSpace::Available() { return capacity_ - SizeOfObjects(); }
-
-void NewLargeObjectSpace::Flip() {
-  for (LargePage* chunk = first_page(); chunk != nullptr;
-       chunk = chunk->next_page()) {
-    chunk->SetFlag(MemoryChunk::FROM_PAGE);
-    chunk->ClearFlag(MemoryChunk::TO_PAGE);
-  }
-}
-
-void NewLargeObjectSpace::FreeDeadObjects(
-    const std::function<bool(HeapObject)>& is_dead) {
-  bool is_marking = heap()->incremental_marking()->IsMarking();
-  size_t surviving_object_size = 0;
-  bool freed_pages = false;
-  for (auto it = begin(); it != end();) {
-    LargePage* page = *it;
-    it++;
-    HeapObject object = page->GetObject();
-    size_t size = static_cast<size_t>(object.Size());
-    if (is_dead(object)) {
-      freed_pages = true;
-      RemovePage(page, size);
-      heap()->memory_allocator()->Free<MemoryAllocator::kPreFreeAndQueue>(page);
-      if (FLAG_concurrent_marking && is_marking) {
-        heap()->concurrent_marking()->ClearMemoryChunkData(page);
-      }
-    } else {
-      surviving_object_size += size;
-    }
-  }
-  // Right-trimming does not update the objects_size_ counter. We are lazily
-  // updating it after every GC.
-  objects_size_ = surviving_object_size;
-  if (freed_pages) {
-    heap()->memory_allocator()->unmapper()->FreeQueuedChunks();
-  }
-}
-
-void NewLargeObjectSpace::SetCapacity(size_t capacity) {
-  capacity_ = Max(capacity, SizeOfObjects());
-}
-
-CodeLargeObjectSpace::CodeLargeObjectSpace(Heap* heap)
-    : OldLargeObjectSpace(heap, CODE_LO_SPACE),
-      chunk_map_(kInitialChunkMapCapacity) {}
-
-AllocationResult CodeLargeObjectSpace::AllocateRaw(int object_size) {
-  return OldLargeObjectSpace::AllocateRaw(object_size, EXECUTABLE);
-}
-
-void CodeLargeObjectSpace::AddPage(LargePage* page, size_t object_size) {
-  OldLargeObjectSpace::AddPage(page, object_size);
-  InsertChunkMapEntries(page);
-  heap()->isolate()->AddCodeMemoryChunk(page);
-}
-
-void CodeLargeObjectSpace::RemovePage(LargePage* page, size_t object_size) {
-  RemoveChunkMapEntries(page);
-  heap()->isolate()->RemoveCodeMemoryChunk(page);
-  OldLargeObjectSpace::RemovePage(page, object_size);
-}
-
-OffThreadLargeObjectSpace::OffThreadLargeObjectSpace(Heap* heap)
-    : LargeObjectSpace(heap, LO_SPACE) {
-#ifdef V8_ENABLE_THIRD_PARTY_HEAP
-  // OffThreadLargeObjectSpace doesn't work with third-party heap.
-  UNREACHABLE();
-#endif
-}
-
-AllocationResult OffThreadLargeObjectSpace::AllocateRaw(int object_size) {
-  LargePage* page = AllocateLargePage(object_size, NOT_EXECUTABLE);
-  if (page == nullptr) return AllocationResult::Retry(identity());
-
-  return page->GetObject();
-}
-
-void OffThreadLargeObjectSpace::FreeUnmarkedObjects() {
-  // We should never try to free objects in this space.
-  UNREACHABLE();
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/heap/spaces.h b/deps/v8/src/heap/spaces.h
index 8d587443e3e..02b8e1b2066 100644
--- a/deps/v8/src/heap/spaces.h
+++ b/deps/v8/src/heap/spaces.h
@@ -6,32 +6,21 @@
 #define V8_HEAP_SPACES_H_
 
 #include <atomic>
-#include <list>
-#include <map>
 #include <memory>
 #include <unordered_map>
-#include <unordered_set>
 #include <vector>
 
-#include "src/base/atomic-utils.h"
-#include "src/base/bounded-page-allocator.h"
-#include "src/base/export-template.h"
 #include "src/base/iterator.h"
-#include "src/base/list.h"
 #include "src/base/macros.h"
-#include "src/base/platform/mutex.h"
 #include "src/common/globals.h"
-#include "src/flags/flags.h"
 #include "src/heap/basic-memory-chunk.h"
 #include "src/heap/heap.h"
-#include "src/heap/invalidated-slots.h"
-#include "src/heap/marking.h"
-#include "src/heap/slot-set.h"
+#include "src/heap/list.h"
+#include "src/heap/memory-chunk.h"
 #include "src/objects/free-space.h"
 #include "src/objects/heap-object.h"
 #include "src/objects/map.h"
 #include "src/objects/objects.h"
-#include "src/tasks/cancelable-task.h"
 #include "src/utils/allocation.h"
 #include "src/utils/utils.h"
 #include "testing/gtest/include/gtest/gtest_prod.h"  // nogncheck
@@ -45,25 +34,15 @@ class TestCodePageAllocatorScope;
 }  // namespace heap
 
 class AllocationObserver;
-class CompactionSpace;
-class CompactionSpaceCollection;
 class FreeList;
 class Isolate;
 class LargeObjectSpace;
+class LargePage;
 class LinearAllocationArea;
 class LocalArrayBufferTracker;
-class LocalSpace;
-class MemoryAllocator;
-class MemoryChunk;
-class MemoryChunkLayout;
-class OffThreadSpace;
 class Page;
 class PagedSpace;
 class SemiSpace;
-class SlotsBuffer;
-class SlotSet;
-class TypedSlotSet;
-class Space;
 
 // -----------------------------------------------------------------------------
 // Heap structures:
@@ -496,7 +475,10 @@ class V8_EXPORT_PRIVATE Space : public Malloced {
   MemoryChunk* first_page() { return memory_chunk_list_.front(); }
   MemoryChunk* last_page() { return memory_chunk_list_.back(); }
 
-  base::List<MemoryChunk>& memory_chunk_list() { return memory_chunk_list_; }
+  const MemoryChunk* first_page() const { return memory_chunk_list_.front(); }
+  const MemoryChunk* last_page() const { return memory_chunk_list_.back(); }
+
+  heap::List<MemoryChunk>& memory_chunk_list() { return memory_chunk_list_; }
 
   FreeList* free_list() { return free_list_.get(); }
 
@@ -515,7 +497,7 @@ class V8_EXPORT_PRIVATE Space : public Malloced {
   std::vector<AllocationObserver*> allocation_observers_;
 
   // The List manages the pages that belong to the given space.
-  base::List<MemoryChunk> memory_chunk_list_;
+  heap::List<MemoryChunk> memory_chunk_list_;
 
   // Tracks off-heap memory used by this space.
   std::atomic<size_t>* external_backing_store_bytes_;
@@ -525,7 +507,7 @@ class V8_EXPORT_PRIVATE Space : public Malloced {
   AllocationSpace id_;
 
   // Keeps track of committed memory in a space.
-  size_t committed_;
+  std::atomic<size_t> committed_;
   size_t max_committed_;
 
   std::unique_ptr<FreeList> free_list_;
@@ -533,469 +515,6 @@ class V8_EXPORT_PRIVATE Space : public Malloced {
   DISALLOW_COPY_AND_ASSIGN(Space);
 };
 
-// The CodeObjectRegistry holds all start addresses of code objects of a given
-// MemoryChunk. Each MemoryChunk owns a separate CodeObjectRegistry. The
-// CodeObjectRegistry allows fast lookup from an inner pointer of a code object
-// to the actual code object.
-class V8_EXPORT_PRIVATE CodeObjectRegistry {
- public:
-  void RegisterNewlyAllocatedCodeObject(Address code);
-  void RegisterAlreadyExistingCodeObject(Address code);
-  void Clear();
-  void Finalize();
-  bool Contains(Address code) const;
-  Address GetCodeObjectStartFromInnerAddress(Address address) const;
-
- private:
-  std::vector<Address> code_object_registry_already_existing_;
-  std::set<Address> code_object_registry_newly_allocated_;
-};
-
-class V8_EXPORT_PRIVATE MemoryChunkLayout {
- public:
-  static size_t CodePageGuardStartOffset();
-  static size_t CodePageGuardSize();
-  static intptr_t ObjectStartOffsetInCodePage();
-  static intptr_t ObjectEndOffsetInCodePage();
-  static size_t AllocatableMemoryInCodePage();
-  static intptr_t ObjectStartOffsetInDataPage();
-  static size_t AllocatableMemoryInDataPage();
-  static size_t ObjectStartOffsetInMemoryChunk(AllocationSpace space);
-  static size_t AllocatableMemoryInMemoryChunk(AllocationSpace space);
-};
-
-// MemoryChunk represents a memory region owned by a specific space.
-// It is divided into the header and the body. Chunk start is always
-// 1MB aligned. Start of the body is aligned so it can accommodate
-// any heap object.
-class MemoryChunk : public BasicMemoryChunk {
- public:
-  // Use with std data structures.
-  struct Hasher {
-    size_t operator()(MemoryChunk* const chunk) const {
-      return reinterpret_cast<size_t>(chunk) >> kPageSizeBits;
-    }
-  };
-
-  using Flags = uintptr_t;
-
-  static const Flags kPointersToHereAreInterestingMask =
-      POINTERS_TO_HERE_ARE_INTERESTING;
-
-  static const Flags kPointersFromHereAreInterestingMask =
-      POINTERS_FROM_HERE_ARE_INTERESTING;
-
-  static const Flags kEvacuationCandidateMask = EVACUATION_CANDIDATE;
-
-  static const Flags kIsInYoungGenerationMask = FROM_PAGE | TO_PAGE;
-
-  static const Flags kIsLargePageMask = LARGE_PAGE;
-
-  static const Flags kSkipEvacuationSlotsRecordingMask =
-      kEvacuationCandidateMask | kIsInYoungGenerationMask;
-
-  // |kDone|: The page state when sweeping is complete or sweeping must not be
-  //   performed on that page. Sweeper threads that are done with their work
-  //   will set this value and not touch the page anymore.
-  // |kPending|: This page is ready for parallel sweeping.
-  // |kInProgress|: This page is currently swept by a sweeper thread.
-  enum class ConcurrentSweepingState : intptr_t {
-    kDone,
-    kPending,
-    kInProgress,
-  };
-
-  static const size_t kHeaderSize =
-      BasicMemoryChunk::kHeaderSize  // Parent size.
-      + 3 * kSystemPointerSize       // VirtualMemory reservation_
-      + kSystemPointerSize           // Address owner_
-      + kSizetSize                   // size_t progress_bar_
-      + kIntptrSize                  // intptr_t live_byte_count_
-      + kSystemPointerSize           // SlotSet* sweeping_slot_set_
-      + kSystemPointerSize *
-            NUMBER_OF_REMEMBERED_SET_TYPES  // TypedSlotSet* array
-      + kSystemPointerSize *
-            NUMBER_OF_REMEMBERED_SET_TYPES  // InvalidatedSlots* array
-      + kSystemPointerSize  // std::atomic<intptr_t> high_water_mark_
-      + kSystemPointerSize  // base::Mutex* mutex_
-      + kSystemPointerSize  // std::atomic<ConcurrentSweepingState>
-                            // concurrent_sweeping_
-      + kSystemPointerSize  // base::Mutex* page_protection_change_mutex_
-      + kSystemPointerSize  // unitptr_t write_unprotect_counter_
-      + kSizetSize * ExternalBackingStoreType::kNumTypes
-      // std::atomic<size_t> external_backing_store_bytes_
-      + kSizetSize              // size_t allocated_bytes_
-      + kSizetSize              // size_t wasted_memory_
-      + kSystemPointerSize * 2  // base::ListNode
-      + kSystemPointerSize      // FreeListCategory** categories__
-      + kSystemPointerSize      // LocalArrayBufferTracker* local_tracker_
-      + kIntptrSize  // std::atomic<intptr_t> young_generation_live_byte_count_
-      + kSystemPointerSize   // Bitmap* young_generation_bitmap_
-      + kSystemPointerSize   // CodeObjectRegistry* code_object_registry_
-      + kSystemPointerSize;  // PossiblyEmptyBuckets possibly_empty_buckets_
-
-  // Page size in bytes.  This must be a multiple of the OS page size.
-  static const int kPageSize = 1 << kPageSizeBits;
-
-  // Maximum number of nested code memory modification scopes.
-  static const int kMaxWriteUnprotectCounter = 3;
-
-  // Only works if the pointer is in the first kPageSize of the MemoryChunk.
-  static MemoryChunk* FromAddress(Address a) {
-    DCHECK(!V8_ENABLE_THIRD_PARTY_HEAP_BOOL);
-    return reinterpret_cast<MemoryChunk*>(BaseAddress(a));
-  }
-  // Only works if the object is in the first kPageSize of the MemoryChunk.
-  static MemoryChunk* FromHeapObject(HeapObject o) {
-    DCHECK(!V8_ENABLE_THIRD_PARTY_HEAP_BOOL);
-    return reinterpret_cast<MemoryChunk*>(BaseAddress(o.ptr()));
-  }
-
-  void SetOldGenerationPageFlags(bool is_marking);
-  void SetYoungGenerationPageFlags(bool is_marking);
-
-  static inline void UpdateHighWaterMark(Address mark) {
-    if (mark == kNullAddress) return;
-    // Need to subtract one from the mark because when a chunk is full the
-    // top points to the next address after the chunk, which effectively belongs
-    // to another chunk. See the comment to Page::FromAllocationAreaAddress.
-    MemoryChunk* chunk = MemoryChunk::FromAddress(mark - 1);
-    intptr_t new_mark = static_cast<intptr_t>(mark - chunk->address());
-    intptr_t old_mark = chunk->high_water_mark_.load(std::memory_order_relaxed);
-    while ((new_mark > old_mark) &&
-           !chunk->high_water_mark_.compare_exchange_weak(
-               old_mark, new_mark, std::memory_order_acq_rel)) {
-    }
-  }
-
-  static inline void MoveExternalBackingStoreBytes(
-      ExternalBackingStoreType type, MemoryChunk* from, MemoryChunk* to,
-      size_t amount);
-
-  void DiscardUnusedMemory(Address addr, size_t size);
-
-  base::Mutex* mutex() { return mutex_; }
-
-  void set_concurrent_sweeping_state(ConcurrentSweepingState state) {
-    concurrent_sweeping_ = state;
-  }
-
-  ConcurrentSweepingState concurrent_sweeping_state() {
-    return static_cast<ConcurrentSweepingState>(concurrent_sweeping_.load());
-  }
-
-  bool SweepingDone() {
-    return concurrent_sweeping_ == ConcurrentSweepingState::kDone;
-  }
-
-  inline Heap* heap() const {
-    DCHECK_NOT_NULL(heap_);
-    return heap_;
-  }
-
-#ifdef THREAD_SANITIZER
-  // Perform a dummy acquire load to tell TSAN that there is no data race in
-  // mark-bit initialization. See MemoryChunk::Initialize for the corresponding
-  // release store.
-  void SynchronizedHeapLoad();
-#endif
-
-  template <RememberedSetType type>
-  bool ContainsSlots() {
-    return slot_set<type>() != nullptr || typed_slot_set<type>() != nullptr ||
-           invalidated_slots<type>() != nullptr;
-  }
-
-  template <RememberedSetType type, AccessMode access_mode = AccessMode::ATOMIC>
-  SlotSet* slot_set() {
-    if (access_mode == AccessMode::ATOMIC)
-      return base::AsAtomicPointer::Acquire_Load(&slot_set_[type]);
-    return slot_set_[type];
-  }
-
-  template <AccessMode access_mode = AccessMode::ATOMIC>
-  SlotSet* sweeping_slot_set() {
-    if (access_mode == AccessMode::ATOMIC)
-      return base::AsAtomicPointer::Acquire_Load(&sweeping_slot_set_);
-    return sweeping_slot_set_;
-  }
-
-  template <RememberedSetType type, AccessMode access_mode = AccessMode::ATOMIC>
-  TypedSlotSet* typed_slot_set() {
-    if (access_mode == AccessMode::ATOMIC)
-      return base::AsAtomicPointer::Acquire_Load(&typed_slot_set_[type]);
-    return typed_slot_set_[type];
-  }
-
-  template <RememberedSetType type>
-  V8_EXPORT_PRIVATE SlotSet* AllocateSlotSet();
-  SlotSet* AllocateSweepingSlotSet();
-  SlotSet* AllocateSlotSet(SlotSet** slot_set);
-
-  // Not safe to be called concurrently.
-  template <RememberedSetType type>
-  void ReleaseSlotSet();
-  void ReleaseSlotSet(SlotSet** slot_set);
-  void ReleaseSweepingSlotSet();
-  template <RememberedSetType type>
-  TypedSlotSet* AllocateTypedSlotSet();
-  // Not safe to be called concurrently.
-  template <RememberedSetType type>
-  void ReleaseTypedSlotSet();
-
-  template <RememberedSetType type>
-  InvalidatedSlots* AllocateInvalidatedSlots();
-  template <RememberedSetType type>
-  void ReleaseInvalidatedSlots();
-  template <RememberedSetType type>
-  V8_EXPORT_PRIVATE void RegisterObjectWithInvalidatedSlots(HeapObject object);
-  void InvalidateRecordedSlots(HeapObject object);
-  template <RememberedSetType type>
-  bool RegisteredObjectWithInvalidatedSlots(HeapObject object);
-  template <RememberedSetType type>
-  InvalidatedSlots* invalidated_slots() {
-    return invalidated_slots_[type];
-  }
-
-  void ReleaseLocalTracker();
-
-  void AllocateYoungGenerationBitmap();
-  void ReleaseYoungGenerationBitmap();
-
-  int FreeListsLength();
-
-  // Approximate amount of physical memory committed for this chunk.
-  V8_EXPORT_PRIVATE size_t CommittedPhysicalMemory();
-
-  Address HighWaterMark() { return address() + high_water_mark_; }
-
-  size_t ProgressBar() {
-    DCHECK(IsFlagSet<AccessMode::ATOMIC>(HAS_PROGRESS_BAR));
-    return progress_bar_.load(std::memory_order_acquire);
-  }
-
-  bool TrySetProgressBar(size_t old_value, size_t new_value) {
-    DCHECK(IsFlagSet<AccessMode::ATOMIC>(HAS_PROGRESS_BAR));
-    return progress_bar_.compare_exchange_strong(old_value, new_value,
-                                                 std::memory_order_acq_rel);
-  }
-
-  void ResetProgressBar() {
-    if (IsFlagSet(MemoryChunk::HAS_PROGRESS_BAR)) {
-      progress_bar_.store(0, std::memory_order_release);
-    }
-  }
-
-  inline void IncrementExternalBackingStoreBytes(ExternalBackingStoreType type,
-                                                 size_t amount);
-
-  inline void DecrementExternalBackingStoreBytes(ExternalBackingStoreType type,
-                                                 size_t amount);
-
-  size_t ExternalBackingStoreBytes(ExternalBackingStoreType type) {
-    return external_backing_store_bytes_[type];
-  }
-
-  // Some callers rely on the fact that this can operate on both
-  // tagged and aligned object addresses.
-  inline uint32_t AddressToMarkbitIndex(Address addr) const {
-    return static_cast<uint32_t>(addr - this->address()) >> kTaggedSizeLog2;
-  }
-
-  inline Address MarkbitIndexToAddress(uint32_t index) const {
-    return this->address() + (index << kTaggedSizeLog2);
-  }
-
-  bool NeverEvacuate() { return IsFlagSet(NEVER_EVACUATE); }
-
-  void MarkNeverEvacuate() { SetFlag(NEVER_EVACUATE); }
-
-  bool CanAllocate() {
-    return !IsEvacuationCandidate() && !IsFlagSet(NEVER_ALLOCATE_ON_PAGE);
-  }
-
-  template <AccessMode access_mode = AccessMode::NON_ATOMIC>
-  bool IsEvacuationCandidate() {
-    DCHECK(!(IsFlagSet<access_mode>(NEVER_EVACUATE) &&
-             IsFlagSet<access_mode>(EVACUATION_CANDIDATE)));
-    return IsFlagSet<access_mode>(EVACUATION_CANDIDATE);
-  }
-
-  template <AccessMode access_mode = AccessMode::NON_ATOMIC>
-  bool ShouldSkipEvacuationSlotRecording() {
-    uintptr_t flags = GetFlags<access_mode>();
-    return ((flags & kSkipEvacuationSlotsRecordingMask) != 0) &&
-           ((flags & COMPACTION_WAS_ABORTED) == 0);
-  }
-
-  Executability executable() {
-    return IsFlagSet(IS_EXECUTABLE) ? EXECUTABLE : NOT_EXECUTABLE;
-  }
-
-  bool IsFromPage() const { return IsFlagSet(FROM_PAGE); }
-  bool IsToPage() const { return IsFlagSet(TO_PAGE); }
-  bool IsLargePage() const { return IsFlagSet(LARGE_PAGE); }
-  bool InYoungGeneration() const {
-    return (GetFlags() & kIsInYoungGenerationMask) != 0;
-  }
-  bool InNewSpace() const { return InYoungGeneration() && !IsLargePage(); }
-  bool InNewLargeObjectSpace() const {
-    return InYoungGeneration() && IsLargePage();
-  }
-  bool InOldSpace() const;
-  V8_EXPORT_PRIVATE bool InLargeObjectSpace() const;
-
-  // Gets the chunk's owner or null if the space has been detached.
-  Space* owner() const { return owner_; }
-
-  void set_owner(Space* space) { owner_ = space; }
-
-  bool IsWritable() const {
-    // If this is a read-only space chunk but heap_ is non-null, it has not yet
-    // been sealed and can be written to.
-    return !InReadOnlySpace() || heap_ != nullptr;
-  }
-
-  // Gets the chunk's allocation space, potentially dealing with a null owner_
-  // (like read-only chunks have).
-  inline AllocationSpace owner_identity() const;
-
-  // Emits a memory barrier. For TSAN builds the other thread needs to perform
-  // MemoryChunk::synchronized_heap() to simulate the barrier.
-  void InitializationMemoryFence();
-
-  V8_EXPORT_PRIVATE void SetReadable();
-  V8_EXPORT_PRIVATE void SetReadAndExecutable();
-  V8_EXPORT_PRIVATE void SetReadAndWritable();
-
-  void SetDefaultCodePermissions() {
-    if (FLAG_jitless) {
-      SetReadable();
-    } else {
-      SetReadAndExecutable();
-    }
-  }
-
-  base::ListNode<MemoryChunk>& list_node() { return list_node_; }
-
-  CodeObjectRegistry* GetCodeObjectRegistry() { return code_object_registry_; }
-
-  FreeList* free_list() { return owner()->free_list(); }
-
-  PossiblyEmptyBuckets* possibly_empty_buckets() {
-    return &possibly_empty_buckets_;
-  }
-
- protected:
-  static MemoryChunk* Initialize(Heap* heap, Address base, size_t size,
-                                 Address area_start, Address area_end,
-                                 Executability executable, Space* owner,
-                                 VirtualMemory reservation);
-
-  // Release all memory allocated by the chunk. Should be called when memory
-  // chunk is about to be freed.
-  void ReleaseAllAllocatedMemory();
-  // Release memory allocated by the chunk, except that which is needed by
-  // read-only space chunks.
-  void ReleaseAllocatedMemoryNeededForWritableChunk();
-
-  // Sets the requested page permissions only if the write unprotect counter
-  // has reached 0.
-  void DecrementWriteUnprotectCounterAndMaybeSetPermissions(
-      PageAllocator::Permission permission);
-
-  VirtualMemory* reserved_memory() { return &reservation_; }
-
-  template <AccessMode mode>
-  ConcurrentBitmap<mode>* marking_bitmap() const {
-    return reinterpret_cast<ConcurrentBitmap<mode>*>(marking_bitmap_);
-  }
-
-  template <AccessMode mode>
-  ConcurrentBitmap<mode>* young_generation_bitmap() const {
-    return reinterpret_cast<ConcurrentBitmap<mode>*>(young_generation_bitmap_);
-  }
-
-  // If the chunk needs to remember its memory reservation, it is stored here.
-  VirtualMemory reservation_;
-
-  // The space owning this memory chunk.
-  std::atomic<Space*> owner_;
-
-  // Used by the incremental marker to keep track of the scanning progress in
-  // large objects that have a progress bar and are scanned in increments.
-  std::atomic<size_t> progress_bar_;
-
-  // Count of bytes marked black on page.
-  intptr_t live_byte_count_;
-
-  // A single slot set for small pages (of size kPageSize) or an array of slot
-  // set for large pages. In the latter case the number of entries in the array
-  // is ceil(size() / kPageSize).
-  SlotSet* sweeping_slot_set_;
-  TypedSlotSet* typed_slot_set_[NUMBER_OF_REMEMBERED_SET_TYPES];
-  InvalidatedSlots* invalidated_slots_[NUMBER_OF_REMEMBERED_SET_TYPES];
-
-  // Assuming the initial allocation on a page is sequential,
-  // count highest number of bytes ever allocated on the page.
-  std::atomic<intptr_t> high_water_mark_;
-
-  base::Mutex* mutex_;
-
-  std::atomic<ConcurrentSweepingState> concurrent_sweeping_;
-
-  base::Mutex* page_protection_change_mutex_;
-
-  // This field is only relevant for code pages. It depicts the number of
-  // times a component requested this page to be read+writeable. The
-  // counter is decremented when a component resets to read+executable.
-  // If Value() == 0 => The memory is read and executable.
-  // If Value() >= 1 => The Memory is read and writable (and maybe executable).
-  // The maximum value is limited by {kMaxWriteUnprotectCounter} to prevent
-  // excessive nesting of scopes.
-  // All executable MemoryChunks are allocated rw based on the assumption that
-  // they will be used immediatelly for an allocation. They are initialized
-  // with the number of open CodeSpaceMemoryModificationScopes. The caller
-  // that triggers the page allocation is responsible for decrementing the
-  // counter.
-  uintptr_t write_unprotect_counter_;
-
-  // Byte allocated on the page, which includes all objects on the page
-  // and the linear allocation area.
-  size_t allocated_bytes_;
-
-  // Tracks off-heap memory used by this memory chunk.
-  std::atomic<size_t> external_backing_store_bytes_[kNumTypes];
-
-  // Freed memory that was not added to the free list.
-  size_t wasted_memory_;
-
-  base::ListNode<MemoryChunk> list_node_;
-
-  FreeListCategory** categories_;
-
-  LocalArrayBufferTracker* local_tracker_;
-
-  std::atomic<intptr_t> young_generation_live_byte_count_;
-  Bitmap* young_generation_bitmap_;
-
-  CodeObjectRegistry* code_object_registry_;
-
-  PossiblyEmptyBuckets possibly_empty_buckets_;
-
- private:
-  void InitializeReservedMemory() { reservation_.Reset(); }
-
-  friend class ConcurrentMarkingState;
-  friend class MajorMarkingState;
-  friend class MajorAtomicMarkingState;
-  friend class MajorNonAtomicMarkingState;
-  friend class MemoryAllocator;
-  friend class MinorMarkingState;
-  friend class MinorNonAtomicMarkingState;
-  friend class PagedSpace;
-};
-
 STATIC_ASSERT(sizeof(std::atomic<intptr_t>) == kSystemPointerSize);
 
 // -----------------------------------------------------------------------------
@@ -1051,9 +570,17 @@ class Page : public MemoryChunk {
   Page* next_page() { return static_cast<Page*>(list_node_.next()); }
   Page* prev_page() { return static_cast<Page*>(list_node_.prev()); }
 
+  const Page* next_page() const {
+    return static_cast<const Page*>(list_node_.next());
+  }
+  const Page* prev_page() const {
+    return static_cast<const Page*>(list_node_.prev());
+  }
+
   template <typename Callback>
   inline void ForAllFreeListCategories(Callback callback) {
-    for (int i = kFirstCategory; i < free_list()->number_of_categories(); i++) {
+    for (int i = kFirstCategory;
+         i < owner()->free_list()->number_of_categories(); i++) {
       callback(categories_[i]);
     }
   }
@@ -1102,7 +629,9 @@ class Page : public MemoryChunk {
   size_t ShrinkToHighWaterMark();
 
   V8_EXPORT_PRIVATE void CreateBlackArea(Address start, Address end);
+  V8_EXPORT_PRIVATE void CreateBlackAreaBackground(Address start, Address end);
   void DestroyBlackArea(Address start, Address end);
+  void DestroyBlackAreaBackground(Address start, Address end);
 
   void InitializeFreeListCategories();
   void AllocateFreeListCategories();
@@ -1115,450 +644,11 @@ class Page : public MemoryChunk {
   friend class MemoryAllocator;
 };
 
-class ReadOnlyPage : public Page {
- public:
-  // Clears any pointers in the header that point out of the page that would
-  // otherwise make the header non-relocatable.
-  void MakeHeaderRelocatable();
-
- private:
-  friend class ReadOnlySpace;
-};
-
-class LargePage : public MemoryChunk {
- public:
-  // A limit to guarantee that we do not overflow typed slot offset in
-  // the old to old remembered set.
-  // Note that this limit is higher than what assembler already imposes on
-  // x64 and ia32 architectures.
-  static const int kMaxCodePageSize = 512 * MB;
-
-  static LargePage* FromHeapObject(HeapObject o) {
-    return static_cast<LargePage*>(MemoryChunk::FromHeapObject(o));
-  }
-
-  inline HeapObject GetObject();
-
-  inline LargePage* next_page() {
-    return static_cast<LargePage*>(list_node_.next());
-  }
-
-  // Uncommit memory that is not in use anymore by the object. If the object
-  // cannot be shrunk 0 is returned.
-  Address GetAddressToShrink(Address object_address, size_t object_size);
-
-  void ClearOutOfLiveRangeSlots(Address free_start);
-
- private:
-  static LargePage* Initialize(Heap* heap, MemoryChunk* chunk,
-                               Executability executable);
-
-  friend class MemoryAllocator;
-};
-
 // Validate our estimates on the header size.
 STATIC_ASSERT(sizeof(BasicMemoryChunk) <= BasicMemoryChunk::kHeaderSize);
 STATIC_ASSERT(sizeof(MemoryChunk) <= MemoryChunk::kHeaderSize);
-STATIC_ASSERT(sizeof(LargePage) <= MemoryChunk::kHeaderSize);
 STATIC_ASSERT(sizeof(Page) <= MemoryChunk::kHeaderSize);
 
-// The process-wide singleton that keeps track of code range regions with the
-// intention to reuse free code range regions as a workaround for CFG memory
-// leaks (see crbug.com/870054).
-class CodeRangeAddressHint {
- public:
-  // Returns the most recently freed code range start address for the given
-  // size. If there is no such entry, then a random address is returned.
-  V8_EXPORT_PRIVATE Address GetAddressHint(size_t code_range_size);
-
-  V8_EXPORT_PRIVATE void NotifyFreedCodeRange(Address code_range_start,
-                                              size_t code_range_size);
-
- private:
-  base::Mutex mutex_;
-  // A map from code range size to an array of recently freed code range
-  // addresses. There should be O(1) different code range sizes.
-  // The length of each array is limited by the peak number of code ranges,
-  // which should be also O(1).
-  std::unordered_map<size_t, std::vector<Address>> recently_freed_;
-};
-
-// ----------------------------------------------------------------------------
-// A space acquires chunks of memory from the operating system. The memory
-// allocator allocates and deallocates pages for the paged heap spaces and large
-// pages for large object space.
-class MemoryAllocator {
- public:
-  // Unmapper takes care of concurrently unmapping and uncommitting memory
-  // chunks.
-  class Unmapper {
-   public:
-    class UnmapFreeMemoryTask;
-
-    Unmapper(Heap* heap, MemoryAllocator* allocator)
-        : heap_(heap),
-          allocator_(allocator),
-          pending_unmapping_tasks_semaphore_(0),
-          pending_unmapping_tasks_(0),
-          active_unmapping_tasks_(0) {
-      chunks_[kRegular].reserve(kReservedQueueingSlots);
-      chunks_[kPooled].reserve(kReservedQueueingSlots);
-    }
-
-    void AddMemoryChunkSafe(MemoryChunk* chunk) {
-      if (!chunk->IsLargePage() && chunk->executable() != EXECUTABLE) {
-        AddMemoryChunkSafe<kRegular>(chunk);
-      } else {
-        AddMemoryChunkSafe<kNonRegular>(chunk);
-      }
-    }
-
-    MemoryChunk* TryGetPooledMemoryChunkSafe() {
-      // Procedure:
-      // (1) Try to get a chunk that was declared as pooled and already has
-      // been uncommitted.
-      // (2) Try to steal any memory chunk of kPageSize that would've been
-      // unmapped.
-      MemoryChunk* chunk = GetMemoryChunkSafe<kPooled>();
-      if (chunk == nullptr) {
-        chunk = GetMemoryChunkSafe<kRegular>();
-        if (chunk != nullptr) {
-          // For stolen chunks we need to manually free any allocated memory.
-          chunk->ReleaseAllAllocatedMemory();
-        }
-      }
-      return chunk;
-    }
-
-    V8_EXPORT_PRIVATE void FreeQueuedChunks();
-    void CancelAndWaitForPendingTasks();
-    void PrepareForGC();
-    V8_EXPORT_PRIVATE void EnsureUnmappingCompleted();
-    V8_EXPORT_PRIVATE void TearDown();
-    size_t NumberOfCommittedChunks();
-    V8_EXPORT_PRIVATE int NumberOfChunks();
-    size_t CommittedBufferedMemory();
-
-   private:
-    static const int kReservedQueueingSlots = 64;
-    static const int kMaxUnmapperTasks = 4;
-
-    enum ChunkQueueType {
-      kRegular,     // Pages of kPageSize that do not live in a CodeRange and
-                    // can thus be used for stealing.
-      kNonRegular,  // Large chunks and executable chunks.
-      kPooled,      // Pooled chunks, already uncommited and ready for reuse.
-      kNumberOfChunkQueues,
-    };
-
-    enum class FreeMode {
-      kUncommitPooled,
-      kReleasePooled,
-    };
-
-    template <ChunkQueueType type>
-    void AddMemoryChunkSafe(MemoryChunk* chunk) {
-      base::MutexGuard guard(&mutex_);
-      chunks_[type].push_back(chunk);
-    }
-
-    template <ChunkQueueType type>
-    MemoryChunk* GetMemoryChunkSafe() {
-      base::MutexGuard guard(&mutex_);
-      if (chunks_[type].empty()) return nullptr;
-      MemoryChunk* chunk = chunks_[type].back();
-      chunks_[type].pop_back();
-      return chunk;
-    }
-
-    bool MakeRoomForNewTasks();
-
-    template <FreeMode mode>
-    void PerformFreeMemoryOnQueuedChunks();
-
-    void PerformFreeMemoryOnQueuedNonRegularChunks();
-
-    Heap* const heap_;
-    MemoryAllocator* const allocator_;
-    base::Mutex mutex_;
-    std::vector<MemoryChunk*> chunks_[kNumberOfChunkQueues];
-    CancelableTaskManager::Id task_ids_[kMaxUnmapperTasks];
-    base::Semaphore pending_unmapping_tasks_semaphore_;
-    intptr_t pending_unmapping_tasks_;
-    std::atomic<intptr_t> active_unmapping_tasks_;
-
-    friend class MemoryAllocator;
-  };
-
-  enum AllocationMode {
-    kRegular,
-    kPooled,
-  };
-
-  enum FreeMode {
-    kFull,
-    kAlreadyPooled,
-    kPreFreeAndQueue,
-    kPooledAndQueue,
-  };
-
-  V8_EXPORT_PRIVATE static intptr_t GetCommitPageSize();
-
-  // Computes the memory area of discardable memory within a given memory area
-  // [addr, addr+size) and returns the result as base::AddressRegion. If the
-  // memory is not discardable base::AddressRegion is an empty region.
-  V8_EXPORT_PRIVATE static base::AddressRegion ComputeDiscardMemoryArea(
-      Address addr, size_t size);
-
-  V8_EXPORT_PRIVATE MemoryAllocator(Isolate* isolate, size_t max_capacity,
-                                    size_t code_range_size);
-
-  V8_EXPORT_PRIVATE void TearDown();
-
-  // Allocates a Page from the allocator. AllocationMode is used to indicate
-  // whether pooled allocation, which only works for MemoryChunk::kPageSize,
-  // should be tried first.
-  template <MemoryAllocator::AllocationMode alloc_mode = kRegular,
-            typename SpaceType>
-  EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
-  Page* AllocatePage(size_t size, SpaceType* owner, Executability executable);
-
-  LargePage* AllocateLargePage(size_t size, LargeObjectSpace* owner,
-                               Executability executable);
-
-  template <MemoryAllocator::FreeMode mode = kFull>
-  EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
-  void Free(MemoryChunk* chunk);
-
-  // Returns allocated spaces in bytes.
-  size_t Size() { return size_; }
-
-  // Returns allocated executable spaces in bytes.
-  size_t SizeExecutable() { return size_executable_; }
-
-  // Returns the maximum available bytes of heaps.
-  size_t Available() {
-    const size_t size = Size();
-    return capacity_ < size ? 0 : capacity_ - size;
-  }
-
-  // Returns an indication of whether a pointer is in a space that has
-  // been allocated by this MemoryAllocator.
-  V8_INLINE bool IsOutsideAllocatedSpace(Address address) {
-    return address < lowest_ever_allocated_ ||
-           address >= highest_ever_allocated_;
-  }
-
-  // Returns a MemoryChunk in which the memory region from commit_area_size to
-  // reserve_area_size of the chunk area is reserved but not committed, it
-  // could be committed later by calling MemoryChunk::CommitArea.
-  V8_EXPORT_PRIVATE MemoryChunk* AllocateChunk(size_t reserve_area_size,
-                                               size_t commit_area_size,
-                                               Executability executable,
-                                               Space* space);
-
-  Address AllocateAlignedMemory(size_t reserve_size, size_t commit_size,
-                                size_t alignment, Executability executable,
-                                void* hint, VirtualMemory* controller);
-
-  void FreeMemory(v8::PageAllocator* page_allocator, Address addr, size_t size);
-
-  // Partially release |bytes_to_free| bytes starting at |start_free|. Note that
-  // internally memory is freed from |start_free| to the end of the reservation.
-  // Additional memory beyond the page is not accounted though, so
-  // |bytes_to_free| is computed by the caller.
-  void PartialFreeMemory(MemoryChunk* chunk, Address start_free,
-                         size_t bytes_to_free, Address new_area_end);
-
-  // Checks if an allocated MemoryChunk was intended to be used for executable
-  // memory.
-  bool IsMemoryChunkExecutable(MemoryChunk* chunk) {
-    return executable_memory_.find(chunk) != executable_memory_.end();
-  }
-
-  // Commit memory region owned by given reservation object.  Returns true if
-  // it succeeded and false otherwise.
-  bool CommitMemory(VirtualMemory* reservation);
-
-  // Uncommit memory region owned by given reservation object. Returns true if
-  // it succeeded and false otherwise.
-  bool UncommitMemory(VirtualMemory* reservation);
-
-  // Zaps a contiguous block of memory [start..(start+size)[ with
-  // a given zap value.
-  void ZapBlock(Address start, size_t size, uintptr_t zap_value);
-
-  V8_WARN_UNUSED_RESULT bool CommitExecutableMemory(VirtualMemory* vm,
-                                                    Address start,
-                                                    size_t commit_size,
-                                                    size_t reserved_size);
-
-  // Page allocator instance for allocating non-executable pages.
-  // Guaranteed to be a valid pointer.
-  v8::PageAllocator* data_page_allocator() { return data_page_allocator_; }
-
-  // Page allocator instance for allocating executable pages.
-  // Guaranteed to be a valid pointer.
-  v8::PageAllocator* code_page_allocator() { return code_page_allocator_; }
-
-  // Returns page allocator suitable for allocating pages with requested
-  // executability.
-  v8::PageAllocator* page_allocator(Executability executable) {
-    return executable == EXECUTABLE ? code_page_allocator_
-                                    : data_page_allocator_;
-  }
-
-  // A region of memory that may contain executable code including reserved
-  // OS page with read-write access in the beginning.
-  const base::AddressRegion& code_range() const {
-    // |code_range_| >= |optional RW pages| + |code_page_allocator_instance_|
-    DCHECK_IMPLIES(!code_range_.is_empty(), code_page_allocator_instance_);
-    DCHECK_IMPLIES(!code_range_.is_empty(),
-                   code_range_.contains(code_page_allocator_instance_->begin(),
-                                        code_page_allocator_instance_->size()));
-    return code_range_;
-  }
-
-  Unmapper* unmapper() { return &unmapper_; }
-
-  // Performs all necessary bookkeeping to free the memory, but does not free
-  // it.
-  void UnregisterMemory(MemoryChunk* chunk);
-
- private:
-  void InitializeCodePageAllocator(v8::PageAllocator* page_allocator,
-                                   size_t requested);
-
-  // PreFreeMemory logically frees the object, i.e., it unregisters the memory,
-  // logs a delete event and adds the chunk to remembered unmapped pages.
-  void PreFreeMemory(MemoryChunk* chunk);
-
-  // PerformFreeMemory can be called concurrently when PreFree was executed
-  // before.
-  void PerformFreeMemory(MemoryChunk* chunk);
-
-  // See AllocatePage for public interface. Note that currently we only support
-  // pools for NOT_EXECUTABLE pages of size MemoryChunk::kPageSize.
-  template <typename SpaceType>
-  MemoryChunk* AllocatePagePooled(SpaceType* owner);
-
-  // Initializes pages in a chunk. Returns the first page address.
-  // This function and GetChunkId() are provided for the mark-compact
-  // collector to rebuild page headers in the from space, which is
-  // used as a marking stack and its page headers are destroyed.
-  Page* InitializePagesInChunk(int chunk_id, int pages_in_chunk,
-                               PagedSpace* owner);
-
-  void UpdateAllocatedSpaceLimits(Address low, Address high) {
-    // The use of atomic primitives does not guarantee correctness (wrt.
-    // desired semantics) by default. The loop here ensures that we update the
-    // values only if they did not change in between.
-    Address ptr = lowest_ever_allocated_.load(std::memory_order_relaxed);
-    while ((low < ptr) && !lowest_ever_allocated_.compare_exchange_weak(
-                              ptr, low, std::memory_order_acq_rel)) {
-    }
-    ptr = highest_ever_allocated_.load(std::memory_order_relaxed);
-    while ((high > ptr) && !highest_ever_allocated_.compare_exchange_weak(
-                               ptr, high, std::memory_order_acq_rel)) {
-    }
-  }
-
-  void RegisterExecutableMemoryChunk(MemoryChunk* chunk) {
-    DCHECK(chunk->IsFlagSet(MemoryChunk::IS_EXECUTABLE));
-    DCHECK_EQ(executable_memory_.find(chunk), executable_memory_.end());
-    executable_memory_.insert(chunk);
-  }
-
-  void UnregisterExecutableMemoryChunk(MemoryChunk* chunk) {
-    DCHECK_NE(executable_memory_.find(chunk), executable_memory_.end());
-    executable_memory_.erase(chunk);
-    chunk->heap()->UnregisterUnprotectedMemoryChunk(chunk);
-  }
-
-  Isolate* isolate_;
-
-  // This object controls virtual space reserved for code on the V8 heap. This
-  // is only valid for 64-bit architectures where kRequiresCodeRange.
-  VirtualMemory code_reservation_;
-
-  // Page allocator used for allocating data pages. Depending on the
-  // configuration it may be a page allocator instance provided by v8::Platform
-  // or a BoundedPageAllocator (when pointer compression is enabled).
-  v8::PageAllocator* data_page_allocator_;
-
-  // Page allocator used for allocating code pages. Depending on the
-  // configuration it may be a page allocator instance provided by v8::Platform
-  // or a BoundedPageAllocator (when pointer compression is enabled or
-  // on those 64-bit architectures where pc-relative 32-bit displacement
-  // can be used for call and jump instructions).
-  v8::PageAllocator* code_page_allocator_;
-
-  // A part of the |code_reservation_| that may contain executable code
-  // including reserved page with read-write access in the beginning.
-  // See details below.
-  base::AddressRegion code_range_;
-
-  // This unique pointer owns the instance of bounded code allocator
-  // that controls executable pages allocation. It does not control the
-  // optionally existing page in the beginning of the |code_range_|.
-  // So, summarizing all above, the following conditions hold:
-  // 1) |code_reservation_| >= |code_range_|
-  // 2) |code_range_| >= |optional RW pages| + |code_page_allocator_instance_|.
-  // 3) |code_reservation_| is AllocatePageSize()-aligned
-  // 4) |code_page_allocator_instance_| is MemoryChunk::kAlignment-aligned
-  // 5) |code_range_| is CommitPageSize()-aligned
-  std::unique_ptr<base::BoundedPageAllocator> code_page_allocator_instance_;
-
-  // Maximum space size in bytes.
-  size_t capacity_;
-
-  // Allocated space size in bytes.
-  std::atomic<size_t> size_;
-  // Allocated executable space size in bytes.
-  std::atomic<size_t> size_executable_;
-
-  // We keep the lowest and highest addresses allocated as a quick way
-  // of determining that pointers are outside the heap. The estimate is
-  // conservative, i.e. not all addresses in 'allocated' space are allocated
-  // to our heap. The range is [lowest, highest[, inclusive on the low end
-  // and exclusive on the high end.
-  std::atomic<Address> lowest_ever_allocated_;
-  std::atomic<Address> highest_ever_allocated_;
-
-  VirtualMemory last_chunk_;
-  Unmapper unmapper_;
-
-  // Data structure to remember allocated executable memory chunks.
-  std::unordered_set<MemoryChunk*> executable_memory_;
-
-  friend class heap::TestCodePageAllocatorScope;
-
-  DISALLOW_IMPLICIT_CONSTRUCTORS(MemoryAllocator);
-};
-
-extern template EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
-    Page* MemoryAllocator::AllocatePage<MemoryAllocator::kRegular, PagedSpace>(
-        size_t size, PagedSpace* owner, Executability executable);
-extern template EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
-    Page* MemoryAllocator::AllocatePage<MemoryAllocator::kRegular, SemiSpace>(
-        size_t size, SemiSpace* owner, Executability executable);
-extern template EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
-    Page* MemoryAllocator::AllocatePage<MemoryAllocator::kPooled, SemiSpace>(
-        size_t size, SemiSpace* owner, Executability executable);
-
-extern template EXPORT_TEMPLATE_DECLARE(
-    V8_EXPORT_PRIVATE) void MemoryAllocator::
-    Free<MemoryAllocator::kFull>(MemoryChunk* chunk);
-extern template EXPORT_TEMPLATE_DECLARE(
-    V8_EXPORT_PRIVATE) void MemoryAllocator::
-    Free<MemoryAllocator::kAlreadyPooled>(MemoryChunk* chunk);
-extern template EXPORT_TEMPLATE_DECLARE(
-    V8_EXPORT_PRIVATE) void MemoryAllocator::
-    Free<MemoryAllocator::kPreFreeAndQueue>(MemoryChunk* chunk);
-extern template EXPORT_TEMPLATE_DECLARE(
-    V8_EXPORT_PRIVATE) void MemoryAllocator::
-    Free<MemoryAllocator::kPooledAndQueue>(MemoryChunk* chunk);
-
 // -----------------------------------------------------------------------------
 // Interface for heap object iterator to be implemented by all object space
 // object iterators.
@@ -1590,6 +680,7 @@ class PageIteratorImpl
 };
 
 using PageIterator = PageIteratorImpl<Page>;
+using ConstPageIterator = PageIteratorImpl<const Page>;
 using LargePageIterator = PageIteratorImpl<LargePage>;
 
 class PageRange {
@@ -1607,44 +698,6 @@ class PageRange {
   Page* end_;
 };
 
-// -----------------------------------------------------------------------------
-// Heap object iterator in new/old/map spaces.
-//
-// A PagedSpaceObjectIterator iterates objects from the bottom of the given
-// space to its top or from the bottom of the given page to its top.
-//
-// If objects are allocated in the page during iteration the iterator may
-// or may not iterate over those objects.  The caller must create a new
-// iterator in order to be sure to visit these new objects.
-class V8_EXPORT_PRIVATE PagedSpaceObjectIterator : public ObjectIterator {
- public:
-  // Creates a new object iterator in a given space.
-  PagedSpaceObjectIterator(Heap* heap, PagedSpace* space);
-  PagedSpaceObjectIterator(Heap* heap, PagedSpace* space, Page* page);
-
-  // Creates a new object iterator in a given off-thread space.
-  explicit PagedSpaceObjectIterator(OffThreadSpace* space);
-
-  // Advance to the next object, skipping free spaces and other fillers and
-  // skipping the special garbage section of which there is one per space.
-  // Returns nullptr when the iteration has ended.
-  inline HeapObject Next() override;
-
- private:
-  // Fast (inlined) path of next().
-  inline HeapObject FromCurrentPage();
-
-  // Slow path of next(), goes into the next page.  Returns false if the
-  // iteration has ended.
-  bool AdvanceToNextPage();
-
-  Address cur_addr_;  // Current iteration point.
-  Address cur_end_;   // End iteration point.
-  PagedSpace* space_;
-  PageRange page_range_;
-  PageRange::iterator current_page_;
-};
-
 // -----------------------------------------------------------------------------
 // A space has a circular list of pages. The next page can be accessed via
 // Page::next_page() call.
@@ -1704,8 +757,18 @@ class AllocationStats {
  public:
   AllocationStats() { Clear(); }
 
-  // Zero out all the allocation statistics (i.e., no capacity).
-  void Clear() {
+  AllocationStats& operator=(const AllocationStats& stats) V8_NOEXCEPT {
+    capacity_ = stats.capacity_.load();
+    max_capacity_ = stats.max_capacity_;
+    size_.store(stats.size_);
+#ifdef DEBUG
+    allocated_on_page_ = stats.allocated_on_page_;
+#endif
+    return *this;
+  }
+
+  // Zero out all the allocation statistics (i.e., no capacity).
+  void Clear() {
     capacity_ = 0;
     max_capacity_ = 0;
     ClearSize();
@@ -1727,8 +790,11 @@ class AllocationStats {
 #endif
 
   void IncreaseAllocatedBytes(size_t bytes, Page* page) {
-    DCHECK_GE(size_ + bytes, size_);
-    size_ += bytes;
+#ifdef DEBUG
+    size_t size = size_;
+    DCHECK_GE(size + bytes, size);
+#endif
+    size_.fetch_add(bytes);
 #ifdef DEBUG
     allocated_on_page_[page] += bytes;
 #endif
@@ -1736,7 +802,7 @@ class AllocationStats {
 
   void DecreaseAllocatedBytes(size_t bytes, Page* page) {
     DCHECK_GE(size_, bytes);
-    size_ -= bytes;
+    size_.fetch_sub(bytes);
 #ifdef DEBUG
     DCHECK_GE(allocated_on_page_[page], bytes);
     allocated_on_page_[page] -= bytes;
@@ -1768,7 +834,7 @@ class AllocationStats {
   size_t max_capacity_;
 
   // |size_|: The number of allocated bytes.
-  size_t size_;
+  std::atomic<size_t> size_;
 
 #ifdef DEBUG
   std::unordered_map<Page*, size_t, Page::Hasher> allocated_on_page_;
@@ -1810,7 +876,7 @@ class V8_EXPORT_PRIVATE FreeListLegacy : public FreeList {
   inline Page* GetPageForSize(size_t size_in_bytes) override;
 
   FreeListLegacy();
-  ~FreeListLegacy();
+  ~FreeListLegacy() override;
 
   V8_WARN_UNUSED_RESULT FreeSpace Allocate(size_t size_in_bytes,
                                            size_t* node_size,
@@ -1894,7 +960,7 @@ class V8_EXPORT_PRIVATE FreeListFastAlloc : public FreeList {
   inline Page* GetPageForSize(size_t size_in_bytes) override;
 
   FreeListFastAlloc();
-  ~FreeListFastAlloc();
+  ~FreeListFastAlloc() override;
 
   V8_WARN_UNUSED_RESULT FreeSpace Allocate(size_t size_in_bytes,
                                            size_t* node_size,
@@ -1940,7 +1006,7 @@ class V8_EXPORT_PRIVATE FreeListMany : public FreeList {
   Page* GetPageForSize(size_t size_in_bytes) override;
 
   FreeListMany();
-  ~FreeListMany();
+  ~FreeListMany() override;
 
   V8_WARN_UNUSED_RESULT FreeSpace Allocate(size_t size_in_bytes,
                                            size_t* node_size,
@@ -2136,7 +1202,7 @@ class V8_EXPORT_PRIVATE FreeListMap : public FreeList {
   Page* GetPageForSize(size_t size_in_bytes) override;
 
   FreeListMap();
-  ~FreeListMap();
+  ~FreeListMap() override;
 
   V8_WARN_UNUSED_RESULT FreeSpace Allocate(size_t size_in_bytes,
                                            size_t* node_size,
@@ -2185,13 +1251,16 @@ class LocalAllocationBuffer {
                                                  AllocationResult result,
                                                  intptr_t size);
 
-  ~LocalAllocationBuffer() { Close(); }
+  ~LocalAllocationBuffer() { CloseAndMakeIterable(); }
 
-  // Convert to C++11 move-semantics once allowed by the style guide.
-  LocalAllocationBuffer(const LocalAllocationBuffer& other) V8_NOEXCEPT;
-  LocalAllocationBuffer& operator=(const LocalAllocationBuffer& other)
+  LocalAllocationBuffer(const LocalAllocationBuffer& other) = delete;
+  V8_EXPORT_PRIVATE LocalAllocationBuffer(LocalAllocationBuffer&& other)
       V8_NOEXCEPT;
 
+  LocalAllocationBuffer& operator=(const LocalAllocationBuffer& other) = delete;
+  V8_EXPORT_PRIVATE LocalAllocationBuffer& operator=(
+      LocalAllocationBuffer&& other) V8_NOEXCEPT;
+
   V8_WARN_UNUSED_RESULT inline AllocationResult AllocateRawAligned(
       int size_in_bytes, AllocationAlignment alignment);
 
@@ -2204,7 +1273,11 @@ class LocalAllocationBuffer {
   inline bool TryFreeLast(HeapObject object, int object_size);
 
   // Close a LAB, effectively invalidating it. Returns the unused area.
-  V8_EXPORT_PRIVATE LinearAllocationArea Close();
+  V8_EXPORT_PRIVATE LinearAllocationArea CloseAndMakeIterable();
+  void MakeIterable();
+
+  Address top() const { return allocation_info_.top(); }
+  Address limit() const { return allocation_info_.limit(); }
 
  private:
   V8_EXPORT_PRIVATE LocalAllocationBuffer(
@@ -2277,776 +1350,6 @@ class SpaceWithLinearArea : public Space {
       AllocationOrigin::kNumberOfAllocationOrigins)] = {0};
 };
 
-class V8_EXPORT_PRIVATE PagedSpace
-    : NON_EXPORTED_BASE(public SpaceWithLinearArea) {
- public:
-  using iterator = PageIterator;
-
-  static const size_t kCompactionMemoryWanted = 500 * KB;
-
-  // Creates a space with an id.
-  PagedSpace(Heap* heap, AllocationSpace id, Executability executable,
-             FreeList* free_list,
-             LocalSpaceKind local_space_kind = LocalSpaceKind::kNone);
-
-  ~PagedSpace() override { TearDown(); }
-
-  // Checks whether an object/address is in this space.
-  inline bool Contains(Address a);
-  inline bool Contains(Object o);
-  bool ContainsSlow(Address addr);
-
-  // Does the space need executable memory?
-  Executability executable() { return executable_; }
-
-  // Prepares for a mark-compact GC.
-  void PrepareForMarkCompact();
-
-  // Current capacity without growing (Size() + Available()).
-  size_t Capacity() { return accounting_stats_.Capacity(); }
-
-  // Approximate amount of physical memory committed for this space.
-  size_t CommittedPhysicalMemory() override;
-
-  // Sets the capacity, the available space and the wasted space to zero.
-  // The stats are rebuilt during sweeping by adding each page to the
-  // capacity and the size when it is encountered.  As free spaces are
-  // discovered during the sweeping they are subtracted from the size and added
-  // to the available and wasted totals. The free list is cleared as well.
-  void ClearAllocatorState() {
-    accounting_stats_.ClearSize();
-    free_list_->Reset();
-  }
-
-  // Available bytes without growing.  These are the bytes on the free list.
-  // The bytes in the linear allocation area are not included in this total
-  // because updating the stats would slow down allocation.  New pages are
-  // immediately added to the free list so they show up here.
-  size_t Available() override { return free_list_->Available(); }
-
-  // Allocated bytes in this space.  Garbage bytes that were not found due to
-  // concurrent sweeping are counted as being allocated!  The bytes in the
-  // current linear allocation area (between top and limit) are also counted
-  // here.
-  size_t Size() override { return accounting_stats_.Size(); }
-
-  // As size, but the bytes in lazily swept pages are estimated and the bytes
-  // in the current linear allocation area are not included.
-  size_t SizeOfObjects() override;
-
-  // Wasted bytes in this space.  These are just the bytes that were thrown away
-  // due to being too small to use for allocation.
-  virtual size_t Waste() { return free_list_->wasted_bytes(); }
-
-  // Allocate the requested number of bytes in the space if possible, return a
-  // failure object if not.
-  V8_WARN_UNUSED_RESULT inline AllocationResult AllocateRawUnaligned(
-      int size_in_bytes, AllocationOrigin origin = AllocationOrigin::kRuntime);
-
-  // Allocate the requested number of bytes in the space double aligned if
-  // possible, return a failure object if not.
-  V8_WARN_UNUSED_RESULT inline AllocationResult AllocateRawAligned(
-      int size_in_bytes, AllocationAlignment alignment,
-      AllocationOrigin origin = AllocationOrigin::kRuntime);
-
-  // Allocate the requested number of bytes in the space and consider allocation
-  // alignment if needed.
-  V8_WARN_UNUSED_RESULT inline AllocationResult AllocateRaw(
-      int size_in_bytes, AllocationAlignment alignment,
-      AllocationOrigin origin = AllocationOrigin::kRuntime);
-
-  size_t Free(Address start, size_t size_in_bytes, SpaceAccountingMode mode) {
-    if (size_in_bytes == 0) return 0;
-    heap()->CreateFillerObjectAt(start, static_cast<int>(size_in_bytes),
-                                 ClearRecordedSlots::kNo);
-    if (mode == SpaceAccountingMode::kSpaceAccounted) {
-      return AccountedFree(start, size_in_bytes);
-    } else {
-      return UnaccountedFree(start, size_in_bytes);
-    }
-  }
-
-  // Give a block of memory to the space's free list.  It might be added to
-  // the free list or accounted as waste.
-  // If add_to_freelist is false then just accounting stats are updated and
-  // no attempt to add area to free list is made.
-  size_t AccountedFree(Address start, size_t size_in_bytes) {
-    size_t wasted = free_list_->Free(start, size_in_bytes, kLinkCategory);
-    Page* page = Page::FromAddress(start);
-    accounting_stats_.DecreaseAllocatedBytes(size_in_bytes, page);
-    DCHECK_GE(size_in_bytes, wasted);
-    return size_in_bytes - wasted;
-  }
-
-  size_t UnaccountedFree(Address start, size_t size_in_bytes) {
-    size_t wasted = free_list_->Free(start, size_in_bytes, kDoNotLinkCategory);
-    DCHECK_GE(size_in_bytes, wasted);
-    return size_in_bytes - wasted;
-  }
-
-  inline bool TryFreeLast(HeapObject object, int object_size);
-
-  void ResetFreeList();
-
-  // Empty space linear allocation area, returning unused area to free list.
-  void FreeLinearAllocationArea();
-
-  void MarkLinearAllocationAreaBlack();
-  void UnmarkLinearAllocationArea();
-
-  void DecreaseAllocatedBytes(size_t bytes, Page* page) {
-    accounting_stats_.DecreaseAllocatedBytes(bytes, page);
-  }
-  void IncreaseAllocatedBytes(size_t bytes, Page* page) {
-    accounting_stats_.IncreaseAllocatedBytes(bytes, page);
-  }
-  void DecreaseCapacity(size_t bytes) {
-    accounting_stats_.DecreaseCapacity(bytes);
-  }
-  void IncreaseCapacity(size_t bytes) {
-    accounting_stats_.IncreaseCapacity(bytes);
-  }
-
-  void RefineAllocatedBytesAfterSweeping(Page* page);
-
-  Page* InitializePage(MemoryChunk* chunk);
-
-  void ReleasePage(Page* page);
-
-  // Adds the page to this space and returns the number of bytes added to the
-  // free list of the space.
-  size_t AddPage(Page* page);
-  void RemovePage(Page* page);
-  // Remove a page if it has at least |size_in_bytes| bytes available that can
-  // be used for allocation.
-  Page* RemovePageSafe(int size_in_bytes);
-
-  void SetReadable();
-  void SetReadAndExecutable();
-  void SetReadAndWritable();
-
-  void SetDefaultCodePermissions() {
-    if (FLAG_jitless) {
-      SetReadable();
-    } else {
-      SetReadAndExecutable();
-    }
-  }
-
-#ifdef VERIFY_HEAP
-  // Verify integrity of this space.
-  virtual void Verify(Isolate* isolate, ObjectVisitor* visitor);
-
-  void VerifyLiveBytes();
-
-  // Overridden by subclasses to verify space-specific object
-  // properties (e.g., only maps or free-list nodes are in map space).
-  virtual void VerifyObject(HeapObject obj) {}
-#endif
-
-#ifdef DEBUG
-  void VerifyCountersAfterSweeping(Heap* heap);
-  void VerifyCountersBeforeConcurrentSweeping();
-  // Print meta info and objects in this space.
-  void Print() override;
-
-  // Report code object related statistics
-  static void ReportCodeStatistics(Isolate* isolate);
-  static void ResetCodeStatistics(Isolate* isolate);
-#endif
-
-  bool CanExpand(size_t size);
-
-  // Returns the number of total pages in this space.
-  int CountTotalPages();
-
-  // Return size of allocatable area on a page in this space.
-  inline int AreaSize() { return static_cast<int>(area_size_); }
-
-  bool is_local_space() { return local_space_kind_ != LocalSpaceKind::kNone; }
-
-  bool is_off_thread_space() {
-    return local_space_kind_ == LocalSpaceKind::kOffThreadSpace;
-  }
-
-  bool is_compaction_space() {
-    return base::IsInRange(local_space_kind_,
-                           LocalSpaceKind::kFirstCompactionSpace,
-                           LocalSpaceKind::kLastCompactionSpace);
-  }
-
-  LocalSpaceKind local_space_kind() { return local_space_kind_; }
-
-  // Merges {other} into the current space. Note that this modifies {other},
-  // e.g., removes its bump pointer area and resets statistics.
-  void MergeLocalSpace(LocalSpace* other);
-
-  // Refills the free list from the corresponding free list filled by the
-  // sweeper.
-  virtual void RefillFreeList();
-
-  base::Mutex* mutex() { return &space_mutex_; }
-
-  inline void UnlinkFreeListCategories(Page* page);
-  inline size_t RelinkFreeListCategories(Page* page);
-
-  Page* first_page() { return reinterpret_cast<Page*>(Space::first_page()); }
-
-  iterator begin() { return iterator(first_page()); }
-  iterator end() { return iterator(nullptr); }
-
-  // Shrink immortal immovable pages of the space to be exactly the size needed
-  // using the high water mark.
-  void ShrinkImmortalImmovablePages();
-
-  size_t ShrinkPageToHighWaterMark(Page* page);
-
-  std::unique_ptr<ObjectIterator> GetObjectIterator(Heap* heap) override;
-
-  void SetLinearAllocationArea(Address top, Address limit);
-
- private:
-  // Set space linear allocation area.
-  void SetTopAndLimit(Address top, Address limit) {
-    DCHECK(top == limit ||
-           Page::FromAddress(top) == Page::FromAddress(limit - 1));
-    MemoryChunk::UpdateHighWaterMark(allocation_info_.top());
-    allocation_info_.Reset(top, limit);
-  }
-  void DecreaseLimit(Address new_limit);
-  void UpdateInlineAllocationLimit(size_t min_size) override;
-  bool SupportsInlineAllocation() override {
-    return identity() == OLD_SPACE && !is_local_space();
-  }
-
- protected:
-  // PagedSpaces that should be included in snapshots have different, i.e.,
-  // smaller, initial pages.
-  virtual bool snapshotable() { return true; }
-
-  bool HasPages() { return first_page() != nullptr; }
-
-  // Cleans up the space, frees all pages in this space except those belonging
-  // to the initial chunk, uncommits addresses in the initial chunk.
-  void TearDown();
-
-  // Expands the space by allocating a fixed number of pages. Returns false if
-  // it cannot allocate requested number of pages from OS, or if the hard heap
-  // size limit has been hit.
-  bool Expand();
-
-  // Sets up a linear allocation area that fits the given number of bytes.
-  // Returns false if there is not enough space and the caller has to retry
-  // after collecting garbage.
-  inline bool EnsureLinearAllocationArea(int size_in_bytes,
-                                         AllocationOrigin origin);
-  // Allocates an object from the linear allocation area. Assumes that the
-  // linear allocation area is large enought to fit the object.
-  inline HeapObject AllocateLinearly(int size_in_bytes);
-  // Tries to allocate an aligned object from the linear allocation area.
-  // Returns nullptr if the linear allocation area does not fit the object.
-  // Otherwise, returns the object pointer and writes the allocation size
-  // (object size + alignment filler size) to the size_in_bytes.
-  inline HeapObject TryAllocateLinearlyAligned(int* size_in_bytes,
-                                               AllocationAlignment alignment);
-
-  V8_WARN_UNUSED_RESULT bool RefillLinearAllocationAreaFromFreeList(
-      size_t size_in_bytes, AllocationOrigin origin);
-
-  // If sweeping is still in progress try to sweep unswept pages. If that is
-  // not successful, wait for the sweeper threads and retry free-list
-  // allocation. Returns false if there is not enough space and the caller
-  // has to retry after collecting garbage.
-  V8_WARN_UNUSED_RESULT bool EnsureSweptAndRetryAllocation(
-      int size_in_bytes, AllocationOrigin origin);
-
-  V8_WARN_UNUSED_RESULT bool SweepAndRetryAllocation(int required_freed_bytes,
-                                                     int max_pages,
-                                                     int size_in_bytes,
-                                                     AllocationOrigin origin);
-
-  // Slow path of AllocateRaw. This function is space-dependent. Returns false
-  // if there is not enough space and the caller has to retry after
-  // collecting garbage.
-  V8_WARN_UNUSED_RESULT virtual bool SlowRefillLinearAllocationArea(
-      int size_in_bytes, AllocationOrigin origin);
-
-  // Implementation of SlowAllocateRaw. Returns false if there is not enough
-  // space and the caller has to retry after collecting garbage.
-  V8_WARN_UNUSED_RESULT bool RawSlowRefillLinearAllocationArea(
-      int size_in_bytes, AllocationOrigin origin);
-
-  Executability executable_;
-
-  LocalSpaceKind local_space_kind_;
-
-  size_t area_size_;
-
-  // Accounting information for this space.
-  AllocationStats accounting_stats_;
-
-  // Mutex guarding any concurrent access to the space.
-  base::Mutex space_mutex_;
-
-  friend class IncrementalMarking;
-  friend class MarkCompactCollector;
-
-  // Used in cctest.
-  friend class heap::HeapTester;
-};
-
-enum SemiSpaceId { kFromSpace = 0, kToSpace = 1 };
-
-// -----------------------------------------------------------------------------
-// SemiSpace in young generation
-//
-// A SemiSpace is a contiguous chunk of memory holding page-like memory chunks.
-// The mark-compact collector  uses the memory of the first page in the from
-// space as a marking stack when tracing live objects.
-class SemiSpace : public Space {
- public:
-  using iterator = PageIterator;
-
-  static void Swap(SemiSpace* from, SemiSpace* to);
-
-  SemiSpace(Heap* heap, SemiSpaceId semispace)
-      : Space(heap, NEW_SPACE, new NoFreeList()),
-        current_capacity_(0),
-        maximum_capacity_(0),
-        minimum_capacity_(0),
-        age_mark_(kNullAddress),
-        committed_(false),
-        id_(semispace),
-        current_page_(nullptr),
-        pages_used_(0) {}
-
-  inline bool Contains(HeapObject o);
-  inline bool Contains(Object o);
-  inline bool ContainsSlow(Address a);
-
-  void SetUp(size_t initial_capacity, size_t maximum_capacity);
-  void TearDown();
-
-  bool Commit();
-  bool Uncommit();
-  bool is_committed() { return committed_; }
-
-  // Grow the semispace to the new capacity.  The new capacity requested must
-  // be larger than the current capacity and less than the maximum capacity.
-  bool GrowTo(size_t new_capacity);
-
-  // Shrinks the semispace to the new capacity.  The new capacity requested
-  // must be more than the amount of used memory in the semispace and less
-  // than the current capacity.
-  bool ShrinkTo(size_t new_capacity);
-
-  bool EnsureCurrentCapacity();
-
-  Address space_end() { return memory_chunk_list_.back()->area_end(); }
-
-  // Returns the start address of the first page of the space.
-  Address space_start() {
-    DCHECK_NE(memory_chunk_list_.front(), nullptr);
-    return memory_chunk_list_.front()->area_start();
-  }
-
-  Page* current_page() { return current_page_; }
-  int pages_used() { return pages_used_; }
-
-  // Returns the start address of the current page of the space.
-  Address page_low() { return current_page_->area_start(); }
-
-  // Returns one past the end address of the current page of the space.
-  Address page_high() { return current_page_->area_end(); }
-
-  bool AdvancePage() {
-    Page* next_page = current_page_->next_page();
-    // We cannot expand if we reached the maximum number of pages already. Note
-    // that we need to account for the next page already for this check as we
-    // could potentially fill the whole page after advancing.
-    const bool reached_max_pages = (pages_used_ + 1) == max_pages();
-    if (next_page == nullptr || reached_max_pages) {
-      return false;
-    }
-    current_page_ = next_page;
-    pages_used_++;
-    return true;
-  }
-
-  // Resets the space to using the first page.
-  void Reset();
-
-  void RemovePage(Page* page);
-  void PrependPage(Page* page);
-
-  Page* InitializePage(MemoryChunk* chunk);
-
-  // Age mark accessors.
-  Address age_mark() { return age_mark_; }
-  void set_age_mark(Address mark);
-
-  // Returns the current capacity of the semispace.
-  size_t current_capacity() { return current_capacity_; }
-
-  // Returns the maximum capacity of the semispace.
-  size_t maximum_capacity() { return maximum_capacity_; }
-
-  // Returns the initial capacity of the semispace.
-  size_t minimum_capacity() { return minimum_capacity_; }
-
-  SemiSpaceId id() { return id_; }
-
-  // Approximate amount of physical memory committed for this space.
-  size_t CommittedPhysicalMemory() override;
-
-  // If we don't have these here then SemiSpace will be abstract.  However
-  // they should never be called:
-
-  size_t Size() override { UNREACHABLE(); }
-
-  size_t SizeOfObjects() override { return Size(); }
-
-  size_t Available() override { UNREACHABLE(); }
-
-  Page* first_page() { return reinterpret_cast<Page*>(Space::first_page()); }
-  Page* last_page() { return reinterpret_cast<Page*>(Space::last_page()); }
-
-  iterator begin() { return iterator(first_page()); }
-  iterator end() { return iterator(nullptr); }
-
-  std::unique_ptr<ObjectIterator> GetObjectIterator(Heap* heap) override;
-
-#ifdef DEBUG
-  V8_EXPORT_PRIVATE void Print() override;
-  // Validate a range of of addresses in a SemiSpace.
-  // The "from" address must be on a page prior to the "to" address,
-  // in the linked page order, or it must be earlier on the same page.
-  static void AssertValidRange(Address from, Address to);
-#else
-  // Do nothing.
-  inline static void AssertValidRange(Address from, Address to) {}
-#endif
-
-#ifdef VERIFY_HEAP
-  virtual void Verify();
-#endif
-
- private:
-  void RewindPages(int num_pages);
-
-  inline int max_pages() {
-    return static_cast<int>(current_capacity_ / Page::kPageSize);
-  }
-
-  // Copies the flags into the masked positions on all pages in the space.
-  void FixPagesFlags(intptr_t flags, intptr_t flag_mask);
-
-  // The currently committed space capacity.
-  size_t current_capacity_;
-
-  // The maximum capacity that can be used by this space. A space cannot grow
-  // beyond that size.
-  size_t maximum_capacity_;
-
-  // The minimum capacity for the space. A space cannot shrink below this size.
-  size_t minimum_capacity_;
-
-  // Used to govern object promotion during mark-compact collection.
-  Address age_mark_;
-
-  bool committed_;
-  SemiSpaceId id_;
-
-  Page* current_page_;
-
-  int pages_used_;
-
-  friend class NewSpace;
-  friend class SemiSpaceObjectIterator;
-};
-
-// A SemiSpaceObjectIterator is an ObjectIterator that iterates over the active
-// semispace of the heap's new space.  It iterates over the objects in the
-// semispace from a given start address (defaulting to the bottom of the
-// semispace) to the top of the semispace.  New objects allocated after the
-// iterator is created are not iterated.
-class SemiSpaceObjectIterator : public ObjectIterator {
- public:
-  // Create an iterator over the allocated objects in the given to-space.
-  explicit SemiSpaceObjectIterator(NewSpace* space);
-
-  inline HeapObject Next() override;
-
- private:
-  void Initialize(Address start, Address end);
-
-  // The current iteration point.
-  Address current_;
-  // The end of iteration.
-  Address limit_;
-};
-
-// -----------------------------------------------------------------------------
-// The young generation space.
-//
-// The new space consists of a contiguous pair of semispaces.  It simply
-// forwards most functions to the appropriate semispace.
-
-class V8_EXPORT_PRIVATE NewSpace
-    : NON_EXPORTED_BASE(public SpaceWithLinearArea) {
- public:
-  using iterator = PageIterator;
-
-  NewSpace(Heap* heap, v8::PageAllocator* page_allocator,
-           size_t initial_semispace_capacity, size_t max_semispace_capacity);
-
-  ~NewSpace() override { TearDown(); }
-
-  inline bool ContainsSlow(Address a);
-  inline bool Contains(Object o);
-  inline bool Contains(HeapObject o);
-
-  // Tears down the space.  Heap memory was not allocated by the space, so it
-  // is not deallocated here.
-  void TearDown();
-
-  // Flip the pair of spaces.
-  void Flip();
-
-  // Grow the capacity of the semispaces.  Assumes that they are not at
-  // their maximum capacity.
-  void Grow();
-
-  // Shrink the capacity of the semispaces.
-  void Shrink();
-
-  // Return the allocated bytes in the active semispace.
-  size_t Size() final {
-    DCHECK_GE(top(), to_space_.page_low());
-    return to_space_.pages_used() *
-               MemoryChunkLayout::AllocatableMemoryInDataPage() +
-           static_cast<size_t>(top() - to_space_.page_low());
-  }
-
-  size_t SizeOfObjects() final { return Size(); }
-
-  // Return the allocatable capacity of a semispace.
-  size_t Capacity() {
-    SLOW_DCHECK(to_space_.current_capacity() == from_space_.current_capacity());
-    return (to_space_.current_capacity() / Page::kPageSize) *
-           MemoryChunkLayout::AllocatableMemoryInDataPage();
-  }
-
-  // Return the current size of a semispace, allocatable and non-allocatable
-  // memory.
-  size_t TotalCapacity() {
-    DCHECK(to_space_.current_capacity() == from_space_.current_capacity());
-    return to_space_.current_capacity();
-  }
-
-  // Committed memory for NewSpace is the committed memory of both semi-spaces
-  // combined.
-  size_t CommittedMemory() final {
-    return from_space_.CommittedMemory() + to_space_.CommittedMemory();
-  }
-
-  size_t MaximumCommittedMemory() final {
-    return from_space_.MaximumCommittedMemory() +
-           to_space_.MaximumCommittedMemory();
-  }
-
-  // Approximate amount of physical memory committed for this space.
-  size_t CommittedPhysicalMemory() final;
-
-  // Return the available bytes without growing.
-  size_t Available() final {
-    DCHECK_GE(Capacity(), Size());
-    return Capacity() - Size();
-  }
-
-  size_t ExternalBackingStoreBytes(ExternalBackingStoreType type) const final {
-    if (V8_ARRAY_BUFFER_EXTENSION_BOOL &&
-        type == ExternalBackingStoreType::kArrayBuffer)
-      return heap()->YoungArrayBufferBytes();
-    DCHECK_EQ(0, from_space_.ExternalBackingStoreBytes(type));
-    return to_space_.ExternalBackingStoreBytes(type);
-  }
-
-  size_t ExternalBackingStoreBytes() {
-    size_t result = 0;
-    for (int i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
-      result +=
-          ExternalBackingStoreBytes(static_cast<ExternalBackingStoreType>(i));
-    }
-    return result;
-  }
-
-  size_t AllocatedSinceLastGC() {
-    const Address age_mark = to_space_.age_mark();
-    DCHECK_NE(age_mark, kNullAddress);
-    DCHECK_NE(top(), kNullAddress);
-    Page* const age_mark_page = Page::FromAllocationAreaAddress(age_mark);
-    Page* const last_page = Page::FromAllocationAreaAddress(top());
-    Page* current_page = age_mark_page;
-    size_t allocated = 0;
-    if (current_page != last_page) {
-      DCHECK_EQ(current_page, age_mark_page);
-      DCHECK_GE(age_mark_page->area_end(), age_mark);
-      allocated += age_mark_page->area_end() - age_mark;
-      current_page = current_page->next_page();
-    } else {
-      DCHECK_GE(top(), age_mark);
-      return top() - age_mark;
-    }
-    while (current_page != last_page) {
-      DCHECK_NE(current_page, age_mark_page);
-      allocated += MemoryChunkLayout::AllocatableMemoryInDataPage();
-      current_page = current_page->next_page();
-    }
-    DCHECK_GE(top(), current_page->area_start());
-    allocated += top() - current_page->area_start();
-    DCHECK_LE(allocated, Size());
-    return allocated;
-  }
-
-  void MovePageFromSpaceToSpace(Page* page) {
-    DCHECK(page->IsFromPage());
-    from_space_.RemovePage(page);
-    to_space_.PrependPage(page);
-  }
-
-  bool Rebalance();
-
-  // Return the maximum capacity of a semispace.
-  size_t MaximumCapacity() {
-    DCHECK(to_space_.maximum_capacity() == from_space_.maximum_capacity());
-    return to_space_.maximum_capacity();
-  }
-
-  bool IsAtMaximumCapacity() { return TotalCapacity() == MaximumCapacity(); }
-
-  // Returns the initial capacity of a semispace.
-  size_t InitialTotalCapacity() {
-    DCHECK(to_space_.minimum_capacity() == from_space_.minimum_capacity());
-    return to_space_.minimum_capacity();
-  }
-
-  void ResetOriginalTop() {
-    DCHECK_GE(top(), original_top_);
-    DCHECK_LE(top(), original_limit_);
-    original_top_.store(top(), std::memory_order_release);
-  }
-
-  Address original_top_acquire() {
-    return original_top_.load(std::memory_order_acquire);
-  }
-  Address original_limit_relaxed() {
-    return original_limit_.load(std::memory_order_relaxed);
-  }
-
-  // Return the address of the first allocatable address in the active
-  // semispace. This may be the address where the first object resides.
-  Address first_allocatable_address() { return to_space_.space_start(); }
-
-  // Get the age mark of the inactive semispace.
-  Address age_mark() { return from_space_.age_mark(); }
-  // Set the age mark in the active semispace.
-  void set_age_mark(Address mark) { to_space_.set_age_mark(mark); }
-
-  V8_WARN_UNUSED_RESULT V8_INLINE AllocationResult
-  AllocateRawAligned(int size_in_bytes, AllocationAlignment alignment,
-                     AllocationOrigin origin = AllocationOrigin::kRuntime);
-
-  V8_WARN_UNUSED_RESULT V8_INLINE AllocationResult AllocateRawUnaligned(
-      int size_in_bytes, AllocationOrigin origin = AllocationOrigin::kRuntime);
-
-  V8_WARN_UNUSED_RESULT V8_INLINE AllocationResult
-  AllocateRaw(int size_in_bytes, AllocationAlignment alignment,
-              AllocationOrigin origin = AllocationOrigin::kRuntime);
-
-  V8_WARN_UNUSED_RESULT inline AllocationResult AllocateRawSynchronized(
-      int size_in_bytes, AllocationAlignment alignment,
-      AllocationOrigin origin = AllocationOrigin::kRuntime);
-
-  // Reset the allocation pointer to the beginning of the active semispace.
-  void ResetLinearAllocationArea();
-
-  // When inline allocation stepping is active, either because of incremental
-  // marking, idle scavenge, or allocation statistics gathering, we 'interrupt'
-  // inline allocation every once in a while. This is done by setting
-  // allocation_info_.limit to be lower than the actual limit and and increasing
-  // it in steps to guarantee that the observers are notified periodically.
-  void UpdateInlineAllocationLimit(size_t size_in_bytes) override;
-
-  inline bool ToSpaceContainsSlow(Address a);
-  inline bool ToSpaceContains(Object o);
-  inline bool FromSpaceContains(Object o);
-
-  // Try to switch the active semispace to a new, empty, page.
-  // Returns false if this isn't possible or reasonable (i.e., there
-  // are no pages, or the current page is already empty), or true
-  // if successful.
-  bool AddFreshPage();
-  bool AddFreshPageSynchronized();
-
-#ifdef VERIFY_HEAP
-  // Verify the active semispace.
-  virtual void Verify(Isolate* isolate);
-#endif
-
-#ifdef DEBUG
-  // Print the active semispace.
-  void Print() override { to_space_.Print(); }
-#endif
-
-  // Return whether the operation succeeded.
-  bool CommitFromSpaceIfNeeded() {
-    if (from_space_.is_committed()) return true;
-    return from_space_.Commit();
-  }
-
-  bool UncommitFromSpace() {
-    if (!from_space_.is_committed()) return true;
-    return from_space_.Uncommit();
-  }
-
-  bool IsFromSpaceCommitted() { return from_space_.is_committed(); }
-
-  SemiSpace* active_space() { return &to_space_; }
-
-  Page* first_page() { return to_space_.first_page(); }
-  Page* last_page() { return to_space_.last_page(); }
-
-  iterator begin() { return to_space_.begin(); }
-  iterator end() { return to_space_.end(); }
-
-  std::unique_ptr<ObjectIterator> GetObjectIterator(Heap* heap) override;
-
-  SemiSpace& from_space() { return from_space_; }
-  SemiSpace& to_space() { return to_space_; }
-
- private:
-  // Update linear allocation area to match the current to-space page.
-  void UpdateLinearAllocationArea();
-
-  base::Mutex mutex_;
-
-  // The top and the limit at the time of setting the linear allocation area.
-  // These values can be accessed by background tasks.
-  std::atomic<Address> original_top_;
-  std::atomic<Address> original_limit_;
-
-  // The semispaces.
-  SemiSpace to_space_;
-  SemiSpace from_space_;
-  VirtualMemory reservation_;
-
-  bool EnsureAllocation(int size_in_bytes, AllocationAlignment alignment);
-  bool SupportsInlineAllocation() override { return true; }
-
-  friend class SemiSpaceObjectIterator;
-};
-
 class V8_EXPORT_PRIVATE PauseAllocationObserversScope {
  public:
   explicit PauseAllocationObserversScope(Heap* heap);
@@ -3057,402 +1360,6 @@ class V8_EXPORT_PRIVATE PauseAllocationObserversScope {
   DISALLOW_COPY_AND_ASSIGN(PauseAllocationObserversScope);
 };
 
-// -----------------------------------------------------------------------------
-// Base class for compaction space and off-thread space.
-
-class V8_EXPORT_PRIVATE LocalSpace : public PagedSpace {
- public:
-  LocalSpace(Heap* heap, AllocationSpace id, Executability executable,
-             LocalSpaceKind local_space_kind)
-      : PagedSpace(heap, id, executable, FreeList::CreateFreeList(),
-                   local_space_kind) {
-    DCHECK_NE(local_space_kind, LocalSpaceKind::kNone);
-  }
-
- protected:
-  // The space is temporary and not included in any snapshots.
-  bool snapshotable() override { return false; }
-};
-
-// -----------------------------------------------------------------------------
-// Compaction space that is used temporarily during compaction.
-
-class V8_EXPORT_PRIVATE CompactionSpace : public LocalSpace {
- public:
-  CompactionSpace(Heap* heap, AllocationSpace id, Executability executable,
-                  LocalSpaceKind local_space_kind)
-      : LocalSpace(heap, id, executable, local_space_kind) {
-    DCHECK(is_compaction_space());
-  }
-
- protected:
-  V8_WARN_UNUSED_RESULT bool SlowRefillLinearAllocationArea(
-      int size_in_bytes, AllocationOrigin origin) override;
-};
-
-// A collection of |CompactionSpace|s used by a single compaction task.
-class CompactionSpaceCollection : public Malloced {
- public:
-  explicit CompactionSpaceCollection(Heap* heap,
-                                     LocalSpaceKind local_space_kind)
-      : old_space_(heap, OLD_SPACE, Executability::NOT_EXECUTABLE,
-                   local_space_kind),
-        code_space_(heap, CODE_SPACE, Executability::EXECUTABLE,
-                    local_space_kind) {}
-
-  CompactionSpace* Get(AllocationSpace space) {
-    switch (space) {
-      case OLD_SPACE:
-        return &old_space_;
-      case CODE_SPACE:
-        return &code_space_;
-      default:
-        UNREACHABLE();
-    }
-    UNREACHABLE();
-  }
-
- private:
-  CompactionSpace old_space_;
-  CompactionSpace code_space_;
-};
-
-// -----------------------------------------------------------------------------
-// Old generation regular object space.
-
-class OldSpace : public PagedSpace {
- public:
-  // Creates an old space object. The constructor does not allocate pages
-  // from OS.
-  explicit OldSpace(Heap* heap)
-      : PagedSpace(heap, OLD_SPACE, NOT_EXECUTABLE,
-                   FreeList::CreateFreeList()) {}
-
-  static bool IsAtPageStart(Address addr) {
-    return static_cast<intptr_t>(addr & kPageAlignmentMask) ==
-           MemoryChunkLayout::ObjectStartOffsetInDataPage();
-  }
-
-  size_t ExternalBackingStoreBytes(ExternalBackingStoreType type) const final {
-    if (V8_ARRAY_BUFFER_EXTENSION_BOOL &&
-        type == ExternalBackingStoreType::kArrayBuffer)
-      return heap()->OldArrayBufferBytes();
-    return external_backing_store_bytes_[type];
-  }
-};
-
-// -----------------------------------------------------------------------------
-// Old generation code object space.
-
-class CodeSpace : public PagedSpace {
- public:
-  // Creates an old space object. The constructor does not allocate pages
-  // from OS.
-  explicit CodeSpace(Heap* heap)
-      : PagedSpace(heap, CODE_SPACE, EXECUTABLE, FreeList::CreateFreeList()) {}
-};
-
-// For contiguous spaces, top should be in the space (or at the end) and limit
-// should be the end of the space.
-#define DCHECK_SEMISPACE_ALLOCATION_INFO(info, space) \
-  SLOW_DCHECK((space).page_low() <= (info).top() &&   \
-              (info).top() <= (space).page_high() &&  \
-              (info).limit() <= (space).page_high())
-
-// -----------------------------------------------------------------------------
-// Old space for all map objects
-
-class MapSpace : public PagedSpace {
- public:
-  // Creates a map space object.
-  explicit MapSpace(Heap* heap)
-      : PagedSpace(heap, MAP_SPACE, NOT_EXECUTABLE, new FreeListMap()) {}
-
-  int RoundSizeDownToObjectAlignment(int size) override {
-    if (base::bits::IsPowerOfTwo(Map::kSize)) {
-      return RoundDown(size, Map::kSize);
-    } else {
-      return (size / Map::kSize) * Map::kSize;
-    }
-  }
-
-  void SortFreeList();
-
-#ifdef VERIFY_HEAP
-  void VerifyObject(HeapObject obj) override;
-#endif
-};
-
-// -----------------------------------------------------------------------------
-// Off-thread space that is used for folded allocation on a different thread.
-
-class V8_EXPORT_PRIVATE OffThreadSpace : public LocalSpace {
- public:
-  explicit OffThreadSpace(Heap* heap)
-      : LocalSpace(heap, OLD_SPACE, NOT_EXECUTABLE,
-                   LocalSpaceKind::kOffThreadSpace) {
-#ifdef V8_ENABLE_THIRD_PARTY_HEAP
-    // OffThreadSpace doesn't work with third-party heap.
-    UNREACHABLE();
-#endif
-  }
-
- protected:
-  V8_WARN_UNUSED_RESULT bool SlowRefillLinearAllocationArea(
-      int size_in_bytes, AllocationOrigin origin) override;
-
-  void RefillFreeList() override;
-};
-
-// -----------------------------------------------------------------------------
-// Read Only space for all Immortal Immovable and Immutable objects
-
-class ReadOnlySpace : public PagedSpace {
- public:
-  explicit ReadOnlySpace(Heap* heap);
-
-  // TODO(v8:7464): Remove this once PagedSpace::Unseal no longer writes to
-  // memory_chunk_list_.
-  ~ReadOnlySpace() override { Unseal(); }
-
-  bool writable() const { return !is_marked_read_only_; }
-
-  bool Contains(Address a) = delete;
-  bool Contains(Object o) = delete;
-
-  V8_EXPORT_PRIVATE void ClearStringPaddingIfNeeded();
-
-  enum class SealMode { kDetachFromHeapAndForget, kDoNotDetachFromHeap };
-
-  // Seal the space by marking it read-only, optionally detaching it
-  // from the heap and forgetting it for memory bookkeeping purposes (e.g.
-  // prevent space's memory from registering as leaked).
-  void Seal(SealMode ro_mode);
-
-  // During boot the free_space_map is created, and afterwards we may need
-  // to write it into the free list nodes that were already created.
-  void RepairFreeListsAfterDeserialization();
-
-  size_t Available() override { return 0; }
-
- private:
-  // Unseal the space after is has been sealed, by making it writable.
-  // TODO(v8:7464): Only possible if the space hasn't been detached.
-  void Unseal();
-  void SetPermissionsForPages(MemoryAllocator* memory_allocator,
-                              PageAllocator::Permission access);
-
-  bool is_marked_read_only_ = false;
-
-  //
-  // String padding must be cleared just before serialization and therefore the
-  // string padding in the space will already have been cleared if the space was
-  // deserialized.
-  bool is_string_padding_cleared_;
-};
-
-// -----------------------------------------------------------------------------
-// Large objects ( > kMaxRegularHeapObjectSize ) are allocated and
-// managed by the large object space.
-// Large objects do not move during garbage collections.
-
-class V8_EXPORT_PRIVATE LargeObjectSpace : public Space {
- public:
-  using iterator = LargePageIterator;
-
-  ~LargeObjectSpace() override { TearDown(); }
-
-  // Releases internal resources, frees objects in this space.
-  void TearDown();
-
-  // Available bytes for objects in this space.
-  size_t Available() override;
-
-  size_t Size() override { return size_; }
-  size_t SizeOfObjects() override { return objects_size_; }
-
-  // Approximate amount of physical memory committed for this space.
-  size_t CommittedPhysicalMemory() override;
-
-  int PageCount() { return page_count_; }
-
-  // Frees unmarked objects.
-  virtual void FreeUnmarkedObjects();
-
-  // Checks whether a heap object is in this space; O(1).
-  bool Contains(HeapObject obj);
-  // Checks whether an address is in the object area in this space. Iterates
-  // all objects in the space. May be slow.
-  bool ContainsSlow(Address addr);
-
-  // Checks whether the space is empty.
-  bool IsEmpty() { return first_page() == nullptr; }
-
-  virtual void AddPage(LargePage* page, size_t object_size);
-  virtual void RemovePage(LargePage* page, size_t object_size);
-
-  LargePage* first_page() {
-    return reinterpret_cast<LargePage*>(Space::first_page());
-  }
-
-  iterator begin() { return iterator(first_page()); }
-  iterator end() { return iterator(nullptr); }
-
-  std::unique_ptr<ObjectIterator> GetObjectIterator(Heap* heap) override;
-
-  virtual bool is_off_thread() const { return false; }
-
-#ifdef VERIFY_HEAP
-  virtual void Verify(Isolate* isolate);
-#endif
-
-#ifdef DEBUG
-  void Print() override;
-#endif
-
- protected:
-  LargeObjectSpace(Heap* heap, AllocationSpace id);
-
-  LargePage* AllocateLargePage(int object_size, Executability executable);
-
-  size_t size_;          // allocated bytes
-  int page_count_;       // number of chunks
-  size_t objects_size_;  // size of objects
-
- private:
-  friend class LargeObjectSpaceObjectIterator;
-};
-
-class OffThreadLargeObjectSpace;
-
-class OldLargeObjectSpace : public LargeObjectSpace {
- public:
-  explicit OldLargeObjectSpace(Heap* heap);
-
-  V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT AllocationResult
-  AllocateRaw(int object_size);
-
-  // Clears the marking state of live objects.
-  void ClearMarkingStateOfLiveObjects();
-
-  void PromoteNewLargeObject(LargePage* page);
-
-  V8_EXPORT_PRIVATE void MergeOffThreadSpace(OffThreadLargeObjectSpace* other);
-
- protected:
-  explicit OldLargeObjectSpace(Heap* heap, AllocationSpace id);
-  V8_WARN_UNUSED_RESULT AllocationResult AllocateRaw(int object_size,
-                                                     Executability executable);
-};
-
-class NewLargeObjectSpace : public LargeObjectSpace {
- public:
-  NewLargeObjectSpace(Heap* heap, size_t capacity);
-
-  V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT AllocationResult
-  AllocateRaw(int object_size);
-
-  // Available bytes for objects in this space.
-  size_t Available() override;
-
-  void Flip();
-
-  void FreeDeadObjects(const std::function<bool(HeapObject)>& is_dead);
-
-  void SetCapacity(size_t capacity);
-
-  // The last allocated object that is not guaranteed to be initialized when
-  // the concurrent marker visits it.
-  Address pending_object() {
-    return pending_object_.load(std::memory_order_relaxed);
-  }
-
-  void ResetPendingObject() { pending_object_.store(0); }
-
- private:
-  std::atomic<Address> pending_object_;
-  size_t capacity_;
-};
-
-class CodeLargeObjectSpace : public OldLargeObjectSpace {
- public:
-  explicit CodeLargeObjectSpace(Heap* heap);
-
-  V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT AllocationResult
-  AllocateRaw(int object_size);
-
-  // Finds a large object page containing the given address, returns nullptr
-  // if such a page doesn't exist.
-  LargePage* FindPage(Address a);
-
- protected:
-  void AddPage(LargePage* page, size_t object_size) override;
-  void RemovePage(LargePage* page, size_t object_size) override;
-
- private:
-  static const size_t kInitialChunkMapCapacity = 1024;
-  void InsertChunkMapEntries(LargePage* page);
-  void RemoveChunkMapEntries(LargePage* page);
-
-  // Page-aligned addresses to their corresponding LargePage.
-  std::unordered_map<Address, LargePage*> chunk_map_;
-};
-
-class V8_EXPORT_PRIVATE OffThreadLargeObjectSpace : public LargeObjectSpace {
- public:
-  explicit OffThreadLargeObjectSpace(Heap* heap);
-
-  V8_WARN_UNUSED_RESULT AllocationResult AllocateRaw(int object_size);
-
-  void FreeUnmarkedObjects() override;
-
-  bool is_off_thread() const override { return true; }
-
- protected:
-  // OldLargeObjectSpace can mess with OffThreadLargeObjectSpace during merging.
-  friend class OldLargeObjectSpace;
-
-  V8_WARN_UNUSED_RESULT AllocationResult AllocateRaw(int object_size,
-                                                     Executability executable);
-};
-
-class LargeObjectSpaceObjectIterator : public ObjectIterator {
- public:
-  explicit LargeObjectSpaceObjectIterator(LargeObjectSpace* space);
-
-  HeapObject Next() override;
-
- private:
-  LargePage* current_;
-};
-
-// Iterates over the chunks (pages and large object pages) that can contain
-// pointers to new space or to evacuation candidates.
-class OldGenerationMemoryChunkIterator {
- public:
-  inline explicit OldGenerationMemoryChunkIterator(Heap* heap);
-
-  // Return nullptr when the iterator is done.
-  inline MemoryChunk* next();
-
- private:
-  enum State {
-    kOldSpaceState,
-    kMapState,
-    kCodeState,
-    kLargeObjectState,
-    kCodeLargeObjectState,
-    kFinishedState
-  };
-  Heap* heap_;
-  State state_;
-  PageIterator old_iterator_;
-  PageIterator code_iterator_;
-  PageIterator map_iterator_;
-  LargePageIterator lo_iterator_;
-  LargePageIterator code_lo_iterator_;
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/heap/sweeper.cc b/deps/v8/src/heap/sweeper.cc
index 67062503d3e..db5e347b0fc 100644
--- a/deps/v8/src/heap/sweeper.cc
+++ b/deps/v8/src/heap/sweeper.cc
@@ -6,10 +6,11 @@
 
 #include "src/execution/vm-state-inl.h"
 #include "src/heap/array-buffer-tracker-inl.h"
+#include "src/heap/code-object-registry.h"
 #include "src/heap/gc-tracer.h"
 #include "src/heap/invalidated-slots-inl.h"
 #include "src/heap/mark-compact-inl.h"
-#include "src/heap/remembered-set.h"
+#include "src/heap/remembered-set-inl.h"
 #include "src/objects/objects-inl.h"
 
 namespace v8 {
@@ -245,8 +246,87 @@ void Sweeper::EnsureCompleted() {
   sweeping_in_progress_ = false;
 }
 
+void Sweeper::SupportConcurrentSweeping() {
+  ForAllSweepingSpaces([this](AllocationSpace space) {
+    const int kMaxPagesToSweepPerSpace = 1;
+    ParallelSweepSpace(space, 0, kMaxPagesToSweepPerSpace);
+  });
+}
+
 bool Sweeper::AreSweeperTasksRunning() { return num_sweeping_tasks_ != 0; }
 
+V8_INLINE size_t Sweeper::FreeAndProcessFreedMemory(
+    Address free_start, Address free_end, Page* page, Space* space,
+    bool non_empty_typed_slots, FreeListRebuildingMode free_list_mode,
+    FreeSpaceTreatmentMode free_space_mode) {
+  CHECK_GT(free_end, free_start);
+  size_t freed_bytes = 0;
+  size_t size = static_cast<size_t>(free_end - free_start);
+  if (free_space_mode == ZAP_FREE_SPACE) {
+    ZapCode(free_start, size);
+  }
+  if (free_list_mode == REBUILD_FREE_LIST) {
+    freed_bytes = reinterpret_cast<PagedSpace*>(space)->Free(
+        free_start, size, SpaceAccountingMode::kSpaceUnaccounted);
+
+  } else {
+    Heap::CreateFillerObjectAt(ReadOnlyRoots(page->heap()), free_start,
+                               static_cast<int>(size),
+                               ClearFreedMemoryMode::kClearFreedMemory);
+  }
+  if (should_reduce_memory_) page->DiscardUnusedMemory(free_start, size);
+
+  return freed_bytes;
+}
+
+V8_INLINE void Sweeper::CleanupRememberedSetEntriesForFreedMemory(
+    Address free_start, Address free_end, Page* page,
+    bool non_empty_typed_slots, FreeRangesMap* free_ranges_map,
+    InvalidatedSlotsCleanup* old_to_new_cleanup) {
+  DCHECK_LE(free_start, free_end);
+  RememberedSetSweeping::RemoveRange(page, free_start, free_end,
+                                     SlotSet::KEEP_EMPTY_BUCKETS);
+  RememberedSet<OLD_TO_OLD>::RemoveRange(page, free_start, free_end,
+                                         SlotSet::KEEP_EMPTY_BUCKETS);
+  if (non_empty_typed_slots) {
+    free_ranges_map->insert(std::pair<uint32_t, uint32_t>(
+        static_cast<uint32_t>(free_start - page->address()),
+        static_cast<uint32_t>(free_end - page->address())));
+  }
+
+  old_to_new_cleanup->Free(free_start, free_end);
+}
+
+void Sweeper::CleanupInvalidTypedSlotsOfFreeRanges(
+    Page* page, const FreeRangesMap& free_ranges_map) {
+  if (!free_ranges_map.empty()) {
+    TypedSlotSet* old_to_new = page->typed_slot_set<OLD_TO_NEW>();
+    if (old_to_new != nullptr) {
+      old_to_new->ClearInvalidSlots(free_ranges_map);
+    }
+    TypedSlotSet* old_to_old = page->typed_slot_set<OLD_TO_OLD>();
+    if (old_to_old != nullptr) {
+      old_to_old->ClearInvalidSlots(free_ranges_map);
+    }
+  }
+}
+
+void Sweeper::ClearMarkBitsAndHandleLivenessStatistics(
+    Page* page, size_t live_bytes, FreeListRebuildingMode free_list_mode) {
+  marking_state_->bitmap(page)->Clear();
+  if (free_list_mode == IGNORE_FREE_LIST) {
+    marking_state_->SetLiveBytes(page, 0);
+    // We did not free memory, so have to adjust allocated bytes here.
+    intptr_t freed_bytes = page->area_size() - live_bytes;
+    page->DecreaseAllocatedBytes(freed_bytes);
+  } else {
+    // Keep the old live bytes counter of the page until RefillFreeList, where
+    // the space size is refined.
+    // The allocated_bytes() counter is precisely the total size of objects.
+    DCHECK_EQ(live_bytes, page->allocated_bytes());
+  }
+}
+
 int Sweeper::RawSweep(
     Page* p, FreeListRebuildingMode free_list_mode,
     FreeSpaceTreatmentMode free_space_mode,
@@ -258,7 +338,26 @@ int Sweeper::RawSweep(
          space->identity() == CODE_SPACE || space->identity() == MAP_SPACE);
   DCHECK(!p->IsEvacuationCandidate() && !p->SweepingDone());
 
+  // Phase 1: Prepare the page for sweeping.
+
+  // Before we sweep objects on the page, we free dead array buffers which
+  // requires valid mark bits.
+  ArrayBufferTracker::FreeDead(p, marking_state_);
+
+  // Set the allocated_bytes_ counter to area_size and clear the wasted_memory_
+  // counter. The free operations below will decrease allocated_bytes_ to actual
+  // live bytes and keep track of wasted_memory_.
+  p->ResetAllocationStatistics();
+
   CodeObjectRegistry* code_object_registry = p->GetCodeObjectRegistry();
+  if (code_object_registry) code_object_registry->Clear();
+
+  // Phase 2: Free the non-live memory and clean-up the regular remembered set
+  // entires.
+
+  // Liveness and freeing statistics.
+  size_t live_bytes = 0;
+  size_t max_freed_bytes = 0;
 
   // TODO(ulan): we don't have to clear type old-to-old slots in code space
   // because the concurrent marker doesn't mark code objects. This requires
@@ -266,35 +365,21 @@ int Sweeper::RawSweep(
   bool non_empty_typed_slots = p->typed_slot_set<OLD_TO_NEW>() != nullptr ||
                                p->typed_slot_set<OLD_TO_OLD>() != nullptr;
 
-  // The free ranges map is used for filtering typed slots.
-  std::map<uint32_t, uint32_t> free_ranges;
-
-  // Before we sweep objects on the page, we free dead array buffers which
-  // requires valid mark bits.
-  ArrayBufferTracker::FreeDead(p, marking_state_);
-
-  Address free_start = p->area_start();
-  InvalidatedSlotsCleanup old_to_new_cleanup =
-      InvalidatedSlotsCleanup::NoCleanup(p);
-
   // Clean invalidated slots during the final atomic pause. After resuming
   // execution this isn't necessary, invalid old-to-new refs were already
   // removed by mark compact's update pointers phase.
+  InvalidatedSlotsCleanup old_to_new_cleanup =
+      InvalidatedSlotsCleanup::NoCleanup(p);
   if (invalidated_slots_in_free_space ==
       FreeSpaceMayContainInvalidatedSlots::kYes)
     old_to_new_cleanup = InvalidatedSlotsCleanup::OldToNew(p);
 
-  intptr_t live_bytes = 0;
-  intptr_t freed_bytes = 0;
-  intptr_t max_freed_bytes = 0;
-
-  // Set the allocated_bytes_ counter to area_size and clear the wasted_memory_
-  // counter. The free operations below will decrease allocated_bytes_ to actual
-  // live bytes and keep track of wasted_memory_.
-  p->ResetAllocationStatistics();
-
-  if (code_object_registry) code_object_registry->Clear();
+  // The free ranges map is used for filtering typed slots.
+  FreeRangesMap free_ranges_map;
 
+  // Iterate over the page using the live objects and free the memory before
+  // the given live object.
+  Address free_start = p->area_start();
   for (auto object_and_size :
        LiveObjectRange<kBlackObjects>(p, marking_state_->bitmap(p))) {
     HeapObject const object = object_and_size.first;
@@ -303,32 +388,14 @@ int Sweeper::RawSweep(
     DCHECK(marking_state_->IsBlack(object));
     Address free_end = object.address();
     if (free_end != free_start) {
-      CHECK_GT(free_end, free_start);
-      size_t size = static_cast<size_t>(free_end - free_start);
-      if (free_space_mode == ZAP_FREE_SPACE) {
-        ZapCode(free_start, size);
-      }
-      if (free_list_mode == REBUILD_FREE_LIST) {
-        freed_bytes = reinterpret_cast<PagedSpace*>(space)->Free(
-            free_start, size, SpaceAccountingMode::kSpaceUnaccounted);
-        max_freed_bytes = Max(freed_bytes, max_freed_bytes);
-      } else {
-        p->heap()->CreateFillerObjectAt(
-            free_start, static_cast<int>(size), ClearRecordedSlots::kNo,
-            ClearFreedMemoryMode::kClearFreedMemory);
-      }
-      if (should_reduce_memory_) p->DiscardUnusedMemory(free_start, size);
-      RememberedSetSweeping::RemoveRange(p, free_start, free_end,
-                                         SlotSet::KEEP_EMPTY_BUCKETS);
-      RememberedSet<OLD_TO_OLD>::RemoveRange(p, free_start, free_end,
-                                             SlotSet::KEEP_EMPTY_BUCKETS);
-      if (non_empty_typed_slots) {
-        free_ranges.insert(std::pair<uint32_t, uint32_t>(
-            static_cast<uint32_t>(free_start - p->address()),
-            static_cast<uint32_t>(free_end - p->address())));
-      }
-
-      old_to_new_cleanup.Free(free_start, free_end);
+      max_freed_bytes =
+          Max(max_freed_bytes,
+              FreeAndProcessFreedMemory(free_start, free_end, p, space,
+                                        non_empty_typed_slots, free_list_mode,
+                                        free_space_mode));
+      CleanupRememberedSetEntriesForFreedMemory(
+          free_start, free_end, p, non_empty_typed_slots, &free_ranges_map,
+          &old_to_new_cleanup);
     }
     Map map = object.synchronized_map();
     int size = object.SizeFromMap(map);
@@ -336,65 +403,29 @@ int Sweeper::RawSweep(
     free_start = free_end + size;
   }
 
-  if (free_start != p->area_end()) {
-    CHECK_GT(p->area_end(), free_start);
-    size_t size = static_cast<size_t>(p->area_end() - free_start);
-    if (free_space_mode == ZAP_FREE_SPACE) {
-      ZapCode(free_start, size);
-    }
-    if (free_list_mode == REBUILD_FREE_LIST) {
-      freed_bytes = reinterpret_cast<PagedSpace*>(space)->Free(
-          free_start, size, SpaceAccountingMode::kSpaceUnaccounted);
-      max_freed_bytes = Max(freed_bytes, max_freed_bytes);
-    } else {
-      p->heap()->CreateFillerObjectAt(free_start, static_cast<int>(size),
-                                      ClearRecordedSlots::kNo,
-                                      ClearFreedMemoryMode::kClearFreedMemory);
-    }
-    if (should_reduce_memory_) p->DiscardUnusedMemory(free_start, size);
-    RememberedSetSweeping::RemoveRange(p, free_start, p->area_end(),
-                                       SlotSet::KEEP_EMPTY_BUCKETS);
-    RememberedSet<OLD_TO_OLD>::RemoveRange(p, free_start, p->area_end(),
-                                           SlotSet::KEEP_EMPTY_BUCKETS);
-    if (non_empty_typed_slots) {
-      free_ranges.insert(std::pair<uint32_t, uint32_t>(
-          static_cast<uint32_t>(free_start - p->address()),
-          static_cast<uint32_t>(p->area_end() - p->address())));
-    }
-
-    old_to_new_cleanup.Free(free_start, p->area_end());
+  // If there is free memory after the last live object also free that.
+  Address free_end = p->area_end();
+  if (free_end != free_start) {
+    max_freed_bytes =
+        Max(max_freed_bytes,
+            FreeAndProcessFreedMemory(free_start, free_end, p, space,
+                                      non_empty_typed_slots, free_list_mode,
+                                      free_space_mode));
+    CleanupRememberedSetEntriesForFreedMemory(
+        free_start, free_end, p, non_empty_typed_slots, &free_ranges_map,
+        &old_to_new_cleanup);
   }
 
-  // Clear invalid typed slots after collection all free ranges.
-  if (!free_ranges.empty()) {
-    TypedSlotSet* old_to_new = p->typed_slot_set<OLD_TO_NEW>();
-    if (old_to_new != nullptr) {
-      old_to_new->ClearInvalidSlots(free_ranges);
-    }
-    TypedSlotSet* old_to_old = p->typed_slot_set<OLD_TO_OLD>();
-    if (old_to_old != nullptr) {
-      old_to_old->ClearInvalidSlots(free_ranges);
-    }
-  }
+  // Phase 3: Post process the page.
+  CleanupInvalidTypedSlotsOfFreeRanges(p, free_ranges_map);
+  ClearMarkBitsAndHandleLivenessStatistics(p, live_bytes, free_list_mode);
 
-  marking_state_->bitmap(p)->Clear();
-  if (free_list_mode == IGNORE_FREE_LIST) {
-    marking_state_->SetLiveBytes(p, 0);
-    // We did not free memory, so have to adjust allocated bytes here.
-    intptr_t freed_bytes = p->area_size() - live_bytes;
-    p->DecreaseAllocatedBytes(freed_bytes);
-  } else {
-    // Keep the old live bytes counter of the page until RefillFreeList, where
-    // the space size is refined.
-    // The allocated_bytes() counter is precisely the total size of objects.
-    DCHECK_EQ(live_bytes, p->allocated_bytes());
-  }
   p->set_concurrent_sweeping_state(Page::ConcurrentSweepingState::kDone);
   if (code_object_registry) code_object_registry->Finalize();
   if (free_list_mode == IGNORE_FREE_LIST) return 0;
 
   return static_cast<int>(
-      p->free_list()->GuaranteedAllocatable(max_freed_bytes));
+      p->owner()->free_list()->GuaranteedAllocatable(max_freed_bytes));
 }
 
 void Sweeper::SweepSpaceFromTask(AllocationSpace identity) {
diff --git a/deps/v8/src/heap/sweeper.h b/deps/v8/src/heap/sweeper.h
index 7e6757351f5..7cd1bafd4fb 100644
--- a/deps/v8/src/heap/sweeper.h
+++ b/deps/v8/src/heap/sweeper.h
@@ -6,6 +6,7 @@
 #define V8_HEAP_SWEEPER_H_
 
 #include <deque>
+#include <map>
 #include <vector>
 
 #include "src/base/platform/semaphore.h"
@@ -15,9 +16,11 @@
 namespace v8 {
 namespace internal {
 
+class InvalidatedSlotsCleanup;
 class MajorNonAtomicMarkingState;
 class Page;
 class PagedSpace;
+class Space;
 
 enum FreeSpaceTreatmentMode { IGNORE_FREE_SPACE, ZAP_FREE_SPACE };
 
@@ -26,6 +29,7 @@ class Sweeper {
   using IterabilityList = std::vector<Page*>;
   using SweepingList = std::vector<Page*>;
   using SweptList = std::vector<Page*>;
+  using FreeRangesMap = std::map<uint32_t, uint32_t>;
 
   // Pauses the sweeper tasks or completes sweeping.
   class PauseOrCompleteScope final {
@@ -43,7 +47,7 @@ class Sweeper {
   // after exiting this scope.
   class FilterSweepingPagesScope final {
    public:
-    explicit FilterSweepingPagesScope(
+    FilterSweepingPagesScope(
         Sweeper* sweeper, const PauseOrCompleteScope& pause_or_complete_scope);
     ~FilterSweepingPagesScope();
 
@@ -104,6 +108,9 @@ class Sweeper {
   void EnsureCompleted();
   bool AreSweeperTasksRunning();
 
+  // Support concurrent sweepers from main thread
+  void SupportConcurrentSweeping();
+
   Page* GetSweptPageSafe(PagedSpace* space);
 
   void AddPageForIterability(Page* page);
@@ -127,6 +134,33 @@ class Sweeper {
     callback(MAP_SPACE);
   }
 
+  // Helper function for RawSweep. Depending on the FreeListRebuildingMode and
+  // FreeSpaceTreatmentMode this function may add the free memory to a free
+  // list, make the memory iterable, clear it, and return the free memory to
+  // the operating system.
+  size_t FreeAndProcessFreedMemory(Address free_start, Address free_end,
+                                   Page* page, Space* space,
+                                   bool non_empty_typed_slots,
+                                   FreeListRebuildingMode free_list_mode,
+                                   FreeSpaceTreatmentMode free_space_mode);
+
+  // Helper function for RawSweep. Handle remembered set entries in the freed
+  // memory which require clearing.
+  void CleanupRememberedSetEntriesForFreedMemory(
+      Address free_start, Address free_end, Page* page,
+      bool non_empty_typed_slots, FreeRangesMap* free_ranges_map,
+      InvalidatedSlotsCleanup* old_to_new_cleanup);
+
+  // Helper function for RawSweep. Clears invalid typed slots in the given free
+  // ranges.
+  void CleanupInvalidTypedSlotsOfFreeRanges(
+      Page* page, const FreeRangesMap& free_ranges_map);
+
+  // Helper function for RawSweep. Clears the mark bits and ensures consistency
+  // of live bytes.
+  void ClearMarkBitsAndHandleLivenessStatistics(
+      Page* page, size_t live_bytes, FreeListRebuildingMode free_list_mode);
+
   // Can only be called on the main thread when no tasks are running.
   bool IsDoneSweeping() const {
     bool is_done = true;
@@ -173,7 +207,9 @@ class Sweeper {
   SweptList swept_list_[kNumberOfSweepingSpaces];
   SweepingList sweeping_list_[kNumberOfSweepingSpaces];
   bool incremental_sweeper_pending_;
-  bool sweeping_in_progress_;
+  // Main thread can finalize sweeping, while background threads allocation slow
+  // path checks this flag to see whether it could support concurrent sweeping.
+  std::atomic<bool> sweeping_in_progress_;
   // Counter is actively maintained by the concurrent tasks to avoid querying
   // the semaphore for maintaining a task counter on the main thread.
   std::atomic<intptr_t> num_sweeping_tasks_;
diff --git a/deps/v8/src/heap/third-party/heap-api-stub.cc b/deps/v8/src/heap/third-party/heap-api-stub.cc
new file mode 100644
index 00000000000..6d31479bec6
--- /dev/null
+++ b/deps/v8/src/heap/third-party/heap-api-stub.cc
@@ -0,0 +1,53 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/execution/isolate-utils-inl.h"
+#include "src/heap/heap-inl.h"
+#include "src/heap/third-party/heap-api.h"
+
+namespace v8 {
+namespace internal {
+
+Isolate* Heap::GetIsolateFromWritableObject(HeapObject object) {
+  return GetHeapFromWritableObject(object)->isolate();
+}
+
+}  // namespace internal
+}  // namespace v8
+
+namespace v8 {
+namespace internal {
+namespace third_party_heap {
+
+// static
+std::unique_ptr<Heap> Heap::New(v8::internal::Isolate*) { return nullptr; }
+
+// static
+v8::internal::Isolate* Heap::GetIsolate(Address) { return nullptr; }
+
+AllocationResult Heap::Allocate(size_t, AllocationType, AllocationAlignment) {
+  return AllocationResult();
+}
+
+Address Heap::GetObjectFromInnerPointer(Address) { return 0; }
+
+const base::AddressRegion& Heap::GetCodeRange() {
+  static const base::AddressRegion no_region(0, 0);
+  return no_region;
+}
+
+// static
+bool Heap::InCodeSpace(Address) { return false; }
+
+// static
+bool Heap::InReadOnlySpace(Address) { return false; }
+
+// static
+bool Heap::IsValidHeapObject(HeapObject) { return false; }
+
+bool Heap::CollectGarbage() { return false; }
+
+}  // namespace third_party_heap
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/ic/accessor-assembler.cc b/deps/v8/src/ic/accessor-assembler.cc
index d3731a74651..88207c2564a 100644
--- a/deps/v8/src/ic/accessor-assembler.cc
+++ b/deps/v8/src/ic/accessor-assembler.cc
@@ -208,7 +208,7 @@ void AccessorAssembler::HandleLoadAccessor(
   TNode<Foreign> foreign = LoadObjectField<Foreign>(
       call_handler_info, CallHandlerInfo::kJsCallbackOffset);
   TNode<RawPtrT> callback =
-      LoadObjectField<RawPtrT>(foreign, Foreign::kForeignAddressOffset);
+      DecodeExternalPointer(LoadForeignForeignAddress(foreign));
   TNode<Object> data =
       LoadObjectField(call_handler_info, CallHandlerInfo::kDataOffset);
 
@@ -1655,7 +1655,7 @@ void AccessorAssembler::HandleStoreICProtoHandler(
       TNode<Foreign> foreign = LoadObjectField<Foreign>(
           call_handler_info, CallHandlerInfo::kJsCallbackOffset);
       TNode<RawPtrT> callback =
-          LoadObjectField<RawPtrT>(foreign, Foreign::kForeignAddressOffset);
+          DecodeExternalPointer(LoadForeignForeignAddress(foreign));
       TNode<Object> data =
           LoadObjectField(call_handler_info, CallHandlerInfo::kDataOffset);
 
@@ -1968,23 +1968,21 @@ TNode<PropertyArray> AccessorAssembler::ExtendPropertiesBackingStore(
     // Previous property deletion could have left behind unused backing store
     // capacity even for a map that think it doesn't have any unused fields.
     // Perform a bounds check to see if we actually have to grow the array.
-    GotoIf(UintPtrLessThan(index, ParameterToIntPtr(var_length.value(), mode)),
+    GotoIf(UintPtrLessThan(index, ParameterToIntPtr(var_length.value())),
            &done);
 
     TNode<BInt> delta = BIntConstant(JSObject::kFieldsAdded);
-    Node* new_capacity = IntPtrOrSmiAdd(var_length.value(), delta, mode);
+    TNode<BInt> new_capacity = IntPtrOrSmiAdd(var_length.value(), delta);
 
     // Grow properties array.
     DCHECK(kMaxNumberOfDescriptors + JSObject::kFieldsAdded <
            FixedArrayBase::GetMaxLengthForNewSpaceAllocation(PACKED_ELEMENTS));
     // The size of a new properties backing store is guaranteed to be small
     // enough that the new backing store will be allocated in new space.
-    CSA_ASSERT(this,
-               UintPtrOrSmiLessThan(
-                   new_capacity,
-                   IntPtrOrSmiConstant(
-                       kMaxNumberOfDescriptors + JSObject::kFieldsAdded, mode),
-                   mode));
+    CSA_ASSERT(this, UintPtrOrSmiLessThan(
+                         new_capacity,
+                         IntPtrOrSmiConstant<BInt>(kMaxNumberOfDescriptors +
+                                                   JSObject::kFieldsAdded)));
 
     TNode<PropertyArray> new_properties =
         AllocatePropertyArray(new_capacity, mode);
@@ -2002,7 +2000,7 @@ TNode<PropertyArray> AccessorAssembler::ExtendPropertiesBackingStore(
     // TODO(gsathya): Clean up the type conversions by creating smarter
     // helpers that do the correct op based on the mode.
     TNode<Int32T> new_capacity_int32 =
-        TruncateIntPtrToInt32(ParameterToIntPtr(new_capacity, mode));
+        TruncateIntPtrToInt32(ParameterToIntPtr(new_capacity));
     TNode<Int32T> new_length_and_hash_int32 =
         Word32Or(var_encoded_hash.value(), new_capacity_int32);
     StoreObjectField(new_properties, PropertyArray::kLengthAndHashOffset,
@@ -3654,6 +3652,9 @@ void AccessorAssembler::GenerateLoadIC_Megamorphic() {
   TVARIABLE(MaybeObject, var_handler);
   Label if_handler(this, &var_handler), miss(this, Label::kDeferred);
 
+  CSA_ASSERT(this, TaggedEqual(LoadFeedbackVectorSlot(CAST(vector), slot),
+                               MegamorphicSymbolConstant()));
+
   TryProbeStubCache(isolate()->load_stub_cache(), receiver, CAST(name),
                     &if_handler, &var_handler, &miss);
 
diff --git a/deps/v8/src/ic/binary-op-assembler.cc b/deps/v8/src/ic/binary-op-assembler.cc
index 25c2181ab2d..4937938df71 100644
--- a/deps/v8/src/ic/binary-op-assembler.cc
+++ b/deps/v8/src/ic/binary-op-assembler.cc
@@ -279,6 +279,7 @@ TNode<Object> BinaryOpAssembler::Generate_BinaryOperationWithFeedback(
     {
       Comment("perform smi operation");
       var_result = smiOperation(lhs_smi, CAST(rhs), &var_type_feedback);
+      UpdateFeedback(var_type_feedback.value(), maybe_feedback_vector, slot_id);
       Goto(&end);
     }
   }
@@ -321,6 +322,7 @@ TNode<Object> BinaryOpAssembler::Generate_BinaryOperationWithFeedback(
   BIND(&do_float_operation);
   {
     var_type_feedback = SmiConstant(BinaryOperationFeedback::kNumber);
+    UpdateFeedback(var_type_feedback.value(), maybe_feedback_vector, slot_id);
     TNode<Float64T> lhs_value = var_float_lhs.value();
     TNode<Float64T> rhs_value = var_float_rhs.value();
     TNode<Float64T> value = floatOperation(lhs_value, rhs_value);
@@ -384,6 +386,7 @@ TNode<Object> BinaryOpAssembler::Generate_BinaryOperationWithFeedback(
   BIND(&if_both_bigint);
   {
     var_type_feedback = SmiConstant(BinaryOperationFeedback::kBigInt);
+    UpdateFeedback(var_type_feedback.value(), maybe_feedback_vector, slot_id);
     if (op == Operation::kSubtract) {
       Label bigint_too_big(this);
       var_result =
@@ -415,6 +418,7 @@ TNode<Object> BinaryOpAssembler::Generate_BinaryOperationWithFeedback(
 
   BIND(&call_stub);
   {
+    UpdateFeedback(var_type_feedback.value(), maybe_feedback_vector, slot_id);
     TNode<Object> result;
     switch (op) {
       case Operation::kSubtract:
@@ -437,7 +441,6 @@ TNode<Object> BinaryOpAssembler::Generate_BinaryOperationWithFeedback(
   }
 
   BIND(&end);
-  UpdateFeedback(var_type_feedback.value(), maybe_feedback_vector, slot_id);
   return var_result.value();
 }
 
diff --git a/deps/v8/src/ic/binary-op-assembler.h b/deps/v8/src/ic/binary-op-assembler.h
index 79b8cd221b9..4bd0d516089 100644
--- a/deps/v8/src/ic/binary-op-assembler.h
+++ b/deps/v8/src/ic/binary-op-assembler.h
@@ -50,6 +50,72 @@ class BinaryOpAssembler : public CodeStubAssembler {
       TNode<UintPtrT> slot, TNode<HeapObject> maybe_feedback_vector,
       bool rhs_known_smi);
 
+  TNode<Object> Generate_BitwiseOrWithFeedback(
+      TNode<Context> context, TNode<Object> left, TNode<Object> right,
+      TNode<UintPtrT> slot, TNode<HeapObject> maybe_feedback_vector,
+      bool /* unused */) {
+    TVARIABLE(Smi, feedback);
+    TNode<Object> result = Generate_BitwiseBinaryOpWithFeedback(
+        Operation::kBitwiseOr, left, right, context, &feedback);
+    UpdateFeedback(feedback.value(), maybe_feedback_vector, slot);
+    return result;
+  }
+
+  TNode<Object> Generate_BitwiseXorWithFeedback(
+      TNode<Context> context, TNode<Object> left, TNode<Object> right,
+      TNode<UintPtrT> slot, TNode<HeapObject> maybe_feedback_vector,
+      bool /* unused */) {
+    TVARIABLE(Smi, feedback);
+    TNode<Object> result = Generate_BitwiseBinaryOpWithFeedback(
+        Operation::kBitwiseXor, left, right, context, &feedback);
+    UpdateFeedback(feedback.value(), maybe_feedback_vector, slot);
+    return result;
+  }
+
+  TNode<Object> Generate_BitwiseAndWithFeedback(
+      TNode<Context> context, TNode<Object> left, TNode<Object> right,
+      TNode<UintPtrT> slot, TNode<HeapObject> maybe_feedback_vector,
+      bool /* unused */) {
+    TVARIABLE(Smi, feedback);
+    TNode<Object> result = Generate_BitwiseBinaryOpWithFeedback(
+        Operation::kBitwiseAnd, left, right, context, &feedback);
+    UpdateFeedback(feedback.value(), maybe_feedback_vector, slot);
+    return result;
+  }
+
+  TNode<Object> Generate_ShiftLeftWithFeedback(
+      TNode<Context> context, TNode<Object> left, TNode<Object> right,
+      TNode<UintPtrT> slot, TNode<HeapObject> maybe_feedback_vector,
+      bool /* unused */) {
+    TVARIABLE(Smi, feedback);
+    TNode<Object> result = Generate_BitwiseBinaryOpWithFeedback(
+        Operation::kShiftLeft, left, right, context, &feedback);
+    UpdateFeedback(feedback.value(), maybe_feedback_vector, slot);
+    return result;
+  }
+
+  TNode<Object> Generate_ShiftRightWithFeedback(
+      TNode<Context> context, TNode<Object> left, TNode<Object> right,
+      TNode<UintPtrT> slot, TNode<HeapObject> maybe_feedback_vector,
+      bool /* unused */) {
+    TVARIABLE(Smi, feedback);
+    TNode<Object> result = Generate_BitwiseBinaryOpWithFeedback(
+        Operation::kShiftRight, left, right, context, &feedback);
+    UpdateFeedback(feedback.value(), maybe_feedback_vector, slot);
+    return result;
+  }
+
+  TNode<Object> Generate_ShiftRightLogicalWithFeedback(
+      TNode<Context> context, TNode<Object> left, TNode<Object> right,
+      TNode<UintPtrT> slot, TNode<HeapObject> maybe_feedback_vector,
+      bool /* unused */) {
+    TVARIABLE(Smi, feedback);
+    TNode<Object> result = Generate_BitwiseBinaryOpWithFeedback(
+        Operation::kShiftRightLogical, left, right, context, &feedback);
+    UpdateFeedback(feedback.value(), maybe_feedback_vector, slot);
+    return result;
+  }
+
   TNode<Object> Generate_BitwiseBinaryOpWithFeedback(Operation bitwise_op,
                                                      TNode<Object> left,
                                                      TNode<Object> right,
diff --git a/deps/v8/src/ic/ic.cc b/deps/v8/src/ic/ic.cc
index b508a20f805..1ec38c372d2 100644
--- a/deps/v8/src/ic/ic.cc
+++ b/deps/v8/src/ic/ic.cc
@@ -4,11 +4,11 @@
 
 #include "src/ic/ic.h"
 
-#include "include/v8config.h"
 #include "src/api/api-arguments-inl.h"
 #include "src/api/api.h"
 #include "src/ast/ast.h"
 #include "src/base/bits.h"
+#include "src/base/logging.h"
 #include "src/builtins/accessors.h"
 #include "src/codegen/code-factory.h"
 #include "src/execution/arguments-inl.h"
@@ -695,10 +695,6 @@ void IC::SetCache(Handle<Name> name, const MaybeObjectHandle& handler) {
   }
 }
 
-#if defined(__clang__) && defined(V8_OS_WIN)
-// Force function alignment to work around CPU bug: https://crbug.com/968683
-__attribute__((__aligned__(32)))
-#endif
 void LoadIC::UpdateCaches(LookupIterator* lookup) {
   Handle<Object> code;
   if (lookup->state() == LookupIterator::ACCESS_CHECK) {
@@ -1428,6 +1424,28 @@ bool StoreIC::LookupForWrite(LookupIterator* it, Handle<Object> value,
     }
   }
 
+  // If we are in StoreGlobal then check if we should throw on non-existent
+  // properties.
+  if (IsStoreGlobalIC() &&
+      (GetShouldThrow(it->isolate(), Nothing<ShouldThrow>()) ==
+       ShouldThrow::kThrowOnError)) {
+    // ICs typically does the store in two steps: prepare receiver for the
+    // transition followed by the actual store. For global objects we create a
+    // property cell when preparing for transition and install this cell in the
+    // handler. In strict mode, we throw and never initialize this property
+    // cell. The IC handler assumes that the property cell it is holding is for
+    // a property that is existing. This case violates this assumption. If we
+    // happen to invalidate this property cell later, it leads to incorrect
+    // behaviour. For now just use a slow stub and don't install the property
+    // cell for these cases. Hopefully these cases are not frequent enough to
+    // impact performance.
+    //
+    // TODO(mythria): If we find this to be happening often, we could install a
+    // new kind of handler for non-existent properties. These handlers can then
+    // miss to runtime if the value is not hole (i.e. cell got invalidated) and
+    // handle these stores correctly.
+    return false;
+  }
   receiver = it->GetStoreTarget<JSObject>();
   if (it->ExtendingNonExtensible(receiver)) return false;
   it->PrepareTransitionToDataProperty(receiver, value, NONE, store_origin);
@@ -1839,6 +1857,12 @@ void KeyedStoreIC::UpdateStoreElement(Handle<Map> receiver_map,
     if (receiver_map.is_identical_to(previous_receiver_map) &&
         new_receiver_map.is_identical_to(receiver_map) &&
         old_store_mode == STANDARD_STORE && store_mode != STANDARD_STORE) {
+      if (receiver_map->IsJSArrayMap() &&
+          JSArray::MayHaveReadOnlyLength(*receiver_map)) {
+        set_slow_stub_reason(
+            "can't generalize store mode (potentially read-only length)");
+        return;
+      }
       // A "normal" IC that handles stores can switch to a version that can
       // grow at the end of the array, handle OOB accesses or copy COW arrays
       // and still stay MONOMORPHIC.
@@ -1883,13 +1907,18 @@ void KeyedStoreIC::UpdateStoreElement(Handle<Map> receiver_map,
   }
 
   // If the store mode isn't the standard mode, make sure that all polymorphic
-  // receivers are either external arrays, or all "normal" arrays. Otherwise,
-  // use the megamorphic stub.
+  // receivers are either external arrays, or all "normal" arrays with writable
+  // length. Otherwise, use the megamorphic stub.
   if (store_mode != STANDARD_STORE) {
     size_t external_arrays = 0;
     for (MapAndHandler map_and_handler : target_maps_and_handlers) {
       Handle<Map> map = map_and_handler.first;
-      if (map->has_typed_array_elements()) {
+      if (map->IsJSArrayMap() && JSArray::MayHaveReadOnlyLength(*map)) {
+        set_slow_stub_reason(
+            "unsupported combination of arrays (potentially read-only length)");
+        return;
+
+      } else if (map->has_typed_array_elements()) {
         DCHECK(!IsStoreInArrayLiteralICKind(kind()));
         external_arrays++;
       }
@@ -1918,8 +1947,12 @@ void KeyedStoreIC::UpdateStoreElement(Handle<Map> receiver_map,
 Handle<Object> KeyedStoreIC::StoreElementHandler(
     Handle<Map> receiver_map, KeyedAccessStoreMode store_mode,
     MaybeHandle<Object> prev_validity_cell) {
+  // The only case when could keep using non-slow element store handler for
+  // a fast array with potentially read-only elements is when it's an
+  // initializing store to array literal.
   DCHECK_IMPLIES(
-      receiver_map->DictionaryElementsInPrototypeChainOnly(isolate()),
+      !receiver_map->has_dictionary_elements() &&
+          receiver_map->MayHaveReadOnlyElementsInPrototypeChain(isolate()),
       IsStoreInArrayLiteralICKind(kind()));
 
   if (receiver_map->IsJSProxyMap()) {
@@ -1984,7 +2017,7 @@ void KeyedStoreIC::StoreElementPolymorphicHandlers(
     Handle<Map> transition;
 
     if (receiver_map->instance_type() < FIRST_JS_RECEIVER_TYPE ||
-        receiver_map->DictionaryElementsInPrototypeChainOnly(isolate())) {
+        receiver_map->MayHaveReadOnlyElementsInPrototypeChain(isolate())) {
       // TODO(mvstanton): Consider embedding store_mode in the state of the slow
       // keyed store ic for uniformity.
       TRACE_HANDLER_STATS(isolate(), KeyedStoreIC_SlowStub);
@@ -2147,17 +2180,18 @@ MaybeHandle<Object> KeyedStoreIC::Store(Handle<Object> object,
       } else if (object->IsJSArray() && IsGrowStoreMode(store_mode) &&
                  JSArray::HasReadOnlyLength(Handle<JSArray>::cast(object))) {
         set_slow_stub_reason("array has read only length");
-      } else if (object->IsJSArray() && MayHaveTypedArrayInPrototypeChain(
-                                            Handle<JSObject>::cast(object))) {
+      } else if (object->IsJSObject() && MayHaveTypedArrayInPrototypeChain(
+                                             Handle<JSObject>::cast(object))) {
         // Make sure we don't handle this in IC if there's any JSTypedArray in
         // the {receiver}'s prototype chain, since that prototype is going to
         // swallow all stores that are out-of-bounds for said prototype, and we
         // just let the runtime deal with the complexity of this.
-        set_slow_stub_reason("typed array in the prototype chain of an Array");
+        set_slow_stub_reason("typed array in the prototype chain");
       } else if (key_is_valid_index) {
         if (old_receiver_map->is_abandoned_prototype_map()) {
           set_slow_stub_reason("receiver with prototype map");
-        } else if (!old_receiver_map->DictionaryElementsInPrototypeChainOnly(
+        } else if (old_receiver_map->has_dictionary_elements() ||
+                   !old_receiver_map->MayHaveReadOnlyElementsInPrototypeChain(
                        isolate())) {
           // We should go generic if receiver isn't a dictionary, but our
           // prototype chain does have dictionary elements. This ensures that
@@ -2167,7 +2201,7 @@ MaybeHandle<Object> KeyedStoreIC::Store(Handle<Object> object,
           UpdateStoreElement(old_receiver_map, store_mode,
                              handle(receiver->map(), isolate()));
         } else {
-          set_slow_stub_reason("dictionary or proxy prototype");
+          set_slow_stub_reason("prototype with potentially read-only elements");
         }
       } else {
         set_slow_stub_reason("non-smi-like key");
diff --git a/deps/v8/src/ic/keyed-store-generic.cc b/deps/v8/src/ic/keyed-store-generic.cc
index 88a66e17607..bc752e0e93e 100644
--- a/deps/v8/src/ic/keyed-store-generic.cc
+++ b/deps/v8/src/ic/keyed-store-generic.cc
@@ -80,9 +80,9 @@ class KeyedStoreGenericAssembler : public AccessorAssembler {
                              Nothing<LanguageMode>());
   }
 
-  void BranchIfPrototypesHaveNonFastElements(TNode<Map> receiver_map,
-                                             Label* non_fast_elements,
-                                             Label* only_fast_elements);
+  void BranchIfPrototypesMayHaveReadOnlyElements(
+      TNode<Map> receiver_map, Label* maybe_read_only_elements,
+      Label* only_fast_writable_elements);
 
   void TryRewriteElements(TNode<JSObject> receiver, TNode<Map> receiver_map,
                           TNode<FixedArrayBase> elements,
@@ -176,9 +176,9 @@ void KeyedStoreGenericGenerator::SetPropertyInLiteral(
   assembler.SetProperty(context, receiver, key, value, LanguageMode::kStrict);
 }
 
-void KeyedStoreGenericAssembler::BranchIfPrototypesHaveNonFastElements(
-    TNode<Map> receiver_map, Label* non_fast_elements,
-    Label* only_fast_elements) {
+void KeyedStoreGenericAssembler::BranchIfPrototypesMayHaveReadOnlyElements(
+    TNode<Map> receiver_map, Label* maybe_read_only_elements,
+    Label* only_fast_writable_elements) {
   TVARIABLE(Map, var_map);
   var_map = receiver_map;
   Label loop_body(this, &var_map);
@@ -188,16 +188,17 @@ void KeyedStoreGenericAssembler::BranchIfPrototypesHaveNonFastElements(
   {
     TNode<Map> map = var_map.value();
     TNode<HeapObject> prototype = LoadMapPrototype(map);
-    GotoIf(IsNull(prototype), only_fast_elements);
+    GotoIf(IsNull(prototype), only_fast_writable_elements);
     TNode<Map> prototype_map = LoadMap(prototype);
     var_map = prototype_map;
     TNode<Uint16T> instance_type = LoadMapInstanceType(prototype_map);
     GotoIf(IsCustomElementsReceiverInstanceType(instance_type),
-           non_fast_elements);
+           maybe_read_only_elements);
     TNode<Int32T> elements_kind = LoadMapElementsKind(prototype_map);
-    GotoIf(IsFastElementsKind(elements_kind), &loop_body);
+    GotoIf(IsFastOrNonExtensibleOrSealedElementsKind(elements_kind),
+           &loop_body);
     GotoIf(Word32Equal(elements_kind, Int32Constant(NO_ELEMENTS)), &loop_body);
-    Goto(non_fast_elements);
+    Goto(maybe_read_only_elements);
   }
 }
 
@@ -350,8 +351,8 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
               CAST(Load(MachineType::AnyTagged(), elements, offset));
           GotoIf(IsNotTheHole(element), &hole_check_passed);
         }
-        BranchIfPrototypesHaveNonFastElements(receiver_map, slow,
-                                              &hole_check_passed);
+        BranchIfPrototypesMayHaveReadOnlyElements(receiver_map, slow,
+                                                  &hole_check_passed);
         BIND(&hole_check_passed);
       }
     }
@@ -442,7 +443,6 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
     TNode<IntPtrT> offset =
         ElementOffsetFromIndex(index, PACKED_DOUBLE_ELEMENTS, kHeaderSize);
     if (!IsStoreInLiteral()) {
-      // Check if we're about to overwrite the hole. We can safely do that
       // Check if we're about to overwrite the hole. We can safely do that
       // only if there can be no setters on the prototype chain.
       {
@@ -456,8 +456,8 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
           Goto(&hole_check_passed);
           BIND(&found_hole);
         }
-        BranchIfPrototypesHaveNonFastElements(receiver_map, slow,
-                                              &hole_check_passed);
+        BranchIfPrototypesMayHaveReadOnlyElements(receiver_map, slow,
+                                                  &hole_check_passed);
         BIND(&hole_check_passed);
       }
     }
diff --git a/deps/v8/src/ic/unary-op-assembler.cc b/deps/v8/src/ic/unary-op-assembler.cc
new file mode 100644
index 00000000000..6580601a1f4
--- /dev/null
+++ b/deps/v8/src/ic/unary-op-assembler.cc
@@ -0,0 +1,283 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/ic/unary-op-assembler.h"
+
+#include "src/common/globals.h"
+
+namespace v8 {
+namespace internal {
+
+namespace {
+
+class UnaryOpAssemblerImpl final : public CodeStubAssembler {
+ public:
+  explicit UnaryOpAssemblerImpl(compiler::CodeAssemblerState* state)
+      : CodeStubAssembler(state) {}
+
+  TNode<Object> BitwiseNot(TNode<Context> context, TNode<Object> value,
+                           TNode<UintPtrT> slot,
+                           TNode<HeapObject> maybe_feedback_vector) {
+    // TODO(jgruber): Make this implementation more consistent with other unary
+    // ops (i.e. have them all use UnaryOpWithFeedback or some other common
+    // mechanism).
+    TVARIABLE(Word32T, var_word32);
+    TVARIABLE(Smi, var_feedback);
+    TVARIABLE(BigInt, var_bigint);
+    TVARIABLE(Object, var_result);
+    Label if_number(this), if_bigint(this, Label::kDeferred), out(this);
+    TaggedToWord32OrBigIntWithFeedback(context, value, &if_number, &var_word32,
+                                       &if_bigint, &var_bigint, &var_feedback);
+
+    // Number case.
+    BIND(&if_number);
+    var_result =
+        ChangeInt32ToTagged(Signed(Word32BitwiseNot(var_word32.value())));
+    TNode<Smi> result_type = SelectSmiConstant(
+        TaggedIsSmi(var_result.value()), BinaryOperationFeedback::kSignedSmall,
+        BinaryOperationFeedback::kNumber);
+    UpdateFeedback(SmiOr(result_type, var_feedback.value()),
+                   maybe_feedback_vector, slot);
+    Goto(&out);
+
+    // BigInt case.
+    BIND(&if_bigint);
+    UpdateFeedback(SmiConstant(BinaryOperationFeedback::kBigInt),
+                   maybe_feedback_vector, slot);
+    var_result =
+        CallRuntime(Runtime::kBigIntUnaryOp, context, var_bigint.value(),
+                    SmiConstant(Operation::kBitwiseNot));
+    Goto(&out);
+
+    BIND(&out);
+    return var_result.value();
+  }
+
+  TNode<Object> Decrement(TNode<Context> context, TNode<Object> value,
+                          TNode<UintPtrT> slot,
+                          TNode<HeapObject> maybe_feedback_vector) {
+    return IncrementOrDecrement<Operation::kDecrement>(context, value, slot,
+                                                       maybe_feedback_vector);
+  }
+
+  TNode<Object> Increment(TNode<Context> context, TNode<Object> value,
+                          TNode<UintPtrT> slot,
+                          TNode<HeapObject> maybe_feedback_vector) {
+    return IncrementOrDecrement<Operation::kIncrement>(context, value, slot,
+                                                       maybe_feedback_vector);
+  }
+
+  TNode<Object> Negate(TNode<Context> context, TNode<Object> value,
+                       TNode<UintPtrT> slot,
+                       TNode<HeapObject> maybe_feedback_vector) {
+    SmiOperation smi_op = [=](TNode<Smi> smi_value,
+                              TVariable<Smi>* var_feedback, Label* do_float_op,
+                              TVariable<Float64T>* var_float) {
+      TVARIABLE(Number, var_result);
+      Label if_zero(this), if_min_smi(this), end(this);
+      // Return -0 if operand is 0.
+      GotoIf(SmiEqual(smi_value, SmiConstant(0)), &if_zero);
+
+      // Special-case the minimum Smi to avoid overflow.
+      GotoIf(SmiEqual(smi_value, SmiConstant(Smi::kMinValue)), &if_min_smi);
+
+      // Else simply subtract operand from 0.
+      CombineFeedback(var_feedback, BinaryOperationFeedback::kSignedSmall);
+      var_result = SmiSub(SmiConstant(0), smi_value);
+      Goto(&end);
+
+      BIND(&if_zero);
+      CombineFeedback(var_feedback, BinaryOperationFeedback::kNumber);
+      var_result = MinusZeroConstant();
+      Goto(&end);
+
+      BIND(&if_min_smi);
+      *var_float = SmiToFloat64(smi_value);
+      Goto(do_float_op);
+
+      BIND(&end);
+      return var_result.value();
+    };
+    FloatOperation float_op = [=](TNode<Float64T> float_value) {
+      return Float64Neg(float_value);
+    };
+    BigIntOperation bigint_op = [=](TNode<Context> context,
+                                    TNode<HeapObject> bigint_value) {
+      return CAST(CallRuntime(Runtime::kBigIntUnaryOp, context, bigint_value,
+                              SmiConstant(Operation::kNegate)));
+    };
+    return UnaryOpWithFeedback(context, value, slot, maybe_feedback_vector,
+                               smi_op, float_op, bigint_op);
+  }
+
+ private:
+  using SmiOperation = std::function<TNode<Number>(
+      TNode<Smi> /* smi_value */, TVariable<Smi>* /* var_feedback */,
+      Label* /* do_float_op */, TVariable<Float64T>* /* var_float */)>;
+  using FloatOperation =
+      std::function<TNode<Float64T>(TNode<Float64T> /* float_value */)>;
+  using BigIntOperation = std::function<TNode<HeapObject>(
+      TNode<Context> /* context */, TNode<HeapObject> /* bigint_value */)>;
+
+  TNode<Object> UnaryOpWithFeedback(TNode<Context> context, TNode<Object> value,
+                                    TNode<UintPtrT> slot,
+                                    TNode<HeapObject> maybe_feedback_vector,
+                                    const SmiOperation& smi_op,
+                                    const FloatOperation& float_op,
+                                    const BigIntOperation& bigint_op) {
+    TVARIABLE(Object, var_value, value);
+    TVARIABLE(Object, var_result);
+    TVARIABLE(Float64T, var_float_value);
+    TVARIABLE(Smi, var_feedback, SmiConstant(BinaryOperationFeedback::kNone));
+    Label start(this, {&var_value, &var_feedback}), end(this);
+    Label do_float_op(this, &var_float_value);
+    Goto(&start);
+    // We might have to try again after ToNumeric conversion.
+    BIND(&start);
+    {
+      Label if_smi(this), if_heapnumber(this), if_oddball(this);
+      Label if_bigint(this, Label::kDeferred);
+      Label if_other(this, Label::kDeferred);
+      TNode<Object> value = var_value.value();
+      GotoIf(TaggedIsSmi(value), &if_smi);
+
+      TNode<HeapObject> value_heap_object = CAST(value);
+      TNode<Map> map = LoadMap(value_heap_object);
+      GotoIf(IsHeapNumberMap(map), &if_heapnumber);
+      TNode<Uint16T> instance_type = LoadMapInstanceType(map);
+      GotoIf(IsBigIntInstanceType(instance_type), &if_bigint);
+      Branch(InstanceTypeEqual(instance_type, ODDBALL_TYPE), &if_oddball,
+             &if_other);
+
+      BIND(&if_smi);
+      {
+        var_result =
+            smi_op(CAST(value), &var_feedback, &do_float_op, &var_float_value);
+        Goto(&end);
+      }
+
+      BIND(&if_heapnumber);
+      {
+        var_float_value = LoadHeapNumberValue(value_heap_object);
+        Goto(&do_float_op);
+      }
+
+      BIND(&if_bigint);
+      {
+        var_result = bigint_op(context, value_heap_object);
+        CombineFeedback(&var_feedback, BinaryOperationFeedback::kBigInt);
+        Goto(&end);
+      }
+
+      BIND(&if_oddball);
+      {
+        // We do not require an Or with earlier feedback here because once we
+        // convert the value to a number, we cannot reach this path. We can
+        // only reach this path on the first pass when the feedback is kNone.
+        CSA_ASSERT(this, SmiEqual(var_feedback.value(),
+                                  SmiConstant(BinaryOperationFeedback::kNone)));
+        OverwriteFeedback(&var_feedback,
+                          BinaryOperationFeedback::kNumberOrOddball);
+        var_value =
+            LoadObjectField(value_heap_object, Oddball::kToNumberOffset);
+        Goto(&start);
+      }
+
+      BIND(&if_other);
+      {
+        // We do not require an Or with earlier feedback here because once we
+        // convert the value to a number, we cannot reach this path. We can
+        // only reach this path on the first pass when the feedback is kNone.
+        CSA_ASSERT(this, SmiEqual(var_feedback.value(),
+                                  SmiConstant(BinaryOperationFeedback::kNone)));
+        OverwriteFeedback(&var_feedback, BinaryOperationFeedback::kAny);
+        var_value = CallBuiltin(Builtins::kNonNumberToNumeric, context,
+                                value_heap_object);
+        Goto(&start);
+      }
+    }
+
+    BIND(&do_float_op);
+    {
+      CombineFeedback(&var_feedback, BinaryOperationFeedback::kNumber);
+      var_result =
+          AllocateHeapNumberWithValue(float_op(var_float_value.value()));
+      Goto(&end);
+    }
+
+    BIND(&end);
+    UpdateFeedback(var_feedback.value(), maybe_feedback_vector, slot);
+    return var_result.value();
+  }
+
+  template <Operation kOperation>
+  TNode<Object> IncrementOrDecrement(TNode<Context> context,
+                                     TNode<Object> value, TNode<UintPtrT> slot,
+                                     TNode<HeapObject> maybe_feedback_vector) {
+    STATIC_ASSERT(kOperation == Operation::kIncrement ||
+                  kOperation == Operation::kDecrement);
+    static constexpr int kAddValue =
+        (kOperation == Operation::kIncrement) ? 1 : -1;
+
+    SmiOperation smi_op = [=](TNode<Smi> smi_value,
+                              TVariable<Smi>* var_feedback, Label* do_float_op,
+                              TVariable<Float64T>* var_float) {
+      Label if_overflow(this), out(this);
+      TNode<Smi> result =
+          TrySmiAdd(smi_value, SmiConstant(kAddValue), &if_overflow);
+      CombineFeedback(var_feedback, BinaryOperationFeedback::kSignedSmall);
+      Goto(&out);
+
+      BIND(&if_overflow);
+      *var_float = SmiToFloat64(smi_value);
+      Goto(do_float_op);
+
+      BIND(&out);
+      return result;
+    };
+    FloatOperation float_op = [=](TNode<Float64T> float_value) {
+      return Float64Add(float_value, Float64Constant(kAddValue));
+    };
+    BigIntOperation bigint_op = [=](TNode<Context> context,
+                                    TNode<HeapObject> bigint_value) {
+      return CAST(CallRuntime(Runtime::kBigIntUnaryOp, context, bigint_value,
+                              SmiConstant(kOperation)));
+    };
+    return UnaryOpWithFeedback(context, value, slot, maybe_feedback_vector,
+                               smi_op, float_op, bigint_op);
+  }
+};
+
+}  // namespace
+
+TNode<Object> UnaryOpAssembler::Generate_BitwiseNotWithFeedback(
+    TNode<Context> context, TNode<Object> value, TNode<UintPtrT> slot,
+    TNode<HeapObject> maybe_feedback_vector) {
+  UnaryOpAssemblerImpl a(state_);
+  return a.BitwiseNot(context, value, slot, maybe_feedback_vector);
+}
+
+TNode<Object> UnaryOpAssembler::Generate_DecrementWithFeedback(
+    TNode<Context> context, TNode<Object> value, TNode<UintPtrT> slot,
+    TNode<HeapObject> maybe_feedback_vector) {
+  UnaryOpAssemblerImpl a(state_);
+  return a.Decrement(context, value, slot, maybe_feedback_vector);
+}
+
+TNode<Object> UnaryOpAssembler::Generate_IncrementWithFeedback(
+    TNode<Context> context, TNode<Object> value, TNode<UintPtrT> slot,
+    TNode<HeapObject> maybe_feedback_vector) {
+  UnaryOpAssemblerImpl a(state_);
+  return a.Increment(context, value, slot, maybe_feedback_vector);
+}
+
+TNode<Object> UnaryOpAssembler::Generate_NegateWithFeedback(
+    TNode<Context> context, TNode<Object> value, TNode<UintPtrT> slot,
+    TNode<HeapObject> maybe_feedback_vector) {
+  UnaryOpAssemblerImpl a(state_);
+  return a.Negate(context, value, slot, maybe_feedback_vector);
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/ic/unary-op-assembler.h b/deps/v8/src/ic/unary-op-assembler.h
new file mode 100644
index 00000000000..b22322ddf2a
--- /dev/null
+++ b/deps/v8/src/ic/unary-op-assembler.h
@@ -0,0 +1,45 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_IC_UNARY_OP_ASSEMBLER_H_
+#define V8_IC_UNARY_OP_ASSEMBLER_H_
+
+#include "src/codegen/code-stub-assembler.h"
+
+namespace v8 {
+namespace internal {
+
+namespace compiler {
+class CodeAssemblerState;
+}
+
+class UnaryOpAssembler final {
+ public:
+  explicit UnaryOpAssembler(compiler::CodeAssemblerState* state)
+      : state_(state) {}
+
+  TNode<Object> Generate_BitwiseNotWithFeedback(
+      TNode<Context> context, TNode<Object> value, TNode<UintPtrT> slot,
+      TNode<HeapObject> maybe_feedback_vector);
+
+  TNode<Object> Generate_DecrementWithFeedback(
+      TNode<Context> context, TNode<Object> value, TNode<UintPtrT> slot,
+      TNode<HeapObject> maybe_feedback_vector);
+
+  TNode<Object> Generate_IncrementWithFeedback(
+      TNode<Context> context, TNode<Object> value, TNode<UintPtrT> slot,
+      TNode<HeapObject> maybe_feedback_vector);
+
+  TNode<Object> Generate_NegateWithFeedback(
+      TNode<Context> context, TNode<Object> value, TNode<UintPtrT> slot,
+      TNode<HeapObject> maybe_feedback_vector);
+
+ private:
+  compiler::CodeAssemblerState* const state_;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_IC_UNARY_OP_ASSEMBLER_H_
diff --git a/deps/v8/src/init/bootstrapper.cc b/deps/v8/src/init/bootstrapper.cc
index 22d33eaf919..96e613f2474 100644
--- a/deps/v8/src/init/bootstrapper.cc
+++ b/deps/v8/src/init/bootstrapper.cc
@@ -25,6 +25,7 @@
 #endif  // ENABLE_VTUNE_TRACEMARK
 #include "src/heap/heap-inl.h"
 #include "src/logging/counters.h"
+#include "src/logging/log.h"
 #include "src/numbers/math-random.h"
 #include "src/objects/api-callbacks.h"
 #include "src/objects/arguments.h"
@@ -188,7 +189,7 @@ class Genesis {
 
   // Creates the global objects using the global proxy and the template passed
   // in through the API.  We call this regardless of whether we are building a
-  // context from scratch or using a deserialized one from the partial snapshot
+  // context from scratch or using a deserialized one from the context snapshot
   // but in the latter case we don't use the objects it produces directly, as
   // we have to use the deserialized ones that are linked together with the
   // rest of the context snapshot. At the end we link the global proxy and the
@@ -361,32 +362,11 @@ void Bootstrapper::DetachGlobal(Handle<Context> env) {
     isolate_->AddDetachedContext(env);
   }
 
-  env->native_context().set_microtask_queue(nullptr);
+  env->native_context().set_microtask_queue(isolate_, nullptr);
 }
 
 namespace {
 
-V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateSharedFunctionInfo(
-    Isolate* isolate, Builtins::Name builtin_id, Handle<String> name, int len,
-    FunctionKind kind = FunctionKind::kNormalFunction) {
-  Handle<SharedFunctionInfo> shared =
-      isolate->factory()->NewSharedFunctionInfoForBuiltin(name, builtin_id,
-                                                          kind);
-  shared->set_internal_formal_parameter_count(len);
-  shared->set_length(len);
-  return shared;
-}
-
-V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateBuiltinSharedFunctionInfo(
-    Isolate* isolate, Builtins::Name builtin_id, Handle<String> name, int len) {
-  Handle<SharedFunctionInfo> shared =
-      isolate->factory()->NewSharedFunctionInfoForBuiltin(name, builtin_id,
-                                                          kNormalFunction);
-  shared->set_internal_formal_parameter_count(len);
-  shared->set_length(len);
-  return shared;
-}
-
 V8_NOINLINE Handle<JSFunction> CreateFunction(
     Isolate* isolate, Handle<String> name, InstanceType type, int instance_size,
     int inobject_properties, Handle<HeapObject> prototype,
@@ -1334,21 +1314,22 @@ static void InstallWithIntrinsicDefaultProto(Isolate* isolate,
   isolate->native_context()->set(context_index, *function);
 }
 
-static void InstallError(Isolate* isolate, Handle<JSObject> global,
-                         Handle<String> name, int context_index) {
+static void InstallError(
+    Isolate* isolate, Handle<JSObject> global, Handle<String> name,
+    int context_index,
+    Builtins::Name error_constructor = Builtins::kErrorConstructor,
+    int error_function_length = 1, int in_object_properties = 2) {
   Factory* factory = isolate->factory();
 
   // Most Error objects consist of a message and a stack trace.
   // Reserve two in-object properties for these.
-  const int kInObjectPropertiesCount = 2;
   const int kErrorObjectSize =
-      JSObject::kHeaderSize + kInObjectPropertiesCount * kTaggedSize;
-  Handle<JSFunction> error_fun =
-      InstallFunction(isolate, global, name, JS_ERROR_TYPE, kErrorObjectSize,
-                      kInObjectPropertiesCount, factory->the_hole_value(),
-                      Builtins::kErrorConstructor);
+      JSObject::kHeaderSize + in_object_properties * kTaggedSize;
+  Handle<JSFunction> error_fun = InstallFunction(
+      isolate, global, name, JS_ERROR_TYPE, kErrorObjectSize,
+      in_object_properties, factory->the_hole_value(), error_constructor);
   error_fun->shared().DontAdaptArguments();
-  error_fun->shared().set_length(1);
+  error_fun->shared().set_length(error_function_length);
 
   if (context_index == Context::ERROR_FUNCTION_INDEX) {
     SimpleInstallFunction(isolate, error_fun, "captureStackTrace",
@@ -1396,20 +1377,6 @@ static void InstallError(Isolate* isolate, Handle<JSObject> global,
   }
 }
 
-namespace {
-
-void InstallMakeError(Isolate* isolate, int builtin_id, int context_index) {
-  NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
-      isolate->factory()->empty_string(), isolate->factory()->the_hole_value(),
-      JS_OBJECT_TYPE, JSObject::kHeaderSize, 0, builtin_id, MUTABLE);
-
-  Handle<JSFunction> function = isolate->factory()->NewFunction(args);
-  function->shared().DontAdaptArguments();
-  isolate->native_context()->set(context_index, *function);
-}
-
-}  // namespace
-
 // This is only called if we are not using snapshots.  The equivalent
 // work in the snapshot case is done in HookUpGlobalObject.
 void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
@@ -1622,47 +1589,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     }
   }
 
-  {  // --- A s y n c F r o m S y n c I t e r a t o r
-    Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-        isolate_, Builtins::kAsyncIteratorValueUnwrap, factory->empty_string(),
-        1);
-    native_context()->set_async_iterator_value_unwrap_shared_fun(*info);
-  }
-
-  {  // --- A s y n c G e n e r a t o r ---
-    Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-        isolate_, Builtins::kAsyncGeneratorAwaitResolveClosure,
-        factory->empty_string(), 1);
-    native_context()->set_async_generator_await_resolve_shared_fun(*info);
-
-    info = SimpleCreateSharedFunctionInfo(
-        isolate_, Builtins::kAsyncGeneratorAwaitRejectClosure,
-        factory->empty_string(), 1);
-    native_context()->set_async_generator_await_reject_shared_fun(*info);
-
-    info = SimpleCreateSharedFunctionInfo(
-        isolate_, Builtins::kAsyncGeneratorYieldResolveClosure,
-        factory->empty_string(), 1);
-    native_context()->set_async_generator_yield_resolve_shared_fun(*info);
-
-    info = SimpleCreateSharedFunctionInfo(
-        isolate_, Builtins::kAsyncGeneratorReturnResolveClosure,
-        factory->empty_string(), 1);
-    native_context()->set_async_generator_return_resolve_shared_fun(*info);
-
-    info = SimpleCreateSharedFunctionInfo(
-        isolate_, Builtins::kAsyncGeneratorReturnClosedResolveClosure,
-        factory->empty_string(), 1);
-    native_context()->set_async_generator_return_closed_resolve_shared_fun(
-        *info);
-
-    info = SimpleCreateSharedFunctionInfo(
-        isolate_, Builtins::kAsyncGeneratorReturnClosedRejectClosure,
-        factory->empty_string(), 1);
-    native_context()->set_async_generator_return_closed_reject_shared_fun(
-        *info);
-  }
-
   Handle<JSFunction> array_prototype_to_string_fun;
   {  // --- A r r a y ---
     Handle<JSFunction> array_function = InstallFunction(
@@ -2345,13 +2271,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
   }
 
-  {
-    Handle<SharedFunctionInfo> info = SimpleCreateBuiltinSharedFunctionInfo(
-        isolate_, Builtins::kPromiseGetCapabilitiesExecutor,
-        factory->empty_string(), 2);
-    native_context()->set_promise_get_capabilities_executor_shared_fun(*info);
-  }
-
   {  // -- P r o m i s e
     Handle<JSFunction> promise_fun = InstallFunction(
         isolate_, global, "Promise", JS_PROMISE_TYPE,
@@ -2398,89 +2317,12 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     InstallFunctionWithBuiltinId(isolate_, prototype, "finally",
                                  Builtins::kPromisePrototypeFinally, 1, true);
 
-    {
-      Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-          isolate(), Builtins::kPromiseThenFinally,
-          isolate_->factory()->empty_string(), 1);
-      info->set_native(true);
-      native_context()->set_promise_then_finally_shared_fun(*info);
-    }
-
-    {
-      Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-          isolate(), Builtins::kPromiseCatchFinally,
-          isolate_->factory()->empty_string(), 1);
-      info->set_native(true);
-      native_context()->set_promise_catch_finally_shared_fun(*info);
-    }
-
-    {
-      Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-          isolate(), Builtins::kPromiseValueThunkFinally,
-          isolate_->factory()->empty_string(), 0);
-      native_context()->set_promise_value_thunk_finally_shared_fun(*info);
-    }
-
-    {
-      Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-          isolate(), Builtins::kPromiseThrowerFinally,
-          isolate_->factory()->empty_string(), 0);
-      native_context()->set_promise_thrower_finally_shared_fun(*info);
-    }
-
-    // Force the Promise constructor to fast properties, so that we can use the
-    // fast paths for various things like
-    //
-    //   x instanceof Promise
-    //
-    // etc. We should probably come up with a more principled approach once
-    // the JavaScript builtins are gone.
-    JSObject::MigrateSlowToFast(Handle<JSObject>::cast(promise_fun), 0,
-                                "Bootstrapping");
+    DCHECK(promise_fun->HasFastProperties());
 
     Handle<Map> prototype_map(prototype->map(), isolate());
     Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate_);
 
-    {  // Internal: IsPromise
-      Handle<JSFunction> function = SimpleCreateFunction(
-          isolate_, factory->empty_string(), Builtins::kIsPromise, 1, false);
-      native_context()->set_is_promise(*function);
-    }
-
-    {
-      Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-          isolate_, Builtins::kPromiseCapabilityDefaultResolve,
-          factory->empty_string(), 1, FunctionKind::kConciseMethod);
-      info->set_native(true);
-      info->set_function_map_index(
-          Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
-      native_context()->set_promise_capability_default_resolve_shared_fun(
-          *info);
-
-      info = SimpleCreateSharedFunctionInfo(
-          isolate_, Builtins::kPromiseCapabilityDefaultReject,
-          factory->empty_string(), 1, FunctionKind::kConciseMethod);
-      info->set_native(true);
-      info->set_function_map_index(
-          Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
-      native_context()->set_promise_capability_default_reject_shared_fun(*info);
-    }
-
-    {
-      Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-          isolate_, Builtins::kPromiseAllResolveElementClosure,
-          factory->empty_string(), 1);
-      native_context()->set_promise_all_resolve_element_shared_fun(*info);
-    }
-
-    // Force the Promise constructor to fast properties, so that we can use the
-    // fast paths for various things like
-    //
-    //   x instanceof Promise
-    //
-    // etc. We should probably come up with a more principled approach once
-    // the JavaScript builtins are gone.
-    JSObject::MigrateSlowToFast(promise_fun, 0, "Bootstrapping");
+    DCHECK(promise_fun->HasFastProperties());
   }
 
   {  // -- R e g E x p
@@ -2674,14 +2516,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
       native_context()->set_regexp_species_protector(*cell);
     }
 
-    // Force the RegExp constructor to fast properties, so that we can use the
-    // fast paths for various things like
-    //
-    //   x instanceof RegExp
-    //
-    // etc. We should probably come up with a more principled approach once
-    // the JavaScript builtins are gone.
-    JSObject::MigrateSlowToFast(regexp_fun, 0, "Bootstrapping");
+    DCHECK(regexp_fun->HasFastProperties());
   }
 
   {  // --- R e g E x p S t r i n g  I t e r a t o r ---
@@ -2709,49 +2544,33 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
         regexp_string_iterator_function->initial_map());
   }
 
-  {  // -- E r r o r
-    InstallError(isolate_, global, factory->Error_string(),
-                 Context::ERROR_FUNCTION_INDEX);
-    InstallMakeError(isolate_, Builtins::kMakeError, Context::MAKE_ERROR_INDEX);
-  }
+  // -- E r r o r
+  InstallError(isolate_, global, factory->Error_string(),
+               Context::ERROR_FUNCTION_INDEX);
 
-  {  // -- E v a l E r r o r
-    InstallError(isolate_, global, factory->EvalError_string(),
-                 Context::EVAL_ERROR_FUNCTION_INDEX);
-  }
+  // -- E v a l E r r o r
+  InstallError(isolate_, global, factory->EvalError_string(),
+               Context::EVAL_ERROR_FUNCTION_INDEX);
 
-  {  // -- R a n g e E r r o r
-    InstallError(isolate_, global, factory->RangeError_string(),
-                 Context::RANGE_ERROR_FUNCTION_INDEX);
-    InstallMakeError(isolate_, Builtins::kMakeRangeError,
-                     Context::MAKE_RANGE_ERROR_INDEX);
-  }
+  // -- R a n g e E r r o r
+  InstallError(isolate_, global, factory->RangeError_string(),
+               Context::RANGE_ERROR_FUNCTION_INDEX);
 
-  {  // -- R e f e r e n c e E r r o r
-    InstallError(isolate_, global, factory->ReferenceError_string(),
-                 Context::REFERENCE_ERROR_FUNCTION_INDEX);
-  }
+  // -- R e f e r e n c e E r r o r
+  InstallError(isolate_, global, factory->ReferenceError_string(),
+               Context::REFERENCE_ERROR_FUNCTION_INDEX);
 
-  {  // -- S y n t a x E r r o r
-    InstallError(isolate_, global, factory->SyntaxError_string(),
-                 Context::SYNTAX_ERROR_FUNCTION_INDEX);
-    InstallMakeError(isolate_, Builtins::kMakeSyntaxError,
-                     Context::MAKE_SYNTAX_ERROR_INDEX);
-  }
+  // -- S y n t a x E r r o r
+  InstallError(isolate_, global, factory->SyntaxError_string(),
+               Context::SYNTAX_ERROR_FUNCTION_INDEX);
 
-  {  // -- T y p e E r r o r
-    InstallError(isolate_, global, factory->TypeError_string(),
-                 Context::TYPE_ERROR_FUNCTION_INDEX);
-    InstallMakeError(isolate_, Builtins::kMakeTypeError,
-                     Context::MAKE_TYPE_ERROR_INDEX);
-  }
+  // -- T y p e E r r o r
+  InstallError(isolate_, global, factory->TypeError_string(),
+               Context::TYPE_ERROR_FUNCTION_INDEX);
 
-  {  // -- U R I E r r o r
-    InstallError(isolate_, global, factory->URIError_string(),
-                 Context::URI_ERROR_FUNCTION_INDEX);
-    InstallMakeError(isolate_, Builtins::kMakeURIError,
-                     Context::MAKE_URI_ERROR_INDEX);
-  }
+  // -- U R I E r r o r
+  InstallError(isolate_, global, factory->URIError_string(),
+               Context::URI_ERROR_FUNCTION_INDEX);
 
   {  // -- C o m p i l e E r r o r
     Handle<JSObject> dummy = factory->NewJSObject(isolate_->object_function());
@@ -3203,6 +3022,37 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
                           factory->numberingSystem_string(),
                           Builtins::kLocalePrototypeNumberingSystem, true);
     }
+
+    {  // -- D i s p l a y N a m e s
+      Handle<JSFunction> display_names_fun = InstallFunction(
+          isolate(), intl, "DisplayNames", JS_DISPLAY_NAMES_TYPE,
+          JSDisplayNames::kHeaderSize, 0, factory->the_hole_value(),
+          Builtins::kDisplayNamesConstructor);
+      display_names_fun->shared().set_length(0);
+      display_names_fun->shared().DontAdaptArguments();
+      InstallWithIntrinsicDefaultProto(
+          isolate(), display_names_fun,
+          Context::INTL_DISPLAY_NAMES_FUNCTION_INDEX);
+
+      SimpleInstallFunction(isolate(), display_names_fun, "supportedLocalesOf",
+                            Builtins::kDisplayNamesSupportedLocalesOf, 1,
+                            false);
+
+      {
+        // Setup %DisplayNamesPrototype%.
+        Handle<JSObject> prototype(
+            JSObject::cast(display_names_fun->instance_prototype()), isolate());
+
+        InstallToStringTag(isolate(), prototype, "Intl.DisplayNames");
+
+        SimpleInstallFunction(isolate(), prototype, "resolvedOptions",
+                              Builtins::kDisplayNamesPrototypeResolvedOptions,
+                              0, false);
+
+        SimpleInstallFunction(isolate(), prototype, "of",
+                              Builtins::kDisplayNamesPrototypeOf, 1, false);
+      }
+    }
   }
 #endif  // V8_INTL_SUPPORT
 
@@ -3494,6 +3344,10 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     native_context()->set_initial_map_prototype_map(prototype->map());
 
     InstallSpeciesGetter(isolate_, js_map_fun);
+
+    DCHECK(js_map_fun->HasFastProperties());
+
+    native_context()->set_js_map_map(js_map_fun->initial_map());
   }
 
   {  // -- B i g I n t
@@ -3586,6 +3440,10 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     native_context()->set_initial_set_prototype(*prototype);
 
     InstallSpeciesGetter(isolate_, js_set_fun);
+
+    DCHECK(js_set_fun->HasFastProperties());
+
+    native_context()->set_js_set_map(js_set_fun->initial_map());
   }
 
   {  // -- J S M o d u l e N a m e s p a c e
@@ -3734,12 +3592,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     SimpleInstallFunction(isolate_, proxy_function, "revocable",
                           Builtins::kProxyRevocable, 2, true);
-
-    {  // Internal: ProxyRevoke
-      Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-          isolate_, Builtins::kProxyRevoke, factory->empty_string(), 0);
-      native_context()->set_proxy_revoke_shared_fun(*info);
-    }
   }
 
   {  // -- R e f l e c t
@@ -3748,11 +3600,11 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
     JSObject::AddProperty(isolate_, global, reflect_string, reflect, DONT_ENUM);
 
-        SimpleInstallFunction(isolate_, reflect, "defineProperty",
-                              Builtins::kReflectDefineProperty, 3, true);
+    SimpleInstallFunction(isolate_, reflect, "defineProperty",
+                          Builtins::kReflectDefineProperty, 3, true);
 
-        SimpleInstallFunction(isolate_, reflect, "deleteProperty",
-                              Builtins::kReflectDeleteProperty, 2, true);
+    SimpleInstallFunction(isolate_, reflect, "deleteProperty",
+                          Builtins::kReflectDeleteProperty, 2, true);
 
     Handle<JSFunction> apply = SimpleInstallFunction(
         isolate_, reflect, "apply", Builtins::kReflectApply, 3, false);
@@ -3975,9 +3827,12 @@ Handle<JSFunction> Genesis::InstallTypedArray(const char* name,
 void Genesis::InitializeExperimentalGlobal() {
 #define FEATURE_INITIALIZE_GLOBAL(id, descr) InitializeGlobal_##id();
 
-  HARMONY_INPROGRESS(FEATURE_INITIALIZE_GLOBAL)
-  HARMONY_STAGED(FEATURE_INITIALIZE_GLOBAL)
+  // Initialize features from more mature to less mature, because less mature
+  // features may depend on more mature features having been initialized
+  // already.
   HARMONY_SHIPPING(FEATURE_INITIALIZE_GLOBAL)
+  HARMONY_STAGED(FEATURE_INITIALIZE_GLOBAL)
+  HARMONY_INPROGRESS(FEATURE_INITIALIZE_GLOBAL)
 #undef FEATURE_INITIALIZE_GLOBAL
 }
 
@@ -4191,20 +4046,6 @@ void Genesis::InitializeIteratorFunctions() {
     Handle<Map> async_function_object_map = factory->NewMap(
         JS_ASYNC_FUNCTION_OBJECT_TYPE, JSAsyncFunctionObject::kHeaderSize);
     native_context->set_async_function_object_map(*async_function_object_map);
-
-    {
-      Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-          isolate, Builtins::kAsyncFunctionAwaitRejectClosure,
-          factory->empty_string(), 1);
-      native_context->set_async_function_await_reject_shared_fun(*info);
-    }
-
-    {
-      Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-          isolate, Builtins::kAsyncFunctionAwaitResolveClosure,
-          factory->empty_string(), 1);
-      native_context->set_async_function_await_resolve_shared_fun(*info);
-    }
   }
 }
 
@@ -4273,17 +4114,14 @@ EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_private_methods)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_dynamic_import)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_import_meta)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_regexp_sequence)
-EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_optional_chaining)
-EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_nullish)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_top_level_await)
+EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_logical_assignment)
 
 #ifdef V8_INTL_SUPPORT
-EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_intl_add_calendar_numbering_system)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_intl_displaynames_date_types)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_intl_dateformat_day_period)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(
     harmony_intl_dateformat_fractional_second_digits)
-EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_intl_other_calendars)
 #endif  // V8_INTL_SUPPORT
 
 #undef EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE
@@ -4308,17 +4146,11 @@ void Genesis::InitializeGlobal_harmony_weak_refs() {
   Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
 
   {
-    // Create %FinalizationRegistryPrototype%
-    Handle<String> finalization_registry_name =
-        factory->NewStringFromStaticChars("FinalizationRegistry");
-    Handle<JSObject> finalization_registry_prototype = factory->NewJSObject(
-        isolate()->object_function(), AllocationType::kOld);
-
     // Create %FinalizationRegistry%
-    Handle<JSFunction> finalization_registry_fun = CreateFunction(
-        isolate(), finalization_registry_name, JS_FINALIZATION_REGISTRY_TYPE,
-        JSFinalizationRegistry::kHeaderSize, 0, finalization_registry_prototype,
-        Builtins::kFinalizationRegistryConstructor);
+    Handle<JSFunction> finalization_registry_fun = InstallFunction(
+        isolate(), global, factory->FinalizationRegistry_string(),
+        JS_FINALIZATION_REGISTRY_TYPE, JSFinalizationRegistry::kHeaderSize, 0,
+        factory->the_hole_value(), Builtins::kFinalizationRegistryConstructor);
     InstallWithIntrinsicDefaultProto(
         isolate(), finalization_registry_fun,
         Context::JS_FINALIZATION_REGISTRY_FUNCTION_INDEX);
@@ -4326,16 +4158,12 @@ void Genesis::InitializeGlobal_harmony_weak_refs() {
     finalization_registry_fun->shared().DontAdaptArguments();
     finalization_registry_fun->shared().set_length(1);
 
-    // Install the "constructor" property on the prototype.
-    JSObject::AddProperty(isolate(), finalization_registry_prototype,
-                          factory->constructor_string(),
-                          finalization_registry_fun, DONT_ENUM);
+    Handle<JSObject> finalization_registry_prototype(
+        JSObject::cast(finalization_registry_fun->instance_prototype()),
+        isolate());
 
     InstallToStringTag(isolate(), finalization_registry_prototype,
-                       finalization_registry_name);
-
-    JSObject::AddProperty(isolate(), global, finalization_registry_name,
-                          finalization_registry_fun, DONT_ENUM);
+                       factory->FinalizationRegistry_string());
 
     SimpleInstallFunction(isolate(), finalization_registry_prototype,
                           "register", Builtins::kFinalizationRegistryRegister,
@@ -4345,89 +4173,88 @@ void Genesis::InitializeGlobal_harmony_weak_refs() {
                           "unregister",
                           Builtins::kFinalizationRegistryUnregister, 1, false);
 
-    SimpleInstallFunction(isolate(), finalization_registry_prototype,
-                          "cleanupSome",
-                          Builtins::kFinalizationRegistryCleanupSome, 0, false);
+    // The cleanupSome function is created but not exposed, as it is used
+    // internally by InvokeFinalizationRegistryCleanupFromTask.
+    //
+    // It is exposed by FLAG_harmony_weak_refs_with_cleanup_some.
+    Handle<JSFunction> cleanup_some_fun = SimpleCreateFunction(
+        isolate(), factory->InternalizeUtf8String("cleanupSome"),
+        Builtins::kFinalizationRegistryPrototypeCleanupSome, 0, false);
+    native_context()->set_finalization_registry_cleanup_some(*cleanup_some_fun);
   }
   {
-    // Create %WeakRefPrototype%
-    Handle<Map> weak_ref_map =
-        factory->NewMap(JS_WEAK_REF_TYPE, JSWeakRef::kHeaderSize);
-    DCHECK(weak_ref_map->IsJSObjectMap());
-
-    Handle<JSObject> weak_ref_prototype = factory->NewJSObject(
-        isolate()->object_function(), AllocationType::kOld);
-    Map::SetPrototype(isolate(), weak_ref_map, weak_ref_prototype);
-
-    InstallToStringTag(isolate(), weak_ref_prototype,
-                       factory->WeakRef_string());
-
-    SimpleInstallFunction(isolate(), weak_ref_prototype, "deref",
-                          Builtins::kWeakRefDeref, 0, false);
-
     // Create %WeakRef%
-    Handle<String> weak_ref_name = factory->InternalizeUtf8String("WeakRef");
-    Handle<JSFunction> weak_ref_fun = CreateFunction(
-        isolate(), weak_ref_name, JS_WEAK_REF_TYPE, JSWeakRef::kHeaderSize, 0,
-        weak_ref_prototype, Builtins::kWeakRefConstructor);
+    Handle<JSFunction> weak_ref_fun = InstallFunction(
+        isolate(), global, factory->WeakRef_string(), JS_WEAK_REF_TYPE,
+        JSWeakRef::kHeaderSize, 0, factory->the_hole_value(),
+        Builtins::kWeakRefConstructor);
     InstallWithIntrinsicDefaultProto(isolate(), weak_ref_fun,
                                      Context::JS_WEAK_REF_FUNCTION_INDEX);
 
     weak_ref_fun->shared().DontAdaptArguments();
     weak_ref_fun->shared().set_length(1);
 
-    // Install the "constructor" property on the prototype.
-    JSObject::AddProperty(isolate(), weak_ref_prototype,
-                          factory->constructor_string(), weak_ref_fun,
-                          DONT_ENUM);
+    Handle<JSObject> weak_ref_prototype(
+        JSObject::cast(weak_ref_fun->instance_prototype()), isolate());
 
-    JSObject::AddProperty(isolate(), global, weak_ref_name, weak_ref_fun,
-                          DONT_ENUM);
+    InstallToStringTag(isolate(), weak_ref_prototype,
+                       factory->WeakRef_string());
+
+    SimpleInstallFunction(isolate(), weak_ref_prototype, "deref",
+                          Builtins::kWeakRefDeref, 0, false);
   }
+}
 
-  {
-    // Create cleanup iterator for JSFinalizationRegistry.
-    Handle<JSObject> iterator_prototype(
-        native_context()->initial_iterator_prototype(), isolate());
+void Genesis::InitializeGlobal_harmony_weak_refs_with_cleanup_some() {
+  if (!FLAG_harmony_weak_refs_with_cleanup_some) return;
+  DCHECK(FLAG_harmony_weak_refs);
 
-    Handle<JSObject> cleanup_iterator_prototype = factory->NewJSObject(
-        isolate()->object_function(), AllocationType::kOld);
-    JSObject::ForceSetPrototype(cleanup_iterator_prototype, iterator_prototype);
+  Handle<JSFunction> finalization_registry_fun =
+      isolate()->js_finalization_registry_fun();
+  Handle<JSObject> finalization_registry_prototype(
+      JSObject::cast(finalization_registry_fun->instance_prototype()),
+      isolate());
 
-    InstallToStringTag(isolate(), cleanup_iterator_prototype,
-                       "FinalizationRegistry Cleanup Iterator");
+  JSObject::AddProperty(isolate(), finalization_registry_prototype,
+                        factory()->InternalizeUtf8String("cleanupSome"),
+                        isolate()->finalization_registry_cleanup_some(),
+                        DONT_ENUM);
+}
 
-    SimpleInstallFunction(isolate(), cleanup_iterator_prototype, "next",
-                          Builtins::kFinalizationRegistryCleanupIteratorNext, 0,
-                          true);
-    Handle<Map> cleanup_iterator_map =
-        factory->NewMap(JS_FINALIZATION_REGISTRY_CLEANUP_ITERATOR_TYPE,
-                        JSFinalizationRegistryCleanupIterator::kHeaderSize);
-    Map::SetPrototype(isolate(), cleanup_iterator_map,
-                      cleanup_iterator_prototype);
-    native_context()->set_js_finalization_registry_cleanup_iterator_map(
-        *cleanup_iterator_map);
+void Genesis::InitializeGlobal_harmony_promise_any() {
+  if (!FLAG_harmony_promise_any) {
+    return;
   }
+
+  Factory* factory = isolate()->factory();
+  Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
+
+  InstallError(isolate_, global, factory->AggregateError_string(),
+               Context::AGGREGATE_ERROR_FUNCTION_INDEX,
+               Builtins::kAggregateErrorConstructor, 2, 2);
+
+  // Setup %AggregateErrorPrototype%.
+  Handle<JSFunction> aggregate_error_function(
+      native_context()->aggregate_error_function(), isolate());
+  Handle<JSObject> prototype(
+      JSObject::cast(aggregate_error_function->instance_prototype()),
+      isolate());
+
+  Handle<JSFunction> promise_fun(
+      JSFunction::cast(
+          isolate()->native_context()->get(Context::PROMISE_FUNCTION_INDEX)),
+      isolate());
+  Handle<JSFunction> promise_any = InstallFunctionWithBuiltinId(
+      isolate_, promise_fun, "any", Builtins::kPromiseAny, 1, true);
+  native_context()->set_promise_any(*promise_any);
+
+  DCHECK(promise_fun->HasFastProperties());
 }
 
 void Genesis::InitializeGlobal_harmony_promise_all_settled() {
   if (!FLAG_harmony_promise_all_settled) return;
   SimpleInstallFunction(isolate(), isolate()->promise_function(), "allSettled",
                         Builtins::kPromiseAllSettled, 1, true);
-  Factory* factory = isolate()->factory();
-  {
-    Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-        isolate_, Builtins::kPromiseAllSettledResolveElementClosure,
-        factory->empty_string(), 1);
-    native_context()->set_promise_all_settled_resolve_element_shared_fun(*info);
-  }
-
-  {
-    Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-        isolate_, Builtins::kPromiseAllSettledRejectElementClosure,
-        factory->empty_string(), 1);
-    native_context()->set_promise_all_settled_reject_element_shared_fun(*info);
-  }
 }
 
 void Genesis::InitializeGlobal_harmony_regexp_match_indices() {
@@ -4535,43 +4362,6 @@ void Genesis::InitializeGlobal_harmony_intl_segmenter() {
   }
 }
 
-void Genesis::InitializeGlobal_harmony_intl_displaynames() {
-  if (!FLAG_harmony_intl_displaynames) return;
-  Handle<JSObject> intl = Handle<JSObject>::cast(
-      JSReceiver::GetProperty(
-          isolate(),
-          Handle<JSReceiver>(native_context()->global_object(), isolate()),
-          factory()->InternalizeUtf8String("Intl"))
-          .ToHandleChecked());
-
-  Handle<JSFunction> display_names_fun = InstallFunction(
-      isolate(), intl, "DisplayNames", JS_DISPLAY_NAMES_TYPE,
-      JSDisplayNames::kHeaderSize, 0, factory()->the_hole_value(),
-      Builtins::kDisplayNamesConstructor);
-  display_names_fun->shared().set_length(0);
-  display_names_fun->shared().DontAdaptArguments();
-  InstallWithIntrinsicDefaultProto(isolate_, display_names_fun,
-                                   Context::INTL_DISPLAY_NAMES_FUNCTION_INDEX);
-
-  SimpleInstallFunction(isolate(), display_names_fun, "supportedLocalesOf",
-                        Builtins::kDisplayNamesSupportedLocalesOf, 1, false);
-
-  {
-    // Setup %DisplayNamesPrototype%.
-    Handle<JSObject> prototype(
-        JSObject::cast(display_names_fun->instance_prototype()), isolate());
-
-    InstallToStringTag(isolate(), prototype, "Intl.DisplayNames");
-
-    SimpleInstallFunction(isolate(), prototype, "resolvedOptions",
-                          Builtins::kDisplayNamesPrototypeResolvedOptions, 0,
-                          false);
-
-    SimpleInstallFunction(isolate(), prototype, "of",
-                          Builtins::kDisplayNamesPrototypeOf, 1, false);
-  }
-}
-
 #endif  // V8_INTL_SUPPORT
 
 Handle<JSFunction> Genesis::CreateArrayBuffer(
@@ -5152,22 +4942,6 @@ bool Genesis::ConfigureGlobalObjects(
   native_context()->set_array_buffer_map(
       native_context()->array_buffer_fun().initial_map());
 
-  Handle<JSFunction> js_map_fun(native_context()->js_map_fun(), isolate());
-  Handle<JSFunction> js_set_fun(native_context()->js_set_fun(), isolate());
-  // Force the Map/Set constructor to fast properties, so that we can use the
-  // fast paths for various things like
-  //
-  //   x instanceof Map
-  //   x instanceof Set
-  //
-  // etc. We should probably come up with a more principled approach once
-  // the JavaScript builtins are gone.
-  JSObject::MigrateSlowToFast(js_map_fun, 0, "Bootstrapping");
-  JSObject::MigrateSlowToFast(js_set_fun, 0, "Bootstrapping");
-
-  native_context()->set_js_map_map(js_map_fun->initial_map());
-  native_context()->set_js_set_map(js_set_fun->initial_map());
-
   return true;
 }
 
@@ -5451,8 +5225,8 @@ Genesis::Genesis(
   }
 
   native_context()->set_microtask_queue(
-      microtask_queue ? static_cast<MicrotaskQueue*>(microtask_queue)
-                      : isolate->default_microtask_queue());
+      isolate, microtask_queue ? static_cast<MicrotaskQueue*>(microtask_queue)
+                               : isolate->default_microtask_queue());
 
   // Install experimental natives. Do not include them into the
   // snapshot as we should be able to turn them off at runtime. Re-installing
diff --git a/deps/v8/src/init/bootstrapper.h b/deps/v8/src/init/bootstrapper.h
index aaa19972705..e51ef0cd105 100644
--- a/deps/v8/src/init/bootstrapper.h
+++ b/deps/v8/src/init/bootstrapper.h
@@ -55,6 +55,20 @@ class Bootstrapper final {
       v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer,
       v8::MicrotaskQueue* microtask_queue);
 
+  // Used for testing context deserialization. No code runs in the generated
+  // context. It only needs to pass heap verification.
+  Handle<Context> CreateEnvironmentForTesting() {
+    MaybeHandle<JSGlobalProxy> no_global_proxy;
+    v8::Local<v8::ObjectTemplate> no_global_object_template;
+    ExtensionConfiguration no_extensions;
+    static constexpr int kDefaultContextIndex = 0;
+    v8::DeserializeEmbedderFieldsCallback no_callback;
+    v8::MicrotaskQueue* no_microtask_queue = nullptr;
+    return CreateEnvironment(no_global_proxy, no_global_object_template,
+                             &no_extensions, kDefaultContextIndex, no_callback,
+                             no_microtask_queue);
+  }
+
   Handle<JSGlobalProxy> NewRemoteContext(
       MaybeHandle<JSGlobalProxy> maybe_global_proxy,
       v8::Local<v8::ObjectTemplate> global_object_template);
diff --git a/deps/v8/src/init/heap-symbols.h b/deps/v8/src/init/heap-symbols.h
index d56cc4b0cd7..6048f5e2e96 100644
--- a/deps/v8/src/init/heap-symbols.h
+++ b/deps/v8/src/init/heap-symbols.h
@@ -118,6 +118,7 @@
 #define INTERNALIZED_STRING_LIST_GENERATOR(V, _)                     \
   INTERNALIZED_STRING_LIST_GENERATOR_INTL(V, _)                      \
   V(_, add_string, "add")                                            \
+  V(_, AggregateError_string, "AggregateError")                      \
   V(_, always_string, "always")                                      \
   V(_, anonymous_function_string, "(anonymous function)")            \
   V(_, anonymous_string, "anonymous")                                \
@@ -179,11 +180,13 @@
   V(_, enumerable_string, "enumerable")                              \
   V(_, element_string, "element")                                    \
   V(_, Error_string, "Error")                                        \
+  V(_, errors_string, "errors")                                      \
   V(_, error_to_string, "[object Error]")                            \
   V(_, eval_string, "eval")                                          \
   V(_, EvalError_string, "EvalError")                                \
   V(_, exec_string, "exec")                                          \
   V(_, false_string, "false")                                        \
+  V(_, FinalizationRegistry_string, "FinalizationRegistry")          \
   V(_, flags_string, "flags")                                        \
   V(_, Float32Array_string, "Float32Array")                          \
   V(_, Float64Array_string, "Float64Array")                          \
@@ -240,7 +243,7 @@
   V(_, NFD_string, "NFD")                                            \
   V(_, NFKC_string, "NFKC")                                          \
   V(_, NFKD_string, "NFKD")                                          \
-  V(_, not_equal, "not-equal")                                       \
+  V(_, not_equal_string, "not-equal")                                \
   V(_, null_string, "null")                                          \
   V(_, null_to_string, "[object Null]")                              \
   V(_, Number_string, "Number")                                      \
@@ -250,7 +253,7 @@
   V(_, object_string, "object")                                      \
   V(_, object_to_string, "[object Object]")                          \
   V(_, of_string, "of")                                              \
-  V(_, ok, "ok")                                                     \
+  V(_, ok_string, "ok")                                              \
   V(_, one_string, "1")                                              \
   V(_, other_string, "other")                                        \
   V(_, ownKeys_string, "ownKeys")                                    \
@@ -302,7 +305,7 @@
   V(_, this_function_string, ".this_function")                       \
   V(_, this_string, "this")                                          \
   V(_, throw_string, "throw")                                        \
-  V(_, timed_out, "timed-out")                                       \
+  V(_, timed_out_string, "timed-out")                                \
   V(_, toJSON_string, "toJSON")                                      \
   V(_, toString_string, "toString")                                  \
   V(_, true_string, "true")                                          \
@@ -492,6 +495,7 @@
   F(SCAVENGER_SCAVENGE_WEAK_GLOBAL_HANDLES_PROCESS)  \
   F(SCAVENGER_SCAVENGE_PARALLEL)                     \
   F(SCAVENGER_SCAVENGE_ROOTS)                        \
+  F(SCAVENGER_SCAVENGE_STACK_ROOTS)                  \
   F(SCAVENGER_SCAVENGE_UPDATE_REFS)                  \
   F(SCAVENGER_SCAVENGE_WEAK)                         \
   F(SCAVENGER_SCAVENGE_FINALIZE)                     \
diff --git a/deps/v8/src/init/v8.cc b/deps/v8/src/init/v8.cc
index edcc399f95c..52676447372 100644
--- a/deps/v8/src/init/v8.cc
+++ b/deps/v8/src/init/v8.cc
@@ -106,6 +106,9 @@ void V8::InitializeOncePerProcessImpl() {
 
   if (FLAG_random_seed) SetRandomMmapSeed(FLAG_random_seed);
 
+#if defined(V8_USE_PERFETTO)
+  TrackEvent::Register();
+#endif
   Isolate::InitializeOncePerProcess();
 
 #if defined(USE_SIMULATOR)
diff --git a/deps/v8/src/inspector/BUILD.gn b/deps/v8/src/inspector/BUILD.gn
index a326ab0127c..acb1e961a86 100644
--- a/deps/v8/src/inspector/BUILD.gn
+++ b/deps/v8/src/inspector/BUILD.gn
@@ -31,13 +31,9 @@ _protocol_generated = [
 action("protocol_compatibility") {
   visibility = [ ":*" ]  # Only targets in this file can depend on this.
   script = "$_inspector_protocol/check_protocol_compatibility.py"
-  inputs = [
-    v8_inspector_js_protocol,
-  ]
+  inputs = [ v8_inspector_js_protocol ]
   _stamp = "$target_gen_dir/js_protocol.stamp"
-  outputs = [
-    _stamp,
-  ]
+  outputs = [ _stamp ]
   args = [
     "--stamp",
     rebase_path(_stamp, root_build_dir),
@@ -47,9 +43,7 @@ action("protocol_compatibility") {
 
 inspector_protocol_generate("protocol_generated_sources") {
   visibility = [ ":*" ]  # Only targets in this file can depend on this.
-  deps = [
-    ":protocol_compatibility",
-  ]
+  deps = [ ":protocol_compatibility" ]
 
   inspector_protocol_dir = _inspector_protocol
   out_dir = target_gen_dir
@@ -71,13 +65,9 @@ config("inspector_config") {
 v8_header_set("inspector_test_headers") {
   configs = [ ":inspector_config" ]
 
-  public_deps = [
-    "../..:v8_headers",
-  ]
+  public_deps = [ "../..:v8_headers" ]
 
-  sources = [
-    "test-interface.h",
-  ]
+  sources = [ "test-interface.h" ]
 }
 
 v8_source_set("inspector_string_conversions") {
@@ -86,14 +76,13 @@ v8_source_set("inspector_string_conversions") {
     "v8-string-conversions.h",
   ]
   configs = [ "../..:internal_config_base" ]
-  deps = [
-    "../..:v8_libbase",
-  ]
+  deps = [ "../..:v8_libbase" ]
 }
 
 v8_source_set("inspector") {
   deps = [
     ":inspector_string_conversions",
+    "../..:v8_tracing",
     "../..:v8_version",
     "../../third_party/inspector_protocol:crdtp",
   ]
@@ -166,7 +155,5 @@ v8_source_set("inspector") {
 group("v8_generated_cc_files") {
   testonly = true
 
-  deps = [
-    ":protocol_generated_sources",
-  ]
+  deps = [ ":protocol_generated_sources" ]
 }
diff --git a/deps/v8/src/inspector/search-util.cc b/deps/v8/src/inspector/search-util.cc
index d2550ad9e43..ec800007dde 100644
--- a/deps/v8/src/inspector/search-util.cc
+++ b/deps/v8/src/inspector/search-util.cc
@@ -36,7 +36,8 @@ String16 findMagicComment(const String16& content, const String16& name,
     if (content[pos + 2] != '#' && content[pos + 2] != '@') continue;
     if (content[pos + 3] != ' ' && content[pos + 3] != '\t') continue;
     equalSignPos = pos + 4 + nameLength;
-    if (equalSignPos < length && content[equalSignPos] != '=') continue;
+    if (equalSignPos >= length) continue;
+    if (content[equalSignPos] != '=') continue;
     if (multiline) {
       closingCommentPos = content.find("*/", equalSignPos + 1);
       if (closingCommentPos == String16::kNotFound) return String16();
@@ -46,6 +47,7 @@ String16 findMagicComment(const String16& content, const String16& name,
   }
 
   DCHECK(equalSignPos);
+  DCHECK_LT(equalSignPos, length);
   DCHECK(!multiline || closingCommentPos);
   size_t urlPos = equalSignPos + 1;
   String16 match = multiline
diff --git a/deps/v8/src/inspector/string-16.h b/deps/v8/src/inspector/string-16.h
index b4cbd016a6c..76c68498b2c 100644
--- a/deps/v8/src/inspector/string-16.h
+++ b/deps/v8/src/inspector/string-16.h
@@ -28,7 +28,7 @@ class String16 {
   String16(String16&&) V8_NOEXCEPT = default;
   String16(const UChar* characters, size_t size);
   V8_EXPORT String16(const UChar* characters);  // NOLINT(runtime/explicit)
-  String16(const char* characters);   // NOLINT(runtime/explicit)
+  V8_EXPORT String16(const char* characters);   // NOLINT(runtime/explicit)
   String16(const char* characters, size_t size);
   explicit String16(const std::basic_string<UChar>& impl);
   explicit String16(std::basic_string<UChar>&& impl);
diff --git a/deps/v8/src/inspector/string-util.cc b/deps/v8/src/inspector/string-util.cc
index 3f779e86e13..b1c0d6411a7 100644
--- a/deps/v8/src/inspector/string-util.cc
+++ b/deps/v8/src/inspector/string-util.cc
@@ -6,6 +6,7 @@
 
 #include <cinttypes>
 #include <cmath>
+#include <cstddef>
 
 #include "src/base/platform/platform.h"
 #include "src/inspector/protocol/Protocol.h"
@@ -13,6 +14,91 @@
 
 namespace v8_inspector {
 
+namespace protocol {
+namespace {
+std::pair<uint8_t, uint8_t> SplitByte(uint8_t byte, uint8_t split) {
+  return {byte >> split, (byte & ((1 << split) - 1)) << (6 - split)};
+}
+
+v8::Maybe<uint8_t> DecodeByte(char byte) {
+  if ('A' <= byte && byte <= 'Z') return v8::Just<uint8_t>(byte - 'A');
+  if ('a' <= byte && byte <= 'z') return v8::Just<uint8_t>(byte - 'a' + 26);
+  if ('0' <= byte && byte <= '9')
+    return v8::Just<uint8_t>(byte - '0' + 26 + 26);
+  if (byte == '+') return v8::Just<uint8_t>(62);
+  if (byte == '/') return v8::Just<uint8_t>(63);
+  return v8::Nothing<uint8_t>();
+}
+}  // namespace
+
+String Binary::toBase64() const {
+  const char* table =
+      "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+  if (size() == 0) return {};
+  std::basic_string<UChar> result;
+  result.reserve(4 * ((size() + 2) / 3));
+  uint8_t last = 0;
+  for (size_t n = 0; n < size();) {
+    auto split = SplitByte((*bytes_)[n], 2 + 2 * (n % 3));
+    result.push_back(table[split.first | last]);
+
+    ++n;
+    if (n < size() && n % 3 == 0) {
+      result.push_back(table[split.second]);
+      last = 0;
+    } else {
+      last = split.second;
+    }
+  }
+  result.push_back(table[last]);
+  while (result.size() % 4 > 0) result.push_back('=');
+  return String16(std::move(result));
+}
+
+/* static */
+Binary Binary::fromBase64(const String& base64, bool* success) {
+  if (base64.isEmpty()) {
+    *success = true;
+    return Binary::fromSpan(nullptr, 0);
+  }
+
+  *success = false;
+  // Fail if the length is invalid or decoding would overflow.
+  if (base64.length() % 4 != 0 || base64.length() + 4 < base64.length()) {
+    return Binary::fromSpan(nullptr, 0);
+  }
+
+  std::vector<uint8_t> result;
+  result.reserve(3 * base64.length() / 4);
+  char pad = '=';
+  // Iterate groups of four
+  for (size_t i = 0; i < base64.length(); i += 4) {
+    uint8_t a = 0, b = 0, c = 0, d = 0;
+    if (!DecodeByte(base64[i + 0]).To(&a)) return Binary::fromSpan(nullptr, 0);
+    if (!DecodeByte(base64[i + 1]).To(&b)) return Binary::fromSpan(nullptr, 0);
+    if (!DecodeByte(base64[i + 2]).To(&c)) {
+      // Padding is allowed only in the group on the last two positions
+      if (i + 4 < base64.length() || base64[i + 2] != pad ||
+          base64[i + 3] != pad) {
+        return Binary::fromSpan(nullptr, 0);
+      }
+    }
+    if (!DecodeByte(base64[i + 3]).To(&d)) {
+      // Padding is allowed only in the group on the last two positions
+      if (i + 4 < base64.length() || base64[i + 3] != pad) {
+        return Binary::fromSpan(nullptr, 0);
+      }
+    }
+
+    result.push_back((a << 2) | (b >> 4));
+    if (base64[i + 2] != '=') result.push_back((0xFF & (b << 4)) | (c >> 2));
+    if (base64[i + 3] != '=') result.push_back((0xFF & (c << 6)) | d);
+  }
+  *success = true;
+  return Binary(std::make_shared<std::vector<uint8_t>>(std::move(result)));
+}
+}  // namespace protocol
+
 v8::Local<v8::String> toV8String(v8::Isolate* isolate, const String16& string) {
   if (string.isEmpty()) return v8::String::Empty(isolate);
   DCHECK_GT(v8::String::kMaxLength, string.length());
diff --git a/deps/v8/src/inspector/string-util.h b/deps/v8/src/inspector/string-util.h
index 50d3614e54a..1b5f9e34abd 100644
--- a/deps/v8/src/inspector/string-util.h
+++ b/deps/v8/src/inspector/string-util.h
@@ -41,19 +41,14 @@ class StringUtil {
 };
 
 // A read-only sequence of uninterpreted bytes with reference-counted storage.
-// Though the templates for generating the protocol bindings reference
-// this type, js_protocol.pdl doesn't have a field of type 'binary', so
-// therefore it's unnecessary to provide an implementation here.
-class Binary {
+class V8_EXPORT Binary {
  public:
   Binary() = default;
 
   const uint8_t* data() const { return bytes_->data(); }
   size_t size() const { return bytes_->size(); }
-  String toBase64() const { UNIMPLEMENTED(); }
-  static Binary fromBase64(const String& base64, bool* success) {
-    UNIMPLEMENTED();
-  }
+  String toBase64() const;
+  static Binary fromBase64(const String& base64, bool* success);
   static Binary fromSpan(const uint8_t* data, size_t size) {
     return Binary(std::make_shared<std::vector<uint8_t>>(data, data + size));
   }
diff --git a/deps/v8/src/inspector/v8-console.cc b/deps/v8/src/inspector/v8-console.cc
index ec7709f8c69..6dda6ef90c3 100644
--- a/deps/v8/src/inspector/v8-console.cc
+++ b/deps/v8/src/inspector/v8-console.cc
@@ -411,7 +411,7 @@ static void timeEndFunction(const v8::debug::ConsoleCallArguments& info,
         helper.consoleMessageStorage()->timeEnd(helper.contextId(), title);
   }
   String16 message =
-      protocolTitle + ": " + String16::fromDouble(elapsed) + "ms";
+      protocolTitle + ": " + String16::fromDouble(elapsed) + " ms";
   if (timeLog)
     helper.reportCallAndReplaceFirstArgument(ConsoleAPIType::kLog, message);
   else
@@ -783,15 +783,11 @@ static bool isCommandLineAPIGetter(const String16& name) {
 
 void V8Console::CommandLineAPIScope::accessorGetterCallback(
     v8::Local<v8::Name> name, const v8::PropertyCallbackInfo<v8::Value>& info) {
-  CommandLineAPIScope* scope = static_cast<CommandLineAPIScope*>(
-      info.Data().As<v8::External>()->Value());
-  DCHECK(scope);
-
+  CommandLineAPIScope* scope = *static_cast<CommandLineAPIScope**>(
+      info.Data().As<v8::ArrayBuffer>()->GetBackingStore()->Data());
   v8::Local<v8::Context> context = info.GetIsolate()->GetCurrentContext();
-  if (scope->m_cleanup) {
-    bool removed = info.Holder()->Delete(context, name).FromMaybe(false);
-    DCHECK(removed);
-    USE(removed);
+  if (scope == nullptr) {
+    USE(info.Holder()->Delete(context, name).FromMaybe(false));
     return;
   }
   v8::Local<v8::Object> commandLineAPI = scope->m_commandLineAPI;
@@ -815,16 +811,14 @@ void V8Console::CommandLineAPIScope::accessorGetterCallback(
 void V8Console::CommandLineAPIScope::accessorSetterCallback(
     v8::Local<v8::Name> name, v8::Local<v8::Value> value,
     const v8::PropertyCallbackInfo<void>& info) {
-  CommandLineAPIScope* scope = static_cast<CommandLineAPIScope*>(
-      info.Data().As<v8::External>()->Value());
+  CommandLineAPIScope* scope = *static_cast<CommandLineAPIScope**>(
+      info.Data().As<v8::ArrayBuffer>()->GetBackingStore()->Data());
+  if (scope == nullptr) return;
   v8::Local<v8::Context> context = info.GetIsolate()->GetCurrentContext();
   if (!info.Holder()->Delete(context, name).FromMaybe(false)) return;
   if (!info.Holder()->CreateDataProperty(context, name, value).FromMaybe(false))
     return;
-  bool removed =
-      scope->m_installedMethods->Delete(context, name).FromMaybe(false);
-  DCHECK(removed);
-  USE(removed);
+  USE(scope->m_installedMethods->Delete(context, name).FromMaybe(false));
 }
 
 V8Console::CommandLineAPIScope::CommandLineAPIScope(
@@ -833,14 +827,15 @@ V8Console::CommandLineAPIScope::CommandLineAPIScope(
     : m_context(context),
       m_commandLineAPI(commandLineAPI),
       m_global(global),
-      m_installedMethods(v8::Set::New(context->GetIsolate())),
-      m_cleanup(false) {
+      m_installedMethods(v8::Set::New(context->GetIsolate())) {
   v8::MicrotasksScope microtasksScope(context->GetIsolate(),
                                       v8::MicrotasksScope::kDoNotRunMicrotasks);
   v8::Local<v8::Array> names;
   if (!m_commandLineAPI->GetOwnPropertyNames(context).ToLocal(&names)) return;
-  v8::Local<v8::External> externalThis =
-      v8::External::New(context->GetIsolate(), this);
+  m_thisReference =
+      v8::ArrayBuffer::New(context->GetIsolate(), sizeof(CommandLineAPIScope*));
+  *static_cast<CommandLineAPIScope**>(
+      m_thisReference->GetBackingStore()->Data()) = this;
   for (uint32_t i = 0; i < names->Length(); ++i) {
     v8::Local<v8::Value> name;
     if (!names->Get(context, i).ToLocal(&name) || !name->IsName()) continue;
@@ -851,7 +846,7 @@ V8Console::CommandLineAPIScope::CommandLineAPIScope(
              ->SetAccessor(context, v8::Local<v8::Name>::Cast(name),
                            CommandLineAPIScope::accessorGetterCallback,
                            CommandLineAPIScope::accessorSetterCallback,
-                           externalThis, v8::DEFAULT, v8::DontEnum,
+                           m_thisReference, v8::DEFAULT, v8::DontEnum,
                            v8::SideEffectType::kHasNoSideEffect)
              .FromMaybe(false)) {
       bool removed = m_installedMethods->Delete(context, name).FromMaybe(false);
@@ -865,7 +860,8 @@ V8Console::CommandLineAPIScope::CommandLineAPIScope(
 V8Console::CommandLineAPIScope::~CommandLineAPIScope() {
   v8::MicrotasksScope microtasksScope(m_context->GetIsolate(),
                                       v8::MicrotasksScope::kDoNotRunMicrotasks);
-  m_cleanup = true;
+  *static_cast<CommandLineAPIScope**>(
+      m_thisReference->GetBackingStore()->Data()) = nullptr;
   v8::Local<v8::Array> names = m_installedMethods->AsArray();
   for (uint32_t i = 0; i < names->Length(); ++i) {
     v8::Local<v8::Value> name;
diff --git a/deps/v8/src/inspector/v8-console.h b/deps/v8/src/inspector/v8-console.h
index 4d38c51a2a2..5875164595f 100644
--- a/deps/v8/src/inspector/v8-console.h
+++ b/deps/v8/src/inspector/v8-console.h
@@ -42,7 +42,7 @@ class V8Console : public v8::debug::ConsoleDelegate {
     v8::Local<v8::Object> m_commandLineAPI;
     v8::Local<v8::Object> m_global;
     v8::Local<v8::Set> m_installedMethods;
-    bool m_cleanup;
+    v8::Local<v8::ArrayBuffer> m_thisReference;
 
     DISALLOW_COPY_AND_ASSIGN(CommandLineAPIScope);
   };
diff --git a/deps/v8/src/inspector/v8-debugger-agent-impl.cc b/deps/v8/src/inspector/v8-debugger-agent-impl.cc
index 2e5c8cd417b..31fc7a64fab 100644
--- a/deps/v8/src/inspector/v8-debugger-agent-impl.cc
+++ b/deps/v8/src/inspector/v8-debugger-agent-impl.cc
@@ -7,6 +7,7 @@
 #include <algorithm>
 
 #include "../../third_party/inspector_protocol/crdtp/json.h"
+#include "include/v8-inspector.h"
 #include "src/base/safe_conversions.h"
 #include "src/debug/debug-interface.h"
 #include "src/inspector/injected-script.h"
@@ -25,8 +26,6 @@
 #include "src/inspector/v8-stack-trace-impl.h"
 #include "src/inspector/v8-value-utils.h"
 
-#include "include/v8-inspector.h"
-
 namespace v8_inspector {
 
 using protocol::Array;
@@ -1150,6 +1149,55 @@ Response V8DebuggerAgentImpl::evaluateOnCallFrame(
       result, exceptionDetails);
 }
 
+Response V8DebuggerAgentImpl::executeWasmEvaluator(
+    const String16& callFrameId, const protocol::Binary& evaluator,
+    Maybe<double> timeout,
+    std::unique_ptr<protocol::Runtime::RemoteObject>* result,
+    Maybe<protocol::Runtime::ExceptionDetails>* exceptionDetails) {
+  if (!v8::debug::StackTraceIterator::SupportsWasmDebugEvaluate()) {
+    return Response::ServerError(
+        "--wasm-expose-debug-eval is required to execte evaluator modules");
+  }
+  if (!isPaused()) return Response::ServerError(kDebuggerNotPaused);
+  InjectedScript::CallFrameScope scope(m_session, callFrameId);
+  Response response = scope.initialize();
+  if (!response.IsSuccess()) return response;
+
+  int frameOrdinal = static_cast<int>(scope.frameOrdinal());
+  std::unique_ptr<v8::debug::StackTraceIterator> it =
+      v8::debug::StackTraceIterator::Create(m_isolate, frameOrdinal);
+  if (it->Done()) {
+    return Response::ServerError("Could not find call frame with given id");
+  }
+  if (!it->GetScript()->IsWasm()) {
+    return Response::ServerError(
+        "executeWasmEvaluator can only be called on WebAssembly frames");
+  }
+
+  v8::MaybeLocal<v8::Value> maybeResultValue;
+  {
+    V8InspectorImpl::EvaluateScope evaluateScope(scope);
+    if (timeout.isJust()) {
+      response = evaluateScope.setTimeout(timeout.fromJust() / 1000.0);
+      if (!response.IsSuccess()) return response;
+    }
+    v8::MaybeLocal<v8::String> eval_result =
+        it->EvaluateWasm({evaluator.data(), evaluator.size()}, frameOrdinal);
+    if (!eval_result.IsEmpty()) maybeResultValue = eval_result.ToLocalChecked();
+  }
+
+  // Re-initialize after running client's code, as it could have destroyed
+  // context or session.
+  response = scope.initialize();
+  if (!response.IsSuccess()) return response;
+
+  String16 object_group = "";
+  InjectedScript* injected_script = scope.injectedScript();
+  return injected_script->wrapEvaluateResult(maybeResultValue, scope.tryCatch(),
+                                             object_group, WrapMode::kNoPreview,
+                                             result, exceptionDetails);
+}
+
 Response V8DebuggerAgentImpl::setVariableValue(
     int scopeNumber, const String16& variableName,
     std::unique_ptr<protocol::Runtime::CallArgument> newValueArgument,
@@ -1423,6 +1471,39 @@ static String16 getScriptLanguage(const V8DebuggerScript& script) {
   }
 }
 
+static const char* getDebugSymbolTypeName(
+    v8::debug::WasmScript::DebugSymbolsType type) {
+  switch (type) {
+    case v8::debug::WasmScript::DebugSymbolsType::None:
+      return v8_inspector::protocol::Debugger::DebugSymbols::TypeEnum::None;
+    case v8::debug::WasmScript::DebugSymbolsType::SourceMap:
+      return v8_inspector::protocol::Debugger::DebugSymbols::TypeEnum::
+          SourceMap;
+    case v8::debug::WasmScript::DebugSymbolsType::EmbeddedDWARF:
+      return v8_inspector::protocol::Debugger::DebugSymbols::TypeEnum::
+          EmbeddedDWARF;
+    case v8::debug::WasmScript::DebugSymbolsType::ExternalDWARF:
+      return v8_inspector::protocol::Debugger::DebugSymbols::TypeEnum::
+          ExternalDWARF;
+  }
+}
+
+static std::unique_ptr<protocol::Debugger::DebugSymbols> getDebugSymbols(
+    const V8DebuggerScript& script) {
+  v8::debug::WasmScript::DebugSymbolsType type;
+  if (!script.getDebugSymbolsType().To(&type)) return {};
+
+  std::unique_ptr<protocol::Debugger::DebugSymbols> debugSymbols =
+      v8_inspector::protocol::Debugger::DebugSymbols::create()
+          .setType(getDebugSymbolTypeName(type))
+          .build();
+  String16 externalUrl;
+  if (script.getExternalDebugSymbolsURL().To(&externalUrl)) {
+    debugSymbols->setExternalURL(externalUrl);
+  }
+  return debugSymbols;
+}
+
 void V8DebuggerAgentImpl::didParseSource(
     std::unique_ptr<V8DebuggerScript> script, bool success) {
   v8::HandleScope handles(m_isolate);
@@ -1458,6 +1539,8 @@ void V8DebuggerAgentImpl::didParseSource(
       script->getLanguage() == V8DebuggerScript::Language::JavaScript
           ? Maybe<int>()
           : script->codeOffset();
+  std::unique_ptr<protocol::Debugger::DebugSymbols> debugSymbols =
+      getDebugSymbols(*script);
 
   m_scripts[scriptId] = std::move(script);
   // Release the strong reference to get notified when debugger is the only
@@ -1498,15 +1581,13 @@ void V8DebuggerAgentImpl::didParseSource(
     return;
   }
 
-  // TODO(herhut, dgozman): Report correct length for Wasm if needed for
-  // coverage. Or do not send the length at all and change coverage instead.
   if (scriptRef->isSourceLoadedLazily()) {
     m_frontend.scriptParsed(
         scriptId, scriptURL, 0, 0, 0, 0, contextId, scriptRef->hash(),
         std::move(executionContextAuxDataParam), isLiveEditParam,
         std::move(sourceMapURLParam), hasSourceURLParam, isModuleParam, 0,
-        std::move(stackTrace), std::move(codeOffset),
-        std::move(scriptLanguage));
+        std::move(stackTrace), std::move(codeOffset), std::move(scriptLanguage),
+        std::move(debugSymbols));
   } else {
     m_frontend.scriptParsed(
         scriptId, scriptURL, scriptRef->startLine(), scriptRef->startColumn(),
@@ -1514,7 +1595,8 @@ void V8DebuggerAgentImpl::didParseSource(
         scriptRef->hash(), std::move(executionContextAuxDataParam),
         isLiveEditParam, std::move(sourceMapURLParam), hasSourceURLParam,
         isModuleParam, scriptRef->length(), std::move(stackTrace),
-        std::move(codeOffset), std::move(scriptLanguage));
+        std::move(codeOffset), std::move(scriptLanguage),
+        std::move(debugSymbols));
   }
 
   std::vector<protocol::DictionaryValue*> potentialBreakpoints;
diff --git a/deps/v8/src/inspector/v8-debugger-agent-impl.h b/deps/v8/src/inspector/v8-debugger-agent-impl.h
index df719a4fa3c..13ca1624b7c 100644
--- a/deps/v8/src/inspector/v8-debugger-agent-impl.h
+++ b/deps/v8/src/inspector/v8-debugger-agent-impl.h
@@ -113,6 +113,11 @@ class V8DebuggerAgentImpl : public protocol::Debugger::Backend {
       Maybe<double> timeout,
       std::unique_ptr<protocol::Runtime::RemoteObject>* result,
       Maybe<protocol::Runtime::ExceptionDetails>*) override;
+  Response executeWasmEvaluator(
+      const String16& callFrameId, const protocol::Binary& evaluator,
+      Maybe<double> timeout,
+      std::unique_ptr<protocol::Runtime::RemoteObject>* result,
+      Maybe<protocol::Runtime::ExceptionDetails>* exceptionDetails) override;
   Response setVariableValue(
       int scopeNumber, const String16& variableName,
       std::unique_ptr<protocol::Runtime::CallArgument> newValue,
diff --git a/deps/v8/src/inspector/v8-debugger-script.cc b/deps/v8/src/inspector/v8-debugger-script.cc
index 551beb242bd..6e54656d40b 100644
--- a/deps/v8/src/inspector/v8-debugger-script.cc
+++ b/deps/v8/src/inspector/v8-debugger-script.cc
@@ -122,6 +122,21 @@ class ActualScript : public V8DebuggerScript {
     return v8::Just(v8::debug::WasmScript::Cast(*script)->Bytecode());
   }
   Language getLanguage() const override { return m_language; }
+  v8::Maybe<v8::debug::WasmScript::DebugSymbolsType> getDebugSymbolsType()
+      const override {
+    auto script = this->script();
+    if (!script->IsWasm())
+      return v8::Nothing<v8::debug::WasmScript::DebugSymbolsType>();
+    return v8::Just(v8::debug::WasmScript::Cast(*script)->GetDebugSymbolType());
+  }
+  v8::Maybe<String16> getExternalDebugSymbolsURL() const override {
+    auto script = this->script();
+    if (!script->IsWasm()) return v8::Nothing<String16>();
+    v8::MemorySpan<const char> external_url =
+        v8::debug::WasmScript::Cast(*script)->ExternalSymbolsURL();
+    if (external_url.size() == 0) return v8::Nothing<String16>();
+    return v8::Just(String16(external_url.data(), external_url.size()));
+  }
   int startLine() const override { return m_startLine; }
   int startColumn() const override { return m_startColumn; }
   int endLine() const override { return m_endLine; }
@@ -133,9 +148,14 @@ class ActualScript : public V8DebuggerScript {
   }
   bool isSourceLoadedLazily() const override { return false; }
   int length() const override {
+    auto script = this->script();
+    if (script->IsWasm()) {
+      return static_cast<int>(
+          v8::debug::WasmScript::Cast(*script)->Bytecode().size());
+    }
     v8::HandleScope scope(m_isolate);
     v8::Local<v8::String> v8Source;
-    return script()->Source().ToLocal(&v8Source) ? v8Source->Length() : 0;
+    return script->Source().ToLocal(&v8Source) ? v8Source->Length() : 0;
   }
 
   const String16& sourceMappingURL() const override {
@@ -275,6 +295,12 @@ class ActualScript : public V8DebuggerScript {
       } else {
         m_endColumn = source_length + m_startColumn;
       }
+    } else if (script->IsWasm()) {
+      DCHECK_EQ(0, m_startLine);
+      DCHECK_EQ(0, m_startColumn);
+      m_endLine = 0;
+      m_endColumn = static_cast<int>(
+          v8::debug::WasmScript::Cast(*script)->Bytecode().size());
     } else {
       m_endLine = m_startLine;
       m_endColumn = m_startColumn;
diff --git a/deps/v8/src/inspector/v8-debugger-script.h b/deps/v8/src/inspector/v8-debugger-script.h
index d4ad784394f..f47f81a0496 100644
--- a/deps/v8/src/inspector/v8-debugger-script.h
+++ b/deps/v8/src/inspector/v8-debugger-script.h
@@ -61,6 +61,9 @@ class V8DebuggerScript {
   virtual String16 source(size_t pos, size_t len = UINT_MAX) const = 0;
   virtual v8::Maybe<v8::MemorySpan<const uint8_t>> wasmBytecode() const = 0;
   virtual Language getLanguage() const = 0;
+  virtual v8::Maybe<String16> getExternalDebugSymbolsURL() const = 0;
+  virtual v8::Maybe<v8::debug::WasmScript::DebugSymbolsType>
+  getDebugSymbolsType() const = 0;
   virtual const String16& hash() const = 0;
   virtual int startLine() const = 0;
   virtual int startColumn() const = 0;
diff --git a/deps/v8/src/inspector/v8-inspector-impl.cc b/deps/v8/src/inspector/v8-inspector-impl.cc
index 18c592ef118..7bb8029a3d3 100644
--- a/deps/v8/src/inspector/v8-inspector-impl.cc
+++ b/deps/v8/src/inspector/v8-inspector-impl.cc
@@ -131,8 +131,7 @@ void V8InspectorImpl::unmuteExceptions(int contextGroupId) {
 
 V8ConsoleMessageStorage* V8InspectorImpl::ensureConsoleMessageStorage(
     int contextGroupId) {
-  ConsoleStorageMap::iterator storageIt =
-      m_consoleStorageMap.find(contextGroupId);
+  auto storageIt = m_consoleStorageMap.find(contextGroupId);
   if (storageIt == m_consoleStorageMap.end())
     storageIt = m_consoleStorageMap
                     .insert(std::make_pair(
@@ -144,8 +143,7 @@ V8ConsoleMessageStorage* V8InspectorImpl::ensureConsoleMessageStorage(
 }
 
 bool V8InspectorImpl::hasConsoleMessageStorage(int contextGroupId) {
-  ConsoleStorageMap::iterator storageIt =
-      m_consoleStorageMap.find(contextGroupId);
+  auto storageIt = m_consoleStorageMap.find(contextGroupId);
   return storageIt != m_consoleStorageMap.end();
 }
 
@@ -174,10 +172,10 @@ InspectedContext* V8InspectorImpl::getContext(int groupId,
                                               int contextId) const {
   if (!groupId || !contextId) return nullptr;
 
-  ContextsByGroupMap::const_iterator contextGroupIt = m_contexts.find(groupId);
+  auto contextGroupIt = m_contexts.find(groupId);
   if (contextGroupIt == m_contexts.end()) return nullptr;
 
-  ContextByIdMap::iterator contextIt = contextGroupIt->second->find(contextId);
+  auto contextIt = contextGroupIt->second->find(contextId);
   if (contextIt == contextGroupIt->second->end()) return nullptr;
 
   return contextIt->second.get();
@@ -194,10 +192,10 @@ v8::MaybeLocal<v8::Context> V8InspectorImpl::contextById(int contextId) {
 
 void V8InspectorImpl::contextCreated(const V8ContextInfo& info) {
   int contextId = ++m_lastContextId;
-  InspectedContext* context = new InspectedContext(this, info, contextId);
+  auto* context = new InspectedContext(this, info, contextId);
   m_contextIdToGroupIdMap[contextId] = info.contextGroupId;
 
-  ContextsByGroupMap::iterator contextIt = m_contexts.find(info.contextGroupId);
+  auto contextIt = m_contexts.find(info.contextGroupId);
   if (contextIt == m_contexts.end())
     contextIt = m_contexts
                     .insert(std::make_pair(
@@ -224,7 +222,7 @@ void V8InspectorImpl::contextDestroyed(v8::Local<v8::Context> context) {
 void V8InspectorImpl::contextCollected(int groupId, int contextId) {
   m_contextIdToGroupIdMap.erase(contextId);
 
-  ConsoleStorageMap::iterator storageIt = m_consoleStorageMap.find(groupId);
+  auto storageIt = m_consoleStorageMap.find(groupId);
   if (storageIt != m_consoleStorageMap.end())
     storageIt->second->contextDestroyed(contextId);
 
@@ -330,7 +328,7 @@ void V8InspectorImpl::allAsyncTasksCanceled() {
 
 V8Inspector::Counters::Counters(v8::Isolate* isolate) : m_isolate(isolate) {
   CHECK(m_isolate);
-  V8InspectorImpl* inspector =
+  auto* inspector =
       static_cast<V8InspectorImpl*>(v8::debug::GetInspector(m_isolate));
   CHECK(inspector);
   CHECK(!inspector->m_counters);
@@ -339,7 +337,7 @@ V8Inspector::Counters::Counters(v8::Isolate* isolate) : m_isolate(isolate) {
 }
 
 V8Inspector::Counters::~Counters() {
-  V8InspectorImpl* inspector =
+  auto* inspector =
       static_cast<V8InspectorImpl*>(v8::debug::GetInspector(m_isolate));
   CHECK(inspector);
   inspector->m_counters = nullptr;
diff --git a/deps/v8/src/inspector/value-mirror.cc b/deps/v8/src/inspector/value-mirror.cc
index f9457fd1ec1..527dc8bef3d 100644
--- a/deps/v8/src/inspector/value-mirror.cc
+++ b/deps/v8/src/inspector/value-mirror.cc
@@ -39,6 +39,26 @@ V8InternalValueType v8InternalValueTypeFrom(v8::Local<v8::Context> context,
   return inspectedContext->getInternalType(value.As<v8::Object>());
 }
 
+template <typename ResultType>
+ResultType unpackWasmValue(v8::Local<v8::Context> context,
+                           v8::Local<v8::Array> array) {
+  ResultType result;
+  constexpr int kSize = sizeof(result);
+  uint8_t buffer[kSize];
+  for (int i = 0; i < kSize; i++) {
+    v8::Local<v8::Int32> i32 =
+        array->Get(context, i).ToLocalChecked().As<v8::Int32>();
+    buffer[i] = static_cast<uint8_t>(i32->Value());
+  }
+  memcpy(&result, buffer, kSize);
+  return result;
+}
+
+// Partial list of Wasm's ValueType, copied here to avoid including internal
+// header. Using an unscoped enumeration here to allow implicit conversions from
+// int. Keep in sync with ValueType::Kind in wasm/value-type.h.
+enum WasmValueType { kStmt, kI32, kI64, kF32, kF64, kS128, kAnyRef };
+
 Response toProtocolValue(v8::Local<v8::Context> context,
                          v8::Local<v8::Value> value, int maxDepth,
                          std::unique_ptr<protocol::Value>* result) {
@@ -128,6 +148,49 @@ Response toProtocolValue(v8::Local<v8::Context> context,
     *result = std::move(jsonObject);
     return Response::Success();
   }
+
+  if (v8::debug::WasmValue::IsWasmValue(value)) {
+    auto wasmValue = value.As<v8::debug::WasmValue>();
+
+    // Convert serializable Wasm values (i32, f32, f64) into protocol values.
+    // Not all i64 values are representable by double, so always represent it as
+    // a String here.
+    switch (wasmValue->value_type()) {
+      case kI32: {
+        *result = protocol::FundamentalValue::create(
+            unpackWasmValue<int32_t>(context, wasmValue->bytes()));
+        break;
+      }
+      case kI64: {
+        *result = protocol::StringValue::create(String16::fromInteger64(
+            unpackWasmValue<int64_t>(context, wasmValue->bytes())));
+        break;
+      }
+      case kF32: {
+        *result = protocol::FundamentalValue::create(
+            unpackWasmValue<float>(context, wasmValue->bytes()));
+        break;
+      }
+      case kF64: {
+        *result = protocol::FundamentalValue::create(
+            unpackWasmValue<double>(context, wasmValue->bytes()));
+        break;
+      }
+      case kAnyRef: {
+        std::unique_ptr<protocol::Value> anyrefValue;
+        Response response =
+            toProtocolValue(context, wasmValue->ref(), maxDepth, &anyrefValue);
+        if (!response.IsSuccess()) return response;
+        *result = std::move(anyrefValue);
+        break;
+      }
+      default: {
+        UNIMPLEMENTED();
+      }
+    }
+    return Response::Success();
+  }
+
   return Response::ServerError("Object couldn't be returned by value");
 }
 
@@ -398,6 +461,112 @@ class PrimitiveValueMirror final : public ValueMirror {
   String16 m_subtype;
 };
 
+class WasmValueMirror final : public ValueMirror {
+ public:
+  explicit WasmValueMirror(v8::Local<v8::debug::WasmValue> value)
+      : m_value(value) {}
+
+  v8::Local<v8::Value> v8Value() const override { return m_value; }
+
+  Response buildRemoteObject(
+      v8::Local<v8::Context> context, WrapMode mode,
+      std::unique_ptr<RemoteObject>* result) const override {
+    bool serializable;
+    String16 descriptionValue = description(context, &serializable);
+    *result = RemoteObject::create()
+                  .setType(RemoteObject::TypeEnum::Wasm)
+                  .setSubtype(subtype())
+                  .setDescription(descriptionValue)
+                  .build();
+    if (serializable) {
+      std::unique_ptr<protocol::Value> protocolValue;
+      toProtocolValue(context, m_value, &protocolValue);
+      (*result)->setValue(std::move(protocolValue));
+    } else {
+      (*result)->setUnserializableValue(descriptionValue);
+    }
+    return Response::Success();
+  }
+
+  void buildPropertyPreview(
+      v8::Local<v8::Context> context, const String16& name,
+      std::unique_ptr<PropertyPreview>* result) const override {
+    bool serializable;
+    *result = PropertyPreview::create()
+                  .setName(name)
+                  .setType(RemoteObject::TypeEnum::Wasm)
+                  .setSubtype(subtype())
+                  .setValue(description(context, &serializable))
+                  .build();
+  }
+
+  void buildEntryPreview(
+      v8::Local<v8::Context> context, int* nameLimit, int* indexLimit,
+      std::unique_ptr<ObjectPreview>* preview) const override {
+    bool serializable;
+    *preview =
+        ObjectPreview::create()
+            .setType(RemoteObject::TypeEnum::Wasm)
+            .setSubtype(subtype())
+            .setDescription(description(context, &serializable))
+            .setOverflow(false)
+            .setProperties(std::make_unique<protocol::Array<PropertyPreview>>())
+            .build();
+  }
+
+ private:
+  String16 subtype() const {
+    switch (m_value->value_type()) {
+      case kI32:
+        return RemoteObject::SubtypeEnum::I32;
+      case kI64:
+        return RemoteObject::SubtypeEnum::I64;
+      case kF32:
+        return RemoteObject::SubtypeEnum::F32;
+      case kF64:
+        return RemoteObject::SubtypeEnum::F64;
+      case kAnyRef:
+        return RemoteObject::SubtypeEnum::Anyref;
+      default:
+        UNREACHABLE();
+    }
+  }
+
+  String16 description(v8::Local<v8::Context> context,
+                       bool* serializable) const {
+    *serializable = true;
+    switch (m_value->value_type()) {
+      case kI32: {
+        return String16::fromInteger(
+            unpackWasmValue<int32_t>(context, m_value->bytes()));
+      }
+      case kI64: {
+        *serializable = false;
+        return String16::fromInteger64(
+            unpackWasmValue<int64_t>(context, m_value->bytes()));
+      }
+      case kF32: {
+        return String16::fromDouble(
+            unpackWasmValue<float>(context, m_value->bytes()));
+      }
+      case kF64: {
+        return String16::fromDouble(
+            unpackWasmValue<double>(context, m_value->bytes()));
+      }
+      case kAnyRef: {
+        return descriptionForObject(context->GetIsolate(),
+                                    m_value->ref().As<v8::Object>());
+      }
+      default: {
+        *serializable = false;
+        return String16("Unknown");
+      }
+    }
+  }
+
+  v8::Local<v8::debug::WasmValue> m_value;
+};
+
 class NumberMirror final : public ValueMirror {
  public:
   explicit NumberMirror(v8::Local<v8::Number> value) : m_value(value) {}
@@ -814,10 +983,10 @@ void getInternalPropertiesForPreview(
       object->IsBigIntObject()) {
     whitelist.emplace_back("[[PrimitiveValue]]");
   } else if (object->IsPromise()) {
-    whitelist.emplace_back("[[PromiseStatus]]");
-    whitelist.emplace_back("[[PromiseValue]]");
+    whitelist.emplace_back("[[PromiseState]]");
+    whitelist.emplace_back("[[PromiseResult]]");
   } else if (object->IsGeneratorObject()) {
-    whitelist.emplace_back("[[GeneratorStatus]]");
+    whitelist.emplace_back("[[GeneratorState]]");
   }
   for (auto& mirror : mirrors) {
     if (std::find(whitelist.begin(), whitelist.end(), mirror.name) ==
@@ -1602,6 +1771,9 @@ std::unique_ptr<ValueMirror> ValueMirror::create(v8::Local<v8::Context> context,
   if (value->IsSymbol()) {
     return std::make_unique<SymbolMirror>(value.As<v8::Symbol>());
   }
+  if (v8::debug::WasmValue::IsWasmValue(value)) {
+    return std::make_unique<WasmValueMirror>(value.As<v8::debug::WasmValue>());
+  }
   auto clientSubtype = (value->IsUndefined() || value->IsObject())
                            ? clientFor(context)->valueSubtype(value)
                            : nullptr;
diff --git a/deps/v8/src/interpreter/bytecode-generator.cc b/deps/v8/src/interpreter/bytecode-generator.cc
index 18a2fc99133..9a758370635 100644
--- a/deps/v8/src/interpreter/bytecode-generator.cc
+++ b/deps/v8/src/interpreter/bytecode-generator.cc
@@ -1040,10 +1040,10 @@ static bool IsInEagerLiterals(
 #endif  // DEBUG
 
 BytecodeGenerator::BytecodeGenerator(
-    UnoptimizedCompilationInfo* info,
+    Zone* compile_zone, UnoptimizedCompilationInfo* info,
     const AstStringConstants* ast_string_constants,
     std::vector<FunctionLiteral*>* eager_inner_literals)
-    : zone_(info->zone()),
+    : zone_(compile_zone),
       builder_(zone(), info->num_parameters_including_this(),
                info->scope()->num_stack_slots(), info->feedback_vector_spec(),
                info->SourcePositionRecordingMode()),
@@ -1332,7 +1332,7 @@ void BytecodeGenerator::GenerateBytecodeBody() {
   if (FLAG_trace) builder()->CallRuntime(Runtime::kTraceEnter);
 
   // Emit type profile call.
-  if (info()->collect_type_profile()) {
+  if (info()->flags().collect_type_profile()) {
     feedback_spec()->AddTypeProfileSlot();
     int num_parameters = closure_scope()->num_parameters();
     for (int i = 0; i < num_parameters; i++) {
@@ -2134,7 +2134,7 @@ void BytecodeGenerator::VisitFunctionLiteral(FunctionLiteral* expr) {
   DCHECK(expr->scope()->outer_scope() == current_scope());
   uint8_t flags = CreateClosureFlags::Encode(
       expr->pretenure(), closure_scope()->is_function_scope(),
-      info()->might_always_opt());
+      info()->flags().might_always_opt());
   size_t entry = builder()->AllocateDeferredConstantPoolEntry();
   builder()->CreateClosure(entry, GetCachedCreateClosureSlot(expr), flags);
   function_literals_.push_back(std::make_pair(expr, entry));
@@ -3197,7 +3197,7 @@ void BytecodeGenerator::BuildReturn(int source_position) {
     builder()->StoreAccumulatorInRegister(result).CallRuntime(
         Runtime::kTraceExit, result);
   }
-  if (info()->collect_type_profile()) {
+  if (info()->flags().collect_type_profile()) {
     builder()->CollectTypeProfile(info()->literal()->return_position());
   }
   builder()->SetReturnPosition(source_position, info()->literal());
@@ -3538,16 +3538,15 @@ BytecodeGenerator::AssignmentLhsData BytecodeGenerator::PrepareAssignmentLhs(
 // In pseudo-code, this builds:
 //
 // if (!done) {
-//   let method = iterator.return
-//   if (method !== null && method !== undefined) {
-//     try {
-//       if (typeof(method) !== "function") throw TypeError
+//   try {
+//     let method = iterator.return
+//     if (method !== null && method !== undefined) {
 //       let return_val = method.call(iterator)
 //       if (!%IsObject(return_val)) throw TypeError
-//     } catch (e) {
-//       if (iteration_continuation != RETHROW)
-//         rethrow e
 //     }
+//   } catch (e) {
+//     if (iteration_continuation != RETHROW)
+//       rethrow e
 //   }
 // }
 //
@@ -3562,44 +3561,24 @@ void BytecodeGenerator::BuildFinalizeIteration(
   builder()->LoadAccumulatorWithRegister(done).JumpIfTrue(
       ToBooleanMode::kConvertToBoolean, iterator_is_done.New());
 
-  //   method = iterator.return
-  //   if (method !== null && method !== undefined) {
-  Register method = register_allocator()->NewRegister();
-  builder()
-      ->LoadNamedProperty(iterator.object(),
-                          ast_string_constants()->return_string(),
-                          feedback_index(feedback_spec()->AddLoadICSlot()))
-      .StoreAccumulatorInRegister(method)
-      .JumpIfUndefinedOrNull(iterator_is_done.New());
-
   {
     RegisterAllocationScope register_scope(this);
     BuildTryCatch(
         // try {
-        //   if (typeof(method) !== "function") throw TypeError
-        //   let return_val = method.call(iterator)
-        //   if (!%IsObject(return_val)) throw TypeError
+        //   let method = iterator.return
+        //   if (method !== null && method !== undefined) {
+        //     let return_val = method.call(iterator)
+        //     if (!%IsObject(return_val)) throw TypeError
+        //   }
         // }
         [&]() {
-          BytecodeLabel if_callable;
+          Register method = register_allocator()->NewRegister();
           builder()
-              ->CompareTypeOf(TestTypeOfFlags::LiteralFlag::kFunction)
-              .JumpIfTrue(ToBooleanMode::kAlreadyBoolean, &if_callable);
-          {
-            // throw %NewTypeError(kReturnMethodNotCallable)
-            RegisterAllocationScope register_scope(this);
-            RegisterList new_type_error_args =
-                register_allocator()->NewRegisterList(2);
-            builder()
-                ->LoadLiteral(
-                    Smi::FromEnum(MessageTemplate::kReturnMethodNotCallable))
-                .StoreAccumulatorInRegister(new_type_error_args[0])
-                .LoadLiteral(ast_string_constants()->empty_string())
-                .StoreAccumulatorInRegister(new_type_error_args[1])
-                .CallRuntime(Runtime::kNewTypeError, new_type_error_args)
-                .Throw();
-          }
-          builder()->Bind(&if_callable);
+              ->LoadNamedProperty(
+                  iterator.object(), ast_string_constants()->return_string(),
+                  feedback_index(feedback_spec()->AddLoadICSlot()))
+              .JumpIfUndefinedOrNull(iterator_is_done.New())
+              .StoreAccumulatorInRegister(method);
 
           RegisterList args(iterator.object());
           builder()->CallProperty(
@@ -4142,9 +4121,23 @@ void BytecodeGenerator::VisitCompoundAssignment(CompoundAssignment* expr) {
     }
   }
 
-  BinaryOperation* binop = expr->AsCompoundAssignment()->binary_operation();
+  BinaryOperation* binop = expr->binary_operation();
   FeedbackSlot slot = feedback_spec()->AddBinaryOpICSlot();
-  if (expr->value()->IsSmiLiteral()) {
+  BytecodeLabel short_circuit;
+  if (binop->op() == Token::NULLISH) {
+    BytecodeLabel nullish;
+    builder()
+        ->JumpIfUndefinedOrNull(&nullish)
+        .Jump(&short_circuit)
+        .Bind(&nullish);
+    VisitForAccumulatorValue(expr->value());
+  } else if (binop->op() == Token::OR) {
+    builder()->JumpIfTrue(ToBooleanMode::kConvertToBoolean, &short_circuit);
+    VisitForAccumulatorValue(expr->value());
+  } else if (binop->op() == Token::AND) {
+    builder()->JumpIfFalse(ToBooleanMode::kConvertToBoolean, &short_circuit);
+    VisitForAccumulatorValue(expr->value());
+  } else if (expr->value()->IsSmiLiteral()) {
     builder()->BinaryOperationSmiLiteral(
         binop->op(), expr->value()->AsLiteral()->AsSmiLiteral(),
         feedback_index(slot));
@@ -4154,9 +4147,9 @@ void BytecodeGenerator::VisitCompoundAssignment(CompoundAssignment* expr) {
     VisitForAccumulatorValue(expr->value());
     builder()->BinaryOperation(binop->op(), old_value, feedback_index(slot));
   }
-
   builder()->SetExpressionPosition(expr);
   BuildAssignment(lhs_data, expr->op(), expr->lookup_hoisting_mode());
+  builder()->Bind(&short_circuit);
 }
 
 // Suspends the generator to resume at the next suspend_id, with output stored
@@ -4893,7 +4886,8 @@ void BytecodeGenerator::VisitCall(Call* expr) {
       break;
     }
     case Call::NAMED_OPTIONAL_CHAIN_PROPERTY_CALL:
-    case Call::KEYED_OPTIONAL_CHAIN_PROPERTY_CALL: {
+    case Call::KEYED_OPTIONAL_CHAIN_PROPERTY_CALL:
+    case Call::PRIVATE_OPTIONAL_CHAIN_CALL: {
       OptionalChain* chain = callee_expr->AsOptionalChain();
       Property* property = chain->expression()->AsProperty();
       BuildOptionalChain([&]() {
diff --git a/deps/v8/src/interpreter/bytecode-generator.h b/deps/v8/src/interpreter/bytecode-generator.h
index aa461d523c7..2b11e721fac 100644
--- a/deps/v8/src/interpreter/bytecode-generator.h
+++ b/deps/v8/src/interpreter/bytecode-generator.h
@@ -32,7 +32,7 @@ class BytecodeJumpTable;
 class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
  public:
   explicit BytecodeGenerator(
-      UnoptimizedCompilationInfo* info,
+      Zone* zone, UnoptimizedCompilationInfo* info,
       const AstStringConstants* ast_string_constants,
       std::vector<FunctionLiteral*>* eager_inner_literals);
 
diff --git a/deps/v8/src/interpreter/interpreter-assembler.cc b/deps/v8/src/interpreter/interpreter-assembler.cc
index eaea1c91dd8..1d15ed77a09 100644
--- a/deps/v8/src/interpreter/interpreter-assembler.cc
+++ b/deps/v8/src/interpreter/interpreter-assembler.cc
@@ -683,8 +683,9 @@ TNode<Uint32T> InterpreterAssembler::BytecodeOperandIntrinsicId(
 TNode<Object> InterpreterAssembler::LoadConstantPoolEntry(TNode<WordT> index) {
   TNode<FixedArray> constant_pool = CAST(LoadObjectField(
       BytecodeArrayTaggedPointer(), BytecodeArray::kConstantPoolOffset));
-  return UnsafeLoadFixedArrayElement(
-      constant_pool, UncheckedCast<IntPtrT>(index), LoadSensitivity::kCritical);
+  return UnsafeLoadFixedArrayElement(constant_pool,
+                                     UncheckedCast<IntPtrT>(index), 0,
+                                     LoadSensitivity::kCritical);
 }
 
 TNode<IntPtrT> InterpreterAssembler::LoadAndUntagConstantPoolEntry(
@@ -832,149 +833,24 @@ TNode<Object> InterpreterAssembler::Construct(
   DCHECK(Bytecodes::MakesCallAlongCriticalPath(bytecode_));
   TVARIABLE(Object, var_result);
   TVARIABLE(AllocationSite, var_site);
-  Label extra_checks(this, Label::kDeferred), return_result(this, &var_result),
-      construct(this), construct_array(this, &var_site);
-  GotoIf(IsUndefined(maybe_feedback_vector), &construct);
-
-  TNode<FeedbackVector> feedback_vector = CAST(maybe_feedback_vector);
-
-  // Increment the call count.
-  IncrementCallCount(feedback_vector, slot_id);
+  Label return_result(this), construct_generic(this),
+      construct_array(this, &var_site);
 
-  // Check if we have monomorphic {new_target} feedback already.
-  TNode<MaybeObject> feedback =
-      LoadFeedbackVectorSlot(feedback_vector, slot_id);
-  Branch(IsWeakReferenceToObject(feedback, new_target), &construct,
-         &extra_checks);
+  CollectConstructFeedback(context, target, new_target, maybe_feedback_vector,
+                           slot_id, &construct_generic, &construct_array,
+                           &var_site);
 
-  BIND(&extra_checks);
+  BIND(&construct_generic);
   {
-    Label check_allocation_site(this), check_initialized(this),
-        initialize(this), mark_megamorphic(this);
-
-    // Check if it is a megamorphic {new_target}..
-    Comment("check if megamorphic");
-    TNode<BoolT> is_megamorphic = TaggedEqual(
-        feedback, HeapConstant(FeedbackVector::MegamorphicSentinel(isolate())));
-    GotoIf(is_megamorphic, &construct);
-
-    Comment("check if weak reference");
-    GotoIfNot(IsWeakOrCleared(feedback), &check_allocation_site);
-
-    // If the weak reference is cleared, we have a new chance to become
-    // monomorphic.
-    Comment("check if weak reference is cleared");
-    Branch(IsCleared(feedback), &initialize, &mark_megamorphic);
-
-    BIND(&check_allocation_site);
-    {
-      // Check if it is an AllocationSite.
-      Comment("check if allocation site");
-      TNode<HeapObject> strong_feedback = CAST(feedback);
-      GotoIfNot(IsAllocationSite(strong_feedback), &check_initialized);
-
-      // Make sure that {target} and {new_target} are the Array constructor.
-      TNode<Object> array_function = LoadContextElement(
-          LoadNativeContext(context), Context::ARRAY_FUNCTION_INDEX);
-      GotoIfNot(TaggedEqual(target, array_function), &mark_megamorphic);
-      GotoIfNot(TaggedEqual(new_target, array_function), &mark_megamorphic);
-      var_site = CAST(strong_feedback);
-      Goto(&construct_array);
-    }
-
-    BIND(&check_initialized);
-    {
-      // Check if it is uninitialized.
-      Comment("check if uninitialized");
-      TNode<BoolT> is_uninitialized =
-          TaggedEqual(feedback, UninitializedSymbolConstant());
-      Branch(is_uninitialized, &initialize, &mark_megamorphic);
-    }
-
-    BIND(&initialize);
-    {
-      Comment("check if function in same native context");
-      GotoIf(TaggedIsSmi(new_target), &mark_megamorphic);
-      // Check if the {new_target} is a JSFunction or JSBoundFunction
-      // in the current native context.
-      TVARIABLE(HeapObject, var_current, CAST(new_target));
-      Label loop(this, &var_current), done_loop(this);
-      Goto(&loop);
-      BIND(&loop);
-      {
-        Label if_boundfunction(this), if_function(this);
-        TNode<HeapObject> current = var_current.value();
-        TNode<Uint16T> current_instance_type = LoadInstanceType(current);
-        GotoIf(InstanceTypeEqual(current_instance_type, JS_BOUND_FUNCTION_TYPE),
-               &if_boundfunction);
-        Branch(InstanceTypeEqual(current_instance_type, JS_FUNCTION_TYPE),
-               &if_function, &mark_megamorphic);
-
-        BIND(&if_function);
-        {
-          // Check that the JSFunction {current} is in the current native
-          // context.
-          TNode<Context> current_context =
-              CAST(LoadObjectField(current, JSFunction::kContextOffset));
-          TNode<NativeContext> current_native_context =
-              LoadNativeContext(current_context);
-          Branch(
-              TaggedEqual(LoadNativeContext(context), current_native_context),
-              &done_loop, &mark_megamorphic);
-        }
-
-        BIND(&if_boundfunction);
-        {
-          // Continue with the [[BoundTargetFunction]] of {current}.
-          var_current = LoadObjectField<HeapObject>(
-              current, JSBoundFunction::kBoundTargetFunctionOffset);
-          Goto(&loop);
-        }
-      }
-      BIND(&done_loop);
-
-      // Create an AllocationSite if {target} and {new_target} refer
-      // to the current native context's Array constructor.
-      Label create_allocation_site(this), store_weak_reference(this);
-      GotoIfNot(TaggedEqual(target, new_target), &store_weak_reference);
-      TNode<Object> array_function = LoadContextElement(
-          LoadNativeContext(context), Context::ARRAY_FUNCTION_INDEX);
-      Branch(TaggedEqual(target, array_function), &create_allocation_site,
-             &store_weak_reference);
-
-      BIND(&create_allocation_site);
-      {
-        var_site =
-            CreateAllocationSiteInFeedbackVector(feedback_vector, slot_id);
-        ReportFeedbackUpdate(feedback_vector, slot_id,
-                             "Construct:CreateAllocationSite");
-        Goto(&construct_array);
-      }
-
-      BIND(&store_weak_reference);
-      {
-        StoreWeakReferenceInFeedbackVector(feedback_vector, slot_id,
-                                           CAST(new_target));
-        ReportFeedbackUpdate(feedback_vector, slot_id,
-                             "Construct:StoreWeakReference");
-        Goto(&construct);
-      }
-    }
-
-    BIND(&mark_megamorphic);
-    {
-      // MegamorphicSentinel is an immortal immovable object so
-      // write-barrier is not needed.
-      Comment("transition to megamorphic");
-      DCHECK(RootsTable::IsImmortalImmovable(RootIndex::kmegamorphic_symbol));
-      StoreFeedbackVectorSlot(
-          feedback_vector, slot_id,
-          HeapConstant(FeedbackVector::MegamorphicSentinel(isolate())),
-          SKIP_WRITE_BARRIER);
-      ReportFeedbackUpdate(feedback_vector, slot_id,
-                           "Construct:TransitionMegamorphic");
-      Goto(&construct);
-    }
+    // TODO(bmeurer): Remove the generic type_info parameter from the Construct.
+    Comment("call using Construct builtin");
+    Callable callable = CodeFactory::InterpreterPushArgsThenConstruct(
+        isolate(), InterpreterPushArgsMode::kOther);
+    TNode<Code> code_target = HeapConstant(callable.code());
+    var_result = CallStub(callable.descriptor(), code_target, context,
+                          args.reg_count(), args.base_reg_location(), target,
+                          new_target, UndefinedConstant());
+    Goto(&return_result);
   }
 
   BIND(&construct_array);
@@ -991,19 +867,6 @@ TNode<Object> InterpreterAssembler::Construct(
     Goto(&return_result);
   }
 
-  BIND(&construct);
-  {
-    // TODO(bmeurer): Remove the generic type_info parameter from the Construct.
-    Comment("call using Construct builtin");
-    Callable callable = CodeFactory::InterpreterPushArgsThenConstruct(
-        isolate(), InterpreterPushArgsMode::kOther);
-    TNode<Code> code_target = HeapConstant(callable.code());
-    var_result = CallStub(callable.descriptor(), code_target, context,
-                          args.reg_count(), args.base_reg_location(), target,
-                          new_target, UndefinedConstant());
-    Goto(&return_result);
-  }
-
   BIND(&return_result);
   return var_result.value();
 }
diff --git a/deps/v8/src/interpreter/interpreter-generator.cc b/deps/v8/src/interpreter/interpreter-generator.cc
index 6b8b7135e0a..a051aa0147d 100644
--- a/deps/v8/src/interpreter/interpreter-generator.cc
+++ b/deps/v8/src/interpreter/interpreter-generator.cc
@@ -14,6 +14,7 @@
 #include "src/ic/accessor-assembler.h"
 #include "src/ic/binary-op-assembler.h"
 #include "src/ic/ic.h"
+#include "src/ic/unary-op-assembler.h"
 #include "src/interpreter/bytecode-flags.h"
 #include "src/interpreter/bytecodes.h"
 #include "src/interpreter/interpreter-assembler.h"
@@ -1083,38 +1084,17 @@ IGNITION_HANDLER(BitwiseAndSmi, InterpreterBitwiseBinaryOpAssembler) {
 //
 // Perform bitwise-not on the accumulator.
 IGNITION_HANDLER(BitwiseNot, InterpreterAssembler) {
-  TNode<Object> operand = GetAccumulator();
+  TNode<Object> value = GetAccumulator();
+  TNode<Context> context = GetContext();
   TNode<UintPtrT> slot_index = BytecodeOperandIdx(0);
   TNode<HeapObject> maybe_feedback_vector = LoadFeedbackVector();
-  TNode<Context> context = GetContext();
 
-  TVARIABLE(Word32T, var_word32);
-  TVARIABLE(Smi, var_feedback);
-  TVARIABLE(BigInt, var_bigint);
-  Label if_number(this), if_bigint(this);
-  TaggedToWord32OrBigIntWithFeedback(context, operand, &if_number, &var_word32,
-                                     &if_bigint, &var_bigint, &var_feedback);
+  UnaryOpAssembler unary_op_asm(state());
+  TNode<Object> result = unary_op_asm.Generate_BitwiseNotWithFeedback(
+      context, value, slot_index, maybe_feedback_vector);
 
-  // Number case.
-  BIND(&if_number);
-  TNode<Number> result =
-      ChangeInt32ToTagged(Signed(Word32BitwiseNot(var_word32.value())));
-  TNode<Smi> result_type = SelectSmiConstant(
-      TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
-      BinaryOperationFeedback::kNumber);
-  UpdateFeedback(SmiOr(result_type, var_feedback.value()),
-                 maybe_feedback_vector, slot_index);
   SetAccumulator(result);
   Dispatch();
-
-  // BigInt case.
-  BIND(&if_bigint);
-  UpdateFeedback(SmiConstant(BinaryOperationFeedback::kBigInt),
-                 maybe_feedback_vector, slot_index);
-  SetAccumulator(CallRuntime(Runtime::kBigIntUnaryOp, context,
-                             var_bigint.value(),
-                             SmiConstant(Operation::kBitwiseNot)));
-  Dispatch();
 }
 
 // ShiftLeftSmi <imm>
@@ -1144,162 +1124,22 @@ IGNITION_HANDLER(ShiftRightLogicalSmi, InterpreterBitwiseBinaryOpAssembler) {
   BitwiseBinaryOpWithSmi(Operation::kShiftRightLogical);
 }
 
-class UnaryNumericOpAssembler : public InterpreterAssembler {
- public:
-  UnaryNumericOpAssembler(CodeAssemblerState* state, Bytecode bytecode,
-                          OperandScale operand_scale)
-      : InterpreterAssembler(state, bytecode, operand_scale) {}
-
-  virtual ~UnaryNumericOpAssembler() = default;
-
-  // Must return a tagged value.
-  virtual TNode<Number> SmiOp(TNode<Smi> smi_value,
-                              TVariable<Smi>* var_feedback, Label* do_float_op,
-                              TVariable<Float64T>* var_float) = 0;
-  // Must return a Float64 value.
-  virtual TNode<Float64T> FloatOp(TNode<Float64T> float_value) = 0;
-  // Must return a tagged value.
-  virtual TNode<HeapObject> BigIntOp(TNode<HeapObject> bigint_value) = 0;
-
-  void UnaryOpWithFeedback() {
-    TVARIABLE(Object, var_value, GetAccumulator());
-    TVARIABLE(Object, var_result);
-    TVARIABLE(Float64T, var_float_value);
-    TVARIABLE(Smi, var_feedback, SmiConstant(BinaryOperationFeedback::kNone));
-    Label start(this, {&var_value, &var_feedback}), end(this);
-    Label do_float_op(this, &var_float_value);
-    Goto(&start);
-    // We might have to try again after ToNumeric conversion.
-    BIND(&start);
-    {
-      Label if_smi(this), if_heapnumber(this), if_oddball(this);
-      Label if_bigint(this, Label::kDeferred);
-      Label if_other(this, Label::kDeferred);
-      TNode<Object> value = var_value.value();
-      GotoIf(TaggedIsSmi(value), &if_smi);
-
-      TNode<HeapObject> value_heap_object = CAST(value);
-      TNode<Map> map = LoadMap(value_heap_object);
-      GotoIf(IsHeapNumberMap(map), &if_heapnumber);
-      TNode<Uint16T> instance_type = LoadMapInstanceType(map);
-      GotoIf(IsBigIntInstanceType(instance_type), &if_bigint);
-      Branch(InstanceTypeEqual(instance_type, ODDBALL_TYPE), &if_oddball,
-             &if_other);
-
-      BIND(&if_smi);
-      {
-        var_result =
-            SmiOp(CAST(value), &var_feedback, &do_float_op, &var_float_value);
-        Goto(&end);
-      }
-
-      BIND(&if_heapnumber);
-      {
-        var_float_value = LoadHeapNumberValue(value_heap_object);
-        Goto(&do_float_op);
-      }
-
-      BIND(&if_bigint);
-      {
-        var_result = BigIntOp(value_heap_object);
-        CombineFeedback(&var_feedback, BinaryOperationFeedback::kBigInt);
-        Goto(&end);
-      }
-
-      BIND(&if_oddball);
-      {
-        // We do not require an Or with earlier feedback here because once we
-        // convert the value to a number, we cannot reach this path. We can
-        // only reach this path on the first pass when the feedback is kNone.
-        CSA_ASSERT(this, SmiEqual(var_feedback.value(),
-                                  SmiConstant(BinaryOperationFeedback::kNone)));
-        OverwriteFeedback(&var_feedback,
-                          BinaryOperationFeedback::kNumberOrOddball);
-        var_value =
-            LoadObjectField(value_heap_object, Oddball::kToNumberOffset);
-        Goto(&start);
-      }
-
-      BIND(&if_other);
-      {
-        // We do not require an Or with earlier feedback here because once we
-        // convert the value to a number, we cannot reach this path. We can
-        // only reach this path on the first pass when the feedback is kNone.
-        CSA_ASSERT(this, SmiEqual(var_feedback.value(),
-                                  SmiConstant(BinaryOperationFeedback::kNone)));
-        OverwriteFeedback(&var_feedback, BinaryOperationFeedback::kAny);
-        var_value = CallBuiltin(Builtins::kNonNumberToNumeric, GetContext(),
-                                value_heap_object);
-        Goto(&start);
-      }
-    }
-
-    BIND(&do_float_op);
-    {
-      CombineFeedback(&var_feedback, BinaryOperationFeedback::kNumber);
-      var_result =
-          AllocateHeapNumberWithValue(FloatOp(var_float_value.value()));
-      Goto(&end);
-    }
-
-    BIND(&end);
-    TNode<UintPtrT> slot_index = BytecodeOperandIdx(0);
-    TNode<HeapObject> maybe_feedback_vector = LoadFeedbackVector();
-    UpdateFeedback(var_feedback.value(), maybe_feedback_vector, slot_index);
-    SetAccumulator(var_result.value());
-    Dispatch();
-  }
-};
-
-class NegateAssemblerImpl : public UnaryNumericOpAssembler {
- public:
-  explicit NegateAssemblerImpl(CodeAssemblerState* state, Bytecode bytecode,
-                               OperandScale operand_scale)
-      : UnaryNumericOpAssembler(state, bytecode, operand_scale) {}
-
-  TNode<Number> SmiOp(TNode<Smi> smi_value, TVariable<Smi>* var_feedback,
-                      Label* do_float_op,
-                      TVariable<Float64T>* var_float) override {
-    TVARIABLE(Number, var_result);
-    Label if_zero(this), if_min_smi(this), end(this);
-    // Return -0 if operand is 0.
-    GotoIf(SmiEqual(smi_value, SmiConstant(0)), &if_zero);
-
-    // Special-case the minimum Smi to avoid overflow.
-    GotoIf(SmiEqual(smi_value, SmiConstant(Smi::kMinValue)), &if_min_smi);
-
-    // Else simply subtract operand from 0.
-    CombineFeedback(var_feedback, BinaryOperationFeedback::kSignedSmall);
-    var_result = SmiSub(SmiConstant(0), smi_value);
-    Goto(&end);
-
-    BIND(&if_zero);
-    CombineFeedback(var_feedback, BinaryOperationFeedback::kNumber);
-    var_result = MinusZeroConstant();
-    Goto(&end);
-
-    BIND(&if_min_smi);
-    *var_float = SmiToFloat64(smi_value);
-    Goto(do_float_op);
-
-    BIND(&end);
-    return var_result.value();
-  }
-
-  TNode<Float64T> FloatOp(TNode<Float64T> float_value) override {
-    return Float64Neg(float_value);
-  }
-
-  TNode<HeapObject> BigIntOp(TNode<HeapObject> bigint_value) override {
-    return CAST(CallRuntime(Runtime::kBigIntUnaryOp, GetContext(), bigint_value,
-                            SmiConstant(Operation::kNegate)));
-  }
-};
-
 // Negate <feedback_slot>
 //
 // Perform arithmetic negation on the accumulator.
-IGNITION_HANDLER(Negate, NegateAssemblerImpl) { UnaryOpWithFeedback(); }
+IGNITION_HANDLER(Negate, InterpreterAssembler) {
+  TNode<Object> value = GetAccumulator();
+  TNode<Context> context = GetContext();
+  TNode<UintPtrT> slot_index = BytecodeOperandIdx(0);
+  TNode<HeapObject> maybe_feedback_vector = LoadFeedbackVector();
+
+  UnaryOpAssembler unary_op_asm(state());
+  TNode<Object> result = unary_op_asm.Generate_NegateWithFeedback(
+      context, value, slot_index, maybe_feedback_vector);
+
+  SetAccumulator(result);
+  Dispatch();
+}
 
 // ToName <dst>
 //
@@ -1345,72 +1185,39 @@ IGNITION_HANDLER(ToString, InterpreterAssembler) {
   Dispatch();
 }
 
-class IncDecAssembler : public UnaryNumericOpAssembler {
- public:
-  explicit IncDecAssembler(CodeAssemblerState* state, Bytecode bytecode,
-                           OperandScale operand_scale)
-      : UnaryNumericOpAssembler(state, bytecode, operand_scale) {}
-
-  Operation op() {
-    DCHECK(op_ == Operation::kIncrement || op_ == Operation::kDecrement);
-    return op_;
-  }
-
-  TNode<Number> SmiOp(TNode<Smi> value, TVariable<Smi>* var_feedback,
-                      Label* do_float_op,
-                      TVariable<Float64T>* var_float) override {
-    TNode<Smi> one = SmiConstant(1);
-    Label if_overflow(this), if_notoverflow(this);
-    TNode<Smi> result = op() == Operation::kIncrement
-                            ? TrySmiAdd(value, one, &if_overflow)
-                            : TrySmiSub(value, one, &if_overflow);
-    Goto(&if_notoverflow);
-
-    BIND(&if_overflow);
-    {
-      *var_float = SmiToFloat64(value);
-      Goto(do_float_op);
-    }
-
-    BIND(&if_notoverflow);
-    CombineFeedback(var_feedback, BinaryOperationFeedback::kSignedSmall);
-    return result;
-  }
-
-  TNode<Float64T> FloatOp(TNode<Float64T> float_value) override {
-    return op() == Operation::kIncrement
-               ? Float64Add(float_value, Float64Constant(1.0))
-               : Float64Sub(float_value, Float64Constant(1.0));
-  }
-
-  TNode<HeapObject> BigIntOp(TNode<HeapObject> bigint_value) override {
-    return CAST(CallRuntime(Runtime::kBigIntUnaryOp, GetContext(), bigint_value,
-                            SmiConstant(op())));
-  }
-
-  void IncWithFeedback() {
-    op_ = Operation::kIncrement;
-    UnaryOpWithFeedback();
-  }
-
-  void DecWithFeedback() {
-    op_ = Operation::kDecrement;
-    UnaryOpWithFeedback();
-  }
-
- private:
-  Operation op_ = Operation::kEqual;  // Dummy initialization.
-};
-
 // Inc
 //
 // Increments value in the accumulator by one.
-IGNITION_HANDLER(Inc, IncDecAssembler) { IncWithFeedback(); }
+IGNITION_HANDLER(Inc, InterpreterAssembler) {
+  TNode<Object> value = GetAccumulator();
+  TNode<Context> context = GetContext();
+  TNode<UintPtrT> slot_index = BytecodeOperandIdx(0);
+  TNode<HeapObject> maybe_feedback_vector = LoadFeedbackVector();
+
+  UnaryOpAssembler unary_op_asm(state());
+  TNode<Object> result = unary_op_asm.Generate_IncrementWithFeedback(
+      context, value, slot_index, maybe_feedback_vector);
+
+  SetAccumulator(result);
+  Dispatch();
+}
 
 // Dec
 //
 // Decrements value in the accumulator by one.
-IGNITION_HANDLER(Dec, IncDecAssembler) { DecWithFeedback(); }
+IGNITION_HANDLER(Dec, InterpreterAssembler) {
+  TNode<Object> value = GetAccumulator();
+  TNode<Context> context = GetContext();
+  TNode<UintPtrT> slot_index = BytecodeOperandIdx(0);
+  TNode<HeapObject> maybe_feedback_vector = LoadFeedbackVector();
+
+  UnaryOpAssembler unary_op_asm(state());
+  TNode<Object> result = unary_op_asm.Generate_DecrementWithFeedback(
+      context, value, slot_index, maybe_feedback_vector);
+
+  SetAccumulator(result);
+  Dispatch();
+}
 
 // ToBooleanLogicalNot
 //
@@ -1902,17 +1709,7 @@ IGNITION_HANDLER(TestInstanceOf, InterpreterAssembler) {
   TNode<HeapObject> maybe_feedback_vector = LoadFeedbackVector();
   TNode<Context> context = GetContext();
 
-  Label feedback_done(this);
-  GotoIf(IsUndefined(maybe_feedback_vector), &feedback_done);
-
-  // Record feedback for the {callable} in the {feedback_vector}.
-  CollectCallableFeedback(callable, context, CAST(maybe_feedback_vector),
-                          slot_id,
-                          CallableFeedbackMode::kDontCollectFeedbackCell);
-  Goto(&feedback_done);
-
-  BIND(&feedback_done);
-  // Perform the actual instanceof operation.
+  CollectInstanceOfFeedback(callable, context, maybe_feedback_vector, slot_id);
   SetAccumulator(InstanceOf(object, callable, context));
   Dispatch();
 }
@@ -2811,7 +2608,7 @@ IGNITION_HANDLER(CreateMappedArguments, InterpreterAssembler) {
   BIND(&if_duplicate_parameters);
   {
     TNode<Object> result =
-        CallRuntime(Runtime::kNewSloppyArguments_Generic, context, closure);
+        CallRuntime(Runtime::kNewSloppyArguments, context, closure);
     SetAccumulator(result);
     Dispatch();
   }
diff --git a/deps/v8/src/interpreter/interpreter.cc b/deps/v8/src/interpreter/interpreter.cc
index 805b6773578..3927dd9e921 100644
--- a/deps/v8/src/interpreter/interpreter.cc
+++ b/deps/v8/src/interpreter/interpreter.cc
@@ -149,10 +149,10 @@ InterpreterCompilationJob::InterpreterCompilationJob(
     AccountingAllocator* allocator,
     std::vector<FunctionLiteral*>* eager_inner_literals)
     : UnoptimizedCompilationJob(parse_info->stack_limit(), parse_info,
-                                &compilation_info_),
+                                &compilation_info_, CanOffThreadFinalize::kYes),
       zone_(allocator, ZONE_NAME),
       compilation_info_(&zone_, parse_info, literal),
-      generator_(&compilation_info_, parse_info->ast_string_constants(),
+      generator_(&zone_, &compilation_info_, parse_info->ast_string_constants(),
                  eager_inner_literals) {}
 
 InterpreterCompilationJob::Status InterpreterCompilationJob::ExecuteJobImpl() {
@@ -191,17 +191,18 @@ void InterpreterCompilationJob::CheckAndPrintBytecodeMismatch(
     std::cerr << "Bytecode mismatch";
 #ifdef OBJECT_PRINT
     std::cerr << " found for function: ";
-    Handle<String> name = parse_info()->function_name()->string();
-    if (name->length() == 0) {
-      std::cerr << "anonymous";
-    } else {
+    MaybeHandle<String> maybe_name = parse_info()->literal()->GetName(isolate);
+    Handle<String> name;
+    if (maybe_name.ToHandle(&name) && name->length() != 0) {
       name->StringPrint(std::cerr);
+    } else {
+      std::cerr << "anonymous";
     }
     Object script_name = script->GetNameOrSourceURL();
     if (script_name.IsString()) {
       std::cerr << " ";
       String::cast(script_name).StringPrint(std::cerr);
-      std::cerr << ":" << parse_info()->start_position();
+      std::cerr << ":" << parse_info()->literal()->start_position();
     }
 #endif
     std::cerr << "\nOriginal bytecode:\n";
diff --git a/deps/v8/src/libplatform/default-job.cc b/deps/v8/src/libplatform/default-job.cc
new file mode 100644
index 00000000000..7f750f185f6
--- /dev/null
+++ b/deps/v8/src/libplatform/default-job.cc
@@ -0,0 +1,150 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/libplatform/default-job.h"
+
+namespace v8 {
+namespace platform {
+
+DefaultJobState::~DefaultJobState() { DCHECK_EQ(0U, active_workers_); }
+
+void DefaultJobState::NotifyConcurrencyIncrease() {
+  if (is_canceled_.load(std::memory_order_relaxed)) return;
+
+  size_t num_tasks_to_post = 0;
+  {
+    base::MutexGuard guard(&mutex_);
+    const size_t max_concurrency = CappedMaxConcurrency();
+    // Consider |pending_tasks_| to avoid posting too many tasks.
+    if (max_concurrency > (active_workers_ + pending_tasks_)) {
+      num_tasks_to_post = max_concurrency - active_workers_ - pending_tasks_;
+      pending_tasks_ += num_tasks_to_post;
+    }
+  }
+  // Post additional worker tasks to reach |max_concurrency|.
+  for (size_t i = 0; i < num_tasks_to_post; ++i) {
+    CallOnWorkerThread(std::make_unique<DefaultJobWorker>(shared_from_this(),
+                                                          job_task_.get()));
+  }
+}
+
+void DefaultJobState::Join() {
+  bool can_run = false;
+  {
+    base::MutexGuard guard(&mutex_);
+    priority_ = TaskPriority::kUserBlocking;
+    // Reserve a worker for the joining thread. GetMaxConcurrency() is ignored
+    // here, but WaitForParticipationOpportunityLockRequired() waits for
+    // workers to return if necessary so we don't exceed GetMaxConcurrency().
+    num_worker_threads_ = platform_->NumberOfWorkerThreads() + 1;
+    ++active_workers_;
+    can_run = WaitForParticipationOpportunityLockRequired();
+  }
+  while (can_run) {
+    job_task_->Run(this);
+    base::MutexGuard guard(&mutex_);
+    can_run = WaitForParticipationOpportunityLockRequired();
+  }
+}
+
+void DefaultJobState::CancelAndWait() {
+  {
+    base::MutexGuard guard(&mutex_);
+    is_canceled_.store(true, std::memory_order_relaxed);
+    while (active_workers_ > 0) {
+      worker_released_condition_.Wait(&mutex_);
+    }
+  }
+}
+
+bool DefaultJobState::CanRunFirstTask() {
+  base::MutexGuard guard(&mutex_);
+  --pending_tasks_;
+  if (is_canceled_.load(std::memory_order_relaxed)) return false;
+  if (active_workers_ >=
+      std::min(job_task_->GetMaxConcurrency(), num_worker_threads_)) {
+    return false;
+  }
+  // Acquire current worker.
+  ++active_workers_;
+  return true;
+}
+
+bool DefaultJobState::DidRunTask() {
+  size_t num_tasks_to_post = 0;
+  {
+    base::MutexGuard guard(&mutex_);
+    const size_t max_concurrency = CappedMaxConcurrency();
+    if (is_canceled_.load(std::memory_order_relaxed) ||
+        active_workers_ > max_concurrency) {
+      // Release current worker and notify.
+      --active_workers_;
+      worker_released_condition_.NotifyOne();
+      return false;
+    }
+    // Consider |pending_tasks_| to avoid posting too many tasks.
+    if (max_concurrency > active_workers_ + pending_tasks_) {
+      num_tasks_to_post = max_concurrency - active_workers_ - pending_tasks_;
+      pending_tasks_ += num_tasks_to_post;
+    }
+  }
+  // Post additional worker tasks to reach |max_concurrency| in the case that
+  // max concurrency increased. This is not strictly necessary, since
+  // NotifyConcurrencyIncrease() should eventually be invoked. However, some
+  // users of PostJob() batch work and tend to call NotifyConcurrencyIncrease()
+  // late. Posting here allows us to spawn new workers sooner.
+  for (size_t i = 0; i < num_tasks_to_post; ++i) {
+    CallOnWorkerThread(std::make_unique<DefaultJobWorker>(shared_from_this(),
+                                                          job_task_.get()));
+  }
+  return true;
+}
+
+bool DefaultJobState::WaitForParticipationOpportunityLockRequired() {
+  size_t max_concurrency = CappedMaxConcurrency();
+  while (active_workers_ > max_concurrency && active_workers_ > 1) {
+    worker_released_condition_.Wait(&mutex_);
+    max_concurrency = CappedMaxConcurrency();
+  }
+  if (active_workers_ <= max_concurrency) return true;
+  DCHECK_EQ(1U, active_workers_);
+  DCHECK_EQ(0U, max_concurrency);
+  active_workers_ = 0;
+  is_canceled_.store(true, std::memory_order_relaxed);
+  return false;
+}
+
+size_t DefaultJobState::CappedMaxConcurrency() const {
+  return std::min(job_task_->GetMaxConcurrency(), num_worker_threads_);
+}
+
+void DefaultJobState::CallOnWorkerThread(std::unique_ptr<Task> task) {
+  switch (priority_) {
+    case TaskPriority::kBestEffort:
+      return platform_->CallLowPriorityTaskOnWorkerThread(std::move(task));
+    case TaskPriority::kUserVisible:
+      return platform_->CallOnWorkerThread(std::move(task));
+    case TaskPriority::kUserBlocking:
+      return platform_->CallBlockingTaskOnWorkerThread(std::move(task));
+  }
+}
+
+DefaultJobHandle::DefaultJobHandle(std::shared_ptr<DefaultJobState> state)
+    : state_(std::move(state)) {
+  state_->NotifyConcurrencyIncrease();
+}
+
+DefaultJobHandle::~DefaultJobHandle() { DCHECK_EQ(nullptr, state_); }
+
+void DefaultJobHandle::Join() {
+  state_->Join();
+  state_ = nullptr;
+}
+void DefaultJobHandle::Cancel() {
+  state_->CancelAndWait();
+  state_ = nullptr;
+}
+
+}  // namespace platform
+}  // namespace v8
diff --git a/deps/v8/src/libplatform/default-job.h b/deps/v8/src/libplatform/default-job.h
new file mode 100644
index 00000000000..2eb00cbd748
--- /dev/null
+++ b/deps/v8/src/libplatform/default-job.h
@@ -0,0 +1,126 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_LIBPLATFORM_DEFAULT_JOB_H_
+#define V8_LIBPLATFORM_DEFAULT_JOB_H_
+
+#include <atomic>
+#include <memory>
+
+#include "include/libplatform/libplatform-export.h"
+#include "include/v8-platform.h"
+#include "src/base/platform/condition-variable.h"
+#include "src/base/platform/mutex.h"
+
+namespace v8 {
+namespace platform {
+
+class V8_PLATFORM_EXPORT DefaultJobState
+    : NON_EXPORTED_BASE(public JobDelegate),
+      public std::enable_shared_from_this<DefaultJobState> {
+ public:
+  DefaultJobState(Platform* platform, std::unique_ptr<JobTask> job_task,
+                  TaskPriority priority, size_t num_worker_threads)
+      : platform_(platform),
+        job_task_(std::move(job_task)),
+        priority_(priority),
+        num_worker_threads_(num_worker_threads) {}
+  virtual ~DefaultJobState();
+
+  void NotifyConcurrencyIncrease() override;
+  bool ShouldYield() override {
+    // Thread-safe but may return an outdated result.
+    return is_canceled_.load(std::memory_order_relaxed);
+  }
+
+  void Join();
+  void CancelAndWait();
+
+  // Must be called before running |job_task_| for the first time. If it returns
+  // true, then the worker thread must contribute and must call DidRunTask(), or
+  // false if it should return.
+  bool CanRunFirstTask();
+  // Must be called after running |job_task_|. Returns true if the worker thread
+  // must contribute again, or false if it should return.
+  bool DidRunTask();
+
+ private:
+  // Called from the joining thread. Waits for the worker count to be below or
+  // equal to max concurrency (will happen when a worker calls
+  // DidRunTask()). Returns true if the joining thread should run a task, or
+  // false if joining was completed and all other workers returned because
+  // there's no work remaining.
+  bool WaitForParticipationOpportunityLockRequired();
+
+  // Returns GetMaxConcurrency() capped by the number of threads used by this
+  // job.
+  size_t CappedMaxConcurrency() const;
+
+  void CallOnWorkerThread(std::unique_ptr<Task> task);
+
+  Platform* const platform_;
+  std::unique_ptr<JobTask> job_task_;
+
+  // All members below are protected by |mutex_|.
+  base::Mutex mutex_;
+  TaskPriority priority_;
+  // Number of workers running this job.
+  size_t active_workers_ = 0;
+  // Number of posted tasks that aren't running this job yet.
+  size_t pending_tasks_ = 0;
+  // Indicates if the job is canceled.
+  std::atomic_bool is_canceled_{false};
+  // Number of worker threads available to schedule the worker task.
+  size_t num_worker_threads_;
+  // Signaled when a worker returns.
+  base::ConditionVariable worker_released_condition_;
+};
+
+class V8_PLATFORM_EXPORT DefaultJobHandle : public JobHandle {
+ public:
+  explicit DefaultJobHandle(std::shared_ptr<DefaultJobState> state);
+  ~DefaultJobHandle() override;
+
+  void NotifyConcurrencyIncrease() override {
+    state_->NotifyConcurrencyIncrease();
+  }
+
+  void Join() override;
+  void Cancel() override;
+  bool IsRunning() override { return state_ != nullptr; }
+
+ private:
+  std::shared_ptr<DefaultJobState> state_;
+
+  DISALLOW_COPY_AND_ASSIGN(DefaultJobHandle);
+};
+
+class DefaultJobWorker : public Task {
+ public:
+  DefaultJobWorker(std::weak_ptr<DefaultJobState> state, JobTask* job_task)
+      : state_(std::move(state)), job_task_(job_task) {}
+  ~DefaultJobWorker() override = default;
+
+  void Run() override {
+    auto shared_state = state_.lock();
+    if (!shared_state) return;
+    if (!shared_state->CanRunFirstTask()) return;
+    do {
+      job_task_->Run(shared_state.get());
+    } while (shared_state->DidRunTask());
+  }
+
+ private:
+  friend class DefaultJob;
+
+  std::weak_ptr<DefaultJobState> state_;
+  JobTask* job_task_;
+
+  DISALLOW_COPY_AND_ASSIGN(DefaultJobWorker);
+};
+
+}  // namespace platform
+}  // namespace v8
+
+#endif  // V8_LIBPLATFORM_DEFAULT_JOB_H_
diff --git a/deps/v8/src/libplatform/default-platform.cc b/deps/v8/src/libplatform/default-platform.cc
index ddbbd0d4be1..e380161eb07 100644
--- a/deps/v8/src/libplatform/default-platform.cc
+++ b/deps/v8/src/libplatform/default-platform.cc
@@ -15,6 +15,7 @@
 #include "src/base/platform/time.h"
 #include "src/base/sys-info.h"
 #include "src/libplatform/default-foreground-task-runner.h"
+#include "src/libplatform/default-job.h"
 #include "src/libplatform/default-worker-threads-task-runner.h"
 
 namespace v8 {
@@ -38,11 +39,10 @@ std::unique_ptr<v8::Platform> NewDefaultPlatform(
   if (in_process_stack_dumping == InProcessStackDumping::kEnabled) {
     v8::base::debug::EnableInProcessStackDumping();
   }
-  std::unique_ptr<DefaultPlatform> platform(
-      new DefaultPlatform(idle_task_support, std::move(tracing_controller)));
-  platform->SetThreadPoolSize(thread_pool_size);
+  auto platform = std::make_unique<DefaultPlatform>(
+      thread_pool_size, idle_task_support, std::move(tracing_controller));
   platform->EnsureBackgroundTaskRunnerInitialized();
-  return std::move(platform);
+  return platform;
 }
 
 bool PumpMessageLoop(v8::Platform* platform, v8::Isolate* isolate,
@@ -64,19 +64,30 @@ void SetTracingController(
       std::unique_ptr<v8::TracingController>(tracing_controller));
 }
 
-const int DefaultPlatform::kMaxThreadPoolSize = 8;
+namespace {
+constexpr int kMaxThreadPoolSize = 16;
+
+int GetActualThreadPoolSize(int thread_pool_size) {
+  DCHECK_GE(thread_pool_size, 0);
+  if (thread_pool_size < 1) {
+    thread_pool_size = base::SysInfo::NumberOfProcessors() - 1;
+  }
+  return std::max(std::min(thread_pool_size, kMaxThreadPoolSize), 1);
+}
+}  // namespace
 
 DefaultPlatform::DefaultPlatform(
-    IdleTaskSupport idle_task_support,
+    int thread_pool_size, IdleTaskSupport idle_task_support,
     std::unique_ptr<v8::TracingController> tracing_controller)
-    : thread_pool_size_(0),
+    : thread_pool_size_(GetActualThreadPoolSize(thread_pool_size)),
       idle_task_support_(idle_task_support),
       tracing_controller_(std::move(tracing_controller)),
-      page_allocator_(new v8::base::PageAllocator()),
-      time_function_for_testing_(nullptr) {
+      page_allocator_(std::make_unique<v8::base::PageAllocator>()) {
   if (!tracing_controller_) {
     tracing::TracingController* controller = new tracing::TracingController();
+#if !defined(V8_USE_PERFETTO)
     controller->Initialize(nullptr);
+#endif
     tracing_controller_.reset(controller);
   }
 }
@@ -84,21 +95,11 @@ DefaultPlatform::DefaultPlatform(
 DefaultPlatform::~DefaultPlatform() {
   base::MutexGuard guard(&lock_);
   if (worker_threads_task_runner_) worker_threads_task_runner_->Terminate();
-  for (auto it : foreground_task_runner_map_) {
+  for (const auto& it : foreground_task_runner_map_) {
     it.second->Terminate();
   }
 }
 
-void DefaultPlatform::SetThreadPoolSize(int thread_pool_size) {
-  base::MutexGuard guard(&lock_);
-  DCHECK_GE(thread_pool_size, 0);
-  if (thread_pool_size < 1) {
-    thread_pool_size = base::SysInfo::NumberOfProcessors() - 1;
-  }
-  thread_pool_size_ =
-      std::max(std::min(thread_pool_size, kMaxThreadPoolSize), 1);
-}
-
 namespace {
 
 double DefaultTimeFunction() {
@@ -199,6 +200,24 @@ bool DefaultPlatform::IdleTasksEnabled(Isolate* isolate) {
   return idle_task_support_ == IdleTaskSupport::kEnabled;
 }
 
+std::unique_ptr<JobHandle> DefaultPlatform::PostJob(
+    TaskPriority priority, std::unique_ptr<JobTask> job_task) {
+  size_t num_worker_threads = 0;
+  switch (priority) {
+    case TaskPriority::kUserBlocking:
+      num_worker_threads = NumberOfWorkerThreads();
+      break;
+    case TaskPriority::kUserVisible:
+      num_worker_threads = NumberOfWorkerThreads() / 2;
+      break;
+    case TaskPriority::kBestEffort:
+      num_worker_threads = 1;
+      break;
+  }
+  return std::make_unique<DefaultJobHandle>(std::make_shared<DefaultJobState>(
+      this, std::move(job_task), priority, num_worker_threads));
+}
+
 double DefaultPlatform::MonotonicallyIncreasingTime() {
   if (time_function_for_testing_) return time_function_for_testing_();
   return DefaultTimeFunction();
diff --git a/deps/v8/src/libplatform/default-platform.h b/deps/v8/src/libplatform/default-platform.h
index f49277954cd..d459e32490b 100644
--- a/deps/v8/src/libplatform/default-platform.h
+++ b/deps/v8/src/libplatform/default-platform.h
@@ -5,11 +5,8 @@
 #ifndef V8_LIBPLATFORM_DEFAULT_PLATFORM_H_
 #define V8_LIBPLATFORM_DEFAULT_PLATFORM_H_
 
-#include <functional>
 #include <map>
 #include <memory>
-#include <queue>
-#include <vector>
 
 #include "include/libplatform/libplatform-export.h"
 #include "include/libplatform/libplatform.h"
@@ -32,13 +29,12 @@ class DefaultPageAllocator;
 class V8_PLATFORM_EXPORT DefaultPlatform : public NON_EXPORTED_BASE(Platform) {
  public:
   explicit DefaultPlatform(
+      int thread_pool_size = 0,
       IdleTaskSupport idle_task_support = IdleTaskSupport::kDisabled,
       std::unique_ptr<v8::TracingController> tracing_controller = {});
 
   ~DefaultPlatform() override;
 
-  void SetThreadPoolSize(int thread_pool_size);
-
   void EnsureBackgroundTaskRunnerInitialized();
 
   bool PumpMessageLoop(
@@ -62,6 +58,8 @@ class V8_PLATFORM_EXPORT DefaultPlatform : public NON_EXPORTED_BASE(Platform) {
   void CallDelayedOnWorkerThread(std::unique_ptr<Task> task,
                                  double delay_in_seconds) override;
   bool IdleTasksEnabled(Isolate* isolate) override;
+  std::unique_ptr<JobHandle> PostJob(
+      TaskPriority priority, std::unique_ptr<JobTask> job_state) override;
   double MonotonicallyIncreasingTime() override;
   double CurrentClockTimeMillis() override;
   v8::TracingController* GetTracingController() override;
@@ -69,10 +67,8 @@ class V8_PLATFORM_EXPORT DefaultPlatform : public NON_EXPORTED_BASE(Platform) {
   v8::PageAllocator* GetPageAllocator() override;
 
  private:
-  static const int kMaxThreadPoolSize;
-
   base::Mutex lock_;
-  int thread_pool_size_;
+  const int thread_pool_size_;
   IdleTaskSupport idle_task_support_;
   std::shared_ptr<DefaultWorkerThreadsTaskRunner> worker_threads_task_runner_;
   std::map<v8::Isolate*, std::shared_ptr<DefaultForegroundTaskRunner>>
@@ -81,7 +77,7 @@ class V8_PLATFORM_EXPORT DefaultPlatform : public NON_EXPORTED_BASE(Platform) {
   std::unique_ptr<TracingController> tracing_controller_;
   std::unique_ptr<PageAllocator> page_allocator_;
 
-  TimeFunction time_function_for_testing_;
+  TimeFunction time_function_for_testing_ = nullptr;
   DISALLOW_COPY_AND_ASSIGN(DefaultPlatform);
 };
 
diff --git a/deps/v8/src/libplatform/tracing/json-trace-event-listener.cc b/deps/v8/src/libplatform/tracing/json-trace-event-listener.cc
deleted file mode 100644
index 60cc9a98a8b..00000000000
--- a/deps/v8/src/libplatform/tracing/json-trace-event-listener.cc
+++ /dev/null
@@ -1,168 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/libplatform/tracing/json-trace-event-listener.h"
-
-#include <cmath>
-
-#include "base/trace_event/common/trace_event_common.h"
-#include "perfetto/tracing.h"
-#include "protos/perfetto/trace/chrome/chrome_trace_packet.pb.h"
-#include "protos/perfetto/trace/trace.pb.h"
-#include "src/base/logging.h"
-#include "src/base/macros.h"
-
-namespace v8 {
-namespace platform {
-namespace tracing {
-
-JSONTraceEventListener::JSONTraceEventListener(std::ostream* stream)
-    : stream_(stream) {
-  *stream_ << "{\"traceEvents\":[";
-}
-
-JSONTraceEventListener::~JSONTraceEventListener() { *stream_ << "]}"; }
-
-// TODO(petermarshall): Clean up this code which was copied from trace-writer.cc
-// once we've removed that file.
-
-// Writes the given string, taking care to escape characters when necessary.
-void JSONTraceEventListener::AppendJSONString(const char* str) {
-  size_t len = strlen(str);
-  *stream_ << "\"";
-  for (size_t i = 0; i < len; ++i) {
-    // All of the permitted escape sequences in JSON strings, as per
-    // https://mathiasbynens.be/notes/javascript-escapes
-    switch (str[i]) {
-      case '\b':
-        *stream_ << "\\b";
-        break;
-      case '\f':
-        *stream_ << "\\f";
-        break;
-      case '\n':
-        *stream_ << "\\n";
-        break;
-      case '\r':
-        *stream_ << "\\r";
-        break;
-      case '\t':
-        *stream_ << "\\t";
-        break;
-      case '\"':
-        *stream_ << "\\\"";
-        break;
-      case '\\':
-        *stream_ << "\\\\";
-        break;
-      // Note that because we use double quotes for JSON strings,
-      // we don't need to escape single quotes.
-      default:
-        *stream_ << str[i];
-        break;
-    }
-  }
-  *stream_ << "\"";
-}
-
-void JSONTraceEventListener::AppendArgValue(
-    const ::perfetto::protos::ChromeTraceEvent_Arg& arg) {
-  if (arg.has_bool_value()) {
-    *stream_ << (arg.bool_value() ? "true" : "false");
-  } else if (arg.has_uint_value()) {
-    *stream_ << arg.uint_value();
-  } else if (arg.has_int_value()) {
-    *stream_ << arg.int_value();
-  } else if (arg.has_double_value()) {
-    std::string real;
-    double val = arg.double_value();
-    if (std::isfinite(val)) {
-      std::ostringstream convert_stream;
-      convert_stream << val;
-      real = convert_stream.str();
-      // Ensure that the number has a .0 if there's no decimal or 'e'.  This
-      // makes sure that when we read the JSON back, it's interpreted as a
-      // real rather than an int.
-      if (real.find('.') == std::string::npos &&
-          real.find('e') == std::string::npos &&
-          real.find('E') == std::string::npos) {
-        real += ".0";
-      }
-    } else if (std::isnan(val)) {
-      // The JSON spec doesn't allow NaN and Infinity (since these are
-      // objects in EcmaScript).  Use strings instead.
-      real = "\"NaN\"";
-    } else if (val < 0) {
-      real = "\"-Infinity\"";
-    } else {
-      real = "\"Infinity\"";
-    }
-    *stream_ << real;
-  } else if (arg.has_string_value()) {
-    AppendJSONString(arg.string_value().c_str());
-  } else if (arg.has_pointer_value()) {
-    // JSON only supports double and int numbers.
-    // So as not to lose bits from a 64-bit pointer, output as a hex string.
-    *stream_ << "\"0x" << std::hex << arg.pointer_value() << std::dec << "\"";
-  } else if (arg.has_json_value()) {
-    *stream_ << arg.json_value();
-  }
-  // V8 does not emit proto arguments currently.
-  CHECK(!arg.has_traced_value());
-}
-
-void JSONTraceEventListener::ProcessPacket(
-    const ::perfetto::protos::TracePacket& packet) {
-  for (const ::perfetto::protos::ChromeTraceEvent& event :
-       packet.chrome_events().trace_events()) {
-    if (append_comma_) *stream_ << ",";
-    append_comma_ = true;
-
-    // TODO(petermarshall): Handle int64 fields differently?
-    // clang-format off
-    *stream_ << "{\"pid\":" << event.process_id()
-            << ",\"tid\":" << event.thread_id()
-            << ",\"ts\":" << event.timestamp()
-            << ",\"tts\":" << event.thread_timestamp()
-            << ",\"ph\":\"" << static_cast<char>(event.phase())
-            << "\",\"cat\":\"" << event.category_group_name()
-            << "\",\"name\":\"" << event.name()
-            << "\",\"dur\":" << event.duration()
-            << ",\"tdur\":" << event.thread_duration();
-    // clang-format on
-
-    if (event.flags() &
-        (TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT)) {
-      *stream_ << ",\"bind_id\":\"0x" << std::hex << event.bind_id() << "\""
-               << std::dec;
-      if (event.flags() & TRACE_EVENT_FLAG_FLOW_IN) {
-        *stream_ << ",\"flow_in\":true";
-      }
-      if (event.flags() & TRACE_EVENT_FLAG_FLOW_OUT) {
-        *stream_ << ",\"flow_out\":true";
-      }
-    }
-    if (event.flags() & TRACE_EVENT_FLAG_HAS_ID) {
-      if (event.has_scope()) {
-        *stream_ << ",\"scope\":\"" << event.scope() << "\"";
-      }
-      // So as not to lose bits from a 64-bit integer, output as a hex string.
-      *stream_ << ",\"id\":\"0x" << std::hex << event.id() << "\"" << std::dec;
-    }
-
-    *stream_ << ",\"args\":{";
-
-    int i = 0;
-    for (const ::perfetto::protos::ChromeTraceEvent_Arg& arg : event.args()) {
-      if (i++ > 0) *stream_ << ",";
-      *stream_ << "\"" << arg.name() << "\":";
-      AppendArgValue(arg);
-    }
-    *stream_ << "}}";
-  }
-}
-
-}  // namespace tracing
-}  // namespace platform
-}  // namespace v8
diff --git a/deps/v8/src/libplatform/tracing/json-trace-event-listener.h b/deps/v8/src/libplatform/tracing/json-trace-event-listener.h
deleted file mode 100644
index a0ab31c9813..00000000000
--- a/deps/v8/src/libplatform/tracing/json-trace-event-listener.h
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_LIBPLATFORM_TRACING_JSON_TRACE_EVENT_LISTENER_H_
-#define V8_LIBPLATFORM_TRACING_JSON_TRACE_EVENT_LISTENER_H_
-
-#include <ostream>
-
-#include "libplatform/libplatform-export.h"
-#include "src/libplatform/tracing/trace-event-listener.h"
-
-namespace perfetto {
-namespace protos {
-class ChromeTraceEvent_Arg;
-}  // namespace protos
-}  // namespace perfetto
-
-namespace v8 {
-namespace platform {
-namespace tracing {
-
-// A listener that converts the proto trace data to JSON and writes it to a
-// file.
-class V8_PLATFORM_EXPORT JSONTraceEventListener final
-    : public TraceEventListener {
- public:
-  explicit JSONTraceEventListener(std::ostream* stream);
-  ~JSONTraceEventListener() override;
-
-  void ProcessPacket(const ::perfetto::protos::TracePacket& packet) override;
-
- private:
-  // Internal implementation
-  void AppendJSONString(const char* str);
-  void AppendArgValue(const ::perfetto::protos::ChromeTraceEvent_Arg& arg);
-
-  std::ostream* stream_;
-  bool append_comma_ = false;
-};
-
-}  // namespace tracing
-}  // namespace platform
-}  // namespace v8
-
-#endif  // V8_LIBPLATFORM_TRACING_JSON_TRACE_EVENT_LISTENER_H_
diff --git a/deps/v8/src/libplatform/tracing/tracing-controller.cc b/deps/v8/src/libplatform/tracing/tracing-controller.cc
index fdbfdddb512..2019b3ef5bc 100644
--- a/deps/v8/src/libplatform/tracing/tracing-controller.cc
+++ b/deps/v8/src/libplatform/tracing/tracing-controller.cc
@@ -13,30 +13,38 @@
 #include "src/base/platform/time.h"
 
 #ifdef V8_USE_PERFETTO
-#include "base/trace_event/common/trace_event_common.h"
-#include "perfetto/tracing.h"
-#include "protos/perfetto/trace/chrome/chrome_trace_event.pbzero.h"
-#include "protos/perfetto/trace/trace_packet.pbzero.h"
+#include "perfetto/ext/trace_processor/export_json.h"
+#include "perfetto/trace_processor/trace_processor.h"
+#include "perfetto/tracing/tracing.h"
+#include "protos/perfetto/config/data_source_config.gen.h"
+#include "protos/perfetto/config/trace_config.gen.h"
+#include "protos/perfetto/config/track_event/track_event_config.gen.h"
 #include "src/base/platform/platform.h"
 #include "src/base/platform/semaphore.h"
-#include "src/libplatform/tracing/json-trace-event-listener.h"
+#include "src/libplatform/tracing/trace-event-listener.h"
 #endif  // V8_USE_PERFETTO
 
 #ifdef V8_USE_PERFETTO
-class V8DataSource : public perfetto::DataSource<V8DataSource> {
+class JsonOutputWriter : public perfetto::trace_processor::json::OutputWriter {
  public:
-  void OnSetup(const SetupArgs&) override {}
-  void OnStart(const StartArgs&) override {}
-  void OnStop(const StopArgs&) override {}
-};
+  explicit JsonOutputWriter(std::ostream* stream) : stream_(stream) {}
+
+  perfetto::trace_processor::util::Status AppendString(
+      const std::string& string) override {
+    *stream_ << string;
+    return perfetto::trace_processor::util::OkStatus();
+  }
 
-PERFETTO_DEFINE_DATA_SOURCE_STATIC_MEMBERS(V8DataSource);
+ private:
+  std::ostream* stream_;
+};
 #endif  // V8_USE_PERFETTO
 
 namespace v8 {
 namespace platform {
 namespace tracing {
 
+#if !defined(V8_USE_PERFETTO)
 static const size_t kMaxCategoryGroups = 200;
 
 // Parallel arrays g_category_groups and g_category_group_enabled are separate
@@ -60,12 +68,14 @@ const int g_num_builtin_categories = 3;
 
 // Skip default categories.
 v8::base::AtomicWord g_category_index = g_num_builtin_categories;
+#endif  // !defined(V8_USE_PERFETTO)
 
-TracingController::TracingController() = default;
+TracingController::TracingController() { mutex_.reset(new base::Mutex()); }
 
 TracingController::~TracingController() {
   StopTracing();
 
+#if !defined(V8_USE_PERFETTO)
   {
     // Free memory for category group names allocated via strdup.
     base::MutexGuard lock(mutex_.get());
@@ -76,11 +86,7 @@ TracingController::~TracingController() {
     }
     g_category_index = g_num_builtin_categories;
   }
-}
-
-void TracingController::Initialize(TraceBuffer* trace_buffer) {
-  trace_buffer_.reset(trace_buffer);
-  mutex_.reset(new base::Mutex());
+#endif  // !defined(V8_USE_PERFETTO)
 }
 
 #ifdef V8_USE_PERFETTO
@@ -88,14 +94,16 @@ void TracingController::InitializeForPerfetto(std::ostream* output_stream) {
   output_stream_ = output_stream;
   DCHECK_NOT_NULL(output_stream);
   DCHECK(output_stream->good());
-  mutex_.reset(new base::Mutex());
 }
 
 void TracingController::SetTraceEventListenerForTesting(
     TraceEventListener* listener) {
   listener_for_testing_ = listener;
 }
-#endif
+#else   // !V8_USE_PERFETTO
+void TracingController::Initialize(TraceBuffer* trace_buffer) {
+  trace_buffer_.reset(trace_buffer);
+}
 
 int64_t TracingController::CurrentTimestampMicroseconds() {
   return base::TimeTicks::HighResolutionNow().ToInternalValue();
@@ -105,60 +113,6 @@ int64_t TracingController::CurrentCpuTimestampMicroseconds() {
   return base::ThreadTicks::Now().ToInternalValue();
 }
 
-namespace {
-
-#ifdef V8_USE_PERFETTO
-void AddArgsToTraceProto(
-    ::perfetto::protos::pbzero::ChromeTraceEvent* event, int num_args,
-    const char** arg_names, const uint8_t* arg_types,
-    const uint64_t* arg_values,
-    std::unique_ptr<v8::ConvertableToTraceFormat>* arg_convertables) {
-  for (int i = 0; i < num_args; i++) {
-    ::perfetto::protos::pbzero::ChromeTraceEvent_Arg* arg = event->add_args();
-    // TODO(petermarshall): Set name_index instead if need be.
-    arg->set_name(arg_names[i]);
-
-    TraceObject::ArgValue arg_value;
-    arg_value.as_uint = arg_values[i];
-    switch (arg_types[i]) {
-      case TRACE_VALUE_TYPE_CONVERTABLE: {
-        // TODO(petermarshall): Support AppendToProto for Convertables.
-        std::string json_value;
-        arg_convertables[i]->AppendAsTraceFormat(&json_value);
-        arg->set_json_value(json_value.c_str());
-        break;
-      }
-      case TRACE_VALUE_TYPE_BOOL:
-        arg->set_bool_value(arg_value.as_uint);
-        break;
-      case TRACE_VALUE_TYPE_UINT:
-        arg->set_uint_value(arg_value.as_uint);
-        break;
-      case TRACE_VALUE_TYPE_INT:
-        arg->set_int_value(arg_value.as_int);
-        break;
-      case TRACE_VALUE_TYPE_DOUBLE:
-        arg->set_double_value(arg_value.as_double);
-        break;
-      case TRACE_VALUE_TYPE_POINTER:
-        arg->set_pointer_value(arg_value.as_uint);
-        break;
-      // There is no difference between copy strings and regular strings for
-      // Perfetto; the set_string_value(const char*) API will copy the string
-      // into the protobuf by default.
-      case TRACE_VALUE_TYPE_COPY_STRING:
-      case TRACE_VALUE_TYPE_STRING:
-        arg->set_string_value(arg_value.as_string);
-        break;
-      default:
-        UNREACHABLE();
-    }
-  }
-}
-#endif  // V8_USE_PERFETTO
-
-}  // namespace
-
 uint64_t TracingController::AddTraceEvent(
     char phase, const uint8_t* category_enabled_flag, const char* name,
     const char* scope, uint64_t id, uint64_t bind_id, int num_args,
@@ -182,42 +136,6 @@ uint64_t TracingController::AddTraceEventWithTimestamp(
     unsigned int flags, int64_t timestamp) {
   int64_t cpu_now_us = CurrentCpuTimestampMicroseconds();
 
-#ifdef V8_USE_PERFETTO
-    // Don't use COMPLETE events with perfetto - instead transform them into
-    // BEGIN/END pairs. This avoids the need for a thread-local stack of pending
-    // trace events as perfetto does not support handles into the trace buffer.
-    if (phase == TRACE_EVENT_PHASE_COMPLETE) phase = TRACE_EVENT_PHASE_BEGIN;
-
-    V8DataSource::Trace([&](V8DataSource::TraceContext ctx) {
-      auto packet = ctx.NewTracePacket();
-      auto* trace_event_bundle = packet->set_chrome_events();
-      auto* trace_event = trace_event_bundle->add_trace_events();
-
-      trace_event->set_name(name);
-      trace_event->set_timestamp(timestamp);
-      trace_event->set_phase(phase);
-      trace_event->set_thread_id(base::OS::GetCurrentThreadId());
-      trace_event->set_duration(0);
-      trace_event->set_thread_duration(0);
-      if (scope) trace_event->set_scope(scope);
-      trace_event->set_id(id);
-      trace_event->set_flags(flags);
-      if (category_enabled_flag) {
-        const char* category_group_name =
-            GetCategoryGroupName(category_enabled_flag);
-        DCHECK_NOT_NULL(category_group_name);
-        trace_event->set_category_group_name(category_group_name);
-      }
-      trace_event->set_process_id(base::OS::GetCurrentProcessId());
-      trace_event->set_thread_timestamp(cpu_now_us);
-      trace_event->set_bind_id(bind_id);
-
-      AddArgsToTraceProto(trace_event, num_args, arg_names, arg_types,
-                          arg_values, arg_convertables);
-    });
-    return 0;
-#else
-
   uint64_t handle = 0;
   if (recording_.load(std::memory_order_acquire)) {
     TraceObject* trace_object = trace_buffer_->AddTraceEvent(&handle);
@@ -232,7 +150,6 @@ uint64_t TracingController::AddTraceEventWithTimestamp(
     }
   }
   return handle;
-#endif  // V8_USE_PERFETTO
 }
 
 void TracingController::UpdateTraceEventDuration(
@@ -240,24 +157,9 @@ void TracingController::UpdateTraceEventDuration(
   int64_t now_us = CurrentTimestampMicroseconds();
   int64_t cpu_now_us = CurrentCpuTimestampMicroseconds();
 
-#ifdef V8_USE_PERFETTO
-  V8DataSource::Trace([&](V8DataSource::TraceContext ctx) {
-    auto packet = ctx.NewTracePacket();
-    auto* trace_event_bundle = packet->set_chrome_events();
-    auto* trace_event = trace_event_bundle->add_trace_events();
-
-    trace_event->set_phase(TRACE_EVENT_PHASE_END);
-    trace_event->set_thread_id(base::OS::GetCurrentThreadId());
-    trace_event->set_timestamp(now_us);
-    trace_event->set_process_id(base::OS::GetCurrentProcessId());
-    trace_event->set_thread_timestamp(cpu_now_us);
-  });
-#else
-
   TraceObject* trace_object = trace_buffer_->GetEventByHandle(handle);
   if (!trace_object) return;
   trace_object->UpdateDuration(now_us, cpu_now_us);
-#endif  // V8_USE_PERFETTO
 }
 
 const char* TracingController::GetCategoryGroupName(
@@ -275,23 +177,26 @@ const char* TracingController::GetCategoryGroupName(
       (category_ptr - category_begin) / sizeof(g_category_group_enabled[0]);
   return g_category_groups[category_index];
 }
+#endif  // !defined(V8_USE_PERFETTO)
 
 void TracingController::StartTracing(TraceConfig* trace_config) {
 #ifdef V8_USE_PERFETTO
   DCHECK_NOT_NULL(output_stream_);
   DCHECK(output_stream_->good());
-  json_listener_ = std::make_unique<JSONTraceEventListener>(output_stream_);
+  perfetto::trace_processor::Config processor_config;
+  trace_processor_ =
+      perfetto::trace_processor::TraceProcessorStorage::CreateInstance(
+          processor_config);
 
-  // TODO(petermarshall): Set other the params for the config.
   ::perfetto::TraceConfig perfetto_trace_config;
   perfetto_trace_config.add_buffers()->set_size_kb(4096);
-  auto* ds_config = perfetto_trace_config.add_data_sources()->mutable_config();
-  ds_config->set_name("v8.trace_events");
-
-  perfetto::DataSourceDescriptor dsd;
-  dsd.set_name("v8.trace_events");
-  bool registered = V8DataSource::Register(dsd);
-  CHECK(registered);
+  auto ds_config = perfetto_trace_config.add_data_sources()->mutable_config();
+  ds_config->set_name("track_event");
+  perfetto::protos::gen::TrackEventConfig te_config;
+  te_config.add_disabled_categories("*");
+  for (const auto& category : trace_config->GetEnabledCategories())
+    te_config.add_enabled_categories(category);
+  ds_config->set_track_event_config_raw(te_config.SerializeAsString());
 
   tracing_session_ =
       perfetto::Tracing::NewTrace(perfetto::BackendType::kUnspecifiedBackend);
@@ -305,7 +210,9 @@ void TracingController::StartTracing(TraceConfig* trace_config) {
   {
     base::MutexGuard lock(mutex_.get());
     recording_.store(true, std::memory_order_release);
+#ifndef V8_USE_PERFETTO
     UpdateCategoryGroupEnabledFlags();
+#endif
     observers_copy = observers_;
   }
   for (auto o : observers_copy) {
@@ -318,7 +225,9 @@ void TracingController::StopTracing() {
   if (!recording_.compare_exchange_strong(expected, false)) {
     return;
   }
+#ifndef V8_USE_PERFETTO
   UpdateCategoryGroupEnabledFlags();
+#endif
   std::unordered_set<v8::TracingController::TraceStateObserver*> observers_copy;
   {
     base::MutexGuard lock(mutex_.get());
@@ -329,23 +238,21 @@ void TracingController::StopTracing() {
   }
 
 #ifdef V8_USE_PERFETTO
-  // Emit a fake trace event from the main thread. The final trace event is
-  // sometimes skipped because perfetto can't guarantee that the caller is
-  // totally finished writing to it without synchronization. To avoid the
-  // situation where we lose the last trace event, add a fake one here that will
-  // be sacrificed.
-  // TODO(petermarshall): Use the Client API to flush here rather than this
-  // workaround when that becomes available.
-  V8DataSource::Trace([&](V8DataSource::TraceContext ctx) {
-    auto packet = ctx.NewTracePacket();
-  });
   tracing_session_->StopBlocking();
 
   std::vector<char> trace = tracing_session_->ReadTraceBlocking();
-  json_listener_->ParseFromArray(trace);
+  std::unique_ptr<uint8_t[]> trace_bytes(new uint8_t[trace.size()]);
+  std::copy(&trace[0], &trace[0] + trace.size(), &trace_bytes[0]);
+  trace_processor_->Parse(std::move(trace_bytes), trace.size());
+  trace_processor_->NotifyEndOfFile();
+  JsonOutputWriter output_writer(output_stream_);
+  auto status = perfetto::trace_processor::json::ExportJson(
+      trace_processor_.get(), &output_writer, nullptr, nullptr, nullptr);
+  DCHECK(status.ok());
+
   if (listener_for_testing_) listener_for_testing_->ParseFromArray(trace);
 
-  json_listener_.reset();
+  trace_processor_.reset();
 #else
 
   {
@@ -356,6 +263,7 @@ void TracingController::StopTracing() {
 #endif  // V8_USE_PERFETTO
 }
 
+#if !defined(V8_USE_PERFETTO)
 void TracingController::UpdateCategoryGroupEnabledFlag(size_t category_index) {
   unsigned char enabled_flag = 0;
   const char* category_group = g_category_groups[category_index];
@@ -433,6 +341,7 @@ const uint8_t* TracingController::GetCategoryGroupEnabled(
   }
   return category_group_enabled;
 }
+#endif  // !defined(V8_USE_PERFETTO)
 
 void TracingController::AddTraceStateObserver(
     v8::TracingController::TraceStateObserver* observer) {
diff --git a/deps/v8/src/logging/counters-definitions.h b/deps/v8/src/logging/counters-definitions.h
index 32f7e3e652b..1d44b4c833b 100644
--- a/deps/v8/src/logging/counters-definitions.h
+++ b/deps/v8/src/logging/counters-definitions.h
@@ -79,6 +79,10 @@ namespace internal {
      V8.WasmModuleNumberOfCodeGCsTriggered, 1, 128, 20)                        \
   /* number of code spaces reserved per wasm module */                         \
   HR(wasm_module_num_code_spaces, V8.WasmModuleNumberOfCodeSpaces, 1, 128, 20) \
+  /* number of live modules per isolate */                                     \
+  HR(wasm_modules_per_isolate, V8.WasmModulesPerIsolate, 1, 1024, 30)          \
+  /* number of live modules per engine (i.e. whole process) */                 \
+  HR(wasm_modules_per_engine, V8.WasmModulesPerEngine, 1, 1024, 30)            \
   /* bailout reason if Liftoff failed, or {kSuccess} (per function) */         \
   HR(liftoff_bailout_reasons, V8.LiftoffBailoutReasons, 0, 20, 21)             \
   /* Ticks observed in a single Turbofan compilation, in 1K */                 \
@@ -237,8 +241,6 @@ namespace internal {
 #define STATS_COUNTER_LIST_1(SC)                                   \
   /* Global Handle Count*/                                         \
   SC(global_handles, V8.GlobalHandles)                             \
-  /* OS Memory allocated */                                        \
-  SC(memory_allocated, V8.OsMemoryAllocated)                       \
   SC(maps_normalized, V8.MapsNormalized)                           \
   SC(maps_created, V8.MapsCreated)                                 \
   SC(elements_transitions, V8.ObjectElementsTransitions)           \
@@ -264,7 +266,7 @@ namespace internal {
   SC(total_compile_size, V8.TotalCompileSize)                      \
   /* Number of contexts created from scratch. */                   \
   SC(contexts_created_from_scratch, V8.ContextsCreatedFromScratch) \
-  /* Number of contexts created by partial snapshot. */            \
+  /* Number of contexts created by context snapshot. */            \
   SC(contexts_created_by_snapshot, V8.ContextsCreatedBySnapshot)   \
   /* Number of code objects found from pc. */                      \
   SC(pc_to_code, V8.PcToCode)                                      \
diff --git a/deps/v8/src/logging/counters.h b/deps/v8/src/logging/counters.h
index 44d42788965..02a6feee2e3 100644
--- a/deps/v8/src/logging/counters.h
+++ b/deps/v8/src/logging/counters.h
@@ -772,7 +772,6 @@ class RuntimeCallTimer final {
   V(Int8Array_New)                                         \
   V(Isolate_DateTimeConfigurationChangeNotification)       \
   V(Isolate_LocaleConfigurationChangeNotification)         \
-  V(FinalizationGroup_Cleanup)                             \
   V(JSON_Parse)                                            \
   V(JSON_Stringify)                                        \
   V(Map_AsArray)                                           \
@@ -895,6 +894,9 @@ class RuntimeCallTimer final {
   V(Value_NumberValue)                                     \
   V(Value_TypeOf)                                          \
   V(Value_Uint32Value)                                     \
+  V(WasmCompileError_New)                                  \
+  V(WasmLinkError_New)                                     \
+  V(WasmRuntimeError_New)                                  \
   V(WeakMap_Get)                                           \
   V(WeakMap_New)                                           \
   V(WeakMap_Set)
diff --git a/deps/v8/src/logging/log.cc b/deps/v8/src/logging/log.cc
index dc79ffda5e5..00edcc8c9b7 100644
--- a/deps/v8/src/logging/log.cc
+++ b/deps/v8/src/logging/log.cc
@@ -19,6 +19,7 @@
 #include "src/execution/runtime-profiler.h"
 #include "src/execution/vm-state-inl.h"
 #include "src/handles/global-handles.h"
+#include "src/heap/combined-heap.h"
 #include "src/init/bootstrapper.h"
 #include "src/interpreter/bytecodes.h"
 #include "src/interpreter/interpreter.h"
@@ -87,8 +88,6 @@ static const char* ComputeMarker(const wasm::WasmCode* code) {
   switch (code->kind()) {
     case wasm::WasmCode::kFunction:
       return code->is_liftoff() ? "" : "*";
-    case wasm::WasmCode::kInterpreterEntry:
-      return "~";
     default:
       return "";
   }
@@ -1838,7 +1837,7 @@ void Logger::LogAccessorCallbacks() {
 void Logger::LogAllMaps() {
   DisallowHeapAllocation no_gc;
   Heap* heap = isolate_->heap();
-  HeapObjectIterator iterator(heap);
+  CombinedHeapObjectIterator iterator(heap);
   for (HeapObject obj = iterator.Next(); !obj.is_null();
        obj = iterator.Next()) {
     if (!obj.IsMap()) continue;
@@ -2069,10 +2068,6 @@ void ExistingCodeLogger::LogCodeObject(Object object) {
       description = "A Wasm to JavaScript adapter";
       tag = CodeEventListener::STUB_TAG;
       break;
-    case AbstractCode::WASM_INTERPRETER_ENTRY:
-      description = "A Wasm to Interpreter adapter";
-      tag = CodeEventListener::STUB_TAG;
-      break;
     case AbstractCode::C_WASM_ENTRY:
       description = "A C to Wasm entry stub";
       tag = CodeEventListener::STUB_TAG;
diff --git a/deps/v8/src/logging/log.h b/deps/v8/src/logging/log.h
index 9e4dfeb28d2..70f562dee3f 100644
--- a/deps/v8/src/logging/log.h
+++ b/deps/v8/src/logging/log.h
@@ -72,13 +72,13 @@ class Ticker;
 #undef LOG
 #define LOG(isolate, Call)                  \
   do {                                      \
-    auto* logger = (isolate)->logger();     \
+    auto&& logger = (isolate)->logger();    \
     if (logger->is_logging()) logger->Call; \
   } while (false)
 
 #define LOG_CODE_EVENT(isolate, Call)                        \
   do {                                                       \
-    auto* logger = (isolate)->logger();                      \
+    auto&& logger = (isolate)->logger();                     \
     if (logger->is_listening_to_code_events()) logger->Call; \
   } while (false)
 
@@ -117,7 +117,7 @@ class Logger : public CodeEventListener {
   };
 
   explicit Logger(Isolate* isolate);
-  ~Logger();
+  ~Logger() override;
 
   // The separator is used to write an unescaped "," into the log.
   static const LogSeparator kNext;
diff --git a/deps/v8/src/logging/off-thread-logger.h b/deps/v8/src/logging/off-thread-logger.h
index fab58c311bf..f55e429e31c 100644
--- a/deps/v8/src/logging/off-thread-logger.h
+++ b/deps/v8/src/logging/off-thread-logger.h
@@ -19,6 +19,7 @@ class OffThreadLogger {
   void ScriptEvent(Logger::ScriptEventType type, int script_id) {
     UNREACHABLE();
   }
+  void ScriptDetails(Script script) { UNREACHABLE(); }
   void CodeLinePosInfoRecordEvent(Address code_start,
                                   ByteArray source_position_table) {
     UNREACHABLE();
diff --git a/deps/v8/src/objects/allocation-site-inl.h b/deps/v8/src/objects/allocation-site-inl.h
index f0788b7ca14..7447eb5ec36 100644
--- a/deps/v8/src/objects/allocation-site-inl.h
+++ b/deps/v8/src/objects/allocation-site-inl.h
@@ -16,12 +16,11 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(AllocationMemento, Struct)
+TQ_OBJECT_CONSTRUCTORS_IMPL(AllocationMemento)
 OBJECT_CONSTRUCTORS_IMPL(AllocationSite, Struct)
 
 NEVER_READ_ONLY_SPACE_IMPL(AllocationSite)
 
-CAST_ACCESSOR(AllocationMemento)
 CAST_ACCESSOR(AllocationSite)
 
 ACCESSORS(AllocationSite, transition_info_or_boilerplate, Object,
diff --git a/deps/v8/src/objects/allocation-site.h b/deps/v8/src/objects/allocation-site.h
index fde9b7d6026..1da5925beef 100644
--- a/deps/v8/src/objects/allocation-site.h
+++ b/deps/v8/src/objects/allocation-site.h
@@ -162,12 +162,9 @@ class AllocationSite : public Struct {
   OBJECT_CONSTRUCTORS(AllocationSite, Struct);
 };
 
-class AllocationMemento : public Struct {
+class AllocationMemento
+    : public TorqueGeneratedAllocationMemento<AllocationMemento, Struct> {
  public:
-  // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
-                                TORQUE_GENERATED_ALLOCATION_MEMENTO_FIELDS)
-
   DECL_ACCESSORS(allocation_site, Object)
 
   inline bool IsValid() const;
@@ -175,11 +172,8 @@ class AllocationMemento : public Struct {
   inline Address GetAllocationSiteUnchecked() const;
 
   DECL_PRINTER(AllocationMemento)
-  DECL_VERIFIER(AllocationMemento)
-
-  DECL_CAST(AllocationMemento)
 
-  OBJECT_CONSTRUCTORS(AllocationMemento, Struct);
+  TQ_OBJECT_CONSTRUCTORS(AllocationMemento)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/allocation-site.tq b/deps/v8/src/objects/allocation-site.tq
index 1a5f5825fb3..37102685391 100644
--- a/deps/v8/src/objects/allocation-site.tq
+++ b/deps/v8/src/objects/allocation-site.tq
@@ -3,6 +3,8 @@
 // found in the LICENSE file.
 
 extern class AllocationSite extends Struct;
+
+@generateCppClass
 extern class AllocationMemento extends Struct {
   allocation_site: AllocationSite;
 }
diff --git a/deps/v8/src/objects/api-callbacks-inl.h b/deps/v8/src/objects/api-callbacks-inl.h
index 0bec61a7b81..93d2bcd7f45 100644
--- a/deps/v8/src/objects/api-callbacks-inl.h
+++ b/deps/v8/src/objects/api-callbacks-inl.h
@@ -22,24 +22,15 @@ namespace v8 {
 namespace internal {
 
 TQ_OBJECT_CONSTRUCTORS_IMPL(AccessCheckInfo)
-OBJECT_CONSTRUCTORS_IMPL(AccessorInfo, Struct)
+TQ_OBJECT_CONSTRUCTORS_IMPL(AccessorInfo)
 TQ_OBJECT_CONSTRUCTORS_IMPL(InterceptorInfo)
 
 TQ_OBJECT_CONSTRUCTORS_IMPL(CallHandlerInfo)
 
-CAST_ACCESSOR(AccessorInfo)
-
-ACCESSORS(AccessorInfo, name, Name, kNameOffset)
-SMI_ACCESSORS(AccessorInfo, flags, kFlagsOffset)
-ACCESSORS(AccessorInfo, expected_receiver_type, Object,
-          kExpectedReceiverTypeOffset)
-
 ACCESSORS_CHECKED2(AccessorInfo, getter, Object, kGetterOffset, true,
                    Foreign::IsNormalized(value))
 ACCESSORS_CHECKED2(AccessorInfo, setter, Object, kSetterOffset, true,
                    Foreign::IsNormalized(value))
-ACCESSORS(AccessorInfo, js_getter, Object, kJsGetterOffset)
-ACCESSORS(AccessorInfo, data, Object, kDataOffset)
 
 bool AccessorInfo::has_getter() {
   bool result = getter() != Smi::zero();
@@ -97,12 +88,12 @@ bool AccessorInfo::HasExpectedReceiverType() {
 }
 
 BOOL_ACCESSORS(InterceptorInfo, flags, can_intercept_symbols,
-               kCanInterceptSymbolsBit)
-BOOL_ACCESSORS(InterceptorInfo, flags, all_can_read, kAllCanReadBit)
-BOOL_ACCESSORS(InterceptorInfo, flags, non_masking, kNonMasking)
-BOOL_ACCESSORS(InterceptorInfo, flags, is_named, kNamed)
-BOOL_ACCESSORS(InterceptorInfo, flags, has_no_side_effect, kHasNoSideEffect)
-
+               CanInterceptSymbolsBit::kShift)
+BOOL_ACCESSORS(InterceptorInfo, flags, all_can_read, AllCanReadBit::kShift)
+BOOL_ACCESSORS(InterceptorInfo, flags, non_masking, NonMaskingBit::kShift)
+BOOL_ACCESSORS(InterceptorInfo, flags, is_named, NamedBit::kShift)
+BOOL_ACCESSORS(InterceptorInfo, flags, has_no_side_effect,
+               HasNoSideEffectBit::kShift)
 
 bool CallHandlerInfo::IsSideEffectFreeCallHandlerInfo() const {
   ReadOnlyRoots roots = GetReadOnlyRoots();
diff --git a/deps/v8/src/objects/api-callbacks.h b/deps/v8/src/objects/api-callbacks.h
index 77ff26d659a..969adb9fca3 100644
--- a/deps/v8/src/objects/api-callbacks.h
+++ b/deps/v8/src/objects/api-callbacks.h
@@ -24,27 +24,17 @@ namespace internal {
 // If the accessor in the prototype has the READ_ONLY property attribute, then
 // a new value is added to the derived object when the property is set.
 // This shadows the accessor in the prototype.
-class AccessorInfo : public Struct {
+class AccessorInfo : public TorqueGeneratedAccessorInfo<AccessorInfo, Struct> {
  public:
-  DECL_ACCESSORS(name, Name)
-  DECL_INT_ACCESSORS(flags)
-  DECL_ACCESSORS(expected_receiver_type, Object)
   // This directly points at a foreign C function to be used from the runtime.
   DECL_ACCESSORS(getter, Object)
   inline bool has_getter();
   DECL_ACCESSORS(setter, Object)
   inline bool has_setter();
-  // This either points at the same as above, or a trampoline in case we are
-  // running with the simulator. Use these entries from generated code.
-  DECL_ACCESSORS(js_getter, Object)
-  DECL_ACCESSORS(data, Object)
 
   static Address redirect(Address address, AccessorComponent component);
   Address redirected_getter() const;
 
-  // Dispatched behavior.
-  DECL_PRINTER(AccessorInfo)
-
   DECL_BOOLEAN_ACCESSORS(all_can_read)
   DECL_BOOLEAN_ACCESSORS(all_can_write)
   DECL_BOOLEAN_ACCESSORS(is_special_data_property)
@@ -68,35 +58,23 @@ class AccessorInfo : public Struct {
                                       Handle<Map> map);
   inline bool IsCompatibleReceiver(Object receiver);
 
-  DECL_CAST(AccessorInfo)
-
-  // Dispatched behavior.
-  DECL_VERIFIER(AccessorInfo)
-
   // Append all descriptors to the array that are not already there.
   // Return number added.
   static int AppendUnique(Isolate* isolate, Handle<Object> descriptors,
                           Handle<FixedArray> array, int valid_descriptors);
 
-  // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
-                                TORQUE_GENERATED_ACCESSOR_INFO_FIELDS)
-
  private:
   inline bool HasExpectedReceiverType();
 
   // Bit positions in |flags|.
   DEFINE_TORQUE_GENERATED_ACCESSOR_INFO_FLAGS()
 
-  OBJECT_CONSTRUCTORS(AccessorInfo, Struct);
+  TQ_OBJECT_CONSTRUCTORS(AccessorInfo)
 };
 
 class AccessCheckInfo
     : public TorqueGeneratedAccessCheckInfo<AccessCheckInfo, Struct> {
  public:
-  // Dispatched behavior.
-  DECL_PRINTER(AccessCheckInfo)
-
   static AccessCheckInfo Get(Isolate* isolate, Handle<JSObject> receiver);
 
   TQ_OBJECT_CONSTRUCTORS(AccessCheckInfo)
@@ -111,14 +89,7 @@ class InterceptorInfo
   DECL_BOOLEAN_ACCESSORS(is_named)
   DECL_BOOLEAN_ACCESSORS(has_no_side_effect)
 
-  // Dispatched behavior.
-  DECL_PRINTER(InterceptorInfo)
-
-  static const int kCanInterceptSymbolsBit = 0;
-  static const int kAllCanReadBit = 1;
-  static const int kNonMasking = 2;
-  static const int kNamed = 3;
-  static const int kHasNoSideEffect = 4;
+  DEFINE_TORQUE_GENERATED_INTERCEPTOR_INFO_FLAGS()
 
   TQ_OBJECT_CONSTRUCTORS(InterceptorInfo)
 };
diff --git a/deps/v8/src/objects/api-callbacks.tq b/deps/v8/src/objects/api-callbacks.tq
index 47d25546f58..8a8aab59f8d 100644
--- a/deps/v8/src/objects/api-callbacks.tq
+++ b/deps/v8/src/objects/api-callbacks.tq
@@ -9,7 +9,16 @@ extern class CallHandlerInfo extends Struct {
   data: Object;
 }
 
+bitfield struct InterceptorInfoFlags extends uint31 {
+  can_intercept_symbols: bool: 1 bit;
+  all_can_read: bool: 1 bit;
+  non_masking: bool: 1 bit;
+  named: bool: 1 bit;
+  has_no_side_effect: bool: 1 bit;
+}
+
 @generateCppClass
+@generatePrint
 extern class InterceptorInfo extends Struct {
   getter: NonNullForeign|Zero|Undefined;
   setter: NonNullForeign|Zero|Undefined;
@@ -19,10 +28,11 @@ extern class InterceptorInfo extends Struct {
   enumerator: NonNullForeign|Zero|Undefined;
   definer: NonNullForeign|Zero|Undefined;
   data: Object;
-  flags: Smi;
+  flags: SmiTagged<InterceptorInfoFlags>;
 }
 
 @generateCppClass
+@generatePrint
 extern class AccessCheckInfo extends Struct {
   callback: Foreign|Zero|Undefined;
   named_interceptor: InterceptorInfo|Zero|Undefined;
@@ -44,12 +54,16 @@ bitfield struct AccessorInfoFlags extends uint31 {
   initial_attributes: PropertyAttributes: 3 bit;
 }
 
+@generateCppClass
+@generatePrint
 extern class AccessorInfo extends Struct {
-  name: Object;
+  name: Name;
   flags: SmiTagged<AccessorInfoFlags>;
   expected_receiver_type: Object;
   setter: NonNullForeign|Zero;
   getter: NonNullForeign|Zero;
+  // This either points at the same as above, or a trampoline in case we are
+  // running with the simulator. Use these entries from generated code.
   js_getter: NonNullForeign|Zero;
   data: Object;
 }
diff --git a/deps/v8/src/objects/arguments-inl.h b/deps/v8/src/objects/arguments-inl.h
index 8c49d909d2f..494a8960bd8 100644
--- a/deps/v8/src/objects/arguments-inl.h
+++ b/deps/v8/src/objects/arguments-inl.h
@@ -5,9 +5,8 @@
 #ifndef V8_OBJECTS_ARGUMENTS_INL_H_
 #define V8_OBJECTS_ARGUMENTS_INL_H_
 
-#include "src/objects/arguments.h"
-
 #include "src/execution/isolate-inl.h"
+#include "src/objects/arguments.h"
 #include "src/objects/contexts-inl.h"
 #include "src/objects/fixed-array-inl.h"
 #include "src/objects/objects-inl.h"
@@ -18,38 +17,9 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(SloppyArgumentsElements, FixedArray)
 TQ_OBJECT_CONSTRUCTORS_IMPL(JSArgumentsObject)
 TQ_OBJECT_CONSTRUCTORS_IMPL(AliasedArgumentsEntry)
 
-CAST_ACCESSOR(SloppyArgumentsElements)
-
-DEF_GETTER(SloppyArgumentsElements, context, Context) {
-  return TaggedField<Context>::load(isolate, *this,
-                                    OffsetOfElementAt(kContextIndex));
-}
-
-DEF_GETTER(SloppyArgumentsElements, arguments, FixedArray) {
-  return TaggedField<FixedArray>::load(isolate, *this,
-                                       OffsetOfElementAt(kArgumentsIndex));
-}
-
-void SloppyArgumentsElements::set_arguments(FixedArray arguments) {
-  set(kArgumentsIndex, arguments);
-}
-
-uint32_t SloppyArgumentsElements::parameter_map_length() {
-  return length() - kParameterMapStart;
-}
-
-Object SloppyArgumentsElements::get_mapped_entry(uint32_t entry) {
-  return get(entry + kParameterMapStart);
-}
-
-void SloppyArgumentsElements::set_mapped_entry(uint32_t entry, Object object) {
-  set(entry + kParameterMapStart, object);
-}
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/arguments.h b/deps/v8/src/objects/arguments.h
index 52cfb810fbd..41eaaed1a17 100644
--- a/deps/v8/src/objects/arguments.h
+++ b/deps/v8/src/objects/arguments.h
@@ -58,49 +58,6 @@ class JSStrictArgumentsObject : public JSArgumentsObject {
   DISALLOW_IMPLICIT_CONSTRUCTORS(JSStrictArgumentsObject);
 };
 
-// Helper class to access FAST_ and SLOW_SLOPPY_ARGUMENTS_ELEMENTS
-//
-// +---+-----------------------+
-// | 0 | Context  context      |
-// +---------------------------+
-// | 1 | FixedArray arguments  +----+ HOLEY_ELEMENTS
-// +---------------------------+    v-----+-----------+
-// | 2 | Object param_1_map    |    |  0  | the_hole  |
-// |...| ...                   |    | ... | ...       |
-// |n+1| Object param_n_map    |    | n-1 | the_hole  |
-// +---------------------------+    |  n  | element_1 |
-//                                  | ... | ...       |
-//                                  |n+m-1| element_m |
-//                                  +-----------------+
-//
-// Parameter maps give the index into the provided context. If a map entry is
-// the_hole it means that the given entry has been deleted from the arguments
-// object.
-// The arguments backing store kind depends on the ElementsKind of the outer
-// JSArgumentsObject:
-// - FAST_SLOPPY_ARGUMENTS_ELEMENTS: HOLEY_ELEMENTS
-// - SLOW_SLOPPY_ARGUMENTS_ELEMENTS: DICTIONARY_ELEMENTS
-class SloppyArgumentsElements : public FixedArray {
- public:
-  static const int kContextIndex = 0;
-  static const int kArgumentsIndex = 1;
-  static const uint32_t kParameterMapStart = 2;
-
-  DECL_GETTER(context, Context)
-  DECL_GETTER(arguments, FixedArray)
-  inline void set_arguments(FixedArray arguments);
-  inline uint32_t parameter_map_length();
-  inline Object get_mapped_entry(uint32_t entry);
-  inline void set_mapped_entry(uint32_t entry, Object object);
-
-  DECL_CAST(SloppyArgumentsElements)
-#ifdef VERIFY_HEAP
-  void SloppyArgumentsElementsVerify(Isolate* isolate, JSObject holder);
-#endif
-
-  OBJECT_CONSTRUCTORS(SloppyArgumentsElements, FixedArray);
-};
-
 // Representation of a slow alias as part of a sloppy arguments objects.
 // For fast aliases (if HasSloppyArgumentsElements()):
 // - the parameter map contains an index into the context
@@ -113,9 +70,6 @@ class AliasedArgumentsEntry
     : public TorqueGeneratedAliasedArgumentsEntry<AliasedArgumentsEntry,
                                                   Struct> {
  public:
-  // Dispatched behavior.
-  DECL_PRINTER(AliasedArgumentsEntry)
-
   TQ_OBJECT_CONSTRUCTORS(AliasedArgumentsEntry)
 };
 
diff --git a/deps/v8/src/objects/arguments.tq b/deps/v8/src/objects/arguments.tq
index e24eefe6312..e1637056f7f 100644
--- a/deps/v8/src/objects/arguments.tq
+++ b/deps/v8/src/objects/arguments.tq
@@ -26,9 +26,72 @@ extern shape JSStrictArgumentsObject extends JSArgumentsObject {
   length: JSAny;
 }
 
-type SloppyArgumentsElements extends FixedArray;
+// Helper class to access FAST_ and SLOW_SLOPPY_ARGUMENTS_ELEMENTS, dividing
+// arguments into two types for a given SloppyArgumentsElements object:
+// mapped and unmapped.
+//
+// For clarity SloppyArgumentsElements fields are qualified with "elements."
+// below.
+//
+// Mapped arguments are actual arguments. Unmapped arguments are values added
+// to the arguments object after it was created for the call. Mapped arguments
+// are stored in the context at indexes given by elements.mapped_entries[key].
+// Unmapped arguments are stored as regular indexed properties in the arguments
+// array which can be accessed from elements.arguments.
+//
+// elements.length is min(number_of_actual_arguments,
+// number_of_formal_arguments) for a concrete call to a function.
+//
+// Once a SloppyArgumentsElements is generated, lookup of an argument with index
+// |key| in |elements| works as follows:
+//
+// If key >= elements.length then attempt to look in the unmapped arguments
+// array and return the value at key, missing to the runtime if the unmapped
+// arguments array is not a fixed array or if key >= elements.arguments.length.
+//
+// Otherwise, t = elements.mapped_entries[key]. If t is the hole, then the
+// entry has been deleted fron the arguments object, and value is looked up in
+// the unmapped arguments array, as described above. Otherwise, t is a Smi
+// index into the context array specified at elements.context, and the return
+// value is elements.context[t].
+//
+// A graphic representation of a SloppyArgumentsElements object and a
+// corresponding unmapped arguments FixedArray:
+//
+// SloppyArgumentsElements
+// +---+-----------------------+
+// | Context context           |
+// +---------------------------+
+// | FixedArray arguments      +----+ HOLEY_ELEMENTS
+// +---------------------------+    v-----+-----------+
+// | 0 | Object mapped_entries |    |  0  | the_hole  |
+// |...| ...                   |    | ... | ...       |
+// |n-1| Object mapped_entries |    | n-1 | the_hole  |
+// +---------------------------+    |  n  | element_1 |
+//                                  | ... | ...       |
+//                                  |n+m-1| element_m |
+//                                  +-----------------+
+//
+// The elements.arguments backing store kind depends on the ElementsKind of
+// the outer JSArgumentsObject:
+// - FAST_SLOPPY_ARGUMENTS_ELEMENTS: HOLEY_ELEMENTS
+// - SLOW_SLOPPY_ARGUMENTS_ELEMENTS: DICTIONARY_ELEMENTS
+@export
+class SloppyArgumentsElements extends FixedArrayBase {
+  context: Context;
+  arguments: FixedArray;
+  mapped_entries[length]: Smi|TheHole;
+}
+
+macro NewSloppyArgumentsElements<Iterator: type>(
+    length: Smi, context: Context, arguments: FixedArray,
+    it: Iterator): SloppyArgumentsElements {
+  return new
+  SloppyArgumentsElements{length, context, arguments, mapped_entries: ...it};
+}
 
 @generateCppClass
+@generatePrint
 extern class AliasedArgumentsEntry extends Struct {
   aliased_context_slot: Smi;
 }
@@ -36,171 +99,154 @@ extern class AliasedArgumentsEntry extends Struct {
 // TODO(danno): This should be a namespace {} once supported
 namespace arguments {
 
-  macro NewJSStrictArgumentsObject(implicit context: Context)(
-      elements: FixedArray): JSStrictArgumentsObject {
-    const map = GetStrictArgumentsMap();
-    return new JSStrictArgumentsObject{
-      map,
-      properties_or_hash: kEmptyFixedArray,
-      elements,
-      length: elements.length
-    };
-  }
+macro NewJSStrictArgumentsObject(implicit context: Context)(
+    elements: FixedArray): JSStrictArgumentsObject {
+  const map = GetStrictArgumentsMap();
+  return new JSStrictArgumentsObject{
+    map,
+    properties_or_hash: kEmptyFixedArray,
+    elements,
+    length: elements.length
+  };
+}
 
-  macro NewJSSloppyArgumentsObject(implicit context: Context)(
-      elements: FixedArray, callee: JSFunction): JSSloppyArgumentsObject {
-    const map = GetSloppyArgumentsMap();
-    return new JSSloppyArgumentsObject{
-      map,
-      properties_or_hash: kEmptyFixedArray,
-      elements,
-      length: elements.length,
-      callee
-    };
-  }
+macro NewJSSloppyArgumentsObject(implicit context: Context)(
+    elements: FixedArrayBase, callee: JSFunction): JSSloppyArgumentsObject {
+  const map = GetSloppyArgumentsMap();
+  return new JSSloppyArgumentsObject{
+    map,
+    properties_or_hash: kEmptyFixedArray,
+    elements,
+    length: elements.length,
+    callee
+  };
+}
 
-  macro NewJSFastAliasedArgumentsObject(implicit context: Context)(
-      elements: FixedArray, length: Smi,
-      callee: JSFunction): JSSloppyArgumentsObject {
-    // TODO(danno): FastAliasedArguments should really be a type for itself
-    const map = GetFastAliasedArgumentsMap();
-    return new JSSloppyArgumentsObject{
-      map,
-      properties_or_hash: kEmptyFixedArray,
-      elements,
-      length,
-      callee
-    };
-  }
+macro NewJSFastAliasedArgumentsObject(implicit context: Context)(
+    elements: FixedArrayBase, length: Smi,
+    callee: JSFunction): JSSloppyArgumentsObject {
+  // TODO(danno): FastAliasedArguments should really be a type for itself
+  const map = GetFastAliasedArgumentsMap();
+  return new JSSloppyArgumentsObject{
+    map,
+    properties_or_hash: kEmptyFixedArray,
+    elements,
+    length,
+    callee
+  };
+}
 
-  struct ParameterMapIterator {
-    macro Next(): Object labels NoMore {
-      const currentMapSlotCopy = this.currentMapSlot++;
-      if (currentMapSlotCopy > 1) {
-        if (this.currentIndex == this.endInterationIndex) goto NoMore;
-        this.currentIndex--;
-        return Convert<Smi>(this.currentIndex);
-      } else if (currentMapSlotCopy == 0) {
-        return this.context;
-      } else {
-        assert(currentMapSlotCopy == 1);
-        return this.elements;
-      }
-    }
-    const context: Context;
-    const elements: FixedArray;
-    currentIndex: intptr;
-    const endInterationIndex: intptr;
-    currentMapSlot: intptr;
+struct ParameterMapIterator {
+  macro Next(): Smi labels NoMore {
+    if (this.currentIndex == this.endInterationIndex) goto NoMore;
+    this.currentIndex--;
+    return Convert<Smi>(this.currentIndex);
   }
+  currentIndex: intptr;
+  const endInterationIndex: intptr;
+}
 
-  macro NewParameterMapIterator(
-      context: Context, elements: FixedArray, formalParameterCount: intptr,
-      mappedCount: intptr): ParameterMapIterator {
-    const flags = context.scope_info.flags;
-    let contextHeaderSize: intptr = MIN_CONTEXT_SLOTS;
-    if (flags.has_context_extension_slot) ++contextHeaderSize;
-    // Copy the parameter slots and the holes in the arguments.
-    // We need to fill in mapped_count slots. They index the context,
-    // where parameters are stored in reverse order, at
-    //   context_header_size .. context_header_size+argument_count-1
-    // The mapped parameter thus need to get indices
-    //   context_header_size+parameter_count-1 ..
-    //       context_header_size+argument_count-mapped_count
-    // We loop from right to left.
-    const afterLastContextIndex = contextHeaderSize + formalParameterCount;
-    const firstContextIndex = afterLastContextIndex - mappedCount;
-    return ParameterMapIterator{
-      context,
-      elements,
-      currentIndex: afterLastContextIndex,
-      endInterationIndex: firstContextIndex,
-      currentMapSlot: 0
-    };
-  }
+macro NewParameterMapIterator(
+    context: Context, formalParameterCount: intptr,
+    mappedCount: intptr): ParameterMapIterator {
+  const flags = context.scope_info.flags;
+  let contextHeaderSize: intptr = MIN_CONTEXT_SLOTS;
+  if (flags.has_context_extension_slot) ++contextHeaderSize;
+  // Copy the parameter slots and the holes in the arguments.
+  // We need to fill in mapped_count slots. They index the context,
+  // where parameters are stored in reverse order, at
+  //   context_header_size .. context_header_size+argument_count-1
+  // The mapped parameter thus need to get indices
+  //   context_header_size+parameter_count-1 ..
+  //       context_header_size+argument_count-mapped_count
+  // We loop from right to left.
+  const afterLastContextIndex = contextHeaderSize + formalParameterCount;
+  const firstContextIndex = afterLastContextIndex - mappedCount;
+  return ParameterMapIterator{
+    currentIndex: afterLastContextIndex,
+    endInterationIndex: firstContextIndex
+  };
+}
 
-  struct ParameterValueIterator {
-    macro Next(): Object labels NoMore() {
-      if (this.mapped_count != 0) {
-        this.mapped_count--;
-        return TheHole;
-      }
-      if (this.current == this.arguments.length) goto NoMore;
-      return this.arguments[this.current++];
+struct ParameterValueIterator {
+  macro Next(): Object labels NoMore() {
+    if (this.mapped_count != 0) {
+      this.mapped_count--;
+      return TheHole;
     }
-    mapped_count: intptr;
-    const arguments: Arguments;
-    current: intptr;
+    if (this.current == this.arguments.length) goto NoMore;
+    return this.arguments[this.current++];
   }
+  mapped_count: intptr;
+  const arguments: Arguments;
+  current: intptr;
+}
 
-  macro NewParameterValueIterator(mappedCount: intptr, arguments: Arguments):
-      ParameterValueIterator {
-    return ParameterValueIterator{
-      mapped_count: mappedCount,
-      arguments,
-      current: mappedCount
-    };
-  }
+macro NewParameterValueIterator(
+    mappedCount: intptr, arguments: Arguments): ParameterValueIterator {
+  return ParameterValueIterator{
+    mapped_count: mappedCount,
+    arguments,
+    current: mappedCount
+  };
+}
 
-  macro NewAllArguments(implicit context: Context)(
-      frame: FrameWithArguments, argumentCount: intptr): JSArray {
-    const map = GetFastPackedElementsJSArrayMap();
-    const arguments = GetFrameArguments(frame, argumentCount);
-    const it = ArgumentsIterator{arguments, current: 0};
-    const elements = NewFixedArray(argumentCount, it);
-    return NewJSArray(map, elements);
-  }
+macro NewAllArguments(implicit context: Context)(
+    frame: FrameWithArguments, argumentCount: intptr): JSArray {
+  const map = GetFastPackedElementsJSArrayMap();
+  const arguments = GetFrameArguments(frame, argumentCount);
+  const it = ArgumentsIterator{arguments, current: 0};
+  const elements = NewFixedArray(argumentCount, it);
+  return NewJSArray(map, elements);
+}
 
-  macro NewRestArguments(implicit context:
-                             Context)(info: FrameWithArgumentsInfo): JSArray {
-    const argumentCount = Convert<intptr>(info.argument_count);
-    const formalParameterCount = Convert<intptr>(info.formal_parameter_count);
-    const map = GetFastPackedElementsJSArrayMap();
-    const length = (formalParameterCount >= argumentCount) ?
-        0 :
-        argumentCount - formalParameterCount;
-    const arguments = GetFrameArguments(info.frame, argumentCount);
-    const it = ArgumentsIterator{arguments, current: formalParameterCount};
-    const elements = NewFixedArray(length, it);
-    return NewJSArray(map, elements);
-  }
+macro NewRestArguments(implicit context: Context)(info: FrameWithArgumentsInfo):
+    JSArray {
+  const argumentCount = Convert<intptr>(info.argument_count);
+  const formalParameterCount = Convert<intptr>(info.formal_parameter_count);
+  const map = GetFastPackedElementsJSArrayMap();
+  const length = (formalParameterCount >= argumentCount) ?
+      0 :
+      argumentCount - formalParameterCount;
+  const arguments = GetFrameArguments(info.frame, argumentCount);
+  const it = ArgumentsIterator{arguments, current: formalParameterCount};
+  const elements = NewFixedArray(length, it);
+  return NewJSArray(map, elements);
+}
 
-  macro NewStrictArguments(implicit context: Context)(
-      info: FrameWithArgumentsInfo): JSStrictArgumentsObject {
-    const argumentCount = Convert<intptr>(info.argument_count);
-    const arguments = GetFrameArguments(info.frame, argumentCount);
+macro NewStrictArguments(implicit context: Context)(
+    info: FrameWithArgumentsInfo): JSStrictArgumentsObject {
+  const argumentCount = Convert<intptr>(info.argument_count);
+  const arguments = GetFrameArguments(info.frame, argumentCount);
+  const it = ArgumentsIterator{arguments, current: 0};
+  const elements = NewFixedArray(argumentCount, it);
+  return NewJSStrictArgumentsObject(elements);
+}
+
+macro NewSloppyArguments(implicit context: Context)(
+    info: FrameWithArgumentsInfo, callee: JSFunction): JSSloppyArgumentsObject {
+  const argumentCount = Convert<intptr>(info.argument_count);
+  const arguments = GetFrameArguments(info.frame, argumentCount);
+  const formalParameterCount = Convert<intptr>(info.formal_parameter_count);
+  if (formalParameterCount == 0) {
     const it = ArgumentsIterator{arguments, current: 0};
     const elements = NewFixedArray(argumentCount, it);
-    return NewJSStrictArgumentsObject(elements);
+    return NewJSSloppyArgumentsObject(elements, callee);
   }
-
-  macro NewSloppyArguments(implicit context: Context)(
-      info: FrameWithArgumentsInfo,
-      callee: JSFunction): JSSloppyArgumentsObject {
-    const argumentCount = Convert<intptr>(info.argument_count);
-    const arguments = GetFrameArguments(info.frame, argumentCount);
-    const formalParameterCount = Convert<intptr>(info.formal_parameter_count);
-    if (formalParameterCount == 0) {
-      const it = ArgumentsIterator{arguments, current: 0};
-      const elements = NewFixedArray(argumentCount, it);
-      return NewJSSloppyArgumentsObject(elements, callee);
-    }
-    const mappedCount = IntPtrMin(formalParameterCount, argumentCount);
-    const it = NewParameterValueIterator(mappedCount, arguments);
-    const parameterValues = NewFixedArray(argumentCount, it);
-    let paramIter = NewParameterMapIterator(
-        context, parameterValues, formalParameterCount, mappedCount);
-    const elementsLength =
-        Convert<Smi>(mappedCount + kSloppyArgumentsParameterMapStart);
-    const map = kSloppyArgumentsElementsMap;
-    const elements = new
-    FixedArray{map, length: elementsLength, objects: ...paramIter};
-    const length = Convert<Smi>(argumentCount);
-    return NewJSFastAliasedArgumentsObject(elements, length, callee);
-  }
-
+  const mappedCount = IntPtrMin(formalParameterCount, argumentCount);
+  const it = NewParameterValueIterator(mappedCount, arguments);
+  const parameterValues = NewFixedArray(argumentCount, it);
+  let paramIter =
+      NewParameterMapIterator(context, formalParameterCount, mappedCount);
+  const elementsLength = Convert<Smi>(mappedCount);
+  const elements = NewSloppyArgumentsElements(
+      elementsLength, context, parameterValues, paramIter);
+  const length = Convert<Smi>(argumentCount);
+  return NewJSFastAliasedArgumentsObject(elements, length, callee);
 }
 
+}  // namespace arguments
+
 @export
 macro EmitFastNewAllArguments(implicit context: Context)(
     frame: FrameWithArguments, argc: intptr): JSArray {
diff --git a/deps/v8/src/objects/backing-store.cc b/deps/v8/src/objects/backing-store.cc
index a1db32f5dce..bd9f39b7d3a 100644
--- a/deps/v8/src/objects/backing-store.cc
+++ b/deps/v8/src/objects/backing-store.cc
@@ -462,33 +462,63 @@ std::unique_ptr<BackingStore> BackingStore::CopyWasmMemory(Isolate* isolate,
 }
 
 // Try to grow the size of a wasm memory in place, without realloc + copy.
-bool BackingStore::GrowWasmMemoryInPlace(Isolate* isolate, size_t delta_pages,
-                                         size_t max_pages) {
+base::Optional<size_t> BackingStore::GrowWasmMemoryInPlace(Isolate* isolate,
+                                                           size_t delta_pages,
+                                                           size_t max_pages) {
+  // This function grows wasm memory by
+  // * changing the permissions of additional {delta_pages} pages to kReadWrite;
+  // * increment {byte_length_};
+  //
+  // As this code is executed concurrently, the following steps are executed:
+  // 1) Read the current value of {byte_length_};
+  // 2) Change the permission of all pages from {buffer_start_} to
+  //    {byte_length_} + {delta_pages} * {page_size} to kReadWrite;
+  //    * This operation may be executed racefully. The OS takes care of
+  //      synchronization.
+  // 3) Try to update {byte_length_} with a compare_exchange;
+  // 4) Repeat 1) to 3) until the compare_exchange in 3) succeeds;
+  //
+  // The result of this function is the {byte_length_} before growing in pages.
+  // The result of this function appears like the result of an RMW-update on
+  // {byte_length_}, i.e. two concurrent calls to this function will result in
+  // different return values if {delta_pages} != 0.
+  //
+  // Invariants:
+  // * Permissions are always set incrementally, i.e. for any page {b} with
+  //   kReadWrite permission, all pages between the first page {a} and page {b}
+  //   also have kReadWrite permission.
+  // * {byte_length_} is always lower or equal than the amount of memory with
+  //   permissions set to kReadWrite;
+  //     * This is guaranteed by incrementing {byte_length_} with a
+  //       compare_exchange after changing the permissions.
+  //     * This invariant is the reason why we cannot use a fetch_add.
   DCHECK(is_wasm_memory_);
   max_pages = std::min(max_pages, byte_capacity_ / wasm::kWasmPageSize);
 
-  if (delta_pages == 0) return true;          // degenerate grow.
-  if (delta_pages > max_pages) return false;  // would never work.
-
   // Do a compare-exchange loop, because we also need to adjust page
   // permissions. Note that multiple racing grows both try to set page
   // permissions for the entire range (to be RW), so the operating system
   // should deal with that raciness. We know we succeeded when we can
   // compare/swap the old length with the new length.
   size_t old_length = byte_length_.load(std::memory_order_relaxed);
+
+  if (delta_pages == 0)
+    return {old_length / wasm::kWasmPageSize};  // degenerate grow.
+  if (delta_pages > max_pages) return {};       // would never work.
+
   size_t new_length = 0;
   while (true) {
     size_t current_pages = old_length / wasm::kWasmPageSize;
 
     // Check if we have exceed the supplied maximum.
-    if (current_pages > (max_pages - delta_pages)) return false;
+    if (current_pages > (max_pages - delta_pages)) return {};
 
     new_length = (current_pages + delta_pages) * wasm::kWasmPageSize;
 
     // Try to adjust the permissions on the memory.
     if (!i::SetPermissions(GetPlatformPageAllocator(), buffer_start_,
                            new_length, PageAllocator::kReadWrite)) {
-      return false;
+      return {};
     }
     if (byte_length_.compare_exchange_weak(old_length, new_length,
                                            std::memory_order_acq_rel)) {
@@ -502,7 +532,7 @@ bool BackingStore::GrowWasmMemoryInPlace(Isolate* isolate, size_t delta_pages,
     reinterpret_cast<v8::Isolate*>(isolate)
         ->AdjustAmountOfExternalAllocatedMemory(new_length - old_length);
   }
-  return true;
+  return {old_length / wasm::kWasmPageSize};
 }
 
 void BackingStore::AttachSharedWasmMemoryObject(
@@ -515,10 +545,9 @@ void BackingStore::AttachSharedWasmMemoryObject(
 }
 
 void BackingStore::BroadcastSharedWasmMemoryGrow(
-    Isolate* isolate, std::shared_ptr<BackingStore> backing_store,
-    size_t new_pages) {
-  GlobalBackingStoreRegistry::BroadcastSharedWasmMemoryGrow(
-      isolate, backing_store, new_pages);
+    Isolate* isolate, std::shared_ptr<BackingStore> backing_store) {
+  GlobalBackingStoreRegistry::BroadcastSharedWasmMemoryGrow(isolate,
+                                                            backing_store);
 }
 
 void BackingStore::RemoveSharedWasmMemoryObjects(Isolate* isolate) {
@@ -736,8 +765,7 @@ void GlobalBackingStoreRegistry::AddSharedWasmMemoryObject(
 }
 
 void GlobalBackingStoreRegistry::BroadcastSharedWasmMemoryGrow(
-    Isolate* isolate, std::shared_ptr<BackingStore> backing_store,
-    size_t new_pages) {
+    Isolate* isolate, std::shared_ptr<BackingStore> backing_store) {
   {
     // The global lock protects the list of isolates per backing store.
     base::MutexGuard scope_lock(&impl()->mutex_);
diff --git a/deps/v8/src/objects/backing-store.h b/deps/v8/src/objects/backing-store.h
index e9a7c8ec15e..0a460cef8a1 100644
--- a/deps/v8/src/objects/backing-store.h
+++ b/deps/v8/src/objects/backing-store.h
@@ -9,6 +9,7 @@
 
 #include "include/v8-internal.h"
 #include "include/v8.h"
+#include "src/base/optional.h"
 #include "src/handles/handles.h"
 
 namespace v8 {
@@ -84,8 +85,9 @@ class V8_EXPORT_PRIVATE BackingStore : public BackingStoreBase {
   bool free_on_destruct() const { return free_on_destruct_; }
 
   // Attempt to grow this backing store in place.
-  bool GrowWasmMemoryInPlace(Isolate* isolate, size_t delta_pages,
-                             size_t max_pages);
+  base::Optional<size_t> GrowWasmMemoryInPlace(Isolate* isolate,
+                                               size_t delta_pages,
+                                               size_t max_pages);
 
   // Wrapper around ArrayBuffer::Allocator::Reallocate.
   bool Reallocate(Isolate* isolate, size_t new_byte_length);
@@ -104,8 +106,7 @@ class V8_EXPORT_PRIVATE BackingStore : public BackingStoreBase {
   // after the backing store has been grown. Memory objects in this
   // isolate are updated synchronously.
   static void BroadcastSharedWasmMemoryGrow(Isolate* isolate,
-                                            std::shared_ptr<BackingStore>,
-                                            size_t new_pages);
+                                            std::shared_ptr<BackingStore>);
 
   // TODO(wasm): address space limitations should be enforced in page alloc.
   // These methods enforce a limit on the total amount of address space,
@@ -243,8 +244,7 @@ class GlobalBackingStoreRegistry {
 
   // Broadcast updates to all attached memory objects.
   static void BroadcastSharedWasmMemoryGrow(
-      Isolate* isolate, std::shared_ptr<BackingStore> backing_store,
-      size_t new_pages);
+      Isolate* isolate, std::shared_ptr<BackingStore> backing_store);
 
   // Update all shared memory objects in the given isolate.
   static void UpdateSharedWasmMemoryObjects(Isolate* isolate);
diff --git a/deps/v8/src/objects/cell.h b/deps/v8/src/objects/cell.h
index fc49f164b24..f26feae4218 100644
--- a/deps/v8/src/objects/cell.h
+++ b/deps/v8/src/objects/cell.h
@@ -20,9 +20,6 @@ class Cell : public TorqueGeneratedCell<Cell, HeapObject> {
 
   inline Address ValueAddress() { return address() + kValueOffset; }
 
-  // Dispatched behavior.
-  DECL_PRINTER(Cell)
-
   using BodyDescriptor = FixedBodyDescriptor<kValueOffset, kSize, kSize>;
 
   TQ_OBJECT_CONSTRUCTORS(Cell)
diff --git a/deps/v8/src/objects/cell.tq b/deps/v8/src/objects/cell.tq
index 9f825fc5759..ef9b281104e 100644
--- a/deps/v8/src/objects/cell.tq
+++ b/deps/v8/src/objects/cell.tq
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 @generateCppClass
+@generatePrint
 extern class Cell extends HeapObject {
   value: Object;
 }
diff --git a/deps/v8/src/objects/class-definitions-tq-deps-inl.h b/deps/v8/src/objects/class-definitions-tq-deps-inl.h
new file mode 100644
index 00000000000..dafba941ea4
--- /dev/null
+++ b/deps/v8/src/objects/class-definitions-tq-deps-inl.h
@@ -0,0 +1,43 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_CLASS_DEFINITIONS_TQ_DEPS_INL_H_
+#define V8_OBJECTS_CLASS_DEFINITIONS_TQ_DEPS_INL_H_
+
+// This is a collection of -inl.h files required by the generated file
+// class-definitions-tq.cc. Generally, classes using @generateCppClass need an
+// entry here.
+#include "src/objects/allocation-site-inl.h"
+#include "src/objects/arguments-inl.h"
+#include "src/objects/embedder-data-array-inl.h"
+#include "src/objects/free-space-inl.h"
+#include "src/objects/js-collection-inl.h"
+#include "src/objects/js-generator-inl.h"
+#include "src/objects/js-regexp-inl.h"
+#include "src/objects/js-regexp-string-iterator-inl.h"
+#include "src/objects/js-weak-refs-inl.h"
+#include "src/objects/literal-objects-inl.h"
+#include "src/objects/microtask-inl.h"
+#include "src/objects/module-inl.h"
+#include "src/objects/promise-inl.h"
+#include "src/objects/property-descriptor-object-inl.h"
+#include "src/objects/stack-frame-info-inl.h"
+#include "src/objects/struct-inl.h"
+#include "src/objects/template-objects-inl.h"
+
+#ifdef V8_INTL_SUPPORT
+#include "src/objects/js-break-iterator-inl.h"
+#include "src/objects/js-collator-inl.h"
+#include "src/objects/js-date-time-format-inl.h"
+#include "src/objects/js-display-names-inl.h"
+#include "src/objects/js-list-format-inl.h"
+#include "src/objects/js-locale-inl.h"
+#include "src/objects/js-number-format-inl.h"
+#include "src/objects/js-plural-rules-inl.h"
+#include "src/objects/js-relative-time-format-inl.h"
+#include "src/objects/js-segment-iterator-inl.h"
+#include "src/objects/js-segmenter-inl.h"
+#endif
+
+#endif  // V8_OBJECTS_CLASS_DEFINITIONS_TQ_DEPS_INL_H_
diff --git a/deps/v8/src/objects/code-inl.h b/deps/v8/src/objects/code-inl.h
index 81db1745c4a..1af186f3e7e 100644
--- a/deps/v8/src/objects/code-inl.h
+++ b/deps/v8/src/objects/code-inl.h
@@ -454,6 +454,17 @@ void Code::set_builtin_index(int index) {
 
 bool Code::is_builtin() const { return builtin_index() != -1; }
 
+unsigned Code::inlined_bytecode_size() const {
+  DCHECK(kind() == OPTIMIZED_FUNCTION ||
+         ReadField<unsigned>(kInlinedBytecodeSizeOffset) == 0);
+  return ReadField<unsigned>(kInlinedBytecodeSizeOffset);
+}
+
+void Code::set_inlined_bytecode_size(unsigned size) {
+  DCHECK(kind() == OPTIMIZED_FUNCTION || size == 0);
+  WriteField<unsigned>(kInlinedBytecodeSizeOffset, size);
+}
+
 bool Code::has_safepoint_info() const {
   return is_turbofanned() || is_wasm_code();
 }
@@ -477,6 +488,24 @@ void Code::set_marked_for_deoptimization(bool flag) {
   code_data_container().set_kind_specific_flags(updated);
 }
 
+int Code::deoptimization_count() const {
+  DCHECK(kind() == OPTIMIZED_FUNCTION);
+  int32_t flags = code_data_container().kind_specific_flags();
+  int count = DeoptCountField::decode(flags);
+  DCHECK_GE(count, 0);
+  return count;
+}
+
+void Code::increment_deoptimization_count() {
+  DCHECK(kind() == OPTIMIZED_FUNCTION);
+  int32_t flags = code_data_container().kind_specific_flags();
+  int32_t count = DeoptCountField::decode(flags);
+  DCHECK_GE(count, 0);
+  CHECK_LE(count + 1, DeoptCountField::kMax);
+  int32_t updated = DeoptCountField::update(flags, count + 1);
+  code_data_container().set_kind_specific_flags(updated);
+}
+
 bool Code::embedded_objects_cleared() const {
   DCHECK(kind() == OPTIMIZED_FUNCTION);
   int32_t flags = code_data_container().kind_specific_flags();
diff --git a/deps/v8/src/objects/code.cc b/deps/v8/src/objects/code.cc
index 4f272f12995..2e8f808262e 100644
--- a/deps/v8/src/objects/code.cc
+++ b/deps/v8/src/objects/code.cc
@@ -1026,8 +1026,12 @@ const char* DependentCode::DependencyGroupName(DependencyGroup group) {
       return "prototype-check";
     case kPropertyCellChangedGroup:
       return "property-cell-changed";
-    case kFieldOwnerGroup:
-      return "field-owner";
+    case kFieldConstGroup:
+      return "field-const";
+    case kFieldTypeGroup:
+      return "field-type";
+    case kFieldRepresentationGroup:
+      return "field-representation";
     case kInitialMapChangedGroup:
       return "initial-map-changed";
     case kAllocationSiteTenuringChangedGroup:
diff --git a/deps/v8/src/objects/code.h b/deps/v8/src/objects/code.h
index d80e72fa038..ea6f52cc599 100644
--- a/deps/v8/src/objects/code.h
+++ b/deps/v8/src/objects/code.h
@@ -47,7 +47,6 @@ class Code : public HeapObject {
   V(WASM_TO_JS_FUNCTION)    \
   V(JS_TO_WASM_FUNCTION)    \
   V(JS_TO_JS_FUNCTION)      \
-  V(WASM_INTERPRETER_ENTRY) \
   V(C_WASM_ENTRY)
 
   enum Kind {
@@ -138,6 +137,9 @@ class Code : public HeapObject {
   inline void set_builtin_index(int id);
   inline bool is_builtin() const;
 
+  inline unsigned inlined_bytecode_size() const;
+  inline void set_inlined_bytecode_size(unsigned size);
+
   inline bool has_safepoint_info() const;
 
   // [stack_slots]: If {has_safepoint_info()}, the number of stack slots
@@ -180,6 +182,12 @@ class Code : public HeapObject {
   inline bool marked_for_deoptimization() const;
   inline void set_marked_for_deoptimization(bool flag);
 
+  // [deoptimzation_count]: In turboprop we retain the deoptimized code on soft
+  // deopts for a certain number of soft deopts. This field keeps track of
+  // number of deoptimizations we have seen so far.
+  inline int deoptimization_count() const;
+  inline void increment_deoptimization_count();
+
   // [embedded_objects_cleared]: For kind OPTIMIZED_FUNCTION tells whether
   // the embedded objects in the code marked for deoptimization were cleared.
   // Note that embedded_objects_cleared() implies marked_for_deoptimization().
@@ -397,6 +405,7 @@ class Code : public HeapObject {
     FLAG_enable_embedded_constant_pool ? kIntSize : 0)                    \
   V(kCodeCommentsOffsetOffset, kIntSize)                                  \
   V(kBuiltinIndexOffset, kIntSize)                                        \
+  V(kInlinedBytecodeSizeOffset, kIntSize)                                 \
   V(kUnalignedHeaderSize, 0)                                              \
   /* Add padding to align the instruction start following right after */  \
   /* the Code object header. */                                           \
@@ -409,22 +418,23 @@ class Code : public HeapObject {
   // This documents the amount of free space we have in each Code object header
   // due to padding for code alignment.
 #if V8_TARGET_ARCH_ARM64
-  static constexpr int kHeaderPaddingSize = COMPRESS_POINTERS_BOOL ? 20 : 0;
+  static constexpr int kHeaderPaddingSize = COMPRESS_POINTERS_BOOL ? 16 : 28;
 #elif V8_TARGET_ARCH_MIPS64
-  static constexpr int kHeaderPaddingSize = 0;
+  static constexpr int kHeaderPaddingSize = 28;
 #elif V8_TARGET_ARCH_X64
-  static constexpr int kHeaderPaddingSize = COMPRESS_POINTERS_BOOL ? 20 : 0;
+  static constexpr int kHeaderPaddingSize = COMPRESS_POINTERS_BOOL ? 16 : 28;
 #elif V8_TARGET_ARCH_ARM
-  static constexpr int kHeaderPaddingSize = 20;
+  static constexpr int kHeaderPaddingSize = 16;
 #elif V8_TARGET_ARCH_IA32
-  static constexpr int kHeaderPaddingSize = 20;
+  static constexpr int kHeaderPaddingSize = 16;
 #elif V8_TARGET_ARCH_MIPS
-  static constexpr int kHeaderPaddingSize = 20;
+  static constexpr int kHeaderPaddingSize = 16;
 #elif V8_TARGET_ARCH_PPC64
   static constexpr int kHeaderPaddingSize =
-      FLAG_enable_embedded_constant_pool ? 28 : 0;
+      FLAG_enable_embedded_constant_pool ? (COMPRESS_POINTERS_BOOL ? 12 : 24)
+                                         : (COMPRESS_POINTERS_BOOL ? 16 : 28);
 #elif V8_TARGET_ARCH_S390X
-  static constexpr int kHeaderPaddingSize = COMPRESS_POINTERS_BOOL ? 20 : 0;
+  static constexpr int kHeaderPaddingSize = COMPRESS_POINTERS_BOOL ? 16 : 28;
 #else
 #error Unknown architecture.
 #endif
@@ -454,11 +464,11 @@ class Code : public HeapObject {
   V(DeoptAlreadyCountedField, bool, 1, _)         \
   V(CanHaveWeakObjectsField, bool, 1, _)          \
   V(IsPromiseRejectionField, bool, 1, _)          \
-  V(IsExceptionCaughtField, bool, 1, _)
+  V(IsExceptionCaughtField, bool, 1, _)           \
+  V(DeoptCountField, int, 4, _)
   DEFINE_BIT_FIELDS(CODE_KIND_SPECIFIC_FLAGS_BIT_FIELDS)
 #undef CODE_KIND_SPECIFIC_FLAGS_BIT_FIELDS
-  static_assert(IsExceptionCaughtField::kLastUsedBit < 32,
-                "KindSpecificFlags full");
+  static_assert(DeoptCountField::kLastUsedBit < 32, "KindSpecificFlags full");
 
   // The {marked_for_deoptimization} field is accessed from generated code.
   static const int kMarkedForDeoptimizationBit =
@@ -641,7 +651,9 @@ class DependentCode : public WeakFixedArray {
     kPropertyCellChangedGroup,
     // Group of code that omit run-time checks for field(s) introduced by
     // this map, i.e. for the field type.
-    kFieldOwnerGroup,
+    kFieldTypeGroup,
+    kFieldConstGroup,
+    kFieldRepresentationGroup,
     // Group of code that omit run-time type checks for initial maps of
     // constructors.
     kInitialMapChangedGroup,
@@ -709,8 +721,8 @@ class DependentCode : public WeakFixedArray {
 
   inline int flags();
   inline void set_flags(int flags);
-  using GroupField = base::BitField<int, 0, 3>;
-  using CountField = base::BitField<int, 3, 27>;
+  using GroupField = base::BitField<int, 0, 5>;
+  using CountField = base::BitField<int, 5, 27>;
   STATIC_ASSERT(kGroupCount <= GroupField::kMax + 1);
 
   OBJECT_CONSTRUCTORS(DependentCode, WeakFixedArray);
diff --git a/deps/v8/src/objects/contexts-inl.h b/deps/v8/src/objects/contexts-inl.h
index 33df9915646..8bd41722f1f 100644
--- a/deps/v8/src/objects/contexts-inl.h
+++ b/deps/v8/src/objects/contexts-inl.h
@@ -245,14 +245,18 @@ Map Context::GetInitialJSArrayMap(ElementsKind kind) const {
   return Map::cast(initial_js_array_map);
 }
 
-MicrotaskQueue* NativeContext::microtask_queue() const {
+DEF_GETTER(NativeContext, microtask_queue, MicrotaskQueue*) {
+  ExternalPointer_t encoded_value =
+      ReadField<ExternalPointer_t>(kMicrotaskQueueOffset);
   return reinterpret_cast<MicrotaskQueue*>(
-      ReadField<Address>(kMicrotaskQueueOffset));
+      DecodeExternalPointer(isolate, encoded_value));
 }
 
-void NativeContext::set_microtask_queue(MicrotaskQueue* microtask_queue) {
-  WriteField<Address>(kMicrotaskQueueOffset,
-                      reinterpret_cast<Address>(microtask_queue));
+void NativeContext::set_microtask_queue(Isolate* isolate,
+                                        MicrotaskQueue* microtask_queue) {
+  ExternalPointer_t encoded_value = EncodeExternalPointer(
+      isolate, reinterpret_cast<Address>(microtask_queue));
+  WriteField<ExternalPointer_t>(kMicrotaskQueueOffset, encoded_value);
 }
 
 OSROptimizedCodeCache NativeContext::GetOSROptimizedCodeCache() {
diff --git a/deps/v8/src/objects/contexts.h b/deps/v8/src/objects/contexts.h
index a273549d96e..14576c4b598 100644
--- a/deps/v8/src/objects/contexts.h
+++ b/deps/v8/src/objects/contexts.h
@@ -42,11 +42,6 @@ enum ContextLookupFlags {
   V(GENERATOR_NEXT_INTERNAL, JSFunction, generator_next_internal) \
   V(ASYNC_MODULE_EVALUATE_INTERNAL, JSFunction,                   \
     async_module_evaluate_internal)                               \
-  V(MAKE_ERROR_INDEX, JSFunction, make_error)                     \
-  V(MAKE_RANGE_ERROR_INDEX, JSFunction, make_range_error)         \
-  V(MAKE_SYNTAX_ERROR_INDEX, JSFunction, make_syntax_error)       \
-  V(MAKE_TYPE_ERROR_INDEX, JSFunction, make_type_error)           \
-  V(MAKE_URI_ERROR_INDEX, JSFunction, make_uri_error)             \
   V(OBJECT_CREATE, JSFunction, object_create)                     \
   V(REFLECT_APPLY_INDEX, JSFunction, reflect_apply)               \
   V(REFLECT_CONSTRUCT_INDEX, JSFunction, reflect_construct)       \
@@ -54,7 +49,6 @@ enum ContextLookupFlags {
   V(MATH_POW_INDEX, JSFunction, math_pow)                         \
   V(PROMISE_INTERNAL_CONSTRUCTOR_INDEX, JSFunction,               \
     promise_internal_constructor)                                 \
-  V(IS_PROMISE_INDEX, JSFunction, is_promise)                     \
   V(PROMISE_THEN_INDEX, JSFunction, promise_then)
 
 #define NATIVE_CONTEXT_FIELDS(V)                                               \
@@ -76,28 +70,10 @@ enum ContextLookupFlags {
   V(ARRAY_FUNCTION_INDEX, JSFunction, array_function)                          \
   V(ARRAY_JOIN_STACK_INDEX, HeapObject, array_join_stack)                      \
   V(ASYNC_FROM_SYNC_ITERATOR_MAP_INDEX, Map, async_from_sync_iterator_map)     \
-  V(ASYNC_FUNCTION_AWAIT_REJECT_SHARED_FUN, SharedFunctionInfo,                \
-    async_function_await_reject_shared_fun)                                    \
-  V(ASYNC_FUNCTION_AWAIT_RESOLVE_SHARED_FUN, SharedFunctionInfo,               \
-    async_function_await_resolve_shared_fun)                                   \
   V(ASYNC_FUNCTION_FUNCTION_INDEX, JSFunction, async_function_constructor)     \
   V(ASYNC_FUNCTION_OBJECT_MAP_INDEX, Map, async_function_object_map)           \
   V(ASYNC_GENERATOR_FUNCTION_FUNCTION_INDEX, JSFunction,                       \
     async_generator_function_function)                                         \
-  V(ASYNC_ITERATOR_VALUE_UNWRAP_SHARED_FUN, SharedFunctionInfo,                \
-    async_iterator_value_unwrap_shared_fun)                                    \
-  V(ASYNC_GENERATOR_AWAIT_REJECT_SHARED_FUN, SharedFunctionInfo,               \
-    async_generator_await_reject_shared_fun)                                   \
-  V(ASYNC_GENERATOR_AWAIT_RESOLVE_SHARED_FUN, SharedFunctionInfo,              \
-    async_generator_await_resolve_shared_fun)                                  \
-  V(ASYNC_GENERATOR_YIELD_RESOLVE_SHARED_FUN, SharedFunctionInfo,              \
-    async_generator_yield_resolve_shared_fun)                                  \
-  V(ASYNC_GENERATOR_RETURN_RESOLVE_SHARED_FUN, SharedFunctionInfo,             \
-    async_generator_return_resolve_shared_fun)                                 \
-  V(ASYNC_GENERATOR_RETURN_CLOSED_RESOLVE_SHARED_FUN, SharedFunctionInfo,      \
-    async_generator_return_closed_resolve_shared_fun)                          \
-  V(ASYNC_GENERATOR_RETURN_CLOSED_REJECT_SHARED_FUN, SharedFunctionInfo,       \
-    async_generator_return_closed_reject_shared_fun)                           \
   V(ATOMICS_OBJECT, JSObject, atomics_object)                                  \
   V(BIGINT_FUNCTION_INDEX, JSFunction, bigint_function)                        \
   V(BIGINT64_ARRAY_FUN_INDEX, JSFunction, bigint64_array_fun)                  \
@@ -191,8 +167,6 @@ enum ContextLookupFlags {
   V(JS_SET_FUN_INDEX, JSFunction, js_set_fun)                                  \
   V(JS_SET_MAP_INDEX, Map, js_set_map)                                         \
   V(WEAK_CELL_MAP_INDEX, Map, weak_cell_map)                                   \
-  V(JS_FINALIZATION_REGISTRY_CLEANUP_ITERATOR_MAP_INDEX, Map,                  \
-    js_finalization_registry_cleanup_iterator_map)                             \
   V(JS_WEAK_MAP_FUN_INDEX, JSFunction, js_weak_map_fun)                        \
   V(JS_WEAK_SET_FUN_INDEX, JSFunction, js_weak_set_fun)                        \
   V(JS_WEAK_REF_FUNCTION_INDEX, JSFunction, js_weak_ref_fun)                   \
@@ -226,27 +200,6 @@ enum ContextLookupFlags {
   V(PROXY_FUNCTION_INDEX, JSFunction, proxy_function)                          \
   V(PROXY_MAP_INDEX, Map, proxy_map)                                           \
   V(PROXY_REVOCABLE_RESULT_MAP_INDEX, Map, proxy_revocable_result_map)         \
-  V(PROXY_REVOKE_SHARED_FUN, SharedFunctionInfo, proxy_revoke_shared_fun)      \
-  V(PROMISE_GET_CAPABILITIES_EXECUTOR_SHARED_FUN, SharedFunctionInfo,          \
-    promise_get_capabilities_executor_shared_fun)                              \
-  V(PROMISE_CAPABILITY_DEFAULT_REJECT_SHARED_FUN_INDEX, SharedFunctionInfo,    \
-    promise_capability_default_reject_shared_fun)                              \
-  V(PROMISE_CAPABILITY_DEFAULT_RESOLVE_SHARED_FUN_INDEX, SharedFunctionInfo,   \
-    promise_capability_default_resolve_shared_fun)                             \
-  V(PROMISE_THEN_FINALLY_SHARED_FUN, SharedFunctionInfo,                       \
-    promise_then_finally_shared_fun)                                           \
-  V(PROMISE_CATCH_FINALLY_SHARED_FUN, SharedFunctionInfo,                      \
-    promise_catch_finally_shared_fun)                                          \
-  V(PROMISE_VALUE_THUNK_FINALLY_SHARED_FUN, SharedFunctionInfo,                \
-    promise_value_thunk_finally_shared_fun)                                    \
-  V(PROMISE_THROWER_FINALLY_SHARED_FUN, SharedFunctionInfo,                    \
-    promise_thrower_finally_shared_fun)                                        \
-  V(PROMISE_ALL_RESOLVE_ELEMENT_SHARED_FUN, SharedFunctionInfo,                \
-    promise_all_resolve_element_shared_fun)                                    \
-  V(PROMISE_ALL_SETTLED_RESOLVE_ELEMENT_SHARED_FUN, SharedFunctionInfo,        \
-    promise_all_settled_resolve_element_shared_fun)                            \
-  V(PROMISE_ALL_SETTLED_REJECT_ELEMENT_SHARED_FUN, SharedFunctionInfo,         \
-    promise_all_settled_reject_element_shared_fun)                             \
   V(PROMISE_PROTOTYPE_INDEX, JSObject, promise_prototype)                      \
   V(REGEXP_EXEC_FUNCTION_INDEX, JSFunction, regexp_exec_function)              \
   V(REGEXP_FUNCTION_INDEX, JSFunction, regexp_function)                        \
@@ -343,16 +296,20 @@ enum ContextLookupFlags {
   V(ERROR_FUNCTION_INDEX, JSFunction, error_function)                          \
   V(ERROR_TO_STRING, JSFunction, error_to_string)                              \
   V(EVAL_ERROR_FUNCTION_INDEX, JSFunction, eval_error_function)                \
+  V(AGGREGATE_ERROR_FUNCTION_INDEX, JSFunction, aggregate_error_function)      \
   V(GLOBAL_EVAL_FUN_INDEX, JSFunction, global_eval_fun)                        \
   V(GLOBAL_PROXY_FUNCTION_INDEX, JSFunction, global_proxy_function)            \
   V(MAP_DELETE_INDEX, JSFunction, map_delete)                                  \
   V(MAP_GET_INDEX, JSFunction, map_get)                                        \
   V(MAP_HAS_INDEX, JSFunction, map_has)                                        \
   V(MAP_SET_INDEX, JSFunction, map_set)                                        \
+  V(FINALIZATION_REGISTRY_CLEANUP_SOME, JSFunction,                            \
+    finalization_registry_cleanup_some)                                        \
   V(FUNCTION_HAS_INSTANCE_INDEX, JSFunction, function_has_instance)            \
   V(OBJECT_TO_STRING, JSFunction, object_to_string)                            \
   V(OBJECT_VALUE_OF_FUNCTION_INDEX, JSFunction, object_value_of_function)      \
   V(PROMISE_ALL_INDEX, JSFunction, promise_all)                                \
+  V(PROMISE_ANY_INDEX, JSFunction, promise_any)                                \
   V(PROMISE_CATCH_INDEX, JSFunction, promise_catch)                            \
   V(PROMISE_FUNCTION_INDEX, JSFunction, promise_function)                      \
   V(RANGE_ERROR_FUNCTION_INDEX, JSFunction, range_error_function)              \
@@ -371,6 +328,7 @@ enum ContextLookupFlags {
   V(WEAKMAP_SET_INDEX, JSFunction, weakmap_set)                                \
   V(WEAKMAP_GET_INDEX, JSFunction, weakmap_get)                                \
   V(WEAKSET_ADD_INDEX, JSFunction, weakset_add)                                \
+  V(RETAINED_MAPS, WeakArrayList, retained_maps)                               \
   V(OSR_CODE_CACHE_INDEX, WeakFixedArray, osr_code_cache)
 
 // A table of all script contexts. Every loaded top-level script with top-level
@@ -694,7 +652,8 @@ class NativeContext : public Context {
   // TODO(neis): Move some stuff from Context here.
 
   // [microtask_queue]: pointer to the MicrotaskQueue object.
-  DECL_PRIMITIVE_ACCESSORS(microtask_queue, MicrotaskQueue*)
+  DECL_GETTER(microtask_queue, MicrotaskQueue*)
+  inline void set_microtask_queue(Isolate* isolate, MicrotaskQueue* queue);
 
   // Dispatched behavior.
   DECL_PRINTER(NativeContext)
diff --git a/deps/v8/src/objects/contexts.tq b/deps/v8/src/objects/contexts.tq
index 6def2320ffa..1b0ae080c3e 100644
--- a/deps/v8/src/objects/contexts.tq
+++ b/deps/v8/src/objects/contexts.tq
@@ -6,7 +6,7 @@
 extern class Context extends HeapObject {
   length: Smi;
   scope_info: ScopeInfo;
-  previous: Object;
+  previous: Context|Zero|Undefined;
 }
 extern class AwaitContext extends Context generates 'TNode<Context>';
 extern class BlockContext extends Context generates 'TNode<Context>';
@@ -24,6 +24,7 @@ const MIN_CONTEXT_SLOTS: constexpr int31
     generates 'Context::MIN_CONTEXT_SLOTS';
 
 extern enum NativeContextSlot extends intptr constexpr 'Context::Field' {
+  AGGREGATE_ERROR_FUNCTION_INDEX,
   ARRAY_BUFFER_FUN_INDEX,
   ARRAY_BUFFER_NOINIT_FUN_INDEX,
   ARRAY_BUFFER_MAP_INDEX,
@@ -35,11 +36,13 @@ extern enum NativeContextSlot extends intptr constexpr 'Context::Field' {
   JS_ARRAY_PACKED_SMI_ELEMENTS_MAP_INDEX,
   MATH_RANDOM_CACHE_INDEX,
   MATH_RANDOM_INDEX_INDEX,
+  NUMBER_FUNCTION_INDEX,
   PROXY_REVOCABLE_RESULT_MAP_INDEX,
   REFLECT_APPLY_INDEX,
   REGEXP_FUNCTION_INDEX,
   REGEXP_LAST_MATCH_INFO_INDEX,
   INITIAL_STRING_ITERATOR_MAP_INDEX,
+  INITIAL_ARRAY_ITERATOR_MAP_INDEX,
   SLOW_OBJECT_WITH_NULL_PROTOTYPE_MAP,
   STRICT_ARGUMENTS_MAP_INDEX,
   SLOPPY_ARGUMENTS_MAP_INDEX,
@@ -47,20 +50,13 @@ extern enum NativeContextSlot extends intptr constexpr 'Context::Field' {
 
   PROMISE_FUNCTION_INDEX,
   PROMISE_THEN_INDEX,
-  PROMISE_ALL_RESOLVE_ELEMENT_SHARED_FUN,
-  PROMISE_ALL_SETTLED_REJECT_ELEMENT_SHARED_FUN,
-  PROMISE_ALL_SETTLED_RESOLVE_ELEMENT_SHARED_FUN,
-  PROMISE_CAPABILITY_DEFAULT_RESOLVE_SHARED_FUN_INDEX,
-  PROMISE_CAPABILITY_DEFAULT_REJECT_SHARED_FUN_INDEX,
-  PROMISE_CATCH_FINALLY_SHARED_FUN,
-  PROMISE_GET_CAPABILITIES_EXECUTOR_SHARED_FUN,
   PROMISE_PROTOTYPE_INDEX,
-  PROMISE_THROWER_FINALLY_SHARED_FUN,
-  PROMISE_THEN_FINALLY_SHARED_FUN,
-  PROMISE_VALUE_THUNK_FINALLY_SHARED_FUN,
   STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX,
 
   CONTINUATION_PRESERVED_EMBEDDER_DATA_INDEX,
+
+  BOUND_FUNCTION_WITH_CONSTRUCTOR_MAP_INDEX,
+  BOUND_FUNCTION_WITHOUT_CONSTRUCTOR_MAP_INDEX,
   ...
 }
 
@@ -78,3 +74,9 @@ extern operator '[]=' macro StoreContextElement(
 
 extern operator '[]' macro LoadContextElement(Context, intptr): Object;
 extern operator '[]' macro LoadContextElement(Context, Smi): Object;
+
+// A dummy used instead of a context constant for runtime calls that don't need
+// a context.
+type NoContext extends Smi;
+extern macro NoContextConstant(): NoContext;
+const kNoContext: NoContext = NoContextConstant();
diff --git a/deps/v8/src/objects/debug-objects-inl.h b/deps/v8/src/objects/debug-objects-inl.h
index c5b024ed1d3..886c31583e6 100644
--- a/deps/v8/src/objects/debug-objects-inl.h
+++ b/deps/v8/src/objects/debug-objects-inl.h
@@ -51,6 +51,9 @@ BytecodeArray DebugInfo::DebugBytecodeArray() {
   return BytecodeArray::cast(debug_bytecode_array());
 }
 
+TQ_OBJECT_CONSTRUCTORS_IMPL(WasmValue)
+NEVER_READ_ONLY_SPACE_IMPL(WasmValue)
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/debug-objects.h b/deps/v8/src/objects/debug-objects.h
index a7ce9ec3672..22eea25481b 100644
--- a/deps/v8/src/objects/debug-objects.h
+++ b/deps/v8/src/objects/debug-objects.h
@@ -28,7 +28,6 @@ class DebugInfo : public TorqueGeneratedDebugInfo<DebugInfo, Struct> {
  public:
   NEVER_READ_ONLY_SPACE
   DEFINE_TORQUE_GENERATED_DEBUG_INFO_FLAGS()
-  using Flags = base::Flags<Flag>;
 
   // DebugInfo can be detached from the SharedFunctionInfo iff it is empty.
   bool IsEmpty() const;
@@ -126,9 +125,6 @@ class DebugInfo : public TorqueGeneratedDebugInfo<DebugInfo, Struct> {
   // Clears all fields related to block coverage.
   void ClearCoverageInfo(Isolate* isolate);
 
-  // Dispatched behavior.
-  DECL_PRINTER(DebugInfo)
-
   static const int kEstimatedNofBreakPointsInFunction = 4;
 
  private:
@@ -202,6 +198,14 @@ class BreakPoint : public TorqueGeneratedBreakPoint<BreakPoint, Struct> {
   TQ_OBJECT_CONSTRUCTORS(BreakPoint)
 };
 
+// Holds Wasm values. This is used by the inspector.
+class WasmValue : public TorqueGeneratedWasmValue<WasmValue, Struct> {
+ public:
+  NEVER_READ_ONLY_SPACE
+
+  TQ_OBJECT_CONSTRUCTORS(WasmValue)
+};
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/debug-objects.tq b/deps/v8/src/objects/debug-objects.tq
index d50d86c4822..8544e793664 100644
--- a/deps/v8/src/objects/debug-objects.tq
+++ b/deps/v8/src/objects/debug-objects.tq
@@ -35,6 +35,7 @@ bitfield struct DebuggerHints extends uint31 {
 }
 
 @generateCppClass
+@generatePrint
 extern class DebugInfo extends Struct {
   shared: SharedFunctionInfo;
   // Bit field containing various information collected for debugging.
@@ -69,3 +70,15 @@ extern class CoverageInfo extends HeapObject {
   const slot_count: int32;
   slots[slot_count]: CoverageInfoSlot;
 }
+
+@generateCppClass
+@generatePrint
+extern class WasmValue extends Struct {
+  // The type, should map to ValueType::Kind values in value-type.h.
+  value_type: SmiTagged<WasmValueType>;
+  // Holds the actual value. For example, if this holds a Wasm i32, this will
+  // be of length 4, for s128, it will have length 16. These values are
+  // represented by the respective C++ types, and memcpy-ed in.
+  // When value_type is a anyref, it holds the object that anyref points to.
+  bytes_or_ref: Object|ByteArray;
+}
diff --git a/deps/v8/src/objects/descriptor-array-inl.h b/deps/v8/src/objects/descriptor-array-inl.h
index cfbc4f7ec81..357a6732e22 100644
--- a/deps/v8/src/objects/descriptor-array-inl.h
+++ b/deps/v8/src/objects/descriptor-array-inl.h
@@ -24,12 +24,9 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(DescriptorArray, HeapObject)
+TQ_OBJECT_CONSTRUCTORS_IMPL(DescriptorArray)
 TQ_OBJECT_CONSTRUCTORS_IMPL(EnumCache)
 
-CAST_ACCESSOR(DescriptorArray)
-
-ACCESSORS(DescriptorArray, enum_cache, EnumCache, kEnumCacheOffset)
 RELAXED_INT16_ACCESSORS(DescriptorArray, number_of_all_descriptors,
                         kNumberOfAllDescriptorsOffset)
 RELAXED_INT16_ACCESSORS(DescriptorArray, number_of_descriptors,
diff --git a/deps/v8/src/objects/descriptor-array.h b/deps/v8/src/objects/descriptor-array.h
index e24673d01cb..7a4030f4380 100644
--- a/deps/v8/src/objects/descriptor-array.h
+++ b/deps/v8/src/objects/descriptor-array.h
@@ -50,13 +50,13 @@ class EnumCache : public TorqueGeneratedEnumCache<EnumCache, Struct> {
 // The "value" fields store either values or field types. A field type is either
 // FieldType::None(), FieldType::Any() or a weak reference to a Map. All other
 // references are strong.
-class DescriptorArray : public HeapObject {
+class DescriptorArray
+    : public TorqueGeneratedDescriptorArray<DescriptorArray, HeapObject> {
  public:
   DECL_INT16_ACCESSORS(number_of_all_descriptors)
   DECL_INT16_ACCESSORS(number_of_descriptors)
   inline int16_t number_of_slack_descriptors() const;
   inline int number_of_entries() const;
-  DECL_ACCESSORS(enum_cache, EnumCache)
 
   void ClearEnumCache();
   inline void CopyEnumCacheFrom(DescriptorArray array);
@@ -135,14 +135,9 @@ class DescriptorArray : public HeapObject {
   void Initialize(EnumCache enum_cache, HeapObject undefined_value,
                   int nof_descriptors, int slack);
 
-  DECL_CAST(DescriptorArray)
-
   // Constant for denoting key was not found.
   static const int kNotFound = -1;
 
-  // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
-                                TORQUE_GENERATED_DESCRIPTOR_ARRAY_FIELDS)
   STATIC_ASSERT(IsAligned(kStartOfWeakFieldsOffset, kTaggedSize));
   STATIC_ASSERT(IsAligned(kHeaderSize, kTaggedSize));
 
@@ -194,7 +189,7 @@ class DescriptorArray : public HeapObject {
 
 #ifdef DEBUG
   // Is the descriptor array sorted and without duplicates?
-  V8_EXPORT_PRIVATE bool IsSortedNoDuplicates(int valid_descriptors = -1);
+  V8_EXPORT_PRIVATE bool IsSortedNoDuplicates();
 
   // Are two DescriptorArrays equal?
   bool IsEqualTo(DescriptorArray other);
@@ -234,7 +229,7 @@ class DescriptorArray : public HeapObject {
   // Swap first and second descriptor.
   inline void SwapSortedKeys(int first, int second);
 
-  OBJECT_CONSTRUCTORS(DescriptorArray, HeapObject);
+  TQ_OBJECT_CONSTRUCTORS(DescriptorArray)
 };
 
 class NumberOfMarkedDescriptors {
diff --git a/deps/v8/src/objects/descriptor-array.tq b/deps/v8/src/objects/descriptor-array.tq
index 53c209e2378..0b088b3d734 100644
--- a/deps/v8/src/objects/descriptor-array.tq
+++ b/deps/v8/src/objects/descriptor-array.tq
@@ -16,6 +16,7 @@ struct DescriptorEntry {
   value: JSAny|Weak<Map>|AccessorInfo|AccessorPair|ClassPositions;
 }
 
+@generateCppClass
 extern class DescriptorArray extends HeapObject {
   const number_of_all_descriptors: uint16;
   number_of_descriptors: uint16;
diff --git a/deps/v8/src/objects/elements-kind.h b/deps/v8/src/objects/elements-kind.h
index a09eada629e..ec3ca3402d1 100644
--- a/deps/v8/src/objects/elements-kind.h
+++ b/deps/v8/src/objects/elements-kind.h
@@ -127,6 +127,14 @@ inline bool IsDictionaryElementsKind(ElementsKind kind) {
   return kind == DICTIONARY_ELEMENTS;
 }
 
+inline bool IsFastArgumentsElementsKind(ElementsKind kind) {
+  return kind == FAST_SLOPPY_ARGUMENTS_ELEMENTS;
+}
+
+inline bool IsSlowArgumentsElementsKind(ElementsKind kind) {
+  return kind == SLOW_SLOPPY_ARGUMENTS_ELEMENTS;
+}
+
 inline bool IsSloppyArgumentsElementsKind(ElementsKind kind) {
   return base::IsInRange(kind, FAST_SLOPPY_ARGUMENTS_ELEMENTS,
                          SLOW_SLOPPY_ARGUMENTS_ELEMENTS);
diff --git a/deps/v8/src/objects/elements.cc b/deps/v8/src/objects/elements.cc
index d0c680d287d..bb2cb1e3f02 100644
--- a/deps/v8/src/objects/elements.cc
+++ b/deps/v8/src/objects/elements.cc
@@ -22,6 +22,8 @@
 #include "src/objects/slots-atomic-inl.h"
 #include "src/objects/slots.h"
 #include "src/utils/utils.h"
+#include "torque-generated/exported-class-definitions-tq-inl.h"
+#include "torque-generated/exported-class-definitions-tq.h"
 
 // Each concrete ElementsAccessor can handle exactly one ElementsKind,
 // several abstract ElementsAccessor classes are used to allow sharing
@@ -3882,11 +3884,11 @@ class SloppyArgumentsElementsAccessor
                                 InternalIndex entry) {
     Handle<SloppyArgumentsElements> elements(
         SloppyArgumentsElements::cast(parameters), isolate);
-    uint32_t length = elements->parameter_map_length();
+    uint32_t length = elements->length();
     if (entry.as_uint32() < length) {
       // Read context mapped entry.
       DisallowHeapAllocation no_gc;
-      Object probe = elements->get_mapped_entry(entry.as_uint32());
+      Object probe = elements->mapped_entries(entry.as_uint32());
       DCHECK(!probe.IsTheHole(isolate));
       Context context = elements->context();
       int context_entry = Smi::ToInt(probe);
@@ -3918,13 +3920,13 @@ class SloppyArgumentsElementsAccessor
   static inline void SetImpl(FixedArrayBase store, InternalIndex entry,
                              Object value) {
     SloppyArgumentsElements elements = SloppyArgumentsElements::cast(store);
-    uint32_t length = elements.parameter_map_length();
+    uint32_t length = elements.length();
     if (entry.as_uint32() < length) {
       // Store context mapped entry.
       DisallowHeapAllocation no_gc;
-      Object probe = elements.get_mapped_entry(entry.as_uint32());
+      Object probe = elements.mapped_entries(entry.as_uint32());
       DCHECK(!probe.IsTheHole());
-      Context context = elements.context();
+      Context context = Context::cast(elements.context());
       int context_entry = Smi::ToInt(probe);
       DCHECK(!context.get(context_entry).IsTheHole());
       context.set(context_entry, value);
@@ -3935,7 +3937,7 @@ class SloppyArgumentsElementsAccessor
           ArgumentsAccessor::GetRaw(arguments, entry.adjust_down(length));
       if (current.IsAliasedArgumentsEntry()) {
         AliasedArgumentsEntry alias = AliasedArgumentsEntry::cast(current);
-        Context context = elements.context();
+        Context context = Context::cast(elements.context());
         int context_entry = alias.aliased_context_slot();
         DCHECK(!context.get(context_entry).IsTheHole());
         context.set(context_entry, value);
@@ -3955,7 +3957,7 @@ class SloppyArgumentsElementsAccessor
   static uint32_t GetCapacityImpl(JSObject holder, FixedArrayBase store) {
     SloppyArgumentsElements elements = SloppyArgumentsElements::cast(store);
     FixedArray arguments = elements.arguments();
-    return elements.parameter_map_length() +
+    return elements.length() +
            ArgumentsAccessor::GetCapacityImpl(holder, arguments);
   }
 
@@ -3967,7 +3969,7 @@ class SloppyArgumentsElementsAccessor
     size_t max_entries =
         ArgumentsAccessor::GetMaxNumberOfEntries(holder, arguments);
     DCHECK_LE(max_entries, std::numeric_limits<uint32_t>::max());
-    return elements.parameter_map_length() + static_cast<uint32_t>(max_entries);
+    return elements.length() + static_cast<uint32_t>(max_entries);
   }
 
   static uint32_t NumberOfElementsImpl(JSObject receiver,
@@ -3977,7 +3979,7 @@ class SloppyArgumentsElementsAccessor
         SloppyArgumentsElements::cast(backing_store);
     FixedArrayBase arguments = elements.arguments();
     uint32_t nof_elements = 0;
-    uint32_t length = elements.parameter_map_length();
+    uint32_t length = elements.length();
     for (uint32_t index = 0; index < length; index++) {
       if (HasParameterMapArg(isolate, elements, index)) nof_elements++;
     }
@@ -4004,7 +4006,7 @@ class SloppyArgumentsElementsAccessor
                            InternalIndex entry) {
     SloppyArgumentsElements elements =
         SloppyArgumentsElements::cast(parameters);
-    uint32_t length = elements.parameter_map_length();
+    uint32_t length = elements.length();
     if (entry.raw_value() < length) {
       return HasParameterMapArg(isolate, elements, entry.raw_value());
     }
@@ -4035,13 +4037,13 @@ class SloppyArgumentsElementsAccessor
     if (entry.is_not_found()) return entry;
     // Arguments entries could overlap with the dictionary entries, hence offset
     // them by the number of context mapped entries.
-    return entry.adjust_up(elements.parameter_map_length());
+    return entry.adjust_up(elements.length());
   }
 
   static PropertyDetails GetDetailsImpl(JSObject holder, InternalIndex entry) {
     SloppyArgumentsElements elements =
         SloppyArgumentsElements::cast(holder.elements());
-    uint32_t length = elements.parameter_map_length();
+    uint32_t length = elements.length();
     if (entry.as_uint32() < length) {
       return PropertyDetails(kData, NONE, PropertyCellType::kNoCell);
     }
@@ -4053,16 +4055,16 @@ class SloppyArgumentsElementsAccessor
   static bool HasParameterMapArg(Isolate* isolate,
                                  SloppyArgumentsElements elements,
                                  size_t index) {
-    uint32_t length = elements.parameter_map_length();
+    uint32_t length = elements.length();
     if (index >= length) return false;
-    return !elements.get_mapped_entry(static_cast<uint32_t>(index))
+    return !elements.mapped_entries(static_cast<uint32_t>(index))
                 .IsTheHole(isolate);
   }
 
   static void DeleteImpl(Handle<JSObject> obj, InternalIndex entry) {
     Handle<SloppyArgumentsElements> elements(
         SloppyArgumentsElements::cast(obj->elements()), obj->GetIsolate());
-    uint32_t length = elements->parameter_map_length();
+    uint32_t length = elements->length();
     InternalIndex delete_or_entry = entry;
     if (entry.as_uint32() < length) {
       delete_or_entry = InternalIndex::NotFound();
@@ -4071,8 +4073,8 @@ class SloppyArgumentsElementsAccessor
     // SloppyDeleteImpl allocates a new dictionary elements store. For making
     // heap verification happy we postpone clearing out the mapped entry.
     if (entry.as_uint32() < length) {
-      elements->set_mapped_entry(entry.as_uint32(),
-                                 obj->GetReadOnlyRoots().the_hole_value());
+      elements->set_mapped_entries(entry.as_uint32(),
+                                   obj->GetReadOnlyRoots().the_hole_value());
     }
   }
 
@@ -4107,10 +4109,10 @@ class SloppyArgumentsElementsAccessor
       uint32_t insertion_index = 0) {
     Handle<SloppyArgumentsElements> elements =
         Handle<SloppyArgumentsElements>::cast(backing_store);
-    uint32_t length = elements->parameter_map_length();
+    uint32_t length = elements->length();
 
     for (uint32_t i = 0; i < length; ++i) {
-      if (elements->get_mapped_entry(i).IsTheHole(isolate)) continue;
+      if (elements->mapped_entries(i).IsTheHole(isolate)) continue;
       if (convert == GetKeysConversion::kConvertToString) {
         Handle<String> index_string = isolate->factory()->Uint32ToString(i);
         list->set(insertion_index, *index_string);
@@ -4238,7 +4240,7 @@ class SlowSloppyArgumentsElementsAccessor
     Isolate* isolate = obj->GetIsolate();
     Handle<NumberDictionary> dict(NumberDictionary::cast(elements->arguments()),
                                   isolate);
-    uint32_t length = elements->parameter_map_length();
+    uint32_t length = elements->length();
     dict =
         NumberDictionary::DeleteEntry(isolate, dict, entry.adjust_down(length));
     elements->set_arguments(*dict);
@@ -4271,9 +4273,9 @@ class SlowSloppyArgumentsElementsAccessor
     Isolate* isolate = object->GetIsolate();
     Handle<SloppyArgumentsElements> elements =
         Handle<SloppyArgumentsElements>::cast(store);
-    uint32_t length = elements->parameter_map_length();
+    uint32_t length = elements->length();
     if (entry.as_uint32() < length) {
-      Object probe = elements->get_mapped_entry(entry.as_uint32());
+      Object probe = elements->mapped_entries(entry.as_uint32());
       DCHECK(!probe.IsTheHole(isolate));
       Context context = elements->context();
       int context_entry = Smi::ToInt(probe);
@@ -4281,8 +4283,8 @@ class SlowSloppyArgumentsElementsAccessor
       context.set(context_entry, *value);
 
       // Redefining attributes of an aliased element destroys fast aliasing.
-      elements->set_mapped_entry(entry.as_uint32(),
-                                 ReadOnlyRoots(isolate).the_hole_value());
+      elements->set_mapped_entries(entry.as_uint32(),
+                                   ReadOnlyRoots(isolate).the_hole_value());
       // For elements that are still writable we re-establish slow aliasing.
       if ((attributes & READ_ONLY) == 0) {
         value = isolate->factory()->NewAliasedArgumentsEntry(context_entry);
@@ -4339,7 +4341,7 @@ class FastSloppyArgumentsElementsAccessor
     // kMaxUInt32 indicates that a context mapped element got deleted. In this
     // case we only normalize the elements (aka. migrate to SLOW_SLOPPY).
     if (entry->is_not_found()) return dictionary;
-    uint32_t length = elements->parameter_map_length();
+    uint32_t length = elements->length();
     if (entry->as_uint32() >= length) {
       *entry =
           dictionary
diff --git a/deps/v8/src/objects/embedder-data-slot-inl.h b/deps/v8/src/objects/embedder-data-slot-inl.h
index 8222575aa30..3e5276166da 100644
--- a/deps/v8/src/objects/embedder-data-slot-inl.h
+++ b/deps/v8/src/objects/embedder-data-slot-inl.h
@@ -67,7 +67,8 @@ void EmbedderDataSlot::store_tagged(JSObject object, int embedder_field_index,
 #endif
 }
 
-bool EmbedderDataSlot::ToAlignedPointer(void** out_pointer) const {
+bool EmbedderDataSlot::ToAlignedPointer(const Isolate* isolate,
+                                        void** out_pointer) const {
   // We don't care about atomicity of access here because embedder slots
   // are accessed this way only from the main thread via API during "mutator"
   // phase which is propely synched with GC (concurrent marker may still look
@@ -78,6 +79,8 @@ bool EmbedderDataSlot::ToAlignedPointer(void** out_pointer) const {
   // aligned so we have to use unaligned pointer friendly way of accessing them
   // in order to avoid undefined behavior in C++ code.
   Address raw_value = base::ReadUnalignedValue<Address>(address());
+  // We currently have to treat zero as nullptr in embedder slots.
+  if (raw_value) raw_value = DecodeExternalPointer(isolate, raw_value);
 #else
   Address raw_value = *location();
 #endif
@@ -85,15 +88,18 @@ bool EmbedderDataSlot::ToAlignedPointer(void** out_pointer) const {
   return HAS_SMI_TAG(raw_value);
 }
 
-bool EmbedderDataSlot::store_aligned_pointer(void* ptr) {
+bool EmbedderDataSlot::store_aligned_pointer(Isolate* isolate, void* ptr) {
   Address value = reinterpret_cast<Address>(ptr);
   if (!HAS_SMI_TAG(value)) return false;
+  // We currently have to treat zero as nullptr in embedder slots.
+  if (value) value = EncodeExternalPointer(isolate, value);
+  DCHECK(HAS_SMI_TAG(value));
   gc_safe_store(value);
   return true;
 }
 
 EmbedderDataSlot::RawData EmbedderDataSlot::load_raw(
-    const DisallowHeapAllocation& no_gc) const {
+    Isolate* isolate, const DisallowHeapAllocation& no_gc) const {
   // We don't care about atomicity of access here because embedder slots
   // are accessed this way only by serializer from the main thread when
   // GC is not active (concurrent marker may still look at the tagged part
@@ -103,14 +109,20 @@ EmbedderDataSlot::RawData EmbedderDataSlot::load_raw(
   // fields (external pointers, doubles and BigInt data) are only kTaggedSize
   // aligned so we have to use unaligned pointer friendly way of accessing them
   // in order to avoid undefined behavior in C++ code.
-  return base::ReadUnalignedValue<Address>(address());
+  Address value = base::ReadUnalignedValue<Address>(address());
+  // We currently have to treat zero as nullptr in embedder slots.
+  if (value) return DecodeExternalPointer(isolate, value);
+  return value;
 #else
   return *location();
 #endif
 }
 
-void EmbedderDataSlot::store_raw(EmbedderDataSlot::RawData data,
+void EmbedderDataSlot::store_raw(Isolate* isolate,
+                                 EmbedderDataSlot::RawData data,
                                  const DisallowHeapAllocation& no_gc) {
+  // We currently have to treat zero as nullptr in embedder slots.
+  if (data) data = EncodeExternalPointer(isolate, data);
   gc_safe_store(data);
 }
 
diff --git a/deps/v8/src/objects/embedder-data-slot.h b/deps/v8/src/objects/embedder-data-slot.h
index dee8c3ec56e..2881ca03b32 100644
--- a/deps/v8/src/objects/embedder-data-slot.h
+++ b/deps/v8/src/objects/embedder-data-slot.h
@@ -66,14 +66,18 @@ class EmbedderDataSlot
   // the pointer-like value. Note, that some Smis could still look like an
   // aligned pointers.
   // Returns true on success.
-  V8_INLINE bool ToAlignedPointer(void** out_result) const;
+  V8_INLINE bool ToAlignedPointer(const Isolate* isolate,
+                                  void** out_result) const;
 
   // Returns true if the pointer was successfully stored or false it the pointer
   // was improperly aligned.
-  V8_INLINE V8_WARN_UNUSED_RESULT bool store_aligned_pointer(void* ptr);
+  V8_INLINE V8_WARN_UNUSED_RESULT bool store_aligned_pointer(Isolate* isolate,
+                                                             void* ptr);
 
-  V8_INLINE RawData load_raw(const DisallowHeapAllocation& no_gc) const;
-  V8_INLINE void store_raw(RawData data, const DisallowHeapAllocation& no_gc);
+  V8_INLINE RawData load_raw(Isolate* isolate,
+                             const DisallowHeapAllocation& no_gc) const;
+  V8_INLINE void store_raw(Isolate* isolate, RawData data,
+                           const DisallowHeapAllocation& no_gc);
 
  private:
   // Stores given value to the embedder data slot in a concurrent-marker
diff --git a/deps/v8/src/objects/feedback-vector-inl.h b/deps/v8/src/objects/feedback-vector-inl.h
index 72b6e14883a..42c2fa51530 100644
--- a/deps/v8/src/objects/feedback-vector-inl.h
+++ b/deps/v8/src/objects/feedback-vector-inl.h
@@ -233,32 +233,47 @@ BinaryOperationHint BinaryOperationHintFromFeedback(int type_feedback) {
 }
 
 // Helper function to transform the feedback to CompareOperationHint.
+template <CompareOperationFeedback::Type Feedback>
+bool Is(int type_feedback) {
+  return !(type_feedback & ~Feedback);
+}
+
 CompareOperationHint CompareOperationHintFromFeedback(int type_feedback) {
-  switch (type_feedback) {
-    case CompareOperationFeedback::kNone:
-      return CompareOperationHint::kNone;
-    case CompareOperationFeedback::kSignedSmall:
-      return CompareOperationHint::kSignedSmall;
-    case CompareOperationFeedback::kNumber:
-      return CompareOperationHint::kNumber;
-    case CompareOperationFeedback::kNumberOrOddball:
-      return CompareOperationHint::kNumberOrOddball;
-    case CompareOperationFeedback::kInternalizedString:
-      return CompareOperationHint::kInternalizedString;
-    case CompareOperationFeedback::kString:
-      return CompareOperationHint::kString;
-    case CompareOperationFeedback::kSymbol:
-      return CompareOperationHint::kSymbol;
-    case CompareOperationFeedback::kBigInt:
-      return CompareOperationHint::kBigInt;
-    case CompareOperationFeedback::kReceiver:
-      return CompareOperationHint::kReceiver;
-    case CompareOperationFeedback::kReceiverOrNullOrUndefined:
-      return CompareOperationHint::kReceiverOrNullOrUndefined;
-    default:
-      return CompareOperationHint::kAny;
+  if (Is<CompareOperationFeedback::kNone>(type_feedback)) {
+    return CompareOperationHint::kNone;
   }
-  UNREACHABLE();
+
+  if (Is<CompareOperationFeedback::kSignedSmall>(type_feedback)) {
+    return CompareOperationHint::kSignedSmall;
+  } else if (Is<CompareOperationFeedback::kNumber>(type_feedback)) {
+    return CompareOperationHint::kNumber;
+  } else if (Is<CompareOperationFeedback::kNumberOrBoolean>(type_feedback)) {
+    return CompareOperationHint::kNumberOrBoolean;
+  }
+
+  if (Is<CompareOperationFeedback::kInternalizedString>(type_feedback)) {
+    return CompareOperationHint::kInternalizedString;
+  } else if (Is<CompareOperationFeedback::kString>(type_feedback)) {
+    return CompareOperationHint::kString;
+  }
+
+  if (Is<CompareOperationFeedback::kReceiver>(type_feedback)) {
+    return CompareOperationHint::kReceiver;
+  } else if (Is<CompareOperationFeedback::kReceiverOrNullOrUndefined>(
+                 type_feedback)) {
+    return CompareOperationHint::kReceiverOrNullOrUndefined;
+  }
+
+  if (Is<CompareOperationFeedback::kBigInt>(type_feedback)) {
+    return CompareOperationHint::kBigInt;
+  }
+
+  if (Is<CompareOperationFeedback::kSymbol>(type_feedback)) {
+    return CompareOperationHint::kSymbol;
+  }
+
+  DCHECK(Is<CompareOperationFeedback::kAny>(type_feedback));
+  return CompareOperationHint::kAny;
 }
 
 // Helper function to transform the feedback to ForInHint.
diff --git a/deps/v8/src/objects/feedback-vector.cc b/deps/v8/src/objects/feedback-vector.cc
index 929b312f227..e3e607f01c1 100644
--- a/deps/v8/src/objects/feedback-vector.cc
+++ b/deps/v8/src/objects/feedback-vector.cc
@@ -238,7 +238,13 @@ Handle<FeedbackVector> FeedbackVector::New(
     Handle<ClosureFeedbackCellArray> closure_feedback_cell_array) {
   Factory* factory = isolate->factory();
 
-  const int slot_count = shared->feedback_metadata().slot_count();
+  // Hold on to bytecode here. The allocation of a new feedback vector could
+  // trigger a GC and flush the bytecode and feedback metadata.
+  IsCompiledScope is_compiled_scope(*shared, isolate);
+  CHECK(is_compiled_scope.is_compiled());
+  Handle<FeedbackMetadata> feedback_metadata(shared->feedback_metadata(),
+                                             isolate);
+  const int slot_count = feedback_metadata->slot_count();
 
   Handle<FeedbackVector> vector =
       factory->NewFeedbackVector(shared, closure_feedback_cell_array);
@@ -260,7 +266,7 @@ Handle<FeedbackVector> FeedbackVector::New(
             *uninitialized_sentinel);
   for (int i = 0; i < slot_count;) {
     FeedbackSlot slot(i);
-    FeedbackSlotKind kind = shared->feedback_metadata().GetKind(slot);
+    FeedbackSlotKind kind = feedback_metadata->GetKind(slot);
     int index = FeedbackVector::GetIndex(slot);
     int entry_size = FeedbackMetadata::GetSlotSize(kind);
 
@@ -983,7 +989,7 @@ int FeedbackNexus::ExtractMaps(MapHandles* maps) const {
 
 int FeedbackNexus::ExtractMapsAndHandlers(
     std::vector<std::pair<Handle<Map>, MaybeObjectHandle>>* maps_and_handlers,
-    bool drop_deprecated) const {
+    bool try_update_deprecated) const {
   DCHECK(IsLoadICKind(kind()) ||
          IsStoreICKind(kind()) | IsKeyedLoadICKind(kind()) ||
          IsKeyedStoreICKind(kind()) || IsStoreOwnICKind(kind()) ||
@@ -1015,10 +1021,13 @@ int FeedbackNexus::ExtractMapsAndHandlers(
         MaybeObject handler = array.Get(i + 1);
         if (!handler->IsCleared()) {
           DCHECK(IC::IsHandler(handler));
-          Map map = Map::cast(heap_object);
-          if (drop_deprecated && map.is_deprecated()) continue;
+          Handle<Map> map(Map::cast(heap_object), isolate);
+          if (try_update_deprecated &&
+              !Map::TryUpdate(isolate, map).ToHandle(&map)) {
+            continue;
+          }
           maps_and_handlers->push_back(
-              MapAndHandler(handle(map, isolate), handle(handler, isolate)));
+              MapAndHandler(map, handle(handler, isolate)));
           found++;
         }
       }
@@ -1028,10 +1037,13 @@ int FeedbackNexus::ExtractMapsAndHandlers(
     MaybeObject handler = GetFeedbackExtra();
     if (!handler->IsCleared()) {
       DCHECK(IC::IsHandler(handler));
-      Map map = Map::cast(heap_object);
-      if (drop_deprecated && map.is_deprecated()) return 0;
+      Handle<Map> map = handle(Map::cast(heap_object), isolate);
+      if (try_update_deprecated &&
+          !Map::TryUpdate(isolate, map).ToHandle(&map)) {
+        return 0;
+      }
       maps_and_handlers->push_back(
-          MapAndHandler(handle(map, isolate), handle(handler, isolate)));
+          MapAndHandler(map, handle(handler, isolate)));
       return 1;
     }
   }
diff --git a/deps/v8/src/objects/feedback-vector.h b/deps/v8/src/objects/feedback-vector.h
index f1d2cc3029e..24025ad16a4 100644
--- a/deps/v8/src/objects/feedback-vector.h
+++ b/deps/v8/src/objects/feedback-vector.h
@@ -651,7 +651,7 @@ class V8_EXPORT_PRIVATE FeedbackNexus final {
 
   int ExtractMaps(MapHandles* maps) const;
   int ExtractMapsAndHandlers(std::vector<MapAndHandler>* maps_and_handlers,
-                             bool drop_deprecated = false) const;
+                             bool try_update_deprecated = false) const;
   MaybeObjectHandle FindHandlerForMap(Handle<Map> map) const;
 
   bool IsCleared() const {
diff --git a/deps/v8/src/objects/feedback-vector.tq b/deps/v8/src/objects/feedback-vector.tq
index c981b8f57c4..8ede5579d54 100644
--- a/deps/v8/src/objects/feedback-vector.tq
+++ b/deps/v8/src/objects/feedback-vector.tq
@@ -6,13 +6,15 @@ extern class FeedbackVector extends HeapObject {
   shared_function_info: SharedFunctionInfo;
   optimized_code_weak_or_smi: Weak<Code>|Smi;
   closure_feedback_cell_array: FixedArray;
-  length: int32;
+  const length: int32;
   invocation_count: int32;
   profiler_ticks: int32;
   // TODO(v8:9287) The padding is not necessary on platforms with 4 bytes
   // tagged pointers, we should make it conditional; however, platform-specific
   // interacts badly with GCMole, so we need to address that first.
   padding: uint32;
+  // TODO(tebbi): The variable-length feedback_slots field should be declared
+  // here once it is possible to declare tagged slots after untagged slots.
 }
 
 extern class FeedbackMetadata extends HeapObject;
diff --git a/deps/v8/src/objects/field-type.cc b/deps/v8/src/objects/field-type.cc
index 5c771c4ffa6..3b3457249fd 100644
--- a/deps/v8/src/objects/field-type.cc
+++ b/deps/v8/src/objects/field-type.cc
@@ -63,6 +63,15 @@ bool FieldType::NowIs(FieldType other) const {
   return *this == other;
 }
 
+bool FieldType::Equals(FieldType other) const {
+  if (IsAny() && other.IsAny()) return true;
+  if (IsNone() && other.IsNone()) return true;
+  if (IsClass() && other.IsClass()) {
+    return *this == other;
+  }
+  return false;
+}
+
 bool FieldType::NowIs(Handle<FieldType> other) const { return NowIs(*other); }
 
 void FieldType::PrintTo(std::ostream& os) const {
diff --git a/deps/v8/src/objects/field-type.h b/deps/v8/src/objects/field-type.h
index 566994b43ec..d3856c48b69 100644
--- a/deps/v8/src/objects/field-type.h
+++ b/deps/v8/src/objects/field-type.h
@@ -41,6 +41,7 @@ class FieldType : public Object {
   bool NowIs(FieldType other) const;
   bool NowIs(Handle<FieldType> other) const;
 
+  V8_EXPORT_PRIVATE bool Equals(FieldType other) const;
   V8_EXPORT_PRIVATE void PrintTo(std::ostream& os) const;
 
  private:
diff --git a/deps/v8/src/objects/fixed-array-inl.h b/deps/v8/src/objects/fixed-array-inl.h
index 4608f2ea21a..174d4abc5b4 100644
--- a/deps/v8/src/objects/fixed-array-inl.h
+++ b/deps/v8/src/objects/fixed-array-inl.h
@@ -21,55 +21,35 @@
 #include "src/roots/roots-inl.h"
 #include "src/sanitizer/tsan.h"
 
+#include "torque-generated/class-definitions-tq-inl.h"
+
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
 
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(FixedArrayBase, HeapObject)
-OBJECT_CONSTRUCTORS_IMPL(FixedArray, FixedArrayBase)
-OBJECT_CONSTRUCTORS_IMPL(FixedDoubleArray, FixedArrayBase)
-OBJECT_CONSTRUCTORS_IMPL(ArrayList, FixedArray)
-OBJECT_CONSTRUCTORS_IMPL(ByteArray, FixedArrayBase)
-OBJECT_CONSTRUCTORS_IMPL(TemplateList, FixedArray)
-OBJECT_CONSTRUCTORS_IMPL(WeakFixedArray, HeapObject)
-OBJECT_CONSTRUCTORS_IMPL(WeakArrayList, HeapObject)
-
-FixedArrayBase::FixedArrayBase(Address ptr, AllowInlineSmiStorage allow_smi)
-    : HeapObject(ptr, allow_smi) {
-  SLOW_DCHECK(
-      (allow_smi == AllowInlineSmiStorage::kAllowBeingASmi && IsSmi()) ||
-      IsFixedArrayBase());
-}
-
-ByteArray::ByteArray(Address ptr, AllowInlineSmiStorage allow_smi)
-    : FixedArrayBase(ptr, allow_smi) {
-  SLOW_DCHECK(
-      (allow_smi == AllowInlineSmiStorage::kAllowBeingASmi && IsSmi()) ||
-      IsByteArray());
-}
+TQ_OBJECT_CONSTRUCTORS_IMPL(FixedArrayBase)
+FixedArrayBase::FixedArrayBase(Address ptr,
+                               HeapObject::AllowInlineSmiStorage allow_smi)
+    : TorqueGeneratedFixedArrayBase(ptr, allow_smi) {}
+TQ_OBJECT_CONSTRUCTORS_IMPL(FixedArray)
+TQ_OBJECT_CONSTRUCTORS_IMPL(FixedDoubleArray)
+TQ_OBJECT_CONSTRUCTORS_IMPL(ArrayList)
+TQ_OBJECT_CONSTRUCTORS_IMPL(ByteArray)
+ByteArray::ByteArray(Address ptr, HeapObject::AllowInlineSmiStorage allow_smi)
+    : TorqueGeneratedByteArray(ptr, allow_smi) {}
+TQ_OBJECT_CONSTRUCTORS_IMPL(TemplateList)
+TQ_OBJECT_CONSTRUCTORS_IMPL(WeakFixedArray)
+TQ_OBJECT_CONSTRUCTORS_IMPL(WeakArrayList)
 
 NEVER_READ_ONLY_SPACE_IMPL(WeakArrayList)
 
-CAST_ACCESSOR(ArrayList)
-CAST_ACCESSOR(ByteArray)
-CAST_ACCESSOR(FixedArray)
-CAST_ACCESSOR(FixedArrayBase)
-CAST_ACCESSOR(FixedDoubleArray)
-CAST_ACCESSOR(TemplateList)
-CAST_ACCESSOR(WeakFixedArray)
-CAST_ACCESSOR(WeakArrayList)
-
-SMI_ACCESSORS(FixedArrayBase, length, kLengthOffset)
 SYNCHRONIZED_SMI_ACCESSORS(FixedArrayBase, length, kLengthOffset)
 
-SMI_ACCESSORS(WeakFixedArray, length, kLengthOffset)
 SYNCHRONIZED_SMI_ACCESSORS(WeakFixedArray, length, kLengthOffset)
 
-SMI_ACCESSORS(WeakArrayList, capacity, kCapacityOffset)
 SYNCHRONIZED_SMI_ACCESSORS(WeakArrayList, capacity, kCapacityOffset)
-SMI_ACCESSORS(WeakArrayList, length, kLengthOffset)
 
 Object FixedArrayBase::unchecked_synchronized_length() const {
   return ACQUIRE_READ_FIELD(*this, kLengthOffset);
@@ -212,6 +192,19 @@ void FixedArray::CopyElements(Isolate* isolate, int dst_index, FixedArray src,
   isolate->heap()->CopyRange(*this, dst_slot, src_slot, len, mode);
 }
 
+// Due to left- and right-trimming, concurrent visitors need to read the length
+// with acquire semantics.
+// TODO(ulan): Acquire should not be needed anymore.
+inline int FixedArray::AllocatedSize() {
+  return SizeFor(synchronized_length());
+}
+inline int WeakFixedArray::AllocatedSize() {
+  return SizeFor(synchronized_length());
+}
+inline int WeakArrayList::AllocatedSize() {
+  return SizeFor(synchronized_capacity());
+}
+
 // Perform a binary search in a fixed array.
 template <SearchMode search_mode, typename T>
 int BinarySearch(T* array, Name name, int valid_entries,
@@ -392,28 +385,15 @@ MaybeObject WeakFixedArray::Get(int index) const {
 
 MaybeObject WeakFixedArray::Get(const Isolate* isolate, int index) const {
   DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
-  return TaggedField<MaybeObject>::Relaxed_Load(isolate, *this,
-                                                OffsetOfElementAt(index));
-}
-
-void WeakFixedArray::Set(int index, MaybeObject value) {
-  DCHECK_GE(index, 0);
-  DCHECK_LT(index, length());
-  int offset = OffsetOfElementAt(index);
-  RELAXED_WRITE_WEAK_FIELD(*this, offset, value);
-  WEAK_WRITE_BARRIER(*this, offset, value);
+  return objects(isolate, index);
 }
 
 void WeakFixedArray::Set(int index, MaybeObject value, WriteBarrierMode mode) {
-  DCHECK_GE(index, 0);
-  DCHECK_LT(index, length());
-  int offset = OffsetOfElementAt(index);
-  RELAXED_WRITE_WEAK_FIELD(*this, offset, value);
-  CONDITIONAL_WEAK_WRITE_BARRIER(*this, offset, value, mode);
+  set_objects(index, value, mode);
 }
 
 MaybeObjectSlot WeakFixedArray::data_start() {
-  return RawMaybeWeakField(kHeaderSize);
+  return RawMaybeWeakField(kObjectsOffset);
 }
 
 MaybeObjectSlot WeakFixedArray::RawFieldOfElementAt(int index) {
@@ -440,20 +420,15 @@ MaybeObject WeakArrayList::Get(int index) const {
 
 MaybeObject WeakArrayList::Get(const Isolate* isolate, int index) const {
   DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(capacity()));
-  return TaggedField<MaybeObject>::Relaxed_Load(isolate, *this,
-                                                OffsetOfElementAt(index));
+  return objects(isolate, index);
 }
 
 void WeakArrayList::Set(int index, MaybeObject value, WriteBarrierMode mode) {
-  DCHECK_GE(index, 0);
-  DCHECK_LT(index, this->capacity());
-  int offset = OffsetOfElementAt(index);
-  RELAXED_WRITE_WEAK_FIELD(*this, offset, value);
-  CONDITIONAL_WEAK_WRITE_BARRIER(*this, offset, value, mode);
+  set_objects(index, value, mode);
 }
 
 MaybeObjectSlot WeakArrayList::data_start() {
-  return RawMaybeWeakField(kHeaderSize);
+  return RawMaybeWeakField(kObjectsOffset);
 }
 
 void WeakArrayList::CopyElements(Isolate* isolate, int dst_index,
diff --git a/deps/v8/src/objects/fixed-array.h b/deps/v8/src/objects/fixed-array.h
index c706fbd2174..63c3c5360b9 100644
--- a/deps/v8/src/objects/fixed-array.h
+++ b/deps/v8/src/objects/fixed-array.h
@@ -7,16 +7,15 @@
 
 #include "src/handles/maybe-handles.h"
 #include "src/objects/instance-type.h"
+#include "src/objects/objects.h"
 #include "src/objects/smi.h"
-#include "torque-generated/field-offsets-tq.h"
+#include "torque-generated/class-definitions-tq.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
 
 namespace v8 {
 namespace internal {
-using WeakArrayBodyDescriptor =
-    FlexibleWeakBodyDescriptor<HeapObject::kHeaderSize>;
 
 #define FIXED_ARRAY_SUB_INSTANCE_TYPE_LIST(V)    \
   V(BYTECODE_ARRAY_CONSTANT_POOL_SUB_TYPE)       \
@@ -69,19 +68,14 @@ enum FixedArraySubInstanceType {
 
 // Common superclass for FixedArrays that allow implementations to share
 // common accessors and some code paths.
-class FixedArrayBase : public HeapObject {
+class FixedArrayBase
+    : public TorqueGeneratedFixedArrayBase<FixedArrayBase, HeapObject> {
  public:
-  // [length]: length of the array.
-  DECL_INT_ACCESSORS(length)
-
   // Get and set the length using acquire loads and release stores.
   DECL_SYNCHRONIZED_INT_ACCESSORS(length)
 
   inline Object unchecked_synchronized_length() const;
 
-  DECL_CAST(FixedArrayBase)
-  DECL_VERIFIER(FixedArrayBase)
-
   static int GetMaxLengthForNewSpaceAllocation(ElementsKind kind);
 
   V8_EXPORT_PRIVATE bool IsCowArray() const;
@@ -95,20 +89,15 @@ class FixedArrayBase : public HeapObject {
   static const int kMaxSize = 128 * kTaggedSize * MB - kTaggedSize;
   STATIC_ASSERT(Smi::IsValid(kMaxSize));
 
-  // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
-                                TORQUE_GENERATED_FIXED_ARRAY_BASE_FIELDS)
-
  protected:
-  // Special-purpose constructor for subclasses that have fast paths where
-  // their ptr() is a Smi.
-  inline FixedArrayBase(Address ptr, AllowInlineSmiStorage allow_smi);
-
-  OBJECT_CONSTRUCTORS(FixedArrayBase, HeapObject);
+  TQ_OBJECT_CONSTRUCTORS(FixedArrayBase)
+  inline FixedArrayBase(Address ptr,
+                        HeapObject::AllowInlineSmiStorage allow_smi);
 };
 
 // FixedArray describes fixed-sized arrays with element type Object.
-class FixedArray : public FixedArrayBase {
+class FixedArray
+    : public TorqueGeneratedFixedArray<FixedArray, FixedArrayBase> {
  public:
   // Setter and getter for elements.
   inline Object get(int index) const;
@@ -171,12 +160,14 @@ class FixedArray : public FixedArrayBase {
   }
 
   // Code Generation support.
-  static constexpr int OffsetOfElementAt(int index) { return SizeFor(index); }
+  static constexpr int OffsetOfElementAt(int index) {
+    STATIC_ASSERT(kObjectsOffset == SizeFor(0));
+    return SizeFor(index);
+  }
 
   // Garbage collection support.
   inline ObjectSlot RawFieldOfElementAt(int index);
 
-  DECL_CAST(FixedArray)
   // Maximally allowed length of a FixedArray.
   static const int kMaxLength = (kMaxSize - kHeaderSize) / kTaggedSize;
   static_assert(Internals::IsValidSmi(kMaxLength),
@@ -189,9 +180,10 @@ class FixedArray : public FixedArrayBase {
 
   // Dispatched behavior.
   DECL_PRINTER(FixedArray)
-  DECL_VERIFIER(FixedArray)
 
-  using BodyDescriptor = FlexibleBodyDescriptor<kHeaderSize>;
+  int AllocatedSize();
+
+  class BodyDescriptor;
 
   static constexpr int kObjectsOffset = kHeaderSize;
 
@@ -208,7 +200,7 @@ class FixedArray : public FixedArrayBase {
   inline void set_null(ReadOnlyRoots ro_roots, int index);
   inline void set_the_hole(ReadOnlyRoots ro_roots, int index);
 
-  OBJECT_CONSTRUCTORS(FixedArray, FixedArrayBase);
+  TQ_OBJECT_CONSTRUCTORS(FixedArray)
 };
 
 // FixedArray alias added only because of IsFixedArrayExact() predicate, which
@@ -217,7 +209,8 @@ class FixedArray : public FixedArrayBase {
 class FixedArrayExact final : public FixedArray {};
 
 // FixedDoubleArray describes fixed-sized arrays with element type double.
-class FixedDoubleArray : public FixedArrayBase {
+class FixedDoubleArray
+    : public TorqueGeneratedFixedDoubleArray<FixedDoubleArray, FixedArrayBase> {
  public:
   // Setter and getter for elements.
   inline double get_scalar(int index);
@@ -245,8 +238,6 @@ class FixedDoubleArray : public FixedArrayBase {
   // Code Generation support.
   static int OffsetOfElementAt(int index) { return SizeFor(index); }
 
-  DECL_CAST(FixedDoubleArray)
-
   // Start offset of elements.
   static constexpr int kFloatsOffset = kHeaderSize;
 
@@ -261,29 +252,20 @@ class FixedDoubleArray : public FixedArrayBase {
 
   class BodyDescriptor;
 
-  OBJECT_CONSTRUCTORS(FixedDoubleArray, FixedArrayBase);
+  TQ_OBJECT_CONSTRUCTORS(FixedDoubleArray)
 };
 
 // WeakFixedArray describes fixed-sized arrays with element type
 // MaybeObject.
-class WeakFixedArray : public HeapObject {
+class WeakFixedArray
+    : public TorqueGeneratedWeakFixedArray<WeakFixedArray, HeapObject> {
  public:
-  DECL_CAST(WeakFixedArray)
-
   inline MaybeObject Get(int index) const;
   inline MaybeObject Get(const Isolate* isolate, int index) const;
 
-  // Setter that uses write barrier.
-  inline void Set(int index, MaybeObject value);
-
-  // Setter with explicit barrier mode.
-  inline void Set(int index, MaybeObject value, WriteBarrierMode mode);
-
-  static constexpr int SizeFor(int length) {
-    return kHeaderSize + length * kTaggedSize;
-  }
-
-  DECL_INT_ACCESSORS(length)
+  inline void Set(
+      int index, MaybeObject value,
+      WriteBarrierMode mode = WriteBarrierMode::UPDATE_WRITE_BARRIER);
 
   // Get and set the length using acquire loads and release stores.
   DECL_SYNCHRONIZED_INT_ACCESSORS(length)
@@ -299,19 +281,19 @@ class WeakFixedArray : public HeapObject {
   DECL_PRINTER(WeakFixedArray)
   DECL_VERIFIER(WeakFixedArray)
 
-  using BodyDescriptor = WeakArrayBodyDescriptor;
-
-  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
-                                TORQUE_GENERATED_WEAK_FIXED_ARRAY_FIELDS)
+  class BodyDescriptor;
 
   static const int kMaxLength =
       (FixedArray::kMaxSize - kHeaderSize) / kTaggedSize;
   static_assert(Internals::IsValidSmi(kMaxLength),
                 "WeakFixedArray maxLength not a Smi");
 
+  int AllocatedSize();
+
  protected:
   static int OffsetOfElementAt(int index) {
-    return kHeaderSize + index * kTaggedSize;
+    STATIC_ASSERT(kObjectsOffset == SizeFor(0));
+    return SizeFor(index);
   }
 
  private:
@@ -319,7 +301,7 @@ class WeakFixedArray : public HeapObject {
 
   static const int kFirstIndex = 1;
 
-  OBJECT_CONSTRUCTORS(WeakFixedArray, HeapObject);
+  TQ_OBJECT_CONSTRUCTORS(WeakFixedArray)
 };
 
 // WeakArrayList is like a WeakFixedArray with static convenience methods for
@@ -327,11 +309,10 @@ class WeakFixedArray : public HeapObject {
 // capacity() returns the allocated size. The number of elements is stored at
 // kLengthOffset and is updated with every insertion. The array grows
 // dynamically with O(1) amortized insertion.
-class WeakArrayList : public HeapObject {
+class WeakArrayList
+    : public TorqueGeneratedWeakArrayList<WeakArrayList, HeapObject> {
  public:
   NEVER_READ_ONLY_SPACE
-  DECL_CAST(WeakArrayList)
-  DECL_VERIFIER(WeakArrayList)
   DECL_PRINTER(WeakArrayList)
 
   V8_EXPORT_PRIVATE static Handle<WeakArrayList> AddToEnd(
@@ -365,7 +346,7 @@ class WeakArrayList : public HeapObject {
                   WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   static constexpr int SizeForCapacity(int capacity) {
-    return kHeaderSize + capacity * kTaggedSize;
+    return SizeFor(capacity);
   }
 
   static constexpr int CapacityForLength(int length) {
@@ -380,17 +361,12 @@ class WeakArrayList : public HeapObject {
 
   V8_EXPORT_PRIVATE bool IsFull();
 
-  DECL_INT_ACCESSORS(capacity)
-  DECL_INT_ACCESSORS(length)
-
   // Get and set the capacity using acquire loads and release stores.
   DECL_SYNCHRONIZED_INT_ACCESSORS(capacity)
 
-  // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
-                                TORQUE_GENERATED_WEAK_ARRAY_LIST_FIELDS)
+  int AllocatedSize();
 
-  using BodyDescriptor = WeakArrayBodyDescriptor;
+  class BodyDescriptor;
 
   static const int kMaxCapacity =
       (FixedArray::kMaxSize - kHeaderSize) / kTaggedSize;
@@ -418,7 +394,7 @@ class WeakArrayList : public HeapObject {
     return kHeaderSize + index * kTaggedSize;
   }
 
-  OBJECT_CONSTRUCTORS(WeakArrayList, HeapObject);
+  TQ_OBJECT_CONSTRUCTORS(WeakArrayList)
 };
 
 class WeakArrayList::Iterator {
@@ -443,7 +419,7 @@ class WeakArrayList::Iterator {
 // the allocated size. The number of elements is stored at kLengthIndex and is
 // updated with every insertion. The elements of the ArrayList are stored in the
 // underlying FixedArray starting at kFirstIndex.
-class ArrayList : public FixedArray {
+class ArrayList : public TorqueGeneratedArrayList<ArrayList, FixedArray> {
  public:
   V8_EXPORT_PRIVATE static Handle<ArrayList> Add(Isolate* isolate,
                                                  Handle<ArrayList> array,
@@ -476,14 +452,13 @@ class ArrayList : public FixedArray {
   // Return a copy of the list of size Length() without the first entry. The
   // number returned by Length() is stored in the first entry.
   static Handle<FixedArray> Elements(Isolate* isolate, Handle<ArrayList> array);
-  DECL_CAST(ArrayList)
 
  private:
   static Handle<ArrayList> EnsureSpace(Isolate* isolate,
                                        Handle<ArrayList> array, int length);
   static const int kLengthIndex = 0;
   static const int kFirstIndex = 1;
-  OBJECT_CONSTRUCTORS(ArrayList, FixedArray);
+  TQ_OBJECT_CONSTRUCTORS(ArrayList)
 };
 
 enum SearchMode { ALL_ENTRIES, VALID_ENTRIES };
@@ -494,7 +469,7 @@ inline int Search(T* array, Name name, int valid_entries = 0,
 
 // ByteArray represents fixed sized byte arrays.  Used for the relocation info
 // that is attached to code objects.
-class ByteArray : public FixedArrayBase {
+class ByteArray : public TorqueGeneratedByteArray<ByteArray, FixedArrayBase> {
  public:
   inline int Size();
 
@@ -543,12 +518,9 @@ class ByteArray : public FixedArrayBase {
   // Returns a pointer to the ByteArray object for a given data start address.
   static inline ByteArray FromDataStartAddress(Address address);
 
-  DECL_CAST(ByteArray)
-
   // Dispatched behavior.
   inline int ByteArraySize();
   DECL_PRINTER(ByteArray)
-  DECL_VERIFIER(ByteArray)
 
   // Layout description.
   static const int kAlignedSize = OBJECT_POINTER_ALIGN(kHeaderSize);
@@ -561,11 +533,8 @@ class ByteArray : public FixedArrayBase {
   class BodyDescriptor;
 
  protected:
-  // Special-purpose constructor for subclasses that have fast paths where
-  // their ptr() is a Smi.
-  inline ByteArray(Address ptr, AllowInlineSmiStorage allow_smi);
-
-  OBJECT_CONSTRUCTORS(ByteArray, FixedArrayBase);
+  TQ_OBJECT_CONSTRUCTORS(ByteArray)
+  inline ByteArray(Address ptr, HeapObject::AllowInlineSmiStorage allow_smi);
 };
 
 // Wrapper class for ByteArray which can store arbitrary C++ classes, as long
@@ -605,7 +574,8 @@ class PodArray : public ByteArray {
   OBJECT_CONSTRUCTORS(PodArray<T>, ByteArray);
 };
 
-class TemplateList : public FixedArray {
+class TemplateList
+    : public TorqueGeneratedTemplateList<TemplateList, FixedArray> {
  public:
   static Handle<TemplateList> New(Isolate* isolate, int size);
   inline int length() const;
@@ -614,12 +584,11 @@ class TemplateList : public FixedArray {
   inline void set(int index, Object value);
   static Handle<TemplateList> Add(Isolate* isolate, Handle<TemplateList> list,
                                   Handle<Object> value);
-  DECL_CAST(TemplateList)
  private:
   static const int kLengthIndex = 0;
   static const int kFirstElementIndex = kLengthIndex + 1;
 
-  OBJECT_CONSTRUCTORS(TemplateList, FixedArray);
+  TQ_OBJECT_CONSTRUCTORS(TemplateList)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/fixed-array.tq b/deps/v8/src/objects/fixed-array.tq
index 0c57e0bc634..b15f9c5f065 100644
--- a/deps/v8/src/objects/fixed-array.tq
+++ b/deps/v8/src/objects/fixed-array.tq
@@ -3,31 +3,49 @@
 // found in the LICENSE file.
 
 @abstract
+@generateCppClass
 extern class FixedArrayBase extends HeapObject {
+  // length of the array.
   const length: Smi;
 }
 
-extern class FixedArray extends FixedArrayBase { objects[length]: Object; }
+@generateBodyDescriptor
+@generateCppClass
+extern class FixedArray extends FixedArrayBase {
+  objects[length]: Object;
+}
 
 type EmptyFixedArray extends FixedArray;
 
+@generateCppClass
 extern class FixedDoubleArray extends FixedArrayBase {
   floats[length]: float64_or_hole;
 }
 
-extern class WeakFixedArray extends HeapObject { length: Smi; }
+@generateBodyDescriptor
+@generateCppClass
+extern class WeakFixedArray extends HeapObject {
+  const length: Smi;
+  objects[length]: MaybeObject;
+}
 
-extern class ByteArray extends FixedArrayBase {}
+@generateCppClass
+extern class ByteArray extends FixedArrayBase {
+  bytes[length]: uint8;
+}
 
 @hasSameInstanceTypeAsParent
+@generateCppClass
 extern class ArrayList extends FixedArray {
 }
 
 @hasSameInstanceTypeAsParent
-@noVerifier
+@generateCppClass
 extern class TemplateList extends FixedArray {
 }
 
+@generateBodyDescriptor
+@generateCppClass
 extern class WeakArrayList extends HeapObject {
   const capacity: Smi;
   length: Smi;
@@ -83,6 +101,9 @@ operator '[]=' macro StoreFixedArrayDirect(a: FixedArray, i: Smi, v: Object) {
   a.objects[i] = v;
 }
 
+extern macro AllocateFixedArray(
+    constexpr ElementsKind, intptr, constexpr AllocationFlag): FixedArrayBase;
+
 extern macro AllocateZeroedFixedArray(intptr): FixedArray;
 extern macro AllocateZeroedFixedDoubleArray(intptr): FixedDoubleArray;
 extern macro CalculateNewElementsCapacity(Smi): Smi;
@@ -120,8 +141,15 @@ macro ExtractFixedDoubleArray(
           ConstantIterator(kDoubleHole)));
 }
 
+namespace runtime {
+extern runtime FatalProcessOutOfMemoryInvalidArrayLength(NoContext): never;
+}
+
 macro NewFixedArray<Iterator: type>(length: intptr, it: Iterator): FixedArray {
   if (length == 0) return kEmptyFixedArray;
+  if (length > kFixedArrayMaxLength) deferred {
+      runtime::FatalProcessOutOfMemoryInvalidArrayLength(kNoContext);
+    }
   return new
   FixedArray{map: kFixedArrayMap, length: Convert<Smi>(length), objects: ...it};
 }
@@ -129,6 +157,9 @@ macro NewFixedArray<Iterator: type>(length: intptr, it: Iterator): FixedArray {
 macro NewFixedDoubleArray<Iterator: type>(
     length: intptr, it: Iterator): FixedDoubleArray|EmptyFixedArray {
   if (length == 0) return kEmptyFixedArray;
+  if (length > kFixedDoubleArrayMaxLength) deferred {
+      runtime::FatalProcessOutOfMemoryInvalidArrayLength(kNoContext);
+    }
   return new FixedDoubleArray{
     map: kFixedDoubleArrayMap,
     length: Convert<Smi>(length),
diff --git a/deps/v8/src/objects/foreign-inl.h b/deps/v8/src/objects/foreign-inl.h
index d2f3a6df726..d455aede1a7 100644
--- a/deps/v8/src/objects/foreign-inl.h
+++ b/deps/v8/src/objects/foreign-inl.h
@@ -5,8 +5,10 @@
 #ifndef V8_OBJECTS_FOREIGN_INL_H_
 #define V8_OBJECTS_FOREIGN_INL_H_
 
+#include "src/common/globals.h"
 #include "src/objects/foreign.h"
 
+#include "src/common/external-pointer-inl.h"
 #include "src/heap/heap-write-barrier-inl.h"
 #include "src/objects/objects-inl.h"
 
@@ -16,9 +18,7 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(Foreign, HeapObject)
-
-CAST_ACCESSOR(Foreign)
+TQ_OBJECT_CONSTRUCTORS_IMPL(Foreign)
 
 // static
 bool Foreign::IsNormalized(Object value) {
@@ -26,12 +26,16 @@ bool Foreign::IsNormalized(Object value) {
   return Foreign::cast(value).foreign_address() != kNullAddress;
 }
 
-Address Foreign::foreign_address() {
-  return ReadField<Address>(kForeignAddressOffset);
+DEF_GETTER(Foreign, foreign_address, Address) {
+  ExternalPointer_t encoded_value =
+      ReadField<ExternalPointer_t>(kForeignAddressOffset);
+  Address value = DecodeExternalPointer(isolate, encoded_value);
+  return value;
 }
 
-void Foreign::set_foreign_address(Address value) {
-  WriteField<Address>(kForeignAddressOffset, value);
+void Foreign::set_foreign_address(Isolate* isolate, Address value) {
+  ExternalPointer_t encoded_value = EncodeExternalPointer(isolate, value);
+  WriteField<ExternalPointer_t>(kForeignAddressOffset, encoded_value);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/foreign.h b/deps/v8/src/objects/foreign.h
index 617ca0e34fb..e0f498ab7ee 100644
--- a/deps/v8/src/objects/foreign.h
+++ b/deps/v8/src/objects/foreign.h
@@ -6,7 +6,7 @@
 #define V8_OBJECTS_FOREIGN_H_
 
 #include "src/objects/heap-object.h"
-#include "torque-generated/field-offsets-tq.h"
+#include "torque-generated/class-definitions-tq.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -15,21 +15,15 @@ namespace v8 {
 namespace internal {
 
 // Foreign describes objects pointing from JavaScript to C structures.
-class Foreign : public HeapObject {
+class Foreign : public TorqueGeneratedForeign<Foreign, HeapObject> {
  public:
   // [address]: field containing the address.
-  inline Address foreign_address();
+  DECL_GETTER(foreign_address, Address)
 
   static inline bool IsNormalized(Object object);
 
-  DECL_CAST(Foreign)
-
   // Dispatched behavior.
   DECL_PRINTER(Foreign)
-  DECL_VERIFIER(Foreign)
-
-  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
-                                TORQUE_GENERATED_FOREIGN_FIELDS)
 
 #ifdef V8_COMPRESS_POINTERS
   // TODO(ishell, v8:8875): When pointer compression is enabled the
@@ -38,11 +32,9 @@ class Foreign : public HeapObject {
   // compression is supported) allow unaligned access to full words.
   STATIC_ASSERT(IsAligned(kForeignAddressOffset, kTaggedSize));
 #else
-  STATIC_ASSERT(IsAligned(kForeignAddressOffset, kSystemPointerSize));
+  STATIC_ASSERT(IsAligned(kForeignAddressOffset, kExternalPointerSize));
 #endif
 
-  STATIC_ASSERT(kForeignAddressOffset == Internals::kForeignAddressOffset);
-
   class BodyDescriptor;
 
  private:
@@ -50,9 +42,9 @@ class Foreign : public HeapObject {
   friend class SerializerDeserializer;
   friend class StartupSerializer;
 
-  inline void set_foreign_address(Address value);
+  inline void set_foreign_address(Isolate* isolate, Address value);
 
-  OBJECT_CONSTRUCTORS(Foreign, HeapObject);
+  TQ_OBJECT_CONSTRUCTORS(Foreign)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/foreign.tq b/deps/v8/src/objects/foreign.tq
index 3204635070b..dcf52b12e32 100644
--- a/deps/v8/src/objects/foreign.tq
+++ b/deps/v8/src/objects/foreign.tq
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 @apiExposedInstanceTypeValue(0x46)
+@generateCppClass
 extern class Foreign extends HeapObject {
-  foreign_address: RawPtr;
+  foreign_address: ExternalPointer;
 }
diff --git a/deps/v8/src/objects/frame-array-inl.h b/deps/v8/src/objects/frame-array-inl.h
index e4b395488d8..5627b728237 100644
--- a/deps/v8/src/objects/frame-array-inl.h
+++ b/deps/v8/src/objects/frame-array-inl.h
@@ -33,17 +33,8 @@ FRAME_ARRAY_FIELD_LIST(DEFINE_FRAME_ARRAY_ACCESSORS)
 #undef DEFINE_FRAME_ARRAY_ACCESSORS
 
 bool FrameArray::IsWasmFrame(int frame_ix) const {
-  return IsWasmCompiledFrame(frame_ix) || IsWasmInterpretedFrame(frame_ix);
-}
-
-bool FrameArray::IsWasmCompiledFrame(int frame_ix) const {
-  const int flags = Flags(frame_ix).value();
-  return (flags & kIsWasmCompiledFrame) != 0;
-}
-
-bool FrameArray::IsWasmInterpretedFrame(int frame_ix) const {
   const int flags = Flags(frame_ix).value();
-  return (flags & kIsWasmInterpretedFrame) != 0;
+  return (flags & kIsWasmFrame) != 0;
 }
 
 bool FrameArray::IsAsmJsWasmFrame(int frame_ix) const {
@@ -52,8 +43,7 @@ bool FrameArray::IsAsmJsWasmFrame(int frame_ix) const {
 }
 
 bool FrameArray::IsAnyWasmFrame(int frame_ix) const {
-  return IsWasmFrame(frame_ix) || IsWasmInterpretedFrame(frame_ix) ||
-         IsAsmJsWasmFrame(frame_ix);
+  return IsWasmFrame(frame_ix) || IsAsmJsWasmFrame(frame_ix);
 }
 
 int FrameArray::FrameCount() const {
diff --git a/deps/v8/src/objects/frame-array.h b/deps/v8/src/objects/frame-array.h
index b82a7a60be6..bc4676fc7b8 100644
--- a/deps/v8/src/objects/frame-array.h
+++ b/deps/v8/src/objects/frame-array.h
@@ -38,8 +38,6 @@ class FrameArray : public FixedArray {
 #undef DECL_FRAME_ARRAY_ACCESSORS
 
   inline bool IsWasmFrame(int frame_ix) const;
-  inline bool IsWasmCompiledFrame(int frame_ix) const;
-  inline bool IsWasmInterpretedFrame(int frame_ix) const;
   inline bool IsAsmJsWasmFrame(int frame_ix) const;
   inline bool IsAnyWasmFrame(int frame_ix) const;
   inline int FrameCount() const;
@@ -48,14 +46,14 @@ class FrameArray : public FixedArray {
 
   // Flags.
   enum Flag {
-    kIsWasmCompiledFrame = 1 << 0,
-    kIsWasmInterpretedFrame = 1 << 1,
-    kIsAsmJsWasmFrame = 1 << 2,
-    kIsStrict = 1 << 3,
-    kIsConstructor = 1 << 4,
-    kAsmJsAtNumberConversion = 1 << 5,
-    kIsAsync = 1 << 6,
-    kIsPromiseAll = 1 << 7
+    kIsWasmFrame = 1 << 0,
+    kIsAsmJsWasmFrame = 1 << 1,
+    kIsStrict = 1 << 2,
+    kIsConstructor = 1 << 3,
+    kAsmJsAtNumberConversion = 1 << 4,
+    kIsAsync = 1 << 5,
+    kIsPromiseAll = 1 << 6,
+    kIsPromiseAny = 1 << 7
   };
 
   static Handle<FrameArray> AppendJSFrame(Handle<FrameArray> in,
diff --git a/deps/v8/src/objects/free-space-inl.h b/deps/v8/src/objects/free-space-inl.h
index 318272c3408..1aa571d5b63 100644
--- a/deps/v8/src/objects/free-space-inl.h
+++ b/deps/v8/src/objects/free-space-inl.h
@@ -18,9 +18,8 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(FreeSpace, HeapObject)
+TQ_OBJECT_CONSTRUCTORS_IMPL(FreeSpace)
 
-SMI_ACCESSORS(FreeSpace, size, kSizeOffset)
 RELAXED_SMI_ACCESSORS(FreeSpace, size, kSizeOffset)
 
 int FreeSpace::Size() { return size(); }
diff --git a/deps/v8/src/objects/free-space.h b/deps/v8/src/objects/free-space.h
index 57147270369..ad5ffa075cf 100644
--- a/deps/v8/src/objects/free-space.h
+++ b/deps/v8/src/objects/free-space.h
@@ -6,7 +6,7 @@
 #define V8_OBJECTS_FREE_SPACE_H_
 
 #include "src/objects/heap-object.h"
-#include "torque-generated/field-offsets-tq.h"
+#include "torque-generated/class-definitions-tq.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -19,12 +19,9 @@ namespace internal {
 // the heap remains iterable.  They have a size and a next pointer.
 // The next pointer is the raw address of the next FreeSpace object (or NULL)
 // in the free list.
-class FreeSpace : public HeapObject {
+class FreeSpace : public TorqueGeneratedFreeSpace<FreeSpace, HeapObject> {
  public:
   // [size]: size of the free space including the header.
-  inline int size() const;
-  inline void set_size(int value);
-
   inline int relaxed_read_size() const;
   inline void relaxed_write_size(int value);
 
@@ -39,15 +36,11 @@ class FreeSpace : public HeapObject {
 
   // Dispatched behavior.
   DECL_PRINTER(FreeSpace)
-  DECL_VERIFIER(FreeSpace)
-
-  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
-                                TORQUE_GENERATED_FREE_SPACE_FIELDS)
 
  private:
   inline bool IsValid();
 
-  OBJECT_CONSTRUCTORS(FreeSpace, HeapObject);
+  TQ_OBJECT_CONSTRUCTORS(FreeSpace)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/free-space.tq b/deps/v8/src/objects/free-space.tq
index 5fc8767a58a..501326b04db 100644
--- a/deps/v8/src/objects/free-space.tq
+++ b/deps/v8/src/objects/free-space.tq
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+@generateCppClass
 extern class FreeSpace extends HeapObject {
   size: Smi;
   next: FreeSpace|Uninitialized;
diff --git a/deps/v8/src/objects/function-kind.h b/deps/v8/src/objects/function-kind.h
index dda576fd8a0..5e17ebf054d 100644
--- a/deps/v8/src/objects/function-kind.h
+++ b/deps/v8/src/objects/function-kind.h
@@ -6,6 +6,7 @@
 #define V8_OBJECTS_FUNCTION_KIND_H_
 
 #include "src/base/bounds.h"
+#include "src/base/macros.h"
 
 namespace v8 {
 namespace internal {
@@ -56,6 +57,9 @@ enum FunctionKind : uint8_t {
   kLastFunctionKind = kClassMembersInitializerFunction,
 };
 
+constexpr int kFunctionKindBitSize = 5;
+STATIC_ASSERT(kLastFunctionKind < (1 << kFunctionKindBitSize));
+
 inline bool IsArrowFunction(FunctionKind kind) {
   return base::IsInRange(kind, FunctionKind::kArrowFunction,
                          FunctionKind::kAsyncArrowFunction);
diff --git a/deps/v8/src/objects/heap-number-inl.h b/deps/v8/src/objects/heap-number-inl.h
index 546b16e93d8..4e40fa70b8d 100644
--- a/deps/v8/src/objects/heap-number-inl.h
+++ b/deps/v8/src/objects/heap-number-inl.h
@@ -16,15 +16,7 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(HeapNumber, PrimitiveHeapObject)
-
-CAST_ACCESSOR(HeapNumber)
-
-double HeapNumber::value() const { return ReadField<double>(kValueOffset); }
-
-void HeapNumber::set_value(double value) {
-  WriteField<double>(kValueOffset, value);
-}
+TQ_OBJECT_CONSTRUCTORS_IMPL(HeapNumber)
 
 uint64_t HeapNumber::value_as_bits() const {
   // Bug(v8:8875): HeapNumber's double may be unaligned.
diff --git a/deps/v8/src/objects/heap-number.h b/deps/v8/src/objects/heap-number.h
index 259e23a41d7..4e77a523409 100644
--- a/deps/v8/src/objects/heap-number.h
+++ b/deps/v8/src/objects/heap-number.h
@@ -15,12 +15,9 @@ namespace internal {
 
 // The HeapNumber class describes heap allocated numbers that cannot be
 // represented in a Smi (small integer).
-class HeapNumber : public PrimitiveHeapObject {
+class HeapNumber
+    : public TorqueGeneratedHeapNumber<HeapNumber, PrimitiveHeapObject> {
  public:
-  // [value]: number value.
-  inline double value() const;
-  inline void set_value(double value);
-
   inline uint64_t value_as_bits() const;
   inline void set_value_as_bits(uint64_t bits);
 
@@ -28,7 +25,6 @@ class HeapNumber : public PrimitiveHeapObject {
   inline int get_sign();
 
   // Layout description.
-  static const int kValueOffset = PrimitiveHeapObject::kHeaderSize;
   // IEEE doubles are two 32 bit words.  The first is just mantissa, the second
   // is a mixture of sign, exponent and mantissa. The offsets of two 32 bit
   // words within double numbers are endian dependent and they are set
@@ -43,7 +39,6 @@ class HeapNumber : public PrimitiveHeapObject {
 #error Unknown byte ordering
 #endif
 
-  static const int kSize = kValueOffset + kDoubleSize;
   static const uint32_t kSignMask = 0x80000000u;
   static const uint32_t kExponentMask = 0x7ff00000u;
   static const uint32_t kMantissaMask = 0xfffffu;
@@ -56,12 +51,10 @@ class HeapNumber : public PrimitiveHeapObject {
   static const int kMantissaBitsInTopWord = 20;
   static const int kNonMantissaBitsInTopWord = 12;
 
-  DECL_CAST(HeapNumber)
-  DECL_VERIFIER(HeapNumber)
   DECL_PRINTER(HeapNumber)
   V8_EXPORT_PRIVATE void HeapNumberShortPrint(std::ostream& os);
 
-  OBJECT_CONSTRUCTORS(HeapNumber, PrimitiveHeapObject);
+  TQ_OBJECT_CONSTRUCTORS(HeapNumber)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/heap-number.tq b/deps/v8/src/objects/heap-number.tq
index 478e861bc2f..cffe3a092c1 100644
--- a/deps/v8/src/objects/heap-number.tq
+++ b/deps/v8/src/objects/heap-number.tq
@@ -2,7 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-extern class HeapNumber extends PrimitiveHeapObject { value: float64; }
+@generateCppClass
+extern class HeapNumber extends PrimitiveHeapObject {
+  value: float64;
+}
 
 // The HeapNumber value NaN
 type NaN extends HeapNumber;
diff --git a/deps/v8/src/objects/heap-object.h b/deps/v8/src/objects/heap-object.h
index b19d429320b..0f8efb5c78f 100644
--- a/deps/v8/src/objects/heap-object.h
+++ b/deps/v8/src/objects/heap-object.h
@@ -191,7 +191,7 @@ class HeapObject : public Object {
   bool CanBeRehashed() const;
 
   // Rehash the object based on the layout inferred from its map.
-  void RehashBasedOnMap(ReadOnlyRoots root);
+  void RehashBasedOnMap(LocalIsolateWrapper isolate);
 
   // Layout description.
 #define HEAP_OBJECT_FIELDS(V) \
diff --git a/deps/v8/src/objects/intl-objects.cc b/deps/v8/src/objects/intl-objects.cc
index dee27016d79..d358e2780e2 100644
--- a/deps/v8/src/objects/intl-objects.cc
+++ b/deps/v8/src/objects/intl-objects.cc
@@ -563,14 +563,12 @@ bool ValidateResource(const icu::Locale locale, const char* path,
 }  // namespace
 
 std::set<std::string> Intl::BuildLocaleSet(
-    const icu::Locale* icu_available_locales, int32_t count, const char* path,
+    const std::vector<std::string>& icu_available_locales, const char* path,
     const char* validate_key) {
   std::set<std::string> locales;
-  for (int32_t i = 0; i < count; ++i) {
-    std::string locale =
-        Intl::ToLanguageTag(icu_available_locales[i]).FromJust();
+  for (const std::string& locale : icu_available_locales) {
     if (path != nullptr || validate_key != nullptr) {
-      if (!ValidateResource(icu_available_locales[i], path, validate_key)) {
+      if (!ValidateResource(icu::Locale(locale.c_str()), path, validate_key)) {
         continue;
       }
     }
@@ -2107,9 +2105,9 @@ Maybe<bool> Intl::GetNumberingSystem(Isolate* isolate,
   return Just(false);
 }
 
-const std::set<std::string>& Intl::GetAvailableLocalesForLocale() {
-  static base::LazyInstance<Intl::AvailableLocales<icu::Locale>>::type
-      available_locales = LAZY_INSTANCE_INITIALIZER;
+const std::set<std::string>& Intl::GetAvailableLocales() {
+  static base::LazyInstance<Intl::AvailableLocales<>>::type available_locales =
+      LAZY_INSTANCE_INITIALIZER;
   return available_locales.Pointer()->Get();
 }
 
@@ -2123,8 +2121,7 @@ struct CheckCalendar {
 }  // namespace
 
 const std::set<std::string>& Intl::GetAvailableLocalesForDateFormat() {
-  static base::LazyInstance<
-      Intl::AvailableLocales<icu::DateFormat, CheckCalendar>>::type
+  static base::LazyInstance<Intl::AvailableLocales<CheckCalendar>>::type
       available_locales = LAZY_INSTANCE_INITIALIZER;
   return available_locales.Pointer()->Get();
 }
diff --git a/deps/v8/src/objects/intl-objects.h b/deps/v8/src/objects/intl-objects.h
index 0d8cab42e83..00c5f4f361a 100644
--- a/deps/v8/src/objects/intl-objects.h
+++ b/deps/v8/src/objects/intl-objects.h
@@ -49,7 +49,7 @@ class Intl {
   // script; eg, pa_Guru_IN (language=Panjabi, script=Gurmukhi, country-India)
   // would include pa_IN.
   static std::set<std::string> BuildLocaleSet(
-      const icu::Locale* icu_available_locales, int32_t count, const char* path,
+      const std::vector<std::string>& locales, const char* path,
       const char* validate_key);
 
   static Maybe<std::string> ToLanguageTag(const icu::Locale& locale);
@@ -276,21 +276,34 @@ class Intl {
     static const char* path() { return nullptr; }
   };
 
-  template <typename T, typename C = SkipResourceCheck>
+  template <typename C = SkipResourceCheck>
   class AvailableLocales {
    public:
     AvailableLocales() {
-      int32_t num_locales = 0;
-      const icu::Locale* icu_available_locales =
-          T::getAvailableLocales(num_locales);
-      set = Intl::BuildLocaleSet(icu_available_locales, num_locales, C::path(),
-                                 C::key());
+      UErrorCode status = U_ZERO_ERROR;
+      UEnumeration* uenum =
+          uloc_openAvailableByType(ULOC_AVAILABLE_WITH_LEGACY_ALIASES, &status);
+      DCHECK(U_SUCCESS(status));
+
+      std::vector<std::string> all_locales;
+      const char* loc;
+      while ((loc = uenum_next(uenum, nullptr, &status)) != nullptr) {
+        DCHECK(U_SUCCESS(status));
+        std::string locstr(loc);
+        std::replace(locstr.begin(), locstr.end(), '_', '-');
+        // Handle special case
+        if (locstr == "en-US-POSIX") locstr = "en-US-u-va-posix";
+        all_locales.push_back(locstr);
+      }
+      uenum_close(uenum);
+
+      set_ = Intl::BuildLocaleSet(all_locales, C::path(), C::key());
     }
     virtual ~AvailableLocales() {}
-    const std::set<std::string>& Get() const { return set; }
+    const std::set<std::string>& Get() const { return set_; }
 
    private:
-    std::set<std::string> set;
+    std::set<std::string> set_;
   };
 
   // Utility function to set text to BreakIterator.
@@ -311,7 +324,7 @@ class Intl {
 
   static String ConvertOneByteToLower(String src, String dst);
 
-  static const std::set<std::string>& GetAvailableLocalesForLocale();
+  static const std::set<std::string>& GetAvailableLocales();
 
   static const std::set<std::string>& GetAvailableLocalesForDateFormat();
 };
diff --git a/deps/v8/src/objects/intl-objects.tq b/deps/v8/src/objects/intl-objects.tq
index 8f4f130a0d7..41db48dae34 100644
--- a/deps/v8/src/objects/intl-objects.tq
+++ b/deps/v8/src/objects/intl-objects.tq
@@ -23,6 +23,7 @@ bitfield struct JSDateTimeFormatFlags extends uint31 {
   time_style: DateTimeStyle: 3 bit;
 }
 
+@generateCppClass
 extern class JSDateTimeFormat extends JSObject {
   locale: String;
   icu_locale: Foreign;                // Managed<icu::Locale>
@@ -40,6 +41,7 @@ bitfield struct JSDisplayNamesFlags extends uint31 {
   fallback: JSDisplayNamesFallback: 1 bit;
 }
 
+@generateCppClass
 extern class JSDisplayNames extends JSObject {
   internal: Foreign;  // Managed<DisplayNamesInternal>
   flags: SmiTagged<JSDisplayNamesFlags>;
@@ -52,12 +54,14 @@ bitfield struct JSListFormatFlags extends uint31 {
   Type: JSListFormatType: 2 bit;  // "type" is a reserved word.
 }
 
+@generateCppClass
 extern class JSListFormat extends JSObject {
   locale: String;
   icu_formatter: Foreign;  // Managed<icu::ListFormatter>
   flags: SmiTagged<JSListFormatFlags>;
 }
 
+@generateCppClass
 extern class JSNumberFormat extends JSObject {
   locale: String;
   icu_number_formatter:
@@ -70,6 +74,7 @@ bitfield struct JSPluralRulesFlags extends uint31 {
   Type: JSPluralRulesType: 1 bit;  // "type" is a reserved word.
 }
 
+@generateCppClass
 extern class JSPluralRules extends JSObject {
   locale: String;
   flags: SmiTagged<JSPluralRulesFlags>;
@@ -84,6 +89,7 @@ bitfield struct JSRelativeTimeFormatFlags extends uint31 {
   numeric: JSRelativeTimeFormatNumeric: 1 bit;
 }
 
+@generateCppClass
 extern class JSRelativeTimeFormat extends JSObject {
   locale: String;
   numberingSystem: String;
@@ -91,6 +97,7 @@ extern class JSRelativeTimeFormat extends JSObject {
   flags: SmiTagged<JSRelativeTimeFormatFlags>;
 }
 
+@generateCppClass
 extern class JSLocale extends JSObject {
   icu_locale: Foreign;  // Managed<icu::Locale>
 }
@@ -101,6 +108,7 @@ bitfield struct JSSegmenterFlags extends uint31 {
   granularity: JSSegmenterGranularity: 2 bit;
 }
 
+@generateCppClass
 extern class JSSegmenter extends JSObject {
   locale: String;
   icu_break_iterator: Foreign;  // Managed<icu::BreakIterator>
@@ -112,12 +120,14 @@ bitfield struct JSSegmentIteratorFlags extends uint31 {
   break_type_set: bool: 1 bit;
 }
 
+@generateCppClass
 extern class JSSegmentIterator extends JSObject {
   icu_break_iterator: Foreign;  // Managed<icu::BreakIterator>
   unicode_string: Foreign;      // Managed<icu::UnicodeString>
   flags: SmiTagged<JSSegmentIteratorFlags>;
 }
 
+@generateCppClass
 extern class JSV8BreakIterator extends JSObject {
   locale: String;
   break_iterator: Foreign;  // Managed<icu::BreakIterator>;
@@ -129,6 +139,7 @@ extern class JSV8BreakIterator extends JSObject {
   bound_break_type: Undefined|JSFunction;
 }
 
+@generateCppClass
 extern class JSCollator extends JSObject {
   icu_collator: Foreign;  // Managed<icu::Collator>
   bound_compare: Undefined|JSFunction;
diff --git a/deps/v8/src/objects/js-array-buffer-inl.h b/deps/v8/src/objects/js-array-buffer-inl.h
index b77f5580e2a..6737cdc7195 100644
--- a/deps/v8/src/objects/js-array-buffer-inl.h
+++ b/deps/v8/src/objects/js-array-buffer-inl.h
@@ -5,8 +5,10 @@
 #ifndef V8_OBJECTS_JS_ARRAY_BUFFER_INL_H_
 #define V8_OBJECTS_JS_ARRAY_BUFFER_INL_H_
 
+#include "src/common/external-pointer.h"
 #include "src/objects/js-array-buffer.h"
 
+#include "src/common/external-pointer-inl.h"
 #include "src/heap/heap-write-barrier-inl.h"
 #include "src/objects/js-objects-inl.h"
 #include "src/objects/objects-inl.h"
@@ -18,15 +20,10 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(JSArrayBuffer, JSObject)
-OBJECT_CONSTRUCTORS_IMPL(JSArrayBufferView, JSObject)
-OBJECT_CONSTRUCTORS_IMPL(JSTypedArray, JSArrayBufferView)
-OBJECT_CONSTRUCTORS_IMPL(JSDataView, JSArrayBufferView)
-
-CAST_ACCESSOR(JSArrayBuffer)
-CAST_ACCESSOR(JSArrayBufferView)
-CAST_ACCESSOR(JSTypedArray)
-CAST_ACCESSOR(JSDataView)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSArrayBuffer)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSArrayBufferView)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSTypedArray)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSDataView)
 
 size_t JSArrayBuffer::byte_length() const {
   return ReadField<size_t>(kByteLengthOffset);
@@ -36,12 +33,27 @@ void JSArrayBuffer::set_byte_length(size_t value) {
   WriteField<size_t>(kByteLengthOffset, value);
 }
 
-void* JSArrayBuffer::backing_store() const {
-  return reinterpret_cast<void*>(ReadField<Address>(kBackingStoreOffset));
+DEF_GETTER(JSArrayBuffer, backing_store, void*) {
+  ExternalPointer_t encoded_value =
+      ReadField<ExternalPointer_t>(kBackingStoreOffset);
+  return reinterpret_cast<void*>(DecodeExternalPointer(isolate, encoded_value));
+}
+
+void JSArrayBuffer::set_backing_store(Isolate* isolate, void* value) {
+  ExternalPointer_t encoded_value =
+      EncodeExternalPointer(isolate, reinterpret_cast<Address>(value));
+  WriteField<ExternalPointer_t>(kBackingStoreOffset, encoded_value);
 }
 
-void JSArrayBuffer::set_backing_store(void* value) {
-  WriteField<Address>(kBackingStoreOffset, reinterpret_cast<Address>(value));
+uint32_t JSArrayBuffer::GetBackingStoreRefForDeserialization() const {
+  ExternalPointer_t encoded_value =
+      ReadField<ExternalPointer_t>(kBackingStoreOffset);
+  return static_cast<uint32_t>(encoded_value);
+}
+
+void JSArrayBuffer::SetBackingStoreRefForSerialization(uint32_t ref) {
+  ExternalPointer_t encoded_value = ref;
+  WriteField<ExternalPointer_t>(kBackingStoreOffset, encoded_value);
 }
 
 ArrayBufferExtension* JSArrayBuffer::extension() const {
@@ -173,8 +185,6 @@ void JSArrayBufferView::set_byte_length(size_t value) {
   WriteField<size_t>(kByteLengthOffset, value);
 }
 
-ACCESSORS(JSArrayBufferView, buffer, Object, kBufferOffset)
-
 bool JSArrayBufferView::WasDetached() const {
   return JSArrayBuffer::cast(buffer()).was_detached();
 }
@@ -185,12 +195,15 @@ void JSTypedArray::set_length(size_t value) {
   WriteField<size_t>(kLengthOffset, value);
 }
 
-Address JSTypedArray::external_pointer() const {
-  return ReadField<Address>(kExternalPointerOffset);
+DEF_GETTER(JSTypedArray, external_pointer, Address) {
+  ExternalPointer_t encoded_value =
+      ReadField<ExternalPointer_t>(kExternalPointerOffset);
+  return DecodeExternalPointer(isolate, encoded_value);
 }
 
-void JSTypedArray::set_external_pointer(Address value) {
-  WriteField<Address>(kExternalPointerOffset, value);
+void JSTypedArray::set_external_pointer(Isolate* isolate, Address value) {
+  ExternalPointer_t encoded_value = EncodeExternalPointer(isolate, value);
+  WriteField<ExternalPointer_t>(kExternalPointerOffset, encoded_value);
 }
 
 Address JSTypedArray::ExternalPointerCompensationForOnHeapArray(
@@ -202,14 +215,30 @@ Address JSTypedArray::ExternalPointerCompensationForOnHeapArray(
 #endif
 }
 
-void JSTypedArray::RemoveExternalPointerCompensationForSerialization() {
-  DCHECK(is_on_heap());
-  const Isolate* isolate = GetIsolateForPtrCompr(*this);
-  set_external_pointer(external_pointer() -
-                       ExternalPointerCompensationForOnHeapArray(isolate));
+uint32_t JSTypedArray::GetExternalBackingStoreRefForDeserialization() const {
+  DCHECK(!is_on_heap());
+  ExternalPointer_t encoded_value =
+      ReadField<ExternalPointer_t>(kExternalPointerOffset);
+  return static_cast<uint32_t>(encoded_value);
+}
+
+void JSTypedArray::SetExternalBackingStoreRefForSerialization(uint32_t ref) {
+  DCHECK(!is_on_heap());
+  ExternalPointer_t encoded_value = ref;
+  WriteField<ExternalPointer_t>(kExternalPointerOffset, encoded_value);
 }
 
-ACCESSORS(JSTypedArray, base_pointer, Object, kBasePointerOffset)
+void JSTypedArray::RemoveExternalPointerCompensationForSerialization(
+    Isolate* isolate) {
+  DCHECK(is_on_heap());
+  // TODO(v8:10391): once we have an external table, avoid the need for
+  // compensation by replacing external_pointer and base_pointer fields
+  // with one data_pointer field which can point to either external data
+  // backing store or into on-heap backing store.
+  set_external_pointer(
+      isolate,
+      external_pointer() - ExternalPointerCompensationForOnHeapArray(isolate));
+}
 
 void* JSTypedArray::DataPtr() {
   // Zero-extend Tagged_t to Address according to current compression scheme
@@ -220,18 +249,19 @@ void* JSTypedArray::DataPtr() {
                                  static_cast<Tagged_t>(base_pointer().ptr()));
 }
 
-void JSTypedArray::SetOffHeapDataPtr(void* base, Address offset) {
+void JSTypedArray::SetOffHeapDataPtr(Isolate* isolate, void* base,
+                                     Address offset) {
   set_base_pointer(Smi::zero(), SKIP_WRITE_BARRIER);
   Address address = reinterpret_cast<Address>(base) + offset;
-  set_external_pointer(address);
+  set_external_pointer(isolate, address);
   DCHECK_EQ(address, reinterpret_cast<Address>(DataPtr()));
 }
 
-void JSTypedArray::SetOnHeapDataPtr(HeapObject base, Address offset) {
+void JSTypedArray::SetOnHeapDataPtr(Isolate* isolate, HeapObject base,
+                                    Address offset) {
   set_base_pointer(base);
-  const Isolate* isolate = GetIsolateForPtrCompr(*this);
-  set_external_pointer(offset +
-                       ExternalPointerCompensationForOnHeapArray(isolate));
+  set_external_pointer(
+      isolate, offset + ExternalPointerCompensationForOnHeapArray(isolate));
   DCHECK_EQ(base.ptr() + offset, reinterpret_cast<Address>(DataPtr()));
 }
 
@@ -264,12 +294,16 @@ MaybeHandle<JSTypedArray> JSTypedArray::Validate(Isolate* isolate,
   return array;
 }
 
-void* JSDataView::data_pointer() const {
-  return reinterpret_cast<void*>(ReadField<Address>(kDataPointerOffset));
+DEF_GETTER(JSDataView, data_pointer, void*) {
+  ExternalPointer_t encoded_value =
+      ReadField<ExternalPointer_t>(kDataPointerOffset);
+  return reinterpret_cast<void*>(DecodeExternalPointer(isolate, encoded_value));
 }
 
-void JSDataView::set_data_pointer(void* value) {
-  WriteField<Address>(kDataPointerOffset, reinterpret_cast<Address>(value));
+void JSDataView::set_data_pointer(Isolate* isolate, void* value) {
+  WriteField<ExternalPointer_t>(
+      kDataPointerOffset,
+      EncodeExternalPointer(isolate, reinterpret_cast<Address>(value)));
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/js-array-buffer.cc b/deps/v8/src/objects/js-array-buffer.cc
index 0c2aca6d710..c67777acc03 100644
--- a/deps/v8/src/objects/js-array-buffer.cc
+++ b/deps/v8/src/objects/js-array-buffer.cc
@@ -45,7 +45,7 @@ void JSArrayBuffer::Setup(SharedFlag shared,
   }
   set_extension(nullptr);
   if (!backing_store) {
-    set_backing_store(nullptr);
+    set_backing_store(GetIsolate(), nullptr);
     set_byte_length(0);
   } else {
     Attach(std::move(backing_store));
@@ -60,19 +60,20 @@ void JSArrayBuffer::Attach(std::shared_ptr<BackingStore> backing_store) {
   DCHECK_NOT_NULL(backing_store);
   DCHECK_EQ(is_shared(), backing_store->is_shared());
   DCHECK(!was_detached());
-  set_backing_store(backing_store->buffer_start());
+  Isolate* isolate = GetIsolate();
+  set_backing_store(isolate, backing_store->buffer_start());
   set_byte_length(backing_store->byte_length());
   if (backing_store->is_wasm_memory()) set_is_detachable(false);
   if (!backing_store->free_on_destruct()) set_is_external(true);
   if (V8_ARRAY_BUFFER_EXTENSION_BOOL) {
-    Heap* heap = GetIsolate()->heap();
+    Heap* heap = isolate->heap();
     ArrayBufferExtension* extension = EnsureExtension();
     size_t bytes = backing_store->PerIsolateAccountingLength();
     extension->set_accounting_length(bytes);
     extension->set_backing_store(std::move(backing_store));
     heap->AppendArrayBufferExtension(*this, extension);
   } else {
-    GetIsolate()->heap()->RegisterBackingStore(*this, std::move(backing_store));
+    isolate->heap()->RegisterBackingStore(*this, std::move(backing_store));
   }
 }
 
@@ -103,7 +104,7 @@ void JSArrayBuffer::Detach(bool force_for_wasm_memory) {
 
   DCHECK(!is_shared());
   DCHECK(!is_asmjs_memory());
-  set_backing_store(nullptr);
+  set_backing_store(isolate, nullptr);
   set_byte_length(0);
   set_was_detached(true);
 }
@@ -193,7 +194,7 @@ Handle<JSArrayBuffer> JSTypedArray::GetBuffer() {
 
   // Clear the elements of the typed array.
   self->set_elements(ReadOnlyRoots(isolate).empty_byte_array());
-  self->SetOffHeapDataPtr(array_buffer->backing_store(), 0);
+  self->SetOffHeapDataPtr(isolate, array_buffer->backing_store(), 0);
   DCHECK(!self->is_on_heap());
 
   return array_buffer;
diff --git a/deps/v8/src/objects/js-array-buffer.h b/deps/v8/src/objects/js-array-buffer.h
index 624b716713e..3d6b293e2df 100644
--- a/deps/v8/src/objects/js-array-buffer.h
+++ b/deps/v8/src/objects/js-array-buffer.h
@@ -17,7 +17,8 @@ namespace internal {
 
 class ArrayBufferExtension;
 
-class JSArrayBuffer : public JSObject {
+class JSArrayBuffer
+    : public TorqueGeneratedJSArrayBuffer<JSArrayBuffer, JSObject> {
  public:
 // The maximum length for JSArrayBuffer's supported by V8.
 // On 32-bit architectures we limit this to 2GiB, so that
@@ -33,7 +34,8 @@ class JSArrayBuffer : public JSObject {
   DECL_PRIMITIVE_ACCESSORS(byte_length, size_t)
 
   // [backing_store]: backing memory for this array
-  DECL_PRIMITIVE_ACCESSORS(backing_store, void*)
+  DECL_GETTER(backing_store, void*)
+  inline void set_backing_store(Isolate* isolate, void* value);
 
   // [extension]: extension object used for GC
   DECL_PRIMITIVE_ACCESSORS(extension, ArrayBufferExtension*)
@@ -50,7 +52,7 @@ class JSArrayBuffer : public JSObject {
   // is deterministic. Depending on the V8 build mode there could be no padding.
   V8_INLINE void clear_padding();
 
-// Bit positions for [bit_field].
+  // Bit positions for [bit_field].
   DEFINE_TORQUE_GENERATED_JS_ARRAY_BUFFER_FLAGS()
 
   // [is_external]: true indicates that the embedder is in charge of freeing the
@@ -70,8 +72,6 @@ class JSArrayBuffer : public JSObject {
   // [is_shared]: tells whether this is an ArrayBuffer or a SharedArrayBuffer.
   DECL_BOOLEAN_ACCESSORS(is_shared)
 
-  DECL_CAST(JSArrayBuffer)
-
   // Initializes the fields of the ArrayBuffer. The provided backing_store can
   // be nullptr. If it is not nullptr, then the function registers it with
   // src/heap/array-buffer-tracker.h.
@@ -110,13 +110,21 @@ class JSArrayBuffer : public JSObject {
   void YoungMarkExtension();
   void YoungMarkExtensionPromoted();
 
+  //
+  // Serializer/deserializer support.
+  //
+
+  // Backing stores are serialized/deserialized separately. During serialization
+  // the backing store reference is stored in the backing store field and upon
+  // deserialization it is converted back to actual external (off-heap) pointer
+  // value.
+  inline uint32_t GetBackingStoreRefForDeserialization() const;
+  inline void SetBackingStoreRefForSerialization(uint32_t ref);
+
   // Dispatched behavior.
   DECL_PRINTER(JSArrayBuffer)
   DECL_VERIFIER(JSArrayBuffer)
 
-  // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
-                                TORQUE_GENERATED_JS_ARRAY_BUFFER_FIELDS)
   static constexpr int kEndOfTaggedFieldsOffset = JSObject::kHeaderSize;
 
   static const int kSizeWithEmbedderFields =
@@ -125,8 +133,6 @@ class JSArrayBuffer : public JSObject {
 
   class BodyDescriptor;
 
-  OBJECT_CONSTRUCTORS(JSArrayBuffer, JSObject);
-
  private:
   inline ArrayBufferExtension** extension_location() const;
 
@@ -136,6 +142,8 @@ class JSArrayBuffer : public JSObject {
   inline uint32_t* extension_lo() const;
   inline uint32_t* extension_hi() const;
 #endif
+
+  TQ_OBJECT_CONSTRUCTORS(JSArrayBuffer)
 };
 
 // Each JSArrayBuffer (with a backing store) has a corresponding native-heap
@@ -209,44 +217,29 @@ class ArrayBufferExtension : public Malloced {
   void set_next(ArrayBufferExtension* extension) { next_ = extension; }
 };
 
-class JSArrayBufferView : public JSObject {
+class JSArrayBufferView
+    : public TorqueGeneratedJSArrayBufferView<JSArrayBufferView, JSObject> {
  public:
-  // [buffer]: ArrayBuffer that this typed array views.
-  DECL_ACCESSORS(buffer, Object)
-
   // [byte_offset]: offset of typed array in bytes.
   DECL_PRIMITIVE_ACCESSORS(byte_offset, size_t)
 
   // [byte_length]: length of typed array in bytes.
   DECL_PRIMITIVE_ACCESSORS(byte_length, size_t)
 
-  DECL_CAST(JSArrayBufferView)
-
   DECL_VERIFIER(JSArrayBufferView)
 
   inline bool WasDetached() const;
 
-// Layout description.
-#define JS_ARRAY_BUFFER_VIEW_FIELDS(V) \
-  V(kBufferOffset, kTaggedSize)        \
-  V(kEndOfTaggedFieldsOffset, 0)       \
-  /* Raw data fields. */               \
-  V(kByteOffsetOffset, kUIntptrSize)   \
-  V(kByteLengthOffset, kUIntptrSize)   \
-  /* Header size. */                   \
-  V(kHeaderSize, 0)
-
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
-                                JS_ARRAY_BUFFER_VIEW_FIELDS)
-#undef JS_ARRAY_BUFFER_VIEW_FIELDS
+  static constexpr int kEndOfTaggedFieldsOffset = kByteOffsetOffset;
 
   STATIC_ASSERT(IsAligned(kByteOffsetOffset, kUIntptrSize));
   STATIC_ASSERT(IsAligned(kByteLengthOffset, kUIntptrSize));
 
-  OBJECT_CONSTRUCTORS(JSArrayBufferView, JSObject);
+  TQ_OBJECT_CONSTRUCTORS(JSArrayBufferView)
 };
 
-class JSTypedArray : public JSArrayBufferView {
+class JSTypedArray
+    : public TorqueGeneratedJSTypedArray<JSTypedArray, JSArrayBufferView> {
  public:
   // TODO(v8:4153): This should be equal to JSArrayBuffer::kMaxByteLength
   // eventually.
@@ -260,8 +253,6 @@ class JSTypedArray : public JSArrayBufferView {
       Isolate* isolate, Handle<JSTypedArray> o, Handle<Object> key,
       PropertyDescriptor* desc, Maybe<ShouldThrow> should_throw);
 
-  DECL_CAST(JSTypedArray)
-
   ExternalArrayType type();
   V8_EXPORT_PRIVATE size_t element_size();
 
@@ -270,8 +261,9 @@ class JSTypedArray : public JSArrayBufferView {
   // Use with care: returns raw pointer into heap.
   inline void* DataPtr();
 
-  inline void SetOffHeapDataPtr(void* base, Address offset);
-  inline void SetOnHeapDataPtr(HeapObject base, Address offset);
+  inline void SetOffHeapDataPtr(Isolate* isolate, void* base, Address offset);
+  inline void SetOnHeapDataPtr(Isolate* isolate, HeapObject base,
+                               Address offset);
 
   // Whether the buffer's backing store is on-heap or off-heap.
   inline bool is_on_heap() const;
@@ -288,8 +280,21 @@ class JSTypedArray : public JSArrayBufferView {
   static inline Address ExternalPointerCompensationForOnHeapArray(
       const Isolate* isolate);
 
+  //
+  // Serializer/deserializer support.
+  //
+
+  // External backing stores are serialized/deserialized separately.
+  // During serialization the backing store reference is stored in the typed
+  // array object and upon deserialization it is converted back to actual
+  // external (off-heap) pointer value.
+  // The backing store reference is stored in the external_pointer field.
+  inline uint32_t GetExternalBackingStoreRefForDeserialization() const;
+  inline void SetExternalBackingStoreRefForSerialization(uint32_t ref);
+
   // Subtracts external pointer compensation from the external pointer value.
-  inline void RemoveExternalPointerCompensationForSerialization();
+  inline void RemoveExternalPointerCompensationForSerialization(
+      Isolate* isolate);
 
   static inline MaybeHandle<JSTypedArray> Validate(Isolate* isolate,
                                                    Handle<Object> receiver,
@@ -299,19 +304,6 @@ class JSTypedArray : public JSArrayBufferView {
   DECL_PRINTER(JSTypedArray)
   DECL_VERIFIER(JSTypedArray)
 
-// Layout description.
-#define JS_TYPED_ARRAY_FIELDS(V)                \
-  /* Raw data fields. */                        \
-  V(kLengthOffset, kUIntptrSize)                \
-  V(kExternalPointerOffset, kSystemPointerSize) \
-  V(kBasePointerOffset, kTaggedSize)            \
-  /* Header size. */                            \
-  V(kHeaderSize, 0)
-
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSArrayBufferView::kHeaderSize,
-                                JS_TYPED_ARRAY_FIELDS)
-#undef JS_TYPED_ARRAY_FIELDS
-
   STATIC_ASSERT(IsAligned(kLengthOffset, kUIntptrSize));
   STATIC_ASSERT(IsAligned(kExternalPointerOffset, kSystemPointerSize));
 
@@ -330,37 +322,24 @@ class JSTypedArray : public JSArrayBufferView {
  private:
   friend class Deserializer;
 
-  // [base_pointer]: TODO(v8:4153)
-  DECL_ACCESSORS(base_pointer, Object)
-
   // [external_pointer]: TODO(v8:4153)
-  DECL_PRIMITIVE_ACCESSORS(external_pointer, Address)
+  DECL_GETTER(external_pointer, Address)
+  inline void set_external_pointer(Isolate* isolate, Address value);
 
-  OBJECT_CONSTRUCTORS(JSTypedArray, JSArrayBufferView);
+  TQ_OBJECT_CONSTRUCTORS(JSTypedArray)
 };
 
-class JSDataView : public JSArrayBufferView {
+class JSDataView
+    : public TorqueGeneratedJSDataView<JSDataView, JSArrayBufferView> {
  public:
   // [data_pointer]: pointer to the actual data.
-  DECL_PRIMITIVE_ACCESSORS(data_pointer, void*)
-
-  DECL_CAST(JSDataView)
+  DECL_GETTER(data_pointer, void*)
+  inline void set_data_pointer(Isolate* isolate, void* value);
 
   // Dispatched behavior.
   DECL_PRINTER(JSDataView)
   DECL_VERIFIER(JSDataView)
 
-  // Layout description.
-#define JS_DATA_VIEW_FIELDS(V)       \
-  /* Raw data fields. */             \
-  V(kDataPointerOffset, kIntptrSize) \
-  /* Header size. */                 \
-  V(kHeaderSize, 0)
-
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSArrayBufferView::kHeaderSize,
-                                JS_DATA_VIEW_FIELDS)
-#undef JS_DATA_VIEW_FIELDS
-
   STATIC_ASSERT(IsAligned(kDataPointerOffset, kUIntptrSize));
 
   static const int kSizeWithEmbedderFields =
@@ -369,7 +348,7 @@ class JSDataView : public JSArrayBufferView {
 
   class BodyDescriptor;
 
-  OBJECT_CONSTRUCTORS(JSDataView, JSArrayBufferView);
+  TQ_OBJECT_CONSTRUCTORS(JSDataView)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/js-array-buffer.tq b/deps/v8/src/objects/js-array-buffer.tq
index 9f4f1ba3776..bd99ca74432 100644
--- a/deps/v8/src/objects/js-array-buffer.tq
+++ b/deps/v8/src/objects/js-array-buffer.tq
@@ -10,9 +10,10 @@ bitfield struct JSArrayBufferFlags extends uint32 {
   is_shared: bool: 1 bit;
 }
 
+@generateCppClass
 extern class JSArrayBuffer extends JSObject {
   byte_length: uintptr;
-  backing_store: RawPtr;
+  backing_store: ExternalPointer;
   @if(V8_ARRAY_BUFFER_EXTENSION_BOOL) extension: RawPtr;
   @ifnot(V8_ARRAY_BUFFER_EXTENSION_BOOL) extension: void;
   bit_field: JSArrayBufferFlags;
@@ -21,6 +22,9 @@ extern class JSArrayBuffer extends JSObject {
   @ifnot(TAGGED_SIZE_8_BYTES) optional_padding: void;
 }
 
+extern operator '.backing_store_ptr' macro LoadJSArrayBufferBackingStorePtr(
+    JSArrayBuffer): RawPtr;
+
 @export
 macro IsDetachedBuffer(buffer: JSArrayBuffer): bool {
   return buffer.bit_field.was_detached;
@@ -31,16 +35,22 @@ macro IsSharedArrayBuffer(buffer: JSArrayBuffer): bool {
 }
 
 @abstract
+@generateCppClass
 extern class JSArrayBufferView extends JSObject {
   buffer: JSArrayBuffer;
   byte_offset: uintptr;
   byte_length: uintptr;
 }
 
+@generateCppClass
 extern class JSTypedArray extends JSArrayBufferView {
   length: uintptr;
-  external_pointer: RawPtr;
+  external_pointer: ExternalPointer;
+  // [base_pointer]: TODO(v8:4153)
   base_pointer: ByteArray|Smi;
 }
 
-extern class JSDataView extends JSArrayBufferView { data_pointer: RawPtr; }
+@generateCppClass
+extern class JSDataView extends JSArrayBufferView {
+  data_pointer: ExternalPointer;
+}
diff --git a/deps/v8/src/objects/js-array.h b/deps/v8/src/objects/js-array.h
index 86d14f1924b..6cf54df896f 100644
--- a/deps/v8/src/objects/js-array.h
+++ b/deps/v8/src/objects/js-array.h
@@ -30,6 +30,7 @@ class JSArray : public JSObject {
   // is set to a smi. This matches the set function on FixedArray.
   inline void set_length(Smi length);
 
+  static bool MayHaveReadOnlyLength(Map js_array_map);
   static bool HasReadOnlyLength(Handle<JSArray> array);
   static bool WouldChangeReadOnlyLength(Handle<JSArray> array, uint32_t index);
 
diff --git a/deps/v8/src/objects/js-array.tq b/deps/v8/src/objects/js-array.tq
index b14e794d4d5..dcffc68cba0 100644
--- a/deps/v8/src/objects/js-array.tq
+++ b/deps/v8/src/objects/js-array.tq
@@ -2,10 +2,28 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+extern enum IterationKind extends uint31
+constexpr 'IterationKind' { kKeys, kValues, kEntries }
+
 extern class JSArrayIterator extends JSObject {
   iterated_object: JSReceiver;
   next_index: Number;
-  kind: Smi;
+  kind: SmiTagged<IterationKind>;
+}
+
+// Perform CreateArrayIterator (ES #sec-createarrayiterator).
+@export
+macro CreateArrayIterator(implicit context: NativeContext)(
+    array: JSReceiver, kind: constexpr IterationKind): JSArrayIterator {
+  return new JSArrayIterator{
+    map: UnsafeCast<Map>(
+        context[NativeContextSlot::INITIAL_ARRAY_ITERATOR_MAP_INDEX]),
+    properties_or_hash: kEmptyFixedArray,
+    elements: kEmptyFixedArray,
+    iterated_object: array,
+    next_index: 0,
+    kind: SmiTag<IterationKind>(kind)
+  };
 }
 
 extern class JSArray extends JSObject {
@@ -176,8 +194,7 @@ struct FastJSArrayWitness {
   macro LoadElementOrUndefined(implicit context: Context)(k: Smi): JSAny {
     try {
       return this.LoadElementNoHole(k) otherwise FoundHole;
-    }
-    label FoundHole {
+    } label FoundHole {
       return Undefined;
     }
   }
diff --git a/deps/v8/src/objects/js-break-iterator-inl.h b/deps/v8/src/objects/js-break-iterator-inl.h
index 0dd23edaa5a..729aff90afc 100644
--- a/deps/v8/src/objects/js-break-iterator-inl.h
+++ b/deps/v8/src/objects/js-break-iterator-inl.h
@@ -18,20 +18,12 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(JSV8BreakIterator, JSObject)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSV8BreakIterator)
 
-ACCESSORS(JSV8BreakIterator, locale, String, kLocaleOffset)
 ACCESSORS(JSV8BreakIterator, break_iterator, Managed<icu::BreakIterator>,
           kBreakIteratorOffset)
 ACCESSORS(JSV8BreakIterator, unicode_string, Managed<icu::UnicodeString>,
           kUnicodeStringOffset)
-ACCESSORS(JSV8BreakIterator, bound_adopt_text, Object, kBoundAdoptTextOffset)
-ACCESSORS(JSV8BreakIterator, bound_first, Object, kBoundFirstOffset)
-ACCESSORS(JSV8BreakIterator, bound_next, Object, kBoundNextOffset)
-ACCESSORS(JSV8BreakIterator, bound_current, Object, kBoundCurrentOffset)
-ACCESSORS(JSV8BreakIterator, bound_break_type, Object, kBoundBreakTypeOffset)
-
-CAST_ACCESSOR(JSV8BreakIterator)
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/js-break-iterator.cc b/deps/v8/src/objects/js-break-iterator.cc
index 28db1699f44..483cc1f8c47 100644
--- a/deps/v8/src/objects/js-break-iterator.cc
+++ b/deps/v8/src/objects/js-break-iterator.cc
@@ -239,9 +239,7 @@ String JSV8BreakIterator::BreakType(Isolate* isolate,
 }
 
 const std::set<std::string>& JSV8BreakIterator::GetAvailableLocales() {
-  static base::LazyInstance<Intl::AvailableLocales<icu::BreakIterator>>::type
-      available_locales = LAZY_INSTANCE_INITIALIZER;
-  return available_locales.Pointer()->Get();
+  return Intl::GetAvailableLocales();
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/js-break-iterator.h b/deps/v8/src/objects/js-break-iterator.h
index e21fa9f0eb0..20c177a5f60 100644
--- a/deps/v8/src/objects/js-break-iterator.h
+++ b/deps/v8/src/objects/js-break-iterator.h
@@ -27,7 +27,8 @@ class BreakIterator;
 namespace v8 {
 namespace internal {
 
-class JSV8BreakIterator : public JSObject {
+class JSV8BreakIterator
+    : public TorqueGeneratedJSV8BreakIterator<JSV8BreakIterator, JSObject> {
  public:
   V8_WARN_UNUSED_RESULT static MaybeHandle<JSV8BreakIterator> New(
       Isolate* isolate, Handle<Map> map, Handle<Object> input_locales,
@@ -51,25 +52,12 @@ class JSV8BreakIterator : public JSObject {
   static String BreakType(Isolate* isolate,
                           Handle<JSV8BreakIterator> break_iterator);
 
-  DECL_CAST(JSV8BreakIterator)
   DECL_PRINTER(JSV8BreakIterator)
-  DECL_VERIFIER(JSV8BreakIterator)
 
-  DECL_ACCESSORS(locale, String)
   DECL_ACCESSORS(break_iterator, Managed<icu::BreakIterator>)
   DECL_ACCESSORS(unicode_string, Managed<icu::UnicodeString>)
-  DECL_ACCESSORS(bound_adopt_text, Object)
-  DECL_ACCESSORS(bound_first, Object)
-  DECL_ACCESSORS(bound_next, Object)
-  DECL_ACCESSORS(bound_current, Object)
-  DECL_ACCESSORS(bound_break_type, Object)
-
-  // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
-                                TORQUE_GENERATED_JS_V8_BREAK_ITERATOR_FIELDS)
-
- private:
-  OBJECT_CONSTRUCTORS(JSV8BreakIterator, JSObject);
+
+  TQ_OBJECT_CONSTRUCTORS(JSV8BreakIterator)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/js-collator-inl.h b/deps/v8/src/objects/js-collator-inl.h
index a8d38933160..30660f2e14d 100644
--- a/deps/v8/src/objects/js-collator-inl.h
+++ b/deps/v8/src/objects/js-collator-inl.h
@@ -18,12 +18,9 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(JSCollator, JSObject)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSCollator)
 
 ACCESSORS(JSCollator, icu_collator, Managed<icu::Collator>, kIcuCollatorOffset)
-ACCESSORS(JSCollator, bound_compare, Object, kBoundCompareOffset)
-
-CAST_ACCESSOR(JSCollator)
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/js-collator.cc b/deps/v8/src/objects/js-collator.cc
index 046fa25e3d6..ea9120cbed9 100644
--- a/deps/v8/src/objects/js-collator.cc
+++ b/deps/v8/src/objects/js-collator.cc
@@ -493,18 +493,33 @@ MaybeHandle<JSCollator> JSCollator::New(Isolate* isolate, Handle<Map> map,
 
 namespace {
 
-struct CheckColl {
-  static const char* key() { return nullptr; }
+class CollatorAvailableLocales {
+ public:
+  CollatorAvailableLocales() {
+    int32_t num_locales = 0;
+    const icu::Locale* icu_available_locales =
+        icu::Collator::getAvailableLocales(num_locales);
+    std::vector<std::string> locales;
+    for (int32_t i = 0; i < num_locales; ++i) {
+      locales.push_back(
+          Intl::ToLanguageTag(icu_available_locales[i]).FromJust());
+    }
 #define U_ICUDATA_COLL U_ICUDATA_NAME U_TREE_SEPARATOR_STRING "coll"
-  static const char* path() { return U_ICUDATA_COLL; }
+    set_ = Intl::BuildLocaleSet(locales, U_ICUDATA_COLL, nullptr);
 #undef U_ICUDATA_COLL
+  }
+  virtual ~CollatorAvailableLocales() {}
+  const std::set<std::string>& Get() const { return set_; }
+
+ private:
+  std::set<std::string> set_;
 };
 
 }  // namespace
 
 const std::set<std::string>& JSCollator::GetAvailableLocales() {
-  static base::LazyInstance<Intl::AvailableLocales<icu::Collator, CheckColl>>::
-      type available_locales = LAZY_INSTANCE_INITIALIZER;
+  static base::LazyInstance<CollatorAvailableLocales>::type available_locales =
+      LAZY_INSTANCE_INITIALIZER;
   return available_locales.Pointer()->Get();
 }
 
diff --git a/deps/v8/src/objects/js-collator.h b/deps/v8/src/objects/js-collator.h
index 0147b80ebb0..bad0f93c67b 100644
--- a/deps/v8/src/objects/js-collator.h
+++ b/deps/v8/src/objects/js-collator.h
@@ -29,7 +29,7 @@ class Collator;
 namespace v8 {
 namespace internal {
 
-class JSCollator : public JSObject {
+class JSCollator : public TorqueGeneratedJSCollator<JSCollator, JSObject> {
  public:
   // ecma402/#sec-initializecollator
   V8_WARN_UNUSED_RESULT static MaybeHandle<JSCollator> New(
@@ -42,18 +42,11 @@ class JSCollator : public JSObject {
 
   V8_EXPORT_PRIVATE static const std::set<std::string>& GetAvailableLocales();
 
-  DECL_CAST(JSCollator)
   DECL_PRINTER(JSCollator)
-  DECL_VERIFIER(JSCollator)
-
-// Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
-                                TORQUE_GENERATED_JS_COLLATOR_FIELDS)
 
   DECL_ACCESSORS(icu_collator, Managed<icu::Collator>)
-  DECL_ACCESSORS(bound_compare, Object)
 
-  OBJECT_CONSTRUCTORS(JSCollator, JSObject);
+  TQ_OBJECT_CONSTRUCTORS(JSCollator)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/js-collection.h b/deps/v8/src/objects/js-collection.h
index 17f9c3e198b..a0350726c02 100644
--- a/deps/v8/src/objects/js-collection.h
+++ b/deps/v8/src/objects/js-collection.h
@@ -30,6 +30,7 @@ class JSSet : public TorqueGeneratedJSSet<JSSet, JSCollection> {
  public:
   static void Initialize(Handle<JSSet> set, Isolate* isolate);
   static void Clear(Isolate* isolate, Handle<JSSet> set);
+  void Rehash(Isolate* isolate);
 
   // Dispatched behavior.
   DECL_PRINTER(JSSet)
@@ -56,6 +57,7 @@ class JSMap : public TorqueGeneratedJSMap<JSMap, JSCollection> {
  public:
   static void Initialize(Handle<JSMap> map, Isolate* isolate);
   static void Clear(Isolate* isolate, Handle<JSMap> map);
+  void Rehash(Isolate* isolate);
 
   // Dispatched behavior.
   DECL_PRINTER(JSMap)
diff --git a/deps/v8/src/objects/js-date-time-format-inl.h b/deps/v8/src/objects/js-date-time-format-inl.h
index 4ab9adb8444..56d44cacf96 100644
--- a/deps/v8/src/objects/js-date-time-format-inl.h
+++ b/deps/v8/src/objects/js-date-time-format-inl.h
@@ -18,16 +18,13 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(JSDateTimeFormat, JSObject)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSDateTimeFormat)
 
-ACCESSORS(JSDateTimeFormat, locale, String, kLocaleOffset)
 ACCESSORS(JSDateTimeFormat, icu_locale, Managed<icu::Locale>, kIcuLocaleOffset)
 ACCESSORS(JSDateTimeFormat, icu_simple_date_format,
           Managed<icu::SimpleDateFormat>, kIcuSimpleDateFormatOffset)
 ACCESSORS(JSDateTimeFormat, icu_date_interval_format,
           Managed<icu::DateIntervalFormat>, kIcuDateIntervalFormatOffset)
-ACCESSORS(JSDateTimeFormat, bound_format, Object, kBoundFormatOffset)
-SMI_ACCESSORS(JSDateTimeFormat, flags, kFlagsOffset)
 
 inline void JSDateTimeFormat::set_hour_cycle(HourCycle hour_cycle) {
   int hints = flags();
@@ -61,8 +58,6 @@ inline JSDateTimeFormat::DateTimeStyle JSDateTimeFormat::time_style() const {
   return TimeStyleBits::decode(flags());
 }
 
-CAST_ACCESSOR(JSDateTimeFormat)
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/js-date-time-format.cc b/deps/v8/src/objects/js-date-time-format.cc
index 5643ee57d57..669dfd88ab2 100644
--- a/deps/v8/src/objects/js-date-time-format.cc
+++ b/deps/v8/src/objects/js-date-time-format.cc
@@ -34,6 +34,23 @@ namespace internal {
 
 namespace {
 
+std::string ToHourCycleString(JSDateTimeFormat::HourCycle hc) {
+  switch (hc) {
+    case JSDateTimeFormat::HourCycle::kH11:
+      return "h11";
+    case JSDateTimeFormat::HourCycle::kH12:
+      return "h12";
+    case JSDateTimeFormat::HourCycle::kH23:
+      return "h23";
+    case JSDateTimeFormat::HourCycle::kH24:
+      return "h24";
+    case JSDateTimeFormat::HourCycle::kUndefined:
+      return "";
+    default:
+      UNREACHABLE();
+  }
+}
+
 JSDateTimeFormat::HourCycle ToHourCycle(const std::string& hc) {
   if (hc == "h11") return JSDateTimeFormat::HourCycle::kH11;
   if (hc == "h12") return JSDateTimeFormat::HourCycle::kH12;
@@ -261,7 +278,7 @@ const std::vector<PatternData>& GetPatternData(
   }
 }
 
-std::string GetGMTTzID(Isolate* isolate, const std::string& input) {
+std::string GetGMTTzID(const std::string& input) {
   std::string ret = "Etc/GMT";
   switch (input.length()) {
     case 8:
@@ -304,10 +321,8 @@ char LocaleIndependentAsciiToLower(char ch) {
 // or ho_cHi_minH -> Ho_Chi_Minh. It is locale-agnostic and only
 // deals with ASCII only characters.
 // 'of', 'au' and 'es' are special-cased and lowercased.
-// Also "Antarctica/DumontDUrville" is special case.
 // ICU's timezone parsing is case sensitive, but ECMAScript is case insensitive
-std::string ToTitleCaseTimezoneLocation(Isolate* isolate,
-                                        const std::string& input) {
+std::string ToTitleCaseTimezoneLocation(const std::string& input) {
   std::string title_cased;
   int word_length = 0;
   for (char ch : input) {
@@ -332,34 +347,102 @@ std::string ToTitleCaseTimezoneLocation(Isolate* isolate,
       return std::string();
     }
   }
-  // Special case
-  if (title_cased == "Antarctica/Dumontdurville") {
-    return "Antarctica/DumontDUrville";
-  }
+
   return title_cased;
 }
 
+class SpecialTimeZoneMap {
+ public:
+  SpecialTimeZoneMap() {
+    Add("America/Argentina/ComodRivadavia");
+    Add("America/Knox_IN");
+    Add("Antarctica/McMurdo");
+    Add("Australia/ACT");
+    Add("Australia/LHI");
+    Add("Australia/NSW");
+    Add("Antarctica/DumontDUrville");
+    Add("Brazil/DeNoronha");
+    Add("CET");
+    Add("CST6CDT");
+    Add("Chile/EasterIsland");
+    Add("EET");
+    Add("EST");
+    Add("EST5EDT");
+    Add("GB");
+    Add("GB-Eire");
+    Add("HST");
+    Add("MET");
+    Add("MST");
+    Add("MST7MDT");
+    Add("Mexico/BajaNorte");
+    Add("Mexico/BajaSur");
+    Add("NZ");
+    Add("NZ-CHAT");
+    Add("PRC");
+    Add("PST8PDT");
+    Add("ROC");
+    Add("ROK");
+    Add("UCT");
+    Add("W-SU");
+    Add("WET");
+  }
+
+  std::string Find(const std::string& id) {
+    auto it = map_.find(id);
+    if (it != map_.end()) {
+      return it->second;
+    }
+    return "";
+  }
+
+ private:
+  void Add(const char* id) {
+    std::string upper(id);
+    transform(upper.begin(), upper.end(), upper.begin(),
+              LocaleIndependentAsciiToUpper);
+    map_.insert({upper, id});
+  }
+  std::map<std::string, std::string> map_;
+};
+
 // Return the time zone id which match ICU's expectation of title casing
 // return empty string when error.
-std::string CanonicalizeTimeZoneID(Isolate* isolate, const std::string& input) {
+std::string CanonicalizeTimeZoneID(const std::string& input) {
   std::string upper = input;
   transform(upper.begin(), upper.end(), upper.begin(),
             LocaleIndependentAsciiToUpper);
-  if (upper == "UTC" || upper == "GMT" || upper == "ETC/UTC" ||
-      upper == "ETC/GMT") {
-    return "UTC";
+  if (upper.length() >= 3) {
+    if (memcmp(upper.c_str(), "ETC", 3) == 0) {
+      if (upper == "ETC/UTC" || upper == "ETC/GMT" || upper == "ETC/UCT") {
+        return "UTC";
+      }
+      if (strncmp(upper.c_str(), "ETC/GMT", 7) == 0) {
+        return GetGMTTzID(input);
+      }
+    } else if (memcmp(upper.c_str(), "GMT", 3) == 0) {
+      if (upper == "GMT" || upper == "GMT0" || upper == "GMT+0" ||
+          upper == "GMT-0") {
+        return "UTC";
+      }
+    } else if (memcmp(upper.c_str(), "US/", 3) == 0) {
+      std::string title = ToTitleCaseTimezoneLocation(input);
+      // Change "Us/" to "US/"
+      title[1] = 'S';
+      return title;
+    } else if (upper == "UTC") {
+      return "UTC";
+    }
   }
   // We expect only _, '-' and / beside ASCII letters.
-  // All inputs should conform to Area/Location(/Location)*, or Etc/GMT* .
-  // TODO(jshin): 1. Support 'GB-Eire", 'EST5EDT", "ROK', 'US/*', 'NZ' and many
-  // other aliases/linked names when moving timezone validation code to C++.
-  // See crbug.com/364374 and crbug.com/v8/8007 .
-  // 2. Resolve the difference betwee CLDR/ICU and IANA time zone db.
-  // See http://unicode.org/cldr/trac/ticket/9892 and crbug.com/645807 .
-  if (strncmp(upper.c_str(), "ETC/GMT", 7) == 0) {
-    return GetGMTTzID(isolate, input);
-  }
-  return ToTitleCaseTimezoneLocation(isolate, input);
+
+  static base::LazyInstance<SpecialTimeZoneMap>::type special_time_zone_map =
+      LAZY_INSTANCE_INITIALIZER;
+
+  std::string special_case = special_time_zone_map.Pointer()->Find(upper);
+  if (!special_case.empty()) {
+    return special_case;
+  }
+  return ToTitleCaseTimezoneLocation(input);
 }
 
 Handle<String> DateTimeStyleAsString(Isolate* isolate,
@@ -479,6 +562,7 @@ MaybeHandle<JSObject> JSDateTimeFormat::ResolvedOptions(
   //    [[Minute]]           "minute"
   //    [[Second]]           "second"
   //    [[TimeZoneName]]     "timeZoneName"
+  //    [[FractionalSecondDigits]]     "fractionalSecondDigits"
   CHECK(JSReceiver::CreateDataProperty(isolate, options,
                                        factory->locale_string(), locale,
                                        Just(kDontThrow))
@@ -549,6 +633,13 @@ MaybeHandle<JSObject> JSDateTimeFormat::ResolvedOptions(
         }
       }
     }
+    if (FLAG_harmony_intl_dateformat_fractional_second_digits) {
+      int fsd = FractionalSecondDigitsFromPattern(pattern);
+      CHECK(JSReceiver::CreateDataProperty(
+                isolate, options, factory->fractionalSecondDigits_string(),
+                factory->NewNumberFromInt(fsd), Just(kDontThrow))
+                .FromJust());
+    }
   }
 
   // dateStyle
@@ -568,14 +659,6 @@ MaybeHandle<JSObject> JSDateTimeFormat::ResolvedOptions(
               Just(kDontThrow))
               .FromJust());
   }
-  if (FLAG_harmony_intl_dateformat_fractional_second_digits) {
-    int fsd = FractionalSecondDigitsFromPattern(pattern);
-    CHECK(JSReceiver::CreateDataProperty(
-              isolate, options, factory->fractionalSecondDigits_string(),
-              factory->NewNumberFromInt(fsd), Just(kDontThrow))
-              .FromJust());
-  }
-
   return options;
 }
 
@@ -868,15 +951,14 @@ bool IsValidTimeZoneName(const icu::TimeZone& tz) {
          canonical != icu::UnicodeString("Etc/Unknown", -1, US_INV);
 }
 
-std::unique_ptr<icu::TimeZone> CreateTimeZone(Isolate* isolate,
-                                              const char* timezone) {
+std::unique_ptr<icu::TimeZone> CreateTimeZone(const char* timezone) {
   // Create time zone as specified by the user. We have to re-create time zone
   // since calendar takes ownership.
   if (timezone == nullptr) {
     // 19.a. Else / Let timeZone be DefaultTimeZone().
     return std::unique_ptr<icu::TimeZone>(icu::TimeZone::createDefault());
   }
-  std::string canonicalized = CanonicalizeTimeZoneID(isolate, timezone);
+  std::string canonicalized = CanonicalizeTimeZoneID(timezone);
   if (canonicalized.empty()) return std::unique_ptr<icu::TimeZone>();
   std::unique_ptr<icu::TimeZone> tz(
       icu::TimeZone::createTimeZone(canonicalized.c_str()));
@@ -1078,10 +1160,18 @@ icu::DateIntervalFormat* LazyCreateDateIntervalFormat(
   icu::SimpleDateFormat* icu_simple_date_format =
       date_time_format->icu_simple_date_format().raw();
   UErrorCode status = U_ZERO_ERROR;
+
+  icu::Locale loc = *(date_time_format->icu_locale().raw());
+  // We need to pass in the hc to DateIntervalFormat by using Unicode 'hc'
+  // extension.
+  std::string hcString = ToHourCycleString(date_time_format->hour_cycle());
+  if (!hcString.empty()) {
+    loc.setUnicodeKeywordValue("hc", hcString, status);
+  }
+
   std::unique_ptr<icu::DateIntervalFormat> date_interval_format(
       icu::DateIntervalFormat::createInstance(
-          SkeletonFromDateFormat(*icu_simple_date_format),
-          *(date_time_format->icu_locale().raw()), status));
+          SkeletonFromDateFormat(*icu_simple_date_format), loc, status));
   if (U_FAILURE(status)) {
     return nullptr;
   }
@@ -1262,17 +1352,15 @@ class DateTimePatternGeneratorCache {
  public:
   // Return a clone copy that the caller have to free.
   icu::DateTimePatternGenerator* CreateGenerator(const icu::Locale& locale) {
-    std::string key(FLAG_harmony_intl_other_calendars ? locale.getName()
-                                                      : locale.getBaseName());
+    std::string key(locale.getName());
     base::MutexGuard guard(&mutex_);
     auto it = map_.find(key);
     if (it != map_.end()) {
       return it->second->clone();
     }
     UErrorCode status = U_ZERO_ERROR;
-    map_[key].reset(icu::DateTimePatternGenerator::createInstance(
-        FLAG_harmony_intl_other_calendars ? locale : icu::Locale(key.c_str()),
-        status));
+    map_[key].reset(
+        icu::DateTimePatternGenerator::createInstance(locale, status));
     // Fallback to use "root".
     if (U_FAILURE(status)) {
       status = U_ZERO_ERROR;
@@ -1321,32 +1409,29 @@ MaybeHandle<JSDateTimeFormat> JSDateTimeFormat::New(
 
   std::unique_ptr<char[]> calendar_str = nullptr;
   std::unique_ptr<char[]> numbering_system_str = nullptr;
-  if (FLAG_harmony_intl_add_calendar_numbering_system) {
-    const std::vector<const char*> empty_values = {};
-    // 6. Let calendar be ? GetOption(options, "calendar",
-    //    "string", undefined, undefined).
-    Maybe<bool> maybe_calendar = Intl::GetStringOption(
-        isolate, options, "calendar", empty_values, service, &calendar_str);
-    MAYBE_RETURN(maybe_calendar, MaybeHandle<JSDateTimeFormat>());
-    if (maybe_calendar.FromJust() && calendar_str != nullptr) {
-      icu::Locale default_locale;
-      if (!Intl::IsWellFormedCalendar(calendar_str.get())) {
-        THROW_NEW_ERROR(
-            isolate,
-            NewRangeError(
-                MessageTemplate::kInvalid, factory->calendar_string(),
-                factory->NewStringFromAsciiChecked(calendar_str.get())),
-            JSDateTimeFormat);
-      }
+  const std::vector<const char*> empty_values = {};
+  // 6. Let calendar be ? GetOption(options, "calendar",
+  //    "string", undefined, undefined).
+  Maybe<bool> maybe_calendar = Intl::GetStringOption(
+      isolate, options, "calendar", empty_values, service, &calendar_str);
+  MAYBE_RETURN(maybe_calendar, MaybeHandle<JSDateTimeFormat>());
+  if (maybe_calendar.FromJust() && calendar_str != nullptr) {
+    icu::Locale default_locale;
+    if (!Intl::IsWellFormedCalendar(calendar_str.get())) {
+      THROW_NEW_ERROR(
+          isolate,
+          NewRangeError(MessageTemplate::kInvalid, factory->calendar_string(),
+                        factory->NewStringFromAsciiChecked(calendar_str.get())),
+          JSDateTimeFormat);
     }
-
-    // 8. Let numberingSystem be ? GetOption(options, "numberingSystem",
-    //    "string", undefined, undefined).
-    Maybe<bool> maybe_numberingSystem = Intl::GetNumberingSystem(
-        isolate, options, service, &numbering_system_str);
-    MAYBE_RETURN(maybe_numberingSystem, MaybeHandle<JSDateTimeFormat>());
   }
 
+  // 8. Let numberingSystem be ? GetOption(options, "numberingSystem",
+  //    "string", undefined, undefined).
+  Maybe<bool> maybe_numberingSystem = Intl::GetNumberingSystem(
+      isolate, options, service, &numbering_system_str);
+  MAYBE_RETURN(maybe_numberingSystem, MaybeHandle<JSDateTimeFormat>());
+
   // 6. Let hour12 be ? GetOption(options, "hour12", "boolean", undefined,
   // undefined).
   bool hour12;
@@ -1424,13 +1509,12 @@ MaybeHandle<JSDateTimeFormat> JSDateTimeFormat::New(
   }
 
   // 17. Let timeZone be ? Get(options, "timeZone").
-  const std::vector<const char*> empty_values;
   std::unique_ptr<char[]> timezone = nullptr;
   Maybe<bool> maybe_timezone = Intl::GetStringOption(
       isolate, options, "timeZone", empty_values, service, &timezone);
   MAYBE_RETURN(maybe_timezone, Handle<JSDateTimeFormat>());
 
-  std::unique_ptr<icu::TimeZone> tz = CreateTimeZone(isolate, timezone.get());
+  std::unique_ptr<icu::TimeZone> tz = CreateTimeZone(timezone.get());
   if (tz.get() == nullptr) {
     THROW_NEW_ERROR(
         isolate,
diff --git a/deps/v8/src/objects/js-date-time-format.h b/deps/v8/src/objects/js-date-time-format.h
index ef50b71dc97..1e5720760e6 100644
--- a/deps/v8/src/objects/js-date-time-format.h
+++ b/deps/v8/src/objects/js-date-time-format.h
@@ -31,7 +31,8 @@ class SimpleDateFormat;
 namespace v8 {
 namespace internal {
 
-class JSDateTimeFormat : public JSObject {
+class JSDateTimeFormat
+    : public TorqueGeneratedJSDateTimeFormat<JSDateTimeFormat, JSObject> {
  public:
   V8_WARN_UNUSED_RESULT static MaybeHandle<JSDateTimeFormat> New(
       Isolate* isolate, Handle<Map> map, Handle<Object> locales,
@@ -84,15 +85,10 @@ class JSDateTimeFormat : public JSObject {
   V8_EXPORT_PRIVATE static const std::set<std::string>& GetAvailableLocales();
 
   Handle<String> HourCycleAsString() const;
-  DECL_CAST(JSDateTimeFormat)
 
   // ecma-402/#sec-properties-of-intl-datetimeformat-instances
   enum class DateTimeStyle { kUndefined, kFull, kLong, kMedium, kShort };
 
-// Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
-                                TORQUE_GENERATED_JS_DATE_TIME_FORMAT_FIELDS)
-
   // enum for "hourCycle" option.
   enum class HourCycle { kUndefined, kH11, kH12, kH23, kH24 };
 
@@ -126,17 +122,13 @@ class JSDateTimeFormat : public JSObject {
   STATIC_ASSERT(DateTimeStyle::kMedium <= TimeStyleBits::kMax);
   STATIC_ASSERT(DateTimeStyle::kShort <= TimeStyleBits::kMax);
 
-  DECL_ACCESSORS(locale, String)
   DECL_ACCESSORS(icu_locale, Managed<icu::Locale>)
   DECL_ACCESSORS(icu_simple_date_format, Managed<icu::SimpleDateFormat>)
   DECL_ACCESSORS(icu_date_interval_format, Managed<icu::DateIntervalFormat>)
-  DECL_ACCESSORS(bound_format, Object)
-  DECL_INT_ACCESSORS(flags)
 
   DECL_PRINTER(JSDateTimeFormat)
-  DECL_VERIFIER(JSDateTimeFormat)
 
-  OBJECT_CONSTRUCTORS(JSDateTimeFormat, JSObject);
+  TQ_OBJECT_CONSTRUCTORS(JSDateTimeFormat)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/js-display-names-inl.h b/deps/v8/src/objects/js-display-names-inl.h
index 103f3b388c1..40bea22c97f 100644
--- a/deps/v8/src/objects/js-display-names-inl.h
+++ b/deps/v8/src/objects/js-display-names-inl.h
@@ -20,12 +20,7 @@ namespace internal {
 
 ACCESSORS(JSDisplayNames, internal, Managed<DisplayNamesInternal>,
           kInternalOffset)
-OBJECT_CONSTRUCTORS_IMPL(JSDisplayNames, JSObject)
-
-// Base display names accessors.
-SMI_ACCESSORS(JSDisplayNames, flags, kFlagsOffset)
-
-CAST_ACCESSOR(JSDisplayNames)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSDisplayNames)
 
 inline void JSDisplayNames::set_style(Style style) {
   DCHECK_GE(StyleBits::kMax, style);
diff --git a/deps/v8/src/objects/js-display-names.cc b/deps/v8/src/objects/js-display-names.cc
index 95f46411730..7de863b19bb 100644
--- a/deps/v8/src/objects/js-display-names.cc
+++ b/deps/v8/src/objects/js-display-names.cc
@@ -76,8 +76,8 @@ UDisplayContext ToUDisplayContext(JSDisplayNames::Style style) {
 // Abstract class for all different types.
 class DisplayNamesInternal {
  public:
-  DisplayNamesInternal() {}
-  virtual ~DisplayNamesInternal() {}
+  DisplayNamesInternal() = default;
+  virtual ~DisplayNamesInternal() = default;
   virtual const char* type() const = 0;
   virtual icu::Locale locale() const = 0;
   virtual Maybe<icu::UnicodeString> of(Isolate* isolate,
@@ -101,7 +101,7 @@ class LocaleDisplayNamesCommon : public DisplayNamesInternal {
         icu::LocaleDisplayNames::createInstance(locale, display_context, 4));
   }
 
-  virtual ~LocaleDisplayNamesCommon() {}
+  ~LocaleDisplayNamesCommon() override = default;
 
   icu::Locale locale() const override { return ldn_->getLocale(); }
 
@@ -118,7 +118,7 @@ class LanguageNames : public LocaleDisplayNamesCommon {
   LanguageNames(const icu::Locale& locale, JSDisplayNames::Style style,
                 bool fallback)
       : LocaleDisplayNamesCommon(locale, style, fallback) {}
-  virtual ~LanguageNames() {}
+  ~LanguageNames() override = default;
   const char* type() const override { return "language"; }
   Maybe<icu::UnicodeString> of(Isolate* isolate,
                                const char* code) const override {
@@ -145,7 +145,7 @@ class RegionNames : public LocaleDisplayNamesCommon {
   RegionNames(const icu::Locale& locale, JSDisplayNames::Style style,
               bool fallback)
       : LocaleDisplayNamesCommon(locale, style, fallback) {}
-  virtual ~RegionNames() {}
+  ~RegionNames() override = default;
   const char* type() const override { return "region"; }
   Maybe<icu::UnicodeString> of(Isolate* isolate,
                                const char* code) const override {
@@ -167,7 +167,7 @@ class ScriptNames : public LocaleDisplayNamesCommon {
   ScriptNames(const icu::Locale& locale, JSDisplayNames::Style style,
               bool fallback)
       : LocaleDisplayNamesCommon(locale, style, fallback) {}
-  virtual ~ScriptNames() {}
+  ~ScriptNames() override = default;
   const char* type() const override { return "script"; }
   Maybe<icu::UnicodeString> of(Isolate* isolate,
                                const char* code) const override {
@@ -189,7 +189,7 @@ class CurrencyNames : public LocaleDisplayNamesCommon {
   CurrencyNames(const icu::Locale& locale, JSDisplayNames::Style style,
                 bool fallback)
       : LocaleDisplayNamesCommon(locale, style, fallback) {}
-  virtual ~CurrencyNames() {}
+  ~CurrencyNames() override = default;
   const char* type() const override { return "currency"; }
   Maybe<icu::UnicodeString> of(Isolate* isolate,
                                const char* code) const override {
@@ -267,7 +267,7 @@ class DateTimeFieldNames : public DisplayNamesInternal {
         icu::DateTimePatternGenerator::createInstance(locale_, status));
     CHECK(U_SUCCESS(status));
   }
-  virtual ~DateTimeFieldNames() {}
+  ~DateTimeFieldNames() override = default;
   const char* type() const override { return "dateTimeField"; }
   icu::Locale locale() const override { return locale_; }
   Maybe<icu::UnicodeString> of(Isolate* isolate,
@@ -314,7 +314,7 @@ class DateFormatSymbolsNames : public DisplayNamesInternal {
         length_(length),
         calendar_(calendar) {}
 
-  virtual ~DateFormatSymbolsNames() {}
+  ~DateFormatSymbolsNames() override = default;
 
   const char* type() const override { return type_; }
 
@@ -354,7 +354,7 @@ class WeekdayNames : public DateFormatSymbolsNames {
                const icu::UnicodeString* array, int32_t length,
                const char* calendar)
       : DateFormatSymbolsNames(type, locale, array, length, calendar) {}
-  virtual ~WeekdayNames() {}
+  ~WeekdayNames() override = default;
 
   int32_t ComputeIndex(const char* code) const override {
     int32_t i = atoi(code);
@@ -370,7 +370,7 @@ class MonthNames : public DateFormatSymbolsNames {
              const icu::UnicodeString* array, int32_t length,
              const char* calendar)
       : DateFormatSymbolsNames(type, locale, array, length, calendar) {}
-  virtual ~MonthNames() {}
+  ~MonthNames() override = default;
 
   int32_t ComputeIndex(const char* code) const override {
     return atoi(code) - 1;
@@ -383,7 +383,7 @@ class QuarterNames : public DateFormatSymbolsNames {
                const icu::UnicodeString* array, int32_t length,
                const char* calendar)
       : DateFormatSymbolsNames(type, locale, array, length, calendar) {}
-  virtual ~QuarterNames() {}
+  ~QuarterNames() override = default;
 
   int32_t ComputeIndex(const char* code) const override {
     return atoi(code) - 1;
@@ -396,7 +396,7 @@ class DayPeriodNames : public DateFormatSymbolsNames {
                  const icu::UnicodeString* array, int32_t length,
                  const char* calendar)
       : DateFormatSymbolsNames(type, locale, array, length, calendar) {}
-  virtual ~DayPeriodNames() {}
+  ~DayPeriodNames() override = default;
 
   int32_t ComputeIndex(const char* code) const override {
     if (strcmp("am", code) == 0) {
@@ -750,8 +750,7 @@ struct CheckCalendar {
 }  // namespace
 
 const std::set<std::string>& JSDisplayNames::GetAvailableLocales() {
-  static base::LazyInstance<
-      Intl::AvailableLocales<icu::Locale, CheckCalendar>>::type
+  static base::LazyInstance<Intl::AvailableLocales<CheckCalendar>>::type
       available_locales = LAZY_INSTANCE_INITIALIZER;
   return available_locales.Pointer()->Get();
 }
diff --git a/deps/v8/src/objects/js-display-names.h b/deps/v8/src/objects/js-display-names.h
index c656a257793..cd3ca1ea475 100644
--- a/deps/v8/src/objects/js-display-names.h
+++ b/deps/v8/src/objects/js-display-names.h
@@ -25,7 +25,8 @@ namespace internal {
 
 class DisplayNamesInternal;
 
-class JSDisplayNames : public JSObject {
+class JSDisplayNames
+    : public TorqueGeneratedJSDisplayNames<JSDisplayNames, JSObject> {
  public:
   // Creates display names object with properties derived from input
   // locales and options.
@@ -65,8 +66,6 @@ class JSDisplayNames : public JSObject {
   inline void set_fallback(Fallback fallback);
   inline Fallback fallback() const;
 
-  DECL_CAST(JSDisplayNames)
-
   // Bit positions in |flags|.
   DEFINE_TORQUE_GENERATED_JS_DISPLAY_NAMES_FLAGS()
 
@@ -76,19 +75,11 @@ class JSDisplayNames : public JSObject {
   STATIC_ASSERT(Fallback::kCode <= FallbackBit::kMax);
   STATIC_ASSERT(Fallback::kNone <= FallbackBit::kMax);
 
-  // [flags] Bit field containing various flags about the function.
-  DECL_INT_ACCESSORS(flags)
-
   DECL_ACCESSORS(internal, Managed<DisplayNamesInternal>)
 
   DECL_PRINTER(JSDisplayNames)
-  DECL_VERIFIER(JSDisplayNames)
-
-  // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
-                                TORQUE_GENERATED_JS_DISPLAY_NAMES_FIELDS)
 
-  OBJECT_CONSTRUCTORS(JSDisplayNames, JSObject);
+  TQ_OBJECT_CONSTRUCTORS(JSDisplayNames)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/js-list-format-inl.h b/deps/v8/src/objects/js-list-format-inl.h
index 6a1529ad335..5cf95db4d54 100644
--- a/deps/v8/src/objects/js-list-format-inl.h
+++ b/deps/v8/src/objects/js-list-format-inl.h
@@ -18,13 +18,11 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(JSListFormat, JSObject)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSListFormat)
 
 // Base list format accessors.
-ACCESSORS(JSListFormat, locale, String, kLocaleOffset)
 ACCESSORS(JSListFormat, icu_formatter, Managed<icu::ListFormatter>,
           kIcuFormatterOffset)
-SMI_ACCESSORS(JSListFormat, flags, kFlagsOffset)
 
 inline void JSListFormat::set_style(Style style) {
   DCHECK_GE(StyleBits::kMax, style);
@@ -48,8 +46,6 @@ inline JSListFormat::Type JSListFormat::type() const {
   return TypeBits::decode(flags());
 }
 
-CAST_ACCESSOR(JSListFormat)
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/js-list-format.cc b/deps/v8/src/objects/js-list-format.cc
index 978f0ea38ff..047c03b8422 100644
--- a/deps/v8/src/objects/js-list-format.cc
+++ b/deps/v8/src/objects/js-list-format.cc
@@ -331,8 +331,7 @@ struct CheckListPattern {
 }  // namespace
 
 const std::set<std::string>& JSListFormat::GetAvailableLocales() {
-  static base::LazyInstance<
-      Intl::AvailableLocales<icu::Locale, CheckListPattern>>::type
+  static base::LazyInstance<Intl::AvailableLocales<CheckListPattern>>::type
       available_locales = LAZY_INSTANCE_INITIALIZER;
   return available_locales.Pointer()->Get();
 }
diff --git a/deps/v8/src/objects/js-list-format.h b/deps/v8/src/objects/js-list-format.h
index 0040bccb97d..1f94c957f84 100644
--- a/deps/v8/src/objects/js-list-format.h
+++ b/deps/v8/src/objects/js-list-format.h
@@ -29,7 +29,8 @@ class ListFormatter;
 namespace v8 {
 namespace internal {
 
-class JSListFormat : public JSObject {
+class JSListFormat
+    : public TorqueGeneratedJSListFormat<JSListFormat, JSObject> {
  public:
   // Creates relative time format object with properties derived from input
   // locales and options.
@@ -55,10 +56,7 @@ class JSListFormat : public JSObject {
   Handle<String> StyleAsString() const;
   Handle<String> TypeAsString() const;
 
-  DECL_CAST(JSListFormat)
-
   // ListFormat accessors.
-  DECL_ACCESSORS(locale, String)
   DECL_ACCESSORS(icu_formatter, Managed<icu::ListFormatter>)
 
   // Style: identifying the relative time format style used.
@@ -93,17 +91,9 @@ class JSListFormat : public JSObject {
   STATIC_ASSERT(Type::DISJUNCTION <= TypeBits::kMax);
   STATIC_ASSERT(Type::UNIT <= TypeBits::kMax);
 
-  // [flags] Bit field containing various flags about the function.
-  DECL_INT_ACCESSORS(flags)
-
   DECL_PRINTER(JSListFormat)
-  DECL_VERIFIER(JSListFormat)
-
-  // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
-                                TORQUE_GENERATED_JS_LIST_FORMAT_FIELDS)
 
-  OBJECT_CONSTRUCTORS(JSListFormat, JSObject);
+  TQ_OBJECT_CONSTRUCTORS(JSListFormat)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/js-locale-inl.h b/deps/v8/src/objects/js-locale-inl.h
index 17859ea6ab4..cbd62b9a93b 100644
--- a/deps/v8/src/objects/js-locale-inl.h
+++ b/deps/v8/src/objects/js-locale-inl.h
@@ -19,12 +19,10 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(JSLocale, JSObject)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSLocale)
 
 ACCESSORS(JSLocale, icu_locale, Managed<icu::Locale>, kIcuLocaleOffset)
 
-CAST_ACCESSOR(JSLocale)
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/js-locale.cc b/deps/v8/src/objects/js-locale.cc
index 6bbb86a0b19..53738049d9c 100644
--- a/deps/v8/src/objects/js-locale.cc
+++ b/deps/v8/src/objects/js-locale.cc
@@ -365,38 +365,47 @@ MaybeHandle<JSLocale> JSLocale::New(Isolate* isolate, Handle<Map> map,
 }
 
 namespace {
-Handle<String> MorphLocale(Isolate* isolate, String locale,
-                           void (*morph_func)(icu::Locale*, UErrorCode*)) {
-  UErrorCode status = U_ZERO_ERROR;
-  icu::Locale icu_locale =
-      icu::Locale::forLanguageTag(locale.ToCString().get(), status);
-  // TODO(ftang): Remove the following lines after ICU-8420 fixed.
-  // Due to ICU-8420 "und" is turn into "" by forLanguageTag,
-  // we have to work around to use icu::Locale("und") directly
-  if (icu_locale.getName()[0] == '\0') icu_locale = icu::Locale("und");
-  CHECK(U_SUCCESS(status));
-  CHECK(!icu_locale.isBogus());
-  (*morph_func)(&icu_locale, &status);
-  CHECK(U_SUCCESS(status));
-  CHECK(!icu_locale.isBogus());
-  std::string locale_str = Intl::ToLanguageTag(icu_locale).FromJust();
-  return isolate->factory()->NewStringFromAsciiChecked(locale_str.c_str());
+
+MaybeHandle<JSLocale> Construct(Isolate* isolate,
+                                const icu::Locale& icu_locale) {
+  Handle<Managed<icu::Locale>> managed_locale =
+      Managed<icu::Locale>::FromRawPtr(isolate, 0, icu_locale.clone());
+
+  Handle<JSFunction> constructor(
+      isolate->native_context()->intl_locale_function(), isolate);
+
+  Handle<Map> map;
+  ASSIGN_RETURN_ON_EXCEPTION(
+      isolate, map,
+      JSFunction::GetDerivedMap(isolate, constructor, constructor), JSLocale);
+
+  Handle<JSLocale> locale = Handle<JSLocale>::cast(
+      isolate->factory()->NewFastOrSlowJSObjectFromMap(map));
+  DisallowHeapAllocation no_gc;
+  locale->set_icu_locale(*managed_locale);
+  return locale;
 }
 
 }  // namespace
 
-Handle<String> JSLocale::Maximize(Isolate* isolate, String locale) {
-  return MorphLocale(isolate, locale,
-                     [](icu::Locale* icu_locale, UErrorCode* status) {
-                       icu_locale->addLikelySubtags(*status);
-                     });
+MaybeHandle<JSLocale> JSLocale::Maximize(Isolate* isolate,
+                                         Handle<JSLocale> locale) {
+  icu::Locale icu_locale(*(locale->icu_locale().raw()));
+  UErrorCode status = U_ZERO_ERROR;
+  icu_locale.addLikelySubtags(status);
+  DCHECK(U_SUCCESS(status));
+  DCHECK(!icu_locale.isBogus());
+  return Construct(isolate, icu_locale);
 }
 
-Handle<String> JSLocale::Minimize(Isolate* isolate, String locale) {
-  return MorphLocale(isolate, locale,
-                     [](icu::Locale* icu_locale, UErrorCode* status) {
-                       icu_locale->minimizeSubtags(*status);
-                     });
+MaybeHandle<JSLocale> JSLocale::Minimize(Isolate* isolate,
+                                         Handle<JSLocale> locale) {
+  icu::Locale icu_locale(*(locale->icu_locale().raw()));
+  UErrorCode status = U_ZERO_ERROR;
+  icu_locale.minimizeSubtags(status);
+  DCHECK(U_SUCCESS(status));
+  DCHECK(!icu_locale.isBogus());
+  return Construct(isolate, icu_locale);
 }
 
 Handle<Object> JSLocale::Language(Isolate* isolate, Handle<JSLocale> locale) {
diff --git a/deps/v8/src/objects/js-locale.h b/deps/v8/src/objects/js-locale.h
index 4e73b0499ff..7904505d291 100644
--- a/deps/v8/src/objects/js-locale.h
+++ b/deps/v8/src/objects/js-locale.h
@@ -25,15 +25,18 @@ class Locale;
 namespace v8 {
 namespace internal {
 
-class JSLocale : public JSObject {
+class JSLocale : public TorqueGeneratedJSLocale<JSLocale, JSObject> {
  public:
   // Creates locale object with properties derived from input locale string
   // and options.
   static MaybeHandle<JSLocale> New(Isolate* isolate, Handle<Map> map,
                                    Handle<String> locale,
                                    Handle<JSReceiver> options);
-  static Handle<String> Maximize(Isolate* isolate, String locale);
-  static Handle<String> Minimize(Isolate* isolate, String locale);
+
+  static MaybeHandle<JSLocale> Maximize(Isolate* isolate,
+                                        Handle<JSLocale> locale);
+  static MaybeHandle<JSLocale> Minimize(Isolate* isolate,
+                                        Handle<JSLocale> locale);
 
   static Handle<Object> Language(Isolate* isolate, Handle<JSLocale> locale);
   static Handle<Object> Script(Isolate* isolate, Handle<JSLocale> locale);
@@ -59,18 +62,11 @@ class JSLocale : public JSObject {
   // Help function to check well-formed "3alpha"
   static bool Is3Alpha(const std::string& value);
 
-  DECL_CAST(JSLocale)
-
   DECL_ACCESSORS(icu_locale, Managed<icu::Locale>)
 
   DECL_PRINTER(JSLocale)
-  DECL_VERIFIER(JSLocale)
-
-  // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
-                                TORQUE_GENERATED_JS_LOCALE_FIELDS)
 
-  OBJECT_CONSTRUCTORS(JSLocale, JSObject);
+  TQ_OBJECT_CONSTRUCTORS(JSLocale)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/js-number-format-inl.h b/deps/v8/src/objects/js-number-format-inl.h
index 9cd16c35ed6..035eaf57a34 100644
--- a/deps/v8/src/objects/js-number-format-inl.h
+++ b/deps/v8/src/objects/js-number-format-inl.h
@@ -18,15 +18,11 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(JSNumberFormat, JSObject)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSNumberFormat)
 
-ACCESSORS(JSNumberFormat, locale, String, kLocaleOffset)
 ACCESSORS(JSNumberFormat, icu_number_formatter,
           Managed<icu::number::LocalizedNumberFormatter>,
           kIcuNumberFormatterOffset)
-ACCESSORS(JSNumberFormat, bound_format, Object, kBoundFormatOffset)
-
-CAST_ACCESSOR(JSNumberFormat)
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/js-number-format.cc b/deps/v8/src/objects/js-number-format.cc
index 2d7fd771139..c5b3d06fcaf 100644
--- a/deps/v8/src/objects/js-number-format.cc
+++ b/deps/v8/src/objects/js-number-format.cc
@@ -18,7 +18,6 @@
 #include "unicode/currunit.h"
 #include "unicode/decimfmt.h"
 #include "unicode/locid.h"
-#include "unicode/nounit.h"
 #include "unicode/numberformatter.h"
 #include "unicode/numfmt.h"
 #include "unicode/numsys.h"
@@ -218,7 +217,7 @@ class UnitFactory {
       return found->second;
     }
     // 2. Return false.
-    return icu::NoUnit::base();
+    return icu::MeasureUnit();
   }
 
  private:
@@ -236,7 +235,7 @@ icu::MeasureUnit IsSanctionedUnitIdentifier(const std::string& unit) {
 Maybe<std::pair<icu::MeasureUnit, icu::MeasureUnit>> IsWellFormedUnitIdentifier(
     Isolate* isolate, const std::string& unit) {
   icu::MeasureUnit result = IsSanctionedUnitIdentifier(unit);
-  icu::MeasureUnit none = icu::NoUnit::base();
+  icu::MeasureUnit none = icu::MeasureUnit();
   // 1. If the result of IsSanctionedUnitIdentifier(unitIdentifier) is true,
   // then
   if (result != none) {
@@ -633,11 +632,12 @@ Style StyleFromSkeleton(const icu::UnicodeString& skeleton) {
     return Style::CURRENCY;
   }
   if (skeleton.indexOf("measure-unit/") >= 0) {
+    if (skeleton.indexOf("scale/100") >= 0 &&
+        skeleton.indexOf("measure-unit/concentr-percent") >= 0) {
+      return Style::PERCENT;
+    }
     return Style::UNIT;
   }
-  if (skeleton.indexOf("percent ") >= 0) {
-    return Style::PERCENT;
-  }
   return Style::DECIMAL;
 }
 
@@ -874,17 +874,15 @@ MaybeHandle<JSNumberFormat> JSNumberFormat::New(Isolate* isolate,
   Intl::MatcherOption matcher = maybe_locale_matcher.FromJust();
 
   std::unique_ptr<char[]> numbering_system_str = nullptr;
-  if (FLAG_harmony_intl_add_calendar_numbering_system) {
-    // 7. Let _numberingSystem_ be ? GetOption(_options_, `"numberingSystem"`,
-    //    `"string"`, *undefined*, *undefined*).
-    Maybe<bool> maybe_numberingSystem = Intl::GetNumberingSystem(
-        isolate, options, service, &numbering_system_str);
-    // 8. If _numberingSystem_ is not *undefined*, then
-    // a. If _numberingSystem_ does not match the
-    //    `(3*8alphanum) *("-" (3*8alphanum))` sequence, throw a *RangeError*
-    //     exception.
-    MAYBE_RETURN(maybe_numberingSystem, MaybeHandle<JSNumberFormat>());
-  }
+  // 7. Let _numberingSystem_ be ? GetOption(_options_, `"numberingSystem"`,
+  //    `"string"`, *undefined*, *undefined*).
+  Maybe<bool> maybe_numberingSystem = Intl::GetNumberingSystem(
+      isolate, options, service, &numbering_system_str);
+  // 8. If _numberingSystem_ is not *undefined*, then
+  // a. If _numberingSystem_ does not match the
+  //    `(3*8alphanum) *("-" (3*8alphanum))` sequence, throw a *RangeError*
+  //     exception.
+  MAYBE_RETURN(maybe_numberingSystem, MaybeHandle<JSNumberFormat>());
 
   // 7. Let localeData be %NumberFormat%.[[LocaleData]].
   // 8. Let r be ResolveLocale(%NumberFormat%.[[AvailableLocales]],
@@ -1088,11 +1086,12 @@ MaybeHandle<JSNumberFormat> JSNumberFormat::New(Isolate* isolate,
     std::pair<icu::MeasureUnit, icu::MeasureUnit> unit_pair =
         maybe_wellformed_unit.FromJust();
 
+    icu::MeasureUnit none = icu::MeasureUnit();
     // 13.b Set intlObj.[[Unit]] to unit.
-    if (unit_pair.first != icu::NoUnit::base()) {
+    if (unit_pair.first != none) {
       icu_number_formatter = icu_number_formatter.unit(unit_pair.first);
     }
-    if (unit_pair.second != icu::NoUnit::base()) {
+    if (unit_pair.second != none) {
       icu_number_formatter = icu_number_formatter.perUnit(unit_pair.second);
     }
 
@@ -1105,8 +1104,9 @@ MaybeHandle<JSNumberFormat> JSNumberFormat::New(Isolate* isolate,
   }
 
   if (style == Style::PERCENT) {
-    icu_number_formatter = icu_number_formatter.unit(icu::NoUnit::percent())
-                               .scale(icu::number::Scale::powerOfTen(2));
+    icu_number_formatter =
+        icu_number_formatter.unit(icu::MeasureUnit::getPercent())
+            .scale(icu::number::Scale::powerOfTen(2));
   }
 
   // 23. If style is "currency", then
@@ -1495,8 +1495,7 @@ struct CheckNumberElements {
 }  // namespace
 
 const std::set<std::string>& JSNumberFormat::GetAvailableLocales() {
-  static base::LazyInstance<
-      Intl::AvailableLocales<icu::NumberFormat, CheckNumberElements>>::type
+  static base::LazyInstance<Intl::AvailableLocales<CheckNumberElements>>::type
       available_locales = LAZY_INSTANCE_INITIALIZER;
   return available_locales.Pointer()->Get();
 }
diff --git a/deps/v8/src/objects/js-number-format.h b/deps/v8/src/objects/js-number-format.h
index 471398eafac..d41cca0548c 100644
--- a/deps/v8/src/objects/js-number-format.h
+++ b/deps/v8/src/objects/js-number-format.h
@@ -32,7 +32,8 @@ class LocalizedNumberFormatter;
 namespace v8 {
 namespace internal {
 
-class JSNumberFormat : public JSObject {
+class JSNumberFormat
+    : public TorqueGeneratedJSNumberFormat<JSNumberFormat, JSObject> {
  public:
   // ecma402/#sec-initializenumberformat
   V8_WARN_UNUSED_RESULT static MaybeHandle<JSNumberFormat> New(
@@ -69,21 +70,12 @@ class JSNumberFormat : public JSObject {
       const icu::number::LocalizedNumberFormatter& icu_number_formatter,
       const Intl::NumberFormatDigitOptions& digit_options);
 
-  DECL_CAST(JSNumberFormat)
   DECL_PRINTER(JSNumberFormat)
-  DECL_VERIFIER(JSNumberFormat)
 
-  // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
-                                TORQUE_GENERATED_JS_NUMBER_FORMAT_FIELDS)
-
-  DECL_ACCESSORS(locale, String)
   DECL_ACCESSORS(icu_number_formatter,
                  Managed<icu::number::LocalizedNumberFormatter>)
-  DECL_ACCESSORS(bound_format, Object)
-  DECL_INT_ACCESSORS(flags)
 
-  OBJECT_CONSTRUCTORS(JSNumberFormat, JSObject);
+  TQ_OBJECT_CONSTRUCTORS(JSNumberFormat)
 };
 
 struct NumberFormatSpan {
diff --git a/deps/v8/src/objects/js-objects-inl.h b/deps/v8/src/objects/js-objects-inl.h
index dd5ac099040..192d0ed61d1 100644
--- a/deps/v8/src/objects/js-objects-inl.h
+++ b/deps/v8/src/objects/js-objects-inl.h
@@ -5,8 +5,6 @@
 #ifndef V8_OBJECTS_JS_OBJECTS_INL_H_
 #define V8_OBJECTS_JS_OBJECTS_INL_H_
 
-#include "src/objects/js-objects.h"
-
 #include "src/diagnostics/code-tracer.h"
 #include "src/heap/heap-write-barrier.h"
 #include "src/objects/elements.h"
@@ -16,6 +14,7 @@
 #include "src/objects/field-index-inl.h"
 #include "src/objects/hash-table-inl.h"
 #include "src/objects/heap-number-inl.h"
+#include "src/objects/js-objects.h"
 #include "src/objects/keys.h"
 #include "src/objects/lookup-inl.h"
 #include "src/objects/property-array-inl.h"
@@ -775,9 +774,8 @@ DEF_GETTER(JSObject, GetElementsKind, ElementsKind) {
       DCHECK(kind > DICTIONARY_ELEMENTS ||
              IsAnyNonextensibleElementsKind(kind));
     }
-    DCHECK(
-        !IsSloppyArgumentsElementsKind(kind) ||
-        (elements(isolate).IsFixedArray() && elements(isolate).length() >= 2));
+    DCHECK(!IsSloppyArgumentsElementsKind(kind) ||
+           elements(isolate).IsSloppyArgumentsElements());
   }
 #endif
   return kind;
@@ -816,7 +814,7 @@ DEF_GETTER(JSObject, HasFastPackedElements, bool) {
 }
 
 DEF_GETTER(JSObject, HasDictionaryElements, bool) {
-  return GetElementsKind(isolate) == DICTIONARY_ELEMENTS;
+  return IsDictionaryElementsKind(GetElementsKind(isolate));
 }
 
 DEF_GETTER(JSObject, HasPackedElements, bool) {
@@ -836,11 +834,11 @@ DEF_GETTER(JSObject, HasNonextensibleElements, bool) {
 }
 
 DEF_GETTER(JSObject, HasFastArgumentsElements, bool) {
-  return GetElementsKind(isolate) == FAST_SLOPPY_ARGUMENTS_ELEMENTS;
+  return IsFastArgumentsElementsKind(GetElementsKind(isolate));
 }
 
 DEF_GETTER(JSObject, HasSlowArgumentsElements, bool) {
-  return GetElementsKind(isolate) == SLOW_SLOPPY_ARGUMENTS_ELEMENTS;
+  return IsSlowArgumentsElementsKind(GetElementsKind(isolate));
 }
 
 DEF_GETTER(JSObject, HasSloppyArgumentsElements, bool) {
diff --git a/deps/v8/src/objects/js-objects.cc b/deps/v8/src/objects/js-objects.cc
index 13741c4f621..e5ac753512a 100644
--- a/deps/v8/src/objects/js-objects.cc
+++ b/deps/v8/src/objects/js-objects.cc
@@ -14,6 +14,7 @@
 #include "src/handles/maybe-handles.h"
 #include "src/heap/factory-inl.h"
 #include "src/heap/heap-inl.h"
+#include "src/heap/memory-chunk.h"
 #include "src/ic/ic.h"
 #include "src/init/bootstrapper.h"
 #include "src/logging/counters.h"
@@ -70,6 +71,8 @@
 #include "src/strings/string-stream.h"
 #include "src/utils/ostreams.h"
 #include "src/wasm/wasm-objects.h"
+#include "torque-generated/exported-class-definitions-tq-inl.h"
+#include "torque-generated/exported-class-definitions-tq.h"
 
 namespace v8 {
 namespace internal {
@@ -404,19 +407,6 @@ String JSReceiver::class_name() {
   if (IsJSWeakSet()) return roots.WeakSet_string();
   if (IsJSGlobalProxy()) return roots.global_string();
 
-  Object maybe_constructor = map().GetConstructor();
-  if (maybe_constructor.IsJSFunction()) {
-    JSFunction constructor = JSFunction::cast(maybe_constructor);
-    if (constructor.shared().IsApiFunction()) {
-      maybe_constructor = constructor.shared().get_api_func_data();
-    }
-  }
-
-  if (maybe_constructor.IsFunctionTemplateInfo()) {
-    FunctionTemplateInfo info = FunctionTemplateInfo::cast(maybe_constructor);
-    if (info.class_name().IsString()) return String::cast(info.class_name());
-  }
-
   return roots.Object_string();
 }
 
@@ -440,12 +430,6 @@ std::pair<MaybeHandle<JSFunction>, Handle<String>> GetConstructorHelper(
         return std::make_pair(handle(constructor, isolate),
                               handle(name, isolate));
       }
-    } else if (maybe_constructor.IsFunctionTemplateInfo()) {
-      FunctionTemplateInfo info = FunctionTemplateInfo::cast(maybe_constructor);
-      if (info.class_name().IsString()) {
-        return std::make_pair(MaybeHandle<JSFunction>(),
-                              handle(String::cast(info.class_name()), isolate));
-      }
     }
   }
 
@@ -2140,8 +2124,6 @@ int JSObject::GetHeaderSize(InstanceType type,
       return JSWeakRef::kHeaderSize;
     case JS_FINALIZATION_REGISTRY_TYPE:
       return JSFinalizationRegistry::kHeaderSize;
-    case JS_FINALIZATION_REGISTRY_CLEANUP_ITERATOR_TYPE:
-      return JSFinalizationRegistryCleanupIterator::kHeaderSize;
     case JS_WEAK_MAP_TYPE:
       return JSWeakMap::kHeaderSize;
     case JS_WEAK_SET_TYPE:
@@ -4509,14 +4491,13 @@ Maybe<bool> JSObject::SetPrototype(Handle<JSObject> object,
         NewTypeError(MessageTemplate::kImmutablePrototypeSet, object));
   }
 
-  // From 8.6.2 Object Internal Methods
-  // ...
-  // In addition, if [[Extensible]] is false the value of the [[Class]] and
-  // [[Prototype]] internal properties of the object may not be modified.
-  // ...
-  // Implementation specific extensions that modify [[Class]], [[Prototype]]
-  // or [[Extensible]] must not violate the invariants defined in the preceding
-  // paragraph.
+  // From 6.1.7.3 Invariants of the Essential Internal Methods
+  //
+  // [[SetPrototypeOf]] ( V )
+  // * ...
+  // * If target is non-extensible, [[SetPrototypeOf]] must return false,
+  //   unless V is the SameValue as the target's observed [[GetPrototypeOf]]
+  //   value.
   if (!all_extensible) {
     RETURN_FAILURE(isolate, should_throw,
                    NewTypeError(MessageTemplate::kNonExtensibleProto, object));
@@ -4552,7 +4533,6 @@ Maybe<bool> JSObject::SetPrototype(Handle<JSObject> object,
 
 // static
 void JSObject::SetImmutableProto(Handle<JSObject> object) {
-  DCHECK(!object->IsAccessCheckNeeded());  // Never called from JS
   Handle<Map> map(object->map(), object->GetIsolate());
 
   // Nothing to do if prototype is already set.
@@ -5741,18 +5721,24 @@ double JSDate::CurrentTimeValue(Isolate* isolate) {
 }
 
 // static
-Address JSDate::GetField(Address raw_object, Address smi_index) {
+Address JSDate::GetField(Isolate* isolate, Address raw_object,
+                         Address smi_index) {
+  // Called through CallCFunction.
+  DisallowHeapAllocation no_gc;
+  DisallowHandleAllocation no_handles;
+  DisallowJavascriptExecution no_js(isolate);
+
   Object object(raw_object);
   Smi index(smi_index);
   return JSDate::cast(object)
-      .DoGetField(static_cast<FieldIndex>(index.value()))
+      .DoGetField(isolate, static_cast<FieldIndex>(index.value()))
       .ptr();
 }
 
-Object JSDate::DoGetField(FieldIndex index) {
+Object JSDate::DoGetField(Isolate* isolate, FieldIndex index) {
   DCHECK_NE(index, kDateValue);
 
-  DateCache* date_cache = GetIsolate()->date_cache();
+  DateCache* date_cache = isolate->date_cache();
 
   if (index < kFirstUncachedField) {
     Object stamp = cache_stamp();
@@ -5809,7 +5795,6 @@ Object JSDate::GetUTCField(FieldIndex index, double value,
   int64_t time_ms = static_cast<int64_t>(value);
 
   if (index == kTimezoneOffset) {
-    GetIsolate()->CountUsage(v8::Isolate::kDateGetTimezoneOffset);
     return Smi::FromInt(date_cache->TimezoneOffset(time_ms));
   }
 
diff --git a/deps/v8/src/objects/js-objects.h b/deps/v8/src/objects/js-objects.h
index 418c12ac506..9bfeba372a5 100644
--- a/deps/v8/src/objects/js-objects.h
+++ b/deps/v8/src/objects/js-objects.h
@@ -206,15 +206,17 @@ class JSReceiver : public HeapObject {
   V8_WARN_UNUSED_RESULT static Maybe<bool> IsExtensible(
       Handle<JSReceiver> object);
 
-  // Returns the class name ([[Class]] property in the specification).
+  // Returns the class name.
   V8_EXPORT_PRIVATE String class_name();
 
   // Returns the constructor (the function that was used to instantiate the
   // object).
   static MaybeHandle<JSFunction> GetConstructor(Handle<JSReceiver> receiver);
 
-  // Returns the constructor name (the name (possibly, inferred name) of the
-  // function that was used to instantiate the object).
+  // Returns the constructor name (the (possibly inferred) name of the function
+  // that was used to instantiate the object), if any. If a FunctionTemplate is
+  // used to instantiate the object, the class_name of the FunctionTemplate is
+  // returned instead.
   static Handle<String> GetConstructorName(Handle<JSReceiver> receiver);
 
   V8_EXPORT_PRIVATE Handle<NativeContext> GetCreationContext();
@@ -971,6 +973,8 @@ class JSFunction : public JSFunctionOrBoundFunction {
   static const int kNameDescriptorIndex = 1;
   // Home object descriptor index when function has a [[HomeObject]] slot.
   static const int kMaybeHomeObjectDescriptorIndex = 2;
+  // Fast binding requires length and name accessors.
+  static const int kMinDescriptorsForFastBind = 2;
 
   // [context]: The context for this function.
   inline Context context();
@@ -1278,7 +1282,8 @@ class JSDate : public TorqueGeneratedJSDate<JSDate, JSObject> {
   // {raw_date} is a tagged Object pointer.
   // {smi_index} is a tagged Smi.
   // The return value is a tagged Object pointer.
-  static Address GetField(Address raw_date, Address smi_index);
+  static Address GetField(Isolate* isolate, Address raw_date,
+                          Address smi_index);
 
   static Handle<Object> SetValue(Handle<JSDate> date, double v);
 
@@ -1318,8 +1323,7 @@ class JSDate : public TorqueGeneratedJSDate<JSDate, JSObject> {
   };
 
  private:
-  inline Object DoGetField(FieldIndex index);
-
+  Object DoGetField(Isolate* isolate, FieldIndex index);
   Object GetUTCField(FieldIndex index, double value, DateCache* date_cache);
 
   // Computes and caches the cacheable fields of the date.
diff --git a/deps/v8/src/objects/js-objects.tq b/deps/v8/src/objects/js-objects.tq
index 823fef1e940..1139deeb3d8 100644
--- a/deps/v8/src/objects/js-objects.tq
+++ b/deps/v8/src/objects/js-objects.tq
@@ -79,8 +79,7 @@ macro GetDerivedMap(implicit context: Context)(
     }
 
     return map;
-  }
-  label SlowPath {
+  } label SlowPath {
     return runtime::GetDerivedMap(context, target, newTarget);
   }
 }
diff --git a/deps/v8/src/objects/js-plural-rules-inl.h b/deps/v8/src/objects/js-plural-rules-inl.h
index 40aae56b206..60340931fe3 100644
--- a/deps/v8/src/objects/js-plural-rules-inl.h
+++ b/deps/v8/src/objects/js-plural-rules-inl.h
@@ -19,10 +19,8 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(JSPluralRules, JSObject)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSPluralRules)
 
-ACCESSORS(JSPluralRules, locale, String, kLocaleOffset)
-SMI_ACCESSORS(JSPluralRules, flags, kFlagsOffset)
 ACCESSORS(JSPluralRules, icu_plural_rules, Managed<icu::PluralRules>,
           kIcuPluralRulesOffset)
 ACCESSORS(JSPluralRules, icu_number_formatter,
@@ -40,8 +38,6 @@ inline JSPluralRules::Type JSPluralRules::type() const {
   return TypeBit::decode(flags());
 }
 
-CAST_ACCESSOR(JSPluralRules)
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/js-plural-rules.cc b/deps/v8/src/objects/js-plural-rules.cc
index ffbd53034ed..2e12ca0375b 100644
--- a/deps/v8/src/objects/js-plural-rules.cc
+++ b/deps/v8/src/objects/js-plural-rules.cc
@@ -325,7 +325,6 @@ const std::set<std::string>& JSPluralRules::GetAvailableLocales() {
   static base::LazyInstance<PluralRulesAvailableLocales>::type
       available_locales = LAZY_INSTANCE_INITIALIZER;
   return available_locales.Pointer()->Get();
-  // return Intl::GetAvailableLocalesForLocale();
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/js-plural-rules.h b/deps/v8/src/objects/js-plural-rules.h
index c5df77b57be..4a43b582d76 100644
--- a/deps/v8/src/objects/js-plural-rules.h
+++ b/deps/v8/src/objects/js-plural-rules.h
@@ -32,7 +32,8 @@ class LocalizedNumberFormatter;
 namespace v8 {
 namespace internal {
 
-class JSPluralRules : public JSObject {
+class JSPluralRules
+    : public TorqueGeneratedJSPluralRules<JSPluralRules, JSObject> {
  public:
   V8_WARN_UNUSED_RESULT static MaybeHandle<JSPluralRules> New(
       Isolate* isolate, Handle<Map> map, Handle<Object> locales,
@@ -54,9 +55,7 @@ class JSPluralRules : public JSObject {
 
   Handle<String> TypeAsString() const;
 
-  DECL_CAST(JSPluralRules)
   DECL_PRINTER(JSPluralRules)
-  DECL_VERIFIER(JSPluralRules)
 
   // Bit positions in |flags|.
   DEFINE_TORQUE_GENERATED_JS_PLURAL_RULES_FLAGS()
@@ -64,17 +63,11 @@ class JSPluralRules : public JSObject {
   STATIC_ASSERT(Type::CARDINAL <= TypeBit::kMax);
   STATIC_ASSERT(Type::ORDINAL <= TypeBit::kMax);
 
-  // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
-                                TORQUE_GENERATED_JS_PLURAL_RULES_FIELDS)
-
-  DECL_ACCESSORS(locale, String)
-  DECL_INT_ACCESSORS(flags)
   DECL_ACCESSORS(icu_plural_rules, Managed<icu::PluralRules>)
   DECL_ACCESSORS(icu_number_formatter,
                  Managed<icu::number::LocalizedNumberFormatter>)
 
-  OBJECT_CONSTRUCTORS(JSPluralRules, JSObject);
+  TQ_OBJECT_CONSTRUCTORS(JSPluralRules)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/js-promise-inl.h b/deps/v8/src/objects/js-promise-inl.h
index cffd10b9f15..601de6612bc 100644
--- a/deps/v8/src/objects/js-promise-inl.h
+++ b/deps/v8/src/objects/js-promise-inl.h
@@ -18,8 +18,8 @@ namespace internal {
 
 TQ_OBJECT_CONSTRUCTORS_IMPL(JSPromise)
 
-BOOL_ACCESSORS(JSPromise, flags, has_handler, kHasHandlerBit)
-BOOL_ACCESSORS(JSPromise, flags, handled_hint, kHandledHintBit)
+BOOL_ACCESSORS(JSPromise, flags, has_handler, HasHandlerBit::kShift)
+BOOL_ACCESSORS(JSPromise, flags, handled_hint, HandledHintBit::kShift)
 
 Object JSPromise::result() const {
   DCHECK_NE(Promise::kPending, status());
diff --git a/deps/v8/src/objects/js-promise.h b/deps/v8/src/objects/js-promise.h
index efb13dc015a..cd54f9349eb 100644
--- a/deps/v8/src/objects/js-promise.h
+++ b/deps/v8/src/objects/js-promise.h
@@ -7,6 +7,7 @@
 
 #include "src/objects/js-objects.h"
 #include "src/objects/promise.h"
+#include "torque-generated/bit-fields-tq.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -64,15 +65,8 @@ class JSPromise : public TorqueGeneratedJSPromise<JSPromise, JSObject> {
       kHeaderSize + v8::Promise::kEmbedderFieldCount * kEmbedderDataSlotSize;
 
   // Flags layout.
-  // The first two bits store the v8::Promise::PromiseState.
-  static const int kStatusBits = 2;
-  static const int kHasHandlerBit = 2;
-  static const int kHandledHintBit = 3;
-  using AsyncTaskIdField = base::BitField<int, kHandledHintBit + 1, 22>;
-
-  static const int kStatusShift = 0;
-  static const int kStatusMask = 0x3;
-  static const int kHasHandlerMask = 0x4;
+  DEFINE_TORQUE_GENERATED_JS_PROMISE_FLAGS()
+
   STATIC_ASSERT(v8::Promise::kPending == 0);
   STATIC_ASSERT(v8::Promise::kFulfilled == 1);
   STATIC_ASSERT(v8::Promise::kRejected == 2);
diff --git a/deps/v8/src/objects/js-promise.tq b/deps/v8/src/objects/js-promise.tq
index 515dedcb9b0..ae1c2bcc9d2 100644
--- a/deps/v8/src/objects/js-promise.tq
+++ b/deps/v8/src/objects/js-promise.tq
@@ -2,40 +2,36 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// JSPromise constants
-const kJSPromiseStatusMask: constexpr int31
-    generates 'JSPromise::kStatusMask';
-const kJSPromiseStatusShift: constexpr int31
-    generates 'JSPromise::kStatusShift';
-const kJSPromiseHasHandlerMask: constexpr int31
-    generates 'JSPromise::kHasHandlerMask';
+bitfield struct JSPromiseFlags extends uint31 {
+  status: PromiseState: 2 bit;
+  has_handler: bool: 1 bit;
+  handled_hint: bool: 1 bit;
+  async_task_id: int32: 22 bit;
+}
 
 @generateCppClass
 extern class JSPromise extends JSObject {
   macro Status(): PromiseState {
-    StaticAssert(kJSPromiseStatusShift == 0);
-    const status: int32 = Convert<int32>(this.flags) & kJSPromiseStatusMask;
-    return Convert<PromiseState>(status);
+    return this.flags.status;
   }
 
   macro SetStatus(status: constexpr PromiseState): void {
     assert(this.Status() == PromiseState::kPending);
     assert(status != PromiseState::kPending);
 
-    const mask: Smi = SmiConstant(status);
-    this.flags = this.flags | mask;
+    this.flags.status = status;
   }
 
   macro HasHandler(): bool {
-    return (this.flags & kJSPromiseHasHandlerMask) != 0;
+    return this.flags.has_handler;
   }
 
   macro SetHasHandler(): void {
-    this.flags |= kJSPromiseHasHandlerMask;
+    this.flags.has_handler = true;
   }
 
   // Smi 0 terminated list of PromiseReaction objects in case the JSPromise was
   // not settled yet, otherwise the result.
   reactions_or_result: Zero|PromiseReaction|JSAny;
-  flags: Smi;
+  flags: SmiTagged<JSPromiseFlags>;
 }
diff --git a/deps/v8/src/objects/js-regexp-inl.h b/deps/v8/src/objects/js-regexp-inl.h
index a6f59468fd2..37f39dfb4fd 100644
--- a/deps/v8/src/objects/js-regexp-inl.h
+++ b/deps/v8/src/objects/js-regexp-inl.h
@@ -34,7 +34,7 @@ JSRegExp::Type JSRegExp::TypeTag() const {
   return static_cast<JSRegExp::Type>(smi.value());
 }
 
-int JSRegExp::CaptureCount() {
+int JSRegExp::CaptureCount() const {
   switch (TypeTag()) {
     case ATOM:
       return 0;
@@ -45,6 +45,11 @@ int JSRegExp::CaptureCount() {
   }
 }
 
+int JSRegExp::MaxRegisterCount() const {
+  CHECK_EQ(TypeTag(), IRREGEXP);
+  return Smi::ToInt(DataAt(kIrregexpMaxRegisterCountIndex));
+}
+
 JSRegExp::Flags JSRegExp::GetFlags() {
   DCHECK(this->data().IsFixedArray());
   Object data = this->data();
diff --git a/deps/v8/src/objects/js-regexp-string-iterator-inl.h b/deps/v8/src/objects/js-regexp-string-iterator-inl.h
index ea44aaae271..b0d8e4c5ecf 100644
--- a/deps/v8/src/objects/js-regexp-string-iterator-inl.h
+++ b/deps/v8/src/objects/js-regexp-string-iterator-inl.h
@@ -17,9 +17,9 @@ namespace internal {
 
 TQ_OBJECT_CONSTRUCTORS_IMPL(JSRegExpStringIterator)
 
-BOOL_ACCESSORS(JSRegExpStringIterator, flags, done, kDoneBit)
-BOOL_ACCESSORS(JSRegExpStringIterator, flags, global, kGlobalBit)
-BOOL_ACCESSORS(JSRegExpStringIterator, flags, unicode, kUnicodeBit)
+BOOL_ACCESSORS(JSRegExpStringIterator, flags, done, DoneBit::kShift)
+BOOL_ACCESSORS(JSRegExpStringIterator, flags, global, GlobalBit::kShift)
+BOOL_ACCESSORS(JSRegExpStringIterator, flags, unicode, UnicodeBit::kShift)
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/js-regexp-string-iterator.h b/deps/v8/src/objects/js-regexp-string-iterator.h
index e54aedbc2b5..1fdd5030725 100644
--- a/deps/v8/src/objects/js-regexp-string-iterator.h
+++ b/deps/v8/src/objects/js-regexp-string-iterator.h
@@ -6,6 +6,7 @@
 #define V8_OBJECTS_JS_REGEXP_STRING_ITERATOR_H_
 
 #include "src/objects/js-objects.h"
+#include "torque-generated/bit-fields-tq.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -28,9 +29,7 @@ class JSRegExpStringIterator
 
   DECL_PRINTER(JSRegExpStringIterator)
 
-  static const int kDoneBit = 0;
-  static const int kGlobalBit = 1;
-  static const int kUnicodeBit = 2;
+  DEFINE_TORQUE_GENERATED_JS_REG_EXP_STRING_ITERATOR_FLAGS()
 
   TQ_OBJECT_CONSTRUCTORS(JSRegExpStringIterator)
 };
diff --git a/deps/v8/src/objects/js-regexp-string-iterator.tq b/deps/v8/src/objects/js-regexp-string-iterator.tq
index 3ab1679699c..4daed7af2da 100644
--- a/deps/v8/src/objects/js-regexp-string-iterator.tq
+++ b/deps/v8/src/objects/js-regexp-string-iterator.tq
@@ -2,11 +2,17 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+bitfield struct JSRegExpStringIteratorFlags extends uint31 {
+  done: bool: 1 bit;
+  global: bool: 1 bit;
+  unicode: bool: 1 bit;
+}
+
 @generateCppClass
 extern class JSRegExpStringIterator extends JSObject {
   // The [[IteratingRegExp]] internal property.
   iterating_reg_exp: JSReceiver;
   // The [[IteratedString]] internal property.
   iterated_string: String;
-  flags: Smi;
+  flags: SmiTagged<JSRegExpStringIteratorFlags>;
 }
diff --git a/deps/v8/src/objects/js-regexp.h b/deps/v8/src/objects/js-regexp.h
index 07236e5ba8f..3d584b9f1ab 100644
--- a/deps/v8/src/objects/js-regexp.h
+++ b/deps/v8/src/objects/js-regexp.h
@@ -113,7 +113,11 @@ class JSRegExp : public TorqueGeneratedJSRegExp<JSRegExp, JSObject> {
   static constexpr int kMaxCaptures = 1 << 16;
 
   // Number of captures (without the match itself).
-  inline int CaptureCount();
+  inline int CaptureCount() const;
+  // Each capture (including the match itself) needs two registers.
+  static int RegistersForCaptureCount(int count) { return (count + 1) * 2; }
+
+  inline int MaxRegisterCount() const;
   inline Flags GetFlags();
   inline String Pattern();
   inline Object CaptureNameMap();
@@ -131,9 +135,10 @@ class JSRegExp : public TorqueGeneratedJSRegExp<JSRegExp, JSObject> {
   }
 
   // This could be a Smi kUninitializedValue or Code.
-  Object Code(bool is_latin1) const;
+  V8_EXPORT_PRIVATE Object Code(bool is_latin1) const;
   // This could be a Smi kUninitializedValue or ByteArray.
-  Object Bytecode(bool is_latin1) const;
+  V8_EXPORT_PRIVATE Object Bytecode(bool is_latin1) const;
+
   bool ShouldProduceBytecode();
   inline bool HasCompiledCode() const;
   inline void DiscardCompiledCodeForSerialization();
diff --git a/deps/v8/src/objects/js-relative-time-format-inl.h b/deps/v8/src/objects/js-relative-time-format-inl.h
index 74da1872469..52d9d12261a 100644
--- a/deps/v8/src/objects/js-relative-time-format-inl.h
+++ b/deps/v8/src/objects/js-relative-time-format-inl.h
@@ -18,14 +18,11 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(JSRelativeTimeFormat, JSObject)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSRelativeTimeFormat)
 
 // Base relative time format accessors.
-ACCESSORS(JSRelativeTimeFormat, locale, String, kLocaleOffset)
-ACCESSORS(JSRelativeTimeFormat, numberingSystem, String, kNumberingSystemOffset)
 ACCESSORS(JSRelativeTimeFormat, icu_formatter,
           Managed<icu::RelativeDateTimeFormatter>, kIcuFormatterOffset)
-SMI_ACCESSORS(JSRelativeTimeFormat, flags, kFlagsOffset)
 
 inline void JSRelativeTimeFormat::set_numeric(Numeric numeric) {
   DCHECK_GE(NumericBit::kMax, numeric);
@@ -38,8 +35,6 @@ inline JSRelativeTimeFormat::Numeric JSRelativeTimeFormat::numeric() const {
   return NumericBit::decode(flags());
 }
 
-CAST_ACCESSOR(JSRelativeTimeFormat)
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/js-relative-time-format.h b/deps/v8/src/objects/js-relative-time-format.h
index 87aac9f0609..53f44b2b40a 100644
--- a/deps/v8/src/objects/js-relative-time-format.h
+++ b/deps/v8/src/objects/js-relative-time-format.h
@@ -29,7 +29,9 @@ class RelativeDateTimeFormatter;
 namespace v8 {
 namespace internal {
 
-class JSRelativeTimeFormat : public JSObject {
+class JSRelativeTimeFormat
+    : public TorqueGeneratedJSRelativeTimeFormat<JSRelativeTimeFormat,
+                                                 JSObject> {
  public:
   // Creates relative time format object with properties derived from input
   // locales and options.
@@ -54,12 +56,7 @@ class JSRelativeTimeFormat : public JSObject {
 
   V8_EXPORT_PRIVATE static const std::set<std::string>& GetAvailableLocales();
 
-  DECL_CAST(JSRelativeTimeFormat)
-
   // RelativeTimeFormat accessors.
-  DECL_ACCESSORS(locale, String)
-  DECL_ACCESSORS(numberingSystem, String)
-
   DECL_ACCESSORS(icu_formatter, Managed<icu::RelativeDateTimeFormatter>)
 
   // Numeric: identifying whether numerical descriptions are always used, or
@@ -81,18 +78,9 @@ class JSRelativeTimeFormat : public JSObject {
   STATIC_ASSERT(Numeric::AUTO <= NumericBit::kMax);
   STATIC_ASSERT(Numeric::ALWAYS <= NumericBit::kMax);
 
-  // [flags] Bit field containing various flags about the function.
-  DECL_INT_ACCESSORS(flags)
-
   DECL_PRINTER(JSRelativeTimeFormat)
-  DECL_VERIFIER(JSRelativeTimeFormat)
-
-  // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
-                                TORQUE_GENERATED_JS_RELATIVE_TIME_FORMAT_FIELDS)
 
- private:
-  OBJECT_CONSTRUCTORS(JSRelativeTimeFormat, JSObject);
+  TQ_OBJECT_CONSTRUCTORS(JSRelativeTimeFormat)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/js-segment-iterator-inl.h b/deps/v8/src/objects/js-segment-iterator-inl.h
index f312f7c91a5..2e32cc5d87a 100644
--- a/deps/v8/src/objects/js-segment-iterator-inl.h
+++ b/deps/v8/src/objects/js-segment-iterator-inl.h
@@ -18,7 +18,7 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(JSSegmentIterator, JSObject)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSSegmentIterator)
 
 // Base segment iterator accessors.
 ACCESSORS(JSSegmentIterator, icu_break_iterator, Managed<icu::BreakIterator>,
@@ -29,10 +29,6 @@ ACCESSORS(JSSegmentIterator, unicode_string, Managed<icu::UnicodeString>,
 BIT_FIELD_ACCESSORS(JSSegmentIterator, flags, is_break_type_set,
                     JSSegmentIterator::BreakTypeSetBit)
 
-SMI_ACCESSORS(JSSegmentIterator, flags, kFlagsOffset)
-
-CAST_ACCESSOR(JSSegmentIterator)
-
 inline void JSSegmentIterator::set_granularity(
     JSSegmenter::Granularity granularity) {
   DCHECK_GE(GranularityBits::kMax, granularity);
diff --git a/deps/v8/src/objects/js-segment-iterator.h b/deps/v8/src/objects/js-segment-iterator.h
index 81ebc4dbd28..f1310233e13 100644
--- a/deps/v8/src/objects/js-segment-iterator.h
+++ b/deps/v8/src/objects/js-segment-iterator.h
@@ -28,7 +28,8 @@ class UnicodeString;
 namespace v8 {
 namespace internal {
 
-class JSSegmentIterator : public JSObject {
+class JSSegmentIterator
+    : public TorqueGeneratedJSSegmentIterator<JSSegmentIterator, JSObject> {
  public:
   // ecma402 #sec-CreateSegmentIterator
   V8_WARN_UNUSED_RESULT static MaybeHandle<JSSegmentIterator> Create(
@@ -64,14 +65,11 @@ class JSSegmentIterator : public JSObject {
                                                        int32_t start,
                                                        int32_t end) const;
 
-  DECL_CAST(JSSegmentIterator)
-
   // SegmentIterator accessors.
   DECL_ACCESSORS(icu_break_iterator, Managed<icu::BreakIterator>)
   DECL_ACCESSORS(unicode_string, Managed<icu::UnicodeString>)
 
   DECL_PRINTER(JSSegmentIterator)
-  DECL_VERIFIER(JSSegmentIterator)
 
   inline void set_granularity(JSSegmenter::Granularity granularity);
   inline JSSegmenter::Granularity granularity() const;
@@ -83,14 +81,7 @@ class JSSegmentIterator : public JSObject {
   STATIC_ASSERT(JSSegmenter::Granularity::WORD <= GranularityBits::kMax);
   STATIC_ASSERT(JSSegmenter::Granularity::SENTENCE <= GranularityBits::kMax);
 
-  // [flags] Bit field containing various flags about the function.
-  DECL_INT_ACCESSORS(flags)
-
-// Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
-                                TORQUE_GENERATED_JS_SEGMENT_ITERATOR_FIELDS)
-
-  OBJECT_CONSTRUCTORS(JSSegmentIterator, JSObject);
+  TQ_OBJECT_CONSTRUCTORS(JSSegmentIterator)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/js-segmenter-inl.h b/deps/v8/src/objects/js-segmenter-inl.h
index a31de29c25c..ebf4002e708 100644
--- a/deps/v8/src/objects/js-segmenter-inl.h
+++ b/deps/v8/src/objects/js-segmenter-inl.h
@@ -18,13 +18,11 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(JSSegmenter, JSObject)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSSegmenter)
 
 // Base segmenter accessors.
-ACCESSORS(JSSegmenter, locale, String, kLocaleOffset)
 ACCESSORS(JSSegmenter, icu_break_iterator, Managed<icu::BreakIterator>,
           kIcuBreakIteratorOffset)
-SMI_ACCESSORS(JSSegmenter, flags, kFlagsOffset)
 
 inline void JSSegmenter::set_granularity(Granularity granularity) {
   DCHECK_GE(GranularityBits::kMax, granularity);
@@ -37,8 +35,6 @@ inline JSSegmenter::Granularity JSSegmenter::granularity() const {
   return GranularityBits::decode(flags());
 }
 
-CAST_ACCESSOR(JSSegmenter)
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/js-segmenter.cc b/deps/v8/src/objects/js-segmenter.cc
index 39cf15f6286..f12bac2031e 100644
--- a/deps/v8/src/objects/js-segmenter.cc
+++ b/deps/v8/src/objects/js-segmenter.cc
@@ -163,9 +163,7 @@ Handle<String> JSSegmenter::GranularityAsString() const {
 }
 
 const std::set<std::string>& JSSegmenter::GetAvailableLocales() {
-  static base::LazyInstance<Intl::AvailableLocales<icu::BreakIterator>>::type
-      available_locales = LAZY_INSTANCE_INITIALIZER;
-  return available_locales.Pointer()->Get();
+  return Intl::GetAvailableLocales();
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/js-segmenter.h b/deps/v8/src/objects/js-segmenter.h
index b2cd1cac1b0..39b32480baa 100644
--- a/deps/v8/src/objects/js-segmenter.h
+++ b/deps/v8/src/objects/js-segmenter.h
@@ -29,7 +29,7 @@ class BreakIterator;
 namespace v8 {
 namespace internal {
 
-class JSSegmenter : public JSObject {
+class JSSegmenter : public TorqueGeneratedJSSegmenter<JSSegmenter, JSObject> {
  public:
   // Creates segmenter object with properties derived from input locales and
   // options.
@@ -44,11 +44,7 @@ class JSSegmenter : public JSObject {
 
   Handle<String> GranularityAsString() const;
 
-  DECL_CAST(JSSegmenter)
-
   // Segmenter accessors.
-  DECL_ACCESSORS(locale, String)
-
   DECL_ACCESSORS(icu_break_iterator, Managed<icu::BreakIterator>)
 
   // Granularity: identifying the segmenter used.
@@ -69,18 +65,9 @@ class JSSegmenter : public JSObject {
   STATIC_ASSERT(Granularity::WORD <= GranularityBits::kMax);
   STATIC_ASSERT(Granularity::SENTENCE <= GranularityBits::kMax);
 
-  // [flags] Bit field containing various flags about the function.
-  DECL_INT_ACCESSORS(flags)
-
   DECL_PRINTER(JSSegmenter)
-  DECL_VERIFIER(JSSegmenter)
-
-  // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
-                                TORQUE_GENERATED_JS_SEGMENTER_FIELDS)
 
- private:
-  OBJECT_CONSTRUCTORS(JSSegmenter, JSObject);
+  TQ_OBJECT_CONSTRUCTORS(JSSegmenter)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/js-weak-refs-inl.h b/deps/v8/src/objects/js-weak-refs-inl.h
index 939964b47ef..8b9eb19d6ce 100644
--- a/deps/v8/src/objects/js-weak-refs-inl.h
+++ b/deps/v8/src/objects/js-weak-refs-inl.h
@@ -20,7 +20,6 @@ namespace internal {
 TQ_OBJECT_CONSTRUCTORS_IMPL(WeakCell)
 TQ_OBJECT_CONSTRUCTORS_IMPL(JSWeakRef)
 OBJECT_CONSTRUCTORS_IMPL(JSFinalizationRegistry, JSObject)
-TQ_OBJECT_CONSTRUCTORS_IMPL(JSFinalizationRegistryCleanupIterator)
 
 ACCESSORS(JSFinalizationRegistry, native_context, NativeContext,
           kNativeContextOffset)
@@ -33,6 +32,9 @@ SMI_ACCESSORS(JSFinalizationRegistry, flags, kFlagsOffset)
 ACCESSORS(JSFinalizationRegistry, next_dirty, Object, kNextDirtyOffset)
 CAST_ACCESSOR(JSFinalizationRegistry)
 
+BIT_FIELD_ACCESSORS(JSFinalizationRegistry, flags, scheduled_for_cleanup,
+                    JSFinalizationRegistry::ScheduledForCleanupBit)
+
 void JSFinalizationRegistry::Register(
     Handle<JSFinalizationRegistry> finalization_registry,
     Handle<JSReceiver> target, Handle<Object> holdings,
@@ -175,72 +177,8 @@ bool JSFinalizationRegistry::NeedsCleanup() const {
   return cleared_cells().IsWeakCell();
 }
 
-bool JSFinalizationRegistry::scheduled_for_cleanup() const {
-  return ScheduledForCleanupField::decode(flags());
-}
-
-void JSFinalizationRegistry::set_scheduled_for_cleanup(
-    bool scheduled_for_cleanup) {
-  set_flags(ScheduledForCleanupField::update(flags(), scheduled_for_cleanup));
-}
-
-Object JSFinalizationRegistry::PopClearedCellHoldings(
-    Handle<JSFinalizationRegistry> finalization_registry, Isolate* isolate) {
-  Handle<WeakCell> weak_cell =
-      handle(WeakCell::cast(finalization_registry->cleared_cells()), isolate);
-  DCHECK(weak_cell->prev().IsUndefined(isolate));
-  finalization_registry->set_cleared_cells(weak_cell->next());
-  weak_cell->set_next(ReadOnlyRoots(isolate).undefined_value());
-
-  if (finalization_registry->cleared_cells().IsWeakCell()) {
-    WeakCell cleared_cells_head =
-        WeakCell::cast(finalization_registry->cleared_cells());
-    DCHECK_EQ(cleared_cells_head.prev(), *weak_cell);
-    cleared_cells_head.set_prev(ReadOnlyRoots(isolate).undefined_value());
-  } else {
-    DCHECK(finalization_registry->cleared_cells().IsUndefined(isolate));
-  }
-
-  // Also remove the WeakCell from the key_map (if it's there).
-  if (!weak_cell->unregister_token().IsUndefined(isolate)) {
-    if (weak_cell->key_list_prev().IsUndefined(isolate)) {
-      Handle<SimpleNumberDictionary> key_map =
-          handle(SimpleNumberDictionary::cast(finalization_registry->key_map()),
-                 isolate);
-      Handle<Object> unregister_token =
-          handle(weak_cell->unregister_token(), isolate);
-      uint32_t key = Smi::ToInt(unregister_token->GetHash());
-      InternalIndex entry = key_map->FindEntry(isolate, key);
-
-      if (weak_cell->key_list_next().IsUndefined(isolate)) {
-        // weak_cell is the only one associated with its key; remove the key
-        // from the hash table.
-        DCHECK(entry.is_found());
-        key_map = SimpleNumberDictionary::DeleteEntry(isolate, key_map, entry);
-        finalization_registry->set_key_map(*key_map);
-      } else {
-        // weak_cell is the list head for its key; we need to change the value
-        // of the key in the hash table.
-        Handle<WeakCell> next =
-            handle(WeakCell::cast(weak_cell->key_list_next()), isolate);
-        DCHECK_EQ(next->key_list_prev(), *weak_cell);
-        next->set_key_list_prev(ReadOnlyRoots(isolate).undefined_value());
-        weak_cell->set_key_list_next(ReadOnlyRoots(isolate).undefined_value());
-        key_map = SimpleNumberDictionary::Set(isolate, key_map, key, next);
-        finalization_registry->set_key_map(*key_map);
-      }
-    } else {
-      // weak_cell is somewhere in the middle of its key list.
-      WeakCell prev = WeakCell::cast(weak_cell->key_list_prev());
-      prev.set_key_list_next(weak_cell->key_list_next());
-      if (!weak_cell->key_list_next().IsUndefined()) {
-        WeakCell next = WeakCell::cast(weak_cell->key_list_next());
-        next.set_key_list_prev(weak_cell->key_list_prev());
-      }
-    }
-  }
-
-  return weak_cell->holdings();
+HeapObject WeakCell::relaxed_target() const {
+  return TaggedField<HeapObject>::Relaxed_Load(*this, kTargetOffset);
 }
 
 template <typename GCNotifyUpdatedSlotCallback>
diff --git a/deps/v8/src/objects/js-weak-refs.h b/deps/v8/src/objects/js-weak-refs.h
index ff5cad7ee38..e0f109c3531 100644
--- a/deps/v8/src/objects/js-weak-refs.h
+++ b/deps/v8/src/objects/js-weak-refs.h
@@ -6,6 +6,7 @@
 #define V8_OBJECTS_JS_WEAK_REFS_H_
 
 #include "src/objects/js-objects.h"
+#include "torque-generated/bit-fields-tq.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -35,6 +36,8 @@ class JSFinalizationRegistry : public JSObject {
 
   DECL_INT_ACCESSORS(flags)
 
+  DECL_BOOLEAN_ACCESSORS(scheduled_for_cleanup)
+
   class BodyDescriptor;
 
   inline static void Register(
@@ -58,28 +61,22 @@ class JSFinalizationRegistry : public JSObject {
   // Returns true if the cleared_cells list is non-empty.
   inline bool NeedsCleanup() const;
 
-  inline bool scheduled_for_cleanup() const;
-  inline void set_scheduled_for_cleanup(bool scheduled_for_cleanup);
-
-  // Remove the first cleared WeakCell from the cleared_cells
-  // list (assumes there is one) and return its holdings.
-  inline static Object PopClearedCellHoldings(
-      Handle<JSFinalizationRegistry> finalization_registry, Isolate* isolate);
-
-  // Constructs an iterator for the WeakCells in the cleared_cells list and
-  // calls the user's cleanup function.
+  // Remove the already-popped weak_cell from its unregister token linked list,
+  // as well as removing the entry from the key map if it is the only WeakCell
+  // with its unregister token. This method cannot GC and does not shrink the
+  // key map. Asserts that weak_cell has a non-undefined unregister token.
   //
-  // Returns Nothing<bool> if exception occurs, otherwise returns Just(true).
-  static V8_WARN_UNUSED_RESULT Maybe<bool> Cleanup(
-      Isolate* isolate, Handle<JSFinalizationRegistry> finalization_registry,
-      Handle<Object> callback);
+  // It takes raw Addresses because it is called from CSA and Torque.
+  V8_EXPORT_PRIVATE static void RemoveCellFromUnregisterTokenMap(
+      Isolate* isolate, Address raw_finalization_registry,
+      Address raw_weak_cell);
 
   // Layout description.
   DEFINE_FIELD_OFFSET_CONSTANTS(
       JSObject::kHeaderSize, TORQUE_GENERATED_JS_FINALIZATION_REGISTRY_FIELDS)
 
   // Bitfields in flags.
-  using ScheduledForCleanupField = base::BitField<bool, 0, 1>;
+  DEFINE_TORQUE_GENERATED_FINALIZATION_REGISTRY_FLAGS()
 
   OBJECT_CONSTRUCTORS(JSFinalizationRegistry, JSObject);
 };
@@ -92,6 +89,9 @@ class WeakCell : public TorqueGeneratedWeakCell<WeakCell, HeapObject> {
 
   class BodyDescriptor;
 
+  // Provide relaxed load access to target field.
+  inline HeapObject relaxed_target() const;
+
   // Nullify is called during GC and it modifies the pointers in WeakCell and
   // JSFinalizationRegistry. Thus we need to tell the GC about the modified
   // slots via the gc_notify_updated_slot function. The normal write barrier is
@@ -115,16 +115,6 @@ class JSWeakRef : public TorqueGeneratedJSWeakRef<JSWeakRef, JSObject> {
   TQ_OBJECT_CONSTRUCTORS(JSWeakRef)
 };
 
-class JSFinalizationRegistryCleanupIterator
-    : public TorqueGeneratedJSFinalizationRegistryCleanupIterator<
-          JSFinalizationRegistryCleanupIterator, JSObject> {
- public:
-  DECL_PRINTER(JSFinalizationRegistryCleanupIterator)
-  DECL_VERIFIER(JSFinalizationRegistryCleanupIterator)
-
-  TQ_OBJECT_CONSTRUCTORS(JSFinalizationRegistryCleanupIterator)
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/js-weak-refs.tq b/deps/v8/src/objects/js-weak-refs.tq
index 7adcb93d704..9008f642905 100644
--- a/deps/v8/src/objects/js-weak-refs.tq
+++ b/deps/v8/src/objects/js-weak-refs.tq
@@ -2,29 +2,28 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+bitfield struct FinalizationRegistryFlags extends uint31 {
+  scheduled_for_cleanup: bool: 1 bit;
+}
+
 extern class JSFinalizationRegistry extends JSObject {
   native_context: NativeContext;
-  cleanup: Object;
+  cleanup: Callable;
   active_cells: Undefined|WeakCell;
   cleared_cells: Undefined|WeakCell;
   key_map: Object;
   // For the linked list of FinalizationRegistries that need cleanup. This
   // link is weak.
   next_dirty: Undefined|JSFinalizationRegistry;
-  flags: Smi;
-}
-
-@generateCppClass
-extern class JSFinalizationRegistryCleanupIterator extends JSObject {
-  finalization_registry: JSFinalizationRegistry;
+  flags: SmiTagged<FinalizationRegistryFlags>;
 }
 
 @generateCppClass
 extern class WeakCell extends HeapObject {
   finalization_registry: Undefined|JSFinalizationRegistry;
   target: Undefined|JSReceiver;
-  unregister_token: Object;
-  holdings: Object;
+  unregister_token: JSAny;
+  holdings: JSAny;
 
   // For storing doubly linked lists of WeakCells in JSFinalizationRegistry's
   // "active_cells" and "cleared_cells" lists.
diff --git a/deps/v8/src/objects/layout-descriptor-inl.h b/deps/v8/src/objects/layout-descriptor-inl.h
index 30fe1321293..561e79505e3 100644
--- a/deps/v8/src/objects/layout-descriptor-inl.h
+++ b/deps/v8/src/objects/layout-descriptor-inl.h
@@ -9,6 +9,7 @@
 
 #include "src/handles/handles-inl.h"
 #include "src/objects/descriptor-array-inl.h"
+#include "src/objects/fixed-array-inl.h"
 #include "src/objects/objects-inl.h"
 #include "src/objects/smi.h"
 
diff --git a/deps/v8/src/objects/lookup.cc b/deps/v8/src/objects/lookup.cc
index f0f3a21bafe..0361b6dfd78 100644
--- a/deps/v8/src/objects/lookup.cc
+++ b/deps/v8/src/objects/lookup.cc
@@ -4,7 +4,6 @@
 
 #include "src/objects/lookup.h"
 
-#include "include/v8config.h"
 #include "src/deoptimizer/deoptimizer.h"
 #include "src/execution/isolate-inl.h"
 #include "src/execution/protectors-inl.h"
@@ -15,6 +14,8 @@
 #include "src/objects/hash-table-inl.h"
 #include "src/objects/heap-number-inl.h"
 #include "src/objects/struct-inl.h"
+#include "torque-generated/exported-class-definitions-tq-inl.h"
+#include "torque-generated/exported-class-definitions-tq.h"
 
 namespace v8 {
 namespace internal {
@@ -193,21 +194,11 @@ void LookupIterator::InternalUpdateProtector(Isolate* isolate,
   if (!receiver_generic->IsHeapObject()) return;
   Handle<HeapObject> receiver = Handle<HeapObject>::cast(receiver_generic);
 
-  // Getting the native_context from the isolate as a fallback. If possible, we
-  // use the receiver's creation context instead.
-  Handle<NativeContext> native_context = isolate->native_context();
-
   ReadOnlyRoots roots(isolate);
   if (*name == roots.constructor_string()) {
-    // Fetching the context in here since the operation is rather expensive.
-    if (receiver->IsJSReceiver()) {
-      native_context = Handle<JSReceiver>::cast(receiver)->GetCreationContext();
-    }
-
     if (!Protectors::IsArraySpeciesLookupChainIntact(isolate) &&
         !Protectors::IsPromiseSpeciesLookupChainIntact(isolate) &&
-        !Protectors::IsRegExpSpeciesLookupChainProtectorIntact(
-            native_context) &&
+        !Protectors::IsRegExpSpeciesLookupChainIntact(isolate) &&
         !Protectors::IsTypedArraySpeciesLookupChainIntact(isolate)) {
       return;
     }
@@ -223,12 +214,8 @@ void LookupIterator::InternalUpdateProtector(Isolate* isolate,
       Protectors::InvalidatePromiseSpeciesLookupChain(isolate);
       return;
     } else if (receiver->IsJSRegExp(isolate)) {
-      if (!Protectors::IsRegExpSpeciesLookupChainProtectorIntact(
-              native_context)) {
-        return;
-      }
-      Protectors::InvalidateRegExpSpeciesLookupChainProtector(isolate,
-                                                              native_context);
+      if (!Protectors::IsRegExpSpeciesLookupChainIntact(isolate)) return;
+      Protectors::InvalidateRegExpSpeciesLookupChain(isolate);
       return;
     } else if (receiver->IsJSTypedArray(isolate)) {
       if (!Protectors::IsTypedArraySpeciesLookupChainIntact(isolate)) return;
@@ -254,12 +241,8 @@ void LookupIterator::InternalUpdateProtector(Isolate* isolate,
         Protectors::InvalidatePromiseSpeciesLookupChain(isolate);
       } else if (isolate->IsInAnyContext(*receiver,
                                          Context::REGEXP_PROTOTYPE_INDEX)) {
-        if (!Protectors::IsRegExpSpeciesLookupChainProtectorIntact(
-                native_context)) {
-          return;
-        }
-        Protectors::InvalidateRegExpSpeciesLookupChainProtector(isolate,
-                                                                native_context);
+        if (!Protectors::IsRegExpSpeciesLookupChainIntact(isolate)) return;
+        Protectors::InvalidateRegExpSpeciesLookupChain(isolate);
       } else if (isolate->IsInAnyContext(
                      receiver->map(isolate).prototype(isolate),
                      Context::TYPED_ARRAY_PROTOTYPE_INDEX)) {
@@ -295,15 +278,9 @@ void LookupIterator::InternalUpdateProtector(Isolate* isolate,
       Protectors::InvalidateStringIteratorLookupChain(isolate);
     }
   } else if (*name == roots.species_symbol()) {
-    // Fetching the context in here since the operation is rather expensive.
-    if (receiver->IsJSReceiver()) {
-      native_context = Handle<JSReceiver>::cast(receiver)->GetCreationContext();
-    }
-
     if (!Protectors::IsArraySpeciesLookupChainIntact(isolate) &&
         !Protectors::IsPromiseSpeciesLookupChainIntact(isolate) &&
-        !Protectors::IsRegExpSpeciesLookupChainProtectorIntact(
-            native_context) &&
+        !Protectors::IsRegExpSpeciesLookupChainIntact(isolate) &&
         !Protectors::IsTypedArraySpeciesLookupChainIntact(isolate)) {
       return;
     }
@@ -320,12 +297,8 @@ void LookupIterator::InternalUpdateProtector(Isolate* isolate,
       Protectors::InvalidatePromiseSpeciesLookupChain(isolate);
     } else if (isolate->IsInAnyContext(*receiver,
                                        Context::REGEXP_FUNCTION_INDEX)) {
-      if (!Protectors::IsRegExpSpeciesLookupChainProtectorIntact(
-              native_context)) {
-        return;
-      }
-      Protectors::InvalidateRegExpSpeciesLookupChainProtector(isolate,
-                                                              native_context);
+      if (!Protectors::IsRegExpSpeciesLookupChainIntact(isolate)) return;
+      Protectors::InvalidateRegExpSpeciesLookupChain(isolate);
     } else if (IsTypedArrayFunctionInAnyContext(isolate, *receiver)) {
       if (!Protectors::IsTypedArraySpeciesLookupChainIntact(isolate)) return;
       Protectors::InvalidateTypedArraySpeciesLookupChain(isolate);
@@ -792,13 +765,14 @@ void LookupIterator::TransitionToAccessorPair(Handle<Object> pair,
     receiver->RequireSlowElements(*dictionary);
 
     if (receiver->HasSlowArgumentsElements(isolate_)) {
-      FixedArray parameter_map = FixedArray::cast(receiver->elements(isolate_));
-      uint32_t length = parameter_map.length() - 2;
+      SloppyArgumentsElements parameter_map =
+          SloppyArgumentsElements::cast(receiver->elements(isolate_));
+      uint32_t length = parameter_map.length();
       if (number_.is_found() && number_.as_uint32() < length) {
-        parameter_map.set(number_.as_int() + 2,
-                          ReadOnlyRoots(isolate_).the_hole_value());
+        parameter_map.set_mapped_entries(
+            number_.as_int(), ReadOnlyRoots(isolate_).the_hole_value());
       }
-      FixedArray::cast(receiver->elements(isolate_)).set(1, *dictionary);
+      parameter_map.set_arguments(*dictionary);
     } else {
       receiver->set_elements(*dictionary);
     }
@@ -943,12 +917,7 @@ Handle<Map> LookupIterator::GetFieldOwnerMap() const {
                 isolate_);
 }
 
-#if defined(__clang__) && defined(V8_OS_WIN)
-// Force function alignment to work around CPU bug: https://crbug.com/968683
-__attribute__((__aligned__(32)))
-#endif
-FieldIndex
-LookupIterator::GetFieldIndex() const {
+FieldIndex LookupIterator::GetFieldIndex() const {
   DCHECK(has_property_);
   DCHECK(holder_->HasFastProperties(isolate_));
   DCHECK_EQ(kField, property_details_.location());
diff --git a/deps/v8/src/objects/managed.h b/deps/v8/src/objects/managed.h
index c3203df8a57..8d56a13aef2 100644
--- a/deps/v8/src/objects/managed.h
+++ b/deps/v8/src/objects/managed.h
@@ -92,11 +92,12 @@ class Managed : public Foreign {
   // Create a {Managed<CppType>} from an existing {std::shared_ptr<CppType>}.
   static Handle<Managed<CppType>> FromSharedPtr(
       Isolate* isolate, size_t estimated_size,
-      const std::shared_ptr<CppType>& shared_ptr) {
+      std::shared_ptr<CppType> shared_ptr) {
     reinterpret_cast<v8::Isolate*>(isolate)
         ->AdjustAmountOfExternalAllocatedMemory(estimated_size);
     auto destructor = new ManagedPtrDestructor(
-        estimated_size, new std::shared_ptr<CppType>{shared_ptr}, Destructor);
+        estimated_size, new std::shared_ptr<CppType>{std::move(shared_ptr)},
+        Destructor);
     Handle<Managed<CppType>> handle = Handle<Managed<CppType>>::cast(
         isolate->factory()->NewForeign(reinterpret_cast<Address>(destructor)));
     Handle<Object> global_handle = isolate->global_handles()->Create(*handle);
diff --git a/deps/v8/src/objects/map-inl.h b/deps/v8/src/objects/map-inl.h
index 9b17805c6aa..0cf3f9268dd 100644
--- a/deps/v8/src/objects/map-inl.h
+++ b/deps/v8/src/objects/map-inl.h
@@ -227,8 +227,6 @@ FixedArrayBase Map::GetInitialElements() const {
   if (has_fast_elements() || has_fast_string_wrapper_elements() ||
       has_any_nonextensible_elements()) {
     result = GetReadOnlyRoots().empty_fixed_array();
-  } else if (has_fast_sloppy_arguments_elements()) {
-    result = GetReadOnlyRoots().empty_sloppy_arguments_elements();
   } else if (has_typed_array_elements()) {
     result = GetReadOnlyRoots().empty_byte_array();
   } else if (has_dictionary_elements()) {
@@ -756,6 +754,9 @@ ACCESSORS_CHECKED2(Map, constructor_or_backpointer, Object,
 ACCESSORS_CHECKED(Map, native_context, NativeContext,
                   kConstructorOrBackPointerOrNativeContextOffset,
                   IsContextMap())
+ACCESSORS_CHECKED(Map, wasm_type_info, Foreign,
+                  kConstructorOrBackPointerOrNativeContextOffset,
+                  IsWasmStructMap() || IsWasmArrayMap())
 
 bool Map::IsPrototypeValidityCellValid() const {
   Object validity_cell = prototype_validity_cell();
diff --git a/deps/v8/src/objects/map.cc b/deps/v8/src/objects/map.cc
index 74b2fea2fea..f2e45f385fb 100644
--- a/deps/v8/src/objects/map.cc
+++ b/deps/v8/src/objects/map.cc
@@ -13,6 +13,7 @@
 #include "src/logging/counters-inl.h"
 #include "src/logging/log.h"
 #include "src/objects/descriptor-array.h"
+#include "src/objects/elements-kind.h"
 #include "src/objects/field-type.h"
 #include "src/objects/js-objects.h"
 #include "src/objects/layout-descriptor.h"
@@ -24,6 +25,8 @@
 #include "src/roots/roots.h"
 #include "src/utils/ostreams.h"
 #include "src/zone/zone-containers.h"
+#include "torque-generated/exported-class-definitions-tq-inl.h"
+#include "torque-generated/exported-class-definitions-tq.h"
 #include "torque-generated/field-offsets-tq.h"
 
 namespace v8 {
@@ -84,11 +87,11 @@ Map Map::GetInstanceTypeMap(ReadOnlyRoots roots, InstanceType type) {
     break;
     STRUCT_LIST(MAKE_CASE)
 #undef MAKE_CASE
-#define MAKE_CASE(_, TYPE, Name, name) \
-  case TYPE:                           \
-    map = roots.name##_map();          \
+#define MAKE_CASE(TYPE, Name, name) \
+  case TYPE:                        \
+    map = roots.name##_map();       \
     break;
-    TORQUE_INTERNAL_CLASS_LIST_GENERATOR(MAKE_CASE, _)
+    TORQUE_INTERNAL_INSTANCE_TYPE_LIST(MAKE_CASE)
 #undef MAKE_CASE
     default:
       UNREACHABLE();
@@ -142,7 +145,6 @@ VisitorId Map::GetVisitorId(Map map) {
     case EMBEDDER_DATA_ARRAY_TYPE:
       return kVisitEmbedderDataArray;
 
-    case FIXED_ARRAY_TYPE:
     case OBJECT_BOILERPLATE_DESCRIPTION_TYPE:
     case CLOSURE_FEEDBACK_CELL_ARRAY_TYPE:
     case HASH_TABLE_TYPE:
@@ -175,10 +177,6 @@ VisitorId Map::GetVisitorId(Map map) {
     case EPHEMERON_HASH_TABLE_TYPE:
       return kVisitEphemeronHashTable;
 
-    case WEAK_FIXED_ARRAY_TYPE:
-    case WEAK_ARRAY_LIST_TYPE:
-      return kVisitWeakArray;
-
     case FIXED_DOUBLE_ARRAY_TYPE:
       return kVisitFixedDoubleArray;
 
@@ -295,7 +293,6 @@ VisitorId Map::GetVisitorId(Map map) {
     case JS_PROMISE_TYPE:
     case JS_REG_EXP_TYPE:
     case JS_REG_EXP_STRING_ITERATOR_TYPE:
-    case JS_FINALIZATION_REGISTRY_CLEANUP_ITERATOR_TYPE:
     case JS_FINALIZATION_REGISTRY_TYPE:
 #ifdef V8_INTL_SUPPORT
     case JS_V8_BREAK_ITERATOR_TYPE:
@@ -367,10 +364,15 @@ VisitorId Map::GetVisitorId(Map map) {
     case SYNTHETIC_MODULE_TYPE:
       return kVisitSyntheticModule;
 
+    case WASM_ARRAY_TYPE:
+      return kVisitWasmArray;
+    case WASM_STRUCT_TYPE:
+      return kVisitWasmStruct;
+
 #define MAKE_TQ_CASE(TYPE, Name) \
   case TYPE:                     \
     return kVisit##Name;
-      TORQUE_BODY_DESCRIPTOR_LIST(MAKE_TQ_CASE)
+      TORQUE_INSTANCE_TYPE_TO_BODY_DESCRIPTOR_LIST(MAKE_TQ_CASE)
 #undef MAKE_TQ_CASE
 
     default:
@@ -794,8 +796,21 @@ void Map::GeneralizeField(Isolate* isolate, Handle<Map> map,
   MaybeObjectHandle wrapped_type(WrapFieldType(isolate, new_field_type));
   field_owner->UpdateFieldType(isolate, modify_index, name, new_constness,
                                new_representation, wrapped_type);
-  field_owner->dependent_code().DeoptimizeDependentCodeGroup(
-      DependentCode::kFieldOwnerGroup);
+
+  if (new_constness != old_constness) {
+    field_owner->dependent_code().DeoptimizeDependentCodeGroup(
+        DependentCode::kFieldConstGroup);
+  }
+
+  if (!new_field_type->Equals(*old_field_type)) {
+    field_owner->dependent_code().DeoptimizeDependentCodeGroup(
+        DependentCode::kFieldTypeGroup);
+  }
+
+  if (!new_representation.Equals(old_representation)) {
+    field_owner->dependent_code().DeoptimizeDependentCodeGroup(
+        DependentCode::kFieldRepresentationGroup);
+  }
 
   if (FLAG_trace_generalization) {
     map->PrintGeneralization(
@@ -1405,27 +1420,27 @@ bool Map::OnlyHasSimpleProperties() const {
          !IsSpecialReceiverMap() && !is_dictionary_map();
 }
 
-bool Map::DictionaryElementsInPrototypeChainOnly(Isolate* isolate) {
-  if (IsDictionaryElementsKind(elements_kind())) {
-    return false;
-  }
-
+bool Map::MayHaveReadOnlyElementsInPrototypeChain(Isolate* isolate) {
   for (PrototypeIterator iter(isolate, *this); !iter.IsAtEnd();
        iter.Advance()) {
-    // Be conservative, don't walk into proxies.
-    if (iter.GetCurrent().IsJSProxy()) return true;
-    // String wrappers have non-configurable, non-writable elements.
-    if (iter.GetCurrent().IsStringWrapper()) return true;
+    // Be conservative, don't look into any JSReceivers that may have custom
+    // elements. For example, into JSProxies, String wrappers (which have have
+    // non-configurable, non-writable elements), API objects, etc.
+    if (iter.GetCurrent().map().IsCustomElementsReceiverMap()) return true;
+
     JSObject current = iter.GetCurrent<JSObject>();
+    ElementsKind elements_kind = current.GetElementsKind(isolate);
+    if (IsFrozenElementsKind(elements_kind)) return true;
 
-    if (current.HasDictionaryElements() &&
-        current.element_dictionary().requires_slow_elements()) {
+    if (IsDictionaryElementsKind(elements_kind) &&
+        current.element_dictionary(isolate).requires_slow_elements()) {
       return true;
     }
 
-    if (current.HasSlowArgumentsElements()) {
-      FixedArray parameter_map = FixedArray::cast(current.elements());
-      Object arguments = parameter_map.get(1);
+    if (IsSlowArgumentsElementsKind(elements_kind)) {
+      SloppyArgumentsElements elements =
+          SloppyArgumentsElements::cast(current.elements(isolate));
+      Object arguments = elements.arguments();
       if (NumberDictionary::cast(arguments).requires_slow_elements()) {
         return true;
       }
@@ -1443,7 +1458,7 @@ Handle<Map> Map::RawCopy(Isolate* isolate, Handle<Map> map, int instance_size,
   Handle<HeapObject> prototype(map->prototype(), isolate);
   Map::SetPrototype(isolate, result, prototype);
   result->set_constructor_or_backpointer(map->GetConstructor());
-  result->set_bit_field(map->bit_field());
+  result->set_relaxed_bit_field(map->bit_field());
   result->set_bit_field2(map->bit_field2());
   int new_bit_field3 = map->bit_field3();
   new_bit_field3 = Bits3::OwnsDescriptorsBit::update(new_bit_field3, true);
diff --git a/deps/v8/src/objects/map.h b/deps/v8/src/objects/map.h
index a84173188e4..9876d85d3ec 100644
--- a/deps/v8/src/objects/map.h
+++ b/deps/v8/src/objects/map.h
@@ -28,9 +28,7 @@ enum InstanceType : uint16_t;
   V(CoverageInfo)                    \
   V(DataObject)                      \
   V(FeedbackMetadata)                \
-  V(FixedDoubleArray)                \
-  V(SeqOneByteString)                \
-  V(SeqTwoByteString)
+  V(FixedDoubleArray)
 
 #define POINTER_VISITOR_ID_LIST(V)     \
   V(AllocationSite)                    \
@@ -38,7 +36,6 @@ enum InstanceType : uint16_t;
   V(Cell)                              \
   V(Code)                              \
   V(CodeDataContainer)                 \
-  V(ConsString)                        \
   V(Context)                           \
   V(DataHandler)                       \
   V(DescriptorArray)                   \
@@ -46,7 +43,6 @@ enum InstanceType : uint16_t;
   V(EphemeronHashTable)                \
   V(FeedbackCell)                      \
   V(FeedbackVector)                    \
-  V(FixedArray)                        \
   V(FreeSpace)                         \
   V(JSApiObject)                       \
   V(JSArrayBuffer)                     \
@@ -66,7 +62,6 @@ enum InstanceType : uint16_t;
   V(PrototypeInfo)                     \
   V(SharedFunctionInfo)                \
   V(ShortcutCandidate)                 \
-  V(SlicedString)                      \
   V(SmallOrderedHashMap)               \
   V(SmallOrderedHashSet)               \
   V(SmallOrderedNameDictionary)        \
@@ -74,22 +69,19 @@ enum InstanceType : uint16_t;
   V(Struct)                            \
   V(Symbol)                            \
   V(SyntheticModule)                   \
-  V(ThinString)                        \
   V(TransitionArray)                   \
   V(UncompiledDataWithoutPreparseData) \
   V(UncompiledDataWithPreparseData)    \
   V(WasmCapiFunctionData)              \
   V(WasmIndirectFunctionTable)         \
   V(WasmInstanceObject)                \
-  V(WeakArray)                         \
+  V(WasmArray)                         \
+  V(WasmStruct)                        \
   V(WeakCell)
 
-#define TORQUE_OBJECT_BODY_TO_VISITOR_ID_LIST_ADAPTER(V, TYPE, TypeName) \
-  V(TypeName)
-
-#define TORQUE_VISITOR_ID_LIST(V)        \
-  TORQUE_BODY_DESCRIPTOR_LIST_GENERATOR( \
-      TORQUE_OBJECT_BODY_TO_VISITOR_ID_LIST_ADAPTER, V)
+#define TORQUE_VISITOR_ID_LIST(V)     \
+  TORQUE_DATA_ONLY_VISITOR_ID_LIST(V) \
+  TORQUE_POINTER_VISITOR_ID_LIST(V)
 
 // Objects with the same visitor id are processed in the same way by
 // the heap visitors. The visitor ids for data only objects must precede
@@ -97,9 +89,11 @@ enum InstanceType : uint16_t;
 // of whether an object contains only data or may contain pointers.
 enum VisitorId {
 #define VISITOR_ID_ENUM_DECL(id) kVisit##id,
-  DATA_ONLY_VISITOR_ID_LIST(VISITOR_ID_ENUM_DECL) kDataOnlyVisitorIdCount,
+  DATA_ONLY_VISITOR_ID_LIST(VISITOR_ID_ENUM_DECL)
+      TORQUE_DATA_ONLY_VISITOR_ID_LIST(VISITOR_ID_ENUM_DECL)
+          kDataOnlyVisitorIdCount,
   POINTER_VISITOR_ID_LIST(VISITOR_ID_ENUM_DECL)
-      TORQUE_VISITOR_ID_LIST(VISITOR_ID_ENUM_DECL)
+      TORQUE_POINTER_VISITOR_ID_LIST(VISITOR_ID_ENUM_DECL)
 #undef VISITOR_ID_ENUM_DECL
           kVisitorIdCount
 };
@@ -426,9 +420,11 @@ class Map : public HeapObject {
   // there is no guarantee it is attached.
   inline bool IsDetached(Isolate* isolate) const;
 
-  // Returns true if the current map doesn't have DICTIONARY_ELEMENTS but if a
-  // map with DICTIONARY_ELEMENTS was found in the prototype chain.
-  bool DictionaryElementsInPrototypeChainOnly(Isolate* isolate);
+  // Returns true if there is an object with potentially read-only elements
+  // in the prototype chain. It could be a Proxy, a string wrapper,
+  // an object with DICTIONARY_ELEMENTS potentially containing read-only
+  // elements or an object with any frozen elements, or a slow arguments object.
+  bool MayHaveReadOnlyElementsInPrototypeChain(Isolate* isolate);
 
   inline Map ElementsTransitionMap(Isolate* isolate);
 
@@ -578,9 +574,11 @@ class Map : public HeapObject {
   // back pointer chain until they find the map holding their constructor.
   // Returns null_value if there's neither a constructor function nor a
   // FunctionTemplateInfo available.
-  // The field also overlaps with the native context pointer for context maps.
+  // The field also overlaps with the native context pointer for context maps,
+  // and with the Wasm type info for WebAssembly object maps.
   DECL_ACCESSORS(constructor_or_backpointer, Object)
   DECL_ACCESSORS(native_context, NativeContext)
+  DECL_ACCESSORS(wasm_type_info, Foreign)
   DECL_GETTER(GetConstructor, Object)
   DECL_GETTER(GetFunctionTemplateInfo, FunctionTemplateInfo)
   inline void SetConstructor(Object constructor,
diff --git a/deps/v8/src/objects/map.tq b/deps/v8/src/objects/map.tq
index 93c56278955..e7333a38634 100644
--- a/deps/v8/src/objects/map.tq
+++ b/deps/v8/src/objects/map.tq
@@ -80,3 +80,16 @@ extern class Map extends HeapObject {
 macro LoadMapPrototypeInfo(m: Map): PrototypeInfo labels HasNoPrototypeInfo {
   return m.PrototypeInfo() otherwise HasNoPrototypeInfo;
 }
+
+// Returns true if the map corresponds to non-special fast or dictionary
+// object.
+@export
+macro IsSimpleObjectMap(map: Map): bool {
+  if (IsSpecialReceiverInstanceType(map.instance_type)) {
+    return false;
+  }
+  const bitField = map.bit_field;
+  return !bitField.has_named_interceptor & !bitField.is_access_check_needed;
+}
+
+extern macro IsSpecialReceiverInstanceType(InstanceType): bool;
diff --git a/deps/v8/src/objects/maybe-object-inl.h b/deps/v8/src/objects/maybe-object-inl.h
index 02f5b485ce7..05ef21c3dfc 100644
--- a/deps/v8/src/objects/maybe-object-inl.h
+++ b/deps/v8/src/objects/maybe-object-inl.h
@@ -5,11 +5,9 @@
 #ifndef V8_OBJECTS_MAYBE_OBJECT_INL_H_
 #define V8_OBJECTS_MAYBE_OBJECT_INL_H_
 
+#include "src/common/ptr-compr-inl.h"
+#include "src/execution/local-isolate-wrapper.h"
 #include "src/objects/maybe-object.h"
-
-#ifdef V8_COMPRESS_POINTERS
-#include "src/execution/isolate.h"
-#endif
 #include "src/objects/smi-inl.h"
 #include "src/objects/tagged-impl-inl.h"
 
@@ -59,22 +57,45 @@ HeapObjectReference HeapObjectReference::Weak(Object object) {
 }
 
 // static
-HeapObjectReference HeapObjectReference::ClearedValue(Isolate* isolate) {
+HeapObjectReference HeapObjectReference::ClearedValue(const Isolate* isolate) {
   // Construct cleared weak ref value.
+#ifdef V8_COMPRESS_POINTERS
+  // This is necessary to make pointer decompression computation also
+  // suitable for cleared weak references.
+  Address raw_value =
+      DecompressTaggedPointer(isolate, kClearedWeakHeapObjectLower32);
+#else
   Address raw_value = kClearedWeakHeapObjectLower32;
+#endif
+  // The rest of the code will check only the lower 32-bits.
+  DCHECK_EQ(kClearedWeakHeapObjectLower32, static_cast<uint32_t>(raw_value));
+  return HeapObjectReference(raw_value);
+}
+
+// static
+HeapObjectReference HeapObjectReference::ClearedValue(
+    const OffThreadIsolate* isolate) {
+  // Construct cleared weak ref value.
 #ifdef V8_COMPRESS_POINTERS
   // This is necessary to make pointer decompression computation also
   // suitable for cleared weak references.
-  Address isolate_root = isolate->isolate_root();
-  raw_value |= isolate_root;
-  DCHECK_EQ(raw_value & (~static_cast<Address>(kClearedWeakHeapObjectLower32)),
-            isolate_root);
+  Address raw_value =
+      DecompressTaggedPointer(isolate, kClearedWeakHeapObjectLower32);
+#else
+  Address raw_value = kClearedWeakHeapObjectLower32;
 #endif
   // The rest of the code will check only the lower 32-bits.
   DCHECK_EQ(kClearedWeakHeapObjectLower32, static_cast<uint32_t>(raw_value));
   return HeapObjectReference(raw_value);
 }
 
+// static
+HeapObjectReference HeapObjectReference::ClearedValue(
+    LocalIsolateWrapper isolate) {
+  return isolate.is_off_thread() ? ClearedValue(isolate.off_thread())
+                                 : ClearedValue(isolate.main_thread());
+}
+
 template <typename THeapObjectSlot>
 void HeapObjectReference::Update(THeapObjectSlot slot, HeapObject value) {
   static_assert(std::is_same<THeapObjectSlot, FullHeapObjectSlot>::value ||
diff --git a/deps/v8/src/objects/maybe-object.h b/deps/v8/src/objects/maybe-object.h
index 304cf90d28a..92f68204138 100644
--- a/deps/v8/src/objects/maybe-object.h
+++ b/deps/v8/src/objects/maybe-object.h
@@ -5,6 +5,7 @@
 #ifndef V8_OBJECTS_MAYBE_OBJECT_H_
 #define V8_OBJECTS_MAYBE_OBJECT_H_
 
+#include "src/execution/local-isolate-wrapper.h"
 #include "src/objects/tagged-impl.h"
 
 namespace v8 {
@@ -47,7 +48,13 @@ class HeapObjectReference : public MaybeObject {
 
   V8_INLINE static HeapObjectReference Weak(Object object);
 
-  V8_INLINE static HeapObjectReference ClearedValue(Isolate* isolate);
+  V8_INLINE static HeapObjectReference ClearedValue(const Isolate* isolate);
+
+  V8_INLINE static HeapObjectReference ClearedValue(
+      const OffThreadIsolate* isolate);
+
+  V8_INLINE static HeapObjectReference ClearedValue(
+      LocalIsolateWrapper isolate);
 
   template <typename THeapObjectSlot>
   V8_INLINE static void Update(THeapObjectSlot slot, HeapObject value);
diff --git a/deps/v8/src/objects/module-inl.h b/deps/v8/src/objects/module-inl.h
index ce03c395005..e627aedf18a 100644
--- a/deps/v8/src/objects/module-inl.h
+++ b/deps/v8/src/objects/module-inl.h
@@ -36,8 +36,9 @@ ACCESSORS(Module, exception, Object, kExceptionOffset)
 SMI_ACCESSORS(Module, status, kStatusOffset)
 SMI_ACCESSORS(Module, hash, kHashOffset)
 
-BOOL_ACCESSORS(SourceTextModule, flags, async, kAsyncBit)
-BOOL_ACCESSORS(SourceTextModule, flags, async_evaluating, kAsyncEvaluatingBit)
+BOOL_ACCESSORS(SourceTextModule, flags, async, AsyncBit::kShift)
+BOOL_ACCESSORS(SourceTextModule, flags, async_evaluating,
+               AsyncEvaluatingBit::kShift)
 ACCESSORS(SourceTextModule, async_parent_modules, ArrayList,
           kAsyncParentModulesOffset)
 ACCESSORS(SourceTextModule, top_level_capability, HeapObject,
diff --git a/deps/v8/src/objects/name.tq b/deps/v8/src/objects/name.tq
index 70bb6aea184..4870e2a3f7a 100644
--- a/deps/v8/src/objects/name.tq
+++ b/deps/v8/src/objects/name.tq
@@ -5,8 +5,16 @@
 @abstract
 @generateCppClass
 extern class Name extends PrimitiveHeapObject {
-  hash_field: uint32;
+  hash_field: NameHash;
 }
+
+bitfield struct NameHash extends uint32 {
+  hash_not_commputed: bool: 1 bit;
+  is_not_integer_index_mask: bool: 1 bit;
+  array_index_value: uint32: 24 bit;
+  array_index_length: uint32: 6 bit;
+}
+
 // This is the same as Name, but with the information that there are no other
 // kinds of names.
 type AnyName = PrivateSymbol|PublicSymbol|String;
@@ -29,5 +37,12 @@ extern class Symbol extends Name {
 type PublicSymbol extends Symbol;
 type PrivateSymbol extends Symbol;
 
-const kNameEmptyHashField:
-    constexpr uint32 generates 'Name::kEmptyHashField';
+const kNameEmptyHashField: NameHash = NameHash{
+  hash_not_commputed: true,
+  is_not_integer_index_mask: true,
+  array_index_value: 0,
+  array_index_length: 0
+};
+
+const kMaxCachedArrayIndexLength: constexpr uint32
+    generates 'Name::kMaxCachedArrayIndexLength';
diff --git a/deps/v8/src/objects/object-list-macros.h b/deps/v8/src/objects/object-list-macros.h
index 11b5c034c98..3b8d3f5d531 100644
--- a/deps/v8/src/objects/object-list-macros.h
+++ b/deps/v8/src/objects/object-list-macros.h
@@ -7,8 +7,6 @@
 
 #include "torque-generated/instance-types-tq.h"
 
-#define TORQUE_INTERNAL_CLASS_NAMES_ADAPTER(V, NAME, Name, name) V(Name)
-
 namespace v8 {
 namespace internal {
 
@@ -145,7 +143,6 @@ class ZoneForwardList;
   V(JSDate)                                    \
   V(JSError)                                   \
   V(JSFinalizationRegistry)                    \
-  V(JSFinalizationRegistryCleanupIterator)     \
   V(JSFunction)                                \
   V(JSFunctionOrBoundFunction)                 \
   V(JSGeneratorObject)                         \
@@ -204,7 +201,6 @@ class ZoneForwardList;
   V(SharedFunctionInfo)                        \
   V(SimpleNumberDictionary)                    \
   V(SlicedString)                              \
-  V(SloppyArgumentsElements)                   \
   V(SmallOrderedHashMap)                       \
   V(SmallOrderedHashSet)                       \
   V(SmallOrderedNameDictionary)                \
@@ -228,17 +224,19 @@ class ZoneForwardList;
   V(UncompiledDataWithoutPreparseData)         \
   V(Undetectable)                              \
   V(UniqueName)                                \
+  V(WasmArray)                                 \
   V(WasmExceptionObject)                       \
   V(WasmExceptionPackage)                      \
   V(WasmGlobalObject)                          \
   V(WasmInstanceObject)                        \
   V(WasmMemoryObject)                          \
   V(WasmModuleObject)                          \
+  V(WasmStruct)                                \
   V(WasmTableObject)                           \
   V(WeakFixedArray)                            \
   V(WeakArrayList)                             \
   V(WeakCell)                                  \
-  TORQUE_INTERNAL_CLASS_LIST_GENERATOR(TORQUE_INTERNAL_CLASS_NAMES_ADAPTER, V)
+  TORQUE_INTERNAL_CLASS_LIST(V)
 
 #ifdef V8_INTL_SUPPORT
 #define HEAP_OBJECT_ORDINARY_TYPE_LIST(V) \
diff --git a/deps/v8/src/objects/objects-body-descriptors-inl.h b/deps/v8/src/objects/objects-body-descriptors-inl.h
index 60c508e336c..fbd3618adef 100644
--- a/deps/v8/src/objects/objects-body-descriptors-inl.h
+++ b/deps/v8/src/objects/objects-body-descriptors-inl.h
@@ -5,8 +5,6 @@
 #ifndef V8_OBJECTS_OBJECTS_BODY_DESCRIPTORS_INL_H_
 #define V8_OBJECTS_OBJECTS_BODY_DESCRIPTORS_INL_H_
 
-#include "src/objects/objects-body-descriptors.h"
-
 #include <algorithm>
 
 #include "src/codegen/reloc-info.h"
@@ -17,12 +15,16 @@
 #include "src/objects/hash-table.h"
 #include "src/objects/js-collection.h"
 #include "src/objects/js-weak-refs.h"
+#include "src/objects/objects-body-descriptors.h"
 #include "src/objects/oddball.h"
 #include "src/objects/ordered-hash-table-inl.h"
 #include "src/objects/source-text-module.h"
 #include "src/objects/synthetic-module.h"
 #include "src/objects/transitions.h"
 #include "src/wasm/wasm-objects-inl.h"
+#include "torque-generated/class-definitions-tq-inl.h"
+#include "torque-generated/exported-class-definitions-tq-inl.h"
+#include "torque-generated/internal-class-definitions-tq-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -681,34 +683,6 @@ class Code::BodyDescriptor final : public BodyDescriptorBase {
   }
 };
 
-class SeqOneByteString::BodyDescriptor final : public BodyDescriptorBase {
- public:
-  static bool IsValidSlot(Map map, HeapObject obj, int offset) { return false; }
-
-  template <typename ObjectVisitor>
-  static inline void IterateBody(Map map, HeapObject obj, int object_size,
-                                 ObjectVisitor* v) {}
-
-  static inline int SizeOf(Map map, HeapObject obj) {
-    SeqOneByteString string = SeqOneByteString::cast(obj);
-    return SeqOneByteString::SizeFor(string.synchronized_length());
-  }
-};
-
-class SeqTwoByteString::BodyDescriptor final : public BodyDescriptorBase {
- public:
-  static bool IsValidSlot(Map map, HeapObject obj, int offset) { return false; }
-
-  template <typename ObjectVisitor>
-  static inline void IterateBody(Map map, HeapObject obj, int object_size,
-                                 ObjectVisitor* v) {}
-
-  static inline int SizeOf(Map map, HeapObject obj) {
-    SeqTwoByteString string = SeqTwoByteString::cast(obj);
-    return SeqTwoByteString::SizeFor(string.synchronized_length());
-  }
-};
-
 class WasmInstanceObject::BodyDescriptor final : public BodyDescriptorBase {
  public:
   static bool IsValidSlot(Map map, HeapObject obj, int offset) {
@@ -825,6 +799,54 @@ class CodeDataContainer::BodyDescriptor final : public BodyDescriptorBase {
   }
 };
 
+class WasmArray::BodyDescriptor final : public BodyDescriptorBase {
+ public:
+  static bool IsValidSlot(Map map, HeapObject obj, int offset) {
+    // Fields in WasmArrays never change their types in place, so
+    // there should never be a need to call this function.
+    UNREACHABLE();
+    return false;
+  }
+
+  template <typename ObjectVisitor>
+  static inline void IterateBody(Map map, HeapObject obj, int object_size,
+                                 ObjectVisitor* v) {
+    if (!WasmArray::type(map)->element_type().IsReferenceType()) return;
+    IteratePointers(obj, WasmArray::kHeaderSize, object_size, v);
+  }
+
+  static inline int SizeOf(Map map, HeapObject object) {
+    return WasmArray::SizeFor(map, WasmArray::cast(object).length());
+  }
+};
+
+class WasmStruct::BodyDescriptor final : public BodyDescriptorBase {
+ public:
+  static bool IsValidSlot(Map map, HeapObject obj, int offset) {
+    // Fields in WasmStructs never change their types in place, so
+    // there should never be a need to call this function.
+    UNREACHABLE();
+    return false;
+  }
+
+  template <typename ObjectVisitor>
+  static inline void IterateBody(Map map, HeapObject obj, int object_size,
+                                 ObjectVisitor* v) {
+    WasmStruct wasm_struct = WasmStruct::cast(obj);
+    wasm::StructType* type = WasmStruct::GcSafeType(map);
+    for (uint32_t i = 0; i < type->field_count(); i++) {
+      if (!type->field(i).IsReferenceType()) continue;
+      int offset =
+          WasmStruct::kHeaderSize + static_cast<int>(type->field_offset(i));
+      v->VisitPointer(wasm_struct, wasm_struct.RawField(offset));
+    }
+  }
+
+  static inline int SizeOf(Map map, HeapObject object) {
+    return map.instance_size();
+  }
+};
+
 class EmbedderDataArray::BodyDescriptor final : public BodyDescriptorBase {
  public:
   static bool IsValidSlot(Map map, HeapObject obj, int offset) {
@@ -896,7 +918,6 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
     case EMBEDDER_DATA_ARRAY_TYPE:
       return Op::template apply<EmbedderDataArray::BodyDescriptor>(p1, p2, p3,
                                                                    p4);
-    case FIXED_ARRAY_TYPE:
     case OBJECT_BOILERPLATE_DESCRIPTION_TYPE:
     case CLOSURE_FEEDBACK_CELL_ARRAY_TYPE:
     case HASH_TABLE_TYPE:
@@ -926,10 +947,6 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
       return Op::template apply<Context::BodyDescriptor>(p1, p2, p3, p4);
     case NATIVE_CONTEXT_TYPE:
       return Op::template apply<NativeContext::BodyDescriptor>(p1, p2, p3, p4);
-    case WEAK_FIXED_ARRAY_TYPE:
-      return Op::template apply<WeakFixedArray::BodyDescriptor>(p1, p2, p3, p4);
-    case WEAK_ARRAY_LIST_TYPE:
-      return Op::template apply<WeakArrayList::BodyDescriptor>(p1, p2, p3, p4);
     case FIXED_DOUBLE_ARRAY_TYPE:
       return ReturnType();
     case FEEDBACK_METADATA_TYPE:
@@ -949,6 +966,10 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
       return Op::template apply<FeedbackVector::BodyDescriptor>(p1, p2, p3, p4);
     case COVERAGE_INFO_TYPE:
       return Op::template apply<CoverageInfo::BodyDescriptor>(p1, p2, p3, p4);
+    case WASM_ARRAY_TYPE:
+      return Op::template apply<WasmArray::BodyDescriptor>(p1, p2, p3, p4);
+    case WASM_STRUCT_TYPE:
+      return Op::template apply<WasmStruct::BodyDescriptor>(p1, p2, p3, p4);
     case JS_OBJECT_TYPE:
     case JS_ERROR_TYPE:
     case JS_ARGUMENTS_OBJECT_TYPE:
@@ -979,7 +1000,6 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
     case JS_SPECIAL_API_OBJECT_TYPE:
     case JS_MESSAGE_OBJECT_TYPE:
     case JS_BOUND_FUNCTION_TYPE:
-    case JS_FINALIZATION_REGISTRY_CLEANUP_ITERATOR_TYPE:
     case JS_FINALIZATION_REGISTRY_TYPE:
 #ifdef V8_INTL_SUPPORT
     case JS_V8_BREAK_ITERATOR_TYPE:
@@ -1100,10 +1120,12 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
     case SYNTHETIC_MODULE_TYPE:
       return Op::template apply<SyntheticModule::BodyDescriptor>(p1, p2, p3,
                                                                  p4);
+// TODO(tebbi): Avoid duplicated cases when the body descriptors are identical.
 #define MAKE_TORQUE_BODY_DESCRIPTOR_APPLY(TYPE, TypeName) \
   case TYPE:                                              \
     return Op::template apply<TypeName::BodyDescriptor>(p1, p2, p3, p4);
-      TORQUE_BODY_DESCRIPTOR_LIST(MAKE_TORQUE_BODY_DESCRIPTOR_APPLY)
+      TORQUE_INSTANCE_TYPE_TO_BODY_DESCRIPTOR_LIST(
+          MAKE_TORQUE_BODY_DESCRIPTOR_APPLY)
 #undef MAKE_TORQUE_BODY_DESCRIPTOR_APPLY
 
     default:
@@ -1164,6 +1186,8 @@ class EphemeronHashTable::BodyDescriptor final : public BodyDescriptorBase {
   }
 };
 
+#include "torque-generated/objects-body-descriptors-tq-inl.inc"
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/objects-body-descriptors.h b/deps/v8/src/objects/objects-body-descriptors.h
index 13adf4c3db6..8135e1f1701 100644
--- a/deps/v8/src/objects/objects-body-descriptors.h
+++ b/deps/v8/src/objects/objects-body-descriptors.h
@@ -74,15 +74,14 @@ class BodyDescriptorBase {
                                              ObjectVisitor* v);
 };
 
-// This class describes a body of an object of a fixed size
-// in which all pointer fields are located in the [start_offset, end_offset)
-// interval.
-template <int start_offset, int end_offset, int size>
-class FixedBodyDescriptor final : public BodyDescriptorBase {
+// This class describes a body of an object in which all pointer fields are
+// located in the [start_offset, end_offset) interval.
+// All pointers have to be strong.
+template <int start_offset, int end_offset>
+class FixedRangeBodyDescriptor : public BodyDescriptorBase {
  public:
   static const int kStartOffset = start_offset;
   static const int kEndOffset = end_offset;
-  static const int kSize = size;
 
   static bool IsValidSlot(Map map, HeapObject obj, int offset) {
     return offset >= kStartOffset && offset < kEndOffset;
@@ -99,14 +98,30 @@ class FixedBodyDescriptor final : public BodyDescriptorBase {
     IterateBody(map, obj, v);
   }
 
-  static inline int SizeOf(Map map, HeapObject object) { return kSize; }
+ private:
+  static inline int SizeOf(Map map, HeapObject object) {
+    // Has to be implemented by the subclass.
+    UNREACHABLE();
+  }
 };
 
-// This class describes a body of an object of a variable size
-// in which all pointer fields are located in the [start_offset, object_size)
+// This class describes a body of an object of a fixed size
+// in which all pointer fields are located in the [start_offset, end_offset)
 // interval.
+// All pointers have to be strong.
+template <int start_offset, int end_offset, int size>
+class FixedBodyDescriptor
+    : public FixedRangeBodyDescriptor<start_offset, end_offset> {
+ public:
+  static const int kSize = size;
+  static inline int SizeOf(Map map, HeapObject object) { return kSize; }
+};
+
+// This class describes a body of an object in which all pointer fields are
+// located in the [start_offset, object_size) interval.
+// All pointers have to be strong.
 template <int start_offset>
-class FlexibleBodyDescriptor final : public BodyDescriptorBase {
+class SuffixRangeBodyDescriptor : public BodyDescriptorBase {
  public:
   static const int kStartOffset = start_offset;
 
@@ -120,13 +135,30 @@ class FlexibleBodyDescriptor final : public BodyDescriptorBase {
     IteratePointers(obj, start_offset, object_size, v);
   }
 
+ private:
+  static inline int SizeOf(Map map, HeapObject object) {
+    // Has to be implemented by the subclass.
+    UNREACHABLE();
+  }
+};
+
+// This class describes a body of an object of a variable size
+// in which all pointer fields are located in the [start_offset, object_size)
+// interval.
+// All pointers have to be strong.
+template <int start_offset>
+class FlexibleBodyDescriptor : public SuffixRangeBodyDescriptor<start_offset> {
+ public:
   static inline int SizeOf(Map map, HeapObject object);
 };
 
 using StructBodyDescriptor = FlexibleBodyDescriptor<HeapObject::kHeaderSize>;
 
+// This class describes a body of an object in which all pointer fields are
+// located in the [start_offset, object_size) interval.
+// Pointers may be strong or may be MaybeObject-style weak pointers.
 template <int start_offset>
-class FlexibleWeakBodyDescriptor final : public BodyDescriptorBase {
+class SuffixRangeWeakBodyDescriptor : public BodyDescriptorBase {
  public:
   static const int kStartOffset = start_offset;
 
@@ -140,9 +172,40 @@ class FlexibleWeakBodyDescriptor final : public BodyDescriptorBase {
     IterateMaybeWeakPointers(obj, start_offset, object_size, v);
   }
 
+ private:
+  static inline int SizeOf(Map map, HeapObject object) {
+    // Has to be implemented by the subclass.
+    UNREACHABLE();
+  }
+};
+
+// This class describes a body of an object of a variable size
+// in which all pointer fields are located in the [start_offset, object_size)
+// interval.
+// Pointers may be strong or may be MaybeObject-style weak pointers.
+template <int start_offset>
+class FlexibleWeakBodyDescriptor
+    : public SuffixRangeWeakBodyDescriptor<start_offset> {
+ public:
   static inline int SizeOf(Map map, HeapObject object);
 };
 
+// This class describes a body of an object without any pointers.
+class DataOnlyBodyDescriptor : public BodyDescriptorBase {
+ public:
+  static bool IsValidSlot(Map map, HeapObject obj, int offset) { return false; }
+
+  template <typename ObjectVisitor>
+  static inline void IterateBody(Map map, HeapObject obj, int object_size,
+                                 ObjectVisitor* v) {}
+
+ private:
+  static inline int SizeOf(Map map, HeapObject object) {
+    // Has to be implemented by the subclass.
+    UNREACHABLE();
+  }
+};
+
 // This class describes a body of an object which has a parent class that also
 // has a body descriptor. This represents a union of the parent's body
 // descriptor, and a new descriptor for the child -- so, both parent and child's
@@ -180,10 +243,6 @@ class SubclassBodyDescriptor final : public BodyDescriptorBase {
   }
 };
 
-#define TORQUE_BODY_DESCRIPTOR_LIST_ADAPTER(V, TYPE, TypeName) V(TYPE, TypeName)
-#define TORQUE_BODY_DESCRIPTOR_LIST(V) \
-  TORQUE_BODY_DESCRIPTOR_LIST_GENERATOR(TORQUE_BODY_DESCRIPTOR_LIST_ADAPTER, V)
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/objects-definitions.h b/deps/v8/src/objects/objects-definitions.h
index a830e13ed14..8a990cbc631 100644
--- a/deps/v8/src/objects/objects-definitions.h
+++ b/deps/v8/src/objects/objects-definitions.h
@@ -157,7 +157,8 @@ namespace internal {
     wasm_exported_function_data)                                              \
   V(_, WASM_INDIRECT_FUNCTION_TABLE_TYPE, WasmIndirectFunctionTable,          \
     wasm_indirect_function_table)                                             \
-  V(_, WASM_JS_FUNCTION_DATA_TYPE, WasmJSFunctionData, wasm_js_function_data)
+  V(_, WASM_JS_FUNCTION_DATA_TYPE, WasmJSFunctionData, wasm_js_function_data) \
+  V(_, WASM_VALUE_TYPE, WasmValue, wasm_value)
 
 #define STRUCT_LIST_GENERATOR(V, _) STRUCT_LIST_GENERATOR_BASE(V, _)
 
@@ -174,15 +175,6 @@ namespace internal {
 // Produces (Map, struct_name_map, StructNameMap) entries
 #define STRUCT_MAPS_LIST(V) STRUCT_LIST_GENERATOR(STRUCT_MAPS_LIST_ADAPTER, V)
 
-// Adapts one STRUCT_LIST_GENERATOR entry to the STRUCT_LIST entry
-#define TORQUE_INTERNAL_CLASS_LIST_MAPS_ADAPTER(V, NAME, Name, name) \
-  V(Map, name##_map, Name##Map)
-
-// Produces (NAME, Name, name) entries.
-#define TORQUE_INTERNAL_CLASS_MAPS_LIST(V) \
-  TORQUE_INTERNAL_CLASS_LIST_GENERATOR(    \
-      TORQUE_INTERNAL_CLASS_LIST_MAPS_ADAPTER, V)
-
 //
 // The following macros define list of allocation size objects and list of
 // their maps.
diff --git a/deps/v8/src/objects/objects-inl.h b/deps/v8/src/objects/objects-inl.h
index 9877b67c19d..56465b179ee 100644
--- a/deps/v8/src/objects/objects-inl.h
+++ b/deps/v8/src/objects/objects-inl.h
@@ -67,10 +67,6 @@ int PropertyDetails::field_width_in_words() const {
   return representation().IsDouble() ? kDoubleSize / kTaggedSize : 1;
 }
 
-DEF_GETTER(HeapObject, IsSloppyArgumentsElements, bool) {
-  return IsFixedArrayExact(isolate);
-}
-
 DEF_GETTER(HeapObject, IsClassBoilerplate, bool) {
   return IsFixedArrayExact(isolate);
 }
diff --git a/deps/v8/src/objects/objects.cc b/deps/v8/src/objects/objects.cc
index c4556296512..0656200ab8e 100644
--- a/deps/v8/src/objects/objects.cc
+++ b/deps/v8/src/objects/objects.cc
@@ -123,10 +123,9 @@
 #include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-objects.h"
 #include "src/zone/zone.h"
-
 #include "torque-generated/class-definitions-tq-inl.h"
+#include "torque-generated/exported-class-definitions-tq-inl.h"
 #include "torque-generated/internal-class-definitions-tq-inl.h"
-#include "torque-generated/objects-body-descriptors-tq-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -2278,12 +2277,11 @@ int HeapObject::SizeFromMap(Map map) const {
     PreparseData data = PreparseData::unchecked_cast(*this);
     return PreparseData::SizeFor(data.data_length(), data.children_length());
   }
-#define MAKE_TORQUE_SIZE_FOR(TYPE, TypeName)             \
-  if (instance_type == TYPE) {                           \
-    TypeName instance = TypeName::unchecked_cast(*this); \
-    return TypeName::SizeFor(instance);                  \
+#define MAKE_TORQUE_SIZE_FOR(TYPE, TypeName)                \
+  if (instance_type == TYPE) {                              \
+    return TypeName::unchecked_cast(*this).AllocatedSize(); \
   }
-  TORQUE_BODY_DESCRIPTOR_LIST(MAKE_TORQUE_SIZE_FOR)
+  TORQUE_INSTANCE_TYPE_TO_BODY_DESCRIPTOR_LIST(MAKE_TORQUE_SIZE_FOR)
 #undef MAKE_TORQUE_SIZE_FOR
 
   if (instance_type == CODE_TYPE) {
@@ -2293,6 +2291,9 @@ int HeapObject::SizeFromMap(Map map) const {
     return CoverageInfo::SizeFor(
         CoverageInfo::unchecked_cast(*this).slot_count());
   }
+  if (instance_type == WASM_ARRAY_TYPE) {
+    return WasmArray::SizeFor(map, WasmArray::cast(*this).length());
+  }
   DCHECK_EQ(instance_type, EMBEDDER_DATA_ARRAY_TYPE);
   return EmbedderDataArray::SizeFor(
       EmbedderDataArray::unchecked_cast(*this).length());
@@ -2305,9 +2306,8 @@ bool HeapObject::NeedsRehashing() const {
     case TRANSITION_ARRAY_TYPE:
       return TransitionArray::cast(*this).number_of_entries() > 1;
     case ORDERED_HASH_MAP_TYPE:
-      return OrderedHashMap::cast(*this).NumberOfElements() > 0;
     case ORDERED_HASH_SET_TYPE:
-      return OrderedHashSet::cast(*this).NumberOfElements() > 0;
+      return false;  // We'll rehash from the JSMap or JSSet referencing them.
     case NAME_DICTIONARY_TYPE:
     case GLOBAL_DICTIONARY_TYPE:
     case NUMBER_DICTIONARY_TYPE:
@@ -2317,6 +2317,8 @@ bool HeapObject::NeedsRehashing() const {
     case SMALL_ORDERED_HASH_MAP_TYPE:
     case SMALL_ORDERED_HASH_SET_TYPE:
     case SMALL_ORDERED_NAME_DICTIONARY_TYPE:
+    case JS_MAP_TYPE:
+    case JS_SET_TYPE:
       return true;
     default:
       return false;
@@ -2326,10 +2328,13 @@ bool HeapObject::NeedsRehashing() const {
 bool HeapObject::CanBeRehashed() const {
   DCHECK(NeedsRehashing());
   switch (map().instance_type()) {
+    case JS_MAP_TYPE:
+    case JS_SET_TYPE:
+      return true;
     case ORDERED_HASH_MAP_TYPE:
     case ORDERED_HASH_SET_TYPE:
+      UNREACHABLE();  // We'll rehash from the JSMap or JSSet referencing them.
     case ORDERED_NAME_DICTIONARY_TYPE:
-      // TODO(yangguo): actually support rehashing OrderedHash{Map,Set}.
       return false;
     case NAME_DICTIONARY_TYPE:
     case GLOBAL_DICTIONARY_TYPE:
@@ -2353,7 +2358,8 @@ bool HeapObject::CanBeRehashed() const {
   return false;
 }
 
-void HeapObject::RehashBasedOnMap(ReadOnlyRoots roots) {
+void HeapObject::RehashBasedOnMap(LocalIsolateWrapper isolate) {
+  ReadOnlyRoots roots = ReadOnlyRoots(isolate);
   switch (map().instance_type()) {
     case HASH_TABLE_TYPE:
       UNREACHABLE();
@@ -2385,6 +2391,19 @@ void HeapObject::RehashBasedOnMap(ReadOnlyRoots roots) {
     case SMALL_ORDERED_HASH_SET_TYPE:
       DCHECK_EQ(0, SmallOrderedHashSet::cast(*this).NumberOfElements());
       break;
+    case ORDERED_HASH_MAP_TYPE:
+    case ORDERED_HASH_SET_TYPE:
+      UNREACHABLE();  // We'll rehash from the JSMap or JSSet referencing them.
+    case JS_MAP_TYPE: {
+      DCHECK(isolate.is_main_thread());
+      JSMap::cast(*this).Rehash(isolate.main_thread());
+      break;
+    }
+    case JS_SET_TYPE: {
+      DCHECK(isolate.is_main_thread());
+      JSSet::cast(*this).Rehash(isolate.main_thread());
+      break;
+    }
     case SMALL_ORDERED_NAME_DICTIONARY_TYPE:
       DCHECK_EQ(0, SmallOrderedNameDictionary::cast(*this).NumberOfElements());
       break;
@@ -3106,20 +3125,10 @@ MaybeHandle<JSProxy> JSProxy::New(Isolate* isolate, Handle<Object> target,
     THROW_NEW_ERROR(isolate, NewTypeError(MessageTemplate::kProxyNonObject),
                     JSProxy);
   }
-  if (target->IsJSProxy() && JSProxy::cast(*target).IsRevoked()) {
-    THROW_NEW_ERROR(isolate,
-                    NewTypeError(MessageTemplate::kProxyHandlerOrTargetRevoked),
-                    JSProxy);
-  }
   if (!handler->IsJSReceiver()) {
     THROW_NEW_ERROR(isolate, NewTypeError(MessageTemplate::kProxyNonObject),
                     JSProxy);
   }
-  if (handler->IsJSProxy() && JSProxy::cast(*handler).IsRevoked()) {
-    THROW_NEW_ERROR(isolate,
-                    NewTypeError(MessageTemplate::kProxyHandlerOrTargetRevoked),
-                    JSProxy);
-  }
   return isolate->factory()->NewJSProxy(Handle<JSReceiver>::cast(target),
                                         Handle<JSReceiver>::cast(handler));
 }
@@ -4212,7 +4221,8 @@ Handle<RegExpMatchInfo> RegExpMatchInfo::ReserveCaptures(
     Isolate* isolate, Handle<RegExpMatchInfo> match_info, int capture_count) {
   DCHECK_GE(match_info->length(), kLastMatchOverhead);
 
-  int capture_register_count = (capture_count + 1) * 2;
+  int capture_register_count =
+      JSRegExp::RegistersForCaptureCount(capture_count);
   const int required_length = kFirstCaptureIndex + capture_register_count;
   Handle<RegExpMatchInfo> result = Handle<RegExpMatchInfo>::cast(
       EnsureSpaceInFixedArray(isolate, match_info, required_length));
@@ -4247,9 +4257,8 @@ Handle<FrameArray> FrameArray::AppendWasmFrame(
     int wasm_function_index, wasm::WasmCode* code, int offset, int flags) {
   // This must be either a compiled or interpreted wasm frame, or an asm.js
   // frame (which is always compiled).
-  DCHECK_EQ(1, ((flags & kIsWasmInterpretedFrame) != 0) +
-                   ((flags & kIsWasmCompiledFrame) != 0) +
-                   ((flags & kIsAsmJsWasmFrame) != 0));
+  DCHECK_EQ(1,
+            ((flags & kIsWasmFrame) != 0) + ((flags & kIsAsmJsWasmFrame) != 0));
   Isolate* isolate = wasm_instance->GetIsolate();
   const int frame_count = in->FrameCount();
   const int new_length = LengthFor(frame_count + 1);
@@ -4919,14 +4928,14 @@ Object Script::GetNameOrSourceURL() {
 
 template <typename LocalIsolate>
 MaybeHandle<SharedFunctionInfo> Script::FindSharedFunctionInfo(
-    LocalIsolate* isolate, const FunctionLiteral* fun) {
-  CHECK_NE(fun->function_literal_id(), kFunctionLiteralIdInvalid);
+    LocalIsolate* isolate, int function_literal_id) {
+  CHECK_NE(function_literal_id, kFunctionLiteralIdInvalid);
   // If this check fails, the problem is most probably the function id
   // renumbering done by AstFunctionLiteralIdReindexer; in particular, that
   // AstTraversalVisitor doesn't recurse properly in the construct which
   // triggers the mismatch.
-  CHECK_LT(fun->function_literal_id(), shared_function_infos().length());
-  MaybeObject shared = shared_function_infos().Get(fun->function_literal_id());
+  CHECK_LT(function_literal_id, shared_function_infos().length());
+  MaybeObject shared = shared_function_infos().Get(function_literal_id);
   HeapObject heap_object;
   if (!shared->GetHeapObject(&heap_object) ||
       heap_object.IsUndefined(isolate)) {
@@ -4935,9 +4944,9 @@ MaybeHandle<SharedFunctionInfo> Script::FindSharedFunctionInfo(
   return handle(SharedFunctionInfo::cast(heap_object), isolate);
 }
 template MaybeHandle<SharedFunctionInfo> Script::FindSharedFunctionInfo(
-    Isolate* isolate, const FunctionLiteral* fun);
+    Isolate* isolate, int function_literal_id);
 template MaybeHandle<SharedFunctionInfo> Script::FindSharedFunctionInfo(
-    OffThreadIsolate* isolate, const FunctionLiteral* fun);
+    OffThreadIsolate* isolate, int function_literal_id);
 
 Script::Iterator::Iterator(Isolate* isolate)
     : iterator_(isolate->heap()->script_list()) {}
@@ -5179,9 +5188,9 @@ bool SharedFunctionInfo::PassesFilter(const char* raw_filter) {
 }
 
 bool SharedFunctionInfo::HasSourceCode() const {
-  Isolate* isolate = GetIsolate();
-  return !script().IsUndefined(isolate) &&
-         !Script::cast(script()).source().IsUndefined(isolate);
+  ReadOnlyRoots roots = GetReadOnlyRoots();
+  return !script().IsUndefined(roots) &&
+         !Script::cast(script()).source().IsUndefined(roots);
 }
 
 void SharedFunctionInfo::DiscardCompiledMetadata(
@@ -5726,17 +5735,27 @@ const char* AllocationSite::PretenureDecisionName(PretenureDecision decision) {
   return nullptr;
 }
 
+// static
+bool JSArray::MayHaveReadOnlyLength(Map js_array_map) {
+  DCHECK(js_array_map.IsJSArrayMap());
+  if (js_array_map.is_dictionary_map()) return true;
+
+  // Fast path: "length" is the first fast property of arrays with non
+  // dictionary properties. Since it's not configurable, it's guaranteed to be
+  // the first in the descriptor array.
+  InternalIndex first(0);
+  DCHECK(js_array_map.instance_descriptors().GetKey(first) ==
+         js_array_map.GetReadOnlyRoots().length_string());
+  return js_array_map.instance_descriptors().GetDetails(first).IsReadOnly();
+}
+
 bool JSArray::HasReadOnlyLength(Handle<JSArray> array) {
   Map map = array->map();
-  // Fast path: "length" is the first fast property of arrays. Since it's not
-  // configurable, it's guaranteed to be the first in the descriptor array.
-  if (!map.is_dictionary_map()) {
-    InternalIndex first(0);
-    DCHECK(map.instance_descriptors().GetKey(first) ==
-           array->GetReadOnlyRoots().length_string());
-    return map.instance_descriptors().GetDetails(first).IsReadOnly();
-  }
 
+  // If map guarantees that there can't be a read-only length, we are done.
+  if (!MayHaveReadOnlyLength(map)) return false;
+
+  // Look at the object.
   Isolate* isolate = array->GetIsolate();
   LookupIterator it(isolate, array, isolate->factory()->length_string(), array,
                     LookupIterator::OWN_SKIP_INTERCEPTOR);
@@ -5875,13 +5894,13 @@ class StringSharedKey : public HashTableKey {
 };
 
 v8::Promise::PromiseState JSPromise::status() const {
-  int value = flags() & kStatusMask;
+  int value = flags() & StatusBits::kMask;
   DCHECK(value == 0 || value == 1 || value == 2);
   return static_cast<v8::Promise::PromiseState>(value);
 }
 
 void JSPromise::set_status(Promise::PromiseState status) {
-  int value = flags() & ~kStatusMask;
+  int value = flags() & ~StatusBits::kMask;
   set_flags(value | status);
 }
 
@@ -5889,7 +5908,7 @@ void JSPromise::set_status(Promise::PromiseState status) {
 const char* JSPromise::Status(v8::Promise::PromiseState status) {
   switch (status) {
     case v8::Promise::kFulfilled:
-      return "resolved";
+      return "fulfilled";
     case v8::Promise::kPending:
       return "pending";
     case v8::Promise::kRejected:
@@ -5899,11 +5918,11 @@ const char* JSPromise::Status(v8::Promise::PromiseState status) {
 }
 
 int JSPromise::async_task_id() const {
-  return AsyncTaskIdField::decode(flags());
+  return AsyncTaskIdBits::decode(flags());
 }
 
 void JSPromise::set_async_task_id(int id) {
-  set_flags(AsyncTaskIdField::update(flags(), id));
+  set_flags(AsyncTaskIdBits::update(flags(), id));
 }
 
 // static
@@ -5983,6 +6002,7 @@ Handle<Object> JSPromise::Reject(Handle<JSPromise> promise,
                                  PromiseReaction::kReject);
 }
 
+// https://tc39.es/ecma262/#sec-promise-resolve-functions
 // static
 MaybeHandle<Object> JSPromise::Resolve(Handle<JSPromise> promise,
                                        Handle<Object> resolution) {
@@ -5991,7 +6011,7 @@ MaybeHandle<Object> JSPromise::Resolve(Handle<JSPromise> promise,
   isolate->RunPromiseHook(PromiseHookType::kResolve, promise,
                           isolate->factory()->undefined_value());
 
-  // 6. If SameValue(resolution, promise) is true, then
+  // 7. If SameValue(resolution, promise) is true, then
   if (promise.is_identical_to(resolution)) {
     // a. Let selfResolutionError be a newly created TypeError object.
     Handle<Object> self_resolution_error = isolate->factory()->NewTypeError(
@@ -6000,13 +6020,13 @@ MaybeHandle<Object> JSPromise::Resolve(Handle<JSPromise> promise,
     return Reject(promise, self_resolution_error);
   }
 
-  // 7. If Type(resolution) is not Object, then
+  // 8. If Type(resolution) is not Object, then
   if (!resolution->IsJSReceiver()) {
     // a. Return FulfillPromise(promise, resolution).
     return Fulfill(promise, resolution);
   }
 
-  // 8. Let then be Get(resolution, "then").
+  // 9. Let then be Get(resolution, "then").
   MaybeHandle<Object> then;
   Handle<JSReceiver> receiver(Handle<JSReceiver>::cast(resolution));
 
@@ -6029,7 +6049,7 @@ MaybeHandle<Object> JSPromise::Resolve(Handle<JSPromise> promise,
                                    isolate->factory()->then_string());
   }
 
-  // 9. If then is an abrupt completion, then
+  // 10. If then is an abrupt completion, then
   Handle<Object> then_action;
   if (!then.ToHandle(&then_action)) {
     // a. Return RejectPromise(promise, then.[[Value]]).
@@ -6038,19 +6058,15 @@ MaybeHandle<Object> JSPromise::Resolve(Handle<JSPromise> promise,
     return Reject(promise, reason, false);
   }
 
-  // 10. Let thenAction be then.[[Value]].
-  // 11. If IsCallable(thenAction) is false, then
+  // 11. Let thenAction be then.[[Value]].
+  // 12. If IsCallable(thenAction) is false, then
   if (!then_action->IsCallable()) {
     // a. Return FulfillPromise(promise, resolution).
     return Fulfill(promise, resolution);
   }
 
-  // 12. Perform EnqueueJob("PromiseJobs", PromiseResolveThenableJob,
-  //                        «promise, resolution, thenAction»).
-
-  // According to HTML, we use the context of the then function (|thenAction|)
-  // as the context of the microtask. See step 3 of HTML's EnqueueJob:
-  // https://html.spec.whatwg.org/C/#enqueuejob(queuename,-job,-arguments)
+  // 13. Let job be NewPromiseResolveThenableJob(promise, resolution,
+  //                                             thenAction).
   Handle<NativeContext> then_context;
   if (!JSReceiver::GetContextForMicrotask(Handle<JSReceiver>::cast(then_action))
            .ToHandle(&then_context)) {
@@ -6059,8 +6075,8 @@ MaybeHandle<Object> JSPromise::Resolve(Handle<JSPromise> promise,
 
   Handle<PromiseResolveThenableJobTask> task =
       isolate->factory()->NewPromiseResolveThenableJobTask(
-          promise, Handle<JSReceiver>::cast(then_action),
-          Handle<JSReceiver>::cast(resolution), then_context);
+          promise, Handle<JSReceiver>::cast(resolution),
+          Handle<JSReceiver>::cast(then_action), then_context);
   if (isolate->debug()->is_active() && resolution->IsJSPromise()) {
     // Mark the dependency of the new {promise} on the {resolution}.
     Object::SetProperty(isolate, resolution,
@@ -6071,7 +6087,7 @@ MaybeHandle<Object> JSPromise::Resolve(Handle<JSPromise> promise,
   MicrotaskQueue* microtask_queue = then_context->microtask_queue();
   if (microtask_queue) microtask_queue->EnqueueMicrotask(*task);
 
-  // 13. Return undefined.
+  // 15. Return undefined.
   return isolate->factory()->undefined_value();
 }
 
@@ -7156,7 +7172,7 @@ MaybeHandle<SharedFunctionInfo> CompilationCacheTable::LookupScript(
     Handle<Context> native_context, LanguageMode language_mode) {
   // We use the empty function SFI as part of the key. Although the
   // empty_function is native context dependent, the SFI is de-duped on
-  // snapshot builds by the PartialSnapshotCache, and so this does not prevent
+  // snapshot builds by the StartupObjectCache, and so this does not prevent
   // reuse of scripts in the compilation cache across native contexts.
   Handle<SharedFunctionInfo> shared(native_context->empty_function().shared(),
                                     native_context->GetIsolate());
@@ -7214,7 +7230,7 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutScript(
   Isolate* isolate = native_context->GetIsolate();
   // We use the empty function SFI as part of the key. Although the
   // empty_function is native context dependent, the SFI is de-duped on
-  // snapshot builds by the PartialSnapshotCache, and so this does not prevent
+  // snapshot builds by the StartupObjectCache, and so this does not prevent
   // reuse of scripts in the compilation cache across native contexts.
   Handle<SharedFunctionInfo> shared(native_context->empty_function().shared(),
                                     isolate);
@@ -7864,6 +7880,13 @@ void JSSet::Clear(Isolate* isolate, Handle<JSSet> set) {
   set->set_table(*table);
 }
 
+void JSSet::Rehash(Isolate* isolate) {
+  Handle<OrderedHashSet> table_handle(OrderedHashSet::cast(table()), isolate);
+  Handle<OrderedHashSet> new_table =
+      OrderedHashSet::Rehash(isolate, table_handle).ToHandleChecked();
+  set_table(*new_table);
+}
+
 void JSMap::Initialize(Handle<JSMap> map, Isolate* isolate) {
   Handle<OrderedHashMap> table = isolate->factory()->NewOrderedHashMap();
   map->set_table(*table);
@@ -7875,6 +7898,13 @@ void JSMap::Clear(Isolate* isolate, Handle<JSMap> map) {
   map->set_table(*table);
 }
 
+void JSMap::Rehash(Isolate* isolate) {
+  Handle<OrderedHashMap> table_handle(OrderedHashMap::cast(table()), isolate);
+  Handle<OrderedHashMap> new_table =
+      OrderedHashMap::Rehash(isolate, table_handle).ToHandleChecked();
+  set_table(*new_table);
+}
+
 void JSWeakCollection::Initialize(Handle<JSWeakCollection> weak_collection,
                                   Isolate* isolate) {
   Handle<EphemeronHashTable> table = EphemeronHashTable::New(isolate, 0);
@@ -8309,48 +8339,50 @@ EXTERN_DEFINE_BASE_NAME_DICTIONARY(GlobalDictionary, GlobalDictionaryShape)
 #undef EXTERN_DEFINE_DICTIONARY
 #undef EXTERN_DEFINE_BASE_NAME_DICTIONARY
 
-Maybe<bool> JSFinalizationRegistry::Cleanup(
-    Isolate* isolate, Handle<JSFinalizationRegistry> finalization_registry,
-    Handle<Object> cleanup) {
-  DCHECK(cleanup->IsCallable());
-  // Attempt to shrink key_map now, as unregister tokens are held weakly and the
-  // map is not shrinkable when sweeping dead tokens during GC itself.
-  if (!finalization_registry->key_map().IsUndefined(isolate)) {
-    Handle<SimpleNumberDictionary> key_map =
-        handle(SimpleNumberDictionary::cast(finalization_registry->key_map()),
-               isolate);
-    key_map = SimpleNumberDictionary::Shrink(isolate, key_map);
-    finalization_registry->set_key_map(*key_map);
-  }
-
-  // It's possible that the cleared_cells list is empty, since
-  // FinalizationRegistry.unregister() removed all its elements before this task
-  // ran. In that case, don't call the cleanup function.
-  if (!finalization_registry->cleared_cells().IsUndefined(isolate)) {
-    // Construct the iterator.
-    Handle<JSFinalizationRegistryCleanupIterator> iterator;
-    {
-      Handle<Map> cleanup_iterator_map(
-          isolate->native_context()
-              ->js_finalization_registry_cleanup_iterator_map(),
-          isolate);
-      iterator = Handle<JSFinalizationRegistryCleanupIterator>::cast(
-          isolate->factory()->NewJSObjectFromMap(
-              cleanup_iterator_map, AllocationType::kYoung,
-              Handle<AllocationSite>::null()));
-      iterator->set_finalization_registry(*finalization_registry);
-    }
-    Handle<Object> args[] = {iterator};
-    if (Execution::Call(
-            isolate, cleanup,
-            handle(ReadOnlyRoots(isolate).undefined_value(), isolate), 1, args)
-            .is_null()) {
-      return Nothing<bool>();
+void JSFinalizationRegistry::RemoveCellFromUnregisterTokenMap(
+    Isolate* isolate, Address raw_finalization_registry,
+    Address raw_weak_cell) {
+  DisallowHeapAllocation no_gc;
+  JSFinalizationRegistry finalization_registry =
+      JSFinalizationRegistry::cast(Object(raw_finalization_registry));
+  WeakCell weak_cell = WeakCell::cast(Object(raw_weak_cell));
+  DCHECK(!weak_cell.unregister_token().IsUndefined(isolate));
+
+  // Remove weak_cell from the linked list of other WeakCells with the same
+  // unregister token and remove its unregister token from key_map if necessary
+  // without shrinking it. Since shrinking may allocate, it is performed by the
+  // caller after looping, or on exception.
+  if (weak_cell.key_list_prev().IsUndefined(isolate)) {
+    SimpleNumberDictionary key_map =
+        SimpleNumberDictionary::cast(finalization_registry.key_map());
+    Object unregister_token = weak_cell.unregister_token();
+    uint32_t key = Smi::ToInt(unregister_token.GetHash());
+    InternalIndex entry = key_map.FindEntry(isolate, key);
+    DCHECK(entry.is_found());
+
+    if (weak_cell.key_list_next().IsUndefined(isolate)) {
+      // weak_cell is the only one associated with its key; remove the key
+      // from the hash table.
+      key_map.ClearEntry(entry);
+      key_map.ElementRemoved();
+    } else {
+      // weak_cell is the list head for its key; we need to change the value
+      // of the key in the hash table.
+      WeakCell next = WeakCell::cast(weak_cell.key_list_next());
+      DCHECK_EQ(next.key_list_prev(), weak_cell);
+      next.set_key_list_prev(ReadOnlyRoots(isolate).undefined_value());
+      weak_cell.set_key_list_next(ReadOnlyRoots(isolate).undefined_value());
+      key_map.ValueAtPut(entry, next);
+    }
+  } else {
+    // weak_cell is somewhere in the middle of its key list.
+    WeakCell prev = WeakCell::cast(weak_cell.key_list_prev());
+    prev.set_key_list_next(weak_cell.key_list_next());
+    if (!weak_cell.key_list_next().IsUndefined()) {
+      WeakCell next = WeakCell::cast(weak_cell.key_list_next());
+      next.set_key_list_prev(weak_cell.key_list_prev());
     }
-    // TODO(marja): (spec): Should the iterator be invalidated after the
-    // function returns?
   }
-  return Just(true);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/objects.h b/deps/v8/src/objects/objects.h
index ef437446fd6..a52865c23b3 100644
--- a/deps/v8/src/objects/objects.h
+++ b/deps/v8/src/objects/objects.h
@@ -181,6 +181,7 @@
 //         - SourceTextModule
 //         - SyntheticModule
 //       - SourceTextModuleInfoEntry
+//       - WasmValue
 //     - FeedbackCell
 //     - FeedbackVector
 //     - PreparseData
diff --git a/deps/v8/src/objects/oddball.h b/deps/v8/src/objects/oddball.h
index 4f32e157941..5f0c7ce0015 100644
--- a/deps/v8/src/objects/oddball.h
+++ b/deps/v8/src/objects/oddball.h
@@ -47,6 +47,7 @@ class Oddball : public TorqueGeneratedOddball<Oddball, PrimitiveHeapObject> {
   static const byte kOptimizedOut = 9;
   static const byte kStaleRegister = 10;
   static const byte kSelfReferenceMarker = 10;
+  static const byte kBasicBlockCountersMarker = 11;
 
   static_assert(kStartOfWeakFieldsOffset == kEndOfWeakFieldsOffset,
                 "Ensure BodyDescriptor does not need to handle weak fields.");
diff --git a/deps/v8/src/objects/ordered-hash-table.cc b/deps/v8/src/objects/ordered-hash-table.cc
index cbf3ba373b9..d3250bd92db 100644
--- a/deps/v8/src/objects/ordered-hash-table.cc
+++ b/deps/v8/src/objects/ordered-hash-table.cc
@@ -194,6 +194,13 @@ HeapObject OrderedHashMap::GetEmpty(ReadOnlyRoots ro_roots) {
   return ro_roots.empty_ordered_hash_map();
 }
 
+template <class Derived, int entrysize>
+MaybeHandle<Derived> OrderedHashTable<Derived, entrysize>::Rehash(
+    Isolate* isolate, Handle<Derived> table) {
+  return OrderedHashTable<Derived, entrysize>::Rehash(isolate, table,
+                                                      table->Capacity());
+}
+
 template <class Derived, int entrysize>
 MaybeHandle<Derived> OrderedHashTable<Derived, entrysize>::Rehash(
     Isolate* isolate, Handle<Derived> table, int new_capacity) {
@@ -250,6 +257,20 @@ MaybeHandle<OrderedHashSet> OrderedHashSet::Rehash(Isolate* isolate,
                                                      new_capacity);
 }
 
+MaybeHandle<OrderedHashSet> OrderedHashSet::Rehash(
+    Isolate* isolate, Handle<OrderedHashSet> table) {
+  return OrderedHashTable<
+      OrderedHashSet, OrderedHashSet::kEntrySizeWithoutChain>::Rehash(isolate,
+                                                                      table);
+}
+
+MaybeHandle<OrderedHashMap> OrderedHashMap::Rehash(
+    Isolate* isolate, Handle<OrderedHashMap> table) {
+  return OrderedHashTable<
+      OrderedHashMap, OrderedHashMap::kEntrySizeWithoutChain>::Rehash(isolate,
+                                                                      table);
+}
+
 MaybeHandle<OrderedHashMap> OrderedHashMap::Rehash(Isolate* isolate,
                                                    Handle<OrderedHashMap> table,
                                                    int new_capacity) {
diff --git a/deps/v8/src/objects/ordered-hash-table.h b/deps/v8/src/objects/ordered-hash-table.h
index b587960432c..5f3c45a110a 100644
--- a/deps/v8/src/objects/ordered-hash-table.h
+++ b/deps/v8/src/objects/ordered-hash-table.h
@@ -138,6 +138,7 @@ class OrderedHashTable : public FixedArray {
 
   // The extra +1 is for linking the bucket chains together.
   static const int kEntrySize = entrysize + 1;
+  static const int kEntrySizeWithoutChain = entrysize;
   static const int kChainOffset = entrysize;
 
   static const int kNotFound = -1;
@@ -200,6 +201,8 @@ class OrderedHashTable : public FixedArray {
   static MaybeHandle<Derived> Allocate(
       Isolate* isolate, int capacity,
       AllocationType allocation = AllocationType::kYoung);
+
+  static MaybeHandle<Derived> Rehash(Isolate* isolate, Handle<Derived> table);
   static MaybeHandle<Derived> Rehash(Isolate* isolate, Handle<Derived> table,
                                      int new_capacity);
 
@@ -244,6 +247,8 @@ class V8_EXPORT_PRIVATE OrderedHashSet
   static MaybeHandle<OrderedHashSet> Rehash(Isolate* isolate,
                                             Handle<OrderedHashSet> table,
                                             int new_capacity);
+  static MaybeHandle<OrderedHashSet> Rehash(Isolate* isolate,
+                                            Handle<OrderedHashSet> table);
   static MaybeHandle<OrderedHashSet> Allocate(
       Isolate* isolate, int capacity,
       AllocationType allocation = AllocationType::kYoung);
@@ -273,6 +278,8 @@ class V8_EXPORT_PRIVATE OrderedHashMap
   static MaybeHandle<OrderedHashMap> Rehash(Isolate* isolate,
                                             Handle<OrderedHashMap> table,
                                             int new_capacity);
+  static MaybeHandle<OrderedHashMap> Rehash(Isolate* isolate,
+                                            Handle<OrderedHashMap> table);
   Object ValueAt(int entry);
 
   // This takes and returns raw Address values containing tagged Object
diff --git a/deps/v8/src/objects/promise.tq b/deps/v8/src/objects/promise.tq
index 391f742e444..90ef565cad0 100644
--- a/deps/v8/src/objects/promise.tq
+++ b/deps/v8/src/objects/promise.tq
@@ -72,6 +72,6 @@ extern class PromiseRejectReactionJobTask extends PromiseReactionJobTask {
 extern class PromiseResolveThenableJobTask extends Microtask {
   context: Context;
   promise_to_resolve: JSPromise;
-  then: JSReceiver;
   thenable: JSReceiver;
+  then: JSReceiver;
 }
diff --git a/deps/v8/src/objects/property-descriptor.cc b/deps/v8/src/objects/property-descriptor.cc
index 9c9a71849f4..a14601bc74b 100644
--- a/deps/v8/src/objects/property-descriptor.cc
+++ b/deps/v8/src/objects/property-descriptor.cc
@@ -43,29 +43,29 @@ bool GetPropertyIfPresent(Handle<JSReceiver> receiver, Handle<String> name,
 bool ToPropertyDescriptorFastPath(Isolate* isolate, Handle<JSReceiver> obj,
                                   PropertyDescriptor* desc) {
   if (!obj->IsJSObject()) return false;
-  Map map = Handle<JSObject>::cast(obj)->map();
-  if (map.instance_type() != JS_OBJECT_TYPE) return false;
-  if (map.is_access_check_needed()) return false;
-  if (map.prototype() != *isolate->initial_object_prototype()) return false;
+  Handle<Map> map(Handle<JSObject>::cast(obj)->map(), isolate);
+  if (map->instance_type() != JS_OBJECT_TYPE) return false;
+  if (map->is_access_check_needed()) return false;
+  if (map->prototype() != *isolate->initial_object_prototype()) return false;
   // During bootstrapping, the object_function_prototype_map hasn't been
   // set up yet.
   if (isolate->bootstrapper()->IsActive()) return false;
-  if (JSObject::cast(map.prototype()).map() !=
+  if (JSObject::cast(map->prototype()).map() !=
       isolate->native_context()->object_function_prototype_map()) {
     return false;
   }
   // TODO(jkummerow): support dictionary properties?
-  if (map.is_dictionary_map()) return false;
+  if (map->is_dictionary_map()) return false;
   Handle<DescriptorArray> descs =
-      Handle<DescriptorArray>(map.instance_descriptors(), isolate);
-  for (InternalIndex i : map.IterateOwnDescriptors()) {
+      Handle<DescriptorArray>(map->instance_descriptors(), isolate);
+  for (InternalIndex i : map->IterateOwnDescriptors()) {
     PropertyDetails details = descs->GetDetails(i);
     Handle<Object> value;
     if (details.location() == kField) {
       if (details.kind() == kData) {
         value = JSObject::FastPropertyAt(Handle<JSObject>::cast(obj),
                                          details.representation(),
-                                         FieldIndex::ForDescriptor(map, i));
+                                         FieldIndex::ForDescriptor(*map, i));
       } else {
         DCHECK_EQ(kAccessor, details.kind());
         // Bail out to slow path.
diff --git a/deps/v8/src/objects/prototype-info-inl.h b/deps/v8/src/objects/prototype-info-inl.h
index 80efa862c28..8c93b21f24b 100644
--- a/deps/v8/src/objects/prototype-info-inl.h
+++ b/deps/v8/src/objects/prototype-info-inl.h
@@ -20,9 +20,7 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(PrototypeInfo, Struct)
-
-CAST_ACCESSOR(PrototypeInfo)
+TQ_OBJECT_CONSTRUCTORS_IMPL(PrototypeInfo)
 
 Map PrototypeInfo::ObjectCreateMap() {
   return Map::cast(object_create_map()->GetHeapObjectAssumeWeak());
@@ -39,14 +37,8 @@ bool PrototypeInfo::HasObjectCreateMap() {
   return cache->IsWeak();
 }
 
-ACCESSORS(PrototypeInfo, module_namespace, Object, kJsModuleNamespaceOffset)
-ACCESSORS(PrototypeInfo, prototype_users, Object, kPrototypeUsersOffset)
-ACCESSORS(PrototypeInfo, prototype_chain_enum_cache, Object,
-          kPrototypeChainEnumCacheOffset)
-WEAK_ACCESSORS(PrototypeInfo, object_create_map, kObjectCreateMapOffset)
-SMI_ACCESSORS(PrototypeInfo, registry_slot, kRegistrySlotOffset)
-SMI_ACCESSORS(PrototypeInfo, bit_field, kBitFieldOffset)
-BOOL_ACCESSORS(PrototypeInfo, bit_field, should_be_fast_map, kShouldBeFastBit)
+BOOL_ACCESSORS(PrototypeInfo, bit_field, should_be_fast_map,
+               ShouldBeFastBit::kShift)
 
 void PrototypeUsers::MarkSlotEmpty(WeakArrayList array, int index) {
   DCHECK_GT(index, 0);
diff --git a/deps/v8/src/objects/prototype-info.h b/deps/v8/src/objects/prototype-info.h
index ab238bd9c2f..4e665a39c8d 100644
--- a/deps/v8/src/objects/prototype-info.h
+++ b/deps/v8/src/objects/prototype-info.h
@@ -8,6 +8,7 @@
 #include "src/objects/fixed-array.h"
 #include "src/objects/objects.h"
 #include "src/objects/struct.h"
+#include "torque-generated/bit-fields-tq.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -16,57 +17,29 @@ namespace v8 {
 namespace internal {
 
 // Container for metadata stored on each prototype map.
-class PrototypeInfo : public Struct {
+class PrototypeInfo
+    : public TorqueGeneratedPrototypeInfo<PrototypeInfo, Struct> {
  public:
   static const int UNREGISTERED = -1;
 
-  // [module_namespace]: A backpointer to JSModuleNamespace from its
-  // PrototypeInfo (or undefined). This field is only used for JSModuleNamespace
-  // maps.  TODO(jkummerow): Figure out if there's a way to store the namespace
-  // pointer elsewhere to save memory.
-  DECL_ACCESSORS(module_namespace, Object)
-
-  // [prototype_users]: WeakArrayList containing weak references to maps using
-  // this prototype, or Smi(0) if uninitialized.
-  DECL_ACCESSORS(prototype_users, Object)
-
-  DECL_ACCESSORS(prototype_chain_enum_cache, Object)
-
   // [object_create_map]: A field caching the map for Object.create(prototype).
   static inline void SetObjectCreateMap(Handle<PrototypeInfo> info,
                                         Handle<Map> map);
   inline Map ObjectCreateMap();
   inline bool HasObjectCreateMap();
 
-  // [registry_slot]: Slot in prototype's user registry where this user
-  // is stored. Returns UNREGISTERED if this prototype has not been registered.
-  inline int registry_slot() const;
-  inline void set_registry_slot(int slot);
-
-  // [bit_field]
-  inline int bit_field() const;
-  inline void set_bit_field(int bit_field);
-
   DECL_BOOLEAN_ACCESSORS(should_be_fast_map)
 
-  DECL_CAST(PrototypeInfo)
-
   // Dispatched behavior.
   DECL_PRINTER(PrototypeInfo)
   DECL_VERIFIER(PrototypeInfo)
 
-  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
-                                TORQUE_GENERATED_PROTOTYPE_INFO_FIELDS)
-
   // Bit field usage.
-  static const int kShouldBeFastBit = 0;
+  DEFINE_TORQUE_GENERATED_PROTOTYPE_INFO_FLAGS()
 
   class BodyDescriptor;
 
- private:
-  DECL_ACCESSORS(object_create_map, MaybeObject)
-
-  OBJECT_CONSTRUCTORS(PrototypeInfo, Struct);
+  TQ_OBJECT_CONSTRUCTORS(PrototypeInfo)
 };
 
 // A growing array with an additional API for marking slots "empty". When adding
diff --git a/deps/v8/src/objects/prototype-info.tq b/deps/v8/src/objects/prototype-info.tq
index 77ffa4358d7..28a5b90a829 100644
--- a/deps/v8/src/objects/prototype-info.tq
+++ b/deps/v8/src/objects/prototype-info.tq
@@ -2,14 +2,32 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+bitfield struct PrototypeInfoFlags extends uint31 {
+  should_be_fast: bool: 1 bit;
+}
+
+@generateCppClass
 extern class PrototypeInfo extends Struct {
-  js_module_namespace: JSModuleNamespace|Undefined;
+  // [module_namespace]: A backpointer to JSModuleNamespace from its
+  // PrototypeInfo (or undefined). This field is only used for JSModuleNamespace
+  // maps.  TODO(jkummerow): Figure out if there's a way to store the namespace
+  // pointer elsewhere to save memory.
+  module_namespace: JSModuleNamespace|Undefined;
+
+  // [prototype_users]: WeakArrayList containing weak references to maps using
+  // this prototype, or Smi(0) if uninitialized.
   prototype_users: WeakArrayList|Zero;
-  prototype_chain_enum_cache: FixedArray|Object|Undefined;
+
+  prototype_chain_enum_cache: FixedArray|Zero|Undefined;
+
+  // [registry_slot]: Slot in prototype's user registry where this user
+  // is stored. Returns UNREGISTERED if this prototype has not been registered.
   registry_slot: Smi;
-  validity_cell: Object;
+
+  // [object_create_map]: A field caching the map for Object.create(prototype).
   object_create_map: Weak<Map>|Undefined;
-  bit_field: Smi;
+
+  bit_field: SmiTagged<PrototypeInfoFlags>;
 }
 
 extern macro PrototypeInfoMapConstant(): Map;
diff --git a/deps/v8/src/objects/script-inl.h b/deps/v8/src/objects/script-inl.h
index 1e8b83798cb..ce0bd80a6dc 100644
--- a/deps/v8/src/objects/script-inl.h
+++ b/deps/v8/src/objects/script-inl.h
@@ -17,29 +17,16 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(Script, Struct)
+TQ_OBJECT_CONSTRUCTORS_IMPL(Script)
 
 NEVER_READ_ONLY_SPACE_IMPL(Script)
 
-CAST_ACCESSOR(Script)
-
-ACCESSORS(Script, source, Object, kSourceOffset)
-ACCESSORS(Script, name, Object, kNameOffset)
-SMI_ACCESSORS(Script, id, kIdOffset)
-SMI_ACCESSORS(Script, line_offset, kLineOffsetOffset)
-SMI_ACCESSORS(Script, column_offset, kColumnOffsetOffset)
-ACCESSORS(Script, context_data, Object, kContextOffset)
 SMI_ACCESSORS(Script, type, kScriptTypeOffset)
-ACCESSORS(Script, line_ends, Object, kLineEndsOffset)
 ACCESSORS_CHECKED(Script, eval_from_shared_or_wrapped_arguments, Object,
                   kEvalFromSharedOrWrappedArgumentsOffset,
                   this->type() != TYPE_WASM)
 SMI_ACCESSORS_CHECKED(Script, eval_from_position, kEvalFromPositionOffset,
                       this->type() != TYPE_WASM)
-SMI_ACCESSORS(Script, flags, kFlagsOffset)
-ACCESSORS(Script, source_url, Object, kSourceUrlOffset)
-ACCESSORS(Script, source_mapping_url, Object, kSourceMappingUrlOffset)
-ACCESSORS(Script, host_defined_options, FixedArray, kHostDefinedOptionsOffset)
 ACCESSORS_CHECKED(Script, wasm_breakpoint_infos, FixedArray,
                   kEvalFromSharedOrWrappedArgumentsOffset,
                   this->type() == TYPE_WASM)
@@ -100,39 +87,30 @@ wasm::NativeModule* Script::wasm_native_module() const {
 }
 
 Script::CompilationType Script::compilation_type() {
-  return BooleanBit::get(flags(), kCompilationTypeBit) ? COMPILATION_TYPE_EVAL
-                                                       : COMPILATION_TYPE_HOST;
+  return CompilationTypeBit::decode(flags());
 }
 void Script::set_compilation_type(CompilationType type) {
-  set_flags(BooleanBit::set(flags(), kCompilationTypeBit,
-                            type == COMPILATION_TYPE_EVAL));
+  set_flags(CompilationTypeBit::update(flags(), type));
 }
 Script::CompilationState Script::compilation_state() {
-  return BooleanBit::get(flags(), kCompilationStateBit)
-             ? COMPILATION_STATE_COMPILED
-             : COMPILATION_STATE_INITIAL;
+  return CompilationStateBit::decode(flags());
 }
 void Script::set_compilation_state(CompilationState state) {
-  set_flags(BooleanBit::set(flags(), kCompilationStateBit,
-                            state == COMPILATION_STATE_COMPILED));
+  set_flags(CompilationStateBit::update(flags(), state));
 }
 
-bool Script::is_repl_mode() const {
-  return BooleanBit::get(flags(), kREPLModeBit);
-}
+bool Script::is_repl_mode() const { return IsReplModeBit::decode(flags()); }
 
 void Script::set_is_repl_mode(bool value) {
-  set_flags(BooleanBit::set(flags(), kREPLModeBit, value));
+  set_flags(IsReplModeBit::update(flags(), value));
 }
 
 ScriptOriginOptions Script::origin_options() {
-  return ScriptOriginOptions((flags() & kOriginOptionsMask) >>
-                             kOriginOptionsShift);
+  return ScriptOriginOptions(OriginOptionsBits::decode(flags()));
 }
 void Script::set_origin_options(ScriptOriginOptions origin_options) {
-  DCHECK(!(origin_options.Flags() & ~((1 << kOriginOptionsSize) - 1)));
-  set_flags((flags() & ~kOriginOptionsMask) |
-            (origin_options.Flags() << kOriginOptionsShift));
+  DCHECK(!(origin_options.Flags() & ~((1 << OriginOptionsBits::kSize) - 1)));
+  set_flags(OriginOptionsBits::update(flags(), origin_options.Flags()));
 }
 
 bool Script::HasValidSource() {
diff --git a/deps/v8/src/objects/script.h b/deps/v8/src/objects/script.h
index b9fb7ea4f9f..9ce44c770fd 100644
--- a/deps/v8/src/objects/script.h
+++ b/deps/v8/src/objects/script.h
@@ -11,6 +11,7 @@
 #include "src/objects/fixed-array.h"
 #include "src/objects/objects.h"
 #include "src/objects/struct.h"
+#include "torque-generated/bit-fields-tq.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -20,8 +21,12 @@ namespace v8 {
 namespace internal {
 
 // Script describes a script which has been added to the VM.
-class Script : public Struct {
+class Script : public TorqueGeneratedScript<Script, Struct> {
  public:
+  // Script ID used for temporary scripts, which shouldn't be added to the
+  // script list.
+  static constexpr int kTemporaryScriptId = -2;
+
   NEVER_READ_ONLY_SPACE
   // Script types.
   enum Type {
@@ -41,31 +46,9 @@ class Script : public Struct {
     COMPILATION_STATE_COMPILED = 1
   };
 
-  // [source]: the script source.
-  DECL_ACCESSORS(source, Object)
-
-  // [name]: the script name.
-  DECL_ACCESSORS(name, Object)
-
-  // [id]: the script id.
-  DECL_INT_ACCESSORS(id)
-
-  // [line_offset]: script line offset in resource from where it was extracted.
-  DECL_INT_ACCESSORS(line_offset)
-
-  // [column_offset]: script column offset in resource from where it was
-  // extracted.
-  DECL_INT_ACCESSORS(column_offset)
-
-  // [context_data]: context data for the context this script was compiled in.
-  DECL_ACCESSORS(context_data, Object)
-
   // [type]: the script type.
   DECL_INT_ACCESSORS(type)
 
-  // [line_ends]: FixedArray of line ends positions.
-  DECL_ACCESSORS(line_ends, Object)
-
   DECL_ACCESSORS(eval_from_shared_or_wrapped_arguments, Object)
 
   // [eval_from_shared]: for eval scripts the shared function info for the
@@ -91,15 +74,6 @@ class Script : public Struct {
   // function infos created from this script.
   DECL_ACCESSORS(shared_function_infos, WeakFixedArray)
 
-  // [flags]: Holds an exciting bitfield.
-  DECL_INT_ACCESSORS(flags)
-
-  // [source_url]: sourceURL from magic comment
-  DECL_ACCESSORS(source_url, Object)
-
-  // [source_mapping_url]: sourceMappingURL magic comment
-  DECL_ACCESSORS(source_mapping_url, Object)
-
   // [wasm_breakpoint_infos]: the list of {BreakPointInfo} objects describing
   // all WebAssembly breakpoints for modules/instances managed via this script.
   // This must only be called if the type of this script is TYPE_WASM.
@@ -116,9 +90,6 @@ class Script : public Struct {
   // This must only be called if the type of this script is TYPE_WASM.
   DECL_ACCESSORS(wasm_weak_instance_list, WeakArrayList)
 
-  // [host_defined_options]: Options defined by the embedder.
-  DECL_ACCESSORS(host_defined_options, FixedArray)
-
   // [compilation_type]: how the the script was compiled. Encoded in the
   // 'flags' field.
   inline CompilationType compilation_type();
@@ -140,8 +111,6 @@ class Script : public Struct {
   inline v8::ScriptOriginOptions origin_options();
   inline void set_origin_options(ScriptOriginOptions origin_options);
 
-  DECL_CAST(Script)
-
   // If script source is an external string, check that the underlying
   // resource is accessible. Otherwise, always return true.
   inline bool HasValidSource();
@@ -197,7 +166,7 @@ class Script : public Struct {
   // that matches the function literal.  Return empty handle if not found.
   template <typename LocalIsolate>
   MaybeHandle<SharedFunctionInfo> FindSharedFunctionInfo(
-      LocalIsolate* isolate, const FunctionLiteral* fun);
+      LocalIsolate* isolate, int function_literal_id);
 
   // Iterate over all script objects on the heap.
   class V8_EXPORT_PRIVATE Iterator {
@@ -214,20 +183,11 @@ class Script : public Struct {
   DECL_PRINTER(Script)
   DECL_VERIFIER(Script)
 
-  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
-                                TORQUE_GENERATED_SCRIPT_FIELDS)
-
  private:
   // Bit positions in the flags field.
-  static const int kCompilationTypeBit = 0;
-  static const int kCompilationStateBit = 1;
-  static const int kREPLModeBit = 2;
-  static const int kOriginOptionsShift = 3;
-  static const int kOriginOptionsSize = 4;
-  static const int kOriginOptionsMask = ((1 << kOriginOptionsSize) - 1)
-                                        << kOriginOptionsShift;
-
-  OBJECT_CONSTRUCTORS(Script, Struct);
+  DEFINE_TORQUE_GENERATED_SCRIPT_FLAGS()
+
+  TQ_OBJECT_CONSTRUCTORS(Script)
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/script.tq b/deps/v8/src/objects/script.tq
index 5e68c870239..cac5ceb3ba4 100644
--- a/deps/v8/src/objects/script.tq
+++ b/deps/v8/src/objects/script.tq
@@ -2,20 +2,56 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+type CompilationType extends int32 constexpr 'Script::CompilationType';
+type CompilationState extends int32 constexpr 'Script::CompilationState';
+
+bitfield struct ScriptFlags extends uint31 {
+  compilation_type: CompilationType: 1 bit;
+  compilation_state: CompilationState: 1 bit;
+  is_repl_mode: bool: 1 bit;
+  origin_options: int32: 4 bit;
+}
+
+@generateCppClass
 extern class Script extends Struct {
-  source: Object;
+  // [source]: the script source.
+  source: String|Undefined;
+
+  // [name]: the script name.
   name: Object;
+
+  // [line_offset]: script line offset in resource from where it was extracted.
   line_offset: Smi;
+
+  // [column_offset]: script column offset in resource from where it was
+  // extracted.
   column_offset: Smi;
-  context: Object;
+
+  // [context_data]: context data for the context this script was compiled in.
+  context_data: Smi|Undefined|Symbol;
+
   script_type: Smi;
-  line_ends: Object;
+
+  // [line_ends]: FixedArray of line ends positions.
+  line_ends: FixedArray|Undefined;
+
+  // [id]: the script id.
   id: Smi;
-  eval_from_shared_or_wrapped_arguments: Object;
+
+  eval_from_shared_or_wrapped_arguments: SharedFunctionInfo|FixedArray|
+      Undefined;
   eval_from_position: Smi|Foreign;  // Smi or Managed<wasm::NativeModule>
-  shared_function_infos: Object;
-  flags: Smi;
-  source_url: Object;
+  shared_function_infos: WeakFixedArray|WeakArrayList;
+
+  // [flags]: Holds an exciting bitfield.
+  flags: SmiTagged<ScriptFlags>;
+
+  // [source_url]: sourceURL from magic comment
+  source_url: String|Undefined;
+
+  // [source_mapping_url]: sourceMappingURL magic comment
   source_mapping_url: Object;
-  host_defined_options: Object;
+
+  // [host_defined_options]: Options defined by the embedder.
+  host_defined_options: FixedArray;
 }
diff --git a/deps/v8/src/objects/shared-function-info-inl.h b/deps/v8/src/objects/shared-function-info-inl.h
index af1b685ca8a..28274b71c17 100644
--- a/deps/v8/src/objects/shared-function-info-inl.h
+++ b/deps/v8/src/objects/shared-function-info-inl.h
@@ -5,6 +5,7 @@
 #ifndef V8_OBJECTS_SHARED_FUNCTION_INFO_INL_H_
 #define V8_OBJECTS_SHARED_FUNCTION_INFO_INL_H_
 
+#include "src/base/macros.h"
 #include "src/objects/shared-function-info.h"
 
 #include "src/handles/handles-inl.h"
@@ -96,6 +97,8 @@ NEVER_READ_ONLY_SPACE_IMPL(SharedFunctionInfo)
 CAST_ACCESSOR(SharedFunctionInfo)
 DEFINE_DEOPT_ELEMENT_ACCESSORS(SharedFunctionInfo, Object)
 
+SYNCHRONIZED_ACCESSORS(SharedFunctionInfo, function_data, Object,
+                       kFunctionDataOffset)
 ACCESSORS(SharedFunctionInfo, name_or_scope_info, Object,
           kNameOrScopeInfoOffset)
 ACCESSORS(SharedFunctionInfo, script_or_debug_info, HeapObject,
@@ -167,15 +170,6 @@ AbstractCode SharedFunctionInfo::abstract_code() {
   }
 }
 
-Object SharedFunctionInfo::function_data() const {
-  return ACQUIRE_READ_FIELD(*this, kFunctionDataOffset);
-}
-
-void SharedFunctionInfo::set_function_data(Object data, WriteBarrierMode mode) {
-  RELEASE_WRITE_FIELD(*this, kFunctionDataOffset, data);
-  CONDITIONAL_WRITE_BARRIER(*this, kFunctionDataOffset, data, mode);
-}
-
 int SharedFunctionInfo::function_token_position() const {
   int offset = raw_function_token_offset();
   if (offset == kFunctionTokenOutOfRange) {
@@ -250,6 +244,7 @@ void SharedFunctionInfo::set_language_mode(LanguageMode language_mode) {
 }
 
 FunctionKind SharedFunctionInfo::kind() const {
+  STATIC_ASSERT(FunctionKindBits::kSize == kFunctionKindBitSize);
   return FunctionKindBits::decode(flags());
 }
 
diff --git a/deps/v8/src/objects/shared-function-info.tq b/deps/v8/src/objects/shared-function-info.tq
index f37cc250bc2..c29060714a7 100644
--- a/deps/v8/src/objects/shared-function-info.tq
+++ b/deps/v8/src/objects/shared-function-info.tq
@@ -77,3 +77,12 @@ extern class UncompiledDataWithoutPreparseData extends UncompiledData {
 extern class UncompiledDataWithPreparseData extends UncompiledData {
   preparse_data: PreparseData;
 }
+
+@export
+class OnHeapBasicBlockProfilerData extends HeapObject {
+  block_rpo_numbers: ByteArray;  // Stored as 4-byte ints
+  counts: ByteArray;             // Stored as 4-byte ints
+  name: String;
+  schedule: String;
+  code: String;
+}
diff --git a/deps/v8/src/objects/source-text-module.cc b/deps/v8/src/objects/source-text-module.cc
index f54df2b7ca6..f1b0c9c2c48 100644
--- a/deps/v8/src/objects/source-text-module.cc
+++ b/deps/v8/src/objects/source-text-module.cc
@@ -583,6 +583,16 @@ Handle<JSModuleNamespace> SourceTextModule::GetModuleNamespace(
   return Module::GetModuleNamespace(isolate, requested_module);
 }
 
+Handle<JSObject> SourceTextModule::GetImportMeta(
+    Isolate* isolate, Handle<SourceTextModule> module) {
+  Handle<HeapObject> import_meta(module->import_meta(), isolate);
+  if (import_meta->IsTheHole(isolate)) {
+    import_meta = isolate->RunHostInitializeImportMetaObjectCallback(module);
+    module->set_import_meta(*import_meta);
+  }
+  return Handle<JSObject>::cast(import_meta);
+}
+
 MaybeHandle<Object> SourceTextModule::EvaluateMaybeAsync(
     Isolate* isolate, Handle<SourceTextModule> module) {
   // In the event of errored evaluation, return a rejected promise.
diff --git a/deps/v8/src/objects/source-text-module.h b/deps/v8/src/objects/source-text-module.h
index 57c84d833d8..91970812543 100644
--- a/deps/v8/src/objects/source-text-module.h
+++ b/deps/v8/src/objects/source-text-module.h
@@ -7,6 +7,7 @@
 
 #include "src/objects/module.h"
 #include "src/objects/promise.h"
+#include "torque-generated/bit-fields-tq.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -59,6 +60,11 @@ class SourceTextModule
   static Handle<JSModuleNamespace> GetModuleNamespace(
       Isolate* isolate, Handle<SourceTextModule> module, int module_request);
 
+  // Get the import.meta object of [module].  If it doesn't exist yet, it is
+  // created and passed to the embedder callback for initialization.
+  V8_EXPORT_PRIVATE static Handle<JSObject> GetImportMeta(
+      Isolate* isolate, Handle<SourceTextModule> module);
+
   using BodyDescriptor =
       SubclassBodyDescriptor<Module::BodyDescriptor,
                              FixedBodyDescriptor<kCodeOffset, kSize, kSize>>;
@@ -86,8 +92,7 @@ class SourceTextModule
   inline void DecrementPendingAsyncDependencies();
 
   // Bits for flags.
-  static const int kAsyncBit = 0;
-  static const int kAsyncEvaluatingBit = 1;
+  DEFINE_TORQUE_GENERATED_SOURCE_TEXT_MODULE_FLAGS()
 
   // async_evaluating, top_level_capability, pending_async_dependencies, and
   // async_parent_modules are used exclusively during evaluation of async
diff --git a/deps/v8/src/objects/source-text-module.tq b/deps/v8/src/objects/source-text-module.tq
index fda0138695f..185443414dd 100644
--- a/deps/v8/src/objects/source-text-module.tq
+++ b/deps/v8/src/objects/source-text-module.tq
@@ -4,6 +4,11 @@
 
 type SourceTextModuleInfo extends FixedArray;
 
+bitfield struct SourceTextModuleFlags extends uint31 {
+  async: bool: 1 bit;
+  async_evaluating: bool: 1 bit;
+}
+
 @generateCppClass
 extern class SourceTextModule extends Module {
   // The code representing this module, or an abstraction thereof.
@@ -39,7 +44,7 @@ extern class SourceTextModule extends Module {
   // The number of currently evaluating async dependencies of this module.
   pending_async_dependencies: Smi;
 
-  flags: Smi;
+  flags: SmiTagged<SourceTextModuleFlags>;
 }
 
 @generateCppClass
diff --git a/deps/v8/src/objects/stack-frame-info-inl.h b/deps/v8/src/objects/stack-frame-info-inl.h
index 36236f576ba..820d4324a2f 100644
--- a/deps/v8/src/objects/stack-frame-info-inl.h
+++ b/deps/v8/src/objects/stack-frame-info-inl.h
@@ -18,37 +18,22 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(StackFrameInfo, Struct)
+TQ_OBJECT_CONSTRUCTORS_IMPL(StackFrameInfo)
 
 NEVER_READ_ONLY_SPACE_IMPL(StackFrameInfo)
 
-CAST_ACCESSOR(StackFrameInfo)
-
-SMI_ACCESSORS(StackFrameInfo, line_number, kLineNumberOffset)
-SMI_ACCESSORS(StackFrameInfo, column_number, kColumnNumberOffset)
-SMI_ACCESSORS(StackFrameInfo, script_id, kScriptIdOffset)
-SMI_ACCESSORS(StackFrameInfo, wasm_function_index, kWasmFunctionIndexOffset)
-SMI_ACCESSORS(StackFrameInfo, promise_all_index, kPromiseAllIndexOffset)
-SMI_ACCESSORS_CHECKED(StackFrameInfo, function_offset, kPromiseAllIndexOffset,
-                      is_wasm())
-ACCESSORS(StackFrameInfo, script_name, Object, kScriptNameOffset)
-ACCESSORS(StackFrameInfo, script_name_or_source_url, Object,
-          kScriptNameOrSourceUrlOffset)
-ACCESSORS(StackFrameInfo, function_name, Object, kFunctionNameOffset)
-ACCESSORS(StackFrameInfo, method_name, Object, kMethodNameOffset)
-ACCESSORS(StackFrameInfo, type_name, Object, kTypeNameOffset)
-ACCESSORS(StackFrameInfo, eval_origin, Object, kEvalOriginOffset)
-ACCESSORS(StackFrameInfo, wasm_module_name, Object, kWasmModuleNameOffset)
-ACCESSORS(StackFrameInfo, wasm_instance, Object, kWasmInstanceOffset)
-SMI_ACCESSORS(StackFrameInfo, flag, kFlagOffset)
-BOOL_ACCESSORS(StackFrameInfo, flag, is_eval, kIsEvalBit)
-BOOL_ACCESSORS(StackFrameInfo, flag, is_constructor, kIsConstructorBit)
-BOOL_ACCESSORS(StackFrameInfo, flag, is_wasm, kIsWasmBit)
-BOOL_ACCESSORS(StackFrameInfo, flag, is_asmjs_wasm, kIsAsmJsWasmBit)
-BOOL_ACCESSORS(StackFrameInfo, flag, is_user_java_script, kIsUserJavaScriptBit)
-BOOL_ACCESSORS(StackFrameInfo, flag, is_toplevel, kIsToplevelBit)
-BOOL_ACCESSORS(StackFrameInfo, flag, is_async, kIsAsyncBit)
-BOOL_ACCESSORS(StackFrameInfo, flag, is_promise_all, kIsPromiseAllBit)
+SMI_ACCESSORS_CHECKED(StackFrameInfo, function_offset,
+                      kPromiseCombinatorIndexOffset, is_wasm())
+BOOL_ACCESSORS(StackFrameInfo, flag, is_eval, IsEvalBit::kShift)
+BOOL_ACCESSORS(StackFrameInfo, flag, is_constructor, IsConstructorBit::kShift)
+BOOL_ACCESSORS(StackFrameInfo, flag, is_wasm, IsWasmBit::kShift)
+BOOL_ACCESSORS(StackFrameInfo, flag, is_asmjs_wasm, IsAsmJsWasmBit::kShift)
+BOOL_ACCESSORS(StackFrameInfo, flag, is_user_java_script,
+               IsUserJavaScriptBit::kShift)
+BOOL_ACCESSORS(StackFrameInfo, flag, is_toplevel, IsToplevelBit::kShift)
+BOOL_ACCESSORS(StackFrameInfo, flag, is_async, IsAsyncBit::kShift)
+BOOL_ACCESSORS(StackFrameInfo, flag, is_promise_all, IsPromiseAllBit::kShift)
+BOOL_ACCESSORS(StackFrameInfo, flag, is_promise_any, IsPromiseAnyBit::kShift)
 
 TQ_OBJECT_CONSTRUCTORS_IMPL(StackTraceFrame)
 NEVER_READ_ONLY_SPACE_IMPL(StackTraceFrame)
diff --git a/deps/v8/src/objects/stack-frame-info.cc b/deps/v8/src/objects/stack-frame-info.cc
index c15ad1031cf..a6797599871 100644
--- a/deps/v8/src/objects/stack-frame-info.cc
+++ b/deps/v8/src/objects/stack-frame-info.cc
@@ -47,8 +47,8 @@ int StackTraceFrame::GetScriptId(Handle<StackTraceFrame> frame) {
 }
 
 // static
-int StackTraceFrame::GetPromiseAllIndex(Handle<StackTraceFrame> frame) {
-  return GetFrameInfo(frame)->promise_all_index();
+int StackTraceFrame::GetPromiseCombinatorIndex(Handle<StackTraceFrame> frame) {
+  return GetFrameInfo(frame)->promise_combinator_index();
 }
 
 // static
@@ -168,6 +168,11 @@ bool StackTraceFrame::IsPromiseAll(Handle<StackTraceFrame> frame) {
   return GetFrameInfo(frame)->is_promise_all();
 }
 
+// static
+bool StackTraceFrame::IsPromiseAny(Handle<StackTraceFrame> frame) {
+  return GetFrameInfo(frame)->is_promise_any();
+}
+
 // static
 Handle<StackFrameInfo> StackTraceFrame::GetFrameInfo(
     Handle<StackTraceFrame> frame) {
@@ -326,6 +331,7 @@ void SerializeJSStackFrame(Isolate* isolate, Handle<StackTraceFrame> frame,
   const bool is_toplevel = StackTraceFrame::IsToplevel(frame);
   const bool is_async = StackTraceFrame::IsAsync(frame);
   const bool is_promise_all = StackTraceFrame::IsPromiseAll(frame);
+  const bool is_promise_any = StackTraceFrame::IsPromiseAny(frame);
   const bool is_constructor = StackTraceFrame::IsConstructor(frame);
   // Note: Keep the {is_method_call} predicate in sync with the corresponding
   //       predicate in factory.cc where the StackFrameInfo is created.
@@ -338,7 +344,13 @@ void SerializeJSStackFrame(Isolate* isolate, Handle<StackTraceFrame> frame,
   }
   if (is_promise_all) {
     builder->AppendCString("Promise.all (index ");
-    builder->AppendInt(StackTraceFrame::GetPromiseAllIndex(frame));
+    builder->AppendInt(StackTraceFrame::GetPromiseCombinatorIndex(frame));
+    builder->AppendCString(")");
+    return;
+  }
+  if (is_promise_any) {
+    builder->AppendCString("Promise.any (index ");
+    builder->AppendInt(StackTraceFrame::GetPromiseCombinatorIndex(frame));
     builder->AppendCString(")");
     return;
   }
diff --git a/deps/v8/src/objects/stack-frame-info.h b/deps/v8/src/objects/stack-frame-info.h
index 83a24c047a9..0da16a80c30 100644
--- a/deps/v8/src/objects/stack-frame-info.h
+++ b/deps/v8/src/objects/stack-frame-info.h
@@ -6,6 +6,7 @@
 #define V8_OBJECTS_STACK_FRAME_INFO_H_
 
 #include "src/objects/struct.h"
+#include "torque-generated/bit-fields-tq.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -16,24 +17,12 @@ namespace internal {
 class FrameArray;
 class WasmInstanceObject;
 
-class StackFrameInfo : public Struct {
+class StackFrameInfo
+    : public TorqueGeneratedStackFrameInfo<StackFrameInfo, Struct> {
  public:
   NEVER_READ_ONLY_SPACE
-  DECL_INT_ACCESSORS(line_number)
-  DECL_INT_ACCESSORS(column_number)
-  DECL_INT_ACCESSORS(script_id)
-  DECL_INT_ACCESSORS(wasm_function_index)
-  DECL_INT_ACCESSORS(promise_all_index)
-  // Wasm frames only: function_offset instead of promise_all_index.
+  // Wasm frames only: function_offset instead of promise_combinator_index.
   DECL_INT_ACCESSORS(function_offset)
-  DECL_ACCESSORS(script_name, Object)
-  DECL_ACCESSORS(script_name_or_source_url, Object)
-  DECL_ACCESSORS(function_name, Object)
-  DECL_ACCESSORS(method_name, Object)
-  DECL_ACCESSORS(type_name, Object)
-  DECL_ACCESSORS(eval_origin, Object)
-  DECL_ACCESSORS(wasm_module_name, Object)
-  DECL_ACCESSORS(wasm_instance, Object)
   DECL_BOOLEAN_ACCESSORS(is_eval)
   DECL_BOOLEAN_ACCESSORS(is_constructor)
   DECL_BOOLEAN_ACCESSORS(is_wasm)
@@ -42,29 +31,16 @@ class StackFrameInfo : public Struct {
   DECL_BOOLEAN_ACCESSORS(is_toplevel)
   DECL_BOOLEAN_ACCESSORS(is_async)
   DECL_BOOLEAN_ACCESSORS(is_promise_all)
-  DECL_INT_ACCESSORS(flag)
-
-  DECL_CAST(StackFrameInfo)
+  DECL_BOOLEAN_ACCESSORS(is_promise_any)
 
   // Dispatched behavior.
   DECL_PRINTER(StackFrameInfo)
-  DECL_VERIFIER(StackFrameInfo)
-
-  DEFINE_FIELD_OFFSET_CONSTANTS(Struct::kHeaderSize,
-                                TORQUE_GENERATED_STACK_FRAME_INFO_FIELDS)
 
  private:
   // Bit position in the flag, from least significant bit position.
-  static const int kIsEvalBit = 0;
-  static const int kIsConstructorBit = 1;
-  static const int kIsWasmBit = 2;
-  static const int kIsAsmJsWasmBit = 3;
-  static const int kIsUserJavaScriptBit = 4;
-  static const int kIsToplevelBit = 5;
-  static const int kIsAsyncBit = 6;
-  static const int kIsPromiseAllBit = 7;
-
-  OBJECT_CONSTRUCTORS(StackFrameInfo, Struct);
+  DEFINE_TORQUE_GENERATED_STACK_FRAME_INFO_FLAGS()
+
+  TQ_OBJECT_CONSTRUCTORS(StackFrameInfo)
 };
 
 // This class is used to lazily initialize a StackFrameInfo object from
@@ -85,7 +61,7 @@ class StackTraceFrame
   static int GetColumnNumber(Handle<StackTraceFrame> frame);
   static int GetOneBasedColumnNumber(Handle<StackTraceFrame> frame);
   static int GetScriptId(Handle<StackTraceFrame> frame);
-  static int GetPromiseAllIndex(Handle<StackTraceFrame> frame);
+  static int GetPromiseCombinatorIndex(Handle<StackTraceFrame> frame);
   static int GetFunctionOffset(Handle<StackTraceFrame> frame);
   static int GetWasmFunctionIndex(Handle<StackTraceFrame> frame);
 
@@ -107,6 +83,7 @@ class StackTraceFrame
   static bool IsToplevel(Handle<StackTraceFrame> frame);
   static bool IsAsync(Handle<StackTraceFrame> frame);
   static bool IsPromiseAll(Handle<StackTraceFrame> frame);
+  static bool IsPromiseAny(Handle<StackTraceFrame> frame);
 
  private:
   static Handle<StackFrameInfo> GetFrameInfo(Handle<StackTraceFrame> frame);
diff --git a/deps/v8/src/objects/stack-frame-info.tq b/deps/v8/src/objects/stack-frame-info.tq
index 801e2bc5a0d..b8b218bce14 100644
--- a/deps/v8/src/objects/stack-frame-info.tq
+++ b/deps/v8/src/objects/stack-frame-info.tq
@@ -2,21 +2,34 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+bitfield struct StackFrameInfoFlags extends uint31 {
+  is_eval: bool: 1 bit;
+  is_constructor: bool: 1 bit;
+  is_wasm: bool: 1 bit;
+  is_asm_js_wasm: bool: 1 bit;
+  is_user_java_script: bool: 1 bit;
+  is_toplevel: bool: 1 bit;
+  is_async: bool: 1 bit;
+  is_promise_all: bool: 1 bit;
+  is_promise_any: bool: 1 bit;
+}
+
+@generateCppClass
 extern class StackFrameInfo extends Struct {
   line_number: Smi;
   column_number: Smi;
-  promise_all_index: Smi;
+  promise_combinator_index: Smi;
   script_id: Smi;
   wasm_function_index: Smi;
-  script_name: String|Null|Undefined;
-  script_name_or_source_url: String|Null|Undefined;
+  script_name: Object;
+  script_name_or_source_url: Object;
   function_name: String|Null|Undefined;
   method_name: String|Null|Undefined;
   type_name: String|Null|Undefined;
   eval_origin: String|Null|Undefined;
   wasm_module_name: String|Null|Undefined;
   wasm_instance: WasmInstanceObject|Null|Undefined;
-  flag: Smi;
+  flag: SmiTagged<StackFrameInfoFlags>;
 }
 
 @generateCppClass
diff --git a/deps/v8/src/objects/string-inl.h b/deps/v8/src/objects/string-inl.h
index 5dd460a959d..78f859b78c2 100644
--- a/deps/v8/src/objects/string-inl.h
+++ b/deps/v8/src/objects/string-inl.h
@@ -5,8 +5,9 @@
 #ifndef V8_OBJECTS_STRING_INL_H_
 #define V8_OBJECTS_STRING_INL_H_
 
-#include "src/objects/string.h"
-
+#include "src/common/external-pointer-inl.h"
+#include "src/common/external-pointer.h"
+#include "src/common/globals.h"
 #include "src/handles/handles-inl.h"
 #include "src/heap/factory.h"
 #include "src/numbers/conversions-inl.h"
@@ -14,6 +15,7 @@
 #include "src/objects/name-inl.h"
 #include "src/objects/smi-inl.h"
 #include "src/objects/string-table-inl.h"
+#include "src/objects/string.h"
 #include "src/strings/string-hasher-inl.h"
 
 // Has to be the last include (doesn't have include guards):
@@ -569,12 +571,13 @@ void SeqTwoByteString::SeqTwoByteStringSet(int index, uint16_t value) {
   WriteField<uint16_t>(kHeaderSize + index * kShortSize, value);
 }
 
-int SeqTwoByteString::SeqTwoByteStringSize(InstanceType instance_type) {
-  return SizeFor(length());
+// Due to ThinString rewriting, concurrent visitors need to read the length with
+// acquire semantics.
+inline int SeqOneByteString::AllocatedSize() {
+  return SizeFor(synchronized_length());
 }
-
-int SeqOneByteString::SeqOneByteStringSize(InstanceType instance_type) {
-  return SizeFor(length());
+inline int SeqTwoByteString::AllocatedSize() {
+  return SizeFor(synchronized_length());
 }
 
 void SlicedString::set_parent(String parent, WriteBarrierMode mode) {
@@ -599,54 +602,71 @@ bool ExternalString::is_uncached() const {
   return (type & kUncachedExternalStringMask) == kUncachedExternalStringTag;
 }
 
-Address ExternalString::resource_as_address() {
-  return ReadField<Address>(kResourceOffset);
+DEF_GETTER(ExternalString, resource_as_address, Address) {
+  ExternalPointer_t encoded_address =
+      ReadField<ExternalPointer_t>(kResourceOffset);
+  return DecodeExternalPointer(isolate, encoded_address);
 }
 
-void ExternalString::set_address_as_resource(Address address) {
-  WriteField<Address>(kResourceOffset, address);
+void ExternalString::set_address_as_resource(Isolate* isolate,
+                                             Address address) {
+  const ExternalPointer_t encoded_address =
+      EncodeExternalPointer(isolate, address);
+  WriteField<ExternalPointer_t>(kResourceOffset, encoded_address);
   if (IsExternalOneByteString()) {
-    ExternalOneByteString::cast(*this).update_data_cache();
+    ExternalOneByteString::cast(*this).update_data_cache(isolate);
   } else {
-    ExternalTwoByteString::cast(*this).update_data_cache();
+    ExternalTwoByteString::cast(*this).update_data_cache(isolate);
   }
 }
 
 uint32_t ExternalString::resource_as_uint32() {
-  return static_cast<uint32_t>(ReadField<Address>(kResourceOffset));
+  ExternalPointer_t encoded_address =
+      ReadField<ExternalPointer_t>(kResourceOffset);
+  return static_cast<uint32_t>(encoded_address);
 }
 
-void ExternalString::set_uint32_as_resource(uint32_t value) {
-  WriteField<Address>(kResourceOffset, value);
+void ExternalString::set_uint32_as_resource(Isolate* isolate, uint32_t value) {
+  WriteField<ExternalPointer_t>(kResourceOffset, value);
   if (is_uncached()) return;
-  WriteField<Address>(kResourceDataOffset, kNullAddress);
+  WriteField<ExternalPointer_t>(kResourceDataOffset,
+                                EncodeExternalPointer(isolate, kNullAddress));
 }
 
-void ExternalString::DisposeResource() {
+void ExternalString::DisposeResource(Isolate* isolate) {
+  const ExternalPointer_t encoded_address =
+      ReadField<ExternalPointer_t>(kResourceOffset);
   v8::String::ExternalStringResourceBase* resource =
       reinterpret_cast<v8::String::ExternalStringResourceBase*>(
-          ReadField<Address>(ExternalString::kResourceOffset));
+          DecodeExternalPointer(isolate, encoded_address));
 
   // Dispose of the C++ object if it has not already been disposed.
   if (resource != nullptr) {
     resource->Dispose();
-    WriteField<Address>(ExternalString::kResourceOffset, kNullAddress);
+    const ExternalPointer_t encoded_address =
+        EncodeExternalPointer(isolate, kNullAddress);
+    WriteField<ExternalPointer_t>(kResourceOffset, encoded_address);
   }
 }
 
-const ExternalOneByteString::Resource* ExternalOneByteString::resource() {
-  return reinterpret_cast<Resource*>(ReadField<Address>(kResourceOffset));
+DEF_GETTER(ExternalOneByteString, resource,
+           const ExternalOneByteString::Resource*) {
+  const ExternalPointer_t encoded_address =
+      ReadField<ExternalPointer_t>(kResourceOffset);
+  return reinterpret_cast<Resource*>(
+      DecodeExternalPointer(isolate, encoded_address));
 }
 
-void ExternalOneByteString::update_data_cache() {
+void ExternalOneByteString::update_data_cache(Isolate* isolate) {
   if (is_uncached()) return;
-  WriteField<Address>(kResourceDataOffset,
-                      reinterpret_cast<Address>(resource()->data()));
+  const ExternalPointer_t encoded_resource_data = EncodeExternalPointer(
+      isolate, reinterpret_cast<Address>(resource()->data()));
+  WriteField<ExternalPointer_t>(kResourceDataOffset, encoded_resource_data);
 }
 
 void ExternalOneByteString::SetResource(
     Isolate* isolate, const ExternalOneByteString::Resource* resource) {
-  set_resource(resource);
+  set_resource(isolate, resource);
   size_t new_payload = resource == nullptr ? 0 : resource->length();
   if (new_payload > 0) {
     isolate->heap()->UpdateExternalString(*this, 0, new_payload);
@@ -654,9 +674,11 @@ void ExternalOneByteString::SetResource(
 }
 
 void ExternalOneByteString::set_resource(
-    const ExternalOneByteString::Resource* resource) {
-  WriteField<Address>(kResourceOffset, reinterpret_cast<Address>(resource));
-  if (resource != nullptr) update_data_cache();
+    Isolate* isolate, const ExternalOneByteString::Resource* resource) {
+  const ExternalPointer_t encoded_address =
+      EncodeExternalPointer(isolate, reinterpret_cast<Address>(resource));
+  WriteField<ExternalPointer_t>(kResourceOffset, encoded_address);
+  if (resource != nullptr) update_data_cache(isolate);
 }
 
 const uint8_t* ExternalOneByteString::GetChars() {
@@ -668,19 +690,24 @@ uint8_t ExternalOneByteString::Get(int index) {
   return GetChars()[index];
 }
 
-const ExternalTwoByteString::Resource* ExternalTwoByteString::resource() {
-  return reinterpret_cast<Resource*>(ReadField<Address>(kResourceOffset));
+DEF_GETTER(ExternalTwoByteString, resource,
+           const ExternalTwoByteString::Resource*) {
+  const ExternalPointer_t encoded_address =
+      ReadField<ExternalPointer_t>(kResourceOffset);
+  return reinterpret_cast<Resource*>(
+      DecodeExternalPointer(isolate, encoded_address));
 }
 
-void ExternalTwoByteString::update_data_cache() {
+void ExternalTwoByteString::update_data_cache(Isolate* isolate) {
   if (is_uncached()) return;
-  WriteField<Address>(kResourceDataOffset,
-                      reinterpret_cast<Address>(resource()->data()));
+  const ExternalPointer_t encoded_resource_data = EncodeExternalPointer(
+      isolate, reinterpret_cast<Address>(resource()->data()));
+  WriteField<ExternalPointer_t>(kResourceDataOffset, encoded_resource_data);
 }
 
 void ExternalTwoByteString::SetResource(
     Isolate* isolate, const ExternalTwoByteString::Resource* resource) {
-  set_resource(resource);
+  set_resource(isolate, resource);
   size_t new_payload = resource == nullptr ? 0 : resource->length() * 2;
   if (new_payload > 0) {
     isolate->heap()->UpdateExternalString(*this, 0, new_payload);
@@ -688,9 +715,11 @@ void ExternalTwoByteString::SetResource(
 }
 
 void ExternalTwoByteString::set_resource(
-    const ExternalTwoByteString::Resource* resource) {
-  WriteField<Address>(kResourceOffset, reinterpret_cast<Address>(resource));
-  if (resource != nullptr) update_data_cache();
+    Isolate* isolate, const ExternalTwoByteString::Resource* resource) {
+  const ExternalPointer_t encoded_address =
+      EncodeExternalPointer(isolate, reinterpret_cast<Address>(resource));
+  WriteField<ExternalPointer_t>(kResourceOffset, encoded_address);
+  if (resource != nullptr) update_data_cache(isolate);
 }
 
 const uint16_t* ExternalTwoByteString::GetChars() { return resource()->data(); }
diff --git a/deps/v8/src/objects/string-table.h b/deps/v8/src/objects/string-table.h
index 54af9a44521..76f29a01e38 100644
--- a/deps/v8/src/objects/string-table.h
+++ b/deps/v8/src/objects/string-table.h
@@ -16,7 +16,7 @@ namespace internal {
 
 class StringTableKey {
  public:
-  virtual ~StringTableKey() {}
+  virtual ~StringTableKey() = default;
   inline StringTableKey(uint32_t hash_field, int length);
 
   virtual Handle<String> AsHandle(Isolate* isolate) = 0;
diff --git a/deps/v8/src/objects/string.cc b/deps/v8/src/objects/string.cc
index 8c96900bbe0..90abd00ebac 100644
--- a/deps/v8/src/objects/string.cc
+++ b/deps/v8/src/objects/string.cc
@@ -6,7 +6,8 @@
 
 #include "src/common/globals.h"
 #include "src/handles/handles-inl.h"
-#include "src/heap/heap-inl.h"  // For LooksValid implementation.
+#include "src/heap/heap-inl.h"
+#include "src/heap/memory-chunk.h"
 #include "src/heap/read-only-heap.h"
 #include "src/numbers/conversions.h"
 #include "src/objects/map.h"
@@ -1113,13 +1114,8 @@ MaybeHandle<String> String::GetSubstitution(Isolate* isolate, Match* match,
             isolate, capture,
             match->GetNamedCapture(capture_name, &capture_state), String);
 
-        switch (capture_state) {
-          case CaptureState::INVALID:
-          case CaptureState::UNMATCHED:
-            break;
-          case CaptureState::MATCHED:
-            builder.AppendString(capture);
-            break;
+        if (capture_state == CaptureState::MATCHED) {
+          builder.AppendString(capture);
         }
 
         continue_from_ix = closing_bracket_ix + 1;
diff --git a/deps/v8/src/objects/string.h b/deps/v8/src/objects/string.h
index 616a4b967b8..f9f92a53dd1 100644
--- a/deps/v8/src/objects/string.h
+++ b/deps/v8/src/objects/string.h
@@ -259,9 +259,9 @@ class String : public TorqueGeneratedString<String, Name> {
     virtual Handle<String> GetPrefix() = 0;
     virtual Handle<String> GetSuffix() = 0;
 
-    // A named capture can be invalid (if it is not specified in the pattern),
-    // unmatched (specified but not matched in the current string), and matched.
-    enum CaptureState { INVALID, UNMATCHED, MATCHED };
+    // A named capture can be unmatched (either not specified in the pattern,
+    // or specified but unmatched in the current string), or matched.
+    enum CaptureState { UNMATCHED, MATCHED };
 
     virtual int CaptureCount() = 0;
     virtual bool HasNamedCaptures() = 0;
@@ -558,16 +558,13 @@ class SeqOneByteString
   // instance.
   inline int SeqOneByteStringSize(InstanceType instance_type);
 
-  // Computes the size for an OneByteString instance of a given length.
-  static int SizeFor(int length) {
-    return OBJECT_POINTER_ALIGN(kHeaderSize + length * kCharSize);
-  }
-
   // Maximal memory usage for a single sequential one-byte string.
   static const int kMaxCharsSize = kMaxLength;
   static const int kMaxSize = OBJECT_POINTER_ALIGN(kMaxCharsSize + kHeaderSize);
   STATIC_ASSERT((kMaxSize - kHeaderSize) >= String::kMaxLength);
 
+  int AllocatedSize();
+
   class BodyDescriptor;
 
   TQ_OBJECT_CONSTRUCTORS(SeqOneByteString)
@@ -599,17 +596,14 @@ class SeqTwoByteString
   // instance.
   inline int SeqTwoByteStringSize(InstanceType instance_type);
 
-  // Computes the size for a TwoByteString instance of a given length.
-  static int SizeFor(int length) {
-    return OBJECT_POINTER_ALIGN(kHeaderSize + length * kShortSize);
-  }
-
   // Maximal memory usage for a single sequential two-byte string.
   static const int kMaxCharsSize = kMaxLength * 2;
   static const int kMaxSize = OBJECT_POINTER_ALIGN(kMaxCharsSize + kHeaderSize);
   STATIC_ASSERT(static_cast<int>((kMaxSize - kHeaderSize) / sizeof(uint16_t)) >=
                 String::kMaxLength);
 
+  int AllocatedSize();
+
   class BodyDescriptor;
 
   TQ_OBJECT_CONSTRUCTORS(SeqTwoByteString)
@@ -639,7 +633,7 @@ class ConsString : public TorqueGeneratedConsString<ConsString, String> {
   // Minimum length for a cons string.
   static const int kMinLength = 13;
 
-  using BodyDescriptor = FixedBodyDescriptor<kFirstOffset, kSize, kSize>;
+  class BodyDescriptor;
 
   DECL_VERIFIER(ConsString)
 
@@ -661,7 +655,7 @@ class ThinString : public TorqueGeneratedThinString<ThinString, String> {
 
   DECL_VERIFIER(ThinString)
 
-  using BodyDescriptor = FixedBodyDescriptor<kActualOffset, kSize, kSize>;
+  class BodyDescriptor;
 
   TQ_OBJECT_CONSTRUCTORS(ThinString)
 };
@@ -688,7 +682,7 @@ class SlicedString : public TorqueGeneratedSlicedString<SlicedString, String> {
   // Minimum length for a sliced string.
   static const int kMinLength = 13;
 
-  using BodyDescriptor = FixedBodyDescriptor<kParentOffset, kSize, kSize>;
+  class BodyDescriptor;
 
   DECL_VERIFIER(SlicedString)
 
@@ -722,13 +716,13 @@ class ExternalString : public String {
   int ExternalPayloadSize() const;
 
   // Used in the serializer/deserializer.
-  inline Address resource_as_address();
-  inline void set_address_as_resource(Address address);
+  DECL_GETTER(resource_as_address, Address)
+  inline void set_address_as_resource(Isolate* isolate, Address address);
   inline uint32_t resource_as_uint32();
-  inline void set_uint32_as_resource(uint32_t value);
+  inline void set_uint32_as_resource(Isolate* isolate, uint32_t value);
 
   // Disposes string's resource object if it has not already been disposed.
-  inline void DisposeResource();
+  inline void DisposeResource(Isolate* isolate);
 
   STATIC_ASSERT(kResourceOffset == Internals::kStringResourceOffset);
   static const int kSizeOfAllExternalStrings = kHeaderSize;
@@ -745,19 +739,19 @@ class ExternalOneByteString : public ExternalString {
   using Resource = v8::String::ExternalOneByteStringResource;
 
   // The underlying resource.
-  inline const Resource* resource();
+  DECL_GETTER(resource, const Resource*)
 
   // It is assumed that the previous resource is null. If it is not null, then
   // it is the responsability of the caller the handle the previous resource.
   inline void SetResource(Isolate* isolate, const Resource* buffer);
   // Used only during serialization.
-  inline void set_resource(const Resource* buffer);
+  inline void set_resource(Isolate* isolate, const Resource* buffer);
 
   // Update the pointer cache to the external character array.
   // The cached pointer is always valid, as the external character array does =
   // not move during lifetime.  Deserialization is the only exception, after
   // which the pointer cache has to be refreshed.
-  inline void update_data_cache();
+  inline void update_data_cache(Isolate* isolate);
 
   inline const uint8_t* GetChars();
 
@@ -786,19 +780,19 @@ class ExternalTwoByteString : public ExternalString {
   using Resource = v8::String::ExternalStringResource;
 
   // The underlying string resource.
-  inline const Resource* resource();
+  DECL_GETTER(resource, const Resource*)
 
   // It is assumed that the previous resource is null. If it is not null, then
   // it is the responsability of the caller the handle the previous resource.
   inline void SetResource(Isolate* isolate, const Resource* buffer);
   // Used only during serialization.
-  inline void set_resource(const Resource* buffer);
+  inline void set_resource(Isolate* isolate, const Resource* buffer);
 
   // Update the pointer cache to the external character array.
   // The cached pointer is always valid, as the external character array does =
   // not move during lifetime.  Deserialization is the only exception, after
   // which the pointer cache has to be refreshed.
-  inline void update_data_cache();
+  inline void update_data_cache(Isolate* isolate);
 
   inline const uint16_t* GetChars();
 
diff --git a/deps/v8/src/objects/string.tq b/deps/v8/src/objects/string.tq
index b8d9714b360..7d3f250964d 100644
--- a/deps/v8/src/objects/string.tq
+++ b/deps/v8/src/objects/string.tq
@@ -10,15 +10,17 @@ extern class String extends Name {
 }
 
 @generateCppClass
+@generateBodyDescriptor
 extern class ConsString extends String {
   first: String;
   second: String;
 }
 
 @abstract
+@generateBodyDescriptor
 extern class ExternalString extends String {
-  resource: RawPtr;
-  resource_data: RawPtr;
+  resource: ExternalPointer;
+  resource_data: ExternalPointer;
 }
 
 extern class ExternalOneByteString extends ExternalString {}
@@ -28,27 +30,30 @@ extern class ExternalTwoByteString extends ExternalString {}
 extern class InternalizedString extends String {
 }
 
-// TODO(v8:8983): Add declaration for variable-sized region.
 @abstract
 @generateCppClass
 extern class SeqString extends String {
 }
 @generateCppClass
+@generateBodyDescriptor
 extern class SeqOneByteString extends SeqString {
   chars[length]: char8;
 }
 @generateCppClass
+@generateBodyDescriptor
 extern class SeqTwoByteString extends SeqString {
   chars[length]: char16;
 }
 
 @generateCppClass
+@generateBodyDescriptor
 extern class SlicedString extends String {
   parent: String;
   offset: Smi;
 }
 
 @generateCppClass
+@generateBodyDescriptor
 extern class ThinString extends String {
   actual: String;
 }
diff --git a/deps/v8/src/objects/template.tq b/deps/v8/src/objects/template.tq
index d3e251aa165..1336fb19ba7 100644
--- a/deps/v8/src/objects/template.tq
+++ b/deps/v8/src/objects/template.tq
@@ -5,46 +5,56 @@
 @abstract
 @generateCppClass
 extern class TemplateInfo extends Struct {
-  tag: Object;
-  serial_number: Object;
+  tag: Smi;
+  serial_number: Smi;
   number_of_properties: Smi;
-  property_list: Object;
-  property_accessors: Object;
+  property_list: TemplateList|Undefined;
+  property_accessors: TemplateList|Undefined;
 }
 
 @generateCppClass
+@generatePrint
 extern class FunctionTemplateRareData extends Struct {
   // See DECL_RARE_ACCESSORS in FunctionTemplateInfo.
-  prototype_template: Object;
-  prototype_provider_template: Object;
-  parent_template: Object;
-  named_property_handler: Object;
-  indexed_property_handler: Object;
-  instance_template: Object;
-  instance_call_handler: Object;
-  access_check_info: Object;
-  c_function: Foreign|Smi;
-  c_signature: Foreign|Smi;
+  prototype_template: ObjectTemplateInfo|Undefined;
+  prototype_provider_template: FunctionTemplateInfo|Undefined;
+  parent_template: FunctionTemplateInfo|Undefined;
+  named_property_handler: InterceptorInfo|Undefined;
+  indexed_property_handler: InterceptorInfo|Undefined;
+  instance_template: ObjectTemplateInfo|Undefined;
+  instance_call_handler: CallHandlerInfo|Undefined;
+  access_check_info: AccessCheckInfo|Undefined;
+  c_function: Foreign|Zero;
+  c_signature: Foreign|Zero;
+}
+
+bitfield struct FunctionTemplateInfoFlags extends uint31 {
+  undetectable: bool: 1 bit;
+  needs_access_check: bool: 1 bit;
+  read_only_prototype: bool: 1 bit;
+  remove_prototype: bool: 1 bit;
+  do_not_cache: bool: 1 bit;
+  accept_any_receiver: bool: 1 bit;
 }
 
 @generateCppClass
 extern class FunctionTemplateInfo extends TemplateInfo {
   // Handler invoked when calling an instance of this FunctionTemplateInfo.
   // Either CallHandlerInfo or Undefined.
-  call_code: Object;
-  class_name: Object;
+  call_code: CallHandlerInfo|Undefined;
+  class_name: String|Undefined;
   // If the signature is a FunctionTemplateInfo it is used to check whether the
   // receiver calling the associated JSFunction is a compatible receiver, i.e.
   // it is an instance of the signature FunctionTemplateInfo or any of the
   // receiver's prototypes are.
-  signature: Object;
+  signature: FunctionTemplateInfo|Undefined;
   // If any of the setters declared by DECL_RARE_ACCESSORS are used then a
   // FunctionTemplateRareData will be stored here. Until then this contains
   // undefined.
-  rare_data: HeapObject;
-  shared_function_info: Object;
+  rare_data: FunctionTemplateRareData|Undefined;
+  shared_function_info: SharedFunctionInfo|Undefined;
   // Internal field to store a flag bitfield.
-  flag: Smi;
+  flag: SmiTagged<FunctionTemplateInfoFlags>;
   // "length" property of the final JSFunction.
   length: Smi;
   // Either the_hole or a private symbol. Used to cache the result on
@@ -53,8 +63,13 @@ extern class FunctionTemplateInfo extends TemplateInfo {
   cached_property_name: Object;
 }
 
+bitfield struct ObjectTemplateInfoFlags extends uint31 {
+  is_immutable_prototype: bool: 1 bit;
+  embedder_field_count: int32: 29 bit;
+}
+
 @generateCppClass
 extern class ObjectTemplateInfo extends TemplateInfo {
-  constructor: Object;
-  data: Object;
+  constructor: FunctionTemplateInfo|Undefined;
+  data: SmiTagged<ObjectTemplateInfoFlags>;
 }
diff --git a/deps/v8/src/objects/templates-inl.h b/deps/v8/src/objects/templates-inl.h
index 988230b7ae4..8dd5aa6e2db 100644
--- a/deps/v8/src/objects/templates-inl.h
+++ b/deps/v8/src/objects/templates-inl.h
@@ -24,16 +24,17 @@ TQ_OBJECT_CONSTRUCTORS_IMPL(FunctionTemplateRareData)
 
 NEVER_READ_ONLY_SPACE_IMPL(TemplateInfo)
 
-BOOL_ACCESSORS(FunctionTemplateInfo, flag, undetectable, kUndetectableBit)
+BOOL_ACCESSORS(FunctionTemplateInfo, flag, undetectable,
+               UndetectableBit::kShift)
 BOOL_ACCESSORS(FunctionTemplateInfo, flag, needs_access_check,
-               kNeedsAccessCheckBit)
+               NeedsAccessCheckBit::kShift)
 BOOL_ACCESSORS(FunctionTemplateInfo, flag, read_only_prototype,
-               kReadOnlyPrototypeBit)
+               ReadOnlyPrototypeBit::kShift)
 BOOL_ACCESSORS(FunctionTemplateInfo, flag, remove_prototype,
-               kRemovePrototypeBit)
-BOOL_ACCESSORS(FunctionTemplateInfo, flag, do_not_cache, kDoNotCacheBit)
+               RemovePrototypeBit::kShift)
+BOOL_ACCESSORS(FunctionTemplateInfo, flag, do_not_cache, DoNotCacheBit::kShift)
 BOOL_ACCESSORS(FunctionTemplateInfo, flag, accept_any_receiver,
-               kAcceptAnyReceiver)
+               AcceptAnyReceiverBit::kShift)
 
 // static
 FunctionTemplateRareData FunctionTemplateInfo::EnsureFunctionTemplateRareData(
@@ -61,16 +62,18 @@ FunctionTemplateRareData FunctionTemplateInfo::EnsureFunctionTemplateRareData(
     rare_data.set_##Name(*Name);                                              \
   }
 
-RARE_ACCESSORS(prototype_template, PrototypeTemplate, Object, undefined)
-RARE_ACCESSORS(prototype_provider_template, PrototypeProviderTemplate, Object,
+RARE_ACCESSORS(prototype_template, PrototypeTemplate, HeapObject, undefined)
+RARE_ACCESSORS(prototype_provider_template, PrototypeProviderTemplate,
+               HeapObject, undefined)
+RARE_ACCESSORS(parent_template, ParentTemplate, HeapObject, undefined)
+RARE_ACCESSORS(named_property_handler, NamedPropertyHandler, HeapObject,
                undefined)
-RARE_ACCESSORS(parent_template, ParentTemplate, Object, undefined)
-RARE_ACCESSORS(named_property_handler, NamedPropertyHandler, Object, undefined)
-RARE_ACCESSORS(indexed_property_handler, IndexedPropertyHandler, Object,
+RARE_ACCESSORS(indexed_property_handler, IndexedPropertyHandler, HeapObject,
                undefined)
-RARE_ACCESSORS(instance_template, InstanceTemplate, Object, undefined)
-RARE_ACCESSORS(instance_call_handler, InstanceCallHandler, Object, undefined)
-RARE_ACCESSORS(access_check_info, AccessCheckInfo, Object, undefined)
+RARE_ACCESSORS(instance_template, InstanceTemplate, HeapObject, undefined)
+RARE_ACCESSORS(instance_call_handler, InstanceCallHandler, HeapObject,
+               undefined)
+RARE_ACCESSORS(access_check_info, AccessCheckInfo, HeapObject, undefined)
 RARE_ACCESSORS(c_function, CFunction, Object, Smi(0))
 RARE_ACCESSORS(c_signature, CSignature, Object, Smi(0))
 #undef RARE_ACCESSORS
@@ -110,26 +113,20 @@ ObjectTemplateInfo ObjectTemplateInfo::GetParent(Isolate* isolate) {
 }
 
 int ObjectTemplateInfo::embedder_field_count() const {
-  Object value = data();
-  DCHECK(value.IsSmi());
-  return EmbedderFieldCount::decode(Smi::ToInt(value));
+  return EmbedderFieldCountBits::decode(data());
 }
 
 void ObjectTemplateInfo::set_embedder_field_count(int count) {
   DCHECK_LE(count, JSObject::kMaxEmbedderFields);
-  return set_data(
-      Smi::FromInt(EmbedderFieldCount::update(Smi::ToInt(data()), count)));
+  return set_data(EmbedderFieldCountBits::update(data(), count));
 }
 
 bool ObjectTemplateInfo::immutable_proto() const {
-  Object value = data();
-  DCHECK(value.IsSmi());
-  return IsImmutablePrototype::decode(Smi::ToInt(value));
+  return IsImmutablePrototypeBit::decode(data());
 }
 
 void ObjectTemplateInfo::set_immutable_proto(bool immutable) {
-  return set_data(Smi::FromInt(
-      IsImmutablePrototype::update(Smi::ToInt(data()), immutable)));
+  return set_data(IsImmutablePrototypeBit::update(data(), immutable));
 }
 
 bool FunctionTemplateInfo::IsTemplateFor(JSObject object) {
diff --git a/deps/v8/src/objects/templates.h b/deps/v8/src/objects/templates.h
index 01d40eb29ae..a3b509928be 100644
--- a/deps/v8/src/objects/templates.h
+++ b/deps/v8/src/objects/templates.h
@@ -6,6 +6,7 @@
 #define V8_OBJECTS_TEMPLATES_H_
 
 #include "src/objects/struct.h"
+#include "torque-generated/bit-fields-tq.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -32,9 +33,6 @@ class FunctionTemplateRareData
     : public TorqueGeneratedFunctionTemplateRareData<FunctionTemplateRareData,
                                                      Struct> {
  public:
-  // Dispatched behavior.
-  DECL_PRINTER(FunctionTemplateRareData)
-
   TQ_OBJECT_CONSTRUCTORS(FunctionTemplateRareData)
 };
 
@@ -51,36 +49,37 @@ class FunctionTemplateInfo
 
   // ObjectTemplateInfo or Undefined, used for the prototype property of the
   // resulting JSFunction instance of this FunctionTemplate.
-  DECL_RARE_ACCESSORS(prototype_template, PrototypeTemplate, Object)
+  DECL_RARE_ACCESSORS(prototype_template, PrototypeTemplate, HeapObject)
 
   // In the case the prototype_template is Undefined we use the
   // prototype_provider_template to retrieve the instance prototype. Either
-  // contains an ObjectTemplateInfo or Undefined.
+  // contains an FunctionTemplateInfo or Undefined.
   DECL_RARE_ACCESSORS(prototype_provider_template, PrototypeProviderTemplate,
-                      Object)
+                      HeapObject)
 
   // Used to create prototype chains. The parent_template's prototype is set as
   // __proto__ of this FunctionTemplate's instance prototype. Is either a
   // FunctionTemplateInfo or Undefined.
-  DECL_RARE_ACCESSORS(parent_template, ParentTemplate, Object)
+  DECL_RARE_ACCESSORS(parent_template, ParentTemplate, HeapObject)
 
   // Returns an InterceptorInfo or Undefined for named properties.
-  DECL_RARE_ACCESSORS(named_property_handler, NamedPropertyHandler, Object)
+  DECL_RARE_ACCESSORS(named_property_handler, NamedPropertyHandler, HeapObject)
   // Returns an InterceptorInfo or Undefined for indexed properties/elements.
-  DECL_RARE_ACCESSORS(indexed_property_handler, IndexedPropertyHandler, Object)
+  DECL_RARE_ACCESSORS(indexed_property_handler, IndexedPropertyHandler,
+                      HeapObject)
 
   // An ObjectTemplateInfo that is used when instantiating the JSFunction
   // associated with this FunctionTemplateInfo. Contains either an
   // ObjectTemplateInfo or Undefined. A default instance_template is assigned
   // upon first instantiation if it's Undefined.
-  DECL_RARE_ACCESSORS(instance_template, InstanceTemplate, Object)
+  DECL_RARE_ACCESSORS(instance_template, InstanceTemplate, HeapObject)
 
   // Either a CallHandlerInfo or Undefined. If an instance_call_handler is
   // provided the instances created from the associated JSFunction are marked as
   // callable.
-  DECL_RARE_ACCESSORS(instance_call_handler, InstanceCallHandler, Object)
+  DECL_RARE_ACCESSORS(instance_call_handler, InstanceCallHandler, HeapObject)
 
-  DECL_RARE_ACCESSORS(access_check_info, AccessCheckInfo, Object)
+  DECL_RARE_ACCESSORS(access_check_info, AccessCheckInfo, HeapObject)
 
   DECL_RARE_ACCESSORS(c_function, CFunction, Object)
   DECL_RARE_ACCESSORS(c_signature, CSignature, Object)
@@ -138,12 +137,7 @@ class FunctionTemplateInfo
                                                     Handle<Object> getter);
 
   // Bit position in the flag, from least significant bit position.
-  static const int kUndetectableBit = 0;
-  static const int kNeedsAccessCheckBit = 1;
-  static const int kReadOnlyPrototypeBit = 2;
-  static const int kRemovePrototypeBit = 3;
-  static const int kDoNotCacheBit = 4;
-  static const int kAcceptAnyReceiver = 5;
+  DEFINE_TORQUE_GENERATED_FUNCTION_TEMPLATE_INFO_FLAGS()
 
  private:
   static inline FunctionTemplateRareData EnsureFunctionTemplateRareData(
@@ -170,8 +164,7 @@ class ObjectTemplateInfo
   inline ObjectTemplateInfo GetParent(Isolate* isolate);
 
  private:
-  using IsImmutablePrototype = base::BitField<bool, 0, 1>;
-  using EmbedderFieldCount = IsImmutablePrototype::Next<int, 29>;
+  DEFINE_TORQUE_GENERATED_OBJECT_TEMPLATE_INFO_FLAGS()
 
   TQ_OBJECT_CONSTRUCTORS(ObjectTemplateInfo)
 };
diff --git a/deps/v8/src/objects/transitions.h b/deps/v8/src/objects/transitions.h
index 5a7db13e516..f2a10bb4031 100644
--- a/deps/v8/src/objects/transitions.h
+++ b/deps/v8/src/objects/transitions.h
@@ -228,7 +228,7 @@ class TransitionArray : public WeakFixedArray {
   int GetSortedKeyIndex(int transition_number) { return transition_number; }
   inline int number_of_entries() const;
 #ifdef DEBUG
-  V8_EXPORT_PRIVATE bool IsSortedNoDuplicates(int valid_entries = -1);
+  V8_EXPORT_PRIVATE bool IsSortedNoDuplicates();
 #endif
 
   void Sort();
diff --git a/deps/v8/src/objects/type-hints.cc b/deps/v8/src/objects/type-hints.cc
index cb0a6a4ea9b..da63443b4ca 100644
--- a/deps/v8/src/objects/type-hints.cc
+++ b/deps/v8/src/objects/type-hints.cc
@@ -39,6 +39,8 @@ std::ostream& operator<<(std::ostream& os, CompareOperationHint hint) {
       return os << "SignedSmall";
     case CompareOperationHint::kNumber:
       return os << "Number";
+    case CompareOperationHint::kNumberOrBoolean:
+      return os << "NumberOrBoolean";
     case CompareOperationHint::kNumberOrOddball:
       return os << "NumberOrOddball";
     case CompareOperationHint::kInternalizedString:
diff --git a/deps/v8/src/objects/type-hints.h b/deps/v8/src/objects/type-hints.h
index 1aa27096652..d61ebef8457 100644
--- a/deps/v8/src/objects/type-hints.h
+++ b/deps/v8/src/objects/type-hints.h
@@ -35,6 +35,7 @@ enum class CompareOperationHint : uint8_t {
   kNone,
   kSignedSmall,
   kNumber,
+  kNumberOrBoolean,
   kNumberOrOddball,
   kInternalizedString,
   kString,
diff --git a/deps/v8/src/objects/visitors.h b/deps/v8/src/objects/visitors.h
index c302fdb610c..20bbb1ff1c2 100644
--- a/deps/v8/src/objects/visitors.h
+++ b/deps/v8/src/objects/visitors.h
@@ -16,29 +16,29 @@ namespace internal {
 
 class CodeDataContainer;
 
-#define ROOT_ID_LIST(V)                                \
-  V(kStringTable, "(Internalized strings)")            \
-  V(kExternalStringsTable, "(External strings)")       \
-  V(kReadOnlyRootList, "(Read-only roots)")            \
-  V(kStrongRootList, "(Strong roots)")                 \
-  V(kSmiRootList, "(Smi roots)")                       \
-  V(kBootstrapper, "(Bootstrapper)")                   \
-  V(kTop, "(Isolate)")                                 \
-  V(kRelocatable, "(Relocatable)")                     \
-  V(kDebug, "(Debugger)")                              \
-  V(kCompilationCache, "(Compilation cache)")          \
-  V(kHandleScope, "(Handle scope)")                    \
-  V(kBuiltins, "(Builtins)")                           \
-  V(kGlobalHandles, "(Global handles)")                \
-  V(kEternalHandles, "(Eternal handles)")              \
-  V(kThreadManager, "(Thread manager)")                \
-  V(kStrongRoots, "(Strong roots)")                    \
-  V(kExtensions, "(Extensions)")                       \
-  V(kCodeFlusher, "(Code flusher)")                    \
-  V(kPartialSnapshotCache, "(Partial snapshot cache)") \
-  V(kReadOnlyObjectCache, "(Read-only object cache)")  \
-  V(kWeakCollections, "(Weak collections)")            \
-  V(kWrapperTracing, "(Wrapper tracing)")              \
+#define ROOT_ID_LIST(V)                               \
+  V(kStringTable, "(Internalized strings)")           \
+  V(kExternalStringsTable, "(External strings)")      \
+  V(kReadOnlyRootList, "(Read-only roots)")           \
+  V(kStrongRootList, "(Strong roots)")                \
+  V(kSmiRootList, "(Smi roots)")                      \
+  V(kBootstrapper, "(Bootstrapper)")                  \
+  V(kTop, "(Isolate)")                                \
+  V(kRelocatable, "(Relocatable)")                    \
+  V(kDebug, "(Debugger)")                             \
+  V(kCompilationCache, "(Compilation cache)")         \
+  V(kHandleScope, "(Handle scope)")                   \
+  V(kBuiltins, "(Builtins)")                          \
+  V(kGlobalHandles, "(Global handles)")               \
+  V(kEternalHandles, "(Eternal handles)")             \
+  V(kThreadManager, "(Thread manager)")               \
+  V(kStrongRoots, "(Strong roots)")                   \
+  V(kExtensions, "(Extensions)")                      \
+  V(kCodeFlusher, "(Code flusher)")                   \
+  V(kStartupObjectCache, "(Startup object cache)")    \
+  V(kReadOnlyObjectCache, "(Read-only object cache)") \
+  V(kWeakCollections, "(Weak collections)")           \
+  V(kWrapperTracing, "(Wrapper tracing)")             \
   V(kUnknown, "(Unknown)")
 
 class VisitorSynchronization : public AllStatic {
diff --git a/deps/v8/src/parsing/expression-scope.h b/deps/v8/src/parsing/expression-scope.h
index 6dd55a25c2d..9cb04003ab3 100644
--- a/deps/v8/src/parsing/expression-scope.h
+++ b/deps/v8/src/parsing/expression-scope.h
@@ -53,15 +53,36 @@ class ExpressionScope {
       AsExpressionParsingScope()->TrackVariable(result);
     } else {
       Variable* var = Declare(name, pos);
-      if (IsVarDeclaration() && !parser()->scope()->is_declaration_scope()) {
-        // Make sure we'll properly resolve the variable since we might be in a
-        // with or catch scope. In those cases the proxy isn't guaranteed to
-        // refer to the declared variable, so consider it unresolved.
-        parser()->scope()->AddUnresolved(result);
-      } else {
-        DCHECK_NOT_NULL(var);
-        result->BindTo(var);
+      if (IsVarDeclaration()) {
+        bool passed_through_with = false;
+        for (Scope* scope = parser()->scope(); !scope->is_declaration_scope();
+             scope = scope->outer_scope()) {
+          if (scope->is_with_scope()) {
+            passed_through_with = true;
+          } else if (scope->is_catch_scope()) {
+            Variable* var = scope->LookupLocal(name);
+            // If a variable is declared in a catch scope with a masking
+            // catch-declared variable, the initializing assignment is an
+            // assignment to the catch-declared variable instead.
+            // https://tc39.es/ecma262/#sec-variablestatements-in-catch-blocks
+            if (var != nullptr) {
+              result->set_is_assigned();
+              if (passed_through_with) break;
+              result->BindTo(var);
+              var->SetMaybeAssigned();
+              return result;
+            }
+          }
+        }
+        if (passed_through_with) {
+          // If a variable is declared in a with scope, the initializing
+          // assignment might target a with-declared variable instead.
+          parser()->scope()->AddUnresolved(result);
+          return result;
+        }
       }
+      DCHECK_NOT_NULL(var);
+      result->BindTo(var);
     }
     return result;
   }
diff --git a/deps/v8/src/parsing/parse-info.cc b/deps/v8/src/parsing/parse-info.cc
index 3723636804d..37432e05b7d 100644
--- a/deps/v8/src/parsing/parse-info.cc
+++ b/deps/v8/src/parsing/parse-info.cc
@@ -20,64 +20,108 @@
 namespace v8 {
 namespace internal {
 
-ParseInfo::ParseInfo(AccountingAllocator* zone_allocator, int script_id)
-    : zone_(std::make_unique<Zone>(zone_allocator, ZONE_NAME)),
-      flags_(0),
-      extension_(nullptr),
-      script_scope_(nullptr),
-      stack_limit_(0),
-      hash_seed_(0),
-      function_kind_(FunctionKind::kNormalFunction),
-      function_syntax_kind_(FunctionSyntaxKind::kDeclaration),
+UnoptimizedCompileFlags::UnoptimizedCompileFlags(Isolate* isolate,
+                                                 int script_id)
+    : flags_(0),
       script_id_(script_id),
-      start_position_(0),
-      end_position_(0),
-      parameters_end_pos_(kNoSourcePosition),
-      function_literal_id_(kFunctionLiteralIdInvalid),
-      max_function_literal_id_(kFunctionLiteralIdInvalid),
-      character_stream_(nullptr),
-      ast_value_factory_(nullptr),
-      ast_string_constants_(nullptr),
-      function_name_(nullptr),
-      runtime_call_stats_(nullptr),
-      source_range_map_(nullptr),
-      literal_(nullptr) {}
-
-ParseInfo::ParseInfo(Isolate* isolate, AccountingAllocator* zone_allocator,
-                     int script_id)
-    : ParseInfo(zone_allocator, script_id) {
-  set_hash_seed(HashSeed(isolate));
-  set_stack_limit(isolate->stack_guard()->real_climit());
-  set_runtime_call_stats(isolate->counters()->runtime_call_stats());
-  set_logger(isolate->logger());
-  set_ast_string_constants(isolate->ast_string_constants());
-  set_collect_source_positions(!FLAG_enable_lazy_source_positions ||
-                               isolate->NeedsDetailedOptimizedCodeLineInfo());
-  if (!isolate->is_best_effort_code_coverage()) set_coverage_enabled();
-  if (isolate->is_block_code_coverage()) set_block_coverage_enabled();
-  if (isolate->is_collecting_type_profile()) set_collect_type_profile();
-  if (isolate->compiler_dispatcher()->IsEnabled()) {
-    parallel_tasks_.reset(new ParallelTasks(isolate->compiler_dispatcher()));
-  }
+      function_kind_(FunctionKind::kNormalFunction),
+      function_syntax_kind_(FunctionSyntaxKind::kDeclaration) {
+  set_collect_type_profile(isolate->is_collecting_type_profile());
+  set_coverage_enabled(!isolate->is_best_effort_code_coverage());
+  set_block_coverage_enabled(isolate->is_block_code_coverage());
   set_might_always_opt(FLAG_always_opt || FLAG_prepare_always_opt);
-  set_allow_lazy_compile(FLAG_lazy);
   set_allow_natives_syntax(FLAG_allow_natives_syntax);
+  set_allow_lazy_compile(FLAG_lazy);
   set_allow_harmony_dynamic_import(FLAG_harmony_dynamic_import);
   set_allow_harmony_import_meta(FLAG_harmony_import_meta);
-  set_allow_harmony_optional_chaining(FLAG_harmony_optional_chaining);
-  set_allow_harmony_nullish(FLAG_harmony_nullish);
   set_allow_harmony_private_methods(FLAG_harmony_private_methods);
+  set_collect_source_positions(!FLAG_enable_lazy_source_positions ||
+                               isolate->NeedsDetailedOptimizedCodeLineInfo());
   set_allow_harmony_top_level_await(FLAG_harmony_top_level_await);
+  set_allow_harmony_logical_assignment(FLAG_harmony_logical_assignment);
+}
+
+// static
+UnoptimizedCompileFlags UnoptimizedCompileFlags::ForFunctionCompile(
+    Isolate* isolate, SharedFunctionInfo shared) {
+  Script script = Script::cast(shared.script());
+
+  UnoptimizedCompileFlags flags(isolate, script.id());
+
+  flags.SetFlagsFromFunction(&shared);
+  flags.SetFlagsForFunctionFromScript(script);
+
+  flags.set_allow_lazy_parsing(true);
+  flags.set_is_asm_wasm_broken(shared.is_asm_wasm_broken());
+  flags.set_is_repl_mode(shared.is_repl_mode());
+
+  // CollectTypeProfile uses its own feedback slots. If we have existing
+  // FeedbackMetadata, we can only collect type profile if the feedback vector
+  // has the appropriate slots.
+  flags.set_collect_type_profile(
+      isolate->is_collecting_type_profile() &&
+      (shared.HasFeedbackMetadata()
+           ? shared.feedback_metadata().HasTypeProfileSlot()
+           : script.IsUserJavaScript()));
+
+  // Do not support re-parsing top-level function of a wrapped script.
+  DCHECK_IMPLIES(flags.is_toplevel(), !script.is_wrapped());
+
+  return flags;
+}
+
+// static
+UnoptimizedCompileFlags UnoptimizedCompileFlags::ForScriptCompile(
+    Isolate* isolate, Script script) {
+  UnoptimizedCompileFlags flags(isolate, script.id());
+
+  flags.SetFlagsForFunctionFromScript(script);
+  flags.SetFlagsForToplevelCompile(
+      isolate->is_collecting_type_profile(), script.IsUserJavaScript(),
+      flags.outer_language_mode(), construct_repl_mode(script.is_repl_mode()));
+  if (script.is_wrapped()) {
+    flags.set_function_syntax_kind(FunctionSyntaxKind::kWrapped);
+  }
+
+  return flags;
 }
 
-ParseInfo::ParseInfo(Isolate* isolate)
-    : ParseInfo(isolate, isolate->allocator(), isolate->GetNextScriptId()) {
-  LOG(isolate, ScriptEvent(Logger::ScriptEventType::kReserveId, script_id()));
+// static
+UnoptimizedCompileFlags UnoptimizedCompileFlags::ForToplevelCompile(
+    Isolate* isolate, bool is_user_javascript, LanguageMode language_mode,
+    REPLMode repl_mode) {
+  UnoptimizedCompileFlags flags(isolate, isolate->GetNextScriptId());
+  flags.SetFlagsForToplevelCompile(isolate->is_collecting_type_profile(),
+                                   is_user_javascript, language_mode,
+                                   repl_mode);
+
+  LOG(isolate,
+      ScriptEvent(Logger::ScriptEventType::kReserveId, flags.script_id()));
+  return flags;
+}
+
+// static
+UnoptimizedCompileFlags UnoptimizedCompileFlags::ForToplevelFunction(
+    const UnoptimizedCompileFlags toplevel_flags,
+    const FunctionLiteral* literal) {
+  DCHECK(toplevel_flags.is_toplevel());
+  DCHECK(!literal->is_toplevel());
+
+  // Replicate the toplevel flags, then setup the function-specific flags.
+  UnoptimizedCompileFlags flags = toplevel_flags;
+  flags.SetFlagsFromFunction(literal);
+
+  return flags;
+}
+
+// static
+UnoptimizedCompileFlags UnoptimizedCompileFlags::ForTest(Isolate* isolate) {
+  return UnoptimizedCompileFlags(isolate, Script::kTemporaryScriptId);
 }
 
 template <typename T>
-void ParseInfo::SetFunctionInfo(T function) {
-  set_language_mode(function->language_mode());
+void UnoptimizedCompileFlags::SetFlagsFromFunction(T function) {
+  set_outer_language_mode(function->language_mode());
   set_function_kind(function->kind());
   set_function_syntax_kind(function->syntax_kind());
   set_requires_instance_members_initializer(
@@ -85,63 +129,88 @@ void ParseInfo::SetFunctionInfo(T function) {
   set_class_scope_has_private_brand(function->class_scope_has_private_brand());
   set_has_static_private_methods_or_accessors(
       function->has_static_private_methods_or_accessors());
-  set_toplevel(function->is_toplevel());
+  set_is_toplevel(function->is_toplevel());
   set_is_oneshot_iife(function->is_oneshot_iife());
 }
 
-ParseInfo::ParseInfo(Isolate* isolate, SharedFunctionInfo shared)
-    : ParseInfo(isolate, isolate->allocator(),
-                Script::cast(shared.script()).id()) {
-  // Do not support re-parsing top-level function of a wrapped script.
-  // TODO(yangguo): consider whether we need a top-level function in a
-  //                wrapped script at all.
-  DCHECK_IMPLIES(is_toplevel(), !Script::cast(shared.script()).is_wrapped());
-
+void UnoptimizedCompileFlags::SetFlagsForToplevelCompile(
+    bool is_collecting_type_profile, bool is_user_javascript,
+    LanguageMode language_mode, REPLMode repl_mode) {
   set_allow_lazy_parsing(true);
-  set_asm_wasm_broken(shared.is_asm_wasm_broken());
+  set_is_toplevel(true);
+  set_collect_type_profile(is_user_javascript && is_collecting_type_profile);
+  set_outer_language_mode(
+      stricter_language_mode(outer_language_mode(), language_mode));
+  set_is_repl_mode((repl_mode == REPLMode::kYes));
 
-  set_start_position(shared.StartPosition());
-  set_end_position(shared.EndPosition());
-  function_literal_id_ = shared.function_literal_id();
-  SetFunctionInfo(&shared);
+  set_block_coverage_enabled(block_coverage_enabled() && is_user_javascript);
+}
 
-  Script script = Script::cast(shared.script());
-  SetFlagsForFunctionFromScript(script);
+void UnoptimizedCompileFlags::SetFlagsForFunctionFromScript(Script script) {
+  DCHECK_EQ(script_id(), script.id());
 
-  set_repl_mode(shared.is_repl_mode());
+  set_is_eval(script.compilation_type() == Script::COMPILATION_TYPE_EVAL);
+  set_is_module(script.origin_options().IsModule());
+  DCHECK(!(is_eval() && is_module()));
 
-  // CollectTypeProfile uses its own feedback slots. If we have existing
-  // FeedbackMetadata, we can only collect type profile if the feedback vector
-  // has the appropriate slots.
-  set_collect_type_profile(
-      isolate->is_collecting_type_profile() &&
-      (shared.HasFeedbackMetadata()
-           ? shared.feedback_metadata().HasTypeProfileSlot()
-           : script.IsUserJavaScript()));
+  set_block_coverage_enabled(block_coverage_enabled() &&
+                             script.IsUserJavaScript());
 }
 
-ParseInfo::ParseInfo(Isolate* isolate, Script script)
-    : ParseInfo(isolate, isolate->allocator(), script.id()) {
-  SetFlagsForToplevelCompileFromScript(isolate, script,
-                                       isolate->is_collecting_type_profile());
+UnoptimizedCompileState::UnoptimizedCompileState(Isolate* isolate)
+    : hash_seed_(HashSeed(isolate)),
+      allocator_(isolate->allocator()),
+      ast_string_constants_(isolate->ast_string_constants()),
+      logger_(isolate->logger()),
+      parallel_tasks_(isolate->compiler_dispatcher()->IsEnabled()
+                          ? new ParallelTasks(isolate->compiler_dispatcher())
+                          : nullptr) {}
+
+UnoptimizedCompileState::UnoptimizedCompileState(
+    const UnoptimizedCompileState& other) V8_NOEXCEPT
+    : hash_seed_(other.hash_seed()),
+      allocator_(other.allocator()),
+      ast_string_constants_(other.ast_string_constants()),
+      logger_(other.logger()),
+      // TODO(leszeks): Should this create a new ParallelTasks instance?
+      parallel_tasks_(nullptr) {}
+
+ParseInfo::ParseInfo(const UnoptimizedCompileFlags flags,
+                     UnoptimizedCompileState* state)
+    : flags_(flags),
+      state_(state),
+      zone_(std::make_unique<Zone>(state->allocator(), ZONE_NAME)),
+      extension_(nullptr),
+      script_scope_(nullptr),
+      stack_limit_(0),
+      parameters_end_pos_(kNoSourcePosition),
+      max_function_literal_id_(kFunctionLiteralIdInvalid),
+      character_stream_(nullptr),
+      ast_value_factory_(nullptr),
+      function_name_(nullptr),
+      runtime_call_stats_(nullptr),
+      source_range_map_(nullptr),
+      literal_(nullptr),
+      allow_eval_cache_(false),
+      contains_asm_module_(false),
+      language_mode_(flags.outer_language_mode()) {
+  if (flags.block_coverage_enabled()) {
+    AllocateSourceRangeMap();
+  }
+}
+
+ParseInfo::ParseInfo(Isolate* isolate, const UnoptimizedCompileFlags flags,
+                     UnoptimizedCompileState* state)
+    : ParseInfo(flags, state) {
+  SetPerThreadState(isolate->stack_guard()->real_climit(),
+                    isolate->counters()->runtime_call_stats());
 }
 
 // static
-std::unique_ptr<ParseInfo> ParseInfo::FromParent(
-    const ParseInfo* outer_parse_info, AccountingAllocator* zone_allocator,
+std::unique_ptr<ParseInfo> ParseInfo::ForToplevelFunction(
+    const UnoptimizedCompileFlags flags, UnoptimizedCompileState* compile_state,
     const FunctionLiteral* literal, const AstRawString* function_name) {
-  // Can't use make_unique because the constructor is private.
-  std::unique_ptr<ParseInfo> result(
-      new ParseInfo(zone_allocator, outer_parse_info->script_id_));
-
-  // Replicate shared state of the outer_parse_info.
-  result->flags_ = outer_parse_info->flags_;
-  result->set_logger(outer_parse_info->logger());
-  result->set_ast_string_constants(outer_parse_info->ast_string_constants());
-  result->set_hash_seed(outer_parse_info->hash_seed());
-
-  DCHECK_EQ(outer_parse_info->parameters_end_pos(), kNoSourcePosition);
-  DCHECK_NULL(outer_parse_info->extension());
+  std::unique_ptr<ParseInfo> result(new ParseInfo(flags, compile_state));
 
   // Clone the function_name AstRawString into the ParseInfo's own
   // AstValueFactory.
@@ -152,10 +221,6 @@ std::unique_ptr<ParseInfo> ParseInfo::FromParent(
   // Setup function specific details.
   DCHECK(!literal->is_toplevel());
   result->set_function_name(cloned_function_name);
-  result->set_start_position(literal->start_position());
-  result->set_end_position(literal->end_position());
-  result->set_function_literal_id(literal->function_literal_id());
-  result->SetFunctionInfo(literal);
 
   return result;
 }
@@ -165,17 +230,15 @@ ParseInfo::~ParseInfo() = default;
 DeclarationScope* ParseInfo::scope() const { return literal()->scope(); }
 
 template <typename LocalIsolate>
-Handle<Script> ParseInfo::CreateScript(LocalIsolate* isolate,
-                                       Handle<String> source,
-                                       ScriptOriginOptions origin_options,
-                                       NativesFlag natives) {
+Handle<Script> ParseInfo::CreateScript(
+    LocalIsolate* isolate, Handle<String> source,
+    MaybeHandle<FixedArray> maybe_wrapped_arguments,
+    ScriptOriginOptions origin_options, NativesFlag natives) {
   // Create a script object describing the script to be compiled.
-  DCHECK_GE(script_id_, 0);
+  DCHECK(flags().script_id() >= 0 ||
+         flags().script_id() == Script::kTemporaryScriptId);
   Handle<Script> script =
-      isolate->factory()->NewScriptWithId(source, script_id_);
-  if (isolate->NeedsSourcePositionsForProfiling()) {
-    Script::InitLineEnds(isolate, script);
-  }
+      isolate->factory()->NewScriptWithId(source, flags().script_id());
   switch (natives) {
     case EXTENSION_CODE:
       script->set_type(Script::TYPE_EXTENSION);
@@ -187,8 +250,12 @@ Handle<Script> ParseInfo::CreateScript(LocalIsolate* isolate,
       break;
   }
   script->set_origin_options(origin_options);
-  script->set_is_repl_mode(is_repl_mode());
-  if (is_eval() && !is_wrapped_as_function()) {
+  script->set_is_repl_mode(flags().is_repl_mode());
+
+  DCHECK_EQ(is_wrapped_as_function(), !maybe_wrapped_arguments.is_null());
+  if (is_wrapped_as_function()) {
+    script->set_wrapped_arguments(*maybe_wrapped_arguments.ToHandleChecked());
+  } else if (flags().is_eval()) {
     script->set_compilation_type(Script::COMPILATION_TYPE_EVAL);
   }
 
@@ -198,15 +265,15 @@ Handle<Script> ParseInfo::CreateScript(LocalIsolate* isolate,
 }
 
 template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
-    Handle<Script> ParseInfo::CreateScript(Isolate* isolate,
-                                           Handle<String> source,
-                                           ScriptOriginOptions origin_options,
-                                           NativesFlag natives);
+    Handle<Script> ParseInfo::CreateScript(
+        Isolate* isolate, Handle<String> source,
+        MaybeHandle<FixedArray> maybe_wrapped_arguments,
+        ScriptOriginOptions origin_options, NativesFlag natives);
 template EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
-    Handle<Script> ParseInfo::CreateScript(OffThreadIsolate* isolate,
-                                           Handle<String> source,
-                                           ScriptOriginOptions origin_options,
-                                           NativesFlag natives);
+    Handle<Script> ParseInfo::CreateScript(
+        OffThreadIsolate* isolate, Handle<String> source,
+        MaybeHandle<FixedArray> maybe_wrapped_arguments,
+        ScriptOriginOptions origin_options, NativesFlag natives);
 
 AstValueFactory* ParseInfo::GetOrCreateAstValueFactory() {
   if (!ast_value_factory_.get()) {
@@ -217,7 +284,7 @@ AstValueFactory* ParseInfo::GetOrCreateAstValueFactory() {
 }
 
 void ParseInfo::AllocateSourceRangeMap() {
-  DCHECK(block_coverage_enabled());
+  DCHECK(flags().block_coverage_enabled());
   DCHECK_NULL(source_range_map());
   set_source_range_map(new (zone()) SourceRangeMap(zone()));
 }
@@ -230,75 +297,34 @@ void ParseInfo::set_character_stream(
   character_stream_.swap(character_stream);
 }
 
-void ParseInfo::SetFlagsForToplevelCompile(bool is_collecting_type_profile,
-                                           bool is_user_javascript,
-                                           LanguageMode language_mode,
-                                           REPLMode repl_mode) {
-  set_allow_lazy_parsing();
-  set_toplevel();
-  set_collect_type_profile(is_user_javascript && is_collecting_type_profile);
-  set_language_mode(
-      stricter_language_mode(this->language_mode(), language_mode));
-  set_repl_mode(repl_mode == REPLMode::kYes);
-
-  if (V8_UNLIKELY(is_user_javascript && block_coverage_enabled())) {
-    AllocateSourceRangeMap();
-  }
-}
-
-template <typename LocalIsolate>
-void ParseInfo::SetFlagsForToplevelCompileFromScript(
-    LocalIsolate* isolate, Script script, bool is_collecting_type_profile) {
-  SetFlagsForFunctionFromScript(script);
-  SetFlagsForToplevelCompile(is_collecting_type_profile,
-                             script.IsUserJavaScript(), language_mode(),
-                             construct_repl_mode(script.is_repl_mode()));
-
-  if (script.is_wrapped()) {
-    set_function_syntax_kind(FunctionSyntaxKind::kWrapped);
-  }
-}
-
 void ParseInfo::CheckFlagsForToplevelCompileFromScript(
     Script script, bool is_collecting_type_profile) {
   CheckFlagsForFunctionFromScript(script);
-  DCHECK(allow_lazy_parsing());
-  DCHECK(is_toplevel());
-  DCHECK_EQ(collect_type_profile(),
+  DCHECK(flags().allow_lazy_parsing());
+  DCHECK(flags().is_toplevel());
+  DCHECK_EQ(flags().collect_type_profile(),
             is_collecting_type_profile && script.IsUserJavaScript());
-  DCHECK_EQ(is_repl_mode(), script.is_repl_mode());
+  DCHECK_EQ(flags().is_repl_mode(), script.is_repl_mode());
 
   if (script.is_wrapped()) {
-    DCHECK_EQ(function_syntax_kind(), FunctionSyntaxKind::kWrapped);
-  }
-}
-
-void ParseInfo::SetFlagsForFunctionFromScript(Script script) {
-  DCHECK_EQ(script_id_, script.id());
-
-  set_eval(script.compilation_type() == Script::COMPILATION_TYPE_EVAL);
-  set_module(script.origin_options().IsModule());
-  DCHECK(!(is_eval() && is_module()));
-
-  if (block_coverage_enabled() && script.IsUserJavaScript()) {
-    AllocateSourceRangeMap();
+    DCHECK_EQ(flags().function_syntax_kind(), FunctionSyntaxKind::kWrapped);
   }
 }
 
 void ParseInfo::CheckFlagsForFunctionFromScript(Script script) {
-  DCHECK_EQ(script_id_, script.id());
-  // We set "is_eval" for wrapped functions to get an outer declaration scope.
+  DCHECK_EQ(flags().script_id(), script.id());
+  // We set "is_eval" for wrapped scripts to get an outer declaration scope.
   // This is a bit hacky, but ok since we can't be both eval and wrapped.
-  DCHECK_EQ(is_eval() && !is_wrapped_as_function(),
+  DCHECK_EQ(flags().is_eval() && !script.is_wrapped(),
             script.compilation_type() == Script::COMPILATION_TYPE_EVAL);
-  DCHECK_EQ(is_module(), script.origin_options().IsModule());
-  DCHECK_IMPLIES(block_coverage_enabled() && script.IsUserJavaScript(),
+  DCHECK_EQ(flags().is_module(), script.origin_options().IsModule());
+  DCHECK_IMPLIES(flags().block_coverage_enabled() && script.IsUserJavaScript(),
                  source_range_map() != nullptr);
 }
 
-void ParseInfo::ParallelTasks::Enqueue(ParseInfo* outer_parse_info,
-                                       const AstRawString* function_name,
-                                       FunctionLiteral* literal) {
+void UnoptimizedCompileState::ParallelTasks::Enqueue(
+    ParseInfo* outer_parse_info, const AstRawString* function_name,
+    FunctionLiteral* literal) {
   base::Optional<CompilerDispatcher::JobId> job_id =
       dispatcher_->Enqueue(outer_parse_info, function_name, literal);
   if (job_id) {
diff --git a/deps/v8/src/parsing/parse-info.h b/deps/v8/src/parsing/parse-info.h
index 4430424eb93..c774f0ae942 100644
--- a/deps/v8/src/parsing/parse-info.h
+++ b/deps/v8/src/parsing/parse-info.h
@@ -10,7 +10,9 @@
 #include <vector>
 
 #include "include/v8.h"
+#include "src/base/bit-field.h"
 #include "src/base/export-template.h"
+#include "src/base/logging.h"
 #include "src/common/globals.h"
 #include "src/handles/handles.h"
 #include "src/objects/function-kind.h"
@@ -38,24 +40,187 @@ class SourceRangeMap;
 class Utf16CharacterStream;
 class Zone;
 
+// The flags for a parse + unoptimized compile operation.
+#define FLAG_FIELDS(V, _)                                \
+  V(is_toplevel, bool, 1, _)                             \
+  V(is_eager, bool, 1, _)                                \
+  V(is_eval, bool, 1, _)                                 \
+  V(outer_language_mode, LanguageMode, 1, _)             \
+  V(parse_restriction, ParseRestriction, 1, _)           \
+  V(is_module, bool, 1, _)                               \
+  V(allow_lazy_parsing, bool, 1, _)                      \
+  V(is_lazy_compile, bool, 1, _)                         \
+  V(collect_type_profile, bool, 1, _)                    \
+  V(coverage_enabled, bool, 1, _)                        \
+  V(block_coverage_enabled, bool, 1, _)                  \
+  V(is_asm_wasm_broken, bool, 1, _)                      \
+  V(class_scope_has_private_brand, bool, 1, _)           \
+  V(requires_instance_members_initializer, bool, 1, _)   \
+  V(has_static_private_methods_or_accessors, bool, 1, _) \
+  V(might_always_opt, bool, 1, _)                        \
+  V(allow_natives_syntax, bool, 1, _)                    \
+  V(allow_lazy_compile, bool, 1, _)                      \
+  V(allow_harmony_dynamic_import, bool, 1, _)            \
+  V(allow_harmony_import_meta, bool, 1, _)               \
+  V(allow_harmony_private_methods, bool, 1, _)           \
+  V(is_oneshot_iife, bool, 1, _)                         \
+  V(collect_source_positions, bool, 1, _)                \
+  V(allow_harmony_top_level_await, bool, 1, _)           \
+  V(is_repl_mode, bool, 1, _)                            \
+  V(allow_harmony_logical_assignment, bool, 1, _)
+
+class V8_EXPORT_PRIVATE UnoptimizedCompileFlags {
+ public:
+  // Set-up flags for a toplevel compilation.
+  static UnoptimizedCompileFlags ForToplevelCompile(Isolate* isolate,
+                                                    bool is_user_javascript,
+                                                    LanguageMode language_mode,
+                                                    REPLMode repl_mode);
+
+  // Set-up flags for a compiling a particular function (either a lazy compile
+  // or a recompile).
+  static UnoptimizedCompileFlags ForFunctionCompile(Isolate* isolate,
+                                                    SharedFunctionInfo shared);
+
+  // Set-up flags for a full compilation of a given script.
+  static UnoptimizedCompileFlags ForScriptCompile(Isolate* isolate,
+                                                  Script script);
+
+  // Set-up flags for a parallel toplevel function compilation, based on the
+  // flags of an existing toplevel compilation.
+  static UnoptimizedCompileFlags ForToplevelFunction(
+      const UnoptimizedCompileFlags toplevel_flags,
+      const FunctionLiteral* literal);
+
+  // Create flags for a test.
+  static UnoptimizedCompileFlags ForTest(Isolate* isolate);
+
+#define FLAG_GET_SET(NAME, TYPE, SIZE, _)                       \
+  TYPE NAME() const { return BitFields::NAME::decode(flags_); } \
+  UnoptimizedCompileFlags& set_##NAME(TYPE value) {             \
+    flags_ = BitFields::NAME::update(flags_, value);            \
+    return *this;                                               \
+  }
+
+  FLAG_FIELDS(FLAG_GET_SET, _)
+
+  int script_id() const { return script_id_; }
+  UnoptimizedCompileFlags& set_script_id(int value) {
+    script_id_ = value;
+    return *this;
+  }
+
+  FunctionKind function_kind() const { return function_kind_; }
+  UnoptimizedCompileFlags& set_function_kind(FunctionKind value) {
+    function_kind_ = value;
+    return *this;
+  }
+
+  FunctionSyntaxKind function_syntax_kind() const {
+    return function_syntax_kind_;
+  }
+  UnoptimizedCompileFlags& set_function_syntax_kind(FunctionSyntaxKind value) {
+    function_syntax_kind_ = value;
+    return *this;
+  }
+
+ private:
+  struct BitFields {
+    DEFINE_BIT_FIELDS(FLAG_FIELDS)
+  };
+
+  UnoptimizedCompileFlags(Isolate* isolate, int script_id);
+
+  // Set function info flags based on those in either FunctionLiteral or
+  // SharedFunctionInfo |function|
+  template <typename T>
+  void SetFlagsFromFunction(T function);
+  void SetFlagsForToplevelCompile(bool is_collecting_type_profile,
+                                  bool is_user_javascript,
+                                  LanguageMode language_mode,
+                                  REPLMode repl_mode);
+  void SetFlagsForFunctionFromScript(Script script);
+
+  uint32_t flags_;
+  int script_id_;
+  FunctionKind function_kind_;
+  FunctionSyntaxKind function_syntax_kind_;
+};
+
+#undef FLAG_FIELDS
+class ParseInfo;
+
+// The mutable state for a parse + unoptimized compile operation.
+class V8_EXPORT_PRIVATE UnoptimizedCompileState {
+ public:
+  explicit UnoptimizedCompileState(Isolate*);
+  UnoptimizedCompileState(const UnoptimizedCompileState& other) V8_NOEXCEPT;
+
+  class ParallelTasks {
+   public:
+    explicit ParallelTasks(CompilerDispatcher* compiler_dispatcher)
+        : dispatcher_(compiler_dispatcher) {
+      DCHECK_NOT_NULL(dispatcher_);
+    }
+
+    void Enqueue(ParseInfo* outer_parse_info, const AstRawString* function_name,
+                 FunctionLiteral* literal);
+
+    using EnqueuedJobsIterator =
+        std::forward_list<std::pair<FunctionLiteral*, uintptr_t>>::iterator;
+
+    EnqueuedJobsIterator begin() { return enqueued_jobs_.begin(); }
+    EnqueuedJobsIterator end() { return enqueued_jobs_.end(); }
+
+    CompilerDispatcher* dispatcher() { return dispatcher_; }
+
+   private:
+    CompilerDispatcher* dispatcher_;
+    std::forward_list<std::pair<FunctionLiteral*, uintptr_t>> enqueued_jobs_;
+  };
+
+  uint64_t hash_seed() const { return hash_seed_; }
+  AccountingAllocator* allocator() const { return allocator_; }
+  const AstStringConstants* ast_string_constants() const {
+    return ast_string_constants_;
+  }
+  Logger* logger() const { return logger_; }
+  PendingCompilationErrorHandler* pending_error_handler() {
+    return &pending_error_handler_;
+  }
+  const PendingCompilationErrorHandler* pending_error_handler() const {
+    return &pending_error_handler_;
+  }
+  ParallelTasks* parallel_tasks() const { return parallel_tasks_.get(); }
+
+ private:
+  uint64_t hash_seed_;
+  AccountingAllocator* allocator_;
+  const AstStringConstants* ast_string_constants_;
+  PendingCompilationErrorHandler pending_error_handler_;
+  Logger* logger_;
+  std::unique_ptr<ParallelTasks> parallel_tasks_;
+};
+
 // A container for the inputs, configuration options, and outputs of parsing.
 class V8_EXPORT_PRIVATE ParseInfo {
  public:
-  explicit ParseInfo(Isolate*);
-  ParseInfo(Isolate* isolate, Script script);
-  ParseInfo(Isolate* isolate, SharedFunctionInfo shared);
+  ParseInfo(Isolate* isolate, const UnoptimizedCompileFlags flags,
+            UnoptimizedCompileState* state);
 
   // Creates a new parse info based on parent top-level |outer_parse_info| for
   // function |literal|.
-  static std::unique_ptr<ParseInfo> FromParent(
-      const ParseInfo* outer_parse_info, AccountingAllocator* zone_allocator,
-      const FunctionLiteral* literal, const AstRawString* function_name);
+  static std::unique_ptr<ParseInfo> ForToplevelFunction(
+      const UnoptimizedCompileFlags flags,
+      UnoptimizedCompileState* compile_state, const FunctionLiteral* literal,
+      const AstRawString* function_name);
 
   ~ParseInfo();
 
   template <typename LocalIsolate>
   EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
   Handle<Script> CreateScript(LocalIsolate* isolate, Handle<String> source,
+                              MaybeHandle<FixedArray> maybe_wrapped_arguments,
                               ScriptOriginOptions origin_options,
                               NativesFlag natives = NOT_NATIVES_CODE);
 
@@ -65,70 +230,40 @@ class V8_EXPORT_PRIVATE ParseInfo {
 
   Zone* zone() const { return zone_.get(); }
 
-// Convenience accessor methods for flags.
-#define FLAG_ACCESSOR(flag, getter, setter)     \
-  bool getter() const { return GetFlag(flag); } \
-  void setter() { SetFlag(flag); }              \
-  void setter(bool val) { SetFlag(flag, val); }
-
-  FLAG_ACCESSOR(kToplevel, is_toplevel, set_toplevel)
-  FLAG_ACCESSOR(kEager, is_eager, set_eager)
-  FLAG_ACCESSOR(kEval, is_eval, set_eval)
-  FLAG_ACCESSOR(kStrictMode, is_strict_mode, set_strict_mode)
-  FLAG_ACCESSOR(kModule, is_module, set_module)
-  FLAG_ACCESSOR(kAllowLazyParsing, allow_lazy_parsing, set_allow_lazy_parsing)
-  FLAG_ACCESSOR(kLazyCompile, lazy_compile, set_lazy_compile)
-  FLAG_ACCESSOR(kCollectTypeProfile, collect_type_profile,
-                set_collect_type_profile)
-  FLAG_ACCESSOR(kIsAsmWasmBroken, is_asm_wasm_broken, set_asm_wasm_broken)
-  FLAG_ACCESSOR(kContainsAsmModule, contains_asm_module,
-                set_contains_asm_module)
-  FLAG_ACCESSOR(kCoverageEnabled, coverage_enabled, set_coverage_enabled)
-  FLAG_ACCESSOR(kBlockCoverageEnabled, block_coverage_enabled,
-                set_block_coverage_enabled)
-  FLAG_ACCESSOR(kAllowEvalCache, allow_eval_cache, set_allow_eval_cache)
-  FLAG_ACCESSOR(kRequiresInstanceMembersInitializer,
-                requires_instance_members_initializer,
-                set_requires_instance_members_initializer)
-  FLAG_ACCESSOR(kClassScopeHasPrivateBrand, class_scope_has_private_brand,
-                set_class_scope_has_private_brand)
-  FLAG_ACCESSOR(kHasStaticPrivateMethodsOrAccessors,
-                has_static_private_methods_or_accessors,
-                set_has_static_private_methods_or_accessors)
-  FLAG_ACCESSOR(kMightAlwaysOpt, might_always_opt, set_might_always_opt)
-  FLAG_ACCESSOR(kAllowNativeSyntax, allow_natives_syntax,
-                set_allow_natives_syntax)
-  FLAG_ACCESSOR(kAllowLazyCompile, allow_lazy_compile, set_allow_lazy_compile)
-  FLAG_ACCESSOR(kAllowNativeSyntax, allow_native_syntax,
-                set_allow_native_syntax)
-  FLAG_ACCESSOR(kAllowHarmonyDynamicImport, allow_harmony_dynamic_import,
-                set_allow_harmony_dynamic_import)
-  FLAG_ACCESSOR(kAllowHarmonyImportMeta, allow_harmony_import_meta,
-                set_allow_harmony_import_meta)
-  FLAG_ACCESSOR(kAllowHarmonyOptionalChaining, allow_harmony_optional_chaining,
-                set_allow_harmony_optional_chaining)
-  FLAG_ACCESSOR(kAllowHarmonyPrivateMethods, allow_harmony_private_methods,
-                set_allow_harmony_private_methods)
-  FLAG_ACCESSOR(kIsOneshotIIFE, is_oneshot_iife, set_is_oneshot_iife)
-  FLAG_ACCESSOR(kCollectSourcePositions, collect_source_positions,
-                set_collect_source_positions)
-  FLAG_ACCESSOR(kAllowHarmonyNullish, allow_harmony_nullish,
-                set_allow_harmony_nullish)
-  FLAG_ACCESSOR(kAllowHarmonyTopLevelAwait, allow_harmony_top_level_await,
-                set_allow_harmony_top_level_await)
-  FLAG_ACCESSOR(kREPLMode, is_repl_mode, set_repl_mode)
-
-#undef FLAG_ACCESSOR
-
-  void set_parse_restriction(ParseRestriction restriction) {
-    SetFlag(kParseRestriction, restriction != NO_PARSE_RESTRICTION);
+  const UnoptimizedCompileFlags& flags() const { return flags_; }
+
+  // Getters for state.
+  uint64_t hash_seed() const { return state_->hash_seed(); }
+  AccountingAllocator* allocator() const { return state_->allocator(); }
+  const AstStringConstants* ast_string_constants() const {
+    return state_->ast_string_constants();
   }
+  Logger* logger() const { return state_->logger(); }
+  PendingCompilationErrorHandler* pending_error_handler() {
+    return state_->pending_error_handler();
+  }
+  UnoptimizedCompileState::ParallelTasks* parallel_tasks() const {
+    return state_->parallel_tasks();
+  }
+  const UnoptimizedCompileState* state() const { return state_; }
 
-  ParseRestriction parse_restriction() const {
-    return GetFlag(kParseRestriction) ? ONLY_SINGLE_FUNCTION_LITERAL
-                                      : NO_PARSE_RESTRICTION;
+  // Accessors for per-thread state.
+  uintptr_t stack_limit() const { return stack_limit_; }
+  RuntimeCallStats* runtime_call_stats() const { return runtime_call_stats_; }
+  void SetPerThreadState(uintptr_t stack_limit,
+                         RuntimeCallStats* runtime_call_stats) {
+    stack_limit_ = stack_limit;
+    runtime_call_stats_ = runtime_call_stats;
   }
 
+  // Accessor methods for output flags.
+  bool allow_eval_cache() const { return allow_eval_cache_; }
+  void set_allow_eval_cache(bool value) { allow_eval_cache_ = value; }
+  bool contains_asm_module() const { return contains_asm_module_; }
+  void set_contains_asm_module(bool value) { contains_asm_module_ = value; }
+  LanguageMode language_mode() const { return language_mode_; }
+  void set_language_mode(LanguageMode value) { language_mode_ = value; }
+
   Utf16CharacterStream* character_stream() const {
     return character_stream_.get();
   }
@@ -166,44 +301,13 @@ class V8_EXPORT_PRIVATE ParseInfo {
 
   DeclarationScope* scope() const;
 
-  uintptr_t stack_limit() const { return stack_limit_; }
-  void set_stack_limit(uintptr_t stack_limit) { stack_limit_ = stack_limit; }
-
-  uint64_t hash_seed() const { return hash_seed_; }
-  void set_hash_seed(uint64_t hash_seed) { hash_seed_ = hash_seed; }
-
-  int start_position() const { return start_position_; }
-  void set_start_position(int start_position) {
-    start_position_ = start_position;
-  }
-
-  int end_position() const { return end_position_; }
-  void set_end_position(int end_position) { end_position_ = end_position; }
-
   int parameters_end_pos() const { return parameters_end_pos_; }
   void set_parameters_end_pos(int parameters_end_pos) {
     parameters_end_pos_ = parameters_end_pos;
   }
 
-  int function_literal_id() const { return function_literal_id_; }
-  void set_function_literal_id(int function_literal_id) {
-    function_literal_id_ = function_literal_id;
-  }
-
-  FunctionKind function_kind() const { return function_kind_; }
-  void set_function_kind(FunctionKind function_kind) {
-    function_kind_ = function_kind;
-  }
-
-  FunctionSyntaxKind function_syntax_kind() const {
-    return function_syntax_kind_;
-  }
-  void set_function_syntax_kind(FunctionSyntaxKind function_syntax_kind) {
-    function_syntax_kind_ = function_syntax_kind;
-  }
-
   bool is_wrapped_as_function() const {
-    return function_syntax_kind() == FunctionSyntaxKind::kWrapped;
+    return flags().function_syntax_kind() == FunctionSyntaxKind::kWrapped;
   }
 
   int max_function_literal_id() const { return max_function_literal_id_; }
@@ -211,163 +315,45 @@ class V8_EXPORT_PRIVATE ParseInfo {
     max_function_literal_id_ = max_function_literal_id;
   }
 
-  const AstStringConstants* ast_string_constants() const {
-    return ast_string_constants_;
-  }
-  void set_ast_string_constants(
-      const AstStringConstants* ast_string_constants) {
-    ast_string_constants_ = ast_string_constants;
-  }
-
-  RuntimeCallStats* runtime_call_stats() const { return runtime_call_stats_; }
-  void set_runtime_call_stats(RuntimeCallStats* runtime_call_stats) {
-    runtime_call_stats_ = runtime_call_stats;
-  }
-  Logger* logger() const { return logger_; }
-  void set_logger(Logger* logger) { logger_ = logger; }
-
   void AllocateSourceRangeMap();
   SourceRangeMap* source_range_map() const { return source_range_map_; }
   void set_source_range_map(SourceRangeMap* source_range_map) {
     source_range_map_ = source_range_map;
   }
 
-  PendingCompilationErrorHandler* pending_error_handler() {
-    return &pending_error_handler_;
-  }
-
-  class ParallelTasks {
-   public:
-    explicit ParallelTasks(CompilerDispatcher* compiler_dispatcher)
-        : dispatcher_(compiler_dispatcher) {
-      DCHECK(dispatcher_);
-    }
-
-    void Enqueue(ParseInfo* outer_parse_info, const AstRawString* function_name,
-                 FunctionLiteral* literal);
-
-    using EnqueuedJobsIterator =
-        std::forward_list<std::pair<FunctionLiteral*, uintptr_t>>::iterator;
-
-    EnqueuedJobsIterator begin() { return enqueued_jobs_.begin(); }
-    EnqueuedJobsIterator end() { return enqueued_jobs_.end(); }
-
-    CompilerDispatcher* dispatcher() { return dispatcher_; }
-
-   private:
-    CompilerDispatcher* dispatcher_;
-    std::forward_list<std::pair<FunctionLiteral*, uintptr_t>> enqueued_jobs_;
-  };
-
-  ParallelTasks* parallel_tasks() { return parallel_tasks_.get(); }
-
-  void SetFlagsForToplevelCompile(bool is_collecting_type_profile,
-                                  bool is_user_javascript,
-                                  LanguageMode language_mode,
-                                  REPLMode repl_mode);
-
   void CheckFlagsForFunctionFromScript(Script script);
 
-  int script_id() const { return script_id_; }
-  //--------------------------------------------------------------------------
-
-  LanguageMode language_mode() const {
-    return construct_language_mode(is_strict_mode());
-  }
-  void set_language_mode(LanguageMode language_mode) {
-    STATIC_ASSERT(LanguageModeSize == 2);
-    set_strict_mode(is_strict(language_mode));
-  }
-
  private:
-  ParseInfo(AccountingAllocator* zone_allocator, int script_id);
-  ParseInfo(Isolate*, AccountingAllocator* zone_allocator, int script_id);
+  ParseInfo(const UnoptimizedCompileFlags flags,
+            UnoptimizedCompileState* state);
 
-  void SetFlagsForFunctionFromScript(Script script);
-
-  template <typename LocalIsolate>
-  void SetFlagsForToplevelCompileFromScript(LocalIsolate* isolate,
-                                            Script script,
-                                            bool is_collecting_type_profile);
   void CheckFlagsForToplevelCompileFromScript(Script script,
                                               bool is_collecting_type_profile);
 
-  // Set function info flags based on those in either FunctionLiteral or
-  // SharedFunctionInfo |function|
-  template <typename T>
-  void SetFunctionInfo(T function);
-
-  // Various configuration flags for parsing.
-  enum Flag : uint32_t {
-    // ---------- Input flags ---------------------------
-    kToplevel = 1u << 0,
-    kEager = 1u << 1,
-    kEval = 1u << 2,
-    kStrictMode = 1u << 3,
-    kNative = 1u << 4,
-    kParseRestriction = 1u << 5,
-    kModule = 1u << 6,
-    kAllowLazyParsing = 1u << 7,
-    kLazyCompile = 1u << 8,
-    kCollectTypeProfile = 1u << 9,
-    kCoverageEnabled = 1u << 10,
-    kBlockCoverageEnabled = 1u << 11,
-    kIsAsmWasmBroken = 1u << 12,
-    kAllowEvalCache = 1u << 13,
-    kRequiresInstanceMembersInitializer = 1u << 14,
-    kContainsAsmModule = 1u << 15,
-    kMightAlwaysOpt = 1u << 16,
-    kAllowLazyCompile = 1u << 17,
-    kAllowNativeSyntax = 1u << 18,
-    kAllowHarmonyPublicFields = 1u << 19,
-    kAllowHarmonyStaticFields = 1u << 20,
-    kAllowHarmonyDynamicImport = 1u << 21,
-    kAllowHarmonyImportMeta = 1u << 22,
-    kAllowHarmonyOptionalChaining = 1u << 23,
-    kHasStaticPrivateMethodsOrAccessors = 1u << 24,
-    kAllowHarmonyPrivateMethods = 1u << 25,
-    kIsOneshotIIFE = 1u << 26,
-    kCollectSourcePositions = 1u << 27,
-    kAllowHarmonyNullish = 1u << 28,
-    kAllowHarmonyTopLevelAwait = 1u << 29,
-    kREPLMode = 1u << 30,
-    kClassScopeHasPrivateBrand = 1u << 31,
-  };
-
   //------------- Inputs to parsing and scope analysis -----------------------
+  const UnoptimizedCompileFlags flags_;
+  UnoptimizedCompileState* state_;
+
   std::unique_ptr<Zone> zone_;
-  uint32_t flags_;
   v8::Extension* extension_;
   DeclarationScope* script_scope_;
   uintptr_t stack_limit_;
-  uint64_t hash_seed_;
-  FunctionKind function_kind_;
-  FunctionSyntaxKind function_syntax_kind_;
-  int script_id_;
-  int start_position_;
-  int end_position_;
   int parameters_end_pos_;
-  int function_literal_id_;
   int max_function_literal_id_;
 
   //----------- Inputs+Outputs of parsing and scope analysis -----------------
   std::unique_ptr<Utf16CharacterStream> character_stream_;
   std::unique_ptr<ConsumedPreparseData> consumed_preparse_data_;
   std::unique_ptr<AstValueFactory> ast_value_factory_;
-  const class AstStringConstants* ast_string_constants_;
   const AstRawString* function_name_;
   RuntimeCallStats* runtime_call_stats_;
-  Logger* logger_;
   SourceRangeMap* source_range_map_;  // Used when block coverage is enabled.
-  std::unique_ptr<ParallelTasks> parallel_tasks_;
 
   //----------- Output of parsing and scope analysis ------------------------
   FunctionLiteral* literal_;
-  PendingCompilationErrorHandler pending_error_handler_;
-
-  void SetFlag(Flag f) { flags_ |= f; }
-  void SetFlag(Flag f, bool v) { flags_ = v ? flags_ | f : flags_ & ~f; }
-  bool GetFlag(Flag f) const { return (flags_ & f) != 0; }
+  bool allow_eval_cache_ : 1;
+  bool contains_asm_module_ : 1;
+  LanguageMode language_mode_ : 1;
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/parsing/parser-base.h b/deps/v8/src/parsing/parser-base.h
index 29e527ce2cc..903ce2bb7f8 100644
--- a/deps/v8/src/parsing/parser-base.h
+++ b/deps/v8/src/parsing/parser-base.h
@@ -23,6 +23,7 @@
 #include "src/objects/function-kind.h"
 #include "src/parsing/expression-scope.h"
 #include "src/parsing/func-name-inferrer.h"
+#include "src/parsing/parse-info.h"
 #include "src/parsing/scanner.h"
 #include "src/parsing/token.h"
 #include "src/utils/pointer-with-payload.h"
@@ -241,7 +242,7 @@ class ParserBase {
              v8::Extension* extension, AstValueFactory* ast_value_factory,
              PendingCompilationErrorHandler* pending_error_handler,
              RuntimeCallStats* runtime_call_stats, Logger* logger,
-             int script_id, bool parsing_module, bool parsing_on_main_thread)
+             UnoptimizedCompileFlags flags, bool parsing_on_main_thread)
       : scope_(nullptr),
         original_scope_(nullptr),
         function_state_(nullptr),
@@ -252,56 +253,25 @@ class ParserBase {
         runtime_call_stats_(runtime_call_stats),
         logger_(logger),
         parsing_on_main_thread_(parsing_on_main_thread),
-        parsing_module_(parsing_module),
         stack_limit_(stack_limit),
         pending_error_handler_(pending_error_handler),
         zone_(zone),
         expression_scope_(nullptr),
         scanner_(scanner),
+        flags_(flags),
         function_literal_id_(0),
-        script_id_(script_id),
-        default_eager_compile_hint_(FunctionLiteral::kShouldLazyCompile),
-        allow_natives_(false),
-        allow_harmony_dynamic_import_(false),
-        allow_harmony_import_meta_(false),
-        allow_harmony_private_methods_(false),
-        allow_harmony_top_level_await_(false),
-        allow_eval_cache_(true) {
+        default_eager_compile_hint_(FunctionLiteral::kShouldLazyCompile) {
     pointer_buffer_.reserve(32);
     variable_buffer_.reserve(32);
   }
 
-#define ALLOW_ACCESSORS(name)                           \
-  bool allow_##name() const { return allow_##name##_; } \
-  void set_allow_##name(bool allow) { allow_##name##_ = allow; }
+  const UnoptimizedCompileFlags& flags() const { return flags_; }
 
-  ALLOW_ACCESSORS(natives)
-  ALLOW_ACCESSORS(harmony_dynamic_import)
-  ALLOW_ACCESSORS(harmony_import_meta)
-  ALLOW_ACCESSORS(harmony_private_methods)
-  ALLOW_ACCESSORS(harmony_top_level_await)
-  ALLOW_ACCESSORS(eval_cache)
-
-#undef ALLOW_ACCESSORS
+  bool allow_eval_cache() const { return allow_eval_cache_; }
+  void set_allow_eval_cache(bool allow) { allow_eval_cache_ = allow; }
 
   V8_INLINE bool has_error() const { return scanner()->has_parser_error(); }
 
-  bool allow_harmony_optional_chaining() const {
-    return scanner()->allow_harmony_optional_chaining();
-  }
-
-  void set_allow_harmony_optional_chaining(bool allow) {
-    scanner()->set_allow_harmony_optional_chaining(allow);
-  }
-
-  bool allow_harmony_nullish() const {
-    return scanner()->allow_harmony_nullish();
-  }
-
-  void set_allow_harmony_nullish(bool allow) {
-    scanner()->set_allow_harmony_nullish(allow);
-  }
-
   uintptr_t stack_limit() const { return stack_limit_; }
 
   void set_stack_limit(uintptr_t stack_limit) { stack_limit_ = stack_limit; }
@@ -885,8 +855,6 @@ class ParserBase {
     // Any further calls to Next or peek will return the illegal token.
     if (GetCurrentStackPosition() < stack_limit_) set_stack_overflow();
   }
-  int script_id() { return script_id_; }
-  void set_script_id(int id) { script_id_ = id; }
 
   V8_INLINE Token::Value peek() { return scanner()->peek(); }
 
@@ -1077,7 +1045,7 @@ class ParserBase {
     return IsResumableFunction(function_state_->kind());
   }
   bool is_await_allowed() const {
-    return is_async_function() || (allow_harmony_top_level_await() &&
+    return is_async_function() || (flags().allow_harmony_top_level_await() &&
                                    IsModule(function_state_->kind()));
   }
   const PendingCompilationErrorHandler* pending_error_handler() const {
@@ -1279,7 +1247,12 @@ class ParserBase {
   // hoisted over such a scope.
   void CheckConflictingVarDeclarations(DeclarationScope* scope) {
     if (has_error()) return;
-    Declaration* decl = scope->CheckConflictingVarDeclarations();
+    bool allowed_catch_binding_var_redeclaration = false;
+    Declaration* decl = scope->CheckConflictingVarDeclarations(
+        &allowed_catch_binding_var_redeclaration);
+    if (allowed_catch_binding_var_redeclaration) {
+      impl()->CountUsage(v8::Isolate::kVarRedeclaredCatchBinding);
+    }
     if (decl != nullptr) {
       // In ES6, conflicting variable bindings are early errors.
       const AstRawString* name = decl->var()->raw_name();
@@ -1501,16 +1474,14 @@ class ParserBase {
     FormalParametersT* parent_parameters_;
   };
 
-  class FunctionBodyParsingScope {
+  class FunctionParsingScope {
    public:
-    explicit FunctionBodyParsingScope(Impl* parser)
+    explicit FunctionParsingScope(Impl* parser)
         : parser_(parser), expression_scope_(parser_->expression_scope_) {
       parser_->expression_scope_ = nullptr;
     }
 
-    ~FunctionBodyParsingScope() {
-      parser_->expression_scope_ = expression_scope_;
-    }
+    ~FunctionParsingScope() { parser_->expression_scope_ = expression_scope_; }
 
    private:
     Impl* parser_;
@@ -1534,7 +1505,6 @@ class ParserBase {
   RuntimeCallStats* runtime_call_stats_;
   internal::Logger* logger_;
   bool parsing_on_main_thread_;
-  const bool parsing_module_;
   uintptr_t stack_limit_;
   PendingCompilationErrorHandler* pending_error_handler_;
 
@@ -1549,8 +1519,8 @@ class ParserBase {
 
   Scanner* scanner_;
 
+  const UnoptimizedCompileFlags flags_;
   int function_literal_id_;
-  int script_id_;
 
   FunctionLiteral::EagerCompileHint default_eager_compile_hint_;
 
@@ -1589,12 +1559,7 @@ class ParserBase {
 
   bool accept_IN_ = true;
 
-  bool allow_natives_;
-  bool allow_harmony_dynamic_import_;
-  bool allow_harmony_import_meta_;
-  bool allow_harmony_private_methods_;
-  bool allow_harmony_top_level_await_;
-  bool allow_eval_cache_;
+  bool allow_eval_cache_ = true;
 };
 
 template <typename Impl>
@@ -1644,7 +1609,7 @@ ParserBase<Impl>::ParseAndClassifyIdentifier(Token::Value next) {
   }
 
   if (!Token::IsValidIdentifier(next, language_mode(), is_generator(),
-                                parsing_module_ || is_async_function())) {
+                                flags().is_module() || is_async_function())) {
     ReportUnexpectedToken(next);
     return impl()->EmptyIdentifierString();
   }
@@ -1668,7 +1633,7 @@ typename ParserBase<Impl>::IdentifierT ParserBase<Impl>::ParseIdentifier(
 
   if (!Token::IsValidIdentifier(
           next, language_mode(), IsGeneratorFunction(function_kind),
-          parsing_module_ || IsAsyncFunction(function_kind))) {
+          flags().is_module() || IsAsyncFunction(function_kind))) {
     ReportUnexpectedToken(next);
     return impl()->EmptyIdentifierString();
   }
@@ -1879,7 +1844,7 @@ ParserBase<Impl>::ParsePrimaryExpression() {
       return ParseSuperExpression(is_new);
     }
     case Token::IMPORT:
-      if (!allow_harmony_dynamic_import()) break;
+      if (!flags().allow_harmony_dynamic_import()) break;
       return ParseImportExpressions();
 
     case Token::LBRACK:
@@ -1942,7 +1907,7 @@ ParserBase<Impl>::ParsePrimaryExpression() {
       return ParseTemplateLiteral(impl()->NullExpression(), beg_pos, false);
 
     case Token::MOD:
-      if (allow_natives() || extension_ != nullptr) {
+      if (flags().allow_natives_syntax() || extension_ != nullptr) {
         return ParseV8Intrinsic();
       }
       break;
@@ -2188,7 +2153,7 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseProperty(
         prop_info->kind = ParsePropertyKind::kNotSet;
         return impl()->FailureExpression();
       }
-      if (V8_UNLIKELY(!allow_harmony_private_methods() &&
+      if (V8_UNLIKELY(!flags().allow_harmony_private_methods() &&
                       (IsAccessor(prop_info->kind) ||
                        prop_info->kind == ParsePropertyKind::kMethod))) {
         ReportUnexpectedToken(Next());
@@ -2437,7 +2402,7 @@ ParserBase<Impl>::ParseClassPropertyDefinition(ClassInfo* class_info,
 template <typename Impl>
 typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseMemberInitializer(
     ClassInfo* class_info, int beg_pos, bool is_static) {
-  FunctionBodyParsingScope body_parsing_scope(impl());
+  FunctionParsingScope body_parsing_scope(impl());
   DeclarationScope* initializer_scope =
       is_static ? class_info->static_fields_scope
                 : class_info->instance_members_scope;
@@ -2535,8 +2500,9 @@ ParserBase<Impl>::ParseObjectPropertyDefinition(ParsePropertyInfo* prop_info,
       //    IdentifierReference Initializer?
       DCHECK_EQ(function_flags, ParseFunctionFlag::kIsNormal);
 
-      if (!Token::IsValidIdentifier(name_token, language_mode(), is_generator(),
-                                    parsing_module_ || is_async_function())) {
+      if (!Token::IsValidIdentifier(
+              name_token, language_mode(), is_generator(),
+              flags().is_module() || is_async_function())) {
         ReportUnexpectedToken(Next());
         return impl()->NullLiteralProperty();
       }
@@ -2789,6 +2755,11 @@ ParserBase<Impl>::ParseAssignmentExpressionCoverGrammar() {
   Token::Value op = peek();
 
   if (!Token::IsArrowOrAssignmentOp(op)) return expression;
+  if ((op == Token::ASSIGN_NULLISH || op == Token::ASSIGN_OR ||
+       op == Token::ASSIGN_AND) &&
+      !flags().allow_harmony_logical_assignment()) {
+    return expression;
+  }
 
   // Arrow functions.
   if (V8_UNLIKELY(op == Token::ARROW)) {
@@ -3399,13 +3370,7 @@ ParserBase<Impl>::ParseLeftHandSideContinuation(ExpressionT result) {
         if (is_optional) {
           DCHECK_EQ(scanner()->current_token(), Token::QUESTION_PERIOD);
           int pos = position();
-          Token::Value next = Next();
-          if (V8_UNLIKELY(!Token::IsPropertyName(next))) {
-            ReportUnexpectedToken(next);
-            return impl()->FailureExpression();
-          }
-          IdentifierT name = impl()->GetSymbol();
-          ExpressionT key = factory()->NewStringLiteral(name, position());
+          ExpressionT key = ParsePropertyOrPrivatePropertyName();
           result = factory()->NewProperty(result, key, pos, is_optional);
           break;
         }
@@ -3456,8 +3421,10 @@ ParserBase<Impl>::ParseMemberWithPresentNewPrefixesExpression() {
   if (peek() == Token::SUPER) {
     const bool is_new = true;
     result = ParseSuperExpression(is_new);
-  } else if (allow_harmony_dynamic_import() && peek() == Token::IMPORT &&
-             (!allow_harmony_import_meta() || PeekAhead() == Token::LPAREN)) {
+  } else if (flags().allow_harmony_dynamic_import() &&
+             peek() == Token::IMPORT &&
+             (!flags().allow_harmony_import_meta() ||
+              PeekAhead() == Token::LPAREN)) {
     impl()->ReportMessageAt(scanner()->peek_location(),
                             MessageTemplate::kImportCallNotNewExpression);
     return impl()->FailureExpression();
@@ -3555,14 +3522,14 @@ ParserBase<Impl>::ParseMemberExpression() {
 template <typename Impl>
 typename ParserBase<Impl>::ExpressionT
 ParserBase<Impl>::ParseImportExpressions() {
-  DCHECK(allow_harmony_dynamic_import());
+  DCHECK(flags().allow_harmony_dynamic_import());
 
   Consume(Token::IMPORT);
   int pos = position();
-  if (allow_harmony_import_meta() && Check(Token::PERIOD)) {
+  if (flags().allow_harmony_import_meta() && Check(Token::PERIOD)) {
     ExpectContextualKeyword(ast_value_factory()->meta_string(), "import.meta",
                             pos);
-    if (!parsing_module_) {
+    if (!flags().is_module()) {
       impl()->ReportMessageAt(scanner()->location(),
                               MessageTemplate::kImportMetaOutsideModule);
       return impl()->FailureExpression();
@@ -3572,7 +3539,7 @@ ParserBase<Impl>::ParseImportExpressions() {
   }
 
   if (V8_UNLIKELY(peek() != Token::LPAREN)) {
-    if (!parsing_module_) {
+    if (!flags().is_module()) {
       impl()->ReportMessageAt(scanner()->location(),
                               MessageTemplate::kImportOutsideModule);
     } else {
@@ -4157,8 +4124,6 @@ void ParserBase<Impl>::ParseFunctionBody(
     StatementListT* body, IdentifierT function_name, int pos,
     const FormalParametersT& parameters, FunctionKind kind,
     FunctionSyntaxKind function_syntax_kind, FunctionBodyType body_type) {
-  FunctionBodyParsingScope body_parsing_scope(impl());
-
   if (IsResumableFunction(kind)) impl()->PrepareGeneratorVariables();
 
   DeclarationScope* function_scope = parameters.scope;
@@ -4435,6 +4400,7 @@ ParserBase<Impl>::ParseArrowFunctionLiteral(
           Consume(Token::LBRACE);
 
           AcceptINScope scope(this, true);
+          FunctionParsingScope body_parsing_scope(impl());
           ParseFunctionBody(&body, impl()->NullIdentifier(), kNoSourcePosition,
                             parameters, kind,
                             FunctionSyntaxKind::kAnonymousExpression,
@@ -4445,6 +4411,7 @@ ParserBase<Impl>::ParseArrowFunctionLiteral(
       } else {
         Consume(Token::LBRACE);
         AcceptINScope scope(this, true);
+        FunctionParsingScope body_parsing_scope(impl());
         ParseFunctionBody(&body, impl()->NullIdentifier(), kNoSourcePosition,
                           formal_parameters, kind,
                           FunctionSyntaxKind::kAnonymousExpression,
@@ -4454,6 +4421,7 @@ ParserBase<Impl>::ParseArrowFunctionLiteral(
     } else {
       // Single-expression body
       has_braces = false;
+      FunctionParsingScope body_parsing_scope(impl());
       ParseFunctionBody(&body, impl()->NullIdentifier(), kNoSourcePosition,
                         formal_parameters, kind,
                         FunctionSyntaxKind::kAnonymousExpression,
@@ -4493,8 +4461,9 @@ ParserBase<Impl>::ParseArrowFunctionLiteral(
     const char* event_name =
         is_lazy_top_level_function ? "preparse-no-resolution" : "parse";
     const char* name = "arrow function";
-    logger_->FunctionEvent(event_name, script_id(), ms, scope->start_position(),
-                           scope->end_position(), name, strlen(name));
+    logger_->FunctionEvent(event_name, flags().script_id(), ms,
+                           scope->start_position(), scope->end_position(), name,
+                           strlen(name));
   }
 
   return function_literal;
diff --git a/deps/v8/src/parsing/parser.cc b/deps/v8/src/parsing/parser.cc
index 2a1ad0e98b7..63b8b9c6f94 100644
--- a/deps/v8/src/parsing/parser.cc
+++ b/deps/v8/src/parsing/parser.cc
@@ -15,6 +15,7 @@
 #include "src/base/overflowing-math.h"
 #include "src/base/platform/platform.h"
 #include "src/codegen/bailout-reason.h"
+#include "src/common/globals.h"
 #include "src/common/message-template.h"
 #include "src/compiler-dispatcher/compiler-dispatcher.h"
 #include "src/logging/counters.h"
@@ -416,13 +417,12 @@ Expression* Parser::NewV8RuntimeFunctionForFuzzing(
 }
 
 Parser::Parser(ParseInfo* info)
-    : ParserBase<Parser>(info->zone(), &scanner_, info->stack_limit(),
-                         info->extension(), info->GetOrCreateAstValueFactory(),
-                         info->pending_error_handler(),
-                         info->runtime_call_stats(), info->logger(),
-                         info->script_id(), info->is_module(), true),
+    : ParserBase<Parser>(
+          info->zone(), &scanner_, info->stack_limit(), info->extension(),
+          info->GetOrCreateAstValueFactory(), info->pending_error_handler(),
+          info->runtime_call_stats(), info->logger(), info->flags(), true),
       info_(info),
-      scanner_(info->character_stream(), info->is_module()),
+      scanner_(info->character_stream(), flags()),
       preparser_zone_(info->zone()->allocator(), ZONE_NAME),
       reusable_preparser_(nullptr),
       mode_(PARSE_EAGERLY),  // Lazy mode must be set explicitly.
@@ -445,20 +445,13 @@ Parser::Parser(ParseInfo* info)
   // of functions without an outer context when setting a breakpoint through
   // Debug::FindSharedFunctionInfoInScript
   // We also compile eagerly for kProduceExhaustiveCodeCache.
-  bool can_compile_lazily = info->allow_lazy_compile() && !info->is_eager();
+  bool can_compile_lazily = flags().allow_lazy_compile() && !flags().is_eager();
 
   set_default_eager_compile_hint(can_compile_lazily
                                      ? FunctionLiteral::kShouldLazyCompile
                                      : FunctionLiteral::kShouldEagerCompile);
-  allow_lazy_ = info->allow_lazy_compile() && info->allow_lazy_parsing() &&
+  allow_lazy_ = flags().allow_lazy_compile() && flags().allow_lazy_parsing() &&
                 info->extension() == nullptr && can_compile_lazily;
-  set_allow_natives(info->allow_natives_syntax());
-  set_allow_harmony_dynamic_import(info->allow_harmony_dynamic_import());
-  set_allow_harmony_import_meta(info->allow_harmony_import_meta());
-  set_allow_harmony_nullish(info->allow_harmony_nullish());
-  set_allow_harmony_optional_chaining(info->allow_harmony_optional_chaining());
-  set_allow_harmony_private_methods(info->allow_harmony_private_methods());
-  set_allow_harmony_top_level_await(info->allow_harmony_top_level_await());
   for (int feature = 0; feature < v8::Isolate::kUseCounterFeatureCount;
        ++feature) {
     use_counts_[feature] = 0;
@@ -469,7 +462,7 @@ void Parser::InitializeEmptyScopeChain(ParseInfo* info) {
   DCHECK_NULL(original_scope_);
   DCHECK_NULL(info->script_scope());
   DeclarationScope* script_scope =
-      NewScriptScope(info->is_repl_mode() ? REPLMode::kYes : REPLMode::kNo);
+      NewScriptScope(flags().is_repl_mode() ? REPLMode::kYes : REPLMode::kNo);
   info->set_script_scope(script_scope);
   original_scope_ = script_scope;
 }
@@ -485,7 +478,7 @@ void Parser::DeserializeScopeChain(
     original_scope_ = Scope::DeserializeScopeChain(
         isolate, zone(), *outer_scope_info, info->script_scope(),
         ast_value_factory(), mode);
-    if (info->is_eval() || IsArrowFunction(info->function_kind())) {
+    if (flags().is_eval() || IsArrowFunction(flags().function_kind())) {
       original_scope_->GetReceiverScope()->DeserializeReceiver(
           ast_value_factory());
     }
@@ -515,18 +508,18 @@ void MaybeProcessSourceRanges(ParseInfo* parse_info, Expression* root,
 
 }  // namespace
 
-FunctionLiteral* Parser::ParseProgram(
-    Isolate* isolate, Handle<Script> script, ParseInfo* info,
-    MaybeHandle<ScopeInfo> maybe_outer_scope_info) {
+void Parser::ParseProgram(Isolate* isolate, Handle<Script> script,
+                          ParseInfo* info,
+                          MaybeHandle<ScopeInfo> maybe_outer_scope_info) {
   // TODO(bmeurer): We temporarily need to pass allow_nesting = true here,
   // see comment for HistogramTimerScope class.
-  DCHECK_EQ(script->id(), script_id());
+  DCHECK_EQ(script->id(), flags().script_id());
 
   // It's OK to use the Isolate & counters here, since this function is only
   // called in the main thread.
   DCHECK(parsing_on_main_thread_);
   RuntimeCallTimerScope runtime_timer(
-      runtime_call_stats_, info->is_eval()
+      runtime_call_stats_, flags().is_eval()
                                ? RuntimeCallCounterId::kParseEval
                                : RuntimeCallCounterId::kParseProgram);
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"), "V8.ParseProgram");
@@ -546,6 +539,7 @@ FunctionLiteral* Parser::ParseProgram(
   FunctionLiteral* result = DoParseProgram(isolate, info);
   MaybeResetCharacterStream(info, result);
   MaybeProcessSourceRanges(info, result, stack_limit_);
+  PostProcessParseResult(isolate, info, result);
 
   HandleSourceURLComments(isolate, script);
 
@@ -554,14 +548,14 @@ FunctionLiteral* Parser::ParseProgram(
     const char* event_name = "parse-eval";
     int start = -1;
     int end = -1;
-    if (!info->is_eval()) {
+    if (!flags().is_eval()) {
       event_name = "parse-script";
       start = 0;
       end = String::cast(script->source()).length();
     }
-    LOG(isolate, FunctionEvent(event_name, script_id(), ms, start, end, "", 0));
+    LOG(isolate,
+        FunctionEvent(event_name, flags().script_id(), ms, start, end, "", 0));
   }
-  return result;
 }
 
 FunctionLiteral* Parser::DoParseProgram(Isolate* isolate, ParseInfo* info) {
@@ -574,16 +568,14 @@ FunctionLiteral* Parser::DoParseProgram(Isolate* isolate, ParseInfo* info) {
 
   ParsingModeScope mode(this, allow_lazy_ ? PARSE_LAZILY : PARSE_EAGERLY);
   ResetFunctionLiteralId();
-  DCHECK(info->function_literal_id() == kFunctionLiteralIdTopLevel ||
-         info->function_literal_id() == kFunctionLiteralIdInvalid);
 
   FunctionLiteral* result = nullptr;
   {
     Scope* outer = original_scope_;
     DCHECK_NOT_NULL(outer);
-    if (info->is_eval()) {
+    if (flags().is_eval()) {
       outer = NewEvalScope(outer);
-    } else if (parsing_module_) {
+    } else if (flags().is_module()) {
       DCHECK_EQ(outer, info->script_scope());
       outer = NewModuleScope(info->script_scope());
     }
@@ -594,15 +586,15 @@ FunctionLiteral* Parser::DoParseProgram(Isolate* isolate, ParseInfo* info) {
     FunctionState function_state(&function_state_, &scope_, scope);
     ScopedPtrList<Statement> body(pointer_buffer());
     int beg_pos = scanner()->location().beg_pos;
-    if (parsing_module_) {
-      DCHECK(info->is_module());
+    if (flags().is_module()) {
+      DCHECK(flags().is_module());
 
       PrepareGeneratorVariables();
       Expression* initial_yield =
           BuildInitialYield(kNoSourcePosition, kGeneratorFunction);
       body.Add(
           factory()->NewExpressionStatement(initial_yield, kNoSourcePosition));
-      if (allow_harmony_top_level_await()) {
+      if (flags().allow_harmony_top_level_await()) {
         // First parse statements into a buffer. Then, if there was a
         // top level await, create an inner block and rewrite the body of the
         // module as an async function. Otherwise merge the statements back
@@ -636,7 +628,7 @@ FunctionLiteral* Parser::DoParseProgram(Isolate* isolate, ParseInfo* info) {
     } else if (info->is_wrapped_as_function()) {
       DCHECK(parsing_on_main_thread_);
       ParseWrapped(isolate, info, &body, scope, zone());
-    } else if (info->is_repl_mode()) {
+    } else if (flags().is_repl_mode()) {
       ParseREPLProgram(info, &body, scope);
     } else {
       // Don't count the mode in the use counters--give the program a chance
@@ -661,13 +653,13 @@ FunctionLiteral* Parser::DoParseProgram(Isolate* isolate, ParseInfo* info) {
     }
     // Internalize the ast strings in the case of eval so we can check for
     // conflicting var declarations with outer scope-info-backed scopes.
-    if (info->is_eval()) {
+    if (flags().is_eval()) {
       DCHECK(parsing_on_main_thread_);
       info->ast_value_factory()->Internalize(isolate);
     }
     CheckConflictingVarDeclarations(scope);
 
-    if (info->parse_restriction() == ONLY_SINGLE_FUNCTION_LITERAL) {
+    if (flags().parse_restriction() == ONLY_SINGLE_FUNCTION_LITERAL) {
       if (body.length() != 1 || !body.at(0)->IsExpressionStatement() ||
           !body.at(0)
                ->AsExpressionStatement()
@@ -692,6 +684,33 @@ FunctionLiteral* Parser::DoParseProgram(Isolate* isolate, ParseInfo* info) {
   return result;
 }
 
+void Parser::PostProcessParseResult(Isolate* isolate, ParseInfo* info,
+                                    FunctionLiteral* literal) {
+  if (literal == nullptr) return;
+
+  info->set_literal(literal);
+  info->set_language_mode(literal->language_mode());
+  if (info->flags().is_eval()) {
+    info->set_allow_eval_cache(allow_eval_cache());
+  }
+
+  // We cannot internalize on a background thread; a foreground task will take
+  // care of calling AstValueFactory::Internalize just before compilation.
+  DCHECK_EQ(isolate != nullptr, parsing_on_main_thread_);
+  if (isolate) info->ast_value_factory()->Internalize(isolate);
+
+  {
+    RuntimeCallTimerScope runtimeTimer(info->runtime_call_stats(),
+                                       RuntimeCallCounterId::kCompileAnalyse,
+                                       RuntimeCallStats::kThreadSpecific);
+    if (!Rewriter::Rewrite(info) || !DeclarationScope::Analyze(info)) {
+      // Null out the literal to indicate that something failed.
+      info->set_literal(nullptr);
+      return;
+    }
+  }
+}
+
 ZonePtrList<const AstRawString>* Parser::PrepareWrappedArguments(
     Isolate* isolate, ParseInfo* info, Zone* zone) {
   DCHECK(parsing_on_main_thread_);
@@ -745,7 +764,7 @@ void Parser::ParseREPLProgram(ParseInfo* info, ScopedPtrList<Statement>* body,
   // completion value of the script is obtained by manually invoking
   // the {Rewriter} which will return a VariableProxy referencing the
   // result.
-  DCHECK(info->is_repl_mode());
+  DCHECK(flags().is_repl_mode());
   this->scope()->SetLanguageMode(info->language_mode());
   PrepareGeneratorVariables();
 
@@ -791,8 +810,8 @@ Expression* Parser::WrapREPLResult(Expression* value) {
                                      false);
 }
 
-FunctionLiteral* Parser::ParseFunction(Isolate* isolate, ParseInfo* info,
-                                       Handle<SharedFunctionInfo> shared_info) {
+void Parser::ParseFunction(Isolate* isolate, ParseInfo* info,
+                           Handle<SharedFunctionInfo> shared_info) {
   // It's OK to use the Isolate & counters here, since this function is only
   // called in the main thread.
   DCHECK(parsing_on_main_thread_);
@@ -815,6 +834,10 @@ FunctionLiteral* Parser::ParseFunction(Isolate* isolate, ParseInfo* info,
         Script::cast(shared_info->script()).wrapped_arguments(), isolate);
   }
 
+  int start_position = shared_info->StartPosition();
+  int end_position = shared_info->EndPosition();
+  int function_literal_id = shared_info->function_literal_id();
+
   // Initialize parser state.
   Handle<String> name(shared_info->Name(), isolate);
   info->set_function_name(ast_value_factory()->GetString(name));
@@ -827,9 +850,11 @@ FunctionLiteral* Parser::ParseFunction(Isolate* isolate, ParseInfo* info,
     // function is in heritage position. Otherwise the function scope's skip bit
     // will be correctly inherited from the outer scope.
     ClassScope::HeritageParsingScope heritage(original_scope_->AsClassScope());
-    result = DoParseFunction(isolate, info, info->function_name());
+    result = DoParseFunction(isolate, info, start_position, end_position,
+                             function_literal_id, info->function_name());
   } else {
-    result = DoParseFunction(isolate, info, info->function_name());
+    result = DoParseFunction(isolate, info, start_position, end_position,
+                             function_literal_id, info->function_name());
   }
   MaybeResetCharacterStream(info, result);
   MaybeProcessSourceRanges(info, result, stack_limit_);
@@ -837,23 +862,25 @@ FunctionLiteral* Parser::ParseFunction(Isolate* isolate, ParseInfo* info,
     Handle<String> inferred_name(shared_info->inferred_name(), isolate);
     result->set_inferred_name(inferred_name);
   }
+  PostProcessParseResult(isolate, info, result);
 
   if (V8_UNLIKELY(FLAG_log_function_events) && result != nullptr) {
     double ms = timer.Elapsed().InMillisecondsF();
-    // We need to make sure that the debug-name is available.
-    ast_value_factory()->Internalize(isolate);
+    // We should already be internalized by now, so the debug name will be
+    // available.
     DeclarationScope* function_scope = result->scope();
     std::unique_ptr<char[]> function_name = result->GetDebugName();
     LOG(isolate,
-        FunctionEvent("parse-function", script_id(), ms,
+        FunctionEvent("parse-function", flags().script_id(), ms,
                       function_scope->start_position(),
                       function_scope->end_position(), function_name.get(),
                       strlen(function_name.get())));
   }
-  return result;
 }
 
 FunctionLiteral* Parser::DoParseFunction(Isolate* isolate, ParseInfo* info,
+                                         int start_position, int end_position,
+                                         int function_literal_id,
                                          const AstRawString* raw_name) {
   DCHECK_EQ(parsing_on_main_thread_, isolate != nullptr);
   DCHECK_NOT_NULL(raw_name);
@@ -863,8 +890,8 @@ FunctionLiteral* Parser::DoParseFunction(Isolate* isolate, ParseInfo* info,
   fni_.PushEnclosingName(raw_name);
 
   ResetFunctionLiteralId();
-  DCHECK_LT(0, info->function_literal_id());
-  SkipFunctionLiterals(info->function_literal_id() - 1);
+  DCHECK_LT(0, function_literal_id);
+  SkipFunctionLiterals(function_literal_id - 1);
 
   ParsingModeScope parsing_mode(this, PARSE_EAGERLY);
 
@@ -880,10 +907,10 @@ FunctionLiteral* Parser::DoParseFunction(Isolate* isolate, ParseInfo* info,
     BlockState block_state(&scope_, outer);
     DCHECK(is_sloppy(outer->language_mode()) ||
            is_strict(info->language_mode()));
-    FunctionKind kind = info->function_kind();
-    DCHECK_IMPLIES(
-        IsConciseMethod(kind) || IsAccessorFunction(kind),
-        info->function_syntax_kind() == FunctionSyntaxKind::kAccessorOrMethod);
+    FunctionKind kind = flags().function_kind();
+    DCHECK_IMPLIES(IsConciseMethod(kind) || IsAccessorFunction(kind),
+                   flags().function_syntax_kind() ==
+                       FunctionSyntaxKind::kAccessorOrMethod);
 
     if (IsArrowFunction(kind)) {
       if (IsAsyncFunction(kind)) {
@@ -906,7 +933,7 @@ FunctionLiteral* Parser::DoParseFunction(Isolate* isolate, ParseInfo* info,
       // not passing the ScopeInfo to the Scope constructor.
       SetLanguageMode(scope, info->language_mode());
 
-      scope->set_start_position(info->start_position());
+      scope->set_start_position(start_position);
       ParserFormalParameters formals(scope);
       {
         ParameterDeclarationParsingScope formals_scope(this);
@@ -927,14 +954,14 @@ FunctionLiteral* Parser::DoParseFunction(Isolate* isolate, ParseInfo* info,
         formals.duplicate_loc = formals_scope.duplicate_location();
       }
 
-      if (GetLastFunctionLiteralId() != info->function_literal_id() - 1) {
+      if (GetLastFunctionLiteralId() != function_literal_id - 1) {
         if (has_error()) return nullptr;
         // If there were FunctionLiterals in the parameters, we need to
         // renumber them to shift down so the next function literal id for
         // the arrow function is the one requested.
         AstFunctionLiteralIdReindexer reindexer(
             stack_limit_,
-            (info->function_literal_id() - 1) - GetLastFunctionLiteralId());
+            (function_literal_id - 1) - GetLastFunctionLiteralId());
         for (auto p : formals.params) {
           if (p->pattern != nullptr) reindexer.Reindex(p->pattern);
           if (p->initializer() != nullptr) {
@@ -942,7 +969,7 @@ FunctionLiteral* Parser::DoParseFunction(Isolate* isolate, ParseInfo* info,
           }
         }
         ResetFunctionLiteralId();
-        SkipFunctionLiterals(info->function_literal_id() - 1);
+        SkipFunctionLiterals(function_literal_id - 1);
       }
 
       Expression* expression = ParseArrowFunctionLiteral(formals);
@@ -952,7 +979,7 @@ FunctionLiteral* Parser::DoParseFunction(Isolate* isolate, ParseInfo* info,
       // concise body happens to be a valid expression. This is a problem
       // only for arrow functions with single expression bodies, since there
       // is no end token such as "}" for normal functions.
-      if (scanner()->location().end_pos == info->end_position()) {
+      if (scanner()->location().end_pos == end_position) {
         // The pre-parser saw an arrow function here, so the full parser
         // must produce a FunctionLiteral.
         DCHECK(expression->IsFunctionLiteral());
@@ -961,7 +988,7 @@ FunctionLiteral* Parser::DoParseFunction(Isolate* isolate, ParseInfo* info,
     } else if (IsDefaultConstructor(kind)) {
       DCHECK_EQ(scope(), outer);
       result = DefaultConstructor(raw_name, IsDerivedConstructor(kind),
-                                  info->start_position(), info->end_position());
+                                  start_position, end_position);
     } else {
       ZonePtrList<const AstRawString>* arguments_for_wrapped_function =
           info->is_wrapped_as_function()
@@ -969,24 +996,23 @@ FunctionLiteral* Parser::DoParseFunction(Isolate* isolate, ParseInfo* info,
               : nullptr;
       result = ParseFunctionLiteral(
           raw_name, Scanner::Location::invalid(), kSkipFunctionNameCheck, kind,
-          kNoSourcePosition, info->function_syntax_kind(),
+          kNoSourcePosition, flags().function_syntax_kind(),
           info->language_mode(), arguments_for_wrapped_function);
     }
 
     if (has_error()) return nullptr;
     result->set_requires_instance_members_initializer(
-        info->requires_instance_members_initializer());
+        flags().requires_instance_members_initializer());
     result->set_class_scope_has_private_brand(
-        info->class_scope_has_private_brand());
+        flags().class_scope_has_private_brand());
     result->set_has_static_private_methods_or_accessors(
-        info->has_static_private_methods_or_accessors());
-    if (info->is_oneshot_iife()) {
+        flags().has_static_private_methods_or_accessors());
+    if (flags().is_oneshot_iife()) {
       result->mark_as_oneshot_iife();
     }
   }
 
-  DCHECK_IMPLIES(result,
-                 info->function_literal_id() == result->function_literal_id());
+  DCHECK_IMPLIES(result, function_literal_id == result->function_literal_id());
   return result;
 }
 
@@ -1007,8 +1033,9 @@ Statement* Parser::ParseModuleItem() {
     // We must be careful not to parse a dynamic import expression as an import
     // declaration. Same for import.meta expressions.
     Token::Value peek_ahead = PeekAhead();
-    if ((!allow_harmony_dynamic_import() || peek_ahead != Token::LPAREN) &&
-        (!allow_harmony_import_meta() || peek_ahead != Token::PERIOD)) {
+    if ((!flags().allow_harmony_dynamic_import() ||
+         peek_ahead != Token::LPAREN) &&
+        (!flags().allow_harmony_import_meta() || peek_ahead != Token::PERIOD)) {
       ParseImportDeclaration();
       return factory()->EmptyStatement();
     }
@@ -1068,7 +1095,7 @@ ZoneChunkList<Parser::ExportClauseData>* Parser::ParseExportClause(
     // caller needs to report an error.
     if (!reserved_loc->IsValid() &&
         !Token::IsValidIdentifier(name_tok, LanguageMode::kStrict, false,
-                                  parsing_module_)) {
+                                  flags().is_module())) {
       *reserved_loc = scanner()->location();
     }
     const AstRawString* local_name = ParsePropertyName();
@@ -1124,7 +1151,7 @@ ZonePtrList<const Parser::NamedImport>* Parser::ParseNamedImports(int pos) {
     }
     if (!Token::IsValidIdentifier(scanner()->current_token(),
                                   LanguageMode::kStrict, false,
-                                  parsing_module_)) {
+                                  flags().is_module())) {
       ReportMessage(MessageTemplate::kUnexpectedReserved);
       return nullptr;
     } else if (IsEvalOrArguments(local_name)) {
@@ -1562,7 +1589,7 @@ Statement* Parser::DeclareFunction(const AstRawString* variable_name,
   bool was_added;
   Declare(declaration, variable_name, kind, mode, kCreatedInitialized, scope(),
           &was_added, beg_pos);
-  if (info()->coverage_enabled()) {
+  if (info()->flags().coverage_enabled()) {
     // Force the function to be allocated when collecting source coverage, so
     // that even dead functions get source coverage data.
     declaration->var()->set_is_used();
@@ -2378,7 +2405,7 @@ FunctionLiteral* Parser::ParseFunctionLiteral(
   // parenthesis before the function means that it will be called
   // immediately). bar can be parsed lazily, but we need to parse it in a mode
   // that tracks unresolved variables.
-  DCHECK_IMPLIES(parse_lazily(), info()->allow_lazy_compile());
+  DCHECK_IMPLIES(parse_lazily(), info()->flags().allow_lazy_compile());
   DCHECK_IMPLIES(parse_lazily(), has_error() || allow_lazy_);
   DCHECK_IMPLIES(parse_lazily(), extension_ == nullptr);
 
@@ -2477,7 +2504,7 @@ FunctionLiteral* Parser::ParseFunctionLiteral(
             ? (is_top_level ? "preparse-no-resolution" : "preparse-resolution")
             : "full-parse";
     logger_->FunctionEvent(
-        event_name, script_id(), ms, scope->start_position(),
+        event_name, flags().script_id(), ms, scope->start_position(),
         scope->end_position(),
         reinterpret_cast<const char*>(function_name->raw_data()),
         function_name->byte_length());
@@ -2584,7 +2611,7 @@ bool Parser::SkipFunction(const AstRawString* function_name, FunctionKind kind,
 
   PreParser::PreParseResult result = reusable_preparser()->PreParseFunction(
       function_name, kind, function_syntax_kind, function_scope, use_counts_,
-      produced_preparse_data, this->script_id());
+      produced_preparse_data);
 
   if (result == PreParser::kPreParseStackOverflow) {
     // Propagate stack overflow.
@@ -2733,6 +2760,7 @@ void Parser::ParseFunction(
     bool* has_duplicate_parameters, int* expected_property_count,
     int* suspend_count,
     ZonePtrList<const AstRawString>* arguments_for_wrapped_function) {
+  FunctionParsingScope function_parsing_scope(this);
   ParsingModeScope mode(this, allow_lazy_ ? PARSE_LAZILY : PARSE_EAGERLY);
 
   FunctionState function_state(&function_state_, &scope_, function_scope);
@@ -2880,7 +2908,7 @@ void Parser::DeclarePrivateClassMember(ClassScope* scope,
                                        ClassLiteralProperty::Kind kind,
                                        bool is_static, ClassInfo* class_info) {
   DCHECK_IMPLIES(kind != ClassLiteralProperty::Kind::FIELD,
-                 allow_harmony_private_methods());
+                 flags().allow_harmony_private_methods());
 
   if (kind == ClassLiteralProperty::Kind::FIELD) {
     if (is_static) {
@@ -3085,11 +3113,11 @@ void Parser::UpdateStatistics(Isolate* isolate, Handle<Script> script) {
       total_preparse_skipped_);
 }
 
-void Parser::ParseOnBackground(ParseInfo* info) {
+void Parser::ParseOnBackground(ParseInfo* info, int start_position,
+                               int end_position, int function_literal_id) {
   RuntimeCallTimerScope runtimeTimer(
       runtime_call_stats_, RuntimeCallCounterId::kParseBackgroundProgram);
   parsing_on_main_thread_ = false;
-  set_script_id(info->script_id());
 
   DCHECK_NULL(info->literal());
   FunctionLiteral* result = nullptr;
@@ -3104,19 +3132,19 @@ void Parser::ParseOnBackground(ParseInfo* info) {
   // don't). We work around this by storing all the scopes which need their end
   // position set at the end of the script (the top scope and possible eval
   // scopes) and set their end position after we know the script length.
-  if (info->is_toplevel()) {
+  if (flags().is_toplevel()) {
+    DCHECK_EQ(start_position, 0);
+    DCHECK_EQ(end_position, 0);
+    DCHECK_EQ(function_literal_id, kFunctionLiteralIdTopLevel);
     result = DoParseProgram(/* isolate = */ nullptr, info);
   } else {
-    result =
-        DoParseFunction(/* isolate = */ nullptr, info, info->function_name());
+    result = DoParseFunction(/* isolate = */ nullptr, info, start_position,
+                             end_position, function_literal_id,
+                             info->function_name());
   }
   MaybeResetCharacterStream(info, result);
   MaybeProcessSourceRanges(info, result, stack_limit_);
-
-  info->set_literal(result);
-
-  // We cannot internalize on a background thread; a foreground task will take
-  // care of calling AstValueFactory::Internalize just before compilation.
+  PostProcessParseResult(/* isolate = */ nullptr, info, result);
 }
 
 Parser::TemplateLiteralState Parser::OpenTemplateLiteral(int pos) {
diff --git a/deps/v8/src/parsing/parser.h b/deps/v8/src/parsing/parser.h
index fd24ffb3e8e..472c9a71ab4 100644
--- a/deps/v8/src/parsing/parser.h
+++ b/deps/v8/src/parsing/parser.h
@@ -14,6 +14,7 @@
 #include "src/base/compiler-specific.h"
 #include "src/base/threaded-list.h"
 #include "src/common/globals.h"
+#include "src/parsing/parse-info.h"
 #include "src/parsing/parser-base.h"
 #include "src/parsing/parsing.h"
 #include "src/parsing/preparser.h"
@@ -134,7 +135,9 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
 
   static bool IsPreParser() { return false; }
 
-  void ParseOnBackground(ParseInfo* info);
+  // Sets the literal on |info| if parsing succeeded.
+  void ParseOnBackground(ParseInfo* info, int start_position, int end_position,
+                         int function_literal_id);
 
   // Initializes an empty scope chain for top-level scripts, or scopes which
   // consist of only the native context.
@@ -207,14 +210,20 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
 
   void PrepareGeneratorVariables();
 
-  // Returns nullptr if parsing failed.
-  FunctionLiteral* ParseProgram(Isolate* isolate, Handle<Script> script,
-                                ParseInfo* info,
-                                MaybeHandle<ScopeInfo> maybe_outer_scope_info);
+  // Sets the literal on |info| if parsing succeeded.
+  void ParseProgram(Isolate* isolate, Handle<Script> script, ParseInfo* info,
+                    MaybeHandle<ScopeInfo> maybe_outer_scope_info);
+
+  // Sets the literal on |info| if parsing succeeded.
+  void ParseFunction(Isolate* isolate, ParseInfo* info,
+                     Handle<SharedFunctionInfo> shared_info);
+
+  void PostProcessParseResult(Isolate* isolate, ParseInfo* info,
+                              FunctionLiteral* literal);
 
-  FunctionLiteral* ParseFunction(Isolate* isolate, ParseInfo* info,
-                                 Handle<SharedFunctionInfo> shared_info);
   FunctionLiteral* DoParseFunction(Isolate* isolate, ParseInfo* info,
+                                   int start_position, int end_position,
+                                   int function_literal_id,
                                    const AstRawString* raw_name);
 
   // Called by ParseProgram after setting up the scanner.
@@ -239,15 +248,9 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
     if (reusable_preparser_ == nullptr) {
       reusable_preparser_ = new PreParser(
           &preparser_zone_, &scanner_, stack_limit_, ast_value_factory(),
-          pending_error_handler(), runtime_call_stats_, logger_, -1,
-          parsing_module_, parsing_on_main_thread_);
-#define SET_ALLOW(name) reusable_preparser_->set_allow_##name(allow_##name());
-      SET_ALLOW(natives);
-      SET_ALLOW(harmony_dynamic_import);
-      SET_ALLOW(harmony_import_meta);
-      SET_ALLOW(harmony_private_methods);
-      SET_ALLOW(eval_cache);
-#undef SET_ALLOW
+          pending_error_handler(), runtime_call_stats_, logger_, flags(),
+          parsing_on_main_thread_);
+      reusable_preparser_->set_allow_eval_cache(allow_eval_cache());
       preparse_data_buffer_.reserve(128);
     }
     return reusable_preparser_;
diff --git a/deps/v8/src/parsing/parsing.cc b/deps/v8/src/parsing/parsing.cc
index 8a960cdc292..e126874d7dc 100644
--- a/deps/v8/src/parsing/parsing.cc
+++ b/deps/v8/src/parsing/parsing.cc
@@ -12,6 +12,7 @@
 #include "src/objects/objects-inl.h"
 #include "src/parsing/parse-info.h"
 #include "src/parsing/parser.h"
+#include "src/parsing/rewriter.h"
 #include "src/parsing/scanner-character-streams.h"
 #include "src/zone/zone-list-inl.h"  // crbug.com/v8/8816
 
@@ -19,10 +20,27 @@ namespace v8 {
 namespace internal {
 namespace parsing {
 
+namespace {
+
+void MaybeReportErrorsAndStatistics(ParseInfo* info, Handle<Script> script,
+                                    Isolate* isolate, Parser* parser,
+                                    ReportErrorsAndStatisticsMode mode) {
+  if (mode == ReportErrorsAndStatisticsMode::kYes) {
+    if (info->literal() == nullptr) {
+      info->pending_error_handler()->PrepareErrors(isolate,
+                                                   info->ast_value_factory());
+      info->pending_error_handler()->ReportErrors(isolate, script);
+    }
+    parser->UpdateStatistics(isolate, script);
+  }
+}
+
+}  // namespace
+
 bool ParseProgram(ParseInfo* info, Handle<Script> script,
                   MaybeHandle<ScopeInfo> maybe_outer_scope_info,
                   Isolate* isolate, ReportErrorsAndStatisticsMode mode) {
-  DCHECK(info->is_toplevel());
+  DCHECK(info->flags().is_toplevel());
   DCHECK_NULL(info->literal());
 
   VMState<PARSER> state(isolate);
@@ -36,27 +54,11 @@ bool ParseProgram(ParseInfo* info, Handle<Script> script,
 
   Parser parser(info);
 
-  FunctionLiteral* result = nullptr;
   // Ok to use Isolate here; this function is only called in the main thread.
   DCHECK(parser.parsing_on_main_thread_);
-
-  result = parser.ParseProgram(isolate, script, info, maybe_outer_scope_info);
-  info->set_literal(result);
-  if (result) {
-    info->set_language_mode(info->literal()->language_mode());
-    if (info->is_eval()) {
-      info->set_allow_eval_cache(parser.allow_eval_cache());
-    }
-  }
-
-  if (mode == ReportErrorsAndStatisticsMode::kYes) {
-    if (result == nullptr) {
-      info->pending_error_handler()->ReportErrors(isolate, script,
-                                                  info->ast_value_factory());
-    }
-    parser.UpdateStatistics(isolate, script);
-  }
-  return (result != nullptr);
+  parser.ParseProgram(isolate, script, info, maybe_outer_scope_info);
+  MaybeReportErrorsAndStatistics(info, script, isolate, &parser, mode);
+  return info->literal() != nullptr;
 }
 
 bool ParseProgram(ParseInfo* info, Handle<Script> script, Isolate* isolate,
@@ -66,10 +68,12 @@ bool ParseProgram(ParseInfo* info, Handle<Script> script, Isolate* isolate,
 
 bool ParseFunction(ParseInfo* info, Handle<SharedFunctionInfo> shared_info,
                    Isolate* isolate, ReportErrorsAndStatisticsMode mode) {
-  DCHECK(!info->is_toplevel());
+  DCHECK(!info->flags().is_toplevel());
   DCHECK(!shared_info.is_null());
   DCHECK_NULL(info->literal());
 
+  VMState<PARSER> state(isolate);
+
   // Create a character stream for the parser.
   Handle<Script> script(Script::cast(shared_info->script()), isolate);
   Handle<String> source(String::cast(script->source()), isolate);
@@ -79,37 +83,19 @@ bool ParseFunction(ParseInfo* info, Handle<SharedFunctionInfo> shared_info,
                          shared_info->EndPosition()));
   info->set_character_stream(std::move(stream));
 
-  VMState<PARSER> state(isolate);
-
   Parser parser(info);
 
-  FunctionLiteral* result = nullptr;
   // Ok to use Isolate here; this function is only called in the main thread.
   DCHECK(parser.parsing_on_main_thread_);
-
-  result = parser.ParseFunction(isolate, info, shared_info);
-  info->set_literal(result);
-  if (result) {
-    info->ast_value_factory()->Internalize(isolate);
-    if (info->is_eval()) {
-      info->set_allow_eval_cache(parser.allow_eval_cache());
-    }
-  }
-
-  if (mode == ReportErrorsAndStatisticsMode::kYes) {
-    if (result == nullptr) {
-      info->pending_error_handler()->ReportErrors(isolate, script,
-                                                  info->ast_value_factory());
-    }
-    parser.UpdateStatistics(isolate, script);
-  }
-  return (result != nullptr);
+  parser.ParseFunction(isolate, info, shared_info);
+  MaybeReportErrorsAndStatistics(info, script, isolate, &parser, mode);
+  return info->literal() != nullptr;
 }
 
 bool ParseAny(ParseInfo* info, Handle<SharedFunctionInfo> shared_info,
               Isolate* isolate, ReportErrorsAndStatisticsMode mode) {
   DCHECK(!shared_info.is_null());
-  if (info->is_toplevel()) {
+  if (info->flags().is_toplevel()) {
     MaybeHandle<ScopeInfo> maybe_outer_scope_info;
     if (shared_info->HasOuterScopeInfo()) {
       maybe_outer_scope_info =
diff --git a/deps/v8/src/parsing/pending-compilation-error-handler.cc b/deps/v8/src/parsing/pending-compilation-error-handler.cc
index 80d201d13f7..f131b7ad8e6 100644
--- a/deps/v8/src/parsing/pending-compilation-error-handler.cc
+++ b/deps/v8/src/parsing/pending-compilation-error-handler.cc
@@ -5,24 +5,68 @@
 #include "src/parsing/pending-compilation-error-handler.h"
 
 #include "src/ast/ast-value-factory.h"
+#include "src/base/logging.h"
 #include "src/debug/debug.h"
 #include "src/execution/isolate.h"
 #include "src/execution/messages.h"
+#include "src/execution/off-thread-isolate.h"
 #include "src/handles/handles.h"
+#include "src/heap/off-thread-factory-inl.h"
 #include "src/objects/objects-inl.h"
 
 namespace v8 {
 namespace internal {
 
+void PendingCompilationErrorHandler::MessageDetails::SetString(
+    Handle<String> string, Isolate* isolate) {
+  DCHECK_NE(type_, kMainThreadHandle);
+  DCHECK_NE(type_, kOffThreadTransferHandle);
+  type_ = kMainThreadHandle;
+  arg_handle_ = string;
+}
+
+void PendingCompilationErrorHandler::MessageDetails::SetString(
+    Handle<String> string, OffThreadIsolate* isolate) {
+  DCHECK_NE(type_, kMainThreadHandle);
+  DCHECK_NE(type_, kOffThreadTransferHandle);
+  type_ = kOffThreadTransferHandle;
+  arg_transfer_handle_ = isolate->TransferHandle(string);
+}
+
+template <typename LocalIsolate>
+void PendingCompilationErrorHandler::MessageDetails::Prepare(
+    LocalIsolate* isolate) {
+  switch (type_) {
+    case kAstRawString:
+      return SetString(arg_->string(), isolate);
+    case kNone:
+    case kConstCharString:
+      // We can delay allocation until ArgumentString(isolate).
+      // TODO(leszeks): We don't actually have to transfer this string, since
+      // it's a root.
+      return;
+    case kMainThreadHandle:
+    case kOffThreadTransferHandle:
+      UNREACHABLE();
+  }
+}
+
 Handle<String> PendingCompilationErrorHandler::MessageDetails::ArgumentString(
     Isolate* isolate) const {
-  if (arg_ != nullptr) return arg_->string();
-  if (char_arg_ != nullptr) {
-    return isolate->factory()
-        ->NewStringFromUtf8(CStrVector(char_arg_))
-        .ToHandleChecked();
+  switch (type_) {
+    case kMainThreadHandle:
+      return arg_handle_;
+    case kOffThreadTransferHandle:
+      return arg_transfer_handle_.ToHandle();
+    case kNone:
+      return isolate->factory()->undefined_string();
+    case kConstCharString:
+      return isolate->factory()
+          ->NewStringFromUtf8(CStrVector(char_arg_), AllocationType::kOld)
+          .ToHandleChecked();
+    case kAstRawString:
+      UNREACHABLE();
   }
-  return isolate->factory()->undefined_string();
 }
 
 MessageLocation PendingCompilationErrorHandler::MessageDetails::GetLocation(
@@ -37,8 +81,7 @@ void PendingCompilationErrorHandler::ReportMessageAt(int start_position,
   if (has_pending_error_) return;
   has_pending_error_ = true;
 
-  error_details_ =
-      MessageDetails(start_position, end_position, message, nullptr, arg);
+  error_details_ = MessageDetails(start_position, end_position, message, arg);
 }
 
 void PendingCompilationErrorHandler::ReportMessageAt(int start_position,
@@ -48,8 +91,7 @@ void PendingCompilationErrorHandler::ReportMessageAt(int start_position,
   if (has_pending_error_) return;
   has_pending_error_ = true;
 
-  error_details_ =
-      MessageDetails(start_position, end_position, message, arg, nullptr);
+  error_details_ = MessageDetails(start_position, end_position, message, arg);
 }
 
 void PendingCompilationErrorHandler::ReportWarningAt(int start_position,
@@ -57,11 +99,23 @@ void PendingCompilationErrorHandler::ReportWarningAt(int start_position,
                                                      MessageTemplate message,
                                                      const char* arg) {
   warning_messages_.emplace_front(
-      MessageDetails(start_position, end_position, message, nullptr, arg));
+      MessageDetails(start_position, end_position, message, arg));
 }
 
-void PendingCompilationErrorHandler::ReportWarnings(Isolate* isolate,
-                                                    Handle<Script> script) {
+template <typename LocalIsolate>
+void PendingCompilationErrorHandler::PrepareWarnings(LocalIsolate* isolate) {
+  DCHECK(!has_pending_error());
+
+  for (MessageDetails& warning : warning_messages_) {
+    warning.Prepare(isolate);
+  }
+}
+template void PendingCompilationErrorHandler::PrepareWarnings(Isolate* isolate);
+template void PendingCompilationErrorHandler::PrepareWarnings(
+    OffThreadIsolate* isolate);
+
+void PendingCompilationErrorHandler::ReportWarnings(
+    Isolate* isolate, Handle<Script> script) const {
   DCHECK(!has_pending_error());
 
   for (const MessageDetails& warning : warning_messages_) {
@@ -75,27 +129,33 @@ void PendingCompilationErrorHandler::ReportWarnings(Isolate* isolate,
   }
 }
 
-void PendingCompilationErrorHandler::ReportWarnings(OffThreadIsolate* isolate,
-                                                    Handle<Script> script) {
-  // TODO(leszeks): Do nothing, re-report on the main thread.
-  UNREACHABLE();
+template <typename LocalIsolate>
+void PendingCompilationErrorHandler::PrepareErrors(
+    LocalIsolate* isolate, AstValueFactory* ast_value_factory) {
+  if (stack_overflow()) return;
+
+  DCHECK(has_pending_error());
+  // Internalize ast values for throwing the pending error.
+  ast_value_factory->Internalize(isolate);
+  error_details_.Prepare(isolate);
 }
+template void PendingCompilationErrorHandler::PrepareErrors(
+    Isolate* isolate, AstValueFactory* ast_value_factory);
+template void PendingCompilationErrorHandler::PrepareErrors(
+    OffThreadIsolate* isolate, AstValueFactory* ast_value_factory);
 
-void PendingCompilationErrorHandler::ReportErrors(
-    Isolate* isolate, Handle<Script> script,
-    AstValueFactory* ast_value_factory) {
+void PendingCompilationErrorHandler::ReportErrors(Isolate* isolate,
+                                                  Handle<Script> script) const {
   if (stack_overflow()) {
     isolate->StackOverflow();
   } else {
     DCHECK(has_pending_error());
-    // Internalize ast values for throwing the pending error.
-    ast_value_factory->Internalize(isolate);
     ThrowPendingError(isolate, script);
   }
 }
 
-void PendingCompilationErrorHandler::ThrowPendingError(Isolate* isolate,
-                                                       Handle<Script> script) {
+void PendingCompilationErrorHandler::ThrowPendingError(
+    Isolate* isolate, Handle<Script> script) const {
   if (!has_pending_error_) return;
 
   MessageLocation location = error_details_.GetLocation(script);
@@ -109,7 +169,8 @@ void PendingCompilationErrorHandler::ThrowPendingError(Isolate* isolate,
 }
 
 Handle<String> PendingCompilationErrorHandler::FormatErrorMessageForTest(
-    Isolate* isolate) const {
+    Isolate* isolate) {
+  error_details_.Prepare(isolate);
   return MessageFormatter::Format(isolate, error_details_.message(),
                                   error_details_.ArgumentString(isolate));
 }
diff --git a/deps/v8/src/parsing/pending-compilation-error-handler.h b/deps/v8/src/parsing/pending-compilation-error-handler.h
index b854c3849e3..4d15ac91cab 100644
--- a/deps/v8/src/parsing/pending-compilation-error-handler.h
+++ b/deps/v8/src/parsing/pending-compilation-error-handler.h
@@ -10,6 +10,7 @@
 #include "src/base/macros.h"
 #include "src/common/globals.h"
 #include "src/common/message-template.h"
+#include "src/execution/off-thread-isolate.h"
 #include "src/handles/handles.h"
 
 namespace v8 {
@@ -47,15 +48,16 @@ class PendingCompilationErrorHandler {
   bool has_pending_warnings() const { return !warning_messages_.empty(); }
 
   // Handle errors detected during parsing.
-  void ReportErrors(Isolate* isolate, Handle<Script> script,
-                    AstValueFactory* ast_value_factory);
+  template <typename LocalIsolate>
+  void PrepareErrors(LocalIsolate* isolate, AstValueFactory* ast_value_factory);
+  void ReportErrors(Isolate* isolate, Handle<Script> script) const;
 
   // Handle warnings detected during compilation.
-  void ReportWarnings(Isolate* isolate, Handle<Script> script);
-  void ReportWarnings(OffThreadIsolate* isolate, Handle<Script> script);
+  template <typename LocalIsolate>
+  void PrepareWarnings(LocalIsolate* isolate);
+  void ReportWarnings(Isolate* isolate, Handle<Script> script) const;
 
-  V8_EXPORT_PRIVATE Handle<String> FormatErrorMessageForTest(
-      Isolate* isolate) const;
+  V8_EXPORT_PRIVATE Handle<String> FormatErrorMessageForTest(Isolate* isolate);
 
   void set_unidentifiable_error() {
     has_pending_error_ = true;
@@ -77,30 +79,54 @@ class PendingCompilationErrorHandler {
         : start_position_(-1),
           end_position_(-1),
           message_(MessageTemplate::kNone),
-          arg_(nullptr),
-          char_arg_(nullptr) {}
+          type_(kNone) {}
     MessageDetails(int start_position, int end_position,
-                   MessageTemplate message, const AstRawString* arg,
-                   const char* char_arg)
+                   MessageTemplate message, const AstRawString* arg)
         : start_position_(start_position),
           end_position_(end_position),
           message_(message),
           arg_(arg),
-          char_arg_(char_arg) {}
+          type_(arg ? kAstRawString : kNone) {}
+    MessageDetails(int start_position, int end_position,
+                   MessageTemplate message, const char* char_arg)
+        : start_position_(start_position),
+          end_position_(end_position),
+          message_(message),
+          char_arg_(char_arg),
+          type_(char_arg_ ? kConstCharString : kNone) {}
 
     Handle<String> ArgumentString(Isolate* isolate) const;
     MessageLocation GetLocation(Handle<Script> script) const;
     MessageTemplate message() const { return message_; }
 
+    template <typename LocalIsolate>
+    void Prepare(LocalIsolate* isolate);
+
    private:
+    enum Type {
+      kNone,
+      kAstRawString,
+      kConstCharString,
+      kMainThreadHandle,
+      kOffThreadTransferHandle
+    };
+
+    void SetString(Handle<String> string, Isolate* isolate);
+    void SetString(Handle<String> string, OffThreadIsolate* isolate);
+
     int start_position_;
     int end_position_;
     MessageTemplate message_;
-    const AstRawString* arg_;
-    const char* char_arg_;
+    union {
+      const AstRawString* arg_;
+      const char* char_arg_;
+      Handle<String> arg_handle_;
+      OffThreadTransferHandle<String> arg_transfer_handle_;
+    };
+    Type type_;
   };
 
-  void ThrowPendingError(Isolate* isolate, Handle<Script> script);
+  void ThrowPendingError(Isolate* isolate, Handle<Script> script) const;
 
   bool has_pending_error_;
   bool stack_overflow_;
diff --git a/deps/v8/src/parsing/preparse-data-impl.h b/deps/v8/src/parsing/preparse-data-impl.h
index 11165da5ed6..707e76236d8 100644
--- a/deps/v8/src/parsing/preparse-data-impl.h
+++ b/deps/v8/src/parsing/preparse-data-impl.h
@@ -158,17 +158,20 @@ class BaseConsumedPreparseData : public ConsumedPreparseData {
       LanguageMode* language_mode) final;
 
   void RestoreScopeAllocationData(DeclarationScope* scope,
-                                  AstValueFactory* ast_value_factory) final;
+                                  AstValueFactory* ast_value_factory,
+                                  Zone* zone) final;
 
 #ifdef DEBUG
   bool VerifyDataStart();
 #endif
 
  private:
-  void RestoreDataForScope(Scope* scope, AstValueFactory* ast_value_factory);
+  void RestoreDataForScope(Scope* scope, AstValueFactory* ast_value_factory,
+                           Zone* zone);
   void RestoreDataForVariable(Variable* var);
   void RestoreDataForInnerScopes(Scope* scope,
-                                 AstValueFactory* ast_value_factory);
+                                 AstValueFactory* ast_value_factory,
+                                 Zone* zone);
 
   std::unique_ptr<ByteData> scope_data_;
   // When consuming the data, these indexes point to the data we're going to
diff --git a/deps/v8/src/parsing/preparse-data.cc b/deps/v8/src/parsing/preparse-data.cc
index 7161861b76a..d421cb868cd 100644
--- a/deps/v8/src/parsing/preparse-data.cc
+++ b/deps/v8/src/parsing/preparse-data.cc
@@ -613,7 +613,7 @@ BaseConsumedPreparseData<Data>::GetDataForSkippableFunction(
 
 template <class Data>
 void BaseConsumedPreparseData<Data>::RestoreScopeAllocationData(
-    DeclarationScope* scope, AstValueFactory* ast_value_factory) {
+    DeclarationScope* scope, AstValueFactory* ast_value_factory, Zone* zone) {
   DCHECK_EQ(scope->scope_type(), ScopeType::FUNCTION_SCOPE);
   typename ByteData::ReadingScope reading_scope(this);
 
@@ -628,7 +628,7 @@ void BaseConsumedPreparseData<Data>::RestoreScopeAllocationData(
   DCHECK_EQ(end_position_from_data, scope->end_position());
 #endif
 
-  RestoreDataForScope(scope, ast_value_factory);
+  RestoreDataForScope(scope, ast_value_factory, zone);
 
   // Check that we consumed all scope data.
   DCHECK_EQ(scope_data_->RemainingBytes(), 0);
@@ -636,7 +636,7 @@ void BaseConsumedPreparseData<Data>::RestoreScopeAllocationData(
 
 template <typename Data>
 void BaseConsumedPreparseData<Data>::RestoreDataForScope(
-    Scope* scope, AstValueFactory* ast_value_factory) {
+    Scope* scope, AstValueFactory* ast_value_factory, Zone* zone) {
   if (scope->is_declaration_scope() &&
       scope->AsDeclarationScope()->is_skipped_function()) {
     return;
@@ -670,7 +670,7 @@ void BaseConsumedPreparseData<Data>::RestoreDataForScope(
     if (scope->AsClassScope()->is_anonymous_class()) {
       var = scope->AsClassScope()->DeclareClassVariable(
           ast_value_factory, nullptr, kNoSourcePosition);
-      AstNodeFactory factory(ast_value_factory, ast_value_factory->zone());
+      AstNodeFactory factory(ast_value_factory, zone);
       Declaration* declaration =
           factory.NewVariableDeclaration(kNoSourcePosition);
       scope->declarations()->Add(declaration);
@@ -692,7 +692,7 @@ void BaseConsumedPreparseData<Data>::RestoreDataForScope(
     if (IsSerializableVariableMode(var->mode())) RestoreDataForVariable(var);
   }
 
-  RestoreDataForInnerScopes(scope, ast_value_factory);
+  RestoreDataForInnerScopes(scope, ast_value_factory, zone);
 }
 
 template <typename Data>
@@ -732,10 +732,10 @@ void BaseConsumedPreparseData<Data>::RestoreDataForVariable(Variable* var) {
 
 template <typename Data>
 void BaseConsumedPreparseData<Data>::RestoreDataForInnerScopes(
-    Scope* scope, AstValueFactory* ast_value_factory) {
+    Scope* scope, AstValueFactory* ast_value_factory, Zone* zone) {
   for (Scope* inner = scope->inner_scope(); inner != nullptr;
        inner = inner->sibling()) {
-    RestoreDataForScope(inner, ast_value_factory);
+    RestoreDataForScope(inner, ast_value_factory, zone);
   }
 }
 
diff --git a/deps/v8/src/parsing/preparse-data.h b/deps/v8/src/parsing/preparse-data.h
index 409942f8c31..aa31326f9fb 100644
--- a/deps/v8/src/parsing/preparse-data.h
+++ b/deps/v8/src/parsing/preparse-data.h
@@ -134,8 +134,6 @@ class V8_EXPORT_PRIVATE PreparseDataBuilder : public ZoneObject,
     ByteData()
         : byte_data_(nullptr), index_(0), free_quarters_in_last_byte_(0) {}
 
-    ~ByteData() {}
-
     void Start(std::vector<uint8_t>* buffer);
     void Finalize(Zone* zone);
 
@@ -297,8 +295,9 @@ class ConsumedPreparseData {
 
   // Restores the information needed for allocating the Scope's (and its
   // subscopes') variables.
-  virtual void RestoreScopeAllocationData(
-      DeclarationScope* scope, AstValueFactory* ast_value_factory) = 0;
+  virtual void RestoreScopeAllocationData(DeclarationScope* scope,
+                                          AstValueFactory* ast_value_factory,
+                                          Zone* zone) = 0;
 
  protected:
   ConsumedPreparseData() = default;
diff --git a/deps/v8/src/parsing/preparser.cc b/deps/v8/src/parsing/preparser.cc
index 464e8e7b17c..f9af109d817 100644
--- a/deps/v8/src/parsing/preparser.cc
+++ b/deps/v8/src/parsing/preparser.cc
@@ -78,7 +78,7 @@ PreParser::PreParseResult PreParser::PreParseProgram() {
   // ModuleDeclarationInstantiation for Source Text Module Records creates a
   // new Module Environment Record whose outer lexical environment record is
   // the global scope.
-  if (parsing_module_) scope = NewModuleScope(scope);
+  if (flags().is_module()) scope = NewModuleScope(scope);
 
   FunctionState top_scope(&function_state_, &scope_, scope);
   original_scope_ = scope_;
@@ -105,11 +105,9 @@ void PreParserFormalParameters::ValidateStrictMode(PreParser* preparser) const {
 PreParser::PreParseResult PreParser::PreParseFunction(
     const AstRawString* function_name, FunctionKind kind,
     FunctionSyntaxKind function_syntax_kind, DeclarationScope* function_scope,
-    int* use_counts, ProducedPreparseData** produced_preparse_data,
-    int script_id) {
+    int* use_counts, ProducedPreparseData** produced_preparse_data) {
   DCHECK_EQ(FUNCTION_SCOPE, function_scope->scope_type());
   use_counts_ = use_counts;
-  set_script_id(script_id);
 #ifdef DEBUG
   function_scope->set_is_being_lazily_parsed(true);
 #endif
@@ -268,6 +266,7 @@ PreParser::Expression PreParser::ParseFunctionLiteral(
     int function_token_pos, FunctionSyntaxKind function_syntax_kind,
     LanguageMode language_mode,
     ZonePtrList<const AstRawString>* arguments_for_wrapped_function) {
+  FunctionParsingScope function_parsing_scope(this);
   // Wrapped functions are not parsed in the preparser.
   DCHECK_NULL(arguments_for_wrapped_function);
   DCHECK_NE(FunctionSyntaxKind::kWrapped, function_syntax_kind);
@@ -358,7 +357,7 @@ PreParser::Expression PreParser::ParseFunctionLiteral(
       name_byte_length = string->byte_length();
     }
     logger_->FunctionEvent(
-        event_name, script_id(), ms, function_scope->start_position(),
+        event_name, flags().script_id(), ms, function_scope->start_position(),
         function_scope->end_position(), name, name_byte_length);
   }
 
diff --git a/deps/v8/src/parsing/preparser.h b/deps/v8/src/parsing/preparser.h
index 3c1122ef005..5280e3d2268 100644
--- a/deps/v8/src/parsing/preparser.h
+++ b/deps/v8/src/parsing/preparser.h
@@ -8,6 +8,7 @@
 #include "src/ast/ast-value-factory.h"
 #include "src/ast/ast.h"
 #include "src/ast/scopes.h"
+#include "src/parsing/parse-info.h"
 #include "src/parsing/parser-base.h"
 #include "src/parsing/pending-compilation-error-handler.h"
 #include "src/parsing/preparser-logger.h"
@@ -921,12 +922,11 @@ class PreParser : public ParserBase<PreParser> {
             AstValueFactory* ast_value_factory,
             PendingCompilationErrorHandler* pending_error_handler,
             RuntimeCallStats* runtime_call_stats, Logger* logger,
-            int script_id = -1, bool parsing_module = false,
-            bool parsing_on_main_thread = true)
+            UnoptimizedCompileFlags flags, bool parsing_on_main_thread = true)
       : ParserBase<PreParser>(zone, scanner, stack_limit, nullptr,
                               ast_value_factory, pending_error_handler,
-                              runtime_call_stats, logger, script_id,
-                              parsing_module, parsing_on_main_thread),
+                              runtime_call_stats, logger, flags,
+                              parsing_on_main_thread),
         use_counts_(nullptr),
         preparse_data_builder_(nullptr),
         preparse_data_builder_buffer_() {
@@ -954,8 +954,7 @@ class PreParser : public ParserBase<PreParser> {
   PreParseResult PreParseFunction(
       const AstRawString* function_name, FunctionKind kind,
       FunctionSyntaxKind function_syntax_kind, DeclarationScope* function_scope,
-      int* use_counts, ProducedPreparseData** produced_preparser_scope_data,
-      int script_id);
+      int* use_counts, ProducedPreparseData** produced_preparser_scope_data);
 
   PreparseDataBuilder* preparse_data_builder() const {
     return preparse_data_builder_;
diff --git a/deps/v8/src/parsing/rewriter.cc b/deps/v8/src/parsing/rewriter.cc
index 75ec661d2d6..942acf13f82 100644
--- a/deps/v8/src/parsing/rewriter.cc
+++ b/deps/v8/src/parsing/rewriter.cc
@@ -17,12 +17,12 @@ namespace internal {
 class Processor final : public AstVisitor<Processor> {
  public:
   Processor(uintptr_t stack_limit, DeclarationScope* closure_scope,
-            Variable* result, AstValueFactory* ast_value_factory)
+            Variable* result, AstValueFactory* ast_value_factory, Zone* zone)
       : result_(result),
         replacement_(nullptr),
-        zone_(ast_value_factory->zone()),
+        zone_(zone),
         closure_scope_(closure_scope),
-        factory_(ast_value_factory, ast_value_factory->zone()),
+        factory_(ast_value_factory, zone),
         result_assigned_(false),
         is_set_(false),
         breakable_(false) {
@@ -31,10 +31,10 @@ class Processor final : public AstVisitor<Processor> {
   }
 
   Processor(Parser* parser, DeclarationScope* closure_scope, Variable* result,
-            AstValueFactory* ast_value_factory)
+            AstValueFactory* ast_value_factory, Zone* zone)
       : result_(result),
         replacement_(nullptr),
-        zone_(ast_value_factory->zone()),
+        zone_(zone),
         closure_scope_(closure_scope),
         factory_(ast_value_factory, zone_),
         result_assigned_(false),
@@ -392,7 +392,7 @@ base::Optional<VariableProxy*> Rewriter::RewriteBody(
     Variable* result = scope->AsDeclarationScope()->NewTemporary(
         info->ast_value_factory()->dot_result_string());
     Processor processor(info->stack_limit(), scope->AsDeclarationScope(),
-                        result, info->ast_value_factory());
+                        result, info->ast_value_factory(), info->zone());
     processor.Process(body);
 
     DCHECK_IMPLIES(scope->is_module_scope(), processor.result_assigned());
@@ -400,7 +400,7 @@ base::Optional<VariableProxy*> Rewriter::RewriteBody(
       int pos = kNoSourcePosition;
       VariableProxy* result_value =
           processor.factory()->NewVariableProxy(result, pos);
-      if (!info->is_repl_mode()) {
+      if (!info->flags().is_repl_mode()) {
         Statement* result_statement =
             processor.factory()->NewReturnStatement(result_value, pos);
         body->Add(result_statement, info->zone());
@@ -408,7 +408,10 @@ base::Optional<VariableProxy*> Rewriter::RewriteBody(
       return result_value;
     }
 
-    if (processor.HasStackOverflow()) return base::nullopt;
+    if (processor.HasStackOverflow()) {
+      info->pending_error_handler()->set_stack_overflow();
+      return base::nullopt;
+    }
   }
   return nullptr;
 }
diff --git a/deps/v8/src/parsing/scanner-inl.h b/deps/v8/src/parsing/scanner-inl.h
index fc5194f263f..bd4d0284d86 100644
--- a/deps/v8/src/parsing/scanner-inl.h
+++ b/deps/v8/src/parsing/scanner-inl.h
@@ -364,14 +364,14 @@ V8_INLINE Token::Value Scanner::ScanSingleToken() {
           return Select(token);
 
         case Token::CONDITIONAL:
-          // ? ?. ??
+          // ? ?. ?? ??=
           Advance();
-          if (V8_UNLIKELY(allow_harmony_optional_chaining() && c0_ == '.')) {
+          if (c0_ == '.') {
             Advance();
             if (!IsDecimalDigit(c0_)) return Token::QUESTION_PERIOD;
             PushBack('.');
-          } else if (V8_UNLIKELY(allow_harmony_nullish() && c0_ == '?')) {
-            return Select(Token::NULLISH);
+          } else if (c0_ == '?') {
+            return Select('=', Token::ASSIGN_NULLISH, Token::NULLISH);
           }
           return Token::CONDITIONAL;
 
@@ -471,16 +471,16 @@ V8_INLINE Token::Value Scanner::ScanSingleToken() {
           return Token::DIV;
 
         case Token::BIT_AND:
-          // & && &=
+          // & && &= &&=
           Advance();
-          if (c0_ == '&') return Select(Token::AND);
+          if (c0_ == '&') return Select('=', Token::ASSIGN_AND, Token::AND);
           if (c0_ == '=') return Select(Token::ASSIGN_BIT_AND);
           return Token::BIT_AND;
 
         case Token::BIT_OR:
-          // | || |=
+          // | || |= ||=
           Advance();
-          if (c0_ == '|') return Select(Token::OR);
+          if (c0_ == '|') return Select('=', Token::ASSIGN_OR, Token::OR);
           if (c0_ == '=') return Select(Token::ASSIGN_BIT_OR);
           return Token::BIT_OR;
 
diff --git a/deps/v8/src/parsing/scanner.cc b/deps/v8/src/parsing/scanner.cc
index 91e4183d53a..52a1bf0724c 100644
--- a/deps/v8/src/parsing/scanner.cc
+++ b/deps/v8/src/parsing/scanner.cc
@@ -13,6 +13,7 @@
 #include "src/ast/ast-value-factory.h"
 #include "src/numbers/conversions-inl.h"
 #include "src/objects/bigint.h"
+#include "src/parsing/parse-info.h"
 #include "src/parsing/scanner-inl.h"
 #include "src/zone/zone.h"
 
@@ -89,12 +90,10 @@ bool Scanner::BookmarkScope::HasBeenApplied() const {
 // ----------------------------------------------------------------------------
 // Scanner
 
-Scanner::Scanner(Utf16CharacterStream* source, bool is_module)
-    : source_(source),
+Scanner::Scanner(Utf16CharacterStream* source, UnoptimizedCompileFlags flags)
+    : flags_(flags),
+      source_(source),
       found_html_comment_(false),
-      allow_harmony_optional_chaining_(false),
-      allow_harmony_nullish_(false),
-      is_module_(is_module),
       octal_pos_(Location::invalid()),
       octal_message_(MessageTemplate::kNone) {
   DCHECK_NOT_NULL(source);
@@ -190,7 +189,7 @@ Token::Value Scanner::PeekAhead() {
 }
 
 Token::Value Scanner::SkipSingleHTMLComment() {
-  if (is_module_) {
+  if (flags_.is_module()) {
     ReportScannerError(source_pos(), MessageTemplate::kHtmlCommentInModule);
     return Token::ILLEGAL;
   }
@@ -233,9 +232,9 @@ void Scanner::TryToParseSourceURLComment() {
   if (!name.is_one_byte()) return;
   Vector<const uint8_t> name_literal = name.one_byte_literal();
   LiteralBuffer* value;
-  if (name_literal == StaticCharVector("sourceURL")) {
+  if (name_literal == StaticOneByteVector("sourceURL")) {
     value = &source_url_;
-  } else if (name_literal == StaticCharVector("sourceMappingURL")) {
+  } else if (name_literal == StaticOneByteVector("sourceMappingURL")) {
     value = &source_mapping_url_;
   } else {
     return;
diff --git a/deps/v8/src/parsing/scanner.h b/deps/v8/src/parsing/scanner.h
index bed63c9d4e1..830067e1ad5 100644
--- a/deps/v8/src/parsing/scanner.h
+++ b/deps/v8/src/parsing/scanner.h
@@ -15,6 +15,7 @@
 #include "src/common/globals.h"
 #include "src/common/message-template.h"
 #include "src/parsing/literal-buffer.h"
+#include "src/parsing/parse-info.h"
 #include "src/parsing/token.h"
 #include "src/strings/char-predicates.h"
 #include "src/strings/unicode.h"
@@ -269,7 +270,7 @@ class V8_EXPORT_PRIVATE Scanner {
   static const int kNoOctalLocation = -1;
   static const uc32 kEndOfInput = Utf16CharacterStream::kEndOfInput;
 
-  explicit Scanner(Utf16CharacterStream* source, bool is_module);
+  explicit Scanner(Utf16CharacterStream* source, UnoptimizedCompileFlags flags);
 
   void Initialize();
 
@@ -410,18 +411,6 @@ class V8_EXPORT_PRIVATE Scanner {
 
   bool FoundHtmlComment() const { return found_html_comment_; }
 
-  bool allow_harmony_optional_chaining() const {
-    return allow_harmony_optional_chaining_;
-  }
-
-  void set_allow_harmony_optional_chaining(bool allow) {
-    allow_harmony_optional_chaining_ = allow;
-  }
-
-  bool allow_harmony_nullish() const { return allow_harmony_nullish_; }
-
-  void set_allow_harmony_nullish(bool allow) { allow_harmony_nullish_ = allow; }
-
   const Utf16CharacterStream* stream() const { return source_; }
 
  private:
@@ -715,6 +704,8 @@ class V8_EXPORT_PRIVATE Scanner {
   const TokenDesc& next() const { return *next_; }
   const TokenDesc& next_next() const { return *next_next_; }
 
+  UnoptimizedCompileFlags flags_;
+
   TokenDesc* current_;    // desc for current token (as returned by Next())
   TokenDesc* next_;       // desc for next token (one token look-ahead)
   TokenDesc* next_next_;  // desc for the token after next (after PeakAhead())
@@ -730,12 +721,6 @@ class V8_EXPORT_PRIVATE Scanner {
   // Whether this scanner encountered an HTML comment.
   bool found_html_comment_;
 
-  // Harmony flags to allow ESNext features.
-  bool allow_harmony_optional_chaining_;
-  bool allow_harmony_nullish_;
-
-  const bool is_module_;
-
   // Values parsed from magic comments.
   LiteralBuffer source_url_;
   LiteralBuffer source_mapping_url_;
diff --git a/deps/v8/src/parsing/token.h b/deps/v8/src/parsing/token.h
index 4749945ebd0..ef92238de2a 100644
--- a/deps/v8/src/parsing/token.h
+++ b/deps/v8/src/parsing/token.h
@@ -31,6 +31,9 @@ namespace internal {
 /* Binary operators */
 /* ADD and SUB are at the end since they are UnaryOp */
 #define BINARY_OP_TOKEN_LIST(T, E) \
+  E(T, NULLISH, "??", 3)           \
+  E(T, OR, "||", 4)                \
+  E(T, AND, "&&", 5)               \
   E(T, BIT_OR, "|", 6)             \
   E(T, BIT_XOR, "^", 7)            \
   E(T, BIT_AND, "&", 8)            \
@@ -97,9 +100,6 @@ namespace internal {
   /* IsBinaryOp() relies on this block of enum values */           \
   /* being contiguous and sorted in the same order! */             \
   T(COMMA, ",", 1)                                                 \
-  T(NULLISH, "??", 3)                                              \
-  T(OR, "||", 4)                                                   \
-  T(AND, "&&", 5)                                                  \
                                                                    \
   /* Unary operators, starting at ADD in BINARY_OP_TOKEN_LIST  */  \
   /* IsUnaryOp() relies on this block of enum values */            \
@@ -297,8 +297,8 @@ class V8_EXPORT_PRIVATE Token {
   }
 
   static Value BinaryOpForAssignment(Value op) {
-    DCHECK(base::IsInRange(op, ASSIGN_BIT_OR, ASSIGN_SUB));
-    Value result = static_cast<Value>(op - ASSIGN_BIT_OR + BIT_OR);
+    DCHECK(base::IsInRange(op, ASSIGN_NULLISH, ASSIGN_SUB));
+    Value result = static_cast<Value>(op - ASSIGN_NULLISH + NULLISH);
     DCHECK(IsBinaryOp(result));
     return result;
   }
diff --git a/deps/v8/src/profiler/cpu-profiler.cc b/deps/v8/src/profiler/cpu-profiler.cc
index 4c35159b2e9..71130f65ed6 100644
--- a/deps/v8/src/profiler/cpu-profiler.cc
+++ b/deps/v8/src/profiler/cpu-profiler.cc
@@ -12,6 +12,7 @@
 #include "src/debug/debug.h"
 #include "src/execution/frames-inl.h"
 #include "src/execution/vm-state-inl.h"
+#include "src/libsampler/sampler.h"
 #include "src/logging/counters.h"
 #include "src/logging/log.h"
 #include "src/profiler/cpu-profiler-inl.h"
@@ -84,7 +85,6 @@ ProfilerEventsProcessor::ProfilerEventsProcessor(
     : Thread(Thread::Options("v8:ProfEvntProc", kProfilerStackSize)),
       generator_(generator),
       code_observer_(code_observer),
-      running_(1),
       last_code_event_id_(0),
       last_processed_code_event_id_(0),
       isolate_(isolate) {
@@ -149,7 +149,10 @@ void ProfilerEventsProcessor::AddSample(TickSample sample) {
 }
 
 void ProfilerEventsProcessor::StopSynchronously() {
-  if (!base::Relaxed_AtomicExchange(&running_, 0)) return;
+  bool expected = true;
+  if (!running_.compare_exchange_strong(expected, false,
+                                        std::memory_order_relaxed))
+    return;
   {
     base::MutexGuard guard(&running_mutex_);
     running_cond_.NotifyOne();
@@ -205,7 +208,7 @@ SamplingEventsProcessor::ProcessOneSample() {
       (record1.order == last_processed_code_event_id_)) {
     TickSampleEventRecord record;
     ticks_from_vm_buffer_.Dequeue(&record);
-    generator_->RecordTickSample(record.sample);
+    generator_->SymbolizeTickSample(record.sample);
     return OneSampleProcessed;
   }
 
@@ -217,14 +220,14 @@ SamplingEventsProcessor::ProcessOneSample() {
   if (record->order != last_processed_code_event_id_) {
     return FoundSampleForNextCodeEvent;
   }
-  generator_->RecordTickSample(record->sample);
+  generator_->SymbolizeTickSample(record->sample);
   ticks_buffer_.Remove();
   return OneSampleProcessed;
 }
 
 void SamplingEventsProcessor::Run() {
   base::MutexGuard guard(&running_mutex_);
-  while (!!base::Relaxed_Load(&running_)) {
+  while (running_.load(std::memory_order_relaxed)) {
     base::TimeTicks nextSampleTime =
         base::TimeTicks::HighResolutionNow() + period_;
     base::TimeTicks now;
@@ -261,7 +264,7 @@ void SamplingEventsProcessor::Run() {
           // If true was returned, we got interrupted before the timeout
           // elapsed. If this was not due to a change in running state, a
           // spurious wakeup occurred (thus we should continue to wait).
-          if (!base::Relaxed_Load(&running_)) {
+          if (!running_.load(std::memory_order_relaxed)) {
             break;
           }
           now = base::TimeTicks::HighResolutionNow();
@@ -287,7 +290,7 @@ void SamplingEventsProcessor::SetSamplingInterval(base::TimeDelta period) {
   StopSynchronously();
 
   period_ = period;
-  base::Relaxed_Store(&running_, 1);
+  running_.store(true, std::memory_order_relaxed);
 
   StartSynchronously();
 }
diff --git a/deps/v8/src/profiler/cpu-profiler.h b/deps/v8/src/profiler/cpu-profiler.h
index 093f28aba34..65e6d13d44b 100644
--- a/deps/v8/src/profiler/cpu-profiler.h
+++ b/deps/v8/src/profiler/cpu-profiler.h
@@ -5,30 +5,28 @@
 #ifndef V8_PROFILER_CPU_PROFILER_H_
 #define V8_PROFILER_CPU_PROFILER_H_
 
+#include <atomic>
 #include <memory>
 
-#include "src/base/atomic-utils.h"
-#include "src/base/atomicops.h"
 #include "src/base/platform/condition-variable.h"
 #include "src/base/platform/mutex.h"
 #include "src/base/platform/time.h"
-#include "src/execution/isolate.h"
-#include "src/handles/maybe-handles.h"
-#include "src/libsampler/sampler.h"
 #include "src/profiler/circular-queue.h"
 #include "src/profiler/profiler-listener.h"
 #include "src/profiler/tick-sample.h"
-#include "src/utils/allocation.h"
 #include "src/utils/locked-queue.h"
 
 namespace v8 {
+namespace sampler {
+class Sampler;
+}
 namespace internal {
 
 // Forward declarations.
 class CodeEntry;
 class CodeMap;
-class CpuProfile;
 class CpuProfilesCollection;
+class Isolate;
 class ProfileGenerator;
 
 #define CODE_EVENTS_TYPE_LIST(V)                 \
@@ -110,6 +108,8 @@ class NativeContextMoveEventRecord : public CodeEventRecord {
   Address to_address;
 };
 
+// A record type for sending samples from the main thread/signal handler to the
+// profiling thread.
 class TickSampleEventRecord {
  public:
   // The parameterless constructor is used when we dequeue data from
@@ -121,7 +121,8 @@ class TickSampleEventRecord {
   TickSample sample;
 };
 
-
+// A record type for sending code events (e.g. create, move, delete) to the
+// profiling thread.
 class CodeEventsContainer {
  public:
   explicit CodeEventsContainer(
@@ -155,14 +156,14 @@ class ProfilerCodeObserver;
 class V8_EXPORT_PRIVATE ProfilerEventsProcessor : public base::Thread,
                                                   public CodeEventObserver {
  public:
-  virtual ~ProfilerEventsProcessor();
+  ~ProfilerEventsProcessor() override;
 
   void CodeEventHandler(const CodeEventsContainer& evt_rec) override;
 
   // Thread control.
   void Run() override = 0;
   void StopSynchronously();
-  V8_INLINE bool running() { return !!base::Relaxed_Load(&running_); }
+  bool running() { return running_.load(std::memory_order_relaxed); }
   void Enqueue(const CodeEventsContainer& event);
 
   // Puts current stack into the tick sample events buffer.
@@ -189,7 +190,7 @@ class V8_EXPORT_PRIVATE ProfilerEventsProcessor : public base::Thread,
 
   ProfileGenerator* generator_;
   ProfilerCodeObserver* code_observer_;
-  base::Atomic32 running_;
+  std::atomic_bool running_{true};
   base::ConditionVariable running_cond_;
   base::Mutex running_mutex_;
   LockedQueue<CodeEventsContainer> events_buffer_;
@@ -276,6 +277,26 @@ class V8_EXPORT_PRIVATE ProfilerCodeObserver : public CodeEventObserver {
   ProfilerEventsProcessor* processor_;
 };
 
+// The CpuProfiler is a sampling CPU profiler for JS frames. It corresponds to
+// v8::CpuProfiler at the API level. It spawns an additional thread which is
+// responsible for triggering samples and then symbolizing the samples with
+// function names. To symbolize on a background thread, the profiler copies
+// metadata about generated code off-heap.
+//
+// Sampling is done using posix signals (except on Windows). The profiling
+// thread sends a signal to the main thread, based on a timer. The signal
+// handler can interrupt the main thread between any abitrary instructions.
+// This means we are very careful about reading stack values during the signal
+// handler as we could be in the middle of an operation that is modifying the
+// stack.
+//
+// The story on Windows is similar except we use thread suspend and resume.
+//
+// Samples are passed to the profiling thread via a circular buffer. The
+// profiling thread symbolizes the samples by looking up the code pointers
+// against its own list of code objects. The profiling thread also listens for
+// code creation/move/deletion events (from the GC), to maintain its list of
+// code objects accurately.
 class V8_EXPORT_PRIVATE CpuProfiler {
  public:
   explicit CpuProfiler(Isolate* isolate, CpuProfilingNamingMode = kDebugNaming,
@@ -314,7 +335,7 @@ class V8_EXPORT_PRIVATE CpuProfiler {
   ProfilerEventsProcessor* processor() const { return processor_.get(); }
   Isolate* isolate() const { return isolate_; }
 
-  ProfilerListener* profiler_listener_for_test() {
+  ProfilerListener* profiler_listener_for_test() const {
     return profiler_listener_.get();
   }
 
diff --git a/deps/v8/src/profiler/heap-profiler.cc b/deps/v8/src/profiler/heap-profiler.cc
index c5fcdcd7132..f063fd1f476 100644
--- a/deps/v8/src/profiler/heap-profiler.cc
+++ b/deps/v8/src/profiler/heap-profiler.cc
@@ -216,14 +216,27 @@ void HeapProfiler::QueryObjects(Handle<Context> context,
                                 debug::QueryObjectPredicate* predicate,
                                 PersistentValueVector<v8::Object>* objects) {
   {
-    CombinedHeapObjectIterator function_heap_iterator(
+    HandleScope handle_scope(isolate());
+    std::vector<Handle<JSTypedArray>> on_heap_typed_arrays;
+    CombinedHeapObjectIterator heap_iterator(
         heap(), HeapObjectIterator::kFilterUnreachable);
-    for (HeapObject heap_obj = function_heap_iterator.Next();
-         !heap_obj.is_null(); heap_obj = function_heap_iterator.Next()) {
+    for (HeapObject heap_obj = heap_iterator.Next(); !heap_obj.is_null();
+         heap_obj = heap_iterator.Next()) {
       if (heap_obj.IsFeedbackVector()) {
         FeedbackVector::cast(heap_obj).ClearSlots(isolate());
+      } else if (heap_obj.IsJSTypedArray() &&
+                 JSTypedArray::cast(heap_obj).is_on_heap()) {
+        // Cannot call typed_array->GetBuffer() here directly because it may
+        // trigger GC. Defer that call by collecting the object in a vector.
+        on_heap_typed_arrays.push_back(
+            handle(JSTypedArray::cast(heap_obj), isolate()));
       }
     }
+    for (auto& typed_array : on_heap_typed_arrays) {
+      // Convert the on-heap typed array into off-heap typed array, so that
+      // its ArrayBuffer becomes valid and can be returned in the result.
+      typed_array->GetBuffer();
+    }
   }
   // We should return accurate information about live objects, so we need to
   // collect all garbage first.
diff --git a/deps/v8/src/profiler/heap-snapshot-generator.cc b/deps/v8/src/profiler/heap-snapshot-generator.cc
index 2ae22224193..5b08ad007c1 100644
--- a/deps/v8/src/profiler/heap-snapshot-generator.cc
+++ b/deps/v8/src/profiler/heap-snapshot-generator.cc
@@ -1129,7 +1129,7 @@ void V8HeapExplorer::ExtractScriptReferences(HeapEntry* entry, Script script) {
   SetInternalReference(entry, "source", script.source(), Script::kSourceOffset);
   SetInternalReference(entry, "name", script.name(), Script::kNameOffset);
   SetInternalReference(entry, "context_data", script.context_data(),
-                       Script::kContextOffset);
+                       Script::kContextDataOffset);
   TagObject(script.line_ends(), "(script line ends)");
   SetInternalReference(entry, "line_ends", script.line_ends(),
                        Script::kLineEndsOffset);
@@ -1487,7 +1487,11 @@ bool V8HeapExplorer::IterateAndExtractReferences(
   // its custom name to a generic builtin.
   RootsReferencesExtractor extractor(this);
   ReadOnlyRoots(heap_).Iterate(&extractor);
-  heap_->IterateRoots(&extractor, VISIT_ONLY_STRONG);
+  heap_->IterateRoots(&extractor, base::EnumSet<SkipRoot>{SkipRoot::kWeak});
+  // TODO(ulan): The heap snapshot generator incorrectly considers the weak
+  // string tables as strong retainers. Move IterateWeakRoots after
+  // SetVisitingWeakRoots.
+  heap_->IterateWeakRoots(&extractor, {});
   extractor.SetVisitingWeakRoots();
   heap_->IterateWeakGlobalHandles(&extractor);
 
diff --git a/deps/v8/src/profiler/profile-generator.cc b/deps/v8/src/profiler/profile-generator.cc
index b8389f4350b..b38a67771ba 100644
--- a/deps/v8/src/profiler/profile-generator.cc
+++ b/deps/v8/src/profiler/profile-generator.cc
@@ -6,6 +6,7 @@
 
 #include <algorithm>
 
+#include "src/codegen/source-position.h"
 #include "src/objects/shared-function-info-inl.h"
 #include "src/profiler/cpu-profiler.h"
 #include "src/profiler/profile-generator-inl.h"
@@ -871,7 +872,7 @@ ProfileGenerator::ProfileGenerator(CpuProfilesCollection* profiles,
                                    CodeMap* code_map)
     : profiles_(profiles), code_map_(code_map) {}
 
-void ProfileGenerator::RecordTickSample(const TickSample& sample) {
+void ProfileGenerator::SymbolizeTickSample(const TickSample& sample) {
   ProfileStackTrace stack_trace;
   // Conservatively reserve space for stack frames + pc + function + vm-state.
   // There could in fact be more of them because of inlined entries.
diff --git a/deps/v8/src/profiler/profile-generator.h b/deps/v8/src/profiler/profile-generator.h
index 9f7ef34d185..1f9d5370ae7 100644
--- a/deps/v8/src/profiler/profile-generator.h
+++ b/deps/v8/src/profiler/profile-generator.h
@@ -17,7 +17,6 @@
 #include "include/v8-profiler.h"
 #include "src/base/platform/time.h"
 #include "src/builtins/builtins.h"
-#include "src/codegen/source-position.h"
 #include "src/logging/code-events.h"
 #include "src/profiler/strings-storage.h"
 #include "src/utils/allocation.h"
@@ -521,7 +520,10 @@ class V8_EXPORT_PRIVATE ProfileGenerator {
  public:
   explicit ProfileGenerator(CpuProfilesCollection* profiles, CodeMap* code_map);
 
-  void RecordTickSample(const TickSample& sample);
+  // Use the CodeMap to turn the raw addresses recorded in the sample into
+  // code/function names. The symbolized stack is added to the relevant
+  // profiles in the CpuProfilesCollection.
+  void SymbolizeTickSample(const TickSample& sample);
 
   void UpdateNativeContextAddress(Address from, Address to);
 
diff --git a/deps/v8/src/profiler/sampling-heap-profiler.cc b/deps/v8/src/profiler/sampling-heap-profiler.cc
index e7d780e084a..19a15481fed 100644
--- a/deps/v8/src/profiler/sampling-heap-profiler.cc
+++ b/deps/v8/src/profiler/sampling-heap-profiler.cc
@@ -74,15 +74,13 @@ SamplingHeapProfiler::~SamplingHeapProfiler() {
 void SamplingHeapProfiler::SampleObject(Address soon_object, size_t size) {
   DisallowHeapAllocation no_allocation;
 
+  // Check if the area is iterable by confirming that it starts with a map.
+  DCHECK((*ObjectSlot(soon_object)).IsMap());
+
   HandleScope scope(isolate_);
   HeapObject heap_object = HeapObject::FromAddress(soon_object);
   Handle<Object> obj(heap_object, isolate_);
 
-  // Mark the new block as FreeSpace to make sure the heap is iterable while we
-  // are taking the sample.
-  heap_->CreateFillerObjectAt(soon_object, static_cast<int>(size),
-                              ClearRecordedSlots::kNo);
-
   Local<v8::Value> loc = v8::Utils::ToLocal(obj);
 
   AllocationNode* node = AddStack();
diff --git a/deps/v8/src/profiler/tick-sample.cc b/deps/v8/src/profiler/tick-sample.cc
index 00bff91cd0a..94cd4171ea8 100644
--- a/deps/v8/src/profiler/tick-sample.cc
+++ b/deps/v8/src/profiler/tick-sample.cc
@@ -10,7 +10,7 @@
 #include "src/execution/frames-inl.h"
 #include "src/execution/simulator.h"
 #include "src/execution/vm-state-inl.h"
-#include "src/heap/heap-inl.h"  // For MemoryAllocator::code_range.
+#include "src/heap/heap-inl.h"  // For Heap::code_range.
 #include "src/logging/counters.h"
 #include "src/sanitizer/asan.h"
 #include "src/sanitizer/msan.h"
diff --git a/deps/v8/src/profiler/tracing-cpu-profiler.cc b/deps/v8/src/profiler/tracing-cpu-profiler.cc
index 26092885a9c..d18ae09fb14 100644
--- a/deps/v8/src/profiler/tracing-cpu-profiler.cc
+++ b/deps/v8/src/profiler/tracing-cpu-profiler.cc
@@ -4,6 +4,7 @@
 
 #include "src/profiler/tracing-cpu-profiler.h"
 
+#include "src/execution/isolate.h"
 #include "src/init/v8.h"
 #include "src/profiler/cpu-profiler.h"
 #include "src/tracing/trace-event.h"
@@ -49,10 +50,7 @@ void TracingCpuProfilerImpl::OnTraceDisabled() {
 void TracingCpuProfilerImpl::StartProfiling() {
   base::MutexGuard lock(&mutex_);
   if (!profiling_enabled_ || profiler_) return;
-  bool enabled;
-  TRACE_EVENT_CATEGORY_GROUP_ENABLED(
-      TRACE_DISABLED_BY_DEFAULT("v8.cpu_profiler.hires"), &enabled);
-  int sampling_interval_us = enabled ? 100 : 1000;
+  int sampling_interval_us = 100;
   profiler_.reset(new CpuProfiler(isolate_, kDebugNaming));
   profiler_->set_sampling_interval(
       base::TimeDelta::FromMicroseconds(sampling_interval_us));
diff --git a/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.cc b/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.cc
index 03dac337e0d..10dad83c28c 100644
--- a/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.cc
+++ b/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.cc
@@ -945,25 +945,6 @@ RegExpMacroAssembler::IrregexpImplementation
   return kARMImplementation;
 }
 
-void RegExpMacroAssemblerARM::LoadCurrentCharacterImpl(int cp_offset,
-                                                       Label* on_end_of_input,
-                                                       bool check_bounds,
-                                                       int characters,
-                                                       int eats_at_least) {
-  // It's possible to preload a small number of characters when each success
-  // path requires a large number of characters, but not the reverse.
-  DCHECK_GE(eats_at_least, characters);
-
-  DCHECK(cp_offset < (1<<30));  // Be sane! (And ensure negation works)
-  if (check_bounds) {
-    if (cp_offset >= 0) {
-      CheckPosition(cp_offset + eats_at_least - 1, on_end_of_input);
-    } else {
-      CheckPosition(cp_offset, on_end_of_input);
-    }
-  }
-  LoadCurrentCharacterUnchecked(cp_offset, characters);
-}
 
 void RegExpMacroAssemblerARM::PopCurrentPosition() {
   Pop(current_input_offset());
diff --git a/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.h b/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.h
index 22628fb760c..549636a6744 100644
--- a/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.h
+++ b/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.h
@@ -67,9 +67,8 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerARM
   virtual void IfRegisterLT(int reg, int comparand, Label* if_lt);
   virtual void IfRegisterEqPos(int reg, Label* if_eq);
   virtual IrregexpImplementation Implementation();
-  virtual void LoadCurrentCharacterImpl(int cp_offset, Label* on_end_of_input,
-                                        bool check_bounds, int characters,
-                                        int eats_at_least);
+  virtual void LoadCurrentCharacterUnchecked(int cp_offset,
+                                             int character_count);
   virtual void PopCurrentPosition();
   virtual void PopRegister(int register_index);
   virtual void PushBacktrack(Label* label);
@@ -127,10 +126,6 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerARM
 
   static const int kBacktrackConstantPoolSize = 4;
 
-  // Load a number of characters at the given offset from the
-  // current position, into the current-character register.
-  void LoadCurrentCharacterUnchecked(int cp_offset, int character_count);
-
   // Check whether preemption has been requested.
   void CheckPreemption();
 
diff --git a/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.cc b/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.cc
index 43a6bdf912a..055f5639f5b 100644
--- a/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.cc
+++ b/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.cc
@@ -1131,28 +1131,6 @@ RegExpMacroAssembler::IrregexpImplementation
   return kARM64Implementation;
 }
 
-void RegExpMacroAssemblerARM64::LoadCurrentCharacterImpl(int cp_offset,
-                                                         Label* on_end_of_input,
-                                                         bool check_bounds,
-                                                         int characters,
-                                                         int eats_at_least) {
-  // It's possible to preload a small number of characters when each success
-  // path requires a large number of characters, but not the reverse.
-  DCHECK_GE(eats_at_least, characters);
-
-  // TODO(pielan): Make sure long strings are caught before this, and not
-  // just asserted in debug mode.
-  // Be sane! (And ensure that an int32_t can be used to index the string)
-  DCHECK(cp_offset < (1<<30));
-  if (check_bounds) {
-    if (cp_offset >= 0) {
-      CheckPosition(cp_offset + eats_at_least - 1, on_end_of_input);
-    } else {
-      CheckPosition(cp_offset, on_end_of_input);
-    }
-  }
-  LoadCurrentCharacterUnchecked(cp_offset, characters);
-}
 
 void RegExpMacroAssemblerARM64::PopCurrentPosition() {
   Pop(current_input_offset());
diff --git a/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.h b/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.h
index 91b5e90bf53..2b5feb1dbdc 100644
--- a/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.h
+++ b/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.h
@@ -73,9 +73,8 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerARM64
   virtual void IfRegisterLT(int reg, int comparand, Label* if_lt);
   virtual void IfRegisterEqPos(int reg, Label* if_eq);
   virtual IrregexpImplementation Implementation();
-  virtual void LoadCurrentCharacterImpl(int cp_offset, Label* on_end_of_input,
-                                        bool check_bounds, int characters,
-                                        int eats_at_least);
+  virtual void LoadCurrentCharacterUnchecked(int cp_offset,
+                                             int character_count);
   virtual void PopCurrentPosition();
   virtual void PopRegister(int register_index);
   virtual void PushBacktrack(Label* label);
@@ -139,10 +138,6 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerARM64
   // 16 registers.
   static const int kNumCachedRegisters = 16;
 
-  // Load a number of characters at the given offset from the
-  // current position, into the current-character register.
-  void LoadCurrentCharacterUnchecked(int cp_offset, int character_count);
-
   // Check whether preemption has been requested.
   void CheckPreemption();
 
diff --git a/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.cc b/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.cc
index 7f6bd5e2961..501a0aff604 100644
--- a/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.cc
+++ b/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.cc
@@ -981,25 +981,6 @@ RegExpMacroAssembler::IrregexpImplementation
   return kIA32Implementation;
 }
 
-void RegExpMacroAssemblerIA32::LoadCurrentCharacterImpl(int cp_offset,
-                                                        Label* on_end_of_input,
-                                                        bool check_bounds,
-                                                        int characters,
-                                                        int eats_at_least) {
-  // It's possible to preload a small number of characters when each success
-  // path requires a large number of characters, but not the reverse.
-  DCHECK_GE(eats_at_least, characters);
-
-  DCHECK(cp_offset < (1<<30));  // Be sane! (And ensure negation works)
-  if (check_bounds) {
-    if (cp_offset >= 0) {
-      CheckPosition(cp_offset + eats_at_least - 1, on_end_of_input);
-    } else {
-      CheckPosition(cp_offset, on_end_of_input);
-    }
-  }
-  LoadCurrentCharacterUnchecked(cp_offset, characters);
-}
 
 void RegExpMacroAssemblerIA32::PopCurrentPosition() {
   Pop(edi);
diff --git a/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.h b/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.h
index f68dd0b1b7d..2339ca57e15 100644
--- a/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.h
+++ b/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.h
@@ -66,9 +66,8 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerIA32
   virtual void IfRegisterLT(int reg, int comparand, Label* if_lt);
   virtual void IfRegisterEqPos(int reg, Label* if_eq);
   virtual IrregexpImplementation Implementation();
-  virtual void LoadCurrentCharacterImpl(int cp_offset, Label* on_end_of_input,
-                                        bool check_bounds, int characters,
-                                        int eats_at_least);
+  virtual void LoadCurrentCharacterUnchecked(int cp_offset,
+                                             int character_count);
   virtual void PopCurrentPosition();
   virtual void PopRegister(int register_index);
   virtual void PushBacktrack(Label* label);
@@ -127,10 +126,6 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerIA32
   // Initial size of code buffer.
   static const int kRegExpCodeSize = 1024;
 
-  // Load a number of characters at the given offset from the
-  // current position, into the current-character register.
-  void LoadCurrentCharacterUnchecked(int cp_offset, int character_count);
-
   // Check whether preemption has been requested.
   void CheckPreemption();
 
diff --git a/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.cc b/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.cc
index e3f2ea62925..5f8eb4c6d33 100644
--- a/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.cc
+++ b/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.cc
@@ -958,25 +958,6 @@ RegExpMacroAssembler::IrregexpImplementation
   return kMIPSImplementation;
 }
 
-void RegExpMacroAssemblerMIPS::LoadCurrentCharacterImpl(int cp_offset,
-                                                        Label* on_end_of_input,
-                                                        bool check_bounds,
-                                                        int characters,
-                                                        int eats_at_least) {
-  // It's possible to preload a small number of characters when each success
-  // path requires a large number of characters, but not the reverse.
-  DCHECK_GE(eats_at_least, characters);
-
-  DCHECK(cp_offset < (1<<30));  // Be sane! (And ensure negation works).
-  if (check_bounds) {
-    if (cp_offset >= 0) {
-      CheckPosition(cp_offset + eats_at_least - 1, on_end_of_input);
-    } else {
-      CheckPosition(cp_offset, on_end_of_input);
-    }
-  }
-  LoadCurrentCharacterUnchecked(cp_offset, characters);
-}
 
 void RegExpMacroAssemblerMIPS::PopCurrentPosition() {
   Pop(current_input_offset());
diff --git a/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.h b/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.h
index 5733bbe0460..cafa7851803 100644
--- a/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.h
+++ b/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.h
@@ -67,9 +67,8 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerMIPS
   virtual void IfRegisterLT(int reg, int comparand, Label* if_lt);
   virtual void IfRegisterEqPos(int reg, Label* if_eq);
   virtual IrregexpImplementation Implementation();
-  virtual void LoadCurrentCharacterImpl(int cp_offset, Label* on_end_of_input,
-                                        bool check_bounds, int characters,
-                                        int eats_at_least);
+  virtual void LoadCurrentCharacterUnchecked(int cp_offset,
+                                             int character_count);
   virtual void PopCurrentPosition();
   virtual void PopRegister(int register_index);
   virtual void PushBacktrack(Label* label);
@@ -128,10 +127,6 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerMIPS
   // Initial size of code buffer.
   static const int kRegExpCodeSize = 1024;
 
-  // Load a number of characters at the given offset from the
-  // current position, into the current-character register.
-  void LoadCurrentCharacterUnchecked(int cp_offset, int character_count);
-
   // Check whether preemption has been requested.
   void CheckPreemption();
 
diff --git a/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.cc b/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.cc
index fc3cad8b0e3..c443c8da467 100644
--- a/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.cc
+++ b/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.cc
@@ -994,25 +994,6 @@ RegExpMacroAssembler::IrregexpImplementation
   return kMIPSImplementation;
 }
 
-void RegExpMacroAssemblerMIPS::LoadCurrentCharacterImpl(int cp_offset,
-                                                        Label* on_end_of_input,
-                                                        bool check_bounds,
-                                                        int characters,
-                                                        int eats_at_least) {
-  // It's possible to preload a small number of characters when each success
-  // path requires a large number of characters, but not the reverse.
-  DCHECK_GE(eats_at_least, characters);
-
-  DCHECK(cp_offset < (1<<30));  // Be sane! (And ensure negation works).
-  if (check_bounds) {
-    if (cp_offset >= 0) {
-      CheckPosition(cp_offset + eats_at_least - 1, on_end_of_input);
-    } else {
-      CheckPosition(cp_offset, on_end_of_input);
-    }
-  }
-  LoadCurrentCharacterUnchecked(cp_offset, characters);
-}
 
 void RegExpMacroAssemblerMIPS::PopCurrentPosition() {
   Pop(current_input_offset());
diff --git a/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.h b/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.h
index b267297c245..161a01e2fca 100644
--- a/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.h
+++ b/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.h
@@ -67,9 +67,8 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerMIPS
   virtual void IfRegisterLT(int reg, int comparand, Label* if_lt);
   virtual void IfRegisterEqPos(int reg, Label* if_eq);
   virtual IrregexpImplementation Implementation();
-  virtual void LoadCurrentCharacterImpl(int cp_offset, Label* on_end_of_input,
-                                        bool check_bounds, int characters,
-                                        int eats_at_least);
+  virtual void LoadCurrentCharacterUnchecked(int cp_offset,
+                                             int character_count);
   virtual void PopCurrentPosition();
   virtual void PopRegister(int register_index);
   virtual void PushBacktrack(Label* label);
@@ -133,10 +132,6 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerMIPS
   // Initial size of code buffer.
   static const int kRegExpCodeSize = 1024;
 
-  // Load a number of characters at the given offset from the
-  // current position, into the current-character register.
-  void LoadCurrentCharacterUnchecked(int cp_offset, int character_count);
-
   // Check whether preemption has been requested.
   void CheckPreemption();
 
diff --git a/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.cc b/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.cc
index 376103324a1..5a6eb315103 100644
--- a/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.cc
+++ b/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.cc
@@ -235,7 +235,7 @@ void RegExpMacroAssemblerPPC::CheckGreedyLoop(Label* on_equal) {
   __ cmp(current_input_offset(), r3);
   __ bne(&backtrack_non_equal);
   __ addi(backtrack_stackpointer(), backtrack_stackpointer(),
-          Operand(kPointerSize));
+          Operand(kSystemPointerSize));
 
   __ bind(&backtrack_non_equal);
   BranchOrBacktrack(eq, on_equal);
@@ -687,7 +687,7 @@ Handle<HeapObject> RegExpMacroAssemblerPPC::GetCode(Handle<String> source) {
     __ MultiPush(argument_registers | registers_to_retain);
     // Set frame pointer in space for it if this is not a direct call
     // from generated code.
-    __ addi(frame_pointer(), sp, Operand(8 * kPointerSize));
+    __ addi(frame_pointer(), sp, Operand(8 * kSystemPointerSize));
 
     STATIC_ASSERT(kSuccessfulCaptures == kInputString - kSystemPointerSize);
     __ li(r3, Operand::Zero());
@@ -711,7 +711,7 @@ Handle<HeapObject> RegExpMacroAssemblerPPC::GetCode(Handle<String> source) {
     __ ble(&stack_limit_hit, cr0);
     // Check if there is room for the variable number of registers above
     // the stack limit.
-    __ Cmpli(r3, Operand(num_registers_ * kPointerSize), r0);
+    __ Cmpli(r3, Operand(num_registers_ * kSystemPointerSize), r0);
     __ bge(&stack_ok);
     // Exit with OutOfMemory exception. There is not enough space on the stack
     // for our working registers.
@@ -727,7 +727,7 @@ Handle<HeapObject> RegExpMacroAssemblerPPC::GetCode(Handle<String> source) {
     __ bind(&stack_ok);
 
     // Allocate space on stack for registers.
-    __ Add(sp, sp, -num_registers_ * kPointerSize, r0);
+    __ Add(sp, sp, -num_registers_ * kSystemPointerSize, r0);
     // Load string end.
     __ LoadP(end_of_input_address(), MemOperand(frame_pointer(), kInputEnd));
     // Load input start.
@@ -769,12 +769,13 @@ Handle<HeapObject> RegExpMacroAssemblerPPC::GetCode(Handle<String> source) {
       // Fill saved registers with initial value = start offset - 1
       if (num_saved_registers_ > 8) {
         // One slot beyond address of register 0.
-        __ addi(r4, frame_pointer(), Operand(kRegisterZero + kPointerSize));
+        __ addi(r4, frame_pointer(),
+                Operand(kRegisterZero + kSystemPointerSize));
         __ mov(r5, Operand(num_saved_registers_));
         __ mtctr(r5);
         Label init_loop;
         __ bind(&init_loop);
-        __ StorePU(r3, MemOperand(r4, -kPointerSize));
+        __ StorePU(r3, MemOperand(r4, -kSystemPointerSize));
         __ bdnz(&init_loop);
       } else {
         for (int i = 0; i < num_saved_registers_; i++) {
@@ -992,25 +993,6 @@ RegExpMacroAssemblerPPC::Implementation() {
   return kPPCImplementation;
 }
 
-void RegExpMacroAssemblerPPC::LoadCurrentCharacterImpl(int cp_offset,
-                                                       Label* on_end_of_input,
-                                                       bool check_bounds,
-                                                       int characters,
-                                                       int eats_at_least) {
-  // It's possible to preload a small number of characters when each success
-  // path requires a large number of characters, but not the reverse.
-  DCHECK_GE(eats_at_least, characters);
-
-  DCHECK(cp_offset < (1 << 30));  // Be sane! (And ensure negation works)
-  if (check_bounds) {
-    if (cp_offset >= 0) {
-      CheckPosition(cp_offset + eats_at_least - 1, on_end_of_input);
-    } else {
-      CheckPosition(cp_offset, on_end_of_input);
-    }
-  }
-  LoadCurrentCharacterUnchecked(cp_offset, characters);
-}
 
 void RegExpMacroAssemblerPPC::PopCurrentPosition() {
   Pop(current_input_offset());
@@ -1122,15 +1104,17 @@ void RegExpMacroAssemblerPPC::CallCheckStackGuardState(Register scratch) {
   // The following stack manipulation logic is similar to
   // PrepareCallCFunction.  However, we need an extra slot on the
   // stack to house the return address parameter.
-  if (frame_alignment > kPointerSize) {
+  if (frame_alignment > kSystemPointerSize) {
     // Make stack end at alignment and make room for stack arguments
     // -- preserving original value of sp.
     __ mr(scratch, sp);
-    __ addi(sp, sp, Operand(-(stack_passed_arguments + 1) * kPointerSize));
+    __ addi(sp, sp,
+            Operand(-(stack_passed_arguments + 1) * kSystemPointerSize));
     DCHECK(base::bits::IsPowerOfTwo(frame_alignment));
     __ ClearRightImm(sp, sp,
                      Operand(base::bits::WhichPowerOfTwo(frame_alignment)));
-    __ StoreP(scratch, MemOperand(sp, stack_passed_arguments * kPointerSize));
+    __ StoreP(scratch,
+              MemOperand(sp, stack_passed_arguments * kSystemPointerSize));
   } else {
     // Make room for stack arguments
     stack_space += stack_passed_arguments;
@@ -1138,14 +1122,14 @@ void RegExpMacroAssemblerPPC::CallCheckStackGuardState(Register scratch) {
 
   // Allocate frame with required slots to make ABI work.
   __ li(r0, Operand::Zero());
-  __ StorePU(r0, MemOperand(sp, -stack_space * kPointerSize));
+  __ StorePU(r0, MemOperand(sp, -stack_space * kSystemPointerSize));
 
   // RegExp code frame pointer.
   __ mr(r5, frame_pointer());
   // Code of self.
   __ mov(r4, Operand(masm_->CodeObject()));
   // r3 will point to the return address, placed by DirectCEntry.
-  __ addi(r3, sp, Operand(kStackFrameExtraParamSlot * kPointerSize));
+  __ addi(r3, sp, Operand(kStackFrameExtraParamSlot * kSystemPointerSize));
 
   ExternalReference stack_guard_check =
       ExternalReference::re_check_stack_guard_state(isolate());
@@ -1159,10 +1143,10 @@ void RegExpMacroAssemblerPPC::CallCheckStackGuardState(Register scratch) {
 
   // Restore the stack pointer
   stack_space = kNumRequiredStackFrameSlots + stack_passed_arguments;
-  if (frame_alignment > kPointerSize) {
-    __ LoadP(sp, MemOperand(sp, stack_space * kPointerSize));
+  if (frame_alignment > kSystemPointerSize) {
+    __ LoadP(sp, MemOperand(sp, stack_space * kSystemPointerSize));
   } else {
-    __ addi(sp, sp, Operand(stack_space * kPointerSize));
+    __ addi(sp, sp, Operand(stack_space * kSystemPointerSize));
   }
 
   __ mov(code_pointer(), Operand(masm_->CodeObject()));
@@ -1203,7 +1187,7 @@ MemOperand RegExpMacroAssemblerPPC::register_location(int register_index) {
     num_registers_ = register_index + 1;
   }
   return MemOperand(frame_pointer(),
-                    kRegisterZero - register_index * kPointerSize);
+                    kRegisterZero - register_index * kSystemPointerSize);
 }
 
 
@@ -1265,7 +1249,7 @@ void RegExpMacroAssemblerPPC::SafeCallTarget(Label* name) {
 
 void RegExpMacroAssemblerPPC::Push(Register source) {
   DCHECK(source != backtrack_stackpointer());
-  __ StorePU(source, MemOperand(backtrack_stackpointer(), -kPointerSize));
+  __ StorePU(source, MemOperand(backtrack_stackpointer(), -kSystemPointerSize));
 }
 
 
@@ -1273,7 +1257,7 @@ void RegExpMacroAssemblerPPC::Pop(Register target) {
   DCHECK(target != backtrack_stackpointer());
   __ LoadP(target, MemOperand(backtrack_stackpointer()));
   __ addi(backtrack_stackpointer(), backtrack_stackpointer(),
-          Operand(kPointerSize));
+          Operand(kSystemPointerSize));
 }
 
 
diff --git a/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.h b/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.h
index 3e64f139a8f..598691d9883 100644
--- a/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.h
+++ b/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.h
@@ -59,9 +59,8 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerPPC
   virtual void IfRegisterLT(int reg, int comparand, Label* if_lt);
   virtual void IfRegisterEqPos(int reg, Label* if_eq);
   virtual IrregexpImplementation Implementation();
-  virtual void LoadCurrentCharacterImpl(int cp_offset, Label* on_end_of_input,
-                                        bool check_bounds, int characters,
-                                        int eats_at_least);
+  virtual void LoadCurrentCharacterUnchecked(int cp_offset,
+                                             int character_count);
   virtual void PopCurrentPosition();
   virtual void PopRegister(int register_index);
   virtual void PushBacktrack(Label* label);
@@ -92,26 +91,27 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerPPC
   // Register 25..31.
   static const int kStoredRegisters = kFramePointer;
   // Return address (stored from link register, read into pc on return).
-  static const int kReturnAddress = kStoredRegisters + 7 * kPointerSize;
-  static const int kCallerFrame = kReturnAddress + kPointerSize;
+  static const int kReturnAddress = kStoredRegisters + 7 * kSystemPointerSize;
+  static const int kCallerFrame = kReturnAddress + kSystemPointerSize;
   // Stack parameters placed by caller.
   static const int kIsolate =
-      kCallerFrame + kStackFrameExtraParamSlot * kPointerSize;
+      kCallerFrame + kStackFrameExtraParamSlot * kSystemPointerSize;
 
   // Below the frame pointer.
   // Register parameters stored by setup code.
-  static const int kDirectCall = kFramePointer - kPointerSize;
-  static const int kStackHighEnd = kDirectCall - kPointerSize;
-  static const int kNumOutputRegisters = kStackHighEnd - kPointerSize;
-  static const int kRegisterOutput = kNumOutputRegisters - kPointerSize;
-  static const int kInputEnd = kRegisterOutput - kPointerSize;
-  static const int kInputStart = kInputEnd - kPointerSize;
-  static const int kStartIndex = kInputStart - kPointerSize;
-  static const int kInputString = kStartIndex - kPointerSize;
+  static const int kDirectCall = kFramePointer - kSystemPointerSize;
+  static const int kStackHighEnd = kDirectCall - kSystemPointerSize;
+  static const int kNumOutputRegisters = kStackHighEnd - kSystemPointerSize;
+  static const int kRegisterOutput = kNumOutputRegisters - kSystemPointerSize;
+  static const int kInputEnd = kRegisterOutput - kSystemPointerSize;
+  static const int kInputStart = kInputEnd - kSystemPointerSize;
+  static const int kStartIndex = kInputStart - kSystemPointerSize;
+  static const int kInputString = kStartIndex - kSystemPointerSize;
   // When adding local variables remember to push space for them in
   // the frame in GetCode.
-  static const int kSuccessfulCaptures = kInputString - kPointerSize;
-  static const int kStringStartMinusOne = kSuccessfulCaptures - kPointerSize;
+  static const int kSuccessfulCaptures = kInputString - kSystemPointerSize;
+  static const int kStringStartMinusOne =
+      kSuccessfulCaptures - kSystemPointerSize;
   static const int kBacktrackCount = kStringStartMinusOne - kSystemPointerSize;
   // First register address. Following registers are below it on the stack.
   static const int kRegisterZero = kBacktrackCount - kSystemPointerSize;
@@ -119,10 +119,6 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerPPC
   // Initial size of code buffer.
   static const int kRegExpCodeSize = 1024;
 
-  // Load a number of characters at the given offset from the
-  // current position, into the current-character register.
-  void LoadCurrentCharacterUnchecked(int cp_offset, int character_count);
-
   // Check whether preemption has been requested.
   void CheckPreemption();
 
diff --git a/deps/v8/src/regexp/regexp-bytecode-generator.cc b/deps/v8/src/regexp/regexp-bytecode-generator.cc
index e82b67b530a..83933a617c5 100644
--- a/deps/v8/src/regexp/regexp-bytecode-generator.cc
+++ b/deps/v8/src/regexp/regexp-bytecode-generator.cc
@@ -182,7 +182,7 @@ void RegExpBytecodeGenerator::LoadCurrentCharacterImpl(int cp_offset,
                                                        int eats_at_least) {
   DCHECK_GE(eats_at_least, characters);
   if (eats_at_least > characters && check_bounds) {
-    DCHECK(is_uint24(cp_offset + eats_at_least));
+    DCHECK(is_int24(cp_offset + eats_at_least));
     Emit(BC_CHECK_CURRENT_POSITION, cp_offset + eats_at_least);
     EmitOrLink(on_failure);
     check_bounds = false;  // Load below doesn't need to check.
diff --git a/deps/v8/src/regexp/regexp-bytecode-generator.h b/deps/v8/src/regexp/regexp-bytecode-generator.h
index 85073cc99db..fdb9b468619 100644
--- a/deps/v8/src/regexp/regexp-bytecode-generator.h
+++ b/deps/v8/src/regexp/regexp-bytecode-generator.h
@@ -22,61 +22,60 @@ class V8_EXPORT_PRIVATE RegExpBytecodeGenerator : public RegExpMacroAssembler {
   // determines the initial buffer size. The buffer is owned by the assembler
   // and deallocated upon destruction of the assembler.
   RegExpBytecodeGenerator(Isolate* isolate, Zone* zone);
-  virtual ~RegExpBytecodeGenerator();
+  ~RegExpBytecodeGenerator() override;
   // The byte-code interpreter checks on each push anyway.
-  virtual int stack_limit_slack() { return 1; }
-  virtual bool CanReadUnaligned() { return false; }
-  virtual void Bind(Label* label);
-  virtual void AdvanceCurrentPosition(int by);  // Signed cp change.
-  virtual void PopCurrentPosition();
-  virtual void PushCurrentPosition();
-  virtual void Backtrack();
-  virtual void GoTo(Label* label);
-  virtual void PushBacktrack(Label* label);
-  virtual bool Succeed();
-  virtual void Fail();
-  virtual void PopRegister(int register_index);
-  virtual void PushRegister(int register_index,
-                            StackCheckFlag check_stack_limit);
-  virtual void AdvanceRegister(int reg, int by);  // r[reg] += by.
-  virtual void SetCurrentPositionFromEnd(int by);
-  virtual void SetRegister(int register_index, int to);
-  virtual void WriteCurrentPositionToRegister(int reg, int cp_offset);
-  virtual void ClearRegisters(int reg_from, int reg_to);
-  virtual void ReadCurrentPositionFromRegister(int reg);
-  virtual void WriteStackPointerToRegister(int reg);
-  virtual void ReadStackPointerFromRegister(int reg);
-  virtual void LoadCurrentCharacterImpl(int cp_offset, Label* on_end_of_input,
-                                        bool check_bounds, int characters,
-                                        int eats_at_least);
-  virtual void CheckCharacter(unsigned c, Label* on_equal);
-  virtual void CheckCharacterAfterAnd(unsigned c, unsigned mask,
-                                      Label* on_equal);
-  virtual void CheckCharacterGT(uc16 limit, Label* on_greater);
-  virtual void CheckCharacterLT(uc16 limit, Label* on_less);
-  virtual void CheckGreedyLoop(Label* on_tos_equals_current_position);
-  virtual void CheckAtStart(int cp_offset, Label* on_at_start);
-  virtual void CheckNotAtStart(int cp_offset, Label* on_not_at_start);
-  virtual void CheckNotCharacter(unsigned c, Label* on_not_equal);
-  virtual void CheckNotCharacterAfterAnd(unsigned c, unsigned mask,
-                                         Label* on_not_equal);
-  virtual void CheckNotCharacterAfterMinusAnd(uc16 c, uc16 minus, uc16 mask,
-                                              Label* on_not_equal);
-  virtual void CheckCharacterInRange(uc16 from, uc16 to, Label* on_in_range);
-  virtual void CheckCharacterNotInRange(uc16 from, uc16 to,
-                                        Label* on_not_in_range);
-  virtual void CheckBitInTable(Handle<ByteArray> table, Label* on_bit_set);
-  virtual void CheckNotBackReference(int start_reg, bool read_backward,
-                                     Label* on_no_match);
-  virtual void CheckNotBackReferenceIgnoreCase(int start_reg,
-                                               bool read_backward,
-                                               Label* on_no_match);
-  virtual void IfRegisterLT(int register_index, int comparand, Label* if_lt);
-  virtual void IfRegisterGE(int register_index, int comparand, Label* if_ge);
-  virtual void IfRegisterEqPos(int register_index, Label* if_eq);
+  int stack_limit_slack() override { return 1; }
+  bool CanReadUnaligned() override { return false; }
+  void Bind(Label* label) override;
+  void AdvanceCurrentPosition(int by) override;  // Signed cp change.
+  void PopCurrentPosition() override;
+  void PushCurrentPosition() override;
+  void Backtrack() override;
+  void GoTo(Label* label) override;
+  void PushBacktrack(Label* label) override;
+  bool Succeed() override;
+  void Fail() override;
+  void PopRegister(int register_index) override;
+  void PushRegister(int register_index,
+                    StackCheckFlag check_stack_limit) override;
+  void AdvanceRegister(int reg, int by) override;  // r[reg] += by.
+  void SetCurrentPositionFromEnd(int by) override;
+  void SetRegister(int register_index, int to) override;
+  void WriteCurrentPositionToRegister(int reg, int cp_offset) override;
+  void ClearRegisters(int reg_from, int reg_to) override;
+  void ReadCurrentPositionFromRegister(int reg) override;
+  void WriteStackPointerToRegister(int reg) override;
+  void ReadStackPointerFromRegister(int reg) override;
+  void LoadCurrentCharacterImpl(int cp_offset, Label* on_end_of_input,
+                                bool check_bounds, int characters,
+                                int eats_at_least) override;
+  void CheckCharacter(unsigned c, Label* on_equal) override;
+  void CheckCharacterAfterAnd(unsigned c, unsigned mask,
+                              Label* on_equal) override;
+  void CheckCharacterGT(uc16 limit, Label* on_greater) override;
+  void CheckCharacterLT(uc16 limit, Label* on_less) override;
+  void CheckGreedyLoop(Label* on_tos_equals_current_position) override;
+  void CheckAtStart(int cp_offset, Label* on_at_start) override;
+  void CheckNotAtStart(int cp_offset, Label* on_not_at_start) override;
+  void CheckNotCharacter(unsigned c, Label* on_not_equal) override;
+  void CheckNotCharacterAfterAnd(unsigned c, unsigned mask,
+                                 Label* on_not_equal) override;
+  void CheckNotCharacterAfterMinusAnd(uc16 c, uc16 minus, uc16 mask,
+                                      Label* on_not_equal) override;
+  void CheckCharacterInRange(uc16 from, uc16 to, Label* on_in_range) override;
+  void CheckCharacterNotInRange(uc16 from, uc16 to,
+                                Label* on_not_in_range) override;
+  void CheckBitInTable(Handle<ByteArray> table, Label* on_bit_set) override;
+  void CheckNotBackReference(int start_reg, bool read_backward,
+                             Label* on_no_match) override;
+  void CheckNotBackReferenceIgnoreCase(int start_reg, bool read_backward,
+                                       Label* on_no_match) override;
+  void IfRegisterLT(int register_index, int comparand, Label* if_lt) override;
+  void IfRegisterGE(int register_index, int comparand, Label* if_ge) override;
+  void IfRegisterEqPos(int register_index, Label* if_eq) override;
 
-  virtual IrregexpImplementation Implementation();
-  virtual Handle<HeapObject> GetCode(Handle<String> source);
+  IrregexpImplementation Implementation() override;
+  Handle<HeapObject> GetCode(Handle<String> source) override;
 
  private:
   void Expand();
diff --git a/deps/v8/src/regexp/regexp-bytecodes.h b/deps/v8/src/regexp/regexp-bytecodes.h
index 1664a476d29..1d04531eec6 100644
--- a/deps/v8/src/regexp/regexp-bytecodes.h
+++ b/deps/v8/src/regexp/regexp-bytecodes.h
@@ -27,6 +27,7 @@ STATIC_ASSERT(1 << BYTECODE_SHIFT > BYTECODE_MASK);
 
 // TODO(pthier): Argument offsets of bytecodes should be easily accessible by
 // name or at least by position.
+// TODO(jgruber): More precise types (e.g. int32/uint32 instead of value32).
 #define BYTECODE_ITERATOR(V)                                                   \
   V(BREAK, 0, 4)              /* bc8                                        */ \
   V(PUSH_CP, 1, 4)            /* bc8 pad24                                  */ \
diff --git a/deps/v8/src/regexp/regexp-compiler-tonode.cc b/deps/v8/src/regexp/regexp-compiler-tonode.cc
index 40ecee0f915..9496de83e10 100644
--- a/deps/v8/src/regexp/regexp-compiler-tonode.cc
+++ b/deps/v8/src/regexp/regexp-compiler-tonode.cc
@@ -439,6 +439,8 @@ RegExpNode* RegExpCharacterClass::ToNode(RegExpCompiler* compiler,
       AddNonBmpSurrogatePairs(compiler, result, on_success, &splitter);
       AddLoneLeadSurrogates(compiler, result, on_success, &splitter);
       AddLoneTrailSurrogates(compiler, result, on_success, &splitter);
+      static constexpr int kMaxRangesToInline = 32;  // Arbitrary.
+      if (ranges->length() > kMaxRangesToInline) result->SetDoNotInline();
       return result;
     }
   } else {
diff --git a/deps/v8/src/regexp/regexp-compiler.cc b/deps/v8/src/regexp/regexp-compiler.cc
index a6c7cdbe2fb..a04180fd346 100644
--- a/deps/v8/src/regexp/regexp-compiler.cc
+++ b/deps/v8/src/regexp/regexp-compiler.cc
@@ -223,7 +223,7 @@ class RecursionCheck {
 // a fixed array or a null handle depending on whether it succeeded.
 RegExpCompiler::RegExpCompiler(Isolate* isolate, Zone* zone, int capture_count,
                                bool one_byte)
-    : next_register_(2 * (capture_count + 1)),
+    : next_register_(JSRegExp::RegistersForCaptureCount(capture_count)),
       unicode_lookaround_stack_register_(kNoRegister),
       unicode_lookaround_position_register_(kNoRegister),
       work_list_(nullptr),
@@ -269,7 +269,7 @@ RegExpCompiler::CompilationResult RegExpCompiler::Assemble(
   isolate->IncreaseTotalRegexpCodeGenerated(code);
   work_list_ = nullptr;
 
-  return {*code, next_register_};
+  return {code, next_register_};
 }
 
 bool Trace::DeferredAction::Mentions(int that) {
@@ -3804,26 +3804,24 @@ void TextNode::FillInBMInfo(Isolate* isolate, int initial_offset, int budget,
   if (initial_offset == 0) set_bm_info(not_at_start, bm);
 }
 
-// static
 RegExpNode* RegExpCompiler::OptionallyStepBackToLeadSurrogate(
-    RegExpCompiler* compiler, RegExpNode* on_success, JSRegExp::Flags flags) {
-  DCHECK(!compiler->read_backward());
-  Zone* zone = compiler->zone();
+    RegExpNode* on_success, JSRegExp::Flags flags) {
+  DCHECK(!read_backward());
   ZoneList<CharacterRange>* lead_surrogates = CharacterRange::List(
-      zone, CharacterRange::Range(kLeadSurrogateStart, kLeadSurrogateEnd));
+      zone(), CharacterRange::Range(kLeadSurrogateStart, kLeadSurrogateEnd));
   ZoneList<CharacterRange>* trail_surrogates = CharacterRange::List(
-      zone, CharacterRange::Range(kTrailSurrogateStart, kTrailSurrogateEnd));
+      zone(), CharacterRange::Range(kTrailSurrogateStart, kTrailSurrogateEnd));
 
-  ChoiceNode* optional_step_back = new (zone) ChoiceNode(2, zone);
+  ChoiceNode* optional_step_back = new (zone()) ChoiceNode(2, zone());
 
-  int stack_register = compiler->UnicodeLookaroundStackRegister();
-  int position_register = compiler->UnicodeLookaroundPositionRegister();
+  int stack_register = UnicodeLookaroundStackRegister();
+  int position_register = UnicodeLookaroundPositionRegister();
   RegExpNode* step_back = TextNode::CreateForCharacterRanges(
-      zone, lead_surrogates, true, on_success, flags);
+      zone(), lead_surrogates, true, on_success, flags);
   RegExpLookaround::Builder builder(true, step_back, stack_register,
                                     position_register);
   RegExpNode* match_trail = TextNode::CreateForCharacterRanges(
-      zone, trail_surrogates, false, builder.on_match_success(), flags);
+      zone(), trail_surrogates, false, builder.on_match_success(), flags);
 
   optional_step_back->AddAlternative(
       GuardedAlternative(builder.ForMatch(match_trail)));
@@ -3832,5 +3830,49 @@ RegExpNode* RegExpCompiler::OptionallyStepBackToLeadSurrogate(
   return optional_step_back;
 }
 
+RegExpNode* RegExpCompiler::PreprocessRegExp(RegExpCompileData* data,
+                                             JSRegExp::Flags flags,
+                                             bool is_one_byte) {
+  // Wrap the body of the regexp in capture #0.
+  RegExpNode* captured_body =
+      RegExpCapture::ToNode(data->tree, 0, this, accept());
+  RegExpNode* node = captured_body;
+  if (!data->tree->IsAnchoredAtStart() && !IsSticky(flags)) {
+    // Add a .*? at the beginning, outside the body capture, unless
+    // this expression is anchored at the beginning or sticky.
+    JSRegExp::Flags default_flags = JSRegExp::Flags();
+    RegExpNode* loop_node = RegExpQuantifier::ToNode(
+        0, RegExpTree::kInfinity, false,
+        new (zone()) RegExpCharacterClass('*', default_flags), this,
+        captured_body, data->contains_anchor);
+
+    if (data->contains_anchor) {
+      // Unroll loop once, to take care of the case that might start
+      // at the start of input.
+      ChoiceNode* first_step_node = new (zone()) ChoiceNode(2, zone());
+      first_step_node->AddAlternative(GuardedAlternative(captured_body));
+      first_step_node->AddAlternative(GuardedAlternative(new (zone()) TextNode(
+          new (zone()) RegExpCharacterClass('*', default_flags), false,
+          loop_node)));
+      node = first_step_node;
+    } else {
+      node = loop_node;
+    }
+  }
+  if (is_one_byte) {
+    node = node->FilterOneByte(RegExpCompiler::kMaxRecursion);
+    // Do it again to propagate the new nodes to places where they were not
+    // put because they had not been calculated yet.
+    if (node != nullptr) {
+      node = node->FilterOneByte(RegExpCompiler::kMaxRecursion);
+    }
+  } else if (IsUnicode(flags) && (IsGlobal(flags) || IsSticky(flags))) {
+    node = OptionallyStepBackToLeadSurrogate(node, flags);
+  }
+
+  if (node == nullptr) node = new (zone()) EndNode(EndNode::BACKTRACK, zone());
+  return node;
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/regexp/regexp-compiler.h b/deps/v8/src/regexp/regexp-compiler.h
index d083d5d9dd9..a35ffcd01a2 100644
--- a/deps/v8/src/regexp/regexp-compiler.h
+++ b/deps/v8/src/regexp/regexp-compiler.h
@@ -501,7 +501,7 @@ class RegExpCompiler {
 
   struct CompilationResult final {
     explicit CompilationResult(RegExpError err) : error(err) {}
-    CompilationResult(Object code, int registers)
+    CompilationResult(Handle<Object> code, int registers)
         : code(code), num_registers(registers) {}
 
     static CompilationResult RegExpTooBig() {
@@ -511,7 +511,7 @@ class RegExpCompiler {
     bool Succeeded() const { return error == RegExpError::kNone; }
 
     const RegExpError error = RegExpError::kNone;
-    Object code;
+    Handle<Object> code;
     int num_registers = 0;
   };
 
@@ -519,11 +519,19 @@ class RegExpCompiler {
                              RegExpNode* start, int capture_count,
                              Handle<String> pattern);
 
+  // Preprocessing is the final step of node creation before analysis
+  // and assembly. It includes:
+  // - Wrapping the body of the regexp in capture 0.
+  // - Inserting the implicit .* before/after the regexp if necessary.
+  // - If the input is a one-byte string, filtering out nodes that can't match.
+  // - Fixing up regexp matches that start within a surrogate pair.
+  RegExpNode* PreprocessRegExp(RegExpCompileData* data, JSRegExp::Flags flags,
+                               bool is_one_byte);
+
   // If the regexp matching starts within a surrogate pair, step back to the
   // lead surrogate and start matching from there.
-  static RegExpNode* OptionallyStepBackToLeadSurrogate(RegExpCompiler* compiler,
-                                                       RegExpNode* on_success,
-                                                       JSRegExp::Flags flags);
+  RegExpNode* OptionallyStepBackToLeadSurrogate(RegExpNode* on_success,
+                                                JSRegExp::Flags flags);
 
   inline void AddWork(RegExpNode* node) {
     if (!node->on_work_list() && !node->label()->is_bound()) {
diff --git a/deps/v8/src/regexp/regexp-interpreter.cc b/deps/v8/src/regexp/regexp-interpreter.cc
index d3efa65bf12..a2305eaee80 100644
--- a/deps/v8/src/regexp/regexp-interpreter.cc
+++ b/deps/v8/src/regexp/regexp-interpreter.cc
@@ -100,6 +100,18 @@ int32_t Load16AlignedSigned(const byte* pc) {
   return *reinterpret_cast<const int16_t*>(pc);
 }
 
+// Helpers to access the packed argument. Takes the 32 bits containing the
+// current bytecode, where the 8 LSB contain the bytecode and the rest contains
+// a packed 24-bit argument.
+// TODO(jgruber): Specify signed-ness in bytecode signature declarations, and
+// police restrictions during bytecode generation.
+int32_t LoadPacked24Signed(int32_t bytecode_and_packed_arg) {
+  return bytecode_and_packed_arg >> BYTECODE_SHIFT;
+}
+uint32_t LoadPacked24Unsigned(int32_t bytecode_and_packed_arg) {
+  return static_cast<uint32_t>(bytecode_and_packed_arg) >> BYTECODE_SHIFT;
+}
+
 // A simple abstraction over the backtracking stack used by the interpreter.
 //
 // Despite the name 'backtracking' stack, it's actually used as a generic stack
@@ -144,6 +156,48 @@ class BacktrackStack {
   DISALLOW_COPY_AND_ASSIGN(BacktrackStack);
 };
 
+// Registers used during interpreter execution. These consist of output
+// registers in indices [0, output_register_count[ which will contain matcher
+// results as a {start,end} index tuple for each capture (where the whole match
+// counts as implicit capture 0); and internal registers in indices
+// [output_register_count, total_register_count[.
+class InterpreterRegisters {
+ public:
+  using RegisterT = int;
+
+  InterpreterRegisters(int total_register_count, RegisterT* output_registers,
+                       int output_register_count)
+      : registers_(total_register_count),
+        output_registers_(output_registers),
+        output_register_count_(output_register_count) {
+    // TODO(jgruber): Use int32_t consistently for registers. Currently, CSA
+    // uses int32_t while runtime uses int.
+    STATIC_ASSERT(sizeof(int) == sizeof(int32_t));
+    DCHECK_GE(output_register_count, 2);  // At least 2 for the match itself.
+    DCHECK_GE(total_register_count, output_register_count);
+    DCHECK_LE(total_register_count, RegExpMacroAssembler::kMaxRegisterCount);
+    DCHECK_NOT_NULL(output_registers);
+
+    // Initialize the output register region to -1 signifying 'no match'.
+    std::memset(registers_.data(), -1,
+                output_register_count * sizeof(RegisterT));
+  }
+
+  const RegisterT& operator[](size_t index) const { return registers_[index]; }
+  RegisterT& operator[](size_t index) { return registers_[index]; }
+
+  void CopyToOutputRegisters() {
+    MemCopy(output_registers_, registers_.data(),
+            output_register_count_ * sizeof(RegisterT));
+  }
+
+ private:
+  static constexpr int kStaticCapacity = 64;  // Arbitrary.
+  base::SmallVector<RegisterT, kStaticCapacity> registers_;
+  RegisterT* const output_registers_;
+  const int output_register_count_;
+};
+
 IrregexpInterpreter::Result ThrowStackOverflow(Isolate* isolate,
                                                RegExp::CallOrigin call_origin) {
   CHECK(call_origin == RegExp::CallOrigin::kFromRuntime);
@@ -254,6 +308,12 @@ bool CheckBitInTable(const uint32_t current_char, const byte* const table) {
   return (b & (1 << bit)) != 0;
 }
 
+// Returns true iff 0 <= index < length.
+bool IndexIsInBounds(int index, int length) {
+  DCHECK_GE(length, 0);
+  return static_cast<uintptr_t>(index) < static_cast<uintptr_t>(length);
+}
+
 // If computed gotos are supported by the compiler, we can get addresses to
 // labels directly in C/C++. Every bytecode handler has its own label and we
 // store the addresses in a dispatch table indexed by bytecode. To execute the
@@ -295,6 +355,14 @@ bool CheckBitInTable(const uint32_t current_char, const byte* const table) {
   next_pc = code_base + offset;    \
   DECODE()
 
+// Current position mutations.
+#define SET_CURRENT_POSITION(value)                        \
+  do {                                                     \
+    current = (value);                                     \
+    DCHECK(base::IsInRange(current, 0, subject.length())); \
+  } while (false)
+#define ADVANCE_CURRENT_POSITION(by) SET_CURRENT_POSITION(current + (by))
+
 #ifdef DEBUG
 #define BYTECODE(name)                                                \
   BC_LABEL(name)                                                      \
@@ -305,12 +373,12 @@ bool CheckBitInTable(const uint32_t current_char, const byte* const table) {
 #endif  // DEBUG
 
 template <typename Char>
-IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
-                                     String subject_string,
-                                     Vector<const Char> subject, int* registers,
-                                     int current, uint32_t current_char,
-                                     RegExp::CallOrigin call_origin,
-                                     const uint32_t backtrack_limit) {
+IrregexpInterpreter::Result RawMatch(
+    Isolate* isolate, ByteArray code_array, String subject_string,
+    Vector<const Char> subject, int* output_registers,
+    int output_register_count, int total_register_count, int current,
+    uint32_t current_char, RegExp::CallOrigin call_origin,
+    const uint32_t backtrack_limit) {
   DisallowHeapAllocation no_gc;
 
 #if V8_USE_COMPUTED_GOTO
@@ -364,6 +432,8 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
   const byte* pc = code_array.GetDataStartAddress();
   const byte* code_base = pc;
 
+  InterpreterRegisters registers(total_register_count, output_registers,
+                                 output_register_count);
   BacktrackStack backtrack_stack;
 
   uint32_t backtrack_count = 0;
@@ -403,44 +473,44 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
     }
     BYTECODE(PUSH_REGISTER) {
       ADVANCE(PUSH_REGISTER);
-      if (!backtrack_stack.push(registers[insn >> BYTECODE_SHIFT])) {
+      if (!backtrack_stack.push(registers[LoadPacked24Unsigned(insn)])) {
         return MaybeThrowStackOverflow(isolate, call_origin);
       }
       DISPATCH();
     }
     BYTECODE(SET_REGISTER) {
       ADVANCE(SET_REGISTER);
-      registers[insn >> BYTECODE_SHIFT] = Load32Aligned(pc + 4);
+      registers[LoadPacked24Unsigned(insn)] = Load32Aligned(pc + 4);
       DISPATCH();
     }
     BYTECODE(ADVANCE_REGISTER) {
       ADVANCE(ADVANCE_REGISTER);
-      registers[insn >> BYTECODE_SHIFT] += Load32Aligned(pc + 4);
+      registers[LoadPacked24Unsigned(insn)] += Load32Aligned(pc + 4);
       DISPATCH();
     }
     BYTECODE(SET_REGISTER_TO_CP) {
       ADVANCE(SET_REGISTER_TO_CP);
-      registers[insn >> BYTECODE_SHIFT] = current + Load32Aligned(pc + 4);
+      registers[LoadPacked24Unsigned(insn)] = current + Load32Aligned(pc + 4);
       DISPATCH();
     }
     BYTECODE(SET_CP_TO_REGISTER) {
       ADVANCE(SET_CP_TO_REGISTER);
-      current = registers[insn >> BYTECODE_SHIFT];
+      SET_CURRENT_POSITION(registers[LoadPacked24Unsigned(insn)]);
       DISPATCH();
     }
     BYTECODE(SET_REGISTER_TO_SP) {
       ADVANCE(SET_REGISTER_TO_SP);
-      registers[insn >> BYTECODE_SHIFT] = backtrack_stack.sp();
+      registers[LoadPacked24Unsigned(insn)] = backtrack_stack.sp();
       DISPATCH();
     }
     BYTECODE(SET_SP_TO_REGISTER) {
       ADVANCE(SET_SP_TO_REGISTER);
-      backtrack_stack.set_sp(registers[insn >> BYTECODE_SHIFT]);
+      backtrack_stack.set_sp(registers[LoadPacked24Unsigned(insn)]);
       DISPATCH();
     }
     BYTECODE(POP_CP) {
       ADVANCE(POP_CP);
-      current = backtrack_stack.pop();
+      SET_CURRENT_POSITION(backtrack_stack.pop());
       DISPATCH();
     }
     BYTECODE(POP_BT) {
@@ -460,7 +530,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
     }
     BYTECODE(POP_REGISTER) {
       ADVANCE(POP_REGISTER);
-      registers[insn >> BYTECODE_SHIFT] = backtrack_stack.pop();
+      registers[LoadPacked24Unsigned(insn)] = backtrack_stack.pop();
       DISPATCH();
     }
     BYTECODE(FAIL) {
@@ -471,11 +541,12 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
     BYTECODE(SUCCEED) {
       isolate->counters()->regexp_backtracks()->AddSample(
           static_cast<int>(backtrack_count));
+      registers.CopyToOutputRegisters();
       return IrregexpInterpreter::SUCCESS;
     }
     BYTECODE(ADVANCE_CP) {
       ADVANCE(ADVANCE_CP);
-      current += insn >> BYTECODE_SHIFT;
+      ADVANCE_CURRENT_POSITION(LoadPacked24Signed(insn));
       DISPATCH();
     }
     BYTECODE(GOTO) {
@@ -484,7 +555,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
     }
     BYTECODE(ADVANCE_CP_AND_GOTO) {
       SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
-      current += insn >> BYTECODE_SHIFT;
+      ADVANCE_CURRENT_POSITION(LoadPacked24Signed(insn));
       DISPATCH();
     }
     BYTECODE(CHECK_GREEDY) {
@@ -497,7 +568,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(LOAD_CURRENT_CHAR) {
-      int pos = current + (insn >> BYTECODE_SHIFT);
+      int pos = current + LoadPacked24Signed(insn);
       if (pos >= subject.length() || pos < 0) {
         SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
       } else {
@@ -508,12 +579,12 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
     }
     BYTECODE(LOAD_CURRENT_CHAR_UNCHECKED) {
       ADVANCE(LOAD_CURRENT_CHAR_UNCHECKED);
-      int pos = current + (insn >> BYTECODE_SHIFT);
+      int pos = current + LoadPacked24Signed(insn);
       current_char = subject[pos];
       DISPATCH();
     }
     BYTECODE(LOAD_2_CURRENT_CHARS) {
-      int pos = current + (insn >> BYTECODE_SHIFT);
+      int pos = current + LoadPacked24Signed(insn);
       if (pos + 2 > subject.length() || pos < 0) {
         SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
       } else {
@@ -525,14 +596,14 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
     }
     BYTECODE(LOAD_2_CURRENT_CHARS_UNCHECKED) {
       ADVANCE(LOAD_2_CURRENT_CHARS_UNCHECKED);
-      int pos = current + (insn >> BYTECODE_SHIFT);
+      int pos = current + LoadPacked24Signed(insn);
       Char next = subject[pos + 1];
       current_char = (subject[pos] | (next << (kBitsPerByte * sizeof(Char))));
       DISPATCH();
     }
     BYTECODE(LOAD_4_CURRENT_CHARS) {
       DCHECK_EQ(1, sizeof(Char));
-      int pos = current + (insn >> BYTECODE_SHIFT);
+      int pos = current + LoadPacked24Signed(insn);
       if (pos + 4 > subject.length() || pos < 0) {
         SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
       } else {
@@ -548,7 +619,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
     BYTECODE(LOAD_4_CURRENT_CHARS_UNCHECKED) {
       ADVANCE(LOAD_4_CURRENT_CHARS_UNCHECKED);
       DCHECK_EQ(1, sizeof(Char));
-      int pos = current + (insn >> BYTECODE_SHIFT);
+      int pos = current + LoadPacked24Signed(insn);
       Char next1 = subject[pos + 1];
       Char next2 = subject[pos + 2];
       Char next3 = subject[pos + 3];
@@ -566,7 +637,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(CHECK_CHAR) {
-      uint32_t c = (insn >> BYTECODE_SHIFT);
+      uint32_t c = LoadPacked24Unsigned(insn);
       if (c == current_char) {
         SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
       } else {
@@ -584,7 +655,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(CHECK_NOT_CHAR) {
-      uint32_t c = (insn >> BYTECODE_SHIFT);
+      uint32_t c = LoadPacked24Unsigned(insn);
       if (c != current_char) {
         SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
       } else {
@@ -602,7 +673,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(AND_CHECK_CHAR) {
-      uint32_t c = (insn >> BYTECODE_SHIFT);
+      uint32_t c = LoadPacked24Unsigned(insn);
       if (c == (current_char & Load32Aligned(pc + 4))) {
         SET_PC_FROM_OFFSET(Load32Aligned(pc + 8));
       } else {
@@ -620,7 +691,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(AND_CHECK_NOT_CHAR) {
-      uint32_t c = (insn >> BYTECODE_SHIFT);
+      uint32_t c = LoadPacked24Unsigned(insn);
       if (c != (current_char & Load32Aligned(pc + 4))) {
         SET_PC_FROM_OFFSET(Load32Aligned(pc + 8));
       } else {
@@ -629,7 +700,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(MINUS_AND_CHECK_NOT_CHAR) {
-      uint32_t c = (insn >> BYTECODE_SHIFT);
+      uint32_t c = LoadPacked24Unsigned(insn);
       uint32_t minus = Load16Aligned(pc + 4);
       uint32_t mask = Load16Aligned(pc + 6);
       if (c != ((current_char - minus) & mask)) {
@@ -668,7 +739,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(CHECK_LT) {
-      uint32_t limit = (insn >> BYTECODE_SHIFT);
+      uint32_t limit = LoadPacked24Unsigned(insn);
       if (current_char < limit) {
         SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
       } else {
@@ -677,7 +748,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(CHECK_GT) {
-      uint32_t limit = (insn >> BYTECODE_SHIFT);
+      uint32_t limit = LoadPacked24Unsigned(insn);
       if (current_char > limit) {
         SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
       } else {
@@ -686,7 +757,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(CHECK_REGISTER_LT) {
-      if (registers[insn >> BYTECODE_SHIFT] < Load32Aligned(pc + 4)) {
+      if (registers[LoadPacked24Unsigned(insn)] < Load32Aligned(pc + 4)) {
         SET_PC_FROM_OFFSET(Load32Aligned(pc + 8));
       } else {
         ADVANCE(CHECK_REGISTER_LT);
@@ -694,7 +765,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(CHECK_REGISTER_GE) {
-      if (registers[insn >> BYTECODE_SHIFT] >= Load32Aligned(pc + 4)) {
+      if (registers[LoadPacked24Unsigned(insn)] >= Load32Aligned(pc + 4)) {
         SET_PC_FROM_OFFSET(Load32Aligned(pc + 8));
       } else {
         ADVANCE(CHECK_REGISTER_GE);
@@ -702,7 +773,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(CHECK_REGISTER_EQ_POS) {
-      if (registers[insn >> BYTECODE_SHIFT] == current) {
+      if (registers[LoadPacked24Unsigned(insn)] == current) {
         SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
       } else {
         ADVANCE(CHECK_REGISTER_EQ_POS);
@@ -710,7 +781,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(CHECK_NOT_REGS_EQUAL) {
-      if (registers[insn >> BYTECODE_SHIFT] ==
+      if (registers[LoadPacked24Unsigned(insn)] ==
           registers[Load32Aligned(pc + 4)]) {
         ADVANCE(CHECK_NOT_REGS_EQUAL);
       } else {
@@ -719,29 +790,29 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(CHECK_NOT_BACK_REF) {
-      int from = registers[insn >> BYTECODE_SHIFT];
-      int len = registers[(insn >> BYTECODE_SHIFT) + 1] - from;
+      int from = registers[LoadPacked24Unsigned(insn)];
+      int len = registers[LoadPacked24Unsigned(insn) + 1] - from;
       if (from >= 0 && len > 0) {
         if (current + len > subject.length() ||
             CompareChars(&subject[from], &subject[current], len) != 0) {
           SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
           DISPATCH();
         }
-        current += len;
+        ADVANCE_CURRENT_POSITION(len);
       }
       ADVANCE(CHECK_NOT_BACK_REF);
       DISPATCH();
     }
     BYTECODE(CHECK_NOT_BACK_REF_BACKWARD) {
-      int from = registers[insn >> BYTECODE_SHIFT];
-      int len = registers[(insn >> BYTECODE_SHIFT) + 1] - from;
+      int from = registers[LoadPacked24Unsigned(insn)];
+      int len = registers[LoadPacked24Unsigned(insn) + 1] - from;
       if (from >= 0 && len > 0) {
         if (current - len < 0 ||
             CompareChars(&subject[from], &subject[current - len], len) != 0) {
           SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
           DISPATCH();
         }
-        current -= len;
+        SET_CURRENT_POSITION(current - len);
       }
       ADVANCE(CHECK_NOT_BACK_REF_BACKWARD);
       DISPATCH();
@@ -750,15 +821,15 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       UNREACHABLE();  // TODO(jgruber): Remove this unused bytecode.
     }
     BYTECODE(CHECK_NOT_BACK_REF_NO_CASE) {
-      int from = registers[insn >> BYTECODE_SHIFT];
-      int len = registers[(insn >> BYTECODE_SHIFT) + 1] - from;
+      int from = registers[LoadPacked24Unsigned(insn)];
+      int len = registers[LoadPacked24Unsigned(insn) + 1] - from;
       if (from >= 0 && len > 0) {
         if (current + len > subject.length() ||
             !BackRefMatchesNoCase(isolate, from, current, len, subject)) {
           SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
           DISPATCH();
         }
-        current += len;
+        ADVANCE_CURRENT_POSITION(len);
       }
       ADVANCE(CHECK_NOT_BACK_REF_NO_CASE);
       DISPATCH();
@@ -767,21 +838,21 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       UNREACHABLE();  // TODO(jgruber): Remove this unused bytecode.
     }
     BYTECODE(CHECK_NOT_BACK_REF_NO_CASE_BACKWARD) {
-      int from = registers[insn >> BYTECODE_SHIFT];
-      int len = registers[(insn >> BYTECODE_SHIFT) + 1] - from;
+      int from = registers[LoadPacked24Unsigned(insn)];
+      int len = registers[LoadPacked24Unsigned(insn) + 1] - from;
       if (from >= 0 && len > 0) {
         if (current - len < 0 ||
             !BackRefMatchesNoCase(isolate, from, current - len, len, subject)) {
           SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
           DISPATCH();
         }
-        current -= len;
+        SET_CURRENT_POSITION(current - len);
       }
       ADVANCE(CHECK_NOT_BACK_REF_NO_CASE_BACKWARD);
       DISPATCH();
     }
     BYTECODE(CHECK_AT_START) {
-      if (current + (insn >> BYTECODE_SHIFT) == 0) {
+      if (current + LoadPacked24Signed(insn) == 0) {
         SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
       } else {
         ADVANCE(CHECK_AT_START);
@@ -789,7 +860,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(CHECK_NOT_AT_START) {
-      if (current + (insn >> BYTECODE_SHIFT) == 0) {
+      if (current + LoadPacked24Signed(insn) == 0) {
         ADVANCE(CHECK_NOT_AT_START);
       } else {
         SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
@@ -798,15 +869,15 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
     }
     BYTECODE(SET_CURRENT_POSITION_FROM_END) {
       ADVANCE(SET_CURRENT_POSITION_FROM_END);
-      int by = static_cast<uint32_t>(insn) >> BYTECODE_SHIFT;
+      int by = LoadPacked24Unsigned(insn);
       if (subject.length() - current > by) {
-        current = subject.length() - by;
+        SET_CURRENT_POSITION(subject.length() - by);
         current_char = subject[current - 1];
       }
       DISPATCH();
     }
     BYTECODE(CHECK_CURRENT_POSITION) {
-      int pos = current + (insn >> BYTECODE_SHIFT);
+      int pos = current + LoadPacked24Signed(insn);
       if (pos > subject.length() || pos < 0) {
         SET_PC_FROM_OFFSET(Load32Aligned(pc + 4));
       } else {
@@ -815,23 +886,22 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
       DISPATCH();
     }
     BYTECODE(SKIP_UNTIL_CHAR) {
-      int load_offset = (insn >> BYTECODE_SHIFT);
+      int32_t load_offset = LoadPacked24Signed(insn);
       int32_t advance = Load16AlignedSigned(pc + 4);
       uint32_t c = Load16Aligned(pc + 6);
-      while (static_cast<uintptr_t>(current + load_offset) <
-             static_cast<uintptr_t>(subject.length())) {
+      while (IndexIsInBounds(current + load_offset, subject.length())) {
         current_char = subject[current + load_offset];
         if (c == current_char) {
           SET_PC_FROM_OFFSET(Load32Aligned(pc + 8));
           DISPATCH();
         }
-        current += advance;
+        ADVANCE_CURRENT_POSITION(advance);
       }
       SET_PC_FROM_OFFSET(Load32Aligned(pc + 12));
       DISPATCH();
     }
     BYTECODE(SKIP_UNTIL_CHAR_AND) {
-      int load_offset = (insn >> BYTECODE_SHIFT);
+      int32_t load_offset = LoadPacked24Signed(insn);
       int32_t advance = Load16AlignedSigned(pc + 4);
       uint16_t c = Load16Aligned(pc + 6);
       uint32_t mask = Load32Aligned(pc + 8);
@@ -843,13 +913,13 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
           SET_PC_FROM_OFFSET(Load32Aligned(pc + 16));
           DISPATCH();
         }
-        current += advance;
+        ADVANCE_CURRENT_POSITION(advance);
       }
       SET_PC_FROM_OFFSET(Load32Aligned(pc + 20));
       DISPATCH();
     }
     BYTECODE(SKIP_UNTIL_CHAR_POS_CHECKED) {
-      int load_offset = (insn >> BYTECODE_SHIFT);
+      int32_t load_offset = LoadPacked24Signed(insn);
       int32_t advance = Load16AlignedSigned(pc + 4);
       uint16_t c = Load16Aligned(pc + 6);
       int32_t maximum_offset = Load32Aligned(pc + 8);
@@ -860,34 +930,32 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
           SET_PC_FROM_OFFSET(Load32Aligned(pc + 12));
           DISPATCH();
         }
-        current += advance;
+        ADVANCE_CURRENT_POSITION(advance);
       }
       SET_PC_FROM_OFFSET(Load32Aligned(pc + 16));
       DISPATCH();
     }
     BYTECODE(SKIP_UNTIL_BIT_IN_TABLE) {
-      int load_offset = (insn >> BYTECODE_SHIFT);
+      int32_t load_offset = LoadPacked24Signed(insn);
       int32_t advance = Load16AlignedSigned(pc + 4);
       const byte* table = pc + 8;
-      while (static_cast<uintptr_t>(current + load_offset) <
-             static_cast<uintptr_t>(subject.length())) {
+      while (IndexIsInBounds(current + load_offset, subject.length())) {
         current_char = subject[current + load_offset];
         if (CheckBitInTable(current_char, table)) {
           SET_PC_FROM_OFFSET(Load32Aligned(pc + 24));
           DISPATCH();
         }
-        current += advance;
+        ADVANCE_CURRENT_POSITION(advance);
       }
       SET_PC_FROM_OFFSET(Load32Aligned(pc + 28));
       DISPATCH();
     }
     BYTECODE(SKIP_UNTIL_GT_OR_NOT_BIT_IN_TABLE) {
-      int load_offset = (insn >> BYTECODE_SHIFT);
+      int32_t load_offset = LoadPacked24Signed(insn);
       int32_t advance = Load16AlignedSigned(pc + 4);
       uint16_t limit = Load16Aligned(pc + 6);
       const byte* table = pc + 8;
-      while (static_cast<uintptr_t>(current + load_offset) <
-             static_cast<uintptr_t>(subject.length())) {
+      while (IndexIsInBounds(current + load_offset, subject.length())) {
         current_char = subject[current + load_offset];
         if (current_char > limit) {
           SET_PC_FROM_OFFSET(Load32Aligned(pc + 24));
@@ -897,18 +965,17 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
           SET_PC_FROM_OFFSET(Load32Aligned(pc + 24));
           DISPATCH();
         }
-        current += advance;
+        ADVANCE_CURRENT_POSITION(advance);
       }
       SET_PC_FROM_OFFSET(Load32Aligned(pc + 28));
       DISPATCH();
     }
     BYTECODE(SKIP_UNTIL_CHAR_OR_CHAR) {
-      int load_offset = (insn >> BYTECODE_SHIFT);
+      int32_t load_offset = LoadPacked24Signed(insn);
       int32_t advance = Load32Aligned(pc + 4);
       uint16_t c = Load16Aligned(pc + 8);
       uint16_t c2 = Load16Aligned(pc + 10);
-      while (static_cast<uintptr_t>(current + load_offset) <
-             static_cast<uintptr_t>(subject.length())) {
+      while (IndexIsInBounds(current + load_offset, subject.length())) {
         current_char = subject[current + load_offset];
         // The two if-statements below are split up intentionally, as combining
         // them seems to result in register allocation behaving quite
@@ -921,7 +988,7 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
           SET_PC_FROM_OFFSET(Load32Aligned(pc + 12));
           DISPATCH();
         }
-        current += advance;
+        ADVANCE_CURRENT_POSITION(advance);
       }
       SET_PC_FROM_OFFSET(Load32Aligned(pc + 16));
       DISPATCH();
@@ -941,6 +1008,8 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
 }
 
 #undef BYTECODE
+#undef ADVANCE_CURRENT_POSITION
+#undef SET_CURRENT_POSITION
 #undef DISPATCH
 #undef DECODE
 #undef SET_PC_FROM_OFFSET
@@ -952,24 +1021,25 @@ IrregexpInterpreter::Result RawMatch(Isolate* isolate, ByteArray code_array,
 
 // static
 IrregexpInterpreter::Result IrregexpInterpreter::Match(
-    Isolate* isolate, JSRegExp regexp, String subject_string, int* registers,
-    int registers_length, int start_position, RegExp::CallOrigin call_origin) {
-  if (FLAG_regexp_tier_up) {
-    regexp.TierUpTick();
-  }
+    Isolate* isolate, JSRegExp regexp, String subject_string,
+    int* output_registers, int output_register_count, int start_position,
+    RegExp::CallOrigin call_origin) {
+  if (FLAG_regexp_tier_up) regexp.TierUpTick();
 
   bool is_one_byte = String::IsOneByteRepresentationUnderneath(subject_string);
   ByteArray code_array = ByteArray::cast(regexp.Bytecode(is_one_byte));
+  int total_register_count = regexp.MaxRegisterCount();
 
-  return MatchInternal(isolate, code_array, subject_string, registers,
-                       registers_length, start_position, call_origin,
-                       regexp.BacktrackLimit());
+  return MatchInternal(isolate, code_array, subject_string, output_registers,
+                       output_register_count, total_register_count,
+                       start_position, call_origin, regexp.BacktrackLimit());
 }
 
 IrregexpInterpreter::Result IrregexpInterpreter::MatchInternal(
     Isolate* isolate, ByteArray code_array, String subject_string,
-    int* registers, int registers_length, int start_position,
-    RegExp::CallOrigin call_origin, uint32_t backtrack_limit) {
+    int* output_registers, int output_register_count, int total_register_count,
+    int start_position, RegExp::CallOrigin call_origin,
+    uint32_t backtrack_limit) {
   DCHECK(subject_string.IsFlat());
 
   // Note: Heap allocation *is* allowed in two situations if calling from
@@ -980,27 +1050,23 @@ IrregexpInterpreter::Result IrregexpInterpreter::MatchInternal(
   //    after interrupts have run.
   DisallowHeapAllocation no_gc;
 
-  // Reset registers to -1 (=undefined).
-  // This is necessary because registers are only written when a
-  // capture group matched.
-  // Resetting them ensures that previous matches are cleared.
-  memset(registers, -1, sizeof(registers[0]) * registers_length);
-
   uc16 previous_char = '\n';
   String::FlatContent subject_content = subject_string.GetFlatContent(no_gc);
   if (subject_content.IsOneByte()) {
     Vector<const uint8_t> subject_vector = subject_content.ToOneByteVector();
     if (start_position != 0) previous_char = subject_vector[start_position - 1];
     return RawMatch(isolate, code_array, subject_string, subject_vector,
-                    registers, start_position, previous_char, call_origin,
-                    backtrack_limit);
+                    output_registers, output_register_count,
+                    total_register_count, start_position, previous_char,
+                    call_origin, backtrack_limit);
   } else {
     DCHECK(subject_content.IsTwoByte());
     Vector<const uc16> subject_vector = subject_content.ToUC16Vector();
     if (start_position != 0) previous_char = subject_vector[start_position - 1];
     return RawMatch(isolate, code_array, subject_string, subject_vector,
-                    registers, start_position, previous_char, call_origin,
-                    backtrack_limit);
+                    output_registers, output_register_count,
+                    total_register_count, start_position, previous_char,
+                    call_origin, backtrack_limit);
   }
 }
 
@@ -1009,11 +1075,11 @@ IrregexpInterpreter::Result IrregexpInterpreter::MatchInternal(
 // This method is called through an external reference from RegExpExecInternal
 // builtin.
 IrregexpInterpreter::Result IrregexpInterpreter::MatchForCallFromJs(
-    Address subject, int32_t start_position, Address, Address, int* registers,
-    int32_t registers_length, Address, RegExp::CallOrigin call_origin,
-    Isolate* isolate, Address regexp) {
+    Address subject, int32_t start_position, Address, Address,
+    int* output_registers, int32_t output_register_count, Address,
+    RegExp::CallOrigin call_origin, Isolate* isolate, Address regexp) {
   DCHECK_NOT_NULL(isolate);
-  DCHECK_NOT_NULL(registers);
+  DCHECK_NOT_NULL(output_registers);
   DCHECK(call_origin == RegExp::CallOrigin::kFromJs);
 
   DisallowHeapAllocation no_gc;
@@ -1028,38 +1094,18 @@ IrregexpInterpreter::Result IrregexpInterpreter::MatchForCallFromJs(
     return IrregexpInterpreter::RETRY;
   }
 
-  // In generated code, registers are allocated on the stack. The given
-  // `registers` argument is only guaranteed to hold enough space for permanent
-  // registers (i.e. for captures), and not for temporary registers used only
-  // during matcher execution. We match that behavior in the interpreter by
-  // using a SmallVector as internal register storage.
-  static constexpr int kBaseRegisterArraySize = 64;  // Arbitrary.
-  const int internal_register_count =
-      Smi::ToInt(regexp_obj.DataAt(JSRegExp::kIrregexpMaxRegisterCountIndex));
-  base::SmallVector<int, kBaseRegisterArraySize> internal_registers(
-      internal_register_count);
-
-  Result result =
-      Match(isolate, regexp_obj, subject_string, internal_registers.data(),
-            internal_register_count, start_position, call_origin);
-
-  // Copy capture registers to the output array.
-  if (result == IrregexpInterpreter::SUCCESS) {
-    CHECK_GE(internal_registers.size(), registers_length);
-    MemCopy(registers, internal_registers.data(),
-            registers_length * sizeof(registers[0]));
-  }
-
-  return result;
+  return Match(isolate, regexp_obj, subject_string, output_registers,
+               output_register_count, start_position, call_origin);
 }
 
 #endif  // !COMPILING_IRREGEXP_FOR_EXTERNAL_EMBEDDER
 
 IrregexpInterpreter::Result IrregexpInterpreter::MatchForCallFromRuntime(
     Isolate* isolate, Handle<JSRegExp> regexp, Handle<String> subject_string,
-    int* registers, int registers_length, int start_position) {
-  return Match(isolate, *regexp, *subject_string, registers, registers_length,
-               start_position, RegExp::CallOrigin::kFromRuntime);
+    int* output_registers, int output_register_count, int start_position) {
+  return Match(isolate, *regexp, *subject_string, output_registers,
+               output_register_count, start_position,
+               RegExp::CallOrigin::kFromRuntime);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/regexp/regexp-interpreter.h b/deps/v8/src/regexp/regexp-interpreter.h
index d77b5db8968..be964764434 100644
--- a/deps/v8/src/regexp/regexp-interpreter.h
+++ b/deps/v8/src/regexp/regexp-interpreter.h
@@ -23,36 +23,42 @@ class V8_EXPORT_PRIVATE IrregexpInterpreter : public AllStatic {
 
   // In case a StackOverflow occurs, a StackOverflowException is created and
   // EXCEPTION is returned.
-  static Result MatchForCallFromRuntime(Isolate* isolate,
-                                        Handle<JSRegExp> regexp,
-                                        Handle<String> subject_string,
-                                        int* registers, int registers_length,
-                                        int start_position);
+  static Result MatchForCallFromRuntime(
+      Isolate* isolate, Handle<JSRegExp> regexp, Handle<String> subject_string,
+      int* output_registers, int output_register_count, int start_position);
 
   // In case a StackOverflow occurs, EXCEPTION is returned. The caller is
   // responsible for creating the exception.
+  //
   // RETRY is returned if a retry through the runtime is needed (e.g. when
   // interrupts have been scheduled or the regexp is marked for tier-up).
+  //
   // Arguments input_start, input_end and backtrack_stack are
   // unused. They are only passed to match the signature of the native irregex
   // code.
+  //
+  // Arguments output_registers and output_register_count describe the results
+  // array, which will contain register values of all captures if SUCCESS is
+  // returned. For all other return codes, the results array remains unmodified.
   static Result MatchForCallFromJs(Address subject, int32_t start_position,
                                    Address input_start, Address input_end,
-                                   int* registers, int32_t registers_length,
+                                   int* output_registers,
+                                   int32_t output_register_count,
                                    Address backtrack_stack,
                                    RegExp::CallOrigin call_origin,
                                    Isolate* isolate, Address regexp);
 
   static Result MatchInternal(Isolate* isolate, ByteArray code_array,
-                              String subject_string, int* registers,
-                              int registers_length, int start_position,
+                              String subject_string, int* output_registers,
+                              int output_register_count,
+                              int total_register_count, int start_position,
                               RegExp::CallOrigin call_origin,
                               uint32_t backtrack_limit);
 
  private:
   static Result Match(Isolate* isolate, JSRegExp regexp, String subject_string,
-                      int* registers, int registers_length, int start_position,
-                      RegExp::CallOrigin call_origin);
+                      int* output_registers, int output_register_count,
+                      int start_position, RegExp::CallOrigin call_origin);
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/regexp/regexp-macro-assembler.cc b/deps/v8/src/regexp/regexp-macro-assembler.cc
index 3ac1bb7f579..6cc9cae6e1d 100644
--- a/deps/v8/src/regexp/regexp-macro-assembler.cc
+++ b/deps/v8/src/regexp/regexp-macro-assembler.cc
@@ -111,6 +111,24 @@ NativeRegExpMacroAssembler::NativeRegExpMacroAssembler(Isolate* isolate,
 
 NativeRegExpMacroAssembler::~NativeRegExpMacroAssembler() = default;
 
+void NativeRegExpMacroAssembler::LoadCurrentCharacterImpl(
+    int cp_offset, Label* on_end_of_input, bool check_bounds, int characters,
+    int eats_at_least) {
+  // It's possible to preload a small number of characters when each success
+  // path requires a large number of characters, but not the reverse.
+  DCHECK_GE(eats_at_least, characters);
+
+  DCHECK(base::IsInRange(cp_offset, kMinCPOffset, kMaxCPOffset));
+  if (check_bounds) {
+    if (cp_offset >= 0) {
+      CheckPosition(cp_offset + eats_at_least - 1, on_end_of_input);
+    } else {
+      CheckPosition(cp_offset, on_end_of_input);
+    }
+  }
+  LoadCurrentCharacterUnchecked(cp_offset, characters);
+}
+
 bool NativeRegExpMacroAssembler::CanReadUnaligned() {
   return FLAG_enable_regexp_unaligned_accesses && !slow_safe();
 }
diff --git a/deps/v8/src/regexp/regexp-macro-assembler.h b/deps/v8/src/regexp/regexp-macro-assembler.h
index e83446cdc9b..289c2a979e6 100644
--- a/deps/v8/src/regexp/regexp-macro-assembler.h
+++ b/deps/v8/src/regexp/regexp-macro-assembler.h
@@ -28,13 +28,14 @@ struct DisjunctDecisionRow {
 class RegExpMacroAssembler {
  public:
   // The implementation must be able to handle at least:
-  static const int kMaxRegister = (1 << 16) - 1;
-  static const int kMaxCPOffset = (1 << 15) - 1;
-  static const int kMinCPOffset = -(1 << 15);
+  static constexpr int kMaxRegisterCount = (1 << 16);
+  static constexpr int kMaxRegister = kMaxRegisterCount - 1;
+  static constexpr int kMaxCPOffset = (1 << 15) - 1;
+  static constexpr int kMinCPOffset = -(1 << 15);
 
-  static const int kTableSizeBits = 7;
-  static const int kTableSize = 1 << kTableSizeBits;
-  static const int kTableMask = kTableSize - 1;
+  static constexpr int kTableSizeBits = 7;
+  static constexpr int kTableSize = 1 << kTableSizeBits;
+  static constexpr int kTableMask = kTableSize - 1;
 
   static constexpr int kUseCharactersValue = -1;
 
@@ -272,6 +273,13 @@ class NativeRegExpMacroAssembler: public RegExpMacroAssembler {
                                        const byte* input_end, int* output,
                                        int output_size, Isolate* isolate,
                                        JSRegExp regexp);
+  void LoadCurrentCharacterImpl(int cp_offset, Label* on_end_of_input,
+                                bool check_bounds, int characters,
+                                int eats_at_least) override;
+  // Load a number of characters at the given offset from the
+  // current position, into the current-character register.
+  virtual void LoadCurrentCharacterUnchecked(int cp_offset,
+                                             int character_count) = 0;
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/regexp/regexp-nodes.h b/deps/v8/src/regexp/regexp-nodes.h
index d618c9bb276..7863dbaa02a 100644
--- a/deps/v8/src/regexp/regexp-nodes.h
+++ b/deps/v8/src/regexp/regexp-nodes.h
@@ -237,6 +237,15 @@ class RegExpNode : public ZoneObject {
     eats_at_least_ = eats_at_least;
   }
 
+  // TODO(v8:10441): This is a hacky way to avoid exponential code size growth
+  // for very large choice nodes that can be generated by unicode property
+  // escapes. In order to avoid inlining (i.e. trace recursion), we pretend to
+  // have generated the maximum count of code copies already.
+  // We should instead fix this properly, e.g. by using the code size budget
+  // (flush_budget) or by generating property escape matches as calls to a C
+  // function.
+  void SetDoNotInline() { trace_count_ = kMaxCopiesCodeGenerated; }
+
   BoyerMooreLookahead* bm_info(bool not_at_start) {
     return bm_info_[not_at_start ? 1 : 0];
   }
diff --git a/deps/v8/src/regexp/regexp-parser.cc b/deps/v8/src/regexp/regexp-parser.cc
index 3c1115414fb..a052ade45d2 100644
--- a/deps/v8/src/regexp/regexp-parser.cc
+++ b/deps/v8/src/regexp/regexp-parser.cc
@@ -1789,34 +1789,54 @@ RegExpTree* RegExpParser::ParseCharacterClass(const RegExpBuilder* builder) {
 
 #undef CHECK_FAILED
 
-
-bool RegExpParser::ParseRegExp(Isolate* isolate, Zone* zone,
-                               FlatStringReader* input, JSRegExp::Flags flags,
-                               RegExpCompileData* result) {
+bool RegExpParser::Parse(RegExpCompileData* result,
+                         const DisallowHeapAllocation&) {
   DCHECK(result != nullptr);
-  RegExpParser parser(input, flags, isolate, zone);
-  RegExpTree* tree = parser.ParsePattern();
-  if (parser.failed()) {
+  RegExpTree* tree = ParsePattern();
+  if (failed()) {
     DCHECK(tree == nullptr);
-    DCHECK(parser.error_ != RegExpError::kNone);
-    result->error = parser.error_;
-    result->error_pos = parser.error_pos_;
+    DCHECK(error_ != RegExpError::kNone);
+    result->error = error_;
+    result->error_pos = error_pos_;
   } else {
     DCHECK(tree != nullptr);
-    DCHECK(parser.error_ == RegExpError::kNone);
+    DCHECK(error_ == RegExpError::kNone);
     if (FLAG_trace_regexp_parser) {
       StdoutStream os;
-      tree->Print(os, zone);
+      tree->Print(os, zone());
       os << "\n";
     }
     result->tree = tree;
-    int capture_count = parser.captures_started();
-    result->simple = tree->IsAtom() && parser.simple() && capture_count == 0;
-    result->contains_anchor = parser.contains_anchor();
-    result->capture_name_map = parser.CreateCaptureNameMap();
+    int capture_count = captures_started();
+    result->simple = tree->IsAtom() && simple() && capture_count == 0;
+    result->contains_anchor = contains_anchor();
     result->capture_count = capture_count;
   }
-  return !parser.failed();
+  return !failed();
+}
+
+bool RegExpParser::ParseRegExp(Isolate* isolate, Zone* zone,
+                               FlatStringReader* input, JSRegExp::Flags flags,
+                               RegExpCompileData* result) {
+  RegExpParser parser(input, flags, isolate, zone);
+  bool success;
+  {
+    DisallowHeapAllocation no_gc;
+    success = parser.Parse(result, no_gc);
+  }
+  if (success) {
+    result->capture_name_map = parser.CreateCaptureNameMap();
+  }
+  return success;
+}
+
+bool RegExpParser::VerifyRegExpSyntax(Isolate* isolate, Zone* zone,
+                                      FlatStringReader* input,
+                                      JSRegExp::Flags flags,
+                                      RegExpCompileData* result,
+                                      const DisallowHeapAllocation& no_gc) {
+  RegExpParser parser(input, flags, isolate, zone);
+  return parser.Parse(result, no_gc);
 }
 
 RegExpBuilder::RegExpBuilder(Zone* zone, JSRegExp::Flags flags)
diff --git a/deps/v8/src/regexp/regexp-parser.h b/deps/v8/src/regexp/regexp-parser.h
index aff1746bc53..bfb08208980 100644
--- a/deps/v8/src/regexp/regexp-parser.h
+++ b/deps/v8/src/regexp/regexp-parser.h
@@ -159,6 +159,13 @@ class V8_EXPORT_PRIVATE RegExpParser {
 
   static bool ParseRegExp(Isolate* isolate, Zone* zone, FlatStringReader* input,
                           JSRegExp::Flags flags, RegExpCompileData* result);
+  static bool VerifyRegExpSyntax(Isolate* isolate, Zone* zone,
+                                 FlatStringReader* input, JSRegExp::Flags flags,
+                                 RegExpCompileData* result,
+                                 const DisallowHeapAllocation& no_gc);
+
+ private:
+  bool Parse(RegExpCompileData* result, const DisallowHeapAllocation&);
 
   RegExpTree* ParsePattern();
   RegExpTree* ParseDisjunction();
diff --git a/deps/v8/src/regexp/regexp-utils.cc b/deps/v8/src/regexp/regexp-utils.cc
index 73c2015dd91..556edbdac88 100644
--- a/deps/v8/src/regexp/regexp-utils.cc
+++ b/deps/v8/src/regexp/regexp-utils.cc
@@ -185,10 +185,7 @@ bool RegExpUtils::IsUnmodifiedRegExp(Isolate* isolate, Handle<Object> obj) {
   // property. Similar spots in CSA would use BranchIfFastRegExp_Strict in this
   // case.
 
-  if (!Protectors::IsRegExpSpeciesLookupChainProtectorIntact(
-          recv.GetCreationContext())) {
-    return false;
-  }
+  if (!Protectors::IsRegExpSpeciesLookupChainIntact(isolate)) return false;
 
   // The smi check is required to omit ToLength(lastIndex) calls with possible
   // user-code execution on the fast path.
diff --git a/deps/v8/src/regexp/regexp.cc b/deps/v8/src/regexp/regexp.cc
index 4319990a398..7b8da4d8eae 100644
--- a/deps/v8/src/regexp/regexp.cc
+++ b/deps/v8/src/regexp/regexp.cc
@@ -34,8 +34,7 @@ class RegExpImpl final : public AllStatic {
   // Prepares a JSRegExp object with Irregexp-specific data.
   static void IrregexpInitialize(Isolate* isolate, Handle<JSRegExp> re,
                                  Handle<String> pattern, JSRegExp::Flags flags,
-                                 int capture_register_count,
-                                 uint32_t backtrack_limit);
+                                 int capture_count, uint32_t backtrack_limit);
 
   static void AtomCompile(Isolate* isolate, Handle<JSRegExp> re,
                           Handle<String> pattern, JSRegExp::Flags flags,
@@ -86,7 +85,6 @@ class RegExpImpl final : public AllStatic {
   static void SetIrregexpCaptureNameMap(FixedArray re,
                                         Handle<FixedArray> value);
   static int IrregexpNumberOfCaptures(FixedArray re);
-  static int IrregexpNumberOfRegisters(FixedArray re);
   static ByteArray IrregexpByteCode(FixedArray re, bool is_one_byte);
   static Code IrregexpNativeCode(FixedArray re, bool is_one_byte);
 };
@@ -422,7 +420,7 @@ bool RegExpImpl::CompileIrregexp(Isolate* isolate, Handle<JSRegExp> re,
   Handle<FixedArray> data =
       Handle<FixedArray>(FixedArray::cast(re->data()), isolate);
   if (compile_data.compilation_target == RegExpCompilationTarget::kNative) {
-    data->set(JSRegExp::code_index(is_one_byte), compile_data.code);
+    data->set(JSRegExp::code_index(is_one_byte), *compile_data.code);
     // Reset bytecode to uninitialized. In case we use tier-up we know that
     // tier-up has happened this way.
     data->set(JSRegExp::bytecode_index(is_one_byte),
@@ -432,7 +430,7 @@ bool RegExpImpl::CompileIrregexp(Isolate* isolate, Handle<JSRegExp> re,
               RegExpCompilationTarget::kBytecode);
     // Store code generated by compiler in bytecode and trampoline to
     // interpreter in code.
-    data->set(JSRegExp::bytecode_index(is_one_byte), compile_data.code);
+    data->set(JSRegExp::bytecode_index(is_one_byte), *compile_data.code);
     Handle<Code> trampoline =
         BUILTIN_CODE(isolate, RegExpInterpreterTrampoline);
     data->set(JSRegExp::code_index(is_one_byte), *trampoline);
@@ -456,7 +454,7 @@ bool RegExpImpl::CompileIrregexp(Isolate* isolate, Handle<JSRegExp> re,
 }
 
 int RegExpImpl::IrregexpMaxRegisterCount(FixedArray re) {
-  return Smi::cast(re.get(JSRegExp::kIrregexpMaxRegisterCountIndex)).value();
+  return Smi::ToInt(re.get(JSRegExp::kIrregexpMaxRegisterCountIndex));
 }
 
 void RegExpImpl::SetIrregexpMaxRegisterCount(FixedArray re, int value) {
@@ -476,10 +474,6 @@ int RegExpImpl::IrregexpNumberOfCaptures(FixedArray re) {
   return Smi::ToInt(re.get(JSRegExp::kIrregexpCaptureCountIndex));
 }
 
-int RegExpImpl::IrregexpNumberOfRegisters(FixedArray re) {
-  return Smi::ToInt(re.get(JSRegExp::kIrregexpMaxRegisterCountIndex));
-}
-
 ByteArray RegExpImpl::IrregexpByteCode(FixedArray re, bool is_one_byte) {
   return ByteArray::cast(re.get(JSRegExp::bytecode_index(is_one_byte)));
 }
@@ -509,35 +503,23 @@ int RegExp::IrregexpPrepare(Isolate* isolate, Handle<JSRegExp> regexp,
     return -1;
   }
 
-  DisallowHeapAllocation no_gc;
-  FixedArray data = FixedArray::cast(regexp->data());
-  if (regexp->ShouldProduceBytecode()) {
-    // Byte-code regexp needs space allocated for all its registers.
-    // The result captures are copied to the start of the registers array
-    // if the match succeeds.  This way those registers are not clobbered
-    // when we set the last match info from last successful match.
-    return RegExpImpl::IrregexpNumberOfRegisters(data) +
-           (RegExpImpl::IrregexpNumberOfCaptures(data) + 1) * 2;
-  } else {
-    // Native regexp only needs room to output captures. Registers are handled
-    // internally.
-    return (RegExpImpl::IrregexpNumberOfCaptures(data) + 1) * 2;
-  }
+  // Only reserve room for output captures. Internal registers are allocated by
+  // the engine.
+  return JSRegExp::RegistersForCaptureCount(regexp->CaptureCount());
 }
 
 int RegExpImpl::IrregexpExecRaw(Isolate* isolate, Handle<JSRegExp> regexp,
                                 Handle<String> subject, int index,
                                 int32_t* output, int output_size) {
-  Handle<FixedArray> irregexp(FixedArray::cast(regexp->data()), isolate);
-
   DCHECK_LE(0, index);
   DCHECK_LE(index, subject->length());
   DCHECK(subject->IsFlat());
+  DCHECK_GE(output_size,
+            JSRegExp::RegistersForCaptureCount(regexp->CaptureCount()));
 
   bool is_one_byte = String::IsOneByteRepresentationUnderneath(*subject);
 
   if (!regexp->ShouldProduceBytecode()) {
-    DCHECK(output_size >= (IrregexpNumberOfCaptures(*irregexp) + 1) * 2);
     do {
       EnsureCompiledIrregexp(isolate, regexp, subject, is_one_byte);
       // The stack is used to allocate registers for the compiled regexp code.
@@ -568,27 +550,16 @@ int RegExpImpl::IrregexpExecRaw(Isolate* isolate, Handle<JSRegExp> regexp,
     UNREACHABLE();
   } else {
     DCHECK(regexp->ShouldProduceBytecode());
-    DCHECK(output_size >= IrregexpNumberOfRegisters(*irregexp));
-    // We must have done EnsureCompiledIrregexp, so we can get the number of
-    // registers.
-    int number_of_capture_registers =
-        (IrregexpNumberOfCaptures(*irregexp) + 1) * 2;
-    int32_t* raw_output = &output[number_of_capture_registers];
 
     do {
       IrregexpInterpreter::Result result =
           IrregexpInterpreter::MatchForCallFromRuntime(
-              isolate, regexp, subject, raw_output, number_of_capture_registers,
-              index);
+              isolate, regexp, subject, output, output_size, index);
       DCHECK_IMPLIES(result == IrregexpInterpreter::EXCEPTION,
                      isolate->has_pending_exception());
 
       switch (result) {
         case IrregexpInterpreter::SUCCESS:
-          // Copy capture results to the start of the registers array.
-          MemCopy(output, raw_output,
-                  number_of_capture_registers * sizeof(int32_t));
-          return result;
         case IrregexpInterpreter::EXCEPTION:
         case IrregexpInterpreter::FAILURE:
           return result;
@@ -596,9 +567,7 @@ int RegExpImpl::IrregexpExecRaw(Isolate* isolate, Handle<JSRegExp> regexp,
           // The string has changed representation, and we must restart the
           // match.
           // We need to reset the tier up to start over with compilation.
-          if (FLAG_regexp_tier_up) {
-            regexp->ResetLastTierUpTick();
-          }
+          if (FLAG_regexp_tier_up) regexp->ResetLastTierUpTick();
           is_one_byte = String::IsOneByteRepresentationUnderneath(*subject);
           EnsureCompiledIrregexp(isolate, regexp, subject, is_one_byte);
           break;
@@ -659,8 +628,7 @@ MaybeHandle<Object> RegExpImpl::IrregexpExec(
                                   output_registers, required_registers);
 
   if (res == RegExp::RE_SUCCESS) {
-    int capture_count =
-        IrregexpNumberOfCaptures(FixedArray::cast(regexp->data()));
+    int capture_count = regexp->CaptureCount();
     return RegExp::SetLastMatchInfo(isolate, last_match_info, subject,
                                     capture_count, output_registers);
   }
@@ -692,7 +660,8 @@ Handle<RegExpMatchInfo> RegExp::SetLastMatchInfo(
     }
   }
 
-  int capture_register_count = (capture_count + 1) * 2;
+  int capture_register_count =
+      JSRegExp::RegistersForCaptureCount(capture_count);
   DisallowHeapAllocation no_allocation;
   if (match != nullptr) {
     for (int i = 0; i < capture_register_count; i += 2) {
@@ -746,14 +715,12 @@ bool RegExpImpl::Compile(Isolate* isolate, Zone* zone, RegExpCompileData* data,
                          JSRegExp::Flags flags, Handle<String> pattern,
                          Handle<String> sample_subject, bool is_one_byte,
                          uint32_t backtrack_limit) {
-  if ((data->capture_count + 1) * 2 - 1 > RegExpMacroAssembler::kMaxRegister) {
+  if (JSRegExp::RegistersForCaptureCount(data->capture_count) >
+      RegExpMacroAssembler::kMaxRegisterCount) {
     data->error = RegExpError::kTooLarge;
     return false;
   }
 
-  bool is_sticky = IsSticky(flags);
-  bool is_global = IsGlobal(flags);
-  bool is_unicode = IsUnicode(flags);
   RegExpCompiler compiler(isolate, zone, data->capture_count, is_one_byte);
 
   if (compiler.optimize()) {
@@ -772,50 +739,8 @@ bool RegExpImpl::Compile(Isolate* isolate, Zone* zone, RegExpCompileData* data,
     compiler.frequency_collator()->CountCharacter(sample_subject->Get(i));
   }
 
-  // Wrap the body of the regexp in capture #0.
-  RegExpNode* captured_body =
-      RegExpCapture::ToNode(data->tree, 0, &compiler, compiler.accept());
-  RegExpNode* node = captured_body;
-  bool is_end_anchored = data->tree->IsAnchoredAtEnd();
-  bool is_start_anchored = data->tree->IsAnchoredAtStart();
-  int max_length = data->tree->max_match();
-  if (!is_start_anchored && !is_sticky) {
-    // Add a .*? at the beginning, outside the body capture, unless
-    // this expression is anchored at the beginning or sticky.
-    JSRegExp::Flags default_flags = JSRegExp::Flags();
-    RegExpNode* loop_node = RegExpQuantifier::ToNode(
-        0, RegExpTree::kInfinity, false,
-        new (zone) RegExpCharacterClass('*', default_flags), &compiler,
-        captured_body, data->contains_anchor);
-
-    if (data->contains_anchor) {
-      // Unroll loop once, to take care of the case that might start
-      // at the start of input.
-      ChoiceNode* first_step_node = new (zone) ChoiceNode(2, zone);
-      first_step_node->AddAlternative(GuardedAlternative(captured_body));
-      first_step_node->AddAlternative(GuardedAlternative(new (zone) TextNode(
-          new (zone) RegExpCharacterClass('*', default_flags), false,
-          loop_node)));
-      node = first_step_node;
-    } else {
-      node = loop_node;
-    }
-  }
-  if (is_one_byte) {
-    node = node->FilterOneByte(RegExpCompiler::kMaxRecursion);
-    // Do it again to propagate the new nodes to places where they were not
-    // put because they had not been calculated yet.
-    if (node != nullptr) {
-      node = node->FilterOneByte(RegExpCompiler::kMaxRecursion);
-    }
-  } else if (is_unicode && (is_global || is_sticky)) {
-    node = RegExpCompiler::OptionallyStepBackToLeadSurrogate(&compiler, node,
-                                                             flags);
-  }
-
-  if (node == nullptr) node = new (zone) EndNode(EndNode::BACKTRACK, zone);
-  data->node = node;
-  data->error = AnalyzeRegExp(isolate, is_one_byte, node);
+  data->node = compiler.PreprocessRegExp(data, flags, is_one_byte);
+  data->error = AnalyzeRegExp(isolate, is_one_byte, data->node);
   if (data->error != RegExpError::kNone) {
     return false;
   }
@@ -830,30 +755,32 @@ bool RegExpImpl::Compile(Isolate* isolate, Zone* zone, RegExpCompileData* data,
         is_one_byte ? NativeRegExpMacroAssembler::LATIN1
                     : NativeRegExpMacroAssembler::UC16;
 
+    const int output_register_count =
+        JSRegExp::RegistersForCaptureCount(data->capture_count);
 #if V8_TARGET_ARCH_IA32
-    macro_assembler.reset(new RegExpMacroAssemblerIA32(
-        isolate, zone, mode, (data->capture_count + 1) * 2));
+    macro_assembler.reset(new RegExpMacroAssemblerIA32(isolate, zone, mode,
+                                                       output_register_count));
 #elif V8_TARGET_ARCH_X64
-    macro_assembler.reset(new RegExpMacroAssemblerX64(
-        isolate, zone, mode, (data->capture_count + 1) * 2));
+    macro_assembler.reset(new RegExpMacroAssemblerX64(isolate, zone, mode,
+                                                      output_register_count));
 #elif V8_TARGET_ARCH_ARM
-    macro_assembler.reset(new RegExpMacroAssemblerARM(
-        isolate, zone, mode, (data->capture_count + 1) * 2));
+    macro_assembler.reset(new RegExpMacroAssemblerARM(isolate, zone, mode,
+                                                      output_register_count));
 #elif V8_TARGET_ARCH_ARM64
-    macro_assembler.reset(new RegExpMacroAssemblerARM64(
-        isolate, zone, mode, (data->capture_count + 1) * 2));
+    macro_assembler.reset(new RegExpMacroAssemblerARM64(isolate, zone, mode,
+                                                        output_register_count));
 #elif V8_TARGET_ARCH_S390
-    macro_assembler.reset(new RegExpMacroAssemblerS390(
-        isolate, zone, mode, (data->capture_count + 1) * 2));
+    macro_assembler.reset(new RegExpMacroAssemblerS390(isolate, zone, mode,
+                                                       output_register_count));
 #elif V8_TARGET_ARCH_PPC || V8_TARGET_ARCH_PPC64
-    macro_assembler.reset(new RegExpMacroAssemblerPPC(
-        isolate, zone, mode, (data->capture_count + 1) * 2));
+    macro_assembler.reset(new RegExpMacroAssemblerPPC(isolate, zone, mode,
+                                                      output_register_count));
 #elif V8_TARGET_ARCH_MIPS
-    macro_assembler.reset(new RegExpMacroAssemblerMIPS(
-        isolate, zone, mode, (data->capture_count + 1) * 2));
+    macro_assembler.reset(new RegExpMacroAssemblerMIPS(isolate, zone, mode,
+                                                       output_register_count));
 #elif V8_TARGET_ARCH_MIPS64
-    macro_assembler.reset(new RegExpMacroAssemblerMIPS(
-        isolate, zone, mode, (data->capture_count + 1) * 2));
+    macro_assembler.reset(new RegExpMacroAssemblerMIPS(isolate, zone, mode,
+                                                       output_register_count));
 #else
 #error "Unsupported architecture"
 #endif
@@ -868,17 +795,20 @@ bool RegExpImpl::Compile(Isolate* isolate, Zone* zone, RegExpCompileData* data,
 
   // Inserted here, instead of in Assembler, because it depends on information
   // in the AST that isn't replicated in the Node structure.
+  bool is_end_anchored = data->tree->IsAnchoredAtEnd();
+  bool is_start_anchored = data->tree->IsAnchoredAtStart();
+  int max_length = data->tree->max_match();
   static const int kMaxBacksearchLimit = 1024;
-  if (is_end_anchored && !is_start_anchored && !is_sticky &&
+  if (is_end_anchored && !is_start_anchored && !IsSticky(flags) &&
       max_length < kMaxBacksearchLimit) {
     macro_assembler->SetCurrentPositionFromEnd(max_length);
   }
 
-  if (is_global) {
+  if (IsGlobal(flags)) {
     RegExpMacroAssembler::GlobalMode mode = RegExpMacroAssembler::GLOBAL;
     if (data->tree->min_match() > 0) {
       mode = RegExpMacroAssembler::GLOBAL_NO_ZERO_LENGTH_CHECK;
-    } else if (is_unicode) {
+    } else if (IsUnicode(flags)) {
       mode = RegExpMacroAssembler::GLOBAL_UNICODE;
     }
     macro_assembler->set_global_mode(mode);
@@ -895,7 +825,7 @@ bool RegExpImpl::Compile(Isolate* isolate, Zone* zone, RegExpCompileData* data,
 #endif
 
   RegExpCompiler::CompilationResult result = compiler.Assemble(
-      isolate, macro_assembler_ptr, node, data->capture_count, pattern);
+      isolate, macro_assembler_ptr, data->node, data->capture_count, pattern);
 
   // Code / bytecode printing.
   {
@@ -904,14 +834,14 @@ bool RegExpImpl::Compile(Isolate* isolate, Zone* zone, RegExpCompileData* data,
         data->compilation_target == RegExpCompilationTarget::kNative) {
       CodeTracer::Scope trace_scope(isolate->GetCodeTracer());
       OFStream os(trace_scope.file());
-      Handle<Code> c(Code::cast(result.code), isolate);
+      Handle<Code> c = Handle<Code>::cast(result.code);
       auto pattern_cstring = pattern->ToCString();
       c->Disassemble(pattern_cstring.get(), os, isolate);
     }
 #endif
     if (FLAG_print_regexp_bytecode &&
         data->compilation_target == RegExpCompilationTarget::kBytecode) {
-      Handle<ByteArray> bytecode(ByteArray::cast(result.code), isolate);
+      Handle<ByteArray> bytecode = Handle<ByteArray>::cast(result.code);
       auto pattern_cstring = pattern->ToCString();
       RegExpBytecodeDisassemble(bytecode->GetDataStartAddress(),
                                 bytecode->length(), pattern_cstring.get());
diff --git a/deps/v8/src/regexp/regexp.h b/deps/v8/src/regexp/regexp.h
index 27ccbb47ba7..3a5d9e29628 100644
--- a/deps/v8/src/regexp/regexp.h
+++ b/deps/v8/src/regexp/regexp.h
@@ -27,7 +27,7 @@ struct RegExpCompileData {
 
   // Either the generated code as produced by the compiler or a trampoline
   // to the interpreter.
-  Object code;
+  Handle<Object> code;
 
   // True, iff the pattern is a 'simple' atom with zero captures. In other
   // words, the pattern consists of a string with no metacharacters and special
diff --git a/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.cc b/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.cc
index be4b85df4fc..2109b45314a 100644
--- a/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.cc
+++ b/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.cc
@@ -983,26 +983,6 @@ RegExpMacroAssemblerS390::Implementation() {
   return kS390Implementation;
 }
 
-void RegExpMacroAssemblerS390::LoadCurrentCharacterImpl(int cp_offset,
-                                                        Label* on_end_of_input,
-                                                        bool check_bounds,
-                                                        int characters,
-                                                        int eats_at_least) {
-  // It's possible to preload a small number of characters when each success
-  // path requires a large number of characters, but not the reverse.
-  DCHECK_GE(eats_at_least, characters);
-
-  DCHECK(cp_offset < (1 << 30));  // Be sane! (And ensure negation works)
-  if (check_bounds) {
-    if (cp_offset >= 0) {
-      CheckPosition(cp_offset + eats_at_least - 1, on_end_of_input);
-    } else {
-      CheckPosition(cp_offset, on_end_of_input);
-    }
-  }
-  LoadCurrentCharacterUnchecked(cp_offset, characters);
-}
-
 void RegExpMacroAssemblerS390::PopCurrentPosition() {
   Pop(current_input_offset());
 }
diff --git a/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.h b/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.h
index eced564d7f9..9ced67fe274 100644
--- a/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.h
+++ b/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.h
@@ -59,9 +59,7 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerS390
   virtual void IfRegisterLT(int reg, int comparand, Label* if_lt);
   virtual void IfRegisterEqPos(int reg, Label* if_eq);
   virtual IrregexpImplementation Implementation();
-  virtual void LoadCurrentCharacterImpl(int cp_offset, Label* on_end_of_input,
-                                        bool check_bounds, int characters,
-                                        int eats_at_least);
+  void LoadCurrentCharacterUnchecked(int cp_offset, int character_count);
   virtual void PopCurrentPosition();
   virtual void PopRegister(int register_index);
   virtual void PushBacktrack(Label* label);
@@ -121,10 +119,6 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerS390
   // Initial size of code buffer.
   static const int kRegExpCodeSize = 1024;
 
-  // Load a number of characters at the given offset from the
-  // current position, into the current-character register.
-  void LoadCurrentCharacterUnchecked(int cp_offset, int character_count);
-
   // Check whether preemption has been requested.
   void CheckPreemption();
 
diff --git a/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.cc b/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.cc
index 5edbf5e5790..cf8eb6604c9 100644
--- a/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.cc
+++ b/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.cc
@@ -1044,25 +1044,6 @@ RegExpMacroAssembler::IrregexpImplementation
   return kX64Implementation;
 }
 
-void RegExpMacroAssemblerX64::LoadCurrentCharacterImpl(int cp_offset,
-                                                       Label* on_end_of_input,
-                                                       bool check_bounds,
-                                                       int characters,
-                                                       int eats_at_least) {
-  // It's possible to preload a small number of characters when each success
-  // path requires a large number of characters, but not the reverse.
-  DCHECK_GE(eats_at_least, characters);
-
-  DCHECK(cp_offset < (1<<30));  // Be sane! (And ensure negation works)
-  if (check_bounds) {
-    if (cp_offset >= 0) {
-      CheckPosition(cp_offset + eats_at_least - 1, on_end_of_input);
-    } else {
-      CheckPosition(cp_offset, on_end_of_input);
-    }
-  }
-  LoadCurrentCharacterUnchecked(cp_offset, characters);
-}
 
 void RegExpMacroAssemblerX64::PopCurrentPosition() {
   Pop(rdi);
diff --git a/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.h b/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.h
index 64614e228a7..551e9bc6ec7 100644
--- a/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.h
+++ b/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.h
@@ -59,9 +59,8 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerX64
   void IfRegisterLT(int reg, int comparand, Label* if_lt) override;
   void IfRegisterEqPos(int reg, Label* if_eq) override;
   IrregexpImplementation Implementation() override;
-  void LoadCurrentCharacterImpl(int cp_offset, Label* on_end_of_input,
-                                bool check_bounds, int characters,
-                                int eats_at_least) override;
+  void LoadCurrentCharacterUnchecked(int cp_offset,
+                                     int character_count) override;
   void PopCurrentPosition() override;
   void PopRegister(int register_index) override;
   void PushBacktrack(Label* label) override;
@@ -159,10 +158,6 @@ class V8_EXPORT_PRIVATE RegExpMacroAssemblerX64
   // Initial size of code buffer.
   static const int kRegExpCodeSize = 1024;
 
-  // Load a number of characters at the given offset from the
-  // current position, into the current-character register.
-  void LoadCurrentCharacterUnchecked(int cp_offset, int character_count);
-
   // Check whether preemption has been requested.
   void CheckPreemption();
 
diff --git a/deps/v8/src/roots/roots-inl.h b/deps/v8/src/roots/roots-inl.h
index 2a5fabd2168..2bec843aa36 100644
--- a/deps/v8/src/roots/roots-inl.h
+++ b/deps/v8/src/roots/roots-inl.h
@@ -5,9 +5,8 @@
 #ifndef V8_ROOTS_ROOTS_INL_H_
 #define V8_ROOTS_ROOTS_INL_H_
 
-#include "src/roots/roots.h"
-
 #include "src/execution/isolate.h"
+#include "src/execution/local-isolate-wrapper.h"
 #include "src/execution/off-thread-isolate.h"
 #include "src/handles/handles.h"
 #include "src/heap/read-only-heap.h"
@@ -23,6 +22,7 @@
 #include "src/objects/scope-info.h"
 #include "src/objects/slots.h"
 #include "src/objects/string.h"
+#include "src/roots/roots.h"
 
 namespace v8 {
 namespace internal {
@@ -62,6 +62,9 @@ bool RootsTable::IsRootHandle(Handle<T> handle, RootIndex* index) const {
 ReadOnlyRoots::ReadOnlyRoots(Heap* heap)
     : ReadOnlyRoots(Isolate::FromHeap(heap)) {}
 
+ReadOnlyRoots::ReadOnlyRoots(OffThreadHeap* heap)
+    : ReadOnlyRoots(OffThreadIsolate::FromHeap(heap)) {}
+
 ReadOnlyRoots::ReadOnlyRoots(Isolate* isolate)
     : read_only_roots_(reinterpret_cast<Address*>(
           isolate->roots_table().read_only_roots_begin().address())) {}
@@ -69,29 +72,45 @@ ReadOnlyRoots::ReadOnlyRoots(Isolate* isolate)
 ReadOnlyRoots::ReadOnlyRoots(OffThreadIsolate* isolate)
     : ReadOnlyRoots(isolate->factory()->read_only_roots()) {}
 
-ReadOnlyRoots::ReadOnlyRoots(Address* ro_roots) : read_only_roots_(ro_roots) {}
+ReadOnlyRoots::ReadOnlyRoots(LocalHeapWrapper heap)
+    : ReadOnlyRoots(heap.is_off_thread() ? ReadOnlyRoots(heap.off_thread())
+                                         : ReadOnlyRoots(heap.main_thread())) {}
+
+ReadOnlyRoots::ReadOnlyRoots(LocalIsolateWrapper isolate)
+    : ReadOnlyRoots(isolate.is_off_thread()
+                        ? ReadOnlyRoots(isolate.off_thread())
+                        : ReadOnlyRoots(isolate.main_thread())) {}
 
 // We use unchecked_cast below because we trust our read-only roots to
 // have the right type, and to avoid the heavy #includes that would be
 // required for checked casts.
 
-#define ROOT_ACCESSOR(Type, name, CamelName)                          \
-  Type ReadOnlyRoots::name() const {                                  \
-    DCHECK(CheckType(RootIndex::k##CamelName));                       \
-    return Type::unchecked_cast(Object(at(RootIndex::k##CamelName))); \
-  }                                                                   \
-  Handle<Type> ReadOnlyRoots::name##_handle() const {                 \
-    DCHECK(CheckType(RootIndex::k##CamelName));                       \
-    return Handle<Type>(&at(RootIndex::k##CamelName));                \
+#define ROOT_ACCESSOR(Type, name, CamelName)                  \
+  Type ReadOnlyRoots::name() const {                          \
+    DCHECK(CheckType_##name());                               \
+    return unchecked_##name();                                \
+  }                                                           \
+  Type ReadOnlyRoots::unchecked_##name() const {              \
+    return Type::unchecked_cast(                              \
+        Object(*GetLocation(RootIndex::k##CamelName)));       \
+  }                                                           \
+  Handle<Type> ReadOnlyRoots::name##_handle() const {         \
+    DCHECK(CheckType_##name());                               \
+    Address* location = GetLocation(RootIndex::k##CamelName); \
+    return Handle<Type>(location);                            \
   }
 
 READ_ONLY_ROOT_LIST(ROOT_ACCESSOR)
 #undef ROOT_ACCESSOR
 
-Address& ReadOnlyRoots::at(RootIndex root_index) const {
+Address* ReadOnlyRoots::GetLocation(RootIndex root_index) const {
   size_t index = static_cast<size_t>(root_index);
   DCHECK_LT(index, kEntriesCount);
-  return read_only_roots_[index];
+  return &read_only_roots_[index];
+}
+
+Address ReadOnlyRoots::at(RootIndex root_index) const {
+  return *GetLocation(root_index);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/roots/roots.cc b/deps/v8/src/roots/roots.cc
index e2ca6e5897f..3fdecfe0bf1 100644
--- a/deps/v8/src/roots/roots.cc
+++ b/deps/v8/src/roots/roots.cc
@@ -25,23 +25,14 @@ void ReadOnlyRoots::Iterate(RootVisitor* visitor) {
 }
 
 #ifdef DEBUG
-
-bool ReadOnlyRoots::CheckType(RootIndex index) const {
-  Object root(at(index));
-  switch (index) {
-#define CHECKTYPE(Type, name, CamelName) \
-  case RootIndex::k##CamelName:          \
-    return root.Is##Type();
-    READ_ONLY_ROOT_LIST(CHECKTYPE)
-#undef CHECKTYPE
-
-    default:
-      UNREACHABLE();
-      return false;
+#define ROOT_TYPE_CHECK(Type, name, CamelName)   \
+  bool ReadOnlyRoots::CheckType_##name() const { \
+    return unchecked_##name().Is##Type();        \
   }
-}
 
-#endif  // DEBUG
+READ_ONLY_ROOT_LIST(ROOT_TYPE_CHECK)
+#undef ROOT_TYPE_CHECK
+#endif
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/roots/roots.h b/deps/v8/src/roots/roots.h
index cf84ebf40bc..a00e99f7ce3 100644
--- a/deps/v8/src/roots/roots.h
+++ b/deps/v8/src/roots/roots.h
@@ -5,8 +5,10 @@
 #ifndef V8_ROOTS_ROOTS_H_
 #define V8_ROOTS_ROOTS_H_
 
+#include "src/base/macros.h"
 #include "src/builtins/accessors.h"
 #include "src/common/globals.h"
+#include "src/execution/local-isolate-wrapper.h"
 #include "src/handles/handles.h"
 #include "src/init/heap-symbols.h"
 #include "src/objects/objects-definitions.h"
@@ -18,6 +20,7 @@ namespace internal {
 
 // Forward declarations.
 enum ElementsKind : uint8_t;
+class OffThreadHeap;
 class OffThreadIsolate;
 template <typename T>
 class Handle;
@@ -105,7 +108,6 @@ class Symbol;
   V(Map, next_call_side_effect_free_call_handler_info_map,                     \
     NextCallSideEffectFreeCallHandlerInfoMap)                                  \
   V(Map, simple_number_dictionary_map, SimpleNumberDictionaryMap)              \
-  V(Map, sloppy_arguments_elements_map, SloppyArgumentsElementsMap)            \
   V(Map, small_ordered_hash_map_map, SmallOrderedHashMapMap)                   \
   V(Map, small_ordered_hash_set_map, SmallOrderedHashSetMap)                   \
   V(Map, small_ordered_name_dictionary_map, SmallOrderedNameDictionaryMap)     \
@@ -153,6 +155,7 @@ class Symbol;
   V(Map, optimized_out_map, OptimizedOutMap)                                   \
   V(Map, stale_register_map, StaleRegisterMap)                                 \
   V(Map, self_reference_marker_map, SelfReferenceMarkerMap)                    \
+  V(Map, basic_block_counters_marker_map, BasicBlockCountersMarkerMap)         \
   /* Canonical empty values */                                                 \
   V(EnumCache, empty_enum_cache, EmptyEnumCache)                               \
   V(PropertyArray, empty_property_array, EmptyPropertyArray)                   \
@@ -163,7 +166,6 @@ class Symbol;
     EmptyArrayBoilerplateDescription)                                          \
   V(ClosureFeedbackCellArray, empty_closure_feedback_cell_array,               \
     EmptyClosureFeedbackCellArray)                                             \
-  V(FixedArray, empty_sloppy_arguments_elements, EmptySloppyArgumentsElements) \
   V(NumberDictionary, empty_slow_element_dictionary,                           \
     EmptySlowElementDictionary)                                                \
   V(FixedArray, empty_ordered_hash_map, EmptyOrderedHashMap)                   \
@@ -182,6 +184,8 @@ class Symbol;
   V(HeapNumber, minus_infinity_value, MinusInfinityValue)                      \
   /* Marker for self-references during code-generation */                      \
   V(HeapObject, self_reference_marker, SelfReferenceMarker)                    \
+  /* Marker for basic-block usage counters array during code-generation */     \
+  V(Oddball, basic_block_counters_marker, BasicBlockCountersMarker)            \
   /* Canonical off-heap trampoline data */                                     \
   V(ByteArray, off_heap_trampoline_relocation_info,                            \
     OffHeapTrampolineRelocationInfo)                                           \
@@ -214,6 +218,7 @@ class Symbol;
   V(PropertyCell, array_species_protector, ArraySpeciesProtector)              \
   V(PropertyCell, typed_array_species_protector, TypedArraySpeciesProtector)   \
   V(PropertyCell, promise_species_protector, PromiseSpeciesProtector)          \
+  V(PropertyCell, regexp_species_protector, RegExpSpeciesProtector)            \
   V(PropertyCell, string_length_protector, StringLengthProtector)              \
   V(PropertyCell, array_iterator_protector, ArrayIteratorProtector)            \
   V(PropertyCell, array_buffer_detaching_protector,                            \
@@ -229,7 +234,49 @@ class Symbol;
   V(FixedArray, string_split_cache, StringSplitCache)                          \
   V(FixedArray, regexp_multiple_cache, RegExpMultipleCache)                    \
   /* Indirection lists for isolate-independent builtins */                     \
-  V(FixedArray, builtins_constants_table, BuiltinsConstantsTable)
+  V(FixedArray, builtins_constants_table, BuiltinsConstantsTable)              \
+  /* Internal SharedFunctionInfos */                                           \
+  V(SharedFunctionInfo, async_function_await_reject_shared_fun,                \
+    AsyncFunctionAwaitRejectSharedFun)                                         \
+  V(SharedFunctionInfo, async_function_await_resolve_shared_fun,               \
+    AsyncFunctionAwaitResolveSharedFun)                                        \
+  V(SharedFunctionInfo, async_generator_await_reject_shared_fun,               \
+    AsyncGeneratorAwaitRejectSharedFun)                                        \
+  V(SharedFunctionInfo, async_generator_await_resolve_shared_fun,              \
+    AsyncGeneratorAwaitResolveSharedFun)                                       \
+  V(SharedFunctionInfo, async_generator_yield_resolve_shared_fun,              \
+    AsyncGeneratorYieldResolveSharedFun)                                       \
+  V(SharedFunctionInfo, async_generator_return_resolve_shared_fun,             \
+    AsyncGeneratorReturnResolveSharedFun)                                      \
+  V(SharedFunctionInfo, async_generator_return_closed_reject_shared_fun,       \
+    AsyncGeneratorReturnClosedRejectSharedFun)                                 \
+  V(SharedFunctionInfo, async_generator_return_closed_resolve_shared_fun,      \
+    AsyncGeneratorReturnClosedResolveSharedFun)                                \
+  V(SharedFunctionInfo, async_iterator_value_unwrap_shared_fun,                \
+    AsyncIteratorValueUnwrapSharedFun)                                         \
+  V(SharedFunctionInfo, promise_all_resolve_element_shared_fun,                \
+    PromiseAllResolveElementSharedFun)                                         \
+  V(SharedFunctionInfo, promise_all_settled_resolve_element_shared_fun,        \
+    PromiseAllSettledResolveElementSharedFun)                                  \
+  V(SharedFunctionInfo, promise_all_settled_reject_element_shared_fun,         \
+    PromiseAllSettledRejectElementSharedFun)                                   \
+  V(SharedFunctionInfo, promise_any_reject_element_shared_fun,                 \
+    PromiseAnyRejectElementSharedFun)                                          \
+  V(SharedFunctionInfo, promise_capability_default_reject_shared_fun,          \
+    PromiseCapabilityDefaultRejectSharedFun)                                   \
+  V(SharedFunctionInfo, promise_capability_default_resolve_shared_fun,         \
+    PromiseCapabilityDefaultResolveSharedFun)                                  \
+  V(SharedFunctionInfo, promise_catch_finally_shared_fun,                      \
+    PromiseCatchFinallySharedFun)                                              \
+  V(SharedFunctionInfo, promise_get_capabilities_executor_shared_fun,          \
+    PromiseGetCapabilitiesExecutorSharedFun)                                   \
+  V(SharedFunctionInfo, promise_then_finally_shared_fun,                       \
+    PromiseThenFinallySharedFun)                                               \
+  V(SharedFunctionInfo, promise_thrower_finally_shared_fun,                    \
+    PromiseThrowerFinallySharedFun)                                            \
+  V(SharedFunctionInfo, promise_value_thunk_finally_shared_fun,                \
+    PromiseValueThunkFinallySharedFun)                                         \
+  V(SharedFunctionInfo, proxy_revoke_shared_fun, ProxyRevokeSharedFun)
 
 // These root references can be updated by the mutator.
 #define STRONG_MUTABLE_MOVABLE_ROOT_LIST(V)                                \
@@ -243,7 +290,6 @@ class Symbol;
   V(FixedArray, materialized_objects, MaterializedObjects)                 \
   V(WeakArrayList, detached_contexts, DetachedContexts)                    \
   V(WeakArrayList, retaining_path_targets, RetainingPathTargets)           \
-  V(WeakArrayList, retained_maps, RetainedMaps)                            \
   /* Feedback vectors that we need for code coverage or type profile */    \
   V(Object, feedback_vectors_for_profiling_tools,                          \
     FeedbackVectorsForProfilingTools)                                      \
@@ -258,6 +304,7 @@ class Symbol;
     InterpreterEntryTrampolineForProfiling)                                \
   V(Object, pending_optimize_for_test_bytecode,                            \
     PendingOptimizeForTestBytecode)                                        \
+  V(ArrayList, basic_block_profiling_data, BasicBlockProfilingData)        \
   V(WeakArrayList, shared_wasm_memories, SharedWasmMemories)
 
 // Entries in this list are limited to Smis and are not visited during GC.
@@ -302,15 +349,15 @@ class Symbol;
 #define ACCESSOR_INFO_ROOT_LIST(V) \
   ACCESSOR_INFO_LIST_GENERATOR(ACCESSOR_INFO_ROOT_LIST_ADAPTER, V)
 
-#define READ_ONLY_ROOT_LIST(V)       \
-  STRONG_READ_ONLY_ROOT_LIST(V)      \
-  INTERNALIZED_STRING_ROOT_LIST(V)   \
-  PRIVATE_SYMBOL_ROOT_LIST(V)        \
-  PUBLIC_SYMBOL_ROOT_LIST(V)         \
-  WELL_KNOWN_SYMBOL_ROOT_LIST(V)     \
-  STRUCT_MAPS_LIST(V)                \
-  TORQUE_INTERNAL_CLASS_MAPS_LIST(V) \
-  ALLOCATION_SITE_MAPS_LIST(V)       \
+#define READ_ONLY_ROOT_LIST(V)     \
+  STRONG_READ_ONLY_ROOT_LIST(V)    \
+  INTERNALIZED_STRING_ROOT_LIST(V) \
+  PRIVATE_SYMBOL_ROOT_LIST(V)      \
+  PUBLIC_SYMBOL_ROOT_LIST(V)       \
+  WELL_KNOWN_SYMBOL_ROOT_LIST(V)   \
+  STRUCT_MAPS_LIST(V)              \
+  TORQUE_INTERNAL_MAP_ROOT_LIST(V) \
+  ALLOCATION_SITE_MAPS_LIST(V)     \
   DATA_HANDLER_MAPS_LIST(V)
 
 #define MUTABLE_ROOT_LIST(V)                \
@@ -480,33 +527,46 @@ class ReadOnlyRoots {
       static_cast<size_t>(RootIndex::kReadOnlyRootsCount);
 
   V8_INLINE explicit ReadOnlyRoots(Heap* heap);
+  V8_INLINE explicit ReadOnlyRoots(OffThreadHeap* heap);
   V8_INLINE explicit ReadOnlyRoots(Isolate* isolate);
   V8_INLINE explicit ReadOnlyRoots(OffThreadIsolate* isolate);
+  V8_INLINE explicit ReadOnlyRoots(LocalIsolateWrapper wrapper);
+  V8_INLINE explicit ReadOnlyRoots(LocalHeapWrapper wrapper);
 
-#define ROOT_ACCESSOR(Type, name, CamelName) \
-  V8_INLINE class Type name() const;         \
+#define ROOT_ACCESSOR(Type, name, CamelName)     \
+  V8_INLINE class Type name() const;             \
+  V8_INLINE class Type unchecked_##name() const; \
   V8_INLINE Handle<Type> name##_handle() const;
 
   READ_ONLY_ROOT_LIST(ROOT_ACCESSOR)
 #undef ROOT_ACCESSOR
 
+  // Get the address of a given read-only root index, without type checks.
+  V8_INLINE Address at(RootIndex root_index) const;
+
   // Iterate over all the read-only roots. This is not necessary for garbage
   // collection and is usually only performed as part of (de)serialization or
   // heap verification.
   void Iterate(RootVisitor* visitor);
 
+ private:
 #ifdef DEBUG
-  V8_EXPORT_PRIVATE bool CheckType(RootIndex index) const;
+#define ROOT_TYPE_CHECK(Type, name, CamelName) \
+  V8_EXPORT_PRIVATE bool CheckType_##name() const;
+
+  READ_ONLY_ROOT_LIST(ROOT_TYPE_CHECK)
+#undef ROOT_TYPE_CHECK
 #endif
 
- private:
-  V8_INLINE explicit ReadOnlyRoots(Address* ro_roots);
+  V8_INLINE explicit ReadOnlyRoots(Address* ro_roots)
+      : read_only_roots_(ro_roots) {}
 
-  V8_INLINE Address& at(RootIndex root_index) const;
+  V8_INLINE Address* GetLocation(RootIndex root_index) const;
 
   Address* read_only_roots_;
 
   friend class ReadOnlyHeap;
+  friend class DeserializerAllocator;
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/runtime/runtime-compiler.cc b/deps/v8/src/runtime/runtime-compiler.cc
index 93733fe90f0..a0e7a2410ad 100644
--- a/deps/v8/src/runtime/runtime-compiler.cc
+++ b/deps/v8/src/runtime/runtime-compiler.cc
@@ -123,22 +123,17 @@ RUNTIME_FUNCTION(Runtime_InstantiateAsmJs) {
   if (args[3].IsJSArrayBuffer()) {
     memory = args.at<JSArrayBuffer>(3);
   }
-  if (function->shared().HasAsmWasmData()) {
-    Handle<SharedFunctionInfo> shared(function->shared(), isolate);
+  Handle<SharedFunctionInfo> shared(function->shared(), isolate);
+  if (shared->HasAsmWasmData()) {
     Handle<AsmWasmData> data(shared->asm_wasm_data(), isolate);
     MaybeHandle<Object> result = AsmJs::InstantiateAsmWasm(
         isolate, shared, data, stdlib, foreign, memory);
-    if (!result.is_null()) {
-      return *result.ToHandleChecked();
-    }
-  }
-  // Remove wasm data, mark as broken for asm->wasm, replace function code with
-  // UncompiledData, and return a smi 0 to indicate failure.
-  if (function->shared().HasAsmWasmData()) {
-    SharedFunctionInfo::DiscardCompiled(isolate,
-                                        handle(function->shared(), isolate));
+    if (!result.is_null()) return *result.ToHandleChecked();
+    // Remove wasm data, mark as broken for asm->wasm, replace function code
+    // with UncompiledData, and return a smi 0 to indicate failure.
+    SharedFunctionInfo::DiscardCompiled(isolate, shared);
   }
-  function->shared().set_is_asm_wasm_broken(true);
+  shared->set_is_asm_wasm_broken(true);
   DCHECK(function->code() ==
          isolate->builtins()->builtin(Builtins::kInstantiateAsmJs));
   function->set_code(isolate->builtins()->builtin(Builtins::kCompileLazy));
@@ -176,6 +171,12 @@ RUNTIME_FUNCTION(Runtime_NotifyDeoptimized) {
   JavaScriptFrame* top_frame = top_it.frame();
   isolate->set_context(Context::cast(top_frame->context()));
 
+  int count = optimized_code->deoptimization_count();
+  if (type == DeoptimizeKind::kSoft && count < FLAG_reuse_opt_code_count) {
+    optimized_code->increment_deoptimization_count();
+    return ReadOnlyRoots(isolate).undefined_value();
+  }
+
   // Invalidate the underlying optimized code on non-lazy deopts.
   if (type != DeoptimizeKind::kLazy) {
     Deoptimizer::DeoptimizeFunction(*function, *optimized_code);
diff --git a/deps/v8/src/runtime/runtime-debug.cc b/deps/v8/src/runtime/runtime-debug.cc
index 0e1b8fd8fad..e6a7cbd5f71 100644
--- a/deps/v8/src/runtime/runtime-debug.cc
+++ b/deps/v8/src/runtime/runtime-debug.cc
@@ -27,6 +27,7 @@
 #include "src/objects/js-promise-inl.h"
 #include "src/runtime/runtime-utils.h"
 #include "src/runtime/runtime.h"
+#include "src/snapshot/embedded/embedded-data.h"
 #include "src/snapshot/snapshot.h"
 #include "src/wasm/wasm-objects-inl.h"
 
@@ -240,7 +241,7 @@ MaybeHandle<JSArray> Runtime::GetInternalProperties(Isolate* isolate,
 
     Handle<FixedArray> result = factory->NewFixedArray(2 * 3);
     Handle<String> generator_status =
-        factory->NewStringFromAsciiChecked("[[GeneratorStatus]]");
+        factory->NewStringFromAsciiChecked("[[GeneratorState]]");
     result->set(0, *generator_status);
     Handle<String> status_str = factory->NewStringFromAsciiChecked(status);
     result->set(1, *status_str);
@@ -260,7 +261,7 @@ MaybeHandle<JSArray> Runtime::GetInternalProperties(Isolate* isolate,
     const char* status = JSPromise::Status(promise->status());
     Handle<FixedArray> result = factory->NewFixedArray(2 * 2);
     Handle<String> promise_status =
-        factory->NewStringFromAsciiChecked("[[PromiseStatus]]");
+        factory->NewStringFromAsciiChecked("[[PromiseState]]");
     result->set(0, *promise_status);
     Handle<String> status_str = factory->NewStringFromAsciiChecked(status);
     result->set(1, *status_str);
@@ -270,7 +271,7 @@ MaybeHandle<JSArray> Runtime::GetInternalProperties(Isolate* isolate,
                                  : promise->result(),
                              isolate);
     Handle<String> promise_value =
-        factory->NewStringFromAsciiChecked("[[PromiseValue]]");
+        factory->NewStringFromAsciiChecked("[[PromiseResult]]");
     result->set(2, *promise_value);
     result->set(3, *value_obj);
     return factory->NewJSArrayWithElements(result);
diff --git a/deps/v8/src/runtime/runtime-internal.cc b/deps/v8/src/runtime/runtime-internal.cc
index b3d9f26ee54..bdb2931e200 100644
--- a/deps/v8/src/runtime/runtime-internal.cc
+++ b/deps/v8/src/runtime/runtime-internal.cc
@@ -209,11 +209,29 @@ RUNTIME_FUNCTION(Runtime_NewError) {
 
 RUNTIME_FUNCTION(Runtime_NewTypeError) {
   HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
+  DCHECK_LE(args.length(), 4);
+  DCHECK_GE(args.length(), 1);
   CONVERT_INT32_ARG_CHECKED(template_index, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, arg0, 1);
   MessageTemplate message_template = MessageTemplateFromInt(template_index);
-  return *isolate->factory()->NewTypeError(message_template, arg0);
+
+  Handle<Object> arg0;
+  if (args.length() >= 2) {
+    CHECK(args[1].IsObject());
+    arg0 = args.at<Object>(1);
+  }
+
+  Handle<Object> arg1;
+  if (args.length() >= 3) {
+    CHECK(args[2].IsObject());
+    arg1 = args.at<Object>(2);
+  }
+  Handle<Object> arg2;
+  if (args.length() >= 4) {
+    CHECK(args[3].IsObject());
+    arg2 = args.at<Object>(3);
+  }
+
+  return *isolate->factory()->NewTypeError(message_template, arg0, arg1, arg2);
 }
 
 RUNTIME_FUNCTION(Runtime_NewReferenceError) {
@@ -409,11 +427,13 @@ RUNTIME_FUNCTION(Runtime_ThrowIteratorError) {
   return isolate->Throw(*ErrorUtils::NewIteratorError(isolate, object));
 }
 
-RUNTIME_FUNCTION(Runtime_ThrowSpreadArgIsNullOrUndefined) {
+RUNTIME_FUNCTION(Runtime_ThrowSpreadArgError) {
   HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
-  return ErrorUtils::ThrowSpreadArgIsNullOrUndefinedError(isolate, object);
+  DCHECK_EQ(2, args.length());
+  CONVERT_SMI_ARG_CHECKED(message_id_smi, 0);
+  MessageTemplate message_id = MessageTemplateFromInt(message_id_smi);
+  CONVERT_ARG_HANDLE_CHECKED(Object, object, 1);
+  return ErrorUtils::ThrowSpreadArgError(isolate, message_id, object);
 }
 
 RUNTIME_FUNCTION(Runtime_ThrowCalledNonCallable) {
@@ -578,19 +598,21 @@ RUNTIME_FUNCTION(Runtime_GetTemplateObject) {
       isolate, native_context, description, shared_info, slot_id);
 }
 
-RUNTIME_FUNCTION(Runtime_ReportMessage) {
+RUNTIME_FUNCTION(Runtime_ReportMessageFromMicrotask) {
   // Helper to report messages and continue JS execution. This is intended to
-  // behave similarly to reporting exceptions which reach the top-level in
-  // Execution.cc, but allow the JS code to continue. This is useful for
-  // implementing algorithms such as RunMicrotasks in JS.
+  // behave similarly to reporting exceptions which reach the top-level, but
+  // allow the JS code to continue.
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
 
-  CONVERT_ARG_HANDLE_CHECKED(Object, message_obj, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, exception, 0);
 
   DCHECK(!isolate->has_pending_exception());
-  isolate->set_pending_exception(*message_obj);
-  isolate->ReportPendingMessagesFromJavaScript();
+  isolate->set_pending_exception(*exception);
+  MessageLocation* no_location = nullptr;
+  Handle<JSMessageObject> message =
+      isolate->CreateMessageOrAbort(exception, no_location);
+  MessageHandler::ReportMessage(isolate, no_location, message);
   isolate->clear_pending_exception();
   return ReadOnlyRoots(isolate).undefined_value();
 }
diff --git a/deps/v8/src/runtime/runtime-module.cc b/deps/v8/src/runtime/runtime-module.cc
index eb21e0a9a40..ecc9ad534ef 100644
--- a/deps/v8/src/runtime/runtime-module.cc
+++ b/deps/v8/src/runtime/runtime-module.cc
@@ -41,7 +41,7 @@ RUNTIME_FUNCTION(Runtime_GetImportMetaObject) {
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
   Handle<SourceTextModule> module(isolate->context().module(), isolate);
-  return *isolate->RunHostInitializeImportMetaObjectCallback(module);
+  return *SourceTextModule::GetImportMeta(isolate, module);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/runtime/runtime-numbers.cc b/deps/v8/src/runtime/runtime-numbers.cc
index e496880b71b..04b195b31e1 100644
--- a/deps/v8/src/runtime/runtime-numbers.cc
+++ b/deps/v8/src/runtime/runtime-numbers.cc
@@ -70,12 +70,12 @@ RUNTIME_FUNCTION(Runtime_StringParseFloat) {
   return *isolate->factory()->NewNumber(value);
 }
 
-RUNTIME_FUNCTION(Runtime_NumberToString) {
+RUNTIME_FUNCTION(Runtime_NumberToStringSlow) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_NUMBER_ARG_HANDLE_CHECKED(number, 0);
 
-  return *isolate->factory()->NumberToString(number);
+  return *isolate->factory()->NumberToString(number, NumberCacheMode::kSetOnly);
 }
 
 RUNTIME_FUNCTION(Runtime_MaxSmi) {
diff --git a/deps/v8/src/runtime/runtime-object.cc b/deps/v8/src/runtime/runtime-object.cc
index b93cdf349b1..2dfa9e53bec 100644
--- a/deps/v8/src/runtime/runtime-object.cc
+++ b/deps/v8/src/runtime/runtime-object.cc
@@ -10,6 +10,7 @@
 #include "src/execution/messages.h"
 #include "src/handles/maybe-handles.h"
 #include "src/heap/heap-inl.h"  // For ToBoolean. TODO(jkummerow): Drop.
+#include "src/heap/memory-chunk.h"
 #include "src/init/bootstrapper.h"
 #include "src/logging/counters.h"
 #include "src/objects/hash-table-inl.h"
@@ -916,9 +917,7 @@ RUNTIME_FUNCTION(Runtime_DefineDataPropertyInLiteral) {
     }
   }
 
-  DataPropertyInLiteralFlags flags =
-      static_cast<DataPropertyInLiteralFlag>(flag);
-
+  DataPropertyInLiteralFlags flags(flag);
   PropertyAttributes attrs = (flags & DataPropertyInLiteralFlag::kDontEnum)
                                  ? PropertyAttributes::DONT_ENUM
                                  : PropertyAttributes::NONE;
@@ -991,14 +990,6 @@ RUNTIME_FUNCTION(Runtime_IsJSReceiver) {
   return isolate->heap()->ToBoolean(obj.IsJSReceiver());
 }
 
-RUNTIME_FUNCTION(Runtime_ClassOf) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_CHECKED(Object, obj, 0);
-  if (!obj.IsJSReceiver()) return ReadOnlyRoots(isolate).null_value();
-  return JSReceiver::cast(obj).class_name();
-}
-
 RUNTIME_FUNCTION(Runtime_GetFunctionName) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
diff --git a/deps/v8/src/runtime/runtime-promise.cc b/deps/v8/src/runtime/runtime-promise.cc
index d1b63a2fc87..4d1c5ea9d2a 100644
--- a/deps/v8/src/runtime/runtime-promise.cc
+++ b/deps/v8/src/runtime/runtime-promise.cc
@@ -260,5 +260,62 @@ RUNTIME_FUNCTION(Runtime_ResolvePromise) {
   return *result;
 }
 
+// A helper function to be called when constructing AggregateError objects. This
+// takes care of the Error-related construction, e.g., stack traces.
+RUNTIME_FUNCTION(Runtime_ConstructAggregateErrorHelper) {
+  DCHECK(FLAG_harmony_promise_any);
+  HandleScope scope(isolate);
+  DCHECK_EQ(3, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSFunction, target, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, new_target, 1);
+  CONVERT_ARG_HANDLE_CHECKED(Object, message, 2);
+
+  DCHECK_EQ(*target, *isolate->aggregate_error_function());
+
+  Handle<Object> result;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, result,
+      ErrorUtils::Construct(isolate, target, new_target, message));
+  return *result;
+}
+
+// A helper function to be called when constructing AggregateError objects. This
+// takes care of the Error-related construction, e.g., stack traces.
+RUNTIME_FUNCTION(Runtime_ConstructInternalAggregateErrorHelper) {
+  DCHECK(FLAG_harmony_promise_any);
+  HandleScope scope(isolate);
+  DCHECK_GE(args.length(), 1);
+  CONVERT_ARG_HANDLE_CHECKED(Smi, message, 0);
+
+  Handle<Object> arg0;
+  if (args.length() >= 2) {
+    DCHECK(args[1].IsObject());
+    arg0 = args.at<Object>(1);
+  }
+
+  Handle<Object> arg1;
+  if (args.length() >= 3) {
+    DCHECK(args[2].IsObject());
+    arg1 = args.at<Object>(2);
+  }
+
+  Handle<Object> arg2;
+  if (args.length() >= 4) {
+    CHECK(args[3].IsObject());
+    arg2 = args.at<Object>(3);
+  }
+
+  Handle<Object> message_string = MessageFormatter::Format(
+      isolate, MessageTemplate(message->value()), arg0, arg1, arg2);
+
+  Handle<Object> result;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, result,
+      ErrorUtils::Construct(isolate, isolate->aggregate_error_function(),
+                            isolate->aggregate_error_function(),
+                            message_string));
+  return *result;
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-regexp.cc b/deps/v8/src/runtime/runtime-regexp.cc
index 1d6cad9465b..a1ec2967314 100644
--- a/deps/v8/src/runtime/runtime-regexp.cc
+++ b/deps/v8/src/runtime/runtime-regexp.cc
@@ -938,8 +938,8 @@ class MatchInfoBackedMatch : public String::Match {
         *capture_name_map_);
 
     if (capture_index == -1) {
-      *state = INVALID;
-      return name;  // Arbitrary string handle.
+      *state = UNMATCHED;
+      return isolate_->factory()->empty_string();
     }
 
     DCHECK(1 <= capture_index && capture_index <= CaptureCount());
@@ -1015,15 +1015,6 @@ class VectorBackedMatch : public String::Match {
                                       CaptureState* state) override {
     DCHECK(has_named_captures_);
 
-    Maybe<bool> maybe_capture_exists =
-        JSReceiver::HasProperty(groups_obj_, name);
-    if (maybe_capture_exists.IsNothing()) return MaybeHandle<String>();
-
-    if (!maybe_capture_exists.FromJust()) {
-      *state = INVALID;
-      return name;  // Arbitrary string handle.
-    }
-
     Handle<Object> capture_obj;
     ASSIGN_RETURN_ON_EXCEPTION(isolate_, capture_obj,
                                Object::GetProperty(isolate_, groups_obj_, name),
@@ -1109,7 +1100,7 @@ static Object SearchRegExpMultiple(Isolate* isolate, Handle<String> subject,
         isolate->heap(), *subject, regexp->data(), &last_match_cache,
         RegExpResultsCache::REGEXP_MULTIPLE_INDICES);
     if (cached_answer.IsFixedArray()) {
-      int capture_registers = (capture_count + 1) * 2;
+      int capture_registers = JSRegExp::RegistersForCaptureCount(capture_count);
       int32_t* last_match = NewArray<int32_t>(capture_registers);
       for (int i = 0; i < capture_registers; i++) {
         last_match[i] = Smi::ToInt(last_match_cache.get(i));
@@ -1234,8 +1225,7 @@ static Object SearchRegExpMultiple(Isolate* isolate, Handle<String> subject,
 
     if (subject_length > kMinLengthToCache) {
       // Store the last successful match into the array for caching.
-      // TODO(yangguo): do not expose last match to JS and simplify caching.
-      int capture_registers = (capture_count + 1) * 2;
+      int capture_registers = JSRegExp::RegistersForCaptureCount(capture_count);
       Handle<FixedArray> last_match_cache =
           isolate->factory()->NewFixedArray(capture_registers);
       int32_t* last_match = global_cache.LastSuccessfulMatch();
diff --git a/deps/v8/src/runtime/runtime-scopes.cc b/deps/v8/src/runtime/runtime-scopes.cc
index 52abeef5833..70ee3326319 100644
--- a/deps/v8/src/runtime/runtime-scopes.cc
+++ b/deps/v8/src/runtime/runtime-scopes.cc
@@ -18,6 +18,8 @@
 #include "src/objects/module-inl.h"
 #include "src/objects/smi.h"
 #include "src/runtime/runtime-utils.h"
+#include "torque-generated/exported-class-definitions-tq-inl.h"
+#include "torque-generated/exported-class-definitions-tq.h"
 
 namespace v8 {
 namespace internal {
@@ -408,20 +410,19 @@ Handle<JSObject> NewSloppyArguments(Isolate* isolate, Handle<JSFunction> callee,
   if (argument_count > 0) {
     if (parameter_count > 0) {
       int mapped_count = Min(argument_count, parameter_count);
-      Handle<FixedArray> parameter_map = isolate->factory()->NewFixedArray(
-          mapped_count + 2, AllocationType::kYoung);
-      parameter_map->set_map(
-          ReadOnlyRoots(isolate).sloppy_arguments_elements_map());
-      result->set_map(isolate->native_context()->fast_aliased_arguments_map());
-      result->set_elements(*parameter_map);
 
       // Store the context and the arguments array at the beginning of the
       // parameter map.
       Handle<Context> context(isolate->context(), isolate);
       Handle<FixedArray> arguments = isolate->factory()->NewFixedArray(
           argument_count, AllocationType::kYoung);
-      parameter_map->set(0, *context);
-      parameter_map->set(1, *arguments);
+
+      Handle<SloppyArgumentsElements> parameter_map =
+          isolate->factory()->NewSloppyArgumentsElements(
+              mapped_count, context, arguments, AllocationType::kYoung);
+
+      result->set_map(isolate->native_context()->fast_aliased_arguments_map());
+      result->set_elements(*parameter_map);
 
       // Loop over the actual parameters backwards.
       int index = argument_count - 1;
@@ -438,7 +439,8 @@ Handle<JSObject> NewSloppyArguments(Isolate* isolate, Handle<JSFunction> callee,
       // arguments object.
       for (int i = 0; i < mapped_count; i++) {
         arguments->set(i, parameters[i]);
-        parameter_map->set_the_hole(i + 2);
+        parameter_map->set_mapped_entries(
+            i, *isolate->factory()->the_hole_value());
       }
 
       // Walk all context slots to find context allocated parameters. Mark each
@@ -449,7 +451,7 @@ Handle<JSObject> NewSloppyArguments(Isolate* isolate, Handle<JSFunction> callee,
         if (parameter >= mapped_count) continue;
         arguments->set_the_hole(parameter);
         Smi slot = Smi::FromInt(scope_info->ContextHeaderLength() + i);
-        parameter_map->set(parameter + 2, slot);
+        parameter_map->set_mapped_entries(parameter, slot);
       }
     } else {
       // If there is no aliasing, the arguments object elements are not
@@ -487,8 +489,7 @@ class ParameterArguments {
 
 }  // namespace
 
-
-RUNTIME_FUNCTION(Runtime_NewSloppyArguments_Generic) {
+RUNTIME_FUNCTION(Runtime_NewSloppyArguments) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, callee, 0);
@@ -501,7 +502,6 @@ RUNTIME_FUNCTION(Runtime_NewSloppyArguments_Generic) {
   return *NewSloppyArguments(isolate, callee, argument_getter, argument_count);
 }
 
-
 RUNTIME_FUNCTION(Runtime_NewStrictArguments) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -552,37 +552,6 @@ RUNTIME_FUNCTION(Runtime_NewRestParameter) {
   return *result;
 }
 
-
-RUNTIME_FUNCTION(Runtime_NewSloppyArguments) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, callee, 0);
-  StackFrameIterator iterator(isolate);
-
-  // Stub/interpreter handler frame
-  iterator.Advance();
-  DCHECK(iterator.frame()->type() == StackFrame::STUB);
-
-  // Function frame
-  iterator.Advance();
-  JavaScriptFrame* function_frame = JavaScriptFrame::cast(iterator.frame());
-  DCHECK(function_frame->is_java_script());
-  int argc = function_frame->ComputeParametersCount();
-  Address fp = function_frame->fp();
-  if (function_frame->has_adapted_arguments()) {
-    iterator.Advance();
-    ArgumentsAdaptorFrame* adaptor_frame =
-        ArgumentsAdaptorFrame::cast(iterator.frame());
-    argc = adaptor_frame->ComputeParametersCount();
-    fp = adaptor_frame->fp();
-  }
-
-  Address parameters =
-      fp + argc * kSystemPointerSize + StandardFrameConstants::kCallerSPOffset;
-  ParameterArguments argument_getter(parameters);
-  return *NewSloppyArguments(isolate, callee, argument_getter, argc);
-}
-
 RUNTIME_FUNCTION(Runtime_NewArgumentsElements) {
   HandleScope scope(isolate);
   DCHECK_EQ(3, args.length());
diff --git a/deps/v8/src/runtime/runtime-test.cc b/deps/v8/src/runtime/runtime-test.cc
index 220a4a473ca..18504a03e21 100644
--- a/deps/v8/src/runtime/runtime-test.cc
+++ b/deps/v8/src/runtime/runtime-test.cc
@@ -28,6 +28,7 @@
 #include "src/objects/js-array-inl.h"
 #include "src/objects/js-regexp-inl.h"
 #include "src/objects/smi.h"
+#include "src/snapshot/snapshot.h"
 #include "src/trap-handler/trap-handler.h"
 #include "src/utils/ostreams.h"
 #include "src/wasm/memory-tracing.h"
@@ -111,6 +112,26 @@ bool WasmInstanceOverride(const v8::FunctionCallbackInfo<v8::Value>& args) {
   return true;
 }
 
+V8_WARN_UNUSED_RESULT Object CrashUnlessFuzzing(Isolate* isolate) {
+  CHECK(FLAG_fuzzing);
+  return ReadOnlyRoots(isolate).undefined_value();
+}
+
+// Assert that the given argument is a number within the Int32 range
+// and convert it to int32_t.  If the argument is not an Int32 we crash if not
+// in fuzzing mode.
+#define CONVERT_INT32_ARG_FUZZ_SAFE(name, index)                   \
+  if (!args[index].IsNumber()) return CrashUnlessFuzzing(isolate); \
+  int32_t name = 0;                                                \
+  if (!args[index].ToInt32(&name)) return CrashUnlessFuzzing(isolate);
+
+// Cast the given object to a boolean and store it in a variable with
+// the given name.  If the object is not a boolean we crash if not in
+// fuzzing mode.
+#define CONVERT_BOOLEAN_ARG_FUZZ_SAFE(name, index)                  \
+  if (!args[index].IsBoolean()) return CrashUnlessFuzzing(isolate); \
+  bool name = args[index].IsTrue(isolate);
+
 }  // namespace
 
 RUNTIME_FUNCTION(Runtime_ClearMegamorphicStubCache) {
@@ -163,18 +184,13 @@ RUNTIME_FUNCTION(Runtime_DeoptimizeFunction) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
 
-  // This function is used by fuzzers to get coverage in compiler.
-  // Ignore calls on non-function objects to avoid runtime errors.
   CONVERT_ARG_HANDLE_CHECKED(Object, function_object, 0);
-  if (!function_object->IsJSFunction()) {
-    return ReadOnlyRoots(isolate).undefined_value();
-  }
+  if (!function_object->IsJSFunction()) return CrashUnlessFuzzing(isolate);
   Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
 
-  // If the function is not optimized, just return.
-  if (!function->IsOptimized()) return ReadOnlyRoots(isolate).undefined_value();
-
-  Deoptimizer::DeoptimizeFunction(*function);
+  if (function->IsOptimized()) {
+    Deoptimizer::DeoptimizeFunction(*function);
+  }
 
   return ReadOnlyRoots(isolate).undefined_value();
 }
@@ -188,12 +204,11 @@ RUNTIME_FUNCTION(Runtime_DeoptimizeNow) {
   // Find the JavaScript function on the top of the stack.
   JavaScriptFrameIterator it(isolate);
   if (!it.done()) function = handle(it.frame()->function(), isolate);
-  if (function.is_null()) return ReadOnlyRoots(isolate).undefined_value();
-
-  // If the function is not optimized, just return.
-  if (!function->IsOptimized()) return ReadOnlyRoots(isolate).undefined_value();
+  if (function.is_null()) return CrashUnlessFuzzing(isolate);
 
-  Deoptimizer::DeoptimizeFunction(*function);
+  if (function->IsOptimized()) {
+    Deoptimizer::DeoptimizeFunction(*function);
+  }
 
   return ReadOnlyRoots(isolate).undefined_value();
 }
@@ -238,24 +253,19 @@ RUNTIME_FUNCTION(Runtime_IsConcurrentRecompilationSupported) {
 RUNTIME_FUNCTION(Runtime_OptimizeFunctionOnNextCall) {
   HandleScope scope(isolate);
 
-  // This function is used by fuzzers, ignore calls with bogus arguments count.
   if (args.length() != 1 && args.length() != 2) {
-    return ReadOnlyRoots(isolate).undefined_value();
+    return CrashUnlessFuzzing(isolate);
   }
 
-  // This function is used by fuzzers to get coverage for optimizations
-  // in compiler. Ignore calls on non-function objects to avoid runtime errors.
   CONVERT_ARG_HANDLE_CHECKED(Object, function_object, 0);
-  if (!function_object->IsJSFunction()) {
-    return ReadOnlyRoots(isolate).undefined_value();
-  }
+  if (!function_object->IsJSFunction()) return CrashUnlessFuzzing(isolate);
   Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
 
   // The following conditions were lifted (in part) from the DCHECK inside
   // JSFunction::MarkForOptimization().
 
   if (!function->shared().allows_lazy_compilation()) {
-    return ReadOnlyRoots(isolate).undefined_value();
+    return CrashUnlessFuzzing(isolate);
   }
 
   // If function isn't compiled, compile it now.
@@ -263,19 +273,19 @@ RUNTIME_FUNCTION(Runtime_OptimizeFunctionOnNextCall) {
   if (!is_compiled_scope.is_compiled() &&
       !Compiler::Compile(function, Compiler::CLEAR_EXCEPTION,
                          &is_compiled_scope)) {
-    return ReadOnlyRoots(isolate).undefined_value();
+    return CrashUnlessFuzzing(isolate);
   }
 
-  if (!FLAG_opt || (function->shared().optimization_disabled() &&
-                    function->shared().disable_optimization_reason() ==
-                        BailoutReason::kNeverOptimize)) {
-    return ReadOnlyRoots(isolate).undefined_value();
-  }
+  if (!FLAG_opt) return ReadOnlyRoots(isolate).undefined_value();
 
-  if (function->shared().HasAsmWasmData()) {
-    return ReadOnlyRoots(isolate).undefined_value();
+  if (function->shared().optimization_disabled() &&
+      function->shared().disable_optimization_reason() ==
+          BailoutReason::kNeverOptimize) {
+    return CrashUnlessFuzzing(isolate);
   }
 
+  if (function->shared().HasAsmWasmData()) return CrashUnlessFuzzing(isolate);
+
   if (FLAG_testing_d8_test_runner) {
     PendingOptimizationTable::MarkedForOptimization(isolate, function);
   }
@@ -290,11 +300,8 @@ RUNTIME_FUNCTION(Runtime_OptimizeFunctionOnNextCall) {
 
   ConcurrencyMode concurrency_mode = ConcurrencyMode::kNotConcurrent;
   if (args.length() == 2) {
-    // Ignore invalid inputs produced by fuzzers.
     CONVERT_ARG_HANDLE_CHECKED(Object, type, 1);
-    if (!type->IsString()) {
-      return ReadOnlyRoots(isolate).undefined_value();
-    }
+    if (!type->IsString()) return CrashUnlessFuzzing(isolate);
     if (Handle<String>::cast(type)->IsOneByteEqualTo(
             StaticCharVector("concurrent")) &&
         isolate->concurrent_recompilation_enabled()) {
@@ -355,9 +362,6 @@ bool EnsureFeedbackVector(Handle<JSFunction> function) {
 RUNTIME_FUNCTION(Runtime_EnsureFeedbackVectorForFunction) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
-  if (!args[0].IsJSFunction()) {
-    return ReadOnlyRoots(isolate).undefined_value();
-  }
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
   EnsureFeedbackVector(function);
   return ReadOnlyRoots(isolate).undefined_value();
@@ -366,16 +370,13 @@ RUNTIME_FUNCTION(Runtime_EnsureFeedbackVectorForFunction) {
 RUNTIME_FUNCTION(Runtime_PrepareFunctionForOptimization) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 1 || args.length() == 2);
-  if (!args[0].IsJSFunction()) {
-    return ReadOnlyRoots(isolate).undefined_value();
-  }
+  if (!args[0].IsJSFunction()) return CrashUnlessFuzzing(isolate);
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
 
   bool allow_heuristic_optimization = false;
   if (args.length() == 2) {
     CONVERT_ARG_HANDLE_CHECKED(Object, sync_object, 1);
-    if (!sync_object->IsString())
-      return ReadOnlyRoots(isolate).undefined_value();
+    if (!sync_object->IsString()) return CrashUnlessFuzzing(isolate);
     Handle<String> sync = Handle<String>::cast(sync_object);
     if (sync->IsOneByteEqualTo(
             StaticCharVector("allow heuristic optimization"))) {
@@ -384,7 +385,7 @@ RUNTIME_FUNCTION(Runtime_PrepareFunctionForOptimization) {
   }
 
   if (!EnsureFeedbackVector(function)) {
-    return ReadOnlyRoots(isolate).undefined_value();
+    return CrashUnlessFuzzing(isolate);
   }
 
   // If optimization is disabled for the function, return without making it
@@ -392,13 +393,10 @@ RUNTIME_FUNCTION(Runtime_PrepareFunctionForOptimization) {
   if (function->shared().optimization_disabled() &&
       function->shared().disable_optimization_reason() ==
           BailoutReason::kNeverOptimize) {
-    return ReadOnlyRoots(isolate).undefined_value();
+    return CrashUnlessFuzzing(isolate);
   }
 
-  // We don't optimize Asm/Wasm functions.
-  if (function->shared().HasAsmWasmData()) {
-    return ReadOnlyRoots(isolate).undefined_value();
-  }
+  if (function->shared().HasAsmWasmData()) return CrashUnlessFuzzing(isolate);
 
   // Hold onto the bytecode array between marking and optimization to ensure
   // it's not flushed.
@@ -417,18 +415,24 @@ RUNTIME_FUNCTION(Runtime_OptimizeOsr) {
   Handle<JSFunction> function;
 
   // The optional parameter determines the frame being targeted.
-  int stack_depth = args.length() == 1 ? args.smi_at(0) : 0;
+  int stack_depth = 0;
+  if (args.length() == 1) {
+    if (!args[0].IsSmi()) return CrashUnlessFuzzing(isolate);
+    stack_depth = args.smi_at(0);
+  }
 
   // Find the JavaScript function on the top of the stack.
   JavaScriptFrameIterator it(isolate);
   while (!it.done() && stack_depth--) it.Advance();
   if (!it.done()) function = handle(it.frame()->function(), isolate);
-  if (function.is_null()) return ReadOnlyRoots(isolate).undefined_value();
+  if (function.is_null()) return CrashUnlessFuzzing(isolate);
 
-  if (!FLAG_opt || (function->shared().optimization_disabled() &&
-                    function->shared().disable_optimization_reason() ==
-                        BailoutReason::kNeverOptimize)) {
-    return ReadOnlyRoots(isolate).undefined_value();
+  if (!FLAG_opt) return ReadOnlyRoots(isolate).undefined_value();
+
+  if (function->shared().optimization_disabled() &&
+      function->shared().disable_optimization_reason() ==
+          BailoutReason::kNeverOptimize) {
+    return CrashUnlessFuzzing(isolate);
   }
 
   if (FLAG_testing_d8_test_runner) {
@@ -470,14 +474,15 @@ RUNTIME_FUNCTION(Runtime_OptimizeOsr) {
 RUNTIME_FUNCTION(Runtime_NeverOptimizeFunction) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
-  // This function is used by fuzzers to get coverage for optimizations
-  // in compiler. Ignore calls on non-function objects to avoid runtime errors.
   CONVERT_ARG_HANDLE_CHECKED(Object, function_object, 0);
-  if (!function_object->IsJSFunction()) {
-    return ReadOnlyRoots(isolate).undefined_value();
-  }
+  if (!function_object->IsJSFunction()) return CrashUnlessFuzzing(isolate);
   Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
-  function->shared().DisableOptimization(BailoutReason::kNeverOptimize);
+  SharedFunctionInfo sfi = function->shared();
+  if (sfi.abstract_code().kind() != AbstractCode::INTERPRETED_FUNCTION &&
+      sfi.abstract_code().kind() != AbstractCode::BUILTIN) {
+    return CrashUnlessFuzzing(isolate);
+  }
+  sfi.DisableOptimization(BailoutReason::kNeverOptimize);
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
@@ -500,23 +505,25 @@ RUNTIME_FUNCTION(Runtime_GetOptimizationStatus) {
     status |= static_cast<int>(OptimizationStatus::kMaybeDeopted);
   }
 
-  // This function is used by fuzzers to get coverage for optimizations
-  // in compiler. Ignore calls on non-function objects to avoid runtime errors.
   CONVERT_ARG_HANDLE_CHECKED(Object, function_object, 0);
-  if (!function_object->IsJSFunction()) {
-    return Smi::FromInt(status);
-  }
+  if (function_object->IsUndefined()) return Smi::FromInt(status);
+  if (!function_object->IsJSFunction()) return CrashUnlessFuzzing(isolate);
   Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
+
   status |= static_cast<int>(OptimizationStatus::kIsFunction);
 
   bool sync_with_compiler_thread = true;
   if (args.length() == 2) {
     CONVERT_ARG_HANDLE_CHECKED(Object, sync_object, 1);
-    if (!sync_object->IsString())
-      return ReadOnlyRoots(isolate).undefined_value();
+    if (!sync_object->IsString()) return CrashUnlessFuzzing(isolate);
     Handle<String> sync = Handle<String>::cast(sync_object);
     if (sync->IsOneByteEqualTo(StaticCharVector("no sync"))) {
       sync_with_compiler_thread = false;
+    } else if (sync->IsOneByteEqualTo(StaticCharVector("sync")) ||
+               sync->length() == 0) {
+      DCHECK(sync_with_compiler_thread);
+    } else {
+      return CrashUnlessFuzzing(isolate);
     }
   }
 
@@ -575,29 +582,25 @@ RUNTIME_FUNCTION(Runtime_GetOptimizationStatus) {
 
 RUNTIME_FUNCTION(Runtime_UnblockConcurrentRecompilation) {
   DCHECK_EQ(0, args.length());
-  if (FLAG_block_concurrent_recompilation &&
-      isolate->concurrent_recompilation_enabled()) {
-    isolate->optimizing_compile_dispatcher()->Unblock();
-  }
+  CHECK(FLAG_block_concurrent_recompilation);
+  CHECK(isolate->concurrent_recompilation_enabled());
+  isolate->optimizing_compile_dispatcher()->Unblock();
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
-static void ReturnThis(const v8::FunctionCallbackInfo<v8::Value>& args) {
-  args.GetReturnValue().Set(args.This());
+static void ReturnNull(const v8::FunctionCallbackInfo<v8::Value>& args) {
+  args.GetReturnValue().SetNull();
 }
 
 RUNTIME_FUNCTION(Runtime_GetUndetectable) {
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
-
   Local<v8::ObjectTemplate> desc = v8::ObjectTemplate::New(v8_isolate);
   desc->MarkAsUndetectable();
-  desc->SetCallAsFunctionHandler(ReturnThis);
-  Local<v8::Object> obj;
-  if (!desc->NewInstance(v8_isolate->GetCurrentContext()).ToLocal(&obj)) {
-    return Object();
-  }
+  desc->SetCallAsFunctionHandler(ReturnNull);
+  Local<v8::Object> obj =
+      desc->NewInstance(v8_isolate->GetCurrentContext()).ToLocalChecked();
   return *Utils::OpenHandle(*obj);
 }
 
@@ -630,9 +633,6 @@ RUNTIME_FUNCTION(Runtime_GetCallable) {
 RUNTIME_FUNCTION(Runtime_ClearFunctionFeedback) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
-  if (!args[0].IsJSFunction()) {
-    return ReadOnlyRoots(isolate).undefined_value();
-  }
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
   function->ClearTypeFeedbackInfo();
   return ReadOnlyRoots(isolate).undefined_value();
@@ -672,15 +672,15 @@ RUNTIME_FUNCTION(Runtime_SetAllocationTimeout) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 2 || args.length() == 3);
 #ifdef V8_ENABLE_ALLOCATION_TIMEOUT
-  CONVERT_INT32_ARG_CHECKED(timeout, 1);
+  CONVERT_INT32_ARG_FUZZ_SAFE(timeout, 1);
   isolate->heap()->set_allocation_timeout(timeout);
 #endif
 #ifdef DEBUG
-  CONVERT_INT32_ARG_CHECKED(interval, 0);
+  CONVERT_INT32_ARG_FUZZ_SAFE(interval, 0);
   FLAG_gc_interval = interval;
   if (args.length() == 3) {
     // Enable/disable inline allocation if requested.
-    CONVERT_BOOLEAN_ARG_CHECKED(inline_allocation, 2);
+    CONVERT_BOOLEAN_ARG_FUZZ_SAFE(inline_allocation, 2);
     if (inline_allocation) {
       isolate->heap()->EnableInlineAllocation();
     } else {
@@ -816,24 +816,19 @@ RUNTIME_FUNCTION(Runtime_DebugTrackRetainingPath) {
   HandleScope scope(isolate);
   DCHECK_LE(1, args.length());
   DCHECK_GE(2, args.length());
-  if (!FLAG_track_retaining_path) {
-    PrintF("DebugTrackRetainingPath requires --track-retaining-path flag.\n");
-  } else {
-    CONVERT_ARG_HANDLE_CHECKED(HeapObject, object, 0);
-    RetainingPathOption option = RetainingPathOption::kDefault;
-    if (args.length() == 2) {
-      CONVERT_ARG_HANDLE_CHECKED(String, str, 1);
-      const char track_ephemeron_path[] = "track-ephemeron-path";
-      if (str->IsOneByteEqualTo(StaticCharVector(track_ephemeron_path))) {
-        option = RetainingPathOption::kTrackEphemeronPath;
-      } else if (str->length() != 0) {
-        PrintF("Unexpected second argument of DebugTrackRetainingPath.\n");
-        PrintF("Expected an empty string or '%s', got '%s'.\n",
-               track_ephemeron_path, str->ToCString().get());
-      }
+  CHECK(FLAG_track_retaining_path);
+  CONVERT_ARG_HANDLE_CHECKED(HeapObject, object, 0);
+  RetainingPathOption option = RetainingPathOption::kDefault;
+  if (args.length() == 2) {
+    CONVERT_ARG_HANDLE_CHECKED(String, str, 1);
+    const char track_ephemeron_path[] = "track-ephemeron-path";
+    if (str->IsOneByteEqualTo(StaticCharVector(track_ephemeron_path))) {
+      option = RetainingPathOption::kTrackEphemeronPath;
+    } else {
+      CHECK_EQ(str->length(), 0);
     }
-    isolate->heap()->AddRetainingPathTarget(object, option);
   }
+  isolate->heap()->AddRetainingPathTarget(object, option);
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
@@ -919,10 +914,8 @@ RUNTIME_FUNCTION(Runtime_DisassembleFunction) {
   // Get the function and make sure it is compiled.
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, func, 0);
   IsCompiledScope is_compiled_scope;
-  if (!func->is_compiled() &&
-      !Compiler::Compile(func, Compiler::KEEP_EXCEPTION, &is_compiled_scope)) {
-    return ReadOnlyRoots(isolate).exception();
-  }
+  CHECK(func->is_compiled() ||
+        Compiler::Compile(func, Compiler::KEEP_EXCEPTION, &is_compiled_scope));
   StdoutStream os;
   func->code().Print(os);
   os << std::endl;
@@ -959,7 +952,6 @@ RUNTIME_FUNCTION(Runtime_TraceEnter) {
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
-
 RUNTIME_FUNCTION(Runtime_TraceExit) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
@@ -971,6 +963,14 @@ RUNTIME_FUNCTION(Runtime_TraceExit) {
   return obj;  // return TOS
 }
 
+RUNTIME_FUNCTION(Runtime_WasmTraceEnter) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(0, args.length());
+  // TODO(10559): Print more useful info here.
+  PrintF("Enter function\n");
+  return ReadOnlyRoots(isolate).undefined_value();
+}
+
 RUNTIME_FUNCTION(Runtime_HaveSameMap) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(2, args.length());
@@ -1001,7 +1001,6 @@ RUNTIME_FUNCTION(Runtime_IsAsmWasmCode) {
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_CHECKED(JSFunction, function, 0);
   if (!function.shared().HasAsmWasmData()) {
-    // Doesn't have wasm data.
     return ReadOnlyRoots(isolate).false_value();
   }
   if (function.shared().HasBuiltinId() &&
@@ -1080,13 +1079,12 @@ RUNTIME_FUNCTION(Runtime_GetWasmExceptionId) {
   CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 1);
   Handle<Object> tag =
       WasmExceptionPackage::GetExceptionTag(isolate, exception);
-  if (tag->IsWasmExceptionTag()) {
-    Handle<FixedArray> exceptions_table(instance->exceptions_table(), isolate);
-    for (int index = 0; index < exceptions_table->length(); ++index) {
-      if (exceptions_table->get(index) == *tag) return Smi::FromInt(index);
-    }
+  CHECK(tag->IsWasmExceptionTag());
+  Handle<FixedArray> exceptions_table(instance->exceptions_table(), isolate);
+  for (int index = 0; index < exceptions_table->length(); ++index) {
+    if (exceptions_table->get(index) == *tag) return Smi::FromInt(index);
   }
-  return ReadOnlyRoots(isolate).undefined_value();
+  UNREACHABLE();
 }
 
 RUNTIME_FUNCTION(Runtime_GetWasmExceptionValues) {
@@ -1102,7 +1100,6 @@ RUNTIME_FUNCTION(Runtime_GetWasmExceptionValues) {
 
 namespace {
 bool EnableWasmThreads(v8::Local<v8::Context> context) { return true; }
-
 bool DisableWasmThreads(v8::Local<v8::Context> context) { return false; }
 }  // namespace
 
@@ -1203,6 +1200,22 @@ RUNTIME_FUNCTION(Runtime_StringIteratorProtector) {
       Protectors::IsStringIteratorLookupChainIntact(isolate));
 }
 
+// For use by tests and fuzzers. It
+//
+// 1. serializes a snapshot of the current isolate,
+// 2. deserializes the snapshot,
+// 3. and runs VerifyHeap on the resulting isolate.
+//
+// The current isolate should not be modified by this call and can keep running
+// once it completes.
+RUNTIME_FUNCTION(Runtime_SerializeDeserializeNow) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(0, args.length());
+  Snapshot::SerializeDeserializeAndVerifyForTesting(isolate,
+                                                    isolate->native_context());
+  return ReadOnlyRoots(isolate).undefined_value();
+}
+
 // Take a compiled wasm module and serialize it into an array buffer, which is
 // then returned.
 RUNTIME_FUNCTION(Runtime_SerializeWasmModule) {
@@ -1226,8 +1239,7 @@ RUNTIME_FUNCTION(Runtime_SerializeWasmModule) {
     return *array_buffer;
   }
 
-  // Error. Return undefined.
-  return ReadOnlyRoots(isolate).undefined_value();
+  UNREACHABLE();
 }
 
 // Take an array buffer and attempt to reconstruct a compiled wasm module.
@@ -1268,7 +1280,7 @@ RUNTIME_FUNCTION(Runtime_CloneWasmModule) {
 
   Handle<WasmModuleObject> new_module_object =
       isolate->wasm_engine()->ImportNativeModule(
-          isolate, module_object->shared_native_module());
+          isolate, module_object->shared_native_module(), {});
 
   return *new_module_object;
 }
@@ -1315,15 +1327,6 @@ RUNTIME_FUNCTION(Runtime_WasmGetNumberOfInstances) {
   return Smi::FromInt(instance_count);
 }
 
-RUNTIME_FUNCTION(Runtime_WasmNumInterpretedCalls) {
-  DCHECK_EQ(1, args.length());
-  HandleScope scope(isolate);
-  CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
-  if (!instance->has_debug_info()) return Object();
-  uint64_t num = instance->debug_info().NumInterpretedCalls();
-  return *isolate->factory()->NewNumberFromSize(static_cast<size_t>(num));
-}
-
 RUNTIME_FUNCTION(Runtime_WasmNumCodeSpaces) {
   DCHECK_EQ(1, args.length());
   HandleScope scope(isolate);
@@ -1340,18 +1343,6 @@ RUNTIME_FUNCTION(Runtime_WasmNumCodeSpaces) {
   return *isolate->factory()->NewNumberFromSize(num_spaces);
 }
 
-RUNTIME_FUNCTION(Runtime_RedirectToWasmInterpreter) {
-  DCHECK_EQ(2, args.length());
-  HandleScope scope(isolate);
-  CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
-  CONVERT_SMI_ARG_CHECKED(function_index, 1);
-  Handle<WasmDebugInfo> debug_info =
-      WasmInstanceObject::GetOrCreateDebugInfo(instance);
-  WasmDebugInfo::RedirectToInterpreter(debug_info,
-                                       Vector<int>(&function_index, 1));
-  return ReadOnlyRoots(isolate).undefined_value();
-}
-
 RUNTIME_FUNCTION(Runtime_WasmTraceMemory) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -1365,7 +1356,7 @@ RUNTIME_FUNCTION(Runtime_WasmTraceMemory) {
   StackTraceFrameIterator it(isolate);
   DCHECK(!it.done());
   DCHECK(it.is_wasm());
-  WasmCompiledFrame* frame = WasmCompiledFrame::cast(it.frame());
+  WasmFrame* frame = WasmFrame::cast(it.frame());
 
   uint8_t* mem_start = reinterpret_cast<uint8_t*>(
       frame->wasm_instance().memory_object().array_buffer().backing_store());
@@ -1399,7 +1390,8 @@ RUNTIME_FUNCTION(Runtime_WasmTierDownModule) {
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
   auto* native_module = instance->module_object().native_module();
-  native_module->TierDown(isolate);
+  native_module->SetTieringState(wasm::kTieredDown);
+  native_module->TriggerRecompilation();
   CHECK(!native_module->compilation_state()->failed());
   return ReadOnlyRoots(isolate).undefined_value();
 }
@@ -1409,7 +1401,8 @@ RUNTIME_FUNCTION(Runtime_WasmTierUpModule) {
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
   auto* native_module = instance->module_object().native_module();
-  native_module->TierUp(isolate);
+  native_module->SetTieringState(wasm::kTieredUp);
+  native_module->TriggerRecompilation();
   CHECK(!native_module->compilation_state()->failed());
   return ReadOnlyRoots(isolate).undefined_value();
 }
diff --git a/deps/v8/src/runtime/runtime-wasm.cc b/deps/v8/src/runtime/runtime-wasm.cc
index f65922064f1..72b98fc6f23 100644
--- a/deps/v8/src/runtime/runtime-wasm.cc
+++ b/deps/v8/src/runtime/runtime-wasm.cc
@@ -17,6 +17,7 @@
 #include "src/runtime/runtime-utils.h"
 #include "src/trap-handler/trap-handler.h"
 #include "src/wasm/module-compiler.h"
+#include "src/wasm/value-type.h"
 #include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-constants.h"
 #include "src/wasm/wasm-debug.h"
@@ -53,7 +54,7 @@ class FrameFinder {
 };
 
 WasmInstanceObject GetWasmInstanceOnStackTop(Isolate* isolate) {
-  return FrameFinder<WasmCompiledFrame, StackFrame::EXIT>(isolate)
+  return FrameFinder<WasmFrame, StackFrame::EXIT>(isolate)
       .frame()
       ->wasm_instance();
 }
@@ -86,6 +87,8 @@ Object ThrowWasmError(Isolate* isolate, MessageTemplate message) {
 }  // namespace
 
 RUNTIME_FUNCTION(Runtime_WasmIsValidFuncRefValue) {
+  // This code is called from wrappers, so the "thread is wasm" flag is not set.
+  DCHECK(!trap_handler::IsThreadInWasm());
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, function, 0);
@@ -100,6 +103,7 @@ RUNTIME_FUNCTION(Runtime_WasmIsValidFuncRefValue) {
 }
 
 RUNTIME_FUNCTION(Runtime_WasmMemoryGrow) {
+  ClearThreadInWasmScope flag_scope;
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
@@ -107,9 +111,6 @@ RUNTIME_FUNCTION(Runtime_WasmMemoryGrow) {
   // which calls this runtime function.
   CONVERT_UINT32_ARG_CHECKED(delta_pages, 1);
 
-  // This runtime function is always being called from wasm code.
-  ClearThreadInWasmScope flag_scope;
-
   int ret = WasmMemoryObject::Grow(
       isolate, handle(instance->memory_object(), isolate), delta_pages);
   // The WasmMemoryGrow builtin which calls this runtime function expects us to
@@ -125,12 +126,17 @@ RUNTIME_FUNCTION(Runtime_ThrowWasmError) {
 }
 
 RUNTIME_FUNCTION(Runtime_ThrowWasmStackOverflow) {
+  ClearThreadInWasmScope clear_wasm_flag;
   SealHandleScope shs(isolate);
   DCHECK_LE(0, args.length());
   return isolate->StackOverflow();
 }
 
 RUNTIME_FUNCTION(Runtime_WasmThrowTypeError) {
+  // This runtime function is called both from wasm and from e.g. js-to-js
+  // functions. Hence the "thread in wasm" flag can be either set or not. Both
+  // is OK, since throwing will trigger unwinding anyway, which sets the flag
+  // correctly depending on the handler.
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
   THROW_NEW_ERROR_RETURN_FAILURE(
@@ -138,6 +144,7 @@ RUNTIME_FUNCTION(Runtime_WasmThrowTypeError) {
 }
 
 RUNTIME_FUNCTION(Runtime_WasmThrowCreate) {
+  ClearThreadInWasmScope clear_wasm_flag;
   // TODO(kschimpf): Can this be replaced with equivalent TurboFan code/calls.
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
@@ -163,173 +170,10 @@ RUNTIME_FUNCTION(Runtime_WasmThrowCreate) {
   return *exception;
 }
 
-RUNTIME_FUNCTION(Runtime_WasmExceptionGetTag) {
-  // TODO(kschimpf): Can this be replaced with equivalent TurboFan code/calls.
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  DCHECK(isolate->context().is_null());
-  isolate->set_context(GetNativeContextFromWasmInstanceOnStackTop(isolate));
-  CONVERT_ARG_CHECKED(Object, except_obj_raw, 0);
-  // TODO(wasm): Manually box because parameters are not visited yet.
-  Handle<Object> except_obj(except_obj_raw, isolate);
-  if (!except_obj->IsWasmExceptionPackage(isolate)) {
-    return ReadOnlyRoots(isolate).undefined_value();
-  }
-  Handle<WasmExceptionPackage> exception =
-      Handle<WasmExceptionPackage>::cast(except_obj);
-  return *WasmExceptionPackage::GetExceptionTag(isolate, exception);
-}
-
-RUNTIME_FUNCTION(Runtime_WasmExceptionGetValues) {
-  // TODO(kschimpf): Can this be replaced with equivalent TurboFan code/calls.
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  DCHECK(isolate->context().is_null());
-  isolate->set_context(GetNativeContextFromWasmInstanceOnStackTop(isolate));
-  CONVERT_ARG_CHECKED(Object, except_obj_raw, 0);
-  // TODO(wasm): Manually box because parameters are not visited yet.
-  Handle<Object> except_obj(except_obj_raw, isolate);
-  if (!except_obj->IsWasmExceptionPackage(isolate)) {
-    return ReadOnlyRoots(isolate).undefined_value();
-  }
-  Handle<WasmExceptionPackage> exception =
-      Handle<WasmExceptionPackage>::cast(except_obj);
-  return *WasmExceptionPackage::GetExceptionValues(isolate, exception);
-}
-
-RUNTIME_FUNCTION(Runtime_WasmRunInterpreter) {
-  DCHECK_EQ(2, args.length());
-  HandleScope scope(isolate);
-  CONVERT_NUMBER_CHECKED(int32_t, func_index, Int32, args[0]);
-  CONVERT_ARG_HANDLE_CHECKED(Object, arg_buffer_obj, 1);
-
-  // The arg buffer is the raw pointer to the caller's stack. It looks like a
-  // Smi (lowest bit not set, as checked by IsSmi), but is no valid Smi. We just
-  // cast it back to the raw pointer.
-  CHECK(!arg_buffer_obj->IsHeapObject());
-  CHECK(arg_buffer_obj->IsSmi());
-  Address arg_buffer = arg_buffer_obj->ptr();
-
-  ClearThreadInWasmScope wasm_flag;
-
-  // Find the frame pointer and instance of the interpreter frame on the stack.
-  Handle<WasmInstanceObject> instance;
-  Address frame_pointer = 0;
-  {
-    FrameFinder<WasmInterpreterEntryFrame, StackFrame::EXIT> frame_finder(
-        isolate);
-    instance = handle(frame_finder.frame()->wasm_instance(), isolate);
-    frame_pointer = frame_finder.frame()->fp();
-  }
-
-  // Reserve buffers for argument and return values.
-  DCHECK_GE(instance->module()->functions.size(), func_index);
-  const wasm::FunctionSig* sig = instance->module()->functions[func_index].sig;
-  DCHECK_GE(kMaxInt, sig->parameter_count());
-  int num_params = static_cast<int>(sig->parameter_count());
-  ScopedVector<wasm::WasmValue> wasm_args(num_params);
-  DCHECK_GE(kMaxInt, sig->return_count());
-  int num_returns = static_cast<int>(sig->return_count());
-  ScopedVector<wasm::WasmValue> wasm_rets(num_returns);
-
-  // Copy the arguments for the {arg_buffer} into a vector of {WasmValue}. This
-  // also boxes reference types into handles, which needs to happen before any
-  // methods that could trigger a GC are being called.
-  Address arg_buf_ptr = arg_buffer;
-  for (int i = 0; i < num_params; ++i) {
-#define CASE_ARG_TYPE(type, ctype)                                     \
-  case wasm::ValueType::type:                                          \
-    DCHECK_EQ(sig->GetParam(i).element_size_bytes(), sizeof(ctype));   \
-    wasm_args[i] =                                                     \
-        wasm::WasmValue(base::ReadUnalignedValue<ctype>(arg_buf_ptr)); \
-    arg_buf_ptr += sizeof(ctype);                                      \
-    break;
-    switch (sig->GetParam(i).kind()) {
-      CASE_ARG_TYPE(kI32, uint32_t)
-      CASE_ARG_TYPE(kI64, uint64_t)
-      CASE_ARG_TYPE(kF32, float)
-      CASE_ARG_TYPE(kF64, double)
-#undef CASE_ARG_TYPE
-      case wasm::ValueType::kAnyRef:
-      case wasm::ValueType::kFuncRef:
-      case wasm::ValueType::kNullRef:
-      case wasm::ValueType::kExnRef: {
-        DCHECK_EQ(sig->GetParam(i).element_size_bytes(), kSystemPointerSize);
-        Handle<Object> ref(
-            Object(base::ReadUnalignedValue<Address>(arg_buf_ptr)), isolate);
-        DCHECK_IMPLIES(sig->GetParam(i) == wasm::kWasmNullRef, ref->IsNull());
-        wasm_args[i] = wasm::WasmValue(ref);
-        arg_buf_ptr += kSystemPointerSize;
-        break;
-      }
-      case wasm::ValueType::kStmt:
-      case wasm::ValueType::kS128:
-      case wasm::ValueType::kBottom:
-        UNREACHABLE();
-    }
-  }
-
-  // Set the current isolate's context.
-  DCHECK(isolate->context().is_null());
-  isolate->set_context(instance->native_context());
-
-  // Run the function in the interpreter. Note that neither the {WasmDebugInfo}
-  // nor the {InterpreterHandle} have to exist, because interpretation might
-  // have been triggered by another Isolate sharing the same WasmEngine.
-  Handle<WasmDebugInfo> debug_info =
-      WasmInstanceObject::GetOrCreateDebugInfo(instance);
-  bool success = WasmDebugInfo::RunInterpreter(
-      isolate, debug_info, frame_pointer, func_index, wasm_args, wasm_rets);
-
-  // Early return on failure.
-  if (!success) {
-    DCHECK(isolate->has_pending_exception());
-    return ReadOnlyRoots(isolate).exception();
-  }
-
-  // Copy return values from the vector of {WasmValue} into {arg_buffer}. This
-  // also un-boxes reference types from handles into raw pointers.
-  arg_buf_ptr = arg_buffer;
-  for (int i = 0; i < num_returns; ++i) {
-#define CASE_RET_TYPE(type, ctype)                                           \
-  case wasm::ValueType::type:                                                \
-    DCHECK_EQ(sig->GetReturn(i).element_size_bytes(), sizeof(ctype));        \
-    base::WriteUnalignedValue<ctype>(arg_buf_ptr, wasm_rets[i].to<ctype>()); \
-    arg_buf_ptr += sizeof(ctype);                                            \
-    break;
-    switch (sig->GetReturn(i).kind()) {
-      CASE_RET_TYPE(kI32, uint32_t)
-      CASE_RET_TYPE(kI64, uint64_t)
-      CASE_RET_TYPE(kF32, float)
-      CASE_RET_TYPE(kF64, double)
-#undef CASE_RET_TYPE
-      case wasm::ValueType::kAnyRef:
-      case wasm::ValueType::kFuncRef:
-      case wasm::ValueType::kNullRef:
-      case wasm::ValueType::kExnRef: {
-        DCHECK_EQ(sig->GetReturn(i).element_size_bytes(), kSystemPointerSize);
-        DCHECK_IMPLIES(sig->GetReturn(i) == wasm::kWasmNullRef,
-                       wasm_rets[i].to_anyref()->IsNull());
-        base::WriteUnalignedValue<Object>(arg_buf_ptr,
-                                          *wasm_rets[i].to_anyref());
-        arg_buf_ptr += kSystemPointerSize;
-        break;
-      }
-      default:
-        UNREACHABLE();
-    }
-  }
-
-  return ReadOnlyRoots(isolate).undefined_value();
-}
-
 RUNTIME_FUNCTION(Runtime_WasmStackGuard) {
+  ClearThreadInWasmScope wasm_flag;
   SealHandleScope shs(isolate);
   DCHECK_EQ(0, args.length());
-  DCHECK(!trap_handler::IsTrapHandlerEnabled() ||
-         trap_handler::IsThreadInWasm());
-
-  ClearThreadInWasmScope wasm_flag;
 
   // Check if this is a real stack overflow.
   StackLimitCheck check(isolate);
@@ -339,14 +183,12 @@ RUNTIME_FUNCTION(Runtime_WasmStackGuard) {
 }
 
 RUNTIME_FUNCTION(Runtime_WasmCompileLazy) {
+  ClearThreadInWasmScope wasm_flag;
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
   CONVERT_SMI_ARG_CHECKED(func_index, 1);
 
-  // This runtime function is always called from wasm code.
-  ClearThreadInWasmScope flag_scope;
-
 #ifdef DEBUG
   FrameFinder<WasmCompileLazyFrame, StackFrame::EXIT> frame_finder(isolate);
   DCHECK_EQ(*instance, frame_finder.frame()->wasm_instance());
@@ -367,7 +209,7 @@ RUNTIME_FUNCTION(Runtime_WasmCompileLazy) {
 }
 
 // Should be called from within a handle scope
-Handle<JSArrayBuffer> getSharedArrayBuffer(Handle<WasmInstanceObject> instance,
+Handle<JSArrayBuffer> GetSharedArrayBuffer(Handle<WasmInstanceObject> instance,
                                            Isolate* isolate, uint32_t address) {
   DCHECK(instance->has_memory_object());
   Handle<JSArrayBuffer> array_buffer(instance->memory_object().array_buffer(),
@@ -389,7 +231,7 @@ RUNTIME_FUNCTION(Runtime_WasmAtomicNotify) {
   CONVERT_NUMBER_CHECKED(uint32_t, address, Uint32, args[1]);
   CONVERT_NUMBER_CHECKED(uint32_t, count, Uint32, args[2]);
   Handle<JSArrayBuffer> array_buffer =
-      getSharedArrayBuffer(instance, isolate, address);
+      GetSharedArrayBuffer(instance, isolate, address);
   return FutexEmulation::Wake(array_buffer, address, count);
 }
 
@@ -403,7 +245,7 @@ RUNTIME_FUNCTION(Runtime_WasmI32AtomicWait) {
   CONVERT_ARG_HANDLE_CHECKED(BigInt, timeout_ns, 3);
 
   Handle<JSArrayBuffer> array_buffer =
-      getSharedArrayBuffer(instance, isolate, address);
+      GetSharedArrayBuffer(instance, isolate, address);
   return FutexEmulation::WaitWasm32(isolate, array_buffer, address,
                                     expected_value, timeout_ns->AsInt64());
 }
@@ -418,7 +260,7 @@ RUNTIME_FUNCTION(Runtime_WasmI64AtomicWait) {
   CONVERT_ARG_HANDLE_CHECKED(BigInt, timeout_ns, 3);
 
   Handle<JSArrayBuffer> array_buffer =
-      getSharedArrayBuffer(instance, isolate, address);
+      GetSharedArrayBuffer(instance, isolate, address);
   return FutexEmulation::WaitWasm64(isolate, array_buffer, address,
                                     expected_value->AsInt64(),
                                     timeout_ns->AsInt64());
@@ -439,15 +281,11 @@ Object ThrowTableOutOfBounds(Isolate* isolate,
 }  // namespace
 
 RUNTIME_FUNCTION(Runtime_WasmRefFunc) {
-  // This runtime function is always being called from wasm code.
   ClearThreadInWasmScope flag_scope;
   HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  auto instance =
-      Handle<WasmInstanceObject>(GetWasmInstanceOnStackTop(isolate), isolate);
-  DCHECK(isolate->context().is_null());
-  isolate->set_context(instance->native_context());
-  CONVERT_UINT32_ARG_CHECKED(function_index, 0);
+  DCHECK_EQ(2, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
+  CONVERT_UINT32_ARG_CHECKED(function_index, 1);
 
   Handle<WasmExternalFunction> function =
       WasmInstanceObject::GetOrCreateWasmExternalFunction(isolate, instance,
@@ -457,9 +295,7 @@ RUNTIME_FUNCTION(Runtime_WasmRefFunc) {
 }
 
 RUNTIME_FUNCTION(Runtime_WasmFunctionTableGet) {
-  // This runtime function is always being called from wasm code.
   ClearThreadInWasmScope flag_scope;
-
   HandleScope scope(isolate);
   DCHECK_EQ(3, args.length());
   CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
@@ -468,6 +304,8 @@ RUNTIME_FUNCTION(Runtime_WasmFunctionTableGet) {
   DCHECK_LT(table_index, instance->tables().length());
   auto table = handle(
       WasmTableObject::cast(instance->tables().get(table_index)), isolate);
+  // We only use the runtime call for lazily initialized function references.
+  DCHECK_EQ(table->type(), wasm::kWasmFuncRef);
 
   if (!WasmTableObject::IsInBounds(isolate, table, entry_index)) {
     return ThrowWasmError(isolate, MessageTemplate::kWasmTrapTableOutOfBounds);
@@ -477,9 +315,7 @@ RUNTIME_FUNCTION(Runtime_WasmFunctionTableGet) {
 }
 
 RUNTIME_FUNCTION(Runtime_WasmFunctionTableSet) {
-  // This runtime function is always being called from wasm code.
   ClearThreadInWasmScope flag_scope;
-
   HandleScope scope(isolate);
   DCHECK_EQ(4, args.length());
   CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
@@ -491,6 +327,8 @@ RUNTIME_FUNCTION(Runtime_WasmFunctionTableSet) {
   DCHECK_LT(table_index, instance->tables().length());
   auto table = handle(
       WasmTableObject::cast(instance->tables().get(table_index)), isolate);
+  // We only use the runtime call for function references.
+  DCHECK_EQ(table->type(), wasm::kWasmFuncRef);
 
   if (!WasmTableObject::IsInBounds(isolate, table, entry_index)) {
     return ThrowWasmError(isolate, MessageTemplate::kWasmTrapTableOutOfBounds);
@@ -500,11 +338,15 @@ RUNTIME_FUNCTION(Runtime_WasmFunctionTableSet) {
 }
 
 RUNTIME_FUNCTION(Runtime_WasmTableInit) {
+  ClearThreadInWasmScope flag_scope;
   HandleScope scope(isolate);
   DCHECK_EQ(6, args.length());
   CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
   CONVERT_UINT32_ARG_CHECKED(table_index, 1);
   CONVERT_UINT32_ARG_CHECKED(elem_segment_index, 2);
+  static_assert(
+      wasm::kV8MaxWasmTableSize < kSmiMaxValue,
+      "Make sure clamping to Smi range doesn't make an invalid call valid");
   CONVERT_UINT32_ARG_CHECKED(dst, 3);
   CONVERT_UINT32_ARG_CHECKED(src, 4);
   CONVERT_UINT32_ARG_CHECKED(count, 5);
@@ -518,11 +360,15 @@ RUNTIME_FUNCTION(Runtime_WasmTableInit) {
 }
 
 RUNTIME_FUNCTION(Runtime_WasmTableCopy) {
+  ClearThreadInWasmScope flag_scope;
   HandleScope scope(isolate);
   DCHECK_EQ(6, args.length());
   CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
   CONVERT_UINT32_ARG_CHECKED(table_dst_index, 1);
   CONVERT_UINT32_ARG_CHECKED(table_src_index, 2);
+  static_assert(
+      wasm::kV8MaxWasmTableSize < kSmiMaxValue,
+      "Make sure clamping to Smi range doesn't make an invalid call valid");
   CONVERT_UINT32_ARG_CHECKED(dst, 3);
   CONVERT_UINT32_ARG_CHECKED(src, 4);
   CONVERT_UINT32_ARG_CHECKED(count, 5);
@@ -536,6 +382,7 @@ RUNTIME_FUNCTION(Runtime_WasmTableCopy) {
 }
 
 RUNTIME_FUNCTION(Runtime_WasmTableGrow) {
+  ClearThreadInWasmScope flag_scope;
   HandleScope scope(isolate);
   DCHECK_EQ(3, args.length());
   auto instance =
@@ -554,6 +401,7 @@ RUNTIME_FUNCTION(Runtime_WasmTableGrow) {
 }
 
 RUNTIME_FUNCTION(Runtime_WasmTableFill) {
+  ClearThreadInWasmScope flag_scope;
   HandleScope scope(isolate);
   DCHECK_EQ(4, args.length());
   auto instance =
@@ -585,29 +433,11 @@ RUNTIME_FUNCTION(Runtime_WasmTableFill) {
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
-RUNTIME_FUNCTION(Runtime_WasmNewMultiReturnFixedArray) {
-  DCHECK_EQ(1, args.length());
-  HandleScope scope(isolate);
-  CONVERT_INT32_ARG_CHECKED(size, 0);
-  Handle<FixedArray> fixed_array = isolate->factory()->NewFixedArray(size);
-  return *fixed_array;
-}
-
-RUNTIME_FUNCTION(Runtime_WasmNewMultiReturnJSArray) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  DCHECK(!isolate->context().is_null());
-  CONVERT_ARG_CHECKED(FixedArray, fixed_array, 0);
-  Handle<FixedArray> fixed_array_handle(fixed_array, isolate);
-  Handle<JSArray> array = isolate->factory()->NewJSArrayWithElements(
-      fixed_array_handle, PACKED_ELEMENTS);
-  return *array;
-}
-
 RUNTIME_FUNCTION(Runtime_WasmDebugBreak) {
+  ClearThreadInWasmScope flag_scope;
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
-  FrameFinder<WasmCompiledFrame, StackFrame::EXIT, StackFrame::WASM_DEBUG_BREAK>
+  FrameFinder<WasmFrame, StackFrame::EXIT, StackFrame::WASM_DEBUG_BREAK>
       frame_finder(isolate);
   auto instance = handle(frame_finder.frame()->wasm_instance(), isolate);
   int position = frame_finder.frame()->position();
@@ -617,10 +447,10 @@ RUNTIME_FUNCTION(Runtime_WasmDebugBreak) {
   DebugScope debug_scope(isolate->debug());
 
   const auto undefined = ReadOnlyRoots(isolate).undefined_value();
-  WasmCompiledFrame* frame = frame_finder.frame();
+  WasmFrame* frame = frame_finder.frame();
   auto* debug_info = frame->native_module()->GetDebugInfo();
   if (debug_info->IsStepping(frame)) {
-    debug_info->ClearStepping();
+    debug_info->ClearStepping(isolate);
     isolate->debug()->ClearStepping();
     isolate->debug()->OnDebugBreak(isolate->factory()->empty_fixed_array());
     return undefined;
@@ -631,7 +461,7 @@ RUNTIME_FUNCTION(Runtime_WasmDebugBreak) {
   Handle<FixedArray> breakpoints;
   if (WasmScript::CheckBreakPoints(isolate, script, position)
           .ToHandle(&breakpoints)) {
-    debug_info->ClearStepping();
+    debug_info->ClearStepping(isolate);
     isolate->debug()->ClearStepping();
     if (isolate->debug()->break_points_active()) {
       // We hit one or several breakpoints. Notify the debug listeners.
diff --git a/deps/v8/src/runtime/runtime-weak-refs.cc b/deps/v8/src/runtime/runtime-weak-refs.cc
new file mode 100644
index 00000000000..f73017c5842
--- /dev/null
+++ b/deps/v8/src/runtime/runtime-weak-refs.cc
@@ -0,0 +1,30 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/runtime/runtime-utils.h"
+
+#include "src/execution/arguments-inl.h"
+#include "src/objects/js-weak-refs-inl.h"
+
+namespace v8 {
+namespace internal {
+
+RUNTIME_FUNCTION(Runtime_ShrinkFinalizationRegistryUnregisterTokenMap) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSFinalizationRegistry, finalization_registry, 0);
+
+  if (!finalization_registry->key_map().IsUndefined(isolate)) {
+    Handle<SimpleNumberDictionary> key_map =
+        handle(SimpleNumberDictionary::cast(finalization_registry->key_map()),
+               isolate);
+    key_map = SimpleNumberDictionary::Shrink(isolate, key_map);
+    finalization_registry->set_key_map(*key_map);
+  }
+
+  return ReadOnlyRoots(isolate).undefined_value();
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/runtime/runtime.cc b/deps/v8/src/runtime/runtime.cc
index e51338ba6dc..bd6853de8e8 100644
--- a/deps/v8/src/runtime/runtime.cc
+++ b/deps/v8/src/runtime/runtime.cc
@@ -212,6 +212,7 @@ bool Runtime::IsWhitelistedForFuzzing(FunctionId id) {
     // Runtime functions only permitted for non-differential fuzzers.
     // This list may contain functions performing extra checks or returning
     // different values in the context of different flags passed to V8.
+    case Runtime::kGetOptimizationStatus:
     case Runtime::kHeapObjectVerify:
     case Runtime::kIsBeingInterpreted:
       return !FLAG_allow_natives_for_differential_fuzzing;
diff --git a/deps/v8/src/runtime/runtime.h b/deps/v8/src/runtime/runtime.h
index 57500be5107..d5ec75d82f9 100644
--- a/deps/v8/src/runtime/runtime.h
+++ b/deps/v8/src/runtime/runtime.h
@@ -222,10 +222,10 @@ namespace internal {
   F(NewError, 2, 1)                                  \
   F(NewReferenceError, 2, 1)                         \
   F(NewSyntaxError, 2, 1)                            \
-  F(NewTypeError, 2, 1)                              \
+  F(NewTypeError, -1 /* [1, 4] */, 1)                \
   F(OrdinaryHasInstance, 2, 1)                       \
   F(PromoteScheduledException, 0, 1)                 \
-  F(ReportMessage, 1, 1)                             \
+  F(ReportMessageFromMicrotask, 1, 1)                \
   F(ReThrow, 1, 1)                                   \
   F(RunMicrotaskCallback, 2, 1)                      \
   F(PerformMicrotaskCheckpoint, 0, 1)                \
@@ -239,7 +239,7 @@ namespace internal {
   F(ThrowInvalidStringLength, 0, 1)                  \
   F(ThrowInvalidTypedArrayAlignment, 2, 1)           \
   F(ThrowIteratorError, 1, 1)                        \
-  F(ThrowSpreadArgIsNullOrUndefined, 1, 1)           \
+  F(ThrowSpreadArgError, 2, 1)                       \
   F(ThrowIteratorResultNotAnObject, 1, 1)            \
   F(ThrowNotConstructor, 1, 1)                       \
   F(ThrowPatternAssignmentNonCoercible, 1, 1)        \
@@ -274,7 +274,7 @@ namespace internal {
   I(IsSmi, 1, 1)                         \
   F(IsValidSmi, 1, 1)                    \
   F(MaxSmi, 0, 1)                        \
-  F(NumberToString, 1, 1)                \
+  F(NumberToStringSlow, 1, 1)            \
   F(StringParseFloat, 1, 1)              \
   F(StringParseInt, 2, 1)                \
   F(StringToNumber, 1, 1)                \
@@ -285,7 +285,6 @@ namespace internal {
   F(AddPrivateField, 3, 1)                                      \
   F(AddPrivateBrand, 3, 1)                                      \
   F(AllocateHeapNumber, 0, 1)                                   \
-  F(ClassOf, 1, 1)                                              \
   F(CollectTypeProfile, 3, 1)                                   \
   F(CompleteInobjectSlackTrackingForMap, 1, 1)                  \
   I(CopyDataProperties, 2, 1)                                   \
@@ -367,7 +366,9 @@ namespace internal {
   F(RejectPromise, 3, 1)                 \
   F(ResolvePromise, 2, 1)                \
   F(PromiseRejectAfterResolved, 2, 1)    \
-  F(PromiseResolveAfterResolved, 2, 1)
+  F(PromiseResolveAfterResolved, 2, 1)   \
+  F(ConstructAggregateErrorHelper, 3, 1) \
+  F(ConstructInternalAggregateErrorHelper, -1 /* <= 4*/, 1)
 
 #define FOR_EACH_INTRINSIC_PROXY(F, I) \
   F(CheckProxyGetSetTrapResult, 2, 1)  \
@@ -403,8 +404,7 @@ namespace internal {
   F(NewClosure_Tenured, 2, 1)               \
   F(NewFunctionContext, 1, 1)               \
   F(NewRestParameter, 1, 1)                 \
-  F(NewSloppyArguments, 3, 1)               \
-  F(NewSloppyArguments_Generic, 1, 1)       \
+  F(NewSloppyArguments, 1, 1)               \
   F(NewStrictArguments, 1, 1)               \
   F(PushBlockContext, 1, 1)                 \
   F(PushCatchContext, 2, 1)                 \
@@ -520,9 +520,9 @@ namespace internal {
   F(NewRegExpWithBacktrackLimit, 3, 1)        \
   F(PrepareFunctionForOptimization, -1, 1)    \
   F(PrintWithNameForAssert, 2, 1)             \
-  F(RedirectToWasmInterpreter, 2, 1)          \
   F(RunningInSimulator, 0, 1)                 \
   F(RuntimeEvaluateREPL, 1, 1)                \
+  F(SerializeDeserializeNow, 0, 1)            \
   F(SerializeWasmModule, 1, 1)                \
   F(SetAllocationTimeout, -1 /* 2 || 3 */, 1) \
   F(SetForceSlowPath, 1, 1)                   \
@@ -538,11 +538,11 @@ namespace internal {
   F(TurbofanStaticAssert, 1, 1)               \
   F(UnblockConcurrentRecompilation, 0, 1)     \
   F(WasmGetNumberOfInstances, 1, 1)           \
-  F(WasmNumInterpretedCalls, 1, 1)            \
   F(WasmNumCodeSpaces, 1, 1)                  \
   F(WasmTierDownModule, 1, 1)                 \
   F(WasmTierUpFunction, 2, 1)                 \
   F(WasmTierUpModule, 1, 1)                   \
+  F(WasmTraceEnter, 0, 1)                     \
   F(WasmTraceMemory, 1, 1)                    \
   I(DeoptimizeNow, 0, 1)
 
@@ -553,32 +553,30 @@ namespace internal {
   F(TypedArraySet, 2, 1)                    \
   F(TypedArraySortFast, 1, 1)
 
-#define FOR_EACH_INTRINSIC_WASM(F, I)   \
-  F(ThrowWasmError, 1, 1)               \
-  F(ThrowWasmStackOverflow, 0, 1)       \
-  F(WasmI32AtomicWait, 4, 1)            \
-  F(WasmI64AtomicWait, 5, 1)            \
-  F(WasmAtomicNotify, 3, 1)             \
-  F(WasmExceptionGetValues, 1, 1)       \
-  F(WasmExceptionGetTag, 1, 1)          \
-  F(WasmMemoryGrow, 2, 1)               \
-  F(WasmRunInterpreter, 2, 1)           \
-  F(WasmStackGuard, 0, 1)               \
-  F(WasmThrowCreate, 2, 1)              \
-  F(WasmThrowTypeError, 0, 1)           \
-  F(WasmRefFunc, 1, 1)                  \
-  F(WasmFunctionTableGet, 3, 1)         \
-  F(WasmFunctionTableSet, 4, 1)         \
-  F(WasmTableInit, 6, 1)                \
-  F(WasmTableCopy, 6, 1)                \
-  F(WasmTableGrow, 3, 1)                \
-  F(WasmTableFill, 4, 1)                \
-  F(WasmIsValidFuncRefValue, 1, 1)      \
-  F(WasmCompileLazy, 2, 1)              \
-  F(WasmNewMultiReturnFixedArray, 1, 1) \
-  F(WasmNewMultiReturnJSArray, 1, 1)    \
+#define FOR_EACH_INTRINSIC_WASM(F, I) \
+  F(ThrowWasmError, 1, 1)             \
+  F(ThrowWasmStackOverflow, 0, 1)     \
+  F(WasmI32AtomicWait, 4, 1)          \
+  F(WasmI64AtomicWait, 5, 1)          \
+  F(WasmAtomicNotify, 3, 1)           \
+  F(WasmMemoryGrow, 2, 1)             \
+  F(WasmStackGuard, 0, 1)             \
+  F(WasmThrowCreate, 2, 1)            \
+  F(WasmThrowTypeError, 0, 1)         \
+  F(WasmRefFunc, 1, 1)                \
+  F(WasmFunctionTableGet, 3, 1)       \
+  F(WasmFunctionTableSet, 4, 1)       \
+  F(WasmTableInit, 6, 1)              \
+  F(WasmTableCopy, 6, 1)              \
+  F(WasmTableGrow, 3, 1)              \
+  F(WasmTableFill, 4, 1)              \
+  F(WasmIsValidFuncRefValue, 1, 1)    \
+  F(WasmCompileLazy, 2, 1)            \
   F(WasmDebugBreak, 0, 1)
 
+#define FOR_EACH_INTRINSIC_WEAKREF(F, I) \
+  F(ShrinkFinalizationRegistryUnregisterTokenMap, 1, 1)
+
 #define FOR_EACH_INTRINSIC_RETURN_PAIR_IMPL(F, I) \
   F(DebugBreakOnBytecode, 1, 2)                   \
   F(LoadLookupSlotForCall, 1, 2)
@@ -637,7 +635,8 @@ namespace internal {
   FOR_EACH_INTRINSIC_SYMBOL(F, I)                   \
   FOR_EACH_INTRINSIC_TEST(F, I)                     \
   FOR_EACH_INTRINSIC_TYPEDARRAY(F, I)               \
-  FOR_EACH_INTRINSIC_WASM(F, I)
+  FOR_EACH_INTRINSIC_WASM(F, I)                     \
+  FOR_EACH_INTRINSIC_WEAKREF(F, I)
 
 // Defines the list of all intrinsics, coming in 2 flavors, either returning an
 // object or a pair.
diff --git a/deps/v8/src/snapshot/DEPS b/deps/v8/src/snapshot/DEPS
index 93f17c92867..6f92db18d47 100644
--- a/deps/v8/src/snapshot/DEPS
+++ b/deps/v8/src/snapshot/DEPS
@@ -5,7 +5,7 @@ specific_include_rules = {
   "snapshot-compression.cc": [
     "+third_party/zlib",
   ],
-  "serializer-common.cc": [
+  "snapshot-utils.cc": [
     "+third_party/zlib",
   ],
 }
diff --git a/deps/v8/src/snapshot/code-serializer.cc b/deps/v8/src/snapshot/code-serializer.cc
index d155313872f..f650b339944 100644
--- a/deps/v8/src/snapshot/code-serializer.cc
+++ b/deps/v8/src/snapshot/code-serializer.cc
@@ -4,15 +4,19 @@
 
 #include "src/snapshot/code-serializer.h"
 
+#include "src/base/platform/platform.h"
 #include "src/codegen/macro-assembler.h"
+#include "src/common/globals.h"
 #include "src/debug/debug.h"
 #include "src/heap/heap-inl.h"
+#include "src/heap/off-thread-factory-inl.h"
 #include "src/logging/counters.h"
 #include "src/logging/log.h"
 #include "src/objects/objects-inl.h"
 #include "src/objects/slots.h"
 #include "src/objects/visitors.h"
 #include "src/snapshot/object-deserializer.h"
+#include "src/snapshot/snapshot-utils.h"
 #include "src/snapshot/snapshot.h"
 #include "src/utils/version.h"
 
@@ -31,7 +35,8 @@ ScriptData::ScriptData(const byte* data, int length)
 }
 
 CodeSerializer::CodeSerializer(Isolate* isolate, uint32_t source_hash)
-    : Serializer(isolate), source_hash_(source_hash) {
+    : Serializer(isolate, Snapshot::kDefaultSerializerFlags),
+      source_hash_(source_hash) {
   allocator()->UseCustomChunkSize(FLAG_serialization_chunk_size);
 }
 
@@ -190,12 +195,12 @@ void CodeSerializer::SerializeObject(HeapObject obj) {
   // bytecode array stored within the InterpreterData, which is the important
   // information. On deserialization we'll create our code objects again, if
   // --interpreted-frames-native-stack is on. See v8:9122 for more context
-#if !defined(V8_TARGET_ARCH_ARM) && !defined(V8_TARGET_ARCH_S390X)
+#ifndef V8_TARGET_ARCH_ARM
   if (V8_UNLIKELY(FLAG_interpreted_frames_native_stack) &&
       obj.IsInterpreterData()) {
     obj = InterpreterData::cast(obj).bytecode_array();
   }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_S390X
+#endif  // V8_TARGET_ARCH_ARM
 
   // Past this point we should not see any (context-specific) maps anymore.
   CHECK(!obj.IsMap());
@@ -215,7 +220,7 @@ void CodeSerializer::SerializeGeneric(HeapObject heap_object) {
   serializer.Serialize();
 }
 
-#if !defined(V8_TARGET_ARCH_ARM) && !defined(V8_TARGET_ARCH_S390X)
+#ifndef V8_TARGET_ARCH_ARM
 // NOTE(mmarchini): when FLAG_interpreted_frames_native_stack is on, we want to
 // create duplicates of InterpreterEntryTrampoline for the deserialized
 // functions, otherwise we'll call the builtin IET for those functions (which
@@ -255,7 +260,40 @@ void CreateInterpreterDataForDeserializedCode(Isolate* isolate,
                             column_num));
   }
 }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_S390X
+#endif  // V8_TARGET_ARCH_ARM
+
+namespace {
+class StressOffThreadDeserializeThread final : public base::Thread {
+ public:
+  explicit StressOffThreadDeserializeThread(
+      OffThreadIsolate* off_thread_isolate, const SerializedCodeData* scd)
+      : Thread(
+            base::Thread::Options("StressOffThreadDeserializeThread", 2 * MB)),
+        off_thread_isolate_(off_thread_isolate),
+        scd_(scd) {}
+
+  MaybeHandle<SharedFunctionInfo> maybe_result() const {
+    return maybe_result_.ToHandle();
+  }
+
+  void Run() final {
+    off_thread_isolate_->PinToCurrentThread();
+
+    MaybeHandle<SharedFunctionInfo> off_thread_maybe_result =
+        ObjectDeserializer::DeserializeSharedFunctionInfoOffThread(
+            off_thread_isolate_, scd_,
+            off_thread_isolate_->factory()->empty_string());
+
+    maybe_result_ =
+        off_thread_isolate_->TransferHandle(off_thread_maybe_result);
+  }
+
+ private:
+  OffThreadIsolate* off_thread_isolate_;
+  const SerializedCodeData* scd_;
+  OffThreadTransferMaybeHandle<SharedFunctionInfo> maybe_result_;
+};
+}  // namespace
 
 MaybeHandle<SharedFunctionInfo> CodeSerializer::Deserialize(
     Isolate* isolate, ScriptData* cached_data, Handle<String> source,
@@ -268,8 +306,7 @@ MaybeHandle<SharedFunctionInfo> CodeSerializer::Deserialize(
   SerializedCodeData::SanityCheckResult sanity_check_result =
       SerializedCodeData::CHECK_SUCCESS;
   const SerializedCodeData scd = SerializedCodeData::FromCachedData(
-      isolate, cached_data,
-      SerializedCodeData::SourceHash(source, origin_options),
+      cached_data, SerializedCodeData::SourceHash(source, origin_options),
       &sanity_check_result);
   if (sanity_check_result != SerializedCodeData::CHECK_SUCCESS) {
     if (FLAG_profile_deserialization) PrintF("[Cached code failed check]\n");
@@ -280,8 +317,29 @@ MaybeHandle<SharedFunctionInfo> CodeSerializer::Deserialize(
   }
 
   // Deserialize.
-  MaybeHandle<SharedFunctionInfo> maybe_result =
-      ObjectDeserializer::DeserializeSharedFunctionInfo(isolate, &scd, source);
+  MaybeHandle<SharedFunctionInfo> maybe_result;
+  if (FLAG_stress_background_compile) {
+    Zone zone(isolate->allocator(), "Deserialize");
+    OffThreadIsolate off_thread_isolate(isolate, &zone);
+
+    StressOffThreadDeserializeThread thread(&off_thread_isolate, &scd);
+    CHECK(thread.Start());
+    thread.Join();
+
+    off_thread_isolate.FinishOffThread();
+    off_thread_isolate.Publish(isolate);
+
+    maybe_result = thread.maybe_result();
+
+    // Fix-up result script source.
+    Handle<SharedFunctionInfo> result;
+    if (maybe_result.ToHandle(&result)) {
+      Script::cast(result->script()).set_source(*source);
+    }
+  } else {
+    maybe_result = ObjectDeserializer::DeserializeSharedFunctionInfo(
+        isolate, &scd, source);
+  }
 
   Handle<SharedFunctionInfo> result;
   if (!maybe_result.ToHandle(&result)) {
@@ -301,11 +359,11 @@ MaybeHandle<SharedFunctionInfo> CodeSerializer::Deserialize(
       isolate->is_profiling() ||
       isolate->code_event_dispatcher()->IsListeningToCodeEvents();
 
-#if !defined(V8_TARGET_ARCH_ARM) && !defined(V8_TARGET_ARCH_S390X)
+#ifndef V8_TARGET_ARCH_ARM
   if (V8_UNLIKELY(FLAG_interpreted_frames_native_stack))
     CreateInterpreterDataForDeserializedCode(isolate, result,
                                              log_code_creation);
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_S390X
+#endif  // V8_TARGET_ARCH_ARM
 
   bool needs_source_positions = isolate->NeedsSourcePositionsForProfiling();
 
@@ -355,7 +413,6 @@ MaybeHandle<SharedFunctionInfo> CodeSerializer::Deserialize(
   return scope.CloseAndEscape(result);
 }
 
-
 SerializedCodeData::SerializedCodeData(const std::vector<byte>* payload,
                                        const CodeSerializer* cs) {
   DisallowHeapAllocation no_gc;
@@ -403,7 +460,7 @@ SerializedCodeData::SerializedCodeData(const std::vector<byte>* payload,
 }
 
 SerializedCodeData::SanityCheckResult SerializedCodeData::SanityCheck(
-    Isolate* isolate, uint32_t expected_source_hash) const {
+    uint32_t expected_source_hash) const {
   if (this->size_ < kHeaderSize) return INVALID_HEADER;
   uint32_t magic_number = GetMagicNumber();
   if (magic_number != kMagicNumber) return MAGIC_NUMBER_MISMATCH;
@@ -469,11 +526,11 @@ SerializedCodeData::SerializedCodeData(ScriptData* data)
     : SerializedData(const_cast<byte*>(data->data()), data->length()) {}
 
 SerializedCodeData SerializedCodeData::FromCachedData(
-    Isolate* isolate, ScriptData* cached_data, uint32_t expected_source_hash,
+    ScriptData* cached_data, uint32_t expected_source_hash,
     SanityCheckResult* rejection_result) {
   DisallowHeapAllocation no_gc;
   SerializedCodeData scd(cached_data);
-  *rejection_result = scd.SanityCheck(isolate, expected_source_hash);
+  *rejection_result = scd.SanityCheck(expected_source_hash);
   if (*rejection_result != CHECK_SUCCESS) {
     cached_data->Reject();
     return SerializedCodeData(nullptr, 0);
diff --git a/deps/v8/src/snapshot/code-serializer.h b/deps/v8/src/snapshot/code-serializer.h
index ace50b26f3a..2daf5200ec7 100644
--- a/deps/v8/src/snapshot/code-serializer.h
+++ b/deps/v8/src/snapshot/code-serializer.h
@@ -109,8 +109,7 @@ class SerializedCodeData : public SerializedData {
   static const uint32_t kHeaderSize = POINTER_SIZE_ALIGN(kUnalignedHeaderSize);
 
   // Used when consuming.
-  static SerializedCodeData FromCachedData(Isolate* isolate,
-                                           ScriptData* cached_data,
+  static SerializedCodeData FromCachedData(ScriptData* cached_data,
                                            uint32_t expected_source_hash,
                                            SanityCheckResult* rejection_result);
 
@@ -136,8 +135,7 @@ class SerializedCodeData : public SerializedData {
     return Vector<const byte>(data_ + kHeaderSize, size_ - kHeaderSize);
   }
 
-  SanityCheckResult SanityCheck(Isolate* isolate,
-                                uint32_t expected_source_hash) const;
+  SanityCheckResult SanityCheck(uint32_t expected_source_hash) const;
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/snapshot/partial-deserializer.cc b/deps/v8/src/snapshot/context-deserializer.cc
similarity index 81%
rename from deps/v8/src/snapshot/partial-deserializer.cc
rename to deps/v8/src/snapshot/context-deserializer.cc
index 8a215b6b871..b6b6da54f91 100644
--- a/deps/v8/src/snapshot/partial-deserializer.cc
+++ b/deps/v8/src/snapshot/context-deserializer.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/snapshot/partial-deserializer.h"
+#include "src/snapshot/context-deserializer.h"
 
 #include "src/api/api-inl.h"
 #include "src/heap/heap-inl.h"
@@ -12,11 +12,11 @@
 namespace v8 {
 namespace internal {
 
-MaybeHandle<Context> PartialDeserializer::DeserializeContext(
+MaybeHandle<Context> ContextDeserializer::DeserializeContext(
     Isolate* isolate, const SnapshotData* data, bool can_rehash,
     Handle<JSGlobalProxy> global_proxy,
     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer) {
-  PartialDeserializer d(data);
+  ContextDeserializer d(data);
   d.SetRehashability(can_rehash);
 
   MaybeHandle<Object> maybe_result =
@@ -27,15 +27,18 @@ MaybeHandle<Context> PartialDeserializer::DeserializeContext(
                                         : MaybeHandle<Context>();
 }
 
-MaybeHandle<Object> PartialDeserializer::Deserialize(
+MaybeHandle<Object> ContextDeserializer::Deserialize(
     Isolate* isolate, Handle<JSGlobalProxy> global_proxy,
     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer) {
   Initialize(isolate);
   if (!allocator()->ReserveSpace()) {
-    V8::FatalProcessOutOfMemory(isolate, "PartialDeserializer");
+    V8::FatalProcessOutOfMemory(isolate, "ContextDeserializer");
   }
 
+  // Replace serialized references to the global proxy and its map with the
+  // given global proxy and its map.
   AddAttachedObject(global_proxy);
+  AddAttachedObject(handle(global_proxy->map(), isolate));
 
   Handle<Object> result;
   {
@@ -45,8 +48,7 @@ MaybeHandle<Object> PartialDeserializer::Deserialize(
     CodeSpace* code_space = isolate->heap()->code_space();
     Address start_address = code_space->top();
     Object root;
-    VisitRootPointer(Root::kPartialSnapshotCache, nullptr,
-                     FullObjectSlot(&root));
+    VisitRootPointer(Root::kStartupObjectCache, nullptr, FullObjectSlot(&root));
     DeserializeDeferredObjects();
     DeserializeEmbedderFields(embedder_fields_deserializer);
 
@@ -57,21 +59,20 @@ MaybeHandle<Object> PartialDeserializer::Deserialize(
     // new code, which also has to be flushed from instruction cache.
     CHECK_EQ(start_address, code_space->top());
 
-    if (FLAG_rehash_snapshot && can_rehash()) Rehash();
     LogNewMapEvents();
 
     result = handle(root, isolate);
   }
 
+  if (FLAG_rehash_snapshot && can_rehash()) Rehash();
   SetupOffHeapArrayBufferBackingStores();
 
   return result;
 }
 
-void PartialDeserializer::SetupOffHeapArrayBufferBackingStores() {
+void ContextDeserializer::SetupOffHeapArrayBufferBackingStores() {
   for (Handle<JSArrayBuffer> buffer : new_off_heap_array_buffers()) {
-    // Serializer writes backing store ref in |backing_store| field.
-    size_t store_index = reinterpret_cast<size_t>(buffer->backing_store());
+    uint32_t store_index = buffer->GetBackingStoreRefForDeserialization();
     auto bs = backing_store(store_index);
     SharedFlag shared =
         bs && bs->is_shared() ? SharedFlag::kShared : SharedFlag::kNotShared;
@@ -79,7 +80,7 @@ void PartialDeserializer::SetupOffHeapArrayBufferBackingStores() {
   }
 }
 
-void PartialDeserializer::DeserializeEmbedderFields(
+void ContextDeserializer::DeserializeEmbedderFields(
     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer) {
   if (!source()->HasMore() || source()->Get() != kEmbedderFieldsData) return;
   DisallowHeapAllocation no_gc;
diff --git a/deps/v8/src/snapshot/partial-deserializer.h b/deps/v8/src/snapshot/context-deserializer.h
similarity index 77%
rename from deps/v8/src/snapshot/partial-deserializer.h
rename to deps/v8/src/snapshot/context-deserializer.h
index a25e6595954..38549022380 100644
--- a/deps/v8/src/snapshot/partial-deserializer.h
+++ b/deps/v8/src/snapshot/context-deserializer.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_SNAPSHOT_PARTIAL_DESERIALIZER_H_
-#define V8_SNAPSHOT_PARTIAL_DESERIALIZER_H_
+#ifndef V8_SNAPSHOT_CONTEXT_DESERIALIZER_H_
+#define V8_SNAPSHOT_CONTEXT_DESERIALIZER_H_
 
 #include "src/snapshot/deserializer.h"
 #include "src/snapshot/snapshot.h"
@@ -14,8 +14,8 @@ namespace internal {
 class Context;
 
 // Deserializes the context-dependent object graph rooted at a given object.
-// The PartialDeserializer is not expected to deserialize any code objects.
-class V8_EXPORT_PRIVATE PartialDeserializer final : public Deserializer {
+// The ContextDeserializer is not expected to deserialize any code objects.
+class V8_EXPORT_PRIVATE ContextDeserializer final : public Deserializer {
  public:
   static MaybeHandle<Context> DeserializeContext(
       Isolate* isolate, const SnapshotData* data, bool can_rehash,
@@ -23,7 +23,7 @@ class V8_EXPORT_PRIVATE PartialDeserializer final : public Deserializer {
       v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer);
 
  private:
-  explicit PartialDeserializer(const SnapshotData* data)
+  explicit ContextDeserializer(const SnapshotData* data)
       : Deserializer(data, false) {}
 
   // Deserialize a single object and the objects reachable from it.
@@ -40,4 +40,4 @@ class V8_EXPORT_PRIVATE PartialDeserializer final : public Deserializer {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_SNAPSHOT_PARTIAL_DESERIALIZER_H_
+#endif  // V8_SNAPSHOT_CONTEXT_DESERIALIZER_H_
diff --git a/deps/v8/src/snapshot/partial-serializer.cc b/deps/v8/src/snapshot/context-serializer.cc
similarity index 63%
rename from deps/v8/src/snapshot/partial-serializer.cc
rename to deps/v8/src/snapshot/context-serializer.cc
index 56b29a2ac71..41047aee7ba 100644
--- a/deps/v8/src/snapshot/partial-serializer.cc
+++ b/deps/v8/src/snapshot/context-serializer.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/snapshot/partial-serializer.h"
+#include "src/snapshot/context-serializer.h"
 #include "src/snapshot/startup-serializer.h"
 
 #include "src/api/api-inl.h"
@@ -15,10 +15,61 @@
 namespace v8 {
 namespace internal {
 
-PartialSerializer::PartialSerializer(
-    Isolate* isolate, StartupSerializer* startup_serializer,
+namespace {
+
+// During serialization, puts the native context into a state understood by the
+// serializer (e.g. by clearing lists of Code objects).  After serialization,
+// the original state is restored.
+class SanitizeNativeContextScope final {
+ public:
+  SanitizeNativeContextScope(Isolate* isolate, NativeContext native_context,
+                             bool allow_active_isolate_for_testing,
+                             const DisallowHeapAllocation& no_gc)
+      : isolate_(isolate),
+        native_context_(native_context),
+        microtask_queue_(native_context.microtask_queue()),
+        optimized_code_list_(native_context.OptimizedCodeListHead()),
+        deoptimized_code_list_(native_context.DeoptimizedCodeListHead()) {
+#ifdef DEBUG
+    if (!allow_active_isolate_for_testing) {
+      // Microtasks.
+      DCHECK_EQ(0, microtask_queue_->size());
+      DCHECK(!microtask_queue_->HasMicrotasksSuppressions());
+      DCHECK_EQ(0, microtask_queue_->GetMicrotasksScopeDepth());
+      DCHECK(microtask_queue_->DebugMicrotasksScopeDepthIsZero());
+      // Code lists.
+      DCHECK(optimized_code_list_.IsUndefined(isolate));
+      DCHECK(deoptimized_code_list_.IsUndefined(isolate));
+    }
+#endif
+    Object undefined = ReadOnlyRoots(isolate).undefined_value();
+    native_context.set_microtask_queue(isolate, nullptr);
+    native_context.SetOptimizedCodeListHead(undefined);
+    native_context.SetDeoptimizedCodeListHead(undefined);
+  }
+
+  ~SanitizeNativeContextScope() {
+    // Restore saved fields.
+    native_context_.SetDeoptimizedCodeListHead(optimized_code_list_);
+    native_context_.SetOptimizedCodeListHead(deoptimized_code_list_);
+    native_context_.set_microtask_queue(isolate_, microtask_queue_);
+  }
+
+ private:
+  Isolate* isolate_;
+  NativeContext native_context_;
+  MicrotaskQueue* const microtask_queue_;
+  const Object optimized_code_list_;
+  const Object deoptimized_code_list_;
+};
+
+}  // namespace
+
+ContextSerializer::ContextSerializer(
+    Isolate* isolate, Snapshot::SerializerFlags flags,
+    StartupSerializer* startup_serializer,
     v8::SerializeEmbedderFieldsCallback callback)
-    : Serializer(isolate),
+    : Serializer(isolate, flags),
       startup_serializer_(startup_serializer),
       serialize_embedder_fields_(callback),
       can_be_rehashed_(true) {
@@ -26,36 +77,40 @@ PartialSerializer::PartialSerializer(
   allocator()->UseCustomChunkSize(FLAG_serialization_chunk_size);
 }
 
-PartialSerializer::~PartialSerializer() {
-  OutputStatistics("PartialSerializer");
+ContextSerializer::~ContextSerializer() {
+  OutputStatistics("ContextSerializer");
 }
 
-void PartialSerializer::Serialize(Context* o, bool include_global_proxy) {
+void ContextSerializer::Serialize(Context* o,
+                                  const DisallowHeapAllocation& no_gc) {
   context_ = *o;
   DCHECK(context_.IsNativeContext());
+
+  // Upon deserialization, references to the global proxy and its map will be
+  // replaced.
   reference_map()->AddAttachedReference(
       reinterpret_cast<void*>(context_.global_proxy().ptr()));
+  reference_map()->AddAttachedReference(
+      reinterpret_cast<void*>(context_.global_proxy().map().ptr()));
+
   // The bootstrap snapshot has a code-stub context. When serializing the
-  // partial snapshot, it is chained into the weak context list on the isolate
+  // context snapshot, it is chained into the weak context list on the isolate
   // and it's next context pointer may point to the code-stub context.  Clear
   // it before serializing, it will get re-added to the context list
   // explicitly when it's loaded.
+  // TODO(v8:10416): These mutations should not observably affect the running
+  // context.
   context_.set(Context::NEXT_CONTEXT_LINK,
                ReadOnlyRoots(isolate()).undefined_value());
   DCHECK(!context_.global_object().IsUndefined());
   // Reset math random cache to get fresh random numbers.
   MathRandom::ResetContext(context_);
 
-#ifdef DEBUG
-  MicrotaskQueue* microtask_queue = context_.native_context().microtask_queue();
-  DCHECK_EQ(0, microtask_queue->size());
-  DCHECK(!microtask_queue->HasMicrotasksSuppressions());
-  DCHECK_EQ(0, microtask_queue->GetMicrotasksScopeDepth());
-  DCHECK(microtask_queue->DebugMicrotasksScopeDepthIsZero());
-#endif
-  context_.native_context().set_microtask_queue(nullptr);
+  SanitizeNativeContextScope sanitize_native_context(
+      isolate(), context_.native_context(), allow_active_isolate_for_testing(),
+      no_gc);
 
-  VisitRootPointer(Root::kPartialSnapshotCache, nullptr, FullObjectSlot(o));
+  VisitRootPointer(Root::kStartupObjectCache, nullptr, FullObjectSlot(o));
   SerializeDeferredObjects();
 
   // Add section for embedder-serialized embedder fields.
@@ -68,9 +123,18 @@ void PartialSerializer::Serialize(Context* o, bool include_global_proxy) {
   Pad();
 }
 
-void PartialSerializer::SerializeObject(HeapObject obj) {
+void ContextSerializer::SerializeObject(HeapObject obj) {
   DCHECK(!ObjectIsBytecodeHandler(obj));  // Only referenced in dispatch table.
 
+  if (!allow_active_isolate_for_testing()) {
+    // When serializing a snapshot intended for real use, we should not end up
+    // at another native context.
+    // But in test scenarios there is no way to avoid this. Since we only
+    // serialize a single context in these cases, and this context does not
+    // have to be executable, we can simply ignore this.
+    DCHECK_IMPLIES(obj.IsNativeContext(), obj == context_);
+  }
+
   if (SerializeHotObject(obj)) return;
 
   if (SerializeRoot(obj)) return;
@@ -81,22 +145,20 @@ void PartialSerializer::SerializeObject(HeapObject obj) {
     return;
   }
 
-  if (ShouldBeInThePartialSnapshotCache(obj)) {
-    startup_serializer_->SerializeUsingPartialSnapshotCache(&sink_, obj);
+  if (ShouldBeInTheStartupObjectCache(obj)) {
+    startup_serializer_->SerializeUsingStartupObjectCache(&sink_, obj);
     return;
   }
 
-  // Pointers from the partial snapshot to the objects in the startup snapshot
-  // should go through the root array or through the partial snapshot cache.
+  // Pointers from the context snapshot to the objects in the startup snapshot
+  // should go through the root array or through the startup object cache.
   // If this is not the case you may have to add something to the root array.
   DCHECK(!startup_serializer_->ReferenceMapContains(obj));
-  // All the internalized strings that the partial snapshot needs should be
-  // either in the root table or in the partial snapshot cache.
+  // All the internalized strings that the context snapshot needs should be
+  // either in the root table or in the startup object cache.
   DCHECK(!obj.IsInternalizedString());
   // Function and object templates are not context specific.
   DCHECK(!obj.IsTemplateInfo());
-  // We should not end up at another native context.
-  DCHECK_IMPLIES(obj != context_, !obj.IsNativeContext());
 
   // Clear literal boilerplates and feedback.
   if (obj.IsFeedbackVector()) FeedbackVector::cast(obj).ClearSlots(isolate());
@@ -125,10 +187,10 @@ void PartialSerializer::SerializeObject(HeapObject obj) {
   serializer.Serialize();
 }
 
-bool PartialSerializer::ShouldBeInThePartialSnapshotCache(HeapObject o) {
+bool ContextSerializer::ShouldBeInTheStartupObjectCache(HeapObject o) {
   // Scripts should be referred only through shared function infos.  We can't
-  // allow them to be part of the partial snapshot because they contain a
-  // unique ID, and deserializing several partial snapshots containing script
+  // allow them to be part of the context snapshot because they contain a
+  // unique ID, and deserializing several context snapshots containing script
   // would cause dupes.
   DCHECK(!o.IsScript());
   return o.IsName() || o.IsSharedFunctionInfo() || o.IsHeapNumber() ||
@@ -142,7 +204,7 @@ namespace {
 bool DataIsEmpty(const StartupData& data) { return data.raw_size == 0; }
 }  // anonymous namespace
 
-bool PartialSerializer::SerializeJSObjectWithEmbedderFields(Object obj) {
+bool ContextSerializer::SerializeJSObjectWithEmbedderFields(Object obj) {
   if (!obj.IsJSObject()) return false;
   JSObject js_obj = JSObject::cast(obj);
   int embedder_fields_count = js_obj.GetEmbedderFieldCount();
@@ -167,7 +229,8 @@ bool PartialSerializer::SerializeJSObjectWithEmbedderFields(Object obj) {
   //    onto the result.
   for (int i = 0; i < embedder_fields_count; i++) {
     EmbedderDataSlot embedder_data_slot(js_obj, i);
-    original_embedder_values.emplace_back(embedder_data_slot.load_raw(no_gc));
+    original_embedder_values.emplace_back(
+        embedder_data_slot.load_raw(isolate(), no_gc));
     Object object = embedder_data_slot.load_tagged();
     if (object.IsHeapObject()) {
       DCHECK(IsValidHeapObject(isolate()->heap(), HeapObject::cast(object)));
@@ -194,7 +257,7 @@ bool PartialSerializer::SerializeJSObjectWithEmbedderFields(Object obj) {
   //    with embedder callbacks.
   for (int i = 0; i < embedder_fields_count; i++) {
     if (!DataIsEmpty(serialized_data[i])) {
-      EmbedderDataSlot(js_obj, i).store_raw(kNullAddress, no_gc);
+      EmbedderDataSlot(js_obj, i).store_raw(isolate(), kNullAddress, no_gc);
     }
   }
 
@@ -213,7 +276,8 @@ bool PartialSerializer::SerializeJSObjectWithEmbedderFields(Object obj) {
     StartupData data = serialized_data[i];
     if (DataIsEmpty(data)) continue;
     // Restore original values from cleared fields.
-    EmbedderDataSlot(js_obj, i).store_raw(original_embedder_values[i], no_gc);
+    EmbedderDataSlot(js_obj, i).store_raw(isolate(),
+                                          original_embedder_values[i], no_gc);
     embedder_fields_sink_.Put(kNewObject + static_cast<int>(reference.space()),
                               "embedder field holder");
     embedder_fields_sink_.PutInt(reference.chunk_index(), "BackRefChunkIndex");
@@ -229,11 +293,11 @@ bool PartialSerializer::SerializeJSObjectWithEmbedderFields(Object obj) {
   // 6) The content of the separate sink is appended eventually to the default
   //    sink. The ensures that during deserialization, we call the deserializer
   //    callback at the end, and can guarantee that the deserialized objects are
-  //    in a consistent state. See PartialSerializer::Serialize.
+  //    in a consistent state. See ContextSerializer::Serialize.
   return true;
 }
 
-void PartialSerializer::CheckRehashability(HeapObject obj) {
+void ContextSerializer::CheckRehashability(HeapObject obj) {
   if (!can_be_rehashed_) return;
   if (!obj.NeedsRehashing()) return;
   if (obj.CanBeRehashed()) return;
diff --git a/deps/v8/src/snapshot/partial-serializer.h b/deps/v8/src/snapshot/context-serializer.h
similarity index 68%
rename from deps/v8/src/snapshot/partial-serializer.h
rename to deps/v8/src/snapshot/context-serializer.h
index d8e9ee24965..68850ed609c 100644
--- a/deps/v8/src/snapshot/partial-serializer.h
+++ b/deps/v8/src/snapshot/context-serializer.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_SNAPSHOT_PARTIAL_SERIALIZER_H_
-#define V8_SNAPSHOT_PARTIAL_SERIALIZER_H_
+#ifndef V8_SNAPSHOT_CONTEXT_SERIALIZER_H_
+#define V8_SNAPSHOT_CONTEXT_SERIALIZER_H_
 
 #include "src/objects/contexts.h"
 #include "src/snapshot/serializer.h"
@@ -14,25 +14,23 @@ namespace internal {
 
 class StartupSerializer;
 
-class V8_EXPORT_PRIVATE PartialSerializer : public Serializer {
+class V8_EXPORT_PRIVATE ContextSerializer : public Serializer {
  public:
-  PartialSerializer(Isolate* isolate, StartupSerializer* startup_serializer,
+  ContextSerializer(Isolate* isolate, Snapshot::SerializerFlags flags,
+                    StartupSerializer* startup_serializer,
                     v8::SerializeEmbedderFieldsCallback callback);
 
-  ~PartialSerializer() override;
+  ~ContextSerializer() override;
 
   // Serialize the objects reachable from a single object pointer.
-  void Serialize(Context* o, bool include_global_proxy);
+  void Serialize(Context* o, const DisallowHeapAllocation& no_gc);
 
   bool can_be_rehashed() const { return can_be_rehashed_; }
 
  private:
   void SerializeObject(HeapObject o) override;
-
-  bool ShouldBeInThePartialSnapshotCache(HeapObject o);
-
+  bool ShouldBeInTheStartupObjectCache(HeapObject o);
   bool SerializeJSObjectWithEmbedderFields(Object obj);
-
   void CheckRehashability(HeapObject obj);
 
   StartupSerializer* startup_serializer_;
@@ -44,10 +42,10 @@ class V8_EXPORT_PRIVATE PartialSerializer : public Serializer {
 
   // Used to store serialized data for embedder fields.
   SnapshotByteSink embedder_fields_sink_;
-  DISALLOW_COPY_AND_ASSIGN(PartialSerializer);
+  DISALLOW_COPY_AND_ASSIGN(ContextSerializer);
 };
 
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_SNAPSHOT_PARTIAL_SERIALIZER_H_
+#endif  // V8_SNAPSHOT_CONTEXT_SERIALIZER_H_
diff --git a/deps/v8/src/snapshot/deserializer-allocator.cc b/deps/v8/src/snapshot/deserializer-allocator.cc
index e58e7b66aca..c1eaaed2960 100644
--- a/deps/v8/src/snapshot/deserializer-allocator.cc
+++ b/deps/v8/src/snapshot/deserializer-allocator.cc
@@ -5,10 +5,18 @@
 #include "src/snapshot/deserializer-allocator.h"
 
 #include "src/heap/heap-inl.h"  // crbug.com/v8/8499
+#include "src/heap/memory-chunk.h"
+#include "src/roots/roots.h"
 
 namespace v8 {
 namespace internal {
 
+void DeserializerAllocator::Initialize(LocalHeapWrapper heap) {
+  heap_ = heap;
+  roots_ = heap.is_off_thread() ? ReadOnlyRoots(heap.off_thread())
+                                : ReadOnlyRoots(heap.main_thread());
+}
+
 // We know the space requirements before deserialization and can
 // pre-allocate that reserved space. During deserialization, all we need
 // to do is to bump up the pointer for each space in the reserved
@@ -23,12 +31,18 @@ namespace internal {
 Address DeserializerAllocator::AllocateRaw(SnapshotSpace space, int size) {
   const int space_number = static_cast<int>(space);
   if (space == SnapshotSpace::kLargeObject) {
-    AlwaysAllocateScope scope(heap_);
     // Note that we currently do not support deserialization of large code
     // objects.
-    OldLargeObjectSpace* lo_space = heap_->lo_space();
-    AllocationResult result = lo_space->AllocateRaw(size);
-    HeapObject obj = result.ToObjectChecked();
+    HeapObject obj;
+    if (heap_.is_off_thread()) {
+      obj = heap_.off_thread()->lo_space_.AllocateRaw(size).ToObjectChecked();
+    } else {
+      Heap* heap = heap_.main_thread();
+      AlwaysAllocateScope scope(heap);
+      OldLargeObjectSpace* lo_space = heap->lo_space();
+      AllocationResult result = lo_space->AllocateRaw(size);
+      obj = result.ToObjectChecked();
+    }
     deserialized_large_objects_.push_back(obj);
     return obj.address();
   } else if (space == SnapshotSpace::kMap) {
@@ -81,10 +95,10 @@ Address DeserializerAllocator::Allocate(SnapshotSpace space, int size) {
     // If one of the following assertions fails, then we are deserializing an
     // aligned object when the filler maps have not been deserialized yet.
     // We require filler maps as padding to align the object.
-    DCHECK(ReadOnlyRoots(heap_).free_space_map().IsMap());
-    DCHECK(ReadOnlyRoots(heap_).one_pointer_filler_map().IsMap());
-    DCHECK(ReadOnlyRoots(heap_).two_pointer_filler_map().IsMap());
-    obj = heap_->AlignWithFiller(obj, size, reserved, next_alignment_);
+    DCHECK(roots_.free_space_map().IsMap());
+    DCHECK(roots_.one_pointer_filler_map().IsMap());
+    DCHECK(roots_.two_pointer_filler_map().IsMap());
+    obj = Heap::AlignWithFiller(roots_, obj, size, reserved, next_alignment_);
     address = obj.address();
     next_alignment_ = kWordAligned;
     return address;
@@ -107,6 +121,7 @@ void DeserializerAllocator::MoveToNextChunk(SnapshotSpace space) {
 }
 
 HeapObject DeserializerAllocator::GetMap(uint32_t index) {
+  DCHECK(!heap_.is_off_thread());
   DCHECK_LT(index, next_map_index_);
   return HeapObject::FromAddress(allocated_maps_[index]);
 }
@@ -154,10 +169,16 @@ bool DeserializerAllocator::ReserveSpace() {
   }
 #endif  // DEBUG
   DCHECK(allocated_maps_.empty());
-  // TODO(v8:7464): Allocate using the off-heap ReadOnlySpace here once
-  // implemented.
-  if (!heap_->ReserveSpace(reservations_, &allocated_maps_)) {
-    return false;
+  if (heap_.is_off_thread()) {
+    if (!heap_.off_thread()->ReserveSpace(reservations_)) {
+      return false;
+    }
+  } else {
+    // TODO(v8:7464): Allocate using the off-heap ReadOnlySpace here once
+    // implemented.
+    if (!heap_.main_thread()->ReserveSpace(reservations_, &allocated_maps_)) {
+      return false;
+    }
   }
   for (int i = 0; i < kNumberOfPreallocatedSpaces; i++) {
     high_water_[i] = reservations_[i][0].start;
@@ -179,7 +200,8 @@ bool DeserializerAllocator::ReservationsAreFullyUsed() const {
 }
 
 void DeserializerAllocator::RegisterDeserializedObjectsForBlackAllocation() {
-  heap_->RegisterDeserializedObjectsForBlackAllocation(
+  DCHECK(!heap_.is_off_thread());
+  heap_.main_thread()->RegisterDeserializedObjectsForBlackAllocation(
       reservations_, deserialized_large_objects_, allocated_maps_);
 }
 
diff --git a/deps/v8/src/snapshot/deserializer-allocator.h b/deps/v8/src/snapshot/deserializer-allocator.h
index 18f9363cdf1..9381e1302bd 100644
--- a/deps/v8/src/snapshot/deserializer-allocator.h
+++ b/deps/v8/src/snapshot/deserializer-allocator.h
@@ -6,21 +6,25 @@
 #define V8_SNAPSHOT_DESERIALIZER_ALLOCATOR_H_
 
 #include "src/common/globals.h"
+#include "src/execution/local-isolate-wrapper.h"
 #include "src/heap/heap.h"
 #include "src/objects/heap-object.h"
-#include "src/snapshot/serializer-common.h"
+#include "src/roots/roots.h"
+#include "src/snapshot/references.h"
+#include "src/snapshot/snapshot-data.h"
 
 namespace v8 {
 namespace internal {
 
 class Deserializer;
 class StartupDeserializer;
+class OffThreadHeap;
 
 class DeserializerAllocator final {
  public:
   DeserializerAllocator() = default;
 
-  void Initialize(Heap* heap) { heap_ = heap; }
+  void Initialize(LocalHeapWrapper heap);
 
   // ------- Allocation Methods -------
   // Methods related to memory allocation during deserialization.
@@ -98,7 +102,9 @@ class DeserializerAllocator final {
   // back-references.
   std::vector<HeapObject> deserialized_large_objects_;
 
-  Heap* heap_;
+  // ReadOnlyRoots and heap are null until Initialize is called.
+  LocalHeapWrapper heap_ = LocalHeapWrapper(nullptr);
+  ReadOnlyRoots roots_ = ReadOnlyRoots(static_cast<Address*>(nullptr));
 
   DISALLOW_COPY_AND_ASSIGN(DeserializerAllocator);
 };
diff --git a/deps/v8/src/snapshot/deserializer.cc b/deps/v8/src/snapshot/deserializer.cc
index fdb4babe071..f2c85e4cc0d 100644
--- a/deps/v8/src/snapshot/deserializer.cc
+++ b/deps/v8/src/snapshot/deserializer.cc
@@ -4,13 +4,17 @@
 
 #include "src/snapshot/deserializer.h"
 
+#include "src/base/logging.h"
 #include "src/codegen/assembler-inl.h"
+#include "src/common/external-pointer.h"
 #include "src/execution/isolate.h"
+#include "src/execution/local-isolate-wrapper-inl.h"
 #include "src/heap/heap-inl.h"
 #include "src/heap/heap-write-barrier-inl.h"
 #include "src/heap/read-only-heap.h"
 #include "src/interpreter/interpreter.h"
 #include "src/logging/log.h"
+#include "src/logging/off-thread-logger.h"
 #include "src/objects/api-callbacks.h"
 #include "src/objects/cell-inl.h"
 #include "src/objects/hash-table.h"
@@ -22,6 +26,7 @@
 #include "src/objects/smi.h"
 #include "src/objects/string.h"
 #include "src/roots/roots.h"
+#include "src/snapshot/embedded/embedded-data.h"
 #include "src/snapshot/snapshot.h"
 #include "src/tracing/trace-event.h"
 #include "src/tracing/traced-value.h"
@@ -44,22 +49,34 @@ TSlot Deserializer::WriteAddress(TSlot dest, Address value) {
   return dest + (kSystemPointerSize / TSlot::kSlotDataSize);
 }
 
-void Deserializer::Initialize(Isolate* isolate) {
-  DCHECK_NULL(isolate_);
-  DCHECK_NOT_NULL(isolate);
-  isolate_ = isolate;
-  allocator()->Initialize(isolate->heap());
+template <typename TSlot>
+TSlot Deserializer::WriteExternalPointer(TSlot dest, Address value) {
+  value = EncodeExternalPointer(isolate(), value);
+  DCHECK(!allocator()->next_reference_is_weak());
+  memcpy(dest.ToVoidPtr(), &value, kExternalPointerSize);
+  STATIC_ASSERT(IsAligned(kExternalPointerSize, TSlot::kSlotDataSize));
+  return dest + (kExternalPointerSize / TSlot::kSlotDataSize);
+}
+
+void Deserializer::Initialize(LocalIsolateWrapper local_isolate) {
+  DCHECK(local_isolate_.is_null());
+  DCHECK(!local_isolate.is_null());
+  local_isolate_ = local_isolate;
+  allocator()->Initialize(local_isolate->heap());
 
 #ifdef DEBUG
-  // The read-only deserializer is run by read-only heap set-up before the heap
-  // is fully set up. External reference table relies on a few parts of this
-  // set-up (like old-space), so it may be uninitialized at this point.
-  if (isolate->isolate_data()->external_reference_table()->is_initialized()) {
-    // Count the number of external references registered through the API.
-    num_api_references_ = 0;
-    if (isolate_->api_external_references() != nullptr) {
-      while (isolate_->api_external_references()[num_api_references_] != 0) {
-        num_api_references_++;
+  num_api_references_ = 0;
+  if (!local_isolate.is_off_thread()) {
+    Isolate* isolate = local_isolate.main_thread();
+    // The read-only deserializer is run by read-only heap set-up before the
+    // heap is fully set up. External reference table relies on a few parts of
+    // this set-up (like old-space), so it may be uninitialized at this point.
+    if (isolate->isolate_data()->external_reference_table()->is_initialized()) {
+      // Count the number of external references registered through the API.
+      if (isolate->api_external_references() != nullptr) {
+        while (isolate->api_external_references()[num_api_references_] != 0) {
+          num_api_references_++;
+        }
       }
     }
   }
@@ -70,7 +87,7 @@ void Deserializer::Initialize(Isolate* isolate) {
 void Deserializer::Rehash() {
   DCHECK(can_rehash() || deserializing_user_code());
   for (HeapObject item : to_rehash_) {
-    item.RehashBasedOnMap(ReadOnlyRoots(isolate_));
+    item.RehashBasedOnMap(local_isolate());
   }
 }
 
@@ -130,34 +147,32 @@ void Deserializer::DeserializeDeferredObjects() {
       }
     }
   }
-}
 
-void Deserializer::LogNewObjectEvents() {
-  {
-    // {new_maps_} and {new_code_objects_} are vectors containing raw
-    // pointers, hence there should be no GC happening.
-    DisallowHeapAllocation no_gc;
-    // Issue code events for newly deserialized code objects.
-    LOG_CODE_EVENT(isolate_, LogCodeObjects());
+  // When the deserialization of maps are deferred, they will be created
+  // as filler maps, and we postpone the post processing until the maps
+  // are also deserialized.
+  for (const auto& pair : fillers_to_post_process_) {
+    DCHECK(!pair.first.IsFiller());
+    PostProcessNewObject(pair.first, pair.second);
   }
-  LOG_CODE_EVENT(isolate_, LogCompiledFunctions());
-  LogNewMapEvents();
 }
 
 void Deserializer::LogNewMapEvents() {
   DisallowHeapAllocation no_gc;
-  for (Map map : new_maps()) {
+  DCHECK(is_main_thread());
+
+  for (Map map : new_maps_) {
     DCHECK(FLAG_trace_maps);
-    LOG(isolate_, MapCreate(map));
-    LOG(isolate_, MapDetails(map));
+    LOG(isolate(), MapCreate(map));
+    LOG(isolate(), MapDetails(map));
   }
 }
 
 void Deserializer::LogScriptEvents(Script script) {
   DisallowHeapAllocation no_gc;
-  LOG(isolate_,
+  LOG(local_isolate(),
       ScriptEvent(Logger::ScriptEventType::kDeserialize, script.id()));
-  LOG(isolate_, ScriptDetails(script));
+  LOG(local_isolate(), ScriptDetails(script));
 }
 
 StringTableInsertionKey::StringTableInsertionKey(String string)
@@ -201,7 +216,11 @@ HeapObject Deserializer::PostProcessNewObject(HeapObject obj,
   DisallowHeapAllocation no_gc;
 
   if ((FLAG_rehash_snapshot && can_rehash_) || deserializing_user_code()) {
-    if (obj.IsString()) {
+    if (obj.IsFiller()) {
+      DCHECK_EQ(fillers_to_post_process_.find(obj),
+                fillers_to_post_process_.end());
+      fillers_to_post_process_.insert({obj, space});
+    } else if (obj.IsString()) {
       // Uninitialize hash field as we need to recompute the hash.
       String string = String::cast(obj);
       string.set_hash_field(String::kEmptyHashField);
@@ -219,18 +238,22 @@ HeapObject Deserializer::PostProcessNewObject(HeapObject obj,
     if (obj.IsString()) {
       String string = String::cast(obj);
       if (string.IsInternalizedString()) {
+        // Off-thread internalized strings are canonicalized during off-thread
+        // isolate publish, so we don't have to canonicalize them here.
+        if (local_isolate().is_off_thread()) return string;
+
         // Canonicalize the internalized string. If it already exists in the
         // string table, set it to forward to the existing one.
         StringTableInsertionKey key(string);
-        String canonical = ForwardStringIfExists(isolate_, &key);
+        String canonical = ForwardStringIfExists(isolate(), &key);
 
         if (!canonical.is_null()) return canonical;
 
-        new_internalized_strings_.push_back(handle(string, isolate_));
+        new_internalized_strings_.push_back(handle(string, isolate()));
         return string;
       }
     } else if (obj.IsScript()) {
-      new_scripts_.push_back(handle(Script::cast(obj), isolate_));
+      new_scripts_.push_back(handle(Script::cast(obj), local_isolate()));
     } else if (obj.IsAllocationSite()) {
       // We should link new allocation sites, but we can't do this immediately
       // because |AllocationSite::HasWeakNext()| internally accesses
@@ -266,11 +289,11 @@ HeapObject Deserializer::PostProcessNewObject(HeapObject obj,
     ExternalString string = ExternalString::cast(obj);
     uint32_t index = string.resource_as_uint32();
     Address address =
-        static_cast<Address>(isolate_->api_external_references()[index]);
-    string.set_address_as_resource(address);
-    isolate_->heap()->UpdateExternalString(string, 0,
-                                           string.ExternalPayloadSize());
-    isolate_->heap()->RegisterExternalString(String::cast(obj));
+        static_cast<Address>(isolate()->api_external_references()[index]);
+    string.set_address_as_resource(isolate(), address);
+    isolate()->heap()->UpdateExternalString(string, 0,
+                                            string.ExternalPayloadSize());
+    isolate()->heap()->RegisterExternalString(String::cast(obj));
   } else if (obj.IsJSDataView()) {
     JSDataView data_view = JSDataView::cast(obj);
     JSArrayBuffer buffer = JSArrayBuffer::cast(data_view.buffer());
@@ -279,31 +302,35 @@ HeapObject Deserializer::PostProcessNewObject(HeapObject obj,
       // The backing store of the JSArrayBuffer has not been correctly restored
       // yet, as that may trigger GC. The backing_store field currently contains
       // a numbered reference to an already deserialized backing store.
-      size_t store_index = reinterpret_cast<size_t>(buffer.backing_store());
+      uint32_t store_index = buffer.GetBackingStoreRefForDeserialization();
       backing_store = backing_stores_[store_index]->buffer_start();
     }
-    data_view.set_data_pointer(reinterpret_cast<uint8_t*>(backing_store) +
-                               data_view.byte_offset());
+    data_view.set_data_pointer(
+        isolate(),
+        reinterpret_cast<uint8_t*>(backing_store) + data_view.byte_offset());
   } else if (obj.IsJSTypedArray()) {
     JSTypedArray typed_array = JSTypedArray::cast(obj);
     // Fixup typed array pointers.
     if (typed_array.is_on_heap()) {
-      typed_array.SetOnHeapDataPtr(HeapObject::cast(typed_array.base_pointer()),
+      typed_array.SetOnHeapDataPtr(isolate(),
+                                   HeapObject::cast(typed_array.base_pointer()),
                                    typed_array.external_pointer());
     } else {
       // Serializer writes backing store ref as a DataPtr() value.
-      size_t store_index = reinterpret_cast<size_t>(typed_array.DataPtr());
+      uint32_t store_index =
+          typed_array.GetExternalBackingStoreRefForDeserialization();
       auto backing_store = backing_stores_[store_index];
       auto start = backing_store
                        ? reinterpret_cast<byte*>(backing_store->buffer_start())
                        : nullptr;
-      typed_array.SetOffHeapDataPtr(start, typed_array.byte_offset());
+      typed_array.SetOffHeapDataPtr(isolate(), start,
+                                    typed_array.byte_offset());
     }
   } else if (obj.IsJSArrayBuffer()) {
     JSArrayBuffer buffer = JSArrayBuffer::cast(obj);
     // Postpone allocation of backing store to avoid triggering the GC.
     if (buffer.backing_store() != nullptr) {
-      new_off_heap_array_buffers_.push_back(handle(buffer, isolate_));
+      new_off_heap_array_buffers_.push_back(handle(buffer, local_isolate()));
     }
   } else if (obj.IsBytecodeArray()) {
     // TODO(mythria): Remove these once we store the default values for these
@@ -336,8 +363,9 @@ HeapObject Deserializer::GetBackReferencedObject(SnapshotSpace space) {
     case SnapshotSpace::kReadOnlyHeap: {
       uint32_t chunk_index = source_.GetInt();
       uint32_t chunk_offset = source_.GetInt();
-      if (isolate()->heap()->deserialization_complete()) {
-        PagedSpace* read_only_space = isolate()->heap()->read_only_space();
+      if (is_off_thread() || isolate()->heap()->deserialization_complete()) {
+        PagedSpace* read_only_space =
+            local_isolate()->heap()->read_only_space();
         Page* page = read_only_space->first_page();
         for (uint32_t i = 0; i < chunk_index; ++i) {
           page = page->next_page();
@@ -385,7 +413,7 @@ HeapObject Deserializer::ReadObject(SnapshotSpace space) {
   Address address = allocator()->Allocate(space, size);
   HeapObject obj = HeapObject::FromAddress(address);
 
-  isolate_->heap()->OnAllocationEvent(obj, size);
+  local_isolate()->heap()->OnAllocationEvent(obj, size);
   MaybeObjectSlot current(address);
   MaybeObjectSlot limit(address + size);
 
@@ -433,7 +461,7 @@ void Deserializer::VisitCodeTarget(Code host, RelocInfo* rinfo) {
 void Deserializer::VisitEmbeddedPointer(Code host, RelocInfo* rinfo) {
   HeapObject object = ReadObject();
   // Embedded object reference must be a strong one.
-  rinfo->set_target_object(isolate_->heap(), object);
+  rinfo->set_target_object(isolate()->heap(), object);
 }
 
 void Deserializer::VisitRuntimeEntry(Code host, RelocInfo* rinfo) {
@@ -476,7 +504,7 @@ void Deserializer::VisitOffHeapTarget(Code host, RelocInfo* rinfo) {
   int builtin_index = source_.GetInt();
   DCHECK(Builtins::IsBuiltinId(builtin_index));
 
-  CHECK_NOT_NULL(isolate_->embedded_blob());
+  CHECK_NOT_NULL(isolate()->embedded_blob());
   EmbeddedData d = EmbeddedData::FromBlob();
   Address address = d.InstructionStartOfBuiltin(builtin_index);
   CHECK_NE(kNullAddress, address);
@@ -517,7 +545,6 @@ template <typename TSlot>
 bool Deserializer::ReadData(TSlot current, TSlot limit,
                             SnapshotSpace source_space,
                             Address current_object_address) {
-  Isolate* const isolate = isolate_;
   // Write barrier support costs around 1% in startup time.  In fact there
   // are no new space objects in current boot snapshots, so it's not needed,
   // but that may change.
@@ -532,9 +559,9 @@ bool Deserializer::ReadData(TSlot current, TSlot limit,
   case bytecode + static_cast<int>(snapshot_space): \
     STATIC_ASSERT((static_cast<int>(snapshot_space) & ~kSpaceMask) == 0);
 
-#define CASE_BODY(bytecode, space_number_if_any)                             \
-  current = ReadDataCase<TSlot, bytecode, space_number_if_any>(              \
-      isolate, current, current_object_address, data, write_barrier_needed); \
+#define CASE_BODY(bytecode, space_number_if_any)                    \
+  current = ReadDataCase<TSlot, bytecode, space_number_if_any>(     \
+      current, current_object_address, data, write_barrier_needed); \
   break;
 
 // This generates a case and a body for the new space (which has to do extra
@@ -579,10 +606,10 @@ bool Deserializer::ReadData(TSlot current, TSlot limit,
       // Find an object in the roots array and write a pointer to it to the
       // current object.
       SINGLE_CASE(kRootArray, SnapshotSpace::kReadOnlyHeap)
-      // Find an object in the partial snapshots cache and write a pointer to it
+      // Find an object in the startup object cache and write a pointer to it
       // to the current object.
-      SINGLE_CASE(kPartialSnapshotCache, SnapshotSpace::kReadOnlyHeap)
-      // Find an object in the partial snapshots cache and write a pointer to it
+      SINGLE_CASE(kStartupObjectCache, SnapshotSpace::kReadOnlyHeap)
+      // Find an object in the read-only object cache and write a pointer to it
       // to the current object.
       SINGLE_CASE(kReadOnlyObjectCache, SnapshotSpace::kReadOnlyHeap)
       // Find an object in the attached references and write a pointer to it to
@@ -595,9 +622,15 @@ bool Deserializer::ReadData(TSlot current, TSlot limit,
 
       // Find an external reference and write a pointer to it to the current
       // object.
+      case kSandboxedExternalReference:
       case kExternalReference: {
         Address address = ReadExternalReferenceCase();
-        current = WriteAddress(current, address);
+        if (V8_HEAP_SANDBOX_BOOL && data == kSandboxedExternalReference) {
+          current = WriteExternalPointer(current, address);
+        } else {
+          DCHECK(!V8_HEAP_SANDBOX_BOOL);
+          current = WriteAddress(current, address);
+        }
         break;
       }
 
@@ -667,35 +700,44 @@ bool Deserializer::ReadData(TSlot current, TSlot limit,
       }
 
       case kOffHeapBackingStore: {
-        AlwaysAllocateScope scope(isolate->heap());
+        AlwaysAllocateScope scope(isolate()->heap());
         int byte_length = source_.GetInt();
-        std::unique_ptr<BackingStore> backing_store =
-            BackingStore::Allocate(isolate, byte_length, SharedFlag::kNotShared,
-                                   InitializedFlag::kUninitialized);
+        std::unique_ptr<BackingStore> backing_store = BackingStore::Allocate(
+            isolate(), byte_length, SharedFlag::kNotShared,
+            InitializedFlag::kUninitialized);
         CHECK_NOT_NULL(backing_store);
         source_.CopyRaw(backing_store->buffer_start(), byte_length);
         backing_stores_.push_back(std::move(backing_store));
         break;
       }
 
+      case kSandboxedApiReference:
       case kApiReference: {
         uint32_t reference_id = static_cast<uint32_t>(source_.GetInt());
         Address address;
-        if (isolate->api_external_references()) {
+        if (isolate()->api_external_references()) {
           DCHECK_WITH_MSG(
               reference_id < num_api_references_,
               "too few external references provided through the API");
           address = static_cast<Address>(
-              isolate->api_external_references()[reference_id]);
+              local_isolate()
+                  .main_thread()
+                  ->api_external_references()[reference_id]);
         } else {
           address = reinterpret_cast<Address>(NoExternalReferencesCallback);
         }
-        current = WriteAddress(current, address);
+        if (V8_HEAP_SANDBOX_BOOL && data == kSandboxedApiReference) {
+          current = WriteExternalPointer(current, address);
+        } else {
+          DCHECK(!V8_HEAP_SANDBOX_BOOL);
+          current = WriteAddress(current, address);
+        }
         break;
       }
 
       case kClearedWeakReference:
-        current = Write(current, HeapObjectReference::ClearedValue(isolate_));
+        current =
+            Write(current, HeapObjectReference::ClearedValue(local_isolate()));
         break;
 
       case kWeakPrefix:
@@ -722,7 +764,8 @@ bool Deserializer::ReadData(TSlot current, TSlot limit,
       SIXTEEN_CASES(kRootArrayConstants + 16) {
         int id = data & kRootArrayConstantsMask;
         RootIndex root_index = static_cast<RootIndex>(id);
-        MaybeObject object = MaybeObject::FromObject(isolate->root(root_index));
+        MaybeObject object =
+            MaybeObject(ReadOnlyRoots(local_isolate()).at(root_index));
         DCHECK(!Heap::InYoungGeneration(object));
         current = Write(current, object);
         break;
@@ -751,41 +794,17 @@ bool Deserializer::ReadData(TSlot current, TSlot limit,
         break;
       }
 
-      // Deserialize raw data of fixed length from 1 to 32 words.
+      // Deserialize raw data of fixed length from 1 to 32 times kTaggedSize.
       STATIC_ASSERT(kNumberOfFixedRawData == 32);
       SIXTEEN_CASES(kFixedRawData)
       SIXTEEN_CASES(kFixedRawData + 16) {
-        // This bytecode has become very confusing with recent changes due to
-        // pointer compression. From comments and variable names it implies that
-        // the length unit is words/kPointerSize, but the unit is actually
-        // kTaggedSize since https://chromium-review.googlesource.com/c/1388529.
-        //
-        // Also, contents can be (tagged) Smis or just a raw byte sequence. In
-        // the case of Smis we must be careful when deserializing into full
-        // object slots. It is not valid to deserialize a sequence of >1 Smis
-        // into full object slots in compressed pointer builds.
-        //
-        // Likewise one must pay attention to endianness when deserializing a
-        // smi into a full object slot. That is what the code below is trying to
-        // address.
-        //
-        // The solution below works because we currently never deserialize >1
-        // Smi into full object slots, or raw byte sequences into full object
-        // slots. But those assumptions are fragile.
-        //
-        const int size_in_tagged = data - kFixedRawDataStart;
-        const int size_in_bytes = size_in_tagged * kTaggedSize;
-        Address addr = current.address();
-        DCHECK_IMPLIES(kTaggedSize != TSlot::kSlotDataSize,
-                       size_in_tagged == 1);
-#ifdef V8_TARGET_BIG_ENDIAN
-        if (kTaggedSize != TSlot::kSlotDataSize) {
-          // Should only be reached when deserializing a Smi root.
-          addr += kTaggedSize;
-        }
-#endif
-        source_.CopyRaw(reinterpret_cast<void*>(addr), size_in_bytes);
-        current += size_in_tagged;
+        int size_in_tagged = data - kFixedRawDataStart;
+        source_.CopyRaw(current.ToVoidPtr(), size_in_tagged * kTaggedSize);
+
+        int size_in_bytes = size_in_tagged * kTaggedSize;
+        int size_in_slots = size_in_bytes / TSlot::kSlotDataSize;
+        DCHECK(IsAligned(size_in_bytes, TSlot::kSlotDataSize));
+        current += size_in_slots;
         break;
       }
 
@@ -815,14 +834,13 @@ bool Deserializer::ReadData(TSlot current, TSlot limit,
 
 Address Deserializer::ReadExternalReferenceCase() {
   uint32_t reference_id = static_cast<uint32_t>(source_.GetInt());
-  return isolate_->external_reference_table()->address(reference_id);
+  return isolate()->external_reference_table()->address(reference_id);
 }
 
 template <typename TSlot, SerializerDeserializer::Bytecode bytecode,
           SnapshotSpace space_number_if_any>
-TSlot Deserializer::ReadDataCase(Isolate* isolate, TSlot current,
-                                 Address current_object_address, byte data,
-                                 bool write_barrier_needed) {
+TSlot Deserializer::ReadDataCase(TSlot current, Address current_object_address,
+                                 byte data, bool write_barrier_needed) {
   bool emit_write_barrier = false;
   SnapshotSpace space = static_cast<SnapshotSpace>(
       space_number_if_any == kAnyOldSpace
@@ -843,19 +861,20 @@ TSlot Deserializer::ReadDataCase(Isolate* isolate, TSlot current,
   } else if (bytecode == kRootArray) {
     int id = source_.GetInt();
     RootIndex root_index = static_cast<RootIndex>(id);
-    heap_object = HeapObject::cast(isolate->root(root_index));
+    heap_object = HeapObject::cast(local_isolate()->root(root_index));
     emit_write_barrier = Heap::InYoungGeneration(heap_object);
     hot_objects_.Add(heap_object);
   } else if (bytecode == kReadOnlyObjectCache) {
     int cache_index = source_.GetInt();
     heap_object = HeapObject::cast(
-        isolate->read_only_heap()->cached_read_only_object(cache_index));
+        local_isolate()->read_only_heap()->cached_read_only_object(
+            cache_index));
     DCHECK(!Heap::InYoungGeneration(heap_object));
     emit_write_barrier = false;
-  } else if (bytecode == kPartialSnapshotCache) {
+  } else if (bytecode == kStartupObjectCache) {
     int cache_index = source_.GetInt();
     heap_object =
-        HeapObject::cast(isolate->partial_snapshot_cache()->at(cache_index));
+        HeapObject::cast(isolate()->startup_object_cache()->at(cache_index));
     emit_write_barrier = Heap::InYoungGeneration(heap_object);
   } else {
     DCHECK_EQ(bytecode, kAttachedReference);
@@ -872,7 +891,7 @@ TSlot Deserializer::ReadDataCase(Isolate* isolate, TSlot current,
   if (emit_write_barrier && write_barrier_needed) {
     DCHECK_IMPLIES(FLAG_disable_write_barriers, !write_barrier_needed);
     HeapObject host_object = HeapObject::FromAddress(current_object_address);
-    SLOW_DCHECK(isolate->heap()->Contains(host_object));
+    SLOW_DCHECK(local_isolate()->heap()->Contains(host_object));
     GenerationalBarrier(host_object, MaybeObjectSlot(current.address()),
                         heap_object_ref);
   }
diff --git a/deps/v8/src/snapshot/deserializer.h b/deps/v8/src/snapshot/deserializer.h
index 62814a881ae..344db431a18 100644
--- a/deps/v8/src/snapshot/deserializer.h
+++ b/deps/v8/src/snapshot/deserializer.h
@@ -8,6 +8,7 @@
 #include <utility>
 #include <vector>
 
+#include "src/execution/local-isolate-wrapper.h"
 #include "src/objects/allocation-site.h"
 #include "src/objects/api-callbacks.h"
 #include "src/objects/backing-store.h"
@@ -16,7 +17,7 @@
 #include "src/objects/map.h"
 #include "src/objects/string.h"
 #include "src/snapshot/deserializer-allocator.h"
-#include "src/snapshot/serializer-common.h"
+#include "src/snapshot/serializer-deserializer.h"
 #include "src/snapshot/snapshot-source-sink.h"
 
 namespace v8 {
@@ -47,7 +48,7 @@ class V8_EXPORT_PRIVATE Deserializer : public SerializerDeserializer {
   // Create a deserializer from a snapshot byte source.
   template <class Data>
   Deserializer(Data* data, bool deserializing_user_code)
-      : isolate_(nullptr),
+      : local_isolate_(nullptr),
         source_(data->Payload()),
         magic_number_(data->GetMagicNumber()),
         deserializing_user_code_(deserializing_user_code),
@@ -58,7 +59,10 @@ class V8_EXPORT_PRIVATE Deserializer : public SerializerDeserializer {
     backing_stores_.push_back({});
   }
 
-  void Initialize(Isolate* isolate);
+  void Initialize(Isolate* isolate) {
+    Initialize(LocalIsolateWrapper(isolate));
+  }
+  void Initialize(LocalIsolateWrapper isolate);
   void DeserializeDeferredObjects();
 
   // Create Log events for newly deserialized objects.
@@ -80,7 +84,11 @@ class V8_EXPORT_PRIVATE Deserializer : public SerializerDeserializer {
     CHECK_EQ(new_off_heap_array_buffers().size(), 0);
   }
 
-  Isolate* isolate() const { return isolate_; }
+  LocalIsolateWrapper local_isolate() const { return local_isolate_; }
+  Isolate* isolate() const { return local_isolate().main_thread(); }
+  bool is_main_thread() const { return local_isolate().is_main_thread(); }
+  bool is_off_thread() const { return local_isolate().is_off_thread(); }
+
   SnapshotByteSource* source() { return &source_; }
   const std::vector<AllocationSite>& new_allocation_sites() const {
     return new_allocation_sites_;
@@ -107,6 +115,7 @@ class V8_EXPORT_PRIVATE Deserializer : public SerializerDeserializer {
   }
 
   std::shared_ptr<BackingStore> backing_store(size_t i) {
+    DCHECK_LT(i, backing_stores_.size());
     return backing_stores_[i];
   }
 
@@ -116,9 +125,6 @@ class V8_EXPORT_PRIVATE Deserializer : public SerializerDeserializer {
 
   void Rehash();
 
-  // Cached current isolate.
-  Isolate* isolate_;
-
  private:
   void VisitRootPointers(Root root, const char* description,
                          FullObjectSlot start, FullObjectSlot end) override;
@@ -131,6 +137,9 @@ class V8_EXPORT_PRIVATE Deserializer : public SerializerDeserializer {
   template <typename TSlot>
   inline TSlot WriteAddress(TSlot dest, Address value);
 
+  template <typename TSlot>
+  inline TSlot WriteExternalPointer(TSlot dest, Address value);
+
   // Fills in some heap data in an area from start to end (non-inclusive).  The
   // space id is used for the write barrier.  The object_address is the address
   // of the object we are writing into, or nullptr if we are not writing into an
@@ -144,9 +153,8 @@ class V8_EXPORT_PRIVATE Deserializer : public SerializerDeserializer {
   // Returns the new value of {current}.
   template <typename TSlot, Bytecode bytecode,
             SnapshotSpace space_number_if_any>
-  inline TSlot ReadDataCase(Isolate* isolate, TSlot current,
-                            Address current_object_address, byte data,
-                            bool write_barrier_needed);
+  inline TSlot ReadDataCase(TSlot current, Address current_object_address,
+                            byte data, bool write_barrier_needed);
 
   // A helper function for ReadData for reading external references.
   inline Address ReadExternalReferenceCase();
@@ -171,6 +179,9 @@ class V8_EXPORT_PRIVATE Deserializer : public SerializerDeserializer {
   // Special handling for serialized code like hooking up internalized strings.
   HeapObject PostProcessNewObject(HeapObject obj, SnapshotSpace space);
 
+  // Cached current isolate.
+  LocalIsolateWrapper local_isolate_;
+
   // Objects from the attached object descriptions in the serialized user code.
   std::vector<Handle<HeapObject>> attached_objects_;
 
@@ -193,6 +204,11 @@ class V8_EXPORT_PRIVATE Deserializer : public SerializerDeserializer {
   // TODO(6593): generalize rehashing, and remove this flag.
   bool can_rehash_;
   std::vector<HeapObject> to_rehash_;
+  // Store the objects whose maps are deferred and thus initialized as filler
+  // maps during deserialization, so that they can be processed later when the
+  // maps become available.
+  std::unordered_map<HeapObject, SnapshotSpace, Object::Hasher>
+      fillers_to_post_process_;
 
 #ifdef DEBUG
   uint32_t num_api_references_;
diff --git a/deps/v8/src/snapshot/embedded/embedded-data.cc b/deps/v8/src/snapshot/embedded/embedded-data.cc
index bb2a49e61e1..93c584dcb74 100644
--- a/deps/v8/src/snapshot/embedded/embedded-data.cc
+++ b/deps/v8/src/snapshot/embedded/embedded-data.cc
@@ -7,6 +7,7 @@
 #include "src/codegen/assembler-inl.h"
 #include "src/codegen/callable.h"
 #include "src/objects/objects-inl.h"
+#include "src/snapshot/snapshot-utils.h"
 #include "src/snapshot/snapshot.h"
 
 namespace v8 {
@@ -306,7 +307,10 @@ Address EmbeddedData::InstructionEndOfBytecodeHandlers() const {
 size_t EmbeddedData::CreateEmbeddedBlobHash() const {
   STATIC_ASSERT(EmbeddedBlobHashOffset() == 0);
   STATIC_ASSERT(EmbeddedBlobHashSize() == kSizetSize);
-  return base::hash_range(data_ + EmbeddedBlobHashSize(), data_ + size_);
+  // Hash the entire blob except the hash field itself.
+  Vector<const byte> payload(data_ + EmbeddedBlobHashSize(),
+                             size_ - EmbeddedBlobHashSize());
+  return Checksum(payload);
 }
 
 void EmbeddedData::PrintStatistics() const {
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.cc b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.cc
index 8b1b4500d6e..ebb78477b69 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.cc
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.cc
@@ -96,10 +96,6 @@ void PlatformEmbeddedFileWriterAIX::DeclareFunctionBegin(const char* name,
 
 void PlatformEmbeddedFileWriterAIX::DeclareFunctionEnd(const char* name) {}
 
-int PlatformEmbeddedFileWriterAIX::HexLiteral(uint64_t value) {
-  return fprintf(fp_, "0x%" PRIx64, value);
-}
-
 void PlatformEmbeddedFileWriterAIX::FilePrologue() {}
 
 void PlatformEmbeddedFileWriterAIX::DeclareExternalFilename(
@@ -122,12 +118,6 @@ DataDirective PlatformEmbeddedFileWriterAIX::ByteChunkDataDirective() const {
   return kLong;
 }
 
-int PlatformEmbeddedFileWriterAIX::WriteByteChunk(const uint8_t* data) {
-  DCHECK_EQ(ByteChunkDataDirective(), kLong);
-  const uint32_t* long_ptr = reinterpret_cast<const uint32_t*>(data);
-  return HexLiteral(*long_ptr);
-}
-
 #undef SYMBOL_PREFIX
 
 }  // namespace internal
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.h b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.h
index 8f99c1ae85b..2c709e0a303 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.h
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-aix.h
@@ -37,8 +37,6 @@ class PlatformEmbeddedFileWriterAIX : public PlatformEmbeddedFileWriterBase {
   void DeclareFunctionBegin(const char* name, uint32_t size) override;
   void DeclareFunctionEnd(const char* name) override;
 
-  int HexLiteral(uint64_t value) override;
-
   void Comment(const char* string) override;
 
   void FilePrologue() override;
@@ -48,7 +46,6 @@ class PlatformEmbeddedFileWriterAIX : public PlatformEmbeddedFileWriterBase {
   int IndentedDataDirective(DataDirective directive) override;
 
   DataDirective ByteChunkDataDirective() const override;
-  int WriteByteChunk(const uint8_t* data) override;
 
  private:
   void DeclareSymbolGlobal(const char* name);
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-base.cc b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-base.cc
index 7a04a9dfabf..1cd402d8ba1 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-base.cc
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-base.cc
@@ -24,6 +24,10 @@ DataDirective PointerSizeDirective() {
   }
 }
 
+int PlatformEmbeddedFileWriterBase::HexLiteral(uint64_t value) {
+  return fprintf(fp_, "0x%" PRIx64, value);
+}
+
 int DataDirectiveSize(DataDirective directive) {
   switch (directive) {
     case kByte:
@@ -39,24 +43,37 @@ int DataDirectiveSize(DataDirective directive) {
 }
 
 int PlatformEmbeddedFileWriterBase::WriteByteChunk(const uint8_t* data) {
-  DCHECK_EQ(ByteChunkDataDirective(), kOcta);
-
-  static constexpr size_t kSize = kInt64Size;
-
-  uint64_t part1, part2;
-  // Use memcpy for the reads since {data} is not guaranteed to be aligned.
+  size_t kSize = DataDirectiveSize(ByteChunkDataDirective());
+  size_t kHalfSize = kSize / 2;
+  uint64_t high = 0, low = 0;
+
+  switch (kSize) {
+    case 1:
+      low = *data;
+      break;
+    case 4:
+      low = *reinterpret_cast<const uint32_t*>(data);
+      break;
+    case 8:
+      low = *reinterpret_cast<const uint64_t*>(data);
+      break;
+    case 16:
 #ifdef V8_TARGET_BIG_ENDIAN
-  memcpy(&part1, data, kSize);
-  memcpy(&part2, data + kSize, kSize);
+      memcpy(&high, data, kHalfSize);
+      memcpy(&low, data + kHalfSize, kHalfSize);
 #else
-  memcpy(&part1, data + kSize, kSize);
-  memcpy(&part2, data, kSize);
+      memcpy(&high, data + kHalfSize, kHalfSize);
+      memcpy(&low, data, kHalfSize);
 #endif  // V8_TARGET_BIG_ENDIAN
+      break;
+    default:
+      UNREACHABLE();
+  }
 
-  if (part1 != 0) {
-    return fprintf(fp(), "0x%" PRIx64 "%016" PRIx64, part1, part2);
+  if (high != 0) {
+    return fprintf(fp(), "0x%" PRIx64 "%016" PRIx64, high, low);
   } else {
-    return fprintf(fp(), "0x%" PRIx64, part2);
+    return fprintf(fp(), "0x%" PRIx64, low);
   }
 }
 
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-base.h b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-base.h
index eab5ca8ec67..b8709cb9329 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-base.h
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-base.h
@@ -67,7 +67,7 @@ class PlatformEmbeddedFileWriterBase {
   virtual void DeclareFunctionEnd(const char* name) = 0;
 
   // Returns the number of printed characters.
-  virtual int HexLiteral(uint64_t value) = 0;
+  virtual int HexLiteral(uint64_t value);
 
   virtual void Comment(const char* string) = 0;
   virtual void Newline() { fprintf(fp_, "\n"); }
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.cc b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.cc
index f1d6efc7677..7e779ec6e5f 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.cc
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.cc
@@ -114,10 +114,6 @@ void PlatformEmbeddedFileWriterGeneric::DeclareFunctionBegin(const char* name,
 
 void PlatformEmbeddedFileWriterGeneric::DeclareFunctionEnd(const char* name) {}
 
-int PlatformEmbeddedFileWriterGeneric::HexLiteral(uint64_t value) {
-  return fprintf(fp_, "0x%" PRIx64, value);
-}
-
 void PlatformEmbeddedFileWriterGeneric::FilePrologue() {
   // TODO(v8:10026): Add ELF note required for BTI.
 }
@@ -146,6 +142,18 @@ int PlatformEmbeddedFileWriterGeneric::IndentedDataDirective(
   return fprintf(fp_, "  %s ", DirectiveAsString(directive));
 }
 
+DataDirective PlatformEmbeddedFileWriterGeneric::ByteChunkDataDirective()
+    const {
+#if defined(V8_TARGET_ARCH_MIPS) || defined(V8_TARGET_ARCH_MIPS64)
+  // MIPS uses a fixed 4 byte instruction set, using .long
+  // to prevent any unnecessary padding.
+  return kLong;
+#else
+  // Other ISAs just listen to the base
+  return PlatformEmbeddedFileWriterBase::ByteChunkDataDirective();
+#endif
+}
+
 #undef SYMBOL_PREFIX
 
 }  // namespace internal
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.h b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.h
index 1f899cbb5ca..4d8284f31fd 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.h
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-generic.h
@@ -39,8 +39,6 @@ class PlatformEmbeddedFileWriterGeneric
   void DeclareFunctionBegin(const char* name, uint32_t size) override;
   void DeclareFunctionEnd(const char* name) override;
 
-  int HexLiteral(uint64_t value) override;
-
   void Comment(const char* string) override;
 
   void FilePrologue() override;
@@ -49,6 +47,8 @@ class PlatformEmbeddedFileWriterGeneric
 
   int IndentedDataDirective(DataDirective directive) override;
 
+  DataDirective ByteChunkDataDirective() const override;
+
  private:
   void DeclareSymbolGlobal(const char* name);
 
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.cc b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.cc
index 234f8a1f485..a094a81ee29 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.cc
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.cc
@@ -89,10 +89,6 @@ void PlatformEmbeddedFileWriterMac::DeclareFunctionBegin(const char* name,
 
 void PlatformEmbeddedFileWriterMac::DeclareFunctionEnd(const char* name) {}
 
-int PlatformEmbeddedFileWriterMac::HexLiteral(uint64_t value) {
-  return fprintf(fp_, "0x%" PRIx64, value);
-}
-
 void PlatformEmbeddedFileWriterMac::FilePrologue() {}
 
 void PlatformEmbeddedFileWriterMac::DeclareExternalFilename(
diff --git a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.h b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.h
index 76780d75f36..79f8fdf587d 100644
--- a/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.h
+++ b/deps/v8/src/snapshot/embedded/platform-embedded-file-writer-mac.h
@@ -37,8 +37,6 @@ class PlatformEmbeddedFileWriterMac : public PlatformEmbeddedFileWriterBase {
   void DeclareFunctionBegin(const char* name, uint32_t size) override;
   void DeclareFunctionEnd(const char* name) override;
 
-  int HexLiteral(uint64_t value) override;
-
   void Comment(const char* string) override;
 
   void FilePrologue() override;
diff --git a/deps/v8/src/snapshot/mksnapshot.cc b/deps/v8/src/snapshot/mksnapshot.cc
index d0d94147072..c0d3846e9e0 100644
--- a/deps/v8/src/snapshot/mksnapshot.cc
+++ b/deps/v8/src/snapshot/mksnapshot.cc
@@ -13,8 +13,8 @@
 #include "src/codegen/source-position-table.h"
 #include "src/flags/flags.h"
 #include "src/sanitizer/msan.h"
+#include "src/snapshot/context-serializer.h"
 #include "src/snapshot/embedded/embedded-file-writer.h"
-#include "src/snapshot/partial-serializer.h"
 #include "src/snapshot/snapshot.h"
 #include "src/snapshot/startup-serializer.h"
 
diff --git a/deps/v8/src/snapshot/object-deserializer.cc b/deps/v8/src/snapshot/object-deserializer.cc
index cca8d422409..caae792c42e 100644
--- a/deps/v8/src/snapshot/object-deserializer.cc
+++ b/deps/v8/src/snapshot/object-deserializer.cc
@@ -6,6 +6,7 @@
 
 #include "src/codegen/assembler-inl.h"
 #include "src/execution/isolate.h"
+#include "src/execution/local-isolate-wrapper-inl.h"
 #include "src/heap/heap-inl.h"
 #include "src/objects/allocation-site-inl.h"
 #include "src/objects/objects.h"
@@ -26,77 +27,92 @@ ObjectDeserializer::DeserializeSharedFunctionInfo(
   d.AddAttachedObject(source);
 
   Handle<HeapObject> result;
-  return d.Deserialize(isolate).ToHandle(&result)
+  return d.Deserialize(LocalIsolateWrapper(isolate)).ToHandle(&result)
              ? Handle<SharedFunctionInfo>::cast(result)
              : MaybeHandle<SharedFunctionInfo>();
 }
 
-MaybeHandle<HeapObject> ObjectDeserializer::Deserialize(Isolate* isolate) {
-  Initialize(isolate);
+MaybeHandle<SharedFunctionInfo>
+ObjectDeserializer::DeserializeSharedFunctionInfoOffThread(
+    OffThreadIsolate* isolate, const SerializedCodeData* data,
+    Handle<String> source) {
+  DCHECK(ReadOnlyHeap::Contains(*source) || Heap::InOffThreadSpace(*source));
+
+  ObjectDeserializer d(data);
+
+  d.AddAttachedObject(source);
+
+  Handle<HeapObject> result;
+  return d.Deserialize(LocalIsolateWrapper(isolate)).ToHandle(&result)
+             ? Handle<SharedFunctionInfo>::cast(result)
+             : MaybeHandle<SharedFunctionInfo>();
+}
+
+MaybeHandle<HeapObject> ObjectDeserializer::Deserialize(
+    LocalIsolateWrapper local_isolate) {
+  Initialize(local_isolate);
   if (!allocator()->ReserveSpace()) return MaybeHandle<HeapObject>();
 
   DCHECK(deserializing_user_code());
-  HandleScope scope(isolate);
+  LocalHandleScopeWrapper scope(local_isolate);
   Handle<HeapObject> result;
   {
     DisallowHeapAllocation no_gc;
     Object root;
-    VisitRootPointer(Root::kPartialSnapshotCache, nullptr,
-                     FullObjectSlot(&root));
+    VisitRootPointer(Root::kStartupObjectCache, nullptr, FullObjectSlot(&root));
     DeserializeDeferredObjects();
-    FlushICache();
-    LinkAllocationSites();
-    LogNewMapEvents();
-    result = handle(HeapObject::cast(root), isolate);
-    Rehash();
-    allocator()->RegisterDeserializedObjectsForBlackAllocation();
+    CHECK(new_code_objects().empty());
+    if (is_main_thread()) {
+      LinkAllocationSites();
+      LogNewMapEvents();
+    }
+    result = handle(HeapObject::cast(root), local_isolate);
+    if (is_main_thread()) {
+      allocator()->RegisterDeserializedObjectsForBlackAllocation();
+    }
   }
+
+  Rehash();
   CommitPostProcessedObjects();
   return scope.CloseAndEscape(result);
 }
 
-void ObjectDeserializer::FlushICache() {
-  DCHECK(deserializing_user_code());
-  for (Code code : new_code_objects()) {
-    // Record all references to embedded objects in the new code object.
-#ifndef V8_DISABLE_WRITE_BARRIERS
-    WriteBarrierForCode(code);
-#endif
-    FlushInstructionCache(code.raw_instruction_start(),
-                          code.raw_instruction_size());
-  }
-}
-
 void ObjectDeserializer::CommitPostProcessedObjects() {
-  CHECK_LE(new_internalized_strings().size(), kMaxInt);
-  StringTable::EnsureCapacityForDeserialization(
-      isolate(), static_cast<int>(new_internalized_strings().size()));
-  for (Handle<String> string : new_internalized_strings()) {
-    DisallowHeapAllocation no_gc;
-    StringTableInsertionKey key(*string);
-    StringTable::AddKeyNoResize(isolate(), &key);
+  if (is_main_thread()) {
+    CHECK_LE(new_internalized_strings().size(), kMaxInt);
+    StringTable::EnsureCapacityForDeserialization(
+        isolate(), static_cast<int>(new_internalized_strings().size()));
+    for (Handle<String> string : new_internalized_strings()) {
+      DisallowHeapAllocation no_gc;
+      StringTableInsertionKey key(*string);
+      StringTable::AddKeyNoResize(isolate(), &key);
+    }
+
+    for (Handle<JSArrayBuffer> buffer : new_off_heap_array_buffers()) {
+      uint32_t store_index = buffer->GetBackingStoreRefForDeserialization();
+      auto bs = backing_store(store_index);
+      SharedFlag shared =
+          bs && bs->is_shared() ? SharedFlag::kShared : SharedFlag::kNotShared;
+      buffer->Setup(shared, bs);
+    }
+  } else {
+    CHECK_EQ(new_internalized_strings().size(), 0);
+    CHECK_EQ(new_off_heap_array_buffers().size(), 0);
   }
 
-  Heap* heap = isolate()->heap();
-  Factory* factory = isolate()->factory();
   for (Handle<Script> script : new_scripts()) {
     // Assign a new script id to avoid collision.
-    script->set_id(isolate()->GetNextScriptId());
+    script->set_id(local_isolate()->GetNextScriptId());
     LogScriptEvents(*script);
     // Add script to list.
-    Handle<WeakArrayList> list = factory->script_list();
-    list = WeakArrayList::AddToEnd(isolate(), list,
-                                   MaybeObjectHandle::Weak(script));
-    heap->SetRootScriptList(*list);
-  }
-
-  for (Handle<JSArrayBuffer> buffer : new_off_heap_array_buffers()) {
-    // Serializer writes backing store ref in |backing_store| field.
-    size_t store_index = reinterpret_cast<size_t>(buffer->backing_store());
-    auto bs = backing_store(store_index);
-    SharedFlag shared =
-        bs && bs->is_shared() ? SharedFlag::kShared : SharedFlag::kNotShared;
-    buffer->Setup(shared, bs);
+    if (is_main_thread()) {
+      Handle<WeakArrayList> list = isolate()->factory()->script_list();
+      list = WeakArrayList::AddToEnd(isolate(), list,
+                                     MaybeObjectHandle::Weak(script));
+      isolate()->heap()->SetRootScriptList(*list);
+    } else {
+      local_isolate().off_thread()->heap()->AddToScriptList(script);
+    }
   }
 }
 
diff --git a/deps/v8/src/snapshot/object-deserializer.h b/deps/v8/src/snapshot/object-deserializer.h
index ad7fecb0213..5003ffe1602 100644
--- a/deps/v8/src/snapshot/object-deserializer.h
+++ b/deps/v8/src/snapshot/object-deserializer.h
@@ -18,14 +18,16 @@ class ObjectDeserializer final : public Deserializer {
  public:
   static MaybeHandle<SharedFunctionInfo> DeserializeSharedFunctionInfo(
       Isolate* isolate, const SerializedCodeData* data, Handle<String> source);
+  static MaybeHandle<SharedFunctionInfo> DeserializeSharedFunctionInfoOffThread(
+      OffThreadIsolate* isolate, const SerializedCodeData* data,
+      Handle<String> source);
 
  private:
   explicit ObjectDeserializer(const SerializedCodeData* data);
 
   // Deserialize an object graph. Fail gracefully.
-  MaybeHandle<HeapObject> Deserialize(Isolate* isolate);
+  MaybeHandle<HeapObject> Deserialize(LocalIsolateWrapper isolate);
 
-  void FlushICache();
   void LinkAllocationSites();
   void CommitPostProcessedObjects();
 };
diff --git a/deps/v8/src/snapshot/read-only-deserializer.cc b/deps/v8/src/snapshot/read-only-deserializer.cc
index a2ad1a02796..cb168d62f81 100644
--- a/deps/v8/src/snapshot/read-only-deserializer.cc
+++ b/deps/v8/src/snapshot/read-only-deserializer.cc
@@ -29,8 +29,8 @@ void ReadOnlyDeserializer::DeserializeInto(Isolate* isolate) {
   DCHECK(isolate->handle_scope_implementer()->blocks()->empty());
   // Read-only object cache is not yet populated.
   DCHECK(!ro_heap->read_only_object_cache_is_initialized());
-  // Partial snapshot cache is not yet populated.
-  DCHECK(isolate->partial_snapshot_cache()->empty());
+  // Startup object cache is not yet populated.
+  DCHECK(isolate->startup_object_cache()->empty());
   // Builtins are not yet created.
   DCHECK(!isolate->builtins()->is_initialized());
 
@@ -55,7 +55,7 @@ void ReadOnlyDeserializer::DeserializeInto(Isolate* isolate) {
   }
 
   if (FLAG_rehash_snapshot && can_rehash()) {
-    isolate_->heap()->InitializeHashSeed();
+    isolate->heap()->InitializeHashSeed();
     Rehash();
   }
 }
diff --git a/deps/v8/src/snapshot/read-only-serializer.cc b/deps/v8/src/snapshot/read-only-serializer.cc
index 41e61881549..9bc8f105d1a 100644
--- a/deps/v8/src/snapshot/read-only-serializer.cc
+++ b/deps/v8/src/snapshot/read-only-serializer.cc
@@ -16,8 +16,9 @@
 namespace v8 {
 namespace internal {
 
-ReadOnlySerializer::ReadOnlySerializer(Isolate* isolate)
-    : RootsSerializer(isolate, RootIndex::kFirstReadOnlyRoot) {
+ReadOnlySerializer::ReadOnlySerializer(Isolate* isolate,
+                                       Snapshot::SerializerFlags flags)
+    : RootsSerializer(isolate, flags, RootIndex::kFirstReadOnlyRoot) {
   STATIC_ASSERT(RootIndex::kFirstReadOnlyRoot == RootIndex::kFirstRoot);
   allocator()->UseCustomChunkSize(FLAG_serialization_chunk_size);
 }
@@ -50,7 +51,8 @@ void ReadOnlySerializer::SerializeReadOnlyRoots() {
   // No active threads.
   CHECK_NULL(isolate()->thread_manager()->FirstThreadStateInUse());
   // No active or weak handles.
-  CHECK(isolate()->handle_scope_implementer()->blocks()->empty());
+  CHECK_IMPLIES(!allow_active_isolate_for_testing(),
+                isolate()->handle_scope_implementer()->blocks()->empty());
 
   ReadOnlyRoots(isolate()).Iterate(this);
 }
diff --git a/deps/v8/src/snapshot/read-only-serializer.h b/deps/v8/src/snapshot/read-only-serializer.h
index c73c3976476..f30b2c30ba2 100644
--- a/deps/v8/src/snapshot/read-only-serializer.h
+++ b/deps/v8/src/snapshot/read-only-serializer.h
@@ -17,7 +17,7 @@ class SnapshotByteSink;
 
 class V8_EXPORT_PRIVATE ReadOnlySerializer : public RootsSerializer {
  public:
-  explicit ReadOnlySerializer(Isolate* isolate);
+  ReadOnlySerializer(Isolate* isolate, Snapshot::SerializerFlags flags);
   ~ReadOnlySerializer() override;
 
   void SerializeReadOnlyRoots();
diff --git a/deps/v8/src/snapshot/roots-serializer.cc b/deps/v8/src/snapshot/roots-serializer.cc
index f354dec1589..6a8f2bb05e5 100644
--- a/deps/v8/src/snapshot/roots-serializer.cc
+++ b/deps/v8/src/snapshot/roots-serializer.cc
@@ -13,8 +13,9 @@ namespace v8 {
 namespace internal {
 
 RootsSerializer::RootsSerializer(Isolate* isolate,
+                                 Snapshot::SerializerFlags flags,
                                  RootIndex first_root_to_be_serialized)
-    : Serializer(isolate),
+    : Serializer(isolate, flags),
       first_root_to_be_serialized_(first_root_to_be_serialized),
       can_be_rehashed_(true) {
   for (size_t i = 0; i < static_cast<size_t>(first_root_to_be_serialized);
@@ -47,7 +48,7 @@ void RootsSerializer::VisitRootPointers(Root root, const char* description,
     // - Only root list elements that have been fully serialized can be
     //   referenced using kRootArray bytecodes.
     for (FullObjectSlot current = start; current < end; ++current) {
-      SerializeRootObject(*current);
+      SerializeRootObject(current);
       size_t root_index = current - roots_table.begin();
       root_has_been_serialized_.set(root_index);
     }
diff --git a/deps/v8/src/snapshot/roots-serializer.h b/deps/v8/src/snapshot/roots-serializer.h
index cfb59dd75e9..be41d7220fb 100644
--- a/deps/v8/src/snapshot/roots-serializer.h
+++ b/deps/v8/src/snapshot/roots-serializer.h
@@ -24,7 +24,8 @@ class RootsSerializer : public Serializer {
  public:
   // The serializer expects that all roots before |first_root_to_be_serialized|
   // are already serialized.
-  RootsSerializer(Isolate* isolate, RootIndex first_root_to_be_serialized);
+  RootsSerializer(Isolate* isolate, Snapshot::SerializerFlags flags,
+                  RootIndex first_root_to_be_serialized);
 
   bool can_be_rehashed() const { return can_be_rehashed_; }
   bool root_has_been_serialized(RootIndex root_index) const {
diff --git a/deps/v8/src/snapshot/serializer-allocator.h b/deps/v8/src/snapshot/serializer-allocator.h
index 0d15c5a91bf..51264961cd2 100644
--- a/deps/v8/src/snapshot/serializer-allocator.h
+++ b/deps/v8/src/snapshot/serializer-allocator.h
@@ -5,7 +5,8 @@
 #ifndef V8_SNAPSHOT_SERIALIZER_ALLOCATOR_H_
 #define V8_SNAPSHOT_SERIALIZER_ALLOCATOR_H_
 
-#include "src/snapshot/serializer-common.h"
+#include "src/snapshot/references.h"
+#include "src/snapshot/snapshot-data.h"
 
 namespace v8 {
 namespace internal {
diff --git a/deps/v8/src/snapshot/serializer-deserializer.cc b/deps/v8/src/snapshot/serializer-deserializer.cc
new file mode 100644
index 00000000000..37fb2636ceb
--- /dev/null
+++ b/deps/v8/src/snapshot/serializer-deserializer.cc
@@ -0,0 +1,61 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/snapshot/serializer-deserializer.h"
+
+#include "src/objects/foreign-inl.h"
+#include "src/objects/objects-inl.h"
+
+namespace v8 {
+namespace internal {
+
+// The startup object cache is terminated by undefined. We visit the context
+// snapshot...
+//  - during deserialization to populate it.
+//  - during normal GC to keep its content alive.
+//  - not during serialization. The context serializer adds to it explicitly.
+DISABLE_CFI_PERF
+void SerializerDeserializer::Iterate(Isolate* isolate, RootVisitor* visitor) {
+  std::vector<Object>* cache = isolate->startup_object_cache();
+  for (size_t i = 0;; ++i) {
+    // Extend the array ready to get a value when deserializing.
+    if (cache->size() <= i) cache->push_back(Smi::zero());
+    // During deserialization, the visitor populates the startup object cache
+    // and eventually terminates the cache with undefined.
+    visitor->VisitRootPointer(Root::kStartupObjectCache, nullptr,
+                              FullObjectSlot(&cache->at(i)));
+    if (cache->at(i).IsUndefined(isolate)) break;
+  }
+}
+
+bool SerializerDeserializer::CanBeDeferred(HeapObject o) {
+  // ArrayBuffer instances are serialized by first re-assigning a index
+  // to the backing store field, then serializing the object, and then
+  // storing the actual backing store address again (and the same for the
+  // ArrayBufferExtension). If serialization of the object itself is deferred,
+  // the real backing store address is written into the snapshot, which cannot
+  // be processed when deserializing.
+  return !o.IsString() && !o.IsScript() && !o.IsJSTypedArray() &&
+         !o.IsJSArrayBuffer();
+}
+
+void SerializerDeserializer::RestoreExternalReferenceRedirectors(
+    Isolate* isolate, const std::vector<AccessorInfo>& accessor_infos) {
+  // Restore wiped accessor infos.
+  for (AccessorInfo info : accessor_infos) {
+    Foreign::cast(info.js_getter())
+        .set_foreign_address(isolate, info.redirected_getter());
+  }
+}
+
+void SerializerDeserializer::RestoreExternalReferenceRedirectors(
+    Isolate* isolate, const std::vector<CallHandlerInfo>& call_handler_infos) {
+  for (CallHandlerInfo info : call_handler_infos) {
+    Foreign::cast(info.js_callback())
+        .set_foreign_address(isolate, info.redirected_callback());
+  }
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/snapshot/serializer-common.h b/deps/v8/src/snapshot/serializer-deserializer.h
similarity index 61%
rename from deps/v8/src/snapshot/serializer-common.h
rename to deps/v8/src/snapshot/serializer-deserializer.h
index 3636da3aa45..d9d62d89f01 100644
--- a/deps/v8/src/snapshot/serializer-common.h
+++ b/deps/v8/src/snapshot/serializer-deserializer.h
@@ -1,18 +1,12 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
+// Copyright 2020 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_SNAPSHOT_SERIALIZER_COMMON_H_
-#define V8_SNAPSHOT_SERIALIZER_COMMON_H_
+#ifndef V8_SNAPSHOT_SERIALIZER_DESERIALIZER_H_
+#define V8_SNAPSHOT_SERIALIZER_DESERIALIZER_H_
 
-#include "src/base/bits.h"
-#include "src/base/memory.h"
-#include "src/codegen/external-reference-table.h"
-#include "src/common/globals.h"
 #include "src/objects/visitors.h"
-#include "src/sanitizer/msan.h"
 #include "src/snapshot/references.h"
-#include "src/utils/address-map.h"
 
 namespace v8 {
 namespace internal {
@@ -20,95 +14,57 @@ namespace internal {
 class CallHandlerInfo;
 class Isolate;
 
-class ExternalReferenceEncoder {
+// The Serializer/Deserializer class is a common superclass for Serializer and
+// Deserializer which is used to store common constants and methods used by
+// both.
+class SerializerDeserializer : public RootVisitor {
  public:
-  class Value {
-   public:
-    explicit Value(uint32_t raw) : value_(raw) {}
-    Value() : value_(0) {}
-    static uint32_t Encode(uint32_t index, bool is_from_api) {
-      return Index::encode(index) | IsFromAPI::encode(is_from_api);
-    }
-
-    bool is_from_api() const { return IsFromAPI::decode(value_); }
-    uint32_t index() const { return Index::decode(value_); }
-
-   private:
-    using Index = base::BitField<uint32_t, 0, 31>;
-    using IsFromAPI = base::BitField<bool, 31, 1>;
-    uint32_t value_;
-  };
-
-  explicit ExternalReferenceEncoder(Isolate* isolate);
-  ~ExternalReferenceEncoder();  // NOLINT (modernize-use-equals-default)
-
-  Value Encode(Address key);
-  Maybe<Value> TryEncode(Address key);
-
-  const char* NameOfAddress(Isolate* isolate, Address address) const;
-
- private:
-  AddressToIndexHashMap* map_;
-
-#ifdef DEBUG
-  std::vector<int> count_;
-  const intptr_t* api_references_;
-#endif  // DEBUG
-
-  DISALLOW_COPY_AND_ASSIGN(ExternalReferenceEncoder);
-};
+  static void Iterate(Isolate* isolate, RootVisitor* visitor);
 
-class HotObjectsList {
- public:
-  HotObjectsList() : index_(0) {}
+ protected:
+  class HotObjectsList {
+   public:
+    HotObjectsList() = default;
 
-  void Add(HeapObject object) {
-    DCHECK(!AllowHeapAllocation::IsAllowed());
-    circular_queue_[index_] = object;
-    index_ = (index_ + 1) & kSizeMask;
-  }
+    void Add(HeapObject object) {
+      DCHECK(!AllowHeapAllocation::IsAllowed());
+      circular_queue_[index_] = object;
+      index_ = (index_ + 1) & kSizeMask;
+    }
 
-  HeapObject Get(int index) {
-    DCHECK(!AllowHeapAllocation::IsAllowed());
-    DCHECK(!circular_queue_[index].is_null());
-    return circular_queue_[index];
-  }
+    HeapObject Get(int index) {
+      DCHECK(!AllowHeapAllocation::IsAllowed());
+      DCHECK(!circular_queue_[index].is_null());
+      return circular_queue_[index];
+    }
 
-  static const int kNotFound = -1;
+    static const int kNotFound = -1;
 
-  int Find(HeapObject object) {
-    DCHECK(!AllowHeapAllocation::IsAllowed());
-    for (int i = 0; i < kSize; i++) {
-      if (circular_queue_[i] == object) return i;
+    int Find(HeapObject object) {
+      DCHECK(!AllowHeapAllocation::IsAllowed());
+      for (int i = 0; i < kSize; i++) {
+        if (circular_queue_[i] == object) return i;
+      }
+      return kNotFound;
     }
-    return kNotFound;
-  }
 
-  static const int kSize = 8;
+    static const int kSize = 8;
 
- private:
-  static_assert(base::bits::IsPowerOfTwo(kSize), "kSize must be power of two");
-  static const int kSizeMask = kSize - 1;
-  HeapObject circular_queue_[kSize];
-  int index_;
-
-  DISALLOW_COPY_AND_ASSIGN(HotObjectsList);
-};
+   private:
+    STATIC_ASSERT(base::bits::IsPowerOfTwo(kSize));
+    static const int kSizeMask = kSize - 1;
+    HeapObject circular_queue_[kSize];
+    int index_ = 0;
 
-// The Serializer/Deserializer class is a common superclass for Serializer and
-// Deserializer which is used to store common constants and methods used by
-// both.
-class SerializerDeserializer : public RootVisitor {
- public:
-  static void Iterate(Isolate* isolate, RootVisitor* visitor);
+    DISALLOW_COPY_AND_ASSIGN(HotObjectsList);
+  };
 
- protected:
   static bool CanBeDeferred(HeapObject o);
 
   void RestoreExternalReferenceRedirectors(
-      const std::vector<AccessorInfo>& accessor_infos);
+      Isolate* isolate, const std::vector<AccessorInfo>& accessor_infos);
   void RestoreExternalReferenceRedirectors(
-      const std::vector<CallHandlerInfo>& call_handler_infos);
+      Isolate* isolate, const std::vector<CallHandlerInfo>& call_handler_infos);
 
   static const int kNumberOfPreallocatedSpaces =
       static_cast<int>(SnapshotSpace::kNumberOfPreallocatedSpaces);
@@ -119,8 +75,7 @@ class SerializerDeserializer : public RootVisitor {
 // clang-format off
 #define UNUSED_SERIALIZER_BYTE_CODES(V)                           \
   V(0x06) V(0x07) V(0x0e) V(0x0f)                                 \
-  /* Free range 0x26..0x2f */                                     \
-  V(0x26) V(0x27)                                                 \
+  /* Free range 0x28..0x2f */                                     \
   V(0x28) V(0x29) V(0x2a) V(0x2b) V(0x2c) V(0x2d) V(0x2e) V(0x2f) \
   /* Free range 0x30..0x3f */                                     \
   V(0x30) V(0x31) V(0x32) V(0x33) V(0x34) V(0x35) V(0x36) V(0x37) \
@@ -180,11 +135,11 @@ class SerializerDeserializer : public RootVisitor {
     kBackref = 0x08,
 
     //
-    // ---------- byte code range 0x10..0x25 ----------
+    // ---------- byte code range 0x10..0x27 ----------
     //
 
-    // Object in the partial snapshot cache.
-    kPartialSnapshotCache = 0x10,
+    // Object in the startup object cache.
+    kStartupObjectCache = 0x10,
     // Root array item.
     kRootArray,
     // Object provided in the attached list.
@@ -218,6 +173,12 @@ class SerializerDeserializer : public RootVisitor {
     kApiReference,
     // External reference referenced by id.
     kExternalReference,
+    // Same as two bytecodes above but for serializing sandboxed external
+    // pointer values.
+    // TODO(v8:10391): Remove them once all ExternalPointer usages are
+    // sandbox-ready.
+    kSandboxedApiReference,
+    kSandboxedExternalReference,
     // Internal reference of a code objects in code stream.
     kInternalReference,
     // In-place weak references.
@@ -235,7 +196,6 @@ class SerializerDeserializer : public RootVisitor {
 
     // 0x60..0x7f
     kFixedRawData = 0x60,
-    kOnePointerRawData = kFixedRawData,
     kFixedRawDataStart = kFixedRawData - 1,
 
     //
@@ -294,73 +254,7 @@ class SerializerDeserializer : public RootVisitor {
   HotObjectsList hot_objects_;
 };
 
-class SerializedData {
- public:
-  class Reservation {
-   public:
-    Reservation() : reservation_(0) {}
-    explicit Reservation(uint32_t size)
-        : reservation_(ChunkSizeBits::encode(size)) {}
-
-    uint32_t chunk_size() const { return ChunkSizeBits::decode(reservation_); }
-    bool is_last() const { return IsLastChunkBits::decode(reservation_); }
-
-    void mark_as_last() { reservation_ |= IsLastChunkBits::encode(true); }
-
-   private:
-    uint32_t reservation_;
-  };
-
-  SerializedData(byte* data, int size)
-      : data_(data), size_(size), owns_data_(false) {}
-  SerializedData() : data_(nullptr), size_(0), owns_data_(false) {}
-  SerializedData(SerializedData&& other) V8_NOEXCEPT
-      : data_(other.data_),
-        size_(other.size_),
-        owns_data_(other.owns_data_) {
-    // Ensure |other| will not attempt to destroy our data in destructor.
-    other.owns_data_ = false;
-  }
-
-  virtual ~SerializedData() {
-    if (owns_data_) DeleteArray<byte>(data_);
-  }
-
-  uint32_t GetMagicNumber() const { return GetHeaderValue(kMagicNumberOffset); }
-
-  using ChunkSizeBits = base::BitField<uint32_t, 0, 31>;
-  using IsLastChunkBits = base::BitField<bool, 31, 1>;
-
-  static constexpr uint32_t kMagicNumberOffset = 0;
-  static constexpr uint32_t kMagicNumber =
-      0xC0DE0000 ^ ExternalReferenceTable::kSize;
-
- protected:
-  void SetHeaderValue(uint32_t offset, uint32_t value) {
-    base::WriteLittleEndianValue(reinterpret_cast<Address>(data_) + offset,
-                                 value);
-  }
-
-  uint32_t GetHeaderValue(uint32_t offset) const {
-    return base::ReadLittleEndianValue<uint32_t>(
-        reinterpret_cast<Address>(data_) + offset);
-  }
-
-  void AllocateData(uint32_t size);
-
-  void SetMagicNumber() { SetHeaderValue(kMagicNumberOffset, kMagicNumber); }
-
-  byte* data_;
-  uint32_t size_;
-  bool owns_data_;
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(SerializedData);
-};
-
-V8_EXPORT_PRIVATE uint32_t Checksum(Vector<const byte> payload);
-
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_SNAPSHOT_SERIALIZER_COMMON_H_
+#endif  // V8_SNAPSHOT_SERIALIZER_DESERIALIZER_H_
diff --git a/deps/v8/src/snapshot/serializer.cc b/deps/v8/src/snapshot/serializer.cc
index 9ad8d091cdf..1f451f8c177 100644
--- a/deps/v8/src/snapshot/serializer.cc
+++ b/deps/v8/src/snapshot/serializer.cc
@@ -6,6 +6,7 @@
 
 #include "src/codegen/assembler-inl.h"
 #include "src/heap/heap-inl.h"  // For Space::identity().
+#include "src/heap/memory-chunk-inl.h"
 #include "src/heap/read-only-heap.h"
 #include "src/interpreter/interpreter.h"
 #include "src/objects/code.h"
@@ -14,42 +15,22 @@
 #include "src/objects/map.h"
 #include "src/objects/slots-inl.h"
 #include "src/objects/smi.h"
-#include "src/snapshot/snapshot.h"
 
 namespace v8 {
 namespace internal {
 
-Serializer::Serializer(Isolate* isolate)
+Serializer::Serializer(Isolate* isolate, Snapshot::SerializerFlags flags)
     : isolate_(isolate),
       external_reference_encoder_(isolate),
       root_index_map_(isolate),
+      flags_(flags),
       allocator_(this) {
 #ifdef OBJECT_PRINT
   if (FLAG_serialization_statistics) {
     for (int space = 0; space < kNumberOfSpaces; ++space) {
-      instance_type_count_[space] = NewArray<int>(kInstanceTypes);
-      instance_type_size_[space] = NewArray<size_t>(kInstanceTypes);
-      for (int i = 0; i < kInstanceTypes; i++) {
-        instance_type_count_[space][i] = 0;
-        instance_type_size_[space][i] = 0;
-      }
-    }
-  } else {
-    for (int space = 0; space < kNumberOfSpaces; ++space) {
-      instance_type_count_[space] = nullptr;
-      instance_type_size_[space] = nullptr;
-    }
-  }
-#endif  // OBJECT_PRINT
-}
-
-Serializer::~Serializer() {
-  if (code_address_map_ != nullptr) delete code_address_map_;
-#ifdef OBJECT_PRINT
-  for (int space = 0; space < kNumberOfSpaces; ++space) {
-    if (instance_type_count_[space] != nullptr) {
-      DeleteArray(instance_type_count_[space]);
-      DeleteArray(instance_type_size_[space]);
+      // Value-initialized to 0.
+      instance_type_count_[space] = std::make_unique<int[]>(kInstanceTypes);
+      instance_type_size_[space] = std::make_unique<size_t[]>(kInstanceTypes);
     }
   }
 #endif  // OBJECT_PRINT
@@ -102,15 +83,16 @@ bool Serializer::MustBeDeferred(HeapObject object) { return false; }
 void Serializer::VisitRootPointers(Root root, const char* description,
                                    FullObjectSlot start, FullObjectSlot end) {
   for (FullObjectSlot current = start; current < end; ++current) {
-    SerializeRootObject(*current);
+    SerializeRootObject(current);
   }
 }
 
-void Serializer::SerializeRootObject(Object object) {
-  if (object.IsSmi()) {
-    PutSmi(Smi::cast(object));
+void Serializer::SerializeRootObject(FullObjectSlot slot) {
+  Object o = *slot;
+  if (o.IsSmi()) {
+    PutSmiRoot(slot);
   } else {
-    SerializeObject(HeapObject::cast(object));
+    SerializeObject(HeapObject::cast(o));
   }
 }
 
@@ -209,12 +191,21 @@ void Serializer::PutRoot(RootIndex root, HeapObject object) {
   }
 }
 
-void Serializer::PutSmi(Smi smi) {
-  sink_.Put(kOnePointerRawData, "Smi");
-  Tagged_t raw_value = static_cast<Tagged_t>(smi.ptr());
-  byte bytes[kTaggedSize];
-  memcpy(bytes, &raw_value, kTaggedSize);
-  for (int i = 0; i < kTaggedSize; i++) sink_.Put(bytes[i], "Byte");
+void Serializer::PutSmiRoot(FullObjectSlot slot) {
+  // Serializing a smi root in compressed pointer builds will serialize the
+  // full object slot (of kSystemPointerSize) to avoid complications during
+  // deserialization (endianness or smi sequences).
+  STATIC_ASSERT(decltype(slot)::kSlotDataSize == sizeof(Address));
+  STATIC_ASSERT(decltype(slot)::kSlotDataSize == kSystemPointerSize);
+  static constexpr int bytes_to_output = decltype(slot)::kSlotDataSize;
+  static constexpr int size_in_tagged = bytes_to_output >> kTaggedSizeLog2;
+  sink_.PutSection(kFixedRawDataStart + size_in_tagged, "Smi");
+
+  Address raw_value = Smi::cast(*slot).ptr();
+  const byte* raw_value_as_bytes = reinterpret_cast<const byte*>(&raw_value);
+  for (size_t i = 0; i < bytes_to_output; i++) {
+    sink_.Put(raw_value_as_bytes[i], "Byte");
+  }
 }
 
 void Serializer::PutBackReference(HeapObject object,
@@ -283,7 +274,7 @@ void Serializer::Pad(int padding_offset) {
 
 void Serializer::InitializeCodeAddressMap() {
   isolate_->InitializeLoggingAndCounters();
-  code_address_map_ = new CodeAddressMap(isolate_);
+  code_address_map_ = std::make_unique<CodeAddressMap>(isolate_);
 }
 
 Code Serializer::CopyCode(Code code) {
@@ -363,7 +354,8 @@ uint32_t Serializer::ObjectSerializer::SerializeBackingStore(
 void Serializer::ObjectSerializer::SerializeJSTypedArray() {
   JSTypedArray typed_array = JSTypedArray::cast(object_);
   if (typed_array.is_on_heap()) {
-    typed_array.RemoveExternalPointerCompensationForSerialization();
+    typed_array.RemoveExternalPointerCompensationForSerialization(
+        serializer_->isolate());
   } else {
     if (!typed_array.WasDetached()) {
       // Explicitly serialize the backing store now.
@@ -379,13 +371,9 @@ void Serializer::ObjectSerializer::SerializeJSTypedArray() {
           reinterpret_cast<Address>(typed_array.DataPtr()) - byte_offset);
 
       uint32_t ref = SerializeBackingStore(backing_store, byte_length);
-      // To properly share the buffer, we set the backing store ref as an
-      // off-heap offset from nullptr. On deserialization we re-set data
-      // pointer to proper value.
-      typed_array.SetOffHeapDataPtr(nullptr, ref);
-      DCHECK_EQ(ref, reinterpret_cast<Address>(typed_array.DataPtr()));
+      typed_array.SetExternalBackingStoreRefForSerialization(ref);
     } else {
-      typed_array.SetOffHeapDataPtr(nullptr, 0);
+      typed_array.SetExternalBackingStoreRefForSerialization(0);
     }
   }
   SerializeObject();
@@ -402,10 +390,7 @@ void Serializer::ObjectSerializer::SerializeJSArrayBuffer() {
   // The embedder-allocated backing store only exists for the off-heap case.
   if (backing_store != nullptr) {
     uint32_t ref = SerializeBackingStore(backing_store, byte_length);
-    // To properly share the buffer, we set the backing store ref as an
-    // a backing store address. On deserialization we re-set data pointer
-    // to proper value.
-    buffer.set_backing_store(reinterpret_cast<void*>(static_cast<size_t>(ref)));
+    buffer.SetBackingStoreRefForSerialization(ref);
 
     // Ensure deterministic output by setting extension to null during
     // serialization.
@@ -414,7 +399,7 @@ void Serializer::ObjectSerializer::SerializeJSArrayBuffer() {
 
   SerializeObject();
 
-  buffer.set_backing_store(backing_store);
+  buffer.set_backing_store(serializer_->isolate(), backing_store);
   buffer.set_extension(extension);
 }
 
@@ -428,9 +413,9 @@ void Serializer::ObjectSerializer::SerializeExternalString() {
   if (serializer_->external_reference_encoder_.TryEncode(resource).To(
           &reference)) {
     DCHECK(reference.is_from_api());
-    string.set_uint32_as_resource(reference.index());
+    string.set_uint32_as_resource(serializer_->isolate(), reference.index());
     SerializeObject();
-    string.set_address_as_resource(resource);
+    string.set_address_as_resource(serializer_->isolate(), resource);
   } else {
     SerializeExternalStringAsSequentialString();
   }
@@ -555,7 +540,7 @@ void Serializer::ObjectSerializer::Serialize() {
 
   if (object_.IsScript()) {
     // Clear cached line ends.
-    Object undefined = ReadOnlyRoots(serializer_->isolate()).undefined_value();
+    Oddball undefined = ReadOnlyRoots(serializer_->isolate()).undefined_value();
     Script::cast(object_).set_line_ends(undefined);
   }
 
@@ -584,11 +569,16 @@ SnapshotSpace GetSnapshotSpace(HeapObject object) {
     // Large code objects are not supported and cannot be expressed by
     // SnapshotSpace.
     DCHECK_NE(heap_space, CODE_LO_SPACE);
-    // Young generation large objects are tenured.
-    if (heap_space == NEW_LO_SPACE) {
-      return SnapshotSpace::kLargeObject;
-    } else {
-      return static_cast<SnapshotSpace>(heap_space);
+    switch (heap_space) {
+      // Young generation objects are tenured, as objects that have survived
+      // until snapshot building probably deserve to be considered 'old'.
+      case NEW_SPACE:
+        return SnapshotSpace::kOld;
+      case NEW_LO_SPACE:
+        return SnapshotSpace::kLargeObject;
+
+      default:
+        return static_cast<SnapshotSpace>(heap_space);
     }
   }
 }
@@ -728,32 +718,64 @@ void Serializer::ObjectSerializer::VisitEmbeddedPointer(Code host,
   bytes_processed_so_far_ += rinfo->target_address_size();
 }
 
-void Serializer::ObjectSerializer::VisitExternalReference(Foreign host,
-                                                          Address* p) {
-  auto encoded_reference =
-      serializer_->EncodeExternalReference(host.foreign_address());
-  if (encoded_reference.is_from_api()) {
-    sink_->Put(kApiReference, "ApiRef");
+void Serializer::ObjectSerializer::OutputExternalReference(Address target,
+                                                           int target_size,
+                                                           bool sandboxify) {
+  DCHECK_LE(target_size, sizeof(target));  // Must fit in Address.
+  ExternalReferenceEncoder::Value encoded_reference;
+  bool encoded_successfully;
+
+  if (serializer_->allow_unknown_external_references_for_testing()) {
+    encoded_successfully =
+        serializer_->TryEncodeExternalReference(target).To(&encoded_reference);
   } else {
-    sink_->Put(kExternalReference, "ExternalRef");
+    encoded_reference = serializer_->EncodeExternalReference(target);
+    encoded_successfully = true;
+  }
+
+  if (!encoded_successfully) {
+    // In this case the serialized snapshot will not be used in a different
+    // Isolate and thus the target address will not change between
+    // serialization and deserialization. We can serialize seen external
+    // references verbatim.
+    CHECK(serializer_->allow_unknown_external_references_for_testing());
+    CHECK(IsAligned(target_size, kObjectAlignment));
+    CHECK_LE(target_size, kNumberOfFixedRawData * kTaggedSize);
+    int size_in_tagged = target_size >> kTaggedSizeLog2;
+    sink_->PutSection(kFixedRawDataStart + size_in_tagged, "FixedRawData");
+    sink_->PutRaw(reinterpret_cast<byte*>(&target), target_size, "Bytes");
+  } else if (encoded_reference.is_from_api()) {
+    if (V8_HEAP_SANDBOX_BOOL && sandboxify) {
+      sink_->Put(kSandboxedApiReference, "SandboxedApiRef");
+    } else {
+      sink_->Put(kApiReference, "ApiRef");
+    }
+    sink_->PutInt(encoded_reference.index(), "reference index");
+  } else {
+    if (V8_HEAP_SANDBOX_BOOL && sandboxify) {
+      sink_->Put(kSandboxedExternalReference, "SandboxedExternalRef");
+    } else {
+      sink_->Put(kExternalReference, "ExternalRef");
+    }
+    sink_->PutInt(encoded_reference.index(), "reference index");
   }
-  sink_->PutInt(encoded_reference.index(), "reference index");
-  bytes_processed_so_far_ += kSystemPointerSize;
+  bytes_processed_so_far_ += target_size;
+}
+
+void Serializer::ObjectSerializer::VisitExternalReference(Foreign host,
+                                                          Address* p) {
+  // "Sandboxify" external reference.
+  OutputExternalReference(host.foreign_address(), kExternalPointerSize, true);
 }
 
 void Serializer::ObjectSerializer::VisitExternalReference(Code host,
                                                           RelocInfo* rinfo) {
   Address target = rinfo->target_external_reference();
-  auto encoded_reference = serializer_->EncodeExternalReference(target);
-  if (encoded_reference.is_from_api()) {
-    DCHECK(!rinfo->IsCodedSpecially());
-    sink_->Put(kApiReference, "ApiRef");
-  } else {
-    sink_->Put(kExternalReference, "ExternalRef");
-  }
   DCHECK_NE(target, kNullAddress);  // Code does not reference null.
-  sink_->PutInt(encoded_reference.index(), "reference index");
-  bytes_processed_so_far_ += rinfo->target_address_size();
+  DCHECK_IMPLIES(serializer_->EncodeExternalReference(target).is_from_api(),
+                 !rinfo->IsCodedSpecially());
+  // Don't "sandboxify" external references embedded in the code.
+  OutputExternalReference(target, rinfo->target_address_size(), false);
 }
 
 void Serializer::ObjectSerializer::VisitInternalReference(Code host,
@@ -834,8 +856,8 @@ void Serializer::ObjectSerializer::OutputRawData(Address up_to) {
     DCHECK(to_skip == bytes_to_output);
     if (IsAligned(bytes_to_output, kObjectAlignment) &&
         bytes_to_output <= kNumberOfFixedRawData * kTaggedSize) {
-      int size_in_words = bytes_to_output >> kTaggedSizeLog2;
-      sink_->PutSection(kFixedRawDataStart + size_in_words, "FixedRawData");
+      int size_in_tagged = bytes_to_output >> kTaggedSizeLog2;
+      sink_->PutSection(kFixedRawDataStart + size_in_tagged, "FixedRawData");
     } else {
       sink_->Put(kVariableRawData, "VariableRawData");
       sink_->PutInt(bytes_to_output, "length");
diff --git a/deps/v8/src/snapshot/serializer.h b/deps/v8/src/snapshot/serializer.h
index de65a92013d..be748de5629 100644
--- a/deps/v8/src/snapshot/serializer.h
+++ b/deps/v8/src/snapshot/serializer.h
@@ -7,13 +7,15 @@
 
 #include <map>
 
+#include "src/codegen/external-reference-encoder.h"
 #include "src/execution/isolate.h"
 #include "src/logging/log.h"
 #include "src/objects/objects.h"
 #include "src/snapshot/embedded/embedded-data.h"
 #include "src/snapshot/serializer-allocator.h"
-#include "src/snapshot/serializer-common.h"
+#include "src/snapshot/serializer-deserializer.h"
 #include "src/snapshot/snapshot-source-sink.h"
+#include "src/snapshot/snapshot.h"
 
 namespace v8 {
 namespace internal {
@@ -157,8 +159,7 @@ class ObjectCacheIndexMap {
 
 class Serializer : public SerializerDeserializer {
  public:
-  explicit Serializer(Isolate* isolate);
-  ~Serializer() override;
+  Serializer(Isolate* isolate, Snapshot::SerializerFlags flags);
 
   std::vector<SerializedData::Reservation> EncodeReservations() const {
     return allocator_.EncodeReservations();
@@ -198,10 +199,10 @@ class Serializer : public SerializerDeserializer {
 
   void VisitRootPointers(Root root, const char* description,
                          FullObjectSlot start, FullObjectSlot end) override;
-  void SerializeRootObject(Object object);
+  void SerializeRootObject(FullObjectSlot slot);
 
   void PutRoot(RootIndex root_index, HeapObject object);
-  void PutSmi(Smi smi);
+  void PutSmiRoot(FullObjectSlot slot);
   void PutBackReference(HeapObject object, SerializerReference reference);
   void PutAttachedReference(SerializerReference reference);
   // Emit alignment prefix if necessary, return required padding space in bytes.
@@ -224,6 +225,10 @@ class Serializer : public SerializerDeserializer {
   ExternalReferenceEncoder::Value EncodeExternalReference(Address addr) {
     return external_reference_encoder_.Encode(addr);
   }
+  Maybe<ExternalReferenceEncoder::Value> TryEncodeExternalReference(
+      Address addr) {
+    return external_reference_encoder_.TryEncode(addr);
+  }
 
   // GetInt reads 4 bytes at once, requiring padding at the end.
   // Use padding_offset to specify the space you want to use after padding.
@@ -260,21 +265,29 @@ class Serializer : public SerializerDeserializer {
 
   SnapshotByteSink sink_;  // Used directly by subclasses.
 
+  bool allow_unknown_external_references_for_testing() const {
+    return (flags_ & Snapshot::kAllowUnknownExternalReferencesForTesting) != 0;
+  }
+  bool allow_active_isolate_for_testing() const {
+    return (flags_ & Snapshot::kAllowActiveIsolateForTesting) != 0;
+  }
+
  private:
   Isolate* isolate_;
   SerializerReferenceMap reference_map_;
   ExternalReferenceEncoder external_reference_encoder_;
   RootIndexMap root_index_map_;
-  CodeAddressMap* code_address_map_ = nullptr;
+  std::unique_ptr<CodeAddressMap> code_address_map_;
   std::vector<byte> code_buffer_;
   std::vector<HeapObject> deferred_objects_;  // To handle stack overflow.
   int recursion_depth_ = 0;
+  const Snapshot::SerializerFlags flags_;
   SerializerAllocator allocator_;
 
 #ifdef OBJECT_PRINT
-  static const int kInstanceTypes = LAST_TYPE + 1;
-  int* instance_type_count_[kNumberOfSpaces];
-  size_t* instance_type_size_[kNumberOfSpaces];
+  static constexpr int kInstanceTypes = LAST_TYPE + 1;
+  std::unique_ptr<int[]> instance_type_count_[kNumberOfSpaces];
+  std::unique_ptr<size_t[]> instance_type_size_[kNumberOfSpaces];
 #endif  // OBJECT_PRINT
 
 #ifdef DEBUG
@@ -327,6 +340,8 @@ class Serializer::ObjectSerializer : public ObjectVisitor {
   // This function outputs or skips the raw data between the last pointer and
   // up to the current position.
   void SerializeContent(Map map, int size);
+  void OutputExternalReference(Address target, int target_size,
+                               bool sandboxify);
   void OutputRawData(Address up_to);
   void OutputCode(int size);
   uint32_t SerializeBackingStore(void* backing_store, int32_t byte_length);
diff --git a/deps/v8/src/snapshot/snapshot-compression.cc b/deps/v8/src/snapshot/snapshot-compression.cc
index dea16bfa348..09ac2eecdaf 100644
--- a/deps/v8/src/snapshot/snapshot-compression.cc
+++ b/deps/v8/src/snapshot/snapshot-compression.cc
@@ -4,7 +4,9 @@
 
 #include "src/snapshot/snapshot-compression.h"
 
+#include "src/base/platform/elapsed-timer.h"
 #include "src/utils/memcopy.h"
+#include "src/utils/utils.h"
 #include "third_party/zlib/google/compression_utils_portable.h"
 
 namespace v8 {
diff --git a/deps/v8/src/snapshot/snapshot-compression.h b/deps/v8/src/snapshot/snapshot-compression.h
index 59c21feb749..fe637bd1a62 100644
--- a/deps/v8/src/snapshot/snapshot-compression.h
+++ b/deps/v8/src/snapshot/snapshot-compression.h
@@ -5,9 +5,7 @@
 #ifndef V8_SNAPSHOT_SNAPSHOT_COMPRESSION_H_
 #define V8_SNAPSHOT_SNAPSHOT_COMPRESSION_H_
 
-#include "src/snapshot/serializer-common.h"
-#include "src/snapshot/serializer.h"
-#include "src/snapshot/snapshot.h"
+#include "src/snapshot/snapshot-data.h"
 #include "src/utils/vector.h"
 
 namespace v8 {
diff --git a/deps/v8/src/snapshot/snapshot-data.cc b/deps/v8/src/snapshot/snapshot-data.cc
new file mode 100644
index 00000000000..b6dccf2af54
--- /dev/null
+++ b/deps/v8/src/snapshot/snapshot-data.cc
@@ -0,0 +1,80 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/snapshot/snapshot-data.h"
+
+#include "src/common/assert-scope.h"
+#include "src/snapshot/serializer.h"
+
+#ifdef V8_SNAPSHOT_COMPRESSION
+#include "src/snapshot/snapshot-compression.h"
+#endif
+
+namespace v8 {
+namespace internal {
+
+void SerializedData::AllocateData(uint32_t size) {
+  DCHECK(!owns_data_);
+  data_ = NewArray<byte>(size);
+  size_ = size;
+  owns_data_ = true;
+}
+
+// static
+constexpr uint32_t SerializedData::kMagicNumber;
+
+SnapshotData::SnapshotData(const Serializer* serializer) {
+  DisallowHeapAllocation no_gc;
+  std::vector<Reservation> reservations = serializer->EncodeReservations();
+  const std::vector<byte>* payload = serializer->Payload();
+
+  // Calculate sizes.
+  uint32_t reservation_size =
+      static_cast<uint32_t>(reservations.size()) * kUInt32Size;
+  uint32_t payload_offset = kHeaderSize + reservation_size;
+  uint32_t padded_payload_offset = POINTER_SIZE_ALIGN(payload_offset);
+  uint32_t size =
+      padded_payload_offset + static_cast<uint32_t>(payload->size());
+
+  // Allocate backing store and create result data.
+  AllocateData(size);
+
+  // Zero out pre-payload data. Part of that is only used for padding.
+  memset(data_, 0, padded_payload_offset);
+
+  // Set header values.
+  SetMagicNumber();
+  SetHeaderValue(kNumReservationsOffset, static_cast<int>(reservations.size()));
+  SetHeaderValue(kPayloadLengthOffset, static_cast<int>(payload->size()));
+
+  // Copy reservation chunk sizes.
+  CopyBytes(data_ + kHeaderSize, reinterpret_cast<byte*>(reservations.data()),
+            reservation_size);
+
+  // Copy serialized data.
+  CopyBytes(data_ + padded_payload_offset, payload->data(),
+            static_cast<size_t>(payload->size()));
+}
+
+std::vector<SerializedData::Reservation> SnapshotData::Reservations() const {
+  uint32_t size = GetHeaderValue(kNumReservationsOffset);
+  std::vector<SerializedData::Reservation> reservations(size);
+  memcpy(reservations.data(), data_ + kHeaderSize,
+         size * sizeof(SerializedData::Reservation));
+  return reservations;
+}
+
+Vector<const byte> SnapshotData::Payload() const {
+  uint32_t reservations_size =
+      GetHeaderValue(kNumReservationsOffset) * kUInt32Size;
+  uint32_t padded_payload_offset =
+      POINTER_SIZE_ALIGN(kHeaderSize + reservations_size);
+  const byte* payload = data_ + padded_payload_offset;
+  uint32_t length = GetHeaderValue(kPayloadLengthOffset);
+  DCHECK_EQ(data_ + size_, payload + length);
+  return Vector<const byte>(payload, length);
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/snapshot/snapshot-data.h b/deps/v8/src/snapshot/snapshot-data.h
new file mode 100644
index 00000000000..b8a9133e7f9
--- /dev/null
+++ b/deps/v8/src/snapshot/snapshot-data.h
@@ -0,0 +1,129 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_SNAPSHOT_SNAPSHOT_DATA_H_
+#define V8_SNAPSHOT_SNAPSHOT_DATA_H_
+
+#include "src/base/bit-field.h"
+#include "src/base/memory.h"
+#include "src/codegen/external-reference-table.h"
+#include "src/utils/memcopy.h"
+#include "src/utils/vector.h"
+
+namespace v8 {
+namespace internal {
+
+// Forward declarations.
+class Isolate;
+class Serializer;
+
+class SerializedData {
+ public:
+  class Reservation {
+   public:
+    Reservation() : reservation_(0) {}
+    explicit Reservation(uint32_t size)
+        : reservation_(ChunkSizeBits::encode(size)) {}
+
+    uint32_t chunk_size() const { return ChunkSizeBits::decode(reservation_); }
+    bool is_last() const { return IsLastChunkBits::decode(reservation_); }
+
+    void mark_as_last() { reservation_ |= IsLastChunkBits::encode(true); }
+
+   private:
+    uint32_t reservation_;
+  };
+
+  SerializedData(byte* data, int size)
+      : data_(data), size_(size), owns_data_(false) {}
+  SerializedData() : data_(nullptr), size_(0), owns_data_(false) {}
+  SerializedData(SerializedData&& other) V8_NOEXCEPT
+      : data_(other.data_),
+        size_(other.size_),
+        owns_data_(other.owns_data_) {
+    // Ensure |other| will not attempt to destroy our data in destructor.
+    other.owns_data_ = false;
+  }
+
+  virtual ~SerializedData() {
+    if (owns_data_) DeleteArray<byte>(data_);
+  }
+
+  uint32_t GetMagicNumber() const { return GetHeaderValue(kMagicNumberOffset); }
+
+  using ChunkSizeBits = base::BitField<uint32_t, 0, 31>;
+  using IsLastChunkBits = base::BitField<bool, 31, 1>;
+
+  static constexpr uint32_t kMagicNumberOffset = 0;
+  static constexpr uint32_t kMagicNumber =
+      0xC0DE0000 ^ ExternalReferenceTable::kSize;
+
+ protected:
+  void SetHeaderValue(uint32_t offset, uint32_t value) {
+    base::WriteLittleEndianValue(reinterpret_cast<Address>(data_) + offset,
+                                 value);
+  }
+
+  uint32_t GetHeaderValue(uint32_t offset) const {
+    return base::ReadLittleEndianValue<uint32_t>(
+        reinterpret_cast<Address>(data_) + offset);
+  }
+
+  void AllocateData(uint32_t size);
+
+  void SetMagicNumber() { SetHeaderValue(kMagicNumberOffset, kMagicNumber); }
+
+  byte* data_;
+  uint32_t size_;
+  bool owns_data_;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(SerializedData);
+};
+
+// Wrapper around reservation sizes and the serialization payload.
+class V8_EXPORT_PRIVATE SnapshotData : public SerializedData {
+ public:
+  // Used when producing.
+  explicit SnapshotData(const Serializer* serializer);
+
+  // Used when consuming.
+  explicit SnapshotData(const Vector<const byte> snapshot)
+      : SerializedData(const_cast<byte*>(snapshot.begin()), snapshot.length()) {
+  }
+
+  std::vector<Reservation> Reservations() const;
+  virtual Vector<const byte> Payload() const;
+
+  Vector<const byte> RawData() const {
+    return Vector<const byte>(data_, size_);
+  }
+
+ protected:
+  // Empty constructor used by SnapshotCompression so it can manually allocate
+  // memory.
+  SnapshotData() : SerializedData() {}
+  friend class SnapshotCompression;
+
+  // Resize used by SnapshotCompression so it can shrink the compressed
+  // SnapshotData.
+  void Resize(uint32_t size) { size_ = size; }
+
+  // The data header consists of uint32_t-sized entries:
+  // [0] magic number and (internal) external reference count
+  // [1] number of reservation size entries
+  // [2] payload length
+  // ... reservations
+  // ... serialized payload
+  static const uint32_t kNumReservationsOffset =
+      kMagicNumberOffset + kUInt32Size;
+  static const uint32_t kPayloadLengthOffset =
+      kNumReservationsOffset + kUInt32Size;
+  static const uint32_t kHeaderSize = kPayloadLengthOffset + kUInt32Size;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_SNAPSHOT_SNAPSHOT_DATA_H_
diff --git a/deps/v8/src/snapshot/snapshot-source-sink.h b/deps/v8/src/snapshot/snapshot-source-sink.h
index adcfa8df618..eb4427a75f2 100644
--- a/deps/v8/src/snapshot/snapshot-source-sink.h
+++ b/deps/v8/src/snapshot/snapshot-source-sink.h
@@ -8,7 +8,7 @@
 #include <utility>
 
 #include "src/base/logging.h"
-#include "src/snapshot/serializer-common.h"
+#include "src/snapshot/snapshot-utils.h"
 #include "src/utils/utils.h"
 
 namespace v8 {
@@ -63,24 +63,6 @@ class SnapshotByteSource final {
     return answer;
   }
 
-  int GetIntSlow() {
-    // Unlike GetInt, this reads only up to the end of the blob, even if less
-    // than 4 bytes are remaining.
-    // TODO(jgruber): Remove once the use in MakeFromScriptsSource is gone.
-    DCHECK(position_ < length_);
-    uint32_t answer = data_[position_];
-    if (position_ + 1 < length_) answer |= data_[position_ + 1] << 8;
-    if (position_ + 2 < length_) answer |= data_[position_ + 2] << 16;
-    if (position_ + 3 < length_) answer |= data_[position_ + 3] << 24;
-    int bytes = (answer & 3) + 1;
-    Advance(bytes);
-    uint32_t mask = 0xffffffffu;
-    mask >>= 32 - (bytes << 3);
-    answer &= mask;
-    answer >>= 2;
-    return answer;
-  }
-
   // Returns length.
   int GetBlob(const byte** data);
 
diff --git a/deps/v8/src/snapshot/snapshot-utils.cc b/deps/v8/src/snapshot/snapshot-utils.cc
new file mode 100644
index 00000000000..88e8e794c2f
--- /dev/null
+++ b/deps/v8/src/snapshot/snapshot-utils.cc
@@ -0,0 +1,25 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/snapshot/snapshot-utils.h"
+
+#include "src/sanitizer/msan.h"
+#include "third_party/zlib/zlib.h"
+
+namespace v8 {
+namespace internal {
+
+uint32_t Checksum(Vector<const byte> payload) {
+#ifdef MEMORY_SANITIZER
+  // Computing the checksum includes padding bytes for objects like strings.
+  // Mark every object as initialized in the code serializer.
+  MSAN_MEMORY_IS_INITIALIZED(payload.begin(), payload.length());
+#endif  // MEMORY_SANITIZER
+  // Priming the adler32 call so it can see what CPU features are available.
+  adler32(0, NULL, 0);
+  return static_cast<uint32_t>(adler32(0, payload.begin(), payload.length()));
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/snapshot/snapshot-utils.h b/deps/v8/src/snapshot/snapshot-utils.h
new file mode 100644
index 00000000000..045813b1394
--- /dev/null
+++ b/deps/v8/src/snapshot/snapshot-utils.h
@@ -0,0 +1,18 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_SNAPSHOT_SNAPSHOT_UTILS_H_
+#define V8_SNAPSHOT_SNAPSHOT_UTILS_H_
+
+#include "src/utils/vector.h"
+
+namespace v8 {
+namespace internal {
+
+V8_EXPORT_PRIVATE uint32_t Checksum(Vector<const byte> payload);
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_SNAPSHOT_SNAPSHOT_UTILS_H_
diff --git a/deps/v8/src/snapshot/snapshot-common.cc b/deps/v8/src/snapshot/snapshot.cc
similarity index 50%
rename from deps/v8/src/snapshot/snapshot-common.cc
rename to deps/v8/src/snapshot/snapshot.cc
index 8e80b0b0b00..fd0866619c1 100644
--- a/deps/v8/src/snapshot/snapshot-common.cc
+++ b/deps/v8/src/snapshot/snapshot.cc
@@ -7,10 +7,17 @@
 #include "src/snapshot/snapshot.h"
 
 #include "src/base/platform/platform.h"
+#include "src/execution/isolate-inl.h"
+#include "src/init/bootstrapper.h"
 #include "src/logging/counters.h"
-#include "src/snapshot/partial-deserializer.h"
+#include "src/objects/js-regexp-inl.h"
+#include "src/snapshot/context-deserializer.h"
+#include "src/snapshot/context-serializer.h"
 #include "src/snapshot/read-only-deserializer.h"
+#include "src/snapshot/read-only-serializer.h"
+#include "src/snapshot/snapshot-utils.h"
 #include "src/snapshot/startup-deserializer.h"
+#include "src/snapshot/startup-serializer.h"
 #include "src/utils/memcopy.h"
 #include "src/utils/version.h"
 
@@ -21,6 +28,82 @@
 namespace v8 {
 namespace internal {
 
+namespace {
+
+class SnapshotImpl : public AllStatic {
+ public:
+  static v8::StartupData CreateSnapshotBlob(
+      const SnapshotData* startup_snapshot_in,
+      const SnapshotData* read_only_snapshot_in,
+      const std::vector<SnapshotData*>& context_snapshots_in,
+      bool can_be_rehashed);
+
+  static uint32_t ExtractNumContexts(const v8::StartupData* data);
+  static uint32_t ExtractContextOffset(const v8::StartupData* data,
+                                       uint32_t index);
+  static Vector<const byte> ExtractStartupData(const v8::StartupData* data);
+  static Vector<const byte> ExtractReadOnlyData(const v8::StartupData* data);
+  static Vector<const byte> ExtractContextData(const v8::StartupData* data,
+                                               uint32_t index);
+
+  static uint32_t GetHeaderValue(const v8::StartupData* data, uint32_t offset) {
+    return base::ReadLittleEndianValue<uint32_t>(
+        reinterpret_cast<Address>(data->data) + offset);
+  }
+  static void SetHeaderValue(char* data, uint32_t offset, uint32_t value) {
+    base::WriteLittleEndianValue(reinterpret_cast<Address>(data) + offset,
+                                 value);
+  }
+
+  static void CheckVersion(const v8::StartupData* data);
+
+  // Snapshot blob layout:
+  // [0] number of contexts N
+  // [1] rehashability
+  // [2] checksum
+  // [3] (128 bytes) version string
+  // [4] offset to readonly
+  // [5] offset to context 0
+  // [6] offset to context 1
+  // ...
+  // ... offset to context N - 1
+  // ... startup snapshot data
+  // ... read-only snapshot data
+  // ... context 0 snapshot data
+  // ... context 1 snapshot data
+
+  static const uint32_t kNumberOfContextsOffset = 0;
+  // TODO(yangguo): generalize rehashing, and remove this flag.
+  static const uint32_t kRehashabilityOffset =
+      kNumberOfContextsOffset + kUInt32Size;
+  static const uint32_t kChecksumOffset = kRehashabilityOffset + kUInt32Size;
+  static const uint32_t kVersionStringOffset = kChecksumOffset + kUInt32Size;
+  static const uint32_t kVersionStringLength = 64;
+  static const uint32_t kReadOnlyOffsetOffset =
+      kVersionStringOffset + kVersionStringLength;
+  static const uint32_t kFirstContextOffsetOffset =
+      kReadOnlyOffsetOffset + kUInt32Size;
+
+  static Vector<const byte> ChecksummedContent(const v8::StartupData* data) {
+    STATIC_ASSERT(kVersionStringOffset == kChecksumOffset + kUInt32Size);
+    const uint32_t kChecksumStart = kVersionStringOffset;
+    return Vector<const byte>(
+        reinterpret_cast<const byte*>(data->data + kChecksumStart),
+        data->raw_size - kChecksumStart);
+  }
+
+  static uint32_t StartupSnapshotOffset(int num_contexts) {
+    return POINTER_SIZE_ALIGN(kFirstContextOffsetOffset +
+                              num_contexts * kInt32Size);
+  }
+
+  static uint32_t ContextSnapshotOffsetOffset(int index) {
+    return kFirstContextOffsetOffset + index * kInt32Size;
+  }
+};
+
+}  // namespace
+
 SnapshotData MaybeDecompress(const Vector<const byte>& snapshot_data) {
 #ifdef V8_SNAPSHOT_COMPRESSION
   return SnapshotCompression::Decompress(snapshot_data);
@@ -31,7 +114,7 @@ SnapshotData MaybeDecompress(const Vector<const byte>& snapshot_data) {
 
 #ifdef DEBUG
 bool Snapshot::SnapshotIsValid(const v8::StartupData* snapshot_blob) {
-  return Snapshot::ExtractNumContexts(snapshot_blob) > 0;
+  return SnapshotImpl::ExtractNumContexts(snapshot_blob) > 0;
 }
 #endif  // DEBUG
 
@@ -40,10 +123,22 @@ bool Snapshot::HasContextSnapshot(Isolate* isolate, size_t index) {
   const v8::StartupData* blob = isolate->snapshot_blob();
   if (blob == nullptr) return false;
   if (blob->data == nullptr) return false;
-  size_t num_contexts = static_cast<size_t>(ExtractNumContexts(blob));
+  size_t num_contexts =
+      static_cast<size_t>(SnapshotImpl::ExtractNumContexts(blob));
   return index < num_contexts;
 }
 
+bool Snapshot::VersionIsValid(const v8::StartupData* data) {
+  char version[SnapshotImpl::kVersionStringLength];
+  memset(version, 0, SnapshotImpl::kVersionStringLength);
+  CHECK_LT(
+      SnapshotImpl::kVersionStringOffset + SnapshotImpl::kVersionStringLength,
+      static_cast<uint32_t>(data->raw_size));
+  Version::GetString(Vector<char>(version, SnapshotImpl::kVersionStringLength));
+  return strncmp(version, data->data + SnapshotImpl::kVersionStringOffset,
+                 SnapshotImpl::kVersionStringLength) == 0;
+}
+
 bool Snapshot::Initialize(Isolate* isolate) {
   if (!isolate->snapshot_available()) return false;
   RuntimeCallTimerScope rcs_timer(isolate,
@@ -52,10 +147,10 @@ bool Snapshot::Initialize(Isolate* isolate) {
   if (FLAG_profile_deserialization) timer.Start();
 
   const v8::StartupData* blob = isolate->snapshot_blob();
-  CheckVersion(blob);
+  SnapshotImpl::CheckVersion(blob);
   CHECK(VerifyChecksum(blob));
-  Vector<const byte> startup_data = ExtractStartupData(blob);
-  Vector<const byte> read_only_data = ExtractReadOnlyData(blob);
+  Vector<const byte> startup_data = SnapshotImpl::ExtractStartupData(blob);
+  Vector<const byte> read_only_data = SnapshotImpl::ExtractReadOnlyData(blob);
 
   SnapshotData startup_snapshot_data(MaybeDecompress(startup_data));
   SnapshotData read_only_snapshot_data(MaybeDecompress(read_only_data));
@@ -85,11 +180,11 @@ MaybeHandle<Context> Snapshot::NewContextFromSnapshot(
 
   const v8::StartupData* blob = isolate->snapshot_blob();
   bool can_rehash = ExtractRehashability(blob);
-  Vector<const byte> context_data =
-      ExtractContextData(blob, static_cast<uint32_t>(context_index));
+  Vector<const byte> context_data = SnapshotImpl::ExtractContextData(
+      blob, static_cast<uint32_t>(context_index));
   SnapshotData snapshot_data(MaybeDecompress(context_data));
 
-  MaybeHandle<Context> maybe_result = PartialDeserializer::DeserializeContext(
+  MaybeHandle<Context> maybe_result = ContextDeserializer::DeserializeContext(
       isolate, &snapshot_data, can_rehash, global_proxy,
       embedder_fields_deserializer);
 
@@ -105,6 +200,125 @@ MaybeHandle<Context> Snapshot::NewContextFromSnapshot(
   return result;
 }
 
+// static
+void Snapshot::ClearReconstructableDataForSerialization(
+    Isolate* isolate, bool clear_recompilable_data) {
+  // Clear SFIs and JSRegExps.
+
+  if (clear_recompilable_data) {
+    HandleScope scope(isolate);
+    std::vector<i::Handle<i::SharedFunctionInfo>> sfis_to_clear;
+    {  // Heap allocation is disallowed within this scope.
+      i::HeapObjectIterator it(isolate->heap());
+      for (i::HeapObject o = it.Next(); !o.is_null(); o = it.Next()) {
+        if (o.IsSharedFunctionInfo()) {
+          i::SharedFunctionInfo shared = i::SharedFunctionInfo::cast(o);
+          if (shared.script().IsScript() &&
+              Script::cast(shared.script()).type() == Script::TYPE_EXTENSION) {
+            continue;  // Don't clear extensions, they cannot be recompiled.
+          }
+          if (shared.CanDiscardCompiled()) {
+            sfis_to_clear.emplace_back(shared, isolate);
+          }
+        } else if (o.IsJSRegExp()) {
+          i::JSRegExp regexp = i::JSRegExp::cast(o);
+          if (regexp.HasCompiledCode()) {
+            regexp.DiscardCompiledCodeForSerialization();
+          }
+        }
+      }
+    }
+
+    // Must happen after heap iteration since SFI::DiscardCompiled may allocate.
+    for (i::Handle<i::SharedFunctionInfo> shared : sfis_to_clear) {
+      i::SharedFunctionInfo::DiscardCompiled(isolate, shared);
+    }
+  }
+
+  // Clear JSFunctions.
+
+  i::HeapObjectIterator it(isolate->heap());
+  for (i::HeapObject o = it.Next(); !o.is_null(); o = it.Next()) {
+    if (!o.IsJSFunction()) continue;
+
+    i::JSFunction fun = i::JSFunction::cast(o);
+    fun.CompleteInobjectSlackTrackingIfActive();
+
+    i::SharedFunctionInfo shared = fun.shared();
+    if (shared.script().IsScript() &&
+        Script::cast(shared.script()).type() == Script::TYPE_EXTENSION) {
+      continue;  // Don't clear extensions, they cannot be recompiled.
+    }
+
+    // Also, clear out feedback vectors, or any optimized code.
+    // Note that checking for fun.IsOptimized() || fun.IsInterpreted() is
+    // not sufficient because the function can have a feedback vector even
+    // if it is not compiled (e.g. when the bytecode was flushed). On the
+    // other hand, only checking for the feedback vector is not sufficient
+    // because there can be multiple functions sharing the same feedback
+    // vector. So we need all these checks.
+    if (fun.IsOptimized() || fun.IsInterpreted() ||
+        !fun.raw_feedback_cell().value().IsUndefined()) {
+      fun.raw_feedback_cell().set_value(
+          i::ReadOnlyRoots(isolate).undefined_value());
+      fun.set_code(isolate->builtins()->builtin(i::Builtins::kCompileLazy));
+    }
+#ifdef DEBUG
+    if (clear_recompilable_data) {
+      DCHECK(fun.shared().HasWasmExportedFunctionData() ||
+             fun.shared().HasBuiltinId() || fun.shared().IsApiFunction() ||
+             fun.shared().HasUncompiledDataWithoutPreparseData());
+    }
+#endif  // DEBUG
+  }
+}
+
+// static
+void Snapshot::SerializeDeserializeAndVerifyForTesting(
+    Isolate* isolate, Handle<Context> default_context) {
+  StartupData serialized_data;
+  std::unique_ptr<const char[]> auto_delete_serialized_data;
+
+  isolate->heap()->CollectAllAvailableGarbage(
+      i::GarbageCollectionReason::kSnapshotCreator);
+
+  // Test serialization.
+  {
+    DisallowHeapAllocation no_gc;
+
+    Snapshot::SerializerFlags flags(
+        Snapshot::kAllowUnknownExternalReferencesForTesting |
+        Snapshot::kAllowActiveIsolateForTesting);
+    serialized_data = Snapshot::Create(isolate, *default_context, no_gc, flags);
+    auto_delete_serialized_data.reset(serialized_data.data);
+  }
+
+  // Test deserialization.
+  Isolate* new_isolate = Isolate::New();
+  {
+    // Set serializer_enabled() to not install extensions and experimental
+    // natives on the new isolate.
+    // TODO(v8:10416): This should be a separate setting on the isolate.
+    new_isolate->enable_serializer();
+    new_isolate->Enter();
+    new_isolate->set_snapshot_blob(&serialized_data);
+    new_isolate->set_array_buffer_allocator(
+        v8::ArrayBuffer::Allocator::NewDefaultAllocator());
+    CHECK(Snapshot::Initialize(new_isolate));
+
+    HandleScope scope(new_isolate);
+    Handle<Context> new_native_context =
+        new_isolate->bootstrapper()->CreateEnvironmentForTesting();
+    CHECK(new_native_context->IsNativeContext());
+
+#ifdef VERIFY_HEAP
+    new_isolate->heap()->Verify();
+#endif  // VERIFY_HEAP
+  }
+  new_isolate->Exit();
+  Isolate::Delete(new_isolate);
+}
+
 void ProfileDeserialization(
     const SnapshotData* read_only_snapshot,
     const SnapshotData* startup_snapshot,
@@ -129,7 +343,70 @@ void ProfileDeserialization(
   }
 }
 
-v8::StartupData Snapshot::CreateSnapshotBlob(
+// static
+constexpr Snapshot::SerializerFlags Snapshot::kDefaultSerializerFlags;
+
+// static
+v8::StartupData Snapshot::Create(
+    Isolate* isolate, std::vector<Context>* contexts,
+    const std::vector<SerializeInternalFieldsCallback>&
+        embedder_fields_serializers,
+    const DisallowHeapAllocation& no_gc, SerializerFlags flags) {
+  DCHECK_EQ(contexts->size(), embedder_fields_serializers.size());
+  DCHECK_GT(contexts->size(), 0);
+
+  ReadOnlySerializer read_only_serializer(isolate, flags);
+  read_only_serializer.SerializeReadOnlyRoots();
+
+  StartupSerializer startup_serializer(isolate, flags, &read_only_serializer);
+  startup_serializer.SerializeStrongReferences(no_gc);
+
+  // Serialize each context with a new serializer.
+  const int num_contexts = static_cast<int>(contexts->size());
+  std::vector<SnapshotData*> context_snapshots;
+  context_snapshots.reserve(num_contexts);
+
+  // TODO(v8:6593): generalize rehashing, and remove this flag.
+  bool can_be_rehashed = true;
+
+  for (int i = 0; i < num_contexts; i++) {
+    ContextSerializer context_serializer(isolate, flags, &startup_serializer,
+                                         embedder_fields_serializers[i]);
+    context_serializer.Serialize(&contexts->at(i), no_gc);
+    can_be_rehashed = can_be_rehashed && context_serializer.can_be_rehashed();
+    context_snapshots.push_back(new SnapshotData(&context_serializer));
+  }
+
+  startup_serializer.SerializeWeakReferencesAndDeferred();
+  can_be_rehashed = can_be_rehashed && startup_serializer.can_be_rehashed();
+
+  startup_serializer.CheckNoDirtyFinalizationRegistries();
+
+  read_only_serializer.FinalizeSerialization();
+  can_be_rehashed = can_be_rehashed && read_only_serializer.can_be_rehashed();
+
+  SnapshotData read_only_snapshot(&read_only_serializer);
+  SnapshotData startup_snapshot(&startup_serializer);
+  v8::StartupData result =
+      SnapshotImpl::CreateSnapshotBlob(&startup_snapshot, &read_only_snapshot,
+                                       context_snapshots, can_be_rehashed);
+
+  for (const SnapshotData* ptr : context_snapshots) delete ptr;
+
+  CHECK(Snapshot::VerifyChecksum(&result));
+  return result;
+}
+
+// static
+v8::StartupData Snapshot::Create(Isolate* isolate, Context default_context,
+                                 const DisallowHeapAllocation& no_gc,
+                                 SerializerFlags flags) {
+  std::vector<Context> contexts{default_context};
+  std::vector<SerializeInternalFieldsCallback> callbacks{{}};
+  return Snapshot::Create(isolate, &contexts, callbacks, no_gc, flags);
+}
+
+v8::StartupData SnapshotImpl::CreateSnapshotBlob(
     const SnapshotData* startup_snapshot_in,
     const SnapshotData* read_only_snapshot_in,
     const std::vector<SnapshotData*>& context_snapshots_in,
@@ -163,7 +440,8 @@ v8::StartupData Snapshot::CreateSnapshotBlob(
 #endif
 
   uint32_t num_contexts = static_cast<uint32_t>(context_snapshots->size());
-  uint32_t startup_snapshot_offset = StartupSnapshotOffset(num_contexts);
+  uint32_t startup_snapshot_offset =
+      SnapshotImpl::StartupSnapshotOffset(num_contexts);
   uint32_t total_length = startup_snapshot_offset;
   total_length += static_cast<uint32_t>(startup_snapshot->RawData().length());
   total_length += static_cast<uint32_t>(read_only_snapshot->RawData().length());
@@ -176,15 +454,18 @@ v8::StartupData Snapshot::CreateSnapshotBlob(
 
   char* data = new char[total_length];
   // Zero out pre-payload data. Part of that is only used for padding.
-  memset(data, 0, StartupSnapshotOffset(num_contexts));
+  memset(data, 0, SnapshotImpl::StartupSnapshotOffset(num_contexts));
 
-  SetHeaderValue(data, kNumberOfContextsOffset, num_contexts);
-  SetHeaderValue(data, kRehashabilityOffset, can_be_rehashed ? 1 : 0);
+  SnapshotImpl::SetHeaderValue(data, SnapshotImpl::kNumberOfContextsOffset,
+                               num_contexts);
+  SnapshotImpl::SetHeaderValue(data, SnapshotImpl::kRehashabilityOffset,
+                               can_be_rehashed ? 1 : 0);
 
   // Write version string into snapshot data.
-  memset(data + kVersionStringOffset, 0, kVersionStringLength);
-  Version::GetString(
-      Vector<char>(data + kVersionStringOffset, kVersionStringLength));
+  memset(data + SnapshotImpl::kVersionStringOffset, 0,
+         SnapshotImpl::kVersionStringLength);
+  Version::GetString(Vector<char>(data + SnapshotImpl::kVersionStringOffset,
+                                  SnapshotImpl::kVersionStringLength));
 
   // Startup snapshot (isolate-specific data).
   uint32_t payload_offset = startup_snapshot_offset;
@@ -201,7 +482,8 @@ v8::StartupData Snapshot::CreateSnapshotBlob(
   payload_offset += payload_length;
 
   // Read-only.
-  SetHeaderValue(data, kReadOnlyOffsetOffset, payload_offset);
+  SnapshotImpl::SetHeaderValue(data, SnapshotImpl::kReadOnlyOffsetOffset,
+                               payload_offset);
   payload_length = read_only_snapshot->RawData().length();
   CopyBytes(
       data + payload_offset,
@@ -212,9 +494,10 @@ v8::StartupData Snapshot::CreateSnapshotBlob(
   }
   payload_offset += payload_length;
 
-  // Partial snapshots (context-specific data).
+  // Context snapshots (context-specific data).
   for (uint32_t i = 0; i < num_contexts; i++) {
-    SetHeaderValue(data, ContextSnapshotOffsetOffset(i), payload_offset);
+    SnapshotImpl::SetHeaderValue(
+        data, SnapshotImpl::ContextSnapshotOffsetOffset(i), payload_offset);
     SnapshotData* context_snapshot = (*context_snapshots)[i];
     payload_length = context_snapshot->RawData().length();
     CopyBytes(
@@ -233,12 +516,14 @@ v8::StartupData Snapshot::CreateSnapshotBlob(
   DCHECK_EQ(total_length, payload_offset);
   v8::StartupData result = {data, static_cast<int>(total_length)};
 
-  SetHeaderValue(data, kChecksumOffset, Checksum(ChecksummedContent(&result)));
+  SnapshotImpl::SetHeaderValue(
+      data, SnapshotImpl::kChecksumOffset,
+      Checksum(SnapshotImpl::ChecksummedContent(&result)));
 
   return result;
 }
 
-uint32_t Snapshot::ExtractNumContexts(const v8::StartupData* data) {
+uint32_t SnapshotImpl::ExtractNumContexts(const v8::StartupData* data) {
   CHECK_LT(kNumberOfContextsOffset, data->raw_size);
   uint32_t num_contexts = GetHeaderValue(data, kNumberOfContextsOffset);
   return num_contexts;
@@ -247,8 +532,9 @@ uint32_t Snapshot::ExtractNumContexts(const v8::StartupData* data) {
 bool Snapshot::VerifyChecksum(const v8::StartupData* data) {
   base::ElapsedTimer timer;
   if (FLAG_profile_deserialization) timer.Start();
-  uint32_t expected = GetHeaderValue(data, kChecksumOffset);
-  uint32_t result = Checksum(ChecksummedContent(data));
+  uint32_t expected =
+      SnapshotImpl::GetHeaderValue(data, SnapshotImpl::kChecksumOffset);
+  uint32_t result = Checksum(SnapshotImpl::ChecksummedContent(data));
   if (FLAG_profile_deserialization) {
     double ms = timer.Elapsed().InMillisecondsF();
     PrintF("[Verifying snapshot checksum took %0.3f ms]\n", ms);
@@ -256,8 +542,8 @@ bool Snapshot::VerifyChecksum(const v8::StartupData* data) {
   return result == expected;
 }
 
-uint32_t Snapshot::ExtractContextOffset(const v8::StartupData* data,
-                                        uint32_t index) {
+uint32_t SnapshotImpl::ExtractContextOffset(const v8::StartupData* data,
+                                            uint32_t index) {
   // Extract the offset of the context at a given index from the StartupData,
   // and check that it is within bounds.
   uint32_t context_offset =
@@ -267,8 +553,10 @@ uint32_t Snapshot::ExtractContextOffset(const v8::StartupData* data,
 }
 
 bool Snapshot::ExtractRehashability(const v8::StartupData* data) {
-  CHECK_LT(kRehashabilityOffset, static_cast<uint32_t>(data->raw_size));
-  uint32_t rehashability = GetHeaderValue(data, kRehashabilityOffset);
+  CHECK_LT(SnapshotImpl::kRehashabilityOffset,
+           static_cast<uint32_t>(data->raw_size));
+  uint32_t rehashability =
+      SnapshotImpl::GetHeaderValue(data, SnapshotImpl::kRehashabilityOffset);
   CHECK_IMPLIES(rehashability != 0, rehashability == 1);
   return rehashability != 0;
 }
@@ -285,23 +573,25 @@ Vector<const byte> ExtractData(const v8::StartupData* snapshot,
 }
 }  // namespace
 
-Vector<const byte> Snapshot::ExtractStartupData(const v8::StartupData* data) {
-  DCHECK(SnapshotIsValid(data));
+Vector<const byte> SnapshotImpl::ExtractStartupData(
+    const v8::StartupData* data) {
+  DCHECK(Snapshot::SnapshotIsValid(data));
 
   uint32_t num_contexts = ExtractNumContexts(data);
   return ExtractData(data, StartupSnapshotOffset(num_contexts),
                      GetHeaderValue(data, kReadOnlyOffsetOffset));
 }
 
-Vector<const byte> Snapshot::ExtractReadOnlyData(const v8::StartupData* data) {
-  DCHECK(SnapshotIsValid(data));
+Vector<const byte> SnapshotImpl::ExtractReadOnlyData(
+    const v8::StartupData* data) {
+  DCHECK(Snapshot::SnapshotIsValid(data));
 
   return ExtractData(data, GetHeaderValue(data, kReadOnlyOffsetOffset),
                      GetHeaderValue(data, ContextSnapshotOffsetOffset(0)));
 }
 
-Vector<const byte> Snapshot::ExtractContextData(const v8::StartupData* data,
-                                                uint32_t index) {
+Vector<const byte> SnapshotImpl::ExtractContextData(const v8::StartupData* data,
+                                                    uint32_t index) {
   uint32_t num_contexts = ExtractNumContexts(data);
   CHECK_LT(index, num_contexts);
 
@@ -320,14 +610,13 @@ Vector<const byte> Snapshot::ExtractContextData(const v8::StartupData* data,
   return Vector<const byte>(context_data, context_length);
 }
 
-void Snapshot::CheckVersion(const v8::StartupData* data) {
-  char version[kVersionStringLength];
-  memset(version, 0, kVersionStringLength);
-  CHECK_LT(kVersionStringOffset + kVersionStringLength,
-           static_cast<uint32_t>(data->raw_size));
-  Version::GetString(Vector<char>(version, kVersionStringLength));
-  if (strncmp(version, data->data + kVersionStringOffset,
-              kVersionStringLength) != 0) {
+void SnapshotImpl::CheckVersion(const v8::StartupData* data) {
+  if (!Snapshot::VersionIsValid(data)) {
+    char version[kVersionStringLength];
+    memset(version, 0, kVersionStringLength);
+    CHECK_LT(kVersionStringOffset + kVersionStringLength,
+             static_cast<uint32_t>(data->raw_size));
+    Version::GetString(Vector<char>(version, kVersionStringLength));
     FATAL(
         "Version mismatch between V8 binary and snapshot.\n"
         "#   V8 binary version: %.*s\n"
@@ -339,58 +628,6 @@ void Snapshot::CheckVersion(const v8::StartupData* data) {
   }
 }
 
-SnapshotData::SnapshotData(const Serializer* serializer) {
-  DisallowHeapAllocation no_gc;
-  std::vector<Reservation> reservations = serializer->EncodeReservations();
-  const std::vector<byte>* payload = serializer->Payload();
-
-  // Calculate sizes.
-  uint32_t reservation_size =
-      static_cast<uint32_t>(reservations.size()) * kUInt32Size;
-  uint32_t payload_offset = kHeaderSize + reservation_size;
-  uint32_t padded_payload_offset = POINTER_SIZE_ALIGN(payload_offset);
-  uint32_t size =
-      padded_payload_offset + static_cast<uint32_t>(payload->size());
-
-  // Allocate backing store and create result data.
-  AllocateData(size);
-
-  // Zero out pre-payload data. Part of that is only used for padding.
-  memset(data_, 0, padded_payload_offset);
-
-  // Set header values.
-  SetMagicNumber();
-  SetHeaderValue(kNumReservationsOffset, static_cast<int>(reservations.size()));
-  SetHeaderValue(kPayloadLengthOffset, static_cast<int>(payload->size()));
-
-  // Copy reservation chunk sizes.
-  CopyBytes(data_ + kHeaderSize, reinterpret_cast<byte*>(reservations.data()),
-            reservation_size);
-
-  // Copy serialized data.
-  CopyBytes(data_ + padded_payload_offset, payload->data(),
-            static_cast<size_t>(payload->size()));
-}
-
-std::vector<SerializedData::Reservation> SnapshotData::Reservations() const {
-  uint32_t size = GetHeaderValue(kNumReservationsOffset);
-  std::vector<SerializedData::Reservation> reservations(size);
-  memcpy(reservations.data(), data_ + kHeaderSize,
-         size * sizeof(SerializedData::Reservation));
-  return reservations;
-}
-
-Vector<const byte> SnapshotData::Payload() const {
-  uint32_t reservations_size =
-      GetHeaderValue(kNumReservationsOffset) * kUInt32Size;
-  uint32_t padded_payload_offset =
-      POINTER_SIZE_ALIGN(kHeaderSize + reservations_size);
-  const byte* payload = data_ + padded_payload_offset;
-  uint32_t length = GetHeaderValue(kPayloadLengthOffset);
-  DCHECK_EQ(data_ + size_, payload + length);
-  return Vector<const byte>(payload, length);
-}
-
 namespace {
 
 bool RunExtraCode(v8::Isolate* isolate, v8::Local<v8::Context> context,
diff --git a/deps/v8/src/snapshot/snapshot.h b/deps/v8/src/snapshot/snapshot.h
index d9f05c59a86..016e51799b9 100644
--- a/deps/v8/src/snapshot/snapshot.h
+++ b/deps/v8/src/snapshot/snapshot.h
@@ -1,168 +1,104 @@
-// Copyright 2006-2008 the V8 project authors. All rights reserved.
+// Copyright 2020 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_SNAPSHOT_SNAPSHOT_H_
 #define V8_SNAPSHOT_SNAPSHOT_H_
 
-#include "src/snapshot/partial-serializer.h"
-#include "src/snapshot/startup-serializer.h"
-
-#include "src/utils/utils.h"
+#include "include/v8.h"  // For StartupData.
+#include "src/common/assert-scope.h"
+#include "src/common/globals.h"
 
 namespace v8 {
 namespace internal {
 
-// Forward declarations.
+class Context;
 class Isolate;
-class PartialSerializer;
-class SnapshotCompression;
-class StartupSerializer;
-
-// Wrapper around reservation sizes and the serialization payload.
-class V8_EXPORT_PRIVATE SnapshotData : public SerializedData {
- public:
-  // Used when producing.
-  explicit SnapshotData(const Serializer* serializer);
-
-  // Used when consuming.
-  explicit SnapshotData(const Vector<const byte> snapshot)
-      : SerializedData(const_cast<byte*>(snapshot.begin()), snapshot.length()) {
-  }
-
-  std::vector<Reservation> Reservations() const;
-  virtual Vector<const byte> Payload() const;
-
-  Vector<const byte> RawData() const {
-    return Vector<const byte>(data_, size_);
-  }
-
- protected:
-  // Empty constructor used by SnapshotCompression so it can manually allocate
-  // memory.
-  SnapshotData() : SerializedData() {}
-  friend class SnapshotCompression;
-
-  // Resize used by SnapshotCompression so it can shrink the compressed
-  // SnapshotData.
-  void Resize(uint32_t size) { size_ = size; }
-
-  // The data header consists of uint32_t-sized entries:
-  // [0] magic number and (internal) external reference count
-  // [1] number of reservation size entries
-  // [2] payload length
-  // ... reservations
-  // ... serialized payload
-  static const uint32_t kNumReservationsOffset =
-      kMagicNumberOffset + kUInt32Size;
-  static const uint32_t kPayloadLengthOffset =
-      kNumReservationsOffset + kUInt32Size;
-  static const uint32_t kHeaderSize = kPayloadLengthOffset + kUInt32Size;
-};
+class SnapshotData;
+class JSGlobalProxy;
 
 class Snapshot : public AllStatic {
  public:
-  // ---------------- Deserialization ----------------
+  // ---------------- Serialization -------------------------------------------
+
+  enum SerializerFlag {
+    // If set, serializes unknown external references as verbatim data. This
+    // usually leads to invalid state if the snapshot is deserialized in a
+    // different isolate or a different process.
+    // If unset, all external references must be known to the encoder.
+    kAllowUnknownExternalReferencesForTesting = 1 << 0,
+    // If set, the serializer enters a more permissive mode which allows
+    // serialization of a currently active, running isolate. This has multiple
+    // effects; for example, open handles are allowed, microtasks may exist,
+    // etc. Note that in this mode, the serializer is allowed to skip
+    // visitation of certain problematic areas even if they are non-empty. The
+    // resulting snapshot is not guaranteed to result in a runnable context
+    // after deserialization.
+    // If unset, we assert that these previously mentioned areas are empty.
+    kAllowActiveIsolateForTesting = 1 << 1,
+  };
+  using SerializerFlags = base::Flags<SerializerFlag>;
+  V8_EXPORT_PRIVATE static constexpr SerializerFlags kDefaultSerializerFlags =
+      {};
+
+  // In preparation for serialization, clear data from the given isolate's heap
+  // that 1. can be reconstructed and 2. is not suitable for serialization. The
+  // `clear_recompilable_data` flag controls whether compiled objects are
+  // cleared from shared function infos and regexp objects.
+  V8_EXPORT_PRIVATE static void ClearReconstructableDataForSerialization(
+      Isolate* isolate, bool clear_recompilable_data);
+
+  // Serializes the given isolate and contexts. Each context may have an
+  // associated callback to serialize internal fields. The default context must
+  // be passed at index 0.
+  static v8::StartupData Create(
+      Isolate* isolate, std::vector<Context>* contexts,
+      const std::vector<SerializeInternalFieldsCallback>&
+          embedder_fields_serializers,
+      const DisallowHeapAllocation& no_gc,
+      SerializerFlags flags = kDefaultSerializerFlags);
+
+  // Convenience helper for the above when only serializing a single context.
+  static v8::StartupData Create(
+      Isolate* isolate, Context default_context,
+      const DisallowHeapAllocation& no_gc,
+      SerializerFlags flags = kDefaultSerializerFlags);
+
+  // ---------------- Deserialization -----------------------------------------
 
   // Initialize the Isolate from the internal snapshot. Returns false if no
   // snapshot could be found.
   static bool Initialize(Isolate* isolate);
 
-  // Create a new context using the internal partial snapshot.
+  // Create a new context using the internal context snapshot.
   static MaybeHandle<Context> NewContextFromSnapshot(
       Isolate* isolate, Handle<JSGlobalProxy> global_proxy,
       size_t context_index,
       v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer);
 
-  // ---------------- Helper methods ----------------
+  // ---------------- Testing -------------------------------------------------
+
+  // This function is used to stress the snapshot component. It serializes the
+  // current isolate and context into a snapshot, deserializes the snapshot into
+  // a new isolate and context, and finally runs VerifyHeap on the fresh
+  // isolate.
+  V8_EXPORT_PRIVATE static void SerializeDeserializeAndVerifyForTesting(
+      Isolate* isolate, Handle<Context> default_context);
+
+  // ---------------- Helper methods ------------------------------------------
 
   static bool HasContextSnapshot(Isolate* isolate, size_t index);
   static bool EmbedsScript(Isolate* isolate);
+  V8_EXPORT_PRIVATE static bool VerifyChecksum(const v8::StartupData* data);
+  static bool ExtractRehashability(const v8::StartupData* data);
+  static bool VersionIsValid(const v8::StartupData* data);
 
   // To be implemented by the snapshot source.
   static const v8::StartupData* DefaultSnapshotBlob();
 
-  V8_EXPORT_PRIVATE static bool VerifyChecksum(const v8::StartupData* data);
-
-  // ---------------- Serialization ----------------
-
-  static v8::StartupData CreateSnapshotBlob(
-      const SnapshotData* startup_snapshot_in,
-      const SnapshotData* read_only_snapshot_in,
-      const std::vector<SnapshotData*>& context_snapshots_in,
-      bool can_be_rehashed);
-
 #ifdef DEBUG
   static bool SnapshotIsValid(const v8::StartupData* snapshot_blob);
 #endif  // DEBUG
-
-  static bool ExtractRehashability(const v8::StartupData* data);
-
- private:
-  static uint32_t ExtractNumContexts(const v8::StartupData* data);
-  static uint32_t ExtractContextOffset(const v8::StartupData* data,
-                                       uint32_t index);
-  static Vector<const byte> ExtractStartupData(const v8::StartupData* data);
-  static Vector<const byte> ExtractReadOnlyData(const v8::StartupData* data);
-  static Vector<const byte> ExtractContextData(const v8::StartupData* data,
-                                               uint32_t index);
-
-  static uint32_t GetHeaderValue(const v8::StartupData* data, uint32_t offset) {
-    return base::ReadLittleEndianValue<uint32_t>(
-        reinterpret_cast<Address>(data->data) + offset);
-  }
-  static void SetHeaderValue(char* data, uint32_t offset, uint32_t value) {
-    base::WriteLittleEndianValue(reinterpret_cast<Address>(data) + offset,
-                                 value);
-  }
-
-  static void CheckVersion(const v8::StartupData* data);
-
-  // Snapshot blob layout:
-  // [0] number of contexts N
-  // [1] rehashability
-  // [2] checksum
-  // [3] (128 bytes) version string
-  // [4] offset to readonly
-  // [5] offset to context 0
-  // [6] offset to context 1
-  // ...
-  // ... offset to context N - 1
-  // ... startup snapshot data
-  // ... read-only snapshot data
-  // ... context 0 snapshot data
-  // ... context 1 snapshot data
-
-  static const uint32_t kNumberOfContextsOffset = 0;
-  // TODO(yangguo): generalize rehashing, and remove this flag.
-  static const uint32_t kRehashabilityOffset =
-      kNumberOfContextsOffset + kUInt32Size;
-  static const uint32_t kChecksumOffset = kRehashabilityOffset + kUInt32Size;
-  static const uint32_t kVersionStringOffset = kChecksumOffset + kUInt32Size;
-  static const uint32_t kVersionStringLength = 64;
-  static const uint32_t kReadOnlyOffsetOffset =
-      kVersionStringOffset + kVersionStringLength;
-  static const uint32_t kFirstContextOffsetOffset =
-      kReadOnlyOffsetOffset + kUInt32Size;
-
-  static Vector<const byte> ChecksummedContent(const v8::StartupData* data) {
-    STATIC_ASSERT(kVersionStringOffset == kChecksumOffset + kUInt32Size);
-    const uint32_t kChecksumStart = kVersionStringOffset;
-    return Vector<const byte>(
-        reinterpret_cast<const byte*>(data->data + kChecksumStart),
-        data->raw_size - kChecksumStart);
-  }
-
-  static uint32_t StartupSnapshotOffset(int num_contexts) {
-    return POINTER_SIZE_ALIGN(kFirstContextOffsetOffset +
-                              num_contexts * kInt32Size);
-  }
-
-  static uint32_t ContextSnapshotOffsetOffset(int index) {
-    return kFirstContextOffsetOffset + index * kInt32Size;
-  }
-
-  DISALLOW_IMPLICIT_CONSTRUCTORS(Snapshot);
 };
 
 // Convenience wrapper around snapshot data blob creation used e.g. by tests and
diff --git a/deps/v8/src/snapshot/startup-deserializer.cc b/deps/v8/src/snapshot/startup-deserializer.cc
index 7ef6ac6168f..6d19c3a399a 100644
--- a/deps/v8/src/snapshot/startup-deserializer.cc
+++ b/deps/v8/src/snapshot/startup-deserializer.cc
@@ -8,6 +8,7 @@
 #include "src/codegen/assembler-inl.h"
 #include "src/execution/v8threads.h"
 #include "src/heap/heap-inl.h"
+#include "src/logging/log.h"
 #include "src/snapshot/snapshot.h"
 
 namespace v8 {
@@ -24,20 +25,23 @@ void StartupDeserializer::DeserializeInto(Isolate* isolate) {
   DCHECK_NULL(isolate->thread_manager()->FirstThreadStateInUse());
   // No active handles.
   DCHECK(isolate->handle_scope_implementer()->blocks()->empty());
-  // Partial snapshot cache is not yet populated.
-  DCHECK(isolate->partial_snapshot_cache()->empty());
+  // Startup object cache is not yet populated.
+  DCHECK(isolate->startup_object_cache()->empty());
   // Builtins are not yet created.
   DCHECK(!isolate->builtins()->is_initialized());
 
   {
     DisallowHeapAllocation no_gc;
     isolate->heap()->IterateSmiRoots(this);
-    isolate->heap()->IterateStrongRoots(this, VISIT_FOR_SERIALIZATION);
+    isolate->heap()->IterateRoots(
+        this,
+        base::EnumSet<SkipRoot>{SkipRoot::kUnserializable, SkipRoot::kWeak});
     Iterate(isolate, this);
-    isolate->heap()->IterateWeakRoots(this, VISIT_FOR_SERIALIZATION);
+    isolate->heap()->IterateWeakRoots(
+        this, base::EnumSet<SkipRoot>{SkipRoot::kUnserializable});
     DeserializeDeferredObjects();
-    RestoreExternalReferenceRedirectors(accessor_infos());
-    RestoreExternalReferenceRedirectors(call_handler_infos());
+    RestoreExternalReferenceRedirectors(isolate, accessor_infos());
+    RestoreExternalReferenceRedirectors(isolate, call_handler_infos());
 
     // Flush the instruction cache for the entire code-space. Must happen after
     // builtins deserialization.
@@ -70,7 +74,7 @@ void StartupDeserializer::DeserializeInto(Isolate* isolate) {
 }
 
 void StartupDeserializer::LogNewMapEvents() {
-  if (FLAG_trace_maps) LOG(isolate_, LogAllMaps());
+  if (FLAG_trace_maps) LOG(isolate(), LogAllMaps());
 }
 
 void StartupDeserializer::FlushICache() {
diff --git a/deps/v8/src/snapshot/startup-serializer.cc b/deps/v8/src/snapshot/startup-serializer.cc
index 8b95ca6b6ac..0820b044c6a 100644
--- a/deps/v8/src/snapshot/startup-serializer.cc
+++ b/deps/v8/src/snapshot/startup-serializer.cc
@@ -19,17 +19,61 @@
 namespace v8 {
 namespace internal {
 
+namespace {
+
+// The isolate roots may not point at context-specific objects during
+// serialization.
+class SanitizeIsolateScope final {
+ public:
+  SanitizeIsolateScope(Isolate* isolate, bool allow_active_isolate_for_testing,
+                       const DisallowHeapAllocation& no_gc)
+      : isolate_(isolate),
+        feedback_vectors_for_profiling_tools_(
+            isolate->heap()->feedback_vectors_for_profiling_tools()),
+        detached_contexts_(isolate->heap()->detached_contexts()) {
+#ifdef DEBUG
+    if (!allow_active_isolate_for_testing) {
+      // These should already be empty when creating a real snapshot.
+      DCHECK_EQ(feedback_vectors_for_profiling_tools_,
+                ReadOnlyRoots(isolate).undefined_value());
+      DCHECK_EQ(detached_contexts_,
+                ReadOnlyRoots(isolate).empty_weak_array_list());
+    }
+#endif
+
+    isolate->SetFeedbackVectorsForProfilingTools(
+        ReadOnlyRoots(isolate).undefined_value());
+    isolate->heap()->SetDetachedContexts(
+        ReadOnlyRoots(isolate).empty_weak_array_list());
+  }
+
+  ~SanitizeIsolateScope() {
+    // Restore saved fields.
+    isolate_->SetFeedbackVectorsForProfilingTools(
+        feedback_vectors_for_profiling_tools_);
+    isolate_->heap()->SetDetachedContexts(detached_contexts_);
+  }
+
+ private:
+  Isolate* isolate_;
+  const Object feedback_vectors_for_profiling_tools_;
+  const WeakArrayList detached_contexts_;
+};
+
+}  // namespace
+
 StartupSerializer::StartupSerializer(Isolate* isolate,
+                                     Snapshot::SerializerFlags flags,
                                      ReadOnlySerializer* read_only_serializer)
-    : RootsSerializer(isolate, RootIndex::kFirstStrongRoot),
+    : RootsSerializer(isolate, flags, RootIndex::kFirstStrongRoot),
       read_only_serializer_(read_only_serializer) {
   allocator()->UseCustomChunkSize(FLAG_serialization_chunk_size);
   InitializeCodeAddressMap();
 }
 
 StartupSerializer::~StartupSerializer() {
-  RestoreExternalReferenceRedirectors(accessor_infos_);
-  RestoreExternalReferenceRedirectors(call_handler_infos_);
+  RestoreExternalReferenceRedirectors(isolate(), accessor_infos_);
+  RestoreExternalReferenceRedirectors(isolate(), call_handler_infos_);
   OutputStatistics("StartupSerializer");
 }
 
@@ -96,13 +140,17 @@ void StartupSerializer::SerializeObject(HeapObject obj) {
   if (use_simulator && obj.IsAccessorInfo()) {
     // Wipe external reference redirects in the accessor info.
     AccessorInfo info = AccessorInfo::cast(obj);
-    Address original_address = Foreign::cast(info.getter()).foreign_address();
-    Foreign::cast(info.js_getter()).set_foreign_address(original_address);
+    Address original_address =
+        Foreign::cast(info.getter()).foreign_address(isolate());
+    Foreign::cast(info.js_getter())
+        .set_foreign_address(isolate(), original_address);
     accessor_infos_.push_back(info);
   } else if (use_simulator && obj.IsCallHandlerInfo()) {
     CallHandlerInfo info = CallHandlerInfo::cast(obj);
-    Address original_address = Foreign::cast(info.callback()).foreign_address();
-    Foreign::cast(info.js_callback()).set_foreign_address(original_address);
+    Address original_address =
+        Foreign::cast(info.callback()).foreign_address(isolate());
+    Foreign::cast(info.js_callback())
+        .set_foreign_address(isolate(), original_address);
     call_handler_infos_.push_back(info);
   } else if (obj.IsScript() && Script::cast(obj).IsUserJavaScript()) {
     Script::cast(obj).set_context_data(
@@ -125,28 +173,36 @@ void StartupSerializer::SerializeObject(HeapObject obj) {
 }
 
 void StartupSerializer::SerializeWeakReferencesAndDeferred() {
-  // This comes right after serialization of the partial snapshot, where we
-  // add entries to the partial snapshot cache of the startup snapshot. Add
-  // one entry with 'undefined' to terminate the partial snapshot cache.
+  // This comes right after serialization of the context snapshot, where we
+  // add entries to the startup object cache of the startup snapshot. Add
+  // one entry with 'undefined' to terminate the startup object cache.
   Object undefined = ReadOnlyRoots(isolate()).undefined_value();
-  VisitRootPointer(Root::kPartialSnapshotCache, nullptr,
+  VisitRootPointer(Root::kStartupObjectCache, nullptr,
                    FullObjectSlot(&undefined));
-  isolate()->heap()->IterateWeakRoots(this, VISIT_FOR_SERIALIZATION);
+  isolate()->heap()->IterateWeakRoots(
+      this, base::EnumSet<SkipRoot>{SkipRoot::kUnserializable});
   SerializeDeferredObjects();
   Pad();
 }
 
-void StartupSerializer::SerializeStrongReferences() {
+void StartupSerializer::SerializeStrongReferences(
+    const DisallowHeapAllocation& no_gc) {
   Isolate* isolate = this->isolate();
   // No active threads.
   CHECK_NULL(isolate->thread_manager()->FirstThreadStateInUse());
   // No active or weak handles.
-  CHECK(isolate->handle_scope_implementer()->blocks()->empty());
+  CHECK_IMPLIES(!allow_active_isolate_for_testing(),
+                isolate->handle_scope_implementer()->blocks()->empty());
+
+  SanitizeIsolateScope sanitize_isolate(
+      isolate, allow_active_isolate_for_testing(), no_gc);
 
   // Visit smi roots and immortal immovables first to make sure they end up in
   // the first page.
   isolate->heap()->IterateSmiRoots(this);
-  isolate->heap()->IterateStrongRoots(this, VISIT_FOR_SERIALIZATION);
+  isolate->heap()->IterateRoots(
+      this,
+      base::EnumSet<SkipRoot>{SkipRoot::kUnserializable, SkipRoot::kWeak});
 }
 
 SerializedHandleChecker::SerializedHandleChecker(Isolate* isolate,
@@ -163,11 +219,11 @@ bool StartupSerializer::SerializeUsingReadOnlyObjectCache(
   return read_only_serializer_->SerializeUsingReadOnlyObjectCache(sink, obj);
 }
 
-void StartupSerializer::SerializeUsingPartialSnapshotCache(
-    SnapshotByteSink* sink, HeapObject obj) {
+void StartupSerializer::SerializeUsingStartupObjectCache(SnapshotByteSink* sink,
+                                                         HeapObject obj) {
   int cache_index = SerializeInObjectCache(obj);
-  sink->Put(kPartialSnapshotCache, "PartialSnapshotCache");
-  sink->PutInt(cache_index, "partial_snapshot_cache_index");
+  sink->Put(kStartupObjectCache, "StartupObjectCache");
+  sink->PutInt(cache_index, "startup_object_cache_index");
 }
 
 void StartupSerializer::CheckNoDirtyFinalizationRegistries() {
@@ -193,6 +249,7 @@ void SerializedHandleChecker::VisitRootPointers(Root root,
     PrintF("%s handle not serialized: ",
            root == Root::kGlobalHandles ? "global" : "eternal");
     (*p).Print();
+    PrintF("\n");
     ok_ = false;
   }
 }
diff --git a/deps/v8/src/snapshot/startup-serializer.h b/deps/v8/src/snapshot/startup-serializer.h
index 50c023852ff..e09c3e48570 100644
--- a/deps/v8/src/snapshot/startup-serializer.h
+++ b/deps/v8/src/snapshot/startup-serializer.h
@@ -18,15 +18,16 @@ class ReadOnlySerializer;
 
 class V8_EXPORT_PRIVATE StartupSerializer : public RootsSerializer {
  public:
-  StartupSerializer(Isolate* isolate, ReadOnlySerializer* read_only_serializer);
+  StartupSerializer(Isolate* isolate, Snapshot::SerializerFlags flags,
+                    ReadOnlySerializer* read_only_serializer);
   ~StartupSerializer() override;
 
   // Serialize the current state of the heap.  The order is:
   // 1) Strong roots
   // 2) Builtins and bytecode handlers
-  // 3) Partial snapshot cache
+  // 3) Startup object cache
   // 4) Weak references (e.g. the string table)
-  void SerializeStrongReferences();
+  void SerializeStrongReferences(const DisallowHeapAllocation& no_gc);
   void SerializeWeakReferencesAndDeferred();
 
   // If |obj| can be serialized in the read-only snapshot then add it to the
@@ -36,10 +37,9 @@ class V8_EXPORT_PRIVATE StartupSerializer : public RootsSerializer {
   bool SerializeUsingReadOnlyObjectCache(SnapshotByteSink* sink,
                                          HeapObject obj);
 
-  // Adds |obj| to the partial snapshot object cache if not already present and
-  // emits a PartialSnapshotCache bytecode into |sink|.
-  void SerializeUsingPartialSnapshotCache(SnapshotByteSink* sink,
-                                          HeapObject obj);
+  // Adds |obj| to the startup object object cache if not already present and
+  // emits a StartupObjectCache bytecode into |sink|.
+  void SerializeUsingStartupObjectCache(SnapshotByteSink* sink, HeapObject obj);
 
   // The per-heap dirty FinalizationRegistry list is weak and not serialized. No
   // JSFinalizationRegistries should be used during startup.
diff --git a/deps/v8/src/strings/uri.cc b/deps/v8/src/strings/uri.cc
index de4e339b392..466c3616a1a 100644
--- a/deps/v8/src/strings/uri.cc
+++ b/deps/v8/src/strings/uri.cc
@@ -420,7 +420,7 @@ static MaybeHandle<String> UnescapePrivate(Isolate* isolate,
   int index;
   {
     DisallowHeapAllocation no_allocation;
-    StringSearch<uint8_t, Char> search(isolate, StaticCharVector("%"));
+    StringSearch<uint8_t, Char> search(isolate, StaticOneByteVector("%"));
     index = search.Search(source->GetCharVector<Char>(no_allocation), 0);
     if (index < 0) return source;
   }
diff --git a/deps/v8/src/torque/ast.h b/deps/v8/src/torque/ast.h
index 93e0622aee2..76c047c7eec 100644
--- a/deps/v8/src/torque/ast.h
+++ b/deps/v8/src/torque/ast.h
@@ -93,7 +93,7 @@ namespace torque {
   AST_STATEMENT_NODE_KIND_LIST(V)       \
   AST_DECLARATION_NODE_KIND_LIST(V)     \
   V(Identifier)                         \
-  V(LabelBlock)                         \
+  V(TryHandler)                         \
   V(ClassBody)
 
 struct AstNode {
@@ -204,7 +204,7 @@ struct EnumDescription {
 
 class Ast {
  public:
-  Ast() {}
+  Ast() = default;
 
   std::vector<Declaration*>& declarations() { return declarations_; }
   const std::vector<Declaration*>& declarations() const {
@@ -780,14 +780,17 @@ struct ForLoopStatement : Statement {
   Statement* body;
 };
 
-struct LabelBlock : AstNode {
-  DEFINE_AST_NODE_LEAF_BOILERPLATE(LabelBlock)
-  LabelBlock(SourcePosition pos, Identifier* label,
+struct TryHandler : AstNode {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(TryHandler)
+  enum class HandlerKind { kCatch, kLabel };
+  TryHandler(SourcePosition pos, HandlerKind handler_kind, Identifier* label,
              const ParameterList& parameters, Statement* body)
       : AstNode(kKind, pos),
+        handler_kind(handler_kind),
         label(label),
         parameters(parameters),
         body(std::move(body)) {}
+  HandlerKind handler_kind;
   Identifier* label;
   ParameterList parameters;
   Statement* body;
@@ -802,15 +805,13 @@ struct StatementExpression : Expression {
 
 struct TryLabelExpression : Expression {
   DEFINE_AST_NODE_LEAF_BOILERPLATE(TryLabelExpression)
-  TryLabelExpression(SourcePosition pos, bool catch_exceptions,
-                     Expression* try_expression, LabelBlock* label_block)
+  TryLabelExpression(SourcePosition pos, Expression* try_expression,
+                     TryHandler* label_block)
       : Expression(kKind, pos),
-        catch_exceptions(catch_exceptions),
         try_expression(try_expression),
         label_block(label_block) {}
-  bool catch_exceptions;
   Expression* try_expression;
-  LabelBlock* label_block;
+  TryHandler* label_block;
 };
 
 struct BlockStatement : Statement {
@@ -1175,8 +1176,7 @@ struct ClassBody : AstNode {
 struct ClassDeclaration : TypeDeclaration {
   DEFINE_AST_NODE_LEAF_BOILERPLATE(ClassDeclaration)
   ClassDeclaration(SourcePosition pos, Identifier* name, ClassFlags flags,
-                   base::Optional<TypeExpression*> super,
-                   base::Optional<std::string> generates,
+                   TypeExpression* super, base::Optional<std::string> generates,
                    std::vector<Declaration*> methods,
                    std::vector<ClassFieldExpression> fields,
                    InstanceTypeConstraints instance_type_constraints)
@@ -1188,7 +1188,7 @@ struct ClassDeclaration : TypeDeclaration {
         fields(std::move(fields)),
         instance_type_constraints(std::move(instance_type_constraints)) {}
   ClassFlags flags;
-  base::Optional<TypeExpression*> super;
+  TypeExpression* super;
   base::Optional<std::string> generates;
   std::vector<Declaration*> methods;
   std::vector<ClassFieldExpression> fields;
diff --git a/deps/v8/src/torque/cfg.h b/deps/v8/src/torque/cfg.h
index e45cb75073e..4cacb58edb3 100644
--- a/deps/v8/src/torque/cfg.h
+++ b/deps/v8/src/torque/cfg.h
@@ -63,7 +63,7 @@ class Block {
 
     DCHECK_EQ(input_definitions_->Size(), input_definitions.Size());
     bool changed = false;
-    for (BottomOffset i = 0; i < input_definitions.AboveTop(); ++i) {
+    for (BottomOffset i = {0}; i < input_definitions.AboveTop(); ++i) {
       auto& current = input_definitions_->Peek(i);
       auto& input = input_definitions.Peek(i);
       if (current == input) continue;
diff --git a/deps/v8/src/torque/class-debug-reader-generator.cc b/deps/v8/src/torque/class-debug-reader-generator.cc
index 52646dff261..b89ec85d80a 100644
--- a/deps/v8/src/torque/class-debug-reader-generator.cc
+++ b/deps/v8/src/torque/class-debug-reader-generator.cc
@@ -53,7 +53,7 @@ class ValueTypeFieldIterator {
     if (const auto type_wrapped_in_smi =
             Type::MatchUnaryGeneric(type_, TypeOracle::GetSmiTaggedGeneric())) {
       type = *type_wrapped_in_smi;
-      bitfield_start_offset = kSmiTagSize + kSmiShiftSize;
+      bitfield_start_offset = TargetArchitecture::SmiTagAndShiftSize();
     }
     if (const BitFieldStructType* bit_field_struct_type =
             BitFieldStructType::DynamicCast(type)) {
diff --git a/deps/v8/src/torque/constants.h b/deps/v8/src/torque/constants.h
index 9eba568ac9f..616e7a23acd 100644
--- a/deps/v8/src/torque/constants.h
+++ b/deps/v8/src/torque/constants.h
@@ -24,6 +24,7 @@ static const char* const BOOL_TYPE_STRING = "bool";
 static const char* const VOID_TYPE_STRING = "void";
 static const char* const ARGUMENTS_TYPE_STRING = "Arguments";
 static const char* const CONTEXT_TYPE_STRING = "Context";
+static const char* const NO_CONTEXT_TYPE_STRING = "NoContext";
 static const char* const NATIVE_CONTEXT_TYPE_STRING = "NativeContext";
 static const char* const JS_FUNCTION_TYPE_STRING = "JSFunction";
 static const char* const MAP_TYPE_STRING = "Map";
@@ -38,6 +39,7 @@ static const char* const UNINITIALIZED_TYPE_STRING = "Uninitialized";
 static const char* const UNINITIALIZED_HEAP_OBJECT_TYPE_STRING =
     "UninitializedHeapObject";
 static const char* const RAWPTR_TYPE_STRING = "RawPtr";
+static const char* const EXTERNALPTR_TYPE_STRING = "ExternalPointer";
 static const char* const CONST_STRING_TYPE_STRING = "constexpr string";
 static const char* const STRING_TYPE_STRING = "String";
 static const char* const NUMBER_TYPE_STRING = "Number";
@@ -126,7 +128,6 @@ enum class ClassFlag {
   kIsShape = 1 << 5,
   kHasSameInstanceTypeAsParent = 1 << 6,
   kGenerateCppClassDefinitions = 1 << 7,
-  kHasIndexedField = 1 << 8,
   kHighestInstanceTypeWithinParent = 1 << 9,
   kLowestInstanceTypeWithinParent = 1 << 10,
   kUndefinedLayout = 1 << 11,
diff --git a/deps/v8/src/torque/csa-generator.cc b/deps/v8/src/torque/csa-generator.cc
index 9716ccbad43..00e8f2202d0 100644
--- a/deps/v8/src/torque/csa-generator.cc
+++ b/deps/v8/src/torque/csa-generator.cc
@@ -5,6 +5,7 @@
 #include "src/torque/csa-generator.h"
 
 #include "src/common/globals.h"
+#include "src/torque/global-context.h"
 #include "src/torque/type-oracle.h"
 #include "src/torque/types.h"
 #include "src/torque/utils.h"
@@ -15,7 +16,7 @@ namespace torque {
 
 base::Optional<Stack<std::string>> CSAGenerator::EmitGraph(
     Stack<std::string> parameters) {
-  for (BottomOffset i = 0; i < parameters.AboveTop(); ++i) {
+  for (BottomOffset i = {0}; i < parameters.AboveTop(); ++i) {
     SetDefinitionVariable(DefinitionLocation::Parameter(i.offset),
                           parameters.Peek(i));
   }
@@ -26,7 +27,7 @@ base::Optional<Stack<std::string>> CSAGenerator::EmitGraph(
     out() << "  compiler::CodeAssemblerParameterizedLabel<";
     bool first = true;
     DCHECK_EQ(block->InputTypes().Size(), block->InputDefinitions().Size());
-    for (BottomOffset i = 0; i < block->InputTypes().AboveTop(); ++i) {
+    for (BottomOffset i = {0}; i < block->InputTypes().AboveTop(); ++i) {
       if (block->InputDefinitions().Peek(i).IsPhiFromBlock(block)) {
         if (!first) out() << ", ";
         out() << block->InputTypes().Peek(i)->GetGeneratedTNodeTypeName();
@@ -69,7 +70,7 @@ Stack<std::string> CSAGenerator::EmitBlock(const Block* block) {
   Stack<std::string> stack;
   std::stringstream phi_names;
 
-  for (BottomOffset i = 0; i < block->InputTypes().AboveTop(); ++i) {
+  for (BottomOffset i = {0}; i < block->InputTypes().AboveTop(); ++i) {
     const auto& def = block->InputDefinitions().Peek(i);
     stack.Push(DefinitionToVariable(def));
     if (def.IsPhiFromBlock(block)) {
@@ -467,7 +468,7 @@ void CSAGenerator::EmitInstruction(
 
     const auto& input_definitions =
         (*instruction.return_continuation)->InputDefinitions();
-    for (BottomOffset i = 0; i < input_definitions.AboveTop(); ++i) {
+    for (BottomOffset i = {0}; i < input_definitions.AboveTop(); ++i) {
       if (input_definitions.Peek(i).IsPhiFromBlock(
               *instruction.return_continuation)) {
         out() << ", "
@@ -486,7 +487,7 @@ void CSAGenerator::EmitInstruction(
     const auto& label_definitions =
         instruction.label_blocks[l]->InputDefinitions();
 
-    BottomOffset i = 0;
+    BottomOffset i = {0};
     for (; i < stack->AboveTop(); ++i) {
       if (label_definitions.Peek(i).IsPhiFromBlock(
               instruction.label_blocks[l])) {
@@ -511,8 +512,14 @@ void CSAGenerator::EmitInstruction(const CallBuiltinInstruction& instruction,
       LowerType(instruction.builtin->signature().return_type);
   if (instruction.is_tailcall) {
     out() << "   CodeStubAssembler(state_).TailCallBuiltin(Builtins::k"
-          << instruction.builtin->ExternalName() << ", ";
-    PrintCommaSeparatedList(out(), arguments);
+          << instruction.builtin->ExternalName();
+    if (!instruction.builtin->signature().HasContextParameter()) {
+      // Add dummy context parameter to satisfy the TailCallBuiltin signature.
+      out() << ", TNode<Object>()";
+    }
+    for (const std::string& argument : arguments) {
+      out() << ", " << argument;
+    }
     out() << ");\n";
   } else {
     std::string result_name;
@@ -524,25 +531,24 @@ void CSAGenerator::EmitInstruction(const CallBuiltinInstruction& instruction,
     std::string catch_name =
         PreCallableExceptionPreparation(instruction.catch_block);
     Stack<std::string> pre_call_stack = *stack;
-    if (result_types.size() == 1) {
-      std::string generated_type = result_types[0]->GetGeneratedTNodeTypeName();
-      stack->Push(result_name);
-      out() << "    " << result_name << " = ";
-      if (generated_type != "Object") out() << "TORQUE_CAST(";
-      out() << "CodeStubAssembler(state_).CallBuiltin(Builtins::k"
-            << instruction.builtin->ExternalName() << ", ";
-      PrintCommaSeparatedList(out(), arguments);
-      if (generated_type != "Object") out() << ")";
-      out() << ");\n";
-    } else {
-      DCHECK_EQ(0, result_types.size());
-      // TODO(tebbi): Actually, builtins have to return a value, so we should
-      // not have to handle this case.
-      out() << "    CodeStubAssembler(state_).CallBuiltin(Builtins::k"
-            << instruction.builtin->ExternalName() << ", ";
-      PrintCommaSeparatedList(out(), arguments);
-      out() << ");\n";
+
+    DCHECK_EQ(1, result_types.size());
+    std::string generated_type = result_types[0]->GetGeneratedTNodeTypeName();
+    stack->Push(result_name);
+    out() << "    " << result_name << " = ";
+    if (generated_type != "Object") out() << "TORQUE_CAST(";
+    out() << "CodeStubAssembler(state_).CallBuiltin(Builtins::k"
+          << instruction.builtin->ExternalName();
+    if (!instruction.builtin->signature().HasContextParameter()) {
+      // Add dummy context parameter to satisfy the CallBuiltin signature.
+      out() << ", TNode<Object>()";
     }
+    for (const std::string& argument : arguments) {
+      out() << ", " << argument;
+    }
+    if (generated_type != "Object") out() << ")";
+    out() << ");\n";
+
     PostCallableExceptionPreparation(
         catch_name,
         result_types.size() == 0 ? TypeOracle::GetVoidType() : result_types[0],
@@ -554,8 +560,8 @@ void CSAGenerator::EmitInstruction(const CallBuiltinInstruction& instruction,
 void CSAGenerator::EmitInstruction(
     const CallBuiltinPointerInstruction& instruction,
     Stack<std::string>* stack) {
-  std::vector<std::string> function_and_arguments =
-      stack->PopMany(1 + instruction.argc);
+  std::vector<std::string> arguments = stack->PopMany(instruction.argc);
+  std::string function = stack->Pop();
   std::vector<const Type*> result_types =
       LowerType(instruction.type->return_type());
   if (result_types.size() != 1) {
@@ -575,8 +581,15 @@ void CSAGenerator::EmitInstruction(
            "CallableFor(ca_."
            "isolate(),"
            "ExampleBuiltinForTorqueFunctionPointerType("
-        << instruction.type->function_pointer_type_id() << ")).descriptor(), ";
-  PrintCommaSeparatedList(out(), function_and_arguments);
+        << instruction.type->function_pointer_type_id() << ")).descriptor(), "
+        << function;
+  if (!instruction.type->HasContextParameter()) {
+    // Add dummy context parameter to satisfy the CallBuiltinPointer signature.
+    out() << ", TNode<Object>()";
+  }
+  for (const std::string& argument : arguments) {
+    out() << ", " << argument;
+  }
   out() << ")";
   if (generated_type != "Object") out() << ")";
   out() << ";\n";
@@ -617,7 +630,7 @@ void CSAGenerator::PostCallableExceptionPreparation(
 
     DCHECK_EQ(stack->Size() + 1, (*catch_block)->InputDefinitions().Size());
     const auto& input_definitions = (*catch_block)->InputDefinitions();
-    for (BottomOffset i = 0; i < input_definitions.AboveTop(); ++i) {
+    for (BottomOffset i = {0}; i < input_definitions.AboveTop(); ++i) {
       if (input_definitions.Peek(i).IsPhiFromBlock(*catch_block)) {
         if (i < stack->AboveTop()) {
           out() << ", " << stack->Peek(i);
@@ -700,7 +713,7 @@ void CSAGenerator::EmitInstruction(const BranchInstruction& instruction,
   const auto& true_definitions = instruction.if_true->InputDefinitions();
   DCHECK_EQ(stack->Size(), true_definitions.Size());
   bool first = true;
-  for (BottomOffset i = 0; i < stack->AboveTop(); ++i) {
+  for (BottomOffset i = {0}; i < stack->AboveTop(); ++i) {
     if (true_definitions.Peek(i).IsPhiFromBlock(instruction.if_true)) {
       if (!first) out() << ", ";
       out() << stack->Peek(i);
@@ -713,7 +726,7 @@ void CSAGenerator::EmitInstruction(const BranchInstruction& instruction,
   const auto& false_definitions = instruction.if_false->InputDefinitions();
   DCHECK_EQ(stack->Size(), false_definitions.Size());
   first = true;
-  for (BottomOffset i = 0; i < stack->AboveTop(); ++i) {
+  for (BottomOffset i = {0}; i < stack->AboveTop(); ++i) {
     if (false_definitions.Peek(i).IsPhiFromBlock(instruction.if_false)) {
       if (!first) out() << ", ";
       out() << stack->Peek(i);
@@ -731,7 +744,7 @@ void CSAGenerator::EmitInstruction(
 
   const auto& true_definitions = instruction.if_true->InputDefinitions();
   DCHECK_EQ(stack->Size(), true_definitions.Size());
-  for (BottomOffset i = 0; i < stack->AboveTop(); ++i) {
+  for (BottomOffset i = {0}; i < stack->AboveTop(); ++i) {
     if (true_definitions.Peek(i).IsPhiFromBlock(instruction.if_true)) {
       out() << ", " << stack->Peek(i);
     }
@@ -743,7 +756,7 @@ void CSAGenerator::EmitInstruction(
 
   const auto& false_definitions = instruction.if_false->InputDefinitions();
   DCHECK_EQ(stack->Size(), false_definitions.Size());
-  for (BottomOffset i = 0; i < stack->AboveTop(); ++i) {
+  for (BottomOffset i = {0}; i < stack->AboveTop(); ++i) {
     if (false_definitions.Peek(i).IsPhiFromBlock(instruction.if_false)) {
       out() << ", " << stack->Peek(i);
     }
@@ -759,7 +772,7 @@ void CSAGenerator::EmitInstruction(const GotoInstruction& instruction,
   const auto& destination_definitions =
       instruction.destination->InputDefinitions();
   DCHECK_EQ(stack->Size(), destination_definitions.Size());
-  for (BottomOffset i = 0; i < stack->AboveTop(); ++i) {
+  for (BottomOffset i = {0}; i < stack->AboveTop(); ++i) {
     if (destination_definitions.Peek(i).IsPhiFromBlock(
             instruction.destination)) {
       out() << ", " << stack->Peek(i);
@@ -858,13 +871,20 @@ void CSAGenerator::EmitInstruction(const StoreReferenceInstruction& instruction,
 }
 
 namespace {
-std::string GetBitFieldSpecialization(const BitFieldStructType* container,
+std::string GetBitFieldSpecialization(const Type* container,
                                       const BitField& field) {
+  auto smi_tagged_type =
+      Type::MatchUnaryGeneric(container, TypeOracle::GetSmiTaggedGeneric());
+  std::string container_type = smi_tagged_type
+                                   ? "uintptr_t"
+                                   : container->GetConstexprGeneratedTypeName();
+  int offset = smi_tagged_type
+                   ? field.offset + TargetArchitecture::SmiTagAndShiftSize()
+                   : field.offset;
   std::stringstream stream;
   stream << "base::BitField<"
          << field.name_and_type.type->GetConstexprGeneratedTypeName() << ", "
-         << field.offset << ", " << field.num_bits << ", "
-         << container->GetConstexprGeneratedTypeName() << ">";
+         << offset << ", " << field.num_bits << ", " << container_type << ">";
   return stream.str();
 }
 }  // namespace
@@ -877,23 +897,36 @@ void CSAGenerator::EmitInstruction(const LoadBitFieldInstruction& instruction,
   std::string bit_field_struct = stack->Pop();
   stack->Push(result_name);
 
-  const BitFieldStructType* source_type = instruction.bit_field_struct_type;
-  const Type* result_type = instruction.bit_field.name_and_type.type;
-  bool source_uintptr = source_type->IsSubtypeOf(TypeOracle::GetUIntPtrType());
-  bool result_uintptr = result_type->IsSubtypeOf(TypeOracle::GetUIntPtrType());
-  std::string source_word_type = source_uintptr ? "WordT" : "Word32T";
+  const Type* struct_type = instruction.bit_field_struct_type;
+  const Type* field_type = instruction.bit_field.name_and_type.type;
+  auto smi_tagged_type =
+      Type::MatchUnaryGeneric(struct_type, TypeOracle::GetSmiTaggedGeneric());
+  bool struct_is_pointer_size =
+      IsPointerSizeIntegralType(struct_type) || smi_tagged_type;
+  DCHECK_IMPLIES(!struct_is_pointer_size, Is32BitIntegralType(struct_type));
+  bool field_is_pointer_size = IsPointerSizeIntegralType(field_type);
+  DCHECK_IMPLIES(!field_is_pointer_size, Is32BitIntegralType(field_type));
+  std::string struct_word_type = struct_is_pointer_size ? "WordT" : "Word32T";
   std::string decoder =
-      source_uintptr
-          ? (result_uintptr ? "DecodeWord" : "DecodeWord32FromWord")
-          : (result_uintptr ? "DecodeWordFromWord32" : "DecodeWord32");
+      struct_is_pointer_size
+          ? (field_is_pointer_size ? "DecodeWord" : "DecodeWord32FromWord")
+          : (field_is_pointer_size ? "DecodeWordFromWord32" : "DecodeWord32");
 
-  decls() << "  " << result_type->GetGeneratedTypeName() << " " << result_name
+  decls() << "  " << field_type->GetGeneratedTypeName() << " " << result_name
           << ";\n";
+
+  if (smi_tagged_type) {
+    // If the container is a SMI, then UncheckedCast is insufficient and we must
+    // use a bit cast.
+    bit_field_struct =
+        "ca_.BitcastTaggedToWordForTagAndSmiBits(" + bit_field_struct + ")";
+  }
+
   out() << "    " << result_name << " = ca_.UncheckedCast<"
-        << result_type->GetGeneratedTNodeTypeName()
+        << field_type->GetGeneratedTNodeTypeName()
         << ">(CodeStubAssembler(state_)." << decoder << "<"
-        << GetBitFieldSpecialization(source_type, instruction.bit_field)
-        << ">(ca_.UncheckedCast<" << source_word_type << ">("
+        << GetBitFieldSpecialization(struct_type, instruction.bit_field)
+        << ">(ca_.UncheckedCast<" << struct_word_type << ">("
         << bit_field_struct << ")));\n";
 }
 
@@ -906,25 +939,47 @@ void CSAGenerator::EmitInstruction(const StoreBitFieldInstruction& instruction,
   std::string bit_field_struct = stack->Pop();
   stack->Push(result_name);
 
-  const BitFieldStructType* struct_type = instruction.bit_field_struct_type;
+  const Type* struct_type = instruction.bit_field_struct_type;
   const Type* field_type = instruction.bit_field.name_and_type.type;
-  bool struct_uintptr = struct_type->IsSubtypeOf(TypeOracle::GetUIntPtrType());
-  bool field_uintptr = field_type->IsSubtypeOf(TypeOracle::GetUIntPtrType());
-  std::string struct_word_type = struct_uintptr ? "WordT" : "Word32T";
-  std::string field_word_type = field_uintptr ? "UintPtrT" : "Uint32T";
+  auto smi_tagged_type =
+      Type::MatchUnaryGeneric(struct_type, TypeOracle::GetSmiTaggedGeneric());
+  bool struct_is_pointer_size =
+      IsPointerSizeIntegralType(struct_type) || smi_tagged_type;
+  DCHECK_IMPLIES(!struct_is_pointer_size, Is32BitIntegralType(struct_type));
+  bool field_is_pointer_size = IsPointerSizeIntegralType(field_type);
+  DCHECK_IMPLIES(!field_is_pointer_size, Is32BitIntegralType(field_type));
+  std::string struct_word_type = struct_is_pointer_size ? "WordT" : "Word32T";
+  std::string field_word_type = field_is_pointer_size ? "UintPtrT" : "Uint32T";
   std::string encoder =
-      struct_uintptr ? (field_uintptr ? "UpdateWord" : "UpdateWord32InWord")
-                     : (field_uintptr ? "UpdateWordInWord32" : "UpdateWord32");
+      struct_is_pointer_size
+          ? (field_is_pointer_size ? "UpdateWord" : "UpdateWord32InWord")
+          : (field_is_pointer_size ? "UpdateWordInWord32" : "UpdateWord32");
 
   decls() << "  " << struct_type->GetGeneratedTypeName() << " " << result_name
           << ";\n";
+
+  if (smi_tagged_type) {
+    // If the container is a SMI, then UncheckedCast is insufficient and we must
+    // use a bit cast.
+    bit_field_struct =
+        "ca_.BitcastTaggedToWordForTagAndSmiBits(" + bit_field_struct + ")";
+  }
+
+  std::string result_expression =
+      "CodeStubAssembler(state_)." + encoder + "<" +
+      GetBitFieldSpecialization(struct_type, instruction.bit_field) +
+      ">(ca_.UncheckedCast<" + struct_word_type + ">(" + bit_field_struct +
+      "), ca_.UncheckedCast<" + field_word_type + ">(" + value + ")" +
+      (instruction.starts_as_zero ? ", true" : "") + ")";
+
+  if (smi_tagged_type) {
+    result_expression =
+        "ca_.BitcastWordToTaggedSigned(" + result_expression + ")";
+  }
+
   out() << "    " << result_name << " = ca_.UncheckedCast<"
-        << struct_type->GetGeneratedTNodeTypeName()
-        << ">(CodeStubAssembler(state_)." << encoder << "<"
-        << GetBitFieldSpecialization(struct_type, instruction.bit_field)
-        << ">(ca_.UncheckedCast<" << struct_word_type << ">("
-        << bit_field_struct << "), ca_.UncheckedCast<" << field_word_type
-        << ">(" << value << ")));\n";
+        << struct_type->GetGeneratedTNodeTypeName() << ">(" << result_expression
+        << ");\n";
 }
 
 // static
diff --git a/deps/v8/src/torque/declarable.cc b/deps/v8/src/torque/declarable.cc
index 7c370c97b3c..fb5ed15f850 100644
--- a/deps/v8/src/torque/declarable.cc
+++ b/deps/v8/src/torque/declarable.cc
@@ -77,9 +77,26 @@ SpecializationRequester::SpecializationRequester(SourcePosition position,
   this->scope = scope;
 }
 
+std::vector<Declarable*> Scope::Lookup(const QualifiedName& name) {
+  if (name.namespace_qualification.size() >= 1 &&
+      name.namespace_qualification[0] == "") {
+    return GlobalContext::GetDefaultNamespace()->Lookup(
+        name.DropFirstNamespaceQualification());
+  }
+  std::vector<Declarable*> result;
+  if (ParentScope()) {
+    result = ParentScope()->Lookup(name);
+  }
+  for (Declarable* declarable : LookupShallow(name)) {
+    result.push_back(declarable);
+  }
+  return result;
+}
+
 base::Optional<std::string> TypeConstraint::IsViolated(const Type* type) const {
   if (upper_bound && !type->IsSubtypeOf(*upper_bound)) {
-    return {ToString("expected ", *type, " to be a subtype of ", *upper_bound)};
+    return {
+        ToString("expected ", *type, " to be a subtype of ", **upper_bound)};
   }
   return base::nullopt;
 }
diff --git a/deps/v8/src/torque/declarable.h b/deps/v8/src/torque/declarable.h
index b6fdef67b90..6fbf969e86f 100644
--- a/deps/v8/src/torque/declarable.h
+++ b/deps/v8/src/torque/declarable.h
@@ -36,6 +36,17 @@ struct QualifiedName {
   explicit QualifiedName(std::string name)
       : QualifiedName({}, std::move(name)) {}
 
+  bool HasNamespaceQualification() const {
+    return !namespace_qualification.empty();
+  }
+
+  QualifiedName DropFirstNamespaceQualification() const {
+    return QualifiedName{
+        std::vector<std::string>(namespace_qualification.begin() + 1,
+                                 namespace_qualification.end()),
+        name};
+  }
+
   friend std::ostream& operator<<(std::ostream& os, const QualifiedName& name);
 };
 
@@ -163,7 +174,7 @@ class Scope : public Declarable {
   explicit Scope(Declarable::Kind kind) : Declarable(kind) {}
 
   std::vector<Declarable*> LookupShallow(const QualifiedName& name) {
-    if (name.namespace_qualification.empty()) return declarations_[name.name];
+    if (!name.HasNamespaceQualification()) return declarations_[name.name];
     Scope* child = nullptr;
     for (Declarable* declarable :
          declarations_[name.namespace_qualification.front()]) {
@@ -176,22 +187,10 @@ class Scope : public Declarable {
       }
     }
     if (child == nullptr) return {};
-    return child->LookupShallow(
-        QualifiedName({name.namespace_qualification.begin() + 1,
-                       name.namespace_qualification.end()},
-                      name.name));
+    return child->LookupShallow(name.DropFirstNamespaceQualification());
   }
 
-  std::vector<Declarable*> Lookup(const QualifiedName& name) {
-    std::vector<Declarable*> result;
-    if (ParentScope()) {
-      result = ParentScope()->Lookup(name);
-    }
-    for (Declarable* declarable : LookupShallow(name)) {
-      result.push_back(declarable);
-    }
-    return result;
-  }
+  std::vector<Declarable*> Lookup(const QualifiedName& name);
   template <class T>
   T* AddDeclarable(const std::string& name, T* declarable) {
     declarations_[name].push_back(declarable);
diff --git a/deps/v8/src/torque/declaration-visitor.cc b/deps/v8/src/torque/declaration-visitor.cc
index 5e3c8bbcb26..99b7bdddcd1 100644
--- a/deps/v8/src/torque/declaration-visitor.cc
+++ b/deps/v8/src/torque/declaration-visitor.cc
@@ -103,6 +103,10 @@ Builtin* DeclarationVisitor::CreateBuiltin(BuiltinDeclaration* decl,
           *signature.return_type, ".");
   }
 
+  if (signature.return_type == TypeOracle::GetVoidType()) {
+    Error("Builtins cannot have return type void.");
+  }
+
   return Declarations::CreateBuiltin(std::move(external_name),
                                      std::move(readable_name), kind,
                                      std::move(signature), body);
@@ -122,11 +126,12 @@ void DeclarationVisitor::Visit(ExternalRuntimeDeclaration* decl) {
         "Missing parameters for runtime function, at least the context "
         "parameter is required.");
   }
-  if (!(signature.parameter_types.types[0] == TypeOracle::GetContextType())) {
+  if (!(signature.parameter_types.types[0] == TypeOracle::GetContextType() ||
+        signature.parameter_types.types[0] == TypeOracle::GetNoContextType())) {
     ReportError(
         "first parameter to runtime functions has to be the context and have "
-        "type Context, but found type ",
-        signature.parameter_types.types[0]);
+        "type Context or NoContext, but found type ",
+        *signature.parameter_types.types[0]);
   }
   if (!(signature.return_type->IsSubtypeOf(TypeOracle::GetObjectType()) ||
         signature.return_type == TypeOracle::GetVoidType() ||
diff --git a/deps/v8/src/torque/earley-parser.h b/deps/v8/src/torque/earley-parser.h
index 81b75bdd7a1..77bcd2ab9cb 100644
--- a/deps/v8/src/torque/earley-parser.h
+++ b/deps/v8/src/torque/earley-parser.h
@@ -52,8 +52,7 @@ enum class ParseResultHolderBase::TypeId {
   kDeclarationPtr,
   kTypeExpressionPtr,
   kOptionalTypeExpressionPtr,
-  kLabelBlockPtr,
-  kOptionalLabelBlockPtr,
+  kTryHandlerPtr,
   kNameAndTypeExpression,
   kImplicitParameters,
   kOptionalImplicitParameters,
@@ -82,7 +81,7 @@ enum class ParseResultHolderBase::TypeId {
   kOptionalTypeList,
   kLabelAndTypes,
   kStdVectorOfLabelAndTypes,
-  kStdVectorOfLabelBlockPtr,
+  kStdVectorOfTryHandlerPtr,
   kOptionalStatementPtr,
   kOptionalExpressionPtr,
   kTypeswitchCase,
diff --git a/deps/v8/src/torque/global-context.cc b/deps/v8/src/torque/global-context.cc
index e236de5a93e..35ddb1d2e26 100644
--- a/deps/v8/src/torque/global-context.cc
+++ b/deps/v8/src/torque/global-context.cc
@@ -24,7 +24,12 @@ GlobalContext::GlobalContext(Ast ast)
 
 TargetArchitecture::TargetArchitecture(bool force_32bit)
     : tagged_size_(force_32bit ? sizeof(int32_t) : kTaggedSize),
-      raw_ptr_size_(force_32bit ? sizeof(int32_t) : kSystemPointerSize) {}
+      raw_ptr_size_(force_32bit ? sizeof(int32_t) : kSystemPointerSize),
+      smi_tag_and_shift_size_(
+          kSmiTagSize + (force_32bit ? SmiTagging<kApiInt32Size>::kSmiShiftSize
+                                     : kSmiShiftSize)),
+      external_ptr_size_(force_32bit ? sizeof(int32_t) : kExternalPointerSize) {
+}
 
 }  // namespace torque
 }  // namespace internal
diff --git a/deps/v8/src/torque/global-context.h b/deps/v8/src/torque/global-context.h
index bbfbb686ef4..6182762a6a2 100644
--- a/deps/v8/src/torque/global-context.h
+++ b/deps/v8/src/torque/global-context.h
@@ -67,6 +67,14 @@ class GlobalContext : public ContextualClass<GlobalContext> {
     return Get().generated_per_file_[file];
   }
 
+  static void SetInstanceTypesInitialized() {
+    DCHECK(!Get().instance_types_initialized_);
+    Get().instance_types_initialized_ = true;
+  }
+  static bool IsInstanceTypesInitialized() {
+    return Get().instance_types_initialized_;
+  }
+
  private:
   bool collect_language_server_data_;
   bool force_assert_statements_;
@@ -76,6 +84,7 @@ class GlobalContext : public ContextualClass<GlobalContext> {
   std::set<std::string> cpp_includes_;
   std::map<SourceId, PerFileStreams> generated_per_file_;
   std::map<std::string, size_t> fresh_ids_;
+  bool instance_types_initialized_ = false;
 
   friend class LanguageServerData;
 };
@@ -91,12 +100,16 @@ class TargetArchitecture : public ContextualClass<TargetArchitecture> {
 
   static size_t TaggedSize() { return Get().tagged_size_; }
   static size_t RawPtrSize() { return Get().raw_ptr_size_; }
+  static size_t ExternalPointerSize() { return Get().external_ptr_size_; }
   static size_t MaxHeapAlignment() { return TaggedSize(); }
   static bool ArePointersCompressed() { return TaggedSize() < RawPtrSize(); }
+  static int SmiTagAndShiftSize() { return Get().smi_tag_and_shift_size_; }
 
  private:
   const size_t tagged_size_;
   const size_t raw_ptr_size_;
+  const int smi_tag_and_shift_size_;
+  const size_t external_ptr_size_;
 };
 
 }  // namespace torque
diff --git a/deps/v8/src/torque/implementation-visitor.cc b/deps/v8/src/torque/implementation-visitor.cc
index 820576e02a2..874e43a7b0d 100644
--- a/deps/v8/src/torque/implementation-visitor.cc
+++ b/deps/v8/src/torque/implementation-visitor.cc
@@ -2,7 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/torque/implementation-visitor.h"
+
 #include <algorithm>
+#include <iomanip>
 #include <string>
 
 #include "src/base/optional.h"
@@ -10,7 +13,6 @@
 #include "src/torque/csa-generator.h"
 #include "src/torque/declaration-visitor.h"
 #include "src/torque/global-context.h"
-#include "src/torque/implementation-visitor.h"
 #include "src/torque/parameter-difference.h"
 #include "src/torque/server-data.h"
 #include "src/torque/type-inference.h"
@@ -530,17 +532,8 @@ void ImplementationVisitor::Visit(Builtin* builtin) {
   } else {
     DCHECK(builtin->IsStub());
 
-    // Context
-    const bool context_is_implicit = signature.implicit_count > 0;
-    std::string parameter0 =
-        AddParameter(0, builtin, &parameters, &parameter_types,
-                     &parameter_bindings, context_is_implicit);
-    source_out() << "  TNode<Context> " << parameter0
-                 << " = UncheckedCast<Context>(Parameter("
-                 << "Descriptor::kContext));\n";
-    source_out() << "  USE(" << parameter0 << ");\n";
-
-    for (size_t i = 1; i < signature.parameter_names.size(); ++i) {
+    bool has_context_parameter = signature.HasContextParameter();
+    for (size_t i = 0; i < signature.parameter_names.size(); ++i) {
       const Type* type = signature.types()[i];
       const bool mark_as_used = signature.implicit_count > i;
       std::string var = AddParameter(i, builtin, &parameters, &parameter_types,
@@ -548,8 +541,14 @@ void ImplementationVisitor::Visit(Builtin* builtin) {
       source_out() << "  " << type->GetGeneratedTypeName() << " " << var
                    << " = "
                    << "UncheckedCast<" << type->GetGeneratedTNodeTypeName()
-                   << ">(Parameter(Descriptor::ParameterIndex<" << (i - 1)
-                   << ">()));\n";
+                   << ">(Parameter(";
+      if (i == 0 && has_context_parameter) {
+        source_out() << "Descriptor::kContext";
+      } else {
+        source_out() << "Descriptor::ParameterIndex<"
+                     << (has_context_parameter ? i - 1 : i) << ">()";
+      }
+      source_out() << "));\n";
       source_out() << "  USE(" << var << ");\n";
     }
   }
@@ -732,8 +731,17 @@ VisitResult ImplementationVisitor::Visit(LogicalAndExpression* expr) {
   VisitResult true_result;
   {
     StackScope true_block_scope(this);
+    VisitResult right_result = Visit(expr->right);
+    if (TryGetSourceForBitfieldExpression(expr->left) != nullptr &&
+        TryGetSourceForBitfieldExpression(expr->right) != nullptr &&
+        TryGetSourceForBitfieldExpression(expr->left)->value ==
+            TryGetSourceForBitfieldExpression(expr->right)->value) {
+      Lint(
+          "Please use & rather than && when checking multiple bitfield "
+          "values, to avoid complexity in generated code.");
+    }
     true_result = true_block_scope.Yield(
-        GenerateImplicitConvert(TypeOracle::GetBoolType(), Visit(expr->right)));
+        GenerateImplicitConvert(TypeOracle::GetBoolType(), right_result));
   }
   assembler().Goto(done_block);
 
@@ -778,16 +786,22 @@ VisitResult ImplementationVisitor::Visit(AssignmentExpression* expr) {
 }
 
 VisitResult ImplementationVisitor::Visit(NumberLiteralExpression* expr) {
-  int32_t i = static_cast<int32_t>(expr->number);
   const Type* result_type = TypeOracle::GetConstFloat64Type();
-  if (i == expr->number) {
-    if ((i >> 30) == (i >> 31)) {
-      result_type = TypeOracle::GetConstInt31Type();
-    } else {
-      result_type = TypeOracle::GetConstInt32Type();
+  if (expr->number >= std::numeric_limits<int32_t>::min() &&
+      expr->number <= std::numeric_limits<int32_t>::max()) {
+    int32_t i = static_cast<int32_t>(expr->number);
+    if (i == expr->number) {
+      if ((i >> 30) == (i >> 31)) {
+        result_type = TypeOracle::GetConstInt31Type();
+      } else {
+        result_type = TypeOracle::GetConstInt32Type();
+      }
     }
   }
-  return VisitResult{result_type, ToString(expr->number)};
+  std::stringstream str;
+  str << std::setprecision(std::numeric_limits<double>::digits10 + 1)
+      << expr->number;
+  return VisitResult{result_type, str.str()};
 }
 
 VisitResult ImplementationVisitor::Visit(AssumeTypeImpossibleExpression* expr) {
@@ -828,6 +842,17 @@ VisitResult ImplementationVisitor::Visit(LocationExpression* expr) {
   return scope.Yield(GenerateFetchFromLocation(GetLocationReference(expr)));
 }
 
+VisitResult ImplementationVisitor::Visit(FieldAccessExpression* expr) {
+  StackScope scope(this);
+  LocationReference location = GetLocationReference(expr);
+  if (location.IsBitFieldAccess()) {
+    if (auto* identifier = IdentifierExpression::DynamicCast(expr->object)) {
+      bitfield_expressions_[expr] = identifier->name;
+    }
+  }
+  return scope.Yield(GenerateFetchFromLocation(location));
+}
+
 const Type* ImplementationVisitor::Visit(GotoStatement* stmt) {
   Binding<LocalLabel>* label = LookupLabel(stmt->label->value);
   size_t parameter_count = label->parameter_types.size();
@@ -1192,30 +1217,6 @@ VisitResult ImplementationVisitor::Visit(StatementExpression* expr) {
   return VisitResult{Visit(expr->statement), assembler().TopRange(0)};
 }
 
-void ImplementationVisitor::CheckInitializersWellformed(
-    const std::string& aggregate_name,
-    const std::vector<Field>& aggregate_fields,
-    const std::vector<NameAndExpression>& initializers,
-    bool ignore_first_field) {
-  size_t fields_offset = ignore_first_field ? 1 : 0;
-  size_t fields_size = aggregate_fields.size() - fields_offset;
-  for (size_t i = 0; i < std::min(fields_size, initializers.size()); i++) {
-    const std::string& field_name =
-        aggregate_fields[i + fields_offset].name_and_type.name;
-    Identifier* found_name = initializers[i].name;
-    if (field_name != found_name->value) {
-      Error("Expected field name \"", field_name, "\" instead of \"",
-            found_name->value, "\"")
-          .Position(found_name->pos)
-          .Throw();
-    }
-  }
-  if (fields_size != initializers.size()) {
-    ReportError("expected ", fields_size, " initializers for ", aggregate_name,
-                " found ", initializers.size());
-  }
-}
-
 InitializerResults ImplementationVisitor::VisitInitializerResults(
     const ClassType* class_type,
     const std::vector<NameAndExpression>& initializers) {
@@ -1924,21 +1925,57 @@ VisitResult ImplementationVisitor::Visit(StructExpression* expr) {
   }
 
   // Compute and check struct type from given struct name and argument types
-  const StructType* struct_type = TypeVisitor::ComputeTypeForStructExpression(
+  const Type* type = TypeVisitor::ComputeTypeForStructExpression(
       expr->type, term_argument_types);
-  CheckInitializersWellformed(struct_type->name(), struct_type->fields(),
-                              initializers);
+  if (const auto* struct_type = StructType::DynamicCast(type)) {
+    CheckInitializersWellformed(struct_type->name(), struct_type->fields(),
+                                initializers);
 
-  // Implicitly convert values and thereby build the struct on the stack
-  StackRange struct_range = assembler().TopRange(0);
-  auto& fields = struct_type->fields();
-  for (size_t i = 0; i < values.size(); i++) {
-    values[i] =
-        GenerateImplicitConvert(fields[i].name_and_type.type, values[i]);
-    struct_range.Extend(values[i].stack_range());
+    // Implicitly convert values and thereby build the struct on the stack
+    StackRange struct_range = assembler().TopRange(0);
+    auto& fields = struct_type->fields();
+    for (size_t i = 0; i < values.size(); i++) {
+      values[i] =
+          GenerateImplicitConvert(fields[i].name_and_type.type, values[i]);
+      struct_range.Extend(values[i].stack_range());
+    }
+
+    return stack_scope.Yield(VisitResult(struct_type, struct_range));
+  } else {
+    const auto* bitfield_struct_type = BitFieldStructType::cast(type);
+    CheckInitializersWellformed(bitfield_struct_type->name(),
+                                bitfield_struct_type->fields(), initializers);
+
+    // Create a zero and cast it to the desired bitfield struct type.
+    VisitResult result{TypeOracle::GetConstInt32Type(), "0"};
+    result = GenerateImplicitConvert(TypeOracle::GetInt32Type(), result);
+    result = GenerateCall("Unsigned", Arguments{{result}, {}}, {});
+    result = GenerateCall("%RawDownCast", Arguments{{result}, {}},
+                          {bitfield_struct_type});
+
+    // Set each field in the result. If these fields are constexpr, then all of
+    // this initialization will end up reduced to a single value during TurboFan
+    // optimization.
+    auto& fields = bitfield_struct_type->fields();
+    for (size_t i = 0; i < values.size(); i++) {
+      values[i] =
+          GenerateImplicitConvert(fields[i].name_and_type.type, values[i]);
+      result = GenerateSetBitField(bitfield_struct_type, fields[i], result,
+                                   values[i], /*starts_as_zero=*/true);
+    }
+
+    return stack_scope.Yield(result);
   }
+}
 
-  return stack_scope.Yield(VisitResult(struct_type, struct_range));
+VisitResult ImplementationVisitor::GenerateSetBitField(
+    const Type* bitfield_struct_type, const BitField& bitfield,
+    VisitResult bitfield_struct, VisitResult value, bool starts_as_zero) {
+  GenerateCopy(bitfield_struct);
+  GenerateCopy(value);
+  assembler().Emit(
+      StoreBitFieldInstruction{bitfield_struct_type, bitfield, starts_as_zero});
+  return VisitResult(bitfield_struct_type, assembler().TopRange(1));
 }
 
 LocationReference ImplementationVisitor::GetLocationReference(
@@ -2002,6 +2039,20 @@ LocationReference ImplementationVisitor::GenerateFieldAccess(
     const BitField& field = bitfield_struct->LookupField(fieldname);
     return LocationReference::BitFieldAccess(reference, field);
   }
+  if (const auto type_wrapped_in_smi = Type::MatchUnaryGeneric(
+          reference.ReferencedType(), TypeOracle::GetSmiTaggedGeneric())) {
+    const BitFieldStructType* bitfield_struct =
+        BitFieldStructType::DynamicCast(*type_wrapped_in_smi);
+    if (bitfield_struct == nullptr) {
+      ReportError(
+          "When a value of type SmiTagged<T> is used in a field access "
+          "expression, T is expected to be a bitfield struct type. Instead, T "
+          "is ",
+          **type_wrapped_in_smi);
+    }
+    const BitField& field = bitfield_struct->LookupField(fieldname);
+    return LocationReference::BitFieldAccess(reference, field);
+  }
   if (reference.IsHeapReference()) {
     VisitResult ref = reference.heap_reference();
     bool is_const;
@@ -2190,9 +2241,8 @@ VisitResult ImplementationVisitor::GenerateFetchFromLocation(
     // First fetch the bitfield struct, then get the bits out of it.
     VisitResult bit_field_struct =
         GenerateFetchFromLocation(reference.bit_field_struct_location());
-    assembler().Emit(LoadBitFieldInstruction{
-        BitFieldStructType::cast(bit_field_struct.type()),
-        reference.bit_field()});
+    assembler().Emit(LoadBitFieldInstruction{bit_field_struct.type(),
+                                             reference.bit_field()});
     return VisitResult(reference.ReferencedType(), assembler().TopRange(1));
   } else {
     if (reference.IsHeapSlice()) {
@@ -2269,17 +2319,14 @@ void ImplementationVisitor::GenerateAssignToLocation(
         GenerateFetchFromLocation(reference.bit_field_struct_location());
     VisitResult converted_value =
         GenerateImplicitConvert(reference.ReferencedType(), assignment_value);
-    GenerateCopy(bit_field_struct);
-    GenerateCopy(converted_value);
-    assembler().Emit(StoreBitFieldInstruction{
-        BitFieldStructType::cast(bit_field_struct.type()),
-        reference.bit_field()});
-    GenerateAssignToLocation(
-        reference.bit_field_struct_location(),
-        VisitResult(bit_field_struct.type(), assembler().TopRange(1)));
+    VisitResult updated_bit_field_struct =
+        GenerateSetBitField(bit_field_struct.type(), reference.bit_field(),
+                            bit_field_struct, converted_value);
+    GenerateAssignToLocation(reference.bit_field_struct_location(),
+                             updated_bit_field_struct);
   } else {
     DCHECK(reference.IsTemporary());
-    ReportError("cannot assign to temporary ",
+    ReportError("cannot assign to const-bound or temporary ",
                 reference.temporary_description());
   }
 }
@@ -2655,6 +2702,16 @@ VisitResult ImplementationVisitor::Visit(CallExpression* expr,
       LanguageServerData::AddDefinition(expr->callee->name->pos,
                                         callable->IdentifierPosition());
     }
+    if (expr->callee->name->value == "!" && arguments.parameters.size() == 1) {
+      PropagateBitfieldMark(expr->arguments[0], expr);
+    }
+    if (expr->callee->name->value == "==" && arguments.parameters.size() == 2) {
+      if (arguments.parameters[0].type()->IsConstexpr()) {
+        PropagateBitfieldMark(expr->arguments[1], expr);
+      } else if (arguments.parameters[1].type()->IsConstexpr()) {
+        PropagateBitfieldMark(expr->arguments[0], expr);
+      }
+    }
     return scope.Yield(
         GenerateCall(name, arguments, specialization_types, is_tailcall));
   }
@@ -2669,7 +2726,7 @@ VisitResult ImplementationVisitor::Visit(CallMethodExpression* expr) {
   LocationReference target = GetLocationReference(expr->target);
   if (!target.IsVariableAccess()) {
     VisitResult result = GenerateFetchFromLocation(target);
-    target = LocationReference::Temporary(result, "method target result");
+    target = LocationReference::Temporary(result, "this parameter");
   }
   const AggregateType* target_type =
       AggregateType::DynamicCast(target.ReferencedType());
@@ -2958,13 +3015,15 @@ void ImplementationVisitor::GenerateBuiltinDefinitionsAndInterfaceDescriptors(
         builtin_definitions << "TFC(" << builtin->ExternalName() << ", "
                             << builtin->ExternalName();
         std::string descriptor_name = builtin->ExternalName() + "Descriptor";
-        constexpr size_t kFirstNonContextParameter = 1;
+        bool has_context_parameter = builtin->signature().HasContextParameter();
+        size_t kFirstNonContextParameter = has_context_parameter ? 1 : 0;
         size_t parameter_count =
             builtin->parameter_names().size() - kFirstNonContextParameter;
 
-        interface_descriptors << "class " << descriptor_name
-                              << " : public TorqueInterfaceDescriptor<"
-                              << parameter_count << "> {\n";
+        interface_descriptors
+            << "class " << descriptor_name
+            << " : public TorqueInterfaceDescriptor<" << parameter_count << ", "
+            << (has_context_parameter ? "true" : "false") << "> {\n";
         interface_descriptors << "  DECLARE_DESCRIPTOR_WITH_BASE("
                               << descriptor_name
                               << ", TorqueInterfaceDescriptor)\n";
@@ -3112,10 +3171,10 @@ class FieldOffsetsGenerator {
 
     // In the presence of indexed fields, we already emitted kHeaderSize before
     // the indexed field.
-    if (!type_->IsShape() && !type_->HasIndexedField()) {
+    if (!type_->IsShape() && !header_size_emitted_) {
       WriteMarker("kHeaderSize");
     }
-    if (type_->HasStaticSize()) {
+    if (!type_->IsAbstract() && type_->HasStaticSize()) {
       WriteMarker("kSize");
     }
   }
@@ -3247,12 +3306,28 @@ void ImplementationVisitor::GenerateClassFieldOffsets(
       }
     }
 
-    header << "#define TORQUE_BODY_DESCRIPTOR_LIST_GENERATOR(V, _)\\\n";
+    header << "#define TORQUE_INSTANCE_TYPE_TO_BODY_DESCRIPTOR_LIST(V)\\\n";
     for (const ClassType* type : TypeOracle::GetClasses()) {
-      if (type->ShouldGenerateBodyDescriptor()) {
+      if (type->ShouldGenerateBodyDescriptor() && type->OwnInstanceType()) {
         std::string type_name =
             CapifyStringWithUnderscores(type->name()) + "_TYPE";
-        header << "V(_, " << type_name << ", " << type->name() << ")\\\n";
+        header << "V(" << type_name << "," << type->name() << ")\\\n";
+      }
+    }
+    header << "\n";
+
+    header << "#define TORQUE_DATA_ONLY_VISITOR_ID_LIST(V)\\\n";
+    for (const ClassType* type : TypeOracle::GetClasses()) {
+      if (type->ShouldGenerateBodyDescriptor() && type->HasNoPointerSlots()) {
+        header << "V(" << type->name() << ")\\\n";
+      }
+    }
+    header << "\n";
+
+    header << "#define TORQUE_POINTER_VISITOR_ID_LIST(V)\\\n";
+    for (const ClassType* type : TypeOracle::GetClasses()) {
+      if (type->ShouldGenerateBodyDescriptor() && !type->HasNoPointerSlots()) {
+        header << "V(" << type->name() << ")\\\n";
       }
     }
     header << "\n";
@@ -3296,6 +3371,7 @@ void ImplementationVisitor::GenerateBitFields(
                  << " = 1 << " << field.offset << ", \\\n";
         }
         header << "  }; \\\n";
+        header << "  using Flags = base::Flags<Flag>; \\\n";
       }
 
       header << "\n";
@@ -3356,7 +3432,7 @@ class CppClassGenerator {
   void GenerateFieldAccessor(const Field& f);
   void GenerateFieldAccessorForUntagged(const Field& f);
   void GenerateFieldAccessorForSmi(const Field& f);
-  void GenerateFieldAccessorForObject(const Field& f);
+  void GenerateFieldAccessorForTagged(const Field& f);
 
   void GenerateClassCasts();
 
@@ -3473,26 +3549,18 @@ void CppClassGenerator::GenerateClass() {
         hdr_ << "    size += " << index_name_and_type.name << " * "
              << field_size << ";\n";
       }
+      if (type_->size().Alignment() < TargetArchitecture::TaggedSize()) {
+        hdr_ << "    size = OBJECT_POINTER_ALIGN(size);\n";
+      }
     }
     hdr_ << "    return size;\n";
     hdr_ << "  }\n\n";
-    hdr_ << "  V8_INLINE static constexpr int32_t SizeFor(D o) {\n";
+    hdr_ << "  V8_INLINE int32_t AllocatedSize() {\n";
     hdr_ << "    return SizeFor(";
     first = true;
     for (auto field : *index_fields) {
       if (!first) hdr_ << ", ";
-      // Subclasses of FixedArrayBase need to use the synchronized length
-      // accessor to be consistent (theoretically, FixedArrayBase classes
-      // can concurrently change size e.g. through left-trimming, although
-      // in practice this won't happen for Torque-generated classes) as well as
-      // explicitly convert to a Smi, since the C++-side accessors are
-      // int-based.
-      if (field.aggregate == TypeOracle::GetFixedArrayBaseType() &&
-          field.name_and_type.name == "length") {
-        hdr_ << "o.synchronized_length()";
-      } else {
-        hdr_ << "o." << field.name_and_type.name << "()";
-      }
+      hdr_ << "this->" << field.name_and_type.name << "()";
       first = false;
     }
     hdr_ << ");\n  }\n";
@@ -3532,13 +3600,72 @@ void CppClassGenerator::GenerateClassConstructors() {
 
   hdr_ << "protected:\n";
   hdr_ << "  inline explicit " << gen_name_ << "(Address ptr);\n";
+  hdr_ << "  // Special-purpose constructor for subclasses that have fast "
+          "paths where\n";
+  hdr_ << "  // their ptr() is a Smi.\n";
+  hdr_ << "  inline explicit " << gen_name_
+       << "(Address ptr, HeapObject::AllowInlineSmiStorage allow_smi);\n";
 
   inl_ << "template<class D, class P>\n";
   inl_ << "inline " << gen_name_T_ << "::" << gen_name_ << "(Address ptr)\n";
   inl_ << "  : P(ptr) {\n";
   inl_ << "  SLOW_DCHECK(this->Is" << name_ << "());\n";
   inl_ << "}\n";
+
+  inl_ << "template<class D, class P>\n";
+  inl_ << "inline " << gen_name_T_ << "::" << gen_name_
+       << "(Address ptr, HeapObject::AllowInlineSmiStorage allow_smi)\n";
+  inl_ << "  : P(ptr, allow_smi) {\n";
+  inl_ << "  SLOW_DCHECK((allow_smi == "
+          "HeapObject::AllowInlineSmiStorage::kAllowBeingASmi && "
+       << "this->IsSmi()) || this->Is" << name_ << "());\n";
+  inl_ << "}\n";
+}
+
+namespace {
+std::string GenerateRuntimeTypeCheck(const Type* type,
+                                     const std::string& value) {
+  bool maybe_object = !type->IsSubtypeOf(TypeOracle::GetStrongTaggedType());
+  std::stringstream type_check;
+  bool at_start = true;
+  // If weak pointers are allowed, then start by checking for a cleared value.
+  if (maybe_object) {
+    type_check << value << ".IsCleared()";
+    at_start = false;
+  }
+  for (const RuntimeType& runtime_type : type->GetRuntimeTypes()) {
+    if (!at_start) type_check << " || ";
+    at_start = false;
+    if (maybe_object) {
+      bool strong = runtime_type.weak_ref_to.empty();
+      if (strong && runtime_type.type == "MaybeObject") {
+        // Rather than a generic Weak<T>, this is a basic type Tagged or
+        // WeakHeapObject. We can't validate anything more about the type of
+        // the object pointed to, so just check that it's weak.
+        type_check << value << ".IsWeak()";
+      } else {
+        type_check << "(" << (strong ? "!" : "") << value << ".IsWeak() && "
+                   << value << ".GetHeapObjectOrSmi().Is"
+                   << (strong ? runtime_type.type : runtime_type.weak_ref_to)
+                   << "())";
+      }
+    } else {
+      type_check << value << ".Is" << runtime_type.type << "()";
+    }
+  }
+  return type_check.str();
+}
+
+void GenerateBoundsDCheck(std::ostream& os, const std::string& index,
+                          const ClassType* type, const Field& f) {
+  os << "  DCHECK_GE(" << index << ", 0);\n";
+  if (base::Optional<NameAndType> array_length =
+          ExtractSimpleFieldArraySize(*type, *f.index)) {
+    os << "  DCHECK_LT(" << index << ", this->" << array_length->name
+       << "());\n";
+  }
 }
+}  // namespace
 
 // TODO(sigurds): Keep in sync with DECL_ACCESSORS and ACCESSORS macro.
 void CppClassGenerator::GenerateFieldAccessor(const Field& f) {
@@ -3548,14 +3675,19 @@ void CppClassGenerator::GenerateFieldAccessor(const Field& f) {
   // TODO(danno): Support generation of struct accessors
   if (f.name_and_type.type->IsStructType()) return;
 
+  // TODO(v8:10391) Generate accessors for external pointers
+  if (f.name_and_type.type->IsSubtypeOf(TypeOracle::GetExternalPointerType())) {
+    return;
+  }
+
   if (!f.name_and_type.type->IsSubtypeOf(TypeOracle::GetTaggedType())) {
     return GenerateFieldAccessorForUntagged(f);
   }
   if (f.name_and_type.type->IsSubtypeOf(TypeOracle::GetSmiType())) {
     return GenerateFieldAccessorForSmi(f);
   }
-  if (f.name_and_type.type->IsSubtypeOf(TypeOracle::GetObjectType())) {
-    return GenerateFieldAccessorForObject(f);
+  if (f.name_and_type.type->IsSubtypeOf(TypeOracle::GetTaggedType())) {
+    return GenerateFieldAccessorForTagged(f);
   }
 
   Error("Generation of field accessor for ", type_->name(),
@@ -3599,6 +3731,7 @@ void CppClassGenerator::GenerateFieldAccessorForUntagged(const Field& f) {
   }
   inl_ << ") const {\n";
   if (f.index) {
+    GenerateBoundsDCheck(inl_, "i", type_, f);
     size_t field_size;
     std::string size_string;
     std::tie(field_size, size_string) = f.GetFieldSizeInformation();
@@ -3617,6 +3750,7 @@ void CppClassGenerator::GenerateFieldAccessorForUntagged(const Field& f) {
   }
   inl_ << type << " value) {\n";
   if (f.index) {
+    GenerateBoundsDCheck(inl_, "i", type_, f);
     size_t field_size;
     std::string size_string;
     std::tie(field_size, size_string) = f.GetFieldSizeInformation();
@@ -3653,6 +3787,7 @@ void CppClassGenerator::GenerateFieldAccessorForSmi(const Field& f) {
   }
   inl_ << ") const {\n";
   if (f.index) {
+    GenerateBoundsDCheck(inl_, "i", type_, f);
     inl_ << "  int offset = " << offset << " + i * kTaggedSize;\n";
     inl_ << "  return this->template ReadField<Smi>(offset).value();\n";
     inl_ << "}\n";
@@ -3669,6 +3804,7 @@ void CppClassGenerator::GenerateFieldAccessorForSmi(const Field& f) {
   }
   inl_ << type << " value) {\n";
   if (f.index) {
+    GenerateBoundsDCheck(inl_, "i", type_, f);
     inl_ << "  int offset = " << offset << " + i * kTaggedSize;\n";
     inl_ << "  WRITE_FIELD(*this, offset, Smi::FromInt(value));\n";
   } else {
@@ -3677,18 +3813,16 @@ void CppClassGenerator::GenerateFieldAccessorForSmi(const Field& f) {
   inl_ << "}\n\n";
 }
 
-void CppClassGenerator::GenerateFieldAccessorForObject(const Field& f) {
+void CppClassGenerator::GenerateFieldAccessorForTagged(const Field& f) {
   const Type* field_type = f.name_and_type.type;
-  DCHECK(field_type->IsSubtypeOf(TypeOracle::GetObjectType()));
+  DCHECK(field_type->IsSubtypeOf(TypeOracle::GetTaggedType()));
   const std::string& name = f.name_and_type.name;
-  const std::string offset = "k" + CamelifyString(name) + "Offset";
-  base::Optional<const ClassType*> class_type = field_type->ClassSupertype();
-
-  std::string type =
-      class_type ? (*class_type)->GetGeneratedTNodeTypeName() : "Object";
+  std::string offset = "k" + CamelifyString(name) + "Offset";
+  bool strong_pointer = field_type->IsSubtypeOf(TypeOracle::GetObjectType());
 
+  std::string type = field_type->GetRuntimeType();
   // Generate declarations in header.
-  if (!class_type && field_type != TypeOracle::GetObjectType()) {
+  if (!field_type->IsClassType() && field_type != TypeOracle::GetObjectType()) {
     hdr_ << "  // Torque type: " << field_type->ToString() << "\n";
   }
 
@@ -3699,11 +3833,7 @@ void CppClassGenerator::GenerateFieldAccessorForObject(const Field& f) {
   hdr_ << "  inline void set_" << name << "(" << (f.index ? "int i, " : "")
        << type << " value, WriteBarrierMode mode = UPDATE_WRITE_BARRIER);\n\n";
 
-  std::string type_check;
-  for (const RuntimeType& runtime_type : field_type->GetRuntimeTypes()) {
-    if (!type_check.empty()) type_check += " || ";
-    type_check += "value.Is" + runtime_type.type + "()";
-  }
+  std::string type_check = GenerateRuntimeTypeCheck(field_type, "value");
 
   // Generate implementation in inline header.
   inl_ << "template <class D, class P>\n";
@@ -3719,28 +3849,25 @@ void CppClassGenerator::GenerateFieldAccessorForObject(const Field& f) {
        << "(const Isolate* isolate" << (f.index ? ", int i" : "")
        << ") const {\n";
 
-  if (class_type) {
-    if (f.index) {
-      inl_ << "  int offset = " << offset << " + i * kTaggedSize;\n";
-      inl_ << "  return " << type
-           << "::cast(RELAXED_READ_FIELD(*this, offset));\n";
-    } else {
-      inl_ << "  return TaggedField<" << type << ", " << offset
-           << ">::load(isolate, *this);\n";
-    }
+  // TODO(tebbi): The distinction between relaxed and non-relaxed accesses here
+  // is pretty arbitrary and just tries to preserve what was there before.
+  // It currently doesn't really make a difference due to concurrent marking
+  // turning all loads and stores to be relaxed. We should probably drop the
+  // distinction at some point, even though in principle non-relaxed operations
+  // would give us TSAN protection.
+  if (f.index) {
+    GenerateBoundsDCheck(inl_, "i", type_, f);
+    inl_ << "  int offset = " << offset << " + i * kTaggedSize;\n";
+    inl_ << "  auto value = TaggedField<" << type
+         << ">::Relaxed_Load(isolate, *this, offset);\n";
   } else {
-    // TODO(tebbi): load value as HeapObject when possible
-    if (f.index) {
-      inl_ << "  int offset = " << offset << " + i * kTaggedSize;\n";
-      inl_ << "  Object value = Object::cast(RELAXED_READ_FIELD(*this, "
-              "offset));\n";
-    } else {
-      inl_ << "  Object value = TaggedField<Object, " << offset
-           << ">::load(isolate, *this);\n";
-    }
+    inl_ << "  auto value = TaggedField<" << type << ", " << offset
+         << ">::load(isolate, *this);\n";
+  }
+  if (!type_check.empty()) {
     inl_ << "  DCHECK(" << type_check << ");\n";
-    inl_ << "  return value;\n";
   }
+  inl_ << "  return value;\n";
   inl_ << "}\n";
 
   inl_ << "template <class D, class P>\n";
@@ -3749,30 +3876,37 @@ void CppClassGenerator::GenerateFieldAccessorForObject(const Field& f) {
     inl_ << "int i, ";
   }
   inl_ << type << " value, WriteBarrierMode mode) {\n";
-  inl_ << "  SLOW_DCHECK(" << type_check << ");\n";
+  if (!type_check.empty()) {
+    inl_ << "  SLOW_DCHECK(" << type_check << ");\n";
+  }
   if (f.index) {
+    GenerateBoundsDCheck(inl_, "i", type_, f);
+    const char* write_macro =
+        strong_pointer ? "WRITE_FIELD" : "RELAXED_WRITE_WEAK_FIELD";
     inl_ << "  int offset = " << offset << " + i * kTaggedSize;\n";
-    inl_ << "  WRITE_FIELD(*this, offset, value);\n";
+    offset = "offset";
+    inl_ << "  " << write_macro << "(*this, offset, value);\n";
   } else {
-    inl_ << "  WRITE_FIELD(*this, " << offset << ", value);\n";
+    const char* write_macro =
+        strong_pointer ? "RELAXED_WRITE_FIELD" : "RELAXED_WRITE_WEAK_FIELD";
+    inl_ << "  " << write_macro << "(*this, " << offset << ", value);\n";
   }
-  inl_ << "  CONDITIONAL_WRITE_BARRIER(*this, " << offset
-       << ", value, mode);\n";
+  const char* write_barrier = strong_pointer ? "CONDITIONAL_WRITE_BARRIER"
+                                             : "CONDITIONAL_WEAK_WRITE_BARRIER";
+  inl_ << "  " << write_barrier << "(*this, " << offset << ", value, mode);\n";
   inl_ << "}\n\n";
 }
 
 void EmitClassDefinitionHeadersIncludes(const std::string& basename,
                                         std::stringstream& header,
                                         std::stringstream& inline_header) {
-  header << "#include \"src/objects/fixed-array.h\"\n";
   header << "#include \"src/objects/objects.h\"\n";
+  header << "#include \"src/objects/heap-object.h\"\n";
   header << "#include \"src/objects/smi.h\"\n";
   header << "#include \"torque-generated/field-offsets-tq.h\"\n";
   header << "#include <type_traits>\n\n";
 
   inline_header << "#include \"torque-generated/class-definitions-tq.h\"\n";
-  inline_header << "#include "
-                   "\"torque-generated/objects-body-descriptors-tq-inl.h\"\n\n";
   inline_header << "#include \"src/objects/js-promise.h\"\n";
   inline_header << "#include \"src/objects/js-weak-refs.h\"\n";
   inline_header << "#include \"src/objects/module.h\"\n";
@@ -3811,14 +3945,19 @@ void ImplementationVisitor::GenerateClassDefinitions(
   std::stringstream inline_external_header;
   std::stringstream internal_header;
   std::stringstream inline_internal_header;
+  std::stringstream exported_header;
+  std::stringstream inline_exported_header;
   std::stringstream implementation;
   std::stringstream factory_header;
   std::stringstream factory_impl;
   std::string basename = "class-definitions-tq";
   std::string internal_basename = "internal-" + basename;
+  std::string exported_basename = "exported-" + basename;
   std::string file_basename = output_directory + "/" + basename;
   std::string internal_file_basename =
       output_directory + "/" + internal_basename;
+  std::string exported_file_basename =
+      output_directory + "/" + exported_basename;
   std::string factory_basename = "factory-tq";
   std::string factory_file_basename = output_directory + "/" + factory_basename;
 
@@ -3834,8 +3973,24 @@ void ImplementationVisitor::GenerateClassDefinitions(
     IncludeGuardScope internal_inline_header_guard(
         inline_internal_header, internal_basename + "-inl.h");
 
-    external_header
+    IncludeGuardScope exported_header_guard(exported_header,
+                                            exported_basename + ".h");
+
+    IncludeGuardScope exported_inline_header_guard(
+        inline_exported_header, exported_basename + "-inl.h");
+
+    internal_header << "#include \"torque-generated/class-definitions-tq.h\"\n";
+    internal_header << "#include \"src/objects/fixed-array.h\"\n";
+    inline_internal_header
         << "#include \"torque-generated/internal-class-definitions-tq.h\"\n";
+    inline_internal_header
+        << "#include \"torque-generated/class-definitions-tq-inl.h\"\n";
+
+    exported_header << "#include \"src/objects/fixed-array.h\"\n";
+    exported_header << "#include \"torque-generated/class-definitions-tq.h\"\n";
+    inline_exported_header
+        << "#include \"torque-generated/exported-class-definitions-tq.h\"\n";
+    inline_exported_header << "#include \"src/objects/fixed-array-inl.h\"\n";
 
     EmitClassDefinitionHeadersIncludes(basename, external_header,
                                        inline_external_header);
@@ -3850,6 +4005,10 @@ void ImplementationVisitor::GenerateClassDefinitions(
     IncludeObjectMacrosScope internal_inline_header_macros(
         inline_internal_header);
 
+    IncludeObjectMacrosScope exported_header_macros(exported_header);
+    IncludeObjectMacrosScope exported_inline_header_macros(
+        inline_exported_header);
+
     NamespaceScope header_namespaces(external_header, {"v8", "internal"});
     NamespaceScope inline_header_namespaces(inline_external_header,
                                             {"v8", "internal"});
@@ -3857,6 +4016,10 @@ void ImplementationVisitor::GenerateClassDefinitions(
                                               {"v8", "internal"});
     NamespaceScope internal_inline_header_namespaces(inline_internal_header,
                                                      {"v8", "internal"});
+    NamespaceScope exported_header_namespaces(exported_header,
+                                              {"v8", "internal"});
+    NamespaceScope exported_inline_header_namespaces(inline_exported_header,
+                                                     {"v8", "internal"});
 
     EmitClassDefinitionHeadersForwardDeclarations(external_header);
     EmitClassDefinitionHeadersForwardDeclarations(internal_header);
@@ -3869,44 +4032,37 @@ void ImplementationVisitor::GenerateClassDefinitions(
     factory_impl
         << "#include "
            "\"torque-generated/internal-class-definitions-tq-inl.h\"\n\n";
+    factory_impl
+        << "#include "
+           "\"torque-generated/exported-class-definitions-tq-inl.h\"\n\n";
     NamespaceScope factory_impl_namespaces(factory_impl, {"v8", "internal"});
     factory_impl << "\n";
 
     implementation
         << "#include \"torque-generated/class-definitions-tq.h\"\n\n";
     implementation << "#include \"torque-generated/class-verifiers-tq.h\"\n\n";
-    implementation << "#include \"src/objects/arguments-inl.h\"\n";
-    implementation << "#include \"src/objects/js-collection-inl.h\"\n";
-    implementation << "#include \"src/objects/embedder-data-array-inl.h\"\n";
-    implementation << "#include \"src/objects/js-generator-inl.h\"\n";
-    implementation << "#include \"src/objects/js-regexp-inl.h\"\n";
-    implementation << "#include \"src/objects/js-weak-refs-inl.h\"\n";
-    implementation
-        << "#include \"src/objects/js-regexp-string-iterator-inl.h\"\n";
-    implementation << "#include \"src/objects/literal-objects-inl.h\"\n";
-    implementation << "#include \"src/objects/microtask-inl.h\"\n";
-    implementation << "#include \"src/objects/module-inl.h\"\n";
-    implementation << "#include \"src/objects/promise-inl.h\"\n";
     implementation
-        << "#include \"src/objects/property-descriptor-object-inl.h\"\n";
-    implementation << "#include \"src/objects/stack-frame-info-inl.h\"\n";
-    implementation << "#include \"src/objects/struct-inl.h\"\n";
-    implementation << "#include \"src/objects/template-objects-inl.h\"\n\n";
+        << "#include \"src/objects/class-definitions-tq-deps-inl.h\"\n\n";
     implementation
         << "#include "
            "\"torque-generated/internal-class-definitions-tq-inl.h\"\n\n";
+    implementation
+        << "#include "
+           "\"torque-generated/exported-class-definitions-tq-inl.h\"\n\n";
     NamespaceScope implementation_namespaces(implementation,
                                              {"v8", "internal"});
 
     std::set<const StructType*, TypeLess> structs_used_in_classes;
 
     for (const ClassType* type : TypeOracle::GetClasses()) {
-      std::stringstream& header = (type->IsExtern() || type->ShouldExport())
-                                      ? external_header
-                                      : internal_header;
+      std::stringstream& header =
+          type->IsExtern()
+              ? external_header
+              : type->ShouldExport() ? exported_header : internal_header;
       std::stringstream& inline_header =
-          (type->IsExtern() || type->ShouldExport()) ? inline_external_header
-                                                     : inline_internal_header;
+          type->IsExtern() ? inline_external_header
+                           : type->ShouldExport() ? inline_exported_header
+                                                  : inline_internal_header;
 
       if (type->GenerateCppClassDefinitions()) {
         CppClassGenerator g(type, header, inline_header, implementation);
@@ -4002,6 +4158,8 @@ void ImplementationVisitor::GenerateClassDefinitions(
   WriteFile(file_basename + ".cc", implementation.str());
   WriteFile(internal_file_basename + ".h", internal_header.str());
   WriteFile(internal_file_basename + "-inl.h", inline_internal_header.str());
+  WriteFile(exported_file_basename + ".h", exported_header.str());
+  WriteFile(exported_file_basename + "-inl.h", inline_exported_header.str());
   WriteFile(factory_file_basename + ".inc", factory_header.str());
   WriteFile(factory_file_basename + ".cc", factory_impl.str());
 }
@@ -4053,6 +4211,8 @@ void ImplementationVisitor::GeneratePrintDefinitions(
     impl << "#include <iosfwd>\n\n";
     impl << "#include "
             "\"torque-generated/internal-class-definitions-tq-inl.h\"\n";
+    impl << "#include "
+            "\"torque-generated/exported-class-definitions-tq-inl.h\"\n";
     impl << "#include \"src/objects/struct-inl.h\"\n\n";
     impl << "#include \"src/objects/template-objects-inl.h\"\n\n";
 
@@ -4080,140 +4240,174 @@ void ImplementationVisitor::GeneratePrintDefinitions(
   WriteFile(output_directory + "/" + file_name, new_contents);
 }
 
+base::Optional<std::string> MatchSimpleBodyDescriptor(const ClassType* type) {
+  std::vector<ObjectSlotKind> slots = type->ComputeHeaderSlotKinds();
+  if (!type->HasStaticSize()) {
+    slots.push_back(*type->ComputeArraySlotKind());
+  }
+
+  // Skip the map slot.
+  size_t i = 1;
+  while (i < slots.size() && slots[i] == ObjectSlotKind::kNoPointer) ++i;
+  if (i == slots.size()) return "DataOnlyBodyDescriptor";
+  bool has_weak_pointers = false;
+  size_t start_index = i;
+  for (; i < slots.size(); ++i) {
+    if (slots[i] == ObjectSlotKind::kStrongPointer) {
+      continue;
+    } else if (slots[i] == ObjectSlotKind::kMaybeObjectPointer) {
+      has_weak_pointers = true;
+    } else if (slots[i] == ObjectSlotKind::kNoPointer) {
+      break;
+    } else {
+      return base::nullopt;
+    }
+  }
+  size_t end_index = i;
+  for (; i < slots.size(); ++i) {
+    if (slots[i] != ObjectSlotKind::kNoPointer) return base::nullopt;
+  }
+  size_t start_offset = start_index * TargetArchitecture::TaggedSize();
+  size_t end_offset = end_index * TargetArchitecture::TaggedSize();
+  // We pick a suffix-range body descriptor even in cases where the object size
+  // is fixed, to reduce the amount of code executed for object visitation.
+  if (end_index == slots.size()) {
+    return ToString("SuffixRange", has_weak_pointers ? "Weak" : "",
+                    "BodyDescriptor<", start_offset, ">");
+  }
+  if (!has_weak_pointers) {
+    return ToString("FixedRangeDescriptor<", start_offset, ", ", end_offset,
+                    ", ", *type->size().SingleValue(), ">");
+  }
+  return base::nullopt;
+}
+
 void ImplementationVisitor::GenerateBodyDescriptors(
     const std::string& output_directory) {
-  std::string file_name = "objects-body-descriptors-tq-inl";
+  std::string file_name = "objects-body-descriptors-tq-inl.inc";
   std::stringstream h_contents;
-  {
-    IncludeGuardScope include_guard(h_contents, file_name + ".h");
-
-    h_contents << "\n#include \"src/objects/objects-body-descriptors.h\"\n";
-    h_contents << "\n#include \"torque-generated/class-definitions-tq.h\"\n";
-    h_contents
-        << "\n#include \"torque-generated/internal-class-definitions-tq.h\"\n";
-    h_contents << "\n#include "
-                  "\"torque-generated/internal-class-definitions-tq-inl.h\"\n";
-
-    NamespaceScope h_namespaces(h_contents, {"v8", "internal"});
 
     for (const ClassType* type : TypeOracle::GetClasses()) {
       std::string name = type->name();
       if (!type->ShouldGenerateBodyDescriptor()) continue;
 
-      const ClassType* super_class = type->GetSuperClass();
-      std::string super_name = super_class->name();
-      h_contents << "class " << name
-                 << "::BodyDescriptor final : public BodyDescriptorBase {\n";
-
-      h_contents << " public:\n";
-
-      h_contents << "  static bool IsValidSlot(Map map, HeapObject obj, int "
-                    "offset) {\n";
-
-      if (super_class == TypeOracle::GetHeapObjectType() ||
-          super_class == TypeOracle::GetFixedArrayBaseType()) {
-        h_contents << "    if (offset < " << super_name
-                   << "::kHeaderSize) return true;\n";
+      bool has_array_fields = !type->HasStaticSize();
+      std::vector<ObjectSlotKind> header_slot_kinds =
+          type->ComputeHeaderSlotKinds();
+      base::Optional<ObjectSlotKind> array_slot_kind =
+          type->ComputeArraySlotKind();
+      DCHECK_EQ(has_array_fields, array_slot_kind.has_value());
+
+      h_contents << "class " << name << "::BodyDescriptor final : public ";
+      if (auto descriptor_name = MatchSimpleBodyDescriptor(type)) {
+        h_contents << *descriptor_name << " {\n";
+        h_contents << " public:\n";
       } else {
-        h_contents << "    if (" << super_name
-                   << "::BodyDescriptor::IsValidSlot(map, obj, offset)) return "
-                      "true;\n";
-      }
+        h_contents << "BodyDescriptorBase {\n";
+        h_contents << " public:\n";
 
-      h_contents << "    return offset >= " << name
-                 << "::kStartOfStrongFieldsOffset"
-                 << " && offset < " << name << ""
-                 << "::kEndOfStrongFieldsOffset;\n";
-      h_contents << "  }\n\n";
-
-      h_contents << "  template <typename ObjectVisitor>\n";
-      h_contents << "  static inline void IterateBody(Map map, HeapObject obj, "
-                    "int object_size, ObjectVisitor* v) {\n";
-
-      // There may be MaybeObjects embedded in the strong pointer section, which
-      // are not suppored.
-      for (auto& f : type->fields()) {
-        for (const Type* t : LowerType(f.name_and_type.type)) {
-          if (t->IsSubtypeOf(TypeOracle::GetTaggedType()) &&
-              !t->IsSubtypeOf(TypeOracle::GetObjectType())) {
-            Error("Cannot generate body descriptor for field ",
-                  f.name_and_type.name, " of class ", name, " because ", *t,
-                  " can contain tagged weak pointers.");
-          }
+        h_contents << "  static bool IsValidSlot(Map map, HeapObject obj, int "
+                      "offset) {\n";
+        if (has_array_fields) {
+          h_contents << "    if (offset < kHeaderSize) {\n";
         }
-      }
+        h_contents << "      bool valid_slots[] = {";
+        for (ObjectSlotKind slot : header_slot_kinds) {
+          h_contents << (slot != ObjectSlotKind::kNoPointer ? "1" : "0") << ",";
+        }
+        h_contents << "};\n"
+                   << "      return valid_slots[static_cast<unsigned "
+                      "int>(offset)/kTaggedSize];\n";
+        if (has_array_fields) {
+          h_contents << "    }\n";
+          bool array_is_tagged = *array_slot_kind != ObjectSlotKind::kNoPointer;
+          h_contents << "    return " << (array_is_tagged ? "true" : "false")
+                     << ";\n";
+        }
+        h_contents << "  }\n\n";
 
-      if (super_class != TypeOracle::GetHeapObjectType() &&
-          super_class != TypeOracle::GetFixedArrayBaseType()) {
+        h_contents << "  template <typename ObjectVisitor>\n";
         h_contents
-            << "    " << super_name
-            << "::BodyDescriptor::IterateBody(map, obj, object_size, v);\n";
-      }
-
-      h_contents << "    if (" << name
-                 << "::kStartOfStrongFieldsOffset != " << name
-                 << "::kEndOfStrongFieldsOffset) {\n";
-      h_contents << "      IteratePointers(obj, " << name
-                 << "::kStartOfStrongFieldsOffset, " << name
-                 << "::kEndOfStrongFieldsOffset, v);\n";
-      h_contents << "    }\n";
-
-      h_contents << "    if (" << name
-                 << "::kStartOfWeakFieldsOffset != " << name
-                 << "::kEndOfWeakFieldsOffset) {\n";
-      h_contents << "      IterateCustomWeakPointers(obj, " << name
-                 << "::kStartOfWeakFieldsOffset, " << name
-                 << "::kEndOfWeakFieldsOffset, v);\n";
-      h_contents << "    }\n";
-
-      // Since all of the index fields are at the end of the object and must
-      // only be Tagged values, emit only a single IteratePointers from the
-      // beginning of the first indexed field to the end of the object.
-      bool first_index_seen = false;
-      for (const Field& field : type->ComputeAllFields()) {
-        if (field.index && !first_index_seen) {
-          std::string indexed_field_name =
-              CamelifyString(field.name_and_type.name);
-          if (field.name_and_type.type->IsSubtypeOf(
-                  TypeOracle::GetObjectType())) {
-            h_contents << "    BodyDescriptorBase::IteratePointers(obj, "
-                       << name << "::k" << indexed_field_name << "Offset, "
-                       << name << "::SizeFor(" << name << "::cast(obj)), v);\n";
+            << "  static inline void IterateBody(Map map, HeapObject obj, "
+               "int object_size, ObjectVisitor* v) {\n";
+
+        std::vector<ObjectSlotKind> slots = std::move(header_slot_kinds);
+        if (has_array_fields) slots.push_back(*array_slot_kind);
+
+        // Skip the map slot.
+        slots.erase(slots.begin());
+        size_t start_offset = TargetArchitecture::TaggedSize();
+
+        size_t end_offset = start_offset;
+        ObjectSlotKind section_kind;
+        for (size_t i = 0; i <= slots.size(); ++i) {
+          base::Optional<ObjectSlotKind> next_section_kind;
+          bool finished_section = false;
+          if (i == 0) {
+            next_section_kind = slots[i];
+          } else if (i < slots.size()) {
+            if (auto combined = Combine(section_kind, slots[i])) {
+              next_section_kind = *combined;
+            } else {
+              next_section_kind = slots[i];
+              finished_section = true;
+            }
           } else {
-            Error(
-                "generating body descriptors for indexed fields not subtype of "
-                "Object isn't (yet) supported");
+            finished_section = true;
           }
-          first_index_seen = true;
-        }
-        if (first_index_seen) {
-          for (const Type* t : LowerType(field.name_and_type.type)) {
-            if (!t->IsSubtypeOf(TypeOracle::GetObjectType())) {
-              Error("cannot generate class body descriptor for \"",
-                    type->name(),
-                    "\", all fields of including and after the first indexed "
-                    "member must no comprised only of subtypes of Object "
-                    "(field \"",
-                    field.name_and_type.name, "\" is not)");
+          if (finished_section) {
+            bool is_array_slot = i == slots.size() && has_array_fields;
+            bool multiple_slots =
+                is_array_slot ||
+                (end_offset - start_offset > TargetArchitecture::TaggedSize());
+            base::Optional<std::string> iterate_command;
+            switch (section_kind) {
+              case ObjectSlotKind::kStrongPointer:
+                iterate_command = "IteratePointer";
+                break;
+              case ObjectSlotKind::kMaybeObjectPointer:
+                iterate_command = "IterateMaybeWeakPointer";
+                break;
+              case ObjectSlotKind::kCustomWeakPointer:
+                iterate_command = "IterateCustomWeakPointer";
+                break;
+              case ObjectSlotKind::kNoPointer:
+                break;
+            }
+            if (iterate_command) {
+              if (multiple_slots) *iterate_command += "s";
+              h_contents << "    " << *iterate_command << "(obj, "
+                         << start_offset;
+              if (multiple_slots) {
+                h_contents << ", "
+                           << (i == slots.size() ? "object_size"
+                                                 : std::to_string(end_offset));
+              }
+              h_contents << ", v);\n";
             }
+            start_offset = end_offset;
           }
+          if (i < slots.size()) section_kind = *next_section_kind;
+          end_offset += TargetArchitecture::TaggedSize();
         }
-      }
 
-      h_contents << "  }\n\n";
+        h_contents << "  }\n\n";
+      }
 
       h_contents
           << "  static inline int SizeOf(Map map, HeapObject raw_object) {\n";
-      h_contents << "    " << name << " object = " << name
-                 << "::cast(raw_object);\n";
-      h_contents << "    return " << name << "::SizeFor(object);\n";
+      if (type->size().SingleValue()) {
+        h_contents << "    return " << *type->size().SingleValue() << ";\n";
+      } else {
+        h_contents << "    return " << name
+                   << "::cast(raw_object).AllocatedSize();\n";
+      }
       h_contents << "  }\n\n";
 
       h_contents << "};\n";
     }
-  }
 
-  WriteFile(output_directory + "/" + file_name + ".h", h_contents.str());
+    WriteFile(output_directory + "/" + file_name, h_contents.str());
 }
 
 namespace {
@@ -4242,9 +4436,8 @@ void GenerateFieldValueVerifier(const std::string& class_name,
 
   // Read the field.
   cc_contents << "    " << object_type << " " << value << " = TaggedField<"
-              << object_type << ", " << class_name << "::k"
-              << CamelifyString(class_field.name_and_type.name)
-              << "Offset>::load(o, " << index_offset << ");\n";
+              << object_type << ", " << *class_field.offset << ">::load(o, "
+              << index_offset << ");\n";
 
   // Call VerifyPointer or VerifyMaybeObjectPointer on it.
   cc_contents << "    " << object_type << "::" << verify_fn << "(isolate, "
@@ -4254,34 +4447,8 @@ void GenerateFieldValueVerifier(const std::string& class_name,
   // the Object type because it would not check anything beyond what we already
   // checked with VerifyPointer.
   if (field_type != TypeOracle::GetObjectType()) {
-    std::stringstream type_check;
-    bool at_start = true;
-    // If weak pointers are allowed, then start by checking for a cleared value.
-    if (maybe_object) {
-      type_check << value << ".IsCleared()";
-      at_start = false;
-    }
-    for (const RuntimeType& runtime_type : field_type->GetRuntimeTypes()) {
-      if (!at_start) type_check << " || ";
-      at_start = false;
-      if (maybe_object) {
-        bool strong = runtime_type.weak_ref_to.empty();
-        if (strong && runtime_type.type == "MaybeObject") {
-          // Rather than a generic Weak<T>, this is a basic type Tagged or
-          // WeakHeapObject. We can't validate anything more about the type of
-          // the object pointed to, so just check that it's weak.
-          type_check << value << ".IsWeak()";
-        } else {
-          type_check << "(" << (strong ? "!" : "") << value << ".IsWeak() && "
-                     << value << ".GetHeapObjectOrSmi().Is"
-                     << (strong ? runtime_type.type : runtime_type.weak_ref_to)
-                     << "())";
-        }
-      } else {
-        type_check << value << ".Is" << runtime_type.type << "()";
-      }
-    }
-    cc_contents << "    CHECK(" << type_check.str() << ");\n";
+    cc_contents << "    CHECK(" << GenerateRuntimeTypeCheck(field_type, value)
+                << ");\n";
   }
 }
 
@@ -4369,6 +4536,8 @@ void ImplementationVisitor::GenerateClassVerifiers(
     cc_contents << "#include \"torque-generated/" << file_name << ".h\"\n";
     cc_contents << "#include "
                    "\"torque-generated/internal-class-definitions-tq-inl.h\"\n";
+    cc_contents << "#include "
+                   "\"torque-generated/exported-class-definitions-tq-inl.h\"\n";
 
     IncludeObjectMacrosScope object_macros(cc_contents);
 
@@ -4384,7 +4553,7 @@ void ImplementationVisitor::GenerateClassVerifiers(
 
     const char* verifier_class = "TorqueGeneratedClassVerifiers";
 
-    h_contents << "class " << verifier_class << "{\n";
+    h_contents << "class V8_EXPORT_PRIVATE " << verifier_class << "{\n";
     h_contents << " public:\n";
 
     for (const ClassType* type : TypeOracle::GetClasses()) {
@@ -4481,6 +4650,9 @@ void ImplementationVisitor::GenerateExportedMacrosAssembler(
     h_contents << "#include \"torque-generated/csa-types-tq.h\"\n";
     h_contents
         << "#include \"torque-generated/internal-class-definitions-tq.h\"\n";
+    h_contents
+        << "#include \"torque-generated/exported-class-definitions-tq.h\"\n";
+    cc_contents << "#include \"src/objects/fixed-array-inl.h\"\n";
     cc_contents << "#include \"src/objects/free-space.h\"\n";
     cc_contents << "#include \"src/objects/js-regexp-string-iterator.h\"\n";
     cc_contents << "#include \"src/objects/ordered-hash-table.h\"\n";
diff --git a/deps/v8/src/torque/implementation-visitor.h b/deps/v8/src/torque/implementation-visitor.h
index 0cd58aa9223..476864fb517 100644
--- a/deps/v8/src/torque/implementation-visitor.h
+++ b/deps/v8/src/torque/implementation-visitor.h
@@ -432,11 +432,29 @@ class ImplementationVisitor {
   VisitResult Visit(Expression* expr);
   const Type* Visit(Statement* stmt);
 
+  template <typename T>
   void CheckInitializersWellformed(
-      const std::string& aggregate_name,
-      const std::vector<Field>& aggregate_fields,
+      const std::string& aggregate_name, const std::vector<T>& aggregate_fields,
       const std::vector<NameAndExpression>& initializers,
-      bool ignore_first_field = false);
+      bool ignore_first_field = false) {
+    size_t fields_offset = ignore_first_field ? 1 : 0;
+    size_t fields_size = aggregate_fields.size() - fields_offset;
+    for (size_t i = 0; i < std::min(fields_size, initializers.size()); i++) {
+      const std::string& field_name =
+          aggregate_fields[i + fields_offset].name_and_type.name;
+      Identifier* found_name = initializers[i].name;
+      if (field_name != found_name->value) {
+        Error("Expected field name \"", field_name, "\" instead of \"",
+              found_name->value, "\"")
+            .Position(found_name->pos)
+            .Throw();
+      }
+    }
+    if (fields_size != initializers.size()) {
+      ReportError("expected ", fields_size, " initializers for ",
+                  aggregate_name, " found ", initializers.size());
+    }
+  }
 
   InitializerResults VisitInitializerResults(
       const ClassType* class_type,
@@ -480,6 +498,7 @@ class ImplementationVisitor {
   VisitResult GetBuiltinCode(Builtin* builtin);
 
   VisitResult Visit(LocationExpression* expr);
+  VisitResult Visit(FieldAccessExpression* expr);
 
   void VisitAllDeclarables();
   void Visit(Declarable* delarable);
@@ -713,6 +732,12 @@ class ImplementationVisitor {
   StackRange GenerateLabelGoto(LocalLabel* label,
                                base::Optional<StackRange> arguments = {});
 
+  VisitResult GenerateSetBitField(const Type* bitfield_struct_type,
+                                  const BitField& bitfield,
+                                  VisitResult bitfield_struct,
+                                  VisitResult value,
+                                  bool starts_as_zero = false);
+
   std::vector<Binding<LocalLabel>*> LabelsFromIdentifiers(
       const std::vector<Identifier*>& names);
 
@@ -759,9 +784,32 @@ class ImplementationVisitor {
     ReplaceFileContentsIfDifferent(file, content);
   }
 
+  const Identifier* TryGetSourceForBitfieldExpression(
+      const Expression* expr) const {
+    auto it = bitfield_expressions_.find(expr);
+    if (it == bitfield_expressions_.end()) return nullptr;
+    return it->second;
+  }
+
+  void PropagateBitfieldMark(const Expression* original,
+                             const Expression* derived) {
+    if (const Identifier* source =
+            TryGetSourceForBitfieldExpression(original)) {
+      bitfield_expressions_[derived] = source;
+    }
+  }
+
   base::Optional<CfgAssembler> assembler_;
   NullOStream null_stream_;
   bool is_dry_run_;
+
+  // Just for allowing us to emit warnings. After visiting an Expression, if
+  // that Expression is a bitfield load, plus an optional inversion or an
+  // equality check with a constant, then that Expression will be present in
+  // this map. The Identifier associated is the bitfield struct that contains
+  // the value to load.
+  std::unordered_map<const Expression*, const Identifier*>
+      bitfield_expressions_;
 };
 
 void ReportAllUnusedMacros();
diff --git a/deps/v8/src/torque/instance-type-generator.cc b/deps/v8/src/torque/instance-type-generator.cc
index a06c9846293..6e708f7fea6 100644
--- a/deps/v8/src/torque/instance-type-generator.cc
+++ b/deps/v8/src/torque/instance-type-generator.cc
@@ -256,6 +256,9 @@ int SolveInstanceTypeConstraints(
     root->start = root->value;
   }
   root->num_values = root->end - root->start + 1;
+  root->type->InitializeInstanceTypes(
+      root->value == -1 ? base::Optional<int>{} : root->value,
+      std::make_pair(root->start, root->end));
 
   if (root->num_values > 0) {
     destination->push_back(std::move(root));
@@ -433,46 +436,60 @@ void ImplementationVisitor::GenerateInstanceTypes(
     header << only_declared_range_instance_types.str();
     header << "\n";
 
-    header << "// Instance types for non-extern Torque classes.\n";
-    header << "#define TORQUE_INSTANCE_TYPES(V) \\\n";
+    std::stringstream torque_internal_class_list;
+    std::stringstream torque_internal_varsize_instance_type_list;
+    std::stringstream torque_internal_fixed_instance_type_list;
+    std::stringstream torque_internal_map_csa_list;
+    std::stringstream torque_internal_map_root_list;
+
     for (const ClassType* type : TypeOracle::GetClasses()) {
-      if (type->IsExtern()) continue;
-      std::string type_name =
+      std::string upper_case_name = type->name();
+      std::string lower_case_name = SnakeifyString(type->name());
+      std::string instance_type_name =
           CapifyStringWithUnderscores(type->name()) + "_TYPE";
-      header << "  V(" << type_name << ") \\\n";
-    }
-    header << "\n";
 
-    header << "// Map list macros for non-extern Torque classes.\n";
-    header << "#define TORQUE_INTERNAL_VARSIZE_CLASS_LIST_GENERATOR(V, _) \\\n";
-    for (const ClassType* type : TypeOracle::GetClasses()) {
       if (type->IsExtern()) continue;
-      if (!type->HasIndexedField()) continue;
-      std::string type_name =
-          CapifyStringWithUnderscores(type->name()) + "_TYPE";
-      std::string variable_name = SnakeifyString(type->name());
-      header << "  V(_, " << type_name << ", " << type->name() << ", "
-             << variable_name << ") \\\n";
+      torque_internal_class_list << "  V(" << upper_case_name << ") \\\n";
+
+      if (type->IsAbstract()) continue;
+      torque_internal_map_csa_list << "  V(" << upper_case_name << "Map, "
+                                   << lower_case_name << "_map, "
+                                   << upper_case_name << "Map) \\\n";
+      torque_internal_map_root_list << "  V(Map, " << lower_case_name
+                                    << "_map, " << upper_case_name
+                                    << "Map) \\\n";
+      std::stringstream& list =
+          type->HasStaticSize() ? torque_internal_fixed_instance_type_list
+                                : torque_internal_varsize_instance_type_list;
+      list << "  V(" << instance_type_name << ", " << upper_case_name << ", "
+           << lower_case_name << ") \\\n";
     }
+
+    header << "// Non-extern Torque classes.\n";
+    header << "#define TORQUE_INTERNAL_CLASS_LIST(V) \\\n";
+    header << torque_internal_class_list.str();
     header << "\n";
-    header << "#define TORQUE_INTERNAL_FIXED_CLASS_LIST_GENERATOR(V, _) \\\n";
-    for (const ClassType* type : TypeOracle::GetClasses()) {
-      if (type->IsExtern()) continue;
-      if (type->HasIndexedField()) continue;
-      std::string type_name =
-          CapifyStringWithUnderscores(type->name()) + "_TYPE";
-      std::string variable_name = SnakeifyString(type->name());
-      header << "  V(_, " << type_name << ", " << type->name() << ", "
-             << variable_name << ") \\\n";
-    }
+    header << "#define TORQUE_INTERNAL_VARSIZE_INSTANCE_TYPE_LIST(V) \\\n";
+    header << torque_internal_varsize_instance_type_list.str();
+    header << "\n";
+    header << "#define TORQUE_INTERNAL_FIXED_INSTANCE_TYPE_LIST(V) \\\n";
+    header << torque_internal_fixed_instance_type_list.str();
     header << "\n";
-    header << "#define TORQUE_INTERNAL_CLASS_LIST_GENERATOR(V, _) \\\n";
-    header << "  TORQUE_INTERNAL_VARSIZE_CLASS_LIST_GENERATOR(V, _) \\\n";
-    header << "  TORQUE_INTERNAL_FIXED_CLASS_LIST_GENERATOR(V, _)\n";
+    header << "#define TORQUE_INTERNAL_INSTANCE_TYPE_LIST(V) \\\n";
+    header << "  TORQUE_INTERNAL_VARSIZE_INSTANCE_TYPE_LIST(V) \\\n";
+    header << "  TORQUE_INTERNAL_FIXED_INSTANCE_TYPE_LIST(V) \\\n";
+    header << "\n";
+    header << "#define TORQUE_INTERNAL_MAP_CSA_LIST(V) \\\n";
+    header << torque_internal_map_csa_list.str();
+    header << "\n";
+    header << "#define TORQUE_INTERNAL_MAP_ROOT_LIST(V) \\\n";
+    header << torque_internal_map_root_list.str();
     header << "\n";
   }
   std::string output_header_path = output_directory + "/" + file_name;
   WriteFile(output_header_path, header.str());
+
+  GlobalContext::SetInstanceTypesInitialized();
 }
 
 }  // namespace torque
diff --git a/deps/v8/src/torque/instructions.h b/deps/v8/src/torque/instructions.h
index 2d5eff71da7..4609e8c223e 100644
--- a/deps/v8/src/torque/instructions.h
+++ b/deps/v8/src/torque/instructions.h
@@ -349,14 +349,13 @@ struct StoreReferenceInstruction : InstructionBase {
 // Pops a bitfield struct; pushes a bitfield value extracted from it.
 struct LoadBitFieldInstruction : InstructionBase {
   TORQUE_INSTRUCTION_BOILERPLATE()
-  LoadBitFieldInstruction(const BitFieldStructType* bit_field_struct_type,
-                          BitField bit_field)
+  LoadBitFieldInstruction(const Type* bit_field_struct_type, BitField bit_field)
       : bit_field_struct_type(bit_field_struct_type),
         bit_field(std::move(bit_field)) {}
 
   DefinitionLocation GetValueDefinition() const;
 
-  const BitFieldStructType* bit_field_struct_type;
+  const Type* bit_field_struct_type;
   BitField bit_field;
 };
 
@@ -364,15 +363,18 @@ struct LoadBitFieldInstruction : InstructionBase {
 // containing the updated value.
 struct StoreBitFieldInstruction : InstructionBase {
   TORQUE_INSTRUCTION_BOILERPLATE()
-  StoreBitFieldInstruction(const BitFieldStructType* bit_field_struct_type,
-                           BitField bit_field)
+  StoreBitFieldInstruction(const Type* bit_field_struct_type,
+                           BitField bit_field, bool starts_as_zero)
       : bit_field_struct_type(bit_field_struct_type),
-        bit_field(std::move(bit_field)) {}
+        bit_field(std::move(bit_field)),
+        starts_as_zero(starts_as_zero) {}
 
   DefinitionLocation GetValueDefinition() const;
 
-  const BitFieldStructType* bit_field_struct_type;
+  const Type* bit_field_struct_type;
   BitField bit_field;
+  // Allows skipping the mask step if we know the starting value is zero.
+  bool starts_as_zero;
 };
 
 struct CallIntrinsicInstruction : InstructionBase {
diff --git a/deps/v8/src/torque/ls/message.h b/deps/v8/src/torque/ls/message.h
index 0d84d2ffafd..513a1e0d43a 100644
--- a/deps/v8/src/torque/ls/message.h
+++ b/deps/v8/src/torque/ls/message.h
@@ -82,8 +82,8 @@ class Message : public BaseJsonAccessor {
   JSON_STRING_ACCESSORS(jsonrpc)
 
  protected:
-  const JsonObject& object() const { return value_.ToObject(); }
-  JsonObject& object() { return value_.ToObject(); }
+  const JsonObject& object() const override { return value_.ToObject(); }
+  JsonObject& object() override { return value_.ToObject(); }
 
  private:
   JsonValue value_;
@@ -96,8 +96,8 @@ class NestedJsonAccessor : public BaseJsonAccessor {
  public:
   explicit NestedJsonAccessor(JsonObject& object) : object_(object) {}
 
-  const JsonObject& object() const { return object_; }
-  JsonObject& object() { return object_; }
+  const JsonObject& object() const override { return object_; }
+  JsonObject& object() override { return object_; }
 
  private:
   JsonObject& object_;
diff --git a/deps/v8/src/torque/torque-compiler.cc b/deps/v8/src/torque/torque-compiler.cc
index ad7d906d544..20bc2973547 100644
--- a/deps/v8/src/torque/torque-compiler.cc
+++ b/deps/v8/src/torque/torque-compiler.cc
@@ -55,6 +55,7 @@ void CompileCurrentAst(TorqueCompilerOptions options) {
   }
   TargetArchitecture::Scope target_architecture(options.force_32bit_output);
   TypeOracle::Scope type_oracle;
+  CurrentScope::Scope current_namespace(GlobalContext::GetDefaultNamespace());
 
   // Two-step process of predeclaration + resolution allows to resolve type
   // declarations independent of the order they are given.
@@ -73,6 +74,7 @@ void CompileCurrentAst(TorqueCompilerOptions options) {
   ImplementationVisitor implementation_visitor;
   implementation_visitor.SetDryRun(output_directory.length() == 0);
 
+  implementation_visitor.GenerateInstanceTypes(output_directory);
   implementation_visitor.BeginCSAFiles();
 
   implementation_visitor.VisitAllDeclarables();
@@ -91,7 +93,6 @@ void CompileCurrentAst(TorqueCompilerOptions options) {
   implementation_visitor.GenerateBodyDescriptors(output_directory);
   implementation_visitor.GenerateExportedMacrosAssembler(output_directory);
   implementation_visitor.GenerateCSATypes(output_directory);
-  implementation_visitor.GenerateInstanceTypes(output_directory);
 
   implementation_visitor.EndCSAFiles();
   implementation_visitor.GenerateImplementation(output_directory);
diff --git a/deps/v8/src/torque/torque-parser.cc b/deps/v8/src/torque/torque-parser.cc
index e63827db2cd..c184842dccb 100644
--- a/deps/v8/src/torque/torque-parser.cc
+++ b/deps/v8/src/torque/torque-parser.cc
@@ -86,12 +86,8 @@ V8_EXPORT_PRIVATE const ParseResultTypeId
     ParseResultHolder<base::Optional<TypeExpression*>>::id =
         ParseResultTypeId::kOptionalTypeExpressionPtr;
 template <>
-V8_EXPORT_PRIVATE const ParseResultTypeId ParseResultHolder<LabelBlock*>::id =
-    ParseResultTypeId::kLabelBlockPtr;
-template <>
-V8_EXPORT_PRIVATE const ParseResultTypeId
-    ParseResultHolder<base::Optional<LabelBlock*>>::id =
-        ParseResultTypeId::kOptionalLabelBlockPtr;
+V8_EXPORT_PRIVATE const ParseResultTypeId ParseResultHolder<TryHandler*>::id =
+    ParseResultTypeId::kTryHandlerPtr;
 template <>
 V8_EXPORT_PRIVATE const ParseResultTypeId ParseResultHolder<Expression*>::id =
     ParseResultTypeId::kExpressionPtr;
@@ -215,8 +211,8 @@ V8_EXPORT_PRIVATE const ParseResultTypeId
         ParseResultTypeId::kStdVectorOfLabelAndTypes;
 template <>
 V8_EXPORT_PRIVATE const ParseResultTypeId
-    ParseResultHolder<std::vector<LabelBlock*>>::id =
-        ParseResultTypeId::kStdVectorOfLabelBlockPtr;
+    ParseResultHolder<std::vector<TryHandler*>>::id =
+        ParseResultTypeId::kStdVectorOfTryHandlerPtr;
 template <>
 V8_EXPORT_PRIVATE const ParseResultTypeId
     ParseResultHolder<base::Optional<Statement*>>::id =
@@ -321,7 +317,7 @@ Expression* MakeCall(IdentifierExpression* callee,
   // used as labels identifiers. All other statements in a call's otherwise
   // must create intermediate Labels for the otherwise's statement code.
   size_t label_id = 0;
-  std::vector<LabelBlock*> temp_labels;
+  std::vector<TryHandler*> temp_labels;
   for (auto* statement : otherwise) {
     if (auto* e = ExpressionStatement::DynamicCast(statement)) {
       if (auto* id = IdentifierExpression::DynamicCast(e->expression)) {
@@ -336,9 +332,10 @@ Expression* MakeCall(IdentifierExpression* callee,
     auto label_id = MakeNode<Identifier>(label_name);
     label_id->pos = SourcePosition::Invalid();
     labels.push_back(label_id);
-    auto* label_block =
-        MakeNode<LabelBlock>(label_id, ParameterList::Empty(), statement);
-    temp_labels.push_back(label_block);
+    auto* handler =
+        MakeNode<TryHandler>(TryHandler::HandlerKind::kLabel, label_id,
+                             ParameterList::Empty(), statement);
+    temp_labels.push_back(handler);
   }
 
   // Create nested try-label expression for all of the temporary Labels that
@@ -351,7 +348,7 @@ Expression* MakeCall(IdentifierExpression* callee,
   }
 
   for (auto* label : temp_labels) {
-    result = MakeNode<TryLabelExpression>(false, result, label);
+    result = MakeNode<TryLabelExpression>(result, label);
   }
   return result;
 }
@@ -906,8 +903,8 @@ base::Optional<ParseResult> MakeClassDeclaration(
   if (!IsValidTypeName(name->value)) {
     NamingConventionError("Type", name, "UpperCamelCase");
   }
-  auto extends = child_results->NextAs<base::Optional<TypeExpression*>>();
-  if (extends && !BasicTypeExpression::DynamicCast(*extends)) {
+  auto extends = child_results->NextAs<TypeExpression*>();
+  if (!BasicTypeExpression::DynamicCast(extends)) {
     ReportError("Expected type name in extends clause.");
   }
   auto generates = child_results->NextAs<base::Optional<std::string>>();
@@ -1410,8 +1407,9 @@ base::Optional<ParseResult> MakeTypeswitchStatement(
       BlockStatement* next_block = MakeNode<BlockStatement>();
       current_block->statements.push_back(
           MakeNode<ExpressionStatement>(MakeNode<TryLabelExpression>(
-              false, MakeNode<StatementExpression>(case_block),
-              MakeNode<LabelBlock>(MakeNode<Identifier>(kNextCaseLabelName),
+              MakeNode<StatementExpression>(case_block),
+              MakeNode<TryHandler>(TryHandler::HandlerKind::kLabel,
+                                   MakeNode<Identifier>(kNextCaseLabelName),
                                    ParameterList::Empty(), next_block))));
       current_block = next_block;
     }
@@ -1512,15 +1510,21 @@ base::Optional<ParseResult> MakeTryLabelExpression(
   auto try_block = child_results->NextAs<Statement*>();
   CheckNotDeferredStatement(try_block);
   Statement* result = try_block;
-  auto label_blocks = child_results->NextAs<std::vector<LabelBlock*>>();
-  auto catch_block = child_results->NextAs<base::Optional<LabelBlock*>>();
-  for (auto block : label_blocks) {
-    result = MakeNode<ExpressionStatement>(MakeNode<TryLabelExpression>(
-        false, MakeNode<StatementExpression>(result), block));
-  }
-  if (catch_block) {
+  auto handlers = child_results->NextAs<std::vector<TryHandler*>>();
+  if (handlers.empty()) {
+    Error("Try blocks without catch or label don't make sense.");
+  }
+  for (size_t i = 0; i < handlers.size(); ++i) {
+    if (i != 0 &&
+        handlers[i]->handler_kind == TryHandler::HandlerKind::kCatch) {
+      Error(
+          "A catch handler always has to be first, before any label handler, "
+          "to avoid ambiguity about whether it catches exceptions from "
+          "preceding handlers or not.")
+          .Position(handlers[i]->pos);
+    }
     result = MakeNode<ExpressionStatement>(MakeNode<TryLabelExpression>(
-        true, MakeNode<StatementExpression>(result), *catch_block));
+        MakeNode<StatementExpression>(result), handlers[i]));
   }
   return ParseResult{result};
 }
@@ -1546,7 +1550,8 @@ base::Optional<ParseResult> MakeLabelBlock(ParseResultIterator* child_results) {
   }
   auto parameters = child_results->NextAs<ParameterList>();
   auto body = child_results->NextAs<Statement*>();
-  LabelBlock* result = MakeNode<LabelBlock>(label, std::move(parameters), body);
+  TryHandler* result = MakeNode<TryHandler>(TryHandler::HandlerKind::kLabel,
+                                            label, std::move(parameters), body);
   return ParseResult{result};
 }
 
@@ -1561,8 +1566,9 @@ base::Optional<ParseResult> MakeCatchBlock(ParseResultIterator* child_results) {
   parameters.types.push_back(MakeNode<BasicTypeExpression>(
       std::vector<std::string>{}, "JSAny", std::vector<TypeExpression*>{}));
   parameters.has_varargs = false;
-  LabelBlock* result = MakeNode<LabelBlock>(
-      MakeNode<Identifier>(kCatchLabelName), std::move(parameters), body);
+  TryHandler* result = MakeNode<TryHandler>(
+      TryHandler::HandlerKind::kCatch, MakeNode<Identifier>(kCatchLabelName),
+      std::move(parameters), body);
   return ParseResult{result};
 }
 
@@ -1596,6 +1602,17 @@ base::Optional<ParseResult> MakeRightShiftIdentifier(
   return ParseResult{MakeNode<Identifier>(str)};
 }
 
+base::Optional<ParseResult> MakeNamespaceQualification(
+    ParseResultIterator* child_results) {
+  bool global_namespace = child_results->NextAs<bool>();
+  auto namespace_qualification =
+      child_results->NextAs<std::vector<std::string>>();
+  if (global_namespace) {
+    namespace_qualification.insert(namespace_qualification.begin(), "");
+  }
+  return ParseResult(std::move(namespace_qualification));
+}
+
 base::Optional<ParseResult> MakeIdentifierExpression(
     ParseResultIterator* child_results) {
   auto namespace_qualification =
@@ -1831,6 +1848,10 @@ struct TorqueGrammar : Grammar {
         }
         continue;
       }
+      if (MatchString("/*", pos)) {
+        while (!MatchString("*/", pos)) ++*pos;
+        continue;
+      }
       return true;
     }
   }
@@ -1972,14 +1993,19 @@ struct TorqueGrammar : Grammar {
   // Result: std::vector<Annotation>
   Symbol* annotations = List<Annotation>(&annotation);
 
+  // Result: std::vector<std::string>
+  Symbol namespaceQualification = {
+      Rule({CheckIf(Token("::")),
+            List<std::string>(Sequence({&identifier, Token("::")}))},
+           MakeNamespaceQualification)};
+
   // Result: TypeList
   Symbol* typeList = List<TypeExpression*>(&type, Token(","));
 
   // Result: TypeExpression*
   Symbol simpleType = {
       Rule({Token("("), &type, Token(")")}),
-      Rule({List<std::string>(Sequence({&identifier, Token("::")})),
-            CheckIf(Token("constexpr")), &identifier,
+      Rule({&namespaceQualification, CheckIf(Token("constexpr")), &identifier,
             TryOrDefault<std::vector<TypeExpression*>>(
                 &genericSpecializationTypeList)},
            MakeBasicTypeExpression),
@@ -2113,7 +2139,7 @@ struct TorqueGrammar : Grammar {
 
   // Result: Expression*
   Symbol identifierExpression = {
-      Rule({List<std::string>(Sequence({&identifier, Token("::")})), &name,
+      Rule({&namespaceQualification, &name,
             TryOrDefault<TypeList>(&genericSpecializationTypeList)},
            MakeIdentifierExpression),
   };
@@ -2247,13 +2273,11 @@ struct TorqueGrammar : Grammar {
                         List<Statement*>(&statement), Token("}")},
                        MakeBlockStatement)};
 
-  // Result: LabelBlock*
-  Symbol labelBlock = {
+  // Result: TryHandler*
+  Symbol tryHandler = {
       Rule({Token("label"), &name,
             TryOrDefault<ParameterList>(&parameterListNoVararg), &block},
-           MakeLabelBlock)};
-
-  Symbol catchBlock = {
+           MakeLabelBlock),
       Rule({Token("catch"), Token("("), &identifier, Token(")"), &block},
            MakeCatchBlock)};
 
@@ -2299,13 +2323,16 @@ struct TorqueGrammar : Grammar {
            MakeIfStatement),
       Rule(
           {
-              Token("typeswitch"), Token("("), expression, Token(")"),
-              Token("{"), NonemptyList<TypeswitchCase>(&typeswitchCase),
+              Token("typeswitch"),
+              Token("("),
+              expression,
+              Token(")"),
+              Token("{"),
+              NonemptyList<TypeswitchCase>(&typeswitchCase),
               Token("}"),
           },
           MakeTypeswitchStatement),
-      Rule({Token("try"), &block, List<LabelBlock*>(&labelBlock),
-            Optional<LabelBlock*>(&catchBlock)},
+      Rule({Token("try"), &block, List<TryHandler*>(&tryHandler)},
            MakeTryLabelExpression),
       Rule({OneOf({"assert", "check"}), Token("("), &expressionWithSource,
             Token(")"), Token(";")},
@@ -2354,8 +2381,7 @@ struct TorqueGrammar : Grammar {
             &externalString, Token(";")},
            AsSingletonVector<Declaration*, MakeExternConstDeclaration>()),
       Rule({annotations, CheckIf(Token("extern")), CheckIf(Token("transient")),
-            OneOf({"class", "shape"}), &name,
-            Optional<TypeExpression*>(Sequence({Token("extends"), &type})),
+            OneOf({"class", "shape"}), &name, Token("extends"), &type,
             Optional<std::string>(
                 Sequence({Token("generates"), &externalString})),
             &optionalClassBody},
@@ -2426,21 +2452,17 @@ struct TorqueGrammar : Grammar {
                 Sequence({Token("constexpr"), &externalString})),
             Token("{"), NonemptyList<Identifier*>(&name, Token(",")),
             CheckIf(Sequence({Token(","), Token("...")})), Token("}")},
-           MakeEnumDeclaration)};
+           MakeEnumDeclaration),
+      Rule({Token("namespace"), &identifier, Token("{"), &declarationList,
+            Token("}")},
+           AsSingletonVector<Declaration*, MakeNamespaceDeclaration>())};
 
   // Result: std::vector<Declaration*>
   Symbol declarationList = {
       Rule({List<std::vector<Declaration*>>(&declaration)}, ConcatList)};
 
-  // Result: std::vector<Declaration*>
-  Symbol namespaceDeclaration = {
-      Rule({Token("namespace"), &identifier, Token("{"), &declarationList,
-            Token("}")},
-           AsSingletonVector<Declaration*, MakeNamespaceDeclaration>())};
-
   Symbol file = {Rule({&file, Token("import"), &externalString},
                       ProcessTorqueImportDeclaration),
-                 Rule({&file, &namespaceDeclaration}, AddGlobalDeclarations),
                  Rule({&file, &declaration}, AddGlobalDeclarations), Rule({})};
 };
 
diff --git a/deps/v8/src/torque/type-oracle.h b/deps/v8/src/torque/type-oracle.h
index 114bf043b5b..c6939efa538 100644
--- a/deps/v8/src/torque/type-oracle.h
+++ b/deps/v8/src/torque/type-oracle.h
@@ -182,6 +182,10 @@ class TypeOracle : public ContextualClass<TypeOracle> {
     return Get().GetBuiltinType(RAWPTR_TYPE_STRING);
   }
 
+  static const Type* GetExternalPointerType() {
+    return Get().GetBuiltinType(EXTERNALPTR_TYPE_STRING);
+  }
+
   static const Type* GetMapType() {
     return Get().GetBuiltinType(MAP_TYPE_STRING);
   }
@@ -300,6 +304,10 @@ class TypeOracle : public ContextualClass<TypeOracle> {
     return Get().GetBuiltinType(CONTEXT_TYPE_STRING);
   }
 
+  static const Type* GetNoContextType() {
+    return Get().GetBuiltinType(NO_CONTEXT_TYPE_STRING);
+  }
+
   static const Type* GetNativeContextType() {
     return Get().GetBuiltinType(NATIVE_CONTEXT_TYPE_STRING);
   }
diff --git a/deps/v8/src/torque/type-visitor.cc b/deps/v8/src/torque/type-visitor.cc
index 10ed87d2478..5b61baf3a83 100644
--- a/deps/v8/src/torque/type-visitor.cc
+++ b/deps/v8/src/torque/type-visitor.cc
@@ -247,7 +247,7 @@ const ClassType* TypeVisitor::ComputeType(
   ClassFlags flags = decl->flags;
   bool is_shape = flags & ClassFlag::kIsShape;
   std::string generates = decl->name->value;
-  const Type* super_type = TypeVisitor::ComputeType(*decl->super);
+  const Type* super_type = TypeVisitor::ComputeType(decl->super);
   if (is_shape) {
     if (!(flags & ClassFlag::kExtern)) {
       ReportError("Shapes must be extern, add \"extern\" to the declaration.");
@@ -266,9 +266,6 @@ const ClassType* TypeVisitor::ComputeType(
     // support for type-checks on the C++ side.
     generates = super_class->name();
   }
-  if (!decl->super) {
-    ReportError("Extern class must extend another type.");
-  }
   if (super_type != TypeOracle::GetStrongTaggedType()) {
     const ClassType* super_class = ClassType::DynamicCast(super_type);
     if (!super_class) {
@@ -455,7 +452,7 @@ void TypeVisitor::VisitStructMethods(
   DeclareMethods(struct_type, struct_declaration->methods);
 }
 
-const StructType* TypeVisitor::ComputeTypeForStructExpression(
+const Type* TypeVisitor::ComputeTypeForStructExpression(
     TypeExpression* type_expression,
     const std::vector<const Type*>& term_argument_types) {
   auto* basic = BasicTypeExpression::DynamicCast(type_expression);
@@ -475,11 +472,11 @@ const StructType* TypeVisitor::ComputeTypeForStructExpression(
   // Compute types of non-generic structs as usual
   if (!(maybe_generic_type && decl)) {
     const Type* type = ComputeType(type_expression);
-    const StructType* struct_type = StructType::DynamicCast(type);
-    if (!struct_type) {
-      ReportError(*type, " is not a struct, but used like one");
+    if (!type->IsStructType() && !type->IsBitFieldStructType()) {
+      ReportError(*type,
+                  " is not a struct or bitfield struct, but used like one");
     }
-    return struct_type;
+    return type;
   }
 
   auto generic_type = *maybe_generic_type;
diff --git a/deps/v8/src/torque/type-visitor.h b/deps/v8/src/torque/type-visitor.h
index 6bb2bba499d..205e842cc75 100644
--- a/deps/v8/src/torque/type-visitor.h
+++ b/deps/v8/src/torque/type-visitor.h
@@ -32,7 +32,9 @@ class TypeVisitor {
   static void VisitStructMethods(StructType* struct_type,
                                  const StructDeclaration* struct_declaration);
   static Signature MakeSignature(const CallableDeclaration* declaration);
-  static const StructType* ComputeTypeForStructExpression(
+  // Can return either StructType or BitFieldStructType, since they can both be
+  // used in struct expressions like `MyStruct{ a: 0, b: foo }`
+  static const Type* ComputeTypeForStructExpression(
       TypeExpression* type_expression,
       const std::vector<const Type*>& term_argument_types);
 
diff --git a/deps/v8/src/torque/types.cc b/deps/v8/src/torque/types.cc
index e08716c98a1..a01fd596804 100644
--- a/deps/v8/src/torque/types.cc
+++ b/deps/v8/src/torque/types.cc
@@ -2,11 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include <iostream>
-
 #include "src/torque/types.h"
 
+#include <cmath>
+#include <iostream>
+
 #include "src/base/bits.h"
+#include "src/base/optional.h"
 #include "src/torque/ast.h"
 #include "src/torque/declarable.h"
 #include "src/torque/global-context.h"
@@ -471,25 +473,16 @@ void StructType::Finalize() const {
   CheckForDuplicateFields();
 }
 
-constexpr ClassFlags ClassType::kInternalFlags;
-
 ClassType::ClassType(const Type* parent, Namespace* nspace,
                      const std::string& name, ClassFlags flags,
                      const std::string& generates, const ClassDeclaration* decl,
                      const TypeAlias* alias)
     : AggregateType(Kind::kClassType, parent, nspace, name),
       size_(ResidueClass::Unknown()),
-      flags_(flags & ~(kInternalFlags)),
+      flags_(flags),
       generates_(generates),
       decl_(decl),
-      alias_(alias) {
-  DCHECK_EQ(flags & kInternalFlags, 0);
-}
-
-bool ClassType::HasIndexedField() const {
-  if (!is_finalized_) Finalize();
-  return flags_ & ClassFlag::kHasIndexedField;
-}
+      alias_(alias) {}
 
 std::string ClassType::GetGeneratedTNodeTypeNameImpl() const {
   return generates_;
@@ -510,11 +503,6 @@ void ClassType::Finalize() const {
   if (is_finalized_) return;
   CurrentScope::Scope scope_activator(alias_->ParentScope());
   CurrentSourcePosition::Scope position_activator(decl_->pos);
-  if (parent()) {
-    if (const ClassType* super_class = ClassType::DynamicCast(parent())) {
-      if (super_class->HasIndexedField()) flags_ |= ClassFlag::kHasIndexedField;
-    }
-  }
   TypeVisitor::VisitClassFieldsAndMethods(const_cast<ClassType*>(this),
                                           this->decl_);
   is_finalized_ = true;
@@ -542,6 +530,122 @@ std::vector<Field> ClassType::ComputeAllFields() const {
   return all_fields;
 }
 
+std::vector<Field> ClassType::ComputeHeaderFields() const {
+  std::vector<Field> result;
+  for (Field& field : ComputeAllFields()) {
+    if (field.index) break;
+    DCHECK(*field.offset < header_size());
+    result.push_back(std::move(field));
+  }
+  return result;
+}
+
+std::vector<Field> ClassType::ComputeArrayFields() const {
+  std::vector<Field> result;
+  for (Field& field : ComputeAllFields()) {
+    if (!field.index) {
+      DCHECK(*field.offset < header_size());
+      continue;
+    }
+    result.push_back(std::move(field));
+  }
+  return result;
+}
+
+void ClassType::InitializeInstanceTypes(
+    base::Optional<int> own, base::Optional<std::pair<int, int>> range) const {
+  DCHECK(!own_instance_type_.has_value());
+  DCHECK(!instance_type_range_.has_value());
+  own_instance_type_ = own;
+  instance_type_range_ = range;
+}
+
+base::Optional<int> ClassType::OwnInstanceType() const {
+  DCHECK(GlobalContext::IsInstanceTypesInitialized());
+  return own_instance_type_;
+}
+
+base::Optional<std::pair<int, int>> ClassType::InstanceTypeRange() const {
+  DCHECK(GlobalContext::IsInstanceTypesInitialized());
+  return instance_type_range_;
+}
+
+namespace {
+void ComputeSlotKindsHelper(std::vector<ObjectSlotKind>* slots,
+                            size_t start_offset,
+                            const std::vector<Field>& fields) {
+  size_t offset = start_offset;
+  for (const Field& field : fields) {
+    size_t field_size = std::get<0>(field.GetFieldSizeInformation());
+    size_t slot_index = offset / TargetArchitecture::TaggedSize();
+    // Rounding-up division to find the number of slots occupied by all the
+    // fields up to and including the current one.
+    size_t used_slots =
+        (offset + field_size + TargetArchitecture::TaggedSize() - 1) /
+        TargetArchitecture::TaggedSize();
+    while (used_slots > slots->size()) {
+      slots->push_back(ObjectSlotKind::kNoPointer);
+    }
+    const Type* type = field.name_and_type.type;
+    if (auto struct_type = type->StructSupertype()) {
+      ComputeSlotKindsHelper(slots, offset, (*struct_type)->fields());
+    } else {
+      ObjectSlotKind kind;
+      if (type->IsSubtypeOf(TypeOracle::GetObjectType())) {
+        if (field.is_weak) {
+          kind = ObjectSlotKind::kCustomWeakPointer;
+        } else {
+          kind = ObjectSlotKind::kStrongPointer;
+        }
+      } else if (type->IsSubtypeOf(TypeOracle::GetTaggedType())) {
+        DCHECK(!field.is_weak);
+        kind = ObjectSlotKind::kMaybeObjectPointer;
+      } else {
+        kind = ObjectSlotKind::kNoPointer;
+      }
+      DCHECK(slots->at(slot_index) == ObjectSlotKind::kNoPointer);
+      slots->at(slot_index) = kind;
+    }
+
+    offset += field_size;
+  }
+}
+}  // namespace
+
+std::vector<ObjectSlotKind> ClassType::ComputeHeaderSlotKinds() const {
+  std::vector<ObjectSlotKind> result;
+  std::vector<Field> header_fields = ComputeHeaderFields();
+  ComputeSlotKindsHelper(&result, 0, header_fields);
+  DCHECK_EQ(std::ceil(static_cast<double>(header_size()) /
+                      TargetArchitecture::TaggedSize()),
+            result.size());
+  return result;
+}
+
+base::Optional<ObjectSlotKind> ClassType::ComputeArraySlotKind() const {
+  std::vector<ObjectSlotKind> kinds;
+  ComputeSlotKindsHelper(&kinds, 0, ComputeArrayFields());
+  if (kinds.empty()) return base::nullopt;
+  std::sort(kinds.begin(), kinds.end());
+  if (kinds.front() == kinds.back()) return {kinds.front()};
+  if (kinds.front() == ObjectSlotKind::kStrongPointer &&
+      kinds.back() == ObjectSlotKind::kMaybeObjectPointer) {
+    return ObjectSlotKind::kMaybeObjectPointer;
+  }
+  Error("Array fields mix types with different GC visitation requirements.")
+      .Throw();
+}
+
+bool ClassType::HasNoPointerSlots() const {
+  for (ObjectSlotKind slot : ComputeHeaderSlotKinds()) {
+    if (slot != ObjectSlotKind::kNoPointer) return false;
+  }
+  if (auto slot = ComputeArraySlotKind()) {
+    if (*slot != ObjectSlotKind::kNoPointer) return false;
+  }
+  return true;
+}
+
 void ClassType::GenerateAccessors() {
   // For each field, construct AST snippets that implement a CSA accessor
   // function. The implementation iterator will turn the snippets into code.
@@ -620,11 +724,11 @@ void ClassType::GenerateAccessors() {
 }
 
 bool ClassType::HasStaticSize() const {
-  if (IsShape()) return true;
-  if (IsSubtypeOf(TypeOracle::GetJSObjectType())) return false;
-  if (IsAbstract()) return false;
-  if (HasIndexedField()) return false;
-  return true;
+  // Abstract classes don't have instances directly, so asking this question
+  // doesn't make sense.
+  DCHECK(!IsAbstract());
+  if (IsSubtypeOf(TypeOracle::GetJSObjectType()) && !IsShape()) return false;
+  return size().SingleValue().has_value();
 }
 
 void PrintSignature(std::ostream& os, const Signature& sig, bool with_names) {
@@ -719,6 +823,21 @@ bool Signature::HasSameTypesAs(const Signature& other,
   return true;
 }
 
+namespace {
+bool FirstTypeIsContext(const std::vector<const Type*> parameter_types) {
+  return !parameter_types.empty() &&
+         parameter_types[0] == TypeOracle::GetContextType();
+}
+}  // namespace
+
+bool Signature::HasContextParameter() const {
+  return FirstTypeIsContext(types());
+}
+
+bool BuiltinPointerType::HasContextParameter() const {
+  return FirstTypeIsContext(parameter_types());
+}
+
 bool IsAssignableFrom(const Type* to, const Type* from) {
   if (to == from) return true;
   if (from->IsSubtypeOf(to)) return true;
@@ -814,6 +933,8 @@ size_t AbstractType::AlignmentLog2() const {
     alignment = TargetArchitecture::TaggedSize();
   } else if (this == TypeOracle::GetRawPtrType()) {
     alignment = TargetArchitecture::RawPtrSize();
+  } else if (this == TypeOracle::GetExternalPointerType()) {
+    alignment = TargetArchitecture::ExternalPointerSize();
   } else if (this == TypeOracle::GetVoidType()) {
     alignment = 1;
   } else if (this == TypeOracle::GetInt8Type()) {
@@ -881,6 +1002,9 @@ base::Optional<std::tuple<size_t, std::string>> SizeOf(const Type* type) {
   } else if (type->IsSubtypeOf(TypeOracle::GetRawPtrType())) {
     size = TargetArchitecture::RawPtrSize();
     size_string = "kSystemPointerSize";
+  } else if (type->IsSubtypeOf(TypeOracle::GetExternalPointerType())) {
+    size = TargetArchitecture::ExternalPointerSize();
+    size_string = "kExternalPointerSize";
   } else if (type->IsSubtypeOf(TypeOracle::GetVoidType())) {
     size = 0;
     size_string = "0";
@@ -942,10 +1066,17 @@ bool IsAllowedAsBitField(const Type* type) {
   // Any integer-ish type, including bools and enums which inherit from integer
   // types, are allowed. Note, however, that we always zero-extend during
   // decoding regardless of signedness.
+  return IsPointerSizeIntegralType(type) || Is32BitIntegralType(type);
+}
+
+bool IsPointerSizeIntegralType(const Type* type) {
+  return type->IsSubtypeOf(TypeOracle::GetUIntPtrType()) ||
+         type->IsSubtypeOf(TypeOracle::GetIntPtrType());
+}
+
+bool Is32BitIntegralType(const Type* type) {
   return type->IsSubtypeOf(TypeOracle::GetUint32Type()) ||
-         type->IsSubtypeOf(TypeOracle::GetUIntPtrType()) ||
          type->IsSubtypeOf(TypeOracle::GetInt32Type()) ||
-         type->IsSubtypeOf(TypeOracle::GetIntPtrType()) ||
          type->IsSubtypeOf(TypeOracle::GetBoolType());
 }
 
@@ -960,6 +1091,13 @@ base::Optional<NameAndType> ExtractSimpleFieldArraySize(
   return class_type.LookupField(identifier->name->value).name_and_type;
 }
 
+std::string Type::GetRuntimeType() const {
+  // TODO(tebbi): Other types are currently unsupported, since there the TNode
+  // types and the C++ runtime types disagree.
+  DCHECK(this->IsSubtypeOf(TypeOracle::GetTaggedType()));
+  return GetGeneratedTNodeTypeName();
+}
+
 }  // namespace torque
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/torque/types.h b/deps/v8/src/torque/types.h
index b60879ce859..ace926550d5 100644
--- a/deps/v8/src/torque/types.h
+++ b/deps/v8/src/torque/types.h
@@ -104,6 +104,7 @@ struct RuntimeType {
 
 class V8_EXPORT_PRIVATE Type : public TypeBase {
  public:
+  Type& operator=(const Type& other) = delete;
   virtual bool IsSubtypeOf(const Type* supertype) const;
 
   // Default rendering for error messages etc.
@@ -135,6 +136,7 @@ class V8_EXPORT_PRIVATE Type : public TypeBase {
   base::Optional<const ClassType*> ClassSupertype() const;
   base::Optional<const StructType*> StructSupertype() const;
   virtual std::vector<RuntimeType> GetRuntimeTypes() const { return {}; }
+  virtual std::string GetRuntimeType() const;
   static const Type* CommonSupertype(const Type* a, const Type* b);
   void AddAlias(std::string alias) const { aliases_.insert(std::move(alias)); }
   size_t id() const { return id_; }
@@ -163,7 +165,6 @@ class V8_EXPORT_PRIVATE Type : public TypeBase {
   Type(TypeBase::Kind kind, const Type* parent,
        MaybeSpecializationKey specialized_from = base::nullopt);
   Type(const Type& other) V8_NOEXCEPT;
-  Type& operator=(const Type& other) = delete;
   void set_parent(const Type* t) { parent_ = t; }
   int Depth() const;
   virtual std::string ToExplicitString() const = 0;
@@ -274,6 +275,7 @@ class AbstractType final : public Type {
   const Type* NonConstexprVersion() const override {
     if (non_constexpr_version_) return non_constexpr_version_;
     if (!IsConstexpr()) return this;
+    if (parent()) return parent()->NonConstexprVersion();
     return nullptr;
   }
 
@@ -299,8 +301,13 @@ class AbstractType final : public Type {
   }
 
   std::string SimpleNameImpl() const override {
-    if (IsConstexpr())
-      return "constexpr_" + NonConstexprVersion()->SimpleName();
+    if (IsConstexpr()) {
+      const Type* non_constexpr_version = NonConstexprVersion();
+      if (non_constexpr_version == nullptr) {
+        ReportError("Cannot find non-constexpr type corresponding to ", *this);
+      }
+      return "constexpr_" + non_constexpr_version->SimpleName();
+    }
     return name();
   }
 
@@ -346,6 +353,8 @@ class V8_EXPORT_PRIVATE BuiltinPointerType final : public Type {
     return {{"Smi", ""}};
   }
 
+  bool HasContextParameter() const;
+
  private:
   friend class TypeOracle;
   BuiltinPointerType(const Type* parent, TypeVector parameter_types,
@@ -375,6 +384,9 @@ class V8_EXPORT_PRIVATE UnionType final : public Type {
     return "TNode<" + GetGeneratedTNodeTypeName() + ">";
   }
   std::string GetGeneratedTNodeTypeNameImpl() const override;
+  std::string GetRuntimeType() const override {
+    return parent()->GetRuntimeType();
+  }
 
   friend size_t hash_value(const UnionType& p) {
     size_t result = 0;
@@ -420,6 +432,13 @@ class V8_EXPORT_PRIVATE UnionType final : public Type {
     return false;
   }
 
+  bool IsConstexpr() const override { return parent()->IsConstexpr(); }
+
+  const Type* NonConstexprVersion() const override {
+    if (!IsConstexpr()) return this;
+    return parent()->NonConstexprVersion();
+  }
+
   void Extend(const Type* t) {
     if (const UnionType* union_type = UnionType::DynamicCast(t)) {
       for (const Type* member : union_type->types_) {
@@ -517,8 +536,6 @@ class AggregateType : public Type {
 
   virtual void Finalize() const = 0;
 
-  virtual bool HasIndexedField() const { return false; }
-
   void SetFields(std::vector<Field> fields) { fields_ = std::move(fields); }
   const std::vector<Field>& fields() const {
     if (!is_finalized_) Finalize();
@@ -607,10 +624,25 @@ class StructType final : public AggregateType {
 
 class TypeAlias;
 
+enum class ObjectSlotKind : uint8_t {
+  kNoPointer,
+  kStrongPointer,
+  kMaybeObjectPointer,
+  kCustomWeakPointer
+};
+
+inline base::Optional<ObjectSlotKind> Combine(ObjectSlotKind a,
+                                              ObjectSlotKind b) {
+  if (a == b) return {a};
+  if (std::min(a, b) == ObjectSlotKind::kStrongPointer &&
+      std::max(a, b) == ObjectSlotKind::kMaybeObjectPointer) {
+    return {ObjectSlotKind::kMaybeObjectPointer};
+  }
+  return base::nullopt;
+}
+
 class ClassType final : public AggregateType {
  public:
-  static constexpr ClassFlags kInternalFlags = ClassFlag::kHasIndexedField;
-
   DECLARE_TYPE_BOILERPLATE(ClassType)
   std::string ToExplicitString() const override;
   std::string GetGeneratedTypeNameImpl() const override;
@@ -625,6 +657,7 @@ class ClassType final : public AggregateType {
                            (!HasUndefinedLayout() && !IsShape()));
   }
   bool ShouldGenerateBodyDescriptor() const {
+    if (IsAbstract()) return false;
     return flags_ & ClassFlag::kGenerateBodyDescriptor || !IsExtern();
   }
   bool IsTransient() const override { return flags_ & ClassFlag::kTransient; }
@@ -639,7 +672,6 @@ class ClassType final : public AggregateType {
   bool ShouldExport() const { return flags_ & ClassFlag::kExport; }
   bool IsShape() const { return flags_ & ClassFlag::kIsShape; }
   bool HasStaticSize() const;
-  bool HasIndexedField() const override;
   size_t header_size() const {
     if (!is_finalized_) Finalize();
     return header_size_;
@@ -655,14 +687,19 @@ class ClassType final : public AggregateType {
   void GenerateAccessors();
   bool AllowInstantiation() const;
   const Field& RegisterField(Field field) override {
-    if (field.index) {
-      flags_ |= ClassFlag::kHasIndexedField;
-    }
     return AggregateType::RegisterField(field);
   }
   void Finalize() const override;
 
   std::vector<Field> ComputeAllFields() const;
+  std::vector<Field> ComputeHeaderFields() const;
+  std::vector<Field> ComputeArrayFields() const;
+  // The slots of an object are the tagged pointer sized offsets in an object
+  // that may or may not require GC visiting. These helper functions determine
+  // what kind of GC visiting the individual slots require.
+  std::vector<ObjectSlotKind> ComputeHeaderSlotKinds() const;
+  base::Optional<ObjectSlotKind> ComputeArraySlotKind() const;
+  bool HasNoPointerSlots() const;
 
   const InstanceTypeConstraints& GetInstanceTypeConstraints() const {
     return decl_->instance_type_constraints;
@@ -678,6 +715,14 @@ class ClassType final : public AggregateType {
   }
   SourcePosition GetPosition() const { return decl_->pos; }
 
+  // TODO(tebbi): We should no longer pass around types as const pointers, so
+  // that we can avoid mutable fields and const initializers for
+  // late-initialized portions of types like this one.
+  void InitializeInstanceTypes(base::Optional<int> own,
+                               base::Optional<std::pair<int, int>> range) const;
+  base::Optional<int> OwnInstanceType() const;
+  base::Optional<std::pair<int, int>> InstanceTypeRange() const;
+
  private:
   friend class TypeOracle;
   friend class TypeVisitor;
@@ -691,6 +736,8 @@ class ClassType final : public AggregateType {
   const std::string generates_;
   const ClassDeclaration* decl_;
   const TypeAlias* alias_;
+  mutable base::Optional<int> own_instance_type_;
+  mutable base::Optional<std::pair<int, int>> instance_type_range_;
 };
 
 inline std::ostream& operator<<(std::ostream& os, const Type& t) {
@@ -804,6 +851,7 @@ struct Signature {
     return TypeVector(parameter_types.types.begin() + implicit_count,
                       parameter_types.types.end());
   }
+  bool HasContextParameter() const;
 };
 
 void PrintSignature(std::ostream& os, const Signature& sig, bool with_names);
@@ -820,6 +868,8 @@ TypeVector LowerParameterTypes(const ParameterTypes& parameter_types,
 base::Optional<std::tuple<size_t, std::string>> SizeOf(const Type* type);
 bool IsAnyUnsignedInteger(const Type* type);
 bool IsAllowedAsBitField(const Type* type);
+bool IsPointerSizeIntegralType(const Type* type);
+bool Is32BitIntegralType(const Type* type);
 
 base::Optional<NameAndType> ExtractSimpleFieldArraySize(
     const ClassType& class_type, Expression* array_size);
diff --git a/deps/v8/src/torque/utils.h b/deps/v8/src/torque/utils.h
index 1c5b3079f50..52efe6564e7 100644
--- a/deps/v8/src/torque/utils.h
+++ b/deps/v8/src/torque/utils.h
@@ -47,6 +47,7 @@ std::string ToString(Args&&... args) {
 
 class V8_EXPORT_PRIVATE MessageBuilder {
  public:
+  MessageBuilder() = delete;
   MessageBuilder(const std::string& message, TorqueMessage::Kind kind);
 
   MessageBuilder& Position(SourcePosition position) {
@@ -62,7 +63,6 @@ class V8_EXPORT_PRIVATE MessageBuilder {
   }
 
  private:
-  MessageBuilder() = delete;
   void Report() const;
 
   TorqueMessage message_;
@@ -172,9 +172,7 @@ void PrintCommaSeparatedList(std::ostream& os, const T& list) {
 
 struct BottomOffset {
   size_t offset;
-  BottomOffset(std::nullptr_t zero = 0)  // NOLINT(runtime/explicit)
-      : offset(0) {}
-  explicit BottomOffset(std::size_t offset) : offset(offset) {}
+
   BottomOffset& operator=(std::size_t offset) {
     this->offset = offset;
     return *this;
@@ -340,7 +338,7 @@ void EraseIf(Container* container, F f) {
 
 class NullStreambuf : public std::streambuf {
  public:
-  virtual int overflow(int c) {
+  int overflow(int c) override {
     setp(buffer_, buffer_ + sizeof(buffer_));
     return (c == traits_type::eof()) ? '\0' : c;
   }
@@ -370,10 +368,10 @@ class IfDefScope {
  public:
   IfDefScope(std::ostream& os, std::string d);
   ~IfDefScope();
-
- private:
   IfDefScope(const IfDefScope&) = delete;
   IfDefScope& operator=(const IfDefScope&) = delete;
+
+ private:
   std::ostream& os_;
   std::string d_;
 };
@@ -383,10 +381,10 @@ class NamespaceScope {
   NamespaceScope(std::ostream& os,
                  std::initializer_list<std::string> namespaces);
   ~NamespaceScope();
-
- private:
   NamespaceScope(const NamespaceScope&) = delete;
   NamespaceScope& operator=(const NamespaceScope&) = delete;
+
+ private:
   std::ostream& os_;
   std::vector<std::string> d_;
 };
@@ -395,10 +393,10 @@ class IncludeGuardScope {
  public:
   IncludeGuardScope(std::ostream& os, std::string file_name);
   ~IncludeGuardScope();
-
- private:
   IncludeGuardScope(const IncludeGuardScope&) = delete;
   IncludeGuardScope& operator=(const IncludeGuardScope&) = delete;
+
+ private:
   std::ostream& os_;
   std::string d_;
 };
@@ -407,10 +405,10 @@ class IncludeObjectMacrosScope {
  public:
   explicit IncludeObjectMacrosScope(std::ostream& os);
   ~IncludeObjectMacrosScope();
-
- private:
   IncludeObjectMacrosScope(const IncludeObjectMacrosScope&) = delete;
   IncludeObjectMacrosScope& operator=(const IncludeObjectMacrosScope&) = delete;
+
+ private:
   std::ostream& os_;
 };
 
diff --git a/deps/v8/src/tracing/DEPS b/deps/v8/src/tracing/DEPS
new file mode 100644
index 00000000000..fd3531bfcc3
--- /dev/null
+++ b/deps/v8/src/tracing/DEPS
@@ -0,0 +1,4 @@
+include_rules = [
+  "+perfetto/tracing.h",
+  "+protos/perfetto"
+]
diff --git a/deps/v8/src/tracing/trace-categories.cc b/deps/v8/src/tracing/trace-categories.cc
new file mode 100644
index 00000000000..98c41e41e8a
--- /dev/null
+++ b/deps/v8/src/tracing/trace-categories.cc
@@ -0,0 +1,9 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/tracing/trace-categories.h"
+
+#if defined(V8_USE_PERFETTO)
+PERFETTO_TRACK_EVENT_STATIC_STORAGE();
+#endif
diff --git a/deps/v8/src/tracing/trace-categories.h b/deps/v8/src/tracing/trace-categories.h
new file mode 100644
index 00000000000..4ad96935158
--- /dev/null
+++ b/deps/v8/src/tracing/trace-categories.h
@@ -0,0 +1,57 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TRACING_TRACE_CATEGORIES_H_
+#define V8_TRACING_TRACE_CATEGORIES_H_
+
+#include "src/base/macros.h"
+
+#if defined(V8_USE_PERFETTO)
+
+// Exports tracks events into the v8 namespace to avoid conflicts with embedders
+// like Chrome.
+#define PERFETTO_TRACK_EVENT_NAMESPACE v8
+
+// Export trace categories and the track event data source in components builds.
+#define PERFETTO_COMPONENT_EXPORT V8_EXPORT_PRIVATE
+
+// For now most of v8 uses legacy trace events.
+#define PERFETTO_ENABLE_LEGACY_TRACE_EVENTS 1
+
+#include "perfetto/tracing.h"
+
+// Trace category prefixes used in tests.
+PERFETTO_DEFINE_TEST_CATEGORY_PREFIXES("v8-cat", "cat", "v8.Test2");
+
+// List of categories used by built-in V8 trace events.
+// clang-format off
+PERFETTO_DEFINE_CATEGORIES(
+    perfetto::Category("V8.HandleInterrupts"),
+    perfetto::Category("v8"),
+    perfetto::Category("v8.console"),
+    perfetto::Category("v8.execute"),
+    perfetto::Category("v8.runtime"),
+    perfetto::Category::Group("devtools.timeline,v8"),
+    perfetto::Category::Group("devtools.timeline,"
+                              TRACE_DISABLED_BY_DEFAULT("v8.gc")),
+    perfetto::Category(TRACE_DISABLED_BY_DEFAULT("devtools.timeline")),
+    perfetto::Category(TRACE_DISABLED_BY_DEFAULT("v8")),
+    perfetto::Category(TRACE_DISABLED_BY_DEFAULT("v8.compile")),
+    perfetto::Category(TRACE_DISABLED_BY_DEFAULT("v8.cpu_profiler")),
+    perfetto::Category(TRACE_DISABLED_BY_DEFAULT("v8.gc")),
+    perfetto::Category(TRACE_DISABLED_BY_DEFAULT("v8.gc_stats")),
+    perfetto::Category(TRACE_DISABLED_BY_DEFAULT("v8.ic_stats")),
+    perfetto::Category(TRACE_DISABLED_BY_DEFAULT("v8.runtime")),
+    perfetto::Category(TRACE_DISABLED_BY_DEFAULT("v8.runtime_stats")),
+    perfetto::Category(TRACE_DISABLED_BY_DEFAULT("v8.runtime_stats_sampling")),
+    perfetto::Category(TRACE_DISABLED_BY_DEFAULT("v8.turbofan")),
+    perfetto::Category(TRACE_DISABLED_BY_DEFAULT("v8.wasm")),
+    perfetto::Category::Group("v8,devtools.timeline"),
+    perfetto::Category::Group(TRACE_DISABLED_BY_DEFAULT("v8.turbofan") ","
+                              TRACE_DISABLED_BY_DEFAULT("v8.wasm")));
+// clang-format on
+
+#endif  // defined(V8_USE_PERFETTO)
+
+#endif  // V8_TRACING_TRACE_CATEGORIES_H_
diff --git a/deps/v8/src/tracing/trace-event.cc b/deps/v8/src/tracing/trace-event.cc
index 6c631b1f3c3..8e69fe55205 100644
--- a/deps/v8/src/tracing/trace-event.cc
+++ b/deps/v8/src/tracing/trace-event.cc
@@ -15,6 +15,7 @@ namespace v8 {
 namespace internal {
 namespace tracing {
 
+#if !defined(V8_USE_PERFETTO)
 v8::TracingController* TraceEventHelper::GetTracingController() {
   return v8::internal::V8::GetCurrentPlatform()->GetTracingController();
 }
@@ -51,6 +52,7 @@ void CallStatsScopedTracer::Initialize(v8::internal::Isolate* isolate,
       v8::internal::tracing::kGlobalScope, v8::internal::tracing::kNoId,
       TRACE_EVENT_FLAG_NONE, v8::internal::tracing::kNoId);
 }
+#endif  // !defined(V8_USE_PERFETTO)
 
 }  // namespace tracing
 }  // namespace internal
diff --git a/deps/v8/src/tracing/trace-event.h b/deps/v8/src/tracing/trace-event.h
index 0a650a8ebb7..816e79c5232 100644
--- a/deps/v8/src/tracing/trace-event.h
+++ b/deps/v8/src/tracing/trace-event.h
@@ -8,7 +8,13 @@
 #include <stddef.h>
 #include <memory>
 
+#if defined(V8_USE_PERFETTO)
+#include "protos/perfetto/trace/track_event/debug_annotation.pbzero.h"
+#include "src/tracing/trace-categories.h"
+#else
 #include "base/trace_event/common/trace_event_common.h"
+#endif  // !defined(V8_USE_PERFETTO)
+
 #include "include/v8-platform.h"
 #include "src/base/atomicops.h"
 #include "src/base/macros.h"
@@ -32,6 +38,8 @@ enum CategoryGroupEnabledFlags {
   kEnabledForETWExport_CategoryGroupEnabledFlags = 1 << 3,
 };
 
+#if !defined(V8_USE_PERFETTO)
+
 // TODO(petermarshall): Remove with the old tracing implementation - Perfetto
 // copies const char* arguments by default.
 // By default, const char* argument values are assumed to have long-lived scope
@@ -284,8 +292,8 @@ class Isolate;
 
 namespace tracing {
 
-// Specify these values when the corresponding argument of AddTraceEvent is not
-// used.
+// Specify these values when the corresponding argument of AddTraceEvent
+// is not used.
 const int kZeroNumArgs = 0;
 const decltype(nullptr) kGlobalScope = nullptr;
 const uint64_t kNoId = 0;
@@ -605,4 +613,39 @@ class CallStatsScopedTracer {
 }  // namespace internal
 }  // namespace v8
 
+#else  // defined(V8_USE_PERFETTO)
+
+#define TRACE_EVENT_CALL_STATS_SCOPED(isolate, category, name)             \
+  struct PERFETTO_UID(ScopedEvent) {                                       \
+    struct ScopedStats {                                                   \
+      ScopedStats(v8::internal::Isolate* isolate_arg, int) {               \
+        TRACE_EVENT_BEGIN(category, name, [&](perfetto::EventContext) {    \
+          isolate_ = isolate_arg;                                          \
+          internal::RuntimeCallStats* table =                              \
+              isolate_->counters()->runtime_call_stats();                  \
+          has_parent_scope_ = table->InUse();                              \
+          if (!has_parent_scope_) table->Reset();                          \
+        });                                                                \
+      }                                                                    \
+      ~ScopedStats() {                                                     \
+        TRACE_EVENT_END(category, [&](perfetto::EventContext ctx) {        \
+          if (!has_parent_scope_ && isolate_) {                            \
+            /* TODO(skyostil): Write as typed event instead of JSON */     \
+            auto value = v8::tracing::TracedValue::Create();               \
+            isolate_->counters()->runtime_call_stats()->Dump(value.get()); \
+            auto annotation = ctx.event()->add_debug_annotations();        \
+            annotation->set_name("runtime-call-stats");                    \
+            value->Add(annotation);                                        \
+          }                                                                \
+        });                                                                \
+      }                                                                    \
+      v8::internal::Isolate* isolate_;                                     \
+      bool has_parent_scope_;                                              \
+    } stats;                                                               \
+  } PERFETTO_UID(scoped_event) {                                           \
+    { isolate, 0 }                                                         \
+  }
+
+#endif  // defined(V8_USE_PERFETTO)
+
 #endif  // V8_TRACING_TRACE_EVENT_H_
diff --git a/deps/v8/src/tracing/traced-value.cc b/deps/v8/src/tracing/traced-value.cc
index 9011b51f48f..bc5398a5671 100644
--- a/deps/v8/src/tracing/traced-value.cc
+++ b/deps/v8/src/tracing/traced-value.cc
@@ -8,6 +8,10 @@
 #include "src/numbers/conversions.h"
 #include "src/utils/vector.h"
 
+#ifdef V8_USE_PERFETTO
+#include "protos/perfetto/trace/track_event/debug_annotation.pbzero.h"
+#endif
+
 namespace v8 {
 namespace tracing {
 
@@ -207,5 +211,16 @@ void TracedValue::AppendAsTraceFormat(std::string* out) const {
   *out += '}';
 }
 
+#ifdef V8_USE_PERFETTO
+void TracedValue::Add(
+    perfetto::protos::pbzero::DebugAnnotation* annotation) const {
+  std::string json;
+  json += "{";
+  json += data_;
+  json += "}";
+  annotation->set_legacy_json_value(json);
+}
+#endif  // V8_USE_PERFETTO
+
 }  // namespace tracing
 }  // namespace v8
diff --git a/deps/v8/src/tracing/traced-value.h b/deps/v8/src/tracing/traced-value.h
index 3edfbc23b20..3b1d09059de 100644
--- a/deps/v8/src/tracing/traced-value.h
+++ b/deps/v8/src/tracing/traced-value.h
@@ -12,11 +12,17 @@
 
 #include "include/v8-platform.h"
 #include "src/base/macros.h"
+#include "src/tracing/trace-event.h"
 
 namespace v8 {
 namespace tracing {
 
-class V8_EXPORT_PRIVATE TracedValue : public ConvertableToTraceFormat {
+class V8_EXPORT_PRIVATE TracedValue : public ConvertableToTraceFormat
+#ifdef V8_USE_PERFETTO
+    ,
+                                      public perfetto::DebugAnnotation
+#endif  // V8_USE_PERFETTO
+{
  public:
   ~TracedValue() override;
 
@@ -54,6 +60,11 @@ class V8_EXPORT_PRIVATE TracedValue : public ConvertableToTraceFormat {
   // ConvertableToTraceFormat implementation.
   void AppendAsTraceFormat(std::string* out) const override;
 
+#ifdef V8_USE_PERFETTO
+  // DebugAnnotation implementation.
+  void Add(perfetto::protos::pbzero::DebugAnnotation*) const override;
+#endif  // V8_USE_PERFETTO
+
  private:
   TracedValue();
 
diff --git a/deps/v8/src/utils/ostreams.cc b/deps/v8/src/utils/ostreams.cc
index c43f01be563..b58f51159b8 100644
--- a/deps/v8/src/utils/ostreams.cc
+++ b/deps/v8/src/utils/ostreams.cc
@@ -6,6 +6,7 @@
 
 #include <cinttypes>
 
+#include "src/base/lazy-instance.h"
 #include "src/objects/objects.h"
 #include "src/objects/string.h"
 
@@ -114,6 +115,9 @@ std::streamsize AndroidLogStream::xsputn(const char* s, std::streamsize n) {
 }
 #endif
 
+DEFINE_LAZY_LEAKY_OBJECT_GETTER(base::RecursiveMutex,
+                                StdoutStream::GetStdoutMutex)
+
 namespace {
 
 // Locale-independent predicates.
diff --git a/deps/v8/src/utils/ostreams.h b/deps/v8/src/utils/ostreams.h
index e87675d5418..899c85fd94c 100644
--- a/deps/v8/src/utils/ostreams.h
+++ b/deps/v8/src/utils/ostreams.h
@@ -13,6 +13,7 @@
 
 #include "include/v8config.h"
 #include "src/base/macros.h"
+#include "src/base/platform/mutex.h"
 #include "src/common/globals.h"
 
 namespace v8 {
@@ -35,7 +36,7 @@ class V8_EXPORT_PRIVATE OFStreamBase : public std::streambuf {
 class V8_EXPORT_PRIVATE DbgStreamBuf : public std::streambuf {
  public:
   DbgStreamBuf();
-  ~DbgStreamBuf();
+  ~DbgStreamBuf() override;
 
  private:
   int sync() override;
@@ -47,7 +48,7 @@ class V8_EXPORT_PRIVATE DbgStreamBuf : public std::streambuf {
 class DbgStdoutStream : public std::ostream {
  public:
   DbgStdoutStream();
-  ~DbgStdoutStream() = default;
+  ~DbgStdoutStream() override = default;
 
  private:
   DbgStreamBuf streambuf_;
@@ -80,12 +81,20 @@ class StdoutStream : public std::ostream {
   StdoutStream() : std::ostream(&stream_) {}
 
  private:
+  static V8_EXPORT_PRIVATE base::RecursiveMutex* GetStdoutMutex();
+
   AndroidLogStream stream_;
+  base::RecursiveMutexGuard mutex_guard_{GetStdoutMutex()};
 };
 #else
 class StdoutStream : public OFStream {
  public:
   StdoutStream() : OFStream(stdout) {}
+
+ private:
+  static V8_EXPORT_PRIVATE base::RecursiveMutex* GetStdoutMutex();
+
+  base::RecursiveMutexGuard mutex_guard_{GetStdoutMutex()};
 };
 #endif
 
diff --git a/deps/v8/src/utils/pointer-with-payload.h b/deps/v8/src/utils/pointer-with-payload.h
index 1c140ff6840..6200f410775 100644
--- a/deps/v8/src/utils/pointer-with-payload.h
+++ b/deps/v8/src/utils/pointer-with-payload.h
@@ -20,6 +20,12 @@ struct PointerWithPayloadTraits {
       alignof(PointerType) >= 8 ? 3 : alignof(PointerType) >= 4 ? 2 : 1;
 };
 
+// Assume void* has the same payloads as void**, under the assumption that it's
+// used for classes that contain at least one pointer.
+template <>
+struct PointerWithPayloadTraits<void> : public PointerWithPayloadTraits<void*> {
+};
+
 // PointerWithPayload combines a PointerType* an a small PayloadType into
 // one. The bits of the storage type get packed into the lower bits of the
 // pointer that are free due to alignment. The user needs to specify how many
@@ -42,11 +48,12 @@ class PointerWithPayload {
       "Ptr does not have sufficient alignment for the selected amount of "
       "storage bits.");
 
-  static constexpr uintptr_t kPayloadMask = (uintptr_t{1} << kAvailBits) - 1;
+  static constexpr uintptr_t kPayloadMask =
+      (uintptr_t{1} << NumPayloadBits) - 1;
   static constexpr uintptr_t kPointerMask = ~kPayloadMask;
 
  public:
-  PointerWithPayload() {}
+  PointerWithPayload() = default;
 
   explicit PointerWithPayload(PointerType* pointer)
       : pointer_(reinterpret_cast<uintptr_t>(pointer)) {
@@ -68,6 +75,13 @@ class PointerWithPayload {
     return reinterpret_cast<PointerType*>(pointer_ & kPointerMask);
   }
 
+  // An optimized version of GetPointer for when we know the payload value.
+  V8_INLINE PointerType* GetPointerWithKnownPayload(PayloadType payload) const {
+    DCHECK_EQ(GetPayload(), payload);
+    return reinterpret_cast<PointerType*>(pointer_ -
+                                          static_cast<uintptr_t>(payload));
+  }
+
   V8_INLINE PointerType* operator->() const { return GetPointer(); }
 
   V8_INLINE void update(PointerType* new_pointer, PayloadType new_payload) {
diff --git a/deps/v8/src/utils/vector.h b/deps/v8/src/utils/vector.h
index 71dadc6c0e8..38202d804fd 100644
--- a/deps/v8/src/utils/vector.h
+++ b/deps/v8/src/utils/vector.h
@@ -21,6 +21,10 @@ namespace internal {
 template <typename T>
 class Vector {
  public:
+  using value_type = T;
+  using iterator = T*;
+  using const_iterator = const T*;
+
   constexpr Vector() : start_(nullptr), length_(0) {}
 
   constexpr Vector(T* data, size_t length) : start_(data), length_(length) {
@@ -116,17 +120,15 @@ class Vector {
   }
 
   template <typename S>
-  static constexpr Vector<T> cast(Vector<S> input) {
+  static Vector<T> cast(Vector<S> input) {
     // Casting is potentially dangerous, so be really restrictive here. This
     // might be lifted once we have use cases for that.
     STATIC_ASSERT(std::is_pod<S>::value);
     STATIC_ASSERT(std::is_pod<T>::value);
-#if V8_HAS_CXX14_CONSTEXPR
-    DCHECK_EQ(0, (input.length() * sizeof(S)) % sizeof(T));
+    DCHECK_EQ(0, (input.size() * sizeof(S)) % sizeof(T));
     DCHECK_EQ(0, reinterpret_cast<uintptr_t>(input.begin()) % alignof(T));
-#endif
     return Vector<T>(reinterpret_cast<T*>(input.begin()),
-                     input.length() * sizeof(S) / sizeof(T));
+                     input.size() * sizeof(S) / sizeof(T));
   }
 
   bool operator==(const Vector<const T> other) const {
@@ -236,37 +238,48 @@ class OwnedVector {
   size_t length_ = 0;
 };
 
+// The vectors returned by {StaticCharVector}, {CStrVector}, or {OneByteVector}
+// do not contain a null-termination byte. If you want the null byte, use
+// {ArrayVector}.
+
+// Known length, constexpr.
 template <size_t N>
-constexpr Vector<const uint8_t> StaticCharVector(const char (&array)[N]) {
-  return Vector<const uint8_t>::cast(Vector<const char>(array, N - 1));
+constexpr Vector<const char> StaticCharVector(const char (&array)[N]) {
+  return {array, N - 1};
 }
 
-// The resulting vector does not contain a null-termination byte. If you want
-// the null byte, use ArrayVector("foo").
+// Unknown length, not constexpr.
 inline Vector<const char> CStrVector(const char* data) {
-  return Vector<const char>(data, strlen(data));
+  return {data, strlen(data)};
 }
 
+// OneByteVector is never constexpr because the data pointer is
+// {reinterpret_cast}ed.
 inline Vector<const uint8_t> OneByteVector(const char* data, size_t length) {
-  return Vector<const uint8_t>(reinterpret_cast<const uint8_t*>(data), length);
+  return {reinterpret_cast<const uint8_t*>(data), length};
 }
 
 inline Vector<const uint8_t> OneByteVector(const char* data) {
   return OneByteVector(data, strlen(data));
 }
 
+template <size_t N>
+Vector<const uint8_t> StaticOneByteVector(const char (&array)[N]) {
+  return OneByteVector(array, N - 1);
+}
+
 // For string literals, ArrayVector("foo") returns a vector ['f', 'o', 'o', \0]
 // with length 4 and null-termination.
 // If you want ['f', 'o', 'o'], use CStrVector("foo").
 template <typename T, size_t N>
 inline constexpr Vector<T> ArrayVector(T (&arr)[N]) {
-  return Vector<T>{arr, N};
+  return {arr, N};
 }
 
 // Construct a Vector from a start pointer and a size.
 template <typename T>
 inline constexpr Vector<T> VectorOf(T* start, size_t size) {
-  return Vector<T>(start, size);
+  return {start, size};
 }
 
 // Construct a Vector from anything providing a {data()} and {size()} accessor.
diff --git a/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h b/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h
index fe921c64064..defbd94f660 100644
--- a/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h
+++ b/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h
@@ -6,6 +6,7 @@
 #define V8_WASM_BASELINE_ARM_LIFTOFF_ASSEMBLER_ARM_H_
 
 #include "src/wasm/baseline/liftoff-assembler.h"
+#include "src/wasm/baseline/liftoff-register.h"
 
 namespace v8 {
 namespace internal {
@@ -25,7 +26,7 @@ namespace liftoff {
 //   1   | return addr (lr)   |
 //   0   | previous frame (fp)|
 //  -----+--------------------+  <-- frame ptr (fp)
-//  -1   | 0xa: WASM_COMPILED |
+//  -1   | 0xa: WASM          |
 //  -2   |     instance       |
 //  -----+--------------------+---------------------------
 //  -3   |    slot 0 (high)   |   ^
@@ -42,13 +43,16 @@ constexpr int kInstanceOffset = 2 * kSystemPointerSize;
 // PatchPrepareStackFrame will use in order to increase the stack appropriately.
 // Three instructions are required to sub a large constant, movw + movt + sub.
 constexpr int32_t kPatchInstructionsRequired = 3;
+constexpr int kHalfStackSlotSize = LiftoffAssembler::kStackSlotSize >> 1;
 
-inline MemOperand GetStackSlot(int offset) { return MemOperand(fp, -offset); }
+inline MemOperand GetStackSlot(int offset) {
+  return MemOperand(offset > 0 ? fp : sp, -offset);
+}
 
 inline MemOperand GetHalfStackSlot(int offset, RegPairHalf half) {
   int32_t half_offset =
       half == kLowWord ? 0 : LiftoffAssembler::kStackSlotSize / 2;
-  return MemOperand(fp, -offset + half_offset);
+  return MemOperand(offset > 0 ? fp : sp, -offset + half_offset);
 }
 
 inline MemOperand GetInstanceOperand() { return GetStackSlot(kInstanceOffset); }
@@ -68,11 +72,18 @@ inline MemOperand GetMemOp(LiftoffAssembler* assm,
 inline Register CalculateActualAddress(LiftoffAssembler* assm,
                                        UseScratchRegisterScope* temps,
                                        Register addr_reg, Register offset_reg,
-                                       int32_t offset_imm) {
+                                       int32_t offset_imm,
+                                       Register result_reg = no_reg) {
   if (offset_reg == no_reg && offset_imm == 0) {
-    return addr_reg;
+    if (result_reg == no_reg) {
+      return addr_reg;
+    } else {
+      assm->mov(result_reg, addr_reg);
+      return result_reg;
+    }
   }
-  Register actual_addr_reg = temps->Acquire();
+  Register actual_addr_reg =
+      result_reg != no_reg ? result_reg : temps->Acquire();
   if (offset_reg == no_reg) {
     assm->add(actual_addr_reg, addr_reg, Operand(offset_imm));
   } else {
@@ -111,19 +122,11 @@ template <void (Assembler::*op)(Register, Register, Register, SBit, Condition),
                                            SBit, Condition)>
 inline void I64Binop(LiftoffAssembler* assm, LiftoffRegister dst,
                      LiftoffRegister lhs, LiftoffRegister rhs) {
-  UseScratchRegisterScope temps(assm);
-  Register scratch = dst.low_gp();
-  bool can_use_dst =
-      dst.low_gp() != lhs.high_gp() && dst.low_gp() != rhs.high_gp();
-  if (!can_use_dst) {
-    scratch = temps.Acquire();
-  }
-  (assm->*op)(scratch, lhs.low_gp(), rhs.low_gp(), SetCC, al);
+  DCHECK_NE(dst.low_gp(), lhs.high_gp());
+  DCHECK_NE(dst.low_gp(), rhs.high_gp());
+  (assm->*op)(dst.low_gp(), lhs.low_gp(), rhs.low_gp(), SetCC, al);
   (assm->*op_with_carry)(dst.high_gp(), lhs.high_gp(), Operand(rhs.high_gp()),
                          LeaveCC, al);
-  if (!can_use_dst) {
-    assm->mov(dst.low_gp(), scratch);
-  }
 }
 
 template <void (Assembler::*op)(Register, Register, const Operand&, SBit,
@@ -132,20 +135,12 @@ template <void (Assembler::*op)(Register, Register, const Operand&, SBit,
                                            SBit, Condition)>
 inline void I64BinopI(LiftoffAssembler* assm, LiftoffRegister dst,
                       LiftoffRegister lhs, int32_t imm) {
-  UseScratchRegisterScope temps(assm);
-  Register scratch = dst.low_gp();
-  bool can_use_dst = dst.low_gp() != lhs.high_gp();
-  if (!can_use_dst) {
-    scratch = temps.Acquire();
-  }
-  (assm->*op)(scratch, lhs.low_gp(), Operand(imm), SetCC, al);
+  DCHECK_NE(dst.low_gp(), lhs.high_gp());
+  (assm->*op)(dst.low_gp(), lhs.low_gp(), Operand(imm), SetCC, al);
   // Top half of the immediate sign extended, either 0 or -1.
   int32_t sign_extend = imm < 0 ? -1 : 0;
   (assm->*op_with_carry)(dst.high_gp(), lhs.high_gp(), Operand(sign_extend),
                          LeaveCC, al);
-  if (!can_use_dst) {
-    assm->mov(dst.low_gp(), scratch);
-  }
 }
 
 template <void (TurboAssembler::*op)(Register, Register, Register, Register,
@@ -185,6 +180,10 @@ inline Simd128Register GetSimd128Register(DoubleRegister reg) {
   return QwNeonRegister::from_code(reg.code() / 2);
 }
 
+inline Simd128Register GetSimd128Register(LiftoffRegister reg) {
+  return liftoff::GetSimd128Register(reg.low_fp());
+}
+
 enum class MinOrMax : uint8_t { kMin, kMax };
 template <typename RegisterType>
 inline void EmitFloatMinOrMax(LiftoffAssembler* assm, RegisterType dst,
@@ -218,6 +217,181 @@ inline Register EnsureNoAlias(Assembler* assm, Register reg,
   return tmp;
 }
 
+inline void S128NarrowOp(LiftoffAssembler* assm, NeonDataType dt,
+                         NeonDataType sdt, LiftoffRegister dst,
+                         LiftoffRegister lhs, LiftoffRegister rhs) {
+  if (dst == lhs) {
+    assm->vqmovn(dt, sdt, dst.low_fp(), liftoff::GetSimd128Register(lhs));
+    assm->vqmovn(dt, sdt, dst.high_fp(), liftoff::GetSimd128Register(rhs));
+  } else {
+    assm->vqmovn(dt, sdt, dst.high_fp(), liftoff::GetSimd128Register(rhs));
+    assm->vqmovn(dt, sdt, dst.low_fp(), liftoff::GetSimd128Register(lhs));
+  }
+}
+
+inline void F64x2Compare(LiftoffAssembler* assm, LiftoffRegister dst,
+                         LiftoffRegister lhs, LiftoffRegister rhs,
+                         Condition cond) {
+  DCHECK(cond == eq || cond == ne || cond == lt || cond == le);
+
+  QwNeonRegister dest = liftoff::GetSimd128Register(dst);
+  QwNeonRegister left = liftoff::GetSimd128Register(lhs);
+  QwNeonRegister right = liftoff::GetSimd128Register(rhs);
+  UseScratchRegisterScope temps(assm);
+  Register scratch = temps.Acquire();
+
+  assm->mov(scratch, Operand(0));
+  assm->VFPCompareAndSetFlags(left.low(), right.low());
+  assm->mov(scratch, Operand(-1), LeaveCC, cond);
+  if (cond == lt || cond == le) {
+    // Check for NaN.
+    assm->mov(scratch, Operand(0), LeaveCC, vs);
+  }
+  assm->vmov(dest.low(), scratch, scratch);
+
+  assm->mov(scratch, Operand(0));
+  assm->VFPCompareAndSetFlags(left.high(), right.high());
+  assm->mov(scratch, Operand(-1), LeaveCC, cond);
+  if (cond == lt || cond == le) {
+    // Check for NaN.
+    assm->mov(scratch, Operand(0), LeaveCC, vs);
+  }
+  assm->vmov(dest.high(), scratch, scratch);
+}
+
+inline void Store(LiftoffAssembler* assm, LiftoffRegister src, MemOperand dst,
+                  ValueType type) {
+#ifdef DEBUG
+  // The {str} instruction needs a temp register when the immediate in the
+  // provided MemOperand does not fit into 12 bits. This happens for large stack
+  // frames. This DCHECK checks that the temp register is available when needed.
+  DCHECK(UseScratchRegisterScope{assm}.CanAcquire());
+#endif
+  switch (type.kind()) {
+    case ValueType::kI32:
+      assm->str(src.gp(), dst);
+      break;
+    case ValueType::kI64:
+      // Positive offsets should be lowered to kI32.
+      assm->str(src.low_gp(), MemOperand(dst.rn(), dst.offset()));
+      assm->str(
+          src.high_gp(),
+          MemOperand(dst.rn(), dst.offset() + liftoff::kHalfStackSlotSize));
+      break;
+    case ValueType::kF32:
+      assm->vstr(liftoff::GetFloatRegister(src.fp()), dst);
+      break;
+    case ValueType::kF64:
+      assm->vstr(src.fp(), dst);
+      break;
+    case ValueType::kS128: {
+      UseScratchRegisterScope temps(assm);
+      Register addr = liftoff::CalculateActualAddress(assm, &temps, dst.rn(),
+                                                      no_reg, dst.offset());
+      assm->vst1(Neon8, NeonListOperand(src.low_fp(), 2), NeonMemOperand(addr));
+      break;
+    }
+    default:
+      UNREACHABLE();
+  }
+}
+
+inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, MemOperand src,
+                 ValueType type) {
+  switch (type.kind()) {
+    case ValueType::kI32:
+      assm->ldr(dst.gp(), src);
+      break;
+    case ValueType::kI64:
+      assm->ldr(dst.low_gp(), MemOperand(src.rn(), src.offset()));
+      assm->ldr(
+          dst.high_gp(),
+          MemOperand(src.rn(), src.offset() + liftoff::kHalfStackSlotSize));
+      break;
+    case ValueType::kF32:
+      assm->vldr(liftoff::GetFloatRegister(dst.fp()), src);
+      break;
+    case ValueType::kF64:
+      assm->vldr(dst.fp(), src);
+      break;
+    case ValueType::kS128: {
+      // Get memory address of slot to fill from.
+      UseScratchRegisterScope temps(assm);
+      Register addr = liftoff::CalculateActualAddress(assm, &temps, src.rn(),
+                                                      no_reg, src.offset());
+      assm->vld1(Neon8, NeonListOperand(dst.low_fp(), 2), NeonMemOperand(addr));
+      break;
+    }
+    default:
+      UNREACHABLE();
+  }
+}
+
+constexpr int MaskFromNeonDataType(NeonDataType dt) {
+  switch (dt) {
+    case NeonS8:
+    case NeonU8:
+      return 7;
+    case NeonS16:
+    case NeonU16:
+      return 15;
+    case NeonS32:
+    case NeonU32:
+      return 31;
+    case NeonS64:
+    case NeonU64:
+      return 63;
+  }
+}
+
+enum ShiftDirection { kLeft, kRight };
+
+template <ShiftDirection dir = kLeft, NeonDataType dt, NeonSize sz>
+inline void EmitSimdShift(LiftoffAssembler* assm, LiftoffRegister dst,
+                          LiftoffRegister lhs, LiftoffRegister rhs) {
+  constexpr int mask = MaskFromNeonDataType(dt);
+  UseScratchRegisterScope temps(assm);
+  QwNeonRegister tmp = temps.AcquireQ();
+  Register shift = temps.Acquire();
+  assm->and_(shift, rhs.gp(), Operand(mask));
+  assm->vdup(sz, tmp, shift);
+  if (dir == kRight) {
+    assm->vneg(sz, tmp, tmp);
+  }
+  assm->vshl(dt, liftoff::GetSimd128Register(dst),
+             liftoff::GetSimd128Register(lhs), tmp);
+}
+
+template <ShiftDirection dir, NeonDataType dt>
+inline void EmitSimdShiftImmediate(LiftoffAssembler* assm, LiftoffRegister dst,
+                                   LiftoffRegister lhs, int32_t rhs) {
+  // vshr by 0 is not allowed, so check for it, and only move if dst != lhs.
+  int32_t shift = rhs & MaskFromNeonDataType(dt);
+  if (shift) {
+    if (dir == kLeft) {
+      assm->vshl(dt, liftoff::GetSimd128Register(dst),
+                 liftoff::GetSimd128Register(lhs), shift);
+    } else {
+      assm->vshr(dt, liftoff::GetSimd128Register(dst),
+                 liftoff::GetSimd128Register(lhs), shift);
+    }
+  } else if (dst != lhs) {
+    assm->vmov(liftoff::GetSimd128Register(dst),
+               liftoff::GetSimd128Register(lhs));
+  }
+}
+
+inline void EmitAnyTrue(LiftoffAssembler* assm, LiftoffRegister dst,
+                        LiftoffRegister src) {
+  UseScratchRegisterScope temps(assm);
+  DwVfpRegister scratch = temps.AcquireD();
+  assm->vpmax(NeonU32, scratch, src.low_fp(), src.high_fp());
+  assm->vpmax(NeonU32, scratch, scratch, scratch);
+  assm->ExtractLane(dst.gp(), scratch, NeonS32, 0);
+  assm->cmp(dst.gp(), Operand(0));
+  assm->mov(dst.gp(), Operand(1), LeaveCC, ne);
+}
+
 }  // namespace liftoff
 
 int LiftoffAssembler::PrepareStackFrame() {
@@ -323,8 +497,8 @@ void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
       vmov(liftoff::GetFloatRegister(reg.fp()), value.to_f32_boxed());
       break;
     case ValueType::kF64: {
-      Register extra_scratch = GetUnusedRegister(kGpReg).gp();
-      vmov(reg.fp(), Double(value.to_f64_boxed().get_scalar()), extra_scratch);
+      Register extra_scratch = GetUnusedRegister(kGpReg, {}).gp();
+      vmov(reg.fp(), Double(value.to_f64_boxed().get_bits()), extra_scratch);
       break;
     }
     default:
@@ -540,98 +714,524 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
   }
 }
 
+namespace liftoff {
+#define __ lasm->
+
+inline void AtomicOp32(
+    LiftoffAssembler* lasm, Register dst_addr, Register offset_reg,
+    uint32_t offset_imm, LiftoffRegister value, LiftoffRegister result,
+    LiftoffRegList pinned,
+    void (Assembler::*load)(Register, Register, Condition),
+    void (Assembler::*store)(Register, Register, Register, Condition),
+    void (*op)(LiftoffAssembler*, Register, Register, Register)) {
+  Register store_result = pinned.set(__ GetUnusedRegister(kGpReg, pinned)).gp();
+
+  // Allocate an additional {temp} register to hold the result that should be
+  // stored to memory. Note that {temp} and {store_result} are not allowed to be
+  // the same register.
+  Register temp = pinned.set(__ GetUnusedRegister(kGpReg, pinned)).gp();
+
+  // Make sure that {result} is unique.
+  Register result_reg = result.gp();
+  if (result_reg == value.gp() || result_reg == dst_addr ||
+      result_reg == offset_reg) {
+    result_reg = __ GetUnusedRegister(kGpReg, pinned).gp();
+  }
+
+  UseScratchRegisterScope temps(lasm);
+  Register actual_addr = liftoff::CalculateActualAddress(
+      lasm, &temps, dst_addr, offset_reg, offset_imm);
+
+  __ dmb(ISH);
+  Label retry;
+  __ bind(&retry);
+  (lasm->*load)(result_reg, actual_addr, al);
+  op(lasm, temp, result_reg, value.gp());
+  (lasm->*store)(store_result, temp, actual_addr, al);
+  __ cmp(store_result, Operand(0));
+  __ b(ne, &retry);
+  __ dmb(ISH);
+  if (result_reg != result.gp()) {
+    __ mov(result.gp(), result_reg);
+  }
+}
+
+inline void Add(LiftoffAssembler* lasm, Register dst, Register lhs,
+                Register rhs) {
+  __ add(dst, lhs, rhs);
+}
+
+inline void Sub(LiftoffAssembler* lasm, Register dst, Register lhs,
+                Register rhs) {
+  __ sub(dst, lhs, rhs);
+}
+
+inline void And(LiftoffAssembler* lasm, Register dst, Register lhs,
+                Register rhs) {
+  __ and_(dst, lhs, rhs);
+}
+
+inline void Or(LiftoffAssembler* lasm, Register dst, Register lhs,
+               Register rhs) {
+  __ orr(dst, lhs, rhs);
+}
+
+inline void Xor(LiftoffAssembler* lasm, Register dst, Register lhs,
+                Register rhs) {
+  __ eor(dst, lhs, rhs);
+}
+
+inline void Exchange(LiftoffAssembler* lasm, Register dst, Register lhs,
+                     Register rhs) {
+  __ mov(dst, rhs);
+}
+
+inline void AtomicBinop32(LiftoffAssembler* lasm, Register dst_addr,
+                          Register offset_reg, uint32_t offset_imm,
+                          LiftoffRegister value, LiftoffRegister result,
+                          StoreType type,
+                          void (*op)(LiftoffAssembler*, Register, Register,
+                                     Register)) {
+  LiftoffRegList pinned =
+      LiftoffRegList::ForRegs(dst_addr, offset_reg, value, result);
+  switch (type.value()) {
+    case StoreType::kI64Store8:
+      __ LoadConstant(result.high(), WasmValue(0));
+      result = result.low();
+      value = value.low();
+      V8_FALLTHROUGH;
+    case StoreType::kI32Store8:
+      liftoff::AtomicOp32(lasm, dst_addr, offset_reg, offset_imm, value, result,
+                          pinned, &Assembler::ldrexb, &Assembler::strexb, op);
+      return;
+    case StoreType::kI64Store16:
+      __ LoadConstant(result.high(), WasmValue(0));
+      result = result.low();
+      value = value.low();
+      V8_FALLTHROUGH;
+    case StoreType::kI32Store16:
+      liftoff::AtomicOp32(lasm, dst_addr, offset_reg, offset_imm, value, result,
+                          pinned, &Assembler::ldrexh, &Assembler::strexh, op);
+      return;
+    case StoreType::kI64Store32:
+      __ LoadConstant(result.high(), WasmValue(0));
+      result = result.low();
+      value = value.low();
+      V8_FALLTHROUGH;
+    case StoreType::kI32Store:
+      liftoff::AtomicOp32(lasm, dst_addr, offset_reg, offset_imm, value, result,
+                          pinned, &Assembler::ldrex, &Assembler::strex, op);
+      return;
+    default:
+      UNREACHABLE();
+  }
+}
+
+inline void AtomicOp64(LiftoffAssembler* lasm, Register dst_addr,
+                       Register offset_reg, uint32_t offset_imm,
+                       LiftoffRegister value,
+                       base::Optional<LiftoffRegister> result,
+                       void (*op)(LiftoffAssembler*, LiftoffRegister,
+                                  LiftoffRegister, LiftoffRegister)) {
+  // strexd loads a 64 bit word into two registers. The first register needs
+  // to have an even index, e.g. r8, the second register needs to be the one
+  // with the next higher index, e.g. r9 if the first register is r8. In the
+  // following code we use the fixed register pair r8/r9 to make the code here
+  // simpler, even though other register pairs would also be possible.
+  constexpr Register dst_low = r8;
+  constexpr Register dst_high = r9;
+
+  // Make sure {dst_low} and {dst_high} are not occupied by any other value.
+  Register value_low = value.low_gp();
+  Register value_high = value.high_gp();
+  LiftoffRegList pinned = LiftoffRegList::ForRegs(
+      dst_addr, offset_reg, value_low, value_high, dst_low, dst_high);
+  __ ClearRegister(dst_low, {&dst_addr, &offset_reg, &value_low, &value_high},
+                   pinned);
+  pinned = pinned |
+           LiftoffRegList::ForRegs(dst_addr, offset_reg, value_low, value_high);
+  __ ClearRegister(dst_high, {&dst_addr, &offset_reg, &value_low, &value_high},
+                   pinned);
+  pinned = pinned |
+           LiftoffRegList::ForRegs(dst_addr, offset_reg, value_low, value_high);
+
+  // Make sure that {result}, if it exists, also does not overlap with
+  // {dst_low} and {dst_high}. We don't have to transfer the value stored in
+  // {result}.
+  Register result_low = no_reg;
+  Register result_high = no_reg;
+  if (result.has_value()) {
+    result_low = result.value().low_gp();
+    if (pinned.has(result_low)) {
+      result_low = __ GetUnusedRegister(kGpReg, pinned).gp();
+    }
+    pinned.set(result_low);
+
+    result_high = result.value().high_gp();
+    if (pinned.has(result_high)) {
+      result_high = __ GetUnusedRegister(kGpReg, pinned).gp();
+    }
+    pinned.set(result_high);
+  }
+
+  Register store_result = __ GetUnusedRegister(kGpReg, pinned).gp();
+
+  UseScratchRegisterScope temps(lasm);
+  Register actual_addr = liftoff::CalculateActualAddress(
+      lasm, &temps, dst_addr, offset_reg, offset_imm);
+
+  __ dmb(ISH);
+  Label retry;
+  __ bind(&retry);
+  // {ldrexd} is needed here so that the {strexd} instruction below can
+  // succeed. We don't need the value we are reading. We use {dst_low} and
+  // {dst_high} as the destination registers because {ldrexd} has the same
+  // restrictions on registers as {strexd}, see the comment above.
+  __ ldrexd(dst_low, dst_high, actual_addr);
+  if (result.has_value()) {
+    __ mov(result_low, dst_low);
+    __ mov(result_high, dst_high);
+  }
+  op(lasm, LiftoffRegister::ForPair(dst_low, dst_high),
+     LiftoffRegister::ForPair(dst_low, dst_high),
+     LiftoffRegister::ForPair(value_low, value_high));
+  __ strexd(store_result, dst_low, dst_high, actual_addr);
+  __ cmp(store_result, Operand(0));
+  __ b(ne, &retry);
+  __ dmb(ISH);
+
+  if (result.has_value()) {
+    if (result_low != result.value().low_gp()) {
+      __ mov(result.value().low_gp(), result_low);
+    }
+    if (result_high != result.value().high_gp()) {
+      __ mov(result.value().high_gp(), result_high);
+    }
+  }
+}
+
+inline void I64Store(LiftoffAssembler* lasm, LiftoffRegister dst,
+                     LiftoffRegister, LiftoffRegister src) {
+  __ mov(dst.low_gp(), src.low_gp());
+  __ mov(dst.high_gp(), src.high_gp());
+}
+
+#undef __
+}  // namespace liftoff
+
 void LiftoffAssembler::AtomicLoad(LiftoffRegister dst, Register src_addr,
                                   Register offset_reg, uint32_t offset_imm,
                                   LoadType type, LiftoffRegList pinned) {
-  bailout(kAtomics, "AtomicLoad");
+  if (type.value() != LoadType::kI64Load) {
+    Load(dst, src_addr, offset_reg, offset_imm, type, pinned, nullptr, true);
+    dmb(ISH);
+    return;
+  }
+  // ldrexd loads a 64 bit word into two registers. The first register needs to
+  // have an even index, e.g. r8, the second register needs to be the one with
+  // the next higher index, e.g. r9 if the first register is r8. In the
+  // following code we use the fixed register pair r8/r9 to make the code here
+  // simpler, even though other register pairs would also be possible.
+  constexpr Register dst_low = r8;
+  constexpr Register dst_high = r9;
+  if (cache_state()->is_used(LiftoffRegister(dst_low))) {
+    SpillRegister(LiftoffRegister(dst_low));
+  }
+  if (cache_state()->is_used(LiftoffRegister(dst_high))) {
+    SpillRegister(LiftoffRegister(dst_high));
+  }
+  UseScratchRegisterScope temps(this);
+  Register actual_addr = liftoff::CalculateActualAddress(
+      this, &temps, src_addr, offset_reg, offset_imm);
+  ldrexd(dst_low, dst_high, actual_addr);
+  dmb(ISH);
+
+  LiftoffAssembler::ParallelRegisterMoveTuple reg_moves[]{
+      {dst, LiftoffRegister::ForPair(dst_low, dst_high), kWasmI64}};
+  ParallelRegisterMove(ArrayVector(reg_moves));
 }
 
 void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
                                    uint32_t offset_imm, LiftoffRegister src,
                                    StoreType type, LiftoffRegList pinned) {
-  bailout(kAtomics, "AtomicStore");
+  if (type.value() == StoreType::kI64Store) {
+    liftoff::AtomicOp64(this, dst_addr, offset_reg, offset_imm, src, {},
+                        liftoff::I64Store);
+    return;
+  }
+
+  dmb(ISH);
+  Store(dst_addr, offset_reg, offset_imm, src, type, pinned, nullptr, true);
+  dmb(ISH);
+  return;
 }
 
 void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
-  bailout(kAtomics, "AtomicAdd");
+                                 LiftoffRegister result, StoreType type) {
+  if (type.value() == StoreType::kI64Store) {
+    liftoff::AtomicOp64(this, dst_addr, offset_reg, offset_imm, value, {result},
+                        liftoff::I64Binop<&Assembler::add, &Assembler::adc>);
+    return;
+  }
+  liftoff::AtomicBinop32(this, dst_addr, offset_reg, offset_imm, value, result,
+                         type, &liftoff::Add);
 }
 
 void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
-  bailout(kAtomics, "AtomicSub");
+                                 LiftoffRegister result, StoreType type) {
+  if (type.value() == StoreType::kI64Store) {
+    liftoff::AtomicOp64(this, dst_addr, offset_reg, offset_imm, value, {result},
+                        liftoff::I64Binop<&Assembler::sub, &Assembler::sbc>);
+    return;
+  }
+  liftoff::AtomicBinop32(this, dst_addr, offset_reg, offset_imm, value, result,
+                         type, &liftoff::Sub);
 }
 
 void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
-  bailout(kAtomics, "AtomicAnd");
+                                 LiftoffRegister result, StoreType type) {
+  if (type.value() == StoreType::kI64Store) {
+    liftoff::AtomicOp64(this, dst_addr, offset_reg, offset_imm, value, {result},
+                        liftoff::I64Binop<&Assembler::and_, &Assembler::and_>);
+    return;
+  }
+  liftoff::AtomicBinop32(this, dst_addr, offset_reg, offset_imm, value, result,
+                         type, &liftoff::And);
 }
 
 void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
                                 uint32_t offset_imm, LiftoffRegister value,
-                                StoreType type) {
-  bailout(kAtomics, "AtomicOr");
+                                LiftoffRegister result, StoreType type) {
+  if (type.value() == StoreType::kI64Store) {
+    liftoff::AtomicOp64(this, dst_addr, offset_reg, offset_imm, value, {result},
+                        liftoff::I64Binop<&Assembler::orr, &Assembler::orr>);
+    return;
+  }
+  liftoff::AtomicBinop32(this, dst_addr, offset_reg, offset_imm, value, result,
+                         type, &liftoff::Or);
 }
 
 void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
-  bailout(kAtomics, "AtomicXor");
+                                 LiftoffRegister result, StoreType type) {
+  if (type.value() == StoreType::kI64Store) {
+    liftoff::AtomicOp64(this, dst_addr, offset_reg, offset_imm, value, {result},
+                        liftoff::I64Binop<&Assembler::eor, &Assembler::eor>);
+    return;
+  }
+  liftoff::AtomicBinop32(this, dst_addr, offset_reg, offset_imm, value, result,
+                         type, &liftoff::Xor);
 }
 
 void LiftoffAssembler::AtomicExchange(Register dst_addr, Register offset_reg,
                                       uint32_t offset_imm,
-                                      LiftoffRegister value, StoreType type) {
-  bailout(kAtomics, "AtomicExchange");
+                                      LiftoffRegister value,
+                                      LiftoffRegister result, StoreType type) {
+  if (type.value() == StoreType::kI64Store) {
+    liftoff::AtomicOp64(this, dst_addr, offset_reg, offset_imm, value, {result},
+                        liftoff::I64Store);
+    return;
+  }
+  liftoff::AtomicBinop32(this, dst_addr, offset_reg, offset_imm, value, result,
+                         type, &liftoff::Exchange);
 }
 
+namespace liftoff {
+#define __ lasm->
+
+inline void AtomicI64CompareExchange(LiftoffAssembler* lasm,
+                                     Register dst_addr_reg, Register offset_reg,
+                                     uint32_t offset_imm,
+                                     LiftoffRegister expected,
+                                     LiftoffRegister new_value,
+                                     LiftoffRegister result) {
+  // To implement I64AtomicCompareExchange, we nearly need all registers, with
+  // some registers having special constraints, e.g. like for {new_value} and
+  // {result} the low-word register has to have an even register code, and the
+  // high-word has to be in the next higher register. To avoid complicated
+  // register allocation code here, we just assign fixed registers to all
+  // values here, and then move all values into the correct register.
+  Register dst_addr = r0;
+  Register offset = r1;
+  Register result_low = r4;
+  Register result_high = r5;
+  Register new_value_low = r2;
+  Register new_value_high = r3;
+  Register store_result = r6;
+  Register expected_low = r8;
+  Register expected_high = r9;
+
+  // We spill all registers, so that we can re-assign them afterwards.
+  __ SpillRegisters(dst_addr, offset, result_low, result_high, new_value_low,
+                    new_value_high, store_result, expected_low, expected_high);
+
+  LiftoffAssembler::ParallelRegisterMoveTuple reg_moves[]{
+      {LiftoffRegister::ForPair(new_value_low, new_value_high), new_value,
+       kWasmI64},
+      {LiftoffRegister::ForPair(expected_low, expected_high), expected,
+       kWasmI64},
+      {LiftoffRegister(dst_addr), LiftoffRegister(dst_addr_reg), kWasmI32},
+      {LiftoffRegister(offset),
+       LiftoffRegister(offset_reg != no_reg ? offset_reg : offset), kWasmI32}};
+  __ ParallelRegisterMove(ArrayVector(reg_moves));
+
+  {
+    UseScratchRegisterScope temps(lasm);
+    Register temp = liftoff::CalculateActualAddress(
+        lasm, &temps, dst_addr, offset_reg == no_reg ? no_reg : offset,
+        offset_imm, dst_addr);
+    // Make sure the actual address is stored in the right register.
+    DCHECK_EQ(dst_addr, temp);
+    USE(temp);
+  }
+
+  Label retry;
+  Label done;
+  __ dmb(ISH);
+  __ bind(&retry);
+  __ ldrexd(result_low, result_high, dst_addr);
+  __ cmp(result_low, expected_low);
+  __ b(ne, &done);
+  __ cmp(result_high, expected_high);
+  __ b(ne, &done);
+  __ strexd(store_result, new_value_low, new_value_high, dst_addr);
+  __ cmp(store_result, Operand(0));
+  __ b(ne, &retry);
+  __ dmb(ISH);
+  __ bind(&done);
+
+  LiftoffAssembler::ParallelRegisterMoveTuple reg_moves_result[]{
+      {result, LiftoffRegister::ForPair(result_low, result_high), kWasmI64}};
+  __ ParallelRegisterMove(ArrayVector(reg_moves_result));
+}
+#undef __
+}  // namespace liftoff
+
 void LiftoffAssembler::AtomicCompareExchange(
     Register dst_addr, Register offset_reg, uint32_t offset_imm,
     LiftoffRegister expected, LiftoffRegister new_value, LiftoffRegister result,
     StoreType type) {
-  bailout(kAtomics, "AtomicCompareExchange");
-}
-
-void LiftoffAssembler::AtomicFence() { dmb(ISH); }
+  if (type.value() == StoreType::kI64Store) {
+    liftoff::AtomicI64CompareExchange(this, dst_addr, offset_reg, offset_imm,
+                                      expected, new_value, result);
+    return;
+  }
 
-void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
-                                           uint32_t caller_slot_idx,
-                                           ValueType type) {
-  int32_t offset = (caller_slot_idx + 1) * kSystemPointerSize;
-  MemOperand src(fp, offset);
-  switch (type.kind()) {
-    case ValueType::kI32:
-      ldr(dst.gp(), src);
-      break;
-    case ValueType::kI64:
-      ldr(dst.low_gp(), src);
-      ldr(dst.high_gp(), MemOperand(fp, offset + kSystemPointerSize));
-      break;
-    case ValueType::kF32:
-      vldr(liftoff::GetFloatRegister(dst.fp()), src);
+  // The other versions of CompareExchange can share code, but need special load
+  // and store instructions.
+  void (Assembler::*load)(Register, Register, Condition) = nullptr;
+  void (Assembler::*store)(Register, Register, Register, Condition) = nullptr;
+
+  LiftoffRegList pinned = LiftoffRegList::ForRegs(dst_addr, offset_reg);
+  // We need to remember the high word of {result}, so we can set it to zero in
+  // the end if necessary.
+  Register result_high = no_reg;
+  switch (type.value()) {
+    case StoreType::kI64Store8:
+      result_high = result.high_gp();
+      result = result.low();
+      new_value = new_value.low();
+      expected = expected.low();
+      V8_FALLTHROUGH;
+    case StoreType::kI32Store8:
+      load = &Assembler::ldrexb;
+      store = &Assembler::strexb;
+      // We have to clear the high bits of {expected}, as we can only do a
+      // 32-bit comparison. If the {expected} register is used, we spill it
+      // first.
+      if (cache_state()->is_used(expected)) {
+        SpillRegister(expected);
+      }
+      uxtb(expected.gp(), expected.gp());
       break;
-    case ValueType::kF64:
-      vldr(dst.fp(), src);
+    case StoreType::kI64Store16:
+      result_high = result.high_gp();
+      result = result.low();
+      new_value = new_value.low();
+      expected = expected.low();
+      V8_FALLTHROUGH;
+    case StoreType::kI32Store16:
+      load = &Assembler::ldrexh;
+      store = &Assembler::strexh;
+      // We have to clear the high bits of {expected}, as we can only do a
+      // 32-bit comparison. If the {expected} register is used, we spill it
+      // first.
+      if (cache_state()->is_used(expected)) {
+        SpillRegister(expected);
+      }
+      uxth(expected.gp(), expected.gp());
       break;
-    case ValueType::kS128: {
-      UseScratchRegisterScope temps(this);
-      Register addr = liftoff::CalculateActualAddress(this, &temps, src.rn(),
-                                                      no_reg, src.offset());
-      vld1(Neon8, NeonListOperand(dst.low_fp(), 2), NeonMemOperand(addr));
+    case StoreType::kI64Store32:
+      result_high = result.high_gp();
+      result = result.low();
+      new_value = new_value.low();
+      expected = expected.low();
+      V8_FALLTHROUGH;
+    case StoreType::kI32Store:
+      load = &Assembler::ldrex;
+      store = &Assembler::strex;
       break;
-    }
     default:
       UNREACHABLE();
   }
+  pinned.set(new_value);
+  pinned.set(expected);
+
+  Register result_reg = result.gp();
+  if (pinned.has(result)) {
+    result_reg = GetUnusedRegister(kGpReg, pinned).gp();
+  }
+  pinned.set(LiftoffRegister(result));
+  Register store_result = GetUnusedRegister(kGpReg, pinned).gp();
+
+  UseScratchRegisterScope temps(this);
+  Register actual_addr = liftoff::CalculateActualAddress(
+      this, &temps, dst_addr, offset_reg, offset_imm);
+
+  Label retry;
+  Label done;
+  dmb(ISH);
+  bind(&retry);
+  (this->*load)(result.gp(), actual_addr, al);
+  cmp(result.gp(), expected.gp());
+  b(ne, &done);
+  (this->*store)(store_result, new_value.gp(), actual_addr, al);
+  cmp(store_result, Operand(0));
+  b(ne, &retry);
+  dmb(ISH);
+  bind(&done);
+
+  if (result.gp() != result_reg) {
+    mov(result.gp(), result_reg);
+  }
+  if (result_high != no_reg) {
+    LoadConstant(LiftoffRegister(result_high), WasmValue(0));
+  }
+}
+
+void LiftoffAssembler::AtomicFence() { dmb(ISH); }
+
+void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
+                                           uint32_t caller_slot_idx,
+                                           ValueType type) {
+  MemOperand src(fp, (caller_slot_idx + 1) * kSystemPointerSize);
+  liftoff::Load(this, dst, src, type);
+}
+
+void LiftoffAssembler::StoreCallerFrameSlot(LiftoffRegister src,
+                                            uint32_t caller_slot_idx,
+                                            ValueType type) {
+  MemOperand dst(fp, (caller_slot_idx + 1) * kSystemPointerSize);
+  liftoff::Store(this, src, dst, type);
 }
 
 void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
   DCHECK_NE(dst_offset, src_offset);
-  LiftoffRegister reg = GetUnusedRegister(reg_class_for(type));
+  LiftoffRegister reg = GetUnusedRegister(reg_class_for(type), {});
   Fill(reg, src_offset, type);
   Spill(dst_offset, reg, type);
 }
@@ -656,32 +1256,16 @@ void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
 }
 
 void LiftoffAssembler::Spill(int offset, LiftoffRegister reg, ValueType type) {
+#ifdef DEBUG
+  // The {str} instruction needs a temp register when the immediate in the
+  // provided MemOperand does not fit into 12 bits. This happens for large stack
+  // frames. This DCHECK checks that the temp register is available when needed.
+  DCHECK(UseScratchRegisterScope{this}.CanAcquire());
+#endif
+  DCHECK_LT(0, offset);
   RecordUsedSpillOffset(offset);
-  MemOperand dst = liftoff::GetStackSlot(offset);
-  switch (type.kind()) {
-    case ValueType::kI32:
-      str(reg.gp(), dst);
-      break;
-    case ValueType::kI64:
-      str(reg.low_gp(), liftoff::GetHalfStackSlot(offset, kLowWord));
-      str(reg.high_gp(), liftoff::GetHalfStackSlot(offset, kHighWord));
-      break;
-    case ValueType::kF32:
-      vstr(liftoff::GetFloatRegister(reg.fp()), dst);
-      break;
-    case ValueType::kF64:
-      vstr(reg.fp(), dst);
-      break;
-    case ValueType::kS128: {
-      UseScratchRegisterScope temps(this);
-      Register addr = liftoff::CalculateActualAddress(this, &temps, dst.rn(),
-                                                      no_reg, dst.offset());
-      vst1(Neon8, NeonListOperand(reg.low_fp(), 2), NeonMemOperand(addr));
-      break;
-    }
-    default:
-      UNREACHABLE();
-  }
+  MemOperand dst(fp, -offset);
+  liftoff::Store(this, reg, dst, type);
 }
 
 void LiftoffAssembler::Spill(int offset, WasmValue value) {
@@ -692,7 +1276,7 @@ void LiftoffAssembler::Spill(int offset, WasmValue value) {
   // The scratch register will be required by str if multiple instructions
   // are required to encode the offset, and so we cannot use it in that case.
   if (!ImmediateFitsAddrMode2Instruction(dst.offset())) {
-    src = GetUnusedRegister(kGpReg).gp();
+    src = GetUnusedRegister(kGpReg, {}).gp();
   } else {
     src = temps.Acquire();
   }
@@ -717,32 +1301,7 @@ void LiftoffAssembler::Spill(int offset, WasmValue value) {
 }
 
 void LiftoffAssembler::Fill(LiftoffRegister reg, int offset, ValueType type) {
-  switch (type.kind()) {
-    case ValueType::kI32:
-      ldr(reg.gp(), liftoff::GetStackSlot(offset));
-      break;
-    case ValueType::kI64:
-      ldr(reg.low_gp(), liftoff::GetHalfStackSlot(offset, kLowWord));
-      ldr(reg.high_gp(), liftoff::GetHalfStackSlot(offset, kHighWord));
-      break;
-    case ValueType::kF32:
-      vldr(liftoff::GetFloatRegister(reg.fp()), liftoff::GetStackSlot(offset));
-      break;
-    case ValueType::kF64:
-      vldr(reg.fp(), liftoff::GetStackSlot(offset));
-      break;
-    case ValueType::kS128: {
-      // Get memory address of slot to fill from.
-      MemOperand slot = liftoff::GetStackSlot(offset);
-      UseScratchRegisterScope temps(this);
-      Register addr = liftoff::CalculateActualAddress(this, &temps, slot.rn(),
-                                                      no_reg, slot.offset());
-      vld1(Neon8, NeonListOperand(reg.low_fp(), 2), NeonMemOperand(addr));
-      break;
-    }
-    default:
-      UNREACHABLE();
-  }
+  liftoff::Load(this, reg, liftoff::GetStackSlot(offset), type);
 }
 
 void LiftoffAssembler::FillI64Half(Register reg, int offset, RegPairHalf half) {
@@ -791,27 +1350,27 @@ void LiftoffAssembler::FillStackSlotsWithZero(int start, int size) {
                                      Register rhs) {             \
     instruction(dst, lhs, rhs);                                  \
   }
-#define I32_BINOP_I(name, instruction)                           \
-  I32_BINOP(name, instruction)                                   \
-  void LiftoffAssembler::emit_##name(Register dst, Register lhs, \
-                                     int32_t imm) {              \
-    instruction(dst, lhs, Operand(imm));                         \
-  }
-#define I32_SHIFTOP(name, instruction)                           \
-  void LiftoffAssembler::emit_##name(Register dst, Register src, \
-                                     Register amount) {          \
-    UseScratchRegisterScope temps(this);                         \
-    Register scratch = temps.Acquire();                          \
-    and_(scratch, amount, Operand(0x1f));                        \
-    instruction(dst, src, Operand(scratch));                     \
-  }                                                              \
-  void LiftoffAssembler::emit_##name(Register dst, Register src, \
-                                     int32_t amount) {           \
-    if (V8_LIKELY((amount & 31) != 0)) {                         \
-      instruction(dst, src, Operand(amount & 31));               \
-    } else if (dst != src) {                                     \
-      mov(dst, src);                                             \
-    }                                                            \
+#define I32_BINOP_I(name, instruction)                              \
+  I32_BINOP(name, instruction)                                      \
+  void LiftoffAssembler::emit_##name##i(Register dst, Register lhs, \
+                                        int32_t imm) {              \
+    instruction(dst, lhs, Operand(imm));                            \
+  }
+#define I32_SHIFTOP(name, instruction)                              \
+  void LiftoffAssembler::emit_##name(Register dst, Register src,    \
+                                     Register amount) {             \
+    UseScratchRegisterScope temps(this);                            \
+    Register scratch = temps.Acquire();                             \
+    and_(scratch, amount, Operand(0x1f));                           \
+    instruction(dst, src, Operand(scratch));                        \
+  }                                                                 \
+  void LiftoffAssembler::emit_##name##i(Register dst, Register src, \
+                                        int32_t amount) {           \
+    if (V8_LIKELY((amount & 31) != 0)) {                            \
+      instruction(dst, src, Operand(amount & 31));                  \
+    } else if (dst != src) {                                        \
+      mov(dst, src);                                                \
+    }                                                               \
   }
 #define FP32_UNOP(name, instruction)                                           \
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
@@ -997,8 +1556,8 @@ void LiftoffAssembler::emit_i64_add(LiftoffRegister dst, LiftoffRegister lhs,
   liftoff::I64Binop<&Assembler::add, &Assembler::adc>(this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i64_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                    int32_t imm) {
+void LiftoffAssembler::emit_i64_addi(LiftoffRegister dst, LiftoffRegister lhs,
+                                     int32_t imm) {
   liftoff::I64BinopI<&Assembler::add, &Assembler::adc>(this, dst, lhs, imm);
 }
 
@@ -1057,8 +1616,8 @@ void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
   liftoff::I64Shiftop<&TurboAssembler::LslPair, true>(this, dst, src, amount);
 }
 
-void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i64_shli(LiftoffRegister dst, LiftoffRegister src,
+                                     int32_t amount) {
   UseScratchRegisterScope temps(this);
   // {src.low_gp()} will still be needed after writing {dst.high_gp()}.
   Register src_low =
@@ -1072,8 +1631,8 @@ void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
   liftoff::I64Shiftop<&TurboAssembler::AsrPair, false>(this, dst, src, amount);
 }
 
-void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i64_sari(LiftoffRegister dst, LiftoffRegister src,
+                                     int32_t amount) {
   UseScratchRegisterScope temps(this);
   // {src.high_gp()} will still be needed after writing {dst.low_gp()}.
   Register src_high =
@@ -1087,8 +1646,8 @@ void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
   liftoff::I64Shiftop<&TurboAssembler::LsrPair, false>(this, dst, src, amount);
 }
 
-void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i64_shri(LiftoffRegister dst, LiftoffRegister src,
+                                     int32_t amount) {
   UseScratchRegisterScope temps(this);
   // {src.high_gp()} will still be needed after writing {dst.low_gp()}.
   Register src_high =
@@ -1259,7 +1818,7 @@ void LiftoffAssembler::emit_f32_copysign(DoubleRegister dst, DoubleRegister lhs,
                                          DoubleRegister rhs) {
   constexpr uint32_t kF32SignBit = uint32_t{1} << 31;
   UseScratchRegisterScope temps(this);
-  Register scratch = GetUnusedRegister(kGpReg).gp();
+  Register scratch = GetUnusedRegister(kGpReg, {}).gp();
   Register scratch2 = temps.Acquire();
   VmovLow(scratch, lhs);
   // Clear sign bit in {scratch}.
@@ -1278,7 +1837,7 @@ void LiftoffAssembler::emit_f64_copysign(DoubleRegister dst, DoubleRegister lhs,
   // On arm, we cannot hold the whole f64 value in a gp register, so we just
   // operate on the upper half (UH).
   UseScratchRegisterScope temps(this);
-  Register scratch = GetUnusedRegister(kGpReg).gp();
+  Register scratch = GetUnusedRegister(kGpReg, {}).gp();
   Register scratch2 = temps.Acquire();
   VmovHigh(scratch, lhs);
   // Clear sign bit in {scratch}.
@@ -1363,6 +1922,38 @@ bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
       b(trap, ge);
       return true;
     }
+    case kExprI32SConvertSatF32: {
+      UseScratchRegisterScope temps(this);
+      SwVfpRegister scratch_f = temps.AcquireS();
+      vcvt_s32_f32(
+          scratch_f,
+          liftoff::GetFloatRegister(src.fp()));  // f32 -> i32 round to zero.
+      vmov(dst.gp(), scratch_f);
+      return true;
+    }
+    case kExprI32UConvertSatF32: {
+      UseScratchRegisterScope temps(this);
+      SwVfpRegister scratch_f = temps.AcquireS();
+      vcvt_u32_f32(
+          scratch_f,
+          liftoff::GetFloatRegister(src.fp()));  // f32 -> u32 round to zero.
+      vmov(dst.gp(), scratch_f);
+      return true;
+    }
+    case kExprI32SConvertSatF64: {
+      UseScratchRegisterScope temps(this);
+      SwVfpRegister scratch_f = temps.AcquireS();
+      vcvt_s32_f64(scratch_f, src.fp());  // f64 -> i32 round to zero.
+      vmov(dst.gp(), scratch_f);
+      return true;
+    }
+    case kExprI32UConvertSatF64: {
+      UseScratchRegisterScope temps(this);
+      SwVfpRegister scratch_f = temps.AcquireS();
+      vcvt_u32_f64(scratch_f, src.fp());  // f64 -> u32 round to zero.
+      vmov(dst.gp(), scratch_f);
+      return true;
+    }
     case kExprI32ReinterpretF32:
       vmov(dst.gp(), liftoff::GetFloatRegister(src.fp()));
       return true;
@@ -1415,10 +2006,14 @@ bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
     case kExprF64UConvertI64:
     case kExprI64SConvertF32:
     case kExprI64UConvertF32:
+    case kExprI64SConvertSatF32:
+    case kExprI64UConvertSatF32:
     case kExprF32SConvertI64:
     case kExprF32UConvertI64:
     case kExprI64SConvertF64:
     case kExprI64UConvertF64:
+    case kExprI64SConvertSatF64:
+    case kExprI64UConvertSatF64:
       // These cases can be handled by the C fallback function.
       return false;
     default:
@@ -1553,6 +2148,79 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   }
 }
 
+void LiftoffAssembler::LoadTransform(LiftoffRegister dst, Register src_addr,
+                                     Register offset_reg, uint32_t offset_imm,
+                                     LoadType type,
+                                     LoadTransformationKind transform,
+                                     uint32_t* protected_load_pc) {
+  UseScratchRegisterScope temps(this);
+  Register actual_src_addr = liftoff::CalculateActualAddress(
+      this, &temps, src_addr, offset_reg, offset_imm);
+  *protected_load_pc = pc_offset();
+  MachineType memtype = type.mem_type();
+
+  if (transform == LoadTransformationKind::kExtend) {
+    if (memtype == MachineType::Int8()) {
+      vld1(Neon8, NeonListOperand(dst.low_fp()),
+           NeonMemOperand(actual_src_addr));
+      vmovl(NeonS8, liftoff::GetSimd128Register(dst), dst.low_fp());
+    } else if (memtype == MachineType::Uint8()) {
+      vld1(Neon8, NeonListOperand(dst.low_fp()),
+           NeonMemOperand(actual_src_addr));
+      vmovl(NeonU8, liftoff::GetSimd128Register(dst), dst.low_fp());
+    } else if (memtype == MachineType::Int16()) {
+      vld1(Neon16, NeonListOperand(dst.low_fp()),
+           NeonMemOperand(actual_src_addr));
+      vmovl(NeonS16, liftoff::GetSimd128Register(dst), dst.low_fp());
+    } else if (memtype == MachineType::Uint16()) {
+      vld1(Neon16, NeonListOperand(dst.low_fp()),
+           NeonMemOperand(actual_src_addr));
+      vmovl(NeonU16, liftoff::GetSimd128Register(dst), dst.low_fp());
+    } else if (memtype == MachineType::Int32()) {
+      vld1(Neon32, NeonListOperand(dst.low_fp()),
+           NeonMemOperand(actual_src_addr));
+      vmovl(NeonS32, liftoff::GetSimd128Register(dst), dst.low_fp());
+    } else if (memtype == MachineType::Uint32()) {
+      vld1(Neon32, NeonListOperand(dst.low_fp()),
+           NeonMemOperand(actual_src_addr));
+      vmovl(NeonU32, liftoff::GetSimd128Register(dst), dst.low_fp());
+    }
+  } else {
+    DCHECK_EQ(LoadTransformationKind::kSplat, transform);
+    if (memtype == MachineType::Int8()) {
+      vld1r(Neon8, NeonListOperand(liftoff::GetSimd128Register(dst)),
+            NeonMemOperand(actual_src_addr));
+    } else if (memtype == MachineType::Int16()) {
+      vld1r(Neon16, NeonListOperand(liftoff::GetSimd128Register(dst)),
+            NeonMemOperand(actual_src_addr));
+    } else if (memtype == MachineType::Int32()) {
+      vld1r(Neon32, NeonListOperand(liftoff::GetSimd128Register(dst)),
+            NeonMemOperand(actual_src_addr));
+    } else if (memtype == MachineType::Int64()) {
+      vld1(Neon32, NeonListOperand(dst.low_fp()),
+           NeonMemOperand(actual_src_addr));
+      TurboAssembler::Move(dst.high_fp(), dst.low_fp());
+    }
+  }
+}
+
+void LiftoffAssembler::emit_s8x16_swizzle(LiftoffRegister dst,
+                                          LiftoffRegister lhs,
+                                          LiftoffRegister rhs) {
+  UseScratchRegisterScope temps(this);
+
+  NeonListOperand table(liftoff::GetSimd128Register(lhs));
+  if (dst == lhs) {
+    // dst will be overwritten, so keep the table somewhere else.
+    QwNeonRegister tbl = temps.AcquireQ();
+    TurboAssembler::Move(tbl, liftoff::GetSimd128Register(lhs));
+    table = NeonListOperand(tbl);
+  }
+
+  vtbl(dst.low_fp(), table, rhs.low_fp());
+  vtbl(dst.high_fp(), table, rhs.high_fp());
+}
+
 void LiftoffAssembler::emit_f64x2_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
   TurboAssembler::Move(dst.low_fp(), src.fp());
@@ -1562,17 +2230,33 @@ void LiftoffAssembler::emit_f64x2_splat(LiftoffRegister dst,
 void LiftoffAssembler::emit_f64x2_extract_lane(LiftoffRegister dst,
                                                LiftoffRegister lhs,
                                                uint8_t imm_lane_idx) {
-  ExtractLane(dst.fp(), liftoff::GetSimd128Register(lhs.low_fp()),
-              imm_lane_idx);
+  ExtractLane(dst.fp(), liftoff::GetSimd128Register(lhs), imm_lane_idx);
 }
 
 void LiftoffAssembler::emit_f64x2_replace_lane(LiftoffRegister dst,
                                                LiftoffRegister src1,
                                                LiftoffRegister src2,
                                                uint8_t imm_lane_idx) {
-  ReplaceLane(liftoff::GetSimd128Register(dst.low_fp()),
-              liftoff::GetSimd128Register(src1.low_fp()), src2.fp(),
-              imm_lane_idx);
+  ReplaceLane(liftoff::GetSimd128Register(dst),
+              liftoff::GetSimd128Register(src1), src2.fp(), imm_lane_idx);
+}
+
+void LiftoffAssembler::emit_f64x2_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  vabs(dst.low_fp(), src.low_fp());
+  vabs(dst.high_fp(), src.high_fp());
+}
+
+void LiftoffAssembler::emit_f64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  vneg(dst.low_fp(), src.low_fp());
+  vneg(dst.high_fp(), src.high_fp());
+}
+
+void LiftoffAssembler::emit_f64x2_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  vsqrt(dst.low_fp(), src.low_fp());
+  vsqrt(dst.high_fp(), src.high_fp());
 }
 
 void LiftoffAssembler::emit_f64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
@@ -1589,52 +2273,138 @@ void LiftoffAssembler::emit_f64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
 
 void LiftoffAssembler::emit_f64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  bailout(kSimd, "f64x2mul");
+  vmul(dst.low_fp(), lhs.low_fp(), rhs.low_fp());
+  vmul(dst.high_fp(), lhs.high_fp(), rhs.high_fp());
 }
 
-void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  vdup(Neon32, liftoff::GetSimd128Register(dst.low_fp()), src.fp(), 0);
+void LiftoffAssembler::emit_f64x2_div(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  vdiv(dst.low_fp(), lhs.low_fp(), rhs.low_fp());
+  vdiv(dst.high_fp(), lhs.high_fp(), rhs.high_fp());
+}
+
+void LiftoffAssembler::emit_f64x2_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  Simd128Register dest = liftoff::GetSimd128Register(dst);
+  Simd128Register left = liftoff::GetSimd128Register(lhs);
+  Simd128Register right = liftoff::GetSimd128Register(rhs);
+
+  liftoff::EmitFloatMinOrMax(this, dest.low(), left.low(), right.low(),
+                             liftoff::MinOrMax::kMin);
+  liftoff::EmitFloatMinOrMax(this, dest.high(), left.high(), right.high(),
+                             liftoff::MinOrMax::kMin);
+}
+
+void LiftoffAssembler::emit_f64x2_max(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  Simd128Register dest = liftoff::GetSimd128Register(dst);
+  Simd128Register left = liftoff::GetSimd128Register(lhs);
+  Simd128Register right = liftoff::GetSimd128Register(rhs);
+
+  liftoff::EmitFloatMinOrMax(this, dest.low(), left.low(), right.low(),
+                             liftoff::MinOrMax::kMax);
+  liftoff::EmitFloatMinOrMax(this, dest.high(), left.high(), right.high(),
+                             liftoff::MinOrMax::kMax);
+}
+
+void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  vdup(Neon32, liftoff::GetSimd128Register(dst), src.fp(), 0);
 }
 
 void LiftoffAssembler::emit_f32x4_extract_lane(LiftoffRegister dst,
                                                LiftoffRegister lhs,
                                                uint8_t imm_lane_idx) {
   ExtractLane(liftoff::GetFloatRegister(dst.fp()),
-              liftoff::GetSimd128Register(lhs.low_fp()), imm_lane_idx);
+              liftoff::GetSimd128Register(lhs), imm_lane_idx);
 }
 
 void LiftoffAssembler::emit_f32x4_replace_lane(LiftoffRegister dst,
                                                LiftoffRegister src1,
                                                LiftoffRegister src2,
                                                uint8_t imm_lane_idx) {
-  ReplaceLane(liftoff::GetSimd128Register(dst.low_fp()),
-              liftoff::GetSimd128Register(src1.low_fp()),
+  ReplaceLane(liftoff::GetSimd128Register(dst),
+              liftoff::GetSimd128Register(src1),
               liftoff::GetFloatRegister(src2.fp()), imm_lane_idx);
 }
 
+void LiftoffAssembler::emit_f32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  vabs(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(src));
+}
+
+void LiftoffAssembler::emit_f32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  vneg(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(src));
+}
+
+void LiftoffAssembler::emit_f32x4_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  // The list of d registers available to us is from d0 to d15, which always
+  // maps to 2 s registers.
+  LowDwVfpRegister dst_low = LowDwVfpRegister::from_code(dst.low_fp().code());
+  LowDwVfpRegister src_low = LowDwVfpRegister::from_code(src.low_fp().code());
+
+  LowDwVfpRegister dst_high = LowDwVfpRegister::from_code(dst.high_fp().code());
+  LowDwVfpRegister src_high = LowDwVfpRegister::from_code(src.high_fp().code());
+
+  vsqrt(dst_low.low(), src_low.low());
+  vsqrt(dst_low.high(), src_low.high());
+  vsqrt(dst_high.low(), src_high.low());
+  vsqrt(dst_high.high(), src_high.high());
+}
+
 void LiftoffAssembler::emit_f32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  vadd(liftoff::GetSimd128Register(dst.low_fp()),
-       liftoff::GetSimd128Register(lhs.low_fp()),
-       liftoff::GetSimd128Register(rhs.low_fp()));
+  vadd(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(lhs),
+       liftoff::GetSimd128Register(rhs));
 }
 
 void LiftoffAssembler::emit_f32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  vsub(liftoff::GetSimd128Register(dst.low_fp()),
-       liftoff::GetSimd128Register(lhs.low_fp()),
-       liftoff::GetSimd128Register(rhs.low_fp()));
+  vsub(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(lhs),
+       liftoff::GetSimd128Register(rhs));
 }
 
 void LiftoffAssembler::emit_f32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  bailout(kSimd, "f32x4mul");
+  vmul(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(lhs),
+       liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_f32x4_div(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  // The list of d registers available to us is from d0 to d15, which always
+  // maps to 2 s registers.
+  LowDwVfpRegister dst_low = LowDwVfpRegister::from_code(dst.low_fp().code());
+  LowDwVfpRegister lhs_low = LowDwVfpRegister::from_code(lhs.low_fp().code());
+  LowDwVfpRegister rhs_low = LowDwVfpRegister::from_code(rhs.low_fp().code());
+
+  LowDwVfpRegister dst_high = LowDwVfpRegister::from_code(dst.high_fp().code());
+  LowDwVfpRegister lhs_high = LowDwVfpRegister::from_code(lhs.high_fp().code());
+  LowDwVfpRegister rhs_high = LowDwVfpRegister::from_code(rhs.high_fp().code());
+
+  vdiv(dst_low.low(), lhs_low.low(), rhs_low.low());
+  vdiv(dst_low.high(), lhs_low.high(), rhs_low.high());
+  vdiv(dst_high.low(), lhs_high.low(), rhs_high.low());
+  vdiv(dst_high.high(), lhs_high.high(), rhs_high.high());
+}
+
+void LiftoffAssembler::emit_f32x4_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  vmin(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(lhs),
+       liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_f32x4_max(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  vmax(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(lhs),
+       liftoff::GetSimd128Register(rhs));
 }
 
 void LiftoffAssembler::emit_i64x2_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
-  Simd128Register dst_simd = liftoff::GetSimd128Register(dst.low_fp());
+  Simd128Register dst_simd = liftoff::GetSimd128Register(dst);
   vdup(Neon32, dst_simd, src.low_gp());
   ReplaceLane(dst_simd, dst_simd, src.high_gp(), NeonS32, 1);
   ReplaceLane(dst_simd, dst_simd, src.high_gp(), NeonS32, 3);
@@ -1643,9 +2413,9 @@ void LiftoffAssembler::emit_i64x2_splat(LiftoffRegister dst,
 void LiftoffAssembler::emit_i64x2_extract_lane(LiftoffRegister dst,
                                                LiftoffRegister lhs,
                                                uint8_t imm_lane_idx) {
-  ExtractLane(dst.low_gp(), liftoff::GetSimd128Register(lhs.low_fp()), NeonS32,
+  ExtractLane(dst.low_gp(), liftoff::GetSimd128Register(lhs), NeonS32,
               imm_lane_idx * 2);
-  ExtractLane(dst.high_gp(), liftoff::GetSimd128Register(lhs.low_fp()), NeonS32,
+  ExtractLane(dst.high_gp(), liftoff::GetSimd128Register(lhs), NeonS32,
               imm_lane_idx * 2 + 1);
 }
 
@@ -1653,41 +2423,122 @@ void LiftoffAssembler::emit_i64x2_replace_lane(LiftoffRegister dst,
                                                LiftoffRegister src1,
                                                LiftoffRegister src2,
                                                uint8_t imm_lane_idx) {
-  Simd128Register dst_simd = liftoff::GetSimd128Register(dst.low_fp());
-  Simd128Register src1_simd = liftoff::GetSimd128Register(src1.low_fp());
+  Simd128Register dst_simd = liftoff::GetSimd128Register(dst);
+  Simd128Register src1_simd = liftoff::GetSimd128Register(src1);
   ReplaceLane(dst_simd, src1_simd, src2.low_gp(), NeonS32, imm_lane_idx * 2);
   ReplaceLane(dst_simd, dst_simd, src2.high_gp(), NeonS32,
               imm_lane_idx * 2 + 1);
 }
 
+void LiftoffAssembler::emit_i64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  UseScratchRegisterScope temps(this);
+  QwNeonRegister zero =
+      dst == src ? temps.AcquireQ() : liftoff::GetSimd128Register(dst);
+  vmov(zero, uint64_t{0});
+  vqsub(NeonS64, liftoff::GetSimd128Register(dst), zero,
+        liftoff::GetSimd128Register(src));
+}
+
+void LiftoffAssembler::emit_i64x2_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::kLeft, NeonS64, Neon32>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  vshl(NeonS64, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), rhs & 63);
+}
+
+void LiftoffAssembler::emit_i64x2_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::kRight, NeonS64, Neon32>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftImmediate<liftoff::kRight, NeonS64>(this, dst, lhs,
+                                                            rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::kRight, NeonU64, Neon32>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftImmediate<liftoff::kRight, NeonU64>(this, dst, lhs,
+                                                            rhs);
+}
+
 void LiftoffAssembler::emit_i64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  vadd(Neon64, liftoff::GetSimd128Register(dst.low_fp()),
-       liftoff::GetSimd128Register(lhs.low_fp()),
-       liftoff::GetSimd128Register(rhs.low_fp()));
+  vadd(Neon64, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
 }
 
 void LiftoffAssembler::emit_i64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  vsub(Neon64, liftoff::GetSimd128Register(dst.low_fp()),
-       liftoff::GetSimd128Register(lhs.low_fp()),
-       liftoff::GetSimd128Register(rhs.low_fp()));
+  vsub(Neon64, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
 }
 
 void LiftoffAssembler::emit_i64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  bailout(kSimd, "i64x2mul");
+  UseScratchRegisterScope temps(this);
+
+  QwNeonRegister dst_neon = liftoff::GetSimd128Register(dst);
+  QwNeonRegister left = liftoff::GetSimd128Register(lhs);
+  QwNeonRegister right = liftoff::GetSimd128Register(rhs);
+
+  // These temporary registers will be modified. We can directly modify lhs and
+  // rhs if they are not uesd, saving on temporaries.
+  QwNeonRegister tmp1 = left;
+  QwNeonRegister tmp2 = right;
+
+  if (cache_state()->is_used(lhs) && cache_state()->is_used(rhs)) {
+    tmp1 = temps.AcquireQ();
+    // We only have 1 scratch Q register, so acquire another ourselves.
+    LiftoffRegList pinned = LiftoffRegList::ForRegs(dst);
+    LiftoffRegister unused_pair = GetUnusedRegister(kFpRegPair, pinned);
+    tmp2 = liftoff::GetSimd128Register(unused_pair);
+  } else if (cache_state()->is_used(lhs)) {
+    tmp1 = temps.AcquireQ();
+  } else if (cache_state()->is_used(rhs)) {
+    tmp2 = temps.AcquireQ();
+  }
+
+  // Algorithm from code-generator-arm.cc, refer to comments there for details.
+  if (tmp1 != left) {
+    vmov(tmp1, left);
+  }
+  if (tmp2 != right) {
+    vmov(tmp2, right);
+  }
+
+  vtrn(Neon32, tmp1.low(), tmp1.high());
+  vtrn(Neon32, tmp2.low(), tmp2.high());
+
+  vmull(NeonU32, dst_neon, tmp1.low(), tmp2.high());
+  vmlal(NeonU32, dst_neon, tmp1.high(), tmp2.low());
+  vshl(NeonU64, dst_neon, dst_neon, 32);
+
+  vmlal(NeonU32, dst_neon, tmp1.low(), tmp2.low());
 }
 
 void LiftoffAssembler::emit_i32x4_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
-  vdup(Neon32, liftoff::GetSimd128Register(dst.low_fp()), src.gp());
+  vdup(Neon32, liftoff::GetSimd128Register(dst), src.gp());
 }
 
 void LiftoffAssembler::emit_i32x4_extract_lane(LiftoffRegister dst,
                                                LiftoffRegister lhs,
                                                uint8_t imm_lane_idx) {
-  ExtractLane(dst.gp(), liftoff::GetSimd128Register(lhs.low_fp()), NeonS32,
+  ExtractLane(dst.gp(), liftoff::GetSimd128Register(lhs), NeonS32,
               imm_lane_idx);
 }
 
@@ -1695,65 +2546,249 @@ void LiftoffAssembler::emit_i32x4_replace_lane(LiftoffRegister dst,
                                                LiftoffRegister src1,
                                                LiftoffRegister src2,
                                                uint8_t imm_lane_idx) {
-  ReplaceLane(liftoff::GetSimd128Register(dst.low_fp()),
-              liftoff::GetSimd128Register(src1.low_fp()), src2.gp(), NeonS32,
+  ReplaceLane(liftoff::GetSimd128Register(dst),
+              liftoff::GetSimd128Register(src1), src2.gp(), NeonS32,
               imm_lane_idx);
 }
 
+void LiftoffAssembler::emit_i32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  vneg(Neon32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(src));
+}
+
+void LiftoffAssembler::emit_v32x4_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAnyTrue(this, dst, src);
+}
+
+void LiftoffAssembler::emit_v32x4_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v32x4_alltrue");
+}
+
+void LiftoffAssembler::emit_i32x4_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::kLeft, NeonS32, Neon32>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  vshl(NeonS32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), rhs & 31);
+}
+
+void LiftoffAssembler::emit_i32x4_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::kRight, NeonS32, Neon32>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftImmediate<liftoff::kRight, NeonS32>(this, dst, lhs,
+                                                            rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::kRight, NeonU32, Neon32>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftImmediate<liftoff::kRight, NeonU32>(this, dst, lhs,
+                                                            rhs);
+}
+
 void LiftoffAssembler::emit_i32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  vadd(Neon32, liftoff::GetSimd128Register(dst.low_fp()),
-       liftoff::GetSimd128Register(lhs.low_fp()),
-       liftoff::GetSimd128Register(rhs.low_fp()));
+  vadd(Neon32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
 }
 
 void LiftoffAssembler::emit_i32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  vsub(Neon32, liftoff::GetSimd128Register(dst.low_fp()),
-       liftoff::GetSimd128Register(lhs.low_fp()),
-       liftoff::GetSimd128Register(rhs.low_fp()));
+  vsub(Neon32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
 }
 
 void LiftoffAssembler::emit_i32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  bailout(kSimd, "i32x4mul");
+  vmul(Neon32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i32x4_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  vmin(NeonS32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i32x4_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  vmin(NeonU32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i32x4_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  vmax(NeonS32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i32x4_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  vmax(NeonU32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
 }
 
 void LiftoffAssembler::emit_i16x8_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
-  vdup(Neon16, liftoff::GetSimd128Register(dst.low_fp()), src.gp());
+  vdup(Neon16, liftoff::GetSimd128Register(dst), src.gp());
+}
+
+void LiftoffAssembler::emit_i16x8_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  vneg(Neon16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(src));
+}
+
+void LiftoffAssembler::emit_v16x8_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAnyTrue(this, dst, src);
+}
+
+void LiftoffAssembler::emit_v16x8_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v16x8_alltrue");
+}
+
+void LiftoffAssembler::emit_i16x8_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::kLeft, NeonS16, Neon16>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  vshl(NeonS16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), rhs & 15);
+}
+
+void LiftoffAssembler::emit_i16x8_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::kRight, NeonS16, Neon16>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftImmediate<liftoff::kRight, NeonS16>(this, dst, lhs,
+                                                            rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::kRight, NeonU16, Neon16>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftImmediate<liftoff::kRight, NeonU16>(this, dst, lhs,
+                                                            rhs);
 }
 
 void LiftoffAssembler::emit_i16x8_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  vadd(Neon16, liftoff::GetSimd128Register(dst.low_fp()),
-       liftoff::GetSimd128Register(lhs.low_fp()),
-       liftoff::GetSimd128Register(rhs.low_fp()));
+  vadd(Neon16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i16x8_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  vqadd(NeonS16, liftoff::GetSimd128Register(dst),
+        liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
 }
 
 void LiftoffAssembler::emit_i16x8_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  vsub(Neon16, liftoff::GetSimd128Register(dst.low_fp()),
-       liftoff::GetSimd128Register(lhs.low_fp()),
-       liftoff::GetSimd128Register(rhs.low_fp()));
+  vsub(Neon16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i16x8_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  vqsub(NeonS16, liftoff::GetSimd128Register(dst),
+        liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i16x8_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  vqsub(NeonU16, liftoff::GetSimd128Register(dst),
+        liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
 }
 
 void LiftoffAssembler::emit_i16x8_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  bailout(kSimd, "i16x8mul");
+  vmul(Neon16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i16x8_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  vqadd(NeonU16, liftoff::GetSimd128Register(dst),
+        liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i16x8_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  vmin(NeonS16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i16x8_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  vmin(NeonU16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i16x8_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  vmax(NeonS16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i16x8_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  vmax(NeonU16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
 }
 
 void LiftoffAssembler::emit_i16x8_extract_lane_u(LiftoffRegister dst,
                                                  LiftoffRegister lhs,
                                                  uint8_t imm_lane_idx) {
-  ExtractLane(dst.gp(), liftoff::GetSimd128Register(lhs.low_fp()), NeonU16,
+  ExtractLane(dst.gp(), liftoff::GetSimd128Register(lhs), NeonU16,
               imm_lane_idx);
 }
 
 void LiftoffAssembler::emit_i16x8_extract_lane_s(LiftoffRegister dst,
                                                  LiftoffRegister lhs,
                                                  uint8_t imm_lane_idx) {
-  ExtractLane(dst.gp(), liftoff::GetSimd128Register(lhs.low_fp()), NeonS16,
+  ExtractLane(dst.gp(), liftoff::GetSimd128Register(lhs), NeonS16,
               imm_lane_idx);
 }
 
@@ -1761,56 +2796,474 @@ void LiftoffAssembler::emit_i16x8_replace_lane(LiftoffRegister dst,
                                                LiftoffRegister src1,
                                                LiftoffRegister src2,
                                                uint8_t imm_lane_idx) {
-  ReplaceLane(liftoff::GetSimd128Register(dst.low_fp()),
-              liftoff::GetSimd128Register(src1.low_fp()), src2.gp(), NeonS16,
+  ReplaceLane(liftoff::GetSimd128Register(dst),
+              liftoff::GetSimd128Register(src1), src2.gp(), NeonS16,
               imm_lane_idx);
 }
 
 void LiftoffAssembler::emit_i8x16_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
-  vdup(Neon8, liftoff::GetSimd128Register(dst.low_fp()), src.gp());
+  vdup(Neon8, liftoff::GetSimd128Register(dst), src.gp());
 }
 
 void LiftoffAssembler::emit_i8x16_extract_lane_u(LiftoffRegister dst,
                                                  LiftoffRegister lhs,
                                                  uint8_t imm_lane_idx) {
-  ExtractLane(dst.gp(), liftoff::GetSimd128Register(lhs.low_fp()), NeonU8,
-              imm_lane_idx);
+  ExtractLane(dst.gp(), liftoff::GetSimd128Register(lhs), NeonU8, imm_lane_idx);
 }
 
 void LiftoffAssembler::emit_i8x16_extract_lane_s(LiftoffRegister dst,
                                                  LiftoffRegister lhs,
                                                  uint8_t imm_lane_idx) {
-  ExtractLane(dst.gp(), liftoff::GetSimd128Register(lhs.low_fp()), NeonS8,
-              imm_lane_idx);
+  ExtractLane(dst.gp(), liftoff::GetSimd128Register(lhs), NeonS8, imm_lane_idx);
 }
 
 void LiftoffAssembler::emit_i8x16_replace_lane(LiftoffRegister dst,
                                                LiftoffRegister src1,
                                                LiftoffRegister src2,
                                                uint8_t imm_lane_idx) {
-  ReplaceLane(liftoff::GetSimd128Register(dst.low_fp()),
-              liftoff::GetSimd128Register(src1.low_fp()), src2.gp(), NeonS8,
+  ReplaceLane(liftoff::GetSimd128Register(dst),
+              liftoff::GetSimd128Register(src1), src2.gp(), NeonS8,
               imm_lane_idx);
 }
 
+void LiftoffAssembler::emit_i8x16_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  vneg(Neon8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(src));
+}
+
+void LiftoffAssembler::emit_v8x16_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAnyTrue(this, dst, src);
+}
+
+void LiftoffAssembler::emit_v8x16_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v8x16_alltrue");
+}
+
+void LiftoffAssembler::emit_i8x16_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::kLeft, NeonS8, Neon8>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  vshl(NeonS8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), rhs & 7);
+}
+
+void LiftoffAssembler::emit_i8x16_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::kRight, NeonS8, Neon8>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftImmediate<liftoff::kRight, NeonS8>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::kRight, NeonU8, Neon8>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftImmediate<liftoff::kRight, NeonU8>(this, dst, lhs, rhs);
+}
+
 void LiftoffAssembler::emit_i8x16_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  vadd(Neon8, liftoff::GetSimd128Register(dst.low_fp()),
-       liftoff::GetSimd128Register(lhs.low_fp()),
-       liftoff::GetSimd128Register(rhs.low_fp()));
+  vadd(Neon8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i8x16_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  vqadd(NeonS8, liftoff::GetSimd128Register(dst),
+        liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
 }
 
 void LiftoffAssembler::emit_i8x16_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  vsub(Neon8, liftoff::GetSimd128Register(dst.low_fp()),
-       liftoff::GetSimd128Register(lhs.low_fp()),
-       liftoff::GetSimd128Register(rhs.low_fp()));
+  vsub(Neon8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i8x16_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  vqsub(NeonS8, liftoff::GetSimd128Register(dst),
+        liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i8x16_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  vqsub(NeonU8, liftoff::GetSimd128Register(dst),
+        liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
 }
 
 void LiftoffAssembler::emit_i8x16_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  bailout(kSimd, "i8x16mul");
+  vmul(Neon8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i8x16_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  vqadd(NeonU8, liftoff::GetSimd128Register(dst),
+        liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i8x16_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  vmin(NeonS8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i8x16_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  vmin(NeonU8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i8x16_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  vmax(NeonS8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i8x16_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  vmax(NeonU8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i8x16_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  vceq(Neon8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i8x16_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  vceq(Neon8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+  vmvn(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(dst));
+}
+
+void LiftoffAssembler::emit_i8x16_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  vcgt(NeonS8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i8x16_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  vcgt(NeonU8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i8x16_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  vcge(NeonS8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i8x16_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  vcge(NeonU8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i16x8_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  vceq(Neon16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i16x8_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  vceq(Neon16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+  vmvn(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(dst));
+}
+
+void LiftoffAssembler::emit_i16x8_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  vcgt(NeonS16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i16x8_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  vcgt(NeonU16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i16x8_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  vcge(NeonS16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i16x8_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  vcge(NeonU16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  vceq(Neon32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  vceq(Neon32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+  vmvn(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(dst));
+}
+
+void LiftoffAssembler::emit_i32x4_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  vcgt(NeonS32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i32x4_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  vcgt(NeonU32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i32x4_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  vcge(NeonS32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i32x4_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  vcge(NeonU32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_f32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  vceq(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(lhs),
+       liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_f32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  vceq(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(lhs),
+       liftoff::GetSimd128Register(rhs));
+  vmvn(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(dst));
+}
+
+void LiftoffAssembler::emit_f32x4_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  vcgt(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(rhs),
+       liftoff::GetSimd128Register(lhs));
+}
+
+void LiftoffAssembler::emit_f32x4_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  vcge(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(rhs),
+       liftoff::GetSimd128Register(lhs));
+}
+
+void LiftoffAssembler::emit_f64x2_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::F64x2Compare(this, dst, lhs, rhs, eq);
+}
+
+void LiftoffAssembler::emit_f64x2_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::F64x2Compare(this, dst, lhs, rhs, ne);
+}
+
+void LiftoffAssembler::emit_f64x2_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::F64x2Compare(this, dst, lhs, rhs, lt);
+}
+
+void LiftoffAssembler::emit_f64x2_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::F64x2Compare(this, dst, lhs, rhs, le);
+}
+
+void LiftoffAssembler::emit_s128_not(LiftoffRegister dst, LiftoffRegister src) {
+  vmvn(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(src));
+}
+
+void LiftoffAssembler::emit_s128_and(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  vand(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(lhs),
+       liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_s128_or(LiftoffRegister dst, LiftoffRegister lhs,
+                                    LiftoffRegister rhs) {
+  vorr(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(lhs),
+       liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_s128_xor(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  veor(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(lhs),
+       liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_s128_select(LiftoffRegister dst,
+                                        LiftoffRegister src1,
+                                        LiftoffRegister src2,
+                                        LiftoffRegister mask) {
+  if (dst != mask) {
+    vmov(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(mask));
+  }
+  vbsl(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(src1),
+       liftoff::GetSimd128Register(src2));
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  vcvt_s32_f32(liftoff::GetSimd128Register(dst),
+               liftoff::GetSimd128Register(src));
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  vcvt_u32_f32(liftoff::GetSimd128Register(dst),
+               liftoff::GetSimd128Register(src));
+}
+
+void LiftoffAssembler::emit_f32x4_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  vcvt_f32_s32(liftoff::GetSimd128Register(dst),
+               liftoff::GetSimd128Register(src));
+}
+
+void LiftoffAssembler::emit_f32x4_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  vcvt_f32_u32(liftoff::GetSimd128Register(dst),
+               liftoff::GetSimd128Register(src));
+}
+
+void LiftoffAssembler::emit_i8x16_sconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::S128NarrowOp(this, NeonS8, NeonS8, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_uconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::S128NarrowOp(this, NeonU8, NeonS8, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::S128NarrowOp(this, NeonS16, NeonS16, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::S128NarrowOp(this, NeonU16, NeonS16, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  vmovl(NeonS8, liftoff::GetSimd128Register(dst), src.low_fp());
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  vmovl(NeonS8, liftoff::GetSimd128Register(dst), src.high_fp());
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  vmovl(NeonU8, liftoff::GetSimd128Register(dst), src.low_fp());
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  vmovl(NeonU8, liftoff::GetSimd128Register(dst), src.high_fp());
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  vmovl(NeonS16, liftoff::GetSimd128Register(dst), src.low_fp());
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  vmovl(NeonS16, liftoff::GetSimd128Register(dst), src.high_fp());
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  vmovl(NeonU16, liftoff::GetSimd128Register(dst), src.low_fp());
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  vmovl(NeonU16, liftoff::GetSimd128Register(dst), src.high_fp());
+}
+
+void LiftoffAssembler::emit_s128_and_not(LiftoffRegister dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  vbic(liftoff::GetSimd128Register(dst), liftoff::GetSimd128Register(lhs),
+       liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i8x16_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  vrhadd(NeonU8, liftoff::GetSimd128Register(dst),
+         liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i16x8_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  vrhadd(NeonU16, liftoff::GetSimd128Register(dst),
+         liftoff::GetSimd128Register(lhs), liftoff::GetSimd128Register(rhs));
+}
+
+void LiftoffAssembler::emit_i8x16_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  vabs(Neon8, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(src));
+}
+
+void LiftoffAssembler::emit_i16x8_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  vabs(Neon16, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(src));
+}
+
+void LiftoffAssembler::emit_i32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  vabs(Neon32, liftoff::GetSimd128Register(dst),
+       liftoff::GetSimd128Register(src));
 }
 
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
@@ -2038,7 +3491,7 @@ void LiftoffStackSlots::Construct() {
             asm_->vpush(src.reg().fp());
             break;
           case ValueType::kS128:
-            asm_->vpush(liftoff::GetSimd128Register(src.reg().low_fp()));
+            asm_->vpush(liftoff::GetSimd128Register(src.reg()));
             break;
           default:
             UNREACHABLE();
diff --git a/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h b/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h
index bcf78184b1d..66a0c510982 100644
--- a/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h
+++ b/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h
@@ -27,7 +27,7 @@ namespace liftoff {
 //   1   | return addr (lr)   |
 //   0   | previous frame (fp)|
 //  -----+--------------------+  <-- frame ptr (fp)
-//  -1   | 0xa: WASM_COMPILED |
+//  -1   | 0xa: WASM          |
 //  -2   |     instance       |
 //  -----+--------------------+---------------------------
 //  -3   |     slot 0         |   ^
@@ -41,7 +41,9 @@ namespace liftoff {
 
 constexpr int kInstanceOffset = 2 * kSystemPointerSize;
 
-inline MemOperand GetStackSlot(int offset) { return MemOperand(fp, -offset); }
+inline MemOperand GetStackSlot(int offset) {
+  return MemOperand(offset > 0 ? fp : sp, -offset);
+}
 
 inline MemOperand GetInstanceOperand() { return GetStackSlot(kInstanceOffset); }
 
@@ -102,6 +104,66 @@ inline MemOperand GetMemOp(LiftoffAssembler* assm,
   return MemOperand(addr.X(), offset_imm);
 }
 
+enum class ShiftDirection : bool { kLeft, kRight };
+
+enum class ShiftSign : bool { kSigned, kUnsigned };
+
+template <ShiftDirection dir, ShiftSign sign = ShiftSign::kSigned>
+inline void EmitSimdShift(LiftoffAssembler* assm, VRegister dst, VRegister lhs,
+                          Register rhs, VectorFormat format) {
+  DCHECK_IMPLIES(dir == ShiftDirection::kLeft, sign == ShiftSign::kSigned);
+  DCHECK(dst.IsSameFormat(lhs));
+  DCHECK_EQ(dst.LaneCount(), LaneCountFromFormat(format));
+
+  UseScratchRegisterScope temps(assm);
+  VRegister tmp = temps.AcquireV(format);
+  Register shift = dst.Is2D() ? temps.AcquireX() : temps.AcquireW();
+  int mask = LaneSizeInBitsFromFormat(format) - 1;
+  assm->And(shift, rhs, mask);
+  assm->Dup(tmp, shift);
+
+  if (dir == ShiftDirection::kRight) {
+    assm->Neg(tmp, tmp);
+  }
+
+  if (sign == ShiftSign::kSigned) {
+    assm->Sshl(dst, lhs, tmp);
+  } else {
+    assm->Ushl(dst, lhs, tmp);
+  }
+}
+
+template <VectorFormat format, ShiftSign sign>
+inline void EmitSimdShiftRightImmediate(LiftoffAssembler* assm, VRegister dst,
+                                        VRegister lhs, int32_t rhs) {
+  // Sshr and Ushr does not allow shifts to be 0, so check for that here.
+  int mask = LaneSizeInBitsFromFormat(format) - 1;
+  int32_t shift = rhs & mask;
+  if (!shift) {
+    if (dst != lhs) {
+      assm->Mov(dst, lhs);
+    }
+    return;
+  }
+
+  if (sign == ShiftSign::kSigned) {
+    assm->Sshr(dst, lhs, rhs & mask);
+  } else {
+    assm->Ushr(dst, lhs, rhs & mask);
+  }
+}
+
+inline void EmitAnyTrue(LiftoffAssembler* assm, LiftoffRegister dst,
+                        LiftoffRegister src) {
+  // AnyTrue does not depend on the number of lanes, so we can use V4S for all.
+  UseScratchRegisterScope scope(assm);
+  VRegister temp = scope.AcquireV(kFormatS);
+  assm->Umaxv(temp, src.fp().V4S());
+  assm->Umov(dst.gp().W(), temp, 0);
+  assm->Cmp(dst.gp().W(), 0);
+  assm->Cset(dst.gp().W(), ne);
+}
+
 }  // namespace liftoff
 
 int LiftoffAssembler::PrepareStackFrame() {
@@ -297,8 +359,6 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
     case LoadType::kS128Load:
       Ldr(dst.fp().Q(), src_op);
       break;
-    default:
-      UNREACHABLE();
   }
 }
 
@@ -335,8 +395,6 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
     case StoreType::kS128Store:
       Str(src.fp().Q(), dst_op);
       break;
-    default:
-      UNREACHABLE();
   }
 }
 
@@ -354,37 +412,38 @@ void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
 
 void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicAdd");
 }
 
 void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicSub");
 }
 
 void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicAnd");
 }
 
 void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
                                 uint32_t offset_imm, LiftoffRegister value,
-                                StoreType type) {
+                                LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicOr");
 }
 
 void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicXor");
 }
 
 void LiftoffAssembler::AtomicExchange(Register dst_addr, Register offset_reg,
                                       uint32_t offset_imm,
-                                      LiftoffRegister value, StoreType type) {
+                                      LiftoffRegister value,
+                                      LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicExchange");
 }
 
@@ -404,6 +463,13 @@ void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
   Ldr(liftoff::GetRegFromType(dst, type), MemOperand(fp, offset));
 }
 
+void LiftoffAssembler::StoreCallerFrameSlot(LiftoffRegister src,
+                                            uint32_t caller_slot_idx,
+                                            ValueType type) {
+  int32_t offset = (caller_slot_idx + 1) * LiftoffAssembler::kStackSlotSize;
+  Str(liftoff::GetRegFromType(src, type), MemOperand(fp, offset));
+}
+
 void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
   UseScratchRegisterScope temps(this);
@@ -429,7 +495,7 @@ void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
     Fmov(dst.D(), src.D());
   } else {
     DCHECK_EQ(kWasmS128, type);
-    Fmov(dst.Q(), src.Q());
+    Mov(dst.Q(), src.Q());
   }
 }
 
@@ -532,22 +598,22 @@ void LiftoffAssembler::FillStackSlotsWithZero(int start, int size) {
                                      Register rhs) {             \
     instruction(dst.W(), lhs.W(), rhs.W());                      \
   }
-#define I32_BINOP_I(name, instruction)                           \
-  I32_BINOP(name, instruction)                                   \
-  void LiftoffAssembler::emit_##name(Register dst, Register lhs, \
-                                     int32_t imm) {              \
-    instruction(dst.W(), lhs.W(), Immediate(imm));               \
+#define I32_BINOP_I(name, instruction)                              \
+  I32_BINOP(name, instruction)                                      \
+  void LiftoffAssembler::emit_##name##i(Register dst, Register lhs, \
+                                        int32_t imm) {              \
+    instruction(dst.W(), lhs.W(), Immediate(imm));                  \
   }
 #define I64_BINOP(name, instruction)                                           \
   void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister lhs, \
                                      LiftoffRegister rhs) {                    \
     instruction(dst.gp().X(), lhs.gp().X(), rhs.gp().X());                     \
   }
-#define I64_BINOP_I(name, instruction)                                         \
-  I64_BINOP(name, instruction)                                                 \
-  void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister lhs, \
-                                     int32_t imm) {                            \
-    instruction(dst.gp().X(), lhs.gp().X(), imm);                              \
+#define I64_BINOP_I(name, instruction)                                      \
+  I64_BINOP(name, instruction)                                              \
+  void LiftoffAssembler::emit_##name##i(LiftoffRegister dst,                \
+                                        LiftoffRegister lhs, int32_t imm) { \
+    instruction(dst.gp().X(), lhs.gp().X(), imm);                           \
   }
 #define FP32_BINOP(name, instruction)                                        \
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister lhs, \
@@ -577,22 +643,22 @@ void LiftoffAssembler::FillStackSlotsWithZero(int start, int size) {
     instruction(dst.D(), src.D());                                             \
     return true;                                                               \
   }
-#define I32_SHIFTOP(name, instruction)                           \
-  void LiftoffAssembler::emit_##name(Register dst, Register src, \
-                                     Register amount) {          \
-    instruction(dst.W(), src.W(), amount.W());                   \
-  }                                                              \
-  void LiftoffAssembler::emit_##name(Register dst, Register src, \
-                                     int32_t amount) {           \
-    instruction(dst.W(), src.W(), amount & 31);                  \
+#define I32_SHIFTOP(name, instruction)                              \
+  void LiftoffAssembler::emit_##name(Register dst, Register src,    \
+                                     Register amount) {             \
+    instruction(dst.W(), src.W(), amount.W());                      \
+  }                                                                 \
+  void LiftoffAssembler::emit_##name##i(Register dst, Register src, \
+                                        int32_t amount) {           \
+    instruction(dst.W(), src.W(), amount & 31);                     \
   }
 #define I64_SHIFTOP(name, instruction)                                         \
   void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
                                      Register amount) {                        \
     instruction(dst.gp().X(), src.gp().X(), amount.X());                       \
   }                                                                            \
-  void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
-                                     int32_t amount) {                         \
+  void LiftoffAssembler::emit_##name##i(LiftoffRegister dst,                   \
+                                        LiftoffRegister src, int32_t amount) { \
     instruction(dst.gp().X(), src.gp().X(), amount & 63);                      \
   }
 
@@ -903,6 +969,30 @@ bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
       B(trap, ne);
       return true;
     }
+    case kExprI32SConvertSatF32:
+      Fcvtzs(dst.gp().W(), src.fp().S());
+      return true;
+    case kExprI32UConvertSatF32:
+      Fcvtzu(dst.gp().W(), src.fp().S());
+      return true;
+    case kExprI32SConvertSatF64:
+      Fcvtzs(dst.gp().W(), src.fp().D());
+      return true;
+    case kExprI32UConvertSatF64:
+      Fcvtzu(dst.gp().W(), src.fp().D());
+      return true;
+    case kExprI64SConvertSatF32:
+      Fcvtzs(dst.gp().X(), src.fp().S());
+      return true;
+    case kExprI64UConvertSatF32:
+      Fcvtzu(dst.gp().X(), src.fp().S());
+      return true;
+    case kExprI64SConvertSatF64:
+      Fcvtzs(dst.gp().X(), src.fp().D());
+      return true;
+    case kExprI64UConvertSatF64:
+      Fcvtzu(dst.gp().X(), src.fp().D());
+      return true;
     case kExprI32ReinterpretF32:
       Fmov(dst.gp().W(), src.fp().S());
       return true;
@@ -1084,6 +1174,70 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   }
 }
 
+void LiftoffAssembler::LoadTransform(LiftoffRegister dst, Register src_addr,
+                                     Register offset_reg, uint32_t offset_imm,
+                                     LoadType type,
+                                     LoadTransformationKind transform,
+                                     uint32_t* protected_load_pc) {
+  UseScratchRegisterScope temps(this);
+  MemOperand src_op =
+      liftoff::GetMemOp(this, &temps, src_addr, offset_reg, offset_imm);
+  *protected_load_pc = pc_offset();
+  MachineType memtype = type.mem_type();
+
+  if (transform == LoadTransformationKind::kExtend) {
+    if (memtype == MachineType::Int8()) {
+      Ldr(dst.fp().D(), src_op);
+      Sxtl(dst.fp().V8H(), dst.fp().V8B());
+    } else if (memtype == MachineType::Uint8()) {
+      Ldr(dst.fp().D(), src_op);
+      Uxtl(dst.fp().V8H(), dst.fp().V8B());
+    } else if (memtype == MachineType::Int16()) {
+      Ldr(dst.fp().D(), src_op);
+      Sxtl(dst.fp().V4S(), dst.fp().V4H());
+    } else if (memtype == MachineType::Uint16()) {
+      Ldr(dst.fp().D(), src_op);
+      Uxtl(dst.fp().V4S(), dst.fp().V4H());
+    } else if (memtype == MachineType::Int32()) {
+      Ldr(dst.fp().D(), src_op);
+      Sxtl(dst.fp().V2D(), dst.fp().V2S());
+    } else if (memtype == MachineType::Uint32()) {
+      Ldr(dst.fp().D(), src_op);
+      Uxtl(dst.fp().V2D(), dst.fp().V2S());
+    }
+  } else {
+    // ld1r only allows no offset or post-index, so emit an add.
+    DCHECK_EQ(LoadTransformationKind::kSplat, transform);
+    if (src_op.IsRegisterOffset()) {
+      // We have 2 tmp gps, so it's okay to acquire 1 more here, and actually
+      // doesn't matter if we acquire the same one.
+      Register tmp = temps.AcquireX();
+      Add(tmp, src_op.base(), src_op.regoffset().X());
+      src_op = MemOperand(tmp.X(), 0);
+    } else if (src_op.IsImmediateOffset() && src_op.offset() != 0) {
+      Register tmp = temps.AcquireX();
+      Add(tmp, src_op.base(), src_op.offset());
+      src_op = MemOperand(tmp.X(), 0);
+    }
+
+    if (memtype == MachineType::Int8()) {
+      ld1r(dst.fp().V16B(), src_op);
+    } else if (memtype == MachineType::Int16()) {
+      ld1r(dst.fp().V8H(), src_op);
+    } else if (memtype == MachineType::Int32()) {
+      ld1r(dst.fp().V4S(), src_op);
+    } else if (memtype == MachineType::Int64()) {
+      ld1r(dst.fp().V2D(), src_op);
+    }
+  }
+}
+
+void LiftoffAssembler::emit_s8x16_swizzle(LiftoffRegister dst,
+                                          LiftoffRegister lhs,
+                                          LiftoffRegister rhs) {
+  Tbl(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
 void LiftoffAssembler::emit_f64x2_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
   Dup(dst.fp().V2D(), src.fp().D(), 0);
@@ -1105,6 +1259,21 @@ void LiftoffAssembler::emit_f64x2_replace_lane(LiftoffRegister dst,
   Mov(dst.fp().V2D(), imm_lane_idx, src2.fp().V2D(), 0);
 }
 
+void LiftoffAssembler::emit_f64x2_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Fabs(dst.fp().V2D(), src.fp().V2D());
+}
+
+void LiftoffAssembler::emit_f64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Fneg(dst.fp().V2D(), src.fp().V2D());
+}
+
+void LiftoffAssembler::emit_f64x2_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  Fsqrt(dst.fp().V2D(), src.fp().V2D());
+}
+
 void LiftoffAssembler::emit_f64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   Fadd(dst.fp().V2D(), lhs.fp().V2D(), rhs.fp().V2D());
@@ -1117,7 +1286,22 @@ void LiftoffAssembler::emit_f64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
 
 void LiftoffAssembler::emit_f64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  bailout(kSimd, "f64x2mul");
+  Fmul(dst.fp().V2D(), lhs.fp().V2D(), rhs.fp().V2D());
+}
+
+void LiftoffAssembler::emit_f64x2_div(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  Fdiv(dst.fp().V2D(), lhs.fp().V2D(), rhs.fp().V2D());
+}
+
+void LiftoffAssembler::emit_f64x2_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  Fmin(dst.fp().V2D(), lhs.fp().V2D(), rhs.fp().V2D());
+}
+
+void LiftoffAssembler::emit_f64x2_max(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  Fmax(dst.fp().V2D(), lhs.fp().V2D(), rhs.fp().V2D());
 }
 
 void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
@@ -1141,6 +1325,21 @@ void LiftoffAssembler::emit_f32x4_replace_lane(LiftoffRegister dst,
   Mov(dst.fp().V4S(), imm_lane_idx, src2.fp().V4S(), 0);
 }
 
+void LiftoffAssembler::emit_f32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Fabs(dst.fp().V4S(), src.fp().V4S());
+}
+
+void LiftoffAssembler::emit_f32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Fneg(dst.fp().V4S(), src.fp().V4S());
+}
+
+void LiftoffAssembler::emit_f32x4_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  Fsqrt(dst.fp().V4S(), src.fp().V4S());
+}
+
 void LiftoffAssembler::emit_f32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   Fadd(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
@@ -1153,7 +1352,22 @@ void LiftoffAssembler::emit_f32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
 
 void LiftoffAssembler::emit_f32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  bailout(kSimd, "f32x4mul");
+  Fmul(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
+}
+
+void LiftoffAssembler::emit_f32x4_div(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  Fdiv(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
+}
+
+void LiftoffAssembler::emit_f32x4_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  Fmin(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
+}
+
+void LiftoffAssembler::emit_f32x4_max(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  Fmax(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
 }
 
 void LiftoffAssembler::emit_i64x2_splat(LiftoffRegister dst,
@@ -1177,6 +1391,51 @@ void LiftoffAssembler::emit_i64x2_replace_lane(LiftoffRegister dst,
   Mov(dst.fp().V2D(), imm_lane_idx, src2.gp().X());
 }
 
+void LiftoffAssembler::emit_i64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Neg(dst.fp().V2D(), src.fp().V2D());
+}
+
+void LiftoffAssembler::emit_i64x2_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::ShiftDirection::kLeft>(
+      this, dst.fp().V2D(), lhs.fp().V2D(), rhs.gp(), kFormat2D);
+}
+
+void LiftoffAssembler::emit_i64x2_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  Shl(dst.fp().V2D(), lhs.fp().V2D(), rhs & 63);
+}
+
+void LiftoffAssembler::emit_i64x2_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::ShiftDirection::kRight,
+                         liftoff::ShiftSign::kSigned>(
+      this, dst.fp().V2D(), lhs.fp().V2D(), rhs.gp(), kFormat2D);
+}
+
+void LiftoffAssembler::emit_i64x2_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftRightImmediate<kFormat2D, liftoff::ShiftSign::kSigned>(
+      this, dst.fp().V2D(), lhs.fp().V2D(), rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::ShiftDirection::kRight,
+                         liftoff::ShiftSign::kUnsigned>(
+      this, dst.fp().V2D(), lhs.fp().V2D(), rhs.gp(), kFormat2D);
+}
+
+void LiftoffAssembler::emit_i64x2_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftRightImmediate<kFormat2D,
+                                       liftoff::ShiftSign::kUnsigned>(
+      this, dst.fp().V2D(), lhs.fp().V2D(), rhs);
+}
+
 void LiftoffAssembler::emit_i64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   Add(dst.fp().V2D(), lhs.fp().V2D(), rhs.fp().V2D());
@@ -1189,7 +1448,23 @@ void LiftoffAssembler::emit_i64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
 
 void LiftoffAssembler::emit_i64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  bailout(kSimd, "i64x2mul");
+  UseScratchRegisterScope temps(this);
+  VRegister tmp1 = temps.AcquireV(kFormat2D);
+  VRegister tmp2 = temps.AcquireV(kFormat2D);
+
+  // Algorithm copied from code-generator-arm64.cc with minor modifications:
+  // - 2 (max number of scratch registers in Liftoff) temporaries instead of 3
+  // - 1 more Umull instruction to calculate | cg | ae |,
+  // - so, we can no longer use Umlal in the last step, and use Add instead.
+  // Refer to comments there for details.
+  Xtn(tmp1.V2S(), lhs.fp().V2D());
+  Xtn(tmp2.V2S(), rhs.fp().V2D());
+  Umull(tmp1.V2D(), tmp1.V2S(), tmp2.V2S());
+  Rev64(tmp2.V4S(), rhs.fp().V4S());
+  Mul(tmp2.V4S(), tmp2.V4S(), lhs.fp().V4S());
+  Addp(tmp2.V4S(), tmp2.V4S(), tmp2.V4S());
+  Shll(dst.fp().V2D(), tmp2.V2S(), 32);
+  Add(dst.fp().V2D(), dst.fp().V2D(), tmp1.V2D());
 }
 
 void LiftoffAssembler::emit_i32x4_splat(LiftoffRegister dst,
@@ -1213,6 +1488,61 @@ void LiftoffAssembler::emit_i32x4_replace_lane(LiftoffRegister dst,
   Mov(dst.fp().V4S(), imm_lane_idx, src2.gp().W());
 }
 
+void LiftoffAssembler::emit_i32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Neg(dst.fp().V4S(), src.fp().V4S());
+}
+
+void LiftoffAssembler::emit_v32x4_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAnyTrue(this, dst, src);
+}
+
+void LiftoffAssembler::emit_v32x4_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v32x4_alltrue");
+}
+
+void LiftoffAssembler::emit_i32x4_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::ShiftDirection::kLeft>(
+      this, dst.fp().V4S(), lhs.fp().V4S(), rhs.gp(), kFormat4S);
+}
+
+void LiftoffAssembler::emit_i32x4_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  Shl(dst.fp().V4S(), lhs.fp().V4S(), rhs & 31);
+}
+
+void LiftoffAssembler::emit_i32x4_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::ShiftDirection::kRight,
+                         liftoff::ShiftSign::kSigned>(
+      this, dst.fp().V4S(), lhs.fp().V4S(), rhs.gp(), kFormat4S);
+}
+
+void LiftoffAssembler::emit_i32x4_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftRightImmediate<kFormat4S, liftoff::ShiftSign::kSigned>(
+      this, dst.fp().V4S(), lhs.fp().V4S(), rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::ShiftDirection::kRight,
+                         liftoff::ShiftSign::kUnsigned>(
+      this, dst.fp().V4S(), lhs.fp().V4S(), rhs.gp(), kFormat4S);
+}
+
+void LiftoffAssembler::emit_i32x4_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftRightImmediate<kFormat4S,
+                                       liftoff::ShiftSign::kUnsigned>(
+      this, dst.fp().V4S(), lhs.fp().V4S(), rhs);
+}
+
 void LiftoffAssembler::emit_i32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   Add(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
@@ -1225,7 +1555,31 @@ void LiftoffAssembler::emit_i32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
 
 void LiftoffAssembler::emit_i32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  bailout(kSimd, "i32x4mul");
+  Mul(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
+}
+
+void LiftoffAssembler::emit_i32x4_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  Smin(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
+}
+
+void LiftoffAssembler::emit_i32x4_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  Umin(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
+}
+
+void LiftoffAssembler::emit_i32x4_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  Smax(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
+}
+
+void LiftoffAssembler::emit_i32x4_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  Umax(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
 }
 
 void LiftoffAssembler::emit_i16x8_splat(LiftoffRegister dst,
@@ -1255,19 +1609,122 @@ void LiftoffAssembler::emit_i16x8_replace_lane(LiftoffRegister dst,
   Mov(dst.fp().V8H(), imm_lane_idx, src2.gp().W());
 }
 
+void LiftoffAssembler::emit_i16x8_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Neg(dst.fp().V8H(), src.fp().V8H());
+}
+
+void LiftoffAssembler::emit_v16x8_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAnyTrue(this, dst, src);
+}
+
+void LiftoffAssembler::emit_v16x8_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v16x8_alltrue");
+}
+
+void LiftoffAssembler::emit_i16x8_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::ShiftDirection::kLeft>(
+      this, dst.fp().V8H(), lhs.fp().V8H(), rhs.gp(), kFormat8H);
+}
+
+void LiftoffAssembler::emit_i16x8_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  Shl(dst.fp().V8H(), lhs.fp().V8H(), rhs & 15);
+}
+
+void LiftoffAssembler::emit_i16x8_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::ShiftDirection::kRight,
+                         liftoff::ShiftSign::kSigned>(
+      this, dst.fp().V8H(), lhs.fp().V8H(), rhs.gp(), kFormat8H);
+}
+
+void LiftoffAssembler::emit_i16x8_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftRightImmediate<kFormat8H, liftoff::ShiftSign::kSigned>(
+      this, dst.fp().V8H(), lhs.fp().V8H(), rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::ShiftDirection::kRight,
+                         liftoff::ShiftSign::kUnsigned>(
+      this, dst.fp().V8H(), lhs.fp().V8H(), rhs.gp(), kFormat8H);
+}
+
+void LiftoffAssembler::emit_i16x8_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftRightImmediate<kFormat8H,
+                                       liftoff::ShiftSign::kUnsigned>(
+      this, dst.fp().V8H(), lhs.fp().V8H(), rhs);
+}
+
 void LiftoffAssembler::emit_i16x8_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   Add(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
 }
 
+void LiftoffAssembler::emit_i16x8_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  Sqadd(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
+}
+
 void LiftoffAssembler::emit_i16x8_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   Sub(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
 }
 
+void LiftoffAssembler::emit_i16x8_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  Sqsub(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
+}
+
+void LiftoffAssembler::emit_i16x8_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  Uqsub(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
+}
+
 void LiftoffAssembler::emit_i16x8_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  bailout(kSimd, "i16x8mul");
+  Mul(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
+}
+
+void LiftoffAssembler::emit_i16x8_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  Uqadd(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
+}
+
+void LiftoffAssembler::emit_i16x8_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  Smin(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
+}
+
+void LiftoffAssembler::emit_i16x8_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  Umin(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
+}
+
+void LiftoffAssembler::emit_i16x8_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  Smax(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
+}
+
+void LiftoffAssembler::emit_i16x8_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  Umax(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
 }
 
 void LiftoffAssembler::emit_i8x16_splat(LiftoffRegister dst,
@@ -1297,19 +1754,435 @@ void LiftoffAssembler::emit_i8x16_replace_lane(LiftoffRegister dst,
   Mov(dst.fp().V16B(), imm_lane_idx, src2.gp().W());
 }
 
+void LiftoffAssembler::emit_i8x16_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Neg(dst.fp().V16B(), src.fp().V16B());
+}
+
+void LiftoffAssembler::emit_v8x16_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAnyTrue(this, dst, src);
+}
+
+void LiftoffAssembler::emit_v8x16_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v8x16_alltrue");
+}
+
+void LiftoffAssembler::emit_i8x16_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::ShiftDirection::kLeft>(
+      this, dst.fp().V16B(), lhs.fp().V16B(), rhs.gp(), kFormat16B);
+}
+
+void LiftoffAssembler::emit_i8x16_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  Shl(dst.fp().V16B(), lhs.fp().V16B(), rhs & 7);
+}
+
+void LiftoffAssembler::emit_i8x16_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::ShiftDirection::kRight,
+                         liftoff::ShiftSign::kSigned>(
+      this, dst.fp().V16B(), lhs.fp().V16B(), rhs.gp(), kFormat16B);
+}
+
+void LiftoffAssembler::emit_i8x16_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftRightImmediate<kFormat16B, liftoff::ShiftSign::kSigned>(
+      this, dst.fp().V16B(), lhs.fp().V16B(), rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShift<liftoff::ShiftDirection::kRight,
+                         liftoff::ShiftSign::kUnsigned>(
+      this, dst.fp().V16B(), lhs.fp().V16B(), rhs.gp(), kFormat16B);
+}
+
+void LiftoffAssembler::emit_i8x16_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftRightImmediate<kFormat16B,
+                                       liftoff::ShiftSign::kUnsigned>(
+      this, dst.fp().V16B(), lhs.fp().V16B(), rhs);
+}
+
 void LiftoffAssembler::emit_i8x16_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   Add(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
 }
 
+void LiftoffAssembler::emit_i8x16_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  Sqadd(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
 void LiftoffAssembler::emit_i8x16_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   Sub(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
 }
 
+void LiftoffAssembler::emit_i8x16_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  Sqsub(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i8x16_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  Uqsub(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
 void LiftoffAssembler::emit_i8x16_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  bailout(kSimd, "i8x16mul");
+  Mul(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i8x16_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  Uqadd(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i8x16_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  Smin(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i8x16_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  Umin(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i8x16_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  Smax(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i8x16_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  Umax(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i8x16_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  Cmeq(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i8x16_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  Cmeq(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+  Mvn(dst.fp().V16B(), dst.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i8x16_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  Cmgt(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i8x16_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  Cmhi(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i8x16_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  Cmge(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i8x16_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  Cmhs(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i16x8_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  Cmeq(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
+}
+
+void LiftoffAssembler::emit_i16x8_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  Cmeq(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
+  Mvn(dst.fp().V8H(), dst.fp().V8H());
+}
+
+void LiftoffAssembler::emit_i16x8_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  Cmgt(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
+}
+
+void LiftoffAssembler::emit_i16x8_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  Cmhi(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
+}
+
+void LiftoffAssembler::emit_i16x8_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  Cmge(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
+}
+
+void LiftoffAssembler::emit_i16x8_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  Cmhs(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
+}
+
+void LiftoffAssembler::emit_i32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  Cmeq(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
+}
+
+void LiftoffAssembler::emit_i32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  Cmeq(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
+  Mvn(dst.fp().V4S(), dst.fp().V4S());
+}
+
+void LiftoffAssembler::emit_i32x4_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  Cmgt(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
+}
+
+void LiftoffAssembler::emit_i32x4_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  Cmhi(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
+}
+
+void LiftoffAssembler::emit_i32x4_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  Cmge(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
+}
+
+void LiftoffAssembler::emit_i32x4_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  Cmhs(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
+}
+
+void LiftoffAssembler::emit_f32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  Fcmeq(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
+}
+
+void LiftoffAssembler::emit_f32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  Fcmeq(dst.fp().V4S(), lhs.fp().V4S(), rhs.fp().V4S());
+  Mvn(dst.fp().V4S(), dst.fp().V4S());
+}
+
+void LiftoffAssembler::emit_f32x4_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  Fcmgt(dst.fp().V4S(), rhs.fp().V4S(), lhs.fp().V4S());
+}
+
+void LiftoffAssembler::emit_f32x4_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  Fcmge(dst.fp().V4S(), rhs.fp().V4S(), lhs.fp().V4S());
+}
+
+void LiftoffAssembler::emit_f64x2_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  Fcmeq(dst.fp().V2D(), lhs.fp().V2D(), rhs.fp().V2D());
+}
+
+void LiftoffAssembler::emit_f64x2_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  Fcmeq(dst.fp().V2D(), lhs.fp().V2D(), rhs.fp().V2D());
+  Mvn(dst.fp().V2D(), dst.fp().V2D());
+}
+
+void LiftoffAssembler::emit_f64x2_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  Fcmgt(dst.fp().V2D(), rhs.fp().V2D(), lhs.fp().V2D());
+}
+
+void LiftoffAssembler::emit_f64x2_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  Fcmge(dst.fp().V2D(), rhs.fp().V2D(), lhs.fp().V2D());
+}
+
+void LiftoffAssembler::emit_s128_not(LiftoffRegister dst, LiftoffRegister src) {
+  Mvn(dst.fp().V16B(), src.fp().V16B());
+}
+
+void LiftoffAssembler::emit_s128_and(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  And(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_s128_or(LiftoffRegister dst, LiftoffRegister lhs,
+                                    LiftoffRegister rhs) {
+  Orr(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_s128_xor(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  Eor(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_s128_select(LiftoffRegister dst,
+                                        LiftoffRegister src1,
+                                        LiftoffRegister src2,
+                                        LiftoffRegister mask) {
+  if (dst != mask) {
+    Mov(dst.fp().V16B(), mask.fp().V16B());
+  }
+  Bsl(dst.fp().V16B(), src1.fp().V16B(), src2.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  Fcvtzs(dst.fp().V4S(), src.fp().V4S());
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  Fcvtzu(dst.fp().V4S(), src.fp().V4S());
+}
+
+void LiftoffAssembler::emit_f32x4_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  Scvtf(dst.fp().V4S(), src.fp().V4S());
+}
+
+void LiftoffAssembler::emit_f32x4_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  Ucvtf(dst.fp().V4S(), src.fp().V4S());
+}
+
+void LiftoffAssembler::emit_i8x16_sconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  UseScratchRegisterScope temps(this);
+  VRegister tmp = temps.AcquireV(kFormat8H);
+  VRegister right = rhs.fp().V8H();
+  if (dst == rhs) {
+    Mov(tmp, right);
+    right = tmp;
+  }
+  Sqxtn(dst.fp().V8B(), lhs.fp().V8H());
+  Sqxtn2(dst.fp().V16B(), right);
+}
+
+void LiftoffAssembler::emit_i8x16_uconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  UseScratchRegisterScope temps(this);
+  VRegister tmp = temps.AcquireV(kFormat8H);
+  VRegister right = rhs.fp().V8H();
+  if (dst == rhs) {
+    Mov(tmp, right);
+    right = tmp;
+  }
+  Sqxtun(dst.fp().V8B(), lhs.fp().V8H());
+  Sqxtun2(dst.fp().V16B(), right);
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  UseScratchRegisterScope temps(this);
+  VRegister tmp = temps.AcquireV(kFormat4S);
+  VRegister right = rhs.fp().V4S();
+  if (dst == rhs) {
+    Mov(tmp, right);
+    right = tmp;
+  }
+  Sqxtn(dst.fp().V4H(), lhs.fp().V4S());
+  Sqxtn2(dst.fp().V8H(), right);
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  UseScratchRegisterScope temps(this);
+  VRegister tmp = temps.AcquireV(kFormat4S);
+  VRegister right = rhs.fp().V4S();
+  if (dst == rhs) {
+    Mov(tmp, right);
+    right = tmp;
+  }
+  Sqxtun(dst.fp().V4H(), lhs.fp().V4S());
+  Sqxtun2(dst.fp().V8H(), right);
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  Sxtl(dst.fp().V8H(), src.fp().V8B());
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  Sxtl2(dst.fp().V8H(), src.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  Uxtl(dst.fp().V8H(), src.fp().V8B());
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  Uxtl2(dst.fp().V8H(), src.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  Sxtl(dst.fp().V4S(), src.fp().V4H());
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  Sxtl2(dst.fp().V4S(), src.fp().V8H());
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  Uxtl(dst.fp().V4S(), src.fp().V4H());
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  Uxtl2(dst.fp().V4S(), src.fp().V8H());
+}
+
+void LiftoffAssembler::emit_s128_and_not(LiftoffRegister dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  Bic(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i8x16_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  Urhadd(dst.fp().V16B(), lhs.fp().V16B(), rhs.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i16x8_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  Urhadd(dst.fp().V8H(), lhs.fp().V8H(), rhs.fp().V8H());
+}
+
+void LiftoffAssembler::emit_i8x16_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Abs(dst.fp().V16B(), src.fp().V16B());
+}
+
+void LiftoffAssembler::emit_i16x8_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Abs(dst.fp().V8H(), src.fp().V8H());
+}
+
+void LiftoffAssembler::emit_i32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Abs(dst.fp().V4S(), src.fp().V4S());
 }
 
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
diff --git a/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h b/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h
index 0172b282dc2..7bb497fa999 100644
--- a/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h
+++ b/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h
@@ -23,12 +23,14 @@ namespace liftoff {
 // ebp-4 holds the stack marker, ebp-8 is the instance parameter.
 constexpr int kInstanceOffset = 8;
 
-inline Operand GetStackSlot(int offset) { return Operand(ebp, -offset); }
+inline Operand GetStackSlot(int offset) {
+  return Operand(offset > 0 ? ebp : esp, -offset);
+}
 
 inline MemOperand GetHalfStackSlot(int offset, RegPairHalf half) {
   int32_t half_offset =
       half == kLowWord ? 0 : LiftoffAssembler::kStackSlotSize / 2;
-  return Operand(ebp, -offset + half_offset);
+  return Operand(offset > 0 ? ebp : esp, -offset + half_offset);
 }
 
 // TODO(clemensb): Make this a constexpr variable once Operand is constexpr.
@@ -128,7 +130,7 @@ inline Register GetTmpByteRegister(LiftoffAssembler* assm, Register candidate) {
   if (candidate.is_byte_register()) return candidate;
   // {GetUnusedRegister()} may insert move instructions to spill registers to
   // the stack. This is OK because {mov} does not change the status flags.
-  return assm->GetUnusedRegister(liftoff::kByteRegs).gp();
+  return assm->GetUnusedRegister(liftoff::kByteRegs, {}).gp();
 }
 
 inline void MoveStackValue(LiftoffAssembler* assm, const Operand& src,
@@ -334,8 +336,6 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
     case LoadType::kS128Load:
       movdqu(dst.fp(), src_op);
       break;
-    default:
-      UNREACHABLE();
   }
 }
 
@@ -403,8 +403,6 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
     case StoreType::kS128Store:
       Movdqu(dst_op, src.fp());
       break;
-    default:
-      UNREACHABLE();
   }
 }
 
@@ -491,37 +489,38 @@ void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
 
 void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicAdd");
 }
 
 void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicSub");
 }
 
 void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicAnd");
 }
 
 void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
                                 uint32_t offset_imm, LiftoffRegister value,
-                                StoreType type) {
+                                LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicOr");
 }
 
 void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicXor");
 }
 
 void LiftoffAssembler::AtomicExchange(Register dst_addr, Register offset_reg,
                                       uint32_t offset_imm,
-                                      LiftoffRegister value, StoreType type) {
+                                      LiftoffRegister value,
+                                      LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicExchange");
 }
 
@@ -541,6 +540,13 @@ void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                 type);
 }
 
+void LiftoffAssembler::StoreCallerFrameSlot(LiftoffRegister src,
+                                            uint32_t caller_slot_idx,
+                                            ValueType type) {
+  liftoff::Store(this, ebp, kSystemPointerSize * (caller_slot_idx + 1), src,
+                 type);
+}
+
 void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
   if (needs_gp_reg_pair(type)) {
@@ -686,7 +692,7 @@ void LiftoffAssembler::emit_i32_add(Register dst, Register lhs, Register rhs) {
   }
 }
 
-void LiftoffAssembler::emit_i32_add(Register dst, Register lhs, int32_t imm) {
+void LiftoffAssembler::emit_i32_addi(Register dst, Register lhs, int32_t imm) {
   if (lhs != dst) {
     lea(dst, Operand(lhs, imm));
   } else {
@@ -829,7 +835,7 @@ void LiftoffAssembler::emit_i32_and(Register dst, Register lhs, Register rhs) {
   liftoff::EmitCommutativeBinOp<&Assembler::and_>(this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i32_and(Register dst, Register lhs, int32_t imm) {
+void LiftoffAssembler::emit_i32_andi(Register dst, Register lhs, int32_t imm) {
   liftoff::EmitCommutativeBinOpImm<&Assembler::and_>(this, dst, lhs, imm);
 }
 
@@ -837,7 +843,7 @@ void LiftoffAssembler::emit_i32_or(Register dst, Register lhs, Register rhs) {
   liftoff::EmitCommutativeBinOp<&Assembler::or_>(this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i32_or(Register dst, Register lhs, int32_t imm) {
+void LiftoffAssembler::emit_i32_ori(Register dst, Register lhs, int32_t imm) {
   liftoff::EmitCommutativeBinOpImm<&Assembler::or_>(this, dst, lhs, imm);
 }
 
@@ -845,7 +851,7 @@ void LiftoffAssembler::emit_i32_xor(Register dst, Register lhs, Register rhs) {
   liftoff::EmitCommutativeBinOp<&Assembler::xor_>(this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i32_xor(Register dst, Register lhs, int32_t imm) {
+void LiftoffAssembler::emit_i32_xori(Register dst, Register lhs, int32_t imm) {
   liftoff::EmitCommutativeBinOpImm<&Assembler::xor_>(this, dst, lhs, imm);
 }
 
@@ -891,8 +897,8 @@ void LiftoffAssembler::emit_i32_shl(Register dst, Register src,
   liftoff::EmitShiftOperation(this, dst, src, amount, &Assembler::shl_cl);
 }
 
-void LiftoffAssembler::emit_i32_shl(Register dst, Register src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i32_shli(Register dst, Register src,
+                                     int32_t amount) {
   if (dst != src) mov(dst, src);
   shl(dst, amount & 31);
 }
@@ -902,8 +908,8 @@ void LiftoffAssembler::emit_i32_sar(Register dst, Register src,
   liftoff::EmitShiftOperation(this, dst, src, amount, &Assembler::sar_cl);
 }
 
-void LiftoffAssembler::emit_i32_sar(Register dst, Register src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i32_sari(Register dst, Register src,
+                                     int32_t amount) {
   if (dst != src) mov(dst, src);
   sar(dst, amount & 31);
 }
@@ -913,8 +919,8 @@ void LiftoffAssembler::emit_i32_shr(Register dst, Register src,
   liftoff::EmitShiftOperation(this, dst, src, amount, &Assembler::shr_cl);
 }
 
-void LiftoffAssembler::emit_i32_shr(Register dst, Register src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i32_shri(Register dst, Register src,
+                                     int32_t amount) {
   if (dst != src) mov(dst, src);
   shr(dst, amount & 31);
 }
@@ -1001,8 +1007,8 @@ void LiftoffAssembler::emit_i64_add(LiftoffRegister dst, LiftoffRegister lhs,
   liftoff::OpWithCarry<&Assembler::add, &Assembler::adc>(this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i64_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                    int32_t imm) {
+void LiftoffAssembler::emit_i64_addi(LiftoffRegister dst, LiftoffRegister lhs,
+                                     int32_t imm) {
   liftoff::OpWithCarryI<&Assembler::add, &Assembler::adc>(this, dst, lhs, imm);
 }
 
@@ -1137,8 +1143,8 @@ void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
                                    &TurboAssembler::ShlPair_cl);
 }
 
-void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i64_shli(LiftoffRegister dst, LiftoffRegister src,
+                                     int32_t amount) {
   amount &= 63;
   if (amount >= 32) {
     if (dst.high_gp() != src.low_gp()) mov(dst.high_gp(), src.low_gp());
@@ -1156,8 +1162,8 @@ void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
                                    &TurboAssembler::SarPair_cl);
 }
 
-void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i64_sari(LiftoffRegister dst, LiftoffRegister src,
+                                     int32_t amount) {
   amount &= 63;
   if (amount >= 32) {
     if (dst.low_gp() != src.high_gp()) mov(dst.low_gp(), src.high_gp());
@@ -1175,8 +1181,8 @@ void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
                                    &TurboAssembler::ShrPair_cl);
 }
 
-void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i64_shri(LiftoffRegister dst, LiftoffRegister src,
+                                     int32_t amount) {
   amount &= 63;
   if (amount >= 32) {
     if (dst.low_gp() != src.high_gp()) mov(dst.low_gp(), src.high_gp());
@@ -1339,7 +1345,7 @@ inline void EmitFloatMinOrMax(LiftoffAssembler* assm, DoubleRegister dst,
 
   // We need one tmp register to extract the sign bit. Get it right at the
   // beginning, such that the spilling code is not accidentially jumped over.
-  Register tmp = assm->GetUnusedRegister(kGpReg).gp();
+  Register tmp = assm->GetUnusedRegister(kGpReg, {}).gp();
 
 #define dop(name, ...)            \
   do {                            \
@@ -1402,9 +1408,9 @@ void LiftoffAssembler::emit_f32_max(DoubleRegister dst, DoubleRegister lhs,
 void LiftoffAssembler::emit_f32_copysign(DoubleRegister dst, DoubleRegister lhs,
                                          DoubleRegister rhs) {
   static constexpr int kF32SignBit = 1 << 31;
-  Register scratch = GetUnusedRegister(kGpReg).gp();
-  Register scratch2 =
-      GetUnusedRegister(kGpReg, LiftoffRegList::ForRegs(scratch)).gp();
+  LiftoffRegList pinned;
+  Register scratch = pinned.set(GetUnusedRegister(kGpReg, pinned)).gp();
+  Register scratch2 = GetUnusedRegister(kGpReg, pinned).gp();
   Movd(scratch, lhs);                      // move {lhs} into {scratch}.
   and_(scratch, Immediate(~kF32SignBit));  // clear sign bit in {scratch}.
   Movd(scratch2, rhs);                     // move {rhs} into {scratch2}.
@@ -1531,9 +1537,9 @@ void LiftoffAssembler::emit_f64_copysign(DoubleRegister dst, DoubleRegister lhs,
   static constexpr int kF32SignBit = 1 << 31;
   // On ia32, we cannot hold the whole f64 value in a gp register, so we just
   // operate on the upper half (UH).
-  Register scratch = GetUnusedRegister(kGpReg).gp();
-  Register scratch2 =
-      GetUnusedRegister(kGpReg, LiftoffRegList::ForRegs(scratch)).gp();
+  LiftoffRegList pinned;
+  Register scratch = pinned.set(GetUnusedRegister(kGpReg, pinned)).gp();
+  Register scratch2 = GetUnusedRegister(kGpReg, pinned).gp();
 
   Pextrd(scratch, lhs, 1);                 // move UH of {lhs} into {scratch}.
   and_(scratch, Immediate(~kF32SignBit));  // clear sign bit in {scratch}.
@@ -1602,6 +1608,7 @@ void LiftoffAssembler::emit_f64_sqrt(DoubleRegister dst, DoubleRegister src) {
 }
 
 namespace liftoff {
+#define __ assm->
 // Used for float to int conversions. If the value in {converted_back} equals
 // {src} afterwards, the conversion succeeded.
 template <typename dst_type, typename src_type>
@@ -1611,21 +1618,21 @@ inline void ConvertFloatToIntAndBack(LiftoffAssembler* assm, Register dst,
                                      LiftoffRegList pinned) {
   if (std::is_same<double, src_type>::value) {  // f64
     if (std::is_signed<dst_type>::value) {      // f64 -> i32
-      assm->cvttsd2si(dst, src);
-      assm->Cvtsi2sd(converted_back, dst);
+      __ cvttsd2si(dst, src);
+      __ Cvtsi2sd(converted_back, dst);
     } else {  // f64 -> u32
-      assm->Cvttsd2ui(dst, src, liftoff::kScratchDoubleReg);
-      assm->Cvtui2sd(converted_back, dst,
-                     assm->GetUnusedRegister(kGpReg, pinned).gp());
+      __ Cvttsd2ui(dst, src, liftoff::kScratchDoubleReg);
+      __ Cvtui2sd(converted_back, dst,
+                  __ GetUnusedRegister(kGpReg, pinned).gp());
     }
   } else {                                  // f32
     if (std::is_signed<dst_type>::value) {  // f32 -> i32
-      assm->cvttss2si(dst, src);
-      assm->Cvtsi2ss(converted_back, dst);
+      __ cvttss2si(dst, src);
+      __ Cvtsi2ss(converted_back, dst);
     } else {  // f32 -> u32
-      assm->Cvttss2ui(dst, src, liftoff::kScratchDoubleReg);
-      assm->Cvtui2ss(converted_back, dst,
-                     assm->GetUnusedRegister(kGpReg, pinned).gp());
+      __ Cvttss2ui(dst, src, liftoff::kScratchDoubleReg);
+      __ Cvtui2ss(converted_back, dst,
+                  __ GetUnusedRegister(kGpReg, pinned).gp());
     }
   }
 }
@@ -1634,36 +1641,101 @@ template <typename dst_type, typename src_type>
 inline bool EmitTruncateFloatToInt(LiftoffAssembler* assm, Register dst,
                                    DoubleRegister src, Label* trap) {
   if (!CpuFeatures::IsSupported(SSE4_1)) {
-    assm->bailout(kMissingCPUFeature, "no SSE4.1");
+    __ bailout(kMissingCPUFeature, "no SSE4.1");
     return true;
   }
   CpuFeatureScope feature(assm, SSE4_1);
 
   LiftoffRegList pinned = LiftoffRegList::ForRegs(src, dst);
   DoubleRegister rounded =
-      pinned.set(assm->GetUnusedRegister(kFpReg, pinned)).fp();
+      pinned.set(__ GetUnusedRegister(kFpReg, pinned)).fp();
   DoubleRegister converted_back =
-      pinned.set(assm->GetUnusedRegister(kFpReg, pinned)).fp();
+      pinned.set(__ GetUnusedRegister(kFpReg, pinned)).fp();
 
   if (std::is_same<double, src_type>::value) {  // f64
-    assm->roundsd(rounded, src, kRoundToZero);
+    __ roundsd(rounded, src, kRoundToZero);
   } else {  // f32
-    assm->roundss(rounded, src, kRoundToZero);
+    __ roundss(rounded, src, kRoundToZero);
   }
   ConvertFloatToIntAndBack<dst_type, src_type>(assm, dst, rounded,
                                                converted_back, pinned);
   if (std::is_same<double, src_type>::value) {  // f64
-    assm->ucomisd(converted_back, rounded);
+    __ ucomisd(converted_back, rounded);
   } else {  // f32
-    assm->ucomiss(converted_back, rounded);
+    __ ucomiss(converted_back, rounded);
   }
 
   // Jump to trap if PF is 0 (one of the operands was NaN) or they are not
   // equal.
-  assm->j(parity_even, trap);
-  assm->j(not_equal, trap);
+  __ j(parity_even, trap);
+  __ j(not_equal, trap);
+  return true;
+}
+
+template <typename dst_type, typename src_type>
+inline bool EmitSatTruncateFloatToInt(LiftoffAssembler* assm, Register dst,
+                                      DoubleRegister src) {
+  if (!CpuFeatures::IsSupported(SSE4_1)) {
+    __ bailout(kMissingCPUFeature, "no SSE4.1");
+    return true;
+  }
+  CpuFeatureScope feature(assm, SSE4_1);
+
+  Label done;
+  Label not_nan;
+  Label src_positive;
+
+  LiftoffRegList pinned = LiftoffRegList::ForRegs(src, dst);
+  DoubleRegister rounded =
+      pinned.set(__ GetUnusedRegister(kFpReg, pinned)).fp();
+  DoubleRegister converted_back =
+      pinned.set(__ GetUnusedRegister(kFpReg, pinned)).fp();
+  DoubleRegister zero_reg =
+      pinned.set(__ GetUnusedRegister(kFpReg, pinned)).fp();
+
+  if (std::is_same<double, src_type>::value) {  // f64
+    __ roundsd(rounded, src, kRoundToZero);
+  } else {  // f32
+    __ roundss(rounded, src, kRoundToZero);
+  }
+
+  ConvertFloatToIntAndBack<dst_type, src_type>(assm, dst, rounded,
+                                               converted_back, pinned);
+  if (std::is_same<double, src_type>::value) {  // f64
+    __ ucomisd(converted_back, rounded);
+  } else {  // f32
+    __ ucomiss(converted_back, rounded);
+  }
+
+  // Return 0 if PF is 0 (one of the operands was NaN)
+  __ j(parity_odd, &not_nan);
+  __ xor_(dst, dst);
+  __ jmp(&done);
+
+  __ bind(&not_nan);
+  // If rounding is as expected, return result
+  __ j(equal, &done);
+
+  __ Xorpd(zero_reg, zero_reg);
+
+  // if out-of-bounds, check if src is positive
+  if (std::is_same<double, src_type>::value) {  // f64
+    __ ucomisd(src, zero_reg);
+  } else {  // f32
+    __ ucomiss(src, zero_reg);
+  }
+  __ j(above, &src_positive);
+  __ mov(dst, Immediate(std::numeric_limits<dst_type>::min()));
+  __ jmp(&done);
+
+  __ bind(&src_positive);
+
+  __ mov(dst, Immediate(std::numeric_limits<dst_type>::max()));
+
+  __ bind(&done);
   return true;
 }
+#undef __
 }  // namespace liftoff
 
 bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
@@ -1685,6 +1757,18 @@ bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
     case kExprI32UConvertF64:
       return liftoff::EmitTruncateFloatToInt<uint32_t, double>(this, dst.gp(),
                                                                src.fp(), trap);
+    case kExprI32SConvertSatF32:
+      return liftoff::EmitSatTruncateFloatToInt<int32_t, float>(this, dst.gp(),
+                                                                src.fp());
+    case kExprI32UConvertSatF32:
+      return liftoff::EmitSatTruncateFloatToInt<uint32_t, float>(this, dst.gp(),
+                                                                 src.fp());
+    case kExprI32SConvertSatF64:
+      return liftoff::EmitSatTruncateFloatToInt<int32_t, double>(this, dst.gp(),
+                                                                 src.fp());
+    case kExprI32UConvertSatF64:
+      return liftoff::EmitSatTruncateFloatToInt<uint32_t, double>(
+          this, dst.gp(), src.fp());
     case kExprI32ReinterpretF32:
       Movd(dst.gp(), src.fp());
       return true;
@@ -1950,14 +2034,19 @@ void EmitSimdCommutativeBinOp(
 
 template <void (Assembler::*avx_op)(XMMRegister, XMMRegister, XMMRegister),
           void (Assembler::*sse_op)(XMMRegister, XMMRegister)>
-void EmitSimdSub(LiftoffAssembler* assm, LiftoffRegister dst,
-                 LiftoffRegister lhs, LiftoffRegister rhs) {
+void EmitSimdNonCommutativeBinOp(
+    LiftoffAssembler* assm, LiftoffRegister dst, LiftoffRegister lhs,
+    LiftoffRegister rhs, base::Optional<CpuFeature> feature = base::nullopt) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(assm, AVX);
     (assm->*avx_op)(dst.fp(), lhs.fp(), rhs.fp());
-  } else if (lhs.fp() == rhs.fp()) {
-    assm->pxor(dst.fp(), dst.fp());
-  } else if (dst.fp() == rhs.fp()) {
+    return;
+  }
+
+  base::Optional<CpuFeatureScope> sse_scope;
+  if (feature.has_value()) sse_scope.emplace(assm, *feature);
+
+  if (dst.fp() == rhs.fp()) {
     assm->movaps(kScratchDoubleReg, rhs.fp());
     assm->movaps(dst.fp(), lhs.fp());
     (assm->*sse_op)(dst.fp(), kScratchDoubleReg);
@@ -1966,68 +2055,187 @@ void EmitSimdSub(LiftoffAssembler* assm, LiftoffRegister dst,
     (assm->*sse_op)(dst.fp(), rhs.fp());
   }
 }
-}  // namespace liftoff
 
-void LiftoffAssembler::emit_f64x2_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  Movddup(dst.fp(), src.fp());
-}
+template <void (Assembler::*avx_op)(XMMRegister, XMMRegister, XMMRegister),
+          void (Assembler::*sse_op)(XMMRegister, XMMRegister), uint8_t width>
+void EmitSimdShiftOp(LiftoffAssembler* assm, LiftoffRegister dst,
+                     LiftoffRegister operand, LiftoffRegister count) {
+  static constexpr RegClass tmp_rc = reg_class_for(ValueType::kI32);
+  LiftoffRegister tmp =
+      assm->GetUnusedRegister(tmp_rc, LiftoffRegList::ForRegs(count));
+  constexpr int mask = (1 << width) - 1;
 
-void LiftoffAssembler::emit_f64x2_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
+  assm->mov(tmp.gp(), count.gp());
+  assm->and_(tmp.gp(), Immediate(mask));
+  assm->Movd(kScratchDoubleReg, tmp.gp());
   if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vshufpd(dst.fp(), lhs.fp(), lhs.fp(), imm_lane_idx);
+    CpuFeatureScope scope(assm, AVX);
+    (assm->*avx_op)(dst.fp(), operand.fp(), kScratchDoubleReg);
   } else {
-    if (dst.fp() != lhs.fp()) movaps(dst.fp(), lhs.fp());
-    if (imm_lane_idx != 0) shufpd(dst.fp(), dst.fp(), imm_lane_idx);
+    if (dst.fp() != operand.fp()) assm->movaps(dst.fp(), operand.fp());
+    (assm->*sse_op)(dst.fp(), kScratchDoubleReg);
   }
 }
 
-void LiftoffAssembler::emit_f64x2_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  // TODO(fanchenk): Use movlhps and blendpd
+template <void (Assembler::*avx_op)(XMMRegister, XMMRegister, byte),
+          void (Assembler::*sse_op)(XMMRegister, byte), uint8_t width>
+void EmitSimdShiftOpImm(LiftoffAssembler* assm, LiftoffRegister dst,
+                        LiftoffRegister operand, int32_t count) {
+  constexpr int mask = (1 << width) - 1;
+  byte shift = static_cast<byte>(count & mask);
   if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    if (imm_lane_idx == 0) {
-      vinsertps(dst.fp(), src1.fp(), src2.fp(), 0b00000000);
-      vinsertps(dst.fp(), dst.fp(), src2.fp(), 0b01010000);
-    } else {
-      vinsertps(dst.fp(), src1.fp(), src2.fp(), 0b00100000);
-      vinsertps(dst.fp(), dst.fp(), src2.fp(), 0b01110000);
+    CpuFeatureScope scope(assm, AVX);
+    (assm->*avx_op)(dst.fp(), operand.fp(), shift);
+  } else {
+    if (dst.fp() != operand.fp()) assm->movaps(dst.fp(), operand.fp());
+    (assm->*sse_op)(dst.fp(), shift);
+  }
+}
+
+enum class ShiftSignedness { kSigned, kUnsigned };
+
+template <bool is_signed>
+void EmitI8x16Shr(LiftoffAssembler* assm, LiftoffRegister dst,
+                  LiftoffRegister lhs, LiftoffRegister rhs) {
+  // Same algorithm is used for both signed and unsigned shifts, the only
+  // difference is the actual shift and pack in the end. This is the same
+  // algorithm as used in code-generator-ia32.cc
+  Register tmp =
+      assm->GetUnusedRegister(kGpReg, LiftoffRegList::ForRegs(rhs)).gp();
+  XMMRegister tmp_simd =
+      assm->GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(dst, lhs)).fp();
+
+  // Unpack the bytes into words, do logical shifts, and repack.
+  assm->Punpckhbw(liftoff::kScratchDoubleReg, lhs.fp());
+  assm->Punpcklbw(dst.fp(), lhs.fp());
+  assm->mov(tmp, rhs.gp());
+  // Take shift value modulo 8.
+  assm->and_(tmp, 7);
+  assm->add(tmp, Immediate(8));
+  assm->Movd(tmp_simd, tmp);
+  if (is_signed) {
+    assm->Psraw(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg,
+                tmp_simd);
+    assm->Psraw(dst.fp(), dst.fp(), tmp_simd);
+    assm->Packsswb(dst.fp(), liftoff::kScratchDoubleReg);
+  } else {
+    assm->Psrlw(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg,
+                tmp_simd);
+    assm->Psrlw(dst.fp(), dst.fp(), tmp_simd);
+    assm->Packuswb(dst.fp(), liftoff::kScratchDoubleReg);
+  }
+}
+
+inline void EmitAnyTrue(LiftoffAssembler* assm, LiftoffRegister dst,
+                        LiftoffRegister src) {
+  Register tmp =
+      assm->GetUnusedRegister(kGpReg, LiftoffRegList::ForRegs(dst)).gp();
+  assm->xor_(tmp, tmp);
+  assm->mov(dst.gp(), Immediate(1));
+  assm->Ptest(src.fp(), src.fp());
+  assm->cmov(zero, dst.gp(), tmp);
+}
+
+template <void (TurboAssembler::*pcmp)(XMMRegister, XMMRegister)>
+inline void EmitAllTrue(LiftoffAssembler* assm, LiftoffRegister dst,
+                        LiftoffRegister src) {
+  Register tmp =
+      assm->GetUnusedRegister(kGpReg, LiftoffRegList::ForRegs(dst)).gp();
+  XMMRegister tmp_simd = liftoff::kScratchDoubleReg;
+  assm->mov(tmp, Immediate(1));
+  assm->xor_(dst.gp(), dst.gp());
+  assm->Pxor(tmp_simd, tmp_simd);
+  (assm->*pcmp)(tmp_simd, src.fp());
+  assm->Ptest(tmp_simd, tmp_simd);
+  assm->cmov(zero, dst.gp(), tmp);
+}
+
+}  // namespace liftoff
+
+void LiftoffAssembler::LoadTransform(LiftoffRegister dst, Register src_addr,
+                                     Register offset_reg, uint32_t offset_imm,
+                                     LoadType type,
+                                     LoadTransformationKind transform,
+                                     uint32_t* protected_load_pc) {
+  DCHECK_LE(offset_imm, std::numeric_limits<int32_t>::max());
+  Operand src_op{src_addr, offset_reg, times_1,
+                 static_cast<int32_t>(offset_imm)};
+  *protected_load_pc = pc_offset();
+
+  MachineType memtype = type.mem_type();
+  if (transform == LoadTransformationKind::kExtend) {
+    if (memtype == MachineType::Int8()) {
+      Pmovsxbw(dst.fp(), src_op);
+    } else if (memtype == MachineType::Uint8()) {
+      Pmovzxbw(dst.fp(), src_op);
+    } else if (memtype == MachineType::Int16()) {
+      Pmovsxwd(dst.fp(), src_op);
+    } else if (memtype == MachineType::Uint16()) {
+      Pmovzxwd(dst.fp(), src_op);
+    } else if (memtype == MachineType::Int32()) {
+      Pmovsxdq(dst.fp(), src_op);
+    } else if (memtype == MachineType::Uint32()) {
+      Pmovzxdq(dst.fp(), src_op);
     }
   } else {
-    CpuFeatureScope scope(this, SSE4_1);
-    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
-    if (imm_lane_idx == 0) {
-      insertps(dst.fp(), src2.fp(), 0b00000000);
-      insertps(dst.fp(), src2.fp(), 0b01010000);
-    } else {
-      insertps(dst.fp(), src2.fp(), 0b00100000);
-      insertps(dst.fp(), src2.fp(), 0b01110000);
+    DCHECK_EQ(LoadTransformationKind::kSplat, transform);
+    if (memtype == MachineType::Int8()) {
+      Pinsrb(dst.fp(), src_op, 0);
+      Pxor(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+      Pshufb(dst.fp(), liftoff::kScratchDoubleReg);
+    } else if (memtype == MachineType::Int16()) {
+      Pinsrw(dst.fp(), src_op, 0);
+      Pshuflw(dst.fp(), dst.fp(), uint8_t{0});
+      Punpcklqdq(dst.fp(), dst.fp());
+    } else if (memtype == MachineType::Int32()) {
+      Vbroadcastss(dst.fp(), src_op);
+    } else if (memtype == MachineType::Int64()) {
+      Movddup(dst.fp(), src_op);
     }
   }
 }
 
-void LiftoffAssembler::emit_f64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vaddpd, &Assembler::addpd>(
-      this, dst, lhs, rhs);
+void LiftoffAssembler::emit_s8x16_swizzle(LiftoffRegister dst,
+                                          LiftoffRegister lhs,
+                                          LiftoffRegister rhs) {
+  XMMRegister mask =
+      GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(lhs, rhs)).fp();
+  // Out-of-range indices should return 0, add 112 (0x70) so that any value > 15
+  // saturates to 128 (top bit set), so pshufb will zero that lane.
+  TurboAssembler::Move(mask, uint32_t{0x70707070});
+  Pshufd(mask, mask, uint8_t{0x0});
+  Paddusb(mask, rhs.fp());
+  if (lhs != dst) {
+    Movaps(dst.fp(), lhs.fp());
+  }
+  Pshufb(dst.fp(), mask);
 }
 
-void LiftoffAssembler::emit_f64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdSub<&Assembler::vsubpd, &Assembler::subpd>(this, dst, lhs,
-                                                              rhs);
+void LiftoffAssembler::emit_i8x16_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  Movd(dst.fp(), src.gp());
+  Pxor(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+  Pshufb(dst.fp(), liftoff::kScratchDoubleReg);
 }
 
-void LiftoffAssembler::emit_f64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vmulpd, &Assembler::mulpd>(
-      this, dst, lhs, rhs);
+void LiftoffAssembler::emit_i16x8_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  Movd(dst.fp(), src.gp());
+  Pshuflw(dst.fp(), dst.fp(), 0);
+  Pshufd(dst.fp(), dst.fp(), 0);
+}
+
+void LiftoffAssembler::emit_i32x4_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  Movd(dst.fp(), src.gp());
+  Pshufd(dst.fp(), dst.fp(), 0);
+}
+
+void LiftoffAssembler::emit_i64x2_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  Pinsrd(dst.fp(), src.low_gp(), 0);
+  Pinsrd(dst.fp(), src.high_gp(), 1);
+  Pshufd(dst.fp(), dst.fp(), 0x44);
 }
 
 void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
@@ -2043,246 +2251,391 @@ void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
   }
 }
 
-void LiftoffAssembler::emit_f32x4_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vshufps(dst.fp(), lhs.fp(), lhs.fp(), imm_lane_idx);
-  } else {
-    if (dst.fp() != lhs.fp()) movaps(dst.fp(), lhs.fp());
-    if (imm_lane_idx != 0) shufps(dst.fp(), dst.fp(), imm_lane_idx);
-  }
+void LiftoffAssembler::emit_f64x2_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  Movddup(dst.fp(), src.fp());
 }
 
-void LiftoffAssembler::emit_f32x4_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vinsertps(dst.fp(), src1.fp(), src2.fp(), (imm_lane_idx << 4) & 0x30);
-  } else {
-    CpuFeatureScope scope(this, SSE4_1);
-    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
-    insertps(dst.fp(), src2.fp(), (imm_lane_idx << 4) & 0x30);
-  }
+void LiftoffAssembler::emit_i8x16_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpcmpeqb, &Assembler::pcmpeqb>(
+      this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_f32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vaddps, &Assembler::addps>(
+void LiftoffAssembler::emit_i8x16_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpcmpeqb, &Assembler::pcmpeqb>(
       this, dst, lhs, rhs);
+  Pcmpeqb(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+  Pxor(dst.fp(), liftoff::kScratchDoubleReg);
 }
 
-void LiftoffAssembler::emit_f32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdSub<&Assembler::vsubps, &Assembler::subps>(this, dst, lhs,
-                                                              rhs);
+void LiftoffAssembler::emit_i8x16_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpcmpgtb,
+                                       &Assembler::pcmpgtb>(this, dst, lhs,
+                                                            rhs);
 }
 
-void LiftoffAssembler::emit_f32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vmulps, &Assembler::mulps>(
+void LiftoffAssembler::emit_i8x16_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(liftoff::kScratchDoubleReg, rhs.fp());
+    ref = liftoff::kScratchDoubleReg;
+  }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxub, &Assembler::pmaxub>(
       this, dst, lhs, rhs);
+  Pcmpeqb(dst.fp(), ref);
+  Pcmpeqb(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+  Pxor(dst.fp(), liftoff::kScratchDoubleReg);
 }
 
-void LiftoffAssembler::emit_i64x2_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  Pinsrd(dst.fp(), src.low_gp(), 0);
-  Pinsrd(dst.fp(), src.high_gp(), 1);
-  Pshufd(dst.fp(), dst.fp(), 0x44);
+void LiftoffAssembler::emit_i8x16_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(liftoff::kScratchDoubleReg, rhs.fp());
+    ref = liftoff::kScratchDoubleReg;
+  }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminsb, &Assembler::pminsb>(
+      this, dst, lhs, rhs, SSE4_1);
+  Pcmpeqb(dst.fp(), ref);
 }
 
-void LiftoffAssembler::emit_i64x2_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
-  Pextrd(dst.low_gp(), lhs.fp(), imm_lane_idx * 2);
-  Pextrd(dst.high_gp(), lhs.fp(), imm_lane_idx * 2 + 1);
+void LiftoffAssembler::emit_i8x16_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(liftoff::kScratchDoubleReg, rhs.fp());
+    ref = liftoff::kScratchDoubleReg;
+  }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminub, &Assembler::pminub>(
+      this, dst, lhs, rhs);
+  Pcmpeqb(dst.fp(), ref);
 }
 
-void LiftoffAssembler::emit_i64x2_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vpinsrd(dst.fp(), src1.fp(), src2.low_gp(), imm_lane_idx * 2);
-    vpinsrd(dst.fp(), dst.fp(), src2.high_gp(), imm_lane_idx * 2 + 1);
-  } else {
-    CpuFeatureScope scope(this, SSE4_1);
-    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
-    pinsrd(dst.fp(), src2.low_gp(), imm_lane_idx * 2);
-    pinsrd(dst.fp(), src2.high_gp(), imm_lane_idx * 2 + 1);
-  }
+void LiftoffAssembler::emit_i16x8_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpcmpeqw, &Assembler::pcmpeqw>(
+      this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddq, &Assembler::paddq>(
+void LiftoffAssembler::emit_i16x8_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpcmpeqw, &Assembler::pcmpeqw>(
       this, dst, lhs, rhs);
+  Pcmpeqw(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+  Pxor(dst.fp(), liftoff::kScratchDoubleReg);
 }
 
-void LiftoffAssembler::emit_i64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdSub<&Assembler::vpsubq, &Assembler::psubq>(this, dst, lhs,
-                                                              rhs);
+void LiftoffAssembler::emit_i16x8_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpcmpgtw,
+                                       &Assembler::pcmpgtw>(this, dst, lhs,
+                                                            rhs);
 }
 
-void LiftoffAssembler::emit_i64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  static constexpr RegClass tmp_rc = reg_class_for(ValueType::kS128);
-  LiftoffRegister tmp1 =
-      GetUnusedRegister(tmp_rc, LiftoffRegList::ForRegs(dst, lhs, rhs));
-  LiftoffRegister tmp2 =
-      GetUnusedRegister(tmp_rc, LiftoffRegList::ForRegs(dst, lhs, rhs, tmp1));
-  Movaps(tmp1.fp(), lhs.fp());
-  Movaps(tmp2.fp(), rhs.fp());
-  // Multiply high dword of each qword of left with right.
-  Psrlq(tmp1.fp(), 32);
-  Pmuludq(tmp1.fp(), tmp1.fp(), rhs.fp());
-  // Multiply high dword of each qword of right with left.
-  Psrlq(tmp2.fp(), 32);
-  Pmuludq(tmp2.fp(), tmp2.fp(), lhs.fp());
-  Paddq(tmp2.fp(), tmp2.fp(), tmp1.fp());
-  Psllq(tmp2.fp(), tmp2.fp(), 32);
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vpmuludq(dst.fp(), lhs.fp(), rhs.fp());
-  } else {
-    if (dst.fp() != lhs.fp()) movaps(dst.fp(), lhs.fp());
-    pmuludq(dst.fp(), rhs.fp());
+void LiftoffAssembler::emit_i16x8_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(liftoff::kScratchDoubleReg, rhs.fp());
+    ref = liftoff::kScratchDoubleReg;
   }
-  Paddq(dst.fp(), dst.fp(), tmp2.fp());
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxuw, &Assembler::pmaxuw>(
+      this, dst, lhs, rhs);
+  Pcmpeqw(dst.fp(), ref);
+  Pcmpeqw(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+  Pxor(dst.fp(), liftoff::kScratchDoubleReg);
 }
 
-void LiftoffAssembler::emit_i32x4_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  Movd(dst.fp(), src.gp());
-  Pshufd(dst.fp(), dst.fp(), 0);
+void LiftoffAssembler::emit_i16x8_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(liftoff::kScratchDoubleReg, rhs.fp());
+    ref = liftoff::kScratchDoubleReg;
+  }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminsw, &Assembler::pminsw>(
+      this, dst, lhs, rhs);
+  Pcmpeqw(dst.fp(), ref);
 }
 
-void LiftoffAssembler::emit_i32x4_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
-  Pextrd(dst.gp(), lhs.fp(), imm_lane_idx);
+void LiftoffAssembler::emit_i16x8_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(liftoff::kScratchDoubleReg, rhs.fp());
+    ref = liftoff::kScratchDoubleReg;
+  }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminuw, &Assembler::pminuw>(
+      this, dst, lhs, rhs, SSE4_1);
+  Pcmpeqw(dst.fp(), ref);
 }
 
-void LiftoffAssembler::emit_i32x4_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vpinsrd(dst.fp(), src1.fp(), src2.gp(), imm_lane_idx);
-  } else {
-    CpuFeatureScope scope(this, SSE4_1);
-    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
-    pinsrd(dst.fp(), src2.gp(), imm_lane_idx);
+void LiftoffAssembler::emit_i32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpcmpeqd, &Assembler::pcmpeqd>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpcmpeqd, &Assembler::pcmpeqd>(
+      this, dst, lhs, rhs);
+  Pcmpeqd(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+  Pxor(dst.fp(), liftoff::kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_i32x4_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpcmpgtd,
+                                       &Assembler::pcmpgtd>(this, dst, lhs,
+                                                            rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(liftoff::kScratchDoubleReg, rhs.fp());
+    ref = liftoff::kScratchDoubleReg;
   }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxud, &Assembler::pmaxud>(
+      this, dst, lhs, rhs);
+  Pcmpeqd(dst.fp(), ref);
+  Pcmpeqd(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+  Pxor(dst.fp(), liftoff::kScratchDoubleReg);
 }
 
-void LiftoffAssembler::emit_i32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddd, &Assembler::paddd>(
+void LiftoffAssembler::emit_i32x4_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(liftoff::kScratchDoubleReg, rhs.fp());
+    ref = liftoff::kScratchDoubleReg;
+  }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminsd, &Assembler::pminsd>(
+      this, dst, lhs, rhs, SSE4_1);
+  Pcmpeqd(dst.fp(), ref);
+}
+
+void LiftoffAssembler::emit_i32x4_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(liftoff::kScratchDoubleReg, rhs.fp());
+    ref = liftoff::kScratchDoubleReg;
+  }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminud, &Assembler::pminud>(
+      this, dst, lhs, rhs, SSE4_1);
+  Pcmpeqd(dst.fp(), ref);
+}
+
+void LiftoffAssembler::emit_f32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vcmpeqps, &Assembler::cmpeqps>(
       this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdSub<&Assembler::vpsubd, &Assembler::psubd>(this, dst, lhs,
-                                                              rhs);
+void LiftoffAssembler::emit_f32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vcmpneqps,
+                                    &Assembler::cmpneqps>(this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmulld, &Assembler::pmulld>(
-      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+void LiftoffAssembler::emit_f32x4_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vcmpltps,
+                                       &Assembler::cmpltps>(this, dst, lhs,
+                                                            rhs);
 }
 
-void LiftoffAssembler::emit_i16x8_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  Movd(dst.fp(), src.gp());
-  Pshuflw(dst.fp(), dst.fp(), 0);
-  Pshufd(dst.fp(), dst.fp(), 0);
+void LiftoffAssembler::emit_f32x4_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vcmpleps,
+                                       &Assembler::cmpleps>(this, dst, lhs,
+                                                            rhs);
 }
 
-void LiftoffAssembler::emit_i16x8_extract_lane_u(LiftoffRegister dst,
-                                                 LiftoffRegister lhs,
-                                                 uint8_t imm_lane_idx) {
-  Pextrw(dst.gp(), lhs.fp(), imm_lane_idx);
+void LiftoffAssembler::emit_f64x2_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vcmpeqpd, &Assembler::cmpeqpd>(
+      this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i16x8_extract_lane_s(LiftoffRegister dst,
-                                                 LiftoffRegister lhs,
-                                                 uint8_t imm_lane_idx) {
-  Pextrw(dst.gp(), lhs.fp(), imm_lane_idx);
-  movsx_w(dst.gp(), dst.gp());
+void LiftoffAssembler::emit_f64x2_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vcmpneqpd,
+                                    &Assembler::cmpneqpd>(this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i16x8_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vpinsrw(dst.fp(), src1.fp(), src2.gp(), imm_lane_idx);
+void LiftoffAssembler::emit_f64x2_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vcmpltpd,
+                                       &Assembler::cmpltpd>(this, dst, lhs,
+                                                            rhs);
+}
+
+void LiftoffAssembler::emit_f64x2_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vcmplepd,
+                                       &Assembler::cmplepd>(this, dst, lhs,
+                                                            rhs);
+}
+
+void LiftoffAssembler::emit_s128_not(LiftoffRegister dst, LiftoffRegister src) {
+  if (dst.fp() != src.fp()) {
+    Pcmpeqd(dst.fp(), dst.fp());
+    Pxor(dst.fp(), src.fp());
   } else {
-    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
-    pinsrw(dst.fp(), src2.gp(), imm_lane_idx);
+    Pcmpeqd(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+    Pxor(dst.fp(), liftoff::kScratchDoubleReg);
   }
 }
 
-void LiftoffAssembler::emit_i16x8_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddw, &Assembler::paddw>(
+void LiftoffAssembler::emit_s128_and(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpand, &Assembler::pand>(
       this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i16x8_sub(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdSub<&Assembler::vpsubw, &Assembler::psubw>(this, dst, lhs,
-                                                              rhs);
+void LiftoffAssembler::emit_s128_or(LiftoffRegister dst, LiftoffRegister lhs,
+                                    LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpor, &Assembler::por>(
+      this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i16x8_mul(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmullw, &Assembler::pmullw>(
+void LiftoffAssembler::emit_s128_xor(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpxor, &Assembler::pxor>(
       this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i8x16_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  Movd(dst.fp(), src.gp());
-  Pxor(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
-  Pshufb(dst.fp(), liftoff::kScratchDoubleReg);
+void LiftoffAssembler::emit_s128_select(LiftoffRegister dst,
+                                        LiftoffRegister src1,
+                                        LiftoffRegister src2,
+                                        LiftoffRegister mask) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vxorps(liftoff::kScratchDoubleReg, src1.fp(), src2.fp());
+    vandps(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg, mask.fp());
+    vxorps(dst.fp(), liftoff::kScratchDoubleReg, src2.fp());
+  } else {
+    movaps(liftoff::kScratchDoubleReg, src1.fp());
+    xorps(liftoff::kScratchDoubleReg, src2.fp());
+    andps(liftoff::kScratchDoubleReg, mask.fp());
+    if (dst.fp() != src2.fp()) movaps(dst.fp(), src2.fp());
+    xorps(dst.fp(), liftoff::kScratchDoubleReg);
+  }
 }
 
-void LiftoffAssembler::emit_i8x16_extract_lane_u(LiftoffRegister dst,
-                                                 LiftoffRegister lhs,
-                                                 uint8_t imm_lane_idx) {
-  Pextrb(dst.gp(), lhs.fp(), imm_lane_idx);
+void LiftoffAssembler::emit_i8x16_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  if (dst.fp() == src.fp()) {
+    Pcmpeqd(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+    Psignb(dst.fp(), liftoff::kScratchDoubleReg);
+  } else {
+    Pxor(dst.fp(), dst.fp());
+    Psubb(dst.fp(), src.fp());
+  }
 }
 
-void LiftoffAssembler::emit_i8x16_extract_lane_s(LiftoffRegister dst,
-                                                 LiftoffRegister lhs,
-                                                 uint8_t imm_lane_idx) {
-  Pextrb(dst.gp(), lhs.fp(), imm_lane_idx);
-  movsx_b(dst.gp(), dst.gp());
+void LiftoffAssembler::emit_v8x16_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAnyTrue(this, dst, src);
 }
 
-void LiftoffAssembler::emit_i8x16_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
+void LiftoffAssembler::emit_v8x16_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAllTrue<&TurboAssembler::Pcmpeqb>(this, dst, src);
+}
+
+void LiftoffAssembler::emit_i8x16_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  static constexpr RegClass tmp_rc = reg_class_for(ValueType::kI32);
+  static constexpr RegClass tmp_simd_rc = reg_class_for(ValueType::kS128);
+  LiftoffRegister tmp = GetUnusedRegister(tmp_rc, LiftoffRegList::ForRegs(rhs));
+  LiftoffRegister tmp_simd =
+      GetUnusedRegister(tmp_simd_rc, LiftoffRegList::ForRegs(dst, lhs));
+  // Mask off the unwanted bits before word-shifting.
+  Pcmpeqw(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+  mov(tmp.gp(), rhs.gp());
+  and_(tmp.gp(), Immediate(7));
+  add(tmp.gp(), Immediate(8));
+  Movd(tmp_simd.fp(), tmp.gp());
+  Psrlw(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg, tmp_simd.fp());
+  Packuswb(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
-    vpinsrb(dst.fp(), src1.fp(), src2.gp(), imm_lane_idx);
+    vpand(dst.fp(), lhs.fp(), liftoff::kScratchDoubleReg);
   } else {
-    CpuFeatureScope scope(this, SSE4_1);
-    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
-    pinsrb(dst.fp(), src2.gp(), imm_lane_idx);
+    if (dst.fp() != lhs.fp()) movaps(dst.fp(), lhs.fp());
+    pand(dst.fp(), liftoff::kScratchDoubleReg);
+  }
+  sub(tmp.gp(), Immediate(8));
+  Movd(tmp_simd.fp(), tmp.gp());
+  Psllw(dst.fp(), dst.fp(), tmp_simd.fp());
+}
+
+void LiftoffAssembler::emit_i8x16_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  static constexpr RegClass tmp_rc = reg_class_for(ValueType::kI32);
+  LiftoffRegister tmp = GetUnusedRegister(tmp_rc, {});
+  byte shift = static_cast<byte>(rhs & 0x7);
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpsllw(dst.fp(), lhs.fp(), shift);
+  } else {
+    if (dst.fp() != lhs.fp()) movaps(dst.fp(), lhs.fp());
+    psllw(dst.fp(), shift);
   }
+
+  uint8_t bmask = static_cast<uint8_t>(0xff << shift);
+  uint32_t mask = bmask << 24 | bmask << 16 | bmask << 8 | bmask;
+  mov(tmp.gp(), mask);
+  Movd(liftoff::kScratchDoubleReg, tmp.gp());
+  Pshufd(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg, uint8_t{0});
+  Pand(dst.fp(), liftoff::kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_i8x16_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitI8x16Shr</*is_signed=*/true>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  Punpckhbw(liftoff::kScratchDoubleReg, lhs.fp());
+  Punpcklbw(dst.fp(), lhs.fp());
+  uint8_t shift = (rhs & 7) + 8;
+  Psraw(liftoff::kScratchDoubleReg, shift);
+  Psraw(dst.fp(), shift);
+  Packsswb(dst.fp(), liftoff::kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_i8x16_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitI8x16Shr</*is_signed=*/false>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  Register tmp = GetUnusedRegister(kGpReg, {}).gp();
+  // Perform 16-bit shift, then mask away high bits.
+  uint8_t shift = rhs & 7;
+  Psrlw(dst.fp(), lhs.fp(), byte{shift});
+
+  uint8_t bmask = 0xff >> shift;
+  uint32_t mask = bmask << 24 | bmask << 16 | bmask << 8 | bmask;
+  mov(tmp, mask);
+  Movd(liftoff::kScratchDoubleReg, tmp);
+  Pshufd(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg, 0);
+  Pand(dst.fp(), liftoff::kScratchDoubleReg);
 }
 
 void LiftoffAssembler::emit_i8x16_add(LiftoffRegister dst, LiftoffRegister lhs,
@@ -2291,10 +2644,39 @@ void LiftoffAssembler::emit_i8x16_add(LiftoffRegister dst, LiftoffRegister lhs,
       this, dst, lhs, rhs);
 }
 
+void LiftoffAssembler::emit_i8x16_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddsb, &Assembler::paddsb>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddusb, &Assembler::paddusb>(
+      this, dst, lhs, rhs);
+}
+
 void LiftoffAssembler::emit_i8x16_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  liftoff::EmitSimdSub<&Assembler::vpsubb, &Assembler::psubb>(this, dst, lhs,
-                                                              rhs);
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubb, &Assembler::psubb>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubsb, &Assembler::psubsb>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubusb,
+                                       &Assembler::psubusb>(this, dst, lhs,
+                                                            rhs);
 }
 
 void LiftoffAssembler::emit_i8x16_mul(LiftoffRegister dst, LiftoffRegister lhs,
@@ -2359,13 +2741,988 @@ void LiftoffAssembler::emit_i8x16_mul(LiftoffRegister dst, LiftoffRegister lhs,
   }
 }
 
+void LiftoffAssembler::emit_i8x16_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminsb, &Assembler::pminsb>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i8x16_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminub, &Assembler::pminub>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxsb, &Assembler::pmaxsb>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i8x16_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxub, &Assembler::pmaxub>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  if (dst.fp() == src.fp()) {
+    Pcmpeqd(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+    Psignw(dst.fp(), liftoff::kScratchDoubleReg);
+  } else {
+    Pxor(dst.fp(), dst.fp());
+    Psubw(dst.fp(), src.fp());
+  }
+}
+
+void LiftoffAssembler::emit_v16x8_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAnyTrue(this, dst, src);
+}
+
+void LiftoffAssembler::emit_v16x8_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAllTrue<&TurboAssembler::Pcmpeqw>(this, dst, src);
+}
+
+void LiftoffAssembler::emit_i16x8_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpsllw, &Assembler::psllw, 4>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpsllw, &Assembler::psllw, 4>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpsraw, &Assembler::psraw, 4>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpsraw, &Assembler::psraw, 4>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpsrlw, &Assembler::psrlw, 4>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpsrlw, &Assembler::psrlw, 4>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_add(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddw, &Assembler::paddw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddsw, &Assembler::paddsw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddusw, &Assembler::paddusw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubw, &Assembler::psubw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubsw, &Assembler::psubsw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubusw,
+                                       &Assembler::psubusw>(this, dst, lhs,
+                                                            rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmullw, &Assembler::pmullw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminsw, &Assembler::pminsw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminuw, &Assembler::pminuw>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i16x8_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxsw, &Assembler::pmaxsw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxuw, &Assembler::pmaxuw>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  if (dst.fp() == src.fp()) {
+    Pcmpeqd(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+    Psignd(dst.fp(), liftoff::kScratchDoubleReg);
+  } else {
+    Pxor(dst.fp(), dst.fp());
+    Psubd(dst.fp(), src.fp());
+  }
+}
+
+void LiftoffAssembler::emit_v32x4_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAnyTrue(this, dst, src);
+}
+
+void LiftoffAssembler::emit_v32x4_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAllTrue<&TurboAssembler::Pcmpeqd>(this, dst, src);
+}
+
+void LiftoffAssembler::emit_i32x4_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpslld, &Assembler::pslld, 5>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpslld, &Assembler::pslld, 5>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpsrad, &Assembler::psrad, 5>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpsrad, &Assembler::psrad, 5>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpsrld, &Assembler::psrld, 5>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpsrld, &Assembler::psrld, 5>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddd, &Assembler::paddd>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubd, &Assembler::psubd>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmulld, &Assembler::pmulld>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i32x4_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminsd, &Assembler::pminsd>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i32x4_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminud, &Assembler::pminud>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i32x4_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxsd, &Assembler::pmaxsd>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i32x4_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxud, &Assembler::pmaxud>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  DoubleRegister reg =
+      dst.fp() == src.fp() ? liftoff::kScratchDoubleReg : dst.fp();
+  Pxor(reg, reg);
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpsubq(dst.fp(), reg, src.fp());
+  } else {
+    psubq(reg, src.fp());
+    if (dst.fp() != reg) movapd(dst.fp(), reg);
+  }
+}
+
+void LiftoffAssembler::emit_i64x2_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpsllq, &Assembler::psllq, 6>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpsllq, &Assembler::psllq, 6>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  XMMRegister shift = liftoff::kScratchDoubleReg;
+  XMMRegister tmp =
+      GetUnusedRegister(RegClass::kFpReg, LiftoffRegList::ForRegs(dst, lhs))
+          .fp();
+
+  // Take shift value modulo 64.
+  and_(rhs.gp(), Immediate(63));
+  Movd(shift, rhs.gp());
+
+  // Set up a mask [0x80000000,0,0x80000000,0].
+  Pcmpeqb(tmp, tmp);
+  Psllq(tmp, tmp, 63);
+
+  Psrlq(tmp, tmp, shift);
+  Psrlq(dst.fp(), lhs.fp(), shift);
+  Pxor(dst.fp(), tmp);
+  Psubq(dst.fp(), tmp);
+}
+
+void LiftoffAssembler::emit_i64x2_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  XMMRegister tmp = liftoff::kScratchDoubleReg;
+  int32_t shift = rhs & 63;
+
+  // Set up a mask [0x80000000,0,0x80000000,0].
+  Pcmpeqb(tmp, tmp);
+  Psllq(tmp, tmp, 63);
+
+  Psrlq(tmp, tmp, shift);
+  Psrlq(dst.fp(), lhs.fp(), shift);
+  Pxor(dst.fp(), tmp);
+  Psubq(dst.fp(), tmp);
+}
+
+void LiftoffAssembler::emit_i64x2_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpsrlq, &Assembler::psrlq, 6>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpsrlq, &Assembler::psrlq, 6>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddq, &Assembler::paddq>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubq, &Assembler::psubq>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  static constexpr RegClass tmp_rc = reg_class_for(ValueType::kS128);
+  LiftoffRegister tmp1 =
+      GetUnusedRegister(tmp_rc, LiftoffRegList::ForRegs(dst, lhs, rhs));
+  LiftoffRegister tmp2 =
+      GetUnusedRegister(tmp_rc, LiftoffRegList::ForRegs(dst, lhs, rhs, tmp1));
+  Movaps(tmp1.fp(), lhs.fp());
+  Movaps(tmp2.fp(), rhs.fp());
+  // Multiply high dword of each qword of left with right.
+  Psrlq(tmp1.fp(), 32);
+  Pmuludq(tmp1.fp(), tmp1.fp(), rhs.fp());
+  // Multiply high dword of each qword of right with left.
+  Psrlq(tmp2.fp(), 32);
+  Pmuludq(tmp2.fp(), tmp2.fp(), lhs.fp());
+  Paddq(tmp2.fp(), tmp2.fp(), tmp1.fp());
+  Psllq(tmp2.fp(), tmp2.fp(), 32);
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpmuludq(dst.fp(), lhs.fp(), rhs.fp());
+  } else {
+    if (dst.fp() != lhs.fp()) movaps(dst.fp(), lhs.fp());
+    pmuludq(dst.fp(), rhs.fp());
+  }
+  Paddq(dst.fp(), dst.fp(), tmp2.fp());
+}
+
+void LiftoffAssembler::emit_f32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  if (dst.fp() == src.fp()) {
+    Pcmpeqd(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+    Psrld(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg, 1);
+    Andps(dst.fp(), liftoff::kScratchDoubleReg);
+  } else {
+    Pcmpeqd(dst.fp(), dst.fp());
+    Psrld(dst.fp(), dst.fp(), 1);
+    Andps(dst.fp(), src.fp());
+  }
+}
+
+void LiftoffAssembler::emit_f32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  if (dst.fp() == src.fp()) {
+    Pcmpeqd(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+    Pslld(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg, 31);
+    Xorps(dst.fp(), liftoff::kScratchDoubleReg);
+  } else {
+    Pcmpeqd(dst.fp(), dst.fp());
+    Pslld(dst.fp(), dst.fp(), 31);
+    Xorps(dst.fp(), src.fp());
+  }
+}
+
+void LiftoffAssembler::emit_f32x4_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  Sqrtps(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_f32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vaddps, &Assembler::addps>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vsubps, &Assembler::subps>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vmulps, &Assembler::mulps>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f32x4_div(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vdivps, &Assembler::divps>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f32x4_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  // The minps instruction doesn't propagate NaNs and +0's in its first
+  // operand. Perform minps in both orders, merge the results, and adjust.
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vminps(liftoff::kScratchDoubleReg, lhs.fp(), rhs.fp());
+    vminps(dst.fp(), rhs.fp(), lhs.fp());
+  } else if (dst.fp() == lhs.fp() || dst.fp() == rhs.fp()) {
+    XMMRegister src = dst.fp() == lhs.fp() ? rhs.fp() : lhs.fp();
+    movaps(liftoff::kScratchDoubleReg, src);
+    minps(liftoff::kScratchDoubleReg, dst.fp());
+    minps(dst.fp(), src);
+  } else {
+    movaps(liftoff::kScratchDoubleReg, lhs.fp());
+    minps(liftoff::kScratchDoubleReg, rhs.fp());
+    movaps(dst.fp(), rhs.fp());
+    minps(dst.fp(), lhs.fp());
+  }
+  // propagate -0's and NaNs, which may be non-canonical.
+  Orps(liftoff::kScratchDoubleReg, dst.fp());
+  // Canonicalize NaNs by quieting and clearing the payload.
+  Cmpunordps(dst.fp(), dst.fp(), liftoff::kScratchDoubleReg);
+  Orps(liftoff::kScratchDoubleReg, dst.fp());
+  Psrld(dst.fp(), dst.fp(), byte{10});
+  Andnps(dst.fp(), liftoff::kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_f32x4_max(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  // The maxps instruction doesn't propagate NaNs and +0's in its first
+  // operand. Perform maxps in both orders, merge the results, and adjust.
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vmaxps(liftoff::kScratchDoubleReg, lhs.fp(), rhs.fp());
+    vmaxps(dst.fp(), rhs.fp(), lhs.fp());
+  } else if (dst.fp() == lhs.fp() || dst.fp() == rhs.fp()) {
+    XMMRegister src = dst.fp() == lhs.fp() ? rhs.fp() : lhs.fp();
+    movaps(liftoff::kScratchDoubleReg, src);
+    maxps(liftoff::kScratchDoubleReg, dst.fp());
+    maxps(dst.fp(), src);
+  } else {
+    movaps(liftoff::kScratchDoubleReg, lhs.fp());
+    maxps(liftoff::kScratchDoubleReg, rhs.fp());
+    movaps(dst.fp(), rhs.fp());
+    maxps(dst.fp(), lhs.fp());
+  }
+  // Find discrepancies.
+  Xorps(dst.fp(), liftoff::kScratchDoubleReg);
+  // Propagate NaNs, which may be non-canonical.
+  Orps(liftoff::kScratchDoubleReg, dst.fp());
+  // Propagate sign discrepancy and (subtle) quiet NaNs.
+  Subps(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg, dst.fp());
+  // Canonicalize NaNs by clearing the payload. Sign is non-deterministic.
+  Cmpunordps(dst.fp(), dst.fp(), liftoff::kScratchDoubleReg);
+  Psrld(dst.fp(), dst.fp(), byte{10});
+  Andnps(dst.fp(), liftoff::kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_f64x2_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  if (dst.fp() == src.fp()) {
+    Pcmpeqd(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+    Psrlq(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg, 1);
+    Andpd(dst.fp(), liftoff::kScratchDoubleReg);
+  } else {
+    Pcmpeqd(dst.fp(), dst.fp());
+    Psrlq(dst.fp(), dst.fp(), 1);
+    Andpd(dst.fp(), src.fp());
+  }
+}
+
+void LiftoffAssembler::emit_f64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  if (dst.fp() == src.fp()) {
+    Pcmpeqd(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+    Psllq(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg, 63);
+    Xorpd(dst.fp(), liftoff::kScratchDoubleReg);
+  } else {
+    Pcmpeqd(dst.fp(), dst.fp());
+    Psllq(dst.fp(), dst.fp(), 63);
+    Xorpd(dst.fp(), src.fp());
+  }
+}
+
+void LiftoffAssembler::emit_f64x2_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  Sqrtpd(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_f64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vaddpd, &Assembler::addpd>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vsubpd, &Assembler::subpd>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vmulpd, &Assembler::mulpd>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f64x2_div(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vdivpd, &Assembler::divpd>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f64x2_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  // The minpd instruction doesn't propagate NaNs and +0's in its first
+  // operand. Perform minpd in both orders, merge the results, and adjust.
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vminpd(liftoff::kScratchDoubleReg, lhs.fp(), rhs.fp());
+    vminpd(dst.fp(), rhs.fp(), lhs.fp());
+  } else if (dst.fp() == lhs.fp() || dst.fp() == rhs.fp()) {
+    XMMRegister src = dst.fp() == lhs.fp() ? rhs.fp() : lhs.fp();
+    movapd(liftoff::kScratchDoubleReg, src);
+    minpd(liftoff::kScratchDoubleReg, dst.fp());
+    minpd(dst.fp(), src);
+  } else {
+    movapd(liftoff::kScratchDoubleReg, lhs.fp());
+    minpd(liftoff::kScratchDoubleReg, rhs.fp());
+    movapd(dst.fp(), rhs.fp());
+    minpd(dst.fp(), lhs.fp());
+  }
+  // propagate -0's and NaNs, which may be non-canonical.
+  Orpd(liftoff::kScratchDoubleReg, dst.fp());
+  // Canonicalize NaNs by quieting and clearing the payload.
+  Cmpunordpd(dst.fp(), dst.fp(), liftoff::kScratchDoubleReg);
+  Orpd(liftoff::kScratchDoubleReg, dst.fp());
+  Psrlq(dst.fp(), 13);
+  Andnpd(dst.fp(), liftoff::kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_f64x2_max(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  // The maxpd instruction doesn't propagate NaNs and +0's in its first
+  // operand. Perform maxpd in both orders, merge the results, and adjust.
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vmaxpd(liftoff::kScratchDoubleReg, lhs.fp(), rhs.fp());
+    vmaxpd(dst.fp(), rhs.fp(), lhs.fp());
+  } else if (dst.fp() == lhs.fp() || dst.fp() == rhs.fp()) {
+    XMMRegister src = dst.fp() == lhs.fp() ? rhs.fp() : lhs.fp();
+    movapd(liftoff::kScratchDoubleReg, src);
+    maxpd(liftoff::kScratchDoubleReg, dst.fp());
+    maxpd(dst.fp(), src);
+  } else {
+    movapd(liftoff::kScratchDoubleReg, lhs.fp());
+    maxpd(liftoff::kScratchDoubleReg, rhs.fp());
+    movapd(dst.fp(), rhs.fp());
+    maxpd(dst.fp(), lhs.fp());
+  }
+  // Find discrepancies.
+  Xorpd(dst.fp(), liftoff::kScratchDoubleReg);
+  // Propagate NaNs, which may be non-canonical.
+  Orpd(liftoff::kScratchDoubleReg, dst.fp());
+  // Propagate sign discrepancy and (subtle) quiet NaNs.
+  Subpd(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg, dst.fp());
+  // Canonicalize NaNs by clearing the payload. Sign is non-deterministic.
+  Cmpunordpd(dst.fp(), dst.fp(), liftoff::kScratchDoubleReg);
+  Psrlq(dst.fp(), 13);
+  Andnpd(dst.fp(), liftoff::kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  // NAN->0
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vcmpeqps(liftoff::kScratchDoubleReg, src.fp(), src.fp());
+    vpand(dst.fp(), src.fp(), liftoff::kScratchDoubleReg);
+  } else {
+    movaps(liftoff::kScratchDoubleReg, src.fp());
+    cmpeqps(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+    if (dst.fp() != src.fp()) movaps(dst.fp(), src.fp());
+    pand(dst.fp(), liftoff::kScratchDoubleReg);
+  }
+  // Set top bit if >= 0 (but not -0.0!).
+  Pxor(liftoff::kScratchDoubleReg, dst.fp());
+  // Convert to int.
+  Cvttps2dq(dst.fp(), dst.fp());
+  // Set top bit if >=0 is now < 0.
+  Pand(liftoff::kScratchDoubleReg, dst.fp());
+  Psrad(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg, byte{31});
+  // Set positive overflow lanes to 0x7FFFFFFF.
+  Pxor(dst.fp(), liftoff::kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  static constexpr RegClass tmp_rc = reg_class_for(ValueType::kS128);
+  DoubleRegister tmp =
+      GetUnusedRegister(tmp_rc, LiftoffRegList::ForRegs(dst, src)).fp();
+  // NAN->0, negative->0.
+  Pxor(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vmaxps(dst.fp(), src.fp(), liftoff::kScratchDoubleReg);
+  } else {
+    if (dst.fp() != src.fp()) movaps(dst.fp(), src.fp());
+    maxps(dst.fp(), liftoff::kScratchDoubleReg);
+  }
+  // scratch: float representation of max_signed.
+  Pcmpeqd(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+  Psrld(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg,
+        uint8_t{1});  // 0x7fffffff
+  Cvtdq2ps(liftoff::kScratchDoubleReg,
+           liftoff::kScratchDoubleReg);  // 0x4f000000
+  // tmp: convert (src-max_signed).
+  // Set positive overflow lanes to 0x7FFFFFFF.
+  // Set negative lanes to 0.
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vsubps(tmp, dst.fp(), liftoff::kScratchDoubleReg);
+  } else {
+    movaps(tmp, dst.fp());
+    subps(tmp, liftoff::kScratchDoubleReg);
+  }
+  Cmpleps(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg, tmp);
+  Cvttps2dq(tmp, tmp);
+  Pxor(tmp, liftoff::kScratchDoubleReg);
+  Pxor(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);
+  Pmaxsd(tmp, liftoff::kScratchDoubleReg);
+  // Convert to int. Overflow lanes above max_signed will be 0x80000000.
+  Cvttps2dq(dst.fp(), dst.fp());
+  // Add (src-max_signed) for overflow lanes.
+  Paddd(dst.fp(), dst.fp(), tmp);
+}
+
+void LiftoffAssembler::emit_f32x4_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  Cvtdq2ps(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_f32x4_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  Pxor(liftoff::kScratchDoubleReg, liftoff::kScratchDoubleReg);  // Zeros.
+  Pblendw(liftoff::kScratchDoubleReg, src.fp(),
+          uint8_t{0x55});  // Get lo 16 bits.
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpsubd(dst.fp(), src.fp(), liftoff::kScratchDoubleReg);  // Get hi 16 bits.
+  } else {
+    if (dst.fp() != src.fp()) movaps(dst.fp(), src.fp());
+    psubd(dst.fp(), liftoff::kScratchDoubleReg);
+  }
+  Cvtdq2ps(liftoff::kScratchDoubleReg,
+           liftoff::kScratchDoubleReg);  // Convert lo exactly.
+  Psrld(dst.fp(), dst.fp(), byte{1});   // Divide by 2 to get in unsigned range.
+  Cvtdq2ps(dst.fp(), dst.fp());         // Convert hi, exactly.
+  Addps(dst.fp(), dst.fp(), dst.fp());  // Double hi, exactly.
+  Addps(dst.fp(), dst.fp(),
+        liftoff::kScratchDoubleReg);  // Add hi and lo, may round.
+}
+
+void LiftoffAssembler::emit_i8x16_sconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpacksswb,
+                                       &Assembler::packsswb>(this, dst, lhs,
+                                                             rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_uconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpackuswb,
+                                       &Assembler::packuswb>(this, dst, lhs,
+                                                             rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpackssdw,
+                                       &Assembler::packssdw>(this, dst, lhs,
+                                                             rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpackusdw,
+                                       &Assembler::packusdw>(this, dst, lhs,
+                                                             rhs, SSE4_1);
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  Pmovsxbw(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  Palignr(dst.fp(), src.fp(), static_cast<uint8_t>(8));
+  Pmovsxbw(dst.fp(), dst.fp());
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  Pmovzxbw(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  Palignr(dst.fp(), src.fp(), static_cast<uint8_t>(8));
+  Pmovzxbw(dst.fp(), dst.fp());
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  Pmovsxwd(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  Palignr(dst.fp(), src.fp(), static_cast<uint8_t>(8));
+  Pmovsxwd(dst.fp(), dst.fp());
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  Pmovzxwd(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  Palignr(dst.fp(), src.fp(), static_cast<uint8_t>(8));
+  Pmovzxwd(dst.fp(), dst.fp());
+}
+
+void LiftoffAssembler::emit_s128_and_not(LiftoffRegister dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vandnps, &Assembler::andnps>(
+      this, dst, rhs, lhs);
+}
+
+void LiftoffAssembler::emit_i8x16_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpavgb, &Assembler::pavgb>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpavgw, &Assembler::pavgw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Pabsb(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_i16x8_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Pabsw(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_i32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Pabsd(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_i8x16_extract_lane_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 uint8_t imm_lane_idx) {
+  Register byte_reg = liftoff::GetTmpByteRegister(this, dst.gp());
+  Pextrb(byte_reg, lhs.fp(), imm_lane_idx);
+  movsx_b(dst.gp(), byte_reg);
+}
+
+void LiftoffAssembler::emit_i8x16_extract_lane_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 uint8_t imm_lane_idx) {
+  Pextrb(dst.gp(), lhs.fp(), imm_lane_idx);
+}
+
+void LiftoffAssembler::emit_i16x8_extract_lane_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 uint8_t imm_lane_idx) {
+  Pextrw(dst.gp(), lhs.fp(), imm_lane_idx);
+  movsx_w(dst.gp(), dst.gp());
+}
+
+void LiftoffAssembler::emit_i16x8_extract_lane_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 uint8_t imm_lane_idx) {
+  Pextrw(dst.gp(), lhs.fp(), imm_lane_idx);
+}
+
+void LiftoffAssembler::emit_i32x4_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  Pextrd(dst.gp(), lhs.fp(), imm_lane_idx);
+}
+
+void LiftoffAssembler::emit_i64x2_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  Pextrd(dst.low_gp(), lhs.fp(), imm_lane_idx * 2);
+  Pextrd(dst.high_gp(), lhs.fp(), imm_lane_idx * 2 + 1);
+}
+
+void LiftoffAssembler::emit_f32x4_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vshufps(dst.fp(), lhs.fp(), lhs.fp(), imm_lane_idx);
+  } else {
+    if (dst.fp() != lhs.fp()) movaps(dst.fp(), lhs.fp());
+    if (imm_lane_idx != 0) shufps(dst.fp(), dst.fp(), imm_lane_idx);
+  }
+}
+
+void LiftoffAssembler::emit_f64x2_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vshufpd(dst.fp(), lhs.fp(), lhs.fp(), imm_lane_idx);
+  } else {
+    if (dst.fp() != lhs.fp()) movaps(dst.fp(), lhs.fp());
+    if (imm_lane_idx != 0) shufpd(dst.fp(), dst.fp(), imm_lane_idx);
+  }
+}
+
+void LiftoffAssembler::emit_i8x16_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpinsrb(dst.fp(), src1.fp(), src2.gp(), imm_lane_idx);
+  } else {
+    CpuFeatureScope scope(this, SSE4_1);
+    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
+    pinsrb(dst.fp(), src2.gp(), imm_lane_idx);
+  }
+}
+
+void LiftoffAssembler::emit_i16x8_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpinsrw(dst.fp(), src1.fp(), src2.gp(), imm_lane_idx);
+  } else {
+    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
+    pinsrw(dst.fp(), src2.gp(), imm_lane_idx);
+  }
+}
+
+void LiftoffAssembler::emit_i32x4_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpinsrd(dst.fp(), src1.fp(), src2.gp(), imm_lane_idx);
+  } else {
+    CpuFeatureScope scope(this, SSE4_1);
+    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
+    pinsrd(dst.fp(), src2.gp(), imm_lane_idx);
+  }
+}
+
+void LiftoffAssembler::emit_i64x2_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpinsrd(dst.fp(), src1.fp(), src2.low_gp(), imm_lane_idx * 2);
+    vpinsrd(dst.fp(), dst.fp(), src2.high_gp(), imm_lane_idx * 2 + 1);
+  } else {
+    CpuFeatureScope scope(this, SSE4_1);
+    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
+    pinsrd(dst.fp(), src2.low_gp(), imm_lane_idx * 2);
+    pinsrd(dst.fp(), src2.high_gp(), imm_lane_idx * 2 + 1);
+  }
+}
+
+void LiftoffAssembler::emit_f32x4_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vinsertps(dst.fp(), src1.fp(), src2.fp(), (imm_lane_idx << 4) & 0x30);
+  } else {
+    CpuFeatureScope scope(this, SSE4_1);
+    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
+    insertps(dst.fp(), src2.fp(), (imm_lane_idx << 4) & 0x30);
+  }
+}
+
+void LiftoffAssembler::emit_f64x2_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  // TODO(fanchenk): Use movlhps and blendpd
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    if (imm_lane_idx == 0) {
+      vinsertps(dst.fp(), src1.fp(), src2.fp(), 0b00000000);
+      vinsertps(dst.fp(), dst.fp(), src2.fp(), 0b01010000);
+    } else {
+      vinsertps(dst.fp(), src1.fp(), src2.fp(), 0b00100000);
+      vinsertps(dst.fp(), dst.fp(), src2.fp(), 0b01110000);
+    }
+  } else {
+    CpuFeatureScope scope(this, SSE4_1);
+    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
+    if (imm_lane_idx == 0) {
+      insertps(dst.fp(), src2.fp(), 0b00000000);
+      insertps(dst.fp(), src2.fp(), 0b01010000);
+    } else {
+      insertps(dst.fp(), src2.fp(), 0b00100000);
+      insertps(dst.fp(), src2.fp(), 0b01110000);
+    }
+  }
+}
+
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
   cmp(esp, Operand(limit_address, 0));
   j(below_equal, ool_code);
 }
 
 void LiftoffAssembler::CallTrapCallbackForTesting() {
-  PrepareCallCFunction(0, GetUnusedRegister(kGpReg).gp());
+  PrepareCallCFunction(0, GetUnusedRegister(kGpReg, {}).gp());
   CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(), 0);
 }
 
diff --git a/deps/v8/src/wasm/baseline/liftoff-assembler.cc b/deps/v8/src/wasm/baseline/liftoff-assembler.cc
index 74df00590ff..37147cc94d9 100644
--- a/deps/v8/src/wasm/baseline/liftoff-assembler.cc
+++ b/deps/v8/src/wasm/baseline/liftoff-assembler.cc
@@ -12,6 +12,7 @@
 #include "src/compiler/linkage.h"
 #include "src/compiler/wasm-compiler.h"
 #include "src/utils/ostreams.h"
+#include "src/wasm/baseline/liftoff-register.h"
 #include "src/wasm/function-body-decoder-impl.h"
 #include "src/wasm/wasm-linkage.h"
 #include "src/wasm/wasm-opcodes.h"
@@ -517,7 +518,6 @@ LiftoffRegister LiftoffAssembler::LoadToRegister(VarState slot,
       return reg;
     }
     case VarState::kRegister:
-      cache_state_.dec_used(slot.reg());
       return slot.reg();
     case VarState::kIntConst: {
       RegClass rc =
@@ -530,9 +530,28 @@ LiftoffRegister LiftoffAssembler::LoadToRegister(VarState slot,
   UNREACHABLE();
 }
 
+LiftoffRegister LiftoffAssembler::LoadI64HalfIntoRegister(VarState slot,
+                                                          RegPairHalf half) {
+  if (slot.is_reg()) {
+    return half == kLowWord ? slot.reg().low() : slot.reg().high();
+  }
+  LiftoffRegister dst = GetUnusedRegister(kGpReg, {});
+  if (slot.is_stack()) {
+    FillI64Half(dst.gp(), slot.offset(), half);
+    return dst;
+  }
+  DCHECK(slot.is_const());
+  int32_t half_word =
+      static_cast<int32_t>(half == kLowWord ? slot.constant().to_i64()
+                                            : slot.constant().to_i64() >> 32);
+  LoadConstant(dst, WasmValue(half_word));
+  return dst;
+}
+
 LiftoffRegister LiftoffAssembler::PopToRegister(LiftoffRegList pinned) {
   DCHECK(!cache_state_.stack_state.empty());
   VarState slot = cache_state_.stack_state.back();
+  if (slot.is_reg()) cache_state_.dec_used(slot.reg());
   cache_state_.stack_state.pop_back();
   return LoadToRegister(slot, pinned);
 }
@@ -541,6 +560,7 @@ LiftoffRegister LiftoffAssembler::PeekToRegister(int index,
                                                  LiftoffRegList pinned) {
   DCHECK_LT(index, cache_state_.stack_state.size());
   VarState& slot = cache_state_.stack_state.end()[-1 - index];
+  if (slot.is_reg()) cache_state_.dec_used(slot.reg());
   LiftoffRegister reg = LoadToRegister(slot, pinned);
   if (!slot.is_reg()) {
     slot.MakeRegister(reg);
@@ -548,6 +568,32 @@ LiftoffRegister LiftoffAssembler::PeekToRegister(int index,
   return reg;
 }
 
+void LiftoffAssembler::PrepareLoopArgs(int num) {
+  for (int i = 0; i < num; ++i) {
+    VarState& slot = cache_state_.stack_state.end()[-1 - i];
+    if (slot.is_stack()) continue;
+    RegClass rc = reg_class_for(slot.type());
+    if (slot.is_reg()) {
+      if (cache_state_.get_use_count(slot.reg()) > 1) {
+        // If the register is used more than once, we cannot use it for the
+        // merge. Move it to an unused register instead.
+        LiftoffRegList pinned;
+        pinned.set(slot.reg());
+        LiftoffRegister dst_reg = GetUnusedRegister(rc, pinned);
+        Move(dst_reg, slot.reg(), slot.type());
+        cache_state_.dec_used(slot.reg());
+        cache_state_.inc_used(dst_reg);
+        slot.MakeRegister(dst_reg);
+      }
+      continue;
+    }
+    LiftoffRegister reg = GetUnusedRegister(rc, {});
+    LoadConstant(reg, slot.constant());
+    slot.MakeRegister(reg);
+    cache_state_.inc_used(reg);
+  }
+}
+
 void LiftoffAssembler::MergeFullStackWith(const CacheState& target,
                                           const CacheState& source) {
   DCHECK_EQ(source.stack_height(), target.stack_height());
@@ -614,6 +660,24 @@ void LiftoffAssembler::SpillAllRegisters() {
   cache_state_.reset_used_registers();
 }
 
+void LiftoffAssembler::ClearRegister(
+    Register reg, std::initializer_list<Register*> possible_uses,
+    LiftoffRegList pinned) {
+  if (cache_state()->is_used(LiftoffRegister(reg))) {
+    SpillRegister(LiftoffRegister(reg));
+  }
+  Register replacement = no_reg;
+  for (Register* use : possible_uses) {
+    if (reg != *use) continue;
+    if (replacement == no_reg) {
+      replacement = GetUnusedRegister(kGpReg, pinned).gp();
+      Move(replacement, reg, LiftoffAssembler::kWasmIntPtr);
+    }
+    // We cannot leave this loop early. There may be multiple uses of {reg}.
+    *use = replacement;
+  }
+}
+
 namespace {
 void PrepareStackTransfers(const FunctionSig* sig,
                            compiler::CallDescriptor* call_descriptor,
@@ -645,25 +709,8 @@ void PrepareStackTransfers(const FunctionSig* sig,
         DCHECK(!loc.IsAnyRegister());
         RegClass rc = is_gp_pair ? kGpReg : reg_class_for(type);
         int reg_code = loc.AsRegister();
-
-        // Initialize to anything, will be set in all branches below.
-        LiftoffRegister reg = kGpCacheRegList.GetFirstRegSet();
-        if (!kSimpleFPAliasing && type == kWasmF32) {
-          // Liftoff assumes a one-to-one mapping between float registers and
-          // double registers, and so does not distinguish between f32 and f64
-          // registers. The f32 register code must therefore be halved in order
-          // to pass the f64 code to Liftoff.
-          DCHECK_EQ(0, reg_code % 2);
-          reg = LiftoffRegister::from_code(rc, (reg_code / 2));
-        } else if (kNeedS128RegPair && type == kWasmS128) {
-          // Similarly for double registers and SIMD registers, the SIMD code
-          // needs to be doubled to pass the f64 code to Liftoff.
-          reg = LiftoffRegister::ForFpPair(
-              DoubleRegister::from_code(reg_code * 2));
-        } else {
-          reg = LiftoffRegister::from_code(rc, reg_code);
-        }
-
+        LiftoffRegister reg =
+            LiftoffRegister::from_external_code(rc, type, reg_code);
         param_regs->set(reg);
         if (is_gp_pair) {
           stack_transfers->LoadI64HalfIntoRegister(reg, slot, stack_offset,
@@ -690,6 +737,8 @@ void LiftoffAssembler::PrepareBuiltinCall(
   PrepareStackTransfers(sig, call_descriptor, params.begin(), &stack_slots,
                         &stack_transfers, &param_regs);
   // Create all the slots.
+  // Builtin stack parameters are pushed in reversed order.
+  stack_slots.Reverse();
   stack_slots.Construct();
   // Execute the stack transfers before filling the instance register.
   stack_transfers.Execute();
@@ -761,7 +810,6 @@ void LiftoffAssembler::PrepareCall(const FunctionSig* sig,
   stack_slots.Construct();
   // Execute the stack transfers before filling the instance register.
   stack_transfers.Execute();
-
   // Pop parameters from the value stack.
   cache_state_.stack_state.pop_back(num_params);
 
@@ -776,36 +824,46 @@ void LiftoffAssembler::PrepareCall(const FunctionSig* sig,
 
 void LiftoffAssembler::FinishCall(const FunctionSig* sig,
                                   compiler::CallDescriptor* call_descriptor) {
-  const size_t return_count = sig->return_count();
-  if (return_count != 0) {
-    DCHECK_EQ(1, return_count);
-    ValueType return_type = sig->GetReturn(0);
+  // Offset of the current return value relative to the stack pointer.
+  int return_offset = 0;
+  int call_desc_return_idx = 0;
+  for (ValueType return_type : sig->returns()) {
+    DCHECK_LT(call_desc_return_idx, call_descriptor->ReturnCount());
     const bool needs_gp_pair = needs_gp_reg_pair(return_type);
-    const bool needs_fp_pair = needs_fp_reg_pair(return_type);
-    DCHECK_EQ(needs_gp_pair ? 2 : 1, call_descriptor->ReturnCount());
-    RegClass rc = needs_gp_pair
-                      ? kGpReg
-                      : needs_fp_pair ? kFpReg : reg_class_for(return_type);
-#if V8_TARGET_ARCH_ARM
-    // If the return register was not d0 for f32, the code value would have to
-    // be halved as is done for the parameter registers.
-    DCHECK_EQ(call_descriptor->GetReturnLocation(0).AsRegister(), 0);
-#endif
-    LiftoffRegister return_reg = LiftoffRegister::from_code(
-        rc, call_descriptor->GetReturnLocation(0).AsRegister());
-    DCHECK(GetCacheRegList(rc).has(return_reg));
-    if (needs_gp_pair) {
-      LiftoffRegister high_reg = LiftoffRegister::from_code(
-          rc, call_descriptor->GetReturnLocation(1).AsRegister());
-      DCHECK(GetCacheRegList(rc).has(high_reg));
-      return_reg = LiftoffRegister::ForPair(return_reg.gp(), high_reg.gp());
-    } else if (needs_fp_pair) {
-      DCHECK_EQ(0, return_reg.fp().code() % 2);
-      return_reg = LiftoffRegister::ForFpPair(return_reg.fp());
-    }
-    DCHECK(!cache_state_.is_used(return_reg));
-    PushRegister(return_type, return_reg);
+    const int num_lowered_params = 1 + needs_gp_pair;
+    const ValueType lowered_type = needs_gp_pair ? kWasmI32 : return_type;
+    const RegClass rc = reg_class_for(lowered_type);
+    // Initialize to anything, will be set in the loop and used afterwards.
+    LiftoffRegister reg_pair[2] = {kGpCacheRegList.GetFirstRegSet(),
+                                   kGpCacheRegList.GetFirstRegSet()};
+    LiftoffRegList pinned;
+    for (int pair_idx = 0; pair_idx < num_lowered_params; ++pair_idx) {
+      compiler::LinkageLocation loc =
+          call_descriptor->GetReturnLocation(call_desc_return_idx++);
+      if (loc.IsRegister()) {
+        DCHECK(!loc.IsAnyRegister());
+        reg_pair[pair_idx] = LiftoffRegister::from_external_code(
+            rc, lowered_type, loc.AsRegister());
+      } else {
+        DCHECK(loc.IsCallerFrameSlot());
+        reg_pair[pair_idx] = GetUnusedRegister(rc, pinned);
+        Fill(reg_pair[pair_idx], -return_offset, lowered_type);
+        const int type_size = lowered_type.element_size_bytes();
+        const int slot_size = RoundUp<kSystemPointerSize>(type_size);
+        return_offset += slot_size;
+      }
+      if (pair_idx == 0) {
+        pinned.set(reg_pair[0]);
+      }
+    }
+    if (num_lowered_params == 1) {
+      PushRegister(return_type, reg_pair[0]);
+    } else {
+      PushRegister(return_type, LiftoffRegister::ForPair(reg_pair[0].gp(),
+                                                         reg_pair[1].gp()));
+    }
   }
+  RecordUsedSpillOffset(TopSpillOffset() + return_offset);
 }
 
 void LiftoffAssembler::Move(LiftoffRegister dst, LiftoffRegister src,
@@ -816,6 +874,10 @@ void LiftoffAssembler::Move(LiftoffRegister dst, LiftoffRegister src,
     // Use the {StackTransferRecipe} to move pairs, as the registers in the
     // pairs might overlap.
     StackTransferRecipe(this).MoveRegister(dst, src, type);
+  } else if (kNeedS128RegPair && dst.is_fp_pair()) {
+    // Calling low_fp is fine, Move will automatically check the type and
+    // convert this FP to its SIMD register, and use a SIMD move.
+    Move(dst.low_fp(), src.low_fp(), type);
   } else if (dst.is_gp()) {
     Move(dst.gp(), src.gp(), type);
   } else {
@@ -832,26 +894,59 @@ void LiftoffAssembler::ParallelRegisterMove(
   }
 }
 
-void LiftoffAssembler::MoveToReturnRegisters(const FunctionSig* sig) {
-  // We do not support multi-value yet.
-  DCHECK_EQ(1, sig->return_count());
-  ValueType return_type = sig->GetReturn(0);
+void LiftoffAssembler::MoveToReturnLocations(
+    const FunctionSig* sig, compiler::CallDescriptor* descriptor) {
+  int call_desc_return_idx = 0;
+  DCHECK_LE(sig->return_count(), cache_state_.stack_height());
+  VarState* slots = cache_state_.stack_state.end() - sig->return_count();
+  // Fill return frame slots first to ensure that all potential spills happen
+  // before we prepare the stack transfers.
+  for (size_t i = 0; i < sig->return_count(); ++i) {
+    ValueType return_type = sig->GetReturn(i);
+    bool needs_gp_pair = needs_gp_reg_pair(return_type);
+    int num_lowered_params = 1 + needs_gp_pair;
+    for (int pair_idx = 0; pair_idx < num_lowered_params; ++pair_idx) {
+      compiler::LinkageLocation loc =
+          descriptor->GetReturnLocation(call_desc_return_idx++);
+      if (loc.IsCallerFrameSlot()) {
+        RegPairHalf half = pair_idx == 0 ? kLowWord : kHighWord;
+        VarState& slot = slots[i];
+        LiftoffRegister reg = needs_gp_pair
+                                  ? LoadI64HalfIntoRegister(slot, half)
+                                  : LoadToRegister(slot, {});
+        ValueType lowered_type = needs_gp_pair ? kWasmI32 : return_type;
+        StoreCallerFrameSlot(reg, -loc.AsCallerFrameSlot(), lowered_type);
+      }
+    }
+  }
+  // Prepare and execute stack transfers.
+  call_desc_return_idx = 0;
   StackTransferRecipe stack_transfers(this);
-  // Defaults to a gp reg, will be set below if return type is not gp.
-  LiftoffRegister return_reg = LiftoffRegister(kGpReturnRegisters[0]);
-
-  if (needs_gp_reg_pair(return_type)) {
-    return_reg =
-        LiftoffRegister::ForPair(kGpReturnRegisters[0], kGpReturnRegisters[1]);
-  } else if (needs_fp_reg_pair(return_type)) {
-    return_reg = LiftoffRegister::ForFpPair(kFpReturnRegisters[0]);
-  } else if (reg_class_for(return_type) == kFpReg) {
-    return_reg = LiftoffRegister(kFpReturnRegisters[0]);
-  } else {
-    DCHECK_EQ(kGpReg, reg_class_for(return_type));
+  for (size_t i = 0; i < sig->return_count(); ++i) {
+    ValueType return_type = sig->GetReturn(i);
+    bool needs_gp_pair = needs_gp_reg_pair(return_type);
+    int num_lowered_params = 1 + needs_gp_pair;
+    for (int pair_idx = 0; pair_idx < num_lowered_params; ++pair_idx) {
+      RegPairHalf half = pair_idx == 0 ? kLowWord : kHighWord;
+      compiler::LinkageLocation loc =
+          descriptor->GetReturnLocation(call_desc_return_idx++);
+      if (loc.IsRegister()) {
+        DCHECK(!loc.IsAnyRegister());
+        int reg_code = loc.AsRegister();
+        ValueType lowered_type = needs_gp_pair ? kWasmI32 : return_type;
+        RegClass rc = reg_class_for(lowered_type);
+        LiftoffRegister reg =
+            LiftoffRegister::from_external_code(rc, return_type, reg_code);
+        VarState& slot = slots[i];
+        if (needs_gp_pair) {
+          stack_transfers.LoadI64HalfIntoRegister(reg, slot, slot.offset(),
+                                                  half);
+        } else {
+          stack_transfers.LoadIntoRegister(reg, slot, slot.offset());
+        }
+      }
+    }
   }
-  stack_transfers.LoadIntoRegister(return_reg, cache_state_.stack_state.back(),
-                                   cache_state_.stack_state.back().offset());
 }
 
 #ifdef ENABLE_SLOW_DCHECKS
@@ -950,12 +1045,15 @@ void LiftoffAssembler::SpillRegister(LiftoffRegister reg) {
       // {clear_used} call below only clears one of them.
       cache_state_.dec_used(slot->reg().low());
       cache_state_.dec_used(slot->reg().high());
+      cache_state_.last_spilled_regs.set(slot->reg().low());
+      cache_state_.last_spilled_regs.set(slot->reg().high());
     }
     Spill(slot->offset(), slot->reg(), slot->type());
     slot->MakeStack();
     if (--remaining_uses == 0) break;
   }
   cache_state_.clear_used(reg);
+  cache_state_.last_spilled_regs.set(reg);
 }
 
 void LiftoffAssembler::set_num_locals(uint32_t num_locals) {
diff --git a/deps/v8/src/wasm/baseline/liftoff-assembler.h b/deps/v8/src/wasm/baseline/liftoff-assembler.h
index 6573ff4aa4d..aa11b42c6cb 100644
--- a/deps/v8/src/wasm/baseline/liftoff-assembler.h
+++ b/deps/v8/src/wasm/baseline/liftoff-assembler.h
@@ -259,7 +259,6 @@ class LiftoffAssembler : public TurboAssembler {
         last_spilled_regs = {};
       }
       LiftoffRegister reg = unspilled.GetFirstRegSet();
-      last_spilled_regs.set(reg);
       return reg;
     }
 
@@ -297,6 +296,10 @@ class LiftoffAssembler : public TurboAssembler {
   // but discarded with {stack_state.pop_back(count)}.
   LiftoffRegister PeekToRegister(int index, LiftoffRegList pinned);
 
+  // Ensure that the loop inputs are either in a register or spilled to the
+  // stack, so that we can merge different values on the back-edge.
+  void PrepareLoopArgs(int num);
+
   int NextSpillOffset(ValueType type) {
     int offset = TopSpillOffset() + SlotSizeForType(type);
     if (NeedsAlignment(type)) {
@@ -337,7 +340,7 @@ class LiftoffAssembler : public TurboAssembler {
   // possible.
   LiftoffRegister GetUnusedRegister(
       RegClass rc, std::initializer_list<LiftoffRegister> try_first,
-      LiftoffRegList pinned = {}) {
+      LiftoffRegList pinned) {
     for (LiftoffRegister reg : try_first) {
       DCHECK_EQ(reg.reg_class(), rc);
       if (cache_state_.is_free(reg)) return reg;
@@ -346,11 +349,20 @@ class LiftoffAssembler : public TurboAssembler {
   }
 
   // Get an unused register for class {rc}, potentially spilling to free one.
-  LiftoffRegister GetUnusedRegister(RegClass rc, LiftoffRegList pinned = {}) {
+  LiftoffRegister GetUnusedRegister(RegClass rc, LiftoffRegList pinned) {
     if (kNeedI64RegPair && rc == kGpRegPair) {
       LiftoffRegList candidates = kGpCacheRegList;
       Register low = pinned.set(GetUnusedRegister(candidates, pinned)).gp();
       Register high = GetUnusedRegister(candidates, pinned).gp();
+      if (low.code() > high.code()) {
+        // Establish the invariant that the register of the low word always has
+        // a lower code than the register of the high word. This guarantees that
+        // if a register pair of an input is reused for the result, the low
+        // word and high word registers are not swapped, i.e. the low word
+        // register of the result is not the high word register of the input,
+        // and vice versa.
+        std::swap(low, high);
+      }
       return LiftoffRegister::ForPair(low, high);
     } else if (kNeedS128RegPair && rc == kFpRegPair) {
       // kFpRegPair specific logic here because we need adjacent registers, not
@@ -382,6 +394,22 @@ class LiftoffAssembler : public TurboAssembler {
   void SpillLocals();
   void SpillAllRegisters();
 
+  // Clear any uses of {reg} in both the cache and in {possible_uses}.
+  // Any use in the stack is spilled. If any register in {possible_uses} matches
+  // {reg}, then the content of {reg} is moved to a new temporary register, and
+  // all matches in {possible_uses} are rewritten to that temporary register.
+  void ClearRegister(Register reg,
+                     std::initializer_list<Register*> possible_uses,
+                     LiftoffRegList pinned);
+
+  // Spills all passed registers.
+  template <typename... Regs>
+  void SpillRegisters(Regs... regs) {
+    for (LiftoffRegister r : {LiftoffRegister(regs)...}) {
+      if (cache_state()->is_used(r)) SpillRegister(r);
+    }
+  }
+
   // Call this method whenever spilling something, such that the number of used
   // spill slot can be tracked and the stack frame will be allocated big enough.
   void RecordUsedSpillOffset(int offset) {
@@ -418,7 +446,8 @@ class LiftoffAssembler : public TurboAssembler {
   };
   void ParallelRegisterMove(Vector<ParallelRegisterMoveTuple>);
 
-  void MoveToReturnRegisters(const FunctionSig*);
+  void MoveToReturnLocations(const FunctionSig*,
+                             compiler::CallDescriptor* descriptor);
 
 #ifdef ENABLE_SLOW_DCHECKS
   // Validate that the register use counts reflect the state of the cache.
@@ -466,28 +495,28 @@ class LiftoffAssembler : public TurboAssembler {
                           StoreType type, LiftoffRegList pinned);
 
   inline void AtomicAdd(Register dst_addr, Register offset_reg,
-                        uint32_t offset_imm, LiftoffRegister result,
-                        StoreType type);
+                        uint32_t offset_imm, LiftoffRegister value,
+                        LiftoffRegister result, StoreType type);
 
   inline void AtomicSub(Register dst_addr, Register offset_reg,
-                        uint32_t offset_imm, LiftoffRegister result,
-                        StoreType type);
+                        uint32_t offset_imm, LiftoffRegister value,
+                        LiftoffRegister result, StoreType type);
 
   inline void AtomicAnd(Register dst_addr, Register offset_reg,
-                        uint32_t offset_imm, LiftoffRegister result,
-                        StoreType type);
+                        uint32_t offset_imm, LiftoffRegister value,
+                        LiftoffRegister result, StoreType type);
 
   inline void AtomicOr(Register dst_addr, Register offset_reg,
-                       uint32_t offset_imm, LiftoffRegister result,
-                       StoreType type);
+                       uint32_t offset_imm, LiftoffRegister value,
+                       LiftoffRegister result, StoreType type);
 
   inline void AtomicXor(Register dst_addr, Register offset_reg,
-                        uint32_t offset_imm, LiftoffRegister result,
-                        StoreType type);
+                        uint32_t offset_imm, LiftoffRegister value,
+                        LiftoffRegister result, StoreType type);
 
   inline void AtomicExchange(Register dst_addr, Register offset_reg,
-                             uint32_t offset_imm, LiftoffRegister result,
-                             StoreType type);
+                             uint32_t offset_imm, LiftoffRegister value,
+                             LiftoffRegister result, StoreType type);
 
   inline void AtomicCompareExchange(Register dst_addr, Register offset_reg,
                                     uint32_t offset_imm,
@@ -499,6 +528,8 @@ class LiftoffAssembler : public TurboAssembler {
 
   inline void LoadCallerFrameSlot(LiftoffRegister, uint32_t caller_slot_idx,
                                   ValueType);
+  inline void StoreCallerFrameSlot(LiftoffRegister, uint32_t caller_slot_idx,
+                                   ValueType);
   inline void MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                              ValueType);
 
@@ -515,7 +546,7 @@ class LiftoffAssembler : public TurboAssembler {
 
   // i32 binops.
   inline void emit_i32_add(Register dst, Register lhs, Register rhs);
-  inline void emit_i32_add(Register dst, Register lhs, int32_t imm);
+  inline void emit_i32_addi(Register dst, Register lhs, int32_t imm);
   inline void emit_i32_sub(Register dst, Register lhs, Register rhs);
   inline void emit_i32_mul(Register dst, Register lhs, Register rhs);
   inline void emit_i32_divs(Register dst, Register lhs, Register rhs,
@@ -528,17 +559,17 @@ class LiftoffAssembler : public TurboAssembler {
   inline void emit_i32_remu(Register dst, Register lhs, Register rhs,
                             Label* trap_rem_by_zero);
   inline void emit_i32_and(Register dst, Register lhs, Register rhs);
-  inline void emit_i32_and(Register dst, Register lhs, int32_t imm);
+  inline void emit_i32_andi(Register dst, Register lhs, int32_t imm);
   inline void emit_i32_or(Register dst, Register lhs, Register rhs);
-  inline void emit_i32_or(Register dst, Register lhs, int32_t imm);
+  inline void emit_i32_ori(Register dst, Register lhs, int32_t imm);
   inline void emit_i32_xor(Register dst, Register lhs, Register rhs);
-  inline void emit_i32_xor(Register dst, Register lhs, int32_t imm);
+  inline void emit_i32_xori(Register dst, Register lhs, int32_t imm);
   inline void emit_i32_shl(Register dst, Register src, Register amount);
-  inline void emit_i32_shl(Register dst, Register src, int32_t amount);
+  inline void emit_i32_shli(Register dst, Register src, int32_t amount);
   inline void emit_i32_sar(Register dst, Register src, Register amount);
-  inline void emit_i32_sar(Register dst, Register src, int32_t amount);
+  inline void emit_i32_sari(Register dst, Register src, int32_t amount);
   inline void emit_i32_shr(Register dst, Register src, Register amount);
-  inline void emit_i32_shr(Register dst, Register src, int32_t amount);
+  inline void emit_i32_shri(Register dst, Register src, int32_t amount);
 
   // i32 unops.
   inline void emit_i32_clz(Register dst, Register src);
@@ -548,8 +579,8 @@ class LiftoffAssembler : public TurboAssembler {
   // i64 binops.
   inline void emit_i64_add(LiftoffRegister dst, LiftoffRegister lhs,
                            LiftoffRegister rhs);
-  inline void emit_i64_add(LiftoffRegister dst, LiftoffRegister lhs,
-                           int32_t imm);
+  inline void emit_i64_addi(LiftoffRegister dst, LiftoffRegister lhs,
+                            int32_t imm);
   inline void emit_i64_sub(LiftoffRegister dst, LiftoffRegister lhs,
                            LiftoffRegister rhs);
   inline void emit_i64_mul(LiftoffRegister dst, LiftoffRegister lhs,
@@ -565,28 +596,28 @@ class LiftoffAssembler : public TurboAssembler {
                             LiftoffRegister rhs, Label* trap_rem_by_zero);
   inline void emit_i64_and(LiftoffRegister dst, LiftoffRegister lhs,
                            LiftoffRegister rhs);
-  inline void emit_i64_and(LiftoffRegister dst, LiftoffRegister lhs,
-                           int32_t imm);
+  inline void emit_i64_andi(LiftoffRegister dst, LiftoffRegister lhs,
+                            int32_t imm);
   inline void emit_i64_or(LiftoffRegister dst, LiftoffRegister lhs,
                           LiftoffRegister rhs);
-  inline void emit_i64_or(LiftoffRegister dst, LiftoffRegister lhs,
-                          int32_t imm);
+  inline void emit_i64_ori(LiftoffRegister dst, LiftoffRegister lhs,
+                           int32_t imm);
   inline void emit_i64_xor(LiftoffRegister dst, LiftoffRegister lhs,
                            LiftoffRegister rhs);
-  inline void emit_i64_xor(LiftoffRegister dst, LiftoffRegister lhs,
-                           int32_t imm);
+  inline void emit_i64_xori(LiftoffRegister dst, LiftoffRegister lhs,
+                            int32_t imm);
   inline void emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
                            Register amount);
-  inline void emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
-                           int32_t amount);
+  inline void emit_i64_shli(LiftoffRegister dst, LiftoffRegister src,
+                            int32_t amount);
   inline void emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
                            Register amount);
-  inline void emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
-                           int32_t amount);
+  inline void emit_i64_sari(LiftoffRegister dst, LiftoffRegister src,
+                            int32_t amount);
   inline void emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
                            Register amount);
-  inline void emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
-                           int32_t amount);
+  inline void emit_i64_shri(LiftoffRegister dst, LiftoffRegister src,
+                            int32_t amount);
 
   // i64 unops.
   inline void emit_i64_clz(LiftoffRegister dst, LiftoffRegister src);
@@ -619,19 +650,19 @@ class LiftoffAssembler : public TurboAssembler {
       emit_i32_and(dst, lhs, rhs);
     }
   }
-  inline void emit_ptrsize_shr(Register dst, Register src, int amount) {
+  inline void emit_ptrsize_shri(Register dst, Register src, int amount) {
     if (kSystemPointerSize == 8) {
-      emit_i64_shr(LiftoffRegister(dst), LiftoffRegister(src), amount);
+      emit_i64_shri(LiftoffRegister(dst), LiftoffRegister(src), amount);
     } else {
-      emit_i32_shr(dst, src, amount);
+      emit_i32_shri(dst, src, amount);
     }
   }
 
-  inline void emit_ptrsize_add(Register dst, Register lhs, int32_t imm) {
+  inline void emit_ptrsize_addi(Register dst, Register lhs, int32_t imm) {
     if (kSystemPointerSize == 8) {
-      emit_i64_add(LiftoffRegister(dst), LiftoffRegister(lhs), imm);
+      emit_i64_addi(LiftoffRegister(dst), LiftoffRegister(lhs), imm);
     } else {
-      emit_i32_add(dst, lhs, imm);
+      emit_i32_addi(dst, lhs, imm);
     }
   }
 
@@ -711,86 +742,324 @@ class LiftoffAssembler : public TurboAssembler {
   inline void emit_f64_set_cond(Condition condition, Register dst,
                                 DoubleRegister lhs, DoubleRegister rhs);
 
+  inline void LoadTransform(LiftoffRegister dst, Register src_addr,
+                            Register offset_reg, uint32_t offset_imm,
+                            LoadType type, LoadTransformationKind transform,
+                            uint32_t* protected_load_pc);
+  inline void emit_s8x16_swizzle(LiftoffRegister dst, LiftoffRegister lhs,
+                                 LiftoffRegister rhs);
+  inline void emit_i8x16_splat(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_i16x8_splat(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_i32x4_splat(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_i64x2_splat(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_f32x4_splat(LiftoffRegister dst, LiftoffRegister src);
   inline void emit_f64x2_splat(LiftoffRegister dst, LiftoffRegister src);
-  inline void emit_f64x2_extract_lane(LiftoffRegister dst, LiftoffRegister lhs,
-                                      uint8_t imm_lane_idx);
-  inline void emit_f64x2_replace_lane(LiftoffRegister dst, LiftoffRegister src1,
-                                      LiftoffRegister src2,
-                                      uint8_t imm_lane_idx);
-  inline void emit_f64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
+  inline void emit_i8x16_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_i8x16_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_i8x16_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                              LiftoffRegister rhs);
+  inline void emit_i8x16_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                              LiftoffRegister rhs);
+  inline void emit_i8x16_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                              LiftoffRegister rhs);
+  inline void emit_i8x16_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                              LiftoffRegister rhs);
+  inline void emit_i16x8_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_i16x8_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_i16x8_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                              LiftoffRegister rhs);
+  inline void emit_i16x8_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                              LiftoffRegister rhs);
+  inline void emit_i16x8_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                              LiftoffRegister rhs);
+  inline void emit_i16x8_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                              LiftoffRegister rhs);
+  inline void emit_i32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_i32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_i32x4_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                              LiftoffRegister rhs);
+  inline void emit_i32x4_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                              LiftoffRegister rhs);
+  inline void emit_i32x4_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                              LiftoffRegister rhs);
+  inline void emit_i32x4_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                              LiftoffRegister rhs);
+  inline void emit_f32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_f32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_f32x4_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_f32x4_le(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_f64x2_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_f64x2_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_f64x2_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_f64x2_le(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_s128_not(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_s128_and(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_s128_or(LiftoffRegister dst, LiftoffRegister lhs,
+                           LiftoffRegister rhs);
+  inline void emit_s128_xor(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs);
+  inline void emit_s128_select(LiftoffRegister dst, LiftoffRegister src1,
+                               LiftoffRegister src2, LiftoffRegister mask);
+  inline void emit_i8x16_neg(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_v8x16_anytrue(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_v8x16_alltrue(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_i8x16_shl(LiftoffRegister dst, LiftoffRegister lhs,
                              LiftoffRegister rhs);
-  inline void emit_f64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
+  inline void emit_i8x16_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                              int32_t rhs);
+  inline void emit_i8x16_shr_s(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i8x16_shri_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                int32_t rhs);
+  inline void emit_i8x16_shr_u(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i8x16_shri_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                int32_t rhs);
+  inline void emit_i8x16_add(LiftoffRegister dst, LiftoffRegister lhs,
                              LiftoffRegister rhs);
-  inline void emit_f64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
+  inline void emit_i8x16_add_saturate_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs);
+  inline void emit_i8x16_add_saturate_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs);
+  inline void emit_i8x16_sub(LiftoffRegister dst, LiftoffRegister lhs,
                              LiftoffRegister rhs);
-  inline void emit_f32x4_splat(LiftoffRegister dst, LiftoffRegister src);
-  inline void emit_f32x4_extract_lane(LiftoffRegister dst, LiftoffRegister lhs,
-                                      uint8_t imm_lane_idx);
-  inline void emit_f32x4_replace_lane(LiftoffRegister dst, LiftoffRegister src1,
-                                      LiftoffRegister src2,
-                                      uint8_t imm_lane_idx);
-  inline void emit_f32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
+  inline void emit_i8x16_sub_saturate_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs);
+  inline void emit_i8x16_sub_saturate_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs);
+  inline void emit_i8x16_mul(LiftoffRegister dst, LiftoffRegister lhs,
                              LiftoffRegister rhs);
-  inline void emit_f32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
+  inline void emit_i8x16_min_s(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i8x16_min_u(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i8x16_max_s(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i8x16_max_u(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i16x8_neg(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_v16x8_anytrue(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_v16x8_alltrue(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_i16x8_shl(LiftoffRegister dst, LiftoffRegister lhs,
                              LiftoffRegister rhs);
-  inline void emit_f32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
+  inline void emit_i16x8_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                              int32_t rhs);
+  inline void emit_i16x8_shr_s(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i16x8_shri_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                int32_t rhs);
+  inline void emit_i16x8_shr_u(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i16x8_shri_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                int32_t rhs);
+  inline void emit_i16x8_add(LiftoffRegister dst, LiftoffRegister lhs,
                              LiftoffRegister rhs);
-  inline void emit_i64x2_splat(LiftoffRegister dst, LiftoffRegister src);
-  inline void emit_i64x2_extract_lane(LiftoffRegister dst, LiftoffRegister lhs,
-                                      uint8_t imm_lane_idx);
-  inline void emit_i64x2_replace_lane(LiftoffRegister dst, LiftoffRegister src1,
-                                      LiftoffRegister src2,
-                                      uint8_t imm_lane_idx);
-  inline void emit_i64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
+  inline void emit_i16x8_add_saturate_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs);
+  inline void emit_i16x8_add_saturate_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs);
+  inline void emit_i16x8_sub(LiftoffRegister dst, LiftoffRegister lhs,
                              LiftoffRegister rhs);
-  inline void emit_i64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
+  inline void emit_i16x8_sub_saturate_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs);
+  inline void emit_i16x8_sub_saturate_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs);
+  inline void emit_i16x8_mul(LiftoffRegister dst, LiftoffRegister lhs,
                              LiftoffRegister rhs);
-  inline void emit_i64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
+  inline void emit_i16x8_min_s(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i16x8_min_u(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i16x8_max_s(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i16x8_max_u(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i32x4_neg(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_v32x4_anytrue(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_v32x4_alltrue(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_i32x4_shl(LiftoffRegister dst, LiftoffRegister lhs,
                              LiftoffRegister rhs);
-  inline void emit_i32x4_splat(LiftoffRegister dst, LiftoffRegister src);
-  inline void emit_i32x4_extract_lane(LiftoffRegister dst, LiftoffRegister lhs,
-                                      uint8_t imm_lane_idx);
-  inline void emit_i32x4_replace_lane(LiftoffRegister dst, LiftoffRegister src1,
-                                      LiftoffRegister src2,
-                                      uint8_t imm_lane_idx);
+  inline void emit_i32x4_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                              int32_t rhs);
+  inline void emit_i32x4_shr_s(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i32x4_shri_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                int32_t rhs);
+  inline void emit_i32x4_shr_u(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i32x4_shri_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                int32_t rhs);
   inline void emit_i32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
                              LiftoffRegister rhs);
   inline void emit_i32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
                              LiftoffRegister rhs);
   inline void emit_i32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
                              LiftoffRegister rhs);
-  inline void emit_i16x8_splat(LiftoffRegister dst, LiftoffRegister src);
-  inline void emit_i16x8_extract_lane_u(LiftoffRegister dst,
-                                        LiftoffRegister lhs,
-                                        uint8_t imm_lane_idx);
-  inline void emit_i16x8_extract_lane_s(LiftoffRegister dst,
-                                        LiftoffRegister lhs,
-                                        uint8_t imm_lane_idx);
-  inline void emit_i16x8_replace_lane(LiftoffRegister dst, LiftoffRegister src1,
-                                      LiftoffRegister src2,
-                                      uint8_t imm_lane_idx);
-  inline void emit_i16x8_add(LiftoffRegister dst, LiftoffRegister lhs,
+  inline void emit_i32x4_min_s(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i32x4_min_u(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i32x4_max_s(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i32x4_max_u(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i64x2_neg(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_i64x2_shl(LiftoffRegister dst, LiftoffRegister lhs,
                              LiftoffRegister rhs);
-  inline void emit_i16x8_sub(LiftoffRegister dst, LiftoffRegister lhs,
+  inline void emit_i64x2_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                              int32_t rhs);
+  inline void emit_i64x2_shr_s(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i64x2_shri_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                int32_t rhs);
+  inline void emit_i64x2_shr_u(LiftoffRegister dst, LiftoffRegister lhs,
+                               LiftoffRegister rhs);
+  inline void emit_i64x2_shri_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                int32_t rhs);
+  inline void emit_i64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
                              LiftoffRegister rhs);
-  inline void emit_i16x8_mul(LiftoffRegister dst, LiftoffRegister lhs,
+  inline void emit_i64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
                              LiftoffRegister rhs);
-  inline void emit_i8x16_splat(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_i64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                             LiftoffRegister rhs);
+  inline void emit_f32x4_abs(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_f32x4_neg(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_f32x4_sqrt(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_f32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
+                             LiftoffRegister rhs);
+  inline void emit_f32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                             LiftoffRegister rhs);
+  inline void emit_f32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                             LiftoffRegister rhs);
+  inline void emit_f32x4_div(LiftoffRegister dst, LiftoffRegister lhs,
+                             LiftoffRegister rhs);
+  inline void emit_f32x4_min(LiftoffRegister dst, LiftoffRegister lhs,
+                             LiftoffRegister rhs);
+  inline void emit_f32x4_max(LiftoffRegister dst, LiftoffRegister lhs,
+                             LiftoffRegister rhs);
+  inline void emit_f64x2_abs(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_f64x2_neg(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_f64x2_sqrt(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_f64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
+                             LiftoffRegister rhs);
+  inline void emit_f64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                             LiftoffRegister rhs);
+  inline void emit_f64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                             LiftoffRegister rhs);
+  inline void emit_f64x2_div(LiftoffRegister dst, LiftoffRegister lhs,
+                             LiftoffRegister rhs);
+  inline void emit_f64x2_min(LiftoffRegister dst, LiftoffRegister lhs,
+                             LiftoffRegister rhs);
+  inline void emit_f64x2_max(LiftoffRegister dst, LiftoffRegister lhs,
+                             LiftoffRegister rhs);
+  inline void emit_i32x4_sconvert_f32x4(LiftoffRegister dst,
+                                        LiftoffRegister src);
+  inline void emit_i32x4_uconvert_f32x4(LiftoffRegister dst,
+                                        LiftoffRegister src);
+  inline void emit_f32x4_sconvert_i32x4(LiftoffRegister dst,
+                                        LiftoffRegister src);
+  inline void emit_f32x4_uconvert_i32x4(LiftoffRegister dst,
+                                        LiftoffRegister src);
+  inline void emit_i8x16_sconvert_i16x8(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs);
+  inline void emit_i8x16_uconvert_i16x8(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs);
+  inline void emit_i16x8_sconvert_i32x4(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs);
+  inline void emit_i16x8_uconvert_i32x4(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs);
+  inline void emit_i16x8_sconvert_i8x16_low(LiftoffRegister dst,
+                                            LiftoffRegister src);
+  inline void emit_i16x8_sconvert_i8x16_high(LiftoffRegister dst,
+                                             LiftoffRegister src);
+  inline void emit_i16x8_uconvert_i8x16_low(LiftoffRegister dst,
+                                            LiftoffRegister src);
+  inline void emit_i16x8_uconvert_i8x16_high(LiftoffRegister dst,
+                                             LiftoffRegister src);
+  inline void emit_i32x4_sconvert_i16x8_low(LiftoffRegister dst,
+                                            LiftoffRegister src);
+  inline void emit_i32x4_sconvert_i16x8_high(LiftoffRegister dst,
+                                             LiftoffRegister src);
+  inline void emit_i32x4_uconvert_i16x8_low(LiftoffRegister dst,
+                                            LiftoffRegister src);
+  inline void emit_i32x4_uconvert_i16x8_high(LiftoffRegister dst,
+                                             LiftoffRegister src);
+  inline void emit_s128_and_not(LiftoffRegister dst, LiftoffRegister lhs,
+                                LiftoffRegister rhs);
+  inline void emit_i8x16_rounding_average_u(LiftoffRegister dst,
+                                            LiftoffRegister lhs,
+                                            LiftoffRegister rhs);
+  inline void emit_i16x8_rounding_average_u(LiftoffRegister dst,
+                                            LiftoffRegister lhs,
+                                            LiftoffRegister rhs);
+  inline void emit_i8x16_abs(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_i16x8_abs(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_i32x4_abs(LiftoffRegister dst, LiftoffRegister src);
+  inline void emit_i8x16_extract_lane_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        uint8_t imm_lane_idx);
   inline void emit_i8x16_extract_lane_u(LiftoffRegister dst,
                                         LiftoffRegister lhs,
                                         uint8_t imm_lane_idx);
-  inline void emit_i8x16_extract_lane_s(LiftoffRegister dst,
+  inline void emit_i16x8_extract_lane_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        uint8_t imm_lane_idx);
+  inline void emit_i16x8_extract_lane_u(LiftoffRegister dst,
                                         LiftoffRegister lhs,
                                         uint8_t imm_lane_idx);
+  inline void emit_i32x4_extract_lane(LiftoffRegister dst, LiftoffRegister lhs,
+                                      uint8_t imm_lane_idx);
+  inline void emit_i64x2_extract_lane(LiftoffRegister dst, LiftoffRegister lhs,
+                                      uint8_t imm_lane_idx);
+  inline void emit_f32x4_extract_lane(LiftoffRegister dst, LiftoffRegister lhs,
+                                      uint8_t imm_lane_idx);
+  inline void emit_f64x2_extract_lane(LiftoffRegister dst, LiftoffRegister lhs,
+                                      uint8_t imm_lane_idx);
   inline void emit_i8x16_replace_lane(LiftoffRegister dst, LiftoffRegister src1,
                                       LiftoffRegister src2,
                                       uint8_t imm_lane_idx);
-  inline void emit_i8x16_add(LiftoffRegister dst, LiftoffRegister lhs,
-                             LiftoffRegister rhs);
-  inline void emit_i8x16_sub(LiftoffRegister dst, LiftoffRegister lhs,
-                             LiftoffRegister rhs);
-  inline void emit_i8x16_mul(LiftoffRegister dst, LiftoffRegister lhs,
-                             LiftoffRegister rhs);
+  inline void emit_i16x8_replace_lane(LiftoffRegister dst, LiftoffRegister src1,
+                                      LiftoffRegister src2,
+                                      uint8_t imm_lane_idx);
+  inline void emit_i32x4_replace_lane(LiftoffRegister dst, LiftoffRegister src1,
+                                      LiftoffRegister src2,
+                                      uint8_t imm_lane_idx);
+  inline void emit_i64x2_replace_lane(LiftoffRegister dst, LiftoffRegister src1,
+                                      LiftoffRegister src2,
+                                      uint8_t imm_lane_idx);
+  inline void emit_f32x4_replace_lane(LiftoffRegister dst, LiftoffRegister src1,
+                                      LiftoffRegister src2,
+                                      uint8_t imm_lane_idx);
+  inline void emit_f64x2_replace_lane(LiftoffRegister dst, LiftoffRegister src1,
+                                      LiftoffRegister src2,
+                                      uint8_t imm_lane_idx);
 
   inline void StackCheck(Label* ool_code, Register limit_address);
 
@@ -867,6 +1136,7 @@ class LiftoffAssembler : public TurboAssembler {
 
  private:
   LiftoffRegister LoadToRegister(VarState slot, LiftoffRegList pinned);
+  LiftoffRegister LoadI64HalfIntoRegister(VarState slot, RegPairHalf half);
 
   uint32_t num_locals_ = 0;
   static constexpr uint32_t kInlineLocalTypes = 8;
@@ -874,7 +1144,7 @@ class LiftoffAssembler : public TurboAssembler {
     ValueType local_types_[kInlineLocalTypes];
     ValueType* more_local_types_;
   };
-  static_assert(sizeof(ValueType) == 1,
+  static_assert(sizeof(ValueType) == 4,
                 "Reconsider this inlining if ValueType gets bigger");
   CacheState cache_state_;
   int max_used_spill_offset_ = StaticStackFrameSize();
@@ -957,9 +1227,9 @@ void LiftoffAssembler::emit_i64_and(LiftoffRegister dst, LiftoffRegister lhs,
       this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i64_and(LiftoffRegister dst, LiftoffRegister lhs,
-                                    int32_t imm) {
-  liftoff::EmitI64IndependentHalfOperationImm<&LiftoffAssembler::emit_i32_and>(
+void LiftoffAssembler::emit_i64_andi(LiftoffRegister dst, LiftoffRegister lhs,
+                                     int32_t imm) {
+  liftoff::EmitI64IndependentHalfOperationImm<&LiftoffAssembler::emit_i32_andi>(
       this, dst, lhs, imm);
 }
 
@@ -969,9 +1239,9 @@ void LiftoffAssembler::emit_i64_or(LiftoffRegister dst, LiftoffRegister lhs,
       this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i64_or(LiftoffRegister dst, LiftoffRegister lhs,
-                                   int32_t imm) {
-  liftoff::EmitI64IndependentHalfOperationImm<&LiftoffAssembler::emit_i32_or>(
+void LiftoffAssembler::emit_i64_ori(LiftoffRegister dst, LiftoffRegister lhs,
+                                    int32_t imm) {
+  liftoff::EmitI64IndependentHalfOperationImm<&LiftoffAssembler::emit_i32_ori>(
       this, dst, lhs, imm);
 }
 
@@ -981,9 +1251,9 @@ void LiftoffAssembler::emit_i64_xor(LiftoffRegister dst, LiftoffRegister lhs,
       this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i64_xor(LiftoffRegister dst, LiftoffRegister lhs,
-                                    int32_t imm) {
-  liftoff::EmitI64IndependentHalfOperationImm<&LiftoffAssembler::emit_i32_xor>(
+void LiftoffAssembler::emit_i64_xori(LiftoffRegister dst, LiftoffRegister lhs,
+                                     int32_t imm) {
+  liftoff::EmitI64IndependentHalfOperationImm<&LiftoffAssembler::emit_i32_xori>(
       this, dst, lhs, imm);
 }
 
@@ -1003,19 +1273,19 @@ class LiftoffStackSlots {
   }
   void Add(const LiftoffAssembler::VarState& src) { slots_.emplace_back(src); }
 
+  void Reverse() { std::reverse(slots_.begin(), slots_.end()); }
+
   inline void Construct();
 
  private:
   struct Slot {
-    // Allow move construction.
-    Slot(Slot&&) V8_NOEXCEPT = default;
     Slot(const LiftoffAssembler::VarState& src, uint32_t src_offset,
          RegPairHalf half)
         : src_(src), src_offset_(src_offset), half_(half) {}
     explicit Slot(const LiftoffAssembler::VarState& src)
         : src_(src), half_(kLowWord) {}
 
-    const LiftoffAssembler::VarState src_;
+    LiftoffAssembler::VarState src_;
     uint32_t src_offset_ = 0;
     RegPairHalf half_;
   };
diff --git a/deps/v8/src/wasm/baseline/liftoff-compiler.cc b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
index 377cd1b5a80..28e96eb4f8b 100644
--- a/deps/v8/src/wasm/baseline/liftoff-compiler.cc
+++ b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
@@ -8,6 +8,7 @@
 #include "src/codegen/assembler-inl.h"
 // TODO(clemensb): Remove dependences on compiler stuff.
 #include "src/codegen/interface-descriptors.h"
+#include "src/codegen/machine-type.h"
 #include "src/codegen/macro-assembler-inl.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/wasm-compiler.h"
@@ -253,6 +254,12 @@ class LiftoffCompiler {
 
   using Value = ValueBase;
 
+  static constexpr auto kI32 = ValueType::kI32;
+  static constexpr auto kI64 = ValueType::kI64;
+  static constexpr auto kF32 = ValueType::kF32;
+  static constexpr auto kF64 = ValueType::kF64;
+  static constexpr auto kS128 = ValueType::kS128;
+
   struct ElseState {
     MovableLabel label;
     LiftoffAssembler::CacheState state;
@@ -272,6 +279,17 @@ class LiftoffCompiler {
 
   using FullDecoder = WasmFullDecoder<validate, LiftoffCompiler>;
 
+  // For debugging, we need to spill registers before a trap, to be able to
+  // inspect them.
+  struct SpilledRegistersBeforeTrap {
+    struct Entry {
+      int offset;
+      LiftoffRegister reg;
+      ValueType type;
+    };
+    std::vector<Entry> entries;
+  };
+
   struct OutOfLineCode {
     MovableLabel label;
     MovableLabel continuation;
@@ -279,20 +297,30 @@ class LiftoffCompiler {
     WasmCodePosition position;
     LiftoffRegList regs_to_save;
     uint32_t pc;  // for trap handler.
+    // These two pointers will only be used for debug code:
     DebugSideTableBuilder::EntryBuilder* debug_sidetable_entry_builder;
+    std::unique_ptr<SpilledRegistersBeforeTrap> spilled_registers;
 
     // Named constructors:
     static OutOfLineCode Trap(
         WasmCode::RuntimeStubId s, WasmCodePosition pos, uint32_t pc,
-        DebugSideTableBuilder::EntryBuilder* debug_sidetable_entry_builder) {
+        DebugSideTableBuilder::EntryBuilder* debug_sidetable_entry_builder,
+        std::unique_ptr<SpilledRegistersBeforeTrap> spilled_registers) {
       DCHECK_LT(0, pos);
-      return {{}, {}, s, pos, {}, pc, debug_sidetable_entry_builder};
+      return {{},
+              {},
+              s,
+              pos,
+              {},
+              pc,
+              debug_sidetable_entry_builder,
+              std::move(spilled_registers)};
     }
     static OutOfLineCode StackCheck(
         WasmCodePosition pos, LiftoffRegList regs,
         DebugSideTableBuilder::EntryBuilder* debug_sidetable_entry_builder) {
-      return {{},   {}, WasmCode::kWasmStackGuard,    pos,
-              regs, 0,  debug_sidetable_entry_builder};
+      return {{},   {}, WasmCode::kWasmStackGuard,     pos,
+              regs, 0,  debug_sidetable_entry_builder, {}};
     }
   };
 
@@ -300,13 +328,14 @@ class LiftoffCompiler {
                   CompilationEnv* env, Zone* compilation_zone,
                   std::unique_ptr<AssemblerBuffer> buffer,
                   DebugSideTableBuilder* debug_sidetable_builder,
-                  Vector<int> breakpoints = {},
+                  ForDebugging for_debugging, Vector<int> breakpoints = {},
                   Vector<int> extra_source_pos = {})
       : asm_(std::move(buffer)),
         descriptor_(
             GetLoweredCallDescriptor(compilation_zone, call_descriptor)),
         env_(env),
         debug_sidetable_builder_(debug_sidetable_builder),
+        for_debugging_(for_debugging),
         compilation_zone_(compilation_zone),
         safepoint_table_builder_(compilation_zone_),
         next_breakpoint_ptr_(breakpoints.begin()),
@@ -445,45 +474,8 @@ class LiftoffCompiler {
       LiftoffRegister in_reg = kGpCacheRegList.GetFirstRegSet();
       if (param_loc.IsRegister()) {
         DCHECK(!param_loc.IsAnyRegister());
-        int reg_code = param_loc.AsRegister();
-        if (!kSimpleFPAliasing && type == kWasmF32) {
-          // Liftoff assumes a one-to-one mapping between float registers and
-          // double registers, and so does not distinguish between f32 and f64
-          // registers. The f32 register code must therefore be halved in order
-          // to pass the f64 code to Liftoff.
-          DCHECK_EQ(0, reg_code % 2);
-          reg_code /= 2;
-        } else if (kNeedS128RegPair && type == kWasmS128) {
-          // Similarly for double registers and SIMD registers, the SIMD code
-          // needs to be doubled to pass the f64 code to Liftoff.
-          reg_code *= 2;
-        }
-        RegList cache_regs = rc == kGpReg ? kLiftoffAssemblerGpCacheRegs
-                                          : kLiftoffAssemblerFpCacheRegs;
-        if (cache_regs & (1ULL << reg_code)) {
-          // This is a cache register, just use it.
-          if (kNeedS128RegPair && rc == kFpRegPair) {
-            in_reg =
-                LiftoffRegister::ForFpPair(DoubleRegister::from_code(reg_code));
-          } else {
-            in_reg = LiftoffRegister::from_code(rc, reg_code);
-          }
-        } else {
-          // Move to a cache register (spill one if necessary).
-          // Note that we cannot create a {LiftoffRegister} for reg_code, since
-          // {LiftoffRegister} can only store cache regs.
-          in_reg = __ GetUnusedRegister(rc, pinned);
-          if (rc == kGpReg) {
-            __ Move(in_reg.gp(), Register::from_code(reg_code), lowered_type);
-          } else if (kNeedS128RegPair && rc == kFpRegPair) {
-            __ Move(in_reg.low_fp(), DoubleRegister::from_code(reg_code),
-                    lowered_type);
-          } else {
-            DCHECK_EQ(kFpReg, rc);
-            __ Move(in_reg.fp(), DoubleRegister::from_code(reg_code),
-                    lowered_type);
-          }
-        }
+        in_reg = LiftoffRegister::from_external_code(rc, type,
+                                                     param_loc.AsRegister());
       } else if (param_loc.IsCallerFrameSlot()) {
         in_reg = __ GetUnusedRegister(rc, pinned);
         __ LoadCallerFrameSlot(in_reg, -param_loc.AsCallerFrameSlot(),
@@ -504,7 +496,7 @@ class LiftoffCompiler {
         position, __ cache_state()->used_registers,
         RegisterDebugSideTableEntry(DebugSideTableBuilder::kAssumeSpilling)));
     OutOfLineCode& ool = out_of_line_code_.back();
-    Register limit_address = __ GetUnusedRegister(kGpReg).gp();
+    Register limit_address = __ GetUnusedRegister(kGpReg, {}).gp();
     LOAD_INSTANCE_FIELD(limit_address, StackLimitAddress, kSystemPointerSize);
     __ StackCheck(ool.label.get(), limit_address);
     __ bind(ool.continuation.get());
@@ -528,6 +520,14 @@ class LiftoffCompiler {
     return false;
   }
 
+  void TraceFunctionEntry(FullDecoder* decoder) {
+    DEBUG_CODE_COMMENT("trace function entry");
+    source_position_table_builder_.AddPosition(
+        __ pc_offset(), SourcePosition(decoder->position()), false);
+    __ CallRuntimeStub(WasmCode::kWasmTraceEnter);
+    safepoint_table_builder_.DefineSafepoint(&asm_, Safepoint::kNoLazyDeopt);
+  }
+
   void StartFunctionBody(FullDecoder* decoder, Control* block) {
     for (uint32_t i = 0; i < __ num_locals(); ++i) {
       if (!CheckSupportedType(decoder, kSupportedTypes, __ local_type(i),
@@ -552,7 +552,7 @@ class LiftoffCompiler {
     __ CodeEntry();
 
     DEBUG_CODE_COMMENT("enter frame");
-    __ EnterFrame(StackFrame::WASM_COMPILED);
+    __ EnterFrame(StackFrame::WASM);
     __ set_has_frame(true);
     pc_offset_stack_frame_construction_ = __ PrepareStackFrame();
     // {PrepareStackFrame} is the first platform-specific assembler method.
@@ -602,9 +602,11 @@ class LiftoffCompiler {
     // is never a position of any instruction in the function.
     StackCheck(0);
 
+    if (FLAG_trace_wasm) TraceFunctionEntry(decoder);
+
     // If we are generating debug code, do check the "hook on function call"
     // flag. If set, trigger a break.
-    if (V8_UNLIKELY(env_->debug)) {
+    if (V8_UNLIKELY(for_debugging_)) {
       // If there is a breakpoint set on the first instruction (== start of the
       // function), then skip the check for "hook on function call", since we
       // will unconditionally break there anyway.
@@ -613,7 +615,7 @@ class LiftoffCompiler {
                              *next_breakpoint_ptr_ == decoder->position());
       if (!has_breakpoint) {
         DEBUG_CODE_COMMENT("check hook on function call");
-        Register flag = __ GetUnusedRegister(kGpReg).gp();
+        Register flag = __ GetUnusedRegister(kGpReg, {}).gp();
         LOAD_INSTANCE_FIELD(flag, HookOnFunctionCallAddress,
                             kSystemPointerSize);
         Label no_break;
@@ -628,6 +630,8 @@ class LiftoffCompiler {
   }
 
   void GenerateOutOfLineCode(OutOfLineCode* ool) {
+    DEBUG_CODE_COMMENT(
+        (std::string("Out of line: ") + GetRuntimeStubName(ool->stub)).c_str());
     __ bind(ool->label.get());
     const bool is_stack_check = ool->stub == WasmCode::kWasmStackGuard;
     const bool is_mem_out_of_bounds =
@@ -647,13 +651,21 @@ class LiftoffCompiler {
       DCHECK(!is_stack_check);
       __ CallTrapCallbackForTesting();
       DEBUG_CODE_COMMENT("leave frame");
-      __ LeaveFrame(StackFrame::WASM_COMPILED);
+      __ LeaveFrame(StackFrame::WASM);
       __ DropStackSlotsAndRet(
           static_cast<uint32_t>(descriptor_->StackParameterCount()));
       return;
     }
 
-    if (!ool->regs_to_save.is_empty()) __ PushRegisters(ool->regs_to_save);
+    // We cannot both push and spill registers.
+    DCHECK(ool->regs_to_save.is_empty() || ool->spilled_registers == nullptr);
+    if (!ool->regs_to_save.is_empty()) {
+      __ PushRegisters(ool->regs_to_save);
+    } else if (V8_UNLIKELY(ool->spilled_registers != nullptr)) {
+      for (auto& entry : ool->spilled_registers->entries) {
+        __ Spill(entry.offset, entry.reg, entry.type);
+      }
+    }
 
     source_position_table_builder_.AddPosition(
         __ pc_offset(), SourcePosition(ool->position), true);
@@ -722,10 +734,8 @@ class LiftoffCompiler {
     TraceCacheState(decoder);
 #ifdef DEBUG
     SLOW_DCHECK(__ ValidateCacheState());
-    if (WasmOpcodes::IsPrefixOpcode(opcode) &&
-        decoder->pc() + 1 < decoder->end()) {
-      byte op_index = *(decoder->pc() + 1);
-      opcode = static_cast<WasmOpcode>(opcode << 8 | op_index);
+    if (WasmOpcodes::IsPrefixOpcode(opcode)) {
+      opcode = decoder->read_prefixed_opcode<Decoder::kValidate>(decoder->pc());
     }
     DEBUG_CODE_COMMENT(WasmOpcodes::OpcodeName(opcode));
 #endif
@@ -733,7 +743,7 @@ class LiftoffCompiler {
 
   void EmitBreakpoint(FullDecoder* decoder) {
     DEBUG_CODE_COMMENT("breakpoint");
-    DCHECK(env_->debug);
+    DCHECK(for_debugging_);
     source_position_table_builder_.AddPosition(
         __ pc_offset(), SourcePosition(decoder->position()), false);
     __ CallRuntimeStub(WasmCode::kWasmDebugBreak);
@@ -744,10 +754,6 @@ class LiftoffCompiler {
   void Block(FullDecoder* decoder, Control* block) {}
 
   void Loop(FullDecoder* decoder, Control* loop) {
-    if (loop->start_merge.arity > 0 || loop->end_merge.arity > 1) {
-      return unsupported(decoder, kMultiValue, "multi-value loop");
-    }
-
     // Before entering a loop, spill all locals to the stack, in order to free
     // the cache registers, and to avoid unnecessarily reloading stack values
     // into registers at branches.
@@ -755,6 +761,8 @@ class LiftoffCompiler {
     // pre-analysis of the function.
     __ SpillLocals();
 
+    __ PrepareLoopArgs(loop->start_merge.arity);
+
     // Loop labels bind at the beginning of the block.
     __ bind(loop->label.get());
 
@@ -777,10 +785,6 @@ class LiftoffCompiler {
     DCHECK_EQ(if_block, decoder->control_at(0));
     DCHECK(if_block->is_if());
 
-    if (if_block->start_merge.arity > 0 || if_block->end_merge.arity > 1) {
-      return unsupported(decoder, kMultiValue, "multi-value if");
-    }
-
     // Allocate the else state.
     if_block->else_state = std::make_unique<ElseState>();
 
@@ -819,9 +823,9 @@ class LiftoffCompiler {
       // No merge yet at the end of the if, but we need to create a merge for
       // the both arms of this if. Thus init the merge point from the else
       // state, then merge the if state into that.
-      DCHECK_EQ(0, c->end_merge.arity);
-      c->label_state.InitMerge(c->else_state->state, __ num_locals(), 0,
-                               c->stack_depth);
+      DCHECK_EQ(c->start_merge.arity, c->end_merge.arity);
+      c->label_state.InitMerge(c->else_state->state, __ num_locals(),
+                               c->start_merge.arity, c->stack_depth);
       __ MergeFullStackWith(c->label_state, *__ cache_state());
       __ emit_jump(c->label.get());
       // Merge the else state into the end state.
@@ -878,15 +882,61 @@ class LiftoffCompiler {
              ext_ref);
   }
 
+  template <typename EmitFn, typename... Args>
+  typename std::enable_if<!std::is_member_function_pointer<EmitFn>::value>::type
+  CallEmitFn(EmitFn fn, Args... args) {
+    fn(args...);
+  }
+
+  template <typename EmitFn, typename... Args>
+  typename std::enable_if<std::is_member_function_pointer<EmitFn>::value>::type
+  CallEmitFn(EmitFn fn, Args... args) {
+    (asm_.*fn)(ConvertAssemblerArg(args)...);
+  }
+
+  // Wrap a {LiftoffRegister} with implicit conversions to {Register} and
+  // {DoubleRegister}.
+  struct AssemblerRegisterConverter {
+    LiftoffRegister reg;
+    operator LiftoffRegister() { return reg; }
+    operator Register() { return reg.gp(); }
+    operator DoubleRegister() { return reg.fp(); }
+  };
+
+  // Convert {LiftoffRegister} to {AssemblerRegisterConverter}, other types stay
+  // unchanged.
+  template <typename T>
+  typename std::conditional<std::is_same<LiftoffRegister, T>::value,
+                            AssemblerRegisterConverter, T>::type
+  ConvertAssemblerArg(T t) {
+    return {t};
+  }
+
+  template <typename EmitFn, typename ArgType>
+  struct EmitFnWithFirstArg {
+    EmitFn fn;
+    ArgType first_arg;
+  };
+
+  template <typename EmitFn, typename ArgType>
+  EmitFnWithFirstArg<EmitFn, ArgType> BindFirst(EmitFn fn, ArgType arg) {
+    return {fn, arg};
+  }
+
+  template <typename EmitFn, typename T, typename... Args>
+  void CallEmitFn(EmitFnWithFirstArg<EmitFn, T> bound_fn, Args... args) {
+    CallEmitFn(bound_fn.fn, bound_fn.first_arg, ConvertAssemblerArg(args)...);
+  }
+
   template <ValueType::Kind src_type, ValueType::Kind result_type, class EmitFn>
   void EmitUnOp(EmitFn fn) {
     constexpr RegClass src_rc = reg_class_for(src_type);
     constexpr RegClass result_rc = reg_class_for(result_type);
     LiftoffRegister src = __ PopToRegister();
     LiftoffRegister dst = src_rc == result_rc
-                              ? __ GetUnusedRegister(result_rc, {src})
-                              : __ GetUnusedRegister(result_rc);
-    fn(dst, src);
+                              ? __ GetUnusedRegister(result_rc, {src}, {})
+                              : __ GetUnusedRegister(result_rc, {});
+    CallEmitFn(fn, dst, src);
     __ PushRegister(ValueType(result_type), dst);
   }
 
@@ -912,8 +962,9 @@ class LiftoffCompiler {
     static constexpr RegClass src_rc = reg_class_for(src_type);
     static constexpr RegClass dst_rc = reg_class_for(dst_type);
     LiftoffRegister src = __ PopToRegister();
-    LiftoffRegister dst = src_rc == dst_rc ? __ GetUnusedRegister(dst_rc, {src})
-                                           : __ GetUnusedRegister(dst_rc);
+    LiftoffRegister dst = src_rc == dst_rc
+                              ? __ GetUnusedRegister(dst_rc, {src}, {})
+                              : __ GetUnusedRegister(dst_rc, {});
     DCHECK_EQ(!!can_trap, trap_position > 0);
     Label* trap = can_trap ? AddOutOfLineTrap(
                                  trap_position,
@@ -942,38 +993,23 @@ class LiftoffCompiler {
 
   void UnOp(FullDecoder* decoder, WasmOpcode opcode, const Value& value,
             Value* result) {
-#define CASE_I32_UNOP(opcode, fn)                       \
-  case kExpr##opcode:                                   \
-    EmitUnOp<ValueType::kI32, ValueType::kI32>(         \
-        [=](LiftoffRegister dst, LiftoffRegister src) { \
-          __ emit_##fn(dst.gp(), src.gp());             \
-        });                                             \
-    break;
-#define CASE_I64_UNOP(opcode, fn)                       \
-  case kExpr##opcode:                                   \
-    EmitUnOp<ValueType::kI64, ValueType::kI64>(         \
-        [=](LiftoffRegister dst, LiftoffRegister src) { \
-          __ emit_##fn(dst, src);                       \
-        });                                             \
-    break;
-#define CASE_FLOAT_UNOP(opcode, type, fn)               \
-  case kExpr##opcode:                                   \
-    EmitUnOp<ValueType::k##type, ValueType::k##type>(   \
-        [=](LiftoffRegister dst, LiftoffRegister src) { \
-          __ emit_##fn(dst.fp(), src.fp());             \
-        });                                             \
-    break;
-#define CASE_FLOAT_UNOP_WITH_CFALLBACK(opcode, type, fn)              \
-  case kExpr##opcode:                                                 \
-    EmitFloatUnOpWithCFallback<ValueType::k##type>(                   \
-        &LiftoffAssembler::emit_##fn, &ExternalReference::wasm_##fn); \
-    break;
+#define CASE_I32_UNOP(opcode, fn) \
+  case kExpr##opcode:             \
+    return EmitUnOp<kI32, kI32>(&LiftoffAssembler::emit_##fn);
+#define CASE_I64_UNOP(opcode, fn) \
+  case kExpr##opcode:             \
+    return EmitUnOp<kI64, kI64>(&LiftoffAssembler::emit_##fn);
+#define CASE_FLOAT_UNOP(opcode, type, fn) \
+  case kExpr##opcode:                     \
+    return EmitUnOp<k##type, k##type>(&LiftoffAssembler::emit_##fn);
+#define CASE_FLOAT_UNOP_WITH_CFALLBACK(opcode, type, fn)                     \
+  case kExpr##opcode:                                                        \
+    return EmitFloatUnOpWithCFallback<k##type>(&LiftoffAssembler::emit_##fn, \
+                                               &ExternalReference::wasm_##fn);
 #define CASE_TYPE_CONVERSION(opcode, dst_type, src_type, ext_ref, can_trap) \
   case kExpr##opcode:                                                       \
-    EmitTypeConversion<ValueType::k##dst_type, ValueType::k##src_type,      \
-                       can_trap>(kExpr##opcode, ext_ref,                    \
-                                 can_trap ? decoder->position() : 0);       \
-    break;
+    return EmitTypeConversion<k##dst_type, k##src_type, can_trap>(          \
+        kExpr##opcode, ext_ref, can_trap ? decoder->position() : 0);
     switch (opcode) {
       CASE_I32_UNOP(I32Clz, i32_clz)
       CASE_I32_UNOP(I32Ctz, i32_ctz)
@@ -1038,19 +1074,11 @@ class LiftoffCompiler {
           outstanding_op_ = kExprI32Eqz;
           break;
         }
-        EmitUnOp<ValueType::kI32, ValueType::kI32>(
-            [=](LiftoffRegister dst, LiftoffRegister src) {
-              __ emit_i32_eqz(dst.gp(), src.gp());
-            });
-        break;
+        return EmitUnOp<kI32, kI32>(&LiftoffAssembler::emit_i32_eqz);
       case kExprI64Eqz:
-        EmitUnOp<ValueType::kI64, ValueType::kI32>(
-            [=](LiftoffRegister dst, LiftoffRegister src) {
-              __ emit_i64_eqz(dst.gp(), src);
-            });
-        break;
+        return EmitUnOp<kI64, kI32>(&LiftoffAssembler::emit_i64_eqz);
       case kExprI32Popcnt:
-        EmitUnOp<ValueType::kI32, ValueType::kI32>(
+        return EmitUnOp<kI32, kI32>(
             [=](LiftoffRegister dst, LiftoffRegister src) {
               if (__ emit_i32_popcnt(dst.gp(), src.gp())) return;
               ValueType sig_i_i_reps[] = {kWasmI32, kWasmI32};
@@ -1058,9 +1086,8 @@ class LiftoffCompiler {
               GenerateCCall(&dst, &sig_i_i, kWasmStmt, &src,
                             ExternalReference::wasm_word32_popcnt());
             });
-        break;
       case kExprI64Popcnt:
-        EmitUnOp<ValueType::kI64, ValueType::kI64>(
+        return EmitUnOp<kI64, kI64>(
             [=](LiftoffRegister dst, LiftoffRegister src) {
               if (__ emit_i64_popcnt(dst, src)) return;
               // The c function returns i32. We will zero-extend later.
@@ -1073,15 +1100,22 @@ class LiftoffCompiler {
               __ emit_type_conversion(kExprI64UConvertI32, dst, c_call_dst,
                                       nullptr);
             });
-        break;
-      case kExprI32SConvertSatF32:
-      case kExprI32UConvertSatF32:
-      case kExprI32SConvertSatF64:
-      case kExprI32UConvertSatF64:
-      case kExprI64SConvertSatF32:
-      case kExprI64UConvertSatF32:
-      case kExprI64SConvertSatF64:
-      case kExprI64UConvertSatF64:
+        CASE_TYPE_CONVERSION(I32SConvertSatF32, I32, F32, nullptr, kNoTrap)
+        CASE_TYPE_CONVERSION(I32UConvertSatF32, I32, F32, nullptr, kNoTrap)
+        CASE_TYPE_CONVERSION(I32SConvertSatF64, I32, F64, nullptr, kNoTrap)
+        CASE_TYPE_CONVERSION(I32UConvertSatF64, I32, F64, nullptr, kNoTrap)
+        CASE_TYPE_CONVERSION(I64SConvertSatF32, I64, F32,
+                             &ExternalReference::wasm_float32_to_int64_sat,
+                             kNoTrap)
+        CASE_TYPE_CONVERSION(I64UConvertSatF32, I64, F32,
+                             &ExternalReference::wasm_float32_to_uint64_sat,
+                             kNoTrap)
+        CASE_TYPE_CONVERSION(I64SConvertSatF64, I64, F64,
+                             &ExternalReference::wasm_float64_to_int64_sat,
+                             kNoTrap)
+        CASE_TYPE_CONVERSION(I64UConvertSatF64, I64, F64,
+                             &ExternalReference::wasm_float64_to_uint64_sat,
+                             kNoTrap)
         return unsupported(decoder, kNonTrappingFloatToInt,
                            WasmOpcodes::OpcodeName(opcode));
       default:
@@ -1108,34 +1142,31 @@ class LiftoffCompiler {
 
       LiftoffRegister lhs = __ PopToRegister();
       LiftoffRegister dst = src_rc == result_rc
-                                ? __ GetUnusedRegister(result_rc, {lhs})
-                                : __ GetUnusedRegister(result_rc);
+                                ? __ GetUnusedRegister(result_rc, {lhs}, {})
+                                : __ GetUnusedRegister(result_rc, {});
 
-      fnImm(dst, lhs, imm);
+      CallEmitFn(fnImm, dst, lhs, imm);
       __ PushRegister(ValueType(result_type), dst);
     } else {
       // The RHS was not an immediate.
-      LiftoffRegister rhs = __ PopToRegister();
-      LiftoffRegister lhs = __ PopToRegister(LiftoffRegList::ForRegs(rhs));
-      LiftoffRegister dst = src_rc == result_rc
-                                ? __ GetUnusedRegister(result_rc, {lhs, rhs})
-                                : __ GetUnusedRegister(result_rc);
-      fn(dst, lhs, rhs);
-      __ PushRegister(ValueType(result_type), dst);
+      EmitBinOp<src_type, result_type>(fn);
     }
   }
 
   template <ValueType::Kind src_type, ValueType::Kind result_type,
-            typename EmitFn>
+            bool swap_lhs_rhs = false, typename EmitFn>
   void EmitBinOp(EmitFn fn) {
     static constexpr RegClass src_rc = reg_class_for(src_type);
     static constexpr RegClass result_rc = reg_class_for(result_type);
     LiftoffRegister rhs = __ PopToRegister();
     LiftoffRegister lhs = __ PopToRegister(LiftoffRegList::ForRegs(rhs));
     LiftoffRegister dst = src_rc == result_rc
-                              ? __ GetUnusedRegister(result_rc, {lhs, rhs})
-                              : __ GetUnusedRegister(result_rc);
-    fn(dst, lhs, rhs);
+                              ? __ GetUnusedRegister(result_rc, {lhs, rhs}, {})
+                              : __ GetUnusedRegister(result_rc, {});
+
+    if (swap_lhs_rhs) std::swap(lhs, rhs);
+
+    CallEmitFn(fn, dst, lhs, rhs);
     __ PushRegister(ValueType(result_type), dst);
   }
 
@@ -1163,89 +1194,32 @@ class LiftoffCompiler {
     }
   }
 
+  template <WasmOpcode opcode>
+  void EmitI32CmpOp(FullDecoder* decoder) {
+    DCHECK(decoder->lookahead(0, opcode));
+    if (decoder->lookahead(1, kExprBrIf)) {
+      DCHECK(!has_outstanding_op());
+      outstanding_op_ = opcode;
+      return;
+    }
+    return EmitBinOp<kI32, kI32>(BindFirst(&LiftoffAssembler::emit_i32_set_cond,
+                                           GetCompareCondition(opcode)));
+  }
+
   void BinOp(FullDecoder* decoder, WasmOpcode opcode, const Value& lhs,
              const Value& rhs, Value* result) {
-#define CASE_I32_BINOP(opcode, fn)                                           \
-  case kExpr##opcode:                                                        \
-    return EmitBinOp<ValueType::kI32, ValueType::kI32>(                      \
-        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
-          __ emit_##fn(dst.gp(), lhs.gp(), rhs.gp());                        \
-        });
-#define CASE_I32_BINOPI(opcode, fn)                                          \
-  case kExpr##opcode:                                                        \
-    return EmitBinOpImm<ValueType::kI32, ValueType::kI32>(                   \
-        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
-          __ emit_##fn(dst.gp(), lhs.gp(), rhs.gp());                        \
-        },                                                                   \
-        [=](LiftoffRegister dst, LiftoffRegister lhs, int32_t imm) {         \
-          __ emit_##fn(dst.gp(), lhs.gp(), imm);                             \
-        });
-#define CASE_I64_BINOP(opcode, fn)                                           \
-  case kExpr##opcode:                                                        \
-    return EmitBinOp<ValueType::kI64, ValueType::kI64>(                      \
-        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
-          __ emit_##fn(dst, lhs, rhs);                                       \
-        });
-#define CASE_I64_BINOPI(opcode, fn)                                          \
-  case kExpr##opcode:                                                        \
-    return EmitBinOpImm<ValueType::kI64, ValueType::kI64>(                   \
-        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
-          __ emit_##fn(dst, lhs, rhs);                                       \
-        },                                                                   \
-        [=](LiftoffRegister dst, LiftoffRegister lhs, int32_t imm) {         \
-          __ emit_##fn(dst, lhs, imm);                                       \
-        });
-#define CASE_FLOAT_BINOP(opcode, type, fn)                                   \
-  case kExpr##opcode:                                                        \
-    return EmitBinOp<ValueType::k##type, ValueType::k##type>(                \
-        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
-          __ emit_##fn(dst.fp(), lhs.fp(), rhs.fp());                        \
-        });
-#define CASE_I32_CMPOP(opcode)                                               \
-  case kExpr##opcode:                                                        \
-    DCHECK(decoder->lookahead(0, kExpr##opcode));                            \
-    if (decoder->lookahead(1, kExprBrIf)) {                                  \
-      DCHECK(!has_outstanding_op());                                         \
-      outstanding_op_ = kExpr##opcode;                                       \
-      break;                                                                 \
-    }                                                                        \
-    return EmitBinOp<ValueType::kI32, ValueType::kI32>(                      \
-        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
-          constexpr Condition cond = GetCompareCondition(kExpr##opcode);     \
-          __ emit_i32_set_cond(cond, dst.gp(), lhs.gp(), rhs.gp());          \
-        });
-#define CASE_I64_CMPOP(opcode, cond)                                         \
-  case kExpr##opcode:                                                        \
-    return EmitBinOp<ValueType::kI64, ValueType::kI32>(                      \
-        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
-          __ emit_i64_set_cond(cond, dst.gp(), lhs, rhs);                    \
-        });
-#define CASE_F32_CMPOP(opcode, cond)                                         \
-  case kExpr##opcode:                                                        \
-    return EmitBinOp<ValueType::kF32, ValueType::kI32>(                      \
-        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
-          __ emit_f32_set_cond(cond, dst.gp(), lhs.fp(), rhs.fp());          \
-        });
-#define CASE_F64_CMPOP(opcode, cond)                                         \
-  case kExpr##opcode:                                                        \
-    return EmitBinOp<ValueType::kF64, ValueType::kI32>(                      \
-        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
-          __ emit_f64_set_cond(cond, dst.gp(), lhs.fp(), rhs.fp());          \
-        });
 #define CASE_I64_SHIFTOP(opcode, fn)                                         \
   case kExpr##opcode:                                                        \
-    return EmitBinOpImm<ValueType::kI64, ValueType::kI64>(                   \
+    return EmitBinOpImm<kI64, kI64>(                                         \
         [=](LiftoffRegister dst, LiftoffRegister src,                        \
             LiftoffRegister amount) {                                        \
           __ emit_##fn(dst, src,                                             \
                        amount.is_gp_pair() ? amount.low_gp() : amount.gp()); \
         },                                                                   \
-        [=](LiftoffRegister dst, LiftoffRegister src, int32_t amount) {      \
-          __ emit_##fn(dst, src, amount);                                    \
-        });
+        &LiftoffAssembler::emit_##fn##i);
 #define CASE_CCALL_BINOP(opcode, type, ext_ref_fn)                           \
   case kExpr##opcode:                                                        \
-    return EmitBinOp<ValueType::k##type, ValueType::k##type>(                \
+    return EmitBinOp<k##type, k##type>(                                      \
         [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
           LiftoffRegister args[] = {lhs, rhs};                               \
           auto ext_ref = ExternalReference::ext_ref_fn();                    \
@@ -1256,79 +1230,172 @@ class LiftoffCompiler {
           GenerateCCall(&dst, &sig, out_arg_type, args, ext_ref);            \
         });
     switch (opcode) {
-      CASE_I32_BINOPI(I32Add, i32_add)
-      CASE_I32_BINOP(I32Sub, i32_sub)
-      CASE_I32_BINOP(I32Mul, i32_mul)
-      CASE_I32_BINOPI(I32And, i32_and)
-      CASE_I32_BINOPI(I32Ior, i32_or)
-      CASE_I32_BINOPI(I32Xor, i32_xor)
-      CASE_I64_BINOPI(I64And, i64_and)
-      CASE_I64_BINOPI(I64Ior, i64_or)
-      CASE_I64_BINOPI(I64Xor, i64_xor)
-      CASE_I32_CMPOP(I32Eq)
-      CASE_I32_CMPOP(I32Ne)
-      CASE_I32_CMPOP(I32LtS)
-      CASE_I32_CMPOP(I32LtU)
-      CASE_I32_CMPOP(I32GtS)
-      CASE_I32_CMPOP(I32GtU)
-      CASE_I32_CMPOP(I32LeS)
-      CASE_I32_CMPOP(I32LeU)
-      CASE_I32_CMPOP(I32GeS)
-      CASE_I32_CMPOP(I32GeU)
-      CASE_I64_BINOPI(I64Add, i64_add)
-      CASE_I64_BINOP(I64Sub, i64_sub)
-      CASE_I64_BINOP(I64Mul, i64_mul)
-      CASE_I64_CMPOP(I64Eq, kEqual)
-      CASE_I64_CMPOP(I64Ne, kUnequal)
-      CASE_I64_CMPOP(I64LtS, kSignedLessThan)
-      CASE_I64_CMPOP(I64LtU, kUnsignedLessThan)
-      CASE_I64_CMPOP(I64GtS, kSignedGreaterThan)
-      CASE_I64_CMPOP(I64GtU, kUnsignedGreaterThan)
-      CASE_I64_CMPOP(I64LeS, kSignedLessEqual)
-      CASE_I64_CMPOP(I64LeU, kUnsignedLessEqual)
-      CASE_I64_CMPOP(I64GeS, kSignedGreaterEqual)
-      CASE_I64_CMPOP(I64GeU, kUnsignedGreaterEqual)
-      CASE_F32_CMPOP(F32Eq, kEqual)
-      CASE_F32_CMPOP(F32Ne, kUnequal)
-      CASE_F32_CMPOP(F32Lt, kUnsignedLessThan)
-      CASE_F32_CMPOP(F32Gt, kUnsignedGreaterThan)
-      CASE_F32_CMPOP(F32Le, kUnsignedLessEqual)
-      CASE_F32_CMPOP(F32Ge, kUnsignedGreaterEqual)
-      CASE_F64_CMPOP(F64Eq, kEqual)
-      CASE_F64_CMPOP(F64Ne, kUnequal)
-      CASE_F64_CMPOP(F64Lt, kUnsignedLessThan)
-      CASE_F64_CMPOP(F64Gt, kUnsignedGreaterThan)
-      CASE_F64_CMPOP(F64Le, kUnsignedLessEqual)
-      CASE_F64_CMPOP(F64Ge, kUnsignedGreaterEqual)
-      CASE_I32_BINOPI(I32Shl, i32_shl)
-      CASE_I32_BINOPI(I32ShrS, i32_sar)
-      CASE_I32_BINOPI(I32ShrU, i32_shr)
-      CASE_CCALL_BINOP(I32Rol, I32, wasm_word32_rol)
-      CASE_CCALL_BINOP(I32Ror, I32, wasm_word32_ror)
-      CASE_I64_SHIFTOP(I64Shl, i64_shl)
-      CASE_I64_SHIFTOP(I64ShrS, i64_sar)
-      CASE_I64_SHIFTOP(I64ShrU, i64_shr)
-      CASE_CCALL_BINOP(I64Rol, I64, wasm_word64_rol)
-      CASE_CCALL_BINOP(I64Ror, I64, wasm_word64_ror)
-      CASE_FLOAT_BINOP(F32Add, F32, f32_add)
-      CASE_FLOAT_BINOP(F32Sub, F32, f32_sub)
-      CASE_FLOAT_BINOP(F32Mul, F32, f32_mul)
-      CASE_FLOAT_BINOP(F32Div, F32, f32_div)
-      CASE_FLOAT_BINOP(F32Min, F32, f32_min)
-      CASE_FLOAT_BINOP(F32Max, F32, f32_max)
-      CASE_FLOAT_BINOP(F32CopySign, F32, f32_copysign)
-      CASE_FLOAT_BINOP(F64Add, F64, f64_add)
-      CASE_FLOAT_BINOP(F64Sub, F64, f64_sub)
-      CASE_FLOAT_BINOP(F64Mul, F64, f64_mul)
-      CASE_FLOAT_BINOP(F64Div, F64, f64_div)
-      CASE_FLOAT_BINOP(F64Min, F64, f64_min)
-      CASE_FLOAT_BINOP(F64Max, F64, f64_max)
-      CASE_FLOAT_BINOP(F64CopySign, F64, f64_copysign)
+      case kExprI32Add:
+        return EmitBinOpImm<kI32, kI32>(&LiftoffAssembler::emit_i32_add,
+                                        &LiftoffAssembler::emit_i32_addi);
+      case kExprI32Sub:
+        return EmitBinOp<kI32, kI32>(&LiftoffAssembler::emit_i32_sub);
+      case kExprI32Mul:
+        return EmitBinOp<kI32, kI32>(&LiftoffAssembler::emit_i32_mul);
+      case kExprI32And:
+        return EmitBinOpImm<kI32, kI32>(&LiftoffAssembler::emit_i32_and,
+                                        &LiftoffAssembler::emit_i32_andi);
+      case kExprI32Ior:
+        return EmitBinOpImm<kI32, kI32>(&LiftoffAssembler::emit_i32_or,
+                                        &LiftoffAssembler::emit_i32_ori);
+      case kExprI32Xor:
+        return EmitBinOpImm<kI32, kI32>(&LiftoffAssembler::emit_i32_xor,
+                                        &LiftoffAssembler::emit_i32_xori);
+      case kExprI32Eq:
+        return EmitI32CmpOp<kExprI32Eq>(decoder);
+      case kExprI32Ne:
+        return EmitI32CmpOp<kExprI32Ne>(decoder);
+      case kExprI32LtS:
+        return EmitI32CmpOp<kExprI32LtS>(decoder);
+      case kExprI32LtU:
+        return EmitI32CmpOp<kExprI32LtU>(decoder);
+      case kExprI32GtS:
+        return EmitI32CmpOp<kExprI32GtS>(decoder);
+      case kExprI32GtU:
+        return EmitI32CmpOp<kExprI32GtU>(decoder);
+      case kExprI32LeS:
+        return EmitI32CmpOp<kExprI32LeS>(decoder);
+      case kExprI32LeU:
+        return EmitI32CmpOp<kExprI32LeU>(decoder);
+      case kExprI32GeS:
+        return EmitI32CmpOp<kExprI32GeS>(decoder);
+      case kExprI32GeU:
+        return EmitI32CmpOp<kExprI32GeU>(decoder);
+      case kExprI64Add:
+        return EmitBinOpImm<kI64, kI64>(&LiftoffAssembler::emit_i64_add,
+                                        &LiftoffAssembler::emit_i64_addi);
+      case kExprI64Sub:
+        return EmitBinOp<kI64, kI64>(&LiftoffAssembler::emit_i64_sub);
+      case kExprI64Mul:
+        return EmitBinOp<kI64, kI64>(&LiftoffAssembler::emit_i64_mul);
+      case kExprI64And:
+        return EmitBinOpImm<kI64, kI64>(&LiftoffAssembler::emit_i64_and,
+                                        &LiftoffAssembler::emit_i64_andi);
+      case kExprI64Ior:
+        return EmitBinOpImm<kI64, kI64>(&LiftoffAssembler::emit_i64_or,
+                                        &LiftoffAssembler::emit_i64_ori);
+      case kExprI64Xor:
+        return EmitBinOpImm<kI64, kI64>(&LiftoffAssembler::emit_i64_xor,
+                                        &LiftoffAssembler::emit_i64_xori);
+      case kExprI64Eq:
+        return EmitBinOp<kI64, kI32>(
+            BindFirst(&LiftoffAssembler::emit_i64_set_cond, kEqual));
+      case kExprI64Ne:
+        return EmitBinOp<kI64, kI32>(
+            BindFirst(&LiftoffAssembler::emit_i64_set_cond, kUnequal));
+      case kExprI64LtS:
+        return EmitBinOp<kI64, kI32>(
+            BindFirst(&LiftoffAssembler::emit_i64_set_cond, kSignedLessThan));
+      case kExprI64LtU:
+        return EmitBinOp<kI64, kI32>(
+            BindFirst(&LiftoffAssembler::emit_i64_set_cond, kUnsignedLessThan));
+      case kExprI64GtS:
+        return EmitBinOp<kI64, kI32>(BindFirst(
+            &LiftoffAssembler::emit_i64_set_cond, kSignedGreaterThan));
+      case kExprI64GtU:
+        return EmitBinOp<kI64, kI32>(BindFirst(
+            &LiftoffAssembler::emit_i64_set_cond, kUnsignedGreaterThan));
+      case kExprI64LeS:
+        return EmitBinOp<kI64, kI32>(
+            BindFirst(&LiftoffAssembler::emit_i64_set_cond, kSignedLessEqual));
+      case kExprI64LeU:
+        return EmitBinOp<kI64, kI32>(BindFirst(
+            &LiftoffAssembler::emit_i64_set_cond, kUnsignedLessEqual));
+      case kExprI64GeS:
+        return EmitBinOp<kI64, kI32>(BindFirst(
+            &LiftoffAssembler::emit_i64_set_cond, kSignedGreaterEqual));
+      case kExprI64GeU:
+        return EmitBinOp<kI64, kI32>(BindFirst(
+            &LiftoffAssembler::emit_i64_set_cond, kUnsignedGreaterEqual));
+      case kExprF32Eq:
+        return EmitBinOp<kF32, kI32>(
+            BindFirst(&LiftoffAssembler::emit_f32_set_cond, kEqual));
+      case kExprF32Ne:
+        return EmitBinOp<kF32, kI32>(
+            BindFirst(&LiftoffAssembler::emit_f32_set_cond, kUnequal));
+      case kExprF32Lt:
+        return EmitBinOp<kF32, kI32>(
+            BindFirst(&LiftoffAssembler::emit_f32_set_cond, kUnsignedLessThan));
+      case kExprF32Gt:
+        return EmitBinOp<kF32, kI32>(BindFirst(
+            &LiftoffAssembler::emit_f32_set_cond, kUnsignedGreaterThan));
+      case kExprF32Le:
+        return EmitBinOp<kF32, kI32>(BindFirst(
+            &LiftoffAssembler::emit_f32_set_cond, kUnsignedLessEqual));
+      case kExprF32Ge:
+        return EmitBinOp<kF32, kI32>(BindFirst(
+            &LiftoffAssembler::emit_f32_set_cond, kUnsignedGreaterEqual));
+      case kExprF64Eq:
+        return EmitBinOp<kF64, kI32>(
+            BindFirst(&LiftoffAssembler::emit_f64_set_cond, kEqual));
+      case kExprF64Ne:
+        return EmitBinOp<kF64, kI32>(
+            BindFirst(&LiftoffAssembler::emit_f64_set_cond, kUnequal));
+      case kExprF64Lt:
+        return EmitBinOp<kF64, kI32>(
+            BindFirst(&LiftoffAssembler::emit_f64_set_cond, kUnsignedLessThan));
+      case kExprF64Gt:
+        return EmitBinOp<kF64, kI32>(BindFirst(
+            &LiftoffAssembler::emit_f64_set_cond, kUnsignedGreaterThan));
+      case kExprF64Le:
+        return EmitBinOp<kF64, kI32>(BindFirst(
+            &LiftoffAssembler::emit_f64_set_cond, kUnsignedLessEqual));
+      case kExprF64Ge:
+        return EmitBinOp<kF64, kI32>(BindFirst(
+            &LiftoffAssembler::emit_f64_set_cond, kUnsignedGreaterEqual));
+      case kExprI32Shl:
+        return EmitBinOpImm<kI32, kI32>(&LiftoffAssembler::emit_i32_shl,
+                                        &LiftoffAssembler::emit_i32_shli);
+      case kExprI32ShrS:
+        return EmitBinOpImm<kI32, kI32>(&LiftoffAssembler::emit_i32_sar,
+                                        &LiftoffAssembler::emit_i32_sari);
+      case kExprI32ShrU:
+        return EmitBinOpImm<kI32, kI32>(&LiftoffAssembler::emit_i32_shr,
+                                        &LiftoffAssembler::emit_i32_shri);
+        CASE_CCALL_BINOP(I32Rol, I32, wasm_word32_rol)
+        CASE_CCALL_BINOP(I32Ror, I32, wasm_word32_ror)
+        CASE_I64_SHIFTOP(I64Shl, i64_shl)
+        CASE_I64_SHIFTOP(I64ShrS, i64_sar)
+        CASE_I64_SHIFTOP(I64ShrU, i64_shr)
+        CASE_CCALL_BINOP(I64Rol, I64, wasm_word64_rol)
+        CASE_CCALL_BINOP(I64Ror, I64, wasm_word64_ror)
+      case kExprF32Add:
+        return EmitBinOp<kF32, kF32>(&LiftoffAssembler::emit_f32_add);
+      case kExprF32Sub:
+        return EmitBinOp<kF32, kF32>(&LiftoffAssembler::emit_f32_sub);
+      case kExprF32Mul:
+        return EmitBinOp<kF32, kF32>(&LiftoffAssembler::emit_f32_mul);
+      case kExprF32Div:
+        return EmitBinOp<kF32, kF32>(&LiftoffAssembler::emit_f32_div);
+      case kExprF32Min:
+        return EmitBinOp<kF32, kF32>(&LiftoffAssembler::emit_f32_min);
+      case kExprF32Max:
+        return EmitBinOp<kF32, kF32>(&LiftoffAssembler::emit_f32_max);
+      case kExprF32CopySign:
+        return EmitBinOp<kF32, kF32>(&LiftoffAssembler::emit_f32_copysign);
+      case kExprF64Add:
+        return EmitBinOp<kF64, kF64>(&LiftoffAssembler::emit_f64_add);
+      case kExprF64Sub:
+        return EmitBinOp<kF64, kF64>(&LiftoffAssembler::emit_f64_sub);
+      case kExprF64Mul:
+        return EmitBinOp<kF64, kF64>(&LiftoffAssembler::emit_f64_mul);
+      case kExprF64Div:
+        return EmitBinOp<kF64, kF64>(&LiftoffAssembler::emit_f64_div);
+      case kExprF64Min:
+        return EmitBinOp<kF64, kF64>(&LiftoffAssembler::emit_f64_min);
+      case kExprF64Max:
+        return EmitBinOp<kF64, kF64>(&LiftoffAssembler::emit_f64_max);
+      case kExprF64CopySign:
+        return EmitBinOp<kF64, kF64>(&LiftoffAssembler::emit_f64_copysign);
       case kExprI32DivS:
-        EmitBinOp<ValueType::kI32, ValueType::kI32>([this, decoder](
-                                                        LiftoffRegister dst,
-                                                        LiftoffRegister lhs,
-                                                        LiftoffRegister rhs) {
+        return EmitBinOp<kI32, kI32>([this, decoder](LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
           WasmCodePosition position = decoder->position();
           AddOutOfLineTrap(position, WasmCode::kThrowWasmTrapDivByZero);
           // Adding the second trap might invalidate the pointer returned for
@@ -1340,39 +1407,34 @@ class LiftoffCompiler {
           __ emit_i32_divs(dst.gp(), lhs.gp(), rhs.gp(), div_by_zero,
                            div_unrepresentable);
         });
-        break;
       case kExprI32DivU:
-        EmitBinOp<ValueType::kI32, ValueType::kI32>(
+        return EmitBinOp<kI32, kI32>(
             [this, decoder](LiftoffRegister dst, LiftoffRegister lhs,
                             LiftoffRegister rhs) {
               Label* div_by_zero = AddOutOfLineTrap(
                   decoder->position(), WasmCode::kThrowWasmTrapDivByZero);
               __ emit_i32_divu(dst.gp(), lhs.gp(), rhs.gp(), div_by_zero);
             });
-        break;
       case kExprI32RemS:
-        EmitBinOp<ValueType::kI32, ValueType::kI32>(
+        return EmitBinOp<kI32, kI32>(
             [this, decoder](LiftoffRegister dst, LiftoffRegister lhs,
                             LiftoffRegister rhs) {
               Label* rem_by_zero = AddOutOfLineTrap(
                   decoder->position(), WasmCode::kThrowWasmTrapRemByZero);
               __ emit_i32_rems(dst.gp(), lhs.gp(), rhs.gp(), rem_by_zero);
             });
-        break;
       case kExprI32RemU:
-        EmitBinOp<ValueType::kI32, ValueType::kI32>(
+        return EmitBinOp<kI32, kI32>(
             [this, decoder](LiftoffRegister dst, LiftoffRegister lhs,
                             LiftoffRegister rhs) {
               Label* rem_by_zero = AddOutOfLineTrap(
                   decoder->position(), WasmCode::kThrowWasmTrapRemByZero);
               __ emit_i32_remu(dst.gp(), lhs.gp(), rhs.gp(), rem_by_zero);
             });
-        break;
       case kExprI64DivS:
-        EmitBinOp<ValueType::kI64, ValueType::kI64>([this, decoder](
-                                                        LiftoffRegister dst,
-                                                        LiftoffRegister lhs,
-                                                        LiftoffRegister rhs) {
+        return EmitBinOp<kI64, kI64>([this, decoder](LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
           WasmCodePosition position = decoder->position();
           AddOutOfLineTrap(position, WasmCode::kThrowWasmTrapDivByZero);
           // Adding the second trap might invalidate the pointer returned for
@@ -1388,12 +1450,10 @@ class LiftoffCompiler {
                                 div_unrepresentable);
           }
         });
-        break;
       case kExprI64DivU:
-        EmitBinOp<ValueType::kI64, ValueType::kI64>([this, decoder](
-                                                        LiftoffRegister dst,
-                                                        LiftoffRegister lhs,
-                                                        LiftoffRegister rhs) {
+        return EmitBinOp<kI64, kI64>([this, decoder](LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
           Label* div_by_zero = AddOutOfLineTrap(
               decoder->position(), WasmCode::kThrowWasmTrapDivByZero);
           if (!__ emit_i64_divu(dst, lhs, rhs, div_by_zero)) {
@@ -1401,9 +1461,8 @@ class LiftoffCompiler {
             EmitDivOrRem64CCall(dst, lhs, rhs, ext_ref, div_by_zero);
           }
         });
-        break;
       case kExprI64RemS:
-        EmitBinOp<ValueType::kI64, ValueType::kI64>(
+        return EmitBinOp<kI64, kI64>(
             [this, decoder](LiftoffRegister dst, LiftoffRegister lhs,
                             LiftoffRegister rhs) {
               Label* rem_by_zero = AddOutOfLineTrap(
@@ -1413,12 +1472,10 @@ class LiftoffCompiler {
                 EmitDivOrRem64CCall(dst, lhs, rhs, ext_ref, rem_by_zero);
               }
             });
-        break;
       case kExprI64RemU:
-        EmitBinOp<ValueType::kI64, ValueType::kI64>([this, decoder](
-                                                        LiftoffRegister dst,
-                                                        LiftoffRegister lhs,
-                                                        LiftoffRegister rhs) {
+        return EmitBinOp<kI64, kI64>([this, decoder](LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
           Label* rem_by_zero = AddOutOfLineTrap(
               decoder->position(), WasmCode::kThrowWasmTrapRemByZero);
           if (!__ emit_i64_remu(dst, lhs, rhs, rem_by_zero)) {
@@ -1426,19 +1483,9 @@ class LiftoffCompiler {
             EmitDivOrRem64CCall(dst, lhs, rhs, ext_ref, rem_by_zero);
           }
         });
-        break;
       default:
         UNREACHABLE();
     }
-#undef CASE_I32_BINOP
-#undef CASE_I32_BINOPI
-#undef CASE_I64_BINOP
-#undef CASE_I64_BINOPI
-#undef CASE_FLOAT_BINOP
-#undef CASE_I32_CMPOP
-#undef CASE_I64_CMPOP
-#undef CASE_F32_CMPOP
-#undef CASE_F64_CMPOP
 #undef CASE_I64_SHIFTOP
 #undef CASE_CCALL_BINOP
   }
@@ -1456,20 +1503,20 @@ class LiftoffCompiler {
     if (value_i32 == value) {
       __ PushConstant(kWasmI64, value_i32);
     } else {
-      LiftoffRegister reg = __ GetUnusedRegister(reg_class_for(kWasmI64));
+      LiftoffRegister reg = __ GetUnusedRegister(reg_class_for(kWasmI64), {});
       __ LoadConstant(reg, WasmValue(value));
       __ PushRegister(kWasmI64, reg);
     }
   }
 
   void F32Const(FullDecoder* decoder, Value* result, float value) {
-    LiftoffRegister reg = __ GetUnusedRegister(kFpReg);
+    LiftoffRegister reg = __ GetUnusedRegister(kFpReg, {});
     __ LoadConstant(reg, WasmValue(value));
     __ PushRegister(kWasmF32, reg);
   }
 
   void F64Const(FullDecoder* decoder, Value* result, double value) {
-    LiftoffRegister reg = __ GetUnusedRegister(kFpReg);
+    LiftoffRegister reg = __ GetUnusedRegister(kFpReg, {});
     __ LoadConstant(reg, WasmValue(value));
     __ PushRegister(kWasmF64, reg);
   }
@@ -1482,6 +1529,10 @@ class LiftoffCompiler {
     unsupported(decoder, kAnyRef, "func");
   }
 
+  void RefAsNonNull(FullDecoder* decoder, const Value& arg, Value* result) {
+    unsupported(decoder, kAnyRef, "ref.as_non_null");
+  }
+
   void Drop(FullDecoder* decoder, const Value& value) {
     auto& slot = __ cache_state()->stack_state.back();
     // If the dropped slot contains a register, decrement it's use count.
@@ -1491,12 +1542,9 @@ class LiftoffCompiler {
 
   void ReturnImpl(FullDecoder* decoder) {
     size_t num_returns = decoder->sig_->return_count();
-    if (num_returns > 1) {
-      return unsupported(decoder, kMultiValue, "multi-return");
-    }
-    if (num_returns > 0) __ MoveToReturnRegisters(decoder->sig_);
+    if (num_returns > 0) __ MoveToReturnLocations(decoder->sig_, descriptor_);
     DEBUG_CODE_COMMENT("leave frame");
-    __ LeaveFrame(StackFrame::WASM_COMPILED);
+    __ LeaveFrame(StackFrame::WASM);
     __ DropStackSlotsAndRet(
         static_cast<uint32_t>(descriptor_->StackParameterCount()));
   }
@@ -1518,7 +1566,7 @@ class LiftoffCompiler {
         break;
       case kStack: {
         auto rc = reg_class_for(imm.type);
-        LiftoffRegister reg = __ GetUnusedRegister(rc);
+        LiftoffRegister reg = __ GetUnusedRegister(rc, {});
         __ Fill(reg, slot.offset(), imm.type);
         __ PushRegister(slot.type(), reg);
         break;
@@ -1542,7 +1590,7 @@ class LiftoffCompiler {
     }
     DCHECK_EQ(type, __ local_type(local_index));
     RegClass rc = reg_class_for(type);
-    LiftoffRegister dst_reg = __ GetUnusedRegister(rc);
+    LiftoffRegister dst_reg = __ GetUnusedRegister(rc, {});
     __ Fill(dst_reg, src_slot.offset(), type);
     *dst_slot = LiftoffAssembler::VarState(type, dst_reg, dst_slot->offset());
     __ cache_state()->inc_used(dst_reg);
@@ -1579,9 +1627,19 @@ class LiftoffCompiler {
     LocalSet(imm.index, true);
   }
 
+  void AllocateLocals(FullDecoder* decoder, Vector<Value> local_values) {
+    // TODO(7748): Introduce typed functions bailout reason
+    unsupported(decoder, kGC, "let");
+  }
+
+  void DeallocateLocals(FullDecoder* decoder, uint32_t count) {
+    // TODO(7748): Introduce typed functions bailout reason
+    unsupported(decoder, kGC, "let");
+  }
+
   Register GetGlobalBaseAndOffset(const WasmGlobal* global,
                                   LiftoffRegList* pinned, uint32_t* offset) {
-    Register addr = pinned->set(__ GetUnusedRegister(kGpReg)).gp();
+    Register addr = pinned->set(__ GetUnusedRegister(kGpReg, {})).gp();
     if (global->mutability && global->imported) {
       LOAD_INSTANCE_FIELD(addr, ImportedMutableGlobals, kSystemPointerSize);
       __ Load(LiftoffRegister(addr), addr, no_reg,
@@ -1647,8 +1705,8 @@ class LiftoffCompiler {
     DCHECK_EQ(type, __ cache_state()->stack_state.end()[-2].type());
     LiftoffRegister false_value = pinned.set(__ PopToRegister(pinned));
     LiftoffRegister true_value = __ PopToRegister(pinned);
-    LiftoffRegister dst =
-        __ GetUnusedRegister(true_value.reg_class(), {true_value, false_value});
+    LiftoffRegister dst = __ GetUnusedRegister(true_value.reg_class(),
+                                               {true_value, false_value}, {});
     __ PushRegister(type, dst);
 
     // Now emit the actual code to move either {true_value} or {false_value}
@@ -1791,13 +1849,28 @@ class LiftoffCompiler {
     __ cache_state()->Steal(c->else_state->state);
   }
 
+  std::unique_ptr<SpilledRegistersBeforeTrap> GetSpilledRegistersBeforeTrap() {
+    if (V8_LIKELY(!for_debugging_)) return nullptr;
+    // If we are generating debugging code, we really need to spill all
+    // registers to make them inspectable when stopping at the trap.
+    auto spilled = std::make_unique<SpilledRegistersBeforeTrap>();
+    for (uint32_t i = 0, e = __ cache_state()->stack_height(); i < e; ++i) {
+      auto& slot = __ cache_state()->stack_state[i];
+      if (!slot.is_reg()) continue;
+      spilled->entries.push_back(SpilledRegistersBeforeTrap::Entry{
+          slot.offset(), slot.reg(), slot.type()});
+    }
+    return spilled;
+  }
+
   Label* AddOutOfLineTrap(WasmCodePosition position,
                           WasmCode::RuntimeStubId stub, uint32_t pc = 0) {
     DCHECK(FLAG_wasm_bounds_checks);
 
     out_of_line_code_.push_back(OutOfLineCode::Trap(
         stub, position, pc,
-        RegisterDebugSideTableEntry(DebugSideTableBuilder::kAssumeSpilling)));
+        RegisterDebugSideTableEntry(DebugSideTableBuilder::kAssumeSpilling),
+        GetSpilledRegistersBeforeTrap()));
     return out_of_line_code_.back().label.get();
   }
 
@@ -1882,12 +1955,12 @@ class LiftoffCompiler {
       // AND of two operands. We could introduce a new variant of
       // {emit_cond_jump} to use the "test" instruction without the "and" here.
       // Then we can also avoid using the temp register here.
-      __ emit_i32_and(address, index, align_mask);
+      __ emit_i32_andi(address, index, align_mask);
       __ emit_cond_jump(kUnequal, trap_label, kWasmI32, address);
       return;
     }
-    __ emit_i32_add(address, index, offset);
-    __ emit_i32_and(address, address, align_mask);
+    __ emit_i32_addi(address, index, offset);
+    __ emit_i32_andi(address, address, align_mask);
 
     __ emit_cond_jump(kUnequal, trap_label, kWasmI32, address);
   }
@@ -1950,7 +2023,7 @@ class LiftoffCompiler {
       if (index != old_index) __ Move(index, old_index, kWasmI32);
     }
     Register tmp = __ GetUnusedRegister(kGpReg, *pinned).gp();
-    __ emit_ptrsize_add(index, index, *offset);
+    __ emit_ptrsize_addi(index, index, *offset);
     LOAD_INSTANCE_FIELD(tmp, MemoryMask, kSystemPointerSize);
     __ emit_ptrsize_and(index, index, tmp);
     *offset = 0;
@@ -1990,11 +2063,54 @@ class LiftoffCompiler {
                            offset, decoder->position());
     }
   }
+
   void LoadTransform(FullDecoder* decoder, LoadType type,
                      LoadTransformationKind transform,
                      const MemoryAccessImmediate<validate>& imm,
                      const Value& index_val, Value* result) {
-    unsupported(decoder, kSimd, "simd");
+    // LoadTransform requires SIMD support, so check for it here. If
+    // unsupported, bailout and let TurboFan lower the code.
+    if (!CheckSupportedType(decoder, kSupportedTypes, kWasmS128,
+                            "LoadTransform")) {
+      return;
+    }
+
+    LiftoffRegList pinned;
+    Register index = pinned.set(__ PopToRegister()).gp();
+    // For load splats, LoadType is the size of the load, and for load
+    // extends, LoadType is the size of the lane, and it always loads 8 bytes.
+    uint32_t access_size =
+        transform == LoadTransformationKind::kExtend ? 8 : type.size();
+    if (BoundsCheckMem(decoder, access_size, imm.offset, index, pinned,
+                       kDontForceCheck)) {
+      return;
+    }
+
+    uint32_t offset = imm.offset;
+    index = AddMemoryMasking(index, &offset, &pinned);
+    DEBUG_CODE_COMMENT("LoadTransform from memory");
+    Register addr = __ GetUnusedRegister(kGpReg, pinned).gp();
+    LOAD_INSTANCE_FIELD(addr, MemoryStart, kSystemPointerSize);
+    LiftoffRegister value = __ GetUnusedRegister(reg_class_for(kS128), {});
+    uint32_t protected_load_pc = 0;
+    __ LoadTransform(value, addr, index, offset, type, transform,
+                     &protected_load_pc);
+
+    if (env_->use_trap_handler) {
+      AddOutOfLineTrap(decoder->position(),
+                       WasmCode::kThrowWasmTrapMemOutOfBounds,
+                       protected_load_pc);
+    }
+    __ PushRegister(ValueType{kS128}, value);
+
+    if (FLAG_trace_wasm_memory) {
+      // Again load extend is different.
+      MachineRepresentation mem_rep =
+          transform == LoadTransformationKind::kExtend
+              ? MachineRepresentation::kWord64
+              : type.mem_type().representation();
+      TraceMemoryOperation(false, mem_rep, index, offset, decoder->position());
+    }
   }
 
   void StoreMem(FullDecoder* decoder, StoreType type,
@@ -2032,9 +2148,9 @@ class LiftoffCompiler {
   }
 
   void CurrentMemoryPages(FullDecoder* decoder, Value* result) {
-    Register mem_size = __ GetUnusedRegister(kGpReg).gp();
+    Register mem_size = __ GetUnusedRegister(kGpReg, {}).gp();
     LOAD_INSTANCE_FIELD(mem_size, MemorySize, kSystemPointerSize);
-    __ emit_ptrsize_shr(mem_size, mem_size, kWasmPageSizeLog2);
+    __ emit_ptrsize_shri(mem_size, mem_size, kWasmPageSizeLog2);
     __ PushRegister(kWasmI32, LiftoffRegister(mem_size));
   }
 
@@ -2081,13 +2197,10 @@ class LiftoffCompiler {
   void CallDirect(FullDecoder* decoder,
                   const CallFunctionImmediate<validate>& imm,
                   const Value args[], Value returns[]) {
-    if (imm.sig->return_count() > 1) {
-      return unsupported(decoder, kMultiValue, "multi-return");
-    }
-    if (imm.sig->return_count() == 1 &&
-        !CheckSupportedType(decoder, kSupportedTypes, imm.sig->GetReturn(0),
-                            "return")) {
-      return;
+    for (ValueType ret : imm.sig->returns()) {
+      if (!CheckSupportedType(decoder, kSupportedTypes, ret, "return")) {
+        return;
+      }
     }
 
     auto call_descriptor =
@@ -2143,16 +2256,13 @@ class LiftoffCompiler {
   void CallIndirect(FullDecoder* decoder, const Value& index_val,
                     const CallIndirectImmediate<validate>& imm,
                     const Value args[], Value returns[]) {
-    if (imm.sig->return_count() > 1) {
-      return unsupported(decoder, kMultiValue, "multi-return");
-    }
     if (imm.table_index != 0) {
       return unsupported(decoder, kAnyRef, "table index != 0");
     }
-    if (imm.sig->return_count() == 1 &&
-        !CheckSupportedType(decoder, kSupportedTypes, imm.sig->GetReturn(0),
-                            "return")) {
-      return;
+    for (ValueType ret : imm.sig->returns()) {
+      if (!CheckSupportedType(decoder, kSupportedTypes, ret, "return")) {
+        return;
+      }
     }
 
     // Place the source position before any stack manipulation, since this will
@@ -2207,7 +2317,7 @@ class LiftoffCompiler {
       // 3) mask = diff & neg_index
       __ emit_i32_and(mask, diff, neg_index);
       // 4) mask = mask >> 31
-      __ emit_i32_sar(mask, mask, 31);
+      __ emit_i32_sari(mask, mask, 31);
 
       // Apply mask.
       __ emit_i32_and(index, index, mask);
@@ -2218,7 +2328,7 @@ class LiftoffCompiler {
     LOAD_INSTANCE_FIELD(table, IndirectFunctionTableSigIds, kSystemPointerSize);
     // Shift {index} by 2 (multiply by 4) to represent kInt32Size items.
     STATIC_ASSERT((1 << 2) == kInt32Size);
-    __ emit_i32_shl(index, index, 2);
+    __ emit_i32_shli(index, index, 2);
     __ Load(LiftoffRegister(scratch), table, index, 0, LoadType::kI32Load,
             pinned);
 
@@ -2288,156 +2398,407 @@ class LiftoffCompiler {
     unsupported(decoder, kTailCall, "return_call_indirect");
   }
 
+  void BrOnNull(FullDecoder* decoder, const Value& ref_object, uint32_t depth) {
+    unsupported(decoder, kAnyRef, "br_on_null");
+  }
+
+  template <ValueType::Kind src_type, ValueType::Kind result_type,
+            typename EmitFn>
+  void EmitTerOp(EmitFn fn) {
+    static constexpr RegClass src_rc = reg_class_for(src_type);
+    static constexpr RegClass result_rc = reg_class_for(result_type);
+    LiftoffRegister src3 = __ PopToRegister();
+    LiftoffRegister src2 = __ PopToRegister(LiftoffRegList::ForRegs(src3));
+    LiftoffRegister src1 =
+        __ PopToRegister(LiftoffRegList::ForRegs(src3, src2));
+    // Reusing src1 and src2 will complicate codegen for select for some
+    // backend, so we allow only reusing src3 (the mask), and pin src1 and src2.
+    LiftoffRegister dst =
+        src_rc == result_rc
+            ? __ GetUnusedRegister(result_rc, {src3},
+                                   LiftoffRegList::ForRegs(src1, src2))
+            : __ GetUnusedRegister(result_rc, {});
+    CallEmitFn(fn, dst, src1, src2, src3);
+    __ PushRegister(ValueType(result_type), dst);
+  }
+
+  template <typename EmitFn, typename EmitFnImm>
+  void EmitSimdShiftOp(EmitFn fn, EmitFnImm fnImm) {
+    static constexpr RegClass result_rc = reg_class_for(ValueType::kS128);
+
+    LiftoffAssembler::VarState rhs_slot = __ cache_state()->stack_state.back();
+    // Check if the RHS is an immediate.
+    if (rhs_slot.is_const()) {
+      __ cache_state()->stack_state.pop_back();
+      int32_t imm = rhs_slot.i32_const();
+
+      LiftoffRegister operand = __ PopToRegister();
+      LiftoffRegister dst = __ GetUnusedRegister(result_rc, {operand}, {});
+
+      CallEmitFn(fnImm, dst, operand, imm);
+      __ PushRegister(kWasmS128, dst);
+    } else {
+      LiftoffRegister count = __ PopToRegister();
+      LiftoffRegister operand = __ PopToRegister();
+      LiftoffRegister dst = __ GetUnusedRegister(result_rc, {operand}, {});
+
+      CallEmitFn(fn, dst, operand, count);
+      __ PushRegister(kWasmS128, dst);
+    }
+  }
+
   void SimdOp(FullDecoder* decoder, WasmOpcode opcode, Vector<Value> args,
               Value* result) {
     if (!CpuFeatures::SupportsWasmSimd128()) {
       return unsupported(decoder, kSimd, "simd");
     }
     switch (opcode) {
-      case wasm::kExprF64x2Splat:
-        EmitUnOp<ValueType::kF64, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister src) {
-              __ emit_f64x2_splat(dst, src);
-            });
-        break;
-      case wasm::kExprF64x2Add:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_f64x2_add(dst, lhs, rhs);
-            });
-        break;
-      case wasm::kExprF64x2Sub:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_f64x2_sub(dst, lhs, rhs);
-            });
-        break;
-      case wasm::kExprF64x2Mul:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_f64x2_mul(dst, lhs, rhs);
-            });
-        break;
-      case wasm::kExprF32x4Splat:
-        EmitUnOp<ValueType::kF32, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister src) {
-              __ emit_f32x4_splat(dst, src);
-            });
-        break;
-      case wasm::kExprF32x4Add:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_f32x4_add(dst, lhs, rhs);
-            });
-        break;
-      case wasm::kExprF32x4Sub:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_f32x4_sub(dst, lhs, rhs);
-            });
-        break;
-      case wasm::kExprF32x4Mul:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_f32x4_mul(dst, lhs, rhs);
-            });
-        break;
-      case wasm::kExprI64x2Splat:
-        EmitUnOp<ValueType::kI64, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister src) {
-              __ emit_i64x2_splat(dst, src);
-            });
-        break;
-      case wasm::kExprI64x2Add:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_i64x2_add(dst, lhs, rhs);
-            });
-        break;
-      case wasm::kExprI64x2Sub:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_i64x2_sub(dst, lhs, rhs);
-            });
-        break;
-      case wasm::kExprI64x2Mul:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_i64x2_mul(dst, lhs, rhs);
-            });
-        break;
-      case wasm::kExprI32x4Splat:
-        EmitUnOp<ValueType::kI32, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister src) {
-              __ emit_i32x4_splat(dst, src);
-            });
-        break;
-      case wasm::kExprI32x4Add:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_i32x4_add(dst, lhs, rhs);
-            });
-        break;
-      case wasm::kExprI32x4Sub:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_i32x4_sub(dst, lhs, rhs);
-            });
-        break;
-      case wasm::kExprI32x4Mul:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_i32x4_mul(dst, lhs, rhs);
-            });
-        break;
-      case wasm::kExprI16x8Splat:
-        EmitUnOp<ValueType::kI32, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister src) {
-              __ emit_i16x8_splat(dst, src);
-            });
-        break;
-      case wasm::kExprI16x8Add:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_i16x8_add(dst, lhs, rhs);
-            });
-        break;
-      case wasm::kExprI16x8Sub:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_i16x8_sub(dst, lhs, rhs);
-            });
-        break;
-      case wasm::kExprI16x8Mul:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_i16x8_mul(dst, lhs, rhs);
-            });
-        break;
+      case wasm::kExprS8x16Swizzle:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_s8x16_swizzle);
       case wasm::kExprI8x16Splat:
-        EmitUnOp<ValueType::kI32, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister src) {
-              __ emit_i8x16_splat(dst, src);
-            });
-        break;
+        return EmitUnOp<kI32, kS128>(&LiftoffAssembler::emit_i8x16_splat);
+      case wasm::kExprI16x8Splat:
+        return EmitUnOp<kI32, kS128>(&LiftoffAssembler::emit_i16x8_splat);
+      case wasm::kExprI32x4Splat:
+        return EmitUnOp<kI32, kS128>(&LiftoffAssembler::emit_i32x4_splat);
+      case wasm::kExprI64x2Splat:
+        return EmitUnOp<kI64, kS128>(&LiftoffAssembler::emit_i64x2_splat);
+      case wasm::kExprF32x4Splat:
+        return EmitUnOp<kF32, kS128>(&LiftoffAssembler::emit_f32x4_splat);
+      case wasm::kExprF64x2Splat:
+        return EmitUnOp<kF64, kS128>(&LiftoffAssembler::emit_f64x2_splat);
+      case wasm::kExprI8x16Eq:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i8x16_eq);
+      case wasm::kExprI8x16Ne:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i8x16_ne);
+      case wasm::kExprI8x16LtS:
+        return EmitBinOp<kS128, kS128, true>(
+            &LiftoffAssembler::emit_i8x16_gt_s);
+      case wasm::kExprI8x16LtU:
+        return EmitBinOp<kS128, kS128, true>(
+            &LiftoffAssembler::emit_i8x16_gt_u);
+      case wasm::kExprI8x16GtS:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i8x16_gt_s);
+      case wasm::kExprI8x16GtU:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i8x16_gt_u);
+      case wasm::kExprI8x16LeS:
+        return EmitBinOp<kS128, kS128, true>(
+            &LiftoffAssembler::emit_i8x16_ge_s);
+      case wasm::kExprI8x16LeU:
+        return EmitBinOp<kS128, kS128, true>(
+            &LiftoffAssembler::emit_i8x16_ge_u);
+      case wasm::kExprI8x16GeS:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i8x16_ge_s);
+      case wasm::kExprI8x16GeU:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i8x16_ge_u);
+      case wasm::kExprI16x8Eq:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i16x8_eq);
+      case wasm::kExprI16x8Ne:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i16x8_ne);
+      case wasm::kExprI16x8LtS:
+        return EmitBinOp<kS128, kS128, true>(
+            &LiftoffAssembler::emit_i16x8_gt_s);
+      case wasm::kExprI16x8LtU:
+        return EmitBinOp<kS128, kS128, true>(
+            &LiftoffAssembler::emit_i16x8_gt_u);
+      case wasm::kExprI16x8GtS:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i16x8_gt_s);
+      case wasm::kExprI16x8GtU:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i16x8_gt_u);
+      case wasm::kExprI16x8LeS:
+        return EmitBinOp<kS128, kS128, true>(
+            &LiftoffAssembler::emit_i16x8_ge_s);
+      case wasm::kExprI16x8LeU:
+        return EmitBinOp<kS128, kS128, true>(
+            &LiftoffAssembler::emit_i16x8_ge_u);
+      case wasm::kExprI16x8GeS:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i16x8_ge_s);
+      case wasm::kExprI16x8GeU:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i16x8_ge_u);
+      case wasm::kExprI32x4Eq:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i32x4_eq);
+      case wasm::kExprI32x4Ne:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i32x4_ne);
+      case wasm::kExprI32x4LtS:
+        return EmitBinOp<kS128, kS128, true>(
+            &LiftoffAssembler::emit_i32x4_gt_s);
+      case wasm::kExprI32x4LtU:
+        return EmitBinOp<kS128, kS128, true>(
+            &LiftoffAssembler::emit_i32x4_gt_u);
+      case wasm::kExprI32x4GtS:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i32x4_gt_s);
+      case wasm::kExprI32x4GtU:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i32x4_gt_u);
+      case wasm::kExprI32x4LeS:
+        return EmitBinOp<kS128, kS128, true>(
+            &LiftoffAssembler::emit_i32x4_ge_s);
+      case wasm::kExprI32x4LeU:
+        return EmitBinOp<kS128, kS128, true>(
+            &LiftoffAssembler::emit_i32x4_ge_u);
+      case wasm::kExprI32x4GeS:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i32x4_ge_s);
+      case wasm::kExprI32x4GeU:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i32x4_ge_u);
+      case wasm::kExprF32x4Eq:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f32x4_eq);
+      case wasm::kExprF32x4Ne:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f32x4_ne);
+      case wasm::kExprF32x4Lt:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f32x4_lt);
+      case wasm::kExprF32x4Gt:
+        return EmitBinOp<kS128, kS128, true>(&LiftoffAssembler::emit_f32x4_lt);
+      case wasm::kExprF32x4Le:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f32x4_le);
+      case wasm::kExprF32x4Ge:
+        return EmitBinOp<kS128, kS128, true>(&LiftoffAssembler::emit_f32x4_le);
+      case wasm::kExprF64x2Eq:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f64x2_eq);
+      case wasm::kExprF64x2Ne:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f64x2_ne);
+      case wasm::kExprF64x2Lt:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f64x2_lt);
+      case wasm::kExprF64x2Gt:
+        return EmitBinOp<kS128, kS128, true>(&LiftoffAssembler::emit_f64x2_lt);
+      case wasm::kExprF64x2Le:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f64x2_le);
+      case wasm::kExprF64x2Ge:
+        return EmitBinOp<kS128, kS128, true>(&LiftoffAssembler::emit_f64x2_le);
+      case wasm::kExprS128Not:
+        return EmitUnOp<kS128, kS128>(&LiftoffAssembler::emit_s128_not);
+      case wasm::kExprS128And:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_s128_and);
+      case wasm::kExprS128Or:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_s128_or);
+      case wasm::kExprS128Xor:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_s128_xor);
+      case wasm::kExprS128Select:
+        return EmitTerOp<kS128, kS128>(&LiftoffAssembler::emit_s128_select);
+      case wasm::kExprI8x16Neg:
+        return EmitUnOp<kS128, kS128>(&LiftoffAssembler::emit_i8x16_neg);
+      case wasm::kExprV8x16AnyTrue:
+        return EmitUnOp<kS128, kI32>(&LiftoffAssembler::emit_v8x16_anytrue);
+      case wasm::kExprV8x16AllTrue:
+        return EmitUnOp<kS128, kI32>(&LiftoffAssembler::emit_v8x16_alltrue);
+      case wasm::kExprI8x16Shl:
+        return EmitSimdShiftOp(&LiftoffAssembler::emit_i8x16_shl,
+                               &LiftoffAssembler::emit_i8x16_shli);
+      case wasm::kExprI8x16ShrS:
+        return EmitSimdShiftOp(&LiftoffAssembler::emit_i8x16_shr_s,
+                               &LiftoffAssembler::emit_i8x16_shri_s);
+      case wasm::kExprI8x16ShrU:
+        return EmitSimdShiftOp(&LiftoffAssembler::emit_i8x16_shr_u,
+                               &LiftoffAssembler::emit_i8x16_shri_u);
       case wasm::kExprI8x16Add:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_i8x16_add(dst, lhs, rhs);
-            });
-        break;
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i8x16_add);
+      case wasm::kExprI8x16AddSaturateS:
+        return EmitBinOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i8x16_add_saturate_s);
+      case wasm::kExprI8x16AddSaturateU:
+        return EmitBinOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i8x16_add_saturate_u);
       case wasm::kExprI8x16Sub:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_i8x16_sub(dst, lhs, rhs);
-            });
-        break;
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i8x16_sub);
+      case wasm::kExprI8x16SubSaturateS:
+        return EmitBinOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i8x16_sub_saturate_s);
+      case wasm::kExprI8x16SubSaturateU:
+        return EmitBinOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i8x16_sub_saturate_u);
       case wasm::kExprI8x16Mul:
-        EmitBinOp<ValueType::kS128, ValueType::kS128>(
-            [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) {
-              __ emit_i8x16_mul(dst, lhs, rhs);
-            });
-        break;
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i8x16_mul);
+      case wasm::kExprI8x16MinS:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i8x16_min_s);
+      case wasm::kExprI8x16MinU:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i8x16_min_u);
+      case wasm::kExprI8x16MaxS:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i8x16_max_s);
+      case wasm::kExprI8x16MaxU:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i8x16_max_u);
+      case wasm::kExprI16x8Neg:
+        return EmitUnOp<kS128, kS128>(&LiftoffAssembler::emit_i16x8_neg);
+      case wasm::kExprV16x8AnyTrue:
+        return EmitUnOp<kS128, kI32>(&LiftoffAssembler::emit_v16x8_anytrue);
+      case wasm::kExprV16x8AllTrue:
+        return EmitUnOp<kS128, kI32>(&LiftoffAssembler::emit_v16x8_alltrue);
+      case wasm::kExprI16x8Shl:
+        return EmitSimdShiftOp(&LiftoffAssembler::emit_i16x8_shl,
+                               &LiftoffAssembler::emit_i16x8_shli);
+      case wasm::kExprI16x8ShrS:
+        return EmitSimdShiftOp(&LiftoffAssembler::emit_i16x8_shr_s,
+                               &LiftoffAssembler::emit_i16x8_shri_s);
+      case wasm::kExprI16x8ShrU:
+        return EmitSimdShiftOp(&LiftoffAssembler::emit_i16x8_shr_u,
+                               &LiftoffAssembler::emit_i16x8_shri_u);
+      case wasm::kExprI16x8Add:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i16x8_add);
+      case wasm::kExprI16x8AddSaturateS:
+        return EmitBinOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i16x8_add_saturate_s);
+      case wasm::kExprI16x8AddSaturateU:
+        return EmitBinOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i16x8_add_saturate_u);
+      case wasm::kExprI16x8Sub:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i16x8_sub);
+      case wasm::kExprI16x8SubSaturateS:
+        return EmitBinOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i16x8_sub_saturate_s);
+      case wasm::kExprI16x8SubSaturateU:
+        return EmitBinOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i16x8_sub_saturate_u);
+      case wasm::kExprI16x8Mul:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i16x8_mul);
+      case wasm::kExprI16x8MinS:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i16x8_min_s);
+      case wasm::kExprI16x8MinU:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i16x8_min_u);
+      case wasm::kExprI16x8MaxS:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i16x8_max_s);
+      case wasm::kExprI16x8MaxU:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i16x8_max_u);
+      case wasm::kExprI32x4Neg:
+        return EmitUnOp<kS128, kS128>(&LiftoffAssembler::emit_i32x4_neg);
+      case wasm::kExprV32x4AnyTrue:
+        return EmitUnOp<kS128, kI32>(&LiftoffAssembler::emit_v32x4_anytrue);
+      case wasm::kExprV32x4AllTrue:
+        return EmitUnOp<kS128, kI32>(&LiftoffAssembler::emit_v32x4_alltrue);
+      case wasm::kExprI32x4Shl:
+        return EmitSimdShiftOp(&LiftoffAssembler::emit_i32x4_shl,
+                               &LiftoffAssembler::emit_i32x4_shli);
+      case wasm::kExprI32x4ShrS:
+        return EmitSimdShiftOp(&LiftoffAssembler::emit_i32x4_shr_s,
+                               &LiftoffAssembler::emit_i32x4_shri_s);
+      case wasm::kExprI32x4ShrU:
+        return EmitSimdShiftOp(&LiftoffAssembler::emit_i32x4_shr_u,
+                               &LiftoffAssembler::emit_i32x4_shri_u);
+      case wasm::kExprI32x4Add:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i32x4_add);
+      case wasm::kExprI32x4Sub:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i32x4_sub);
+      case wasm::kExprI32x4Mul:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i32x4_mul);
+      case wasm::kExprI32x4MinS:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i32x4_min_s);
+      case wasm::kExprI32x4MinU:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i32x4_min_u);
+      case wasm::kExprI32x4MaxS:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i32x4_max_s);
+      case wasm::kExprI32x4MaxU:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i32x4_max_u);
+      case wasm::kExprI64x2Neg:
+        return EmitUnOp<kS128, kS128>(&LiftoffAssembler::emit_i64x2_neg);
+      case wasm::kExprI64x2Shl:
+        return EmitSimdShiftOp(&LiftoffAssembler::emit_i64x2_shl,
+                               &LiftoffAssembler::emit_i64x2_shli);
+      case wasm::kExprI64x2ShrS:
+        return EmitSimdShiftOp(&LiftoffAssembler::emit_i64x2_shr_s,
+                               &LiftoffAssembler::emit_i64x2_shri_s);
+      case wasm::kExprI64x2ShrU:
+        return EmitSimdShiftOp(&LiftoffAssembler::emit_i64x2_shr_u,
+                               &LiftoffAssembler::emit_i64x2_shri_u);
+      case wasm::kExprI64x2Add:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i64x2_add);
+      case wasm::kExprI64x2Sub:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i64x2_sub);
+      case wasm::kExprI64x2Mul:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_i64x2_mul);
+      case wasm::kExprF32x4Abs:
+        return EmitUnOp<kS128, kS128>(&LiftoffAssembler::emit_f32x4_abs);
+      case wasm::kExprF32x4Neg:
+        return EmitUnOp<kS128, kS128>(&LiftoffAssembler::emit_f32x4_neg);
+      case wasm::kExprF32x4Sqrt:
+        return EmitUnOp<kS128, kS128>(&LiftoffAssembler::emit_f32x4_sqrt);
+      case wasm::kExprF32x4Add:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f32x4_add);
+      case wasm::kExprF32x4Sub:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f32x4_sub);
+      case wasm::kExprF32x4Mul:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f32x4_mul);
+      case wasm::kExprF32x4Div:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f32x4_div);
+      case wasm::kExprF32x4Min:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f32x4_min);
+      case wasm::kExprF32x4Max:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f32x4_max);
+      case wasm::kExprF64x2Abs:
+        return EmitUnOp<kS128, kS128>(&LiftoffAssembler::emit_f64x2_abs);
+      case wasm::kExprF64x2Neg:
+        return EmitUnOp<kS128, kS128>(&LiftoffAssembler::emit_f64x2_neg);
+      case wasm::kExprF64x2Sqrt:
+        return EmitUnOp<kS128, kS128>(&LiftoffAssembler::emit_f64x2_sqrt);
+      case wasm::kExprF64x2Add:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f64x2_add);
+      case wasm::kExprF64x2Sub:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f64x2_sub);
+      case wasm::kExprF64x2Mul:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f64x2_mul);
+      case wasm::kExprF64x2Div:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f64x2_div);
+      case wasm::kExprF64x2Min:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f64x2_min);
+      case wasm::kExprF64x2Max:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_f64x2_max);
+      case wasm::kExprI32x4SConvertF32x4:
+        return EmitUnOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i32x4_sconvert_f32x4);
+      case wasm::kExprI32x4UConvertF32x4:
+        return EmitUnOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i32x4_uconvert_f32x4);
+      case wasm::kExprF32x4SConvertI32x4:
+        return EmitUnOp<kS128, kS128>(
+            &LiftoffAssembler::emit_f32x4_sconvert_i32x4);
+      case wasm::kExprF32x4UConvertI32x4:
+        return EmitUnOp<kS128, kS128>(
+            &LiftoffAssembler::emit_f32x4_uconvert_i32x4);
+      case wasm::kExprI8x16SConvertI16x8:
+        return EmitBinOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i8x16_sconvert_i16x8);
+      case wasm::kExprI8x16UConvertI16x8:
+        return EmitBinOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i8x16_uconvert_i16x8);
+      case wasm::kExprI16x8SConvertI32x4:
+        return EmitBinOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i16x8_sconvert_i32x4);
+      case wasm::kExprI16x8UConvertI32x4:
+        return EmitBinOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i16x8_uconvert_i32x4);
+      case wasm::kExprI16x8SConvertI8x16Low:
+        return EmitUnOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i16x8_sconvert_i8x16_low);
+      case wasm::kExprI16x8SConvertI8x16High:
+        return EmitUnOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i16x8_sconvert_i8x16_high);
+      case wasm::kExprI16x8UConvertI8x16Low:
+        return EmitUnOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i16x8_uconvert_i8x16_low);
+      case wasm::kExprI16x8UConvertI8x16High:
+        return EmitUnOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i16x8_uconvert_i8x16_high);
+      case wasm::kExprI32x4SConvertI16x8Low:
+        return EmitUnOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i32x4_sconvert_i16x8_low);
+      case wasm::kExprI32x4SConvertI16x8High:
+        return EmitUnOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i32x4_sconvert_i16x8_high);
+      case wasm::kExprI32x4UConvertI16x8Low:
+        return EmitUnOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i32x4_uconvert_i16x8_low);
+      case wasm::kExprI32x4UConvertI16x8High:
+        return EmitUnOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i32x4_uconvert_i16x8_high);
+      case wasm::kExprS128AndNot:
+        return EmitBinOp<kS128, kS128>(&LiftoffAssembler::emit_s128_and_not);
+      case wasm::kExprI8x16RoundingAverageU:
+        return EmitBinOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i8x16_rounding_average_u);
+      case wasm::kExprI16x8RoundingAverageU:
+        return EmitBinOp<kS128, kS128>(
+            &LiftoffAssembler::emit_i16x8_rounding_average_u);
+      case wasm::kExprI8x16Abs:
+        return EmitUnOp<kS128, kS128>(&LiftoffAssembler::emit_i8x16_abs);
+      case wasm::kExprI16x8Abs:
+        return EmitUnOp<kS128, kS128>(&LiftoffAssembler::emit_i16x8_abs);
+      case wasm::kExprI32x4Abs:
+        return EmitUnOp<kS128, kS128>(&LiftoffAssembler::emit_i32x4_abs);
       default:
         unsupported(decoder, kSimd, "simd");
     }
@@ -2451,8 +2812,8 @@ class LiftoffCompiler {
     static constexpr RegClass result_rc = reg_class_for(result_type);
     LiftoffRegister lhs = __ PopToRegister();
     LiftoffRegister dst = src_rc == result_rc
-                              ? __ GetUnusedRegister(result_rc, {lhs})
-                              : __ GetUnusedRegister(result_rc);
+                              ? __ GetUnusedRegister(result_rc, {lhs}, {})
+                              : __ GetUnusedRegister(result_rc, {});
     fn(dst, lhs, imm.lane);
     __ PushRegister(ValueType(result_type), dst);
   }
@@ -2460,9 +2821,9 @@ class LiftoffCompiler {
   template <ValueType::Kind src2_type, typename EmitFn>
   void EmitSimdReplaceLaneOp(EmitFn fn,
                              const SimdLaneImmediate<validate>& imm) {
-    static constexpr RegClass src1_rc = reg_class_for(ValueType::kS128);
+    static constexpr RegClass src1_rc = reg_class_for(kS128);
     static constexpr RegClass src2_rc = reg_class_for(src2_type);
-    static constexpr RegClass result_rc = reg_class_for(ValueType::kS128);
+    static constexpr RegClass result_rc = reg_class_for(kS128);
     // On backends which need fp pair, src1_rc and result_rc end up being
     // kFpRegPair, which is != kFpReg, but we still want to pin src2 when it is
     // kFpReg, since it can overlap with those pairs.
@@ -2478,7 +2839,7 @@ class LiftoffCompiler {
         (src2_rc == result_rc || pin_src2)
             ? __ GetUnusedRegister(result_rc, {src1},
                                    LiftoffRegList::ForRegs(src2))
-            : __ GetUnusedRegister(result_rc, {src1});
+            : __ GetUnusedRegister(result_rc, {src1}, {});
     fn(dst, src1, src2, imm.lane);
     __ PushRegister(kWasmS128, dst);
   }
@@ -2492,36 +2853,36 @@ class LiftoffCompiler {
     switch (opcode) {
 #define CASE_SIMD_EXTRACT_LANE_OP(opcode, type, fn)                           \
   case wasm::kExpr##opcode:                                                   \
-    EmitSimdExtractLaneOp<ValueType::kS128, ValueType::k##type>(              \
+    EmitSimdExtractLaneOp<kS128, k##type>(                                    \
         [=](LiftoffRegister dst, LiftoffRegister lhs, uint8_t imm_lane_idx) { \
           __ emit_##fn(dst, lhs, imm_lane_idx);                               \
         },                                                                    \
         imm);                                                                 \
     break;
-      CASE_SIMD_EXTRACT_LANE_OP(F64x2ExtractLane, F64, f64x2_extract_lane)
-      CASE_SIMD_EXTRACT_LANE_OP(F32x4ExtractLane, F32, f32x4_extract_lane)
-      CASE_SIMD_EXTRACT_LANE_OP(I64x2ExtractLane, I64, i64x2_extract_lane)
-      CASE_SIMD_EXTRACT_LANE_OP(I32x4ExtractLane, I32, i32x4_extract_lane)
-      CASE_SIMD_EXTRACT_LANE_OP(I16x8ExtractLaneU, I32, i16x8_extract_lane_u)
-      CASE_SIMD_EXTRACT_LANE_OP(I16x8ExtractLaneS, I32, i16x8_extract_lane_s)
-      CASE_SIMD_EXTRACT_LANE_OP(I8x16ExtractLaneU, I32, i8x16_extract_lane_u)
       CASE_SIMD_EXTRACT_LANE_OP(I8x16ExtractLaneS, I32, i8x16_extract_lane_s)
+      CASE_SIMD_EXTRACT_LANE_OP(I8x16ExtractLaneU, I32, i8x16_extract_lane_u)
+      CASE_SIMD_EXTRACT_LANE_OP(I16x8ExtractLaneS, I32, i16x8_extract_lane_s)
+      CASE_SIMD_EXTRACT_LANE_OP(I16x8ExtractLaneU, I32, i16x8_extract_lane_u)
+      CASE_SIMD_EXTRACT_LANE_OP(I32x4ExtractLane, I32, i32x4_extract_lane)
+      CASE_SIMD_EXTRACT_LANE_OP(I64x2ExtractLane, I64, i64x2_extract_lane)
+      CASE_SIMD_EXTRACT_LANE_OP(F32x4ExtractLane, F32, f32x4_extract_lane)
+      CASE_SIMD_EXTRACT_LANE_OP(F64x2ExtractLane, F64, f64x2_extract_lane)
 #undef CASE_SIMD_EXTRACT_LANE_OP
 #define CASE_SIMD_REPLACE_LANE_OP(opcode, type, fn)                          \
   case wasm::kExpr##opcode:                                                  \
-    EmitSimdReplaceLaneOp<ValueType::k##type>(                               \
+    EmitSimdReplaceLaneOp<k##type>(                                          \
         [=](LiftoffRegister dst, LiftoffRegister src1, LiftoffRegister src2, \
             uint8_t imm_lane_idx) {                                          \
           __ emit_##fn(dst, src1, src2, imm_lane_idx);                       \
         },                                                                   \
         imm);                                                                \
     break;
-      CASE_SIMD_REPLACE_LANE_OP(F64x2ReplaceLane, F64, f64x2_replace_lane)
-      CASE_SIMD_REPLACE_LANE_OP(F32x4ReplaceLane, F32, f32x4_replace_lane)
-      CASE_SIMD_REPLACE_LANE_OP(I64x2ReplaceLane, I64, i64x2_replace_lane)
-      CASE_SIMD_REPLACE_LANE_OP(I32x4ReplaceLane, I32, i32x4_replace_lane)
-      CASE_SIMD_REPLACE_LANE_OP(I16x8ReplaceLane, I32, i16x8_replace_lane)
       CASE_SIMD_REPLACE_LANE_OP(I8x16ReplaceLane, I32, i8x16_replace_lane)
+      CASE_SIMD_REPLACE_LANE_OP(I16x8ReplaceLane, I32, i16x8_replace_lane)
+      CASE_SIMD_REPLACE_LANE_OP(I32x4ReplaceLane, I32, i32x4_replace_lane)
+      CASE_SIMD_REPLACE_LANE_OP(I64x2ReplaceLane, I64, i64x2_replace_lane)
+      CASE_SIMD_REPLACE_LANE_OP(F32x4ReplaceLane, F32, f32x4_replace_lane)
+      CASE_SIMD_REPLACE_LANE_OP(F64x2ReplaceLane, F64, f64x2_replace_lane)
 #undef CASE_SIMD_REPLACE_LANE_OP
       default:
         unsupported(decoder, kSimd, "simd");
@@ -2601,10 +2962,12 @@ class LiftoffCompiler {
                    const MemoryAccessImmediate<validate>& imm,
                    void (LiftoffAssembler::*emit_fn)(Register, Register,
                                                      uint32_t, LiftoffRegister,
+                                                     LiftoffRegister,
                                                      StoreType)) {
     ValueType result_type = type.value_type();
     LiftoffRegList pinned;
     LiftoffRegister value = pinned.set(__ PopToRegister());
+#ifdef V8_TARGET_ARCH_IA32
     // We have to reuse the value register as the result register so that we
     //  don't run out of registers on ia32. For this we use the value register
     //  as the result register if it has no other uses. Otherwise  we allocate
@@ -2614,7 +2977,12 @@ class LiftoffCompiler {
       result = pinned.set(__ GetUnusedRegister(value.reg_class(), pinned));
       __ Move(result, value, result_type);
       pinned.clear(value);
+      value = result;
     }
+#else
+    LiftoffRegister result =
+        pinned.set(__ GetUnusedRegister(value.reg_class(), pinned));
+#endif
     Register index = pinned.set(__ PopToRegister(pinned)).gp();
     if (BoundsCheckMem(decoder, type.size(), imm.offset, index, pinned,
                        kDoForceCheck)) {
@@ -2627,7 +2995,7 @@ class LiftoffCompiler {
     Register addr = pinned.set(__ GetUnusedRegister(kGpReg, pinned)).gp();
     LOAD_INSTANCE_FIELD(addr, MemoryStart, kSystemPointerSize);
 
-    (asm_.*emit_fn)(addr, index, offset, result, type);
+    (asm_.*emit_fn)(addr, index, offset, value, result, type);
     __ PushRegister(result_type, result);
   }
 
@@ -2688,7 +3056,7 @@ class LiftoffCompiler {
 
     uint32_t offset = imm.offset;
     index_reg = AddMemoryMasking(index_reg, &offset, &pinned);
-    if (offset != 0) __ emit_i32_add(index_reg, index_reg, offset);
+    if (offset != 0) __ emit_i32_addi(index_reg, index_reg, offset);
 
     LiftoffAssembler::VarState timeout =
         __ cache_state()->stack_state.end()[-1];
@@ -2758,7 +3126,7 @@ class LiftoffCompiler {
 
     uint32_t offset = imm.offset;
     index = AddMemoryMasking(index, &offset, &pinned);
-    if (offset) __ emit_i32_add(index, index, offset);
+    if (offset) __ emit_i32_addi(index, index, offset);
 
     // TODO(ahaas): Use PrepareCall to prepare parameters.
     __ SpillAllRegisters();
@@ -3137,6 +3505,52 @@ class LiftoffCompiler {
     unsupported(decoder, kAnyRef, "table.fill");
   }
 
+  void StructNew(FullDecoder* decoder,
+                 const StructIndexImmediate<validate>& imm, const Value args[],
+                 Value* result) {
+    // TODO(7748): Implement.
+    unsupported(decoder, kGC, "struct.new");
+  }
+  void StructGet(FullDecoder* decoder, const Value& struct_obj,
+                 const FieldIndexImmediate<validate>& field, Value* result) {
+    // TODO(7748): Implement.
+    unsupported(decoder, kGC, "struct.get");
+  }
+  void StructSet(FullDecoder* decoder, const Value& struct_obj,
+                 const FieldIndexImmediate<validate>& field,
+                 const Value& field_value) {
+    // TODO(7748): Implement.
+    unsupported(decoder, kGC, "struct.set");
+  }
+
+  void ArrayNew(FullDecoder* decoder, const ArrayIndexImmediate<validate>& imm,
+                const Value& length, const Value& initial_value,
+                Value* result) {
+    // TODO(7748): Implement.
+    unsupported(decoder, kGC, "array.new");
+  }
+  void ArrayGet(FullDecoder* decoder, const Value& array_obj,
+                const ArrayIndexImmediate<validate>& imm, const Value& index,
+                Value* result) {
+    // TODO(7748): Implement.
+    unsupported(decoder, kGC, "array.get");
+  }
+  void ArraySet(FullDecoder* decoder, const Value& array_obj,
+                const ArrayIndexImmediate<validate>& imm, const Value& index,
+                const Value& value) {
+    // TODO(7748): Implement.
+    unsupported(decoder, kGC, "array.set");
+  }
+  void ArrayLen(FullDecoder* decoder, const Value& array_obj, Value* result) {
+    // TODO(7748): Implement.
+    unsupported(decoder, kGC, "array.len");
+  }
+
+  void PassThrough(FullDecoder* decoder, const Value& from, Value* to) {
+    // TODO(7748): Implement.
+    unsupported(decoder, kGC, "");
+  }
+
  private:
   // Emit additional source positions for return addresses. Used by debugging to
   // OSR frames with different sets of breakpoints.
@@ -3164,7 +3578,7 @@ class LiftoffCompiler {
       //   0    foo
       //   1    nop  // top frame return address
       //        bar
-      // {WasmCompiledFrame::position} would then return "0" as the source
+      // {WasmFrame::position} would then return "0" as the source
       // position of the top frame instead of "1".  This is fixed by explicitly
       // emitting the missing position before the return address, with a nop so
       // that code offsets do not collide.
@@ -3191,6 +3605,7 @@ class LiftoffCompiler {
   compiler::CallDescriptor* const descriptor_;
   CompilationEnv* const env_;
   DebugSideTableBuilder* const debug_sidetable_builder_;
+  const ForDebugging for_debugging_;
   LiftoffBailoutReason bailout_reason_ = kSuccess;
   std::vector<OutOfLineCode> out_of_line_code_;
   SourcePositionTableBuilder source_position_table_builder_;
@@ -3239,8 +3654,8 @@ class LiftoffCompiler {
 
 WasmCompilationResult ExecuteLiftoffCompilation(
     AccountingAllocator* allocator, CompilationEnv* env,
-    const FunctionBody& func_body, int func_index, Counters* counters,
-    WasmFeatures* detected, Vector<int> breakpoints,
+    const FunctionBody& func_body, int func_index, ForDebugging for_debugging,
+    Counters* counters, WasmFeatures* detected, Vector<int> breakpoints,
     std::unique_ptr<DebugSideTable>* debug_sidetable,
     Vector<int> extra_source_pos) {
   int func_body_size = static_cast<int>(func_body.end - func_body.start);
@@ -3269,7 +3684,8 @@ WasmCompilationResult ExecuteLiftoffCompilation(
   WasmFullDecoder<Decoder::kValidate, LiftoffCompiler> decoder(
       &zone, env->module, env->enabled_features, detected, func_body,
       call_descriptor, env, &zone, instruction_buffer->CreateView(),
-      debug_sidetable_builder.get(), breakpoints, extra_source_pos);
+      debug_sidetable_builder.get(), for_debugging, breakpoints,
+      extra_source_pos);
   decoder.Decode();
   liftoff_compile_time_scope.reset();
   LiftoffCompiler* compiler = &decoder.interface();
@@ -3303,6 +3719,7 @@ WasmCompilationResult ExecuteLiftoffCompilation(
   result.tagged_parameter_slots = call_descriptor->GetTaggedParameterSlots();
   result.func_index = func_index;
   result.result_tier = ExecutionTier::kLiftoff;
+  result.for_debugging = for_debugging;
   if (debug_sidetable) {
     *debug_sidetable = debug_sidetable_builder->GenerateDebugSideTable();
   }
@@ -3322,7 +3739,7 @@ std::unique_ptr<DebugSideTable> GenerateLiftoffDebugSideTable(
       &zone, env->module, env->enabled_features, &detected, func_body,
       call_descriptor, env, &zone,
       NewAssemblerBuffer(AssemblerBase::kDefaultBufferSize),
-      &debug_sidetable_builder);
+      &debug_sidetable_builder, kForDebugging);
   decoder.Decode();
   DCHECK(decoder.ok());
   DCHECK(!decoder.interface().did_bailout());
diff --git a/deps/v8/src/wasm/baseline/liftoff-compiler.h b/deps/v8/src/wasm/baseline/liftoff-compiler.h
index 863fa7ee073..434172c4cf1 100644
--- a/deps/v8/src/wasm/baseline/liftoff-compiler.h
+++ b/deps/v8/src/wasm/baseline/liftoff-compiler.h
@@ -45,6 +45,7 @@ enum LiftoffBailoutReason : int8_t {
   kAtomics = 10,
   kBulkMemory = 11,
   kNonTrappingFloatToInt = 12,
+  kGC = 13,
   // A little gap, for forward compatibility.
   // Any other reason (use rarely; introduce new reasons if this spikes).
   kOtherReason = 20,
@@ -54,8 +55,8 @@ enum LiftoffBailoutReason : int8_t {
 
 V8_EXPORT_PRIVATE WasmCompilationResult ExecuteLiftoffCompilation(
     AccountingAllocator*, CompilationEnv*, const FunctionBody&, int func_index,
-    Counters*, WasmFeatures* detected_features, Vector<int> breakpoints = {},
-    std::unique_ptr<DebugSideTable>* = nullptr,
+    ForDebugging, Counters*, WasmFeatures* detected_features,
+    Vector<int> breakpoints = {}, std::unique_ptr<DebugSideTable>* = nullptr,
     Vector<int> extra_source_pos = {});
 
 V8_EXPORT_PRIVATE std::unique_ptr<DebugSideTable> GenerateLiftoffDebugSideTable(
diff --git a/deps/v8/src/wasm/baseline/liftoff-register.h b/deps/v8/src/wasm/baseline/liftoff-register.h
index 16ad652adef..92fecda7fab 100644
--- a/deps/v8/src/wasm/baseline/liftoff-register.h
+++ b/deps/v8/src/wasm/baseline/liftoff-register.h
@@ -183,6 +183,26 @@ class LiftoffRegister {
     }
   }
 
+  // Shifts the register code depending on the type before converting to a
+  // LiftoffRegister.
+  static LiftoffRegister from_external_code(RegClass rc, ValueType type,
+                                            int code) {
+    if (!kSimpleFPAliasing && type == kWasmF32) {
+      // Liftoff assumes a one-to-one mapping between float registers and
+      // double registers, and so does not distinguish between f32 and f64
+      // registers. The f32 register code must therefore be halved in order
+      // to pass the f64 code to Liftoff.
+      DCHECK_EQ(0, code % 2);
+      return LiftoffRegister::from_code(rc, code >> 1);
+    }
+    if (kNeedS128RegPair && type == kWasmS128) {
+      // Similarly for double registers and SIMD registers, the SIMD code
+      // needs to be doubled to pass the f64 code to Liftoff.
+      return LiftoffRegister::ForFpPair(DoubleRegister::from_code(code << 1));
+    }
+    return LiftoffRegister::from_code(rc, code);
+  }
+
   static LiftoffRegister ForPair(Register low, Register high) {
     DCHECK(kNeedI64RegPair);
     DCHECK_NE(low, high);
diff --git a/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h b/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h
index 8461e0435fd..6412c0f1a0c 100644
--- a/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h
+++ b/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h
@@ -25,7 +25,7 @@ namespace liftoff {
 //   1   | return addr (ra)   |
 //   0   | previous frame (fp)|
 //  -----+--------------------+  <-- frame ptr (fp)
-//  -1   | 0xa: WASM_COMPILED |
+//  -1   | 0xa: WASM          |
 //  -2   |     instance       |
 //  -----+--------------------+---------------------------
 //  -3   |    slot 0 (high)   |   ^
@@ -46,12 +46,14 @@ constexpr int32_t kHighWordOffset = 4;
 // fp-4 holds the stack marker, fp-8 is the instance parameter.
 constexpr int kInstanceOffset = 8;
 
-inline MemOperand GetStackSlot(int offset) { return MemOperand(fp, -offset); }
+inline MemOperand GetStackSlot(int offset) {
+  return MemOperand(offset > 0 ? fp : sp, -offset);
+}
 
 inline MemOperand GetHalfStackSlot(int offset, RegPairHalf half) {
   int32_t half_offset =
       half == kLowWord ? 0 : LiftoffAssembler::kStackSlotSize / 2;
-  return MemOperand(fp, -offset + half_offset);
+  return MemOperand(offset > 0 ? fp : sp, -offset + half_offset);
 }
 
 inline MemOperand GetInstanceOperand() { return GetStackSlot(kInstanceOffset); }
@@ -540,37 +542,38 @@ void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
 
 void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicAdd");
 }
 
 void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicSub");
 }
 
 void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicAnd");
 }
 
 void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
                                 uint32_t offset_imm, LiftoffRegister value,
-                                StoreType type) {
+                                LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicOr");
 }
 
 void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicXor");
 }
 
 void LiftoffAssembler::AtomicExchange(Register dst_addr, Register offset_reg,
                                       uint32_t offset_imm,
-                                      LiftoffRegister value, StoreType type) {
+                                      LiftoffRegister value,
+                                      LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicExchange");
 }
 
@@ -590,10 +593,17 @@ void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
   liftoff::Load(this, dst, fp, offset, type);
 }
 
+void LiftoffAssembler::StoreCallerFrameSlot(LiftoffRegister src,
+                                            uint32_t caller_slot_idx,
+                                            ValueType type) {
+  int32_t offset = kSystemPointerSize * (caller_slot_idx + 1);
+  liftoff::Store(this, fp, offset, src, type);
+}
+
 void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
   DCHECK_NE(dst_offset, src_offset);
-  LiftoffRegister reg = GetUnusedRegister(reg_class_for(type));
+  LiftoffRegister reg = GetUnusedRegister(reg_class_for(type), {});
   Fill(reg, src_offset, type);
   Spill(dst_offset, reg, type);
 }
@@ -636,13 +646,13 @@ void LiftoffAssembler::Spill(int offset, WasmValue value) {
   MemOperand dst = liftoff::GetStackSlot(offset);
   switch (value.type().kind()) {
     case ValueType::kI32: {
-      LiftoffRegister tmp = GetUnusedRegister(kGpReg);
+      LiftoffRegister tmp = GetUnusedRegister(kGpReg, {});
       TurboAssembler::li(tmp.gp(), Operand(value.to_i32()));
       sw(tmp.gp(), dst);
       break;
     }
     case ValueType::kI64: {
-      LiftoffRegister tmp = GetUnusedRegister(kGpRegPair);
+      LiftoffRegister tmp = GetUnusedRegister(kGpRegPair, {});
 
       int32_t low_word = value.to_i64();
       int32_t high_word = value.to_i64() >> 32;
@@ -768,10 +778,10 @@ I32_BINOP(xor, xor_)
 
 #undef I32_BINOP
 
-#define I32_BINOP_I(name, instruction)                               \
-  void LiftoffAssembler::emit_i32_##name(Register dst, Register lhs, \
-                                         int32_t imm) {              \
-    instruction(dst, lhs, Operand(imm));                             \
+#define I32_BINOP_I(name, instruction)                                  \
+  void LiftoffAssembler::emit_i32_##name##i(Register dst, Register lhs, \
+                                            int32_t imm) {              \
+    instruction(dst, lhs, Operand(imm));                                \
   }
 
 // clang-format off
@@ -801,12 +811,12 @@ bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
                                          Register amount) {          \
     instruction(dst, src, amount);                                   \
   }
-#define I32_SHIFTOP_I(name, instruction)                             \
-  I32_SHIFTOP(name, instruction##v)                                  \
-  void LiftoffAssembler::emit_i32_##name(Register dst, Register src, \
-                                         int amount) {               \
-    DCHECK(is_uint5(amount));                                        \
-    instruction(dst, src, amount);                                   \
+#define I32_SHIFTOP_I(name, instruction)                                \
+  I32_SHIFTOP(name, instruction##v)                                     \
+  void LiftoffAssembler::emit_i32_##name##i(Register dst, Register src, \
+                                            int amount) {               \
+    DCHECK(is_uint5(amount));                                           \
+    instruction(dst, src, amount);                                      \
   }
 
 I32_SHIFTOP_I(shl, sll)
@@ -816,8 +826,8 @@ I32_SHIFTOP_I(shr, srl)
 #undef I32_SHIFTOP
 #undef I32_SHIFTOP_I
 
-void LiftoffAssembler::emit_i64_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                    int32_t imm) {
+void LiftoffAssembler::emit_i64_addi(LiftoffRegister dst, LiftoffRegister lhs,
+                                     int32_t imm) {
   TurboAssembler::AddPair(dst.low_gp(), dst.high_gp(), lhs.low_gp(),
                           lhs.high_gp(), imm,
                           kScratchReg, kScratchReg2);
@@ -922,8 +932,8 @@ void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
                                    &TurboAssembler::ShlPair);
 }
 
-void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i64_shli(LiftoffRegister dst, LiftoffRegister src,
+                                     int32_t amount) {
   UseScratchRegisterScope temps(this);
   // {src.low_gp()} will still be needed after writing {dst.high_gp()} and
   // {dst.low_gp()}.
@@ -946,8 +956,8 @@ void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
                                    &TurboAssembler::SarPair);
 }
 
-void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i64_sari(LiftoffRegister dst, LiftoffRegister src,
+                                     int32_t amount) {
   UseScratchRegisterScope temps(this);
   // {src.high_gp()} will still be needed after writing {dst.high_gp()} and
   // {dst.low_gp()}.
@@ -965,8 +975,8 @@ void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
                                    &TurboAssembler::ShrPair);
 }
 
-void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i64_shri(LiftoffRegister dst, LiftoffRegister src,
+                                     int32_t amount) {
   UseScratchRegisterScope temps(this);
   // {src.high_gp()} will still be needed after writing {dst.high_gp()} and
   // {dst.low_gp()}.
@@ -1259,6 +1269,30 @@ bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
       bailout(kUnsupportedArchitecture, "kExprI32UConvertF64");
       return true;
     }
+    case kExprI32SConvertSatF32:
+      bailout(kNonTrappingFloatToInt, "kExprI32SConvertSatF32");
+      return true;
+    case kExprI32UConvertSatF32:
+      bailout(kNonTrappingFloatToInt, "kExprI32UConvertSatF32");
+      return true;
+    case kExprI32SConvertSatF64:
+      bailout(kNonTrappingFloatToInt, "kExprI32SConvertSatF64");
+      return true;
+    case kExprI32UConvertSatF64:
+      bailout(kNonTrappingFloatToInt, "kExprI32UConvertSatF64");
+      return true;
+    case kExprI64SConvertSatF32:
+      bailout(kNonTrappingFloatToInt, "kExprI64SConvertSatF32");
+      return true;
+    case kExprI64UConvertSatF32:
+      bailout(kNonTrappingFloatToInt, "kExprI64UConvertSatF32");
+      return true;
+    case kExprI64SConvertSatF64:
+      bailout(kNonTrappingFloatToInt, "kExprI64SConvertSatF64");
+      return true;
+    case kExprI64UConvertSatF64:
+      bailout(kNonTrappingFloatToInt, "kExprI64UConvertSatF64");
+      return true;
     case kExprI32ReinterpretF32:
       mfc1(dst.gp(), src.fp());
       return true;
@@ -1532,328 +1566,844 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   bind(&cont);
 }
 
+void LiftoffAssembler::LoadTransform(LiftoffRegister dst, Register src_addr,
+                                     Register offset_reg, uint32_t offset_imm,
+                                     LoadType type,
+                                     LoadTransformationKind transform,
+                                     uint32_t* protected_load_pc) {
+  bailout(kSimd, "load extend and load splat unimplemented");
+}
+
+void LiftoffAssembler::emit_s8x16_swizzle(LiftoffRegister dst,
+                                          LiftoffRegister lhs,
+                                          LiftoffRegister rhs) {
+  bailout(kSimd, "emit_s8x16_swizzle");
+}
+
+void LiftoffAssembler::emit_i8x16_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  bailout(kSimd, "emit_i8x16_splat");
+}
+
+void LiftoffAssembler::emit_i16x8_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  bailout(kSimd, "emit_i16x8_splat");
+}
+
+void LiftoffAssembler::emit_i32x4_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  bailout(kSimd, "emit_i32x4_splat");
+}
+
+void LiftoffAssembler::emit_i64x2_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  bailout(kSimd, "emit_i64x2_splat");
+}
+
+void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  bailout(kSimd, "emit_f32x4_splat");
+}
+
 void LiftoffAssembler::emit_f64x2_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
   bailout(kSimd, "emit_f64x2_splat");
 }
 
-void LiftoffAssembler::emit_f64x2_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f64x2_extract_lane");
+void LiftoffAssembler::emit_i8x16_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_eq");
 }
 
-void LiftoffAssembler::emit_f64x2_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f64x2_replace_lane");
+void LiftoffAssembler::emit_i8x16_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_ne");
 }
 
-void LiftoffAssembler::emit_f64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_i8x16_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_gt_s");
+}
+
+void LiftoffAssembler::emit_i8x16_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_gt_u");
+}
+
+void LiftoffAssembler::emit_i8x16_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_ge_s");
+}
+
+void LiftoffAssembler::emit_i8x16_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_ge_u");
+}
+
+void LiftoffAssembler::emit_i16x8_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_eq");
+}
+
+void LiftoffAssembler::emit_i16x8_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_ne");
+}
+
+void LiftoffAssembler::emit_i16x8_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_gt_s");
+}
+
+void LiftoffAssembler::emit_i16x8_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_gt_u");
+}
+
+void LiftoffAssembler::emit_i16x8_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_ge_s");
+}
+
+void LiftoffAssembler::emit_i16x8_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_ge_u");
+}
+
+void LiftoffAssembler::emit_i32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_eq");
+}
+
+void LiftoffAssembler::emit_i32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_ne");
+}
+
+void LiftoffAssembler::emit_i32x4_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_gt_s");
+}
+
+void LiftoffAssembler::emit_i32x4_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_gt_u");
+}
+
+void LiftoffAssembler::emit_i32x4_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_ge_s");
+}
+
+void LiftoffAssembler::emit_i32x4_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_ge_u");
+}
+
+void LiftoffAssembler::emit_f32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_f32x4_eq");
+}
+
+void LiftoffAssembler::emit_f32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_f32x4_ne");
+}
+
+void LiftoffAssembler::emit_f32x4_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_f32x4_lt");
+}
+
+void LiftoffAssembler::emit_f32x4_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_f32x4_le");
+}
+
+void LiftoffAssembler::emit_f64x2_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_f64x2_eq");
+}
+
+void LiftoffAssembler::emit_f64x2_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_f64x2_ne");
+}
+
+void LiftoffAssembler::emit_f64x2_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_f64x2_lt");
+}
+
+void LiftoffAssembler::emit_f64x2_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_f64x2_le");
+}
+
+void LiftoffAssembler::emit_s128_not(LiftoffRegister dst, LiftoffRegister src) {
+  bailout(kSimd, "emit_s128_not");
+}
+
+void LiftoffAssembler::emit_s128_and(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_s128_and");
+}
+
+void LiftoffAssembler::emit_s128_or(LiftoffRegister dst, LiftoffRegister lhs,
+                                    LiftoffRegister rhs) {
+  bailout(kSimd, "emit_s128_or");
+}
+
+void LiftoffAssembler::emit_s128_xor(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_s128_xor");
+}
+
+void LiftoffAssembler::emit_s128_and_not(LiftoffRegister dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  bailout(kSimd, "emit_s128_and_not");
+}
+
+void LiftoffAssembler::emit_s128_select(LiftoffRegister dst,
+                                        LiftoffRegister src1,
+                                        LiftoffRegister src2,
+                                        LiftoffRegister mask) {
+  bailout(kSimd, "emit_s128_select");
+}
+
+void LiftoffAssembler::emit_i8x16_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kSimd, "emit_i8x16_neg");
+}
+
+void LiftoffAssembler::emit_v8x16_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "emit_v8x16_anytrue");
+}
+
+void LiftoffAssembler::emit_i8x16_shl(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f64x2_add");
+  bailout(kSimd, "emit_i8x16_shl");
 }
 
-void LiftoffAssembler::emit_f64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_i8x16_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  bailout(kSimd, "emit_i8x16_shli");
+}
+
+void LiftoffAssembler::emit_i8x16_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_shr_s");
+}
+
+void LiftoffAssembler::emit_i8x16_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "emit_i8x16_shri_s");
+}
+
+void LiftoffAssembler::emit_i8x16_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_shr_u");
+}
+
+void LiftoffAssembler::emit_i8x16_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "emit_i8x16_shri_u");
+}
+
+void LiftoffAssembler::emit_i8x16_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f64x2_sub");
+  bailout(kSimd, "emit_i8x16_add");
 }
 
-void LiftoffAssembler::emit_f64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_i8x16_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_add_saturate_s");
+}
+
+void LiftoffAssembler::emit_i8x16_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_add_saturate_u");
+}
+
+void LiftoffAssembler::emit_i8x16_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f64x2_mul");
+  bailout(kSimd, "emit_i8x16_sub");
 }
 
-void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f32x4_splat");
+void LiftoffAssembler::emit_i8x16_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_sub_saturate_s");
 }
 
-void LiftoffAssembler::emit_f32x4_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f32x4_extract_lane");
+void LiftoffAssembler::emit_i8x16_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_sub_saturate_u");
 }
 
-void LiftoffAssembler::emit_f32x4_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f32x4_replace_lane");
+void LiftoffAssembler::emit_i8x16_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_mul");
 }
 
-void LiftoffAssembler::emit_f32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_i8x16_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_min_s");
+}
+
+void LiftoffAssembler::emit_i8x16_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_min_u");
+}
+
+void LiftoffAssembler::emit_i8x16_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_max_s");
+}
+
+void LiftoffAssembler::emit_i8x16_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_max_u");
+}
+
+void LiftoffAssembler::emit_i16x8_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kSimd, "emit_i16x8_neg");
+}
+
+void LiftoffAssembler::emit_v16x8_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "emit_v16x8_anytrue");
+}
+
+void LiftoffAssembler::emit_i16x8_shl(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f32x4_add");
+  bailout(kSimd, "emit_i16x8_shl");
 }
 
-void LiftoffAssembler::emit_f32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_i16x8_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  bailout(kSimd, "emit_i16x8_shli");
+}
+
+void LiftoffAssembler::emit_i16x8_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_shr_s");
+}
+
+void LiftoffAssembler::emit_i16x8_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "emit_i16x8_shri_s");
+}
+
+void LiftoffAssembler::emit_i16x8_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_shr_u");
+}
+
+void LiftoffAssembler::emit_i16x8_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "emit_i16x8_shri_u");
+}
+
+void LiftoffAssembler::emit_i16x8_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f32x4_sub");
+  bailout(kSimd, "emit_i16x8_add");
 }
 
-void LiftoffAssembler::emit_f32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_i16x8_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_add_saturate_s");
+}
+
+void LiftoffAssembler::emit_i16x8_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_add_saturate_u");
+}
+
+void LiftoffAssembler::emit_i16x8_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f32x4_mul");
+  bailout(kSimd, "emit_i16x8_sub");
 }
 
-void LiftoffAssembler::emit_i64x2_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i64x2_splat");
+void LiftoffAssembler::emit_i16x8_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_sub_saturate_s");
 }
 
-void LiftoffAssembler::emit_i64x2_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i64x2_extract_lane");
+void LiftoffAssembler::emit_i16x8_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_sub_saturate_u");
 }
 
-void LiftoffAssembler::emit_i64x2_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i64x2_replace_lane");
+void LiftoffAssembler::emit_i16x8_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_mul");
+}
+
+void LiftoffAssembler::emit_i16x8_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_min_s");
+}
+
+void LiftoffAssembler::emit_i16x8_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_min_u");
+}
+
+void LiftoffAssembler::emit_i16x8_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_max_s");
+}
+
+void LiftoffAssembler::emit_i16x8_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_max_u");
+}
+
+void LiftoffAssembler::emit_i32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kSimd, "emit_i32x4_neg");
+}
+
+void LiftoffAssembler::emit_v32x4_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "emit_v32x4_anytrue");
+}
+
+void LiftoffAssembler::emit_i32x4_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_shl");
+}
+
+void LiftoffAssembler::emit_i32x4_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  bailout(kSimd, "emit_i32x4_shli");
+}
+
+void LiftoffAssembler::emit_i32x4_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_shr_s");
+}
+
+void LiftoffAssembler::emit_i32x4_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "emit_i32x4_shri_s");
+}
+
+void LiftoffAssembler::emit_i32x4_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_shr_u");
+}
+
+void LiftoffAssembler::emit_i32x4_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "emit_i32x4_shri_u");
+}
+
+void LiftoffAssembler::emit_i32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_add");
+}
+
+void LiftoffAssembler::emit_i32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_sub");
+}
+
+void LiftoffAssembler::emit_i32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_mul");
+}
+
+void LiftoffAssembler::emit_i32x4_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_min_s");
+}
+
+void LiftoffAssembler::emit_i32x4_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_min_u");
+}
+
+void LiftoffAssembler::emit_i32x4_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_max_s");
+}
+
+void LiftoffAssembler::emit_i32x4_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i32x4_max_u");
+}
+
+void LiftoffAssembler::emit_i64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kSimd, "emit_i64x2_neg");
+}
+
+void LiftoffAssembler::emit_i64x2_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i64x2_shl");
+}
+
+void LiftoffAssembler::emit_i64x2_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  bailout(kSimd, "emit_i64x2_shli");
+}
+
+void LiftoffAssembler::emit_i64x2_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i64x2_shr_s");
+}
+
+void LiftoffAssembler::emit_i64x2_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "emit_i64x2_shri_s");
+}
+
+void LiftoffAssembler::emit_i64x2_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i64x2_shr_u");
+}
+
+void LiftoffAssembler::emit_i64x2_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "emit_i64x2_shri_u");
 }
 
 void LiftoffAssembler::emit_i64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
   bailout(kSimd, "emit_i64x2_add");
 }
 
 void LiftoffAssembler::emit_i64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
   bailout(kSimd, "emit_i64x2_sub");
 }
 
 void LiftoffAssembler::emit_i64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
   bailout(kSimd, "emit_i64x2_mul");
 }
 
-void LiftoffAssembler::emit_i32x4_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i32x4_splat");
+void LiftoffAssembler::emit_f32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kSimd, "emit_f32x4_abs");
 }
 
-void LiftoffAssembler::emit_i32x4_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i32x4_extract_lane");
+void LiftoffAssembler::emit_f32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kSimd, "emit_f32x4_neg");
 }
 
-void LiftoffAssembler::emit_i32x4_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i32x4_replace_lane");
+void LiftoffAssembler::emit_f32x4_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  bailout(kSimd, "emit_f32x4_sqrt");
 }
 
-void LiftoffAssembler::emit_i32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_f32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i32x4_add");
+  bailout(kSimd, "emit_f32x4_add");
 }
 
-void LiftoffAssembler::emit_i32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_f32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i32x4_sub");
+  bailout(kSimd, "emit_f32x4_sub");
 }
 
-void LiftoffAssembler::emit_i32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_f32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i32x4_mul");
+  bailout(kSimd, "emit_f32x4_mul");
 }
 
-void LiftoffAssembler::emit_i16x8_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i16x8_splat");
+void LiftoffAssembler::emit_f32x4_div(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "emit_f32x4_div");
 }
 
-void LiftoffAssembler::emit_i16x8_extract_lane_u(LiftoffRegister dst,
-                                                 LiftoffRegister lhs,
-                                                 uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i16x8_extract_lane_u");
+void LiftoffAssembler::emit_f32x4_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "emit_f32x4_min");
 }
 
-void LiftoffAssembler::emit_i16x8_extract_lane_s(LiftoffRegister dst,
-                                                 LiftoffRegister lhs,
-                                                 uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i16x8_extract_lane_s");
+void LiftoffAssembler::emit_f32x4_max(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "emit_f32x4_max");
 }
 
-void LiftoffAssembler::emit_i16x8_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i16x8_replace_lane");
+void LiftoffAssembler::emit_f64x2_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kSimd, "emit_f64x2_abs");
 }
 
-void LiftoffAssembler::emit_i16x8_add(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_f64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kSimd, "emit_f64x2_neg");
+}
+
+void LiftoffAssembler::emit_f64x2_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  bailout(kSimd, "emit_f64x2_sqrt");
+}
+
+void LiftoffAssembler::emit_f64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i16x8_add");
+  bailout(kSimd, "emit_f64x2_add");
 }
 
-void LiftoffAssembler::emit_i16x8_sub(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_f64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i16x8_sub");
+  bailout(kSimd, "emit_f64x2_sub");
 }
 
-void LiftoffAssembler::emit_i16x8_mul(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_f64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i16x8_mul");
+  bailout(kSimd, "emit_f64x2_mul");
 }
 
-void LiftoffAssembler::emit_i8x16_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i8x16_splat");
+void LiftoffAssembler::emit_f64x2_div(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "emit_f64x2_div");
+}
+
+void LiftoffAssembler::emit_f64x2_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "emit_f64x2_min");
+}
+
+void LiftoffAssembler::emit_f64x2_max(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "emit_f64x2_max");
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  bailout(kSimd, "emit_i32x4_sconvert_f32x4");
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  bailout(kSimd, "emit_i32x4_uconvert_f32x4");
+}
+
+void LiftoffAssembler::emit_f32x4_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  bailout(kSimd, "emit_f32x4_sconvert_i32x4");
+}
+
+void LiftoffAssembler::emit_f32x4_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  bailout(kSimd, "emit_f32x4_uconvert_i32x4");
+}
+
+void LiftoffAssembler::emit_i8x16_sconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_sconvert_i16x8");
+}
+
+void LiftoffAssembler::emit_i8x16_uconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_uconvert_i16x8");
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_sconvert_i32x4");
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_uconvert_i32x4");
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  bailout(kSimd, "emit_i16x8_sconvert_i8x16_low");
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  bailout(kSimd, "emit_i16x8_sconvert_i8x16_high");
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  bailout(kSimd, "emit_i16x8_uconvert_i8x16_low");
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  bailout(kSimd, "emit_i16x8_uconvert_i8x16_high");
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  bailout(kSimd, "emit_i32x4_sconvert_i16x8_low");
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  bailout(kSimd, "emit_i32x4_sconvert_i16x8_high");
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  bailout(kSimd, "emit_i32x4_uconvert_i16x8_low");
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  bailout(kSimd, "emit_i32x4_uconvert_i16x8_high");
+}
+
+void LiftoffAssembler::emit_i8x16_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i8x16_rounding_average_u");
+}
+
+void LiftoffAssembler::emit_i16x8_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  bailout(kSimd, "emit_i16x8_rounding_average_u");
+}
+
+void LiftoffAssembler::emit_i8x16_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kSimd, "emit_i8x16_abs");
+}
+
+void LiftoffAssembler::emit_i16x8_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kSimd, "emit_i16x8_abs");
+}
+
+void LiftoffAssembler::emit_i32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kSimd, "emit_i32x4_abs");
+}
+
+void LiftoffAssembler::emit_i8x16_extract_lane_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 uint8_t imm_lane_idx) {
+  bailout(kSimd, "emit_i8x16_extract_lane_s");
 }
 
 void LiftoffAssembler::emit_i8x16_extract_lane_u(LiftoffRegister dst,
                                                  LiftoffRegister lhs,
                                                  uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
   bailout(kSimd, "emit_i8x16_extract_lane_u");
 }
 
-void LiftoffAssembler::emit_i8x16_extract_lane_s(LiftoffRegister dst,
+void LiftoffAssembler::emit_i16x8_extract_lane_s(LiftoffRegister dst,
                                                  LiftoffRegister lhs,
                                                  uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i8x16_extract_lane_s");
+  bailout(kSimd, "emit_i16x8_extract_lane_s");
+}
+
+void LiftoffAssembler::emit_i16x8_extract_lane_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 uint8_t imm_lane_idx) {
+  bailout(kSimd, "emit_i16x8_extract_lane_u");
+}
+
+void LiftoffAssembler::emit_i32x4_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  bailout(kSimd, "emit_i32x4_extract_lane");
+}
+
+void LiftoffAssembler::emit_i64x2_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  bailout(kSimd, "emit_i64x2_extract_lane");
+}
+
+void LiftoffAssembler::emit_f32x4_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  bailout(kSimd, "emit_f32x4_extract_lane");
+}
+
+void LiftoffAssembler::emit_f64x2_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  bailout(kSimd, "emit_f64x2_extract_lane");
 }
 
 void LiftoffAssembler::emit_i8x16_replace_lane(LiftoffRegister dst,
                                                LiftoffRegister src1,
                                                LiftoffRegister src2,
                                                uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
   bailout(kSimd, "emit_i8x16_replace_lane");
 }
 
-void LiftoffAssembler::emit_i8x16_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i8x16_add");
+void LiftoffAssembler::emit_i16x8_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  bailout(kSimd, "emit_i16x8_replace_lane");
 }
 
-void LiftoffAssembler::emit_i8x16_sub(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i8x16_sub");
+void LiftoffAssembler::emit_i32x4_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  bailout(kSimd, "emit_i32x4_replace_lane");
 }
 
-void LiftoffAssembler::emit_i8x16_mul(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i8x16_mul");
+void LiftoffAssembler::emit_i64x2_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  bailout(kSimd, "emit_i64x2_replace_lane");
+}
+
+void LiftoffAssembler::emit_f32x4_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  bailout(kSimd, "emit_f32x4_replace_lane");
+}
+
+void LiftoffAssembler::emit_f64x2_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  bailout(kSimd, "emit_f64x2_replace_lane");
 }
 
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
@@ -1862,7 +2412,7 @@ void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
 }
 
 void LiftoffAssembler::CallTrapCallbackForTesting() {
-  PrepareCallCFunction(0, GetUnusedRegister(kGpReg).gp());
+  PrepareCallCFunction(0, GetUnusedRegister(kGpReg, {}).gp());
   CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(), 0);
 }
 
diff --git a/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h b/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h
index a3f8d606807..18be584216d 100644
--- a/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h
+++ b/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h
@@ -27,7 +27,7 @@ namespace liftoff {
 //   1   | return addr (ra)   |
 //   0   | previous frame (fp)|
 //  -----+--------------------+  <-- frame ptr (fp)
-//  -1   | 0xa: WASM_COMPILED |
+//  -1   | 0xa: WASM          |
 //  -2   |     instance       |
 //  -----+--------------------+---------------------------
 //  -3   |     slot 0         |   ^
@@ -42,7 +42,9 @@ namespace liftoff {
 // fp-8 holds the stack marker, fp-16 is the instance parameter.
 constexpr int kInstanceOffset = 16;
 
-inline MemOperand GetStackSlot(int offset) { return MemOperand(fp, -offset); }
+inline MemOperand GetStackSlot(int offset) {
+  return MemOperand(offset > 0 ? fp : sp, -offset);
+}
 
 inline MemOperand GetInstanceOperand() { return GetStackSlot(kInstanceOffset); }
 
@@ -61,6 +63,9 @@ inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, MemOperand src,
     case ValueType::kF64:
       assm->Ldc1(dst.fp(), src);
       break;
+    case ValueType::kS128:
+      assm->ld_b(dst.fp().toW(), src);
+      break;
     default:
       UNREACHABLE();
   }
@@ -104,6 +109,10 @@ inline void push(LiftoffAssembler* assm, LiftoffRegister reg, ValueType type) {
       assm->daddiu(sp, sp, -kSystemPointerSize);
       assm->Sdc1(reg.fp(), MemOperand(sp, 0));
       break;
+    case ValueType::kS128:
+      assm->daddiu(sp, sp, -kSystemPointerSize * 2);
+      assm->st_b(reg.fp().toW(), MemOperand(sp, 0));
+      break;
     default:
       UNREACHABLE();
   }
@@ -374,6 +383,9 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
     case LoadType::kF64Load:
       TurboAssembler::Uldc1(dst.fp(), src_op, t8);
       break;
+    case LoadType::kS128Load:
+      TurboAssembler::ld_b(dst.fp().toW(), src_op);
+      break;
     default:
       UNREACHABLE();
   }
@@ -437,6 +449,9 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
     case StoreType::kF64Store:
       TurboAssembler::Usdc1(src.fp(), dst_op, t8);
       break;
+    case StoreType::kS128Store:
+      TurboAssembler::st_b(src.fp().toW(), dst_op);
+      break;
     default:
       UNREACHABLE();
   }
@@ -456,37 +471,38 @@ void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
 
 void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicAdd");
 }
 
 void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicSub");
 }
 
 void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicAnd");
 }
 
 void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
                                 uint32_t offset_imm, LiftoffRegister value,
-                                StoreType type) {
+                                LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicOr");
 }
 
 void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicXor");
 }
 
 void LiftoffAssembler::AtomicExchange(Register dst_addr, Register offset_reg,
                                       uint32_t offset_imm,
-                                      LiftoffRegister value, StoreType type) {
+                                      LiftoffRegister value,
+                                      LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicExchange");
 }
 
@@ -506,10 +522,17 @@ void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
   liftoff::Load(this, dst, src, type);
 }
 
+void LiftoffAssembler::StoreCallerFrameSlot(LiftoffRegister src,
+                                            uint32_t caller_slot_idx,
+                                            ValueType type) {
+  int32_t offset = kSystemPointerSize * (caller_slot_idx + 1);
+  liftoff::Store(this, fp, offset, src, type);
+}
+
 void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
   DCHECK_NE(dst_offset, src_offset);
-  LiftoffRegister reg = GetUnusedRegister(reg_class_for(type));
+  LiftoffRegister reg = GetUnusedRegister(reg_class_for(type), {});
   Fill(reg, src_offset, type);
   Spill(dst_offset, reg, type);
 }
@@ -523,7 +546,11 @@ void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
 void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
                             ValueType type) {
   DCHECK_NE(dst, src);
-  TurboAssembler::Move(dst, src);
+  if (type != kWasmS128) {
+    TurboAssembler::Move(dst, src);
+  } else {
+    TurboAssembler::move_v(dst.toW(), src.toW());
+  }
 }
 
 void LiftoffAssembler::Spill(int offset, LiftoffRegister reg, ValueType type) {
@@ -542,6 +569,9 @@ void LiftoffAssembler::Spill(int offset, LiftoffRegister reg, ValueType type) {
     case ValueType::kF64:
       TurboAssembler::Sdc1(reg.fp(), dst);
       break;
+    case ValueType::kS128:
+      TurboAssembler::st_b(reg.fp().toW(), dst);
+      break;
     default:
       UNREACHABLE();
   }
@@ -552,13 +582,13 @@ void LiftoffAssembler::Spill(int offset, WasmValue value) {
   MemOperand dst = liftoff::GetStackSlot(offset);
   switch (value.type().kind()) {
     case ValueType::kI32: {
-      LiftoffRegister tmp = GetUnusedRegister(kGpReg);
+      LiftoffRegister tmp = GetUnusedRegister(kGpReg, {});
       TurboAssembler::li(tmp.gp(), Operand(value.to_i32()));
       sw(tmp.gp(), dst);
       break;
     }
     case ValueType::kI64: {
-      LiftoffRegister tmp = GetUnusedRegister(kGpReg);
+      LiftoffRegister tmp = GetUnusedRegister(kGpReg, {});
       TurboAssembler::li(tmp.gp(), value.to_i64());
       sd(tmp.gp(), dst);
       break;
@@ -585,6 +615,9 @@ void LiftoffAssembler::Fill(LiftoffRegister reg, int offset, ValueType type) {
     case ValueType::kF64:
       TurboAssembler::Ldc1(reg.fp(), src);
       break;
+    case ValueType::kS128:
+      TurboAssembler::ld_b(reg.fp().toW(), src);
+      break;
     default:
       UNREACHABLE();
   }
@@ -695,10 +728,10 @@ I32_BINOP(xor, xor_)
 
 #undef I32_BINOP
 
-#define I32_BINOP_I(name, instruction)                               \
-  void LiftoffAssembler::emit_i32_##name(Register dst, Register lhs, \
-                                         int32_t imm) {              \
-    instruction(dst, lhs, Operand(imm));                             \
+#define I32_BINOP_I(name, instruction)                                  \
+  void LiftoffAssembler::emit_i32_##name##i(Register dst, Register lhs, \
+                                            int32_t imm) {              \
+    instruction(dst, lhs, Operand(imm));                                \
   }
 
 // clang-format off
@@ -728,12 +761,12 @@ bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
                                          Register amount) {          \
     instruction(dst, src, amount);                                   \
   }
-#define I32_SHIFTOP_I(name, instruction)                             \
-  I32_SHIFTOP(name, instruction##v)                                  \
-  void LiftoffAssembler::emit_i32_##name(Register dst, Register src, \
-                                         int amount) {               \
-    DCHECK(is_uint5(amount));                                        \
-    instruction(dst, src, amount);                                   \
+#define I32_SHIFTOP_I(name, instruction)                                \
+  I32_SHIFTOP(name, instruction##v)                                     \
+  void LiftoffAssembler::emit_i32_##name##i(Register dst, Register src, \
+                                            int amount) {               \
+    DCHECK(is_uint5(amount));                                           \
+    instruction(dst, src, amount);                                      \
   }
 
 I32_SHIFTOP_I(shl, sll)
@@ -808,10 +841,10 @@ I64_BINOP(xor, xor_)
 
 #undef I64_BINOP
 
-#define I64_BINOP_I(name, instruction)                                       \
-  void LiftoffAssembler::emit_i64_##name(LiftoffRegister dst,                \
-                                         LiftoffRegister lhs, int32_t imm) { \
-    instruction(dst.gp(), lhs.gp(), Operand(imm));                           \
+#define I64_BINOP_I(name, instruction)                         \
+  void LiftoffAssembler::emit_i64_##name##i(                   \
+      LiftoffRegister dst, LiftoffRegister lhs, int32_t imm) { \
+    instruction(dst.gp(), lhs.gp(), Operand(imm));             \
   }
 
 // clang-format off
@@ -828,15 +861,15 @@ I64_BINOP_I(xor, Xor)
       LiftoffRegister dst, LiftoffRegister src, Register amount) { \
     instruction(dst.gp(), src.gp(), amount);                       \
   }
-#define I64_SHIFTOP_I(name, instruction)                                    \
-  I64_SHIFTOP(name, instruction##v)                                         \
-  void LiftoffAssembler::emit_i64_##name(LiftoffRegister dst,               \
-                                         LiftoffRegister src, int amount) { \
-    DCHECK(is_uint6(amount));                                               \
-    if (amount < 32)                                                        \
-      instruction(dst.gp(), src.gp(), amount);                              \
-    else                                                                    \
-      instruction##32(dst.gp(), src.gp(), amount - 32);                     \
+#define I64_SHIFTOP_I(name, instruction)                                       \
+  I64_SHIFTOP(name, instruction##v)                                            \
+  void LiftoffAssembler::emit_i64_##name##i(LiftoffRegister dst,               \
+                                            LiftoffRegister src, int amount) { \
+    DCHECK(is_uint6(amount));                                                  \
+    if (amount < 32)                                                           \
+      instruction(dst.gp(), src.gp(), amount);                                 \
+    else                                                                       \
+      instruction##32(dst.gp(), src.gp(), amount - 32);                        \
   }
 
 I64_SHIFTOP_I(shl, dsll)
@@ -1144,6 +1177,30 @@ bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
     case kExprF64ReinterpretI64:
       dmtc1(src.gp(), dst.fp());
       return true;
+    case kExprI32SConvertSatF32:
+      bailout(kNonTrappingFloatToInt, "kExprI32SConvertSatF32");
+      return true;
+    case kExprI32UConvertSatF32:
+      bailout(kNonTrappingFloatToInt, "kExprI32UConvertSatF32");
+      return true;
+    case kExprI32SConvertSatF64:
+      bailout(kNonTrappingFloatToInt, "kExprI32SConvertSatF64");
+      return true;
+    case kExprI32UConvertSatF64:
+      bailout(kNonTrappingFloatToInt, "kExprI32UConvertSatF64");
+      return true;
+    case kExprI64SConvertSatF32:
+      bailout(kNonTrappingFloatToInt, "kExprI64SConvertSatF32");
+      return true;
+    case kExprI64UConvertSatF32:
+      bailout(kNonTrappingFloatToInt, "kExprI64UConvertSatF32");
+      return true;
+    case kExprI64SConvertSatF64:
+      bailout(kNonTrappingFloatToInt, "kExprI64SConvertSatF64");
+      return true;
+    case kExprI64UConvertSatF64:
+      bailout(kNonTrappingFloatToInt, "kExprI64UConvertSatF64");
+      return true;
     default:
       return false;
   }
@@ -1264,6 +1321,16 @@ inline FPUCondition ConditionToConditionCmpFPU(Condition condition,
   UNREACHABLE();
 }
 
+inline void EmitAnyTrue(LiftoffAssembler* assm, LiftoffRegister dst,
+                        LiftoffRegister src) {
+  Label all_false;
+  assm->BranchMSA(&all_false, MSA_BRANCH_V, all_zero, src.fp().toW(),
+                  USE_DELAY_SLOT);
+  assm->li(dst.gp(), 0l);
+  assm->li(dst.gp(), 1);
+  assm->bind(&all_false);
+}
+
 }  // namespace liftoff
 
 void LiftoffAssembler::emit_f32_set_cond(Condition cond, Register dst,
@@ -1324,328 +1391,1043 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   bind(&cont);
 }
 
+void LiftoffAssembler::LoadTransform(LiftoffRegister dst, Register src_addr,
+                                     Register offset_reg, uint32_t offset_imm,
+                                     LoadType type,
+                                     LoadTransformationKind transform,
+                                     uint32_t* protected_load_pc) {
+  UseScratchRegisterScope temps(this);
+  Register scratch = temps.Acquire();
+  Daddu(scratch, src_addr, offset_reg);
+  MemOperand src_op = MemOperand(scratch, offset_imm);
+  MSARegister dst_msa = dst.fp().toW();
+  *protected_load_pc = pc_offset();
+  MachineType memtype = type.mem_type();
+
+  if (transform == LoadTransformationKind::kExtend) {
+    Ld(scratch, src_op);
+    if (memtype == MachineType::Int8()) {
+      fill_d(dst_msa, scratch);
+      clti_s_b(kSimd128ScratchReg, dst_msa, 0);
+      ilvr_b(dst_msa, kSimd128ScratchReg, dst_msa);
+    } else if (memtype == MachineType::Uint8()) {
+      xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+      fill_d(dst_msa, scratch);
+      ilvr_b(dst_msa, kSimd128RegZero, dst_msa);
+    } else if (memtype == MachineType::Int16()) {
+      fill_d(dst_msa, scratch);
+      clti_s_h(kSimd128ScratchReg, dst_msa, 0);
+      ilvr_h(dst_msa, kSimd128ScratchReg, dst_msa);
+    } else if (memtype == MachineType::Uint16()) {
+      xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+      fill_d(dst_msa, scratch);
+      ilvr_h(dst_msa, kSimd128RegZero, dst_msa);
+    } else if (memtype == MachineType::Int32()) {
+      fill_d(dst_msa, scratch);
+      clti_s_w(kSimd128ScratchReg, dst_msa, 0);
+      ilvr_w(dst_msa, kSimd128ScratchReg, dst_msa);
+    } else if (memtype == MachineType::Uint32()) {
+      xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+      fill_d(dst_msa, scratch);
+      ilvr_w(dst_msa, kSimd128RegZero, dst_msa);
+    }
+  } else {
+    DCHECK_EQ(LoadTransformationKind::kSplat, transform);
+    if (memtype == MachineType::Int8()) {
+      Lb(scratch, src_op);
+      fill_b(dst_msa, scratch);
+    } else if (memtype == MachineType::Int16()) {
+      Lh(scratch, src_op);
+      fill_h(dst_msa, scratch);
+    } else if (memtype == MachineType::Int32()) {
+      Lw(scratch, src_op);
+      fill_w(dst_msa, scratch);
+    } else if (memtype == MachineType::Int64()) {
+      Ld(scratch, src_op);
+      fill_d(dst_msa, scratch);
+    }
+  }
+}
+
+void LiftoffAssembler::emit_s8x16_swizzle(LiftoffRegister dst,
+                                          LiftoffRegister lhs,
+                                          LiftoffRegister rhs) {
+  MSARegister dst_msa = dst.fp().toW();
+  MSARegister lhs_msa = lhs.fp().toW();
+  MSARegister rhs_msa = rhs.fp().toW();
+
+  if (dst == lhs) {
+    move_v(kSimd128ScratchReg, lhs_msa);
+    lhs_msa = kSimd128ScratchReg;
+  }
+  xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+  move_v(dst_msa, rhs_msa);
+  vshf_b(dst_msa, kSimd128RegZero, lhs_msa);
+}
+
+void LiftoffAssembler::emit_i8x16_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  fill_b(dst.fp().toW(), src.gp());
+}
+
+void LiftoffAssembler::emit_i16x8_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  fill_h(dst.fp().toW(), src.gp());
+}
+
+void LiftoffAssembler::emit_i32x4_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  fill_w(dst.fp().toW(), src.gp());
+}
+
+void LiftoffAssembler::emit_i64x2_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  fill_d(dst.fp().toW(), src.gp());
+}
+
+void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  TurboAssembler::FmoveLow(kScratchReg, src.fp());
+  fill_w(dst.fp().toW(), kScratchReg);
+}
+
 void LiftoffAssembler::emit_f64x2_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f64x2_splat");
+  TurboAssembler::Move(kScratchReg, src.fp());
+  fill_d(dst.fp().toW(), kScratchReg);
 }
 
-void LiftoffAssembler::emit_f64x2_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f64x2_exract_lane");
+void LiftoffAssembler::emit_i8x16_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  ceq_b(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_f64x2_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f64x2_replace_lane");
+void LiftoffAssembler::emit_i8x16_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  ceq_b(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+  nor_v(dst.fp().toW(), dst.fp().toW(), dst.fp().toW());
 }
 
-void LiftoffAssembler::emit_f64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_i8x16_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  clt_s_b(dst.fp().toW(), rhs.fp().toW(), lhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i8x16_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  clt_u_b(dst.fp().toW(), rhs.fp().toW(), lhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i8x16_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  cle_s_b(dst.fp().toW(), rhs.fp().toW(), lhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i8x16_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  cle_u_b(dst.fp().toW(), rhs.fp().toW(), lhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i16x8_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  ceq_h(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i16x8_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  ceq_h(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+  nor_v(dst.fp().toW(), dst.fp().toW(), dst.fp().toW());
+}
+
+void LiftoffAssembler::emit_i16x8_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  clt_s_h(dst.fp().toW(), rhs.fp().toW(), lhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i16x8_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  clt_u_h(dst.fp().toW(), rhs.fp().toW(), lhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i16x8_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  cle_s_h(dst.fp().toW(), rhs.fp().toW(), lhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i16x8_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  cle_u_h(dst.fp().toW(), rhs.fp().toW(), lhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  ceq_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  ceq_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+  nor_v(dst.fp().toW(), dst.fp().toW(), dst.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  clt_s_w(dst.fp().toW(), rhs.fp().toW(), lhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  clt_u_w(dst.fp().toW(), rhs.fp().toW(), lhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  cle_s_w(dst.fp().toW(), rhs.fp().toW(), lhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  cle_u_w(dst.fp().toW(), rhs.fp().toW(), lhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_f32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  fceq_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_f32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  fcune_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_f32x4_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  fclt_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_f32x4_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  fcle_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_f64x2_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  fceq_d(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_f64x2_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  fcune_d(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_f64x2_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  fclt_d(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_f64x2_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  fcle_d(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_s128_not(LiftoffRegister dst, LiftoffRegister src) {
+  nor_v(dst.fp().toW(), src.fp().toW(), src.fp().toW());
+}
+
+void LiftoffAssembler::emit_s128_and(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  and_v(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_s128_or(LiftoffRegister dst, LiftoffRegister lhs,
+                                    LiftoffRegister rhs) {
+  or_v(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_s128_xor(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  xor_v(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_s128_and_not(LiftoffRegister dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  nor_v(kSimd128ScratchReg, rhs.fp().toW(), rhs.fp().toW());
+  and_v(dst.fp().toW(), kSimd128ScratchReg, lhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_s128_select(LiftoffRegister dst,
+                                        LiftoffRegister src1,
+                                        LiftoffRegister src2,
+                                        LiftoffRegister mask) {
+  if (dst == mask) {
+    bsel_v(dst.fp().toW(), src2.fp().toW(), src1.fp().toW());
+  } else {
+    xor_v(kSimd128ScratchReg, src1.fp().toW(), src2.fp().toW());
+    and_v(kSimd128ScratchReg, kSimd128ScratchReg, mask.fp().toW());
+    xor_v(dst.fp().toW(), kSimd128ScratchReg, src2.fp().toW());
+  }
+}
+
+void LiftoffAssembler::emit_i8x16_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+  subv_b(dst.fp().toW(), kSimd128RegZero, src.fp().toW());
+}
+
+void LiftoffAssembler::emit_v8x16_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAnyTrue(this, dst, src);
+}
+
+void LiftoffAssembler::emit_i8x16_shl(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f64x2_add");
+  fill_b(kSimd128ScratchReg, rhs.gp());
+  sll_b(dst.fp().toW(), lhs.fp().toW(), kSimd128ScratchReg);
 }
 
-void LiftoffAssembler::emit_f64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_i8x16_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  slli_b(dst.fp().toW(), lhs.fp().toW(), rhs & 7);
+}
+
+void LiftoffAssembler::emit_i8x16_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  fill_b(kSimd128ScratchReg, rhs.gp());
+  sra_b(dst.fp().toW(), lhs.fp().toW(), kSimd128ScratchReg);
+}
+
+void LiftoffAssembler::emit_i8x16_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  srai_b(dst.fp().toW(), lhs.fp().toW(), rhs & 7);
+}
+
+void LiftoffAssembler::emit_i8x16_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  fill_b(kSimd128ScratchReg, rhs.gp());
+  srl_b(dst.fp().toW(), lhs.fp().toW(), kSimd128ScratchReg);
+}
+
+void LiftoffAssembler::emit_i8x16_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  srli_b(dst.fp().toW(), lhs.fp().toW(), rhs & 7);
+}
+
+void LiftoffAssembler::emit_i8x16_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f64x2_sub");
+  addv_b(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_f64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_i8x16_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  adds_s_b(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i8x16_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  adds_u_b(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i8x16_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f64x2_mul");
+  subv_b(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f32x4_splat");
+void LiftoffAssembler::emit_i8x16_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  subs_s_b(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_f32x4_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f32x4_exract_lane");
+void LiftoffAssembler::emit_i8x16_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  subs_u_b(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_f32x4_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f32x4_replace_lane");
+void LiftoffAssembler::emit_i8x16_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  mulv_b(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_f32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_i8x16_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  min_s_b(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i8x16_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  min_u_b(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i8x16_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  max_s_b(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i8x16_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  max_u_b(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i16x8_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+  subv_h(dst.fp().toW(), kSimd128RegZero, src.fp().toW());
+}
+
+void LiftoffAssembler::emit_v16x8_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAnyTrue(this, dst, src);
+}
+
+void LiftoffAssembler::emit_i16x8_shl(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f32x4_add");
+  fill_h(kSimd128ScratchReg, rhs.gp());
+  sll_h(dst.fp().toW(), lhs.fp().toW(), kSimd128ScratchReg);
 }
 
-void LiftoffAssembler::emit_f32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_i16x8_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  slli_h(dst.fp().toW(), lhs.fp().toW(), rhs & 15);
+}
+
+void LiftoffAssembler::emit_i16x8_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  fill_h(kSimd128ScratchReg, rhs.gp());
+  sra_h(dst.fp().toW(), lhs.fp().toW(), kSimd128ScratchReg);
+}
+
+void LiftoffAssembler::emit_i16x8_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  srai_h(dst.fp().toW(), lhs.fp().toW(), rhs & 15);
+}
+
+void LiftoffAssembler::emit_i16x8_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  fill_h(kSimd128ScratchReg, rhs.gp());
+  srl_h(dst.fp().toW(), lhs.fp().toW(), kSimd128ScratchReg);
+}
+
+void LiftoffAssembler::emit_i16x8_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  srli_h(dst.fp().toW(), lhs.fp().toW(), rhs & 15);
+}
+
+void LiftoffAssembler::emit_i16x8_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f32x4_sub");
+  addv_h(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_f32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_i16x8_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  adds_s_h(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i16x8_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  adds_u_h(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i16x8_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_f32x4_mul");
+  subv_h(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_i64x2_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i64x2_splat");
+void LiftoffAssembler::emit_i16x8_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  subs_s_h(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_i64x2_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i64x2_exract_lane");
+void LiftoffAssembler::emit_i16x8_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  subs_u_h(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_i64x2_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i64x2_replace_lane");
+void LiftoffAssembler::emit_i16x8_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  mulv_h(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i16x8_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  min_s_h(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i16x8_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  min_u_h(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i16x8_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  max_s_h(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i16x8_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  max_u_h(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+  subv_w(dst.fp().toW(), kSimd128RegZero, src.fp().toW());
+}
+
+void LiftoffAssembler::emit_v32x4_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAnyTrue(this, dst, src);
+}
+
+void LiftoffAssembler::emit_i32x4_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  fill_w(kSimd128ScratchReg, rhs.gp());
+  sll_w(dst.fp().toW(), lhs.fp().toW(), kSimd128ScratchReg);
+}
+
+void LiftoffAssembler::emit_i32x4_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  slli_w(dst.fp().toW(), lhs.fp().toW(), rhs & 31);
+}
+
+void LiftoffAssembler::emit_i32x4_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  fill_w(kSimd128ScratchReg, rhs.gp());
+  sra_w(dst.fp().toW(), lhs.fp().toW(), kSimd128ScratchReg);
+}
+
+void LiftoffAssembler::emit_i32x4_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  srai_w(dst.fp().toW(), lhs.fp().toW(), rhs & 31);
+}
+
+void LiftoffAssembler::emit_i32x4_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  fill_w(kSimd128ScratchReg, rhs.gp());
+  srl_w(dst.fp().toW(), lhs.fp().toW(), kSimd128ScratchReg);
+}
+
+void LiftoffAssembler::emit_i32x4_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  srli_w(dst.fp().toW(), lhs.fp().toW(), rhs & 31);
+}
+
+void LiftoffAssembler::emit_i32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  addv_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  subv_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  mulv_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  min_s_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  min_u_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  max_s_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  max_u_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+  subv_d(dst.fp().toW(), kSimd128RegZero, src.fp().toW());
+}
+
+void LiftoffAssembler::emit_i64x2_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  fill_d(kSimd128ScratchReg, rhs.gp());
+  sll_d(dst.fp().toW(), lhs.fp().toW(), kSimd128ScratchReg);
+}
+
+void LiftoffAssembler::emit_i64x2_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  slli_d(dst.fp().toW(), lhs.fp().toW(), rhs & 63);
+}
+
+void LiftoffAssembler::emit_i64x2_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  fill_d(kSimd128ScratchReg, rhs.gp());
+  sra_d(dst.fp().toW(), lhs.fp().toW(), kSimd128ScratchReg);
+}
+
+void LiftoffAssembler::emit_i64x2_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  srai_d(dst.fp().toW(), lhs.fp().toW(), rhs & 63);
+}
+
+void LiftoffAssembler::emit_i64x2_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  fill_d(kSimd128ScratchReg, rhs.gp());
+  srl_d(dst.fp().toW(), lhs.fp().toW(), kSimd128ScratchReg);
+}
+
+void LiftoffAssembler::emit_i64x2_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  srli_d(dst.fp().toW(), lhs.fp().toW(), rhs & 63);
 }
 
 void LiftoffAssembler::emit_i64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i64x2_add");
+  addv_d(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
 void LiftoffAssembler::emit_i64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i64x2_sub");
+  subv_d(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
 void LiftoffAssembler::emit_i64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i64x2_mul");
+  mulv_d(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_i32x4_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i32x4_splat");
+void LiftoffAssembler::emit_f32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bclri_w(dst.fp().toW(), src.fp().toW(), 31);
 }
 
-void LiftoffAssembler::emit_i32x4_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i32x4_exract_lane");
+void LiftoffAssembler::emit_f32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bnegi_w(dst.fp().toW(), src.fp().toW(), 31);
 }
 
-void LiftoffAssembler::emit_i32x4_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i32x4_replace_lane");
+void LiftoffAssembler::emit_f32x4_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  fsqrt_w(dst.fp().toW(), src.fp().toW());
 }
 
-void LiftoffAssembler::emit_i32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_f32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i32x4_add");
+  fadd_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_i32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_f32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i32x4_sub");
+  fsub_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_i32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_f32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i32x4_mul");
+  fmul_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_i16x8_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i16x8_splat");
+void LiftoffAssembler::emit_f32x4_div(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  fdiv_w(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_i16x8_extract_lane_u(LiftoffRegister dst,
-                                                 LiftoffRegister lhs,
-                                                 uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i16x8_exract_lane_u");
+void LiftoffAssembler::emit_f32x4_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  MSARegister dst_msa = dst.fp().toW();
+  MSARegister lhs_msa = lhs.fp().toW();
+  MSARegister rhs_msa = rhs.fp().toW();
+  MSARegister scratch0 = kSimd128RegZero;
+  MSARegister scratch1 = kSimd128ScratchReg;
+  // If inputs are -0.0. and +0.0, then write -0.0 to scratch1.
+  // scratch1 = (lhs == rhs) ?  (lhs | rhs) : (rhs | rhs).
+  fseq_w(scratch0, lhs_msa, rhs_msa);
+  bsel_v(scratch0, rhs_msa, lhs_msa);
+  or_v(scratch1, scratch0, rhs_msa);
+  // scratch0 = isNaN(scratch1) ? scratch1: lhs.
+  fseq_w(scratch0, scratch1, scratch1);
+  bsel_v(scratch0, scratch1, lhs_msa);
+  // dst = (scratch1 <= scratch0) ? scratch1 : scratch0.
+  fsle_w(dst_msa, scratch1, scratch0);
+  bsel_v(dst_msa, scratch0, scratch1);
+}
+
+void LiftoffAssembler::emit_f32x4_max(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  MSARegister dst_msa = dst.fp().toW();
+  MSARegister lhs_msa = lhs.fp().toW();
+  MSARegister rhs_msa = rhs.fp().toW();
+  MSARegister scratch0 = kSimd128RegZero;
+  MSARegister scratch1 = kSimd128ScratchReg;
+  // If inputs are -0.0. and +0.0, then write +0.0 to scratch1.
+  // scratch1 = (lhs == rhs) ?  (lhs | rhs) : (rhs | rhs).
+  fseq_w(scratch0, lhs_msa, rhs_msa);
+  bsel_v(scratch0, rhs_msa, lhs_msa);
+  and_v(scratch1, scratch0, rhs_msa);
+  // scratch0 = isNaN(scratch1) ? scratch1: lhs.
+  fseq_w(scratch0, scratch1, scratch1);
+  bsel_v(scratch0, scratch1, lhs_msa);
+  // dst = (scratch0 <= scratch1) ? scratch1 : scratch0.
+  fsle_w(dst_msa, scratch0, scratch1);
+  bsel_v(dst_msa, scratch0, scratch1);
+}
+
+void LiftoffAssembler::emit_f64x2_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bclri_d(dst.fp().toW(), src.fp().toW(), 63);
+}
+
+void LiftoffAssembler::emit_f64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bnegi_d(dst.fp().toW(), src.fp().toW(), 63);
+}
+
+void LiftoffAssembler::emit_f64x2_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  fsqrt_d(dst.fp().toW(), src.fp().toW());
 }
 
-void LiftoffAssembler::emit_i16x8_extract_lane_s(LiftoffRegister dst,
-                                                 LiftoffRegister lhs,
-                                                 uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i16x8_exract_lane_s");
+void LiftoffAssembler::emit_f64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  fadd_d(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_i16x8_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i16x8_replace_lane");
+void LiftoffAssembler::emit_f64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  fsub_d(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_i16x8_add(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_f64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i16x8_add");
+  fmul_d(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_i16x8_sub(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_f64x2_div(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i16x8_sub");
+  fdiv_d(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
 }
 
-void LiftoffAssembler::emit_i16x8_mul(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_f64x2_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  MSARegister dst_msa = dst.fp().toW();
+  MSARegister lhs_msa = lhs.fp().toW();
+  MSARegister rhs_msa = rhs.fp().toW();
+  MSARegister scratch0 = kSimd128RegZero;
+  MSARegister scratch1 = kSimd128ScratchReg;
+  // If inputs are -0.0. and +0.0, then write -0.0 to scratch1.
+  // scratch1 = (lhs == rhs) ?  (lhs | rhs) : (rhs | rhs).
+  fseq_d(scratch0, lhs_msa, rhs_msa);
+  bsel_v(scratch0, rhs_msa, lhs_msa);
+  or_v(scratch1, scratch0, rhs_msa);
+  // scratch0 = isNaN(scratch1) ? scratch1: lhs.
+  fseq_d(scratch0, scratch1, scratch1);
+  bsel_v(scratch0, scratch1, lhs_msa);
+  // dst = (scratch1 <= scratch0) ? scratch1 : scratch0.
+  fsle_d(dst_msa, scratch1, scratch0);
+  bsel_v(dst_msa, scratch0, scratch1);
+}
+
+void LiftoffAssembler::emit_f64x2_max(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i16x8_mul");
+  MSARegister dst_msa = dst.fp().toW();
+  MSARegister lhs_msa = lhs.fp().toW();
+  MSARegister rhs_msa = rhs.fp().toW();
+  MSARegister scratch0 = kSimd128RegZero;
+  MSARegister scratch1 = kSimd128ScratchReg;
+  // If inputs are -0.0. and +0.0, then write +0.0 to scratch1.
+  // scratch1 = (lhs == rhs) ?  (lhs | rhs) : (rhs | rhs).
+  fseq_d(scratch0, lhs_msa, rhs_msa);
+  bsel_v(scratch0, rhs_msa, lhs_msa);
+  and_v(scratch1, scratch0, rhs_msa);
+  // scratch0 = isNaN(scratch1) ? scratch1: lhs.
+  fseq_d(scratch0, scratch1, scratch1);
+  bsel_v(scratch0, scratch1, lhs_msa);
+  // dst = (scratch0 <= scratch1) ? scratch1 : scratch0.
+  fsle_d(dst_msa, scratch0, scratch1);
+  bsel_v(dst_msa, scratch0, scratch1);
 }
 
-void LiftoffAssembler::emit_i8x16_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i8x16_splat");
+void LiftoffAssembler::emit_i32x4_sconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  ftrunc_s_w(dst.fp().toW(), src.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  ftrunc_u_w(dst.fp().toW(), src.fp().toW());
+}
+
+void LiftoffAssembler::emit_f32x4_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  ffint_s_w(dst.fp().toW(), src.fp().toW());
+}
+
+void LiftoffAssembler::emit_f32x4_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  ffint_u_w(dst.fp().toW(), src.fp().toW());
+}
+
+void LiftoffAssembler::emit_i8x16_sconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  sat_s_h(kSimd128ScratchReg, lhs.fp().toW(), 7);
+  sat_s_h(dst.fp().toW(), lhs.fp().toW(), 7);
+  pckev_b(dst.fp().toW(), dst.fp().toW(), kSimd128ScratchReg);
+}
+
+void LiftoffAssembler::emit_i8x16_uconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+  max_s_h(kSimd128ScratchReg, kSimd128RegZero, lhs.fp().toW());
+  sat_u_h(kSimd128ScratchReg, kSimd128ScratchReg, 7);
+  max_s_h(dst.fp().toW(), kSimd128RegZero, rhs.fp().toW());
+  sat_u_h(dst.fp().toW(), dst.fp().toW(), 7);
+  pckev_b(dst.fp().toW(), dst.fp().toW(), kSimd128ScratchReg);
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  sat_s_w(kSimd128ScratchReg, lhs.fp().toW(), 15);
+  sat_s_w(dst.fp().toW(), lhs.fp().toW(), 15);
+  pckev_h(dst.fp().toW(), dst.fp().toW(), kSimd128ScratchReg);
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+  max_s_w(kSimd128ScratchReg, kSimd128RegZero, lhs.fp().toW());
+  sat_u_w(kSimd128ScratchReg, kSimd128ScratchReg, 15);
+  max_s_w(dst.fp().toW(), kSimd128RegZero, rhs.fp().toW());
+  sat_u_w(dst.fp().toW(), dst.fp().toW(), 15);
+  pckev_h(dst.fp().toW(), dst.fp().toW(), kSimd128ScratchReg);
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  ilvr_b(kSimd128ScratchReg, src.fp().toW(), src.fp().toW());
+  slli_h(dst.fp().toW(), kSimd128ScratchReg, 8);
+  srai_h(dst.fp().toW(), dst.fp().toW(), 8);
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  ilvl_b(kSimd128ScratchReg, src.fp().toW(), src.fp().toW());
+  slli_h(dst.fp().toW(), kSimd128ScratchReg, 8);
+  srai_h(dst.fp().toW(), dst.fp().toW(), 8);
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+  ilvr_b(dst.fp().toW(), kSimd128RegZero, src.fp().toW());
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+  ilvl_b(dst.fp().toW(), kSimd128RegZero, src.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  ilvr_h(kSimd128ScratchReg, src.fp().toW(), src.fp().toW());
+  slli_w(dst.fp().toW(), kSimd128ScratchReg, 16);
+  srai_w(dst.fp().toW(), dst.fp().toW(), 16);
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  ilvl_h(kSimd128ScratchReg, src.fp().toW(), src.fp().toW());
+  slli_w(dst.fp().toW(), kSimd128ScratchReg, 16);
+  srai_w(dst.fp().toW(), dst.fp().toW(), 16);
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+  ilvr_h(dst.fp().toW(), kSimd128RegZero, src.fp().toW());
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+  ilvl_h(dst.fp().toW(), kSimd128RegZero, src.fp().toW());
+}
+
+void LiftoffAssembler::emit_i8x16_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  aver_u_b(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i16x8_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  aver_u_h(dst.fp().toW(), lhs.fp().toW(), rhs.fp().toW());
+}
+
+void LiftoffAssembler::emit_i8x16_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+  asub_s_b(dst.fp().toW(), src.fp().toW(), kSimd128RegZero);
+}
+
+void LiftoffAssembler::emit_i16x8_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+  asub_s_h(dst.fp().toW(), src.fp().toW(), kSimd128RegZero);
+}
+
+void LiftoffAssembler::emit_i32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  xor_v(kSimd128RegZero, kSimd128RegZero, kSimd128RegZero);
+  asub_s_w(dst.fp().toW(), src.fp().toW(), kSimd128RegZero);
+}
+
+void LiftoffAssembler::emit_i8x16_extract_lane_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 uint8_t imm_lane_idx) {
+  copy_s_b(dst.gp(), lhs.fp().toW(), imm_lane_idx);
 }
 
 void LiftoffAssembler::emit_i8x16_extract_lane_u(LiftoffRegister dst,
                                                  LiftoffRegister lhs,
                                                  uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i8x16_exract_lane_u");
+  copy_u_b(dst.gp(), lhs.fp().toW(), imm_lane_idx);
 }
 
-void LiftoffAssembler::emit_i8x16_extract_lane_s(LiftoffRegister dst,
+void LiftoffAssembler::emit_i16x8_extract_lane_s(LiftoffRegister dst,
                                                  LiftoffRegister lhs,
                                                  uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i8x16_exract_lane_s");
+  copy_s_h(dst.gp(), lhs.fp().toW(), imm_lane_idx);
+}
+
+void LiftoffAssembler::emit_i16x8_extract_lane_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 uint8_t imm_lane_idx) {
+  copy_u_h(dst.gp(), lhs.fp().toW(), imm_lane_idx);
+}
+
+void LiftoffAssembler::emit_i32x4_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  copy_s_w(dst.gp(), lhs.fp().toW(), imm_lane_idx);
+}
+
+void LiftoffAssembler::emit_i64x2_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  copy_s_d(dst.gp(), lhs.fp().toW(), imm_lane_idx);
+}
+
+void LiftoffAssembler::emit_f32x4_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  copy_u_w(kScratchReg, lhs.fp().toW(), imm_lane_idx);
+  TurboAssembler::FmoveLow(dst.fp(), kScratchReg);
+}
+
+void LiftoffAssembler::emit_f64x2_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  copy_s_d(kScratchReg, lhs.fp().toW(), imm_lane_idx);
+  TurboAssembler::Move(dst.fp(), kScratchReg);
 }
 
 void LiftoffAssembler::emit_i8x16_replace_lane(LiftoffRegister dst,
                                                LiftoffRegister src1,
                                                LiftoffRegister src2,
                                                uint8_t imm_lane_idx) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i8x16_replace_lane");
+  if (dst != src1) {
+    move_v(dst.fp().toW(), src1.fp().toW());
+  }
+  insert_b(dst.fp().toW(), imm_lane_idx, src2.gp());
 }
 
-void LiftoffAssembler::emit_i8x16_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i8x16_add");
+void LiftoffAssembler::emit_i16x8_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  if (dst != src1) {
+    move_v(dst.fp().toW(), src1.fp().toW());
+  }
+  insert_h(dst.fp().toW(), imm_lane_idx, src2.gp());
 }
 
-void LiftoffAssembler::emit_i8x16_sub(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i8x16_sub");
+void LiftoffAssembler::emit_i32x4_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  if (dst != src1) {
+    move_v(dst.fp().toW(), src1.fp().toW());
+  }
+  insert_w(dst.fp().toW(), imm_lane_idx, src2.gp());
 }
 
-void LiftoffAssembler::emit_i8x16_mul(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  // TODO(mips): Support this on loongson 3a4000. Currently, the main MIPS
-  // CPU, Loongson 3a3000 does not support MSA(simd128), but the upcoming
-  // 3a4000 support MSA.
-  bailout(kSimd, "emit_i8x16_mul");
+void LiftoffAssembler::emit_i64x2_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  if (dst != src1) {
+    move_v(dst.fp().toW(), src1.fp().toW());
+  }
+  insert_d(dst.fp().toW(), imm_lane_idx, src2.gp());
+}
+
+void LiftoffAssembler::emit_f32x4_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  TurboAssembler::FmoveLow(kScratchReg, src2.fp());
+  if (dst != src1) {
+    move_v(dst.fp().toW(), src1.fp().toW());
+  }
+  insert_w(dst.fp().toW(), imm_lane_idx, kScratchReg);
+}
+
+void LiftoffAssembler::emit_f64x2_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  TurboAssembler::Move(kScratchReg, src2.fp());
+  if (dst != src1) {
+    move_v(dst.fp().toW(), src1.fp().toW());
+  }
+  insert_d(dst.fp().toW(), imm_lane_idx, kScratchReg);
 }
 
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
@@ -1654,7 +2436,7 @@ void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
 }
 
 void LiftoffAssembler::CallTrapCallbackForTesting() {
-  PrepareCallCFunction(0, GetUnusedRegister(kGpReg).gp());
+  PrepareCallCFunction(0, GetUnusedRegister(kGpReg, {}).gp());
   CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(), 0);
 }
 
@@ -1679,15 +2461,20 @@ void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
   LiftoffRegList fp_regs = regs & kFpCacheRegList;
   unsigned num_fp_regs = fp_regs.GetNumRegsSet();
   if (num_fp_regs) {
-    daddiu(sp, sp, -(num_fp_regs * kStackSlotSize));
+    unsigned slot_size = IsEnabled(MIPS_SIMD) ? 16 : 8;
+    daddiu(sp, sp, -(num_fp_regs * slot_size));
     unsigned offset = 0;
     while (!fp_regs.is_empty()) {
       LiftoffRegister reg = fp_regs.GetFirstRegSet();
-      TurboAssembler::Sdc1(reg.fp(), MemOperand(sp, offset));
+      if (IsEnabled(MIPS_SIMD)) {
+        TurboAssembler::st_d(reg.fp().toW(), MemOperand(sp, offset));
+      } else {
+        TurboAssembler::Sdc1(reg.fp(), MemOperand(sp, offset));
+      }
       fp_regs.clear(reg);
-      offset += sizeof(double);
+      offset += slot_size;
     }
-    DCHECK_EQ(offset, num_fp_regs * sizeof(double));
+    DCHECK_EQ(offset, num_fp_regs * slot_size);
   }
 }
 
@@ -1696,9 +2483,13 @@ void LiftoffAssembler::PopRegisters(LiftoffRegList regs) {
   unsigned fp_offset = 0;
   while (!fp_regs.is_empty()) {
     LiftoffRegister reg = fp_regs.GetFirstRegSet();
-    TurboAssembler::Ldc1(reg.fp(), MemOperand(sp, fp_offset));
+    if (IsEnabled(MIPS_SIMD)) {
+      TurboAssembler::ld_d(reg.fp().toW(), MemOperand(sp, fp_offset));
+    } else {
+      TurboAssembler::Ldc1(reg.fp(), MemOperand(sp, fp_offset));
+    }
     fp_regs.clear(reg);
-    fp_offset += sizeof(double);
+    fp_offset += (IsEnabled(MIPS_SIMD) ? 16 : 8);
   }
   if (fp_offset) daddiu(sp, sp, fp_offset);
   LiftoffRegList gp_regs = regs & kGpCacheRegList;
@@ -1796,8 +2587,15 @@ void LiftoffStackSlots::Construct() {
     const LiftoffAssembler::VarState& src = slot.src_;
     switch (src.loc()) {
       case LiftoffAssembler::VarState::kStack:
-        asm_->ld(kScratchReg, liftoff::GetStackSlot(slot.src_offset_));
-        asm_->push(kScratchReg);
+        if (src.type() != kWasmS128) {
+          asm_->ld(kScratchReg, liftoff::GetStackSlot(slot.src_offset_));
+          asm_->push(kScratchReg);
+        } else {
+          asm_->ld(kScratchReg, liftoff::GetStackSlot(slot.src_offset_ - 8));
+          asm_->push(kScratchReg);
+          asm_->ld(kScratchReg, liftoff::GetStackSlot(slot.src_offset_));
+          asm_->push(kScratchReg);
+        }
         break;
       case LiftoffAssembler::VarState::kRegister:
         liftoff::push(asm_, src.reg(), src.type());
diff --git a/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h b/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h
index 3b5a5f3a407..a70420d2e3d 100644
--- a/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h
+++ b/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h
@@ -26,7 +26,7 @@ namespace liftoff {
 //   1   | return addr (lr)   |
 //   0   | previous frame (fp)|
 //  -----+--------------------+  <-- frame ptr (fp)
-//  -1   | 0xa: WASM_COMPILED |
+//  -1   | 0xa: WASM          |
 //  -2   |     instance       |
 //  -----+--------------------+---------------------------
 //  -3   |    slot 0 (high)   |   ^
@@ -142,37 +142,38 @@ void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
 
 void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicAdd");
 }
 
 void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicSub");
 }
 
 void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicAnd");
 }
 
 void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
                                 uint32_t offset_imm, LiftoffRegister value,
-                                StoreType type) {
+                                LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicOr");
 }
 
 void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicXor");
 }
 
 void LiftoffAssembler::AtomicExchange(Register dst_addr, Register offset_reg,
                                       uint32_t offset_imm,
-                                      LiftoffRegister value, StoreType type) {
+                                      LiftoffRegister value,
+                                      LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicExchange");
 }
 
@@ -191,6 +192,12 @@ void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
   bailout(kUnsupportedArchitecture, "LoadCallerFrameSlot");
 }
 
+void LiftoffAssembler::StoreCallerFrameSlot(LiftoffRegister src,
+                                            uint32_t caller_slot_idx,
+                                            ValueType type) {
+  bailout(kUnsupportedArchitecture, "StoreCallerFrameSlot");
+}
+
 void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
   bailout(kUnsupportedArchitecture, "MoveStackValue");
@@ -264,22 +271,22 @@ void LiftoffAssembler::FillStackSlotsWithZero(int start, int size) {
                                      Register rhs) {             \
     bailout(kUnsupportedArchitecture, "i32 binop:: " #name);     \
   }
-#define UNIMPLEMENTED_I32_BINOP_I(name)                          \
-  UNIMPLEMENTED_I32_BINOP(name)                                  \
-  void LiftoffAssembler::emit_##name(Register dst, Register lhs, \
-                                     int32_t imm) {              \
-    bailout(kUnsupportedArchitecture, "i32 binop_i: " #name);    \
+#define UNIMPLEMENTED_I32_BINOP_I(name)                             \
+  UNIMPLEMENTED_I32_BINOP(name)                                     \
+  void LiftoffAssembler::emit_##name##i(Register dst, Register lhs, \
+                                        int32_t imm) {              \
+    bailout(kUnsupportedArchitecture, "i32 binop_i: " #name);       \
   }
 #define UNIMPLEMENTED_I64_BINOP(name)                                          \
   void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister lhs, \
                                      LiftoffRegister rhs) {                    \
     bailout(kUnsupportedArchitecture, "i64 binop: " #name);                    \
   }
-#define UNIMPLEMENTED_I64_BINOP_I(name)                                        \
-  UNIMPLEMENTED_I64_BINOP(name)                                                \
-  void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister lhs, \
-                                     int32_t imm) {                            \
-    bailout(kUnsupportedArchitecture, "i64_i binop: " #name);                  \
+#define UNIMPLEMENTED_I64_BINOP_I(name)                                     \
+  UNIMPLEMENTED_I64_BINOP(name)                                             \
+  void LiftoffAssembler::emit_##name##i(LiftoffRegister dst,                \
+                                        LiftoffRegister lhs, int32_t imm) { \
+    bailout(kUnsupportedArchitecture, "i64_i binop: " #name);               \
   }
 #define UNIMPLEMENTED_GP_UNOP(name)                                \
   void LiftoffAssembler::emit_##name(Register dst, Register src) { \
@@ -299,22 +306,22 @@ void LiftoffAssembler::FillStackSlotsWithZero(int start, int size) {
     bailout(kUnsupportedArchitecture, "fp unop: " #name);                      \
     return true;                                                               \
   }
-#define UNIMPLEMENTED_I32_SHIFTOP(name)                          \
-  void LiftoffAssembler::emit_##name(Register dst, Register src, \
-                                     Register amount) {          \
-    bailout(kUnsupportedArchitecture, "i32 shiftop: " #name);    \
-  }                                                              \
-  void LiftoffAssembler::emit_##name(Register dst, Register src, \
-                                     int32_t amount) {           \
-    bailout(kUnsupportedArchitecture, "i32 shiftop: " #name);    \
+#define UNIMPLEMENTED_I32_SHIFTOP(name)                             \
+  void LiftoffAssembler::emit_##name(Register dst, Register src,    \
+                                     Register amount) {             \
+    bailout(kUnsupportedArchitecture, "i32 shiftop: " #name);       \
+  }                                                                 \
+  void LiftoffAssembler::emit_##name##i(Register dst, Register src, \
+                                        int32_t amount) {           \
+    bailout(kUnsupportedArchitecture, "i32 shiftop: " #name);       \
   }
 #define UNIMPLEMENTED_I64_SHIFTOP(name)                                        \
   void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
                                      Register amount) {                        \
     bailout(kUnsupportedArchitecture, "i64 shiftop: " #name);                  \
   }                                                                            \
-  void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
-                                     int32_t amount) {                         \
+  void LiftoffAssembler::emit_##name##i(LiftoffRegister dst,                   \
+                                        LiftoffRegister src, int32_t amount) { \
     bailout(kUnsupportedArchitecture, "i64 shiftop: " #name);                  \
   }
 
@@ -532,6 +539,20 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   bailout(kUnsupportedArchitecture, "emit_f64_set_cond");
 }
 
+void LiftoffAssembler::LoadTransform(LiftoffRegister dst, Register src_addr,
+                                     Register offset_reg, uint32_t offset_imm,
+                                     LoadType type,
+                                     LoadTransformationKind transform,
+                                     uint32_t* protected_load_pc) {
+  bailout(kSimd, "Load transform unimplemented");
+}
+
+void LiftoffAssembler::emit_s8x16_swizzle(LiftoffRegister dst,
+                                          LiftoffRegister lhs,
+                                          LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_s8x16_swizzle");
+}
+
 void LiftoffAssembler::emit_f64x2_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
   bailout(kUnsupportedArchitecture, "emit_f64x2splat");
@@ -550,6 +571,21 @@ void LiftoffAssembler::emit_f64x2_replace_lane(LiftoffRegister dst,
   bailout(kUnsupportedArchitecture, "emit_f64x2replacelane");
 }
 
+void LiftoffAssembler::emit_f64x2_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2_abs");
+}
+
+void LiftoffAssembler::emit_f64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2neg");
+}
+
+void LiftoffAssembler::emit_f64x2_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2sqrt");
+}
+
 void LiftoffAssembler::emit_f64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_f64x2add");
@@ -565,6 +601,21 @@ void LiftoffAssembler::emit_f64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
   bailout(kUnsupportedArchitecture, "emit_f64x2mul");
 }
 
+void LiftoffAssembler::emit_f64x2_div(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2div");
+}
+
+void LiftoffAssembler::emit_f64x2_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2min");
+}
+
+void LiftoffAssembler::emit_f64x2_max(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2max");
+}
+
 void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
   bailout(kUnsupportedArchitecture, "emit_f32x4_splat");
@@ -583,6 +634,21 @@ void LiftoffAssembler::emit_f32x4_replace_lane(LiftoffRegister dst,
   bailout(kUnsupportedArchitecture, "emit_f32x4replacelane");
 }
 
+void LiftoffAssembler::emit_f32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4_abs");
+}
+
+void LiftoffAssembler::emit_f32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4neg");
+}
+
+void LiftoffAssembler::emit_f32x4_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4sqrt");
+}
+
 void LiftoffAssembler::emit_f32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_f32x4add");
@@ -598,6 +664,21 @@ void LiftoffAssembler::emit_f32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
   bailout(kUnsupportedArchitecture, "emit_f32x4mul");
 }
 
+void LiftoffAssembler::emit_f32x4_div(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4div");
+}
+
+void LiftoffAssembler::emit_f32x4_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4min");
+}
+
+void LiftoffAssembler::emit_f32x4_max(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4max");
+}
+
 void LiftoffAssembler::emit_i64x2_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
   bailout(kUnsupportedArchitecture, "emit_i64x2splat");
@@ -616,6 +697,43 @@ void LiftoffAssembler::emit_i64x2_replace_lane(LiftoffRegister dst,
   bailout(kUnsupportedArchitecture, "emit_i64x2replacelane");
 }
 
+void LiftoffAssembler::emit_i64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i64x2neg");
+}
+
+void LiftoffAssembler::emit_i64x2_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "i64x2_shl");
+}
+
+void LiftoffAssembler::emit_i64x2_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  bailout(kSimd, "i64x2_shli");
+}
+
+void LiftoffAssembler::emit_i64x2_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i64x2_shr_s");
+}
+
+void LiftoffAssembler::emit_i64x2_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i64x2_shri_s");
+}
+
+void LiftoffAssembler::emit_i64x2_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i64x2_shr_u");
+}
+
+void LiftoffAssembler::emit_i64x2_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i64x2_shri_u");
+}
+
 void LiftoffAssembler::emit_i64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_i64x2add");
@@ -649,6 +767,53 @@ void LiftoffAssembler::emit_i32x4_replace_lane(LiftoffRegister dst,
   bailout(kUnsupportedArchitecture, "emit_i32x4replacelane");
 }
 
+void LiftoffAssembler::emit_i32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4neg");
+}
+
+void LiftoffAssembler::emit_v32x4_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v32x4_anytrue");
+}
+
+void LiftoffAssembler::emit_v32x4_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v32x4_alltrue");
+}
+
+void LiftoffAssembler::emit_i32x4_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "i32x4_shl");
+}
+
+void LiftoffAssembler::emit_i32x4_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  bailout(kSimd, "i32x4_shli");
+}
+
+void LiftoffAssembler::emit_i32x4_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i32x4_shr_s");
+}
+
+void LiftoffAssembler::emit_i32x4_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i32x4_shri_s");
+}
+
+void LiftoffAssembler::emit_i32x4_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i32x4_shr_u");
+}
+
+void LiftoffAssembler::emit_i32x4_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i32x4_shri_u");
+}
+
 void LiftoffAssembler::emit_i32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_i32x4add");
@@ -664,26 +829,145 @@ void LiftoffAssembler::emit_i32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
   bailout(kUnsupportedArchitecture, "emit_i32x4mul");
 }
 
+void LiftoffAssembler::emit_i32x4_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_min_s");
+}
+
+void LiftoffAssembler::emit_i32x4_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_min_u");
+}
+
+void LiftoffAssembler::emit_i32x4_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_max_s");
+}
+
+void LiftoffAssembler::emit_i32x4_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_max_u");
+}
+
 void LiftoffAssembler::emit_i16x8_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
   bailout(kUnsupportedArchitecture, "emit_i16x8splat");
 }
 
+void LiftoffAssembler::emit_i16x8_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8neg");
+}
+
+void LiftoffAssembler::emit_v16x8_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v16x8_anytrue");
+}
+
+void LiftoffAssembler::emit_v16x8_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v16x8_alltrue");
+}
+
+void LiftoffAssembler::emit_i16x8_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "i16x8_shl");
+}
+
+void LiftoffAssembler::emit_i16x8_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  bailout(kSimd, "i16x8_shli");
+}
+
+void LiftoffAssembler::emit_i16x8_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i16x8_shr_s");
+}
+
+void LiftoffAssembler::emit_i16x8_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i16x8_shri_s");
+}
+
+void LiftoffAssembler::emit_i16x8_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i16x8_shr_u");
+}
+
+void LiftoffAssembler::emit_i16x8_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i16x8_shri_u");
+}
+
 void LiftoffAssembler::emit_i16x8_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_i16x8add");
 }
 
+void LiftoffAssembler::emit_i16x8_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8addsaturate_s");
+}
+
 void LiftoffAssembler::emit_i16x8_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_i16x8sub");
 }
 
+void LiftoffAssembler::emit_i16x8_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8subsaturate_s");
+}
+
+void LiftoffAssembler::emit_i16x8_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8subsaturate_u");
+}
+
 void LiftoffAssembler::emit_i16x8_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_i16x8mul");
 }
 
+void LiftoffAssembler::emit_i16x8_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8addsaturate_u");
+}
+
+void LiftoffAssembler::emit_i16x8_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_min_s");
+}
+
+void LiftoffAssembler::emit_i16x8_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_min_u");
+}
+
+void LiftoffAssembler::emit_i16x8_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_max_s");
+}
+
+void LiftoffAssembler::emit_i16x8_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_max_u");
+}
+
 void LiftoffAssembler::emit_i16x8_extract_lane_u(LiftoffRegister dst,
                                                  LiftoffRegister lhs,
                                                  uint8_t imm_lane_idx) {
@@ -721,6 +1005,53 @@ void LiftoffAssembler::emit_i8x16_replace_lane(LiftoffRegister dst,
   bailout(kUnsupportedArchitecture, "emit_i8x16replacelane");
 }
 
+void LiftoffAssembler::emit_i8x16_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16neg");
+}
+
+void LiftoffAssembler::emit_v8x16_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v8x16_anytrue");
+}
+
+void LiftoffAssembler::emit_v8x16_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v8x16_alltrue");
+}
+
+void LiftoffAssembler::emit_i8x16_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "i8x16_shl");
+}
+
+void LiftoffAssembler::emit_i8x16_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  bailout(kSimd, "i8x16_shli");
+}
+
+void LiftoffAssembler::emit_i8x16_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i8x16_shr_s");
+}
+
+void LiftoffAssembler::emit_i8x16_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i8x16_shri_s");
+}
+
+void LiftoffAssembler::emit_i8x16_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i8x16_shr_u");
+}
+
+void LiftoffAssembler::emit_i8x16_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i8x16_shri_u");
+}
+
 void LiftoffAssembler::emit_i8x16_extract_lane_s(LiftoffRegister dst,
                                                  LiftoffRegister lhs,
                                                  uint8_t imm_lane_idx) {
@@ -732,16 +1063,337 @@ void LiftoffAssembler::emit_i8x16_add(LiftoffRegister dst, LiftoffRegister lhs,
   bailout(kUnsupportedArchitecture, "emit_i8x16add");
 }
 
+void LiftoffAssembler::emit_i8x16_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16addsaturate_s");
+}
+
+void LiftoffAssembler::emit_i8x16_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_min_s");
+}
+
+void LiftoffAssembler::emit_i8x16_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_min_u");
+}
+
+void LiftoffAssembler::emit_i8x16_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_max_s");
+}
+
+void LiftoffAssembler::emit_i8x16_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_max_u");
+}
+
+void LiftoffAssembler::emit_i8x16_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_eq");
+}
+
+void LiftoffAssembler::emit_i8x16_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_ne");
+}
+
+void LiftoffAssembler::emit_i8x16_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16gt_s");
+}
+
+void LiftoffAssembler::emit_i8x16_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16gt_u");
+}
+
+void LiftoffAssembler::emit_i8x16_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16ge_s");
+}
+
+void LiftoffAssembler::emit_i8x16_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16ge_u");
+}
+
+void LiftoffAssembler::emit_i16x8_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_eq");
+}
+
+void LiftoffAssembler::emit_i16x8_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_ne");
+}
+
+void LiftoffAssembler::emit_i16x8_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8gt_s");
+}
+
+void LiftoffAssembler::emit_i16x8_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8gt_u");
+}
+
+void LiftoffAssembler::emit_i16x8_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8ge_s");
+}
+
+void LiftoffAssembler::emit_i16x8_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8ge_u");
+}
+
+void LiftoffAssembler::emit_i32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_eq");
+}
+
+void LiftoffAssembler::emit_i32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_ne");
+}
+
+void LiftoffAssembler::emit_i32x4_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4gt_s");
+}
+
+void LiftoffAssembler::emit_i32x4_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_32x4gt_u");
+}
+
+void LiftoffAssembler::emit_i32x4_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4ge_s");
+}
+
+void LiftoffAssembler::emit_i32x4_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4ge_u");
+}
+
+void LiftoffAssembler::emit_f32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4_eq");
+}
+
+void LiftoffAssembler::emit_f32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4_ne");
+}
+
+void LiftoffAssembler::emit_f32x4_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4_lt");
+}
+
+void LiftoffAssembler::emit_f32x4_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4_le");
+}
+
+void LiftoffAssembler::emit_f64x2_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2_eq");
+}
+
+void LiftoffAssembler::emit_f64x2_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2_ne");
+}
+
+void LiftoffAssembler::emit_f64x2_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2_lt");
+}
+
+void LiftoffAssembler::emit_f64x2_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2_le");
+}
+
+void LiftoffAssembler::emit_s128_not(LiftoffRegister dst, LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_s128_not");
+}
+
+void LiftoffAssembler::emit_s128_and(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_s128_and");
+}
+
+void LiftoffAssembler::emit_s128_or(LiftoffRegister dst, LiftoffRegister lhs,
+                                    LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_s128_or");
+}
+
+void LiftoffAssembler::emit_s128_xor(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_s128_xor");
+}
+
+void LiftoffAssembler::emit_s128_select(LiftoffRegister dst,
+                                        LiftoffRegister src1,
+                                        LiftoffRegister src2,
+                                        LiftoffRegister mask) {
+  bailout(kUnsupportedArchitecture, "emit_s128select");
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  bailout(kSimd, "i32x4_sconvert_f32x4");
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  bailout(kSimd, "i32x4_uconvert_f32x4");
+}
+
+void LiftoffAssembler::emit_f32x4_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  bailout(kSimd, "f32x4_sconvert_i32x4");
+}
+
+void LiftoffAssembler::emit_f32x4_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  bailout(kSimd, "f32x4_uconvert_i32x4");
+}
+
+void LiftoffAssembler::emit_i8x16_sconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_sconvert_i16x8");
+}
+
+void LiftoffAssembler::emit_i8x16_uconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_uconvert_i16x8");
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_sconvert_i32x4");
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_uconvert_i32x4");
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_sconvert_i8x16_low");
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_sconvert_i8x16_high");
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_uconvert_i8x16_low");
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_uconvert_i8x16_high");
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_sconvert_i16x8_low");
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_sconvert_i16x8_high");
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_uconvert_i16x8_low");
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_uconvert_i16x8_high");
+}
+
+void LiftoffAssembler::emit_s128_and_not(LiftoffRegister dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_s128_and_not");
+}
+
+void LiftoffAssembler::emit_i8x16_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_rounding_average_u");
+}
+
+void LiftoffAssembler::emit_i16x8_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_rounding_average_u");
+}
+
+void LiftoffAssembler::emit_i8x16_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_abs");
+}
+
+void LiftoffAssembler::emit_i16x8_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_abs");
+}
+
+void LiftoffAssembler::emit_i32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_abs");
+}
+
 void LiftoffAssembler::emit_i8x16_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_i8x16sub");
 }
 
+void LiftoffAssembler::emit_i8x16_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16subsaturate_s");
+}
+
+void LiftoffAssembler::emit_i8x16_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16subsaturate_u");
+}
+
 void LiftoffAssembler::emit_i8x16_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_i8x16mul");
 }
 
+void LiftoffAssembler::emit_i8x16_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16addsaturate_u");
+}
+
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
   bailout(kUnsupportedArchitecture, "StackCheck");
 }
diff --git a/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h b/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h
index e311677e798..b90d3edc89d 100644
--- a/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h
+++ b/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h
@@ -26,7 +26,7 @@ namespace liftoff {
 //   1   | return addr (lr)   |
 //   0   | previous frame (fp)|
 //  -----+--------------------+  <-- frame ptr (fp)
-//  -1   | 0xa: WASM_COMPILED |
+//  -1   | 0xa: WASM          |
 //  -2   |     instance       |
 //  -----+--------------------+---------------------------
 //  -3   |    slot 0 (high)   |   ^
@@ -141,37 +141,38 @@ void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
 
 void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicAdd");
 }
 
 void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicSub");
 }
 
 void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicAnd");
 }
 
 void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
                                 uint32_t offset_imm, LiftoffRegister value,
-                                StoreType type) {
+                                LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicOr");
 }
 
 void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicXor");
 }
 
 void LiftoffAssembler::AtomicExchange(Register dst_addr, Register offset_reg,
                                       uint32_t offset_imm,
-                                      LiftoffRegister value, StoreType type) {
+                                      LiftoffRegister value,
+                                      LiftoffRegister result, StoreType type) {
   bailout(kAtomics, "AtomicExchange");
 }
 
@@ -190,6 +191,12 @@ void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
   bailout(kUnsupportedArchitecture, "LoadCallerFrameSlot");
 }
 
+void LiftoffAssembler::StoreCallerFrameSlot(LiftoffRegister src,
+                                            uint32_t caller_slot_idx,
+                                            ValueType type) {
+  bailout(kUnsupportedArchitecture, "StoreCallerFrameSlot");
+}
+
 void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
   bailout(kUnsupportedArchitecture, "MoveStackValue");
@@ -268,22 +275,22 @@ void LiftoffAssembler::FillStackSlotsWithZero(int start, int size) {
                                      Register rhs) {             \
     bailout(kUnsupportedArchitecture, "i32 binop: " #name);      \
   }
-#define UNIMPLEMENTED_I32_BINOP_I(name)                          \
-  UNIMPLEMENTED_I32_BINOP(name)                                  \
-  void LiftoffAssembler::emit_##name(Register dst, Register lhs, \
-                                     int32_t imm) {              \
-    bailout(kUnsupportedArchitecture, "i32 binop_i: " #name);    \
+#define UNIMPLEMENTED_I32_BINOP_I(name)                             \
+  UNIMPLEMENTED_I32_BINOP(name)                                     \
+  void LiftoffAssembler::emit_##name##i(Register dst, Register lhs, \
+                                        int32_t imm) {              \
+    bailout(kUnsupportedArchitecture, "i32 binop_i: " #name);       \
   }
 #define UNIMPLEMENTED_I64_BINOP(name)                                          \
   void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister lhs, \
                                      LiftoffRegister rhs) {                    \
     bailout(kUnsupportedArchitecture, "i64 binop: " #name);                    \
   }
-#define UNIMPLEMENTED_I64_BINOP_I(name)                                        \
-  UNIMPLEMENTED_I64_BINOP(name)                                                \
-  void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister lhs, \
-                                     int32_t imm) {                            \
-    bailout(kUnsupportedArchitecture, "i64 binop_i: " #name);                  \
+#define UNIMPLEMENTED_I64_BINOP_I(name)                                     \
+  UNIMPLEMENTED_I64_BINOP(name)                                             \
+  void LiftoffAssembler::emit_##name##i(LiftoffRegister dst,                \
+                                        LiftoffRegister lhs, int32_t imm) { \
+    bailout(kUnsupportedArchitecture, "i64 binop_i: " #name);               \
   }
 #define UNIMPLEMENTED_GP_UNOP(name)                                \
   void LiftoffAssembler::emit_##name(Register dst, Register src) { \
@@ -303,22 +310,22 @@ void LiftoffAssembler::FillStackSlotsWithZero(int start, int size) {
     bailout(kUnsupportedArchitecture, "fp unop: " #name);                      \
     return true;                                                               \
   }
-#define UNIMPLEMENTED_I32_SHIFTOP(name)                          \
-  void LiftoffAssembler::emit_##name(Register dst, Register src, \
-                                     Register amount) {          \
-    bailout(kUnsupportedArchitecture, "i32 shiftop: " #name);    \
-  }                                                              \
-  void LiftoffAssembler::emit_##name(Register dst, Register src, \
-                                     int32_t amount) {           \
-    bailout(kUnsupportedArchitecture, "i32 shiftop: " #name);    \
+#define UNIMPLEMENTED_I32_SHIFTOP(name)                             \
+  void LiftoffAssembler::emit_##name(Register dst, Register src,    \
+                                     Register amount) {             \
+    bailout(kUnsupportedArchitecture, "i32 shiftop: " #name);       \
+  }                                                                 \
+  void LiftoffAssembler::emit_##name##i(Register dst, Register src, \
+                                        int32_t amount) {           \
+    bailout(kUnsupportedArchitecture, "i32 shiftop: " #name);       \
   }
 #define UNIMPLEMENTED_I64_SHIFTOP(name)                                        \
   void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
                                      Register amount) {                        \
     bailout(kUnsupportedArchitecture, "i64 shiftop: " #name);                  \
   }                                                                            \
-  void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
-                                     int32_t amount) {                         \
+  void LiftoffAssembler::emit_##name##i(LiftoffRegister dst,                   \
+                                        LiftoffRegister src, int32_t amount) { \
     bailout(kUnsupportedArchitecture, "i64 shiftop: " #name);                  \
   }
 
@@ -536,6 +543,20 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   bailout(kUnsupportedArchitecture, "emit_f64_set_cond");
 }
 
+void LiftoffAssembler::LoadTransform(LiftoffRegister dst, Register src_addr,
+                                     Register offset_reg, uint32_t offset_imm,
+                                     LoadType type,
+                                     LoadTransformationKind transform,
+                                     uint32_t* protected_load_pc) {
+  bailout(kSimd, "Load transform unimplemented");
+}
+
+void LiftoffAssembler::emit_s8x16_swizzle(LiftoffRegister dst,
+                                          LiftoffRegister lhs,
+                                          LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_s8x16_swizzle");
+}
+
 void LiftoffAssembler::emit_f64x2_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
   bailout(kUnsupportedArchitecture, "emit_f64x2splat");
@@ -554,6 +575,21 @@ void LiftoffAssembler::emit_f64x2_replace_lane(LiftoffRegister dst,
   bailout(kUnsupportedArchitecture, "emit_f64x2replacelane");
 }
 
+void LiftoffAssembler::emit_f64x2_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2_abs");
+}
+
+void LiftoffAssembler::emit_f64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2neg");
+}
+
+void LiftoffAssembler::emit_f64x2_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2sqrt");
+}
+
 void LiftoffAssembler::emit_f64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_f64x2add");
@@ -569,6 +605,21 @@ void LiftoffAssembler::emit_f64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
   bailout(kUnsupportedArchitecture, "emit_f64x2mul");
 }
 
+void LiftoffAssembler::emit_f64x2_div(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2div");
+}
+
+void LiftoffAssembler::emit_f64x2_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2min");
+}
+
+void LiftoffAssembler::emit_f64x2_max(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2max");
+}
+
 void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
   bailout(kUnsupportedArchitecture, "emit_f32x4_splat");
@@ -587,6 +638,21 @@ void LiftoffAssembler::emit_f32x4_replace_lane(LiftoffRegister dst,
   bailout(kUnsupportedArchitecture, "emit_f32x4replacelane");
 }
 
+void LiftoffAssembler::emit_f32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4_abs");
+}
+
+void LiftoffAssembler::emit_f32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4neg");
+}
+
+void LiftoffAssembler::emit_f32x4_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4sqrt");
+}
+
 void LiftoffAssembler::emit_f32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_f32x4add");
@@ -602,6 +668,21 @@ void LiftoffAssembler::emit_f32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
   bailout(kUnsupportedArchitecture, "emit_f32x4mul");
 }
 
+void LiftoffAssembler::emit_f32x4_div(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4div");
+}
+
+void LiftoffAssembler::emit_f32x4_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4min");
+}
+
+void LiftoffAssembler::emit_f32x4_max(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4max");
+}
+
 void LiftoffAssembler::emit_i64x2_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
   bailout(kUnsupportedArchitecture, "emit_i64x2splat");
@@ -620,6 +701,43 @@ void LiftoffAssembler::emit_i64x2_replace_lane(LiftoffRegister dst,
   bailout(kUnsupportedArchitecture, "emit_i64x2replacelane");
 }
 
+void LiftoffAssembler::emit_i64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i64x2neg");
+}
+
+void LiftoffAssembler::emit_i64x2_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "i64x2_shl");
+}
+
+void LiftoffAssembler::emit_i64x2_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  bailout(kSimd, "i64x2_shli");
+}
+
+void LiftoffAssembler::emit_i64x2_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i64x2_shr_s");
+}
+
+void LiftoffAssembler::emit_i64x2_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i64x2_shri_s");
+}
+
+void LiftoffAssembler::emit_i64x2_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i64x2_shr_u");
+}
+
+void LiftoffAssembler::emit_i64x2_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i64x2_shri_u");
+}
+
 void LiftoffAssembler::emit_i64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_i64x2add");
@@ -653,6 +771,53 @@ void LiftoffAssembler::emit_i32x4_replace_lane(LiftoffRegister dst,
   bailout(kUnsupportedArchitecture, "emit_i32x4replacelane");
 }
 
+void LiftoffAssembler::emit_i32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4neg");
+}
+
+void LiftoffAssembler::emit_v32x4_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v32x4_anytrue");
+}
+
+void LiftoffAssembler::emit_v32x4_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v32x4_alltrue");
+}
+
+void LiftoffAssembler::emit_i32x4_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "i32x4_shl");
+}
+
+void LiftoffAssembler::emit_i32x4_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  bailout(kSimd, "i32x4_shli");
+}
+
+void LiftoffAssembler::emit_i32x4_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i32x4_shr_s");
+}
+
+void LiftoffAssembler::emit_i32x4_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i32x4_shri_s");
+}
+
+void LiftoffAssembler::emit_i32x4_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i32x4_shr_u");
+}
+
+void LiftoffAssembler::emit_i32x4_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i32x4_shri_u");
+}
+
 void LiftoffAssembler::emit_i32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_i32x4add");
@@ -668,26 +833,145 @@ void LiftoffAssembler::emit_i32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
   bailout(kUnsupportedArchitecture, "emit_i32x4mul");
 }
 
+void LiftoffAssembler::emit_i32x4_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_min_s");
+}
+
+void LiftoffAssembler::emit_i32x4_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_min_u");
+}
+
+void LiftoffAssembler::emit_i32x4_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_max_s");
+}
+
+void LiftoffAssembler::emit_i32x4_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_max_u");
+}
+
 void LiftoffAssembler::emit_i16x8_splat(LiftoffRegister dst,
                                         LiftoffRegister src) {
   bailout(kUnsupportedArchitecture, "emit_i16x8splat");
 }
 
+void LiftoffAssembler::emit_i16x8_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8neg");
+}
+
+void LiftoffAssembler::emit_v16x8_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v16x8_anytrue");
+}
+
+void LiftoffAssembler::emit_v16x8_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v16x8_alltrue");
+}
+
+void LiftoffAssembler::emit_i16x8_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "i16x8_shl");
+}
+
+void LiftoffAssembler::emit_i16x8_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  bailout(kSimd, "i16x8_shli");
+}
+
+void LiftoffAssembler::emit_i16x8_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i16x8_shr_s");
+}
+
+void LiftoffAssembler::emit_i16x8_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i16x8_shri_s");
+}
+
+void LiftoffAssembler::emit_i16x8_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i16x8_shr_u");
+}
+
+void LiftoffAssembler::emit_i16x8_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i16x8_shri_u");
+}
+
 void LiftoffAssembler::emit_i16x8_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_i16x8add");
 }
 
+void LiftoffAssembler::emit_i16x8_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8addsaturate_s");
+}
+
 void LiftoffAssembler::emit_i16x8_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_i16x8sub");
 }
 
+void LiftoffAssembler::emit_i16x8_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8subsaturate_s");
+}
+
+void LiftoffAssembler::emit_i16x8_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8subsaturate_u");
+}
+
 void LiftoffAssembler::emit_i16x8_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_i16x8mul");
 }
 
+void LiftoffAssembler::emit_i16x8_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8addsaturate_u");
+}
+
+void LiftoffAssembler::emit_i16x8_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_min_s");
+}
+
+void LiftoffAssembler::emit_i16x8_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_min_u");
+}
+
+void LiftoffAssembler::emit_i16x8_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_max_s");
+}
+
+void LiftoffAssembler::emit_i16x8_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_max_u");
+}
+
 void LiftoffAssembler::emit_i16x8_extract_lane_u(LiftoffRegister dst,
                                                  LiftoffRegister lhs,
                                                  uint8_t imm_lane_idx) {
@@ -731,21 +1015,389 @@ void LiftoffAssembler::emit_i8x16_replace_lane(LiftoffRegister dst,
   bailout(kUnsupportedArchitecture, "emit_i8x16replacelane");
 }
 
+void LiftoffAssembler::emit_i8x16_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16neg");
+}
+
+void LiftoffAssembler::emit_v8x16_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v8x16_anytrue");
+}
+
+void LiftoffAssembler::emit_v8x16_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  bailout(kSimd, "v8x16_alltrue");
+}
+
+void LiftoffAssembler::emit_i8x16_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  bailout(kSimd, "i8x16_shl");
+}
+
+void LiftoffAssembler::emit_i8x16_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  bailout(kSimd, "i8x16_shli");
+}
+
+void LiftoffAssembler::emit_i8x16_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i8x16_shr_s");
+}
+
+void LiftoffAssembler::emit_i8x16_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i8x16_shri_s");
+}
+
+void LiftoffAssembler::emit_i8x16_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kSimd, "i8x16_shr_u");
+}
+
+void LiftoffAssembler::emit_i8x16_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  bailout(kSimd, "i8x16_shri_u");
+}
+
 void LiftoffAssembler::emit_i8x16_add(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_i8x16add");
 }
 
+void LiftoffAssembler::emit_i8x16_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16addsaturate_s");
+}
+
 void LiftoffAssembler::emit_i8x16_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_i8x16sub");
 }
 
+void LiftoffAssembler::emit_i8x16_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16subsaturate_s");
+}
+
+void LiftoffAssembler::emit_i8x16_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16subsaturate_u");
+}
+
 void LiftoffAssembler::emit_i8x16_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
   bailout(kUnsupportedArchitecture, "emit_i8x16mul");
 }
 
+void LiftoffAssembler::emit_i8x16_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16addsaturate_u");
+}
+
+void LiftoffAssembler::emit_i8x16_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_min_s");
+}
+
+void LiftoffAssembler::emit_i8x16_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_min_u");
+}
+
+void LiftoffAssembler::emit_i8x16_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_max_s");
+}
+
+void LiftoffAssembler::emit_i8x16_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_max_u");
+}
+
+void LiftoffAssembler::emit_i8x16_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_eq");
+}
+
+void LiftoffAssembler::emit_i8x16_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_ne");
+}
+
+void LiftoffAssembler::emit_i8x16_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16gt_s");
+}
+
+void LiftoffAssembler::emit_i8x16_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16gt_u");
+}
+
+void LiftoffAssembler::emit_i8x16_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16ge_s");
+}
+
+void LiftoffAssembler::emit_i8x16_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16ge_u");
+}
+
+void LiftoffAssembler::emit_i16x8_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_eq");
+}
+
+void LiftoffAssembler::emit_i16x8_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_ne");
+}
+
+void LiftoffAssembler::emit_i16x8_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8gt_s");
+}
+
+void LiftoffAssembler::emit_i16x8_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8gt_u");
+}
+
+void LiftoffAssembler::emit_i16x8_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8ge_s");
+}
+
+void LiftoffAssembler::emit_i16x8_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8ge_u");
+}
+
+void LiftoffAssembler::emit_i32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_eq");
+}
+
+void LiftoffAssembler::emit_i32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_ne");
+}
+
+void LiftoffAssembler::emit_i32x4_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4gt_s");
+}
+
+void LiftoffAssembler::emit_i32x4_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4gt_u");
+}
+
+void LiftoffAssembler::emit_i32x4_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4ge_s");
+}
+
+void LiftoffAssembler::emit_i32x4_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4ge_u");
+}
+
+void LiftoffAssembler::emit_f32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4_eq");
+}
+
+void LiftoffAssembler::emit_f32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4_ne");
+}
+
+void LiftoffAssembler::emit_f32x4_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4_lt");
+}
+
+void LiftoffAssembler::emit_f32x4_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f32x4_le");
+}
+
+void LiftoffAssembler::emit_f64x2_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2_eq");
+}
+
+void LiftoffAssembler::emit_f64x2_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2_ne");
+}
+
+void LiftoffAssembler::emit_f64x2_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2_lt");
+}
+
+void LiftoffAssembler::emit_f64x2_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_f64x2_le");
+}
+
+void LiftoffAssembler::emit_s128_not(LiftoffRegister dst, LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_s128_not");
+}
+
+void LiftoffAssembler::emit_s128_and(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_s128_and");
+}
+
+void LiftoffAssembler::emit_s128_or(LiftoffRegister dst, LiftoffRegister lhs,
+                                    LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_s128_or");
+}
+
+void LiftoffAssembler::emit_s128_xor(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_s128_xor");
+}
+
+void LiftoffAssembler::emit_s128_select(LiftoffRegister dst,
+                                        LiftoffRegister src1,
+                                        LiftoffRegister src2,
+                                        LiftoffRegister mask) {
+  bailout(kUnsupportedArchitecture, "emit_s128select");
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  bailout(kSimd, "i32x4_sconvert_f32x4");
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  bailout(kSimd, "i32x4_uconvert_f32x4");
+}
+
+void LiftoffAssembler::emit_f32x4_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  bailout(kSimd, "f32x4_sconvert_i32x4");
+}
+
+void LiftoffAssembler::emit_f32x4_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  bailout(kSimd, "f32x4_uconvert_i32x4");
+}
+
+void LiftoffAssembler::emit_i8x16_sconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_sconvert_i16x8");
+}
+
+void LiftoffAssembler::emit_i8x16_uconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_uconvert_i16x8");
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_sconvert_i32x4");
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_uconvert_i32x4");
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_sconvert_i8x16_low");
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_sconvert_i8x16_high");
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_uconvert_i8x16_low");
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_uconvert_i8x16_high");
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_sconvert_i16x8_low");
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_sconvert_i16x8_high");
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_uconvert_i16x8_low");
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_uconvert_i16x8_high");
+}
+
+void LiftoffAssembler::emit_s128_and_not(LiftoffRegister dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_s128_and_not");
+}
+
+void LiftoffAssembler::emit_i8x16_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_rounding_average_u");
+}
+
+void LiftoffAssembler::emit_i16x8_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_rounding_average_u");
+}
+
+void LiftoffAssembler::emit_i8x16_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i8x16_abs");
+}
+
+void LiftoffAssembler::emit_i16x8_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i16x8_abs");
+}
+
+void LiftoffAssembler::emit_i32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  bailout(kUnsupportedArchitecture, "emit_i32x4_abs");
+}
+
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
   bailout(kUnsupportedArchitecture, "StackCheck");
 }
diff --git a/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h b/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h
index 6c586255366..2aa60977a2c 100644
--- a/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h
+++ b/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h
@@ -8,7 +8,6 @@
 #include "src/wasm/baseline/liftoff-assembler.h"
 
 #include "src/codegen/assembler.h"
-#include "src/wasm/value-type.h"
 
 namespace v8 {
 namespace internal {
@@ -36,7 +35,9 @@ static_assert((kLiftoffAssemblerFpCacheRegs &
 // rbp-8 holds the stack marker, rbp-16 is the instance parameter.
 constexpr int kInstanceOffset = 16;
 
-inline Operand GetStackSlot(int offset) { return Operand(rbp, -offset); }
+inline Operand GetStackSlot(int offset) {
+  return Operand(offset > 0 ? rbp : rsp, -offset);
+}
 
 // TODO(clemensb): Make this a constexpr variable once Operand is constexpr.
 inline Operand GetInstanceOperand() { return GetStackSlot(kInstanceOffset); }
@@ -122,13 +123,6 @@ inline void push(LiftoffAssembler* assm, LiftoffRegister reg, ValueType type) {
   }
 }
 
-template <typename... Regs>
-inline void SpillRegisters(LiftoffAssembler* assm, Regs... regs) {
-  for (LiftoffRegister r : {LiftoffRegister(regs)...}) {
-    if (assm->cache_state()->is_used(r)) assm->SpillRegister(r);
-  }
-}
-
 constexpr int kSubSpSize = 7;  // 7 bytes for "subq rsp, <imm32>"
 
 }  // namespace liftoff
@@ -311,8 +305,6 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
     case LoadType::kS128Load:
       Movdqu(dst.fp(), src_op);
       break;
-    default:
-      UNREACHABLE();
   }
 }
 
@@ -350,8 +342,6 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
     case StoreType::kS128Store:
       Movdqu(dst_op, src.fp());
       break;
-    default:
-      UNREACHABLE();
   }
 }
 
@@ -390,8 +380,15 @@ void LiftoffAssembler::AtomicStore(Register dst_addr, Register offset_reg,
 
 void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
-  DCHECK(!cache_state()->is_used(value));
+                                 LiftoffRegister result, StoreType type) {
+  DCHECK(!cache_state()->is_used(result));
+  if (cache_state()->is_used(value)) {
+    // We cannot overwrite {value}, but the {value} register is changed in the
+    // code we generate. Therefore we copy {value} to {result} and use the
+    // {result} register in the code below.
+    movq(result.gp(), value.gp());
+    value = result;
+  }
   if (emit_debug_code() && offset_reg != no_reg) {
     AssertZeroExtended(offset_reg);
   }
@@ -401,19 +398,25 @@ void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
     case StoreType::kI32Store8:
     case StoreType::kI64Store8:
       xaddb(dst_op, value.gp());
-      movzxbq(value.gp(), value.gp());
+      movzxbq(result.gp(), value.gp());
       break;
     case StoreType::kI32Store16:
     case StoreType::kI64Store16:
       xaddw(dst_op, value.gp());
-      movzxwq(value.gp(), value.gp());
+      movzxwq(result.gp(), value.gp());
       break;
     case StoreType::kI32Store:
     case StoreType::kI64Store32:
       xaddl(dst_op, value.gp());
+      if (value != result) {
+        movq(result.gp(), value.gp());
+      }
       break;
     case StoreType::kI64Store:
       xaddq(dst_op, value.gp());
+      if (value != result) {
+        movq(result.gp(), value.gp());
+      }
       break;
     default:
       UNREACHABLE();
@@ -422,8 +425,15 @@ void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
 
 void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
-  DCHECK(!cache_state()->is_used(value));
+                                 LiftoffRegister result, StoreType type) {
+  DCHECK(!cache_state()->is_used(result));
+  if (cache_state()->is_used(value)) {
+    // We cannot overwrite {value}, but the {value} register is changed in the
+    // code we generate. Therefore we copy {value} to {result} and use the
+    // {result} register in the code below.
+    movq(result.gp(), value.gp());
+    value = result;
+  }
   if (emit_debug_code() && offset_reg != no_reg) {
     AssertZeroExtended(offset_reg);
   }
@@ -434,25 +444,31 @@ void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
       negb(value.gp());
       lock();
       xaddb(dst_op, value.gp());
-      movzxbq(value.gp(), value.gp());
+      movzxbq(result.gp(), value.gp());
       break;
     case StoreType::kI32Store16:
     case StoreType::kI64Store16:
       negw(value.gp());
       lock();
       xaddw(dst_op, value.gp());
-      movzxwq(value.gp(), value.gp());
+      movzxwq(result.gp(), value.gp());
       break;
     case StoreType::kI32Store:
     case StoreType::kI64Store32:
       negl(value.gp());
       lock();
       xaddl(dst_op, value.gp());
+      if (value != result) {
+        movq(result.gp(), value.gp());
+      }
       break;
     case StoreType::kI64Store:
       negq(value.gp());
       lock();
       xaddq(dst_op, value.gp());
+      if (value != result) {
+        movq(result.gp(), value.gp());
+      }
       break;
     default:
       UNREACHABLE();
@@ -461,40 +477,21 @@ void LiftoffAssembler::AtomicSub(Register dst_addr, Register offset_reg,
 
 namespace liftoff {
 #define __ lasm->
-// Checks if a register in {possible_uses} uses {reg}. If so, it allocates a
-// replacement register for that use, and moves the content of {reg} to {use}.
-// The replacement register is written into the pointer stored in
-// {possible_uses}.
-inline void ClearRegister(LiftoffAssembler* lasm, Register reg,
-                          std::initializer_list<Register*> possible_uses,
-                          LiftoffRegList pinned) {
-  liftoff::SpillRegisters(lasm, reg);
-  Register replacement = no_reg;
-  for (Register* use : possible_uses) {
-    if (reg != *use) continue;
-    if (replacement == no_reg) {
-      replacement = __ GetUnusedRegister(kGpReg, pinned).gp();
-      __ movq(replacement, reg);
-    }
-    // We cannot leave this loop early. There may be multiple uses of {reg}.
-    *use = replacement;
-  }
-}
 
 inline void AtomicBinop(LiftoffAssembler* lasm,
                         void (Assembler::*opl)(Register, Register),
                         void (Assembler::*opq)(Register, Register),
                         Register dst_addr, Register offset_reg,
                         uint32_t offset_imm, LiftoffRegister value,
-                        StoreType type) {
-  DCHECK(!__ cache_state()->is_used(value));
+                        LiftoffRegister result, StoreType type) {
+  DCHECK(!__ cache_state()->is_used(result));
   Register value_reg = value.gp();
   // The cmpxchg instruction uses rax to store the old value of the
   // compare-exchange primitive. Therefore we have to spill the register and
   // move any use to another register.
   LiftoffRegList pinned =
       LiftoffRegList::ForRegs(dst_addr, offset_reg, value_reg);
-  ClearRegister(lasm, rax, {&dst_addr, &offset_reg, &value_reg}, pinned);
+  __ ClearRegister(rax, {&dst_addr, &offset_reg, &value_reg}, pinned);
   if (__ emit_debug_code() && offset_reg != no_reg) {
     __ AssertZeroExtended(offset_reg);
   }
@@ -554,8 +551,8 @@ inline void AtomicBinop(LiftoffAssembler* lasm,
       UNREACHABLE();
   }
 
-  if (value.gp() != rax) {
-    __ movq(value.gp(), rax);
+  if (result.gp() != rax) {
+    __ movq(result.gp(), rax);
   }
 }
 #undef __
@@ -563,29 +560,37 @@ inline void AtomicBinop(LiftoffAssembler* lasm,
 
 void LiftoffAssembler::AtomicAnd(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   liftoff::AtomicBinop(this, &Assembler::andl, &Assembler::andq, dst_addr,
-                       offset_reg, offset_imm, value, type);
+                       offset_reg, offset_imm, value, result, type);
 }
 
 void LiftoffAssembler::AtomicOr(Register dst_addr, Register offset_reg,
                                 uint32_t offset_imm, LiftoffRegister value,
-                                StoreType type) {
+                                LiftoffRegister result, StoreType type) {
   liftoff::AtomicBinop(this, &Assembler::orl, &Assembler::orq, dst_addr,
-                       offset_reg, offset_imm, value, type);
+                       offset_reg, offset_imm, value, result, type);
 }
 
 void LiftoffAssembler::AtomicXor(Register dst_addr, Register offset_reg,
                                  uint32_t offset_imm, LiftoffRegister value,
-                                 StoreType type) {
+                                 LiftoffRegister result, StoreType type) {
   liftoff::AtomicBinop(this, &Assembler::xorl, &Assembler::xorq, dst_addr,
-                       offset_reg, offset_imm, value, type);
+                       offset_reg, offset_imm, value, result, type);
 }
 
 void LiftoffAssembler::AtomicExchange(Register dst_addr, Register offset_reg,
                                       uint32_t offset_imm,
-                                      LiftoffRegister value, StoreType type) {
-  DCHECK(!cache_state()->is_used(value));
+                                      LiftoffRegister value,
+                                      LiftoffRegister result, StoreType type) {
+  DCHECK(!cache_state()->is_used(result));
+  if (cache_state()->is_used(value)) {
+    // We cannot overwrite {value}, but the {value} register is changed in the
+    // code we generate. Therefore we copy {value} to {result} and use the
+    // {result} register in the code below.
+    movq(result.gp(), value.gp());
+    value = result;
+  }
   if (emit_debug_code() && offset_reg != no_reg) {
     AssertZeroExtended(offset_reg);
   }
@@ -594,19 +599,25 @@ void LiftoffAssembler::AtomicExchange(Register dst_addr, Register offset_reg,
     case StoreType::kI32Store8:
     case StoreType::kI64Store8:
       xchgb(value.gp(), dst_op);
-      movzxbq(value.gp(), value.gp());
+      movzxbq(result.gp(), value.gp());
       break;
     case StoreType::kI32Store16:
     case StoreType::kI64Store16:
       xchgw(value.gp(), dst_op);
-      movzxwq(value.gp(), value.gp());
+      movzxwq(result.gp(), value.gp());
       break;
     case StoreType::kI32Store:
     case StoreType::kI64Store32:
       xchgl(value.gp(), dst_op);
+      if (value != result) {
+        movq(result.gp(), value.gp());
+      }
       break;
     case StoreType::kI64Store:
       xchgq(value.gp(), dst_op);
+      if (value != result) {
+        movq(result.gp(), value.gp());
+      }
       break;
     default:
       UNREACHABLE();
@@ -623,8 +634,7 @@ void LiftoffAssembler::AtomicCompareExchange(
   // move any use to another register.
   LiftoffRegList pinned =
       LiftoffRegList::ForRegs(dst_addr, offset_reg, expected, value_reg);
-  liftoff::ClearRegister(this, rax, {&dst_addr, &offset_reg, &value_reg},
-                         pinned);
+  ClearRegister(rax, {&dst_addr, &offset_reg, &value_reg}, pinned);
   if (expected.gp() != rax) {
     movq(rax, expected.gp());
   }
@@ -682,6 +692,13 @@ void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
   liftoff::Load(this, dst, src, type);
 }
 
+void LiftoffAssembler::StoreCallerFrameSlot(LiftoffRegister src,
+                                            uint32_t caller_slot_idx,
+                                            ValueType type) {
+  Operand dst(rbp, kSystemPointerSize * (caller_slot_idx + 1));
+  liftoff::Store(this, dst, src, type);
+}
+
 void LiftoffAssembler::MoveStackValue(uint32_t dst_offset, uint32_t src_offset,
                                       ValueType type) {
   DCHECK_NE(dst_offset, src_offset);
@@ -840,7 +857,7 @@ void LiftoffAssembler::emit_i32_add(Register dst, Register lhs, Register rhs) {
   }
 }
 
-void LiftoffAssembler::emit_i32_add(Register dst, Register lhs, int32_t imm) {
+void LiftoffAssembler::emit_i32_addi(Register dst, Register lhs, int32_t imm) {
   if (lhs != dst) {
     leal(dst, Operand(lhs, imm));
   } else {
@@ -916,7 +933,7 @@ void EmitIntDivOrRem(LiftoffAssembler* assm, Register dst, Register lhs,
   // another temporary register.
   // Do all this before any branch, such that the code is executed
   // unconditionally, as the cache state will also be modified unconditionally.
-  liftoff::SpillRegisters(assm, rdx, rax);
+  assm->SpillRegisters(rdx, rax);
   if (rhs == rax || rhs == rdx) {
     iop(mov, kScratchRegister, rhs);
     rhs = kScratchRegister;
@@ -1006,7 +1023,7 @@ void LiftoffAssembler::emit_i32_and(Register dst, Register lhs, Register rhs) {
                                                                     lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i32_and(Register dst, Register lhs, int32_t imm) {
+void LiftoffAssembler::emit_i32_andi(Register dst, Register lhs, int32_t imm) {
   liftoff::EmitCommutativeBinOpImm<&Assembler::andl, &Assembler::movl>(
       this, dst, lhs, imm);
 }
@@ -1016,7 +1033,7 @@ void LiftoffAssembler::emit_i32_or(Register dst, Register lhs, Register rhs) {
                                                                    lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i32_or(Register dst, Register lhs, int32_t imm) {
+void LiftoffAssembler::emit_i32_ori(Register dst, Register lhs, int32_t imm) {
   liftoff::EmitCommutativeBinOpImm<&Assembler::orl, &Assembler::movl>(this, dst,
                                                                       lhs, imm);
 }
@@ -1026,7 +1043,7 @@ void LiftoffAssembler::emit_i32_xor(Register dst, Register lhs, Register rhs) {
                                                                     lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i32_xor(Register dst, Register lhs, int32_t imm) {
+void LiftoffAssembler::emit_i32_xori(Register dst, Register lhs, int32_t imm) {
   liftoff::EmitCommutativeBinOpImm<&Assembler::xorl, &Assembler::movl>(
       this, dst, lhs, imm);
 }
@@ -1071,8 +1088,8 @@ void LiftoffAssembler::emit_i32_shl(Register dst, Register src,
                                                &Assembler::shll_cl);
 }
 
-void LiftoffAssembler::emit_i32_shl(Register dst, Register src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i32_shli(Register dst, Register src,
+                                     int32_t amount) {
   if (dst != src) movl(dst, src);
   shll(dst, Immediate(amount & 31));
 }
@@ -1083,8 +1100,8 @@ void LiftoffAssembler::emit_i32_sar(Register dst, Register src,
                                                &Assembler::sarl_cl);
 }
 
-void LiftoffAssembler::emit_i32_sar(Register dst, Register src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i32_sari(Register dst, Register src,
+                                     int32_t amount) {
   if (dst != src) movl(dst, src);
   sarl(dst, Immediate(amount & 31));
 }
@@ -1095,8 +1112,8 @@ void LiftoffAssembler::emit_i32_shr(Register dst, Register src,
                                                &Assembler::shrl_cl);
 }
 
-void LiftoffAssembler::emit_i32_shr(Register dst, Register src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i32_shri(Register dst, Register src,
+                                     int32_t amount) {
   if (dst != src) movl(dst, src);
   shrl(dst, Immediate(amount & 31));
 }
@@ -1125,8 +1142,8 @@ void LiftoffAssembler::emit_i64_add(LiftoffRegister dst, LiftoffRegister lhs,
   }
 }
 
-void LiftoffAssembler::emit_i64_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                    int32_t imm) {
+void LiftoffAssembler::emit_i64_addi(LiftoffRegister dst, LiftoffRegister lhs,
+                                     int32_t imm) {
   if (lhs.gp() != dst.gp()) {
     leaq(dst.gp(), Operand(lhs.gp(), imm));
   } else {
@@ -1191,8 +1208,8 @@ void LiftoffAssembler::emit_i64_and(LiftoffRegister dst, LiftoffRegister lhs,
       this, dst.gp(), lhs.gp(), rhs.gp());
 }
 
-void LiftoffAssembler::emit_i64_and(LiftoffRegister dst, LiftoffRegister lhs,
-                                    int32_t imm) {
+void LiftoffAssembler::emit_i64_andi(LiftoffRegister dst, LiftoffRegister lhs,
+                                     int32_t imm) {
   liftoff::EmitCommutativeBinOpImm<&Assembler::andq, &Assembler::movq>(
       this, dst.gp(), lhs.gp(), imm);
 }
@@ -1203,8 +1220,8 @@ void LiftoffAssembler::emit_i64_or(LiftoffRegister dst, LiftoffRegister lhs,
       this, dst.gp(), lhs.gp(), rhs.gp());
 }
 
-void LiftoffAssembler::emit_i64_or(LiftoffRegister dst, LiftoffRegister lhs,
-                                   int32_t imm) {
+void LiftoffAssembler::emit_i64_ori(LiftoffRegister dst, LiftoffRegister lhs,
+                                    int32_t imm) {
   liftoff::EmitCommutativeBinOpImm<&Assembler::orq, &Assembler::movq>(
       this, dst.gp(), lhs.gp(), imm);
 }
@@ -1215,8 +1232,8 @@ void LiftoffAssembler::emit_i64_xor(LiftoffRegister dst, LiftoffRegister lhs,
       this, dst.gp(), lhs.gp(), rhs.gp());
 }
 
-void LiftoffAssembler::emit_i64_xor(LiftoffRegister dst, LiftoffRegister lhs,
-                                    int32_t imm) {
+void LiftoffAssembler::emit_i64_xori(LiftoffRegister dst, LiftoffRegister lhs,
+                                     int32_t imm) {
   liftoff::EmitCommutativeBinOpImm<&Assembler::xorq, &Assembler::movq>(
       this, dst.gp(), lhs.gp(), imm);
 }
@@ -1227,8 +1244,8 @@ void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
                                                &Assembler::shlq_cl);
 }
 
-void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i64_shli(LiftoffRegister dst, LiftoffRegister src,
+                                     int32_t amount) {
   if (dst.gp() != src.gp()) movq(dst.gp(), src.gp());
   shlq(dst.gp(), Immediate(amount & 63));
 }
@@ -1239,8 +1256,8 @@ void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
                                                &Assembler::sarq_cl);
 }
 
-void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i64_sari(LiftoffRegister dst, LiftoffRegister src,
+                                     int32_t amount) {
   if (dst.gp() != src.gp()) movq(dst.gp(), src.gp());
   sarq(dst.gp(), Immediate(amount & 63));
 }
@@ -1251,8 +1268,8 @@ void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
                                                &Assembler::shrq_cl);
 }
 
-void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
-                                    int32_t amount) {
+void LiftoffAssembler::emit_i64_shri(LiftoffRegister dst, LiftoffRegister src,
+                                     int32_t amount) {
   if (dst != src) movq(dst.gp(), src.gp());
   shrq(dst.gp(), Immediate(amount & 63));
 }
@@ -1598,6 +1615,7 @@ void LiftoffAssembler::emit_f64_sqrt(DoubleRegister dst, DoubleRegister src) {
 }
 
 namespace liftoff {
+#define __ assm->
 // Used for float to int conversions. If the value in {converted_back} equals
 // {src} afterwards, the conversion succeeded.
 template <typename dst_type, typename src_type>
@@ -1606,29 +1624,29 @@ inline void ConvertFloatToIntAndBack(LiftoffAssembler* assm, Register dst,
                                      DoubleRegister converted_back) {
   if (std::is_same<double, src_type>::value) {  // f64
     if (std::is_same<int32_t, dst_type>::value) {  // f64 -> i32
-      assm->Cvttsd2si(dst, src);
-      assm->Cvtlsi2sd(converted_back, dst);
+      __ Cvttsd2si(dst, src);
+      __ Cvtlsi2sd(converted_back, dst);
     } else if (std::is_same<uint32_t, dst_type>::value) {  // f64 -> u32
-      assm->Cvttsd2siq(dst, src);
-      assm->movl(dst, dst);
-      assm->Cvtqsi2sd(converted_back, dst);
+      __ Cvttsd2siq(dst, src);
+      __ movl(dst, dst);
+      __ Cvtqsi2sd(converted_back, dst);
     } else if (std::is_same<int64_t, dst_type>::value) {  // f64 -> i64
-      assm->Cvttsd2siq(dst, src);
-      assm->Cvtqsi2sd(converted_back, dst);
+      __ Cvttsd2siq(dst, src);
+      __ Cvtqsi2sd(converted_back, dst);
     } else {
       UNREACHABLE();
     }
   } else {                                  // f32
     if (std::is_same<int32_t, dst_type>::value) {  // f32 -> i32
-      assm->Cvttss2si(dst, src);
-      assm->Cvtlsi2ss(converted_back, dst);
+      __ Cvttss2si(dst, src);
+      __ Cvtlsi2ss(converted_back, dst);
     } else if (std::is_same<uint32_t, dst_type>::value) {  // f32 -> u32
-      assm->Cvttss2siq(dst, src);
-      assm->movl(dst, dst);
-      assm->Cvtqsi2ss(converted_back, dst);
+      __ Cvttss2siq(dst, src);
+      __ movl(dst, dst);
+      __ Cvtqsi2ss(converted_back, dst);
     } else if (std::is_same<int64_t, dst_type>::value) {  // f32 -> i64
-      assm->Cvttss2siq(dst, src);
-      assm->Cvtqsi2ss(converted_back, dst);
+      __ Cvttss2siq(dst, src);
+      __ Cvtqsi2ss(converted_back, dst);
     } else {
       UNREACHABLE();
     }
@@ -1639,7 +1657,7 @@ template <typename dst_type, typename src_type>
 inline bool EmitTruncateFloatToInt(LiftoffAssembler* assm, Register dst,
                                    DoubleRegister src, Label* trap) {
   if (!CpuFeatures::IsSupported(SSE4_1)) {
-    assm->bailout(kMissingCPUFeature, "no SSE4.1");
+    __ bailout(kMissingCPUFeature, "no SSE4.1");
     return true;
   }
   CpuFeatureScope feature(assm, SSE4_1);
@@ -1648,24 +1666,143 @@ inline bool EmitTruncateFloatToInt(LiftoffAssembler* assm, Register dst,
   DoubleRegister converted_back = kScratchDoubleReg2;
 
   if (std::is_same<double, src_type>::value) {  // f64
-    assm->Roundsd(rounded, src, kRoundToZero);
+    __ Roundsd(rounded, src, kRoundToZero);
   } else {  // f32
-    assm->Roundss(rounded, src, kRoundToZero);
+    __ Roundss(rounded, src, kRoundToZero);
   }
   ConvertFloatToIntAndBack<dst_type, src_type>(assm, dst, rounded,
                                                converted_back);
   if (std::is_same<double, src_type>::value) {  // f64
-    assm->Ucomisd(converted_back, rounded);
+    __ Ucomisd(converted_back, rounded);
   } else {  // f32
-    assm->Ucomiss(converted_back, rounded);
+    __ Ucomiss(converted_back, rounded);
   }
 
   // Jump to trap if PF is 0 (one of the operands was NaN) or they are not
   // equal.
-  assm->j(parity_even, trap);
-  assm->j(not_equal, trap);
+  __ j(parity_even, trap);
+  __ j(not_equal, trap);
+  return true;
+}
+
+template <typename dst_type, typename src_type>
+inline bool EmitSatTruncateFloatToInt(LiftoffAssembler* assm, Register dst,
+                                      DoubleRegister src) {
+  if (!CpuFeatures::IsSupported(SSE4_1)) {
+    __ bailout(kMissingCPUFeature, "no SSE4.1");
+    return true;
+  }
+  CpuFeatureScope feature(assm, SSE4_1);
+
+  Label done;
+  Label not_nan;
+  Label src_positive;
+
+  DoubleRegister rounded = kScratchDoubleReg;
+  DoubleRegister converted_back = kScratchDoubleReg2;
+  DoubleRegister zero_reg = kScratchDoubleReg;
+
+  if (std::is_same<double, src_type>::value) {  // f64
+    __ Roundsd(rounded, src, kRoundToZero);
+  } else {  // f32
+    __ Roundss(rounded, src, kRoundToZero);
+  }
+
+  ConvertFloatToIntAndBack<dst_type, src_type>(assm, dst, rounded,
+                                               converted_back);
+  if (std::is_same<double, src_type>::value) {  // f64
+    __ Ucomisd(converted_back, rounded);
+  } else {  // f32
+    __ Ucomiss(converted_back, rounded);
+  }
+
+  // Return 0 if PF is 0 (one of the operands was NaN)
+  __ j(parity_odd, &not_nan);
+  __ xorl(dst, dst);
+  __ jmp(&done);
+
+  __ bind(&not_nan);
+  // If rounding is as expected, return result
+  __ j(equal, &done);
+
+  __ xorpd(zero_reg, zero_reg);
+
+  // if out-of-bounds, check if src is positive
+  if (std::is_same<double, src_type>::value) {  // f64
+    __ Ucomisd(src, zero_reg);
+  } else {  // f32
+    __ Ucomiss(src, zero_reg);
+  }
+  __ j(above, &src_positive);
+  if (std::is_same<int32_t, dst_type>::value ||
+      std::is_same<uint32_t, dst_type>::value) {  // i32
+    __ movl(
+        dst,
+        Immediate(static_cast<int32_t>(std::numeric_limits<dst_type>::min())));
+  } else if (std::is_same<int64_t, dst_type>::value) {  // i64s
+    __ movq(dst, Immediate64(std::numeric_limits<dst_type>::min()));
+  } else {
+    UNREACHABLE();
+  }
+  __ jmp(&done);
+
+  __ bind(&src_positive);
+  if (std::is_same<int32_t, dst_type>::value ||
+      std::is_same<uint32_t, dst_type>::value) {  // i32
+    __ movl(
+        dst,
+        Immediate(static_cast<int32_t>(std::numeric_limits<dst_type>::max())));
+  } else if (std::is_same<int64_t, dst_type>::value) {  // i64s
+    __ movq(dst, Immediate64(std::numeric_limits<dst_type>::max()));
+  } else {
+    UNREACHABLE();
+  }
+
+  __ bind(&done);
+  return true;
+}
+
+template <typename src_type>
+inline bool EmitSatTruncateFloatToUInt64(LiftoffAssembler* assm, Register dst,
+                                         DoubleRegister src) {
+  if (!CpuFeatures::IsSupported(SSE4_1)) {
+    __ bailout(kMissingCPUFeature, "no SSE4.1");
+    return true;
+  }
+  CpuFeatureScope feature(assm, SSE4_1);
+
+  Label done;
+  Label neg_or_nan;
+  Label overflow;
+
+  DoubleRegister zero_reg = kScratchDoubleReg;
+
+  __ xorpd(zero_reg, zero_reg);
+  if (std::is_same<double, src_type>::value) {  // f64
+    __ Ucomisd(src, zero_reg);
+  } else {  // f32
+    __ Ucomiss(src, zero_reg);
+  }
+  // Check if NaN
+  __ j(parity_even, &neg_or_nan);
+  __ j(below, &neg_or_nan);
+  if (std::is_same<double, src_type>::value) {  // f64
+    __ Cvttsd2uiq(dst, src, &overflow);
+  } else {  // f32
+    __ Cvttss2uiq(dst, src, &overflow);
+  }
+  __ jmp(&done);
+
+  __ bind(&neg_or_nan);
+  __ movq(dst, zero_reg);
+  __ jmp(&done);
+
+  __ bind(&overflow);
+  __ movq(dst, Immediate64(std::numeric_limits<uint64_t>::max()));
+  __ bind(&done);
   return true;
 }
+#undef __
 }  // namespace liftoff
 
 bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
@@ -1687,6 +1824,18 @@ bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
     case kExprI32UConvertF64:
       return liftoff::EmitTruncateFloatToInt<uint32_t, double>(this, dst.gp(),
                                                                src.fp(), trap);
+    case kExprI32SConvertSatF32:
+      return liftoff::EmitSatTruncateFloatToInt<int32_t, float>(this, dst.gp(),
+                                                                src.fp());
+    case kExprI32UConvertSatF32:
+      return liftoff::EmitSatTruncateFloatToInt<uint32_t, float>(this, dst.gp(),
+                                                                 src.fp());
+    case kExprI32SConvertSatF64:
+      return liftoff::EmitSatTruncateFloatToInt<int32_t, double>(this, dst.gp(),
+                                                                 src.fp());
+    case kExprI32UConvertSatF64:
+      return liftoff::EmitSatTruncateFloatToInt<uint32_t, double>(
+          this, dst.gp(), src.fp());
     case kExprI32ReinterpretF32:
       Movd(dst.gp(), src.fp());
       return true;
@@ -1709,6 +1858,20 @@ bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
       Cvttsd2uiq(dst.gp(), src.fp(), trap);
       return true;
     }
+    case kExprI64SConvertSatF32:
+      return liftoff::EmitSatTruncateFloatToInt<int64_t, float>(this, dst.gp(),
+                                                                src.fp());
+    case kExprI64UConvertSatF32: {
+      return liftoff::EmitSatTruncateFloatToUInt64<float>(this, dst.gp(),
+                                                          src.fp());
+    }
+    case kExprI64SConvertSatF64:
+      return liftoff::EmitSatTruncateFloatToInt<int64_t, double>(this, dst.gp(),
+                                                                 src.fp());
+    case kExprI64UConvertSatF64: {
+      return liftoff::EmitSatTruncateFloatToUInt64<double>(this, dst.gp(),
+                                                           src.fp());
+    }
     case kExprI64UConvertI32:
       AssertZeroExtended(src.gp());
       if (dst.gp() != src.gp()) movl(dst.gp(), src.gp());
@@ -1900,14 +2063,19 @@ void EmitSimdCommutativeBinOp(
 
 template <void (Assembler::*avx_op)(XMMRegister, XMMRegister, XMMRegister),
           void (Assembler::*sse_op)(XMMRegister, XMMRegister)>
-void EmitSimdSub(LiftoffAssembler* assm, LiftoffRegister dst,
-                 LiftoffRegister lhs, LiftoffRegister rhs) {
+void EmitSimdNonCommutativeBinOp(
+    LiftoffAssembler* assm, LiftoffRegister dst, LiftoffRegister lhs,
+    LiftoffRegister rhs, base::Optional<CpuFeature> feature = base::nullopt) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(assm, AVX);
     (assm->*avx_op)(dst.fp(), lhs.fp(), rhs.fp());
-  } else if (lhs.fp() == rhs.fp()) {
-    assm->pxor(dst.fp(), dst.fp());
-  } else if (dst.fp() == rhs.fp()) {
+    return;
+  }
+
+  base::Optional<CpuFeatureScope> sse_scope;
+  if (feature.has_value()) sse_scope.emplace(assm, *feature);
+
+  if (dst.fp() == rhs.fp()) {
     assm->movaps(kScratchDoubleReg, rhs.fp());
     assm->movaps(dst.fp(), lhs.fp());
     (assm->*sse_op)(dst.fp(), kScratchDoubleReg);
@@ -1916,58 +2084,202 @@ void EmitSimdSub(LiftoffAssembler* assm, LiftoffRegister dst,
     (assm->*sse_op)(dst.fp(), rhs.fp());
   }
 }
-}  // namespace liftoff
 
-void LiftoffAssembler::emit_f64x2_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  Movddup(dst.fp(), src.fp());
+template <void (Assembler::*avx_op)(XMMRegister, XMMRegister, XMMRegister),
+          void (Assembler::*sse_op)(XMMRegister, XMMRegister), uint8_t width>
+void EmitSimdShiftOp(LiftoffAssembler* assm, LiftoffRegister dst,
+                     LiftoffRegister operand, LiftoffRegister count) {
+  constexpr int mask = (1 << width) - 1;
+  assm->movq(kScratchRegister, count.gp());
+  assm->andq(kScratchRegister, Immediate(mask));
+  assm->Movq(kScratchDoubleReg, kScratchRegister);
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(assm, AVX);
+    (assm->*avx_op)(dst.fp(), operand.fp(), kScratchDoubleReg);
+  } else {
+    if (dst.fp() != operand.fp()) assm->movaps(dst.fp(), operand.fp());
+    (assm->*sse_op)(dst.fp(), kScratchDoubleReg);
+  }
 }
 
-void LiftoffAssembler::emit_f64x2_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
-  Pextrq(kScratchRegister, lhs.fp(), static_cast<int8_t>(imm_lane_idx));
-  Movq(dst.fp(), kScratchRegister);
+template <void (Assembler::*avx_op)(XMMRegister, XMMRegister, byte),
+          void (Assembler::*sse_op)(XMMRegister, byte), uint8_t width>
+void EmitSimdShiftOpImm(LiftoffAssembler* assm, LiftoffRegister dst,
+                        LiftoffRegister operand, int32_t count) {
+  constexpr int mask = (1 << width) - 1;
+  byte shift = static_cast<byte>(count & mask);
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(assm, AVX);
+    (assm->*avx_op)(dst.fp(), operand.fp(), shift);
+  } else {
+    if (dst.fp() != operand.fp()) assm->movaps(dst.fp(), operand.fp());
+    (assm->*sse_op)(dst.fp(), shift);
+  }
+}
+
+template <bool is_signed>
+void EmitI8x16Shr(LiftoffAssembler* assm, LiftoffRegister dst,
+                  LiftoffRegister lhs, LiftoffRegister rhs) {
+  // Same algorithm as the one in code-generator-x64.cc.
+  assm->Punpckhbw(kScratchDoubleReg, lhs.fp());
+  assm->Punpcklbw(dst.fp(), lhs.fp());
+  // Prepare shift value
+  assm->movq(kScratchRegister, rhs.gp());
+  // Take shift value modulo 8.
+  assm->andq(kScratchRegister, Immediate(7));
+  assm->addq(kScratchRegister, Immediate(8));
+  assm->Movq(liftoff::kScratchDoubleReg2, kScratchRegister);
+  if (is_signed) {
+    assm->Psraw(kScratchDoubleReg, liftoff::kScratchDoubleReg2);
+    assm->Psraw(dst.fp(), liftoff::kScratchDoubleReg2);
+    assm->Packsswb(dst.fp(), kScratchDoubleReg);
+  } else {
+    assm->Psrlw(kScratchDoubleReg, liftoff::kScratchDoubleReg2);
+    assm->Psrlw(dst.fp(), liftoff::kScratchDoubleReg2);
+    assm->Packuswb(dst.fp(), kScratchDoubleReg);
+  }
+}
+
+// Can be used by both the immediate and register version of the shifts. psraq
+// is only available in AVX512, so we can't use it yet.
+template <typename ShiftOperand>
+void EmitI64x2ShrS(LiftoffAssembler* assm, LiftoffRegister dst,
+                   LiftoffRegister lhs, ShiftOperand rhs,
+                   bool shift_is_rcx = false) {
+  bool restore_rcx = false;
+  if (!shift_is_rcx) {
+    if (assm->cache_state()->is_used(LiftoffRegister(rcx))) {
+      restore_rcx = true;
+      assm->movq(kScratchRegister, rcx);
+    }
+    assm->movl(rcx, rhs);
+  }
+
+  Register tmp = kScratchRegister;
+
+  assm->Pextrq(tmp, lhs.fp(), int8_t{0x0});
+  assm->sarq_cl(tmp);
+  assm->Pinsrq(dst.fp(), tmp, int8_t{0x0});
+
+  assm->Pextrq(tmp, lhs.fp(), int8_t{0x1});
+  assm->sarq_cl(tmp);
+  assm->Pinsrq(dst.fp(), tmp, int8_t{0x1});
+
+  // restore rcx.
+  if (restore_rcx) {
+    assm->movq(rcx, kScratchRegister);
+  }
 }
 
-void LiftoffAssembler::emit_f64x2_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    if (imm_lane_idx == 0) {
-      vpblendw(dst.fp(), src1.fp(), src2.fp(), 0b00001111);
-    } else {
-      vmovlhps(dst.fp(), src1.fp(), src2.fp());
+inline void EmitAnyTrue(LiftoffAssembler* assm, LiftoffRegister dst,
+                        LiftoffRegister src) {
+  assm->xorq(dst.gp(), dst.gp());
+  assm->Ptest(src.fp(), src.fp());
+  assm->setcc(not_equal, dst.gp());
+}
+
+template <void (TurboAssembler::*pcmp)(XMMRegister, XMMRegister)>
+inline void EmitAllTrue(LiftoffAssembler* assm, LiftoffRegister dst,
+                        LiftoffRegister src) {
+  XMMRegister tmp = kScratchDoubleReg;
+  assm->xorq(dst.gp(), dst.gp());
+  assm->Pxor(tmp, tmp);
+  (assm->*pcmp)(tmp, src.fp());
+  assm->Ptest(tmp, tmp);
+  assm->setcc(equal, dst.gp());
+}
+
+}  // namespace liftoff
+
+void LiftoffAssembler::LoadTransform(LiftoffRegister dst, Register src_addr,
+                                     Register offset_reg, uint32_t offset_imm,
+                                     LoadType type,
+                                     LoadTransformationKind transform,
+                                     uint32_t* protected_load_pc) {
+  if (emit_debug_code() && offset_reg != no_reg) {
+    AssertZeroExtended(offset_reg);
+  }
+  Operand src_op = liftoff::GetMemOp(this, src_addr, offset_reg, offset_imm);
+  *protected_load_pc = pc_offset();
+  MachineType memtype = type.mem_type();
+  if (transform == LoadTransformationKind::kExtend) {
+    if (memtype == MachineType::Int8()) {
+      Pmovsxbw(dst.fp(), src_op);
+    } else if (memtype == MachineType::Uint8()) {
+      Pmovzxbw(dst.fp(), src_op);
+    } else if (memtype == MachineType::Int16()) {
+      Pmovsxwd(dst.fp(), src_op);
+    } else if (memtype == MachineType::Uint16()) {
+      Pmovzxwd(dst.fp(), src_op);
+    } else if (memtype == MachineType::Int32()) {
+      Pmovsxdq(dst.fp(), src_op);
+    } else if (memtype == MachineType::Uint32()) {
+      Pmovzxdq(dst.fp(), src_op);
     }
   } else {
-    CpuFeatureScope scope(this, SSE4_1);
-    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
-    if (imm_lane_idx == 0) {
-      pblendw(dst.fp(), src2.fp(), 0b00001111);
-    } else {
-      movlhps(dst.fp(), src2.fp());
+    DCHECK_EQ(LoadTransformationKind::kSplat, transform);
+    if (memtype == MachineType::Int8()) {
+      Pinsrb(dst.fp(), src_op, 0);
+      Pxor(kScratchDoubleReg, kScratchDoubleReg);
+      Pshufb(dst.fp(), kScratchDoubleReg);
+    } else if (memtype == MachineType::Int16()) {
+      Pinsrw(dst.fp(), src_op, 0);
+      Pshuflw(dst.fp(), dst.fp(), uint8_t{0});
+      Punpcklqdq(dst.fp(), dst.fp());
+    } else if (memtype == MachineType::Int32()) {
+      if (CpuFeatures::IsSupported(AVX)) {
+        CpuFeatureScope avx_scope(this, AVX);
+        vbroadcastss(dst.fp(), src_op);
+      } else {
+        Movss(dst.fp(), src_op);
+        Shufps(dst.fp(), dst.fp(), byte{0});
+      }
+    } else if (memtype == MachineType::Int64()) {
+      Movddup(dst.fp(), src_op);
     }
   }
 }
 
-void LiftoffAssembler::emit_f64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vaddpd, &Assembler::addpd>(
-      this, dst, lhs, rhs);
+void LiftoffAssembler::emit_s8x16_swizzle(LiftoffRegister dst,
+                                          LiftoffRegister lhs,
+                                          LiftoffRegister rhs) {
+  XMMRegister mask =
+      GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(lhs, rhs)).fp();
+  // Out-of-range indices should return 0, add 112 (0x70) so that any value > 15
+  // saturates to 128 (top bit set), so pshufb will zero that lane.
+  TurboAssembler::Move(mask, uint32_t{0x70707070});
+  Pshufd(mask, mask, uint8_t{0x0});
+  Paddusb(mask, rhs.fp());
+  if (lhs != dst) {
+    Movaps(dst.fp(), lhs.fp());
+  }
+  Pshufb(dst.fp(), mask);
 }
 
-void LiftoffAssembler::emit_f64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdSub<&Assembler::vsubpd, &Assembler::subpd>(this, dst, lhs,
-                                                              rhs);
+void LiftoffAssembler::emit_i8x16_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  Movd(dst.fp(), src.gp());
+  Pxor(kScratchDoubleReg, kScratchDoubleReg);
+  Pshufb(dst.fp(), kScratchDoubleReg);
 }
 
-void LiftoffAssembler::emit_f64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vmulpd, &Assembler::mulpd>(
-      this, dst, lhs, rhs);
+void LiftoffAssembler::emit_i16x8_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  Movd(dst.fp(), src.gp());
+  Pshuflw(dst.fp(), dst.fp(), static_cast<uint8_t>(0));
+  Pshufd(dst.fp(), dst.fp(), static_cast<uint8_t>(0));
+}
+
+void LiftoffAssembler::emit_i32x4_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  Movd(dst.fp(), src.gp());
+  Pshufd(dst.fp(), dst.fp(), static_cast<uint8_t>(0));
+}
+
+void LiftoffAssembler::emit_i64x2_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  Movq(dst.fp(), src.gp());
+  Movddup(dst.fp(), dst.fp());
 }
 
 void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
@@ -1978,242 +2290,392 @@ void LiftoffAssembler::emit_f32x4_splat(LiftoffRegister dst,
   Shufps(dst.fp(), src.fp(), static_cast<byte>(0));
 }
 
-void LiftoffAssembler::emit_f32x4_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vshufps(dst.fp(), lhs.fp(), lhs.fp(), imm_lane_idx);
-  } else {
-    if (dst.fp() != lhs.fp()) movaps(dst.fp(), lhs.fp());
-    if (imm_lane_idx != 0) shufps(dst.fp(), dst.fp(), imm_lane_idx);
-  }
+void LiftoffAssembler::emit_f64x2_splat(LiftoffRegister dst,
+                                        LiftoffRegister src) {
+  Movddup(dst.fp(), src.fp());
 }
 
-void LiftoffAssembler::emit_f32x4_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vinsertps(dst.fp(), src1.fp(), src2.fp(), (imm_lane_idx << 4) & 0x30);
-  } else {
-    CpuFeatureScope scope(this, SSE4_1);
-    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
-    insertps(dst.fp(), src2.fp(), (imm_lane_idx << 4) & 0x30);
-  }
+void LiftoffAssembler::emit_i8x16_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpcmpeqb, &Assembler::pcmpeqb>(
+      this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_f32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vaddps, &Assembler::addps>(
+void LiftoffAssembler::emit_i8x16_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpcmpeqb, &Assembler::pcmpeqb>(
       this, dst, lhs, rhs);
+  Pcmpeqb(kScratchDoubleReg, kScratchDoubleReg);
+  Pxor(dst.fp(), kScratchDoubleReg);
 }
 
-void LiftoffAssembler::emit_f32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdSub<&Assembler::vsubps, &Assembler::subps>(this, dst, lhs,
-                                                              rhs);
+void LiftoffAssembler::emit_i8x16_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpcmpgtb,
+                                       &Assembler::pcmpgtb>(this, dst, lhs,
+                                                            rhs);
 }
 
-void LiftoffAssembler::emit_f32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vmulps, &Assembler::mulps>(
+void LiftoffAssembler::emit_i8x16_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(kScratchDoubleReg, rhs.fp());
+    ref = kScratchDoubleReg;
+  }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxub, &Assembler::pmaxub>(
       this, dst, lhs, rhs);
+  Pcmpeqb(dst.fp(), ref);
+  Pcmpeqb(kScratchDoubleReg, kScratchDoubleReg);
+  Pxor(dst.fp(), kScratchDoubleReg);
 }
 
-void LiftoffAssembler::emit_i64x2_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  Movq(dst.fp(), src.gp());
-  Movddup(dst.fp(), dst.fp());
+void LiftoffAssembler::emit_i8x16_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(kScratchDoubleReg, rhs.fp());
+    ref = kScratchDoubleReg;
+  }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminsb, &Assembler::pminsb>(
+      this, dst, lhs, rhs, SSE4_1);
+  Pcmpeqb(dst.fp(), ref);
 }
 
-void LiftoffAssembler::emit_i64x2_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
-  Pextrq(dst.gp(), lhs.fp(), static_cast<int8_t>(imm_lane_idx));
+void LiftoffAssembler::emit_i8x16_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(kScratchDoubleReg, rhs.fp());
+    ref = kScratchDoubleReg;
+  }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminub, &Assembler::pminub>(
+      this, dst, lhs, rhs);
+  Pcmpeqb(dst.fp(), ref);
 }
 
-void LiftoffAssembler::emit_i64x2_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vpinsrq(dst.fp(), src1.fp(), src2.gp(), imm_lane_idx);
-  } else {
-    CpuFeatureScope scope(this, SSE4_1);
-    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
-    pinsrq(dst.fp(), src2.gp(), imm_lane_idx);
-  }
+void LiftoffAssembler::emit_i16x8_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpcmpeqw, &Assembler::pcmpeqw>(
+      this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddq, &Assembler::paddq>(
+void LiftoffAssembler::emit_i16x8_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpcmpeqw, &Assembler::pcmpeqw>(
       this, dst, lhs, rhs);
+  Pcmpeqw(kScratchDoubleReg, kScratchDoubleReg);
+  Pxor(dst.fp(), kScratchDoubleReg);
 }
 
-void LiftoffAssembler::emit_i64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdSub<&Assembler::vpsubq, &Assembler::psubq>(this, dst, lhs,
-                                                              rhs);
+void LiftoffAssembler::emit_i16x8_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpcmpgtw,
+                                       &Assembler::pcmpgtw>(this, dst, lhs,
+                                                            rhs);
 }
 
-void LiftoffAssembler::emit_i64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  static constexpr RegClass tmp_rc = reg_class_for(ValueType::kS128);
-  LiftoffRegister tmp1 =
-      GetUnusedRegister(tmp_rc, LiftoffRegList::ForRegs(dst, lhs, rhs));
-  LiftoffRegister tmp2 =
-      GetUnusedRegister(tmp_rc, LiftoffRegList::ForRegs(dst, lhs, rhs, tmp1));
-  Movaps(tmp1.fp(), lhs.fp());
-  Movaps(tmp2.fp(), rhs.fp());
-  // Multiply high dword of each qword of left with right.
-  Psrlq(tmp1.fp(), 32);
-  Pmuludq(tmp1.fp(), rhs.fp());
-  // Multiply high dword of each qword of right with left.
-  Psrlq(tmp2.fp(), 32);
-  Pmuludq(tmp2.fp(), lhs.fp());
-  Paddq(tmp2.fp(), tmp1.fp());
-  Psllq(tmp2.fp(), 32);
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vpmuludq(dst.fp(), lhs.fp(), rhs.fp());
-  } else {
-    if (dst.fp() != lhs.fp()) movaps(dst.fp(), lhs.fp());
-    pmuludq(dst.fp(), rhs.fp());
+void LiftoffAssembler::emit_i16x8_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(kScratchDoubleReg, rhs.fp());
+    ref = kScratchDoubleReg;
   }
-  Paddq(dst.fp(), tmp2.fp());
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxuw, &Assembler::pmaxuw>(
+      this, dst, lhs, rhs);
+  Pcmpeqw(dst.fp(), ref);
+  Pcmpeqw(kScratchDoubleReg, kScratchDoubleReg);
+  Pxor(dst.fp(), kScratchDoubleReg);
 }
 
-void LiftoffAssembler::emit_i32x4_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  Movd(dst.fp(), src.gp());
-  Pshufd(dst.fp(), dst.fp(), static_cast<uint8_t>(0));
+void LiftoffAssembler::emit_i16x8_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(kScratchDoubleReg, rhs.fp());
+    ref = kScratchDoubleReg;
+  }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminsw, &Assembler::pminsw>(
+      this, dst, lhs, rhs);
+  Pcmpeqw(dst.fp(), ref);
 }
 
-void LiftoffAssembler::emit_i32x4_extract_lane(LiftoffRegister dst,
-                                               LiftoffRegister lhs,
-                                               uint8_t imm_lane_idx) {
-  Pextrd(dst.gp(), lhs.fp(), imm_lane_idx);
+void LiftoffAssembler::emit_i16x8_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(kScratchDoubleReg, rhs.fp());
+    ref = kScratchDoubleReg;
+  }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminuw, &Assembler::pminuw>(
+      this, dst, lhs, rhs, SSE4_1);
+  Pcmpeqw(dst.fp(), ref);
 }
 
-void LiftoffAssembler::emit_i32x4_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vpinsrd(dst.fp(), src1.fp(), src2.gp(), imm_lane_idx);
-  } else {
-    CpuFeatureScope scope(this, SSE4_1);
-    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
-    pinsrd(dst.fp(), src2.gp(), imm_lane_idx);
+void LiftoffAssembler::emit_i32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpcmpeqd, &Assembler::pcmpeqd>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpcmpeqd, &Assembler::pcmpeqd>(
+      this, dst, lhs, rhs);
+  Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+  Pxor(dst.fp(), kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_i32x4_gt_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpcmpgtd,
+                                       &Assembler::pcmpgtd>(this, dst, lhs,
+                                                            rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_gt_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(kScratchDoubleReg, rhs.fp());
+    ref = kScratchDoubleReg;
   }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxud, &Assembler::pmaxud>(
+      this, dst, lhs, rhs);
+  Pcmpeqd(dst.fp(), ref);
+  Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+  Pxor(dst.fp(), kScratchDoubleReg);
 }
 
-void LiftoffAssembler::emit_i32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddd, &Assembler::paddd>(
+void LiftoffAssembler::emit_i32x4_ge_s(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(kScratchDoubleReg, rhs.fp());
+    ref = kScratchDoubleReg;
+  }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminsd, &Assembler::pminsd>(
+      this, dst, lhs, rhs, SSE4_1);
+  Pcmpeqd(dst.fp(), ref);
+}
+
+void LiftoffAssembler::emit_i32x4_ge_u(LiftoffRegister dst, LiftoffRegister lhs,
+                                       LiftoffRegister rhs) {
+  DoubleRegister ref = rhs.fp();
+  if (dst == rhs) {
+    Movaps(kScratchDoubleReg, rhs.fp());
+    ref = kScratchDoubleReg;
+  }
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminud, &Assembler::pminud>(
+      this, dst, lhs, rhs, SSE4_1);
+  Pcmpeqd(dst.fp(), ref);
+}
+
+void LiftoffAssembler::emit_f32x4_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vcmpeqps, &Assembler::cmpeqps>(
       this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdSub<&Assembler::vpsubd, &Assembler::psubd>(this, dst, lhs,
-                                                              rhs);
+void LiftoffAssembler::emit_f32x4_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vcmpneqps,
+                                    &Assembler::cmpneqps>(this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmulld, &Assembler::pmulld>(
-      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+void LiftoffAssembler::emit_f32x4_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vcmpltps,
+                                       &Assembler::cmpltps>(this, dst, lhs,
+                                                            rhs);
 }
 
-void LiftoffAssembler::emit_i16x8_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  Movd(dst.fp(), src.gp());
-  Pshuflw(dst.fp(), dst.fp(), static_cast<uint8_t>(0));
-  Pshufd(dst.fp(), dst.fp(), static_cast<uint8_t>(0));
+void LiftoffAssembler::emit_f32x4_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vcmpleps,
+                                       &Assembler::cmpleps>(this, dst, lhs,
+                                                            rhs);
 }
 
-void LiftoffAssembler::emit_i16x8_extract_lane_u(LiftoffRegister dst,
-                                                 LiftoffRegister lhs,
-                                                 uint8_t imm_lane_idx) {
-  Pextrw(dst.gp(), lhs.fp(), imm_lane_idx);
+void LiftoffAssembler::emit_f64x2_eq(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vcmpeqpd, &Assembler::cmpeqpd>(
+      this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i16x8_extract_lane_s(LiftoffRegister dst,
-                                                 LiftoffRegister lhs,
-                                                 uint8_t imm_lane_idx) {
-  Pextrw(dst.gp(), lhs.fp(), imm_lane_idx);
-  movsxwl(dst.gp(), dst.gp());
+void LiftoffAssembler::emit_f64x2_ne(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vcmpneqpd,
+                                    &Assembler::cmpneqpd>(this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i16x8_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vpinsrw(dst.fp(), src1.fp(), src2.gp(), imm_lane_idx);
+void LiftoffAssembler::emit_f64x2_lt(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vcmpltpd,
+                                       &Assembler::cmpltpd>(this, dst, lhs,
+                                                            rhs);
+}
+
+void LiftoffAssembler::emit_f64x2_le(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vcmplepd,
+                                       &Assembler::cmplepd>(this, dst, lhs,
+                                                            rhs);
+}
+
+void LiftoffAssembler::emit_s128_not(LiftoffRegister dst, LiftoffRegister src) {
+  if (dst.fp() != src.fp()) {
+    Pcmpeqd(dst.fp(), dst.fp());
+    Pxor(dst.fp(), src.fp());
   } else {
-    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
-    pinsrw(dst.fp(), src2.gp(), imm_lane_idx);
+    Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+    Pxor(dst.fp(), kScratchDoubleReg);
   }
 }
 
-void LiftoffAssembler::emit_i16x8_add(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddw, &Assembler::paddw>(
+void LiftoffAssembler::emit_s128_and(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpand, &Assembler::pand>(
       this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i16x8_sub(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdSub<&Assembler::vpsubw, &Assembler::psubw>(this, dst, lhs,
-                                                              rhs);
+void LiftoffAssembler::emit_s128_or(LiftoffRegister dst, LiftoffRegister lhs,
+                                    LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpor, &Assembler::por>(
+      this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i16x8_mul(LiftoffRegister dst, LiftoffRegister lhs,
-                                      LiftoffRegister rhs) {
-  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmullw, &Assembler::pmullw>(
+void LiftoffAssembler::emit_s128_xor(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpxor, &Assembler::pxor>(
       this, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::emit_i8x16_splat(LiftoffRegister dst,
-                                        LiftoffRegister src) {
-  Movd(dst.fp(), src.gp());
-  Pxor(kScratchDoubleReg, kScratchDoubleReg);
-  Pshufb(dst.fp(), kScratchDoubleReg);
+void LiftoffAssembler::emit_s128_select(LiftoffRegister dst,
+                                        LiftoffRegister src1,
+                                        LiftoffRegister src2,
+                                        LiftoffRegister mask) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vxorps(kScratchDoubleReg, src1.fp(), src2.fp());
+    vandps(kScratchDoubleReg, kScratchDoubleReg, mask.fp());
+    vxorps(dst.fp(), kScratchDoubleReg, src2.fp());
+  } else {
+    movaps(kScratchDoubleReg, src1.fp());
+    xorps(kScratchDoubleReg, src2.fp());
+    andps(kScratchDoubleReg, mask.fp());
+    if (dst.fp() != src2.fp()) movaps(dst.fp(), src2.fp());
+    xorps(dst.fp(), kScratchDoubleReg);
+  }
 }
 
-void LiftoffAssembler::emit_i8x16_extract_lane_u(LiftoffRegister dst,
-                                                 LiftoffRegister lhs,
-                                                 uint8_t imm_lane_idx) {
-  Pextrb(dst.gp(), lhs.fp(), imm_lane_idx);
+void LiftoffAssembler::emit_i8x16_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  if (dst.fp() == src.fp()) {
+    Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+    Psignb(dst.fp(), kScratchDoubleReg);
+  } else {
+    Pxor(dst.fp(), dst.fp());
+    Psubb(dst.fp(), src.fp());
+  }
 }
 
-void LiftoffAssembler::emit_i8x16_extract_lane_s(LiftoffRegister dst,
-                                                 LiftoffRegister lhs,
-                                                 uint8_t imm_lane_idx) {
-  Pextrb(dst.gp(), lhs.fp(), imm_lane_idx);
-  movsxbl(dst.gp(), dst.gp());
+void LiftoffAssembler::emit_v8x16_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAnyTrue(this, dst, src);
 }
 
-void LiftoffAssembler::emit_i8x16_replace_lane(LiftoffRegister dst,
-                                               LiftoffRegister src1,
-                                               LiftoffRegister src2,
-                                               uint8_t imm_lane_idx) {
+void LiftoffAssembler::emit_v8x16_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAllTrue<&TurboAssembler::Pcmpeqb>(this, dst, src);
+}
+
+void LiftoffAssembler::emit_i8x16_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  static constexpr RegClass tmp_simd_rc = reg_class_for(ValueType::kS128);
+  LiftoffRegister tmp_simd =
+      GetUnusedRegister(tmp_simd_rc, LiftoffRegList::ForRegs(dst, lhs));
+  // Mask off the unwanted bits before word-shifting.
+  Pcmpeqw(kScratchDoubleReg, kScratchDoubleReg);
+  movq(kScratchRegister, rhs.gp());
+  andq(kScratchRegister, Immediate(7));
+  addq(kScratchRegister, Immediate(8));
+  Movq(tmp_simd.fp(), kScratchRegister);
+  Psrlw(kScratchDoubleReg, tmp_simd.fp());
+  Packuswb(kScratchDoubleReg, kScratchDoubleReg);
+
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
-    vpinsrb(dst.fp(), src1.fp(), src2.gp(), imm_lane_idx);
+    vpand(dst.fp(), lhs.fp(), kScratchDoubleReg);
   } else {
-    CpuFeatureScope scope(this, SSE4_1);
-    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
-    pinsrb(dst.fp(), src2.gp(), imm_lane_idx);
+    if (dst.fp() != lhs.fp()) movaps(dst.fp(), lhs.fp());
+    pand(dst.fp(), kScratchDoubleReg);
+  }
+  subq(kScratchRegister, Immediate(8));
+  Movq(tmp_simd.fp(), kScratchRegister);
+  Psllw(dst.fp(), tmp_simd.fp());
+}
+
+void LiftoffAssembler::emit_i8x16_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  byte shift = static_cast<byte>(rhs & 0x7);
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpsllw(dst.fp(), lhs.fp(), shift);
+  } else {
+    if (dst.fp() != lhs.fp()) movaps(dst.fp(), lhs.fp());
+    psllw(dst.fp(), shift);
+  }
+
+  uint8_t bmask = static_cast<uint8_t>(0xff << shift);
+  uint32_t mask = bmask << 24 | bmask << 16 | bmask << 8 | bmask;
+  movl(kScratchRegister, Immediate(mask));
+  Movd(kScratchDoubleReg, kScratchRegister);
+  Pshufd(kScratchDoubleReg, kScratchDoubleReg, uint8_t{0});
+  Pand(dst.fp(), kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_i8x16_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitI8x16Shr</*is_signed=*/true>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  Punpckhbw(kScratchDoubleReg, lhs.fp());
+  Punpcklbw(dst.fp(), lhs.fp());
+  uint8_t shift = (rhs & 7) + 8;
+  Psraw(kScratchDoubleReg, shift);
+  Psraw(dst.fp(), shift);
+  Packsswb(dst.fp(), kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_i8x16_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitI8x16Shr</*is_signed=*/false>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  // Perform 16-bit shift, then mask away high bits.
+  uint8_t shift = rhs & 7;  // i.InputInt3(1);
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpsrlw(dst.fp(), lhs.fp(), byte{shift});
+  } else if (dst != lhs) {
+    Movaps(dst.fp(), lhs.fp());
+    psrlw(dst.fp(), byte{shift});
   }
+
+  uint8_t bmask = 0xff >> shift;
+  uint32_t mask = bmask << 24 | bmask << 16 | bmask << 8 | bmask;
+  movl(kScratchRegister, Immediate(mask));
+  Movd(kScratchDoubleReg, kScratchRegister);
+  Pshufd(kScratchDoubleReg, kScratchDoubleReg, byte{0});
+  Pand(dst.fp(), kScratchDoubleReg);
 }
 
 void LiftoffAssembler::emit_i8x16_add(LiftoffRegister dst, LiftoffRegister lhs,
@@ -2222,10 +2684,39 @@ void LiftoffAssembler::emit_i8x16_add(LiftoffRegister dst, LiftoffRegister lhs,
       this, dst, lhs, rhs);
 }
 
+void LiftoffAssembler::emit_i8x16_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddsb, &Assembler::paddsb>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddusb, &Assembler::paddusb>(
+      this, dst, lhs, rhs);
+}
+
 void LiftoffAssembler::emit_i8x16_sub(LiftoffRegister dst, LiftoffRegister lhs,
                                       LiftoffRegister rhs) {
-  liftoff::EmitSimdSub<&Assembler::vpsubb, &Assembler::psubb>(this, dst, lhs,
-                                                              rhs);
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubb, &Assembler::psubb>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubsb, &Assembler::psubsb>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubusb,
+                                       &Assembler::psubusb>(this, dst, lhs,
+                                                            rhs);
 }
 
 void LiftoffAssembler::emit_i8x16_mul(LiftoffRegister dst, LiftoffRegister lhs,
@@ -2290,6 +2781,933 @@ void LiftoffAssembler::emit_i8x16_mul(LiftoffRegister dst, LiftoffRegister lhs,
   }
 }
 
+void LiftoffAssembler::emit_i8x16_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminsb, &Assembler::pminsb>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i8x16_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminub, &Assembler::pminub>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxsb, &Assembler::pmaxsb>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i8x16_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxub, &Assembler::pmaxub>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  if (dst.fp() == src.fp()) {
+    Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+    Psignw(dst.fp(), kScratchDoubleReg);
+  } else {
+    Pxor(dst.fp(), dst.fp());
+    Psubw(dst.fp(), src.fp());
+  }
+}
+
+void LiftoffAssembler::emit_v16x8_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAnyTrue(this, dst, src);
+}
+
+void LiftoffAssembler::emit_v16x8_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAllTrue<&TurboAssembler::Pcmpeqw>(this, dst, src);
+}
+
+void LiftoffAssembler::emit_i16x8_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpsllw, &Assembler::psllw, 4>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpsllw, &Assembler::psllw, 4>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpsraw, &Assembler::psraw, 4>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpsraw, &Assembler::psraw, 4>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpsrlw, &Assembler::psrlw, 4>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpsrlw, &Assembler::psrlw, 4>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_add(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddw, &Assembler::paddw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_add_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddsw, &Assembler::paddsw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_add_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddusw, &Assembler::paddusw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubw, &Assembler::psubw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_sub_saturate_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubsw, &Assembler::psubsw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_sub_saturate_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubusw,
+                                       &Assembler::psubusw>(this, dst, lhs,
+                                                            rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmullw, &Assembler::pmullw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminsw, &Assembler::pminsw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminuw, &Assembler::pminuw>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i16x8_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxsw, &Assembler::pmaxsw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxuw, &Assembler::pmaxuw>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  if (dst.fp() == src.fp()) {
+    Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+    Psignd(dst.fp(), kScratchDoubleReg);
+  } else {
+    Pxor(dst.fp(), dst.fp());
+    Psubd(dst.fp(), src.fp());
+  }
+}
+
+void LiftoffAssembler::emit_v32x4_anytrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAnyTrue(this, dst, src);
+}
+
+void LiftoffAssembler::emit_v32x4_alltrue(LiftoffRegister dst,
+                                          LiftoffRegister src) {
+  liftoff::EmitAllTrue<&TurboAssembler::Pcmpeqd>(this, dst, src);
+}
+
+void LiftoffAssembler::emit_i32x4_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpslld, &Assembler::pslld, 5>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpslld, &Assembler::pslld, 5>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpsrad, &Assembler::psrad, 5>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpsrad, &Assembler::psrad, 5>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpsrld, &Assembler::psrld, 5>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpsrld, &Assembler::psrld, 5>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddd, &Assembler::paddd>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubd, &Assembler::psubd>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmulld, &Assembler::pmulld>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i32x4_min_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminsd, &Assembler::pminsd>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i32x4_min_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpminud, &Assembler::pminud>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i32x4_max_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxsd, &Assembler::pmaxsd>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i32x4_max_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpmaxud, &Assembler::pmaxud>(
+      this, dst, lhs, rhs, base::Optional<CpuFeature>(SSE4_1));
+}
+
+void LiftoffAssembler::emit_i64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  DoubleRegister reg = dst.fp() == src.fp() ? kScratchDoubleReg : dst.fp();
+  Pxor(reg, reg);
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpsubq(dst.fp(), reg, src.fp());
+  } else {
+    psubq(reg, src.fp());
+    if (dst.fp() != reg) movapd(dst.fp(), reg);
+  }
+}
+
+void LiftoffAssembler::emit_i64x2_shl(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpsllq, &Assembler::psllq, 6>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_shli(LiftoffRegister dst, LiftoffRegister lhs,
+                                       int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpsllq, &Assembler::psllq, 6>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_shr_s(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitI64x2ShrS(this, dst, lhs, rhs.gp(),
+                         /*shift_is_rcx=*/rhs.gp() == rcx);
+}
+
+void LiftoffAssembler::emit_i64x2_shri_s(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitI64x2ShrS(this, dst, lhs, Immediate(rhs));
+}
+
+void LiftoffAssembler::emit_i64x2_shr_u(LiftoffRegister dst,
+                                        LiftoffRegister lhs,
+                                        LiftoffRegister rhs) {
+  liftoff::EmitSimdShiftOp<&Assembler::vpsrlq, &Assembler::psrlq, 6>(this, dst,
+                                                                     lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_shri_u(LiftoffRegister dst,
+                                         LiftoffRegister lhs, int32_t rhs) {
+  liftoff::EmitSimdShiftOpImm<&Assembler::vpsrlq, &Assembler::psrlq, 6>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpaddq, &Assembler::paddq>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpsubq, &Assembler::psubq>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  static constexpr RegClass tmp_rc = reg_class_for(ValueType::kS128);
+  LiftoffRegister tmp1 =
+      GetUnusedRegister(tmp_rc, LiftoffRegList::ForRegs(dst, lhs, rhs));
+  LiftoffRegister tmp2 =
+      GetUnusedRegister(tmp_rc, LiftoffRegList::ForRegs(dst, lhs, rhs, tmp1));
+  Movaps(tmp1.fp(), lhs.fp());
+  Movaps(tmp2.fp(), rhs.fp());
+  // Multiply high dword of each qword of left with right.
+  Psrlq(tmp1.fp(), 32);
+  Pmuludq(tmp1.fp(), rhs.fp());
+  // Multiply high dword of each qword of right with left.
+  Psrlq(tmp2.fp(), 32);
+  Pmuludq(tmp2.fp(), lhs.fp());
+  Paddq(tmp2.fp(), tmp1.fp());
+  Psllq(tmp2.fp(), 32);
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpmuludq(dst.fp(), lhs.fp(), rhs.fp());
+  } else {
+    if (dst.fp() != lhs.fp()) movaps(dst.fp(), lhs.fp());
+    pmuludq(dst.fp(), rhs.fp());
+  }
+  Paddq(dst.fp(), tmp2.fp());
+}
+
+void LiftoffAssembler::emit_f32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  if (dst.fp() == src.fp()) {
+    Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+    Psrld(kScratchDoubleReg, static_cast<byte>(1));
+    Andps(dst.fp(), kScratchDoubleReg);
+  } else {
+    Pcmpeqd(dst.fp(), dst.fp());
+    Psrld(dst.fp(), static_cast<byte>(1));
+    Andps(dst.fp(), src.fp());
+  }
+}
+
+void LiftoffAssembler::emit_f32x4_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  if (dst.fp() == src.fp()) {
+    Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+    Pslld(kScratchDoubleReg, static_cast<byte>(31));
+    Xorps(dst.fp(), kScratchDoubleReg);
+  } else {
+    Pcmpeqd(dst.fp(), dst.fp());
+    Pslld(dst.fp(), static_cast<byte>(31));
+    Xorps(dst.fp(), src.fp());
+  }
+}
+
+void LiftoffAssembler::emit_f32x4_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  Sqrtps(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_f32x4_add(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vaddps, &Assembler::addps>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f32x4_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vsubps, &Assembler::subps>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f32x4_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vmulps, &Assembler::mulps>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f32x4_div(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vdivps, &Assembler::divps>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f32x4_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  // The minps instruction doesn't propagate NaNs and +0's in its first
+  // operand. Perform minps in both orders, merge the results, and adjust.
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vminps(kScratchDoubleReg, lhs.fp(), rhs.fp());
+    vminps(dst.fp(), rhs.fp(), lhs.fp());
+  } else if (dst.fp() == lhs.fp() || dst.fp() == rhs.fp()) {
+    XMMRegister src = dst.fp() == lhs.fp() ? rhs.fp() : lhs.fp();
+    movaps(kScratchDoubleReg, src);
+    minps(kScratchDoubleReg, dst.fp());
+    minps(dst.fp(), src);
+  } else {
+    movaps(kScratchDoubleReg, lhs.fp());
+    minps(kScratchDoubleReg, rhs.fp());
+    movaps(dst.fp(), rhs.fp());
+    minps(dst.fp(), lhs.fp());
+  }
+  // propagate -0's and NaNs, which may be non-canonical.
+  Orps(kScratchDoubleReg, dst.fp());
+  // Canonicalize NaNs by quieting and clearing the payload.
+  Cmpps(dst.fp(), kScratchDoubleReg, int8_t{3});
+  Orps(kScratchDoubleReg, dst.fp());
+  Psrld(dst.fp(), byte{10});
+  Andnps(dst.fp(), kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_f32x4_max(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  // The maxps instruction doesn't propagate NaNs and +0's in its first
+  // operand. Perform maxps in both orders, merge the results, and adjust.
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vmaxps(kScratchDoubleReg, lhs.fp(), rhs.fp());
+    vmaxps(dst.fp(), rhs.fp(), lhs.fp());
+  } else if (dst.fp() == lhs.fp() || dst.fp() == rhs.fp()) {
+    XMMRegister src = dst.fp() == lhs.fp() ? rhs.fp() : lhs.fp();
+    movaps(kScratchDoubleReg, src);
+    maxps(kScratchDoubleReg, dst.fp());
+    maxps(dst.fp(), src);
+  } else {
+    movaps(kScratchDoubleReg, lhs.fp());
+    maxps(kScratchDoubleReg, rhs.fp());
+    movaps(dst.fp(), rhs.fp());
+    maxps(dst.fp(), lhs.fp());
+  }
+  // Find discrepancies.
+  Xorps(dst.fp(), kScratchDoubleReg);
+  // Propagate NaNs, which may be non-canonical.
+  Orps(kScratchDoubleReg, dst.fp());
+  // Propagate sign discrepancy and (subtle) quiet NaNs.
+  Subps(kScratchDoubleReg, dst.fp());
+  // Canonicalize NaNs by clearing the payload. Sign is non-deterministic.
+  Cmpps(dst.fp(), kScratchDoubleReg, int8_t{3});
+  Psrld(dst.fp(), byte{10});
+  Andnps(dst.fp(), kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_f64x2_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  if (dst.fp() == src.fp()) {
+    Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+    Psrlq(kScratchDoubleReg, static_cast<byte>(1));
+    Andpd(dst.fp(), kScratchDoubleReg);
+  } else {
+    Pcmpeqd(dst.fp(), dst.fp());
+    Psrlq(dst.fp(), static_cast<byte>(1));
+    Andpd(dst.fp(), src.fp());
+  }
+}
+
+void LiftoffAssembler::emit_f64x2_neg(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  if (dst.fp() == src.fp()) {
+    Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+    Psllq(kScratchDoubleReg, static_cast<byte>(63));
+    Xorpd(dst.fp(), kScratchDoubleReg);
+  } else {
+    Pcmpeqd(dst.fp(), dst.fp());
+    Psllq(dst.fp(), static_cast<byte>(63));
+    Xorpd(dst.fp(), src.fp());
+  }
+}
+
+void LiftoffAssembler::emit_f64x2_sqrt(LiftoffRegister dst,
+                                       LiftoffRegister src) {
+  Sqrtpd(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_f64x2_add(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vaddpd, &Assembler::addpd>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f64x2_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vsubpd, &Assembler::subpd>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f64x2_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vmulpd, &Assembler::mulpd>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f64x2_div(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vdivpd, &Assembler::divpd>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_f64x2_min(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  // The minpd instruction doesn't propagate NaNs and +0's in its first
+  // operand. Perform minpd in both orders, merge the results, and adjust.
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vminpd(kScratchDoubleReg, lhs.fp(), rhs.fp());
+    vminpd(dst.fp(), rhs.fp(), lhs.fp());
+  } else if (dst.fp() == lhs.fp() || dst.fp() == rhs.fp()) {
+    XMMRegister src = dst.fp() == lhs.fp() ? rhs.fp() : lhs.fp();
+    movapd(kScratchDoubleReg, src);
+    minpd(kScratchDoubleReg, dst.fp());
+    minpd(dst.fp(), src);
+  } else {
+    movapd(kScratchDoubleReg, lhs.fp());
+    minpd(kScratchDoubleReg, rhs.fp());
+    movapd(dst.fp(), rhs.fp());
+    minpd(dst.fp(), lhs.fp());
+  }
+  // propagate -0's and NaNs, which may be non-canonical.
+  Orpd(kScratchDoubleReg, dst.fp());
+  // Canonicalize NaNs by quieting and clearing the payload.
+  Cmppd(dst.fp(), kScratchDoubleReg, int8_t{3});
+  Orpd(kScratchDoubleReg, dst.fp());
+  Psrlq(dst.fp(), 13);
+  Andnpd(dst.fp(), kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_f64x2_max(LiftoffRegister dst, LiftoffRegister lhs,
+                                      LiftoffRegister rhs) {
+  // The maxpd instruction doesn't propagate NaNs and +0's in its first
+  // operand. Perform maxpd in both orders, merge the results, and adjust.
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vmaxpd(kScratchDoubleReg, lhs.fp(), rhs.fp());
+    vmaxpd(dst.fp(), rhs.fp(), lhs.fp());
+  } else if (dst.fp() == lhs.fp() || dst.fp() == rhs.fp()) {
+    XMMRegister src = dst.fp() == lhs.fp() ? rhs.fp() : lhs.fp();
+    movapd(kScratchDoubleReg, src);
+    maxpd(kScratchDoubleReg, dst.fp());
+    maxpd(dst.fp(), src);
+  } else {
+    movapd(kScratchDoubleReg, lhs.fp());
+    maxpd(kScratchDoubleReg, rhs.fp());
+    movapd(dst.fp(), rhs.fp());
+    maxpd(dst.fp(), lhs.fp());
+  }
+  // Find discrepancies.
+  Xorpd(dst.fp(), kScratchDoubleReg);
+  // Propagate NaNs, which may be non-canonical.
+  Orpd(kScratchDoubleReg, dst.fp());
+  // Propagate sign discrepancy and (subtle) quiet NaNs.
+  Subpd(kScratchDoubleReg, dst.fp());
+  // Canonicalize NaNs by clearing the payload. Sign is non-deterministic.
+  Cmppd(dst.fp(), kScratchDoubleReg, int8_t{3});
+  Psrlq(dst.fp(), 13);
+  Andnpd(dst.fp(), kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  // NAN->0
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vcmpeqps(kScratchDoubleReg, src.fp(), src.fp());
+    vpand(dst.fp(), src.fp(), kScratchDoubleReg);
+  } else {
+    movaps(kScratchDoubleReg, src.fp());
+    cmpeqps(kScratchDoubleReg, kScratchDoubleReg);
+    if (dst.fp() != src.fp()) movaps(dst.fp(), src.fp());
+    pand(dst.fp(), kScratchDoubleReg);
+  }
+  // Set top bit if >= 0 (but not -0.0!).
+  Pxor(kScratchDoubleReg, dst.fp());
+  // Convert to int.
+  Cvttps2dq(dst.fp(), dst.fp());
+  // Set top bit if >=0 is now < 0.
+  Pand(kScratchDoubleReg, dst.fp());
+  Psrad(kScratchDoubleReg, byte{31});
+  // Set positive overflow lanes to 0x7FFFFFFF.
+  Pxor(dst.fp(), kScratchDoubleReg);
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_f32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  // NAN->0, negative->0.
+  Pxor(kScratchDoubleReg, kScratchDoubleReg);
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vmaxps(dst.fp(), src.fp(), kScratchDoubleReg);
+  } else {
+    if (dst.fp() != src.fp()) movaps(dst.fp(), src.fp());
+    maxps(dst.fp(), kScratchDoubleReg);
+  }
+  // scratch: float representation of max_signed.
+  Pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+  Psrld(kScratchDoubleReg, uint8_t{1});            // 0x7fffffff
+  Cvtdq2ps(kScratchDoubleReg, kScratchDoubleReg);  // 0x4f000000
+  // scratch2: convert (src-max_signed).
+  // Set positive overflow lanes to 0x7FFFFFFF.
+  // Set negative lanes to 0.
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vsubps(liftoff::kScratchDoubleReg2, dst.fp(), kScratchDoubleReg);
+  } else {
+    movaps(liftoff::kScratchDoubleReg2, dst.fp());
+    subps(liftoff::kScratchDoubleReg2, kScratchDoubleReg);
+  }
+  Cmpleps(kScratchDoubleReg, liftoff::kScratchDoubleReg2);
+  Cvttps2dq(liftoff::kScratchDoubleReg2, liftoff::kScratchDoubleReg2);
+  Pxor(liftoff::kScratchDoubleReg2, kScratchDoubleReg);
+  Pxor(kScratchDoubleReg, kScratchDoubleReg);
+  Pmaxsd(liftoff::kScratchDoubleReg2, kScratchDoubleReg);
+  // Convert to int. Overflow lanes above max_signed will be 0x80000000.
+  Cvttps2dq(dst.fp(), dst.fp());
+  // Add (src-max_signed) for overflow lanes.
+  Paddd(dst.fp(), liftoff::kScratchDoubleReg2);
+}
+
+void LiftoffAssembler::emit_f32x4_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  Cvtdq2ps(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_f32x4_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister src) {
+  Pxor(kScratchDoubleReg, kScratchDoubleReg);           // Zeros.
+  Pblendw(kScratchDoubleReg, src.fp(), uint8_t{0x55});  // Get lo 16 bits.
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpsubd(dst.fp(), src.fp(), kScratchDoubleReg);  // Get hi 16 bits.
+  } else {
+    if (dst.fp() != src.fp()) movaps(dst.fp(), src.fp());
+    psubd(dst.fp(), kScratchDoubleReg);
+  }
+  Cvtdq2ps(kScratchDoubleReg, kScratchDoubleReg);  // Convert lo exactly.
+  Psrld(dst.fp(), byte{1});            // Divide by 2 to get in unsigned range.
+  Cvtdq2ps(dst.fp(), dst.fp());        // Convert hi, exactly.
+  Addps(dst.fp(), dst.fp());           // Double hi, exactly.
+  Addps(dst.fp(), kScratchDoubleReg);  // Add hi and lo, may round.
+}
+
+void LiftoffAssembler::emit_i8x16_sconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpacksswb,
+                                       &Assembler::packsswb>(this, dst, lhs,
+                                                             rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_uconvert_i16x8(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpackuswb,
+                                       &Assembler::packuswb>(this, dst, lhs,
+                                                             rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpackssdw,
+                                       &Assembler::packssdw>(this, dst, lhs,
+                                                             rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i32x4(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vpackusdw,
+                                       &Assembler::packusdw>(this, dst, lhs,
+                                                             rhs, SSE4_1);
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  Pmovsxbw(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_i16x8_sconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  Palignr(dst.fp(), src.fp(), static_cast<uint8_t>(8));
+  Pmovsxbw(dst.fp(), dst.fp());
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  Pmovzxbw(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_i16x8_uconvert_i8x16_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  Palignr(dst.fp(), src.fp(), static_cast<uint8_t>(8));
+  Pmovzxbw(dst.fp(), dst.fp());
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  Pmovsxwd(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_i32x4_sconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  Palignr(dst.fp(), src.fp(), static_cast<uint8_t>(8));
+  Pmovsxwd(dst.fp(), dst.fp());
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_low(LiftoffRegister dst,
+                                                     LiftoffRegister src) {
+  Pmovzxwd(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_i32x4_uconvert_i16x8_high(LiftoffRegister dst,
+                                                      LiftoffRegister src) {
+  Palignr(dst.fp(), src.fp(), static_cast<uint8_t>(8));
+  Pmovzxwd(dst.fp(), dst.fp());
+}
+
+void LiftoffAssembler::emit_s128_and_not(LiftoffRegister dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  liftoff::EmitSimdNonCommutativeBinOp<&Assembler::vandnps, &Assembler::andnps>(
+      this, dst, rhs, lhs);
+}
+
+void LiftoffAssembler::emit_i8x16_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpavgb, &Assembler::pavgb>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i16x8_rounding_average_u(LiftoffRegister dst,
+                                                     LiftoffRegister lhs,
+                                                     LiftoffRegister rhs) {
+  liftoff::EmitSimdCommutativeBinOp<&Assembler::vpavgw, &Assembler::pavgw>(
+      this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i8x16_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Pabsb(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_i16x8_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Pabsw(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_i32x4_abs(LiftoffRegister dst,
+                                      LiftoffRegister src) {
+  Pabsd(dst.fp(), src.fp());
+}
+
+void LiftoffAssembler::emit_i8x16_extract_lane_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 uint8_t imm_lane_idx) {
+  Pextrb(dst.gp(), lhs.fp(), imm_lane_idx);
+  movsxbl(dst.gp(), dst.gp());
+}
+
+void LiftoffAssembler::emit_i8x16_extract_lane_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 uint8_t imm_lane_idx) {
+  Pextrb(dst.gp(), lhs.fp(), imm_lane_idx);
+}
+
+void LiftoffAssembler::emit_i16x8_extract_lane_s(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 uint8_t imm_lane_idx) {
+  Pextrw(dst.gp(), lhs.fp(), imm_lane_idx);
+  movsxwl(dst.gp(), dst.gp());
+}
+
+void LiftoffAssembler::emit_i16x8_extract_lane_u(LiftoffRegister dst,
+                                                 LiftoffRegister lhs,
+                                                 uint8_t imm_lane_idx) {
+  Pextrw(dst.gp(), lhs.fp(), imm_lane_idx);
+}
+
+void LiftoffAssembler::emit_i32x4_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  Pextrd(dst.gp(), lhs.fp(), imm_lane_idx);
+}
+
+void LiftoffAssembler::emit_i64x2_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  Pextrq(dst.gp(), lhs.fp(), static_cast<int8_t>(imm_lane_idx));
+}
+
+void LiftoffAssembler::emit_f32x4_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vshufps(dst.fp(), lhs.fp(), lhs.fp(), imm_lane_idx);
+  } else {
+    if (dst.fp() != lhs.fp()) movaps(dst.fp(), lhs.fp());
+    if (imm_lane_idx != 0) shufps(dst.fp(), dst.fp(), imm_lane_idx);
+  }
+}
+
+void LiftoffAssembler::emit_f64x2_extract_lane(LiftoffRegister dst,
+                                               LiftoffRegister lhs,
+                                               uint8_t imm_lane_idx) {
+  Pextrq(kScratchRegister, lhs.fp(), static_cast<int8_t>(imm_lane_idx));
+  Movq(dst.fp(), kScratchRegister);
+}
+
+void LiftoffAssembler::emit_i8x16_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpinsrb(dst.fp(), src1.fp(), src2.gp(), imm_lane_idx);
+  } else {
+    CpuFeatureScope scope(this, SSE4_1);
+    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
+    pinsrb(dst.fp(), src2.gp(), imm_lane_idx);
+  }
+}
+
+void LiftoffAssembler::emit_i16x8_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpinsrw(dst.fp(), src1.fp(), src2.gp(), imm_lane_idx);
+  } else {
+    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
+    pinsrw(dst.fp(), src2.gp(), imm_lane_idx);
+  }
+}
+
+void LiftoffAssembler::emit_i32x4_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpinsrd(dst.fp(), src1.fp(), src2.gp(), imm_lane_idx);
+  } else {
+    CpuFeatureScope scope(this, SSE4_1);
+    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
+    pinsrd(dst.fp(), src2.gp(), imm_lane_idx);
+  }
+}
+
+void LiftoffAssembler::emit_i64x2_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpinsrq(dst.fp(), src1.fp(), src2.gp(), imm_lane_idx);
+  } else {
+    CpuFeatureScope scope(this, SSE4_1);
+    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
+    pinsrq(dst.fp(), src2.gp(), imm_lane_idx);
+  }
+}
+
+void LiftoffAssembler::emit_f32x4_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vinsertps(dst.fp(), src1.fp(), src2.fp(), (imm_lane_idx << 4) & 0x30);
+  } else {
+    CpuFeatureScope scope(this, SSE4_1);
+    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
+    insertps(dst.fp(), src2.fp(), (imm_lane_idx << 4) & 0x30);
+  }
+}
+
+void LiftoffAssembler::emit_f64x2_replace_lane(LiftoffRegister dst,
+                                               LiftoffRegister src1,
+                                               LiftoffRegister src2,
+                                               uint8_t imm_lane_idx) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    if (imm_lane_idx == 0) {
+      vpblendw(dst.fp(), src1.fp(), src2.fp(), 0b00001111);
+    } else {
+      vmovlhps(dst.fp(), src1.fp(), src2.fp());
+    }
+  } else {
+    CpuFeatureScope scope(this, SSE4_1);
+    if (dst.fp() != src1.fp()) movaps(dst.fp(), src1.fp());
+    if (imm_lane_idx == 0) {
+      pblendw(dst.fp(), src2.fp(), 0b00001111);
+    } else {
+      movlhps(dst.fp(), src2.fp());
+    }
+  }
+}
+
 void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
   cmpq(rsp, Operand(limit_address, 0));
   j(below_equal, ool_code);
diff --git a/deps/v8/src/wasm/c-api.cc b/deps/v8/src/wasm/c-api.cc
index d098a5f57ff..1e6ec70126c 100644
--- a/deps/v8/src/wasm/c-api.cc
+++ b/deps/v8/src/wasm/c-api.cc
@@ -201,8 +201,6 @@ auto seal(const typename implement<C>::type* x) -> const C* {
 // Configuration
 
 struct ConfigImpl {
-  ConfigImpl() {}
-  ~ConfigImpl() {}
 };
 
 template <>
@@ -265,8 +263,8 @@ auto Engine::make(own<Config>&& config) -> own<Engine> {
 StoreImpl::~StoreImpl() {
 #ifdef DEBUG
   reinterpret_cast<i::Isolate*>(isolate_)->heap()->PreciseCollectAllGarbage(
-      i::Heap::kNoGCFlags, i::GarbageCollectionReason::kTesting,
-      v8::kGCCallbackFlagForced);
+      i::Heap::kForcedGC, i::GarbageCollectionReason::kTesting,
+      v8::kNoGCCallbackFlags);
 #endif
   context()->Exit();
   isolate_->Dispose();
@@ -375,7 +373,7 @@ ValTypeImpl* valtype_f64 = new ValTypeImpl(F64);
 ValTypeImpl* valtype_anyref = new ValTypeImpl(ANYREF);
 ValTypeImpl* valtype_funcref = new ValTypeImpl(FUNCREF);
 
-ValType::~ValType() {}
+ValType::~ValType() = default;
 
 void ValType::operator delete(void*) {}
 
@@ -417,7 +415,7 @@ struct ExternTypeImpl {
   ExternKind kind;
 
   explicit ExternTypeImpl(ExternKind kind) : kind(kind) {}
-  virtual ~ExternTypeImpl() {}
+  virtual ~ExternTypeImpl() = default;
 };
 
 template <>
@@ -455,8 +453,6 @@ struct FuncTypeImpl : ExternTypeImpl {
       : ExternTypeImpl(EXTERN_FUNC),
         params(std::move(params)),
         results(std::move(results)) {}
-
-  ~FuncTypeImpl() {}
 };
 
 template <>
@@ -464,7 +460,7 @@ struct implement<FuncType> {
   using type = FuncTypeImpl;
 };
 
-FuncType::~FuncType() {}
+FuncType::~FuncType() = default;
 
 auto FuncType::make(ownvec<ValType>&& params, ownvec<ValType>&& results)
     -> own<FuncType> {
@@ -510,7 +506,7 @@ struct GlobalTypeImpl : ExternTypeImpl {
         content(std::move(content)),
         mutability(mutability) {}
 
-  ~GlobalTypeImpl() {}
+  ~GlobalTypeImpl() override = default;
 };
 
 template <>
@@ -518,7 +514,7 @@ struct implement<GlobalType> {
   using type = GlobalTypeImpl;
 };
 
-GlobalType::~GlobalType() {}
+GlobalType::~GlobalType() = default;
 
 auto GlobalType::make(own<ValType>&& content, Mutability mutability)
     -> own<GlobalType> {
@@ -563,7 +559,7 @@ struct TableTypeImpl : ExternTypeImpl {
         element(std::move(element)),
         limits(limits) {}
 
-  ~TableTypeImpl() {}
+  ~TableTypeImpl() override = default;
 };
 
 template <>
@@ -571,7 +567,7 @@ struct implement<TableType> {
   using type = TableTypeImpl;
 };
 
-TableType::~TableType() {}
+TableType::~TableType() = default;
 
 auto TableType::make(own<ValType>&& element, Limits limits) -> own<TableType> {
   return element ? own<TableType>(seal<TableType>(
@@ -609,7 +605,7 @@ struct MemoryTypeImpl : ExternTypeImpl {
   explicit MemoryTypeImpl(Limits limits)
       : ExternTypeImpl(EXTERN_MEMORY), limits(limits) {}
 
-  ~MemoryTypeImpl() {}
+  ~MemoryTypeImpl() override = default;
 };
 
 template <>
@@ -617,7 +613,7 @@ struct implement<MemoryType> {
   using type = MemoryTypeImpl;
 };
 
-MemoryType::~MemoryType() {}
+MemoryType::~MemoryType() = default;
 
 auto MemoryType::make(Limits limits) -> own<MemoryType> {
   return own<MemoryType>(
@@ -655,8 +651,6 @@ struct ImportTypeImpl {
       : module(std::move(module)),
         name(std::move(name)),
         type(std::move(type)) {}
-
-  ~ImportTypeImpl() {}
 };
 
 template <>
@@ -697,8 +691,6 @@ struct ExportTypeImpl {
   ExportTypeImpl(Name& name,             // NOLINT(runtime/references)
                  own<ExternType>& type)  // NOLINT(runtime/references)
       : name(std::move(name)), type(std::move(type)) {}
-
-  ~ExportTypeImpl() {}
 };
 
 template <>
@@ -767,7 +759,7 @@ class RefImpl {
   }
 
  private:
-  RefImpl() {}
+  RefImpl() = default;
 
   i::Address* location() const {
     return reinterpret_cast<i::Address*>(val_.address());
@@ -813,8 +805,6 @@ struct FrameImpl {
         func_offset(func_offset),
         module_offset(module_offset) {}
 
-  ~FrameImpl() {}
-
   own<Instance> instance;
   uint32_t func_index;
   size_t func_offset;
@@ -854,7 +844,7 @@ struct implement<Trap> {
   using type = RefImpl<Trap, i::JSReceiver>;
 };
 
-Trap::~Trap() {}
+Trap::~Trap() = default;
 
 auto Trap::copy() const -> own<Trap> { return impl(this)->copy(); }
 
@@ -941,7 +931,7 @@ struct implement<Foreign> {
   using type = RefImpl<Foreign, i::JSReceiver>;
 };
 
-Foreign::~Foreign() {}
+Foreign::~Foreign() = default;
 
 auto Foreign::copy() const -> own<Foreign> { return impl(this)->copy(); }
 
@@ -962,7 +952,7 @@ struct implement<Module> {
   using type = RefImpl<Module, i::WasmModuleObject>;
 };
 
-Module::~Module() {}
+Module::~Module() = default;
 
 auto Module::copy() const -> own<Module> { return impl(this)->copy(); }
 
@@ -1106,7 +1096,7 @@ struct implement<Extern> {
   using type = RefImpl<Extern, i::JSReceiver>;
 };
 
-Extern::~Extern() {}
+Extern::~Extern() = default;
 
 auto Extern::copy() const -> own<Extern> { return impl(this)->copy(); }
 
@@ -1177,7 +1167,7 @@ struct implement<Func> {
   using type = RefImpl<Func, i::JSFunction>;
 };
 
-Func::~Func() {}
+Func::~Func() = default;
 
 auto Func::copy() const -> own<Func> { return impl(this)->copy(); }
 
@@ -1662,7 +1652,7 @@ struct implement<Global> {
   using type = RefImpl<Global, i::WasmGlobalObject>;
 };
 
-Global::~Global() {}
+Global::~Global() = default;
 
 auto Global::copy() const -> own<Global> { return impl(this)->copy(); }
 
@@ -1754,7 +1744,7 @@ struct implement<Table> {
   using type = RefImpl<Table, i::WasmTableObject>;
 };
 
-Table::~Table() {}
+Table::~Table() = default;
 
 auto Table::copy() const -> own<Table> { return impl(this)->copy(); }
 
@@ -1873,7 +1863,7 @@ struct implement<Memory> {
   using type = RefImpl<Memory, i::WasmMemoryObject>;
 };
 
-Memory::~Memory() {}
+Memory::~Memory() = default;
 
 auto Memory::copy() const -> own<Memory> { return impl(this)->copy(); }
 
@@ -1941,7 +1931,7 @@ struct implement<Instance> {
   using type = RefImpl<Instance, i::WasmInstanceObject>;
 };
 
-Instance::~Instance() {}
+Instance::~Instance() = default;
 
 auto Instance::copy() const -> own<Instance> { return impl(this)->copy(); }
 
diff --git a/deps/v8/src/wasm/c-api.h b/deps/v8/src/wasm/c-api.h
index 43a0fb73b2d..426806f1d20 100644
--- a/deps/v8/src/wasm/c-api.h
+++ b/deps/v8/src/wasm/c-api.h
@@ -43,7 +43,7 @@ class StoreImpl {
  private:
   friend own<Store> Store::make(Engine*);
 
-  StoreImpl() {}
+  StoreImpl() = default;
 
   v8::Isolate::CreateParams create_params_;
   v8::Isolate* isolate_ = nullptr;
diff --git a/deps/v8/src/wasm/compilation-environment.h b/deps/v8/src/wasm/compilation-environment.h
index be60dfd519b..1b2710666e2 100644
--- a/deps/v8/src/wasm/compilation-environment.h
+++ b/deps/v8/src/wasm/compilation-environment.h
@@ -60,15 +60,11 @@ struct CompilationEnv {
 
   const LowerSimd lower_simd;
 
-  // Whether the debugger is active.
-  const bool debug;
-
   constexpr CompilationEnv(const WasmModule* module,
                            UseTrapHandler use_trap_handler,
                            RuntimeExceptionSupport runtime_exception_support,
                            const WasmFeatures& enabled_features,
-                           LowerSimd lower_simd = kNoLowerSimd,
-                           bool debug = false)
+                           LowerSimd lower_simd = kNoLowerSimd)
       : module(module),
         use_trap_handler(use_trap_handler),
         runtime_exception_support(runtime_exception_support),
@@ -79,8 +75,7 @@ struct CompilationEnv {
                              : max_initial_mem_pages()) *
                         uint64_t{kWasmPageSize}),
         enabled_features(enabled_features),
-        lower_simd(lower_simd),
-        debug(debug) {}
+        lower_simd(lower_simd) {}
 };
 
 // The wire bytes are either owned by the StreamingDecoder, or (after streaming)
@@ -129,12 +124,12 @@ class CompilationState {
   // delete} with {size_t} argument. The {size_t} argument would be incorrect.
   void operator delete(void* ptr) { ::operator delete(ptr); }
 
+  CompilationState() = delete;
+
  private:
   // NativeModule is allowed to call the static {New} method.
   friend class NativeModule;
 
-  CompilationState() = delete;
-
   // The CompilationState keeps a {std::weak_ptr} back to the {NativeModule}
   // such that it can keep it alive (by regaining a {std::shared_ptr}) in
   // certain scopes.
diff --git a/deps/v8/src/wasm/decoder.h b/deps/v8/src/wasm/decoder.h
index 3c0c0493b00..695960086e1 100644
--- a/deps/v8/src/wasm/decoder.h
+++ b/deps/v8/src/wasm/decoder.h
@@ -15,6 +15,7 @@
 #include "src/flags/flags.h"
 #include "src/utils/utils.h"
 #include "src/utils/vector.h"
+#include "src/wasm/wasm-opcodes.h"
 #include "src/wasm/wasm-result.h"
 #include "src/zone/zone-containers.h"
 
@@ -126,6 +127,40 @@ class Decoder {
                                                                name);
   }
 
+  // Reads a prefixed-opcode, possibly with variable-length index.
+  // The length param is set to the number of bytes this index is encoded with.
+  // For most cases (non variable-length), it will be 1.
+  template <ValidateFlag validate>
+  WasmOpcode read_prefixed_opcode(const byte* pc, uint32_t* length = nullptr,
+                                  const char* name = "prefixed opcode") {
+    uint32_t unused_length;
+    if (length == nullptr) {
+      length = &unused_length;
+    }
+    DCHECK(WasmOpcodes::IsPrefixOpcode(static_cast<WasmOpcode>(*pc)));
+    uint32_t index;
+    if (*pc == WasmOpcode::kSimdPrefix) {
+      // SIMD opcodes can be multiple bytes (when LEB128 encoded).
+      index = read_u32v<validate>(pc + 1, length, "prefixed opcode index");
+      // Only support SIMD opcodes that go up to 0xFF (when decoded). Anything
+      // bigger will need 1 more byte, and the '<< 8' below will be wrong.
+      if (validate && V8_UNLIKELY(index > 0xff)) {
+        errorf(pc, "Invalid SIMD opcode %d", index);
+      }
+    } else {
+      if (!validate || validate_size(pc, 2, "expected 2 bytes")) {
+        DCHECK(validate_size(pc, 2, "expected 2 bytes"));
+        index = *(pc + 1);
+        *length = 1;
+      } else {
+        // If kValidate and size validation fails.
+        index = 0;
+        *length = 0;
+      }
+    }
+    return static_cast<WasmOpcode>((*pc) << 8 | index);
+  }
+
   // Reads a 8-bit unsigned integer (byte) and advances {pc_}.
   uint8_t consume_u8(const char* name = "uint8_t") {
     return consume_little_endian<uint8_t>(name);
diff --git a/deps/v8/src/wasm/function-body-decoder-impl.h b/deps/v8/src/wasm/function-body-decoder-impl.h
index 9752d4ef0c8..e85899c83dc 100644
--- a/deps/v8/src/wasm/function-body-decoder-impl.h
+++ b/deps/v8/src/wasm/function-body-decoder-impl.h
@@ -41,22 +41,18 @@ struct WasmException;
     return true;                  \
   }())
 
-#define RET_ON_PROTOTYPE_OPCODE(feat)                                          \
+#define CHECK_PROTOTYPE_OPCODE_GEN(feat, opt_break)                            \
   DCHECK(!this->module_ || this->module_->origin == kWasmOrigin);              \
   if (!this->enabled_.has_##feat()) {                                          \
     this->error("Invalid opcode (enable with --experimental-wasm-" #feat ")"); \
+    opt_break                                                                  \
   } else {                                                                     \
     this->detected_->Add(kFeature_##feat);                                     \
   }
 
-#define CHECK_PROTOTYPE_OPCODE(feat)                                           \
-  DCHECK(!this->module_ || this->module_->origin == kWasmOrigin);              \
-  if (!this->enabled_.has_##feat()) {                                          \
-    this->error("Invalid opcode (enable with --experimental-wasm-" #feat ")"); \
-    break;                                                                     \
-  } else {                                                                     \
-    this->detected_->Add(kFeature_##feat);                                     \
-  }
+#define CHECK_PROTOTYPE_OPCODE(feat) CHECK_PROTOTYPE_OPCODE_GEN(feat, break;)
+
+#define RET_ON_PROTOTYPE_OPCODE(feat) CHECK_PROTOTYPE_OPCODE_GEN(feat, )
 
 #define OPCODE_ERROR(opcode, message)                                 \
   (this->errorf(this->pc_, "%s: %s", WasmOpcodes::OpcodeName(opcode), \
@@ -207,54 +203,155 @@ struct GlobalIndexImmediate {
   }
 };
 
-namespace function_body_decoder {
-// Decode a byte representing a local type. Return {false} if the encoded
-// byte was invalid or the start of a type index.
-inline bool decode_local_type(uint8_t val, ValueType* result) {
-  switch (static_cast<ValueTypeCode>(val)) {
-    case kLocalVoid:
-      *result = kWasmStmt;
-      return true;
+namespace value_type_reader {
+
+// Read a value type starting at address 'pc' in 'decoder'.
+// No bytes are consumed. The result is written into the 'result' parameter.
+// Returns the amount of bytes read, or 0 if decoding failed.
+// Registers an error if the type opcode is invalid iff validate is set.
+template <Decoder::ValidateFlag validate>
+ValueType read_value_type(Decoder* decoder, const byte* pc,
+                          uint32_t* const length, const WasmFeatures& enabled) {
+  *length = 1;
+  byte val = decoder->read_u8<validate>(pc, "value type opcode");
+  if (decoder->failed()) {
+    return kWasmBottom;
+  }
+
+  ValueTypeCode code = static_cast<ValueTypeCode>(val);
+  switch (code) {
     case kLocalI32:
-      *result = kWasmI32;
-      return true;
+      return kWasmI32;
     case kLocalI64:
-      *result = kWasmI64;
-      return true;
+      return kWasmI64;
     case kLocalF32:
-      *result = kWasmF32;
-      return true;
+      return kWasmF32;
     case kLocalF64:
-      *result = kWasmF64;
-      return true;
-    case kLocalS128:
-      *result = kWasmS128;
-      return true;
-    case kLocalFuncRef:
-      *result = kWasmFuncRef;
-      return true;
+      return kWasmF64;
     case kLocalAnyRef:
-      *result = kWasmAnyRef;
-      return true;
+      if (enabled.has_anyref()) {
+        return kWasmAnyRef;
+      }
+      decoder->error(pc,
+                     "invalid value type 'anyref', enable with "
+                     "--experimental-wasm-anyref");
+      return kWasmBottom;
+    case kLocalFuncRef:
+      if (enabled.has_anyref()) {
+        return kWasmFuncRef;
+      }
+      decoder->error(pc,
+                     "invalid value type 'funcref', enable with "
+                     "--experimental-wasm-anyref");
+      return kWasmBottom;
     case kLocalNullRef:
-      *result = kWasmNullRef;
-      return true;
+      if (enabled.has_anyref()) {
+        return kWasmNullRef;
+      }
+      decoder->error(pc,
+                     "invalid value type 'nullref', enable with "
+                     "--experimental-wasm-anyref");
+      return kWasmBottom;
     case kLocalExnRef:
-      *result = kWasmExnRef;
-      return true;
-    default:
-      *result = kWasmBottom;
-      return false;
-  }
+      if (enabled.has_eh()) {
+        return kWasmExnRef;
+      }
+      decoder->error(pc,
+                     "invalid value type 'exception ref', enable with "
+                     "--experimental-wasm-eh");
+      return kWasmBottom;
+    case kLocalRef:
+      if (enabled.has_gc()) {
+        uint32_t type_index =
+            decoder->read_u32v<validate>(pc + 1, length, "type index");
+        (*length)++;
+        if (!VALIDATE(type_index < kV8MaxWasmTypes)) {
+          decoder->errorf(pc,
+                          "Type index %u is greater than the maximum "
+                          "number %zu of type definitions supported by V8",
+                          type_index, kV8MaxWasmTypes);
+          return kWasmBottom;
+        } else {
+          return ValueType(ValueType::kRef, type_index);
+        }
+      }
+      decoder->error(pc,
+                     "invalid value type 'ref', enable with "
+                     "--experimental-wasm-gc");
+      return kWasmBottom;
+    case kLocalOptRef:
+      if (enabled.has_gc()) {
+        uint32_t type_index =
+            decoder->read_u32v<validate>(pc + 1, length, "type index");
+        (*length)++;
+        if (!VALIDATE(type_index < kV8MaxWasmTypes)) {
+          decoder->errorf(pc,
+                          "Type index %u is greater than the maximum "
+                          "number %zu of type definitions supported by V8",
+                          type_index, kV8MaxWasmTypes);
+          return kWasmBottom;
+        } else {
+          return ValueType(ValueType::kOptRef, type_index);
+        }
+      }
+      decoder->error(pc,
+                     "invalid value type 'optref', enable with "
+                     "--experimental-wasm-gc");
+      return kWasmBottom;
+    case kLocalEqRef:
+      if (enabled.has_gc()) {
+        return kWasmEqRef;
+      }
+      decoder->error(pc,
+                     "invalid value type 'eqref', enable with "
+                     "--experimental-wasm-simd");
+      return kWasmBottom;
+    case kLocalI31Ref:
+      if (enabled.has_gc()) {
+        // TODO(7748): Implement
+        decoder->error(pc, "'i31ref' is unimplemented");
+      }
+      decoder->error(pc,
+                     "invalid value type 'i31ref', enable with "
+                     "--experimental-wasm-simd");
+      return kWasmBottom;
+    case kLocalRttRef:
+      if (enabled.has_gc()) {
+        // TODO(7748): Implement
+        decoder->error(pc, "'rttref' is unimplemented");
+      }
+      decoder->error(pc,
+                     "invalid value type 'rttref', enable with "
+                     "--experimental-wasm-simd");
+      return kWasmBottom;
+    case kLocalS128:
+      if (enabled.has_simd()) {
+        return kWasmS128;
+      }
+      decoder->error(pc,
+                     "invalid value type 'Simd128', enable with "
+                     "--experimental-wasm-simd");
+      return kWasmBottom;
+    case kLocalVoid:
+    case kLocalI8:
+    case kLocalI16:
+      // Although these types are included in ValueType, they are technically
+      // not value types and are only used in specific contexts. The caller of
+      // this function is responsible to check for them separately.
+      break;
+  }
+  // Malformed modules specifying invalid types can get here.
+  return kWasmBottom;
 }
-}  // namespace function_body_decoder
+}  // namespace value_type_reader
 
 template <Decoder::ValidateFlag validate>
 struct SelectTypeImmediate {
   uint32_t length;
   ValueType type;
 
-  inline SelectTypeImmediate(Decoder* decoder, const byte* pc) {
+  inline SelectTypeImmediate(const WasmFeatures& enabled, Decoder* decoder,
+                             const byte* pc) {
     uint8_t num_types =
         decoder->read_u32v<validate>(pc + 1, &length, "number of select types");
     if (!VALIDATE(num_types == 1)) {
@@ -262,12 +359,12 @@ struct SelectTypeImmediate {
           pc + 1, "Invalid number of types. Select accepts exactly one type");
       return;
     }
-    uint8_t val = decoder->read_u8<validate>(pc + length + 1, "select type");
-    length++;
-    if (!function_body_decoder::decode_local_type(val, &type) ||
-        type == kWasmStmt) {
+    uint32_t type_length;
+    type = value_type_reader::read_value_type<validate>(
+        decoder, pc + length + 1, &type_length, enabled);
+    length += type_length;
+    if (type == kWasmBottom) {
       decoder->error(pc + 1, "invalid select type");
-      return;
     }
   }
 };
@@ -281,22 +378,30 @@ struct BlockTypeImmediate {
 
   inline BlockTypeImmediate(const WasmFeatures& enabled, Decoder* decoder,
                             const byte* pc) {
-    uint8_t val = decoder->read_u8<validate>(pc + 1, "block type");
-    if (!function_body_decoder::decode_local_type(val, &type)) {
-      // Handle multi-value blocks.
-      if (!VALIDATE(enabled.has_mv())) {
-        decoder->error(pc + 1, "invalid block type");
-        return;
-      }
-      if (!VALIDATE(decoder->ok())) return;
-      int32_t index =
-          decoder->read_i32v<validate>(pc + 1, &length, "block arity");
-      if (!VALIDATE(length > 0 && index >= 0)) {
-        decoder->error(pc + 1, "invalid block type index");
-        return;
-      }
-      sig_index = static_cast<uint32_t>(index);
+    if (decoder->read_u8<validate>(pc + 1, "block type") == kLocalVoid) {
+      // 1st case: void block. Struct fields stay at default values.
+      return;
+    }
+    type = value_type_reader::read_value_type<validate>(decoder, pc + 1,
+                                                        &length, enabled);
+    if (type != kWasmBottom) {
+      // 2nd case: block with val type immediate.
+      return;
+    }
+    // It has to be the 3rd case: multi-value block,
+    // which is represented by a type index.
+    if (!VALIDATE(enabled.has_mv())) {
+      decoder->error(pc + 1, "invalid block type");
+      return;
+    }
+    if (!VALIDATE(decoder->ok())) return;
+    int32_t index =
+        decoder->read_i32v<validate>(pc + 1, &length, "block type index");
+    if (!VALIDATE(length > 0 && index >= 0)) {
+      decoder->error(pc + 1, "invalid block type index");
+      return;
     }
+    sig_index = static_cast<uint32_t>(index);
   }
 
   uint32_t in_arity() const {
@@ -373,6 +478,39 @@ struct TableIndexImmediate {
   }
 };
 
+template <Decoder::ValidateFlag validate>
+struct StructIndexImmediate {
+  uint32_t index = 0;
+  uint32_t length = 0;
+  const StructType* struct_type = nullptr;
+  inline StructIndexImmediate(Decoder* decoder, const byte* pc) {
+    index = decoder->read_u32v<validate>(pc, &length, "struct index");
+  }
+};
+
+template <Decoder::ValidateFlag validate>
+struct FieldIndexImmediate {
+  StructIndexImmediate<validate> struct_index;
+  uint32_t index = 0;
+  uint32_t length = 0;
+  inline FieldIndexImmediate(Decoder* decoder, const byte* pc)
+      : struct_index(decoder, pc) {
+    index = decoder->read_u32v<validate>(pc + struct_index.length, &length,
+                                         "field index");
+    length += struct_index.length;
+  }
+};
+
+template <Decoder::ValidateFlag validate>
+struct ArrayIndexImmediate {
+  uint32_t index = 0;
+  uint32_t length = 0;
+  const ArrayType* array_type = nullptr;
+  inline ArrayIndexImmediate(Decoder* decoder, const byte* pc) {
+    index = decoder->read_u32v<validate>(pc, &length, "array index");
+  }
+};
+
 template <Decoder::ValidateFlag validate>
 struct CallIndirectImmediate {
   uint32_t table_index;
@@ -485,8 +623,12 @@ struct SimdLaneImmediate {
   uint8_t lane;
   uint32_t length = 1;
 
-  inline SimdLaneImmediate(Decoder* decoder, const byte* pc) {
-    lane = decoder->read_u8<validate>(pc + 2, "lane");
+  inline SimdLaneImmediate(Decoder* decoder, const byte* pc,
+                           uint32_t opcode_length) {
+    // Callers should pass in pc unchanged from where the decoding happens. 1 is
+    // added to account for the SIMD prefix byte, and opcode_length is the
+    // number of bytes the LEB encoding of the SIMD opcode takes.
+    lane = decoder->read_u8<validate>(pc + 1 + opcode_length, "lane");
   }
 };
 
@@ -495,9 +637,14 @@ template <Decoder::ValidateFlag validate>
 struct Simd8x16ShuffleImmediate {
   uint8_t shuffle[kSimd128Size] = {0};
 
-  inline Simd8x16ShuffleImmediate(Decoder* decoder, const byte* pc) {
+  inline Simd8x16ShuffleImmediate(Decoder* decoder, const byte* pc,
+                                  uint32_t opcode_length) {
+    // Callers should pass in pc unchanged from where the decoding happens. 1 is
+    // added to account for the SIMD prefix byte, and opcode_length is the
+    // number of bytes the LEB encoding of the SIMD opcode takes.
     for (uint32_t i = 0; i < kSimd128Size; ++i) {
-      shuffle[i] = decoder->read_u8<validate>(pc + 2 + i, "shuffle");
+      shuffle[i] =
+          decoder->read_u8<validate>(pc + 1 + opcode_length + i, "shuffle");
     }
   }
 };
@@ -600,7 +747,7 @@ struct Merge {
   // Reachability::kReachable.
   bool reached;
 
-  Merge(bool reached = false) : reached(reached) {}
+  explicit Merge(bool reached = false) : reached(reached) {}
 
   Value& operator[](uint32_t i) {
     DCHECK_GT(arity, i);
@@ -613,6 +760,7 @@ enum ControlKind : uint8_t {
   kControlIfElse,
   kControlBlock,
   kControlLoop,
+  kControlLet,
   kControlTry,
   kControlTryCatch
 };
@@ -630,6 +778,7 @@ enum Reachability : uint8_t {
 template <typename Value>
 struct ControlBase {
   ControlKind kind = kControlBlock;
+  uint32_t locals_count = 0;
   uint32_t stack_depth = 0;  // stack height at the beginning of the construct.
   const uint8_t* pc = nullptr;
   Reachability reachability = kReachable;
@@ -640,13 +789,16 @@ struct ControlBase {
 
   MOVE_ONLY_NO_DEFAULT_CONSTRUCTOR(ControlBase);
 
-  ControlBase(ControlKind kind, uint32_t stack_depth, const uint8_t* pc,
-              Reachability reachability)
+  ControlBase(ControlKind kind, uint32_t locals_count, uint32_t stack_depth,
+              const uint8_t* pc, Reachability reachability)
       : kind(kind),
+        locals_count(locals_count),
         stack_depth(stack_depth),
         pc(pc),
         reachability(reachability),
-        start_merge(reachability == kReachable) {}
+        start_merge(reachability == kReachable) {
+    DCHECK(kind == kControlLet || locals_count == 0);
+  }
 
   // Check whether the current block is reachable.
   bool reachable() const { return reachability == kReachable; }
@@ -666,6 +818,7 @@ struct ControlBase {
   bool is_onearmed_if() const { return kind == kControlIf; }
   bool is_if_else() const { return kind == kControlIfElse; }
   bool is_block() const { return kind == kControlBlock; }
+  bool is_let() const { return kind == kControlLet; }
   bool is_loop() const { return kind == kControlLoop; }
   bool is_incomplete_try() const { return kind == kControlTry; }
   bool is_try_catch() const { return kind == kControlTryCatch; }
@@ -676,11 +829,6 @@ struct ControlBase {
   }
 };
 
-enum class LoadTransformationKind : uint8_t {
-  kSplat,
-  kExtend,
-};
-
 // This is the list of callback functions that an interface for the
 // WasmFullDecoder should implement.
 // F(Name, args...)
@@ -710,12 +858,15 @@ enum class LoadTransformationKind : uint8_t {
   F(F64Const, Value* result, double value)                                    \
   F(RefNull, Value* result)                                                   \
   F(RefFunc, uint32_t function_index, Value* result)                          \
+  F(RefAsNonNull, const Value& arg, Value* result)                            \
   F(Drop, const Value& value)                                                 \
   F(DoReturn, Vector<Value> values)                                           \
   F(LocalGet, Value* result, const LocalIndexImmediate<validate>& imm)        \
   F(LocalSet, const Value& value, const LocalIndexImmediate<validate>& imm)   \
   F(LocalTee, const Value& value, Value* result,                              \
     const LocalIndexImmediate<validate>& imm)                                 \
+  F(AllocateLocals, Vector<Value> local_values)                               \
+  F(DeallocateLocals, uint32_t count)                                         \
   F(GlobalGet, Value* result, const GlobalIndexImmediate<validate>& imm)      \
   F(GlobalSet, const Value& value, const GlobalIndexImmediate<validate>& imm) \
   F(TableGet, const Value& index, Value* result,                              \
@@ -746,6 +897,7 @@ enum class LoadTransformationKind : uint8_t {
     const Value args[])                                                       \
   F(ReturnCallIndirect, const Value& index,                                   \
     const CallIndirectImmediate<validate>& imm, const Value args[])           \
+  F(BrOnNull, const Value& ref_object, uint32_t depth)                        \
   F(SimdOp, WasmOpcode opcode, Vector<Value> args, Value* result)             \
   F(SimdLaneOp, WasmOpcode opcode, const SimdLaneImmediate<validate>& imm,    \
     const Vector<Value> inputs, Value* result)                                \
@@ -774,7 +926,23 @@ enum class LoadTransformationKind : uint8_t {
     const Value& delta, Value* result)                                        \
   F(TableSize, const TableIndexImmediate<validate>& imm, Value* result)       \
   F(TableFill, const TableIndexImmediate<validate>& imm, const Value& start,  \
-    const Value& value, const Value& count)
+    const Value& value, const Value& count)                                   \
+  F(StructNew, const StructIndexImmediate<validate>& imm, const Value args[], \
+    Value* result)                                                            \
+  F(StructGet, const Value& struct_object,                                    \
+    const FieldIndexImmediate<validate>& field, Value* result)                \
+  F(StructSet, const Value& struct_object,                                    \
+    const FieldIndexImmediate<validate>& field, const Value& field_value)     \
+  F(ArrayNew, const ArrayIndexImmediate<validate>& imm, const Value& length,  \
+    const Value& initial_value, Value* result)                                \
+  F(ArrayGet, const Value& array_obj,                                         \
+    const ArrayIndexImmediate<validate>& imm, const Value& index,             \
+    Value* result)                                                            \
+  F(ArraySet, const Value& array_obj,                                         \
+    const ArrayIndexImmediate<validate>& imm, const Value& index,             \
+    const Value& value)                                                       \
+  F(ArrayLen, const Value& array_obj, Value* result)                          \
+  F(PassThrough, const Value& from, Value* to)
 
 // Generic Wasm bytecode decoder with utilities for decoding immediates,
 // lengths, etc.
@@ -803,102 +971,81 @@ class WasmDecoder : public Decoder {
                : static_cast<uint32_t>(local_types_->size());
   }
 
-  static bool DecodeLocals(const WasmFeatures& enabled, Decoder* decoder,
-                           const FunctionSig* sig,
-                           ZoneVector<ValueType>* type_list) {
-    DCHECK_NOT_NULL(type_list);
-    DCHECK_EQ(0, type_list->size());
-    // Initialize from signature.
-    if (sig != nullptr) {
-      type_list->assign(sig->parameters().begin(), sig->parameters().end());
+  void InitializeLocalsFromSig() {
+    if (sig_ != nullptr) {
+      local_types_->assign(sig_->parameters().begin(),
+                           sig_->parameters().end());
     }
+  }
+
+  // Decodes local definitions in the current decoder.
+  // Returns true iff locals are found.
+  // Writes the total length of decoded locals in 'total_length'.
+  // If insert_postion is present, the decoded locals will be inserted into the
+  // 'local_types_' of this decoder. Otherwise, this function is used just to
+  // check validity and determine the encoding length of the locals in bytes.
+  // The decoder's pc is not advanced. If no locals are found (i.e., no
+  // compressed uint32 is found at pc), this will exit as 'false' and without an
+  // error.
+  bool DecodeLocals(const byte* pc, uint32_t* total_length,
+                    const base::Optional<uint32_t> insert_position) {
+    DCHECK_NOT_NULL(local_types_);
+
+    uint32_t length;
+    *total_length = 0;
+
+    // The 'else' value is useless, we pass it for convenience.
+    ZoneVector<ValueType>::iterator insert_iterator =
+        insert_position.has_value()
+            ? local_types_->begin() + insert_position.value()
+            : local_types_->begin();
+
     // Decode local declarations, if any.
-    uint32_t entries = decoder->consume_u32v("local decls count");
-    if (decoder->failed()) return false;
+    uint32_t entries = read_u32v<kValidate>(pc, &length, "local decls count");
+    if (failed()) {
+      error(pc + *total_length, "invalid local decls count");
+      return false;
+    }
 
+    *total_length += length;
     TRACE("local decls count: %u\n", entries);
-    while (entries-- > 0 && decoder->more()) {
-      uint32_t count = decoder->consume_u32v("local count");
-      if (decoder->failed()) return false;
 
-      DCHECK_LE(type_list->size(), kV8MaxWasmFunctionLocals);
-      if (count > kV8MaxWasmFunctionLocals - type_list->size()) {
-        decoder->error(decoder->pc() - 1, "local count too large");
+    while (entries-- > 0) {
+      if (!more()) {
+        error(end(), "expected more local decls but reached end of input");
         return false;
       }
-      byte code = decoder->consume_u8("local type");
-      if (decoder->failed()) return false;
+      uint32_t count =
+          read_u32v<kValidate>(pc + *total_length, &length, "local count");
+      if (failed()) {
+        error(pc + *total_length, "invalid local count");
+        return false;
+      }
+      DCHECK_LE(local_types_->size(), kV8MaxWasmFunctionLocals);
+      if (count > kV8MaxWasmFunctionLocals - local_types_->size()) {
+        error(pc + *total_length, "local count too large");
+        return false;
+      }
+      *total_length += length;
 
-      ValueType type;
-      switch (code) {
-        case kLocalI32:
-          type = kWasmI32;
-          break;
-        case kLocalI64:
-          type = kWasmI64;
-          break;
-        case kLocalF32:
-          type = kWasmF32;
-          break;
-        case kLocalF64:
-          type = kWasmF64;
-          break;
-        case kLocalAnyRef:
-          if (enabled.has_anyref()) {
-            type = kWasmAnyRef;
-            break;
-          }
-          decoder->error(decoder->pc() - 1,
-                         "invalid local type 'anyref', enable with "
-                         "--experimental-wasm-anyref");
-          return false;
-        case kLocalFuncRef:
-          if (enabled.has_anyref()) {
-            type = kWasmFuncRef;
-            break;
-          }
-          decoder->error(decoder->pc() - 1,
-                         "invalid local type 'funcref', enable with "
-                         "--experimental-wasm-anyref");
-          return false;
-        case kLocalNullRef:
-          if (enabled.has_anyref()) {
-            type = kWasmNullRef;
-            break;
-          }
-          decoder->error(decoder->pc() - 1,
-                         "invalid local type 'nullref', enable with "
-                         "--experimental-wasm-anyref");
-          return false;
-        case kLocalExnRef:
-          if (enabled.has_eh()) {
-            type = kWasmExnRef;
-            break;
-          }
-          decoder->error(decoder->pc() - 1,
-                         "invalid local type 'exception ref', enable with "
-                         "--experimental-wasm-eh");
-          return false;
-        case kLocalS128:
-          if (enabled.has_simd()) {
-            type = kWasmS128;
-            break;
-          }
-          decoder->error(decoder->pc() - 1,
-                         "invalid local type 'Simd128', enable with "
-                         "--experimental-wasm-simd");
-          return false;
-        default:
-          decoder->error(decoder->pc() - 1, "invalid local type");
-          return false;
+      ValueType type = value_type_reader::read_value_type<kValidate>(
+          this, pc + *total_length, &length, enabled_);
+      if (type == kWasmBottom) {
+        error(pc + *total_length, "invalid local type");
+        return false;
+      }
+      *total_length += length;
+      if (insert_position.has_value()) {
+        // Move the insertion iterator to the end of the newly inserted locals.
+        insert_iterator =
+            local_types_->insert(insert_iterator, count, type) + count;
       }
-      type_list->insert(type_list->end(), count, type);
     }
-    DCHECK(decoder->ok());
+    DCHECK(ok());
     return true;
   }
 
-  static BitVector* AnalyzeLoopAssignment(Decoder* decoder, const byte* pc,
+  static BitVector* AnalyzeLoopAssignment(WasmDecoder* decoder, const byte* pc,
                                           uint32_t locals_count, Zone* zone) {
     if (pc >= decoder->end()) return nullptr;
     if (*pc != kExprLoop) return nullptr;
@@ -989,6 +1136,41 @@ class WasmDecoder : public Decoder {
     return true;
   }
 
+  inline bool Complete(const byte* pc, StructIndexImmediate<validate>& imm) {
+    if (!VALIDATE(module_ != nullptr && module_->has_struct(imm.index))) {
+      return false;
+    }
+    imm.struct_type = module_->struct_type(imm.index);
+    return true;
+  }
+
+  inline bool Validate(const byte* pc, StructIndexImmediate<validate>& imm) {
+    if (Complete(pc, imm)) return true;
+    errorf(pc, "invalid struct index: %u", imm.index);
+    return false;
+  }
+
+  inline bool Validate(const byte* pc, FieldIndexImmediate<validate>& imm) {
+    if (!Validate(pc, imm.struct_index)) return false;
+    if (imm.index < imm.struct_index.struct_type->field_count()) return true;
+    errorf(pc + imm.struct_index.length, "invalid field index: %u", imm.index);
+    return false;
+  }
+
+  inline bool Complete(const byte* pc, ArrayIndexImmediate<validate>& imm) {
+    if (!VALIDATE(module_ != nullptr && module_->has_array(imm.index))) {
+      return false;
+    }
+    imm.array_type = module_->array_type(imm.index);
+    return true;
+  }
+
+  inline bool Validate(const byte* pc, ArrayIndexImmediate<validate>& imm) {
+    if (Complete(pc, imm)) return true;
+    errorf(pc, "invalid array index: %u", imm.index);
+    return false;
+  }
+
   inline bool CanReturnCall(const FunctionSig* target_sig) {
     if (target_sig == nullptr) return false;
     size_t num_returns = sig_->return_count();
@@ -1018,10 +1200,10 @@ class WasmDecoder : public Decoder {
 
   inline bool Complete(const byte* pc, CallIndirectImmediate<validate>& imm) {
     if (!VALIDATE(module_ != nullptr &&
-                  imm.sig_index < module_->signatures.size())) {
+                  module_->has_signature(imm.sig_index))) {
       return false;
     }
-    imm.sig = module_->signatures[imm.sig_index];
+    imm.sig = module_->signature(imm.sig_index);
     return true;
   }
 
@@ -1116,17 +1298,17 @@ class WasmDecoder : public Decoder {
 
   inline bool Complete(BlockTypeImmediate<validate>& imm) {
     if (imm.type != kWasmBottom) return true;
-    if (!VALIDATE(module_ && imm.sig_index < module_->signatures.size())) {
+    if (!VALIDATE(module_ && module_->has_signature(imm.sig_index))) {
       return false;
     }
-    imm.sig = module_->signatures[imm.sig_index];
+    imm.sig = module_->signature(imm.sig_index);
     return true;
   }
 
   inline bool Validate(BlockTypeImmediate<validate>& imm) {
     if (!Complete(imm)) {
-      errorf(pc_, "block type index %u out of bounds (%zu signatures)",
-             imm.sig_index, module_ ? module_->signatures.size() : 0);
+      errorf(pc_, "block type index %u out of bounds (%zu types)",
+             imm.sig_index, module_ ? module_->types.size() : 0);
       return false;
     }
     return true;
@@ -1230,7 +1412,7 @@ class WasmDecoder : public Decoder {
     return true;
   }
 
-  static uint32_t OpcodeLength(Decoder* decoder, const byte* pc) {
+  static uint32_t OpcodeLength(WasmDecoder* decoder, const byte* pc) {
     WasmOpcode opcode = static_cast<WasmOpcode>(*pc);
     switch (opcode) {
 #define DECLARE_OPCODE_CASE(name, opcode, sig) case kExpr##name:
@@ -1275,6 +1457,15 @@ class WasmDecoder : public Decoder {
         return 1 + imm.length;
       }
 
+      case kExprLet: {
+        BlockTypeImmediate<validate> imm(WasmFeatures::All(), decoder, pc);
+        uint32_t locals_length;
+        bool locals_result =
+            decoder->DecodeLocals(decoder->pc() + 1 + imm.length,
+                                  &locals_length, base::Optional<uint32_t>());
+        return 1 + imm.length + (locals_result ? locals_length : 0);
+      }
+
       case kExprThrow: {
         ExceptionIndexImmediate<validate> imm(decoder, pc);
         return 1 + imm.length;
@@ -1285,6 +1476,11 @@ class WasmDecoder : public Decoder {
         return 1 + imm.length;
       }
 
+      case kExprBrOnNull: {
+        BranchDepthImmediate<validate> imm(decoder, pc);
+        return 1 + imm.length;
+      }
+
       case kExprLocalGet:
       case kExprLocalSet:
       case kExprLocalTee: {
@@ -1292,7 +1488,7 @@ class WasmDecoder : public Decoder {
         return 1 + imm.length;
       }
       case kExprSelectWithType: {
-        SelectTypeImmediate<validate> imm(decoder, pc);
+        SelectTypeImmediate<validate> imm(WasmFeatures::All(), decoder, pc);
         return 1 + imm.length;
       }
       case kExprBrTable: {
@@ -1379,31 +1575,31 @@ class WasmDecoder : public Decoder {
         }
       }
       case kSimdPrefix: {
-        byte simd_index = decoder->read_u8<validate>(pc + 1, "simd_index");
-        WasmOpcode opcode =
-            static_cast<WasmOpcode>(kSimdPrefix << 8 | simd_index);
+        uint32_t length = 0;
+        opcode = decoder->read_prefixed_opcode<validate>(pc, &length);
         switch (opcode) {
 #define DECLARE_OPCODE_CASE(name, opcode, sig) case kExpr##name:
           FOREACH_SIMD_0_OPERAND_OPCODE(DECLARE_OPCODE_CASE)
 #undef DECLARE_OPCODE_CASE
-          return 2;
+          return 1 + length;
 #define DECLARE_OPCODE_CASE(name, opcode, sig) case kExpr##name:
           FOREACH_SIMD_1_OPERAND_OPCODE(DECLARE_OPCODE_CASE)
 #undef DECLARE_OPCODE_CASE
-          return 3;
+          return 2 + length;
 #define DECLARE_OPCODE_CASE(name, opcode, sig) case kExpr##name:
           FOREACH_SIMD_MEM_OPCODE(DECLARE_OPCODE_CASE)
 #undef DECLARE_OPCODE_CASE
           {
-            MemoryAccessImmediate<validate> imm(decoder, pc + 1, UINT32_MAX);
-            return 2 + imm.length;
+            MemoryAccessImmediate<validate> imm(decoder, pc + length,
+                                                UINT32_MAX);
+            return 1 + length + imm.length;
           }
           // Shuffles require a byte per lane, or 16 immediate bytes.
           case kExprS8x16Shuffle:
-            return 2 + kSimd128Size;
+            return 1 + length + kSimd128Size;
           default:
             decoder->error(pc, "invalid SIMD opcode");
-            return 2;
+            return 1 + length;
         }
       }
       case kAtomicPrefix: {
@@ -1429,6 +1625,58 @@ class WasmDecoder : public Decoder {
             return 2;
         }
       }
+      case kGCPrefix: {
+        byte gc_index = decoder->read_u8<validate>(pc + 1, "gc_index");
+        WasmOpcode opcode = static_cast<WasmOpcode>(kGCPrefix << 8 | gc_index);
+        switch (opcode) {
+          case kExprStructNew:
+          case kExprStructNewSub:
+          case kExprStructNewDefault: {
+            StructIndexImmediate<validate> imm(decoder, pc + 2);
+            return 2 + imm.length;
+          }
+          case kExprStructGet:
+          case kExprStructGetS:
+          case kExprStructGetU:
+          case kExprStructSet: {
+            FieldIndexImmediate<validate> imm(decoder, pc + 2);
+            return 2 + imm.length;
+          }
+          case kExprArrayNew:
+          case kExprArrayNewSub:
+          case kExprArrayNewDefault:
+          case kExprArrayGet:
+          case kExprArrayGetS:
+          case kExprArrayGetU:
+          case kExprArraySet:
+          case kExprArrayLen: {
+            ArrayIndexImmediate<validate> imm(decoder, pc + 2);
+            return 2 + imm.length;
+          }
+          case kExprBrOnCast: {
+            BranchDepthImmediate<validate> imm(decoder, pc + 2);
+            return 2 + imm.length;
+          }
+          case kExprRttGet:
+          case kExprRttSub: {
+            // TODO(7748): Implement.
+            decoder->error(pc, "rtt opcodes not implemented yet");
+            return 2;
+          }
+
+          case kExprI31New:
+          case kExprI31GetS:
+          case kExprI31GetU:
+          case kExprRefTest:
+          case kExprRefCast:
+            return 2;
+
+          default:
+            // This is unreachable except for malformed modules.
+            decoder->error(pc, "invalid gc opcode");
+            return 2;
+        }
+      }
       default:
         return 1;
     }
@@ -1454,6 +1702,8 @@ class WasmDecoder : public Decoder {
       case kExprTableGet:
       case kExprLocalTee:
       case kExprMemoryGrow:
+      case kExprRefAsNonNull:
+      case kExprBrOnNull:
         return {1, 1};
       case kExprLocalSet:
       case kExprGlobalSet:
@@ -1505,10 +1755,13 @@ class WasmDecoder : public Decoder {
       case kExprReturnCallIndirect:
       case kExprUnreachable:
         return {0, 0};
+      case kExprLet:
+        // TODO(7748): Implement
+        return {0, 0};
       case kNumericPrefix:
       case kAtomicPrefix:
       case kSimdPrefix: {
-        opcode = static_cast<WasmOpcode>(opcode << 8 | *(pc + 1));
+        opcode = this->read_prefixed_opcode<validate>(pc);
         switch (opcode) {
           FOREACH_SIMD_1_OPERAND_1_PARAM_OPCODE(DECLARE_OPCODE_CASE)
             return {1, 1};
@@ -1588,8 +1841,12 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     }
 
     DCHECK_EQ(0, this->local_types_->size());
-    WasmDecoder<validate>::DecodeLocals(this->enabled_, this, this->sig_,
-                                        this->local_types_);
+    this->InitializeLocalsFromSig();
+    uint32_t locals_length;
+    this->DecodeLocals(this->pc(), &locals_length,
+                       static_cast<uint32_t>(this->local_types_->size()));
+    this->consume_bytes(locals_length);
+
     CALL_INTERFACE(StartFunction);
     DecodeFunctionBody();
     if (!this->failed()) CALL_INTERFACE(FinishFunction);
@@ -1622,12 +1879,8 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     if (!WasmOpcodes::IsPrefixOpcode(opcode)) {
       return WasmOpcodes::OpcodeName(static_cast<WasmOpcode>(opcode));
     }
-    // We need one more byte.
-    ++pc;
-    if (pc >= this->end_) return "<end>";
-    byte sub_opcode = *pc;
-    opcode = static_cast<WasmOpcode>(opcode << 8 | sub_opcode);
-    return WasmOpcodes::OpcodeName(static_cast<WasmOpcode>(opcode));
+    opcode = this->template read_prefixed_opcode<Decoder::kValidate>(pc);
+    return WasmOpcodes::OpcodeName(opcode);
   }
 
   inline Zone* zone() const { return zone_; }
@@ -1730,7 +1983,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
 
     // Set up initial function block.
     {
-      auto* c = PushControl(kControlBlock);
+      Control* c = PushControl(kControlBlock);
       InitMerge(&c->start_merge, 0, [](uint32_t) -> Value { UNREACHABLE(); });
       InitMerge(&c->end_merge,
                 static_cast<uint32_t>(this->sig_->return_count()),
@@ -1769,8 +2022,8 @@ class WasmFullDecoder : public WasmDecoder<validate> {
         case kExprBlock: {
           BlockTypeImmediate<validate> imm(this->enabled_, this, this->pc_);
           if (!this->Validate(imm)) break;
-          auto args = PopArgs(imm.sig);
-          auto* block = PushControl(kControlBlock);
+          ArgVector args = PopArgs(imm.sig);
+          Control* block = PushControl(kControlBlock);
           SetBlockType(block, imm, args.begin());
           CALL_INTERFACE_IF_REACHABLE(Block, block);
           PushMergeValues(block, &block->start_merge);
@@ -1779,7 +2032,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
         }
         case kExprRethrow: {
           CHECK_PROTOTYPE_OPCODE(eh);
-          auto exception = Pop(0, kWasmExnRef);
+          Value exception = Pop(0, kWasmExnRef);
           CALL_INTERFACE_IF_REACHABLE(Rethrow, exception);
           EndControl();
           break;
@@ -1789,7 +2042,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           ExceptionIndexImmediate<validate> imm(this, this->pc_);
           len = 1 + imm.length;
           if (!this->Validate(this->pc_, imm)) break;
-          auto args = PopArgs(imm.exception->ToFunctionSig());
+          ArgVector args = PopArgs(imm.exception->ToFunctionSig());
           CALL_INTERFACE_IF_REACHABLE(Throw, imm, VectorOf(args));
           EndControl();
           break;
@@ -1798,8 +2051,8 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           CHECK_PROTOTYPE_OPCODE(eh);
           BlockTypeImmediate<validate> imm(this->enabled_, this, this->pc_);
           if (!this->Validate(imm)) break;
-          auto args = PopArgs(imm.sig);
-          auto* try_block = PushControl(kControlTry);
+          ArgVector args = PopArgs(imm.sig);
+          Control* try_block = PushControl(kControlTry);
           SetBlockType(try_block, imm, args.begin());
           len = 1 + imm.length;
           CALL_INTERFACE_IF_REACHABLE(Try, try_block);
@@ -1825,7 +2078,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           FallThruTo(c);
           stack_.erase(stack_.begin() + c->stack_depth, stack_.end());
           c->reachability = control_at(1)->innerReachability();
-          auto* exception = Push(kWasmExnRef);
+          Value* exception = Push(kWasmExnRef);
           CALL_INTERFACE_IF_PARENT_REACHABLE(Catch, c, exception);
           break;
         }
@@ -1835,7 +2088,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           if (!this->Validate(this->pc_, imm.depth, control_.size())) break;
           if (!this->Validate(this->pc_ + imm.depth.length, imm.index)) break;
           Control* c = control_at(imm.depth.depth);
-          auto exception = Pop(0, kWasmExnRef);
+          Value exception = Pop(0, kWasmExnRef);
           const WasmExceptionSig* sig = imm.index.exception->sig;
           size_t value_count = sig->parameter_count();
           // TODO(wasm): This operand stack mutation is an ugly hack to make
@@ -1854,15 +2107,87 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           }
           len = 1 + imm.length;
           for (size_t i = 0; i < value_count; ++i) Pop();
-          auto* pexception = Push(kWasmExnRef);
+          Value* pexception = Push(kWasmExnRef);
           *pexception = exception;
           break;
         }
+        case kExprBrOnNull: {
+          CHECK_PROTOTYPE_OPCODE(gc);
+          BranchDepthImmediate<validate> imm(this, this->pc_);
+          if (!this->Validate(this->pc_, imm, control_.size())) break;
+          len = 1 + imm.length;
+          Value ref_object = Pop();
+          if (this->failed()) break;
+          Control* c = control_at(imm.depth);
+          TypeCheckBranchResult check_result = TypeCheckBranch(c, true);
+          if (V8_LIKELY(check_result == kReachableBranch)) {
+            switch (ref_object.type.kind()) {
+              case ValueType::kRef: {
+                Value* result = Push(
+                    ValueType(ValueType::kRef, ref_object.type.ref_index()));
+                CALL_INTERFACE(PassThrough, ref_object, result);
+                break;
+              }
+              case ValueType::kOptRef: {
+                // We need to Push the result value after calling BrOnNull on
+                // the interface. Therefore we must sync the ref_object and
+                // result nodes afterwards (in PassThrough).
+                CALL_INTERFACE(BrOnNull, ref_object, imm.depth);
+                Value* result = Push(
+                    ValueType(ValueType::kRef, ref_object.type.ref_index()));
+                CALL_INTERFACE(PassThrough, ref_object, result);
+                c->br_merge()->reached = true;
+                break;
+              }
+              case ValueType::kNullRef:
+                if (imm.depth == control_.size() - 1) {
+                  DoReturn();
+                } else {
+                  CALL_INTERFACE(Br, c);
+                  c->br_merge()->reached = true;
+                }
+                EndControl();
+                break;
+              default:
+                this->error(this->pc_,
+                            "invalid agrument type to ref.as_non_null");
+                break;
+            }
+          }
+          break;
+        }
+        case kExprLet: {
+          CHECK_PROTOTYPE_OPCODE(typed_funcref);
+          BlockTypeImmediate<validate> imm(this->enabled_, this, this->pc_);
+          if (!this->Validate(imm)) break;
+          uint32_t current_local_count =
+              static_cast<uint32_t>(local_type_vec_.size());
+          // Temporarily add the let-defined values
+          // to the beginning of the function locals.
+          uint32_t locals_length;
+          if (!this->DecodeLocals(this->pc() + 1 + imm.length, &locals_length,
+                                  0)) {
+            break;
+          }
+          len = 1 + imm.length + locals_length;
+          uint32_t locals_count = static_cast<uint32_t>(local_type_vec_.size() -
+                                                        current_local_count);
+          ArgVector let_local_values =
+              PopArgs(VectorOf(local_type_vec_.data(), locals_count));
+          ArgVector args = PopArgs(imm.sig);
+          Control* let_block = PushControl(kControlLet, locals_count);
+          SetBlockType(let_block, imm, args.begin());
+          CALL_INTERFACE_IF_REACHABLE(Block, let_block);
+          PushMergeValues(let_block, &let_block->start_merge);
+          CALL_INTERFACE_IF_REACHABLE(AllocateLocals,
+                                      VectorOf(let_local_values));
+          break;
+        }
         case kExprLoop: {
           BlockTypeImmediate<validate> imm(this->enabled_, this, this->pc_);
           if (!this->Validate(imm)) break;
-          auto args = PopArgs(imm.sig);
-          auto* block = PushControl(kControlLoop);
+          ArgVector args = PopArgs(imm.sig);
+          Control* block = PushControl(kControlLoop);
           SetBlockType(&control_.back(), imm, args.begin());
           len = 1 + imm.length;
           CALL_INTERFACE_IF_REACHABLE(Loop, block);
@@ -1872,10 +2197,10 @@ class WasmFullDecoder : public WasmDecoder<validate> {
         case kExprIf: {
           BlockTypeImmediate<validate> imm(this->enabled_, this, this->pc_);
           if (!this->Validate(imm)) break;
-          auto cond = Pop(0, kWasmI32);
-          auto args = PopArgs(imm.sig);
+          Value cond = Pop(0, kWasmI32);
+          ArgVector args = PopArgs(imm.sig);
           if (!VALIDATE(this->ok())) break;
-          auto* if_block = PushControl(kControlIf);
+          Control* if_block = PushControl(kControlIf);
           SetBlockType(if_block, imm, args.begin());
           CALL_INTERFACE_IF_REACHABLE(If, cond, if_block);
           len = 1 + imm.length;
@@ -1923,6 +2248,12 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             }
             if (!TypeCheckOneArmedIf(c)) break;
           }
+          if (c->is_let()) {
+            this->local_types_->erase(
+                this->local_types_->begin(),
+                this->local_types_->begin() + c->locals_count);
+            CALL_INTERFACE_IF_REACHABLE(DeallocateLocals, c->locals_count);
+          }
           if (!TypeCheckFallThru()) break;
 
           if (control_.size() == 1) {
@@ -1942,27 +2273,27 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           break;
         }
         case kExprSelect: {
-          auto cond = Pop(2, kWasmI32);
-          auto fval = Pop();
-          auto tval = Pop(0, fval.type);
+          Value cond = Pop(2, kWasmI32);
+          Value fval = Pop();
+          Value tval = Pop(0, fval.type);
           ValueType type = tval.type == kWasmBottom ? fval.type : tval.type;
-          if (type.IsSubTypeOf(kWasmAnyRef)) {
+          if (type.IsReferenceType()) {
             this->error(
                 "select without type is only valid for value type inputs");
             break;
           }
-          auto* result = Push(type);
+          Value* result = Push(type);
           CALL_INTERFACE_IF_REACHABLE(Select, cond, fval, tval, result);
           break;
         }
         case kExprSelectWithType: {
           CHECK_PROTOTYPE_OPCODE(anyref);
-          SelectTypeImmediate<validate> imm(this, this->pc_);
+          SelectTypeImmediate<validate> imm(this->enabled_, this, this->pc_);
           if (this->failed()) break;
-          auto cond = Pop(2, kWasmI32);
-          auto fval = Pop(1, imm.type);
-          auto tval = Pop(0, imm.type);
-          auto* result = Push(imm.type);
+          Value cond = Pop(2, kWasmI32);
+          Value fval = Pop(1, imm.type);
+          Value tval = Pop(0, imm.type);
+          Value* result = Push(imm.type);
           CALL_INTERFACE_IF_REACHABLE(Select, cond, fval, tval, result);
           len = 1 + imm.length;
           break;
@@ -1988,7 +2319,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
         }
         case kExprBrIf: {
           BranchDepthImmediate<validate> imm(this, this->pc_);
-          auto cond = Pop(0, kWasmI32);
+          Value cond = Pop(0, kWasmI32);
           if (this->failed()) break;
           if (!this->Validate(this->pc_, imm, control_.size())) break;
           Control* c = control_at(imm.depth);
@@ -2005,7 +2336,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
         case kExprBrTable: {
           BranchTableImmediate<validate> imm(this, this->pc_);
           BranchTableIterator<validate> iterator(this, imm);
-          auto key = Pop(0, kWasmI32);
+          Value key = Pop(0, kWasmI32);
           if (this->failed()) break;
           if (!this->Validate(this->pc_, imm, control_.size())) break;
 
@@ -2063,7 +2394,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             // Since we deal with unreachable code, we do not have to keep the
             // values.
             int num_returns = static_cast<int>(this->sig_->return_count());
-            for (int i = 0; i < num_returns; ++i) {
+            for (int i = num_returns - 1; i >= 0; --i) {
               Pop(i, this->sig_->GetReturn(i));
             }
           }
@@ -2078,35 +2409,35 @@ class WasmFullDecoder : public WasmDecoder<validate> {
         }
         case kExprI32Const: {
           ImmI32Immediate<validate> imm(this, this->pc_);
-          auto* value = Push(kWasmI32);
+          Value* value = Push(kWasmI32);
           CALL_INTERFACE_IF_REACHABLE(I32Const, value, imm.value);
           len = 1 + imm.length;
           break;
         }
         case kExprI64Const: {
           ImmI64Immediate<validate> imm(this, this->pc_);
-          auto* value = Push(kWasmI64);
+          Value* value = Push(kWasmI64);
           CALL_INTERFACE_IF_REACHABLE(I64Const, value, imm.value);
           len = 1 + imm.length;
           break;
         }
         case kExprF32Const: {
           ImmF32Immediate<validate> imm(this, this->pc_);
-          auto* value = Push(kWasmF32);
+          Value* value = Push(kWasmF32);
           CALL_INTERFACE_IF_REACHABLE(F32Const, value, imm.value);
           len = 1 + imm.length;
           break;
         }
         case kExprF64Const: {
           ImmF64Immediate<validate> imm(this, this->pc_);
-          auto* value = Push(kWasmF64);
+          Value* value = Push(kWasmF64);
           CALL_INTERFACE_IF_REACHABLE(F64Const, value, imm.value);
           len = 1 + imm.length;
           break;
         }
         case kExprRefNull: {
           CHECK_PROTOTYPE_OPCODE(anyref);
-          auto* value = Push(kWasmNullRef);
+          Value* value = Push(kWasmNullRef);
           CALL_INTERFACE_IF_REACHABLE(RefNull, value);
           len = 1;
           break;
@@ -2115,15 +2446,44 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           CHECK_PROTOTYPE_OPCODE(anyref);
           FunctionIndexImmediate<validate> imm(this, this->pc_);
           if (!this->Validate(this->pc_, imm)) break;
-          auto* value = Push(kWasmFuncRef);
+          Value* value = Push(kWasmFuncRef);
           CALL_INTERFACE_IF_REACHABLE(RefFunc, imm.index, value);
           len = 1 + imm.length;
           break;
         }
+        case kExprRefAsNonNull: {
+          CHECK_PROTOTYPE_OPCODE(gc);
+          Value value = Pop();
+          switch (value.type.kind()) {
+            case ValueType::kRef: {
+              Value* result =
+                  Push(ValueType(ValueType::kRef, value.type.ref_index()));
+              CALL_INTERFACE_IF_REACHABLE(PassThrough, value, result);
+              break;
+            }
+            case ValueType::kOptRef: {
+              Value* result =
+                  Push(ValueType(ValueType::kRef, value.type.ref_index()));
+              CALL_INTERFACE_IF_REACHABLE(RefAsNonNull, value, result);
+              break;
+            }
+            case ValueType::kNullRef:
+              // TODO(7748): Fix this once the standard clears up (see
+              // https://github.com/WebAssembly/function-references/issues/21).
+              CALL_INTERFACE_IF_REACHABLE(Unreachable);
+              EndControl();
+              break;
+            default:
+              this->error(this->pc_ + 1,
+                          "invalid agrument type to ref.as_non_null");
+              break;
+          }
+          break;
+        }
         case kExprLocalGet: {
           LocalIndexImmediate<validate> imm(this, this->pc_);
           if (!this->Validate(this->pc_, imm)) break;
-          auto* value = Push(imm.type);
+          Value* value = Push(imm.type);
           CALL_INTERFACE_IF_REACHABLE(LocalGet, value, imm);
           len = 1 + imm.length;
           break;
@@ -2131,7 +2491,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
         case kExprLocalSet: {
           LocalIndexImmediate<validate> imm(this, this->pc_);
           if (!this->Validate(this->pc_, imm)) break;
-          auto value = Pop(0, local_type_vec_[imm.index]);
+          Value value = Pop(0, local_type_vec_[imm.index]);
           CALL_INTERFACE_IF_REACHABLE(LocalSet, value, imm);
           len = 1 + imm.length;
           break;
@@ -2139,14 +2499,14 @@ class WasmFullDecoder : public WasmDecoder<validate> {
         case kExprLocalTee: {
           LocalIndexImmediate<validate> imm(this, this->pc_);
           if (!this->Validate(this->pc_, imm)) break;
-          auto value = Pop(0, local_type_vec_[imm.index]);
-          auto* result = Push(value.type);
+          Value value = Pop(0, local_type_vec_[imm.index]);
+          Value* result = Push(value.type);
           CALL_INTERFACE_IF_REACHABLE(LocalTee, value, result, imm);
           len = 1 + imm.length;
           break;
         }
         case kExprDrop: {
-          auto value = Pop();
+          Value value = Pop();
           CALL_INTERFACE_IF_REACHABLE(Drop, value);
           break;
         }
@@ -2154,7 +2514,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           GlobalIndexImmediate<validate> imm(this, this->pc_);
           len = 1 + imm.length;
           if (!this->Validate(this->pc_, imm)) break;
-          auto* result = Push(imm.type);
+          Value* result = Push(imm.type);
           CALL_INTERFACE_IF_REACHABLE(GlobalGet, result, imm);
           break;
         }
@@ -2167,7 +2527,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
                          imm.index);
             break;
           }
-          auto value = Pop(0, imm.type);
+          Value value = Pop(0, imm.type);
           CALL_INTERFACE_IF_REACHABLE(GlobalSet, value, imm);
           break;
         }
@@ -2177,8 +2537,8 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           len = 1 + imm.length;
           if (!this->Validate(this->pc_, imm)) break;
           DCHECK_NOT_NULL(this->module_);
-          auto index = Pop(0, kWasmI32);
-          auto* result = Push(this->module_->tables[imm.index].type);
+          Value index = Pop(0, kWasmI32);
+          Value* result = Push(this->module_->tables[imm.index].type);
           CALL_INTERFACE_IF_REACHABLE(TableGet, index, result, imm);
           break;
         }
@@ -2187,8 +2547,8 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           TableIndexImmediate<validate> imm(this, this->pc_);
           len = 1 + imm.length;
           if (!this->Validate(this->pc_, imm)) break;
-          auto value = Pop(1, this->module_->tables[imm.index].type);
-          auto index = Pop(0, kWasmI32);
+          Value value = Pop(1, this->module_->tables[imm.index].type);
+          Value index = Pop(0, kWasmI32);
           CALL_INTERFACE_IF_REACHABLE(TableSet, index, value, imm);
           break;
         }
@@ -2271,15 +2631,15 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             this->error("grow_memory is not supported for asmjs modules");
             break;
           }
-          auto value = Pop(0, kWasmI32);
-          auto* result = Push(kWasmI32);
+          Value value = Pop(0, kWasmI32);
+          Value* result = Push(kWasmI32);
           CALL_INTERFACE_IF_REACHABLE(MemoryGrow, value, result);
           break;
         }
         case kExprMemorySize: {
           if (!CheckHasMemory()) break;
           MemoryIndexImmediate<validate> imm(this, this->pc_);
-          auto* result = Push(kWasmI32);
+          Value* result = Push(kWasmI32);
           len = 1 + imm.length;
           CALL_INTERFACE_IF_REACHABLE(CurrentMemoryPages, result);
           break;
@@ -2288,8 +2648,8 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           CallFunctionImmediate<validate> imm(this, this->pc_);
           len = 1 + imm.length;
           if (!this->Validate(this->pc_, imm)) break;
-          auto args = PopArgs(imm.sig);
-          auto* returns = PushReturns(imm.sig);
+          ArgVector args = PopArgs(imm.sig);
+          Value* returns = PushReturns(imm.sig);
           CALL_INTERFACE_IF_REACHABLE(CallDirect, imm, args.begin(), returns);
           break;
         }
@@ -2297,9 +2657,9 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           CallIndirectImmediate<validate> imm(this->enabled_, this, this->pc_);
           len = 1 + imm.length;
           if (!this->Validate(this->pc_, imm)) break;
-          auto index = Pop(0, kWasmI32);
-          auto args = PopArgs(imm.sig);
-          auto* returns = PushReturns(imm.sig);
+          Value index = Pop(0, kWasmI32);
+          ArgVector args = PopArgs(imm.sig);
+          Value* returns = PushReturns(imm.sig);
           CALL_INTERFACE_IF_REACHABLE(CallIndirect, index, imm, args.begin(),
                                       returns);
           break;
@@ -2315,7 +2675,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             break;
           }
 
-          auto args = PopArgs(imm.sig);
+          ArgVector args = PopArgs(imm.sig);
 
           CALL_INTERFACE_IF_REACHABLE(ReturnCall, imm, args.begin());
           EndControl();
@@ -2330,8 +2690,8 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             OPCODE_ERROR(opcode, "tail call return types mismatch");
             break;
           }
-          auto index = Pop(0, kWasmI32);
-          auto args = PopArgs(imm.sig);
+          Value index = Pop(0, kWasmI32);
+          ArgVector args = PopArgs(imm.sig);
           CALL_INTERFACE_IF_REACHABLE(ReturnCallIndirect, index, imm,
                                       args.begin());
           EndControl();
@@ -2355,13 +2715,15 @@ class WasmFullDecoder : public WasmDecoder<validate> {
         }
         case kSimdPrefix: {
           CHECK_PROTOTYPE_OPCODE(simd);
-          len++;
-          byte simd_index =
-              this->template read_u8<validate>(this->pc_ + 1, "simd index");
-          opcode = static_cast<WasmOpcode>(opcode << 8 | simd_index);
+          uint32_t length = 0;
+          opcode =
+              this->template read_prefixed_opcode<validate>(this->pc_, &length);
+          if (!VALIDATE(this->ok())) break;
+          len += length;
+
           TRACE_PART(TRACE_INST_FORMAT, startrel(this->pc_),
                      WasmOpcodes::OpcodeName(opcode));
-          len += DecodeSimdOpcode(opcode);
+          len += DecodeSimdOpcode(opcode, length);
           break;
         }
         case kAtomicPrefix: {
@@ -2375,6 +2737,16 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           len += DecodeAtomicOpcode(opcode);
           break;
         }
+        case kGCPrefix: {
+          CHECK_PROTOTYPE_OPCODE(gc);
+          byte gc_index =
+              this->template read_u8<validate>(this->pc_ + 1, "gc index");
+          opcode = static_cast<WasmOpcode>(opcode << 8 | gc_index);
+          TRACE_PART(TRACE_INST_FORMAT, startrel(this->pc_),
+                     WasmOpcodes::OpcodeName(opcode));
+          len = DecodeGCOpcode(opcode);
+          break;
+        }
 // Note that prototype opcodes are not handled in the fastpath
 // above this switch, to avoid checking a feature flag.
 #define SIMPLE_PROTOTYPE_CASE(name, opc, sig) \
@@ -2414,7 +2786,9 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             case kControlTry:
               TRACE_PART("T");
               break;
-            default:
+            case kControlIfElse:
+            case kControlTryCatch:
+            case kControlLet:  // TODO(7748): Implement
               break;
           }
           if (c.start_merge.arity) TRACE_PART("%u-", c.start_merge.arity);
@@ -2423,10 +2797,11 @@ class WasmFullDecoder : public WasmDecoder<validate> {
         }
         TRACE_PART(" | ");
         for (size_t i = 0; i < stack_.size(); ++i) {
-          auto& val = stack_[i];
+          Value& val = stack_[i];
           WasmOpcode opcode = static_cast<WasmOpcode>(*val.pc);
           if (WasmOpcodes::IsPrefixOpcode(opcode)) {
-            opcode = static_cast<WasmOpcode>(opcode << 8 | *(val.pc + 1));
+            opcode = this->template read_prefixed_opcode<Decoder::kNoValidate>(
+                val.pc);
           }
           TRACE_PART(" %c@%d:%s", val.type.short_name(),
                      static_cast<int>(val.pc - this->start_),
@@ -2468,7 +2843,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
 
   void EndControl() {
     DCHECK(!control_.empty());
-    auto* current = &control_.back();
+    Control* current = &control_.back();
     stack_.erase(stack_.begin() + current->stack_depth, stack_.end());
     CALL_INTERFACE_IF_REACHABLE(EndControl, current);
     current->reachability = kUnreachable;
@@ -2507,15 +2882,33 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     return args;
   }
 
+  V8_INLINE ArgVector PopArgs(const StructType* type) {
+    int count = static_cast<int>(type->field_count());
+    ArgVector args(count);
+    for (int i = count - 1; i >= 0; i--) {
+      args[i] = Pop(i, type->field(i));
+    }
+    return args;
+  }
+
+  V8_INLINE ArgVector PopArgs(Vector<ValueType> arg_types) {
+    ArgVector args(arg_types.size());
+    for (int i = static_cast<int>(arg_types.size()) - 1; i >= 0; i--) {
+      args[i] = Pop(i, arg_types[i]);
+    }
+    return args;
+  }
+
   ValueType GetReturnType(const FunctionSig* sig) {
     DCHECK_GE(1, sig->return_count());
     return sig->return_count() == 0 ? kWasmStmt : sig->GetReturn();
   }
 
-  Control* PushControl(ControlKind kind) {
+  Control* PushControl(ControlKind kind, uint32_t locals_count = 0) {
     Reachability reachability =
         control_.empty() ? kReachable : control_.back().innerReachability();
-    control_.emplace_back(kind, stack_size(), this->pc_, reachability);
+    control_.emplace_back(kind, locals_count, stack_size(), this->pc_,
+                          reachability);
     return &control_.back();
   }
 
@@ -2540,17 +2933,22 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     if (!CheckHasMemory()) return 0;
     MemoryAccessImmediate<validate> imm(this, this->pc_ + prefix_len,
                                         type.size_log_2());
-    auto index = Pop(0, kWasmI32);
-    auto* result = Push(type.value_type());
+    Value index = Pop(0, kWasmI32);
+    Value* result = Push(type.value_type());
     CALL_INTERFACE_IF_REACHABLE(LoadMem, type, imm, index, result);
     return imm.length;
   }
 
-  int DecodeLoadTransformMem(LoadType type, LoadTransformationKind transform) {
+  int DecodeLoadTransformMem(LoadType type, LoadTransformationKind transform,
+                             uint32_t opcode_length) {
     if (!CheckHasMemory()) return 0;
-    MemoryAccessImmediate<validate> imm(this, this->pc_ + 1, type.size_log_2());
-    auto index = Pop(0, kWasmI32);
-    auto* result = Push(kWasmS128);
+    // Load extends always load 64-bits.
+    uint32_t max_alignment =
+        transform == LoadTransformationKind::kExtend ? 3 : type.size_log_2();
+    MemoryAccessImmediate<validate> imm(this, this->pc_ + opcode_length,
+                                        max_alignment);
+    Value index = Pop(0, kWasmI32);
+    Value* result = Push(kWasmS128);
     CALL_INTERFACE_IF_REACHABLE(LoadTransform, type, transform, imm, index,
                                 result);
     return imm.length;
@@ -2560,8 +2958,8 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     if (!CheckHasMemory()) return 0;
     MemoryAccessImmediate<validate> imm(this, this->pc_ + prefix_len,
                                         store.size_log_2());
-    auto value = Pop(1, store.value_type());
-    auto index = Pop(0, kWasmI32);
+    Value value = Pop(1, store.value_type());
+    Value index = Pop(0, kWasmI32);
     CALL_INTERFACE_IF_REACHABLE(StoreMem, store, imm, index, value);
     return imm.length;
   }
@@ -2576,7 +2974,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
   }
 
   std::vector<ValueType> InitializeBrTableResultTypes(uint32_t target) {
-    auto* merge = control_at(target)->br_merge();
+    Merge<Value>* merge = control_at(target)->br_merge();
     int br_arity = merge->arity;
     std::vector<ValueType> result(br_arity);
     for (int i = 0; i < br_arity; ++i) {
@@ -2587,7 +2985,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
 
   bool UpdateBrTableResultTypes(std::vector<ValueType>* result_types,
                                 uint32_t target, const byte* pos, int index) {
-    auto* merge = control_at(target)->br_merge();
+    Merge<Value>* merge = control_at(target)->br_merge();
     int br_arity = merge->arity;
     // First we check if the arities match.
     if (br_arity != static_cast<int>(result_types->size())) {
@@ -2649,56 +3047,60 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     return this->ok();
   }
 
-  uint32_t SimdExtractLane(WasmOpcode opcode, ValueType type) {
-    SimdLaneImmediate<validate> imm(this, this->pc_);
+  uint32_t SimdExtractLane(WasmOpcode opcode, ValueType type,
+                           uint32_t opcode_length) {
+    SimdLaneImmediate<validate> imm(this, this->pc_, opcode_length);
     if (this->Validate(this->pc_, opcode, imm)) {
       Value inputs[] = {Pop(0, kWasmS128)};
-      auto* result = Push(type);
+      Value* result = Push(type);
       CALL_INTERFACE_IF_REACHABLE(SimdLaneOp, opcode, imm, ArrayVector(inputs),
                                   result);
     }
     return imm.length;
   }
 
-  uint32_t SimdReplaceLane(WasmOpcode opcode, ValueType type) {
-    SimdLaneImmediate<validate> imm(this, this->pc_);
+  uint32_t SimdReplaceLane(WasmOpcode opcode, ValueType type,
+                           uint32_t opcode_length) {
+    SimdLaneImmediate<validate> imm(this, this->pc_, opcode_length);
     if (this->Validate(this->pc_, opcode, imm)) {
       Value inputs[2] = {UnreachableValue(this->pc_),
                          UnreachableValue(this->pc_)};
       inputs[1] = Pop(1, type);
       inputs[0] = Pop(0, kWasmS128);
-      auto* result = Push(kWasmS128);
+      Value* result = Push(kWasmS128);
       CALL_INTERFACE_IF_REACHABLE(SimdLaneOp, opcode, imm, ArrayVector(inputs),
                                   result);
     }
     return imm.length;
   }
 
-  uint32_t Simd8x16ShuffleOp() {
-    Simd8x16ShuffleImmediate<validate> imm(this, this->pc_);
+  uint32_t Simd8x16ShuffleOp(uint32_t opcode_length) {
+    Simd8x16ShuffleImmediate<validate> imm(this, this->pc_, opcode_length);
     if (this->Validate(this->pc_, imm)) {
-      auto input1 = Pop(1, kWasmS128);
-      auto input0 = Pop(0, kWasmS128);
-      auto* result = Push(kWasmS128);
+      Value input1 = Pop(1, kWasmS128);
+      Value input0 = Pop(0, kWasmS128);
+      Value* result = Push(kWasmS128);
       CALL_INTERFACE_IF_REACHABLE(Simd8x16ShuffleOp, imm, input0, input1,
                                   result);
     }
     return 16;
   }
 
-  uint32_t DecodeSimdOpcode(WasmOpcode opcode) {
+  uint32_t DecodeSimdOpcode(WasmOpcode opcode, uint32_t opcode_length) {
+    // opcode_length is the number of bytes that this SIMD-specific opcode takes
+    // up in the LEB128 encoded form.
     uint32_t len = 0;
     switch (opcode) {
       case kExprF64x2ExtractLane: {
-        len = SimdExtractLane(opcode, kWasmF64);
+        len = SimdExtractLane(opcode, kWasmF64, opcode_length);
         break;
       }
       case kExprF32x4ExtractLane: {
-        len = SimdExtractLane(opcode, kWasmF32);
+        len = SimdExtractLane(opcode, kWasmF32, opcode_length);
         break;
       }
       case kExprI64x2ExtractLane: {
-        len = SimdExtractLane(opcode, kWasmI64);
+        len = SimdExtractLane(opcode, kWasmI64, opcode_length);
         break;
       }
       case kExprI32x4ExtractLane:
@@ -2706,76 +3108,84 @@ class WasmFullDecoder : public WasmDecoder<validate> {
       case kExprI16x8ExtractLaneU:
       case kExprI8x16ExtractLaneS:
       case kExprI8x16ExtractLaneU: {
-        len = SimdExtractLane(opcode, kWasmI32);
+        len = SimdExtractLane(opcode, kWasmI32, opcode_length);
         break;
       }
       case kExprF64x2ReplaceLane: {
-        len = SimdReplaceLane(opcode, kWasmF64);
+        len = SimdReplaceLane(opcode, kWasmF64, opcode_length);
         break;
       }
       case kExprF32x4ReplaceLane: {
-        len = SimdReplaceLane(opcode, kWasmF32);
+        len = SimdReplaceLane(opcode, kWasmF32, opcode_length);
         break;
       }
       case kExprI64x2ReplaceLane: {
-        len = SimdReplaceLane(opcode, kWasmI64);
+        len = SimdReplaceLane(opcode, kWasmI64, opcode_length);
         break;
       }
       case kExprI32x4ReplaceLane:
       case kExprI16x8ReplaceLane:
       case kExprI8x16ReplaceLane: {
-        len = SimdReplaceLane(opcode, kWasmI32);
+        len = SimdReplaceLane(opcode, kWasmI32, opcode_length);
         break;
       }
       case kExprS8x16Shuffle: {
-        len = Simd8x16ShuffleOp();
+        len = Simd8x16ShuffleOp(opcode_length);
         break;
       }
       case kExprS128LoadMem:
-        len = DecodeLoadMem(LoadType::kS128Load, 1);
+        len = DecodeLoadMem(LoadType::kS128Load, opcode_length);
         break;
       case kExprS128StoreMem:
-        len = DecodeStoreMem(StoreType::kS128Store, 1);
+        len = DecodeStoreMem(StoreType::kS128Store, opcode_length);
         break;
       case kExprS8x16LoadSplat:
         len = DecodeLoadTransformMem(LoadType::kI32Load8S,
-                                     LoadTransformationKind::kSplat);
+                                     LoadTransformationKind::kSplat,
+                                     opcode_length);
         break;
       case kExprS16x8LoadSplat:
         len = DecodeLoadTransformMem(LoadType::kI32Load16S,
-                                     LoadTransformationKind::kSplat);
+                                     LoadTransformationKind::kSplat,
+                                     opcode_length);
         break;
       case kExprS32x4LoadSplat:
-        len = DecodeLoadTransformMem(LoadType::kI32Load,
-                                     LoadTransformationKind::kSplat);
+        len = DecodeLoadTransformMem(
+            LoadType::kI32Load, LoadTransformationKind::kSplat, opcode_length);
         break;
       case kExprS64x2LoadSplat:
-        len = DecodeLoadTransformMem(LoadType::kI64Load,
-                                     LoadTransformationKind::kSplat);
+        len = DecodeLoadTransformMem(
+            LoadType::kI64Load, LoadTransformationKind::kSplat, opcode_length);
         break;
       case kExprI16x8Load8x8S:
         len = DecodeLoadTransformMem(LoadType::kI32Load8S,
-                                     LoadTransformationKind::kExtend);
+                                     LoadTransformationKind::kExtend,
+                                     opcode_length);
         break;
       case kExprI16x8Load8x8U:
         len = DecodeLoadTransformMem(LoadType::kI32Load8U,
-                                     LoadTransformationKind::kExtend);
+                                     LoadTransformationKind::kExtend,
+                                     opcode_length);
         break;
       case kExprI32x4Load16x4S:
         len = DecodeLoadTransformMem(LoadType::kI32Load16S,
-                                     LoadTransformationKind::kExtend);
+                                     LoadTransformationKind::kExtend,
+                                     opcode_length);
         break;
       case kExprI32x4Load16x4U:
         len = DecodeLoadTransformMem(LoadType::kI32Load16U,
-                                     LoadTransformationKind::kExtend);
+                                     LoadTransformationKind::kExtend,
+                                     opcode_length);
         break;
       case kExprI64x2Load32x2S:
         len = DecodeLoadTransformMem(LoadType::kI64Load32S,
-                                     LoadTransformationKind::kExtend);
+                                     LoadTransformationKind::kExtend,
+                                     opcode_length);
         break;
       case kExprI64x2Load32x2U:
         len = DecodeLoadTransformMem(LoadType::kI64Load32U,
-                                     LoadTransformationKind::kExtend);
+                                     LoadTransformationKind::kExtend,
+                                     opcode_length);
         break;
       default: {
         if (!FLAG_wasm_simd_post_mvp &&
@@ -2789,8 +3199,8 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           this->error("invalid simd opcode");
           break;
         }
-        auto args = PopArgs(sig);
-        auto* results =
+        ArgVector args = PopArgs(sig);
+        Value* results =
             sig->return_count() == 0 ? nullptr : Push(GetReturnType(sig));
         CALL_INTERFACE_IF_REACHABLE(SimdOp, opcode, VectorOf(args), results);
       }
@@ -2798,6 +3208,112 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     return len;
   }
 
+  uint32_t DecodeGCOpcode(WasmOpcode opcode) {
+    uint32_t len = 2;
+    switch (opcode) {
+      case kExprStructNew: {
+        StructIndexImmediate<validate> imm(this, this->pc_ + len);
+        len += imm.length;
+        if (!this->Validate(this->pc_, imm)) break;
+        ArgVector args = PopArgs(imm.struct_type);
+        Value* value = Push(ValueType(ValueType::kRef, imm.index));
+        CALL_INTERFACE_IF_REACHABLE(StructNew, imm, args.begin(), value);
+        break;
+      }
+      case kExprStructGet: {
+        FieldIndexImmediate<validate> field(this, this->pc_ + len);
+        if (!this->Validate(this->pc_ + len, field)) break;
+        ValueType field_type =
+            field.struct_index.struct_type->field(field.index);
+        if (field_type.IsPacked()) {
+          this->error(this->pc_,
+                      "struct.get used with a field of packed type. "
+                      "Use struct.get_s or struct.get_u instead.");
+          break;
+        }
+        len += field.length;
+        Value struct_obj =
+            Pop(0, ValueType(ValueType::kOptRef, field.struct_index.index));
+        Value* value = Push(field_type);
+        CALL_INTERFACE_IF_REACHABLE(StructGet, struct_obj, field, value);
+        break;
+      }
+      case kExprStructSet: {
+        FieldIndexImmediate<validate> field(this, this->pc_ + len);
+        if (!this->Validate(this->pc_ + len, field)) break;
+        len += field.length;
+        if (!field.struct_index.struct_type->mutability(field.index)) {
+          this->error(this->pc_, "setting immutable struct field");
+          break;
+        }
+        Value field_value = Pop(
+            0,
+            ValueType(
+                field.struct_index.struct_type->field(field.index).Unpack()));
+        Value struct_obj =
+            Pop(0, ValueType(ValueType::kOptRef, field.struct_index.index));
+        CALL_INTERFACE_IF_REACHABLE(StructSet, struct_obj, field, field_value);
+        break;
+      }
+      case kExprArrayNew: {
+        ArrayIndexImmediate<validate> imm(this, this->pc_ + len);
+        len += imm.length;
+        if (!this->Validate(this->pc_, imm)) break;
+        Value length = Pop(0, kWasmI32);
+        Value initial_value = Pop(0, imm.array_type->element_type());
+        Value* value = Push(ValueType(ValueType::kRef, imm.index));
+        CALL_INTERFACE_IF_REACHABLE(ArrayNew, imm, length, initial_value,
+                                    value);
+        break;
+      }
+      case kExprArrayGet: {
+        ArrayIndexImmediate<validate> imm(this, this->pc_ + len);
+        len += imm.length;
+        if (!this->Validate(this->pc_ + len, imm)) break;
+        if (imm.array_type->element_type().IsPacked()) {
+          this->error(this->pc_,
+                      "array.get used with a field of packed type. "
+                      "Use array.get_s or array.get_u instead.");
+          break;
+        }
+        Value index = Pop(0, kWasmI32);
+        Value array_obj = Pop(0, ValueType(ValueType::kOptRef, imm.index));
+        Value* value = Push(imm.array_type->element_type());
+        // TODO(7748): Optimize this when array_obj is non-nullable ref.
+        CALL_INTERFACE_IF_REACHABLE(ArrayGet, array_obj, imm, index, value);
+        break;
+      }
+      case kExprArraySet: {
+        ArrayIndexImmediate<validate> imm(this, this->pc_ + len);
+        len += imm.length;
+        if (!this->Validate(this->pc_ + len, imm)) break;
+        if (!imm.array_type->mutability()) {
+          this->error(this->pc_, "setting element of immutable array");
+          break;
+        }
+        Value value = Pop(0, imm.array_type->element_type().Unpack());
+        Value index = Pop(0, kWasmI32);
+        Value array_obj = Pop(0, ValueType(ValueType::kOptRef, imm.index));
+        // TODO(7748): Optimize this when array_obj is non-nullable ref.
+        CALL_INTERFACE_IF_REACHABLE(ArraySet, array_obj, imm, index, value);
+        break;
+      }
+      case kExprArrayLen: {
+        ArrayIndexImmediate<validate> imm(this, this->pc_ + len);
+        len += imm.length;
+        if (!this->Validate(this->pc_ + len, imm)) break;
+        Value array_obj = Pop(0, ValueType(ValueType::kOptRef, imm.index));
+        Value* value = Push(kWasmI32);
+        CALL_INTERFACE_IF_REACHABLE(ArrayLen, array_obj, value);
+        break;
+      }
+      default:
+        this->error("invalid gc opcode");
+        return 0;
+    }
+    return len;
+  }
+
   uint32_t DecodeAtomicOpcode(WasmOpcode opcode) {
     uint32_t len = 0;
     ValueType ret_type;
@@ -2841,8 +3357,8 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     MemoryAccessImmediate<validate> imm(
         this, this->pc_ + 1, ElementSizeLog2Of(memtype.representation()));
     len += imm.length;
-    auto args = PopArgs(sig);
-    auto result = ret_type == kWasmStmt ? nullptr : Push(GetReturnType(sig));
+    ArgVector args = PopArgs(sig);
+    Value* result = ret_type == kWasmStmt ? nullptr : Push(GetReturnType(sig));
     CALL_INTERFACE_IF_REACHABLE(AtomicOp, opcode, VectorOf(args), imm, result);
     return len;
   }
@@ -2866,9 +3382,9 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           MemoryInitImmediate<validate> imm(this, this->pc_);
           if (!this->Validate(imm)) break;
           len += imm.length;
-          auto size = Pop(2, sig->GetParam(2));
-          auto src = Pop(1, sig->GetParam(1));
-          auto dst = Pop(0, sig->GetParam(0));
+          Value size = Pop(2, sig->GetParam(2));
+          Value src = Pop(1, sig->GetParam(1));
+          Value dst = Pop(0, sig->GetParam(0));
           CALL_INTERFACE_IF_REACHABLE(MemoryInit, imm, dst, src, size);
           break;
         }
@@ -2883,9 +3399,9 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           MemoryCopyImmediate<validate> imm(this, this->pc_);
           if (!this->Validate(imm)) break;
           len += imm.length;
-          auto size = Pop(2, sig->GetParam(2));
-          auto src = Pop(1, sig->GetParam(1));
-          auto dst = Pop(0, sig->GetParam(0));
+          Value size = Pop(2, sig->GetParam(2));
+          Value src = Pop(1, sig->GetParam(1));
+          Value dst = Pop(0, sig->GetParam(0));
           CALL_INTERFACE_IF_REACHABLE(MemoryCopy, imm, dst, src, size);
           break;
         }
@@ -2893,9 +3409,9 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           MemoryIndexImmediate<validate> imm(this, this->pc_ + 1);
           if (!this->Validate(this->pc_ + 1, imm)) break;
           len += imm.length;
-          auto size = Pop(2, sig->GetParam(2));
-          auto value = Pop(1, sig->GetParam(1));
-          auto dst = Pop(0, sig->GetParam(0));
+          Value size = Pop(2, sig->GetParam(2));
+          Value value = Pop(1, sig->GetParam(1));
+          Value dst = Pop(0, sig->GetParam(0));
           CALL_INTERFACE_IF_REACHABLE(MemoryFill, imm, dst, value, size);
           break;
         }
@@ -2903,7 +3419,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           TableInitImmediate<validate> imm(this, this->pc_);
           if (!this->Validate(imm)) break;
           len += imm.length;
-          auto args = PopArgs(sig);
+          ArgVector args = PopArgs(sig);
           CALL_INTERFACE_IF_REACHABLE(TableInit, imm, VectorOf(args));
           break;
         }
@@ -2918,7 +3434,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           TableCopyImmediate<validate> imm(this, this->pc_);
           if (!this->Validate(imm)) break;
           len += imm.length;
-          auto args = PopArgs(sig);
+          ArgVector args = PopArgs(sig);
           CALL_INTERFACE_IF_REACHABLE(TableCopy, imm, VectorOf(args));
           break;
         }
@@ -2926,9 +3442,9 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           TableIndexImmediate<validate> imm(this, this->pc_ + 1);
           if (!this->Validate(this->pc_, imm)) break;
           len += imm.length;
-          auto delta = Pop(1, sig->GetParam(1));
-          auto value = Pop(0, this->module_->tables[imm.index].type);
-          auto* result = Push(kWasmI32);
+          Value delta = Pop(1, sig->GetParam(1));
+          Value value = Pop(0, this->module_->tables[imm.index].type);
+          Value* result = Push(kWasmI32);
           CALL_INTERFACE_IF_REACHABLE(TableGrow, imm, value, delta, result);
           break;
         }
@@ -2936,7 +3452,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           TableIndexImmediate<validate> imm(this, this->pc_ + 1);
           if (!this->Validate(this->pc_, imm)) break;
           len += imm.length;
-          auto* result = Push(kWasmI32);
+          Value* result = Push(kWasmI32);
           CALL_INTERFACE_IF_REACHABLE(TableSize, imm, result);
           break;
         }
@@ -2944,9 +3460,9 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           TableIndexImmediate<validate> imm(this, this->pc_ + 1);
           if (!this->Validate(this->pc_, imm)) break;
           len += imm.length;
-          auto count = Pop(2, sig->GetParam(2));
-          auto value = Pop(1, this->module_->tables[imm.index].type);
-          auto start = Pop(0, sig->GetParam(0));
+          Value count = Pop(2, sig->GetParam(2));
+          Value value = Pop(1, this->module_->tables[imm.index].type);
+          Value start = Pop(0, sig->GetParam(0));
           CALL_INTERFACE_IF_REACHABLE(TableFill, imm, start, value, count);
           break;
         }
@@ -3002,7 +3518,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
   }
 
   V8_INLINE Value Pop(int index, ValueType expected) {
-    auto val = Pop();
+    Value val = Pop();
     if (!VALIDATE(val.type.IsSubTypeOf(expected) || val.type == kWasmBottom ||
                   expected == kWasmBottom)) {
       this->errorf(val.pc, "%s[%d] expected type %s, found %s of type %s",
@@ -3023,7 +3539,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
       }
       return UnreachableValue(this->pc_);
     }
-    auto val = stack_.back();
+    Value val = stack_.back();
     stack_.pop_back();
     return val;
   }
@@ -3186,7 +3702,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     // This line requires num_returns > 0.
     Value* stack_values = &*(stack_.end() - num_returns);
     for (int i = 0; i < num_returns; ++i) {
-      auto& val = stack_values[i];
+      Value& val = stack_values[i];
       ValueType expected_type = this->sig_->GetReturn(i);
       if (!val.type.IsSubTypeOf(expected_type)) {
         this->errorf(this->pc_,
@@ -3205,8 +3721,10 @@ class WasmFullDecoder : public WasmDecoder<validate> {
   }
 
   void BuildSimplePrototypeOperator(WasmOpcode opcode) {
-    if (WasmOpcodes::IsAnyRefOpcode(opcode)) {
+    if (opcode == kExprRefIsNull) {
       RET_ON_PROTOTYPE_OPCODE(anyref);
+    } else if (opcode == kExprRefEq) {
+      RET_ON_PROTOTYPE_OPCODE(gc);
     }
     const FunctionSig* sig = WasmOpcodes::Signature(opcode);
     BuildSimpleOperator(opcode, sig);
@@ -3215,16 +3733,16 @@ class WasmFullDecoder : public WasmDecoder<validate> {
   void BuildSimpleOperator(WasmOpcode opcode, const FunctionSig* sig) {
     switch (sig->parameter_count()) {
       case 1: {
-        auto val = Pop(0, sig->GetParam(0));
-        auto* ret =
+        Value val = Pop(0, sig->GetParam(0));
+        Value* ret =
             sig->return_count() == 0 ? nullptr : Push(sig->GetReturn(0));
         CALL_INTERFACE_IF_REACHABLE(UnOp, opcode, val, ret);
         break;
       }
       case 2: {
-        auto rval = Pop(1, sig->GetParam(1));
-        auto lval = Pop(0, sig->GetParam(0));
-        auto* ret =
+        Value rval = Pop(1, sig->GetParam(1));
+        Value lval = Pop(0, sig->GetParam(0));
+        Value* ret =
             sig->return_count() == 0 ? nullptr : Push(sig->GetReturn(0));
         CALL_INTERFACE_IF_REACHABLE(BinOp, opcode, lval, rval, ret);
         break;
@@ -3236,16 +3754,16 @@ class WasmFullDecoder : public WasmDecoder<validate> {
 
   void BuildSimpleOperator(WasmOpcode opcode, ValueType return_type,
                            ValueType arg_type) {
-    auto val = Pop(0, arg_type);
-    auto* ret = return_type == kWasmStmt ? nullptr : Push(return_type);
+    Value val = Pop(0, arg_type);
+    Value* ret = return_type == kWasmStmt ? nullptr : Push(return_type);
     CALL_INTERFACE_IF_REACHABLE(UnOp, opcode, val, ret);
   }
 
   void BuildSimpleOperator(WasmOpcode opcode, ValueType return_type,
                            ValueType lhs_type, ValueType rhs_type) {
-    auto rval = Pop(1, rhs_type);
-    auto lval = Pop(0, lhs_type);
-    auto* ret = return_type == kWasmStmt ? nullptr : Push(return_type);
+    Value rval = Pop(1, rhs_type);
+    Value lval = Pop(0, lhs_type);
+    Value* ret = return_type == kWasmStmt ? nullptr : Push(return_type);
     CALL_INTERFACE_IF_REACHABLE(BinOp, opcode, lval, rval, ret);
   }
 
@@ -3278,6 +3796,8 @@ class EmptyInterface {
 #undef TRACE_INST_FORMAT
 #undef VALIDATE
 #undef CHECK_PROTOTYPE_OPCODE
+#undef RET_ON_PROTOTYPE_OPCODE
+#undef CHECK_PROTOTYPE_OPCODE_GEN
 #undef OPCODE_ERROR
 
 }  // namespace wasm
diff --git a/deps/v8/src/wasm/function-body-decoder.cc b/deps/v8/src/wasm/function-body-decoder.cc
index 63788bcc8dc..fc1c73ae3c1 100644
--- a/deps/v8/src/wasm/function-body-decoder.cc
+++ b/deps/v8/src/wasm/function-body-decoder.cc
@@ -21,14 +21,24 @@ namespace wasm {
 
 bool DecodeLocalDecls(const WasmFeatures& enabled, BodyLocalDecls* decls,
                       const byte* start, const byte* end) {
-  Decoder decoder(start, end);
-  if (WasmDecoder<Decoder::kValidate>::DecodeLocals(enabled, &decoder, nullptr,
-                                                    &decls->type_list)) {
+  WasmFeatures no_features = WasmFeatures::None();
+  WasmDecoder<Decoder::kValidate> decoder(nullptr, enabled, &no_features,
+                                          nullptr, start, end, 0);
+  // The decoded functions need to be inserted into &decls->type_list,
+  // so we pass a pointer to it to local_types_ which will be updated
+  // in DecodeLocals.
+  decoder.local_types_ = &decls->type_list;
+  uint32_t length;
+  if (decoder.DecodeLocals(
+          decoder.pc(), &length,
+          static_cast<uint32_t>(decoder.local_types_->size()))) {
     DCHECK(decoder.ok());
-    decls->encoded_size = decoder.pc_offset();
+    decls->encoded_size = length;
     return true;
+  } else {
+    decls->encoded_size = 0;
+    return false;
   }
-  return false;
 }
 
 BytecodeIterator::BytecodeIterator(const byte* start, const byte* end,
@@ -54,7 +64,9 @@ DecodeResult VerifyWasmCode(AccountingAllocator* allocator,
 }
 
 unsigned OpcodeLength(const byte* pc, const byte* end) {
-  Decoder decoder(pc, end);
+  WasmFeatures no_features = WasmFeatures::None();
+  WasmDecoder<Decoder::kNoValidate> decoder(nullptr, no_features, &no_features,
+                                            nullptr, pc, end, 0);
   return WasmDecoder<Decoder::kNoValidate>::OpcodeLength(&decoder, pc);
 }
 
@@ -154,7 +166,7 @@ bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
     ++line_nr;
   }
 
-  os << "// body: " << std::endl;
+  os << "// body:" << std::endl;
   if (line_numbers) line_numbers->push_back(kNoByteCode);
   ++line_nr;
   unsigned control_depth = 0;
@@ -187,6 +199,7 @@ bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
         opcode == kExprTry) {
       DCHECK_EQ(2, length);
 
+      // TODO(7748) Update this for gc and ref types if needed
       switch (i.pc()[1]) {
 #define CASE_LOCAL_TYPE(local_name, type_name) \
   case kLocal##local_name:                     \
@@ -282,7 +295,9 @@ bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
 
 BitVector* AnalyzeLoopAssignmentForTesting(Zone* zone, size_t num_locals,
                                            const byte* start, const byte* end) {
-  Decoder decoder(start, end);
+  WasmFeatures no_features = WasmFeatures::None();
+  WasmDecoder<Decoder::kValidate> decoder(nullptr, no_features, &no_features,
+                                          nullptr, start, end, 0);
   return WasmDecoder<Decoder::kValidate>::AnalyzeLoopAssignment(
       &decoder, start, static_cast<uint32_t>(num_locals), zone);
 }
diff --git a/deps/v8/src/wasm/function-body-decoder.h b/deps/v8/src/wasm/function-body-decoder.h
index f5425402336..3eb42b8050e 100644
--- a/deps/v8/src/wasm/function-body-decoder.h
+++ b/deps/v8/src/wasm/function-body-decoder.h
@@ -34,6 +34,8 @@ struct FunctionBody {
       : sig(sig), offset(offset), start(start), end(end) {}
 };
 
+enum class LoadTransformationKind : uint8_t { kSplat, kExtend };
+
 V8_EXPORT_PRIVATE DecodeResult VerifyWasmCode(AccountingAllocator* allocator,
                                               const WasmFeatures& enabled,
                                               const WasmModule* module,
@@ -173,9 +175,7 @@ class V8_EXPORT_PRIVATE BytecodeIterator : public NON_EXPORTED_BASE(Decoder) {
   bool has_next() { return pc_ < end_; }
 
   WasmOpcode prefixed_opcode() {
-    byte prefix = read_u8<Decoder::kNoValidate>(pc_, "expected prefix");
-    byte index = read_u8<Decoder::kNoValidate>(pc_ + 1, "expected index");
-    return static_cast<WasmOpcode>(prefix << 8 | index);
+    return read_prefixed_opcode<Decoder::kNoValidate>(pc_);
   }
 };
 
diff --git a/deps/v8/src/wasm/function-compiler.cc b/deps/v8/src/wasm/function-compiler.cc
index 1b6b83a3b14..6b25520d84f 100644
--- a/deps/v8/src/wasm/function-compiler.cc
+++ b/deps/v8/src/wasm/function-compiler.cc
@@ -115,7 +115,6 @@ ExecutionTier WasmCompilationUnit::GetBaselineExecutionTier(
   // Liftoff does not support the special asm.js opcodes, thus always compile
   // asm.js modules with TurboFan.
   if (is_asmjs_module(module)) return ExecutionTier::kTurbofan;
-  if (FLAG_wasm_interpret_all) return ExecutionTier::kInterpreter;
   return FLAG_liftoff ? ExecutionTier::kLiftoff : ExecutionTier::kTurbofan;
 }
 
@@ -131,7 +130,7 @@ WasmCompilationResult WasmCompilationUnit::ExecuteCompilation(
                                         counters, detected);
   }
 
-  if (result.succeeded()) {
+  if (result.succeeded() && counters) {
     counters->wasm_generated_code_size()->Increment(
         result.code_desc.instr_size);
     counters->wasm_reloc_size()->Increment(result.code_desc.reloc_size);
@@ -164,12 +163,16 @@ WasmCompilationResult WasmCompilationUnit::ExecuteFunctionCompilation(
   wasm::FunctionBody func_body{func->sig, func->code.offset(), code.begin(),
                                code.end()};
 
-  auto size_histogram = SELECT_WASM_COUNTER(counters, env->module->origin, wasm,
-                                            function_size_bytes);
-  size_histogram->AddSample(static_cast<int>(func_body.end - func_body.start));
-  auto timed_histogram = SELECT_WASM_COUNTER(counters, env->module->origin,
-                                             wasm_compile, function_time);
-  TimedHistogramScope wasm_compile_function_time_scope(timed_histogram);
+  base::Optional<TimedHistogramScope> wasm_compile_function_time_scope;
+  if (counters) {
+    auto size_histogram = SELECT_WASM_COUNTER(counters, env->module->origin,
+                                              wasm, function_size_bytes);
+    size_histogram->AddSample(
+        static_cast<int>(func_body.end - func_body.start));
+    auto timed_histogram = SELECT_WASM_COUNTER(counters, env->module->origin,
+                                               wasm_compile, function_time);
+    wasm_compile_function_time_scope.emplace(timed_histogram);
+  }
 
   if (FLAG_trace_wasm_compiler) {
     PrintF("Compiling wasm function %d with %s\n", func_index_,
@@ -188,9 +191,9 @@ WasmCompilationResult WasmCompilationUnit::ExecuteFunctionCompilation(
       if (V8_LIKELY(FLAG_wasm_tier_mask_for_testing == 0) ||
           func_index_ >= 32 ||
           ((FLAG_wasm_tier_mask_for_testing & (1 << func_index_)) == 0)) {
-        result =
-            ExecuteLiftoffCompilation(wasm_engine->allocator(), env, func_body,
-                                      func_index_, counters, detected);
+        result = ExecuteLiftoffCompilation(wasm_engine->allocator(), env,
+                                           func_body, func_index_,
+                                           for_debugging_, counters, detected);
         if (result.succeeded()) break;
       }
 
@@ -202,12 +205,11 @@ WasmCompilationResult WasmCompilationUnit::ExecuteFunctionCompilation(
     case ExecutionTier::kTurbofan:
       result = compiler::ExecuteTurbofanWasmCompilation(
           wasm_engine, env, func_body, func_index_, counters, detected);
+      result.for_debugging = for_debugging_;
       break;
 
     case ExecutionTier::kInterpreter:
-      result = compiler::ExecuteInterpreterEntryCompilation(
-          wasm_engine, env, func_body, func_index_, counters, detected);
-      break;
+      UNREACHABLE();
   }
 
   return result;
@@ -250,7 +252,7 @@ void WasmCompilationUnit::CompileWasmFunction(Isolate* isolate,
 
   DCHECK_LE(native_module->num_imported_functions(), function->func_index);
   DCHECK_LT(function->func_index, native_module->num_functions());
-  WasmCompilationUnit unit(function->func_index, tier);
+  WasmCompilationUnit unit(function->func_index, tier, kNoDebugging);
   CompilationEnv env = native_module->CreateCompilationEnv();
   WasmCompilationResult result = unit.ExecuteCompilation(
       isolate->wasm_engine(), &env,
@@ -258,7 +260,8 @@ void WasmCompilationUnit::CompileWasmFunction(Isolate* isolate,
       isolate->counters(), detected);
   if (result.succeeded()) {
     WasmCodeRefScope code_ref_scope;
-    native_module->AddCompiledCode(std::move(result));
+    native_module->PublishCode(
+        native_module->AddCompiledCode(std::move(result)));
   } else {
     native_module->compilation_state()->SetError();
   }
diff --git a/deps/v8/src/wasm/function-compiler.h b/deps/v8/src/wasm/function-compiler.h
index a511f19b765..27fd54eb3b2 100644
--- a/deps/v8/src/wasm/function-compiler.h
+++ b/deps/v8/src/wasm/function-compiler.h
@@ -31,6 +31,7 @@ struct WasmFunction;
 
 class WasmInstructionBuffer final {
  public:
+  WasmInstructionBuffer() = delete;
   ~WasmInstructionBuffer();
   std::unique_ptr<AssemblerBuffer> CreateView();
   std::unique_ptr<uint8_t[]> ReleaseBuffer();
@@ -44,7 +45,6 @@ class WasmInstructionBuffer final {
   void operator delete(void* ptr) { ::operator delete(ptr); }
 
  private:
-  WasmInstructionBuffer() = delete;
   DISALLOW_COPY_AND_ASSIGN(WasmInstructionBuffer);
 };
 
@@ -55,7 +55,6 @@ struct WasmCompilationResult {
   enum Kind : int8_t {
     kFunction,
     kWasmToJsWrapper,
-    kInterpreterEntry,
   };
 
   bool succeeded() const { return code_desc.buffer != nullptr; }
@@ -72,14 +71,15 @@ struct WasmCompilationResult {
   ExecutionTier requested_tier;
   ExecutionTier result_tier;
   Kind kind = kFunction;
+  ForDebugging for_debugging = kNoDebugging;
 };
 
 class V8_EXPORT_PRIVATE WasmCompilationUnit final {
  public:
   static ExecutionTier GetBaselineExecutionTier(const WasmModule*);
 
-  WasmCompilationUnit(int index, ExecutionTier tier)
-      : func_index_(index), tier_(tier) {}
+  WasmCompilationUnit(int index, ExecutionTier tier, ForDebugging for_debugging)
+      : func_index_(index), tier_(tier), for_debugging_(for_debugging) {}
 
   WasmCompilationResult ExecuteCompilation(
       WasmEngine*, CompilationEnv*, const std::shared_ptr<WireBytesStorage>&,
@@ -103,6 +103,7 @@ class V8_EXPORT_PRIVATE WasmCompilationUnit final {
 
   int func_index_;
   ExecutionTier tier_;
+  ForDebugging for_debugging_;
 };
 
 // {WasmCompilationUnit} should be trivially copyable and small enough so we can
diff --git a/deps/v8/src/wasm/graph-builder-interface.cc b/deps/v8/src/wasm/graph-builder-interface.cc
index 5f73f272001..79d25412db0 100644
--- a/deps/v8/src/wasm/graph-builder-interface.cc
+++ b/deps/v8/src/wasm/graph-builder-interface.cc
@@ -12,6 +12,7 @@
 #include "src/wasm/decoder.h"
 #include "src/wasm/function-body-decoder-impl.h"
 #include "src/wasm/function-body-decoder.h"
+#include "src/wasm/value-type.h"
 #include "src/wasm/wasm-limits.h"
 #include "src/wasm/wasm-linkage.h"
 #include "src/wasm/wasm-module.h"
@@ -27,18 +28,33 @@ namespace {
 // as well as the current effect and control dependency in the TF graph.
 // It maintains a control state that tracks whether the environment
 // is reachable, has reached a control end, or has been merged.
-struct SsaEnv {
+struct SsaEnv : public ZoneObject {
   enum State { kControlEnd, kUnreachable, kReached, kMerged };
 
   State state;
   TFNode* control;
   TFNode* effect;
   compiler::WasmInstanceCacheNodes instance_cache;
-  TFNode** locals;
+  ZoneVector<TFNode*> locals;
+
+  SsaEnv(Zone* zone, State state, TFNode* control, TFNode* effect,
+         uint32_t locals_size)
+      : state(state), control(control), effect(effect), locals(zone) {
+    if (locals_size > 0) locals.resize(locals_size);
+  }
+
+  SsaEnv(const SsaEnv& other) V8_NOEXCEPT = default;
+  SsaEnv(SsaEnv&& other) V8_NOEXCEPT : state(other.state),
+                                       control(other.control),
+                                       effect(other.effect),
+                                       instance_cache(other.instance_cache),
+                                       locals(std::move(other.locals)) {
+    other.Kill(kUnreachable);
+  }
 
   void Kill(State new_state = kControlEnd) {
     state = new_state;
-    locals = nullptr;
+    locals.clear();
     control = nullptr;
     effect = nullptr;
     instance_cache = {};
@@ -97,22 +113,14 @@ class WasmGraphBuildingInterface {
       : builder_(builder) {}
 
   void StartFunction(FullDecoder* decoder) {
-    SsaEnv* ssa_env =
-        reinterpret_cast<SsaEnv*>(decoder->zone()->New(sizeof(SsaEnv)));
-    uint32_t num_locals = decoder->num_locals();
-    uint32_t env_count = num_locals;
-    size_t size = sizeof(TFNode*) * env_count;
-    ssa_env->state = SsaEnv::kReached;
-    ssa_env->locals =
-        size > 0 ? reinterpret_cast<TFNode**>(decoder->zone()->New(size))
-                 : nullptr;
-
     // The first '+ 1' is needed by TF Start node, the second '+ 1' is for the
     // instance parameter.
     TFNode* start = builder_->Start(
         static_cast<int>(decoder->sig_->parameter_count() + 1 + 1));
-    ssa_env->effect = start;
-    ssa_env->control = start;
+    uint32_t num_locals = decoder->num_locals();
+    SsaEnv* ssa_env = new (decoder->zone())
+        SsaEnv(decoder->zone(), SsaEnv::kReached, start, start, num_locals);
+
     // Initialize effect and control before initializing the locals default
     // values (which might require instance loads) or loading the context.
     builder_->SetEffectControl(start);
@@ -173,7 +181,7 @@ class WasmGraphBuildingInterface {
 
   void Try(FullDecoder* decoder, Control* block) {
     SsaEnv* outer_env = ssa_env_;
-    SsaEnv* catch_env = Split(decoder, outer_env);
+    SsaEnv* catch_env = Split(decoder->zone(), outer_env);
     // Mark catch environment as unreachable, since only accessable
     // through catch unwinding (i.e. landing pads).
     catch_env->state = SsaEnv::kUnreachable;
@@ -191,7 +199,7 @@ class WasmGraphBuildingInterface {
     TFNode* if_false = nullptr;
     BUILD(BranchNoHint, cond.node, &if_true, &if_false);
     SsaEnv* end_env = ssa_env_;
-    SsaEnv* false_env = Split(decoder, ssa_env_);
+    SsaEnv* false_env = Split(decoder->zone(), ssa_env_);
     false_env->control = if_false;
     SsaEnv* true_env = Steal(decoder->zone(), ssa_env_);
     true_env->control = if_true;
@@ -231,7 +239,8 @@ class WasmGraphBuildingInterface {
 
   void BinOp(FullDecoder* decoder, WasmOpcode opcode, const Value& lhs,
              const Value& rhs, Value* result) {
-    auto node = BUILD(Binop, opcode, lhs.node, rhs.node, decoder->position());
+    TFNode* node =
+        BUILD(Binop, opcode, lhs.node, rhs.node, decoder->position());
     if (result) result->node = node;
   }
 
@@ -259,6 +268,10 @@ class WasmGraphBuildingInterface {
     result->node = BUILD(RefFunc, function_index);
   }
 
+  void RefAsNonNull(FullDecoder* decoder, const Value& arg, Value* result) {
+    result->node = BUILD(RefAsNonNull, arg.node, decoder->position());
+  }
+
   void Drop(FullDecoder* decoder, const Value& value) {}
 
   void DoReturn(FullDecoder* decoder, Vector<Value> values) {
@@ -269,23 +282,33 @@ class WasmGraphBuildingInterface {
 
   void LocalGet(FullDecoder* decoder, Value* result,
                 const LocalIndexImmediate<validate>& imm) {
-    if (!ssa_env_->locals) return;  // unreachable
     result->node = ssa_env_->locals[imm.index];
   }
 
   void LocalSet(FullDecoder* decoder, const Value& value,
                 const LocalIndexImmediate<validate>& imm) {
-    if (!ssa_env_->locals) return;  // unreachable
     ssa_env_->locals[imm.index] = value.node;
   }
 
   void LocalTee(FullDecoder* decoder, const Value& value, Value* result,
                 const LocalIndexImmediate<validate>& imm) {
     result->node = value.node;
-    if (!ssa_env_->locals) return;  // unreachable
     ssa_env_->locals[imm.index] = value.node;
   }
 
+  void AllocateLocals(FullDecoder* decoder, Vector<Value> local_values) {
+    ZoneVector<TFNode*>* locals = &ssa_env_->locals;
+    locals->insert(locals->begin(), local_values.size(), nullptr);
+    for (uint32_t i = 0; i < local_values.size(); i++) {
+      (*locals)[i] = local_values[i].node;
+    }
+  }
+
+  void DeallocateLocals(FullDecoder* decoder, uint32_t count) {
+    ZoneVector<TFNode*>* locals = &ssa_env_->locals;
+    locals->erase(locals->begin(), locals->begin() + count);
+  }
+
   void GlobalGet(FullDecoder* decoder, Value* result,
                  const GlobalIndexImmediate<validate>& imm) {
     result->node = BUILD(GlobalGet, imm.index);
@@ -307,7 +330,7 @@ class WasmGraphBuildingInterface {
   }
 
   void Unreachable(FullDecoder* decoder) {
-    BUILD(Unreachable, decoder->position());
+    BUILD(Trap, wasm::TrapReason::kTrapUnreachable, decoder->position());
   }
 
   void Select(FullDecoder* decoder, const Value& cond, const Value& fval,
@@ -340,7 +363,7 @@ class WasmGraphBuildingInterface {
 
   void BrIf(FullDecoder* decoder, const Value& cond, uint32_t depth) {
     SsaEnv* fenv = ssa_env_;
-    SsaEnv* tenv = Split(decoder, fenv);
+    SsaEnv* tenv = Split(decoder->zone(), fenv);
     fenv->SetNotMerged();
     BUILD(BranchNoHint, cond.node, &tenv->control, &fenv->control);
     builder_->SetControl(fenv->control);
@@ -368,7 +391,7 @@ class WasmGraphBuildingInterface {
     while (iterator.has_next()) {
       uint32_t i = iterator.cur_index();
       uint32_t target = iterator.next();
-      SetEnv(Split(decoder, copy));
+      SetEnv(Split(decoder->zone(), copy));
       builder_->SetControl(i == imm.table_count ? BUILD(IfDefault, sw)
                                                 : BUILD(IfValue, i, sw));
       BrOrRet(decoder, target);
@@ -445,6 +468,18 @@ class WasmGraphBuildingInterface {
                  args);
   }
 
+  void BrOnNull(FullDecoder* decoder, const Value& ref_object, uint32_t depth) {
+    SsaEnv* non_null_env = ssa_env_;
+    SsaEnv* null_env = Split(decoder->zone(), non_null_env);
+    non_null_env->SetNotMerged();
+    BUILD(BrOnNull, ref_object.node, &null_env->control,
+          &non_null_env->control);
+    builder_->SetControl(non_null_env->control);
+    SetEnv(null_env);
+    BrOrRet(decoder, depth);
+    SetEnv(non_null_env);
+  }
+
   void SimdOp(FullDecoder* decoder, WasmOpcode opcode, Vector<Value> args,
               Value* result) {
     base::SmallVector<TFNode*, 8> inputs(args.size());
@@ -497,7 +532,7 @@ class WasmGraphBuildingInterface {
     TFNode* exception_tag = BUILD(LoadExceptionTagFromTable, imm.index);
     TFNode* compare = BUILD(ExceptionTagEqual, caught_tag, exception_tag);
     BUILD(BranchNoHint, compare, &if_match, &if_no_match);
-    SsaEnv* if_no_match_env = Split(decoder, ssa_env_);
+    SsaEnv* if_no_match_env = Split(decoder->zone(), ssa_env_);
     SsaEnv* if_match_env = Steal(decoder->zone(), ssa_env_);
     if_no_match_env->control = if_no_match;
     if_match_env->control = if_match;
@@ -600,6 +635,69 @@ class WasmGraphBuildingInterface {
     BUILD(TableFill, imm.index, start.node, value.node, count.node);
   }
 
+  void StructNew(FullDecoder* decoder,
+                 const StructIndexImmediate<validate>& imm, const Value args[],
+                 Value* result) {
+    uint32_t field_count = imm.struct_type->field_count();
+    base::SmallVector<TFNode*, 16> arg_nodes(field_count);
+    for (uint32_t i = 0; i < field_count; i++) {
+      arg_nodes[i] = args[i].node;
+    }
+    result->node =
+        BUILD(StructNew, imm.index, imm.struct_type, VectorOf(arg_nodes));
+  }
+
+  void StructGet(FullDecoder* decoder, const Value& struct_object,
+                 const FieldIndexImmediate<validate>& field, Value* result) {
+    using CheckForNull = compiler::WasmGraphBuilder::CheckForNull;
+    CheckForNull null_check = struct_object.type.kind() == ValueType::kRef
+                                  ? CheckForNull::kWithoutNullCheck
+                                  : CheckForNull::kWithNullCheck;
+    result->node =
+        BUILD(StructGet, struct_object.node, field.struct_index.struct_type,
+              field.index, null_check, decoder->position());
+  }
+
+  void StructSet(FullDecoder* decoder, const Value& struct_object,
+                 const FieldIndexImmediate<validate>& field,
+                 const Value& field_value) {
+    using CheckForNull = compiler::WasmGraphBuilder::CheckForNull;
+    CheckForNull null_check = struct_object.type.kind() == ValueType::kRef
+                                  ? CheckForNull::kWithoutNullCheck
+                                  : CheckForNull::kWithNullCheck;
+    BUILD(StructSet, struct_object.node, field.struct_index.struct_type,
+          field.index, field_value.node, null_check, decoder->position());
+  }
+
+  void ArrayNew(FullDecoder* decoder, const ArrayIndexImmediate<validate>& imm,
+                const Value& length, const Value& initial_value,
+                Value* result) {
+    result->node = BUILD(ArrayNew, imm.index, imm.array_type, length.node,
+                         initial_value.node);
+  }
+
+  void ArrayGet(FullDecoder* decoder, const Value& array_obj,
+                const ArrayIndexImmediate<validate>& imm, const Value& index,
+                Value* result) {
+    result->node = BUILD(ArrayGet, array_obj.node, imm.array_type, index.node,
+                         decoder->position());
+  }
+
+  void ArraySet(FullDecoder* decoder, const Value& array_obj,
+                const ArrayIndexImmediate<validate>& imm, const Value& index,
+                const Value& value) {
+    BUILD(ArraySet, array_obj.node, imm.array_type, index.node, value.node,
+          decoder->position());
+  }
+
+  void ArrayLen(FullDecoder* decoder, const Value& array_obj, Value* result) {
+    result->node = BUILD(ArrayLen, array_obj.node, decoder->position());
+  }
+
+  void PassThrough(FullDecoder* decoder, const Value& from, Value* to) {
+    to->node = from.node;
+  }
+
  private:
   SsaEnv* ssa_env_ = nullptr;
   compiler::WasmGraphBuilder* builder_;
@@ -675,7 +773,7 @@ class WasmGraphBuildingInterface {
     SsaEnv* success_env = Steal(decoder->zone(), ssa_env_);
     success_env->control = if_success;
 
-    SsaEnv* exception_env = Split(decoder, success_env);
+    SsaEnv* exception_env = Split(decoder->zone(), success_env);
     exception_env->control = if_exception;
     exception_env->effect = if_exception;
     SetEnv(exception_env);
@@ -697,6 +795,8 @@ class WasmGraphBuildingInterface {
 
   TFNode* DefaultValue(ValueType type) {
     switch (type.kind()) {
+      case ValueType::kI8:
+      case ValueType::kI16:
       case ValueType::kI32:
         return builder_->Int32Constant(0);
       case ValueType::kI64:
@@ -711,8 +811,12 @@ class WasmGraphBuildingInterface {
       case ValueType::kFuncRef:
       case ValueType::kNullRef:
       case ValueType::kExnRef:
+      case ValueType::kOptRef:
+      case ValueType::kEqRef:
         return builder_->RefNull();
-      default:
+      case ValueType::kStmt:
+      case ValueType::kBottom:
+      case ValueType::kRef:
         UNREACHABLE();
     }
   }
@@ -838,7 +942,7 @@ class WasmGraphBuildingInterface {
                                               control());
       }
 
-      SetEnv(Split(decoder, ssa_env_));
+      SetEnv(Split(decoder->zone(), ssa_env_));
       builder_->StackCheck(decoder->position());
       return;
     }
@@ -852,32 +956,19 @@ class WasmGraphBuildingInterface {
     // Conservatively introduce phis for instance cache.
     builder_->PrepareInstanceCacheForLoop(&ssa_env_->instance_cache, control());
 
-    SetEnv(Split(decoder, ssa_env_));
+    SetEnv(Split(decoder->zone(), ssa_env_));
     builder_->StackCheck(decoder->position());
   }
 
   // Create a complete copy of {from}.
-  SsaEnv* Split(FullDecoder* decoder, SsaEnv* from) {
+  SsaEnv* Split(Zone* zone, SsaEnv* from) {
     DCHECK_NOT_NULL(from);
     if (from == ssa_env_) {
       ssa_env_->control = control();
       ssa_env_->effect = effect();
     }
-    SsaEnv* result =
-        reinterpret_cast<SsaEnv*>(decoder->zone()->New(sizeof(SsaEnv)));
-    size_t size = sizeof(TFNode*) * decoder->num_locals();
-    result->control = from->control;
-    result->effect = from->effect;
-
+    SsaEnv* result = new (zone) SsaEnv(*from);
     result->state = SsaEnv::kReached;
-    if (size > 0) {
-      result->locals = reinterpret_cast<TFNode**>(decoder->zone()->New(size));
-      memcpy(result->locals, from->locals, size);
-    } else {
-      result->locals = nullptr;
-    }
-    result->instance_cache = from->instance_cache;
-
     return result;
   }
 
@@ -889,25 +980,14 @@ class WasmGraphBuildingInterface {
       ssa_env_->control = control();
       ssa_env_->effect = effect();
     }
-    SsaEnv* result = reinterpret_cast<SsaEnv*>(zone->New(sizeof(SsaEnv)));
+    SsaEnv* result = new (zone) SsaEnv(std::move(*from));
     result->state = SsaEnv::kReached;
-    result->locals = from->locals;
-    result->control = from->control;
-    result->effect = from->effect;
-    result->instance_cache = from->instance_cache;
-    from->Kill(SsaEnv::kUnreachable);
     return result;
   }
 
   // Create an unreachable environment.
   SsaEnv* UnreachableEnv(Zone* zone) {
-    SsaEnv* result = reinterpret_cast<SsaEnv*>(zone->New(sizeof(SsaEnv)));
-    result->state = SsaEnv::kUnreachable;
-    result->control = nullptr;
-    result->effect = nullptr;
-    result->locals = nullptr;
-    result->instance_cache = {};
-    return result;
+    return new (zone) SsaEnv(zone, SsaEnv::kUnreachable, nullptr, nullptr, 0);
   }
 
   void DoCall(FullDecoder* decoder, uint32_t table_index, TFNode* index_node,
diff --git a/deps/v8/src/wasm/local-decl-encoder.cc b/deps/v8/src/wasm/local-decl-encoder.cc
index 37a210086be..257f384bef3 100644
--- a/deps/v8/src/wasm/local-decl-encoder.cc
+++ b/deps/v8/src/wasm/local-decl-encoder.cc
@@ -31,6 +31,9 @@ size_t LocalDeclEncoder::Emit(byte* buffer) const {
     LEBHelper::write_u32v(&pos, local_decl.first);
     *pos = local_decl.second.value_type_code();
     ++pos;
+    if (local_decl.second.has_immediate()) {
+      LEBHelper::write_u32v(&pos, local_decl.second.ref_index());
+    }
   }
   DCHECK_EQ(Size(), pos - buffer);
   return static_cast<size_t>(pos - buffer);
@@ -48,9 +51,17 @@ uint32_t LocalDeclEncoder::AddLocals(uint32_t count, ValueType type) {
   return result;
 }
 
+// Size = (size of locals count) +
+// (for each local pair <reps, type>, (size of reps) + (size of type))
 size_t LocalDeclEncoder::Size() const {
   size_t size = LEBHelper::sizeof_u32v(local_decls.size());
-  for (auto p : local_decls) size += 1 + LEBHelper::sizeof_u32v(p.first);
+  for (auto p : local_decls) {
+    size +=
+        LEBHelper::sizeof_u32v(p.first) +  // number of locals
+        1 +                                // Opcode
+        (p.second.has_immediate() ? LEBHelper::sizeof_u32v(p.second.ref_index())
+                                  : 0);  // immediate
+  }
   return size;
 }
 
diff --git a/deps/v8/src/wasm/module-compiler.cc b/deps/v8/src/wasm/module-compiler.cc
index 369dcfd9f79..aeb7082f652 100644
--- a/deps/v8/src/wasm/module-compiler.cc
+++ b/deps/v8/src/wasm/module-compiler.cc
@@ -90,21 +90,59 @@ class BackgroundCompileToken {
       : native_module_(native_module) {}
 
   void Cancel() {
-    base::SharedMutexGuard<base::kExclusive> mutex_guard(&mutex_);
+    base::SharedMutexGuard<base::kExclusive> mutex_guard(
+        &compilation_scope_mutex_);
     native_module_.reset();
   }
 
  private:
   friend class BackgroundCompileScope;
-  base::SharedMutex mutex_;
-  std::weak_ptr<NativeModule> native_module_;
 
   std::shared_ptr<NativeModule> StartScope() {
-    mutex_.LockShared();
+    compilation_scope_mutex_.LockShared();
     return native_module_.lock();
   }
 
-  void ExitScope() { mutex_.UnlockShared(); }
+  // This private method can only be called via {BackgroundCompileScope}.
+  void SchedulePublishCode(NativeModule* native_module,
+                           std::vector<std::unique_ptr<WasmCode>> codes) {
+    {
+      base::MutexGuard guard(&publish_mutex_);
+      if (publisher_running_) {
+        // Add new code to the queue and return.
+        publish_queue_.reserve(publish_queue_.size() + codes.size());
+        for (auto& c : codes) publish_queue_.emplace_back(std::move(c));
+        return;
+      }
+      publisher_running_ = true;
+    }
+    while (true) {
+      PublishCode(native_module, VectorOf(codes));
+      codes.clear();
+
+      // Keep publishing new code that came in.
+      base::MutexGuard guard(&publish_mutex_);
+      DCHECK(publisher_running_);
+      if (publish_queue_.empty()) {
+        publisher_running_ = false;
+        return;
+      }
+      codes.swap(publish_queue_);
+    }
+  }
+
+  void PublishCode(NativeModule*, Vector<std::unique_ptr<WasmCode>>);
+
+  void ExitScope() { compilation_scope_mutex_.UnlockShared(); }
+
+  // {compilation_scope_mutex_} protects {native_module_}.
+  base::SharedMutex compilation_scope_mutex_;
+  std::weak_ptr<NativeModule> native_module_;
+
+  // {publish_mutex_} protects {publish_queue_} and {publisher_running_}.
+  base::Mutex publish_mutex_;
+  std::vector<std::unique_ptr<WasmCode>> publish_queue_;
+  bool publisher_running_ = false;
 };
 
 class CompilationStateImpl;
@@ -129,6 +167,12 @@ class BackgroundCompileScope {
 
   inline CompilationStateImpl* compilation_state();
 
+  // Call {SchedulePublishCode} via the {BackgroundCompileScope} to guarantee
+  // that the {NativeModule} stays alive.
+  void SchedulePublishCode(std::vector<std::unique_ptr<WasmCode>> codes) {
+    token_->SchedulePublishCode(native_module_.get(), std::move(codes));
+  }
+
  private:
   BackgroundCompileToken* const token_;
   // Keep the native module alive while in this scope.
@@ -386,7 +430,7 @@ class CompilationStateImpl {
   // called immediately if no recompilation is needed, or called later
   // otherwise.
   void InitializeRecompilation(
-      ExecutionTier tier,
+      TieringState new_tiering_state,
       CompilationState::callback_t recompilation_finished_callback);
 
   // Add the callback function to be called on compilation events. Needs to be
@@ -409,7 +453,7 @@ class CompilationStateImpl {
   void FinalizeJSToWasmWrappers(Isolate* isolate, const WasmModule* module,
                                 Handle<FixedArray>* export_wrappers_out);
 
-  void OnFinishedUnits(Vector<WasmCode*>, Vector<WasmCompilationResult>);
+  void OnFinishedUnits(Vector<WasmCode*>);
   void OnFinishedJSToWasmWrapperUnits(int num);
 
   void OnBackgroundTaskStopped(int task_id, const WasmFeatures& detected);
@@ -556,7 +600,8 @@ class CompilationStateImpl {
   std::vector<uint8_t> compilation_progress_;
 
   int outstanding_recompilation_functions_ = 0;
-  ExecutionTier recompilation_tier_;
+  TieringState tiering_state_ = kTieredUp;
+
   // End of fields protected by {callbacks_mutex_}.
   //////////////////////////////////////////////////////////////////////////////
 
@@ -564,7 +609,7 @@ class CompilationStateImpl {
   using RequiredBaselineTierField = base::BitField8<ExecutionTier, 0, 2>;
   using RequiredTopTierField = base::BitField8<ExecutionTier, 2, 2>;
   using ReachedTierField = base::BitField8<ExecutionTier, 4, 2>;
-  using ReachedRecompilationTierField = base::BitField8<ExecutionTier, 6, 2>;
+  using MissingRecompilationField = base::BitField8<bool, 6, 1>;
 };
 
 CompilationStateImpl* Impl(CompilationState* compilation_state) {
@@ -578,10 +623,23 @@ CompilationStateImpl* BackgroundCompileScope::compilation_state() {
   return Impl(native_module()->compilation_state());
 }
 
+void BackgroundCompileToken::PublishCode(
+    NativeModule* native_module, Vector<std::unique_ptr<WasmCode>> code) {
+  WasmCodeRefScope code_ref_scope;
+  std::vector<WasmCode*> published_code = native_module->PublishCode(code);
+  native_module->engine()->LogCode(VectorOf(published_code));
+
+  Impl(native_module->compilation_state())
+      ->OnFinishedUnits(VectorOf(published_code));
+}
+
 void UpdateFeatureUseCounts(Isolate* isolate, const WasmFeatures& detected) {
   if (detected.has_threads()) {
     isolate->CountUsage(v8::Isolate::UseCounterFeature::kWasmThreadOpcodes);
   }
+  if (detected.has_simd()) {
+    isolate->CountUsage(v8::Isolate::UseCounterFeature::kWasmSimdOpcodes);
+  }
 }
 
 }  // namespace
@@ -641,8 +699,6 @@ ExecutionTier ApplyHintToExecutionTier(WasmCompilationHintTier hint,
   switch (hint) {
     case WasmCompilationHintTier::kDefault:
       return default_tier;
-    case WasmCompilationHintTier::kInterpreter:
-      return ExecutionTier::kInterpreter;
     case WasmCompilationHintTier::kBaseline:
       return ExecutionTier::kLiftoff;
     case WasmCompilationHintTier::kOptimized:
@@ -739,15 +795,19 @@ class CompilationUnitBuilder {
 
   void AddUnits(uint32_t func_index) {
     if (func_index < native_module_->module()->num_imported_functions) {
-      baseline_units_.emplace_back(func_index, ExecutionTier::kNone);
+      baseline_units_.emplace_back(func_index, ExecutionTier::kNone,
+                                   kNoDebugging);
       return;
     }
     ExecutionTierPair tiers = GetRequestedExecutionTiers(
         native_module_->module(), compilation_state()->compile_mode(),
         native_module_->enabled_features(), func_index);
-    baseline_units_.emplace_back(func_index, tiers.baseline_tier);
+    // Compile everything for non-debugging initially. If needed, we will tier
+    // down when the module is fully compiled. Synchronization would be pretty
+    // difficult otherwise.
+    baseline_units_.emplace_back(func_index, tiers.baseline_tier, kNoDebugging);
     if (tiers.baseline_tier != tiers.top_tier) {
-      tiering_units_.emplace_back(func_index, tiers.top_tier);
+      tiering_units_.emplace_back(func_index, tiers.top_tier, kNoDebugging);
     }
   }
 
@@ -770,12 +830,14 @@ class CompilationUnitBuilder {
               GetCompileStrategy(module, native_module_->enabled_features(),
                                  func_index, lazy_module));
 #endif
-    tiering_units_.emplace_back(func_index, tiers.top_tier);
+    tiering_units_.emplace_back(func_index, tiers.top_tier, kNoDebugging);
   }
 
   void AddRecompilationUnit(int func_index, ExecutionTier tier) {
     // For recompilation, just treat all units like baseline units.
-    baseline_units_.emplace_back(func_index, tier);
+    baseline_units_.emplace_back(
+        func_index, tier,
+        tier == ExecutionTier::kLiftoff ? kForDebugging : kNoDebugging);
   }
 
   bool Commit() {
@@ -898,7 +960,8 @@ bool CompileLazy(Isolate* isolate, NativeModule* native_module,
 
   DCHECK_LE(native_module->num_imported_functions(), func_index);
   DCHECK_LT(func_index, native_module->num_functions());
-  WasmCompilationUnit baseline_unit(func_index, tiers.baseline_tier);
+  WasmCompilationUnit baseline_unit{func_index, tiers.baseline_tier,
+                                    kNoDebugging};
   CompilationEnv env = native_module->CreateCompilationEnv();
   WasmCompilationResult result = baseline_unit.ExecuteCompilation(
       isolate->wasm_engine(), &env, compilation_state->GetWireBytesStorage(),
@@ -923,7 +986,8 @@ bool CompileLazy(Isolate* isolate, NativeModule* native_module,
   }
 
   WasmCodeRefScope code_ref_scope;
-  WasmCode* code = native_module->AddCompiledCode(std::move(result));
+  WasmCode* code = native_module->PublishCode(
+      native_module->AddCompiledCode(std::move(result)));
   DCHECK_EQ(func_index, code->index());
 
   if (WasmCode::ShouldBeLogged(isolate)) code->LogCode(isolate);
@@ -934,7 +998,7 @@ bool CompileLazy(Isolate* isolate, NativeModule* native_module,
   if (GetCompileStrategy(module, enabled_features, func_index, lazy_module) ==
           CompileStrategy::kLazy &&
       tiers.baseline_tier < tiers.top_tier) {
-    WasmCompilationUnit tiering_unit{func_index, tiers.top_tier};
+    WasmCompilationUnit tiering_unit{func_index, tiers.top_tier, kNoDebugging};
     compilation_state->AddTopTierCompilationUnit(tiering_unit);
   }
 
@@ -977,10 +1041,6 @@ bool ExecuteJSToWasmWrapperCompilationUnits(
   return true;
 }
 
-bool NeedsDeterministicCompile() {
-  return FLAG_trace_wasm_decoder || FLAG_wasm_num_compilation_tasks <= 1;
-}
-
 // Run by the main thread and background tasks to take part in compilation.
 // Returns whether any units were executed.
 bool ExecuteCompilationUnits(
@@ -1008,7 +1068,6 @@ bool ExecuteCompilationUnits(
   // These fields are initialized in a {BackgroundCompileScope} before
   // starting compilation.
   double deadline = 0;
-  const bool deterministic = NeedsDeterministicCompile();
   base::Optional<CompilationEnv> env;
   std::shared_ptr<WireBytesStorage> wire_bytes;
   std::shared_ptr<const WasmModule> module;
@@ -1052,17 +1111,16 @@ bool ExecuteCompilationUnits(
     TRACE_EVENT1(TRACE_DISABLED_BY_DEFAULT("v8.wasm"), "PublishResults",
                  "num_results", results_to_publish.size());
     if (results_to_publish.empty()) return;
-    WasmCodeRefScope code_ref_scope;
-    std::vector<WasmCode*> code_vector =
+    std::vector<std::unique_ptr<WasmCode>> unpublished_code =
         compile_scope->native_module()->AddCompiledCode(
             VectorOf(results_to_publish));
+    results_to_publish.clear();
 
     // For import wrapper compilation units, add result to the cache.
     const NativeModule* native_module = compile_scope->native_module();
     int num_imported_functions = native_module->num_imported_functions();
-    DCHECK_EQ(code_vector.size(), results_to_publish.size());
     WasmImportWrapperCache* cache = native_module->import_wrapper_cache();
-    for (WasmCode* code : code_vector) {
+    for (const auto& code : unpublished_code) {
       int func_index = code->index();
       DCHECK_LE(0, func_index);
       DCHECK_LT(func_index, native_module->num_functions());
@@ -1075,16 +1133,12 @@ bool ExecuteCompilationUnits(
         // have been added as a compilation unit. So it is always the first time
         // we compile a wrapper for this key here.
         DCHECK_NULL((*cache)[key]);
-        (*cache)[key] = code;
+        (*cache)[key] = code.get();
         code->IncRef();
       }
     }
 
-    native_module->engine()->LogCode(VectorOf(code_vector));
-
-    compile_scope->compilation_state()->OnFinishedUnits(
-        VectorOf(code_vector), VectorOf(results_to_publish));
-    results_to_publish.clear();
+    compile_scope->SchedulePublishCode(std::move(unpublished_code));
   };
 
   bool compilation_failed = false;
@@ -1107,7 +1161,8 @@ bool ExecuteCompilationUnits(
       }
 
       // Get next unit.
-      if (deterministic || deadline < platform->MonotonicallyIncreasingTime()) {
+      if (FLAG_predictable ||
+          deadline < platform->MonotonicallyIncreasingTime()) {
         unit = {};
       } else {
         unit = compile_scope.compilation_state()->GetNextCompilationUnit(
@@ -1273,6 +1328,7 @@ class CompilationTimeCallback {
 void CompileNativeModule(Isolate* isolate, ErrorThrower* thrower,
                          const WasmModule* wasm_module,
                          NativeModule* native_module) {
+  CHECK(!FLAG_jitless);
   ModuleWireBytes wire_bytes(native_module->wire_bytes());
   const bool lazy_module = IsLazyModule(wasm_module);
   if (!FLAG_wasm_lazy_validation && wasm_module->origin == kWasmOrigin &&
@@ -1314,15 +1370,11 @@ void CompileNativeModule(Isolate* isolate, ErrorThrower* thrower,
   // are part of initial compilation). Otherwise, just execute baseline units.
   bool is_tiering = compilation_state->compile_mode() == CompileMode::kTiering;
   auto baseline_only = is_tiering ? kBaselineOnly : kBaselineOrTopTier;
-  // The main threads contributes to the compilation, except if we need
-  // deterministic compilation; in that case, the single background task will
-  // execute all compilation.
-  if (!NeedsDeterministicCompile()) {
-    while (ExecuteCompilationUnits(
-        compilation_state->background_compile_token(), isolate->counters(),
-        kMainThreadTaskId, baseline_only)) {
-      // Continue executing compilation units.
-    }
+  // The main threads contributes to the compilation.
+  while (ExecuteCompilationUnits(compilation_state->background_compile_token(),
+                                 isolate->counters(), kMainThreadTaskId,
+                                 baseline_only)) {
+    // Continue executing compilation units.
   }
 
   // Now wait until baseline compilation finished.
@@ -1415,32 +1467,30 @@ std::shared_ptr<NativeModule> CompileToNativeModule(
   return native_module;
 }
 
-void RecompileNativeModule(Isolate* isolate, NativeModule* native_module,
-                           ExecutionTier tier) {
+void RecompileNativeModule(NativeModule* native_module,
+                           TieringState tiering_state) {
   // Install a callback to notify us once background recompilation finished.
   auto recompilation_finished_semaphore = std::make_shared<base::Semaphore>(0);
   auto* compilation_state = Impl(native_module->compilation_state());
-  DCHECK(tier == ExecutionTier::kTurbofan || tier == ExecutionTier::kLiftoff);
   // The callback captures a shared ptr to the semaphore.
   // Initialize the compilation units and kick off background compile tasks.
   compilation_state->InitializeRecompilation(
-      tier, [recompilation_finished_semaphore](CompilationEvent event) {
+      tiering_state,
+      [recompilation_finished_semaphore](CompilationEvent event) {
         if (event == CompilationEvent::kFinishedRecompilation) {
           recompilation_finished_semaphore->Signal();
         }
       });
 
-  // For tier down only.
-  if (tier == ExecutionTier::kLiftoff) {
-    // The main thread contributes to the compilation, except if we need
-    // deterministic compilation; in that case, the single background task will
-    // execute all compilation.
-    if (!NeedsDeterministicCompile()) {
-      while (ExecuteCompilationUnits(
-          compilation_state->background_compile_token(), isolate->counters(),
-          kMainThreadTaskId, kBaselineOnly)) {
-        // Continue executing compilation units.
-      }
+  // Always wait for tier down. Tier up usually happens in the background,
+  // except in single-threaded mode.
+  if (tiering_state == kTieredDown || FLAG_single_threaded) {
+    // The main thread contributes to the compilation.
+    constexpr Counters* kNoCounters = nullptr;
+    while (ExecuteCompilationUnits(
+        compilation_state->background_compile_token(), kNoCounters,
+        kMainThreadTaskId, kBaselineOnly)) {
+      // Continue executing compilation units.
     }
 
     // Now wait until baseline recompilation finished.
@@ -1463,6 +1513,7 @@ AsyncCompileJob::AsyncCompileJob(
       wire_bytes_(bytes_copy_.get(), bytes_copy_.get() + length),
       resolver_(std::move(resolver)) {
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.wasm"), "new AsyncCompileJob");
+  CHECK(FLAG_wasm_async_compilation);
   CHECK(!FLAG_jitless);
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
   v8::Platform* platform = V8::GetCurrentPlatform();
@@ -1538,8 +1589,9 @@ class AsyncStreamingProcessor final : public StreamingProcessor {
 
 std::shared_ptr<StreamingDecoder> AsyncCompileJob::CreateStreamingDecoder() {
   DCHECK_NULL(stream_);
-  stream_.reset(new StreamingDecoder(std::make_unique<AsyncStreamingProcessor>(
-      this, isolate_->async_counters(), isolate_->allocator())));
+  stream_ = StreamingDecoder::CreateAsyncStreamingDecoder(
+      std::make_unique<AsyncStreamingProcessor>(
+          this, isolate_->async_counters(), isolate_->allocator()));
   return stream_;
 }
 
@@ -1596,12 +1648,9 @@ void AsyncCompileJob::PrepareRuntimeObjects() {
   // Create heap objects for script and module bytes to be stored in the
   // module object. Asm.js is not compiled asynchronously.
   DCHECK(module_object_.is_null());
-  const WasmModule* module = native_module_->module();
   auto source_url = stream_ ? stream_->url() : Vector<const char>();
-  Handle<Script> script = CreateWasmScript(
-      isolate_, native_module_->wire_bytes(), VectorOf(module->source_map_url),
-      module->name, source_url);
-
+  auto script = isolate_->wasm_engine()->GetOrCreateScript(
+      isolate_, native_module_, source_url);
   Handle<WasmModuleObject> module_object =
       WasmModuleObject::New(isolate_, native_module_, script);
 
@@ -1633,10 +1682,13 @@ void AsyncCompileJob::FinishCompile(bool is_after_cache_hit) {
   DCHECK(!isolate_->context().is_null());
   // Finish the wasm script now and make it public to the debugger.
   Handle<Script> script(module_object_->script(), isolate_);
+  const WasmModule* module = module_object_->module();
   if (script->type() == Script::TYPE_WASM &&
-      module_object_->module()->source_map_url.size() != 0) {
+      module->debug_symbols.type == WasmDebugSymbols::Type::SourceMap &&
+      !module->debug_symbols.external_url.is_empty()) {
+    ModuleWireBytes wire_bytes(module_object_->native_module()->wire_bytes());
     MaybeHandle<String> src_map_str = isolate_->factory()->NewStringFromUtf8(
-        CStrVector(module_object_->module()->source_map_url.c_str()),
+        wire_bytes.GetNameOrNull(module->debug_symbols.external_url),
         AllocationType::kOld);
     script->set_source_mapping_url(*src_map_str.ToHandleChecked());
   }
@@ -1651,11 +1703,10 @@ void AsyncCompileJob::FinishCompile(bool is_after_cache_hit) {
     Handle<FixedArray> export_wrappers;
     if (is_after_cache_hit) {
       // TODO(thibaudm): Look into sharing wrappers.
-      CompileJsToWasmWrappers(isolate_, module_object_->module(),
-                              &export_wrappers);
+      CompileJsToWasmWrappers(isolate_, module, &export_wrappers);
     } else {
-      compilation_state->FinalizeJSToWasmWrappers(
-          isolate_, module_object_->module(), &export_wrappers);
+      compilation_state->FinalizeJSToWasmWrappers(isolate_, module,
+                                                  &export_wrappers);
     }
     module_object_->set_export_wrappers(*export_wrappers);
   }
@@ -1724,8 +1775,11 @@ class AsyncCompileJob::CompilationStateCallback {
       case CompilationEvent::kFailedCompilation:
         DCHECK(!last_event_.has_value());
         if (job_->DecrementAndCheckFinisherCount()) {
+          // Don't update {job_->native_module_} to avoid data races with other
+          // compilation threads. Use a copy of the shared pointer instead.
+          std::shared_ptr<NativeModule> native_module = job_->native_module_;
           job_->isolate_->wasm_engine()->UpdateNativeModuleCache(
-              true, &job_->native_module_, job_->isolate_);
+              true, &native_module, job_->isolate_);
           job_->DoSync<CompileFailed>();
         }
         break;
@@ -1734,8 +1788,6 @@ class AsyncCompileJob::CompilationStateCallback {
         // {kFinishedTopTierCompilation}, hence don't remember this in
         // {last_event_}.
         return;
-      default:
-        UNREACHABLE();
     }
 #ifdef DEBUG
     last_event_ = event;
@@ -2360,6 +2412,13 @@ void AsyncStreamingProcessor::OnFinishedStream(OwnedVector<uint8_t> bytes) {
   }
   const bool needs_finish = job_->DecrementAndCheckFinisherCount();
   DCHECK_IMPLIES(!has_code_section, needs_finish);
+  // We might need to recompile the module for debugging, if the debugger was
+  // enabled while streaming compilation was running. Since handling this while
+  // compiling via streaming is tricky, we just tier down now, before publishing
+  // the module.
+  if (job_->native_module_->IsTieredDown()) {
+    job_->native_module_->TriggerRecompilation();
+  }
   if (needs_finish) {
     const bool failed = job_->native_module_->compilation_state()->failed();
     if (!cache_hit) {
@@ -2406,7 +2465,6 @@ bool AsyncStreamingProcessor::Deserialize(Vector<const uint8_t> module_bytes,
 }
 
 int GetMaxBackgroundTasks() {
-  if (NeedsDeterministicCompile()) return 0;
   int num_worker_threads = V8::GetCurrentPlatform()->NumberOfWorkerThreads();
   return std::min(FLAG_wasm_num_compilation_tasks, num_worker_threads);
 }
@@ -2456,11 +2514,9 @@ void CompilationStateImpl::InitializeCompilationProgress(bool lazy_module,
   for (int func_index = start; func_index < end; func_index++) {
     if (prefer_liftoff) {
       constexpr uint8_t kLiftoffOnlyFunctionProgress =
-          RequiredTopTierField::update(
-              RequiredBaselineTierField::update(
-                  ReachedTierField::encode(ExecutionTier::kNone),
-                  ExecutionTier::kLiftoff),
-              ExecutionTier::kLiftoff);
+          RequiredTopTierField::encode(ExecutionTier::kLiftoff) |
+          RequiredBaselineTierField::encode(ExecutionTier::kLiftoff) |
+          ReachedTierField::encode(ExecutionTier::kNone);
       compilation_progress_.push_back(kLiftoffOnlyFunctionProgress);
       outstanding_baseline_units_++;
       outstanding_top_tier_functions_++;
@@ -2517,49 +2573,61 @@ void CompilationStateImpl::InitializeCompilationProgress(bool lazy_module,
 }
 
 void CompilationStateImpl::InitializeRecompilation(
-    ExecutionTier tier,
+    TieringState new_tiering_state,
     CompilationState::callback_t recompilation_finished_callback) {
   DCHECK(!failed());
 
   // Generate necessary compilation units on the fly.
   CompilationUnitBuilder builder(native_module_);
 
+  // Information about compilation progress is shared between this class and the
+  // NativeModule. Before updating information here, consult the NativeModule to
+  // find all functions that need recompilation.
+  // Since the current tiering state is updated on the NativeModule before
+  // triggering recompilation, it's OK if the information is slightly outdated.
+  // If we compile functions twice, the NativeModule will ignore all redundant
+  // code (or code compiled for the wrong tier).
+  std::vector<int> recompile_function_indexes =
+      native_module_->FindFunctionsToRecompile(new_tiering_state);
+
   {
     base::MutexGuard guard(&callbacks_mutex_);
 
-    // Restart recompilation if another recompilation is already happening.
-    outstanding_recompilation_functions_ = 0;
-    // If compilation hasn't started yet then code would be keep as tiered-down
-    // and don't need to recompile.
+    callbacks_.emplace_back(std::move(recompilation_finished_callback));
+    tiering_state_ = new_tiering_state;
+
+    // If compilation progress is not initialized yet, then compilation didn't
+    // start yet, and new code will be kept tiered-down from the start. For
+    // streaming compilation, there is a special path to tier down later, when
+    // the module is complete. In any case, we don't need to recompile here.
     if (compilation_progress_.size() > 0) {
-      int start = native_module_->module()->num_imported_functions;
-      int end = start + native_module_->module()->num_declared_functions;
-      for (int function_index = start; function_index < end; function_index++) {
-        int slot_index = function_index - start;
-        DCHECK_LT(slot_index, compilation_progress_.size());
-        ExecutionTier reached_tier =
-            ReachedTierField::decode(compilation_progress_[slot_index]);
-        bool has_correct_tier =
-            reached_tier == tier &&
-            native_module_->HasCodeWithTier(function_index, tier);
-        compilation_progress_[slot_index] =
-            ReachedRecompilationTierField::update(
-                compilation_progress_[slot_index],
-                has_correct_tier ? tier : ExecutionTier::kNone);
-        if (!has_correct_tier) {
-          outstanding_recompilation_functions_++;
-          builder.AddRecompilationUnit(function_index, tier);
-        }
+      const WasmModule* module = native_module_->module();
+      DCHECK_EQ(module->num_declared_functions, compilation_progress_.size());
+      DCHECK_GE(module->num_declared_functions,
+                recompile_function_indexes.size());
+      outstanding_recompilation_functions_ =
+          static_cast<int>(recompile_function_indexes.size());
+      // Restart recompilation if another recompilation is already happening.
+      for (auto& progress : compilation_progress_) {
+        progress = MissingRecompilationField::update(progress, false);
+      }
+      auto new_tier = new_tiering_state == kTieredDown
+                          ? ExecutionTier::kLiftoff
+                          : ExecutionTier::kTurbofan;
+      int imported = module->num_imported_functions;
+      for (int function_index : recompile_function_indexes) {
+        DCHECK_LE(imported, function_index);
+        int slot_index = function_index - imported;
+        auto& progress = compilation_progress_[slot_index];
+        progress = MissingRecompilationField::update(progress, true);
+        builder.AddRecompilationUnit(function_index, new_tier);
       }
     }
 
-    // Trigger callback if module needs no recompilation. Add to the list of
-    // callbacks (to be called later) otherwise.
+    // Trigger callback if module needs no recompilation.
     if (outstanding_recompilation_functions_ == 0) {
-      recompilation_finished_callback(CompilationEvent::kFinishedRecompilation);
-    } else {
-      callbacks_.emplace_back(std::move(recompilation_finished_callback));
-      recompilation_tier_ = tier;
+      TriggerCallbacks(base::EnumSet<CompilationEvent>(
+          {CompilationEvent::kFinishedRecompilation}));
     }
   }
 
@@ -2640,8 +2708,7 @@ CompilationStateImpl::GetNextCompilationUnit(
   return compilation_unit_queues_.GetNextUnit(task_id, baseline_only);
 }
 
-void CompilationStateImpl::OnFinishedUnits(
-    Vector<WasmCode*> code_vector, Vector<WasmCompilationResult> results) {
+void CompilationStateImpl::OnFinishedUnits(Vector<WasmCode*> code_vector) {
   TRACE_EVENT1(TRACE_DISABLED_BY_DEFAULT("v8.wasm"), "OnFinishedUnits",
                "num_units", code_vector.size());
 
@@ -2706,21 +2773,19 @@ void CompilationStateImpl::OnFinishedUnits(
         outstanding_top_tier_functions_--;
       }
 
-      // If there is recompilation in progress, we would only count the
-      // functions which are not Liftoff already, and would only decrement the
-      // counter once a function reaches Liftoff.
-      if (outstanding_recompilation_functions_ > 0) {
-        // TODO(duongn): extend this logic for tier up.
-        ExecutionTier recompilation_tier =
-            ReachedRecompilationTierField::decode(function_progress);
-        if (results[i].requested_tier == recompilation_tier_ &&
-            recompilation_tier == ExecutionTier::kNone) {
-          DCHECK(code->tier() >= recompilation_tier_);
+      if (V8_UNLIKELY(MissingRecompilationField::decode(function_progress))) {
+        DCHECK_LT(0, outstanding_recompilation_functions_);
+        // If tiering up, accept any TurboFan code. For tiering down, look at
+        // the {for_debugging} flag. The tier can be Liftoff or TurboFan and is
+        // irrelevant here. In particular, we want to ignore any outstanding
+        // non-debugging units.
+        bool matches = tiering_state_ == kTieredDown
+                           ? code->for_debugging()
+                           : code->tier() == ExecutionTier::kTurbofan;
+        if (matches) {
           outstanding_recompilation_functions_--;
-          // Update function's recompilation progress.
-          compilation_progress_[slot_index] =
-              ReachedRecompilationTierField::update(
-                  compilation_progress_[slot_index], code->tier());
+          compilation_progress_[slot_index] = MissingRecompilationField::update(
+              compilation_progress_[slot_index], false);
           if (outstanding_recompilation_functions_ == 0) {
             triggered_events.Add(CompilationEvent::kFinishedRecompilation);
           }
@@ -2979,7 +3044,7 @@ WasmCode* CompileImportWrapper(
       result.tagged_parameter_slots,
       result.protected_instructions_data.as_vector(),
       result.source_positions.as_vector(), GetCodeKind(result),
-      ExecutionTier::kNone);
+      ExecutionTier::kNone, kNoDebugging);
   WasmCode* published_code = native_module->PublishCode(std::move(wasm_code));
   (*cache_scope)[key] = published_code;
   published_code->IncRef();
@@ -2989,71 +3054,6 @@ WasmCode* CompileImportWrapper(
   return published_code;
 }
 
-Handle<Script> CreateWasmScript(Isolate* isolate,
-                                Vector<const uint8_t> wire_bytes,
-                                Vector<const char> source_map_url,
-                                WireBytesRef name,
-                                Vector<const char> source_url) {
-  Handle<Script> script =
-      isolate->factory()->NewScript(isolate->factory()->empty_string());
-  script->set_compilation_state(Script::COMPILATION_STATE_COMPILED);
-  script->set_context_data(isolate->native_context()->debug_context_id());
-  script->set_type(Script::TYPE_WASM);
-
-  int hash = StringHasher::HashSequentialString(
-      reinterpret_cast<const char*>(wire_bytes.begin()), wire_bytes.length(),
-      kZeroHashSeed);
-
-  const int kBufferSize = 32;
-  char buffer[kBufferSize];
-
-  // Script name is "<module_name>-hash" if name is available and "hash"
-  // otherwise.
-  Handle<String> name_str;
-  if (name.is_set()) {
-    int name_chars = SNPrintF(ArrayVector(buffer), "-%08x", hash);
-    DCHECK(name_chars >= 0 && name_chars < kBufferSize);
-    Handle<String> name_hash =
-        isolate->factory()
-            ->NewStringFromOneByte(
-                VectorOf(reinterpret_cast<uint8_t*>(buffer), name_chars),
-                AllocationType::kOld)
-            .ToHandleChecked();
-    Handle<String> module_name =
-        WasmModuleObject::ExtractUtf8StringFromModuleBytes(
-            isolate, wire_bytes, name, kNoInternalize);
-    name_str = isolate->factory()
-                   ->NewConsString(module_name, name_hash)
-                   .ToHandleChecked();
-  } else {
-    int name_chars = SNPrintF(ArrayVector(buffer), "%08x", hash);
-    DCHECK(name_chars >= 0 && name_chars < kBufferSize);
-    name_str = isolate->factory()
-                   ->NewStringFromOneByte(
-                       VectorOf(reinterpret_cast<uint8_t*>(buffer), name_chars),
-                       AllocationType::kOld)
-                   .ToHandleChecked();
-  }
-  script->set_name(*name_str);
-  MaybeHandle<String> url_str;
-  if (!source_url.empty()) {
-    url_str =
-        isolate->factory()->NewStringFromUtf8(source_url, AllocationType::kOld);
-  } else {
-    Handle<String> url_prefix =
-        isolate->factory()->InternalizeString(StaticCharVector("wasm://wasm/"));
-    url_str = isolate->factory()->NewConsString(url_prefix, name_str);
-  }
-  script->set_source_url(*url_str.ToHandleChecked());
-
-  if (!source_map_url.empty()) {
-    MaybeHandle<String> src_map_str = isolate->factory()->NewStringFromUtf8(
-        source_map_url, AllocationType::kOld);
-    script->set_source_mapping_url(*src_map_str.ToHandleChecked());
-  }
-  return script;
-}
-
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/module-compiler.h b/deps/v8/src/wasm/module-compiler.h
index 4c6acd9aa91..a3fc4037a21 100644
--- a/deps/v8/src/wasm/module-compiler.h
+++ b/deps/v8/src/wasm/module-compiler.h
@@ -44,8 +44,8 @@ std::shared_ptr<NativeModule> CompileToNativeModule(
     std::shared_ptr<const WasmModule> module, const ModuleWireBytes& wire_bytes,
     Handle<FixedArray>* export_wrappers_out);
 
-void RecompileNativeModule(Isolate* isolate, NativeModule* native_module,
-                           ExecutionTier tier);
+void RecompileNativeModule(NativeModule* native_module,
+                           TieringState new_tiering_state);
 
 V8_EXPORT_PRIVATE
 void CompileJsToWasmWrappers(Isolate* isolate, const WasmModule* module,
@@ -60,11 +60,6 @@ WasmCode* CompileImportWrapper(
     compiler::WasmImportCallKind kind, const FunctionSig* sig,
     WasmImportWrapperCache::ModificationScope* cache_scope);
 
-V8_EXPORT_PRIVATE Handle<Script> CreateWasmScript(
-    Isolate* isolate, Vector<const uint8_t> wire_bytes,
-    Vector<const char> source_map_url, WireBytesRef name,
-    Vector<const char> source_url = {});
-
 // Triggered by the WasmCompileLazy builtin. The return value indicates whether
 // compilation was successful. Lazy compilation can fail only if validation is
 // also lazy.
diff --git a/deps/v8/src/wasm/module-decoder.cc b/deps/v8/src/wasm/module-decoder.cc
index 58be26f8453..69fb25dba6d 100644
--- a/deps/v8/src/wasm/module-decoder.cc
+++ b/deps/v8/src/wasm/module-decoder.cc
@@ -13,6 +13,8 @@
 #include "src/utils/ostreams.h"
 #include "src/wasm/decoder.h"
 #include "src/wasm/function-body-decoder-impl.h"
+#include "src/wasm/struct-types.h"
+#include "src/wasm/wasm-constants.h"
 #include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-limits.h"
 
@@ -31,11 +33,7 @@ constexpr char kNameString[] = "name";
 constexpr char kSourceMappingURLString[] = "sourceMappingURL";
 constexpr char kCompilationHintsString[] = "compilationHints";
 constexpr char kDebugInfoString[] = ".debug_info";
-
-template <size_t N>
-constexpr size_t num_chars(const char (&)[N]) {
-  return N - 1;  // remove null character at end.
-}
+constexpr char kExternalDebugInfoString[] = ".external_debug_info";
 
 const char* ExternalKindName(ImportExportKindCode kind) {
   switch (kind) {
@@ -91,6 +89,8 @@ const char* SectionName(SectionCode code) {
       return kSourceMappingURLString;
     case kDebugInfoSectionCode:
       return kDebugInfoString;
+    case kExternalDebugInfoSectionCode:
+      return kExternalDebugInfoString;
     case kCompilationHintsSectionCode:
       return kCompilationHintsString;
     default:
@@ -126,9 +126,8 @@ ValueType TypeOf(const WasmModule* module, const WasmInitExpr& expr) {
       return kWasmNullRef;
     case WasmInitExpr::kRefFuncConst:
       return kWasmFuncRef;
-    default:
-      UNREACHABLE();
   }
+  UNREACHABLE();
 }
 
 // Reads a length-prefixed string, checking that it is within bounds. Returns
@@ -162,25 +161,21 @@ SectionCode IdentifyUnknownSectionInternal(Decoder* decoder) {
         static_cast<int>(section_name_start - decoder->start()),
         string.length() < 20 ? string.length() : 20, section_name_start);
 
-  if (string.length() == num_chars(kNameString) &&
-      strncmp(reinterpret_cast<const char*>(section_name_start), kNameString,
-              num_chars(kNameString)) == 0) {
-    return kNameSectionCode;
-  } else if (string.length() == num_chars(kSourceMappingURLString) &&
-             strncmp(reinterpret_cast<const char*>(section_name_start),
-                     kSourceMappingURLString,
-                     num_chars(kSourceMappingURLString)) == 0) {
-    return kSourceMappingURLSectionCode;
-  } else if (string.length() == num_chars(kCompilationHintsString) &&
-             strncmp(reinterpret_cast<const char*>(section_name_start),
-                     kCompilationHintsString,
-                     num_chars(kCompilationHintsString)) == 0) {
-    return kCompilationHintsSectionCode;
-  } else if (string.length() == num_chars(kDebugInfoString) &&
-             strncmp(reinterpret_cast<const char*>(section_name_start),
-                     kDebugInfoString, num_chars(kDebugInfoString)) == 0) {
-    return kDebugInfoSectionCode;
+  using SpecialSectionPair = std::pair<Vector<const char>, SectionCode>;
+  static constexpr SpecialSectionPair kSpecialSections[]{
+      {StaticCharVector(kNameString), kNameSectionCode},
+      {StaticCharVector(kSourceMappingURLString), kSourceMappingURLSectionCode},
+      {StaticCharVector(kCompilationHintsString), kCompilationHintsSectionCode},
+      {StaticCharVector(kDebugInfoString), kDebugInfoSectionCode},
+      {StaticCharVector(kExternalDebugInfoString),
+       kExternalDebugInfoSectionCode}};
+
+  auto name_vec =
+      Vector<const char>::cast(VectorOf(section_name_start, string.length()));
+  for (auto& special_section : kSpecialSections) {
+    if (name_vec == special_section.first) return special_section.second;
   }
+
   return kUnknownSectionCode;
 }
 }  // namespace
@@ -450,6 +445,9 @@ class ModuleDecoderImpl : public Decoder {
         // .debug_info is a custom section containing core DWARF information
         // if produced by compiler. Its presence likely means that Wasm was
         // built in a debug mode.
+      case kExternalDebugInfoSectionCode:
+        // .external_debug_info is a custom section containing a reference to an
+        // external symbol file.
       case kCompilationHintsSectionCode:
         // TODO(frgossen): report out of place compilation hints section as a
         // warning.
@@ -506,11 +504,14 @@ class ModuleDecoderImpl : public Decoder {
         break;
       case kDebugInfoSectionCode:
         // If there is an explicit source map, prefer it over DWARF info.
-        if (!has_seen_unordered_section(kSourceMappingURLSectionCode)) {
-          module_->source_map_url.assign("wasm://dwarf");
+        if (module_->debug_symbols.type == WasmDebugSymbols::Type::None) {
+          module_->debug_symbols = {WasmDebugSymbols::Type::EmbeddedDWARF, {}};
         }
         consume_bytes(static_cast<uint32_t>(end_ - start_), ".debug_info");
         break;
+      case kExternalDebugInfoSectionCode:
+        DecodeExternalDebugInfoSection();
+        break;
       case kCompilationHintsSectionCode:
         if (enabled_features_.has_compilation_hints()) {
           DecodeCompilationHintsSection();
@@ -550,16 +551,62 @@ class ModuleDecoderImpl : public Decoder {
 
   void DecodeTypeSection() {
     uint32_t signatures_count = consume_count("types count", kV8MaxWasmTypes);
-    module_->signatures.reserve(signatures_count);
+    module_->types.reserve(signatures_count);
     for (uint32_t i = 0; ok() && i < signatures_count; ++i) {
       TRACE("DecodeSignature[%d] module+%d\n", i,
             static_cast<int>(pc_ - start_));
-      const FunctionSig* s = consume_sig(module_->signature_zone.get());
-      module_->signatures.push_back(s);
-      uint32_t id = s ? module_->signature_map.FindOrInsert(*s) : 0;
-      module_->signature_ids.push_back(id);
+      uint8_t kind = consume_u8("type kind");
+      switch (kind) {
+        case kWasmFunctionTypeCode: {
+          const FunctionSig* s = consume_sig(module_->signature_zone.get());
+          module_->add_signature(s);
+          break;
+        }
+        case kWasmStructTypeCode: {
+          if (!enabled_features_.has_gc()) {
+            errorf(pc(), "struct types are part of the GC proposal");
+            break;
+          }
+          const StructType* s = consume_struct(module_->signature_zone.get());
+          module_->add_struct_type(s);
+          // TODO(7748): Should we canonicalize struct types, like
+          // {signature_map} does for function signatures?
+          break;
+        }
+        case kWasmArrayTypeCode: {
+          if (!enabled_features_.has_gc()) {
+            errorf(pc(), "array types are part of the GC proposal");
+            break;
+          }
+          const ArrayType* type = consume_array(module_->signature_zone.get());
+          module_->add_array_type(type);
+          break;
+        }
+        default:
+          errorf(pc(), "unknown type form: %d", kind);
+          break;
+      }
     }
     module_->signature_map.Freeze();
+    VerifyDeferredTypeOffsets();
+  }
+
+  void VerifyDeferredTypeOffsets() {
+    for (auto& struct_offset : deferred_struct_field_type_offsets_) {
+      if (struct_offset.first >= module_->type_kinds.size()) {
+        errorf(struct_offset.second, "reference to undeclared struct/array #%u",
+               struct_offset.first);
+        break;
+      }
+      uint8_t type = module_->type_kinds[struct_offset.first];
+      if (type != kWasmStructTypeCode && type != kWasmArrayTypeCode) {
+        errorf(struct_offset.second,
+               "array element type or struct field "
+               "references non-type index #%u",
+               struct_offset.first);
+        break;
+      }
+    }
   }
 
   void DecodeImportSection() {
@@ -1034,12 +1081,22 @@ class ModuleDecoderImpl : public Decoder {
     Decoder inner(start_, pc_, end_, buffer_offset_);
     WireBytesRef url = wasm::consume_string(&inner, true, "module name");
     if (inner.ok() &&
-        !has_seen_unordered_section(kSourceMappingURLSectionCode)) {
-      const byte* url_start =
-          inner.start() + inner.GetBufferRelativeOffset(url.offset());
-      module_->source_map_url.assign(reinterpret_cast<const char*>(url_start),
-                                     url.length());
-      set_seen_unordered_section(kSourceMappingURLSectionCode);
+        module_->debug_symbols.type != WasmDebugSymbols::Type::SourceMap) {
+      module_->debug_symbols = {WasmDebugSymbols::Type::SourceMap, url};
+    }
+    set_seen_unordered_section(kSourceMappingURLSectionCode);
+    consume_bytes(static_cast<uint32_t>(end_ - start_), nullptr);
+  }
+
+  void DecodeExternalDebugInfoSection() {
+    Decoder inner(start_, pc_, end_, buffer_offset_);
+    WireBytesRef url =
+        wasm::consume_string(&inner, true, "external symbol file");
+    // If there is an explicit source map, prefer it over DWARF info.
+    if (inner.ok() &&
+        module_->debug_symbols.type != WasmDebugSymbols::Type::SourceMap) {
+      module_->debug_symbols = {WasmDebugSymbols::Type::ExternalDWARF, url};
+      set_seen_unordered_section(kExternalDebugInfoSectionCode);
     }
     consume_bytes(static_cast<uint32_t>(end_ - start_), nullptr);
   }
@@ -1257,6 +1314,8 @@ class ModuleDecoderImpl : public Decoder {
                                       const WasmModule* module,
                                       std::unique_ptr<WasmFunction> function) {
     pc_ = start_;
+    expect_u8("type form", kWasmFunctionTypeCode);
+    if (!ok()) return FunctionResult{std::move(intermediate_error_)};
     function->sig = consume_sig(zone);
     function->code = {off(pc_), static_cast<uint32_t>(end_ - pc_)};
 
@@ -1274,6 +1333,7 @@ class ModuleDecoderImpl : public Decoder {
   // Decodes a single function signature at {start}.
   const FunctionSig* DecodeFunctionSignature(Zone* zone, const byte* start) {
     pc_ = start;
+    if (!expect_u8("type form", kWasmFunctionTypeCode)) return nullptr;
     const FunctionSig* result = consume_sig(zone);
     return ok() ? result : nullptr;
   }
@@ -1319,6 +1379,10 @@ class ModuleDecoderImpl : public Decoder {
   // in global section. Used for deferred checking and proper error reporting if
   // these were not properly declared in the element section.
   std::unordered_map<uint32_t, int> deferred_funcref_error_offsets_;
+  // Set of type offsets discovered in field types during type section decoding.
+  // Since struct types may be recursive, this is used for checking and error
+  // reporting once the whole type section is parsed.
+  std::unordered_map<uint32_t, int> deferred_struct_field_type_offsets_;
   ModuleOrigin origin_;
 
   bool has_seen_unordered_section(SectionCode section_code) {
@@ -1438,13 +1502,13 @@ class ModuleDecoderImpl : public Decoder {
   uint32_t consume_sig_index(WasmModule* module, const FunctionSig** sig) {
     const byte* pos = pc_;
     uint32_t sig_index = consume_u32v("signature index");
-    if (sig_index >= module->signatures.size()) {
+    if (!module->has_signature(sig_index)) {
       errorf(pos, "signature index %u out of bounds (%d signatures)", sig_index,
-             static_cast<int>(module->signatures.size()));
+             static_cast<int>(module->types.size()));
       *sig = nullptr;
       return 0;
     }
-    *sig = module->signatures[sig_index];
+    *sig = module->signature(sig_index);
     return sig_index;
   }
 
@@ -1680,43 +1744,28 @@ class ModuleDecoderImpl : public Decoder {
     return val != 0;
   }
 
-  // Reads a single 8-bit integer, interpreting it as a local type.
   ValueType consume_value_type() {
-    byte val = consume_u8("value type");
-    ValueTypeCode t = static_cast<ValueTypeCode>(val);
-    switch (t) {
-      case kLocalI32:
-        return kWasmI32;
-      case kLocalI64:
-        return kWasmI64;
-      case kLocalF32:
-        return kWasmF32;
-      case kLocalF64:
-        return kWasmF64;
+    uint32_t type_length;
+    ValueType result = value_type_reader::read_value_type<kValidate>(
+        this, this->pc(), &type_length,
+        origin_ == kWasmOrigin ? enabled_features_ : WasmFeatures::None());
+    if (result == kWasmBottom) error(pc_, "invalid value type");
+    consume_bytes(type_length);
+    return result;
+  }
+
+  ValueType consume_storage_type() {
+    uint8_t opcode = read_u8<kValidate>(this->pc());
+    switch (opcode) {
+      case kLocalI8:
+        consume_bytes(1);
+        return kWasmI8;
+      case kLocalI16:
+        consume_bytes(1);
+        return kWasmI16;
       default:
-        if (origin_ == kWasmOrigin) {
-          switch (t) {
-            case kLocalS128:
-              if (enabled_features_.has_simd()) return kWasmS128;
-              break;
-            case kLocalFuncRef:
-              if (enabled_features_.has_anyref()) return kWasmFuncRef;
-              break;
-            case kLocalAnyRef:
-              if (enabled_features_.has_anyref()) return kWasmAnyRef;
-              break;
-            case kLocalNullRef:
-              if (enabled_features_.has_anyref()) return kWasmNullRef;
-              break;
-            case kLocalExnRef:
-              if (enabled_features_.has_eh()) return kWasmExnRef;
-              break;
-            default:
-              break;
-          }
-        }
-        error(pc_ - 1, "invalid local type");
-        return kWasmStmt;
+        // It is not a packed type, so it has to be a value type.
+        return consume_value_type();
     }
   }
 
@@ -1754,8 +1803,7 @@ class ModuleDecoderImpl : public Decoder {
   }
 
   const FunctionSig* consume_sig(Zone* zone) {
-    if (!expect_u8("type form", kWasmFunctionTypeCode)) return nullptr;
-    // parse parameter types
+    // Parse parameter types.
     uint32_t param_count =
         consume_count("param count", kV8MaxWasmFunctionParams);
     if (failed()) return nullptr;
@@ -1765,7 +1813,7 @@ class ModuleDecoderImpl : public Decoder {
       params.push_back(param);
     }
     std::vector<ValueType> returns;
-    // parse return types
+    // Parse return types.
     const size_t max_return_count = enabled_features_.has_mv()
                                         ? kV8MaxWasmFunctionMultiReturns
                                         : kV8MaxWasmFunctionReturns;
@@ -1787,6 +1835,41 @@ class ModuleDecoderImpl : public Decoder {
     return new (zone) FunctionSig(return_count, param_count, buffer);
   }
 
+  const StructType* consume_struct(Zone* zone) {
+    // TODO(7748): Introduce a proper maximum.
+    uint32_t field_count = consume_count("field count", 999);
+    if (failed()) return nullptr;
+    ValueType* fields = zone->NewArray<ValueType>(field_count);
+    bool* mutabilities = zone->NewArray<bool>(field_count);
+    for (uint32_t i = 0; ok() && i < field_count; ++i) {
+      ValueType field = consume_storage_type();
+      if (field.has_immediate()) {
+        deferred_struct_field_type_offsets_.emplace(field.ref_index(),
+                                                    pc_offset());
+      }
+      fields[i] = field;
+      bool mutability = consume_mutability();
+      mutabilities[i] = mutability;
+    }
+    if (failed()) return nullptr;
+    uint32_t* offsets = zone->NewArray<uint32_t>(field_count);
+    return new (zone) StructType(field_count, offsets, fields, mutabilities);
+  }
+
+  const ArrayType* consume_array(Zone* zone) {
+    ValueType field = consume_storage_type();
+    if (failed()) return nullptr;
+    if (field.has_immediate()) {
+      deferred_struct_field_type_offsets_.emplace(field.ref_index(),
+                                                  pc_offset());
+    }
+    bool mutability = consume_mutability();
+    if (!mutability) {
+      error(this->pc() - 1, "immutable arrays are not supported yet");
+    }
+    return new (zone) ArrayType(field, mutability);
+  }
+
   // Consume the attribute field of an exception.
   uint32_t consume_exception_attribute() {
     const byte* pos = pc_;
@@ -2081,8 +2164,8 @@ FunctionResult DecodeWasmFunctionForTesting(
     const byte* function_end, Counters* counters) {
   size_t size = function_end - function_start;
   CHECK_LE(function_start, function_end);
-  auto size_histogram = SELECT_WASM_COUNTER(counters, module->origin, wasm,
-                                            function_size_bytes);
+  auto size_histogram =
+      SELECT_WASM_COUNTER(counters, module->origin, wasm, function_size_bytes);
   // TODO(bradnelson): Improve histogram handling of ptrdiff_t.
   size_histogram->AddSample(static_cast<int>(size));
   if (size > kV8MaxWasmFunctionSize) {
@@ -2257,17 +2340,18 @@ void DecodeFunctionNames(const byte* module_start, const byte* module_end,
   }
 }
 
-void DecodeGlobalNames(
-    const Vector<const WasmImport> import_table,
+void GenerateNamesFromImportsAndExports(
+    ImportExportKindCode kind, const Vector<const WasmImport> import_table,
     const Vector<const WasmExport> export_table,
     std::unordered_map<uint32_t, std::pair<WireBytesRef, WireBytesRef>>*
         names) {
   DCHECK_NOT_NULL(names);
   DCHECK(names->empty());
+  DCHECK(kind == kExternalGlobal || kind == kExternalMemory);
 
   // Extract from import table.
   for (const WasmImport& imp : import_table) {
-    if (imp.kind != kExternalGlobal) continue;
+    if (imp.kind != kind) continue;
     if (!imp.module_name.is_set() || !imp.field_name.is_set()) continue;
     if (names->count(imp.index) == 0) {
       names->insert(std::make_pair(
@@ -2277,7 +2361,7 @@ void DecodeGlobalNames(
 
   // Extract from export table.
   for (const WasmExport& exp : export_table) {
-    if (exp.kind != kExternalGlobal) continue;
+    if (exp.kind != kind) continue;
     if (!exp.name.is_set()) continue;
     if (names->count(exp.index) == 0) {
       names->insert(
diff --git a/deps/v8/src/wasm/module-decoder.h b/deps/v8/src/wasm/module-decoder.h
index 6feeebb41dd..4b157a4ab59 100644
--- a/deps/v8/src/wasm/module-decoder.h
+++ b/deps/v8/src/wasm/module-decoder.h
@@ -168,10 +168,10 @@ void DecodeFunctionNames(const byte* module_start, const byte* module_end,
                          std::unordered_map<uint32_t, WireBytesRef>* names,
                          const Vector<const WasmExport> export_table);
 
-// Decode the global names from import table and export table. Returns the
-// result as an unordered map.
-void DecodeGlobalNames(
-    const Vector<const WasmImport> import_table,
+// Decode the global or memory names from import table and export table. Returns
+// the result as an unordered map.
+void GenerateNamesFromImportsAndExports(
+    ImportExportKindCode kind, const Vector<const WasmImport> import_table,
     const Vector<const WasmExport> export_table,
     std::unordered_map<uint32_t, std::pair<WireBytesRef, WireBytesRef>>* names);
 
diff --git a/deps/v8/src/wasm/module-instantiate.cc b/deps/v8/src/wasm/module-instantiate.cc
index 08bd8ff8718..fb8aacf20e9 100644
--- a/deps/v8/src/wasm/module-instantiate.cc
+++ b/deps/v8/src/wasm/module-instantiate.cc
@@ -11,6 +11,7 @@
 #include "src/tracing/trace-event.h"
 #include "src/utils/utils.h"
 #include "src/wasm/module-compiler.h"
+#include "src/wasm/wasm-constants.h"
 #include "src/wasm/wasm-external-refs.h"
 #include "src/wasm/wasm-import-wrapper-cache.h"
 #include "src/wasm/wasm-module.h"
@@ -84,6 +85,39 @@ class CompileImportWrapperTask final : public CancelableTask {
   WasmImportWrapperCache::ModificationScope* const cache_scope_;
 };
 
+Handle<Map> CreateStructMap(Isolate* isolate, const WasmModule* module,
+                            int struct_index) {
+  const wasm::StructType* type = module->struct_type(struct_index);
+  int inobject_properties = 0;
+  DCHECK_LE(type->total_fields_size(), kMaxInt - WasmStruct::kHeaderSize);
+  int instance_size =
+      WasmStruct::kHeaderSize + static_cast<int>(type->total_fields_size());
+  InstanceType instance_type = WASM_STRUCT_TYPE;
+  // TODO(jkummerow): If NO_ELEMENTS were supported, we could use that here.
+  ElementsKind elements_kind = TERMINAL_FAST_ELEMENTS_KIND;
+  Handle<Foreign> type_info =
+      isolate->factory()->NewForeign(reinterpret_cast<Address>(type));
+  Handle<Map> map = isolate->factory()->NewMap(
+      instance_type, instance_size, elements_kind, inobject_properties);
+  map->set_wasm_type_info(*type_info);
+  return map;
+}
+
+Handle<Map> CreateArrayMap(Isolate* isolate, const WasmModule* module,
+                           int array_index) {
+  const wasm::ArrayType* type = module->array_type(array_index);
+  int inobject_properties = 0;
+  int instance_size = kVariableSizeSentinel;
+  InstanceType instance_type = WASM_ARRAY_TYPE;
+  ElementsKind elements_kind = TERMINAL_FAST_ELEMENTS_KIND;
+  Handle<Foreign> type_info =
+      isolate->factory()->NewForeign(reinterpret_cast<Address>(type));
+  Handle<Map> map = isolate->factory()->NewMap(
+      instance_type, instance_size, elements_kind, inobject_properties);
+  map->set_wasm_type_info(*type_info);
+  return map;
+}
+
 }  // namespace
 
 // A helper class to simplify instantiating a module from a module object.
@@ -534,11 +568,30 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   }
 
   //--------------------------------------------------------------------------
-  // Debugging support.
+  // Create maps for managed objects (GC proposal).
   //--------------------------------------------------------------------------
-  // Set all breakpoints that were set on the shared module.
-  WasmScript::SetBreakpointsOnNewInstance(
-      handle(module_object_->script(), isolate_), instance);
+  if (enabled_.has_gc()) {
+    int count = 0;
+    for (uint8_t type_kind : module_->type_kinds) {
+      if (type_kind == kWasmStructTypeCode || type_kind == kWasmArrayTypeCode) {
+        count++;
+      }
+    }
+    Handle<FixedArray> maps =
+        isolate_->factory()->NewUninitializedFixedArray(count);
+    for (int i = 0; i < static_cast<int>(module_->type_kinds.size()); i++) {
+      int index = 0;
+      if (module_->type_kinds[i] == kWasmStructTypeCode) {
+        Handle<Map> map = CreateStructMap(isolate_, module_, i);
+        maps->set(index++, *map);
+      }
+      if (module_->type_kinds[i] == kWasmArrayTypeCode) {
+        Handle<Map> map = CreateArrayMap(isolate_, module_, i);
+        maps->set(index++, *map);
+      }
+    }
+    instance->set_managed_object_maps(*maps);
+  }
 
   //--------------------------------------------------------------------------
   // Create a wrapper for the start function.
@@ -751,7 +804,10 @@ void InstanceBuilder::WriteGlobalValue(const WasmGlobal& global,
     case ValueType::kAnyRef:
     case ValueType::kFuncRef:
     case ValueType::kNullRef:
-    case ValueType::kExnRef: {
+    case ValueType::kExnRef:
+    case ValueType::kRef:
+    case ValueType::kOptRef:
+    case ValueType::kEqRef: {
       DCHECK_IMPLIES(global.type == kWasmNullRef, value->GetRef()->IsNull());
       tagged_globals_->set(global.offset, *value->GetRef());
       break;
@@ -759,6 +815,8 @@ void InstanceBuilder::WriteGlobalValue(const WasmGlobal& global,
     case ValueType::kStmt:
     case ValueType::kS128:
     case ValueType::kBottom:
+    case ValueType::kI8:
+    case ValueType::kI16:
       UNREACHABLE();
   }
   TRACE(", type = %s (from WebAssembly.Global)\n", global.type.type_name());
diff --git a/deps/v8/src/wasm/streaming-decoder.cc b/deps/v8/src/wasm/streaming-decoder.cc
index c88a2c77b89..a97cb69be24 100644
--- a/deps/v8/src/wasm/streaming-decoder.cc
+++ b/deps/v8/src/wasm/streaming-decoder.cc
@@ -25,7 +25,203 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-void StreamingDecoder::OnBytesReceived(Vector<const uint8_t> bytes) {
+class V8_EXPORT_PRIVATE AsyncStreamingDecoder : public StreamingDecoder {
+ public:
+  explicit AsyncStreamingDecoder(std::unique_ptr<StreamingProcessor> processor);
+
+  // The buffer passed into OnBytesReceived is owned by the caller.
+  void OnBytesReceived(Vector<const uint8_t> bytes) override;
+
+  void Finish() override;
+
+  void Abort() override;
+
+  // Notify the StreamingDecoder that compilation ended and the
+  // StreamingProcessor should not be called anymore.
+  void NotifyCompilationEnded() override { Fail(); }
+
+  void NotifyNativeModuleCreated(
+      const std::shared_ptr<NativeModule>& native_module) override;
+
+ private:
+  // The SectionBuffer is the data object for the content of a single section.
+  // It stores all bytes of the section (including section id and section
+  // length), and the offset where the actual payload starts.
+  class SectionBuffer : public WireBytesStorage {
+   public:
+    // id: The section id.
+    // payload_length: The length of the payload.
+    // length_bytes: The section length, as it is encoded in the module bytes.
+    SectionBuffer(uint32_t module_offset, uint8_t id, size_t payload_length,
+                  Vector<const uint8_t> length_bytes)
+        :  // ID + length + payload
+          module_offset_(module_offset),
+          bytes_(OwnedVector<uint8_t>::New(1 + length_bytes.length() +
+                                           payload_length)),
+          payload_offset_(1 + length_bytes.length()) {
+      bytes_.start()[0] = id;
+      memcpy(bytes_.start() + 1, &length_bytes.first(), length_bytes.length());
+    }
+
+    SectionCode section_code() const {
+      return static_cast<SectionCode>(bytes_.start()[0]);
+    }
+
+    Vector<const uint8_t> GetCode(WireBytesRef ref) const final {
+      DCHECK_LE(module_offset_, ref.offset());
+      uint32_t offset_in_code_buffer = ref.offset() - module_offset_;
+      return bytes().SubVector(offset_in_code_buffer,
+                               offset_in_code_buffer + ref.length());
+    }
+
+    uint32_t module_offset() const { return module_offset_; }
+    Vector<uint8_t> bytes() const { return bytes_.as_vector(); }
+    Vector<uint8_t> payload() const { return bytes() + payload_offset_; }
+    size_t length() const { return bytes_.size(); }
+    size_t payload_offset() const { return payload_offset_; }
+
+   private:
+    const uint32_t module_offset_;
+    const OwnedVector<uint8_t> bytes_;
+    const size_t payload_offset_;
+  };
+
+  // The decoding of a stream of wasm module bytes is organized in states. Each
+  // state provides a buffer to store the bytes required for the current state,
+  // information on how many bytes have already been received, how many bytes
+  // are needed, and a {Next} function which starts the next state once all
+  // bytes of the current state were received.
+  //
+  // The states change according to the following state diagram:
+  //
+  //       Start
+  //         |
+  //         |
+  //         v
+  // DecodeModuleHeader
+  //         |   _________________________________________
+  //         |   |                                        |
+  //         v   v                                        |
+  //  DecodeSectionID --> DecodeSectionLength --> DecodeSectionPayload
+  //         A                  |
+  //         |                  | (if the section id == code)
+  //         |                  v
+  //         |      DecodeNumberOfFunctions -- > DecodeFunctionLength
+  //         |                                          A    |
+  //         |                                          |    |
+  //         |  (after all functions were read)         |    v
+  //         ------------------------------------- DecodeFunctionBody
+  //
+  class DecodingState {
+   public:
+    virtual ~DecodingState() = default;
+
+    // Reads the bytes for the current state and returns the number of read
+    // bytes.
+    virtual size_t ReadBytes(AsyncStreamingDecoder* streaming,
+                             Vector<const uint8_t> bytes);
+
+    // Returns the next state of the streaming decoding.
+    virtual std::unique_ptr<DecodingState> Next(
+        AsyncStreamingDecoder* streaming) = 0;
+    // The buffer to store the received bytes.
+    virtual Vector<uint8_t> buffer() = 0;
+    // The number of bytes which were already received.
+    size_t offset() const { return offset_; }
+    void set_offset(size_t value) { offset_ = value; }
+    // A flag to indicate if finishing the streaming decoder is allowed without
+    // error.
+    virtual bool is_finishing_allowed() const { return false; }
+
+   private:
+    size_t offset_ = 0;
+  };
+
+  // Forward declarations of the concrete states. This is needed so that they
+  // can access private members of the AsyncStreamingDecoder.
+  class DecodeVarInt32;
+  class DecodeModuleHeader;
+  class DecodeSectionID;
+  class DecodeSectionLength;
+  class DecodeSectionPayload;
+  class DecodeNumberOfFunctions;
+  class DecodeFunctionLength;
+  class DecodeFunctionBody;
+
+  // Creates a buffer for the next section of the module.
+  SectionBuffer* CreateNewBuffer(uint32_t module_offset, uint8_t section_id,
+                                 size_t length,
+                                 Vector<const uint8_t> length_bytes);
+
+  std::unique_ptr<DecodingState> Error(const WasmError& error) {
+    if (ok()) processor_->OnError(error);
+    Fail();
+    return std::unique_ptr<DecodingState>(nullptr);
+  }
+
+  std::unique_ptr<DecodingState> Error(std::string message) {
+    return Error(WasmError{module_offset_ - 1, std::move(message)});
+  }
+
+  void ProcessModuleHeader() {
+    if (!ok()) return;
+    if (!processor_->ProcessModuleHeader(state_->buffer(), 0)) Fail();
+  }
+
+  void ProcessSection(SectionBuffer* buffer) {
+    if (!ok()) return;
+    if (!processor_->ProcessSection(
+            buffer->section_code(), buffer->payload(),
+            buffer->module_offset() +
+                static_cast<uint32_t>(buffer->payload_offset()))) {
+      Fail();
+    }
+  }
+
+  void StartCodeSection(int num_functions,
+                        std::shared_ptr<WireBytesStorage> wire_bytes_storage,
+                        int code_section_length) {
+    if (!ok()) return;
+    // The offset passed to {ProcessCodeSectionHeader} is an error offset and
+    // not the start offset of a buffer. Therefore we need the -1 here.
+    if (!processor_->ProcessCodeSectionHeader(
+            num_functions, module_offset() - 1, std::move(wire_bytes_storage),
+            code_section_length)) {
+      Fail();
+    }
+  }
+
+  void ProcessFunctionBody(Vector<const uint8_t> bytes,
+                           uint32_t module_offset) {
+    if (!ok()) return;
+    if (!processor_->ProcessFunctionBody(bytes, module_offset)) Fail();
+  }
+
+  void Fail() {
+    // We reset the {processor_} field to represent failure. This also ensures
+    // that we do not accidentally call further methods on the processor after
+    // failure.
+    processor_.reset();
+  }
+
+  bool ok() const { return processor_ != nullptr; }
+
+  uint32_t module_offset() const { return module_offset_; }
+
+  std::unique_ptr<StreamingProcessor> processor_;
+  std::unique_ptr<DecodingState> state_;
+  std::vector<std::shared_ptr<SectionBuffer>> section_buffers_;
+  bool code_section_processed_ = false;
+  uint32_t module_offset_ = 0;
+  size_t total_size_ = 0;
+
+  // We need wire bytes in an array for deserializing cached modules.
+  std::vector<uint8_t> wire_bytes_for_deserializing_;
+
+  DISALLOW_COPY_AND_ASSIGN(AsyncStreamingDecoder);
+};
+
+void AsyncStreamingDecoder::OnBytesReceived(Vector<const uint8_t> bytes) {
   if (deserializing()) {
     wire_bytes_for_deserializing_.insert(wire_bytes_for_deserializing_.end(),
                                          bytes.begin(), bytes.end());
@@ -50,8 +246,8 @@ void StreamingDecoder::OnBytesReceived(Vector<const uint8_t> bytes) {
   }
 }
 
-size_t StreamingDecoder::DecodingState::ReadBytes(StreamingDecoder* streaming,
-                                                  Vector<const uint8_t> bytes) {
+size_t AsyncStreamingDecoder::DecodingState::ReadBytes(
+    AsyncStreamingDecoder* streaming, Vector<const uint8_t> bytes) {
   Vector<uint8_t> remaining_buf = buffer() + offset();
   size_t num_bytes = std::min(bytes.size(), remaining_buf.size());
   TRACE_STREAMING("ReadBytes(%zu bytes)\n", num_bytes);
@@ -60,7 +256,7 @@ size_t StreamingDecoder::DecodingState::ReadBytes(StreamingDecoder* streaming,
   return num_bytes;
 }
 
-void StreamingDecoder::Finish() {
+void AsyncStreamingDecoder::Finish() {
   TRACE_STREAMING("Finish\n");
   if (!ok()) return;
 
@@ -99,31 +295,20 @@ void StreamingDecoder::Finish() {
   processor_->OnFinishedStream(std::move(bytes));
 }
 
-void StreamingDecoder::Abort() {
+void AsyncStreamingDecoder::Abort() {
   TRACE_STREAMING("Abort\n");
   if (!ok()) return;  // Failed already.
   processor_->OnAbort();
   Fail();
 }
 
-void StreamingDecoder::SetModuleCompiledCallback(
-    ModuleCompiledCallback callback) {
-  DCHECK_NULL(module_compiled_callback_);
-  module_compiled_callback_ = callback;
-}
-
-bool StreamingDecoder::SetCompiledModuleBytes(
-    Vector<const uint8_t> compiled_module_bytes) {
-  compiled_module_bytes_ = compiled_module_bytes;
-  return true;
-}
-
 namespace {
 
 class TopTierCompiledCallback {
  public:
-  TopTierCompiledCallback(std::weak_ptr<NativeModule> native_module,
-                          StreamingDecoder::ModuleCompiledCallback callback)
+  TopTierCompiledCallback(
+      std::weak_ptr<NativeModule> native_module,
+      AsyncStreamingDecoder::ModuleCompiledCallback callback)
       : native_module_(std::move(native_module)),
         callback_(std::move(callback)) {}
 
@@ -142,7 +327,7 @@ class TopTierCompiledCallback {
 
  private:
   const std::weak_ptr<NativeModule> native_module_;
-  const StreamingDecoder::ModuleCompiledCallback callback_;
+  const AsyncStreamingDecoder::ModuleCompiledCallback callback_;
 #ifdef DEBUG
   mutable bool called_ = false;
 #endif
@@ -150,7 +335,7 @@ class TopTierCompiledCallback {
 
 }  // namespace
 
-void StreamingDecoder::NotifyNativeModuleCreated(
+void AsyncStreamingDecoder::NotifyNativeModuleCreated(
     const std::shared_ptr<NativeModule>& native_module) {
   if (!module_compiled_callback_) return;
   auto* comp_state = native_module->compilation_state();
@@ -162,20 +347,21 @@ void StreamingDecoder::NotifyNativeModuleCreated(
 // An abstract class to share code among the states which decode VarInts. This
 // class takes over the decoding of the VarInt and then calls the actual decode
 // code with the decoded value.
-class StreamingDecoder::DecodeVarInt32 : public DecodingState {
+class AsyncStreamingDecoder::DecodeVarInt32 : public DecodingState {
  public:
   explicit DecodeVarInt32(size_t max_value, const char* field_name)
       : max_value_(max_value), field_name_(field_name) {}
 
   Vector<uint8_t> buffer() override { return ArrayVector(byte_buffer_); }
 
-  size_t ReadBytes(StreamingDecoder* streaming,
+  size_t ReadBytes(AsyncStreamingDecoder* streaming,
                    Vector<const uint8_t> bytes) override;
 
-  std::unique_ptr<DecodingState> Next(StreamingDecoder* streaming) override;
+  std::unique_ptr<DecodingState> Next(
+      AsyncStreamingDecoder* streaming) override;
 
   virtual std::unique_ptr<DecodingState> NextWithValue(
-      StreamingDecoder* streaming) = 0;
+      AsyncStreamingDecoder* streaming) = 0;
 
  protected:
   uint8_t byte_buffer_[kMaxVarInt32Size];
@@ -187,11 +373,12 @@ class StreamingDecoder::DecodeVarInt32 : public DecodingState {
   size_t bytes_consumed_ = 0;
 };
 
-class StreamingDecoder::DecodeModuleHeader : public DecodingState {
+class AsyncStreamingDecoder::DecodeModuleHeader : public DecodingState {
  public:
   Vector<uint8_t> buffer() override { return ArrayVector(byte_buffer_); }
 
-  std::unique_ptr<DecodingState> Next(StreamingDecoder* streaming) override;
+  std::unique_ptr<DecodingState> Next(
+      AsyncStreamingDecoder* streaming) override;
 
  private:
   // Checks if the magic bytes of the module header are correct.
@@ -202,7 +389,7 @@ class StreamingDecoder::DecodeModuleHeader : public DecodingState {
   uint8_t byte_buffer_[kModuleHeaderSize];
 };
 
-class StreamingDecoder::DecodeSectionID : public DecodingState {
+class AsyncStreamingDecoder::DecodeSectionID : public DecodingState {
  public:
   explicit DecodeSectionID(uint32_t module_offset)
       : module_offset_(module_offset) {}
@@ -210,7 +397,8 @@ class StreamingDecoder::DecodeSectionID : public DecodingState {
   Vector<uint8_t> buffer() override { return {&id_, 1}; }
   bool is_finishing_allowed() const override { return true; }
 
-  std::unique_ptr<DecodingState> Next(StreamingDecoder* streaming) override;
+  std::unique_ptr<DecodingState> Next(
+      AsyncStreamingDecoder* streaming) override;
 
  private:
   uint8_t id_ = 0;
@@ -218,7 +406,7 @@ class StreamingDecoder::DecodeSectionID : public DecodingState {
   const uint32_t module_offset_;
 };
 
-class StreamingDecoder::DecodeSectionLength : public DecodeVarInt32 {
+class AsyncStreamingDecoder::DecodeSectionLength : public DecodeVarInt32 {
  public:
   explicit DecodeSectionLength(uint8_t id, uint32_t module_offset)
       : DecodeVarInt32(kV8MaxWasmModuleSize, "section length"),
@@ -226,7 +414,7 @@ class StreamingDecoder::DecodeSectionLength : public DecodeVarInt32 {
         module_offset_(module_offset) {}
 
   std::unique_ptr<DecodingState> NextWithValue(
-      StreamingDecoder* streaming) override;
+      AsyncStreamingDecoder* streaming) override;
 
  private:
   const uint8_t section_id_;
@@ -234,33 +422,34 @@ class StreamingDecoder::DecodeSectionLength : public DecodeVarInt32 {
   const uint32_t module_offset_;
 };
 
-class StreamingDecoder::DecodeSectionPayload : public DecodingState {
+class AsyncStreamingDecoder::DecodeSectionPayload : public DecodingState {
  public:
   explicit DecodeSectionPayload(SectionBuffer* section_buffer)
       : section_buffer_(section_buffer) {}
 
   Vector<uint8_t> buffer() override { return section_buffer_->payload(); }
 
-  std::unique_ptr<DecodingState> Next(StreamingDecoder* streaming) override;
+  std::unique_ptr<DecodingState> Next(
+      AsyncStreamingDecoder* streaming) override;
 
  private:
   SectionBuffer* const section_buffer_;
 };
 
-class StreamingDecoder::DecodeNumberOfFunctions : public DecodeVarInt32 {
+class AsyncStreamingDecoder::DecodeNumberOfFunctions : public DecodeVarInt32 {
  public:
   explicit DecodeNumberOfFunctions(SectionBuffer* section_buffer)
       : DecodeVarInt32(kV8MaxWasmFunctions, "functions count"),
         section_buffer_(section_buffer) {}
 
   std::unique_ptr<DecodingState> NextWithValue(
-      StreamingDecoder* streaming) override;
+      AsyncStreamingDecoder* streaming) override;
 
  private:
   SectionBuffer* const section_buffer_;
 };
 
-class StreamingDecoder::DecodeFunctionLength : public DecodeVarInt32 {
+class AsyncStreamingDecoder::DecodeFunctionLength : public DecodeVarInt32 {
  public:
   explicit DecodeFunctionLength(SectionBuffer* section_buffer,
                                 size_t buffer_offset,
@@ -274,7 +463,7 @@ class StreamingDecoder::DecodeFunctionLength : public DecodeVarInt32 {
   }
 
   std::unique_ptr<DecodingState> NextWithValue(
-      StreamingDecoder* streaming) override;
+      AsyncStreamingDecoder* streaming) override;
 
  private:
   SectionBuffer* const section_buffer_;
@@ -282,7 +471,7 @@ class StreamingDecoder::DecodeFunctionLength : public DecodeVarInt32 {
   const size_t num_remaining_functions_;
 };
 
-class StreamingDecoder::DecodeFunctionBody : public DecodingState {
+class AsyncStreamingDecoder::DecodeFunctionBody : public DecodingState {
  public:
   explicit DecodeFunctionBody(SectionBuffer* section_buffer,
                               size_t buffer_offset, size_t function_body_length,
@@ -300,7 +489,8 @@ class StreamingDecoder::DecodeFunctionBody : public DecodingState {
     return remaining_buffer.SubVector(0, function_body_length_);
   }
 
-  std::unique_ptr<DecodingState> Next(StreamingDecoder* streaming) override;
+  std::unique_ptr<DecodingState> Next(
+      AsyncStreamingDecoder* streaming) override;
 
  private:
   SectionBuffer* const section_buffer_;
@@ -310,8 +500,8 @@ class StreamingDecoder::DecodeFunctionBody : public DecodingState {
   const uint32_t module_offset_;
 };
 
-size_t StreamingDecoder::DecodeVarInt32::ReadBytes(
-    StreamingDecoder* streaming, Vector<const uint8_t> bytes) {
+size_t AsyncStreamingDecoder::DecodeVarInt32::ReadBytes(
+    AsyncStreamingDecoder* streaming, Vector<const uint8_t> bytes) {
   Vector<uint8_t> buf = buffer();
   Vector<uint8_t> remaining_buf = buf + offset();
   size_t new_bytes = std::min(bytes.size(), remaining_buf.size());
@@ -344,8 +534,8 @@ size_t StreamingDecoder::DecodeVarInt32::ReadBytes(
   return new_bytes;
 }
 
-std::unique_ptr<StreamingDecoder::DecodingState>
-StreamingDecoder::DecodeVarInt32::Next(StreamingDecoder* streaming) {
+std::unique_ptr<AsyncStreamingDecoder::DecodingState>
+AsyncStreamingDecoder::DecodeVarInt32::Next(AsyncStreamingDecoder* streaming) {
   if (!streaming->ok()) return nullptr;
 
   if (value_ > max_value_) {
@@ -358,16 +548,17 @@ StreamingDecoder::DecodeVarInt32::Next(StreamingDecoder* streaming) {
   return NextWithValue(streaming);
 }
 
-std::unique_ptr<StreamingDecoder::DecodingState>
-StreamingDecoder::DecodeModuleHeader::Next(StreamingDecoder* streaming) {
+std::unique_ptr<AsyncStreamingDecoder::DecodingState>
+AsyncStreamingDecoder::DecodeModuleHeader::Next(
+    AsyncStreamingDecoder* streaming) {
   TRACE_STREAMING("DecodeModuleHeader\n");
   streaming->ProcessModuleHeader();
   if (!streaming->ok()) return nullptr;
   return std::make_unique<DecodeSectionID>(streaming->module_offset());
 }
 
-std::unique_ptr<StreamingDecoder::DecodingState>
-StreamingDecoder::DecodeSectionID::Next(StreamingDecoder* streaming) {
+std::unique_ptr<AsyncStreamingDecoder::DecodingState>
+AsyncStreamingDecoder::DecodeSectionID::Next(AsyncStreamingDecoder* streaming) {
   TRACE_STREAMING("DecodeSectionID: %s section\n",
                   SectionName(static_cast<SectionCode>(id_)));
   if (id_ == SectionCode::kCodeSectionCode) {
@@ -383,9 +574,9 @@ StreamingDecoder::DecodeSectionID::Next(StreamingDecoder* streaming) {
   return std::make_unique<DecodeSectionLength>(id_, module_offset_);
 }
 
-std::unique_ptr<StreamingDecoder::DecodingState>
-StreamingDecoder::DecodeSectionLength::NextWithValue(
-    StreamingDecoder* streaming) {
+std::unique_ptr<AsyncStreamingDecoder::DecodingState>
+AsyncStreamingDecoder::DecodeSectionLength::NextWithValue(
+    AsyncStreamingDecoder* streaming) {
   TRACE_STREAMING("DecodeSectionLength(%zu)\n", value_);
   SectionBuffer* buf =
       streaming->CreateNewBuffer(module_offset_, section_id_, value_,
@@ -410,17 +601,18 @@ StreamingDecoder::DecodeSectionLength::NextWithValue(
   return std::make_unique<DecodeSectionPayload>(buf);
 }
 
-std::unique_ptr<StreamingDecoder::DecodingState>
-StreamingDecoder::DecodeSectionPayload::Next(StreamingDecoder* streaming) {
+std::unique_ptr<AsyncStreamingDecoder::DecodingState>
+AsyncStreamingDecoder::DecodeSectionPayload::Next(
+    AsyncStreamingDecoder* streaming) {
   TRACE_STREAMING("DecodeSectionPayload\n");
   streaming->ProcessSection(section_buffer_);
   if (!streaming->ok()) return nullptr;
   return std::make_unique<DecodeSectionID>(streaming->module_offset());
 }
 
-std::unique_ptr<StreamingDecoder::DecodingState>
-StreamingDecoder::DecodeNumberOfFunctions::NextWithValue(
-    StreamingDecoder* streaming) {
+std::unique_ptr<AsyncStreamingDecoder::DecodingState>
+AsyncStreamingDecoder::DecodeNumberOfFunctions::NextWithValue(
+    AsyncStreamingDecoder* streaming) {
   TRACE_STREAMING("DecodeNumberOfFunctions(%zu)\n", value_);
   // Copy the bytes we read into the section buffer.
   Vector<uint8_t> payload_buf = section_buffer_->payload();
@@ -449,9 +641,9 @@ StreamingDecoder::DecodeNumberOfFunctions::NextWithValue(
       value_);
 }
 
-std::unique_ptr<StreamingDecoder::DecodingState>
-StreamingDecoder::DecodeFunctionLength::NextWithValue(
-    StreamingDecoder* streaming) {
+std::unique_ptr<AsyncStreamingDecoder::DecodingState>
+AsyncStreamingDecoder::DecodeFunctionLength::NextWithValue(
+    AsyncStreamingDecoder* streaming) {
   TRACE_STREAMING("DecodeFunctionLength(%zu)\n", value_);
   // Copy the bytes we consumed into the section buffer.
   Vector<uint8_t> fun_length_buffer = section_buffer_->bytes() + buffer_offset_;
@@ -472,8 +664,9 @@ StreamingDecoder::DecodeFunctionLength::NextWithValue(
       num_remaining_functions_, streaming->module_offset());
 }
 
-std::unique_ptr<StreamingDecoder::DecodingState>
-StreamingDecoder::DecodeFunctionBody::Next(StreamingDecoder* streaming) {
+std::unique_ptr<AsyncStreamingDecoder::DecodingState>
+AsyncStreamingDecoder::DecodeFunctionBody::Next(
+    AsyncStreamingDecoder* streaming) {
   TRACE_STREAMING("DecodeFunctionBody\n");
   streaming->ProcessFunctionBody(buffer(), module_offset_);
   if (!streaming->ok()) return nullptr;
@@ -490,13 +683,13 @@ StreamingDecoder::DecodeFunctionBody::Next(StreamingDecoder* streaming) {
   return std::make_unique<DecodeSectionID>(streaming->module_offset());
 }
 
-StreamingDecoder::StreamingDecoder(
+AsyncStreamingDecoder::AsyncStreamingDecoder(
     std::unique_ptr<StreamingProcessor> processor)
     : processor_(std::move(processor)),
       // A module always starts with a module header.
       state_(new DecodeModuleHeader()) {}
 
-StreamingDecoder::SectionBuffer* StreamingDecoder::CreateNewBuffer(
+AsyncStreamingDecoder::SectionBuffer* AsyncStreamingDecoder::CreateNewBuffer(
     uint32_t module_offset, uint8_t section_id, size_t length,
     Vector<const uint8_t> length_bytes) {
   // Section buffers are allocated in the same order they appear in the module,
@@ -506,6 +699,11 @@ StreamingDecoder::SectionBuffer* StreamingDecoder::CreateNewBuffer(
   return section_buffers_.back().get();
 }
 
+std::unique_ptr<StreamingDecoder> StreamingDecoder::CreateAsyncStreamingDecoder(
+    std::unique_ptr<StreamingProcessor> processor) {
+  return std::make_unique<AsyncStreamingDecoder>(std::move(processor));
+}
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/streaming-decoder.h b/deps/v8/src/wasm/streaming-decoder.h
index f3203e70274..bdf3218d1ef 100644
--- a/deps/v8/src/wasm/streaming-decoder.h
+++ b/deps/v8/src/wasm/streaming-decoder.h
@@ -12,6 +12,7 @@
 #include "src/utils/vector.h"
 #include "src/wasm/compilation-environment.h"
 #include "src/wasm/wasm-constants.h"
+#include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-result.h"
 
 namespace v8 {
@@ -66,220 +67,57 @@ class V8_EXPORT_PRIVATE StreamingProcessor {
 // and function bodies.
 class V8_EXPORT_PRIVATE StreamingDecoder {
  public:
-  explicit StreamingDecoder(std::unique_ptr<StreamingProcessor> processor);
+  virtual ~StreamingDecoder() = default;
 
   // The buffer passed into OnBytesReceived is owned by the caller.
-  void OnBytesReceived(Vector<const uint8_t> bytes);
+  virtual void OnBytesReceived(Vector<const uint8_t> bytes) = 0;
 
-  void Finish();
+  virtual void Finish() = 0;
 
-  void Abort();
+  virtual void Abort() = 0;
 
   // Notify the StreamingDecoder that compilation ended and the
   // StreamingProcessor should not be called anymore.
-  void NotifyCompilationEnded() { Fail(); }
+  virtual void NotifyCompilationEnded() = 0;
 
   // Caching support.
   // Sets the callback that is called after the module is fully compiled.
   using ModuleCompiledCallback =
       std::function<void(const std::shared_ptr<NativeModule>&)>;
-  void SetModuleCompiledCallback(ModuleCompiledCallback callback);
-  // Passes previously compiled module bytes from the embedder's cache.
-  bool SetCompiledModuleBytes(Vector<const uint8_t> compiled_module_bytes);
-
-  void NotifyNativeModuleCreated(
-      const std::shared_ptr<NativeModule>& native_module);
-
-  Vector<const char> url() { return VectorOf(url_); }
-  void SetUrl(Vector<const char> url) {
-    url_.assign(url.begin(), url.length());
-  }
-
- private:
-  // TODO(ahaas): Put the whole private state of the StreamingDecoder into the
-  // cc file (PIMPL design pattern).
-
-  // The SectionBuffer is the data object for the content of a single section.
-  // It stores all bytes of the section (including section id and section
-  // length), and the offset where the actual payload starts.
-  class SectionBuffer : public WireBytesStorage {
-   public:
-    // id: The section id.
-    // payload_length: The length of the payload.
-    // length_bytes: The section length, as it is encoded in the module bytes.
-    SectionBuffer(uint32_t module_offset, uint8_t id, size_t payload_length,
-                  Vector<const uint8_t> length_bytes)
-        :  // ID + length + payload
-          module_offset_(module_offset),
-          bytes_(OwnedVector<uint8_t>::New(1 + length_bytes.length() +
-                                           payload_length)),
-          payload_offset_(1 + length_bytes.length()) {
-      bytes_.start()[0] = id;
-      memcpy(bytes_.start() + 1, &length_bytes.first(), length_bytes.length());
-    }
-
-    SectionCode section_code() const {
-      return static_cast<SectionCode>(bytes_.start()[0]);
-    }
-
-    Vector<const uint8_t> GetCode(WireBytesRef ref) const final {
-      DCHECK_LE(module_offset_, ref.offset());
-      uint32_t offset_in_code_buffer = ref.offset() - module_offset_;
-      return bytes().SubVector(offset_in_code_buffer,
-                               offset_in_code_buffer + ref.length());
-    }
-
-    uint32_t module_offset() const { return module_offset_; }
-    Vector<uint8_t> bytes() const { return bytes_.as_vector(); }
-    Vector<uint8_t> payload() const { return bytes() + payload_offset_; }
-    size_t length() const { return bytes_.size(); }
-    size_t payload_offset() const { return payload_offset_; }
-
-   private:
-    const uint32_t module_offset_;
-    const OwnedVector<uint8_t> bytes_;
-    const size_t payload_offset_;
-  };
-
-  // The decoding of a stream of wasm module bytes is organized in states. Each
-  // state provides a buffer to store the bytes required for the current state,
-  // information on how many bytes have already been received, how many bytes
-  // are needed, and a {Next} function which starts the next state once all
-  // bytes of the current state were received.
-  //
-  // The states change according to the following state diagram:
-  //
-  //       Start
-  //         |
-  //         |
-  //         v
-  // DecodeModuleHeader
-  //         |   _________________________________________
-  //         |   |                                        |
-  //         v   v                                        |
-  //  DecodeSectionID --> DecodeSectionLength --> DecodeSectionPayload
-  //         A                  |
-  //         |                  | (if the section id == code)
-  //         |                  v
-  //         |      DecodeNumberOfFunctions -- > DecodeFunctionLength
-  //         |                                          A    |
-  //         |                                          |    |
-  //         |  (after all functions were read)         |    v
-  //         ------------------------------------- DecodeFunctionBody
-  //
-  class DecodingState {
-   public:
-    virtual ~DecodingState() = default;
-
-    // Reads the bytes for the current state and returns the number of read
-    // bytes.
-    virtual size_t ReadBytes(StreamingDecoder* streaming,
-                             Vector<const uint8_t> bytes);
-
-    // Returns the next state of the streaming decoding.
-    virtual std::unique_ptr<DecodingState> Next(
-        StreamingDecoder* streaming) = 0;
-    // The buffer to store the received bytes.
-    virtual Vector<uint8_t> buffer() = 0;
-    // The number of bytes which were already received.
-    size_t offset() const { return offset_; }
-    void set_offset(size_t value) { offset_ = value; }
-    // A flag to indicate if finishing the streaming decoder is allowed without
-    // error.
-    virtual bool is_finishing_allowed() const { return false; }
 
-   private:
-    size_t offset_ = 0;
-  };
-
-  // Forward declarations of the concrete states. This is needed so that they
-  // can access private members of the StreamingDecoder.
-  class DecodeVarInt32;
-  class DecodeModuleHeader;
-  class DecodeSectionID;
-  class DecodeSectionLength;
-  class DecodeSectionPayload;
-  class DecodeNumberOfFunctions;
-  class DecodeFunctionLength;
-  class DecodeFunctionBody;
-
-  // Creates a buffer for the next section of the module.
-  SectionBuffer* CreateNewBuffer(uint32_t module_offset, uint8_t section_id,
-                                 size_t length,
-                                 Vector<const uint8_t> length_bytes);
-
-  std::unique_ptr<DecodingState> Error(const WasmError& error) {
-    if (ok()) processor_->OnError(error);
-    Fail();
-    return std::unique_ptr<DecodingState>(nullptr);
-  }
-
-  std::unique_ptr<DecodingState> Error(std::string message) {
-    return Error(WasmError{module_offset_ - 1, std::move(message)});
-  }
-
-  void ProcessModuleHeader() {
-    if (!ok()) return;
-    if (!processor_->ProcessModuleHeader(state_->buffer(), 0)) Fail();
+  void SetModuleCompiledCallback(ModuleCompiledCallback callback) {
+    module_compiled_callback_ = callback;
   }
 
-  void ProcessSection(SectionBuffer* buffer) {
-    if (!ok()) return;
-    if (!processor_->ProcessSection(
-            buffer->section_code(), buffer->payload(),
-            buffer->module_offset() +
-                static_cast<uint32_t>(buffer->payload_offset()))) {
-      Fail();
-    }
+  // Passes previously compiled module bytes from the embedder's cache.
+  bool SetCompiledModuleBytes(Vector<const uint8_t> compiled_module_bytes) {
+    compiled_module_bytes_ = compiled_module_bytes;
+    return true;
   }
 
-  void StartCodeSection(int num_functions,
-                        std::shared_ptr<WireBytesStorage> wire_bytes_storage,
-                        int code_section_length) {
-    if (!ok()) return;
-    // The offset passed to {ProcessCodeSectionHeader} is an error offset and
-    // not the start offset of a buffer. Therefore we need the -1 here.
-    if (!processor_->ProcessCodeSectionHeader(
-            num_functions, module_offset() - 1, std::move(wire_bytes_storage),
-            code_section_length)) {
-      Fail();
-    }
-  }
+  virtual void NotifyNativeModuleCreated(
+      const std::shared_ptr<NativeModule>& native_module) = 0;
 
-  void ProcessFunctionBody(Vector<const uint8_t> bytes,
-                           uint32_t module_offset) {
-    if (!ok()) return;
-    if (!processor_->ProcessFunctionBody(bytes, module_offset)) Fail();
-  }
+  Vector<const char> url() { return VectorOf(url_); }
 
-  void Fail() {
-    // We reset the {processor_} field to represent failure. This also ensures
-    // that we do not accidentally call further methods on the processor after
-    // failure.
-    processor_.reset();
+  void SetUrl(Vector<const char> url) {
+    url_.assign(url.begin(), url.length());
   }
 
-  bool ok() const { return processor_ != nullptr; }
+  static std::unique_ptr<StreamingDecoder> CreateAsyncStreamingDecoder(
+      std::unique_ptr<StreamingProcessor> processor);
 
-  uint32_t module_offset() const { return module_offset_; }
+  static std::unique_ptr<StreamingDecoder> CreateSyncStreamingDecoder(
+      Isolate* isolate, const WasmFeatures& enabled, Handle<Context> context,
+      const char* api_method_name_for_errors,
+      std::shared_ptr<CompilationResultResolver> resolver);
 
+ protected:
   bool deserializing() const { return !compiled_module_bytes_.empty(); }
 
-  std::unique_ptr<StreamingProcessor> processor_;
-  std::unique_ptr<DecodingState> state_;
-  std::vector<std::shared_ptr<SectionBuffer>> section_buffers_;
-  bool code_section_processed_ = false;
-  uint32_t module_offset_ = 0;
-  size_t total_size_ = 0;
   std::string url_;
-
-  // Caching support.
-  ModuleCompiledCallback module_compiled_callback_ = nullptr;
-  // We need wire bytes in an array for deserializing cached modules.
-  std::vector<uint8_t> wire_bytes_for_deserializing_;
+  ModuleCompiledCallback module_compiled_callback_;
   Vector<const uint8_t> compiled_module_bytes_;
-
-  DISALLOW_COPY_AND_ASSIGN(StreamingDecoder);
 };
 
 }  // namespace wasm
diff --git a/deps/v8/src/wasm/struct-types.h b/deps/v8/src/wasm/struct-types.h
new file mode 100644
index 00000000000..cee563b89f4
--- /dev/null
+++ b/deps/v8/src/wasm/struct-types.h
@@ -0,0 +1,138 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_WASM_STRUCT_TYPES_H_
+#define V8_WASM_STRUCT_TYPES_H_
+
+#include "src/base/iterator.h"
+#include "src/base/macros.h"
+#include "src/common/globals.h"
+#include "src/wasm/value-type.h"
+#include "src/zone/zone.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+
+class StructType : public ZoneObject {
+ public:
+  StructType(uint32_t field_count, uint32_t* field_offsets,
+             const ValueType* reps, const bool* mutabilities)
+      : field_count_(field_count),
+        field_offsets_(field_offsets),
+        reps_(reps),
+        mutabilities_(mutabilities) {
+    InitializeOffsets();
+  }
+
+  uint32_t field_count() const { return field_count_; }
+
+  ValueType field(uint32_t index) const {
+    DCHECK_LT(index, field_count_);
+    return reps_[index];
+  }
+
+  bool mutability(uint32_t index) const {
+    DCHECK_LT(index, field_count_);
+    return mutabilities_[index];
+  }
+
+  // Iteration support.
+  base::iterator_range<const ValueType*> fields() const {
+    return {reps_, reps_ + field_count_};
+  }
+  base::iterator_range<const bool*> mutabilities() const {
+    return {mutabilities_, mutabilities_ + field_count_};
+  }
+
+  bool operator==(const StructType& other) const {
+    if (this == &other) return true;
+    if (field_count() != other.field_count()) return false;
+    return std::equal(fields().begin(), fields().end(),
+                      other.fields().begin()) &&
+           std::equal(mutabilities().begin(), mutabilities().end(),
+                      other.mutabilities().begin());
+  }
+  bool operator!=(const StructType& other) const { return !(*this == other); }
+
+  uint32_t field_offset(uint32_t index) const {
+    DCHECK_LT(index, field_count());
+    if (index == 0) return 0;
+    return field_offsets_[index - 1];
+  }
+  uint32_t total_fields_size() const {
+    return field_offsets_[field_count() - 1];
+  }
+
+  void InitializeOffsets() {
+    uint32_t offset = field(0).element_size_bytes();
+    for (uint32_t i = 1; i < field_count(); i++) {
+      uint32_t field_size = field(i).element_size_bytes();
+      offset = RoundUp(offset, field_size);
+      field_offsets_[i - 1] = offset;
+      offset += field_size;
+    }
+    offset = RoundUp(offset, kTaggedSize);
+    field_offsets_[field_count() - 1] = offset;
+  }
+
+  // For incrementally building StructTypes.
+  class Builder {
+   public:
+    Builder(Zone* zone, uint32_t field_count)
+        : field_count_(field_count),
+          zone_(zone),
+          cursor_(0),
+          buffer_(zone->NewArray<ValueType>(static_cast<int>(field_count))),
+          mutabilities_(zone->NewArray<bool>(static_cast<int>(field_count))) {}
+
+    void AddField(ValueType type, bool mutability) {
+      DCHECK_LT(cursor_, field_count_);
+      mutabilities_[cursor_] = mutability;
+      buffer_[cursor_++] = type;
+    }
+
+    StructType* Build() {
+      DCHECK_EQ(cursor_, field_count_);
+      uint32_t* offsets = zone_->NewArray<uint32_t>(field_count_);
+      return new (zone_)
+          StructType(field_count_, offsets, buffer_, mutabilities_);
+    }
+
+   private:
+    const uint32_t field_count_;
+    Zone* zone_;
+    uint32_t cursor_;
+    ValueType* buffer_;
+    bool* mutabilities_;
+  };
+
+ private:
+  uint32_t field_count_;
+  uint32_t* field_offsets_;
+  const ValueType* reps_;
+  const bool* mutabilities_;
+};
+
+class ArrayType : public ZoneObject {
+ public:
+  constexpr explicit ArrayType(ValueType rep, bool mutability)
+      : rep_(rep), mutability_(mutability) {}
+
+  ValueType element_type() const { return rep_; }
+  bool mutability() const { return mutability_; }
+
+  bool operator==(const ArrayType& other) const { return rep_ == other.rep_; }
+  bool operator!=(const ArrayType& other) const { return rep_ != other.rep_; }
+
+ private:
+  const ValueType rep_;
+  const bool mutability_;
+};
+
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_WASM_STRUCT_TYPES_H_
diff --git a/deps/v8/src/wasm/sync-streaming-decoder.cc b/deps/v8/src/wasm/sync-streaming-decoder.cc
new file mode 100644
index 00000000000..7152806d9d9
--- /dev/null
+++ b/deps/v8/src/wasm/sync-streaming-decoder.cc
@@ -0,0 +1,112 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/execution/isolate.h"
+#include "src/wasm/streaming-decoder.h"
+#include "src/wasm/wasm-engine.h"
+#include "src/wasm/wasm-objects-inl.h"
+#include "src/wasm/wasm-serialization.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+
+class V8_EXPORT_PRIVATE SyncStreamingDecoder : public StreamingDecoder {
+ public:
+  SyncStreamingDecoder(Isolate* isolate, const WasmFeatures& enabled,
+                       Handle<Context> context,
+                       const char* api_method_name_for_errors,
+                       std::shared_ptr<CompilationResultResolver> resolver)
+      : isolate_(isolate),
+        enabled_(enabled),
+        context_(context),
+        api_method_name_for_errors_(api_method_name_for_errors),
+        resolver_(resolver) {}
+
+  // The buffer passed into OnBytesReceived is owned by the caller.
+  void OnBytesReceived(Vector<const uint8_t> bytes) override {
+    buffer_.emplace_back(bytes.size());
+    CHECK_EQ(buffer_.back().size(), bytes.size());
+    std::memcpy(buffer_.back().data(), bytes.data(), bytes.size());
+    buffer_size_ += bytes.size();
+  }
+
+  void Finish() override {
+    // We copy all received chunks into one byte buffer.
+    auto bytes = std::make_unique<uint8_t[]>(buffer_size_);
+    uint8_t* destination = bytes.get();
+    for (auto& chunk : buffer_) {
+      std::memcpy(destination, chunk.data(), chunk.size());
+      destination += chunk.size();
+    }
+    CHECK_EQ(destination - bytes.get(), buffer_size_);
+
+    // Check if we can deserialize the module from cache.
+    if (deserializing()) {
+      HandleScope scope(isolate_);
+      SaveAndSwitchContext saved_context(isolate_, *context_);
+
+      MaybeHandle<WasmModuleObject> module_object = DeserializeNativeModule(
+          isolate_, compiled_module_bytes_,
+          Vector<const uint8_t>(bytes.get(), buffer_size_), url());
+
+      if (!module_object.is_null()) {
+        Handle<WasmModuleObject> module = module_object.ToHandleChecked();
+        resolver_->OnCompilationSucceeded(module);
+        return;
+      }
+    }
+
+    // Compile the received bytes synchronously.
+    ModuleWireBytes wire_bytes(bytes.get(), bytes.get() + buffer_size_);
+    ErrorThrower thrower(isolate_, api_method_name_for_errors_);
+    MaybeHandle<WasmModuleObject> module_object =
+        isolate_->wasm_engine()->SyncCompile(isolate_, enabled_, &thrower,
+                                             wire_bytes);
+    if (thrower.error()) {
+      resolver_->OnCompilationFailed(thrower.Reify());
+      return;
+    }
+    Handle<WasmModuleObject> module = module_object.ToHandleChecked();
+    if (module_compiled_callback_) {
+      module_compiled_callback_(module->shared_native_module());
+    }
+    resolver_->OnCompilationSucceeded(module);
+  }
+
+  void Abort() override {
+    // Abort is fully handled by the API, we only clear the buffer.
+    buffer_.clear();
+  }
+
+  void NotifyCompilationEnded() override { buffer_.clear(); }
+
+  void NotifyNativeModuleCreated(
+      const std::shared_ptr<NativeModule>&) override {
+    // This function is only called from the {AsyncCompileJob}.
+    UNREACHABLE();
+  }
+
+ private:
+  Isolate* isolate_;
+  const WasmFeatures enabled_;
+  Handle<Context> context_;
+  const char* api_method_name_for_errors_;
+  std::shared_ptr<CompilationResultResolver> resolver_;
+
+  std::vector<std::vector<uint8_t>> buffer_;
+  size_t buffer_size_ = 0;
+};
+
+std::unique_ptr<StreamingDecoder> StreamingDecoder::CreateSyncStreamingDecoder(
+    Isolate* isolate, const WasmFeatures& enabled, Handle<Context> context,
+    const char* api_method_name_for_errors,
+    std::shared_ptr<CompilationResultResolver> resolver) {
+  return std::make_unique<SyncStreamingDecoder>(isolate, enabled, context,
+                                                api_method_name_for_errors,
+                                                std::move(resolver));
+}
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/wasm/value-type.h b/deps/v8/src/wasm/value-type.h
index 42230dfc06a..1c6062de456 100644
--- a/deps/v8/src/wasm/value-type.h
+++ b/deps/v8/src/wasm/value-type.h
@@ -5,6 +5,7 @@
 #ifndef V8_WASM_VALUE_TYPE_H_
 #define V8_WASM_VALUE_TYPE_H_
 
+#include "src/base/bit-field.h"
 #include "src/codegen/machine-type.h"
 #include "src/wasm/wasm-constants.h"
 
@@ -19,17 +20,28 @@ namespace wasm {
 // Type for holding simd values, defined in wasm-value.h.
 class Simd128;
 
-// Type lattice: For any two types connected by a line, the type at the bottom
-// is a subtype of the other type.
+// Type lattice: Given a fixed struct type S, the following lattice
+// defines the subtyping relation among types:
+// For every two types connected by a line, the top type is a
+// (direct) subtype of the bottom type.
 //
-//                       AnyRef
-//                       /    \
-//                 FuncRef    ExnRef
-//                       \    /
-// I32  I64  F32  F64    NullRef
-//   \    \    \    \    /
-//   ------------   Bottom
+//                            AnyRef
+//                           /      \
+//                          /      EqRef
+//                         /       /   \
+//                  FuncRef  ExnRef  OptRef(S)
+//                         \    |   /        \
+// I32  I64  F32  F64        NullRef        Ref(S)
+//   \    \    \    \           |            /
+//    ---------------------- Bottom ---------
 // Format: kind, log2Size, code, machineType, shortName, typeName
+//
+// Some of these types are from proposals that are not standardized yet:
+// - "ref" types per https://github.com/WebAssembly/function-references
+// - "optref"/"eqref" per https://github.com/WebAssembly/gc
+//
+// TODO(7748): Extend this with struct and function subtyping.
+//             Keep up to date with funcref vs. anyref subtyping.
 #define FOREACH_VALUE_TYPE(V)                                                \
   V(Stmt, -1, Void, None, 'v', "<stmt>")                                     \
   V(I32, 2, I32, Int32, 'i', "i32")                                          \
@@ -37,10 +49,15 @@ class Simd128;
   V(F32, 2, F32, Float32, 'f', "f32")                                        \
   V(F64, 3, F64, Float64, 'd', "f64")                                        \
   V(S128, 4, S128, Simd128, 's', "s128")                                     \
+  V(I8, 1, I8, Int8, 'b', "i8")                                              \
+  V(I16, 1, I16, Int16, 'h', "i16")                                          \
   V(AnyRef, kSystemPointerSizeLog2, AnyRef, TaggedPointer, 'r', "anyref")    \
   V(FuncRef, kSystemPointerSizeLog2, FuncRef, TaggedPointer, 'a', "funcref") \
   V(NullRef, kSystemPointerSizeLog2, NullRef, TaggedPointer, 'n', "nullref") \
   V(ExnRef, kSystemPointerSizeLog2, ExnRef, TaggedPointer, 'e', "exn")       \
+  V(Ref, kSystemPointerSizeLog2, Ref, TaggedPointer, '*', "ref")             \
+  V(OptRef, kSystemPointerSizeLog2, OptRef, TaggedPointer, 'o', "optref")    \
+  V(EqRef, kSystemPointerSizeLog2, EqRef, TaggedPointer, 'q', "eqref")       \
   V(Bottom, -1, Void, None, '*', "<bot>")
 
 class ValueType {
@@ -51,15 +68,36 @@ class ValueType {
 #undef DEF_ENUM
   };
 
-  constexpr ValueType() : kind_(kStmt) {}
-  explicit constexpr ValueType(Kind kind) : kind_(kind) {}
+  constexpr bool has_immediate() const {
+    return kind() == kRef || kind() == kOptRef;
+  }
 
-  constexpr Kind kind() const { return kind_; }
+  constexpr ValueType() : bit_field_(KindField::encode(kStmt)) {}
+  explicit constexpr ValueType(Kind kind)
+      : bit_field_(KindField::encode(kind)) {
+#if V8_HAS_CXX14_CONSTEXPR
+    DCHECK(!has_immediate());
+#endif
+  }
+  constexpr ValueType(Kind kind, uint32_t ref_index)
+      : bit_field_(KindField::encode(kind) | RefIndexField::encode(ref_index)) {
+#if V8_HAS_CXX14_CONSTEXPR
+    DCHECK(has_immediate());
+#endif
+  }
+
+  constexpr Kind kind() const { return KindField::decode(bit_field_); }
+  constexpr uint32_t ref_index() const {
+#if V8_HAS_CXX14_CONSTEXPR
+    DCHECK(has_immediate());
+#endif
+    return RefIndexField::decode(bit_field_);
+  }
 
   constexpr int element_size_log2() const {
 #if V8_HAS_CXX14_CONSTEXPR
-    DCHECK_NE(kStmt, kind_);
-    DCHECK_NE(kBottom, kind_);
+    DCHECK_NE(kStmt, kind());
+    DCHECK_NE(kBottom, kind());
 #endif
 
     constexpr int kElementSizeLog2[] = {
@@ -68,46 +106,55 @@ class ValueType {
 #undef ELEM_SIZE_LOG2
     };
 
-    return kElementSizeLog2[kind_];
+    return kElementSizeLog2[kind()];
   }
 
   constexpr int element_size_bytes() const { return 1 << element_size_log2(); }
 
   constexpr bool operator==(ValueType other) const {
-    return kind_ == other.kind_;
+    return bit_field_ == other.bit_field_;
   }
   constexpr bool operator!=(ValueType other) const {
-    return kind_ != other.kind_;
+    return bit_field_ != other.bit_field_;
   }
 
-  bool IsSubTypeOf(ValueType other) const {
-    return (*this == other) || (kind_ == kNullRef && other.kind_ == kAnyRef) ||
-           (kind_ == kFuncRef && other.kind_ == kAnyRef) ||
-           (kind_ == kExnRef && other.kind_ == kAnyRef) ||
-           (kind_ == kNullRef && other.kind_ == kFuncRef) ||
-           (kind_ == kNullRef && other.kind_ == kExnRef);
+  // TODO(7748): Extend this with struct and function subtyping.
+  //             Keep up to date with funcref vs. anyref subtyping.
+  constexpr bool IsSubTypeOf(ValueType other) const {
+    return (*this == other) || (other.kind() == kAnyRef && IsReferenceType()) ||
+           (kind() == kNullRef && other.kind() != kRef &&
+            other.IsReferenceType()) ||
+           (other.kind() == kEqRef &&
+            (kind() == kExnRef || kind() == kOptRef || kind() == kRef)) ||
+           (kind() == kRef && other.kind() == kOptRef &&
+            ref_index() == other.ref_index());
   }
 
-  bool IsReferenceType() const {
-    return kind_ == kAnyRef || kind_ == kFuncRef || kind_ == kNullRef ||
-           kind_ == kExnRef;
+  constexpr bool IsReferenceType() const {
+    return kAnyRef <= kind() && kind() <= kEqRef;
   }
 
+  // TODO(7748): Extend this with struct and function subtyping.
+  //             Keep up to date with funcref vs. anyref subtyping.
   static ValueType CommonSubType(ValueType a, ValueType b) {
-    if (a.kind() == b.kind()) return a;
+    if (a == b) return a;
     // The only sub type of any value type is {bot}.
     if (!a.IsReferenceType() || !b.IsReferenceType()) {
       return ValueType(kBottom);
     }
     if (a.IsSubTypeOf(b)) return a;
     if (b.IsSubTypeOf(a)) return b;
-    // {a} and {b} are not each other's subtype. The biggest sub-type of all
-    // reference types is {kWasmNullRef}.
+    // {a} and {b} are not each other's subtype.
+    // If one of them is not nullable, their greatest subtype is bottom,
+    // otherwise null.
+    if (a.kind() == kRef || b.kind() == kRef) return ValueType(kBottom);
     return ValueType(kNullRef);
   }
 
-  ValueTypeCode value_type_code() const {
-    DCHECK_NE(kBottom, kind_);
+  constexpr ValueTypeCode value_type_code() const {
+#if V8_HAS_CXX14_CONSTEXPR
+    DCHECK_NE(kBottom, kind());
+#endif
 
     constexpr ValueTypeCode kValueTypeCode[] = {
 #define TYPE_CODE(kind, log2Size, code, ...) kLocal##code,
@@ -115,11 +162,13 @@ class ValueType {
 #undef TYPE_CODE
     };
 
-    return kValueTypeCode[kind_];
+    return kValueTypeCode[kind()];
   }
 
-  MachineType machine_type() const {
-    DCHECK_NE(kBottom, kind_);
+  constexpr MachineType machine_type() const {
+#if V8_HAS_CXX14_CONSTEXPR
+    DCHECK_NE(kBottom, kind());
+#endif
 
     constexpr MachineType kMachineType[] = {
 #define MACH_TYPE(kind, log2Size, code, machineType, ...) \
@@ -128,10 +177,10 @@ class ValueType {
 #undef MACH_TYPE
     };
 
-    return kMachineType[kind_];
+    return kMachineType[kind()];
   }
 
-  MachineRepresentation machine_representation() {
+  constexpr MachineRepresentation machine_representation() const {
     return machine_type().representation();
   }
 
@@ -163,7 +212,7 @@ class ValueType {
 #undef SHORT_NAME
     };
 
-    return kShortName[kind_];
+    return kShortName[kind()];
   }
 
   constexpr const char* type_name() const {
@@ -174,13 +223,20 @@ class ValueType {
 #undef TYPE_NAME
     };
 
-    return kTypeName[kind_];
+    return kTypeName[kind()];
+  }
+
+  constexpr bool IsPacked() const { return kind() == kI8 || kind() == kI16; }
+
+  constexpr ValueType Unpack() const {
+    return IsPacked() ? ValueType(kI32) : *this;
   }
 
  private:
-  Kind kind_ : 8;
-  // TODO(jkummerow): Add and use the following for reference types:
-  // uint32_t ref_index_ : 24;
+  using KindField = base::BitField<Kind, 0, 8>;
+  using RefIndexField = base::BitField<uint32_t, 8, 24>;
+
+  uint32_t bit_field_;
 };
 
 static_assert(sizeof(ValueType) <= kUInt32Size,
@@ -200,10 +256,13 @@ constexpr ValueType kWasmI64 = ValueType(ValueType::kI64);
 constexpr ValueType kWasmF32 = ValueType(ValueType::kF32);
 constexpr ValueType kWasmF64 = ValueType(ValueType::kF64);
 constexpr ValueType kWasmAnyRef = ValueType(ValueType::kAnyRef);
+constexpr ValueType kWasmEqRef = ValueType(ValueType::kEqRef);
 constexpr ValueType kWasmExnRef = ValueType(ValueType::kExnRef);
 constexpr ValueType kWasmFuncRef = ValueType(ValueType::kFuncRef);
 constexpr ValueType kWasmNullRef = ValueType(ValueType::kNullRef);
 constexpr ValueType kWasmS128 = ValueType(ValueType::kS128);
+constexpr ValueType kWasmI8 = ValueType(ValueType::kI8);
+constexpr ValueType kWasmI16 = ValueType(ValueType::kI16);
 constexpr ValueType kWasmStmt = ValueType(ValueType::kStmt);
 constexpr ValueType kWasmBottom = ValueType(ValueType::kBottom);
 
diff --git a/deps/v8/src/wasm/wasm-code-manager.cc b/deps/v8/src/wasm/wasm-code-manager.cc
index 99cf484b178..992b98acb18 100644
--- a/deps/v8/src/wasm/wasm-code-manager.cc
+++ b/deps/v8/src/wasm/wasm-code-manager.cc
@@ -24,6 +24,7 @@
 #include "src/wasm/compilation-environment.h"
 #include "src/wasm/function-compiler.h"
 #include "src/wasm/jump-table-assembler.h"
+#include "src/wasm/module-compiler.h"
 #include "src/wasm/wasm-debug.h"
 #include "src/wasm/wasm-import-wrapper-cache.h"
 #include "src/wasm/wasm-module-sourcemap.h"
@@ -46,47 +47,59 @@ namespace wasm {
 
 using trap_handler::ProtectedInstructionData;
 
-base::AddressRegion DisjointAllocationPool::Merge(base::AddressRegion region) {
-  auto dest_it = regions_.begin();
-  auto dest_end = regions_.end();
-
-  // Skip over dest regions strictly before {region}.
-  while (dest_it != dest_end && dest_it->end() < region.begin()) ++dest_it;
-
-  // After last dest region: insert and done.
-  if (dest_it == dest_end) {
-    regions_.push_back(region);
-    return region;
-  }
-
-  // Adjacent (from below) to dest: merge and done.
-  if (dest_it->begin() == region.end()) {
-    base::AddressRegion merged_region{region.begin(),
-                                      region.size() + dest_it->size()};
-    DCHECK_EQ(merged_region.end(), dest_it->end());
-    *dest_it = merged_region;
+base::AddressRegion DisjointAllocationPool::Merge(
+    base::AddressRegion new_region) {
+  // Find the possible insertion position by identifying the first region whose
+  // start address is not less than that of {new_region}. Since there cannot be
+  // any overlap between regions, this also means that the start of {above} is
+  // bigger or equal than the *end* of {new_region}.
+  auto above = regions_.lower_bound(new_region);
+  DCHECK(above == regions_.end() || above->begin() >= new_region.end());
+
+  // Check whether to merge with {above}.
+  if (above != regions_.end() && new_region.end() == above->begin()) {
+    base::AddressRegion merged_region{new_region.begin(),
+                                      new_region.size() + above->size()};
+    DCHECK_EQ(merged_region.end(), above->end());
+    // Check whether to also merge with the region below.
+    if (above != regions_.begin()) {
+      auto below = above;
+      --below;
+      if (below->end() == new_region.begin()) {
+        merged_region = {below->begin(), below->size() + merged_region.size()};
+        regions_.erase(below);
+      }
+    }
+    auto insert_pos = regions_.erase(above);
+    regions_.insert(insert_pos, merged_region);
     return merged_region;
   }
 
-  // Before dest: insert and done.
-  if (dest_it->begin() > region.end()) {
-    regions_.insert(dest_it, region);
-    return region;
+  // No element below, and not adjavent to {above}: insert and done.
+  if (above == regions_.begin()) {
+    regions_.insert(above, new_region);
+    return new_region;
   }
 
-  // Src is adjacent from above. Merge and check whether the merged region is
-  // now adjacent to the next region.
-  DCHECK_EQ(dest_it->end(), region.begin());
-  dest_it->set_size(dest_it->size() + region.size());
-  DCHECK_EQ(dest_it->end(), region.end());
-  auto next_dest = dest_it;
-  ++next_dest;
-  if (next_dest != dest_end && dest_it->end() == next_dest->begin()) {
-    dest_it->set_size(dest_it->size() + next_dest->size());
-    DCHECK_EQ(dest_it->end(), next_dest->end());
-    regions_.erase(next_dest);
+  auto below = above;
+  --below;
+  // Sanity check:
+  DCHECK(above == regions_.end() || below->end() < above->begin());
+
+  // Adjacent to {below}: merge and done.
+  if (below->end() == new_region.begin()) {
+    base::AddressRegion merged_region{below->begin(),
+                                      below->size() + new_region.size()};
+    DCHECK_EQ(merged_region.end(), new_region.end());
+    regions_.erase(below);
+    regions_.insert(above, merged_region);
+    return merged_region;
   }
-  return *dest_it;
+
+  // Not adjacent to any existing region: insert between {below} and {above}.
+  DCHECK_LT(below->end(), new_region.begin());
+  regions_.insert(above, new_region);
+  return new_region;
 }
 
 base::AddressRegion DisjointAllocationPool::Allocate(size_t size) {
@@ -96,24 +109,31 @@ base::AddressRegion DisjointAllocationPool::Allocate(size_t size) {
 
 base::AddressRegion DisjointAllocationPool::AllocateInRegion(
     size_t size, base::AddressRegion region) {
-  for (auto it = regions_.begin(), end = regions_.end(); it != end; ++it) {
+  // Get an iterator to the first contained region whose start address is not
+  // smaller than the start address of {region}. Start the search from the
+  // region one before that (the last one whose start address is smaller).
+  auto it = regions_.lower_bound(region);
+  if (it != regions_.begin()) --it;
+
+  for (auto end = regions_.end(); it != end; ++it) {
     base::AddressRegion overlap = it->GetOverlap(region);
     if (size > overlap.size()) continue;
     base::AddressRegion ret{overlap.begin(), size};
-    if (size == it->size()) {
-      // We use the full region --> erase the region from {regions_}.
-      regions_.erase(it);
-    } else if (ret.begin() == it->begin()) {
-      // We return a region at the start --> shrink remaining region from front.
-      *it = base::AddressRegion{it->begin() + size, it->size() - size};
-    } else if (ret.end() == it->end()) {
+    base::AddressRegion old = *it;
+    auto insert_pos = regions_.erase(it);
+    if (size == old.size()) {
+      // We use the full region --> nothing to add back.
+    } else if (ret.begin() == old.begin()) {
+      // We return a region at the start --> shrink old region from front.
+      regions_.insert(insert_pos, {old.begin() + size, old.size() - size});
+    } else if (ret.end() == old.end()) {
       // We return a region at the end --> shrink remaining region.
-      *it = base::AddressRegion{it->begin(), it->size() - size};
+      regions_.insert(insert_pos, {old.begin(), old.size() - size});
     } else {
-      // We return something in the middle --> split the remaining region.
-      regions_.insert(
-          it, base::AddressRegion{it->begin(), ret.begin() - it->begin()});
-      *it = base::AddressRegion{ret.end(), it->end() - ret.end()};
+      // We return something in the middle --> split the remaining region
+      // (insert the region with smaller address first).
+      regions_.insert(insert_pos, {old.begin(), ret.begin() - old.begin()});
+      regions_.insert(insert_pos, {ret.end(), old.end() - ret.end()});
     }
     return ret;
   }
@@ -195,24 +215,31 @@ void WasmCode::LogCode(Isolate* isolate) const {
   if (IsAnonymous()) return;
 
   ModuleWireBytes wire_bytes(native_module()->wire_bytes());
-  WireBytesRef name_ref = native_module()->module()->function_names.Lookup(
-      wire_bytes, index(), VectorOf(native_module()->module()->export_table));
+  WireBytesRef name_ref =
+      native_module()->module()->lazily_generated_names.LookupFunctionName(
+          wire_bytes, index(),
+          VectorOf(native_module()->module()->export_table));
   WasmName name = wire_bytes.GetNameOrNull(name_ref);
 
-  const std::string& source_map_url = native_module()->module()->source_map_url;
+  const WasmDebugSymbols& debug_symbols =
+      native_module()->module()->debug_symbols;
   auto load_wasm_source_map = isolate->wasm_load_source_map_callback();
   auto source_map = native_module()->GetWasmSourceMap();
-  if (!source_map && !source_map_url.empty() && load_wasm_source_map) {
+  if (!source_map && debug_symbols.type == WasmDebugSymbols::Type::SourceMap &&
+      !debug_symbols.external_url.is_empty() && load_wasm_source_map) {
+    WasmName external_url =
+        wire_bytes.GetNameOrNull(debug_symbols.external_url);
+    std::string external_url_string(external_url.data(), external_url.size());
     HandleScope scope(isolate);
     v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
     Local<v8::String> source_map_str =
-        load_wasm_source_map(v8_isolate, source_map_url.c_str());
+        load_wasm_source_map(v8_isolate, external_url_string.c_str());
     native_module()->SetWasmSourceMap(
         std::make_unique<WasmModuleSourceMap>(v8_isolate, source_map_str));
   }
 
   std::string name_buffer;
-  if (kind_ == kWasmToJsWrapper) {
+  if (kind() == kWasmToJsWrapper) {
     name_buffer = "wasm-to-js:";
     size_t prefix_len = name_buffer.size();
     constexpr size_t kMaxSigLength = 128;
@@ -245,6 +272,8 @@ void WasmCode::LogCode(Isolate* isolate) const {
 
 void WasmCode::Validate() const {
 #ifdef DEBUG
+  // Scope for foreign WasmCode pointers.
+  WasmCodeRefScope code_ref_scope;
   // We expect certain relocation info modes to never appear in {WasmCode}
   // objects or to be restricted to a small set of valid values. Hence the
   // iteration below does not use a mask, but visits all relocation data.
@@ -298,6 +327,12 @@ void WasmCode::Print(const char* name) const {
   StdoutStream os;
   os << "--- WebAssembly code ---\n";
   Disassemble(name, os);
+  if (native_module_->HasDebugInfo()) {
+    if (auto* debug_side_table =
+            native_module_->GetDebugInfo()->GetDebugSideTableIfExists(this)) {
+      debug_side_table->Print(os);
+    }
+  }
   os << "--- End code ---\n";
 }
 
@@ -305,7 +340,7 @@ void WasmCode::Disassemble(const char* name, std::ostream& os,
                            Address current_pc) const {
   if (name) os << "name: " << name << "\n";
   if (!IsAnonymous()) os << "index: " << index() << "\n";
-  os << "kind: " << GetWasmCodeKindAsString(kind_) << "\n";
+  os << "kind: " << GetWasmCodeKindAsString(kind()) << "\n";
   os << "compiler: " << (is_liftoff() ? "Liftoff" : "TurboFan") << "\n";
   size_t padding = instructions().size() - unpadded_binary_size_;
   os << "Body (size = " << instructions().size() << " = "
@@ -401,8 +436,6 @@ const char* GetWasmCodeKindAsString(WasmCode::Kind kind) {
       return "wasm-to-capi";
     case WasmCode::kWasmToJsWrapper:
       return "wasm-to-js";
-    case WasmCode::kInterpreterEntry:
-      return "interpreter entry";
     case WasmCode::kJumpTable:
       return "jump table";
   }
@@ -444,6 +477,16 @@ void WasmCode::DecrementRefCount(Vector<WasmCode* const> code_vec) {
   if (engine) engine->FreeDeadCode(dead_code);
 }
 
+int WasmCode::GetSourcePositionBefore(int offset) {
+  int position = kNoSourcePosition;
+  for (SourcePositionTableIterator iterator(source_positions());
+       !iterator.done() && iterator.code_offset() < offset;
+       iterator.Advance()) {
+    position = iterator.source_position().ScriptOffset();
+  }
+  return position;
+}
+
 WasmCodeAllocator::OptionalLock::~OptionalLock() {
   if (allocator_) allocator_->mutex_.Unlock();
 }
@@ -800,10 +843,8 @@ void NativeModule::LogWasmCodes(Isolate* isolate) {
 }
 
 CompilationEnv NativeModule::CreateCompilationEnv() const {
-  // Protect concurrent accesses to {tier_down_}.
-  base::MutexGuard guard(&allocation_mutex_);
-  return {module(),          use_trap_handler_, kRuntimeExceptionSupport,
-          enabled_features_, kNoLowerSimd,      tier_down_};
+  return {module(), use_trap_handler_, kRuntimeExceptionSupport,
+          enabled_features_, kNoLowerSimd};
 }
 
 WasmCode* NativeModule::AddCodeForTesting(Handle<Code> code) {
@@ -886,8 +927,9 @@ WasmCode* NativeModule::AddCodeForTesting(Handle<Code> code) {
                    reloc_info.as_vector(),  // reloc_info
                    source_pos.as_vector(),  // source positions
                    WasmCode::kFunction,     // kind
-                   ExecutionTier::kNone}};  // tier
-  new_code->MaybePrint(nullptr);
+                   ExecutionTier::kNone,    // tier
+                   kNoDebugging}};          // for_debugging
+  new_code->MaybePrint();
   new_code->Validate();
 
   return PublishCode(std::move(new_code));
@@ -932,23 +974,23 @@ std::unique_ptr<WasmCode> NativeModule::AddCode(
     int index, const CodeDesc& desc, int stack_slots,
     int tagged_parameter_slots, Vector<const byte> protected_instructions_data,
     Vector<const byte> source_position_table, WasmCode::Kind kind,
-    ExecutionTier tier) {
+    ExecutionTier tier, ForDebugging for_debugging) {
   Vector<byte> code_space =
       code_allocator_.AllocateForCode(this, desc.instr_size);
   auto jump_table_ref =
       FindJumpTablesForRegion(base::AddressRegionOf(code_space));
   return AddCodeWithCodeSpace(index, desc, stack_slots, tagged_parameter_slots,
                               protected_instructions_data,
-                              source_position_table, kind, tier, code_space,
-                              jump_table_ref);
+                              source_position_table, kind, tier, for_debugging,
+                              code_space, jump_table_ref);
 }
 
 std::unique_ptr<WasmCode> NativeModule::AddCodeWithCodeSpace(
     int index, const CodeDesc& desc, int stack_slots,
     int tagged_parameter_slots, Vector<const byte> protected_instructions_data,
     Vector<const byte> source_position_table, WasmCode::Kind kind,
-    ExecutionTier tier, Vector<uint8_t> dst_code_bytes,
-    const JumpTablesRef& jump_tables) {
+    ExecutionTier tier, ForDebugging for_debugging,
+    Vector<uint8_t> dst_code_bytes, const JumpTablesRef& jump_tables) {
   Vector<byte> reloc_info{desc.buffer + desc.buffer_size - desc.reloc_size,
                           static_cast<size_t>(desc.reloc_size)};
 
@@ -998,7 +1040,7 @@ std::unique_ptr<WasmCode> NativeModule::AddCodeWithCodeSpace(
       this, index, dst_code_bytes, stack_slots, tagged_parameter_slots,
       safepoint_table_offset, handler_table_offset, constant_pool_offset,
       code_comments_offset, instr_size, protected_instructions_data, reloc_info,
-      source_position_table, kind, tier}};
+      source_position_table, kind, tier, for_debugging}};
   code->MaybePrint();
   code->Validate();
 
@@ -1010,12 +1052,22 @@ WasmCode* NativeModule::PublishCode(std::unique_ptr<WasmCode> code) {
   return PublishCodeLocked(std::move(code));
 }
 
+std::vector<WasmCode*> NativeModule::PublishCode(
+    Vector<std::unique_ptr<WasmCode>> codes) {
+  std::vector<WasmCode*> published_code;
+  published_code.reserve(codes.size());
+  base::MutexGuard lock(&allocation_mutex_);
+  // The published code is put into the top-most surrounding {WasmCodeRefScope}.
+  for (auto& code : codes) {
+    published_code.push_back(PublishCodeLocked(std::move(code)));
+  }
+  return published_code;
+}
+
 WasmCode::Kind GetCodeKind(const WasmCompilationResult& result) {
   switch (result.kind) {
     case WasmCompilationResult::kWasmToJsWrapper:
       return WasmCode::Kind::kWasmToJsWrapper;
-    case WasmCompilationResult::kInterpreterEntry:
-      return WasmCode::Kind::kInterpreterEntry;
     case WasmCompilationResult::kFunction:
       return WasmCode::Kind::kFunction;
     default:
@@ -1040,16 +1092,16 @@ WasmCode* NativeModule::PublishCodeLocked(std::unique_ptr<WasmCode> code) {
                       ExecutionTier::kLiftoff < ExecutionTier::kTurbofan,
                   "Assume an order on execution tiers");
 
-    // Unless tier down to Liftoff: update code table but avoid to fall back to
-    // less optimized code. We use the new code if it was compiled with a higher
-    // tier.
     uint32_t slot_idx = declared_function_index(module(), code->index());
     WasmCode* prior_code = code_table_[slot_idx];
-    // TODO(clemensb): Revisit this logic once tier down is fully working.
-    const bool prefer_liftoff = tier_down_ || debug_info_;
+    // If we are tiered down, install all debugging code (except for stepping
+    // code, which is only used for a single frame and never installed in the
+    // code table of jump table). Otherwise, install code if it was compiled
+    // with a higher tier.
     const bool update_code_table =
-        prefer_liftoff ? !prior_code || code->tier() == ExecutionTier::kLiftoff
-                       : !prior_code || prior_code->tier() < code->tier();
+        tiering_state_ == kTieredDown
+            ? !prior_code || code->for_debugging() == kForDebugging
+            : !prior_code || prior_code->tier() < code->tier();
     if (update_code_table) {
       code_table_[slot_idx] = code.get();
       if (prior_code) {
@@ -1058,21 +1110,7 @@ WasmCode* NativeModule::PublishCodeLocked(std::unique_ptr<WasmCode> code) {
         // count cannot drop to zero here.
         CHECK(!prior_code->DecRef());
       }
-    }
-
-    // Populate optimized code to the jump table unless there is an active
-    // redirection to the interpreter that should be preserved.
-    DCHECK_NOT_NULL(main_jump_table_);
-    bool update_jump_table =
-        update_code_table && !has_interpreter_redirection(code->index());
-
-    // Ensure that interpreter entries always populate to the jump table.
-    if (code->kind_ == WasmCode::Kind::kInterpreterEntry) {
-      SetInterpreterRedirection(code->index());
-      update_jump_table = true;
-    }
 
-    if (update_jump_table) {
       PatchJumpTablesLocked(slot_idx, code->instruction_start());
     }
   }
@@ -1098,7 +1136,7 @@ WasmCode* NativeModule::AddDeserializedCode(
       this, index, dst_code_bytes, stack_slots, tagged_parameter_slots,
       safepoint_table_offset, handler_table_offset, constant_pool_offset,
       code_comments_offset, unpadded_binary_size, protected_instructions_data,
-      reloc_info, source_position_table, kind, tier}};
+      reloc_info, source_position_table, kind, tier, kNoDebugging}};
 
   // Note: we do not flush the i-cache here, since the code needs to be
   // relocated anyway. The caller is responsible for flushing the i-cache later.
@@ -1150,21 +1188,22 @@ WasmCode* NativeModule::CreateEmptyJumpTableInRegion(
   DCHECK(!code_space.empty());
   ZapCode(reinterpret_cast<Address>(code_space.begin()), code_space.size());
   std::unique_ptr<WasmCode> code{
-      new WasmCode{this,                    // native_module
-                   kAnonymousFuncIndex,     // index
-                   code_space,              // instructions
-                   0,                       // stack_slots
-                   0,                       // tagged_parameter_slots
-                   0,                       // safepoint_table_offset
-                   jump_table_size,         // handler_table_offset
-                   jump_table_size,         // constant_pool_offset
-                   jump_table_size,         // code_comments_offset
-                   jump_table_size,         // unpadded_binary_size
-                   {},                      // protected_instructions
-                   {},                      // reloc_info
-                   {},                      // source_pos
-                   WasmCode::kJumpTable,    // kind
-                   ExecutionTier::kNone}};  // tier
+      new WasmCode{this,                  // native_module
+                   kAnonymousFuncIndex,   // index
+                   code_space,            // instructions
+                   0,                     // stack_slots
+                   0,                     // tagged_parameter_slots
+                   0,                     // safepoint_table_offset
+                   jump_table_size,       // handler_table_offset
+                   jump_table_size,       // constant_pool_offset
+                   jump_table_size,       // code_comments_offset
+                   jump_table_size,       // unpadded_binary_size
+                   {},                    // protected_instructions
+                   {},                    // reloc_info
+                   {},                    // source_pos
+                   WasmCode::kJumpTable,  // kind
+                   ExecutionTier::kNone,  // tier
+                   kNoDebugging}};        // for_debugging
   return PublishCode(std::move(code));
 }
 
@@ -1452,22 +1491,6 @@ WasmCode::RuntimeStubId NativeModule::GetRuntimeStubId(Address target) const {
   return WasmCode::kRuntimeStubCount;
 }
 
-const char* NativeModule::GetRuntimeStubName(Address target) const {
-  WasmCode::RuntimeStubId stub_id = GetRuntimeStubId(target);
-
-#define RUNTIME_STUB_NAME(Name) #Name,
-#define RUNTIME_STUB_NAME_TRAP(Name) "ThrowWasm" #Name,
-  constexpr const char* runtime_stub_names[] = {WASM_RUNTIME_STUB_LIST(
-      RUNTIME_STUB_NAME, RUNTIME_STUB_NAME_TRAP) "<unknown>"};
-#undef RUNTIME_STUB_NAME
-#undef RUNTIME_STUB_NAME_TRAP
-  STATIC_ASSERT(arraysize(runtime_stub_names) ==
-                WasmCode::kRuntimeStubCount + 1);
-
-  DCHECK_GT(arraysize(runtime_stub_names), stub_id);
-  return runtime_stub_names[stub_id];
-}
-
 NativeModule::~NativeModule() {
   TRACE_HEAP("Deleting native module: %p\n", this);
   // Cancel all background compilation before resetting any field of the
@@ -1779,11 +1802,13 @@ void NativeModule::SampleCodeSize(
   histogram->AddSample(code_size_mb);
 }
 
-WasmCode* NativeModule::AddCompiledCode(WasmCompilationResult result) {
-  return AddCompiledCode({&result, 1})[0];
+std::unique_ptr<WasmCode> NativeModule::AddCompiledCode(
+    WasmCompilationResult result) {
+  std::vector<std::unique_ptr<WasmCode>> code = AddCompiledCode({&result, 1});
+  return std::move(code[0]);
 }
 
-std::vector<WasmCode*> NativeModule::AddCompiledCode(
+std::vector<std::unique_ptr<WasmCode>> NativeModule::AddCompiledCode(
     Vector<WasmCompilationResult> results) {
   DCHECK(!results.empty());
   // First, allocate code space for all the results.
@@ -1811,68 +1836,54 @@ std::vector<WasmCode*> NativeModule::AddCompiledCode(
         result.tagged_parameter_slots,
         result.protected_instructions_data.as_vector(),
         result.source_positions.as_vector(), GetCodeKind(result),
-        result.result_tier, this_code_space, jump_tables));
+        result.result_tier, result.for_debugging, this_code_space,
+        jump_tables));
   }
   DCHECK_EQ(0, code_space.size());
 
-  // Under the {allocation_mutex_}, publish the code. The published code is put
-  // into the top-most surrounding {WasmCodeRefScope} by {PublishCodeLocked}.
-  std::vector<WasmCode*> code_vector;
-  code_vector.reserve(results.size());
-  {
-    base::MutexGuard lock(&allocation_mutex_);
-    for (auto& result : generated_code)
-      code_vector.push_back(PublishCodeLocked(std::move(result)));
-  }
-
-  return code_vector;
+  return generated_code;
 }
 
-bool NativeModule::IsRedirectedToInterpreter(uint32_t func_index) {
-  base::MutexGuard lock(&allocation_mutex_);
-  return has_interpreter_redirection(func_index);
-}
-
-bool NativeModule::SetTieredDown() {
-  // Do not tier down asm.js.
-  if (module()->origin != kWasmOrigin) return false;
+void NativeModule::SetTieringState(TieringState new_tiering_state) {
+  // Do not tier down asm.js (just never change the tiering state).
+  if (module()->origin != kWasmOrigin) return;
 
   base::MutexGuard lock(&allocation_mutex_);
-  if (tier_down_) return true;
-  tier_down_ = true;
-  return false;
+  tiering_state_ = new_tiering_state;
 }
 
 bool NativeModule::IsTieredDown() {
   base::MutexGuard lock(&allocation_mutex_);
-  return tier_down_;
+  return tiering_state_ == kTieredDown;
 }
 
-void NativeModule::TierDown(Isolate* isolate) {
-  // Do not tier down asm.js.
-  if (module()->origin != kWasmOrigin) return;
-
-  // Set the flag. Return if it is already set.
-  if (SetTieredDown()) return;
-
-  // Tier down all functions.
-  isolate->wasm_engine()->RecompileAllFunctions(isolate, this,
-                                                ExecutionTier::kLiftoff);
-}
-
-void NativeModule::TierUp(Isolate* isolate) {
-  // Do not tier up asm.js.
-  if (module()->origin != kWasmOrigin) return;
-
-  // Set the flag.
+void NativeModule::TriggerRecompilation() {
+  // Read the tiering state under the lock, then trigger recompilation after
+  // releasing the lock. If the tiering state was changed when the triggered
+  // compilation units finish, code installation will handle that correctly.
+  TieringState current_state;
   {
     base::MutexGuard lock(&allocation_mutex_);
-    tier_down_ = false;
+    current_state = tiering_state_;
   }
+  RecompileNativeModule(this, current_state);
+}
 
-  // Tier up all functions.
-  isolate->wasm_engine()->RecompileAllFunctions(isolate, this,
-                                                ExecutionTier::kTurbofan);
+std::vector<int> NativeModule::FindFunctionsToRecompile(
+    TieringState new_tiering_state) {
+  base::MutexGuard guard(&allocation_mutex_);
+  std::vector<int> function_indexes;
+  int imported = module()->num_imported_functions;
+  int declared = module()->num_declared_functions;
+  for (int slot_index = 0; slot_index < declared; ++slot_index) {
+    int function_index = imported + slot_index;
+    WasmCode* code = code_table_[slot_index];
+    bool code_is_good = new_tiering_state == kTieredDown
+                            ? code && code->for_debugging()
+                            : code && code->tier() == ExecutionTier::kTurbofan;
+    if (!code_is_good) function_indexes.push_back(function_index);
+  }
+  return function_indexes;
 }
 
 void NativeModule::FreeCode(Vector<WasmCode* const> codes) {
@@ -1893,6 +1904,11 @@ size_t NativeModule::GetNumberOfCodeSpacesForTesting() const {
   return code_allocator_.GetNumCodeSpaces();
 }
 
+bool NativeModule::HasDebugInfo() const {
+  base::MutexGuard guard(&allocation_mutex_);
+  return debug_info_ != nullptr;
+}
+
 DebugInfo* NativeModule::GetDebugInfo() {
   base::MutexGuard guard(&allocation_mutex_);
   if (!debug_info_) debug_info_ = std::make_unique<DebugInfo>(this);
@@ -1998,6 +2014,20 @@ void WasmCodeRefScope::AddRef(WasmCode* code) {
   if (entry.second) code->IncRef();
 }
 
+const char* GetRuntimeStubName(WasmCode::RuntimeStubId stub_id) {
+#define RUNTIME_STUB_NAME(Name) #Name,
+#define RUNTIME_STUB_NAME_TRAP(Name) "ThrowWasm" #Name,
+  constexpr const char* runtime_stub_names[] = {WASM_RUNTIME_STUB_LIST(
+      RUNTIME_STUB_NAME, RUNTIME_STUB_NAME_TRAP) "<unknown>"};
+#undef RUNTIME_STUB_NAME
+#undef RUNTIME_STUB_NAME_TRAP
+  STATIC_ASSERT(arraysize(runtime_stub_names) ==
+                WasmCode::kRuntimeStubCount + 1);
+
+  DCHECK_GT(arraysize(runtime_stub_names), stub_id);
+  return runtime_stub_names[stub_id];
+}
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/wasm-code-manager.h b/deps/v8/src/wasm/wasm-code-manager.h
index 4b176f3ba61..2e16202236f 100644
--- a/deps/v8/src/wasm/wasm-code-manager.h
+++ b/deps/v8/src/wasm/wasm-code-manager.h
@@ -6,14 +6,15 @@
 #define V8_WASM_WASM_CODE_MANAGER_H_
 
 #include <atomic>
-#include <list>
 #include <map>
 #include <memory>
+#include <set>
 #include <unordered_set>
 #include <utility>
 #include <vector>
 
 #include "src/base/address-region.h"
+#include "src/base/bit-field.h"
 #include "src/base/macros.h"
 #include "src/base/optional.h"
 #include "src/builtins/builtins-definitions.h"
@@ -49,11 +50,18 @@ struct WasmModule;
   FOREACH_WASM_TRAPREASON(VTRAP)         \
   V(WasmCompileLazy)                     \
   V(WasmDebugBreak)                      \
+  V(WasmInt32ToHeapNumber)               \
+  V(WasmTaggedNonSmiToInt32)             \
+  V(WasmFloat32ToNumber)                 \
+  V(WasmFloat64ToNumber)                 \
+  V(WasmTaggedToFloat64)                 \
+  V(WasmAllocateJSArray)                 \
   V(WasmAtomicNotify)                    \
   V(WasmI32AtomicWait32)                 \
   V(WasmI32AtomicWait64)                 \
   V(WasmI64AtomicWait32)                 \
   V(WasmI64AtomicWait64)                 \
+  V(WasmRefFunc)                         \
   V(WasmMemoryGrow)                      \
   V(WasmTableInit)                       \
   V(WasmTableCopy)                       \
@@ -63,8 +71,8 @@ struct WasmModule;
   V(WasmStackOverflow)                   \
   V(WasmThrow)                           \
   V(WasmRethrow)                         \
+  V(WasmTraceEnter)                      \
   V(WasmTraceMemory)                     \
-  V(AllocateHeapNumber)                  \
   V(ArgumentsAdaptorTrampoline)          \
   V(BigIntToI32Pair)                     \
   V(BigIntToI64)                         \
@@ -83,10 +91,9 @@ class V8_EXPORT_PRIVATE DisjointAllocationPool final {
   explicit DisjointAllocationPool(base::AddressRegion region)
       : regions_({region}) {}
 
-  // Merge the parameter region into this object while preserving ordering of
-  // the regions. The assumption is that the passed parameter is not
-  // intersecting this object - for example, it was obtained from a previous
-  // Allocate. Returns the merged region.
+  // Merge the parameter region into this object. The assumption is that the
+  // passed parameter is not intersecting this object - for example, it was
+  // obtained from a previous Allocate. Returns the merged region.
   base::AddressRegion Merge(base::AddressRegion);
 
   // Allocate a contiguous region of size {size}. Return an empty pool on
@@ -98,10 +105,11 @@ class V8_EXPORT_PRIVATE DisjointAllocationPool final {
   base::AddressRegion AllocateInRegion(size_t size, base::AddressRegion);
 
   bool IsEmpty() const { return regions_.empty(); }
-  const std::list<base::AddressRegion>& regions() const { return regions_; }
+
+  const auto& regions() const { return regions_; }
 
  private:
-  std::list<base::AddressRegion> regions_;
+  std::set<base::AddressRegion, base::AddressRegion::StartAddressLess> regions_;
 };
 
 class V8_EXPORT_PRIVATE WasmCode final {
@@ -110,7 +118,6 @@ class V8_EXPORT_PRIVATE WasmCode final {
     kFunction,
     kWasmToCapiWrapper,
     kWasmToJsWrapper,
-    kInterpreterEntry,
     kJumpTable
   };
 
@@ -125,9 +132,11 @@ class V8_EXPORT_PRIVATE WasmCode final {
         kRuntimeStubCount
   };
 
-  Vector<byte> instructions() const { return instructions_; }
+  Vector<byte> instructions() const {
+    return VectorOf(instructions_, static_cast<size_t>(instructions_size_));
+  }
   Address instruction_start() const {
-    return reinterpret_cast<Address>(instructions_.begin());
+    return reinterpret_cast<Address>(instructions_);
   }
   Vector<const byte> reloc_info() const {
     return {protected_instructions_data().end(),
@@ -144,9 +153,9 @@ class V8_EXPORT_PRIVATE WasmCode final {
   }
   // Anonymous functions are functions that don't carry an index.
   bool IsAnonymous() const { return index_ == kAnonymousFuncIndex; }
-  Kind kind() const { return kind_; }
+  Kind kind() const { return KindField::decode(flags_); }
   NativeModule* native_module() const { return native_module_; }
-  ExecutionTier tier() const { return tier_; }
+  ExecutionTier tier() const { return ExecutionTierField::decode(flags_); }
   Address constant_pool() const;
   Address handler_table() const;
   int handler_table_size() const;
@@ -159,12 +168,16 @@ class V8_EXPORT_PRIVATE WasmCode final {
   int unpadded_binary_size() const { return unpadded_binary_size_; }
   int stack_slots() const { return stack_slots_; }
   int tagged_parameter_slots() const { return tagged_parameter_slots_; }
-  bool is_liftoff() const { return tier_ == ExecutionTier::kLiftoff; }
+  bool is_liftoff() const { return tier() == ExecutionTier::kLiftoff; }
   bool contains(Address pc) const {
-    return reinterpret_cast<Address>(instructions_.begin()) <= pc &&
-           pc < reinterpret_cast<Address>(instructions_.end());
+    return reinterpret_cast<Address>(instructions_) <= pc &&
+           pc < reinterpret_cast<Address>(instructions_ + instructions_size_);
   }
 
+  // Only Liftoff code that was generated for debugging can be inspected
+  // (otherwise debug side table positions would not match up).
+  bool is_inspectable() const { return is_liftoff() && for_debugging(); }
+
   Vector<const uint8_t> protected_instructions_data() const {
     return {meta_data_.get(),
             static_cast<size_t>(protected_instructions_size_)};
@@ -219,6 +232,16 @@ class V8_EXPORT_PRIVATE WasmCode final {
   // belonging to different {NativeModule}s. Dead code will be deleted.
   static void DecrementRefCount(Vector<WasmCode* const>);
 
+  // Returns the last source position before {offset}.
+  int GetSourcePositionBefore(int offset);
+
+  // Returns whether this code was generated for debugging. If this returns
+  // {kForDebugging}, but {tier()} is not {kLiftoff}, then Liftoff compilation
+  // bailed out.
+  ForDebugging for_debugging() const {
+    return ForDebuggingField::decode(flags_);
+  }
+
   enum FlushICache : bool { kFlushICache = true, kNoFlushICache = false };
 
  private:
@@ -232,24 +255,25 @@ class V8_EXPORT_PRIVATE WasmCode final {
            Vector<const byte> protected_instructions_data,
            Vector<const byte> reloc_info,
            Vector<const byte> source_position_table, Kind kind,
-           ExecutionTier tier)
-      : instructions_(instructions),
-        native_module_(native_module),
+           ExecutionTier tier, ForDebugging for_debugging)
+      : native_module_(native_module),
+        instructions_(instructions.begin()),
+        flags_(KindField::encode(kind) | ExecutionTierField::encode(tier) |
+               ForDebuggingField::encode(for_debugging)),
         meta_data_(ConcatenateBytes(
             {protected_instructions_data, reloc_info, source_position_table})),
+        instructions_size_(instructions.length()),
         reloc_info_size_(reloc_info.length()),
         source_positions_size_(source_position_table.length()),
         protected_instructions_size_(protected_instructions_data.length()),
         index_(index),
-        kind_(kind),
         constant_pool_offset_(constant_pool_offset),
         stack_slots_(stack_slots),
         tagged_parameter_slots_(tagged_parameter_slots),
         safepoint_table_offset_(safepoint_table_offset),
         handler_table_offset_(handler_table_offset),
         code_comments_offset_(code_comments_offset),
-        unpadded_binary_size_(unpadded_binary_size),
-        tier_(tier) {
+        unpadded_binary_size_(unpadded_binary_size) {
     DCHECK_LE(safepoint_table_offset, unpadded_binary_size);
     DCHECK_LE(handler_table_offset, unpadded_binary_size);
     DCHECK_LE(code_comments_offset, unpadded_binary_size);
@@ -279,32 +303,37 @@ class V8_EXPORT_PRIVATE WasmCode final {
   // Returns whether this code becomes dead and needs to be freed.
   V8_NOINLINE bool DecRefOnPotentiallyDeadCode();
 
-  Vector<byte> instructions_;
-  NativeModule* native_module_ = nullptr;
+  NativeModule* const native_module_ = nullptr;
+  byte* const instructions_;
+  const uint8_t flags_;  // Bit field, see below.
   // {meta_data_} contains several byte vectors concatenated into one:
   //  - protected instructions data of size {protected_instructions_size_}
   //  - relocation info of size {reloc_info_size_}
   //  - source positions of size {source_positions_size_}
   // Note that the protected instructions come first to ensure alignment.
   std::unique_ptr<const byte[]> meta_data_;
+  const int instructions_size_;
   const int reloc_info_size_;
   const int source_positions_size_;
   const int protected_instructions_size_;
-  int index_;
-  Kind kind_;
-  int constant_pool_offset_ = 0;
-  int stack_slots_ = 0;
+  const int index_;
+  const int constant_pool_offset_;
+  const int stack_slots_;
   // Number of tagged parameters passed to this function via the stack. This
   // value is used by the stack walker (e.g. GC) to find references.
-  int tagged_parameter_slots_ = 0;
+  const int tagged_parameter_slots_;
   // We care about safepoint data for wasm-to-js functions, since there may be
   // stack/register tagged values for large number conversions.
-  int safepoint_table_offset_ = 0;
-  int handler_table_offset_ = 0;
-  int code_comments_offset_ = 0;
-  int unpadded_binary_size_ = 0;
+  const int safepoint_table_offset_;
+  const int handler_table_offset_;
+  const int code_comments_offset_;
+  const int unpadded_binary_size_;
   int trap_handler_index_ = -1;
-  ExecutionTier tier_;
+
+  // Bits encoded in {flags_}:
+  using KindField = base::BitField8<Kind, 0, 3>;
+  using ExecutionTierField = KindField::Next<ExecutionTier, 2>;
+  using ForDebuggingField = ExecutionTierField::Next<ForDebugging, 2>;
 
   // WasmCode is ref counted. Counters are held by:
   //   1) The jump table / code table.
@@ -325,7 +354,7 @@ class V8_EXPORT_PRIVATE WasmCode final {
 // often for rather small functions.
 // Increase the limit if needed, but first check if the size increase is
 // justified.
-STATIC_ASSERT(sizeof(WasmCode) <= 96);
+STATIC_ASSERT(sizeof(WasmCode) <= 88);
 
 WasmCode::Kind GetCodeKind(const WasmCompilationResult& result);
 
@@ -436,14 +465,14 @@ class V8_EXPORT_PRIVATE NativeModule final {
                                     int stack_slots, int tagged_parameter_slots,
                                     Vector<const byte> protected_instructions,
                                     Vector<const byte> source_position_table,
-                                    WasmCode::Kind kind, ExecutionTier tier);
+                                    WasmCode::Kind kind, ExecutionTier tier,
+                                    ForDebugging for_debugging);
 
   // {PublishCode} makes the code available to the system by entering it into
   // the code table and patching the jump table. It returns a raw pointer to the
-  // given {WasmCode} object.
+  // given {WasmCode} object. Ownership is transferred to the {NativeModule}.
   WasmCode* PublishCode(std::unique_ptr<WasmCode>);
-  // Hold the {allocation_mutex_} when calling {PublishCodeLocked}.
-  WasmCode* PublishCodeLocked(std::unique_ptr<WasmCode>);
+  std::vector<WasmCode*> PublishCode(Vector<std::unique_ptr<WasmCode>>);
 
   WasmCode* AddDeserializedCode(
       int index, Vector<const byte> instructions, int stack_slots,
@@ -561,27 +590,34 @@ class V8_EXPORT_PRIVATE NativeModule final {
   // must be a far jump table slot). Returns {kRuntimeStubCount} on failure.
   WasmCode::RuntimeStubId GetRuntimeStubId(Address runtime_stub_target) const;
 
-  const char* GetRuntimeStubName(Address runtime_stub_target) const;
-
   // Sample the current code size of this modules to the given counters.
   enum CodeSamplingTime : int8_t { kAfterBaseline, kAfterTopTier, kSampling };
   void SampleCodeSize(Counters*, CodeSamplingTime) const;
 
-  WasmCode* AddCompiledCode(WasmCompilationResult);
-  std::vector<WasmCode*> AddCompiledCode(Vector<WasmCompilationResult>);
+  V8_WARN_UNUSED_RESULT std::unique_ptr<WasmCode> AddCompiledCode(
+      WasmCompilationResult);
+  V8_WARN_UNUSED_RESULT std::vector<std::unique_ptr<WasmCode>> AddCompiledCode(
+      Vector<WasmCompilationResult>);
 
-  // Allows to check whether a function has been redirected to the interpreter
-  // by publishing an entry stub with the {Kind::kInterpreterEntry} code kind.
-  bool IsRedirectedToInterpreter(uint32_t func_index);
+  // Set a new tiering state, but don't trigger any recompilation yet; use
+  // {TriggerRecompilation} for that. The two steps are split because In some
+  // scenarios we need to drop locks before triggering recompilation.
+  void SetTieringState(TieringState);
 
-  // Set {tier_down_} flag. Return previous state.
-  bool SetTieredDown();
+  // Check whether this modules is tiered down for debugging.
   bool IsTieredDown();
 
-  // Sets the flag, triggers recompilation of all methods to tier down or up,
-  // waits for that to complete.
-  void TierDown(Isolate* isolate);
-  void TierUp(Isolate* isolate);
+  // Trigger a full recompilation of this module, in the tier set previously via
+  // {SetTieringState}. When tiering down, the calling thread contributes to
+  // compilation and only returns once recompilation is done. Tiering up happens
+  // concurrently, so this method might return before it is complete.
+  void TriggerRecompilation();
+
+  // Find all functions that need to be recompiled for a new tier. Note that
+  // compilation jobs might run concurrently, so this method only considers the
+  // compilation state of this native module at the time of the call.
+  // Returns a vector of function indexes to recompile.
+  std::vector<int> FindFunctionsToRecompile(TieringState);
 
   // Free a set of functions of this module. Uncommits whole pages if possible.
   // The given vector must be ordered by the instruction start address, and all
@@ -593,6 +629,9 @@ class V8_EXPORT_PRIVATE NativeModule final {
   // Retrieve the number of separately reserved code spaces for this module.
   size_t GetNumberOfCodeSpacesForTesting() const;
 
+  // Check whether there is DebugInfo for this NativeModule.
+  bool HasDebugInfo() const;
+
   // Get or create the debug info for this NativeModule.
   DebugInfo* GetDebugInfo();
 
@@ -620,8 +659,8 @@ class V8_EXPORT_PRIVATE NativeModule final {
       int tagged_parameter_slots,
       Vector<const byte> protected_instructions_data,
       Vector<const byte> source_position_table, WasmCode::Kind kind,
-      ExecutionTier tier, Vector<uint8_t> code_space,
-      const JumpTablesRef& jump_tables_ref);
+      ExecutionTier tier, ForDebugging for_debugging,
+      Vector<uint8_t> code_space, const JumpTablesRef& jump_tables_ref);
 
   WasmCode* CreateEmptyJumpTableInRegion(
       int jump_table_size, base::AddressRegion,
@@ -638,29 +677,8 @@ class V8_EXPORT_PRIVATE NativeModule final {
   void AddCodeSpace(base::AddressRegion,
                     const WasmCodeAllocator::OptionalLock&);
 
-  // Hold the {allocation_mutex_} when calling this method.
-  bool has_interpreter_redirection(uint32_t func_index) {
-    DCHECK_LT(func_index, num_functions());
-    DCHECK_LE(module_->num_imported_functions, func_index);
-    if (!interpreter_redirections_) return false;
-    uint32_t bitset_idx = declared_function_index(module(), func_index);
-    uint8_t byte = interpreter_redirections_[bitset_idx / kBitsPerByte];
-    return byte & (1 << (bitset_idx % kBitsPerByte));
-  }
-
-  // Hold the {allocation_mutex_} when calling this method.
-  void SetInterpreterRedirection(uint32_t func_index) {
-    DCHECK_LT(func_index, num_functions());
-    DCHECK_LE(module_->num_imported_functions, func_index);
-    if (!interpreter_redirections_) {
-      interpreter_redirections_.reset(
-          new uint8_t[RoundUp<kBitsPerByte>(module_->num_declared_functions) /
-                      kBitsPerByte]{});
-    }
-    uint32_t bitset_idx = declared_function_index(module(), func_index);
-    uint8_t& byte = interpreter_redirections_[bitset_idx / kBitsPerByte];
-    byte |= 1 << (bitset_idx % kBitsPerByte);
-  }
+  // Hold the {allocation_mutex_} when calling {PublishCodeLocked}.
+  WasmCode* PublishCodeLocked(std::unique_ptr<WasmCode>);
 
   // {WasmCodeAllocator} manages all code reservations and allocations for this
   // {NativeModule}.
@@ -717,10 +735,6 @@ class V8_EXPORT_PRIVATE NativeModule final {
   // imported functions.
   std::unique_ptr<WasmCode*[]> code_table_;
 
-  // Null if no redirections exist, otherwise a bitset over all functions in
-  // this module marking those functions that have been redirected.
-  std::unique_ptr<uint8_t[]> interpreter_redirections_;
-
   // Data (especially jump table) per code space.
   std::vector<CodeSpaceData> code_space_data_;
 
@@ -730,7 +744,8 @@ class V8_EXPORT_PRIVATE NativeModule final {
   // mutex.
   std::unique_ptr<DebugInfo> debug_info_;
 
-  bool tier_down_ = false;
+  TieringState tiering_state_ = kTieredUp;
+
   // End of fields protected by {allocation_mutex_}.
   //////////////////////////////////////////////////////////////////////////////
 
@@ -881,6 +896,8 @@ class GlobalWasmCodeRef {
   DISALLOW_COPY_AND_ASSIGN(GlobalWasmCodeRef);
 };
 
+const char* GetRuntimeStubName(WasmCode::RuntimeStubId);
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/wasm-constants.h b/deps/v8/src/wasm/wasm-constants.h
index acce1eef677..793254b5d2a 100644
--- a/deps/v8/src/wasm/wasm-constants.h
+++ b/deps/v8/src/wasm/wasm-constants.h
@@ -29,10 +29,19 @@ enum ValueTypeCode : uint8_t {
   kLocalFuncRef = 0x70,
   kLocalAnyRef = 0x6f,
   kLocalNullRef = 0x6e,
+  kLocalRef = 0x6d,     // GC proposal
+  kLocalOptRef = 0x6c,  // GC proposal
+  kLocalEqRef = 0x6b,   // GC proposal
+  kLocalI31Ref = 0x6a,  // GC proposal
+  kLocalRttRef = 0x69,  // GC proposal
   kLocalExnRef = 0x68,
+  kLocalI8 = 0x7a,  // GC proposal
+  kLocalI16 = 0x79  // GC proposal
 };
 // Binary encoding of other types.
 constexpr uint8_t kWasmFunctionTypeCode = 0x60;
+constexpr uint8_t kWasmStructTypeCode = 0x5f;
+constexpr uint8_t kWasmArrayTypeCode = 0x5e;
 
 // Binary encoding of import/export kinds.
 enum ImportExportKindCode : uint8_t {
@@ -80,10 +89,11 @@ enum SectionCode : int8_t {
   // The following sections are custom sections, and are identified using a
   // string rather than an integer. Their enumeration values are not guaranteed
   // to be consistent.
-  kNameSectionCode,              // Name section (encoded as a string)
-  kSourceMappingURLSectionCode,  // Source Map URL section
-  kDebugInfoSectionCode,         // DWARF section .debug_info
-  kCompilationHintsSectionCode,  // Compilation hints section
+  kNameSectionCode,               // Name section (encoded as a string)
+  kSourceMappingURLSectionCode,   // Source Map URL section
+  kDebugInfoSectionCode,          // DWARF section .debug_info
+  kExternalDebugInfoSectionCode,  // Section encoding the external symbol path
+  kCompilationHintsSectionCode,   // Compilation hints section
 
   // Helper values
   kFirstSectionInModule = kTypeSectionCode,
diff --git a/deps/v8/src/wasm/wasm-debug-evaluate.cc b/deps/v8/src/wasm/wasm-debug-evaluate.cc
index 80f0b04e0e4..6f1810c06b1 100644
--- a/deps/v8/src/wasm/wasm-debug-evaluate.cc
+++ b/deps/v8/src/wasm/wasm-debug-evaluate.cc
@@ -5,15 +5,19 @@
 #include "src/wasm/wasm-debug-evaluate.h"
 
 #include <algorithm>
+#include <limits>
 
 #include "src/api/api-inl.h"
 #include "src/codegen/machine-type.h"
+#include "src/execution/frames-inl.h"
 #include "src/wasm/value-type.h"
 #include "src/wasm/wasm-arguments.h"
 #include "src/wasm/wasm-constants.h"
+#include "src/wasm/wasm-debug.h"
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-objects.h"
 #include "src/wasm/wasm-result.h"
+#include "src/wasm/wasm-value.h"
 
 namespace v8 {
 namespace internal {
@@ -76,7 +80,8 @@ static bool CheckRangeOutOfBounds(uint32_t offset, uint32_t size,
 
 class DebugEvaluatorProxy {
  public:
-  explicit DebugEvaluatorProxy(Isolate* isolate) : isolate_(isolate) {}
+  explicit DebugEvaluatorProxy(Isolate* isolate, StandardFrame* frame)
+      : isolate_(isolate), frame_(frame) {}
 
   static void GetMemoryTrampoline(
       const v8::FunctionCallbackInfo<v8::Value>& args) {
@@ -89,12 +94,13 @@ class DebugEvaluatorProxy {
     proxy.GetMemory(offset, size, result);
   }
 
+  // void __getMemory(uint32_t offset, uint32_t size, void* result);
   void GetMemory(uint32_t offset, uint32_t size, uint32_t result) {
     wasm::ScheduledErrorThrower thrower(isolate_, "debug evaluate proxy");
     // Check all overflows.
-    if (CheckRangeOutOfBounds(result, size, debuggee_->memory_size(),
+    if (CheckRangeOutOfBounds(offset, size, debuggee_->memory_size(),
                               &thrower) ||
-        CheckRangeOutOfBounds(offset, size, evaluator_->memory_size(),
+        CheckRangeOutOfBounds(result, size, evaluator_->memory_size(),
                               &thrower)) {
       return;
     }
@@ -103,17 +109,68 @@ class DebugEvaluatorProxy {
                 &debuggee_->memory_start()[offset], size);
   }
 
-  template <typename CallableT>
-  Handle<JSReceiver> WrapAsV8Function(CallableT callback) {
-    v8::Isolate* api_isolate = reinterpret_cast<v8::Isolate*>(isolate_);
-    v8::Local<v8::Context> context = api_isolate->GetCurrentContext();
-    std::string data;
-    v8::Local<v8::Function> func =
-        v8::Function::New(context, callback,
-                          v8::External::New(api_isolate, this))
-            .ToLocalChecked();
+  // void* __sbrk(intptr_t increment);
+  uint32_t Sbrk(uint32_t increment) {
+    if (increment > 0 && evaluator_->memory_size() <=
+                             std::numeric_limits<uint32_t>::max() - increment) {
+      Handle<WasmMemoryObject> memory(evaluator_->memory_object(), isolate_);
+      uint32_t new_pages =
+          (increment - 1 + wasm::kWasmPageSize) / wasm::kWasmPageSize;
+      WasmMemoryObject::Grow(isolate_, memory, new_pages);
+    }
+    return static_cast<uint32_t>(evaluator_->memory_size());
+  }
+
+  static void SbrkTrampoline(const v8::FunctionCallbackInfo<v8::Value>& args) {
+    auto& proxy = GetProxy(args);
+    uint32_t size = proxy.GetArgAsUInt32(args, 0);
 
-    return Utils::OpenHandle(*func);
+    uint32_t result = proxy.Sbrk(size);
+    args.GetReturnValue().Set(result);
+  }
+
+  template <typename T>
+  void write_result(const WasmValue& result, uint32_t result_offset) {
+    wasm::ScheduledErrorThrower thrower(isolate_, "debug evaluate proxy");
+    T val = result.to<T>();
+    static_assert(static_cast<uint32_t>(sizeof(T)) == sizeof(T),
+                  "Unexpected size");
+    if (CheckRangeOutOfBounds(result_offset, sizeof(T),
+                              evaluator_->memory_size(), &thrower)) {
+      return;
+    }
+    memcpy(&evaluator_->memory_start()[result_offset], &val, sizeof(T));
+  }
+
+  // void __getLocal(uint32_t local,  void* result);
+  void GetLocal(uint32_t local, uint32_t result_offset) {
+    WasmValue result = LoadLocalValue(local);
+
+    switch (result.type().kind()) {
+      case ValueType::kI32:
+        write_result<uint32_t>(result, result_offset);
+        break;
+      case ValueType::kI64:
+        write_result<int64_t>(result, result_offset);
+        break;
+      case ValueType::kF32:
+        write_result<float>(result, result_offset);
+        break;
+      case ValueType::kF64:
+        write_result<double>(result, result_offset);
+        break;
+      default:
+        UNIMPLEMENTED();
+    }
+  }
+
+  static void GetLocalTrampoline(
+      const v8::FunctionCallbackInfo<v8::Value>& args) {
+    auto& proxy = GetProxy(args);
+    uint32_t local = proxy.GetArgAsUInt32(args, 0);
+    uint32_t result = proxy.GetArgAsUInt32(args, 1);
+
+    proxy.GetLocal(local, result);
   }
 
   Handle<JSObject> CreateImports() {
@@ -121,14 +178,16 @@ class DebugEvaluatorProxy {
         isolate_->factory()->NewJSObject(isolate_->object_function());
     Handle<JSObject> import_module_obj =
         isolate_->factory()->NewJSObject(isolate_->object_function());
-    Object::SetProperty(isolate_, imports_obj,
-                        isolate_->factory()->empty_string(), import_module_obj)
+    Object::SetProperty(isolate_, imports_obj, V8String(isolate_, "env"),
+                        import_module_obj)
         .Assert();
 
-    Object::SetProperty(
-        isolate_, import_module_obj, V8String(isolate_, "__getMemory"),
-        WrapAsV8Function(DebugEvaluatorProxy::GetMemoryTrampoline))
-        .Assert();
+    AddImport(import_module_obj, "__getLocal",
+              DebugEvaluatorProxy::GetLocalTrampoline);
+    AddImport(import_module_obj, "__getMemory",
+              DebugEvaluatorProxy::GetMemoryTrampoline);
+    AddImport(import_module_obj, "__sbrk", DebugEvaluatorProxy::SbrkTrampoline);
+
     return imports_obj;
   }
 
@@ -139,6 +198,14 @@ class DebugEvaluatorProxy {
   }
 
  private:
+  WasmValue LoadLocalValue(uint32_t local) {
+    DCHECK(frame_->is_wasm());
+    wasm::DebugInfo* debug_info =
+        WasmFrame::cast(frame_)->native_module()->GetDebugInfo();
+    return debug_info->GetLocalValue(local, frame_->pc(), frame_->fp(),
+                                     frame_->callee_fp());
+  }
+
   uint32_t GetArgAsUInt32(const v8::FunctionCallbackInfo<v8::Value>& args,
                           int index) {
     // No type/range checks needed on his because this is only called for {args}
@@ -153,7 +220,26 @@ class DebugEvaluatorProxy {
         args.Data().As<v8::External>()->Value());
   }
 
+  template <typename CallableT>
+  void AddImport(Handle<JSObject> import_module_obj, const char* function_name,
+                 CallableT callback) {
+    v8::Isolate* api_isolate = reinterpret_cast<v8::Isolate*>(isolate_);
+    v8::Local<v8::Context> context = api_isolate->GetCurrentContext();
+    std::string data;
+    v8::Local<v8::Function> v8_function =
+        v8::Function::New(context, callback,
+                          v8::External::New(api_isolate, this))
+            .ToLocalChecked();
+
+    auto wrapped_function = Utils::OpenHandle(*v8_function);
+
+    Object::SetProperty(isolate_, import_module_obj,
+                        V8String(isolate_, function_name), wrapped_function)
+        .Assert();
+  }
+
   Isolate* isolate_;
+  StandardFrame* frame_;
   Handle<WasmInstanceObject> evaluator_;
   Handle<WasmInstanceObject> debuggee_;
 };
@@ -161,30 +247,62 @@ class DebugEvaluatorProxy {
 static bool VerifyEvaluatorInterface(const WasmModule* raw_module,
                                      const ModuleWireBytes& bytes,
                                      ErrorThrower* thrower) {
-  for (const WasmFunction& F : raw_module->functions) {
-    WireBytesRef name_ref = raw_module->function_names.Lookup(
-        bytes, F.func_index, VectorOf(raw_module->export_table));
-    std::string name(bytes.start() + name_ref.offset(),
-                     bytes.start() + name_ref.end_offset());
-    if (F.exported && name == "wasm_format") {
-      if (!CheckSignature(kWasmI32, {}, F.sig, thrower)) return false;
-    } else if (F.imported) {
-      if (name == "__getMemory") {
-        if (!CheckSignature(kWasmBottom, {kWasmI32, kWasmI32, kWasmI32}, F.sig,
-                            thrower)) {
-          return false;
+  for (const WasmImport imported : raw_module->import_table) {
+    if (imported.kind != ImportExportKindCode::kExternalFunction) continue;
+    const WasmFunction& F = raw_module->functions.at(imported.index);
+    std::string module_name(bytes.start() + imported.module_name.offset(),
+                            bytes.start() + imported.module_name.end_offset());
+    std::string field_name(bytes.start() + imported.field_name.offset(),
+                           bytes.start() + imported.field_name.end_offset());
+
+    if (module_name == "env") {
+      if (field_name == "__getMemory") {
+        // void __getMemory(uint32_t offset, uint32_t size, void* result);
+        if (CheckSignature(kWasmBottom, {kWasmI32, kWasmI32, kWasmI32}, F.sig,
+                           thrower)) {
+          continue;
+        }
+      } else if (field_name == "__getLocal") {
+        // void __getLocal(uint32_t local,  void* result)
+        if (CheckSignature(kWasmBottom, {kWasmI32, kWasmI32}, F.sig, thrower)) {
+          continue;
+        }
+      } else if (field_name == "__debug") {
+        // void __debug(uint32_t flag, uint32_t value)
+        if (CheckSignature(kWasmBottom, {kWasmI32, kWasmI32}, F.sig, thrower)) {
+          continue;
+        }
+      } else if (field_name == "__sbrk") {
+        // uint32_t __sbrk(uint32_t increment)
+        if (CheckSignature(kWasmI32, {kWasmI32}, F.sig, thrower)) {
+          continue;
         }
       }
     }
+
+    if (!thrower->error()) {
+      thrower->LinkError("Unknown import \"%s\" \"%s\"", module_name.c_str(),
+                         field_name.c_str());
+    }
+
+    return false;
+  }
+  for (const WasmExport& exported : raw_module->export_table) {
+    if (exported.kind != ImportExportKindCode::kExternalFunction) continue;
+    const WasmFunction& F = raw_module->functions.at(exported.index);
+    std::string field_name(bytes.start() + exported.name.offset(),
+                           bytes.start() + exported.name.end_offset());
+    if (field_name == "wasm_format") {
+      if (!CheckSignature(kWasmI32, {}, F.sig, thrower)) return false;
+    }
   }
   return true;
 }
-
 }  // namespace
 
 Maybe<std::string> DebugEvaluateImpl(
     Vector<const byte> snippet, Handle<WasmInstanceObject> debuggee_instance,
-    WasmInterpreter::FramePtr frame) {
+    StandardFrame* frame) {
   Isolate* isolate = debuggee_instance->GetIsolate();
   HandleScope handle_scope(isolate);
   WasmEngine* engine = isolate->wasm_engine();
@@ -206,7 +324,7 @@ Maybe<std::string> DebugEvaluateImpl(
   }
 
   // Set up imports.
-  DebugEvaluatorProxy proxy(isolate);
+  DebugEvaluatorProxy proxy(isolate, frame);
   Handle<JSObject> imports = proxy.CreateImports();
 
   // Instantiate Module.
@@ -261,9 +379,9 @@ Maybe<std::string> DebugEvaluateImpl(
 
 MaybeHandle<String> DebugEvaluate(Vector<const byte> snippet,
                                   Handle<WasmInstanceObject> debuggee_instance,
-                                  WasmInterpreter::FramePtr frame) {
+                                  StandardFrame* frame) {
   Maybe<std::string> result =
-      DebugEvaluateImpl(snippet, debuggee_instance, std::move(frame));
+      DebugEvaluateImpl(snippet, debuggee_instance, frame);
   if (result.IsNothing()) return {};
   std::string result_str = result.ToChecked();
   return V8String(debuggee_instance->GetIsolate(), result_str.c_str());
diff --git a/deps/v8/src/wasm/wasm-debug-evaluate.h b/deps/v8/src/wasm/wasm-debug-evaluate.h
index 21543eb97a6..31eba51a3cc 100644
--- a/deps/v8/src/wasm/wasm-debug-evaluate.h
+++ b/deps/v8/src/wasm/wasm-debug-evaluate.h
@@ -16,7 +16,7 @@ namespace wasm {
 
 MaybeHandle<String> V8_EXPORT_PRIVATE DebugEvaluate(
     Vector<const byte> snippet, Handle<WasmInstanceObject> debuggee_instance,
-    WasmInterpreter::FramePtr frame);
+    StandardFrame* frame);
 
 }  // namespace wasm
 }  // namespace internal
diff --git a/deps/v8/src/wasm/wasm-debug.cc b/deps/v8/src/wasm/wasm-debug.cc
index 10a2e194a7e..64f99ce9c98 100644
--- a/deps/v8/src/wasm/wasm-debug.cc
+++ b/deps/v8/src/wasm/wasm-debug.cc
@@ -4,6 +4,7 @@
 
 #include "src/wasm/wasm-debug.h"
 
+#include <iomanip>
 #include <unordered_map>
 
 #include "src/base/optional.h"
@@ -15,7 +16,6 @@
 #include "src/execution/frames-inl.h"
 #include "src/execution/isolate.h"
 #include "src/heap/factory.h"
-#include "src/utils/identity-map.h"
 #include "src/wasm/baseline/liftoff-compiler.h"
 #include "src/wasm/baseline/liftoff-register.h"
 #include "src/wasm/module-decoder.h"
@@ -24,6 +24,7 @@
 #include "src/wasm/wasm-limits.h"
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-objects-inl.h"
+#include "src/wasm/wasm-value.h"
 #include "src/zone/accounting-allocator.h"
 
 namespace v8 {
@@ -49,28 +50,43 @@ Handle<String> PrintFToOneByteString(Isolate* isolate, const char* format,
 }
 
 Handle<Object> WasmValueToValueObject(Isolate* isolate, WasmValue value) {
+  Handle<ByteArray> bytes;
   switch (value.type().kind()) {
-    case ValueType::kI32:
-      if (Smi::IsValid(value.to<int32_t>()))
-        return handle(Smi::FromInt(value.to<int32_t>()), isolate);
-      return PrintFToOneByteString<false>(isolate, "%d", value.to<int32_t>());
+    case ValueType::kI32: {
+      int32_t val = value.to_i32();
+      bytes = isolate->factory()->NewByteArray(sizeof(val));
+      memcpy(bytes->GetDataStartAddress(), &val, sizeof(val));
+      break;
+    }
     case ValueType::kI64: {
-      int64_t i64 = value.to<int64_t>();
-      int32_t i32 = static_cast<int32_t>(i64);
-      if (i32 == i64 && Smi::IsValid(i32))
-        return handle(Smi::FromIntptr(i32), isolate);
-      return PrintFToOneByteString<false>(isolate, "%" PRId64, i64);
+      int64_t val = value.to_i64();
+      bytes = isolate->factory()->NewByteArray(sizeof(val));
+      memcpy(bytes->GetDataStartAddress(), &val, sizeof(val));
+      break;
+    }
+    case ValueType::kF32: {
+      float val = value.to_f32();
+      bytes = isolate->factory()->NewByteArray(sizeof(val));
+      memcpy(bytes->GetDataStartAddress(), &val, sizeof(val));
+      break;
+    }
+    case ValueType::kF64: {
+      double val = value.to_f64();
+      bytes = isolate->factory()->NewByteArray(sizeof(val));
+      memcpy(bytes->GetDataStartAddress(), &val, sizeof(val));
+      break;
+    }
+    case ValueType::kAnyRef: {
+      return isolate->factory()->NewWasmValue(
+          static_cast<int32_t>(value.type().kind()), value.to_anyref());
     }
-    case ValueType::kF32:
-      return isolate->factory()->NewNumber(value.to<float>());
-    case ValueType::kF64:
-      return isolate->factory()->NewNumber(value.to<double>());
-    case ValueType::kAnyRef:
-      return value.to_anyref();
-    default:
+    default: {
       UNIMPLEMENTED();
       return isolate->factory()->undefined_value();
+    }
   }
+  return isolate->factory()->NewWasmValue(
+      static_cast<int32_t>(value.type().kind()), bytes);
 }
 
 MaybeHandle<String> GetLocalNameString(Isolate* isolate,
@@ -90,8 +106,6 @@ class InterpreterHandle {
   Isolate* isolate_;
   const WasmModule* module_;
   WasmInterpreter interpreter_;
-  StepAction next_step_action_ = StepNone;
-  int last_step_stack_depth_ = 0;
   std::unordered_map<Address, uint32_t> activations_;
 
   uint32_t StartActivation(Address frame_pointer) {
@@ -145,18 +159,6 @@ class InterpreterHandle {
   WasmInterpreter* interpreter() { return &interpreter_; }
   const WasmModule* module() const { return module_; }
 
-  void PrepareStep(StepAction step_action) {
-    next_step_action_ = step_action;
-    last_step_stack_depth_ = CurrentStackDepth();
-  }
-
-  void ClearStepping() { next_step_action_ = StepNone; }
-
-  int CurrentStackDepth() {
-    DCHECK_EQ(1, interpreter()->GetThreadCount());
-    return interpreter()->GetThread(0)->GetFrameCount();
-  }
-
   // Returns true if exited regularly, false if a trap/exception occurred and
   // was not handled inside this activation. In the latter case, a pending
   // exception will have been set on the isolate.
@@ -178,11 +180,10 @@ class InterpreterHandle {
     bool finished = false;
     while (!finished) {
       // TODO(clemensb): Add occasional StackChecks.
-      WasmInterpreter::State state = ContinueExecution(thread);
+      WasmInterpreter::State state = thread->Run();
       switch (state) {
         case WasmInterpreter::State::PAUSED:
-          NotifyDebugEventListeners(thread);
-          break;
+          UNREACHABLE();
         case WasmInterpreter::State::FINISHED:
           // Perfect, just break the switch and exit the loop.
           finished = true;
@@ -212,7 +213,6 @@ class InterpreterHandle {
           return false;
         // RUNNING should never occur here.
         case WasmInterpreter::State::RUNNING:
-        default:
           UNREACHABLE();
       }
     }
@@ -230,248 +230,13 @@ class InterpreterHandle {
 
     FinishActivation(frame_pointer, activation_id);
 
-    // If we do stepping and it exits wasm interpreter then debugger need to
-    // prepare for it.
-    if (next_step_action_ != StepNone) {
-      // Enter the debugger.
-      DebugScope debug_scope(isolate_->debug());
-
-      isolate_->debug()->PrepareStep(StepOut);
-    }
-    ClearStepping();
-
     return true;
   }
 
-  WasmInterpreter::State ContinueExecution(WasmInterpreter::Thread* thread) {
-    switch (next_step_action_) {
-      case StepNone:
-        return thread->Run();
-      case StepIn:
-        return thread->Step();
-      case StepOut:
-        thread->AddBreakFlags(WasmInterpreter::BreakFlag::AfterReturn);
-        return thread->Run();
-      case StepNext: {
-        int stack_depth = thread->GetFrameCount();
-        if (stack_depth == last_step_stack_depth_) return thread->Step();
-        thread->AddBreakFlags(stack_depth > last_step_stack_depth_
-                                  ? WasmInterpreter::BreakFlag::AfterReturn
-                                  : WasmInterpreter::BreakFlag::AfterCall);
-        return thread->Run();
-      }
-      default:
-        UNREACHABLE();
-    }
-  }
-
-  Handle<WasmInstanceObject> GetInstanceObject() {
-    StackTraceFrameIterator it(isolate_);
-    WasmInterpreterEntryFrame* frame =
-        WasmInterpreterEntryFrame::cast(it.frame());
-    Handle<WasmInstanceObject> instance_obj(frame->wasm_instance(), isolate_);
-    // Check that this is indeed the instance which is connected to this
-    // interpreter.
-    DCHECK_EQ(this, Managed<InterpreterHandle>::cast(
-                        instance_obj->debug_info().interpreter_handle())
-                        .raw());
-    return instance_obj;
-  }
-
-  void NotifyDebugEventListeners(WasmInterpreter::Thread* thread) {
-    // Enter the debugger.
-    DebugScope debug_scope(isolate_->debug());
-
-    // Check whether we hit a breakpoint.
-    if (isolate_->debug()->break_points_active()) {
-      Handle<WasmModuleObject> module_object(
-          GetInstanceObject()->module_object(), isolate_);
-      Handle<Script> script(module_object->script(), isolate_);
-      int position = GetTopPosition(module_object);
-      Handle<FixedArray> breakpoints;
-      if (WasmScript::CheckBreakPoints(isolate_, script, position)
-              .ToHandle(&breakpoints)) {
-        // We hit one or several breakpoints. Clear stepping, notify the
-        // listeners and return.
-        ClearStepping();
-        isolate_->debug()->OnDebugBreak(breakpoints);
-        return;
-      }
-    }
-
-    // We did not hit a breakpoint, so maybe this pause is related to stepping.
-    bool hit_step = false;
-    switch (next_step_action_) {
-      case StepNone:
-        break;
-      case StepIn:
-        hit_step = true;
-        break;
-      case StepOut:
-        hit_step = thread->GetFrameCount() < last_step_stack_depth_;
-        break;
-      case StepNext: {
-        hit_step = thread->GetFrameCount() == last_step_stack_depth_;
-        break;
-      }
-      default:
-        UNREACHABLE();
-    }
-    if (!hit_step) return;
-    ClearStepping();
-    isolate_->debug()->OnDebugBreak(isolate_->factory()->empty_fixed_array());
-  }
-
-  int GetTopPosition(Handle<WasmModuleObject> module_object) {
-    DCHECK_EQ(1, interpreter()->GetThreadCount());
-    WasmInterpreter::Thread* thread = interpreter()->GetThread(0);
-    DCHECK_LT(0, thread->GetFrameCount());
-
-    auto frame = thread->GetFrame(thread->GetFrameCount() - 1);
-    return GetWasmFunctionOffset(module_object->module(),
-                                 frame->function()->func_index) +
-           frame->pc();
-  }
-
-  std::vector<std::pair<uint32_t, int>> GetInterpretedStack(
-      Address frame_pointer) {
-    DCHECK_EQ(1, interpreter()->GetThreadCount());
-    WasmInterpreter::Thread* thread = interpreter()->GetThread(0);
-
-    std::pair<uint32_t, uint32_t> frame_range =
-        GetActivationFrameRange(thread, frame_pointer);
-
-    std::vector<std::pair<uint32_t, int>> stack;
-    stack.reserve(frame_range.second - frame_range.first);
-    for (uint32_t fp = frame_range.first; fp < frame_range.second; ++fp) {
-      auto frame = thread->GetFrame(fp);
-      stack.emplace_back(frame->function()->func_index, frame->pc());
-    }
-    return stack;
-  }
-
-  int NumberOfActiveFrames(Address frame_pointer) {
-    if (!HasActivation(frame_pointer)) return 0;
-
-    DCHECK_EQ(1, interpreter()->GetThreadCount());
-    WasmInterpreter::Thread* thread = interpreter()->GetThread(0);
-
-    std::pair<uint32_t, uint32_t> frame_range =
-        GetActivationFrameRange(thread, frame_pointer);
-
-    return frame_range.second - frame_range.first;
-  }
-
-  WasmInterpreter::FramePtr GetInterpretedFrame(Address frame_pointer,
-                                                int idx) {
-    DCHECK_EQ(1, interpreter()->GetThreadCount());
-    WasmInterpreter::Thread* thread = interpreter()->GetThread(0);
-
-    std::pair<uint32_t, uint32_t> frame_range =
-        GetActivationFrameRange(thread, frame_pointer);
-    DCHECK_LE(0, idx);
-    DCHECK_GT(frame_range.second - frame_range.first, idx);
-
-    return thread->GetFrame(frame_range.first + idx);
-  }
-
-  uint64_t NumInterpretedCalls() {
-    DCHECK_EQ(1, interpreter()->GetThreadCount());
-    return interpreter()->GetThread(0)->NumInterpretedCalls();
-  }
-
-  Handle<JSObject> GetLocalScopeObject(InterpretedFrame* frame,
-                                       Handle<WasmDebugInfo> debug_info) {
-    Isolate* isolate = isolate_;
-
-    Handle<JSObject> local_scope_object =
-        isolate_->factory()->NewJSObjectWithNullProto();
-    // Fill parameters and locals.
-    int num_locals = frame->GetLocalCount();
-    DCHECK_LE(frame->GetParameterCount(), num_locals);
-    if (num_locals > 0) {
-      Handle<JSObject> locals_obj =
-          isolate_->factory()->NewJSObjectWithNullProto();
-      Handle<String> locals_name =
-          isolate_->factory()->InternalizeString(StaticCharVector("locals"));
-      JSObject::AddProperty(isolate, local_scope_object, locals_name,
-                            locals_obj, NONE);
-      NativeModule* native_module =
-          debug_info->wasm_instance().module_object().native_module();
-      for (int i = 0; i < num_locals; ++i) {
-        Handle<Name> name;
-        if (!GetLocalNameString(isolate, native_module,
-                                frame->function()->func_index, i)
-                 .ToHandle(&name)) {
-          name = PrintFToOneByteString<true>(isolate_, "var%d", i);
-        }
-        WasmValue value = frame->GetLocalValue(i);
-        Handle<Object> value_obj = WasmValueToValueObject(isolate_, value);
-        // {name} can be a string representation of an element index.
-        LookupIterator::Key lookup_key{isolate, name};
-        LookupIterator it(isolate, locals_obj, lookup_key, locals_obj,
-                          LookupIterator::OWN_SKIP_INTERCEPTOR);
-        if (it.IsFound()) continue;
-        Object::AddDataProperty(&it, value_obj, NONE,
-                                Just(ShouldThrow::kThrowOnError),
-                                StoreOrigin::kNamed)
-            .Check();
-      }
-    }
-
-    // Fill stack values.
-    int stack_count = frame->GetStackHeight();
-    // Use an object without prototype instead of an Array, for nicer displaying
-    // in DevTools. For Arrays, the length field and prototype is displayed,
-    // which does not make too much sense here.
-    Handle<JSObject> stack_obj =
-        isolate_->factory()->NewJSObjectWithNullProto();
-    Handle<String> stack_name =
-        isolate_->factory()->InternalizeString(StaticCharVector("stack"));
-    JSObject::AddProperty(isolate, local_scope_object, stack_name, stack_obj,
-                          NONE);
-    for (int i = 0; i < stack_count; ++i) {
-      WasmValue value = frame->GetStackValue(i);
-      Handle<Object> value_obj = WasmValueToValueObject(isolate_, value);
-      JSObject::AddDataElement(stack_obj, static_cast<uint32_t>(i), value_obj,
-                               NONE);
-    }
-    return local_scope_object;
-  }
-
-  Handle<JSObject> GetStackScopeObject(InterpretedFrame* frame,
-                                       Handle<WasmDebugInfo> debug_info) {
-    // Fill stack values.
-    int stack_count = frame->GetStackHeight();
-    // Use an object without prototype instead of an Array, for nicer displaying
-    // in DevTools. For Arrays, the length field and prototype is displayed,
-    // which does not make too much sense here.
-    Handle<JSObject> stack_scope_obj =
-        isolate_->factory()->NewJSObjectWithNullProto();
-    for (int i = 0; i < stack_count; ++i) {
-      WasmValue value = frame->GetStackValue(i);
-      Handle<Object> value_obj = WasmValueToValueObject(isolate_, value);
-      JSObject::AddDataElement(stack_scope_obj, static_cast<uint32_t>(i),
-                               value_obj, NONE);
-    }
-    return stack_scope_obj;
-  }
-
  private:
   DISALLOW_COPY_AND_ASSIGN(InterpreterHandle);
 };
 
-int FindByteOffset(int pc_offset, WasmCode* wasm_code) {
-  int position = 0;
-  SourcePositionTableIterator iterator(wasm_code->source_positions());
-  for (SourcePositionTableIterator iterator(wasm_code->source_positions());
-       !iterator.done() && iterator.code_offset() < pc_offset;
-       iterator.Advance()) {
-    position = iterator.source_position().ScriptOffset();
-  }
-  return position;
-}
-
 // Generate a sorted and deduplicated list of byte offsets for this function's
 // current positions on the stack.
 std::vector<int> StackFramePositions(int func_index, Isolate* isolate) {
@@ -479,14 +244,11 @@ std::vector<int> StackFramePositions(int func_index, Isolate* isolate) {
   WasmCodeRefScope code_ref_scope;
   for (StackTraceFrameIterator it(isolate); !it.done(); it.Advance()) {
     if (!it.is_wasm()) continue;
-    WasmCompiledFrame* frame = WasmCompiledFrame::cast(it.frame());
+    WasmFrame* frame = WasmFrame::cast(it.frame());
     if (static_cast<int>(frame->function_index()) != func_index) continue;
     WasmCode* wasm_code = frame->wasm_code();
     if (!wasm_code->is_liftoff()) continue;
-    int pc_offset =
-        static_cast<int>(frame->pc() - wasm_code->instruction_start());
-    int byte_offset = FindByteOffset(pc_offset, wasm_code);
-    byte_offsets.push_back(byte_offset);
+    byte_offsets.push_back(frame->byte_offset());
   }
   std::sort(byte_offsets.begin(), byte_offsets.end());
   auto last = std::unique(byte_offsets.begin(), byte_offsets.end());
@@ -527,19 +289,58 @@ Address FindNewPC(WasmCode* wasm_code, int byte_offset,
 
 }  // namespace
 
-Handle<JSObject> GetGlobalScopeObject(Handle<WasmInstanceObject> instance) {
+void DebugSideTable::Print(std::ostream& os) const {
+  os << "Debug side table (" << num_locals_ << " locals, " << entries_.size()
+     << " entries):\n";
+  for (auto& entry : entries_) entry.Print(os);
+  os << "\n";
+}
+
+void DebugSideTable::Entry::Print(std::ostream& os) const {
+  os << std::setw(6) << std::hex << pc_offset_ << std::dec << " [";
+  for (auto& value : values_) {
+    os << " " << value.type.type_name() << ":";
+    switch (value.kind) {
+      case kConstant:
+        os << "const#" << value.i32_const;
+        break;
+      case kRegister:
+        os << "reg#" << value.reg_code;
+        break;
+      case kStack:
+        os << "stack#" << value.stack_offset;
+        break;
+    }
+  }
+  os << " ]\n";
+}
+
+Handle<JSObject> GetModuleScopeObject(Handle<WasmInstanceObject> instance) {
   Isolate* isolate = instance->GetIsolate();
 
-  Handle<JSObject> global_scope_object =
+  Handle<JSObject> module_scope_object =
       isolate->factory()->NewJSObjectWithNullProto();
+
+  Handle<String> instance_name =
+      isolate->factory()->InternalizeString(StaticCharVector("instance"));
+  JSObject::AddProperty(isolate, module_scope_object, instance_name, instance,
+                        NONE);
+
   if (instance->has_memory_object()) {
-    Handle<String> name =
-        isolate->factory()->InternalizeString(StaticCharVector("memory"));
+    Handle<String> name;
+    // TODO(duongn): extend the logic when multiple memories are supported.
+    const uint32_t memory_index = 0;
+    if (!WasmInstanceObject::GetMemoryNameOrNull(isolate, instance,
+                                                 memory_index)
+             .ToHandle(&name)) {
+      const char* label = "memory%d";
+      name = PrintFToOneByteString<true>(isolate, label, memory_index);
+    }
     Handle<JSArrayBuffer> memory_buffer(
         instance->memory_object().array_buffer(), isolate);
     Handle<JSTypedArray> uint8_array = isolate->factory()->NewJSTypedArray(
         kExternalUint8Array, memory_buffer, 0, memory_buffer->byte_length());
-    JSObject::AddProperty(isolate, global_scope_object, name, uint8_array,
+    JSObject::AddProperty(isolate, module_scope_object, name, uint8_array,
                           NONE);
   }
 
@@ -549,7 +350,7 @@ Handle<JSObject> GetGlobalScopeObject(Handle<WasmInstanceObject> instance) {
         isolate->factory()->NewJSObjectWithNullProto();
     Handle<String> globals_name =
         isolate->factory()->InternalizeString(StaticCharVector("globals"));
-    JSObject::AddProperty(isolate, global_scope_object, globals_name,
+    JSObject::AddProperty(isolate, module_scope_object, globals_name,
                           globals_obj, NONE);
 
     for (uint32_t i = 0; i < globals.size(); ++i) {
@@ -565,8 +366,7 @@ Handle<JSObject> GetGlobalScopeObject(Handle<WasmInstanceObject> instance) {
       JSObject::AddProperty(isolate, globals_obj, name, value_obj, NONE);
     }
   }
-
-  return global_scope_object;
+  return module_scope_object;
 }
 
 class DebugInfoImpl {
@@ -574,26 +374,49 @@ class DebugInfoImpl {
   explicit DebugInfoImpl(NativeModule* native_module)
       : native_module_(native_module) {}
 
+  int GetNumLocals(Address pc) {
+    FrameInspectionScope scope(this, pc);
+    if (!scope.is_inspectable()) return 0;
+    return scope.debug_side_table->num_locals();
+  }
+
+  WasmValue GetLocalValue(int local, Address pc, Address fp,
+                          Address debug_break_fp) {
+    FrameInspectionScope scope(this, pc);
+    return GetValue(scope.debug_side_table_entry, local, fp, debug_break_fp);
+  }
+
+  int GetStackDepth(Address pc) {
+    FrameInspectionScope scope(this, pc);
+    if (!scope.is_inspectable()) return 0;
+    int num_locals = static_cast<int>(scope.debug_side_table->num_locals());
+    int value_count = scope.debug_side_table_entry->num_values();
+    return value_count - num_locals;
+  }
+
+  WasmValue GetStackValue(int index, Address pc, Address fp,
+                          Address debug_break_fp) {
+    FrameInspectionScope scope(this, pc);
+    int num_locals = static_cast<int>(scope.debug_side_table->num_locals());
+    int value_count = scope.debug_side_table_entry->num_values();
+    if (num_locals + index >= value_count) return {};
+    return GetValue(scope.debug_side_table_entry, num_locals + index, fp,
+                    debug_break_fp);
+  }
+
   Handle<JSObject> GetLocalScopeObject(Isolate* isolate, Address pc, Address fp,
                                        Address debug_break_fp) {
+    FrameInspectionScope scope(this, pc);
     Handle<JSObject> local_scope_object =
         isolate->factory()->NewJSObjectWithNullProto();
 
-    wasm::WasmCodeRefScope wasm_code_ref_scope;
-    wasm::WasmCode* code =
-        isolate->wasm_engine()->code_manager()->LookupCode(pc);
-    // Only Liftoff code can be inspected.
-    if (!code->is_liftoff()) return local_scope_object;
+    if (!scope.is_inspectable()) return local_scope_object;
 
     auto* module = native_module_->module();
-    auto* function = &module->functions[code->index()];
-    auto* debug_side_table = GetDebugSideTable(code, isolate->allocator());
-    int pc_offset = static_cast<int>(pc - code->instruction_start());
-    auto* debug_side_table_entry = debug_side_table->GetEntry(pc_offset);
-    DCHECK_NOT_NULL(debug_side_table_entry);
+    auto* function = &module->functions[scope.code->index()];
 
     // Fill parameters and locals.
-    int num_locals = static_cast<int>(debug_side_table->num_locals());
+    int num_locals = static_cast<int>(scope.debug_side_table->num_locals());
     DCHECK_LE(static_cast<int>(function->sig->parameter_count()), num_locals);
     if (num_locals > 0) {
       Handle<JSObject> locals_obj =
@@ -610,7 +433,7 @@ class DebugInfoImpl {
           name = PrintFToOneByteString<true>(isolate, "var%d", i);
         }
         WasmValue value =
-            GetValue(debug_side_table_entry, i, fp, debug_break_fp);
+            GetValue(scope.debug_side_table_entry, i, fp, debug_break_fp);
         Handle<Object> value_obj = WasmValueToValueObject(isolate, value);
         // {name} can be a string representation of an element index.
         LookupIterator::Key lookup_key{isolate, name};
@@ -623,50 +446,26 @@ class DebugInfoImpl {
             .Check();
       }
     }
-
-    // Fill stack values.
-    // Use an object without prototype instead of an Array, for nicer displaying
-    // in DevTools. For Arrays, the length field and prototype is displayed,
-    // which does not make too much sense here.
-    Handle<JSObject> stack_obj = isolate->factory()->NewJSObjectWithNullProto();
-    Handle<String> stack_name =
-        isolate->factory()->InternalizeString(StaticCharVector("stack"));
-    JSObject::AddProperty(isolate, local_scope_object, stack_name, stack_obj,
-                          NONE);
-    int value_count = debug_side_table_entry->num_values();
-    for (int i = num_locals; i < value_count; ++i) {
-      WasmValue value = GetValue(debug_side_table_entry, i, fp, debug_break_fp);
-      Handle<Object> value_obj = WasmValueToValueObject(isolate, value);
-      JSObject::AddDataElement(stack_obj, static_cast<uint32_t>(i - num_locals),
-                               value_obj, NONE);
-    }
     return local_scope_object;
   }
 
   Handle<JSObject> GetStackScopeObject(Isolate* isolate, Address pc, Address fp,
                                        Address debug_break_fp) {
+    FrameInspectionScope scope(this, pc);
     Handle<JSObject> stack_scope_obj =
         isolate->factory()->NewJSObjectWithNullProto();
-    wasm::WasmCodeRefScope wasm_code_ref_scope;
-
-    wasm::WasmCode* code =
-        isolate->wasm_engine()->code_manager()->LookupCode(pc);
-    // Only Liftoff code can be inspected.
-    if (!code->is_liftoff()) return stack_scope_obj;
 
-    auto* debug_side_table = GetDebugSideTable(code, isolate->allocator());
-    int pc_offset = static_cast<int>(pc - code->instruction_start());
-    auto* debug_side_table_entry = debug_side_table->GetEntry(pc_offset);
-    DCHECK_NOT_NULL(debug_side_table_entry);
+    if (!scope.is_inspectable()) return stack_scope_obj;
 
     // Fill stack values.
     // Use an object without prototype instead of an Array, for nicer displaying
     // in DevTools. For Arrays, the length field and prototype is displayed,
     // which does not make too much sense here.
-    int num_locals = static_cast<int>(debug_side_table->num_locals());
-    int value_count = debug_side_table_entry->num_values();
+    int num_locals = static_cast<int>(scope.debug_side_table->num_locals());
+    int value_count = scope.debug_side_table_entry->num_values();
     for (int i = num_locals; i < value_count; ++i) {
-      WasmValue value = GetValue(debug_side_table_entry, i, fp, debug_break_fp);
+      WasmValue value =
+          GetValue(scope.debug_side_table_entry, i, fp, debug_break_fp);
       Handle<Object> value_obj = WasmValueToValueObject(isolate, value);
       JSObject::AddDataElement(stack_scope_obj,
                                static_cast<uint32_t>(i - num_locals), value_obj,
@@ -684,13 +483,8 @@ class DebugInfoImpl {
     return local_names_->GetName(func_index, local_index);
   }
 
-  void RecompileLiftoffWithBreakpoints(int func_index, Vector<int> offsets,
-                                       Isolate* current_isolate) {
-    if (func_index == flooded_function_index_) {
-      // We should not be flooding a function that is already flooded.
-      DCHECK(!(offsets.size() == 1 && offsets[0] == 0));
-      flooded_function_index_ = -1;
-    }
+  WasmCode* RecompileLiftoffWithBreakpoints(
+      int func_index, Vector<int> offsets, Vector<int> extra_source_positions) {
     // Recompile the function with Liftoff, setting the new breakpoints.
     // Not thread-safe. The caller is responsible for locking {mutex_}.
     CompilationEnv env = native_module_->CreateCompilationEnv();
@@ -701,114 +495,150 @@ class DebugInfoImpl {
                       wire_bytes.begin() + function->code.end_offset()};
     std::unique_ptr<DebugSideTable> debug_sidetable;
 
-    // Generate additional source positions for current stack frame positions.
-    // These source positions are used to find return addresses in the new code.
-    std::vector<int> stack_frame_positions =
-        StackFramePositions(func_index, current_isolate);
-
+    ForDebugging for_debugging =
+        offsets.size() == 1 && offsets[0] == 0 ? kForStepping : kForDebugging;
     WasmCompilationResult result = ExecuteLiftoffCompilation(
-        native_module_->engine()->allocator(), &env, body, func_index, nullptr,
-        nullptr, offsets, &debug_sidetable, VectorOf(stack_frame_positions));
+        native_module_->engine()->allocator(), &env, body, func_index,
+        for_debugging, nullptr, nullptr, offsets, &debug_sidetable,
+        extra_source_positions);
     // Liftoff compilation failure is a FATAL error. We rely on complete Liftoff
     // support for debugging.
     if (!result.succeeded()) FATAL("Liftoff compilation failed");
     DCHECK_NOT_NULL(debug_sidetable);
 
-    WasmCodeRefScope wasm_code_ref_scope;
-    WasmCode* new_code = native_module_->AddCompiledCode(std::move(result));
-    bool added =
-        debug_side_tables_.emplace(new_code, std::move(debug_sidetable)).second;
-    DCHECK(added);
-    USE(added);
+    WasmCode* new_code = native_module_->PublishCode(
+        native_module_->AddCompiledCode(std::move(result)));
 
-    UpdateReturnAddresses(current_isolate, new_code);
-  }
+    DCHECK(new_code->is_inspectable());
+    {
+      base::MutexGuard guard(&mutex_);
+      DCHECK_EQ(0, debug_side_tables_.count(new_code));
+      debug_side_tables_.emplace(new_code, std::move(debug_sidetable));
+    }
 
-  void SetBreakpoint(int func_index, int offset, Isolate* current_isolate) {
-    // Hold the mutex while setting the breakpoint. This guards against multiple
-    // isolates setting breakpoints at the same time. We don't really support
-    // that scenario yet, but concurrently compiling and installing different
-    // Liftoff variants of a function would be problematic.
-    base::MutexGuard guard(&mutex_);
+    return new_code;
+  }
 
-    // offset == 0 indicates flooding and should not happen here.
-    DCHECK_NE(0, offset);
+  void SetBreakpoint(int func_index, int offset, Isolate* isolate) {
+    std::vector<int> breakpoints_copy;
+    StackFrameId stepping_frame = NO_ID;
+    {
+      // Hold the mutex while modifying the set of breakpoints, but release it
+      // before compiling the new code (see comment in
+      // {RecompileLiftoffWithBreakpoints}). This needs to be revisited once we
+      // support setting different breakpoints in different isolates
+      // (https://crbug.com/v8/10351).
+      base::MutexGuard guard(&mutex_);
+
+      // offset == 0 indicates flooding and should not happen here.
+      DCHECK_NE(0, offset);
+
+      std::vector<int>& breakpoints = breakpoints_per_function_[func_index];
+      auto insertion_point =
+          std::lower_bound(breakpoints.begin(), breakpoints.end(), offset);
+      if (insertion_point != breakpoints.end() && *insertion_point == offset) {
+        // The breakpoint is already set.
+        return;
+      }
+      breakpoints.insert(insertion_point, offset);
+      breakpoints_copy = breakpoints;
 
-    std::vector<int>& breakpoints = breakpoints_per_function_[func_index];
-    auto insertion_point =
-        std::lower_bound(breakpoints.begin(), breakpoints.end(), offset);
-    if (insertion_point != breakpoints.end() && *insertion_point == offset) {
-      // The breakpoint is already set.
-      return;
+      stepping_frame = per_isolate_data_[isolate].stepping_frame;
     }
-    breakpoints.insert(insertion_point, offset);
 
-    // No need to recompile if the function is already flooded.
-    if (func_index == flooded_function_index_) return;
+    UpdateBreakpoints(func_index, VectorOf(breakpoints_copy), isolate,
+                      stepping_frame);
+  }
+
+  void UpdateBreakpoints(int func_index, Vector<int> breakpoints,
+                         Isolate* isolate, StackFrameId stepping_frame) {
+    // Generate additional source positions for current stack frame positions.
+    // These source positions are used to find return addresses in the new code.
+    std::vector<int> stack_frame_positions =
+        StackFramePositions(func_index, isolate);
 
-    RecompileLiftoffWithBreakpoints(func_index, VectorOf(breakpoints),
-                                    current_isolate);
+    WasmCodeRefScope wasm_code_ref_scope;
+    WasmCode* new_code = RecompileLiftoffWithBreakpoints(
+        func_index, breakpoints, VectorOf(stack_frame_positions));
+    UpdateReturnAddresses(isolate, new_code, stepping_frame);
   }
 
-  void FloodWithBreakpoints(int func_index, Isolate* current_isolate) {
-    base::MutexGuard guard(&mutex_);
+  void FloodWithBreakpoints(WasmFrame* frame, ReturnLocation return_location) {
     // 0 is an invalid offset used to indicate flooding.
     int offset = 0;
-    RecompileLiftoffWithBreakpoints(func_index, Vector<int>(&offset, 1),
-                                    current_isolate);
+    WasmCodeRefScope wasm_code_ref_scope;
+    DCHECK(frame->wasm_code()->is_liftoff());
+    // Generate an additional source position for the current byte offset.
+    int byte_offset = frame->byte_offset();
+    WasmCode* new_code = RecompileLiftoffWithBreakpoints(
+        frame->function_index(), VectorOf(&offset, 1),
+        VectorOf(&byte_offset, 1));
+    UpdateReturnAddress(frame, new_code, return_location);
   }
 
   void PrepareStep(Isolate* isolate, StackFrameId break_frame_id) {
     StackTraceFrameIterator it(isolate, break_frame_id);
     DCHECK(!it.done());
-    DCHECK(it.frame()->is_wasm_compiled());
-    WasmCompiledFrame* frame = WasmCompiledFrame::cast(it.frame());
+    DCHECK(it.frame()->is_wasm());
+    WasmFrame* frame = WasmFrame::cast(it.frame());
     StepAction step_action = isolate->debug()->last_step_action();
 
+    // If we are flooding the top frame, the return location is after a
+    // breakpoints. Otherwise, it's after a call.
+    ReturnLocation return_location = kAfterBreakpoint;
+
     // If we are at a return instruction, then any stepping action is equivalent
     // to StepOut, and we need to flood the parent function.
     if (IsAtReturn(frame) || step_action == StepOut) {
       it.Advance();
-      if (it.done() || !it.frame()->is_wasm_compiled()) return;
-      frame = WasmCompiledFrame::cast(it.frame());
+      if (it.done() || !it.frame()->is_wasm()) return;
+      frame = WasmFrame::cast(it.frame());
+      return_location = kAfterWasmCall;
     }
 
-    if (static_cast<int>(frame->function_index()) != flooded_function_index_) {
-      if (flooded_function_index_ != -1) {
-        std::vector<int>& breakpoints =
-            breakpoints_per_function_[flooded_function_index_];
-        RecompileLiftoffWithBreakpoints(flooded_function_index_,
-                                        VectorOf(breakpoints), isolate);
-      }
-      FloodWithBreakpoints(frame->function_index(), isolate);
-      flooded_function_index_ = frame->function_index();
-    }
-    stepping_frame_ = frame->id();
+    FloodWithBreakpoints(frame, return_location);
+
+    base::MutexGuard guard(&mutex_);
+    per_isolate_data_[isolate].stepping_frame = frame->id();
   }
 
-  void ClearStepping() { stepping_frame_ = NO_ID; }
+  void ClearStepping(Isolate* isolate) {
+    base::MutexGuard guard(&mutex_);
+    auto it = per_isolate_data_.find(isolate);
+    if (it != per_isolate_data_.end()) it->second.stepping_frame = NO_ID;
+  }
 
-  bool IsStepping(WasmCompiledFrame* frame) {
+  bool IsStepping(WasmFrame* frame) {
     Isolate* isolate = frame->wasm_instance().GetIsolate();
-    StepAction last_step_action = isolate->debug()->last_step_action();
-    return stepping_frame_ == frame->id() || last_step_action == StepIn;
+    if (isolate->debug()->last_step_action() == StepIn) return true;
+    base::MutexGuard guard(&mutex_);
+    auto it = per_isolate_data_.find(isolate);
+    return it != per_isolate_data_.end() &&
+           it->second.stepping_frame == frame->id();
   }
 
-  void RemoveBreakpoint(int func_index, int position,
-                        Isolate* current_isolate) {
-    base::MutexGuard guard(&mutex_);
-    const auto& function = native_module_->module()->functions[func_index];
-    int offset = position - function.code.offset();
-
-    std::vector<int>& breakpoints = breakpoints_per_function_[func_index];
-    DCHECK_LT(0, offset);
-    auto insertion_point =
-        std::lower_bound(breakpoints.begin(), breakpoints.end(), offset);
-    if (insertion_point != breakpoints.end() && *insertion_point == offset) {
+  void RemoveBreakpoint(int func_index, int position, Isolate* isolate) {
+    std::vector<int> breakpoints_copy;
+    StackFrameId stepping_frame = NO_ID;
+    {
+      base::MutexGuard guard(&mutex_);
+      const auto& function = native_module_->module()->functions[func_index];
+      int offset = position - function.code.offset();
+
+      std::vector<int>& breakpoints = breakpoints_per_function_[func_index];
+      DCHECK_LT(0, offset);
+      auto insertion_point =
+          std::lower_bound(breakpoints.begin(), breakpoints.end(), offset);
+      if (insertion_point == breakpoints.end()) return;
+      if (*insertion_point != offset) return;
       breakpoints.erase(insertion_point);
+      breakpoints_copy = breakpoints;
+
+      stepping_frame = per_isolate_data_[isolate].stepping_frame;
     }
-    RecompileLiftoffWithBreakpoints(func_index, VectorOf(breakpoints),
-                                    current_isolate);
+
+    UpdateBreakpoints(func_index, VectorOf(breakpoints_copy), isolate,
+                      stepping_frame);
   }
 
   void RemoveDebugSideTables(Vector<WasmCode* const> codes) {
@@ -818,12 +648,52 @@ class DebugInfoImpl {
     }
   }
 
+  DebugSideTable* GetDebugSideTableIfExists(const WasmCode* code) const {
+    base::MutexGuard guard(&mutex_);
+    auto it = debug_side_tables_.find(code);
+    return it == debug_side_tables_.end() ? nullptr : it->second.get();
+  }
+
+  void RemoveIsolate(Isolate* isolate) {
+    base::MutexGuard guard(&mutex_);
+    per_isolate_data_.erase(isolate);
+  }
+
  private:
+  struct FrameInspectionScope {
+    FrameInspectionScope(DebugInfoImpl* debug_info, Address pc)
+        : code(debug_info->native_module_->engine()->code_manager()->LookupCode(
+              pc)),
+          pc_offset(static_cast<int>(pc - code->instruction_start())),
+          debug_side_table(
+              code->is_inspectable()
+                  ? debug_info->GetDebugSideTable(
+                        code, debug_info->native_module_->engine()->allocator())
+                  : nullptr),
+          debug_side_table_entry(debug_side_table
+                                     ? debug_side_table->GetEntry(pc_offset)
+                                     : nullptr) {
+      DCHECK_IMPLIES(code->is_inspectable(), debug_side_table_entry != nullptr);
+    }
+
+    bool is_inspectable() const { return debug_side_table_entry; }
+
+    wasm::WasmCodeRefScope wasm_code_ref_scope;
+    wasm::WasmCode* code;
+    int pc_offset;
+    const DebugSideTable* debug_side_table;
+    const DebugSideTable::Entry* debug_side_table_entry;
+  };
+
   const DebugSideTable* GetDebugSideTable(WasmCode* code,
                                           AccountingAllocator* allocator) {
-    base::MutexGuard guard(&mutex_);
-    if (auto& existing_table = debug_side_tables_[code]) {
-      return existing_table.get();
+    DCHECK(code->is_inspectable());
+    {
+      // Only hold the mutex temporarily. We can't hold it while generating the
+      // debug side table, because compilation takes the {NativeModule} lock.
+      base::MutexGuard guard(&mutex_);
+      auto it = debug_side_tables_.find(code);
+      if (it != debug_side_tables_.end()) return it->second.get();
     }
 
     // Otherwise create the debug side table now.
@@ -838,8 +708,17 @@ class DebugInfoImpl {
         GenerateLiftoffDebugSideTable(allocator, &env, func_body);
     DebugSideTable* ret = debug_side_table.get();
 
-    // Install into cache and return.
-    debug_side_tables_[code] = std::move(debug_side_table);
+    // Check cache again, maybe another thread concurrently generated a debug
+    // side table already.
+    {
+      base::MutexGuard guard(&mutex_);
+      auto& slot = debug_side_tables_[code];
+      if (slot != nullptr) return slot.get();
+      slot = std::move(debug_side_table);
+    }
+
+    // Print the code together with the debug table, if requested.
+    code->MaybePrint();
     return ret;
   }
 
@@ -909,36 +788,41 @@ class DebugInfoImpl {
   // After installing a Liftoff code object with a different set of breakpoints,
   // update return addresses on the stack so that execution resumes in the new
   // code. The frame layout itself should be independent of breakpoints.
-  // TODO(thibaudm): update other threads as well.
-  void UpdateReturnAddresses(Isolate* isolate, WasmCode* new_code) {
-    DCHECK(new_code->is_liftoff());
+  void UpdateReturnAddresses(Isolate* isolate, WasmCode* new_code,
+                             StackFrameId stepping_frame) {
     // The first return location is after the breakpoint, others are after wasm
     // calls.
     ReturnLocation return_location = kAfterBreakpoint;
     for (StackTraceFrameIterator it(isolate); !it.done();
          it.Advance(), return_location = kAfterWasmCall) {
       // We still need the flooded function for stepping.
-      if (it.frame()->id() == stepping_frame_) continue;
+      if (it.frame()->id() == stepping_frame) continue;
       if (!it.is_wasm()) continue;
-      WasmCompiledFrame* frame = WasmCompiledFrame::cast(it.frame());
+      WasmFrame* frame = WasmFrame::cast(it.frame());
       if (frame->native_module() != new_code->native_module()) continue;
       if (frame->function_index() != new_code->index()) continue;
-      WasmCode* old_code = frame->wasm_code();
-      if (!old_code->is_liftoff()) continue;
-      int pc_offset =
-          static_cast<int>(frame->pc() - old_code->instruction_start());
-      int position = frame->position();
-      int byte_offset = FindByteOffset(pc_offset, old_code);
-      Address new_pc = FindNewPC(new_code, byte_offset, return_location);
-      PointerAuthentication::ReplacePC(frame->pc_address(), new_pc,
-                                       kSystemPointerSize);
-      USE(position);
-      // The frame position should still be the same after OSR.
-      DCHECK_EQ(position, frame->position());
+      if (!frame->wasm_code()->is_liftoff()) continue;
+      UpdateReturnAddress(frame, new_code, return_location);
     }
   }
 
-  bool IsAtReturn(WasmCompiledFrame* frame) {
+  void UpdateReturnAddress(WasmFrame* frame, WasmCode* new_code,
+                           ReturnLocation return_location) {
+    DCHECK(new_code->is_liftoff());
+    DCHECK_EQ(frame->function_index(), new_code->index());
+    DCHECK_EQ(frame->native_module(), new_code->native_module());
+    DCHECK(frame->wasm_code()->is_liftoff());
+#ifdef DEBUG
+    int old_position = frame->position();
+#endif
+    Address new_pc = FindNewPC(new_code, frame->byte_offset(), return_location);
+    PointerAuthentication::ReplacePC(frame->pc_address(), new_pc,
+                                     kSystemPointerSize);
+    // The frame position should still be the same after OSR.
+    DCHECK_EQ(old_position, frame->position());
+  }
+
+  bool IsAtReturn(WasmFrame* frame) {
     DisallowHeapAllocation no_gc;
     int position = frame->position();
     NativeModule* native_module =
@@ -951,13 +835,23 @@ class DebugInfoImpl {
     return static_cast<size_t>(position) == code.end_offset() - 1;
   }
 
+  // Isolate-specific data, for debugging modules that are shared by multiple
+  // isolates.
+  struct PerIsolateDebugData {
+    // Store the frame ID when stepping, to avoid overwriting that frame when
+    // setting or removing a breakpoint.
+    StackFrameId stepping_frame = NO_ID;
+
+    // TODO(clemensb): Also move breakpoint here.
+  };
+
   NativeModule* const native_module_;
 
   // {mutex_} protects all fields below.
   mutable base::Mutex mutex_;
 
   // DebugSideTable per code object, lazily initialized.
-  std::unordered_map<WasmCode*, std::unique_ptr<DebugSideTable>>
+  std::unordered_map<const WasmCode*, std::unique_ptr<DebugSideTable>>
       debug_side_tables_;
 
   // Names of locals, lazily decoded from the wire bytes.
@@ -965,12 +859,11 @@ class DebugInfoImpl {
 
   // Keeps track of the currently set breakpoints (by offset within that
   // function).
+  // TODO(clemensb): Move this into {PerIsolateDebugData}.
   std::unordered_map<int, std::vector<int>> breakpoints_per_function_;
 
-  // Store the frame ID when stepping, to avoid breaking in recursive calls of
-  // the same function.
-  StackFrameId stepping_frame_ = NO_ID;
-  int flooded_function_index_ = -1;
+  // Isolate-specific data.
+  std::unordered_map<Isolate*, PerIsolateDebugData> per_isolate_data_;
 
   DISALLOW_COPY_AND_ASSIGN(DebugInfoImpl);
 };
@@ -980,6 +873,20 @@ DebugInfo::DebugInfo(NativeModule* native_module)
 
 DebugInfo::~DebugInfo() = default;
 
+int DebugInfo::GetNumLocals(Address pc) { return impl_->GetNumLocals(pc); }
+
+WasmValue DebugInfo::GetLocalValue(int local, Address pc, Address fp,
+                                   Address debug_break_fp) {
+  return impl_->GetLocalValue(local, pc, fp, debug_break_fp);
+}
+
+int DebugInfo::GetStackDepth(Address pc) { return impl_->GetStackDepth(pc); }
+
+WasmValue DebugInfo::GetStackValue(int index, Address pc, Address fp,
+                                   Address debug_break_fp) {
+  return impl_->GetStackValue(index, pc, fp, debug_break_fp);
+}
+
 Handle<JSObject> DebugInfo::GetLocalScopeObject(Isolate* isolate, Address pc,
                                                 Address fp,
                                                 Address debug_break_fp) {
@@ -1005,9 +912,11 @@ void DebugInfo::PrepareStep(Isolate* isolate, StackFrameId break_frame_id) {
   impl_->PrepareStep(isolate, break_frame_id);
 }
 
-void DebugInfo::ClearStepping() { impl_->ClearStepping(); }
+void DebugInfo::ClearStepping(Isolate* isolate) {
+  impl_->ClearStepping(isolate);
+}
 
-bool DebugInfo::IsStepping(WasmCompiledFrame* frame) {
+bool DebugInfo::IsStepping(WasmFrame* frame) {
   return impl_->IsStepping(frame);
 }
 
@@ -1020,41 +929,16 @@ void DebugInfo::RemoveDebugSideTables(Vector<WasmCode* const> code) {
   impl_->RemoveDebugSideTables(code);
 }
 
-}  // namespace wasm
-
-namespace {
-
-wasm::InterpreterHandle* GetOrCreateInterpreterHandle(
-    Isolate* isolate, Handle<WasmDebugInfo> debug_info) {
-  Handle<Object> handle(debug_info->interpreter_handle(), isolate);
-  if (handle->IsUndefined(isolate)) {
-    // Use the maximum stack size to estimate the maximum size of the
-    // interpreter. The interpreter keeps its own stack internally, and the size
-    // of the stack should dominate the overall size of the interpreter. We
-    // multiply by '2' to account for the growing strategy for the backing store
-    // of the stack.
-    size_t interpreter_size = FLAG_stack_size * KB * 2;
-    handle = Managed<wasm::InterpreterHandle>::Allocate(
-        isolate, interpreter_size, isolate, debug_info);
-    debug_info->set_interpreter_handle(*handle);
-  }
-
-  return Handle<Managed<wasm::InterpreterHandle>>::cast(handle)->raw();
-}
-
-wasm::InterpreterHandle* GetInterpreterHandle(WasmDebugInfo debug_info) {
-  Object handle_obj = debug_info.interpreter_handle();
-  DCHECK(!handle_obj.IsUndefined());
-  return Managed<wasm::InterpreterHandle>::cast(handle_obj).raw();
+DebugSideTable* DebugInfo::GetDebugSideTableIfExists(
+    const WasmCode* code) const {
+  return impl_->GetDebugSideTableIfExists(code);
 }
 
-wasm::InterpreterHandle* GetInterpreterHandleOrNull(WasmDebugInfo debug_info) {
-  Object handle_obj = debug_info.interpreter_handle();
-  if (handle_obj.IsUndefined()) return nullptr;
-  return Managed<wasm::InterpreterHandle>::cast(handle_obj).raw();
+void DebugInfo::RemoveIsolate(Isolate* isolate) {
+  return impl_->RemoveIsolate(isolate);
 }
 
-}  // namespace
+}  // namespace wasm
 
 Handle<WasmDebugInfo> WasmDebugInfo::New(Handle<WasmInstanceObject> instance) {
   DCHECK(!instance->has_debug_info());
@@ -1083,128 +967,6 @@ wasm::WasmInterpreter* WasmDebugInfo::SetupForTesting(
   return interp_handle->raw()->interpreter();
 }
 
-// static
-void WasmDebugInfo::PrepareStepIn(Handle<WasmDebugInfo> debug_info,
-                                  int func_index) {
-  Isolate* isolate = debug_info->GetIsolate();
-  auto* handle = GetOrCreateInterpreterHandle(isolate, debug_info);
-  RedirectToInterpreter(debug_info, Vector<int>(&func_index, 1));
-  const wasm::WasmFunction* func = &handle->module()->functions[func_index];
-  handle->interpreter()->PrepareStepIn(func);
-  // Debug break would be considered as a step-in inside wasm.
-  handle->PrepareStep(StepAction::StepIn);
-}
-
-// static
-void WasmDebugInfo::SetBreakpoint(Handle<WasmDebugInfo> debug_info,
-                                  int func_index, int offset) {
-  Isolate* isolate = debug_info->GetIsolate();
-  auto* handle = GetOrCreateInterpreterHandle(isolate, debug_info);
-  RedirectToInterpreter(debug_info, Vector<int>(&func_index, 1));
-  const wasm::WasmFunction* func = &handle->module()->functions[func_index];
-  handle->interpreter()->SetBreakpoint(func, offset, true);
-}
-
-// static
-void WasmDebugInfo::ClearBreakpoint(Handle<WasmDebugInfo> debug_info,
-                                    int func_index, int offset) {
-  Isolate* isolate = debug_info->GetIsolate();
-  auto* handle = GetOrCreateInterpreterHandle(isolate, debug_info);
-  // TODO(leese): If there are no more breakpoints left it would be good to
-  // undo redirecting to the interpreter.
-  const wasm::WasmFunction* func = &handle->module()->functions[func_index];
-  handle->interpreter()->SetBreakpoint(func, offset, false);
-}
-
-// static
-void WasmDebugInfo::RedirectToInterpreter(Handle<WasmDebugInfo> debug_info,
-                                          Vector<int> func_indexes) {
-  Isolate* isolate = debug_info->GetIsolate();
-  // Ensure that the interpreter is instantiated.
-  GetOrCreateInterpreterHandle(isolate, debug_info);
-  Handle<WasmInstanceObject> instance(debug_info->wasm_instance(), isolate);
-  wasm::NativeModule* native_module = instance->module_object().native_module();
-  const wasm::WasmModule* module = instance->module();
-
-  // We may modify the wasm jump table.
-  wasm::NativeModuleModificationScope native_module_modification_scope(
-      native_module);
-
-  for (int func_index : func_indexes) {
-    DCHECK_LE(0, func_index);
-    DCHECK_GT(module->functions.size(), func_index);
-    // Note that this is just a best effort check. Multiple threads can still
-    // race at redirecting the same function to the interpreter, which is OK.
-    if (native_module->IsRedirectedToInterpreter(func_index)) continue;
-
-    wasm::WasmCodeRefScope code_ref_scope;
-    wasm::WasmCompilationResult result = compiler::CompileWasmInterpreterEntry(
-        isolate->wasm_engine(), native_module->enabled_features(), func_index,
-        module->functions[func_index].sig);
-    std::unique_ptr<wasm::WasmCode> wasm_code = native_module->AddCode(
-        func_index, result.code_desc, result.frame_slot_count,
-        result.tagged_parameter_slots,
-        result.protected_instructions_data.as_vector(),
-        result.source_positions.as_vector(), wasm::WasmCode::kInterpreterEntry,
-        wasm::ExecutionTier::kInterpreter);
-    native_module->PublishCode(std::move(wasm_code));
-    DCHECK(native_module->IsRedirectedToInterpreter(func_index));
-  }
-}
-
-void WasmDebugInfo::PrepareStep(StepAction step_action) {
-  GetInterpreterHandle(*this)->PrepareStep(step_action);
-}
-
-// static
-bool WasmDebugInfo::RunInterpreter(Isolate* isolate,
-                                   Handle<WasmDebugInfo> debug_info,
-                                   Address frame_pointer, int func_index,
-                                   Vector<wasm::WasmValue> argument_values,
-                                   Vector<wasm::WasmValue> return_values) {
-  DCHECK_LE(0, func_index);
-  auto* handle = GetOrCreateInterpreterHandle(isolate, debug_info);
-  Handle<WasmInstanceObject> instance(debug_info->wasm_instance(), isolate);
-  return handle->Execute(instance, frame_pointer,
-                         static_cast<uint32_t>(func_index), argument_values,
-                         return_values);
-}
-
-std::vector<std::pair<uint32_t, int>> WasmDebugInfo::GetInterpretedStack(
-    Address frame_pointer) {
-  return GetInterpreterHandle(*this)->GetInterpretedStack(frame_pointer);
-}
-
-int WasmDebugInfo::NumberOfActiveFrames(Address frame_pointer) {
-  return GetInterpreterHandle(*this)->NumberOfActiveFrames(frame_pointer);
-}
-
-wasm::WasmInterpreter::FramePtr WasmDebugInfo::GetInterpretedFrame(
-    Address frame_pointer, int idx) {
-  return GetInterpreterHandle(*this)->GetInterpretedFrame(frame_pointer, idx);
-}
-
-uint64_t WasmDebugInfo::NumInterpretedCalls() {
-  auto* handle = GetInterpreterHandleOrNull(*this);
-  return handle ? handle->NumInterpretedCalls() : 0;
-}
-
-// static
-Handle<JSObject> WasmDebugInfo::GetLocalScopeObject(
-    Handle<WasmDebugInfo> debug_info, Address frame_pointer, int frame_index) {
-  auto* interp_handle = GetInterpreterHandle(*debug_info);
-  auto frame = interp_handle->GetInterpretedFrame(frame_pointer, frame_index);
-  return interp_handle->GetLocalScopeObject(frame.get(), debug_info);
-}
-
-// static
-Handle<JSObject> WasmDebugInfo::GetStackScopeObject(
-    Handle<WasmDebugInfo> debug_info, Address frame_pointer, int frame_index) {
-  auto* interp_handle = GetInterpreterHandle(*debug_info);
-  auto frame = interp_handle->GetInterpretedFrame(frame_pointer, frame_index);
-  return interp_handle->GetStackScopeObject(frame.get(), debug_info);
-}
-
 // static
 Handle<Code> WasmDebugInfo::GetCWasmEntry(Handle<WasmDebugInfo> debug_info,
                                           const wasm::FunctionSig* sig) {
@@ -1315,61 +1077,71 @@ bool WasmScript::SetBreakPointForFunction(Handle<Script> script, int func_index,
   WasmScript::AddBreakpointToInfo(script, func.code.offset() + offset,
                                   break_point);
 
-  if (FLAG_debug_in_liftoff) {
-    native_module->GetDebugInfo()->SetBreakpoint(func_index, offset, isolate);
-  } else {
-    // Iterate over all instances and tell them to set this new breakpoint.
-    // We do this using the weak list of all instances from the script.
-    Handle<WeakArrayList> weak_instance_list(script->wasm_weak_instance_list(),
-                                             isolate);
-    for (int i = 0; i < weak_instance_list->length(); ++i) {
-      MaybeObject maybe_instance = weak_instance_list->Get(i);
-      if (maybe_instance->IsWeak()) {
-        Handle<WasmInstanceObject> instance(
-            WasmInstanceObject::cast(maybe_instance->GetHeapObjectAssumeWeak()),
-            isolate);
-        Handle<WasmDebugInfo> debug_info =
-            WasmInstanceObject::GetOrCreateDebugInfo(instance);
-        WasmDebugInfo::SetBreakpoint(debug_info, func_index, offset);
-      }
+  native_module->GetDebugInfo()->SetBreakpoint(func_index, offset, isolate);
+
+  return true;
+}
+
+namespace {
+
+int GetBreakpointPos(Isolate* isolate, Object break_point_info_or_undef) {
+  if (break_point_info_or_undef.IsUndefined(isolate)) return kMaxInt;
+  return BreakPointInfo::cast(break_point_info_or_undef).source_position();
+}
+
+int FindBreakpointInfoInsertPos(Isolate* isolate,
+                                Handle<FixedArray> breakpoint_infos,
+                                int position) {
+  // Find insert location via binary search, taking care of undefined values on
+  // the right. Position is always greater than zero.
+  DCHECK_LT(0, position);
+
+  int left = 0;                            // inclusive
+  int right = breakpoint_infos->length();  // exclusive
+  while (right - left > 1) {
+    int mid = left + (right - left) / 2;
+    Object mid_obj = breakpoint_infos->get(mid);
+    if (GetBreakpointPos(isolate, mid_obj) <= position) {
+      left = mid;
+    } else {
+      right = mid;
     }
   }
 
-  return true;
+  int left_pos = GetBreakpointPos(isolate, breakpoint_infos->get(left));
+  return left_pos < position ? left + 1 : left;
 }
 
+}  // namespace
+
 // static
 bool WasmScript::ClearBreakPoint(Handle<Script> script, int position,
                                  Handle<BreakPoint> break_point) {
+  if (!script->has_wasm_breakpoint_infos()) return false;
+
   Isolate* isolate = script->GetIsolate();
+  Handle<FixedArray> breakpoint_infos(script->wasm_breakpoint_infos(), isolate);
 
-  // Find the function for this breakpoint.
-  const wasm::WasmModule* module = script->wasm_native_module()->module();
-  int func_index = GetContainingWasmFunction(module, position);
-  if (func_index < 0) return false;
-  const wasm::WasmFunction& func = module->functions[func_index];
-  int offset_in_func = position - func.code.offset();
+  int pos = FindBreakpointInfoInsertPos(isolate, breakpoint_infos, position);
 
-  if (!WasmScript::RemoveBreakpointFromInfo(script, position, break_point)) {
-    return false;
-  }
+  // Does a BreakPointInfo object already exist for this position?
+  if (pos == breakpoint_infos->length()) return false;
+
+  Handle<BreakPointInfo> info(BreakPointInfo::cast(breakpoint_infos->get(pos)),
+                              isolate);
+  BreakPointInfo::ClearBreakPoint(isolate, info, break_point);
 
-  // Iterate over all instances and tell them to remove this breakpoint.
-  // We do this using the weak list of all instances from the script.
-  Handle<WeakArrayList> weak_instance_list(script->wasm_weak_instance_list(),
-                                           isolate);
-  for (int i = 0; i < weak_instance_list->length(); ++i) {
-    MaybeObject maybe_instance = weak_instance_list->Get(i);
-    if (maybe_instance->IsWeak()) {
-      Handle<WasmInstanceObject> instance(
-          WasmInstanceObject::cast(maybe_instance->GetHeapObjectAssumeWeak()),
-          isolate);
-      Handle<WasmDebugInfo> debug_info =
-          WasmInstanceObject::GetOrCreateDebugInfo(instance);
-      WasmDebugInfo::ClearBreakpoint(debug_info, func_index, offset_in_func);
+  // Check if there are no more breakpoints at this location.
+  if (info->GetBreakPointCount(isolate) == 0) {
+    // Update array by moving breakpoints up one position.
+    for (int i = pos; i < breakpoint_infos->length() - 1; i++) {
+      Object entry = breakpoint_infos->get(i + 1);
+      breakpoint_infos->set(i, entry);
+      if (entry.IsUndefined(isolate)) break;
     }
+    // Make sure last array element is empty as a result.
+    breakpoint_infos->set_undefined(breakpoint_infos->length() - 1);
   }
-
   return true;
 }
 
@@ -1401,38 +1173,12 @@ bool WasmScript::ClearBreakPointById(Handle<Script> script, int breakpoint_id) {
   return false;
 }
 
-namespace {
-
-int GetBreakpointPos(Isolate* isolate, Object break_point_info_or_undef) {
-  if (break_point_info_or_undef.IsUndefined(isolate)) return kMaxInt;
-  return BreakPointInfo::cast(break_point_info_or_undef).source_position();
-}
-
-int FindBreakpointInfoInsertPos(Isolate* isolate,
-                                Handle<FixedArray> breakpoint_infos,
-                                int position) {
-  // Find insert location via binary search, taking care of undefined values on
-  // the right. Position is always greater than zero.
-  DCHECK_LT(0, position);
-
-  int left = 0;                            // inclusive
-  int right = breakpoint_infos->length();  // exclusive
-  while (right - left > 1) {
-    int mid = left + (right - left) / 2;
-    Object mid_obj = breakpoint_infos->get(mid);
-    if (GetBreakpointPos(isolate, mid_obj) <= position) {
-      left = mid;
-    } else {
-      right = mid;
-    }
-  }
-
-  int left_pos = GetBreakpointPos(isolate, breakpoint_infos->get(left));
-  return left_pos < position ? left + 1 : left;
+// static
+void WasmScript::ClearAllBreakpoints(Script script) {
+  script.set_wasm_breakpoint_infos(
+      ReadOnlyRoots(script.GetIsolate()).empty_fixed_array());
 }
 
-}  // namespace
-
 // static
 void WasmScript::AddBreakpointToInfo(Handle<Script> script, int position,
                                      Handle<BreakPoint> break_point) {
@@ -1489,69 +1235,6 @@ void WasmScript::AddBreakpointToInfo(Handle<Script> script, int position,
   new_breakpoint_infos->set(insert_pos, *breakpoint_info);
 }
 
-// static
-bool WasmScript::RemoveBreakpointFromInfo(Handle<Script> script, int position,
-                                          Handle<BreakPoint> break_point) {
-  if (!script->has_wasm_breakpoint_infos()) return false;
-
-  Isolate* isolate = script->GetIsolate();
-  Handle<FixedArray> breakpoint_infos(script->wasm_breakpoint_infos(), isolate);
-
-  int pos = FindBreakpointInfoInsertPos(isolate, breakpoint_infos, position);
-
-  // Does a BreakPointInfo object already exist for this position?
-  if (pos == breakpoint_infos->length()) return false;
-
-  Handle<BreakPointInfo> info(BreakPointInfo::cast(breakpoint_infos->get(pos)),
-                              isolate);
-  BreakPointInfo::ClearBreakPoint(isolate, info, break_point);
-
-  // Check if there are no more breakpoints at this location.
-  if (info->GetBreakPointCount(isolate) == 0) {
-    // Update array by moving breakpoints up one position.
-    for (int i = pos; i < breakpoint_infos->length() - 1; i++) {
-      Object entry = breakpoint_infos->get(i + 1);
-      breakpoint_infos->set(i, entry);
-      if (entry.IsUndefined(isolate)) break;
-    }
-    // Make sure last array element is empty as a result.
-    breakpoint_infos->set_undefined(breakpoint_infos->length() - 1);
-  }
-  return true;
-}
-
-void WasmScript::SetBreakpointsOnNewInstance(
-    Handle<Script> script, Handle<WasmInstanceObject> instance) {
-  if (!script->has_wasm_breakpoint_infos()) return;
-  Isolate* isolate = script->GetIsolate();
-  Handle<WasmDebugInfo> debug_info =
-      WasmInstanceObject::GetOrCreateDebugInfo(instance);
-
-  Handle<FixedArray> breakpoint_infos(script->wasm_breakpoint_infos(), isolate);
-  // If the array exists, it should not be empty.
-  DCHECK_LT(0, breakpoint_infos->length());
-
-  for (int i = 0, e = breakpoint_infos->length(); i < e; ++i) {
-    Handle<Object> obj(breakpoint_infos->get(i), isolate);
-    if (obj->IsUndefined(isolate)) {
-      for (; i < e; ++i) {
-        DCHECK(breakpoint_infos->get(i).IsUndefined(isolate));
-      }
-      break;
-    }
-    Handle<BreakPointInfo> breakpoint_info = Handle<BreakPointInfo>::cast(obj);
-    int position = breakpoint_info->source_position();
-
-    // Find the function for this breakpoint, and set the breakpoint.
-    const wasm::WasmModule* module = script->wasm_native_module()->module();
-    int func_index = GetContainingWasmFunction(module, position);
-    DCHECK_LE(0, func_index);
-    const wasm::WasmFunction& func = module->functions[func_index];
-    int offset_in_func = position - func.code.offset();
-    WasmDebugInfo::SetBreakpoint(debug_info, func_index, offset_in_func);
-  }
-}
-
 // static
 bool WasmScript::GetPossibleBreakpoints(
     wasm::NativeModule* native_module, const v8::debug::Location& start,
diff --git a/deps/v8/src/wasm/wasm-debug.h b/deps/v8/src/wasm/wasm-debug.h
index 2611b7facc3..6050cb3a58b 100644
--- a/deps/v8/src/wasm/wasm-debug.h
+++ b/deps/v8/src/wasm/wasm-debug.h
@@ -23,7 +23,7 @@ class Handle;
 class JSObject;
 template <typename T>
 class Vector;
-class WasmCompiledFrame;
+class WasmFrame;
 class WasmInstanceObject;
 
 namespace wasm {
@@ -33,6 +33,7 @@ class LocalNames;
 class NativeModule;
 class WasmCode;
 class WireBytesRef;
+class WasmValue;
 
 // Side table storing information used to inspect Liftoff frames at runtime.
 // This table is only created on demand for debugging, so it is not optimized
@@ -90,6 +91,8 @@ class DebugSideTable {
       return values_[index].reg_code;
     }
 
+    void Print(std::ostream&) const;
+
    private:
     int pc_offset_;
     std::vector<Value> values_;
@@ -119,6 +122,8 @@ class DebugSideTable {
 
   int num_locals() const { return num_locals_; }
 
+  void Print(std::ostream&) const;
+
  private:
   struct EntryPositionLess {
     bool operator()(const Entry& a, const Entry& b) const {
@@ -130,19 +135,27 @@ class DebugSideTable {
   std::vector<Entry> entries_;
 };
 
-// Get the global scope for a given instance. This will contain the wasm memory
+// Get the module scope for a given instance. This will contain the wasm memory
 // (if the instance has a memory) and the values of all globals.
-Handle<JSObject> GetGlobalScopeObject(Handle<WasmInstanceObject>);
+Handle<JSObject> GetModuleScopeObject(Handle<WasmInstanceObject>);
 
 // Debug info per NativeModule, created lazily on demand.
 // Implementation in {wasm-debug.cc} using PIMPL.
-class DebugInfo {
+class V8_EXPORT_PRIVATE DebugInfo {
  public:
   explicit DebugInfo(NativeModule*);
   ~DebugInfo();
 
+  // For the frame inspection methods below:
   // {fp} is the frame pointer of the Liftoff frame, {debug_break_fp} that of
   // the {WasmDebugBreak} frame (if any).
+  int GetNumLocals(Address pc);
+  WasmValue GetLocalValue(int local, Address pc, Address fp,
+                          Address debug_break_fp);
+  int GetStackDepth(Address pc);
+  WasmValue GetStackValue(int index, Address pc, Address fp,
+                          Address debug_break_fp);
+
   Handle<JSObject> GetLocalScopeObject(Isolate*, Address pc, Address fp,
                                        Address debug_break_fp);
 
@@ -155,14 +168,20 @@ class DebugInfo {
 
   void PrepareStep(Isolate*, StackFrameId);
 
-  void ClearStepping();
+  void ClearStepping(Isolate*);
 
-  bool IsStepping(WasmCompiledFrame*);
+  bool IsStepping(WasmFrame*);
 
   void RemoveBreakpoint(int func_index, int offset, Isolate* current_isolate);
 
   void RemoveDebugSideTables(Vector<WasmCode* const>);
 
+  // Return the debug side table for the given code object, but only if it has
+  // already been created. This will never trigger generation of the table.
+  DebugSideTable* GetDebugSideTableIfExists(const WasmCode*) const;
+
+  void RemoveIsolate(Isolate*);
+
  private:
   std::unique_ptr<DebugInfoImpl> impl_;
 };
diff --git a/deps/v8/src/wasm/wasm-engine.cc b/deps/v8/src/wasm/wasm-engine.cc
index 573812e8fa7..402467b5de2 100644
--- a/deps/v8/src/wasm/wasm-engine.cc
+++ b/deps/v8/src/wasm/wasm-engine.cc
@@ -22,6 +22,7 @@
 #include "src/wasm/module-decoder.h"
 #include "src/wasm/module-instantiate.h"
 #include "src/wasm/streaming-decoder.h"
+#include "src/wasm/wasm-debug.h"
 #include "src/wasm/wasm-limits.h"
 #include "src/wasm/wasm-objects-inl.h"
 
@@ -120,7 +121,7 @@ class WasmGCForegroundTask : public CancelableTask {
     // report an empty set of live wasm code.
 #ifdef ENABLE_SLOW_DCHECKS
     for (StackFrameIterator it(isolate_); !it.done(); it.Advance()) {
-      DCHECK_NE(StackFrame::WASM_COMPILED, it.frame()->type());
+      DCHECK_NE(StackFrame::WASM, it.frame()->type());
     }
 #endif
     CheckNoArchivedThreads(isolate_);
@@ -131,6 +132,33 @@ class WasmGCForegroundTask : public CancelableTask {
   Isolate* isolate_;
 };
 
+class WeakScriptHandle {
+ public:
+  explicit WeakScriptHandle(Handle<Script> handle) {
+    auto global_handle =
+        handle->GetIsolate()->global_handles()->Create(*handle);
+    location_ = std::make_unique<Address*>(global_handle.location());
+    GlobalHandles::MakeWeak(location_.get());
+  }
+
+  // Usually the destructor of this class should always be called after the weak
+  // callback because the Script keeps the NativeModule alive. So we expect the
+  // handle to be destroyed and the location to be reset already.
+  // We cannot check this because of one exception. When the native module is
+  // freed during isolate shutdown, the destructor will be called
+  // first, and the callback will never be called.
+  ~WeakScriptHandle() = default;
+
+  WeakScriptHandle(WeakScriptHandle&&) V8_NOEXCEPT = default;
+
+  Handle<Script> handle() { return Handle<Script>(*location_); }
+
+ private:
+  // Store the location in a unique_ptr so that its address stays the same even
+  // when this object is moved/copied.
+  std::unique_ptr<Address*> location_;
+};
+
 }  // namespace
 
 std::shared_ptr<NativeModule> NativeModuleCache::MaybeGetNativeModule(
@@ -320,6 +348,9 @@ struct WasmEngine::IsolateInfo {
   // grows, never shrinks).
   std::set<NativeModule*> native_modules;
 
+  // Scripts created for each native module in this isolate.
+  std::unordered_map<NativeModule*, WeakScriptHandle> scripts;
+
   // Caches whether code needs to be logged on this isolate.
   bool log_codes;
 
@@ -362,7 +393,7 @@ WasmEngine::WasmEngine() : code_manager_(FLAG_wasm_max_code_space * MB) {}
 WasmEngine::~WasmEngine() {
 #ifdef V8_ENABLE_WASM_GDB_REMOTE_DEBUGGING
   // Synchronize on the GDB-remote thread, if running.
-  gdb_server_ = nullptr;
+  gdb_server_.reset();
 #endif  // V8_ENABLE_WASM_GDB_REMOTE_DEBUGGING
 
   // Synchronize on all background compile tasks.
@@ -461,10 +492,7 @@ MaybeHandle<WasmModuleObject> WasmEngine::SyncCompile(
   }
 #endif
 
-  Handle<Script> script =
-      CreateWasmScript(isolate, bytes.module_bytes(),
-                       VectorOf(native_module->module()->source_map_url),
-                       native_module->module()->name);
+  Handle<Script> script = GetOrCreateScript(isolate, native_module);
 
   // Create the compiled module object and populate with compiled functions
   // and information needed at instantiation time. This object needs to be
@@ -573,10 +601,14 @@ std::shared_ptr<StreamingDecoder> WasmEngine::StartStreamingCompilation(
     Isolate* isolate, const WasmFeatures& enabled, Handle<Context> context,
     const char* api_method_name,
     std::shared_ptr<CompilationResultResolver> resolver) {
-  AsyncCompileJob* job =
-      CreateAsyncCompileJob(isolate, enabled, std::unique_ptr<byte[]>(nullptr),
-                            0, context, api_method_name, std::move(resolver));
-  return job->CreateStreamingDecoder();
+  if (FLAG_wasm_async_compilation) {
+    AsyncCompileJob* job = CreateAsyncCompileJob(
+        isolate, enabled, std::unique_ptr<byte[]>(nullptr), 0, context,
+        api_method_name, std::move(resolver));
+    return job->CreateStreamingDecoder();
+  }
+  return StreamingDecoder::CreateSyncStreamingDecoder(
+      isolate, enabled, context, api_method_name, std::move(resolver));
 }
 
 void WasmEngine::CompileFunction(Isolate* isolate, NativeModule* native_module,
@@ -588,12 +620,6 @@ void WasmEngine::CompileFunction(Isolate* isolate, NativeModule* native_module,
       &native_module->module()->functions[function_index], tier);
 }
 
-void WasmEngine::RecompileAllFunctions(Isolate* isolate,
-                                       NativeModule* native_module,
-                                       ExecutionTier tier) {
-  RecompileNativeModule(isolate, native_module, tier);
-}
-
 void WasmEngine::TierDownAllModulesPerIsolate(Isolate* isolate) {
   std::vector<NativeModule*> native_modules;
   {
@@ -602,24 +628,40 @@ void WasmEngine::TierDownAllModulesPerIsolate(Isolate* isolate) {
     isolates_[isolate]->keep_tiered_down = true;
     for (auto* native_module : isolates_[isolate]->native_modules) {
       native_modules.push_back(native_module);
+      native_module->SetTieringState(kTieredDown);
     }
   }
   for (auto* native_module : native_modules) {
-    native_module->TierDown(isolate);
+    native_module->TriggerRecompilation();
   }
 }
 
 void WasmEngine::TierUpAllModulesPerIsolate(Isolate* isolate) {
-  std::vector<NativeModule*> native_modules;
+  // Only trigger recompilation after releasing the mutex, otherwise we risk
+  // deadlocks because of lock inversion.
+  std::vector<NativeModule*> native_modules_to_recompile;
   {
     base::MutexGuard lock(&mutex_);
     isolates_[isolate]->keep_tiered_down = false;
+    auto test_keep_tiered_down = [this](NativeModule* native_module) {
+      DCHECK_EQ(1, native_modules_.count(native_module));
+      for (auto* isolate : native_modules_[native_module]->isolates) {
+        DCHECK_EQ(1, isolates_.count(isolate));
+        if (isolates_[isolate]->keep_tiered_down) return true;
+      }
+      return false;
+    };
     for (auto* native_module : isolates_[isolate]->native_modules) {
-      native_modules.push_back(native_module);
+      if (!native_module->IsTieredDown()) continue;
+      // Only start tier-up if no other isolate needs this modules in tiered
+      // down state.
+      if (test_keep_tiered_down(native_module)) continue;
+      native_module->SetTieringState(kTieredUp);
+      native_modules_to_recompile.push_back(native_module);
     }
   }
-  for (auto* native_module : native_modules) {
-    native_module->TierUp(isolate);
+  for (auto* native_module : native_modules_to_recompile) {
+    native_module->TriggerRecompilation();
   }
 }
 
@@ -628,19 +670,104 @@ std::shared_ptr<NativeModule> WasmEngine::ExportNativeModule(
   return module_object->shared_native_module();
 }
 
+namespace {
+Handle<Script> CreateWasmScript(Isolate* isolate,
+                                std::shared_ptr<NativeModule> native_module,
+                                Vector<const char> source_url = {}) {
+  Handle<Script> script =
+      isolate->factory()->NewScript(isolate->factory()->empty_string());
+  script->set_compilation_state(Script::COMPILATION_STATE_COMPILED);
+  script->set_context_data(isolate->native_context()->debug_context_id());
+  script->set_type(Script::TYPE_WASM);
+
+  Vector<const uint8_t> wire_bytes = native_module->wire_bytes();
+  int hash = StringHasher::HashSequentialString(
+      reinterpret_cast<const char*>(wire_bytes.begin()), wire_bytes.length(),
+      kZeroHashSeed);
+
+  const int kBufferSize = 32;
+  char buffer[kBufferSize];
+
+  // Script name is "<module_name>-hash" if name is available and "hash"
+  // otherwise.
+  const WasmModule* module = native_module->module();
+  Handle<String> name_str;
+  if (module->name.is_set()) {
+    int name_chars = SNPrintF(ArrayVector(buffer), "-%08x", hash);
+    DCHECK(name_chars >= 0 && name_chars < kBufferSize);
+    Handle<String> name_hash =
+        isolate->factory()
+            ->NewStringFromOneByte(
+                VectorOf(reinterpret_cast<uint8_t*>(buffer), name_chars),
+                AllocationType::kOld)
+            .ToHandleChecked();
+    Handle<String> module_name =
+        WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+            isolate, wire_bytes, module->name, kNoInternalize);
+    name_str = isolate->factory()
+                   ->NewConsString(module_name, name_hash)
+                   .ToHandleChecked();
+  } else {
+    int name_chars = SNPrintF(ArrayVector(buffer), "%08x", hash);
+    DCHECK(name_chars >= 0 && name_chars < kBufferSize);
+    name_str = isolate->factory()
+                   ->NewStringFromOneByte(
+                       VectorOf(reinterpret_cast<uint8_t*>(buffer), name_chars),
+                       AllocationType::kOld)
+                   .ToHandleChecked();
+  }
+  script->set_name(*name_str);
+  MaybeHandle<String> url_str;
+  if (!source_url.empty()) {
+    url_str =
+        isolate->factory()->NewStringFromUtf8(source_url, AllocationType::kOld);
+  } else {
+    Handle<String> url_prefix =
+        isolate->factory()->InternalizeString(StaticCharVector("wasm://wasm/"));
+    url_str = isolate->factory()->NewConsString(url_prefix, name_str);
+  }
+  script->set_source_url(*url_str.ToHandleChecked());
+
+  const WasmDebugSymbols& debug_symbols =
+      native_module->module()->debug_symbols;
+  if (debug_symbols.type == WasmDebugSymbols::Type::SourceMap &&
+      !debug_symbols.external_url.is_empty()) {
+    Vector<const char> external_url =
+        ModuleWireBytes(wire_bytes).GetNameOrNull(debug_symbols.external_url);
+    MaybeHandle<String> src_map_str = isolate->factory()->NewStringFromUtf8(
+        external_url, AllocationType::kOld);
+    script->set_source_mapping_url(*src_map_str.ToHandleChecked());
+  }
+
+  // Use the given shared {NativeModule}, but increase its reference count by
+  // allocating a new {Managed<T>} that the {Script} references.
+  size_t code_size_estimate = native_module->committed_code_space();
+  size_t memory_estimate =
+      code_size_estimate +
+      wasm::WasmCodeManager::EstimateNativeModuleMetaDataSize(module);
+  Handle<Managed<wasm::NativeModule>> managed_native_module =
+      Managed<wasm::NativeModule>::FromSharedPtr(isolate, memory_estimate,
+                                                 std::move(native_module));
+  script->set_wasm_managed_native_module(*managed_native_module);
+  script->set_wasm_breakpoint_infos(ReadOnlyRoots(isolate).empty_fixed_array());
+  script->set_wasm_weak_instance_list(
+      ReadOnlyRoots(isolate).empty_weak_array_list());
+  return script;
+}
+}  // namespace
+
 Handle<WasmModuleObject> WasmEngine::ImportNativeModule(
-    Isolate* isolate, std::shared_ptr<NativeModule> shared_native_module) {
+    Isolate* isolate, std::shared_ptr<NativeModule> shared_native_module,
+    Vector<const char> source_url) {
+  DCHECK_EQ(this, shared_native_module->engine());
   NativeModule* native_module = shared_native_module.get();
   ModuleWireBytes wire_bytes(native_module->wire_bytes());
   Handle<Script> script =
-      CreateWasmScript(isolate, wire_bytes.module_bytes(),
-                       VectorOf(native_module->module()->source_map_url),
-                       native_module->module()->name);
+      GetOrCreateScript(isolate, shared_native_module, source_url);
   Handle<FixedArray> export_wrappers;
   CompileJsToWasmWrappers(isolate, native_module->module(), &export_wrappers);
   Handle<WasmModuleObject> module_object = WasmModuleObject::New(
-      isolate, std::move(shared_native_module), script, export_wrappers,
-      native_module->committed_code_space());
+      isolate, std::move(shared_native_module), script, export_wrappers);
   {
     base::MutexGuard lock(&mutex_);
     DCHECK_EQ(1, isolates_.count(isolate));
@@ -769,9 +896,20 @@ void WasmEngine::AddIsolate(Isolate* isolate) {
   };
   isolate->heap()->AddGCEpilogueCallback(callback, v8::kGCTypeMarkSweepCompact,
                                          nullptr);
+#ifdef V8_ENABLE_WASM_GDB_REMOTE_DEBUGGING
+  if (gdb_server_) {
+    gdb_server_->AddIsolate(isolate);
+  }
+#endif  // V8_ENABLE_WASM_GDB_REMOTE_DEBUGGING
 }
 
 void WasmEngine::RemoveIsolate(Isolate* isolate) {
+#ifdef V8_ENABLE_WASM_GDB_REMOTE_DEBUGGING
+  if (gdb_server_) {
+    gdb_server_->RemoveIsolate(isolate);
+  }
+#endif  // V8_ENABLE_WASM_GDB_REMOTE_DEBUGGING
+
   base::MutexGuard guard(&mutex_);
   auto it = isolates_.find(isolate);
   DCHECK_NE(isolates_.end(), it);
@@ -787,6 +925,9 @@ void WasmEngine::RemoveIsolate(Isolate* isolate) {
         current_gc_info_->dead_code.erase(code);
       }
     }
+    if (native_module->HasDebugInfo()) {
+      native_module->GetDebugInfo()->RemoveIsolate(isolate);
+    }
   }
   if (current_gc_info_) {
     if (RemoveIsolateFromCurrentGC(isolate)) PotentiallyFinishCurrentGC();
@@ -856,7 +997,8 @@ std::shared_ptr<NativeModule> WasmEngine::NewNativeModule(
     std::shared_ptr<const WasmModule> module, size_t code_size_estimate) {
 #ifdef V8_ENABLE_WASM_GDB_REMOTE_DEBUGGING
   if (FLAG_wasm_gdb_remote && !gdb_server_) {
-    gdb_server_ = std::make_unique<gdb_server::GdbServer>();
+    gdb_server_ = gdb_server::GdbServer::Create();
+    gdb_server_->AddIsolate(isolate);
   }
 #endif  // V8_ENABLE_WASM_GDB_REMOTE_DEBUGGING
 
@@ -867,10 +1009,15 @@ std::shared_ptr<NativeModule> WasmEngine::NewNativeModule(
       native_module.get(), std::make_unique<NativeModuleInfo>()));
   DCHECK(pair.second);  // inserted new entry.
   pair.first->second.get()->isolates.insert(isolate);
-  isolates_[isolate]->native_modules.insert(native_module.get());
+  auto& modules_per_isolate = isolates_[isolate]->native_modules;
+  modules_per_isolate.insert(native_module.get());
   if (isolates_[isolate]->keep_tiered_down) {
-    native_module->SetTieredDown();
+    native_module->SetTieringState(kTieredDown);
   }
+  isolate->counters()->wasm_modules_per_isolate()->AddSample(
+      static_cast<int>(modules_per_isolate.size()));
+  isolate->counters()->wasm_modules_per_engine()->AddSample(
+      static_cast<int>(native_modules_.size()));
   return native_module;
 }
 
@@ -878,6 +1025,7 @@ std::shared_ptr<NativeModule> WasmEngine::MaybeGetNativeModule(
     ModuleOrigin origin, Vector<const uint8_t> wire_bytes, Isolate* isolate) {
   std::shared_ptr<NativeModule> native_module =
       native_module_cache_.MaybeGetNativeModule(origin, wire_bytes);
+  bool recompile_module = false;
   if (native_module) {
     base::MutexGuard guard(&mutex_);
     auto& native_module_info = native_modules_[native_module.get()];
@@ -886,13 +1034,20 @@ std::shared_ptr<NativeModule> WasmEngine::MaybeGetNativeModule(
     }
     native_module_info->isolates.insert(isolate);
     isolates_[isolate]->native_modules.insert(native_module.get());
+    if (isolates_[isolate]->keep_tiered_down) {
+      native_module->SetTieringState(kTieredDown);
+      recompile_module = true;
+    }
   }
+  // Potentially recompile the module for tier down, after releasing the mutex.
+  if (recompile_module) native_module->TriggerRecompilation();
   return native_module;
 }
 
 bool WasmEngine::UpdateNativeModuleCache(
     bool error, std::shared_ptr<NativeModule>* native_module,
     Isolate* isolate) {
+  DCHECK_EQ(this, native_module->get()->engine());
   // Pass {native_module} by value here to keep it alive until at least after
   // we returned from {Update}. Otherwise, we might {Erase} it inside {Update}
   // which would lock the mutex twice.
@@ -901,13 +1056,20 @@ bool WasmEngine::UpdateNativeModuleCache(
 
   if (prev == native_module->get()) return true;
 
-  base::MutexGuard guard(&mutex_);
-  auto& native_module_info = native_modules_[native_module->get()];
-  if (!native_module_info) {
-    native_module_info = std::make_unique<NativeModuleInfo>();
+  bool recompile_module = false;
+  {
+    base::MutexGuard guard(&mutex_);
+    DCHECK_EQ(1, native_modules_.count(native_module->get()));
+    native_modules_[native_module->get()]->isolates.insert(isolate);
+    DCHECK_EQ(1, isolates_.count(isolate));
+    isolates_[isolate]->native_modules.insert(native_module->get());
+    if (isolates_[isolate]->keep_tiered_down) {
+      native_module->get()->SetTieringState(kTieredDown);
+      recompile_module = true;
+    }
   }
-  native_module_info->isolates.insert(isolate);
-  isolates_[isolate]->native_modules.insert((*native_module).get());
+  // Potentially recompile the module for tier down, after releasing the mutex.
+  if (recompile_module) native_module->get()->TriggerRecompilation();
   return false;
 }
 
@@ -928,6 +1090,7 @@ void WasmEngine::FreeNativeModule(NativeModule* native_module) {
     IsolateInfo* info = isolates_[isolate].get();
     DCHECK_EQ(1, info->native_modules.count(native_module));
     info->native_modules.erase(native_module);
+    info->scripts.erase(native_module);
     // If there are {WasmCode} objects of the deleted {NativeModule}
     // outstanding to be logged in this isolate, remove them. Decrementing the
     // ref count is not needed, since the {NativeModule} dies anyway.
@@ -1018,8 +1181,8 @@ void WasmEngine::ReportLiveCodeFromStackForGC(Isolate* isolate) {
   std::unordered_set<wasm::WasmCode*> live_wasm_code;
   for (StackFrameIterator it(isolate); !it.done(); it.Advance()) {
     StackFrame* const frame = it.frame();
-    if (frame->type() != StackFrame::WASM_COMPILED) continue;
-    live_wasm_code.insert(WasmCompiledFrame::cast(frame)->wasm_code());
+    if (frame->type() != StackFrame::WASM) continue;
+    live_wasm_code.insert(WasmFrame::cast(frame)->wasm_code());
   }
 
   CheckNoArchivedThreads(isolate);
@@ -1089,7 +1252,37 @@ void WasmEngine::FreeDeadCodeLocked(const DeadCodeMap& dead_code) {
   }
 }
 
+Handle<Script> WasmEngine::GetOrCreateScript(
+    Isolate* isolate, const std::shared_ptr<NativeModule>& native_module,
+    Vector<const char> source_url) {
+  {
+    base::MutexGuard guard(&mutex_);
+    DCHECK_EQ(1, isolates_.count(isolate));
+    auto& scripts = isolates_[isolate]->scripts;
+    auto it = scripts.find(native_module.get());
+    if (it != scripts.end()) {
+      Handle<Script> weak_global_handle = it->second.handle();
+      if (weak_global_handle.is_null()) {
+        scripts.erase(it);
+      } else {
+        return Handle<Script>::New(*weak_global_handle, isolate);
+      }
+    }
+  }
+  // Temporarily release the mutex to let the GC collect native modules.
+  auto script = CreateWasmScript(isolate, native_module, source_url);
+  {
+    base::MutexGuard guard(&mutex_);
+    DCHECK_EQ(1, isolates_.count(isolate));
+    auto& scripts = isolates_[isolate]->scripts;
+    DCHECK_EQ(0, scripts.count(native_module.get()));
+    scripts.emplace(native_module.get(), WeakScriptHandle(script));
+    return script;
+  }
+}
+
 void WasmEngine::TriggerGC(int8_t gc_sequence_index) {
+  DCHECK(!mutex_.TryLock());
   DCHECK_NULL(current_gc_info_);
   DCHECK(FLAG_wasm_code_gc);
   new_potentially_dead_code_size_ = 0;
@@ -1117,6 +1310,11 @@ void WasmEngine::TriggerGC(int8_t gc_sequence_index) {
   TRACE_CODE_GC(
       "Starting GC. Total number of potentially dead code objects: %zu\n",
       current_gc_info_->dead_code.size());
+  // Ensure that there are outstanding isolates that will eventually finish this
+  // GC. If there are no outstanding isolates, we finish the GC immediately.
+  PotentiallyFinishCurrentGC();
+  DCHECK(current_gc_info_ == nullptr ||
+         !current_gc_info_->outstanding_isolates.empty());
 }
 
 bool WasmEngine::RemoveIsolateFromCurrentGC(Isolate* isolate) {
diff --git a/deps/v8/src/wasm/wasm-engine.h b/deps/v8/src/wasm/wasm-engine.h
index 7d14fef5061..8e59b3f5df6 100644
--- a/deps/v8/src/wasm/wasm-engine.h
+++ b/deps/v8/src/wasm/wasm-engine.h
@@ -31,15 +31,17 @@ class JSArrayBuffer;
 
 namespace wasm {
 
+#ifdef V8_ENABLE_WASM_GDB_REMOTE_DEBUGGING
+namespace gdb_server {
+class GdbServer;
+}
+#endif  // V8_ENABLE_WASM_GDB_REMOTE_DEBUGGING
+
 class AsyncCompileJob;
 class ErrorThrower;
 struct ModuleWireBytes;
 class WasmFeatures;
 
-namespace gdb_server {
-class GdbServer;
-}
-
 class V8_EXPORT_PRIVATE CompilationResultResolver {
  public:
   virtual void OnCompilationSucceeded(Handle<WasmModuleObject> result) = 0;
@@ -193,10 +195,6 @@ class V8_EXPORT_PRIVATE WasmEngine {
   void CompileFunction(Isolate* isolate, NativeModule* native_module,
                        uint32_t function_index, ExecutionTier tier);
 
-  // Recompiles all functions at a specific compilation tier.
-  void RecompileAllFunctions(Isolate* isolate, NativeModule* native_module,
-                             ExecutionTier tier);
-
   void TierDownAllModulesPerIsolate(Isolate* isolate);
   void TierUpAllModulesPerIsolate(Isolate* isolate);
 
@@ -208,7 +206,8 @@ class V8_EXPORT_PRIVATE WasmEngine {
   // Imports the shared part of a module from a different Context/Isolate using
   // the the same engine, recreating a full module object in the given Isolate.
   Handle<WasmModuleObject> ImportNativeModule(
-      Isolate* isolate, std::shared_ptr<NativeModule> shared_module);
+      Isolate* isolate, std::shared_ptr<NativeModule> shared_module,
+      Vector<const char> source_url);
 
   WasmCodeManager* code_manager() { return &code_manager_; }
 
@@ -335,6 +334,10 @@ class V8_EXPORT_PRIVATE WasmEngine {
   void FreeDeadCode(const DeadCodeMap&);
   void FreeDeadCodeLocked(const DeadCodeMap&);
 
+  Handle<Script> GetOrCreateScript(Isolate*,
+                                   const std::shared_ptr<NativeModule>&,
+                                   Vector<const char> source_url = {});
+
   // Call on process start and exit.
   static void InitializeOncePerProcess();
   static void GlobalTearDown();
diff --git a/deps/v8/src/wasm/wasm-external-refs.cc b/deps/v8/src/wasm/wasm-external-refs.cc
index 6dbb9393849..c06904af48b 100644
--- a/deps/v8/src/wasm/wasm-external-refs.cc
+++ b/deps/v8/src/wasm/wasm-external-refs.cc
@@ -230,6 +230,82 @@ int32_t float64_to_uint64_wrapper(Address data) {
   return 0;
 }
 
+void float32_to_int64_sat_wrapper(Address data) {
+  float input = ReadUnalignedValue<float>(data);
+  // We use "<" here to check the upper bound because of rounding problems: With
+  // "<=" some inputs would be considered within int64 range which are actually
+  // not within int64 range.
+  if (input < static_cast<float>(std::numeric_limits<int64_t>::max()) &&
+      input >= static_cast<float>(std::numeric_limits<int64_t>::min())) {
+    WriteUnalignedValue<int64_t>(data, static_cast<int64_t>(input));
+    return;
+  }
+  if (std::isnan(input)) {
+    WriteUnalignedValue<int64_t>(data, 0);
+    return;
+  }
+  if (input < 0.0) {
+    WriteUnalignedValue<int64_t>(data, std::numeric_limits<int64_t>::min());
+    return;
+  }
+  WriteUnalignedValue<int64_t>(data, std::numeric_limits<int64_t>::max());
+}
+
+void float32_to_uint64_sat_wrapper(Address data) {
+  float input = ReadUnalignedValue<float>(data);
+  // We use "<" here to check the upper bound because of rounding problems: With
+  // "<=" some inputs would be considered within uint64 range which are actually
+  // not within uint64 range.
+  if (input < static_cast<float>(std::numeric_limits<uint64_t>::max()) &&
+      input >= 0.0) {
+    WriteUnalignedValue<uint64_t>(data, static_cast<uint64_t>(input));
+    return;
+  }
+  if (input >= std::numeric_limits<uint64_t>::max()) {
+    WriteUnalignedValue<uint64_t>(data, std::numeric_limits<uint64_t>::max());
+    return;
+  }
+  WriteUnalignedValue<uint64_t>(data, 0);
+}
+
+void float64_to_int64_sat_wrapper(Address data) {
+  double input = ReadUnalignedValue<double>(data);
+  // We use "<" here to check the upper bound because of rounding problems: With
+  // "<=" some inputs would be considered within int64 range which are actually
+  // not within int64 range.
+  if (input < static_cast<double>(std::numeric_limits<int64_t>::max()) &&
+      input >= static_cast<double>(std::numeric_limits<int64_t>::min())) {
+    WriteUnalignedValue<int64_t>(data, static_cast<int64_t>(input));
+    return;
+  }
+  if (std::isnan(input)) {
+    WriteUnalignedValue<int64_t>(data, 0);
+    return;
+  }
+  if (input < 0.0) {
+    WriteUnalignedValue<int64_t>(data, std::numeric_limits<int64_t>::min());
+    return;
+  }
+  WriteUnalignedValue<int64_t>(data, std::numeric_limits<int64_t>::max());
+}
+
+void float64_to_uint64_sat_wrapper(Address data) {
+  double input = ReadUnalignedValue<double>(data);
+  // We use "<" here to check the upper bound because of rounding problems: With
+  // "<=" some inputs would be considered within int64 range which are actually
+  // not within int64 range.
+  if (input < static_cast<double>(std::numeric_limits<uint64_t>::max()) &&
+      input >= 0.0) {
+    WriteUnalignedValue<uint64_t>(data, static_cast<uint64_t>(input));
+    return;
+  }
+  if (input >= std::numeric_limits<uint64_t>::max()) {
+    WriteUnalignedValue<uint64_t>(data, std::numeric_limits<uint64_t>::max());
+    return;
+  }
+  WriteUnalignedValue<uint64_t>(data, 0);
+}
+
 int32_t int64_div_wrapper(Address data) {
   int64_t dividend = ReadUnalignedValue<int64_t>(data);
   int64_t divisor = ReadUnalignedValue<int64_t>(data + sizeof(dividend));
diff --git a/deps/v8/src/wasm/wasm-external-refs.h b/deps/v8/src/wasm/wasm-external-refs.h
index 0a2d5f30602..6d70b8dcfdc 100644
--- a/deps/v8/src/wasm/wasm-external-refs.h
+++ b/deps/v8/src/wasm/wasm-external-refs.h
@@ -45,6 +45,14 @@ V8_EXPORT_PRIVATE int32_t float64_to_int64_wrapper(Address data);
 
 V8_EXPORT_PRIVATE int32_t float64_to_uint64_wrapper(Address data);
 
+V8_EXPORT_PRIVATE void float32_to_int64_sat_wrapper(Address data);
+
+V8_EXPORT_PRIVATE void float32_to_uint64_sat_wrapper(Address data);
+
+V8_EXPORT_PRIVATE void float64_to_int64_sat_wrapper(Address data);
+
+V8_EXPORT_PRIVATE void float64_to_uint64_sat_wrapper(Address data);
+
 V8_EXPORT_PRIVATE int32_t int64_div_wrapper(Address data);
 
 V8_EXPORT_PRIVATE int32_t int64_mod_wrapper(Address data);
diff --git a/deps/v8/src/wasm/wasm-feature-flags.h b/deps/v8/src/wasm/wasm-feature-flags.h
index 4ae5de91095..0abdd908a06 100644
--- a/deps/v8/src/wasm/wasm-feature-flags.h
+++ b/deps/v8/src/wasm/wasm-feature-flags.h
@@ -27,7 +27,18 @@
                                                                                \
   /* No official proposal (yet?). */                                           \
   /* V8 side owner: clemensb */                                                \
-  V(compilation_hints, "compilation hints section", false)
+  V(compilation_hints, "compilation hints section", false)                     \
+                                                                               \
+  /* GC proposal (early prototype, might change dramatically) */               \
+  /* Official proposal: https://github.com/WebAssembly/gc */                   \
+  /* Prototype engineering spec: https://bit.ly/3cWcm6Q */                     \
+  /* V8 side owner: jkummerow */                                               \
+  V(gc, "garbage collection", false)                                           \
+                                                                               \
+  /* Typed function references proposal. */                                    \
+  /* Official proposal: https://github.com/WebAssembly/function-references */  \
+  /* V8 side owner: ahaas */                                                   \
+  V(typed_funcref, "typed function references", false)
 
 // #############################################################################
 // Staged features (disabled by default, but enabled via --wasm-staging (also
diff --git a/deps/v8/src/wasm/wasm-features.cc b/deps/v8/src/wasm/wasm-features.cc
index 2e0909a8e33..42ae237ed29 100644
--- a/deps/v8/src/wasm/wasm-features.cc
+++ b/deps/v8/src/wasm/wasm-features.cc
@@ -27,6 +27,9 @@ WasmFeatures WasmFeatures::FromIsolate(Isolate* isolate) {
   if (isolate->AreWasmThreadsEnabled(handle(isolate->context(), isolate))) {
     features.Add(kFeature_threads);
   }
+  if (isolate->IsWasmSimdEnabled(handle(isolate->context(), isolate))) {
+    features.Add(kFeature_simd);
+  }
   return features;
 }
 
diff --git a/deps/v8/src/wasm/wasm-interpreter.cc b/deps/v8/src/wasm/wasm-interpreter.cc
index b1dc8f22efb..5375ae76ecc 100644
--- a/deps/v8/src/wasm/wasm-interpreter.cc
+++ b/deps/v8/src/wasm/wasm-interpreter.cc
@@ -50,8 +50,6 @@ using base::WriteUnalignedValue;
 #define LANE(i, type) (i)
 #endif
 
-#define FOREACH_INTERNAL_OPCODE(V) V(Breakpoint, 0xFF)
-
 #define FOREACH_SIMPLE_BINOP(V) \
   V(I32Add, uint32_t, +)        \
   V(I32Sub, uint32_t, -)        \
@@ -624,23 +622,6 @@ inline int64_t ExecuteI64ReinterpretF64(WasmValue a) {
   return a.to_f64_boxed().get_bits();
 }
 
-enum InternalOpcode {
-#define DECL_INTERNAL_ENUM(name, value) kInternal##name = value,
-  FOREACH_INTERNAL_OPCODE(DECL_INTERNAL_ENUM)
-#undef DECL_INTERNAL_ENUM
-};
-
-const char* OpcodeName(uint32_t val) {
-  switch (val) {
-#define DECL_INTERNAL_CASE(name, value) \
-  case kInternal##name:                 \
-    return "Internal" #name;
-    FOREACH_INTERNAL_OPCODE(DECL_INTERNAL_CASE)
-#undef DECL_INTERNAL_CASE
-  }
-  return WasmOpcodes::OpcodeName(static_cast<WasmOpcode>(val));
-}
-
 constexpr int32_t kCatchInArity = 1;
 
 }  // namespace
@@ -651,11 +632,9 @@ class SideTable;
 struct InterpreterCode {
   const WasmFunction* function;  // wasm function
   BodyLocalDecls locals;         // local declarations
-  const byte* orig_start;        // start of original code
-  const byte* orig_end;          // end of original code
-  byte* start;                   // start of (maybe altered) code
-  byte* end;                     // end of (maybe altered) code
-  SideTable* side_table;         // precomputed side table for control flow.
+  const byte* start;             // start of code
+  const byte* end;               // end of code
+  SideTable* side_table;         // precomputed side table for control flow
 
   const byte* at(pc_t pc) { return start + pc; }
 };
@@ -676,9 +655,9 @@ class SideTable : public ZoneObject {
     // Represents a control flow label.
     class CLabel : public ZoneObject {
       explicit CLabel(Zone* zone, int32_t target_stack_height, uint32_t arity)
-          : target_stack_height(target_stack_height),
-            arity(arity),
-            refs(zone) {}
+          : target_stack_height(target_stack_height), arity(arity), refs(zone) {
+        DCHECK_LE(0, target_stack_height);
+      }
 
      public:
       struct Ref {
@@ -769,7 +748,7 @@ class SideTable : public ZoneObject {
         static_cast<uint32_t>(code->function->sig->return_count());
     CLabel* func_label =
         CLabel::New(&control_transfer_zone, stack_height, func_arity);
-    control_stack.emplace_back(code->orig_start, func_label, func_arity);
+    control_stack.emplace_back(code->start, func_label, func_arity);
     auto control_parent = [&]() -> Control& {
       DCHECK_LE(2, control_stack.size());
       return control_stack[control_stack.size() - 2];
@@ -777,7 +756,7 @@ class SideTable : public ZoneObject {
     auto copy_unreachable = [&] {
       control_stack.back().unreachable = control_parent().unreachable;
     };
-    for (BytecodeIterator i(code->orig_start, code->orig_end, &code->locals);
+    for (BytecodeIterator i(code->start, code->end, &code->locals);
          i.has_next(); i.next()) {
       WasmOpcode opcode = i.current();
       int32_t exceptional_stack_height = 0;
@@ -809,7 +788,8 @@ class SideTable : public ZoneObject {
         if (exceptional_stack_height + kCatchInArity > max_stack_height_) {
           max_stack_height_ = exceptional_stack_height + kCatchInArity;
         }
-        TRACE("handler @%u: %s -> try @%u\n", i.pc_offset(), OpcodeName(opcode),
+        TRACE("handler @%u: %s -> try @%u\n", i.pc_offset(),
+              WasmOpcodes::OpcodeName(opcode),
               static_cast<uint32_t>(c->pc - code->start));
       }
       switch (opcode) {
@@ -819,12 +799,18 @@ class SideTable : public ZoneObject {
           BlockTypeImmediate<Decoder::kNoValidate> imm(WasmFeatures::All(), &i,
                                                        i.pc());
           if (imm.type == kWasmBottom) {
-            imm.sig = module->signatures[imm.sig_index];
+            imm.sig = module->signature(imm.sig_index);
           }
           TRACE("control @%u: %s, arity %d->%d\n", i.pc_offset(),
                 is_loop ? "Loop" : "Block", imm.in_arity(), imm.out_arity());
+          DCHECK_IMPLIES(!unreachable,
+                         stack_height >= static_cast<int32_t>(imm.in_arity()));
+          int32_t target_stack_height = stack_height - imm.in_arity();
+          // The stack may underflow in unreachable code. In this case the
+          // stack height is clamped at 0.
+          if (V8_UNLIKELY(target_stack_height < 0)) target_stack_height = 0;
           CLabel* label =
-              CLabel::New(&control_transfer_zone, stack_height - imm.in_arity(),
+              CLabel::New(&control_transfer_zone, target_stack_height,
                           is_loop ? imm.in_arity() : imm.out_arity());
           control_stack.emplace_back(i.pc(), label, imm.out_arity());
           copy_unreachable();
@@ -835,13 +821,18 @@ class SideTable : public ZoneObject {
           BlockTypeImmediate<Decoder::kNoValidate> imm(WasmFeatures::All(), &i,
                                                        i.pc());
           if (imm.type == kWasmBottom) {
-            imm.sig = module->signatures[imm.sig_index];
+            imm.sig = module->signature(imm.sig_index);
           }
           TRACE("control @%u: If, arity %d->%d\n", i.pc_offset(),
                 imm.in_arity(), imm.out_arity());
-          CLabel* end_label =
-              CLabel::New(&control_transfer_zone, stack_height - imm.in_arity(),
-                          imm.out_arity());
+          DCHECK_IMPLIES(!unreachable,
+                         stack_height >= static_cast<int32_t>(imm.in_arity()));
+          int32_t target_stack_height = stack_height - imm.in_arity();
+          // The stack may underflow in unreachable code. In this case the
+          // stack height is clamped at 0.
+          if (V8_UNLIKELY(target_stack_height < 0)) target_stack_height = 0;
+          CLabel* end_label = CLabel::New(&control_transfer_zone,
+                                          target_stack_height, imm.out_arity());
           CLabel* else_label =
               CLabel::New(&control_transfer_zone, stack_height, 0);
           control_stack.emplace_back(i.pc(), end_label, else_label,
@@ -859,7 +850,7 @@ class SideTable : public ZoneObject {
           }
           DCHECK_NOT_NULL(c->else_label);
           c->else_label->Bind(i.pc() + 1);
-          c->else_label->Finish(&map_, code->orig_start);
+          c->else_label->Finish(&map_, code->start);
           stack_height = c->else_label->target_stack_height;
           c->else_label = nullptr;
           DCHECK_IMPLIES(!unreachable,
@@ -870,7 +861,7 @@ class SideTable : public ZoneObject {
           BlockTypeImmediate<Decoder::kNoValidate> imm(WasmFeatures::All(), &i,
                                                        i.pc());
           if (imm.type == kWasmBottom) {
-            imm.sig = module->signatures[imm.sig_index];
+            imm.sig = module->signature(imm.sig_index);
           }
           TRACE("control @%u: Try, arity %d->%d\n", i.pc_offset(),
                 imm.in_arity(), imm.out_arity());
@@ -895,7 +886,7 @@ class SideTable : public ZoneObject {
           }
           DCHECK_NOT_NULL(c->else_label);
           c->else_label->Bind(i.pc() + 1);
-          c->else_label->Finish(&map_, code->orig_start);
+          c->else_label->Finish(&map_, code->start);
           c->else_label = nullptr;
           DCHECK_IMPLIES(!unreachable,
                          stack_height >= c->end_label->target_stack_height);
@@ -924,7 +915,7 @@ class SideTable : public ZoneObject {
             if (c->else_label) c->else_label->Bind(i.pc());
             c->end_label->Bind(i.pc() + 1);
           }
-          c->Finish(&map_, code->orig_start);
+          c->Finish(&map_, code->start);
           DCHECK_IMPLIES(!unreachable,
                          stack_height >= c->end_label->target_stack_height);
           stack_height = c->end_label->target_stack_height + c->exit_arity;
@@ -1030,10 +1021,8 @@ class CodeMap {
 
   void AddFunction(const WasmFunction* function, const byte* code_start,
                    const byte* code_end) {
-    InterpreterCode code = {
-        function, BodyLocalDecls(zone_),         code_start,
-        code_end, const_cast<byte*>(code_start), const_cast<byte*>(code_end),
-        nullptr};
+    InterpreterCode code = {function, BodyLocalDecls(zone_), code_start,
+                            code_end, nullptr};
 
     DCHECK_EQ(interpreter_code_.size(), function->func_index);
     interpreter_code_.push_back(code);
@@ -1044,8 +1033,6 @@ class CodeMap {
     DCHECK_LT(function->func_index, interpreter_code_.size());
     InterpreterCode* code = &interpreter_code_[function->func_index];
     DCHECK_EQ(function, code->function);
-    code->orig_start = start;
-    code->orig_end = end;
     code->start = const_cast<byte*>(start);
     code->end = const_cast<byte*>(end);
     code->side_table = nullptr;
@@ -1055,29 +1042,23 @@ class CodeMap {
 
 namespace {
 
-struct ExternalCallResult {
+struct CallResult {
   enum Type {
     // The function should be executed inside this interpreter.
     INTERNAL,
     // For indirect calls: Table or function does not exist.
     INVALID_FUNC,
     // For indirect calls: Signature does not match expected signature.
-    SIGNATURE_MISMATCH,
-    // The function was executed and returned normally.
-    EXTERNAL_RETURNED,
-    // The function was executed, threw an exception, and the stack was unwound.
-    EXTERNAL_UNWOUND,
-    // The function was executed and threw an exception that was locally caught.
-    EXTERNAL_CAUGHT
+    SIGNATURE_MISMATCH
   };
   Type type;
   // If type is INTERNAL, this field holds the function to call internally.
   InterpreterCode* interpreter_code;
 
-  ExternalCallResult(Type type) : type(type) {  // NOLINT
+  CallResult(Type type) : type(type) {  // NOLINT
     DCHECK_NE(INTERNAL, type);
   }
-  ExternalCallResult(Type type, InterpreterCode* code)
+  CallResult(Type type, InterpreterCode* code)
       : type(type), interpreter_code(code) {
     DCHECK_EQ(INTERNAL, type);
   }
@@ -1239,16 +1220,10 @@ class ThreadImpl {
 
   TrapReason GetTrapReason() { return trap_reason_; }
 
-  pc_t GetBreakpointPc() { return break_pc_; }
-
   bool PossibleNondeterminism() { return possible_nondeterminism_; }
 
   uint64_t NumInterpretedCalls() { return num_interpreted_calls_; }
 
-  void AddBreakFlags(uint8_t flags) { break_flags_ |= flags; }
-
-  void ClearBreakFlags() { break_flags_ = WasmInterpreter::BreakFlag::None; }
-
   Handle<Cell> reference_stack_cell() const { return reference_stack_cell_; }
 
   uint32_t NumActivations() {
@@ -1394,7 +1369,6 @@ class ThreadImpl {
     WasmValue value_;
   };
 
-  friend class InterpretedFrameImpl;
   friend class ReferenceStackScope;
 
   CodeMap* codemap_;
@@ -1409,10 +1383,8 @@ class ThreadImpl {
   Handle<Cell> reference_stack_cell_;  // References are on an on-heap stack.
   ZoneVector<Frame> frames_;
   WasmInterpreter::State state_ = WasmInterpreter::STOPPED;
-  pc_t break_pc_ = kInvalidPc;
   TrapReason trap_reason_ = kTrapCount;
   bool possible_nondeterminism_ = false;
-  uint8_t break_flags_ = 0;  // a combination of WasmInterpreter::BreakFlag
   uint64_t num_interpreted_calls_ = 0;
   // Store the stack height of each activation (for unwind and frame
   // inspection).
@@ -1468,12 +1440,17 @@ class ThreadImpl {
         case ValueType::kAnyRef:
         case ValueType::kFuncRef:
         case ValueType::kNullRef:
-        case ValueType::kExnRef: {
+        case ValueType::kExnRef:
+        case ValueType::kRef:
+        case ValueType::kOptRef:
+        case ValueType::kEqRef: {
           val = WasmValue(isolate_->factory()->null_value());
           break;
         }
         case ValueType::kStmt:
         case ValueType::kBottom:
+        case ValueType::kI8:
+        case ValueType::kI16:
           UNREACHABLE();
           break;
       }
@@ -1487,15 +1464,6 @@ class ThreadImpl {
     frames_.back().pc = pc;
   }
 
-  bool SkipBreakpoint(InterpreterCode* code, pc_t pc) {
-    if (pc == break_pc_) {
-      // Skip the previously hit breakpoint when resuming.
-      break_pc_ = kInvalidPc;
-      return true;
-    }
-    return false;
-  }
-
   void ReloadFromFrameOnException(Decoder* decoder, InterpreterCode** code,
                                   pc_t* pc, pc_t* limit) {
     Frame* top = &frames_.back();
@@ -1524,7 +1492,7 @@ class ThreadImpl {
   }
 
   pc_t ReturnPc(Decoder* decoder, InterpreterCode* code, pc_t pc) {
-    switch (code->orig_start[pc]) {
+    switch (code->start[pc]) {
       case kExprCallFunction: {
         CallFunctionImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc));
         return pc + 1 + imm.length;
@@ -1748,7 +1716,7 @@ class ThreadImpl {
       DoTrap(kTrapUnalignedAccess, pc);
       return false;
     }
-    *len = 2 + imm.length;
+    *len += imm.length;
     return true;
   }
 
@@ -1777,7 +1745,7 @@ class ThreadImpl {
       DoTrap(kTrapUnalignedAccess, pc);
       return false;
     }
-    *len = 2 + imm.length;
+    *len += imm.length;
     return true;
   }
 
@@ -1963,8 +1931,9 @@ class ThreadImpl {
         return true;
       }
       default:
-        FATAL("Unknown or unimplemented opcode #%d:%s", code->start[pc],
-              OpcodeName(code->start[pc]));
+        FATAL(
+            "Unknown or unimplemented opcode #%d:%s", code->start[pc],
+            WasmOpcodes::OpcodeName(static_cast<WasmOpcode>(code->start[pc])));
         UNREACHABLE();
     }
     return false;
@@ -2167,7 +2136,7 @@ class ThreadImpl {
 #undef ATOMIC_STORE_CASE
       case kExprAtomicFence:
         std::atomic_thread_fence(std::memory_order_seq_cst);
-        *len += 2;
+        *len += 1;
         break;
       case kExprI32AtomicWait: {
         int32_t val;
@@ -2223,7 +2192,7 @@ class ThreadImpl {
   }
 
   bool ExecuteSimdOp(WasmOpcode opcode, Decoder* decoder, InterpreterCode* code,
-                     pc_t pc, int* const len) {
+                     pc_t pc, int* const len, uint32_t opcode_length) {
     switch (opcode) {
 #define SPLAT_CASE(format, sType, valType, num) \
   case kExpr##format##Splat: {                  \
@@ -2241,50 +2210,70 @@ class ThreadImpl {
       SPLAT_CASE(I16x8, int8, int32_t, 8)
       SPLAT_CASE(I8x16, int16, int32_t, 16)
 #undef SPLAT_CASE
-#define EXTRACT_LANE_CASE(format, name)                                 \
-  case kExpr##format##ExtractLane: {                                    \
-    SimdLaneImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc)); \
-    *len += 1;                                                          \
-    WasmValue val = Pop();                                              \
-    Simd128 s = val.to_s128();                                          \
-    auto ss = s.to_##name();                                            \
-    Push(WasmValue(ss.val[LANE(imm.lane, ss)]));                        \
-    return true;                                                        \
+#define EXTRACT_LANE_CASE(format, name)                                \
+  case kExpr##format##ExtractLane: {                                   \
+    SimdLaneImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc), \
+                                                opcode_length);        \
+    *len += 1;                                                         \
+    WasmValue val = Pop();                                             \
+    Simd128 s = val.to_s128();                                         \
+    auto ss = s.to_##name();                                           \
+    Push(WasmValue(ss.val[LANE(imm.lane, ss)]));                       \
+    return true;                                                       \
   }
       EXTRACT_LANE_CASE(F64x2, f64x2)
       EXTRACT_LANE_CASE(F32x4, f32x4)
       EXTRACT_LANE_CASE(I64x2, i64x2)
       EXTRACT_LANE_CASE(I32x4, i32x4)
 #undef EXTRACT_LANE_CASE
-#define EXTRACT_LANE_EXTEND_CASE(format, name, sign, type)              \
-  case kExpr##format##ExtractLane##sign: {                              \
-    SimdLaneImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc)); \
-    *len += 1;                                                          \
-    WasmValue val = Pop();                                              \
-    Simd128 s = val.to_s128();                                          \
-    auto ss = s.to_##name();                                            \
-    Push(WasmValue(static_cast<type>(ss.val[LANE(imm.lane, ss)])));     \
-    return true;                                                        \
+
+      // Unsigned extracts require a bit more care. The underlying array in
+      // Simd128 is signed (see wasm-value.h), so when casted to uint32_t it
+      // will be signed extended, e.g. int8_t -> int32_t -> uint32_t. So for
+      // unsigned extracts, we will cast it int8_t -> uint8_t -> uint32_t. We
+      // add the DCHECK to ensure that if the array type changes, we know to
+      // change this function.
+#define EXTRACT_LANE_EXTEND_CASE(format, name, sign, extended_type)      \
+  case kExpr##format##ExtractLane##sign: {                               \
+    SimdLaneImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc),   \
+                                                opcode_length);          \
+    *len += 1;                                                           \
+    WasmValue val = Pop();                                               \
+    Simd128 s = val.to_s128();                                           \
+    auto ss = s.to_##name();                                             \
+    auto res = ss.val[LANE(imm.lane, ss)];                               \
+    DCHECK(std::is_signed<decltype(res)>::value);                        \
+    if (std::is_unsigned<extended_type>::value) {                        \
+      using unsigned_type = std::make_unsigned<decltype(res)>::type;     \
+      Push(WasmValue(                                                    \
+          static_cast<extended_type>(static_cast<unsigned_type>(res)))); \
+    } else {                                                             \
+      Push(WasmValue(static_cast<extended_type>(res)));                  \
+    }                                                                    \
+    return true;                                                         \
   }
       EXTRACT_LANE_EXTEND_CASE(I16x8, i16x8, S, int32_t)
       EXTRACT_LANE_EXTEND_CASE(I16x8, i16x8, U, uint32_t)
       EXTRACT_LANE_EXTEND_CASE(I8x16, i8x16, S, int32_t)
       EXTRACT_LANE_EXTEND_CASE(I8x16, i8x16, U, uint32_t)
 #undef EXTRACT_LANE_EXTEND_CASE
-#define BINOP_CASE(op, name, stype, count, expr) \
-  case kExpr##op: {                              \
-    WasmValue v2 = Pop();                        \
-    WasmValue v1 = Pop();                        \
-    stype s1 = v1.to_s128().to_##name();         \
-    stype s2 = v2.to_s128().to_##name();         \
-    stype res;                                   \
-    for (size_t i = 0; i < count; ++i) {         \
-      auto a = s1.val[LANE(i, s1)];              \
-      auto b = s2.val[LANE(i, s1)];              \
-      res.val[LANE(i, s1)] = expr;               \
-    }                                            \
-    Push(WasmValue(Simd128(res)));               \
-    return true;                                 \
+
+#define BINOP_CASE(op, name, stype, count, expr)              \
+  case kExpr##op: {                                           \
+    WasmValue v2 = Pop();                                     \
+    WasmValue v1 = Pop();                                     \
+    stype s1 = v1.to_s128().to_##name();                      \
+    stype s2 = v2.to_s128().to_##name();                      \
+    stype res;                                                \
+    for (size_t i = 0; i < count; ++i) {                      \
+      auto a = s1.val[LANE(i, s1)];                           \
+      auto b = s2.val[LANE(i, s1)];                           \
+      auto result = expr;                                     \
+      possible_nondeterminism_ |= has_nondeterminism(result); \
+      res.val[LANE(i, s1)] = expr;                            \
+    }                                                         \
+    Push(WasmValue(Simd128(res)));                            \
+    return true;                                              \
   }
       BINOP_CASE(F64x2Add, f64x2, float2, 2, a + b)
       BINOP_CASE(F64x2Sub, f64x2, float2, 2, a - b)
@@ -2292,12 +2281,16 @@ class ThreadImpl {
       BINOP_CASE(F64x2Div, f64x2, float2, 2, base::Divide(a, b))
       BINOP_CASE(F64x2Min, f64x2, float2, 2, JSMin(a, b))
       BINOP_CASE(F64x2Max, f64x2, float2, 2, JSMax(a, b))
+      BINOP_CASE(F64x2Pmin, f64x2, float2, 2, std::min(a, b))
+      BINOP_CASE(F64x2Pmax, f64x2, float2, 2, std::max(a, b))
       BINOP_CASE(F32x4Add, f32x4, float4, 4, a + b)
       BINOP_CASE(F32x4Sub, f32x4, float4, 4, a - b)
       BINOP_CASE(F32x4Mul, f32x4, float4, 4, a * b)
       BINOP_CASE(F32x4Div, f32x4, float4, 4, a / b)
       BINOP_CASE(F32x4Min, f32x4, float4, 4, JSMin(a, b))
       BINOP_CASE(F32x4Max, f32x4, float4, 4, JSMax(a, b))
+      BINOP_CASE(F32x4Pmin, f32x4, float4, 4, std::min(a, b))
+      BINOP_CASE(F32x4Pmax, f32x4, float4, 4, std::max(a, b))
       BINOP_CASE(I64x2Add, i64x2, int2, 2, base::AddWithWraparound(a, b))
       BINOP_CASE(I64x2Sub, i64x2, int2, 2, base::SubWithWraparound(a, b))
       BINOP_CASE(I64x2Mul, i64x2, int2, 2, base::MulWithWraparound(a, b))
@@ -2353,17 +2346,19 @@ class ThreadImpl {
       BINOP_CASE(I8x16RoundingAverageU, i8x16, int16, 16,
                  base::RoundingAverageUnsigned<uint8_t>(a, b))
 #undef BINOP_CASE
-#define UNOP_CASE(op, name, stype, count, expr) \
-  case kExpr##op: {                             \
-    WasmValue v = Pop();                        \
-    stype s = v.to_s128().to_##name();          \
-    stype res;                                  \
-    for (size_t i = 0; i < count; ++i) {        \
-      auto a = s.val[i];                        \
-      res.val[i] = expr;                        \
-    }                                           \
-    Push(WasmValue(Simd128(res)));              \
-    return true;                                \
+#define UNOP_CASE(op, name, stype, count, expr)               \
+  case kExpr##op: {                                           \
+    WasmValue v = Pop();                                      \
+    stype s = v.to_s128().to_##name();                        \
+    stype res;                                                \
+    for (size_t i = 0; i < count; ++i) {                      \
+      auto a = s.val[i];                                      \
+      auto result = expr;                                     \
+      possible_nondeterminism_ |= has_nondeterminism(result); \
+      res.val[i] = result;                                    \
+    }                                                         \
+    Push(WasmValue(Simd128(res)));                            \
+    return true;                                              \
   }
       UNOP_CASE(F64x2Abs, f64x2, float2, 2, std::abs(a))
       UNOP_CASE(F64x2Neg, f64x2, float2, 2, -a)
@@ -2373,6 +2368,10 @@ class ThreadImpl {
       UNOP_CASE(F32x4Sqrt, f32x4, float4, 4, std::sqrt(a))
       UNOP_CASE(F32x4RecipApprox, f32x4, float4, 4, base::Recip(a))
       UNOP_CASE(F32x4RecipSqrtApprox, f32x4, float4, 4, base::RecipSqrt(a))
+      UNOP_CASE(F32x4Ceil, f32x4, float4, 4, ceilf(a))
+      UNOP_CASE(F32x4Floor, f32x4, float4, 4, floorf(a))
+      UNOP_CASE(F32x4Trunc, f32x4, float4, 4, truncf(a))
+      UNOP_CASE(F32x4NearestInt, f32x4, float4, 4, nearbyintf(a))
       UNOP_CASE(I64x2Neg, i64x2, int2, 2, base::NegateWithWraparound(a))
       UNOP_CASE(I32x4Neg, i32x4, int4, 4, base::NegateWithWraparound(a))
       UNOP_CASE(I32x4Abs, i32x4, int4, 4, std::abs(a))
@@ -2385,37 +2384,39 @@ class ThreadImpl {
 
 // Cast to double in call to signbit is due to MSCV issue, see
 // https://github.com/microsoft/STL/issues/519.
-#define BITMASK_CASE(op, name, stype, count)                   \
-  case kExpr##op: {                                            \
-    WasmValue v = Pop();                                       \
-    stype s = v.to_s128().to_##name();                         \
-    int32_t res = 0;                                           \
-    for (size_t i = 0; i < count; ++i) {                       \
-      bool sign = std::signbit(static_cast<double>(s.val[i])); \
-      res |= (sign << i);                                      \
-    }                                                          \
-    Push(WasmValue(res));                                      \
-    return true;                                               \
+#define BITMASK_CASE(op, name, stype, count)                            \
+  case kExpr##op: {                                                     \
+    WasmValue v = Pop();                                                \
+    stype s = v.to_s128().to_##name();                                  \
+    int32_t res = 0;                                                    \
+    for (size_t i = 0; i < count; ++i) {                                \
+      bool sign = std::signbit(static_cast<double>(s.val[LANE(i, s)])); \
+      res |= (sign << i);                                               \
+    }                                                                   \
+    Push(WasmValue(res));                                               \
+    return true;                                                        \
   }
       BITMASK_CASE(I8x16BitMask, i8x16, int16, 16)
       BITMASK_CASE(I16x8BitMask, i16x8, int8, 8)
       BITMASK_CASE(I32x4BitMask, i32x4, int4, 4)
 #undef BITMASK_CASE
 
-#define CMPOP_CASE(op, name, stype, out_stype, count, expr) \
-  case kExpr##op: {                                         \
-    WasmValue v2 = Pop();                                   \
-    WasmValue v1 = Pop();                                   \
-    stype s1 = v1.to_s128().to_##name();                    \
-    stype s2 = v2.to_s128().to_##name();                    \
-    out_stype res;                                          \
-    for (size_t i = 0; i < count; ++i) {                    \
-      auto a = s1.val[i];                                   \
-      auto b = s2.val[i];                                   \
-      res.val[i] = expr ? -1 : 0;                           \
-    }                                                       \
-    Push(WasmValue(Simd128(res)));                          \
-    return true;                                            \
+#define CMPOP_CASE(op, name, stype, out_stype, count, expr)   \
+  case kExpr##op: {                                           \
+    WasmValue v2 = Pop();                                     \
+    WasmValue v1 = Pop();                                     \
+    stype s1 = v1.to_s128().to_##name();                      \
+    stype s2 = v2.to_s128().to_##name();                      \
+    out_stype res;                                            \
+    for (size_t i = 0; i < count; ++i) {                      \
+      auto a = s1.val[i];                                     \
+      auto b = s2.val[i];                                     \
+      auto result = expr;                                     \
+      possible_nondeterminism_ |= has_nondeterminism(result); \
+      res.val[i] = result ? -1 : 0;                           \
+    }                                                         \
+    Push(WasmValue(Simd128(res)));                            \
+    return true;                                              \
   }
       CMPOP_CASE(F64x2Eq, f64x2, float2, int2, 2, a == b)
       CMPOP_CASE(F64x2Ne, f64x2, float2, int2, 2, a != b)
@@ -2486,16 +2487,17 @@ class ThreadImpl {
       CMPOP_CASE(I8x16LeU, i8x16, int16, int16, 16,
                  static_cast<uint8_t>(a) <= static_cast<uint8_t>(b))
 #undef CMPOP_CASE
-#define REPLACE_LANE_CASE(format, name, stype, ctype)                   \
-  case kExpr##format##ReplaceLane: {                                    \
-    SimdLaneImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc)); \
-    *len += 1;                                                          \
-    WasmValue new_val = Pop();                                          \
-    WasmValue simd_val = Pop();                                         \
-    stype s = simd_val.to_s128().to_##name();                           \
-    s.val[LANE(imm.lane, s)] = new_val.to<ctype>();                     \
-    Push(WasmValue(Simd128(s)));                                        \
-    return true;                                                        \
+#define REPLACE_LANE_CASE(format, name, stype, ctype)                  \
+  case kExpr##format##ReplaceLane: {                                   \
+    SimdLaneImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc), \
+                                                opcode_length);        \
+    *len += 1;                                                         \
+    WasmValue new_val = Pop();                                         \
+    WasmValue simd_val = Pop();                                        \
+    stype s = simd_val.to_s128().to_##name();                          \
+    s.val[LANE(imm.lane, s)] = new_val.to<ctype>();                    \
+    Push(WasmValue(Simd128(s)));                                       \
+    return true;                                                       \
   }
       REPLACE_LANE_CASE(F64x2, f64x2, float2, double)
       REPLACE_LANE_CASE(F32x4, f32x4, float4, float)
@@ -2507,11 +2509,11 @@ class ThreadImpl {
       case kExprS128LoadMem:
         return ExecuteLoad<Simd128, Simd128>(decoder, code, pc, len,
                                              MachineRepresentation::kSimd128,
-                                             /*prefix_len=*/1);
+                                             /*prefix_len=*/opcode_length);
       case kExprS128StoreMem:
         return ExecuteStore<Simd128, Simd128>(decoder, code, pc, len,
                                               MachineRepresentation::kSimd128,
-                                              /*prefix_len=*/1);
+                                              /*prefix_len=*/opcode_length);
 #define SHIFT_CASE(op, name, stype, count, expr) \
   case kExpr##op: {                              \
     uint32_t shift = Pop().to<uint32_t>();       \
@@ -2554,6 +2556,8 @@ class ThreadImpl {
     dst_type res;                                                             \
     for (size_t i = 0; i < count; ++i) {                                      \
       ctype a = s.val[LANE(start_index + i, s)];                              \
+      auto result = expr;                                                     \
+      possible_nondeterminism_ |= has_nondeterminism(result);                 \
       res.val[LANE(i, res)] = expr;                                           \
     }                                                                         \
     Push(WasmValue(Simd128(res)));                                            \
@@ -2622,21 +2626,23 @@ class ThreadImpl {
         Push(WasmValue(Simd128(res)));
         return true;
       }
-#define ADD_HORIZ_CASE(op, name, stype, count)                   \
-  case kExpr##op: {                                              \
-    WasmValue v2 = Pop();                                        \
-    WasmValue v1 = Pop();                                        \
-    stype s1 = v1.to_s128().to_##name();                         \
-    stype s2 = v2.to_s128().to_##name();                         \
-    stype res;                                                   \
-    for (size_t i = 0; i < count / 2; ++i) {                     \
-      res.val[LANE(i, s1)] =                                     \
-          s1.val[LANE(i * 2, s1)] + s1.val[LANE(i * 2 + 1, s1)]; \
-      res.val[LANE(i + count / 2, s1)] =                         \
-          s2.val[LANE(i * 2, s1)] + s2.val[LANE(i * 2 + 1, s1)]; \
-    }                                                            \
-    Push(WasmValue(Simd128(res)));                               \
-    return true;                                                 \
+#define ADD_HORIZ_CASE(op, name, stype, count)                              \
+  case kExpr##op: {                                                         \
+    WasmValue v2 = Pop();                                                   \
+    WasmValue v1 = Pop();                                                   \
+    stype s1 = v1.to_s128().to_##name();                                    \
+    stype s2 = v2.to_s128().to_##name();                                    \
+    stype res;                                                              \
+    for (size_t i = 0; i < count / 2; ++i) {                                \
+      auto result1 = s1.val[LANE(i * 2, s1)] + s1.val[LANE(i * 2 + 1, s1)]; \
+      possible_nondeterminism_ |= has_nondeterminism(result1);              \
+      res.val[LANE(i, s1)] = result1;                                       \
+      auto result2 = s2.val[LANE(i * 2, s1)] + s2.val[LANE(i * 2 + 1, s1)]; \
+      possible_nondeterminism_ |= has_nondeterminism(result2);              \
+      res.val[LANE(i + count / 2, s1)] = result2;                           \
+    }                                                                       \
+    Push(WasmValue(Simd128(res)));                                          \
+    return true;                                                            \
   }
         ADD_HORIZ_CASE(I32x4AddHoriz, i32x4, int4, 4)
         ADD_HORIZ_CASE(F32x4AddHoriz, f32x4, float4, 4)
@@ -2655,8 +2661,8 @@ class ThreadImpl {
         return true;
       }
       case kExprS8x16Shuffle: {
-        Simd8x16ShuffleImmediate<Decoder::kNoValidate> imm(decoder,
-                                                           code->at(pc));
+        Simd8x16ShuffleImmediate<Decoder::kNoValidate> imm(
+            decoder, code->at(pc), opcode_length);
         *len += 16;
         int16 v2 = Pop().to_s128().to_i8x16();
         int16 v1 = Pop().to_s128().to_i8x16();
@@ -2670,10 +2676,10 @@ class ThreadImpl {
         Push(WasmValue(Simd128(res)));
         return true;
       }
-      case kExprS1x2AnyTrue:
-      case kExprS1x4AnyTrue:
-      case kExprS1x8AnyTrue:
-      case kExprS1x16AnyTrue: {
+      case kExprV64x2AnyTrue:
+      case kExprV32x4AnyTrue:
+      case kExprV16x8AnyTrue:
+      case kExprV8x16AnyTrue: {
         int4 s = Pop().to_s128().to_i32x4();
         bool res = s.val[0] | s.val[1] | s.val[2] | s.val[3];
         Push(WasmValue((res)));
@@ -2689,10 +2695,10 @@ class ThreadImpl {
     Push(WasmValue(res));                                 \
     return true;                                          \
   }
-        REDUCTION_CASE(S1x2AllTrue, i64x2, int2, 2, &)
-        REDUCTION_CASE(S1x4AllTrue, i32x4, int4, 4, &)
-        REDUCTION_CASE(S1x8AllTrue, i16x8, int8, 8, &)
-        REDUCTION_CASE(S1x16AllTrue, i8x16, int16, 16, &)
+        REDUCTION_CASE(V64x2AllTrue, i64x2, int2, 2, &)
+        REDUCTION_CASE(V32x4AllTrue, i32x4, int4, 4, &)
+        REDUCTION_CASE(V16x8AllTrue, i16x8, int8, 8, &)
+        REDUCTION_CASE(V8x16AllTrue, i8x16, int16, 16, &)
 #undef REDUCTION_CASE
 #define QFM_CASE(op, name, stype, count, operation)         \
   case kExpr##op: {                                         \
@@ -2759,13 +2765,16 @@ class ThreadImpl {
   template <typename s_type, typename result_type, typename load_type>
   bool DoSimdLoadSplat(Decoder* decoder, InterpreterCode* code, pc_t pc,
                        int* const len, MachineRepresentation rep) {
+    // len is the number of bytes the make up this op, including prefix byte, so
+    // the prefix_len for ExecuteLoad is len, minus the prefix byte itself.
+    // Think of prefix_len as: number of extra bytes that make up this op.
     if (!ExecuteLoad<result_type, load_type>(decoder, code, pc, len, rep,
-                                             /*prefix_len=*/1)) {
+                                             /*prefix_len=*/*len - 1)) {
       return false;
     }
     result_type v = Pop().to<result_type>();
     s_type s;
-    for (size_t i = 0; i < arraysize(s.val); i++) s.val[i] = v;
+    for (size_t i = 0; i < arraysize(s.val); i++) s.val[LANE(i, s)] = v;
     Push(WasmValue(Simd128(s)));
     return true;
   }
@@ -2776,7 +2785,7 @@ class ThreadImpl {
     static_assert(sizeof(wide_type) == sizeof(narrow_type) * 2,
                   "size mismatch for wide and narrow types");
     if (!ExecuteLoad<uint64_t, uint64_t>(decoder, code, pc, len, rep,
-                                         /*prefix_len=*/1)) {
+                                         /*prefix_len=*/*len - 1)) {
       return false;
     }
     constexpr int lanes = kSimd128Size / sizeof(wide_type);
@@ -2785,7 +2794,7 @@ class ThreadImpl {
     for (int i = 0; i < lanes; i++) {
       uint8_t shift = i * (sizeof(narrow_type) * 8);
       narrow_type el = static_cast<narrow_type>(v >> shift);
-      s.val[i] = static_cast<wide_type>(el);
+      s.val[LANE(i, s)] = static_cast<wide_type>(el);
     }
     Push(WasmValue(Simd128(s)));
     return true;
@@ -2890,6 +2899,13 @@ class ThreadImpl {
           encoded_values->set(encoded_index++, *anyref);
           break;
         }
+        case ValueType::kRef:
+        case ValueType::kOptRef:
+        case ValueType::kEqRef:
+          // TODO(7748): Implement these.
+          UNIMPLEMENTED();
+        case ValueType::kI8:
+        case ValueType::kI16:
         case ValueType::kStmt:
         case ValueType::kBottom:
           UNREACHABLE();
@@ -2995,6 +3011,13 @@ class ThreadImpl {
           value = WasmValue(anyref);
           break;
         }
+        case ValueType::kRef:
+        case ValueType::kOptRef:
+        case ValueType::kEqRef:
+          // TODO(7748): Implement these.
+          UNIMPLEMENTED();
+        case ValueType::kI8:
+        case ValueType::kI16:
         case ValueType::kStmt:
         case ValueType::kBottom:
           UNREACHABLE();
@@ -3020,42 +3043,21 @@ class ThreadImpl {
 
     Decoder decoder(code->start, code->end);
     pc_t limit = code->end - code->start;
-    bool hit_break = false;
 
     while (true) {
-#define PAUSE_IF_BREAK_FLAG(flag)                                     \
-  if (V8_UNLIKELY(break_flags_ & WasmInterpreter::BreakFlag::flag)) { \
-    hit_break = true;                                                 \
-    max = 0;                                                          \
-  }
-
       DCHECK_GT(limit, pc);
       DCHECK_NOT_NULL(code->start);
 
-      // Do first check for a breakpoint, in order to set hit_break correctly.
-      const char* skip = "        ";
       int len = 1;
+      // We need to store this, because SIMD opcodes are LEB encoded, and later
+      // on when executing, we need to know where to read immediates from.
+      uint32_t simd_opcode_length = 0;
       byte orig = code->start[pc];
       WasmOpcode opcode = static_cast<WasmOpcode>(orig);
       if (WasmOpcodes::IsPrefixOpcode(opcode)) {
-        opcode = static_cast<WasmOpcode>(opcode << 8 | code->start[pc + 1]);
-      }
-      if (V8_UNLIKELY(orig == kInternalBreakpoint)) {
-        orig = code->orig_start[pc];
-        if (WasmOpcodes::IsPrefixOpcode(static_cast<WasmOpcode>(orig))) {
-          opcode =
-              static_cast<WasmOpcode>(orig << 8 | code->orig_start[pc + 1]);
-        }
-        if (SkipBreakpoint(code, pc)) {
-          // skip breakpoint by switching on original code.
-          skip = "[skip]  ";
-        } else {
-          TRACE("@%-3zu: [break] %-24s:", pc, WasmOpcodes::OpcodeName(opcode));
-          TraceValueStack();
-          TRACE("\n");
-          hit_break = true;
-          break;
-        }
+        opcode = decoder.read_prefixed_opcode<Decoder::kNoValidate>(
+            &code->start[pc], &simd_opcode_length);
+        len += simd_opcode_length;
       }
 
       // If max is 0, break. If max is positive (a limit is set), decrement it.
@@ -3064,8 +3066,7 @@ class ThreadImpl {
         --max;
       }
 
-      USE(skip);
-      TRACE("@%-3zu: %s%-24s:", pc, skip, WasmOpcodes::OpcodeName(opcode));
+      TRACE("@%-3zu: %-24s:", pc, WasmOpcodes::OpcodeName(opcode));
       TraceValueStack();
       TRACE("\n");
 
@@ -3074,7 +3075,7 @@ class ThreadImpl {
       // stack was modified accordingly.
       std::pair<uint32_t, uint32_t> stack_effect =
           StackEffect(codemap_->module(), frames_.back().code->function->sig,
-                      code->orig_start + pc, code->orig_end);
+                      code->start + pc, code->end);
       sp_t expected_new_stack_height =
           StackHeight() - stack_effect.first + stack_effect.second;
 #endif
@@ -3149,7 +3150,8 @@ class ThreadImpl {
           break;
         }
         case kExprSelectWithType: {
-          SelectTypeImmediate<Decoder::kNoValidate> imm(&decoder, code->at(pc));
+          SelectTypeImmediate<Decoder::kNoValidate> imm(WasmFeatures::All(),
+                                                        &decoder, code->at(pc));
           len = 1 + imm.length;
           V8_FALLTHROUGH;
         }
@@ -3200,7 +3202,6 @@ class ThreadImpl {
         case kExprReturn: {
           size_t arity = code->function->sig->return_count();
           if (!DoReturn(&decoder, &code, &pc, &limit, arity)) return;
-          PAUSE_IF_BREAK_FLAG(AfterReturn);
           continue;  // Do not bump pc.
         }
         case kExprUnreachable: {
@@ -3281,35 +3282,10 @@ class ThreadImpl {
           CallFunctionImmediate<Decoder::kNoValidate> imm(&decoder,
                                                           code->at(pc));
           InterpreterCode* target = codemap()->GetCode(imm.index);
-          if (target->function->imported) {
-            CommitPc(pc);
-            ExternalCallResult result =
-                CallImportedFunction(target->function->func_index);
-            switch (result.type) {
-              case ExternalCallResult::INTERNAL:
-                // The import is a function of this instance. Call it directly.
-                DCHECK(!result.interpreter_code->function->imported);
-                break;
-              case ExternalCallResult::INVALID_FUNC:
-              case ExternalCallResult::SIGNATURE_MISMATCH:
-                // Direct calls are checked statically.
-                UNREACHABLE();
-              case ExternalCallResult::EXTERNAL_RETURNED:
-                PAUSE_IF_BREAK_FLAG(AfterCall);
-                len = 1 + imm.length;
-                break;
-              case ExternalCallResult::EXTERNAL_UNWOUND:
-                return;
-              case ExternalCallResult::EXTERNAL_CAUGHT:
-                ReloadFromFrameOnException(&decoder, &code, &pc, &limit);
-                continue;  // Do not bump pc.
-            }
-            if (result.type != ExternalCallResult::INTERNAL) break;
-          }
+          CHECK(!target->function->imported);
           // Execute an internal call.
           if (!DoCall(&decoder, target, &pc, &limit)) return;
           code = target;
-          PAUSE_IF_BREAK_FLAG(AfterCall);
           continue;  // Do not bump pc.
         } break;
 
@@ -3318,29 +3294,19 @@ class ThreadImpl {
               WasmFeatures::All(), &decoder, code->at(pc));
           uint32_t entry_index = Pop().to<uint32_t>();
           CommitPc(pc);  // TODO(wasm): Be more disciplined about committing PC.
-          ExternalCallResult result =
+          CallResult result =
               CallIndirectFunction(imm.table_index, entry_index, imm.sig_index);
           switch (result.type) {
-            case ExternalCallResult::INTERNAL:
+            case CallResult::INTERNAL:
               // The import is a function of this instance. Call it directly.
               if (!DoCall(&decoder, result.interpreter_code, &pc, &limit))
                 return;
               code = result.interpreter_code;
-              PAUSE_IF_BREAK_FLAG(AfterCall);
               continue;  // Do not bump pc.
-            case ExternalCallResult::INVALID_FUNC:
+            case CallResult::INVALID_FUNC:
               return DoTrap(kTrapFuncInvalid, pc);
-            case ExternalCallResult::SIGNATURE_MISMATCH:
+            case CallResult::SIGNATURE_MISMATCH:
               return DoTrap(kTrapFuncSigMismatch, pc);
-            case ExternalCallResult::EXTERNAL_RETURNED:
-              PAUSE_IF_BREAK_FLAG(AfterCall);
-              len = 1 + imm.length;
-              break;
-            case ExternalCallResult::EXTERNAL_UNWOUND:
-              return;
-            case ExternalCallResult::EXTERNAL_CAUGHT:
-              ReloadFromFrameOnException(&decoder, &code, &pc, &limit);
-              continue;  // Do not bump pc.
           }
         } break;
 
@@ -3349,38 +3315,11 @@ class ThreadImpl {
                                                           code->at(pc));
           InterpreterCode* target = codemap()->GetCode(imm.index);
 
-          if (!target->function->imported) {
-            // Enter internal found function.
-            if (!DoReturnCall(&decoder, target, &pc, &limit)) return;
-            code = target;
-            PAUSE_IF_BREAK_FLAG(AfterCall);
-
-            continue;  // Do not bump pc.
-          }
-          // Function is imported.
-          CommitPc(pc);
-          ExternalCallResult result =
-              CallImportedFunction(target->function->func_index);
-          switch (result.type) {
-            case ExternalCallResult::INTERNAL:
-              // Cannot import internal functions.
-            case ExternalCallResult::INVALID_FUNC:
-            case ExternalCallResult::SIGNATURE_MISMATCH:
-              // Direct calls are checked statically.
-              UNREACHABLE();
-            case ExternalCallResult::EXTERNAL_RETURNED:
-              len = 1 + imm.length;
-              break;
-            case ExternalCallResult::EXTERNAL_UNWOUND:
-              return;
-            case ExternalCallResult::EXTERNAL_CAUGHT:
-              ReloadFromFrameOnException(&decoder, &code, &pc, &limit);
-              continue;
-          }
-          size_t arity = code->function->sig->return_count();
-          if (!DoReturn(&decoder, &code, &pc, &limit, arity)) return;
-          PAUSE_IF_BREAK_FLAG(AfterReturn);
-          continue;
+          CHECK(!target->function->imported);
+          // Enter internal found function.
+          if (!DoReturnCall(&decoder, target, &pc, &limit)) return;
+          code = target;
+          continue;  // Do not bump pc.
         } break;
 
         case kExprReturnCallIndirect: {
@@ -3391,10 +3330,10 @@ class ThreadImpl {
 
           // TODO(wasm): Calling functions needs some refactoring to avoid
           // multi-exit code like this.
-          ExternalCallResult result =
+          CallResult result =
               CallIndirectFunction(imm.table_index, entry_index, imm.sig_index);
           switch (result.type) {
-            case ExternalCallResult::INTERNAL: {
+            case CallResult::INTERNAL: {
               InterpreterCode* target = result.interpreter_code;
 
               DCHECK(!target->function->imported);
@@ -3402,27 +3341,12 @@ class ThreadImpl {
               // The function belongs to this instance. Enter it directly.
               if (!DoReturnCall(&decoder, target, &pc, &limit)) return;
               code = result.interpreter_code;
-              PAUSE_IF_BREAK_FLAG(AfterCall);
               continue;  // Do not bump pc.
             }
-            case ExternalCallResult::INVALID_FUNC:
+            case CallResult::INVALID_FUNC:
               return DoTrap(kTrapFuncInvalid, pc);
-            case ExternalCallResult::SIGNATURE_MISMATCH:
+            case CallResult::SIGNATURE_MISMATCH:
               return DoTrap(kTrapFuncSigMismatch, pc);
-            case ExternalCallResult::EXTERNAL_RETURNED: {
-              len = 1 + imm.length;
-
-              size_t arity = code->function->sig->return_count();
-              if (!DoReturn(&decoder, &code, &pc, &limit, arity)) return;
-              PAUSE_IF_BREAK_FLAG(AfterCall);
-              break;
-            }
-            case ExternalCallResult::EXTERNAL_UNWOUND:
-              return;
-
-            case ExternalCallResult::EXTERNAL_CAUGHT:
-              ReloadFromFrameOnException(&decoder, &code, &pc, &limit);
-              break;
           }
         } break;
 
@@ -3453,7 +3377,11 @@ class ThreadImpl {
             case ValueType::kAnyRef:
             case ValueType::kFuncRef:
             case ValueType::kNullRef:
-            case ValueType::kExnRef: {
+            case ValueType::kExnRef:
+            case ValueType::kRef:
+            case ValueType::kOptRef:
+            case ValueType::kEqRef: {
+              // TODO(7748): Type checks or DCHECKs for ref types?
               HandleScope handle_scope(isolate_);  // Avoid leaking handles.
               Handle<FixedArray> global_buffer;    // The buffer of the global.
               uint32_t global_index;               // The index into the buffer.
@@ -3465,6 +3393,8 @@ class ThreadImpl {
               global_buffer->set(global_index, *ref);
               break;
             }
+            case ValueType::kI8:
+            case ValueType::kI16:
             case ValueType::kStmt:
             case ValueType::kBottom:
               UNREACHABLE();
@@ -3647,7 +3577,6 @@ class ThreadImpl {
           break;
         }
         case kNumericPrefix: {
-          ++len;
           if (!ExecuteNumericOp(opcode, &decoder, code, pc, &len)) return;
           break;
         }
@@ -3656,8 +3585,9 @@ class ThreadImpl {
           break;
         }
         case kSimdPrefix: {
-          ++len;
-          if (!ExecuteSimdOp(opcode, &decoder, code, pc, &len)) return;
+          if (!ExecuteSimdOp(opcode, &decoder, code, pc, &len,
+                             simd_opcode_length))
+            return;
           break;
         }
 
@@ -3710,7 +3640,8 @@ class ThreadImpl {
 
         default:
           FATAL("Unknown or unimplemented opcode #%d:%s", code->start[pc],
-                OpcodeName(code->start[pc]));
+                WasmOpcodes::OpcodeName(
+                    static_cast<WasmOpcode>(code->start[pc])));
           UNREACHABLE();
       }
 
@@ -3727,13 +3658,10 @@ class ThreadImpl {
         size_t arity = code->function->sig->return_count();
         DCHECK_EQ(StackHeight() - arity, frames_.back().llimit());
         if (!DoReturn(&decoder, &code, &pc, &limit, arity)) return;
-        PAUSE_IF_BREAK_FLAG(AfterReturn);
       }
-#undef PAUSE_IF_BREAK_FLAG
     }
 
     state_ = WasmInterpreter::PAUSED;
-    break_pc_ = hit_break ? pc : kInvalidPc;
     CommitPc(pc);
   }
 
@@ -3867,8 +3795,13 @@ class ThreadImpl {
         case ValueType::kFuncRef:
         case ValueType::kExnRef:
         case ValueType::kNullRef:
-          PrintF("(func|null|exn)ref:unimplemented");
+        case ValueType::kRef:
+        case ValueType::kOptRef:
+        case ValueType::kEqRef:
+          PrintF("(func|null|exn|opt|eq|)ref:unimplemented");
           break;
+        case ValueType::kI8:
+        case ValueType::kI16:
         case ValueType::kBottom:
           UNREACHABLE();
           break;
@@ -3877,110 +3810,6 @@ class ThreadImpl {
 #endif  // DEBUG
   }
 
-  ExternalCallResult TryHandleException(Isolate* isolate) {
-    DCHECK(isolate->has_pending_exception());  // Assume exceptional return.
-    if (HandleException(isolate) == WasmInterpreter::Thread::UNWOUND) {
-      return {ExternalCallResult::EXTERNAL_UNWOUND};
-    }
-    return {ExternalCallResult::EXTERNAL_CAUGHT};
-  }
-
-  ExternalCallResult CallExternalWasmFunction(Isolate* isolate,
-                                              Handle<Object> object_ref,
-                                              const WasmCode* code,
-                                              const FunctionSig* sig) {
-    int num_args = static_cast<int>(sig->parameter_count());
-    WasmFeatures enabled_features = WasmFeatures::FromIsolate(isolate);
-
-    if (code->kind() == WasmCode::kWasmToJsWrapper &&
-        !IsJSCompatibleSignature(sig, enabled_features)) {
-      Drop(num_args);  // Pop arguments before throwing.
-      isolate->Throw(*isolate->factory()->NewTypeError(
-          MessageTemplate::kWasmTrapTypeError));
-      return TryHandleException(isolate);
-    }
-
-    Handle<WasmDebugInfo> debug_info(instance_object_->debug_info(), isolate);
-    Handle<Code> wasm_entry = WasmDebugInfo::GetCWasmEntry(debug_info, sig);
-
-    TRACE("  => Calling external wasm function\n");
-
-    // Copy the arguments to one buffer.
-    CWasmArgumentsPacker packer(CWasmArgumentsPacker::TotalSize(sig));
-    sp_t base_index = StackHeight() - num_args;
-    for (int i = 0; i < num_args; ++i) {
-      WasmValue arg = GetStackValue(base_index + i);
-      switch (sig->GetParam(i).kind()) {
-        case ValueType::kI32:
-          packer.Push(arg.to<uint32_t>());
-          break;
-        case ValueType::kI64:
-          packer.Push(arg.to<uint64_t>());
-          break;
-        case ValueType::kF32:
-          packer.Push(arg.to<float>());
-          break;
-        case ValueType::kF64:
-          packer.Push(arg.to<double>());
-          break;
-        case ValueType::kAnyRef:
-        case ValueType::kFuncRef:
-        case ValueType::kNullRef:
-        case ValueType::kExnRef:
-          DCHECK_IMPLIES(sig->GetParam(i) == kWasmNullRef,
-                         arg.to_anyref()->IsNull());
-          packer.Push(arg.to_anyref()->ptr());
-          break;
-        default:
-          UNIMPLEMENTED();
-      }
-    }
-
-    Address call_target = code->instruction_start();
-    Execution::CallWasm(isolate, wasm_entry, call_target, object_ref,
-                        packer.argv());
-    TRACE("  => External wasm function returned%s\n",
-          isolate->has_pending_exception() ? " with exception" : "");
-
-    // Pop arguments off the stack.
-    Drop(num_args);
-
-    if (isolate->has_pending_exception()) {
-      return TryHandleException(isolate);
-    }
-
-    // Push return values.
-    packer.Reset();
-    for (size_t i = 0; i < sig->return_count(); i++) {
-      switch (sig->GetReturn(i).kind()) {
-        case ValueType::kI32:
-          Push(WasmValue(packer.Pop<uint32_t>()));
-          break;
-        case ValueType::kI64:
-          Push(WasmValue(packer.Pop<uint64_t>()));
-          break;
-        case ValueType::kF32:
-          Push(WasmValue(packer.Pop<float>()));
-          break;
-        case ValueType::kF64:
-          Push(WasmValue(packer.Pop<double>()));
-          break;
-        case ValueType::kAnyRef:
-        case ValueType::kFuncRef:
-        case ValueType::kNullRef:
-        case ValueType::kExnRef: {
-          Handle<Object> ref(Object(packer.Pop<Address>()), isolate);
-          DCHECK_IMPLIES(sig->GetReturn(i) == kWasmNullRef, ref->IsNull());
-          Push(WasmValue(ref));
-          break;
-        }
-        default:
-          UNIMPLEMENTED();
-      }
-    }
-    return {ExternalCallResult::EXTERNAL_RETURNED};
-  }
-
   static WasmCode* GetTargetCode(Isolate* isolate, Address target) {
     WasmCodeManager* code_manager = isolate->wasm_engine()->code_manager();
     NativeModule* native_module = code_manager->LookupNativeModule(target);
@@ -4003,59 +3832,36 @@ class ThreadImpl {
     return code;
   }
 
-  ExternalCallResult CallImportedFunction(uint32_t function_index) {
-    DCHECK_GT(module()->num_imported_functions, function_index);
-    HandleScope handle_scope(isolate_);  // Avoid leaking handles.
-
-    ImportedFunctionEntry entry(instance_object_, function_index);
-    Handle<Object> object_ref(entry.object_ref(), isolate_);
-    WasmCode* code = GetTargetCode(isolate_, entry.target());
-
-    // In case a function's body is invalid and the function is lazily validated
-    // and compiled we may get an exception.
-    if (code == nullptr) return TryHandleException(isolate_);
-
-    const FunctionSig* sig = module()->functions[function_index].sig;
-    return CallExternalWasmFunction(isolate_, object_ref, code, sig);
-  }
-
-  ExternalCallResult CallIndirectFunction(uint32_t table_index,
-                                          uint32_t entry_index,
-                                          uint32_t sig_index) {
+  CallResult CallIndirectFunction(uint32_t table_index, uint32_t entry_index,
+                                  uint32_t sig_index) {
     HandleScope handle_scope(isolate_);  // Avoid leaking handles.
     uint32_t expected_sig_id = module()->signature_ids[sig_index];
     DCHECK_EQ(expected_sig_id,
-              module()->signature_map.Find(*module()->signatures[sig_index]));
+              module()->signature_map.Find(*module()->signature(sig_index)));
     // Bounds check against table size.
     if (entry_index >=
         static_cast<uint32_t>(WasmInstanceObject::IndirectFunctionTableSize(
             isolate_, instance_object_, table_index))) {
-      return {ExternalCallResult::INVALID_FUNC};
+      return {CallResult::INVALID_FUNC};
     }
 
     IndirectFunctionTableEntry entry(instance_object_, table_index,
                                      entry_index);
     // Signature check.
     if (entry.sig_id() != static_cast<int32_t>(expected_sig_id)) {
-      return {ExternalCallResult::SIGNATURE_MISMATCH};
+      return {CallResult::SIGNATURE_MISMATCH};
     }
 
-    const FunctionSig* signature = module()->signatures[sig_index];
     Handle<Object> object_ref = handle(entry.object_ref(), isolate_);
     WasmCode* code = GetTargetCode(isolate_, entry.target());
+    CHECK_NOT_NULL(code);
 
-    // In case a function's body is invalid and the function is lazily validated
-    // and compiled we may get an exception.
-    if (code == nullptr) return TryHandleException(isolate_);
-
-    if (!object_ref->IsWasmInstanceObject() || /* call to an import */
-        !instance_object_.is_identical_to(object_ref) /* cross-instance */) {
-      return CallExternalWasmFunction(isolate_, object_ref, code, signature);
-    }
+    // Check that this is an internal call (within the same instance).
+    CHECK(object_ref->IsWasmInstanceObject() &&
+          instance_object_.is_identical_to(object_ref));
 
-    DCHECK(code->kind() == WasmCode::kInterpreterEntry ||
-           code->kind() == WasmCode::kFunction);
-    return {ExternalCallResult::INTERNAL, codemap()->GetCode(code->index())};
+    DCHECK_EQ(WasmCode::kFunction, code->kind());
+    return {CallResult::INTERNAL, codemap()->GetCode(code->index())};
   }
 
   inline Activation current_activation() {
@@ -4063,70 +3869,6 @@ class ThreadImpl {
   }
 };
 
-class InterpretedFrameImpl {
- public:
-  InterpretedFrameImpl(ThreadImpl* thread, int index)
-      : thread_(thread), index_(index) {
-    DCHECK_LE(0, index);
-  }
-
-  const WasmFunction* function() const { return frame()->code->function; }
-
-  int pc() const {
-    DCHECK_LE(0, frame()->pc);
-    DCHECK_GE(kMaxInt, frame()->pc);
-    return static_cast<int>(frame()->pc);
-  }
-
-  int GetParameterCount() const {
-    DCHECK_GE(kMaxInt, function()->sig->parameter_count());
-    return static_cast<int>(function()->sig->parameter_count());
-  }
-
-  int GetLocalCount() const {
-    size_t num_locals = function()->sig->parameter_count() +
-                        frame()->code->locals.type_list.size();
-    DCHECK_GE(kMaxInt, num_locals);
-    return static_cast<int>(num_locals);
-  }
-
-  int GetStackHeight() const {
-    bool is_top_frame =
-        static_cast<size_t>(index_) + 1 == thread_->frames_.size();
-    size_t stack_limit =
-        is_top_frame ? thread_->StackHeight() : thread_->frames_[index_ + 1].sp;
-    DCHECK_LE(frame()->sp, stack_limit);
-    size_t frame_size = stack_limit - frame()->sp;
-    DCHECK_LE(GetLocalCount(), frame_size);
-    return static_cast<int>(frame_size) - GetLocalCount();
-  }
-
-  WasmValue GetLocalValue(int index) const {
-    ThreadImpl::ReferenceStackScope stack_scope(thread_);
-    DCHECK_LE(0, index);
-    DCHECK_GT(GetLocalCount(), index);
-    return thread_->GetStackValue(static_cast<int>(frame()->sp) + index);
-  }
-
-  WasmValue GetStackValue(int index) const {
-    ThreadImpl::ReferenceStackScope stack_scope(thread_);
-    DCHECK_LE(0, index);
-    // Index must be within the number of stack values of this frame.
-    DCHECK_GT(GetStackHeight(), index);
-    return thread_->GetStackValue(static_cast<int>(frame()->sp) +
-                                  GetLocalCount() + index);
-  }
-
- private:
-  ThreadImpl* thread_;
-  int index_;
-
-  ThreadImpl::Frame* frame() const {
-    DCHECK_GT(thread_->frames_.size(), index_);
-    return &thread_->frames_[index_];
-  }
-};
-
 namespace {
 
 // Converters between WasmInterpreter::Thread and WasmInterpreter::ThreadImpl.
@@ -4140,14 +3882,6 @@ ThreadImpl* ToImpl(WasmInterpreter::Thread* thread) {
   return reinterpret_cast<ThreadImpl*>(thread);
 }
 
-// Same conversion for InterpretedFrame and InterpretedFrameImpl.
-InterpretedFrame* ToFrame(InterpretedFrameImpl* impl) {
-  return reinterpret_cast<InterpretedFrame*>(impl);
-}
-const InterpretedFrameImpl* ToImpl(const InterpretedFrame* frame) {
-  return reinterpret_cast<const InterpretedFrameImpl*>(frame);
-}
-
 }  // namespace
 
 //============================================================================
@@ -4185,17 +3919,9 @@ WasmInterpreter::Thread::RaiseException(Isolate* isolate,
   ThreadImpl::ReferenceStackScope stack_scope(impl);
   return impl->RaiseException(isolate, exception);
 }
-pc_t WasmInterpreter::Thread::GetBreakpointPc() {
-  return ToImpl(this)->GetBreakpointPc();
-}
 int WasmInterpreter::Thread::GetFrameCount() {
   return ToImpl(this)->GetFrameCount();
 }
-WasmInterpreter::FramePtr WasmInterpreter::Thread::GetFrame(int index) {
-  DCHECK_LE(0, index);
-  DCHECK_GT(GetFrameCount(), index);
-  return FramePtr(ToFrame(new InterpretedFrameImpl(ToImpl(this), index)));
-}
 WasmValue WasmInterpreter::Thread::GetReturnValue(int index) {
   ThreadImpl* impl = ToImpl(this);
   ThreadImpl::ReferenceStackScope stack_scope(impl);
@@ -4210,12 +3936,6 @@ bool WasmInterpreter::Thread::PossibleNondeterminism() {
 uint64_t WasmInterpreter::Thread::NumInterpretedCalls() {
   return ToImpl(this)->NumInterpretedCalls();
 }
-void WasmInterpreter::Thread::AddBreakFlags(uint8_t flags) {
-  ToImpl(this)->AddBreakFlags(flags);
-}
-void WasmInterpreter::Thread::ClearBreakFlags() {
-  ToImpl(this)->ClearBreakFlags();
-}
 uint32_t WasmInterpreter::Thread::NumActivations() {
   return ToImpl(this)->NumActivations();
 }
@@ -4291,48 +4011,6 @@ void WasmInterpreter::Run() { internals_->threads_[0].Run(); }
 
 void WasmInterpreter::Pause() { internals_->threads_[0].Pause(); }
 
-void WasmInterpreter::PrepareStepIn(const WasmFunction* function) {
-  // Set a breakpoint at the start of function.
-  InterpreterCode* code = internals_->codemap_.GetCode(function);
-  pc_t pc = code->locals.encoded_size;
-  SetBreakpoint(function, pc, true);
-}
-
-bool WasmInterpreter::SetBreakpoint(const WasmFunction* function, pc_t pc,
-                                    bool enabled) {
-  InterpreterCode* code = internals_->codemap_.GetCode(function);
-  size_t size = static_cast<size_t>(code->end - code->start);
-  // Check bounds for {pc}.
-  if (pc < code->locals.encoded_size || pc >= size) return false;
-  // Make a copy of the code before enabling a breakpoint.
-  if (enabled && code->orig_start == code->start) {
-    code->start = reinterpret_cast<byte*>(zone_.New(size));
-    memcpy(code->start, code->orig_start, size);
-    code->end = code->start + size;
-  }
-  bool prev = code->start[pc] == kInternalBreakpoint;
-  if (enabled) {
-    code->start[pc] = kInternalBreakpoint;
-  } else {
-    code->start[pc] = code->orig_start[pc];
-  }
-  return prev;
-}
-
-bool WasmInterpreter::GetBreakpoint(const WasmFunction* function, pc_t pc) {
-  InterpreterCode* code = internals_->codemap_.GetCode(function);
-  size_t size = static_cast<size_t>(code->end - code->start);
-  // Check bounds for {pc}.
-  if (pc < code->locals.encoded_size || pc >= size) return false;
-  // Check if a breakpoint is present at that place in the code.
-  return code->start[pc] == kInternalBreakpoint;
-}
-
-bool WasmInterpreter::SetTracing(const WasmFunction* function, bool enabled) {
-  UNIMPLEMENTED();
-  return false;
-}
-
 int WasmInterpreter::GetThreadCount() {
   return 1;  // only one thread for now.
 }
@@ -4364,43 +4042,15 @@ ControlTransferMap WasmInterpreter::ComputeControlTransfersForTesting(
                         false,   // imported
                         false,   // exported
                         false};  // declared
-  InterpreterCode code{
-      &function, BodyLocalDecls(zone), start, end, nullptr, nullptr, nullptr};
+  InterpreterCode code{&function, BodyLocalDecls(zone), start, end, nullptr};
 
   // Now compute and return the control transfers.
   SideTable side_table(zone, module, &code);
   return side_table.map_;
 }
 
-//============================================================================
-// Implementation of the frame inspection interface.
-//============================================================================
-const WasmFunction* InterpretedFrame::function() const {
-  return ToImpl(this)->function();
-}
-int InterpretedFrame::pc() const { return ToImpl(this)->pc(); }
-int InterpretedFrame::GetParameterCount() const {
-  return ToImpl(this)->GetParameterCount();
-}
-int InterpretedFrame::GetLocalCount() const {
-  return ToImpl(this)->GetLocalCount();
-}
-int InterpretedFrame::GetStackHeight() const {
-  return ToImpl(this)->GetStackHeight();
-}
-WasmValue InterpretedFrame::GetLocalValue(int index) const {
-  return ToImpl(this)->GetLocalValue(index);
-}
-WasmValue InterpretedFrame::GetStackValue(int index) const {
-  return ToImpl(this)->GetStackValue(index);
-}
-void InterpretedFrameDeleter::operator()(InterpretedFrame* ptr) {
-  delete ToImpl(ptr);
-}
-
 #undef TRACE
 #undef LANE
-#undef FOREACH_INTERNAL_OPCODE
 #undef FOREACH_SIMPLE_BINOP
 #undef FOREACH_OTHER_BINOP
 #undef FOREACH_I32CONV_FLOATOP
diff --git a/deps/v8/src/wasm/wasm-interpreter.h b/deps/v8/src/wasm/wasm-interpreter.h
index 5a154be6982..8c4decd7398 100644
--- a/deps/v8/src/wasm/wasm-interpreter.h
+++ b/deps/v8/src/wasm/wasm-interpreter.h
@@ -29,8 +29,6 @@ using sp_t = size_t;
 using pcdiff_t = int32_t;
 using spdiff_t = uint32_t;
 
-constexpr pc_t kInvalidPc = 0x80000000;
-
 struct ControlTransferEntry {
   // Distance from the instruction to the label to jump to (forward, but can be
   // negative).
@@ -43,46 +41,6 @@ struct ControlTransferEntry {
 
 using ControlTransferMap = ZoneMap<pc_t, ControlTransferEntry>;
 
-// Representation of frames within the interpreter.
-//
-// Layout of a frame:
-// -----------------
-// stack slot #N  ‾\.
-// ...             |  stack entries: GetStackHeight(); GetStackValue()
-// stack slot #0  _/·
-// local #L       ‾\.
-// ...             |  locals: GetLocalCount(); GetLocalValue()
-// local #P+1      |
-// param #P        |   ‾\.
-// ...             |    | parameters: GetParameterCount(); GetLocalValue()
-// param #0       _/·  _/·
-// -----------------
-//
-class V8_EXPORT_PRIVATE InterpretedFrame {
- public:
-  const WasmFunction* function() const;
-  int pc() const;
-
-  int GetParameterCount() const;
-  int GetLocalCount() const;
-  int GetStackHeight() const;
-  WasmValue GetLocalValue(int index) const;
-  WasmValue GetStackValue(int index) const;
-
- private:
-  friend class WasmInterpreter;
-  // Don't instante InterpretedFrames; they will be allocated as
-  // InterpretedFrameImpl in the interpreter implementation.
-  InterpretedFrame() = delete;
-  DISALLOW_COPY_AND_ASSIGN(InterpretedFrame);
-};
-
-// Deleter struct to delete the underlying InterpretedFrameImpl without
-// violating language specifications.
-struct V8_EXPORT_PRIVATE InterpretedFrameDeleter {
-  void operator()(InterpretedFrame* ptr);
-};
-
 // An interpreter capable of executing WebAssembly.
 class V8_EXPORT_PRIVATE WasmInterpreter {
  public:
@@ -105,8 +63,6 @@ class V8_EXPORT_PRIVATE WasmInterpreter {
     AfterCall = 1 << 1
   };
 
-  using FramePtr = std::unique_ptr<InterpretedFrame, InterpretedFrameDeleter>;
-
   // Representation of a thread in the interpreter.
   class V8_EXPORT_PRIVATE Thread {
     // Don't instante Threads; they will be allocated as ThreadImpl in the
@@ -132,10 +88,7 @@ class V8_EXPORT_PRIVATE WasmInterpreter {
     ExceptionHandlingResult RaiseException(Isolate*, Handle<Object> exception);
 
     // Stack inspection and modification.
-    pc_t GetBreakpointPc();
     int GetFrameCount();
-    // The InterpretedFrame is only valid as long as the Thread is paused.
-    FramePtr GetFrame(int index);
     WasmValue GetReturnValue(int index = 0);
     TrapReason GetTrapReason();
 
@@ -147,14 +100,6 @@ class V8_EXPORT_PRIVATE WasmInterpreter {
     // Returns the number of calls / function frames executed on this thread.
     uint64_t NumInterpretedCalls();
 
-    // Thread-specific breakpoints.
-    // TODO(wasm): Implement this once we support multiple threads.
-    // bool SetBreakpoint(const WasmFunction* function, int pc, bool enabled);
-    // bool GetBreakpoint(const WasmFunction* function, int pc);
-
-    void AddBreakFlags(uint8_t flags);
-    void ClearBreakFlags();
-
     // Each thread can have multiple activations, each represented by a portion
     // of the stack frames of this thread. StartActivation returns the id
     // (counting from 0 up) of the started activation.
@@ -180,19 +125,6 @@ class V8_EXPORT_PRIVATE WasmInterpreter {
   void Run();
   void Pause();
 
-  // Prepare {function} for stepping in from Javascript.
-  void PrepareStepIn(const WasmFunction* function);
-
-  // Set a breakpoint at {pc} in {function} to be {enabled}. Returns the
-  // previous state of the breakpoint at {pc}.
-  bool SetBreakpoint(const WasmFunction* function, pc_t pc, bool enabled);
-
-  // Gets the current state of the breakpoint at {function}.
-  bool GetBreakpoint(const WasmFunction* function, pc_t pc);
-
-  // Enable or disable tracing for {function}. Return the previous state.
-  bool SetTracing(const WasmFunction* function, bool enabled);
-
   //==========================================================================
   // Thread iteration and inspection.
   //==========================================================================
diff --git a/deps/v8/src/wasm/wasm-js.cc b/deps/v8/src/wasm/wasm-js.cc
index fdc02771b4c..7b5f3b4729a 100644
--- a/deps/v8/src/wasm/wasm-js.cc
+++ b/deps/v8/src/wasm/wasm-js.cc
@@ -73,8 +73,12 @@ class WasmStreaming::WasmStreamingImpl {
 
   void SetClient(std::shared_ptr<Client> client) {
     streaming_decoder_->SetModuleCompiledCallback(
-        [client](const std::shared_ptr<i::wasm::NativeModule>& native_module) {
-          client->OnModuleCompiled(Utils::Convert(native_module));
+        [client, streaming_decoder = streaming_decoder_](
+            const std::shared_ptr<i::wasm::NativeModule>& native_module) {
+          i::Vector<const char> url = streaming_decoder->url();
+          auto compiled_wasm_module =
+              CompiledWasmModule(native_module, url.begin(), url.size());
+          client->OnModuleCompiled(compiled_wasm_module);
         });
   }
 
@@ -331,14 +335,10 @@ class InstantiateBytesResultResolver
         isolate_->factory()->NewJSObject(isolate_->object_function());
 
     i::Handle<i::String> instance_name =
-        isolate_->factory()
-            ->NewStringFromOneByte(i::StaticCharVector("instance"))
-            .ToHandleChecked();
+        isolate_->factory()->NewStringFromStaticChars("instance");
 
     i::Handle<i::String> module_name =
-        isolate_->factory()
-            ->NewStringFromOneByte(i::StaticCharVector("module"))
-            .ToHandleChecked();
+        isolate_->factory()->NewStringFromStaticChars("module");
 
     i::JSObject::AddProperty(isolate_, result, instance_name, instance,
                              i::NONE);
@@ -1364,6 +1364,13 @@ void WebAssemblyGlobal(const v8::FunctionCallbackInfo<v8::Value>& args) {
       }
       break;
     }
+    case i::wasm::ValueType::kRef:
+    case i::wasm::ValueType::kOptRef:
+    case i::wasm::ValueType::kEqRef:
+      // TODO(7748): Implement these.
+      UNIMPLEMENTED();
+    case i::wasm::ValueType::kI8:
+    case i::wasm::ValueType::kI16:
     case i::wasm::ValueType::kStmt:
     case i::wasm::ValueType::kS128:
     case i::wasm::ValueType::kBottom:
@@ -1584,7 +1591,7 @@ void WebAssemblyTableGetLength(
       v8::Number::New(isolate, receiver->current_length()));
 }
 
-// WebAssembly.Table.grow(num) -> num
+// WebAssembly.Table.grow(num, init_value = null) -> num
 void WebAssemblyTableGrow(const v8::FunctionCallbackInfo<v8::Value>& args) {
   v8::Isolate* isolate = args.GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
@@ -1598,8 +1605,20 @@ void WebAssemblyTableGrow(const v8::FunctionCallbackInfo<v8::Value>& args) {
     return;
   }
 
-  int old_size = i::WasmTableObject::Grow(i_isolate, receiver, grow_by,
-                                          i_isolate->factory()->null_value());
+  i::Handle<i::Object> init_value = i_isolate->factory()->null_value();
+  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
+  if (enabled_features.has_typed_funcref()) {
+    if (args.Length() >= 2 && !args[1]->IsUndefined()) {
+      init_value = Utils::OpenHandle(*args[1]);
+    }
+    if (!i::WasmTableObject::IsValidElement(i_isolate, receiver, init_value)) {
+      thrower.TypeError("Argument 1 must be a valid type for the table");
+      return;
+    }
+  }
+
+  int old_size =
+      i::WasmTableObject::Grow(i_isolate, receiver, grow_by, init_value);
 
   if (old_size < 0) {
     thrower.RangeError("failed to grow table by %u", grow_by);
@@ -1812,6 +1831,13 @@ void WebAssemblyGlobalGetValueCommon(
                      receiver->GetRef()->IsNull());
       return_value.Set(Utils::ToLocal(receiver->GetRef()));
       break;
+    case i::wasm::ValueType::kRef:
+    case i::wasm::ValueType::kOptRef:
+    case i::wasm::ValueType::kEqRef:
+      // TODO(7748): Implement these.
+      UNIMPLEMENTED();
+    case i::wasm::ValueType::kI8:
+    case i::wasm::ValueType::kI16:
     case i::wasm::ValueType::kBottom:
     case i::wasm::ValueType::kStmt:
     case i::wasm::ValueType::kS128:
@@ -1897,6 +1923,13 @@ void WebAssemblyGlobalSetValue(
       }
       break;
     }
+    case i::wasm::ValueType::kRef:
+    case i::wasm::ValueType::kOptRef:
+    case i::wasm::ValueType::kEqRef:
+      // TODO(7748): Implement these.
+      UNIMPLEMENTED();
+    case i::wasm::ValueType::kI8:
+    case i::wasm::ValueType::kI16:
     case i::wasm::ValueType::kBottom:
     case i::wasm::ValueType::kStmt:
     case i::wasm::ValueType::kS128:
diff --git a/deps/v8/src/wasm/wasm-module-builder.cc b/deps/v8/src/wasm/wasm-module-builder.cc
index c11a69ad465..f75fdb4ae8b 100644
--- a/deps/v8/src/wasm/wasm-module-builder.cc
+++ b/deps/v8/src/wasm/wasm-module-builder.cc
@@ -2,21 +2,19 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/codegen/signature.h"
+#include "src/wasm/wasm-module-builder.h"
 
+#include "src/base/memory.h"
+#include "src/codegen/signature.h"
 #include "src/handles/handles.h"
 #include "src/init/v8.h"
 #include "src/objects/objects-inl.h"
-#include "src/zone/zone-containers.h"
-
 #include "src/wasm/function-body-decoder.h"
 #include "src/wasm/leb-helper.h"
 #include "src/wasm/wasm-constants.h"
-#include "src/wasm/wasm-module-builder.h"
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-opcodes.h"
-
-#include "src/base/memory.h"
+#include "src/zone/zone-containers.h"
 
 namespace v8 {
 namespace internal {
@@ -55,6 +53,8 @@ WasmFunctionBuilder::WasmFunctionBuilder(WasmModuleBuilder* builder)
       direct_calls_(builder->zone()),
       asm_offsets_(builder->zone(), 8) {}
 
+void WasmFunctionBuilder::EmitByte(byte val) { body_.write_u8(val); }
+
 void WasmFunctionBuilder::EmitI32V(int32_t val) { body_.write_i32v(val); }
 
 void WasmFunctionBuilder::EmitU32V(uint32_t val) { body_.write_u32v(val); }
@@ -91,7 +91,12 @@ void WasmFunctionBuilder::Emit(WasmOpcode opcode) { body_.write_u8(opcode); }
 void WasmFunctionBuilder::EmitWithPrefix(WasmOpcode opcode) {
   DCHECK_NE(0, opcode & 0xff00);
   body_.write_u8(opcode >> 8);
-  body_.write_u8(opcode);
+  if ((opcode >> 8) == WasmOpcode::kSimdPrefix) {
+    // SIMD opcodes are LEB encoded
+    body_.write_u32v(opcode & 0xff);
+  } else {
+    body_.write_u8(opcode);
+  }
 }
 
 void WasmFunctionBuilder::EmitWithU8(WasmOpcode opcode, const byte immediate) {
@@ -234,7 +239,7 @@ void WasmFunctionBuilder::WriteAsmWasmOffsetTable(ZoneBuffer* buffer) const {
 
 WasmModuleBuilder::WasmModuleBuilder(Zone* zone)
     : zone_(zone),
-      signatures_(zone),
+      types_(zone),
       function_imports_(zone),
       global_imports_(zone),
       exports_(zone),
@@ -269,9 +274,21 @@ void WasmModuleBuilder::AddDataSegment(const byte* data, uint32_t size,
 uint32_t WasmModuleBuilder::AddSignature(FunctionSig* sig) {
   auto sig_entry = signature_map_.find(*sig);
   if (sig_entry != signature_map_.end()) return sig_entry->second;
-  uint32_t index = static_cast<uint32_t>(signatures_.size());
+  uint32_t index = static_cast<uint32_t>(types_.size());
   signature_map_.emplace(*sig, index);
-  signatures_.push_back(sig);
+  types_.push_back(Type(sig));
+  return index;
+}
+
+uint32_t WasmModuleBuilder::AddStructType(StructType* type) {
+  uint32_t index = static_cast<uint32_t>(types_.size());
+  types_.push_back(Type(type));
+  return index;
+}
+
+uint32_t WasmModuleBuilder::AddArrayType(ArrayType* type) {
+  uint32_t index = static_cast<uint32_t>(types_.size());
+  types_.push_back(Type(type));
   return index;
 }
 
@@ -334,16 +351,17 @@ uint32_t WasmModuleBuilder::AddTable(ValueType type, uint32_t min_size,
   return static_cast<uint32_t>(tables_.size() - 1);
 }
 
-uint32_t WasmModuleBuilder::AddImport(Vector<const char> name,
-                                      FunctionSig* sig) {
+uint32_t WasmModuleBuilder::AddImport(Vector<const char> name, FunctionSig* sig,
+                                      Vector<const char> module) {
   DCHECK(adding_imports_allowed_);
-  function_imports_.push_back({name, AddSignature(sig)});
+  function_imports_.push_back({module, name, AddSignature(sig)});
   return static_cast<uint32_t>(function_imports_.size() - 1);
 }
 
 uint32_t WasmModuleBuilder::AddGlobalImport(Vector<const char> name,
-                                            ValueType type, bool mutability) {
-  global_imports_.push_back({name, type.value_type_code(), mutability});
+                                            ValueType type, bool mutability,
+                                            Vector<const char> module) {
+  global_imports_.push_back({module, name, type.value_type_code(), mutability});
   return static_cast<uint32_t>(global_imports_.size() - 1);
 }
 
@@ -393,25 +411,58 @@ void WasmModuleBuilder::SetMaxMemorySize(uint32_t value) {
 
 void WasmModuleBuilder::SetHasSharedMemory() { has_shared_memory_ = true; }
 
+namespace {
+void WriteValueType(ZoneBuffer* buffer, const ValueType& type) {
+  buffer->write_u8(type.value_type_code());
+  if (type.has_immediate()) {
+    buffer->write_u32v(type.ref_index());
+  }
+}
+
+}  // namespace
+
 void WasmModuleBuilder::WriteTo(ZoneBuffer* buffer) const {
   // == Emit magic =============================================================
   buffer->write_u32(kWasmMagic);
   buffer->write_u32(kWasmVersion);
 
-  // == Emit signatures ========================================================
-  if (signatures_.size() > 0) {
+  // == Emit types =============================================================
+  if (types_.size() > 0) {
     size_t start = EmitSection(kTypeSectionCode, buffer);
-    buffer->write_size(signatures_.size());
-
-    for (FunctionSig* sig : signatures_) {
-      buffer->write_u8(kWasmFunctionTypeCode);
-      buffer->write_size(sig->parameter_count());
-      for (auto param : sig->parameters()) {
-        buffer->write_u8(param.value_type_code());
-      }
-      buffer->write_size(sig->return_count());
-      for (auto ret : sig->returns()) {
-        buffer->write_u8(ret.value_type_code());
+    buffer->write_size(types_.size());
+
+    for (const Type& type : types_) {
+      switch (type.kind) {
+        case Type::kFunctionSig: {
+          FunctionSig* sig = type.sig;
+          buffer->write_u8(kWasmFunctionTypeCode);
+          buffer->write_size(sig->parameter_count());
+          for (auto param : sig->parameters()) {
+            WriteValueType(buffer, param);
+          }
+          buffer->write_size(sig->return_count());
+          for (auto ret : sig->returns()) {
+            WriteValueType(buffer, ret);
+          }
+          break;
+        }
+        case Type::kStructType: {
+          StructType* struct_type = type.struct_type;
+          buffer->write_u8(kWasmStructTypeCode);
+          buffer->write_size(struct_type->field_count());
+          for (uint32_t i = 0; i < struct_type->field_count(); i++) {
+            WriteValueType(buffer, struct_type->field(i));
+            buffer->write_u8(struct_type->mutability(i) ? 1 : 0);
+          }
+          break;
+        }
+        case Type::kArrayType: {
+          ArrayType* array_type = type.array_type;
+          buffer->write_u8(kWasmArrayTypeCode);
+          WriteValueType(buffer, array_type->element_type());
+          buffer->write_u8(array_type->mutability() ? 1 : 0);
+          break;
+        }
       }
     }
     FixupSection(buffer, start);
@@ -422,15 +473,15 @@ void WasmModuleBuilder::WriteTo(ZoneBuffer* buffer) const {
     size_t start = EmitSection(kImportSectionCode, buffer);
     buffer->write_size(global_imports_.size() + function_imports_.size());
     for (auto import : global_imports_) {
-      buffer->write_u32v(0);              // module name (length)
-      buffer->write_string(import.name);  // field name
+      buffer->write_string(import.module);  // module name
+      buffer->write_string(import.name);    // field name
       buffer->write_u8(kExternalGlobal);
       buffer->write_u8(import.type_code);
       buffer->write_u8(import.mutability ? 1 : 0);
     }
     for (auto import : function_imports_) {
-      buffer->write_u32v(0);              // module name (length)
-      buffer->write_string(import.name);  // field name
+      buffer->write_string(import.module);  // module name
+      buffer->write_string(import.name);    // field name
       buffer->write_u8(kExternalFunction);
       buffer->write_u32v(import.sig_index);
     }
@@ -486,7 +537,7 @@ void WasmModuleBuilder::WriteTo(ZoneBuffer* buffer) const {
     buffer->write_size(globals_.size());
 
     for (const WasmGlobal& global : globals_) {
-      buffer->write_u8(global.type.value_type_code());
+      WriteValueType(buffer, global.type);
       buffer->write_u8(global.mutability ? 1 : 0);
       switch (global.init.kind) {
         case WasmInitExpr::kI32Const:
@@ -540,7 +591,20 @@ void WasmModuleBuilder::WriteTo(ZoneBuffer* buffer) const {
               buffer->write_u8(kExprF64Const);
               buffer->write_f64(0.);
               break;
-            default:
+            case ValueType::kOptRef:
+            case ValueType::kFuncRef:
+            case ValueType::kExnRef:
+            case ValueType::kEqRef:
+              buffer->write_u8(kExprRefNull);
+              break;
+            case ValueType::kI8:
+            case ValueType::kI16:
+            case ValueType::kStmt:
+            case ValueType::kS128:
+            case ValueType::kBottom:
+            case ValueType::kRef:
+            case ValueType::kAnyRef:
+            case ValueType::kNullRef:
               UNREACHABLE();
           }
         }
diff --git a/deps/v8/src/wasm/wasm-module-builder.h b/deps/v8/src/wasm/wasm-module-builder.h
index 93ee913badd..896fc3bf9c1 100644
--- a/deps/v8/src/wasm/wasm-module-builder.h
+++ b/deps/v8/src/wasm/wasm-module-builder.h
@@ -5,16 +5,15 @@
 #ifndef V8_WASM_WASM_MODULE_BUILDER_H_
 #define V8_WASM_WASM_MODULE_BUILDER_H_
 
-#include "src/codegen/signature.h"
-#include "src/zone/zone-containers.h"
-
 #include "src/base/memory.h"
+#include "src/codegen/signature.h"
 #include "src/utils/vector.h"
 #include "src/wasm/leb-helper.h"
 #include "src/wasm/local-decl-encoder.h"
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-opcodes.h"
 #include "src/wasm/wasm-result.h"
+#include "src/zone/zone-containers.h"
 
 namespace v8 {
 namespace internal {
@@ -83,6 +82,7 @@ class ZoneBuffer : public ZoneObject {
   void write_f64(double val) { write_u64(bit_cast<uint64_t>(val)); }
 
   void write(const byte* data, size_t size) {
+    if (size == 0) return;
     EnsureSpace(size);
     memcpy(pos_, data, size);
     pos_ += size;
@@ -159,6 +159,7 @@ class V8_EXPORT_PRIVATE WasmFunctionBuilder : public ZoneObject {
   // Building methods.
   void SetSignature(FunctionSig* sig);
   uint32_t AddLocal(ValueType type);
+  void EmitByte(byte b);
   void EmitI32V(int32_t val);
   void EmitU32V(uint32_t val);
   void EmitCode(const byte* code, uint32_t code_size);
@@ -231,14 +232,17 @@ class V8_EXPORT_PRIVATE WasmModuleBuilder : public ZoneObject {
   explicit WasmModuleBuilder(Zone* zone);
 
   // Building methods.
-  uint32_t AddImport(Vector<const char> name, FunctionSig* sig);
+  uint32_t AddImport(Vector<const char> name, FunctionSig* sig,
+                     Vector<const char> module = {});
   WasmFunctionBuilder* AddFunction(FunctionSig* sig = nullptr);
   uint32_t AddGlobal(ValueType type, bool mutability = true,
                      const WasmInitExpr& init = WasmInitExpr());
   uint32_t AddGlobalImport(Vector<const char> name, ValueType type,
-                           bool mutability);
+                           bool mutability, Vector<const char> module = {});
   void AddDataSegment(const byte* data, uint32_t size, uint32_t dest);
   uint32_t AddSignature(FunctionSig* sig);
+  uint32_t AddStructType(StructType* type);
+  uint32_t AddArrayType(ArrayType* type);
   // In the current implementation, it's supported to have uninitialized slots
   // at the beginning and/or end of the indirect function table, as long as
   // the filled slots form a contiguous block in the middle.
@@ -266,15 +270,36 @@ class V8_EXPORT_PRIVATE WasmModuleBuilder : public ZoneObject {
 
   Zone* zone() { return zone_; }
 
-  FunctionSig* GetSignature(uint32_t index) { return signatures_[index]; }
+  FunctionSig* GetSignature(uint32_t index) {
+    DCHECK(types_[index].kind == Type::kFunctionSig);
+    return types_[index].sig;
+  }
 
  private:
+  struct Type {
+    enum Kind { kFunctionSig, kStructType, kArrayType };
+    explicit Type(FunctionSig* signature)
+        : kind(kFunctionSig), sig(signature) {}
+    explicit Type(StructType* struct_type)
+        : kind(kStructType), struct_type(struct_type) {}
+    explicit Type(ArrayType* array_type)
+        : kind(kArrayType), array_type(array_type) {}
+    Kind kind;
+    union {
+      FunctionSig* sig;
+      StructType* struct_type;
+      ArrayType* array_type;
+    };
+  };
+
   struct WasmFunctionImport {
+    Vector<const char> module;
     Vector<const char> name;
     uint32_t sig_index;
   };
 
   struct WasmGlobalImport {
+    Vector<const char> module;
     Vector<const char> name;
     ValueTypeCode type_code;
     bool mutability;
@@ -306,7 +331,7 @@ class V8_EXPORT_PRIVATE WasmModuleBuilder : public ZoneObject {
 
   friend class WasmFunctionBuilder;
   Zone* zone_;
-  ZoneVector<FunctionSig*> signatures_;
+  ZoneVector<Type> types_;
   ZoneVector<WasmFunctionImport> function_imports_;
   ZoneVector<WasmGlobalImport> global_imports_;
   ZoneVector<WasmExport> exports_;
@@ -331,7 +356,7 @@ class V8_EXPORT_PRIVATE WasmModuleBuilder : public ZoneObject {
 };
 
 inline FunctionSig* WasmFunctionBuilder::signature() {
-  return builder_->signatures_[signature_index_];
+  return builder_->types_[signature_index_].sig;
 }
 
 }  // namespace wasm
diff --git a/deps/v8/src/wasm/wasm-module.cc b/deps/v8/src/wasm/wasm-module.cc
index f5905615e20..738539ecdc5 100644
--- a/deps/v8/src/wasm/wasm-module.cc
+++ b/deps/v8/src/wasm/wasm-module.cc
@@ -30,7 +30,7 @@ namespace wasm {
 // static
 const uint32_t WasmElemSegment::kNullIndex;
 
-WireBytesRef DecodedFunctionNames::Lookup(
+WireBytesRef LazilyGeneratedNames::LookupFunctionName(
     const ModuleWireBytes& wire_bytes, uint32_t function_index,
     Vector<const WasmExport> export_table) const {
   base::MutexGuard lock(&mutex_);
@@ -44,18 +44,23 @@ WireBytesRef DecodedFunctionNames::Lookup(
   return it->second;
 }
 
-std::pair<WireBytesRef, WireBytesRef> DecodedGlobalNames::Lookup(
-    uint32_t global_index, Vector<const WasmImport> import_table,
+std::pair<WireBytesRef, WireBytesRef>
+LazilyGeneratedNames::LookupNameFromImportsAndExports(
+    ImportExportKindCode kind, uint32_t index,
+    Vector<const WasmImport> import_table,
     Vector<const WasmExport> export_table) const {
   base::MutexGuard lock(&mutex_);
-  if (!global_names_) {
-    global_names_.reset(
+  DCHECK(kind == kExternalGlobal || kind == kExternalMemory);
+  auto& names = kind == kExternalGlobal ? global_names_ : memory_names_;
+  if (!names) {
+    names.reset(
         new std::unordered_map<uint32_t,
                                std::pair<WireBytesRef, WireBytesRef>>());
-    DecodeGlobalNames(import_table, export_table, global_names_.get());
+    GenerateNamesFromImportsAndExports(kind, import_table, export_table,
+                                       names.get());
   }
-  auto it = global_names_->find(global_index);
-  if (it == global_names_->end()) return {};
+  auto it = names->find(index);
+  if (it == names->end()) return {};
   return it->second;
 }
 
@@ -118,7 +123,7 @@ int GetContainingWasmFunction(const WasmModule* module, uint32_t byte_offset) {
   return func_index;
 }
 
-void DecodedFunctionNames::AddForTesting(int function_index,
+void LazilyGeneratedNames::AddForTesting(int function_index,
                                          WireBytesRef name) {
   base::MutexGuard lock(&mutex_);
   if (!function_names_) {
@@ -192,7 +197,7 @@ WasmName ModuleWireBytes::GetNameOrNull(WireBytesRef ref) const {
 // Get a string stored in the module bytes representing a function name.
 WasmName ModuleWireBytes::GetNameOrNull(const WasmFunction* function,
                                         const WasmModule* module) const {
-  return GetNameOrNull(module->function_names.Lookup(
+  return GetNameOrNull(module->lazily_generated_names.LookupFunctionName(
       *this, function->func_index, VectorOf(module->export_table)));
 }
 
@@ -453,9 +458,8 @@ Handle<JSArray> GetImports(Isolate* isolate,
       case kExternalException:
         import_kind = exception_string;
         break;
-      default:
-        UNREACHABLE();
     }
+    DCHECK(!import_kind->is_null());
 
     Handle<String> import_module =
         WasmModuleObject::ExtractUtf8StringFromModuleBytes(
@@ -652,11 +656,11 @@ size_t EstimateStoredSize(const WasmModule* module) {
   return sizeof(WasmModule) + VectorSize(module->globals) +
          (module->signature_zone ? module->signature_zone->allocation_size()
                                  : 0) +
-         VectorSize(module->signatures) + VectorSize(module->signature_ids) +
-         VectorSize(module->functions) + VectorSize(module->data_segments) +
-         VectorSize(module->tables) + VectorSize(module->import_table) +
-         VectorSize(module->export_table) + VectorSize(module->exceptions) +
-         VectorSize(module->elem_segments);
+         VectorSize(module->types) + VectorSize(module->type_kinds) +
+         VectorSize(module->signature_ids) + VectorSize(module->functions) +
+         VectorSize(module->data_segments) + VectorSize(module->tables) +
+         VectorSize(module->import_table) + VectorSize(module->export_table) +
+         VectorSize(module->exceptions) + VectorSize(module->elem_segments);
 }
 
 size_t PrintSignature(Vector<char> buffer, const wasm::FunctionSig* sig) {
diff --git a/deps/v8/src/wasm/wasm-module.h b/deps/v8/src/wasm/wasm-module.h
index 6c782607bbe..a189964ad73 100644
--- a/deps/v8/src/wasm/wasm-module.h
+++ b/deps/v8/src/wasm/wasm-module.h
@@ -12,6 +12,7 @@
 #include "src/handles/handles.h"
 #include "src/utils/vector.h"
 #include "src/wasm/signature-map.h"
+#include "src/wasm/struct-types.h"
 #include "src/wasm/wasm-constants.h"
 #include "src/wasm/wasm-opcodes.h"
 
@@ -167,9 +168,8 @@ enum class WasmCompilationHintStrategy : uint8_t {
 
 enum class WasmCompilationHintTier : uint8_t {
   kDefault = 0,
-  kInterpreter = 1,
-  kBaseline = 2,
-  kOptimized = 3,
+  kBaseline = 1,
+  kOptimized = 2,
 };
 
 // Static representation of a wasm compilation hint
@@ -191,34 +191,33 @@ enum ModuleOrigin : uint8_t {
 
 struct ModuleWireBytes;
 
-class V8_EXPORT_PRIVATE DecodedFunctionNames {
+class V8_EXPORT_PRIVATE LazilyGeneratedNames {
  public:
-  WireBytesRef Lookup(const ModuleWireBytes& wire_bytes,
-                      uint32_t function_index,
-                      Vector<const WasmExport> export_table) const;
+  WireBytesRef LookupFunctionName(const ModuleWireBytes& wire_bytes,
+                                  uint32_t function_index,
+                                  Vector<const WasmExport> export_table) const;
+
+  // For memory and global.
+  std::pair<WireBytesRef, WireBytesRef> LookupNameFromImportsAndExports(
+      ImportExportKindCode kind, uint32_t index,
+      const Vector<const WasmImport> import_table,
+      const Vector<const WasmExport> export_table) const;
+
   void AddForTesting(int function_index, WireBytesRef name);
 
  private:
-  // {function_names_} is populated lazily after decoding, and therefore needs a
-  // mutex to protect concurrent modifications from multiple {WasmModuleObject}.
+  // {function_names_}, {global_names_} and {memory_names_} are
+  // populated lazily after decoding, and therefore need a mutex to protect
+  // concurrent modifications from multiple {WasmModuleObject}.
   mutable base::Mutex mutex_;
   mutable std::unique_ptr<std::unordered_map<uint32_t, WireBytesRef>>
       function_names_;
-};
-
-class V8_EXPORT_PRIVATE DecodedGlobalNames {
- public:
-  std::pair<WireBytesRef, WireBytesRef> Lookup(
-      uint32_t global_index, Vector<const WasmImport> import_table,
-      Vector<const WasmExport> export_table) const;
-
- private:
-  // {global_names_} is populated lazily after decoding, and therefore needs a
-  // mutex to protect concurrent modifications from multiple {WasmModuleObject}.
-  mutable base::Mutex mutex_;
   mutable std::unique_ptr<
       std::unordered_map<uint32_t, std::pair<WireBytesRef, WireBytesRef>>>
       global_names_;
+  mutable std::unique_ptr<
+      std::unordered_map<uint32_t, std::pair<WireBytesRef, WireBytesRef>>>
+      memory_names_;
 };
 
 class V8_EXPORT_PRIVATE AsmJsOffsetInformation {
@@ -249,6 +248,23 @@ class V8_EXPORT_PRIVATE AsmJsOffsetInformation {
   std::unique_ptr<AsmJsOffsets> decoded_offsets_;
 };
 
+struct TypeDefinition {
+  explicit TypeDefinition(const FunctionSig* sig) : function_sig(sig) {}
+  explicit TypeDefinition(const StructType* type) : struct_type(type) {}
+  explicit TypeDefinition(const ArrayType* type) : array_type(type) {}
+  union {
+    const FunctionSig* function_sig;
+    const StructType* struct_type;
+    const ArrayType* array_type;
+  };
+};
+
+struct V8_EXPORT_PRIVATE WasmDebugSymbols {
+  enum class Type { None, SourceMap, EmbeddedDWARF, ExternalDWARF };
+  Type type = Type::None;
+  WireBytesRef external_url;
+};
+
 // Static representation of a module.
 struct V8_EXPORT_PRIVATE WasmModule {
   std::unique_ptr<Zone> signature_zone;
@@ -273,8 +289,44 @@ struct V8_EXPORT_PRIVATE WasmModule {
   uint32_t num_declared_data_segments = 0;  // From the DataCount section.
   WireBytesRef code = {0, 0};
   WireBytesRef name = {0, 0};
-  std::vector<const FunctionSig*> signatures;  // by signature index
-  std::vector<uint32_t> signature_ids;   // by signature index
+  std::vector<TypeDefinition> types;    // by type index
+  std::vector<uint8_t> type_kinds;      // by type index
+  std::vector<uint32_t> signature_ids;  // by signature index
+  void add_signature(const FunctionSig* sig) {
+    types.push_back(TypeDefinition(sig));
+    type_kinds.push_back(kWasmFunctionTypeCode);
+    uint32_t canonical_id = sig ? signature_map.FindOrInsert(*sig) : 0;
+    signature_ids.push_back(canonical_id);
+  }
+  const FunctionSig* signature(uint32_t index) const {
+    DCHECK(type_kinds[index] == kWasmFunctionTypeCode);
+    return types[index].function_sig;
+  }
+  bool has_signature(uint32_t index) const {
+    return index < types.size() && type_kinds[index] == kWasmFunctionTypeCode;
+  }
+  void add_struct_type(const StructType* type) {
+    types.push_back(TypeDefinition(type));
+    type_kinds.push_back(kWasmStructTypeCode);
+  }
+  const StructType* struct_type(uint32_t index) const {
+    DCHECK(type_kinds[index] == kWasmStructTypeCode);
+    return types[index].struct_type;
+  }
+  bool has_struct(uint32_t index) const {
+    return index < types.size() && type_kinds[index] == kWasmStructTypeCode;
+  }
+  void add_array_type(const ArrayType* type) {
+    types.push_back(TypeDefinition(type));
+    type_kinds.push_back(kWasmArrayTypeCode);
+  }
+  const ArrayType* array_type(uint32_t index) const {
+    DCHECK(type_kinds[index] == kWasmArrayTypeCode);
+    return types[index].array_type;
+  }
+  bool has_array(uint32_t index) const {
+    return index < types.size() && type_kinds[index] == kWasmArrayTypeCode;
+  }
   std::vector<WasmFunction> functions;
   std::vector<WasmDataSegment> data_segments;
   std::vector<WasmTable> tables;
@@ -286,9 +338,8 @@ struct V8_EXPORT_PRIVATE WasmModule {
   SignatureMap signature_map;  // canonicalizing map for signature indexes.
 
   ModuleOrigin origin = kWasmOrigin;  // origin of the module
-  DecodedFunctionNames function_names;
-  DecodedGlobalNames global_names;
-  std::string source_map_url;
+  LazilyGeneratedNames lazily_generated_names;
+  WasmDebugSymbols debug_symbols;
 
   // Asm.js source position information. Only available for modules compiled
   // from asm.js.
diff --git a/deps/v8/src/wasm/wasm-objects-inl.h b/deps/v8/src/wasm/wasm-objects-inl.h
index 2e75981ff11..93234493445 100644
--- a/deps/v8/src/wasm/wasm-objects-inl.h
+++ b/deps/v8/src/wasm/wasm-objects-inl.h
@@ -37,6 +37,8 @@ OBJECT_CONSTRUCTORS_IMPL(WasmMemoryObject, JSObject)
 OBJECT_CONSTRUCTORS_IMPL(WasmModuleObject, JSObject)
 OBJECT_CONSTRUCTORS_IMPL(WasmTableObject, JSObject)
 OBJECT_CONSTRUCTORS_IMPL(AsmWasmData, Struct)
+TQ_OBJECT_CONSTRUCTORS_IMPL(WasmStruct)
+TQ_OBJECT_CONSTRUCTORS_IMPL(WasmArray)
 
 NEVER_READ_ONLY_SPACE_IMPL(WasmDebugInfo)
 
@@ -49,6 +51,8 @@ CAST_ACCESSOR(WasmMemoryObject)
 CAST_ACCESSOR(WasmModuleObject)
 CAST_ACCESSOR(WasmTableObject)
 CAST_ACCESSOR(AsmWasmData)
+CAST_ACCESSOR(WasmStruct)
+CAST_ACCESSOR(WasmArray)
 
 #define OPTIONAL_ACCESSORS(holder, name, type, offset)                \
   DEF_GETTER(holder, has_##name, bool) {                              \
@@ -264,6 +268,8 @@ OPTIONAL_ACCESSORS(WasmInstanceObject, exceptions_table, FixedArray,
                    kExceptionsTableOffset)
 OPTIONAL_ACCESSORS(WasmInstanceObject, wasm_external_functions, FixedArray,
                    kWasmExternalFunctionsOffset)
+ACCESSORS(WasmInstanceObject, managed_object_maps, FixedArray,
+          kManagedObjectMapsOffset)
 
 void WasmInstanceObject::clear_padding() {
   if (FIELD_SIZE(kOptionalPaddingOffset) != 0) {
@@ -412,6 +418,51 @@ ACCESSORS(AsmWasmData, managed_native_module, Managed<wasm::NativeModule>,
 ACCESSORS(AsmWasmData, export_wrappers, FixedArray, kExportWrappersOffset)
 ACCESSORS(AsmWasmData, uses_bitset, HeapNumber, kUsesBitsetOffset)
 
+wasm::StructType* WasmStruct::type(Map map) {
+  Foreign foreign = map.wasm_type_info();
+  return reinterpret_cast<wasm::StructType*>(foreign.foreign_address());
+}
+
+wasm::StructType* WasmStruct::GcSafeType(Map map) {
+  DCHECK_EQ(WASM_STRUCT_TYPE, map.instance_type());
+  HeapObject raw = HeapObject::cast(map.constructor_or_backpointer());
+  MapWord map_word = raw.map_word();
+  HeapObject forwarded =
+      map_word.IsForwardingAddress() ? map_word.ToForwardingAddress() : raw;
+  Foreign foreign = Foreign::cast(forwarded);
+  return reinterpret_cast<wasm::StructType*>(foreign.foreign_address());
+}
+
+wasm::StructType* WasmStruct::type() const { return type(map()); }
+
+ObjectSlot WasmStruct::RawField(int raw_offset) {
+  int offset = WasmStruct::kHeaderSize + raw_offset;
+  return ObjectSlot(FIELD_ADDR(*this, offset));
+}
+
+wasm::ArrayType* WasmArray::type(Map map) {
+  DCHECK_EQ(WASM_ARRAY_TYPE, map.instance_type());
+  Foreign foreign = map.wasm_type_info();
+  return reinterpret_cast<wasm::ArrayType*>(foreign.foreign_address());
+}
+
+wasm::ArrayType* WasmArray::GcSafeType(Map map) {
+  DCHECK_EQ(WASM_ARRAY_TYPE, map.instance_type());
+  HeapObject raw = HeapObject::cast(map.constructor_or_backpointer());
+  MapWord map_word = raw.map_word();
+  HeapObject forwarded =
+      map_word.IsForwardingAddress() ? map_word.ToForwardingAddress() : raw;
+  Foreign foreign = Foreign::cast(forwarded);
+  return reinterpret_cast<wasm::ArrayType*>(foreign.foreign_address());
+}
+
+wasm::ArrayType* WasmArray::type() const { return type(map()); }
+
+int WasmArray::SizeFor(Map map, int length) {
+  int element_size = type(map)->element_type().element_size_bytes();
+  return kHeaderSize + RoundUp(element_size * length, kTaggedSize);
+}
+
 #include "src/objects/object-macros-undef.h"
 
 }  // namespace internal
diff --git a/deps/v8/src/wasm/wasm-objects.cc b/deps/v8/src/wasm/wasm-objects.cc
index 41b9d503120..68557c7cd72 100644
--- a/deps/v8/src/wasm/wasm-objects.cc
+++ b/deps/v8/src/wasm/wasm-objects.cc
@@ -165,43 +165,24 @@ Handle<WasmModuleObject> WasmModuleObject::New(
 Handle<WasmModuleObject> WasmModuleObject::New(
     Isolate* isolate, std::shared_ptr<wasm::NativeModule> native_module,
     Handle<Script> script, Handle<FixedArray> export_wrappers) {
-  const WasmModule* module = native_module->module();
-  const bool uses_liftoff =
-      FLAG_liftoff && native_module->module()->origin == wasm::kWasmOrigin;
-  size_t code_size_estimate =
-      wasm::WasmCodeManager::EstimateNativeModuleCodeSize(module, uses_liftoff);
-  return New(isolate, std::move(native_module), script, export_wrappers,
-             code_size_estimate);
-}
-
-// static
-Handle<WasmModuleObject> WasmModuleObject::New(
-    Isolate* isolate, std::shared_ptr<wasm::NativeModule> native_module,
-    Handle<Script> script, Handle<FixedArray> export_wrappers,
-    size_t code_size_estimate) {
-  const WasmModule* module = native_module->module();
-
-  // Use the given shared {NativeModule}, but increase its reference count by
-  // allocating a new {Managed<T>} that the {WasmModuleObject} references.
-  size_t memory_estimate =
-      code_size_estimate +
-      wasm::WasmCodeManager::EstimateNativeModuleMetaDataSize(module);
-  Handle<Managed<wasm::NativeModule>> managed_native_module =
-      Managed<wasm::NativeModule>::FromSharedPtr(isolate, memory_estimate,
-                                                 std::move(native_module));
-
+  Handle<Managed<wasm::NativeModule>> managed_native_module;
+  if (script->type() == Script::TYPE_WASM) {
+    managed_native_module = handle(
+        Managed<wasm::NativeModule>::cast(script->wasm_managed_native_module()),
+        isolate);
+  } else {
+    const WasmModule* module = native_module->module();
+    size_t memory_estimate =
+        native_module->committed_code_space() +
+        wasm::WasmCodeManager::EstimateNativeModuleMetaDataSize(module);
+    managed_native_module = Managed<wasm::NativeModule>::FromSharedPtr(
+        isolate, memory_estimate, std::move(native_module));
+  }
   Handle<WasmModuleObject> module_object = Handle<WasmModuleObject>::cast(
       isolate->factory()->NewJSObject(isolate->wasm_module_constructor()));
   module_object->set_export_wrappers(*export_wrappers);
-  if (script->type() == Script::TYPE_WASM) {
-    script->set_wasm_breakpoint_infos(
-        ReadOnlyRoots(isolate).empty_fixed_array());
-    script->set_wasm_managed_native_module(*managed_native_module);
-    script->set_wasm_weak_instance_list(
-        ReadOnlyRoots(isolate).empty_weak_array_list());
-  }
-  module_object->set_script(*script);
   module_object->set_managed_native_module(*managed_native_module);
+  module_object->set_script(*script);
   return module_object;
 }
 
@@ -241,9 +222,10 @@ MaybeHandle<String> WasmModuleObject::GetFunctionNameOrNull(
     Isolate* isolate, Handle<WasmModuleObject> module_object,
     uint32_t func_index) {
   DCHECK_LT(func_index, module_object->module()->functions.size());
-  wasm::WireBytesRef name = module_object->module()->function_names.Lookup(
-      wasm::ModuleWireBytes(module_object->native_module()->wire_bytes()),
-      func_index, VectorOf(module_object->module()->export_table));
+  wasm::WireBytesRef name =
+      module_object->module()->lazily_generated_names.LookupFunctionName(
+          wasm::ModuleWireBytes(module_object->native_module()->wire_bytes()),
+          func_index, VectorOf(module_object->module()->export_table));
   if (!name.is_set()) return {};
   return ExtractUtf8StringFromModuleBytes(isolate, module_object, name,
                                           kNoInternalize);
@@ -267,8 +249,9 @@ Vector<const uint8_t> WasmModuleObject::GetRawFunctionName(
     uint32_t func_index) {
   DCHECK_GT(module()->functions.size(), func_index);
   wasm::ModuleWireBytes wire_bytes(native_module()->wire_bytes());
-  wasm::WireBytesRef name_ref = module()->function_names.Lookup(
-      wire_bytes, func_index, VectorOf(module()->export_table));
+  wasm::WireBytesRef name_ref =
+      module()->lazily_generated_names.LookupFunctionName(
+          wire_bytes, func_index, VectorOf(module()->export_table));
   wasm::WasmName name = wire_bytes.GetNameOrNull(name_ref);
   return Vector<const uint8_t>::cast(name);
 }
@@ -894,18 +877,17 @@ int32_t WasmMemoryObject::Grow(Isolate* isolate,
   std::shared_ptr<BackingStore> backing_store = old_buffer->GetBackingStore();
   if (!backing_store) return -1;
 
-  // Compute new size.
-  size_t new_pages = old_pages + pages;
-
   // Try to handle shared memory first.
   if (old_buffer->is_shared()) {
     if (FLAG_wasm_grow_shared_memory) {
+      base::Optional<size_t> result =
+          backing_store->GrowWasmMemoryInPlace(isolate, pages, maximum_pages);
       // Shared memories can only be grown in place; no copying.
-      if (backing_store->GrowWasmMemoryInPlace(isolate, pages, maximum_pages)) {
-        BackingStore::BroadcastSharedWasmMemoryGrow(isolate, backing_store,
-                                                    new_pages);
+      if (result.has_value()) {
+        BackingStore::BroadcastSharedWasmMemoryGrow(isolate, backing_store);
         // Broadcasting the update should update this memory object too.
         CHECK_NE(*old_buffer, memory_object->array_buffer());
+        size_t new_pages = result.value() + pages;
         // If the allocation succeeded, then this can't possibly overflow:
         size_t new_byte_length = new_pages * wasm::kWasmPageSize;
         // This is a less than check, as it is not guaranteed that the SAB
@@ -914,21 +896,29 @@ int32_t WasmMemoryObject::Grow(Isolate* isolate,
         // It is also possible that a call to Grow was in progress when
         // handling this call.
         CHECK_LE(new_byte_length, memory_object->array_buffer().byte_length());
-        return static_cast<int32_t>(old_pages);  // success
+        // As {old_pages} was read racefully, we return here the synchronized
+        // value provided by {GrowWasmMemoryInPlace}, to provide the atomic
+        // read-modify-write behavior required by the spec.
+        return static_cast<int32_t>(result.value());  // success
       }
     }
     return -1;
   }
 
+  base::Optional<size_t> result =
+      backing_store->GrowWasmMemoryInPlace(isolate, pages, maximum_pages);
   // Try to grow non-shared memory in-place.
-  if (backing_store->GrowWasmMemoryInPlace(isolate, pages, maximum_pages)) {
+  if (result.has_value()) {
     // Detach old and create a new one with the grown backing store.
     old_buffer->Detach(true);
     Handle<JSArrayBuffer> new_buffer =
         isolate->factory()->NewJSArrayBuffer(std::move(backing_store));
     memory_object->update_instances(isolate, new_buffer);
-    return static_cast<int32_t>(old_pages);  // success
+    DCHECK_EQ(result.value(), old_pages);
+    return static_cast<int32_t>(result.value());  // success
   }
+
+  size_t new_pages = old_pages + pages;
   // Try allocating a new backing store and copying.
   std::unique_ptr<BackingStore> new_backing_store =
       backing_store->CopyWasmMemory(isolate, new_pages);
@@ -1240,6 +1230,7 @@ Handle<WasmInstanceObject> WasmInstanceObject::New(
       module_object->native_module()->jump_table_start());
   instance->set_hook_on_function_call_address(
       isolate->debug()->hook_on_function_call_address());
+  instance->set_managed_object_maps(*isolate->factory()->empty_fixed_array());
 
   // Insert the new instance into the scripts weak list of instances. This list
   // is used for breakpoints affecting all instances belonging to the script.
@@ -1472,7 +1463,7 @@ void WasmInstanceObject::ImportWasmJSFunctionIntoTable(
         result.tagged_parameter_slots,
         result.protected_instructions_data.as_vector(),
         result.source_positions.as_vector(), GetCodeKind(result),
-        wasm::ExecutionTier::kNone);
+        wasm::ExecutionTier::kNone, wasm::kNoDebugging);
     wasm::WasmCode* published_code =
         native_module->PublishCode(std::move(wasm_code));
     isolate->counters()->wasm_generated_code_size()->Increment(
@@ -1523,27 +1514,48 @@ WasmInstanceObject::GetGlobalBufferAndIndex(Handle<WasmInstanceObject> instance,
 MaybeHandle<String> WasmInstanceObject::GetGlobalNameOrNull(
     Isolate* isolate, Handle<WasmInstanceObject> instance,
     uint32_t global_index) {
+  return WasmInstanceObject::GetNameFromImportsAndExportsOrNull(
+      isolate, instance, wasm::ImportExportKindCode::kExternalGlobal,
+      global_index);
+}
+
+// static
+MaybeHandle<String> WasmInstanceObject::GetMemoryNameOrNull(
+    Isolate* isolate, Handle<WasmInstanceObject> instance,
+    uint32_t global_index) {
+  return WasmInstanceObject::GetNameFromImportsAndExportsOrNull(
+      isolate, instance, wasm::ImportExportKindCode::kExternalMemory,
+      global_index);
+}
+
+// static
+MaybeHandle<String> WasmInstanceObject::GetNameFromImportsAndExportsOrNull(
+    Isolate* isolate, Handle<WasmInstanceObject> instance,
+    wasm::ImportExportKindCode kind, uint32_t index) {
+  DCHECK(kind == wasm::ImportExportKindCode::kExternalGlobal ||
+         kind == wasm::ImportExportKindCode::kExternalMemory);
   wasm::ModuleWireBytes wire_bytes(
       instance->module_object().native_module()->wire_bytes());
 
   // This is pair of <module_name, field_name>.
   // If field_name is not set then we don't generate a name. Else if module_name
-  // is set then it is imported global. Otherwise it is exported global.
+  // is set then it is an imported one. Otherwise it is an exported one.
   std::pair<wasm::WireBytesRef, wasm::WireBytesRef> name_ref =
-      instance->module()->global_names.Lookup(
-          global_index, VectorOf(instance->module()->import_table),
-          VectorOf(instance->module()->export_table));
+      instance->module()
+          ->lazily_generated_names.LookupNameFromImportsAndExports(
+              kind, index, VectorOf(instance->module()->import_table),
+              VectorOf(instance->module()->export_table));
   if (!name_ref.second.is_set()) return {};
   Vector<const char> field_name = wire_bytes.GetNameOrNull(name_ref.second);
   if (!name_ref.first.is_set()) {
     return isolate->factory()->NewStringFromUtf8(VectorOf(field_name));
   }
   Vector<const char> module_name = wire_bytes.GetNameOrNull(name_ref.first);
-  std::string global_name;
-  global_name.append(module_name.begin(), module_name.end());
-  global_name.append(".");
-  global_name.append(field_name.begin(), field_name.end());
-  return isolate->factory()->NewStringFromUtf8(VectorOf(global_name));
+  std::string full_name;
+  full_name.append(module_name.begin(), module_name.end());
+  full_name.append(".");
+  full_name.append(field_name.begin(), field_name.end());
+  return isolate->factory()->NewStringFromUtf8(VectorOf(full_name));
 }
 
 // static
@@ -1719,10 +1731,15 @@ uint32_t WasmExceptionPackage::GetEncodedSize(
       case wasm::ValueType::kFuncRef:
       case wasm::ValueType::kNullRef:
       case wasm::ValueType::kExnRef:
+      case wasm::ValueType::kRef:
+      case wasm::ValueType::kOptRef:
+      case wasm::ValueType::kEqRef:
         encoded_size += 1;
         break;
       case wasm::ValueType::kStmt:
       case wasm::ValueType::kBottom:
+      case wasm::ValueType::kI8:
+      case wasm::ValueType::kI16:
         UNREACHABLE();
     }
   }
diff --git a/deps/v8/src/wasm/wasm-objects.h b/deps/v8/src/wasm/wasm-objects.h
index 972e8d31cd3..217bd50d154 100644
--- a/deps/v8/src/wasm/wasm-objects.h
+++ b/deps/v8/src/wasm/wasm-objects.h
@@ -13,7 +13,9 @@
 #include "src/debug/debug.h"
 #include "src/heap/heap.h"
 #include "src/objects/objects.h"
+#include "src/wasm/struct-types.h"
 #include "src/wasm/value-type.h"
+#include "torque-generated/class-definitions-tq.h"
 
 // Has to be the last include (doesn't have include guards)
 #include "src/objects/object-macros.h"
@@ -150,10 +152,6 @@ class WasmModuleObject : public JSObject {
   V8_EXPORT_PRIVATE static Handle<WasmModuleObject> New(
       Isolate* isolate, std::shared_ptr<wasm::NativeModule> native_module,
       Handle<Script> script, Handle<FixedArray> export_wrappers);
-  V8_EXPORT_PRIVATE static Handle<WasmModuleObject> New(
-      Isolate* isolate, std::shared_ptr<wasm::NativeModule> native_module,
-      Handle<Script> script, Handle<FixedArray> export_wrappers,
-      size_t code_size_estimate);
 
   // Check whether this module was generated from asm.js source.
   inline bool is_asm_js();
@@ -389,6 +387,7 @@ class WasmInstanceObject : public JSObject {
   DECL_OPTIONAL_ACCESSORS(managed_native_allocations, Foreign)
   DECL_OPTIONAL_ACCESSORS(exceptions_table, FixedArray)
   DECL_OPTIONAL_ACCESSORS(wasm_external_functions, FixedArray)
+  DECL_ACCESSORS(managed_object_maps, FixedArray)
   DECL_PRIMITIVE_ACCESSORS(memory_start, byte*)
   DECL_PRIMITIVE_ACCESSORS(memory_size, size_t)
   DECL_PRIMITIVE_ACCESSORS(memory_mask, size_t)
@@ -448,6 +447,7 @@ class WasmInstanceObject : public JSObject {
   V(kManagedNativeAllocationsOffset, kTaggedSize)                         \
   V(kExceptionsTableOffset, kTaggedSize)                                  \
   V(kWasmExternalFunctionsOffset, kTaggedSize)                            \
+  V(kManagedObjectMapsOffset, kTaggedSize)                                \
   V(kRealStackLimitAddressOffset, kSystemPointerSize)                     \
   V(kDataSegmentStartsOffset, kSystemPointerSize)                         \
   V(kDataSegmentSizesOffset, kSystemPointerSize)                          \
@@ -485,7 +485,8 @@ class WasmInstanceObject : public JSObject {
       kIndirectFunctionTablesOffset,
       kManagedNativeAllocationsOffset,
       kExceptionsTableOffset,
-      kWasmExternalFunctionsOffset};
+      kWasmExternalFunctionsOffset,
+      kManagedObjectMapsOffset};
 
   V8_EXPORT_PRIVATE const wasm::WasmModule* module();
 
@@ -572,9 +573,19 @@ class WasmInstanceObject : public JSObject {
                                                  Handle<WasmInstanceObject>,
                                                  uint32_t global_index);
 
+  // Get the name of a memory in the given instance by index.
+  static MaybeHandle<String> GetMemoryNameOrNull(Isolate*,
+                                                 Handle<WasmInstanceObject>,
+                                                 uint32_t memory_index);
+
   OBJECT_CONSTRUCTORS(WasmInstanceObject, JSObject);
 
  private:
+  // Get the name in the given instance by index and kind.
+  static MaybeHandle<String> GetNameFromImportsAndExportsOrNull(
+      Isolate*, Handle<WasmInstanceObject>, wasm::ImportExportKindCode kind,
+      uint32_t index);
+
   static void InitDataSegmentArrays(Handle<WasmInstanceObject>,
                                     Handle<WasmModuleObject>);
   static void InitElemSegmentArrays(Handle<WasmInstanceObject>,
@@ -831,65 +842,6 @@ class WasmDebugInfo : public Struct {
   V8_EXPORT_PRIVATE static wasm::WasmInterpreter* SetupForTesting(
       Handle<WasmInstanceObject>);
 
-  // Prepare WasmDebugInfo for stepping in the given function.
-  V8_EXPORT_PRIVATE static void PrepareStepIn(Handle<WasmDebugInfo>,
-                                              int func_index);
-
-  // Set a breakpoint in the given function at the given byte offset within that
-  // function. This will redirect all future calls to this function to the
-  // interpreter and will always pause at the given offset.
-  V8_EXPORT_PRIVATE static void SetBreakpoint(Handle<WasmDebugInfo>,
-                                              int func_index, int offset);
-
-  // Clear a previously set breakpoint in the given function at the given byte
-  // offset within that function.
-  V8_EXPORT_PRIVATE static void ClearBreakpoint(Handle<WasmDebugInfo>,
-                                                int func_index, int offset);
-
-  // Make a set of functions always execute in the interpreter without setting
-  // breakpoints.
-  V8_EXPORT_PRIVATE static void RedirectToInterpreter(Handle<WasmDebugInfo>,
-                                                      Vector<int> func_indexes);
-
-  void PrepareStep(StepAction);
-
-  // Execute the specified function in the interpreter. Read arguments from the
-  // {argument_values} vector and write to {return_values} on regular exit.
-  // The frame_pointer will be used to identify the new activation of the
-  // interpreter for unwinding and frame inspection.
-  // Returns true if exited regularly, false if a trap occurred. In the latter
-  // case, a pending exception will have been set on the isolate.
-  static bool RunInterpreter(Isolate* isolate, Handle<WasmDebugInfo>,
-                             Address frame_pointer, int func_index,
-                             Vector<wasm::WasmValue> argument_values,
-                             Vector<wasm::WasmValue> return_values);
-
-  // Get the stack of the wasm interpreter as pairs of <function index, byte
-  // offset>. The list is ordered bottom-to-top, i.e. caller before callee.
-  std::vector<std::pair<uint32_t, int>> GetInterpretedStack(
-      Address frame_pointer);
-
-  int NumberOfActiveFrames(Address frame_pointer);
-
-  V8_EXPORT_PRIVATE
-  std::unique_ptr<wasm::InterpretedFrame, wasm::InterpretedFrameDeleter>
-  GetInterpretedFrame(Address frame_pointer, int frame_index);
-
-  // Returns the number of calls / function frames executed in the interpreter.
-  V8_EXPORT_PRIVATE uint64_t NumInterpretedCalls();
-
-  // Get local scope details for a specific interpreted frame. It contains
-  // information about parameters, locals, and stack values.
-  static Handle<JSObject> GetLocalScopeObject(Handle<WasmDebugInfo>,
-                                              Address frame_pointer,
-                                              int frame_index);
-
-  // Get stack scope details for a specific interpreted frame. It contains
-  // information about stack values.
-  static Handle<JSObject> GetStackScopeObject(Handle<WasmDebugInfo>,
-                                              Address frame_pointer,
-                                              int frame_index);
-
   V8_EXPORT_PRIVATE static Handle<Code> GetCWasmEntry(Handle<WasmDebugInfo>,
                                                       const wasm::FunctionSig*);
 
@@ -930,8 +882,8 @@ class WasmScript : public AllStatic {
   V8_EXPORT_PRIVATE static bool ClearBreakPointById(Handle<Script>,
                                                     int breakpoint_id);
 
-  static void SetBreakpointsOnNewInstance(Handle<Script>,
-                                          Handle<WasmInstanceObject>);
+  // Remove all set breakpoints.
+  static void ClearAllBreakpoints(Script);
 
   // Get a list of all possible breakpoints within a given range of this module.
   V8_EXPORT_PRIVATE static bool GetPossibleBreakpoints(
@@ -947,9 +899,6 @@ class WasmScript : public AllStatic {
   // Helper functions that update the breakpoint info list.
   static void AddBreakpointToInfo(Handle<Script>, int position,
                                   Handle<BreakPoint> break_point);
-
-  static bool RemoveBreakpointFromInfo(Handle<Script>, int position,
-                                       Handle<BreakPoint> break_point);
 };
 
 // Tags provide an object identity for each exception defined in a wasm module
@@ -989,6 +938,38 @@ class AsmWasmData : public Struct {
   OBJECT_CONSTRUCTORS(AsmWasmData, Struct);
 };
 
+class WasmStruct : public TorqueGeneratedWasmStruct<WasmStruct, HeapObject> {
+ public:
+  static inline wasm::StructType* type(Map map);
+  inline wasm::StructType* type() const;
+  static inline wasm::StructType* GcSafeType(Map map);
+
+  inline ObjectSlot RawField(int raw_offset);
+
+  DECL_CAST(WasmStruct)
+  DECL_PRINTER(WasmStruct)
+
+  class BodyDescriptor;
+
+  TQ_OBJECT_CONSTRUCTORS(WasmStruct)
+};
+
+class WasmArray : public TorqueGeneratedWasmArray<WasmArray, HeapObject> {
+ public:
+  static inline wasm::ArrayType* type(Map map);
+  inline wasm::ArrayType* type() const;
+  static inline wasm::ArrayType* GcSafeType(Map map);
+
+  static inline int SizeFor(Map map, int length);
+
+  DECL_CAST(WasmArray)
+  DECL_PRINTER(WasmArray)
+
+  class BodyDescriptor;
+
+  TQ_OBJECT_CONSTRUCTORS(WasmArray)
+};
+
 #undef DECL_OPTIONAL_ACCESSORS
 
 }  // namespace internal
diff --git a/deps/v8/src/wasm/wasm-objects.tq b/deps/v8/src/wasm/wasm-objects.tq
index 8eda9aba2ea..e611ced16ef 100644
--- a/deps/v8/src/wasm/wasm-objects.tq
+++ b/deps/v8/src/wasm/wasm-objects.tq
@@ -102,3 +102,15 @@ extern class AsmWasmData extends Struct {
   export_wrappers: FixedArray;
   uses_bitset: HeapNumber;
 }
+
+@generateCppClass
+extern class WasmStruct extends HeapObject {
+}
+
+@generateCppClass
+extern class WasmArray extends HeapObject {
+  length: uint32;
+
+  @if(TAGGED_SIZE_8_BYTES) optional_padding: uint32;
+  @ifnot(TAGGED_SIZE_8_BYTES) optional_padding: void;
+}
diff --git a/deps/v8/src/wasm/wasm-opcodes.cc b/deps/v8/src/wasm/wasm-opcodes.cc
index 769eba35a1c..43029e4bf16 100644
--- a/deps/v8/src/wasm/wasm-opcodes.cc
+++ b/deps/v8/src/wasm/wasm-opcodes.cc
@@ -35,10 +35,10 @@ namespace wasm {
 #define CASE_S32x4_OP(name, str) CASE_OP(S32x4##name, "s32x4." str)
 #define CASE_S16x8_OP(name, str) CASE_OP(S16x8##name, "s16x8." str)
 #define CASE_S8x16_OP(name, str) CASE_OP(S8x16##name, "s8x16." str)
-#define CASE_S1x2_OP(name, str) CASE_OP(S1x2##name, "s1x2." str)
-#define CASE_S1x4_OP(name, str) CASE_OP(S1x4##name, "s1x4." str)
-#define CASE_S1x8_OP(name, str) CASE_OP(S1x8##name, "s1x8." str)
-#define CASE_S1x16_OP(name, str) CASE_OP(S1x16##name, "s1x16." str)
+#define CASE_V64x2_OP(name, str) CASE_OP(V64x2##name, "v64x2." str)
+#define CASE_V32x4_OP(name, str) CASE_OP(V32x4##name, "v32x4." str)
+#define CASE_V16x8_OP(name, str) CASE_OP(V16x8##name, "v16x8." str)
+#define CASE_V8x16_OP(name, str) CASE_OP(V8x16##name, "v8x16." str)
 #define CASE_INT_OP(name, str) CASE_I32_OP(name, str) CASE_I64_OP(name, str)
 #define CASE_FLOAT_OP(name, str) CASE_F32_OP(name, str) CASE_F64_OP(name, str)
 #define CASE_ALL_OP(name, str) CASE_FLOAT_OP(name, str) CASE_INT_OP(name, str)
@@ -50,6 +50,8 @@ namespace wasm {
   CASE_F32x4_OP(name, str) CASE_F64x2_OP(name, str)
 #define CASE_SIMDI_OP(name, str) \
   CASE_I32x4_OP(name, str) CASE_I16x8_OP(name, str) CASE_I8x16_OP(name, str)
+#define CASE_SIMDV_OP(name, str) \
+  CASE_V32x4_OP(name, str) CASE_V16x8_OP(name, str) CASE_V8x16_OP(name, str)
 #define CASE_SIGN_OP(TYPE, name, str) \
   CASE_##TYPE##_OP(name##S, str "_s") CASE_##TYPE##_OP(name##U, str "_u")
 #define CASE_UNSIGNED_OP(TYPE, name, str) CASE_##TYPE##_OP(name##U, str "_u")
@@ -116,6 +118,7 @@ const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
     CASE_REF_OP(Null, "null")
     CASE_REF_OP(IsNull, "is_null")
     CASE_REF_OP(Func, "func")
+    CASE_REF_OP(AsNonNull, "as_non_null")
     CASE_I32_OP(ConvertI64, "wrap_i64")
     CASE_CONVERT_OP(Convert, INT, F32, "f32", "trunc")
     CASE_CONVERT_OP(Convert, INT, F64, "f64", "trunc")
@@ -148,6 +151,7 @@ const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
     CASE_OP(CallIndirect, "call_indirect")
     CASE_OP(ReturnCall, "return_call")
     CASE_OP(ReturnCallIndirect, "return_call_indirect")
+    CASE_OP(BrOnNull, "br_on_null")
     CASE_OP(Drop, "drop")
     CASE_OP(Select, "select")
     CASE_OP(SelectWithType, "select")
@@ -288,14 +292,10 @@ const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
     CASE_S128_OP(AndNot, "andnot")
     CASE_S8x16_OP(Swizzle, "swizzle")
     CASE_S8x16_OP(Shuffle, "shuffle")
-    CASE_S1x2_OP(AnyTrue, "any_true")
-    CASE_S1x2_OP(AllTrue, "all_true")
-    CASE_S1x4_OP(AnyTrue, "any_true")
-    CASE_S1x4_OP(AllTrue, "all_true")
-    CASE_S1x8_OP(AnyTrue, "any_true")
-    CASE_S1x8_OP(AllTrue, "all_true")
-    CASE_S1x16_OP(AnyTrue, "any_true")
-    CASE_S1x16_OP(AllTrue, "all_true")
+    CASE_SIMDV_OP(AnyTrue, "any_true")
+    CASE_SIMDV_OP(AllTrue, "all_true")
+    CASE_V64x2_OP(AnyTrue, "any_true")
+    CASE_V64x2_OP(AllTrue, "all_true")
     CASE_SIMDF_OP(Qfma, "qfma")
     CASE_SIMDF_OP(Qfms, "qfms")
 
@@ -321,6 +321,16 @@ const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
     CASE_I16x8_OP(BitMask, "bitmask")
     CASE_I32x4_OP(BitMask, "bitmask")
 
+    CASE_F32x4_OP(Pmin, "pmin")
+    CASE_F32x4_OP(Pmax, "pmax")
+    CASE_F64x2_OP(Pmin, "pmin")
+    CASE_F64x2_OP(Pmax, "pmax")
+
+    CASE_F32x4_OP(Ceil, "ceil")
+    CASE_F32x4_OP(Floor, "floor")
+    CASE_F32x4_OP(Trunc, "trunc")
+    CASE_F32x4_OP(NearestInt, "nearest")
+
     // Atomic operations.
     CASE_OP(AtomicNotify, "atomic.notify")
     CASE_INT_OP(AtomicWait, "atomic.wait")
@@ -335,9 +345,45 @@ const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
     CASE_UNSIGNED_ALL_OP(AtomicExchange, "atomic.xchng")
     CASE_UNSIGNED_ALL_OP(AtomicCompareExchange, "atomic.cmpxchng")
 
-    default : return "unknown";
+    // GC operations.
+    CASE_OP(StructNew, "struct.new")
+    CASE_OP(StructNewSub, "struct.new_sub")
+    CASE_OP(StructNewDefault, "struct.new_default")
+    CASE_OP(StructGet, "struct.get")
+    CASE_OP(StructGetS, "struct.get_s")
+    CASE_OP(StructGetU, "struct.get_u")
+    CASE_OP(StructSet, "struct.set")
+    CASE_OP(ArrayNew, "array.new")
+    CASE_OP(ArrayNewSub, "array.new_sub")
+    CASE_OP(ArrayNewDefault, "array.new_default")
+    CASE_OP(ArrayGet, "array.get")
+    CASE_OP(ArrayGetS, "array.get_s")
+    CASE_OP(ArrayGetU, "array.get_u")
+    CASE_OP(ArrayLen, "array.len")
+    CASE_OP(ArraySet, "array.set")
+    CASE_OP(I31New, "i31.new")
+    CASE_OP(I31GetS, "i31.get_s")
+    CASE_OP(I31GetU, "i31.get_u")
+    CASE_OP(RttGet, "rtt.get")
+    CASE_OP(RttSub, "rtt.sub")
+    CASE_OP(RefTest, "ref.test")
+    CASE_OP(RefCast, "ref.cast")
+    CASE_OP(BrOnCast, "br_on_cast")
+    CASE_OP(RefEq, "ref.eq")
+    CASE_OP(Let, "let")
+
+
+    case kNumericPrefix:
+    case kSimdPrefix:
+    case kAtomicPrefix:
+    case kGCPrefix:
+      return "unknown";
     // clang-format on
   }
+  // Even though the switch above handles all well-defined enum values,
+  // random modules (e.g. fuzzer generated) can call this function with
+  // random (invalid) opcodes. Handle those here:
+  return "invalid opcode";
 }
 
 #undef CASE_OP
@@ -357,10 +403,6 @@ const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
 #undef CASE_S32x4_OP
 #undef CASE_S16x8_OP
 #undef CASE_S8x16_OP
-#undef CASE_S1x2_OP
-#undef CASE_S1x4_OP
-#undef CASE_S1x8_OP
-#undef CASE_S1x16_OP
 #undef CASE_INT_OP
 #undef CASE_FLOAT_OP
 #undef CASE_ALL_OP
@@ -427,6 +469,7 @@ bool WasmOpcodes::IsAnyRefOpcode(WasmOpcode opcode) {
     case kExprRefNull:
     case kExprRefIsNull:
     case kExprRefFunc:
+    case kExprRefAsNonNull:
       return true;
     default:
       return false;
diff --git a/deps/v8/src/wasm/wasm-opcodes.h b/deps/v8/src/wasm/wasm-opcodes.h
index d5c16448247..6c686eff12c 100644
--- a/deps/v8/src/wasm/wasm-opcodes.h
+++ b/deps/v8/src/wasm/wasm-opcodes.h
@@ -37,7 +37,9 @@ bool IsJSCompatibleSignature(const FunctionSig* sig, const WasmFeatures&);
   V(Br, 0x0c, _)                         \
   V(BrIf, 0x0d, _)                       \
   V(BrTable, 0x0e, _)                    \
-  V(Return, 0x0f, _)
+  V(Return, 0x0f, _)                     \
+  V(Let, 0x17, _ /* gc prototype */)     \
+  V(BrOnNull, 0xd4, _ /* gc prototype */)
 
 // Constants, locals, globals, and calls.
 #define FOREACH_MISC_OPCODE(V)   \
@@ -60,7 +62,8 @@ bool IsJSCompatibleSignature(const FunctionSig* sig, const WasmFeatures&);
   V(F32Const, 0x43, _)           \
   V(F64Const, 0x44, _)           \
   V(RefNull, 0xd0, _)            \
-  V(RefFunc, 0xd2, _)
+  V(RefFunc, 0xd2, _)            \
+  V(RefAsNonNull, 0xd3, _)
 
 // Load memory expressions.
 #define FOREACH_LOAD_MEM_OPCODE(V) \
@@ -227,9 +230,13 @@ bool IsJSCompatibleSignature(const FunctionSig* sig, const WasmFeatures&);
   V(I64SExtendI16, 0xc3, l_l)     \
   V(I64SExtendI32, 0xc4, l_l)
 
-#define FOREACH_SIMPLE_PROTOTYPE_OPCODE(V) V(RefIsNull, 0xd1, i_r)
+#define FOREACH_SIMPLE_PROTOTYPE_OPCODE(V) \
+  V(RefIsNull, 0xd1, i_r)                  \
+  V(RefEq, 0xd5, i_rr)  // made-up opcode, guessing future spec (GC)
 
 // For compatibility with Asm.js.
+// These opcodes are not spec'ed (or visible) externally; the idea is
+// to use unused ranges for internal purposes.
 #define FOREACH_ASMJS_COMPAT_OPCODE(V) \
   V(F64Acos, 0xc5, d_d)                \
   V(F64Asin, 0xc6, d_d)                \
@@ -242,9 +249,9 @@ bool IsJSCompatibleSignature(const FunctionSig* sig, const WasmFeatures&);
   V(F64Atan2, 0xcd, d_dd)              \
   V(F64Pow, 0xce, d_dd)                \
   V(F64Mod, 0xcf, d_dd)                \
-  V(I32AsmjsDivS, 0xd3, i_ii)          \
-  V(I32AsmjsDivU, 0xd4, i_ii)          \
-  V(I32AsmjsRemS, 0xd5, i_ii)          \
+  V(I32AsmjsDivS, 0xe7, i_ii)          \
+  V(I32AsmjsDivU, 0xe8, i_ii)          \
+  V(I32AsmjsRemS, 0xe9, i_ii)          \
   V(I32AsmjsRemU, 0xd6, i_ii)          \
   V(I32AsmjsLoadMem8S, 0xd7, i_i)      \
   V(I32AsmjsLoadMem8U, 0xd8, i_i)      \
@@ -265,217 +272,225 @@ bool IsJSCompatibleSignature(const FunctionSig* sig, const WasmFeatures&);
 
 #define FOREACH_SIMD_MEM_OPCODE(V) \
   V(S128LoadMem, 0xfd00, s_i)      \
-  V(S128StoreMem, 0xfd01, v_is)    \
-  V(S8x16LoadSplat, 0xfdc2, s_i)   \
-  V(S16x8LoadSplat, 0xfdc3, s_i)   \
-  V(S32x4LoadSplat, 0xfdc4, s_i)   \
-  V(S64x2LoadSplat, 0xfdc5, s_i)   \
-  V(I16x8Load8x8S, 0xfdd2, s_i)    \
-  V(I16x8Load8x8U, 0xfdd3, s_i)    \
-  V(I32x4Load16x4S, 0xfdd4, s_i)   \
-  V(I32x4Load16x4U, 0xfdd5, s_i)   \
-  V(I64x2Load32x2S, 0xfdd6, s_i)   \
-  V(I64x2Load32x2U, 0xfdd7, s_i)
-
-#define FOREACH_SIMD_MASK_OPERAND_OPCODE(V) V(S8x16Shuffle, 0xfd03, s_ss)
+  V(I16x8Load8x8S, 0xfd01, s_i)    \
+  V(I16x8Load8x8U, 0xfd02, s_i)    \
+  V(I32x4Load16x4S, 0xfd03, s_i)   \
+  V(I32x4Load16x4U, 0xfd04, s_i)   \
+  V(I64x2Load32x2S, 0xfd05, s_i)   \
+  V(I64x2Load32x2U, 0xfd06, s_i)   \
+  V(S8x16LoadSplat, 0xfd07, s_i)   \
+  V(S16x8LoadSplat, 0xfd08, s_i)   \
+  V(S32x4LoadSplat, 0xfd09, s_i)   \
+  V(S64x2LoadSplat, 0xfd0a, s_i)   \
+  V(S128StoreMem, 0xfd0b, v_is)
+
+#define FOREACH_SIMD_MASK_OPERAND_OPCODE(V) V(S8x16Shuffle, 0xfd0d, s_ss)
 
 #define FOREACH_SIMD_MVP_0_OPERAND_OPCODE(V) \
-  V(I8x16Splat, 0xfd04, s_i)                 \
-  V(I16x8Splat, 0xfd08, s_i)                 \
-  V(I32x4Splat, 0xfd0c, s_i)                 \
-  V(I64x2Splat, 0xfd0f, s_l)                 \
-  V(F32x4Splat, 0xfd12, s_f)                 \
-  V(F64x2Splat, 0xfd15, s_d)                 \
-  V(I8x16Eq, 0xfd18, s_ss)                   \
-  V(I8x16Ne, 0xfd19, s_ss)                   \
-  V(I8x16LtS, 0xfd1a, s_ss)                  \
-  V(I8x16LtU, 0xfd1b, s_ss)                  \
-  V(I8x16GtS, 0xfd1c, s_ss)                  \
-  V(I8x16GtU, 0xfd1d, s_ss)                  \
-  V(I8x16LeS, 0xfd1e, s_ss)                  \
-  V(I8x16LeU, 0xfd1f, s_ss)                  \
-  V(I8x16GeS, 0xfd20, s_ss)                  \
-  V(I8x16GeU, 0xfd21, s_ss)                  \
-  V(I16x8Eq, 0xfd22, s_ss)                   \
-  V(I16x8Ne, 0xfd23, s_ss)                   \
-  V(I16x8LtS, 0xfd24, s_ss)                  \
-  V(I16x8LtU, 0xfd25, s_ss)                  \
-  V(I16x8GtS, 0xfd26, s_ss)                  \
-  V(I16x8GtU, 0xfd27, s_ss)                  \
-  V(I16x8LeS, 0xfd28, s_ss)                  \
-  V(I16x8LeU, 0xfd29, s_ss)                  \
-  V(I16x8GeS, 0xfd2a, s_ss)                  \
-  V(I16x8GeU, 0xfd2b, s_ss)                  \
-  V(I32x4Eq, 0xfd2c, s_ss)                   \
-  V(I32x4Ne, 0xfd2d, s_ss)                   \
-  V(I32x4LtS, 0xfd2e, s_ss)                  \
-  V(I32x4LtU, 0xfd2f, s_ss)                  \
-  V(I32x4GtS, 0xfd30, s_ss)                  \
-  V(I32x4GtU, 0xfd31, s_ss)                  \
-  V(I32x4LeS, 0xfd32, s_ss)                  \
-  V(I32x4LeU, 0xfd33, s_ss)                  \
-  V(I32x4GeS, 0xfd34, s_ss)                  \
-  V(I32x4GeU, 0xfd35, s_ss)                  \
-  V(F32x4Eq, 0xfd40, s_ss)                   \
-  V(F32x4Ne, 0xfd41, s_ss)                   \
-  V(F32x4Lt, 0xfd42, s_ss)                   \
-  V(F32x4Gt, 0xfd43, s_ss)                   \
-  V(F32x4Le, 0xfd44, s_ss)                   \
-  V(F32x4Ge, 0xfd45, s_ss)                   \
-  V(F64x2Eq, 0xfd46, s_ss)                   \
-  V(F64x2Ne, 0xfd47, s_ss)                   \
-  V(F64x2Lt, 0xfd48, s_ss)                   \
-  V(F64x2Gt, 0xfd49, s_ss)                   \
-  V(F64x2Le, 0xfd4a, s_ss)                   \
-  V(F64x2Ge, 0xfd4b, s_ss)                   \
-  V(S128Not, 0xfd4c, s_s)                    \
-  V(S128And, 0xfd4d, s_ss)                   \
-  V(S128Or, 0xfd4e, s_ss)                    \
-  V(S128Xor, 0xfd4f, s_ss)                   \
-  V(S128Select, 0xfd50, s_sss)               \
-  V(I8x16Neg, 0xfd51, s_s)                   \
-  V(S1x16AnyTrue, 0xfd52, i_s)               \
-  V(S1x16AllTrue, 0xfd53, i_s)               \
-  V(I8x16Shl, 0xfd54, s_si)                  \
-  V(I8x16ShrS, 0xfd55, s_si)                 \
-  V(I8x16ShrU, 0xfd56, s_si)                 \
-  V(I8x16Add, 0xfd57, s_ss)                  \
-  V(I8x16AddSaturateS, 0xfd58, s_ss)         \
-  V(I8x16AddSaturateU, 0xfd59, s_ss)         \
-  V(I8x16Sub, 0xfd5a, s_ss)                  \
-  V(I8x16SubSaturateS, 0xfd5b, s_ss)         \
-  V(I8x16SubSaturateU, 0xfd5c, s_ss)         \
-  V(I8x16Mul, 0xfd5d, s_ss)                  \
-  V(I8x16MinS, 0xfd5e, s_ss)                 \
-  V(I8x16MinU, 0xfd5f, s_ss)                 \
-  V(I8x16MaxS, 0xfd60, s_ss)                 \
-  V(I8x16MaxU, 0xfd61, s_ss)                 \
-  V(I16x8Neg, 0xfd62, s_s)                   \
-  V(S1x8AnyTrue, 0xfd63, i_s)                \
-  V(S1x8AllTrue, 0xfd64, i_s)                \
-  V(I16x8Shl, 0xfd65, s_si)                  \
-  V(I16x8ShrS, 0xfd66, s_si)                 \
-  V(I16x8ShrU, 0xfd67, s_si)                 \
-  V(I16x8Add, 0xfd68, s_ss)                  \
-  V(I16x8AddSaturateS, 0xfd69, s_ss)         \
-  V(I16x8AddSaturateU, 0xfd6a, s_ss)         \
-  V(I16x8Sub, 0xfd6b, s_ss)                  \
-  V(I16x8SubSaturateS, 0xfd6c, s_ss)         \
-  V(I16x8SubSaturateU, 0xfd6d, s_ss)         \
-  V(I16x8Mul, 0xfd6e, s_ss)                  \
-  V(I16x8MinS, 0xfd6f, s_ss)                 \
-  V(I16x8MinU, 0xfd70, s_ss)                 \
-  V(I16x8MaxS, 0xfd71, s_ss)                 \
-  V(I16x8MaxU, 0xfd72, s_ss)                 \
-  V(I32x4Neg, 0xfd73, s_s)                   \
-  V(S1x4AnyTrue, 0xfd74, i_s)                \
-  V(S1x4AllTrue, 0xfd75, i_s)                \
-  V(I32x4Shl, 0xfd76, s_si)                  \
-  V(I32x4ShrS, 0xfd77, s_si)                 \
-  V(I32x4ShrU, 0xfd78, s_si)                 \
-  V(I32x4Add, 0xfd79, s_ss)                  \
-  V(I32x4Sub, 0xfd7c, s_ss)                  \
-  V(I32x4Mul, 0xfd7f, s_ss)                  \
-  V(I32x4MinS, 0xfd80, s_ss)                 \
-  V(I32x4MinU, 0xfd81, s_ss)                 \
-  V(I32x4MaxS, 0xfd82, s_ss)                 \
-  V(I32x4MaxU, 0xfd83, s_ss)                 \
-  V(I64x2Neg, 0xfd84, s_s)                   \
-  V(I64x2Shl, 0xfd87, s_si)                  \
-  V(I64x2ShrS, 0xfd88, s_si)                 \
-  V(I64x2ShrU, 0xfd89, s_si)                 \
-  V(I64x2Add, 0xfd8a, s_ss)                  \
-  V(I64x2Sub, 0xfd8d, s_ss)                  \
-  V(I64x2Mul, 0xfd8c, s_ss)                  \
-  V(F32x4Abs, 0xfd95, s_s)                   \
-  V(F32x4Neg, 0xfd96, s_s)                   \
-  V(F32x4Sqrt, 0xfd97, s_s)                  \
-  V(F32x4Add, 0xfd9a, s_ss)                  \
-  V(F32x4Sub, 0xfd9b, s_ss)                  \
-  V(F32x4Mul, 0xfd9c, s_ss)                  \
-  V(F32x4Div, 0xfd9d, s_ss)                  \
-  V(F32x4Min, 0xfd9e, s_ss)                  \
-  V(F32x4Max, 0xfd9f, s_ss)                  \
-  V(F64x2Abs, 0xfda0, s_s)                   \
-  V(F64x2Neg, 0xfda1, s_s)                   \
-  V(F64x2Sqrt, 0xfda2, s_s)                  \
-  V(F64x2Add, 0xfda5, s_ss)                  \
-  V(F64x2Sub, 0xfda6, s_ss)                  \
-  V(F64x2Mul, 0xfda7, s_ss)                  \
-  V(F64x2Div, 0xfda8, s_ss)                  \
-  V(F64x2Min, 0xfda9, s_ss)                  \
-  V(F64x2Max, 0xfdaa, s_ss)                  \
-  V(I32x4SConvertF32x4, 0xfdab, s_s)         \
-  V(I32x4UConvertF32x4, 0xfdac, s_s)         \
-  V(F32x4SConvertI32x4, 0xfdaf, s_s)         \
-  V(F32x4UConvertI32x4, 0xfdb0, s_s)         \
-  V(S8x16Swizzle, 0xfdc0, s_ss)              \
-  V(I8x16SConvertI16x8, 0xfdc6, s_ss)        \
-  V(I8x16UConvertI16x8, 0xfdc7, s_ss)        \
-  V(I16x8SConvertI32x4, 0xfdc8, s_ss)        \
-  V(I16x8UConvertI32x4, 0xfdc9, s_ss)        \
-  V(I16x8SConvertI8x16Low, 0xfdca, s_s)      \
-  V(I16x8SConvertI8x16High, 0xfdcb, s_s)     \
-  V(I16x8UConvertI8x16Low, 0xfdcc, s_s)      \
-  V(I16x8UConvertI8x16High, 0xfdcd, s_s)     \
-  V(I32x4SConvertI16x8Low, 0xfdce, s_s)      \
-  V(I32x4SConvertI16x8High, 0xfdcf, s_s)     \
-  V(I32x4UConvertI16x8Low, 0xfdd0, s_s)      \
-  V(I32x4UConvertI16x8High, 0xfdd1, s_s)     \
-  V(S128AndNot, 0xfdd8, s_ss)                \
-  V(I8x16RoundingAverageU, 0xfdd9, s_ss)     \
-  V(I16x8RoundingAverageU, 0xfdda, s_ss)     \
-  V(I8x16Abs, 0xfde1, s_s)                   \
-  V(I16x8Abs, 0xfde2, s_s)                   \
-  V(I32x4Abs, 0xfde3, s_s)
+  V(S8x16Swizzle, 0xfd0e, s_ss)              \
+  V(I8x16Splat, 0xfd0f, s_i)                 \
+  V(I16x8Splat, 0xfd10, s_i)                 \
+  V(I32x4Splat, 0xfd11, s_i)                 \
+  V(I64x2Splat, 0xfd12, s_l)                 \
+  V(F32x4Splat, 0xfd13, s_f)                 \
+  V(F64x2Splat, 0xfd14, s_d)                 \
+  V(I8x16Eq, 0xfd23, s_ss)                   \
+  V(I8x16Ne, 0xfd24, s_ss)                   \
+  V(I8x16LtS, 0xfd25, s_ss)                  \
+  V(I8x16LtU, 0xfd26, s_ss)                  \
+  V(I8x16GtS, 0xfd27, s_ss)                  \
+  V(I8x16GtU, 0xfd28, s_ss)                  \
+  V(I8x16LeS, 0xfd29, s_ss)                  \
+  V(I8x16LeU, 0xfd2a, s_ss)                  \
+  V(I8x16GeS, 0xfd2b, s_ss)                  \
+  V(I8x16GeU, 0xfd2c, s_ss)                  \
+  V(I16x8Eq, 0xfd2d, s_ss)                   \
+  V(I16x8Ne, 0xfd2e, s_ss)                   \
+  V(I16x8LtS, 0xfd2f, s_ss)                  \
+  V(I16x8LtU, 0xfd30, s_ss)                  \
+  V(I16x8GtS, 0xfd31, s_ss)                  \
+  V(I16x8GtU, 0xfd32, s_ss)                  \
+  V(I16x8LeS, 0xfd33, s_ss)                  \
+  V(I16x8LeU, 0xfd34, s_ss)                  \
+  V(I16x8GeS, 0xfd35, s_ss)                  \
+  V(I16x8GeU, 0xfd36, s_ss)                  \
+  V(I32x4Eq, 0xfd37, s_ss)                   \
+  V(I32x4Ne, 0xfd38, s_ss)                   \
+  V(I32x4LtS, 0xfd39, s_ss)                  \
+  V(I32x4LtU, 0xfd3a, s_ss)                  \
+  V(I32x4GtS, 0xfd3b, s_ss)                  \
+  V(I32x4GtU, 0xfd3c, s_ss)                  \
+  V(I32x4LeS, 0xfd3d, s_ss)                  \
+  V(I32x4LeU, 0xfd3e, s_ss)                  \
+  V(I32x4GeS, 0xfd3f, s_ss)                  \
+  V(I32x4GeU, 0xfd40, s_ss)                  \
+  V(F32x4Eq, 0xfd41, s_ss)                   \
+  V(F32x4Ne, 0xfd42, s_ss)                   \
+  V(F32x4Lt, 0xfd43, s_ss)                   \
+  V(F32x4Gt, 0xfd44, s_ss)                   \
+  V(F32x4Le, 0xfd45, s_ss)                   \
+  V(F32x4Ge, 0xfd46, s_ss)                   \
+  V(F64x2Eq, 0xfd47, s_ss)                   \
+  V(F64x2Ne, 0xfd48, s_ss)                   \
+  V(F64x2Lt, 0xfd49, s_ss)                   \
+  V(F64x2Gt, 0xfd4a, s_ss)                   \
+  V(F64x2Le, 0xfd4b, s_ss)                   \
+  V(F64x2Ge, 0xfd4c, s_ss)                   \
+  V(S128Not, 0xfd4d, s_s)                    \
+  V(S128And, 0xfd4e, s_ss)                   \
+  V(S128AndNot, 0xfd4f, s_ss)                \
+  V(S128Or, 0xfd50, s_ss)                    \
+  V(S128Xor, 0xfd51, s_ss)                   \
+  V(S128Select, 0xfd52, s_sss)               \
+  V(I8x16Abs, 0xfd60, s_s)                   \
+  V(I8x16Neg, 0xfd61, s_s)                   \
+  V(V8x16AnyTrue, 0xfd62, i_s)               \
+  V(V8x16AllTrue, 0xfd63, i_s)               \
+  V(I8x16BitMask, 0xfd64, i_s)               \
+  V(I8x16SConvertI16x8, 0xfd65, s_ss)        \
+  V(I8x16UConvertI16x8, 0xfd66, s_ss)        \
+  V(I8x16Shl, 0xfd6b, s_si)                  \
+  V(I8x16ShrS, 0xfd6c, s_si)                 \
+  V(I8x16ShrU, 0xfd6d, s_si)                 \
+  V(I8x16Add, 0xfd6e, s_ss)                  \
+  V(I8x16AddSaturateS, 0xfd6f, s_ss)         \
+  V(I8x16AddSaturateU, 0xfd70, s_ss)         \
+  V(I8x16Sub, 0xfd71, s_ss)                  \
+  V(I8x16SubSaturateS, 0xfd72, s_ss)         \
+  V(I8x16SubSaturateU, 0xfd73, s_ss)         \
+  V(I8x16MinS, 0xfd76, s_ss)                 \
+  V(I8x16MinU, 0xfd77, s_ss)                 \
+  V(I8x16MaxS, 0xfd78, s_ss)                 \
+  V(I8x16MaxU, 0xfd79, s_ss)                 \
+  V(I8x16RoundingAverageU, 0xfd7b, s_ss)     \
+  V(I16x8Abs, 0xfd80, s_s)                   \
+  V(I16x8Neg, 0xfd81, s_s)                   \
+  V(V16x8AnyTrue, 0xfd82, i_s)               \
+  V(V16x8AllTrue, 0xfd83, i_s)               \
+  V(I16x8BitMask, 0xfd84, i_s)               \
+  V(I16x8SConvertI32x4, 0xfd85, s_ss)        \
+  V(I16x8UConvertI32x4, 0xfd86, s_ss)        \
+  V(I16x8SConvertI8x16Low, 0xfd87, s_s)      \
+  V(I16x8SConvertI8x16High, 0xfd88, s_s)     \
+  V(I16x8UConvertI8x16Low, 0xfd89, s_s)      \
+  V(I16x8UConvertI8x16High, 0xfd8a, s_s)     \
+  V(I16x8Shl, 0xfd8b, s_si)                  \
+  V(I16x8ShrS, 0xfd8c, s_si)                 \
+  V(I16x8ShrU, 0xfd8d, s_si)                 \
+  V(I16x8Add, 0xfd8e, s_ss)                  \
+  V(I16x8AddSaturateS, 0xfd8f, s_ss)         \
+  V(I16x8AddSaturateU, 0xfd90, s_ss)         \
+  V(I16x8Sub, 0xfd91, s_ss)                  \
+  V(I16x8SubSaturateS, 0xfd92, s_ss)         \
+  V(I16x8SubSaturateU, 0xfd93, s_ss)         \
+  V(I16x8Mul, 0xfd95, s_ss)                  \
+  V(I16x8MinS, 0xfd96, s_ss)                 \
+  V(I16x8MinU, 0xfd97, s_ss)                 \
+  V(I16x8MaxS, 0xfd98, s_ss)                 \
+  V(I16x8MaxU, 0xfd99, s_ss)                 \
+  V(I16x8RoundingAverageU, 0xfd9b, s_ss)     \
+  V(I32x4Abs, 0xfda0, s_s)                   \
+  V(I32x4Neg, 0xfda1, s_s)                   \
+  V(V32x4AnyTrue, 0xfda2, i_s)               \
+  V(V32x4AllTrue, 0xfda3, i_s)               \
+  V(I32x4BitMask, 0xfda4, i_s)               \
+  V(I32x4SConvertI16x8Low, 0xfda7, s_s)      \
+  V(I32x4SConvertI16x8High, 0xfda8, s_s)     \
+  V(I32x4UConvertI16x8Low, 0xfda9, s_s)      \
+  V(I32x4UConvertI16x8High, 0xfdaa, s_s)     \
+  V(I32x4Shl, 0xfdab, s_si)                  \
+  V(I32x4ShrS, 0xfdac, s_si)                 \
+  V(I32x4ShrU, 0xfdad, s_si)                 \
+  V(I32x4Add, 0xfdae, s_ss)                  \
+  V(I32x4Sub, 0xfdb1, s_ss)                  \
+  V(I32x4Mul, 0xfdb5, s_ss)                  \
+  V(I32x4MinS, 0xfdb6, s_ss)                 \
+  V(I32x4MinU, 0xfdb7, s_ss)                 \
+  V(I32x4MaxS, 0xfdb8, s_ss)                 \
+  V(I32x4MaxU, 0xfdb9, s_ss)                 \
+  V(I64x2Neg, 0xfdc1, s_s)                   \
+  V(I64x2Shl, 0xfdcb, s_si)                  \
+  V(I64x2ShrS, 0xfdcc, s_si)                 \
+  V(I64x2ShrU, 0xfdcd, s_si)                 \
+  V(I64x2Add, 0xfdce, s_ss)                  \
+  V(I64x2Sub, 0xfdd1, s_ss)                  \
+  V(I64x2Mul, 0xfdd5, s_ss)                  \
+  V(F32x4Abs, 0xfde0, s_s)                   \
+  V(F32x4Neg, 0xfde1, s_s)                   \
+  V(F32x4Sqrt, 0xfde3, s_s)                  \
+  V(F32x4Add, 0xfde4, s_ss)                  \
+  V(F32x4Sub, 0xfde5, s_ss)                  \
+  V(F32x4Mul, 0xfde6, s_ss)                  \
+  V(F32x4Div, 0xfde7, s_ss)                  \
+  V(F32x4Min, 0xfde8, s_ss)                  \
+  V(F32x4Max, 0xfde9, s_ss)                  \
+  V(F32x4Ceil, 0xfdda, s_s)                  \
+  V(F32x4Floor, 0xfddb, s_s)                 \
+  V(F32x4Trunc, 0xfddc, s_s)                 \
+  V(F32x4NearestInt, 0xfdde, s_s)            \
+  V(F64x2Abs, 0xfdec, s_s)                   \
+  V(F64x2Neg, 0xfded, s_s)                   \
+  V(F64x2Sqrt, 0xfdef, s_s)                  \
+  V(F64x2Add, 0xfdf0, s_ss)                  \
+  V(F64x2Sub, 0xfdf1, s_ss)                  \
+  V(F64x2Mul, 0xfdf2, s_ss)                  \
+  V(F64x2Div, 0xfdf3, s_ss)                  \
+  V(F64x2Min, 0xfdf4, s_ss)                  \
+  V(F64x2Max, 0xfdf5, s_ss)                  \
+  V(I32x4SConvertF32x4, 0xfdf8, s_s)         \
+  V(I32x4UConvertF32x4, 0xfdf9, s_s)         \
+  V(F32x4SConvertI32x4, 0xfdfa, s_s)         \
+  V(F32x4UConvertI32x4, 0xfdfb, s_s)
 
 #define FOREACH_SIMD_POST_MVP_OPCODE(V) \
-  V(I64x2Eq, 0xfd36, s_ss)              \
-  V(I64x2Ne, 0xfd37, s_ss)              \
-  V(I64x2LtS, 0xfd38, s_ss)             \
-  V(I64x2LtU, 0xfd39, s_ss)             \
-  V(I64x2GtS, 0xfd3a, s_ss)             \
-  V(I64x2GtU, 0xfd3b, s_ss)             \
-  V(I64x2LeS, 0xfd3c, s_ss)             \
-  V(I64x2LeU, 0xfd3d, s_ss)             \
-  V(I64x2GeS, 0xfd3e, s_ss)             \
-  V(I64x2GeU, 0xfd3f, s_ss)             \
-  V(S1x2AnyTrue, 0xfd85, i_s)           \
-  V(S1x2AllTrue, 0xfd86, i_s)           \
-  V(I64x2MinS, 0xfd8e, s_ss)            \
-  V(I64x2MinU, 0xfd8f, s_ss)            \
-  V(I64x2MaxS, 0xfd90, s_ss)            \
-  V(I64x2MaxU, 0xfd91, s_ss)            \
-  V(F32x4Qfma, 0xfd98, s_sss)           \
-  V(F32x4Qfms, 0xfd99, s_sss)           \
-  V(F64x2Qfma, 0xfda3, s_sss)           \
-  V(F64x2Qfms, 0xfda4, s_sss)           \
-  V(I16x8AddHoriz, 0xfdbd, s_ss)        \
-  V(I32x4AddHoriz, 0xfdbe, s_ss)        \
-  V(F32x4AddHoriz, 0xfdbf, s_ss)        \
-  V(I8x16BitMask, 0xfde4, i_s)          \
-  V(I16x8BitMask, 0xfde5, i_s)          \
-  V(I32x4BitMask, 0xfde6, i_s)          \
-  V(F32x4RecipApprox, 0xfdee, s_s)      \
-  V(F32x4RecipSqrtApprox, 0xfdef, s_s)
+  V(I8x16Mul, 0xfd75, s_ss)             \
+  V(V64x2AnyTrue, 0xfdc2, i_s)          \
+  V(V64x2AllTrue, 0xfdc3, i_s)          \
+  V(I64x2Eq, 0xfdc0, s_ss)              \
+  V(I64x2Ne, 0xfdc4, s_ss)              \
+  V(I64x2LtS, 0xfdc5, s_ss)             \
+  V(I64x2LtU, 0xfdc6, s_ss)             \
+  V(I64x2GtS, 0xfdc7, s_ss)             \
+  V(I64x2GtU, 0xfdc8, s_ss)             \
+  V(I64x2LeS, 0xfdc9, s_ss)             \
+  V(I64x2LeU, 0xfdca, s_ss)             \
+  V(I64x2GeS, 0xfdcf, s_ss)             \
+  V(I64x2GeU, 0xfdd0, s_ss)             \
+  V(I64x2MinS, 0xfdd6, s_ss)            \
+  V(I64x2MinU, 0xfdd7, s_ss)            \
+  V(I64x2MaxS, 0xfdd8, s_ss)            \
+  V(I64x2MaxU, 0xfdd9, s_ss)            \
+  V(F32x4Qfma, 0xfdfc, s_sss)           \
+  V(F32x4Qfms, 0xfdfd, s_sss)           \
+  V(F64x2Qfma, 0xfdfe, s_sss)           \
+  V(F64x2Qfms, 0xfdff, s_sss)           \
+  V(I16x8AddHoriz, 0xfdaf, s_ss)        \
+  V(I32x4AddHoriz, 0xfdb0, s_ss)        \
+  V(F32x4AddHoriz, 0xfdb2, s_ss)        \
+  V(F32x4RecipApprox, 0xfdb3, s_s)      \
+  V(F32x4RecipSqrtApprox, 0xfdba, s_s)  \
+  V(F32x4Pmin, 0xfdea, s_ss)            \
+  V(F32x4Pmax, 0xfdeb, s_ss)            \
+  V(F64x2Pmin, 0xfdf6, s_ss)            \
+  V(F64x2Pmax, 0xfdf7, s_ss)
 
 #define FOREACH_SIMD_1_OPERAND_1_PARAM_OPCODE(V) \
-  V(I8x16ExtractLaneS, 0xfd05, _)                \
-  V(I8x16ExtractLaneU, 0xfd06, _)                \
-  V(I16x8ExtractLaneS, 0xfd09, _)                \
-  V(I16x8ExtractLaneU, 0xfd0a, _)                \
-  V(I32x4ExtractLane, 0xfd0d, _)                 \
-  V(I64x2ExtractLane, 0xfd10, _)                 \
-  V(F32x4ExtractLane, 0xfd13, _)                 \
-  V(F64x2ExtractLane, 0xfd16, _)
+  V(I8x16ExtractLaneS, 0xfd15, _)                \
+  V(I8x16ExtractLaneU, 0xfd16, _)                \
+  V(I16x8ExtractLaneS, 0xfd18, _)                \
+  V(I16x8ExtractLaneU, 0xfd19, _)                \
+  V(I32x4ExtractLane, 0xfd1b, _)                 \
+  V(I64x2ExtractLane, 0xfd1d, _)                 \
+  V(F32x4ExtractLane, 0xfd1f, _)                 \
+  V(F64x2ExtractLane, 0xfd21, _)
 
 #define FOREACH_SIMD_1_OPERAND_2_PARAM_OPCODE(V) \
-  V(I8x16ReplaceLane, 0xfd07, _)                 \
-  V(I16x8ReplaceLane, 0xfd0b, _)                 \
-  V(I32x4ReplaceLane, 0xfd0e, _)                 \
-  V(I64x2ReplaceLane, 0xfd11, _)                 \
-  V(F32x4ReplaceLane, 0xfd14, _)                 \
-  V(F64x2ReplaceLane, 0xfd17, _)
+  V(I8x16ReplaceLane, 0xfd17, _)                 \
+  V(I16x8ReplaceLane, 0xfd1a, _)                 \
+  V(I32x4ReplaceLane, 0xfd1c, _)                 \
+  V(I64x2ReplaceLane, 0xfd1e, _)                 \
+  V(F32x4ReplaceLane, 0xfd20, _)                 \
+  V(F64x2ReplaceLane, 0xfd22, _)
 
 #define FOREACH_SIMD_0_OPERAND_OPCODE(V) \
   FOREACH_SIMD_MVP_0_OPERAND_OPCODE(V)   \
@@ -574,6 +589,33 @@ bool IsJSCompatibleSignature(const FunctionSig* sig, const WasmFeatures&);
   V(I64AtomicCompareExchange16U, 0xfe4d, l_ill) \
   V(I64AtomicCompareExchange32U, 0xfe4e, l_ill)
 
+// Opcode values are guesswork for now, see:
+// https://docs.google.com/document/d/1DklC3qVuOdLHSXB5UXghM_syCh-4cMinQ50ICiXnK3Q/edit
+#define FOREACH_GC_OPCODE(V)     \
+  V(StructNew, 0xfb00, _)        \
+  V(StructNewSub, 0xfb01, _)     \
+  V(StructNewDefault, 0xfb02, _) \
+  V(StructGet, 0xfb03, _)        \
+  V(StructGetS, 0xfb04, _)       \
+  V(StructGetU, 0xfb05, _)       \
+  V(StructSet, 0xfb06, _)        \
+  V(ArrayNew, 0xfb10, _)         \
+  V(ArrayNewSub, 0xfb11, _)      \
+  V(ArrayNewDefault, 0xfb12, _)  \
+  V(ArrayGet, 0xfb13, _)         \
+  V(ArrayGetS, 0xfb14, _)        \
+  V(ArrayGetU, 0xfb15, _)        \
+  V(ArraySet, 0xfb16, _)         \
+  V(ArrayLen, 0xfb17, _)         \
+  V(I31New, 0xfb20, _)           \
+  V(I31GetS, 0xfb21, _)          \
+  V(I31GetU, 0xfb22, _)          \
+  V(RttGet, 0xfb30, _)           \
+  V(RttSub, 0xfb31, _)           \
+  V(RefTest, 0xfb40, _)          \
+  V(RefCast, 0xfb41, _)          \
+  V(BrOnCast, 0xfb42, _)
+
 #define FOREACH_ATOMIC_0_OPERAND_OPCODE(V)                      \
   /* AtomicFence does not target a particular linear memory. */ \
   V(AtomicFence, 0xfe03, v_v)
@@ -594,7 +636,8 @@ bool IsJSCompatibleSignature(const FunctionSig* sig, const WasmFeatures&);
   FOREACH_SIMD_MEM_OPCODE(V)          \
   FOREACH_ATOMIC_OPCODE(V)            \
   FOREACH_ATOMIC_0_OPERAND_OPCODE(V)  \
-  FOREACH_NUMERIC_OPCODE(V)
+  FOREACH_NUMERIC_OPCODE(V)           \
+  FOREACH_GC_OPCODE(V)
 
 // All signatures.
 #define FOREACH_SIGNATURE(V)                        \
@@ -637,7 +680,8 @@ bool IsJSCompatibleSignature(const FunctionSig* sig, const WasmFeatures&);
   V(i_iil, kWasmI32, kWasmI32, kWasmI32, kWasmI64)  \
   V(i_ill, kWasmI32, kWasmI32, kWasmI64, kWasmI64)  \
   V(i_r, kWasmI32, kWasmAnyRef)                     \
-  V(i_ai, kWasmI32, kWasmFuncRef, kWasmI32)
+  V(i_ai, kWasmI32, kWasmFuncRef, kWasmI32)         \
+  V(i_rr, kWasmI32, kWasmEqRef, kWasmEqRef)
 
 #define FOREACH_SIMD_SIGNATURE(V)          \
   V(s_s, kWasmS128, kWasmS128)             \
@@ -654,7 +698,8 @@ bool IsJSCompatibleSignature(const FunctionSig* sig, const WasmFeatures&);
 #define FOREACH_PREFIX(V) \
   V(Numeric, 0xfc)        \
   V(Simd, 0xfd)           \
-  V(Atomic, 0xfe)
+  V(Atomic, 0xfe)         \
+  V(GC, 0xfb)
 
 enum WasmOpcode {
 // Declare expression opcodes.
diff --git a/deps/v8/src/wasm/wasm-serialization.cc b/deps/v8/src/wasm/wasm-serialization.cc
index 773a709721c..8df5d4c88ee 100644
--- a/deps/v8/src/wasm/wasm-serialization.cc
+++ b/deps/v8/src/wasm/wasm-serialization.cc
@@ -10,7 +10,6 @@
 #include "src/objects/objects.h"
 #include "src/runtime/runtime.h"
 #include "src/snapshot/code-serializer.h"
-#include "src/snapshot/serializer-common.h"
 #include "src/utils/ostreams.h"
 #include "src/utils/utils.h"
 #include "src/utils/version.h"
@@ -301,8 +300,7 @@ NativeModuleSerializer::NativeModuleSerializer(
 
 size_t NativeModuleSerializer::MeasureCode(const WasmCode* code) const {
   if (code == nullptr) return sizeof(bool);
-  DCHECK(code->kind() == WasmCode::kFunction ||
-         code->kind() == WasmCode::kInterpreterEntry);
+  DCHECK_EQ(WasmCode::kFunction, code->kind());
   return kCodeHeaderSize + code->instructions().size() +
          code->reloc_info().size() + code->source_positions().size() +
          code->protected_instructions_data().size();
@@ -330,8 +328,7 @@ void NativeModuleSerializer::WriteCode(const WasmCode* code, Writer* writer) {
     return;
   }
   writer->Write(true);
-  DCHECK(code->kind() == WasmCode::kFunction ||
-         code->kind() == WasmCode::kInterpreterEntry);
+  DCHECK_EQ(WasmCode::kFunction, code->kind());
   // Write the size of the entire code section, followed by the code header.
   writer->Write(code->constant_pool_offset());
   writer->Write(code->safepoint_table_offset());
@@ -611,9 +608,6 @@ MaybeHandle<WasmModuleObject> DeserializeNativeModule(
   if (decode_result.failed()) return {};
   std::shared_ptr<WasmModule> module = std::move(decode_result.value());
   CHECK_NOT_NULL(module);
-  Handle<Script> script = CreateWasmScript(isolate, wire_bytes_vec,
-                                           VectorOf(module->source_map_url),
-                                           module->name, source_url);
 
   auto shared_native_module = wasm_engine->MaybeGetNativeModule(
       module->origin, wire_bytes_vec, isolate);
@@ -641,6 +635,8 @@ MaybeHandle<WasmModuleObject> DeserializeNativeModule(
   CompileJsToWasmWrappers(isolate, shared_native_module->module(),
                           &export_wrappers);
 
+  Handle<Script> script =
+      wasm_engine->GetOrCreateScript(isolate, shared_native_module, source_url);
   Handle<WasmModuleObject> module_object = WasmModuleObject::New(
       isolate, std::move(shared_native_module), script, export_wrappers);
 
diff --git a/deps/v8/src/wasm/wasm-tier.h b/deps/v8/src/wasm/wasm-tier.h
index 8434a2e14bc..24a143d0690 100644
--- a/deps/v8/src/wasm/wasm-tier.h
+++ b/deps/v8/src/wasm/wasm-tier.h
@@ -32,6 +32,12 @@ inline const char* ExecutionTierToString(ExecutionTier tier) {
   }
 }
 
+// {kForDebugging} is used for default tiered-down code (potentially with
+// breakpoints), {kForStepping} is code that is flooded with breakpoints.
+enum ForDebugging : int8_t { kNoDebugging = 0, kForDebugging, kForStepping };
+
+enum TieringState : int8_t { kTieredUp, kTieredDown };
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/benchmarks/benchmarks.status b/deps/v8/test/benchmarks/benchmarks.status
index 1ad433bb23c..127375f26f8 100644
--- a/deps/v8/test/benchmarks/benchmarks.status
+++ b/deps/v8/test/benchmarks/benchmarks.status
@@ -82,4 +82,9 @@
   'octane/typescript': [SKIP],
 }],  # 'predictable'
 
+################################################################################
+['variant == stress_snapshot', {
+  '*': [SKIP],  # only relevant for mjsunit tests.
+}],
+
 ]
diff --git a/deps/v8/test/cctest/BUILD.gn b/deps/v8/test/cctest/BUILD.gn
index 89fe36f65b6..2c9363130a3 100644
--- a/deps/v8/test/cctest/BUILD.gn
+++ b/deps/v8/test/cctest/BUILD.gn
@@ -35,6 +35,14 @@ v8_executable("cctest") {
 
   ldflags = []
 
+  if (v8_use_perfetto) {
+    deps += [
+      # TODO(skyostil): Switch the test to use protozero.
+      "//third_party/perfetto/protos/perfetto/trace/interned_data:lite",
+      "//third_party/perfetto/protos/perfetto/trace/track_event:lite",
+    ]
+  }
+
   # TODO(machenbach): Translate from gyp.
   #["OS=="aix"", {
   #  "ldflags": [ "-Wl,-bbigtoc" ],
@@ -125,6 +133,7 @@ v8_source_set("cctest_sources") {
     "heap/test-alloc.cc",
     "heap/test-array-buffer-tracker.cc",
     "heap/test-compaction.cc",
+    "heap/test-concurrent-allocation.cc",
     "heap/test-concurrent-marking.cc",
     "heap/test-embedder-tracing.cc",
     "heap/test-external-string-tracker.cc",
@@ -169,6 +178,7 @@ v8_source_set("cctest_sources") {
     "test-allocation.cc",
     "test-api-accessors.cc",
     "test-api-array-buffer.cc",
+    "test-api-icu.cc",
     "test-api-interceptors.cc",
     "test-api-stack-traces.cc",
     "test-api-typed-array.cc",
@@ -228,6 +238,7 @@ v8_source_set("cctest_sources") {
     "test-object.cc",
     "test-orderedhashtable.cc",
     "test-parsing.cc",
+    "test-persistent-handles.cc",
     "test-platform.cc",
     "test-profile-generator.cc",
     "test-random-number-generator.cc",
@@ -264,6 +275,7 @@ v8_source_set("cctest_sources") {
     "unicode-helpers.h",
     "wasm/test-c-wasm-entry.cc",
     "wasm/test-compilation-cache.cc",
+    "wasm/test-gc.cc",
     "wasm/test-grow-memory.cc",
     "wasm/test-jump-table-assembler.cc",
     "wasm/test-liftoff-inspection.cc",
@@ -278,6 +290,7 @@ v8_source_set("cctest_sources") {
     "wasm/test-run-wasm-module.cc",
     "wasm/test-run-wasm-sign-extension.cc",
     "wasm/test-run-wasm-simd-liftoff.cc",
+    "wasm/test-run-wasm-simd-scalar-lowering.cc",
     "wasm/test-run-wasm-simd.cc",
     "wasm/test-run-wasm.cc",
     "wasm/test-streaming-compilation.cc",
@@ -286,7 +299,6 @@ v8_source_set("cctest_sources") {
     "wasm/test-wasm-debug-evaluate.cc",
     "wasm/test-wasm-debug-evaluate.h",
     "wasm/test-wasm-import-wrapper-cache.cc",
-    "wasm/test-wasm-interpreter-entry.cc",
     "wasm/test-wasm-serialization.cc",
     "wasm/test-wasm-shared-engine.cc",
     "wasm/test-wasm-stack.cc",
@@ -375,6 +387,11 @@ v8_source_set("cctest_sources") {
     ]
   }
 
+  if (v8_use_perfetto) {
+    # Perfetto doesn't use TraceObject.
+    sources -= [ "test-trace-event.cc" ]
+  }
+
   configs = [
     "../..:external_config",
     "../..:internal_config_base",
@@ -432,10 +449,8 @@ v8_source_set("cctest_sources") {
 
   if (v8_use_perfetto) {
     deps += [
-      "//third_party/perfetto/include/perfetto/tracing",
-      "//third_party/perfetto/protos/perfetto/trace/chrome:lite",
-      "//third_party/perfetto/protos/perfetto/trace/chrome:zero",
-      "//third_party/perfetto/src/tracing:in_process_backend",
+      # TODO(skyostil): Migrate to protozero.
+      "//third_party/perfetto/protos/perfetto/trace:lite",
     ]
   }
 }
diff --git a/deps/v8/test/cctest/cctest.cc b/deps/v8/test/cctest/cctest.cc
index 6adf2041cf0..3110681c103 100644
--- a/deps/v8/test/cctest/cctest.cc
+++ b/deps/v8/test/cctest/cctest.cc
@@ -40,7 +40,7 @@
 #include "test/cctest/trace-extension.h"
 
 #ifdef V8_USE_PERFETTO
-#include "perfetto/tracing.h"
+#include "src/tracing/trace-event.h"
 #endif  // V8_USE_PERFETTO
 
 #if V8_OS_WIN
@@ -150,6 +150,18 @@ void CcTest::PreciseCollectAllGarbage(i::Isolate* isolate) {
                                         i::GarbageCollectionReason::kTesting);
 }
 
+i::Handle<i::String> CcTest::MakeString(const char* str) {
+  i::Isolate* isolate = CcTest::i_isolate();
+  i::Factory* factory = isolate->factory();
+  return factory->InternalizeUtf8String(str);
+}
+
+i::Handle<i::String> CcTest::MakeName(const char* str, int suffix) {
+  i::EmbeddedVector<char, 128> buffer;
+  SNPrintF(buffer, "%s%d", str, suffix);
+  return CcTest::MakeString(buffer.begin());
+}
+
 v8::base::RandomNumberGenerator* CcTest::random_number_generator() {
   return InitIsolateOnce()->random_number_generator();
 }
diff --git a/deps/v8/test/cctest/cctest.h b/deps/v8/test/cctest/cctest.h
index e503b519144..f7d4b8d0508 100644
--- a/deps/v8/test/cctest/cctest.h
+++ b/deps/v8/test/cctest/cctest.h
@@ -141,6 +141,9 @@ class CcTest {
   static void CollectAllAvailableGarbage(i::Isolate* isolate = nullptr);
   static void PreciseCollectAllGarbage(i::Isolate* isolate = nullptr);
 
+  static i::Handle<i::String> MakeString(const char* str);
+  static i::Handle<i::String> MakeName(const char* str, int suffix);
+
   static v8::base::RandomNumberGenerator* random_number_generator();
 
   static v8::Local<v8::Object> global();
@@ -704,6 +707,12 @@ class TestPlatform : public v8::Platform {
     old_platform_->CallDelayedOnWorkerThread(std::move(task), delay_in_seconds);
   }
 
+  std::unique_ptr<v8::JobHandle> PostJob(
+      v8::TaskPriority priority,
+      std::unique_ptr<v8::JobTask> job_task) override {
+    return old_platform_->PostJob(priority, std::move(job_task));
+  }
+
   double MonotonicallyIncreasingTime() override {
     return old_platform_->MonotonicallyIncreasingTime();
   }
diff --git a/deps/v8/test/cctest/cctest.status b/deps/v8/test/cctest/cctest.status
index 444ec9d8ecc..73fdad69fe5 100644
--- a/deps/v8/test/cctest/cctest.status
+++ b/deps/v8/test/cctest/cctest.status
@@ -236,7 +236,7 @@
   'test-cpu-profiler/FunctionCallSample': [SKIP],
 
   # BUG(5920): Flaky crash.
-  'test-serialize/PartialSerializerContext': [PASS, ['arch == x64 and mode == debug', SKIP]],
+  'test-serialize/ContextSerializerContext': [PASS, ['arch == x64 and mode == debug', SKIP]],
 
   # BUG(10107): Failing flakily
   'test-cpu-profiler/Inlining2': ['arch == ia32 and mode == debug', SKIP],
@@ -246,8 +246,8 @@
 ##############################################################################
 ['system == windows and arch == x64 and mode == debug', {
   # BUG(v8:6328).
-  'test-serialize/PartialSerializerCustomContext': [SKIP],
-  'test-serialize/PartialSerializerObject': [SKIP],
+  'test-serialize/ContextSerializerCustomContext': [SKIP],
+  'test-serialize/ContextSerializerObject': [SKIP],
   'test-serialize/StartupSerializerOnce': [SKIP],
   'test-serialize/StartupSerializerOnceRunScript': [SKIP],
   'test-serialize/StartupSerializerTwiceRunScript': [SKIP],
@@ -370,7 +370,6 @@
   'test-run-wasm-module/Run_WasmModule_CallAdd' : [SKIP],
   'test-run-wasm-module/Run_WasmModule_CallMain_recursive' : [SKIP],
   # TODO(ppc): Implement load/store reverse byte instructions
-  'test-run-wasm-simd/RunWasmCompiled_SimdLoadStoreLoad': [SKIP],
   'test-run-wasm-simd/RunWasm_SimdLoadStoreLoad': [SKIP],
   'test-run-wasm-simd/RunWasm_SimdLoadStoreLoad_turbofan': [SKIP],
 
@@ -393,6 +392,8 @@
 
   # Liftoff is not currently supported on ppc and s390
   'test-liftoff-*': [SKIP],
+  'test-wasm-breakpoints/*' : [SKIP],
+  'test-wasm-debug-evaluate/*': [SKIP],
 
   # SIMD not fully implemented yet
   'test-run-wasm-simd-liftoff/*': [SKIP],
@@ -410,9 +411,12 @@
 }],  # variant == stress_incremental_marking
 
 ##############################################################################
-# The test relies on deterministic compilation.
 ['variant == stress_js_bg_compile_wasm_code_gc', {
+  # The test relies on deterministic compilation.
   'test-compiler/DecideToPretenureDuringCompilation': [SKIP],
+
+  # The test relies on deterministic allocation during compilation.
+  'test-compiler/DeepEagerCompilationPeakMemory': [SKIP],
 }],  # variant == stress_js_bg_compile_wasm_code_gc
 
 ##############################################################################
@@ -465,6 +469,7 @@
   'test-c-wasm-entry/*': [SKIP],
   'test-compilation-cache/*': [SKIP],
   'test-jump-table-assembler/*': [SKIP],
+  'test-gc/*': [SKIP],
   'test-grow-memory/*': [SKIP],
   'test-run-wasm-64/*': [SKIP],
   'test-run-wasm-asmjs/*': [SKIP],
@@ -478,13 +483,13 @@
   'test-run-wasm-module/*': [SKIP],
   'test-run-wasm-sign-extension/*': [SKIP],
   'test-run-wasm-simd-liftoff/*': [SKIP],
+  'test-run-wasm-simd-scalar-lowering/*': [SKIP],
   'test-run-wasm-simd/*': [SKIP],
   'test-streaming-compilation/*': [SKIP],
   'test-wasm-breakpoints/*': [SKIP],
   'test-wasm-codegen/*': [SKIP],
   'test-wasm-debug-evaluate/*': [SKIP],
   'test-wasm-import-wrapper-cache/*': [SKIP],
-  'test-wasm-interpreter-entry/*': [SKIP],
   'test-wasm-serialization/*': [SKIP],
   'test-wasm-shared-engine/*': [SKIP],
   'test-wasm-stack/*': [SKIP],
@@ -601,6 +606,7 @@
   'test-log/LogInterpretedFramesNativeStack': [SKIP],
   'test-log/LogInterpretedFramesNativeStackWithSerialization': [SKIP],
   'test-serialize/CodeSerializerOnePlusOneWithInterpretedFramesNativeStack': [SKIP],
+  'test-interpreter/InterpreterWithNativeStack': [SKIP],
 
   # Crashes on native arm.
   'test-macro-assembler-arm/ExtractLane': [PASS, ['arch == arm and not simulator_run', SKIP]],
@@ -614,6 +620,21 @@
   'test-cpu-profiler/DeoptAtFirstLevelInlinedSource': [SKIP],
   'test-cpu-profiler/DeoptAtSecondLevelInlinedSource': [SKIP],
   'test-cpu-profiler/DeoptUntrackedFunction': [SKIP],
+  # Turboprop doesn't use call feedback and hence doesn't inline even if
+  # the inlining flag is explicitly set.
+  'test-cpu-profiler/DetailedSourcePositionAPI_Inlining': [SKIP],
+  'serializer-tester/BoundFunctionArguments': [SKIP],
+  'serializer-tester/BoundFunctionTarget': [SKIP],
 }],  # variant == turboprop
 
+##############################################################################
+['no_i18n == True', {
+  'test-regexp/UnicodePropertyEscapeCodeSize': [SKIP],
+}],  # no_i18n == True
+
+################################################################################
+['variant == stress_snapshot', {
+  '*': [SKIP],  # only relevant for mjsunit tests.
+}],
+
 ]
diff --git a/deps/v8/test/cctest/compiler/test-basic-block-profiler.cc b/deps/v8/test/cctest/compiler/test-basic-block-profiler.cc
index eb8fa641cf7..b55ec840e35 100644
--- a/deps/v8/test/cctest/compiler/test-basic-block-profiler.cc
+++ b/deps/v8/test/cctest/compiler/test-basic-block-profiler.cc
@@ -18,13 +18,15 @@ class BasicBlockProfilerTest : public RawMachineAssemblerTester<int32_t> {
     FLAG_turbo_profiling = true;
   }
 
-  void ResetCounts() { BasicBlockProfiler::Get()->ResetCounts(); }
+  void ResetCounts() {
+    BasicBlockProfiler::Get()->ResetCounts(CcTest::i_isolate());
+  }
 
   void Expect(size_t size, uint32_t* expected) {
     const BasicBlockProfiler::DataList* l =
         BasicBlockProfiler::Get()->data_list();
     CHECK_NE(0, static_cast<int>(l->size()));
-    const BasicBlockProfiler::Data* data = l->back();
+    const BasicBlockProfilerData* data = l->back().get();
     CHECK_EQ(static_cast<int>(size), static_cast<int>(data->n_blocks()));
     const uint32_t* counts = data->counts();
     for (size_t i = 0; i < size; ++i) {
diff --git a/deps/v8/test/cctest/compiler/test-js-context-specialization.cc b/deps/v8/test/cctest/compiler/test-js-context-specialization.cc
index f46c6c57938..36ab68533bc 100644
--- a/deps/v8/test/cctest/compiler/test-js-context-specialization.cc
+++ b/deps/v8/test/cctest/compiler/test-js-context-specialization.cc
@@ -179,6 +179,9 @@ TEST(ReduceJSLoadContext0) {
     CHECK(match.HasValue());
     CHECK_EQ(*expected, *match.Value());
   }
+
+  // Clean up so that verifiers don't complain.
+  native->set(slot, Smi::zero());
 }
 
 TEST(ReduceJSLoadContext1) {
@@ -477,6 +480,9 @@ TEST(ReduceJSStoreContext0) {
     CHECK_EQ(0, static_cast<int>(access.depth()));
     CHECK_EQ(false, access.immutable());
   }
+
+  // Clean up so that verifiers don't complain.
+  native->set(slot, Smi::zero());
 }
 
 TEST(ReduceJSStoreContext1) {
diff --git a/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc b/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc
index 1d02d8a59c6..a690af42936 100644
--- a/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc
+++ b/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc
@@ -217,8 +217,6 @@ static IrOpcode::Value NumberToI32(bool is_signed) {
 }
 
 
-// TODO(turbofan): Lowering of StringAdd is disabled for now.
-#if 0
 TEST(StringBinops) {
   JSTypedLoweringTester R;
 
@@ -228,16 +226,15 @@ TEST(StringBinops) {
     for (size_t j = 0; j < arraysize(kStringTypes); ++j) {
       Node* p1 = R.Parameter(kStringTypes[j], 1);
 
-      Node* add = R.Binop(R.javascript.Add(), p0, p1);
+      Node* add = R.Binop(R.javascript.Add(BinaryOperationHint::kAny), p0, p1);
       Node* r = R.reduce(add);
 
-      R.CheckBinop(IrOpcode::kStringAdd, r);
-      CHECK_EQ(p0, r->InputAt(0));
-      CHECK_EQ(p1, r->InputAt(1));
+      R.CheckBinop(IrOpcode::kStringConcat, r);
+      CHECK_EQ(p0, r->InputAt(1));
+      CHECK_EQ(p1, r->InputAt(2));
     }
   }
 }
-#endif
 
 TEST(AddNumber1) {
   JSTypedLoweringTester R;
diff --git a/deps/v8/test/cctest/compiler/test-linkage.cc b/deps/v8/test/cctest/compiler/test-linkage.cc
index 75899aeaac6..f08ff023f2c 100644
--- a/deps/v8/test/cctest/compiler/test-linkage.cc
+++ b/deps/v8/test/cctest/compiler/test-linkage.cc
@@ -104,6 +104,7 @@ TEST(TestLinkageRuntimeCall) {
 
 
 TEST(TestLinkageStubCall) {
+  // TODO(bbudge) Add tests for FP registers.
   Isolate* isolate = CcTest::InitIsolateOnce();
   Zone zone(isolate->allocator(), ZONE_NAME);
   Callable callable = Builtins::CallableFor(isolate, Builtins::kToNumber);
@@ -116,9 +117,36 @@ TEST(TestLinkageStubCall) {
   CHECK_EQ(1, static_cast<int>(call_descriptor->ReturnCount()));
   CHECK_EQ(Operator::kNoProperties, call_descriptor->properties());
   CHECK_EQ(false, call_descriptor->IsJSFunctionCall());
+
+  CHECK_EQ(call_descriptor->GetParameterType(0), MachineType::AnyTagged());
+  CHECK_EQ(call_descriptor->GetReturnType(0), MachineType::AnyTagged());
   // TODO(titzer): test linkage creation for outgoing stub calls.
 }
 
+TEST(TestFPLinkageStubCall) {
+  Isolate* isolate = CcTest::InitIsolateOnce();
+  Zone zone(isolate->allocator(), ZONE_NAME);
+  Callable callable =
+      Builtins::CallableFor(isolate, Builtins::kWasmFloat64ToNumber);
+  OptimizedCompilationInfo info(ArrayVector("test"), &zone, Code::STUB);
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
+      &zone, callable.descriptor(), 0, CallDescriptor::kNoFlags,
+      Operator::kNoProperties);
+  CHECK(call_descriptor);
+  CHECK_EQ(0, static_cast<int>(call_descriptor->StackParameterCount()));
+  CHECK_EQ(1, static_cast<int>(call_descriptor->ParameterCount()));
+  CHECK_EQ(1, static_cast<int>(call_descriptor->ReturnCount()));
+  CHECK_EQ(Operator::kNoProperties, call_descriptor->properties());
+  CHECK_EQ(false, call_descriptor->IsJSFunctionCall());
+
+  CHECK_EQ(call_descriptor->GetInputType(1), MachineType::Float64());
+  CHECK(call_descriptor->GetInputLocation(1).IsRegister());
+  CHECK_EQ(call_descriptor->GetReturnType(0), MachineType::AnyTagged());
+  CHECK(call_descriptor->GetReturnLocation(0).IsRegister());
+  CHECK_EQ(call_descriptor->GetReturnLocation(0).GetLocation(),
+           kReturnRegister0.code());
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/compiler/value-helper.h b/deps/v8/test/cctest/compiler/value-helper.h
index a612a6432d3..cda606ec169 100644
--- a/deps/v8/test/cctest/compiler/value-helper.h
+++ b/deps/v8/test/cctest/compiler/value-helper.h
@@ -248,7 +248,7 @@ class ValueHelper {
     return ArrayVector(uint32_array);
   }
 
-  static constexpr Vector<const int32_t> int32_vector() {
+  static Vector<const int32_t> int32_vector() {
     return Vector<const int32_t>::cast(uint32_vector());
   }
 
@@ -282,7 +282,7 @@ class ValueHelper {
     return ArrayVector(uint64_array);
   }
 
-  static constexpr Vector<const int64_t> int64_vector() {
+  static Vector<const int64_t> int64_vector() {
     return Vector<const int64_t>::cast(uint64_vector());
   }
 
@@ -293,7 +293,7 @@ class ValueHelper {
     return ArrayVector(int16_array);
   }
 
-  static constexpr Vector<const uint16_t> uint16_vector() {
+  static Vector<const uint16_t> uint16_vector() {
     return Vector<const uint16_t>::cast(int16_vector());
   }
 
@@ -304,7 +304,7 @@ class ValueHelper {
     return ArrayVector(int8_array);
   }
 
-  static constexpr Vector<const uint8_t> uint8_vector() {
+  static Vector<const uint8_t> uint8_vector() {
     return Vector<const uint8_t>::cast(ArrayVector(int8_array));
   }
 
@@ -317,41 +317,41 @@ class ValueHelper {
   }
 
   template <typename T>
-  static constexpr Vector<const T> GetVector();
+  static inline Vector<const T> GetVector();
 };
 
 template <>
-constexpr Vector<const int8_t> ValueHelper::GetVector() {
+inline Vector<const int8_t> ValueHelper::GetVector() {
   return int8_vector();
 }
 
 template <>
-constexpr Vector<const uint8_t> ValueHelper::GetVector() {
+inline Vector<const uint8_t> ValueHelper::GetVector() {
   return uint8_vector();
 }
 
 template <>
-constexpr Vector<const int16_t> ValueHelper::GetVector() {
+inline Vector<const int16_t> ValueHelper::GetVector() {
   return int16_vector();
 }
 
 template <>
-constexpr Vector<const uint16_t> ValueHelper::GetVector() {
+inline Vector<const uint16_t> ValueHelper::GetVector() {
   return uint16_vector();
 }
 
 template <>
-constexpr Vector<const int32_t> ValueHelper::GetVector() {
+inline Vector<const int32_t> ValueHelper::GetVector() {
   return int32_vector();
 }
 
 template <>
-constexpr Vector<const uint32_t> ValueHelper::GetVector() {
+inline Vector<const uint32_t> ValueHelper::GetVector() {
   return uint32_vector();
 }
 
 template <>
-constexpr Vector<const int64_t> ValueHelper::GetVector() {
+inline Vector<const int64_t> ValueHelper::GetVector() {
   return int64_vector();
 }
 
diff --git a/deps/v8/test/cctest/heap/heap-tester.h b/deps/v8/test/cctest/heap/heap-tester.h
index 998e3ff011f..57182d26d9d 100644
--- a/deps/v8/test/cctest/heap/heap-tester.h
+++ b/deps/v8/test/cctest/heap/heap-tester.h
@@ -33,6 +33,7 @@
   V(InvalidatedSlotsFastToSlow)                             \
   V(InvalidatedSlotsSomeInvalidatedRanges)                  \
   V(TestNewSpaceRefsInCopiedCode)                           \
+  V(GCDuringOffThreadMergeWithTransferHandle)               \
   V(GCFlags)                                                \
   V(MarkCompactCollector)                                   \
   V(MarkCompactEpochCounter)                                \
diff --git a/deps/v8/test/cctest/heap/heap-utils.cc b/deps/v8/test/cctest/heap/heap-utils.cc
index 15f9c2d89f1..0abc075063e 100644
--- a/deps/v8/test/cctest/heap/heap-utils.cc
+++ b/deps/v8/test/cctest/heap/heap-utils.cc
@@ -9,6 +9,7 @@
 #include "src/heap/heap-inl.h"
 #include "src/heap/incremental-marking.h"
 #include "src/heap/mark-compact.h"
+#include "src/heap/memory-chunk.h"
 #include "test/cctest/cctest.h"
 
 namespace v8 {
diff --git a/deps/v8/test/cctest/heap/test-compaction.cc b/deps/v8/test/cctest/heap/test-compaction.cc
index d5a5df9cf22..e836f37db5a 100644
--- a/deps/v8/test/cctest/heap/test-compaction.cc
+++ b/deps/v8/test/cctest/heap/test-compaction.cc
@@ -6,7 +6,8 @@
 #include "src/heap/factory.h"
 #include "src/heap/heap-inl.h"
 #include "src/heap/mark-compact.h"
-#include "src/heap/remembered-set.h"
+#include "src/heap/memory-chunk.h"
+#include "src/heap/remembered-set-inl.h"
 #include "src/objects/objects-inl.h"
 #include "test/cctest/cctest.h"
 #include "test/cctest/heap/heap-tester.h"
diff --git a/deps/v8/test/cctest/heap/test-concurrent-allocation.cc b/deps/v8/test/cctest/heap/test-concurrent-allocation.cc
new file mode 100644
index 00000000000..340e81ca815
--- /dev/null
+++ b/deps/v8/test/cctest/heap/test-concurrent-allocation.cc
@@ -0,0 +1,195 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <memory>
+
+#include "src/api/api.h"
+#include "src/base/platform/condition-variable.h"
+#include "src/base/platform/mutex.h"
+#include "src/base/platform/semaphore.h"
+#include "src/common/globals.h"
+#include "src/handles/handles-inl.h"
+#include "src/handles/local-handles-inl.h"
+#include "src/handles/persistent-handles.h"
+#include "src/heap/concurrent-allocator-inl.h"
+#include "src/heap/heap.h"
+#include "src/heap/local-heap.h"
+#include "src/heap/safepoint.h"
+#include "src/objects/heap-number.h"
+#include "src/objects/heap-object.h"
+#include "test/cctest/cctest.h"
+#include "test/cctest/heap/heap-utils.h"
+
+namespace v8 {
+namespace internal {
+
+void CreateFixedArray(Heap* heap, Address start, int size) {
+  HeapObject object = HeapObject::FromAddress(start);
+  object.set_map_after_allocation(ReadOnlyRoots(heap).fixed_array_map(),
+                                  SKIP_WRITE_BARRIER);
+  FixedArray array = FixedArray::cast(object);
+  int length = (size - FixedArray::kHeaderSize) / kTaggedSize;
+  array.set_length(length);
+  MemsetTagged(array.data_start(), ReadOnlyRoots(heap).undefined_value(),
+               length);
+}
+
+const int kNumIterations = 2000;
+const int kSmallObjectSize = 10 * kTaggedSize;
+const int kMediumObjectSize = 8 * KB;
+
+class ConcurrentAllocationThread final : public v8::base::Thread {
+ public:
+  explicit ConcurrentAllocationThread(Heap* heap, std::atomic<int>* pending)
+      : v8::base::Thread(base::Thread::Options("ThreadWithLocalHeap")),
+        heap_(heap),
+        pending_(pending) {}
+
+  void Run() override {
+    LocalHeap local_heap(heap_);
+    ConcurrentAllocator* allocator = local_heap.old_space_allocator();
+
+    for (int i = 0; i < kNumIterations; i++) {
+      Address address = allocator->AllocateOrFail(
+          kSmallObjectSize, AllocationAlignment::kWordAligned,
+          AllocationOrigin::kRuntime);
+      CreateFixedArray(heap_, address, kSmallObjectSize);
+      address = allocator->AllocateOrFail(kMediumObjectSize,
+                                          AllocationAlignment::kWordAligned,
+                                          AllocationOrigin::kRuntime);
+      CreateFixedArray(heap_, address, kMediumObjectSize);
+      if (i % 10 == 0) {
+        local_heap.Safepoint();
+      }
+    }
+
+    pending_->fetch_sub(1);
+  }
+
+  Heap* heap_;
+  std::atomic<int>* pending_;
+};
+
+UNINITIALIZED_TEST(ConcurrentAllocationInOldSpace) {
+  FLAG_max_old_space_size = 32;
+  FLAG_concurrent_allocation = true;
+
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  v8::Isolate* isolate = v8::Isolate::New(create_params);
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+
+  FLAG_local_heaps = true;
+
+  std::vector<std::unique_ptr<ConcurrentAllocationThread>> threads;
+
+  const int kThreads = 4;
+
+  std::atomic<int> pending(kThreads);
+
+  for (int i = 0; i < kThreads; i++) {
+    auto thread = std::make_unique<ConcurrentAllocationThread>(
+        i_isolate->heap(), &pending);
+    CHECK(thread->Start());
+    threads.push_back(std::move(thread));
+  }
+
+  while (pending > 0) {
+    v8::platform::PumpMessageLoop(i::V8::GetCurrentPlatform(), isolate);
+  }
+
+  for (auto& thread : threads) {
+    thread->Join();
+  }
+
+  isolate->Dispose();
+}
+
+const int kWhiteIterations = 1000;
+
+class ConcurrentBlackAllocationThread final : public v8::base::Thread {
+ public:
+  explicit ConcurrentBlackAllocationThread(
+      Heap* heap, std::vector<Address>* objects, base::Semaphore* sema_white,
+      base::Semaphore* sema_marking_started)
+      : v8::base::Thread(base::Thread::Options("ThreadWithLocalHeap")),
+        heap_(heap),
+        objects_(objects),
+        sema_white_(sema_white),
+        sema_marking_started_(sema_marking_started) {}
+
+  void Run() override {
+    LocalHeap local_heap(heap_);
+    ConcurrentAllocator* allocator = local_heap.old_space_allocator();
+
+    for (int i = 0; i < kNumIterations; i++) {
+      if (i == kWhiteIterations) {
+        ParkedScope scope(&local_heap);
+        sema_white_->Signal();
+        sema_marking_started_->Wait();
+      }
+      Address address = allocator->AllocateOrFail(
+          kSmallObjectSize, AllocationAlignment::kWordAligned,
+          AllocationOrigin::kRuntime);
+      objects_->push_back(address);
+      CreateFixedArray(heap_, address, kSmallObjectSize);
+      address = allocator->AllocateOrFail(kMediumObjectSize,
+                                          AllocationAlignment::kWordAligned,
+                                          AllocationOrigin::kRuntime);
+      objects_->push_back(address);
+      CreateFixedArray(heap_, address, kMediumObjectSize);
+    }
+  }
+
+  Heap* heap_;
+  std::vector<Address>* objects_;
+  base::Semaphore* sema_white_;
+  base::Semaphore* sema_marking_started_;
+};
+
+UNINITIALIZED_TEST(ConcurrentBlackAllocation) {
+  FLAG_concurrent_allocation = true;
+
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  v8::Isolate* isolate = v8::Isolate::New(create_params);
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+  Heap* heap = i_isolate->heap();
+
+  FLAG_local_heaps = true;
+
+  std::vector<Address> objects;
+
+  base::Semaphore sema_white(0);
+  base::Semaphore sema_marking_started(0);
+
+  auto thread = std::make_unique<ConcurrentBlackAllocationThread>(
+      heap, &objects, &sema_white, &sema_marking_started);
+  CHECK(thread->Start());
+
+  sema_white.Wait();
+  heap->StartIncrementalMarking(i::Heap::kNoGCFlags,
+                                i::GarbageCollectionReason::kTesting);
+  sema_marking_started.Signal();
+
+  thread->Join();
+
+  const int kObjectsAllocatedPerIteration = 2;
+
+  for (int i = 0; i < kNumIterations * kObjectsAllocatedPerIteration; i++) {
+    Address address = objects[i];
+    HeapObject object = HeapObject::FromAddress(address);
+
+    if (i < kWhiteIterations * kObjectsAllocatedPerIteration) {
+      CHECK(heap->incremental_marking()->marking_state()->IsWhite(object));
+    } else {
+      CHECK(heap->incremental_marking()->marking_state()->IsBlack(object));
+    }
+  }
+
+  isolate->Dispose();
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/heap/test-embedder-tracing.cc b/deps/v8/test/cctest/heap/test-embedder-tracing.cc
index 37b31c2c337..3933c6ec469 100644
--- a/deps/v8/test/cctest/heap/test-embedder-tracing.cc
+++ b/deps/v8/test/cctest/heap/test-embedder-tracing.cc
@@ -281,7 +281,8 @@ TEST(GarbageCollectionForTesting) {
   heap::TemporaryEmbedderHeapTracerScope tracer_scope(isolate, &tracer);
 
   int saved_gc_counter = i_isolate->heap()->gc_count();
-  tracer.GarbageCollectionForTesting(EmbedderHeapTracer::kUnknown);
+  tracer.GarbageCollectionForTesting(
+      EmbedderHeapTracer::EmbedderStackState::kMayContainHeapPointers);
   CHECK_GT(i_isolate->heap()->gc_count(), saved_gc_counter);
 }
 
diff --git a/deps/v8/test/cctest/heap/test-heap.cc b/deps/v8/test/cctest/heap/test-heap.cc
index d181f764f84..46e7e914764 100644
--- a/deps/v8/test/cctest/heap/test-heap.cc
+++ b/deps/v8/test/cctest/heap/test-heap.cc
@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 #include <stdlib.h>
+
 #include <utility>
 
 #include "src/api/api-inl.h"
@@ -35,6 +36,7 @@
 #include "src/debug/debug.h"
 #include "src/deoptimizer/deoptimizer.h"
 #include "src/execution/execution.h"
+#include "src/execution/off-thread-isolate.h"
 #include "src/handles/global-handles.h"
 #include "src/heap/combined-heap.h"
 #include "src/heap/factory.h"
@@ -42,8 +44,9 @@
 #include "src/heap/heap-inl.h"
 #include "src/heap/incremental-marking.h"
 #include "src/heap/mark-compact.h"
+#include "src/heap/memory-chunk.h"
 #include "src/heap/memory-reducer.h"
-#include "src/heap/remembered-set.h"
+#include "src/heap/remembered-set-inl.h"
 #include "src/ic/ic.h"
 #include "src/numbers/hash-seed-inl.h"
 #include "src/objects/elements.h"
@@ -5051,7 +5054,8 @@ TEST(Regress3877) {
   CHECK(weak_prototype_holder->Get(0)->IsCleared());
 }
 
-Handle<WeakFixedArray> AddRetainedMap(Isolate* isolate, Heap* heap) {
+Handle<WeakFixedArray> AddRetainedMap(Isolate* isolate,
+                                      Handle<NativeContext> context) {
   HandleScope inner_scope(isolate);
   Handle<Map> map = Map::Create(isolate, 1);
   v8::Local<v8::Value> result =
@@ -5059,18 +5063,24 @@ Handle<WeakFixedArray> AddRetainedMap(Isolate* isolate, Heap* heap) {
   Handle<JSReceiver> proto =
       v8::Utils::OpenHandle(*v8::Local<v8::Object>::Cast(result));
   Map::SetPrototype(isolate, map, proto);
-  heap->AddRetainedMap(map);
+  isolate->heap()->AddRetainedMap(context, map);
   Handle<WeakFixedArray> array = isolate->factory()->NewWeakFixedArray(1);
   array->Set(0, HeapObjectReference::Weak(*map));
   return inner_scope.CloseAndEscape(array);
 }
 
-
 void CheckMapRetainingFor(int n) {
   FLAG_retain_maps_for_n_gc = n;
   Isolate* isolate = CcTest::i_isolate();
   Heap* heap = isolate->heap();
-  Handle<WeakFixedArray> array_with_map = AddRetainedMap(isolate, heap);
+  v8::Local<v8::Context> ctx = v8::Context::New(CcTest::isolate());
+  Handle<Context> context = Utils::OpenHandle(*ctx);
+  CHECK(context->IsNativeContext());
+  Handle<NativeContext> native_context = Handle<NativeContext>::cast(context);
+
+  ctx->Enter();
+  Handle<WeakFixedArray> array_with_map =
+      AddRetainedMap(isolate, native_context);
   CHECK(array_with_map->Get(0)->IsWeak());
   for (int i = 0; i < n; i++) {
     heap::SimulateIncrementalMarking(heap);
@@ -5080,6 +5090,8 @@ void CheckMapRetainingFor(int n) {
   heap::SimulateIncrementalMarking(heap);
   CcTest::CollectGarbage(OLD_SPACE);
   CHECK(array_with_map->Get(0)->IsCleared());
+
+  ctx->Exit();
 }
 
 
@@ -5094,6 +5106,30 @@ TEST(MapRetaining) {
   CheckMapRetainingFor(7);
 }
 
+TEST(RetainedMapsCleanup) {
+  if (!FLAG_incremental_marking) return;
+  ManualGCScope manual_gc_scope;
+  CcTest::InitializeVM();
+  v8::HandleScope scope(CcTest::isolate());
+  Isolate* isolate = CcTest::i_isolate();
+  Heap* heap = isolate->heap();
+  v8::Local<v8::Context> ctx = v8::Context::New(CcTest::isolate());
+  Handle<Context> context = Utils::OpenHandle(*ctx);
+  CHECK(context->IsNativeContext());
+  Handle<NativeContext> native_context = Handle<NativeContext>::cast(context);
+
+  ctx->Enter();
+  Handle<WeakFixedArray> array_with_map =
+      AddRetainedMap(isolate, native_context);
+  CHECK(array_with_map->Get(0)->IsWeak());
+  heap->NotifyContextDisposed(true);
+  CcTest::CollectAllGarbage();
+  ctx->Exit();
+
+  CHECK_EQ(ReadOnlyRoots(heap).empty_weak_array_list(),
+           native_context->retained_maps());
+}
+
 TEST(PreprocessStackTrace) {
   // Do not automatically trigger early GC.
   FLAG_gc_interval = -1;
@@ -6446,7 +6482,6 @@ UNINITIALIZED_TEST(ReinitializeStringHashSeed) {
       v8::Context::Scope context_scope(context);
     }
     isolate->Dispose();
-    ReadOnlyHeap::ClearSharedHeapForTest();
   }
 }
 
@@ -6933,6 +6968,79 @@ TEST(NoCodeRangeInJitlessMode) {
       CcTest::i_isolate()->heap()->memory_allocator()->code_range().is_empty());
 }
 
+TEST(Regress978156) {
+  if (!FLAG_incremental_marking) return;
+  ManualGCScope manual_gc_scope;
+  CcTest::InitializeVM();
+
+  HandleScope handle_scope(CcTest::i_isolate());
+  Heap* heap = CcTest::i_isolate()->heap();
+
+  // 1. Ensure that the new space is empty.
+  CcTest::CollectGarbage(NEW_SPACE);
+  CcTest::CollectGarbage(NEW_SPACE);
+  // 2. Fill the first page of the new space with FixedArrays.
+  std::vector<Handle<FixedArray>> arrays;
+  i::heap::FillCurrentPage(heap->new_space(), &arrays);
+  // 3. Trim the last array by one word thus creating a one-word filler.
+  Handle<FixedArray> last = arrays.back();
+  CHECK_GT(last->length(), 0);
+  heap->RightTrimFixedArray(*last, 1);
+  // 4. Get the last filler on the page.
+  HeapObject filler = HeapObject::FromAddress(
+      MemoryChunk::FromHeapObject(*last)->area_end() - kTaggedSize);
+  HeapObject::FromAddress(last->address() + last->Size());
+  CHECK(filler.IsFiller());
+  // 5. Start incremental marking.
+  i::IncrementalMarking* marking = heap->incremental_marking();
+  if (marking->IsStopped()) {
+    marking->Start(i::GarbageCollectionReason::kTesting);
+  }
+  IncrementalMarking::MarkingState* marking_state = marking->marking_state();
+  // 6. Mark the filler black to access its two markbits. This triggers
+  // an out-of-bounds access of the marking bitmap in a bad case.
+  marking_state->WhiteToGrey(filler);
+  marking_state->GreyToBlack(filler);
+}
+
+HEAP_TEST(GCDuringOffThreadMergeWithTransferHandle) {
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Heap* heap = isolate->heap();
+
+  HandleScope handle_scope(isolate);
+
+  Zone zone(isolate->allocator(), ZONE_NAME);
+  OffThreadIsolate off_thread_isolate(isolate, &zone);
+
+  OffThreadTransferHandle<FixedArray> transfer_handle;
+
+  {
+    OffThreadHandleScope handle_scope(&off_thread_isolate);
+    Handle<FixedArray> obj =
+        off_thread_isolate.factory()->NewFixedArray(10, AllocationType::kOld);
+
+    transfer_handle = off_thread_isolate.TransferHandle(obj);
+
+    off_thread_isolate.FinishOffThread();
+  }
+
+  heap->set_force_oom(true);
+
+  heap->AddNearHeapLimitCallback(
+      [](void* data, size_t current_heap_limit,
+         size_t initial_heap_limit) -> size_t {
+        Heap* heap = static_cast<Heap*>(data);
+        heap->set_force_oom(false);
+        return 0;
+      },
+      heap);
+
+  off_thread_isolate.Publish(isolate);
+  CHECK(transfer_handle.ToHandle()->IsFixedArray());
+  CHECK_EQ(transfer_handle.ToHandle()->length(), 10);
+}
+
 }  // namespace heap
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/heap/test-invalidated-slots.cc b/deps/v8/test/cctest/heap/test-invalidated-slots.cc
index 67e5c0d48e1..c597fe839da 100644
--- a/deps/v8/test/cctest/heap/test-invalidated-slots.cc
+++ b/deps/v8/test/cctest/heap/test-invalidated-slots.cc
@@ -4,12 +4,12 @@
 
 #include <stdlib.h>
 
-#include "src/init/v8.h"
-
 #include "src/heap/heap-inl.h"
 #include "src/heap/heap.h"
 #include "src/heap/invalidated-slots-inl.h"
 #include "src/heap/invalidated-slots.h"
+#include "src/heap/memory-chunk.h"
+#include "src/init/v8.h"
 #include "test/cctest/cctest.h"
 #include "test/cctest/heap/heap-tester.h"
 #include "test/cctest/heap/heap-utils.h"
diff --git a/deps/v8/test/cctest/heap/test-spaces.cc b/deps/v8/test/cctest/heap/test-spaces.cc
index eb91a5e6718..82d90fc8420 100644
--- a/deps/v8/test/cctest/heap/test-spaces.cc
+++ b/deps/v8/test/cctest/heap/test-spaces.cc
@@ -30,6 +30,9 @@
 #include "src/base/bounded-page-allocator.h"
 #include "src/base/platform/platform.h"
 #include "src/heap/factory.h"
+#include "src/heap/large-spaces.h"
+#include "src/heap/memory-allocator.h"
+#include "src/heap/memory-chunk.h"
 #include "src/heap/spaces-inl.h"
 #include "src/heap/spaces.h"
 #include "src/objects/free-space.h"
diff --git a/deps/v8/test/cctest/heap/test-unmapper.cc b/deps/v8/test/cctest/heap/test-unmapper.cc
index a28e812a99e..1cfd0628d02 100644
--- a/deps/v8/test/cctest/heap/test-unmapper.cc
+++ b/deps/v8/test/cctest/heap/test-unmapper.cc
@@ -2,9 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/init/v8.h"
+#include <vector>
 
-#include "src/heap/spaces.h"
+#include "src/heap/heap.h"
+#include "src/heap/memory-allocator.h"
+#include "src/init/v8.h"
 #include "test/cctest/cctest.h"
 #include "test/cctest/heap/heap-utils.h"
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden
index 8701e505920..a055e878228 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden
@@ -208,9 +208,9 @@ snippet: "
   async function* f() { for (let x of [42]) yield x }
   f();
 "
-frame size: 19
+frame size: 18
 parameter count: 1
-bytecode array length: 361
+bytecode array length: 341
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(4),
@@ -230,7 +230,7 @@ bytecodes: [
                 B(LdaSmi), I8(1),
                 B(Star), R(4),
                 B(Mov), R(8), R(5),
-                B(JumpConstant), U8(15),
+                B(Jump), U8(247),
   /*   36 S> */ B(CreateArrayLiteral), U8(4), U8(0), U8(37),
                 B(Star), R(10),
                 B(GetIterator), R(10), U8(1), U8(3),
@@ -285,34 +285,26 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(13),
                 B(Ldar), R(10),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(15),
                 B(LdaNamedProperty), R(9), U8(10), U8(13),
-                B(Star), R(15),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(16),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(17),
-                B(LdaConstant), U8(11),
-                B(Star), R(18),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(17), U8(2),
-                B(Throw),
-                B(CallProperty0), R(15), R(9), U8(15),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(16),
+                B(CallProperty0), R(16), R(9), U8(15),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(17),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(17), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(16),
+                B(Star), R(15),
                 B(LdaZero),
                 B(TestReferenceEqual), R(11),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(16),
+                B(Ldar), R(15),
                 B(ReThrow),
                 B(Ldar), R(13),
                 B(SetPendingMessage),
                 B(Ldar), R(11),
-                B(SwitchOnSmiNoFeedback), U8(12), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(11), U8(2), I8(0),
                 B(Jump), U8(14),
                 B(Ldar), R(12),
                 B(ReThrow),
@@ -326,7 +318,7 @@ bytecodes: [
                 B(Star), R(4),
                 B(Jump), U8(41),
                 B(Star), R(8),
-                B(CreateCatchContext), R(8), U8(14),
+                B(CreateCatchContext), R(8), U8(13),
                 B(Star), R(7),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -351,7 +343,7 @@ bytecodes: [
                 B(Ldar), R(6),
                 B(SetPendingMessage),
                 B(Ldar), R(4),
-                B(SwitchOnSmiNoFeedback), U8(16), U8(3), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(14), U8(3), I8(0),
                 B(Jump), U8(22),
                 B(Ldar), R(5),
                 B(ReThrow),
@@ -378,20 +370,18 @@ constant pool: [
   Smi [16],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   Smi [6],
   Smi [9],
   SCOPE_INFO_TYPE,
-  Smi [267],
   Smi [6],
   Smi [9],
   Smi [23],
 ]
 handlers: [
-  [19, 315, 315],
-  [22, 281, 281],
+  [19, 295, 295],
+  [22, 261, 261],
   [86, 172, 180],
-  [204, 237, 239],
+  [196, 217, 219],
 ]
 
 ---
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/DestructuringAssignment.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/DestructuringAssignment.golden
index 4bb89c6179d..e8d53c3ff31 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/DestructuringAssignment.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/DestructuringAssignment.golden
@@ -10,9 +10,9 @@ snippet: "
   var x, a = [0,1,2,3];
   [x] = a;
 "
-frame size: 14
+frame size: 13
 parameter count: 1
-bytecode array length: 166
+bytecode array length: 146
 bytecodes: [
   /*   45 S> */ B(CreateArrayLiteral), U8(0), U8(0), U8(37),
                 B(Star), R(1),
@@ -55,29 +55,21 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(8),
                 B(Ldar), R(5),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(10),
                 B(LdaNamedProperty), R(4), U8(4), U8(13),
-                B(Star), R(10),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(11),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(12),
-                B(LdaConstant), U8(5),
-                B(Star), R(13),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(12), U8(2),
-                B(Throw),
-                B(CallProperty0), R(10), R(4), U8(15),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(11),
+                B(CallProperty0), R(11), R(4), U8(15),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(12),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(12), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(11),
+                B(Star), R(10),
                 B(LdaZero),
                 B(TestReferenceEqual), R(6),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(11),
+                B(Ldar), R(10),
                 B(ReThrow),
                 B(Ldar), R(8),
                 B(SetPendingMessage),
@@ -95,11 +87,10 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
   [34, 76, 84],
-  [108, 141, 143],
+  [100, 121, 123],
 ]
 
 ---
@@ -107,9 +98,9 @@ snippet: "
   var x, y, a = [0,1,2,3];
   [,x,...y] = a;
 "
-frame size: 15
+frame size: 14
 parameter count: 1
-bytecode array length: 252
+bytecode array length: 232
 bytecodes: [
   /*   48 S> */ B(CreateArrayLiteral), U8(0), U8(0), U8(37),
                 B(Star), R(2),
@@ -186,29 +177,21 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(9),
                 B(Ldar), R(6),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(11),
                 B(LdaNamedProperty), R(5), U8(4), U8(23),
-                B(Star), R(11),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(12),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(13),
-                B(LdaConstant), U8(5),
-                B(Star), R(14),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(13), U8(2),
-                B(Throw),
-                B(CallProperty0), R(11), R(5), U8(25),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(12),
+                B(CallProperty0), R(12), R(5), U8(25),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(13),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(13), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(12),
+                B(Star), R(11),
                 B(LdaZero),
                 B(TestReferenceEqual), R(7),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(12),
+                B(Ldar), R(11),
                 B(ReThrow),
                 B(Ldar), R(9),
                 B(SetPendingMessage),
@@ -226,11 +209,10 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
   [34, 162, 170],
-  [194, 227, 229],
+  [186, 207, 209],
 ]
 
 ---
@@ -238,9 +220,9 @@ snippet: "
   var x={}, y, a = [0];
   [x.foo,y=4] = a;
 "
-frame size: 16
+frame size: 15
 parameter count: 1
-bytecode array length: 217
+bytecode array length: 197
 bytecodes: [
   /*   40 S> */ B(CreateEmptyObjectLiteral),
                 B(Star), R(0),
@@ -304,29 +286,21 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(9),
                 B(Ldar), R(6),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(12),
                 B(LdaNamedProperty), R(5), U8(5), U8(17),
-                B(Star), R(12),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(13),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(14),
-                B(LdaConstant), U8(6),
-                B(Star), R(15),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(14), U8(2),
-                B(Throw),
-                B(CallProperty0), R(12), R(5), U8(19),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(13),
+                B(CallProperty0), R(13), R(5), U8(19),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(14),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(14), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(13),
+                B(Star), R(12),
                 B(LdaZero),
                 B(TestReferenceEqual), R(7),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
                 B(ReThrow),
                 B(Ldar), R(9),
                 B(SetPendingMessage),
@@ -345,11 +319,10 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["foo"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
   [37, 127, 135],
-  [159, 192, 194],
+  [151, 172, 174],
 ]
 
 ---
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
index 866694aa03a..3a4c3f50cf3 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
@@ -16,7 +16,7 @@ snippet: "
 "
 frame size: 19
 parameter count: 1
-bytecode array length: 319
+bytecode array length: 299
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(4),
@@ -84,20 +84,12 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(10),
                 B(Ldar), R(7),
-                B(JumpIfToBooleanTrue), U8(94),
+                B(JumpIfToBooleanTrue), U8(74),
+                B(Mov), R(context), R(14),
                 B(LdaNamedProperty), R(6), U8(8), U8(17),
-                B(Star), R(14),
-                B(JumpIfUndefinedOrNull), U8(86),
-                B(Mov), R(context), R(15),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(16),
-                B(LdaConstant), U8(9),
-                B(Star), R(17),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(16), U8(2),
-                B(Throw),
-                B(CallProperty0), R(14), R(6), U8(19),
+                B(JumpIfUndefinedOrNull), U8(65),
+                B(Star), R(15),
+                B(CallProperty0), R(15), R(6), U8(19),
                 B(Star), R(17),
                 B(Mov), R(0), R(16),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionAwaitUncaught), R(16), U8(2),
@@ -116,11 +108,11 @@ bytecodes: [
                 B(Star), R(18),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(18), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(15),
+                B(Star), R(14),
                 B(LdaZero),
                 B(TestReferenceEqual), R(8),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(15),
+                B(Ldar), R(14),
                 B(ReThrow),
                 B(Ldar), R(10),
                 B(SetPendingMessage),
@@ -137,7 +129,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionResolve), R(5), U8(3),
   /*   57 S> */ B(Return),
                 B(Star), R(5),
-                B(CreateCatchContext), R(5), U8(10),
+                B(CreateCatchContext), R(5), U8(9),
                 B(Star), R(4),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -153,7 +145,7 @@ bytecodes: [
 ]
 constant pool: [
   Smi [95],
-  Smi [223],
+  Smi [203],
   ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   SYMBOL_TYPE,
@@ -161,13 +153,12 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   SCOPE_INFO_TYPE,
 ]
 handlers: [
-  [19, 291, 291],
+  [19, 271, 271],
   [74, 153, 161],
-  [185, 254, 256],
+  [177, 234, 236],
 ]
 
 ---
@@ -179,7 +170,7 @@ snippet: "
 "
 frame size: 19
 parameter count: 1
-bytecode array length: 340
+bytecode array length: 320
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(4),
@@ -249,20 +240,12 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(10),
                 B(Ldar), R(7),
-                B(JumpIfToBooleanTrue), U8(94),
+                B(JumpIfToBooleanTrue), U8(74),
+                B(Mov), R(context), R(14),
                 B(LdaNamedProperty), R(6), U8(8), U8(17),
-                B(Star), R(14),
-                B(JumpIfUndefinedOrNull), U8(86),
-                B(Mov), R(context), R(15),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(16),
-                B(LdaConstant), U8(9),
-                B(Star), R(17),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(16), U8(2),
-                B(Throw),
-                B(CallProperty0), R(14), R(6), U8(19),
+                B(JumpIfUndefinedOrNull), U8(65),
+                B(Star), R(15),
+                B(CallProperty0), R(15), R(6), U8(19),
                 B(Star), R(17),
                 B(Mov), R(0), R(16),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionAwaitUncaught), R(16), U8(2),
@@ -281,16 +264,16 @@ bytecodes: [
                 B(Star), R(18),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(18), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(15),
+                B(Star), R(14),
                 B(LdaZero),
                 B(TestReferenceEqual), R(8),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(15),
+                B(Ldar), R(14),
                 B(ReThrow),
                 B(Ldar), R(10),
                 B(SetPendingMessage),
                 B(Ldar), R(8),
-                B(SwitchOnSmiNoFeedback), U8(10), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(9), U8(2), I8(0),
                 B(Jump), U8(19),
                 B(Ldar), R(9),
                 B(ReThrow),
@@ -308,7 +291,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionResolve), R(5), U8(3),
   /*   68 S> */ B(Return),
                 B(Star), R(5),
-                B(CreateCatchContext), R(5), U8(12),
+                B(CreateCatchContext), R(5), U8(11),
                 B(Star), R(4),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -324,7 +307,7 @@ bytecodes: [
 ]
 constant pool: [
   Smi [95],
-  Smi [227],
+  Smi [207],
   ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   SYMBOL_TYPE,
@@ -332,15 +315,14 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   Smi [6],
   Smi [9],
   SCOPE_INFO_TYPE,
 ]
 handlers: [
-  [19, 312, 312],
+  [19, 292, 292],
   [74, 157, 165],
-  [189, 258, 260],
+  [181, 238, 240],
 ]
 
 ---
@@ -355,7 +337,7 @@ snippet: "
 "
 frame size: 19
 parameter count: 1
-bytecode array length: 335
+bytecode array length: 315
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(4),
@@ -430,20 +412,12 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(10),
                 B(Ldar), R(7),
-                B(JumpIfToBooleanTrue), U8(94),
+                B(JumpIfToBooleanTrue), U8(74),
+                B(Mov), R(context), R(14),
                 B(LdaNamedProperty), R(6), U8(8), U8(19),
-                B(Star), R(14),
-                B(JumpIfUndefinedOrNull), U8(86),
-                B(Mov), R(context), R(15),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(16),
-                B(LdaConstant), U8(9),
-                B(Star), R(17),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(16), U8(2),
-                B(Throw),
-                B(CallProperty0), R(14), R(6), U8(21),
+                B(JumpIfUndefinedOrNull), U8(65),
+                B(Star), R(15),
+                B(CallProperty0), R(15), R(6), U8(21),
                 B(Star), R(17),
                 B(Mov), R(0), R(16),
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionAwaitUncaught), R(16), U8(2),
@@ -462,11 +436,11 @@ bytecodes: [
                 B(Star), R(18),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(18), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(15),
+                B(Star), R(14),
                 B(LdaZero),
                 B(TestReferenceEqual), R(8),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(15),
+                B(Ldar), R(14),
                 B(ReThrow),
                 B(Ldar), R(10),
                 B(SetPendingMessage),
@@ -483,7 +457,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionResolve), R(5), U8(3),
   /*  114 S> */ B(Return),
                 B(Star), R(5),
-                B(CreateCatchContext), R(5), U8(10),
+                B(CreateCatchContext), R(5), U8(9),
                 B(Star), R(4),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -499,7 +473,7 @@ bytecodes: [
 ]
 constant pool: [
   Smi [95],
-  Smi [239],
+  Smi [219],
   ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   SYMBOL_TYPE,
@@ -507,13 +481,12 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   SCOPE_INFO_TYPE,
 ]
 handlers: [
-  [19, 307, 307],
+  [19, 287, 287],
   [74, 169, 177],
-  [201, 270, 272],
+  [193, 250, 252],
 ]
 
 ---
@@ -524,9 +497,9 @@ snippet: "
   }
   f();
 "
-frame size: 15
+frame size: 14
 parameter count: 1
-bytecode array length: 251
+bytecode array length: 231
 bytecodes: [
                 B(Mov), R(closure), R(2),
                 B(Mov), R(this), R(3),
@@ -577,34 +550,26 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(8),
                 B(Ldar), R(5),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(11),
                 B(LdaNamedProperty), R(4), U8(6), U8(18),
-                B(Star), R(11),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(12),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(13),
-                B(LdaConstant), U8(7),
-                B(Star), R(14),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(13), U8(2),
-                B(Throw),
-                B(CallProperty0), R(11), R(4), U8(20),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(12),
+                B(CallProperty0), R(12), R(4), U8(20),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(13),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(13), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(12),
+                B(Star), R(11),
                 B(LdaZero),
                 B(TestReferenceEqual), R(6),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(12),
+                B(Ldar), R(11),
                 B(ReThrow),
                 B(Ldar), R(8),
                 B(SetPendingMessage),
                 B(Ldar), R(6),
-                B(SwitchOnSmiNoFeedback), U8(8), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(7), U8(2), I8(0),
                 B(Jump), U8(19),
                 B(Ldar), R(7),
                 B(ReThrow),
@@ -622,7 +587,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionResolve), R(3), U8(3),
   /*   96 S> */ B(Return),
                 B(Star), R(3),
-                B(CreateCatchContext), R(3), U8(10),
+                B(CreateCatchContext), R(3), U8(9),
                 B(Star), R(2),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -644,14 +609,13 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   Smi [6],
   Smi [9],
   SCOPE_INFO_TYPE,
 ]
 handlers: [
-  [15, 223, 223],
+  [15, 203, 203],
   [52, 104, 112],
-  [136, 169, 171],
+  [128, 149, 151],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden
index 681b4bc9f50..a3b9a1a86cb 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden
@@ -9,9 +9,9 @@ wrap: yes
 snippet: "
   for (var p of [0, 1, 2]) {}
 "
-frame size: 13
+frame size: 12
 parameter count: 1
-bytecode array length: 163
+bytecode array length: 143
 bytecodes: [
   /*   48 S> */ B(CreateArrayLiteral), U8(0), U8(0), U8(37),
                 B(Star), R(4),
@@ -51,29 +51,21 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(7),
                 B(Ldar), R(4),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(9),
                 B(LdaNamedProperty), R(3), U8(4), U8(13),
-                B(Star), R(9),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(10),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(11),
-                B(LdaConstant), U8(5),
-                B(Star), R(12),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(11), U8(2),
-                B(Throw),
-                B(CallProperty0), R(9), R(3), U8(15),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(10),
+                B(CallProperty0), R(10), R(3), U8(15),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(11),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(11), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(10),
+                B(Star), R(9),
                 B(LdaZero),
                 B(TestReferenceEqual), R(5),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(10),
+                B(Ldar), R(9),
                 B(ReThrow),
                 B(Ldar), R(7),
                 B(SetPendingMessage),
@@ -91,11 +83,10 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
   [31, 73, 81],
-  [105, 138, 140],
+  [97, 118, 120],
 ]
 
 ---
@@ -103,9 +94,9 @@ snippet: "
   var x = 'potatoes';
   for (var p of x) { return p; }
 "
-frame size: 14
+frame size: 13
 parameter count: 1
-bytecode array length: 171
+bytecode array length: 151
 bytecodes: [
   /*   42 S> */ B(LdaConstant), U8(0),
                 B(Star), R(0),
@@ -147,34 +138,26 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(8),
                 B(Ldar), R(5),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(10),
                 B(LdaNamedProperty), R(4), U8(4), U8(12),
-                B(Star), R(10),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(11),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(12),
-                B(LdaConstant), U8(5),
-                B(Star), R(13),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(12), U8(2),
-                B(Throw),
-                B(CallProperty0), R(10), R(4), U8(14),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(11),
+                B(CallProperty0), R(11), R(4), U8(14),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(12),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(12), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(11),
+                B(Star), R(10),
                 B(LdaZero),
                 B(TestReferenceEqual), R(6),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(11),
+                B(Ldar), R(10),
                 B(ReThrow),
                 B(Ldar), R(8),
                 B(SetPendingMessage),
                 B(Ldar), R(6),
-                B(SwitchOnSmiNoFeedback), U8(6), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(5), U8(2), I8(0),
                 B(Jump), U8(8),
                 B(Ldar), R(7),
                 B(ReThrow),
@@ -189,13 +172,12 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   Smi [6],
   Smi [9],
 ]
 handlers: [
   [29, 75, 83],
-  [107, 140, 142],
+  [99, 120, 122],
 ]
 
 ---
@@ -205,9 +187,9 @@ snippet: "
     if (x == 20) break;
   }
 "
-frame size: 13
+frame size: 12
 parameter count: 1
-bytecode array length: 179
+bytecode array length: 159
 bytecodes: [
   /*   48 S> */ B(CreateArrayLiteral), U8(0), U8(0), U8(37),
                 B(Star), R(4),
@@ -254,29 +236,21 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(7),
                 B(Ldar), R(4),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(9),
                 B(LdaNamedProperty), R(3), U8(4), U8(15),
-                B(Star), R(9),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(10),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(11),
-                B(LdaConstant), U8(5),
-                B(Star), R(12),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(11), U8(2),
-                B(Throw),
-                B(CallProperty0), R(9), R(3), U8(17),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(10),
+                B(CallProperty0), R(10), R(3), U8(17),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(11),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(11), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(10),
+                B(Star), R(9),
                 B(LdaZero),
                 B(TestReferenceEqual), R(5),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(10),
+                B(Ldar), R(9),
                 B(ReThrow),
                 B(Ldar), R(7),
                 B(SetPendingMessage),
@@ -294,11 +268,10 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
   [31, 89, 97],
-  [121, 154, 156],
+  [113, 134, 136],
 ]
 
 ---
@@ -306,9 +279,9 @@ snippet: "
   var x = { 'a': 1, 'b': 2 };
   for (x['a'] of [1,2,3]) { return x['a']; }
 "
-frame size: 13
+frame size: 12
 parameter count: 1
-bytecode array length: 185
+bytecode array length: 165
 bytecodes: [
   /*   42 S> */ B(CreateObjectLiteral), U8(0), U8(0), U8(41),
                 B(Star), R(0),
@@ -354,34 +327,26 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(6),
                 B(Ldar), R(3),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(9),
                 B(LdaNamedProperty), R(2), U8(6), U8(18),
-                B(Star), R(9),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(10),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(11),
-                B(LdaConstant), U8(7),
-                B(Star), R(12),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(11), U8(2),
-                B(Throw),
-                B(CallProperty0), R(9), R(2), U8(20),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(10),
+                B(CallProperty0), R(10), R(2), U8(20),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(11),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(11), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(10),
+                B(Star), R(9),
                 B(LdaZero),
                 B(TestReferenceEqual), R(4),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(10),
+                B(Ldar), R(9),
                 B(ReThrow),
                 B(Ldar), R(6),
                 B(SetPendingMessage),
                 B(Ldar), R(4),
-                B(SwitchOnSmiNoFeedback), U8(8), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(7), U8(2), I8(0),
                 B(Jump), U8(8),
                 B(Ldar), R(5),
                 B(ReThrow),
@@ -398,12 +363,11 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   Smi [6],
   Smi [9],
 ]
 handlers: [
   [37, 89, 97],
-  [121, 154, 156],
+  [113, 134, 136],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden
index a38d3d78dd5..42f4b336cae 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden
@@ -13,9 +13,9 @@ snippet: "
   }
   f([1, 2, 3]);
 "
-frame size: 15
+frame size: 14
 parameter count: 2
-bytecode array length: 160
+bytecode array length: 140
 bytecodes: [
   /*   34 S> */ B(GetIterator), R(arg0), U8(0), U8(2),
                 B(JumpIfJSReceiver), U8(7),
@@ -54,29 +54,21 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(9),
                 B(Ldar), R(6),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(11),
                 B(LdaNamedProperty), R(5), U8(3), U8(12),
-                B(Star), R(11),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(12),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(13),
-                B(LdaConstant), U8(4),
-                B(Star), R(14),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(13), U8(2),
-                B(Throw),
-                B(CallProperty0), R(11), R(5), U8(14),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(12),
+                B(CallProperty0), R(12), R(5), U8(14),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(13),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(13), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(12),
+                B(Star), R(11),
                 B(LdaZero),
                 B(TestReferenceEqual), R(7),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(12),
+                B(Ldar), R(11),
                 B(ReThrow),
                 B(Ldar), R(9),
                 B(SetPendingMessage),
@@ -93,11 +85,10 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
   [25, 70, 78],
-  [102, 135, 137],
+  [94, 115, 117],
 ]
 
 ---
@@ -109,7 +100,7 @@ snippet: "
 "
 frame size: 20
 parameter count: 2
-bytecode array length: 244
+bytecode array length: 224
 bytecodes: [
   /*   10 E> */ B(CreateFunctionContext), U8(0), U8(5),
                 B(PushContext), R(2),
@@ -185,29 +176,21 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(9),
                 B(Ldar), R(6),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(12),
                 B(LdaNamedProperty), R(5), U8(8), U8(16),
-                B(Star), R(12),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(13),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(14),
-                B(LdaConstant), U8(9),
-                B(Star), R(15),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(14), U8(2),
-                B(Throw),
-                B(CallProperty0), R(12), R(5), U8(18),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(13),
+                B(CallProperty0), R(13), R(5), U8(18),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(14),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(14), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(13),
+                B(Star), R(12),
                 B(LdaZero),
                 B(TestReferenceEqual), R(7),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
                 B(ReThrow),
                 B(Ldar), R(9),
                 B(SetPendingMessage),
@@ -230,11 +213,10 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["eval"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["1"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
   [58, 152, 160],
-  [184, 217, 219],
+  [176, 197, 199],
 ]
 
 ---
@@ -244,9 +226,9 @@ snippet: "
   }
   f([1, 2, 3]);
 "
-frame size: 14
+frame size: 13
 parameter count: 2
-bytecode array length: 177
+bytecode array length: 157
 bytecodes: [
   /*   34 S> */ B(GetIterator), R(arg0), U8(0), U8(2),
                 B(JumpIfJSReceiver), U8(7),
@@ -293,29 +275,21 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(7),
                 B(Ldar), R(4),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(10),
                 B(LdaNamedProperty), R(3), U8(5), U8(14),
-                B(Star), R(10),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(11),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(12),
-                B(LdaConstant), U8(6),
-                B(Star), R(13),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(12), U8(2),
-                B(Throw),
-                B(CallProperty0), R(10), R(3), U8(16),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(11),
+                B(CallProperty0), R(11), R(3), U8(16),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(12),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(12), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(11),
+                B(Star), R(10),
                 B(LdaZero),
                 B(TestReferenceEqual), R(5),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(11),
+                B(Ldar), R(10),
                 B(ReThrow),
                 B(Ldar), R(7),
                 B(SetPendingMessage),
@@ -334,11 +308,10 @@ constant pool: [
   SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
   [25, 87, 95],
-  [119, 152, 154],
+  [111, 132, 134],
 ]
 
 ---
@@ -348,9 +321,9 @@ snippet: "
   }
   f([{ x: 0, y: 3 }, { x: 1, y: 9 }, { x: -12, y: 17 }]);
 "
-frame size: 17
+frame size: 16
 parameter count: 2
-bytecode array length: 171
+bytecode array length: 151
 bytecodes: [
   /*   41 S> */ B(GetIterator), R(arg0), U8(0), U8(2),
                 B(JumpIfJSReceiver), U8(7),
@@ -393,29 +366,21 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(11),
                 B(Ldar), R(8),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(13),
                 B(LdaNamedProperty), R(7), U8(5), U8(17),
-                B(Star), R(13),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(14),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(15),
-                B(LdaConstant), U8(6),
-                B(Star), R(16),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(15), U8(2),
-                B(Throw),
-                B(CallProperty0), R(13), R(7), U8(19),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(14),
+                B(CallProperty0), R(14), R(7), U8(19),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(15),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(15), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(14),
+                B(Star), R(13),
                 B(LdaZero),
                 B(TestReferenceEqual), R(9),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
                 B(ReThrow),
                 B(Ldar), R(11),
                 B(SetPendingMessage),
@@ -434,11 +399,10 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["y"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
   [25, 81, 89],
-  [113, 146, 148],
+  [105, 126, 128],
 ]
 
 ---
@@ -448,9 +412,9 @@ snippet: "
   }
   f([1, 2, 3]);
 "
-frame size: 16
+frame size: 15
 parameter count: 2
-bytecode array length: 201
+bytecode array length: 181
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(Mov), R(closure), R(5),
@@ -503,29 +467,21 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(10),
                 B(Ldar), R(7),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(12),
                 B(LdaNamedProperty), R(6), U8(6), U8(12),
-                B(Star), R(12),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(13),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(14),
-                B(LdaConstant), U8(7),
-                B(Star), R(15),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(14), U8(2),
-                B(Throw),
-                B(CallProperty0), R(12), R(6), U8(14),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(13),
+                B(CallProperty0), R(13), R(6), U8(14),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(14),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(14), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(13),
+                B(Star), R(12),
                 B(LdaZero),
                 B(TestReferenceEqual), R(8),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
                 B(ReThrow),
                 B(Ldar), R(10),
                 B(SetPendingMessage),
@@ -545,11 +501,10 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
   [66, 111, 119],
-  [143, 176, 178],
+  [135, 156, 158],
 ]
 
 ---
@@ -559,9 +514,9 @@ snippet: "
   }
   f([1, 2, 3]);
 "
-frame size: 15
+frame size: 14
 parameter count: 2
-bytecode array length: 245
+bytecode array length: 225
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(4),
@@ -628,34 +583,26 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(9),
                 B(Ldar), R(6),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(11),
                 B(LdaNamedProperty), R(5), U8(9), U8(12),
-                B(Star), R(11),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(12),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(13),
-                B(LdaConstant), U8(10),
-                B(Star), R(14),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(13), U8(2),
-                B(Throw),
-                B(CallProperty0), R(11), R(5), U8(14),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(12),
+                B(CallProperty0), R(12), R(5), U8(14),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(13),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(13), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(12),
+                B(Star), R(11),
                 B(LdaZero),
                 B(TestReferenceEqual), R(7),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(12),
+                B(Ldar), R(11),
                 B(ReThrow),
                 B(Ldar), R(9),
                 B(SetPendingMessage),
                 B(Ldar), R(7),
-                B(SwitchOnSmiNoFeedback), U8(11), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(10), U8(2), I8(0),
                 B(Jump), U8(8),
                 B(Ldar), R(8),
                 B(ReThrow),
@@ -675,13 +622,12 @@ constant pool: [
   Smi [16],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   Smi [6],
   Smi [9],
 ]
 handlers: [
   [66, 149, 157],
-  [181, 214, 216],
+  [173, 194, 196],
 ]
 
 ---
@@ -691,9 +637,9 @@ snippet: "
   }
   f([1, 2, 3]);
 "
-frame size: 17
+frame size: 16
 parameter count: 2
-bytecode array length: 215
+bytecode array length: 195
 bytecodes: [
                 B(Mov), R(closure), R(5),
                 B(Mov), R(this), R(6),
@@ -737,29 +683,21 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(11),
                 B(Ldar), R(8),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(13),
                 B(LdaNamedProperty), R(7), U8(3), U8(12),
-                B(Star), R(13),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(14),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(15),
-                B(LdaConstant), U8(4),
-                B(Star), R(16),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(15), U8(2),
-                B(Throw),
-                B(CallProperty0), R(13), R(7), U8(14),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(14),
+                B(CallProperty0), R(14), R(7), U8(14),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(15),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(15), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(14),
+                B(Star), R(13),
                 B(LdaZero),
                 B(TestReferenceEqual), R(9),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
                 B(ReThrow),
                 B(Ldar), R(11),
                 B(SetPendingMessage),
@@ -776,7 +714,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionResolve), R(6), U8(3),
   /*   60 S> */ B(Return),
                 B(Star), R(6),
-                B(CreateCatchContext), R(6), U8(5),
+                B(CreateCatchContext), R(6), U8(4),
                 B(Star), R(5),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -795,13 +733,12 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   SCOPE_INFO_TYPE,
 ]
 handlers: [
-  [15, 187, 187],
+  [15, 167, 167],
   [40, 85, 93],
-  [117, 150, 152],
+  [109, 130, 132],
 ]
 
 ---
@@ -811,9 +748,9 @@ snippet: "
   }
   f([1, 2, 3]);
 "
-frame size: 16
+frame size: 15
 parameter count: 2
-bytecode array length: 251
+bytecode array length: 231
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(Mov), R(closure), R(4),
@@ -870,29 +807,21 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(10),
                 B(Ldar), R(7),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(12),
                 B(LdaNamedProperty), R(6), U8(4), U8(12),
-                B(Star), R(12),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(13),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(14),
-                B(LdaConstant), U8(5),
-                B(Star), R(15),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(14), U8(2),
-                B(Throw),
-                B(CallProperty0), R(12), R(6), U8(14),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(13),
+                B(CallProperty0), R(13), R(6), U8(14),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(14),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(14), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(13),
+                B(Star), R(12),
                 B(LdaZero),
                 B(TestReferenceEqual), R(8),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
                 B(ReThrow),
                 B(Ldar), R(10),
                 B(SetPendingMessage),
@@ -909,7 +838,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionResolve), R(5), U8(3),
   /*   54 S> */ B(Return),
                 B(Star), R(5),
-                B(CreateCatchContext), R(5), U8(6),
+                B(CreateCatchContext), R(5), U8(5),
                 B(Star), R(4),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -929,12 +858,11 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   SCOPE_INFO_TYPE,
 ]
 handlers: [
-  [19, 223, 223],
+  [19, 203, 203],
   [44, 121, 129],
-  [153, 186, 188],
+  [145, 166, 168],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden
index c3f8b980cf8..acd0a0e7f8e 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden
@@ -96,9 +96,9 @@ snippet: "
   function* f() { for (let x of [42]) yield x }
   f();
 "
-frame size: 15
+frame size: 14
 parameter count: 1
-bytecode array length: 251
+bytecode array length: 231
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(4),
@@ -167,34 +167,26 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Star), R(9),
                 B(Ldar), R(6),
-                B(JumpIfToBooleanTrue), U8(58),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(Mov), R(context), R(11),
                 B(LdaNamedProperty), R(5), U8(10), U8(13),
-                B(Star), R(11),
-                B(JumpIfUndefinedOrNull), U8(50),
-                B(Mov), R(context), R(12),
-                B(TestTypeOf), U8(6),
-                B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(160),
-                B(Star), R(13),
-                B(LdaConstant), U8(11),
-                B(Star), R(14),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(13), U8(2),
-                B(Throw),
-                B(CallProperty0), R(11), R(5), U8(15),
+                B(JumpIfUndefinedOrNull), U8(29),
+                B(Star), R(12),
+                B(CallProperty0), R(12), R(5), U8(15),
                 B(JumpIfJSReceiver), U8(21),
                 B(Star), R(13),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(13), U8(1),
                 B(Jump), U8(12),
-                B(Star), R(12),
+                B(Star), R(11),
                 B(LdaZero),
                 B(TestReferenceEqual), R(7),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(12),
+                B(Ldar), R(11),
                 B(ReThrow),
                 B(Ldar), R(9),
                 B(SetPendingMessage),
                 B(Ldar), R(7),
-                B(SwitchOnSmiNoFeedback), U8(12), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(11), U8(2), I8(0),
                 B(Jump), U8(8),
                 B(Ldar), R(8),
                 B(ReThrow),
@@ -215,13 +207,12 @@ constant pool: [
   Smi [16],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   Smi [6],
   Smi [9],
 ]
 handlers: [
   [72, 155, 163],
-  [187, 220, 222],
+  [179, 200, 202],
 ]
 
 ---
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateAccessorAccess.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateAccessorAccess.golden
index 7ac886945c2..36f54e68a8c 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateAccessorAccess.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateAccessorAccess.golden
@@ -26,14 +26,14 @@ frame size: 7
 parameter count: 1
 bytecode array length: 97
 bytecodes: [
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaImmutableCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
                 B(Mov), R(context), R(2),
   /*   67 E> */ B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
-  /*   76 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   76 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(4),
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaImmutableCurrentContextSlot), U8(3),
   /*   81 E> */ B(LdaKeyedProperty), R(this), U8(0),
                 B(CallRuntime), U16(Runtime::kLoadPrivateGetter), R(4), U8(1),
                 B(Star), R(5),
@@ -45,16 +45,16 @@ bytecodes: [
                 B(CallProperty1), R(6), R(this), R(5), U8(5),
   /*   91 S> */ B(LdaSmi), I8(1),
                 B(Star), R(3),
-                B(LdaCurrentContextSlot), U8(2),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(5),
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaImmutableCurrentContextSlot), U8(3),
   /*   96 E> */ B(LdaKeyedProperty), R(this), U8(7),
                 B(CallRuntime), U16(Runtime::kLoadPrivateSetter), R(5), U8(1),
                 B(Star), R(6),
                 B(CallProperty1), R(6), R(this), R(3), U8(9),
-  /*  108 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*  108 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(4),
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaImmutableCurrentContextSlot), U8(3),
   /*  120 E> */ B(LdaKeyedProperty), R(this), U8(11),
                 B(CallRuntime), U16(Runtime::kLoadPrivateGetter), R(4), U8(1),
                 B(Star), R(5),
@@ -79,12 +79,12 @@ frame size: 5
 parameter count: 1
 bytecode array length: 31
 bytecodes: [
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaImmutableCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
                 B(Mov), R(context), R(2),
   /*   48 E> */ B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
-  /*   53 S> */ B(Wide), B(LdaSmi), I16(266),
+  /*   53 S> */ B(Wide), B(LdaSmi), I16(265),
                 B(Star), R(3),
                 B(LdaConstant), U8(0),
                 B(Star), R(4),
@@ -110,12 +110,12 @@ frame size: 5
 parameter count: 1
 bytecode array length: 31
 bytecodes: [
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaImmutableCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
                 B(Mov), R(context), R(2),
   /*   41 E> */ B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
-  /*   46 S> */ B(Wide), B(LdaSmi), I16(265),
+  /*   46 S> */ B(Wide), B(LdaSmi), I16(264),
                 B(Star), R(3),
                 B(LdaConstant), U8(0),
                 B(Star), R(4),
@@ -141,12 +141,12 @@ frame size: 5
 parameter count: 1
 bytecode array length: 31
 bytecodes: [
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaImmutableCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
                 B(Mov), R(context), R(2),
   /*   48 E> */ B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
-  /*   53 S> */ B(Wide), B(LdaSmi), I16(266),
+  /*   53 S> */ B(Wide), B(LdaSmi), I16(265),
                 B(Star), R(3),
                 B(LdaConstant), U8(0),
                 B(Star), R(4),
@@ -172,12 +172,12 @@ frame size: 6
 parameter count: 1
 bytecode array length: 31
 bytecodes: [
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaImmutableCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
                 B(Mov), R(context), R(2),
   /*   41 E> */ B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
-  /*   46 S> */ B(Wide), B(LdaSmi), I16(265),
+  /*   46 S> */ B(Wide), B(LdaSmi), I16(264),
                 B(Star), R(4),
                 B(LdaConstant), U8(0),
                 B(Star), R(5),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateClassFieldAccess.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateClassFieldAccess.golden
new file mode 100644
index 00000000000..0c3eefef905
--- /dev/null
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateClassFieldAccess.golden
@@ -0,0 +1,84 @@
+#
+# Autogenerated by generate-bytecode-expectations.
+#
+
+---
+wrap: no
+test function name: test
+private methods: yes
+
+---
+snippet: "
+  class A {
+    #a;
+    #b;
+    constructor() {
+      this.#a = this.#b;
+    }
+  }
+  
+  var test = A;
+  new test;
+"
+frame size: 4
+parameter count: 1
+bytecode array length: 30
+bytecodes: [
+  /*   35 E> */ B(LdaNamedProperty), R(closure), U8(0), U8(0),
+                B(JumpIfUndefined), U8(11),
+                B(Star), R(1),
+                B(CallProperty0), R(1), R(this), U8(2),
+                B(Mov), R(this), R(0),
+  /*   44 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
+                B(Star), R(3),
+                B(LdaImmutableCurrentContextSlot), U8(3),
+  /*   59 E> */ B(LdaKeyedProperty), R(this), U8(4),
+  /*   52 E> */ B(StaKeyedProperty), R(this), R(3), U8(6),
+                B(LdaUndefined),
+  /*   65 S> */ B(Return),
+]
+constant pool: [
+  SYMBOL_TYPE,
+]
+handlers: [
+]
+
+---
+snippet: "
+  class B {
+    #a;
+    #b;
+    constructor() {
+      this.#a = this.#b;
+    }
+    force(str) {
+      eval(str);
+    }
+  }
+  
+  var test = B;
+  new test;
+"
+frame size: 4
+parameter count: 1
+bytecode array length: 30
+bytecodes: [
+  /*   35 E> */ B(LdaNamedProperty), R(closure), U8(0), U8(0),
+                B(JumpIfUndefined), U8(11),
+                B(Star), R(1),
+                B(CallProperty0), R(1), R(this), U8(2),
+                B(Mov), R(this), R(0),
+  /*   44 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
+                B(Star), R(3),
+                B(LdaImmutableCurrentContextSlot), U8(3),
+  /*   59 E> */ B(LdaKeyedProperty), R(this), U8(4),
+  /*   52 E> */ B(StaKeyedProperty), R(this), R(3), U8(6),
+                B(LdaUndefined),
+  /*   65 S> */ B(Return),
+]
+constant pool: [
+  SYMBOL_TYPE,
+]
+handlers: [
+]
+
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateMethodAccess.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateMethodAccess.golden
index cd5dd6f5a62..3b095a44346 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateMethodAccess.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateMethodAccess.golden
@@ -21,14 +21,14 @@ frame size: 4
 parameter count: 1
 bytecode array length: 30
 bytecodes: [
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaImmutableCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
                 B(Mov), R(context), R(2),
   /*   44 E> */ B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
-  /*   49 S> */ B(LdaCurrentContextSlot), U8(3),
+  /*   49 S> */ B(LdaImmutableCurrentContextSlot), U8(3),
   /*   61 E> */ B(LdaKeyedProperty), R(this), U8(0),
-                B(LdaCurrentContextSlot), U8(2),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(3),
   /*   63 E> */ B(CallAnyReceiver), R(3), R(this), U8(1), U8(2),
   /*   66 S> */ B(Return),
@@ -52,12 +52,12 @@ frame size: 5
 parameter count: 1
 bytecode array length: 31
 bytecodes: [
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaImmutableCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
                 B(Mov), R(context), R(2),
   /*   44 E> */ B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
-  /*   49 S> */ B(Wide), B(LdaSmi), I16(264),
+  /*   49 S> */ B(Wide), B(LdaSmi), I16(263),
                 B(Star), R(3),
                 B(LdaConstant), U8(0),
                 B(Star), R(4),
@@ -84,12 +84,12 @@ frame size: 5
 parameter count: 1
 bytecode array length: 31
 bytecodes: [
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaImmutableCurrentContextSlot), U8(3),
                 B(Star), R(1),
                 B(Mov), R(this), R(0),
                 B(Mov), R(context), R(2),
   /*   44 E> */ B(CallRuntime), U16(Runtime::kAddPrivateBrand), R(0), U8(3),
-  /*   49 S> */ B(Wide), B(LdaSmi), I16(264),
+  /*   49 S> */ B(Wide), B(LdaSmi), I16(263),
                 B(Star), R(3),
                 B(LdaConstant), U8(0),
                 B(Star), R(4),
@@ -120,7 +120,7 @@ bytecodes: [
                 B(PushContext), R(0),
                 B(Ldar), R(this),
                 B(StaCurrentContextSlot), U8(2),
-                B(LdaContextSlot), R(0), U8(3), U8(0),
+                B(LdaImmutableContextSlot), R(0), U8(3), U8(0),
                 B(Star), R(2),
                 B(Mov), R(this), R(1),
                 B(Mov), R(0), R(3),
@@ -129,9 +129,9 @@ bytecodes: [
                 B(Star), R(5),
   /*   61 E> */ B(CallUndefinedReceiver0), R(5), U8(0),
                 B(Star), R(5),
-                B(LdaContextSlot), R(0), U8(3), U8(0),
+                B(LdaImmutableContextSlot), R(0), U8(3), U8(0),
   /*   63 E> */ B(LdaKeyedProperty), R(5), U8(2),
-                B(LdaContextSlot), R(0), U8(2), U8(0),
+                B(LdaImmutableContextSlot), R(0), U8(2), U8(0),
                 B(Star), R(4),
   /*   66 E> */ B(CallAnyReceiver), R(4), R(5), U8(1), U8(4),
                 B(LdaUndefined),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticPrivateMethodAccess.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticPrivateMethodAccess.golden
index 352ec83961d..13e0ef019a9 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticPrivateMethodAccess.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticPrivateMethodAccess.golden
@@ -25,13 +25,13 @@ bytecodes: [
                 B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(1),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(262),
+                B(Wide), B(LdaSmi), I16(261),
                 B(Star), R(2),
                 B(LdaConstant), U8(0),
                 B(Star), R(3),
                 B(CallRuntime), U16(Runtime::kNewTypeError), R(2), U8(2),
                 B(Throw),
-                B(LdaCurrentContextSlot), U8(2),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(0),
   /*   70 E> */ B(CallAnyReceiver), R(0), R(1), U8(1), U8(0),
   /*   73 S> */ B(Return),
@@ -56,7 +56,7 @@ frame size: 2
 parameter count: 1
 bytecode array length: 16
 bytecodes: [
-  /*   56 S> */ B(Wide), B(LdaSmi), I16(264),
+  /*   56 S> */ B(Wide), B(LdaSmi), I16(263),
                 B(Star), R(0),
                 B(LdaConstant), U8(0),
                 B(Star), R(1),
@@ -83,7 +83,7 @@ frame size: 2
 parameter count: 1
 bytecode array length: 16
 bytecodes: [
-  /*   56 S> */ B(Wide), B(LdaSmi), I16(264),
+  /*   56 S> */ B(Wide), B(LdaSmi), I16(263),
                 B(Star), R(0),
                 B(LdaConstant), U8(0),
                 B(Star), R(1),
@@ -116,13 +116,13 @@ frame size: 5
 parameter count: 1
 bytecode array length: 142
 bytecodes: [
-  /*   90 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   90 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(1),
                 B(LdaCurrentContextSlot), U8(3),
   /*   94 E> */ B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(0),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(262),
+                B(Wide), B(LdaSmi), I16(261),
                 B(Star), R(2),
                 B(LdaConstant), U8(0),
                 B(Star), R(3),
@@ -138,13 +138,13 @@ bytecodes: [
                 B(CallProperty1), R(3), R(0), R(2), U8(3),
   /*  105 S> */ B(LdaSmi), I8(1),
                 B(Star), R(0),
-                B(LdaCurrentContextSlot), U8(2),
+                B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(2),
                 B(LdaCurrentContextSlot), U8(3),
   /*  109 E> */ B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(1),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(263),
+                B(Wide), B(LdaSmi), I16(262),
                 B(Star), R(3),
                 B(LdaConstant), U8(0),
                 B(Star), R(4),
@@ -153,13 +153,13 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kLoadPrivateSetter), R(2), U8(1),
                 B(Star), R(3),
                 B(CallProperty1), R(3), R(1), R(0), U8(5),
-  /*  122 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*  122 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star), R(1),
                 B(LdaCurrentContextSlot), U8(3),
   /*  133 E> */ B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(0),
                 B(JumpIfTrue), U8(18),
-                B(Wide), B(LdaSmi), I16(262),
+                B(Wide), B(LdaSmi), I16(261),
                 B(Star), R(2),
                 B(LdaConstant), U8(0),
                 B(Star), R(3),
@@ -189,7 +189,7 @@ frame size: 2
 parameter count: 1
 bytecode array length: 16
 bytecodes: [
-  /*   60 S> */ B(Wide), B(LdaSmi), I16(266),
+  /*   60 S> */ B(Wide), B(LdaSmi), I16(265),
                 B(Star), R(0),
                 B(LdaConstant), U8(0),
                 B(Star), R(1),
@@ -215,7 +215,7 @@ frame size: 2
 parameter count: 1
 bytecode array length: 16
 bytecodes: [
-  /*   53 S> */ B(Wide), B(LdaSmi), I16(265),
+  /*   53 S> */ B(Wide), B(LdaSmi), I16(264),
                 B(Star), R(0),
                 B(LdaConstant), U8(0),
                 B(Star), R(1),
@@ -241,7 +241,7 @@ frame size: 2
 parameter count: 1
 bytecode array length: 16
 bytecodes: [
-  /*   60 S> */ B(Wide), B(LdaSmi), I16(266),
+  /*   60 S> */ B(Wide), B(LdaSmi), I16(265),
                 B(Star), R(0),
                 B(LdaConstant), U8(0),
                 B(Star), R(1),
@@ -267,7 +267,7 @@ frame size: 3
 parameter count: 1
 bytecode array length: 16
 bytecodes: [
-  /*   46 S> */ B(Wide), B(LdaSmi), I16(265),
+  /*   46 S> */ B(Wide), B(LdaSmi), I16(264),
                 B(Star), R(1),
                 B(LdaConstant), U8(0),
                 B(Star), R(2),
diff --git a/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc b/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc
index b883753dc5a..13410c916c7 100644
--- a/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc
+++ b/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc
@@ -2756,6 +2756,42 @@ TEST(PrivateClassFields) {
                      LoadGolden("PrivateClassFields.golden")));
 }
 
+TEST(PrivateClassFieldAccess) {
+  InitializedIgnitionHandleScope scope;
+  BytecodeExpectationsPrinter printer(CcTest::isolate());
+  printer.set_wrap(false);
+  printer.set_test_function_name("test");
+
+  const char* snippets[] = {
+      "class A {\n"
+      "  #a;\n"
+      "  #b;\n"
+      "  constructor() {\n"
+      "    this.#a = this.#b;\n"
+      "  }\n"
+      "}\n"
+      "\n"
+      "var test = A;\n"
+      "new test;\n",
+
+      "class B {\n"
+      "  #a;\n"
+      "  #b;\n"
+      "  constructor() {\n"
+      "    this.#a = this.#b;\n"
+      "  }\n"
+      "  force(str) {\n"
+      "    eval(str);\n"
+      "  }\n"
+      "}\n"
+      "\n"
+      "var test = B;\n"
+      "new test;\n"};
+
+  CHECK(CompareTexts(BuildActual(printer, snippets),
+                     LoadGolden("PrivateClassFieldAccess.golden")));
+}
+
 TEST(PrivateMethodDeclaration) {
   bool old_methods_flag = i::FLAG_harmony_private_methods;
   i::FLAG_harmony_private_methods = true;
diff --git a/deps/v8/test/cctest/interpreter/test-interpreter.cc b/deps/v8/test/cctest/interpreter/test-interpreter.cc
index 33daf581c7c..af899f08529 100644
--- a/deps/v8/test/cctest/interpreter/test-interpreter.cc
+++ b/deps/v8/test/cctest/interpreter/test-interpreter.cc
@@ -522,6 +522,7 @@ TEST(InterpreterStringAdd) {
       {ast_factory.GetOneByteString(""), LiteralForTest(2.5),
        factory->NewStringFromStaticChars("2.5"), BinaryOperationFeedback::kAny},
   };
+  ast_factory.Internalize(isolate);
 
   for (size_t i = 0; i < arraysize(test_cases); i++) {
     FeedbackVectorSpec feedback_spec(zone);
@@ -534,7 +535,6 @@ TEST(InterpreterStringAdd) {
     builder.LoadLiteral(test_cases[i].lhs).StoreAccumulatorInRegister(reg);
     LoadLiteralForTest(&builder, test_cases[i].rhs);
     builder.BinaryOperation(Token::Value::ADD, reg, GetIndex(slot)).Return();
-    ast_factory.Internalize(isolate);
     Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
     InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -744,6 +744,7 @@ TEST(InterpreterBinaryOpTypeFeedback) {
       {Token::Value::MOD, LiteralForTest(3),
        LiteralForTest(ast_factory.GetOneByteString("-2")),
        Handle<Smi>(Smi::FromInt(1), isolate), BinaryOperationFeedback::kAny}};
+  ast_factory.Internalize(isolate);
 
   for (const BinaryOpExpectation& test_case : kTestCases) {
     i::FeedbackVectorSpec feedback_spec(zone);
@@ -760,7 +761,6 @@ TEST(InterpreterBinaryOpTypeFeedback) {
     LoadLiteralForTest(&builder, test_case.arg2);
     builder.BinaryOperation(test_case.op, reg, GetIndex(slot0)).Return();
 
-    ast_factory.Internalize(isolate);
     Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
     InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -849,6 +849,7 @@ TEST(InterpreterBinaryOpSmiTypeFeedback) {
        Handle<Smi>(Smi::zero(), isolate), BinaryOperationFeedback::kNumber},
       {Token::Value::SAR, LiteralForTest(ast_factory.GetOneByteString("2")), 1,
        Handle<Smi>(Smi::FromInt(1), isolate), BinaryOperationFeedback::kAny}};
+  ast_factory.Internalize(isolate);
 
   for (const BinaryOpExpectation& test_case : kTestCases) {
     i::FeedbackVectorSpec feedback_spec(zone);
@@ -866,7 +867,6 @@ TEST(InterpreterBinaryOpSmiTypeFeedback) {
         .BinaryOperation(test_case.op, reg, GetIndex(slot0))
         .Return();
 
-    ast_factory.Internalize(isolate);
     Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
 
     InterpreterTester tester(isolate, bytecode_array, metadata);
@@ -1358,8 +1358,6 @@ TEST(InterpreterCall) {
   Isolate* isolate = handles.main_isolate();
   Zone* zone = handles.main_zone();
   Factory* factory = isolate->factory();
-  AstValueFactory ast_factory(zone, isolate->ast_string_constants(),
-                              HashSeed(isolate));
 
   FeedbackVectorSpec feedback_spec(zone);
   FeedbackSlot slot = feedback_spec.AddLoadICSlot();
@@ -1371,10 +1369,12 @@ TEST(InterpreterCall) {
   int call_slot_index = -1;
   call_slot_index = GetIndex(call_slot);
 
-  const AstRawString* name = ast_factory.GetOneByteString("func");
-
   // Check with no args.
   {
+    AstValueFactory ast_factory(zone, isolate->ast_string_constants(),
+                                HashSeed(isolate));
+    const AstRawString* name = ast_factory.GetOneByteString("func");
+
     BytecodeArrayBuilder builder(zone, 1, 1, &feedback_spec);
     Register reg = builder.register_allocator()->NewRegister();
     RegisterList args = builder.register_allocator()->NewRegisterList(1);
@@ -1399,6 +1399,10 @@ TEST(InterpreterCall) {
 
   // Check that receiver is passed properly.
   {
+    AstValueFactory ast_factory(zone, isolate->ast_string_constants(),
+                                HashSeed(isolate));
+    const AstRawString* name = ast_factory.GetOneByteString("func");
+
     BytecodeArrayBuilder builder(zone, 1, 1, &feedback_spec);
     Register reg = builder.register_allocator()->NewRegister();
     RegisterList args = builder.register_allocator()->NewRegisterList(1);
@@ -1424,6 +1428,10 @@ TEST(InterpreterCall) {
 
   // Check with two parameters (+ receiver).
   {
+    AstValueFactory ast_factory(zone, isolate->ast_string_constants(),
+                                HashSeed(isolate));
+    const AstRawString* name = ast_factory.GetOneByteString("func");
+
     BytecodeArrayBuilder builder(zone, 1, 4, &feedback_spec);
     Register reg = builder.register_allocator()->NewRegister();
     RegisterList args = builder.register_allocator()->NewRegisterList(3);
@@ -1457,6 +1465,10 @@ TEST(InterpreterCall) {
 
   // Check with 10 parameters (+ receiver).
   {
+    AstValueFactory ast_factory(zone, isolate->ast_string_constants(),
+                                HashSeed(isolate));
+    const AstRawString* name = ast_factory.GetOneByteString("func");
+
     BytecodeArrayBuilder builder(zone, 1, 12, &feedback_spec);
     Register reg = builder.register_allocator()->NewRegister();
     RegisterList args = builder.register_allocator()->NewRegisterList(11);
@@ -2075,7 +2087,6 @@ TEST(InterpreterMixedComparisons) {
                 LoadStringAndAddSpace(&builder, &ast_factory, rhs_cstr,
                                       string_add_slot);
               }
-              break;
             } else {
               CHECK_EQ(which_side, kLhsIsString);
               // Comparison with String on the lhs and HeapNumber on the rhs.
@@ -2109,9 +2120,19 @@ TEST(InterpreterMixedComparisons) {
             if (tester.HasFeedbackMetadata()) {
               MaybeObject feedback = callable.vector().Get(slot);
               CHECK(feedback->IsSmi());
-              // Comparison with a number and string collects kAny feedback.
-              CHECK_EQ(CompareOperationFeedback::kAny,
-                       feedback->ToSmi().value());
+              if (kComparisonTypes[c] == Token::Value::EQ) {
+                // For sloppy equality, we have more precise feedback.
+                CHECK_EQ(
+                    CompareOperationFeedback::kNumber |
+                        (string_type == kInternalizedStringConstant
+                             ? CompareOperationFeedback::kInternalizedString
+                             : CompareOperationFeedback::kString),
+                    feedback->ToSmi().value());
+              } else {
+                // Comparison with a number and string collects kAny feedback.
+                CHECK_EQ(CompareOperationFeedback::kAny,
+                         feedback->ToSmi().value());
+              }
             }
           }
         }
@@ -2286,14 +2307,15 @@ TEST(InterpreterTestIn) {
   Isolate* isolate = handles.main_isolate();
   Zone* zone = handles.main_zone();
   Factory* factory = isolate->factory();
-  AstValueFactory ast_factory(zone, isolate->ast_string_constants(),
-                              HashSeed(isolate));
   // Allocate an array
   Handle<i::JSArray> array =
       factory->NewJSArray(0, i::ElementsKind::PACKED_SMI_ELEMENTS);
   // Check for these properties on the array object
   const char* properties[] = {"length", "fuzzle", "x", "0"};
   for (size_t i = 0; i < arraysize(properties); i++) {
+    AstValueFactory ast_factory(zone, isolate->ast_string_constants(),
+                                HashSeed(isolate));
+
     bool expected_value = (i == 0);
     FeedbackVectorSpec feedback_spec(zone);
     BytecodeArrayBuilder builder(zone, 1, 1, &feedback_spec);
@@ -2363,6 +2385,7 @@ TEST(InterpreterUnaryNotNonBoolean) {
                      false),
       std::make_pair(LiteralForTest(ast_factory.GetOneByteString("")), true),
   };
+  ast_factory.Internalize(isolate);
 
   for (size_t i = 0; i < arraysize(object_type_tuples); i++) {
     BytecodeArrayBuilder builder(zone, 1, 0);
@@ -2370,7 +2393,6 @@ TEST(InterpreterUnaryNotNonBoolean) {
     Register r0(0);
     LoadLiteralForTest(&builder, object_type_tuples[i].first);
     builder.LogicalNot(ToBooleanMode::kConvertToBoolean).Return();
-    ast_factory.Internalize(isolate);
     Handle<BytecodeArray> bytecode_array = builder.ToBytecodeArray(isolate);
     InterpreterTester tester(isolate, bytecode_array);
     auto callable = tester.GetCallable<>();
@@ -5029,7 +5051,7 @@ TEST(InterpreterGenerators) {
   }
 }
 
-#if !defined(V8_TARGET_ARCH_ARM) && !defined(V8_TARGET_ARCH_S390X)
+#ifndef V8_TARGET_ARCH_ARM
 TEST(InterpreterWithNativeStack) {
   i::FLAG_interpreted_frames_native_stack = true;
 
@@ -5051,7 +5073,7 @@ TEST(InterpreterWithNativeStack) {
   CHECK(code.is_interpreter_trampoline_builtin());
   CHECK_NE(code.address(), interpreter_entry_trampoline->address());
 }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_S390X
+#endif  // V8_TARGET_ARCH_ARM
 
 TEST(InterpreterGetBytecodeHandler) {
   HandleAndZoneScope handles;
diff --git a/deps/v8/test/cctest/libplatform/test-tracing.cc b/deps/v8/test/cctest/libplatform/test-tracing.cc
index 1f1cb55f9ba..77c7c5744e1 100644
--- a/deps/v8/test/cctest/libplatform/test-tracing.cc
+++ b/deps/v8/test/cctest/libplatform/test-tracing.cc
@@ -11,23 +11,9 @@
 
 #ifdef V8_USE_PERFETTO
 #include "perfetto/tracing.h"
-#include "protos/perfetto/trace/chrome/chrome_trace_event.pb.h"
-#include "protos/perfetto/trace/chrome/chrome_trace_event.pbzero.h"
-#include "protos/perfetto/trace/chrome/chrome_trace_packet.pb.h"
 #include "protos/perfetto/trace/trace.pb.h"
-#include "src/libplatform/tracing/json-trace-event-listener.h"
 #include "src/libplatform/tracing/trace-event-listener.h"
-#endif  // V8_USE_PERFETTO
-
-#ifdef V8_USE_PERFETTO
-class TestDataSource : public perfetto::DataSource<TestDataSource> {
- public:
-  void OnSetup(const SetupArgs&) override {}
-  void OnStart(const StartArgs&) override {}
-  void OnStop(const StopArgs&) override {}
-};
-
-PERFETTO_DEFINE_DATA_SOURCE_STATIC_MEMBERS(TestDataSource);
+#include "src/tracing/traced-value.h"
 #endif  // V8_USE_PERFETTO
 
 namespace v8 {
@@ -44,7 +30,6 @@ TEST(TestTraceConfig) {
   CHECK_EQ(trace_config->IsArgumentFilterEnabled(), false);
   CHECK_EQ(trace_config->IsCategoryGroupEnabled("v8"), true);
   CHECK_EQ(trace_config->IsCategoryGroupEnabled("v8.cpu_profile"), false);
-  CHECK_EQ(trace_config->IsCategoryGroupEnabled("v8.cpu_profile.hires"), false);
   CHECK_EQ(trace_config->IsCategoryGroupEnabled(
                TRACE_DISABLED_BY_DEFAULT("v8.runtime")),
            true);
@@ -52,13 +37,13 @@ TEST(TestTraceConfig) {
   CHECK_EQ(
       trace_config->IsCategoryGroupEnabled("v8,disabled-by-default-v8.runtime"),
       true);
-  CHECK_EQ(trace_config->IsCategoryGroupEnabled(
-               "v8_cpu_profile,v8.cpu_profile.hires"),
-           false);
+  CHECK_EQ(trace_config->IsCategoryGroupEnabled("v8_cpu_profile"), false);
 
   delete trace_config;
 }
 
+// Perfetto doesn't use TraceObject.
+#if !defined(V8_USE_PERFETTO)
 TEST(TestTraceObject) {
   TraceObject trace_object;
   uint8_t category_enabled_flag = 41;
@@ -101,7 +86,10 @@ class MockTraceWriter : public TraceWriter {
  private:
   std::vector<std::string> events_;
 };
+#endif  // !defined(V8_USE_PERFETTO)
 
+// Perfetto doesn't use the ring buffer.
+#if !defined(V8_USE_PERFETTO)
 TEST(TestTraceBufferRingBuffer) {
   // We should be able to add kChunkSize * 2 + 1 trace events.
   const int HANDLES_COUNT = TraceBufferChunk::kChunkSize * 2 + 1;
@@ -151,7 +139,10 @@ TEST(TestTraceBufferRingBuffer) {
   }
   delete ring_buffer;
 }
+#endif  // !defined(V8_USE_PERFETTO)
 
+// Perfetto has an internal JSON exporter.
+#if !defined(V8_USE_PERFETTO)
 void PopulateJSONWriter(TraceWriter* writer) {
   v8::Platform* old_platform = i::V8::GetCurrentPlatform();
   std::unique_ptr<v8::Platform> default_platform(
@@ -165,10 +156,6 @@ void PopulateJSONWriter(TraceWriter* writer) {
   TraceBuffer* ring_buffer =
       TraceBuffer::CreateTraceBufferRingBuffer(1, writer);
   tracing_controller->Initialize(ring_buffer);
-#ifdef V8_USE_PERFETTO
-  std::ostringstream sstream;
-  tracing_controller->InitializeForPerfetto(&sstream);
-#endif
   TraceConfig* trace_config = new TraceConfig();
   trace_config->AddIncludedCategory("v8-cat");
   tracing_controller->StartTracing(trace_config);
@@ -220,6 +207,7 @@ TEST(TestJSONTraceWriterWithCustomtag) {
 
   CHECK_EQ(expected_trace_str, trace_str);
 }
+#endif  // !defined(V8_USE_PERFETTO)
 
 void GetJSONStrings(std::vector<std::string>* ret, const std::string& str,
                     const std::string& param, const std::string& start_delim,
@@ -235,7 +223,8 @@ void GetJSONStrings(std::vector<std::string>* ret, const std::string& str,
   }
 }
 
-#ifndef V8_USE_PERFETTO
+// With Perfetto the tracing controller doesn't observe events.
+#if !defined(V8_USE_PERFETTO)
 TEST(TestTracingController) {
   v8::Platform* old_platform = i::V8::GetCurrentPlatform();
   std::unique_ptr<v8::Platform> default_platform(
@@ -251,10 +240,6 @@ TEST(TestTracingController) {
   TraceBuffer* ring_buffer =
       TraceBuffer::CreateTraceBufferRingBuffer(1, writer);
   tracing_controller->Initialize(ring_buffer);
-#ifdef V8_USE_PERFETTO
-  std::ostringstream sstream;
-  tracing_controller->InitializeForPerfetto(&sstream);
-#endif
   TraceConfig* trace_config = new TraceConfig();
   trace_config->AddIncludedCategory("v8");
   tracing_controller->StartTracing(trace_config);
@@ -311,9 +296,6 @@ TEST(TestTracingControllerMultipleArgsAndCopy) {
     TraceBuffer* ring_buffer =
         TraceBuffer::CreateTraceBufferRingBuffer(1, writer);
     tracing_controller->Initialize(ring_buffer);
-#ifdef V8_USE_PERFETTO
-    tracing_controller->InitializeForPerfetto(&perfetto_stream);
-#endif
     TraceConfig* trace_config = new TraceConfig();
     trace_config->AddIncludedCategory("v8");
     tracing_controller->StartTracing(trace_config);
@@ -402,7 +384,7 @@ TEST(TestTracingControllerMultipleArgsAndCopy) {
   CHECK_EQ(all_args[22], "\"a1\":[42,42]");
   CHECK_EQ(all_args[23], "\"a1\":[42,42],\"a2\":[123,123]");
 }
-#endif  // !V8_USE_PERFETTO
+#endif  // !defined(V8_USE_PERFETTO)
 
 namespace {
 
@@ -427,14 +409,15 @@ TEST(TracingObservers) {
   v8::platform::tracing::TracingController* tracing_controller = tracing.get();
   static_cast<v8::platform::DefaultPlatform*>(default_platform.get())
       ->SetTracingController(std::move(tracing));
+#ifdef V8_USE_PERFETTO
+  std::ostringstream sstream;
+  tracing_controller->InitializeForPerfetto(&sstream);
+#else
   MockTraceWriter* writer = new MockTraceWriter();
   v8::platform::tracing::TraceBuffer* ring_buffer =
       v8::platform::tracing::TraceBuffer::CreateTraceBufferRingBuffer(1,
                                                                       writer);
   tracing_controller->Initialize(ring_buffer);
-#ifdef V8_USE_PERFETTO
-  std::ostringstream sstream;
-  tracing_controller->InitializeForPerfetto(&sstream);
 #endif
   v8::platform::tracing::TraceConfig* trace_config =
       new v8::platform::tracing::TraceConfig();
@@ -484,6 +467,8 @@ TEST(TracingObservers) {
   i::V8::SetPlatformForTesting(old_platform);
 }
 
+// With Perfetto the tracing controller doesn't observe events.
+#if !defined(V8_USE_PERFETTO)
 class TraceWritingThread : public base::Thread {
  public:
   TraceWritingThread(
@@ -525,10 +510,6 @@ TEST(AddTraceEventMultiThreaded) {
   TraceBuffer* ring_buffer =
       TraceBuffer::CreateTraceBufferRingBuffer(1, writer);
   tracing_controller->Initialize(ring_buffer);
-#ifdef V8_USE_PERFETTO
-  std::ostringstream sstream;
-  tracing_controller->InitializeForPerfetto(&sstream);
-#endif
   TraceConfig* trace_config = new TraceConfig();
   trace_config->AddIncludedCategory("v8");
   tracing_controller->StartTracing(trace_config);
@@ -546,26 +527,110 @@ TEST(AddTraceEventMultiThreaded) {
 
   i::V8::SetPlatformForTesting(old_platform);
 }
+#endif  // !defined(V8_USE_PERFETTO)
 
 #ifdef V8_USE_PERFETTO
 
-using TraceEvent = ::perfetto::protos::ChromeTraceEvent;
+using TrackEvent = ::perfetto::protos::TrackEvent;
 
 class TestListener : public TraceEventListener {
  public:
   void ProcessPacket(const ::perfetto::protos::TracePacket& packet) {
-    for (const ::perfetto::protos::ChromeTraceEvent& event :
-         packet.chrome_events().trace_events()) {
-      events_.push_back(event);
+    if (packet.incremental_state_cleared()) {
+      categories_.clear();
+      event_names_.clear();
+      debug_annotation_names_.clear();
     }
+
+    if (!packet.has_track_event()) return;
+
+    // Update incremental state.
+    if (packet.has_interned_data()) {
+      const auto& interned_data = packet.interned_data();
+      for (const auto& it : interned_data.event_categories()) {
+        CHECK_EQ(categories_.find(it.iid()), categories_.end());
+        categories_[it.iid()] = it.name();
+      }
+      for (const auto& it : interned_data.event_names()) {
+        CHECK_EQ(event_names_.find(it.iid()), event_names_.end());
+        event_names_[it.iid()] = it.name();
+      }
+      for (const auto& it : interned_data.debug_annotation_names()) {
+        CHECK_EQ(debug_annotation_names_.find(it.iid()),
+                 debug_annotation_names_.end());
+        debug_annotation_names_[it.iid()] = it.name();
+      }
+    }
+    const auto& track_event = packet.track_event();
+    std::string slice;
+    switch (track_event.type()) {
+      case perfetto::protos::TrackEvent::TYPE_SLICE_BEGIN:
+        slice += "B";
+        break;
+      case perfetto::protos::TrackEvent::TYPE_SLICE_END:
+        slice += "E";
+        break;
+      case perfetto::protos::TrackEvent::TYPE_INSTANT:
+        slice += "I";
+        break;
+      default:
+      case perfetto::protos::TrackEvent::TYPE_UNSPECIFIED:
+        CHECK(false);
+    }
+    slice += ":" +
+             (track_event.category_iids_size()
+                  ? categories_[track_event.category_iids().Get(0)]
+                  : "") +
+             ".";
+    if (track_event.name_iid()) {
+      slice += event_names_[track_event.name_iid()];
+    } else {
+      slice += track_event.name();
+    }
+
+    if (track_event.debug_annotations_size()) {
+      slice += "(";
+      bool first_annotation = true;
+      for (const auto& it : track_event.debug_annotations()) {
+        if (!first_annotation) {
+          slice += ",";
+        }
+        slice += debug_annotation_names_[it.name_iid()] + "=";
+        std::stringstream value;
+        if (it.has_bool_value()) {
+          value << "(bool)" << it.bool_value();
+        } else if (it.has_uint_value()) {
+          value << "(uint)" << it.uint_value();
+        } else if (it.has_int_value()) {
+          value << "(int)" << it.int_value();
+        } else if (it.has_double_value()) {
+          value << "(double)" << it.double_value();
+        } else if (it.has_string_value()) {
+          value << "(string)" << it.string_value();
+        } else if (it.has_pointer_value()) {
+          value << "(pointer)0x" << std::hex << it.pointer_value();
+        } else if (it.has_legacy_json_value()) {
+          value << "(json)" << it.legacy_json_value();
+        } else if (it.has_nested_value()) {
+          value << "(nested)" << it.nested_value().string_value();
+        }
+        slice += value.str();
+        first_annotation = false;
+      }
+      slice += ")";
+    }
+    events_.push_back(slice);
   }
 
-  TraceEvent* get_event(size_t index) { return &events_.at(index); }
+  const std::string& get_event(size_t index) { return events_.at(index); }
 
   size_t events_size() const { return events_.size(); }
 
  private:
-  std::vector<TraceEvent> events_;
+  std::vector<std::string> events_;
+  std::map<uint64_t, std::string> categories_;
+  std::map<uint64_t, std::string> event_names_;
+  std::map<uint64_t, std::string> debug_annotation_names_;
 };
 
 class TracingTestHarness {
@@ -592,9 +657,14 @@ class TracingTestHarness {
     tracing_controller_->StartTracing(trace_config);
   }
 
-  void StopTracing() { tracing_controller_->StopTracing(); }
+  void StopTracing() {
+    v8::TrackEvent::Flush();
+    tracing_controller_->StopTracing();
+  }
 
-  TraceEvent* get_event(size_t index) { return listener_.get_event(index); }
+  const std::string& get_event(size_t index) {
+    return listener_.get_event(index);
+  }
   size_t events_size() const { return listener_.events_size(); }
 
   std::string perfetto_json_stream() { return perfetto_json_stream_.str(); }
@@ -622,49 +692,13 @@ TEST(Perfetto) {
 
   harness.StopTracing();
 
-  TraceEvent* event = harness.get_event(0);
-  int32_t thread_id = event->thread_id();
-  int32_t process_id = event->process_id();
-  CHECK_EQ("test1", event->name());
-  CHECK_EQ(TRACE_EVENT_PHASE_BEGIN, event->phase());
-  int64_t timestamp = event->timestamp();
-
-  event = harness.get_event(1);
-  CHECK_EQ("test2", event->name());
-  CHECK_EQ(TRACE_EVENT_PHASE_BEGIN, event->phase());
-  CHECK_EQ(thread_id, event->thread_id());
-  CHECK_EQ(process_id, event->process_id());
-  CHECK_GE(event->timestamp(), timestamp);
-  timestamp = event->timestamp();
-
-  event = harness.get_event(2);
-  CHECK_EQ("test3", event->name());
-  CHECK_EQ(TRACE_EVENT_PHASE_BEGIN, event->phase());
-  CHECK_EQ(thread_id, event->thread_id());
-  CHECK_EQ(process_id, event->process_id());
-  CHECK_GE(event->timestamp(), timestamp);
-  timestamp = event->timestamp();
-
-  event = harness.get_event(3);
-  CHECK_EQ(TRACE_EVENT_PHASE_END, event->phase());
-  CHECK_EQ(thread_id, event->thread_id());
-  CHECK_EQ(process_id, event->process_id());
-  CHECK_GE(event->timestamp(), timestamp);
-  timestamp = event->timestamp();
-
-  event = harness.get_event(4);
-  CHECK_EQ(TRACE_EVENT_PHASE_END, event->phase());
-  CHECK_EQ(thread_id, event->thread_id());
-  CHECK_EQ(process_id, event->process_id());
-  CHECK_GE(event->timestamp(), timestamp);
-  timestamp = event->timestamp();
-
-  event = harness.get_event(5);
-  CHECK_EQ(TRACE_EVENT_PHASE_END, event->phase());
-  CHECK_EQ(thread_id, event->thread_id());
-  CHECK_EQ(process_id, event->process_id());
-  CHECK_GE(event->timestamp(), timestamp);
-  timestamp = event->timestamp();
+  CHECK_EQ("B:v8.test1", harness.get_event(0));
+  CHECK_EQ("B:v8.test2(arg1=(uint)1024)", harness.get_event(1));
+  CHECK_EQ("B:v8.test3(arg1=(uint)1024,arg2=(string)str_arg)",
+           harness.get_event(2));
+  CHECK_EQ("E:.", harness.get_event(3));
+  CHECK_EQ("E:.", harness.get_event(4));
+  CHECK_EQ("E:.", harness.get_event(5));
 
   CHECK_EQ(6, harness.events_size());
 }
@@ -684,10 +718,10 @@ TEST(Categories) {
   harness.StopTracing();
 
   CHECK_EQ(4, harness.events_size());
-  TraceEvent* event = harness.get_event(0);
-  CHECK_EQ("v8.Test", event->name());
-  event = harness.get_event(1);
-  CHECK_EQ("v8.Test3", event->name());
+  CHECK_EQ("B:v8.v8.Test", harness.get_event(0));
+  CHECK_EQ("B:v8.v8.Test3", harness.get_event(1));
+  CHECK_EQ("E:.", harness.get_event(2));
+  CHECK_EQ("E:.", harness.get_event(3));
 }
 
 // Replacement for 'TestTracingControllerMultipleArgsAndCopy'
@@ -747,123 +781,57 @@ TEST(MultipleArgsAndCopy) {
     mm = "CHANGED";
     mmm = "CHANGED";
 
+    auto arg = v8::tracing::TracedValue::Create();
+    arg->SetInteger("value", 42);
     TRACE_EVENT_INSTANT1("v8", "v8.Test", TRACE_EVENT_SCOPE_THREAD, "a1",
-                         new ConvertableToTraceFormatMock(42));
-    std::unique_ptr<ConvertableToTraceFormatMock> trace_event_arg(
-        new ConvertableToTraceFormatMock(42));
+                         std::move(arg));
+
+    arg = v8::tracing::TracedValue::Create();
+    arg->SetString("value", "string");
+    auto arg2 = v8::tracing::TracedValue::Create();
+    arg2->SetDouble("value", 1.23);
     TRACE_EVENT_INSTANT2("v8", "v8.Test", TRACE_EVENT_SCOPE_THREAD, "a1",
-                         std::move(trace_event_arg), "a2",
-                         new ConvertableToTraceFormatMock(123));
+                         std::move(arg), "a2", std::move(arg2));
   }
 
   harness.StopTracing();
 
-  // 20 START/END events, 4 INSTANT events.
-  CHECK_EQ(44, harness.events_size());
-  TraceEvent* event = harness.get_event(0);
-  CHECK_EQ("aa", event->args()[0].name());
-  CHECK_EQ(aa, event->args()[0].uint_value());
-
-  event = harness.get_event(1);
-  CHECK_EQ("bb", event->args()[0].name());
-  CHECK_EQ(bb, event->args()[0].uint_value());
-
-  event = harness.get_event(2);
-  CHECK_EQ("cc", event->args()[0].name());
-  CHECK_EQ(cc, event->args()[0].uint_value());
-
-  event = harness.get_event(3);
-  CHECK_EQ("dd", event->args()[0].name());
-  CHECK_EQ(dd, event->args()[0].uint_value());
-
-  event = harness.get_event(4);
-  CHECK_EQ("ee", event->args()[0].name());
-  CHECK_EQ(ee, event->args()[0].int_value());
-
-  event = harness.get_event(5);
-  CHECK_EQ("ff", event->args()[0].name());
-  CHECK_EQ(ff, event->args()[0].int_value());
-
-  event = harness.get_event(6);
-  CHECK_EQ("gg", event->args()[0].name());
-  CHECK_EQ(gg, event->args()[0].int_value());
-
-  event = harness.get_event(7);
-  CHECK_EQ("hh", event->args()[0].name());
-  CHECK_EQ(hh, event->args()[0].int_value());
-
-  event = harness.get_event(8);
-  CHECK_EQ("ii1", event->args()[0].name());
-  CHECK_EQ(ii1, event->args()[0].bool_value());
-
-  event = harness.get_event(9);
-  CHECK_EQ("ii2", event->args()[0].name());
-  CHECK_EQ(ii2, event->args()[0].bool_value());
-
-  event = harness.get_event(10);
-  CHECK_EQ("jj1", event->args()[0].name());
-  CHECK_EQ(jj1, event->args()[0].double_value());
-
-  event = harness.get_event(11);
-  CHECK_EQ("jj2", event->args()[0].name());
-  CHECK_EQ(jj2, event->args()[0].double_value());
-
-  event = harness.get_event(12);
-  CHECK_EQ("jj3", event->args()[0].name());
-  CHECK(std::isnan(event->args()[0].double_value()));
-
-  event = harness.get_event(13);
-  CHECK_EQ("jj4", event->args()[0].name());
-  CHECK_EQ(jj4, event->args()[0].double_value());
-
-  event = harness.get_event(14);
-  CHECK_EQ("jj5", event->args()[0].name());
-  CHECK_EQ(jj5, event->args()[0].double_value());
-
-  event = harness.get_event(15);
-  CHECK_EQ("kk", event->args()[0].name());
-  CHECK_EQ(kk, reinterpret_cast<void*>(event->args()[0].pointer_value()));
-
-  event = harness.get_event(16);
-  CHECK_EQ("ll", event->args()[0].name());
-  CHECK_EQ(ll, event->args()[0].string_value());
-
-  event = harness.get_event(17);
-  CHECK_EQ("mm", event->args()[0].name());
-  CHECK_EQ("\"INIT\"", event->args()[0].string_value());
-
-  event = harness.get_event(18);
-  CHECK_EQ("v8.Test2.1", event->name());
-  CHECK_EQ("aa", event->args()[0].name());
-  CHECK_EQ(aa, event->args()[0].uint_value());
-  CHECK_EQ("ll", event->args()[1].name());
-  CHECK_EQ(ll, event->args()[1].string_value());
-
-  event = harness.get_event(19);
-  CHECK_EQ("mm1", event->args()[0].name());
-  CHECK_EQ("INIT", event->args()[0].string_value());
-  CHECK_EQ("mm2", event->args()[1].name());
-  CHECK_EQ("\"INIT\"", event->args()[1].string_value());
-
-  event = harness.get_event(20);
-  CHECK_EQ("INIT", event->name());
-
-  event = harness.get_event(21);
-  CHECK_EQ("INIT", event->name());
-  CHECK_EQ("mm1", event->args()[0].name());
-  CHECK_EQ("INIT", event->args()[0].string_value());
-  CHECK_EQ("mm2", event->args()[1].name());
-  CHECK_EQ("\"INIT\"", event->args()[1].string_value());
-
-  event = harness.get_event(22);
-  CHECK_EQ("a1", event->args()[0].name());
-  CHECK_EQ("[42,42]", event->args()[0].json_value());
-
-  event = harness.get_event(23);
-  CHECK_EQ("a1", event->args()[0].name());
-  CHECK_EQ("[42,42]", event->args()[0].json_value());
-  CHECK_EQ("a2", event->args()[1].name());
-  CHECK_EQ("[123,123]", event->args()[1].json_value());
+  CHECK_EQ("B:v8.v8.Test.aa(aa=(uint)11)", harness.get_event(0));
+  CHECK_EQ("B:v8.v8.Test.bb(bb=(uint)22)", harness.get_event(1));
+  CHECK_EQ("B:v8.v8.Test.cc(cc=(uint)33)", harness.get_event(2));
+  CHECK_EQ("B:v8.v8.Test.dd(dd=(uint)44)", harness.get_event(3));
+  CHECK_EQ("B:v8.v8.Test.ee(ee=(int)-55)", harness.get_event(4));
+  CHECK_EQ("B:v8.v8.Test.ff(ff=(int)-66)", harness.get_event(5));
+  CHECK_EQ("B:v8.v8.Test.gg(gg=(int)-77)", harness.get_event(6));
+  CHECK_EQ("B:v8.v8.Test.hh(hh=(int)-88)", harness.get_event(7));
+  CHECK_EQ("B:v8.v8.Test.ii(ii1=(bool)1)", harness.get_event(8));
+  CHECK_EQ("B:v8.v8.Test.ii(ii2=(bool)0)", harness.get_event(9));
+  CHECK_EQ("B:v8.v8.Test.jj1(jj1=(double)99)", harness.get_event(10));
+  CHECK_EQ("B:v8.v8.Test.jj2(jj2=(double)1e+100)", harness.get_event(11));
+  CHECK_EQ("B:v8.v8.Test.jj3(jj3=(double)nan)", harness.get_event(12));
+  CHECK_EQ("B:v8.v8.Test.jj4(jj4=(double)inf)", harness.get_event(13));
+  CHECK_EQ("B:v8.v8.Test.jj5(jj5=(double)-inf)", harness.get_event(14));
+
+  std::ostringstream pointer_stream;
+  pointer_stream << "B:v8.v8.Test.kk(kk=(pointer)" << &aa << ")";
+  CHECK_EQ(pointer_stream.str().c_str(), harness.get_event(15));
+
+  CHECK_EQ("B:v8.v8.Test.ll(ll=(string)100)", harness.get_event(16));
+  CHECK_EQ("B:v8.v8.Test.mm(mm=(string)\"INIT\")", harness.get_event(17));
+  CHECK_EQ("B:v8.v8.Test2.1(aa=(uint)11,ll=(string)100)",
+           harness.get_event(18));
+  CHECK_EQ("B:v8.v8.Test2.2(mm1=(string)INIT,mm2=(string)\"INIT\")",
+           harness.get_event(19));
+  CHECK_EQ("I:v8.INIT", harness.get_event(20));
+  CHECK_EQ("I:v8.INIT(mm1=(string)INIT,mm2=(string)\"INIT\")",
+           harness.get_event(21));
+  CHECK_EQ("I:v8.v8.Test(a1=(json){\"value\":42})", harness.get_event(22));
+  CHECK_EQ(
+      "I:v8.v8.Test(a1=(json){\"value\":\"string\"},a2=(json){\"value\":1.23})",
+      harness.get_event(23));
+
+  // Check the terminating end events.
+  for (size_t i = 0; i < 20; i++) CHECK_EQ("E:.", harness.get_event(24 + i));
 }
 
 TEST(JsonIntegrationTest) {
@@ -895,84 +863,6 @@ TEST(JsonIntegrationTest) {
   CHECK_EQ("\"4\":\"-Infinity\"", all_args[3]);
 }
 
-TEST(TracingPerfetto) {
-  ::perfetto::TraceConfig perfetto_trace_config;
-  perfetto_trace_config.add_buffers()->set_size_kb(4096);
-  auto* ds_config = perfetto_trace_config.add_data_sources()->mutable_config();
-  ds_config->set_name("v8.trace_events");
-
-  perfetto::DataSourceDescriptor dsd;
-  dsd.set_name("v8.trace_events");
-  TestDataSource::Register(dsd);
-
-  auto tracing_session_ =
-      perfetto::Tracing::NewTrace(perfetto::BackendType::kInProcessBackend);
-  tracing_session_->Setup(perfetto_trace_config);
-  tracing_session_->StartBlocking();
-
-  for (int i = 0; i < 15; i++) {
-    TestDataSource::Trace([&](TestDataSource::TraceContext ctx) {
-      auto packet = ctx.NewTracePacket();
-      auto* trace_event_bundle = packet->set_chrome_events();
-      auto* trace_event = trace_event_bundle->add_trace_events();
-
-      trace_event->set_phase('c');
-      trace_event->set_thread_id(v8::base::OS::GetCurrentThreadId());
-      trace_event->set_timestamp(123);
-      trace_event->set_process_id(v8::base::OS::GetCurrentProcessId());
-      trace_event->set_thread_timestamp(123);
-    });
-  }
-  tracing_session_->StopBlocking();
-
-  std::ostringstream perfetto_json_stream_;
-
-  {
-    v8::platform::tracing::JSONTraceEventListener json_listener_(
-        &perfetto_json_stream_);
-
-    std::vector<char> trace = tracing_session_->ReadTraceBlocking();
-    json_listener_.ParseFromArray(trace);
-  }
-
-  printf("%s\n", perfetto_json_stream_.str().c_str());
-  CHECK_GT(perfetto_json_stream_.str().length(), 0);
-}
-
-TEST(StartAndStopRepeated) {
-  for (int i = 0; i < 3; i++) {
-    ::perfetto::TraceConfig perfetto_trace_config;
-    perfetto_trace_config.add_buffers()->set_size_kb(4096);
-    auto* ds_config =
-        perfetto_trace_config.add_data_sources()->mutable_config();
-    ds_config->set_name("v8.trace_events");
-
-    perfetto::DataSourceDescriptor dsd;
-    dsd.set_name("v8.trace_events");
-    TestDataSource::Register(dsd);
-
-    auto tracing_session_ =
-        perfetto::Tracing::NewTrace(perfetto::BackendType::kInProcessBackend);
-    tracing_session_->Setup(perfetto_trace_config);
-    tracing_session_->StartBlocking();
-
-    for (int i = 0; i < 15; i++) {
-      TestDataSource::Trace([&](TestDataSource::TraceContext ctx) {
-        auto packet = ctx.NewTracePacket();
-        auto* trace_event_bundle = packet->set_chrome_events();
-        auto* trace_event = trace_event_bundle->add_trace_events();
-
-        trace_event->set_phase('c');
-        trace_event->set_thread_id(v8::base::OS::GetCurrentThreadId());
-        trace_event->set_timestamp(123);
-        trace_event->set_process_id(v8::base::OS::GetCurrentProcessId());
-        trace_event->set_thread_timestamp(123);
-      });
-    }
-    tracing_session_->StopBlocking();
-  }
-}
-
 #endif  // V8_USE_PERFETTO
 
 }  // namespace tracing
diff --git a/deps/v8/test/cctest/parsing/test-preparser.cc b/deps/v8/test/cctest/parsing/test-preparser.cc
index da5f744f33d..7890170de89 100644
--- a/deps/v8/test/cctest/parsing/test-preparser.cc
+++ b/deps/v8/test/cctest/parsing/test-preparser.cc
@@ -707,9 +707,13 @@ TEST(PreParserScopeAnalysis) {
           shared->uncompiled_data_with_preparse_data().preparse_data(),
           isolate);
 
+      i::UnoptimizedCompileFlags flags =
+          i::UnoptimizedCompileFlags::ForFunctionCompile(isolate, *shared);
+      flags.set_is_lazy_compile(true);
+
       // Parse the lazy function using the scope data.
-      i::ParseInfo using_scope_data(isolate, *shared);
-      using_scope_data.set_lazy_compile();
+      i::UnoptimizedCompileState using_scope_state(isolate);
+      i::ParseInfo using_scope_data(isolate, flags, &using_scope_state);
       using_scope_data.set_consumed_preparse_data(
           i::ConsumedPreparseData::For(isolate, produced_data_on_heap));
       CHECK(i::parsing::ParseFunction(&using_scope_data, shared, isolate));
@@ -720,12 +724,9 @@ TEST(PreParserScopeAnalysis) {
       CHECK(i::ScopeTestHelper::HasSkippedFunctionInside(
           scope_with_skipped_functions));
 
-      // Do scope allocation (based on the preparsed scope data).
-      CHECK(i::DeclarationScope::Analyze(&using_scope_data));
-
       // Parse the lazy function again eagerly to produce baseline data.
-      i::ParseInfo not_using_scope_data(isolate, *shared);
-      not_using_scope_data.set_lazy_compile();
+      i::UnoptimizedCompileState not_using_scope_state(isolate);
+      i::ParseInfo not_using_scope_data(isolate, flags, &not_using_scope_state);
       CHECK(i::parsing::ParseFunction(&not_using_scope_data, shared, isolate));
 
       // Verify that we didn't skip anything (there's no preparsed scope data,
@@ -735,9 +736,6 @@ TEST(PreParserScopeAnalysis) {
       CHECK(!i::ScopeTestHelper::HasSkippedFunctionInside(
           scope_without_skipped_functions));
 
-      // Do normal scope allocation.
-      CHECK(i::DeclarationScope::Analyze(&not_using_scope_data));
-
       // Verify that scope allocation gave the same results when parsing w/ the
       // scope data (and skipping functions), and when parsing without.
       i::ScopeTestHelper::CompareScopes(
@@ -759,7 +757,10 @@ TEST(Regress753896) {
   i::Handle<i::String> source = factory->InternalizeUtf8String(
       "function lazy() { let v = 0; if (true) { var v = 0; } }");
   i::Handle<i::Script> script = factory->NewScript(source);
-  i::ParseInfo info(isolate, *script);
+  i::UnoptimizedCompileState state(isolate);
+  i::UnoptimizedCompileFlags flags =
+      i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+  i::ParseInfo info(isolate, flags, &state);
 
   // We don't assert that parsing succeeded or that it failed; currently the
   // error is not detected inside lazy functions, but it might be in the future.
diff --git a/deps/v8/test/cctest/parsing/test-scanner.cc b/deps/v8/test/cctest/parsing/test-scanner.cc
index 9451d61d899..7fb670e017a 100644
--- a/deps/v8/test/cctest/parsing/test-scanner.cc
+++ b/deps/v8/test/cctest/parsing/test-scanner.cc
@@ -7,6 +7,7 @@
 
 #include "src/handles/handles-inl.h"
 #include "src/objects/objects-inl.h"
+#include "src/parsing/parse-info.h"
 #include "src/parsing/scanner-character-streams.h"
 #include "src/parsing/scanner.h"
 #include "test/cctest/cctest.h"
@@ -34,8 +35,9 @@ struct ScannerTestHelper {
 ScannerTestHelper make_scanner(const char* src) {
   ScannerTestHelper helper;
   helper.stream = ScannerStream::ForTesting(src);
-  helper.scanner =
-      std::unique_ptr<Scanner>(new Scanner(helper.stream.get(), false));
+  helper.scanner = std::unique_ptr<Scanner>(
+      new Scanner(helper.stream.get(),
+                  UnoptimizedCompileFlags::ForTest(CcTest::i_isolate())));
   helper.scanner->Initialize();
   return helper;
 }
diff --git a/deps/v8/test/cctest/test-api-icu.cc b/deps/v8/test/cctest/test-api-icu.cc
new file mode 100644
index 00000000000..c5e617fdd2a
--- /dev/null
+++ b/deps/v8/test/cctest/test-api-icu.cc
@@ -0,0 +1,57 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifdef V8_INTL_SUPPORT
+
+#include <stdlib.h>
+
+#include "include/v8.h"
+#include "src/objects/objects-inl.h"
+#include "test/cctest/cctest.h"
+#include "unicode/locid.h"
+
+namespace {
+void CheckLocaleSpecificValues(const char* locale, const char* date,
+                               const char* number) {
+  CHECK(v8_str(locale)->StrictEquals(
+      CompileRun("Intl.NumberFormat().resolvedOptions().locale")));
+  CHECK(v8_str(date)->StrictEquals(
+      CompileRun("new Date('02/14/2020 13:45').toLocaleString()")));
+  CHECK(v8_str(number)->StrictEquals(
+      CompileRun("Number(10000.3).toLocaleString()")));
+}
+
+void SetIcuLocale(const char* locale_name) {
+  UErrorCode error_code = U_ZERO_ERROR;
+  icu::Locale locale(locale_name);
+  icu::Locale::setDefault(locale, error_code);
+  CHECK(U_SUCCESS(error_code));
+}
+}  // namespace
+
+TEST(LocaleConfigurationChangeNotification) {
+  icu::Locale default_locale = icu::Locale::getDefault();
+
+  LocalContext context;
+  v8::Isolate* isolate = context->GetIsolate();
+  v8::HandleScope scope(isolate);
+
+  SetIcuLocale("en_US");
+  isolate->LocaleConfigurationChangeNotification();
+  CheckLocaleSpecificValues("en-US", "2/14/2020, 1:45:00 PM", "10,000.3");
+
+  SetIcuLocale("ru_RU");
+  isolate->LocaleConfigurationChangeNotification();
+  CheckLocaleSpecificValues("ru-RU", "14.02.2020, 13:45:00", "10 000,3");
+
+  SetIcuLocale("zh_CN");
+  isolate->LocaleConfigurationChangeNotification();
+  CheckLocaleSpecificValues("zh-CN", "2020/2/14 下午1:45:00", "10,000.3");
+
+  UErrorCode error_code = U_ZERO_ERROR;
+  icu::Locale::setDefault(default_locale, error_code);
+  CHECK(U_SUCCESS(error_code));
+}
+
+#endif  // V8_INTL_SUPPORT
diff --git a/deps/v8/test/cctest/test-api-wasm.cc b/deps/v8/test/cctest/test-api-wasm.cc
index 4dc84254bcf..eb49d5668ab 100644
--- a/deps/v8/test/cctest/test-api-wasm.cc
+++ b/deps/v8/test/cctest/test-api-wasm.cc
@@ -130,11 +130,16 @@ TEST(WasmStreamingAbortWithoutReject) {
 namespace {
 
 bool wasm_threads_enabled_value = false;
+bool wasm_simd_enabled_value = false;
 
 bool MockWasmThreadsEnabledCallback(v8::Local<v8::Context>) {
   return wasm_threads_enabled_value;
 }
 
+bool MockWasmSimdEnabledCallback(v8::Local<v8::Context>) {
+  return wasm_simd_enabled_value;
+}
+
 }  // namespace
 
 TEST(TestSetWasmThreadsEnabledCallback) {
@@ -165,3 +170,32 @@ TEST(TestSetWasmThreadsEnabledCallback) {
   i::FLAG_experimental_wasm_threads = false;
   CHECK(i_isolate->AreWasmThreadsEnabled(i_context));
 }
+
+TEST(TestSetWasmSimdEnabledCallback) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::Context> context = v8::Context::New(CcTest::isolate());
+  i::Handle<i::Context> i_context = v8::Utils::OpenHandle(*context);
+
+  // {Isolate::IsWasmSimdEnabled} calls the callback set by the embedder if
+  // such a callback exists. Otherwise it returns
+  // {FLAG_experimental_wasm_simd}. First we test that the flag is returned
+  // correctly if no callback is set. Then we test that the flag is ignored if
+  // the callback is set.
+
+  i::FLAG_experimental_wasm_simd = false;
+  CHECK(!i_isolate->IsWasmSimdEnabled(i_context));
+
+  i::FLAG_experimental_wasm_simd = true;
+  CHECK(i_isolate->IsWasmSimdEnabled(i_context));
+
+  isolate->SetWasmSimdEnabledCallback(MockWasmSimdEnabledCallback);
+  wasm_simd_enabled_value = false;
+  CHECK(!i_isolate->IsWasmSimdEnabled(i_context));
+
+  wasm_simd_enabled_value = true;
+  i::FLAG_experimental_wasm_simd = false;
+  CHECK(i_isolate->IsWasmSimdEnabled(i_context));
+}
diff --git a/deps/v8/test/cctest/test-api.cc b/deps/v8/test/cctest/test-api.cc
index 7f4b3002038..c975d6f8658 100644
--- a/deps/v8/test/cctest/test-api.cc
+++ b/deps/v8/test/cctest/test-api.cc
@@ -1075,20 +1075,23 @@ template<typename Constructor, typename Accessor>
 static void TestFunctionTemplateAccessor(Constructor constructor,
                                          Accessor accessor) {
   LocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope scope(isolate);
 
   Local<v8::FunctionTemplate> fun_templ =
-      v8::FunctionTemplate::New(env->GetIsolate(), constructor);
-  fun_templ->SetClassName(v8_str("funky"));
+      v8::FunctionTemplate::New(isolate, constructor);
+  fun_templ->PrototypeTemplate()->Set(
+      v8::Symbol::GetToStringTag(isolate), v8_str("funky"),
+      static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontEnum));
   fun_templ->InstanceTemplate()->SetAccessor(v8_str("m"), accessor);
+
   Local<Function> fun = fun_templ->GetFunction(env.local()).ToLocalChecked();
   CHECK(env->Global()->Set(env.local(), v8_str("obj"), fun).FromJust());
-  Local<Value> result =
-      v8_compile("(new obj()).toString()")->Run(env.local()).ToLocalChecked();
+  Local<Value> result = CompileRun("(new obj()).toString()");
   CHECK(v8_str("[object funky]")->Equals(env.local(), result).FromJust());
   CompileRun("var obj_instance = new obj();");
-  Local<Script> script;
-  script = v8_compile("obj_instance.x");
+
+  Local<Script> script = v8_compile("obj_instance.x");
   for (int i = 0; i < 30; i++) {
     CHECK_EQ(1, v8_run_int32value(script));
   }
@@ -12633,22 +12636,20 @@ THREADED_TEST(NewTargetHandler) {
 }
 
 THREADED_TEST(ObjectProtoToString) {
+  LocalContext context;
   v8::Isolate* isolate = CcTest::isolate();
   v8::HandleScope scope(isolate);
   Local<v8::FunctionTemplate> templ = v8::FunctionTemplate::New(isolate);
   templ->SetClassName(v8_str("MyClass"));
 
-  LocalContext context;
 
   Local<String> customized_tostring = v8_str("customized toString");
 
   // Replace Object.prototype.toString
-  v8_compile(
-      "Object.prototype.toString = function() {"
-      "  return 'customized toString';"
-      "}")
-      ->Run(context.local())
-      .ToLocalChecked();
+  CompileRun(R"(
+      Object.prototype.toString = function() {
+        return 'customized toString';
+      })");
 
   // Normal ToString call should call replaced Object.prototype.toString
   Local<v8::Object> instance = templ->GetFunction(context.local())
@@ -12659,10 +12660,11 @@ THREADED_TEST(ObjectProtoToString) {
   CHECK(value->IsString() &&
         value->Equals(context.local(), customized_tostring).FromJust());
 
-  // ObjectProtoToString should not call replace toString function.
+  // ObjectProtoToString should not call replace toString function. It should
+  // not look at the class name either.
   value = instance->ObjectProtoToString(context.local()).ToLocalChecked();
   CHECK(value->IsString() &&
-        value->Equals(context.local(), v8_str("[object MyClass]")).FromJust());
+        value->Equals(context.local(), v8_str("[object Object]")).FromJust());
 
   // Check global
   value =
@@ -12671,8 +12673,7 @@ THREADED_TEST(ObjectProtoToString) {
         value->Equals(context.local(), v8_str("[object Object]")).FromJust());
 
   // Check ordinary object
-  Local<Value> object =
-      v8_compile("new Object()")->Run(context.local()).ToLocalChecked();
+  Local<Value> object = CompileRun("new Object()");
   value = object.As<v8::Object>()
               ->ObjectProtoToString(context.local())
               .ToLocalChecked();
@@ -12685,16 +12686,23 @@ TEST(ObjectProtoToStringES6) {
   LocalContext context;
   v8::Isolate* isolate = CcTest::isolate();
   v8::HandleScope scope(isolate);
+
+  // Check that ES6 semantics using @@toStringTag work.
+  Local<v8::Symbol> toStringTag = v8::Symbol::GetToStringTag(isolate);
+
   Local<v8::FunctionTemplate> templ = v8::FunctionTemplate::New(isolate);
   templ->SetClassName(v8_str("MyClass"));
+  templ->PrototypeTemplate()->Set(
+      toStringTag, v8_str("MyClassToStringTag"),
+      static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontEnum));
 
   Local<String> customized_tostring = v8_str("customized toString");
 
   // Replace Object.prototype.toString
-  CompileRun(
-      "Object.prototype.toString = function() {"
-      "  return 'customized toString';"
-      "}");
+  CompileRun(R"(
+      Object.prototype.toString = function() {
+        return 'customized toString';
+      })");
 
   // Normal ToString call should call replaced Object.prototype.toString
   Local<v8::Object> instance = templ->GetFunction(context.local())
@@ -12705,27 +12713,14 @@ TEST(ObjectProtoToStringES6) {
   CHECK(value->IsString() &&
         value->Equals(context.local(), customized_tostring).FromJust());
 
-  // ObjectProtoToString should not call replace toString function.
+  // ObjectProtoToString should not call replace toString function. Instead it
+  // should look at the @@toStringTag property.
   value = instance->ObjectProtoToString(context.local()).ToLocalChecked();
   CHECK(value->IsString() &&
-        value->Equals(context.local(), v8_str("[object MyClass]")).FromJust());
-
-  // Check global
-  value =
-      context->Global()->ObjectProtoToString(context.local()).ToLocalChecked();
-  CHECK(value->IsString() &&
-        value->Equals(context.local(), v8_str("[object Object]")).FromJust());
-
-  // Check ordinary object
-  Local<Value> object = CompileRun("new Object()");
-  value = object.As<v8::Object>()
-              ->ObjectProtoToString(context.local())
-              .ToLocalChecked();
-  CHECK(value->IsString() &&
-        value->Equals(context.local(), v8_str("[object Object]")).FromJust());
+        value->Equals(context.local(), v8_str("[object MyClassToStringTag]"))
+            .FromJust());
 
-  // Check that ES6 semantics using @@toStringTag work
-  Local<v8::Symbol> toStringTag = v8::Symbol::GetToStringTag(isolate);
+  Local<Value> object;
 
 #define TEST_TOSTRINGTAG(type, tag, expected)                              \
   do {                                                                     \
@@ -14627,10 +14622,10 @@ THREADED_TEST(MorphCompositeStringTest) {
     CHECK(lhs->IsOneByte());
     CHECK(rhs->IsOneByte());
 
-    i::String ilhs = *v8::Utils::OpenHandle(*lhs);
-    i::String irhs = *v8::Utils::OpenHandle(*rhs);
-    MorphAString(ilhs, &one_byte_resource, &uc16_resource);
-    MorphAString(irhs, &one_byte_resource, &uc16_resource);
+    i::Handle<i::String> ilhs = v8::Utils::OpenHandle(*lhs);
+    i::Handle<i::String> irhs = v8::Utils::OpenHandle(*rhs);
+    MorphAString(*ilhs, &one_byte_resource, &uc16_resource);
+    MorphAString(*irhs, &one_byte_resource, &uc16_resource);
 
     // This should UTF-8 without flattening, since everything is ASCII.
     Local<String> cons =
@@ -14675,14 +14670,14 @@ THREADED_TEST(MorphCompositeStringTest) {
               .FromJust());
 
     // This avoids the GC from trying to free a stack allocated resource.
-    if (ilhs.IsExternalOneByteString())
-      i::ExternalOneByteString::cast(ilhs).SetResource(i_isolate, nullptr);
+    if (ilhs->IsExternalOneByteString())
+      i::ExternalOneByteString::cast(*ilhs).SetResource(i_isolate, nullptr);
     else
-      i::ExternalTwoByteString::cast(ilhs).SetResource(i_isolate, nullptr);
-    if (irhs.IsExternalOneByteString())
-      i::ExternalOneByteString::cast(irhs).SetResource(i_isolate, nullptr);
+      i::ExternalTwoByteString::cast(*ilhs).SetResource(i_isolate, nullptr);
+    if (irhs->IsExternalOneByteString())
+      i::ExternalOneByteString::cast(*irhs).SetResource(i_isolate, nullptr);
     else
-      i::ExternalTwoByteString::cast(irhs).SetResource(i_isolate, nullptr);
+      i::ExternalTwoByteString::cast(*irhs).SetResource(i_isolate, nullptr);
   }
   i::DeleteArray(two_byte_string);
 }
@@ -19356,6 +19351,52 @@ TEST(ModifyCodeGenFromStrings) {
   try_catch.Reset();
 }
 
+v8::ModifyCodeGenerationFromStringsResult RejectStringsIncrementNumbers(
+    Local<Context> context, Local<Value> source) {
+  if (source->IsString()) {
+    return {false, v8::MaybeLocal<String>()};
+  }
+
+  Local<v8::Number> number;
+  if (!source->ToNumber(context).ToLocal(&number)) {
+    return {true, v8::MaybeLocal<String>()};
+  }
+
+  Local<v8::String> incremented =
+      String::NewFromUtf8(context->GetIsolate(),
+                          std::to_string(number->Value() + 1).c_str(),
+                          v8::NewStringType::kNormal)
+          .ToLocalChecked();
+
+  return {true, incremented};
+}
+
+TEST(AllowFromStringsOrModifyCodegen) {
+  LocalContext context;
+  v8::HandleScope scope(context->GetIsolate());
+  context->GetIsolate()->SetModifyCodeGenerationFromStringsCallback(
+      &RejectStringsIncrementNumbers);
+
+  context->AllowCodeGenerationFromStrings(false);
+
+  TryCatch try_catch(CcTest::isolate());
+  Local<Value> result = CompileRun("eval('40+2')");
+  CHECK(result.IsEmpty());
+  CHECK(try_catch.HasCaught());
+  try_catch.Reset();
+
+  result = CompileRun("eval(42)");
+  CHECK_EQ(43, result->Int32Value(context.local()).FromJust());
+
+  context->AllowCodeGenerationFromStrings(true);
+
+  result = CompileRun("eval('40+2')");
+  CHECK_EQ(42, result->Int32Value(context.local()).FromJust());
+
+  result = CompileRun("eval(42)");
+  CHECK_EQ(43, result->Int32Value(context.local()).FromJust());
+}
+
 TEST(SetErrorMessageForCodeGenFromStrings) {
   LocalContext context;
   v8::HandleScope scope(context->GetIsolate());
@@ -19834,11 +19875,30 @@ static void MicrotaskExceptionTwo(
       v8::Exception::Error(v8_str("second")));
 }
 
+int handler_call_count = 0;
+static void MicrotaskExceptionHandler(Local<Message> message,
+                                      Local<Value> exception) {
+  CHECK(exception->IsNativeError());
+  Local<Context> context = message->GetIsolate()->GetCurrentContext();
+  Local<String> str = exception->ToString(context).ToLocalChecked();
+  switch (handler_call_count++) {
+    case 0:
+      CHECK(str->StrictEquals(v8_str("Error: first")));
+      break;
+    case 1:
+      CHECK(str->StrictEquals(v8_str("Error: second")));
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
 
 TEST(RunMicrotasksIgnoresThrownExceptions) {
   LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
+  isolate->AddMessageListenerWithErrorLevel(MicrotaskExceptionHandler,
+                                            v8::Isolate::kMessageAll);
   CompileRun(
       "var exception1Calls = 0;"
       "var exception2Calls = 0;");
@@ -19849,6 +19909,7 @@ TEST(RunMicrotasksIgnoresThrownExceptions) {
   TryCatch try_catch(isolate);
   CompileRun("1+1;");
   CHECK(!try_catch.HasCaught());
+  CHECK_EQ(handler_call_count, 2);
   CHECK_EQ(1,
            CompileRun("exception1Calls")->Int32Value(env.local()).FromJust());
   CHECK_EQ(1,
@@ -21676,11 +21737,10 @@ THREADED_TEST(FunctionNew) {
   CHECK(v8::Integer::New(isolate, 17)->Equals(env.local(), result).FromJust());
   // Serial number should be invalid => should not be cached.
   auto serial_number =
-      i::Smi::cast(i::Handle<i::JSFunction>::cast(v8::Utils::OpenHandle(*func))
-                       ->shared()
-                       .get_api_func_data()
-                       .serial_number())
-          .value();
+      i::Handle<i::JSFunction>::cast(v8::Utils::OpenHandle(*func))
+          ->shared()
+          .get_api_func_data()
+          .serial_number();
   CHECK_EQ(i::FunctionTemplateInfo::kInvalidSerialNumber, serial_number);
 
   // Verify that each Function::New creates a new function instance
@@ -24433,8 +24493,6 @@ TEST(TurboAsmDisablesDetach) {
       "}"
       "var buffer = new ArrayBuffer(4096);"
       "var module = Module(this, {}, buffer);"
-      "%PrepareFunctionForOptimization(module.load);"
-      "%OptimizeFunctionOnNextCall(module.load);"
       "module.load();"
       "buffer";
 
@@ -24450,8 +24508,6 @@ TEST(TurboAsmDisablesDetach) {
       "}"
       "var buffer = new ArrayBuffer(4096);"
       "var module = Module(this, {}, buffer);"
-      "%PrepareFunctionForOptimization(module.store);"
-      "%OptimizeFunctionOnNextCall(module.store);"
       "module.store();"
       "buffer";
 
@@ -25703,7 +25759,6 @@ void HostInitializeImportMetaObjectCallbackStatic(Local<Context> context,
                                                   Local<Module> module,
                                                   Local<Object> meta) {
   CHECK(!module.IsEmpty());
-
   meta->CreateDataProperty(context, v8_str("foo"), v8_str("bar")).ToChecked();
 }
 
@@ -25727,10 +25782,9 @@ TEST(ImportMeta) {
   v8::ScriptCompiler::Source source(source_text, origin);
   Local<Module> module =
       v8::ScriptCompiler::CompileModule(isolate, &source).ToLocalChecked();
-  i::Handle<i::Object> meta =
-      i_isolate->RunHostInitializeImportMetaObjectCallback(
-          i::Handle<i::SourceTextModule>::cast(v8::Utils::OpenHandle(*module)));
-  CHECK(meta->IsJSObject());
+  i::Handle<i::JSObject> meta = i::SourceTextModule::GetImportMeta(
+      i_isolate,
+      i::Handle<i::SourceTextModule>::cast(v8::Utils::OpenHandle(*module)));
   Local<Object> meta_obj = Local<Object>::Cast(v8::Utils::ToLocal(meta));
   CHECK(meta_obj->Get(context.local(), v8_str("foo"))
             .ToLocalChecked()
@@ -26859,8 +26913,8 @@ static void CallIsolate2(const v8::FunctionCallbackInfo<v8::Value>& args) {
       v8::Local<v8::Context>::New(isolate_2, context_2);
   v8::Context::Scope context_scope(context);
   reinterpret_cast<i::Isolate*>(isolate_2)->heap()->CollectAllGarbage(
-      i::Heap::kNoGCFlags, i::GarbageCollectionReason::kTesting,
-      v8::kGCCallbackFlagForced);
+      i::Heap::kForcedGC, i::GarbageCollectionReason::kTesting,
+      v8::kNoGCCallbackFlags);
   CompileRun("f2() //# sourceURL=isolate2b");
 }
 
@@ -27064,6 +27118,8 @@ void SetupTest(v8::Local<v8::Value> initial_value, LocalContext* env,
   v8::Isolate* isolate = CcTest::isolate();
 
   v8::CFunction c_func = v8::CFunction::Make(ApiNumberChecker<T>::CheckArgFast);
+  CHECK_EQ(c_func.ArgumentInfo(0).GetType(),
+           v8::CTypeInfo::Type::kUnwrappedApiObject);
 
   Local<v8::FunctionTemplate> checker_templ = v8::FunctionTemplate::New(
       isolate, ApiNumberChecker<T>::CheckArgSlow, v8::Local<v8::Value>(),
diff --git a/deps/v8/test/cctest/test-code-pages.cc b/deps/v8/test/cctest/test-code-pages.cc
index 7fafe626296..3323b8d9aa4 100644
--- a/deps/v8/test/cctest/test-code-pages.cc
+++ b/deps/v8/test/cctest/test-code-pages.cc
@@ -8,6 +8,7 @@
 #include "src/execution/isolate.h"
 #include "src/handles/handles-inl.h"
 #include "src/heap/factory.h"
+#include "src/heap/memory-allocator.h"
 #include "src/heap/spaces.h"
 #include "src/libsampler/sampler.h"
 #include "test/cctest/cctest.h"
diff --git a/deps/v8/test/cctest/test-code-stub-assembler.cc b/deps/v8/test/cctest/test-code-stub-assembler.cc
index 755041e0fb9..a3434ae3c33 100644
--- a/deps/v8/test/cctest/test-code-stub-assembler.cc
+++ b/deps/v8/test/cctest/test-code-stub-assembler.cc
@@ -42,18 +42,6 @@ template <class T>
 using TVariable = TypedCodeAssemblerVariable<T>;
 using PromiseResolvingFunctions = TorqueStructPromiseResolvingFunctions;
 
-Handle<String> MakeString(const char* str) {
-  Isolate* isolate = CcTest::i_isolate();
-  Factory* factory = isolate->factory();
-  return factory->InternalizeUtf8String(str);
-}
-
-Handle<String> MakeName(const char* str, int suffix) {
-  EmbeddedVector<char, 128> buffer;
-  SNPrintF(buffer, "%s%d", str, suffix);
-  return MakeString(buffer.begin());
-}
-
 int sum10(int a0, int a1, int a2, int a3, int a4, int a5, int a6, int a7,
           int a8, int a9) {
   return a0 + a1 + a2 + a3 + a4 + a5 + a6 + a7 + a8 + a9;
@@ -1090,7 +1078,7 @@ TEST(TransitionLookup) {
       name = factory->NewSymbol();
     } else {
       int random_key = rand_gen.NextInt(Smi::kMaxValue);
-      name = MakeName("p", random_key);
+      name = CcTest::MakeName("p", random_key);
     }
     keys[i] = name;
 
@@ -2155,79 +2143,6 @@ TEST(Arguments) {
   CHECK_EQ(*isolate->factory()->undefined_value(), *result);
 }
 
-TEST(ArgumentsWithSmiConstantIndices) {
-  Isolate* isolate(CcTest::InitIsolateOnce());
-
-  const int kNumParams = 4;
-  CodeAssemblerTester asm_tester(isolate, kNumParams);
-  CodeStubAssembler m(asm_tester.state());
-
-  CodeStubArguments arguments(&m, m.SmiConstant(3));
-
-  CSA_ASSERT(&m, m.TaggedEqual(arguments.AtIndex(m.SmiConstant(0)),
-                               m.SmiConstant(12)));
-  CSA_ASSERT(&m, m.TaggedEqual(arguments.AtIndex(m.SmiConstant(1)),
-                               m.SmiConstant(13)));
-  CSA_ASSERT(&m, m.TaggedEqual(arguments.AtIndex(m.SmiConstant(2)),
-                               m.SmiConstant(14)));
-
-  arguments.PopAndReturn(arguments.GetReceiver());
-
-  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
-  Handle<Object> result = ft.Call(isolate->factory()->undefined_value(),
-                                  Handle<Smi>(Smi::FromInt(12), isolate),
-                                  Handle<Smi>(Smi::FromInt(13), isolate),
-                                  Handle<Smi>(Smi::FromInt(14), isolate))
-                              .ToHandleChecked();
-  CHECK_EQ(*isolate->factory()->undefined_value(), *result);
-}
-
-TNode<Smi> NonConstantSmi(CodeStubAssembler* m, int value) {
-  // Generate a SMI with the given value and feed it through a Phi so it can't
-  // be inferred to be constant.
-  Variable var(m, MachineRepresentation::kTagged, m->SmiConstant(value));
-  Label dummy_done(m);
-  // Even though the Goto always executes, it will taint the variable and thus
-  // make it appear non-constant when used later.
-  m->GotoIf(m->Int32Constant(1), &dummy_done);
-  var.Bind(m->SmiConstant(value));
-  m->Goto(&dummy_done);
-  m->BIND(&dummy_done);
-
-  // Ensure that the above hackery actually created a non-constant SMI.
-  Smi smi_constant;
-  CHECK(!m->ToSmiConstant(var.value(), &smi_constant));
-
-  return m->UncheckedCast<Smi>(var.value());
-}
-
-TEST(ArgumentsWithSmiIndices) {
-  Isolate* isolate(CcTest::InitIsolateOnce());
-
-  const int kNumParams = 4;
-  CodeAssemblerTester asm_tester(isolate, kNumParams);
-  CodeStubAssembler m(asm_tester.state());
-
-  CodeStubArguments arguments(&m, m.SmiConstant(3));
-
-  CSA_ASSERT(&m, m.TaggedEqual(arguments.AtIndex(NonConstantSmi(&m, 0)),
-                               m.SmiConstant(12)));
-  CSA_ASSERT(&m, m.TaggedEqual(arguments.AtIndex(NonConstantSmi(&m, 1)),
-                               m.SmiConstant(13)));
-  CSA_ASSERT(&m, m.TaggedEqual(arguments.AtIndex(NonConstantSmi(&m, 2)),
-                               m.SmiConstant(14)));
-
-  arguments.PopAndReturn(arguments.GetReceiver());
-
-  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
-  Handle<Object> result = ft.Call(isolate->factory()->undefined_value(),
-                                  Handle<Smi>(Smi::FromInt(12), isolate),
-                                  Handle<Smi>(Smi::FromInt(13), isolate),
-                                  Handle<Smi>(Smi::FromInt(14), isolate))
-                              .ToHandleChecked();
-  CHECK_EQ(*isolate->factory()->undefined_value(), *result);
-}
-
 TEST(ArgumentsForEach) {
   Isolate* isolate(CcTest::InitIsolateOnce());
 
@@ -2686,9 +2601,8 @@ TEST(AllocateFunctionWithMapAndContext) {
       m.NewJSPromise(context, m.UndefinedConstant());
   TNode<Context> promise_context = m.CreatePromiseResolvingFunctionsContext(
       context, promise, m.BooleanConstant(false), native_context);
-  TNode<Object> resolve_info = m.LoadContextElement(
-      native_context,
-      Context::PROMISE_CAPABILITY_DEFAULT_RESOLVE_SHARED_FUN_INDEX);
+  TNode<Object> resolve_info =
+      m.PromiseCapabilityDefaultResolveSharedFunConstant();
   const TNode<Object> map = m.LoadContextElement(
       native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
   const TNode<JSFunction> resolve = m.AllocateFunctionWithMapAndContext(
@@ -2705,9 +2619,11 @@ TEST(AllocateFunctionWithMapAndContext) {
   CHECK_EQ(ReadOnlyRoots(isolate).empty_fixed_array(), fun->elements());
   CHECK_EQ(isolate->heap()->many_closures_cell(), fun->raw_feedback_cell());
   CHECK(!fun->has_prototype_slot());
-  CHECK_EQ(*isolate->promise_capability_default_resolve_shared_fun(),
+  CHECK_EQ(*isolate->factory()->promise_capability_default_resolve_shared_fun(),
            fun->shared());
-  CHECK_EQ(isolate->promise_capability_default_resolve_shared_fun()->GetCode(),
+  CHECK_EQ(isolate->factory()
+               ->promise_capability_default_resolve_shared_fun()
+               ->GetCode(),
            fun->code());
 }
 
@@ -2769,10 +2685,12 @@ TEST(NewPromiseCapability) {
     CHECK(result->promise().IsJSPromise());
     CHECK(result->resolve().IsJSFunction());
     CHECK(result->reject().IsJSFunction());
-    CHECK_EQ(*isolate->promise_capability_default_reject_shared_fun(),
-             JSFunction::cast(result->reject()).shared());
-    CHECK_EQ(*isolate->promise_capability_default_resolve_shared_fun(),
-             JSFunction::cast(result->resolve()).shared());
+    CHECK_EQ(
+        *isolate->factory()->promise_capability_default_reject_shared_fun(),
+        JSFunction::cast(result->reject()).shared());
+    CHECK_EQ(
+        *isolate->factory()->promise_capability_default_resolve_shared_fun(),
+        JSFunction::cast(result->resolve()).shared());
 
     Handle<JSFunction> callbacks[] = {
         handle(JSFunction::cast(result->resolve()), isolate),
@@ -3642,8 +3560,8 @@ TEST(TestCallBuiltinInlineTrampoline) {
   options.use_pc_relative_calls_and_jumps = false;
   options.isolate_independent_code = false;
   FunctionTester ft(asm_tester.GenerateCode(options), kNumParams);
-  MaybeHandle<Object> result = ft.Call(MakeString("abcdef"));
-  CHECK(String::Equals(isolate, MakeString("abcdefabcdef"),
+  MaybeHandle<Object> result = ft.Call(CcTest::MakeString("abcdef"));
+  CHECK(String::Equals(isolate, CcTest::MakeString("abcdefabcdef"),
                        Handle<String>::cast(result.ToHandleChecked())));
 }
 
@@ -3668,8 +3586,8 @@ DISABLED_TEST(TestCallBuiltinIndirectLoad) {
   options.use_pc_relative_calls_and_jumps = false;
   options.isolate_independent_code = true;
   FunctionTester ft(asm_tester.GenerateCode(options), kNumParams);
-  MaybeHandle<Object> result = ft.Call(MakeString("abcdef"));
-  CHECK(String::Equals(isolate, MakeString("abcdefabcdef"),
+  MaybeHandle<Object> result = ft.Call(CcTest::MakeString("abcdef"));
+  CHECK(String::Equals(isolate, CcTest::MakeString("abcdefabcdef"),
                        Handle<String>::cast(result.ToHandleChecked())));
 }
 
@@ -3710,6 +3628,284 @@ TEST(InstructionSchedulingCallerSavedRegisters) {
   FLAG_turbo_instruction_scheduling = old_turbo_instruction_scheduling;
 }
 
+TEST(WasmInt32ToHeapNumber) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+
+  int32_t test_values[] = {
+    // Smi values.
+    1,
+    0,
+    -1,
+    kSmiMaxValue,
+    kSmiMinValue,
+  // Test integers that can't be Smis (only possible if Smis are 31 bits).
+#if defined(V8_HOST_ARCH_32_BIT) || defined(V8_31BIT_SMIS_ON_64BIT_ARCH)
+    kSmiMaxValue + 1,
+    kSmiMinValue - 1,
+#endif
+  };
+
+  // FunctionTester can't handle Wasm type arguments, so for each test value,
+  // build a function with the arguments baked in, then generate a no-argument
+  // function to call.
+  const int kNumParams = 1;
+  for (size_t i = 0; i < arraysize(test_values); ++i) {
+    int32_t test_value = test_values[i];
+    CodeAssemblerTester asm_tester(isolate, kNumParams);
+    CodeStubAssembler m(asm_tester.state());
+    Node* context = m.Parameter(kNumParams + 1);
+    const TNode<Int32T> arg = m.Int32Constant(test_value);
+    const TNode<Object> call_result =
+        m.CallBuiltin(Builtins::kWasmInt32ToHeapNumber, context, arg);
+    m.Return(call_result);
+
+    FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+    Handle<Object> result = ft.Call().ToHandleChecked();
+    CHECK(result->IsNumber());
+    Handle<Object> expected(isolate->factory()->NewNumber(test_value));
+    CHECK(result->StrictEquals(*expected));
+  }
+}
+
+int32_t NumberToInt32(Handle<Object> number) {
+  if (number->IsSmi()) {
+    return Smi::ToInt(*number);
+  }
+  if (number->IsHeapNumber()) {
+    double num = HeapNumber::cast(*number).value();
+    return DoubleToInt32(num);
+  }
+  UNREACHABLE();
+}
+
+TEST(WasmTaggedNonSmiToInt32) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  Factory* factory = isolate->factory();
+  HandleScope scope(isolate);
+
+  Handle<Object> test_values[] = {
+      // No Smis here; the builtin can't handle them correctly.
+      factory->NewNumber(-0.0),
+      factory->NewNumber(1.5),
+      factory->NewNumber(-1.5),
+      factory->NewNumber(2 * static_cast<double>(kSmiMaxValue)),
+      factory->NewNumber(2 * static_cast<double>(kSmiMinValue)),
+      factory->NewNumber(std::numeric_limits<double>::infinity()),
+      factory->NewNumber(-std::numeric_limits<double>::infinity()),
+      factory->NewNumber(-std::numeric_limits<double>::quiet_NaN()),
+  };
+
+  const int kNumParams = 2;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  CodeStubAssembler m(asm_tester.state());
+  Node* context = m.Parameter(kNumParams + 2);
+  const TNode<Object> arg = m.CAST(m.Parameter(0));
+  int32_t result = 0;
+  Node* base = m.IntPtrConstant(reinterpret_cast<intptr_t>(&result));
+  Node* value = m.CallBuiltin(Builtins::kWasmTaggedNonSmiToInt32, context, arg);
+  m.StoreNoWriteBarrier(MachineRepresentation::kWord32, base, value);
+  m.Return(m.UndefinedConstant());
+
+  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+
+  for (size_t i = 0; i < arraysize(test_values); ++i) {
+    Handle<Object> test_value = test_values[i];
+    ft.Call(test_value);
+    int32_t expected = NumberToInt32(test_value);
+    CHECK_EQ(result, expected);
+  }
+}
+
+TEST(WasmFloat32ToNumber) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+
+  float test_values[] = {
+      // Smi values.
+      1,
+      0,
+      -1,
+      // Max and min Smis can't be represented as floats.
+      // Non-Smi values.
+      -0.0,
+      1.5,
+      std::numeric_limits<float>::quiet_NaN(),
+      std::numeric_limits<float>::infinity(),
+  };
+
+  // FunctionTester can't handle Wasm type arguments, so for each test value,
+  // build a function with the arguments baked in, then generate a no-argument
+  // function to call.
+  const int kNumParams = 1;
+  for (size_t i = 0; i < arraysize(test_values); ++i) {
+    double test_value = test_values[i];
+    CodeAssemblerTester asm_tester(isolate, kNumParams);
+    CodeStubAssembler m(asm_tester.state());
+    Node* context = m.Parameter(kNumParams + 1);
+    const TNode<Float32T> arg = m.Float32Constant(test_value);
+    const TNode<Object> call_result =
+        m.CallBuiltin(Builtins::kWasmFloat32ToNumber, context, arg);
+    m.Return(call_result);
+
+    FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+    Handle<Object> result = ft.Call().ToHandleChecked();
+    CHECK(result->IsNumber());
+    Handle<Object> expected(isolate->factory()->NewNumber(test_value));
+    CHECK(result->StrictEquals(*expected) ||
+          (std::isnan(test_value) && std::isnan(result->Number())));
+    CHECK_EQ(result->IsSmi(), expected->IsSmi());
+  }
+}
+
+TEST(WasmFloat64ToNumber) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+
+  double test_values[] = {
+      // Smi values.
+      1,
+      0,
+      -1,
+      kSmiMaxValue,
+      kSmiMinValue,
+      // Non-Smi values.
+      -0.0,
+      1.5,
+      std::numeric_limits<double>::quiet_NaN(),
+      std::numeric_limits<double>::infinity(),
+  };
+
+  // FunctionTester can't handle Wasm type arguments, so for each test value,
+  // build a function with the arguments baked in, then generate a no-argument
+  // function to call.
+  const int kNumParams = 1;
+  for (size_t i = 0; i < arraysize(test_values); ++i) {
+    double test_value = test_values[i];
+    CodeAssemblerTester asm_tester(isolate, kNumParams);
+    CodeStubAssembler m(asm_tester.state());
+    Node* context = m.Parameter(kNumParams + 1);
+    const TNode<Float64T> arg = m.Float64Constant(test_value);
+    const TNode<Object> call_result =
+        m.CallBuiltin(Builtins::kWasmFloat64ToNumber, context, arg);
+    m.Return(call_result);
+
+    FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+    Handle<Object> result = ft.Call().ToHandleChecked();
+    CHECK(result->IsNumber());
+    Handle<Object> expected(isolate->factory()->NewNumber(test_value));
+    CHECK(result->StrictEquals(*expected) ||
+          (std::isnan(test_value) && std::isnan(result->Number())));
+    CHECK_EQ(result->IsSmi(), expected->IsSmi());
+  }
+}
+
+double NumberToFloat64(Handle<Object> number) {
+  if (number->IsSmi()) {
+    return Smi::ToInt(*number);
+  }
+  if (number->IsHeapNumber()) {
+    return HeapNumber::cast(*number).value();
+  }
+  UNREACHABLE();
+}
+
+TEST(WasmTaggedToFloat64) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  Factory* factory = isolate->factory();
+  HandleScope scope(isolate);
+
+  Handle<Object> test_values[] = {
+    // Smi values.
+    handle(Smi::FromInt(1), isolate),
+    handle(Smi::FromInt(0), isolate),
+    handle(Smi::FromInt(-1), isolate),
+    handle(Smi::FromInt(kSmiMaxValue), isolate),
+    handle(Smi::FromInt(kSmiMinValue), isolate),
+    // Test some non-Smis.
+    factory->NewNumber(-0.0),
+    factory->NewNumber(1.5),
+    factory->NewNumber(-1.5),
+// Integer Overflows on platforms with 32 bit Smis.
+#if defined(V8_HOST_ARCH_32_BIT) || defined(V8_31BIT_SMIS_ON_64BIT_ARCH)
+    factory->NewNumber(2 * kSmiMaxValue),
+    factory->NewNumber(2 * kSmiMinValue),
+#endif
+    factory->NewNumber(std::numeric_limits<double>::infinity()),
+    factory->NewNumber(-std::numeric_limits<double>::infinity()),
+    factory->NewNumber(-std::numeric_limits<double>::quiet_NaN()),
+  };
+
+  const int kNumParams = 1;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  CodeStubAssembler m(asm_tester.state());
+  Node* context = m.Parameter(kNumParams + 2);
+  const TNode<Object> arg = m.CAST(m.Parameter(0));
+  double result = 0;
+  Node* base = m.IntPtrConstant(reinterpret_cast<intptr_t>(&result));
+  Node* value = m.CallBuiltin(Builtins::kWasmTaggedToFloat64, context, arg);
+  m.StoreNoWriteBarrier(MachineRepresentation::kFloat64, base, value);
+  m.Return(m.UndefinedConstant());
+
+  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+
+  for (size_t i = 0; i < arraysize(test_values); ++i) {
+    Handle<Object> test_value = test_values[i];
+    ft.Call(test_value);
+    double expected = NumberToFloat64(test_value);
+    if (std::isnan(expected)) {
+      CHECK(std::isnan(result));
+    } else {
+      CHECK_EQ(result, expected);
+    }
+  }
+}
+
+TEST(SmiUntagLeftShiftOptimization) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  const int kNumParams = 1;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  CodeStubAssembler m(asm_tester.state());
+
+  {
+    TNode<TaggedIndex> param =
+        TNode<TaggedIndex>::UncheckedCast(m.Parameter(0));
+    TNode<WordT> unoptimized =
+        m.IntPtrMul(m.TaggedIndexToIntPtr(param), m.IntPtrConstant(8));
+    TNode<WordT> optimized = m.WordShl(
+        m.BitcastTaggedToWordForTagAndSmiBits(param), 3 - kSmiTagSize);
+    m.StaticAssert(m.WordEqual(unoptimized, optimized));
+    m.Return(m.UndefinedConstant());
+  }
+
+  AssemblerOptions options = AssemblerOptions::Default(isolate);
+  FunctionTester ft(asm_tester.GenerateCode(options), kNumParams);
+}
+
+TEST(SmiUntagComparisonOptimization) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  const int kNumParams = 2;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  CodeStubAssembler m(asm_tester.state());
+
+  {
+    TNode<Smi> a = TNode<Smi>::UncheckedCast(m.Parameter(0));
+    TNode<Smi> b = TNode<Smi>::UncheckedCast(m.Parameter(1));
+    TNode<BoolT> unoptimized = m.UintPtrLessThan(m.SmiUntag(a), m.SmiUntag(b));
+#ifdef V8_COMPRESS_POINTERS
+    TNode<BoolT> optimized = m.Uint32LessThan(
+        m.TruncateIntPtrToInt32(m.BitcastTaggedToWordForTagAndSmiBits(a)),
+        m.TruncateIntPtrToInt32(m.BitcastTaggedToWordForTagAndSmiBits(b)));
+#else
+    TNode<BoolT> optimized =
+        m.UintPtrLessThan(m.BitcastTaggedToWordForTagAndSmiBits(a),
+                          m.BitcastTaggedToWordForTagAndSmiBits(b));
+#endif
+    m.StaticAssert(m.Word32Equal(unoptimized, optimized));
+    m.Return(m.UndefinedConstant());
+  }
+
+  AssemblerOptions options = AssemblerOptions::Default(isolate);
+  FunctionTester ft(asm_tester.GenerateCode(options), kNumParams);
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-constantpool.cc b/deps/v8/test/cctest/test-constantpool.cc
index 3d063ac770d..c9f5bcfc187 100644
--- a/deps/v8/test/cctest/test-constantpool.cc
+++ b/deps/v8/test/cctest/test-constantpool.cc
@@ -25,7 +25,7 @@ const int kReach = 1 << kReachBits;
 
 TEST(ConstantPoolPointers) {
   ConstantPoolBuilder builder(kReachBits, kReachBits);
-  const int kRegularCount = kReach / kPointerSize;
+  const int kRegularCount = kReach / kSystemPointerSize;
   ConstantPoolEntry::Access access;
   int pos = 0;
   intptr_t value = 0;
@@ -67,8 +67,9 @@ TEST(ConstantPoolDoubles) {
 
 TEST(ConstantPoolMixedTypes) {
   ConstantPoolBuilder builder(kReachBits, kReachBits);
-  const int kRegularCount = (((kReach / (kDoubleSize + kPointerSize)) * 2) +
-                             ((kPointerSize < kDoubleSize) ? 1 : 0));
+  const int kRegularCount =
+      (((kReach / (kDoubleSize + kSystemPointerSize)) * 2) +
+       ((kSystemPointerSize < kDoubleSize) ? 1 : 0));
   ConstantPoolEntry::Type type = kPtrType;
   ConstantPoolEntry::Access access;
   int pos = 0;
@@ -103,11 +104,11 @@ TEST(ConstantPoolMixedReach) {
   const int ptrReach = 1 << ptrReachBits;
   const int dblReachBits = kReachBits;
   const int dblReach = kReach;
-  const int dblRegularCount =
-      Min(dblReach / kDoubleSize, ptrReach / (kDoubleSize + kPointerSize));
+  const int dblRegularCount = Min(
+      dblReach / kDoubleSize, ptrReach / (kDoubleSize + kSystemPointerSize));
   const int ptrRegularCount =
-      ((ptrReach - (dblRegularCount * (kDoubleSize + kPointerSize))) /
-       kPointerSize) +
+      ((ptrReach - (dblRegularCount * (kDoubleSize + kSystemPointerSize))) /
+       kSystemPointerSize) +
       dblRegularCount;
   ConstantPoolBuilder builder(ptrReachBits, dblReachBits);
   ConstantPoolEntry::Access access;
@@ -152,8 +153,9 @@ TEST(ConstantPoolMixedReach) {
 
 TEST(ConstantPoolSharing) {
   ConstantPoolBuilder builder(kReachBits, kReachBits);
-  const int kRegularCount = (((kReach / (kDoubleSize + kPointerSize)) * 2) +
-                             ((kPointerSize < kDoubleSize) ? 1 : 0));
+  const int kRegularCount =
+      (((kReach / (kDoubleSize + kSystemPointerSize)) * 2) +
+       ((kSystemPointerSize < kDoubleSize) ? 1 : 0));
   ConstantPoolEntry::Access access;
 
   CHECK(builder.IsEmpty());
@@ -201,8 +203,9 @@ TEST(ConstantPoolSharing) {
 
 TEST(ConstantPoolNoSharing) {
   ConstantPoolBuilder builder(kReachBits, kReachBits);
-  const int kRegularCount = (((kReach / (kDoubleSize + kPointerSize)) * 2) +
-                             ((kPointerSize < kDoubleSize) ? 1 : 0));
+  const int kRegularCount =
+      (((kReach / (kDoubleSize + kSystemPointerSize)) * 2) +
+       ((kSystemPointerSize < kDoubleSize) ? 1 : 0));
   ConstantPoolEntry::Access access;
 
   CHECK(builder.IsEmpty());
diff --git a/deps/v8/test/cctest/test-cpu-profiler.cc b/deps/v8/test/cctest/test-cpu-profiler.cc
index b329a841a61..d6ef8b57ff7 100644
--- a/deps/v8/test/cctest/test-cpu-profiler.cc
+++ b/deps/v8/test/cctest/test-cpu-profiler.cc
@@ -39,6 +39,7 @@
 #include "src/deoptimizer/deoptimizer.h"
 #include "src/heap/spaces.h"
 #include "src/libplatform/default-platform.h"
+#include "src/libsampler/sampler.h"
 #include "src/logging/log.h"
 #include "src/objects/objects-inl.h"
 #include "src/profiler/cpu-profiler-inl.h"
@@ -54,7 +55,6 @@
 #include "src/tracing/trace-event.h"
 
 #ifdef V8_USE_PERFETTO
-#include "protos/perfetto/trace/chrome/chrome_trace_event.pb.h"
 #include "protos/perfetto/trace/trace.pb.h"
 #endif
 
@@ -2625,22 +2625,34 @@ using v8::platform::tracing::TraceObject;
 namespace {
 
 #ifdef V8_USE_PERFETTO
-
 class CpuProfilerListener : public platform::tracing::TraceEventListener {
  public:
   void ProcessPacket(const ::perfetto::protos::TracePacket& packet) {
-    for (const ::perfetto::protos::ChromeTraceEvent& trace_event :
-         packet.chrome_events().trace_events()) {
-      if (trace_event.name() != std::string("Profile") &&
-          trace_event.name() != std::string("ProfileChunk"))
-        return;
-      CHECK(!profile_id_ || trace_event.id() == profile_id_);
-      CHECK_EQ(1, trace_event.args_size());
-      CHECK(trace_event.args()[0].has_json_value());
-      profile_id_ = trace_event.id();
-      result_json_ += result_json_.empty() ? "[" : ",\n";
-      result_json_ += trace_event.args()[0].json_value();
+    auto& seq_state = sequence_state_[packet.trusted_packet_sequence_id()];
+    if (packet.incremental_state_cleared()) seq_state = SequenceState{};
+
+    if (!packet.has_track_event()) return;
+
+    // Update incremental state.
+    if (packet.has_interned_data()) {
+      const auto& interned_data = packet.interned_data();
+      for (const auto& it : interned_data.event_names()) {
+        CHECK_EQ(seq_state.event_names_.find(it.iid()),
+                 seq_state.event_names_.end());
+        seq_state.event_names_[it.iid()] = it.name();
+      }
     }
+    const auto& track_event = packet.track_event();
+    auto name = seq_state.event_names_[track_event.name_iid()];
+    if (name != "Profile" && name != "ProfileChunk") return;
+
+    CHECK_EQ(1, track_event.debug_annotations_size());
+    CHECK(track_event.debug_annotations()[0].has_legacy_json_value());
+    CHECK(!profile_id_ ||
+          track_event.legacy_event().unscoped_id() == profile_id_);
+    profile_id_ = track_event.legacy_event().unscoped_id();
+    result_json_ += result_json_.empty() ? "[" : ",\n";
+    result_json_ += track_event.debug_annotations()[0].legacy_json_value();
   }
 
   const std::string& result_json() {
@@ -2650,11 +2662,17 @@ class CpuProfilerListener : public platform::tracing::TraceEventListener {
   void Reset() {
     result_json_.clear();
     profile_id_ = 0;
+    sequence_state_.clear();
   }
 
  private:
   std::string result_json_;
   uint64_t profile_id_ = 0;
+
+  struct SequenceState {
+    std::map<uint64_t, std::string> event_names_;
+  };
+  std::map<uint32_t, SequenceState> sequence_state_;
 };
 
 #else
@@ -2717,8 +2735,6 @@ TEST(TracingCpuProfiler) {
     TraceConfig* trace_config = new TraceConfig();
     trace_config->AddIncludedCategory(
         TRACE_DISABLED_BY_DEFAULT("v8.cpu_profiler"));
-    trace_config->AddIncludedCategory(
-        TRACE_DISABLED_BY_DEFAULT("v8.cpu_profiler.hires"));
 
     std::string test_code = R"(
         function foo() {
@@ -2732,6 +2748,9 @@ TEST(TracingCpuProfiler) {
 
     tracing_controller->StartTracing(trace_config);
     CompileRun(test_code.c_str());
+#ifdef V8_USE_PERFETTO
+    TrackEvent::Flush();
+#endif
     tracing_controller->StopTracing();
 
 #ifdef V8_USE_PERFETTO
@@ -2757,9 +2776,11 @@ TEST(TracingCpuProfiler) {
                  ->IsTrue();
   }
 
+#ifndef V8_USE_PERFETTO
   static_cast<v8::platform::tracing::TracingController*>(
       i::V8::GetCurrentPlatform()->GetTracingController())
       ->Initialize(nullptr);
+#endif  // !V8_USE_PERFETTO
 }
 
 TEST(Issue763073) {
diff --git a/deps/v8/test/cctest/test-debug-helper.cc b/deps/v8/test/cctest/test-debug-helper.cc
index a8b1ecb7a9f..2ab689e7460 100644
--- a/deps/v8/test/cctest/test-debug-helper.cc
+++ b/deps/v8/test/cctest/test-debug-helper.cc
@@ -4,6 +4,7 @@
 
 #include "src/api/api-inl.h"
 #include "src/flags/flags.h"
+#include "src/heap/read-only-spaces.h"
 #include "src/heap/spaces.h"
 #include "test/cctest/cctest.h"
 #include "tools/debug_helper/debug-helper.h"
diff --git a/deps/v8/test/cctest/test-debug.cc b/deps/v8/test/cctest/test-debug.cc
index ed669db8064..35b868a6158 100644
--- a/deps/v8/test/cctest/test-debug.cc
+++ b/deps/v8/test/cctest/test-debug.cc
@@ -3601,34 +3601,30 @@ TEST(NoDebugBreakInAfterCompileEventListener) {
 
 
 // Test that the debug break flag works with function.apply.
-TEST(DebugBreakFunctionApply) {
+TEST(RepeatDebugBreak) {
+  // Test that we can repeatedly set a break without JS execution continuing.
   LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
   v8::Local<v8::Context> context = env.local();
 
   // Create a function for testing breaking in apply.
-  v8::Local<v8::Function> foo = CompileFunction(
-      &env,
-      "function baz(x) { }"
-      "function bar(x) { baz(); }"
-      "function foo(){ bar.apply(this, [1]); }",
-      "foo");
+  v8::Local<v8::Function> foo =
+      CompileFunction(&env, "function foo() {}", "foo");
 
-  // Register a debug event listener which steps and counts.
+  // Register a debug delegate which repeatedly sets a break and counts.
   DebugEventBreakMax delegate;
   v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   // Set the debug break flag before calling the code using function.apply.
   v8::debug::SetBreakOnNextFunctionCall(env->GetIsolate());
 
-  // Limit the number of debug breaks. This is a regression test for issue 493
-  // where this test would enter an infinite loop.
+  // Trigger a break by calling into foo().
   break_point_hit_count = 0;
-  max_break_point_hit_count = 10000;  // 10000 => infinite loop.
+  max_break_point_hit_count = 10000;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
 
   // When keeping the debug break several break will happen.
-  CHECK_GT(break_point_hit_count, 1);
+  CHECK_EQ(break_point_hit_count, max_break_point_hit_count);
 
   v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
@@ -3697,7 +3693,7 @@ void DebugBreakLoop(const char* loop_header, const char** loop_bodies,
   LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  // Register a debug event listener which sets the break flag and counts.
+  // Register a debug delegate which repeatedly sets the break flag and counts.
   DebugEventBreakMax delegate;
   v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
diff --git a/deps/v8/test/cctest/test-disasm-ia32.cc b/deps/v8/test/cctest/test-disasm-ia32.cc
index cc4f5cc296c..496fa666844 100644
--- a/deps/v8/test/cctest/test-disasm-ia32.cc
+++ b/deps/v8/test/cctest/test-disasm-ia32.cc
@@ -546,6 +546,9 @@ TEST(DisasmIa320) {
     __ pinsrw(xmm5, edx, 5);
     __ pinsrw(xmm5, Operand(edx, 4), 5);
 
+    __ movmskps(edx, xmm5);
+    __ pmovmskb(edx, xmm5);
+
 #define EMIT_SSE2_INSTR(instruction, notUsed1, notUsed2, notUsed3) \
   __ instruction(xmm5, xmm1);                                      \
   __ instruction(xmm5, Operand(edx, 4));
@@ -782,6 +785,10 @@ TEST(DisasmIa320) {
       __ vmovd(xmm0, Operand(ebx, ecx, times_4, 10000));
       __ vmovd(eax, xmm1);
       __ vmovd(Operand(ebx, ecx, times_4, 10000), xmm1);
+
+      __ vmovmskps(edx, xmm5);
+      __ vpmovmskb(ebx, xmm1);
+
 #define EMIT_SSE2_AVXINSTR(instruction, notUsed1, notUsed2, notUsed3) \
   __ v##instruction(xmm7, xmm5, xmm1);                                \
   __ v##instruction(xmm7, xmm5, Operand(edx, 4));
diff --git a/deps/v8/test/cctest/test-disasm-x64.cc b/deps/v8/test/cctest/test-disasm-x64.cc
index b9cf05bcc90..8e9eadca25e 100644
--- a/deps/v8/test/cctest/test-disasm-x64.cc
+++ b/deps/v8/test/cctest/test-disasm-x64.cc
@@ -391,6 +391,8 @@ TEST(DisasmX64) {
     // Move operation
     __ cvttss2si(rdx, Operand(rbx, rcx, times_4, 10000));
     __ cvttss2si(rdx, xmm1);
+    __ cvtqsi2ss(xmm1, Operand(rbx, rcx, times_4, 10000));
+    __ cvtqsi2ss(xmm1, rdx);
     __ cvttps2dq(xmm0, xmm1);
     __ cvttps2dq(xmm0, Operand(rbx, rcx, times_4, 10000));
     __ movaps(xmm0, xmm1);
@@ -403,6 +405,8 @@ TEST(DisasmX64) {
     __ ucomiss(xmm0, xmm1);
     __ ucomiss(xmm0, Operand(rbx, rcx, times_4, 10000));
 
+    __ movmskps(rdx, xmm9);
+
 #define EMIT_SSE_INSTR(instruction, notUsed1, notUsed2) \
   __ instruction(xmm1, xmm0);                           \
   __ instruction(xmm1, Operand(rbx, rcx, times_4, 10000));
@@ -423,8 +427,15 @@ TEST(DisasmX64) {
     __ cvttsd2si(rdx, xmm1);
     __ cvttsd2siq(rdx, xmm1);
     __ cvttsd2siq(rdx, Operand(rbx, rcx, times_4, 10000));
+    __ cvtlsi2sd(xmm1, Operand(rbx, rcx, times_4, 10000));
+    __ cvtlsi2sd(xmm1, rdx);
     __ cvtqsi2sd(xmm1, Operand(rbx, rcx, times_4, 10000));
     __ cvtqsi2sd(xmm1, rdx);
+    __ cvtss2sd(xmm1, xmm9);
+    __ cvtss2sd(xmm1, Operand(rbx, rcx, times_4, 10000));
+    __ cvtsd2si(rdx, xmm9);
+    __ cvtsd2siq(rdx, xmm9);
+
     __ movsd(xmm1, Operand(rbx, rcx, times_4, 10000));
     __ movsd(Operand(rbx, rcx, times_4, 10000), xmm1);
     // 128 bit move instructions.
@@ -434,6 +445,12 @@ TEST(DisasmX64) {
     __ movdqa(Operand(rbx, rcx, times_4, 10000), xmm0);
 
     __ ucomisd(xmm0, xmm1);
+    __ ucomisd(xmm8, Operand(rbx, rdx, times_4, 10000));
+
+    __ cmpltsd(xmm3, xmm11);
+
+    __ movmskpd(rdx, xmm9);
+    __ pmovmskb(rdx, xmm9);
 
     __ pcmpeqd(xmm1, xmm0);
 
@@ -571,6 +588,9 @@ TEST(DisasmX64) {
       __ blendvpd(xmm5, xmm1);
       __ blendvpd(xmm5, Operand(rdx, 4));
 
+      __ roundss(xmm8, xmm3, kRoundDown);
+      __ roundsd(xmm8, xmm3, kRoundDown);
+
       SSE4_INSTRUCTION_LIST(EMIT_SSE34_INSTR)
       SSE4_UNOP_INSTRUCTION_LIST(EMIT_SSE34_INSTR)
       SSE4_EXTRACT_INSTRUCTION_LIST(EMIT_SSE34_IMM_INSTR)
@@ -650,6 +670,7 @@ TEST(DisasmX64) {
       __ vmovupd(xmm0, Operand(rbx, rcx, times_4, 10000));
       __ vmovupd(Operand(rbx, rcx, times_4, 10000), xmm0);
       __ vmovmskpd(r9, xmm4);
+      __ vpmovmskb(r10, xmm9);
 
       __ vmovups(xmm5, xmm1);
       __ vmovups(xmm5, Operand(rdx, 4));
diff --git a/deps/v8/test/cctest/test-elements-kind.cc b/deps/v8/test/cctest/test-elements-kind.cc
index 2f6ec6c164b..a9460a89f97 100644
--- a/deps/v8/test/cctest/test-elements-kind.cc
+++ b/deps/v8/test/cctest/test-elements-kind.cc
@@ -27,19 +27,6 @@ namespace test_elements_kind {
 
 namespace {
 
-Handle<String> MakeString(const char* str) {
-  Isolate* isolate = CcTest::i_isolate();
-  Factory* factory = isolate->factory();
-  return factory->InternalizeUtf8String(str);
-}
-
-
-Handle<String> MakeName(const char* str, int suffix) {
-  EmbeddedVector<char, 128> buffer;
-  SNPrintF(buffer, "%s%d", str, suffix);
-  return MakeString(buffer.begin());
-}
-
 template <typename T, typename M>
 bool EQUALS(Isolate* isolate, Handle<T> left, Handle<M> right) {
   if (*left == *right) return true;
@@ -127,7 +114,7 @@ TEST(JSObjectAddingProperties) {
 
   // for the default constructor function no in-object properties are reserved
   // hence adding a single property will initialize the property-array
-  Handle<String> name = MakeName("property", 0);
+  Handle<String> name = CcTest::MakeName("property", 0);
   JSObject::DefinePropertyOrElementIgnoreAttributes(object, name, value, NONE)
       .Check();
   CHECK_NE(object->map(), *previous_map);
@@ -162,7 +149,7 @@ TEST(JSObjectInObjectAddingProperties) {
   // we have reserved space for in-object properties, hence adding up to
   // |nof_inobject_properties| will not create a property store
   for (int i = 0; i < nof_inobject_properties; i++) {
-    Handle<String> name = MakeName("property", i);
+    Handle<String> name = CcTest::MakeName("property", i);
     JSObject::DefinePropertyOrElementIgnoreAttributes(object, name, value, NONE)
         .Check();
   }
@@ -174,7 +161,7 @@ TEST(JSObjectInObjectAddingProperties) {
   // adding one more property will not fit in the in-object properties, thus
   // creating a property store
   int index = nof_inobject_properties + 1;
-  Handle<String> name = MakeName("property", index);
+  Handle<String> name = CcTest::MakeName("property", index);
   JSObject::DefinePropertyOrElementIgnoreAttributes(object, name, value, NONE)
       .Check();
   CHECK_NE(object->map(), *previous_map);
@@ -205,7 +192,7 @@ TEST(JSObjectAddingElements) {
   CHECK(EQUALS(isolate, object->elements(), empty_fixed_array));
 
   // Adding an indexed element initializes the elements array
-  name = MakeString("0");
+  name = CcTest::MakeString("0");
   JSObject::DefinePropertyOrElementIgnoreAttributes(object, name, value, NONE)
       .Check();
   // no change in elements_kind => no map transition
@@ -217,7 +204,7 @@ TEST(JSObjectAddingElements) {
   // Adding more consecutive elements without a change in the backing store
   int non_dict_backing_store_limit = 100;
   for (int i = 1; i < non_dict_backing_store_limit; i++) {
-    name = MakeName("", i);
+    name = CcTest::MakeName("", i);
     JSObject::DefinePropertyOrElementIgnoreAttributes(object, name, value, NONE)
         .Check();
   }
@@ -229,7 +216,7 @@ TEST(JSObjectAddingElements) {
 
   // Adding an element at an very large index causes a change to
   // DICTIONARY_ELEMENTS
-  name = MakeString("100000000");
+  name = CcTest::MakeString("100000000");
   JSObject::DefinePropertyOrElementIgnoreAttributes(object, name, value, NONE)
       .Check();
   // change in elements_kind => map transition
@@ -260,7 +247,7 @@ TEST(JSArrayAddingProperties) {
 
   // for the default constructor function no in-object properties are reserved
   // hence adding a single property will initialize the property-array
-  Handle<String> name = MakeName("property", 0);
+  Handle<String> name = CcTest::MakeName("property", 0);
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value, NONE)
       .Check();
   // No change in elements_kind but added property => new map
@@ -292,7 +279,7 @@ TEST(JSArrayAddingElements) {
   CHECK_EQ(0, Smi::ToInt(array->length()));
 
   // Adding an indexed element initializes the elements array
-  name = MakeString("0");
+  name = CcTest::MakeString("0");
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value, NONE)
       .Check();
   // no change in elements_kind => no map transition
@@ -305,7 +292,7 @@ TEST(JSArrayAddingElements) {
   // Adding more consecutive elements without a change in the backing store
   int non_dict_backing_store_limit = 100;
   for (int i = 1; i < non_dict_backing_store_limit; i++) {
-    name = MakeName("", i);
+    name = CcTest::MakeName("", i);
     JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value, NONE)
         .Check();
   }
@@ -319,7 +306,7 @@ TEST(JSArrayAddingElements) {
   // Adding an element at an very large index causes a change to
   // DICTIONARY_ELEMENTS
   int index = 100000000;
-  name = MakeName("", index);
+  name = CcTest::MakeName("", index);
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value, NONE)
       .Check();
   // change in elements_kind => map transition
@@ -340,7 +327,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastSmiElements) {
 
   Handle<String> name;
   Handle<Object> value_smi(Smi::FromInt(42), isolate);
-  Handle<Object> value_string(MakeString("value"));
+  Handle<Object> value_string(CcTest::MakeString("value"));
   Handle<Object> value_double = factory->NewNumber(3.1415);
 
   Handle<JSArray> array =
@@ -350,7 +337,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastSmiElements) {
   CHECK_EQ(0, Smi::ToInt(array->length()));
 
   // `array[0] = smi_value` doesn't change the elements_kind
-  name = MakeString("0");
+  name = CcTest::MakeString("0");
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value_smi,
                                                     NONE)
       .Check();
@@ -360,7 +347,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastSmiElements) {
   CHECK_EQ(1, Smi::ToInt(array->length()));
 
   // `delete array[0]` does not alter length, but changes the elments_kind
-  name = MakeString("0");
+  name = CcTest::MakeString("0");
   CHECK(JSReceiver::DeletePropertyOrElement(array, name).FromMaybe(false));
   CHECK_NE(array->map(), *previous_map);
   CHECK_EQ(HOLEY_SMI_ELEMENTS, array->map().elements_kind());
@@ -368,11 +355,11 @@ TEST(JSArrayAddingElementsGeneralizingiFastSmiElements) {
   previous_map = handle(array->map(), isolate);
 
   // add a couple of elements again
-  name = MakeString("0");
+  name = CcTest::MakeString("0");
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value_smi,
                                                     NONE)
       .Check();
-  name = MakeString("1");
+  name = CcTest::MakeString("1");
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value_smi,
                                                     NONE)
       .Check();
@@ -381,7 +368,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastSmiElements) {
   CHECK_EQ(2, Smi::ToInt(array->length()));
 
   // Adding a string to the array changes from FAST_HOLEY_SMI to FAST_HOLEY
-  name = MakeString("0");
+  name = CcTest::MakeString("0");
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value_string,
                                                     NONE)
       .Check();
@@ -391,14 +378,14 @@ TEST(JSArrayAddingElementsGeneralizingiFastSmiElements) {
   previous_map = handle(array->map(), isolate);
 
   // We don't transition back to FAST_SMI even if we remove the string
-  name = MakeString("0");
+  name = CcTest::MakeString("0");
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value_smi,
                                                     NONE)
       .Check();
   CHECK_EQ(array->map(), *previous_map);
 
   // Adding a double doesn't change the map either
-  name = MakeString("0");
+  name = CcTest::MakeString("0");
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value_double,
                                                     NONE)
       .Check();
@@ -414,7 +401,7 @@ TEST(JSArrayAddingElementsGeneralizingFastElements) {
 
   Handle<String> name;
   Handle<Object> value_smi(Smi::FromInt(42), isolate);
-  Handle<Object> value_string(MakeString("value"));
+  Handle<Object> value_string(CcTest::MakeString("value"));
 
   Handle<JSArray> array =
       factory->NewJSArray(ElementsKind::PACKED_ELEMENTS, 0, 0);
@@ -423,7 +410,7 @@ TEST(JSArrayAddingElementsGeneralizingFastElements) {
   CHECK_EQ(0, Smi::ToInt(array->length()));
 
   // `array[0] = smi_value` doesn't change the elements_kind
-  name = MakeString("0");
+  name = CcTest::MakeString("0");
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value_smi,
                                                     NONE)
       .Check();
@@ -433,7 +420,7 @@ TEST(JSArrayAddingElementsGeneralizingFastElements) {
   CHECK_EQ(1, Smi::ToInt(array->length()));
 
   // `delete array[0]` does not alter length, but changes the elments_kind
-  name = MakeString("0");
+  name = CcTest::MakeString("0");
   CHECK(JSReceiver::DeletePropertyOrElement(array, name).FromMaybe(false));
   CHECK_NE(array->map(), *previous_map);
   CHECK_EQ(HOLEY_ELEMENTS, array->map().elements_kind());
@@ -441,11 +428,11 @@ TEST(JSArrayAddingElementsGeneralizingFastElements) {
   previous_map = handle(array->map(), isolate);
 
   // add a couple of elements, elements_kind stays HOLEY
-  name = MakeString("0");
+  name = CcTest::MakeString("0");
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value_string,
                                                     NONE)
       .Check();
-  name = MakeString("1");
+  name = CcTest::MakeString("1");
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value_smi,
                                                     NONE)
       .Check();
@@ -463,7 +450,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastDoubleElements) {
 
   Handle<String> name;
   Handle<Object> value_smi(Smi::FromInt(42), isolate);
-  Handle<Object> value_string(MakeString("value"));
+  Handle<Object> value_string(CcTest::MakeString("value"));
   Handle<Object> value_double = factory->NewNumber(3.1415);
 
   Handle<JSArray> array =
@@ -471,7 +458,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastDoubleElements) {
   Handle<Map> previous_map(array->map(), isolate);
 
   // `array[0] = value_double` changes |elements_kind| to PACKED_DOUBLE_ELEMENTS
-  name = MakeString("0");
+  name = CcTest::MakeString("0");
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value_double,
                                                     NONE)
       .Check();
@@ -481,7 +468,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastDoubleElements) {
   previous_map = handle(array->map(), isolate);
 
   // `array[1] = value_smi` doesn't alter the |elements_kind|
-  name = MakeString("1");
+  name = CcTest::MakeString("1");
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value_smi,
                                                     NONE)
       .Check();
@@ -490,7 +477,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastDoubleElements) {
   CHECK_EQ(2, Smi::ToInt(array->length()));
 
   // `delete array[0]` does not alter length, but changes the elments_kind
-  name = MakeString("0");
+  name = CcTest::MakeString("0");
   CHECK(JSReceiver::DeletePropertyOrElement(array, name).FromMaybe(false));
   CHECK_NE(array->map(), *previous_map);
   CHECK_EQ(HOLEY_DOUBLE_ELEMENTS, array->map().elements_kind());
@@ -498,7 +485,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastDoubleElements) {
   previous_map = handle(array->map(), isolate);
 
   // filling the hole `array[0] = value_smi` again doesn't transition back
-  name = MakeString("0");
+  name = CcTest::MakeString("0");
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value_double,
                                                     NONE)
       .Check();
@@ -507,7 +494,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastDoubleElements) {
   CHECK_EQ(2, Smi::ToInt(array->length()));
 
   // Adding a string to the array changes to elements_kind PACKED_ELEMENTS
-  name = MakeString("1");
+  name = CcTest::MakeString("1");
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value_string,
                                                     NONE)
       .Check();
@@ -517,7 +504,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastDoubleElements) {
   previous_map = handle(array->map(), isolate);
 
   // Adding a double doesn't change the map
-  name = MakeString("0");
+  name = CcTest::MakeString("0");
   JSObject::DefinePropertyOrElementIgnoreAttributes(array, name, value_double,
                                                     NONE)
       .Check();
diff --git a/deps/v8/test/cctest/test-field-type-tracking.cc b/deps/v8/test/cctest/test-field-type-tracking.cc
index 840478a5203..a8ef298fb0d 100644
--- a/deps/v8/test/cctest/test-field-type-tracking.cc
+++ b/deps/v8/test/cctest/test-field-type-tracking.cc
@@ -31,12 +31,10 @@ namespace test_field_type_tracking {
 // and observed transitions caused generalization of all fields).
 const bool IS_PROTO_TRANS_ISSUE_FIXED = false;
 
-
 // TODO(ishell): fix this once TransitionToAccessorProperty is able to always
 // keep map in fast mode.
 const bool IS_ACCESSOR_FIELD_SUPPORTED = false;
 
-
 // Number of properties used in the tests.
 const int kPropCount = 7;
 
@@ -45,20 +43,6 @@ const int kPropCount = 7;
 // Helper functions.
 //
 
-static Handle<String> MakeString(const char* str) {
-  Isolate* isolate = CcTest::i_isolate();
-  Factory* factory = isolate->factory();
-  return factory->InternalizeUtf8String(str);
-}
-
-
-static Handle<String> MakeName(const char* str, int suffix) {
-  EmbeddedVector<char, 128> buffer;
-  SNPrintF(buffer, "%s%d", str, suffix);
-  return MakeString(buffer.begin());
-}
-
-
 static Handle<AccessorPair> CreateAccessorPair(bool with_getter,
                                                bool with_setter) {
   Isolate* isolate = CcTest::i_isolate();
@@ -341,7 +325,7 @@ class Expectations {
     SetDataField(property_index, attributes, constness, representation,
                  field_type);
 
-    Handle<String> name = MakeName("prop", property_index);
+    Handle<String> name = CcTest::MakeName("prop", property_index);
     return Map::CopyWithField(isolate_, map, name, field_type, attributes,
                               constness, representation, INSERT_TRANSITION)
         .ToHandleChecked();
@@ -353,7 +337,7 @@ class Expectations {
     int property_index = number_of_properties_++;
     SetDataConstant(property_index, attributes, value);
 
-    Handle<String> name = MakeName("prop", property_index);
+    Handle<String> name = CcTest::MakeName("prop", property_index);
     return Map::CopyWithConstant(isolate_, map, name, value, attributes,
                                  INSERT_TRANSITION)
         .ToHandleChecked();
@@ -370,7 +354,7 @@ class Expectations {
     SetDataField(property_index, attributes, constness, representation,
                  heap_type);
 
-    Handle<String> name = MakeName("prop", property_index);
+    Handle<String> name = CcTest::MakeName("prop", property_index);
     return Map::TransitionToDataProperty(isolate_, map, name, value, attributes,
                                          constness, StoreOrigin::kNamed);
   }
@@ -382,7 +366,7 @@ class Expectations {
     int property_index = number_of_properties_++;
     SetDataConstant(property_index, attributes, value);
 
-    Handle<String> name = MakeName("prop", property_index);
+    Handle<String> name = CcTest::MakeName("prop", property_index);
     return Map::TransitionToDataProperty(isolate_, map, name, value, attributes,
                                          PropertyConstness::kConst,
                                          StoreOrigin::kNamed);
@@ -398,7 +382,7 @@ class Expectations {
     SetDataField(property_index, attributes, constness, representation,
                  heap_type);
 
-    Handle<String> name = MakeName("prop", property_index);
+    Handle<String> name = CcTest::MakeName("prop", property_index);
     Map target = TransitionsAccessor(isolate_, map)
                      .SearchTransition(*name, kData, attributes);
     CHECK(!target.is_null());
@@ -412,7 +396,7 @@ class Expectations {
     int property_index = number_of_properties_++;
     SetAccessorConstant(property_index, attributes, pair);
 
-    Handle<String> name = MakeName("prop", property_index);
+    Handle<String> name = CcTest::MakeName("prop", property_index);
 
     Descriptor d = Descriptor::AccessorConstant(name, pair, attributes);
     return Map::CopyInsertDescriptor(isolate_, map, &d, INSERT_TRANSITION);
@@ -426,7 +410,7 @@ class Expectations {
     int property_index = number_of_properties_++;
     SetAccessorConstant(property_index, attributes, getter, setter);
 
-    Handle<String> name = MakeName("prop", property_index);
+    Handle<String> name = CcTest::MakeName("prop", property_index);
 
     CHECK(!getter->IsNull(isolate_) || !setter->IsNull(isolate_));
     Factory* factory = isolate_->factory();
@@ -453,7 +437,7 @@ class Expectations {
     int property_index = number_of_properties_++;
     SetAccessorConstant(property_index, attributes, pair);
 
-    Handle<String> name = MakeName("prop", property_index);
+    Handle<String> name = CcTest::MakeName("prop", property_index);
 
     Isolate* isolate = CcTest::i_isolate();
     Handle<Object> getter(pair->getter(), isolate);
@@ -606,6 +590,33 @@ Handle<Code> CreateDummyOptimizedCode(Isolate* isolate) {
       .Build();
 }
 
+static void CheckCodeObjectForDeopt(const CRFTData& from,
+                                    const CRFTData& expected,
+                                    Handle<Code> code_field_type,
+                                    Handle<Code> code_field_repr,
+                                    Handle<Code> code_field_const,
+                                    bool expected_deopt) {
+  if (!from.type->Equals(*expected.type)) {
+    CHECK_EQ(expected_deopt, code_field_type->marked_for_deoptimization());
+  } else {
+    CHECK(!code_field_type->marked_for_deoptimization());
+  }
+
+  if (!from.representation.Equals(expected.representation)) {
+    CHECK_EQ(expected_deopt, code_field_repr->marked_for_deoptimization());
+  } else {
+    CHECK(!code_field_repr->marked_for_deoptimization());
+  }
+
+  if (!code_field_const.is_null()) {
+    if (from.constness != expected.constness) {
+      CHECK_EQ(expected_deopt, code_field_const->marked_for_deoptimization());
+    } else {
+      CHECK(!code_field_const->marked_for_deoptimization());
+    }
+  }
+}
+
 // This test ensures that field generalization at |property_index| is done
 // correctly independently of the fact that the |map| is detached from
 // transition tree or not.
@@ -668,13 +679,23 @@ void TestGeneralizeField(int detach_property_at_index, int property_index,
 
   // Create dummy optimized code object to test correct dependencies
   // on the field owner.
-  Handle<Code> code = CreateDummyOptimizedCode(isolate);
+  Handle<Code> code_field_type = CreateDummyOptimizedCode(isolate);
+  Handle<Code> code_field_repr = CreateDummyOptimizedCode(isolate);
+  Handle<Code> code_field_const = CreateDummyOptimizedCode(isolate);
   Handle<Map> field_owner(
       map->FindFieldOwner(isolate, InternalIndex(property_index)), isolate);
-  DependentCode::InstallDependency(isolate, MaybeObjectHandle::Weak(code),
-                                   field_owner,
-                                   DependentCode::kFieldOwnerGroup);
-  CHECK(!code->marked_for_deoptimization());
+  DependentCode::InstallDependency(isolate,
+                                   MaybeObjectHandle::Weak(code_field_type),
+                                   field_owner, DependentCode::kFieldTypeGroup);
+  DependentCode::InstallDependency(
+      isolate, MaybeObjectHandle::Weak(code_field_repr), field_owner,
+      DependentCode::kFieldRepresentationGroup);
+  DependentCode::InstallDependency(
+      isolate, MaybeObjectHandle::Weak(code_field_const), field_owner,
+      DependentCode::kFieldConstGroup);
+  CHECK(!code_field_type->marked_for_deoptimization());
+  CHECK(!code_field_repr->marked_for_deoptimization());
+  CHECK(!code_field_const->marked_for_deoptimization());
 
   // Create new maps by generalizing representation of propX field.
   Handle<Map> new_map =
@@ -687,29 +708,28 @@ void TestGeneralizeField(int detach_property_at_index, int property_index,
   CHECK(!new_map->is_deprecated());
   CHECK(expectations.Check(*new_map));
 
+  bool should_deopt = false;
   if (is_detached_map) {
     CHECK(!map->is_stable());
     CHECK(map->is_deprecated());
     CHECK_NE(*map, *new_map);
-    CHECK_EQ(expected_field_owner_dependency && !field_owner->is_deprecated(),
-             code->marked_for_deoptimization());
-
+    should_deopt =
+        expected_field_owner_dependency && !field_owner->is_deprecated();
   } else if (expected_deprecation) {
     CHECK(!map->is_stable());
     CHECK(map->is_deprecated());
     CHECK(field_owner->is_deprecated());
-    CHECK_NE(*map, *new_map);
-    CHECK(!code->marked_for_deoptimization());
-
+    should_deopt = false;
   } else {
     CHECK(!field_owner->is_deprecated());
     CHECK(map->is_stable());  // Map did not change, must be left stable.
     CHECK_EQ(*map, *new_map);
-
-    CHECK_EQ(expected_field_owner_dependency,
-             code->marked_for_deoptimization());
+    should_deopt = expected_field_owner_dependency;
   }
 
+  CheckCodeObjectForDeopt(from, expected, code_field_type, code_field_repr,
+                          code_field_const, should_deopt);
+
   {
     // Check that all previous maps are not stable.
     Map tmp = *new_map;
@@ -1002,7 +1022,6 @@ TEST(GeneralizeFieldWithAccessorProperties) {
   }
 }
 
-
 ////////////////////////////////////////////////////////////////////////////////
 // A set of tests for attribute reconfiguration case.
 //
@@ -1035,7 +1054,6 @@ void TestReconfigureDataFieldAttribute_GeneralizeField(
   CHECK(map->is_stable());
   CHECK(expectations.Check(*map));
 
-
   // Create another branch in transition tree (property at index |kSplitProp|
   // has different attributes), initialize expectations.
   const int kSplitProp = kPropCount / 2;
@@ -1059,13 +1077,23 @@ void TestReconfigureDataFieldAttribute_GeneralizeField(
 
   // Create dummy optimized code object to test correct dependencies
   // on the field owner.
-  Handle<Code> code = CreateDummyOptimizedCode(isolate);
+  Handle<Code> code_field_type = CreateDummyOptimizedCode(isolate);
+  Handle<Code> code_field_repr = CreateDummyOptimizedCode(isolate);
+  Handle<Code> code_field_const = CreateDummyOptimizedCode(isolate);
   Handle<Map> field_owner(
       map->FindFieldOwner(isolate, InternalIndex(kSplitProp)), isolate);
-  DependentCode::InstallDependency(isolate, MaybeObjectHandle::Weak(code),
-                                   field_owner,
-                                   DependentCode::kFieldOwnerGroup);
-  CHECK(!code->marked_for_deoptimization());
+  DependentCode::InstallDependency(isolate,
+                                   MaybeObjectHandle::Weak(code_field_type),
+                                   field_owner, DependentCode::kFieldTypeGroup);
+  DependentCode::InstallDependency(
+      isolate, MaybeObjectHandle::Weak(code_field_repr), field_owner,
+      DependentCode::kFieldRepresentationGroup);
+  DependentCode::InstallDependency(
+      isolate, MaybeObjectHandle::Weak(code_field_const), field_owner,
+      DependentCode::kFieldConstGroup);
+  CHECK(!code_field_type->marked_for_deoptimization());
+  CHECK(!code_field_repr->marked_for_deoptimization());
+  CHECK(!code_field_const->marked_for_deoptimization());
 
   // Reconfigure attributes of property |kSplitProp| of |map2| to NONE, which
   // should generalize representations in |map1|.
@@ -1085,7 +1113,9 @@ void TestReconfigureDataFieldAttribute_GeneralizeField(
                               expected.type);
   }
   CHECK(map->is_deprecated());
-  CHECK(!code->marked_for_deoptimization());
+  CHECK(!code_field_type->marked_for_deoptimization());
+  CHECK(!code_field_repr->marked_for_deoptimization());
+  CHECK(!code_field_const->marked_for_deoptimization());
   CHECK_NE(*map, *new_map);
 
   CHECK(!new_map->is_deprecated());
@@ -1125,7 +1155,6 @@ void TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
   CHECK(map->is_stable());
   CHECK(expectations.Check(*map));
 
-
   // Create another branch in transition tree (property at index |kSplitProp|
   // has different attributes), initialize expectations.
   const int kSplitProp = kPropCount / 2;
@@ -1149,13 +1178,23 @@ void TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
 
   // Create dummy optimized code object to test correct dependencies
   // on the field owner.
-  Handle<Code> code = CreateDummyOptimizedCode(isolate);
+  Handle<Code> code_field_type = CreateDummyOptimizedCode(isolate);
+  Handle<Code> code_field_repr = CreateDummyOptimizedCode(isolate);
+  Handle<Code> code_field_const = CreateDummyOptimizedCode(isolate);
   Handle<Map> field_owner(
       map->FindFieldOwner(isolate, InternalIndex(kSplitProp)), isolate);
-  DependentCode::InstallDependency(isolate, MaybeObjectHandle::Weak(code),
-                                   field_owner,
-                                   DependentCode::kFieldOwnerGroup);
-  CHECK(!code->marked_for_deoptimization());
+  DependentCode::InstallDependency(isolate,
+                                   MaybeObjectHandle::Weak(code_field_type),
+                                   field_owner, DependentCode::kFieldTypeGroup);
+  DependentCode::InstallDependency(
+      isolate, MaybeObjectHandle::Weak(code_field_repr), field_owner,
+      DependentCode::kFieldRepresentationGroup);
+  DependentCode::InstallDependency(
+      isolate, MaybeObjectHandle::Weak(code_field_const), field_owner,
+      DependentCode::kFieldConstGroup);
+  CHECK(!code_field_type->marked_for_deoptimization());
+  CHECK(!code_field_repr->marked_for_deoptimization());
+  CHECK(!code_field_const->marked_for_deoptimization());
 
   // Reconfigure attributes of property |kSplitProp| of |map2| to NONE, which
   // should generalize representations in |map1|.
@@ -1179,7 +1218,8 @@ void TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
   }
   CHECK(!map->is_deprecated());
   CHECK_EQ(*map, *new_map);
-  CHECK_EQ(expected_field_owner_dependency, code->marked_for_deoptimization());
+  CheckCodeObjectForDeopt(from, expected, code_field_type, code_field_repr,
+                          code_field_const, expected_field_owner_dependency);
 
   CHECK(!new_map->is_deprecated());
   CHECK(expectations.Check(*new_map));
@@ -1364,7 +1404,6 @@ TEST(ReconfigureDataFieldAttribute_GeneralizeHeapObjectFieldToTagged) {
       {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 }
 
-
 // Checks that given |map| is deprecated and that it updates to given |new_map|
 // which in turn should match expectations.
 struct CheckDeprecated {
@@ -1383,7 +1422,6 @@ struct CheckDeprecated {
   }
 };
 
-
 // Checks that given |map| is NOT deprecated, equals to given |new_map| and
 // matches expectations.
 struct CheckSameMap {
@@ -1403,7 +1441,6 @@ struct CheckSameMap {
   }
 };
 
-
 // Checks that given |map| is NOT deprecated and matches expectations.
 // |new_map| is unrelated to |map|.
 struct CheckUnrelated {
@@ -1471,7 +1508,6 @@ static void TestReconfigureProperty_CustomPropertyAfterTargetMap(
   CHECK(map->is_stable());
   CHECK(expectations.Check(*map));
 
-
   // Create branch to |map1|.
   Handle<Map> map1 = map;
   Expectations expectations1 = expectations;
@@ -1488,7 +1524,6 @@ static void TestReconfigureProperty_CustomPropertyAfterTargetMap(
   CHECK(map1->is_stable());
   CHECK(expectations1.Check(*map1));
 
-
   // Create another branch in transition tree (property at index |kSplitProp|
   // has different attributes), initialize expectations.
   Handle<Map> map2 = map;
@@ -1508,7 +1543,6 @@ static void TestReconfigureProperty_CustomPropertyAfterTargetMap(
   CHECK(map2->is_stable());
   CHECK(expectations2.Check(*map2));
 
-
   // Reconfigure attributes of property |kSplitProp| of |map2| to NONE, which
   // should generalize representations in |map1|.
   Handle<Map> new_map =
@@ -1555,7 +1589,6 @@ TEST(ReconfigureDataFieldAttribute_SameDataConstantAfterTargetMap) {
   TestReconfigureProperty_CustomPropertyAfterTargetMap(&config, &checker);
 }
 
-
 TEST(ReconfigureDataFieldAttribute_DataConstantToDataFieldAfterTargetMap) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
@@ -1600,7 +1633,6 @@ TEST(ReconfigureDataFieldAttribute_DataConstantToDataFieldAfterTargetMap) {
   TestReconfigureProperty_CustomPropertyAfterTargetMap(&config, &checker);
 }
 
-
 TEST(ReconfigureDataFieldAttribute_DataConstantToAccConstantAfterTargetMap) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
@@ -1795,13 +1827,23 @@ static void TestReconfigureElementsKind_GeneralizeFieldTrivial(
 
   // Create dummy optimized code object to test correct dependencies
   // on the field owner.
-  Handle<Code> code = CreateDummyOptimizedCode(isolate);
+  Handle<Code> code_field_type = CreateDummyOptimizedCode(isolate);
+  Handle<Code> code_field_repr = CreateDummyOptimizedCode(isolate);
+  Handle<Code> code_field_const = CreateDummyOptimizedCode(isolate);
   Handle<Map> field_owner(
       map->FindFieldOwner(isolate, InternalIndex(kDiffProp)), isolate);
-  DependentCode::InstallDependency(isolate, MaybeObjectHandle::Weak(code),
-                                   field_owner,
-                                   DependentCode::kFieldOwnerGroup);
-  CHECK(!code->marked_for_deoptimization());
+  DependentCode::InstallDependency(isolate,
+                                   MaybeObjectHandle::Weak(code_field_type),
+                                   field_owner, DependentCode::kFieldTypeGroup);
+  DependentCode::InstallDependency(
+      isolate, MaybeObjectHandle::Weak(code_field_repr), field_owner,
+      DependentCode::kFieldRepresentationGroup);
+  DependentCode::InstallDependency(
+      isolate, MaybeObjectHandle::Weak(code_field_const), field_owner,
+      DependentCode::kFieldConstGroup);
+  CHECK(!code_field_type->marked_for_deoptimization());
+  CHECK(!code_field_repr->marked_for_deoptimization());
+  CHECK(!code_field_const->marked_for_deoptimization());
 
   // Reconfigure elements kinds of |map2|, which should generalize
   // representations in |map|.
@@ -1823,7 +1865,9 @@ static void TestReconfigureElementsKind_GeneralizeFieldTrivial(
   CHECK(!map->is_deprecated());
   CHECK_EQ(*map, *new_map);
   CHECK_EQ(IsGeneralizableTo(to.constness, from.constness),
-           !code->marked_for_deoptimization());
+           !code_field_const->marked_for_deoptimization());
+  CheckCodeObjectForDeopt(from, expected, code_field_type, code_field_repr,
+                          Handle<Code>(), false);
 
   CHECK(!new_map->is_deprecated());
   CHECK(expectations.Check(*new_map));
@@ -2063,7 +2107,7 @@ TEST(ReconfigurePropertySplitMapTransitionsOverflow) {
         split_map = map2;
       }
 
-      Handle<String> name = MakeName("prop", i);
+      Handle<String> name = CcTest::MakeName("prop", i);
       Map target = TransitionsAccessor(isolate, map2)
                        .SearchTransition(*name, kData, NONE);
       CHECK(!target.is_null());
@@ -2090,7 +2134,7 @@ TEST(ReconfigurePropertySplitMapTransitionsOverflow) {
   // Fill in transition tree of |map2| so that it can't have more transitions.
   for (int i = 0; i < TransitionsAccessor::kMaxNumberOfTransitions; i++) {
     CHECK(TransitionsAccessor(isolate, map2).CanHaveMoreTransitions());
-    Handle<String> name = MakeName("foo", i);
+    Handle<String> name = CcTest::MakeName("foo", i);
     Map::CopyWithField(isolate, map2, name, any_type, NONE,
                        PropertyConstness::kMutable, Representation::Smi(),
                        INSERT_TRANSITION)
@@ -2288,7 +2332,6 @@ TEST(ElementsKindTransitionFromMapOwningDescriptor) {
   }
 }
 
-
 TEST(ElementsKindTransitionFromMapNotOwningDescriptor) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
@@ -2310,9 +2353,9 @@ TEST(ElementsKindTransitionFromMapNotOwningDescriptor) {
       // Add one more transition to |map| in order to prevent descriptors
       // ownership.
       CHECK(map->owns_descriptors());
-      Map::CopyWithField(isolate, map, MakeString("foo"), any_type, NONE,
-                         PropertyConstness::kMutable, Representation::Smi(),
-                         INSERT_TRANSITION)
+      Map::CopyWithField(isolate, map, CcTest::MakeString("foo"), any_type,
+                         NONE, PropertyConstness::kMutable,
+                         Representation::Smi(), INSERT_TRANSITION)
           .ToHandleChecked();
       CHECK(!map->owns_descriptors());
 
@@ -2423,9 +2466,9 @@ TEST(PrototypeTransitionFromMapNotOwningDescriptor) {
       // Add one more transition to |map| in order to prevent descriptors
       // ownership.
       CHECK(map->owns_descriptors());
-      Map::CopyWithField(isolate, map, MakeString("foo"), any_type, NONE,
-                         PropertyConstness::kMutable, Representation::Smi(),
-                         INSERT_TRANSITION)
+      Map::CopyWithField(isolate, map, CcTest::MakeString("foo"), any_type,
+                         NONE, PropertyConstness::kMutable,
+                         Representation::Smi(), INSERT_TRANSITION)
           .ToHandleChecked();
       CHECK(!map->owns_descriptors());
 
diff --git a/deps/v8/test/cctest/test-flags.cc b/deps/v8/test/cctest/test-flags.cc
index 93c7048f814..9112dc7a571 100644
--- a/deps/v8/test/cctest/test-flags.cc
+++ b/deps/v8/test/cctest/test-flags.cc
@@ -203,7 +203,6 @@ TEST(FlagsJitlessImplications) {
     // definition order in flag-definitions.h.
     CHECK(!FLAG_opt);
     CHECK(!FLAG_validate_asm);
-    CHECK(FLAG_wasm_interpret_all);
     CHECK(!FLAG_asm_wasm_lazy_compilation);
     CHECK(!FLAG_wasm_lazy_compilation);
   }
diff --git a/deps/v8/test/cctest/test-inspector.cc b/deps/v8/test/cctest/test-inspector.cc
index 6dd2aefb9e1..e36ce19eca0 100644
--- a/deps/v8/test/cctest/test-inspector.cc
+++ b/deps/v8/test/cctest/test-inspector.cc
@@ -4,11 +4,11 @@
 
 #include <memory>
 
-#include "test/cctest/cctest.h"
-
 #include "include/v8-inspector.h"
 #include "include/v8.h"
 #include "src/inspector/protocol/Runtime.h"
+#include "src/inspector/string-util.h"
+#include "test/cctest/cctest.h"
 
 using v8_inspector::StringBuffer;
 using v8_inspector::StringView;
@@ -63,3 +63,108 @@ TEST(WrapInsideWrapOnInterrupt) {
   isolate->RequestInterrupt(&WrapOnInterrupt, session.get());
   session->wrapObject(env.local(), v8::Null(isolate), object_group_view, false);
 }
+
+TEST(BinaryFromBase64) {
+  auto checkBinary = [](const v8_inspector::protocol::Binary& binary,
+                        const std::vector<uint8_t>& values) {
+    std::vector<uint8_t> binary_vector(binary.data(),
+                                       binary.data() + binary.size());
+    CHECK_EQ(binary_vector, values);
+  };
+
+  {
+    bool success;
+    auto binary = v8_inspector::protocol::Binary::fromBase64("", &success);
+    CHECK(success);
+    checkBinary(binary, {});
+  }
+  {
+    bool success;
+    auto binary = v8_inspector::protocol::Binary::fromBase64("YQ==", &success);
+    CHECK(success);
+    checkBinary(binary, {'a'});
+  }
+  {
+    bool success;
+    auto binary = v8_inspector::protocol::Binary::fromBase64("YWI=", &success);
+    CHECK(success);
+    checkBinary(binary, {'a', 'b'});
+  }
+  {
+    bool success;
+    auto binary = v8_inspector::protocol::Binary::fromBase64("YWJj", &success);
+    CHECK(success);
+    checkBinary(binary, {'a', 'b', 'c'});
+  }
+  {
+    bool success;
+    // Wrong input length:
+    auto binary = v8_inspector::protocol::Binary::fromBase64("Y", &success);
+    CHECK(!success);
+  }
+  {
+    bool success;
+    // Invalid space:
+    auto binary = v8_inspector::protocol::Binary::fromBase64("=AAA", &success);
+    CHECK(!success);
+  }
+  {
+    bool success;
+    // Invalid space in a non-final block of four:
+    auto binary =
+        v8_inspector::protocol::Binary::fromBase64("AAA=AAAA", &success);
+    CHECK(!success);
+  }
+  {
+    bool success;
+    // Invalid invalid space in second to last position:
+    auto binary = v8_inspector::protocol::Binary::fromBase64("AA=A", &success);
+    CHECK(!success);
+  }
+  {
+    bool success;
+    // Invalid character:
+    auto binary = v8_inspector::protocol::Binary::fromBase64(" ", &success);
+    CHECK(!success);
+  }
+}
+
+TEST(BinaryToBase64) {
+  uint8_t input[] = {'a', 'b', 'c'};
+  {
+    auto binary = v8_inspector::protocol::Binary::fromSpan(input, 0);
+    v8_inspector::protocol::String base64 = binary.toBase64();
+    CHECK_EQ(base64.utf8(), "");
+  }
+  {
+    auto binary = v8_inspector::protocol::Binary::fromSpan(input, 1);
+    v8_inspector::protocol::String base64 = binary.toBase64();
+    CHECK_EQ(base64.utf8(), "YQ==");
+  }
+  {
+    auto binary = v8_inspector::protocol::Binary::fromSpan(input, 2);
+    v8_inspector::protocol::String base64 = binary.toBase64();
+    CHECK_EQ(base64.utf8(), "YWI=");
+  }
+  {
+    auto binary = v8_inspector::protocol::Binary::fromSpan(input, 3);
+    v8_inspector::protocol::String base64 = binary.toBase64();
+    CHECK_EQ(base64.utf8(), "YWJj");
+  }
+}
+
+TEST(BinaryBase64RoundTrip) {
+  std::array<uint8_t, 256> values;
+  for (uint16_t b = 0x0; b <= 0xFF; ++b) values[b] = b;
+  auto binary =
+      v8_inspector::protocol::Binary::fromSpan(values.data(), values.size());
+  v8_inspector::protocol::String base64 = binary.toBase64();
+  bool success = false;
+  auto roundtrip_binary =
+      v8_inspector::protocol::Binary::fromBase64(base64, &success);
+  CHECK(success);
+  CHECK_EQ(values.size(), roundtrip_binary.size());
+  for (size_t i = 0; i < values.size(); ++i) {
+    CHECK_EQ(values[i], roundtrip_binary.data()[i]);
+  }
+}
diff --git a/deps/v8/test/cctest/test-js-weak-refs.cc b/deps/v8/test/cctest/test-js-weak-refs.cc
index 6759c371281..d6c09a1fd4a 100644
--- a/deps/v8/test/cctest/test-js-weak-refs.cc
+++ b/deps/v8/test/cctest/test-js-weak-refs.cc
@@ -6,6 +6,7 @@
 #include "src/execution/microtask-queue.h"
 #include "src/handles/handles-inl.h"
 #include "src/heap/factory-inl.h"
+#include "src/heap/heap-inl.h"
 #include "src/objects/js-objects.h"
 #include "src/objects/js-weak-refs-inl.h"
 #include "test/cctest/cctest.h"
@@ -97,6 +98,33 @@ void NullifyWeakCell(Handle<WeakCell> weak_cell, Isolate* isolate) {
 #endif  // VERIFY_HEAP
 }
 
+Object PopClearedCellHoldings(
+    Handle<JSFinalizationRegistry> finalization_registry, Isolate* isolate) {
+  // PopClearedCell is implemented in Torque. Reproduce that implementation here
+  // for testing.
+  Handle<WeakCell> weak_cell =
+      handle(WeakCell::cast(finalization_registry->cleared_cells()), isolate);
+  DCHECK(weak_cell->prev().IsUndefined(isolate));
+  finalization_registry->set_cleared_cells(weak_cell->next());
+  weak_cell->set_next(ReadOnlyRoots(isolate).undefined_value());
+
+  if (finalization_registry->cleared_cells().IsWeakCell()) {
+    WeakCell cleared_cells_head =
+        WeakCell::cast(finalization_registry->cleared_cells());
+    DCHECK_EQ(cleared_cells_head.prev(), *weak_cell);
+    cleared_cells_head.set_prev(ReadOnlyRoots(isolate).undefined_value());
+  } else {
+    DCHECK(finalization_registry->cleared_cells().IsUndefined(isolate));
+  }
+
+  if (!weak_cell->unregister_token().IsUndefined(isolate)) {
+    JSFinalizationRegistry::RemoveCellFromUnregisterTokenMap(
+        isolate, finalization_registry->ptr(), weak_cell->ptr());
+  }
+
+  return weak_cell->holdings();
+}
+
 // Usage: VerifyWeakCellChain(isolate, list_head, n, cell1, cell2, ..., celln);
 // verifies that list_head == cell1 and cell1, cell2, ..., celln. form a list.
 void VerifyWeakCellChain(Isolate* isolate, Object list_head, int n_args, ...) {
@@ -361,15 +389,13 @@ TEST(TestJSFinalizationRegistryPopClearedCellHoldings1) {
   NullifyWeakCell(weak_cell3, isolate);
 
   CHECK(finalization_registry->NeedsCleanup());
-  Object cleared1 = JSFinalizationRegistry::PopClearedCellHoldings(
-      finalization_registry, isolate);
+  Object cleared1 = PopClearedCellHoldings(finalization_registry, isolate);
   CHECK_EQ(cleared1, *holdings3);
   CHECK(weak_cell3->prev().IsUndefined(isolate));
   CHECK(weak_cell3->next().IsUndefined(isolate));
 
   CHECK(finalization_registry->NeedsCleanup());
-  Object cleared2 = JSFinalizationRegistry::PopClearedCellHoldings(
-      finalization_registry, isolate);
+  Object cleared2 = PopClearedCellHoldings(finalization_registry, isolate);
   CHECK_EQ(cleared2, *holdings2);
   CHECK(weak_cell2->prev().IsUndefined(isolate));
   CHECK(weak_cell2->next().IsUndefined(isolate));
@@ -379,8 +405,7 @@ TEST(TestJSFinalizationRegistryPopClearedCellHoldings1) {
   NullifyWeakCell(weak_cell1, isolate);
 
   CHECK(finalization_registry->NeedsCleanup());
-  Object cleared3 = JSFinalizationRegistry::PopClearedCellHoldings(
-      finalization_registry, isolate);
+  Object cleared3 = PopClearedCellHoldings(finalization_registry, isolate);
   CHECK_EQ(cleared3, *holdings1);
   CHECK(weak_cell1->prev().IsUndefined(isolate));
   CHECK(weak_cell1->next().IsUndefined(isolate));
@@ -424,8 +449,7 @@ TEST(TestJSFinalizationRegistryPopClearedCellHoldings2) {
                            *weak_cell1);
   }
 
-  Object cleared1 = JSFinalizationRegistry::PopClearedCellHoldings(
-      finalization_registry, isolate);
+  Object cleared1 = PopClearedCellHoldings(finalization_registry, isolate);
   CHECK_EQ(cleared1, *holdings2);
 
   {
@@ -434,8 +458,7 @@ TEST(TestJSFinalizationRegistryPopClearedCellHoldings2) {
     VerifyWeakCellKeyChain(isolate, key_map, *token1, 1, *weak_cell1);
   }
 
-  Object cleared2 = JSFinalizationRegistry::PopClearedCellHoldings(
-      finalization_registry, isolate);
+  Object cleared2 = PopClearedCellHoldings(finalization_registry, isolate);
   CHECK_EQ(cleared2, *holdings1);
 
   {
@@ -621,8 +644,7 @@ TEST(TestWeakCellUnregisterPopped) {
   NullifyWeakCell(weak_cell1, isolate);
 
   CHECK(finalization_registry->NeedsCleanup());
-  Object cleared1 = JSFinalizationRegistry::PopClearedCellHoldings(
-      finalization_registry, isolate);
+  Object cleared1 = PopClearedCellHoldings(finalization_registry, isolate);
   CHECK_EQ(cleared1, *holdings1);
 
   VerifyWeakCellChain(isolate, finalization_registry->active_cells(), 0);
@@ -853,5 +875,98 @@ TEST(TestRemoveUnregisterToken) {
   }
 }
 
+TEST(JSWeakRefScavengedInWorklist) {
+  FLAG_harmony_weak_refs = true;
+  if (!FLAG_incremental_marking) {
+    return;
+  }
+
+  ManualGCScope manual_gc_scope;
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Heap* heap = isolate->heap();
+
+  {
+    HandleScope outer_scope(isolate);
+    Handle<JSWeakRef> weak_ref;
+
+    // Make a WeakRef that points to a target, both of which become unreachable.
+    {
+      HandleScope inner_scope(isolate);
+      Handle<JSObject> js_object =
+          isolate->factory()->NewJSObject(isolate->object_function());
+      Handle<JSWeakRef> inner_weak_ref = ConstructJSWeakRef(js_object, isolate);
+      CHECK(Heap::InYoungGeneration(*js_object));
+      CHECK(Heap::InYoungGeneration(*inner_weak_ref));
+
+      weak_ref = inner_scope.CloseAndEscape(inner_weak_ref);
+    }
+
+    // Do marking. This puts the WeakRef above into the js_weak_refs worklist
+    // since its target isn't marked.
+    CHECK(
+        heap->mark_compact_collector()->weak_objects()->js_weak_refs.IsEmpty());
+    heap::SimulateIncrementalMarking(heap, true);
+    CHECK(!heap->mark_compact_collector()
+               ->weak_objects()
+               ->js_weak_refs.IsEmpty());
+  }
+
+  // Now collect both weak_ref and its target. The worklist should be empty.
+  CcTest::CollectGarbage(NEW_SPACE);
+  CHECK(heap->mark_compact_collector()->weak_objects()->js_weak_refs.IsEmpty());
+
+  // The mark-compactor shouldn't see zapped WeakRefs in the worklist.
+  CcTest::CollectAllGarbage();
+}
+
+TEST(JSWeakRefTenuredInWorklist) {
+  FLAG_harmony_weak_refs = true;
+  if (!FLAG_incremental_marking) {
+    return;
+  }
+
+  ManualGCScope manual_gc_scope;
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Heap* heap = isolate->heap();
+
+  HandleScope outer_scope(isolate);
+  Handle<JSWeakRef> weak_ref;
+
+  // Make a WeakRef that points to a target. The target becomes unreachable.
+  {
+    HandleScope inner_scope(isolate);
+    Handle<JSObject> js_object =
+        isolate->factory()->NewJSObject(isolate->object_function());
+    Handle<JSWeakRef> inner_weak_ref = ConstructJSWeakRef(js_object, isolate);
+    CHECK(Heap::InYoungGeneration(*js_object));
+    CHECK(Heap::InYoungGeneration(*inner_weak_ref));
+
+    weak_ref = inner_scope.CloseAndEscape(inner_weak_ref);
+  }
+  JSWeakRef old_weak_ref_location = *weak_ref;
+
+  // Do marking. This puts the WeakRef above into the js_weak_refs worklist
+  // since its target isn't marked.
+  CHECK(heap->mark_compact_collector()->weak_objects()->js_weak_refs.IsEmpty());
+  heap::SimulateIncrementalMarking(heap, true);
+  CHECK(
+      !heap->mark_compact_collector()->weak_objects()->js_weak_refs.IsEmpty());
+
+  // Now collect weak_ref's target. We still have a Handle to weak_ref, so it is
+  // moved and remains on the worklist.
+  CcTest::CollectGarbage(NEW_SPACE);
+  JSWeakRef new_weak_ref_location = *weak_ref;
+  CHECK_NE(old_weak_ref_location, new_weak_ref_location);
+  CHECK(
+      !heap->mark_compact_collector()->weak_objects()->js_weak_refs.IsEmpty());
+
+  // The mark-compactor should see the moved WeakRef in the worklist.
+  CcTest::CollectAllGarbage();
+  CHECK(heap->mark_compact_collector()->weak_objects()->js_weak_refs.IsEmpty());
+  CHECK(weak_ref->target().IsUndefined(isolate));
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-log.cc b/deps/v8/test/cctest/test-log.cc
index 5531b7ec955..2daa69103ac 100644
--- a/deps/v8/test/cctest/test-log.cc
+++ b/deps/v8/test/cctest/test-log.cc
@@ -565,7 +565,7 @@ UNINITIALIZED_TEST(LogAll) {
   isolate->Dispose();
 }
 
-#if !defined(V8_TARGET_ARCH_ARM) && !defined(V8_TARGET_ARCH_S390X)
+#ifndef V8_TARGET_ARCH_ARM
 UNINITIALIZED_TEST(LogInterpretedFramesNativeStack) {
   SETUP_FLAGS();
   i::FLAG_interpreted_frames_native_stack = true;
@@ -650,7 +650,7 @@ UNINITIALIZED_TEST(LogInterpretedFramesNativeStackWithSerialization) {
   } while (!has_cache);
   delete cache;
 }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_S390X
+#endif  // V8_TARGET_ARCH_ARM
 
 UNINITIALIZED_TEST(ExternalCodeEventListener) {
   i::FLAG_log = false;
@@ -721,8 +721,10 @@ UNINITIALIZED_TEST(ExternalCodeEventListenerInnerFunctions) {
     v8::Local<v8::UnboundScript> script =
         v8::ScriptCompiler::CompileUnboundScript(isolate1, &source)
             .ToLocalChecked();
-    CHECK_EQ(code_event_handler.CountLines("Script", "f1"), 1);
-    CHECK_EQ(code_event_handler.CountLines("Script", "f2"), 1);
+    CHECK_EQ(code_event_handler.CountLines("Script", "f1"),
+             i::FLAG_stress_background_compile ? 2 : 1);
+    CHECK_EQ(code_event_handler.CountLines("Script", "f2"),
+             i::FLAG_stress_background_compile ? 2 : 1);
     cache = v8::ScriptCompiler::CreateCodeCache(script);
   }
   isolate1->Dispose();
@@ -753,7 +755,7 @@ UNINITIALIZED_TEST(ExternalCodeEventListenerInnerFunctions) {
   isolate2->Dispose();
 }
 
-#if !defined(V8_TARGET_ARCH_ARM) && !defined(V8_TARGET_ARCH_S390X)
+#ifndef V8_TARGET_ARCH_ARM
 UNINITIALIZED_TEST(ExternalCodeEventListenerWithInterpretedFramesNativeStack) {
   i::FLAG_log = false;
   i::FLAG_prof = false;
@@ -803,7 +805,7 @@ UNINITIALIZED_TEST(ExternalCodeEventListenerWithInterpretedFramesNativeStack) {
   }
   isolate->Dispose();
 }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_S390X
+#endif  // V8_TARGET_ARCH_ARM
 
 UNINITIALIZED_TEST(TraceMaps) {
   SETUP_FLAGS();
diff --git a/deps/v8/test/cctest/test-parsing.cc b/deps/v8/test/cctest/test-parsing.cc
index fd75f263ca7..a7a846b3a61 100644
--- a/deps/v8/test/cctest/test-parsing.cc
+++ b/deps/v8/test/cctest/test-parsing.cc
@@ -261,9 +261,6 @@ TEST(ArrowOrAssignmentOp) {
 bool TokenIsBinaryOp(Token::Value token) {
   switch (token) {
     case Token::COMMA:
-    case Token::NULLISH:
-    case Token::OR:
-    case Token::AND:
 #define T(name, string, precedence) case Token::name:
       BINARY_OP_TOKEN_LIST(T, EXPAND_BINOP_TOKEN)
 #undef T
@@ -515,6 +512,8 @@ TEST(ScanKeywords) {
 #undef KEYWORD
           {nullptr, i::Token::IDENTIFIER}};
 
+  i::UnoptimizedCompileFlags flags =
+      i::UnoptimizedCompileFlags::ForTest(CcTest::i_isolate());
   KeywordToken key_token;
   char buffer[32];
   for (int i = 0; (key_token = keywords[i]).keyword != nullptr; i++) {
@@ -523,7 +522,7 @@ TEST(ScanKeywords) {
     CHECK(static_cast<int>(sizeof(buffer)) >= length);
     {
       auto stream = i::ScannerStream::ForTesting(keyword, length);
-      i::Scanner scanner(stream.get(), false);
+      i::Scanner scanner(stream.get(), flags);
       scanner.Initialize();
       CHECK_EQ(key_token.token, scanner.Next());
       CHECK_EQ(i::Token::EOS, scanner.Next());
@@ -531,7 +530,7 @@ TEST(ScanKeywords) {
     // Removing characters will make keyword matching fail.
     {
       auto stream = i::ScannerStream::ForTesting(keyword, length - 1);
-      i::Scanner scanner(stream.get(), false);
+      i::Scanner scanner(stream.get(), flags);
       scanner.Initialize();
       CHECK_EQ(i::Token::IDENTIFIER, scanner.Next());
       CHECK_EQ(i::Token::EOS, scanner.Next());
@@ -542,7 +541,7 @@ TEST(ScanKeywords) {
       i::MemMove(buffer, keyword, length);
       buffer[length] = chars_to_append[j];
       auto stream = i::ScannerStream::ForTesting(buffer, length + 1);
-      i::Scanner scanner(stream.get(), false);
+      i::Scanner scanner(stream.get(), flags);
       scanner.Initialize();
       CHECK_EQ(i::Token::IDENTIFIER, scanner.Next());
       CHECK_EQ(i::Token::EOS, scanner.Next());
@@ -552,7 +551,7 @@ TEST(ScanKeywords) {
       i::MemMove(buffer, keyword, length);
       buffer[length - 1] = '_';
       auto stream = i::ScannerStream::ForTesting(buffer, length);
-      i::Scanner scanner(stream.get(), false);
+      i::Scanner scanner(stream.get(), flags);
       scanner.Initialize();
       CHECK_EQ(i::Token::IDENTIFIER, scanner.Next());
       CHECK_EQ(i::Token::EOS, scanner.Next());
@@ -566,6 +565,8 @@ TEST(ScanHTMLEndComments) {
   v8::Isolate* isolate = CcTest::isolate();
   i::Isolate* i_isolate = CcTest::i_isolate();
   v8::HandleScope handles(isolate);
+  i::UnoptimizedCompileFlags flags =
+      i::UnoptimizedCompileFlags::ForTest(i_isolate);
 
   // Regression test. See:
   //    http://code.google.com/p/chromium/issues/detail?id=53548
@@ -619,7 +620,7 @@ TEST(ScanHTMLEndComments) {
   for (int i = 0; tests[i]; i++) {
     const char* source = tests[i];
     auto stream = i::ScannerStream::ForTesting(source);
-    i::Scanner scanner(stream.get(), false);
+    i::Scanner scanner(stream.get(), flags);
     scanner.Initialize();
     i::Zone zone(i_isolate->allocator(), ZONE_NAME);
     i::AstValueFactory ast_value_factory(
@@ -628,7 +629,7 @@ TEST(ScanHTMLEndComments) {
     i::PreParser preparser(&zone, &scanner, stack_limit, &ast_value_factory,
                            &pending_error_handler,
                            i_isolate->counters()->runtime_call_stats(),
-                           i_isolate->logger());
+                           i_isolate->logger(), flags);
     i::PreParser::PreParseResult result = preparser.PreParseProgram();
     CHECK_EQ(i::PreParser::kPreParseSuccess, result);
     CHECK(!pending_error_handler.has_pending_error());
@@ -637,7 +638,7 @@ TEST(ScanHTMLEndComments) {
   for (int i = 0; fail_tests[i]; i++) {
     const char* source = fail_tests[i];
     auto stream = i::ScannerStream::ForTesting(source);
-    i::Scanner scanner(stream.get(), false);
+    i::Scanner scanner(stream.get(), flags);
     scanner.Initialize();
     i::Zone zone(i_isolate->allocator(), ZONE_NAME);
     i::AstValueFactory ast_value_factory(
@@ -646,7 +647,7 @@ TEST(ScanHTMLEndComments) {
     i::PreParser preparser(&zone, &scanner, stack_limit, &ast_value_factory,
                            &pending_error_handler,
                            i_isolate->counters()->runtime_call_stats(),
-                           i_isolate->logger());
+                           i_isolate->logger(), flags);
     i::PreParser::PreParseResult result = preparser.PreParseProgram();
     // Even in the case of a syntax error, kPreParseSuccess is returned.
     CHECK_EQ(i::PreParser::kPreParseSuccess, result);
@@ -656,11 +657,15 @@ TEST(ScanHTMLEndComments) {
 }
 
 TEST(ScanHtmlComments) {
+  i::UnoptimizedCompileFlags flags =
+      i::UnoptimizedCompileFlags::ForTest(CcTest::i_isolate());
+
   const char* src = "a <!-- b --> c";
   // Disallow HTML comments.
   {
+    flags.set_is_module(true);
     auto stream = i::ScannerStream::ForTesting(src);
-    i::Scanner scanner(stream.get(), true);
+    i::Scanner scanner(stream.get(), flags);
     scanner.Initialize();
     CHECK_EQ(i::Token::IDENTIFIER, scanner.Next());
     CHECK_EQ(i::Token::ILLEGAL, scanner.Next());
@@ -668,8 +673,9 @@ TEST(ScanHtmlComments) {
 
   // Skip HTML comments:
   {
+    flags.set_is_module(false);
     auto stream = i::ScannerStream::ForTesting(src);
-    i::Scanner scanner(stream.get(), false);
+    i::Scanner scanner(stream.get(), flags);
     scanner.Initialize();
     CHECK_EQ(i::Token::IDENTIFIER, scanner.Next());
     CHECK_EQ(i::Token::EOS, scanner.Next());
@@ -693,6 +699,9 @@ class ScriptResource : public v8::String::ExternalOneByteStringResource {
 TEST(StandAlonePreParser) {
   v8::V8::Initialize();
   i::Isolate* i_isolate = CcTest::i_isolate();
+  i::UnoptimizedCompileFlags flags =
+      i::UnoptimizedCompileFlags::ForTest(i_isolate);
+  flags.set_allow_natives_syntax(true);
 
   i_isolate->stack_guard()->SetStackLimit(i::GetCurrentStackPosition() -
                                           128 * 1024);
@@ -708,7 +717,7 @@ TEST(StandAlonePreParser) {
   uintptr_t stack_limit = i_isolate->stack_guard()->real_climit();
   for (int i = 0; programs[i]; i++) {
     auto stream = i::ScannerStream::ForTesting(programs[i]);
-    i::Scanner scanner(stream.get(), false);
+    i::Scanner scanner(stream.get(), flags);
     scanner.Initialize();
 
     i::Zone zone(i_isolate->allocator(), ZONE_NAME);
@@ -718,8 +727,7 @@ TEST(StandAlonePreParser) {
     i::PreParser preparser(&zone, &scanner, stack_limit, &ast_value_factory,
                            &pending_error_handler,
                            i_isolate->counters()->runtime_call_stats(),
-                           i_isolate->logger());
-    preparser.set_allow_natives(true);
+                           i_isolate->logger(), flags);
     i::PreParser::PreParseResult result = preparser.PreParseProgram();
     CHECK_EQ(i::PreParser::kPreParseSuccess, result);
     CHECK(!pending_error_handler.has_pending_error());
@@ -729,8 +737,10 @@ TEST(StandAlonePreParser) {
 
 TEST(StandAlonePreParserNoNatives) {
   v8::V8::Initialize();
-
   i::Isolate* isolate = CcTest::i_isolate();
+  i::UnoptimizedCompileFlags flags =
+      i::UnoptimizedCompileFlags::ForTest(isolate);
+
   isolate->stack_guard()->SetStackLimit(i::GetCurrentStackPosition() -
                                         128 * 1024);
 
@@ -740,7 +750,7 @@ TEST(StandAlonePreParserNoNatives) {
   uintptr_t stack_limit = isolate->stack_guard()->real_climit();
   for (int i = 0; programs[i]; i++) {
     auto stream = i::ScannerStream::ForTesting(programs[i]);
-    i::Scanner scanner(stream.get(), false);
+    i::Scanner scanner(stream.get(), flags);
     scanner.Initialize();
 
     // Preparser defaults to disallowing natives syntax.
@@ -751,7 +761,7 @@ TEST(StandAlonePreParserNoNatives) {
     i::PreParser preparser(&zone, &scanner, stack_limit, &ast_value_factory,
                            &pending_error_handler,
                            isolate->counters()->runtime_call_stats(),
-                           isolate->logger());
+                           isolate->logger(), flags);
     i::PreParser::PreParseResult result = preparser.PreParseProgram();
     CHECK_EQ(i::PreParser::kPreParseSuccess, result);
     CHECK(pending_error_handler.has_pending_error() ||
@@ -763,6 +773,8 @@ TEST(StandAlonePreParserNoNatives) {
 TEST(RegressChromium62639) {
   v8::V8::Initialize();
   i::Isolate* isolate = CcTest::i_isolate();
+  i::UnoptimizedCompileFlags flags =
+      i::UnoptimizedCompileFlags::ForTest(isolate);
 
   isolate->stack_guard()->SetStackLimit(i::GetCurrentStackPosition() -
                                         128 * 1024);
@@ -775,7 +787,7 @@ TEST(RegressChromium62639) {
   // failed in debug mode, and sometimes crashed in release mode.
 
   auto stream = i::ScannerStream::ForTesting(program);
-  i::Scanner scanner(stream.get(), false);
+  i::Scanner scanner(stream.get(), flags);
   scanner.Initialize();
   i::Zone zone(isolate->allocator(), ZONE_NAME);
   i::AstValueFactory ast_value_factory(&zone, isolate->ast_string_constants(),
@@ -784,7 +796,7 @@ TEST(RegressChromium62639) {
   i::PreParser preparser(&zone, &scanner, isolate->stack_guard()->real_climit(),
                          &ast_value_factory, &pending_error_handler,
                          isolate->counters()->runtime_call_stats(),
-                         isolate->logger());
+                         isolate->logger(), flags);
   i::PreParser::PreParseResult result = preparser.PreParseProgram();
   // Even in the case of a syntax error, kPreParseSuccess is returned.
   CHECK_EQ(i::PreParser::kPreParseSuccess, result);
@@ -796,6 +808,8 @@ TEST(RegressChromium62639) {
 TEST(PreParseOverflow) {
   v8::V8::Initialize();
   i::Isolate* isolate = CcTest::i_isolate();
+  i::UnoptimizedCompileFlags flags =
+      i::UnoptimizedCompileFlags::ForTest(isolate);
 
   isolate->stack_guard()->SetStackLimit(i::GetCurrentStackPosition() -
                                         128 * 1024);
@@ -808,7 +822,7 @@ TEST(PreParseOverflow) {
   uintptr_t stack_limit = isolate->stack_guard()->real_climit();
 
   auto stream = i::ScannerStream::ForTesting(program.get(), kProgramSize);
-  i::Scanner scanner(stream.get(), false);
+  i::Scanner scanner(stream.get(), flags);
   scanner.Initialize();
 
   i::Zone zone(isolate->allocator(), ZONE_NAME);
@@ -817,7 +831,7 @@ TEST(PreParseOverflow) {
   i::PendingCompilationErrorHandler pending_error_handler;
   i::PreParser preparser(
       &zone, &scanner, stack_limit, &ast_value_factory, &pending_error_handler,
-      isolate->counters()->runtime_call_stats(), isolate->logger());
+      isolate->counters()->runtime_call_stats(), isolate->logger(), flags);
   i::PreParser::PreParseResult result = preparser.PreParseProgram();
   CHECK_EQ(i::PreParser::kPreParseStackOverflow, result);
 }
@@ -826,7 +840,10 @@ void TestStreamScanner(i::Utf16CharacterStream* stream,
                        i::Token::Value* expected_tokens,
                        int skip_pos = 0,  // Zero means not skipping.
                        int skip_to = 0) {
-  i::Scanner scanner(stream, false);
+  i::UnoptimizedCompileFlags flags =
+      i::UnoptimizedCompileFlags::ForTest(CcTest::i_isolate());
+
+  i::Scanner scanner(stream, flags);
   scanner.Initialize();
 
   int i = 0;
@@ -894,7 +911,9 @@ TEST(StreamScanner) {
 void TestScanRegExp(const char* re_source, const char* expected) {
   auto stream = i::ScannerStream::ForTesting(re_source);
   i::HandleScope scope(CcTest::i_isolate());
-  i::Scanner scanner(stream.get(), false);
+  i::UnoptimizedCompileFlags flags =
+      i::UnoptimizedCompileFlags::ForTest(CcTest::i_isolate());
+  i::Scanner scanner(stream.get(), flags);
   scanner.Initialize();
 
   i::Token::Value start = scanner.peek();
@@ -1056,13 +1075,13 @@ TEST(ScopeUsesArgumentsSuperThis) {
           factory->NewStringFromUtf8(i::CStrVector(program.begin()))
               .ToHandleChecked();
       i::Handle<i::Script> script = factory->NewScript(source);
-      i::ParseInfo info(isolate, *script);
+      i::UnoptimizedCompileState compile_state(isolate);
+      i::UnoptimizedCompileFlags flags =
+          i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
       // The information we're checking is only produced when eager parsing.
-      info.set_allow_lazy_parsing(false);
+      flags.set_allow_lazy_parsing(false);
+      i::ParseInfo info(isolate, flags, &compile_state);
       CHECK(i::parsing::ParseProgram(&info, script, isolate));
-      CHECK(i::Rewriter::Rewrite(&info));
-      info.ast_value_factory()->Internalize(isolate);
-      CHECK(i::DeclarationScope::Analyze(&info));
       i::DeclarationScope::AllocateScopeInfos(&info, isolate);
       CHECK_NOT_NULL(info.literal());
 
@@ -1121,9 +1140,12 @@ static void CheckParsesToNumber(const char* source) {
 
   i::Handle<i::Script> script = factory->NewScript(source_code);
 
-  i::ParseInfo info(isolate, *script);
-  info.set_allow_lazy_parsing(false);
-  info.set_toplevel(true);
+  i::UnoptimizedCompileState compile_state(isolate);
+  i::UnoptimizedCompileFlags flags =
+      i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+  flags.set_allow_lazy_parsing(false);
+  flags.set_is_toplevel(true);
+  i::ParseInfo info(isolate, flags, &compile_state);
 
   CHECK(i::parsing::ParseProgram(&info, script, isolate));
 
@@ -1431,8 +1453,12 @@ TEST(ScopePositions) {
             .ToHandleChecked();
     CHECK_EQ(source->length(), kProgramSize);
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(isolate, *script);
-    info.set_language_mode(source_data[i].language_mode);
+
+    i::UnoptimizedCompileState compile_state(isolate);
+    i::UnoptimizedCompileFlags flags =
+        i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+    flags.set_outer_language_mode(source_data[i].language_mode);
+    i::ParseInfo info(isolate, flags, &compile_state);
     i::parsing::ParseProgram(&info, script, isolate);
     CHECK_NOT_NULL(info.literal());
 
@@ -1477,14 +1503,27 @@ TEST(DiscardFunctionBody) {
     i::Handle<i::String> source_code =
         factory->NewStringFromUtf8(i::CStrVector(source)).ToHandleChecked();
     i::Handle<i::Script> script = factory->NewScript(source_code);
-    i::ParseInfo info(isolate, *script);
+    i::UnoptimizedCompileState compile_state(isolate);
+    i::UnoptimizedCompileFlags flags =
+        i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+    i::ParseInfo info(isolate, flags, &compile_state);
     i::parsing::ParseProgram(&info, script, isolate);
     function = info.literal();
     CHECK_NOT_NULL(function);
-    CHECK_EQ(1, function->body()->length());
-    i::FunctionLiteral* inner =
-        function->body()->first()->AsExpressionStatement()->expression()->
-        AsCall()->expression()->AsFunctionLiteral();
+    // The rewriter will rewrite this to
+    //     .result = (function f(){...})();
+    //     return .result;
+    // so extract the function from there.
+    CHECK_EQ(2, function->body()->length());
+    i::FunctionLiteral* inner = function->body()
+                                    ->first()
+                                    ->AsExpressionStatement()
+                                    ->expression()
+                                    ->AsAssignment()
+                                    ->value()
+                                    ->AsCall()
+                                    ->expression()
+                                    ->AsFunctionLiteral();
     i::Scope* inner_scope = inner->scope();
     i::FunctionLiteral* fun = nullptr;
     if (!inner_scope->declarations()->is_empty()) {
@@ -1534,8 +1573,6 @@ enum ParserFlag {
   kAllowHarmonyPrivateMethods,
   kAllowHarmonyDynamicImport,
   kAllowHarmonyImportMeta,
-  kAllowHarmonyNullish,
-  kAllowHarmonyOptionalChaining,
 };
 
 enum ParserSyncTestResult {
@@ -1549,22 +1586,17 @@ void SetGlobalFlags(base::EnumSet<ParserFlag> flags) {
   i::FLAG_harmony_private_methods = flags.contains(kAllowHarmonyPrivateMethods);
   i::FLAG_harmony_dynamic_import = flags.contains(kAllowHarmonyDynamicImport);
   i::FLAG_harmony_import_meta = flags.contains(kAllowHarmonyImportMeta);
-  i::FLAG_harmony_optional_chaining =
-      flags.contains(kAllowHarmonyOptionalChaining);
-  i::FLAG_harmony_nullish = flags.contains(kAllowHarmonyNullish);
 }
 
-void SetParserFlags(i::PreParser* parser, base::EnumSet<ParserFlag> flags) {
-  parser->set_allow_natives(flags.contains(kAllowNatives));
-  parser->set_allow_harmony_private_methods(
+void SetParserFlags(i::UnoptimizedCompileFlags* compile_flags,
+                    base::EnumSet<ParserFlag> flags) {
+  compile_flags->set_allow_natives_syntax(flags.contains(kAllowNatives));
+  compile_flags->set_allow_harmony_private_methods(
       flags.contains(kAllowHarmonyPrivateMethods));
-  parser->set_allow_harmony_dynamic_import(
+  compile_flags->set_allow_harmony_dynamic_import(
       flags.contains(kAllowHarmonyDynamicImport));
-  parser->set_allow_harmony_import_meta(
+  compile_flags->set_allow_harmony_import_meta(
       flags.contains(kAllowHarmonyImportMeta));
-  parser->set_allow_harmony_optional_chaining(
-      flags.contains(kAllowHarmonyOptionalChaining));
-  parser->set_allow_harmony_nullish(flags.contains(kAllowHarmonyNullish));
 }
 
 void TestParserSyncWithFlags(i::Handle<i::String> source,
@@ -1574,6 +1606,12 @@ void TestParserSyncWithFlags(i::Handle<i::String> source,
                              bool ignore_error_msg = false) {
   i::Isolate* isolate = CcTest::i_isolate();
   i::Factory* factory = isolate->factory();
+  i::UnoptimizedCompileState compile_state(isolate);
+  i::UnoptimizedCompileFlags compile_flags =
+      i::UnoptimizedCompileFlags::ForToplevelCompile(
+          isolate, true, LanguageMode::kSloppy, REPLMode::kNo);
+  SetParserFlags(&compile_flags, flags);
+  compile_flags.set_is_module(is_module);
 
   uintptr_t stack_limit = isolate->stack_guard()->real_climit();
 
@@ -1582,15 +1620,14 @@ void TestParserSyncWithFlags(i::Handle<i::String> source,
   if (test_preparser) {
     std::unique_ptr<i::Utf16CharacterStream> stream(
         i::ScannerStream::For(isolate, source));
-    i::Scanner scanner(stream.get(), is_module);
+    i::Scanner scanner(stream.get(), compile_flags);
     i::Zone zone(isolate->allocator(), ZONE_NAME);
     i::AstValueFactory ast_value_factory(&zone, isolate->ast_string_constants(),
                                          HashSeed(isolate));
     i::PreParser preparser(&zone, &scanner, stack_limit, &ast_value_factory,
                            &pending_error_handler,
                            isolate->counters()->runtime_call_stats(),
-                           isolate->logger(), -1, is_module);
-    SetParserFlags(&preparser, flags);
+                           isolate->logger(), compile_flags);
     scanner.Initialize();
     i::PreParser::PreParseResult result = preparser.PreParseProgram();
     CHECK_EQ(i::PreParser::kPreParseSuccess, result);
@@ -1600,10 +1637,9 @@ void TestParserSyncWithFlags(i::Handle<i::String> source,
   i::FunctionLiteral* function;
   {
     SetGlobalFlags(flags);
-    i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(isolate, *script);
-    info.set_allow_lazy_parsing(flags.contains(kAllowLazy));
-    if (is_module) info.set_module();
+    i::Handle<i::Script> script =
+        factory->NewScriptWithId(source, compile_flags.script_id());
+    i::ParseInfo info(isolate, compile_flags, &compile_state);
     i::parsing::ParseProgram(&info, script, isolate);
     function = info.literal();
   }
@@ -1995,10 +2031,7 @@ TEST(OptionalChaining) {
       {"", ""}, {"'use strict';", ""}, {nullptr, nullptr}};
   const char* statement_data[] = {"a?.b", "a?.['b']", "a?.()", nullptr};
 
-  static const ParserFlag flags[] = {kAllowHarmonyOptionalChaining};
-  RunParserSyncTest(context_data, statement_data, kSuccess, nullptr, 0, flags,
-                    1, nullptr, 0, false, true, true);
-  RunParserSyncTest(context_data, statement_data, kError);
+  RunParserSyncTest(context_data, statement_data, kSuccess);
 }
 
 TEST(OptionalChainingTaggedError) {
@@ -2010,9 +2043,6 @@ TEST(OptionalChainingTaggedError) {
       {"", ""}, {"'use strict';", ""}, {nullptr, nullptr}};
   const char* statement_data[] = {"a?.b``", "a?.['b']``", "a?.()``", nullptr};
 
-  static const ParserFlag flags[] = {kAllowHarmonyOptionalChaining};
-  RunParserSyncTest(context_data, statement_data, kError, nullptr, 9, flags, 1,
-                    nullptr, 0, false, true, true);
   RunParserSyncTest(context_data, statement_data, kError);
 }
 
@@ -2028,10 +2058,7 @@ TEST(Nullish) {
                                   "a ?? b ?? c ? d : e",
                                   nullptr};
 
-  static const ParserFlag flags[] = {kAllowHarmonyNullish};
-  RunParserSyncTest(context_data, statement_data, kSuccess, nullptr, 0, flags,
-                    1, nullptr, 0, false, true, true);
-  RunParserSyncTest(context_data, statement_data, kError);
+  RunParserSyncTest(context_data, statement_data, kSuccess);
 }
 
 TEST(NullishNotContained) {
@@ -2046,9 +2073,7 @@ TEST(NullishNotContained) {
                                   "a ?? b && c",
                                   nullptr};
 
-  static const ParserFlag flags[] = {kAllowHarmonyNullish};
-  RunParserSyncTest(context_data, statement_data, kError, nullptr, 0, flags, 1,
-                    nullptr, 0, false, true, true);
+  RunParserSyncTest(context_data, statement_data, kError);
 }
 
 TEST(ErrorsEvalAndArguments) {
@@ -3483,6 +3508,7 @@ TEST(InnerAssignment) {
         i::SNPrintF(program, "%s%s%s%s%s", prefix, outer, midfix, inner,
                     suffix);
 
+        UnoptimizedCompileState compile_state(isolate);
         std::unique_ptr<i::ParseInfo> info;
         if (lazy) {
           printf("%s\n", program.begin());
@@ -3491,8 +3517,9 @@ TEST(InnerAssignment) {
           i::Handle<i::JSFunction> f = i::Handle<i::JSFunction>::cast(o);
           i::Handle<i::SharedFunctionInfo> shared =
               i::handle(f->shared(), isolate);
-          info =
-              std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, *shared));
+          i::UnoptimizedCompileFlags flags =
+              i::UnoptimizedCompileFlags::ForFunctionCompile(isolate, *shared);
+          info = std::make_unique<i::ParseInfo>(isolate, flags, &compile_state);
           CHECK(i::parsing::ParseFunction(info.get(), shared, isolate));
         } else {
           i::Handle<i::String> source =
@@ -3500,12 +3527,12 @@ TEST(InnerAssignment) {
           source->PrintOn(stdout);
           printf("\n");
           i::Handle<i::Script> script = factory->NewScript(source);
-          info =
-              std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, *script));
-          info->set_allow_lazy_parsing(false);
+          i::UnoptimizedCompileFlags flags =
+              i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+          flags.set_allow_lazy_parsing(false);
+          info = std::make_unique<i::ParseInfo>(isolate, flags, &compile_state);
           CHECK(i::parsing::ParseProgram(info.get(), script, isolate));
         }
-        CHECK(i::Compiler::Analyze(info.get()));
         CHECK_NOT_NULL(info->literal());
 
         i::Scope* scope = info->literal()->scope();
@@ -3609,10 +3636,12 @@ TEST(MaybeAssignedParameters) {
       i::Handle<i::Object> o = v8::Utils::OpenHandle(*v);
       i::Handle<i::JSFunction> f = i::Handle<i::JSFunction>::cast(o);
       i::Handle<i::SharedFunctionInfo> shared = i::handle(f->shared(), isolate);
-      info = std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, *shared));
-      info->set_allow_lazy_parsing(allow_lazy);
+      i::UnoptimizedCompileState state(isolate);
+      i::UnoptimizedCompileFlags flags =
+          i::UnoptimizedCompileFlags::ForFunctionCompile(isolate, *shared);
+      flags.set_allow_lazy_parsing(allow_lazy);
+      info = std::make_unique<i::ParseInfo>(isolate, flags, &state);
       CHECK(i::parsing::ParseFunction(info.get(), shared, isolate));
-      CHECK(i::Compiler::Analyze(info.get()));
       CHECK_NOT_NULL(info->literal());
 
       i::Scope* scope = info->literal()->scope();
@@ -3645,13 +3674,15 @@ static void TestMaybeAssigned(Input input, const char* variable, bool module,
   printf("\n");
   i::Handle<i::Script> script = factory->NewScript(string);
 
-  std::unique_ptr<i::ParseInfo> info;
-  info = std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, *script));
-  info->set_module(module);
-  info->set_allow_lazy_parsing(allow_lazy_parsing);
+  i::UnoptimizedCompileState state(isolate);
+  i::UnoptimizedCompileFlags flags =
+      i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+  flags.set_is_module(module);
+  flags.set_allow_lazy_parsing(allow_lazy_parsing);
+  std::unique_ptr<i::ParseInfo> info =
+      std::make_unique<i::ParseInfo>(isolate, flags, &state);
 
   CHECK(i::parsing::ParseProgram(info.get(), script, isolate));
-  CHECK(i::Compiler::Analyze(info.get()));
 
   CHECK_NOT_NULL(info->literal());
   i::Scope* scope = info->literal()->scope();
@@ -7401,8 +7432,11 @@ TEST(BasicImportExportParsing) {
     // Show that parsing as a module works
     {
       i::Handle<i::Script> script = factory->NewScript(source);
-      i::ParseInfo info(isolate, *script);
-      info.set_module();
+      i::UnoptimizedCompileState compile_state(isolate);
+      i::UnoptimizedCompileFlags flags =
+          i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+      flags.set_is_module(true);
+      i::ParseInfo info(isolate, flags, &compile_state);
       if (!i::parsing::ParseProgram(&info, script, isolate)) {
         i::Handle<i::JSObject> exception_handle(
             i::JSObject::cast(isolate->pending_exception()), isolate);
@@ -7423,8 +7457,11 @@ TEST(BasicImportExportParsing) {
 
     // And that parsing a script does not.
     {
+      i::UnoptimizedCompileState compile_state(isolate);
       i::Handle<i::Script> script = factory->NewScript(source);
-      i::ParseInfo info(isolate, *script);
+      i::UnoptimizedCompileFlags flags =
+          i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+      i::ParseInfo info(isolate, flags, &compile_state);
       CHECK(!i::parsing::ParseProgram(&info, script, isolate));
       isolate->clear_pending_exception();
     }
@@ -7461,8 +7498,11 @@ TEST(NamespaceExportParsing) {
     i::Handle<i::String> source =
         factory->NewStringFromAsciiChecked(kSources[i]);
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(isolate, *script);
-    info.set_module();
+    i::UnoptimizedCompileState compile_state(isolate);
+    i::UnoptimizedCompileFlags flags =
+        i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+    flags.set_is_module(true);
+    i::ParseInfo info(isolate, flags, &compile_state);
     CHECK(i::parsing::ParseProgram(&info, script, isolate));
   }
 }
@@ -7556,8 +7596,11 @@ TEST(ImportExportParsingErrors) {
         factory->NewStringFromAsciiChecked(kErrorSources[i]);
 
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(isolate, *script);
-    info.set_module();
+    i::UnoptimizedCompileState compile_state(isolate);
+    i::UnoptimizedCompileFlags flags =
+        i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+    flags.set_is_module(true);
+    i::ParseInfo info(isolate, flags, &compile_state);
     CHECK(!i::parsing::ParseProgram(&info, script, isolate));
     isolate->clear_pending_exception();
   }
@@ -7592,8 +7635,11 @@ TEST(ModuleTopLevelFunctionDecl) {
         factory->NewStringFromAsciiChecked(kErrorSources[i]);
 
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(isolate, *script);
-    info.set_module();
+    i::UnoptimizedCompileState compile_state(isolate);
+    i::UnoptimizedCompileFlags flags =
+        i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+    flags.set_is_module(true);
+    i::ParseInfo info(isolate, flags, &compile_state);
     CHECK(!i::parsing::ParseProgram(&info, script, isolate));
     isolate->clear_pending_exception();
   }
@@ -7789,10 +7835,12 @@ TEST(ModuleParsingInternals) {
       "export {foob};";
   i::Handle<i::String> source = factory->NewStringFromAsciiChecked(kSource);
   i::Handle<i::Script> script = factory->NewScript(source);
-  i::ParseInfo info(isolate, *script);
-  info.set_module();
+  i::UnoptimizedCompileState compile_state(isolate);
+  i::UnoptimizedCompileFlags flags =
+      i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+  flags.set_is_module(true);
+  i::ParseInfo info(isolate, flags, &compile_state);
   CHECK(i::parsing::ParseProgram(&info, script, isolate));
-  CHECK(i::Compiler::Analyze(&info));
   i::FunctionLiteral* func = info.literal();
   i::ModuleScope* module_scope = func->scope()->AsModuleScope();
   i::Scope* outer_scope = module_scope->outer_scope();
@@ -8032,7 +8080,10 @@ void TestLanguageMode(const char* source,
 
   i::Handle<i::Script> script =
       factory->NewScript(factory->NewStringFromAsciiChecked(source));
-  i::ParseInfo info(isolate, *script);
+  i::UnoptimizedCompileState compile_state(isolate);
+  i::UnoptimizedCompileFlags flags =
+      i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+  i::ParseInfo info(isolate, flags, &compile_state);
   i::parsing::ParseProgram(&info, script, isolate);
   CHECK_NOT_NULL(info.literal());
   CHECK_EQ(expected_language_mode, info.literal()->language_mode());
@@ -10813,10 +10864,12 @@ TEST(NoPessimisticContextAllocation) {
       printf("\n");
 
       i::Handle<i::Script> script = factory->NewScript(source);
-      i::ParseInfo info(isolate, *script);
+      i::UnoptimizedCompileState compile_state(isolate);
+      i::UnoptimizedCompileFlags flags =
+          i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+      i::ParseInfo info(isolate, flags, &compile_state);
 
       CHECK(i::parsing::ParseProgram(&info, script, isolate));
-      CHECK(i::Compiler::Analyze(&info));
       CHECK_NOT_NULL(info.literal());
 
       i::Scope* scope = info.literal()->scope()->inner_scope();
@@ -11373,12 +11426,12 @@ TEST(LexicalLoopVariable) {
     i::Handle<i::String> source =
         factory->NewStringFromUtf8(i::CStrVector(program)).ToHandleChecked();
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(isolate, *script);
-
-    info.set_allow_lazy_parsing(false);
+    i::UnoptimizedCompileState compile_state(isolate);
+    i::UnoptimizedCompileFlags flags =
+        i::UnoptimizedCompileFlags::ForScriptCompile(isolate, *script);
+    flags.set_allow_lazy_parsing(false);
+    i::ParseInfo info(isolate, flags, &compile_state);
     CHECK(i::parsing::ParseProgram(&info, script, isolate));
-    CHECK(i::Rewriter::Rewrite(&info));
-    CHECK(i::DeclarationScope::Analyze(&info));
     i::DeclarationScope::AllocateScopeInfos(&info, isolate);
     CHECK_NOT_NULL(info.literal());
 
diff --git a/deps/v8/test/cctest/test-persistent-handles.cc b/deps/v8/test/cctest/test-persistent-handles.cc
new file mode 100644
index 00000000000..0bb2990d178
--- /dev/null
+++ b/deps/v8/test/cctest/test-persistent-handles.cc
@@ -0,0 +1,114 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <memory>
+
+#include "src/api/api.h"
+#include "src/base/platform/condition-variable.h"
+#include "src/base/platform/mutex.h"
+#include "src/base/platform/semaphore.h"
+#include "src/handles/handles-inl.h"
+#include "src/handles/local-handles-inl.h"
+#include "src/handles/persistent-handles.h"
+#include "src/heap/heap.h"
+#include "src/heap/local-heap.h"
+#include "src/heap/safepoint.h"
+#include "src/objects/heap-number.h"
+#include "test/cctest/cctest.h"
+#include "test/cctest/heap/heap-utils.h"
+
+namespace v8 {
+namespace internal {
+
+static constexpr int kNumHandles = kHandleBlockSize * 2 + kHandleBlockSize / 2;
+
+class PersistentHandlesThread final : public v8::base::Thread {
+ public:
+  PersistentHandlesThread(Heap* heap, std::vector<Handle<HeapNumber>> handles,
+                          std::unique_ptr<PersistentHandles> ph, Address object,
+                          base::Semaphore* sema_started,
+                          base::Semaphore* sema_gc_finished)
+      : v8::base::Thread(base::Thread::Options("ThreadWithLocalHeap")),
+        heap_(heap),
+        handles_(std::move(handles)),
+        ph_(std::move(ph)),
+        object_(object),
+        sema_started_(sema_started),
+        sema_gc_finished_(sema_gc_finished) {}
+
+  void Run() override {
+    LocalHeap local_heap(heap_, std::move(ph_));
+    LocalHandleScope scope(&local_heap);
+
+    for (int i = 0; i < kNumHandles; i++) {
+      handles_.push_back(
+          Handle<HeapNumber>::cast(local_heap.NewPersistentHandle(object_)));
+    }
+
+    sema_started_->Signal();
+
+    {
+      ParkedScope scope(&local_heap);
+      sema_gc_finished_->Wait();
+    }
+
+    for (Handle<HeapNumber> handle : handles_) {
+      CHECK_EQ(42.0, handle->value());
+    }
+
+    CHECK_EQ(handles_.size(), kNumHandles * 2);
+
+    CHECK(!ph_);
+    ph_ = local_heap.DetachPersistentHandles();
+  }
+
+  Heap* heap_;
+  std::vector<Handle<HeapNumber>> handles_;
+  std::unique_ptr<PersistentHandles> ph_;
+  Address object_;
+  base::Semaphore* sema_started_;
+  base::Semaphore* sema_gc_finished_;
+};
+
+TEST(CreatePersistentHandles) {
+  CcTest::InitializeVM();
+  FLAG_local_heaps = true;
+  Isolate* isolate = CcTest::i_isolate();
+
+  Address object = kNullAddress;
+  std::unique_ptr<PersistentHandles> ph = isolate->NewPersistentHandles();
+  std::vector<Handle<HeapNumber>> handles;
+
+  HandleScope handle_scope(isolate);
+  Handle<HeapNumber> number = isolate->factory()->NewHeapNumber(42.0);
+
+  object = number->ptr();
+
+  for (int i = 0; i < kNumHandles; i++) {
+    handles.push_back(Handle<HeapNumber>::cast(ph->NewHandle(object)));
+  }
+
+  base::Semaphore sema_started(0);
+  base::Semaphore sema_gc_finished(0);
+
+  // pass persistent handles to background thread
+  std::unique_ptr<PersistentHandlesThread> thread(new PersistentHandlesThread(
+      isolate->heap(), std::move(handles), std::move(ph), object, &sema_started,
+      &sema_gc_finished));
+  CHECK(thread->Start());
+
+  sema_started.Wait();
+
+  CcTest::CollectAllGarbage();
+  sema_gc_finished.Signal();
+
+  thread->Join();
+
+  // get persistent handles back to main thread
+  ph = std::move(thread->ph_);
+  ph->NewHandle(number->ptr());
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/test-profile-generator.cc b/deps/v8/test/cctest/test-profile-generator.cc
index 5cfc4df2a34..ac0537652c9 100644
--- a/deps/v8/test/cctest/test-profile-generator.cc
+++ b/deps/v8/test/cctest/test-profile-generator.cc
@@ -376,7 +376,7 @@ class TestSetup {
 
 }  // namespace
 
-TEST(RecordTickSample) {
+TEST(SymbolizeTickSample) {
   TestSetup test_setup;
   i::Isolate* isolate = CcTest::i_isolate();
   CpuProfilesCollection profiles(isolate);
@@ -401,7 +401,7 @@ TEST(RecordTickSample) {
   sample1.tos = ToPointer(0x1500);
   sample1.stack[0] = ToPointer(0x1510);
   sample1.frames_count = 1;
-  generator.RecordTickSample(sample1);
+  generator.SymbolizeTickSample(sample1);
   TickSample sample2;
   sample2.pc = ToPointer(0x1925);
   sample2.tos = ToPointer(0x1900);
@@ -409,14 +409,14 @@ TEST(RecordTickSample) {
   sample2.stack[1] = ToPointer(0x10000);  // non-existent.
   sample2.stack[2] = ToPointer(0x1620);
   sample2.frames_count = 3;
-  generator.RecordTickSample(sample2);
+  generator.SymbolizeTickSample(sample2);
   TickSample sample3;
   sample3.pc = ToPointer(0x1510);
   sample3.tos = ToPointer(0x1500);
   sample3.stack[0] = ToPointer(0x1910);
   sample3.stack[1] = ToPointer(0x1610);
   sample3.frames_count = 2;
-  generator.RecordTickSample(sample3);
+  generator.SymbolizeTickSample(sample3);
 
   CpuProfile* profile = profiles.StopProfiling("");
   CHECK(profile);
@@ -470,7 +470,7 @@ TEST(SampleIds) {
   sample1.pc = ToPointer(0x1600);
   sample1.stack[0] = ToPointer(0x1510);
   sample1.frames_count = 1;
-  generator.RecordTickSample(sample1);
+  generator.SymbolizeTickSample(sample1);
   TickSample sample2;
   sample2.timestamp = v8::base::TimeTicks::HighResolutionNow();
   sample2.pc = ToPointer(0x1925);
@@ -478,14 +478,14 @@ TEST(SampleIds) {
   sample2.stack[1] = ToPointer(0x10000);  // non-existent.
   sample2.stack[2] = ToPointer(0x1620);
   sample2.frames_count = 3;
-  generator.RecordTickSample(sample2);
+  generator.SymbolizeTickSample(sample2);
   TickSample sample3;
   sample3.timestamp = v8::base::TimeTicks::HighResolutionNow();
   sample3.pc = ToPointer(0x1510);
   sample3.stack[0] = ToPointer(0x1910);
   sample3.stack[1] = ToPointer(0x1610);
   sample3.frames_count = 2;
-  generator.RecordTickSample(sample3);
+  generator.SymbolizeTickSample(sample3);
 
   CpuProfile* profile = profiles.StopProfiling("");
   unsigned nodeId = 1;
@@ -518,7 +518,7 @@ TEST(NoSamples) {
   sample1.pc = ToPointer(0x1600);
   sample1.stack[0] = ToPointer(0x1510);
   sample1.frames_count = 1;
-  generator.RecordTickSample(sample1);
+  generator.SymbolizeTickSample(sample1);
 
   CpuProfile* profile = profiles.StopProfiling("");
   unsigned nodeId = 1;
diff --git a/deps/v8/test/cctest/test-regexp.cc b/deps/v8/test/cctest/test-regexp.cc
index ce916c9c7a0..da3a32b794f 100644
--- a/deps/v8/test/cctest/test-regexp.cc
+++ b/deps/v8/test/cctest/test-regexp.cc
@@ -50,6 +50,7 @@
 #include "src/utils/ostreams.h"
 #include "src/zone/zone-list-inl.h"
 #include "test/cctest/cctest.h"
+#include "test/common/wasm/flag-utils.h"
 
 namespace v8 {
 namespace internal {
@@ -1278,14 +1279,16 @@ TEST(MacroAssembler) {
   Handle<String> source = factory->NewStringFromStaticChars("^f(o)o");
   Handle<ByteArray> array = Handle<ByteArray>::cast(m.GetCode(source));
   int captures[5];
+  std::memset(captures, 0, sizeof(captures));
 
   const uc16 str1[] = {'f', 'o', 'o', 'b', 'a', 'r'};
   Handle<String> f1_16 = factory->NewStringFromTwoByte(
       Vector<const uc16>(str1, 6)).ToHandleChecked();
 
-  CHECK(IrregexpInterpreter::MatchInternal(isolate, *array, *f1_16, captures, 5,
-                                           0, RegExp::CallOrigin::kFromRuntime,
-                                           JSRegExp::kNoBacktrackLimit));
+  CHECK_EQ(IrregexpInterpreter::SUCCESS,
+           IrregexpInterpreter::MatchInternal(
+               isolate, *array, *f1_16, captures, 5, 5, 0,
+               RegExp::CallOrigin::kFromRuntime, JSRegExp::kNoBacktrackLimit));
   CHECK_EQ(0, captures[0]);
   CHECK_EQ(3, captures[1]);
   CHECK_EQ(1, captures[2]);
@@ -1296,10 +1299,17 @@ TEST(MacroAssembler) {
   Handle<String> f2_16 = factory->NewStringFromTwoByte(
       Vector<const uc16>(str2, 6)).ToHandleChecked();
 
-  CHECK(!IrregexpInterpreter::MatchInternal(
-      isolate, *array, *f2_16, captures, 5, 0, RegExp::CallOrigin::kFromRuntime,
-      JSRegExp::kNoBacktrackLimit));
-  CHECK_EQ(42, captures[0]);
+  std::memset(captures, 0, sizeof(captures));
+  CHECK_EQ(IrregexpInterpreter::FAILURE,
+           IrregexpInterpreter::MatchInternal(
+               isolate, *array, *f2_16, captures, 5, 5, 0,
+               RegExp::CallOrigin::kFromRuntime, JSRegExp::kNoBacktrackLimit));
+  // Failed matches don't alter output registers.
+  CHECK_EQ(0, captures[0]);
+  CHECK_EQ(0, captures[1]);
+  CHECK_EQ(0, captures[2]);
+  CHECK_EQ(0, captures[3]);
+  CHECK_EQ(0, captures[4]);
 }
 
 #ifndef V8_INTL_SUPPORT
@@ -2332,6 +2342,31 @@ TEST(PeepholeLabelFixupsComplex) {
   }
 }
 
+TEST(UnicodePropertyEscapeCodeSize) {
+  i::FlagScope<bool> f(&v8::internal::FLAG_regexp_tier_up, false);
+
+  LocalContext env;
+  v8::HandleScope scope(CcTest::isolate());
+  i::Handle<i::JSRegExp> re = Utils::OpenHandle(
+      *CompileRun("const r = /\\p{L}\\p{L}\\p{L}/u; r.exec('\\u200b'); r;")
+           .As<v8::RegExp>());
+
+  static constexpr int kMaxSize = 200 * KB;
+  static constexpr bool kIsNotLatin1 = false;
+  Object maybe_code = re->Code(kIsNotLatin1);
+  Object maybe_bytecode = re->Bytecode(kIsNotLatin1);
+  if (maybe_bytecode.IsByteArray()) {
+    // On x64, excessive inlining produced >250KB.
+    CHECK_LT(ByteArray::cast(maybe_bytecode).Size(), kMaxSize);
+  } else if (maybe_code.IsCode()) {
+    // On x64, excessive inlining produced >360KB.
+    CHECK_LT(Code::cast(maybe_code).Size(), kMaxSize);
+    CHECK_EQ(Code::cast(maybe_code).kind(), Code::REGEXP);
+  } else {
+    UNREACHABLE();
+  }
+}
+
 #undef CHECK_PARSE_ERROR
 #undef CHECK_SIMPLE
 #undef CHECK_MIN_MAX
diff --git a/deps/v8/test/cctest/test-roots.cc b/deps/v8/test/cctest/test-roots.cc
index 26002621b6d..1e38c8ffca3 100644
--- a/deps/v8/test/cctest/test-roots.cc
+++ b/deps/v8/test/cctest/test-roots.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "src/heap/heap-inl.h"
+#include "src/heap/memory-chunk-inl.h"
 #include "src/objects/cell.h"
 #include "src/objects/feedback-cell.h"
 #include "src/objects/script.h"
@@ -41,6 +42,7 @@ bool IsInitiallyMutable(Factory* factory, Address object_address) {
 #define INITIALLY_READ_ONLY_ROOT_LIST(V)  \
   V(api_private_symbol_table)             \
   V(api_symbol_table)                     \
+  V(basic_block_profiling_data)           \
   V(builtins_constants_table)             \
   V(current_microtask)                    \
   V(detached_contexts)                    \
@@ -48,7 +50,6 @@ bool IsInitiallyMutable(Factory* factory, Address object_address) {
   V(shared_wasm_memories)                 \
   V(materialized_objects)                 \
   V(public_symbol_table)                  \
-  V(retained_maps)                        \
   V(retaining_path_targets)               \
   V(serialized_global_proxy_sizes)        \
   V(serialized_objects)                   \
diff --git a/deps/v8/test/cctest/test-serialize.cc b/deps/v8/test/cctest/test-serialize.cc
index 7ce8ef71529..c7e57ad81b7 100644
--- a/deps/v8/test/cctest/test-serialize.cc
+++ b/deps/v8/test/cctest/test-serialize.cc
@@ -49,8 +49,8 @@
 #include "src/objects/objects-inl.h"
 #include "src/runtime/runtime.h"
 #include "src/snapshot/code-serializer.h"
-#include "src/snapshot/partial-deserializer.h"
-#include "src/snapshot/partial-serializer.h"
+#include "src/snapshot/context-deserializer.h"
+#include "src/snapshot/context-serializer.h"
 #include "src/snapshot/read-only-deserializer.h"
 #include "src/snapshot/read-only-serializer.h"
 #include "src/snapshot/snapshot-compression.h"
@@ -150,7 +150,6 @@ namespace {
 v8::StartupData CreateSnapshotDataBlob(const char* embedded_source) {
   v8::StartupData data = CreateSnapshotDataBlobInternal(
       v8::SnapshotCreator::FunctionCodeHandling::kClear, embedded_source);
-  ReadOnlyHeap::ClearSharedHeapForTest();
   return data;
 }
 
@@ -172,11 +171,14 @@ static StartupBlobs Serialize(v8::Isolate* isolate) {
   internal_isolate->heap()->CollectAllAvailableGarbage(
       i::GarbageCollectionReason::kTesting);
 
-  ReadOnlySerializer read_only_serializer(internal_isolate);
+  DisallowHeapAllocation no_gc;
+  ReadOnlySerializer read_only_serializer(internal_isolate,
+                                          Snapshot::kDefaultSerializerFlags);
   read_only_serializer.SerializeReadOnlyRoots();
 
-  StartupSerializer ser(internal_isolate, &read_only_serializer);
-  ser.SerializeStrongReferences();
+  StartupSerializer ser(internal_isolate, Snapshot::kDefaultSerializerFlags,
+                        &read_only_serializer);
+  ser.SerializeStrongReferences(no_gc);
 
   ser.SerializeWeakReferencesAndDeferred();
   read_only_serializer.FinalizeSerialization();
@@ -186,12 +188,11 @@ static StartupBlobs Serialize(v8::Isolate* isolate) {
           WritePayload(read_only_snapshot.RawData())};
 }
 
-
-Vector<const uint8_t> ConstructSource(Vector<const uint8_t> head,
-                                      Vector<const uint8_t> body,
-                                      Vector<const uint8_t> tail, int repeats) {
-  int source_length = head.length() + body.length() * repeats + tail.length();
-  uint8_t* source = NewArray<uint8_t>(static_cast<size_t>(source_length));
+Vector<const char> ConstructSource(Vector<const char> head,
+                                   Vector<const char> body,
+                                   Vector<const char> tail, int repeats) {
+  size_t source_length = head.size() + body.size() * repeats + tail.size();
+  char* source = NewArray<char>(source_length);
   CopyChars(source, head.begin(), head.length());
   for (int i = 0; i < repeats; i++) {
     CopyChars(source + head.length() + i * body.length(), body.begin(),
@@ -199,8 +200,7 @@ Vector<const uint8_t> ConstructSource(Vector<const uint8_t> head,
   }
   CopyChars(source + head.length() + repeats * body.length(), tail.begin(),
             tail.length());
-  return Vector<const uint8_t>(const_cast<const uint8_t*>(source),
-                               source_length);
+  return VectorOf(source, source_length);
 }
 
 static v8::Isolate* Deserialize(const StartupBlobs& blobs) {
@@ -224,7 +224,6 @@ void TestStartupSerializerOnceImpl() {
   v8::Isolate* isolate = TestSerializer::NewIsolateInitialized();
   StartupBlobs blobs = Serialize(isolate);
   isolate->Dispose();
-  ReadOnlyHeap::ClearSharedHeapForTest();
   isolate = Deserialize(blobs);
   {
     v8::HandleScope handle_scope(isolate);
@@ -282,7 +281,6 @@ UNINITIALIZED_TEST(StartupSerializerTwice) {
   StartupBlobs blobs2 = Serialize(isolate);
   isolate->Dispose();
   blobs1.Dispose();
-  ReadOnlyHeap::ClearSharedHeapForTest();
   isolate = Deserialize(blobs2);
   {
     v8::Isolate::Scope isolate_scope(isolate);
@@ -303,7 +301,6 @@ UNINITIALIZED_TEST(StartupSerializerOnceRunScript) {
   v8::Isolate* isolate = TestSerializer::NewIsolateInitialized();
   StartupBlobs blobs = Serialize(isolate);
   isolate->Dispose();
-  ReadOnlyHeap::ClearSharedHeapForTest();
   isolate = Deserialize(blobs);
   {
     v8::Isolate::Scope isolate_scope(isolate);
@@ -332,7 +329,6 @@ UNINITIALIZED_TEST(StartupSerializerTwiceRunScript) {
   StartupBlobs blobs2 = Serialize(isolate);
   isolate->Dispose();
   blobs1.Dispose();
-  ReadOnlyHeap::ClearSharedHeapForTest();
   isolate = Deserialize(blobs2);
   {
     v8::Isolate::Scope isolate_scope(isolate);
@@ -353,9 +349,9 @@ UNINITIALIZED_TEST(StartupSerializerTwiceRunScript) {
   FreeCurrentEmbeddedBlob();
 }
 
-static void PartiallySerializeContext(Vector<const byte>* startup_blob_out,
-                                      Vector<const byte>* read_only_blob_out,
-                                      Vector<const byte>* partial_blob_out) {
+static void SerializeContext(Vector<const byte>* startup_blob_out,
+                             Vector<const byte>* read_only_blob_out,
+                             Vector<const byte>* context_blob_out) {
   v8::Isolate* v8_isolate = TestSerializer::NewIsolateInitialized();
   Isolate* isolate = reinterpret_cast<Isolate*>(v8_isolate);
   Heap* heap = isolate->heap();
@@ -386,18 +382,22 @@ static void PartiallySerializeContext(Vector<const byte>* startup_blob_out,
 
     env.Reset();
 
+    DisallowHeapAllocation no_gc;
     SnapshotByteSink read_only_sink;
-    ReadOnlySerializer read_only_serializer(isolate);
+    ReadOnlySerializer read_only_serializer(isolate,
+                                            Snapshot::kDefaultSerializerFlags);
     read_only_serializer.SerializeReadOnlyRoots();
 
     SnapshotByteSink startup_sink;
-    StartupSerializer startup_serializer(isolate, &read_only_serializer);
-    startup_serializer.SerializeStrongReferences();
+    StartupSerializer startup_serializer(
+        isolate, Snapshot::kDefaultSerializerFlags, &read_only_serializer);
+    startup_serializer.SerializeStrongReferences(no_gc);
 
-    SnapshotByteSink partial_sink;
-    PartialSerializer partial_serializer(isolate, &startup_serializer,
-                                         v8::SerializeInternalFieldsCallback());
-    partial_serializer.Serialize(&raw_context, false);
+    SnapshotByteSink context_sink;
+    ContextSerializer context_serializer(
+        isolate, Snapshot::kDefaultSerializerFlags, &startup_serializer,
+        v8::SerializeInternalFieldsCallback());
+    context_serializer.Serialize(&raw_context, no_gc);
 
     startup_serializer.SerializeWeakReferencesAndDeferred();
 
@@ -405,40 +405,39 @@ static void PartiallySerializeContext(Vector<const byte>* startup_blob_out,
 
     SnapshotData read_only_snapshot(&read_only_serializer);
     SnapshotData startup_snapshot(&startup_serializer);
-    SnapshotData partial_snapshot(&partial_serializer);
+    SnapshotData context_snapshot(&context_serializer);
 
-    *partial_blob_out = WritePayload(partial_snapshot.RawData());
+    *context_blob_out = WritePayload(context_snapshot.RawData());
     *startup_blob_out = WritePayload(startup_snapshot.RawData());
     *read_only_blob_out = WritePayload(read_only_snapshot.RawData());
   }
   v8_isolate->Dispose();
-  ReadOnlyHeap::ClearSharedHeapForTest();
 }
 
 UNINITIALIZED_TEST(SnapshotCompression) {
   DisableAlwaysOpt();
   Vector<const byte> startup_blob;
   Vector<const byte> read_only_blob;
-  Vector<const byte> partial_blob;
-  PartiallySerializeContext(&startup_blob, &read_only_blob, &partial_blob);
-  SnapshotData original_snapshot_data(partial_blob);
+  Vector<const byte> context_blob;
+  SerializeContext(&startup_blob, &read_only_blob, &context_blob);
+  SnapshotData original_snapshot_data(context_blob);
   SnapshotData compressed =
       i::SnapshotCompression::Compress(&original_snapshot_data);
   SnapshotData decompressed =
       i::SnapshotCompression::Decompress(compressed.RawData());
-  CHECK_EQ(partial_blob, decompressed.RawData());
+  CHECK_EQ(context_blob, decompressed.RawData());
 
   startup_blob.Dispose();
   read_only_blob.Dispose();
-  partial_blob.Dispose();
+  context_blob.Dispose();
 }
 
-UNINITIALIZED_TEST(PartialSerializerContext) {
+UNINITIALIZED_TEST(ContextSerializerContext) {
   DisableAlwaysOpt();
   Vector<const byte> startup_blob;
   Vector<const byte> read_only_blob;
-  Vector<const byte> partial_blob;
-  PartiallySerializeContext(&startup_blob, &read_only_blob, &partial_blob);
+  Vector<const byte> context_blob;
+  SerializeContext(&startup_blob, &read_only_blob, &context_blob);
 
   StartupBlobs blobs = {startup_blob, read_only_blob};
   v8::Isolate* v8_isolate = TestSerializer::NewIsolateFromBlob(blobs);
@@ -453,8 +452,8 @@ UNINITIALIZED_TEST(PartialSerializerContext) {
         isolate->factory()->NewUninitializedJSGlobalProxy(
             JSGlobalProxy::SizeWithEmbedderFields(0));
     {
-      SnapshotData snapshot_data(partial_blob);
-      root = PartialDeserializer::DeserializeContext(
+      SnapshotData snapshot_data(context_blob);
+      root = ContextDeserializer::DeserializeContext(
                  isolate, &snapshot_data, false, global_proxy,
                  v8::DeserializeInternalFieldsCallback())
                  .ToHandleChecked();
@@ -464,25 +463,24 @@ UNINITIALIZED_TEST(PartialSerializerContext) {
 
     Handle<Object> root2;
     {
-      SnapshotData snapshot_data(partial_blob);
-      root2 = PartialDeserializer::DeserializeContext(
+      SnapshotData snapshot_data(context_blob);
+      root2 = ContextDeserializer::DeserializeContext(
                   isolate, &snapshot_data, false, global_proxy,
                   v8::DeserializeInternalFieldsCallback())
                   .ToHandleChecked();
       CHECK(root2->IsContext());
       CHECK(!root.is_identical_to(root2));
     }
-    partial_blob.Dispose();
+    context_blob.Dispose();
   }
   v8_isolate->Dispose();
   blobs.Dispose();
   FreeCurrentEmbeddedBlob();
 }
 
-static void PartiallySerializeCustomContext(
-    Vector<const byte>* startup_blob_out,
-    Vector<const byte>* read_only_blob_out,
-    Vector<const byte>* partial_blob_out) {
+static void SerializeCustomContext(Vector<const byte>* startup_blob_out,
+                                   Vector<const byte>* read_only_blob_out,
+                                   Vector<const byte>* context_blob_out) {
   v8::Isolate* v8_isolate = TestSerializer::NewIsolateInitialized();
   Isolate* isolate = reinterpret_cast<Isolate*>(v8_isolate);
   {
@@ -511,12 +509,12 @@ static void PartiallySerializeCustomContext(
           "var p = 0;"
           "(async ()=>{ p = await 42; })();");
 
-      Vector<const uint8_t> source = ConstructSource(
+      Vector<const char> source = ConstructSource(
           StaticCharVector("function g() { return [,"), StaticCharVector("1,"),
           StaticCharVector("];} a = g(); b = g(); b.push(1);"), 100000);
-      v8::MaybeLocal<v8::String> source_str = v8::String::NewFromOneByte(
-          v8_isolate, source.begin(), v8::NewStringType::kNormal,
-          source.length());
+      v8::MaybeLocal<v8::String> source_str =
+          v8::String::NewFromUtf8(v8_isolate, source.begin(),
+                                  v8::NewStringType::kNormal, source.length());
       CompileRun(source_str.ToLocalChecked());
       source.Dispose();
     }
@@ -534,18 +532,22 @@ static void PartiallySerializeCustomContext(
 
     env.Reset();
 
+    DisallowHeapAllocation no_gc;
     SnapshotByteSink read_only_sink;
-    ReadOnlySerializer read_only_serializer(isolate);
+    ReadOnlySerializer read_only_serializer(isolate,
+                                            Snapshot::kDefaultSerializerFlags);
     read_only_serializer.SerializeReadOnlyRoots();
 
     SnapshotByteSink startup_sink;
-    StartupSerializer startup_serializer(isolate, &read_only_serializer);
-    startup_serializer.SerializeStrongReferences();
+    StartupSerializer startup_serializer(
+        isolate, Snapshot::kDefaultSerializerFlags, &read_only_serializer);
+    startup_serializer.SerializeStrongReferences(no_gc);
 
-    SnapshotByteSink partial_sink;
-    PartialSerializer partial_serializer(isolate, &startup_serializer,
-                                         v8::SerializeInternalFieldsCallback());
-    partial_serializer.Serialize(&raw_context, false);
+    SnapshotByteSink context_sink;
+    ContextSerializer context_serializer(
+        isolate, Snapshot::kDefaultSerializerFlags, &startup_serializer,
+        v8::SerializeInternalFieldsCallback());
+    context_serializer.Serialize(&raw_context, no_gc);
 
     startup_serializer.SerializeWeakReferencesAndDeferred();
 
@@ -553,23 +555,21 @@ static void PartiallySerializeCustomContext(
 
     SnapshotData read_only_snapshot(&read_only_serializer);
     SnapshotData startup_snapshot(&startup_serializer);
-    SnapshotData partial_snapshot(&partial_serializer);
+    SnapshotData context_snapshot(&context_serializer);
 
-    *partial_blob_out = WritePayload(partial_snapshot.RawData());
+    *context_blob_out = WritePayload(context_snapshot.RawData());
     *startup_blob_out = WritePayload(startup_snapshot.RawData());
     *read_only_blob_out = WritePayload(read_only_snapshot.RawData());
   }
   v8_isolate->Dispose();
-  ReadOnlyHeap::ClearSharedHeapForTest();
 }
 
-UNINITIALIZED_TEST(PartialSerializerCustomContext) {
+UNINITIALIZED_TEST(ContextSerializerCustomContext) {
   DisableAlwaysOpt();
   Vector<const byte> startup_blob;
   Vector<const byte> read_only_blob;
-  Vector<const byte> partial_blob;
-  PartiallySerializeCustomContext(&startup_blob, &read_only_blob,
-                                  &partial_blob);
+  Vector<const byte> context_blob;
+  SerializeCustomContext(&startup_blob, &read_only_blob, &context_blob);
 
   StartupBlobs blobs = {startup_blob, read_only_blob};
   v8::Isolate* v8_isolate = TestSerializer::NewIsolateFromBlob(blobs);
@@ -584,8 +584,8 @@ UNINITIALIZED_TEST(PartialSerializerCustomContext) {
         isolate->factory()->NewUninitializedJSGlobalProxy(
             JSGlobalProxy::SizeWithEmbedderFields(0));
     {
-      SnapshotData snapshot_data(partial_blob);
-      root = PartialDeserializer::DeserializeContext(
+      SnapshotData snapshot_data(context_blob);
+      root = ContextDeserializer::DeserializeContext(
                  isolate, &snapshot_data, false, global_proxy,
                  v8::DeserializeInternalFieldsCallback())
                  .ToHandleChecked();
@@ -657,7 +657,7 @@ UNINITIALIZED_TEST(PartialSerializerCustomContext) {
                   .FromJust();
       CHECK_EQ(100002, b);
     }
-    partial_blob.Dispose();
+    context_blob.Dispose();
   }
   v8_isolate->Dispose();
   blobs.Dispose();
@@ -782,7 +782,6 @@ void TestCustomSnapshotDataBlobWithIrregexpCode(
   DisableEmbeddedBlobRefcounting();
   v8::StartupData data1 =
       CreateSnapshotDataBlobInternal(function_code_handling, source);
-  ReadOnlyHeap::ClearSharedHeapForTest();
 
   v8::Isolate::CreateParams params1;
   params1.snapshot_blob = &data1;
@@ -931,7 +930,6 @@ void TypedArrayTestHelper(
         creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear);
   }
 
-  ReadOnlyHeap::ClearSharedHeapForTest();
   v8::Isolate::CreateParams create_params;
   create_params.snapshot_blob = &blob;
   create_params.array_buffer_allocator =
@@ -1100,7 +1098,6 @@ UNINITIALIZED_TEST(CustomSnapshotDataBlobDetachedArrayBuffer) {
         creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear);
   }
 
-  ReadOnlyHeap::ClearSharedHeapForTest();
   v8::Isolate::CreateParams create_params;
   create_params.snapshot_blob = &blob;
   create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -1171,7 +1168,6 @@ UNINITIALIZED_TEST(CustomSnapshotDataBlobOnOrOffHeapTypedArray) {
         creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear);
   }
 
-  ReadOnlyHeap::ClearSharedHeapForTest();
   v8::Isolate::CreateParams create_params;
   create_params.snapshot_blob = &blob;
   create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -1225,7 +1221,6 @@ UNINITIALIZED_TEST(CustomSnapshotDataBlobTypedArrayNoEmbedderFieldCallback) {
         creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear);
   }
 
-  ReadOnlyHeap::ClearSharedHeapForTest();
   v8::Isolate::CreateParams create_params;
   create_params.snapshot_blob = &blob;
   create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -1348,7 +1343,6 @@ UNINITIALIZED_TEST(CustomSnapshotDataBlobWithLocker) {
   const char* source1 = "function f() { return 42; }";
 
   DisableEmbeddedBlobRefcounting();
-  ReadOnlyHeap::ClearSharedHeapForTest();
   v8::StartupData data1 = CreateSnapshotDataBlob(source1);
 
   v8::Isolate::CreateParams params1;
@@ -1426,7 +1420,6 @@ UNINITIALIZED_TEST(SnapshotDataBlobWithWarmup) {
   DisableEmbeddedBlobRefcounting();
   v8::StartupData cold = CreateSnapshotDataBlob(nullptr);
   v8::StartupData warm = WarmUpSnapshotDataBlobInternal(cold, warmup);
-  ReadOnlyHeap::ClearSharedHeapForTest();
   delete[] cold.data;
 
   v8::Isolate::CreateParams params;
@@ -1463,7 +1456,6 @@ UNINITIALIZED_TEST(CustomSnapshotDataBlobWithWarmup) {
   DisableEmbeddedBlobRefcounting();
   v8::StartupData cold = CreateSnapshotDataBlob(source);
   v8::StartupData warm = WarmUpSnapshotDataBlobInternal(cold, warmup);
-  ReadOnlyHeap::ClearSharedHeapForTest();
   delete[] cold.data;
 
   v8::Isolate::CreateParams params;
@@ -1496,14 +1488,13 @@ UNINITIALIZED_TEST(CustomSnapshotDataBlobImmortalImmovableRoots) {
   // Flood the startup snapshot with shared function infos. If they are
   // serialized before the immortal immovable root, the root will no longer end
   // up on the first page.
-  Vector<const uint8_t> source =
+  Vector<const char> source =
       ConstructSource(StaticCharVector("var a = [];"),
                       StaticCharVector("a.push(function() {return 7});"),
                       StaticCharVector("\0"), 10000);
 
   DisableEmbeddedBlobRefcounting();
-  v8::StartupData data =
-      CreateSnapshotDataBlob(reinterpret_cast<const char*>(source.begin()));
+  v8::StartupData data = CreateSnapshotDataBlob(source.begin());
 
   v8::Isolate::CreateParams params;
   params.snapshot_blob = &data;
@@ -1672,7 +1663,7 @@ void TestCodeSerializerOnePlusOneImpl(bool verify_builtins_count = true) {
 TEST(CodeSerializerOnePlusOne) { TestCodeSerializerOnePlusOneImpl(); }
 
 // See bug v8:9122
-#if !defined(V8_TARGET_ARCH_ARM) && !defined(V8_TARGET_ARCH_S390X)
+#ifndef V8_TARGET_ARCH_ARM
 TEST(CodeSerializerOnePlusOneWithInterpretedFramesNativeStack) {
   FLAG_interpreted_frames_native_stack = true;
   // We pass false because this test will create IET copies (which are
@@ -1804,13 +1795,13 @@ TEST(CodeSerializerLargeCodeObject) {
   // code. Don't even bother generating optimized code to avoid timeouts.
   FLAG_always_opt = false;
 
-  Vector<const uint8_t> source = ConstructSource(
+  Vector<const char> source = ConstructSource(
       StaticCharVector("var j=1; if (j == 0) {"),
       StaticCharVector(
           "for (let i of Object.prototype) for (let k = 0; k < 0; ++k);"),
       StaticCharVector("} j=7; j"), 2000);
   Handle<String> source_str =
-      isolate->factory()->NewStringFromOneByte(source).ToHandleChecked();
+      isolate->factory()->NewStringFromUtf8(source).ToHandleChecked();
 
   Handle<JSObject> global(isolate->context().global_object(), isolate);
   ScriptData* cache = nullptr;
@@ -1860,12 +1851,12 @@ TEST(CodeSerializerLargeCodeObjectWithIncrementalMarking) {
 
   v8::HandleScope scope(CcTest::isolate());
 
-  Vector<const uint8_t> source = ConstructSource(
+  Vector<const char> source = ConstructSource(
       StaticCharVector("var j=1; if (j == 0) {"),
       StaticCharVector("for (var i = 0; i < Object.prototype; i++);"),
       StaticCharVector("} j=7; var s = 'happy_hippo'; j"), 20000);
   Handle<String> source_str =
-      isolate->factory()->NewStringFromOneByte(source).ToHandleChecked();
+      isolate->factory()->NewStringFromUtf8(source).ToHandleChecked();
 
   // Create a string on an evacuation candidate in old space.
   Handle<String> moving_object;
@@ -1922,6 +1913,7 @@ TEST(CodeSerializerLargeCodeObjectWithIncrementalMarking) {
   delete cache;
   source.Dispose();
 }
+
 TEST(CodeSerializerLargeStrings) {
   LocalContext context;
   Isolate* isolate = CcTest::i_isolate();
@@ -1931,15 +1923,15 @@ TEST(CodeSerializerLargeStrings) {
 
   v8::HandleScope scope(CcTest::isolate());
 
-  Vector<const uint8_t> source_s = ConstructSource(
+  Vector<const char> source_s = ConstructSource(
       StaticCharVector("var s = \""), StaticCharVector("abcdef"),
       StaticCharVector("\";"), 1000000);
-  Vector<const uint8_t> source_t = ConstructSource(
+  Vector<const char> source_t = ConstructSource(
       StaticCharVector("var t = \""), StaticCharVector("uvwxyz"),
       StaticCharVector("\"; s + t"), 999999);
   Handle<String> source_str =
-      f->NewConsString(f->NewStringFromOneByte(source_s).ToHandleChecked(),
-                       f->NewStringFromOneByte(source_t).ToHandleChecked())
+      f->NewConsString(f->NewStringFromUtf8(source_s).ToHandleChecked(),
+                       f->NewStringFromUtf8(source_t).ToHandleChecked())
           .ToHandleChecked();
 
   Handle<JSObject> global(isolate->context().global_object(), isolate);
@@ -1992,23 +1984,23 @@ TEST(CodeSerializerThreeBigStrings) {
   const int32_t length_of_b = kMaxRegularHeapObjectSize / 2;
   const int32_t length_of_c = kMaxRegularHeapObjectSize / 2;
 
-  Vector<const uint8_t> source_a =
+  Vector<const char> source_a =
       ConstructSource(StaticCharVector("var a = \""), StaticCharVector("a"),
                       StaticCharVector("\";"), length_of_a);
   Handle<String> source_a_str =
-      f->NewStringFromOneByte(source_a).ToHandleChecked();
+      f->NewStringFromUtf8(source_a).ToHandleChecked();
 
-  Vector<const uint8_t> source_b =
+  Vector<const char> source_b =
       ConstructSource(StaticCharVector("var b = \""), StaticCharVector("b"),
                       StaticCharVector("\";"), length_of_b);
   Handle<String> source_b_str =
-      f->NewStringFromOneByte(source_b).ToHandleChecked();
+      f->NewStringFromUtf8(source_b).ToHandleChecked();
 
-  Vector<const uint8_t> source_c =
+  Vector<const char> source_c =
       ConstructSource(StaticCharVector("var c = \""), StaticCharVector("c"),
                       StaticCharVector("\";"), length_of_c);
   Handle<String> source_c_str =
-      f->NewStringFromOneByte(source_c).ToHandleChecked();
+      f->NewStringFromUtf8(source_c).ToHandleChecked();
 
   Handle<String> source_str =
       f->NewConsString(
@@ -2178,10 +2170,10 @@ TEST(CodeSerializerLargeExternalString) {
   v8::HandleScope scope(CcTest::isolate());
 
   // Create a huge external internalized string to use as variable name.
-  Vector<const uint8_t> string =
+  Vector<const char> string =
       ConstructSource(StaticCharVector(""), StaticCharVector("abcdef"),
                       StaticCharVector(""), 999999);
-  Handle<String> name = f->NewStringFromOneByte(string).ToHandleChecked();
+  Handle<String> name = f->NewStringFromUtf8(string).ToHandleChecked();
   SerializerOneByteResource one_byte_resource(
       reinterpret_cast<const char*>(string.begin()), string.length());
   name = f->InternalizeString(name);
@@ -2665,7 +2657,6 @@ UNINITIALIZED_TEST(SnapshotCreatorMultipleContexts) {
         creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear);
   }
 
-  ReadOnlyHeap::ClearSharedHeapForTest();
   v8::Isolate::CreateParams params;
   params.snapshot_blob = &blob;
   params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -2804,7 +2795,6 @@ UNINITIALIZED_TEST(SnapshotCreatorExternalReferences) {
 
   // Deserialize with the original external reference.
   {
-    ReadOnlyHeap::ClearSharedHeapForTest();
     v8::Isolate::CreateParams params;
     params.snapshot_blob = &blob;
     params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -2830,7 +2820,6 @@ UNINITIALIZED_TEST(SnapshotCreatorExternalReferences) {
 
   // Deserialize with some other external reference.
   {
-    ReadOnlyHeap::ClearSharedHeapForTest();
     v8::Isolate::CreateParams params;
     params.snapshot_blob = &blob;
     params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -2879,7 +2868,6 @@ UNINITIALIZED_TEST(SnapshotCreatorShortExternalReferences) {
 
   // Deserialize with an incomplete list of external references.
   {
-    ReadOnlyHeap::ClearSharedHeapForTest();
     v8::Isolate::CreateParams params;
     params.snapshot_blob = &blob;
     params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -2940,7 +2928,6 @@ UNINITIALIZED_TEST(SnapshotCreatorNoExternalReferencesDefault) {
 
   // Deserialize with an incomplete list of external references.
   {
-    ReadOnlyHeap::ClearSharedHeapForTest();
     v8::Isolate::CreateParams params;
     params.snapshot_blob = &blob;
     params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -2990,7 +2977,6 @@ UNINITIALIZED_TEST(SnapshotCreatorPreparseDataAndNoOuterScope) {
 
   // Deserialize with an incomplete list of external references.
   {
-    ReadOnlyHeap::ClearSharedHeapForTest();
     v8::Isolate::CreateParams params;
     params.snapshot_blob = &blob;
     params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -3030,7 +3016,6 @@ UNINITIALIZED_TEST(SnapshotCreatorArrayJoinWithKeep) {
   DisableAlwaysOpt();
   DisableEmbeddedBlobRefcounting();
   v8::StartupData blob = CreateCustomSnapshotArrayJoinWithKeep();
-  ReadOnlyHeap::ClearSharedHeapForTest();
 
   // Deserialize with an incomplete list of external references.
   {
@@ -3076,7 +3061,6 @@ UNINITIALIZED_TEST(SnapshotCreatorDuplicateFunctions) {
   DisableAlwaysOpt();
   DisableEmbeddedBlobRefcounting();
   v8::StartupData blob = CreateCustomSnapshotWithDuplicateFunctions();
-  ReadOnlyHeap::ClearSharedHeapForTest();
 
   // Deserialize with an incomplete list of external references.
   {
@@ -3105,7 +3089,6 @@ TEST(SnapshotCreatorNoExternalReferencesCustomFail1) {
 
   // Deserialize with an incomplete list of external references.
   {
-    ReadOnlyHeap::ClearSharedHeapForTest();
     v8::Isolate::CreateParams params;
     params.snapshot_blob = &blob;
     params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -3131,7 +3114,6 @@ TEST(SnapshotCreatorNoExternalReferencesCustomFail2) {
 
   // Deserialize with an incomplete list of external references.
   {
-    ReadOnlyHeap::ClearSharedHeapForTest();
     v8::Isolate::CreateParams params;
     params.snapshot_blob = &blob;
     params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -3250,7 +3232,6 @@ UNINITIALIZED_TEST(SnapshotCreatorTemplates) {
   }
 
   {
-    ReadOnlyHeap::ClearSharedHeapForTest();
     v8::Isolate::CreateParams params;
     params.snapshot_blob = &blob;
     params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -3415,7 +3396,6 @@ UNINITIALIZED_TEST(SnapshotCreatorAddData) {
   }
 
   {
-    ReadOnlyHeap::ClearSharedHeapForTest();
     v8::Isolate::CreateParams params;
     params.snapshot_blob = &blob;
     params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -3496,7 +3476,6 @@ UNINITIALIZED_TEST(SnapshotCreatorAddData) {
     isolate->Dispose();
   }
   {
-    ReadOnlyHeap::ClearSharedHeapForTest();
     SnapshotCreator creator(nullptr, &blob);
     v8::Isolate* isolate = creator.GetIsolate();
     {
@@ -3523,7 +3502,6 @@ UNINITIALIZED_TEST(SnapshotCreatorAddData) {
         creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear);
   }
   {
-    ReadOnlyHeap::ClearSharedHeapForTest();
     v8::Isolate::CreateParams params;
     params.snapshot_blob = &blob;
     params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -3668,7 +3646,6 @@ UNINITIALIZED_TEST(SnapshotCreatorIncludeGlobalProxy) {
   }
 
   {
-    ReadOnlyHeap::ClearSharedHeapForTest();
     v8::Isolate::CreateParams params;
     params.snapshot_blob = &blob;
     params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -3778,7 +3755,7 @@ UNINITIALIZED_TEST(SnapshotCreatorIncludeGlobalProxy) {
   FreeCurrentEmbeddedBlob();
 }
 
-UNINITIALIZED_TEST(ReinitializeHashSeedNotRehashable) {
+UNINITIALIZED_TEST(ReinitializeHashSeedJSCollectionRehashable) {
   DisableAlwaysOpt();
   i::FLAG_rehash_snapshot = true;
   i::FLAG_hash_seed = 42;
@@ -3796,24 +3773,28 @@ UNINITIALIZED_TEST(ReinitializeHashSeedNotRehashable) {
       CompileRun(
           "var m = new Map();"
           "m.set('a', 1);"
-          "m.set('b', 2);");
+          "m.set('b', 2);"
+          "var s = new Set();"
+          "s.add(1);"
+          "s.add(globalThis);");
       ExpectInt32("m.get('b')", 2);
+      ExpectTrue("s.has(1)");
+      ExpectTrue("s.has(globalThis)");
       creator.SetDefaultContext(context);
     }
     blob =
         creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear);
-    CHECK(!blob.CanBeRehashed());
+    CHECK(blob.CanBeRehashed());
   }
 
-  ReadOnlyHeap::ClearSharedHeapForTest();
   i::FLAG_hash_seed = 1337;
   v8::Isolate::CreateParams create_params;
   create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
   create_params.snapshot_blob = &blob;
   v8::Isolate* isolate = v8::Isolate::New(create_params);
   {
-    // Check that no rehashing has been performed.
-    CHECK_EQ(static_cast<uint64_t>(42),
+    // Check that rehashing has been performed.
+    CHECK_EQ(static_cast<uint64_t>(1337),
              HashSeed(reinterpret_cast<i::Isolate*>(isolate)));
     v8::Isolate::Scope isolate_scope(isolate);
     v8::HandleScope handle_scope(isolate);
@@ -3821,6 +3802,8 @@ UNINITIALIZED_TEST(ReinitializeHashSeedNotRehashable) {
     CHECK(!context.IsEmpty());
     v8::Context::Scope context_scope(context);
     ExpectInt32("m.get('b')", 2);
+    ExpectTrue("s.has(1)");
+    ExpectTrue("s.has(globalThis)");
   }
   isolate->Dispose();
   delete[] blob.data;
@@ -3872,7 +3855,6 @@ UNINITIALIZED_TEST(ReinitializeHashSeedRehashable) {
     CHECK(blob.CanBeRehashed());
   }
 
-  ReadOnlyHeap::ClearSharedHeapForTest();
   i::FLAG_hash_seed = 1337;
   v8::Isolate::CreateParams create_params;
   create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -3941,7 +3923,6 @@ UNINITIALIZED_TEST(WeakArraySerializationInSnapshot) {
         creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear);
   }
 
-  ReadOnlyHeap::ClearSharedHeapForTest();
   v8::Isolate::CreateParams create_params;
   create_params.snapshot_blob = &blob;
   create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
diff --git a/deps/v8/test/cctest/test-unboxed-doubles.cc b/deps/v8/test/cctest/test-unboxed-doubles.cc
index ebeb05597e4..525a73a788c 100644
--- a/deps/v8/test/cctest/test-unboxed-doubles.cc
+++ b/deps/v8/test/cctest/test-unboxed-doubles.cc
@@ -45,20 +45,6 @@ static void InitializeVerifiedMapDescriptors(
   CHECK(layout_descriptor.IsConsistentWithMap(map, true));
 }
 
-static Handle<String> MakeString(const char* str) {
-  Isolate* isolate = CcTest::i_isolate();
-  Factory* factory = isolate->factory();
-  return factory->InternalizeUtf8String(str);
-}
-
-
-static Handle<String> MakeName(const char* str, int suffix) {
-  EmbeddedVector<char, 128> buffer;
-  SNPrintF(buffer, "%s%d", str, suffix);
-  return MakeString(buffer.begin());
-}
-
-
 Handle<JSObject> GetObject(const char* name) {
   return Handle<JSObject>::cast(
       v8::Utils::OpenHandle(*v8::Local<v8::Object>::Cast(
@@ -995,13 +981,14 @@ TEST(DescriptorArrayTrimming) {
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<Map> map = Map::Create(isolate, kFieldCount);
   for (int i = 0; i < kSplitFieldIndex; i++) {
-    map = Map::CopyWithField(isolate, map, MakeName("prop", i), any_type, NONE,
-                             PropertyConstness::kMutable, Representation::Smi(),
-                             INSERT_TRANSITION)
+    map = Map::CopyWithField(isolate, map, CcTest::MakeName("prop", i),
+                             any_type, NONE, PropertyConstness::kMutable,
+                             Representation::Smi(), INSERT_TRANSITION)
               .ToHandleChecked();
   }
-  map = Map::CopyWithField(isolate, map, MakeName("dbl", kSplitFieldIndex),
-                           any_type, NONE, PropertyConstness::kMutable,
+  map = Map::CopyWithField(isolate, map,
+                           CcTest::MakeName("dbl", kSplitFieldIndex), any_type,
+                           NONE, PropertyConstness::kMutable,
                            Representation::Double(), INSERT_TRANSITION)
             .ToHandleChecked();
   CHECK(map->layout_descriptor().IsConsistentWithMap(*map, true));
@@ -1015,7 +1002,7 @@ TEST(DescriptorArrayTrimming) {
 
     Handle<Map> tmp_map = map;
     for (int i = kSplitFieldIndex + 1; i < kFieldCount; i++) {
-      tmp_map = Map::CopyWithField(isolate, tmp_map, MakeName("dbl", i),
+      tmp_map = Map::CopyWithField(isolate, tmp_map, CcTest::MakeName("dbl", i),
                                    any_type, NONE, PropertyConstness::kMutable,
                                    Representation::Double(), INSERT_TRANSITION)
                     .ToHandleChecked();
@@ -1055,14 +1042,15 @@ TEST(DescriptorArrayTrimming) {
 
     Handle<Map> tmp_map = map;
     for (int i = kSplitFieldIndex + 1; i < kFieldCount - 1; i++) {
-      tmp_map = Map::CopyWithField(isolate, tmp_map, MakeName("tagged", i),
-                                   any_type, NONE, PropertyConstness::kMutable,
-                                   Representation::Tagged(), INSERT_TRANSITION)
-                    .ToHandleChecked();
+      tmp_map =
+          Map::CopyWithField(isolate, tmp_map, CcTest::MakeName("tagged", i),
+                             any_type, NONE, PropertyConstness::kMutable,
+                             Representation::Tagged(), INSERT_TRANSITION)
+              .ToHandleChecked();
       CHECK(tmp_map->layout_descriptor().IsConsistentWithMap(*tmp_map, true));
     }
-    tmp_map = Map::CopyWithField(isolate, tmp_map, MakeString("dbl"), any_type,
-                                 NONE, PropertyConstness::kMutable,
+    tmp_map = Map::CopyWithField(isolate, tmp_map, CcTest::MakeString("dbl"),
+                                 any_type, NONE, PropertyConstness::kMutable,
                                  Representation::Double(), INSERT_TRANSITION)
                   .ToHandleChecked();
     CHECK(tmp_map->layout_descriptor().IsConsistentWithMap(*tmp_map, true));
@@ -1087,8 +1075,8 @@ TEST(DoScavenge) {
 
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<Map> map = Map::Create(isolate, 10);
-  map = Map::CopyWithField(isolate, map, MakeName("prop", 0), any_type, NONE,
-                           PropertyConstness::kMutable,
+  map = Map::CopyWithField(isolate, map, CcTest::MakeName("prop", 0), any_type,
+                           NONE, PropertyConstness::kMutable,
                            Representation::Double(), INSERT_TRANSITION)
             .ToHandleChecked();
 
@@ -1153,12 +1141,12 @@ TEST(DoScavengeWithIncrementalWriteBarrier) {
 
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<Map> map = Map::Create(isolate, 10);
-  map = Map::CopyWithField(isolate, map, MakeName("prop", 0), any_type, NONE,
-                           PropertyConstness::kMutable,
+  map = Map::CopyWithField(isolate, map, CcTest::MakeName("prop", 0), any_type,
+                           NONE, PropertyConstness::kMutable,
                            Representation::Double(), INSERT_TRANSITION)
             .ToHandleChecked();
-  map = Map::CopyWithField(isolate, map, MakeName("prop", 1), any_type, NONE,
-                           PropertyConstness::kMutable,
+  map = Map::CopyWithField(isolate, map, CcTest::MakeName("prop", 1), any_type,
+                           NONE, PropertyConstness::kMutable,
                            Representation::Tagged(), INSERT_TRANSITION)
             .ToHandleChecked();
 
@@ -1390,14 +1378,14 @@ TEST(LayoutDescriptorSharing) {
   {
     Handle<Map> map = Map::Create(isolate, 64);
     for (int i = 0; i < 32; i++) {
-      Handle<String> name = MakeName("prop", i);
+      Handle<String> name = CcTest::MakeName("prop", i);
       map = Map::CopyWithField(isolate, map, name, any_type, NONE,
                                PropertyConstness::kMutable,
                                Representation::Smi(), INSERT_TRANSITION)
                 .ToHandleChecked();
     }
-    split_map = Map::CopyWithField(isolate, map, MakeString("dbl"), any_type,
-                                   NONE, PropertyConstness::kMutable,
+    split_map = Map::CopyWithField(isolate, map, CcTest::MakeString("dbl"),
+                                   any_type, NONE, PropertyConstness::kMutable,
                                    Representation::Double(), INSERT_TRANSITION)
                     .ToHandleChecked();
   }
@@ -1408,9 +1396,9 @@ TEST(LayoutDescriptorSharing) {
   CHECK(split_map->owns_descriptors());
 
   Handle<Map> map1 =
-      Map::CopyWithField(isolate, split_map, MakeString("foo"), any_type, NONE,
-                         PropertyConstness::kMutable, Representation::Double(),
-                         INSERT_TRANSITION)
+      Map::CopyWithField(isolate, split_map, CcTest::MakeString("foo"),
+                         any_type, NONE, PropertyConstness::kMutable,
+                         Representation::Double(), INSERT_TRANSITION)
           .ToHandleChecked();
   CHECK(!split_map->owns_descriptors());
   CHECK_EQ(*split_layout_descriptor, split_map->layout_descriptor());
@@ -1421,9 +1409,9 @@ TEST(LayoutDescriptorSharing) {
   CHECK(map1->layout_descriptor().IsConsistentWithMap(*map1, true));
 
   Handle<Map> map2 =
-      Map::CopyWithField(isolate, split_map, MakeString("bar"), any_type, NONE,
-                         PropertyConstness::kMutable, Representation::Tagged(),
-                         INSERT_TRANSITION)
+      Map::CopyWithField(isolate, split_map, CcTest::MakeString("bar"),
+                         any_type, NONE, PropertyConstness::kMutable,
+                         Representation::Tagged(), INSERT_TRANSITION)
           .ToHandleChecked();
 
   // Layout descriptors should not be shared with |split_map|.
@@ -1595,15 +1583,15 @@ static void TestWriteBarrierObjectShiftFieldsRight(
   Handle<JSObject> func = GetObject("func");
 
   Handle<Map> map = Map::Create(isolate, 10);
-  map = Map::CopyWithConstant(isolate, map, MakeName("prop", 0), func, NONE,
-                              INSERT_TRANSITION)
+  map = Map::CopyWithConstant(isolate, map, CcTest::MakeName("prop", 0), func,
+                              NONE, INSERT_TRANSITION)
             .ToHandleChecked();
-  map = Map::CopyWithField(isolate, map, MakeName("prop", 1), any_type, NONE,
-                           PropertyConstness::kMutable,
+  map = Map::CopyWithField(isolate, map, CcTest::MakeName("prop", 1), any_type,
+                           NONE, PropertyConstness::kMutable,
                            Representation::Double(), INSERT_TRANSITION)
             .ToHandleChecked();
-  map = Map::CopyWithField(isolate, map, MakeName("prop", 2), any_type, NONE,
-                           PropertyConstness::kMutable,
+  map = Map::CopyWithField(isolate, map, CcTest::MakeName("prop", 2), any_type,
+                           NONE, PropertyConstness::kMutable,
                            Representation::Tagged(), INSERT_TRANSITION)
             .ToHandleChecked();
 
diff --git a/deps/v8/test/cctest/torque/test-torque.cc b/deps/v8/test/cctest/torque/test-torque.cc
index 9442dab6f5e..bc84077594a 100644
--- a/deps/v8/test/cctest/torque/test-torque.cc
+++ b/deps/v8/test/cctest/torque/test-torque.cc
@@ -19,6 +19,7 @@
 #include "src/strings/char-predicates.h"
 #include "test/cctest/compiler/code-assembler-tester.h"
 #include "test/cctest/compiler/function-tester.h"
+#include "torque-generated/exported-class-definitions-tq-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -113,8 +114,7 @@ TEST(TestBuiltinSpecialization) {
   CodeAssemblerTester asm_tester(isolate, 0);
   TestTorqueAssembler m(asm_tester.state());
   {
-    TNode<Object> temp = m.SmiConstant(0);
-    m.TestBuiltinSpecialization(m.UncheckedCast<Context>(temp));
+    m.TestBuiltinSpecialization();
     m.Return(m.UndefinedConstant());
   }
   FunctionTester ft(asm_tester.GenerateCode(), 0);
@@ -170,8 +170,7 @@ TEST(TestFunctionPointerToGeneric) {
   CodeAssemblerTester asm_tester(isolate, 0);
   TestTorqueAssembler m(asm_tester.state());
   {
-    TNode<Object> temp = m.SmiConstant(0);
-    m.TestFunctionPointerToGeneric(m.UncheckedCast<Context>(temp));
+    m.TestFunctionPointerToGeneric();
     m.Return(m.UndefinedConstant());
   }
   FunctionTester ft(asm_tester.GenerateCode(), 0);
@@ -694,6 +693,43 @@ TEST(TestBitFieldStore) {
   }
 }
 
+TEST(TestBitFieldInit) {
+  CcTest::InitializeVM();
+  Isolate* isolate(CcTest::i_isolate());
+  i::HandleScope scope(isolate);
+  const int kNumParams = 4;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  TestTorqueAssembler m(asm_tester.state());
+  {
+    // Untag all of the parameters to get plain integer values.
+    TNode<BoolT> a =
+        m.UncheckedCast<BoolT>(m.Unsigned(m.SmiToInt32(m.Parameter(0))));
+    TNode<Uint16T> b =
+        m.UncheckedCast<Uint16T>(m.Unsigned(m.SmiToInt32(m.Parameter(1))));
+    TNode<Uint32T> c =
+        m.UncheckedCast<Uint32T>(m.Unsigned(m.SmiToInt32(m.Parameter(2))));
+    TNode<BoolT> d =
+        m.UncheckedCast<BoolT>(m.Unsigned(m.SmiToInt32(m.Parameter(3))));
+
+    // Call the Torque-defined macro, which verifies that reading each bitfield
+    // out of val yields the correct result.
+    m.TestBitFieldInit(a, b, c, d);
+    m.Return(m.UndefinedConstant());
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+
+  // Test every possible bit combination for this 8-bit value.
+  for (int a = 0; a <= 1; ++a) {
+    for (int b = 0; b <= 7; ++b) {
+      for (int c = 0; c <= 7; ++c) {
+        for (int d = 0; d <= 1; ++d) {
+          ft.Call(ft.Val(a), ft.Val(b), ft.Val(c), ft.Val(d));
+        }
+      }
+    }
+  }
+}
+
 TEST(TestBitFieldUintptrOps) {
   CcTest::InitializeVM();
   Isolate* isolate(CcTest::i_isolate());
@@ -720,6 +756,26 @@ TEST(TestBitFieldUintptrOps) {
   ft.Call(ft.Val(val2), ft.Val(val3));
 }
 
+TEST(TestBitFieldMultipleFlags) {
+  CcTest::InitializeVM();
+  Isolate* isolate(CcTest::i_isolate());
+  i::HandleScope scope(isolate);
+  const int kNumParams = 3;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  TestTorqueAssembler m(asm_tester.state());
+  {
+    TNode<BoolT> a =
+        m.UncheckedCast<BoolT>(m.Unsigned(m.SmiToInt32(m.Parameter(0))));
+    TNode<Int32T> b = m.SmiToInt32(m.Parameter(1));
+    TNode<BoolT> c =
+        m.UncheckedCast<BoolT>(m.Unsigned(m.SmiToInt32(m.Parameter(2))));
+    m.TestBitFieldMultipleFlags(a, b, c);
+    m.Return(m.UndefinedConstant());
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+  // No need to call it; we just checked StaticAsserts during compilation.
+}
+
 TEST(TestTestParentFrameArguments) {
   CcTest::InitializeVM();
   Isolate* isolate(CcTest::i_isolate());
diff --git a/deps/v8/test/cctest/wasm/test-gc.cc b/deps/v8/test/cctest/wasm/test-gc.cc
new file mode 100644
index 00000000000..05be659606c
--- /dev/null
+++ b/deps/v8/test/cctest/wasm/test-gc.cc
@@ -0,0 +1,414 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stdint.h>
+
+#include "src/utils/utils.h"
+#include "src/utils/vector.h"
+#include "src/wasm/module-decoder.h"
+#include "src/wasm/struct-types.h"
+#include "src/wasm/wasm-engine.h"
+#include "src/wasm/wasm-module-builder.h"
+#include "src/wasm/wasm-module.h"
+#include "src/wasm/wasm-objects-inl.h"
+#include "src/wasm/wasm-opcodes.h"
+#include "test/cctest/cctest.h"
+#include "test/cctest/compiler/value-helper.h"
+#include "test/cctest/wasm/wasm-run-utils.h"
+#include "test/common/wasm/test-signatures.h"
+#include "test/common/wasm/wasm-macro-gen.h"
+#include "test/common/wasm/wasm-module-runner.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+namespace test_gc {
+
+WASM_EXEC_TEST(BasicStruct) {
+  // TODO(7748): Implement support in other tiers.
+  if (execution_tier == ExecutionTier::kLiftoff) return;
+  if (execution_tier == ExecutionTier::kInterpreter) return;
+  TestSignatures sigs;
+  EXPERIMENTAL_FLAG_SCOPE(gc);
+  EXPERIMENTAL_FLAG_SCOPE(anyref);
+  v8::internal::AccountingAllocator allocator;
+  Zone zone(&allocator, ZONE_NAME);
+
+  WasmModuleBuilder* builder = new (&zone) WasmModuleBuilder(&zone);
+  StructType::Builder type_builder(&zone, 2);
+  type_builder.AddField(kWasmI32, true);
+  type_builder.AddField(kWasmI32, true);
+  int32_t type_index = builder->AddStructType(type_builder.Build());
+  ValueType kRefTypes[] = {ValueType(ValueType::kRef, type_index)};
+  ValueType kOptRefType = ValueType(ValueType::kOptRef, type_index);
+  FunctionSig sig_q_v(1, 0, kRefTypes);
+
+  // Test struct.new and struct.get.
+  WasmFunctionBuilder* f = builder->AddFunction(sigs.i_v());
+  f->builder()->AddExport(CStrVector("f"), f);
+  byte f_code[] = {WASM_STRUCT_GET(type_index, 0,
+                                   WASM_STRUCT_NEW(type_index, WASM_I32V(42),
+                                                   WASM_I32V(64))),
+                   kExprEnd};
+  f->EmitCode(f_code, sizeof(f_code));
+
+  // Test struct.new and struct.get.
+  WasmFunctionBuilder* g = builder->AddFunction(sigs.i_v());
+  g->builder()->AddExport(CStrVector("g"), g);
+  byte g_code[] = {WASM_STRUCT_GET(type_index, 1,
+                                   WASM_STRUCT_NEW(type_index, WASM_I32V(42),
+                                                   WASM_I32V(64))),
+                   kExprEnd};
+  g->EmitCode(g_code, sizeof(g_code));
+
+  // Test struct.new, returning struct references to JS.
+  WasmFunctionBuilder* h = builder->AddFunction(&sig_q_v);
+  h->builder()->AddExport(CStrVector("h"), h);
+  byte h_code[] = {WASM_STRUCT_NEW(type_index, WASM_I32V(42), WASM_I32V(64)),
+                   kExprEnd};
+  h->EmitCode(h_code, sizeof(h_code));
+
+  // Test struct.set, struct refs types in locals.
+  WasmFunctionBuilder* j = builder->AddFunction(sigs.i_v());
+  uint32_t j_local_index = j->AddLocal(kOptRefType);
+  uint32_t j_field_index = 0;
+  j->builder()->AddExport(CStrVector("j"), j);
+  byte j_code[] = {
+      WASM_SET_LOCAL(j_local_index,
+                     WASM_STRUCT_NEW(type_index, WASM_I32V(42), WASM_I32V(64))),
+      WASM_STRUCT_SET(type_index, j_field_index, WASM_GET_LOCAL(j_local_index),
+                      WASM_I32V(-99)),
+      WASM_STRUCT_GET(type_index, j_field_index, WASM_GET_LOCAL(j_local_index)),
+      kExprEnd};
+  j->EmitCode(j_code, sizeof(j_code));
+
+  // Test struct.set, ref.as_non_null,
+  // struct refs types in globals and if-results.
+  uint32_t k_global_index = builder->AddGlobal(kOptRefType, true);
+  WasmFunctionBuilder* k = builder->AddFunction(sigs.i_v());
+  uint32_t k_field_index = 0;
+  k->builder()->AddExport(CStrVector("k"), k);
+  byte k_code[] = {
+      WASM_SET_GLOBAL(k_global_index, WASM_STRUCT_NEW(type_index, WASM_I32V(55),
+                                                      WASM_I32V(66))),
+      WASM_STRUCT_GET(type_index, k_field_index,
+                      WASM_REF_AS_NON_NULL(WASM_IF_ELSE_R(
+                          kOptRefType, WASM_I32V(1),
+                          WASM_GET_GLOBAL(k_global_index), WASM_REF_NULL))),
+      kExprEnd};
+  k->EmitCode(k_code, sizeof(k_code));
+
+  // Test br_on_null 1.
+  WasmFunctionBuilder* l = builder->AddFunction(sigs.i_v());
+  uint32_t l_local_index = l->AddLocal(kOptRefType);
+  l->builder()->AddExport(CStrVector("l"), l);
+  byte l_code[] = {
+      WASM_BLOCK_I(WASM_I32V(42),
+                   // Branch will be taken.
+                   // 42 left on stack outside the block (not 52).
+                   WASM_BR_ON_NULL(0, WASM_GET_LOCAL(l_local_index)),
+                   WASM_I32V(52), WASM_BR(0)),
+      kExprEnd};
+  l->EmitCode(l_code, sizeof(l_code));
+
+  // Test br_on_null 2.
+  WasmFunctionBuilder* m = builder->AddFunction(sigs.i_v());
+  uint32_t m_field_index = 0;
+  m->builder()->AddExport(CStrVector("m"), m);
+  byte m_code[] = {
+      WASM_BLOCK_I(
+          WASM_I32V(42),
+          WASM_STRUCT_GET(
+              type_index, m_field_index,
+              // Branch will not be taken.
+              // 52 left on stack outside the block (not 42).
+              WASM_BR_ON_NULL(0, WASM_STRUCT_NEW(type_index, WASM_I32V(52),
+                                                 WASM_I32V(62)))),
+          WASM_BR(0)),
+      kExprEnd};
+  m->EmitCode(m_code, sizeof(m_code));
+
+  // Test ref.eq
+  WasmFunctionBuilder* n = builder->AddFunction(sigs.i_v());
+  uint32_t n_local_index = n->AddLocal(kOptRefType);
+  n->builder()->AddExport(CStrVector("n"), n);
+  byte n_code[] = {
+      WASM_SET_LOCAL(n_local_index,
+                     WASM_STRUCT_NEW(type_index, WASM_I32V(55), WASM_I32V(66))),
+      WASM_I32_ADD(
+          WASM_I32_SHL(
+              WASM_REF_EQ(  // true
+                  WASM_GET_LOCAL(n_local_index), WASM_GET_LOCAL(n_local_index)),
+              WASM_I32V(0)),
+          WASM_I32_ADD(
+              WASM_I32_SHL(WASM_REF_EQ(  // false
+                               WASM_GET_LOCAL(n_local_index),
+                               WASM_STRUCT_NEW(type_index, WASM_I32V(55),
+                                               WASM_I32V(66))),
+                           WASM_I32V(1)),
+              WASM_I32_ADD(
+                  WASM_I32_SHL(  // false
+                      WASM_REF_EQ(WASM_GET_LOCAL(n_local_index), WASM_REF_NULL),
+                      WASM_I32V(2)),
+                  WASM_I32_SHL(WASM_REF_EQ(  // true
+                                   WASM_REF_NULL, WASM_REF_NULL),
+                               WASM_I32V(3))))),
+      kExprEnd};
+  n->EmitCode(n_code, sizeof(n_code));
+  // Result: 0b1001
+
+  /************************* End of test definitions *************************/
+
+  ZoneBuffer buffer(&zone);
+  builder->WriteTo(&buffer);
+
+  Isolate* isolate = CcTest::InitIsolateOnce();
+  HandleScope scope(isolate);
+  testing::SetupIsolateForWasmModule(isolate);
+  ErrorThrower thrower(isolate, "Test");
+  MaybeHandle<WasmInstanceObject> maybe_instance =
+      testing::CompileAndInstantiateForTesting(
+          isolate, &thrower, ModuleWireBytes(buffer.begin(), buffer.end()));
+  if (thrower.error()) FATAL("%s", thrower.error_msg());
+  Handle<WasmInstanceObject> instance = maybe_instance.ToHandleChecked();
+
+  CHECK_EQ(42, testing::CallWasmFunctionForTesting(isolate, instance, &thrower,
+                                                   "f", 0, nullptr));
+  CHECK_EQ(64, testing::CallWasmFunctionForTesting(isolate, instance, &thrower,
+                                                   "g", 0, nullptr));
+
+  // TODO(7748): This uses the JavaScript interface to retrieve the plain
+  // WasmStruct. Once the JS interaction story is settled, this may well
+  // need to be changed.
+  Handle<WasmExportedFunction> h_export =
+      testing::GetExportedFunction(isolate, instance, "h").ToHandleChecked();
+  Handle<Object> undefined = isolate->factory()->undefined_value();
+  Handle<Object> ref_result =
+      Execution::Call(isolate, h_export, undefined, 0, nullptr)
+          .ToHandleChecked();
+  CHECK(ref_result->IsWasmStruct());
+
+  CHECK_EQ(-99, testing::CallWasmFunctionForTesting(isolate, instance, &thrower,
+                                                    "j", 0, nullptr));
+
+  CHECK_EQ(55, testing::CallWasmFunctionForTesting(isolate, instance, &thrower,
+                                                   "k", 0, nullptr));
+
+  CHECK_EQ(42, testing::CallWasmFunctionForTesting(isolate, instance, &thrower,
+                                                   "l", 0, nullptr));
+
+  CHECK_EQ(52, testing::CallWasmFunctionForTesting(isolate, instance, &thrower,
+                                                   "m", 0, nullptr));
+
+  CHECK_EQ(0b1001, testing::CallWasmFunctionForTesting(
+                       isolate, instance, &thrower, "n", 0, nullptr));
+}
+
+WASM_EXEC_TEST(LetInstruction) {
+  // TODO(7748): Implement support in other tiers.
+  if (execution_tier == ExecutionTier::kLiftoff) return;
+  if (execution_tier == ExecutionTier::kInterpreter) return;
+  TestSignatures sigs;
+  EXPERIMENTAL_FLAG_SCOPE(gc);
+  EXPERIMENTAL_FLAG_SCOPE(typed_funcref);
+  EXPERIMENTAL_FLAG_SCOPE(anyref);
+  v8::internal::AccountingAllocator allocator;
+  Zone zone(&allocator, ZONE_NAME);
+
+  WasmModuleBuilder* builder = new (&zone) WasmModuleBuilder(&zone);
+  StructType::Builder type_builder(&zone, 2);
+  type_builder.AddField(kWasmI32, true);
+  type_builder.AddField(kWasmI32, true);
+  int32_t type_index = builder->AddStructType(type_builder.Build());
+  ValueType kRefTypes[] = {ValueType(ValueType::kRef, type_index)};
+  FunctionSig sig_q_v(1, 0, kRefTypes);
+
+  WasmFunctionBuilder* let_test_1 = builder->AddFunction(sigs.i_v());
+  let_test_1->builder()->AddExport(CStrVector("let_test_1"), let_test_1);
+  uint32_t let_local_index = 0;
+  uint32_t let_field_index = 0;
+  byte let_code[] = {
+      WASM_LET_1_I(WASM_REF_TYPE(type_index),
+                   WASM_STRUCT_NEW(type_index, WASM_I32V(42), WASM_I32V(52)),
+                   WASM_STRUCT_GET(type_index, let_field_index,
+                                   WASM_GET_LOCAL(let_local_index))),
+      kExprEnd};
+  let_test_1->EmitCode(let_code, sizeof(let_code));
+
+  WasmFunctionBuilder* let_test_2 = builder->AddFunction(sigs.i_v());
+  let_test_2->builder()->AddExport(CStrVector("let_test_2"), let_test_2);
+  uint32_t let_2_field_index = 0;
+  byte let_code_2[] = {
+      WASM_LET_2_I(kLocalI32, WASM_I32_ADD(WASM_I32V(42), WASM_I32V(-32)),
+                   WASM_REF_TYPE(type_index),
+                   WASM_STRUCT_NEW(type_index, WASM_I32V(42), WASM_I32V(52)),
+                   WASM_I32_MUL(WASM_STRUCT_GET(type_index, let_2_field_index,
+                                                WASM_GET_LOCAL(1)),
+                                WASM_GET_LOCAL(0))),
+      kExprEnd};
+  let_test_2->EmitCode(let_code_2, sizeof(let_code_2));
+
+  WasmFunctionBuilder* let_test_locals = builder->AddFunction(sigs.i_i());
+  let_test_locals->builder()->AddExport(CStrVector("let_test_locals"),
+                                        let_test_locals);
+  let_test_locals->AddLocal(kWasmI32);
+  byte let_code_locals[] = {
+      WASM_SET_LOCAL(1, WASM_I32V(100)),
+      WASM_LET_2_I(
+          kLocalI32, WASM_I32V(1), kLocalI32, WASM_I32V(10),
+          WASM_I32_SUB(WASM_I32_ADD(WASM_GET_LOCAL(0),     // 1st let-local
+                                    WASM_GET_LOCAL(2)),    // Parameter
+                       WASM_I32_ADD(WASM_GET_LOCAL(1),     // 2nd let-local
+                                    WASM_GET_LOCAL(3)))),  // Function local
+      kExprEnd};
+  // Result: (1 + 1000) - (10 + 100) = 891
+  let_test_locals->EmitCode(let_code_locals, sizeof(let_code_locals));
+
+  WasmFunctionBuilder* let_test_erase = builder->AddFunction(sigs.i_v());
+  let_test_erase->builder()->AddExport(CStrVector("let_test_erase"),
+                                       let_test_erase);
+  uint32_t let_erase_local_index = let_test_erase->AddLocal(kWasmI32);
+  byte let_code_erase[] = {WASM_SET_LOCAL(let_erase_local_index, WASM_I32V(0)),
+                           WASM_LET_1_V(kLocalI32, WASM_I32V(1), WASM_NOP),
+                           WASM_GET_LOCAL(let_erase_local_index), kExprEnd};
+  // The result should be 0 and not 1, as local_get(0) refers to the original
+  // local.
+  let_test_erase->EmitCode(let_code_erase, sizeof(let_code_erase));
+
+  /************************* End of test definitions *************************/
+
+  ZoneBuffer buffer(&zone);
+  builder->WriteTo(&buffer);
+
+  Isolate* isolate = CcTest::InitIsolateOnce();
+  HandleScope scope(isolate);
+  testing::SetupIsolateForWasmModule(isolate);
+  ErrorThrower thrower(isolate, "Test");
+  MaybeHandle<WasmInstanceObject> maybe_instance =
+      testing::CompileAndInstantiateForTesting(
+          isolate, &thrower, ModuleWireBytes(buffer.begin(), buffer.end()));
+  if (thrower.error()) FATAL("%s", thrower.error_msg());
+  Handle<WasmInstanceObject> instance = maybe_instance.ToHandleChecked();
+
+  CHECK_EQ(42, testing::CallWasmFunctionForTesting(isolate, instance, &thrower,
+                                                   "let_test_1", 0, nullptr));
+
+  CHECK_EQ(420, testing::CallWasmFunctionForTesting(isolate, instance, &thrower,
+                                                    "let_test_2", 0, nullptr));
+
+  Handle<Object> let_local_args[] = {handle(Smi::FromInt(1000), isolate)};
+  CHECK_EQ(891, testing::CallWasmFunctionForTesting(isolate, instance, &thrower,
+                                                    "let_test_locals", 1,
+                                                    let_local_args));
+  CHECK_EQ(0, testing::CallWasmFunctionForTesting(
+                  isolate, instance, &thrower, "let_test_erase", 0, nullptr));
+}
+
+WASM_EXEC_TEST(BasicArray) {
+  // TODO(7748): Implement support in other tiers.
+  if (execution_tier == ExecutionTier::kLiftoff) return;
+  if (execution_tier == ExecutionTier::kInterpreter) return;
+  TestSignatures sigs;
+  EXPERIMENTAL_FLAG_SCOPE(gc);
+  EXPERIMENTAL_FLAG_SCOPE(anyref);
+  v8::internal::AccountingAllocator allocator;
+  Zone zone(&allocator, ZONE_NAME);
+
+  WasmModuleBuilder* builder = new (&zone) WasmModuleBuilder(&zone);
+  ArrayType type(wasm::kWasmI32, true);
+  int32_t type_index = builder->AddArrayType(&type);
+  ValueType kRefTypes[] = {ValueType(ValueType::kRef, type_index)};
+  FunctionSig sig_q_v(1, 0, kRefTypes);
+  ValueType kOptRefType = ValueType(ValueType::kOptRef, type_index);
+
+  WasmFunctionBuilder* f = builder->AddFunction(sigs.i_i());
+  uint32_t local_index = f->AddLocal(kOptRefType);
+  f->builder()->AddExport(CStrVector("f"), f);
+  // f: a = [12, 12, 12]; a[1] = 42; return a[arg0]
+  byte f_code[] = {
+      WASM_SET_LOCAL(local_index,
+                     WASM_ARRAY_NEW(type_index, WASM_I32V(12), WASM_I32V(3))),
+      WASM_ARRAY_SET(type_index, WASM_GET_LOCAL(local_index), WASM_I32V(1),
+                     WASM_I32V(42)),
+      WASM_ARRAY_GET(type_index, WASM_GET_LOCAL(local_index),
+                     WASM_GET_LOCAL(0)),
+      kExprEnd};
+  f->EmitCode(f_code, sizeof(f_code));
+
+  // Reads and returns an array's length.
+  WasmFunctionBuilder* g = builder->AddFunction(sigs.i_v());
+  f->builder()->AddExport(CStrVector("g"), g);
+  byte g_code[] = {
+      WASM_ARRAY_LEN(type_index,
+                     WASM_ARRAY_NEW(type_index, WASM_I32V(0), WASM_I32V(42))),
+      kExprEnd};
+  g->EmitCode(g_code, sizeof(g_code));
+
+  WasmFunctionBuilder* h = builder->AddFunction(&sig_q_v);
+  h->builder()->AddExport(CStrVector("h"), h);
+  // Create an array of length 2, initialized to [42, 42].
+  byte h_code[] = {WASM_ARRAY_NEW(type_index, WASM_I32V(42), WASM_I32V(2)),
+                   kExprEnd};
+  h->EmitCode(h_code, sizeof(h_code));
+
+  ZoneBuffer buffer(&zone);
+  builder->WriteTo(&buffer);
+
+  Isolate* isolate = CcTest::InitIsolateOnce();
+  HandleScope scope(isolate);
+  testing::SetupIsolateForWasmModule(isolate);
+  ErrorThrower thrower(isolate, "Test");
+  Handle<WasmInstanceObject> instance =
+      testing::CompileAndInstantiateForTesting(
+          isolate, &thrower, ModuleWireBytes(buffer.begin(), buffer.end()))
+          .ToHandleChecked();
+
+  Handle<Object> argv[] = {handle(Smi::FromInt(0), isolate)};
+  CHECK_EQ(12, testing::CallWasmFunctionForTesting(isolate, instance, &thrower,
+                                                   "f", 1, argv));
+  argv[0] = handle(Smi::FromInt(1), isolate);
+  CHECK_EQ(42, testing::CallWasmFunctionForTesting(isolate, instance, &thrower,
+                                                   "f", 1, argv));
+  argv[0] = handle(Smi::FromInt(2), isolate);
+  CHECK_EQ(12, testing::CallWasmFunctionForTesting(isolate, instance, &thrower,
+                                                   "f", 1, argv));
+  Handle<Object> undefined = isolate->factory()->undefined_value();
+  {
+    Handle<WasmExportedFunction> f_export =
+        testing::GetExportedFunction(isolate, instance, "f").ToHandleChecked();
+    TryCatch try_catch(reinterpret_cast<v8::Isolate*>(isolate));
+    argv[0] = handle(Smi::FromInt(3), isolate);
+    MaybeHandle<Object> no_result =
+        Execution::Call(isolate, f_export, undefined, 1, argv);
+    CHECK(no_result.is_null());
+    CHECK(try_catch.HasCaught());
+    isolate->clear_pending_exception();
+    argv[0] = handle(Smi::FromInt(-1), isolate);
+    no_result = Execution::Call(isolate, f_export, undefined, 1, argv);
+    CHECK(no_result.is_null());
+    CHECK(try_catch.HasCaught());
+    isolate->clear_pending_exception();
+  }
+
+  CHECK_EQ(42, testing::CallWasmFunctionForTesting(isolate, instance, &thrower,
+                                                   "g", 0, nullptr));
+
+  // TODO(7748): This uses the JavaScript interface to retrieve the plain
+  // WasmArray. Once the JS interaction story is settled, this may well
+  // need to be changed.
+  Handle<WasmExportedFunction> h_export =
+      testing::GetExportedFunction(isolate, instance, "h").ToHandleChecked();
+  Handle<Object> ref_result =
+      Execution::Call(isolate, h_export, undefined, 0, nullptr)
+          .ToHandleChecked();
+  CHECK(ref_result->IsWasmArray());
+#if OBJECT_PRINT
+  ref_result->Print();
+#endif
+}
+
+}  // namespace test_gc
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/wasm/test-liftoff-inspection.cc b/deps/v8/test/cctest/wasm/test-liftoff-inspection.cc
index 4984bf4524f..9196c56aa88 100644
--- a/deps/v8/test/cctest/wasm/test-liftoff-inspection.cc
+++ b/deps/v8/test/cctest/wasm/test-liftoff-inspection.cc
@@ -42,12 +42,14 @@ class LiftoffCompileEnvironment {
     CompilationEnv env = module_builder_.CreateCompilationEnv();
     WasmFeatures detected1;
     WasmFeatures detected2;
-    WasmCompilationResult result1 = ExecuteLiftoffCompilation(
-        isolate_->allocator(), &env, test_func.body,
-        test_func.function->func_index, isolate_->counters(), &detected1);
-    WasmCompilationResult result2 = ExecuteLiftoffCompilation(
-        isolate_->allocator(), &env, test_func.body,
-        test_func.function->func_index, isolate_->counters(), &detected2);
+    WasmCompilationResult result1 =
+        ExecuteLiftoffCompilation(isolate_->allocator(), &env, test_func.body,
+                                  test_func.function->func_index, kNoDebugging,
+                                  isolate_->counters(), &detected1);
+    WasmCompilationResult result2 =
+        ExecuteLiftoffCompilation(isolate_->allocator(), &env, test_func.body,
+                                  test_func.function->func_index, kNoDebugging,
+                                  isolate_->counters(), &detected2);
 
     CHECK(result1.succeeded());
     CHECK(result2.succeeded());
@@ -68,14 +70,13 @@ class LiftoffCompileEnvironment {
       std::vector<int> breakpoints = {}) {
     auto test_func = AddFunction(return_types, param_types, raw_function_bytes);
 
-    CompilationEnv env = module_builder_.CreateCompilationEnv(
-        breakpoints.empty() ? TestingModuleBuilder::kNoDebug
-                            : TestingModuleBuilder::kDebug);
+    CompilationEnv env = module_builder_.CreateCompilationEnv();
     WasmFeatures detected;
     std::unique_ptr<DebugSideTable> debug_side_table_via_compilation;
-    ExecuteLiftoffCompilation(
-        CcTest::i_isolate()->allocator(), &env, test_func.body, 0, nullptr,
-        &detected, VectorOf(breakpoints), &debug_side_table_via_compilation);
+    ExecuteLiftoffCompilation(CcTest::i_isolate()->allocator(), &env,
+                              test_func.body, 0, kForDebugging, nullptr,
+                              &detected, VectorOf(breakpoints),
+                              &debug_side_table_via_compilation);
 
     // If there are no breakpoint, then {ExecuteLiftoffCompilation} should
     // provide the same debug side table.
@@ -306,6 +307,8 @@ TEST(Liftoff_debug_side_table_simple) {
       {WASM_I32_ADD(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))});
   CheckDebugSideTable(
       {
+          // function entry, locals in registers.
+          {Register(kWasmI32), Register(kWasmI32)},
           // OOL stack check, locals spilled, stack empty.
           {Stack(kWasmI32), Stack(kWasmI32)},
       },
@@ -320,6 +323,8 @@ TEST(Liftoff_debug_side_table_call) {
                     WASM_GET_LOCAL(0))});
   CheckDebugSideTable(
       {
+          // function entry, local in register.
+          {Register(kWasmI32)},
           // call, local spilled, stack empty.
           {Stack(kWasmI32)},
           // OOL stack check, local spilled, stack empty.
@@ -338,6 +343,8 @@ TEST(Liftoff_debug_side_table_call_const) {
                     WASM_GET_LOCAL(0))});
   CheckDebugSideTable(
       {
+          // function entry, local in register.
+          {Register(kWasmI32)},
           // call, local is kConst.
           {Constant(kWasmI32, kConst)},
           // OOL stack check, local spilled.
@@ -355,6 +362,8 @@ TEST(Liftoff_debug_side_table_indirect_call) {
                     WASM_GET_LOCAL(0))});
   CheckDebugSideTable(
       {
+          // function entry, local in register.
+          {Register(kWasmI32)},
           // indirect call, local spilled, stack empty.
           {Stack(kWasmI32)},
           // OOL stack check, local spilled, stack empty.
@@ -375,6 +384,8 @@ TEST(Liftoff_debug_side_table_loop) {
       {WASM_I32V_1(kConst), WASM_LOOP(WASM_BR_IF(0, WASM_GET_LOCAL(0)))});
   CheckDebugSideTable(
       {
+          // function entry, local in register.
+          {Register(kWasmI32)},
           // OOL stack check, local spilled, stack empty.
           {Stack(kWasmI32)},
           // OOL loop stack check, local spilled, stack has {kConst}.
@@ -390,6 +401,8 @@ TEST(Liftoff_debug_side_table_trap) {
       {WASM_I32_DIVS(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))});
   CheckDebugSideTable(
       {
+          // function entry, locals in registers.
+          {Register(kWasmI32), Register(kWasmI32)},
           // OOL stack check, local spilled, stack empty.
           {Stack(kWasmI32), Stack(kWasmI32)},
           // OOL trap (div by zero), locals spilled, stack empty.
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc b/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc
index 178f86bac94..16700cac8c9 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc
@@ -569,7 +569,7 @@ WASM_EXEC_TEST(I64AtomicNonConstIndexCompareExchangeNarrow) {
                WASM_I64_EQ(WASM_I64V(1), WASM_I64V(0)), WASM_GET_LOCAL(0),
                WASM_GET_LOCAL(1), MachineRepresentation::kWord16)));
 
-  uint64_t initial = 4444333322221111, local = 0x9999888877776666;
+  uint64_t initial = 0x4444333322221111, local = 0x9999888877776666;
   r.builder().WriteMemory(&memory[0], initial);
   CHECK_EQ(static_cast<uint16_t>(initial), r.Call(initial, local));
   CHECK_EQ(static_cast<uint16_t>(CompareExchange(initial, initial, local)),
@@ -782,6 +782,35 @@ WASM_EXEC_TEST(I64AtomicCompareExchangeUseOnlyHighWord) {
   CHECK_EQ(0x12345678, r.Call());
 }
 
+WASM_EXEC_TEST(I64AtomicExchangeUseOnlyLowWord) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint32_t> r(execution_tier);
+  uint64_t* memory =
+      r.builder().AddMemoryElems<uint64_t>(kWasmPageSize / sizeof(uint64_t));
+  memory[1] = 0x1234567890abcdeful;
+  r.builder().SetHasSharedMemory();
+  // Test that we can use just the low word of an I64AtomicLoad.
+  BUILD(r, WASM_I32_CONVERT_I64(WASM_ATOMICS_BINOP(
+               kExprI64AtomicExchange, WASM_I32V(8), WASM_I64V(1),
+               MachineRepresentation::kWord64)));
+  CHECK_EQ(0x90abcdef, r.Call());
+}
+
+WASM_EXEC_TEST(I64AtomicExchangeUseOnlyHighWord) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint32_t> r(execution_tier);
+  uint64_t* memory =
+      r.builder().AddMemoryElems<uint64_t>(kWasmPageSize / sizeof(uint64_t));
+  memory[1] = 0x1234567890abcdeful;
+  r.builder().SetHasSharedMemory();
+  // Test that we can use just the high word of an I64AtomicLoad.
+  BUILD(r, WASM_I32_CONVERT_I64(WASM_I64_ROR(
+               WASM_ATOMICS_BINOP(kExprI64AtomicExchange, WASM_I32V(8),
+                                  WASM_I64V(1), MachineRepresentation::kWord64),
+               WASM_I64V(32))));
+  CHECK_EQ(0x12345678, r.Call());
+}
+
 WASM_EXEC_TEST(I64AtomicCompareExchange32UZeroExtended) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint32_t> r(execution_tier);
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-bulk-memory.cc b/deps/v8/test/cctest/wasm/test-run-wasm-bulk-memory.cc
index ab826df7d7e..aefd10bb712 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-bulk-memory.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-bulk-memory.cc
@@ -367,21 +367,21 @@ void TestTableCopyInbounds(ExecutionTier execution_tier, int table_dst,
   }
 }
 
-WASM_EXEC_TEST(TableCopyInboundsFrom0To0) {
+WASM_COMPILED_EXEC_TEST(TableCopyInboundsFrom0To0) {
   TestTableCopyInbounds(execution_tier, 0, 0);
 }
 
-WASM_EXEC_TEST(TableCopyInboundsFrom3To0) {
+WASM_COMPILED_EXEC_TEST(TableCopyInboundsFrom3To0) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableCopyInbounds(execution_tier, 3, 0);
 }
 
-WASM_EXEC_TEST(TableCopyInboundsFrom5To9) {
+WASM_COMPILED_EXEC_TEST(TableCopyInboundsFrom5To9) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableCopyInbounds(execution_tier, 5, 9);
 }
 
-WASM_EXEC_TEST(TableCopyInboundsFrom6To6) {
+WASM_COMPILED_EXEC_TEST(TableCopyInboundsFrom6To6) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableCopyInbounds(execution_tier, 6, 6);
 }
@@ -476,12 +476,14 @@ void TestTableInitElems(ExecutionTier execution_tier, int table_index) {
   CheckTableCall(isolate, table, &r, call_index, 0, 1, 2, 3, 4);
 }
 
-WASM_EXEC_TEST(TableInitElems0) { TestTableInitElems(execution_tier, 0); }
-WASM_EXEC_TEST(TableInitElems7) {
+WASM_COMPILED_EXEC_TEST(TableInitElems0) {
+  TestTableInitElems(execution_tier, 0);
+}
+WASM_COMPILED_EXEC_TEST(TableInitElems7) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableInitElems(execution_tier, 7);
 }
-WASM_EXEC_TEST(TableInitElems9) {
+WASM_COMPILED_EXEC_TEST(TableInitElems9) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableInitElems(execution_tier, 9);
 }
@@ -555,12 +557,12 @@ void TestTableInitOob(ExecutionTier execution_tier, int table_index) {
   r.CheckCallViaJS(0xDEADBEEF, 0, 10, 1);
 }
 
-WASM_EXEC_TEST(TableInitOob0) { TestTableInitOob(execution_tier, 0); }
-WASM_EXEC_TEST(TableInitOob7) {
+WASM_COMPILED_EXEC_TEST(TableInitOob0) { TestTableInitOob(execution_tier, 0); }
+WASM_COMPILED_EXEC_TEST(TableInitOob7) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableInitOob(execution_tier, 7);
 }
-WASM_EXEC_TEST(TableInitOob9) {
+WASM_COMPILED_EXEC_TEST(TableInitOob9) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableInitOob(execution_tier, 9);
 }
@@ -628,21 +630,21 @@ void TestTableCopyElems(ExecutionTier execution_tier, int table_dst,
   }
 }
 
-WASM_EXEC_TEST(TableCopyElemsFrom0To0) {
+WASM_COMPILED_EXEC_TEST(TableCopyElemsFrom0To0) {
   TestTableCopyElems(execution_tier, 0, 0);
 }
 
-WASM_EXEC_TEST(TableCopyElemsFrom3To0) {
+WASM_COMPILED_EXEC_TEST(TableCopyElemsFrom3To0) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableCopyElems(execution_tier, 3, 0);
 }
 
-WASM_EXEC_TEST(TableCopyElemsFrom5To9) {
+WASM_COMPILED_EXEC_TEST(TableCopyElemsFrom5To9) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableCopyElems(execution_tier, 5, 9);
 }
 
-WASM_EXEC_TEST(TableCopyElemsFrom6To6) {
+WASM_COMPILED_EXEC_TEST(TableCopyElemsFrom6To6) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableCopyElems(execution_tier, 6, 6);
 }
@@ -703,21 +705,21 @@ void TestTableCopyCalls(ExecutionTier execution_tier, int table_dst,
   }
 }
 
-WASM_EXEC_TEST(TableCopyCallsFrom0To0) {
+WASM_COMPILED_EXEC_TEST(TableCopyCallsTo0From0) {
   TestTableCopyCalls(execution_tier, 0, 0);
 }
 
-WASM_EXEC_TEST(TableCopyCallsFrom3To0) {
+WASM_COMPILED_EXEC_TEST(TableCopyCallsTo3From0) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableCopyCalls(execution_tier, 3, 0);
 }
 
-WASM_EXEC_TEST(TableCopyCallsFrom5To9) {
+WASM_COMPILED_EXEC_TEST(TableCopyCallsTo5From9) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableCopyCalls(execution_tier, 5, 9);
 }
 
-WASM_EXEC_TEST(TableCopyCallsFrom6To6) {
+WASM_COMPILED_EXEC_TEST(TableCopyCallsTo6From6) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableCopyCalls(execution_tier, 6, 6);
 }
@@ -779,21 +781,21 @@ void TestTableCopyOobWrites(ExecutionTier execution_tier, int table_dst,
   CheckTable(isolate, table, f0, f1, f2, f3, f4);
 }
 
-WASM_EXEC_TEST(TableCopyOobWritesFrom0To0) {
+WASM_COMPILED_EXEC_TEST(TableCopyOobWritesFrom0To0) {
   TestTableCopyOobWrites(execution_tier, 0, 0);
 }
 
-WASM_EXEC_TEST(TableCopyOobWritesFrom3To0) {
+WASM_COMPILED_EXEC_TEST(TableCopyOobWritesFrom3To0) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableCopyOobWrites(execution_tier, 3, 0);
 }
 
-WASM_EXEC_TEST(TableCopyOobWritesFrom5To9) {
+WASM_COMPILED_EXEC_TEST(TableCopyOobWritesFrom5To9) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableCopyOobWrites(execution_tier, 5, 9);
 }
 
-WASM_EXEC_TEST(TableCopyOobWritesFrom6To6) {
+WASM_COMPILED_EXEC_TEST(TableCopyOobWritesFrom6To6) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableCopyOobWrites(execution_tier, 6, 6);
 }
@@ -838,26 +840,26 @@ void TestTableCopyOob1(ExecutionTier execution_tier, int table_dst,
   }
 }
 
-WASM_EXEC_TEST(TableCopyOob1From0To0) {
+WASM_COMPILED_EXEC_TEST(TableCopyOob1From0To0) {
   TestTableCopyOob1(execution_tier, 0, 0);
 }
 
-WASM_EXEC_TEST(TableCopyOob1From3To0) {
+WASM_COMPILED_EXEC_TEST(TableCopyOob1From3To0) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableCopyOob1(execution_tier, 3, 0);
 }
 
-WASM_EXEC_TEST(TableCopyOob1From5To9) {
+WASM_COMPILED_EXEC_TEST(TableCopyOob1From5To9) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableCopyOob1(execution_tier, 5, 9);
 }
 
-WASM_EXEC_TEST(TableCopyOob1From6To6) {
+WASM_COMPILED_EXEC_TEST(TableCopyOob1From6To6) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   TestTableCopyOob1(execution_tier, 6, 6);
 }
 
-WASM_EXEC_TEST(ElemDropTwice) {
+WASM_COMPILED_EXEC_TEST(ElemDropTwice) {
   EXPERIMENTAL_FLAG_SCOPE(bulk_memory);
   WasmRunner<uint32_t> r(execution_tier);
   r.builder().AddIndirectFunctionTable(nullptr, 1);
@@ -868,7 +870,7 @@ WASM_EXEC_TEST(ElemDropTwice) {
   r.CheckCallViaJS(0);
 }
 
-WASM_EXEC_TEST(ElemDropThenTableInit) {
+WASM_COMPILED_EXEC_TEST(ElemDropThenTableInit) {
   EXPERIMENTAL_FLAG_SCOPE(bulk_memory);
   WasmRunner<uint32_t, uint32_t> r(execution_tier);
   r.builder().AddIndirectFunctionTable(nullptr, 1);
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-exceptions.cc b/deps/v8/test/cctest/wasm/test-run-wasm-exceptions.cc
index cddc6f74688..0b238e468d3 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-exceptions.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-exceptions.cc
@@ -12,7 +12,7 @@ namespace internal {
 namespace wasm {
 namespace test_run_wasm_exceptions {
 
-WASM_EXEC_TEST(TryCatchThrow) {
+WASM_COMPILED_EXEC_TEST(TryCatchThrow) {
   TestSignatures sigs;
   EXPERIMENTAL_FLAG_SCOPE(eh);
   WasmRunner<uint32_t, uint32_t> r(execution_tier);
@@ -32,7 +32,7 @@ WASM_EXEC_TEST(TryCatchThrow) {
   r.CheckCallViaJS(kResult1, 1);
 }
 
-WASM_EXEC_TEST(TryCatchCallDirect) {
+WASM_COMPILED_EXEC_TEST(TryCatchCallDirect) {
   TestSignatures sigs;
   EXPERIMENTAL_FLAG_SCOPE(eh);
   WasmRunner<uint32_t, uint32_t> r(execution_tier);
@@ -60,7 +60,7 @@ WASM_EXEC_TEST(TryCatchCallDirect) {
   r.CheckCallViaJS(kResult1, 1);
 }
 
-WASM_EXEC_TEST(TryCatchCallIndirect) {
+WASM_COMPILED_EXEC_TEST(TryCatchCallIndirect) {
   TestSignatures sigs;
   EXPERIMENTAL_FLAG_SCOPE(eh);
   WasmRunner<uint32_t, uint32_t> r(execution_tier);
@@ -97,7 +97,7 @@ WASM_EXEC_TEST(TryCatchCallIndirect) {
   r.CheckCallViaJS(kResult1, 1);
 }
 
-WASM_EXEC_TEST(TryCatchCallExternal) {
+WASM_COMPILED_EXEC_TEST(TryCatchCallExternal) {
   TestSignatures sigs;
   EXPERIMENTAL_FLAG_SCOPE(eh);
   HandleScope scope(CcTest::InitIsolateOnce());
@@ -127,7 +127,7 @@ WASM_EXEC_TEST(TryCatchCallExternal) {
   r.CheckCallViaJS(kResult1, 1);
 }
 
-WASM_EXEC_TEST(TryCatchTrapTypeError) {
+WASM_COMPILED_EXEC_TEST(TryCatchTrapTypeError) {
   TestSignatures sigs;
   EXPERIMENTAL_FLAG_SCOPE(eh);
   HandleScope scope(CcTest::InitIsolateOnce());
@@ -189,22 +189,22 @@ void TestTrapNotCaught(byte* code, size_t code_size,
 
 }  // namespace
 
-WASM_EXEC_TEST(TryCatchTrapUnreachable) {
+WASM_COMPILED_EXEC_TEST(TryCatchTrapUnreachable) {
   byte code[] = {WASM_UNREACHABLE};
   TestTrapNotCaught(code, arraysize(code), execution_tier);
 }
 
-WASM_EXEC_TEST(TryCatchTrapMemOutOfBounds) {
+WASM_COMPILED_EXEC_TEST(TryCatchTrapMemOutOfBounds) {
   byte code[] = {WASM_LOAD_MEM(MachineType::Int32(), WASM_I32V_1(-1))};
   TestTrapNotCaught(code, arraysize(code), execution_tier);
 }
 
-WASM_EXEC_TEST(TryCatchTrapDivByZero) {
+WASM_COMPILED_EXEC_TEST(TryCatchTrapDivByZero) {
   byte code[] = {WASM_I32_DIVS(WASM_GET_LOCAL(0), WASM_I32V_1(0))};
   TestTrapNotCaught(code, arraysize(code), execution_tier);
 }
 
-WASM_EXEC_TEST(TryCatchTrapRemByZero) {
+WASM_COMPILED_EXEC_TEST(TryCatchTrapRemByZero) {
   byte code[] = {WASM_I32_REMS(WASM_GET_LOCAL(0), WASM_I32V_1(0))};
   TestTrapNotCaught(code, arraysize(code), execution_tier);
 }
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-interpreter.cc b/deps/v8/test/cctest/wasm/test-run-wasm-interpreter.cc
index 0c5474142c3..f0f85b186c6 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-interpreter.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-interpreter.cc
@@ -273,49 +273,6 @@ std::unique_ptr<int[]> Find(byte* code, size_t code_size, int n, ...) {
   return offsets;
 }
 
-TEST(Breakpoint_I32Add) {
-  static const int kLocalsDeclSize = 1;
-  static const int kNumBreakpoints = 3;
-  byte code[] = {WASM_I32_ADD(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))};
-  std::unique_ptr<int[]> offsets =
-      Find(code, sizeof(code), kNumBreakpoints, kExprLocalGet, kExprLocalGet,
-           kExprI32Add);
-
-  WasmRunner<int32_t, uint32_t, uint32_t> r(ExecutionTier::kInterpreter);
-
-  r.Build(code, code + arraysize(code));
-
-  WasmInterpreter* interpreter = r.interpreter();
-  WasmInterpreter::Thread* thread = interpreter->GetThread(0);
-  for (int i = 0; i < kNumBreakpoints; i++) {
-    interpreter->SetBreakpoint(r.function(), kLocalsDeclSize + offsets[i],
-                               true);
-  }
-
-  FOR_UINT32_INPUTS(a) {
-    for (uint32_t b = 11; b < 3000000000u; b += 1000000000u) {
-      thread->Reset();
-      WasmValue args[] = {WasmValue(a), WasmValue(b)};
-      thread->InitFrame(r.function(), args);
-
-      for (int i = 0; i < kNumBreakpoints; i++) {
-        thread->Run();  // run to next breakpoint
-        // Check the thread stopped at the right pc.
-        CHECK_EQ(WasmInterpreter::PAUSED, thread->state());
-        CHECK_EQ(static_cast<size_t>(kLocalsDeclSize + offsets[i]),
-                 thread->GetBreakpointPc());
-      }
-
-      thread->Run();  // run to completion
-
-      // Check the thread finished with the right value.
-      CHECK_EQ(WasmInterpreter::FINISHED, thread->state());
-      uint32_t expected = (a) + (b);
-      CHECK_EQ(expected, thread->GetReturnValue().to<uint32_t>());
-    }
-  }
-}
-
 TEST(Step_I32Mul) {
   static const int kTraceLength = 4;
   byte code[] = {WASM_I32_MUL(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))};
@@ -351,49 +308,6 @@ TEST(Step_I32Mul) {
   }
 }
 
-TEST(Breakpoint_I32And_disable) {
-  static const int kLocalsDeclSize = 1;
-  static const int kNumBreakpoints = 1;
-  byte code[] = {WASM_I32_AND(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))};
-  std::unique_ptr<int[]> offsets =
-      Find(code, sizeof(code), kNumBreakpoints, kExprI32And);
-
-  WasmRunner<int32_t, uint32_t, uint32_t> r(ExecutionTier::kInterpreter);
-
-  r.Build(code, code + arraysize(code));
-
-  WasmInterpreter* interpreter = r.interpreter();
-  WasmInterpreter::Thread* thread = interpreter->GetThread(0);
-
-  FOR_UINT32_INPUTS(a) {
-    for (uint32_t b = 11; b < 3000000000u; b += 1000000000u) {
-      // Run with and without breakpoints.
-      for (int do_break = 0; do_break < 2; do_break++) {
-        interpreter->SetBreakpoint(r.function(), kLocalsDeclSize + offsets[0],
-                                   do_break);
-        thread->Reset();
-        WasmValue args[] = {WasmValue(a), WasmValue(b)};
-        thread->InitFrame(r.function(), args);
-
-        if (do_break) {
-          thread->Run();  // run to next breakpoint
-          // Check the thread stopped at the right pc.
-          CHECK_EQ(WasmInterpreter::PAUSED, thread->state());
-          CHECK_EQ(static_cast<size_t>(kLocalsDeclSize + offsets[0]),
-                   thread->GetBreakpointPc());
-        }
-
-        thread->Run();  // run to completion
-
-        // Check the thread finished with the right value.
-        CHECK_EQ(WasmInterpreter::FINISHED, thread->state());
-        uint32_t expected = (a) & (b);
-        CHECK_EQ(expected, thread->GetReturnValue().to<uint32_t>());
-      }
-    }
-  }
-}
-
 TEST(MemoryGrow) {
   {
     WasmRunner<int32_t, uint32_t> r(ExecutionTier::kInterpreter);
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-js.cc b/deps/v8/test/cctest/wasm/test-run-wasm-js.cc
index 0db42c69b4c..e7fec1a4646 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-js.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-js.cc
@@ -71,7 +71,7 @@ ManuallyImportedJSFunction CreateJSSelector(FunctionSig* sig, int which) {
 }
 }  // namespace
 
-WASM_EXEC_TEST(Run_Int32Sub_jswrapped) {
+WASM_COMPILED_EXEC_TEST(Run_Int32Sub_jswrapped) {
   WasmRunner<int, int, int> r(execution_tier);
   BUILD(r, WASM_I32_SUB(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
 
@@ -79,7 +79,7 @@ WASM_EXEC_TEST(Run_Int32Sub_jswrapped) {
   r.CheckCallViaJS(-8723487, -8000000, 723487);
 }
 
-WASM_EXEC_TEST(Run_Float32Div_jswrapped) {
+WASM_COMPILED_EXEC_TEST(Run_Float32Div_jswrapped) {
   WasmRunner<float, float, float> r(execution_tier);
   BUILD(r, WASM_F32_DIV(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
 
@@ -87,7 +87,7 @@ WASM_EXEC_TEST(Run_Float32Div_jswrapped) {
   r.CheckCallViaJS(64, -16, -0.25);
 }
 
-WASM_EXEC_TEST(Run_Float64Add_jswrapped) {
+WASM_COMPILED_EXEC_TEST(Run_Float64Add_jswrapped) {
   WasmRunner<double, double, double> r(execution_tier);
   BUILD(r, WASM_F64_ADD(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
 
@@ -95,7 +95,7 @@ WASM_EXEC_TEST(Run_Float64Add_jswrapped) {
   r.CheckCallViaJS(-5.5, -5.25, -0.25);
 }
 
-WASM_EXEC_TEST(Run_I32Popcount_jswrapped) {
+WASM_COMPILED_EXEC_TEST(Run_I32Popcount_jswrapped) {
   WasmRunner<int, int> r(execution_tier);
   BUILD(r, WASM_I32_POPCNT(WASM_GET_LOCAL(0)));
 
@@ -104,7 +104,7 @@ WASM_EXEC_TEST(Run_I32Popcount_jswrapped) {
   r.CheckCallViaJS(6, 0x3F);
 }
 
-WASM_EXEC_TEST(Run_CallJS_Add_jswrapped) {
+WASM_COMPILED_EXEC_TEST(Run_CallJS_Add_jswrapped) {
   TestSignatures sigs;
   HandleScope scope(CcTest::InitIsolateOnce());
   const char* source = "(function(a) { return a + 99; })";
@@ -121,7 +121,7 @@ WASM_EXEC_TEST(Run_CallJS_Add_jswrapped) {
   r.CheckCallViaJS(-666666801, -666666900);
 }
 
-WASM_EXEC_TEST(Run_IndirectCallJSFunction) {
+WASM_COMPILED_EXEC_TEST(Run_IndirectCallJSFunction) {
   Isolate* isolate = CcTest::InitIsolateOnce();
   HandleScope scope(isolate);
   TestSignatures sigs;
@@ -192,42 +192,42 @@ void RunJSSelectTest(ExecutionTier tier, int which) {
   }
 }
 
-WASM_EXEC_TEST(Run_JSSelect_0) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelect_0) {
   CcTest::InitializeVM();
   RunJSSelectTest(execution_tier, 0);
 }
 
-WASM_EXEC_TEST(Run_JSSelect_1) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelect_1) {
   CcTest::InitializeVM();
   RunJSSelectTest(execution_tier, 1);
 }
 
-WASM_EXEC_TEST(Run_JSSelect_2) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelect_2) {
   CcTest::InitializeVM();
   RunJSSelectTest(execution_tier, 2);
 }
 
-WASM_EXEC_TEST(Run_JSSelect_3) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelect_3) {
   CcTest::InitializeVM();
   RunJSSelectTest(execution_tier, 3);
 }
 
-WASM_EXEC_TEST(Run_JSSelect_4) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelect_4) {
   CcTest::InitializeVM();
   RunJSSelectTest(execution_tier, 4);
 }
 
-WASM_EXEC_TEST(Run_JSSelect_5) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelect_5) {
   CcTest::InitializeVM();
   RunJSSelectTest(execution_tier, 5);
 }
 
-WASM_EXEC_TEST(Run_JSSelect_6) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelect_6) {
   CcTest::InitializeVM();
   RunJSSelectTest(execution_tier, 6);
 }
 
-WASM_EXEC_TEST(Run_JSSelect_7) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelect_7) {
   CcTest::InitializeVM();
   RunJSSelectTest(execution_tier, 7);
 }
@@ -262,42 +262,42 @@ void RunWASMSelectTest(ExecutionTier tier, int which) {
   }
 }
 
-WASM_EXEC_TEST(Run_WASMSelect_0) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelect_0) {
   CcTest::InitializeVM();
   RunWASMSelectTest(execution_tier, 0);
 }
 
-WASM_EXEC_TEST(Run_WASMSelect_1) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelect_1) {
   CcTest::InitializeVM();
   RunWASMSelectTest(execution_tier, 1);
 }
 
-WASM_EXEC_TEST(Run_WASMSelect_2) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelect_2) {
   CcTest::InitializeVM();
   RunWASMSelectTest(execution_tier, 2);
 }
 
-WASM_EXEC_TEST(Run_WASMSelect_3) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelect_3) {
   CcTest::InitializeVM();
   RunWASMSelectTest(execution_tier, 3);
 }
 
-WASM_EXEC_TEST(Run_WASMSelect_4) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelect_4) {
   CcTest::InitializeVM();
   RunWASMSelectTest(execution_tier, 4);
 }
 
-WASM_EXEC_TEST(Run_WASMSelect_5) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelect_5) {
   CcTest::InitializeVM();
   RunWASMSelectTest(execution_tier, 5);
 }
 
-WASM_EXEC_TEST(Run_WASMSelect_6) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelect_6) {
   CcTest::InitializeVM();
   RunWASMSelectTest(execution_tier, 6);
 }
 
-WASM_EXEC_TEST(Run_WASMSelect_7) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelect_7) {
   CcTest::InitializeVM();
   RunWASMSelectTest(execution_tier, 7);
 }
@@ -334,44 +334,44 @@ void RunWASMSelectAlignTest(ExecutionTier tier, int num_args, int num_params) {
   }
 }
 
-WASM_EXEC_TEST(Run_WASMSelectAlign_0) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelectAlign_0) {
   CcTest::InitializeVM();
   RunWASMSelectAlignTest(execution_tier, 0, 1);
   RunWASMSelectAlignTest(execution_tier, 0, 2);
 }
 
-WASM_EXEC_TEST(Run_WASMSelectAlign_1) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelectAlign_1) {
   CcTest::InitializeVM();
   RunWASMSelectAlignTest(execution_tier, 1, 2);
   RunWASMSelectAlignTest(execution_tier, 1, 3);
 }
 
-WASM_EXEC_TEST(Run_WASMSelectAlign_2) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelectAlign_2) {
   CcTest::InitializeVM();
   RunWASMSelectAlignTest(execution_tier, 2, 3);
   RunWASMSelectAlignTest(execution_tier, 2, 4);
 }
 
-WASM_EXEC_TEST(Run_WASMSelectAlign_3) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelectAlign_3) {
   CcTest::InitializeVM();
   RunWASMSelectAlignTest(execution_tier, 3, 3);
   RunWASMSelectAlignTest(execution_tier, 3, 4);
 }
 
-WASM_EXEC_TEST(Run_WASMSelectAlign_4) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelectAlign_4) {
   CcTest::InitializeVM();
   RunWASMSelectAlignTest(execution_tier, 4, 3);
   RunWASMSelectAlignTest(execution_tier, 4, 4);
 }
 
-WASM_EXEC_TEST(Run_WASMSelectAlign_7) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelectAlign_7) {
   CcTest::InitializeVM();
   RunWASMSelectAlignTest(execution_tier, 7, 5);
   RunWASMSelectAlignTest(execution_tier, 7, 6);
   RunWASMSelectAlignTest(execution_tier, 7, 7);
 }
 
-WASM_EXEC_TEST(Run_WASMSelectAlign_8) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelectAlign_8) {
   CcTest::InitializeVM();
   RunWASMSelectAlignTest(execution_tier, 8, 5);
   RunWASMSelectAlignTest(execution_tier, 8, 6);
@@ -379,7 +379,7 @@ WASM_EXEC_TEST(Run_WASMSelectAlign_8) {
   RunWASMSelectAlignTest(execution_tier, 8, 8);
 }
 
-WASM_EXEC_TEST(Run_WASMSelectAlign_9) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelectAlign_9) {
   CcTest::InitializeVM();
   RunWASMSelectAlignTest(execution_tier, 9, 6);
   RunWASMSelectAlignTest(execution_tier, 9, 7);
@@ -387,7 +387,7 @@ WASM_EXEC_TEST(Run_WASMSelectAlign_9) {
   RunWASMSelectAlignTest(execution_tier, 9, 9);
 }
 
-WASM_EXEC_TEST(Run_WASMSelectAlign_10) {
+WASM_COMPILED_EXEC_TEST(Run_WASMSelectAlign_10) {
   CcTest::InitializeVM();
   RunWASMSelectAlignTest(execution_tier, 10, 7);
   RunWASMSelectAlignTest(execution_tier, 10, 8);
@@ -449,37 +449,37 @@ void RunJSSelectAlignTest(ExecutionTier tier, int num_args, int num_params) {
   }
 }
 
-WASM_EXEC_TEST(Run_JSSelectAlign_0) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelectAlign_0) {
   CcTest::InitializeVM();
   RunJSSelectAlignTest(execution_tier, 0, 1);
   RunJSSelectAlignTest(execution_tier, 0, 2);
 }
 
-WASM_EXEC_TEST(Run_JSSelectAlign_1) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelectAlign_1) {
   CcTest::InitializeVM();
   RunJSSelectAlignTest(execution_tier, 1, 2);
   RunJSSelectAlignTest(execution_tier, 1, 3);
 }
 
-WASM_EXEC_TEST(Run_JSSelectAlign_2) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelectAlign_2) {
   CcTest::InitializeVM();
   RunJSSelectAlignTest(execution_tier, 2, 3);
   RunJSSelectAlignTest(execution_tier, 2, 4);
 }
 
-WASM_EXEC_TEST(Run_JSSelectAlign_3) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelectAlign_3) {
   CcTest::InitializeVM();
   RunJSSelectAlignTest(execution_tier, 3, 3);
   RunJSSelectAlignTest(execution_tier, 3, 4);
 }
 
-WASM_EXEC_TEST(Run_JSSelectAlign_4) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelectAlign_4) {
   CcTest::InitializeVM();
   RunJSSelectAlignTest(execution_tier, 4, 3);
   RunJSSelectAlignTest(execution_tier, 4, 4);
 }
 
-WASM_EXEC_TEST(Run_JSSelectAlign_7) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelectAlign_7) {
   CcTest::InitializeVM();
   RunJSSelectAlignTest(execution_tier, 7, 3);
   RunJSSelectAlignTest(execution_tier, 7, 4);
@@ -487,7 +487,7 @@ WASM_EXEC_TEST(Run_JSSelectAlign_7) {
   RunJSSelectAlignTest(execution_tier, 7, 4);
 }
 
-WASM_EXEC_TEST(Run_JSSelectAlign_8) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelectAlign_8) {
   CcTest::InitializeVM();
   RunJSSelectAlignTest(execution_tier, 8, 5);
   RunJSSelectAlignTest(execution_tier, 8, 6);
@@ -495,7 +495,7 @@ WASM_EXEC_TEST(Run_JSSelectAlign_8) {
   RunJSSelectAlignTest(execution_tier, 8, 8);
 }
 
-WASM_EXEC_TEST(Run_JSSelectAlign_9) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelectAlign_9) {
   CcTest::InitializeVM();
   RunJSSelectAlignTest(execution_tier, 9, 6);
   RunJSSelectAlignTest(execution_tier, 9, 7);
@@ -503,7 +503,7 @@ WASM_EXEC_TEST(Run_JSSelectAlign_9) {
   RunJSSelectAlignTest(execution_tier, 9, 9);
 }
 
-WASM_EXEC_TEST(Run_JSSelectAlign_10) {
+WASM_COMPILED_EXEC_TEST(Run_JSSelectAlign_10) {
   CcTest::InitializeVM();
   RunJSSelectAlignTest(execution_tier, 10, 7);
   RunJSSelectAlignTest(execution_tier, 10, 8);
@@ -560,11 +560,11 @@ void RunPickerTest(ExecutionTier tier, bool indirect) {
   r.CheckCallApplyViaJS(right, rc_fn.function_index(), args_right, 1);
 }
 
-WASM_EXEC_TEST(Run_ReturnCallImportedFunction) {
+WASM_COMPILED_EXEC_TEST(Run_ReturnCallImportedFunction) {
   RunPickerTest(execution_tier, false);
 }
 
-WASM_EXEC_TEST(Run_ReturnCallIndirectImportedFunction) {
+WASM_COMPILED_EXEC_TEST(Run_ReturnCallIndirectImportedFunction) {
   RunPickerTest(execution_tier, true);
 }
 
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-module.cc b/deps/v8/test/cctest/wasm/test-run-wasm-module.cc
index ea080a7a122..f655d996265 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-module.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-module.cc
@@ -942,6 +942,126 @@ TEST(MemoryWithOOBEmptyDataSegment) {
   Cleanup();
 }
 
+TEST(GcStructIdsPass) {
+  {
+    EXPERIMENTAL_FLAG_SCOPE(gc);
+    EXPERIMENTAL_FLAG_SCOPE(anyref);
+    Isolate* isolate = CcTest::InitIsolateOnce();
+    HandleScope scope(isolate);
+    testing::SetupIsolateForWasmModule(isolate);
+
+    ErrorThrower thrower(isolate, "GcStructIdsPass");
+
+    const byte data[] = {
+        WASM_MODULE_HEADER,   // --
+        kTypeSectionCode,     // --
+        U32V_1(23),           // Section size
+        U32V_1(3),            // type count
+        kWasmStructTypeCode,  // index 0 = struct(i32, type(0), type(1))
+        U32V_1(3),            // field count
+        kLocalI32,            // field 0
+        U32V_1(1),            // mutability
+        kLocalRef,            // field 1
+        U32V_1(0),            // --
+        U32V_1(1),            // mutability
+        kLocalRef,            // field 2
+        U32V_1(1),            // --
+        U32V_1(1),            // mutability
+        kWasmStructTypeCode,  // index 1 = struct(type(0), type(2))
+        U32V_1(2),            // field count
+        kLocalRef,            // field 0
+        U32V_1(0),            // --
+        U32V_1(1),            // mutability
+        kLocalRef,            // field 1
+        U32V_1(2),            // --
+        U32V_1(1),            // mutability
+        kWasmArrayTypeCode,   // index 2 = array(type(0))
+        kLocalRef,            // element type
+        U32V_1(0),            // --
+        U32V_1(1)             // mutability
+    };
+
+    CompileAndInstantiateForTesting(
+        isolate, &thrower, ModuleWireBytes(data, data + arraysize(data)));
+    // This module is valid.
+    if (thrower.error()) {
+      FATAL("%s", thrower.error_msg());
+    }
+  }
+  Cleanup();
+}
+
+TEST(GcStructIdsUndefinedIndex) {
+  {
+    EXPERIMENTAL_FLAG_SCOPE(gc);
+    EXPERIMENTAL_FLAG_SCOPE(anyref);
+    Isolate* isolate = CcTest::InitIsolateOnce();
+    HandleScope scope(isolate);
+    testing::SetupIsolateForWasmModule(isolate);
+
+    ErrorThrower thrower(isolate, "GcStructIdsUndefinedIndex");
+
+    const byte data[] = {
+        WASM_MODULE_HEADER,   // --
+        kTypeSectionCode,     // --
+        U32V_1(6),            // Section size
+        U32V_1(1),            // type count
+        kWasmStructTypeCode,  // index 0 = struct(type(1))
+        U32V_1(1),            // field count
+        kLocalRef,            // field 0
+        U32V_1(1),            // --
+        U32V_1(1)             // mutability
+    };
+
+    CompileAndInstantiateForTesting(
+        isolate, &thrower, ModuleWireBytes(data, data + arraysize(data)));
+    // There should be an error reflecting an undeclared index.
+    CHECK(thrower.error());
+    CHECK_NE(std::string(thrower.error_msg())
+                 .find("reference to undeclared struct/array"),
+             std::string::npos);
+  }
+  Cleanup();
+}
+
+TEST(GcStructIdsIllegalIndex) {
+  {
+    EXPERIMENTAL_FLAG_SCOPE(gc);
+    EXPERIMENTAL_FLAG_SCOPE(anyref);
+    Isolate* isolate = CcTest::InitIsolateOnce();
+    HandleScope scope(isolate);
+    testing::SetupIsolateForWasmModule(isolate);
+
+    ErrorThrower thrower(isolate, "GcStructIdsIllegalIndex");
+
+    const byte data[] = {
+        WASM_MODULE_HEADER,     // --
+        kTypeSectionCode,       // --
+        U32V_1(11),             // Section size
+        U32V_1(2),              // type count
+        kWasmStructTypeCode,    // index 0 = struct(type(1))
+        U32V_1(1),              // field count
+        kLocalRef,              // field 0
+        U32V_1(1),              // --
+        U32V_1(1),              // mutability
+        kWasmFunctionTypeCode,  // index 1 = int32 -> int32
+        U32V_1(1),              // param count
+        kLocalI32,              // param 0
+        U32V_1(1),              // returns count
+        kLocalI32               // return 0
+    };
+    CompileAndInstantiateForTesting(
+        isolate, &thrower, ModuleWireBytes(data, data + arraysize(data)));
+    // There should be an error reflecting an invalid index.
+    CHECK(thrower.error());
+    CHECK_NE(std::string(thrower.error_msg())
+                 .find("array element type or struct "
+                       "field references non-type index"),
+             std::string::npos);
+  }
+  Cleanup();
+}
+
 #undef EMIT_CODE_WITH_END
 
 }  // namespace test_run_wasm_module
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-simd-scalar-lowering.cc b/deps/v8/test/cctest/wasm/test-run-wasm-simd-scalar-lowering.cc
new file mode 100644
index 00000000000..517f8438a4e
--- /dev/null
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-simd-scalar-lowering.cc
@@ -0,0 +1,47 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/wasm/compilation-environment.h"
+#include "src/wasm/wasm-tier.h"
+#include "test/cctest/cctest.h"
+#include "test/cctest/wasm/wasm-run-utils.h"
+#include "test/common/wasm/flag-utils.h"
+#include "test/common/wasm/wasm-macro-gen.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+namespace test_run_wasm_simd {
+
+#define WASM_SIMD_TEST(name)                                     \
+  void RunWasm_##name##_Impl(LowerSimd lower_simd,               \
+                             ExecutionTier execution_tier);      \
+  TEST(RunWasm_##name##_simd_lowered) {                          \
+    EXPERIMENTAL_FLAG_SCOPE(simd);                               \
+    RunWasm_##name##_Impl(kLowerSimd, ExecutionTier::kTurbofan); \
+  }                                                              \
+  void RunWasm_##name##_Impl(LowerSimd lower_simd, ExecutionTier execution_tier)
+
+WASM_SIMD_TEST(I8x16ToF32x4) {
+  WasmRunner<int32_t, int32_t> r(execution_tier, lower_simd);
+  float* g = r.builder().AddGlobal<float>(kWasmS128);
+  byte param1 = 0;
+  BUILD(r,
+        WASM_SET_GLOBAL(
+            0, WASM_SIMD_UNOP(kExprF32x4Sqrt,
+                              WASM_SIMD_I8x16_SPLAT(WASM_GET_LOCAL(param1)))),
+        WASM_ONE);
+
+  // Arbitrary pattern that doesn't end up creating a NaN.
+  r.Call(0x5b);
+  float f = bit_cast<float>(0x5b5b5b5b);
+  float actual = ReadLittleEndianValue<float>(&g[0]);
+  float expected = std::sqrt(f);
+  CHECK_EQ(expected, actual);
+}
+
+}  // namespace test_run_wasm_simd
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc b/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
index 23ab076e4a7..00273692e95 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <limits>
 #include <type_traits>
 
 #include "src/base/bits.h"
@@ -99,12 +100,18 @@ T Div(T a, T b) {
 
 template <typename T>
 T Minimum(T a, T b) {
-  return a <= b ? a : b;
+  // Follow one of the possible implementation given in
+  // https://en.cppreference.com/w/cpp/algorithm/min so that it works the same
+  // way for floats (when given NaNs/Infs).
+  return (b < a) ? b : a;
 }
 
 template <typename T>
 T Maximum(T a, T b) {
-  return a >= b ? a : b;
+  // Follow one of the possible implementation given in
+  // https://en.cppreference.com/w/cpp/algorithm/max so that it works the same
+  // way for floats (when given NaNs/Infs).
+  return (a < b) ? b : a;
 }
 
 template <typename T>
@@ -408,85 +415,6 @@ bool ExpectFused(ExecutionTier tier) {
                                     lane_index, WASM_GET_LOCAL(value))),       \
           WASM_RETURN1(WASM_ZERO))
 
-#define TO_BYTE(val) static_cast<byte>(val)
-// TODO(v8:10258): We have support for emitting multi-byte opcodes now, so this
-// can change to simply, op, once the decoder is fixed to decode multi byte
-// opcodes.
-#define WASM_SIMD_OP(op) kSimdPrefix, TO_BYTE(op)
-#define WASM_SIMD_SPLAT(Type, ...) __VA_ARGS__, WASM_SIMD_OP(kExpr##Type##Splat)
-#define WASM_SIMD_UNOP(op, x) x, WASM_SIMD_OP(op)
-#define WASM_SIMD_BINOP(op, x, y) x, y, WASM_SIMD_OP(op)
-#define WASM_SIMD_SHIFT_OP(op, x, y) x, y, WASM_SIMD_OP(op)
-#define WASM_SIMD_CONCAT_OP(op, bytes, x, y) \
-  x, y, WASM_SIMD_OP(op), TO_BYTE(bytes)
-#define WASM_SIMD_SELECT(format, x, y, z) x, y, z, WASM_SIMD_OP(kExprS128Select)
-
-#define WASM_SIMD_F64x2_SPLAT(x) WASM_SIMD_SPLAT(F64x2, x)
-#define WASM_SIMD_F64x2_EXTRACT_LANE(lane, x) \
-  x, WASM_SIMD_OP(kExprF64x2ExtractLane), TO_BYTE(lane)
-#define WASM_SIMD_F64x2_REPLACE_LANE(lane, x, y) \
-  x, y, WASM_SIMD_OP(kExprF64x2ReplaceLane), TO_BYTE(lane)
-
-#define WASM_SIMD_F32x4_SPLAT(x) WASM_SIMD_SPLAT(F32x4, x)
-#define WASM_SIMD_F32x4_EXTRACT_LANE(lane, x) \
-  x, WASM_SIMD_OP(kExprF32x4ExtractLane), TO_BYTE(lane)
-#define WASM_SIMD_F32x4_REPLACE_LANE(lane, x, y) \
-  x, y, WASM_SIMD_OP(kExprF32x4ReplaceLane), TO_BYTE(lane)
-
-#define WASM_SIMD_I64x2_SPLAT(x) WASM_SIMD_SPLAT(I64x2, x)
-#define WASM_SIMD_I64x2_EXTRACT_LANE(lane, x) \
-  x, WASM_SIMD_OP(kExprI64x2ExtractLane), TO_BYTE(lane)
-#define WASM_SIMD_I64x2_REPLACE_LANE(lane, x, y) \
-  x, y, WASM_SIMD_OP(kExprI64x2ReplaceLane), TO_BYTE(lane)
-
-#define WASM_SIMD_I32x4_SPLAT(x) WASM_SIMD_SPLAT(I32x4, x)
-#define WASM_SIMD_I32x4_EXTRACT_LANE(lane, x) \
-  x, WASM_SIMD_OP(kExprI32x4ExtractLane), TO_BYTE(lane)
-#define WASM_SIMD_I32x4_REPLACE_LANE(lane, x, y) \
-  x, y, WASM_SIMD_OP(kExprI32x4ReplaceLane), TO_BYTE(lane)
-
-#define WASM_SIMD_I16x8_SPLAT(x) WASM_SIMD_SPLAT(I16x8, x)
-#define WASM_SIMD_I16x8_EXTRACT_LANE(lane, x) \
-  x, WASM_SIMD_OP(kExprI16x8ExtractLaneS), TO_BYTE(lane)
-#define WASM_SIMD_I16x8_EXTRACT_LANE_U(lane, x) \
-  x, WASM_SIMD_OP(kExprI16x8ExtractLaneU), TO_BYTE(lane)
-#define WASM_SIMD_I16x8_REPLACE_LANE(lane, x, y) \
-  x, y, WASM_SIMD_OP(kExprI16x8ReplaceLane), TO_BYTE(lane)
-
-#define WASM_SIMD_I8x16_SPLAT(x) WASM_SIMD_SPLAT(I8x16, x)
-#define WASM_SIMD_I8x16_EXTRACT_LANE(lane, x) \
-  x, WASM_SIMD_OP(kExprI8x16ExtractLaneS), TO_BYTE(lane)
-#define WASM_SIMD_I8x16_EXTRACT_LANE_U(lane, x) \
-  x, WASM_SIMD_OP(kExprI8x16ExtractLaneU), TO_BYTE(lane)
-#define WASM_SIMD_I8x16_REPLACE_LANE(lane, x, y) \
-  x, y, WASM_SIMD_OP(kExprI8x16ReplaceLane), TO_BYTE(lane)
-
-#define WASM_SIMD_S8x16_SHUFFLE_OP(opcode, m, x, y)                        \
-  x, y, WASM_SIMD_OP(opcode), TO_BYTE(m[0]), TO_BYTE(m[1]), TO_BYTE(m[2]), \
-      TO_BYTE(m[3]), TO_BYTE(m[4]), TO_BYTE(m[5]), TO_BYTE(m[6]),          \
-      TO_BYTE(m[7]), TO_BYTE(m[8]), TO_BYTE(m[9]), TO_BYTE(m[10]),         \
-      TO_BYTE(m[11]), TO_BYTE(m[12]), TO_BYTE(m[13]), TO_BYTE(m[14]),      \
-      TO_BYTE(m[15])
-
-#define WASM_SIMD_LOAD_MEM(index) \
-  index, WASM_SIMD_OP(kExprS128LoadMem), ZERO_ALIGNMENT, ZERO_OFFSET
-#define WASM_SIMD_LOAD_MEM_OFFSET(offset, index) \
-  index, WASM_SIMD_OP(kExprS128LoadMem), ZERO_ALIGNMENT, offset
-#define WASM_SIMD_STORE_MEM(index, val) \
-  index, val, WASM_SIMD_OP(kExprS128StoreMem), ZERO_ALIGNMENT, ZERO_OFFSET
-#define WASM_SIMD_STORE_MEM_OFFSET(offset, index, val) \
-  index, val, WASM_SIMD_OP(kExprS128StoreMem), ZERO_ALIGNMENT, offset
-
-#define WASM_SIMD_F64x2_QFMA(a, b, c) a, b, c, WASM_SIMD_OP(kExprF64x2Qfma)
-#define WASM_SIMD_F64x2_QFMS(a, b, c) a, b, c, WASM_SIMD_OP(kExprF64x2Qfms)
-#define WASM_SIMD_F32x4_QFMA(a, b, c) a, b, c, WASM_SIMD_OP(kExprF32x4Qfma)
-#define WASM_SIMD_F32x4_QFMS(a, b, c) a, b, c, WASM_SIMD_OP(kExprF32x4Qfms)
-
-#define WASM_SIMD_LOAD_SPLAT(opcode, index) \
-  index, WASM_SIMD_OP(opcode), ZERO_ALIGNMENT, ZERO_OFFSET
-#define WASM_SIMD_LOAD_EXTEND(opcode, index) \
-  index, WASM_SIMD_OP(opcode), ZERO_ALIGNMENT, ZERO_OFFSET
-
 // Runs tests of compiled code, using the interpreter as a reference.
 #define WASM_SIMD_COMPILED_TEST(name)                              \
   void RunWasm_##name##_Impl(LowerSimd lower_simd,                 \
@@ -548,7 +476,7 @@ WASM_SIMD_TEST(S128Globals) {
   // Set up a global to hold input and output vectors.
   int32_t* g0 = r.builder().AddGlobal<int32_t>(kWasmS128);
   int32_t* g1 = r.builder().AddGlobal<int32_t>(kWasmS128);
-  BUILD_V(r, WASM_SET_GLOBAL(1, WASM_GET_GLOBAL(0)), WASM_ONE);
+  BUILD(r, WASM_SET_GLOBAL(1, WASM_GET_GLOBAL(0)), WASM_ONE);
 
   FOR_INT32_INPUTS(x) {
     for (int i = 0; i < 4; i++) {
@@ -762,6 +690,30 @@ WASM_SIMD_TEST(F32x4RecipSqrtApprox) {
                    base::RecipSqrt, false /* !exact */);
 }
 
+// TODO(v8:10553) Prototyping floating-point rounding instructions.
+#if V8_TARGET_ARCH_X64
+WASM_SIMD_TEST_NO_LOWERING(F32x4Ceil) {
+  FLAG_SCOPE(wasm_simd_post_mvp);
+  RunF32x4UnOpTest(execution_tier, lower_simd, kExprF32x4Ceil, ceilf, true);
+}
+
+WASM_SIMD_TEST_NO_LOWERING(F32x4Floor) {
+  FLAG_SCOPE(wasm_simd_post_mvp);
+  RunF32x4UnOpTest(execution_tier, lower_simd, kExprF32x4Floor, floorf, true);
+}
+
+WASM_SIMD_TEST_NO_LOWERING(F32x4Trunc) {
+  FLAG_SCOPE(wasm_simd_post_mvp);
+  RunF32x4UnOpTest(execution_tier, lower_simd, kExprF32x4Trunc, truncf, true);
+}
+
+WASM_SIMD_TEST_NO_LOWERING(F32x4NearestInt) {
+  FLAG_SCOPE(wasm_simd_post_mvp);
+  RunF32x4UnOpTest(execution_tier, lower_simd, kExprF32x4NearestInt, nearbyintf,
+                   true);
+}
+#endif  // V8_TARGET_ARCH_X64
+
 void RunF32x4BinOpTest(ExecutionTier execution_tier, LowerSimd lower_simd,
                        WasmOpcode opcode, FloatBinOp expected_op) {
   WasmRunner<int32_t, float, float> r(execution_tier, lower_simd);
@@ -829,6 +781,21 @@ WASM_SIMD_TEST(F32x4Max) {
   RunF32x4BinOpTest(execution_tier, lower_simd, kExprF32x4Max, JSMax);
 }
 
+// TODO(v8:10501) Prototyping pmin and pmax instructions.
+#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_IA32 || V8_TARGET_ARCH_ARM64 || \
+    V8_TARGET_ARCH_ARM
+WASM_SIMD_TEST_NO_LOWERING(F32x4Pmin) {
+  FLAG_SCOPE(wasm_simd_post_mvp);
+  RunF32x4BinOpTest(execution_tier, lower_simd, kExprF32x4Pmin, Minimum);
+}
+
+WASM_SIMD_TEST_NO_LOWERING(F32x4Pmax) {
+  FLAG_SCOPE(wasm_simd_post_mvp);
+  RunF32x4BinOpTest(execution_tier, lower_simd, kExprF32x4Pmax, Maximum);
+}
+#endif  // V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_IA32 || V8_TARGET_ARCH_ARM64 ||
+        // V8_TARGET_ARCH_ARM
+
 void RunF32x4CompareOpTest(ExecutionTier execution_tier, LowerSimd lower_simd,
                            WasmOpcode opcode, FloatCompareOp expected_op) {
   WasmRunner<int32_t, float, float> r(execution_tier, lower_simd);
@@ -940,8 +907,8 @@ WASM_SIMD_TEST_NO_LOWERING(I64x2Splat) {
   // Set up a global to hold output vector.
   int64_t* g = r.builder().AddGlobal<int64_t>(kWasmS128);
   byte param1 = 0;
-  BUILD_V(r, WASM_SET_GLOBAL(0, WASM_SIMD_I64x2_SPLAT(WASM_GET_LOCAL(param1))),
-          WASM_ONE);
+  BUILD(r, WASM_SET_GLOBAL(0, WASM_SIMD_I64x2_SPLAT(WASM_GET_LOCAL(param1))),
+        WASM_ONE);
 
   FOR_INT64_INPUTS(x) {
     r.Call(x);
@@ -1206,7 +1173,8 @@ WASM_SIMD_TEST_NO_LOWERING(F64x2ReplaceLane) {
   CHECK_EQ(1., ReadLittleEndianValue<double>(&g1[1]));
 }
 
-#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_S390X
+#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_S390X || \
+    V8_TARGET_ARCH_MIPS64
 WASM_SIMD_TEST_NO_LOWERING(F64x2ExtractLaneWithI64x2) {
   WasmRunner<int64_t> r(execution_tier, lower_simd);
   BUILD(r, WASM_IF_ELSE_L(
@@ -1226,7 +1194,8 @@ WASM_SIMD_TEST_NO_LOWERING(I64x2ExtractWithF64x2) {
                WASM_I64V(1), WASM_I64V(0)));
   CHECK_EQ(1, r.Call());
 }
-#endif  // V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_S390X
+#endif  // V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_S390X ||
+        // V8_TARGET_ARCH_MIPS64
 
 bool IsExtreme(double x) {
   double abs_x = std::fabs(x);
@@ -1417,6 +1386,21 @@ WASM_SIMD_TEST_NO_LOWERING(F64x2Div) {
   RunF64x2BinOpTest(execution_tier, lower_simd, kExprF64x2Div, Div);
 }
 
+// TODO(v8:10501) Prototyping pmin and pmax instructions.
+#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_IA32 || V8_TARGET_ARCH_ARM64 || \
+    V8_TARGET_ARCH_ARM
+WASM_SIMD_TEST_NO_LOWERING(F64x2Pmin) {
+  FLAG_SCOPE(wasm_simd_post_mvp);
+  RunF64x2BinOpTest(execution_tier, lower_simd, kExprF64x2Pmin, Minimum);
+}
+
+WASM_SIMD_TEST_NO_LOWERING(F64x2Pmax) {
+  FLAG_SCOPE(wasm_simd_post_mvp);
+  RunF64x2BinOpTest(execution_tier, lower_simd, kExprF64x2Pmax, Maximum);
+}
+#endif  // V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_IA32 || V8_TARGET_ARCH_ARM64 ||
+        // V8_TARGET_ARCH_ARM
+
 void RunF64x2CompareOpTest(ExecutionTier execution_tier, LowerSimd lower_simd,
                            WasmOpcode opcode, DoubleCompareOp expected_op) {
   WasmRunner<int32_t, double, double> r(execution_tier, lower_simd);
@@ -1661,9 +1645,7 @@ WASM_SIMD_TEST(I16x8ReplaceLane) {
   }
 }
 
-#if V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_ARM
 WASM_SIMD_TEST_NO_LOWERING(I8x16BitMask) {
-  FLAG_SCOPE(wasm_simd_post_mvp);
   WasmRunner<int32_t, int32_t> r(execution_tier, lower_simd);
   byte value1 = r.AllocateLocal(kWasmS128);
 
@@ -1683,7 +1665,6 @@ WASM_SIMD_TEST_NO_LOWERING(I8x16BitMask) {
 }
 
 WASM_SIMD_TEST_NO_LOWERING(I16x8BitMask) {
-  FLAG_SCOPE(wasm_simd_post_mvp);
   WasmRunner<int32_t, int32_t> r(execution_tier, lower_simd);
   byte value1 = r.AllocateLocal(kWasmS128);
 
@@ -1703,7 +1684,6 @@ WASM_SIMD_TEST_NO_LOWERING(I16x8BitMask) {
 }
 
 WASM_SIMD_TEST_NO_LOWERING(I32x4BitMask) {
-  FLAG_SCOPE(wasm_simd_post_mvp);
   WasmRunner<int32_t, int32_t> r(execution_tier, lower_simd);
   byte value1 = r.AllocateLocal(kWasmS128);
 
@@ -1721,7 +1701,6 @@ WASM_SIMD_TEST_NO_LOWERING(I32x4BitMask) {
     CHECK_EQ(actual, expected);
   }
 }
-#endif  // V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_ARM
 
 WASM_SIMD_TEST(I8x16Splat) {
   WasmRunner<int32_t, int32_t> r(execution_tier, lower_simd);
@@ -2059,17 +2038,17 @@ void RunI32x4ShiftOpTest(ExecutionTier execution_tier, LowerSimd lower_simd,
   }
 }
 
-WASM_SIMD_TEST_NO_LOWERING(I32x4Shl) {
+WASM_SIMD_TEST(I32x4Shl) {
   RunI32x4ShiftOpTest(execution_tier, lower_simd, kExprI32x4Shl,
                       LogicalShiftLeft);
 }
 
-WASM_SIMD_TEST_NO_LOWERING(I32x4ShrS) {
+WASM_SIMD_TEST(I32x4ShrS) {
   RunI32x4ShiftOpTest(execution_tier, lower_simd, kExprI32x4ShrS,
                       ArithmeticShiftRight);
 }
 
-WASM_SIMD_TEST_NO_LOWERING(I32x4ShrU) {
+WASM_SIMD_TEST(I32x4ShrU) {
   RunI32x4ShiftOpTest(execution_tier, lower_simd, kExprI32x4ShrU,
                       LogicalShiftRight);
 }
@@ -2328,17 +2307,17 @@ void RunI16x8ShiftOpTest(ExecutionTier execution_tier, LowerSimd lower_simd,
   }
 }
 
-WASM_SIMD_TEST_NO_LOWERING(I16x8Shl) {
+WASM_SIMD_TEST(I16x8Shl) {
   RunI16x8ShiftOpTest(execution_tier, lower_simd, kExprI16x8Shl,
                       LogicalShiftLeft);
 }
 
-WASM_SIMD_TEST_NO_LOWERING(I16x8ShrS) {
+WASM_SIMD_TEST(I16x8ShrS) {
   RunI16x8ShiftOpTest(execution_tier, lower_simd, kExprI16x8ShrS,
                       ArithmeticShiftRight);
 }
 
-WASM_SIMD_TEST_NO_LOWERING(I16x8ShrU) {
+WASM_SIMD_TEST(I16x8ShrU) {
   RunI16x8ShiftOpTest(execution_tier, lower_simd, kExprI16x8ShrU,
                       LogicalShiftRight);
 }
@@ -2520,6 +2499,7 @@ WASM_SIMD_TEST(I8x16LeU) {
 }
 
 WASM_SIMD_TEST(I8x16Mul) {
+  FLAG_SCOPE(wasm_simd_post_mvp);
   RunI8x16BinOpTest(execution_tier, lower_simd, kExprI8x16Mul,
                     base::MulWithWraparound);
 }
@@ -2562,17 +2542,17 @@ void RunI8x16ShiftOpTest(ExecutionTier execution_tier, LowerSimd lower_simd,
   }
 }
 
-WASM_SIMD_TEST_NO_LOWERING(I8x16Shl) {
+WASM_SIMD_TEST(I8x16Shl) {
   RunI8x16ShiftOpTest(execution_tier, lower_simd, kExprI8x16Shl,
                       LogicalShiftLeft);
 }
 
-WASM_SIMD_TEST_NO_LOWERING(I8x16ShrS) {
+WASM_SIMD_TEST(I8x16ShrS) {
   RunI8x16ShiftOpTest(execution_tier, lower_simd, kExprI8x16ShrS,
                       ArithmeticShiftRight);
 }
 
-WASM_SIMD_TEST_NO_LOWERING(I8x16ShrU) {
+WASM_SIMD_TEST(I8x16ShrU) {
   RunI8x16ShiftOpTest(execution_tier, lower_simd, kExprI8x16ShrU,
                       LogicalShiftRight);
 }
@@ -3039,7 +3019,7 @@ WASM_SIMD_COMPILED_TEST(S8x16MultiShuffleFuzz) {
 // test inputs. Test inputs with all true, all false, one true, and one false.
 #define WASM_SIMD_BOOL_REDUCTION_TEST(format, lanes, int_type)                 \
   WASM_SIMD_TEST(ReductionTest##lanes) {                                       \
-    FLAG_SCOPE(wasm_simd_post_mvp); \
+    FLAG_SCOPE(wasm_simd_post_mvp);                                            \
     WasmRunner<int32_t> r(execution_tier, lower_simd);                         \
     if (lanes == 2 && lower_simd == kLowerSimd) return;                        \
     byte zero = r.AllocateLocal(kWasmS128);                                    \
@@ -3047,28 +3027,28 @@ WASM_SIMD_COMPILED_TEST(S8x16MultiShuffleFuzz) {
     byte reduced = r.AllocateLocal(kWasmI32);                                  \
     BUILD(r, WASM_SET_LOCAL(zero, WASM_SIMD_I##format##_SPLAT(int_type(0))),   \
           WASM_SET_LOCAL(                                                      \
-              reduced, WASM_SIMD_UNOP(kExprS1x##lanes##AnyTrue,                \
+              reduced, WASM_SIMD_UNOP(kExprV##format##AnyTrue,                 \
                                       WASM_SIMD_BINOP(kExprI##format##Eq,      \
                                                       WASM_GET_LOCAL(zero),    \
                                                       WASM_GET_LOCAL(zero)))), \
           WASM_IF(WASM_I32_EQ(WASM_GET_LOCAL(reduced), WASM_ZERO),             \
                   WASM_RETURN1(WASM_ZERO)),                                    \
           WASM_SET_LOCAL(                                                      \
-              reduced, WASM_SIMD_UNOP(kExprS1x##lanes##AnyTrue,                \
+              reduced, WASM_SIMD_UNOP(kExprV##format##AnyTrue,                 \
                                       WASM_SIMD_BINOP(kExprI##format##Ne,      \
                                                       WASM_GET_LOCAL(zero),    \
                                                       WASM_GET_LOCAL(zero)))), \
           WASM_IF(WASM_I32_NE(WASM_GET_LOCAL(reduced), WASM_ZERO),             \
                   WASM_RETURN1(WASM_ZERO)),                                    \
           WASM_SET_LOCAL(                                                      \
-              reduced, WASM_SIMD_UNOP(kExprS1x##lanes##AllTrue,                \
+              reduced, WASM_SIMD_UNOP(kExprV##format##AllTrue,                 \
                                       WASM_SIMD_BINOP(kExprI##format##Eq,      \
                                                       WASM_GET_LOCAL(zero),    \
                                                       WASM_GET_LOCAL(zero)))), \
           WASM_IF(WASM_I32_EQ(WASM_GET_LOCAL(reduced), WASM_ZERO),             \
                   WASM_RETURN1(WASM_ZERO)),                                    \
           WASM_SET_LOCAL(                                                      \
-              reduced, WASM_SIMD_UNOP(kExprS1x##lanes##AllTrue,                \
+              reduced, WASM_SIMD_UNOP(kExprV##format##AllTrue,                 \
                                       WASM_SIMD_BINOP(kExprI##format##Ne,      \
                                                       WASM_GET_LOCAL(zero),    \
                                                       WASM_GET_LOCAL(zero)))), \
@@ -3078,28 +3058,28 @@ WASM_SIMD_COMPILED_TEST(S8x16MultiShuffleFuzz) {
                          WASM_SIMD_I##format##_REPLACE_LANE(                   \
                              lanes - 1, WASM_GET_LOCAL(zero), int_type(1))),   \
           WASM_SET_LOCAL(                                                      \
-              reduced, WASM_SIMD_UNOP(kExprS1x##lanes##AnyTrue,                \
+              reduced, WASM_SIMD_UNOP(kExprV##format##AnyTrue,                 \
                                       WASM_SIMD_BINOP(kExprI##format##Eq,      \
                                                       WASM_GET_LOCAL(one_one), \
                                                       WASM_GET_LOCAL(zero)))), \
           WASM_IF(WASM_I32_EQ(WASM_GET_LOCAL(reduced), WASM_ZERO),             \
                   WASM_RETURN1(WASM_ZERO)),                                    \
           WASM_SET_LOCAL(                                                      \
-              reduced, WASM_SIMD_UNOP(kExprS1x##lanes##AnyTrue,                \
+              reduced, WASM_SIMD_UNOP(kExprV##format##AnyTrue,                 \
                                       WASM_SIMD_BINOP(kExprI##format##Ne,      \
                                                       WASM_GET_LOCAL(one_one), \
                                                       WASM_GET_LOCAL(zero)))), \
           WASM_IF(WASM_I32_EQ(WASM_GET_LOCAL(reduced), WASM_ZERO),             \
                   WASM_RETURN1(WASM_ZERO)),                                    \
           WASM_SET_LOCAL(                                                      \
-              reduced, WASM_SIMD_UNOP(kExprS1x##lanes##AllTrue,                \
+              reduced, WASM_SIMD_UNOP(kExprV##format##AllTrue,                 \
                                       WASM_SIMD_BINOP(kExprI##format##Eq,      \
                                                       WASM_GET_LOCAL(one_one), \
                                                       WASM_GET_LOCAL(zero)))), \
           WASM_IF(WASM_I32_NE(WASM_GET_LOCAL(reduced), WASM_ZERO),             \
                   WASM_RETURN1(WASM_ZERO)),                                    \
           WASM_SET_LOCAL(                                                      \
-              reduced, WASM_SIMD_UNOP(kExprS1x##lanes##AllTrue,                \
+              reduced, WASM_SIMD_UNOP(kExprV##format##AllTrue,                 \
                                       WASM_SIMD_BINOP(kExprI##format##Ne,      \
                                                       WASM_GET_LOCAL(one_one), \
                                                       WASM_GET_LOCAL(zero)))), \
@@ -3195,8 +3175,9 @@ WASM_SIMD_TEST(SimdI32x4SplatFromExtract) {
   WasmRunner<int32_t> r(execution_tier, lower_simd);
   r.AllocateLocal(kWasmI32);
   r.AllocateLocal(kWasmS128);
-  BUILD(r, WASM_SET_LOCAL(0, WASM_SIMD_I32x4_EXTRACT_LANE(
-                                 0, WASM_SIMD_I32x4_SPLAT(WASM_I32V(76)))),
+  BUILD(r,
+        WASM_SET_LOCAL(0, WASM_SIMD_I32x4_EXTRACT_LANE(
+                              0, WASM_SIMD_I32x4_SPLAT(WASM_I32V(76)))),
         WASM_SET_LOCAL(1, WASM_SIMD_I32x4_SPLAT(WASM_GET_LOCAL(0))),
         WASM_SIMD_I32x4_EXTRACT_LANE(1, WASM_GET_LOCAL(1)));
   CHECK_EQ(76, r.Call());
@@ -3407,6 +3388,29 @@ WASM_SIMD_TEST(SimdLoadStoreLoadMemargOffset) {
   }
 }
 
+// Test a multi-byte opcode with offset values that encode into valid opcodes.
+// This is to exercise decoding logic and make sure we get the lengths right.
+WASM_SIMD_TEST(S8x16LoadSplatOffset) {
+  // This offset is [82, 22] when encoded, which contains valid opcodes.
+  constexpr int offset = 4354;
+  WasmRunner<int32_t> r(execution_tier, lower_simd);
+  int8_t* memory = r.builder().AddMemoryElems<int8_t>(kWasmPageSize);
+  int8_t* global = r.builder().AddGlobal<int8_t>(kWasmS128);
+  BUILD(r,
+        WASM_SET_GLOBAL(
+            0, WASM_SIMD_LOAD_SPLAT_OFFSET(kExprS8x16LoadSplat, WASM_I32V(0),
+                                           U32V_2(offset))),
+        WASM_ONE);
+
+  // We don't really care about all valid values, so just test for 1.
+  int8_t x = 7;
+  r.builder().WriteMemory(&memory[offset], x);
+  r.Call();
+  for (int i = 0; i < 16; i++) {
+    CHECK_EQ(x, ReadLittleEndianValue<int8_t>(&global[i]));
+  }
+}
+
 template <typename T>
 void RunLoadSplatTest(ExecutionTier execution_tier, LowerSimd lower_simd,
                       WasmOpcode op) {
@@ -3447,23 +3451,59 @@ WASM_SIMD_TEST_NO_LOWERING(S64x2LoadSplat) {
 template <typename S, typename T>
 void RunLoadExtendTest(ExecutionTier execution_tier, LowerSimd lower_simd,
                        WasmOpcode op) {
+  static_assert(sizeof(S) < sizeof(T),
+                "load extend should go from smaller to larger type");
   constexpr int lanes_s = 16 / sizeof(S);
   constexpr int lanes_t = 16 / sizeof(T);
   constexpr int mem_index = 16;  // Load from mem index 16 (bytes).
-  WasmRunner<int32_t> r(execution_tier, lower_simd);
-  S* memory = r.builder().AddMemoryElems<S>(kWasmPageSize / sizeof(S));
-  T* global = r.builder().AddGlobal<T>(kWasmS128);
-  BUILD(r, WASM_SET_GLOBAL(0, WASM_SIMD_LOAD_EXTEND(op, WASM_I32V(mem_index))),
+  // Load extends always load 64 bits, so alignment values can be from 0 to 3.
+  for (byte alignment = 0; alignment <= 3; alignment++) {
+    WasmRunner<int32_t> r(execution_tier, lower_simd);
+    S* memory = r.builder().AddMemoryElems<S>(kWasmPageSize / sizeof(S));
+    T* global = r.builder().AddGlobal<T>(kWasmS128);
+    BUILD(r,
+          WASM_SET_GLOBAL(0, WASM_SIMD_LOAD_EXTEND_ALIGNMENT(
+                                 op, WASM_I32V(mem_index), alignment)),
+          WASM_ONE);
+
+    for (S x : compiler::ValueHelper::GetVector<S>()) {
+      for (int i = 0; i < lanes_s; i++) {
+        // 16-th byte in memory is lanes-th element (size T) of memory.
+        r.builder().WriteMemory(&memory[lanes_s + i], x);
+      }
+      r.Call();
+      for (int i = 0; i < lanes_t; i++) {
+        CHECK_EQ(static_cast<T>(x), ReadLittleEndianValue<T>(&global[i]));
+      }
+    }
+  }
+
+  // Test for offset.
+  {
+    WasmRunner<int32_t> r(execution_tier, lower_simd);
+    S* memory = r.builder().AddMemoryElems<S>(kWasmPageSize / sizeof(S));
+    T* global = r.builder().AddGlobal<T>(kWasmS128);
+    constexpr byte offset = sizeof(S);
+    BUILD(
+        r,
+        WASM_SET_GLOBAL(0, WASM_SIMD_LOAD_EXTEND_OFFSET(op, WASM_ZERO, offset)),
         WASM_ONE);
 
-  for (S x : compiler::ValueHelper::GetVector<S>()) {
+    // Let max_s be the max_s value for type S, we set up the memory as such:
+    // memory = [max_s, max_s - 1, ... max_s - (lane_s - 1)].
+    constexpr S max_s = std::numeric_limits<S>::max();
     for (int i = 0; i < lanes_s; i++) {
-      // 16-th byte in memory is lanes-th element (size T) of memory.
-      r.builder().WriteMemory(&memory[lanes_s + i], x);
+      // Integer promotion due to -, static_cast to narrow.
+      r.builder().WriteMemory(&memory[i], static_cast<S>(max_s - i));
     }
+
     r.Call();
+
+    // Loads will be offset by sizeof(S), so will always start from (max_s - 1).
     for (int i = 0; i < lanes_t; i++) {
-      CHECK_EQ(static_cast<T>(x), ReadLittleEndianValue<T>(&global[i]));
+      // Integer promotion due to -, static_cast to narrow.
+      T expected = static_cast<T>(max_s - i - 1);
+      CHECK_EQ(expected, ReadLittleEndianValue<T>(&global[i]));
     }
   }
 }
@@ -3497,18 +3537,16 @@ WASM_SIMD_TEST_NO_LOWERING(I64x2Load32x2S) {
                                       kExprI64x2Load32x2S);
 }
 
-#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_IA32 || V8_TARGET_ARCH_ARM64 || \
-    V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_S390X
 #define WASM_SIMD_ANYTRUE_TEST(format, lanes, max, param_type)                \
   WASM_SIMD_TEST(S##format##AnyTrue) {                                        \
-    FLAG_SCOPE(wasm_simd_post_mvp); \
+    FLAG_SCOPE(wasm_simd_post_mvp);                                           \
     WasmRunner<int32_t, param_type> r(execution_tier, lower_simd);            \
     if (lanes == 2 && lower_simd == kLowerSimd) return;                       \
     byte simd = r.AllocateLocal(kWasmS128);                                   \
     BUILD(                                                                    \
         r,                                                                    \
         WASM_SET_LOCAL(simd, WASM_SIMD_I##format##_SPLAT(WASM_GET_LOCAL(0))), \
-        WASM_SIMD_UNOP(kExprS1x##lanes##AnyTrue, WASM_GET_LOCAL(simd)));      \
+        WASM_SIMD_UNOP(kExprV##format##AnyTrue, WASM_GET_LOCAL(simd)));       \
     DCHECK_EQ(1, r.Call(max));                                                \
     DCHECK_EQ(1, r.Call(5));                                                  \
     DCHECK_EQ(0, r.Call(0));                                                  \
@@ -3520,16 +3558,28 @@ WASM_SIMD_ANYTRUE_TEST(32x4, 4, 0xffffffff, int32_t)
 WASM_SIMD_ANYTRUE_TEST(16x8, 8, 0xffff, int32_t)
 WASM_SIMD_ANYTRUE_TEST(8x16, 16, 0xff, int32_t)
 
+// Special any true test cases that splats a -0.0 double into a i64x2.
+// This is specifically to ensure that our implementation correct handles that
+// 0.0 and -0.0 will be different in an anytrue (IEEE753 says they are equals).
+WASM_SIMD_TEST_NO_LOWERING(V32x4AnytrueWithNegativeZero) {
+  WasmRunner<int32_t, int64_t> r(execution_tier, lower_simd);
+  byte simd = r.AllocateLocal(kWasmS128);
+  BUILD(r, WASM_SET_LOCAL(simd, WASM_SIMD_I64x2_SPLAT(WASM_GET_LOCAL(0))),
+        WASM_SIMD_UNOP(kExprV32x4AnyTrue, WASM_GET_LOCAL(simd)));
+  DCHECK_EQ(1, r.Call(0x8000000000000000));
+  DCHECK_EQ(0, r.Call(0x0000000000000000));
+}
+
 #define WASM_SIMD_ALLTRUE_TEST(format, lanes, max, param_type)                \
-  WASM_SIMD_TEST(S##format##AllTrue) {                                        \
-    FLAG_SCOPE(wasm_simd_post_mvp); \
+  WASM_SIMD_TEST(V##format##AllTrue) {                                        \
+    FLAG_SCOPE(wasm_simd_post_mvp);                                           \
     WasmRunner<int32_t, param_type> r(execution_tier, lower_simd);            \
     if (lanes == 2 && lower_simd == kLowerSimd) return;                       \
     byte simd = r.AllocateLocal(kWasmS128);                                   \
     BUILD(                                                                    \
         r,                                                                    \
         WASM_SET_LOCAL(simd, WASM_SIMD_I##format##_SPLAT(WASM_GET_LOCAL(0))), \
-        WASM_SIMD_UNOP(kExprS1x##lanes##AllTrue, WASM_GET_LOCAL(simd)));      \
+        WASM_SIMD_UNOP(kExprV##format##AllTrue, WASM_GET_LOCAL(simd)));       \
     DCHECK_EQ(1, r.Call(max));                                                \
     DCHECK_EQ(1, r.Call(0x1));                                                \
     DCHECK_EQ(0, r.Call(0));                                                  \
@@ -3540,8 +3590,6 @@ WASM_SIMD_ALLTRUE_TEST(64x2, 2, 0xffffffffffffffff, int64_t)
 WASM_SIMD_ALLTRUE_TEST(32x4, 4, 0xffffffff, int32_t)
 WASM_SIMD_ALLTRUE_TEST(16x8, 8, 0xffff, int32_t)
 WASM_SIMD_ALLTRUE_TEST(8x16, 16, 0xff, int32_t)
-#endif  // V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_IA32 || V8_TARGET_ARCH_ARM64 ||
-        // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_S390X
 
 WASM_SIMD_TEST(BitSelect) {
   WasmRunner<int32_t, int32_t> r(execution_tier, lower_simd);
@@ -3634,6 +3682,15 @@ WASM_SIMD_TEST_NO_LOWERING(I16x8GtUMixed) {
                                 UnsignedGreater);
 }
 
+WASM_SIMD_TEST_NO_LOWERING(I16x8ExtractLaneU_I8x16Splat) {
+  // Test that we are correctly signed/unsigned extending when extracting.
+  WasmRunner<int32_t, int32_t> r(execution_tier, lower_simd);
+  byte simd_val = r.AllocateLocal(kWasmS128);
+  BUILD(r, WASM_SET_LOCAL(simd_val, WASM_SIMD_I8x16_SPLAT(WASM_GET_LOCAL(0))),
+        WASM_SIMD_I16x8_EXTRACT_LANE_U(0, WASM_GET_LOCAL(simd_val)));
+  CHECK_EQ(0xfafa, r.Call(0xfa));
+}
+
 #define WASM_EXTRACT_I16x8_TEST(Sign, Type)                                    \
   WASM_SIMD_TEST(I16X8ExtractLane##Sign) {                                     \
     WasmRunner<int32_t, int32_t> r(execution_tier, lower_simd);                \
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm.cc b/deps/v8/test/cctest/wasm/test-run-wasm.cc
index 1aebac3c761..511ba192463 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm.cc
@@ -3752,9 +3752,9 @@ TEST(Liftoff_tier_up) {
     memcpy(buffer.get(), sub_code->instructions().begin(), sub_size);
     desc.buffer = buffer.get();
     desc.instr_size = static_cast<int>(sub_size);
-    std::unique_ptr<WasmCode> new_code =
-        native_module->AddCode(add.function_index(), desc, 0, 0, {}, {},
-                               WasmCode::kFunction, ExecutionTier::kTurbofan);
+    std::unique_ptr<WasmCode> new_code = native_module->AddCode(
+        add.function_index(), desc, 0, 0, {}, {}, WasmCode::kFunction,
+        ExecutionTier::kTurbofan, kNoDebugging);
     native_module->PublishCode(std::move(new_code));
 
     // Second run should now execute {sub}.
@@ -3762,6 +3762,15 @@ TEST(Liftoff_tier_up) {
   }
 }
 
+TEST(Regression_1085507) {
+  EXPERIMENTAL_FLAG_SCOPE(mv);
+  WasmRunner<int32_t> r(ExecutionTier::kInterpreter);
+  TestSignatures sigs;
+  uint32_t sig_v_i = r.builder().AddSignature(sigs.v_i());
+  BUILD(r, WASM_I32V_1(0), kExprIf, kLocalVoid, WASM_UNREACHABLE,
+        WASM_BLOCK_X(sig_v_i, kExprDrop), kExprElse, kExprEnd, WASM_I32V_1(0));
+}
+
 #undef B1
 #undef B2
 #undef RET
diff --git a/deps/v8/test/cctest/wasm/test-streaming-compilation.cc b/deps/v8/test/cctest/wasm/test-streaming-compilation.cc
index 4d3f83daff7..d9df1985a40 100644
--- a/deps/v8/test/cctest/wasm/test-streaming-compilation.cc
+++ b/deps/v8/test/cctest/wasm/test-streaming-compilation.cc
@@ -7,7 +7,6 @@
 #include "src/objects/managed.h"
 #include "src/objects/objects-inl.h"
 #include "src/utils/vector.h"
-
 #include "src/wasm/module-decoder.h"
 #include "src/wasm/streaming-decoder.h"
 #include "src/wasm/wasm-engine.h"
@@ -16,9 +15,8 @@
 #include "src/wasm/wasm-objects-inl.h"
 #include "src/wasm/wasm-objects.h"
 #include "src/wasm/wasm-serialization.h"
-
 #include "test/cctest/cctest.h"
-
+#include "test/common/wasm/flag-utils.h"
 #include "test/common/wasm/test-signatures.h"
 #include "test/common/wasm/wasm-macro-gen.h"
 
@@ -174,13 +172,20 @@ class StreamTester {
 };
 }  // namespace
 
-#define STREAM_TEST(name)                               \
-  void RunStream_##name();                              \
-  TEST(name) {                                          \
-    MockPlatform platform;                              \
-    CcTest::InitializeVM();                             \
-    RunStream_##name();                                 \
-  }                                                     \
+#define STREAM_TEST(name)                                                     \
+  void RunStream_##name();                                                    \
+  TEST(Async##name) {                                                         \
+    MockPlatform platform;                                                    \
+    CcTest::InitializeVM();                                                   \
+    RunStream_##name();                                                       \
+  }                                                                           \
+                                                                              \
+  TEST(SingleThreaded##name) {                                                \
+    i::FlagScope<bool> single_threaded_scope(&i::FLAG_single_threaded, true); \
+    MockPlatform platform;                                                    \
+    CcTest::InitializeVM();                                                   \
+    RunStream_##name();                                                       \
+  }                                                                           \
   void RunStream_##name()
 
 // Create a valid module with 3 functions.
@@ -1174,9 +1179,10 @@ STREAM_TEST(TestCompileErrorFunctionName) {
       U32V_1(1),                            // functions count
       0,                                    // signature index
       kCodeSectionCode,                     // section code
-      U32V_1(3),                            // section size
+      U32V_1(4),                            // section size
       U32V_1(1),                            // functions count
-      1,                                    // body size
+      2,                                    // body size
+      0,                                    // local definitions count
       kExprNop,                             // body
   };
 
@@ -1210,7 +1216,7 @@ STREAM_TEST(TestCompileErrorFunctionName) {
     CHECK(tester.IsPromiseRejected());
     CHECK_EQ(
         "CompileError: WebAssembly.compileStreaming(): Compiling function "
-        "#0:\"f\" failed: function body must end with \"end\" opcode @+25",
+        "#0:\"f\" failed: function body must end with \"end\" opcode @+26",
         tester.error_message());
   }
 }
diff --git a/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc b/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc
index 9f011ecf38f..fd1e5c81937 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc
@@ -7,8 +7,8 @@
 #include "src/execution/frames-inl.h"
 #include "src/objects/property-descriptor.h"
 #include "src/utils/utils.h"
+#include "src/wasm/wasm-debug.h"
 #include "src/wasm/wasm-objects-inl.h"
-
 #include "test/cctest/cctest.h"
 #include "test/cctest/compiler/value-helper.h"
 #include "test/cctest/wasm/wasm-run-utils.h"
@@ -116,7 +116,7 @@ class BreakHandler : public debug::DebugDelegate {
 
     // Check the current position.
     StackTraceFrameIterator frame_it(isolate_);
-    auto summ = FrameSummary::GetTop(frame_it.frame()).AsWasmInterpreted();
+    auto summ = FrameSummary::GetTop(frame_it.frame()).AsWasm();
     CHECK_EQ(expected_breaks_[count_].position, summ.byte_offset());
 
     expected_breaks_[count_].pre_action();
@@ -152,14 +152,6 @@ Handle<BreakPoint> SetBreakpoint(WasmRunnerBase* runner, int function_index,
       runner->main_isolate()->factory()->NewBreakPoint(
           break_index++, runner->main_isolate()->factory()->empty_string());
   CHECK(WasmScript::SetBreakPoint(script, &code_offset, break_point));
-  int set_byte_offset = code_offset - func_offset;
-  CHECK_EQ(expected_set_byte_offset, set_byte_offset);
-  // Also set breakpoint on the debug info of the instance directly, since the
-  // instance chain is not setup properly in tests.
-  Handle<WasmDebugInfo> debug_info =
-      WasmInstanceObject::GetOrCreateDebugInfo(instance);
-  WasmDebugInfo::SetBreakpoint(debug_info, function_index, set_byte_offset);
-
   return break_point;
 }
 
@@ -172,11 +164,6 @@ void ClearBreakpoint(WasmRunnerBase* runner, int function_index,
   Handle<Script> script(instance->module_object().script(),
                         runner->main_isolate());
   CHECK(WasmScript::ClearBreakPoint(script, code_offset, break_point));
-  // Also clear breakpoint on the debug info of the instance directly, since the
-  // instance chain is not setup properly in tests.
-  Handle<WasmDebugInfo> debug_info =
-      WasmInstanceObject::GetOrCreateDebugInfo(instance);
-  WasmDebugInfo::ClearBreakpoint(debug_info, function_index, byte_offset);
 }
 
 // Wrapper with operator<<.
@@ -243,21 +230,23 @@ class CollectValuesBreakHandler : public debug::DebugDelegate {
     HandleScope handles(isolate_);
 
     StackTraceFrameIterator frame_it(isolate_);
-    auto summ = FrameSummary::GetTop(frame_it.frame()).AsWasmInterpreted();
-    Handle<WasmInstanceObject> instance = summ.wasm_instance();
-
-    auto frame =
-        instance->debug_info().GetInterpretedFrame(frame_it.frame()->fp(), 0);
-    CHECK_EQ(expected.locals.size(), frame->GetLocalCount());
-    for (int i = 0; i < frame->GetLocalCount(); ++i) {
-      CHECK_EQ(WasmValWrapper{expected.locals[i]},
-               WasmValWrapper{frame->GetLocalValue(i)});
+    WasmFrame* frame = WasmFrame::cast(frame_it.frame());
+    DebugInfo* debug_info = frame->native_module()->GetDebugInfo();
+
+    int num_locals = debug_info->GetNumLocals(frame->pc());
+    CHECK_EQ(expected.locals.size(), num_locals);
+    for (int i = 0; i < num_locals; ++i) {
+      WasmValue local_value = debug_info->GetLocalValue(
+          i, frame->pc(), frame->fp(), frame->callee_fp());
+      CHECK_EQ(WasmValWrapper{expected.locals[i]}, WasmValWrapper{local_value});
     }
 
-    CHECK_EQ(expected.stack.size(), frame->GetStackHeight());
-    for (int i = 0; i < frame->GetStackHeight(); ++i) {
-      CHECK_EQ(WasmValWrapper{expected.stack[i]},
-               WasmValWrapper{frame->GetStackValue(i)});
+    int stack_depth = debug_info->GetStackDepth(frame->pc());
+    CHECK_EQ(expected.stack.size(), stack_depth);
+    for (int i = 0; i < stack_depth; ++i) {
+      WasmValue stack_value = debug_info->GetStackValue(
+          i, frame->pc(), frame->fp(), frame->callee_fp());
+      CHECK_EQ(WasmValWrapper{expected.stack[i]}, WasmValWrapper{stack_value});
     }
 
     isolate_->debug()->PrepareStep(StepAction::StepIn);
@@ -379,6 +368,7 @@ WASM_COMPILED_EXEC_TEST(WasmSimpleStepping) {
 
 WASM_COMPILED_EXEC_TEST(WasmStepInAndOut) {
   WasmRunner<int, int> runner(execution_tier);
+  runner.TierDown();
   WasmFunctionCompiler& f2 = runner.NewFunction<void>();
   f2.AllocateLocal(kWasmI32);
 
diff --git a/deps/v8/test/cctest/wasm/test-wasm-debug-evaluate.cc b/deps/v8/test/cctest/wasm/test-wasm-debug-evaluate.cc
index 5a7b2bc2016..c62aef31929 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-debug-evaluate.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-debug-evaluate.cc
@@ -43,14 +43,20 @@ namespace {
 template <typename... FunctionArgsT>
 class TestCode {
  public:
-  TestCode(WasmRunnerBase* runner, std::initializer_list<byte> code)
-      : compiler_(&runner->NewFunction<FunctionArgsT...>()), code_(code) {
+  TestCode(WasmRunnerBase* runner, std::initializer_list<byte> code,
+           std::initializer_list<ValueType::Kind> locals = {})
+      : compiler_(&runner->NewFunction<FunctionArgsT...>()),
+        code_(code),
+        locals_(static_cast<uint32_t>(locals.size())) {
+    for (ValueType::Kind T : locals) {
+      compiler_->AllocateLocal(ValueType(T));
+    }
     compiler_->Build(code.begin(), code.end());
   }
 
   Handle<BreakPoint> BreakOnReturn(WasmRunnerBase* runner) {
     runner->TierDown();
-    uint32_t return_offset_in_function = FindReturn();
+    uint32_t return_offset_in_function = locals_ + FindReturn();
 
     int function_index = compiler_->function_index();
     int function_offset =
@@ -66,14 +72,6 @@ class TestCode {
             break_index++, runner->main_isolate()->factory()->empty_string());
     CHECK(WasmScript::SetBreakPoint(script, &return_offset_in_module,
                                     break_point));
-    int set_breakpoint_offset = return_offset_in_module - function_offset;
-    // Also set breakpoint on the debug info of the instance directly, since
-    // the instance chain is not set up properly in tests.
-    Handle<WasmDebugInfo> debug_info =
-        WasmInstanceObject::GetOrCreateDebugInfo(instance);
-    WasmDebugInfo::SetBreakpoint(debug_info, function_index,
-                                 set_breakpoint_offset);
-
     return break_point;
   }
 
@@ -98,6 +96,7 @@ class TestCode {
 
   WasmFunctionCompiler* compiler_;
   std::vector<byte> code_;
+  uint32_t locals_;
 };
 
 class WasmEvaluatorBuilder {
@@ -108,6 +107,9 @@ class WasmEvaluatorBuilder {
       : zone_(&allocator_, ZONE_NAME), builder_(&zone_) {
     get_memory_function_index = AddImport<void, uint32_t, uint32_t, uint32_t>(
         CStrVector("__getMemory"));
+    get_local_function_index =
+        AddImport<void, uint32_t, uint32_t>(CStrVector("__getLocal"));
+    sbrk_function_index = AddImport<uint32_t, uint32_t>(CStrVector("__sbrk"));
     wasm_format_function =
         builder_.AddFunction(WasmRunnerBase::CreateSig<uint32_t>(&zone_));
     wasm_format_function->SetName(CStrVector("wasm_format"));
@@ -119,7 +121,8 @@ class WasmEvaluatorBuilder {
   template <typename ReturnT, typename... ArgTs>
   uint32_t AddImport(Vector<const char> name) {
     return builder_.AddImport(
-        name, WasmRunnerBase::CreateSig<ReturnT, ArgTs...>(&zone_));
+        name, WasmRunnerBase::CreateSig<ReturnT, ArgTs...>(&zone_),
+        CStrVector("env"));
   }
 
   void push_back(std::initializer_list<byte> code) {
@@ -127,9 +130,19 @@ class WasmEvaluatorBuilder {
                                    static_cast<uint32_t>(code.size()));
   }
 
+  void CallSbrk(std::initializer_list<byte> args) {
+    push_back(args);
+    push_back({WASM_CALL_FUNCTION0(sbrk_function_index)});
+  }
+
+  void CallGetLocal(std::initializer_list<byte> args) {
+    push_back(args);
+    push_back({WASM_CALL_FUNCTION0(get_local_function_index)});
+  }
+
   void CallGetMemory(std::initializer_list<byte> args) {
     push_back(args);
-    push_back({WASM_CALL_FUNCTION0(wasm_format_function->func_index())});
+    push_back({WASM_CALL_FUNCTION0(get_memory_function_index)});
   }
 
   ZoneBuffer bytes() {
@@ -143,6 +156,8 @@ class WasmEvaluatorBuilder {
   Zone zone_;
   WasmModuleBuilder builder_;
   uint32_t get_memory_function_index = 0;
+  uint32_t get_local_function_index = 0;
+  uint32_t sbrk_function_index = 0;
   WasmFunctionBuilder* wasm_format_function = nullptr;
 };
 
@@ -189,15 +204,12 @@ class WasmBreakHandler : public debug::DebugDelegate {
     // Check the current position.
     StackTraceFrameIterator frame_it(isolate_);
 
-    FrameSummary::WasmInterpretedFrameSummary summary =
-        FrameSummary::GetTop(frame_it.frame()).AsWasmInterpreted();
-    Handle<WasmInstanceObject> instance = summary.wasm_instance();
-    WasmInterpreter::FramePtr frame =
-        instance->debug_info().GetInterpretedFrame(frame_it.frame()->fp(), 0);
+    WasmFrame* frame = WasmFrame::cast(frame_it.frame());
+    Handle<WasmInstanceObject> instance{frame->wasm_instance(), isolate_};
 
     MaybeHandle<String> result_handle = v8::internal::wasm::DebugEvaluate(
         {evaluator_bytes_.begin(), evaluator_bytes_.size()}, instance,
-        std::move(frame));
+        frame_it.frame());
 
     Maybe<std::string> error_message = GetPendingExceptionAsString();
     Maybe<std::string> result_message =
@@ -218,7 +230,7 @@ WASM_COMPILED_EXEC_TEST(WasmDebugEvaluate_CompileFailed) {
   code.BreakOnReturn(&runner);
 
   WasmEvaluatorBuilder evaluator(execution_tier);
-  // Create a module that doesn't compile by missing the END bytecode
+  // Create a module that doesn't compile by missing the END bytecode.
   evaluator.push_back({WASM_RETURN1(WASM_I32V_1(33))});
 
   Isolate* isolate = runner.main_isolate();
@@ -262,11 +274,12 @@ WASM_COMPILED_EXEC_TEST(WasmDebugEvaluate_ExecuteFailed_SEGV) {
 
   TestCode<int> code(&runner, {WASM_RETURN1(WASM_I32V_1(32))});
 
-  // Create a module that doesn't compile by missing the END bytecode
-  WasmEvaluatorBuilder evaluator(execution_tier);
+  // Use a max memory size of 2 here to verify the precondition for the
+  // GrowMemory test below.
+  WasmEvaluatorBuilder evaluator(execution_tier, 1, 2);
   code.BreakOnReturn(&runner);
 
-  // Load 1 byte from an address that's too high
+  // Load 1 byte from an address that's too high.
   evaluator.CallGetMemory(
       {WASM_I32V_1(32), WASM_I32V_1(1), WASM_I32V_3((1 << 16) + 1)});
   evaluator.push_back({WASM_RETURN1(WASM_I32V_1(33)), WASM_END});
@@ -283,6 +296,34 @@ WASM_COMPILED_EXEC_TEST(WasmDebugEvaluate_ExecuteFailed_SEGV) {
       std::string::npos);
 }
 
+WASM_COMPILED_EXEC_TEST(WasmDebugEvaluate_GrowMemory) {
+  WasmRunner<int> runner(execution_tier);
+  runner.builder().AddMemoryElems<int32_t>(64);
+
+  TestCode<int> code(
+      &runner,
+      {WASM_STORE_MEM(MachineType::Int32(), WASM_I32V_1(32), WASM_I32V_2('A')),
+       WASM_RETURN1(WASM_LOAD_MEM(MachineType::Int32(), WASM_I32V_1(32)))});
+  code.BreakOnReturn(&runner);
+
+  WasmEvaluatorBuilder evaluator(execution_tier, 1, 2);
+  // Grow the memory.
+  evaluator.CallSbrk({WASM_I32V_1(1)});
+  // Load 1 byte from an address that's too high for the default memory.
+  evaluator.CallGetMemory(
+      {WASM_I32V_1(32), WASM_I32V_1(1), WASM_I32V_3((1 << 16) + 1)});
+  evaluator.push_back({WASM_RETURN1(WASM_I32V_3((1 << 16) + 1)), WASM_END});
+
+  Isolate* isolate = runner.main_isolate();
+  WasmBreakHandler break_handler(isolate, evaluator.bytes());
+  CHECK(!code.Run(&runner).is_null());
+
+  WasmBreakHandler::EvaluationResult result =
+      break_handler.result().ToChecked();
+  CHECK(result.error.IsNothing());
+  CHECK_EQ(result.result.ToChecked(), "A");
+}
+
 WASM_COMPILED_EXEC_TEST(WasmDebugEvaluate_LinearMemory) {
   WasmRunner<int> runner(execution_tier);
   runner.builder().AddMemoryElems<int32_t>(64);
@@ -309,6 +350,30 @@ WASM_COMPILED_EXEC_TEST(WasmDebugEvaluate_LinearMemory) {
   CHECK_EQ(result.result.ToChecked(), "A");
 }
 
+WASM_COMPILED_EXEC_TEST(WasmDebugEvaluate_Locals) {
+  WasmRunner<int> runner(execution_tier);
+  runner.builder().AddMemoryElems<int32_t>(64);
+
+  TestCode<int> code(
+      &runner,
+      {WASM_SET_LOCAL(0, WASM_I32V_2('A')), WASM_RETURN1(WASM_GET_LOCAL(0))},
+      {ValueType::kI32});
+  code.BreakOnReturn(&runner);
+
+  WasmEvaluatorBuilder evaluator(execution_tier);
+  evaluator.CallGetLocal({WASM_I32V_1(0), WASM_I32V_1(33)});
+  evaluator.push_back({WASM_RETURN1(WASM_I32V_1(33)), WASM_END});
+
+  Isolate* isolate = runner.main_isolate();
+  WasmBreakHandler break_handler(isolate, evaluator.bytes());
+  CHECK(!code.Run(&runner).is_null());
+
+  WasmBreakHandler::EvaluationResult result =
+      break_handler.result().ToChecked();
+  CHECK(result.error.IsNothing());
+  CHECK_EQ(result.result.ToChecked(), "A");
+}
+
 }  // namespace
 }  // namespace wasm
 }  // namespace internal
diff --git a/deps/v8/test/cctest/wasm/test-wasm-interpreter-entry.cc b/deps/v8/test/cctest/wasm/test-wasm-interpreter-entry.cc
deleted file mode 100644
index 75e927fafe1..00000000000
--- a/deps/v8/test/cctest/wasm/test-wasm-interpreter-entry.cc
+++ /dev/null
@@ -1,260 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include <cstdint>
-
-#include "src/base/overflowing-math.h"
-#include "src/codegen/assembler-inl.h"
-#include "src/objects/objects-inl.h"
-#include "src/wasm/wasm-objects.h"
-#include "test/cctest/cctest.h"
-#include "test/cctest/compiler/value-helper.h"
-#include "test/cctest/wasm/wasm-run-utils.h"
-#include "test/common/wasm/wasm-macro-gen.h"
-
-namespace v8 {
-namespace internal {
-namespace wasm {
-
-/**
- * We test the interface from Wasm compiled code to the Wasm interpreter by
- * building a module with two functions. The external function is called from
- * this test, and will be compiled code. It takes its arguments and passes them
- * on to the internal function, which will be redirected to the interpreter.
- * If the internal function has an i64 parameter, is has to be replaced by two
- * i32 parameters on the external function.
- * The internal function just converts all its arguments to f64, sums them up
- * and returns the sum.
- */
-namespace {
-
-template <typename T>
-class ArgPassingHelper {
- public:
-  ArgPassingHelper(WasmRunnerBase* runner, WasmFunctionCompiler* inner_compiler,
-                   std::initializer_list<uint8_t> bytes_inner_function,
-                   std::initializer_list<uint8_t> bytes_outer_function,
-                   const T& expected_lambda)
-      : isolate_(runner->main_isolate()),
-        expected_lambda_(expected_lambda),
-        debug_info_(WasmInstanceObject::GetOrCreateDebugInfo(
-            runner->builder().instance_object())) {
-    std::vector<uint8_t> inner_code{bytes_inner_function};
-    inner_compiler->Build(inner_code.data(),
-                          inner_code.data() + inner_code.size());
-
-    std::vector<uint8_t> outer_code{bytes_outer_function};
-    runner->Build(outer_code.data(), outer_code.data() + outer_code.size());
-
-    int funcs_to_redict[] = {
-        static_cast<int>(inner_compiler->function_index())};
-    runner->builder().SetExecutable();
-    WasmDebugInfo::RedirectToInterpreter(debug_info_,
-                                         ArrayVector(funcs_to_redict));
-    main_fun_wrapper_ = runner->builder().WrapCode(runner->function_index());
-  }
-
-  template <typename... Args>
-  void CheckCall(Args... args) {
-    Handle<Object> arg_objs[] = {isolate_->factory()->NewNumber(args)...};
-
-    uint64_t num_interpreted_before = debug_info_->NumInterpretedCalls();
-    Handle<Object> global(isolate_->context().global_object(), isolate_);
-    MaybeHandle<Object> retval = Execution::Call(
-        isolate_, main_fun_wrapper_, global, arraysize(arg_objs), arg_objs);
-    uint64_t num_interpreted_after = debug_info_->NumInterpretedCalls();
-    // Check that we really went through the interpreter.
-    CHECK_EQ(num_interpreted_before + 1, num_interpreted_after);
-    // Check the result.
-    double result = retval.ToHandleChecked()->Number();
-    double expected = expected_lambda_(args...);
-    CHECK_DOUBLE_EQ(expected, result);
-  }
-
- private:
-  Isolate* isolate_;
-  T expected_lambda_;
-  Handle<WasmDebugInfo> debug_info_;
-  Handle<JSFunction> main_fun_wrapper_;
-};
-
-template <typename T>
-static ArgPassingHelper<T> GetHelper(
-    WasmRunnerBase* runner, WasmFunctionCompiler* inner_compiler,
-    std::initializer_list<uint8_t> bytes_inner_function,
-    std::initializer_list<uint8_t> bytes_outer_function,
-    const T& expected_lambda) {
-  return ArgPassingHelper<T>(runner, inner_compiler, bytes_inner_function,
-                             bytes_outer_function, expected_lambda);
-}
-
-}  // namespace
-
-// Pass int32_t, return int32_t.
-TEST(TestArgumentPassing_int32) {
-  WasmRunner<int32_t, int32_t> runner(ExecutionTier::kTurbofan);
-  WasmFunctionCompiler& f2 = runner.NewFunction<int32_t, int32_t>();
-
-  auto helper = GetHelper(
-      &runner, &f2,
-      {// Return 2*<0> + 1.
-       WASM_I32_ADD(WASM_I32_MUL(WASM_I32V_1(2), WASM_GET_LOCAL(0)), WASM_ONE)},
-      {// Call f2 with param <0>.
-       WASM_GET_LOCAL(0), WASM_CALL_FUNCTION0(f2.function_index())},
-      [](int32_t a) {
-        return base::AddWithWraparound(base::MulWithWraparound(2, a), 1);
-      });
-
-  FOR_INT32_INPUTS(v) { helper.CheckCall(v); }
-}
-
-// Pass int64_t, return double.
-TEST(TestArgumentPassing_double_int64) {
-  WasmRunner<double, int32_t, int32_t> runner(ExecutionTier::kTurbofan);
-  WasmFunctionCompiler& f2 = runner.NewFunction<double, int64_t>();
-
-  auto helper = GetHelper(
-      &runner, &f2,
-      {// Return (double)<0>.
-       WASM_F64_SCONVERT_I64(WASM_GET_LOCAL(0))},
-      {// Call f2 with param (<0> | (<1> << 32)).
-       WASM_I64_IOR(WASM_I64_UCONVERT_I32(WASM_GET_LOCAL(0)),
-                    WASM_I64_SHL(WASM_I64_UCONVERT_I32(WASM_GET_LOCAL(1)),
-                                 WASM_I64V_1(32))),
-       WASM_CALL_FUNCTION0(f2.function_index())},
-      [](int32_t a, int32_t b) {
-        int64_t a64 = static_cast<int64_t>(a) & 0xFFFFFFFF;
-        int64_t b64 = static_cast<uint64_t>(static_cast<int64_t>(b)) << 32;
-        return static_cast<double>(a64 | b64);
-      });
-
-  FOR_INT32_INPUTS(v1) {
-    FOR_INT32_INPUTS(v2) { helper.CheckCall(v1, v2); }
-  }
-
-  FOR_INT64_INPUTS(v) {
-    int32_t v1 = static_cast<int32_t>(v);
-    int32_t v2 = static_cast<int32_t>(v >> 32);
-    helper.CheckCall(v1, v2);
-    helper.CheckCall(v2, v1);
-  }
-}
-
-// Pass double, return int64_t.
-TEST(TestArgumentPassing_int64_double) {
-  // Outer function still returns double.
-  WasmRunner<double, double> runner(ExecutionTier::kTurbofan);
-  WasmFunctionCompiler& f2 = runner.NewFunction<int64_t, double>();
-
-  auto helper = GetHelper(
-      &runner, &f2,
-      {// Return (int64_t)<0>.
-       WASM_I64_SCONVERT_F64(WASM_GET_LOCAL(0))},
-      {// Call f2 with param <0>, convert returned value back to double.
-       WASM_F64_SCONVERT_I64(WASM_SEQ(
-           WASM_GET_LOCAL(0), WASM_CALL_FUNCTION0(f2.function_index())))},
-      [](double d) { return d; });
-
-  for (int64_t i : compiler::ValueHelper::int64_vector()) {
-    helper.CheckCall(i);
-  }
-}
-
-// Pass float, return double.
-TEST(TestArgumentPassing_float_double) {
-  WasmRunner<double, float> runner(ExecutionTier::kTurbofan);
-  WasmFunctionCompiler& f2 = runner.NewFunction<double, float>();
-
-  auto helper = GetHelper(
-      &runner, &f2,
-      {// Return 2*(double)<0> + 1.
-       WASM_F64_ADD(
-           WASM_F64_MUL(WASM_F64(2), WASM_F64_CONVERT_F32(WASM_GET_LOCAL(0))),
-           WASM_F64(1))},
-      {// Call f2 with param <0>.
-       WASM_GET_LOCAL(0), WASM_CALL_FUNCTION0(f2.function_index())},
-      [](float f) { return 2. * static_cast<double>(f) + 1.; });
-
-  FOR_FLOAT32_INPUTS(f) { helper.CheckCall(f); }
-}
-
-// Pass two doubles, return double.
-TEST(TestArgumentPassing_double_double) {
-  WasmRunner<double, double, double> runner(ExecutionTier::kTurbofan);
-  WasmFunctionCompiler& f2 = runner.NewFunction<double, double, double>();
-
-  auto helper = GetHelper(&runner, &f2,
-                          {// Return <0> + <1>.
-                           WASM_F64_ADD(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))},
-                          {// Call f2 with params <0>, <1>.
-                           WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
-                           WASM_CALL_FUNCTION0(f2.function_index())},
-                          [](double a, double b) { return a + b; });
-
-  FOR_FLOAT64_INPUTS(d1) {
-    FOR_FLOAT64_INPUTS(d2) { helper.CheckCall(d1, d2); }
-  }
-}
-
-// Pass int32_t, int64_t, float and double, return double.
-TEST(TestArgumentPassing_AllTypes) {
-  // The second and third argument will be combined to an i64.
-  WasmRunner<double, int32_t, int32_t, int32_t, float, double> runner(
-      ExecutionTier::kTurbofan);
-  WasmFunctionCompiler& f2 =
-      runner.NewFunction<double, int32_t, int64_t, float, double>();
-
-  auto helper = GetHelper(
-      &runner, &f2,
-      {
-          // Convert all arguments to double, add them and return the sum.
-          WASM_F64_ADD(          // <0+1+2> + <3>
-              WASM_F64_ADD(      // <0+1> + <2>
-                  WASM_F64_ADD(  // <0> + <1>
-                      WASM_F64_SCONVERT_I32(
-                          WASM_GET_LOCAL(0)),  // <0> to double
-                      WASM_F64_SCONVERT_I64(
-                          WASM_GET_LOCAL(1))),               // <1> to double
-                  WASM_F64_CONVERT_F32(WASM_GET_LOCAL(2))),  // <2> to double
-              WASM_GET_LOCAL(3))                             // <3>
-      },
-      {WASM_GET_LOCAL(0),                                      // first arg
-       WASM_I64_IOR(WASM_I64_UCONVERT_I32(WASM_GET_LOCAL(1)),  // second arg
-                    WASM_I64_SHL(WASM_I64_UCONVERT_I32(WASM_GET_LOCAL(2)),
-                                 WASM_I64V_1(32))),
-       WASM_GET_LOCAL(3),  // third arg
-       WASM_GET_LOCAL(4),  // fourth arg
-       WASM_CALL_FUNCTION0(f2.function_index())},
-      [](int32_t a, int32_t b, int32_t c, float d, double e) {
-        return 0. + a + (static_cast<int64_t>(b) & 0xFFFFFFFF) +
-               ((static_cast<int64_t>(c) & 0xFFFFFFFF) << 32) + d + e;
-      });
-
-  auto CheckCall = [&](int32_t a, int64_t b, float c, double d) {
-    int32_t b0 = static_cast<int32_t>(b);
-    int32_t b1 = static_cast<int32_t>(b >> 32);
-    helper.CheckCall(a, b0, b1, c, d);
-    helper.CheckCall(a, b1, b0, c, d);
-  };
-
-  Vector<const int32_t> test_values_i32 = compiler::ValueHelper::int32_vector();
-  Vector<const int64_t> test_values_i64 = compiler::ValueHelper::int64_vector();
-  Vector<const float> test_values_f32 = compiler::ValueHelper::float32_vector();
-  Vector<const double> test_values_f64 =
-      compiler::ValueHelper::float64_vector();
-  size_t max_len =
-      std::max(std::max(test_values_i32.size(), test_values_i64.size()),
-               std::max(test_values_f32.size(), test_values_f64.size()));
-  for (size_t i = 0; i < max_len; ++i) {
-    int32_t i32 = test_values_i32[i % test_values_i32.size()];
-    int64_t i64 = test_values_i64[i % test_values_i64.size()];
-    float f32 = test_values_f32[i % test_values_f32.size()];
-    double f64 = test_values_f64[i % test_values_f64.size()];
-    CheckCall(i32, i64, f32, f64);
-  }
-}
-
-}  // namespace wasm
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/test/cctest/wasm/test-wasm-serialization.cc b/deps/v8/test/cctest/wasm/test-wasm-serialization.cc
index 2a486303e89..75bdff0571b 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-serialization.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-serialization.cc
@@ -69,10 +69,11 @@ class WasmSerializationTest {
     base::WriteUnalignedValue<uint32_t>(num_functions_slot, 0);
   }
 
-  MaybeHandle<WasmModuleObject> Deserialize() {
+  MaybeHandle<WasmModuleObject> Deserialize(
+      Vector<const char> source_url = {}) {
     return DeserializeNativeModule(CcTest::i_isolate(),
                                    VectorOf(serialized_bytes_),
-                                   VectorOf(wire_bytes_), {});
+                                   VectorOf(wire_bytes_), source_url);
   }
 
   void DeserializeAndRun() {
@@ -200,6 +201,19 @@ TEST(DeserializeValidModule) {
   test.CollectGarbage();
 }
 
+TEST(DeserializeWithSourceUrl) {
+  WasmSerializationTest test;
+  {
+    HandleScope scope(CcTest::i_isolate());
+    const std::string url = "http://example.com/example.wasm";
+    Handle<WasmModuleObject> module_object;
+    CHECK(test.Deserialize(VectorOf(url)).ToHandle(&module_object));
+    String source_url = String::cast(module_object->script().source_url());
+    CHECK_EQ(url, source_url.ToCString().get());
+  }
+  test.CollectGarbage();
+}
+
 TEST(DeserializeMismatchingVersion) {
   WasmSerializationTest test;
   {
diff --git a/deps/v8/test/cctest/wasm/test-wasm-shared-engine.cc b/deps/v8/test/cctest/wasm/test-wasm-shared-engine.cc
index badeb8e7a01..3639569f89b 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-shared-engine.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-shared-engine.cc
@@ -86,7 +86,8 @@ class SharedEngineIsolate {
 
   Handle<WasmInstanceObject> ImportInstance(SharedModule shared_module) {
     Handle<WasmModuleObject> module_object =
-        isolate()->wasm_engine()->ImportNativeModule(isolate(), shared_module);
+        isolate()->wasm_engine()->ImportNativeModule(isolate(), shared_module,
+                                                     {});
     ErrorThrower thrower(isolate(), "ImportInstance");
     MaybeHandle<WasmInstanceObject> instance =
         isolate()->wasm_engine()->SyncInstantiate(isolate(), &thrower,
diff --git a/deps/v8/test/cctest/wasm/test-wasm-stack.cc b/deps/v8/test/cctest/wasm/test-wasm-stack.cc
index 864b8885a27..7ef79a63502 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-stack.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-stack.cc
@@ -104,7 +104,7 @@ void CheckComputeLocation(v8::internal::Isolate* i_isolate, Handle<Object> exc,
 }  // namespace
 
 // Call from JS to wasm to JS and throw an Error from JS.
-WASM_EXEC_TEST(CollectDetailedWasmStack_ExplicitThrowFromJs) {
+WASM_COMPILED_EXEC_TEST(CollectDetailedWasmStack_ExplicitThrowFromJs) {
   TestSignatures sigs;
   HandleScope scope(CcTest::InitIsolateOnce());
   const char* source =
@@ -153,7 +153,7 @@ WASM_EXEC_TEST(CollectDetailedWasmStack_ExplicitThrowFromJs) {
 }
 
 // Trigger a trap in wasm, stack should contain a source url.
-WASM_EXEC_TEST(CollectDetailedWasmStack_WasmUrl) {
+WASM_COMPILED_EXEC_TEST(CollectDetailedWasmStack_WasmUrl) {
   // Create a WasmRunner with stack checks and traps enabled.
   WasmRunner<int> r(execution_tier, nullptr, "main", kRuntimeExceptionSupport);
 
@@ -210,7 +210,7 @@ WASM_EXEC_TEST(CollectDetailedWasmStack_WasmUrl) {
 }
 
 // Trigger a trap in wasm, stack should be JS -> wasm -> wasm.
-WASM_EXEC_TEST(CollectDetailedWasmStack_WasmError) {
+WASM_COMPILED_EXEC_TEST(CollectDetailedWasmStack_WasmError) {
   for (int pos_shift = 0; pos_shift < 3; ++pos_shift) {
     // Test a position with 1, 2 or 3 bytes needed to represent it.
     int unreachable_pos = 1 << (8 * pos_shift);
diff --git a/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc b/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc
index 21808b0557b..2ffd72aaafe 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc
@@ -66,7 +66,7 @@ void CheckExceptionInfos(v8::internal::Isolate* i_isolate, Handle<Object> exc,
 }  // namespace
 
 // Trigger a trap for executing unreachable.
-WASM_EXEC_TEST(Unreachable) {
+WASM_COMPILED_EXEC_TEST(Unreachable) {
   // Create a WasmRunner with stack checks and traps enabled.
   WasmRunner<void> r(execution_tier, nullptr, "main", kRuntimeExceptionSupport);
   TestSignatures sigs;
@@ -100,7 +100,7 @@ WASM_EXEC_TEST(Unreachable) {
 }
 
 // Trigger a trap for loading from out-of-bounds.
-WASM_EXEC_TEST(IllegalLoad) {
+WASM_COMPILED_EXEC_TEST(IllegalLoad) {
   WasmRunner<void> r(execution_tier, nullptr, "main", kRuntimeExceptionSupport);
   TestSignatures sigs;
 
diff --git a/deps/v8/test/cctest/wasm/wasm-run-utils.cc b/deps/v8/test/cctest/wasm/wasm-run-utils.cc
index 96980e6df7d..15903bcb3a1 100644
--- a/deps/v8/test/cctest/wasm/wasm-run-utils.cc
+++ b/deps/v8/test/cctest/wasm/wasm-run-utils.cc
@@ -18,35 +18,6 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-template <>
-void AppendSingle(std::vector<byte>* code, WasmOpcode op) {
-  // We do not yet have opcodes that take up more than 2 byte (decoded). But if
-  // that changes, this will need to be updated.
-  DCHECK_EQ(0, op >> 16);
-  byte prefix = (op >> 8) & 0xff;
-  byte opcode = op & 0xff;
-
-  if (!prefix) {
-    code->push_back(opcode);
-    return;
-  }
-
-  // Ensure the prefix is really one of the supported prefixed opcodes.
-  DCHECK(WasmOpcodes::IsPrefixOpcode(static_cast<WasmOpcode>(prefix)));
-  code->push_back(prefix);
-
-  // Decoded opcodes fit in a byte (0x00-0xff).
-  DCHECK_LE(LEBHelper::sizeof_u32v(opcode), 2);
-  // Therefore, the encoding needs max 2 bytes.
-  uint8_t encoded[2];
-  uint8_t* d = encoded;
-  // d is updated to after the last uint8_t written.
-  LEBHelper::write_u32v(&d, opcode);
-  for (uint8_t* p = encoded; p < d; p++) {
-    code->push_back(*p);
-  }
-}
-
 TestingModuleBuilder::TestingModuleBuilder(
     Zone* zone, ManuallyImportedJSFunction* maybe_import, ExecutionTier tier,
     RuntimeExceptionSupport exception_support, LowerSimd lower_simd)
@@ -164,22 +135,11 @@ uint32_t TestingModuleBuilder::AddFunction(const FunctionSig* sig,
                 test_module_->num_declared_functions);
   if (name) {
     Vector<const byte> name_vec = Vector<const byte>::cast(CStrVector(name));
-    test_module_->function_names.AddForTesting(
+    test_module_->lazily_generated_names.AddForTesting(
         index, {AddBytes(name_vec), static_cast<uint32_t>(name_vec.length())});
   }
   if (interpreter_) {
     interpreter_->AddFunctionForTesting(&test_module_->functions.back());
-    // Patch the jump table to call the interpreter for this function.
-    wasm::WasmCompilationResult result = compiler::CompileWasmInterpreterEntry(
-        isolate_->wasm_engine(), native_module_->enabled_features(), index,
-        sig);
-    std::unique_ptr<wasm::WasmCode> code = native_module_->AddCode(
-        index, result.code_desc, result.frame_slot_count,
-        result.tagged_parameter_slots,
-        result.protected_instructions_data.as_vector(),
-        result.source_positions.as_vector(), wasm::WasmCode::kInterpreterEntry,
-        wasm::ExecutionTier::kInterpreter);
-    native_module_->PublishCode(std::move(code));
   }
   DCHECK_LT(index, kMaxFunctions);  // limited for testing.
   return index;
@@ -195,6 +155,7 @@ void TestingModuleBuilder::FreezeSignatureMapAndInitializeWrapperCache() {
 }
 
 Handle<JSFunction> TestingModuleBuilder::WrapCode(uint32_t index) {
+  CHECK(!interpreter_);
   FreezeSignatureMapAndInitializeWrapperCache();
   SetExecutable();
   return WasmInstanceObject::GetOrCreateWasmExternalFunction(
@@ -338,18 +299,14 @@ uint32_t TestingModuleBuilder::AddPassiveElementSegment(
   return index;
 }
 
-CompilationEnv TestingModuleBuilder::CreateCompilationEnv(
-    AssumeDebugging debug) {
+CompilationEnv TestingModuleBuilder::CreateCompilationEnv() {
   // This is a hack so we don't need to call
   // trap_handler::IsTrapHandlerEnabled().
   const bool is_trap_handler_enabled =
       V8_TRAP_HANDLER_SUPPORTED && i::FLAG_wasm_trap_handler;
   return {test_module_ptr_,
           is_trap_handler_enabled ? kUseTrapHandler : kNoTrapHandler,
-          runtime_exception_support_,
-          enabled_features_,
-          lower_simd(),
-          debug};
+          runtime_exception_support_, enabled_features_, lower_simd()};
 }
 
 const WasmGlobal* TestingModuleBuilder::AddGlobal(ValueType type) {
@@ -364,10 +321,6 @@ const WasmGlobal* TestingModuleBuilder::AddGlobal(ValueType type) {
 }
 
 Handle<WasmInstanceObject> TestingModuleBuilder::InitInstanceObject() {
-  Handle<Script> script =
-      isolate_->factory()->NewScript(isolate_->factory()->empty_string());
-  script->set_type(Script::TYPE_WASM);
-
   const bool kUsesLiftoff = true;
   size_t code_size_estimate =
       wasm::WasmCodeManager::EstimateNativeModuleCodeSize(test_module_.get(),
@@ -375,6 +328,8 @@ Handle<WasmInstanceObject> TestingModuleBuilder::InitInstanceObject() {
   auto native_module = isolate_->wasm_engine()->NewNativeModule(
       isolate_, enabled_features_, test_module_, code_size_estimate);
   native_module->SetWireBytes(OwnedVector<const uint8_t>());
+  Handle<Script> script =
+      isolate_->wasm_engine()->GetOrCreateScript(isolate_, native_module);
 
   Handle<WasmModuleObject> module_object =
       WasmModuleObject::New(isolate_, std::move(native_module), script);
@@ -580,13 +535,17 @@ void WasmFunctionCompiler::Build(const byte* start, const byte* end) {
                          func_wire_bytes.begin(), func_wire_bytes.end()};
   NativeModule* native_module =
       builder_->instance_object()->module_object().native_module();
-  WasmCompilationUnit unit(function_->func_index, builder_->execution_tier());
+  ForDebugging for_debugging =
+      native_module->IsTieredDown() ? kForDebugging : kNoDebugging;
+  WasmCompilationUnit unit(function_->func_index, builder_->execution_tier(),
+                           for_debugging);
   WasmFeatures unused_detected_features;
   WasmCompilationResult result = unit.ExecuteCompilation(
       isolate()->wasm_engine(), &env,
       native_module->compilation_state()->GetWireBytesStorage(),
       isolate()->counters(), &unused_detected_features);
-  WasmCode* code = native_module->AddCompiledCode(std::move(result));
+  WasmCode* code = native_module->PublishCode(
+      native_module->AddCompiledCode(std::move(result)));
   DCHECK_NOT_NULL(code);
   if (WasmCode::ShouldBeLogged(isolate())) code->LogCode(isolate());
 }
diff --git a/deps/v8/test/cctest/wasm/wasm-run-utils.h b/deps/v8/test/cctest/wasm/wasm-run-utils.h
index d1bc9293b63..5d008d882a4 100644
--- a/deps/v8/test/cctest/wasm/wasm-run-utils.h
+++ b/deps/v8/test/cctest/wasm/wasm-run-utils.h
@@ -75,42 +75,6 @@ using compiler::Node;
     r.Build(code, code + arraysize(code)); \
   } while (false)
 
-template <typename T>
-void AppendSingle(std::vector<byte>* code, T t) {
-  static_assert(std::is_integral<T>::value,
-                "Special types need specializations");
-  code->push_back(t);
-}
-
-// Specialized for WasmOpcode.
-template <>
-void AppendSingle<WasmOpcode>(std::vector<byte>* code, WasmOpcode op);
-
-template <typename... T>
-void Append(std::vector<byte>* code, T... ts) {
-  static_assert(sizeof...(ts) == 0, "Base case for appending bytes to code.");
-}
-
-template <typename First, typename... Rest>
-void Append(std::vector<byte>* code, First first, Rest... rest) {
-  AppendSingle(code, first);
-  Append(code, rest...);
-}
-
-// Like BUILD but pushes code bytes into a std::vector instead of an array
-// initializer. This is useful for opcodes (like SIMD), that are LEB128
-// (variable-sized). We use recursive template instantiations with variadic
-// template arguments, so that the Append calls can handle either bytes or
-// opcodes. AppendSingle is specialized for WasmOpcode, and appends multiple
-// bytes. This allows existing callers to swap out the BUILD macro for BUILD_V
-// macro without changes. Also see https://crbug.com/v8/10258.
-#define BUILD_V(r, ...)                              \
-  do {                                               \
-    std::vector<byte> code;                          \
-    Append(&code, __VA_ARGS__);                      \
-    r.Build(code.data(), code.data() + code.size()); \
-  } while (false)
-
 // For tests that must manually import a JSFunction with source code.
 struct ManuallyImportedJSFunction {
   const FunctionSig* sig;
@@ -146,12 +110,10 @@ class TestingModuleBuilder {
   }
 
   byte AddSignature(const FunctionSig* sig) {
-    DCHECK_EQ(test_module_->signatures.size(),
-              test_module_->signature_ids.size());
-    test_module_->signatures.push_back(sig);
-    auto canonical_sig_num = test_module_->signature_map.FindOrInsert(*sig);
-    test_module_->signature_ids.push_back(canonical_sig_num);
-    size_t size = test_module_->signatures.size();
+    // TODO(7748): This will need updating for struct/array types support.
+    DCHECK_EQ(test_module_->types.size(), test_module_->signature_ids.size());
+    test_module_->add_signature(sig);
+    size_t size = test_module_->types.size();
     CHECK_GT(127, size);
     return static_cast<byte>(size - 1);
   }
@@ -258,10 +220,13 @@ class TestingModuleBuilder {
 
   void SetExecutable() { native_module_->SetExecutable(true); }
 
-  void TierDown() { native_module_->TierDown(isolate_); }
+  void TierDown() {
+    native_module_->SetTieringState(kTieredDown);
+    native_module_->TriggerRecompilation();
+    execution_tier_ = ExecutionTier::kLiftoff;
+  }
 
-  enum AssumeDebugging : bool { kDebug = true, kNoDebug = false };
-  CompilationEnv CreateCompilationEnv(AssumeDebugging = kNoDebug);
+  CompilationEnv CreateCompilationEnv();
 
   ExecutionTier execution_tier() const { return execution_tier_; }
 
diff --git a/deps/v8/test/common/wasm/wasm-macro-gen.h b/deps/v8/test/common/wasm/wasm-macro-gen.h
index 1da88a406a1..32088dae084 100644
--- a/deps/v8/test/common/wasm/wasm-macro-gen.h
+++ b/deps/v8/test/common/wasm/wasm-macro-gen.h
@@ -89,10 +89,15 @@
 #define WASM_BLOCK_F(...) kExprBlock, kLocalF32, __VA_ARGS__, kExprEnd
 #define WASM_BLOCK_D(...) kExprBlock, kLocalF64, __VA_ARGS__, kExprEnd
 
+#define TYPE_IMM(t) \
+  static_cast<byte>((t).value_type_code()), U32V_1((t).ref_index())
+
 #define WASM_BLOCK_T(t, ...) \
   kExprBlock, static_cast<byte>((t).value_type_code()), __VA_ARGS__, kExprEnd
 
-#define WASM_BLOCK_X(index, ...)                                  \
+#define WASM_BLOCK_R(t, ...) kExprBlock, TYPE_IMM(t), __VA_ARGS__, kExprEnd
+
+#define WASM_BLOCK_X(index, ...) \
   kExprBlock, static_cast<byte>(index), __VA_ARGS__, kExprEnd
 
 #define WASM_INFINITE_LOOP kExprLoop, kLocalVoid, kExprBr, DEPTH_0, kExprEnd
@@ -106,7 +111,9 @@
 #define WASM_LOOP_T(t, ...) \
   kExprLoop, static_cast<byte>((t).value_type_code()), __VA_ARGS__, kExprEnd
 
-#define WASM_LOOP_X(index, ...)                                   \
+#define WASM_LOOP_R(t, ...) kExprLoop, TYPE_IMM(t), __VA_ARGS__, kExprEnd
+
+#define WASM_LOOP_X(index, ...) \
   kExprLoop, static_cast<byte>(index), __VA_ARGS__, kExprEnd
 
 #define WASM_IF(cond, ...) cond, kExprIf, kLocalVoid, __VA_ARGS__, kExprEnd
@@ -114,6 +121,9 @@
 #define WASM_IF_T(t, cond, ...) \
   cond, kExprIf, static_cast<byte>((t).value_type_code()), __VA_ARGS__, kExprEnd
 
+#define WASM_IF_R(t, cond, ...) \
+  cond, kExprIf, TYPE_IMM(t), __VA_ARGS__, kExprEnd
+
 #define WASM_IF_X(index, cond, ...)                                   \
   cond, kExprIf, static_cast<byte>(index), __VA_ARGS__, kExprEnd
 
@@ -133,12 +143,17 @@
   cond, kExprIf, static_cast<byte>((t).value_type_code()), tstmt, kExprElse, \
       fstmt, kExprEnd
 
+#define WASM_IF_ELSE_R(t, cond, tstmt, fstmt) \
+  cond, kExprIf, TYPE_IMM(t), tstmt, kExprElse, fstmt, kExprEnd
+
 #define WASM_IF_ELSE_X(index, cond, tstmt, fstmt)                            \
   cond, kExprIf, static_cast<byte>(index), tstmt, kExprElse, fstmt, kExprEnd
 
 #define WASM_TRY_CATCH_T(t, trystmt, catchstmt)                            \
   kExprTry, static_cast<byte>((t).value_type_code()), trystmt, kExprCatch, \
       catchstmt, kExprEnd
+#define WASM_TRY_CATCH_R(t, trystmt, catchstmt) \
+  kExprTry, TYPE_IMM(t), trystmt, kExprCatch, catchstmt, kExprEnd
 
 #define WASM_SELECT(tval, fval, cond) tval, fval, cond, kExprSelect
 #define WASM_SELECT_I(tval, fval, cond) \
@@ -358,10 +373,6 @@ inline WasmOpcode LoadStoreOpcodeOf(MachineType type, bool store) {
       static_cast<byte>(bit_cast<uint64_t>(static_cast<double>(val)) >> 48), \
       static_cast<byte>(bit_cast<uint64_t>(static_cast<double>(val)) >> 56)
 
-#define WASM_REF_NULL kExprRefNull
-#define WASM_REF_FUNC(val) kExprRefFunc, val
-#define WASM_REF_IS_NULL(val) val, kExprRefIsNull
-
 #define WASM_GET_LOCAL(index) kExprLocalGet, static_cast<byte>(index)
 #define WASM_SET_LOCAL(index, val) val, kExprLocalSet, static_cast<byte>(index)
 #define WASM_TEE_LOCAL(index, val) val, kExprLocalTee, static_cast<byte>(index)
@@ -409,6 +420,35 @@ inline WasmOpcode LoadStoreOpcodeOf(MachineType type, bool store) {
 
 #define TABLE_ZERO 0
 
+//------------------------------------------------------------------------------
+// Heap-allocated object operations.
+//------------------------------------------------------------------------------
+#define WASM_GC_OP(op) kGCPrefix, static_cast<byte>(op)
+#define WASM_STRUCT_NEW(index, ...) \
+  __VA_ARGS__, WASM_GC_OP(kExprStructNew), static_cast<byte>(index)
+#define WASM_STRUCT_GET(typeidx, fieldidx, struct_obj)                \
+  struct_obj, WASM_GC_OP(kExprStructGet), static_cast<byte>(typeidx), \
+      static_cast<byte>(fieldidx)
+#define WASM_STRUCT_SET(typeidx, fieldidx, struct_obj, value)                \
+  struct_obj, value, WASM_GC_OP(kExprStructSet), static_cast<byte>(typeidx), \
+      static_cast<byte>(fieldidx)
+#define WASM_REF_NULL kExprRefNull
+#define WASM_REF_FUNC(val) kExprRefFunc, val
+#define WASM_REF_IS_NULL(val) val, kExprRefIsNull
+#define WASM_REF_AS_NON_NULL(val) val, kExprRefAsNonNull
+#define WASM_REF_EQ(lhs, rhs) lhs, rhs, kExprRefEq
+
+#define WASM_ARRAY_NEW(index, default_value, length) \
+  default_value, length, WASM_GC_OP(kExprArrayNew), static_cast<byte>(index)
+#define WASM_ARRAY_GET(typeidx, array, index) \
+  array, index, WASM_GC_OP(kExprArrayGet), static_cast<byte>(typeidx)
+#define WASM_ARRAY_SET(typeidx, array, index, value) \
+  array, index, value, WASM_GC_OP(kExprArraySet), static_cast<byte>(typeidx)
+#define WASM_ARRAY_LEN(typeidx, array) \
+  array, WASM_GC_OP(kExprArrayLen), static_cast<byte>(typeidx)
+
+#define WASM_BR_ON_NULL(depth, ref_object) \
+  ref_object, kExprBrOnNull, static_cast<byte>(depth)
 // Pass: sig_index, ...args, func_index
 #define WASM_CALL_INDIRECT(sig_index, ...) \
   __VA_ARGS__, kExprCallIndirect, static_cast<byte>(sig_index), TABLE_ZERO
@@ -418,6 +458,23 @@ inline WasmOpcode LoadStoreOpcodeOf(MachineType type, bool store) {
 #define WASM_RETURN_CALL_INDIRECT(sig_index, ...) \
   __VA_ARGS__, kExprReturnCallIndirect, static_cast<byte>(sig_index), TABLE_ZERO
 
+#define WASM_REF_TYPE(typeidx) kLocalRef, U32V_1(typeidx)
+
+// shift locals by 1; let (locals[0]: local_type) = value in ...
+#define WASM_LET_1_V(local_type, value, ...)                                  \
+  value, kExprLet, kLocalVoid, U32V_1(1), U32V_1(1), local_type, __VA_ARGS__, \
+      kExprEnd
+#define WASM_LET_1_I(local_type, value, ...)                                 \
+  value, kExprLet, kLocalI32, U32V_1(1), U32V_1(1), local_type, __VA_ARGS__, \
+      kExprEnd
+// shift locals by 2;
+// let (locals[0]: local_type_1) = value_1,
+//     (locals[1]: local_type_2) = value_2
+// in ...
+#define WASM_LET_2_I(local_type_1, value_1, local_type_2, value_2, ...)      \
+  value_1, value_2, kExprLet, kLocalI32, U32V_1(2), U32V_1(1), local_type_1, \
+      U32V_1(1), local_type_2, __VA_ARGS__, kExprEnd
+
 #define WASM_NOT(x) x, kExprI32Eqz
 #define WASM_SEQ(...) __VA_ARGS__
 
@@ -686,7 +743,7 @@ inline WasmOpcode LoadStoreOpcodeOf(MachineType type, bool store) {
 #define WASM_ATOMICS_FENCE WASM_ATOMICS_OP(kExprAtomicFence), ZERO_OFFSET
 
 //------------------------------------------------------------------------------
-// Sign Externsion Operations.
+// Sign Extension Operations.
 //------------------------------------------------------------------------------
 #define WASM_I32_SIGN_EXT_I8(x) x, kExprI32SExtendI8
 #define WASM_I32_SIGN_EXT_I16(x) x, kExprI32SExtendI16
@@ -694,6 +751,92 @@ inline WasmOpcode LoadStoreOpcodeOf(MachineType type, bool store) {
 #define WASM_I64_SIGN_EXT_I16(x) x, kExprI64SExtendI16
 #define WASM_I64_SIGN_EXT_I32(x) x, kExprI64SExtendI32
 
+//------------------------------------------------------------------------------
+// SIMD Operations.
+//------------------------------------------------------------------------------
+#define TO_BYTE(val) static_cast<byte>(val)
+// Encode all simd ops as a 2-byte LEB.
+#define WASM_SIMD_OP(op) kSimdPrefix, U32V_2(op & 0xff)
+#define WASM_SIMD_SPLAT(Type, ...) __VA_ARGS__, WASM_SIMD_OP(kExpr##Type##Splat)
+#define WASM_SIMD_UNOP(op, x) x, WASM_SIMD_OP(op)
+#define WASM_SIMD_BINOP(op, x, y) x, y, WASM_SIMD_OP(op)
+#define WASM_SIMD_SHIFT_OP(op, x, y) x, y, WASM_SIMD_OP(op)
+#define WASM_SIMD_CONCAT_OP(op, bytes, x, y) \
+  x, y, WASM_SIMD_OP(op), TO_BYTE(bytes)
+#define WASM_SIMD_SELECT(format, x, y, z) x, y, z, WASM_SIMD_OP(kExprS128Select)
+
+#define WASM_SIMD_F64x2_SPLAT(x) WASM_SIMD_SPLAT(F64x2, x)
+#define WASM_SIMD_F64x2_EXTRACT_LANE(lane, x) \
+  x, WASM_SIMD_OP(kExprF64x2ExtractLane), TO_BYTE(lane)
+#define WASM_SIMD_F64x2_REPLACE_LANE(lane, x, y) \
+  x, y, WASM_SIMD_OP(kExprF64x2ReplaceLane), TO_BYTE(lane)
+
+#define WASM_SIMD_F32x4_SPLAT(x) WASM_SIMD_SPLAT(F32x4, x)
+#define WASM_SIMD_F32x4_EXTRACT_LANE(lane, x) \
+  x, WASM_SIMD_OP(kExprF32x4ExtractLane), TO_BYTE(lane)
+#define WASM_SIMD_F32x4_REPLACE_LANE(lane, x, y) \
+  x, y, WASM_SIMD_OP(kExprF32x4ReplaceLane), TO_BYTE(lane)
+
+#define WASM_SIMD_I64x2_SPLAT(x) WASM_SIMD_SPLAT(I64x2, x)
+#define WASM_SIMD_I64x2_EXTRACT_LANE(lane, x) \
+  x, WASM_SIMD_OP(kExprI64x2ExtractLane), TO_BYTE(lane)
+#define WASM_SIMD_I64x2_REPLACE_LANE(lane, x, y) \
+  x, y, WASM_SIMD_OP(kExprI64x2ReplaceLane), TO_BYTE(lane)
+
+#define WASM_SIMD_I32x4_SPLAT(x) WASM_SIMD_SPLAT(I32x4, x)
+#define WASM_SIMD_I32x4_EXTRACT_LANE(lane, x) \
+  x, WASM_SIMD_OP(kExprI32x4ExtractLane), TO_BYTE(lane)
+#define WASM_SIMD_I32x4_REPLACE_LANE(lane, x, y) \
+  x, y, WASM_SIMD_OP(kExprI32x4ReplaceLane), TO_BYTE(lane)
+
+#define WASM_SIMD_I16x8_SPLAT(x) WASM_SIMD_SPLAT(I16x8, x)
+#define WASM_SIMD_I16x8_EXTRACT_LANE(lane, x) \
+  x, WASM_SIMD_OP(kExprI16x8ExtractLaneS), TO_BYTE(lane)
+#define WASM_SIMD_I16x8_EXTRACT_LANE_U(lane, x) \
+  x, WASM_SIMD_OP(kExprI16x8ExtractLaneU), TO_BYTE(lane)
+#define WASM_SIMD_I16x8_REPLACE_LANE(lane, x, y) \
+  x, y, WASM_SIMD_OP(kExprI16x8ReplaceLane), TO_BYTE(lane)
+
+#define WASM_SIMD_I8x16_SPLAT(x) WASM_SIMD_SPLAT(I8x16, x)
+#define WASM_SIMD_I8x16_EXTRACT_LANE(lane, x) \
+  x, WASM_SIMD_OP(kExprI8x16ExtractLaneS), TO_BYTE(lane)
+#define WASM_SIMD_I8x16_EXTRACT_LANE_U(lane, x) \
+  x, WASM_SIMD_OP(kExprI8x16ExtractLaneU), TO_BYTE(lane)
+#define WASM_SIMD_I8x16_REPLACE_LANE(lane, x, y) \
+  x, y, WASM_SIMD_OP(kExprI8x16ReplaceLane), TO_BYTE(lane)
+
+#define WASM_SIMD_S8x16_SHUFFLE_OP(opcode, m, x, y)                        \
+  x, y, WASM_SIMD_OP(opcode), TO_BYTE(m[0]), TO_BYTE(m[1]), TO_BYTE(m[2]), \
+      TO_BYTE(m[3]), TO_BYTE(m[4]), TO_BYTE(m[5]), TO_BYTE(m[6]),          \
+      TO_BYTE(m[7]), TO_BYTE(m[8]), TO_BYTE(m[9]), TO_BYTE(m[10]),         \
+      TO_BYTE(m[11]), TO_BYTE(m[12]), TO_BYTE(m[13]), TO_BYTE(m[14]),      \
+      TO_BYTE(m[15])
+
+#define WASM_SIMD_LOAD_MEM(index) \
+  index, WASM_SIMD_OP(kExprS128LoadMem), ZERO_ALIGNMENT, ZERO_OFFSET
+#define WASM_SIMD_LOAD_MEM_OFFSET(offset, index) \
+  index, WASM_SIMD_OP(kExprS128LoadMem), ZERO_ALIGNMENT, offset
+#define WASM_SIMD_STORE_MEM(index, val) \
+  index, val, WASM_SIMD_OP(kExprS128StoreMem), ZERO_ALIGNMENT, ZERO_OFFSET
+#define WASM_SIMD_STORE_MEM_OFFSET(offset, index, val) \
+  index, val, WASM_SIMD_OP(kExprS128StoreMem), ZERO_ALIGNMENT, offset
+
+#define WASM_SIMD_F64x2_QFMA(a, b, c) a, b, c, WASM_SIMD_OP(kExprF64x2Qfma)
+#define WASM_SIMD_F64x2_QFMS(a, b, c) a, b, c, WASM_SIMD_OP(kExprF64x2Qfms)
+#define WASM_SIMD_F32x4_QFMA(a, b, c) a, b, c, WASM_SIMD_OP(kExprF32x4Qfma)
+#define WASM_SIMD_F32x4_QFMS(a, b, c) a, b, c, WASM_SIMD_OP(kExprF32x4Qfms)
+
+#define WASM_SIMD_LOAD_SPLAT(opcode, index) \
+  index, WASM_SIMD_OP(opcode), ZERO_ALIGNMENT, ZERO_OFFSET
+#define WASM_SIMD_LOAD_SPLAT_OFFSET(opcode, index, offset) \
+  index, WASM_SIMD_OP(opcode), ZERO_ALIGNMENT, offset
+#define WASM_SIMD_LOAD_EXTEND(opcode, index) \
+  index, WASM_SIMD_OP(opcode), ZERO_ALIGNMENT, ZERO_OFFSET
+#define WASM_SIMD_LOAD_EXTEND_OFFSET(opcode, index, offset) \
+  index, WASM_SIMD_OP(opcode), ZERO_ALIGNMENT, offset
+#define WASM_SIMD_LOAD_EXTEND_ALIGNMENT(opcode, index, alignment) \
+  index, WASM_SIMD_OP(opcode), alignment, ZERO_OFFSET
+
 //------------------------------------------------------------------------------
 // Compilation Hints.
 //------------------------------------------------------------------------------
@@ -701,12 +844,10 @@ inline WasmOpcode LoadStoreOpcodeOf(MachineType type, bool store) {
 #define COMPILE_STRATEGY_LAZY (0x01)
 #define COMPILE_STRATEGY_EAGER (0x02)
 #define BASELINE_TIER_DEFAULT (0x00 << 2)
-#define BASELINE_TIER_INTERPRETER (0x01 << 2)
-#define BASELINE_TIER_BASELINE (0x02 << 2)
-#define BASELINE_TIER_OPTIMIZED (0x03 << 2)
+#define BASELINE_TIER_BASELINE (0x01 << 2)
+#define BASELINE_TIER_OPTIMIZED (0x02 << 2)
 #define TOP_TIER_DEFAULT (0x00 << 4)
-#define TOP_TIER_INTERPRETER (0x01 << 4)
-#define TOP_TIER_BASELINE (0x02 << 4)
-#define TOP_TIER_OPTIMIZED (0x03 << 4)
+#define TOP_TIER_BASELINE (0x01 << 4)
+#define TOP_TIER_OPTIMIZED (0x02 << 4)
 
 #endif  // V8_WASM_MACRO_GEN_H_
diff --git a/deps/v8/test/common/wasm/wasm-module-runner.cc b/deps/v8/test/common/wasm/wasm-module-runner.cc
index 067188bba0a..e6e95df5d58 100644
--- a/deps/v8/test/common/wasm/wasm-module-runner.cc
+++ b/deps/v8/test/common/wasm/wasm-module-runner.cc
@@ -106,9 +106,14 @@ bool InterpretWasmModuleForTesting(Isolate* isolate,
       case ValueType::kFuncRef:
       case ValueType::kNullRef:
       case ValueType::kExnRef:
+      case ValueType::kRef:
+      case ValueType::kOptRef:
+      case ValueType::kEqRef:
         arguments[i] =
             WasmValue(Handle<Object>::cast(isolate->factory()->null_value()));
         break;
+      case ValueType::kI8:
+      case ValueType::kI16:
       case ValueType::kStmt:
       case ValueType::kBottom:
       case ValueType::kS128:
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-patch-positions-replace.js b/deps/v8/test/debugger/debug/debug-liveedit-patch-positions-replace.js
index 21d2d36f6a2..edb086c805b 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-patch-positions-replace.js
+++ b/deps/v8/test/debugger/debug/debug-liveedit-patch-positions-replace.js
@@ -65,7 +65,7 @@ function CallM(changer) {
 }
 
 // This several iterations should cause call IC for BeingReplaced call. This IC
-// will keep reference to code object of BeingRepalced function. This reference
+// will keep reference to code object of BeingReplaced function. This reference
 // should also be patched. Unfortunately, this is a manually checked fact (from
 // debugger or debug print) and doesn't work as an automatic test.
 CallM(NoOp);
diff --git a/deps/v8/test/debugger/debug/es6/debug-promises/promise-any-caught.js b/deps/v8/test/debugger/debug/es6/debug-promises/promise-any-caught.js
new file mode 100644
index 00000000000..a5df680d687
--- /dev/null
+++ b/deps/v8/test/debugger/debug/es6/debug-promises/promise-any-caught.js
@@ -0,0 +1,39 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --harmony-promise-any
+
+// Test debug events when we only listen to uncaught exceptions and a
+// Promise p3 created by Promise.any has a catch handler, and is rejected
+// because the Promise p2 passed to Promise.any is rejected. We
+// expect no Exception debug event to be triggered, since p3 and by
+// extension p2 have a catch handler.
+
+let Debug = debug.Debug;
+
+let expected_events = 2;
+
+let p1 = Promise.resolve();
+p1.name = "p1";
+
+let p2 = p1.then(function() {
+  throw new Error("caught");
+});
+p2.name = "p2";
+
+let p3 = Promise.any([p2]);
+p3.name = "p3";
+
+p3.catch(function(e) {});
+
+function listener(event, exec_state, event_data, data) {
+  try {
+    assertTrue(event != Debug.DebugEvent.Exception)
+  } catch (e) {
+    %AbortJS(e + "\n" + e.stack);
+  }
+}
+
+Debug.setBreakOnUncaughtException();
+Debug.setListener(listener);
diff --git a/deps/v8/test/debugger/debug/es6/debug-promises/promise-any-uncaught.js b/deps/v8/test/debugger/debug/es6/debug-promises/promise-any-uncaught.js
new file mode 100644
index 00000000000..a7bb0ad70a6
--- /dev/null
+++ b/deps/v8/test/debugger/debug/es6/debug-promises/promise-any-uncaught.js
@@ -0,0 +1,67 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --harmony-promise-any
+
+// Test debug events when we only listen to uncaught exceptions and a
+// Promise p3 created by Promise.any has no catch handler, and is rejected
+// because the Promise p2 passed to Promise.any is rejected.
+// We expect one event for p2; the system recognizes the rejection of p3
+// to be redundant and based on the rejection of p2 and does not trigger
+// an additional rejection.
+
+let Debug = debug.Debug;
+
+let expected_events = 1;
+let log = [];
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Exception) return;
+  try {
+    expected_events--;
+    assertTrue(expected_events >= 0);
+    assertEquals("uncaught", event_data.exception().message);
+    // Assert that the debug event is triggered at the throw site.
+    assertTrue(exec_state.frame(0).sourceLineText().indexOf("// event") > 0);
+    assertTrue(event_data.uncaught());
+  } catch (e) {
+    %AbortJS(e + "\n" + e.stack);
+  }
+}
+
+Debug.setBreakOnUncaughtException();
+Debug.setListener(listener);
+
+let p1 = Promise.resolve();
+p1.name = "p1";
+
+let p2 = p1.then(function() {
+  log.push("throw");
+  throw new Error("uncaught");  // event
+});
+p2.name = "p2";
+
+let p3 = Promise.any([p2]);
+p3.name = "p3";
+
+log.push("end main");
+
+function testDone(iteration) {
+  function checkResult() {
+    try {
+      assertTrue(iteration < 10);
+      if (expected_events === 0) {
+        assertEquals(["end main", "throw"], log);
+      } else {
+        testDone(iteration + 1);
+      }
+    } catch (e) {
+      %AbortJS(e + "\n" + e.stack);
+    }
+  }
+
+  %EnqueueMicrotask(checkResult);
+}
+
+testDone(0);
diff --git a/deps/v8/test/debugger/debug/regress/regress-10319.js b/deps/v8/test/debugger/debug/regress/regress-10319.js
new file mode 100644
index 00000000000..7ab901958d2
--- /dev/null
+++ b/deps/v8/test/debugger/debug/regress/regress-10319.js
@@ -0,0 +1,46 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var Debug = debug.Debug;
+
+var frame;
+
+Debug.setListener(function (event, exec_state, event_data, data) {
+  if (event == Debug.DebugEvent.Break) {
+    frame = exec_state.frame(0);
+
+    // Try changing the value, which hasn't yet been initialized.
+    assertEquals(3, frame.evaluate("result = 3").value());
+    assertEquals(3, frame.evaluate("result").value());
+  }
+});
+
+function makeCounter() {
+  // If the variable `result` were stack-allocated, it would be 3 at this point
+  // due to the debugging activity during function entry. However, for a
+  // heap-allocated variable, the debugger evaluated `result = 3` in a temporary
+  // scope instead and had no effect on this variable.
+  assertEquals(undefined, result);
+
+  var result = 0;
+
+  // Regardless of how `result` is allocated, it should now be initialized.
+  assertEquals(0, result);
+
+  // Close over `result` to cause it to be heap-allocated.
+  return () => ++result;
+}
+
+// Break on entry to a function which includes heap-allocated variables.
+%ScheduleBreak();
+makeCounter();
+
+// Check the frame state which was collected during the breakpoint.
+assertEquals(1, frame.localCount());
+assertEquals('result', frame.localName(0));
+assertEquals(undefined, frame.localValue(0).value());
+assertEquals(3, frame.scopeCount());
+assertEquals(debug.ScopeType.Local, frame.scope(0).scopeType());
+assertEquals(debug.ScopeType.Script, frame.scope(1).scopeType());
+assertEquals(debug.ScopeType.Global, frame.scope(2).scopeType());
diff --git a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins.js
index 29d8145b3c6..82c7b1082e5 100644
--- a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins.js
+++ b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins.js
@@ -144,12 +144,13 @@ function listener(event, exec_state, event_data, data) {
 
     // Test Math functions.
     for (f of Object.getOwnPropertyNames(Math)) {
-      if (typeof Math[f] === "function") {
+      if (f !== "random" && typeof Math[f] === "function") {
         var result = exec_state.frame(0).evaluate(
                          `Math.${f}(0.5, -0.5);`, true).value();
-        if (f != "random") assertEquals(Math[f](0.5, -0.5), result);
+        assertEquals(Math[f](0.5, -0.5), result);
       }
     }
+    fail("Math.random();");
 
     // Test Number functions.
     success(new Number(0), `new Number()`);
@@ -184,7 +185,7 @@ function listener(event, exec_state, event_data, data) {
         if (f == "match") continue;
         if (f == "matchAll") continue;
         if (f == "search") continue;
-        if (f == "split" || f == "replace") {
+        if (f == "split" || f == "replace" || f == "replaceAll") {
           fail(`'abcd'.${f}(2)`);
           continue;
         }
diff --git a/deps/v8/test/debugger/debug/wasm/debug-enabled-tier-down-wasm-streaming.js b/deps/v8/test/debugger/debug/wasm/debug-enabled-tier-down-wasm-streaming.js
new file mode 100644
index 00000000000..4f4784dee64
--- /dev/null
+++ b/deps/v8/test/debugger/debug/wasm/debug-enabled-tier-down-wasm-streaming.js
@@ -0,0 +1,7 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-test-streaming
+
+load('test/debugger/debug/wasm/debug-enabled-tier-down-wasm.js');
diff --git a/deps/v8/test/debugger/debug/wasm/debug-enabled-tier-down-wasm-unsupported-liftoff.js b/deps/v8/test/debugger/debug/wasm/debug-enabled-tier-down-wasm-unsupported-liftoff.js
index e7ba10349c5..686aea16b18 100644
--- a/deps/v8/test/debugger/debug/wasm/debug-enabled-tier-down-wasm-unsupported-liftoff.js
+++ b/deps/v8/test/debugger/debug/wasm/debug-enabled-tier-down-wasm-unsupported-liftoff.js
@@ -4,7 +4,10 @@
 
 // Flags: --experimental-wasm-anyref
 
-load("test/mjsunit/wasm/wasm-module-builder.js");
+// Test that tiering up and tiering down works even if functions cannot be
+// compiled with Liftoff.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
 
 // Create a simple Wasm module.
 function create_builder(i) {
diff --git a/deps/v8/test/debugger/debug/wasm/debug-enabled-tier-down-wasm.js b/deps/v8/test/debugger/debug/wasm/debug-enabled-tier-down-wasm.js
index 20dc1e1c5ee..312ae47e7f3 100644
--- a/deps/v8/test/debugger/debug/wasm/debug-enabled-tier-down-wasm.js
+++ b/deps/v8/test/debugger/debug/wasm/debug-enabled-tier-down-wasm.js
@@ -6,7 +6,7 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
 
 const num_functions = 200;
 
-// Create a simple Wasm script.
+// Create a simple Wasm module.
 function create_builder(delta = 0) {
   const builder = new WasmModuleBuilder();
   for (let i = 0; i < num_functions; ++i) {
@@ -23,7 +23,7 @@ function checkTieredDown(instance) {
   }
 }
 
-function checkTieredUp(instance) {
+function waitForTieredUp(instance) {
   // Busy waiting until all functions are tiered up.
   let num_liftoff_functions = 0;
   while (true) {
@@ -37,26 +37,39 @@ function checkTieredUp(instance) {
   }
 }
 
-const instance = create_builder().instantiate();
 const Debug = new DebugWrapper();
-Debug.enable();
-checkTieredDown(instance);
-const newInstance = create_builder(num_functions*2).instantiate();
-checkTieredDown(newInstance);
-Debug.disable();
-checkTieredUp(instance);
-checkTieredUp(newInstance);
-
-// Async.
-async function testTierDownToLiftoffAsync() {
-  const asyncInstance = await create_builder(num_functions).asyncInstantiate();
+
+(function testTierDownToLiftoff() {
+  // In the 'isolates' test, this test runs in parallel to itself on two
+  // isolates. All checks below should still hold.
+  const instance = create_builder(0).instantiate();
   Debug.enable();
-  checkTieredDown(asyncInstance);
-  const newAsyncInstance = await create_builder(num_functions*3).asyncInstantiate();
-  checkTieredDown(newAsyncInstance);
+  checkTieredDown(instance);
+  const instance2 = create_builder(1).instantiate();
+  checkTieredDown(instance2);
   Debug.disable();
-  checkTieredUp(asyncInstance);
-  checkTieredUp(newAsyncInstance);
-}
+  // Eventually the instances will be completely tiered up again.
+  waitForTieredUp(instance);
+  waitForTieredUp(instance2);
+})();
 
-assertPromiseResult(testTierDownToLiftoffAsync());
+// Test async compilation.
+assertPromiseResult((async function testTierDownToLiftoffAsync() {
+  // First test: enable the debugger *after* compiling the module.
+  const instance = await create_builder(2).asyncInstantiate();
+  Debug.enable();
+  checkTieredDown(instance);
+  const instance2 = await create_builder(3).asyncInstantiate();
+  checkTieredDown(instance2);
+  Debug.disable();
+  waitForTieredUp(instance);
+  waitForTieredUp(instance2);
+
+  // Second test: enable the debugger *while* compiling the module.
+  const instancePromise = create_builder(4).asyncInstantiate();
+  Debug.enable();
+  const instance3 = await instancePromise;
+  checkTieredDown(instance3);
+  Debug.disable();
+  waitForTieredUp(instance3);
+})());
diff --git a/deps/v8/test/debugger/debug/wasm/debug-step-into-wasm.js b/deps/v8/test/debugger/debug/wasm/debug-step-into-wasm.js
index 71ae2a61e72..8454c246689 100644
--- a/deps/v8/test/debugger/debug/wasm/debug-step-into-wasm.js
+++ b/deps/v8/test/debugger/debug/wasm/debug-step-into-wasm.js
@@ -85,8 +85,8 @@ Debug.setListener(listener2);
 f();
 Debug.setListener(null);
 
-assertEquals(break_count, 3);
-assertEquals(js_break_line, 3);
-assertEquals(wasm_break_count, 4);
-assertEquals(break_count2, 2);
+assertEquals(3, break_count);
+assertEquals(3, js_break_line);
+assertEquals(4, wasm_break_count);
+assertEquals(2, break_count2);
 assertNull(exception);
diff --git a/deps/v8/test/debugger/debug/wasm/stepping-from-js.js b/deps/v8/test/debugger/debug/wasm/stepping-from-js.js
new file mode 100644
index 00000000000..6d2d5e4ef44
--- /dev/null
+++ b/deps/v8/test/debugger/debug/wasm/stepping-from-js.js
@@ -0,0 +1,68 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test stepping from JS through Wasm.
+// A similar test exists as an inspector test already, but inspector tests are
+// not run concurrently in multiple isolates (see `run-tests.py --isolates`).
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+const imp_fun = builder.addImport('imp', 'ort', kSig_i_v);
+const sub_fun = builder.addFunction('sub', kSig_i_ii).addBody([
+  kExprLocalGet, 0,  // local.get i0
+  kExprLocalGet, 1,  // local.get i1
+  kExprI32Sub        // i32.sub i0 i1
+]);
+builder.addFunction('main', kSig_i_v)
+    .addBody([
+      kExprCallFunction, imp_fun,       // call import
+      kExprI32Const, 3,                 // i32.const 3
+      kExprCallFunction, sub_fun.index  // call 'sub'
+    ])
+    .exportFunc();
+// Compute the line number of the 'imported' function (to avoid hard-coding it).
+const import_line_nr = parseInt((new Error()).stack.match(/:([0-9]+):/)[1]) + 1;
+function imported() {
+  debugger;
+  return 7;
+}
+const instance = builder.instantiate({imp: {ort: imported}});
+
+Debug = debug.Debug;
+
+const expected_breaks = [
+  `imported:${import_line_nr + 1}:2`,   // debugger;
+  `imported:${import_line_nr + 2}:2`,   // return 7;
+  `imported:${import_line_nr + 2}:11`,  // return 7;
+  'sub:1:58', 'sub:1:60', 'sub:1:62', 'sub:1:63', 'main:1:72'
+];
+let error;
+function onBreak(event, exec_state, data) {
+  try {
+    if (event != Debug.DebugEvent.Break) return;
+    if (error) return;
+    if (data.sourceLineText().indexOf('Main returned.') >= 0) {
+      assertEquals(0, expected_breaks.length, 'hit all expected breaks');
+      return;
+    }
+    const pos =
+        [data.functionName(), data.sourceLine(), data.sourceColumn()].join(':');
+    const loc = [pos, data.sourceLineText()].join(':');
+    print(`Break at ${loc}`);
+    assertTrue(expected_breaks.length > 0, 'expecting more breaks');
+    const expected_pos = expected_breaks.shift();
+    assertEquals(expected_pos, pos);
+    exec_state.prepareStep(Debug.StepAction.StepIn);
+  } catch (e) {
+    if (!error) error = e;
+  }
+}
+
+Debug.setListener(onBreak);
+print('Running main.');
+const result = instance.exports.main();
+print('Main returned.');
+if (error) throw error;
+assertEquals(4, result);
diff --git a/deps/v8/test/debugger/debugger.status b/deps/v8/test/debugger/debugger.status
index a10c503d740..115a6c7105f 100644
--- a/deps/v8/test/debugger/debugger.status
+++ b/deps/v8/test/debugger/debugger.status
@@ -42,6 +42,10 @@
 
   # Very slow in stress mode.
   'regress/regress-2318': [SKIP],
+
+  # Currently fails because breakpoint information is inconsistent after
+  # disabling and re-enabling the debugger (https://crbug.com/v8/10403).
+  'debug/wasm/debug-step-into-wasm': [SKIP],
 }],  # variant == stress
 
 ##############################################################################
@@ -50,12 +54,6 @@
   'debug/debug-stepout-scope-part*': [SKIP],
 }],  # variant == stress and (arch == arm or arch == arm64) and simulator_run
 
-##############################################################################
-['variant == stress_incremental_marking', {
-  # BUG(chromium:772010).
-  'debug/debug-*': [PASS, ['system == windows', SKIP]],
-}],  # variant == stress_incremental_marking
-
 ##############################################################################
 ['gc_stress == True', {
   # Skip tests not suitable for GC stress.
@@ -88,6 +86,11 @@
   # https://crbug.com/v8/8147
   'debug/debug-liveedit-*': [SKIP],
   'debug/debug-set-variable-value': [SKIP],
+
+  # Rely on (blocking) concurrent compilation.
+  'debug/regress/regress-opt-after-debug-deopt': [SKIP],
+  'debug/regress/regress-prepare-break-while-recompile': [SKIP],
+  'regress/regress-7421': [SKIP],
 }],  # 'predictable == True'
 
 ##############################################################################
@@ -143,21 +146,12 @@
 ['arch in (s390, s390x, ppc, ppc64)', {
   'regress/regress-crbug-1032042': [SKIP],
   'regress/regress-crbug-840288': [SKIP],
-  'debug/wasm/asm-debug': [SKIP],
-  'debug/wasm/debug-enabled-tier-down-wasm': [SKIP],
-  'debug/wasm/debug-step-into-wasm': [SKIP],
-  'debug/wasm/frame-inspection': [SKIP],
+  'debug/wasm/*': [SKIP],
 }],
 
-##############################################################################
-['isolates', {
-  # WebAssembly debugging does not work reliably when multiple isolates are
-  # involved (https://crbug.com/v8/10359).
-  # (this list might need to be extended by more debugging tests as they
-  # start flaking)
-  'debug/wasm/debug-enabled-tier-down-wasm': [SKIP],
-  'debug/wasm/debug-enabled-tier-down-wasm-unsupported-liftoff': [SKIP],
-  'regress/regress-crbug-1032042': [SKIP],
-}],  # 'isolates'
+################################################################################
+['variant == stress_snapshot', {
+  '*': [SKIP],  # only relevant for mjsunit tests.
+}],
 
 ]
diff --git a/deps/v8/test/debugging/debugging.status b/deps/v8/test/debugging/debugging.status
index b5ebc844742..7cbaca0e9ba 100644
--- a/deps/v8/test/debugging/debugging.status
+++ b/deps/v8/test/debugging/debugging.status
@@ -2,4 +2,11 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-[]
+[
+
+################################################################################
+['variant == stress_snapshot', {
+  '*': [SKIP],  # only relevant for mjsunit tests.
+}],
+
+]
diff --git a/deps/v8/test/debugging/testcfg.py b/deps/v8/test/debugging/testcfg.py
index 6f7fedb25be..1a212de9697 100644
--- a/deps/v8/test/debugging/testcfg.py
+++ b/deps/v8/test/debugging/testcfg.py
@@ -79,7 +79,8 @@ class PYTestLoader(testsuite.GenericTestLoader):
 
   @property
   def excluded_files(self):
-    return {'gdb_rsp.py', 'testcfg.py', '__init__.py'}
+    return {'gdb_rsp.py', 'testcfg.py', '__init__.py', 'test_basic.py',
+            'test_float.py', 'test_memory.py', 'test_trap.py'}
 
   @property
   def extensions(self):
diff --git a/deps/v8/test/debugging/wasm/gdb-server/OWNERS b/deps/v8/test/debugging/wasm/gdb-server/OWNERS
new file mode 100644
index 00000000000..4b8c1919e84
--- /dev/null
+++ b/deps/v8/test/debugging/wasm/gdb-server/OWNERS
@@ -0,0 +1,3 @@
+paolosev@microsoft.com
+
+# COMPONENT: Blink>JavaScript>WebAssembly
\ No newline at end of file
diff --git a/deps/v8/test/debugging/wasm/gdb-server/breakpoints.py b/deps/v8/test/debugging/wasm/gdb-server/breakpoints.py
new file mode 100644
index 00000000000..98fb192075e
--- /dev/null
+++ b/deps/v8/test/debugging/wasm/gdb-server/breakpoints.py
@@ -0,0 +1,58 @@
+# Copyright 2020 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Flags: -expose-wasm --wasm-gdb-remote --wasm-pause-waiting-for-debugger test/debugging/wasm/gdb-server/test_files/test_basic.js
+
+import sys
+import unittest
+
+import gdb_rsp
+import test_files.test_basic as test_basic
+
+class Tests(unittest.TestCase):
+  def test_initial_breakpoint(self):
+    # Testing that the debuggee suspends when the debugger attaches.
+    with gdb_rsp.LaunchDebugStub(COMMAND) as connection:
+      reply = connection.RspRequest('?')
+      gdb_rsp.AssertReplySignal(reply, gdb_rsp.SIGTRAP)
+
+  def test_setting_removing_breakpoint(self):
+    with gdb_rsp.LaunchDebugStub(COMMAND) as connection:
+      module_load_addr = gdb_rsp.GetLoadedModuleAddress(connection)
+      func_addr = module_load_addr + test_basic.BREAK_ADDRESS_1
+
+      # Set a breakpoint.
+      reply = connection.RspRequest('Z0,%x,1' % func_addr)
+      self.assertEqual(reply, 'OK')
+
+      # When we run the program, we should hit the breakpoint.
+      reply = connection.RspRequest('c')
+      gdb_rsp.AssertReplySignal(reply, gdb_rsp.SIGTRAP)
+      gdb_rsp.CheckInstructionPtr(connection, func_addr)
+
+      # Check that we can remove the breakpoint.
+      reply = connection.RspRequest('z0,%x,0' % func_addr)
+      self.assertEqual(reply, 'OK')
+      # Requesting removing a breakpoint on an address that does not
+      # have one should return an error.
+      reply = connection.RspRequest('z0,%x,0' % func_addr)
+      self.assertEqual(reply, 'E03')
+
+  def test_setting_breakpoint_on_invalid_address(self):
+    with gdb_rsp.LaunchDebugStub(COMMAND) as connection:
+      # Requesting a breakpoint on an invalid address should give an error.
+      reply = connection.RspRequest('Z0,%x,1' % (1 << 32))
+      self.assertEqual(reply, 'E03')
+
+
+def Main():
+  index = sys.argv.index('--')
+  args = sys.argv[index + 1:]
+  # The remaining arguments go to unittest.main().
+  global COMMAND
+  COMMAND = args
+  unittest.main(argv=sys.argv[:index])
+
+if __name__ == '__main__':
+  Main()
diff --git a/deps/v8/test/debugging/wasm/gdb-server/connect.py b/deps/v8/test/debugging/wasm/gdb-server/connect.py
index f2bac294254..9fd9628b5a6 100644
--- a/deps/v8/test/debugging/wasm/gdb-server/connect.py
+++ b/deps/v8/test/debugging/wasm/gdb-server/connect.py
@@ -1,24 +1,27 @@
-# Copyright 2019 the V8 project authors. All rights reserved.
+# Copyright 2020 the V8 project authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-# Flags: -expose-wasm --wasm_gdb_remote --wasm-pause-waiting-for-debugger --wasm-interpret-all test/debugging/wasm/gdb-server/test_files/test.js
+# Flags: -expose-wasm --wasm-gdb-remote --wasm-pause-waiting-for-debugger test/debugging/wasm/gdb-server/test_files/test_basic.js
 
+from ctypes import *
 import os
 import subprocess
 import unittest
 import sys
+
 import gdb_rsp
+import test_files.test_basic as test_basic
 
 # These are set up by Main().
 COMMAND = None
 
-
 class Tests(unittest.TestCase):
+
   def test_disconnect(self):
     process = gdb_rsp.PopenDebugStub(COMMAND)
     try:
-      # Connect and record the instruction pointer.
+      # Connect.
       connection = gdb_rsp.GdbRspConnection()
       connection.Close()
       # Reconnect 3 times.
@@ -28,6 +31,29 @@ def test_disconnect(self):
     finally:
       gdb_rsp.KillProcess(process)
 
+  def test_kill(self):
+    process = gdb_rsp.PopenDebugStub(COMMAND)
+    try:
+      connection = gdb_rsp.GdbRspConnection()
+      # Request killing the target.
+      reply = connection.RspRequest('k')
+      self.assertEqual(reply, 'OK')
+      signal = c_byte(process.wait()).value
+      self.assertEqual(signal, gdb_rsp.RETURNCODE_KILL)
+    finally:
+      gdb_rsp.KillProcess(process)
+
+  def test_detach(self):
+    process = gdb_rsp.PopenDebugStub(COMMAND)
+    try:
+      connection = gdb_rsp.GdbRspConnection()
+      # Request detaching from the target.
+      # This resumes execution, so we get the normal exit() status.
+      reply = connection.RspRequest('D')
+      self.assertEqual(reply, 'OK')
+    finally:
+      gdb_rsp.KillProcess(process)
+
 
 def Main():
   index = sys.argv.index('--')
diff --git a/deps/v8/test/debugging/wasm/gdb-server/float.py b/deps/v8/test/debugging/wasm/gdb-server/float.py
new file mode 100644
index 00000000000..fd732e32a5d
--- /dev/null
+++ b/deps/v8/test/debugging/wasm/gdb-server/float.py
@@ -0,0 +1,71 @@
+# Copyright 2020 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Flags: -expose-wasm --wasm-gdb-remote --wasm-pause-waiting-for-debugger test/debugging/wasm/gdb-server/test_files/test_float.js
+
+import os
+import re
+import struct
+import subprocess
+import sys
+import unittest
+
+import gdb_rsp
+import test_files.test_float as test_float
+
+# These are set up by Main().
+COMMAND = None
+
+class Tests(unittest.TestCase):
+
+  def RunToWasm(self, connection):
+    module_load_addr = gdb_rsp.GetLoadedModuleAddress(connection)
+    breakpoint_addr = module_load_addr + test_float.FUNC_START_ADDR
+
+    # Set a breakpoint.
+    reply = connection.RspRequest('Z0,%x,1' % breakpoint_addr)
+    self.assertEqual(reply, 'OK')
+
+    # When we run the program, we should hit the breakpoint.
+    reply = connection.RspRequest('c')
+    gdb_rsp.AssertReplySignal(reply, gdb_rsp.SIGTRAP)
+
+    # Remove the breakpoint.
+    reply = connection.RspRequest('z0,%x,1' % breakpoint_addr)
+    self.assertEqual(reply, 'OK')
+
+  def test_loaded_modules(self):
+    with gdb_rsp.LaunchDebugStub(COMMAND) as connection:
+      modules = gdb_rsp.GetLoadedModules(connection)
+      connection.Close()
+      assert(len(modules) > 0)
+
+  def test_wasm_local_float(self):
+    with gdb_rsp.LaunchDebugStub(COMMAND) as connection:
+      self.RunToWasm(connection)
+      module_load_addr = gdb_rsp.GetLoadedModuleAddress(connection)
+
+      reply = connection.RspRequest('qWasmLocal:0;0')
+      value = struct.unpack('f', gdb_rsp.DecodeHex(reply))[0]
+      self.assertEqual(test_float.ARG_0, value)
+
+      reply = connection.RspRequest('qWasmLocal:0;1')
+      value = struct.unpack('f', gdb_rsp.DecodeHex(reply))[0]
+      self.assertEqual(test_float.ARG_1, value)
+
+      # invalid local
+      reply = connection.RspRequest('qWasmLocal:0;9')
+      self.assertEqual("E03", reply)
+
+
+def Main():
+  index = sys.argv.index('--')
+  args = sys.argv[index + 1:]
+  # The remaining arguments go to unittest.main().
+  global COMMAND
+  COMMAND = args
+  unittest.main(argv=sys.argv[:index])
+
+if __name__ == '__main__':
+  Main()
diff --git a/deps/v8/test/debugging/wasm/gdb-server/gdb_rsp.py b/deps/v8/test/debugging/wasm/gdb-server/gdb_rsp.py
index 131725f83d1..f1981ed9a84 100644
--- a/deps/v8/test/debugging/wasm/gdb-server/gdb_rsp.py
+++ b/deps/v8/test/debugging/wasm/gdb-server/gdb_rsp.py
@@ -1,13 +1,25 @@
-# Copyright 2019 the V8 project authors. All rights reserved.
+# Copyright 2020 the V8 project authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import re
 import socket
+import struct
 import subprocess
 import time
+import xml.etree.ElementTree
 
 SOCKET_ADDR = ('localhost', 8765)
 
+SIGTRAP = 5
+SIGSEGV = 11
+RETURNCODE_KILL = -9
+
+ARCH = 'wasm32'
+REG_DEFS = {
+    ARCH: [('pc', 'Q'), ],
+}
+
 
 def EnsurePortIsAvailable(addr=SOCKET_ADDR):
   # As a sanity check, check that the TCP port is available by binding to it
@@ -21,6 +33,11 @@ def EnsurePortIsAvailable(addr=SOCKET_ADDR):
   sock.bind(addr)
   sock.close()
 
+def RspChecksum(data):
+  checksum = 0
+  for char in data:
+    checksum = (checksum + ord(char)) & 0xff
+  return checksum
 
 class GdbRspConnection(object):
 
@@ -48,6 +65,40 @@ def _Connect(self, addr):
     raise Exception('Could not connect to the debug stub in %i seconds'
                     % timeout_in_seconds)
 
+  def _GetReply(self):
+    reply = ''
+    message_finished = re.compile('#[0-9a-fA-F]{2}')
+    while True:
+      data = self._socket.recv(1024)
+      if len(data) == 0:
+        raise AssertionError('EOF on socket reached with '
+                             'incomplete reply message: %r' % reply)
+      reply += data
+      if message_finished.match(reply[-3:]):
+        break
+    match = re.match('\+?\$([^#]*)#([0-9a-fA-F]{2})$', reply)
+    if match is None:
+      raise AssertionError('Unexpected reply message: %r' % reply)
+    reply_body = match.group(1)
+    checksum = match.group(2)
+    expected_checksum = '%02x' % RspChecksum(reply_body)
+    if checksum != expected_checksum:
+      raise AssertionError('Bad RSP checksum: %r != %r' %
+                           (checksum, expected_checksum))
+    # Send acknowledgement.
+    self._socket.send('+')
+    return reply_body
+
+  # Send an rsp message, but don't wait for or expect a reply.
+  def RspSendOnly(self, data):
+    msg = '$%s#%02x' % (data, RspChecksum(data))
+    return self._socket.send(msg)
+
+  def RspRequest(self, data):
+    self.RspSendOnly(data)
+    reply = self._GetReply()
+    return reply
+
   def Close(self):
     self._socket.close()
 
@@ -71,3 +122,87 @@ def KillProcess(process):
     else:
       raise
   process.wait()
+
+
+class LaunchDebugStub(object):
+  def __init__(self, command):
+    self._proc = PopenDebugStub(command)
+
+  def __enter__(self):
+    try:
+      return GdbRspConnection()
+    except:
+      KillProcess(self._proc)
+      raise
+
+  def __exit__(self, exc_type, exc_value, traceback):
+    KillProcess(self._proc)
+
+
+def AssertEquals(x, y):
+  if x != y:
+    raise AssertionError('%r != %r' % (x, y))
+
+def DecodeHex(data):
+  assert len(data) % 2 == 0, data
+  return bytes(bytearray([int(data[index * 2 : (index + 1) * 2], 16) for index in xrange(len(data) // 2)]))
+
+def EncodeHex(data):
+  return ''.join('%02x' % ord(byte) for byte in data)
+
+def DecodeUInt64Array(data):
+  assert len(data) % 16 == 0, data
+  result = []
+  for index in xrange(len(data) // 16):
+    value = 0
+    for digit in xrange(7, -1, -1):
+      value = value * 256 + int(data[index * 16 + digit * 2 : index * 16 + (digit + 1) * 2], 16)
+    result.append(value)
+  return result
+
+def AssertReplySignal(reply, signal):
+  AssertEquals(ParseThreadStopReply(reply)['signal'], signal)
+
+def ParseThreadStopReply(reply):
+  match = re.match('T([0-9a-f]{2})thread-pcs:([0-9a-f]+);thread:([0-9a-f]+);$', reply)
+  if not match:
+    raise AssertionError('Bad thread stop reply: %r' % reply)
+  return {'signal': int(match.group(1), 16),
+          'thread_pc': int(match.group(2), 16),
+          'thread_id': int(match.group(3), 16)}
+
+def CheckInstructionPtr(connection, expected_ip):
+  ip_value = DecodeRegs(connection.RspRequest('g'))['pc']
+  AssertEquals(ip_value, expected_ip)
+
+def DecodeRegs(reply):
+  defs = REG_DEFS[ARCH]
+  names = [reg_name for reg_name, reg_fmt in defs]
+  fmt = ''.join([reg_fmt for reg_name, reg_fmt in defs])
+
+  values = struct.unpack_from(fmt, DecodeHex(reply))
+  return dict(zip(names, values))
+
+def GetLoadedModules(connection):
+  modules = {}
+  reply = connection.RspRequest('qXfer:libraries:read')
+  AssertEquals(reply[0], 'l')
+  library_list = xml.etree.ElementTree.fromstring(reply[1:])
+  AssertEquals(library_list.tag, 'library-list')
+  for library in library_list:
+    AssertEquals(library.tag, 'library')
+    section = library.find('section')
+    address = section.get('address')
+    assert long(address) > 0
+    modules[long(address)] = library.get('name')
+  return modules
+
+def GetLoadedModuleAddress(connection):
+  modules = GetLoadedModules(connection)
+  assert len(modules) > 0
+  return modules.keys()[0]
+
+def ReadCodeMemory(connection, address, size):
+  reply = connection.RspRequest('m%x,%x' % (address, size))
+  assert not reply.startswith('E'), reply
+  return DecodeHex(reply)
diff --git a/deps/v8/test/debugging/wasm/gdb-server/memory.py b/deps/v8/test/debugging/wasm/gdb-server/memory.py
new file mode 100644
index 00000000000..db102a71075
--- /dev/null
+++ b/deps/v8/test/debugging/wasm/gdb-server/memory.py
@@ -0,0 +1,96 @@
+# Copyright 2020 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Flags: -expose-wasm --wasm-gdb-remote --wasm-pause-waiting-for-debugger test/debugging/wasm/gdb-server/test_files/test_memory.js
+
+import struct
+import sys
+import unittest
+
+import gdb_rsp
+import test_files.test_memory as test_memory
+
+# These are set up by Main().
+COMMAND = None
+
+class Tests(unittest.TestCase):
+  # Test that reading from an unreadable address gives a sensible error.
+  def CheckReadMemoryAtInvalidAddr(self, connection):
+    mem_addr = 0xffffffff
+    result = connection.RspRequest('m%x,%x' % (mem_addr, 1))
+    self.assertEquals(result, 'E02')
+
+  def RunToWasm(self, connection, breakpoint_addr):
+    # Set a breakpoint.
+    reply = connection.RspRequest('Z0,%x,1' % breakpoint_addr)
+    self.assertEqual(reply, 'OK')
+
+    # When we run the program, we should hit the breakpoint.
+    reply = connection.RspRequest('c')
+    gdb_rsp.AssertReplySignal(reply, gdb_rsp.SIGTRAP)
+
+    # Remove the breakpoint.
+    reply = connection.RspRequest('z0,%x,1' % breakpoint_addr)
+    self.assertEqual(reply, 'OK')
+
+  def test_reading_and_writing_memory(self):
+    with gdb_rsp.LaunchDebugStub(COMMAND) as connection:
+      module_load_addr = gdb_rsp.GetLoadedModuleAddress(connection)
+      breakpoint_addr = module_load_addr + test_memory.FUNC0_START_ADDR
+      self.RunToWasm(connection, breakpoint_addr)
+
+      self.CheckReadMemoryAtInvalidAddr(connection)
+
+      # Check reading code memory space.
+      expected_data = b'\0asm'
+      result = gdb_rsp.ReadCodeMemory(connection, module_load_addr, len(expected_data))
+      self.assertEqual(result, expected_data)
+
+      # Check reading instance memory at a valid range.
+      reply = connection.RspRequest('qWasmMem:0;%x;%x' % (32, 4))
+      value = struct.unpack('I', gdb_rsp.DecodeHex(reply))[0]
+      self.assertEquals(int(value), 0)
+
+      # Check reading instance memory at an invalid range.
+      reply = connection.RspRequest('qWasmMem:0;%x;%x' % (0xf0000000, 4))
+      self.assertEqual(reply, 'E03')
+
+  def test_wasm_global(self):
+    with gdb_rsp.LaunchDebugStub(COMMAND) as connection:
+      module_load_addr = gdb_rsp.GetLoadedModuleAddress(connection)
+      breakpoint_addr = module_load_addr + test_memory.FUNC0_START_ADDR
+      self.RunToWasm(connection, breakpoint_addr)
+
+      # Check reading valid global.
+      reply = connection.RspRequest('qWasmGlobal:0;0')
+      value = struct.unpack('I', gdb_rsp.DecodeHex(reply))[0]
+      self.assertEqual(0, value)
+
+      # Check reading invalid global.
+      reply = connection.RspRequest('qWasmGlobal:0;9')
+      self.assertEqual("E03", reply)
+
+  def test_wasm_call_stack(self):
+    with gdb_rsp.LaunchDebugStub(COMMAND) as connection:
+      module_load_addr = gdb_rsp.GetLoadedModuleAddress(connection)
+      breakpoint_addr = module_load_addr + test_memory.FUNC0_START_ADDR
+      self.RunToWasm(connection, breakpoint_addr)
+
+      reply = connection.RspRequest('qWasmCallStack')
+      stack = gdb_rsp.DecodeUInt64Array(reply)
+      assert(len(stack) > 2) # At least two Wasm frames, plus one or more JS frames.
+      self.assertEqual(stack[0], module_load_addr + test_memory.FUNC0_START_ADDR)
+      self.assertEqual(stack[1], module_load_addr + test_memory.FUNC1_RETURN_ADDR)
+
+
+def Main():
+  index = sys.argv.index('--')
+  args = sys.argv[index + 1:]
+  # The remaining arguments go to unittest.main().
+  global COMMAND
+  COMMAND = args
+  unittest.main(argv=sys.argv[:index])
+
+if __name__ == '__main__':
+  Main()
diff --git a/deps/v8/test/debugging/wasm/gdb-server/status.py b/deps/v8/test/debugging/wasm/gdb-server/status.py
new file mode 100644
index 00000000000..0b333dce057
--- /dev/null
+++ b/deps/v8/test/debugging/wasm/gdb-server/status.py
@@ -0,0 +1,109 @@
+# Copyright 2020 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Flags: -expose-wasm --wasm-gdb-remote --wasm-pause-waiting-for-debugger test/debugging/wasm/gdb-server/test_files/test_basic.js
+
+import re
+import struct
+import sys
+import unittest
+
+import gdb_rsp
+import test_files.test_basic as test_basic
+
+# These are set up by Main().
+COMMAND = None
+
+class Tests(unittest.TestCase):
+
+  def test_loaded_modules(self):
+    with gdb_rsp.LaunchDebugStub(COMMAND) as connection:
+      modules = gdb_rsp.GetLoadedModules(connection)
+      connection.Close()
+      assert(len(modules) > 0)
+
+  def test_checking_thread_state(self):
+    with gdb_rsp.LaunchDebugStub(COMMAND) as connection:
+      # Query wasm thread id
+      reply = connection.RspRequest('qfThreadInfo')
+      match = re.match('m([0-9])$', reply)
+      if match is None:
+        raise AssertionError('Bad active thread list reply: %r' % reply)
+      thread_id = int(match.group(1), 10)
+      # There should not be other threads.
+      reply = connection.RspRequest('qsThreadInfo')
+      self.assertEqual("l", reply)
+      # Test that valid thread should be alive.
+      reply = connection.RspRequest('T%d' % (thread_id))
+      self.assertEqual("OK", reply)
+      # Test invalid thread id.
+      reply = connection.RspRequest('T42')
+      self.assertEqual("E02", reply)
+
+  def test_wasm_local(self):
+    with gdb_rsp.LaunchDebugStub(COMMAND) as connection:
+      module_load_addr = gdb_rsp.GetLoadedModuleAddress(connection)
+      breakpoint_addr = module_load_addr + test_basic.BREAK_ADDRESS_2
+
+      reply = connection.RspRequest('Z0,%x,1' % breakpoint_addr)
+      self.assertEqual("OK", reply)
+      reply = connection.RspRequest('c')
+      gdb_rsp.AssertReplySignal(reply, gdb_rsp.SIGTRAP)
+
+      reply = connection.RspRequest('qWasmLocal:0;0')
+      value = struct.unpack('I', gdb_rsp.DecodeHex(reply))[0]
+      self.assertEqual(test_basic.ARG_0, value)
+
+      reply = connection.RspRequest('qWasmLocal:0;1')
+      value = struct.unpack('I', gdb_rsp.DecodeHex(reply))[0]
+      self.assertEqual(test_basic.ARG_1, value)
+
+      # invalid local
+      reply = connection.RspRequest('qWasmLocal:0;9')
+      self.assertEqual("E03", reply)
+
+  def test_wasm_stack_value(self):
+    with gdb_rsp.LaunchDebugStub(COMMAND) as connection:
+      module_load_addr = gdb_rsp.GetLoadedModuleAddress(connection)
+      breakpoint_addr = module_load_addr + test_basic.BREAK_ADDRESS_2
+
+      reply = connection.RspRequest('Z0,%x,1' % breakpoint_addr)
+      self.assertEqual("OK", reply)
+      reply = connection.RspRequest('c')
+      gdb_rsp.AssertReplySignal(reply, gdb_rsp.SIGTRAP)
+
+      reply = connection.RspRequest('qWasmStackValue:0;0')
+      value = struct.unpack('I', gdb_rsp.DecodeHex(reply))[0]
+      self.assertEqual(test_basic.ARG_0, value)
+
+      reply = connection.RspRequest('qWasmStackValue:0;1')
+      value = struct.unpack('I', gdb_rsp.DecodeHex(reply))[0]
+      self.assertEqual(test_basic.ARG_1, value)
+
+      # invalid index
+      reply = connection.RspRequest('qWasmStackValue:0;2')
+      self.assertEqual("E03", reply)
+
+  def test_modifying_code_is_disallowed(self):
+    with gdb_rsp.LaunchDebugStub(COMMAND) as connection:
+      # Pick an arbitrary address in the code segment.
+      module_load_addr = gdb_rsp.GetLoadedModuleAddress(connection)
+      breakpoint_addr = module_load_addr + test_basic.BREAK_ADDRESS_1
+      # Writing to the code area should be disallowed.
+      data = '\x00'
+      write_command = 'M%x,%x:%s' % (breakpoint_addr, len(data), gdb_rsp.EncodeHex(data))
+      reply = connection.RspRequest(write_command)
+      self.assertEquals(reply, 'E03')
+
+
+def Main():
+  index = sys.argv.index('--')
+  args = sys.argv[index + 1:]
+  # The remaining arguments go to unittest.main().
+  global COMMAND
+  COMMAND = args
+  unittest.main(argv=sys.argv[:index])
+
+if __name__ == '__main__':
+  Main()
diff --git a/deps/v8/test/debugging/wasm/gdb-server/stepping.py b/deps/v8/test/debugging/wasm/gdb-server/stepping.py
new file mode 100644
index 00000000000..bc227ef2b06
--- /dev/null
+++ b/deps/v8/test/debugging/wasm/gdb-server/stepping.py
@@ -0,0 +1,56 @@
+# Copyright 2020 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Flags: -expose-wasm --wasm-gdb-remote --wasm-pause-waiting-for-debugger test/debugging/wasm/gdb-server/test_files/test_basic.js
+
+import sys
+import unittest
+
+import gdb_rsp
+import test_files.test_basic as test_basic
+
+# These are set up by Main().
+COMMAND = None
+
+class Tests(unittest.TestCase):
+  def test_single_step(self):
+    with gdb_rsp.LaunchDebugStub(COMMAND) as connection:
+      module_load_addr = gdb_rsp.GetLoadedModuleAddress(connection)
+      bp_addr = module_load_addr + test_basic.BREAK_ADDRESS_0
+      reply = connection.RspRequest('Z0,%x,1' % bp_addr)
+      self.assertEqual("OK", reply)
+      reply = connection.RspRequest('c')
+      gdb_rsp.AssertReplySignal(reply, gdb_rsp.SIGTRAP)
+
+      # We expect 's' to stop at the next instruction.
+      reply = connection.RspRequest('s')
+      gdb_rsp.AssertReplySignal(reply, gdb_rsp.SIGTRAP)
+      tid = gdb_rsp.ParseThreadStopReply(reply)['thread_id']
+      self.assertEqual(tid, 1)
+      regs = gdb_rsp.DecodeRegs(connection.RspRequest('g'))
+      self.assertEqual(regs['pc'], module_load_addr + test_basic.BREAK_ADDRESS_1)
+
+      # Again.
+      reply = connection.RspRequest('s')
+      gdb_rsp.AssertReplySignal(reply, gdb_rsp.SIGTRAP)
+      tid = gdb_rsp.ParseThreadStopReply(reply)['thread_id']
+      self.assertEqual(tid, 1)
+      regs = gdb_rsp.DecodeRegs(connection.RspRequest('g'))
+      self.assertEqual(regs['pc'], module_load_addr + test_basic.BREAK_ADDRESS_2)
+
+      # Check that we can continue after single-stepping.
+      reply = connection.RspRequest('c')
+      gdb_rsp.AssertReplySignal(reply, gdb_rsp.SIGTRAP)
+
+
+def Main():
+  index = sys.argv.index('--')
+  args = sys.argv[index + 1:]
+  # The remaining arguments go to unittest.main().
+  global COMMAND
+  COMMAND = args
+  unittest.main(argv=sys.argv[:index])
+
+if __name__ == '__main__':
+  Main()
diff --git a/deps/v8/test/debugging/wasm/gdb-server/test_files/__init__.py b/deps/v8/test/debugging/wasm/gdb-server/test_files/__init__.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/deps/v8/test/debugging/wasm/gdb-server/test_files/test.js b/deps/v8/test/debugging/wasm/gdb-server/test_files/test.js
deleted file mode 100644
index 0959edca300..00000000000
--- a/deps/v8/test/debugging/wasm/gdb-server/test_files/test.js
+++ /dev/null
@@ -1,33 +0,0 @@
-
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-load("test/mjsunit/wasm/wasm-module-builder.js");
-
-var builder = new WasmModuleBuilder();
-builder.addFunction('mul', kSig_i_ii)
-// input is 2 args of type int and output is int
-.addBody([
-  kExprLocalGet, 0, // local.get i0
-  kExprLocalGet, 1, // local.get i1
-  kExprI32Mul]) // i32.sub i0 i1
-.exportFunc();
-
-const instance = builder.instantiate();
-const wasm_f = instance.exports.mul;
-
-function f() {
-  var result = wasm_f(21, 2);
-  return result;
-}
-
-try {
-    let val = 0;
-    while (true) {
-        val += f();
-    }
-}
-catch (e) {
-    print('*exception:* ' + e);
-}
diff --git a/deps/v8/test/debugging/wasm/gdb-server/test_files/test_basic.js b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_basic.js
new file mode 100644
index 00000000000..0c80446e415
--- /dev/null
+++ b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_basic.js
@@ -0,0 +1,31 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder
+    .addFunction('mul', kSig_i_ii)
+    // input is 2 args of type int and output is int
+    .addBody([
+      kExprLocalGet, 0,  // local.get i0
+      kExprLocalGet, 1,  // local.get i1
+      kExprI32Mul
+    ])  // i32.mul i0 i1
+    .exportFunc();
+
+const instance = builder.instantiate();
+const wasm_f = instance.exports.mul;
+
+function f() {
+  var result = wasm_f(21, 2);
+  return result;
+}
+
+try {
+  let val = f();
+  f();
+} catch (e) {
+  print('*exception:* ' + e);
+}
diff --git a/deps/v8/test/debugging/wasm/gdb-server/test_files/test_basic.py b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_basic.py
new file mode 100644
index 00000000000..7c3f520421f
--- /dev/null
+++ b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_basic.py
@@ -0,0 +1,23 @@
+# Copyright 2020 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# 0x00 (module
+# 0x08   [type]
+#        (type $type0 (func (param i32 i32) (result i32)))
+# 0x11   [function]
+# 0x15   (export "mul" (func $func0))
+# 0x1e   [code]
+# 0x20   (func $func0 (param $var0 i32) (param $var1 i32) (result i32)
+# 0x23     get_local $var0
+# 0x25     get_local $var1
+# 0x27     i32.mul
+#   )
+# )
+# 0x29   [name]
+
+BREAK_ADDRESS_0 = 0x0023
+BREAK_ADDRESS_1 = 0x0025
+BREAK_ADDRESS_2 = 0x0027
+ARG_0 = 21
+ARG_1 = 2
diff --git a/deps/v8/test/debugging/wasm/gdb-server/test_files/test_float.js b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_float.js
new file mode 100644
index 00000000000..e1f45e5aa67
--- /dev/null
+++ b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_float.js
@@ -0,0 +1,31 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder
+    .addFunction('mul', kSig_f_ff)
+    // input is 2 args of type float and output is float
+    .addBody([
+      kExprLocalGet, 0,  // local.get f0
+      kExprLocalGet, 1,  // local.get f1
+      kExprF32Mul,       // f32.mul i0 i1
+    ])
+    .exportFunc();
+
+const instance = builder.instantiate();
+const wasm_f = instance.exports.mul;
+
+function f() {
+  var result = wasm_f(12.0, 3.5);
+  return result;
+}
+
+try {
+  let val = f();
+  print('float result: ' + val);
+} catch (e) {
+  print('*exception:* ' + e);
+}
diff --git a/deps/v8/test/debugging/wasm/gdb-server/test_files/test_float.py b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_float.py
new file mode 100644
index 00000000000..6cf59eb3805
--- /dev/null
+++ b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_float.py
@@ -0,0 +1,21 @@
+# Copyright 2020 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# 0x00 (module
+# 0x08   [type]
+#        (type $type0 (func (param f32 f32) (result f32)))
+# 0x11   [function]
+# 0x15   (export "mul" (func $func0))
+# 0x1e   [code]
+# 0x20   (func $func0 (param $var0 f32) (param $var1 f32) (result f32)
+# 0x23     get_local $var0
+# 0x25     get_local $var1
+# 0x27     f32.mul
+#   )
+# )
+# 0x29   [name]
+
+ARG_0 = 12.0
+ARG_1 = 3.5
+FUNC_START_ADDR = 0x23
diff --git a/deps/v8/test/debugging/wasm/gdb-server/test_files/test_memory.js b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_memory.js
new file mode 100644
index 00000000000..c955f126fae
--- /dev/null
+++ b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_memory.js
@@ -0,0 +1,48 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+
+builder.addGlobal(kWasmI32).exportAs('g_n');
+
+builder.addMemory(32, 128).exportMemoryAs('mem')
+
+var func_a_idx =
+    builder.addFunction('wasm_A', kSig_v_i).addBody([kExprNop, kExprNop]).index;
+
+// wasm_B calls wasm_A <param0> times.
+builder.addFunction('wasm_B', kSig_v_i)
+    .addBody([
+      kExprLoop,
+      kWasmStmt,  // while
+      kExprLocalGet,
+      0,  // -
+      kExprIf,
+      kWasmStmt,  // if <param0> != 0
+      kExprLocalGet,
+      0,  // -
+      kExprI32Const,
+      1,            // -
+      kExprI32Sub,  // -
+      kExprLocalSet,
+      0,                      // decrease <param0>
+      ...wasmI32Const(1024),  // some longer i32 const (2 byte imm)
+      kExprCallFunction,
+      func_a_idx,  // -
+      kExprBr,
+      1,         // continue
+      kExprEnd,  // -
+      kExprEnd,  // break
+    ])
+    .exportAs('main');
+
+const instance = builder.instantiate();
+const wasm_main = instance.exports.main;
+
+function f() {
+  wasm_main(42);
+}
+f();
diff --git a/deps/v8/test/debugging/wasm/gdb-server/test_files/test_memory.py b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_memory.py
new file mode 100644
index 00000000000..5502bcc6e63
--- /dev/null
+++ b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_memory.py
@@ -0,0 +1,43 @@
+# Copyright 2020 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# 0x00 (module
+# 0x08   [type]
+# 0x0a   (type $type0 (func (param i32)))
+# 0x0f   (type $type1 (func (param i32)))
+# 0x13   [function]
+# 0x18   [memory]
+#        (memory (;0;) 32 128)
+# 0x1f   [global]
+# 0x27   (global $global0 i32 (i32.const 0))
+# 0x29   (export "g_n" (global $global0))
+# 0x30   (export "mem" (memory 0))
+# 0x36   (export "main" (func $func1))
+# 0x3d   [code]
+# 0x3f   (func $func0 (param $var0 i32)
+# 0x42     nop
+# 0x43     nop
+#   )
+# 0x45   (func $func1 (param $var0 i32)
+# 0x47     loop $label0
+# 0x49       get_local $var0
+# 0x4b       if
+# 0x4d         get_local $var0
+# 0x4f         i32.const 1
+# 0x51         i32.sub
+# 0x52         set_local $var0
+# 0x54         i32.const 1024
+# 0x57         call $func0
+# 0x59         br $label0
+# 0x5b       end
+# 0x5c     end $label0
+#   )
+# )
+# 0x5e   [name]
+
+MEM_MIN = 32
+MEM_MAX = 128
+FUNC0_START_ADDR = 0x42
+FUNC1_RETURN_ADDR = 0x59
+FUNC1_START_ADDR = 0x47
diff --git a/deps/v8/test/debugging/wasm/gdb-server/test_files/test_trap.js b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_trap.js
new file mode 100644
index 00000000000..2f4a9fb52cb
--- /dev/null
+++ b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_trap.js
@@ -0,0 +1,31 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+
+builder.addMemory(32, 128).exportMemoryAs('mem')
+
+var func_a_idx =
+  builder.addFunction('wasm_A', kSig_v_v).addBody([
+    kExprI32Const, 0,  // i32.const 0
+    kExprI32Const, 42, // i32.const 42
+    kExprI32StoreMem, 0, 0xff, 0xff, 0xff, 0xff, 0x0f, // i32.store offset = -1
+  ]).index;
+
+builder.addFunction('main', kSig_i_v).addBody([
+    kExprCallFunction, func_a_idx, // call $wasm_A
+    kExprI32Const, 0 // i32.const 0
+  ])
+  .exportFunc();
+
+const instance = builder.instantiate();
+const main_f = instance.exports.main;
+
+function f() {
+  var result = main_f();
+  return result;
+}
+f();
diff --git a/deps/v8/test/debugging/wasm/gdb-server/test_files/test_trap.py b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_trap.py
new file mode 100644
index 00000000000..a85fc4b640a
--- /dev/null
+++ b/deps/v8/test/debugging/wasm/gdb-server/test_files/test_trap.py
@@ -0,0 +1,28 @@
+# Copyright 2020 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# 0x00 (module
+# 0x08   [type]
+# 0x0a   (type $type0 (func))
+# 0x0e   (type $type1 (func (result i32)))
+# 0x12   [function]
+# 0x17   [memory]
+# 0x19   (memory $memory0 32 128)
+# 0x1e   [export]
+# 0x20   (export "mem" (memory $memory0))
+# 0x27   (export "main" (func $func1))
+# 0x2e   [code]
+# 0x30   (func $func0
+# 0x33     i32.const 0
+# 0x35     i32.const 42
+# 0x37     i32.store offset=-1 align=1
+# 0x3e   )
+# 0x3f   (func $func1 (result i32)
+# 0x41     call $func0
+# 0x43     i32.const 0
+# 0x45   )
+# 0x46   ...
+#      )
+
+TRAP_ADDRESS = 0x0037
diff --git a/deps/v8/test/debugging/wasm/gdb-server/trap.py b/deps/v8/test/debugging/wasm/gdb-server/trap.py
new file mode 100644
index 00000000000..7a6fea13d26
--- /dev/null
+++ b/deps/v8/test/debugging/wasm/gdb-server/trap.py
@@ -0,0 +1,37 @@
+# Copyright 2020 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Flags: -expose-wasm --wasm-gdb-remote --wasm-pause-waiting-for-debugger test/debugging/wasm/gdb-server/test_files/test_trap.js
+
+import sys
+import unittest
+
+import gdb_rsp
+import test_files.test_trap as test_trap
+
+# These are set up by Main().
+COMMAND = None
+
+class Tests(unittest.TestCase):
+  def test_trap(self):
+    with gdb_rsp.LaunchDebugStub(COMMAND) as connection:
+      module_load_addr = gdb_rsp.GetLoadedModuleAddress(connection)
+      reply = connection.RspRequest('c')
+      gdb_rsp.AssertReplySignal(reply, gdb_rsp.SIGSEGV)
+      tid = gdb_rsp.ParseThreadStopReply(reply)['thread_id']
+      self.assertEqual(tid, 1)
+      regs = gdb_rsp.DecodeRegs(connection.RspRequest('g'))
+      self.assertEqual(regs['pc'], module_load_addr + test_trap.TRAP_ADDRESS)
+
+
+def Main():
+  index = sys.argv.index('--')
+  args = sys.argv[index + 1:]
+  # The remaining arguments go to unittest.main().
+  global COMMAND
+  COMMAND = args
+  unittest.main(argv=sys.argv[:index])
+
+if __name__ == '__main__':
+  Main()
diff --git a/deps/v8/test/fuzzer/fuzzer.status b/deps/v8/test/fuzzer/fuzzer.status
index 65e51c238b7..0a08dfa2e96 100644
--- a/deps/v8/test/fuzzer/fuzzer.status
+++ b/deps/v8/test/fuzzer/fuzzer.status
@@ -13,4 +13,9 @@
   'wasm_compile/*': [SKIP],
 }], # lite_mode or variant == jitless
 
+################################################################################
+['variant == stress_snapshot', {
+  '*': [SKIP],  # only relevant for mjsunit tests.
+}],
+
 ]
diff --git a/deps/v8/test/fuzzer/parser.cc b/deps/v8/test/fuzzer/parser.cc
index c411d933d65..691fcf67e6f 100644
--- a/deps/v8/test/fuzzer/parser.cc
+++ b/deps/v8/test/fuzzer/parser.cc
@@ -80,7 +80,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
 
   v8::internal::Handle<v8::internal::Script> script =
       factory->NewScript(source.ToHandleChecked());
-  v8::internal::ParseInfo info(i_isolate, *script);
+  v8::internal::UnoptimizedCompileState state(i_isolate);
+  v8::internal::UnoptimizedCompileFlags flags =
+      v8::internal::UnoptimizedCompileFlags::ForScriptCompile(i_isolate,
+                                                              *script);
+  v8::internal::ParseInfo info(i_isolate, flags, &state);
   if (!v8::internal::parsing::ParseProgram(&info, script, i_isolate)) {
     i_isolate->OptionalRescheduleException(true);
   }
diff --git a/deps/v8/test/fuzzer/wasm-compile.cc b/deps/v8/test/fuzzer/wasm-compile.cc
index 1241061a7ba..853ad2e5ae5 100644
--- a/deps/v8/test/fuzzer/wasm-compile.cc
+++ b/deps/v8/test/fuzzer/wasm-compile.cc
@@ -32,6 +32,8 @@ namespace {
 
 constexpr int kMaxFunctions = 4;
 constexpr int kMaxGlobals = 64;
+constexpr int kMaxParameters = 15;
+constexpr int kMaxReturns = 15;
 
 class DataRange {
   Vector<const uint8_t> data_;
@@ -63,6 +65,13 @@ class DataRange {
 
   template <typename T, size_t max_bytes = sizeof(T)>
   T get() {
+    // DISABLE FOR BOOL
+    // The -O3 on release will break the result. This creates a different
+    // observable side effect when invoking get<bool> between debug and release
+    // version, which eventually makes the code output different as well as
+    // raising various unrecoverable errors on runtime. It is caused by
+    // undefined behavior of assigning boolean via memcpy from randomized bytes.
+    STATIC_ASSERT(!(std::is_same<T, bool>::value));
     STATIC_ASSERT(max_bytes <= sizeof(T));
     // We want to support the case where we have less than sizeof(T) bytes
     // remaining in the slice. For example, if we emit an i32 constant, it's
@@ -105,11 +114,36 @@ class WasmGenerator {
 
   class BlockScope {
    public:
-    BlockScope(WasmGenerator* gen, WasmOpcode block_type, ValueType result_type,
-               ValueType br_type)
+    BlockScope(WasmGenerator* gen, WasmOpcode block_type,
+               const std::vector<ValueType>& param_types,
+               const std::vector<ValueType>& result_types,
+               const std::vector<ValueType>& br_types)
         : gen_(gen) {
-      gen->blocks_.push_back(br_type);
-      gen->builder_->EmitWithU8(block_type, result_type.value_type_code());
+      gen->blocks_.push_back(br_types);
+      if (param_types.size() == 0 && result_types.size() == 0) {
+        gen->builder_->EmitWithU8(block_type, kWasmStmt.value_type_code());
+        return;
+      }
+      if (param_types.size() == 0 && result_types.size() == 1) {
+        gen->builder_->EmitWithU8(block_type,
+                                  result_types[0].value_type_code());
+        return;
+      }
+      // Multi-value block.
+      Zone* zone = gen->builder_->builder()->zone();
+      FunctionSig::Builder builder(zone, result_types.size(),
+                                   param_types.size());
+      for (auto& type : param_types) {
+        DCHECK_NE(type, kWasmStmt);
+        builder.AddParam(type);
+      }
+      for (auto& type : result_types) {
+        DCHECK_NE(type, kWasmStmt);
+        builder.AddReturn(type);
+      }
+      FunctionSig* sig = builder.Build();
+      int sig_id = gen->builder_->builder()->AddSignature(sig);
+      gen->builder_->EmitWithI32V(block_type, sig_id);
     }
 
     ~BlockScope() {
@@ -121,32 +155,76 @@ class WasmGenerator {
     WasmGenerator* const gen_;
   };
 
+  void block(const std::vector<ValueType>& param_types,
+             const std::vector<ValueType>& return_types, DataRange* data) {
+    BlockScope block_scope(this, kExprBlock, param_types, return_types,
+                           return_types);
+    ConsumeAndGenerate(param_types, return_types, data);
+  }
+
   template <ValueType::Kind T>
   void block(DataRange* data) {
-    BlockScope block_scope(this, kExprBlock, ValueType(T), ValueType(T));
-    Generate<T>(data);
+    block({}, {ValueType(T)}, data);
+  }
+
+  void loop(const std::vector<ValueType>& param_types,
+            const std::vector<ValueType>& return_types, DataRange* data) {
+    BlockScope block_scope(this, kExprLoop, param_types, return_types,
+                           param_types);
+    ConsumeAndGenerate(param_types, return_types, data);
   }
 
   template <ValueType::Kind T>
   void loop(DataRange* data) {
-    // When breaking to a loop header, don't provide any input value (hence
-    // kWasmStmt).
-    BlockScope block_scope(this, kExprLoop, ValueType(T), kWasmStmt);
-    Generate<T>(data);
+    loop({}, {ValueType(T)}, data);
   }
 
   enum IfType { kIf, kIfElse };
 
+  void if_(const std::vector<ValueType>& param_types,
+           const std::vector<ValueType>& return_types, IfType type,
+           DataRange* data) {
+    // One-armed "if" are only valid if the input and output types are the same.
+    DCHECK_IMPLIES(type == kIf, param_types == return_types);
+    Generate(kWasmI32, data);
+    BlockScope block_scope(this, kExprIf, param_types, return_types,
+                           return_types);
+    ConsumeAndGenerate(param_types, return_types, data);
+    if (type == kIfElse) {
+      builder_->Emit(kExprElse);
+      ConsumeAndGenerate(param_types, return_types, data);
+    }
+  }
+
   template <ValueType::Kind T, IfType type>
   void if_(DataRange* data) {
     static_assert(T == ValueType::kStmt || type == kIfElse,
                   "if without else cannot produce a value");
-    Generate<ValueType::kI32>(data);
-    BlockScope block_scope(this, kExprIf, ValueType(T), ValueType(T));
-    Generate<T>(data);
-    if (type == kIfElse) {
-      builder_->Emit(kExprElse);
-      Generate<T>(data);
+    auto return_type = T == ValueType::kStmt
+                           ? std::vector<ValueType>{}
+                           : std::vector<ValueType>{ValueType(T)};
+    if_({}, return_type, type, data);
+  }
+
+  void any_block(const std::vector<ValueType>& param_types,
+                 const std::vector<ValueType>& return_types, DataRange* data) {
+    uint8_t block_type = data->get<uint8_t>() % 4;
+    switch (block_type) {
+      case 0:
+        block(param_types, return_types, data);
+        return;
+      case 1:
+        loop(param_types, return_types, data);
+        return;
+      case 2:
+        if (param_types == return_types) {
+          if_({}, {}, kIf, data);
+          return;
+        }
+        V8_FALLTHROUGH;
+      case 3:
+        if_(param_types, return_types, kIfElse, data);
+        return;
     }
   }
 
@@ -154,9 +232,9 @@ class WasmGenerator {
     // There is always at least the block representing the function body.
     DCHECK(!blocks_.empty());
     const uint32_t target_block = data->get<uint32_t>() % blocks_.size();
-    const ValueType break_type = blocks_[target_block];
+    const auto break_types = blocks_[target_block];
 
-    Generate(break_type, data);
+    Generate(VectorOf(break_types), data);
     builder_->EmitWithI32V(
         kExprBr, static_cast<uint32_t>(blocks_.size()) - 1 - target_block);
   }
@@ -166,13 +244,16 @@ class WasmGenerator {
     // There is always at least the block representing the function body.
     DCHECK(!blocks_.empty());
     const uint32_t target_block = data->get<uint32_t>() % blocks_.size();
-    const ValueType break_type = blocks_[target_block];
+    const auto break_types = blocks_[target_block];
 
-    Generate(break_type, data);
+    Generate(VectorOf(break_types), data);
     Generate(kWasmI32, data);
     builder_->EmitWithI32V(
         kExprBrIf, static_cast<uint32_t>(blocks_.size()) - 1 - target_block);
-    ConvertOrGenerate(break_type, ValueType(wanted_type), data);
+    auto return_type = wanted_type == ValueType::kStmt
+                           ? std::vector<ValueType>{}
+                           : std::vector<ValueType>{ValueType(wanted_type)};
+    ConsumeAndGenerate(break_types, return_type, data);
   }
 
   // TODO(eholk): make this function constexpr once gcc supports it
@@ -194,6 +275,13 @@ class WasmGenerator {
       case kExprI64AtomicXor:
       case kExprI64AtomicExchange:
       case kExprI64AtomicCompareExchange:
+      case kExprI16x8Load8x8S:
+      case kExprI16x8Load8x8U:
+      case kExprI32x4Load16x4S:
+      case kExprI32x4Load16x4U:
+      case kExprI64x2Load32x2S:
+      case kExprI64x2Load32x2U:
+      case kExprS64x2LoadSplat:
         return 3;
       case kExprI32LoadMem:
       case kExprI64LoadMem32S:
@@ -220,6 +308,7 @@ class WasmGenerator {
       case kExprI64AtomicXor32U:
       case kExprI64AtomicExchange32U:
       case kExprI64AtomicCompareExchange32U:
+      case kExprS32x4LoadSplat:
         return 2;
       case kExprI32LoadMem16S:
       case kExprI32LoadMem16U:
@@ -245,6 +334,7 @@ class WasmGenerator {
       case kExprI64AtomicXor16U:
       case kExprI64AtomicExchange16U:
       case kExprI64AtomicCompareExchange16U:
+      case kExprS16x8LoadSplat:
         return 1;
       case kExprI32LoadMem8S:
       case kExprI32LoadMem8U:
@@ -270,6 +360,7 @@ class WasmGenerator {
       case kExprI64AtomicXor8U:
       case kExprI64AtomicExchange8U:
       case kExprI64AtomicCompareExchange8U:
+      case kExprS8x16LoadSplat:
         return 0;
       default:
         return 0;
@@ -307,9 +398,24 @@ class WasmGenerator {
   }
 
   template <WasmOpcode Op, ValueType::Kind... Args>
-  void simd_op(DataRange* data) {
+  void op_with_prefix(DataRange* data) {
+    Generate<Args...>(data);
+    builder_->EmitWithPrefix(Op);
+  }
+
+  template <WasmOpcode Op, int lanes, ValueType::Kind... Args>
+  void simd_lane_op(DataRange* data) {
     Generate<Args...>(data);
     builder_->EmitWithPrefix(Op);
+    builder_->EmitByte(data->get<byte>() % lanes);
+  }
+
+  void simd_shuffle(DataRange* data) {
+    Generate<ValueType::kS128, ValueType::kS128>(data);
+    builder_->EmitWithPrefix(kExprS8x16Shuffle);
+    for (int i = 0; i < kSimd128Size; i++) {
+      builder_->EmitByte(static_cast<uint8_t>(data->get<byte>() % 32));
+    }
   }
 
   void drop(DataRange* data) {
@@ -370,19 +476,24 @@ class WasmGenerator {
     }
     // Emit call.
     builder_->EmitWithU32V(kExprCallFunction, func_index);
-    // Convert the return value to the wanted type.
-    ValueType return_type =
-        sig->return_count() == 0 ? kWasmStmt : sig->GetReturn(0);
-    if (return_type == kWasmStmt && wanted_type != kWasmStmt) {
+    if (sig->return_count() == 0 && wanted_type != kWasmStmt) {
       // The call did not generate a value. Thus just generate it here.
       Generate(wanted_type, data);
-    } else if (return_type != kWasmStmt && wanted_type == kWasmStmt) {
-      // The call did generate a value, but we did not want one.
-      builder_->Emit(kExprDrop);
-    } else if (return_type != wanted_type) {
-      // If the returned type does not match the wanted type, convert it.
-      Convert(return_type, wanted_type);
+      return;
+    }
+    if (wanted_type == kWasmStmt) {
+      // The call did generate values, but we did not want one.
+      for (size_t i = 0; i < sig->return_count(); ++i) {
+        builder_->Emit(kExprDrop);
+      }
+      return;
     }
+    std::vector<ValueType> return_types(sig->returns().begin(),
+                                        sig->returns().end());
+    auto wanted_types = wanted_type == kWasmStmt
+                            ? std::vector<ValueType>{}
+                            : std::vector<ValueType>{wanted_type};
+    ConsumeAndGenerate(return_types, wanted_types, data);
   }
 
   struct Var {
@@ -541,8 +652,10 @@ class WasmGenerator {
         globals_(globals),
         mutable_globals_(mutable_globals) {
     FunctionSig* sig = fn->signature();
-    DCHECK_GE(1, sig->return_count());
-    blocks_.push_back(sig->return_count() == 0 ? kWasmStmt : sig->GetReturn(0));
+    blocks_.emplace_back();
+    for (size_t i = 0; i < sig->return_count(); ++i) {
+      blocks_.back().push_back(sig->GetReturn(i));
+    }
 
     constexpr uint32_t kMaxLocals = 32;
     locals_.resize(data->get<uint8_t>() % kMaxLocals);
@@ -565,9 +678,15 @@ class WasmGenerator {
     Generate<T2, Ts...>(data);
   }
 
+  std::vector<ValueType> GenerateTypes(DataRange* data);
+  void Generate(Vector<const ValueType> types, DataRange* data);
+  void ConsumeAndGenerate(const std::vector<ValueType>& parameter_types,
+                          const std::vector<ValueType>& return_types,
+                          DataRange* data);
+
  private:
   WasmFunctionBuilder* builder_;
-  std::vector<ValueType> blocks_;
+  std::vector<std::vector<ValueType>> blocks_;
   const std::vector<FunctionSig*>& functions_;
   std::vector<ValueType> locals_;
   std::vector<ValueType> globals_;
@@ -581,6 +700,16 @@ class WasmGenerator {
   }
 };
 
+template <>
+void WasmGenerator::block<ValueType::kStmt>(DataRange* data) {
+  block({}, {}, data);
+}
+
+template <>
+void WasmGenerator::loop<ValueType::kStmt>(DataRange* data) {
+  loop({}, {}, data);
+}
+
 template <>
 void WasmGenerator::Generate<ValueType::kStmt>(DataRange* data) {
   GeneratorRecursionScope rec_scope(this);
@@ -703,6 +832,11 @@ void WasmGenerator::Generate<ValueType::kI32>(DataRange* data) {
       &WasmGenerator::op<kExprI32UConvertF64, ValueType::kF64>,
       &WasmGenerator::op<kExprI32ReinterpretF32, ValueType::kF32>,
 
+      &WasmGenerator::op_with_prefix<kExprI32SConvertSatF32, ValueType::kF32>,
+      &WasmGenerator::op_with_prefix<kExprI32UConvertSatF32, ValueType::kF32>,
+      &WasmGenerator::op_with_prefix<kExprI32SConvertSatF64, ValueType::kF64>,
+      &WasmGenerator::op_with_prefix<kExprI32UConvertSatF64, ValueType::kF64>,
+
       &WasmGenerator::block<ValueType::kI32>,
       &WasmGenerator::loop<ValueType::kI32>,
       &WasmGenerator::if_<ValueType::kI32, kIfElse>,
@@ -762,9 +896,16 @@ void WasmGenerator::Generate<ValueType::kI32>(DataRange* data) {
                                 ValueType::kI32, ValueType::kI32,
                                 ValueType::kI32>,
 
-      &WasmGenerator::simd_op<kExprS1x16AnyTrue, ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprS1x8AnyTrue, ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprS1x4AnyTrue, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprV8x16AnyTrue, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprV16x8AnyTrue, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprV32x4AnyTrue, ValueType::kS128>,
+      &WasmGenerator::simd_lane_op<kExprI8x16ExtractLaneS, 16,
+                                   ValueType::kS128>,
+      &WasmGenerator::simd_lane_op<kExprI8x16ExtractLaneU, 16,
+                                   ValueType::kS128>,
+      &WasmGenerator::simd_lane_op<kExprI16x8ExtractLaneS, 8, ValueType::kS128>,
+      &WasmGenerator::simd_lane_op<kExprI16x8ExtractLaneU, 8, ValueType::kS128>,
+      &WasmGenerator::simd_lane_op<kExprI32x4ExtractLane, 4, ValueType::kS128>,
 
       &WasmGenerator::current_memory,
       &WasmGenerator::grow_memory,
@@ -826,6 +967,11 @@ void WasmGenerator::Generate<ValueType::kI64>(DataRange* data) {
       &WasmGenerator::op<kExprI64Ctz, ValueType::kI64>,
       &WasmGenerator::op<kExprI64Popcnt, ValueType::kI64>,
 
+      &WasmGenerator::op_with_prefix<kExprI64SConvertSatF32, ValueType::kF32>,
+      &WasmGenerator::op_with_prefix<kExprI64UConvertSatF32, ValueType::kF32>,
+      &WasmGenerator::op_with_prefix<kExprI64SConvertSatF64, ValueType::kF64>,
+      &WasmGenerator::op_with_prefix<kExprI64UConvertSatF64, ValueType::kF64>,
+
       &WasmGenerator::block<ValueType::kI64>,
       &WasmGenerator::loop<ValueType::kI64>,
       &WasmGenerator::if_<ValueType::kI64, kIfElse>,
@@ -903,6 +1049,8 @@ void WasmGenerator::Generate<ValueType::kI64>(DataRange* data) {
                                 ValueType::kI32, ValueType::kI64,
                                 ValueType::kI64>,
 
+      &WasmGenerator::simd_lane_op<kExprI64x2ExtractLane, 2, ValueType::kS128>,
+
       &WasmGenerator::get_local<ValueType::kI64>,
       &WasmGenerator::tee_local<ValueType::kI64>,
       &WasmGenerator::get_global<ValueType::kI64>,
@@ -958,6 +1106,8 @@ void WasmGenerator::Generate<ValueType::kF32>(DataRange* data) {
 
       &WasmGenerator::memop<kExprF32LoadMem>,
 
+      &WasmGenerator::simd_lane_op<kExprF32x4ExtractLane, 4, ValueType::kS128>,
+
       &WasmGenerator::get_local<ValueType::kF32>,
       &WasmGenerator::tee_local<ValueType::kF32>,
       &WasmGenerator::get_global<ValueType::kF32>,
@@ -1013,6 +1163,8 @@ void WasmGenerator::Generate<ValueType::kF64>(DataRange* data) {
 
       &WasmGenerator::memop<kExprF64LoadMem>,
 
+      &WasmGenerator::simd_lane_op<kExprF64x2ExtractLane, 2, ValueType::kS128>,
+
       &WasmGenerator::get_local<ValueType::kF64>,
       &WasmGenerator::tee_local<ValueType::kF64>,
       &WasmGenerator::get_global<ValueType::kF64>,
@@ -1037,135 +1189,273 @@ void WasmGenerator::Generate<ValueType::kS128>(DataRange* data) {
   }
 
   constexpr GenerateFn alternatives[] = {
-      &WasmGenerator::simd_op<kExprI8x16Splat, ValueType::kI32>,
-      &WasmGenerator::simd_op<kExprI8x16Eq, ValueType::kS128, ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16Ne, ValueType::kS128, ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16LtS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16LtU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16GtS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16GtU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16LeS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16LeU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16GeS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16GeU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16Neg, ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16Shl, ValueType::kS128, ValueType::kI32>,
-      &WasmGenerator::simd_op<kExprI8x16ShrS, ValueType::kS128,
-                              ValueType::kI32>,
-      &WasmGenerator::simd_op<kExprI8x16ShrU, ValueType::kS128,
-                              ValueType::kI32>,
-      &WasmGenerator::simd_op<kExprI8x16Add, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16AddSaturateS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16AddSaturateU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16Sub, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16SubSaturateS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16SubSaturateU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16MinS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16MinU, ValueType::kS128,
-                              ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16Splat, ValueType::kI32>,
+      &WasmGenerator::op_with_prefix<kExprI8x16Eq, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16Ne, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16LtS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16LtU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16GtS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16GtU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16LeS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16LeU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16GeS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16GeU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16Neg, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16Shl, ValueType::kS128,
+                                     ValueType::kI32>,
+      &WasmGenerator::op_with_prefix<kExprI8x16ShrS, ValueType::kS128,
+                                     ValueType::kI32>,
+      &WasmGenerator::op_with_prefix<kExprI8x16ShrU, ValueType::kS128,
+                                     ValueType::kI32>,
+      &WasmGenerator::op_with_prefix<kExprI8x16Add, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16AddSaturateS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16AddSaturateU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16Sub, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16SubSaturateS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16SubSaturateU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16MinS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16MinU, ValueType::kS128,
+                                     ValueType::kS128>,
       // I8x16Mul is prototyped but not in the proposal, thus omitted here.
-      &WasmGenerator::simd_op<kExprI8x16MaxS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI8x16MaxU, ValueType::kS128,
-                              ValueType::kS128>,
-
-      &WasmGenerator::simd_op<kExprI16x8Splat, ValueType::kI32>,
-      &WasmGenerator::simd_op<kExprI16x8Eq, ValueType::kS128, ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8Ne, ValueType::kS128, ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8LtS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8LtU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8GtS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8GtU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8LeS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8LeU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8GeS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8GeU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8Neg, ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8Shl, ValueType::kS128, ValueType::kI32>,
-      &WasmGenerator::simd_op<kExprI16x8ShrS, ValueType::kS128,
-                              ValueType::kI32>,
-      &WasmGenerator::simd_op<kExprI16x8ShrU, ValueType::kS128,
-                              ValueType::kI32>,
-      &WasmGenerator::simd_op<kExprI16x8Add, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8AddSaturateS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8AddSaturateU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8Sub, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8SubSaturateS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8SubSaturateU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8Mul, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8MinS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8MinU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8MaxS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI16x8MaxU, ValueType::kS128,
-                              ValueType::kS128>,
-
-      &WasmGenerator::simd_op<kExprI32x4Splat, ValueType::kI32>,
-      &WasmGenerator::simd_op<kExprI32x4Eq, ValueType::kS128, ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI32x4Ne, ValueType::kS128, ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI32x4LtS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI32x4LtU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI32x4GtS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI32x4GtU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI32x4LeS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI32x4LeU, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI32x4GeS, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI32x4GeU, ValueType::kS128,
-                              ValueType::kS128>,
-
-      &WasmGenerator::simd_op<kExprI64x2Splat, ValueType::kI64>,
-      &WasmGenerator::simd_op<kExprF32x4Splat, ValueType::kF32>,
-      &WasmGenerator::simd_op<kExprF64x2Splat, ValueType::kF64>,
-
-      &WasmGenerator::simd_op<kExprI32x4Add, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprI64x2Add, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprF32x4Add, ValueType::kS128,
-                              ValueType::kS128>,
-      &WasmGenerator::simd_op<kExprF64x2Add, ValueType::kS128,
-                              ValueType::kS128>,
-
-      &WasmGenerator::memop<kExprS128LoadMem>};
+      &WasmGenerator::op_with_prefix<kExprI8x16MaxS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16MaxU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16RoundingAverageU,
+                                     ValueType::kS128, ValueType::kS128>,
+
+      &WasmGenerator::op_with_prefix<kExprI16x8Splat, ValueType::kI32>,
+      &WasmGenerator::op_with_prefix<kExprI16x8Eq, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8Ne, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8LtS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8LtU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8GtS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8GtU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8LeS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8LeU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8GeS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8GeU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8Neg, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8Shl, ValueType::kS128,
+                                     ValueType::kI32>,
+      &WasmGenerator::op_with_prefix<kExprI16x8ShrS, ValueType::kS128,
+                                     ValueType::kI32>,
+      &WasmGenerator::op_with_prefix<kExprI16x8ShrU, ValueType::kS128,
+                                     ValueType::kI32>,
+      &WasmGenerator::op_with_prefix<kExprI16x8Add, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8AddSaturateS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8AddSaturateU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8Sub, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8SubSaturateS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8SubSaturateU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8Mul, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8MinS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8MinU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8MaxS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8MaxU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8RoundingAverageU,
+                                     ValueType::kS128, ValueType::kS128>,
+
+      &WasmGenerator::op_with_prefix<kExprI32x4Splat, ValueType::kI32>,
+      &WasmGenerator::op_with_prefix<kExprI32x4Eq, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4Ne, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4LtS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4LtU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4GtS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4GtU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4LeS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4LeU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4GeS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4GeU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4Neg, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4Shl, ValueType::kS128,
+                                     ValueType::kI32>,
+      &WasmGenerator::op_with_prefix<kExprI32x4ShrS, ValueType::kS128,
+                                     ValueType::kI32>,
+      &WasmGenerator::op_with_prefix<kExprI32x4ShrU, ValueType::kS128,
+                                     ValueType::kI32>,
+      &WasmGenerator::op_with_prefix<kExprI32x4Add, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4Sub, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4Mul, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4MinS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4MinU, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4MaxS, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4MaxU, ValueType::kS128,
+                                     ValueType::kS128>,
+
+      &WasmGenerator::op_with_prefix<kExprI64x2Splat, ValueType::kI64>,
+      &WasmGenerator::op_with_prefix<kExprI64x2Neg, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI64x2Shl, ValueType::kS128,
+                                     ValueType::kI32>,
+      &WasmGenerator::op_with_prefix<kExprI64x2ShrS, ValueType::kS128,
+                                     ValueType::kI32>,
+      &WasmGenerator::op_with_prefix<kExprI64x2ShrU, ValueType::kS128,
+                                     ValueType::kI32>,
+      &WasmGenerator::op_with_prefix<kExprI64x2Add, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI64x2Sub, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI64x2Mul, ValueType::kS128,
+                                     ValueType::kS128>,
+
+      &WasmGenerator::op_with_prefix<kExprF32x4Splat, ValueType::kF32>,
+      &WasmGenerator::op_with_prefix<kExprF32x4Eq, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4Ne, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4Lt, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4Gt, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4Le, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4Ge, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4Abs, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4Neg, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4Sqrt, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4Add, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4Sub, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4Mul, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4Div, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4Min, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4Max, ValueType::kS128,
+                                     ValueType::kS128>,
+
+      &WasmGenerator::op_with_prefix<kExprF64x2Splat, ValueType::kF64>,
+      &WasmGenerator::op_with_prefix<kExprF64x2Eq, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF64x2Ne, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF64x2Lt, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF64x2Gt, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF64x2Le, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF64x2Ge, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF64x2Abs, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF64x2Neg, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF64x2Sqrt, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF64x2Add, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF64x2Sub, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF64x2Mul, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF64x2Div, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF64x2Min, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF64x2Max, ValueType::kS128,
+                                     ValueType::kS128>,
+
+      &WasmGenerator::op_with_prefix<kExprI32x4SConvertF32x4, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4UConvertF32x4, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4SConvertI32x4, ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprF32x4UConvertI32x4, ValueType::kS128>,
+
+      &WasmGenerator::op_with_prefix<kExprI8x16SConvertI16x8, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI8x16UConvertI16x8, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8SConvertI32x4, ValueType::kS128,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8UConvertI32x4, ValueType::kS128,
+                                     ValueType::kS128>,
+
+      &WasmGenerator::op_with_prefix<kExprI16x8SConvertI8x16Low,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8SConvertI8x16High,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8UConvertI8x16Low,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI16x8UConvertI8x16High,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4SConvertI16x8Low,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4SConvertI16x8High,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4UConvertI16x8Low,
+                                     ValueType::kS128>,
+      &WasmGenerator::op_with_prefix<kExprI32x4UConvertI16x8High,
+                                     ValueType::kS128>,
+
+      &WasmGenerator::simd_shuffle,
+      &WasmGenerator::op_with_prefix<kExprS8x16Swizzle, ValueType::kS128,
+                                     ValueType::kS128>,
+
+      &WasmGenerator::memop<kExprS128LoadMem>,
+      &WasmGenerator::memop<kExprI16x8Load8x8S>,
+      &WasmGenerator::memop<kExprI16x8Load8x8U>,
+      &WasmGenerator::memop<kExprI32x4Load16x4S>,
+      &WasmGenerator::memop<kExprI32x4Load16x4U>,
+      &WasmGenerator::memop<kExprI64x2Load32x2S>,
+      &WasmGenerator::memop<kExprI64x2Load32x2U>,
+      &WasmGenerator::memop<kExprS8x16LoadSplat>,
+      &WasmGenerator::memop<kExprS16x8LoadSplat>,
+      &WasmGenerator::memop<kExprS32x4LoadSplat>,
+      &WasmGenerator::memop<kExprS64x2LoadSplat>};
 
   GenerateOneOf(alternatives, data);
 }
@@ -1194,14 +1484,87 @@ void WasmGenerator::Generate(ValueType type, DataRange* data) {
   }
 }
 
+std::vector<ValueType> WasmGenerator::GenerateTypes(DataRange* data) {
+  std::vector<ValueType> types;
+  int num_params = int{data->get<uint8_t>()} % (kMaxParameters + 1);
+  for (int i = 0; i < num_params; ++i) {
+    types.push_back(GetValueType(data));
+  }
+  return types;
+}
+
+void WasmGenerator::Generate(Vector<const ValueType> types, DataRange* data) {
+  // Maybe emit a multi-value block with the expected return type. Use a
+  // non-default value to indicate block generation to avoid recursion when we
+  // reach the end of the data.
+  bool generate_block = data->get<uint8_t>() % 32 == 1;
+  if (generate_block) {
+    GeneratorRecursionScope rec_scope(this);
+    if (!recursion_limit_reached()) {
+      const auto param_types = GenerateTypes(data);
+      Generate(VectorOf(param_types), data);
+      any_block(param_types, {types.begin(), types.end()}, data);
+      return;
+    }
+  }
+
+  if (types.size() == 0) {
+    Generate(kWasmStmt, data);
+    return;
+  }
+  if (types.size() == 1) {
+    Generate(types[0], data);
+    return;
+  }
+
+  // Split the types in two halves and recursively generate each half.
+  // Each half is non empty to ensure termination.
+  size_t split_index = data->get<uint8_t>() % (types.size() - 1) + 1;
+  Vector<const ValueType> lower_half(types.begin(), split_index);
+  Vector<const ValueType> upper_half(types.begin() + split_index,
+                                     types.size() - split_index);
+  DataRange first_range = data->split();
+  Generate(lower_half, &first_range);
+  Generate(upper_half, data);
+}
+
+// Emit code to match an arbitrary signature.
+void WasmGenerator::ConsumeAndGenerate(
+    const std::vector<ValueType>& param_types,
+    const std::vector<ValueType>& return_types, DataRange* data) {
+  if (param_types.size() == 0) {
+    Generate(VectorOf(return_types), data);
+    return;
+  }
+  // Keep exactly one of the parameters on the stack with a combination of drops
+  // and selects, convert this value to the first return type, and generate the
+  // remaining types.
+  // TODO(thibaudm): Improve this strategy to potentially generate any sequence
+  // of instructions matching the given signature.
+  size_t return_index = data->get<uint8_t>() % param_types.size();
+  for (size_t i = param_types.size() - 1; i > return_index; --i) {
+    builder_->Emit(kExprDrop);
+  }
+  for (size_t i = return_index; i > 0; --i) {
+    Convert(param_types[i], param_types[i - 1]);
+    builder_->EmitI32Const(0);
+    builder_->Emit(kExprSelect);
+  }
+  if (return_types.empty()) {
+    builder_->Emit(kExprDrop);
+  } else {
+    Convert(param_types[0], return_types[0]);
+    Generate(VectorOf(return_types) + 1, data);
+  }
+}
+
 FunctionSig* GenerateSig(Zone* zone, DataRange* data) {
   // Generate enough parameters to spill some to the stack.
-  constexpr int kMaxParameters = 15;
   int num_params = int{data->get<uint8_t>()} % (kMaxParameters + 1);
-  bool has_return = data->get<bool>();
+  int num_returns = int{data->get<uint8_t>()} % (kMaxReturns + 1);
 
-  FunctionSig::Builder builder(zone, has_return ? 1 : 0, num_params);
-  if (has_return) builder.AddReturn(GetValueType(data));
+  FunctionSig::Builder builder(zone, num_returns, num_params);
+  for (int i = 0; i < num_returns; ++i) builder.AddReturn(GetValueType(data));
   for (int i = 0; i < num_params; ++i) builder.AddParam(GetValueType(data));
   return builder.Build();
 }
@@ -1253,9 +1616,9 @@ class WasmCompileFuzzer : public WasmExecutionFuzzer {
 
       WasmGenerator gen(f, function_signatures, globals, mutable_globals,
                         &function_range);
-      ValueType return_type =
-          sig->return_count() == 0 ? kWasmStmt : sig->GetReturn(0);
-      gen.Generate(return_type, &function_range);
+      Vector<const ValueType> return_types(sig->returns().begin(),
+                                           sig->return_count());
+      gen.Generate(return_types, &function_range);
 
       f->Emit(kExprEnd);
       if (i == 0) builder.AddExport(CStrVector("main"), f);
diff --git a/deps/v8/test/fuzzer/wasm-fuzzer-common.cc b/deps/v8/test/fuzzer/wasm-fuzzer-common.cc
index 590bc1bc173..1c8bafcea2c 100644
--- a/deps/v8/test/fuzzer/wasm-fuzzer-common.cc
+++ b/deps/v8/test/fuzzer/wasm-fuzzer-common.cc
@@ -172,7 +172,14 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
        << glob.mutability << ");\n";
   }
 
-  for (const FunctionSig* sig : module->signatures) {
+  // TODO(7748): Support array/struct types.
+#if DEBUG
+  for (uint8_t kind : module->type_kinds) {
+    DCHECK_EQ(kWasmFunctionTypeCode, kind);
+  }
+#endif
+  for (TypeDefinition type : module->types) {
+    const FunctionSig* sig = type.function_sig;
     os << "builder.addType(makeSig(" << PrintParameters(sig) << ", "
        << PrintReturns(sig) << "));\n";
   }
@@ -191,6 +198,7 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
   }
   for (const WasmElemSegment& elem_segment : module->elem_segments) {
     os << "builder.addElementSegment(";
+    os << elem_segment.table_index << ", ";
     switch (elem_segment.offset.kind) {
       case WasmInitExpr::kGlobalIndex:
         os << elem_segment.offset.val.global_index << ", true";
@@ -251,7 +259,6 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
     os << "assertThrows(function() { builder.instantiate(); }, "
           "WebAssembly.CompileError);\n";
   }
-  os << "\n";
 }
 
 void WasmExecutionFuzzer::FuzzWasmModule(Vector<const uint8_t> data,
diff --git a/deps/v8/test/inspector/debugger/asm-js-breakpoint-before-exec-expected.txt b/deps/v8/test/inspector/debugger/asm-js-breakpoint-before-exec-expected.txt
index c5a8d155c4e..a71c5d0ec51 100644
--- a/deps/v8/test/inspector/debugger/asm-js-breakpoint-before-exec-expected.txt
+++ b/deps/v8/test/inspector/debugger/asm-js-breakpoint-before-exec-expected.txt
@@ -5,7 +5,7 @@ Running test: enableDebugger
 Running test: addScript
 Script nr 1 parsed!
 First script; assuming testFunction.
-Flooding script with breakpoints for the lines 3 to 21...
+Flooding script with breakpoints for the lines 3 to 19...
 Setting breakpoint on line 3
 error: undefined
 Setting breakpoint on line 4
@@ -38,36 +38,26 @@ Setting breakpoint on line 17
 error: undefined
 Setting breakpoint on line 18
 error: undefined
-Setting breakpoint on line 19
-error: undefined
-Setting breakpoint on line 20
-error: undefined
 
 Running test: runTestFunction
 Script nr 2 parsed!
 Paused #1
-  - [0] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":17,"columnNumber":2}
+  - [0] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":17,"columnNumber":12}
   - [1] {"functionName":"","function_lineNumber":0,"function_columnNumber":0,"lineNumber":0,"columnNumber":0}
 Paused #2
   - [0] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":18,"columnNumber":2}
   - [1] {"functionName":"","function_lineNumber":0,"function_columnNumber":0,"lineNumber":0,"columnNumber":0}
 Paused #3
-  - [0] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":19,"columnNumber":12}
-  - [1] {"functionName":"","function_lineNumber":0,"function_columnNumber":0,"lineNumber":0,"columnNumber":0}
-Paused #4
-  - [0] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":20,"columnNumber":2}
-  - [1] {"functionName":"","function_lineNumber":0,"function_columnNumber":0,"lineNumber":0,"columnNumber":0}
-Paused #5
   - [0] {"functionName":"call_debugger","function_lineNumber":13,"function_columnNumber":24,"lineNumber":14,"columnNumber":4}
   - [1] {"functionName":"callDebugger","lineNumber":5,"columnNumber":6}
   - [2] {"functionName":"redirectFun","lineNumber":8,"columnNumber":6}
-  - [3] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":20,"columnNumber":2}
+  - [3] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":18,"columnNumber":2}
   - [4] {"functionName":"","function_lineNumber":0,"function_columnNumber":0,"lineNumber":0,"columnNumber":0}
-Paused #6
+Paused #4
   - [0] {"functionName":"call_debugger","function_lineNumber":13,"function_columnNumber":24,"lineNumber":15,"columnNumber":2}
   - [1] {"functionName":"callDebugger","lineNumber":5,"columnNumber":6}
   - [2] {"functionName":"redirectFun","lineNumber":8,"columnNumber":6}
-  - [3] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":20,"columnNumber":2}
+  - [3] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":18,"columnNumber":2}
   - [4] {"functionName":"","function_lineNumber":0,"function_columnNumber":0,"lineNumber":0,"columnNumber":0}
 
 Running test: finished
diff --git a/deps/v8/test/inspector/debugger/asm-js-breakpoint-before-exec.js b/deps/v8/test/inspector/debugger/asm-js-breakpoint-before-exec.js
index 2b4c8343d52..32182b58072 100644
--- a/deps/v8/test/inspector/debugger/asm-js-breakpoint-before-exec.js
+++ b/deps/v8/test/inspector/debugger/asm-js-breakpoint-before-exec.js
@@ -25,8 +25,6 @@ function testFunction() {
     debugger;
   }
 
-  %PrepareFunctionForOptimization(generateAsmJs);
-  %OptimizeFunctionOnNextCall(generateAsmJs);
   var fun = generateAsmJs(this, {'call_debugger': call_debugger}, undefined);
   fun();
 }
@@ -106,6 +104,13 @@ function handleScriptParsed(messageObject)
 
   var startLine = messageObject.params.startLine + 3;
   var endLine = messageObject.params.endLine;
+  if (startLine > endLine) {
+    InspectorTest.log(
+      `Terminating early: start line ${startLine} is after end line ${endLine}.`
+    );
+    return;
+  }
+
   InspectorTest.log('First script; assuming testFunction.');
   InspectorTest.log(
       'Flooding script with breakpoints for the lines ' + startLine + ' to ' +
diff --git a/deps/v8/test/inspector/debugger/asm-js-breakpoint-during-exec-expected.txt b/deps/v8/test/inspector/debugger/asm-js-breakpoint-during-exec-expected.txt
index 18b61dcf4d3..ac4cfa1485a 100644
--- a/deps/v8/test/inspector/debugger/asm-js-breakpoint-during-exec-expected.txt
+++ b/deps/v8/test/inspector/debugger/asm-js-breakpoint-during-exec-expected.txt
@@ -11,10 +11,10 @@ Paused #1
   - [0] {"functionName":"call_debugger","function_lineNumber":13,"function_columnNumber":24,"lineNumber":14,"columnNumber":4}
   - [1] {"functionName":"callDebugger","lineNumber":5,"columnNumber":6}
   - [2] {"functionName":"redirectFun","lineNumber":8,"columnNumber":6}
-  - [3] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":20,"columnNumber":2}
+  - [3] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":18,"columnNumber":2}
   - [4] {"functionName":"","function_lineNumber":0,"function_columnNumber":0,"lineNumber":0,"columnNumber":0}
 First time paused, setting breakpoints!
-Flooding script with breakpoints for all lines (0 - 24)...
+Flooding script with breakpoints for all lines (0 - 22)...
 Setting breakpoint on line 0
 error: undefined
 Setting breakpoint on line 1
@@ -59,27 +59,23 @@ Setting breakpoint on line 20
 error: undefined
 Setting breakpoint on line 21
 error: undefined
-Setting breakpoint on line 22
-error: undefined
-Setting breakpoint on line 23
-error: undefined
 Script nr 3 parsed!
 Resuming...
 Paused #2
   - [0] {"functionName":"call_debugger","function_lineNumber":13,"function_columnNumber":24,"lineNumber":15,"columnNumber":2}
   - [1] {"functionName":"callDebugger","lineNumber":5,"columnNumber":6}
   - [2] {"functionName":"redirectFun","lineNumber":8,"columnNumber":6}
-  - [3] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":20,"columnNumber":2}
+  - [3] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":18,"columnNumber":2}
   - [4] {"functionName":"","function_lineNumber":0,"function_columnNumber":0,"lineNumber":0,"columnNumber":0}
 Script nr 4 parsed!
 Resuming...
 Paused #3
-  - [0] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":22,"columnNumber":17}
+  - [0] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":20,"columnNumber":17}
   - [1] {"functionName":"","function_lineNumber":0,"function_columnNumber":0,"lineNumber":0,"columnNumber":0}
 Script nr 5 parsed!
 Resuming...
 Paused #4
-  - [0] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":23,"columnNumber":2}
+  - [0] {"functionName":"testFunction","function_lineNumber":0,"function_columnNumber":21,"lineNumber":21,"columnNumber":2}
   - [1] {"functionName":"","function_lineNumber":0,"function_columnNumber":0,"lineNumber":0,"columnNumber":0}
 Script nr 6 parsed!
 Resuming...
diff --git a/deps/v8/test/inspector/debugger/asm-js-breakpoint-during-exec.js b/deps/v8/test/inspector/debugger/asm-js-breakpoint-during-exec.js
index 5a5d1fcf69f..e10c25513a8 100644
--- a/deps/v8/test/inspector/debugger/asm-js-breakpoint-during-exec.js
+++ b/deps/v8/test/inspector/debugger/asm-js-breakpoint-during-exec.js
@@ -25,8 +25,6 @@ function testFunction() {
     debugger;
   }
 
-  %PrepareFunctionForOptimization(generateAsmJs);
-  %OptimizeFunctionOnNextCall(generateAsmJs);
   var fun = generateAsmJs(this, {'call_debugger': call_debugger}, undefined);
   fun();
 
diff --git a/deps/v8/test/inspector/debugger/object-preview-internal-properties-expected.txt b/deps/v8/test/inspector/debugger/object-preview-internal-properties-expected.txt
index d21ebc783e1..be4e104424c 100644
--- a/deps/v8/test/inspector/debugger/object-preview-internal-properties-expected.txt
+++ b/deps/v8/test/inspector/debugger/object-preview-internal-properties-expected.txt
@@ -40,24 +40,24 @@ expression: Object(BigInt(2))
 Running test: promise
 expression: Promise.resolve(42)
 {
-    name : [[PromiseStatus]]
+    name : [[PromiseState]]
     type : string
-    value : resolved
+    value : fulfilled
 }
 {
-    name : [[PromiseValue]]
+    name : [[PromiseResult]]
     type : number
     value : 42
 }
 
 expression: new Promise(() => undefined)
 {
-    name : [[PromiseStatus]]
+    name : [[PromiseState]]
     type : string
     value : pending
 }
 {
-    name : [[PromiseValue]]
+    name : [[PromiseResult]]
     type : undefined
     value : undefined
 }
@@ -66,7 +66,7 @@ expression: new Promise(() => undefined)
 Running test: generatorObject
 expression: (function* foo() { yield 1 })()
 {
-    name : [[GeneratorStatus]]
+    name : [[GeneratorState]]
     type : string
     value : suspended
 }
@@ -249,12 +249,12 @@ expression: ({})
 Running test: overridenArrayGetter
 expression: Promise.resolve(42)
 {
-    name : [[PromiseStatus]]
+    name : [[PromiseState]]
     type : string
-    value : resolved
+    value : fulfilled
 }
 {
-    name : [[PromiseValue]]
+    name : [[PromiseResult]]
     type : number
     value : 42
 }
diff --git a/deps/v8/test/inspector/debugger/wasm-anyref-global.js b/deps/v8/test/inspector/debugger/wasm-anyref-global.js
index 1c47cfc8d8d..bf64649afb9 100644
--- a/deps/v8/test/inspector/debugger/wasm-anyref-global.js
+++ b/deps/v8/test/inspector/debugger/wasm-anyref-global.js
@@ -57,16 +57,17 @@ let {session, contextGroup, Protocol} =
     InspectorTest.log('Paused in debugger.');
     let scopeChain = callFrames[0].scopeChain;
     for (let scope of scopeChain) {
-      if (scope.type != 'global') continue;
+      if (scope.type != 'module') continue;
 
-      let globalObjectProps = (await Protocol.Runtime.getProperties({
+      let moduleObjectProps = (await Protocol.Runtime.getProperties({
                               'objectId': scope.object.objectId
                             })).result.result;
 
-      for (let prop of globalObjectProps) {
+      for (let prop of moduleObjectProps) {
+        if (prop.name != 'globals') continue;
         let subProps = (await Protocol.Runtime.getProperties({
-                              objectId: prop.value.objectId
-                            })).result.result;
+                            objectId: prop.value.objectId
+                          })).result.result;
         let values =
             subProps.map((value) => `"${value.name}": ${value.value.value}`)
                 .join(', ');
diff --git a/deps/v8/test/inspector/debugger/wasm-breakpoint-reset-on-debugger-restart-expected.txt b/deps/v8/test/inspector/debugger/wasm-breakpoint-reset-on-debugger-restart-expected.txt
new file mode 100644
index 00000000000..20d0e846bd5
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-breakpoint-reset-on-debugger-restart-expected.txt
@@ -0,0 +1,11 @@
+Test that breakpoints do not survive a restart of the debugger.
+Instantiating.
+Waiting for wasm script (ignoring first non-wasm script).
+Setting breakpoint.
+Calling func.
+Script wasm://wasm/8c388106 byte offset 33: Wasm opcode 0x01
+func returned.
+Restarting debugger.
+Calling func.
+func returned.
+Finished.
diff --git a/deps/v8/test/inspector/debugger/wasm-breakpoint-reset-on-debugger-restart.js b/deps/v8/test/inspector/debugger/wasm-breakpoint-reset-on-debugger-restart.js
new file mode 100644
index 00000000000..116f048dc3b
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-breakpoint-reset-on-debugger-restart.js
@@ -0,0 +1,63 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const {session, contextGroup, Protocol} = InspectorTest.start(
+    'Test that breakpoints do not survive a restart of the debugger.');
+session.setupScriptMap();
+
+utils.load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+
+const func =
+    builder.addFunction('func', kSig_v_v).addBody([kExprNop]).exportFunc();
+
+const module_bytes = JSON.stringify(builder.toArray());
+
+function instantiate(bytes) {
+  let buffer = new ArrayBuffer(bytes.length);
+  let view = new Uint8Array(buffer);
+  for (let i = 0; i < bytes.length; ++i) {
+    view[i] = bytes[i] | 0;
+  }
+
+  let module = new WebAssembly.Module(buffer);
+  return new WebAssembly.Instance(module);
+}
+contextGroup.addScript(instantiate.toString());
+
+Protocol.Debugger.onPaused(async msg => {
+  await session.logSourceLocation(msg.params.callFrames[0].location);
+  Protocol.Debugger.resume();
+});
+
+(async function test() {
+  await Protocol.Debugger.enable();
+  InspectorTest.log('Instantiating.');
+  // Spawn asynchronously:
+  Protocol.Runtime.evaluate(
+      {'expression': `const instance = instantiate(${module_bytes});`});
+  InspectorTest.log(
+      'Waiting for wasm script (ignoring first non-wasm script).');
+  const [, {params: wasm_script}] = await Protocol.Debugger.onceScriptParsed(2);
+  InspectorTest.log('Setting breakpoint.');
+  await Protocol.Debugger.setBreakpoint({
+    'location': {
+      'scriptId': wasm_script.scriptId,
+      'lineNumber': 0,
+      'columnNumber': func.body_offset
+    }
+  });
+  for (let run of [0, 1]) {
+    InspectorTest.log('Calling func.');
+    await Protocol.Runtime.evaluate({'expression': 'instance.exports.func()'});
+    InspectorTest.log('func returned.');
+    if (run == 1) continue;
+    InspectorTest.log('Restarting debugger.');
+    await Protocol.Debugger.disable();
+    await Protocol.Debugger.enable();
+  }
+  InspectorTest.log('Finished.');
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/wasm-debug-evaluate-expected.txt b/deps/v8/test/inspector/debugger/wasm-debug-evaluate-expected.txt
new file mode 100644
index 00000000000..de08ecbf026
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-debug-evaluate-expected.txt
@@ -0,0 +1,5 @@
+Tests wasm debug-evaluate
+Test: TestGetMemory
+Result: 2
+Expected: 2
+Finished!
diff --git a/deps/v8/test/inspector/debugger/wasm-debug-evaluate.js b/deps/v8/test/inspector/debugger/wasm-debug-evaluate.js
new file mode 100644
index 00000000000..e9776ce81ea
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-debug-evaluate.js
@@ -0,0 +1,155 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --wasm-expose-debug-eval
+
+const {session, contextGroup, Protocol} =
+    InspectorTest.start('Tests wasm debug-evaluate');
+
+utils.load('test/mjsunit/wasm/wasm-module-builder.js');
+
+function instantiate(bytes) {
+  let buffer = new ArrayBuffer(bytes.length);
+  let view = new Uint8Array(buffer);
+  for (let i = 0; i < bytes.length; ++i) {
+    view[i] = bytes[i] | 0;
+  }
+
+  let module = new WebAssembly.Module(buffer);
+  return new WebAssembly.Instance(module);
+}
+contextGroup.addScript(instantiate.toString());
+
+function printFailure(message) {
+  if (!message.result) {
+    InspectorTest.logMessage(message);
+  }
+  return message;
+}
+
+async function getWasmScript() {
+  while (true) {
+    const script = await Protocol.Debugger.onceScriptParsed();
+    if (script.params.url.startsWith('wasm://')) return script.params;
+  }
+}
+
+async function handleDebuggerPaused(data, messageObject) {
+  const topFrameId = messageObject.params.callFrames[0].callFrameId;
+  const params = {callFrameId: topFrameId, evaluator: data};
+  try {
+    const evalResult = await Protocol.Debugger.executeWasmEvaluator(params);
+    InspectorTest.log('Result: ' + evalResult.result.result.value);
+  } catch (err) {
+    InspectorTest.log(
+        'Eval failed: ' + err + '\nGot: ' + JSON.stringify(evalResult));
+  }
+  await Protocol.Debugger.resume();
+}
+
+async function runTest(testName, breakLine, debuggeeBytes, snippetBytes) {
+  try {
+    await Protocol.Debugger.onPaused(
+        handleDebuggerPaused.bind(null, snippetBytes));
+    InspectorTest.log('Test: ' + testName);
+    const scriptListener = getWasmScript();
+    const module = JSON.stringify(debuggeeBytes);
+    await Protocol.Runtime.evaluate(
+        {'expression': `const instance = instantiate(${module})`});
+    const script = await scriptListener;
+    const msg = await Protocol.Debugger.setBreakpoint({
+      'location': {
+        'scriptId': script.scriptId,
+        'lineNumber': 0,
+        'columnNumber': breakLine
+      }
+    });
+    printFailure(msg);
+    const eval = await Protocol.Runtime.evaluate(
+        {'expression': 'instance.exports.main()'});
+    InspectorTest.log(
+        'Expected: ' + String.fromCharCode(eval.result.result.value));
+    InspectorTest.log('Finished!');
+  } catch (err) {
+    InspectorTest.log(err.message);
+  }
+}
+
+// copied from v8
+function encode64(data) {
+  const BASE =
+      'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+  const PAD = '=';
+  var ret = '';
+  var leftchar = 0;
+  var leftbits = 0;
+  for (var i = 0; i < data.length; i++) {
+    leftchar = (leftchar << 8) | data[i];
+    leftbits += 8;
+    while (leftbits >= 6) {
+      const curr = (leftchar >> (leftbits - 6)) & 0x3f;
+      leftbits -= 6;
+      ret += BASE[curr];
+    }
+  }
+  if (leftbits == 2) {
+    ret += BASE[(leftchar & 3) << 4];
+    ret += PAD + PAD;
+  } else if (leftbits == 4) {
+    ret += BASE[(leftchar & 0xf) << 2];
+    ret += PAD;
+  }
+  return ret;
+}
+
+(async () => {
+  try {
+    await Protocol.Debugger.enable();
+
+    await (async function TestGetMemory() {
+      const debuggee_builder = new WasmModuleBuilder();
+      debuggee_builder.addMemory(256, 256);
+      const mainFunc =
+          debuggee_builder.addFunction('main', kSig_i_v)
+              .addBody([
+                // clang-format off
+                kExprI32Const, 32,
+                kExprI32Const, 50,
+                kExprI32StoreMem, 0, 0,
+                kExprI32Const, 32,
+                kExprI32LoadMem, 0, 0,
+                kExprReturn
+                // clang-format on
+              ])
+              .exportAs('main');
+
+      const snippet_builder = new WasmModuleBuilder();
+      snippet_builder.addMemory(1, 1);
+      const getMemoryIdx = snippet_builder.addImport(
+          'env', '__getMemory', makeSig([kWasmI32, kWasmI32, kWasmI32], []));
+      const heapBase = 32;  // Just pick some position in memory
+      snippet_builder.addFunction('wasm_format', kSig_i_v)
+          .addBody([
+            // clang-format off
+            // __getMemory(32, 4, heapBase)
+            kExprI32Const, 32, kExprI32Const, 4, kExprI32Const, heapBase,
+            kExprCallFunction, getMemoryIdx,
+            // return heapBase
+            kExprI32Const, heapBase,
+            kExprReturn
+            // clang-format on
+          ])
+          .exportAs('wasm_format');
+
+      const debuggeeModule = debuggee_builder.toArray();
+      await runTest(
+          'TestGetMemory', mainFunc.body_offset + 9, debuggeeModule,
+          encode64(snippet_builder.toArray()));
+    })();
+
+  } catch (err) {
+    InspectorTest.log(err)
+  }
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/wasm-global-names.js b/deps/v8/test/inspector/debugger/wasm-global-names.js
index 22d0eb30ea4..70e6b0f8dda 100644
--- a/deps/v8/test/inspector/debugger/wasm-global-names.js
+++ b/deps/v8/test/inspector/debugger/wasm-global-names.js
@@ -58,16 +58,16 @@ function test(moduleBytes) {
     InspectorTest.log('Paused in debugger.');
     let scopeChain = callFrames[0].scopeChain;
     for (let scope of scopeChain) {
-      if (scope.type != 'global') continue;
-
-      let globalObjectProps = (await Protocol.Runtime.getProperties({
+      if (scope.type != 'module') continue;
+      let moduleObjectProps = (await Protocol.Runtime.getProperties({
                                 'objectId': scope.object.objectId
                               })).result.result;
 
-      for (let prop of globalObjectProps) {
+      for (let prop of moduleObjectProps) {
+        if (prop.name != 'globals') continue;
         let subProps = (await Protocol.Runtime.getProperties({
-                         objectId: prop.value.objectId
-                       })).result.result;
+                        objectId: prop.value.objectId
+                      })).result.result;
         let values = subProps.map((value) => `"${value.name}"`).join(', ');
         InspectorTest.log(`   ${prop.name}: {${values}}`);
       }
diff --git a/deps/v8/test/inspector/debugger/wasm-inspect-many-registers-expected.txt b/deps/v8/test/inspector/debugger/wasm-inspect-many-registers-expected.txt
index 04c48c92f63..ed457e29c4e 100644
--- a/deps/v8/test/inspector/debugger/wasm-inspect-many-registers-expected.txt
+++ b/deps/v8/test/inspector/debugger/wasm-inspect-many-registers-expected.txt
@@ -4,100 +4,100 @@ Testing i32.
 Waiting for wasm script.
 Setting 20 breakpoints.
 Calling main.
-Paused at offset 48; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : []
-Paused at offset 50; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0]
-Paused at offset 52; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1]
-Paused at offset 54; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2]
-Paused at offset 56; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3]
-Paused at offset 58; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4]
-Paused at offset 60; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5]
-Paused at offset 62; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6]
-Paused at offset 64; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7]
-Paused at offset 66; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7, 8]
-Paused at offset 68; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
-Paused at offset 69; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7, 17]
-Paused at offset 70; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 24]
-Paused at offset 71; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 30]
-Paused at offset 72; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 35]
-Paused at offset 73; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 39]
-Paused at offset 74; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 42]
-Paused at offset 75; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 44]
-Paused at offset 76; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 45]
-Paused at offset 77; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [45]
+Paused at offset 48; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: []
+Paused at offset 50; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0]
+Paused at offset 52; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1]
+Paused at offset 54; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2]
+Paused at offset 56; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3]
+Paused at offset 58; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4]
+Paused at offset 60; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5]
+Paused at offset 62; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6]
+Paused at offset 64; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7]
+Paused at offset 66; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7, 8]
+Paused at offset 68; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
+Paused at offset 69; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7, 17]
+Paused at offset 70; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 24]
+Paused at offset 71; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 30]
+Paused at offset 72; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 35]
+Paused at offset 73; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 39]
+Paused at offset 74; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 42]
+Paused at offset 75; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 44]
+Paused at offset 76; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 45]
+Paused at offset 77; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [45]
 main returned.
 Testing i64.
 Waiting for wasm script.
 Setting 20 breakpoints.
 Calling main.
-Paused at offset 48; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : []
-Paused at offset 50; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0]
-Paused at offset 52; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1]
-Paused at offset 54; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2]
-Paused at offset 56; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3]
-Paused at offset 58; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4]
-Paused at offset 60; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5]
-Paused at offset 62; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6]
-Paused at offset 64; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7]
-Paused at offset 66; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7, 8]
-Paused at offset 68; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
-Paused at offset 69; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7, 17]
-Paused at offset 70; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 24]
-Paused at offset 71; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 30]
-Paused at offset 72; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 35]
-Paused at offset 73; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 39]
-Paused at offset 74; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 42]
-Paused at offset 75; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 44]
-Paused at offset 76; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 45]
-Paused at offset 77; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [45]
+Paused at offset 48; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: []
+Paused at offset 50; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0]
+Paused at offset 52; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1]
+Paused at offset 54; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2]
+Paused at offset 56; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3]
+Paused at offset 58; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4]
+Paused at offset 60; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5]
+Paused at offset 62; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6]
+Paused at offset 64; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7]
+Paused at offset 66; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7, 8]
+Paused at offset 68; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
+Paused at offset 69; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7, 17]
+Paused at offset 70; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 24]
+Paused at offset 71; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 30]
+Paused at offset 72; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 35]
+Paused at offset 73; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 39]
+Paused at offset 74; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 42]
+Paused at offset 75; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 44]
+Paused at offset 76; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 45]
+Paused at offset 77; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [45]
 main returned.
 Testing f32.
 Waiting for wasm script.
 Setting 20 breakpoints.
 Calling main.
-Paused at offset 48; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : []
-Paused at offset 50; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0]
-Paused at offset 52; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1]
-Paused at offset 54; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2]
-Paused at offset 56; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3]
-Paused at offset 58; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4]
-Paused at offset 60; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5]
-Paused at offset 62; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6]
-Paused at offset 64; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7]
-Paused at offset 66; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7, 8]
-Paused at offset 68; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
-Paused at offset 69; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7, 17]
-Paused at offset 70; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 24]
-Paused at offset 71; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 30]
-Paused at offset 72; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 35]
-Paused at offset 73; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 39]
-Paused at offset 74; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 42]
-Paused at offset 75; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 44]
-Paused at offset 76; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 45]
-Paused at offset 77; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [45]
+Paused at offset 48; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: []
+Paused at offset 50; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0]
+Paused at offset 52; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1]
+Paused at offset 54; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2]
+Paused at offset 56; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3]
+Paused at offset 58; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4]
+Paused at offset 60; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5]
+Paused at offset 62; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6]
+Paused at offset 64; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7]
+Paused at offset 66; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7, 8]
+Paused at offset 68; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
+Paused at offset 69; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7, 17]
+Paused at offset 70; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 24]
+Paused at offset 71; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 30]
+Paused at offset 72; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 35]
+Paused at offset 73; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 39]
+Paused at offset 74; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 42]
+Paused at offset 75; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 44]
+Paused at offset 76; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 45]
+Paused at offset 77; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [45]
 main returned.
 Testing f64.
 Waiting for wasm script.
 Setting 20 breakpoints.
 Calling main.
-Paused at offset 48; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : []
-Paused at offset 50; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0]
-Paused at offset 52; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1]
-Paused at offset 54; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2]
-Paused at offset 56; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3]
-Paused at offset 58; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4]
-Paused at offset 60; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5]
-Paused at offset 62; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6]
-Paused at offset 64; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7]
-Paused at offset 66; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7, 8]
-Paused at offset 68; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
-Paused at offset 69; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 7, 17]
-Paused at offset 70; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 6, 24]
-Paused at offset 71; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 5, 30]
-Paused at offset 72; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 4, 35]
-Paused at offset 73; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 3, 39]
-Paused at offset 74; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 2, 42]
-Paused at offset 75; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 1, 44]
-Paused at offset 76; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [0, 45]
-Paused at offset 77; locals : [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; stack : [45]
+Paused at offset 48; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: []
+Paused at offset 50; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0]
+Paused at offset 52; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1]
+Paused at offset 54; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2]
+Paused at offset 56; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3]
+Paused at offset 58; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4]
+Paused at offset 60; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5]
+Paused at offset 62; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6]
+Paused at offset 64; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7]
+Paused at offset 66; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7, 8]
+Paused at offset 68; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
+Paused at offset 69; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 7, 17]
+Paused at offset 70; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 6, 24]
+Paused at offset 71; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 5, 30]
+Paused at offset 72; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 4, 35]
+Paused at offset 73; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 3, 39]
+Paused at offset 74; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 2, 42]
+Paused at offset 75; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 1, 44]
+Paused at offset 76; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [0, 45]
+Paused at offset 77; locals: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; wasm-expression-stack: [45]
 main returned.
 Finished!
diff --git a/deps/v8/test/inspector/debugger/wasm-inspect-many-registers.js b/deps/v8/test/inspector/debugger/wasm-inspect-many-registers.js
index a8f8b65586f..09b9acef2b0 100644
--- a/deps/v8/test/inspector/debugger/wasm-inspect-many-registers.js
+++ b/deps/v8/test/inspector/debugger/wasm-inspect-many-registers.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --debug-in-liftoff
-
 const {session, contextGroup, Protocol} =
     InspectorTest.start('Test inspecting register values in Liftoff.');
 
@@ -31,24 +29,33 @@ function instantiate(bytes) {
 const evalWithUrl = (code, url) => Protocol.Runtime.evaluate(
     {'expression': code + '\n//# sourceURL=v8://test/' + url});
 
+function getWasmValue(value) {
+  return typeof (value.value) === 'undefined' ? value.unserializableValue :
+                                                value.value;
+}
+
 Protocol.Debugger.onPaused(async msg => {
   let loc = msg.params.callFrames[0].location;
   let line = [`Paused at offset ${loc.columnNumber}`];
   // Inspect only the top wasm frame.
   var frame = msg.params.callFrames[0];
   for (var scope of frame.scopeChain) {
-    if (scope.type != 'local') continue;
+    if (scope.type == 'module') continue;
     var scope_properties =
         await Protocol.Runtime.getProperties({objectId: scope.object.objectId});
-    for (var value of scope_properties.result.result) {
-      let msg = await Protocol.Runtime.getProperties(
+    if (scope.type == 'local') {
+      for (var value of scope_properties.result.result) {
+        let msg = await Protocol.Runtime.getProperties(
           {objectId: value.value.objectId});
-      let str = msg.result.result.map(elem => elem.value.value).join(', ');
-      line.push(`${value.name} : [${str}]`);
+        let str = msg.result.result.map(elem => getWasmValue(elem.value)).join(', ');
+        line.push(`${value.name}: [${str}]`);
+      }
+    } else {
+      let str = scope_properties.result.result.map(elem => getWasmValue(elem.value)).join(', ');
+      line.push(`${scope.type}: [${str}]`);
     }
-    InspectorTest.log(line.join('; '));
   }
-
+  InspectorTest.log(line.join('; '));
   Protocol.Debugger.resume();
 });
 
diff --git a/deps/v8/test/inspector/debugger/wasm-memory-names-expected.txt b/deps/v8/test/inspector/debugger/wasm-memory-names-expected.txt
new file mode 100644
index 00000000000..e73262b9ab2
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-memory-names-expected.txt
@@ -0,0 +1,19 @@
+Test wasm memory names
+Waiting for wasm script to be parsed.
+Setting breakpoint in wasm.
+Running main.
+Paused in debugger.
+name: memory0
+Finished.
+Waiting for wasm script to be parsed.
+Setting breakpoint in wasm.
+Running main.
+Paused in debugger.
+name: exported_memory
+Finished.
+Waiting for wasm script to be parsed.
+Setting breakpoint in wasm.
+Running main.
+Paused in debugger.
+name: module_name.imported_mem
+Finished.
diff --git a/deps/v8/test/inspector/debugger/wasm-memory-names.js b/deps/v8/test/inspector/debugger/wasm-memory-names.js
new file mode 100644
index 00000000000..9906c8d8af8
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-memory-names.js
@@ -0,0 +1,118 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} =
+    InspectorTest.start('Test wasm memory names');
+
+utils.load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let func;
+
+// No name memory.
+function createModuleBytesUnnamedMemory() {
+  let builder = new WasmModuleBuilder();
+  builder.addMemory(1, 1);
+  func = builder.addFunction('main', kSig_i_i)
+             .addBody([kExprI32Const, 0, kExprI32LoadMem, 0, 0])
+             .exportAs('main');
+
+  return JSON.stringify(builder.toArray());
+}
+
+// Exported memory.
+function createModuleBytesExportedMemory() {
+  let builder = new WasmModuleBuilder();
+  var memory = builder.addMemory(1, 1);
+  builder.addExportOfKind('exported_memory', kExternalMemory);
+  func = builder.addFunction('main', kSig_i_i)
+             .addBody([kExprI32Const, 0, kExprI32LoadMem, 0, 0])
+             .exportAs('main');
+
+  return JSON.stringify(builder.toArray());
+}
+
+// Imported memory.
+function createModuleBytesImportedMemory() {
+  let builder = new WasmModuleBuilder();
+  builder.addImportedMemory('module_name', 'imported_mem', 0, 1);
+  func = builder.addFunction('main', kSig_i_i)
+             .addBody([kExprI32Const, 0, kExprI32LoadMem, 0, 0])
+             .exportAs('main');
+
+  return JSON.stringify(builder.toArray());
+}
+
+function createInstance(moduleBytes) {
+  let module = new WebAssembly.Module((new Uint8Array(moduleBytes)).buffer);
+  let memory = new WebAssembly.Memory({initial: 1, maximum: 1});
+  instance =
+      new WebAssembly.Instance(module, {module_name: {imported_mem: memory}});
+}
+
+async function logMemoryName(msg, Protocol) {
+  let callFrames = msg.params.callFrames;
+  InspectorTest.log('Paused in debugger.');
+
+  let scopeChain = callFrames[0].scopeChain;
+  for (let scope of scopeChain) {
+    if (scope.type != 'module') continue;
+    let moduleObjectProps = (await Protocol.Runtime.getProperties({
+                              'objectId': scope.object.objectId
+                            })).result.result;
+
+    for (let prop of moduleObjectProps) {
+      if (prop.name == 'instance') continue;
+      InspectorTest.log(`name: ${prop.name}`);
+    }
+  }
+}
+
+async function check(moduleBytes) {
+  Protocol.Runtime.evaluate({
+    expression: `
+    createInstance(${moduleBytes});`
+  });
+
+  InspectorTest.log('Waiting for wasm script to be parsed.');
+  let scriptId;
+  while (true) {
+    let msg = await Protocol.Debugger.onceScriptParsed();
+    if (msg.params.url.startsWith('wasm://')) {
+      scriptId = msg.params.scriptId;
+      break;
+    }
+  }
+
+  InspectorTest.log('Setting breakpoint in wasm.');
+  await Protocol.Debugger.setBreakpoint(
+      {location: {scriptId, lineNumber: 0, columnNumber: func.body_offset}});
+
+  InspectorTest.log('Running main.');
+  Protocol.Runtime.evaluate({expression: 'instance.exports.main()'});
+
+  let msg = await Protocol.Debugger.oncePaused();
+  await logMemoryName(msg, Protocol);
+  await Protocol.Debugger.resume();
+
+  InspectorTest.log('Finished.');
+}
+
+contextGroup.addScript(`
+  let instance;
+  ${createInstance.toString()}`);
+
+(async function test() {
+  try {
+    Protocol.Debugger.enable();
+
+    await check(createModuleBytesUnnamedMemory());
+    await check(createModuleBytesExportedMemory());
+    await check(createModuleBytesImportedMemory());
+
+  } catch (exc) {
+    InspectorTest.log(`Failed with exception: ${exc}.`);
+  } finally {
+    InspectorTest.completeTest();
+  }
+})();
diff --git a/deps/v8/test/inspector/debugger/wasm-scope-info-expected.txt b/deps/v8/test/inspector/debugger/wasm-scope-info-expected.txt
index 45bff036b7f..3eacab4ba15 100644
--- a/deps/v8/test/inspector/debugger/wasm-scope-info-expected.txt
+++ b/deps/v8/test/inspector/debugger/wasm-scope-info-expected.txt
@@ -4,388 +4,423 @@ Waiting for wasm script to be parsed.
 Got wasm script!
 Setting breakpoint on first instruction of second function
 {
-    columnNumber : 69
+    columnNumber : 134
     lineNumber : 0
     scriptId : <scriptId>
 }
 Paused:
-Script wasm://wasm/d374ef0a byte offset 69: Wasm opcode 0x41
+Script wasm://wasm/2d24c81e byte offset 134: Wasm opcode 0x41
 Scope:
-at func (0:69):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:134):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 4 (number), "var1": 0 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
-   stack: 
+   locals: "0": 0 (f64), "i32Arg": 4 (i32), "var1": 0 (i32), "i64_local": 0 (i64), "unicode☼f64": 0 (f64)
  - scope (wasm-expression-stack):
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 71: Wasm opcode 0x21
+Script wasm://wasm/2d24c81e byte offset 136: Wasm opcode 0x21
 Scope:
-at func (0:71):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:136):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 4 (number), "var1": 0 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
-   stack: "0": 11 (number)
+   locals: "0": 0 (f64), "i32Arg": 4 (i32), "var1": 0 (i32), "i64_local": 0 (i64), "unicode☼f64": 0 (f64)
  - scope (wasm-expression-stack):
-   0: 11 (number)
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+   0: 11 (i32)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 73: Wasm opcode 0x41
+Script wasm://wasm/2d24c81e byte offset 138: Wasm opcode 0x41
 Scope:
-at func (0:73):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:138):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 11 (number), "var1": 0 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
-   stack: 
+   locals: "0": 0 (f64), "i32Arg": 11 (i32), "var1": 0 (i32), "i64_local": 0 (i64), "unicode☼f64": 0 (f64)
  - scope (wasm-expression-stack):
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 75: Wasm opcode 0x21
+Script wasm://wasm/2d24c81e byte offset 140: Wasm opcode 0x21
 Scope:
-at func (0:75):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:140):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 11 (number), "var1": 0 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
-   stack: "0": 47 (number)
+   locals: "0": 0 (f64), "i32Arg": 11 (i32), "var1": 0 (i32), "i64_local": 0 (i64), "unicode☼f64": 0 (f64)
  - scope (wasm-expression-stack):
-   0: 47 (number)
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+   0: 47 (i32)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 77: Wasm opcode 0x42
+Script wasm://wasm/2d24c81e byte offset 142: Wasm opcode 0x42
 Scope:
-at func (0:77):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:142):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 11 (number), "var1": 47 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
-   stack: 
+   locals: "0": 0 (f64), "i32Arg": 11 (i32), "var1": 47 (i32), "i64_local": 0 (i64), "unicode☼f64": 0 (f64)
  - scope (wasm-expression-stack):
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 88: Wasm opcode 0x21
+Script wasm://wasm/2d24c81e byte offset 153: Wasm opcode 0x21
 Scope:
-at func (0:88):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:153):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 11 (number), "var1": 47 (number), "i64_local": 0 (number), "unicode☼f64": 0 (number)
-   stack: "0": 9223372036854775807 (string)
+   locals: "0": 0 (f64), "i32Arg": 11 (i32), "var1": 47 (i32), "i64_local": 0 (i64), "unicode☼f64": 0 (f64)
  - scope (wasm-expression-stack):
-   0: 9223372036854775807 (string)
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+   0: 9223372036854775807 (i64)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 90: Wasm opcode 0x42
+Script wasm://wasm/2d24c81e byte offset 155: Wasm opcode 0x42
 Scope:
-at func (0:90):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:155):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 11 (number), "var1": 47 (number), "i64_local": 9223372036854775807 (string), "unicode☼f64": 0 (number)
-   stack: 
+   locals: "0": 0 (f64), "i32Arg": 11 (i32), "var1": 47 (i32), "i64_local": 9223372036854775807 (i64), "unicode☼f64": 0 (f64)
  - scope (wasm-expression-stack):
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 101: Wasm opcode 0x21
+Script wasm://wasm/2d24c81e byte offset 166: Wasm opcode 0x21
 Scope:
-at func (0:101):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:166):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 11 (number), "var1": 47 (number), "i64_local": 9223372036854775807 (string), "unicode☼f64": 0 (number)
-   stack: "0": -9223372036854775808 (string)
+   locals: "0": 0 (f64), "i32Arg": 11 (i32), "var1": 47 (i32), "i64_local": 9223372036854775807 (i64), "unicode☼f64": 0 (f64)
  - scope (wasm-expression-stack):
-   0: -9223372036854775808 (string)
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+   0: -9223372036854775808 (i64)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 103: Wasm opcode 0x41
+Script wasm://wasm/2d24c81e byte offset 168: Wasm opcode 0x41
 Scope:
-at func (0:103):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:168):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 11 (number), "var1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
-   stack: 
+   locals: "0": 0 (f64), "i32Arg": 11 (i32), "var1": 47 (i32), "i64_local": -9223372036854775808 (i64), "unicode☼f64": 0 (f64)
  - scope (wasm-expression-stack):
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 105: Wasm opcode 0xb8
+Script wasm://wasm/2d24c81e byte offset 170: Wasm opcode 0xb8
 Scope:
-at func (0:105):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:170):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 11 (number), "var1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
-   stack: "0": 1 (number)
+   locals: "0": 0 (f64), "i32Arg": 11 (i32), "var1": 47 (i32), "i64_local": -9223372036854775808 (i64), "unicode☼f64": 0 (f64)
  - scope (wasm-expression-stack):
-   0: 1 (number)
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+   0: 1 (i32)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 106: Wasm opcode 0x41
+Script wasm://wasm/2d24c81e byte offset 171: Wasm opcode 0x41
 Scope:
-at func (0:106):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:171):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 11 (number), "var1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
-   stack: "0": 1 (number)
+   locals: "0": 0 (f64), "i32Arg": 11 (i32), "var1": 47 (i32), "i64_local": -9223372036854775808 (i64), "unicode☼f64": 0 (f64)
  - scope (wasm-expression-stack):
-   0: 1 (number)
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+   0: 1 (f64)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 108: Wasm opcode 0xb8
+Script wasm://wasm/2d24c81e byte offset 173: Wasm opcode 0xb8
 Scope:
-at func (0:108):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:173):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 11 (number), "var1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
-   stack: "0": 1 (number), "1": 7 (number)
+   locals: "0": 0 (f64), "i32Arg": 11 (i32), "var1": 47 (i32), "i64_local": -9223372036854775808 (i64), "unicode☼f64": 0 (f64)
  - scope (wasm-expression-stack):
-   0: 1 (number)
-   1: 7 (number)
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+   0: 1 (f64)
+   1: 7 (i32)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 109: Wasm opcode 0xa3
+Script wasm://wasm/2d24c81e byte offset 174: Wasm opcode 0xa3
 Scope:
-at func (0:109):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:174):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 11 (number), "var1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
-   stack: "0": 1 (number), "1": 7 (number)
+   locals: "0": 0 (f64), "i32Arg": 11 (i32), "var1": 47 (i32), "i64_local": -9223372036854775808 (i64), "unicode☼f64": 0 (f64)
  - scope (wasm-expression-stack):
-   0: 1 (number)
-   1: 7 (number)
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+   0: 1 (f64)
+   1: 7 (f64)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 110: Wasm opcode 0x21
+Script wasm://wasm/2d24c81e byte offset 175: Wasm opcode 0x21
 Scope:
-at func (0:110):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:175):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 11 (number), "var1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0 (number)
-   stack: "0": 0.14285714285714285 (number)
+   locals: "0": 0 (f64), "i32Arg": 11 (i32), "var1": 47 (i32), "i64_local": -9223372036854775808 (i64), "unicode☼f64": 0 (f64)
  - scope (wasm-expression-stack):
-   0: 0.14285714285714285 (number)
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+   0: 0.14285714285714285 (f64)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 112: Wasm opcode 0x41
+Script wasm://wasm/2d24c81e byte offset 177: Wasm opcode 0x41
 Scope:
-at func (0:112):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:177):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 11 (number), "var1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0.14285714285714285 (number)
-   stack: 
+   locals: "0": 0 (f64), "i32Arg": 11 (i32), "var1": 47 (i32), "i64_local": -9223372036854775808 (i64), "unicode☼f64": 0.14285714285714285 (f64)
  - scope (wasm-expression-stack):
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 114: Wasm opcode 0x24
+Script wasm://wasm/2d24c81e byte offset 179: Wasm opcode 0x24
 Scope:
-at func (0:114):
- - scope (global):
-   globals: "global0": 0 (number)
+at func (0:179):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 11 (number), "var1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0.14285714285714285 (number)
-   stack: "0": 15 (number)
+   locals: "0": 0 (f64), "i32Arg": 11 (i32), "var1": 47 (i32), "i64_local": -9223372036854775808 (i64), "unicode☼f64": 0.14285714285714285 (f64)
  - scope (wasm-expression-stack):
-   0: 15 (number)
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 0 (number)
+   0: 15 (i32)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 116: Wasm opcode 0x0b
+Script wasm://wasm/2d24c81e byte offset 181: Wasm opcode 0x0b
 Scope:
-at func (0:116):
- - scope (global):
-   globals: "global0": 15 (number)
+at func (0:181):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 15 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32Arg": 11 (number), "var1": 47 (number), "i64_local": -9223372036854775808 (string), "unicode☼f64": 0.14285714285714285 (number)
-   stack: 
+   locals: "0": 0 (f64), "i32Arg": 11 (i32), "var1": 47 (i32), "i64_local": -9223372036854775808 (i64), "unicode☼f64": 0.14285714285714285 (f64)
  - scope (wasm-expression-stack):
-at call_func (0:58):
- - scope (global):
-   globals: "global0": 15 (number)
+at call_func (0:123):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 15 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/d374ef0a byte offset 60: Wasm opcode 0x0b
+Script wasm://wasm/2d24c81e byte offset 125: Wasm opcode 0x0b
 Scope:
-at call_func (0:60):
- - scope (global):
-   globals: "global0": 15 (number)
+at call_func (0:125):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 15 (i32)
  - scope (local):
-   locals: "var0": 4 (number), "var1": 7.199999809265137 (number)
-   stack: 
+   locals: "var0": 4 (i32), "var1": 7.199999809265137 (f32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
diff --git a/deps/v8/test/inspector/debugger/wasm-scope-info-liftoff-expected.txt b/deps/v8/test/inspector/debugger/wasm-scope-info-liftoff-expected.txt
index 292f0074a3d..5ec75e11a12 100644
--- a/deps/v8/test/inspector/debugger/wasm-scope-info-liftoff-expected.txt
+++ b/deps/v8/test/inspector/debugger/wasm-scope-info-liftoff-expected.txt
@@ -5,237 +5,259 @@ Calling instantiate function.
 Got wasm script!
 Setting breakpoint on line 2 (first instruction) of third function
 {
-    columnNumber : 85
+    columnNumber : 150
     lineNumber : 0
     scriptId : <scriptId>
 }
 Paused:
-Script wasm://wasm/c4eb034a byte offset 85: Wasm opcode 0x20
+Script wasm://wasm/be0fbeba byte offset 150: Wasm opcode 0x20
 Scope:
-at C (interpreted) (0:85):
- - scope (global):
-   globals: "global0": 0 (number)
+at C (interpreted) (0:150):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "i32_arg": 42 (number), "i32_local": 0 (number)
-   stack: 
+   locals: "i32_arg": 42 (i32), "i32_local": 0 (i32)
  - scope (wasm-expression-stack):
-at B (liftoff) (0:76):
- - scope (global):
-   globals: "global0": 0 (number)
+at B (liftoff) (0:141):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32_arg": 42 (number), "i32_local": 0 (number), "f32_local": 7.199999809265137 (number), "var5": 0 (number)
-   stack: "0": 42 (number), "1": 3 (number)
+   locals: "0": 0 (f32), "i32_arg": 42 (i32), "i32_local": 0 (i32), "f32_local": 7.199999809265137 (f32), "var5": 0 (f32)
  - scope (wasm-expression-stack):
-   0: 42 (number)
-   1: 3 (number)
-at A (liftoff) (0:54):
- - scope (global):
-   globals: "global0": 0 (number)
+   0: 42 (i32)
+   1: 3 (i32)
+at A (liftoff) (0:119):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 42 (number)
-   stack: 
+   locals: "var0": 42 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/c4eb034a byte offset 87: Wasm opcode 0x24
+Script wasm://wasm/be0fbeba byte offset 152: Wasm opcode 0x24
 Scope:
-at C (interpreted) (0:87):
- - scope (global):
-   globals: "global0": 0 (number)
+at C (interpreted) (0:152):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "i32_arg": 42 (number), "i32_local": 0 (number)
-   stack: "0": 42 (number)
+   locals: "i32_arg": 42 (i32), "i32_local": 0 (i32)
  - scope (wasm-expression-stack):
-   0: 42 (number)
-at B (liftoff) (0:76):
- - scope (global):
-   globals: "global0": 0 (number)
+   0: 42 (i32)
+at B (liftoff) (0:141):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32_arg": 42 (number), "i32_local": 0 (number), "f32_local": 7.199999809265137 (number), "var5": 0 (number)
-   stack: "0": 42 (number), "1": 3 (number)
+   locals: "0": 0 (f32), "i32_arg": 42 (i32), "i32_local": 0 (i32), "f32_local": 7.199999809265137 (f32), "var5": 0 (f32)
  - scope (wasm-expression-stack):
-   0: 42 (number)
-   1: 3 (number)
-at A (liftoff) (0:54):
- - scope (global):
-   globals: "global0": 0 (number)
+   0: 42 (i32)
+   1: 3 (i32)
+at A (liftoff) (0:119):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 0 (i32)
  - scope (local):
-   locals: "var0": 42 (number)
-   stack: 
+   locals: "var0": 42 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/c4eb034a byte offset 89: Wasm opcode 0x41
+Script wasm://wasm/be0fbeba byte offset 154: Wasm opcode 0x41
 Scope:
-at C (interpreted) (0:89):
- - scope (global):
-   globals: "global0": 42 (number)
+at C (interpreted) (0:154):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "i32_arg": 42 (number), "i32_local": 0 (number)
-   stack: 
+   locals: "i32_arg": 42 (i32), "i32_local": 0 (i32)
  - scope (wasm-expression-stack):
-at B (liftoff) (0:76):
- - scope (global):
-   globals: "global0": 42 (number)
+at B (liftoff) (0:141):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32_arg": 42 (number), "i32_local": 0 (number), "f32_local": 7.199999809265137 (number), "var5": 0 (number)
-   stack: "0": 42 (number), "1": 3 (number)
+   locals: "0": 0 (f32), "i32_arg": 42 (i32), "i32_local": 0 (i32), "f32_local": 7.199999809265137 (f32), "var5": 0 (f32)
  - scope (wasm-expression-stack):
-   0: 42 (number)
-   1: 3 (number)
-at A (liftoff) (0:54):
- - scope (global):
-   globals: "global0": 42 (number)
+   0: 42 (i32)
+   1: 3 (i32)
+at A (liftoff) (0:119):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "var0": 42 (number)
-   stack: 
+   locals: "var0": 42 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/c4eb034a byte offset 91: Wasm opcode 0x21
+Script wasm://wasm/be0fbeba byte offset 156: Wasm opcode 0x21
 Scope:
-at C (interpreted) (0:91):
- - scope (global):
-   globals: "global0": 42 (number)
+at C (interpreted) (0:156):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "i32_arg": 42 (number), "i32_local": 0 (number)
-   stack: "0": 47 (number)
+   locals: "i32_arg": 42 (i32), "i32_local": 0 (i32)
  - scope (wasm-expression-stack):
-   0: 47 (number)
-at B (liftoff) (0:76):
- - scope (global):
-   globals: "global0": 42 (number)
+   0: 47 (i32)
+at B (liftoff) (0:141):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32_arg": 42 (number), "i32_local": 0 (number), "f32_local": 7.199999809265137 (number), "var5": 0 (number)
-   stack: "0": 42 (number), "1": 3 (number)
+   locals: "0": 0 (f32), "i32_arg": 42 (i32), "i32_local": 0 (i32), "f32_local": 7.199999809265137 (f32), "var5": 0 (f32)
  - scope (wasm-expression-stack):
-   0: 42 (number)
-   1: 3 (number)
-at A (liftoff) (0:54):
- - scope (global):
-   globals: "global0": 42 (number)
+   0: 42 (i32)
+   1: 3 (i32)
+at A (liftoff) (0:119):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "var0": 42 (number)
-   stack: 
+   locals: "var0": 42 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/c4eb034a byte offset 93: Wasm opcode 0x0b
+Script wasm://wasm/be0fbeba byte offset 158: Wasm opcode 0x0b
 Scope:
-at C (interpreted) (0:93):
- - scope (global):
-   globals: "global0": 42 (number)
+at C (interpreted) (0:158):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "i32_arg": 42 (number), "i32_local": 47 (number)
-   stack: 
+   locals: "i32_arg": 42 (i32), "i32_local": 47 (i32)
  - scope (wasm-expression-stack):
-at B (liftoff) (0:76):
- - scope (global):
-   globals: "global0": 42 (number)
+at B (liftoff) (0:141):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32_arg": 42 (number), "i32_local": 0 (number), "f32_local": 7.199999809265137 (number), "var5": 0 (number)
-   stack: "0": 42 (number), "1": 3 (number)
+   locals: "0": 0 (f32), "i32_arg": 42 (i32), "i32_local": 0 (i32), "f32_local": 7.199999809265137 (f32), "var5": 0 (f32)
  - scope (wasm-expression-stack):
-   0: 42 (number)
-   1: 3 (number)
-at A (liftoff) (0:54):
- - scope (global):
-   globals: "global0": 42 (number)
+   0: 42 (i32)
+   1: 3 (i32)
+at A (liftoff) (0:119):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "var0": 42 (number)
-   stack: 
+   locals: "var0": 42 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/c4eb034a byte offset 78: Wasm opcode 0x1a
+Script wasm://wasm/be0fbeba byte offset 143: Wasm opcode 0x1a
 Scope:
-at B (liftoff) (0:78):
- - scope (global):
-   globals: "global0": 42 (number)
+at B (liftoff) (0:143):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32_arg": 42 (number), "i32_local": 0 (number), "f32_local": 7.199999809265137 (number), "var5": 0 (number)
-   stack: "0": 42 (number), "1": 3 (number)
+   locals: "0": 0 (f32), "i32_arg": 42 (i32), "i32_local": 0 (i32), "f32_local": 7.199999809265137 (f32), "var5": 0 (f32)
  - scope (wasm-expression-stack):
-   0: 42 (number)
-   1: 3 (number)
-at A (liftoff) (0:54):
- - scope (global):
-   globals: "global0": 42 (number)
+   0: 42 (i32)
+   1: 3 (i32)
+at A (liftoff) (0:119):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "var0": 42 (number)
-   stack: 
+   locals: "var0": 42 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/c4eb034a byte offset 79: Wasm opcode 0x1a
+Script wasm://wasm/be0fbeba byte offset 144: Wasm opcode 0x1a
 Scope:
-at B (liftoff) (0:79):
- - scope (global):
-   globals: "global0": 42 (number)
+at B (liftoff) (0:144):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32_arg": 42 (number), "i32_local": 0 (number), "f32_local": 7.199999809265137 (number), "var5": 0 (number)
-   stack: "0": 42 (number)
+   locals: "0": 0 (f32), "i32_arg": 42 (i32), "i32_local": 0 (i32), "f32_local": 7.199999809265137 (f32), "var5": 0 (f32)
  - scope (wasm-expression-stack):
-   0: 42 (number)
-at A (liftoff) (0:54):
- - scope (global):
-   globals: "global0": 42 (number)
+   0: 42 (i32)
+at A (liftoff) (0:119):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "var0": 42 (number)
-   stack: 
+   locals: "var0": 42 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/c4eb034a byte offset 80: Wasm opcode 0x0b
+Script wasm://wasm/be0fbeba byte offset 145: Wasm opcode 0x0b
 Scope:
-at B (liftoff) (0:80):
- - scope (global):
-   globals: "global0": 42 (number)
+at B (liftoff) (0:145):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "0": 0 (number), "i32_arg": 42 (number), "i32_local": 0 (number), "f32_local": 7.199999809265137 (number), "var5": 0 (number)
-   stack: 
+   locals: "0": 0 (f32), "i32_arg": 42 (i32), "i32_local": 0 (i32), "f32_local": 7.199999809265137 (f32), "var5": 0 (f32)
  - scope (wasm-expression-stack):
-at A (liftoff) (0:54):
- - scope (global):
-   globals: "global0": 42 (number)
+at A (liftoff) (0:119):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "var0": 42 (number)
-   stack: 
+   locals: "var0": 42 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
    -- skipped globals
 
 Paused:
-Script wasm://wasm/c4eb034a byte offset 56: Wasm opcode 0x0b
+Script wasm://wasm/be0fbeba byte offset 121: Wasm opcode 0x0b
 Scope:
-at A (liftoff) (0:56):
- - scope (global):
-   globals: "global0": 42 (number)
+at A (liftoff) (0:121):
+ - scope (module):
+   instance: exports: "exported_global" (Global), "exported_memory" (Memory), "exported_table" (Table), "main" (Function)
+   exported_memory: Uint8Array(65536)
+   globals: "exported_global": 42 (i32)
  - scope (local):
-   locals: "var0": 42 (number)
-   stack: 
+   locals: "var0": 42 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
  - scope (global):
diff --git a/deps/v8/test/inspector/debugger/wasm-scope-info-liftoff.js b/deps/v8/test/inspector/debugger/wasm-scope-info-liftoff.js
index ef7ec63b039..2f20ad3e225 100644
--- a/deps/v8/test/inspector/debugger/wasm-scope-info-liftoff.js
+++ b/deps/v8/test/inspector/debugger/wasm-scope-info-liftoff.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --debug-in-liftoff
-
 let {session, contextGroup, Protocol} = InspectorTest.start(
     'Test retrieving scope information from compiled Liftoff frames');
 session.setupScriptMap();
@@ -64,8 +62,10 @@ async function instantiateWasm() {
   utils.load('test/mjsunit/wasm/wasm-module-builder.js');
 
   var builder = new WasmModuleBuilder();
-  // Also add a global, so we have some global scope.
-  builder.addGlobal(kWasmI32, true);
+  // Add a global, memory and exports to populate the module scope.
+  builder.addGlobal(kWasmI32, true).exportAs('exported_global');
+  builder.addMemory(1,1).exportMemoryAs('exported_memory');
+  builder.addTable(kWasmAnyFunc, 0).exportAs('exported_table');
 
   // Add two functions without breakpoint, to check that locals and operand
   // stack values are shown correctly in Liftoff code.
@@ -146,22 +146,54 @@ async function waitForWasmScripts() {
   return wasm_script_ids;
 }
 
-async function getScopeValues(value) {
+async function getScopeValues(name, value) {
   if (value.type == 'object') {
+    if (value.subtype == 'typedarray') return value.description;
+    if (name == 'instance') return dumpInstanceProperties(value);
+
     let msg = await Protocol.Runtime.getProperties({objectId: value.objectId});
     printIfFailure(msg);
     const printProperty = function(elem) {
-      return `"${elem.name}": ${elem.value.value} (${elem.value.type})`;
+      return `"${elem.name}": ${getWasmValue(elem.value)} (${elem.value.subtype})`;
     }
     return msg.result.result.map(printProperty).join(', ');
   }
-  return value.value + ' (' + value.type + ')';
+  return getWasmValue(value) + ' (' + value.subtype + ')';
 }
 
 async function dumpScopeProperties(message) {
   printIfFailure(message);
   for (var value of message.result.result) {
-    var value_str = await getScopeValues(value.value);
+    var value_str = await getScopeValues(value.name, value.value);
     InspectorTest.log('   ' + value.name + ': ' + value_str);
   }
 }
+
+async function dumpInstanceProperties(instanceObj) {
+  function invokeGetter(property) {
+    return this[JSON.parse(property)];
+  }
+
+  const exportsName = 'exports';
+  let exportsObj = await Protocol.Runtime.callFunctionOn(
+      {objectId: instanceObj.objectId,
+       functionDeclaration: invokeGetter.toString(),
+       arguments: [{value: JSON.stringify(exportsName)}]
+  });
+  printIfFailure(exportsObj);
+  let exports = await Protocol.Runtime.getProperties(
+      {objectId: exportsObj.result.result.objectId});
+  printIfFailure(exports);
+
+  const printExports = function(value) {
+    return `"${value.name}" (${value.value.className})`;
+  }
+  const formattedExports = exports.result.result.map(printExports).join(', ');
+  return `${exportsName}: ${formattedExports}`
+}
+
+function getWasmValue(wasmValue) {
+  return typeof (wasmValue.value) === 'undefined' ?
+      wasmValue.unserializableValue :
+      wasmValue.value;
+}
diff --git a/deps/v8/test/inspector/debugger/wasm-scope-info.js b/deps/v8/test/inspector/debugger/wasm-scope-info.js
index 413aa69ce17..70e3fab6c2c 100644
--- a/deps/v8/test/inspector/debugger/wasm-scope-info.js
+++ b/deps/v8/test/inspector/debugger/wasm-scope-info.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --debug-in-liftoff
-
 let {session, contextGroup, Protocol} = InspectorTest.start(
     'Test retrieving scope information when pausing in wasm functions');
 session.setupScriptMap();
@@ -69,8 +67,10 @@ async function instantiateWasm() {
   utils.load('test/mjsunit/wasm/wasm-module-builder.js');
 
   var builder = new WasmModuleBuilder();
-  // Also add a global, so we have some global scope.
-  builder.addGlobal(kWasmI32, true);
+  // Add a global, memory and exports to populate the module scope.
+  builder.addGlobal(kWasmI32, true).exportAs('exported_global');
+  builder.addMemory(1,1).exportMemoryAs('exported_memory');
+  builder.addTable(kWasmAnyFunc, 0).exportAs('exported_table');
 
   // Add a function without breakpoint, to check that locals are shown
   // correctly in compiled code.
@@ -144,22 +144,54 @@ async function waitForWasmScripts() {
   return wasm_script_ids;
 }
 
-async function getScopeValues(value) {
+async function getScopeValues(name, value) {
   if (value.type == 'object') {
+    if (value.subtype == 'typedarray') return value.description;
+    if (name == 'instance') return dumpInstanceProperties(value);
+
     let msg = await Protocol.Runtime.getProperties({objectId: value.objectId});
     printIfFailure(msg);
     const printProperty = function(elem) {
-      return `"${elem.name}": ${elem.value.value} (${elem.value.type})`;
+      return `"${elem.name}": ${getWasmValue(elem.value)} (${elem.value.subtype})`;
     }
     return msg.result.result.map(printProperty).join(', ');
   }
-  return value.value + ' (' + value.type + ')';
+  return getWasmValue(value) + ' (' + value.subtype + ')';
 }
 
 async function dumpScopeProperties(message) {
   printIfFailure(message);
   for (var value of message.result.result) {
-    var value_str = await getScopeValues(value.value);
+    var value_str = await getScopeValues(value.name, value.value);
     InspectorTest.log('   ' + value.name + ': ' + value_str);
   }
 }
+
+async function dumpInstanceProperties(instanceObj) {
+  function invokeGetter(property) {
+    return this[JSON.parse(property)];
+  }
+
+  const exportsName = 'exports';
+  let exportsObj = await Protocol.Runtime.callFunctionOn(
+      {objectId: instanceObj.objectId,
+       functionDeclaration: invokeGetter.toString(),
+       arguments: [{value: JSON.stringify(exportsName)}]
+  });
+  printIfFailure(exportsObj);
+  let exports = await Protocol.Runtime.getProperties(
+      {objectId: exportsObj.result.result.objectId});
+  printIfFailure(exports);
+
+  const printExports = function(value) {
+    return `"${value.name}" (${value.value.className})`;
+  }
+  const formattedExports = exports.result.result.map(printExports).join(', ');
+  return `${exportsName}: ${formattedExports}`
+}
+
+function getWasmValue(wasmValue) {
+  return typeof (wasmValue.value) === 'undefined' ?
+      wasmValue.unserializableValue :
+      wasmValue.value;
+}
diff --git a/deps/v8/test/inspector/debugger/wasm-scripts-expected.txt b/deps/v8/test/inspector/debugger/wasm-scripts-expected.txt
index 7b76eab18b0..3ffdab7e5e1 100644
--- a/deps/v8/test/inspector/debugger/wasm-scripts-expected.txt
+++ b/deps/v8/test/inspector/debugger/wasm-scripts-expected.txt
@@ -1,15 +1,27 @@
 Tests how wasm scripts are reported
 Check that each inspector gets a wasm script at module creation time.
-Session #1: Script #0 parsed. URL: wasm://wasm/7b04570e. Source map URL: , module begin: 0, module end: 0, code offset: 34
-Session #2: Script #0 parsed. URL: wasm://wasm/7b04570e. Source map URL: , module begin: 0, module end: 0, code offset: 34
-Session #1: Script #1 parsed. URL: wasm://wasm/ba7c35be. Source map URL: wasm://dwarf, module begin: 0, module end: 0, code offset: 34
-Session #2: Script #1 parsed. URL: wasm://wasm/ba7c35be. Source map URL: wasm://dwarf, module begin: 0, module end: 0, code offset: 34
-Session #1: Script #2 parsed. URL: wasm://wasm/1baa71fe. Source map URL: abc, module begin: 0, module end: 0, code offset: 34
-Session #2: Script #2 parsed. URL: wasm://wasm/1baa71fe. Source map URL: abc, module begin: 0, module end: 0, code offset: 34
-Session #1: Script #3 parsed. URL: wasm://wasm/95e97206. Source map URL: abc, module begin: 0, module end: 0, code offset: 34
-Session #2: Script #3 parsed. URL: wasm://wasm/95e97206. Source map URL: abc, module begin: 0, module end: 0, code offset: 34
-Session #1: Script #4 parsed. URL: wasm://wasm/7ab47392. Source map URL: abc, module begin: 0, module end: 0, code offset: 34
-Session #2: Script #4 parsed. URL: wasm://wasm/7ab47392. Source map URL: abc, module begin: 0, module end: 0, code offset: 34
+Session #1: Script #0 parsed. URL: wasm://wasm/7b04570e. Script ID: 0, Source map URL: , debug symbols: None:undefined. module begin: 0, module end: 77, code offset: 34
+Session #2: Script #0 parsed. URL: wasm://wasm/7b04570e. Script ID: 0, Source map URL: , debug symbols: None:undefined. module begin: 0, module end: 77, code offset: 34
+Session #1: Script #1 parsed. URL: wasm://wasm/7b04570e. Script ID: 0, Source map URL: , debug symbols: None:undefined. module begin: 0, module end: 77, code offset: 34
+Session #2: Script #1 parsed. URL: wasm://wasm/7b04570e. Script ID: 0, Source map URL: , debug symbols: None:undefined. module begin: 0, module end: 77, code offset: 34
+Session #1: Script #2 parsed. URL: wasm://wasm/5e8bdc5a. Script ID: 1, Source map URL: , debug symbols: ExternalDWARF:abc. module begin: 0, module end: 104, code offset: 34
+Session #2: Script #2 parsed. URL: wasm://wasm/5e8bdc5a. Script ID: 1, Source map URL: , debug symbols: ExternalDWARF:abc. module begin: 0, module end: 104, code offset: 34
+Session #1: Script #3 parsed. URL: wasm://wasm/ba7c35be. Script ID: 2, Source map URL: , debug symbols: EmbeddedDWARF:undefined. module begin: 0, module end: 96, code offset: 34
+Session #2: Script #3 parsed. URL: wasm://wasm/ba7c35be. Script ID: 2, Source map URL: , debug symbols: EmbeddedDWARF:undefined. module begin: 0, module end: 96, code offset: 34
+Session #1: Script #4 parsed. URL: wasm://wasm/1baa71fe. Script ID: 3, Source map URL: abc, debug symbols: SourceMap:abc. module begin: 0, module end: 100, code offset: 34
+Session #2: Script #4 parsed. URL: wasm://wasm/1baa71fe. Script ID: 3, Source map URL: abc, debug symbols: SourceMap:abc. module begin: 0, module end: 100, code offset: 34
+Session #1: Script #5 parsed. URL: wasm://wasm/0f5a61aa. Script ID: 4, Source map URL: abc, debug symbols: SourceMap:abc. module begin: 0, module end: 127, code offset: 34
+Session #2: Script #5 parsed. URL: wasm://wasm/0f5a61aa. Script ID: 4, Source map URL: abc, debug symbols: SourceMap:abc. module begin: 0, module end: 127, code offset: 34
+Session #1: Script #6 parsed. URL: wasm://wasm/2b982afe. Script ID: 5, Source map URL: abc, debug symbols: SourceMap:abc. module begin: 0, module end: 127, code offset: 34
+Session #2: Script #6 parsed. URL: wasm://wasm/2b982afe. Script ID: 5, Source map URL: abc, debug symbols: SourceMap:abc. module begin: 0, module end: 127, code offset: 34
+Session #1: Script #7 parsed. URL: wasm://wasm/63e4f84a. Script ID: 6, Source map URL: , debug symbols: ExternalDWARF:abc. module begin: 0, module end: 123, code offset: 34
+Session #2: Script #7 parsed. URL: wasm://wasm/63e4f84a. Script ID: 6, Source map URL: , debug symbols: ExternalDWARF:abc. module begin: 0, module end: 123, code offset: 34
+Session #1: Script #8 parsed. URL: wasm://wasm/2c194a36. Script ID: 7, Source map URL: , debug symbols: ExternalDWARF:abc. module begin: 0, module end: 123, code offset: 34
+Session #2: Script #8 parsed. URL: wasm://wasm/2c194a36. Script ID: 7, Source map URL: , debug symbols: ExternalDWARF:abc. module begin: 0, module end: 123, code offset: 34
+Session #1: Script #9 parsed. URL: wasm://wasm/95e97206. Script ID: 8, Source map URL: abc, debug symbols: SourceMap:abc. module begin: 0, module end: 119, code offset: 34
+Session #2: Script #9 parsed. URL: wasm://wasm/95e97206. Script ID: 8, Source map URL: abc, debug symbols: SourceMap:abc. module begin: 0, module end: 119, code offset: 34
+Session #1: Script #10 parsed. URL: wasm://wasm/7ab47392. Script ID: 9, Source map URL: abc, debug symbols: SourceMap:abc. module begin: 0, module end: 119, code offset: 34
+Session #2: Script #10 parsed. URL: wasm://wasm/7ab47392. Script ID: 9, Source map URL: abc, debug symbols: SourceMap:abc. module begin: 0, module end: 119, code offset: 34
 Session #1: Source for wasm://wasm/7b04570e:
 Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
 Imports: []
@@ -18,6 +30,22 @@ Session #2: Source for wasm://wasm/7b04570e:
 Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
 Imports: []
 Exports: [main: function]
+Session #1: Source for wasm://wasm/7b04570e:
+Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
+Imports: []
+Exports: [main: function]
+Session #2: Source for wasm://wasm/7b04570e:
+Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
+Imports: []
+Exports: [main: function]
+Session #1: Source for wasm://wasm/5e8bdc5a:
+Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 19 14 2e 65 78 74 65 72 6e 61 6c 5f 64 65 62 75 67 5f 69 6e 66 6f 03 61 62 63 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
+Imports: []
+Exports: [main: function]
+Session #2: Source for wasm://wasm/5e8bdc5a:
+Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 19 14 2e 65 78 74 65 72 6e 61 6c 5f 64 65 62 75 67 5f 69 6e 66 6f 03 61 62 63 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
+Imports: []
+Exports: [main: function]
 Session #1: Source for wasm://wasm/ba7c35be:
 Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 11 0b 2e 64 65 62 75 67 5f 69 6e 66 6f 01 02 03 04 05 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
 Imports: []
@@ -34,6 +62,38 @@ Session #2: Source for wasm://wasm/1baa71fe:
 Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 15 10 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 03 61 62 63 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
 Imports: []
 Exports: [main: function]
+Session #1: Source for wasm://wasm/0f5a61aa:
+Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 15 10 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 03 61 62 63 00 19 14 2e 65 78 74 65 72 6e 61 6c 5f 64 65 62 75 67 5f 69 6e 66 6f 03 61 62 63 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
+Imports: []
+Exports: [main: function]
+Session #2: Source for wasm://wasm/0f5a61aa:
+Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 15 10 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 03 61 62 63 00 19 14 2e 65 78 74 65 72 6e 61 6c 5f 64 65 62 75 67 5f 69 6e 66 6f 03 61 62 63 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
+Imports: []
+Exports: [main: function]
+Session #1: Source for wasm://wasm/2b982afe:
+Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 19 14 2e 65 78 74 65 72 6e 61 6c 5f 64 65 62 75 67 5f 69 6e 66 6f 03 61 62 63 00 15 10 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 03 61 62 63 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
+Imports: []
+Exports: [main: function]
+Session #2: Source for wasm://wasm/2b982afe:
+Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 19 14 2e 65 78 74 65 72 6e 61 6c 5f 64 65 62 75 67 5f 69 6e 66 6f 03 61 62 63 00 15 10 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 03 61 62 63 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
+Imports: []
+Exports: [main: function]
+Session #1: Source for wasm://wasm/63e4f84a:
+Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 11 0b 2e 64 65 62 75 67 5f 69 6e 66 6f 01 02 03 04 05 00 19 14 2e 65 78 74 65 72 6e 61 6c 5f 64 65 62 75 67 5f 69 6e 66 6f 03 61 62 63 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
+Imports: []
+Exports: [main: function]
+Session #2: Source for wasm://wasm/63e4f84a:
+Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 11 0b 2e 64 65 62 75 67 5f 69 6e 66 6f 01 02 03 04 05 00 19 14 2e 65 78 74 65 72 6e 61 6c 5f 64 65 62 75 67 5f 69 6e 66 6f 03 61 62 63 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
+Imports: []
+Exports: [main: function]
+Session #1: Source for wasm://wasm/2c194a36:
+Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 19 14 2e 65 78 74 65 72 6e 61 6c 5f 64 65 62 75 67 5f 69 6e 66 6f 03 61 62 63 00 11 0b 2e 64 65 62 75 67 5f 69 6e 66 6f 01 02 03 04 05 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
+Imports: []
+Exports: [main: function]
+Session #2: Source for wasm://wasm/2c194a36:
+Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 19 14 2e 65 78 74 65 72 6e 61 6c 5f 64 65 62 75 67 5f 69 6e 66 6f 03 61 62 63 00 11 0b 2e 64 65 62 75 67 5f 69 6e 66 6f 01 02 03 04 05 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
+Imports: []
+Exports: [main: function]
 Session #1: Source for wasm://wasm/95e97206:
 Raw: 00 61 73 6d 01 00 00 00 01 07 02 60 00 00 60 00 00 03 03 02 00 01 07 08 01 04 6d 61 69 6e 00 01 0a 0e 02 03 00 01 0b 08 00 02 40 41 02 1a 0b 0b 00 11 0b 2e 64 65 62 75 67 5f 69 6e 66 6f 01 02 03 04 05 00 15 10 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 03 61 62 63 00 1b 04 6e 61 6d 65 01 14 02 00 0b 6e 6f 70 46 75 6e 63 74 69 6f 6e 01 04 6d 61 69 6e
 Imports: []
diff --git a/deps/v8/test/inspector/debugger/wasm-scripts.js b/deps/v8/test/inspector/debugger/wasm-scripts.js
index 5ad5ff09de0..e7e158e9d59 100644
--- a/deps/v8/test/inspector/debugger/wasm-scripts.js
+++ b/deps/v8/test/inspector/debugger/wasm-scripts.js
@@ -35,6 +35,15 @@ function testFunction(bytes) {
   new WebAssembly.Module(new Uint8Array(bytes));
 }
 
+// Generate stable IDs.
+let scriptIds = {};
+function nextStableId(id) {
+  if (!(id in scriptIds)) {
+    scriptIds[id] = Object.keys(scriptIds).length;
+  }
+  return scriptIds[id];
+}
+
 contextGroup.addScript(testFunction.toString(), 0, 0, 'v8://test/testFunction');
 
 InspectorTest.log(
@@ -43,36 +52,69 @@ InspectorTest.log(
 // Sample .debug_info section.
 // Content doesn't matter, as we don't try to parse it in V8,
 // but should be non-empty to check that we're skipping it correctly.
-const dwarfSection = { name: '.debug_info', value: [1, 2, 3, 4, 5] };
+const embeddedDWARFSection = {
+  name: '.debug_info',
+  value: [1, 2, 3, 4, 5]
+};
+
+// Sample external_debug_info section set to "abc".
+const externalDWARFSection = {
+  name: '.external_debug_info',
+  value: [3, 97, 98, 99]
+};
 
 // Sample sourceMappingURL section set to "abc".
-const sourceMapSection = { name: 'sourceMappingURL', value: [3, 97, 98, 99] };
+const sourceMapSection = {
+  name: 'sourceMappingURL',
+  value: [3, 97, 98, 99]
+};
 
-sessions[0].Protocol.Runtime
+sessions[0]
+    .Protocol.Runtime
     .evaluate({
       'expression': `//# sourceURL=v8://test/runTestRunction
 
       // no debug info
       testFunction([${createModule()}]);
 
-      // DWARF
-      testFunction([${createModule(dwarfSection)}]);
+      // shared script for identical modules
+      testFunction([${createModule()}]);
+
+      // External DWARF
+      testFunction([${createModule(externalDWARFSection)}]);
+
+      // Embedded DWARF
+      testFunction([${createModule(embeddedDWARFSection)}]);
 
       // Source map
       testFunction([${createModule(sourceMapSection)}]);
 
-      // DWARF + source map
-      testFunction([${createModule(dwarfSection, sourceMapSection)}]);
+      // SourceMap + External DWARF
+      testFunction([${createModule(sourceMapSection, externalDWARFSection)}]);
+
+      // External DWARF + SourceMap (different order)
+      testFunction([${createModule(externalDWARFSection, sourceMapSection)}]);
+
+      // Embedded DWARF + External DWARF
+      testFunction([${
+          createModule(embeddedDWARFSection, externalDWARFSection)}]);
+
+      // External + Embedded DWARF (different order)
+      testFunction([${
+          createModule(externalDWARFSection, embeddedDWARFSection)}]);
+
+      // Embedded DWARF + source map
+      testFunction([${createModule(embeddedDWARFSection, sourceMapSection)}]);
 
-      // Source map + DWARF (different order)
-      testFunction([${createModule(sourceMapSection, dwarfSection)}]);
+      // Source map + Embedded DWARF (different order)
+      testFunction([${createModule(sourceMapSection, embeddedDWARFSection)}]);
       `
     })
-    .then(() => (
-      // At this point all scripts were parsed.
-      // Stop tracking and wait for script sources in each session.
-      Promise.all(sessions.map(session => session.getScripts()))
-    ))
+    .then(
+        () => (
+            // At this point all scripts were parsed.
+            // Stop tracking and wait for script sources in each session.
+            Promise.all(sessions.map(session => session.getScripts()))))
     .catch(err => {
       InspectorTest.log(err.stack);
     })
@@ -85,11 +127,21 @@ function trackScripts(debuggerParams) {
   Protocol.Debugger.enable(debuggerParams);
   Protocol.Debugger.onScriptParsed(handleScriptParsed);
 
-  async function loadScript(
-      {url, scriptId, sourceMapURL, startColumn, endColumn, codeOffset}) {
+  async function loadScript({
+    url,
+    scriptId,
+    sourceMapURL,
+    startColumn,
+    endColumn,
+    codeOffset,
+    debugSymbols
+  }) {
+    let stableId = nextStableId(scriptId);
     InspectorTest.log(`Session #${sessionId}: Script #${
-        scripts.length} parsed. URL: ${url}. Source map URL: ${
-        sourceMapURL}, module begin: ${startColumn}, module end: ${endColumn}, code offset: ${codeOffset}`);
+        scripts.length} parsed. URL: ${url}. Script ID: ${
+        stableId}, Source map URL: ${sourceMapURL}, debug symbols: ${
+        debugSymbols.type}:${debugSymbols.externalURL}. module begin: ${
+        startColumn}, module end: ${endColumn}, code offset: ${codeOffset}`);
     let {result: {scriptSource, bytecode}} =
         await Protocol.Debugger.getScriptSource({scriptId});
     if (bytecode) {
@@ -101,10 +153,17 @@ function trackScripts(debuggerParams) {
       bytecode = InspectorTest.decodeBase64(bytecode);
       // Check that it can be parsed back to a WebAssembly module.
       let module = new WebAssembly.Module(bytecode);
-      scriptSource = `
+      scriptSource =
+          `
 Raw: ${Array.from(bytecode, b => ('0' + b.toString(16)).slice(-2)).join(' ')}
-Imports: [${WebAssembly.Module.imports(module).map(i => `${i.name}: ${i.kind} from "${i.module}"`).join(', ')}]
-Exports: [${WebAssembly.Module.exports(module).map(e => `${e.name}: ${e.kind}`).join(', ')}]
+Imports: [${
+              WebAssembly.Module.imports(module)
+                  .map(i => `${i.name}: ${i.kind} from "${i.module}"`)
+                  .join(', ')}]
+Exports: [${
+              WebAssembly.Module.exports(module)
+                  .map(e => `${e.name}: ${e.kind}`)
+                  .join(', ')}]
       `.trim();
     }
     InspectorTest.log(`Session #${sessionId}: Source for ${url}:`);
diff --git a/deps/v8/test/inspector/debugger/wasm-set-breakpoint-liftoff-expected.txt b/deps/v8/test/inspector/debugger/wasm-set-breakpoint-liftoff-expected.txt
index 43827fef3bb..6f444b9101b 100644
--- a/deps/v8/test/inspector/debugger/wasm-set-breakpoint-liftoff-expected.txt
+++ b/deps/v8/test/inspector/debugger/wasm-set-breakpoint-liftoff-expected.txt
@@ -7,15 +7,15 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 38: Wasm opcode 0x01
 Scope:
 at wasm_A (0:38):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   stack: 
  - scope (wasm-expression-stack):
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 3 (number)
-   stack: 
+   locals: "var0": 3 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
@@ -32,15 +32,15 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 39: Wasm opcode 0x01
 Scope:
 at wasm_A (0:39):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   stack: 
  - scope (wasm-expression-stack):
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 3 (number)
-   stack: 
+   locals: "var0": 3 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
@@ -48,10 +48,10 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 45: Wasm opcode 0x20
 Scope:
 at wasm_B (0:45):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 3 (number)
-   stack: 
+   locals: "var0": 3 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
@@ -59,22 +59,22 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 47: Wasm opcode 0x04
 Scope:
 at wasm_B (0:47):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 3 (number)
-   stack: "0": 3 (number)
+   locals: "var0": 3 (i32)
  - scope (wasm-expression-stack):
-   0: 3 (number)
+   0: 3 (i32)
 at (anonymous) (0:17):
    -- skipped
 Paused:
 Script wasm://wasm/0c10a5fe byte offset 49: Wasm opcode 0x20
 Scope:
 at wasm_B (0:49):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 3 (number)
-   stack: 
+   locals: "var0": 3 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
@@ -82,52 +82,52 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 51: Wasm opcode 0x41
 Scope:
 at wasm_B (0:51):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 3 (number)
-   stack: "0": 3 (number)
+   locals: "var0": 3 (i32)
  - scope (wasm-expression-stack):
-   0: 3 (number)
+   0: 3 (i32)
 at (anonymous) (0:17):
    -- skipped
 Paused:
 Script wasm://wasm/0c10a5fe byte offset 53: Wasm opcode 0x6b
 Scope:
 at wasm_B (0:53):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 3 (number)
-   stack: "0": 3 (number), "1": 1 (number)
+   locals: "var0": 3 (i32)
  - scope (wasm-expression-stack):
-   0: 3 (number)
-   1: 1 (number)
+   0: 3 (i32)
+   1: 1 (i32)
 at (anonymous) (0:17):
    -- skipped
 Paused:
 Script wasm://wasm/0c10a5fe byte offset 54: Wasm opcode 0x21
 Scope:
 at wasm_B (0:54):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 3 (number)
-   stack: "0": 2 (number)
+   locals: "var0": 3 (i32)
  - scope (wasm-expression-stack):
-   0: 2 (number)
+   0: 2 (i32)
 at (anonymous) (0:17):
    -- skipped
 Paused:
 Script wasm://wasm/0c10a5fe byte offset 38: Wasm opcode 0x01
 Scope:
 at wasm_A (0:38):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   stack: 
  - scope (wasm-expression-stack):
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 2 (number)
-   stack: 
+   locals: "var0": 2 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
@@ -135,15 +135,15 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 39: Wasm opcode 0x01
 Scope:
 at wasm_A (0:39):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   stack: 
  - scope (wasm-expression-stack):
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 2 (number)
-   stack: 
+   locals: "var0": 2 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
@@ -151,10 +151,10 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 45: Wasm opcode 0x20
 Scope:
 at wasm_B (0:45):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 2 (number)
-   stack: 
+   locals: "var0": 2 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
@@ -162,22 +162,22 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 47: Wasm opcode 0x04
 Scope:
 at wasm_B (0:47):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 2 (number)
-   stack: "0": 2 (number)
+   locals: "var0": 2 (i32)
  - scope (wasm-expression-stack):
-   0: 2 (number)
+   0: 2 (i32)
 at (anonymous) (0:17):
    -- skipped
 Paused:
 Script wasm://wasm/0c10a5fe byte offset 49: Wasm opcode 0x20
 Scope:
 at wasm_B (0:49):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 2 (number)
-   stack: 
+   locals: "var0": 2 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
@@ -185,52 +185,52 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 51: Wasm opcode 0x41
 Scope:
 at wasm_B (0:51):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 2 (number)
-   stack: "0": 2 (number)
+   locals: "var0": 2 (i32)
  - scope (wasm-expression-stack):
-   0: 2 (number)
+   0: 2 (i32)
 at (anonymous) (0:17):
    -- skipped
 Paused:
 Script wasm://wasm/0c10a5fe byte offset 53: Wasm opcode 0x6b
 Scope:
 at wasm_B (0:53):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 2 (number)
-   stack: "0": 2 (number), "1": 1 (number)
+   locals: "var0": 2 (i32)
  - scope (wasm-expression-stack):
-   0: 2 (number)
-   1: 1 (number)
+   0: 2 (i32)
+   1: 1 (i32)
 at (anonymous) (0:17):
    -- skipped
 Paused:
 Script wasm://wasm/0c10a5fe byte offset 54: Wasm opcode 0x21
 Scope:
 at wasm_B (0:54):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 2 (number)
-   stack: "0": 1 (number)
+   locals: "var0": 2 (i32)
  - scope (wasm-expression-stack):
-   0: 1 (number)
+   0: 1 (i32)
 at (anonymous) (0:17):
    -- skipped
 Paused:
 Script wasm://wasm/0c10a5fe byte offset 38: Wasm opcode 0x01
 Scope:
 at wasm_A (0:38):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   stack: 
  - scope (wasm-expression-stack):
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 1 (number)
-   stack: 
+   locals: "var0": 1 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
@@ -238,15 +238,15 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 39: Wasm opcode 0x01
 Scope:
 at wasm_A (0:39):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   stack: 
  - scope (wasm-expression-stack):
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 1 (number)
-   stack: 
+   locals: "var0": 1 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
@@ -254,10 +254,10 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 45: Wasm opcode 0x20
 Scope:
 at wasm_B (0:45):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 1 (number)
-   stack: 
+   locals: "var0": 1 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
@@ -265,22 +265,22 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 47: Wasm opcode 0x04
 Scope:
 at wasm_B (0:47):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 1 (number)
-   stack: "0": 1 (number)
+   locals: "var0": 1 (i32)
  - scope (wasm-expression-stack):
-   0: 1 (number)
+   0: 1 (i32)
 at (anonymous) (0:17):
    -- skipped
 Paused:
 Script wasm://wasm/0c10a5fe byte offset 49: Wasm opcode 0x20
 Scope:
 at wasm_B (0:49):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 1 (number)
-   stack: 
+   locals: "var0": 1 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
@@ -288,52 +288,52 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 51: Wasm opcode 0x41
 Scope:
 at wasm_B (0:51):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 1 (number)
-   stack: "0": 1 (number)
+   locals: "var0": 1 (i32)
  - scope (wasm-expression-stack):
-   0: 1 (number)
+   0: 1 (i32)
 at (anonymous) (0:17):
    -- skipped
 Paused:
 Script wasm://wasm/0c10a5fe byte offset 53: Wasm opcode 0x6b
 Scope:
 at wasm_B (0:53):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 1 (number)
-   stack: "0": 1 (number), "1": 1 (number)
+   locals: "var0": 1 (i32)
  - scope (wasm-expression-stack):
-   0: 1 (number)
-   1: 1 (number)
+   0: 1 (i32)
+   1: 1 (i32)
 at (anonymous) (0:17):
    -- skipped
 Paused:
 Script wasm://wasm/0c10a5fe byte offset 54: Wasm opcode 0x21
 Scope:
 at wasm_B (0:54):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 1 (number)
-   stack: "0": 0 (number)
+   locals: "var0": 1 (i32)
  - scope (wasm-expression-stack):
-   0: 0 (number)
+   0: 0 (i32)
 at (anonymous) (0:17):
    -- skipped
 Paused:
 Script wasm://wasm/0c10a5fe byte offset 38: Wasm opcode 0x01
 Scope:
 at wasm_A (0:38):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   stack: 
  - scope (wasm-expression-stack):
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 0 (number)
-   stack: 
+   locals: "var0": 0 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
@@ -341,15 +341,15 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 39: Wasm opcode 0x01
 Scope:
 at wasm_A (0:39):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   stack: 
  - scope (wasm-expression-stack):
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 0 (number)
-   stack: 
+   locals: "var0": 0 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
@@ -357,10 +357,10 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 45: Wasm opcode 0x20
 Scope:
 at wasm_B (0:45):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 0 (number)
-   stack: 
+   locals: "var0": 0 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
@@ -368,22 +368,22 @@ Paused:
 Script wasm://wasm/0c10a5fe byte offset 47: Wasm opcode 0x04
 Scope:
 at wasm_B (0:47):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 0 (number)
-   stack: "0": 0 (number)
+   locals: "var0": 0 (i32)
  - scope (wasm-expression-stack):
-   0: 0 (number)
+   0: 0 (i32)
 at (anonymous) (0:17):
    -- skipped
 Paused:
 Script wasm://wasm/0c10a5fe byte offset 61: Wasm opcode 0x0b
 Scope:
 at wasm_B (0:61):
- - scope (global):
+ - scope (module):
+   instance: exports: "main" (Function)
  - scope (local):
-   locals: "var0": 0 (number)
-   stack: 
+   locals: "var0": 0 (i32)
  - scope (wasm-expression-stack):
 at (anonymous) (0:17):
    -- skipped
diff --git a/deps/v8/test/inspector/debugger/wasm-set-breakpoint-liftoff.js b/deps/v8/test/inspector/debugger/wasm-set-breakpoint-liftoff.js
index 3e8d783af68..3a7f0995b12 100644
--- a/deps/v8/test/inspector/debugger/wasm-set-breakpoint-liftoff.js
+++ b/deps/v8/test/inspector/debugger/wasm-set-breakpoint-liftoff.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --debug-in-liftoff
-
 const {session, contextGroup, Protocol} =
     InspectorTest.start('Tests stepping through wasm scripts.');
 session.setupScriptMap();
@@ -85,7 +83,7 @@ Protocol.Debugger.onPaused(async msg => {
       var properties = await Protocol.Runtime.getProperties(
           {'objectId': scope.object.objectId});
       for (var value of properties.result.result) {
-        var value_str = await getScopeValues(value.value);
+        var value_str = await getScopeValues(value.name, value.value);
         InspectorTest.log('   ' + value.name + ': ' + value_str);
       }
     }
@@ -105,15 +103,43 @@ Protocol.Debugger.onPaused(async msg => {
   Protocol.Debugger.resume();
 });
 
-async function getScopeValues(value) {
+function getWasmValue(value) {
+  return typeof (value.value) === 'undefined' ? value.unserializableValue :
+                                                value.value;
+}
+
+async function getScopeValues(name, value) {
   if (value.type == 'object') {
+    if (name == 'instance') return dumpInstanceProperties(value);
+
     let msg = await Protocol.Runtime.getProperties({objectId: value.objectId});
     const printProperty = function(elem) {
-      return `"${elem.name}": ${elem.value.value} (${elem.value.type})`;
+      return `"${elem.name}": ${getWasmValue(elem.value)} (${elem.value.subtype})`;
     }
     return msg.result.result.map(printProperty).join(', ');
   }
-  return value.value + ' (' + value.type + ')';
+  return getWasmValue(value) + ' (' + value.subtype + ')';
+}
+
+async function dumpInstanceProperties(instanceObj) {
+  function invokeGetter(property) {
+    return this[JSON.parse(property)];
+  }
+
+  const exportsName = 'exports';
+  let exportsObj = await Protocol.Runtime.callFunctionOn(
+      {objectId: instanceObj.objectId,
+       functionDeclaration: invokeGetter.toString(),
+       arguments: [{value: JSON.stringify(exportsName)}]
+  });
+  let exports = await Protocol.Runtime.getProperties(
+      {objectId: exportsObj.result.result.objectId});
+
+  const printExports = function(value) {
+    return `"${value.name}" (${value.value.className})`;
+  }
+  const formattedExports = exports.result.result.map(printExports).join(', ');
+  return `${exportsName}: ${formattedExports}`
 }
 
 (async function test() {
diff --git a/deps/v8/test/inspector/debugger/wasm-step-after-trap-expected.txt b/deps/v8/test/inspector/debugger/wasm-step-after-trap-expected.txt
new file mode 100644
index 00000000000..8b0861de10e
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-step-after-trap-expected.txt
@@ -0,0 +1,56 @@
+Test scope inspection and stepping after a trap.
+Instantiating.
+Calling div function.
+Paused at:
+--- 0 ---
+Script wasm://wasm/a9a86c5e byte offset 46: Wasm opcode 0x6d
+scope at div (0:46):
+   locals: "a": 1, "b": 0, "unused": 4711, "local_zero": 0, "local_const_11": 11
+--- 1 ---
+  try {
+    instance.exports.#div(1, 0, 4711);  // traps (div by zero)
+  } catch (e) {
+
+--- 2 ---
+#call_div()
+
+-------------
+-> stepInto
+Paused at:
+--- 0 ---
+  } catch (e) {
+    #e.stack;  // step target of first pause
+  }
+
+--- 1 ---
+#call_div()
+
+-------------
+-> resume
+Paused at:
+--- 0 ---
+Script wasm://wasm/a9a86c5e byte offset 46: Wasm opcode 0x6d
+scope at div (0:46):
+   locals: "a": -2147483648, "b": -1, "unused": 4711, "local_zero": 0, "local_const_11": 11
+--- 1 ---
+  try {
+    instance.exports.#div(0x80000000, -1, 4711);  // traps (unrepresentable)
+  } catch (e) {
+
+--- 2 ---
+#call_div()
+
+-------------
+-> stepInto
+Paused at:
+--- 0 ---
+  } catch (e) {
+    #e.stack;  // step target of second pause
+  }
+
+--- 1 ---
+#call_div()
+
+-------------
+-> resume
+Finished.
diff --git a/deps/v8/test/inspector/debugger/wasm-step-after-trap.js b/deps/v8/test/inspector/debugger/wasm-step-after-trap.js
new file mode 100644
index 00000000000..c3f5af6dcfd
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-step-after-trap.js
@@ -0,0 +1,102 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const {session, contextGroup, Protocol} =
+    InspectorTest.start('Test scope inspection and stepping after a trap.');
+session.setupScriptMap();
+
+utils.load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+
+// Create a function which computes the div of the first two arguments.
+builder.addFunction('div', kSig_i_iii)
+    .addLocals(
+        {i32_count: 2}, ['a', 'b', 'unused', 'local_zero', 'local_const_11'])
+    .addBody([
+      kExprI32Const, 11,  // const 11
+      kExprLocalSet, 4,   // set local #4 ('local_const_11')
+      kExprLocalGet, 0,   // param 0
+      kExprLocalGet, 1,   // param 1
+      kExprI32DivS        // div
+    ])
+    .exportFunc();
+
+const module_bytes = JSON.stringify(builder.toArray());
+
+function instantiate(bytes) {
+  let buffer = new ArrayBuffer(bytes.length);
+  let view = new Uint8Array(buffer);
+  for (let i = 0; i < bytes.length; ++i) {
+    view[i] = bytes[i] | 0;
+  }
+
+  let module = new WebAssembly.Module(buffer);
+  return new WebAssembly.Instance(module);
+}
+
+function getShortLocationString(location) {
+  return `${location.lineNumber}:${location.columnNumber}`;
+}
+
+let actions =
+    ['stepInto', 'resume', 'stepInto', 'resume', 'stepInfo', 'resume'];
+Protocol.Debugger.onPaused(async msg => {
+  InspectorTest.log('Paused at:');
+  for (let [nr, frame] of msg.params.callFrames.entries()) {
+    InspectorTest.log(`--- ${nr} ---`);
+    await session.logSourceLocation(frame.location);
+    if (/^wasm/.test(frame.url)) await printLocalScope(frame);
+  }
+  InspectorTest.log('-------------');
+  let action = actions.shift();
+  InspectorTest.log(`-> ${action}`);
+  Protocol.Debugger[action]();
+});
+
+function call_div() {
+  instance.exports.div(0, 1, 4711);  // does not trap
+  try {
+    instance.exports.div(1, 0, 4711);  // traps (div by zero)
+  } catch (e) {
+    e.stack;  // step target of first pause
+  }
+  try {
+    instance.exports.div(0x80000000, -1, 4711);  // traps (unrepresentable)
+  } catch (e) {
+    e.stack;  // step target of second pause
+  }
+}
+
+contextGroup.addScript(instantiate.toString());
+contextGroup.addScript(call_div.toString());
+
+(async function test() {
+  await Protocol.Debugger.enable();
+  await Protocol.Debugger.setPauseOnExceptions({state: 'all'});
+  InspectorTest.log('Instantiating.');
+  await Protocol.Runtime.evaluate(
+      {'expression': `const instance = instantiate(${module_bytes});`});
+  InspectorTest.log('Calling div function.');
+  await Protocol.Runtime.evaluate({'expression': 'call_div()'});
+  InspectorTest.log('Finished.');
+  InspectorTest.completeTest();
+})();
+
+async function printLocalScope(frame) {
+  InspectorTest.log(`scope at ${frame.functionName} (${
+      frame.location.lineNumber}:${frame.location.columnNumber}):`);
+  for (let scope of frame.scopeChain) {
+    if (scope.type != 'local') continue;
+    let properties = await Protocol.Runtime.getProperties(
+        {'objectId': scope.object.objectId});
+    for (let value of properties.result.result) {
+      let msg = await Protocol.Runtime.getProperties(
+          {objectId: value.value.objectId});
+      let prop_str = p => `"${p.name}": ${p.value.value}`;
+      let value_str = msg.result.result.map(prop_str).join(', ');
+      InspectorTest.log(`   ${value.name}: ${value_str}`);
+    }
+  }
+}
diff --git a/deps/v8/test/inspector/debugger/wasm-stepping-byte-offsets-expected.txt b/deps/v8/test/inspector/debugger/wasm-stepping-byte-offsets-expected.txt
index 54e567e65b5..569699ea241 100644
--- a/deps/v8/test/inspector/debugger/wasm-stepping-byte-offsets-expected.txt
+++ b/deps/v8/test/inspector/debugger/wasm-stepping-byte-offsets-expected.txt
@@ -9,11 +9,10 @@ Setting breakpoint on offset 59 (should be propagated to 60, the offset of the c
 }
 Script wasm://wasm/befe41aa byte offset 60: Wasm opcode 0x10
 at wasm_B (0:60):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":3}
-   stack: {"0":1024}
  - scope (wasm-expression-stack):
    {"0":1024}
 at (anonymous) (0:17):
@@ -22,19 +21,17 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/befe41aa byte offset 39: Wasm opcode 0x01
 at wasm_A (0:39):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1024}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at wasm_B (0:60):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":3}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -43,19 +40,17 @@ at (anonymous) (0:17):
 Debugger.stepOver called
 Script wasm://wasm/befe41aa byte offset 40: Wasm opcode 0x01
 at wasm_A (0:40):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1024}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at wasm_B (0:60):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":3}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -64,11 +59,10 @@ at (anonymous) (0:17):
 Debugger.stepOut called
 Script wasm://wasm/befe41aa byte offset 62: Wasm opcode 0x0c
 at wasm_B (0:62):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":3}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -77,11 +71,10 @@ at (anonymous) (0:17):
 Debugger.stepOut called
 Script wasm://wasm/befe41aa byte offset 60: Wasm opcode 0x10
 at wasm_B (0:60):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":2}
-   stack: {"0":1024}
  - scope (wasm-expression-stack):
    {"0":1024}
 at (anonymous) (0:17):
@@ -90,11 +83,10 @@ at (anonymous) (0:17):
 Debugger.stepOver called
 Script wasm://wasm/befe41aa byte offset 62: Wasm opcode 0x0c
 at wasm_B (0:62):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":2}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -103,11 +95,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/befe41aa byte offset 46: Wasm opcode 0x20
 at wasm_B (0:46):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":2}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -116,11 +107,10 @@ at (anonymous) (0:17):
 Debugger.resume called
 Script wasm://wasm/befe41aa byte offset 60: Wasm opcode 0x10
 at wasm_B (0:60):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {"0":1024}
  - scope (wasm-expression-stack):
    {"0":1024}
 at (anonymous) (0:17):
@@ -129,19 +119,17 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/befe41aa byte offset 39: Wasm opcode 0x01
 at wasm_A (0:39):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1024}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at wasm_B (0:60):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -150,11 +138,10 @@ at (anonymous) (0:17):
 Debugger.stepOut called
 Script wasm://wasm/befe41aa byte offset 62: Wasm opcode 0x0c
 at wasm_B (0:62):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -163,11 +150,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/befe41aa byte offset 46: Wasm opcode 0x20
 at wasm_B (0:46):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -176,11 +162,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/befe41aa byte offset 48: Wasm opcode 0x04
 at wasm_B (0:48):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {"0":1}
  - scope (wasm-expression-stack):
    {"0":1}
 at (anonymous) (0:17):
@@ -189,11 +174,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/befe41aa byte offset 50: Wasm opcode 0x20
 at wasm_B (0:50):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -202,11 +186,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/befe41aa byte offset 52: Wasm opcode 0x41
 at wasm_B (0:52):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {"0":1}
  - scope (wasm-expression-stack):
    {"0":1}
 at (anonymous) (0:17):
@@ -215,11 +198,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/befe41aa byte offset 54: Wasm opcode 0x6b
 at wasm_B (0:54):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {"0":1,"1":1}
  - scope (wasm-expression-stack):
    {"0":1,"1":1}
 at (anonymous) (0:17):
@@ -228,11 +210,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/befe41aa byte offset 55: Wasm opcode 0x21
 at wasm_B (0:55):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {"0":0}
  - scope (wasm-expression-stack):
    {"0":0}
 at (anonymous) (0:17):
@@ -241,11 +222,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/befe41aa byte offset 57: Wasm opcode 0x41
 at wasm_B (0:57):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":0}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -254,11 +234,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/befe41aa byte offset 60: Wasm opcode 0x10
 at wasm_B (0:60):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":0}
-   stack: {"0":1024}
  - scope (wasm-expression-stack):
    {"0":1024}
 at (anonymous) (0:17):
@@ -267,19 +246,17 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/befe41aa byte offset 39: Wasm opcode 0x01
 at wasm_A (0:39):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1024}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at wasm_B (0:60):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":0}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -288,19 +265,17 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/befe41aa byte offset 40: Wasm opcode 0x01
 at wasm_A (0:40):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1024}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at wasm_B (0:60):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":0}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -309,19 +284,17 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/befe41aa byte offset 41: Wasm opcode 0x0b
 at wasm_A (0:41):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1024}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at wasm_B (0:60):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":0}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -330,11 +303,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/befe41aa byte offset 62: Wasm opcode 0x0c
 at wasm_B (0:62):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":0}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
diff --git a/deps/v8/test/inspector/debugger/wasm-stepping-byte-offsets.js b/deps/v8/test/inspector/debugger/wasm-stepping-byte-offsets.js
index d3c19329735..70f73d6cace 100644
--- a/deps/v8/test/inspector/debugger/wasm-stepping-byte-offsets.js
+++ b/deps/v8/test/inspector/debugger/wasm-stepping-byte-offsets.js
@@ -104,7 +104,7 @@ async function waitForPauseAndStep(stepAction) {
     InspectorTest.log(`at ${functionName} (${lineNumber}:${columnNumber}):`);
     for (var scope of frame.scopeChain) {
       InspectorTest.logObject(' - scope (' + scope.type + '):');
-      if (scope.type === 'global') {
+      if (scope.type === 'module' || scope.type === 'global') {
         InspectorTest.logObject('   -- skipped');
       } else {
         const {result: {result: {value}}} =
@@ -114,9 +114,7 @@ async function waitForPauseAndStep(stepAction) {
             returnByValue: true
           });
         if (scope.type === 'local') {
-          if (value.locals)
-            InspectorTest.log(`   locals: ${JSON.stringify(value.locals)}`);
-          InspectorTest.log(`   stack: ${JSON.stringify(value.stack)}`);
+          InspectorTest.log(`   locals: ${JSON.stringify(value.locals)}`);
         } else {
           InspectorTest.log(`   ${JSON.stringify(value)}`);
         }
diff --git a/deps/v8/test/inspector/debugger/wasm-stepping-liftoff.js b/deps/v8/test/inspector/debugger/wasm-stepping-liftoff.js
index 78c65e01f1b..7ff4f58d870 100644
--- a/deps/v8/test/inspector/debugger/wasm-stepping-liftoff.js
+++ b/deps/v8/test/inspector/debugger/wasm-stepping-liftoff.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --debug-in-liftoff
-
 let {session, contextGroup, Protocol} =
     InspectorTest.start('Tests stepping through wasm scripts by byte offsets');
 session.setupScriptMap();
diff --git a/deps/v8/test/inspector/debugger/wasm-stepping-with-source-map-expected.txt b/deps/v8/test/inspector/debugger/wasm-stepping-with-source-map-expected.txt
index 6e4f8ffc6a9..543e424214d 100644
--- a/deps/v8/test/inspector/debugger/wasm-stepping-with-source-map-expected.txt
+++ b/deps/v8/test/inspector/debugger/wasm-stepping-with-source-map-expected.txt
@@ -12,11 +12,10 @@ Setting breakpoint on offset 54 (on the setlocal before the call), url wasm://wa
 }
 Script wasm://wasm/9b4bf87e byte offset 54: Wasm opcode 0x21
 at wasm_B (0:54):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":4}
-   stack: {"0":3}
  - scope (wasm-expression-stack):
    {"0":3}
 at (anonymous) (0:17):
@@ -25,11 +24,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/9b4bf87e byte offset 56: Wasm opcode 0x10
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":3}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -38,18 +36,16 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/9b4bf87e byte offset 38: Wasm opcode 0x01
 at wasm_A (0:38):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":3}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -58,18 +54,16 @@ at (anonymous) (0:17):
 Debugger.stepOver called
 Script wasm://wasm/9b4bf87e byte offset 39: Wasm opcode 0x01
 at wasm_A (0:39):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":3}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -78,11 +72,10 @@ at (anonymous) (0:17):
 Debugger.stepOut called
 Script wasm://wasm/9b4bf87e byte offset 58: Wasm opcode 0x0c
 at wasm_B (0:58):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":3}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -91,11 +84,10 @@ at (anonymous) (0:17):
 Debugger.stepOut called
 Script wasm://wasm/9b4bf87e byte offset 54: Wasm opcode 0x21
 at wasm_B (0:54):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":3}
-   stack: {"0":2}
  - scope (wasm-expression-stack):
    {"0":2}
 at (anonymous) (0:17):
@@ -104,11 +96,10 @@ at (anonymous) (0:17):
 Debugger.stepOver called
 Script wasm://wasm/9b4bf87e byte offset 56: Wasm opcode 0x10
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":2}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -117,11 +108,10 @@ at (anonymous) (0:17):
 Debugger.stepOver called
 Script wasm://wasm/9b4bf87e byte offset 58: Wasm opcode 0x0c
 at wasm_B (0:58):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":2}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -130,11 +120,10 @@ at (anonymous) (0:17):
 Debugger.resume called
 Script wasm://wasm/9b4bf87e byte offset 54: Wasm opcode 0x21
 at wasm_B (0:54):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":2}
-   stack: {"0":1}
  - scope (wasm-expression-stack):
    {"0":1}
 at (anonymous) (0:17):
@@ -143,11 +132,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/9b4bf87e byte offset 56: Wasm opcode 0x10
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -156,18 +144,16 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/9b4bf87e byte offset 38: Wasm opcode 0x01
 at wasm_A (0:38):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -176,11 +162,10 @@ at (anonymous) (0:17):
 Debugger.stepOut called
 Script wasm://wasm/9b4bf87e byte offset 58: Wasm opcode 0x0c
 at wasm_B (0:58):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -189,11 +174,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/9b4bf87e byte offset 45: Wasm opcode 0x20
 at wasm_B (0:45):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -202,11 +186,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/9b4bf87e byte offset 47: Wasm opcode 0x04
 at wasm_B (0:47):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {"0":1}
  - scope (wasm-expression-stack):
    {"0":1}
 at (anonymous) (0:17):
@@ -215,11 +198,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/9b4bf87e byte offset 49: Wasm opcode 0x20
 at wasm_B (0:49):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -228,11 +210,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/9b4bf87e byte offset 51: Wasm opcode 0x41
 at wasm_B (0:51):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {"0":1}
  - scope (wasm-expression-stack):
    {"0":1}
 at (anonymous) (0:17):
@@ -241,11 +222,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/9b4bf87e byte offset 53: Wasm opcode 0x6b
 at wasm_B (0:53):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {"0":1,"1":1}
  - scope (wasm-expression-stack):
    {"0":1,"1":1}
 at (anonymous) (0:17):
@@ -254,11 +234,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/9b4bf87e byte offset 54: Wasm opcode 0x21
 at wasm_B (0:54):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":1}
-   stack: {"0":0}
  - scope (wasm-expression-stack):
    {"0":0}
 at (anonymous) (0:17):
@@ -267,11 +246,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/9b4bf87e byte offset 56: Wasm opcode 0x10
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":0}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -280,18 +258,16 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/9b4bf87e byte offset 38: Wasm opcode 0x01
 at wasm_A (0:38):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":0}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -300,18 +276,16 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/9b4bf87e byte offset 39: Wasm opcode 0x01
 at wasm_A (0:39):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":0}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -320,18 +294,16 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/9b4bf87e byte offset 40: Wasm opcode 0x0b
 at wasm_A (0:40):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at wasm_B (0:56):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":0}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
@@ -340,11 +312,10 @@ at (anonymous) (0:17):
 Debugger.stepInto called
 Script wasm://wasm/9b4bf87e byte offset 58: Wasm opcode 0x0c
 at wasm_B (0:58):
- - scope (global):
+ - scope (module):
    -- skipped
  - scope (local):
    locals: {"var0":0}
-   stack: {}
  - scope (wasm-expression-stack):
    {}
 at (anonymous) (0:17):
diff --git a/deps/v8/test/inspector/debugger/wasm-stepping-with-source-map.js b/deps/v8/test/inspector/debugger/wasm-stepping-with-source-map.js
index 17b1d05153c..b33751e7c6b 100644
--- a/deps/v8/test/inspector/debugger/wasm-stepping-with-source-map.js
+++ b/deps/v8/test/inspector/debugger/wasm-stepping-with-source-map.js
@@ -102,7 +102,7 @@ async function waitForPauseAndStep(stepAction) {
     InspectorTest.log(`at ${functionName} (${lineNumber}:${columnNumber}):`);
     for (var scope of frame.scopeChain) {
       InspectorTest.logObject(' - scope (' + scope.type + '):');
-      if (scope.type === 'global') {
+      if (scope.type === 'global' || scope.type === 'module') {
         InspectorTest.logObject('   -- skipped');
       } else {
         const {result: {result: {value}}} =
@@ -115,7 +115,6 @@ async function waitForPauseAndStep(stepAction) {
         if (scope.type === 'local') {
           if (value.locals)
             InspectorTest.log(`   locals: ${JSON.stringify(value.locals)}`);
-          InspectorTest.log(`   stack: ${JSON.stringify(value.stack)}`);
         } else {
           InspectorTest.log(`   ${JSON.stringify(value)}`);
         }
diff --git a/deps/v8/test/inspector/inspector-test.cc b/deps/v8/test/inspector/inspector-test.cc
index 4837f3caea9..b92d269c944 100644
--- a/deps/v8/test/inspector/inspector-test.cc
+++ b/deps/v8/test/inspector/inspector-test.cc
@@ -1070,7 +1070,6 @@ int main(int argc, char* argv[]) {
       printf("Embedding script '%s'\n", argv[i]);
       startup_data = i::CreateSnapshotDataBlobInternal(
           v8::SnapshotCreator::FunctionCodeHandling::kClear, argv[i], nullptr);
-      v8::internal::ReadOnlyHeap::ClearSharedHeapForTest();
       argv[i] = nullptr;
     }
   }
diff --git a/deps/v8/test/inspector/inspector.status b/deps/v8/test/inspector/inspector.status
index ba06c9df3c8..2a97083708a 100644
--- a/deps/v8/test/inspector/inspector.status
+++ b/deps/v8/test/inspector/inspector.status
@@ -14,15 +14,12 @@
 
   # https://crbug.com/v8/9029
   'debugger/script-on-after-compile-snapshot': [SKIP],
-}],  # ALWAYS
 
-##############################################################################
-['variant == future', {
   # https://crbug.com/v8/10356
   # This test worked in the wasm interpreter, but fails when using Liftoff for
   # debugging.
   'debugger/wasm-anyref-global': [FAIL],
-}],
+}],  # ALWAYS
 
 ##############################################################################
 ['system == android', {
@@ -78,11 +75,7 @@
 ##############################################################################
 ['arch == ppc or arch == ppc64', {
   # Liftoff needs to be enabled before running these tests.
-  'debugger/wasm-scope-info': [SKIP],
-  'debugger/wasm-scope-info-liftoff': [SKIP],
-  'debugger/wasm-set-breakpoint-liftoff': [SKIP],
-  'debugger/wasm-stepping-liftoff': [SKIP],
-  'debugger/wasm-inspect-many-registers': [SKIP],
+  'debugger/wasm-*': [SKIP],
 }],  # 'arch == ppc or arch == ppc64'
 
 ##############################################################################
@@ -90,13 +83,18 @@
   # Stack manipulations in LiveEdit is not implemented for this arch.
   'debugger/set-script-source-stack-padding': [SKIP],
   # Liftoff needs to be enabled before running these tests.
-  'debugger/wasm-scope-info': [SKIP],
-  'debugger/wasm-scope-info-liftoff': [SKIP],
-  'debugger/wasm-set-breakpoint-liftoff': [SKIP],
-  'debugger/wasm-stepping-liftoff': [SKIP],
-  'debugger/wasm-inspect-many-registers': [SKIP],
+  'debugger/wasm-*': [SKIP],
 }],  # 'arch == s390 or arch == s390x'
 
+################################################################################
+['variant == stress_snapshot', {
+  '*': [SKIP],  # only relevant for mjsunit tests.
+}],
+
 ##############################################################################
+['tsan == True', {
+  # TSan handles SIGPROF incorrectly (https://crbug.com/v8/9869).
+  'cpu-profiler/console-profile-wasm': [SKIP],
+}],  # 'tsan == True'
 
 ]
diff --git a/deps/v8/test/inspector/runtime/console-time-end-format-expected.txt b/deps/v8/test/inspector/runtime/console-time-end-format-expected.txt
index d09dc41c790..dd4a6960b30 100644
--- a/deps/v8/test/inspector/runtime/console-time-end-format-expected.txt
+++ b/deps/v8/test/inspector/runtime/console-time-end-format-expected.txt
@@ -1,37 +1,37 @@
 Checks format of console.timeEnd output
 
 Running test: zero
-js: 0ms
-timeEnd: 0ms
+js: 0 ms
+timeEnd: 0 ms
 
 Running test: verySmall
-js: 1e-15ms
-timeEnd: 1e-15ms
+js: 1e-15 ms
+timeEnd: 1e-15 ms
 
 Running test: small
-js: 0.001ms
-timeEnd: 0.001ms
+js: 0.001 ms
+timeEnd: 0.001 ms
 
 Running test: regular
-js: 1.2345ms
-timeEnd: 1.2345ms
+js: 1.2345 ms
+timeEnd: 1.2345 ms
 
 Running test: big
-js: 10000.2345ms
-timeEnd: 10000.2345ms
+js: 10000.2345 ms
+timeEnd: 10000.2345 ms
 
 Running test: veryBig
-js: 1000000000000000.2ms
-timeEnd: 1000000000000000.2ms
+js: 1000000000000000.2 ms
+timeEnd: 1000000000000000.2 ms
 
 Running test: huge
-js: 1e+42ms
-timeEnd: 1e+42ms
+js: 1e+42 ms
+timeEnd: 1e+42 ms
 
 Running test: undefinedAsLabel
-js: 1ms
-default: 1ms
+js: 1 ms
+default: 1 ms
 
 Running test: emptyAsLabel
-js: 1ms
-default: 1ms
+js: 1 ms
+default: 1 ms
diff --git a/deps/v8/test/inspector/runtime/console-time-end-format.js b/deps/v8/test/inspector/runtime/console-time-end-format.js
index 4b28f67e8e5..c7d779fecf3 100644
--- a/deps/v8/test/inspector/runtime/console-time-end-format.js
+++ b/deps/v8/test/inspector/runtime/console-time-end-format.js
@@ -43,7 +43,7 @@ async function checkInterval(time, label) {
   label = label === undefined ? '\'timeEnd\'' : label;
   utils.setCurrentTimeMSForTest(0.0);
   Protocol.Runtime.evaluate({
-    expression: `console.log('js: ' + ${time} + 'ms')`
+    expression: `console.log('js: ' + ${time} + ' ms')`
   });
   await Protocol.Runtime.evaluate({expression: `console.time(${label})`});
   utils.setCurrentTimeMSForTest(time);
diff --git a/deps/v8/test/inspector/runtime/console-time-log-expected.txt b/deps/v8/test/inspector/runtime/console-time-log-expected.txt
index 4cf9e408a3d..72d00552c1f 100644
--- a/deps/v8/test/inspector/runtime/console-time-log-expected.txt
+++ b/deps/v8/test/inspector/runtime/console-time-log-expected.txt
@@ -2,7 +2,7 @@ Test for console.timeLog
 [
     [0] : {
         type : string
-        value : 42: 1ms
+        value : 42: 1 ms
     }
     [1] : {
         type : string
@@ -12,7 +12,7 @@ Test for console.timeLog
 [
     [0] : {
         type : string
-        value : 42: 2ms
+        value : 42: 2 ms
     }
     [1] : {
         type : string
@@ -26,7 +26,7 @@ Test for console.timeLog
 [
     [0] : {
         type : string
-        value : 42: 3ms
+        value : 42: 3 ms
     }
 ]
 [
diff --git a/deps/v8/test/inspector/runtime/console-time-repeat-expected.txt b/deps/v8/test/inspector/runtime/console-time-repeat-expected.txt
index b675532adbf..600423e3610 100644
--- a/deps/v8/test/inspector/runtime/console-time-repeat-expected.txt
+++ b/deps/v8/test/inspector/runtime/console-time-repeat-expected.txt
@@ -13,10 +13,10 @@ Checks that repeated console.time do not reset
             callFrames : [
                 [0] : {
                     columnNumber : 8
-                    functionName : 
+                    functionName :
                     lineNumber : 0
                     scriptId : <scriptId>
-                    url : 
+                    url :
                 }
             ]
         }
@@ -30,7 +30,7 @@ Checks that repeated console.time do not reset
         args : [
             [0] : {
                 type : string
-                value : a: 2ms
+                value : a: 2 ms
             }
         ]
         executionContextId : <executionContextId>
@@ -38,10 +38,10 @@ Checks that repeated console.time do not reset
             callFrames : [
                 [0] : {
                     columnNumber : 8
-                    functionName : 
+                    functionName :
                     lineNumber : 0
                     scriptId : <scriptId>
-                    url : 
+                    url :
                 }
             ]
         }
@@ -63,10 +63,10 @@ Checks that repeated console.time do not reset
             callFrames : [
                 [0] : {
                     columnNumber : 8
-                    functionName : 
+                    functionName :
                     lineNumber : 0
                     scriptId : <scriptId>
-                    url : 
+                    url :
                 }
             ]
         }
diff --git a/deps/v8/test/inspector/runtime/internal-properties-expected.txt b/deps/v8/test/inspector/runtime/internal-properties-expected.txt
index 978c104866c..fc4de5bca39 100644
--- a/deps/v8/test/inspector/runtime/internal-properties-expected.txt
+++ b/deps/v8/test/inspector/runtime/internal-properties-expected.txt
@@ -160,14 +160,14 @@ expression: Promise.resolve(42)
     result : {
         internalProperties : [
             [0] : {
-                name : [[PromiseStatus]]
+                name : [[PromiseState]]
                 value : {
                     type : string
-                    value : resolved
+                    value : fulfilled
                 }
             }
             [1] : {
-                name : [[PromiseValue]]
+                name : [[PromiseResult]]
                 value : {
                     description : 42
                     type : number
@@ -183,14 +183,14 @@ expression: new Promise(() => undefined)
     result : {
         internalProperties : [
             [0] : {
-                name : [[PromiseStatus]]
+                name : [[PromiseState]]
                 value : {
                     type : string
                     value : pending
                 }
             }
             [1] : {
-                name : [[PromiseValue]]
+                name : [[PromiseResult]]
                 value : {
                     type : undefined
                 }
@@ -219,7 +219,7 @@ expression: gen1
                 }
             }
             [1] : {
-                name : [[GeneratorStatus]]
+                name : [[GeneratorState]]
                 value : {
                     type : string
                     value : suspended
@@ -275,7 +275,7 @@ expression: gen1.next();gen1
                 }
             }
             [1] : {
-                name : [[GeneratorStatus]]
+                name : [[GeneratorState]]
                 value : {
                     type : string
                     value : suspended
@@ -331,7 +331,7 @@ expression: gen1.next();gen1
                 }
             }
             [1] : {
-                name : [[GeneratorStatus]]
+                name : [[GeneratorState]]
                 value : {
                     type : string
                     value : closed
@@ -379,7 +379,7 @@ expression: gen2
                 }
             }
             [1] : {
-                name : [[GeneratorStatus]]
+                name : [[GeneratorState]]
                 value : {
                     type : string
                     value : suspended
@@ -435,7 +435,7 @@ expression: gen2.next();gen2
                 }
             }
             [1] : {
-                name : [[GeneratorStatus]]
+                name : [[GeneratorState]]
                 value : {
                     type : string
                     value : suspended
@@ -491,7 +491,7 @@ expression: gen2.next();gen2
                 }
             }
             [1] : {
-                name : [[GeneratorStatus]]
+                name : [[GeneratorState]]
                 value : {
                     type : string
                     value : closed
diff --git a/deps/v8/test/inspector/runtime/protocol-works-with-different-locale-expected.txt b/deps/v8/test/inspector/runtime/protocol-works-with-different-locale-expected.txt
index da9eccc694b..7f66bbca67c 100644
--- a/deps/v8/test/inspector/runtime/protocol-works-with-different-locale-expected.txt
+++ b/deps/v8/test/inspector/runtime/protocol-works-with-different-locale-expected.txt
@@ -16,10 +16,10 @@ Running test: consoleLogWithDefaultLocale
             callFrames : [
                 [0] : {
                     columnNumber : 8
-                    functionName : 
+                    functionName :
                     lineNumber : 0
                     scriptId : <scriptId>
-                    url : 
+                    url :
                 }
             ]
         }
@@ -36,7 +36,7 @@ set locale to fr_CA.UTF-8 (has comma as separator)
         args : [
             [0] : {
                 type : string
-                value : a: 0.001ms
+                value : a: 0.001 ms
             }
         ]
         executionContextId : <executionContextId>
@@ -44,10 +44,10 @@ set locale to fr_CA.UTF-8 (has comma as separator)
             callFrames : [
                 [0] : {
                     columnNumber : 8
-                    functionName : 
+                    functionName :
                     lineNumber : 0
                     scriptId : <scriptId>
-                    url : 
+                    url :
                 }
             ]
         }
@@ -73,10 +73,10 @@ set locale to fr_CA.UTF-8 (has comma as separator)
             callFrames : [
                 [0] : {
                     columnNumber : 8
-                    functionName : 
+                    functionName :
                     lineNumber : 0
                     scriptId : <scriptId>
-                    url : 
+                    url :
                 }
             ]
         }
@@ -102,10 +102,10 @@ set locale to fr_CA.UTF-8 (has comma as separator)
             callFrames : [
                 [0] : {
                     columnNumber : 8
-                    functionName : 
+                    functionName :
                     lineNumber : 0
                     scriptId : <scriptId>
-                    url : 
+                    url :
                 }
             ]
         }
@@ -119,7 +119,7 @@ set locale to fr_CA.UTF-8 (has comma as separator)
         args : [
             [0] : {
                 type : string
-                value : a: 0.001ms
+                value : a: 0.001 ms
             }
         ]
         executionContextId : <executionContextId>
@@ -127,10 +127,10 @@ set locale to fr_CA.UTF-8 (has comma as separator)
             callFrames : [
                 [0] : {
                     columnNumber : 8
-                    functionName : 
+                    functionName :
                     lineNumber : 0
                     scriptId : <scriptId>
-                    url : 
+                    url :
                 }
             ]
         }
diff --git a/deps/v8/test/inspector/runtime/query-objects-expected.txt b/deps/v8/test/inspector/runtime/query-objects-expected.txt
index c11f021101b..640da3d20b8 100644
--- a/deps/v8/test/inspector/runtime/query-objects-expected.txt
+++ b/deps/v8/test/inspector/runtime/query-objects-expected.txt
@@ -98,6 +98,9 @@ Dump each object constructor name.
 Running test: testQueryObjectsWithFeedbackVector
 Before/After difference: 1
 
+Running test: testQueryObjectsWithArrayBuffer
+Test that queryObjects does not crash for on-heap TypedArrays
+
 Running test: testWithObjectGroup
 Query for Array.prototype 3 times
 Results since initial: 0
diff --git a/deps/v8/test/inspector/runtime/query-objects.js b/deps/v8/test/inspector/runtime/query-objects.js
index 63a26deaefc..302c7c195cd 100644
--- a/deps/v8/test/inspector/runtime/query-objects.js
+++ b/deps/v8/test/inspector/runtime/query-objects.js
@@ -147,6 +147,34 @@ InspectorTest.runAsyncTestSuite([
     session.disconnect();
   },
 
+  async function testQueryObjectsWithArrayBuffer() {
+    let contextGroup = new InspectorTest.ContextGroup();
+    let session = contextGroup.connect();
+    let Protocol = session.Protocol;
+
+    await Protocol.Runtime.evaluate({
+      expression: 'new Int8Array(32)',
+    });
+    let {result:{result:{objectId}}} = await Protocol.Runtime.evaluate({
+      expression: 'ArrayBuffer.prototype'
+    });
+    let {result:{objects}} = await session.Protocol.Runtime.queryObjects({
+      prototypeObjectId: objectId
+    });
+    let {result:{result: properties}} = await session.Protocol.Runtime.getProperties({
+      objectId: objects.objectId,
+      ownProperties: true,
+      generatePreview: true
+    });
+    await session.Protocol.Runtime.getProperties({
+      objectId: properties[0].value.objectId,
+      ownProperties: true,
+      generatePreview: true
+    });
+    InspectorTest.log('Test that queryObjects does not crash for on-heap TypedArrays');
+    session.disconnect();
+  },
+
   async function testWithObjectGroup() {
     let contextGroup = new InspectorTest.ContextGroup();
     let session = contextGroup.connect();
diff --git a/deps/v8/test/inspector/runtime/regress-1075763-expected.txt b/deps/v8/test/inspector/runtime/regress-1075763-expected.txt
new file mode 100644
index 00000000000..0cc0ce21331
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/regress-1075763-expected.txt
@@ -0,0 +1,26 @@
+Tests Runtime.evaluate returns object with undefined property.
+{
+    id : <messageId>
+    result : {
+        result : {
+            className : f
+            description : f
+            objectId : <objectId>
+            preview : {
+                description : f
+                overflow : false
+                properties : [
+                    [0] : {
+                        name : [[GeneratorState]]
+                        type : string
+                        value : suspended
+                    }
+                ]
+                subtype : generator
+                type : object
+            }
+            subtype : generator
+            type : object
+        }
+    }
+}
diff --git a/deps/v8/test/inspector/runtime/regress-1075763.js b/deps/v8/test/inspector/runtime/regress-1075763.js
new file mode 100644
index 00000000000..5137ed730c2
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/regress-1075763.js
@@ -0,0 +1,14 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+    'Tests Runtime.evaluate returns object with undefined property.');
+
+(async function test() {
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: "(function* f() {  yield f;})()",
+    generatePreview: true
+  }));
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/runtime/regress-1078205-expected.txt b/deps/v8/test/inspector/runtime/regress-1078205-expected.txt
new file mode 100644
index 00000000000..0f1754b9d74
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/regress-1078205-expected.txt
@@ -0,0 +1,157 @@
+Test malformed sourceURL magic comment.
+{
+    id : <messageId>
+    result : {
+        exceptionDetails : {
+            columnNumber : 0
+            exception : {
+                className : SyntaxError
+                description : SyntaxError: Unexpected token / in JSON at position 0     at JSON.parse (<anonymous>)     at <anonymous>:1:6
+                objectId : <objectId>
+                subtype : error
+                type : object
+            }
+            exceptionId : <exceptionId>
+            lineNumber : 0
+            scriptId : <scriptId>
+            text : Uncaught
+        }
+        result : {
+            className : SyntaxError
+            description : SyntaxError: Unexpected token / in JSON at position 0     at JSON.parse (<anonymous>)     at <anonymous>:1:6
+            objectId : <objectId>
+            subtype : error
+            type : object
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        exceptionDetails : {
+            columnNumber : 0
+            exception : {
+                className : SyntaxError
+                description : SyntaxError: Unexpected token / in JSON at position 0     at JSON.parse (<anonymous>)     at <anonymous>:1:6
+                objectId : <objectId>
+                subtype : error
+                type : object
+            }
+            exceptionId : <exceptionId>
+            lineNumber : 0
+            scriptId : <scriptId>
+            text : Uncaught
+        }
+        result : {
+            className : SyntaxError
+            description : SyntaxError: Unexpected token / in JSON at position 0     at JSON.parse (<anonymous>)     at <anonymous>:1:6
+            objectId : <objectId>
+            subtype : error
+            type : object
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        exceptionDetails : {
+            columnNumber : 0
+            exception : {
+                className : SyntaxError
+                description : SyntaxError: Unexpected token / in JSON at position 0     at JSON.parse (<anonymous>)     at <anonymous>:1:6
+                objectId : <objectId>
+                subtype : error
+                type : object
+            }
+            exceptionId : <exceptionId>
+            lineNumber : 0
+            scriptId : <scriptId>
+            text : Uncaught
+        }
+        result : {
+            className : SyntaxError
+            description : SyntaxError: Unexpected token / in JSON at position 0     at JSON.parse (<anonymous>)     at <anonymous>:1:6
+            objectId : <objectId>
+            subtype : error
+            type : object
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        exceptionDetails : {
+            columnNumber : 0
+            exception : {
+                className : SyntaxError
+                description : SyntaxError: Unexpected token / in JSON at position 0     at JSON.parse (<anonymous>)     at <anonymous>:1:6
+                objectId : <objectId>
+                subtype : error
+                type : object
+            }
+            exceptionId : <exceptionId>
+            lineNumber : 0
+            scriptId : <scriptId>
+            text : Uncaught
+        }
+        result : {
+            className : SyntaxError
+            description : SyntaxError: Unexpected token / in JSON at position 0     at JSON.parse (<anonymous>)     at <anonymous>:1:6
+            objectId : <objectId>
+            subtype : error
+            type : object
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        exceptionDetails : {
+            columnNumber : 0
+            exception : {
+                className : SyntaxError
+                description : SyntaxError: Unexpected token / in JSON at position 0     at JSON.parse (<anonymous>)     at <anonymous>:1:6
+                objectId : <objectId>
+                subtype : error
+                type : object
+            }
+            exceptionId : <exceptionId>
+            lineNumber : 0
+            scriptId : <scriptId>
+            text : Uncaught
+        }
+        result : {
+            className : SyntaxError
+            description : SyntaxError: Unexpected token / in JSON at position 0     at JSON.parse (<anonymous>)     at <anonymous>:1:6
+            objectId : <objectId>
+            subtype : error
+            type : object
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        exceptionDetails : {
+            columnNumber : 0
+            exception : {
+                className : SyntaxError
+                description : SyntaxError: Unexpected token / in JSON at position 0     at JSON.parse (<anonymous>)     at <anonymous>:1:6
+                objectId : <objectId>
+                subtype : error
+                type : object
+            }
+            exceptionId : <exceptionId>
+            lineNumber : 0
+            scriptId : <scriptId>
+            text : Uncaught
+        }
+        result : {
+            className : SyntaxError
+            description : SyntaxError: Unexpected token / in JSON at position 0     at JSON.parse (<anonymous>)     at <anonymous>:1:6
+            objectId : <objectId>
+            subtype : error
+            type : object
+        }
+    }
+}
diff --git a/deps/v8/test/inspector/runtime/regress-1078205.js b/deps/v8/test/inspector/runtime/regress-1078205.js
new file mode 100644
index 00000000000..ce17c190514
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/regress-1078205.js
@@ -0,0 +1,34 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+let {session, contextGroup, Protocol} = InspectorTest.start(
+    'Test malformed sourceURL magic comment.');
+
+(async function test() {
+  await Protocol.Debugger.enable();
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: "JSON.parse('//')",
+    generatePreview: true,
+  }));
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: "JSON.parse('//#')",
+    generatePreview: true,
+  }));
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: "JSON.parse('//# ')",
+    generatePreview: true,
+  }));
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: "JSON.parse('//# sourceURL')",
+    generatePreview: true,
+  }));
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: "JSON.parse('//# sourceURL=')",
+    generatePreview: true,
+  }));
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: "JSON.parse('//# sourceURL=\"')",
+    generatePreview: true,
+  }));
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/runtime/regress-986051-expected.txt b/deps/v8/test/inspector/runtime/regress-986051-expected.txt
new file mode 100644
index 00000000000..ad2f3d82095
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/regress-986051-expected.txt
@@ -0,0 +1,76 @@
+Regression test for 986051
+Regression test
+{
+    id : <messageId>
+    result : {
+        result : {
+            description : 1
+            type : number
+            value : 1
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        exceptionDetails : {
+            columnNumber : 1
+            exception : {
+                className : ReferenceError
+                description : ReferenceError: $0 is not defined     at <anonymous>:1:1
+                objectId : <objectId>
+                subtype : error
+                type : object
+            }
+            exceptionId : <exceptionId>
+            lineNumber : 1
+            scriptId : <scriptId>
+            stackTrace : {
+                callFrames : [
+                    [0] : {
+                        columnNumber : 0
+                        functionName : 
+                        lineNumber : 0
+                        scriptId : <scriptId>
+                        url : 
+                    }
+                ]
+            }
+            text : Uncaught
+        }
+        result : {
+            className : ReferenceError
+            description : ReferenceError: $0 is not defined     at <anonymous>:1:1
+            objectId : <objectId>
+            subtype : error
+            type : object
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        result : {
+            className : global
+            description : global
+            objectId : <objectId>
+            type : object
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        result : {
+            type : undefined
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        result : {
+            type : undefined
+        }
+    }
+}
diff --git a/deps/v8/test/inspector/runtime/regress-986051.js b/deps/v8/test/inspector/runtime/regress-986051.js
new file mode 100644
index 00000000000..7c6842a36cf
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/regress-986051.js
@@ -0,0 +1,25 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {Protocol} = InspectorTest.start(
+  "Regression test for 986051");
+
+Protocol.Runtime.enable();
+(async function() {
+  InspectorTest.log("Regression test");
+  evaluateRepl('1', true);
+  evaluateRepl('$0', false);
+  evaluateRepl('Object.defineProperty(globalThis, "$0", {configurable: false});', true);
+  evaluateRepl('$0', true);
+  evaluateRepl('$0', false);
+  InspectorTest.completeTest();
+})();
+
+async function evaluateRepl(expression, includeCommandLineAPI) {
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression,
+    includeCommandLineAPI,
+    replMode: true,
+  }));
+}
diff --git a/deps/v8/test/inspector/runtime/remote-object-expected.txt b/deps/v8/test/inspector/runtime/remote-object-expected.txt
index 98fe47beed7..f4d98a9ccaa 100644
--- a/deps/v8/test/inspector/runtime/remote-object-expected.txt
+++ b/deps/v8/test/inspector/runtime/remote-object-expected.txt
@@ -1274,7 +1274,7 @@ Running test: testGenerator
             overflow : false
             properties : [
                 [0] : {
-                    name : [[GeneratorStatus]]
+                    name : [[GeneratorState]]
                     type : string
                     value : suspended
                 }
@@ -1565,12 +1565,12 @@ Running test: testPromise
             overflow : false
             properties : [
                 [0] : {
-                    name : [[PromiseStatus]]
+                    name : [[PromiseState]]
                     type : string
-                    value : resolved
+                    value : fulfilled
                 }
                 [1] : {
-                    name : [[PromiseValue]]
+                    name : [[PromiseResult]]
                     type : string
                     value : aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa…aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
                 }
@@ -1593,12 +1593,12 @@ Running test: testPromise
             overflow : false
             properties : [
                 [0] : {
-                    name : [[PromiseStatus]]
+                    name : [[PromiseState]]
                     type : string
                     value : rejected
                 }
                 [1] : {
-                    name : [[PromiseValue]]
+                    name : [[PromiseResult]]
                     type : number
                     value : 42
                 }
@@ -1621,12 +1621,12 @@ Running test: testPromise
             overflow : false
             properties : [
                 [0] : {
-                    name : [[PromiseStatus]]
+                    name : [[PromiseState]]
                     type : string
                     value : pending
                 }
                 [1] : {
-                    name : [[PromiseValue]]
+                    name : [[PromiseResult]]
                     type : undefined
                     value : undefined
                 }
diff --git a/deps/v8/test/intl/date-format/check-calendar.js b/deps/v8/test/intl/date-format/check-calendar.js
index 8654e380359..ba0beed9043 100644
--- a/deps/v8/test/intl/date-format/check-calendar.js
+++ b/deps/v8/test/intl/date-format/check-calendar.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-intl-add-calendar-numbering-system
-
 let invalidCalendar = [
   "invalid",
   "abce",
diff --git a/deps/v8/test/intl/date-format/check-numbering-system.js b/deps/v8/test/intl/date-format/check-numbering-system.js
index c17a84fff15..141cc13039d 100644
--- a/deps/v8/test/intl/date-format/check-numbering-system.js
+++ b/deps/v8/test/intl/date-format/check-numbering-system.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-intl-add-calendar-numbering-system
-
 let invalidNumberingSystem = [
   "invalid",
   "abce",
diff --git a/deps/v8/test/intl/date-format/constructor-calendar-numberingSytem-order.js b/deps/v8/test/intl/date-format/constructor-calendar-numberingSytem-order.js
index 75b4a456d4b..a859a29c056 100644
--- a/deps/v8/test/intl/date-format/constructor-calendar-numberingSytem-order.js
+++ b/deps/v8/test/intl/date-format/constructor-calendar-numberingSytem-order.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-intl-add-calendar-numbering-system
 const actual = [];
 
 const options = {
diff --git a/deps/v8/test/intl/date-format/property-override.js b/deps/v8/test/intl/date-format/property-override.js
index 370f82b0c69..44b8b9d7abf 100644
--- a/deps/v8/test/intl/date-format/property-override.js
+++ b/deps/v8/test/intl/date-format/property-override.js
@@ -71,6 +71,7 @@ var expectedProperties = [
   'minute',
   'second',
   'timeZoneName',
+  'fractionalSecondDigits',
 ];
 
 assertEquals(expectedProperties.length, properties.length);
diff --git a/deps/v8/test/intl/date-format/related-year.js b/deps/v8/test/intl/date-format/related-year.js
index a3d9e9dcb4b..9460a5705b2 100644
--- a/deps/v8/test/intl/date-format/related-year.js
+++ b/deps/v8/test/intl/date-format/related-year.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-intl-other-calendars
 // Test it will output relatedYear and yearName
 
 let df = new Intl.DateTimeFormat("zh-u-ca-chinese", {year: "numeric"})
diff --git a/deps/v8/test/intl/displaynames/constructor-order.js b/deps/v8/test/intl/displaynames/constructor-order.js
index 6951b5fddb9..919df585bd3 100644
--- a/deps/v8/test/intl/displaynames/constructor-order.js
+++ b/deps/v8/test/intl/displaynames/constructor-order.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-intl-displaynames
-
 // Throws only once during construction.
 // Check for all getters to prevent regression.
 // Preserve the order of getter initialization.
diff --git a/deps/v8/test/intl/displaynames/constructor.js b/deps/v8/test/intl/displaynames/constructor.js
index c86fa479feb..2dc72e63ceb 100644
--- a/deps/v8/test/intl/displaynames/constructor.js
+++ b/deps/v8/test/intl/displaynames/constructor.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-intl-displaynames
 // DisplayNames constructor can't be called as function.
 assertThrows(() => Intl.DisplayNames('sr'), TypeError);
 
diff --git a/deps/v8/test/intl/displaynames/resolved-options.js b/deps/v8/test/intl/displaynames/resolved-options.js
index dd8988375ac..32cbc8f199a 100644
--- a/deps/v8/test/intl/displaynames/resolved-options.js
+++ b/deps/v8/test/intl/displaynames/resolved-options.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-intl-displaynames
-
 let displayNames = new Intl.DisplayNames();
 // The default style is 'long'
 assertEquals('long', displayNames.resolvedOptions().style);
diff --git a/deps/v8/test/intl/displaynames/supported-locale.js b/deps/v8/test/intl/displaynames/supported-locale.js
index d392bedd114..ac8f058fbed 100644
--- a/deps/v8/test/intl/displaynames/supported-locale.js
+++ b/deps/v8/test/intl/displaynames/supported-locale.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-intl-displaynames
-
 assertEquals(typeof Intl.DisplayNames.supportedLocalesOf, "function",
              "Intl.DisplayNames.supportedLocalesOf should be a function");
 
diff --git a/deps/v8/test/intl/intl.status b/deps/v8/test/intl/intl.status
index 6437de45db2..617617f5155 100644
--- a/deps/v8/test/intl/intl.status
+++ b/deps/v8/test/intl/intl.status
@@ -34,11 +34,10 @@
   'collator/check-kf-option': [FAIL],
   'collator/check-kn-option': [FAIL],
 
-  # https://code.google.com/p/v8/issues/detail?id=9312
-  'regress-9312': [FAIL],
-
   # http://crbug/v8/9930
   'date-format/format_range_hour_cycle': [FAIL],
+  # http://crbug/v8/10437
+  'regress-10437': [FAIL],
 }],  # ALWAYS
 
 ['variant == no_wasm_traps', {
@@ -67,8 +66,11 @@
   'default_locale': [SKIP],
   # Unable to change locale and TZ on Android:
   'regress-7770': [SKIP],
-  # 'bn' locale is not included in Android.
-  'relative-time-format/resolved-options-nu-extended': [FAIL],
 }],  # 'system == android'
 
+################################################################################
+['variant == stress_snapshot', {
+  '*': [SKIP],  # only relevant for mjsunit tests.
+}],
+
 ]
diff --git a/deps/v8/test/intl/number-format/check-numbering-system.js b/deps/v8/test/intl/number-format/check-numbering-system.js
index 78c9a6d8d54..e17b1f427a3 100644
--- a/deps/v8/test/intl/number-format/check-numbering-system.js
+++ b/deps/v8/test/intl/number-format/check-numbering-system.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-intl-add-calendar-numbering-system
-
 let invalidNumberingSystem = [
   "invalid",
   "abce",
diff --git a/deps/v8/test/intl/number-format/constructor-numberingSytem-order.js b/deps/v8/test/intl/number-format/constructor-numberingSytem-order.js
index 8c284967ff8..6cc73c2d23e 100644
--- a/deps/v8/test/intl/number-format/constructor-numberingSytem-order.js
+++ b/deps/v8/test/intl/number-format/constructor-numberingSytem-order.js
@@ -1,8 +1,6 @@
 // Copyright 2019 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-
-// Flags: --harmony-intl-add-calendar-numbering-system
 const actual = [];
 
 const options = {
diff --git a/deps/v8/test/intl/regress-10437.js b/deps/v8/test/intl/regress-10437.js
new file mode 100644
index 00000000000..1bdd3566608
--- /dev/null
+++ b/deps/v8/test/intl/regress-10437.js
@@ -0,0 +1,18 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertDoesNotThrow(() => (new Intl.NumberFormat(
+    'ar', {style: 'unit', unit: 'acre-per-degree'})).format(0));
+
+assertDoesNotThrow(() => (new Intl.NumberFormat(
+    'ar', {style: 'unit', unit: 'millimeter-per-mile'})).format(0));
+
+assertDoesNotThrow(() => (new Intl.NumberFormat(
+    'ar', {style: 'unit', unit: 'centimeter-per-acre'})).format(1));
+
+assertDoesNotThrow(() => (new Intl.NumberFormat(
+    'ar', {style: 'unit', unit: 'minute-per-yard'})).format(1));
+
+assertDoesNotThrow(() => (new Intl.NumberFormat(
+    'ar', {style: 'unit', unit: 'foot-per-fluid-ounce'})).format(2));
diff --git a/deps/v8/test/intl/regress-10438.js b/deps/v8/test/intl/regress-10438.js
new file mode 100644
index 00000000000..81419180cf1
--- /dev/null
+++ b/deps/v8/test/intl/regress-10438.js
@@ -0,0 +1,51 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony_intl_dateformat_fractional_second_digits
+
+assertEquals(
+    0,
+    (new Intl.DateTimeFormat("en", {fractionalSecondDigits: 0}))
+        .resolvedOptions().fractionalSecondDigits);
+
+assertEquals(
+    1,
+    (new Intl.DateTimeFormat("en", {fractionalSecondDigits: 1}))
+        .resolvedOptions().fractionalSecondDigits);
+
+assertEquals(
+    2,
+    (new Intl.DateTimeFormat("en", {fractionalSecondDigits: 2}))
+        .resolvedOptions().fractionalSecondDigits);
+
+assertEquals(
+    3,
+    (new Intl.DateTimeFormat("en", {fractionalSecondDigits: 3}))
+        .resolvedOptions().fractionalSecondDigits);
+
+// When timeStyle and dateStyle is not present, GetNumberOption will fallback
+// to 0 as default regardless fractionalSecondDigits is present in the option or
+// not.
+assertEquals(
+    0,
+    (new Intl.DateTimeFormat()).resolvedOptions().fractionalSecondDigits);
+
+assertEquals(
+    0,
+    (new Intl.DateTimeFormat("en", {fractionalSecondDigits: undefined}))
+        .resolvedOptions().fractionalSecondDigits);
+
+// When timeStyle or dateStyle is present, the code should not read
+// fractionalSecondDigits from the option.
+assertEquals(
+    undefined,
+    (new Intl.DateTimeFormat(
+        "en", {timeStyle: "short", fractionalSecondDigits: 3}))
+        .resolvedOptions().fractionalSecondDigits);
+
+assertEquals(
+    undefined,
+    (new Intl.DateTimeFormat(
+        "en", {dateStyle: "short", fractionalSecondDigits: 3}))
+        .resolvedOptions().fractionalSecondDigits);
diff --git a/deps/v8/test/intl/regress-1074578.js b/deps/v8/test/intl/regress-1074578.js
new file mode 100644
index 00000000000..c8fa56e8a27
--- /dev/null
+++ b/deps/v8/test/intl/regress-1074578.js
@@ -0,0 +1,45 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test the update of tz2020a
+// https://mm.icann.org/pipermail/tz-announce/2020-April/000058.html
+//    Morocco springs forward on 2020-05-31, not 2020-05-24.
+//    Canada's Yukon advanced to -07 year-round on 2020-03-08.
+//    America/Nuuk renamed from America/Godthab.
+//    zic now supports expiration dates for leap second lists.
+
+// A. Test Morocco springs forward on 2020-05-31, not 2020-05-24.
+
+const df1 = new Intl.DateTimeFormat(
+    "en",
+    {timeZone: "Africa/Casablanca", timeStyle: "long", dateStyle: "long"})
+const d1 = new Date("2020-05-25T00:00:00.000Z");
+const d2 = new Date("2020-05-31T00:00:00.000Z");
+
+// Before tz2020a change will get "May 25, 2020 at 1:00:00 AM GMT+1"
+assertEquals("May 25, 2020 at 12:00:00 AM GMT", df1.format(d1));
+
+// Before tz2020a change will get "May 31, 2020 at 1:00:00 AM GMT+1"
+assertEquals("May 31, 2020 at 12:00:00 AM GMT", df1.format(d2));
+
+// B. Test Canada's Yukon advanced to -07 year-round on 2020-03-08.
+const df2 = new Intl.DateTimeFormat(
+    "en",
+    {timeZone: "Canada/Yukon", dateStyle: "long", timeStyle: "long"});
+const d3 = new Date("2020-03-09T00:00Z");
+const d4 = new Date("2021-03-09T00:00Z");
+
+// Before tz202a change will get "March 8, 2020 at 5:00:00 PM PDT"
+assertEquals("March 8, 2020 at 5:00:00 PM MST", df2.format(d3));
+
+// Before tz202a change will get "March 8, 2021 at 4:00:00 PM PST"
+assertEquals("March 8, 2021 at 5:00:00 PM MST", df2.format(d4));
+
+// C. Test America/Nuuk renamed from America/Godthab.
+
+// Before tz2020a will throw RangeError.
+const df3 = new Intl.DateTimeFormat("en", {timeZone: "America/Nuuk"});
+
+// Renamed timezone will return the stable name before the rename.
+assertEquals("America/Godthab", df3.resolvedOptions().timeZone);
diff --git a/deps/v8/test/intl/regress-364374.js b/deps/v8/test/intl/regress-364374.js
new file mode 100644
index 00000000000..05e8afc4a34
--- /dev/null
+++ b/deps/v8/test/intl/regress-364374.js
@@ -0,0 +1,60 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const special_time_zones = [
+  "America/Argentina/ComodRivadavia",
+  "America/Knox_IN",
+  "Antarctica/McMurdo",
+  "Australia/ACT",
+  "Australia/LHI",
+  "Australia/NSW",
+  "Brazil/DeNoronha",
+  "CET",
+  "CST6CDT",
+  "Chile/EasterIsland",
+  "Etc/UCT",
+  "EET",
+  "EST",
+  "EST5EDT",
+  "GB",
+  "GB-Eire",
+  "GMT+0",
+  "GMT-0",
+  "GMT0",
+  "HST",
+  "MET",
+  "MST",
+  "MST7MDT",
+  "Mexico/BajaNorte",
+  "Mexico/BajaSur",
+  "NZ",
+  "NZ-CHAT",
+  "PRC",
+  "PST8PDT",
+  "ROC",
+  "ROK",
+  "UCT",
+  "US/Alaska",
+  "US/Aleutian",
+  "US/Arizona",
+  "US/Central",
+  "US/East-Indiana",
+  "US/Eastern",
+  "US/Hawaii",
+  "US/Indiana-Starke",
+  "US/Michigan",
+  "US/Mountain",
+  "US/Pacific",
+  "US/Pacific-New",
+  "US/Samoa",
+  "W-SU",
+  "WET",
+];
+
+special_time_zones.forEach(function(timeZone) {
+  assertDoesNotThrow(() => {
+    // Make sure the following wont throw RangeError exception
+    df = new Intl.DateTimeFormat(undefined, {timeZone});
+  });
+})
diff --git a/deps/v8/test/intl/regress-966285.js b/deps/v8/test/intl/regress-966285.js
index 4c5cfa94913..c53fb6d8acd 100644
--- a/deps/v8/test/intl/regress-966285.js
+++ b/deps/v8/test/intl/regress-966285.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-intl-add-calendar-numbering-system
-
 var v = {};
 Object.defineProperty(v.__proto__, "calendar",
     { get: function() { return -1; } });
diff --git a/deps/v8/test/intl/regress-9786.js b/deps/v8/test/intl/regress-9786.js
index e922dba5f74..faeb6ad2bf0 100644
--- a/deps/v8/test/intl/regress-9786.js
+++ b/deps/v8/test/intl/regress-9786.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-intl-add-calendar-numbering-system
-
 // Well-formed but invalid calendar should not throw RangeError.
 var calendar = "abc";
 var len = 3;
diff --git a/deps/v8/test/intl/regress-9787.js b/deps/v8/test/intl/regress-9787.js
index 576c0f7d649..24eca1178c3 100644
--- a/deps/v8/test/intl/regress-9787.js
+++ b/deps/v8/test/intl/regress-9787.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-intl-add-calendar-numbering-system
-
 // ill-formed and valid calendar should throw RangeError.
 assertThrows(
     'new Intl.DateTimeFormat("en", {calendar: "gregorian"})',
diff --git a/deps/v8/test/intl/regress-9788.js b/deps/v8/test/intl/regress-9788.js
index 7a3679584fa..1a4d44b4a35 100644
--- a/deps/v8/test/intl/regress-9788.js
+++ b/deps/v8/test/intl/regress-9788.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-intl-add-calendar-numbering-system
-
 // Well-formed but invalid numberingSystem should not throw RangeError.
 var numberingSystem = "abc";
 var len = 3;
diff --git a/deps/v8/test/intl/regress-9887.js b/deps/v8/test/intl/regress-9887.js
index 4ef31f85bc4..0d43a1711d5 100644
--- a/deps/v8/test/intl/regress-9887.js
+++ b/deps/v8/test/intl/regress-9887.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-intl-add-calendar-numbering-system
-
 let intlClasses = [
     Intl.RelativeTimeFormat,
     Intl.NumberFormat,
diff --git a/deps/v8/test/intl/relative-time-format/resolved-options-nu-extended.js b/deps/v8/test/intl/relative-time-format/resolved-options-nu-extended.js
index dd7979df9e7..0d5da805fb0 100644
--- a/deps/v8/test/intl/relative-time-format/resolved-options-nu-extended.js
+++ b/deps/v8/test/intl/relative-time-format/resolved-options-nu-extended.js
@@ -6,21 +6,25 @@
 // Split from test/intl/relative-time-format/resolved-options-nu.js
 // because Android not yet include bn locale data.
 
-// For locale default the numberingSystem to other than 'latn'
-assertEquals(
-    "beng",
-    new Intl.RelativeTimeFormat("bn").resolvedOptions().numberingSystem
-);
+// Only test if the browser support 'bn' locale
+if (Intl.RelativeTimeFormat.supportedLocalesOf(["bn"]).length > 0) {
+  // For locale default the numberingSystem to other than 'latn'
+  assertEquals(
+      "beng",
+      new Intl.RelativeTimeFormat("bn").resolvedOptions().numberingSystem
+  );
 
-// For locale which default others but  use -u-nu-latn to change to 'latn' numberingSystem
-assertEquals(
-    "latn",
-    new Intl.RelativeTimeFormat("bn-u-nu-latn").resolvedOptions()
-        .numberingSystem
-);
-// For locale use -u-nu- with invalid value still back to default.
-assertEquals(
-    "beng",
-    new Intl.RelativeTimeFormat("bn-u-nu-abcd").resolvedOptions()
-        .numberingSystem
-);
+  // For locale which default others but  use -u-nu-latn to change to 'latn'
+  // numberingSystem
+  assertEquals(
+      "latn",
+      new Intl.RelativeTimeFormat("bn-u-nu-latn").resolvedOptions()
+          .numberingSystem
+  );
+  // For locale use -u-nu- with invalid value still back to default.
+  assertEquals(
+      "beng",
+      new Intl.RelativeTimeFormat("bn-u-nu-abcd").resolvedOptions()
+          .numberingSystem
+  );
+}
diff --git a/deps/v8/test/js-perf-test/JSTests1.json b/deps/v8/test/js-perf-test/JSTests1.json
index d8c8a046840..3f472a41e63 100644
--- a/deps/v8/test/js-perf-test/JSTests1.json
+++ b/deps/v8/test/js-perf-test/JSTests1.json
@@ -10,6 +10,22 @@
   "total": true,
   "resources": ["base.js"],
   "tests": [
+    {
+      "name": "Operators",
+      "path": ["Operators"],
+      "main": "run.js",
+      "resources": [
+        "run.js",
+        "abstract-equality.js"
+      ],
+      "results_regexp": "^Operators\\-%s\\(Score\\): (.+)$",
+      "tests": [
+        {"name": "Equal-SmiNumber"},
+        {"name": "Equal-SmiOddball"},
+        {"name": "Equal-NumberOddball"},
+        {"name": "Equal-OddballOddball"}
+      ]
+    },
     {
       "name": "Collections",
       "path": ["Collections"],
diff --git a/deps/v8/test/js-perf-test/Operators/abstract-equality.js b/deps/v8/test/js-perf-test/Operators/abstract-equality.js
new file mode 100644
index 00000000000..da65a602964
--- /dev/null
+++ b/deps/v8/test/js-perf-test/Operators/abstract-equality.js
@@ -0,0 +1,79 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const TEST_ITERATIONS = 100000;
+
+// This dummy ensures that the feedback for benchmark.run() in the Measure
+// function from base.js is not monomorphic, thereby preventing the benchmarks
+// below from being inlined. This ensures consistent behavior and comparable
+// results.
+new BenchmarkSuite('Prevent-Inline-Dummy', [100000], [
+  new Benchmark('Prevent-Inline-Dummy', true, false, 0, () => {})
+]);
+
+new BenchmarkSuite('Equal-SmiNumber', [100000], [
+  new Benchmark('Equal-SmiNumber', true, false, 0, TestEqualSmiNumber, SetUp)
+]);
+
+new BenchmarkSuite('Equal-SmiOddball', [100000], [
+  new Benchmark('Equal-SmiOddball', true, false, 0, TestEqualSmiOddball, SetUp)
+]);
+
+new BenchmarkSuite('Equal-NumberOddball', [100000], [
+  new Benchmark('Equal-NumberOddball', true, false, 0, TestEqualNumberOddball,
+    SetUp)
+]);
+
+new BenchmarkSuite('Equal-OddballOddball', [100000], [
+  new Benchmark('Equal-OddballOddball', true, false, 0, TestEqualOddballOddball,
+    SetUp)
+]);
+
+
+let smis = [];
+let numbers = [];
+let oddballs = [];
+function SetUp() {
+  for(let i = 0; i < TEST_ITERATIONS + 1; ++i) {
+    smis[i] = (i % 2 == 0) ? 42 : -42;
+    numbers[i] = (i % 2 == 0) ? 42.3 : -42.3;
+    oddballs[i] = (i % 2 == 0);
+  }
+}
+
+
+function TestEqualSmiNumber() {
+  let result = false;
+  for(let i = 0; i < TEST_ITERATIONS; ++i) {
+    result = result || (11 == numbers[i]);
+  }
+  return result;
+}
+
+
+function TestEqualSmiOddball() {
+  let result = false;
+  for(let i = 1; i < TEST_ITERATIONS; ++i) {
+    result = result || (smis[i] == false);
+  }
+  return result;
+}
+
+
+function TestEqualNumberOddball() {
+  let result = false;
+  for(let i = 1; i < TEST_ITERATIONS; ++i) {
+    result = result || (numbers[i] == false);
+  }
+  return result;
+}
+
+
+function TestEqualOddballOddball() {
+  let result = false;
+  for(let i = 0; i < TEST_ITERATIONS; ++i) {
+    result = result || (oddballs[i] == oddballs[i+1]);
+  }
+  return result;
+}
diff --git a/deps/v8/test/js-perf-test/Operators/run.js b/deps/v8/test/js-perf-test/Operators/run.js
new file mode 100644
index 00000000000..e70442ac1d8
--- /dev/null
+++ b/deps/v8/test/js-perf-test/Operators/run.js
@@ -0,0 +1,28 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+load('../base.js');
+load('abstract-equality.js');
+
+var success = true;
+
+
+function PrintResult(name, result) {
+  print(`Operators-${name}(Score): ${result}`);
+}
+
+
+function PrintError(name, error) {
+  PrintResult(name, error);
+  success = false;
+}
+
+
+BenchmarkSuite.config.doWarmup = undefined;
+BenchmarkSuite.config.doDeterministic = undefined;
+
+BenchmarkSuite.RunSuites({ NotifyResult: PrintResult,
+                           NotifyError: PrintError });
diff --git a/deps/v8/test/message/fail/spread-call-4.js b/deps/v8/test/message/fail/spread-call-4.js
new file mode 100644
index 00000000000..564562b7ad6
--- /dev/null
+++ b/deps/v8/test/message/fail/spread-call-4.js
@@ -0,0 +1,5 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+x = 1;
+console.log(1, ...x);
diff --git a/deps/v8/test/message/fail/spread-call-4.out b/deps/v8/test/message/fail/spread-call-4.out
new file mode 100644
index 00000000000..66503f64193
--- /dev/null
+++ b/deps/v8/test/message/fail/spread-call-4.out
@@ -0,0 +1,5 @@
+*%(basename)s:5: TypeError: Found non-callable @@iterator
+console.log(1, ...x);
+                  ^
+TypeError: Found non-callable @@iterator
+    at *%(basename)s:5:9
diff --git a/deps/v8/test/message/message.status b/deps/v8/test/message/message.status
index fd6f282ecca..f374a668264 100644
--- a/deps/v8/test/message/message.status
+++ b/deps/v8/test/message/message.status
@@ -41,11 +41,12 @@
 # TODO(clemensb): Implement on all other platforms (crbug.com/v8/6600).
 ['arch != x64 and arch != ia32 and arch != arm64 and arch != arm', {
   'wasm-trace-memory-liftoff': [SKIP],
+  'wasm-trace': [SKIP],
 }], # arch != x64 and arch != ia32 and arch != arm64 and arch != arm
 
 ['variant == code_serializer', {
-  # TODO(yangguo): Code serializer output is incompatible with all message
-  # tests.
+  # Code serializer output is incompatible with all message tests
+  # because the same test is executed twice.
   '*': [SKIP],
 }],  # variant == code_serializer
 
@@ -64,4 +65,9 @@
   'asm-*': [SKIP],
 }], # lite_mode or variant == jitless
 
+################################################################################
+['variant == stress_snapshot', {
+  '*': [SKIP],  # only relevant for mjsunit tests.
+}],
+
 ]
diff --git a/deps/v8/test/message/wasm-trace-memory-interpreted.js b/deps/v8/test/message/wasm-trace-memory-interpreted.js
deleted file mode 100644
index 401707f5811..00000000000
--- a/deps/v8/test/message/wasm-trace-memory-interpreted.js
+++ /dev/null
@@ -1,8 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --no-stress-opt --expose-wasm --trace-wasm-memory --wasm-interpret-all
-// Flags: --experimental-wasm-simd
-
-load("test/message/wasm-trace-memory.js");
diff --git a/deps/v8/test/message/wasm-trace-memory-interpreted.out b/deps/v8/test/message/wasm-trace-memory-interpreted.out
deleted file mode 100644
index e04e6964ca7..00000000000
--- a/deps/v8/test/message/wasm-trace-memory-interpreted.out
+++ /dev/null
@@ -1,14 +0,0 @@
-interpreter func:     0+0x3     load from 00000004 val: i32:0 / 00000000
-interpreter func:     1+0x3     load from 00000001 val:  i8:0 / 00
-interpreter func:     3+0x5      store to 00000004 val: i32:305419896 / 12345678
-interpreter func:     0+0x3     load from 00000002 val: i32:1450704896 / 56780000
-interpreter func:     1+0x3     load from 00000006 val:  i8:52 / 34
-interpreter func:     2+0x3     load from 00000002 val: f32:68169720922112.000000 / 56780000
-interpreter func:     4+0x5      store to 00000004 val:  i8:171 / ab
-interpreter func:     0+0x3     load from 00000002 val: i32:1454047232 / 56ab0000
-interpreter func:     2+0x3     load from 00000002 val: f32:94008244174848.000000 / 56ab0000
-interpreter func:     6+0x7      store to 00000004 val: s128:48879 48879 48879 48879 / 0000beef 0000beef 0000beef 0000beef
-interpreter func:     5+0x3     load from 00000002 val: s128:-1091633152 -1091633152 -1091633152 -1091633152 / beef0000 beef0000 beef0000 beef0000
-interpreter func:     7+0x3     load from 00000004 val: i16:48879 / beef
-interpreter func:     8+0x3     load from 00000002 val: i64:-4688528683866062848 / beef0000beef0000
-interpreter func:     9+0x3     load from 00000002 val: f64:-0.000015 / beef0000beef0000
diff --git a/deps/v8/test/message/wasm-trace.js b/deps/v8/test/message/wasm-trace.js
new file mode 100644
index 00000000000..1fffcf5e996
--- /dev/null
+++ b/deps/v8/test/message/wasm-trace.js
@@ -0,0 +1,19 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --trace-wasm --no-wasm-tier-up --liftoff --no-stress-opt
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+let kRet23Function = builder.addFunction('ret_23', kSig_i_v)
+                        .addBody([kExprI32Const, 23])
+                        .exportFunc()
+                        .index;
+builder.addFunction('main', kSig_v_v)
+    .addBody([kExprCallFunction, kRet23Function, kExprDrop])
+    .exportAs('main');
+
+let instance = builder.instantiate();
+instance.exports.main();
diff --git a/deps/v8/test/message/wasm-trace.out b/deps/v8/test/message/wasm-trace.out
new file mode 100644
index 00000000000..c895939834b
--- /dev/null
+++ b/deps/v8/test/message/wasm-trace.out
@@ -0,0 +1,2 @@
+Enter function
+Enter function
diff --git a/deps/v8/test/message/weakref-finalizationregistry-error.js b/deps/v8/test/message/weakref-finalizationregistry-error.js
index 1db6bfeccd9..e4c47fed0dc 100644
--- a/deps/v8/test/message/weakref-finalizationregistry-error.js
+++ b/deps/v8/test/message/weakref-finalizationregistry-error.js
@@ -8,8 +8,7 @@
 // Since cleanup tasks are top-level tasks, errors thrown from them don't stop
 // future cleanup tasks from running.
 
-function callback(iter) {
-  [...iter];
+function callback(holdings) {
   throw new Error('callback');
 };
 
diff --git a/deps/v8/test/message/weakref-finalizationregistry-error.out b/deps/v8/test/message/weakref-finalizationregistry-error.out
index 4682b63f23c..01255fd364d 100644
--- a/deps/v8/test/message/weakref-finalizationregistry-error.out
+++ b/deps/v8/test/message/weakref-finalizationregistry-error.out
@@ -3,10 +3,12 @@
   ^
 Error: callback
     at callback (*%(basename)s:{NUMBER}:{NUMBER})
+    at FinalizationRegistry.cleanupSome (<anonymous>)
 
 *%(basename)s:{NUMBER}: Error: callback
   throw new Error('callback');
   ^
 Error: callback
     at callback (*%(basename)s:{NUMBER}:{NUMBER})
+    at FinalizationRegistry.cleanupSome (<anonymous>)
 
diff --git a/deps/v8/test/mjsunit/asm/load-elimination.js b/deps/v8/test/mjsunit/asm/load-elimination.js
index fff722d0178..f3d0c1a4e62 100644
--- a/deps/v8/test/mjsunit/asm/load-elimination.js
+++ b/deps/v8/test/mjsunit/asm/load-elimination.js
@@ -23,5 +23,3 @@ var foo = (function(stdlib, foreign, heap) {
 
 assertEquals(0x1234, foo());
 assertEquals(0x1234, foo());
-%OptimizeFunctionOnNextCall(foo);
-assertEquals(0x1234, foo());
diff --git a/deps/v8/test/mjsunit/async-stack-traces-promise-any.js b/deps/v8/test/mjsunit/async-stack-traces-promise-any.js
new file mode 100644
index 00000000000..0b81bfec8fc
--- /dev/null
+++ b/deps/v8/test/mjsunit/async-stack-traces-promise-any.js
@@ -0,0 +1,42 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --async-stack-traces --harmony-promise-any
+
+// Basic test with Promise.any().
+(function() {
+  async function fine() { }
+
+  async function thrower() {
+    await fine();
+    throw new Error();
+  }
+
+  async function driver() {
+    await Promise.any([thrower(), thrower()]);
+  }
+
+  async function test(f) {
+    try {
+      await f();
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, AggregateError);
+      assertEquals(2, e.errors.length);
+      assertMatches(/Error.+at thrower.+at async Promise.any \(index 0\).+at async driver.+at async test/ms, e.errors[0].stack);
+      assertMatches(/Error.+at thrower.+at async Promise.any \(index 1\).+at async driver.+at async test/ms, e.errors[1].stack);
+    }
+  }
+
+  assertPromiseResult((async () => {
+    %PrepareFunctionForOptimization(thrower);
+    %PrepareFunctionForOptimization(driver);
+    await test(driver);
+    await test(driver);
+    %OptimizeFunctionOnNextCall(thrower);
+    await test(driver);
+    %OptimizeFunctionOnNextCall(driver);
+    await test(driver);
+  })());
+})();
diff --git a/deps/v8/test/mjsunit/call-intrinsic-fuzzing.js b/deps/v8/test/mjsunit/call-intrinsic-fuzzing.js
index 3945c8d49d1..f76dd42d715 100644
--- a/deps/v8/test/mjsunit/call-intrinsic-fuzzing.js
+++ b/deps/v8/test/mjsunit/call-intrinsic-fuzzing.js
@@ -2,15 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-for-fuzzing
+// Flags: --allow-natives-for-fuzzing --fuzzing
 
 // Test whitelisted/blacklisted intrinsics in the context of fuzzing.
 
 // Blacklisted intrinsics are replaced with undefined.
-assertEquals(undefined, %GetOptimizationStatus(function (){}));
+assertEquals(undefined, %ConstructConsString("a", "b"));
 
 // Blacklisted intrinsics can have wrong arguments.
-assertEquals(undefined, %GetOptimizationStatus(1, 2, 3, 4));
+assertEquals(undefined, %ConstructConsString(1, 2, 3, 4));
 
 // We don't care if an intrinsic actually exists.
 assertEquals(undefined, %FooBar());
diff --git a/deps/v8/test/mjsunit/compiler/abstract-equal-oddball.js b/deps/v8/test/mjsunit/compiler/abstract-equal-oddball.js
new file mode 100644
index 00000000000..29913055627
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/abstract-equal-oddball.js
@@ -0,0 +1,305 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+
+// smi == boolean
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(2, true));
+  assertTrue(foo(1, true));
+  assertTrue(foo(0, false));
+  assertFalse(foo(2, false));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(2, true));
+  assertTrue(foo(1, true));
+  assertTrue(foo(0, false));
+  assertFalse(foo(2, false));
+  assertOptimized(foo);
+
+  assertFalse(foo(0, null));
+  assertUnoptimized(foo);
+})();
+
+
+// boolean == smi
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(true, 2));
+  assertTrue(foo(true, 1));
+  assertTrue(foo(false, 0));
+  assertFalse(foo(false, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(true, 2));
+  assertTrue(foo(true, 1));
+  assertTrue(foo(false, 0));
+  assertFalse(foo(false, 2));
+  assertOptimized(foo);
+
+  assertFalse(foo(null, 0));
+  assertUnoptimized(foo);
+})();
+
+
+// smi == undefined
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(2, undefined));
+  assertFalse(foo(0, undefined));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(2, undefined));
+  assertFalse(foo(0, undefined));
+  assertOptimized(foo);
+})();
+
+
+// undefined == smi
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(undefined, 2));
+  assertFalse(foo(undefined, 0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(undefined, 2));
+  assertFalse(foo(undefined, 0));
+  assertOptimized(foo);
+})();
+
+
+// smi == null
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(2, null));
+  assertFalse(foo(0, null));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(2, null));
+  assertFalse(foo(0, null));
+  assertOptimized(foo);
+})();
+
+
+// null == smi
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(null, 2));
+  assertFalse(foo(null, 0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(null, 2));
+  assertFalse(foo(null, 0));
+  assertOptimized(foo);
+})();
+
+
+// smi == oddball
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(2, null));
+  assertFalse(foo(0, undefined));
+  assertFalse(foo(0, true));
+  assertTrue(foo(1, true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(2, null));
+  assertFalse(foo(0, undefined));
+  assertFalse(foo(0, true));
+  assertTrue(foo(1, true));
+  assertOptimized(foo);
+})();
+
+
+// oddball == smi
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(null, 2));
+  assertFalse(foo(undefined, 0));
+  assertFalse(foo(true, 0));
+  assertTrue(foo(true, 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(null, 2));
+  assertFalse(foo(undefined, 0));
+  assertFalse(foo(true, 0));
+  assertTrue(foo(true, 1));
+  assertOptimized(foo);
+})();
+
+
+// number == boolean
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(-2.8, true));
+  assertTrue(foo(1, true));
+  assertTrue(foo(-0.0, false));
+  assertFalse(foo(2, false));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(-2.8, true));
+  assertTrue(foo(1, true));
+  assertTrue(foo(-0.0, false));
+  assertFalse(foo(2, false));
+  assertOptimized(foo);
+
+  assertFalse(foo(0, null));
+  assertUnoptimized(foo);
+})();
+
+
+// boolean == number
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(true, -2.8));
+  assertTrue(foo(true, 1));
+  assertTrue(foo(false, -0.0));
+  assertFalse(foo(false, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(true, -2.8));
+  assertTrue(foo(true, 1));
+  assertTrue(foo(false, -0.0));
+  assertFalse(foo(false, 2));
+  assertOptimized(foo);
+
+  assertFalse(foo(null, 0));
+  assertUnoptimized(foo);
+})();
+
+
+// number == undefined
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(-2.8, undefined));
+  assertFalse(foo(-0.0, undefined));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(-2.8, undefined));
+  assertFalse(foo(-0.0, undefined));
+  assertOptimized(foo);
+})();
+
+
+// undefined == number
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(undefined, -2.8));
+  assertFalse(foo(undefined, -0.0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(undefined, -2.8));
+  assertFalse(foo(undefined, -0.0));
+  assertOptimized(foo);
+})();
+
+
+// number == null
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(-2.8, null));
+  assertFalse(foo(-0.0, null));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(-2.8, null));
+  assertFalse(foo(-0.0, null));
+  assertOptimized(foo);
+})();
+
+
+// null == number
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(null, -2.8));
+  assertFalse(foo(null, -0.0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(null, -2.8));
+  assertFalse(foo(null, -0.0));
+  assertOptimized(foo);
+})();
+
+
+// number == oddball
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(-2.8, null));
+  assertFalse(foo(-0.0, undefined));
+  assertFalse(foo(0, true));
+  assertTrue(foo(1.0, true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(-2.8, null));
+  assertFalse(foo(-0.0, undefined));
+  assertFalse(foo(0, true));
+  assertTrue(foo(1.0, true));
+  assertOptimized(foo);
+})();
+
+
+// oddball == number
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(null, -2.8));
+  assertFalse(foo(undefined, -0.0));
+  assertFalse(foo(true, 0));
+  assertTrue(foo(true, 1.0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(null, -2.8));
+  assertFalse(foo(undefined, -0.0));
+  assertFalse(foo(true, 0));
+  assertTrue(foo(true, 1.0));
+  assertOptimized(foo);
+})();
+
+
+// oddball == oddball
+(function() {
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(null, null));
+  assertTrue(foo(undefined, undefined));
+  assertTrue(foo(false, false));
+  assertTrue(foo(true, true));
+  assertTrue(foo(undefined, null));
+  assertFalse(foo(undefined, false));
+  assertFalse(foo(null, false));
+  assertFalse(foo(true, undefined));
+  assertFalse(foo(true, null));
+  assertFalse(foo(true, false));
+
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(null, null));
+  assertOptimized(foo);
+  assertTrue(foo(undefined, undefined));
+  assertTrue(foo(false, false));
+  assertTrue(foo(true, true));
+  assertTrue(foo(undefined, null));
+  assertFalse(foo(undefined, false));
+  assertFalse(foo(null, false));
+  assertFalse(foo(true, undefined));
+  assertFalse(foo(true, null));
+  assertFalse(foo(true, false));
+  assertOptimized(foo);
+})();
diff --git a/deps/v8/test/mjsunit/compiler/abstract-equal-symbol.js b/deps/v8/test/mjsunit/compiler/abstract-equal-symbol.js
index 2a7c9643ec4..a985ed6f69d 100644
--- a/deps/v8/test/mjsunit/compiler/abstract-equal-symbol.js
+++ b/deps/v8/test/mjsunit/compiler/abstract-equal-symbol.js
@@ -47,6 +47,9 @@
   assertFalse(foo(a));
   %OptimizeFunctionOnNextCall(foo);
   assertTrue(foo(b));
+  // Re-prepare the function immediately to make sure type feedback isn't
+  // cleared by untimely gc, as re-optimization on new feedback is tested below
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(a));
   assertOptimized(foo);
 
@@ -55,7 +58,6 @@
   assertUnoptimized(foo);
 
   // Make sure TurboFan learns the new feedback
-  %PrepareFunctionForOptimization(foo);
   %OptimizeFunctionOnNextCall(foo);
   assertFalse(foo("a"));
   assertOptimized(foo);
diff --git a/deps/v8/test/mjsunit/compiler/abstract-equal-undetectable.js b/deps/v8/test/mjsunit/compiler/abstract-equal-undetectable.js
index ad866aa7bed..6c3d0ff8623 100644
--- a/deps/v8/test/mjsunit/compiler/abstract-equal-undetectable.js
+++ b/deps/v8/test/mjsunit/compiler/abstract-equal-undetectable.js
@@ -91,10 +91,6 @@ const undetectable = %GetUndetectable();
   %OptimizeFunctionOnNextCall(foo);
   assertTrue(foo(b));
   assertFalse(foo(a));
-
-  // TurboFan doesn't need to bake in feedback, since it sees the undetectable.
-  assertFalse(foo(1));
-  assertOptimized(foo);
 })();
 
 // Unknown undetectable on one side strict equality with receiver.
@@ -124,3 +120,30 @@ const undetectable = %GetUndetectable();
   assertFalse(foo(1));
   assertUnoptimized(foo);
 })();
+
+// Unknown undetectable on both sides.
+(function() {
+  const a = undetectable;
+
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(a, a));
+  assertTrue(foo(a, undefined));
+  assertTrue(foo(undefined, a));
+  assertFalse(foo(a, %GetUndetectable()));
+  assertFalse(foo(%GetUndetectable(), a));
+  assertFalse(foo(%GetUndetectable(), %GetUndetectable()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(a, a));
+  assertTrue(foo(a, undefined));
+  assertTrue(foo(undefined, a));
+  assertFalse(foo(a, %GetUndetectable()));
+  assertFalse(foo(%GetUndetectable(), a));
+  assertFalse(foo(%GetUndetectable(), %GetUndetectable()));
+  assertOptimized(foo);
+
+  // TurboFan bakes in feedback on the inputs.
+  assertFalse(foo(1));
+  assertUnoptimized(foo);
+})();
diff --git a/deps/v8/test/mjsunit/compiler/bigint-add-no-deopt-loop.js b/deps/v8/test/mjsunit/compiler/bigint-add-no-deopt-loop.js
index 1390acc3563..2004477932f 100644
--- a/deps/v8/test/mjsunit/compiler/bigint-add-no-deopt-loop.js
+++ b/deps/v8/test/mjsunit/compiler/bigint-add-no-deopt-loop.js
@@ -18,12 +18,14 @@ testAdd(3n, 7n);
 testAdd(17n, -54n);
 %OptimizeFunctionOnNextCall(testAdd);
 assertEquals(testAdd(6n, 2n), 8n);
+// Re-prepare the function immediately to make sure type feedback isn't cleared
+// by an untimely gc, as re-optimization on new feedback is tested below
+%PrepareFunctionForOptimization(testAdd);
 assertOptimized(testAdd);
 
 assertThrows(() => testAdd(big, big), RangeError);
 assertUnoptimized(testAdd);
 
-%PrepareFunctionForOptimization(testAdd);
 testAdd(30n, -50n);
 testAdd(23n, 5n);
 %OptimizeFunctionOnNextCall(testAdd);
diff --git a/deps/v8/test/mjsunit/compiler/monomorphic-named-load-with-no-map.js b/deps/v8/test/mjsunit/compiler/monomorphic-named-load-with-no-map.js
new file mode 100644
index 00000000000..9341f8e8c91
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/monomorphic-named-load-with-no-map.js
@@ -0,0 +1,53 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --harmony-weak-refs --expose-gc
+
+// Helper to convert setTimeout into an awaitable promise.
+function asyncTimeout(timeout) {
+  return new Promise((resolve, reject)=>{
+    setTimeout(resolve, timeout);
+  })
+}
+
+function Foo() {}
+
+function getX(o) { return o.x; }
+
+(async function() {
+  let o = new Foo();
+  // Transition o:Foo to o:Foo{x}. This transition is important, as the o:Foo
+  // map is the initial map for the Foo constructor, and so is strongly held by
+  // it. We want o to be the only strong holder of its map.
+  o.x = 42;
+  %CompleteInobjectSlackTracking(new Foo());
+
+  // Warm up 'getX' with 'Foo{x}' feedback for its o.x access.
+  %PrepareFunctionForOptimization(getX);
+  assertEquals(getX(o), 42);
+  assertEquals(getX(o), 42);
+
+  // Clear out 'o', which is the only strong holder of the Foo{x} map.
+  let weak_o = new WeakRef(o);
+  o = null;
+
+  // Tick the message loop so that the weak ref can be collected.
+  await asyncTimeout(0);
+
+  // Collect the old 'o', which will also collect the 'Foo{x}' map.
+  gc();
+
+  // Make sure the old 'o' was collected.
+  assertEquals(undefined, weak_o.deref());
+
+  // Optimize the function with the current monomorphic 'Foo{x}' map o.x access,
+  // where the 'Foo{x}' map is dead and therefore the map set is empty. Then,
+  // create a new 'Foo{x}' object and pass that through. This compilation and
+  // o.x access should still succeed despite the dead map.
+  %OptimizeFunctionOnNextCall(getX);
+  o = new Foo();
+  o.x = 42;
+  assertEquals(getX(o), 42);
+
+})();
diff --git a/deps/v8/test/mjsunit/compiler/osr-infinite.js b/deps/v8/test/mjsunit/compiler/osr-infinite.js
index 51b3a3e871d..0a5f6576bf2 100644
--- a/deps/v8/test/mjsunit/compiler/osr-infinite.js
+++ b/deps/v8/test/mjsunit/compiler/osr-infinite.js
@@ -11,7 +11,6 @@ function thrower() {
   if (x == 5)  %OptimizeOsr(1);
   if (x == 10) throw "terminate";
 }
-%PrepareFunctionForOptimization(thrower);
 
 %NeverOptimizeFunction(thrower);  // Don't want to inline the thrower.
 %NeverOptimizeFunction(test);     // Don't want to inline the func into test.
diff --git a/deps/v8/test/mjsunit/compiler/redundancy-elimination.js b/deps/v8/test/mjsunit/compiler/redundancy-elimination.js
index dc01fb4a05d..d5b0f6a390c 100644
--- a/deps/v8/test/mjsunit/compiler/redundancy-elimination.js
+++ b/deps/v8/test/mjsunit/compiler/redundancy-elimination.js
@@ -155,10 +155,8 @@
   %OptimizeFunctionOnNextCall(foo);
   assertEquals(1, foo([1, 2], 0));
   assertEquals(1, foo([1, 2], 1));
-  // Even passing -0 should not deoptimize and
-  // of course still pass the equality test above.
-  assertEquals(9, foo([9, 2], -0));
   assertOptimized(foo);
+  assertEquals(9, foo([9, 2], -0));
 })();
 
 // Test the RedundancyElimination::ReduceSpeculativeNumberComparison()
@@ -176,10 +174,8 @@
   %OptimizeFunctionOnNextCall(foo);
   assertEquals(1, foo([1, 2], 0));
   assertEquals(1, foo([1, 2], 1));
-  // Even passing -0 should not deoptimize and
-  // of course still pass the equality test above.
-  assertEquals(9, foo([9, 2], -0));
   assertOptimized(foo);
+  assertEquals(9, foo([9, 2], -0));
 })();
 
 // Test the RedundancyElimination::ReduceSpeculativeNumberComparison()
@@ -197,8 +193,6 @@
   %OptimizeFunctionOnNextCall(foo);
   assertEquals(1, foo([1, 2], 0));
   assertEquals(1, foo([1, 2], 1));
-  // Even passing -0 should not deoptimize and
-  // of course still pass the equality test above.
-  assertEquals(9, foo([9, 2], -0));
   assertOptimized(foo);
+  assertEquals(9, foo([9, 2], -0));
 })();
diff --git a/deps/v8/test/mjsunit/compiler/regress-1065737.js b/deps/v8/test/mjsunit/compiler/regress-1065737.js
new file mode 100644
index 00000000000..7da5ee7238d
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1065737.js
@@ -0,0 +1,17 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  class c {
+    static get [v = 0]() {}
+  }
+}
+
+%PrepareFunctionForOptimization(foo);
+assertThrows(foo, ReferenceError);
+assertThrows(foo, ReferenceError);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(foo, ReferenceError);
diff --git a/deps/v8/test/mjsunit/compiler/regress-1067544.js b/deps/v8/test/mjsunit/compiler/regress-1067544.js
new file mode 100644
index 00000000000..4e41c766b67
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1067544.js
@@ -0,0 +1,16 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const v = [];
+function foo() {
+  Int8Array.prototype.values.call([v]);
+}
+
+%PrepareFunctionForOptimization(foo);
+assertThrows(foo, TypeError);
+assertThrows(foo, TypeError);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(foo, TypeError);
diff --git a/deps/v8/test/mjsunit/compiler/regress-1068494.js b/deps/v8/test/mjsunit/compiler/regress-1068494.js
new file mode 100644
index 00000000000..e7578e2c8b3
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1068494.js
@@ -0,0 +1,14 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  return { ['bar']: class {} };
+}
+%PrepareFunctionForOptimization(foo);
+assertEquals('bar', foo().bar.name);
+assertEquals('bar', foo().bar.name);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals('bar', foo().bar.name);
diff --git a/deps/v8/test/mjsunit/compiler/regress-1070892.js b/deps/v8/test/mjsunit/compiler/regress-1070892.js
new file mode 100644
index 00000000000..b58dde74703
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1070892.js
@@ -0,0 +1,17 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var v = {0: 0, 1: 1, '01': 7};
+function foo(index) {
+    return [v[index], v[index + 1], index + 1];
+};
+
+%PrepareFunctionForOptimization(foo);
+assertEquals(foo(0), [0, 1, 1]);
+assertEquals(foo(0), [0, 1, 1]);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(foo(0), [0, 1, 1]);
+assertEquals(foo('0'), [0, 7, '01']);
diff --git a/deps/v8/test/mjsunit/compiler/regress-1071743.js b/deps/v8/test/mjsunit/compiler/regress-1071743.js
new file mode 100644
index 00000000000..f2d1d07a9d1
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1071743.js
@@ -0,0 +1,32 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+function foo(v) {
+  let x = Math.floor(v);
+  Number.prototype[v] = 42;
+  return x + Math.floor(v);
+}
+
+%PrepareFunctionForOptimization(foo);
+assertSame(foo(-0), -0);
+assertSame(foo(-0), -0);
+%OptimizeFunctionOnNextCall(foo);
+assertSame(foo(-0), -0);
+
+
+function bar(v) {
+  v = v ? (v|0) : -0;  // v has now type Integral32OrMinusZero.
+  let x = Math.floor(v);
+  Number.prototype[v] = 42;
+  return x + Math.floor(v);
+}
+
+%PrepareFunctionForOptimization(bar);
+assertSame(2, bar(1));
+assertSame(2, bar(1));
+%OptimizeFunctionOnNextCall(bar);
+assertSame(-0, bar(-0));
diff --git a/deps/v8/test/mjsunit/compiler/regress-1074736.js b/deps/v8/test/mjsunit/compiler/regress-1074736.js
new file mode 100644
index 00000000000..6395026454f
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1074736.js
@@ -0,0 +1,17 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var arr = new Uint8Array();
+%ArrayBufferDetach(arr.buffer);
+
+function foo() {
+  return arr[Symbol.iterator]();
+}
+
+%PrepareFunctionForOptimization(foo);
+assertThrows(foo, TypeError);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(foo, TypeError);
diff --git a/deps/v8/test/mjsunit/compiler/regress-1082704.js b/deps/v8/test/mjsunit/compiler/regress-1082704.js
new file mode 100644
index 00000000000..e93f5a6e91c
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1082704.js
@@ -0,0 +1,16 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var array = [[]];
+function foo() {
+  const x = array[0];
+  const y = [][0];
+  return x == y;
+}
+%PrepareFunctionForOptimization(foo);
+assertFalse(foo());
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo());
diff --git a/deps/v8/test/mjsunit/const-field-tracking-2.js b/deps/v8/test/mjsunit/const-field-tracking-2.js
new file mode 100644
index 00000000000..b0eb8c749f6
--- /dev/null
+++ b/deps/v8/test/mjsunit/const-field-tracking-2.js
@@ -0,0 +1,225 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// TODO(gsathya): This test will probably break when v8 tiers up to turbofan
+// from turboprop.
+//
+// Flags: --allow-natives-syntax --opt --no-always-opt --turboprop
+
+var global = this;
+var unique_id = 0;
+// Creates a function with unique SharedFunctionInfo to ensure the feedback
+// vector is unique for each test case.
+function MakeFunctionWithUniqueSFI(...args) {
+  assertTrue(args.length > 0);
+  var body = `/* Unique comment: ${unique_id++} */ ` + args.pop();
+  return new Function(...args, body);
+}
+
+
+//
+// Load constant field from constant object directly.
+//
+function TestLoadFromConstantFieldOfAConstantObject(the_value, other_value) {
+  function A(v) { this.v = v; }
+  function O() { this.a = new A(the_value); }
+  var the_object = new O();
+
+  // Ensure that {the_object.a}'s map is not stable to complicate compiler's
+  // life.
+  new A(the_value).blah = 0;
+
+  // Ensure that constant tracking is enabled for {contant_object}.
+  delete global.constant_object;
+  global.constant_object = the_object;
+  assertEquals(the_object, constant_object);
+
+  assertTrue(%HasFastProperties(the_object));
+
+  // {constant_object} is known to the compiler via global property cell
+  // tracking.
+  var load = MakeFunctionWithUniqueSFI("return constant_object.a.v;");
+  %PrepareFunctionForOptimization(load);
+  load();
+  load();
+  %OptimizeFunctionOnNextCall(load);
+  assertEquals(the_value, load());
+  assertOptimized(load);
+  var a = new A(other_value);
+  assertTrue(%HaveSameMap(a, the_object.a));
+  // Make constant field mutable by assigning another value
+  // to some other instance of A.
+  new A(the_value).v = other_value;
+  assertTrue(%HaveSameMap(a, new A(the_value)));
+  assertTrue(%HaveSameMap(a, the_object.a));
+  assertOptimized(load);
+  assertEquals(the_value, load());
+  assertOptimized(load);
+  assertEquals(the_value, load());
+}
+
+//Test constant tracking with Smi value.
+(function() {
+  var the_value = 42;
+  var other_value = 153;
+  TestLoadFromConstantFieldOfAConstantObject(the_value, other_value);
+})();
+
+// Test constant tracking with double value.
+(function() {
+  var the_value = 0.9;
+  var other_value = 0.42;
+  TestLoadFromConstantFieldOfAConstantObject(the_value, other_value);
+})();
+
+// Test constant tracking with function value.
+(function() {
+  var the_value = function V() {};
+  var other_value = function W() {};
+  TestLoadFromConstantFieldOfAConstantObject(the_value, other_value);
+})();
+
+// Test constant tracking with heap object value.
+(function() {
+  function V() {}
+  var the_value = new V();
+  var other_value = new V();
+  TestLoadFromConstantFieldOfAConstantObject(the_value, other_value);
+})();
+
+
+//
+// Load constant field from a prototype.
+//
+function TestLoadFromConstantFieldOfAPrototype(the_value, other_value) {
+  function Proto() { this.v = the_value; }
+  var the_prototype = new Proto();
+
+  function O() {}
+  O.prototype = the_prototype;
+  var the_object = new O();
+
+  // Ensure O.prototype is in fast mode by loading from its field.
+  function warmup() { return new O().v; }
+  %EnsureFeedbackVectorForFunction(warmup);
+  warmup(); warmup(); warmup();
+  assertTrue(%HasFastProperties(O.prototype));
+
+  // The parameter object is not constant but all the values have the same
+  // map and therefore the compiler knows the prototype object and can
+  // optimize load of "v".
+  var load = MakeFunctionWithUniqueSFI("o", "return o.v;");
+  %PrepareFunctionForOptimization(load);
+  load(new O());
+  load(new O());
+  %OptimizeFunctionOnNextCall(load);
+  assertEquals(the_value, load(new O()));
+  assertOptimized(load);
+  // Invalidation of mutability should trigger deoptimization with a
+  // "field-owner" reason.
+  the_prototype.v = other_value;
+  assertUnoptimized(load);
+}
+
+// Test constant tracking with Smi value.
+(function() {
+  var the_value = 42;
+  var other_value = 153;
+  TestLoadFromConstantFieldOfAPrototype(the_value, other_value);
+})();
+
+// Test constant tracking with double value.
+(function() {
+  var the_value = 0.9;
+  var other_value = 0.42;
+  TestLoadFromConstantFieldOfAPrototype(the_value, other_value);
+})();
+
+// Test constant tracking with function value.
+(function() {
+  var the_value = function V() {};
+  var other_value = function W() {};
+  TestLoadFromConstantFieldOfAPrototype(the_value, other_value);
+})();
+
+// Test constant tracking with heap object value.
+(function() {
+  function V() {}
+  var the_value = new V();
+  var other_value = new V();
+  TestLoadFromConstantFieldOfAPrototype(the_value, other_value);
+})();
+
+
+//
+// Store to constant field of a constant object.
+//
+function TestStoreToConstantFieldOfConstantObject(the_value, other_value) {
+  function A(v) { this.v = v; }
+  function O() { this.a = new A(the_value); }
+  var the_object = new O();
+
+  // Ensure that {the_object.a}'s map is not stable to complicate compiler's
+  // life.
+  new A(the_value).blah = 0;
+
+  // Ensure that constant tracking is enabled for {contant_object}.
+  delete global.constant_object;
+  global.constant_object = the_object;
+  assertEquals(the_object, constant_object);
+
+  assertTrue(%HasFastProperties(the_object));
+
+  // {constant_object} is known to the compiler via global property cell
+  // tracking.
+  var store = MakeFunctionWithUniqueSFI("v", "constant_object.a.v = v;");
+  %PrepareFunctionForOptimization(store);
+  store(the_value);
+  store(the_value);
+  %OptimizeFunctionOnNextCall(store);
+  store(the_value);
+  assertEquals(the_value, constant_object.a.v);
+  assertOptimized(store);
+  // Storing of the same value does not deoptimize.
+  store(the_value);
+  assertEquals(the_value, constant_object.a.v);
+  assertOptimized(store);
+
+  var a = new A(other_value);
+
+  assertOptimized(store);
+  // Storing other value deoptimizes because of failed value check.
+  store(other_value);
+  assertOptimized(store);
+  assertEquals(other_value, constant_object.a.v);
+}
+
+// Test constant tracking with Smi values.
+(function() {
+  var the_value = 42;
+  var other_value = 153;
+  TestStoreToConstantFieldOfConstantObject(the_value, other_value);
+})();
+
+// Test constant tracking with double values.
+(function() {
+  var the_value = 0.9;
+  var other_value = 0.42
+  TestStoreToConstantFieldOfConstantObject(the_value, other_value);
+})();
+
+// Test constant tracking with function values.
+(function() {
+  var the_value = function V() {};
+  var other_value = function W() {};
+  TestStoreToConstantFieldOfConstantObject(the_value, other_value);
+})();
+
+// Test constant tracking with heap object values.
+(function() {
+  function V() {}
+  var the_value = new V();
+  var other_value = new V();
+  TestStoreToConstantFieldOfConstantObject(the_value, other_value);
+})();
diff --git a/deps/v8/test/mjsunit/es6/array-copywithin.js b/deps/v8/test/mjsunit/es6/array-copywithin.js
index ed52b7d5faa..140f27b7853 100644
--- a/deps/v8/test/mjsunit/es6/array-copywithin.js
+++ b/deps/v8/test/mjsunit/es6/array-copywithin.js
@@ -42,7 +42,7 @@
   Array.prototype.copyWithin.call(args, -2, 0);
   assertArrayEquals([1, 1, 2], Array.prototype.slice.call(args));
 
-  // [[Class]] does not change
+  // Object.prototype.toString branding does not change
   assertArrayEquals("[object Arguments]", Object.prototype.toString.call(args));
 })();
 
diff --git a/deps/v8/test/mjsunit/es6/promise-all-resolve-not-callable.js b/deps/v8/test/mjsunit/es6/promise-all-resolve-not-callable.js
new file mode 100644
index 00000000000..cfaa3a71582
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/promise-all-resolve-not-callable.js
@@ -0,0 +1,30 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+load('test/mjsunit/test-async.js');
+
+// Promise.all should call IteratorClose if Promise.resolve is not callable.
+
+let returnCount = 0;
+let iter = {
+  [Symbol.iterator]() {
+    return {
+      return() {
+        returnCount++;
+      }
+    };
+  }
+};
+
+Promise.resolve = "certainly not callable";
+
+testAsync(assert => {
+  assert.plan(2);
+  Promise.all(iter).then(assert.unreachable, reason => {
+    assert.equals(true, reason instanceof TypeError);
+    assert.equals(1, returnCount);
+  });
+});
diff --git a/deps/v8/test/mjsunit/es6/promise-allsettled-resolve-not-callable.js b/deps/v8/test/mjsunit/es6/promise-allsettled-resolve-not-callable.js
new file mode 100644
index 00000000000..ed5868383db
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/promise-allsettled-resolve-not-callable.js
@@ -0,0 +1,30 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+load('test/mjsunit/test-async.js');
+
+// Promise.allSettled should call IteratorClose if Promise.resolve is not callable.
+
+let returnCount = 0;
+let iter = {
+  [Symbol.iterator]() {
+    return {
+      return() {
+        returnCount++;
+      }
+    };
+  }
+};
+
+Promise.resolve = "certainly not callable";
+
+testAsync(assert => {
+  assert.plan(2);
+  Promise.allSettled(iter).then(assert.unreachable, reason => {
+    assert.equals(true, reason instanceof TypeError);
+    assert.equals(1, returnCount);
+  });
+});
diff --git a/deps/v8/test/mjsunit/es6/promise-race-resolve-not-callable.js b/deps/v8/test/mjsunit/es6/promise-race-resolve-not-callable.js
new file mode 100644
index 00000000000..17f696f8922
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/promise-race-resolve-not-callable.js
@@ -0,0 +1,30 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+load('test/mjsunit/test-async.js');
+
+// Promise.race should call IteratorClose if Promise.resolve is not callable.
+
+let returnCount = 0;
+let iter = {
+  [Symbol.iterator]() {
+    return {
+      return() {
+        returnCount++;
+      }
+    };
+  }
+};
+
+Promise.resolve = "certainly not callable";
+
+testAsync(assert => {
+  assert.plan(2);
+  Promise.race(iter).then(assert.unreachable, reason => {
+    assert.equals(true, reason instanceof TypeError);
+    assert.equals(1, returnCount);
+  });
+});
diff --git a/deps/v8/test/mjsunit/es6/proxies-constructor.js b/deps/v8/test/mjsunit/es6/proxies-constructor.js
index 93b64ec3a1b..206df4713c0 100644
--- a/deps/v8/test/mjsunit/es6/proxies-constructor.js
+++ b/deps/v8/test/mjsunit/es6/proxies-constructor.js
@@ -22,14 +22,6 @@
 })();
 
 
-(function testRevokedTarget() {
-  var revocable = Proxy.revocable({}, {});
-  revocable.revoke();
-
-  assertThrows(function(){ new Proxy(revocable.proxy, {}); }, TypeError);
-})();
-
-
 (function testNonObjectHandlerTypes() {
   assertThrows(function(){ new Proxy({}, undefined); }, TypeError);
 
@@ -45,14 +37,6 @@
 })();
 
 
-(function testRevokedHandler() {
-  var revocable = Proxy.revocable({}, {});
-  revocable.revoke();
-
-  assertThrows(function(){ new Proxy({}, revocable.proxy); }, TypeError);
-})();
-
-
 (function testConstructionWithoutArguments() {
   assertThrows(function(){ new Proxy(); }, TypeError);
 
diff --git a/deps/v8/test/mjsunit/es6/proxies-revocable.js b/deps/v8/test/mjsunit/es6/proxies-revocable.js
index 82b853af8cd..1f61174a356 100644
--- a/deps/v8/test/mjsunit/es6/proxies-revocable.js
+++ b/deps/v8/test/mjsunit/es6/proxies-revocable.js
@@ -21,9 +21,3 @@ assertEquals(undefined, revoke());
 for (var trap of traps) {
   assertThrows(() => Reflect[trap](proxy), TypeError);
 }
-
-// Throw TypeError if target or handler is revoked proxy
-var revocable = Proxy.revocable({}, {});
-revocable.revoke();
-assertThrows(function(){ Proxy.revocable(revocable.proxy, {}); }, TypeError);
-assertThrows(function(){ Proxy.revocable({}, revocable.proxy); }, TypeError);
diff --git a/deps/v8/test/mjsunit/es6/reflect-construct.js b/deps/v8/test/mjsunit/es6/reflect-construct.js
index 34b6f27373f..f69a93b4879 100644
--- a/deps/v8/test/mjsunit/es6/reflect-construct.js
+++ b/deps/v8/test/mjsunit/es6/reflect-construct.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --allow-unsafe-function-constructor
+// Flags: --allow-unsafe-function-constructor --harmony-promise-any
 
 
 (function testReflectConstructArity() {
@@ -311,6 +311,7 @@
   var realm2 = Realm.create();
 
   var well_known_intrinsic_constructors = [
+    ["AggregateError", [[]]],
       "Array",
       "ArrayBuffer",
       "Boolean",
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-411237.js b/deps/v8/test/mjsunit/es6/regress/regress-411237.js
deleted file mode 100644
index b2b1a39bf61..00000000000
--- a/deps/v8/test/mjsunit/es6/regress/regress-411237.js
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax
-
-%PrepareFunctionForOptimization(print);
-try {
-  %OptimizeFunctionOnNextCall(print);
-} catch(e) { }
-
-try {
-  function* f() {
-  }
-  %PrepareFunctionForOptimization(f);
-  %OptimizeFunctionOnNextCall(f);
-} catch(e) { }
diff --git a/deps/v8/test/mjsunit/es6/typedarray-from-optional-arguments.js b/deps/v8/test/mjsunit/es6/typedarray-from-optional-arguments.js
new file mode 100644
index 00000000000..c1375aefe30
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/typedarray-from-optional-arguments.js
@@ -0,0 +1,32 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var typedArrayConstructors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Uint8ClampedArray,
+  Float32Array,
+  Float64Array
+];
+
+function assertArrayLikeEquals(value, expected, type) {
+  assertEquals(value.__proto__, type.prototype);
+  assertEquals(expected.length, value.length);
+  for (var i = 0; i < value.length; ++i) {
+    assertEquals(expected[i], value[i]);
+  }
+}
+
+for (var constructor of typedArrayConstructors) {
+  let ta = new constructor([1,2,3]);
+  assertArrayLikeEquals(constructor.from([1,2,3]), ta, constructor);
+  assertArrayLikeEquals(constructor.from([1,2,3], undefined),
+                        ta, constructor);
+  assertArrayLikeEquals(constructor.from([1,2,3], undefined, undefined),
+                        ta, constructor);
+}
diff --git a/deps/v8/test/mjsunit/harmony/aggregate-error.js b/deps/v8/test/mjsunit/harmony/aggregate-error.js
new file mode 100644
index 00000000000..cc83145c513
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/aggregate-error.js
@@ -0,0 +1,188 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-promise-any
+
+(function TestNoParameters() {
+    // Can't omit the "errors" parameter; there's nothing to iterate.
+    assertThrows(() => { new AggregateError(); });
+})();
+
+(function TestNoParameters_NoNew() {
+    // Can't omit the "errors" parameter; there's nothing to iterate.
+    assertThrows(() => { AggregateError(); });
+})();
+
+(function TestOneParameterErrorsIsArray() {
+    let error = new AggregateError([1, 20, 4]);
+    assertEquals('', error.message);
+    assertEquals([1, 20, 4], error.errors);
+})();
+
+(function TestOneParameterErrorsIsArray_NoNew() {
+    let error = AggregateError([1, 20, 4]);
+    assertEquals('', error.message);
+    assertEquals([1, 20, 4], error.errors);
+})();
+
+(function TestOneParameterErrosIsAnEmptyArray() {
+    let error = new AggregateError([]);
+    assertEquals('', error.message);
+    assertEquals([], error.errors);
+})();
+
+(function TestOneParameterErrorsIsASet() {
+    let set = new Set();
+    set.add(5);
+    set.add(100);
+    let error = new AggregateError(set);
+    assertEquals('', error.message);
+    assertEquals(2, error.errors.length);
+    assertTrue(error.errors[0] == 5 || error.errors[1] == 5);
+    assertTrue(error.errors[0] == 100 || error.errors[1] == 100);
+})();
+
+(function TestOneParameterErrorsNotIterable() {
+    assertThrows(() => { new AggregateError(5); });
+})();
+
+(function TestOneParameterErrorsNotIterable_NoNew() {
+    assertThrows(() => { AggregateError(5); });
+})();
+
+(function TestTwoParameters() {
+    let error = new AggregateError([1, 20, 4], 'custom message');
+    assertEquals('custom message', error.message);
+    assertEquals([1, 20, 4], error.errors);
+})();
+
+(function TestTwoParameters_NoNew() {
+    let error = AggregateError([1, 20, 4], 'custom message');
+    assertEquals('custom message', error.message);
+    assertEquals([1, 20, 4], error.errors);
+})();
+
+(function TestTwoParametersMessageNotString() {
+    let custom = { toString() { return 'hello'; } };
+    let error = new AggregateError([], custom);
+    assertEquals('hello', error.message);
+})();
+
+(function TestTwoParametersMessageIsSMI() {
+    let error = new AggregateError([], 44);
+    assertEquals('44', error.message);
+})();
+
+(function TestTwoParametersMessageUndefined() {
+    let error = new AggregateError([], undefined);
+    assertFalse(Object.prototype.hasOwnProperty.call(error, 'message'));
+})();
+
+(function SetErrors() {
+  let e = new AggregateError([1]);
+  e.errors = [4, 5, 6];
+  assertEquals([4, 5, 6], e.errors);
+})();
+
+(function SubClassProto() {
+    class A extends AggregateError {
+        constructor() {
+            super([]);
+        }
+    }
+
+    let o = new A();
+    assertEquals(o.__proto__, A.prototype);
+})();
+
+(function ErrorsWithHoles() {
+    let errors = [0];
+    errors[2] = 2;
+    let a = new AggregateError(errors);
+    assertEquals([0, undefined, 2], a.errors);
+})();
+
+(function ErrorsIsANewArray(){
+  let array = [8, 9];
+  let e = new AggregateError(array);
+  array.push(1);
+  assertEquals([8, 9], e.errors);
+})();
+
+(function ErrorsIsTheSameArray(){
+    let e = new AggregateError([9, 6, 3]);
+    const errors1 = e.errors;
+    const errors2 = e.errors;
+    assertSame(errors1, errors2);
+})();
+
+(function ErrorsModified(){
+    let e = new AggregateError([9, 6, 3]);
+    const errors1 = e.errors;
+    errors1[0] = 50;
+    const errors2 = e.errors;
+    assertEquals([50, 6, 3], errors1);
+    assertEquals([50, 6, 3], errors2);
+})();
+
+(function EmptyErrorsModified1(){
+    let e = new AggregateError([]);
+    const errors1 = e.errors;
+    errors1[0] = 50;
+    const errors2 = e.errors;
+    assertEquals([50], errors1);
+    assertEquals([50], errors2);
+})();
+
+(function EmptyErrorsModified2(){
+    let e = new AggregateError([]);
+    const errors1 = e.errors;
+    errors1.push(50);
+    const errors2 = e.errors;
+    assertEquals([50], errors1);
+    assertEquals([50], errors2);
+})();
+
+(function AggregateErrorCreation() {
+    // Verify that we match the spec wrt getting the prototype from the
+    // newTarget, iterating the errors array and calling toString on the
+    // message.
+    let counter = 1;
+    let prototype_got = 0;
+    let errors_iterated = 0;
+    let to_string_called = 0;
+
+    // For observing Get(new target, "prototype")
+    function target() {}
+    let handler = {
+        get: (target, prop, receiver) => {
+          if (prop == 'prototype') {
+            prototype_got = counter++;
+            return target.prototype;
+          }
+        }
+    };
+    let p = new Proxy(target, handler);
+
+    // For observing IterableToList(errors)
+    var errors = {
+      [Symbol.iterator]() {
+        return {
+          next() {
+            errors_iterated = counter++;
+            return { done: true };
+          }
+        };
+      }
+    };
+
+    // For observing ToString(message)
+    let message = { toString: () => { to_string_called = counter++;}}
+
+    let o = Reflect.construct(AggregateError, [errors, message], p);
+
+    assertEquals(1, prototype_got);
+    assertEquals(2, to_string_called);
+    assertEquals(3, errors_iterated);
+ })();
diff --git a/deps/v8/test/mjsunit/harmony/logical-assignment.js b/deps/v8/test/mjsunit/harmony/logical-assignment.js
new file mode 100644
index 00000000000..92153547c2e
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/logical-assignment.js
@@ -0,0 +1,42 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-logical-assignment
+
+{
+  let x = null;
+  let y = 0;
+  x ??= y ||= 5;
+
+  assertEquals(x, 5);
+  assertEquals(y, 5);
+}
+
+
+{
+  let x = null;
+  let y = 4;
+  x ??= y ||= 5;
+
+  assertEquals(x, 4);
+  assertEquals(y, 4);
+}
+
+{
+  let x = 1;
+  let y = 0;
+  x &&= y ||= 5;
+
+  assertEquals(x, 5);
+  assertEquals(y, 5);
+}
+
+{
+  let x = 0;
+  let y = 0;
+  x &&= y ||= 5;
+
+  assertEquals(x, 0);
+  assertEquals(y, 0);
+}
diff --git a/deps/v8/test/mjsunit/harmony/optional-chaining-this-private.js b/deps/v8/test/mjsunit/harmony/optional-chaining-this-private.js
new file mode 100644
index 00000000000..1dd27aa59f5
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/optional-chaining-this-private.js
@@ -0,0 +1,16 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class C {
+  static #c = C;
+  static #m() { return this; }
+  static test(C) {
+    assertEquals(C?.#m(), C);
+    assertEquals((C?.#m)(), C);
+    assertEquals(C?.#c?.#m(), C);
+    assertEquals((C?.#c?.#m)(), C);
+  }
+}
+
+C.test(C);
diff --git a/deps/v8/test/mjsunit/harmony/optional-chaining.js b/deps/v8/test/mjsunit/harmony/optional-chaining.js
index a6121f5fcbb..72b0559e004 100644
--- a/deps/v8/test/mjsunit/harmony/optional-chaining.js
+++ b/deps/v8/test/mjsunit/harmony/optional-chaining.js
@@ -101,7 +101,6 @@ shouldThrowSyntaxError('function foo() { new?.target; }');
 
 shouldThrowSyntaxError('function tag() {} tag?.``;');
 shouldThrowSyntaxError('const o = { tag() {} }; o?.tag``;');
-shouldThrowSyntaxError('class A { #foo = "hi"; constructor() { this?.#foo; } }')
 
 const o2 = {
   count: 0,
diff --git a/deps/v8/test/mjsunit/harmony/promise-any-overflow-1.js b/deps/v8/test/mjsunit/harmony/promise-any-overflow-1.js
new file mode 100644
index 00000000000..0a95edd05c3
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/promise-any-overflow-1.js
@@ -0,0 +1,21 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-promise-any
+
+load('test/mjsunit/test-async.js');
+
+// Make sure we properly throw a RangeError when overflowing the maximum
+// number of elements for Promise.any, which is capped at 2^21 bits right
+// now, since we store the indices as identity hash on the resolve element
+// closures.
+const a = new Array(2 ** 21 - 1);
+const p = Promise.resolve(1);
+for (let i = 0; i < a.length; ++i) a[i] = p;
+testAsync(assert => {
+  assert.plan(1);
+  Promise.any(a).then(assert.unreachable, reason => {
+    assert.equals(true, reason instanceof RangeError);
+  });
+});
diff --git a/deps/v8/test/mjsunit/harmony/promise-any-overflow-2.js b/deps/v8/test/mjsunit/harmony/promise-any-overflow-2.js
new file mode 100644
index 00000000000..2ed8453e3a6
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/promise-any-overflow-2.js
@@ -0,0 +1,18 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-promise-any
+
+load('test/mjsunit/test-async.js');
+
+// Test that pre-allocation of the errors array works even if it needs to be
+// allocated in large object space.
+const a = new Array(64 * 1024);
+a.fill(Promise.reject(1));
+testAsync(assert => {
+  assert.plan(1);
+  Promise.any(a).then(assert.unreachable, b => {
+    assert.equals(a.length, b.errors.length);
+  });
+});
diff --git a/deps/v8/test/mjsunit/harmony/promise-any-resolve-not-callable.js b/deps/v8/test/mjsunit/harmony/promise-any-resolve-not-callable.js
new file mode 100644
index 00000000000..abfd0570e9c
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/promise-any-resolve-not-callable.js
@@ -0,0 +1,30 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-promise-any
+
+load('test/mjsunit/test-async.js');
+
+// Promise.any should call IteratorClose if Promise.resolve is not callable.
+
+let returnCount = 0;
+let iter = {
+  [Symbol.iterator]() {
+    return {
+      return() {
+        returnCount++;
+      }
+    };
+  }
+};
+
+Promise.resolve = "certainly not callable";
+
+testAsync(assert => {
+  assert.plan(2);
+  Promise.any(iter).then(assert.unreachable, reason => {
+    assert.equals(true, reason instanceof TypeError);
+    assert.equals(1, returnCount);
+  });
+});
diff --git a/deps/v8/test/mjsunit/harmony/promise-any.js b/deps/v8/test/mjsunit/harmony/promise-any.js
new file mode 100644
index 00000000000..7d5f723f457
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/promise-any.js
@@ -0,0 +1,118 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --harmony-promise-any
+
+load('test/mjsunit/test-async.js');
+
+(function() {
+  testAsync(assert => {
+    assert.plan(1);
+    Promise.any([]).then(
+      assert.unreachable,
+      (x) => { assert.equals(0, x.errors.length); }
+    );
+  });
+})();
+
+(function() {
+  const p1 = Promise.resolve(1);
+  const p2 = Promise.resolve(2);
+  const p3 = Promise.resolve(3);
+  testAsync(assert => {
+    assert.plan(1);
+    Promise.any([p1, p2, p3]).then(
+      (x) => { assert.equals(1, x); },
+      assert.unreachable);
+    });
+})();
+
+(function() {
+  let outsideResolve;
+  let outsideReject;
+  let p1 = new Promise(() => {});
+  let p2 = new Promise(function(resolve, reject) {
+      outsideResolve = resolve;
+      outsideReject = reject;
+  });
+  let p3 = new Promise(() => {});
+  testAsync(assert => {
+    assert.plan(1);
+    Promise.any([p1, p2, p3]).then(
+      (x) => { assert.equals(2, x); },
+      assert.unreachable
+    );
+    outsideResolve(2);
+    });
+})();
+
+(function() {
+  const p1 = Promise.reject(1);
+  const p2 = Promise.resolve(2);
+  const p3 = Promise.resolve(3);
+  testAsync(assert => {
+    assert.plan(1);
+    Promise.any([p1, p2, p3]).then(
+      (x) => { assert.equals(2, x); },
+      assert.unreachable);
+    });
+})();
+
+(function() {
+  const p1 = Promise.reject(1);
+  const p2 = Promise.reject(2);
+  const p3 = Promise.reject(3);
+  testAsync(assert => {
+    assert.plan(4);
+    Promise.any([p1, p2, p3]).then(
+      assert.unreachable,
+      (x) => {
+        assert.equals(3, x.errors.length);
+        assert.equals(1, x.errors[0]);
+        assert.equals(2, x.errors[1]);
+        assert.equals(3, x.errors[2]);
+      }
+    );
+  });
+})();
+
+(function() {
+  testAsync(assert => {
+    assert.plan(1);
+    (async function() {
+      const p1 = Promise.reject(1);
+      const p2 = Promise.reject(2);
+      const p3 = Promise.reject(3);
+      try {
+        await Promise.any([p1, p2, p3]);
+      } catch (error) {
+        assert.equals(1, 1);
+      }
+    })();
+  });
+})();
+
+// Test that we return a proper array even if (custom) "then" invokes the
+// reject callbacks right away.
+(function() {
+  class MyPromise extends Promise {
+    constructor(executor, id) {
+      super(executor);
+      this.id = id;
+    }
+
+    then(resolve, reject) {
+      if (this.id) return reject(this.id);
+      return super.then(resolve, reject)
+    }
+  };
+  const a = new MyPromise(() => {}, 'a');
+  const b = new MyPromise(() => {}, 'b');
+  testAsync(assert => {
+    assert.plan(1);
+    MyPromise.any([a, b]).then(
+      assert.unreachable,
+        (e) => { assert.equals(['a', 'b'], e.errors) });
+  });
+})();
diff --git a/deps/v8/test/mjsunit/harmony/string-matchAll.js b/deps/v8/test/mjsunit/harmony/string-matchAll.js
index e9b39ba46c3..e3b1d5c224d 100644
--- a/deps/v8/test/mjsunit/harmony/string-matchAll.js
+++ b/deps/v8/test/mjsunit/harmony/string-matchAll.js
@@ -36,7 +36,7 @@ TestNoMatch('a', 'b');
 
 
 function TestGlobalRegex(regex_or_string) {
-  const iter = 'ab'.matchAll(/./g);
+  const iter = 'ab'.matchAll(regex_or_string);
   let next_result = iter.next();
   assertEquals(['a'], next_result.value);
   assertFalse(next_result.done);
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/basics-cleanupsome.js b/deps/v8/test/mjsunit/harmony/weakrefs/basics-cleanupsome.js
new file mode 100644
index 00000000000..3a3a54ef347
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/basics-cleanupsome.js
@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs-with-cleanup-some
+
+(function TestCleanupSomeWithoutFinalizationRegistry() {
+  assertThrows(() => FinalizationRegistry.prototype.cleanupSome.call({}), TypeError);
+  // Does not throw:
+  let fg = new FinalizationRegistry(() => {});
+  let rv = FinalizationRegistry.prototype.cleanupSome.call(fg);
+  assertEquals(undefined, rv);
+})();
+
+(function TestCleanupSomeWithNonCallableCallback() {
+  let fg = new FinalizationRegistry(() => {});
+  assertThrows(() => fg.cleanupSome(1), TypeError);
+  assertThrows(() => fg.cleanupSome(1n), TypeError);
+  assertThrows(() => fg.cleanupSome(Symbol()), TypeError);
+  assertThrows(() => fg.cleanupSome({}), TypeError);
+  assertThrows(() => fg.cleanupSome('foo'), TypeError);
+  assertThrows(() => fg.cleanupSome(true), TypeError);
+  assertThrows(() => fg.cleanupSome(false), TypeError);
+  assertThrows(() => fg.cleanupSome(null), TypeError);
+})();
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/basics.js b/deps/v8/test/mjsunit/harmony/weakrefs/basics.js
index 9a1a99efe4d..547a688c2ae 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/basics.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/basics.js
@@ -148,23 +148,3 @@
   let proxy = new Proxy(obj, handler);
   let wr = new WeakRef(proxy);
 })();
-
-(function TestCleanupSomeWithoutFinalizationRegistry() {
-  assertThrows(() => FinalizationRegistry.prototype.cleanupSome.call({}), TypeError);
-  // Does not throw:
-  let fg = new FinalizationRegistry(() => {});
-  let rv = FinalizationRegistry.prototype.cleanupSome.call(fg);
-  assertEquals(undefined, rv);
-})();
-
-(function TestCleanupSomeWithNonCallableCallback() {
-  let fg = new FinalizationRegistry(() => {});
-  assertThrows(() => fg.cleanupSome(1), TypeError);
-  assertThrows(() => fg.cleanupSome(1n), TypeError);
-  assertThrows(() => fg.cleanupSome(Symbol()), TypeError);
-  assertThrows(() => fg.cleanupSome({}), TypeError);
-  assertThrows(() => fg.cleanupSome('foo'), TypeError);
-  assertThrows(() => fg.cleanupSome(true), TypeError);
-  assertThrows(() => fg.cleanupSome(false), TypeError);
-  assertThrows(() => fg.cleanupSome(null), TypeError);
-})();
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/cleanup-doesnt-iterate-all-holdings.js b/deps/v8/test/mjsunit/harmony/weakrefs/cleanup-doesnt-iterate-all-holdings.js
deleted file mode 100644
index 3f5133a87c6..00000000000
--- a/deps/v8/test/mjsunit/harmony/weakrefs/cleanup-doesnt-iterate-all-holdings.js
+++ /dev/null
@@ -1,93 +0,0 @@
-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
-
-let cleanup_call_count = 0;
-let cleanup = function(iter) {
-  print("in cleanup");
-  if (cleanup_call_count == 0) {
-    // First call: iterate 2 of the 3 holdings
-    let holdings_list = [];
-    for (holdings of iter) {
-      holdings_list.push(holdings);
-      // Don't iterate the rest of the holdings
-      if (holdings_list.length == 2) {
-        break;
-      }
-    }
-    assertEquals(holdings_list.length, 2);
-    assertTrue(holdings_list[0] < 3);
-    assertTrue(holdings_list[1] < 3);
-    // Update call count only after the asserts; this ensures that the test
-    // fails even if the exceptions inside the cleanup function are swallowed.
-    cleanup_call_count++;
-  } else {
-    // Second call: iterate one leftover holdings and one holdings.
-    assertEquals(1, cleanup_call_count);
-    let holdings_list = [];
-    for (holdings of iter) {
-      holdings_list.push(holdings);
-    }
-    assertEquals(holdings_list.length, 2);
-    assertTrue((holdings_list[0] < 3 && holdings_list[1] == 100) ||
-               (holdings_list[1] < 3 && holdings_list[0] == 100));
-    // Update call count only after the asserts; this ensures that the test
-    // fails even if the exceptions inside the cleanup function are swallowed.
-    cleanup_call_count++;
-  }
-}
-
-let fg = new FinalizationRegistry(cleanup);
-// Create 3 objects and register them in the FinalizationRegistry. The objects need
-// to be inside a closure so that we can reliably kill them!
-
-(function() {
-  let objects = [];
-
-  for (let i = 0; i < 3; ++i) {
-    objects[i] = {a: i};
-    fg.register(objects[i], i);
-  }
-
-  gc();
-  assertEquals(0, cleanup_call_count);
-
-  // Drop the references to the objects.
-  objects = [];
-})();
-
-// This GC will reclaim the targets.
-gc();
-assertEquals(0, cleanup_call_count);
-
-let timeout_func_1 = function() {
-  assertEquals(1, cleanup_call_count);
-
-  // Assert that the cleanup function won't be called unless new targets appear.
-  setTimeout(timeout_func_2, 0);
-}
-
-setTimeout(timeout_func_1, 0);
-
-let timeout_func_2 = function() {
-  assertEquals(1, cleanup_call_count);
-
-  // Create a new object and register it.
-  (function() {
-    let obj = {};
-    let wc = fg.register(obj, 100);
-    obj = null;
-  })();
-
-  // This GC will reclaim the targets.
-  gc();
-  assertEquals(1, cleanup_call_count);
-
-  setTimeout(timeout_func_3, 0);
-}
-
-let timeout_func_3 = function() {
-  assertEquals(2, cleanup_call_count);
-}
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/cleanup-is-not-a-microtask.js b/deps/v8/test/mjsunit/harmony/weakrefs/cleanup-is-not-a-microtask.js
index 12282f7486e..8b43618c711 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/cleanup-is-not-a-microtask.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/cleanup-is-not-a-microtask.js
@@ -19,9 +19,8 @@ function scheduleMicrotask(func) {
 
 let log = [];
 
-let cleanup = (iter) => {
+let cleanup = (holdings) => {
   cleanedUp = true;
-  for (holdings of iter) { }
 }
 
 let fg = new FinalizationRegistry(cleanup);
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/iterating-in-cleanup.js b/deps/v8/test/mjsunit/harmony/weakrefs/cleanup.js
similarity index 78%
rename from deps/v8/test/mjsunit/harmony/weakrefs/iterating-in-cleanup.js
rename to deps/v8/test/mjsunit/harmony/weakrefs/cleanup.js
index c591b44a541..ef60d3f1501 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/iterating-in-cleanup.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/cleanup.js
@@ -4,21 +4,11 @@
 
 // Flags: --harmony-weak-refs --expose-gc --noincremental-marking
 
-let cleanup_called = false;
-let cleanup = function(iter) {
-  assertFalse(cleanup_called);
-  let holdings_list = [];
-  for (holdings of iter) {
-    holdings_list.push(holdings);
-  }
-  assertEquals(holdings_list.length, 2);
-  if (holdings_list[0] == 1) {
-    assertEquals(holdings_list[1], 2);
-  } else {
-    assertEquals(holdings_list[0], 2);
-    assertEquals(holdings_list[1], 1);
-  }
-  cleanup_called = true;
+let cleanup_called = 0;
+let holdings_list = [];
+let cleanup = function(holdings) {
+  holdings_list.push(holdings);
+  cleanup_called++;
 }
 
 let fg = new FinalizationRegistry(cleanup);
@@ -34,7 +24,7 @@ let o2 = {};
 })();
 
 gc();
-assertFalse(cleanup_called);
+assertEquals(cleanup_called, 0);
 
 // Drop the last references to o1 and o2.
 (function() {
@@ -45,10 +35,17 @@ assertFalse(cleanup_called);
 // GC will reclaim the target objects; the cleanup function will be called the
 // next time we enter the event loop.
 gc();
-assertFalse(cleanup_called);
+assertEquals(cleanup_called, 0);
 
 let timeout_func = function() {
-  assertTrue(cleanup_called);
+  assertEquals(cleanup_called, 2);
+  assertEquals(holdings_list.length, 2);
+  if (holdings_list[0] == 1) {
+    assertEquals(holdings_list[1], 2);
+  } else {
+    assertEquals(holdings_list[0], 2);
+    assertEquals(holdings_list[1], 1);
+  }
 }
 
 setTimeout(timeout_func, 0);
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/cleanupsome-2.js b/deps/v8/test/mjsunit/harmony/weakrefs/cleanupsome-2.js
index 8e40fd6bbd4..f7fe196c78e 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/cleanupsome-2.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/cleanupsome-2.js
@@ -2,14 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+// Flags: --harmony-weak-refs-with-cleanup-some --expose-gc --noincremental-marking --allow-natives-syntax
 
 let cleanup_count = 0;
 let cleanup_holdings = [];
-let cleanup = function(iter) {
-  for (holdings of iter) {
-    cleanup_holdings.push(holdings);
-  }
+let cleanup = function(holdings) {
+  cleanup_holdings.push(holdings);
   ++cleanup_count;
 }
 
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/cleanupsome-after-unregister.js b/deps/v8/test/mjsunit/harmony/weakrefs/cleanupsome-after-unregister.js
index 697c926a82e..cdced3fca5d 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/cleanupsome-after-unregister.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/cleanupsome-after-unregister.js
@@ -2,14 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+// Flags: --harmony-weak-refs-with-cleanup-some --expose-gc --noincremental-marking
 
 let cleanup_count = 0;
 let cleanup_holdings = [];
-let cleanup = function(iter) {
-  for (holdings of iter) {
-    cleanup_holdings.push(holdings);
-  }
+let cleanup = function(holdings) {
+  cleanup_holdings.push(holdings);
   ++cleanup_count;
 }
 
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/cleanupsome-optional.js b/deps/v8/test/mjsunit/harmony/weakrefs/cleanupsome-optional.js
new file mode 100644
index 00000000000..7476f2bd4ed
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/cleanupsome-optional.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs
+
+// FinalizationRegistry#cleanupSome is normative optional and has its own
+// flag. Test that it's not present with only --harmony-weak-refs.
+
+assertEquals(undefined, Object.getOwnPropertyDescriptor(
+  FinalizationRegistry.prototype, "cleanupSome"));
+assertEquals(undefined, FinalizationRegistry.prototype.cleanupSome);
+assertFalse('cleanupSome' in FinalizationRegistry.prototype);
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/cleanupsome.js b/deps/v8/test/mjsunit/harmony/weakrefs/cleanupsome.js
index f757bdbf7e0..480ec4e2ad8 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/cleanupsome.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/cleanupsome.js
@@ -2,18 +2,16 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+// Flags: --harmony-weak-refs-with-cleanup-some --expose-gc --noincremental-marking --allow-natives-syntax
 
 let cleanup_count = 0;
 let cleanup_holdings = [];
-let cleanup = function(iter) {
+let cleanup = function(holdings) {
   %AbortJS("shouldn't be called");
 }
 
-let cleanup2 = function(iter) {
-  for (holdings of iter) {
-    cleanup_holdings.push(holdings);
-  }
+let cleanup2 = function(holdings) {
+  cleanup_holdings.push(holdings);
   ++cleanup_count;
 }
 
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/clearkeptobjects-on-quit.js b/deps/v8/test/mjsunit/harmony/weakrefs/clearkeptobjects-on-quit.js
new file mode 100644
index 00000000000..6007f9c3608
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/clearkeptobjects-on-quit.js
@@ -0,0 +1,13 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs
+
+// A newly created WeakRef is kept alive until the end of the next microtask
+// checkpoint. V8 asserts that the kept objects list is cleared at the end of
+// microtask checkpoints when the microtask policy is auto. Test that d8, which
+// uses the auto policy, upholds the assert when manually quitting.
+let obj = {};
+let wr = new WeakRef(obj);
+testRunner.quit();
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-and-weakref b/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-and-weakref
index 144b56fce72..274e714994d 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-and-weakref
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-and-weakref
@@ -5,12 +5,10 @@
 // Flags: --harmony-weak-refs --expose-gc --noincremental-marking
 
 let cleanup_called = false;
-let cleanup = function(iter) {
+let cleanup = function(holdings) {
   assertFalse(cleanup_called);
   let holdings_list = [];
-  for (holdings of iter) {
-    holdings_list.push(holdings);
-  }
+  holdings_list.push(holdings);
   assertEquals(1, holdings_list.length);
   assertEquals("holdings", holdings_list[0]);
   cleanup_called = true;
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-independent-lifetime.js b/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-independent-lifetime.js
index 732740f2930..72d2cae83ef 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-independent-lifetime.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-independent-lifetime.js
@@ -5,8 +5,7 @@
 // Flags: --harmony-weak-refs --expose-gc --noincremental-marking
 
 let cleanup_called = false;
-function cleanup(iter) {
-  [...iter];
+function cleanup(holdings) {
   cleanup_called = true;
 };
 (function() {
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-keeps-holdings-alive.js b/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-keeps-holdings-alive.js
index d8c00fcff8f..f63d17ed7fe 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-keeps-holdings-alive.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-keeps-holdings-alive.js
@@ -5,14 +5,10 @@
 // Flags: --harmony-weak-refs --expose-gc --noincremental-marking
 
 let cleanup_called = false;
-let cleanup = function(iter) {
+let holdings_list = [];
+let cleanup = function(holdings) {
   assertFalse(cleanup_called);
-  let holdings_list = [];
-  for (holdings of iter) {
-    holdings_list.push(holdings);
-  }
-  assertEquals(holdings_list.length, 1);
-  assertEquals(holdings_list[0].a, "this is the holdings object");
+  holdings_list.push(holdings);
   cleanup_called = true;
 }
 
@@ -40,6 +36,8 @@ assertFalse(cleanup_called);
 
 let timeout_func = function() {
   assertTrue(cleanup_called);
+  assertEquals(holdings_list.length, 1);
+  assertEquals(holdings_list[0].a, "this is the holdings object");
 }
 
 setTimeout(timeout_func, 0);
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-scheduled-for-cleanup-multiple-times.js b/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-scheduled-for-cleanup-multiple-times.js
index de25bbe425c..3b3f3412a20 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-scheduled-for-cleanup-multiple-times.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/finalizationregistry-scheduled-for-cleanup-multiple-times.js
@@ -11,17 +11,13 @@ let cleanup0_holdings_count = 0;
 let cleanup1_call_count = 0;
 let cleanup1_holdings_count = 0;
 
-let cleanup0 = function(iter) {
-  for (holdings of iter) {
-    ++cleanup0_holdings_count;
-  }
+let cleanup0 = function(holdings) {
+  ++cleanup0_holdings_count;
   ++cleanup0_call_count;
 }
 
-let cleanup1 = function(iter) {
-  for (holdings of iter) {
-    ++cleanup1_holdings_count;
-  }
+let cleanup1 = function(holdings) {
+  ++cleanup1_holdings_count;
   ++cleanup1_call_count;
 }
 
@@ -61,12 +57,11 @@ gc();
 gc();
 
 let timeout_func = function() {
-  assertEquals(1, cleanup0_call_count);
+  assertEquals(2, cleanup0_call_count);
   assertEquals(2, cleanup0_holdings_count);
-  assertEquals(1, cleanup1_call_count);
+  assertEquals(2, cleanup1_call_count);
   assertEquals(2, cleanup1_holdings_count);
 }
 
-// Give the cleanup task a chance to run. All holdings will be iterated during
-// the same invocation of the cleanup function.
+// Give the cleanup task a chance to run.
 setTimeout(timeout_func, 0);
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/multiple-dirty-finalization-groups.js b/deps/v8/test/mjsunit/harmony/weakrefs/multiple-dirty-finalization-groups.js
index fec0ab5b574..21b9ff709b7 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/multiple-dirty-finalization-groups.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/multiple-dirty-finalization-groups.js
@@ -6,10 +6,8 @@
 
 let cleanup_call_count = 0;
 let cleanup_holdings_count = 0;
-let cleanup = function(iter) {
-  for (holdings of iter) {
-    ++cleanup_holdings_count;
-  }
+let cleanup = function(holdings) {
+  ++cleanup_holdings_count;
   ++cleanup_call_count;
 }
 
@@ -33,7 +31,7 @@ let fg2 = new FinalizationRegistry(cleanup);
 gc();
 assertEquals(0, cleanup_call_count);
 
-// Assert that the cleanup function was called and iterated the holdings.
+// Assert that the cleanup function was called.
 let timeout_func = function() {
   assertEquals(2, cleanup_call_count);
   assertEquals(2, cleanup_holdings_count);
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/reentrant-gc-from-cleanup.js b/deps/v8/test/mjsunit/harmony/weakrefs/reentrant-gc-from-cleanup.js
index 09854f05562..235a34a5921 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/reentrant-gc-from-cleanup.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/reentrant-gc-from-cleanup.js
@@ -5,9 +5,7 @@
 // Flags: --harmony-weak-refs --expose-gc --noincremental-marking
 
 let call_count = 0;
-let reentrant_gc =
-    function(iter) {
-  [...iter];
+let reentrant_gc = function(holdings) {
   gc();
   call_count++;
 }
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/stress-finalizationregistry-dirty-enqueue.js b/deps/v8/test/mjsunit/harmony/weakrefs/stress-finalizationregistry-dirty-enqueue.js
new file mode 100644
index 00000000000..f9bcc2b77df
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/stress-finalizationregistry-dirty-enqueue.js
@@ -0,0 +1,36 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stress-compaction --expose-gc
+
+// Test that the dirty FinalizationRegistries that are enqueued during GC have
+// their slots correctly recorded by the GC.
+
+// 1) Create many JSFinalizationRegistry objects so that they span several pages
+// (page size is 256kb).
+let registries = [];
+for (let i = 0; i < 1024 * 8; i++) {
+  registries.push(new FinalizationRegistry(() => {}));
+}
+
+// 2) Force two GCs to ensure that JSFinalizatonRegistry objects are tenured.
+gc();
+gc();
+
+// 3) In a function: create a dummy target and register it in all
+// JSFinalizatonRegistry objects.
+(function() {
+  let garbage = {};
+  registries.forEach((fr) => {
+    fr.register(garbage, 42);
+  });
+  garbage = null;
+})();
+
+// 4) Outside the function where the target is unreachable: force GC to collect
+// the object.
+gc();
+
+// 5) Force another GC to test that the slot was correctly updated.
+gc();
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/undefined-holdings.js b/deps/v8/test/mjsunit/harmony/weakrefs/undefined-holdings.js
index 7c09cf59850..56d9b562a11 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/undefined-holdings.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/undefined-holdings.js
@@ -6,11 +6,9 @@
 
 let cleanup_call_count = 0;
 let cleanup_holdings_count = 0;
-let cleanup = function(iter) {
-  for (holdings of iter) {
-    assertEquals(holdings, undefined);
-    ++cleanup_holdings_count;
-  }
+let cleanup = function(holdings) {
+  assertEquals(holdings, undefined);
+  ++cleanup_holdings_count;
   ++cleanup_call_count;
 }
 
@@ -30,7 +28,7 @@ let fg = new FinalizationRegistry(cleanup);
 gc();
 assertEquals(0, cleanup_call_count);
 
-// Assert that the cleanup function was called and iterated the holdings.
+// Assert that the cleanup function was called.
 let timeout_func = function() {
   assertEquals(1, cleanup_call_count);
   assertEquals(1, cleanup_holdings_count);
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-after-cleanup.js b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-after-cleanup.js
index e8a7843c71a..400385d1931 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-after-cleanup.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-after-cleanup.js
@@ -6,11 +6,9 @@
 
 let cleanup_call_count = 0;
 let cleanup_holdings_count = 0;
-let cleanup = function(iter) {
-  for (holdings of iter) {
-    assertEquals("holdings", holdings);
-    ++cleanup_holdings_count;
-  }
+let cleanup = function(holdings) {
+  assertEquals("holdings", holdings);
+  ++cleanup_holdings_count;
   ++cleanup_call_count;
 }
 
@@ -30,12 +28,12 @@ let key = {"k": "this is the key"};
 gc();
 assertEquals(0, cleanup_call_count);
 
-// Assert that the cleanup function was called and iterated the holdings.
+// Assert that the cleanup function was called.
 let timeout_func = function() {
   assertEquals(1, cleanup_call_count);
   assertEquals(1, cleanup_holdings_count);
 
-  // Unregister an already iterated over weak reference.
+  // Unregister an already cleaned-up weak reference.
   let success = fg.unregister(key);
   assertFalse(success);
 
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-before-cleanup.js b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-before-cleanup.js
index ff576b4dfef..efa4df52170 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-before-cleanup.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-before-cleanup.js
@@ -5,7 +5,7 @@
 // Flags: --harmony-weak-refs --expose-gc --noincremental-marking --noincremental-marking
 
 let cleanup_call_count = 0;
-let cleanup = function(iter) {
+let cleanup = function(holdings) {
   ++cleanup_call_count;
 }
 
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-called-twice.js b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-called-twice.js
index e7604eecec7..ff48758c07d 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-called-twice.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-called-twice.js
@@ -5,7 +5,7 @@
 // Flags: --harmony-weak-refs --expose-gc --noincremental-marking
 
 let cleanup_call_count = 0;
-let cleanup = function(iter) {
+let cleanup = function(holdings) {
   ++cleanup_call_count;
 }
 
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup5.js b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup.js
similarity index 65%
rename from deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup5.js
rename to deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup.js
index 30926d1d56f..e607a1ead5a 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup5.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup.js
@@ -6,18 +6,12 @@
 
 let cleanup_call_count = 0;
 let cleanup_holdings_count = 0;
-let cleanup = function(iter) {
-  for (holdings of iter) {
-    assertEquals(holdings, "holdings");
-
-    // There's one more object with the same key that we haven't
-    // iterated over yet so we should be able to unregister the
-    // callback for that one.
-    let success = fg.unregister(key);
-    assertTrue(success);
-
-    ++cleanup_holdings_count;
-  }
+let cleanup = function(holdings) {
+  assertEquals(holdings, "holdings");
+  let success = fg.unregister(key);
+  assertFalse(success);
+
+  ++cleanup_holdings_count;
   ++cleanup_call_count;
 }
 
@@ -28,9 +22,7 @@ let key = {"k": "this is the key"};
 
 (function() {
   let object = {};
-  let object2 = {};
   fg.register(object, "holdings", key);
-  fg.register(object2, "holdings", key);
 
   // object goes out of scope.
 })();
@@ -39,7 +31,7 @@ let key = {"k": "this is the key"};
 gc();
 assertEquals(0, cleanup_call_count);
 
-// Assert that the cleanup function was called and iterated the WeakCell.
+// Assert that the cleanup function was called.
 let timeout_func = function() {
   assertEquals(1, cleanup_call_count);
   assertEquals(1, cleanup_holdings_count);
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup1.js b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup1.js
deleted file mode 100644
index a62e6ed923c..00000000000
--- a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup1.js
+++ /dev/null
@@ -1,42 +0,0 @@
-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
-
-let cleanup_call_count = 0;
-let cleanup_holdings_count = 0;
-let cleanup = function(iter) {
-  // Unregister before we've iterated through the holdings.
-  let success = fg.unregister(key);
-  assertTrue(success);
-
-  for (wc of iter) {
-    ++cleanup_holdings_count;
-  }
-  ++cleanup_call_count;
-}
-
-let fg = new FinalizationRegistry(cleanup);
-let key = {"k": "the key"};
-// Create an object and register it in the FinalizationRegistry. The object needs
-// to be inside a closure so that we can reliably kill them!
-
-(function() {
-  let object = {};
-  fg.register(object, "holdings", key);
-
-  // object goes out of scope.
-})();
-
-// This GC will discover unretained targets and schedule cleanup.
-gc();
-assertEquals(0, cleanup_call_count);
-
-// Assert that the cleanup function was called, but didn't iterate any holdings.
-let timeout_func = function() {
-  assertEquals(1, cleanup_call_count);
-  assertEquals(0, cleanup_holdings_count);
-}
-
-setTimeout(timeout_func, 0);
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup2.js b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup2.js
index e26d9a19217..e04b9f14859 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup2.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup2.js
@@ -6,34 +6,40 @@
 
 let cleanup_call_count = 0;
 let cleanup_holdings_count = 0;
-let cleanup = function(iter) {
-  for (holdings of iter) {
-    assertEquals(holdings, "holdings");
-    let success = fg.unregister(key);
-    assertFalse(success);
-
-    ++cleanup_holdings_count;
+let cleanup = function(holdings) {
+  // See which target we're cleaning up and unregister the other one.
+  if (holdings == 1) {
+    let success = fg.unregister(key2);
+    assertTrue(success);
+  } else {
+    assertSame(holdings, 2);
+    let success = fg.unregister(key1);
+    assertTrue(success);
   }
+  ++cleanup_holdings_count;
   ++cleanup_call_count;
 }
 
 let fg = new FinalizationRegistry(cleanup);
-// Create an object and register it in the FinalizationRegistry. The object needs to be inside
-// a closure so that we can reliably kill them!
-let key = {"k": "this is the key"};
+let key1 = {"k": "first key"};
+let key2 = {"k": "second key"};
+// Create two objects and register them in the FinalizationRegistry. The objects
+// need to be inside a closure so that we can reliably kill them!
 
 (function() {
-  let object = {};
-  fg.register(object, "holdings", key);
+  let object1 = {};
+  fg.register(object1, 1, key1);
+  let object2 = {};
+  fg.register(object2, 2, key2);
 
-  // object goes out of scope.
+  // object1 and object2 go out of scope.
 })();
 
-// This GC will discover dirty WeakCells and schedule cleanup.
+// This GC will reclaim target objects and schedule cleanup.
 gc();
 assertEquals(0, cleanup_call_count);
 
-// Assert that the cleanup function was called and iterated the WeakCell.
+// Assert that the cleanup function was called and cleaned up one holdings (but not the other one).
 let timeout_func = function() {
   assertEquals(1, cleanup_call_count);
   assertEquals(1, cleanup_holdings_count);
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup3.js b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup3.js
index 8f28673205b..e11fd3b8e93 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup3.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup3.js
@@ -6,35 +6,39 @@
 
 let cleanup_call_count = 0;
 let cleanup_holdings_count = 0;
-let cleanup = function(iter) {
-  for (holdings of iter) {
-    assertEquals(holdings, "holdings");
-    ++cleanup_holdings_count;
-  }
-  // Unregister an already iterated over weak reference.
+let cleanup = function(holdings) {
+  assertEquals(holdings, "holdings");
+
+  // There's one more object with the same key that we haven't
+  // cleaned up yet so we should be able to unregister the
+  // callback for that one.
   let success = fg.unregister(key);
-  assertFalse(success);
+
+  assertTrue(success);
+
+  ++cleanup_holdings_count;
   ++cleanup_call_count;
 }
 
 let fg = new FinalizationRegistry(cleanup);
-let key = {"k": "this is the key"};
-
 // Create an object and register it in the FinalizationRegistry. The object needs to be inside
 // a closure so that we can reliably kill them!
+let key = {"k": "this is the key"};
 
 (function() {
   let object = {};
+  let object2 = {};
   fg.register(object, "holdings", key);
+  fg.register(object2, "holdings", key);
 
   // object goes out of scope.
 })();
 
-// This GC will reclaim the target object and schedule cleanup.
+// This GC will discover dirty WeakCells and schedule cleanup.
 gc();
 assertEquals(0, cleanup_call_count);
 
-// Assert that the cleanup function was called and iterated the holdings.
+// Assert that the cleanup function was called.
 let timeout_func = function() {
   assertEquals(1, cleanup_call_count);
   assertEquals(1, cleanup_holdings_count);
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup4.js b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup4.js
deleted file mode 100644
index a7ab9d18dfd..00000000000
--- a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup4.js
+++ /dev/null
@@ -1,50 +0,0 @@
-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
-
-let cleanup_call_count = 0;
-let cleanup_holdings_count = 0;
-let cleanup = function(iter) {
-  for (holdings of iter) {
-    // See which target we're iterating over and unregister the other one.
-    if (holdings == 1) {
-      let success = fg.unregister(key2);
-      assertTrue(success);
-    } else {
-      assertSame(holdings, 2);
-      let success = fg.unregister(key1);
-      assertTrue(success);
-    }
-    ++cleanup_holdings_count;
-  }
-  ++cleanup_call_count;
-}
-
-let fg = new FinalizationRegistry(cleanup);
-let key1 = {"k": "first key"};
-let key2 = {"k": "second key"};
-// Create two objects and register them in the FinalizationRegistry. The objects
-// need to be inside a closure so that we can reliably kill them!
-
-(function() {
-  let object1 = {};
-  fg.register(object1, 1, key1);
-  let object2 = {};
-  fg.register(object2, 2, key2);
-
-  // object1 and object2 go out of scope.
-})();
-
-// This GC will reclaim target objects and schedule cleanup.
-gc();
-assertEquals(0, cleanup_call_count);
-
-// Assert that the cleanup function was called and iterated one holdings (but not the other one).
-let timeout_func = function() {
-  assertEquals(1, cleanup_call_count);
-  assertEquals(1, cleanup_holdings_count);
-}
-
-setTimeout(timeout_func, 0);
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-many.js b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-many.js
index 3512fc9217f..772078e1077 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-many.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-many.js
@@ -6,11 +6,9 @@
 
 let cleanup_call_count = 0;
 let cleanup_holdings_count = 0;
-let cleanup = function(iter) {
-  for (holdings of iter) {
-    assertEquals("holdings2", holdings);
-    ++cleanup_holdings_count;
-  }
+let cleanup = function(holdings) {
+  assertEquals("holdings2", holdings);
+  ++cleanup_holdings_count;
   ++cleanup_call_count;
 }
 
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-when-cleanup-already-scheduled.js b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-when-cleanup-already-scheduled.js
index 51179979652..3b3e488a82d 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/unregister-when-cleanup-already-scheduled.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/unregister-when-cleanup-already-scheduled.js
@@ -5,7 +5,7 @@
 // Flags: --harmony-weak-refs --expose-gc --noincremental-marking
 
 let cleanup_call_count = 0;
-let cleanup = function(iter) {
+let cleanup = function(holdings) {
   ++cleanup_call_count;
 }
 
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/weak-cell-basics.js b/deps/v8/test/mjsunit/harmony/weakrefs/weak-cell-basics.js
index f3480f78d15..ee4b5ecb903 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/weak-cell-basics.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/weak-cell-basics.js
@@ -5,13 +5,9 @@
 // Flags: --harmony-weak-refs --expose-gc --noincremental-marking
 
 let cleanup_called = false;
-let cleanup = function(iter) {
+let cleanup = function(holdings_arg) {
   assertFalse(cleanup_called);
-  let result = iter.next();
-  assertEquals(result.value, holdings);
-  assertFalse(result.done);
-  result = iter.next();
-  assertTrue(result.done);
+  assertEquals(holdings_arg, holdings);
   cleanup_called = true;
 }
 
diff --git a/deps/v8/test/mjsunit/harmony/weakrefs/weak-unregistertoken.js b/deps/v8/test/mjsunit/harmony/weakrefs/weak-unregistertoken.js
index 94f5ce6a903..6572faee212 100644
--- a/deps/v8/test/mjsunit/harmony/weakrefs/weak-unregistertoken.js
+++ b/deps/v8/test/mjsunit/harmony/weakrefs/weak-unregistertoken.js
@@ -2,19 +2,19 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+// Flags: --harmony-weak-refs-with-cleanup-some --expose-gc --noincremental-marking
 
-var FG = new FinalizationRegistry (function (iter) { globalThis.FRRan = true; });
+var FR = new FinalizationRegistry (function (holdings) { globalThis.FRRan = true; });
 {
   let obj = {};
   // obj is its own unregister token and becomes unreachable after this
   // block. If the unregister token is held strongly this test will not
   // terminate.
-  FG.register(obj, 42, obj);
+  FR.register(obj, 42, obj);
 }
 function tryAgain() {
   gc();
-  if (globalThis.FRRan || FG.cleanupSome()) {
+  if (globalThis.FRRan || FR.cleanupSome()) {
     return;
   }
   setTimeout(tryAgain, 0);
diff --git a/deps/v8/test/mjsunit/mjsunit.js b/deps/v8/test/mjsunit/mjsunit.js
index 58dcd6c9ed1..0aeb3862ca1 100644
--- a/deps/v8/test/mjsunit/mjsunit.js
+++ b/deps/v8/test/mjsunit/mjsunit.js
@@ -295,7 +295,7 @@ var prettyPrinted;
           default:
             return objectClass + "(" + String(value) + ")";
         }
-        // [[Class]] is "Object".
+        // classOf() returned "Object".
         var name = value.constructor.name;
         if (name) return name + "()";
         return "Object()";
diff --git a/deps/v8/test/mjsunit/mjsunit.status b/deps/v8/test/mjsunit/mjsunit.status
index 989c0979080..f8aa3ef7047 100644
--- a/deps/v8/test/mjsunit/mjsunit.status
+++ b/deps/v8/test/mjsunit/mjsunit.status
@@ -65,6 +65,14 @@
   # BUG(v8:10197)
   'regress/regress-748069': [SKIP],
 
+  # https://crbug.com/1043058
+  # Enable once serializing a running isolate is fully implemented.
+  'serialize-deserialize-now': [SKIP],
+
+  # https://crbug.com/v8/issues/10486
+  # Enable once multi-byte prefixed opcodes are correctly handled
+  'regress/wasm/regress-1065599': [SKIP],
+
   ##############################################################################
   # Tests where variants make no sense.
   'd8/enable-tracing': [PASS, NO_VARIANTS],
@@ -86,6 +94,7 @@
   # Long-running tests.
   # We really should find better solutions for these.
   'es6/promise-all-overflow-1': [SKIP],
+  'harmony/promise-any-overflow-1': [SKIP],
   'migrations': [SKIP],
   'regress/regress-2073': [SKIP],
 
@@ -113,6 +122,7 @@
   'asm/sqlite3/*': [PASS, SLOW, NO_VARIANTS],
   'compiler/regress-9017': [PASS, SLOW],
   'es6/promise-all-overflow-2': [PASS, SLOW, ['arch != x64', SKIP]],
+  'harmony/promise-any-overflow-2': [PASS, SLOW, ['arch != x64', SKIP]],
   'copy-on-write-assert': [PASS, SLOW],
   'es6/typedarray-construct-offset-not-smi': [PASS, SLOW],
   'harmony/futex': [PASS, SLOW],
@@ -237,6 +247,7 @@
   'es6/block-let-crankshaft': [SKIP],
   'opt-elements-kind': [SKIP],
   'osr-elements-kind': [SKIP],
+  'compiler/number-divide': [SKIP],
   'regress/regress-crbug-137689': [SKIP],
   'regress/regress-trap-allocation-memento': [SKIP],
   'regress/regress-2249': [SKIP],
@@ -380,6 +391,7 @@
 
   # Flag --interpreted-frames-native-stack incompatible with jitless
   'regress/regress-10138': [SKIP],
+  'regress/regress-1078913': [SKIP],
 }],  # 'lite_mode or variant == jitless'
 
 ##############################################################################
@@ -822,10 +834,6 @@
   'wasm/module-memory': [SKIP],
   'wasm/shared-memory-gc-stress': [SKIP],
 
-  # Redirection to the interpreter is non-deterministic with multiple isolates.
-  'wasm/interpreter-mixed': [SKIP],
-  'wasm/worker-interpreter': [SKIP],
-
   # The {FreezeWasmLazyCompilation} runtime function sets a flag in the native
   # module, which causes a data-race if the native module is shared between
   # isolates.
@@ -937,16 +945,26 @@
 
   # BUG(v8:7166).
   'd8/enable-tracing': [SKIP],
-  # Relies on async compilation which requires background tasks.
-  'wasm/streaming-error-position': [SKIP],
+
+  # Rely on (blocking) concurrent compilation.
+  'compiler/concurrent-invalidate-transition-map': [SKIP],
+  'compiler/concurrent-proto-change': [SKIP],
+  'compiler/manual-concurrent-recompile': [SKIP],
+  'compiler/regress-905555-2': [SKIP],
+  'compiler/regress-905555': [SKIP],
+  'compiler/regress-9945-1': [SKIP],
+  'concurrent-initial-prototype-change': [SKIP],
+  'regress/regress-356053': [SKIP],
+  'regress/regress-embedded-cons-string': [SKIP],
+
   # Intentionally non-deterministic using shared arraybuffers.
   'wasm/atomics-stress': [SKIP],
   'wasm/atomics64-stress': [SKIP],
   'wasm/futex': [SKIP],
+  'regress/wasm/regress-1067621': [SKIP],
 
-  # Deadlocks on predictable platform (https://crbug.com/v8/9760).
-  'wasm/async-compile': [SKIP],
-  'wasm/streaming-compile': [SKIP],
+  # BUG(v8:9975).
+  'es6/typedarray-copywithin': [SKIP],
 }],  # 'predictable == True'
 
 ##############################################################################
@@ -1134,9 +1152,20 @@
   'compiler/opt-higher-order-functions': [SKIP],
   'regress/regress-1049982-1': [SKIP],
   'regress/regress-1049982-2': [SKIP],
+  'es6/iterator-eager-deopt': [SKIP],
 
   # interrupt_budget overrides don't work with TurboProp.
   'interrupt-budget-override': [SKIP],
+  'never-optimize': [SKIP],
+
+  # In turboprop we reuse the optimized code on soft deopt. The following tests
+  # test for a soft deopt and they won't work in TurboProp.
+  'deopt-recursive-soft-once': [SKIP],
+  'regress/regress-3709': [SKIP],
+  'regress/regress-5790': [SKIP],
+
+  # const field tracking is disabled in turboprop
+  'const-field-tracking': [SKIP],
 }],  # variant == turboprop
 
 ##############################################################################
@@ -1160,4 +1189,72 @@
   'compiler/number-toboolean': [SKIP],
 }],  # variant == assert_types
 
+##############################################################################
+['variant == stress_snapshot and arch != x64', {
+  # Deserialization fails due to read-only snapshot checksum verification.
+  # https://crbug.com/v8/10491
+  '*': [SKIP],
+}],
+
+['variant == stress_snapshot and arch == x64', {
+  # Crashes the serializer due to recursion.
+  'deep-recursion': [SKIP],
+  'string-replace-gc': [SKIP],
+  # Debug check failed:
+  # map == GetReadOnlyRoots(isolate).fixed_array_map() || map == GetReadOnlyRoots(isolate).fixed_cow_array_map().
+  # This means a mismatch of elements kinds / elements on the global object.
+  'es6/block-sloppy-function': [SKIP],
+  'es6/reflect-get-own-property-descriptor': [SKIP],
+  'es6/reflect': [SKIP],
+  'get-own-property-descriptor': [SKIP],
+  'global-properties': [SKIP],
+  'indexed-accessors': [SKIP],
+  'object-freeze-global': [SKIP],
+  'object-seal-global': [SKIP],
+  'regress/regress-1103': [SKIP],
+  'regress/regress-1112': [SKIP],
+  'regress/regress-1120': [SKIP],
+  'regress/regress-2346': [SKIP],
+  'regress/regress-489151': [SKIP],
+  'regress/regress-crbug-1002628': [SKIP],
+  'regress/regress-crbug-454091': [SKIP],
+  'regress/regress-crbug-663750': [SKIP],
+  'regress/regress-freeze-setter': [SKIP],
+  # TODO(v8:10494): asm Code objects can't be flushed and end up in the isolate
+  # serializer.
+  'asm/*': [SKIP],
+  'compiler/regress-439743': [SKIP],
+  'regress/regress-441099': [SKIP],
+  'regress/regress-617526': [SKIP],
+  'regress/regress-6196': [SKIP],
+  'regress/regress-677685': [SKIP],
+  'regress/regress-7893': [SKIP],
+  'regress/regress-799690': [SKIP],
+  'regress/regress-8377': [SKIP],
+  'regress/regress-crbug-1047368': [SKIP],
+  'regress/regress-crbug-898974': [SKIP],
+  'regress/regress-crbug-935800': [SKIP],
+  'regress/regress-crbug-976934': [SKIP],
+  'regress/wasm/*': [SKIP],
+  'wasm/*': [SKIP],
+  # Investigate (IsScript).
+  'harmony/import-from-compilation-errored': [SKIP],
+  'harmony/private-fields-special-object': [SKIP],
+  # Investigate (JSFunction in startup serializer).
+  'regress/regress-1034394': [SKIP],
+  'regress/regress-863810': [SKIP],
+  'regress/regress-crbug-772056': [SKIP],
+  # Investigate (Check failed: buffer.byte_length() <= Smi::kMaxValue)
+  'regress/regress-319722-ArrayBuffer': [SKIP],
+  'regress/regress-599717': [SKIP],
+  'regress/regress-667603': [SKIP],
+  # Investigate (IsFixedArrayBase).
+  'regress/regress-786784': [SKIP],
+  'regress/regress-v8-9656': [SKIP],
+  # Investigate (startup_serializer_->ReferenceMapContains(obj)).
+  'regress/regress-813440': [SKIP],
+  # Investigate (segfault).
+  'regress/regress-crbug-397662': [SKIP],
+}],  # variant == stress_snapshot
+
 ]
diff --git a/deps/v8/test/mjsunit/never-optimize.js b/deps/v8/test/mjsunit/never-optimize.js
index f2b764e16c7..95c8c8650af 100644
--- a/deps/v8/test/mjsunit/never-optimize.js
+++ b/deps/v8/test/mjsunit/never-optimize.js
@@ -25,38 +25,23 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --opt --no-always-opt
+// Flags: --allow-natives-syntax --opt --no-always-opt --no-use-osr
+// Flags: --interrupt-budget=1024
 
-function o1() {
-}
+function o1() { }
 %PrepareFunctionForOptimization(o1);
-
 o1(); o1();
 %OptimizeFunctionOnNextCall(o1);
 o1();
-
-// Check that the given function was optimized.
 assertOptimized(o1);
 
 // Test the %NeverOptimizeFunction runtime call.
+function u1(i) { return i+1 }
+function u2(i) { return i+1 }
 %NeverOptimizeFunction(u1);
-function u1() {
-}
-
-function u2() {
+for (let i = 0; i < 1000; ++i) {
   u1();
+  u2();
 }
-%PrepareFunctionForOptimization(u1);
-%PrepareFunctionForOptimization(u2);
-
-u1(); u1();
-u2(); u2();
-
-%OptimizeFunctionOnNextCall(u1);
-%OptimizeFunctionOnNextCall(u2);
-
-u1(); u1();
-u2(); u2();
-
 assertUnoptimized(u1);
 assertOptimized(u2);
diff --git a/deps/v8/test/mjsunit/class-of-builtins.js b/deps/v8/test/mjsunit/object-tostring-builtins.js
similarity index 95%
rename from deps/v8/test/mjsunit/class-of-builtins.js
rename to deps/v8/test/mjsunit/object-tostring-builtins.js
index 59fefffa758..8717770979a 100644
--- a/deps/v8/test/mjsunit/class-of-builtins.js
+++ b/deps/v8/test/mjsunit/object-tostring-builtins.js
@@ -25,8 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// The [[Class]] property of (instances of) builtin functions must be
-// correctly set.
+// Object.prototype.toString should return the correct values for instances of
+// various built-in classes.
 var funs = {
   Object:   [ Object ],
   Function: [ Function ],
diff --git a/deps/v8/test/mjsunit/regress-crbug-1078825.js b/deps/v8/test/mjsunit/regress-crbug-1078825.js
new file mode 100644
index 00000000000..9381da50a06
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress-crbug-1078825.js
@@ -0,0 +1,20 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --harmony-promise-any
+
+load('test/mjsunit/test-async.js');
+
+(function() {
+  const p1 = Promise.reject(1);
+  const p2 = Promise.resolve(1);
+  Object.defineProperty(p2, "then", {});
+
+  testAsync(assert => {
+    assert.plan(1);
+    Promise.any([p1, p2]).then(
+      assert.unreachable,
+      (e) => { assert.equals(true, e instanceof TypeError); });
+    });
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-10508.js b/deps/v8/test/mjsunit/regress/regress-10508.js
new file mode 100644
index 00000000000..9199336b7f8
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-10508.js
@@ -0,0 +1,15 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Error.prepareStackTrace = (error, frames) => {
+  // JSON.stringify executes the replacer, triggering the relevant
+  // code in Invoke().
+  JSON.stringify({}, frames[0].getFunction());
+};
+let v0;
+try {
+  throw new Error();
+} catch (e) {
+  e.stack
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-1069964.js b/deps/v8/test/mjsunit/regress/regress-1069964.js
new file mode 100644
index 00000000000..0c6000b1bab
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1069964.js
@@ -0,0 +1,8 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Realm.createAllowCrossRealmAccess();
+const c = Realm.global(1);
+Realm.detachGlobal(1);
+try { c.constructor = () => {}; } catch {}
diff --git a/deps/v8/test/mjsunit/regress/regress-1071190.js b/deps/v8/test/mjsunit/regress/regress-1071190.js
new file mode 100644
index 00000000000..7a888442e69
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1071190.js
@@ -0,0 +1,23 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+function test() {
+  const a = new DataView(new ArrayBuffer(32));
+  const b = new DataView(new ArrayBuffer(32));
+  a.setFloat64(0);
+  b.setFloat64(0, undefined);
+
+  for(let i = 0; i < 8; ++i) {
+    assertEquals(a.getUint8(i), b.getUint8(i));
+  }
+}
+
+%PrepareFunctionForOptimization(test);
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
diff --git a/deps/v8/test/mjsunit/regress/regress-1076569.js b/deps/v8/test/mjsunit/regress/regress-1076569.js
new file mode 100644
index 00000000000..a223b600a63
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1076569.js
@@ -0,0 +1,16 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --allow-natives-syntax --turboprop
+
+var array = new Int16Array();
+
+function foo() {
+  array[0] = "123.12";
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-1077804.js b/deps/v8/test/mjsunit/regress/regress-1077804.js
new file mode 100644
index 00000000000..00ae196c33d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1077804.js
@@ -0,0 +1,21 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  return bar();
+}
+
+function bar(a, b) {
+  return a + b;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+%OptimizeFunctionOnNextCall(foo);
+%PrepareFunctionForOptimization(bar);
+%OptimizeFunctionOnNextCall(bar);
+bar(2n, 2n);
+assertTrue(Number.isNaN(foo()));
diff --git a/deps/v8/test/mjsunit/regress/regress-1078913.js b/deps/v8/test/mjsunit/regress/regress-1078913.js
new file mode 100644
index 00000000000..58d083f5472
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1078913.js
@@ -0,0 +1,29 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --interpreted-frames-native-stack
+
+// Make sure that the interpreted trampoline copy (for native interpreter frames
+// in stack traces) works for interperted functions but doesn't crash for asm.js
+
+function func() {
+  return;
+}
+
+function asm_func() {
+  "use asm";
+  function f(){}
+  return {f:f};
+}
+
+function failed_asm_func() {
+  "use asm";
+  // This should fail validation
+  [x,y,z] = [1,2,3];
+  return;
+}
+
+func();
+asm_func();
+failed_asm_func();
diff --git a/deps/v8/test/mjsunit/regress/regress-1079446.js b/deps/v8/test/mjsunit/regress/regress-1079446.js
new file mode 100644
index 00000000000..2322843751a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1079446.js
@@ -0,0 +1,17 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turboprop
+
+arr = new Int16Array();
+function foo() {
+  arr.__defineGetter__('a', function() { });
+  arr[0] = "123.12";
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-1083272.js b/deps/v8/test/mjsunit/regress/regress-1083272.js
new file mode 100644
index 00000000000..0f16db70400
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1083272.js
@@ -0,0 +1,19 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turboprop
+
+function foo(e, t) {
+    for (var n = [e], s = e.length; s > 0; --s) {}
+    for (var s = 0; s < n.length; s++) { t() }
+}
+
+var e = 'abc';
+function t() {};
+
+%PrepareFunctionForOptimization(foo);
+foo(e, t);
+foo(e, t);
+%OptimizeFunctionOnNextCall(foo);
+foo(e, t);
diff --git a/deps/v8/test/mjsunit/regress/regress-1083450.js b/deps/v8/test/mjsunit/regress/regress-1083450.js
new file mode 100644
index 00000000000..120e8f3f737
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1083450.js
@@ -0,0 +1,7 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const source = "(?<=(?=ab)(|)abc)"
+const re = new RegExp(source);
+assertNotNull(re.exec("abc"));
diff --git a/deps/v8/test/mjsunit/regress/regress-1083763.js b/deps/v8/test/mjsunit/regress/regress-1083763.js
new file mode 100644
index 00000000000..e0504c90e28
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1083763.js
@@ -0,0 +1,19 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turboprop
+
+function bar() {}
+
+function foo() {
+  try {
+    bar( "abc".charAt(4));
+  } catch (e) {}
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-1084872.js b/deps/v8/test/mjsunit/regress/regress-1084872.js
new file mode 100644
index 00000000000..61392086104
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1084872.js
@@ -0,0 +1,7 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const re = new RegExp("(?<=(.)\\2.*(T))");
+re.exec(undefined);
+assertEquals(re.exec("bTaLTT")[1], "b");
diff --git a/deps/v8/test/mjsunit/regress/regress-347542.js b/deps/v8/test/mjsunit/regress/regress-1084953.js
similarity index 53%
rename from deps/v8/test/mjsunit/regress/regress-347542.js
rename to deps/v8/test/mjsunit/regress/regress-1084953.js
index 3929a6076ae..57a27d741d9 100644
--- a/deps/v8/test/mjsunit/regress/regress-347542.js
+++ b/deps/v8/test/mjsunit/regress/regress-1084953.js
@@ -1,12 +1,16 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
+// Copyright 2020 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --turboprop
 
-// Flags: --allow-natives-syntax
-
-function foo() {};
+function foo() {
+  try {
+    +Symbol();
+  } catch {
+  }
+}
 %PrepareFunctionForOptimization(foo);
 foo();
 %OptimizeFunctionOnNextCall(foo);
 foo();
-%NeverOptimizeFunction(foo);
diff --git a/deps/v8/test/mjsunit/regress/regress-1086470.js b/deps/v8/test/mjsunit/regress/regress-1086470.js
new file mode 100644
index 00000000000..013d7222b9c
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1086470.js
@@ -0,0 +1,20 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function __f_1( __v_9) {
+  return arguments;
+}
+
+var __v_48 = [];
+var __v_49 = __f_1();
+var __v_50 = 3;
+Object.preventExtensions(__v_49);
+function __f_7(__v_52, __v_53, __v_54) {
+  __v_52[__v_53] =
+  __v_54;
+}
+__v_48.__proto__ = __v_49;
+for (var __v_51 = 0; __v_51 < __v_50; __v_51++) {
+  __f_7(__v_48, __v_51);
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-1365.js b/deps/v8/test/mjsunit/regress/regress-1365.js
index 59290f9ebc7..58efb5715ce 100644
--- a/deps/v8/test/mjsunit/regress/regress-1365.js
+++ b/deps/v8/test/mjsunit/regress/regress-1365.js
@@ -43,7 +43,6 @@ assertEquals(Object.prototype, Object.prototype.valueOf());
 assertThrows(callGlobalValueOf);
 assertThrows(callGlobalHasOwnProperty);
 
-%OptimizeFunctionOnNextCall(Object.prototype.valueOf);
 Object.prototype.valueOf();
 
 assertEquals(Object.prototype, Object.prototype.valueOf());
diff --git a/deps/v8/test/mjsunit/regress/regress-447756.js b/deps/v8/test/mjsunit/regress/regress-447756.js
index 1fc7518c130..55fd2bd0fc4 100644
--- a/deps/v8/test/mjsunit/regress/regress-447756.js
+++ b/deps/v8/test/mjsunit/regress/regress-447756.js
@@ -42,7 +42,8 @@ function TestOptimizedCode() {
   assertSame(Infinity, 1 / a1.byteOffset);
 }
 
-%OptimizeFunctionOnNextCall(Uint8Array);
-for (var i = 0; i < 1000; i++) {
-  TestOptimizedCode();
-}
+%PrepareFunctionForOptimization(TestOptimizedCode);
+TestOptimizedCode();
+TestOptimizedCode();
+%OptimizeFunctionOnNextCall(TestOptimizedCode);
+TestOptimizedCode();
diff --git a/deps/v8/test/mjsunit/regress/regress-491481.js b/deps/v8/test/mjsunit/regress/regress-491481.js
deleted file mode 100644
index 196b6aeb79f..00000000000
--- a/deps/v8/test/mjsunit/regress/regress-491481.js
+++ /dev/null
@@ -1,15 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax
-
-try {
-%OptimizeFunctionOnNextCall(print);
-try {
-  __f_16();
-} catch(e) { print(e); }
-try {
-  __f_10();
-} catch(e) {; }
-} catch(e) {}
diff --git a/deps/v8/test/mjsunit/regress/regress-5660.js b/deps/v8/test/mjsunit/regress/regress-5660.js
new file mode 100644
index 00000000000..db085e27173
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5660.js
@@ -0,0 +1,41 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --allow-natives-syntax
+
+(function() {
+  function test(a, b) {
+    return a === b;
+  }
+
+  %PrepareFunctionForOptimization(test);
+  assertTrue(test(undefined, undefined));
+  assertTrue(test(undefined, undefined));
+  %OptimizeFunctionOnNextCall(test);
+  assertTrue(test(undefined, undefined));
+})();
+
+(function() {
+  function test(a, b) {
+    return a === b;
+  }
+
+  %PrepareFunctionForOptimization(test);
+  assertTrue(test(true, true));
+  assertTrue(test(true, true));
+  %OptimizeFunctionOnNextCall(test);
+  assertFalse(test(true, 1));
+})();
+
+(function() {
+  function test(a, b) {
+      return a == b;
+  }
+
+  %PrepareFunctionForOptimization(test);
+  assertTrue(test(true, true));
+  assertTrue(test(true, true));
+  %OptimizeFunctionOnNextCall(test);
+  assertTrue(test(true, 1));
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-9441.js b/deps/v8/test/mjsunit/regress/regress-9441.js
new file mode 100644
index 00000000000..d2fb17a239d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-9441.js
@@ -0,0 +1,23 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+function foo(a, b) {
+    return a - b;
+}
+
+%PrepareFunctionForOptimization(foo);
+assertEquals(-1n, foo(1n, 2n));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1n, foo(2n, 1n));
+assertOptimized(foo);
+assertThrows(() => foo(2n, undefined));
+assertUnoptimized(foo);
+%PrepareFunctionForOptimization(foo);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(-1n, foo(1n, 2n));
+assertOptimized(foo);
+assertThrows(() => foo(undefined, 2n));
+assertOptimized(foo);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1053939-1.js b/deps/v8/test/mjsunit/regress/regress-crbug-1053939-1.js
new file mode 100644
index 00000000000..e7657882bcd
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1053939-1.js
@@ -0,0 +1,16 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-lazy-feedback-allocation
+
+
+v = {};
+v.__proto__ = new Int32Array(1);
+function foo() {
+  for (var i = 0; i < 2; i++) {
+    v[i] = 0;
+  }
+}
+foo();
+assertEquals(Object.keys(v).length, 1);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1055138-1.js b/deps/v8/test/mjsunit/regress/regress-crbug-1055138-1.js
new file mode 100644
index 00000000000..039cf83c8f4
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1055138-1.js
@@ -0,0 +1,64 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Object.prototype[1] = 153;
+Object.freeze(Object.prototype);
+
+(function TestSloppyStoreToReadOnlyProperty() {
+  function foo() {
+    let ar = [];
+    for (let i = 0; i < 3; i++) {
+      ar[i] = 42;
+
+      if (i == 1) {
+        // Attempt to overwrite read-only element should not change
+        // array length.
+        assertEquals(1, ar.length);
+      } else {
+        assertEquals(i + 1, ar.length);
+      }
+    }
+    return ar;
+  }
+
+  assertEquals([42,153,42], foo());
+  assertEquals([42,153,42], foo());
+  assertEquals([42,153,42], foo());
+  %PrepareFunctionForOptimization(foo);
+  assertEquals([42,153,42], foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals([42,153,42], foo());
+})();
+
+(function StrictStoreToReadOnlyProperty() {
+  function foo() {
+    "use strict";
+    let ar = [];
+    let threw_exception = false;
+    for (let i = 0; i < 3; i++) {
+      try {
+        ar[i] = 42;
+      } catch(e) {
+        // Attempt to overwrite read-only element should throw and
+        // should not change array length.
+        assertTrue(i == 1);
+        assertEquals(1, ar.length);
+        assertInstanceof(e, TypeError);
+        threw_exception = true;
+      }
+    }
+    assertTrue(threw_exception);
+    return ar;
+  }
+
+  assertEquals([42,153,42], foo());
+  assertEquals([42,153,42], foo());
+  assertEquals([42,153,42], foo());
+  %PrepareFunctionForOptimization(foo);
+  assertEquals([42,153,42], foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals([42,153,42], foo());
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1055138-2.js b/deps/v8/test/mjsunit/regress/regress-crbug-1055138-2.js
new file mode 100644
index 00000000000..33dbcf85205
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1055138-2.js
@@ -0,0 +1,34 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.prototype[1] = 153;
+
+(function TestSloppyStoreToReadOnlyProperty() {
+  function foo(prototype_frozen) {
+    let ar = [];
+    for (let i = 0; i < 3; i++) {
+      ar[i] = 42;
+
+      if (prototype_frozen) {
+        if (i == 1) {
+          // Attempt to overwrite read-only element should not change
+          // array length.
+          assertEquals(1, ar.length);
+        } else {
+          assertEquals(i + 1, ar.length);
+        }
+      }
+    }
+    return ar;
+  }
+
+  // Warm-up store IC.
+  assertEquals([42,42,42], foo(false));
+  assertEquals([42,42,42], foo(false));
+  assertEquals([42,42,42], foo(false));
+  assertEquals([42,42,42], foo(false));
+  Object.freeze(Object.prototype);
+  // Ensure IC was properly invalidated.
+  assertEquals([42,153,42], foo(true));
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1055138-3.js b/deps/v8/test/mjsunit/regress/regress-crbug-1055138-3.js
new file mode 100644
index 00000000000..bf08cdc9fd9
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1055138-3.js
@@ -0,0 +1,40 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.prototype[1] = 153;
+
+(function StrictStoreToReadOnlyProperty() {
+  function foo(prototype_frozen) {
+    "use strict";
+    let ar = [];
+    let threw_exception = false;
+    for (let i = 0; i < 3; i++) {
+      try {
+        ar[i] = 42;
+      } catch(e) {
+        if (prototype_frozen) {
+          // Attempt to overwrite read-only element should throw and
+          // should not change array length.
+          assertTrue(i == 1);
+          assertEquals(1, ar.length);
+          assertInstanceof(e, TypeError);
+          threw_exception = true;
+        }
+      }
+    }
+    if (prototype_frozen) {
+      assertTrue(threw_exception);
+    }
+    return ar;
+  }
+
+  // Warm-up store IC.
+  assertEquals([42,42,42], foo(false));
+  assertEquals([42,42,42], foo(false));
+  assertEquals([42,42,42], foo(false));
+  assertEquals([42,42,42], foo(false));
+  Object.freeze(Object.prototype);
+  // Ensure IC was properly invalidated.
+  assertEquals([42,153,42], foo());
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1060023.js b/deps/v8/test/mjsunit/regress/regress-crbug-1060023.js
new file mode 100644
index 00000000000..ca666130bbf
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1060023.js
@@ -0,0 +1,10 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class b extends RegExp {
+  exec() {
+    (function() { (a = (function({} = this) {})) => {} })
+  }
+}
+assertThrows(()=>'a'.match(new b), TypeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1063796.js b/deps/v8/test/mjsunit/regress/regress-crbug-1063796.js
new file mode 100644
index 00000000000..b86ceed155f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1063796.js
@@ -0,0 +1,15 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Object.prototype[1] = 1;
+function foo(baz) {
+  return 1 in arguments;
+}
+assertTrue(foo(0));
+%PrepareFunctionForOptimization(foo);
+assertTrue(foo(0));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(0));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1065741.js b/deps/v8/test/mjsunit/regress/regress-crbug-1065741.js
new file mode 100644
index 00000000000..bf97370d934
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1065741.js
@@ -0,0 +1,19 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function bar() {
+  String.prototype.startsWith.apply();
+}
+
+%PrepareFunctionForOptimization(bar);
+assertThrows(bar, TypeError);
+assertThrows(bar, TypeError);
+%OptimizeFunctionOnNextCall(bar);
+assertThrows(bar, TypeError);
+%PrepareFunctionForOptimization(bar);
+%OptimizeFunctionOnNextCall(bar);
+assertThrows(bar, TypeError);
+assertOptimized(bar);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1067757.js b/deps/v8/test/mjsunit/regress/regress-crbug-1067757.js
new file mode 100644
index 00000000000..feba5c1e68b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1067757.js
@@ -0,0 +1,30 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-lazy-feedback-allocation
+
+"use strict";
+
+function foo() {
+  let count = 0;
+  try {
+    for (p of v) {
+      count += 1;
+    }
+  } catch (e) { }
+  assertEquals(count, 0);
+}
+
+var v = [ "0", {}];
+
+foo();
+Reflect.deleteProperty(v, '0');
+
+let count_loop = 0;
+try {
+ for (p of v) { count_loop += 1; }
+} catch (e) {}
+assertEquals(count_loop, 0);
+
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1069530.js b/deps/v8/test/mjsunit/regress/regress-crbug-1069530.js
new file mode 100644
index 00000000000..1fca911f3bb
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1069530.js
@@ -0,0 +1,29 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-lazy-feedback-allocation
+
+function store(ar, index) {
+  ar[index] = "a";
+}
+
+let growable_array = [];
+
+// Train IC on growable array
+store(growable_array, 0);
+store(growable_array, 1);
+store(growable_array, 2);
+store(growable_array, 3);
+
+// Now make IC polymorphic
+var array = [];
+Object.defineProperty(array, "length", { value: 3, writable: false });
+
+store(array, 0);
+store(array, 1);
+
+// ... and try to grow it.
+store(array, 3);
+assertEquals(undefined, array[3]);
+assertEquals(3, array.length);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1070560.js b/deps/v8/test/mjsunit/regress/regress-crbug-1070560.js
new file mode 100644
index 00000000000..c94d5f5b939
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1070560.js
@@ -0,0 +1,16 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+ // Create a FixedDoubleArray
+ var arr = [5.65];
+ // Force the elements to be EmptyFixedArray
+ arr.splice(0);
+ // This should create a FixedDoubleArray initialized with holes.
+ arr.splice(-4, 9, 10, 20);
+ // If the earlier spice didn't create a holes this would fail.
+ assertFalse(2 in arr);
+}
+
+f();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1074737.js b/deps/v8/test/mjsunit/regress/regress-crbug-1074737.js
new file mode 100644
index 00000000000..a644f87c671
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1074737.js
@@ -0,0 +1,40 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+try {
+  throw 42
+} catch (e) {
+  function foo() { return e };
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+  var e = "expected";
+}
+assertEquals("expected", foo());
+
+try {
+  throw 42
+} catch (f) {
+  function foo2() { return f };
+  %PrepareFunctionForOptimization(foo2);
+  %OptimizeFunctionOnNextCall(foo2);
+  foo2();
+  with ({}) {
+    var f = "expected";
+  }
+}
+assertEquals("expected", foo2());
+
+(function () {
+  function foo3() { return g };
+  %PrepareFunctionForOptimization(foo3);
+  %OptimizeFunctionOnNextCall(foo3);
+  foo3();
+  with ({}) {
+    var g = "expected";
+  }
+  assertEquals("expected", foo3());
+})()
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1077508.js b/deps/v8/test/mjsunit/regress/regress-crbug-1077508.js
new file mode 100644
index 00000000000..73bc5a69108
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1077508.js
@@ -0,0 +1,14 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const array = [, , , 0, 1, 2];
+const comparefn = () => {
+  Array.prototype.__defineSetter__("0", function () {});
+  Array.prototype.__defineSetter__("1", function () {});
+  Array.prototype.__defineSetter__("2", function () {});
+};
+
+array.sort(comparefn);
+
+assertArrayEquals([, , , , , , ], array);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-754177.js b/deps/v8/test/mjsunit/regress/regress-crbug-754177.js
index 1c105a3bf2c..74685366d4b 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-754177.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-754177.js
@@ -2,11 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax  --fuzzing
 
-// Do not crash on non-JSFunction input.
+// Do not crash on non-JSFunction input when fuzzing.
 %NeverOptimizeFunction(undefined);
 %NeverOptimizeFunction(true);
 %NeverOptimizeFunction(1);
 %NeverOptimizeFunction({});
 assertThrows("%NeverOptimizeFunction()", SyntaxError);
+
+%PrepareFunctionForOptimization(print);
+%OptimizeFunctionOnNextCall(print);
diff --git a/deps/v8/test/mjsunit/regress/regress-v8-10484-1.js b/deps/v8/test/mjsunit/regress/regress-v8-10484-1.js
new file mode 100644
index 00000000000..61dd2929f34
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-v8-10484-1.js
@@ -0,0 +1,18 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var ar;
+Object.defineProperty(Array.prototype, 3,
+    { get() { Object.freeze(ar); } });
+
+function foo() {
+  ar = [1, 2, 3];
+  ar.length = 4;
+  ar.pop();
+}
+
+assertThrows(foo, TypeError);
+assertThrows(foo, TypeError);
+assertThrows(foo, TypeError);
+assertThrows(foo, TypeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-v8-10484-2.js b/deps/v8/test/mjsunit/regress/regress-v8-10484-2.js
new file mode 100644
index 00000000000..c2030e82dbf
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-v8-10484-2.js
@@ -0,0 +1,24 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var ar;
+Object.defineProperty(Array.prototype, 3,
+    {
+      get() {
+        Object.defineProperty(
+            ar, "length",
+            { value: 3, writable: false, configurable: false });
+      }
+    });
+
+function foo() {
+  ar = [1, 2, 3];
+  ar.length = 4;
+  ar.pop();
+}
+
+assertThrows(foo, TypeError);
+assertThrows(foo, TypeError);
+assertThrows(foo, TypeError);
+assertThrows(foo, TypeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-v8-10513.js b/deps/v8/test/mjsunit/regress/regress-v8-10513.js
new file mode 100644
index 00000000000..e9b91f5b4d6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-v8-10513.js
@@ -0,0 +1,25 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const access_log = [];
+const handler = {
+  get: function(obj, prop) {
+    access_log.push(prop);
+    return prop in obj ? obj[prop] : "z";
+  }
+};
+
+class ProxiedGroupRegExp extends RegExp {
+  exec(s) {
+    var result = super.exec(s);
+    if (result) {
+      result.groups = new Proxy(result.groups, handler);
+    }
+    return result;
+  }
+}
+
+let re = new ProxiedGroupRegExp("(?<x>.)");
+assertEquals("a z", "a".replace(re, "$<x> $<y>"));
+assertEquals(["x", "y"], access_log);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-10309.js b/deps/v8/test/mjsunit/regress/wasm/regress-10309.js
index ce73b783efe..904ea73acab 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-10309.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-10309.js
@@ -46,7 +46,7 @@ function assert_return(action, expected) {
 let f32 = Math.fround;
 
 // simple.wast:1
-let $1 = instance("\x00\x61\x73\x6d\x01\x00\x00\x00\x01\x09\x02\x60\x00\x00\x60\x01\x7f\x01\x7d\x03\x04\x03\x00\x00\x01\x05\x03\x01\x00\x01\x07\x1c\x02\x11\x72\x65\x70\x6c\x61\x63\x65\x5f\x6c\x61\x6e\x65\x5f\x74\x65\x73\x74\x00\x01\x04\x72\x65\x61\x64\x00\x02\x08\x01\x00\x0a\x6e\x03\x2a\x00\x41\x10\x43\x00\x00\x80\x3f\x38\x02\x00\x41\x14\x43\x00\x00\x00\x40\x38\x02\x00\x41\x18\x43\x00\x00\x40\x40\x38\x02\x00\x41\x1c\x43\x00\x00\x80\x40\x38\x02\x00\x0b\x39\x01\x01\x7b\x41\x10\x2a\x02\x00\xfd\x12\x21\x00\x20\x00\x41\x10\x2a\x01\x04\xfd\x14\x01\x21\x00\x20\x00\x41\x10\x2a\x01\x08\xfd\x14\x02\x21\x00\x20\x00\x41\x10\x2a\x01\x0c\xfd\x14\x03\x21\x00\x41\x00\x20\x00\xfd\x01\x02\x00\x0b\x07\x00\x20\x00\x2a\x02\x00\x0b");
+let $1 = instance("\x00\x61\x73\x6d\x01\x00\x00\x00\x01\x09\x02\x60\x00\x00\x60\x01\x7f\x01\x7d\x03\x04\x03\x00\x00\x01\x05\x03\x01\x00\x01\x07\x1c\x02\x11\x72\x65\x70\x6c\x61\x63\x65\x5f\x6c\x61\x6e\x65\x5f\x74\x65\x73\x74\x00\x01\x04\x72\x65\x61\x64\x00\x02\x08\x01\x00\x0a\x6e\x03\x2a\x00\x41\x10\x43\x00\x00\x80\x3f\x38\x02\x00\x41\x14\x43\x00\x00\x00\x40\x38\x02\x00\x41\x18\x43\x00\x00\x40\x40\x38\x02\x00\x41\x1c\x43\x00\x00\x80\x40\x38\x02\x00\x0b\x39\x01\x01\x7b\x41\x10\x2a\x02\x00\xfd\x13\x21\x00\x20\x00\x41\x10\x2a\x01\x04\xfd\x20\x01\x21\x00\x20\x00\x41\x10\x2a\x01\x08\xfd\x20\x02\x21\x00\x20\x00\x41\x10\x2a\x01\x0c\xfd\x20\x03\x21\x00\x41\x00\x20\x00\xfd\x0b\x02\x00\x0b\x07\x00\x20\x00\x2a\x02\x00\x0b");
 
 // simple.wast:49
 call($1, "replace_lane_test", []);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1054466.js b/deps/v8/test/mjsunit/regress/wasm/regress-1054466.js
index 85ee43732be..41b8ee2335b 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-1054466.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1054466.js
@@ -42,9 +42,9 @@ kExprF32Max,  // f32.max
 kSimdPrefix, kExprF32x4Splat,  // f32x4.splat
 kExprI32Const, 0x83, 0x01,  // i32.const
 kSimdPrefix, kExprI32x4Splat,  // i32x4.splat
-kSimdPrefix, kExprI32x4Add,  // i32x4.add
-kSimdPrefix, kExprI32x4Add,  // i32x4.add
-kSimdPrefix, kExprS1x8AnyTrue,  // s1x8.any_true
+kSimdPrefix, kExprI32x4Eq,  // i32x4.eq
+kSimdPrefix, kExprI32x4Eq,  // i32x4.eq
+kSimdPrefix, kExprV8x16AnyTrue,  // v8x16.any_true
 kExprEnd,  // end @64
 ]);
 builder.addExport('main', 0);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1055692.js b/deps/v8/test/mjsunit/regress/wasm/regress-1055692.js
deleted file mode 100644
index a16180ab5cb..00000000000
--- a/deps/v8/test/mjsunit/regress/wasm/regress-1055692.js
+++ /dev/null
@@ -1,35 +0,0 @@
-// Copyright 2020 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --wasm-staging --wasm-interpret-all --experimental-wasm-simd
-
-load('test/mjsunit/wasm/wasm-module-builder.js');
-
-const builder = new WasmModuleBuilder();
-builder.addMemory(16, 32, false);
-builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
-// Generate function 1 (out of 1).
-builder.addFunction(undefined, 0 /* sig */)
-  .addBodyWithEnd([
-// signature: i_iii
-// body:
-kExprI32Const, 0x75,  // i32.const
-kExprI32Const, 0x74,  // i32.const
-kExprI32Const, 0x18,  // i32.const
-kSimdPrefix, kExprS8x16LoadSplat,  // s8x16.load_splat
-kExprUnreachable,  // unreachable
-kExprUnreachable,  // unreachable
-kExprI32Const, 0x6f,  // i32.const
-kExprI32Const, 0x7f,  // i32.const
-kExprI32Const, 0x6f,  // i32.const
-kExprDrop,
-kExprDrop,
-kExprDrop,
-kExprDrop,
-kExprDrop,
-kExprEnd,  // end @18
-]);
-builder.addExport('main', 0);
-const instance = builder.instantiate();
-print(instance.exports.main(1, 2, 3));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1065599.js b/deps/v8/test/mjsunit/regress/wasm/regress-1065599.js
new file mode 100644
index 00000000000..85057104cc0
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1065599.js
@@ -0,0 +1,27 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-simd
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false);
+builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
+// Generate function 1 (out of 1).
+builder.addFunction(undefined, 0 /* sig */).addBodyWithEnd([
+  // signature: i_iii
+  // body:
+  kExprI32Const, 0xba, 0x01,       // i32.const
+  kSimdPrefix, kExprI16x8Splat,    // i16x8.splat
+  kExprMemorySize, 0x00,           // memory.size
+  kSimdPrefix, kExprI16x8ShrS,     // i16x8.shr_s
+  kSimdPrefix, kExprV8x16AnyTrue,  // v8x16.any_true
+  kExprMemorySize, 0x00,           // memory.size
+  kExprI32RemS,                    // i32.rem_s
+  kExprEnd,                        // end @15
+]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+instance.exports.main(1, 2, 3);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1065635.js b/deps/v8/test/mjsunit/regress/wasm/regress-1065635.js
new file mode 100644
index 00000000000..a4f82e8650a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1065635.js
@@ -0,0 +1,13 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo() {
+  'use asm';
+  function bar() {
+    return -1e-15;
+  }
+  return {bar: bar};
+}
+
+assertEquals(-1e-15, foo().bar());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1065852.js b/deps/v8/test/mjsunit/regress/wasm/regress-1065852.js
new file mode 100644
index 00000000000..24463e06887
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1065852.js
@@ -0,0 +1,14 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function* asm() {
+  "use asm";
+  function x(v) {
+    v = v | 0;
+  }
+  return x;
+}
+
+// 'function*' creates a generator with an implicit 'next' method.
+asm().next();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1067621.js b/deps/v8/test/mjsunit/regress/wasm/regress-1067621.js
new file mode 100644
index 00000000000..e75b0156f4a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1067621.js
@@ -0,0 +1,82 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-threads
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const kNumberOfWorker = 4;
+
+const workerOnMessage = function(msg) {
+  if (msg.module) {
+    let module = msg.module;
+    let mem = msg.mem;
+    this.instance = new WebAssembly.Instance(module, {m: {memory: mem}});
+    postMessage({instantiated: true});
+  } else {
+    const kNumberOfRuns = 20;
+    let result = new Array(kNumberOfRuns);
+    for (let i = 0; i < kNumberOfRuns; ++i) {
+      result[i] = instance.exports.grow();
+    }
+    postMessage({result: result});
+  }
+};
+
+function spawnWorkers() {
+  let workers = [];
+  for (let i = 0; i < kNumberOfWorker; i++) {
+    let worker = new Worker(
+        'onmessage = ' + workerOnMessage.toString(), {type: 'string'});
+    workers.push(worker);
+  }
+  return workers;
+}
+
+function instantiateModuleInWorkers(workers, module, shared_memory) {
+  for (let worker of workers) {
+    worker.postMessage({module: module, mem: shared_memory});
+    let msg = worker.getMessage();
+    if (!msg.instantiated) throw 'Worker failed to instantiate';
+  }
+}
+
+function triggerWorkers(workers) {
+  for (i = 0; i < workers.length; i++) {
+    let worker = workers[i];
+    worker.postMessage({});
+  }
+}
+
+(function TestConcurrentGrowMemoryResult() {
+  let builder = new WasmModuleBuilder();
+  builder.addImportedMemory('m', 'memory', 1, 500, 'shared');
+  builder.addFunction('grow', kSig_i_v)
+      .addBody([kExprI32Const, 1, kExprMemoryGrow, kMemoryZero])
+      .exportFunc();
+
+  const module = builder.toModule();
+  const shared_memory =
+      new WebAssembly.Memory({initial: 1, maximum: 500, shared: true});
+
+  // Spawn off the workers and run the sequences.
+  let workers = spawnWorkers();
+  instantiateModuleInWorkers(workers, module, shared_memory);
+  triggerWorkers(workers);
+  let all_results = [];
+  for (let worker of workers) {
+    let msg = worker.getMessage();
+    all_results = all_results.concat(msg.result);
+  }
+
+  all_results.sort((a, b) => a - b);
+  for (let i = 1; i < all_results.length; ++i) {
+    assertEquals(all_results[i - 1] + 1, all_results[i]);
+  }
+
+  // Terminate all workers.
+  for (let worker of workers) {
+    worker.terminate();
+  }
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1070078.js b/deps/v8/test/mjsunit/regress/wasm/regress-1070078.js
new file mode 100644
index 00000000000..8df2e35e65d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1070078.js
@@ -0,0 +1,39 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-simd
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false);
+builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
+// Generate function 1 (out of 4).
+builder.addFunction(undefined, 0 /* sig */).addBodyWithEnd([
+  // signature: i_iii
+  // body:
+  kExprI32Const, 0x00,  // i32.const
+  kExprMemoryGrow, 0x00,  // memory.grow
+  kExprI32Const, 0xd3, 0xe7, 0x03,  // i32.const
+  kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+  kExprI32Const, 0x84, 0x80, 0xc0, 0x05,  // i32.const
+  kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+  kExprI32Const, 0x84, 0x81, 0x80, 0xc8, 0x01,  // i32.const
+  kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+  kExprI32Const, 0x19,  // i32.const
+  kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+  kSimdPrefix, kExprS8x16Shuffle,
+  0x00, 0x00, 0x17, 0x00, 0x04, 0x04, 0x04, 0x04,
+  0x04, 0x10, 0x01, 0x00, 0x04, 0x04, 0x04, 0x04,  // s8x16.shuffle
+  kSimdPrefix, kExprS8x16Shuffle,
+  0x04, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  // s8x16.shuffle
+  kSimdPrefix, kExprI8x16LeU,  // i8x16.le_u
+  kSimdPrefix, kExprV8x16AnyTrue,  // v8x16.any_true
+  kExprMemoryGrow, 0x00,  // memory.grow
+  kExprDrop,
+  kExprEnd,  // end @233
+]);
+builder.addExport('main', 0);
+builder.instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1073553.js b/deps/v8/test/mjsunit/regress/wasm/regress-1073553.js
new file mode 100644
index 00000000000..78ea8c26872
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1073553.js
@@ -0,0 +1,14 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(1);
+builder.addFunction(undefined, kSig_v_i) .addBodyWithEnd([
+    kExprI32Const, 1, kExprMemoryGrow, kMemoryZero, kNumericPrefix]);
+// Intentionally add just a numeric opcode prefix without the index byte.
+
+const b = builder.toBuffer();
+WebAssembly.compile(b);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1074586-b.js b/deps/v8/test/mjsunit/regress/wasm/regress-1074586-b.js
new file mode 100644
index 00000000000..fbadeb08599
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1074586-b.js
@@ -0,0 +1,23 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// // Use of this source code is governed by a BSD-style license that can be
+// // found in the LICENSE file.
+
+// Flags: --wasm-staging
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false, true);
+const sig = builder.addType(makeSig(
+    [kWasmI32, kWasmI32, kWasmI32, kWasmI32, kWasmI32, kWasmI32, kWasmI32],
+    []));
+builder.addFunction(undefined, sig).addBodyWithEnd([
+  // signature: v_iiiiifidi
+  // body:
+  kExprI32Const, 0x00,                             // i32.const
+  kExprI64Const, 0x00,                             // i64.const
+  kAtomicPrefix, kExprI64AtomicStore, 0x00, 0x00,  // i64.atomic.store64
+  kExprEnd,                                        // end @9
+]);
+builder.addExport('main', 0);
+assertDoesNotThrow(() => builder.instantiate());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1074586.js b/deps/v8/test/mjsunit/regress/wasm/regress-1074586.js
new file mode 100644
index 00000000000..ae25e3c2615
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1074586.js
@@ -0,0 +1,94 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-staging
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(1, 1, false, true);
+builder.addGlobal(kWasmI32, 1);
+const sig = builder.addType(makeSig([kWasmI32, kWasmI64, kWasmI64, kWasmI64], [kWasmF32]));
+// Generate function 1 (out of 3).
+builder.addFunction(undefined, sig)
+  .addLocals({i32_count: 57}).addLocals({i64_count: 11})
+  .addBodyWithEnd([
+// signature: f_illl
+// body:
+kExprLocalGet, 0x1b,  // local.get
+kExprLocalSet, 0x1c,  // local.set
+kExprI32Const, 0x00,  // i32.const
+kExprIf, kWasmStmt,  // if @11
+  kExprGlobalGet, 0x00,  // global.get
+  kExprLocalSet, 0x1e,  // local.set
+  kExprBlock, kWasmStmt,  // block @19
+    kExprGlobalGet, 0x00,  // global.get
+    kExprLocalSet, 0x21,  // local.set
+    kExprBlock, kWasmStmt,  // block @25
+      kExprBlock, kWasmStmt,  // block @27
+        kExprBlock, kWasmStmt,  // block @29
+          kExprGlobalGet, 0x00,  // global.get
+          kExprLocalSet, 0x0a,  // local.set
+          kExprI32Const, 0x00,  // i32.const
+          kExprLocalSet, 0x28,  // local.set
+          kExprLocalGet, 0x00,  // local.get
+          kExprLocalSet, 0x0b,  // local.set
+          kExprI32Const, 0x00,  // i32.const
+          kExprBrIf, 0x01,  // br_if depth=1
+          kExprEnd,  // end @47
+        kExprUnreachable,  // unreachable
+        kExprEnd,  // end @49
+      kExprI32Const, 0x01,  // i32.const
+      kExprLocalSet, 0x36,  // local.set
+      kExprI32Const, 0x00,  // i32.const
+      kExprIf, kWasmStmt,  // if @56
+        kExprEnd,  // end @59
+      kExprLocalGet, 0x00,  // local.get
+      kExprLocalSet, 0x10,  // local.set
+      kExprI32Const, 0x00,  // i32.const
+      kExprI32Eqz,  // i32.eqz
+      kExprLocalSet, 0x38,  // local.set
+      kExprBlock, kWasmStmt,  // block @69
+        kExprI32Const, 0x7f,  // i32.const
+        kExprI32Eqz,  // i32.eqz
+        kExprLocalSet, 0x39,  // local.set
+        kExprI32Const, 0x01,  // i32.const
+        kExprIf, kWasmStmt,  // if @78
+          kExprGlobalGet, 0x00,  // global.get
+          kExprLocalSet, 0x11,  // local.set
+          kExprI32Const, 0x00,  // i32.const
+          kExprI32Eqz,  // i32.eqz
+          kExprLocalSet, 0x12,  // local.set
+          kExprGlobalGet, 0x00,  // global.get
+          kExprLocalSet, 0x13,  // local.set
+          kExprI32Const, 0x00,  // i32.const
+          kExprI32Const, 0x01,  // i32.const
+          kExprI32Sub,  // i32.sub
+          kExprLocalSet, 0x3a,  // local.set
+          kExprI32Const, 0x00,  // i32.const
+          kAtomicPrefix, kExprI64AtomicLoad16U, 0x01, 0x04,  // i64.atomic.load16_u
+          kExprDrop,  // drop
+          kExprI64Const, 0x01,  // i64.const
+          kExprLocalSet, 0x44,  // local.set
+          kExprI64Const, 0x01,  // i64.const
+          kExprLocalSet, 0x3e,  // local.set
+        kExprElse,  // else @115
+          kExprNop,  // nop
+          kExprEnd,  // end @117
+        kExprLocalGet, 0x40,  // local.get
+        kExprLocalSet, 0x41,  // local.set
+        kExprLocalGet, 0x41,  // local.get
+        kExprI64Const, 0x4b,  // i64.const
+        kExprI64Add,  // i64.add
+        kExprDrop,  // drop
+        kExprEnd,  // end @128
+      kExprEnd,  // end @129
+    kExprUnreachable,  // unreachable
+    kExprEnd,  // end @132
+  kExprUnreachable,  // unreachable
+  kExprEnd,  // end @134
+kExprF32Const, 0x00, 0x00, 0x84, 0x42,  // f32.const
+kExprEnd,  // end @140
+]);
+const instance = builder.instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1075953.js b/deps/v8/test/mjsunit/regress/wasm/regress-1075953.js
new file mode 100644
index 00000000000..12f8ba661a5
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1075953.js
@@ -0,0 +1,38 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-staging
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(1, 1, false, true);
+const sig = builder.addType(makeSig([], [kWasmI32]));
+
+builder.addFunction(undefined, sig)
+  .addLocals({i32_count: 1002}).addLocals({i64_count: 3})
+  .addBodyWithEnd([
+// signature: i_v
+// body:
+  kExprLocalGet, 0xec, 0x07,  // local.get
+  kExprLocalGet, 0xea, 0x07,  // local.set
+  kExprLocalGet, 0x17,  // local.set
+  kExprLocalGet, 0xb5, 0x01,  // local.set
+  kExprI32Const, 0x00,  // i32.const
+  kExprIf, kWasmI32,  // if @39 i32
+    kExprI32Const, 0x91, 0xe8, 0x7e,  // i32.const
+  kExprElse,  // else @45
+    kExprI32Const, 0x00,  // i32.const
+    kExprEnd,  // end @48
+  kExprIf, kWasmStmt,  // if @49
+    kExprI32Const, 0x00,  // i32.const
+    kExprI32Const, 0x00,  // i32.const
+    kAtomicPrefix, kExprI32AtomicSub, 0x01, 0x04,  // i32.atomic.sub
+    kExprDrop,
+  kExprEnd,
+  kExprUnreachable,
+kExprEnd
+]);
+
+const instance = builder.instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1079449.js b/deps/v8/test/mjsunit/regress/wasm/regress-1079449.js
new file mode 100644
index 00000000000..65e964552d6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1079449.js
@@ -0,0 +1,37 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-staging
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false, true);
+const sig = builder.addType(makeSig(
+    [
+      kWasmI64, kWasmI32, kWasmI64, kWasmI32, kWasmI32, kWasmI32, kWasmI32,
+      kWasmI32, kWasmI32, kWasmI64, kWasmI64, kWasmI64
+    ],
+    [kWasmI64]));
+// Generate function 2 (out of 3).
+builder.addFunction(undefined, sig)
+    .addLocals({f32_count: 10})
+    .addLocals({i32_count: 4})
+    .addLocals({f64_count: 1})
+    .addLocals({i32_count: 15})
+    .addBodyWithEnd([
+      // signature: v_liliiiiiilll
+      // body:
+      kExprI32Const, 0x00,  // i32.const
+      kExprI64Const, 0x00,  // i64.const
+      kExprI64Const, 0x00,  // i64.const
+      kAtomicPrefix, kExprI64AtomicCompareExchange, 0x00,
+      0x8,      // i64.atomic.cmpxchng64
+      kExprEnd,  // end @124
+    ]);
+
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(
+    0n, instance.exports.main(1n, 2, 3n, 4, 5, 6, 7, 8, 9, 10n, 11n, 12n, 13n));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1081030.js b/deps/v8/test/mjsunit/regress/wasm/regress-1081030.js
new file mode 100644
index 00000000000..7430c62128f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1081030.js
@@ -0,0 +1,25 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-simd
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
+// Generate function 1 (out of 1).
+builder.addFunction(undefined, 0 /* sig */).addBodyWithEnd([
+  // signature: i_iii
+  // body:
+  kExprF32Const, 0xf8, 0xf8, 0xf8, 0xf8,
+  kSimdPrefix, kExprF32x4Splat,         // f32x4.splat
+  kExprF32Const, 0xf8, 0xf8, 0xf8, 0xf8,
+  kSimdPrefix, kExprF32x4Splat,         // f32x4.splat
+  kSimdPrefix, kExprF32x4Min, 0x01,     // f32x4.min
+  kSimdPrefix, kExprV32x4AnyTrue, 0x01,  // i32x4.any_true
+  kExprEnd,                             // end @16
+]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(1, instance.exports.main(1, 2, 3));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1084151.js b/deps/v8/test/mjsunit/regress/wasm/regress-1084151.js
new file mode 100644
index 00000000000..ed7a5aa2ab3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1084151.js
@@ -0,0 +1,31 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-mv
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+let builder = new WasmModuleBuilder();
+let sig_i_iii = builder.addType(kSig_i_iii);
+
+builder.addFunction("main", sig_i_iii)
+  .addBody([
+    kExprLocalGet, 1,
+    kExprLocalGet, 1,
+    kExprI32Const, 5,
+    kExprLoop, sig_i_iii,
+      kExprLocalGet, 1,
+      kExprBlock, sig_i_iii,
+        kExprLocalGet, 1,
+        kExprLocalGet, 2,
+        kExprBrIf, 1,
+        kExprDrop,
+        kExprDrop,
+        kExprDrop,
+      kExprEnd,
+      kExprDrop,
+    kExprEnd])
+  .exportAs("main");
+
+let module = new WebAssembly.Module(builder.toBuffer());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7049.js b/deps/v8/test/mjsunit/regress/wasm/regress-7049.js
deleted file mode 100644
index 46dce4a8716..00000000000
--- a/deps/v8/test/mjsunit/regress/wasm/regress-7049.js
+++ /dev/null
@@ -1,53 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --expose-gc
-
-load('test/mjsunit/wasm/wasm-module-builder.js');
-
-// Build two instances, instance 2 is interpreted, and calls instance 1 (via
-// C_WASM_ENTRY), instance 1 then calls JS, which triggers GC.
-
-let builder1 = new WasmModuleBuilder();
-
-function call_gc() {
-  print('Triggering GC.');
-  gc();
-  print('Survived GC.');
-}
-let func1_sig = makeSig(new Array(8).fill(kWasmI32), [kWasmI32]);
-let imp = builder1.addImport('q', 'gc', kSig_v_v);
-let func1 = builder1.addFunction('func1', func1_sig)
-                .addBody([
-                  kExprLocalGet, 0,  // -
-                  kExprCallFunction, imp
-                ])
-                .exportFunc();
-let instance1 = builder1.instantiate({q: {gc: call_gc}});
-
-let builder2 = new WasmModuleBuilder();
-
-let func1_imp = builder2.addImport('q', 'func1', func1_sig);
-let func2 = builder2.addFunction('func2', kSig_i_i)
-                .addBody([
-                  kExprLocalGet, 0,  // 1
-                  kExprLocalGet, 0,  // 2
-                  kExprLocalGet, 0,  // 3
-                  kExprLocalGet, 0,  // 4
-                  kExprLocalGet, 0,  // 5
-                  kExprLocalGet, 0,  // 6
-                  kExprLocalGet, 0,  // 7
-                  kExprLocalGet, 0,  // 8
-                  kExprCallFunction, func1_imp
-                ])
-                .exportFunc();
-
-let instance2 = builder2.instantiate({q: {func1: instance1.exports.func1}});
-
-%RedirectToWasmInterpreter(
-        instance2, parseInt(instance2.exports.func2.name));
-
-// Call with 1. This will be passed by the C_WASM_ENTRY via the stack, and the
-// GC will try to dereference it (before the bug fix).
-instance2.exports.func2(1);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-715216a.js b/deps/v8/test/mjsunit/regress/wasm/regress-715216a.js
deleted file mode 100644
index 56253414c94..00000000000
--- a/deps/v8/test/mjsunit/regress/wasm/regress-715216a.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --wasm-interpret-all --validate-asm
-
-function asm() {
-  "use asm";
-  function f() {}
-  return {};
-}
-asm();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-715216b.js b/deps/v8/test/mjsunit/regress/wasm/regress-715216b.js
deleted file mode 100644
index 85e93e07c91..00000000000
--- a/deps/v8/test/mjsunit/regress/wasm/regress-715216b.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --wasm-interpret-all --wasm-lazy-compilation
-
-load("test/mjsunit/wasm/wasm-module-builder.js");
-
-var builder = new WasmModuleBuilder();
-builder.addFunction('f', kSig_v_v).addBody([]);
-builder.addFunction('g', kSig_v_v).addBody([]);
-builder.instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-719175.js b/deps/v8/test/mjsunit/regress/wasm/regress-719175.js
deleted file mode 100644
index c6217b0b01a..00000000000
--- a/deps/v8/test/mjsunit/regress/wasm/regress-719175.js
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --validate-asm --wasm-interpret-all
-
-function asm() {
-  'use asm';
-  function f() {
-    if (1.0 % 2.5 == -0.75) {
-    }
-    return 0;
-  }
-  return {f: f};
-}
-asm().f();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-766003.js b/deps/v8/test/mjsunit/regress/wasm/regress-766003.js
deleted file mode 100644
index 3aaff40636b..00000000000
--- a/deps/v8/test/mjsunit/regress/wasm/regress-766003.js
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm --wasm-interpret-all
-
-load('test/mjsunit/wasm/wasm-module-builder.js');
-
- __v_6 = new WasmModuleBuilder();
-__v_6.addFunction('exp1', kSig_i_i).addBody([kExprUnreachable]).exportFunc();
- __v_7 = new WasmModuleBuilder();
- __v_7.addImport('__v_11', '__v_11', kSig_i_i);
-try {
-; } catch(e) {; }
- __v_8 = __v_6.instantiate().exports.exp1;
- __v_9 = __v_7.instantiate({__v_11: {__v_11: __v_8}}).exports.call_imp;
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-771243.js b/deps/v8/test/mjsunit/regress/wasm/regress-771243.js
deleted file mode 100644
index c06adebd769..00000000000
--- a/deps/v8/test/mjsunit/regress/wasm/regress-771243.js
+++ /dev/null
@@ -1,38 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm --wasm-interpret-all
-
-load('test/mjsunit/wasm/wasm-module-builder.js');
-
-assertThrows(() => {
- __v_29 = 0;
-function __f_1() {
- __v_19 = new WasmModuleBuilder();
-  if (__v_25) {
- __v_23 = __v_19.addImport('__v_24', '__v_30', __v_25);
-  }
-  if (__v_18) {
- __v_19.addMemory();
- __v_19.addFunction('load', kSig_i_i)
-        .addBody([ 0])
-        .exportFunc();
-  }
- return __v_19;
-}
- (function TestExternalCallBetweenTwoWasmModulesWithoutAndWithMemory() {
- __v_21 = __f_1(__v_18 = false, __v_25 = kSig_i_i);
- __v_21.addFunction('plus_one', kSig_i_i)
-      .addBody([
-        kExprLocalGet, 0,                   // -
-        kExprCallFunction, __v_29      ])
-      .exportFunc();
- __v_32 =
-      __f_1(__v_18 = true, __v_25 = undefined);
- __v_31 = __v_32.instantiate(); try { __v_32[__getRandomProperty()] = __v_0; delete __v_18[__getRandomProperty()]; delete __v_34[__getRandomProperty()]; } catch(e) {; };
- __v_20 = __v_21.instantiate(
-      {__v_24: {__v_30: __v_31.exports.load}});
- __v_20.exports.plus_one(); __v_33 = __v_43;
-})();
-});
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-772332.js b/deps/v8/test/mjsunit/regress/wasm/regress-772332.js
deleted file mode 100644
index 54676b198e0..00000000000
--- a/deps/v8/test/mjsunit/regress/wasm/regress-772332.js
+++ /dev/null
@@ -1,32 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm --wasm-interpret-all
-
-load('test/mjsunit/wasm/wasm-module-builder.js');
-
-assertThrows(() => {
-let __v_50315 = 0;
-function __f_15356(__v_50316, __v_50317) {
-  let __v_50318 = new WasmModuleBuilder();
-  if (__v_50317) {
-    let __v_50319 = __v_50318.addImport('import_module', 'other_module_fn', kSig_i_i);
-  }
-      __v_50318.addMemory();
-      __v_50318.addFunction('load', kSig_i_i).addBody([ 0, 0, 0]).exportFunc();
-  return __v_50318;
-}
-  (function __f_15357() {
-    let __v_50320 = __f_15356(__v_50350 = false, __v_50351 = kSig_i_i);
-      __v_50320.addFunction('plus_one', kSig_i_i).addBody([kExprLocalGet, 0, kExprCallFunction, __v_50315, kExprI32Const, kExprI32Add, kExprReturn]).exportFunc();
-    let __v_50321 = __f_15356();
-    let __v_50324 = __v_50321.instantiate();
-    let __v_50325 = __v_50320.instantiate({
-      import_module: {
-        other_module_fn: __v_50324.exports.load
-      }
-    });
- __v_50325.exports.plus_one();
-  })();
-});
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-778917.js b/deps/v8/test/mjsunit/regress/wasm/regress-778917.js
deleted file mode 100644
index c7eb033d950..00000000000
--- a/deps/v8/test/mjsunit/regress/wasm/regress-778917.js
+++ /dev/null
@@ -1,19 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm --wasm-interpret-all
-
-load("test/mjsunit/wasm/wasm-module-builder.js");
-
-
-const builder = new WasmModuleBuilder();
-
-const index = builder.addFunction("huge_frame", kSig_v_v)
-    .addBody([kExprCallFunction, 0])
-  .addLocals({f64_count: 49555}).exportFunc().index;
-// We assume above that the function we added has index 0.
-assertEquals(0, index);
-
-const module = builder.instantiate();
-assertThrows(module.exports.huge_frame, RangeError);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-831463.js b/deps/v8/test/mjsunit/regress/wasm/regress-831463.js
deleted file mode 100644
index 2818ad350b6..00000000000
--- a/deps/v8/test/mjsunit/regress/wasm/regress-831463.js
+++ /dev/null
@@ -1,21 +0,0 @@
-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --wasm-interpret-all
-
-load("test/mjsunit/wasm/wasm-module-builder.js");
-
-const builder = new WasmModuleBuilder();
-const sig = builder.addType(kSig_i_i);
-builder.addFunction('call', kSig_i_v)
-    .addBody([
-      kExprI32Const, 0, kExprI32Const, 0, kExprCallIndirect, sig, kTableZero
-    ])
-    .exportAs('call');
-builder.addImportedTable('imp', 'table');
-const table = new WebAssembly.Table({element: 'anyfunc', initial: 1});
-const instance = builder.instantiate({imp: {table: table}});
-assertThrows(
-    () => instance.exports.call(), WebAssembly.RuntimeError,
-    /function signature mismatch/);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-834624.js b/deps/v8/test/mjsunit/regress/wasm/regress-834624.js
deleted file mode 100644
index 3e3548ed321..00000000000
--- a/deps/v8/test/mjsunit/regress/wasm/regress-834624.js
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --wasm-interpret-all
-
-load("test/mjsunit/wasm/wasm-module-builder.js");
-
-let instance;
-(function DoTest() {
-  function call_main() {
-    instance.exports.main();
-  }
-  let module = new WasmModuleBuilder();
-  module.addImport('mod', 'func', kSig_v_i);
-  module.addFunction('main', kSig_v_i)
-    .addBody([kExprLocalGet, 0, kExprCallFunction, 0])
-    .exportFunc();
-  instance = module.instantiate({
-    mod: {
-      func: call_main
-    }
-  });
-  try {
-    instance.exports.main();
-  } catch (e) {
-    // ignore
-  }
-})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-crbug-1007608.js b/deps/v8/test/mjsunit/regress/wasm/regress-crbug-1007608.js
deleted file mode 100644
index 279d2dbd06b..00000000000
--- a/deps/v8/test/mjsunit/regress/wasm/regress-crbug-1007608.js
+++ /dev/null
@@ -1,26 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Bug is in the C-to-Wasm entry, used e.g. by the Wasm interpreter.
-// Flags: --wasm-interpret-all
-
-load("test/mjsunit/wasm/wasm-module-builder.js");
-
-let argc = 7;
-let builder = new WasmModuleBuilder();
-let types = new Array(argc).fill(kWasmI32);
-let sig = makeSig(types, []);
-let body = [];
-for (let i = 0; i < argc; ++i) {
-  body.push(kExprLocalGet, i);
-}
-body.push(kExprCallFunction, 0);
-builder.addImport('', 'f', sig);
-builder.addFunction("main", sig).addBody(body).exportAs('main');
-let instance = builder.instantiate({
-  '': {
-    'f': function() { throw "don't crash"; }
-  }
-});
-assertThrows(instance.exports.main);
diff --git a/deps/v8/test/mjsunit/serialize-deserialize-now.js b/deps/v8/test/mjsunit/serialize-deserialize-now.js
new file mode 100644
index 00000000000..b906328efff
--- /dev/null
+++ b/deps/v8/test/mjsunit/serialize-deserialize-now.js
@@ -0,0 +1,17 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+%SerializeDeserializeNow();
+
+const xs = [0, 1, 2];
+var o = { a: 0, b: 1, c: 2 };
+
+%SerializeDeserializeNow();
+
+const p = new Promise((resolve, reject) => { resolve("Promise"); });
+p.then((msg) => console.log(msg));
+
+%SerializeDeserializeNow();
diff --git a/deps/v8/test/mjsunit/tools/foozzie.js b/deps/v8/test/mjsunit/tools/foozzie.js
index 30faf46116b..67e6547c67e 100644
--- a/deps/v8/test/mjsunit/tools/foozzie.js
+++ b/deps/v8/test/mjsunit/tools/foozzie.js
@@ -8,9 +8,9 @@
 // Test foozzie mocks for differential fuzzing.
 
 // Deterministic Math.random.
-assertEquals(0.1, Math.random());
-assertEquals(0.2, Math.random());
-assertEquals(0.3, Math.random());
+assertEquals(0.7098480789645691, Math.random());
+assertEquals(0.9742682568175951, Math.random());
+assertEquals(0.20008059867222983, Math.random());
 
 // Deterministic date.
 assertEquals(1477662728698, Date.now());
@@ -77,3 +77,15 @@ if (isBigEndian){
 else {
   testArrayType(Float64Array, [0, 1072693248]);
 }
+
+// Realm.eval is just eval.
+assertEquals(1477662728716, Realm.eval(Realm.create(), `Date.now()`));
+
+// Test suppressions when Math.pow is optimized.
+function callPow(v) {
+  return Math.pow(v, -0.5);
+}
+%PrepareFunctionForOptimization(callPow);
+const unoptimized = callPow(6996);
+%OptimizeFunctionOnNextCall(callPow);
+assertEquals(unoptimized, callPow(6996));
diff --git a/deps/v8/test/mjsunit/wasm/anyfunc-interpreter.js b/deps/v8/test/mjsunit/wasm/anyfunc-interpreter.js
deleted file mode 100644
index 10d66c6b369..00000000000
--- a/deps/v8/test/mjsunit/wasm/anyfunc-interpreter.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm --experimental-wasm-anyref --expose-gc
-// Flags: --wasm-interpret-all
-
-// This is just a wrapper for an existing reference types test case that runs
-// with the --wasm-interpret-all flag added. If we ever decide to add a test
-// variant for this, then we can remove this file.
-
-load("test/mjsunit/wasm/anyfunc.js");
diff --git a/deps/v8/test/mjsunit/wasm/anyref-globals-interpreter.js b/deps/v8/test/mjsunit/wasm/anyref-globals-interpreter.js
deleted file mode 100644
index bca5d6c2026..00000000000
--- a/deps/v8/test/mjsunit/wasm/anyref-globals-interpreter.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --experimental-wasm-anyref --expose-gc
-// Flags: --wasm-interpret-all
-
-// This is just a wrapper for an existing reference types test case that runs
-// with the --wasm-interpret-all flag added. If we ever decide to add a test
-// variant for this, then we can remove this file.
-
-load("test/mjsunit/wasm/anyref-globals.js");
diff --git a/deps/v8/test/mjsunit/wasm/anyref-interpreter.js b/deps/v8/test/mjsunit/wasm/anyref-interpreter.js
deleted file mode 100644
index d22e841049f..00000000000
--- a/deps/v8/test/mjsunit/wasm/anyref-interpreter.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm --experimental-wasm-anyref --expose-gc
-// Flags: --wasm-interpret-all
-
-// This is just a wrapper for an existing reference types test case that runs
-// with the --wasm-interpret-all flag added. If we ever decide to add a test
-// variant for this, then we can remove this file.
-
-load("test/mjsunit/wasm/anyref.js");
diff --git a/deps/v8/test/mjsunit/wasm/asm-wasm.js b/deps/v8/test/mjsunit/wasm/asm-wasm.js
index 97219f113ba..10db2c2be80 100644
--- a/deps/v8/test/mjsunit/wasm/asm-wasm.js
+++ b/deps/v8/test/mjsunit/wasm/asm-wasm.js
@@ -1397,3 +1397,27 @@ assertWasm(3.25, TestFloatGlobals);
   assertEquals(42, m.bar());
   assertEquals(42, m.baz());
 })();
+
+(function TestGenerator() {
+  function* asmModule() {
+    "use asm";
+    function foo() {
+      return 42;
+    }
+    return {foo: foo};
+  }
+  asmModule();
+  assertFalse(%IsAsmWasmCode(asmModule));
+})();
+
+(function TestAsyncFunction() {
+  async function asmModule() {
+    "use asm";
+    function foo() {
+      return 42;
+    }
+    return {foo: foo};
+  }
+  asmModule();
+  assertFalse(%IsAsmWasmCode(asmModule));
+})();
diff --git a/deps/v8/test/mjsunit/wasm/compilation-hints-async-compilation.js b/deps/v8/test/mjsunit/wasm/compilation-hints-async-compilation.js
index 4723b92acff..b01d0e55b71 100644
--- a/deps/v8/test/mjsunit/wasm/compilation-hints-async-compilation.js
+++ b/deps/v8/test/mjsunit/wasm/compilation-hints-async-compilation.js
@@ -19,7 +19,7 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
   assertPromiseResult(WebAssembly.compile(bytes)
     .then(assertUnreachable,
           error => assertEquals("WebAssembly.compile(): Invalid compilation " +
-          "hint 0x2d (forbidden downgrade) @+49", error.message)));
+          "hint 0x19 (forbidden downgrade) @+49", error.message)));
 })();
 
 (function testCompileWithBadLazyFunctionBody() {
diff --git a/deps/v8/test/mjsunit/wasm/compilation-hints-decoder.js b/deps/v8/test/mjsunit/wasm/compilation-hints-decoder.js
index 5bcac2af9e9..aa0525c09d8 100644
--- a/deps/v8/test/mjsunit/wasm/compilation-hints-decoder.js
+++ b/deps/v8/test/mjsunit/wasm/compilation-hints-decoder.js
@@ -20,7 +20,7 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
          .exportFunc();
   assertThrows(() => builder.instantiate({mod: {pow: Math.pow}}),
                WebAssembly.CompileError,
-               "WebAssembly.Module(): Invalid compilation hint 0x2d " +
+               "WebAssembly.Module(): Invalid compilation hint 0x19 " +
                "(forbidden downgrade) @+70");
 })();
 
@@ -33,8 +33,8 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
                    kExprLocalGet, 0,
                    kExprCallFunction, 0])
          .setCompilationHint(kCompilationHintStrategyDefault,
-                             kCompilationHintTierInterpreter,
-                             kCompilationHintTierInterpreter)
+                             kCompilationHintTierBaseline,
+                             kCompilationHintTierBaseline)
          .exportFunc();
   builder.addFunction('upow2', kSig_i_i)
          .addBody([kExprLocalGet, 0,
diff --git a/deps/v8/test/mjsunit/wasm/compilation-hints-ignored.js b/deps/v8/test/mjsunit/wasm/compilation-hints-ignored.js
index 4bfc22fb89c..09af4c7f691 100644
--- a/deps/v8/test/mjsunit/wasm/compilation-hints-ignored.js
+++ b/deps/v8/test/mjsunit/wasm/compilation-hints-ignored.js
@@ -13,8 +13,8 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
                    kExprLocalGet, 0,
                    kExprCallFunction, 0])
          .setCompilationHint(kCompilationHintStrategyDefault,
-                             kCompilationHintTierInterpreter,
-                             kCompilationHintTierInterpreter)
+                             kCompilationHintTierBaseline,
+                             kCompilationHintTierBaseline)
          .exportFunc();
   let instance = builder.instantiate({mod: {pow: Math.pow}});
   assertEquals(27, instance.exports.upow(3))
diff --git a/deps/v8/test/mjsunit/wasm/compilation-hints-interpreter.js b/deps/v8/test/mjsunit/wasm/compilation-hints-interpreter.js
deleted file mode 100644
index f9f85a7d91f..00000000000
--- a/deps/v8/test/mjsunit/wasm/compilation-hints-interpreter.js
+++ /dev/null
@@ -1,113 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be found
-// in the LICENSE file.
-
-// Flags: --experimental-wasm-compilation-hints --wasm-lazy-validation
-
-load('test/mjsunit/wasm/wasm-module-builder.js');
-
-(function testInterpreterCallsLazyFunctionInOtherInstance() {
-  print(arguments.callee.name);
-  let builder0 = new WasmModuleBuilder();
-  builder0.addFunction("getX", kSig_i_v)
-          .addBody([kExprI32Const, 42])
-          .setCompilationHint(kCompilationHintStrategyLazy,
-                              kCompilationHintTierBaseline,
-                              kCompilationHintTierBaseline)
-          .exportFunc();
-  let builder1 = new WasmModuleBuilder();
-  builder1.addImport("otherModule", "getX", kSig_i_v);
-  builder1.addFunction("plusX", kSig_i_i)
-          .addBody([kExprCallFunction, 0,
-                    kExprLocalGet, 0,
-                    kExprI32Add])
-          .setCompilationHint(kCompilationHintStrategyLazy,
-                              kCompilationHintTierInterpreter,
-                              kCompilationHintTierInterpreter)
-          .exportFunc();
-  let instance0 = builder0.instantiate();
-  let instance1 = builder1.instantiate(
-      {otherModule: {getX: instance0.exports.getX}});
-  assertEquals(46, instance1.exports.plusX(4));
-})();
-
-(function testInterpreterCallsLazyBadFunctionInOtherInstance() {
-  print(arguments.callee.name);
-  let builder0 = new WasmModuleBuilder();
-  builder0.addFunction("getX", kSig_i_v)
-          .addBody([kExprI64Const, 42])
-          .setCompilationHint(kCompilationHintStrategyLazy,
-                              kCompilationHintTierBaseline,
-                              kCompilationHintTierBaseline)
-          .exportFunc();
-  let builder1 = new WasmModuleBuilder();
-  builder1.addImport("otherModule", "getX", kSig_i_v);
-  builder1.addFunction("plusX", kSig_i_i)
-          .addBody([kExprCallFunction, 0,
-                    kExprLocalGet, 0,
-                    kExprI32Add])
-          .setCompilationHint(kCompilationHintStrategyLazy,
-                              kCompilationHintTierInterpreter,
-                              kCompilationHintTierInterpreter)
-          .exportFunc();
-  let instance0 = builder0.instantiate();
-  let instance1 = builder1.instantiate(
-      {otherModule: {getX: instance0.exports.getX}});
-  assertThrows(() => instance1.exports.plusX(4),
-               WebAssembly.CompileError,
-               "Compiling function #0:\"getX\" failed: type error in " +
-               "merge[0] (expected i32, got i64) @+57");
-})();
-
-(function testInterpreterCallsLazyFunctionThroughIndirection() {
-  print(arguments.callee.name);
-  let builder = new WasmModuleBuilder();
-  let sig_i_ii = builder.addType(kSig_i_ii);
-  let add = builder.addFunction('add', sig_i_ii)
-                   .addBody([kExprLocalGet, 0,
-                             kExprLocalGet, 1,
-                             kExprI32Add])
-                   .setCompilationHint(kCompilationHintStrategyLazy,
-                                       kCompilationHintTierInterpreter,
-                                       kCompilationHintTierInterpreter);
-  builder.appendToTable([add.index]);
-  builder.addFunction('main', kSig_i_iii)
-         .addBody([// Call indirect #0 with args <#1, #2>.
-                   kExprLocalGet, 1,
-                   kExprLocalGet, 2,
-                   kExprLocalGet, 0,
-                   kExprCallIndirect, sig_i_ii, kTableZero])
-         .setCompilationHint(kCompilationHintStrategyLazy,
-                             kCompilationHintTierInterpreter,
-                             kCompilationHintTierInterpreter)
-         .exportFunc();
-  assertEquals(99, builder.instantiate().exports.main(0, 22, 77));
-})();
-
-(function testInterpreterCallsLazyBadFunctionThroughIndirection() {
-  print(arguments.callee.name);
-  let builder = new WasmModuleBuilder();
-  let sig_i_ii = builder.addType(kSig_i_ii);
-  let add = builder.addFunction('add', sig_i_ii)
-                   .addBody([kExprLocalGet, 0,
-                             kExprLocalGet, 1,
-                             kExprI64Add])
-                   .setCompilationHint(kCompilationHintStrategyLazy,
-                                       kCompilationHintTierInterpreter,
-                                       kCompilationHintTierInterpreter);
-  builder.appendToTable([add.index]);
-  builder.addFunction('main', kSig_i_iii)
-         .addBody([// Call indirect #0 with args <#1, #2>.
-                   kExprLocalGet, 1,
-                   kExprLocalGet, 2,
-                   kExprLocalGet, 0,
-                   kExprCallIndirect, sig_i_ii, kTableZero])
-         .setCompilationHint(kCompilationHintStrategyLazy,
-                             kCompilationHintTierInterpreter,
-                             kCompilationHintTierInterpreter)
-         .exportFunc();
-  assertThrows(() => builder.instantiate().exports.main(0, 22, 77),
-               WebAssembly.CompileError,
-               "Compiling function #0:\"add\" failed: i64.add[1] expected " +
-               "type i64, found local.get of type i32 @+83");
-})();
diff --git a/deps/v8/test/mjsunit/wasm/compilation-hints-streaming-compilation.js b/deps/v8/test/mjsunit/wasm/compilation-hints-streaming-compilation.js
index 2708da149b8..59c1a9ed3aa 100644
--- a/deps/v8/test/mjsunit/wasm/compilation-hints-streaming-compilation.js
+++ b/deps/v8/test/mjsunit/wasm/compilation-hints-streaming-compilation.js
@@ -49,7 +49,7 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
                                                        {mod: {pow: Math.pow}})
     .then(assertUnreachable,
           error => assertEquals("WebAssembly.instantiateStreaming(): Invalid " +
-                                "compilation hint 0x2d (forbidden downgrade) " +
+                                "compilation hint 0x19 (forbidden downgrade) " +
                                 "@+78",
                                 error.message)));
 })();
diff --git a/deps/v8/test/mjsunit/wasm/compilation-hints-sync-compilation.js b/deps/v8/test/mjsunit/wasm/compilation-hints-sync-compilation.js
index 35f77de157d..1f9c00a1f73 100644
--- a/deps/v8/test/mjsunit/wasm/compilation-hints-sync-compilation.js
+++ b/deps/v8/test/mjsunit/wasm/compilation-hints-sync-compilation.js
@@ -17,7 +17,7 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
          .exportFunc();
   assertThrows(() => builder.toModule(),
     WebAssembly.CompileError,
-    "WebAssembly.Module(): Invalid compilation hint 0x2d " +
+    "WebAssembly.Module(): Invalid compilation hint 0x19 " +
     "(forbidden downgrade) @+49");
 })();
 
diff --git a/deps/v8/test/mjsunit/wasm/compiled-module-management.js b/deps/v8/test/mjsunit/wasm/compiled-module-management.js
index a2b102f0837..47a12c165ba 100644
--- a/deps/v8/test/mjsunit/wasm/compiled-module-management.js
+++ b/deps/v8/test/mjsunit/wasm/compiled-module-management.js
@@ -80,6 +80,7 @@ assertEquals(0, %WasmGetNumberOfInstances(module));
   instance4 = new WebAssembly.Instance(module, {"": {getValue: () => 4}});
   assertEquals(4, instance4.exports.f());
   module = null;
+  instance4 = null;
 })();
 
 // Note that two GC's are required because weak slots clearing is deferred.
diff --git a/deps/v8/test/mjsunit/wasm/exceptions-anyref-interpreter.js b/deps/v8/test/mjsunit/wasm/exceptions-anyref-interpreter.js
deleted file mode 100644
index 14d1e60e88f..00000000000
--- a/deps/v8/test/mjsunit/wasm/exceptions-anyref-interpreter.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --experimental-wasm-eh --experimental-wasm-anyref --allow-natives-syntax
-// Flags: --wasm-interpret-all
-
-// This is just a wrapper for existing exception handling test cases that runs
-// with the --wasm-interpret-all flag added. If we ever decide to add a test
-// variant for this, then we can remove this file.
-
-load("test/mjsunit/wasm/exceptions-anyref.js");
diff --git a/deps/v8/test/mjsunit/wasm/exceptions-global-interpreter.js b/deps/v8/test/mjsunit/wasm/exceptions-global-interpreter.js
deleted file mode 100644
index ae06ff00fbd..00000000000
--- a/deps/v8/test/mjsunit/wasm/exceptions-global-interpreter.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm --experimental-wasm-eh --allow-natives-syntax
-// Flags: --wasm-interpret-all
-
-// This is just a wrapper for existing exception handling test cases that runs
-// with the --wasm-interpret-all flag added. If we ever decide to add a test
-// variant for this, then we can remove this file.
-
-load("test/mjsunit/wasm/exceptions-global.js");
diff --git a/deps/v8/test/mjsunit/wasm/exceptions-interpreter.js b/deps/v8/test/mjsunit/wasm/exceptions-interpreter.js
deleted file mode 100644
index 9393aade0fc..00000000000
--- a/deps/v8/test/mjsunit/wasm/exceptions-interpreter.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm --experimental-wasm-eh --allow-natives-syntax
-// Flags: --wasm-interpret-all
-
-// This is just a wrapper for existing exception handling test cases that runs
-// with the --wasm-interpret-all flag added. If we ever decide to add a test
-// variant for this, then we can remove this file.
-
-load("test/mjsunit/wasm/exceptions.js");
diff --git a/deps/v8/test/mjsunit/wasm/exceptions-rethrow-interpreter.js b/deps/v8/test/mjsunit/wasm/exceptions-rethrow-interpreter.js
deleted file mode 100644
index 42285ba169e..00000000000
--- a/deps/v8/test/mjsunit/wasm/exceptions-rethrow-interpreter.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm --experimental-wasm-eh --allow-natives-syntax
-// Flags: --wasm-interpret-all
-
-// This is just a wrapper for existing exception handling test cases that runs
-// with the --wasm-interpret-all flag added. If we ever decide to add a test
-// variant for this, then we can remove this file.
-
-load("test/mjsunit/wasm/exceptions-rethrow.js");
diff --git a/deps/v8/test/mjsunit/wasm/exceptions-simd-interpreter.js b/deps/v8/test/mjsunit/wasm/exceptions-simd-interpreter.js
deleted file mode 100644
index 7fd4e60032a..00000000000
--- a/deps/v8/test/mjsunit/wasm/exceptions-simd-interpreter.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm --experimental-wasm-eh --experimental-wasm-simd --allow-natives-syntax
-// Flags: --wasm-interpret-all
-
-// This is just a wrapper for existing exception handling test cases that runs
-// with the --wasm-interpret-all flag added. If we ever decide to add a test
-// variant for this, then we can remove this file.
-
-load("test/mjsunit/wasm/exceptions-simd.js");
diff --git a/deps/v8/test/mjsunit/wasm/exceptions-simd.js b/deps/v8/test/mjsunit/wasm/exceptions-simd.js
index 6fb7283d742..0b407af5c08 100644
--- a/deps/v8/test/mjsunit/wasm/exceptions-simd.js
+++ b/deps/v8/test/mjsunit/wasm/exceptions-simd.js
@@ -42,7 +42,7 @@ load("test/mjsunit/wasm/exceptions-utils.js");
         kExprEnd,
         kExprLocalGet, 0,
         kSimdPrefix, kExprI32x4Eq,
-        kSimdPrefix, kExprS1x4AllTrue,
+        kSimdPrefix, kExprV8x16AllTrue,
       ])
       .exportFunc();
   var instance = builder.instantiate();
diff --git a/deps/v8/test/mjsunit/wasm/exceptions.js b/deps/v8/test/mjsunit/wasm/exceptions.js
index fc82455ca83..de1026c045d 100644
--- a/deps/v8/test/mjsunit/wasm/exceptions.js
+++ b/deps/v8/test/mjsunit/wasm/exceptions.js
@@ -182,13 +182,62 @@ load("test/mjsunit/wasm/exceptions-utils.js");
         kExprEnd
       ]).exportFunc();
   function throw_exc() {
-    throw exception = new WebAssembly.RuntimeError('My user text');
+    throw new WebAssembly.RuntimeError('My user text');
   }
   let instance = builder.instantiate({imp: {ort: throw_exc}});
 
   assertEquals(11, instance.exports.call_import());
 })();
 
+(function TestExnWithWasmProtoNotCaught() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_v);
+  let imp = builder.addImport('imp', 'ort', kSig_v_v);
+  let throw_fn = builder.addFunction('throw', kSig_v_v)
+                     .addBody([kExprThrow, except])
+                     .exportFunc();
+  builder.addFunction('test', kSig_v_v)
+      .addBody([
+        // Calling "throw" directly should produce the expected exception.
+        kExprTry, kWasmStmt,
+          kExprCallFunction, throw_fn.index,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
+        kExprEnd,
+        // Calling through JS produces a wrapped exceptions which does not match
+        // the br_on_exn.
+        kExprTry, kWasmStmt,
+          kExprCallFunction, imp,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
+        kExprEnd
+      ]).exportFunc();
+  let instance;
+  let wrapped_exn;
+  function js_import() {
+    try {
+      instance.exports.throw();
+    } catch (e) {
+      wrapped_exn = new Error();
+      wrapped_exn.__proto__ = e;
+      throw wrapped_exn;
+    }
+  }
+  instance = builder.instantiate({imp: {ort: js_import}});
+  let caught = undefined;
+  try {
+    instance.exports.test();
+  } catch (e) {
+    caught = e;
+  }
+  assertTrue(!!caught, 'should have trapped');
+  assertEquals(caught, wrapped_exn);
+  assertInstanceof(caught.__proto__, WebAssembly.RuntimeError);
+})();
+
 // Test that we can distinguish which exception was thrown by using a cascaded
 // sequence of nested try blocks with a single handler in each catch block.
 (function TestCatchComplex1() {
diff --git a/deps/v8/test/mjsunit/wasm/futex-interpreter.js b/deps/v8/test/mjsunit/wasm/futex-interpreter.js
deleted file mode 100644
index 738e62a0a57..00000000000
--- a/deps/v8/test/mjsunit/wasm/futex-interpreter.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --experimental-wasm-threads --allow-natives-syntax
-// Flags: --wasm-interpret-all
-
-// This is a wrapper for existing futex tests with the --wasm-interpret-all
-// flag added. If we ever decide to add a test variant for this, this file can
-// be removed.
-
-load("test/mjsunit/wasm/futex.js");
diff --git a/deps/v8/test/mjsunit/wasm/indirect-call-non-zero-table-interpreter.js b/deps/v8/test/mjsunit/wasm/indirect-call-non-zero-table-interpreter.js
deleted file mode 100644
index f9275d7ccc1..00000000000
--- a/deps/v8/test/mjsunit/wasm/indirect-call-non-zero-table-interpreter.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm --experimental-wasm-anyref --experimental-wasm-return-call
-// Flags: --wasm-interpret-all
-
-// This is just a wrapper for an existing reference types test case that runs
-// with the --wasm-interpret-all flag added. If we ever decide to add a test
-// variant for this, then we can remove this file.
-
-load("test/mjsunit/wasm/indirect-call-non-zero-table.js");
diff --git a/deps/v8/test/mjsunit/wasm/interpreter-mixed.js b/deps/v8/test/mjsunit/wasm/interpreter-mixed.js
deleted file mode 100644
index 2e72a888394..00000000000
--- a/deps/v8/test/mjsunit/wasm/interpreter-mixed.js
+++ /dev/null
@@ -1,222 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --expose-gc
-
-load('test/mjsunit/wasm/wasm-module-builder.js');
-
-// =============================================================================
-// Tests in this file test the interaction between the wasm interpreter and
-// compiled code.
-// =============================================================================
-
-// The stack trace contains file path, replace it by "file".
-let stripPath = s => s.replace(/[^ (]*interpreter-mixed\.js/g, 'file');
-
-function checkStack(stack, expected_lines) {
-  print('stack: ' + stack);
-  let lines = stack.split('\n');
-  assertEquals(expected_lines.length, lines.length);
-  for (let i = 0; i < lines.length; ++i) {
-    let test =
-        typeof expected_lines[i] == 'string' ? assertEquals : assertMatches;
-    test(expected_lines[i], lines[i], 'line ' + i);
-  }
-}
-
-(function testMemoryGrowBetweenInterpretedAndCompiled() {
-  // grow_memory can be called from interpreted or compiled code, and changes
-  // should be reflected in either execution.
-  var builder = new WasmModuleBuilder();
-  var grow_body = [kExprLocalGet, 0, kExprMemoryGrow, kMemoryZero];
-  var load_body = [kExprLocalGet, 0, kExprI32LoadMem, 0, 0];
-  var store_body = [kExprLocalGet, 0, kExprLocalGet, 1, kExprI32StoreMem, 0, 0];
-  builder.addFunction('grow_memory', kSig_i_i).addBody(grow_body).exportFunc();
-  builder.addFunction('load', kSig_i_i).addBody(load_body).exportFunc();
-  builder.addFunction('store', kSig_v_ii).addBody(store_body).exportFunc();
-  var grow_interp_function =
-      builder.addFunction('grow_memory_interpreted', kSig_i_i)
-          .addBody(grow_body)
-          .exportFunc();
-  var load_interp_function = builder.addFunction('load_interpreted', kSig_i_i)
-                                 .addBody(load_body)
-                                 .exportFunc();
-  var kNumPages = 2;
-  var kMaxPages = 10;
-  builder.addMemory(kNumPages, kMaxPages, false);
-  var instance = builder.instantiate();
-  var exp = instance.exports;
-  %RedirectToWasmInterpreter(instance, grow_interp_function.index);
-  %RedirectToWasmInterpreter(instance, load_interp_function.index);
-
-  // Initially, we can load from offset 12, but not OOB.
-  var oob_index = kNumPages * kPageSize;
-  var initial_interpreted = %WasmNumInterpretedCalls(instance);
-  assertEquals(0, exp.load(12));
-  assertEquals(0, exp.load_interpreted(12));
-  assertTraps(kTrapMemOutOfBounds, () => exp.load(oob_index));
-  assertTraps(
-      kTrapMemOutOfBounds, () => exp.load_interpreted(oob_index));
-  // Grow by 2 pages from compiled code, and ensure that this is reflected in
-  // the interpreter.
-  assertEquals(kNumPages, exp.grow_memory(2));
-  kNumPages += 2;
-  assertEquals(kNumPages, exp.grow_memory_interpreted(0));
-  assertEquals(kNumPages, exp.grow_memory(0));
-  // Now we can load from the previous OOB index.
-  assertEquals(0, exp.load(oob_index));
-  assertEquals(0, exp.load_interpreted(oob_index));
-  // Set new OOB index and ensure that it traps.
-  oob_index = kNumPages * kPageSize;
-  assertTraps(kTrapMemOutOfBounds, () => exp.load(oob_index));
-  assertTraps(
-      kTrapMemOutOfBounds, () => exp.load_interpreted(oob_index));
-  // Grow by another page in the interpreter, and ensure that this is reflected
-  // in compiled code.
-  assertEquals(kNumPages, exp.grow_memory_interpreted(1));
-  kNumPages += 1;
-  assertEquals(kNumPages, exp.grow_memory_interpreted(0));
-  assertEquals(kNumPages, exp.grow_memory(0));
-  // Now we can store to the previous OOB index and read it back in both
-  // environments.
-  exp.store(oob_index, 47);
-  assertEquals(47, exp.load(oob_index));
-  assertEquals(47, exp.load_interpreted(oob_index));
-  // We cannot grow beyong kMaxPages.
-  assertEquals(-1, exp.grow_memory(kMaxPages - kNumPages + 1));
-  assertEquals(-1, exp.grow_memory_interpreted(kMaxPages - kNumPages + 1));
-  // Overall, we executed 9 functions in the interpreter.
-  assertEquals(initial_interpreted + 9, %WasmNumInterpretedCalls(instance));
-})();
-
-function createTwoInstancesCallingEachOther(inner_throws = false) {
-  let builder1 = new WasmModuleBuilder();
-
-  let id_imp = builder1.addImport('q', 'id', kSig_i_i);
-  let plus_one = builder1.addFunction('plus_one', kSig_i_i)
-                     .addBody([
-                       kExprLocalGet, 0,  // -
-                       kExprI32Const, 1,  // -
-                       kExprI32Add,       // -
-                       kExprCallFunction, id_imp
-                     ])
-                     .exportFunc();
-  function imp(i) {
-    if (inner_throws) throw new Error('i=' + i);
-    return i;
-  }
-  let instance1 = builder1.instantiate({q: {id: imp}});
-
-  let builder2 = new WasmModuleBuilder();
-
-  let plus_one_imp = builder2.addImport('q', 'plus_one', kSig_i_i);
-  let plus_two = builder2.addFunction('plus_two', kSig_i_i)
-                     .addBody([
-                       // Call import, add one more.
-                       kExprLocalGet, 0,                 // -
-                       kExprCallFunction, plus_one_imp,  // -
-                       kExprI32Const, 1,                 // -
-                       kExprI32Add
-                     ])
-                     .exportFunc();
-
-  let instance2 =
-      builder2.instantiate({q: {plus_one: instance1.exports.plus_one}});
-  return [instance1, instance2];
-}
-
-function redirectToInterpreter(
-    instance1, instance2, redirect_plus_one, redirect_plus_two) {
-  // Redirect functions to the interpreter.
-  if (redirect_plus_one) {
-    %RedirectToWasmInterpreter(instance1,
-                               parseInt(instance1.exports.plus_one.name));
-  }
-  if (redirect_plus_two) {
-    %RedirectToWasmInterpreter(instance2,
-                               parseInt(instance2.exports.plus_two.name));
-  }
-}
-
-(function testImportFromOtherInstance() {
-  print("testImportFromOtherInstance");
-  // Three runs: Break in instance 1, break in instance 2, or both.
-  for (let run = 0; run < 3; ++run) {
-    print(" - run " + run);
-    (() => {
-      // Trigger a GC to ensure that the underlying native module is not a cached
-      // one from a previous run, with functions already redirected to the
-      // interpreter. This is not observable from pure JavaScript, but this is
-      // observable with the internal runtime functions used in this test.
-      // Run in a local scope to ensure previous native modules are
-      // unreachable.
-      gc();
-      let [instance1, instance2] = createTwoInstancesCallingEachOther();
-      let interpreted_before_1 = %WasmNumInterpretedCalls(instance1);
-      let interpreted_before_2 = %WasmNumInterpretedCalls(instance2);
-      // Call plus_two, which calls plus_one.
-      assertEquals(9, instance2.exports.plus_two(7));
-      // Nothing interpreted:
-      assertEquals(interpreted_before_1, %WasmNumInterpretedCalls(instance1));
-      assertEquals(interpreted_before_2, %WasmNumInterpretedCalls(instance2));
-      // Now redirect functions to the interpreter.
-      redirectToInterpreter(instance1, instance2, run != 1, run != 0);
-      // Call plus_two, which calls plus_one.
-      assertEquals(9, instance2.exports.plus_two(7));
-      // TODO(6668): Fix patching of instances which imported others' code.
-      //assertEquals(interpreted_before_1 + (run == 1 ? 0 : 1),
-      //             %WasmNumInterpretedCalls(instance1));
-      assertEquals(interpreted_before_2 + (run == 0 ? 0 : 1),
-                   %WasmNumInterpretedCalls(instance2))
-    })();
-  }
-})();
-
-(function testStackTraceThroughCWasmEntry() {
-  print("testStackTraceThroughCWasmEntry");
-  for (let run = 0; run < 3; ++run) {
-    print(" - run " + run);
-    let [instance1, instance2] = createTwoInstancesCallingEachOther(true);
-    redirectToInterpreter(instance1, instance2, run != 1, run != 0);
-
-    try {
-      // Call plus_two, which calls plus_one.
-      instance2.exports.plus_two(7);
-      assertUnreachable('should trap because of unreachable instruction');
-    } catch (e) {
-      checkStack(stripPath(e.stack), [
-        'Error: i=8',                                                   // -
-        /^    at imp \(file:\d+:29\)$/,                                 // -
-        '    at plus_one (<anonymous>:wasm-function[1]:0x3b)',          // -
-        '    at plus_two (<anonymous>:wasm-function[1]:0x3e)',          // -
-        /^    at testStackTraceThroughCWasmEntry \(file:\d+:25\)$/,     // -
-        /^    at file:\d+:3$/
-      ]);
-    }
-  }
-})();
-
-(function testInterpreterPreservedOnTierUp() {
-  print(arguments.callee.name);
-  var builder = new WasmModuleBuilder();
-  var fun_body = [kExprI32Const, 23];
-  var fun = builder.addFunction('fun', kSig_i_v).addBody(fun_body).exportFunc();
-  var instance = builder.instantiate();
-  var exp = instance.exports;
-
-  // Initially the interpreter is not being called.
-  var initial_interpreted = %WasmNumInterpretedCalls(instance);
-  assertEquals(23, exp.fun());
-  assertEquals(initial_interpreted + 0, %WasmNumInterpretedCalls(instance));
-
-  // Redirection will cause the interpreter to be called.
-  %RedirectToWasmInterpreter(instance, fun.index);
-  assertEquals(23, exp.fun());
-  assertEquals(initial_interpreted + 1, %WasmNumInterpretedCalls(instance));
-
-  // Requesting a tier-up still ensure the interpreter is being called.
-  %WasmTierUpFunction(instance, fun.index);
-  assertEquals(23, exp.fun());
-  assertEquals(initial_interpreted + 2, %WasmNumInterpretedCalls(instance));
-})();
diff --git a/deps/v8/test/mjsunit/wasm/interpreter.js b/deps/v8/test/mjsunit/wasm/interpreter.js
deleted file mode 100644
index 99debff8467..00000000000
--- a/deps/v8/test/mjsunit/wasm/interpreter.js
+++ /dev/null
@@ -1,569 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --wasm-interpret-all --allow-natives-syntax --expose-gc
-
-load('test/mjsunit/wasm/wasm-module-builder.js');
-
-// The stack trace contains file path, only keep "interpreter.js".
-let stripPath = s => s.replace(/[^ (]*interpreter\.js/g, 'interpreter.js');
-
-function checkStack(stack, expected_lines) {
-  print('stack: ' + stack);
-  var lines = stack.split('\n');
-  assertEquals(expected_lines.length, lines.length);
-  for (var i = 0; i < lines.length; ++i) {
-    let test =
-        typeof expected_lines[i] == 'string' ? assertEquals : assertMatches;
-    test(expected_lines[i], lines[i], 'line ' + i);
-  }
-}
-
-(function testCallImported() {
-  print(arguments.callee.name);
-  var stack;
-  let func = () => stack = new Error('test imported stack').stack;
-
-  var builder = new WasmModuleBuilder();
-  builder.addImport('mod', 'func', kSig_v_v);
-  builder.addFunction('main', kSig_v_v)
-      .addBody([kExprCallFunction, 0])
-      .exportFunc();
-  var instance = builder.instantiate({mod: {func: func}});
-  // Test that this does not mess up internal state by executing it three times.
-  for (var i = 0; i < 3; ++i) {
-    var interpreted_before = %WasmNumInterpretedCalls(instance);
-    instance.exports.main();
-    assertEquals(interpreted_before + 1, %WasmNumInterpretedCalls(instance));
-    checkStack(stripPath(stack), [
-      'Error: test imported stack',                          // -
-      /^    at func \(interpreter.js:\d+:28\)$/,             // -
-      '    at main (<anonymous>:wasm-function[1]:0x32)',     // -
-      /^    at testCallImported \(interpreter.js:\d+:22\)$/, // -
-      /^    at interpreter.js:\d+:3$/
-    ]);
-  }
-})();
-
-(function testCallImportedWithParameters() {
-  print(arguments.callee.name);
-  var stack;
-  var passed_args = [];
-  let func1 = (i, j) => (passed_args.push(i, j), 2 * i + j);
-  let func2 = (f) => (passed_args.push(f), 8 * f);
-
-  var builder = new WasmModuleBuilder();
-  builder.addImport('mod', 'func1', makeSig([kWasmI32, kWasmI32], [kWasmF32]));
-  builder.addImport('mod', 'func2', makeSig([kWasmF64], [kWasmI32]));
-  builder.addFunction('main', makeSig([kWasmI32, kWasmF64], [kWasmF32]))
-      .addBody([
-        // call #0 with arg 0 and arg 0 + 1
-        kExprLocalGet, 0, kExprLocalGet, 0, kExprI32Const, 1, kExprI32Add,
-        kExprCallFunction, 0,
-        // call #1 with arg 1
-        kExprLocalGet, 1, kExprCallFunction, 1,
-        // convert returned value to f32
-        kExprF32UConvertI32,
-        // add the two values
-        kExprF32Add
-      ])
-      .exportFunc();
-  var instance = builder.instantiate({mod: {func1: func1, func2: func2}});
-  var interpreted_before = %WasmNumInterpretedCalls(instance);
-  var args = [11, 0.3];
-  var ret = instance.exports.main(...args);
-  assertEquals(interpreted_before + 1, %WasmNumInterpretedCalls(instance));
-  var passed_test_args = [...passed_args];
-  var expected = func1(args[0], args[0] + 1) + func2(args[1]) | 0;
-  assertEquals(expected, ret);
-  assertArrayEquals([args[0], args[0] + 1, args[1]], passed_test_args);
-})();
-
-(function testTrap() {
-  print(arguments.callee.name);
-  var builder = new WasmModuleBuilder();
-  var foo_idx = builder.addFunction('foo', kSig_v_v)
-                    .addBody([kExprNop, kExprNop, kExprUnreachable])
-                    .index;
-  builder.addFunction('main', kSig_v_v)
-      .addBody([kExprNop, kExprCallFunction, foo_idx])
-      .exportFunc();
-  var instance = builder.instantiate();
-  // Test that this does not mess up internal state by executing it three times.
-  for (var i = 0; i < 3; ++i) {
-    var interpreted_before = %WasmNumInterpretedCalls(instance);
-    var stack;
-    try {
-      instance.exports.main();
-      assertUnreachable();
-    } catch (e) {
-      stack = e.stack;
-    }
-    assertEquals(interpreted_before + 2, %WasmNumInterpretedCalls(instance));
-    checkStack(stripPath(stack), [
-      'RuntimeError: unreachable',                       // -
-      '    at foo (<anonymous>:wasm-function[0]:0x27)',  // -
-      '    at main (<anonymous>:wasm-function[1]:0x2c)', // -
-      /^    at testTrap \(interpreter.js:\d+:24\)$/,     // -
-      /^    at interpreter.js:\d+:3$/
-    ]);
-  }
-})();
-
-(function testThrowFromImport() {
-  print(arguments.callee.name);
-  function func() {
-    throw new Error('thrown from imported function');
-  }
-  var builder = new WasmModuleBuilder();
-  builder.addImport("mod", "func", kSig_v_v);
-  builder.addFunction('main', kSig_v_v)
-      .addBody([kExprCallFunction, 0])
-      .exportFunc();
-  var instance = builder.instantiate({mod: {func: func}});
-  // Test that this does not mess up internal state by executing it three times.
-  for (var i = 0; i < 3; ++i) {
-    var interpreted_before = %WasmNumInterpretedCalls(instance);
-    var stack;
-    try {
-      instance.exports.main();
-      assertUnreachable();
-    } catch (e) {
-      stack = e.stack;
-    }
-    assertEquals(interpreted_before + 1, %WasmNumInterpretedCalls(instance));
-    checkStack(stripPath(stack), [
-      'Error: thrown from imported function',                   // -
-      /^    at func \(interpreter.js:\d+:11\)$/,                // -
-      '    at main (<anonymous>:wasm-function[1]:0x32)',        // -
-      /^    at testThrowFromImport \(interpreter.js:\d+:24\)$/, // -
-      /^    at interpreter.js:\d+:3$/
-    ]);
-  }
-})();
-
-(function testGlobals() {
-  print(arguments.callee.name);
-  var builder = new WasmModuleBuilder();
-  builder.addGlobal(kWasmI32, true);  // 0
-  builder.addGlobal(kWasmI64, true);  // 1
-  builder.addGlobal(kWasmF32, true);  // 2
-  builder.addGlobal(kWasmF64, true);  // 3
-  builder.addFunction('get_i32', kSig_i_v)
-      .addBody([kExprGlobalGet, 0])
-      .exportFunc();
-  builder.addFunction('get_i64', kSig_d_v)
-      .addBody([kExprGlobalGet, 1, kExprF64SConvertI64])
-      .exportFunc();
-  builder.addFunction('get_f32', kSig_d_v)
-      .addBody([kExprGlobalGet, 2, kExprF64ConvertF32])
-      .exportFunc();
-  builder.addFunction('get_f64', kSig_d_v)
-      .addBody([kExprGlobalGet, 3])
-      .exportFunc();
-  builder.addFunction('set_i32', kSig_v_i)
-      .addBody([kExprLocalGet, 0, kExprGlobalSet, 0])
-      .exportFunc();
-  builder.addFunction('set_i64', kSig_v_d)
-      .addBody([kExprLocalGet, 0, kExprI64SConvertF64, kExprGlobalSet, 1])
-      .exportFunc();
-  builder.addFunction('set_f32', kSig_v_d)
-      .addBody([kExprLocalGet, 0, kExprF32ConvertF64, kExprGlobalSet, 2])
-      .exportFunc();
-  builder.addFunction('set_f64', kSig_v_d)
-      .addBody([kExprLocalGet, 0, kExprGlobalSet, 3])
-      .exportFunc();
-  var instance = builder.instantiate();
-  // Initially, all should be zero.
-  assertEquals(0, instance.exports.get_i32());
-  assertEquals(0, instance.exports.get_i64());
-  assertEquals(0, instance.exports.get_f32());
-  assertEquals(0, instance.exports.get_f64());
-  // Assign values to all variables.
-  var values = [4711, 1<<40 + 1 << 33, 0.3, 12.34567];
-  instance.exports.set_i32(values[0]);
-  instance.exports.set_i64(values[1]);
-  instance.exports.set_f32(values[2]);
-  instance.exports.set_f64(values[3]);
-  // Now check the values.
-  assertEquals(values[0], instance.exports.get_i32());
-  assertEquals(values[1], instance.exports.get_i64());
-  assertEqualsDelta(values[2], instance.exports.get_f32(), 2**-23);
-  assertEquals(values[3], instance.exports.get_f64());
-})();
-
-(function testReentrantInterpreter() {
-  print(arguments.callee.name);
-  var stacks;
-  var instance;
-  function func(i) {
-    stacks.push(new Error('reentrant interpreter test #' + i).stack);
-    if (i < 2) instance.exports.main(i + 1);
-  }
-
-  var builder = new WasmModuleBuilder();
-  builder.addImport('mod', 'func', kSig_v_i);
-  builder.addFunction('main', kSig_v_i)
-      .addBody([kExprLocalGet, 0, kExprCallFunction, 0])
-      .exportFunc();
-  instance = builder.instantiate({mod: {func: func}});
-  // Test that this does not mess up internal state by executing it three times.
-  for (var i = 0; i < 3; ++i) {
-    var interpreted_before = %WasmNumInterpretedCalls(instance);
-    stacks = [];
-    instance.exports.main(0);
-    assertEquals(interpreted_before + 3, %WasmNumInterpretedCalls(instance));
-    assertEquals(3, stacks.length);
-    for (var e = 0; e < stacks.length; ++e) {
-      expected = ['Error: reentrant interpreter test #' + e];
-      expected.push(/^    at func \(interpreter.js:\d+:17\)$/);
-      expected.push('    at main (<anonymous>:wasm-function[1]:0x36)');
-      for (var k = e; k > 0; --k) {
-        expected.push(/^    at func \(interpreter.js:\d+:33\)$/);
-        expected.push('    at main (<anonymous>:wasm-function[1]:0x36)');
-      }
-      expected.push(
-          /^    at testReentrantInterpreter \(interpreter.js:\d+:22\)$/);
-      expected.push(/    at interpreter.js:\d+:3$/);
-      checkStack(stripPath(stacks[e]), expected);
-    }
-  }
-})();
-
-(function testIndirectImports() {
-  print(arguments.callee.name);
-  var builder = new WasmModuleBuilder();
-
-  var sig_i_ii = builder.addType(kSig_i_ii);
-  var sig_i_i = builder.addType(kSig_i_i);
-  var mul = builder.addImport('q', 'mul', sig_i_ii);
-  var add = builder.addFunction('add', sig_i_ii).addBody([
-    kExprLocalGet, 0, kExprLocalGet, 1, kExprI32Add
-  ]);
-  var mismatch =
-      builder.addFunction('sig_mismatch', sig_i_i).addBody([kExprLocalGet, 0]);
-  var main = builder.addFunction('main', kSig_i_iii)
-                 .addBody([
-                   // Call indirect #0 with args <#1, #2>.
-                   kExprLocalGet, 1, kExprLocalGet, 2, kExprLocalGet, 0,
-                   kExprCallIndirect, sig_i_ii, kTableZero
-                 ])
-                 .exportFunc();
-  builder.appendToTable([mul, add.index, mismatch.index, main.index]);
-
-  var instance = builder.instantiate({q: {mul: (a, b) => a * b}});
-
-  // Call mul.
-  assertEquals(-6, instance.exports.main(0, -2, 3));
-  // Call add.
-  assertEquals(99, instance.exports.main(1, 22, 77));
-  // main and sig_mismatch have another signature.
-  assertTraps(kTrapFuncSigMismatch, () => instance.exports.main(2, 12, 33));
-  assertTraps(kTrapFuncSigMismatch, () => instance.exports.main(3, 12, 33));
-  // Function index 4 does not exist.
-  assertTraps(kTrapFuncInvalid, () => instance.exports.main(4, 12, 33));
-})();
-
-(function testIllegalImports() {
-  print(arguments.callee.name);
-  var builder = new WasmModuleBuilder();
-
-  var sig_l_v = builder.addType(kSig_l_v);
-  var imp = builder.addImport('q', 'imp', sig_l_v);
-  var direct = builder.addFunction('direct', kSig_l_v)
-                   .addBody([kExprCallFunction, imp])
-                   .exportFunc();
-  var indirect = builder.addFunction('indirect', kSig_l_v).addBody([
-    kExprI32Const, 0, kExprCallIndirect, sig_l_v, kTableZero
-  ]);
-  var main =
-      builder.addFunction('main', kSig_v_i)
-          .addBody([
-            // Call indirect #0 with arg #0, drop result.
-            kExprLocalGet, 0, kExprCallIndirect, sig_l_v, kTableZero, kExprDrop
-          ])
-          .exportFunc();
-  builder.appendToTable([imp, direct.index, indirect.index]);
-
-  var instance = builder.instantiate({q: {imp: () => 1}});
-
-  // Calling imported functions with i64 in signature should fail.
-  try {
-    // Via direct call.
-    instance.exports.main(1);
-  } catch (e) {
-    if (!(e instanceof TypeError)) throw e;
-    checkStack(stripPath(e.stack), [
-      'TypeError: ' + kTrapMsgs[kTrapTypeError],               // -
-      '    at direct (<anonymous>:wasm-function[1]:0x55)',     // -
-      '    at main (<anonymous>:wasm-function[3]:0x64)',       // -
-      /^    at testIllegalImports \(interpreter.js:\d+:22\)$/, // -
-      /^    at interpreter.js:\d+:3$/
-    ]);
-  }
-  try {
-    // Via indirect call.
-    instance.exports.main(2);
-  } catch (e) {
-    if (!(e instanceof TypeError)) throw e;
-    checkStack(stripPath(e.stack), [
-      'TypeError: ' + kTrapMsgs[kTrapTypeError],               // -
-      '    at indirect (<anonymous>:wasm-function[2]:0x5c)',   // -
-      '    at main (<anonymous>:wasm-function[3]:0x64)',       // -
-      /^    at testIllegalImports \(interpreter.js:\d+:22\)$/, // -
-      /^    at interpreter.js:\d+:3$/
-    ]);
-  }
-})();
-
-(function testImportExportedFunction() {
-  // See https://crbug.com/860392.
-  print(arguments.callee.name);
-  let instance0 = (() => {
-    let builder = new WasmModuleBuilder();
-    builder.addFunction('f11', kSig_i_v).addBody(wasmI32Const(11)).exportFunc();
-    builder.addFunction('f17', kSig_i_v).addBody(wasmI32Const(17)).exportFunc();
-    return builder.instantiate();
-  })();
-
-  let builder = new WasmModuleBuilder();
-  let sig_i_v = builder.addType(kSig_i_v);
-  let f11_imp = builder.addImport('q', 'f11', sig_i_v);
-  let f17_imp = builder.addImport('q', 'f17', sig_i_v);
-  let add = builder.addFunction('add', sig_i_v).addBody([
-    kExprCallFunction, f11_imp,  // call f11
-    kExprCallFunction, f17_imp,  // call f17
-    kExprI32Add                  // i32.add
-  ]).exportFunc();
-  let instance = builder.instantiate(
-      {q: {f11: instance0.exports.f11, f17: instance0.exports.f17}});
-
-  assertEquals(28, instance.exports.add());
-})();
-
-(function testInfiniteRecursion() {
-  print(arguments.callee.name);
-  var builder = new WasmModuleBuilder();
-
-  var direct = builder.addFunction('main', kSig_v_v)
-                   .addBody([kExprNop, kExprCallFunction, 0])
-                   .exportFunc();
-  var instance = builder.instantiate();
-
-  try {
-    instance.exports.main();
-    assertUnreachable("should throw");
-  } catch (e) {
-    if (!(e instanceof RangeError)) throw e;
-    checkStack(stripPath(e.stack), [
-      'RangeError: Maximum call stack size exceeded',
-      '    at main (<anonymous>:wasm-function[0]:0x20)'
-    ].concat(Array(9).fill('    at main (<anonymous>:wasm-function[0]:0x22)')));
-  }
-})();
-
-(function testUnwindSingleActivation() {
-  print(arguments.callee.name);
-  // Create two activations and unwind just the top one.
-  var builder = new WasmModuleBuilder();
-
-  function MyError(i) {
-    this.i = i;
-  }
-
-  // We call wasm -> func 1 -> wasm -> func2.
-  // func2 throws, func 1 catches.
-  function func1() {
-    try {
-      return instance.exports.foo();
-    } catch (e) {
-      if (!(e instanceof MyError)) throw e;
-      return e.i + 2;
-    }
-  }
-  function func2() {
-    throw new MyError(11);
-  }
-  var imp1 = builder.addImport('mod', 'func1', kSig_i_v);
-  var imp2 = builder.addImport('mod', 'func2', kSig_v_v);
-  builder.addFunction('main', kSig_i_v)
-      .addBody([kExprCallFunction, imp1, kExprI32Const, 2, kExprI32Mul])
-      .exportFunc();
-  builder.addFunction('foo', kSig_v_v)
-      .addBody([kExprCallFunction, imp2])
-      .exportFunc();
-  var instance = builder.instantiate({mod: {func1: func1, func2: func2}});
-
-  var interpreted_before = %WasmNumInterpretedCalls(instance);
-  assertEquals(2 * (11 + 2), instance.exports.main());
-  assertEquals(interpreted_before + 2, %WasmNumInterpretedCalls(instance));
-})();
-
-(function testInterpreterGC() {
-  print(arguments.callee.name);
-  function run(f) {
-    // wrap the creation in a closure so that the only thing returned is
-    // the module (i.e. the underlying array buffer of wasm wire bytes dies).
-    var module = (() => {
-      var builder = new WasmModuleBuilder();
-      var imp = builder.addImport('mod', 'the_name_of_my_import', kSig_i_i);
-      builder.addFunction('main', kSig_i_i)
-          .addBody([kExprLocalGet, 0, kExprCallFunction, imp])
-          .exportAs('main');
-      print('module');
-      return new WebAssembly.Module(builder.toBuffer());
-    })();
-
-    gc();
-    for (var i = 0; i < 10; i++) {
-      print('  instance ' + i);
-      var instance =
-          new WebAssembly.Instance(module, {'mod': {the_name_of_my_import: f}});
-      var g = instance.exports.main;
-      assertEquals('function', typeof g);
-      for (var j = 0; j < 10; j++) {
-        assertEquals(f(j), g(j));
-      }
-    }
-  }
-
-  for (var i = 0; i < 3; i++) {
-    run(x => (x + 19));
-    run(x => (x - 18));
-  }
-})();
-
-(function testImportThrowsOnToNumber() {
-  print(arguments.callee.name);
-  const builder = new WasmModuleBuilder();
-  const imp_idx = builder.addImport('mod', 'func', kSig_i_v);
-  builder.addFunction('main', kSig_i_v)
-      .addBody([kExprCallFunction, imp_idx])
-      .exportFunc();
-  var num_callback_calls = 0;
-  const callback = () => {
-    ++num_callback_calls;
-    return Symbol()
-  };
-  var instance = builder.instantiate({mod: {func: callback}});
-  // Test that this does not mess up internal state by executing it three times.
-  for (var i = 0; i < 3; ++i) {
-    var interpreted_before = %WasmNumInterpretedCalls(instance);
-    assertThrows(
-        () => instance.exports.main(), TypeError,
-        'Cannot convert a Symbol value to a number');
-    assertEquals(interpreted_before + 1, %WasmNumInterpretedCalls(instance));
-    assertEquals(i + 1, num_callback_calls);
-  }
-})();
-
-(function testCallWithMoreReturnsThenParams() {
-  print(arguments.callee.name);
-  const builder1 = new WasmModuleBuilder();
-  builder1.addFunction('exp', kSig_l_v)
-      .addBody([kExprI64Const, 23])
-      .exportFunc();
-  const exp = builder1.instantiate().exports.exp;
-  const builder2 = new WasmModuleBuilder();
-  const imp_idx = builder2.addImport('imp', 'func', kSig_l_v);
-  builder2.addFunction('main', kSig_i_v)
-      .addBody([kExprCallFunction, imp_idx, kExprI32ConvertI64])
-      .exportFunc();
-  const instance = builder2.instantiate({imp: {func: exp}});
-  assertEquals(23, instance.exports.main());
-})();
-
-(function testTableCall() {
-  print(arguments.callee.name);
-  const builder1 = new WasmModuleBuilder();
-  builder1.addFunction('func', kSig_v_v).addBody([]).exportFunc();
-  const instance1 = builder1.instantiate();
-  const table = new WebAssembly.Table({element: 'anyfunc', initial: 2});
-
-  const builder2 = new WasmModuleBuilder()
-  builder2.addImportedTable('m', 'table');
-  const sig = builder2.addType(kSig_v_v);
-  builder2.addFunction('call_func', kSig_v_v)
-      .addBody([kExprI32Const, 0, kExprCallIndirect, sig, kTableZero])
-      .exportFunc();
-  const instance2 = builder2.instantiate({m: {table: table}});
-  table.set(0, instance1.exports.func);
-  instance2.exports.call_func();
-})();
-
-(function testTableCall2() {
-  // See crbug.com/787910.
-  print(arguments.callee.name);
-  const builder1 = new WasmModuleBuilder();
-  builder1.addFunction('exp', kSig_i_i)
-      .addBody([kExprI32Const, 0])
-      .exportFunc();
-  const instance1 = builder1.instantiate();
-  const builder2 = new WasmModuleBuilder();
-  const sig1 = builder2.addType(kSig_i_v);
-  const sig2 = builder2.addType(kSig_i_i);
-  builder2.addFunction('call2', kSig_i_v)
-      .addBody([
-        kExprI32Const, 0, kExprI32Const, 0, kExprCallIndirect, sig2, kTableZero
-      ])
-      .exportAs('call2');
-  builder2.addImportedTable('imp', 'table');
-  const tab = new WebAssembly.Table({
-    element: 'anyfunc',
-    initial: 3,
-  });
-  const instance2 = builder2.instantiate({imp: {table: tab}});
-  tab.set(0, instance1.exports.exp);
-  instance2.exports.call2();
-})();
-
-(function testTableCall3() {
-  // See crbug.com/814562.
-  print(arguments.callee.name);
-  const builder0 = new WasmModuleBuilder();
-  const sig_index = builder0.addType(kSig_i_v);
-  builder0.addFunction('main', kSig_i_i)
-      .addBody([
-        kExprLocalGet, 0,  // --
-        kExprCallIndirect, sig_index, kTableZero
-      ])  // --
-      .exportAs('main');
-  builder0.setTableBounds(3, 3);
-  builder0.addExportOfKind('table', kExternalTable);
-  const module0 = new WebAssembly.Module(builder0.toBuffer());
-  const instance0 = new WebAssembly.Instance(module0);
-
-  const builder1 = new WasmModuleBuilder();
-  builder1.addFunction('main', kSig_i_v).addBody([kExprUnreachable]);
-  builder1.addImportedTable('z', 'table');
-  builder1.addElementSegment(0, 0, false, [0]);
-  const module1 = new WebAssembly.Module(builder1.toBuffer());
-  const instance1 =
-      new WebAssembly.Instance(module1, {z: {table: instance0.exports.table}});
-  assertThrows(
-      () => instance0.exports.main(0), WebAssembly.RuntimeError, 'unreachable');
-})();
-
-(function testSerializeInterpreted() {
-  print(arguments.callee.name);
-  const builder = new WasmModuleBuilder();
-  builder.addFunction('main', kSig_i_i)
-      .addBody([kExprLocalGet, 0, kExprI32Const, 7, kExprI32Add])
-      .exportFunc();
-
-  const wire_bytes = builder.toBuffer();
-  var module = new WebAssembly.Module(wire_bytes);
-  const i1 = new WebAssembly.Instance(module);
-
-  assertEquals(11, i1.exports.main(4));
-
-  const buff = %SerializeWasmModule(module);
-  module = null;
-  gc();
-
-  module = %DeserializeWasmModule(buff, wire_bytes);
-  const i2 = new WebAssembly.Instance(module);
-
-  assertEquals(11, i2.exports.main(4));
-})();
diff --git a/deps/v8/test/mjsunit/wasm/multi-value-interpreter.js b/deps/v8/test/mjsunit/wasm/multi-value-interpreter.js
deleted file mode 100644
index 53f5cfbbde2..00000000000
--- a/deps/v8/test/mjsunit/wasm/multi-value-interpreter.js
+++ /dev/null
@@ -1,7 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --experimental-wasm-mv --wasm-interpret-all
-
-load("test/mjsunit/wasm/multi-value.js");
diff --git a/deps/v8/test/mjsunit/wasm/nullref-interpreter.js b/deps/v8/test/mjsunit/wasm/nullref-interpreter.js
deleted file mode 100644
index f0411394a78..00000000000
--- a/deps/v8/test/mjsunit/wasm/nullref-interpreter.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2020 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --experimental-wasm-anyref -experimental-wasm-eh
-// Flags: --wasm-interpret-all
-
-// This is just a wrapper for an existing reference types test case that runs
-// with the --wasm-interpret-all flag added. If we ever decide to add a test
-// variant for this, then we can remove this file.
-
-load("test/mjsunit/wasm/nullref.js");
diff --git a/deps/v8/test/mjsunit/wasm/streaming-error-position.js b/deps/v8/test/mjsunit/wasm/streaming-error-position.js
index 80a41481aad..50f795f7704 100644
--- a/deps/v8/test/mjsunit/wasm/streaming-error-position.js
+++ b/deps/v8/test/mjsunit/wasm/streaming-error-position.js
@@ -395,5 +395,5 @@ function testErrorPosition(bytes, pos, message) {
   ]);
 
   let pos = bytes.length - 1 - 1;
-  testErrorPositionAsyncOnly(bytes, pos, 'invalid local type');
+  testErrorPositionAsyncOnly(bytes, pos, 'invalid value type');
 })();
diff --git a/deps/v8/test/mjsunit/wasm/table-access-interpreter.js b/deps/v8/test/mjsunit/wasm/table-access-interpreter.js
deleted file mode 100644
index 561ac5aca47..00000000000
--- a/deps/v8/test/mjsunit/wasm/table-access-interpreter.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm --experimental-wasm-anyref
-// Flags: --wasm-interpret-all
-
-// This is just a wrapper for an existing reference types test case that runs
-// with the --wasm-interpret-all flag added. If we ever decide to add a test
-// variant for this, then we can remove this file.
-
-load("test/mjsunit/wasm/table-access.js");
diff --git a/deps/v8/test/mjsunit/wasm/table-fill-interpreter.js b/deps/v8/test/mjsunit/wasm/table-fill-interpreter.js
deleted file mode 100644
index ed9c48b406e..00000000000
--- a/deps/v8/test/mjsunit/wasm/table-fill-interpreter.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm --experimental-wasm-anyref
-// Flags: --wasm-interpret-all
-
-// This is just a wrapper for an existing reference types test case that runs
-// with the --wasm-interpret-all flag added. If we ever decide to add a test
-// variant for this, then we can remove this file.
-
-load("test/mjsunit/wasm/table-fill.js");
diff --git a/deps/v8/test/mjsunit/wasm/table-grow-from-wasm-interpreter.js b/deps/v8/test/mjsunit/wasm/table-grow-from-wasm-interpreter.js
deleted file mode 100644
index 15bbc63a21c..00000000000
--- a/deps/v8/test/mjsunit/wasm/table-grow-from-wasm-interpreter.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm --experimental-wasm-anyref
-// Flags: --wasm-interpret-all
-
-// This is just a wrapper for an existing reference types test case that runs
-// with the --wasm-interpret-all flag added. If we ever decide to add a test
-// variant for this, then we can remove this file.
-
-load("test/mjsunit/wasm/table-grow-from-wasm.js");
diff --git a/deps/v8/test/mjsunit/wasm/typed-funcref.js b/deps/v8/test/mjsunit/wasm/typed-funcref.js
new file mode 100644
index 00000000000..b7e16d6bc99
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/typed-funcref.js
@@ -0,0 +1,38 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-typed-funcref
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// Export an arbitrary function from a Wasm module (identity).
+let foo = (() => {
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('foo', kSig_i_i)
+      .addBody([kExprLocalGet, 0])
+      .exportAs('foo');
+  let module = new WebAssembly.Module(builder.toBuffer());
+  return (new WebAssembly.Instance(builder.toModule())).exports.foo;
+})();
+
+(function TableGrowWithInitializer() {
+  print(arguments.callee.name);
+  var table =
+      new WebAssembly.Table({element: 'anyfunc', initial: 0, maximum: 100});
+
+  table.grow(10);
+  table.grow(10, foo);
+  table.grow(10, null);
+  table.grow(10, undefined);
+
+  for (let i = 0; i < 10; i++) {
+    assertNull(table.get(i));
+  }
+  for (let i = 10; i < 20; i++) {
+    assertEquals(foo, table.get(i));
+  }
+  for (let i = 20; i < 40; i++) {
+    assertNull(table.get(i));
+  }
+})();
diff --git a/deps/v8/test/mjsunit/wasm/wasm-module-builder.js b/deps/v8/test/mjsunit/wasm/wasm-module-builder.js
index 845236cf2e7..5f1b8213ac1 100644
--- a/deps/v8/test/mjsunit/wasm/wasm-module-builder.js
+++ b/deps/v8/test/mjsunit/wasm/wasm-module-builder.js
@@ -468,15 +468,21 @@ let kExprI64AtomicCompareExchange32U = 0x4e;
 
 // Simd opcodes.
 let kExprS128LoadMem = 0x00;
-let kExprS128StoreMem = 0x01;
-let kExprI32x4Splat = 0x0c;
-let kExprF32x4Splat = 0x12;
-let kExprI32x4Eq = 0x2c;
-let kExprS1x8AnyTrue = 0x63;
-let kExprS1x4AllTrue = 0x75;
-let kExprI32x4Add = 0x79;
-let kExprF32x4Min = 0x9e;
-let kExprS8x16LoadSplat = 0xc2;
+let kExprS128StoreMem = 0x0b;
+let kExprS8x16Shuffle = 0x0d;
+let kExprI8x16Splat = 0x0f;
+let kExprI16x8Splat = 0x10;
+let kExprI32x4Splat = 0x11;
+let kExprF32x4Splat = 0x13;
+let kExprI8x16LtU = 0x26;
+let kExprI8x16LeU = 0x2a;
+let kExprI32x4Eq = 0x37;
+let kExprV8x16AnyTrue = 0x62;
+let kExprV8x16AllTrue = 0x63;
+let kExprI8x16Add = 0x6e;
+let kExprI16x8ShrS = [0x8c, 01];
+let kExprV32x4AnyTrue = 0xa2;
+let kExprF32x4Min = 0xe8;
 
 // Compilation hint constants.
 let kCompilationHintStrategyDefault = 0x00;
@@ -484,9 +490,8 @@ let kCompilationHintStrategyLazy = 0x01;
 let kCompilationHintStrategyEager = 0x02;
 let kCompilationHintStrategyLazyBaselineEagerTopTier = 0x03;
 let kCompilationHintTierDefault = 0x00;
-let kCompilationHintTierInterpreter = 0x01;
-let kCompilationHintTierBaseline = 0x02;
-let kCompilationHintTierOptimized = 0x03;
+let kCompilationHintTierBaseline = 0x01;
+let kCompilationHintTierOptimized = 0x02;
 
 let kTrapUnreachable          = 0;
 let kTrapMemOutOfBounds       = 1;
diff --git a/deps/v8/test/mjsunit/wasm/worker-interpreter.js b/deps/v8/test/mjsunit/wasm/worker-interpreter.js
deleted file mode 100644
index 276ff079b56..00000000000
--- a/deps/v8/test/mjsunit/wasm/worker-interpreter.js
+++ /dev/null
@@ -1,68 +0,0 @@
-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --expose-gc
-
-load("test/mjsunit/wasm/wasm-module-builder.js");
-
-(function TestPostInterpretedModule() {
-  let builder = new WasmModuleBuilder();
-  let add = builder.addFunction("add", kSig_i_ii)
-    .addBody([kExprLocalGet, 0, kExprLocalGet, 1, kExprI32Add])
-    .exportFunc();
-
-  // Trigger a GC to ensure that the underlying native module is not a cached
-  // one from a previous run, with functions already redirected to the
-  // interpreter. This is not observable from pure JavaScript, but this is
-  // observable with the internal runtime functions used in this test.
-  gc();
-
-  let module = builder.toModule();
-  let instance = new WebAssembly.Instance(module);
-  let exp = instance.exports;
-
-  let workerScript = `
-    var instance = null;
-    onmessage = function(message) {
-      try {
-        if (message.command == 'module') {
-          instance = new WebAssembly.Instance(message.module);
-          postMessage('OK');
-        }
-        if (message.command == 'call') {
-          let result = instance.exports.add(40, 2);
-          postMessage(result);
-        }
-      } catch(e) {
-        postMessage('ERROR: ' + e);
-      }
-    }
-  `;
-  let worker = new Worker(workerScript, {type: 'string'});
-
-  // Call method without using the interpreter.
-  var initial_interpreted = %WasmNumInterpretedCalls(instance);
-  assertEquals(23, exp.add(20, 3));
-  assertEquals(initial_interpreted + 0, %WasmNumInterpretedCalls(instance));
-
-  // Send module to the worker, still not interpreting.
-  worker.postMessage({ command:'module', module:module });
-  assertEquals('OK', worker.getMessage());
-  worker.postMessage({ command:'call' });
-  assertEquals(42, worker.getMessage());
-  assertEquals(initial_interpreted + 0, %WasmNumInterpretedCalls(instance));
-
-  // Switch to the interpreter and call method.
-  %RedirectToWasmInterpreter(instance, add.index);
-  assertEquals(23, exp.add(20, 3));
-  assertEquals(initial_interpreted + 1, %WasmNumInterpretedCalls(instance));
-
-  // Let worker call interpreted function.
-  worker.postMessage({ command:'call' });
-  assertEquals(42, worker.getMessage());
-  assertEquals(initial_interpreted + 1, %WasmNumInterpretedCalls(instance));
-
-  // All done.
-  worker.terminate();
-})();
diff --git a/deps/v8/test/mkgrokdump/mkgrokdump.cc b/deps/v8/test/mkgrokdump/mkgrokdump.cc
index 8c46e9be0e1..e88d87795cf 100644
--- a/deps/v8/test/mkgrokdump/mkgrokdump.cc
+++ b/deps/v8/test/mkgrokdump/mkgrokdump.cc
@@ -6,10 +6,10 @@
 
 #include "include/libplatform/libplatform.h"
 #include "include/v8.h"
-
 #include "src/execution/frames.h"
 #include "src/execution/isolate.h"
 #include "src/heap/heap-inl.h"
+#include "src/heap/paged-spaces-inl.h"
 #include "src/heap/read-only-heap.h"
 #include "src/heap/spaces.h"
 #include "src/objects/objects-inl.h"
diff --git a/deps/v8/test/mozilla/mozilla.status b/deps/v8/test/mozilla/mozilla.status
index cb556331bd0..37fb66884f3 100644
--- a/deps/v8/test/mozilla/mozilla.status
+++ b/deps/v8/test/mozilla/mozilla.status
@@ -1063,4 +1063,9 @@
   '*': [SKIP],
 }],  # variant == no_wasm_traps
 
+################################################################################
+['variant == stress_snapshot', {
+  '*': [SKIP],  # only relevant for mjsunit tests.
+}],
+
 ]
diff --git a/deps/v8/test/test262/BUILD.gn b/deps/v8/test/test262/BUILD.gn
index 093e489df08..c3d71866d2f 100644
--- a/deps/v8/test/test262/BUILD.gn
+++ b/deps/v8/test/test262/BUILD.gn
@@ -17,6 +17,7 @@ group("v8_test262") {
     "harness-adapt.js",
     "harness-adapt-donotevaluate.js",
     "harness-agent.js",
+    "harness-ishtmldda.js",
     "test262.status",
     "testcfg.py",
     "local-tests/",
diff --git a/deps/v8/test/test262/harness-ishtmldda.js b/deps/v8/test/test262/harness-ishtmldda.js
new file mode 100644
index 00000000000..bcbadf6dc63
--- /dev/null
+++ b/deps/v8/test/test262/harness-ishtmldda.js
@@ -0,0 +1,5 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+$262.IsHTMLDDA = %GetUndetectable();
diff --git a/deps/v8/test/test262/test262.status b/deps/v8/test/test262/test262.status
index c8603bd4fbb..e18082c7ae2 100644
--- a/deps/v8/test/test262/test262.status
+++ b/deps/v8/test/test262/test262.status
@@ -62,16 +62,9 @@
   # https://bugs.chromium.org/p/v8/issues/detail?id=4709
   'language/expressions/assignment/fn-name-lhs-cover': [FAIL],
 
-  # Intl tests which require flags.
-  # https://bugs.chromium.org/p/v8/issues/detail?id=9154
-  'intl402/NumberFormat/numbering-system-options': ['--harmony-intl-add-calendar-numbering-system'],
-  'intl402/DateTimeFormat/constructor-calendar-numberingSystem-order': ['--harmony-intl-add-calendar-numbering-system'],
-  'intl402/DateTimeFormat/numbering-system-calendar-options': ['--harmony-intl-add-calendar-numbering-system'],
-  'intl402/DateTimeFormat/constructor-options-throwing-getters': ['--harmony-intl-add-calendar-numbering-system'],
-  'intl402/NumberFormat/constructor-options-throwing-getters': ['--harmony-intl-add-calendar-numbering-system'],
-  'intl402/NumberFormat/constructor-numberingSystem-order': ['--harmony-intl-add-calendar-numbering-system'],
-  'intl402/DateTimeFormat/prototype/formatToParts/pattern-on-calendar': ['--harmony-intl-other-calendars'],
-  'intl402/DateTimeFormat/prototype/formatToParts/related-year': ['--harmony-intl-other-calendars'],
+  # https://github.com/tc39/test262/issues/2591
+  'intl402/DateTimeFormat/prototype/resolvedOptions/order': ['--no-harmony-intl_dateformat_fractional_second_digits'],
+  'intl402/DateTimeFormat/prototype/resolvedOptions/order-dayPeriod': ['--no-harmony-intl_dateformat_fractional_second_digits'],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=9084
   'intl402/supportedLocalesOf-consistent-with-resolvedOptions': [FAIL],
@@ -364,11 +357,8 @@
   'language/literals/regexp/named-groups/invalid-punctuator-starting-groupspecifier-u': [FAIL_PHASE_ONLY],
   'language/literals/regexp/named-groups/invalid-punctuator-within-groupspecifier': [FAIL_PHASE_ONLY],
   'language/literals/regexp/named-groups/invalid-punctuator-within-groupspecifier-u': [FAIL_PHASE_ONLY],
-  'language/literals/regexp/named-groups/invalid-u-escape-in-groupspecifier': [FAIL_PHASE_ONLY],
-  'language/literals/regexp/named-groups/invalid-u-escape-in-groupspecifier-2': [FAIL_PHASE_ONLY],
   'language/literals/regexp/named-groups/invalid-unterminated-groupspecifier': [FAIL_PHASE_ONLY],
   'language/literals/regexp/named-groups/invalid-unterminated-groupspecifier-u': [FAIL_PHASE_ONLY],
-  'language/literals/regexp/u-dec-esc': [FAIL_PHASE_ONLY],
   'language/literals/regexp/u-invalid-class-escape': [FAIL_PHASE_ONLY],
   'language/literals/regexp/u-invalid-extended-pattern-char': [FAIL_PHASE_ONLY],
   'language/literals/regexp/u-invalid-identity-escape': [FAIL_PHASE_ONLY],
@@ -390,6 +380,106 @@
   'language/literals/regexp/u-unicode-esc-non-hex': [FAIL_PHASE_ONLY],
   'language/literals/regexp/unicode-escape-nls-err': [FAIL_PHASE_ONLY],
 
+  # https://bugs.chromium.org/p/v8/issues/detail?id=10379
+  'built-ins/RegExp/named-groups/non-unicode-property-names-valid': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Alphabetic': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Assigned': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Case_Ignorable': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Cased': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Changes_When_Casefolded': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Changes_When_Casemapped': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Changes_When_Lowercased': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Changes_When_NFKC_Casefolded': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Changes_When_Titlecased': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Changes_When_Uppercased': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Dash': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Diacritic': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Emoji': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Emoji_Modifier_Base': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Emoji_Presentation': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Extended_Pictographic': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Extender': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Cased_Letter': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Dash_Punctuation': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Decimal_Number': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Letter': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Lowercase_Letter': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Mark': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Modifier_Letter': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Modifier_Symbol': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Nonspacing_Mark': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Number': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Letter': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Number': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Punctuation': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Symbol': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Punctuation': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Spacing_Mark': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Symbol': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Uppercase_Letter': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Grapheme_Base': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Grapheme_Extend': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/ID_Continue': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/ID_Start': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Ideographic': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Lowercase': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Arabic': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Armenian': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Bopomofo': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Chakma': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Chorasmian': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Common': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Dives_Akuru': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Han': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Other': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Unassigned': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Inherited': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Khitan_Small_Script': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Latin': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Lisu': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Malayalam': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Newa': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Oriya': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Sharada': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Sinhala': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Syloti_Nagri': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Tangut': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Yezidi': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Arabic': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Bopomofo': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Chakma': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Chorasmian': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Common': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Cyrillic': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Dives_Akuru': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Georgian': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Han': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Inherited': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Khitan_Small_Script': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Latin': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Lisu': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Malayalam': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Newa': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Oriya': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Sharada': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Sinhala': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Syloti_Nagri': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Syriac': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tangut': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Yezidi': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Sentence_Terminal': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Terminal_Punctuation': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Unified_Ideograph': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/Uppercase': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/XID_Continue': [FAIL],
+  'built-ins/RegExp/property-escapes/generated/XID_Start': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=10380
+  'language/identifiers/part-unicode-13.0.0': [FAIL],
+  'language/identifiers/part-unicode-13.0.0-escaped': [FAIL],
+  'language/identifiers/start-unicode-13.0.0': [FAIL],
+  'language/identifiers/start-unicode-13.0.0-escaped': [FAIL],
+
   # https://bugs.chromium.org/p/v8/issues/detail?id=4628
   'language/eval-code/direct/non-definable-function-with-function': [FAIL],
   'language/eval-code/direct/non-definable-function-with-variable': [FAIL],
@@ -451,11 +541,6 @@
   'built-ins/Object/internals/DefineOwnProperty/consistent-value-function-caller': [FAIL_SLOPPY],
   'built-ins/Object/internals/DefineOwnProperty/consistent-value-function-arguments': [FAIL_SLOPPY],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=7184
-  'annexB/language/expressions/yield/star-iterable-return-emulates-undefined-throws-when-called': [FAIL],
-  'annexB/language/statements/for-await-of/iterator-close-return-emulates-undefined-throws-when-called': [FAIL],
-  'annexB/language/statements/for-of/iterator-close-return-emulates-undefined-throws-when-called': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=5690
   'language/expressions/call/eval-spread': [FAIL],
   'language/expressions/call/eval-spread-empty-leading': [FAIL],
@@ -501,23 +586,27 @@
   # https://bugs.chromium.org/p/v8/issues/detail?id=9049
   'language/comments/hashbang/use-strict': [SKIP],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=8179
-  'built-ins/FinalizationRegistry/FinalizationRegistryCleanupIteratorPrototype/next-job-not-active-throws': [FAIL],
-  'built-ins/FinalizationRegistry/prototype/cleanupSome/cleanup-throws-in-callback': [FAIL],
-  'built-ins/FinalizationRegistry/prototype/cleanupSome/poisoned-callback-throws': [FAIL],
-
-  # https://bugs.chromium.org/p/v8/issues/detail?id=10313
-  'built-ins/Date/parse/without-utc-offset': [SKIP],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=9613
   'intl402/Intl/getCanonicalLocales/canonicalized-tags': [FAIL],
   'intl402/Intl/getCanonicalLocales/grandfathered': [FAIL],
-  'intl402/Intl/getCanonicalLocales/non-iana-canon': [FAIL],
   'intl402/Intl/getCanonicalLocales/preferred-grandfathered': [FAIL],
   'intl402/Intl/getCanonicalLocales/preferred-variant': [FAIL],
-  'intl402/Locale/constructor-non-iana-canon': [FAIL],
+  'intl402/Locale/constructor-apply-options-canonicalizes-twice': [FAIL],
   'intl402/Locale/likely-subtags-grandfathered': [FAIL],
 
+  # http://crbug/v8/10447
+  'intl402/Intl/getCanonicalLocales/complex-language-subtag-replacement': [FAIL],
+  'intl402/Intl/getCanonicalLocales/complex-region-subtag-replacement': [FAIL],
+  'intl402/Intl/getCanonicalLocales/transformed-ext-canonical': [FAIL],
+  'intl402/Intl/getCanonicalLocales/transformed-ext-invalid': [FAIL],
+  'intl402/Intl/getCanonicalLocales/unicode-ext-canonicalize-region': [FAIL],
+  'intl402/Intl/getCanonicalLocales/unicode-ext-canonicalize-subdivision': [FAIL],
+  'intl402/Intl/getCanonicalLocales/unicode-ext-canonicalize-yes-to-true': [FAIL],
+  'intl402/Intl/getCanonicalLocales/unicode-ext-key-with-digit': [FAIL],
+
+  # http://crbug/v8/10448
+  'intl402/Locale/prototype/minimize/removing-likely-subtags-first-adds-likely-subtags': [FAIL],
+
   # https://bugs.chromium.org/p/v8/issues/detail?id=9646
   'built-ins/ThrowTypeError/name': [FAIL],
   'language/expressions/class/name': [FAIL],
@@ -528,12 +617,17 @@
   # https://github.com/tc39/test262/pull/2349
   'intl402/Locale/constructor-options-region-valid': [FAIL],
 
+  # http://crbug/v8/10443
+  'intl402/RelativeTimeFormat/prototype/format/pl-pl-style-long': [FAIL],
+  'intl402/RelativeTimeFormat/prototype/format/pl-pl-style-narrow': [FAIL],
+  'intl402/RelativeTimeFormat/prototype/format/pl-pl-style-short': [FAIL],
+  'intl402/RelativeTimeFormat/prototype/formatToParts/pl-pl-style-long': [FAIL],
+  'intl402/RelativeTimeFormat/prototype/formatToParts/pl-pl-style-narrow': [FAIL],
+  'intl402/RelativeTimeFormat/prototype/formatToParts/pl-pl-style-short': [FAIL],
+
   # https://bugs.chromium.org/p/v8/issues/detail?id=9818
   'built-ins/AsyncFunction/proto-from-ctor-realm': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=9808
-  'built-ins/AggregateError/*': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=10111
   # super() should evaluate arguments before checking IsConstructable
   'language/expressions/super/call-proto-not-ctor': [FAIL],
@@ -547,15 +641,80 @@
   'intl402/NumberFormat/prototype/format/signDisplay-ko-KR': [FAIL],
   'intl402/NumberFormat/prototype/format/signDisplay-zh-TW': [FAIL],
   'intl402/NumberFormat/prototype/format/signDisplay-rounding': [FAIL],
+  'intl402/NumberFormat/prototype/format/signDisplay-currency-de-DE': [FAIL],
+  'intl402/NumberFormat/prototype/format/signDisplay-currency-en-US': [FAIL],
+  'intl402/NumberFormat/prototype/format/signDisplay-currency-ja-JP': [FAIL],
+  'intl402/NumberFormat/prototype/format/signDisplay-currency-ko-KR': [FAIL],
+  'intl402/NumberFormat/prototype/format/signDisplay-currency-zh-TW': [FAIL],
   'intl402/NumberFormat/prototype/formatToParts/signDisplay-en-US': [FAIL],
   'intl402/NumberFormat/prototype/formatToParts/signDisplay-de-DE': [FAIL],
   'intl402/NumberFormat/prototype/formatToParts/signDisplay-ja-JP': [FAIL],
   'intl402/NumberFormat/prototype/formatToParts/signDisplay-ko-KR': [FAIL],
   'intl402/NumberFormat/prototype/formatToParts/signDisplay-zh-TW': [FAIL],
-
-  # https://bugs.chromium.org/p/v8/issues/detail?id=10272
-  'intl402/DateTimeFormat/invalid-numbering-system-calendar-options': [FAIL],
-  'intl402/NumberFormat/invalid-numbering-system-options': [FAIL],
+  'intl402/NumberFormat/prototype/formatToParts/signDisplay-currency-de-DE': [FAIL],
+  'intl402/NumberFormat/prototype/formatToParts/signDisplay-currency-en-US': [FAIL],
+  'intl402/NumberFormat/prototype/formatToParts/signDisplay-currency-ja-JP': [FAIL],
+  'intl402/NumberFormat/prototype/formatToParts/signDisplay-currency-ko-KR': [FAIL],
+  'intl402/NumberFormat/prototype/formatToParts/signDisplay-currency-zh-TW': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=10381
+  'built-ins/Array/prototype/concat/arg-length-near-integer-limit': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=10383
+  'built-ins/RegExp/prototype/Symbol.replace/fn-invoke-args-empty-result': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=10395
+  'built-ins/AsyncFromSyncIteratorPrototype/next/absent-value-not-passed': [FAIL],
+  'built-ins/AsyncFromSyncIteratorPrototype/return/absent-value-not-passed': [FAIL],
+
+  # http://crbug/v8/10449
+  'built-ins/Atomics/waitAsync/bad-range': [FAIL],
+  'built-ins/Atomics/waitAsync/descriptor': [FAIL],
+  'built-ins/Atomics/waitAsync/false-for-timeout': [FAIL],
+  'built-ins/Atomics/waitAsync/is-function': [FAIL],
+  'built-ins/Atomics/waitAsync/length': [FAIL],
+  'built-ins/Atomics/waitAsync/name': [FAIL],
+  'built-ins/Atomics/waitAsync/nan-for-timeout-agent': [FAIL],
+  'built-ins/Atomics/waitAsync/negative-index-throws': [FAIL],
+  'built-ins/Atomics/waitAsync/negative-timeout': [FAIL],
+  'built-ins/Atomics/waitAsync/null-for-timeout': [FAIL],
+  'built-ins/Atomics/waitAsync/object-for-timeout': [FAIL],
+  'built-ins/Atomics/waitAsync/poisoned-object-for-timeout-throws-agent': [FAIL],
+  'built-ins/Atomics/waitAsync/returns-result-object-value-is-promise-resolves-to-ok': [FAIL],
+  'built-ins/Atomics/waitAsync/returns-result-object-value-is-promise-resolves-to-timed-out': [FAIL],
+  'built-ins/Atomics/waitAsync/returns-result-object-value-is-string-not-equal': [FAIL],
+  'built-ins/Atomics/waitAsync/returns-result-object-value-is-string-timed-out': [FAIL],
+  'built-ins/Atomics/waitAsync/symbol-for-index-throws': [FAIL],
+  'built-ins/Atomics/waitAsync/symbol-for-index-throws-agent': [FAIL],
+  'built-ins/Atomics/waitAsync/symbol-for-timeout-throws': [FAIL],
+  'built-ins/Atomics/waitAsync/symbol-for-timeout-throws-agent': [FAIL],
+  'built-ins/Atomics/waitAsync/symbol-for-value-throws': [FAIL],
+  'built-ins/Atomics/waitAsync/symbol-for-value-throws-agent': [FAIL],
+  'built-ins/Atomics/waitAsync/true-for-timeout': [FAIL],
+  'built-ins/Atomics/waitAsync/undefined-for-timeout-agent': [FAIL],
+  'built-ins/Atomics/waitAsync/undefined-for-timeout': [FAIL],
+  'built-ins/Atomics/waitAsync/undefined-index-defaults-to-zero-agent': [FAIL],
+  'built-ins/Atomics/waitAsync/value-not-equal': [FAIL],
+  'built-ins/Atomics/waitAsync/waiterlist-block-indexedposition-wake': [FAIL],
+  'built-ins/Atomics/waitAsync/was-woken-before-timeout': [FAIL],
+
+  # SKIP the following TIMEOUT tests instead of FAIL
+  'built-ins/Atomics/waitAsync/false-for-timeout-agent': [SKIP],
+  'built-ins/Atomics/waitAsync/good-views': [SKIP],
+  'built-ins/Atomics/waitAsync/negative-timeout-agent': [SKIP],
+  'built-ins/Atomics/waitAsync/no-spurious-wakeup-no-operation': [SKIP],
+  'built-ins/Atomics/waitAsync/no-spurious-wakeup-on-add': [SKIP],
+  'built-ins/Atomics/waitAsync/no-spurious-wakeup-on-and': [SKIP],
+  'built-ins/Atomics/waitAsync/no-spurious-wakeup-on-compareExchange': [SKIP],
+  'built-ins/Atomics/waitAsync/no-spurious-wakeup-on-exchange': [SKIP],
+  'built-ins/Atomics/waitAsync/no-spurious-wakeup-on-or': [SKIP],
+  'built-ins/Atomics/waitAsync/no-spurious-wakeup-on-store': [SKIP],
+  'built-ins/Atomics/waitAsync/no-spurious-wakeup-on-sub': [SKIP],
+  'built-ins/Atomics/waitAsync/no-spurious-wakeup-on-xor': [SKIP],
+  'built-ins/Atomics/waitAsync/null-for-timeout-agent': [SKIP],
+  'built-ins/Atomics/waitAsync/object-for-timeout-agent': [SKIP],
+  'built-ins/Atomics/waitAsync/true-for-timeout-agent': [SKIP],
+  'built-ins/Atomics/waitAsync/value-not-equal-agent': [SKIP],
 
   ######################## NEEDS INVESTIGATION ###########################
 
@@ -572,7 +731,13 @@
   # https://github.com/tc39/ecma262/pull/889
   'annexB/language/function-code/block-decl-func-skip-arguments': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=6538
+  # Non-simple assignment targets are runtime errors instead of syntax errors for web compat.
+  'language/expressions/logical-assignment/lgcl-or-assignment-operator-non-simple-lhs': [FAIL],
+  'language/expressions/logical-assignment/lgcl-and-assignment-operator-non-simple-lhs': [FAIL],
+  'language/expressions/logical-assignment/lgcl-nullish-assignment-operator-non-simple-lhs': [FAIL],
+
+  # Waiting for Test262 to catch up with the Promise.any proposal modifications
+  'built-ins/NativeErrors/AggregateError/prototype/errors/*': [SKIP],
 
   ############################ INVALID TESTS #############################
 
@@ -630,6 +795,9 @@
   # Unicode regexp case mapping is not available with i18n turned off.
   'language/literals/regexp/u-case-mapping': [SKIP],
 
+  # Unicode in capture group
+  'built-ins/RegExp/prototype/Symbol.replace/named-groups': [FAIL],
+
   # BUG(v8:4437).
   'built-ins/String/prototype/normalize/return-normalized-string': [SKIP],
   'built-ins/String/prototype/normalize/return-normalized-string-from-coerced-form': [SKIP],
@@ -656,7 +824,18 @@
   # Unicode features unavaible without i18n, ie property escapes.
   'built-ins/RegExp/property-escapes/*': [SKIP],
   'built-ins/RegExp/named-groups/unicode-property-names': [SKIP],
+  'built-ins/RegExp/named-groups/unicode-property-names-valid': [SKIP],
   'built-ins/RegExp/match-indices/indices-array-unicode-property-names': [SKIP],
+
+  # Unicode in identifiers
+  'language/identifiers/part-unicode-*': [FAIL],
+  'language/identifiers/start-unicode-1*': [FAIL],
+  'language/identifiers/start-unicode-5*': [FAIL],
+  'language/identifiers/start-unicode-6*': [FAIL],
+  'language/identifiers/start-unicode-7*': [FAIL],
+  'language/identifiers/start-unicode-8*': [FAIL],
+  'language/identifiers/start-unicode-9*': [FAIL],
+
 }],  # no_i18n == True
 
 ['arch == arm or arch == mipsel or arch == mips or arch == arm64 or arch == mips64 or arch == mips64el', {
@@ -719,4 +898,9 @@
   'intl402/DateTimeFormat/prototype/resolvedOptions/basic': [SKIP],
 }],  # system == windows
 
+################################################################################
+['variant == stress_snapshot', {
+  '*': [SKIP],  # only relevant for mjsunit tests.
+}],
+
 ]
diff --git a/deps/v8/test/test262/testcfg.py b/deps/v8/test/test262/testcfg.py
index e1f19563929..9f1d4b4e4e8 100644
--- a/deps/v8/test/test262/testcfg.py
+++ b/deps/v8/test/test262/testcfg.py
@@ -48,22 +48,23 @@
   'Intl.DateTimeFormat-dayPeriod': '--harmony-intl-dateformat-day-period',
   'Intl.DateTimeFormat-quarter': '--harmony-intl-dateformat-quarter',
   'Intl.DateTimeFormat-fractionalSecondDigits': '--harmony-intl-dateformat-fractional-second-digits',
-  'Intl.DisplayNames': '--harmony-intl-displaynames',
   'String.prototype.replaceAll': '--harmony_string_replaceall',
   'Symbol.prototype.description': '--harmony-symbol-description',
   'export-star-as-namespace-from-module': '--harmony-namespace-exports',
   'Promise.allSettled': '--harmony-promise-all-settled',
-  'FinalizationRegistry': '--harmony-weak-refs',
-  'WeakRef': '--harmony-weak-refs',
+  'FinalizationRegistry': '--harmony-weak-refs-with-cleanup-some',
+  'WeakRef': '--harmony-weak-refs-with-cleanup-some',
   'host-gc-required': '--expose-gc-as=v8GC',
-  'optional-chaining': '--harmony-optional-chaining',
+  'IsHTMLDDA': '--allow-natives-syntax',
   'top-level-await': '--harmony-top-level-await',
   'regexp-match-indices': '--harmony-regexp-match-indices',
   # https://github.com/tc39/test262/pull/2395
   'regexp-named-groups': '--harmony-regexp-match-indices',
   'class-methods-private': '--harmony-private-methods',
   'class-static-methods-private': '--harmony-private-methods',
-  'coalesce-expression': '--harmony-nullish',
+  'AggregateError': '--harmony-promise-any',
+  'logical-assignment-operators': '--harmony-logical-assignment',
+  'Promise.any': '--harmony-promise-any',
 }
 
 SKIPPED_FEATURES = set([])
@@ -206,6 +207,8 @@ def _get_files_params(self):
         list(self.suite.harness) +
         ([os.path.join(self.suite.root, "harness-agent.js")]
          if self.__needs_harness_agent() else []) +
+        ([os.path.join(self.suite.root, "harness-ishtmldda.js")]
+         if "IsHTMLDDA" in self.test_record.get("features", []) else []) +
         ([os.path.join(self.suite.root, "harness-adapt-donotevaluate.js")]
          if self.fail_phase_only and not self._fail_phase_reverse else []) +
         self._get_includes() +
diff --git a/deps/v8/test/torque/test-torque.tq b/deps/v8/test/torque/test-torque.tq
index 0693878cce3..09d7e46c250 100644
--- a/deps/v8/test/torque/test-torque.tq
+++ b/deps/v8/test/torque/test-torque.tq
@@ -2,1226 +2,1267 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Test line comment
+/* Test mulitline
+   comment
+*/
+
 namespace test {
-  macro ElementsKindTestHelper1(kind: constexpr ElementsKind): bool {
-    if constexpr (
-        (kind == ElementsKind::UINT8_ELEMENTS) ||
-        (kind == ElementsKind::UINT16_ELEMENTS)) {
-      return true;
-    } else {
-      return false;
-    }
+macro ElementsKindTestHelper1(kind: constexpr ElementsKind): bool {
+  if constexpr (
+      (kind == ElementsKind::UINT8_ELEMENTS) ||
+      (kind == ElementsKind::UINT16_ELEMENTS)) {
+    return true;
+  } else {
+    return false;
   }
+}
 
-  macro ElementsKindTestHelper2(kind: constexpr ElementsKind): constexpr bool {
-    return (
-        (kind == ElementsKind::UINT8_ELEMENTS) ||
-        (kind == ElementsKind::UINT16_ELEMENTS));
-  }
+macro ElementsKindTestHelper2(kind: constexpr ElementsKind): constexpr bool {
+  return (
+      (kind == ElementsKind::UINT8_ELEMENTS) ||
+      (kind == ElementsKind::UINT16_ELEMENTS));
+}
 
-  macro LabelTestHelper1(): never
-      labels Label1 {
-    goto Label1;
-  }
+macro LabelTestHelper1(): never
+    labels Label1 {
+  goto Label1;
+}
 
-  macro LabelTestHelper2(): never
-      labels Label2(Smi) {
-    goto Label2(42);
-  }
+macro LabelTestHelper2(): never
+    labels Label2(Smi) {
+  goto Label2(42);
+}
 
-  macro LabelTestHelper3(): never
-      labels Label3(Oddball, Smi) {
-    goto Label3(Null, 7);
-  }
+macro LabelTestHelper3(): never
+    labels Label3(Oddball, Smi) {
+  goto Label3(Null, 7);
+}
 
-  @export
-  macro TestConstexpr1() {
-    check(FromConstexpr<bool>(
-        IsFastElementsKind(ElementsKind::PACKED_SMI_ELEMENTS)));
-  }
+@export
+macro TestConstexpr1() {
+  check(FromConstexpr<bool>(
+      IsFastElementsKind(ElementsKind::PACKED_SMI_ELEMENTS)));
+}
 
-  @export
-  macro TestConstexprIf() {
-    check(ElementsKindTestHelper1(ElementsKind::UINT8_ELEMENTS));
-    check(ElementsKindTestHelper1(ElementsKind::UINT16_ELEMENTS));
-    check(!ElementsKindTestHelper1(ElementsKind::UINT32_ELEMENTS));
-  }
+@export
+macro TestConstexprIf() {
+  check(ElementsKindTestHelper1(ElementsKind::UINT8_ELEMENTS));
+  check(ElementsKindTestHelper1(ElementsKind::UINT16_ELEMENTS));
+  check(!ElementsKindTestHelper1(ElementsKind::UINT32_ELEMENTS));
+}
 
-  @export
-  macro TestConstexprReturn() {
-    check(FromConstexpr<bool>(
-        ElementsKindTestHelper2(ElementsKind::UINT8_ELEMENTS)));
-    check(FromConstexpr<bool>(
-        ElementsKindTestHelper2(ElementsKind::UINT16_ELEMENTS)));
-    check(!FromConstexpr<bool>(
-        ElementsKindTestHelper2(ElementsKind::UINT32_ELEMENTS)));
-    check(FromConstexpr<bool>(
-        !ElementsKindTestHelper2(ElementsKind::UINT32_ELEMENTS)));
-  }
+@export
+macro TestConstexprReturn() {
+  check(FromConstexpr<bool>(
+      ElementsKindTestHelper2(ElementsKind::UINT8_ELEMENTS)));
+  check(FromConstexpr<bool>(
+      ElementsKindTestHelper2(ElementsKind::UINT16_ELEMENTS)));
+  check(!FromConstexpr<bool>(
+      ElementsKindTestHelper2(ElementsKind::UINT32_ELEMENTS)));
+  check(FromConstexpr<bool>(
+      !ElementsKindTestHelper2(ElementsKind::UINT32_ELEMENTS)));
+}
 
-  @export
-  macro TestGotoLabel(): Boolean {
-    try {
-      LabelTestHelper1() otherwise Label1;
-    }
-    label Label1 {
-      return True;
-    }
+@export
+macro TestGotoLabel(): Boolean {
+  try {
+    LabelTestHelper1() otherwise Label1;
+  } label Label1 {
+    return True;
   }
+}
 
-  @export
-  macro TestGotoLabelWithOneParameter(): Boolean {
-    try {
-      LabelTestHelper2() otherwise Label2;
-    }
-    label Label2(smi: Smi) {
-      check(smi == 42);
-      return True;
-    }
+@export
+macro TestGotoLabelWithOneParameter(): Boolean {
+  try {
+    LabelTestHelper2() otherwise Label2;
+  } label Label2(smi: Smi) {
+    check(smi == 42);
+    return True;
   }
+}
 
-  @export
-  macro TestGotoLabelWithTwoParameters(): Boolean {
-    try {
-      LabelTestHelper3() otherwise Label3;
-    }
-    label Label3(o: Oddball, smi: Smi) {
-      check(o == Null);
-      check(smi == 7);
-      return True;
-    }
+@export
+macro TestGotoLabelWithTwoParameters(): Boolean {
+  try {
+    LabelTestHelper3() otherwise Label3;
+  } label Label3(o: Oddball, smi: Smi) {
+    check(o == Null);
+    check(smi == 7);
+    return True;
   }
+}
 
-  builtin GenericBuiltinTest<T: type>(_c: Context, _param: T): JSAny {
-    return Null;
-  }
+builtin GenericBuiltinTest<T: type>(_param: T): JSAny {
+  return Null;
+}
 
-  GenericBuiltinTest<JSAny>(_c: Context, param: JSAny): JSAny {
-    return param;
-  }
+GenericBuiltinTest<JSAny>(param: JSAny): JSAny {
+  return param;
+}
 
-  @export
-  macro TestBuiltinSpecialization(c: Context) {
-    check(GenericBuiltinTest<Smi>(c, 0) == Null);
-    check(GenericBuiltinTest<Smi>(c, 1) == Null);
-    check(GenericBuiltinTest<JSAny>(c, Undefined) == Undefined);
-    check(GenericBuiltinTest<JSAny>(c, Undefined) == Undefined);
-  }
+@export
+macro TestBuiltinSpecialization() {
+  check(GenericBuiltinTest<Smi>(0) == Null);
+  check(GenericBuiltinTest<Smi>(1) == Null);
+  check(GenericBuiltinTest<JSAny>(Undefined) == Undefined);
+  check(GenericBuiltinTest<JSAny>(Undefined) == Undefined);
+}
 
-  macro LabelTestHelper4(flag: constexpr bool): never
-      labels Label4, Label5 {
-    if constexpr (flag) {
-      goto Label4;
-    } else {
-      goto Label5;
-    }
+macro LabelTestHelper4(flag: constexpr bool): never
+    labels Label4, Label5 {
+  if constexpr (flag) {
+    goto Label4;
+  } else {
+    goto Label5;
   }
+}
 
-  macro CallLabelTestHelper4(flag: constexpr bool): bool {
-    try {
-      LabelTestHelper4(flag) otherwise Label4, Label5;
-    }
-    label Label4 {
-      return true;
-    }
-    label Label5 {
-      return false;
-    }
+macro CallLabelTestHelper4(flag: constexpr bool): bool {
+  try {
+    LabelTestHelper4(flag) otherwise Label4, Label5;
+  } label Label4 {
+    return true;
+  } label Label5 {
+    return false;
   }
+}
 
-  @export
-  macro TestPartiallyUnusedLabel(): Boolean {
-    const r1: bool = CallLabelTestHelper4(true);
-    const r2: bool = CallLabelTestHelper4(false);
+@export
+macro TestPartiallyUnusedLabel(): Boolean {
+  const r1: bool = CallLabelTestHelper4(true);
+  const r2: bool = CallLabelTestHelper4(false);
 
-    if (r1 && !r2) {
-      return True;
-    } else {
-      return False;
-    }
+  if (r1 && !r2) {
+    return True;
+  } else {
+    return False;
   }
+}
 
-  macro GenericMacroTest<T: type>(_param: T): Object {
-    return Undefined;
-  }
+macro GenericMacroTest<T: type>(_param: T): Object {
+  return Undefined;
+}
 
-  GenericMacroTest<Object>(param2: Object): Object {
-    return param2;
-  }
+GenericMacroTest<Object>(param2: Object): Object {
+  return param2;
+}
 
-  macro GenericMacroTestWithLabels<T: type>(_param: T): Object
-  labels _X {
-    return Undefined;
-  }
+macro GenericMacroTestWithLabels<T: type>(_param: T): Object
+labels _X {
+  return Undefined;
+}
 
-  GenericMacroTestWithLabels<Object>(param2: Object): Object
-      labels Y {
-    return Cast<Smi>(param2) otherwise Y;
-  }
+GenericMacroTestWithLabels<Object>(param2: Object): Object
+    labels Y {
+  return Cast<Smi>(param2) otherwise Y;
+}
 
-  @export
-  macro TestMacroSpecialization() {
+@export
+macro TestMacroSpecialization() {
+  try {
+    const _smi0: Smi = 0;
+    check(GenericMacroTest<Smi>(0) == Undefined);
+    check(GenericMacroTest<Smi>(1) == Undefined);
+    check(GenericMacroTest<Object>(Null) == Null);
+    check(GenericMacroTest<Object>(False) == False);
+    check(GenericMacroTest<Object>(True) == True);
+    check((GenericMacroTestWithLabels<Smi>(0) otherwise Fail) == Undefined);
+    check((GenericMacroTestWithLabels<Smi>(0) otherwise Fail) == Undefined);
     try {
-      const _smi0: Smi = 0;
-      check(GenericMacroTest<Smi>(0) == Undefined);
-      check(GenericMacroTest<Smi>(1) == Undefined);
-      check(GenericMacroTest<Object>(Null) == Null);
-      check(GenericMacroTest<Object>(False) == False);
-      check(GenericMacroTest<Object>(True) == True);
-      check((GenericMacroTestWithLabels<Smi>(0) otherwise Fail) == Undefined);
-      check((GenericMacroTestWithLabels<Smi>(0) otherwise Fail) == Undefined);
-      try {
-        GenericMacroTestWithLabels<Object>(False) otherwise Expected;
-      }
-      label Expected {}
-    }
-    label Fail {
-      unreachable;
-    }
+      GenericMacroTestWithLabels<Object>(False) otherwise Expected;
+    } label Expected {}
+  } label Fail {
+    unreachable;
   }
+}
 
-  builtin TestHelperPlus1(_context: Context, x: Smi): Smi {
-    return x + 1;
-  }
-  builtin TestHelperPlus2(_context: Context, x: Smi): Smi {
-    return x + 2;
-  }
+builtin TestHelperPlus1(x: Smi): Smi {
+  return x + 1;
+}
+builtin TestHelperPlus2(x: Smi): Smi {
+  return x + 2;
+}
 
-  @export
-  macro TestFunctionPointers(implicit context: Context)(): Boolean {
-    let fptr: builtin(Context, Smi) => Smi = TestHelperPlus1;
-    check(fptr(context, 42) == 43);
-    fptr = TestHelperPlus2;
-    check(fptr(context, 42) == 44);
-    return True;
-  }
+@export
+macro TestFunctionPointers(implicit context: Context)(): Boolean {
+  let fptr: builtin(Smi) => Smi = TestHelperPlus1;
+  check(fptr(42) == 43);
+  fptr = TestHelperPlus2;
+  check(fptr(42) == 44);
+  return True;
+}
 
-  @export
-  macro TestVariableRedeclaration(implicit context: Context)(): Boolean {
-    let _var1: int31 = FromConstexpr<bool>(42 == 0) ? 0 : 1;
-    let _var2: int31 = FromConstexpr<bool>(42 == 0) ? 1 : 0;
-    return True;
-  }
+@export
+macro TestVariableRedeclaration(implicit context: Context)(): Boolean {
+  let _var1: int31 = FromConstexpr<bool>(42 == 0) ? 0 : 1;
+  let _var2: int31 = FromConstexpr<bool>(42 == 0) ? 1 : 0;
+  return True;
+}
 
-  @export
-  macro TestTernaryOperator(x: Smi): Smi {
-    const b: bool = x < 0 ? true : false;
-    return b ? x - 10 : x + 100;
-  }
+@export
+macro TestTernaryOperator(x: Smi): Smi {
+  const b: bool = x < 0 ? true : false;
+  return b ? x - 10 : x + 100;
+}
 
-  @export
-  macro TestFunctionPointerToGeneric(c: Context) {
-    const fptr1: builtin(Context, Smi) => JSAny = GenericBuiltinTest<Smi>;
-    const fptr2: builtin(Context, JSAny) => JSAny = GenericBuiltinTest<JSAny>;
+@export
+macro TestFunctionPointerToGeneric() {
+  const fptr1: builtin(Smi) => JSAny = GenericBuiltinTest<Smi>;
+  const fptr2: builtin(JSAny) => JSAny = GenericBuiltinTest<JSAny>;
 
-    check(fptr1(c, 0) == Null);
-    check(fptr1(c, 1) == Null);
-    check(fptr2(c, Undefined) == Undefined);
-    check(fptr2(c, Undefined) == Undefined);
-  }
+  check(fptr1(0) == Null);
+  check(fptr1(1) == Null);
+  check(fptr2(Undefined) == Undefined);
+  check(fptr2(Undefined) == Undefined);
+}
 
-  type ObjectToObject = builtin(Context, JSAny) => JSAny;
-  @export
-  macro TestTypeAlias(x: ObjectToObject): BuiltinPtr {
-    return x;
-  }
+type ObjectToObject = builtin(Context, JSAny) => JSAny;
+@export
+macro TestTypeAlias(x: ObjectToObject): BuiltinPtr {
+  return x;
+}
 
-  @export
-  macro TestUnsafeCast(implicit context: Context)(n: Number): Boolean {
-    if (TaggedIsSmi(n)) {
-      const m: Smi = UnsafeCast<Smi>(n);
+@export
+macro TestUnsafeCast(implicit context: Context)(n: Number): Boolean {
+  if (TaggedIsSmi(n)) {
+    const m: Smi = UnsafeCast<Smi>(n);
 
-      check(TestHelperPlus1(context, m) == 11);
-      return True;
-    }
-    return False;
+    check(TestHelperPlus1(m) == 11);
+    return True;
   }
+  return False;
+}
 
-  @export
-  macro TestHexLiteral() {
-    check(Convert<intptr>(0xffff) + 1 == 0x10000);
-    check(Convert<intptr>(-0xffff) == -65535);
-  }
+@export
+macro TestHexLiteral() {
+  check(Convert<intptr>(0xffff) + 1 == 0x10000);
+  check(Convert<intptr>(-0xffff) == -65535);
+}
 
-  @export
-  macro TestLargeIntegerLiterals(implicit c: Context)() {
-    let _x: int32 = 0x40000000;
-    let _y: int32 = 0x7fffffff;
-  }
+@export
+macro TestLargeIntegerLiterals(implicit c: Context)() {
+  let _x: int32 = 0x40000000;
+  let _y: int32 = 0x7fffffff;
+}
 
-  @export
-  macro TestMultilineAssert() {
-    const someVeryLongVariableNameThatWillCauseLineBreaks: Smi = 5;
-    check(
-        someVeryLongVariableNameThatWillCauseLineBreaks > 0 &&
-        someVeryLongVariableNameThatWillCauseLineBreaks < 10);
-  }
+@export
+macro TestMultilineAssert() {
+  const someVeryLongVariableNameThatWillCauseLineBreaks: Smi = 5;
+  check(
+      someVeryLongVariableNameThatWillCauseLineBreaks > 0 &&
+      someVeryLongVariableNameThatWillCauseLineBreaks < 10);
+}
 
-  @export
-  macro TestNewlineInString() {
-    Print('Hello, World!\n');
-  }
+@export
+macro TestNewlineInString() {
+  Print('Hello, World!\n');
+}
 
-  const kConstexprConst: constexpr int31 = 5;
-  const kIntptrConst: intptr = 4;
-  const kSmiConst: Smi = 3;
+const kConstexprConst: constexpr int31 = 5;
+const kIntptrConst: intptr = 4;
+const kSmiConst: Smi = 3;
 
-  @export
-  macro TestModuleConstBindings() {
-    check(kConstexprConst == Int32Constant(5));
-    check(kIntptrConst == 4);
-    check(kSmiConst == 3);
-  }
+@export
+macro TestModuleConstBindings() {
+  check(kConstexprConst == Int32Constant(5));
+  check(kIntptrConst == 4);
+  check(kSmiConst == 3);
+}
 
-  @export
-  macro TestLocalConstBindings() {
-    const x: constexpr int31 = 3;
+@export
+macro TestLocalConstBindings() {
+  const x: constexpr int31 = 3;
+  const xSmi: Smi = x;
+  {
+    const x: Smi = x + FromConstexpr<Smi>(1);
+    check(x == xSmi + 1);
     const xSmi: Smi = x;
-    {
-      const x: Smi = x + FromConstexpr<Smi>(1);
-      check(x == xSmi + 1);
-      const xSmi: Smi = x;
-      check(x == xSmi);
-      check(x == 4);
-    }
-    check(xSmi == 3);
     check(x == xSmi);
+    check(x == 4);
   }
+  check(xSmi == 3);
+  check(x == xSmi);
+}
 
-  struct TestStructA {
-    indexes: FixedArray;
-    i: Smi;
-    k: Number;
-  }
+struct TestStructA {
+  indexes: FixedArray;
+  i: Smi;
+  k: Number;
+}
 
-  struct TestStructB {
-    x: TestStructA;
-    y: Smi;
-  }
+struct TestStructB {
+  x: TestStructA;
+  y: Smi;
+}
 
-  @export
-  macro TestStruct1(i: TestStructA): Smi {
-    return i.i;
-  }
+@export
+macro TestStruct1(i: TestStructA): Smi {
+  return i.i;
+}
 
-  @export
-  macro TestStruct2(implicit context: Context)(): TestStructA {
-    return TestStructA{
-      indexes: UnsafeCast<FixedArray>(kEmptyFixedArray),
-      i: 27,
-      k: 31
-    };
-  }
+@export
+macro TestStruct2(implicit context: Context)(): TestStructA {
+  return TestStructA{
+    indexes: UnsafeCast<FixedArray>(kEmptyFixedArray),
+    i: 27,
+    k: 31
+  };
+}
 
-  @export
-  macro TestStruct3(implicit context: Context)(): TestStructA {
-    let a: TestStructA =
-    TestStructA{indexes: UnsafeCast<FixedArray>(kEmptyFixedArray), i: 13, k: 5};
-    let _b: TestStructA = a;
-    const c: TestStructA = TestStruct2();
-    a.i = TestStruct1(c);
-    a.k = a.i;
-    let d: TestStructB;
-    d.x = a;
-    d = TestStructB{x: a, y: 7};
-    let _e: TestStructA = d.x;
-    let f: Smi = TestStructA{
-      indexes: UnsafeCast<FixedArray>(kEmptyFixedArray),
-      i: 27,
-      k: 31
-    }.i;
-    f = TestStruct2().i;
-    return a;
-  }
+@export
+macro TestStruct3(implicit context: Context)(): TestStructA {
+  let a: TestStructA =
+  TestStructA{indexes: UnsafeCast<FixedArray>(kEmptyFixedArray), i: 13, k: 5};
+  let _b: TestStructA = a;
+  const c: TestStructA = TestStruct2();
+  a.i = TestStruct1(c);
+  a.k = a.i;
+  let d: TestStructB;
+  d.x = a;
+  d = TestStructB{x: a, y: 7};
+  let _e: TestStructA = d.x;
+  let f: Smi = TestStructA{
+    indexes: UnsafeCast<FixedArray>(kEmptyFixedArray),
+    i: 27,
+    k: 31
+  }.i;
+  f = TestStruct2().i;
+  return a;
+}
 
-  struct TestStructC {
-    x: TestStructA;
-    y: TestStructA;
-  }
+struct TestStructC {
+  x: TestStructA;
+  y: TestStructA;
+}
 
-  @export
-  macro TestStruct4(implicit context: Context)(): TestStructC {
-    return TestStructC{x: TestStruct2(), y: TestStruct2()};
-  }
+@export
+macro TestStruct4(implicit context: Context)(): TestStructC {
+  return TestStructC{x: TestStruct2(), y: TestStruct2()};
+}
 
-  macro TestStructInLabel(implicit context: Context)(): never labels
-  Foo(TestStructA) {
-    goto Foo(TestStruct2());
-  }
-  @export  // Silence unused warning.
-  macro CallTestStructInLabel(implicit context: Context)() {
-    try {
-      TestStructInLabel() otherwise Foo;
+macro TestStructInLabel(implicit context: Context)(): never labels
+Foo(TestStructA) {
+  goto Foo(TestStruct2());
+}
+@export  // Silence unused warning.
+macro CallTestStructInLabel(implicit context: Context)() {
+  try {
+    TestStructInLabel() otherwise Foo;
+  } label Foo(_s: TestStructA) {}
+}
+
+// This macro tests different versions of the for-loop where some parts
+// are (not) present.
+@export
+macro TestForLoop() {
+  let sum: Smi = 0;
+  for (let i: Smi = 0; i < 5; ++i) sum += i;
+  check(sum == 10);
+
+  sum = 0;
+  let j: Smi = 0;
+  for (; j < 5; ++j) sum += j;
+  check(sum == 10);
+
+  sum = 0;
+  j = 0;
+  for (; j < 5;) sum += j++;
+  check(sum == 10);
+
+  // Check that break works. No test expression.
+  sum = 0;
+  for (let i: Smi = 0;; ++i) {
+    if (i == 5) break;
+    sum += i;
+  }
+  check(sum == 10);
+
+  sum = 0;
+  j = 0;
+  for (;;) {
+    if (j == 5) break;
+    sum += j;
+    j++;
+  }
+  check(sum == 10);
+
+  // The following tests are the same as above, but use continue to skip
+  // index 3.
+  sum = 0;
+  for (let i: Smi = 0; i < 5; ++i) {
+    if (i == 3) continue;
+    sum += i;
+  }
+  check(sum == 7);
+
+  sum = 0;
+  j = 0;
+  for (; j < 5; ++j) {
+    if (j == 3) continue;
+    sum += j;
+  }
+  check(sum == 7);
+
+  sum = 0;
+  j = 0;
+  for (; j < 5;) {
+    if (j == 3) {
+      j++;
+      continue;
     }
-    label Foo(_s: TestStructA) {}
+    sum += j;
+    j++;
   }
+  check(sum == 7);
 
-  // This macro tests different versions of the for-loop where some parts
-  // are (not) present.
-  @export
-  macro TestForLoop() {
-    let sum: Smi = 0;
-    for (let i: Smi = 0; i < 5; ++i) sum += i;
-    check(sum == 10);
-
-    sum = 0;
-    let j: Smi = 0;
-    for (; j < 5; ++j) sum += j;
-    check(sum == 10);
-
-    sum = 0;
-    j = 0;
-    for (; j < 5;) sum += j++;
-    check(sum == 10);
-
-    // Check that break works. No test expression.
-    sum = 0;
-    for (let i: Smi = 0;; ++i) {
-      if (i == 5) break;
-      sum += i;
-    }
-    check(sum == 10);
+  sum = 0;
+  for (let i: Smi = 0;; ++i) {
+    if (i == 3) continue;
+    if (i == 5) break;
+    sum += i;
+  }
+  check(sum == 7);
 
-    sum = 0;
-    j = 0;
-    for (;;) {
-      if (j == 5) break;
-      sum += j;
+  sum = 0;
+  j = 0;
+  for (;;) {
+    if (j == 3) {
       j++;
+      continue;
     }
-    check(sum == 10);
-
-    // The following tests are the same as above, but use continue to skip
-    // index 3.
-    sum = 0;
-    for (let i: Smi = 0; i < 5; ++i) {
-      if (i == 3) continue;
-      sum += i;
-    }
-    check(sum == 7);
 
-    sum = 0;
-    j = 0;
-    for (; j < 5; ++j) {
-      if (j == 3) continue;
-      sum += j;
-    }
-    check(sum == 7);
-
-    sum = 0;
-    j = 0;
-    for (; j < 5;) {
-      if (j == 3) {
-        j++;
-        continue;
-      }
-      sum += j;
-      j++;
-    }
-    check(sum == 7);
+    if (j == 5) break;
+    sum += j;
+    j++;
+  }
+  check(sum == 7);
 
-    sum = 0;
-    for (let i: Smi = 0;; ++i) {
-      if (i == 3) continue;
-      if (i == 5) break;
-      sum += i;
+  j = 0;
+  try {
+    for (;;) {
+      if (++j == 10) goto Exit;
     }
-    check(sum == 7);
+  } label Exit {
+    check(j == 10);
+  }
 
-    sum = 0;
-    j = 0;
-    for (;;) {
-      if (j == 3) {
-        j++;
-        continue;
-      }
+  // Test if we can handle uninitialized values on the stack.
+  let _i: Smi;
+  for (let j: Smi = 0; j < 10; ++j) {
+  }
+}
 
-      if (j == 5) break;
-      sum += j;
-      j++;
-    }
-    check(sum == 7);
+@export
+macro TestSubtyping(x: Smi) {
+  const _foo: JSAny = x;
+}
 
-    j = 0;
-    try {
-      for (;;) {
-        if (++j == 10) goto Exit;
-      }
+macro IncrementIfSmi<A: type>(x: A): A {
+  typeswitch (x) {
+    case (x: Smi): {
+      return x + 1;
     }
-    label Exit {
-      check(j == 10);
+    case (o: A): {
+      return o;
     }
+  }
+}
 
-    // Test if we can handle uninitialized values on the stack.
-    let _i: Smi;
-    for (let j: Smi = 0; j < 10; ++j) {
+type NumberOrFixedArray = Number|FixedArray;
+macro TypeswitchExample(implicit context: Context)(x: NumberOrFixedArray):
+    int32 {
+  let result: int32 = 0;
+  typeswitch (IncrementIfSmi(x)) {
+    case (_x: FixedArray): {
+      result = result + 1;
+    }
+    case (Number): {
+      result = result + 2;
     }
   }
 
-  @export
-  macro TestSubtyping(x: Smi) {
-    const _foo: JSAny = x;
-  }
+  result = result * 10;
 
-  macro IncrementIfSmi<A: type>(x: A): A {
-    typeswitch (x) {
-      case (x: Smi): {
-        return x + 1;
-      }
-      case (o: A): {
-        return o;
-      }
+  typeswitch (IncrementIfSmi(x)) {
+    case (x: Smi): {
+      result = result + Convert<int32>(x);
     }
-  }
-
-  type NumberOrFixedArray = Number|FixedArray;
-  macro TypeswitchExample(implicit context: Context)(x: NumberOrFixedArray):
-      int32 {
-    let result: int32 = 0;
-    typeswitch (IncrementIfSmi(x)) {
-      case (_x: FixedArray): {
-        result = result + 1;
-      }
-      case (Number): {
-        result = result + 2;
-      }
+    case (a: FixedArray): {
+      result = result + Convert<int32>(a.length);
     }
-
-    result = result * 10;
-
-    typeswitch (IncrementIfSmi(x)) {
-      case (x: Smi): {
-        result = result + Convert<int32>(x);
-      }
-      case (a: FixedArray): {
-        result = result + Convert<int32>(a.length);
-      }
-      case (_x: HeapNumber): {
-        result = result + 7;
-      }
+    case (_x: HeapNumber): {
+      result = result + 7;
     }
-
-    return result;
   }
 
-  @export
-  macro TestTypeswitch(implicit context: Context)() {
-    check(TypeswitchExample(FromConstexpr<Smi>(5)) == 26);
-    const a: FixedArray = AllocateZeroedFixedArray(3);
-    check(TypeswitchExample(a) == 13);
-    check(TypeswitchExample(FromConstexpr<Number>(0.5)) == 27);
-  }
+  return result;
+}
 
-  @export
-  macro TestTypeswitchAsanLsanFailure(implicit context: Context)(obj: Object) {
-    typeswitch (obj) {
-      case (_o: Smi): {
-      }
-      case (_o: JSTypedArray): {
-      }
-      case (_o: JSReceiver): {
-      }
-      case (_o: HeapObject): {
-      }
-    }
-  }
+@export
+macro TestTypeswitch(implicit context: Context)() {
+  check(TypeswitchExample(FromConstexpr<Smi>(5)) == 26);
+  const a: FixedArray = AllocateZeroedFixedArray(3);
+  check(TypeswitchExample(a) == 13);
+  check(TypeswitchExample(FromConstexpr<Number>(0.5)) == 27);
+}
 
-  macro ExampleGenericOverload<A: type>(o: Object): A {
-    return o;
-  }
-  macro ExampleGenericOverload<A: type>(o: Smi): A {
-    return o + 1;
+@export
+macro TestTypeswitchAsanLsanFailure(implicit context: Context)(obj: Object) {
+  typeswitch (obj) {
+    case (_o: Smi): {
+    }
+    case (_o: JSTypedArray): {
+    }
+    case (_o: JSReceiver): {
+    }
+    case (_o: HeapObject): {
+    }
   }
+}
 
-  @export
-  macro TestGenericOverload(implicit context: Context)() {
-    const xSmi: Smi = 5;
-    const xObject: Object = xSmi;
-    check(ExampleGenericOverload<Smi>(xSmi) == 6);
-    check(UnsafeCast<Smi>(ExampleGenericOverload<Object>(xObject)) == 5);
-  }
+macro ExampleGenericOverload<A: type>(o: Object): A {
+  return o;
+}
+macro ExampleGenericOverload<A: type>(o: Smi): A {
+  return o + 1;
+}
 
-  @export
-  macro TestEquality(implicit context: Context)() {
-    const notEqual: bool =
-        AllocateHeapNumberWithValue(0.5) != AllocateHeapNumberWithValue(0.5);
-    check(!notEqual);
-    const equal: bool =
-        AllocateHeapNumberWithValue(0.5) == AllocateHeapNumberWithValue(0.5);
-    check(equal);
-  }
+@export
+macro TestGenericOverload(implicit context: Context)() {
+  const xSmi: Smi = 5;
+  const xObject: Object = xSmi;
+  check(ExampleGenericOverload<Smi>(xSmi) == 6);
+  check(UnsafeCast<Smi>(ExampleGenericOverload<Object>(xObject)) == 5);
+}
 
-  @export
-  macro TestOrAnd(x: bool, y: bool, z: bool): bool {
-    return x || y && z ? true : false;
-  }
+@export
+macro TestEquality(implicit context: Context)() {
+  const notEqual: bool =
+      AllocateHeapNumberWithValue(0.5) != AllocateHeapNumberWithValue(0.5);
+  check(!notEqual);
+  const equal: bool =
+      AllocateHeapNumberWithValue(0.5) == AllocateHeapNumberWithValue(0.5);
+  check(equal);
+}
 
-  @export
-  macro TestAndOr(x: bool, y: bool, z: bool): bool {
-    return x && y || z ? true : false;
-  }
+@export
+macro TestOrAnd(x: bool, y: bool, z: bool): bool {
+  return x || y && z ? true : false;
+}
 
-  @export
-  macro TestLogicalOperators() {
-    check(TestAndOr(true, true, true));
-    check(TestAndOr(true, true, false));
-    check(TestAndOr(true, false, true));
-    check(!TestAndOr(true, false, false));
-    check(TestAndOr(false, true, true));
-    check(!TestAndOr(false, true, false));
-    check(TestAndOr(false, false, true));
-    check(!TestAndOr(false, false, false));
-    check(TestOrAnd(true, true, true));
-    check(TestOrAnd(true, true, false));
-    check(TestOrAnd(true, false, true));
-    check(TestOrAnd(true, false, false));
-    check(TestOrAnd(false, true, true));
-    check(!TestOrAnd(false, true, false));
-    check(!TestOrAnd(false, false, true));
-    check(!TestOrAnd(false, false, false));
-  }
+@export
+macro TestAndOr(x: bool, y: bool, z: bool): bool {
+  return x && y || z ? true : false;
+}
 
-  @export
-  macro TestCall(i: Smi): Smi labels A {
-    if (i < 5) return i;
-    goto A;
-  }
+@export
+macro TestLogicalOperators() {
+  check(TestAndOr(true, true, true));
+  check(TestAndOr(true, true, false));
+  check(TestAndOr(true, false, true));
+  check(!TestAndOr(true, false, false));
+  check(TestAndOr(false, true, true));
+  check(!TestAndOr(false, true, false));
+  check(TestAndOr(false, false, true));
+  check(!TestAndOr(false, false, false));
+  check(TestOrAnd(true, true, true));
+  check(TestOrAnd(true, true, false));
+  check(TestOrAnd(true, false, true));
+  check(TestOrAnd(true, false, false));
+  check(TestOrAnd(false, true, true));
+  check(!TestOrAnd(false, true, false));
+  check(!TestOrAnd(false, false, true));
+  check(!TestOrAnd(false, false, false));
+}
 
-  @export
-  macro TestOtherwiseWithCode1() {
-    let v: Smi = 0;
-    let s: Smi = 1;
-    try {
-      TestCall(10) otherwise goto B(++s);
-    }
-    label B(v1: Smi) {
-      v = v1;
-    }
-    assert(v == 2);
-  }
+@export
+macro TestCall(i: Smi): Smi labels A {
+  if (i < 5) return i;
+  goto A;
+}
 
-  @export
-  macro TestOtherwiseWithCode2() {
-    let s: Smi = 0;
-    for (let i: Smi = 0; i < 10; ++i) {
-      TestCall(i) otherwise break;
-      ++s;
-    }
-    assert(s == 5);
+@export
+macro TestOtherwiseWithCode1() {
+  let v: Smi = 0;
+  let s: Smi = 1;
+  try {
+    TestCall(10) otherwise goto B(++s);
+  } label B(v1: Smi) {
+    v = v1;
   }
+  assert(v == 2);
+}
 
-  @export
-  macro TestOtherwiseWithCode3() {
-    let s: Smi = 0;
-    for (let i: Smi = 0; i < 10; ++i) {
-      s += TestCall(i) otherwise break;
-    }
-    assert(s == 10);
+@export
+macro TestOtherwiseWithCode2() {
+  let s: Smi = 0;
+  for (let i: Smi = 0; i < 10; ++i) {
+    TestCall(i) otherwise break;
+    ++s;
   }
+  assert(s == 5);
+}
 
-  @export
-  macro TestForwardLabel() {
-    try {
-      goto A;
-    }
-    label A {
-      goto B(5);
-    }
-    label B(b: Smi) {
-      assert(b == 5);
-    }
+@export
+macro TestOtherwiseWithCode3() {
+  let s: Smi = 0;
+  for (let i: Smi = 0; i < 10; ++i) {
+    s += TestCall(i) otherwise break;
   }
+  assert(s == 10);
+}
 
-  @export
-  macro TestQualifiedAccess(implicit context: Context)() {
-    const s: Smi = 0;
-    check(!Is<JSArray>(s));
+@export
+macro TestForwardLabel() {
+  try {
+    goto A;
+  } label A {
+    goto B(5);
+  } label B(b: Smi) {
+    assert(b == 5);
   }
+}
 
-  @export
-  macro TestCatch1(implicit context: Context)(): Smi {
-    let r: Smi = 0;
-    try {
-      ThrowTypeError(MessageTemplate::kInvalidArrayLength);
-    } catch (_e) {
-      r = 1;
-      return r;
-    }
-  }
+@export
+macro TestQualifiedAccess(implicit context: Context)() {
+  const s: Smi = 0;
+  check(!Is<JSArray>(s));
+}
 
-  @export
-  macro TestCatch2Wrapper(implicit context: Context)(): never {
+@export
+macro TestCatch1(implicit context: Context)(): Smi {
+  let r: Smi = 0;
+  try {
     ThrowTypeError(MessageTemplate::kInvalidArrayLength);
+  } catch (_e) {
+    r = 1;
+    return r;
   }
+}
 
-  @export
-  macro TestCatch2(implicit context: Context)(): Smi {
-    let r: Smi = 0;
-    try {
-      TestCatch2Wrapper();
-    } catch (_e) {
-      r = 2;
-      return r;
-    }
-  }
+@export
+macro TestCatch2Wrapper(implicit context: Context)(): never {
+  ThrowTypeError(MessageTemplate::kInvalidArrayLength);
+}
 
-  @export
-  macro TestCatch3WrapperWithLabel(implicit context: Context)():
-      never labels _Abort {
-    ThrowTypeError(MessageTemplate::kInvalidArrayLength);
+@export
+macro TestCatch2(implicit context: Context)(): Smi {
+  let r: Smi = 0;
+  try {
+    TestCatch2Wrapper();
+  } catch (_e) {
+    r = 2;
+    return r;
   }
+}
 
-  @export
-  macro TestCatch3(implicit context: Context)(): Smi {
-    let r: Smi = 0;
-    try {
-      TestCatch3WrapperWithLabel() otherwise Abort;
-    }
-    label Abort {
-      return -1;
-    }
-    catch (_e) {
-      r = 2;
-      return r;
-    }
+@export
+macro TestCatch3WrapperWithLabel(implicit context: Context)():
+    never labels _Abort {
+  ThrowTypeError(MessageTemplate::kInvalidArrayLength);
+}
+
+@export
+macro TestCatch3(implicit context: Context)(): Smi {
+  let r: Smi = 0;
+  try {
+    TestCatch3WrapperWithLabel() otherwise Abort;
+  } catch (_e) {
+    r = 2;
+    return r;
+  } label Abort {
+    return -1;
   }
+}
 
-  // This test doesn't actually test the functionality of iterators,
-  // it's only purpose is to make sure tha the CSA macros in the
-  // IteratorBuiltinsAssembler match the signatures provided in
-  // iterator.tq.
-  @export
-  macro TestIterator(implicit context: Context)(o: JSReceiver, map: Map) {
-    try {
-      const t1: JSAny = iterator::GetIteratorMethod(o);
-      const t2: iterator::IteratorRecord = iterator::GetIterator(o);
+// This test doesn't actually test the functionality of iterators,
+// it's only purpose is to make sure tha the CSA macros in the
+// IteratorBuiltinsAssembler match the signatures provided in
+// iterator.tq.
+@export
+transitioning macro TestIterator(implicit context: Context)(
+    o: JSReceiver, map: Map) {
+  try {
+    const t1: JSAny = iterator::GetIteratorMethod(o);
+    const t2: iterator::IteratorRecord = iterator::GetIterator(o);
 
-      const _t3: JSAny = iterator::IteratorStep(t2) otherwise Fail;
-      const _t4: JSAny = iterator::IteratorStep(t2, map) otherwise Fail;
+    const _t3: JSAny = iterator::IteratorStep(t2) otherwise Fail;
+    const _t4: JSAny = iterator::IteratorStep(t2, map) otherwise Fail;
 
-      const t5: JSAny = iterator::IteratorValue(o);
-      const _t6: JSAny = iterator::IteratorValue(o, map);
+    const _t5: JSAny = iterator::IteratorValue(o);
+    const _t6: JSAny = iterator::IteratorValue(o, map);
 
-      const _t7: JSArray = iterator::IterableToList(t1, t1);
+    const _t7: JSArray = iterator::IterableToList(t1, t1);
 
-      iterator::IteratorCloseOnException(t2, t5);
-    }
-    label Fail {}
-  }
+    iterator::IteratorCloseOnException(t2);
+  } label Fail {}
+}
 
-  @export
-  macro TestFrame1(implicit context: Context)() {
-    const f: Frame = LoadFramePointer();
-    const frameType: FrameType =
-        Cast<FrameType>(f.context_or_frame_type) otherwise unreachable;
-    assert(frameType == STUB_FRAME);
-    assert(f.caller == LoadParentFramePointer());
-    typeswitch (f) {
-      case (_f: StandardFrame): {
-        unreachable;
-      }
-      case (_f: ArgumentsAdaptorFrame): {
-        unreachable;
-      }
-      case (_f: StubFrame): {
-      }
+@export
+macro TestFrame1(implicit context: Context)() {
+  const f: Frame = LoadFramePointer();
+  const frameType: FrameType =
+      Cast<FrameType>(f.context_or_frame_type) otherwise unreachable;
+  assert(frameType == STUB_FRAME);
+  assert(f.caller == LoadParentFramePointer());
+  typeswitch (f) {
+    case (_f: StandardFrame): {
+      unreachable;
     }
-  }
-
-  @export
-  macro TestNew(implicit context: Context)() {
-    const f: JSArray = NewJSArray();
-    check(f.IsEmpty());
-    f.length = 0;
-  }
-
-  struct TestInner {
-    macro SetX(newValue: int32) {
-      this.x = newValue;
+    case (_f: ArgumentsAdaptorFrame): {
+      unreachable;
     }
-    macro GetX(): int32 {
-      return this.x;
+    case (_f: StubFrame): {
     }
-    x: int32;
-    y: int32;
   }
+}
 
-  struct TestOuter {
-    a: int32;
-    b: TestInner;
-    c: int32;
-  }
+@export
+macro TestNew(implicit context: Context)() {
+  const f: JSArray = NewJSArray();
+  check(f.IsEmpty());
+  f.length = 0;
+}
 
-  @export
-  macro TestStructConstructor(implicit context: Context)() {
-    // Test default constructor
-    let a: TestOuter = TestOuter{a: 5, b: TestInner{x: 6, y: 7}, c: 8};
-    check(a.a == 5);
-    check(a.b.x == 6);
-    check(a.b.y == 7);
-    check(a.c == 8);
-    a.b.x = 1;
-    check(a.b.x == 1);
-    a.b.SetX(2);
-    check(a.b.x == 2);
-    check(a.b.GetX() == 2);
+struct TestInner {
+  macro SetX(newValue: int32) {
+    this.x = newValue;
   }
-
-  class InternalClass extends HeapObject {
-    macro Flip() labels NotASmi {
-      const tmp = Cast<Smi>(this.b) otherwise NotASmi;
-      this.b = this.a;
-      this.a = tmp;
-    }
-    a: Smi;
-    b: Number;
+  macro GetX(): int32 {
+    return this.x;
   }
+  x: int32;
+  y: int32;
+}
 
-  macro NewInternalClass(x: Smi): InternalClass {
-    return new InternalClass{a: x, b: x + 1};
-  }
+struct TestOuter {
+  a: int32;
+  b: TestInner;
+  c: int32;
+}
 
-  @export
-  macro TestInternalClass(implicit context: Context)() {
-    const o = NewInternalClass(5);
-    o.Flip() otherwise unreachable;
-    check(o.a == 6);
-    check(o.b == 5);
-  }
+@export
+macro TestStructConstructor(implicit context: Context)() {
+  // Test default constructor
+  let a: TestOuter = TestOuter{a: 5, b: TestInner{x: 6, y: 7}, c: 8};
+  check(a.a == 5);
+  check(a.b.x == 6);
+  check(a.b.y == 7);
+  check(a.c == 8);
+  a.b.x = 1;
+  check(a.b.x == 1);
+  a.b.SetX(2);
+  check(a.b.x == 2);
+  check(a.b.GetX() == 2);
+}
 
-  struct StructWithConst {
-    macro TestMethod1(): int32 {
-      return this.b;
-    }
-    macro TestMethod2(): Object {
-      return this.a;
-    }
-    a: Object;
-    const b: int32;
+class InternalClass extends HeapObject {
+  macro Flip() labels NotASmi {
+    const tmp = Cast<Smi>(this.b) otherwise NotASmi;
+    this.b = this.a;
+    this.a = tmp;
   }
+  a: Smi;
+  b: Number;
+}
 
-  @export
-  macro TestConstInStructs() {
-    const x = StructWithConst{a: Null, b: 1};
-    let y = StructWithConst{a: Null, b: 1};
-    y.a = Undefined;
-    const _copy = x;
+macro NewInternalClass(x: Smi): InternalClass {
+  return new InternalClass{a: x, b: x + 1};
+}
 
-    check(x.TestMethod1() == 1);
-    check(x.TestMethod2() == Null);
-  }
+@export
+macro TestInternalClass(implicit context: Context)() {
+  const o = NewInternalClass(5);
+  o.Flip() otherwise unreachable;
+  check(o.a == 6);
+  check(o.b == 5);
+}
 
-  @export
-  macro TestParentFrameArguments(implicit context: Context)() {
-    const parentFrame = LoadParentFramePointer();
-    const castFrame = Cast<StandardFrame>(parentFrame) otherwise unreachable;
-    const arguments = GetFrameArguments(castFrame, 1);
-    ArgumentsIterator{arguments, current: 0};
+struct StructWithConst {
+  macro TestMethod1(): int32 {
+    return this.b;
   }
-
-  struct TestIterator {
-    macro Next(): Object labels NoMore {
-      if (this.count-- == 0) goto NoMore;
-      return TheHole;
-    }
-    count: Smi;
+  macro TestMethod2(): Object {
+    return this.a;
   }
+  a: Object;
+  const b: int32;
+}
 
-  @export
-  macro TestNewFixedArrayFromSpread(implicit context: Context)(): Object {
-    let i = TestIterator{count: 5};
-    return new FixedArray{map: kFixedArrayMap, length: 5, objects: ...i};
-  }
+@export
+macro TestConstInStructs() {
+  const x = StructWithConst{a: Null, b: 1};
+  let y = StructWithConst{a: Null, b: 1};
+  y.a = Undefined;
+  const _copy = x;
 
-  class SmiPair extends HeapObject {
-    macro GetA():&Smi {
-      return & this.a;
-    }
-    a: Smi;
-    b: Smi;
-  }
+  check(x.TestMethod1() == 1);
+  check(x.TestMethod2() == Null);
+}
 
-  macro Swap<T: type>(a:&T, b:&T) {
-    const tmp = * a;
-    * a = * b;
-    * b = tmp;
-  }
+@export
+macro TestParentFrameArguments(implicit context: Context)() {
+  const parentFrame = LoadParentFramePointer();
+  const castFrame = Cast<StandardFrame>(parentFrame) otherwise unreachable;
+  const arguments = GetFrameArguments(castFrame, 1);
+  ArgumentsIterator{arguments, current: 0};
+}
 
-  @export
-  macro TestReferences() {
-    const array = new SmiPair{a: 7, b: 2};
-    const ref:&Smi = & array.a;
-    * ref = 3 + * ref;
-    -- * ref;
-    Swap(& array.b, array.GetA());
-    check(array.a == 2);
-    check(array.b == 9);
+struct TestIterator {
+  macro Next(): Object labels NoMore {
+    if (this.count-- == 0) goto NoMore;
+    return TheHole;
   }
+  count: Smi;
+}
 
-  @export
-  macro TestSlices() {
-    const it = TestIterator{count: 3};
-    const a = new FixedArray{map: kFixedArrayMap, length: 3, objects: ...it};
-    check(a.length == 3);
+@export
+macro TestNewFixedArrayFromSpread(implicit context: Context)(): Object {
+  let i = TestIterator{count: 5};
+  return new FixedArray{map: kFixedArrayMap, length: 5, objects: ...i};
+}
 
-    const oneTwoThree = Convert<Smi>(123);
-    a.objects[0] = oneTwoThree;
-    const firstRef:&Object = & a.objects[0];
-    check(TaggedEqual(* firstRef, oneTwoThree));
+class SmiPair extends HeapObject {
+  macro GetA():&Smi {
+    return & this.a;
+  }
+  a: Smi;
+  b: Smi;
+}
+
+macro Swap<T: type>(a:&T, b:&T) {
+  const tmp = * a;
+  * a = * b;
+  * b = tmp;
+}
 
-    const slice: torque_internal::Slice<Object> = & a.objects;
-    const firstRefAgain:&Object = slice.TryAtIndex(0) otherwise unreachable;
-    check(TaggedEqual(* firstRefAgain, oneTwoThree));
+@export
+macro TestReferences() {
+  const array = new SmiPair{a: 7, b: 2};
+  const ref:&Smi = & array.a;
+  * ref = 3 + * ref;
+  -- * ref;
+  Swap(& array.b, array.GetA());
+  check(array.a == 2);
+  check(array.b == 9);
+}
 
-    const threeTwoOne = Convert<Smi>(321);
-    * firstRefAgain = threeTwoOne;
-    check(TaggedEqual(a.objects[0], threeTwoOne));
+@export
+macro TestSlices() {
+  const it = TestIterator{count: 3};
+  const a = new FixedArray{map: kFixedArrayMap, length: 3, objects: ...it};
+  check(a.length == 3);
 
-    // *slice;             // error, not allowed
-    // a.objects;          // error, not allowed
-    // a.objects = slice;  // error, not allowed
+  const oneTwoThree = Convert<Smi>(123);
+  a.objects[0] = oneTwoThree;
+  const firstRef:&Object = & a.objects[0];
+  check(TaggedEqual(* firstRef, oneTwoThree));
 
-    // TODO(gsps): Currently errors, but should be allowed:
-    // const _sameSlice: torque_internal::Slice<Object> = &(*slice);
-    // (*slice)[0] : Smi
-  }
+  const slice: torque_internal::Slice<Object> = & a.objects;
+  const firstRefAgain:&Object = slice.TryAtIndex(0) otherwise unreachable;
+  check(TaggedEqual(* firstRefAgain, oneTwoThree));
 
-  @export
-  macro TestSliceEnumeration(implicit context: Context)(): Undefined {
-    const fixedArray: FixedArray = AllocateZeroedFixedArray(3);
-    for (let i: intptr = 0; i < 3; i++) {
-      check(UnsafeCast<Smi>(fixedArray.objects[i]) == 0);
-      fixedArray.objects[i] = Convert<Smi>(i) + 3;
-    }
+  const threeTwoOne = Convert<Smi>(321);
+  * firstRefAgain = threeTwoOne;
+  check(TaggedEqual(a.objects[0], threeTwoOne));
 
-    let slice = & fixedArray.objects;
-    for (let i: intptr = 0; i < slice.length; i++) {
-      let ref = slice.TryAtIndex(i) otherwise unreachable;
-      const value = UnsafeCast<Smi>(* ref);
-      check(value == Convert<Smi>(i) + 3);
-      * ref = value + 4;
-    }
+  // *slice;             // error, not allowed
+  // a.objects;          // error, not allowed
+  // a.objects = slice;  // error, not allowed
 
-    let it = slice.Iterator();
-    let count: Smi = 0;
-    while (true) {
-      const value = UnsafeCast<Smi>(it.Next() otherwise break);
-      check(value == count + 7);
-      count++;
-    }
-    check(count == 3);
-    check(it.Empty());
+  // TODO(gsps): Currently errors, but should be allowed:
+  // const _sameSlice: torque_internal::Slice<Object> = &(*slice);
+  // (*slice)[0] : Smi
+}
 
-    return Undefined;
+@export
+macro TestSliceEnumeration(implicit context: Context)(): Undefined {
+  const fixedArray: FixedArray = AllocateZeroedFixedArray(3);
+  for (let i: intptr = 0; i < 3; i++) {
+    check(UnsafeCast<Smi>(fixedArray.objects[i]) == 0);
+    fixedArray.objects[i] = Convert<Smi>(i) + 3;
   }
 
-  @export
-  macro TestStaticAssert() {
-    StaticAssert(1 + 2 == 3);
+  let slice = & fixedArray.objects;
+  for (let i: intptr = 0; i < slice.length; i++) {
+    let ref = slice.TryAtIndex(i) otherwise unreachable;
+    const value = UnsafeCast<Smi>(* ref);
+    check(value == Convert<Smi>(i) + 3);
+    * ref = value + 4;
   }
 
-  class SmiBox extends HeapObject {
-    value: Smi;
-    unrelated: Smi;
+  let it = slice.Iterator();
+  let count: Smi = 0;
+  while (true) {
+    const value = UnsafeCast<Smi>(it.Next() otherwise break);
+    check(value == count + 7);
+    count++;
   }
+  check(count == 3);
+  check(it.Empty());
 
-  builtin NewSmiBox(implicit context: Context)(value: Smi): SmiBox {
-    return new SmiBox{value, unrelated: 0};
-  }
+  return Undefined;
+}
 
-  @export
-  macro TestLoadEliminationFixed(implicit context: Context)() {
-    const box = NewSmiBox(123);
-    const v1 = box.value;
-    box.unrelated = 999;
-    const v2 = (box.unrelated == 0) ? box.value : box.value;
-    StaticAssert(TaggedEqual(v1, v2));
-
-    box.value = 11;
-    const v3 = box.value;
-    const eleven: Smi = 11;
-    StaticAssert(TaggedEqual(v3, eleven));
-  }
+@export
+macro TestStaticAssert() {
+  StaticAssert(1 + 2 == 3);
+}
 
-  @export
-  macro TestLoadEliminationVariable(implicit context: Context)() {
-    const a = UnsafeCast<FixedArray>(kEmptyFixedArray);
-    const box = NewSmiBox(1);
-    const v1 = a.objects[box.value];
-    const u1 = a.objects[box.value + 2];
-    const v2 = a.objects[box.value];
-    const u2 = a.objects[box.value + 2];
-    StaticAssert(TaggedEqual(v1, v2));
-    StaticAssert(TaggedEqual(u1, u2));
-  }
+class SmiBox extends HeapObject {
+  value: Smi;
+  unrelated: Smi;
+}
+
+builtin NewSmiBox(implicit context: Context)(value: Smi): SmiBox {
+  return new SmiBox{value, unrelated: 0};
+}
 
-  @export
-  macro TestRedundantArrayElementCheck(implicit context: Context)(): Smi {
-    const a = kEmptyFixedArray;
-    for (let i: Smi = 0; i < a.length; i++) {
+@export
+macro TestLoadEliminationFixed(implicit context: Context)() {
+  const box = NewSmiBox(123);
+  const v1 = box.value;
+  box.unrelated = 999;
+  const v2 = (box.unrelated == 0) ? box.value : box.value;
+  StaticAssert(TaggedEqual(v1, v2));
+
+  box.value = 11;
+  const v3 = box.value;
+  const eleven: Smi = 11;
+  StaticAssert(TaggedEqual(v3, eleven));
+}
+
+@export
+macro TestLoadEliminationVariable(implicit context: Context)() {
+  const a = UnsafeCast<FixedArray>(kEmptyFixedArray);
+  const box = NewSmiBox(1);
+  const v1 = a.objects[box.value];
+  const u1 = a.objects[box.value + 2];
+  const v2 = a.objects[box.value];
+  const u2 = a.objects[box.value + 2];
+  StaticAssert(TaggedEqual(v1, v2));
+  StaticAssert(TaggedEqual(u1, u2));
+}
+
+@export
+macro TestRedundantArrayElementCheck(implicit context: Context)(): Smi {
+  const a = kEmptyFixedArray;
+  for (let i: Smi = 0; i < a.length; i++) {
+    if (a.objects[i] == TheHole) {
       if (a.objects[i] == TheHole) {
-        if (a.objects[i] == TheHole) {
-          return -1;
-        } else {
-          StaticAssert(false);
-        }
+        return -1;
+      } else {
+        StaticAssert(false);
       }
     }
-    return 1;
   }
+  return 1;
+}
 
-  @export
-  macro TestRedundantSmiCheck(implicit context: Context)(): Smi {
-    const a = kEmptyFixedArray;
-    const x = a.objects[1];
-    typeswitch (x) {
-      case (Smi): {
-        Cast<Smi>(x) otherwise VerifiedUnreachable();
-        return -1;
-      }
-      case (Object): {
-      }
+@export
+macro TestRedundantSmiCheck(implicit context: Context)(): Smi {
+  const a = kEmptyFixedArray;
+  const x = a.objects[1];
+  typeswitch (x) {
+    case (Smi): {
+      Cast<Smi>(x) otherwise VerifiedUnreachable();
+      return -1;
+    }
+    case (Object): {
     }
-    return 1;
   }
+  return 1;
+}
 
-  struct SBox<T: type> {
-    value: T;
-  }
+struct SBox<T: type> {
+  value: T;
+}
 
-  @export
-  macro TestGenericStruct1(): intptr {
-    const i: intptr = 123;
-    let box = SBox{value: i};
-    let boxbox: SBox<SBox<intptr>> = SBox{value: box};
-    check(box.value == 123);
-    boxbox.value.value *= 2;
-    check(boxbox.value.value == 246);
-    return boxbox.value.value;
-  }
+@export
+macro TestGenericStruct1(): intptr {
+  const i: intptr = 123;
+  let box = SBox{value: i};
+  let boxbox: SBox<SBox<intptr>> = SBox{value: box};
+  check(box.value == 123);
+  boxbox.value.value *= 2;
+  check(boxbox.value.value == 246);
+  return boxbox.value.value;
+}
 
-  struct TestTuple<T1: type, T2: type> {
-    const fst: T1;
-    const snd: T2;
-  }
+struct TestTuple<T1: type, T2: type> {
+  const fst: T1;
+  const snd: T2;
+}
 
-  macro TupleSwap<T1: type, T2: type>(tuple: TestTuple<T1, T2>):
-      TestTuple<T2, T1> {
-    return TestTuple{fst: tuple.snd, snd: tuple.fst};
-  }
+macro TupleSwap<T1: type, T2: type>(tuple: TestTuple<T1, T2>):
+    TestTuple<T2, T1> {
+  return TestTuple{fst: tuple.snd, snd: tuple.fst};
+}
 
-  @export
-  macro TestGenericStruct2():
-      TestTuple<TestTuple<intptr, Smi>, TestTuple<Smi, intptr>> {
-    const intptrAndSmi = TestTuple<intptr, Smi>{fst: 1, snd: 2};
-    const smiAndIntptr = TupleSwap(intptrAndSmi);
-    check(intptrAndSmi.fst == smiAndIntptr.snd);
-    check(intptrAndSmi.snd == smiAndIntptr.fst);
-    const tupleTuple =
-        TestTuple<TestTuple<intptr, Smi>>{fst: intptrAndSmi, snd: smiAndIntptr};
-    return tupleTuple;
-  }
+@export
+macro TestGenericStruct2():
+    TestTuple<TestTuple<intptr, Smi>, TestTuple<Smi, intptr>> {
+  const intptrAndSmi = TestTuple<intptr, Smi>{fst: 1, snd: 2};
+  const smiAndIntptr = TupleSwap(intptrAndSmi);
+  check(intptrAndSmi.fst == smiAndIntptr.snd);
+  check(intptrAndSmi.snd == smiAndIntptr.fst);
+  const tupleTuple =
+      TestTuple<TestTuple<intptr, Smi>>{fst: intptrAndSmi, snd: smiAndIntptr};
+  return tupleTuple;
+}
 
-  macro BranchAndWriteResult(x: Smi, box: SmiBox): bool {
-    if (x > 5 || x < 0) {
-      box.value = 1;
-      return true;
-    } else {
-      box.value = 2;
-      return false;
-    }
+macro BranchAndWriteResult(x: Smi, box: SmiBox): bool {
+  if (x > 5 || x < 0) {
+    box.value = 1;
+    return true;
+  } else {
+    box.value = 2;
+    return false;
   }
+}
 
-  @export
-  macro TestBranchOnBoolOptimization(implicit context: Context)(input: Smi) {
-    const box = NewSmiBox(1);
-    // If the two branches get combined into one, we should be able to determine
-    // the value of {box} statically.
-    if (BranchAndWriteResult(input, box)) {
-      StaticAssert(box.value == 1);
-    } else {
-      StaticAssert(box.value == 2);
-    }
+@export
+macro TestBranchOnBoolOptimization(implicit context: Context)(input: Smi) {
+  const box = NewSmiBox(1);
+  // If the two branches get combined into one, we should be able to determine
+  // the value of {box} statically.
+  if (BranchAndWriteResult(input, box)) {
+    StaticAssert(box.value == 1);
+  } else {
+    StaticAssert(box.value == 2);
   }
+}
 
-  bitfield struct TestBitFieldStruct extends uint8 {
-    a: bool: 1 bit;
-    b: uint16: 3 bit;
-    c: uint32: 3 bit;
-    d: bool: 1 bit;
-  }
+bitfield struct TestBitFieldStruct extends uint8 {
+  a: bool: 1 bit;
+  b: uint16: 3 bit;
+  c: uint32: 3 bit;
+  d: bool: 1 bit;
+}
 
-  @export
-  macro TestBitFieldLoad(
-      val: TestBitFieldStruct, expectedA: bool, expectedB: uint16,
-      expectedC: uint32, expectedD: bool) {
-    check(val.a == expectedA);
-    check(val.b == expectedB);
-    check(val.c == expectedC);
-    check(val.d == expectedD);
-  }
+@export
+macro TestBitFieldLoad(
+    val: TestBitFieldStruct, expectedA: bool, expectedB: uint16,
+    expectedC: uint32, expectedD: bool) {
+  check(val.a == expectedA);
+  check(val.b == expectedB);
+  check(val.c == expectedC);
+  check(val.d == expectedD);
+}
 
-  @export
-  macro TestBitFieldStore(val: TestBitFieldStruct) {
-    let val: TestBitFieldStruct = val;  // Get a mutable local copy.
-    const a: bool = val.a;
-    const b: uint16 = val.b;
-    let c: uint32 = val.c;
-    const d: bool = val.d;
+@export
+macro TestBitFieldStore(val: TestBitFieldStruct) {
+  let val: TestBitFieldStruct = val;  // Get a mutable local copy.
+  const a: bool = val.a;
+  const b: uint16 = val.b;
+  let c: uint32 = val.c;
+  const d: bool = val.d;
 
-    val.a = !a;
-    TestBitFieldLoad(val, !a, b, c, d);
+  val.a = !a;
+  TestBitFieldLoad(val, !a, b, c, d);
 
-    c = Unsigned(7 - Signed(val.c));
-    val.c = c;
-    TestBitFieldLoad(val, !a, b, c, d);
+  c = Unsigned(7 - Signed(val.c));
+  val.c = c;
+  TestBitFieldLoad(val, !a, b, c, d);
 
-    val.d = val.b == val.c;
-    TestBitFieldLoad(val, !a, b, c, b == c);
-  }
+  val.d = val.b == val.c;
+  TestBitFieldLoad(val, !a, b, c, b == c);
+}
 
-  // Some other bitfield structs, to verify getting uintptr values out of word32
-  // structs and vice versa.
-  bitfield struct TestBitFieldStruct2 extends uint32 {
-    a: uintptr: 5 bit;
-    b: uintptr: 6 bit;
-  }
-  bitfield struct TestBitFieldStruct3 extends uintptr {
-    c: bool: 1 bit;
-    d: uint32: 9 bit;
-    e: uintptr: 17 bit;
-  }
+@export
+macro TestBitFieldInit(a: bool, b: uint16, c: uint32, d: bool) {
+  const val: TestBitFieldStruct = TestBitFieldStruct{a: a, b: b, c: c, d: d};
+  TestBitFieldLoad(val, a, b, c, d);
+}
 
-  @export
-  macro TestBitFieldUintptrOps(
-      val2: TestBitFieldStruct2, val3: TestBitFieldStruct3) {
-    let val2: TestBitFieldStruct2 = val2;  // Get a mutable local copy.
-    let val3: TestBitFieldStruct3 = val3;  // Get a mutable local copy.
-
-    // Caller is expected to provide these exact values, so we can verify
-    // reading values before starting to write anything.
-    check(val2.a == 3);
-    check(val2.b == 61);
-    check(val3.c);
-    check(val3.d == 500);
-    check(val3.e == 0x1cc);
-
-    val2.b = 16;
-    check(val2.a == 3);
-    check(val2.b == 16);
-
-    val2.b++;
-    check(val2.a == 3);
-    check(val2.b == 17);
-
-    val3.d = 99;
-    val3.e = 1234;
-    check(val3.c);
-    check(val3.d == 99);
-    check(val3.e == 1234);
-  }
+// Some other bitfield structs, to verify getting uintptr values out of word32
+// structs and vice versa.
+bitfield struct TestBitFieldStruct2 extends uint32 {
+  a: uintptr: 5 bit;
+  b: uintptr: 6 bit;
+}
+bitfield struct TestBitFieldStruct3 extends uintptr {
+  c: bool: 1 bit;
+  d: uint32: 9 bit;
+  e: uintptr: 17 bit;
+}
 
-  @export
-  class ExportedSubClass extends ExportedSubClassBase {
-    c_field: int32;
-    d_field: int32;
-    e_field: Smi;
-  }
+@export
+macro TestBitFieldUintptrOps(
+    val2: TestBitFieldStruct2, val3: TestBitFieldStruct3) {
+  let val2: TestBitFieldStruct2 = val2;  // Get a mutable local copy.
+  let val3: TestBitFieldStruct3 = val3;  // Get a mutable local copy.
+
+  // Caller is expected to provide these exact values, so we can verify
+  // reading values before starting to write anything.
+  check(val2.a == 3);
+  check(val2.b == 61);
+  check(val3.c);
+  check(val3.d == 500);
+  check(val3.e == 0x1cc);
+
+  val2.b = 16;
+  check(val2.a == 3);
+  check(val2.b == 16);
+
+  val2.b++;
+  check(val2.a == 3);
+  check(val2.b == 17);
+
+  val3.d = 99;
+  val3.e = 1234;
+  check(val3.c);
+  check(val3.d == 99);
+  check(val3.e == 1234);
+}
 
-  @export
-  class ExportedSubClassBase extends HeapObject {
-    a: HeapObject;
-    b: HeapObject;
-  }
+bitfield struct TestBitFieldStruct4 extends uint31 {
+  a: bool: 1 bit;
+  b: int32: 3 bit;
+  c: bool: 1 bit;
+}
 
-  class InternalClassWithSmiElements extends FixedArrayBase {
-    data: Smi;
-    object: Oddball;
-    entries[length]: Smi;
-  }
+bitfield struct TestBitFieldStruct5 extends uint31 {
+  b: int32: 19 bit;
+  a: bool: 1 bit;
+  c: bool: 1 bit;
+}
 
-  struct InternalClassStructElement {
-    a: Smi;
-    b: Smi;
-  }
+@export
+macro TestBitFieldMultipleFlags(a: bool, b: int32, c: bool) {
+  const f = TestBitFieldStruct4{a: a, b: b, c: c};
+  let simpleExpression = f.a & f.b == 3 & !f.c;
+  let expectedReduction = (Signed(f) & 0x1f) == Convert<int32>(1 | 3 << 1);
+  StaticAssert(simpleExpression == expectedReduction);
+  simpleExpression = !f.a & f.b == 4 & f.c;
+  expectedReduction = (Signed(f) & 0x1f) == Convert<int32>(4 << 1 | 1 << 4);
+  StaticAssert(simpleExpression == expectedReduction);
+  simpleExpression = f.b == 0 & f.c;
+  expectedReduction = (Signed(f) & 0x1e) == Convert<int32>(1 << 4);
+  StaticAssert(simpleExpression == expectedReduction);
+  simpleExpression = f.a & f.c;
+  expectedReduction = (Signed(f) & 0x11) == Convert<int32>(1 | 1 << 4);
+  StaticAssert(simpleExpression == expectedReduction);
+  const f2 = TestBitFieldStruct5{b: b, a: a, c: c};
+  simpleExpression = !f2.a & f2.b == 1234 & f2.c;
+  expectedReduction = (Signed(f2) & 0x1fffff) == Convert<int32>(1234 | 1 << 20);
+  StaticAssert(simpleExpression == expectedReduction);
+  simpleExpression = !f2.a & !f2.c;
+  expectedReduction = (Signed(f2) & 0x180000) == Convert<int32>(0);
+  StaticAssert(simpleExpression == expectedReduction);
+}
 
-  class InternalClassWithStructElements extends HeapObject {
-    dummy1: int32;
-    dummy2: int32;
-    const count: Smi;
-    data: Smi;
-    object: Object;
-    entries[count]: Smi;
-    more_entries[count]: InternalClassStructElement;
-  }
+@export
+class ExportedSubClass extends ExportedSubClassBase {
+  c_field: int32;
+  d_field: int32;
+  e_field: Smi;
+}
 
-  struct SmiGeneratorIterator {
-    macro Next(): Smi labels _NoMore {
-      return this.value++;
-    }
-    value: Smi;
-  }
+@export
+class ExportedSubClassBase extends HeapObject {
+  a: HeapObject;
+  b: HeapObject;
+}
 
-  struct InternalClassStructElementGeneratorIterator {
-    macro Next(): InternalClassStructElement labels _NoMore {
-      return InternalClassStructElement{a: this.value++, b: this.value++};
-    }
-    value: Smi;
-  }
+@abstract
+class AbstractInternalClass extends HeapObject {
+}
 
-  @export
-  macro TestFullyGeneratedClassWithElements() {
-    // Test creation, initialization and access of a fully generated class with
-    // simple (Smi) elements
-    const length: Smi = Convert<Smi>(3);
-    const object1 = new InternalClassWithSmiElements{
-      length,
-      data: 0,
-      object: Undefined,
-      entries: ...SmiGeneratorIterator {
-        value: 11
-      }
-    };
-    assert(object1.length == 3);
-    assert(object1.data == 0);
-    assert(object1.object == Undefined);
-    assert(object1.entries[0] == 11);
-    assert(object1.entries[1] == 12);
-    assert(object1.entries[2] == 13);
-
-    // Test creation, initialization and access of a fully generated class
-    // with elements that are a struct.
-    const object2 = new InternalClassWithStructElements{
-      dummy1: 44,
-      dummy2: 45,
-      count: length,
-      data: 55,
-      object: Undefined,
-      entries: ...SmiGeneratorIterator{value: 3},
-      more_entries: ...InternalClassStructElementGeneratorIterator {
-        value: 1
-      }
-    };
-
-    assert(object2.dummy1 == 44);
-    assert(object2.dummy2 == 45);
-    assert(object2.count == 3);
-    assert(object2.data == 55);
-    assert(object2.object == Undefined);
-    assert(object2.entries[0] == 3);
-    assert(object2.entries[1] == 4);
-    assert(object2.entries[2] == 5);
-    assert(object2.more_entries[0].a == 1);
-    assert(object2.more_entries[0].b == 2);
-    assert(object2.more_entries[1].a == 3);
-    assert(object2.more_entries[1].b == 4);
-    assert(object2.more_entries[2].a == 5);
-    assert(object2.more_entries[2].b == 6);
+class AbstractInternalClassSubclass1 extends AbstractInternalClass {}
+
+class AbstractInternalClassSubclass2 extends AbstractInternalClass {}
+
+class InternalClassWithSmiElements extends FixedArrayBase {
+  data: Smi;
+  object: Oddball;
+  entries[length]: Smi;
+}
+
+struct InternalClassStructElement {
+  a: Smi;
+  b: Smi;
+}
+
+class InternalClassWithStructElements extends HeapObject {
+  dummy1: int32;
+  dummy2: int32;
+  const count: Smi;
+  data: Smi;
+  object: Object;
+  entries[count]: Smi;
+  more_entries[count]: InternalClassStructElement;
+}
+
+struct SmiGeneratorIterator {
+  macro Next(): Smi labels _NoMore {
+    return this.value++;
   }
+  value: Smi;
+}
 
-  @export
-  macro TestFullyGeneratedClassFromCpp(): ExportedSubClass {
-    return new
-    ExportedSubClass{a: Null, b: Null, c_field: 7, d_field: 8, e_field: 9};
+struct InternalClassStructElementGeneratorIterator {
+  macro Next(): InternalClassStructElement labels _NoMore {
+    return InternalClassStructElement{a: this.value++, b: this.value++};
   }
+  value: Smi;
+}
+
+@export
+macro TestFullyGeneratedClassWithElements() {
+  // Test creation, initialization and access of a fully generated class with
+  // simple (Smi) elements
+  const length: Smi = Convert<Smi>(3);
+  const object1 = new InternalClassWithSmiElements{
+    length,
+    data: 0,
+    object: Undefined,
+    entries: ...SmiGeneratorIterator {
+      value: 11
+    }
+  };
+  assert(object1.length == 3);
+  assert(object1.data == 0);
+  assert(object1.object == Undefined);
+  assert(object1.entries[0] == 11);
+  assert(object1.entries[1] == 12);
+  assert(object1.entries[2] == 13);
+
+  // Test creation, initialization and access of a fully generated class
+  // with elements that are a struct.
+  const object2 = new InternalClassWithStructElements{
+    dummy1: 44,
+    dummy2: 45,
+    count: length,
+    data: 55,
+    object: Undefined,
+    entries: ...SmiGeneratorIterator{value: 3},
+    more_entries: ...InternalClassStructElementGeneratorIterator {
+      value: 1
+    }
+  };
+
+  assert(object2.dummy1 == 44);
+  assert(object2.dummy2 == 45);
+  assert(object2.count == 3);
+  assert(object2.data == 55);
+  assert(object2.object == Undefined);
+  assert(object2.entries[0] == 3);
+  assert(object2.entries[1] == 4);
+  assert(object2.entries[2] == 5);
+  assert(object2.more_entries[0].a == 1);
+  assert(object2.more_entries[0].b == 2);
+  assert(object2.more_entries[1].a == 3);
+  assert(object2.more_entries[1].b == 4);
+  assert(object2.more_entries[2].a == 5);
+  assert(object2.more_entries[2].b == 6);
+}
+
+@export
+macro TestFullyGeneratedClassFromCpp(): ExportedSubClass {
+  return new
+  ExportedSubClass{a: Null, b: Null, c_field: 7, d_field: 8, e_field: 9};
+}
 }
diff --git a/deps/v8/test/unittests/BUILD.gn b/deps/v8/test/unittests/BUILD.gn
index f3b060e5da4..68035033b21 100644
--- a/deps/v8/test/unittests/BUILD.gn
+++ b/deps/v8/test/unittests/BUILD.gn
@@ -44,19 +44,38 @@ v8_source_set("cppgc_unittests_sources") {
   testonly = true
 
   sources = [
-    "heap/cppgc/allocation_unittest.cc",
-    "heap/cppgc/finalizer-trait_unittest.cc",
-    "heap/cppgc/garbage-collected_unittest.cc",
-    "heap/cppgc/gc-info_unittest.cc",
-    "heap/cppgc/heap-object-header_unittest.cc",
-    "heap/cppgc/stack_unittest.cc",
+    "heap/cppgc/concurrent-sweeper-unittest.cc",
+    "heap/cppgc/custom-spaces-unittest.cc",
+    "heap/cppgc/finalizer-trait-unittest.cc",
+    "heap/cppgc/free-list-unittest.cc",
+    "heap/cppgc/garbage-collected-unittest.cc",
+    "heap/cppgc/gc-info-unittest.cc",
+    "heap/cppgc/heap-object-header-unittest.cc",
+    "heap/cppgc/heap-page-unittest.cc",
+    "heap/cppgc/heap-unittest.cc",
+    "heap/cppgc/logging-unittest.cc",
+    "heap/cppgc/marker-unittest.cc",
+    "heap/cppgc/marking-visitor-unittest.cc",
+    "heap/cppgc/member-unittest.cc",
+    "heap/cppgc/object-start-bitmap-unittest.cc",
+    "heap/cppgc/page-memory-unittest.cc",
+    "heap/cppgc/persistent-unittest.cc",
+    "heap/cppgc/prefinalizer-unittest.cc",
+    "heap/cppgc/source-location-unittest.cc",
+    "heap/cppgc/stack-unittest.cc",
+    "heap/cppgc/sweeper-unittest.cc",
+    "heap/cppgc/test-platform.cc",
+    "heap/cppgc/test-platform.h",
     "heap/cppgc/tests.cc",
     "heap/cppgc/tests.h",
+    "heap/cppgc/visitor-unittest.cc",
+    "heap/cppgc/worklist-unittest.cc",
   ]
 
   configs = [
     "../..:external_config",
     "../..:internal_config_base",
+    "../..:cppgc_base_config",
   ]
 
   deps = [
@@ -124,7 +143,6 @@ v8_source_set("unittests_sources") {
     "base/functional-unittest.cc",
     "base/ieee754-unittest.cc",
     "base/iterator-unittest.cc",
-    "base/list-unittest.cc",
     "base/logging-unittest.cc",
     "base/macros-unittest.cc",
     "base/ostreams-unittest.cc",
@@ -217,6 +235,7 @@ v8_source_set("unittests_sources") {
     "heap/heap-controller-unittest.cc",
     "heap/heap-unittest.cc",
     "heap/item-parallel-job-unittest.cc",
+    "heap/list-unittest.cc",
     "heap/local-heap-unittest.cc",
     "heap/marking-unittest.cc",
     "heap/marking-worklist-unittest.cc",
@@ -243,6 +262,7 @@ v8_source_set("unittests_sources") {
     "interpreter/constant-array-builder-unittest.cc",
     "interpreter/interpreter-assembler-unittest.cc",
     "interpreter/interpreter-assembler-unittest.h",
+    "libplatform/default-job-unittest.cc",
     "libplatform/default-platform-unittest.cc",
     "libplatform/default-worker-threads-task-runner-unittest.cc",
     "libplatform/task-queue-unittest.cc",
@@ -293,12 +313,15 @@ v8_source_set("unittests_sources") {
     "wasm/wasm-macro-gen-unittest.cc",
     "wasm/wasm-module-builder-unittest.cc",
     "wasm/wasm-module-sourcemap-unittest.cc",
-    "wasm/wasm-opcodes-unittest.cc",
     "zone/zone-allocator-unittest.cc",
     "zone/zone-chunk-list-unittest.cc",
     "zone/zone-unittest.cc",
   ]
 
+  if (v8_enable_wasm_gdb_remote_debugging) {
+    sources += [ "wasm/wasm-gdbserver-unittest.cc" ]
+  }
+
   if (v8_current_cpu == "arm") {
     sources += [
       "assembler/turbo-assembler-arm-unittest.cc",
diff --git a/deps/v8/test/unittests/api/remote-object-unittest.cc b/deps/v8/test/unittests/api/remote-object-unittest.cc
index 5fcc78bbe1c..a73db835a44 100644
--- a/deps/v8/test/unittests/api/remote-object-unittest.cc
+++ b/deps/v8/test/unittests/api/remote-object-unittest.cc
@@ -98,22 +98,5 @@ TEST_F(RemoteObjectTest, TypeOfRemoteObject) {
   EXPECT_STREQ("object", *result);
 }
 
-TEST_F(RemoteObjectTest, ClassOf) {
-  Local<FunctionTemplate> constructor_template =
-      FunctionTemplate::New(isolate(), Constructor);
-  constructor_template->InstanceTemplate()->SetAccessCheckCallbackAndHandler(
-      AccessCheck, NamedPropertyHandlerConfiguration(NamedGetter),
-      IndexedPropertyHandlerConfiguration());
-  constructor_template->SetClassName(
-      String::NewFromUtf8Literal(isolate(), "test_class"));
-
-  Local<Object> remote_object =
-      constructor_template->NewRemoteInstance().ToLocalChecked();
-  Local<String> class_name = Utils::ToLocal(
-      i::handle(Utils::OpenHandle(*remote_object)->class_name(), i_isolate()));
-  String::Utf8Value result(isolate(), class_name);
-  EXPECT_STREQ("test_class", *result);
-}
-
 }  // namespace remote_object_unittest
 }  // namespace v8
diff --git a/deps/v8/test/unittests/base/bits-unittest.cc b/deps/v8/test/unittests/base/bits-unittest.cc
index 1e73ca01328..77dbdd646cb 100644
--- a/deps/v8/test/unittests/base/bits-unittest.cc
+++ b/deps/v8/test/unittests/base/bits-unittest.cc
@@ -18,6 +18,15 @@ namespace v8 {
 namespace base {
 namespace bits {
 
+TEST(Bits, CountPopulation8) {
+  EXPECT_EQ(0u, CountPopulation(uint8_t{0}));
+  EXPECT_EQ(1u, CountPopulation(uint8_t{1}));
+  EXPECT_EQ(2u, CountPopulation(uint8_t{0x11}));
+  EXPECT_EQ(4u, CountPopulation(uint8_t{0x0F}));
+  EXPECT_EQ(6u, CountPopulation(uint8_t{0x3F}));
+  EXPECT_EQ(8u, CountPopulation(uint8_t{0xFF}));
+}
+
 TEST(Bits, CountPopulation16) {
   EXPECT_EQ(0u, CountPopulation(uint16_t{0}));
   EXPECT_EQ(1u, CountPopulation(uint16_t{1}));
diff --git a/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc b/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
index 0990f8c63bc..aab8c7b91d0 100644
--- a/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
+++ b/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
@@ -69,8 +69,9 @@ class CompilerDispatcherTest : public TestWithNativeContext {
   static base::Optional<CompilerDispatcher::JobId> EnqueueUnoptimizedCompileJob(
       CompilerDispatcher* dispatcher, Isolate* isolate,
       Handle<SharedFunctionInfo> shared) {
+    UnoptimizedCompileState state(isolate);
     std::unique_ptr<ParseInfo> outer_parse_info =
-        test::OuterParseInfoForShared(isolate, shared);
+        test::OuterParseInfoForShared(isolate, shared, &state);
     AstValueFactory* ast_value_factory =
         outer_parse_info->GetOrCreateAstValueFactory();
     AstNodeFactory ast_node_factory(ast_value_factory,
@@ -139,6 +140,11 @@ class MockPlatform : public v8::Platform {
 
   bool IdleTasksEnabled(v8::Isolate* isolate) override { return true; }
 
+  std::unique_ptr<JobHandle> PostJob(
+      TaskPriority priority, std::unique_ptr<JobTask> job_state) override {
+    UNREACHABLE();
+  }
+
   double MonotonicallyIncreasingTime() override {
     time_ += time_step_;
     return time_;
diff --git a/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc b/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc
index a779da083a5..6c9c6321ccd 100644
--- a/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc
+++ b/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc
@@ -2043,9 +2043,9 @@ struct MulDPInst {
   Node* (RawMachineAssembler::*mul_constructor)(Node*, Node*);
   Node* (RawMachineAssembler::*add_constructor)(Node*, Node*);
   Node* (RawMachineAssembler::*sub_constructor)(Node*, Node*);
-  ArchOpcode add_arch_opcode;
-  ArchOpcode sub_arch_opcode;
-  ArchOpcode neg_arch_opcode;
+  ArchOpcode multiply_add_arch_opcode;
+  ArchOpcode multiply_sub_arch_opcode;
+  ArchOpcode multiply_neg_arch_opcode;
   MachineType machine_type;
 };
 
@@ -2077,7 +2077,7 @@ TEST_P(InstructionSelectorIntDPWithIntMulTest, AddWithMul) {
     m.Return((m.*mdpi.add_constructor)(m.Parameter(0), n));
     Stream s = m.Build();
     ASSERT_EQ(1U, s.size());
-    EXPECT_EQ(mdpi.add_arch_opcode, s[0]->arch_opcode());
+    EXPECT_EQ(mdpi.multiply_add_arch_opcode, s[0]->arch_opcode());
     EXPECT_EQ(3U, s[0]->InputCount());
     EXPECT_EQ(1U, s[0]->OutputCount());
   }
@@ -2087,7 +2087,7 @@ TEST_P(InstructionSelectorIntDPWithIntMulTest, AddWithMul) {
     m.Return((m.*mdpi.add_constructor)(n, m.Parameter(2)));
     Stream s = m.Build();
     ASSERT_EQ(1U, s.size());
-    EXPECT_EQ(mdpi.add_arch_opcode, s[0]->arch_opcode());
+    EXPECT_EQ(mdpi.multiply_add_arch_opcode, s[0]->arch_opcode());
     EXPECT_EQ(3U, s[0]->InputCount());
     EXPECT_EQ(1U, s[0]->OutputCount());
   }
@@ -2103,7 +2103,7 @@ TEST_P(InstructionSelectorIntDPWithIntMulTest, SubWithMul) {
     m.Return((m.*mdpi.sub_constructor)(m.Parameter(0), n));
     Stream s = m.Build();
     ASSERT_EQ(1U, s.size());
-    EXPECT_EQ(mdpi.sub_arch_opcode, s[0]->arch_opcode());
+    EXPECT_EQ(mdpi.multiply_sub_arch_opcode, s[0]->arch_opcode());
     EXPECT_EQ(3U, s[0]->InputCount());
     EXPECT_EQ(1U, s[0]->OutputCount());
   }
@@ -2120,7 +2120,7 @@ TEST_P(InstructionSelectorIntDPWithIntMulTest, NegativeMul) {
     m.Return((m.*mdpi.mul_constructor)(n, m.Parameter(1)));
     Stream s = m.Build();
     ASSERT_EQ(1U, s.size());
-    EXPECT_EQ(mdpi.neg_arch_opcode, s[0]->arch_opcode());
+    EXPECT_EQ(mdpi.multiply_neg_arch_opcode, s[0]->arch_opcode());
     EXPECT_EQ(2U, s[0]->InputCount());
     EXPECT_EQ(1U, s[0]->OutputCount());
   }
@@ -2131,7 +2131,7 @@ TEST_P(InstructionSelectorIntDPWithIntMulTest, NegativeMul) {
     m.Return((m.*mdpi.mul_constructor)(m.Parameter(0), n));
     Stream s = m.Build();
     ASSERT_EQ(1U, s.size());
-    EXPECT_EQ(mdpi.neg_arch_opcode, s[0]->arch_opcode());
+    EXPECT_EQ(mdpi.multiply_neg_arch_opcode, s[0]->arch_opcode());
     EXPECT_EQ(2U, s[0]->InputCount());
     EXPECT_EQ(1U, s[0]->OutputCount());
   }
@@ -2141,6 +2141,85 @@ INSTANTIATE_TEST_SUITE_P(InstructionSelectorTest,
                          InstructionSelectorIntDPWithIntMulTest,
                          ::testing::ValuesIn(kMulDPInstructions));
 
+namespace {
+
+struct SIMDMulDPInst {
+  const char* mul_constructor_name;
+  const Operator* (MachineOperatorBuilder::*mul_operator)(void);
+  const Operator* (MachineOperatorBuilder::*add_operator)(void);
+  const Operator* (MachineOperatorBuilder::*sub_operator)(void);
+  ArchOpcode multiply_add_arch_opcode;
+  ArchOpcode multiply_sub_arch_opcode;
+  MachineType machine_type;
+};
+
+std::ostream& operator<<(std::ostream& os, const SIMDMulDPInst& inst) {
+  return os << inst.mul_constructor_name;
+}
+
+}  // namespace
+
+static const SIMDMulDPInst kSIMDMulDPInstructions[] = {
+    {"I32x4Mul", &MachineOperatorBuilder::I32x4Mul,
+     &MachineOperatorBuilder::I32x4Add, &MachineOperatorBuilder::I32x4Sub,
+     kArm64I32x4Mla, kArm64I32x4Mls, MachineType::Simd128()},
+    {"I16x8Mul", &MachineOperatorBuilder::I16x8Mul,
+     &MachineOperatorBuilder::I16x8Add, &MachineOperatorBuilder::I16x8Sub,
+     kArm64I16x8Mla, kArm64I16x8Mls, MachineType::Simd128()},
+    {"I8x16Mul", &MachineOperatorBuilder::I8x16Mul,
+     &MachineOperatorBuilder::I8x16Add, &MachineOperatorBuilder::I8x16Sub,
+     kArm64I8x16Mla, kArm64I8x16Mls, MachineType::Simd128()}};
+
+using InstructionSelectorSIMDDPWithSIMDMulTest =
+    InstructionSelectorTestWithParam<SIMDMulDPInst>;
+
+TEST_P(InstructionSelectorSIMDDPWithSIMDMulTest, AddWithMul) {
+  const SIMDMulDPInst mdpi = GetParam();
+  const MachineType type = mdpi.machine_type;
+  {
+    StreamBuilder m(this, type, type, type, type);
+    Node* n = m.AddNode((m.machine()->*mdpi.mul_operator)(), m.Parameter(1),
+                        m.Parameter(2));
+    m.Return(m.AddNode((m.machine()->*mdpi.add_operator)(), m.Parameter(0), n));
+    Stream s = m.Build();
+    ASSERT_EQ(1U, s.size());
+    EXPECT_EQ(mdpi.multiply_add_arch_opcode, s[0]->arch_opcode());
+    EXPECT_EQ(3U, s[0]->InputCount());
+    EXPECT_EQ(1U, s[0]->OutputCount());
+  }
+  {
+    StreamBuilder m(this, type, type, type, type);
+    Node* n = m.AddNode((m.machine()->*mdpi.mul_operator)(), m.Parameter(0),
+                        m.Parameter(1));
+    m.Return(m.AddNode((m.machine()->*mdpi.add_operator)(), n, m.Parameter(2)));
+    Stream s = m.Build();
+    ASSERT_EQ(1U, s.size());
+    EXPECT_EQ(mdpi.multiply_add_arch_opcode, s[0]->arch_opcode());
+    EXPECT_EQ(3U, s[0]->InputCount());
+    EXPECT_EQ(1U, s[0]->OutputCount());
+  }
+}
+
+TEST_P(InstructionSelectorSIMDDPWithSIMDMulTest, SubWithMul) {
+  const SIMDMulDPInst mdpi = GetParam();
+  const MachineType type = mdpi.machine_type;
+  {
+    StreamBuilder m(this, type, type, type, type);
+    Node* n = m.AddNode((m.machine()->*mdpi.mul_operator)(), m.Parameter(1),
+                        m.Parameter(2));
+    m.Return(m.AddNode((m.machine()->*mdpi.sub_operator)(), m.Parameter(0), n));
+    Stream s = m.Build();
+    ASSERT_EQ(1U, s.size());
+    EXPECT_EQ(mdpi.multiply_sub_arch_opcode, s[0]->arch_opcode());
+    EXPECT_EQ(3U, s[0]->InputCount());
+    EXPECT_EQ(1U, s[0]->OutputCount());
+  }
+}
+
+INSTANTIATE_TEST_SUITE_P(InstructionSelectorTest,
+                         InstructionSelectorSIMDDPWithSIMDMulTest,
+                         ::testing::ValuesIn(kSIMDMulDPInstructions));
+
 TEST_F(InstructionSelectorTest, Int32MulWithImmediate) {
   // x * (2^k + 1) -> x + (x << k)
   TRACED_FORRANGE(int32_t, k, 1, 30) {
diff --git a/deps/v8/test/unittests/compiler/effect-control-linearizer-unittest.cc b/deps/v8/test/unittests/compiler/effect-control-linearizer-unittest.cc
index 925ae9b5e70..2c3d4a6d8d0 100644
--- a/deps/v8/test/unittests/compiler/effect-control-linearizer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/effect-control-linearizer-unittest.cc
@@ -292,6 +292,218 @@ TEST_F(EffectControlLinearizerTest, CloneBranch) {
                                             IsBranch(cond2, control2)))))));
 }
 
+TEST_F(EffectControlLinearizerTest, UnreachableThenBranch) {
+  Schedule schedule(zone());
+
+  // Create the graph.
+  Node* unreachable = graph()->NewNode(common()->Unreachable(),
+                                       graph()->start(), graph()->start());
+  Node* branch =
+      graph()->NewNode(common()->Branch(), Int32Constant(0), graph()->start());
+
+  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+  Node* true_throw = graph()->NewNode(common()->Throw(), unreachable, if_true);
+
+  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+  Node* false_throw =
+      graph()->NewNode(common()->Throw(), unreachable, if_false);
+
+  graph()->SetEnd(graph()->NewNode(common()->End(0)));
+
+  // Build the basic block structure.
+  BasicBlock* start = schedule.start();
+  schedule.rpo_order()->push_back(start);
+  start->set_rpo_number(0);
+
+  BasicBlock* tblock = AddBlockToSchedule(&schedule);
+  BasicBlock* fblock = AddBlockToSchedule(&schedule);
+
+  // Populate the basic blocks with nodes.
+  schedule.AddNode(start, graph()->start());
+  schedule.AddNode(start, unreachable);
+  schedule.AddBranch(start, branch, tblock, fblock);
+
+  schedule.AddNode(tblock, if_true);
+  schedule.AddThrow(tblock, true_throw);
+  NodeProperties::MergeControlToEnd(graph(), common(), true_throw);
+
+  schedule.AddNode(fblock, if_false);
+  schedule.AddThrow(fblock, false_throw);
+  NodeProperties::MergeControlToEnd(graph(), common(), false_throw);
+
+  ASSERT_THAT(end(), IsEnd(IsThrow(), IsThrow()));
+  ASSERT_THAT(end()->op()->ControlInputCount(), 2);
+
+  // Run the state effect linearizer, maintaining the schedule.
+  LinearizeEffectControl(
+      jsgraph(), &schedule, zone(), source_positions(), node_origins(),
+      MaskArrayIndexEnable::kDoNotMaskArrayIndex, MaintainSchedule::kMaintain);
+
+  ASSERT_THAT(end(), IsEnd(IsThrow()));
+}
+
+TEST_F(EffectControlLinearizerTest, UnreachableThenDiamond) {
+  Schedule schedule(zone());
+
+  // Create the graph.
+  Node* unreachable = graph()->NewNode(common()->Unreachable(),
+                                       graph()->start(), graph()->start());
+  Node* branch =
+      graph()->NewNode(common()->Branch(), Int32Constant(0), graph()->start());
+
+  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+
+  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+
+  Node* merge = graph()->NewNode(common()->Merge(2), if_true, if_false);
+  Node* throw_node = graph()->NewNode(common()->Throw(), unreachable, if_false);
+  graph()->SetEnd(graph()->NewNode(common()->End(0)));
+
+  // Build the basic block structure.
+  BasicBlock* start = schedule.start();
+  schedule.rpo_order()->push_back(start);
+  start->set_rpo_number(0);
+
+  BasicBlock* tblock = AddBlockToSchedule(&schedule);
+  BasicBlock* fblock = AddBlockToSchedule(&schedule);
+  BasicBlock* mblock = AddBlockToSchedule(&schedule);
+
+  // Populate the basic blocks with nodes.
+  schedule.AddNode(start, graph()->start());
+  schedule.AddNode(start, unreachable);
+  schedule.AddBranch(start, branch, tblock, fblock);
+
+  schedule.AddNode(tblock, if_true);
+  schedule.AddGoto(tblock, mblock);
+
+  schedule.AddNode(fblock, if_false);
+  schedule.AddGoto(fblock, mblock);
+
+  schedule.AddNode(mblock, merge);
+  schedule.AddThrow(mblock, throw_node);
+  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
+
+  ASSERT_THAT(end(), IsEnd(IsThrow()));
+  ASSERT_THAT(end()->op()->ControlInputCount(), 1);
+
+  // Run the state effect linearizer, maintaining the schedule.
+  LinearizeEffectControl(
+      jsgraph(), &schedule, zone(), source_positions(), node_origins(),
+      MaskArrayIndexEnable::kDoNotMaskArrayIndex, MaintainSchedule::kMaintain);
+
+  ASSERT_THAT(end(), IsEnd(IsThrow()));
+}
+
+TEST_F(EffectControlLinearizerTest, UnreachableThenLoop) {
+  Schedule schedule(zone());
+
+  // Create the graph.
+  Node* unreachable = graph()->NewNode(common()->Unreachable(),
+                                       graph()->start(), graph()->start());
+  Node* loop = graph()->NewNode(common()->Loop(1), graph()->start());
+
+  Node* cond = Int32Constant(0);
+  Node* branch = graph()->NewNode(common()->Branch(), cond, loop);
+
+  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+
+  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+
+  loop->AppendInput(zone(), if_false);
+  NodeProperties::ChangeOp(loop, common()->Loop(2));
+
+  Node* throw_node = graph()->NewNode(common()->Throw(), unreachable, if_false);
+  graph()->SetEnd(graph()->NewNode(common()->End(0)));
+
+  // Build the basic block structure.
+  BasicBlock* start = schedule.start();
+  schedule.rpo_order()->push_back(start);
+  start->set_rpo_number(0);
+
+  BasicBlock* lblock = AddBlockToSchedule(&schedule);
+  BasicBlock* fblock = AddBlockToSchedule(&schedule);
+  BasicBlock* tblock = AddBlockToSchedule(&schedule);
+
+  // Populate the basic blocks with nodes.
+  schedule.AddNode(start, graph()->start());
+  schedule.AddNode(start, unreachable);
+  schedule.AddGoto(start, lblock);
+
+  schedule.AddNode(lblock, loop);
+  schedule.AddNode(lblock, cond);
+  schedule.AddBranch(lblock, branch, tblock, fblock);
+
+  schedule.AddNode(fblock, if_false);
+  schedule.AddGoto(fblock, lblock);
+
+  schedule.AddNode(tblock, if_true);
+  schedule.AddThrow(tblock, throw_node);
+  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
+
+  ASSERT_THAT(end(), IsEnd(IsThrow()));
+  ASSERT_THAT(end()->op()->ControlInputCount(), 1);
+
+  // Run the state effect linearizer, maintaining the schedule.
+  LinearizeEffectControl(
+      jsgraph(), &schedule, zone(), source_positions(), node_origins(),
+      MaskArrayIndexEnable::kDoNotMaskArrayIndex, MaintainSchedule::kMaintain);
+
+  ASSERT_THAT(end(), IsEnd(IsThrow()));
+}
+
+TEST_F(EffectControlLinearizerTest, UnreachableInChangedBlockThenBranch) {
+  Schedule schedule(zone());
+
+  // Create the graph.
+  Node* truncate = graph()->NewNode(simplified()->TruncateTaggedToWord32(),
+                                    NumberConstant(1.1));
+  Node* unreachable = graph()->NewNode(common()->Unreachable(),
+                                       graph()->start(), graph()->start());
+  Node* branch =
+      graph()->NewNode(common()->Branch(), Int32Constant(0), graph()->start());
+
+  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+  Node* true_throw = graph()->NewNode(common()->Throw(), unreachable, if_true);
+
+  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+  Node* false_throw =
+      graph()->NewNode(common()->Throw(), unreachable, if_false);
+
+  graph()->SetEnd(graph()->NewNode(common()->End(0)));
+
+  // Build the basic block structure.
+  BasicBlock* start = schedule.start();
+  schedule.rpo_order()->push_back(start);
+  start->set_rpo_number(0);
+
+  BasicBlock* tblock = AddBlockToSchedule(&schedule);
+  BasicBlock* fblock = AddBlockToSchedule(&schedule);
+
+  // Populate the basic blocks with nodes.
+  schedule.AddNode(start, graph()->start());
+  schedule.AddNode(start, truncate);
+  schedule.AddNode(start, unreachable);
+  schedule.AddBranch(start, branch, tblock, fblock);
+
+  schedule.AddNode(tblock, if_true);
+  schedule.AddThrow(tblock, true_throw);
+  NodeProperties::MergeControlToEnd(graph(), common(), true_throw);
+
+  schedule.AddNode(fblock, if_false);
+  schedule.AddThrow(fblock, false_throw);
+  NodeProperties::MergeControlToEnd(graph(), common(), false_throw);
+
+  ASSERT_THAT(end(), IsEnd(IsThrow(), IsThrow()));
+  ASSERT_THAT(end()->op()->ControlInputCount(), 2);
+
+  // Run the state effect linearizer, maintaining the schedule.
+  LinearizeEffectControl(
+      jsgraph(), &schedule, zone(), source_positions(), node_origins(),
+      MaskArrayIndexEnable::kDoNotMaskArrayIndex, MaintainSchedule::kMaintain);
+
+  ASSERT_THAT(end(), IsEnd(IsThrow()));
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/int64-lowering-unittest.cc b/deps/v8/test/unittests/compiler/int64-lowering-unittest.cc
index 30e24b0aa44..e6660b7823e 100644
--- a/deps/v8/test/unittests/compiler/int64-lowering-unittest.cc
+++ b/deps/v8/test/unittests/compiler/int64-lowering-unittest.cc
@@ -816,10 +816,8 @@ TEST_F(Int64LoweringTest, I64Ror) {
   Matcher<Node*> shift_matcher =
       IsWord32And(IsParameter(0), IsInt32Constant(0x1F));
 
-  Matcher<Node*> bit_mask_matcher = IsWord32Shl(
-      IsWord32Sar(IsInt32Constant(std::numeric_limits<int32_t>::min()),
-                  shift_matcher),
-      IsInt32Constant(1));
+  Matcher<Node*> bit_mask_matcher = IsWord32Xor(
+      IsWord32Shr(IsInt32Constant(-1), shift_matcher), IsInt32Constant(-1));
 
   Matcher<Node*> inv_mask_matcher =
       IsWord32Xor(bit_mask_matcher, IsInt32Constant(-1));
diff --git a/deps/v8/test/unittests/compiler/machine-operator-reducer-unittest.cc b/deps/v8/test/unittests/compiler/machine-operator-reducer-unittest.cc
index c3659032cf3..53342cbd212 100644
--- a/deps/v8/test/unittests/compiler/machine-operator-reducer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/machine-operator-reducer-unittest.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "src/compiler/machine-operator-reducer.h"
+#include <limits>
 #include "src/base/bits.h"
 #include "src/base/division-by-constant.h"
 #include "src/base/ieee754.h"
@@ -317,6 +318,7 @@ const ComparisonBinaryOperator kComparisonBinaryOperators[] = {
 
 // Avoid undefined behavior on signed integer overflow.
 int32_t Shl(int32_t x, int32_t y) { return static_cast<uint32_t>(x) << y; }
+int64_t Shl(int64_t x, int64_t y) { return static_cast<uint64_t>(x) << y; }
 
 }  // namespace
 
@@ -763,6 +765,116 @@ TEST_F(MachineOperatorReducerTest, Word32AndWithComparisonAndConstantOne) {
   }
 }
 
+TEST_F(MachineOperatorReducerTest, Word32AndWithBitFields) {
+  Node* const p = Parameter(0);
+
+  for (int i = 0; i < 2; ++i) {
+    bool truncate_from_64_bit = i == 1;
+
+    auto truncate = [&](Node* const input) {
+      return truncate_from_64_bit
+                 ? graph()->NewNode(machine()->TruncateInt64ToInt32(), input)
+                 : input;
+    };
+
+    // Simulate getting some bitfields from a Torque bitfield struct and
+    // checking them all, like `x.a == 5 & x.b & !x.c & x.d == 2`. This is
+    // looking for the pattern: xxxxxxxxxxxxxxxxxxxx10xxx0x1x101. The inputs are
+    // in an already-reduced state as would be created by
+    // ReduceWord32EqualForConstantRhs, so the only shift operation remaining is
+    // the one for selecting a single true bit.
+    Node* three_bits =
+        graph()->NewNode(machine()->Word32Equal(), Int32Constant(5),
+                         graph()->NewNode(machine()->Word32And(),
+                                          Int32Constant(7), truncate(p)));
+    Node* single_bit_true =
+        truncate_from_64_bit
+            ? truncate(graph()->NewNode(machine()->Word64And(),
+                                        Int64Constant(1),
+                                        graph()->NewNode(machine()->Word64Shr(),
+                                                         p, Int64Constant(4))))
+            : graph()->NewNode(machine()->Word32And(), Int32Constant(1),
+                               graph()->NewNode(machine()->Word32Shr(), p,
+                                                Int32Constant(4)));
+    Node* single_bit_false =
+        graph()->NewNode(machine()->Word32Equal(), Int32Constant(0),
+                         graph()->NewNode(machine()->Word32And(),
+                                          Int32Constant(1 << 6), truncate(p)));
+    Node* two_bits =
+        graph()->NewNode(machine()->Word32Equal(), Int32Constant(2 << 10),
+                         graph()->NewNode(machine()->Word32And(),
+                                          Int32Constant(3 << 10), truncate(p)));
+
+    Reduction r1 = Reduce(
+        graph()->NewNode(machine()->Word32And(), three_bits, single_bit_true));
+    ASSERT_TRUE(r1.Changed());
+    EXPECT_THAT(
+        r1.replacement(),
+        IsWord32Equal(
+            IsWord32And(truncate_from_64_bit ? IsTruncateInt64ToInt32(p) : p,
+                        IsInt32Constant(7 | (1 << 4))),
+            IsInt32Constant(5 | (1 << 4))));
+
+    Reduction r2 = Reduce(
+        graph()->NewNode(machine()->Word32And(), single_bit_false, two_bits));
+    ASSERT_TRUE(r2.Changed());
+    EXPECT_THAT(
+        r2.replacement(),
+        IsWord32Equal(
+            IsWord32And(truncate_from_64_bit ? IsTruncateInt64ToInt32(p) : p,
+                        IsInt32Constant((1 << 6) | (3 << 10))),
+            IsInt32Constant(2 << 10)));
+
+    Reduction const r3 = Reduce(graph()->NewNode(
+        machine()->Word32And(), r1.replacement(), r2.replacement()));
+    ASSERT_TRUE(r3.Changed());
+    EXPECT_THAT(
+        r3.replacement(),
+        IsWord32Equal(
+            IsWord32And(truncate_from_64_bit ? IsTruncateInt64ToInt32(p) : p,
+                        IsInt32Constant(7 | (1 << 4) | (1 << 6) | (3 << 10))),
+            IsInt32Constant(5 | (1 << 4) | (2 << 10))));
+  }
+}
+
+// -----------------------------------------------------------------------------
+// Word32Or
+
+TEST_F(MachineOperatorReducerTest, Word32OrWithWord32And) {
+  Node* const p0 = Parameter(0);
+  TRACED_FOREACH(int32_t, m, kUint32Values) {
+    TRACED_FOREACH(int32_t, rhs, kUint32Values) {
+      // To get better coverage of interesting cases, run this test twice:
+      // once with the mask from kUint32Values, and once with its inverse.
+      for (int32_t mask : {m, ~m}) {
+        Reduction const r = Reduce(graph()->NewNode(
+            machine()->Word32Or(),
+            graph()->NewNode(machine()->Word32And(), p0, Int32Constant(mask)),
+            Int32Constant(rhs)));
+        switch (rhs) {
+          case 0:  // x | 0 => x
+            ASSERT_TRUE(r.Changed());
+            EXPECT_THAT(r.replacement(),
+                        IsWord32And(p0, IsInt32Constant(mask)));
+            break;
+          case -1:  // x | -1 => -1
+            ASSERT_TRUE(r.Changed());
+            EXPECT_THAT(r.replacement(), IsInt32Constant(-1));
+            break;
+          default:  // (x & K1) | K2 => x | K2, if K1 | K2 == -1
+            if ((mask | rhs) == -1) {
+              ASSERT_TRUE(r.Changed());
+              EXPECT_THAT(r.replacement(),
+                          IsWord32Or(p0, IsInt32Constant(rhs)));
+            } else {
+              ASSERT_TRUE(!r.Changed());
+            }
+            break;
+        }
+      }
+    }
+  }
+}
 
 // -----------------------------------------------------------------------------
 // Word32Xor
@@ -1053,11 +1165,123 @@ TEST_F(MachineOperatorReducerTest, Word32ShlWithWord32Shr) {
         Int32Constant(x));
     Reduction r = Reduce(node);
     ASSERT_TRUE(r.Changed());
-    int32_t m = static_cast<int32_t>(~((1U << x) - 1U));
+    int32_t m = static_cast<int32_t>(std::numeric_limits<uint32_t>::max() << x);
     EXPECT_THAT(r.replacement(), IsWord32And(p0, IsInt32Constant(m)));
   }
 }
 
+TEST_F(MachineOperatorReducerTest, Word32ShlWithWord32SarShiftOutZeros) {
+  Node* p = Parameter(0);
+  TRACED_FORRANGE(int32_t, x, 1, 31) {
+    TRACED_FORRANGE(int32_t, y, 0, 31) {
+      Node* node = graph()->NewNode(
+          machine()->Word32Shl(),
+          graph()->NewNode(machine()->Word32Sar(ShiftKind::kShiftOutZeros), p,
+                           Int32Constant(x)),
+          Int32Constant(y));
+      Reduction r = Reduce(node);
+      ASSERT_TRUE(r.Changed());
+      if (x == y) {
+        // (p >> x) << y => p
+        EXPECT_THAT(r.replacement(), p);
+      } else if (x < y) {
+        // (p >> x) << y => p << (y - x)
+        EXPECT_THAT(r.replacement(), IsWord32Shl(p, IsInt32Constant(y - x)));
+      } else {
+        // (p >> x) << y => p >> (x - y)
+        EXPECT_THAT(r.replacement(), IsWord32Sar(p, IsInt32Constant(x - y)));
+      }
+    }
+  }
+}
+
+// -----------------------------------------------------------------------------
+// Word64Shl
+
+TEST_F(MachineOperatorReducerTest, Word64ShlWithZeroShift) {
+  Node* p0 = Parameter(0);
+  Node* node = graph()->NewNode(machine()->Word64Shl(), p0, Int64Constant(0));
+  Reduction r = Reduce(node);
+  ASSERT_TRUE(r.Changed());
+  EXPECT_EQ(p0, r.replacement());
+}
+
+TEST_F(MachineOperatorReducerTest, Word64ShlWithWord64Sar) {
+  Node* p0 = Parameter(0);
+  TRACED_FORRANGE(int64_t, x, 1, 63) {
+    Node* node = graph()->NewNode(
+        machine()->Word64Shl(),
+        graph()->NewNode(machine()->Word64Sar(), p0, Int64Constant(x)),
+        Int64Constant(x));
+    Reduction r = Reduce(node);
+    ASSERT_TRUE(r.Changed());
+    int64_t m = static_cast<int64_t>(~((uint64_t{1} << x) - 1));
+    EXPECT_THAT(r.replacement(), IsWord64And(p0, IsInt64Constant(m)));
+  }
+}
+
+TEST_F(MachineOperatorReducerTest,
+       Word64ShlWithWord64SarAndInt64AddAndConstant) {
+  Node* const p0 = Parameter(0);
+  TRACED_FOREACH(int64_t, k, kInt64Values) {
+    TRACED_FORRANGE(int64_t, l, 1, 63) {
+      if (Shl(k, l) == 0) continue;
+      // (x + (K << L)) >> L << L => (x & (-1 << L)) + (K << L)
+      Reduction const r = Reduce(graph()->NewNode(
+          machine()->Word64Shl(),
+          graph()->NewNode(machine()->Word64Sar(),
+                           graph()->NewNode(machine()->Int64Add(), p0,
+                                            Int64Constant(Shl(k, l))),
+                           Int64Constant(l)),
+          Int64Constant(l)));
+      ASSERT_TRUE(r.Changed());
+      EXPECT_THAT(
+          r.replacement(),
+          IsInt64Add(IsWord64And(p0, IsInt64Constant(Shl(int64_t{-1}, l))),
+                     IsInt64Constant(Shl(k, l))));
+    }
+  }
+}
+
+TEST_F(MachineOperatorReducerTest, Word64ShlWithWord64Shr) {
+  Node* p0 = Parameter(0);
+  TRACED_FORRANGE(int64_t, x, 1, 63) {
+    Node* node = graph()->NewNode(
+        machine()->Word64Shl(),
+        graph()->NewNode(machine()->Word64Shr(), p0, Int64Constant(x)),
+        Int64Constant(x));
+    Reduction r = Reduce(node);
+    ASSERT_TRUE(r.Changed());
+    int64_t m = static_cast<int64_t>(std::numeric_limits<uint64_t>::max() << x);
+    EXPECT_THAT(r.replacement(), IsWord64And(p0, IsInt64Constant(m)));
+  }
+}
+
+TEST_F(MachineOperatorReducerTest, Word64ShlWithWord64SarShiftOutZeros) {
+  Node* p = Parameter(0);
+  TRACED_FORRANGE(int64_t, x, 1, 63) {
+    TRACED_FORRANGE(int64_t, y, 0, 63) {
+      Node* node = graph()->NewNode(
+          machine()->Word64Shl(),
+          graph()->NewNode(machine()->Word64Sar(ShiftKind::kShiftOutZeros), p,
+                           Int64Constant(x)),
+          Int64Constant(y));
+      Reduction r = Reduce(node);
+      ASSERT_TRUE(r.Changed());
+      if (x == y) {
+        // (p >> x) << y => p
+        EXPECT_THAT(r.replacement(), p);
+      } else if (x < y) {
+        // (p >> x) << y => p << (y - x)
+        EXPECT_THAT(r.replacement(), IsWord64Shl(p, IsInt64Constant(y - x)));
+      } else {
+        // (p >> x) << y => p >> (x - y)
+        EXPECT_THAT(r.replacement(), IsWord64Sar(p, IsInt64Constant(x - y)));
+      }
+    }
+  }
+}
+
 // -----------------------------------------------------------------------------
 // Word32Equal
 
@@ -1853,6 +2077,29 @@ TEST_F(MachineOperatorReducerTest, Int32LessThanWithWord32Or) {
   }
 }
 
+TEST_F(MachineOperatorReducerTest, Int32LessThanWithWord32SarShiftOutZeros) {
+  Node* const p0 = Parameter(0);
+  Node* const p1 = Parameter(1);
+  TRACED_FORRANGE(int32_t, shift0, 1, 3) {
+    TRACED_FORRANGE(int32_t, shift1, 1, 3) {
+      Node* const node =
+          graph()->NewNode(machine()->Int32LessThan(),
+                           graph()->NewNode(machine()->Word32SarShiftOutZeros(),
+                                            p0, Int32Constant(shift0)),
+                           graph()->NewNode(machine()->Word32SarShiftOutZeros(),
+                                            p1, Int32Constant(shift1)));
+
+      Reduction r = Reduce(node);
+      if (shift0 == shift1) {
+        ASSERT_TRUE(r.Changed());
+        EXPECT_THAT(r.replacement(), IsInt32LessThan(p0, p1));
+      } else {
+        ASSERT_FALSE(r.Changed());
+      }
+    }
+  }
+}
+
 // -----------------------------------------------------------------------------
 // Uint32LessThan
 
@@ -1873,6 +2120,80 @@ TEST_F(MachineOperatorReducerTest, Uint32LessThanWithWord32Sar) {
   }
 }
 
+TEST_F(MachineOperatorReducerTest, Uint32LessThanWithWord32SarShiftOutZeros) {
+  Node* const p0 = Parameter(0);
+  Node* const p1 = Parameter(1);
+  TRACED_FORRANGE(int32_t, shift0, 1, 3) {
+    TRACED_FORRANGE(int32_t, shift1, 1, 3) {
+      Node* const node =
+          graph()->NewNode(machine()->Uint32LessThan(),
+                           graph()->NewNode(machine()->Word32SarShiftOutZeros(),
+                                            p0, Int32Constant(shift0)),
+                           graph()->NewNode(machine()->Word32SarShiftOutZeros(),
+                                            p1, Int32Constant(shift1)));
+
+      Reduction r = Reduce(node);
+      if (shift0 == shift1) {
+        ASSERT_TRUE(r.Changed());
+        EXPECT_THAT(r.replacement(), IsUint32LessThan(p0, p1));
+      } else {
+        ASSERT_FALSE(r.Changed());
+      }
+    }
+  }
+}
+
+// -----------------------------------------------------------------------------
+// Uint64LessThan
+
+TEST_F(MachineOperatorReducerTest, Uint64LessThanWithWord64SarShiftOutZeros) {
+  Node* const p0 = Parameter(0);
+  Node* const p1 = Parameter(1);
+  TRACED_FORRANGE(int64_t, shift0, 1, 3) {
+    TRACED_FORRANGE(int64_t, shift1, 1, 3) {
+      Node* const node =
+          graph()->NewNode(machine()->Uint64LessThan(),
+                           graph()->NewNode(machine()->Word64SarShiftOutZeros(),
+                                            p0, Int64Constant(shift0)),
+                           graph()->NewNode(machine()->Word64SarShiftOutZeros(),
+                                            p1, Int64Constant(shift1)));
+
+      Reduction r = Reduce(node);
+      if (shift0 == shift1) {
+        ASSERT_TRUE(r.Changed());
+        EXPECT_THAT(r.replacement(), IsUint64LessThan(p0, p1));
+      } else {
+        ASSERT_FALSE(r.Changed());
+      }
+    }
+  }
+}
+
+// -----------------------------------------------------------------------------
+// Int64LessThan
+
+TEST_F(MachineOperatorReducerTest, Int64LessThanWithWord64SarShiftOutZeros) {
+  Node* const p0 = Parameter(0);
+  Node* const p1 = Parameter(1);
+  TRACED_FORRANGE(int64_t, shift0, 1, 3) {
+    TRACED_FORRANGE(int64_t, shift1, 1, 3) {
+      Node* const node =
+          graph()->NewNode(machine()->Int64LessThan(),
+                           graph()->NewNode(machine()->Word64SarShiftOutZeros(),
+                                            p0, Int64Constant(shift0)),
+                           graph()->NewNode(machine()->Word64SarShiftOutZeros(),
+                                            p1, Int64Constant(shift1)));
+
+      Reduction r = Reduce(node);
+      if (shift0 == shift1) {
+        ASSERT_TRUE(r.Changed());
+        EXPECT_THAT(r.replacement(), IsInt64LessThan(p0, p1));
+      } else {
+        ASSERT_FALSE(r.Changed());
+      }
+    }
+  }
+}
 
 // -----------------------------------------------------------------------------
 // Float64Mul
diff --git a/deps/v8/test/unittests/compiler/node-test-utils.cc b/deps/v8/test/unittests/compiler/node-test-utils.cc
index bddcea5743e..aeceabeffa0 100644
--- a/deps/v8/test/unittests/compiler/node-test-utils.cc
+++ b/deps/v8/test/unittests/compiler/node-test-utils.cc
@@ -1489,6 +1489,18 @@ Matcher<Node*> IsDead() {
   return MakeMatcher(new TestNodeMatcher(IrOpcode::kDead));
 }
 
+Matcher<Node*> IsUnreachable() {
+  return MakeMatcher(new TestNodeMatcher(IrOpcode::kUnreachable));
+}
+
+Matcher<Node*> IsThrow() {
+  return MakeMatcher(new TestNodeMatcher(IrOpcode::kThrow));
+}
+
+Matcher<Node*> IsStart() {
+  return MakeMatcher(new TestNodeMatcher(IrOpcode::kStart));
+}
+
 Matcher<Node*> IsEnd(const Matcher<Node*>& control0_matcher) {
   return MakeMatcher(new IsControl1Matcher(IrOpcode::kEnd, control0_matcher));
 }
@@ -2175,6 +2187,8 @@ IS_BINOP_MATCHER(Int64Add)
 IS_BINOP_MATCHER(Int64Div)
 IS_BINOP_MATCHER(Int64Sub)
 IS_BINOP_MATCHER(Int64Mul)
+IS_BINOP_MATCHER(Int64LessThan)
+IS_BINOP_MATCHER(Uint64LessThan)
 IS_BINOP_MATCHER(JSAdd)
 IS_BINOP_MATCHER(JSParseInt)
 IS_BINOP_MATCHER(Float32Equal)
diff --git a/deps/v8/test/unittests/compiler/node-test-utils.h b/deps/v8/test/unittests/compiler/node-test-utils.h
index bf21427a5ce..42d6db82cf2 100644
--- a/deps/v8/test/unittests/compiler/node-test-utils.h
+++ b/deps/v8/test/unittests/compiler/node-test-utils.h
@@ -37,6 +37,9 @@ class Node;
 using ::testing::Matcher;
 
 Matcher<Node*> IsDead();
+Matcher<Node*> IsUnreachable();
+Matcher<Node*> IsThrow();
+Matcher<Node*> IsStart();
 Matcher<Node*> IsEnd(const Matcher<Node*>& control0_matcher);
 Matcher<Node*> IsEnd(const Matcher<Node*>& control0_matcher,
                      const Matcher<Node*>& control1_matcher);
@@ -412,6 +415,10 @@ Matcher<Node*> IsInt64Mul(const Matcher<Node*>& lhs_matcher,
                           const Matcher<Node*>& rhs_matcher);
 Matcher<Node*> IsInt64Div(const Matcher<Node*>& lhs_matcher,
                           const Matcher<Node*>& rhs_matcher);
+Matcher<Node*> IsInt64LessThan(const Matcher<Node*>& lhs_matcher,
+                               const Matcher<Node*>& rhs_matcher);
+Matcher<Node*> IsUint64LessThan(const Matcher<Node*>& lhs_matcher,
+                                const Matcher<Node*>& rhs_matcher);
 Matcher<Node*> IsJSAdd(const Matcher<Node*>& lhs_matcher,
                        const Matcher<Node*>& rhs_matcher);
 Matcher<Node*> IsJSParseInt(const Matcher<Node*>& lhs_matcher,
diff --git a/deps/v8/test/unittests/compiler/redundancy-elimination-unittest.cc b/deps/v8/test/unittests/compiler/redundancy-elimination-unittest.cc
index 9dda52ed8ef..6af2969166a 100644
--- a/deps/v8/test/unittests/compiler/redundancy-elimination-unittest.cc
+++ b/deps/v8/test/unittests/compiler/redundancy-elimination-unittest.cc
@@ -670,18 +670,16 @@ TEST_F(RedundancyEliminationTest, CheckedUint32Bounds) {
       Node* effect = graph()->start();
       Node* control = graph()->start();
 
-      Node* check1 = effect = graph()->NewNode(
-          simplified()->CheckedUint32Bounds(
-              feedback1, CheckBoundsParameters::kDeoptOnOutOfBounds),
-          index, length, effect, control);
+      Node* check1 = effect =
+          graph()->NewNode(simplified()->CheckedUint32Bounds(feedback1, {}),
+                           index, length, effect, control);
       Reduction r1 = Reduce(check1);
       ASSERT_TRUE(r1.Changed());
       EXPECT_EQ(r1.replacement(), check1);
 
-      Node* check2 = effect = graph()->NewNode(
-          simplified()->CheckedUint32Bounds(
-              feedback2, CheckBoundsParameters::kDeoptOnOutOfBounds),
-          index, length, effect, control);
+      Node* check2 = effect =
+          graph()->NewNode(simplified()->CheckedUint32Bounds(feedback2, {}),
+                           index, length, effect, control);
       Reduction r2 = Reduce(check2);
       ASSERT_TRUE(r2.Changed());
       EXPECT_EQ(r2.replacement(), check1);
@@ -754,18 +752,16 @@ TEST_F(RedundancyEliminationTest, CheckedUint64Bounds) {
       Node* effect = graph()->start();
       Node* control = graph()->start();
 
-      Node* check1 = effect = graph()->NewNode(
-          simplified()->CheckedUint64Bounds(
-              feedback1, CheckBoundsParameters::kDeoptOnOutOfBounds),
-          index, length, effect, control);
+      Node* check1 = effect =
+          graph()->NewNode(simplified()->CheckedUint64Bounds(feedback1, {}),
+                           index, length, effect, control);
       Reduction r1 = Reduce(check1);
       ASSERT_TRUE(r1.Changed());
       EXPECT_EQ(r1.replacement(), check1);
 
-      Node* check2 = effect = graph()->NewNode(
-          simplified()->CheckedUint64Bounds(
-              feedback2, CheckBoundsParameters::kDeoptOnOutOfBounds),
-          index, length, effect, control);
+      Node* check2 = effect =
+          graph()->NewNode(simplified()->CheckedUint64Bounds(feedback2, {}),
+                           index, length, effect, control);
       Reduction r2 = Reduce(check2);
       ASSERT_TRUE(r2.Changed());
       EXPECT_EQ(r2.replacement(), check1);
diff --git a/deps/v8/test/unittests/execution/microtask-queue-unittest.cc b/deps/v8/test/unittests/execution/microtask-queue-unittest.cc
index 3b59b7cf35d..a19cad7953c 100644
--- a/deps/v8/test/unittests/execution/microtask-queue-unittest.cc
+++ b/deps/v8/test/unittests/execution/microtask-queue-unittest.cc
@@ -65,7 +65,7 @@ using TestWithNativeContextAndFinalizationRegistry =  //
         WithContextMixin<                             //
             WithFinalizationRegistryMixin<            //
                 WithIsolateScopeMixin<                //
-                    WithSharedIsolateMixin<           //
+                    WithIsolateMixin<                 //
                         ::testing::Test>>>>>;
 
 namespace {
@@ -89,7 +89,7 @@ class MicrotaskQueueTest : public TestWithNativeContextAndFinalizationRegistry,
 
   void SetUp() override {
     microtask_queue_ = MicrotaskQueue::New(isolate());
-    native_context()->set_microtask_queue(microtask_queue());
+    native_context()->set_microtask_queue(isolate(), microtask_queue());
 
     if (GetParam()) {
       // Use a PromiseHook to switch the implementation to ResolvePromise
@@ -254,9 +254,9 @@ TEST_P(MicrotaskQueueTest, PromiseHandlerContext) {
   Handle<Context> context2 = Utils::OpenHandle(*v8_context2, isolate());
   Handle<Context> context3 = Utils::OpenHandle(*v8_context3, isolate());
   Handle<Context> context4 = Utils::OpenHandle(*v8_context3, isolate());
-  context2->native_context().set_microtask_queue(microtask_queue());
-  context3->native_context().set_microtask_queue(microtask_queue());
-  context4->native_context().set_microtask_queue(microtask_queue());
+  context2->native_context().set_microtask_queue(isolate(), microtask_queue());
+  context3->native_context().set_microtask_queue(isolate(), microtask_queue());
+  context4->native_context().set_microtask_queue(isolate(), microtask_queue());
 
   Handle<JSFunction> handler;
   Handle<JSProxy> proxy;
@@ -587,7 +587,7 @@ TEST_P(MicrotaskQueueTest, DetachGlobal_InactiveHandler) {
   Local<v8::Context> sub_context = v8::Context::New(v8_isolate());
   Utils::OpenHandle(*sub_context)
       ->native_context()
-      .set_microtask_queue(microtask_queue());
+      .set_microtask_queue(isolate(), microtask_queue());
 
   Handle<JSArray> result;
   Handle<JSFunction> stale_handler;
diff --git a/deps/v8/test/unittests/heap/bitmap-unittest.cc b/deps/v8/test/unittests/heap/bitmap-unittest.cc
index 393f5ea303f..8729d8acb09 100644
--- a/deps/v8/test/unittests/heap/bitmap-unittest.cc
+++ b/deps/v8/test/unittests/heap/bitmap-unittest.cc
@@ -41,7 +41,7 @@ TEST_F(NonAtomicBitmapTest, Cells) {
 }
 
 TEST_F(NonAtomicBitmapTest, CellsCount) {
-  int last_cell_index = bitmap()->CellsCount() - 1;
+  size_t last_cell_index = bitmap()->CellsCount() - 1;
   bitmap()->cells()[last_cell_index] = kBlackCell;
   // Manually verify on raw memory.
   uint8_t* raw = raw_bitmap();
diff --git a/deps/v8/test/unittests/heap/code-object-registry-unittest.cc b/deps/v8/test/unittests/heap/code-object-registry-unittest.cc
index 9b7ac1853e6..10dbd34803b 100644
--- a/deps/v8/test/unittests/heap/code-object-registry-unittest.cc
+++ b/deps/v8/test/unittests/heap/code-object-registry-unittest.cc
@@ -2,7 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/heap/spaces.h"
+#include "src/heap/code-object-registry.h"
+
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace v8 {
diff --git a/deps/v8/test/unittests/heap/cppgc/allocation_unittest.cc b/deps/v8/test/unittests/heap/cppgc/allocation_unittest.cc
deleted file mode 100644
index 3a02ae17217..00000000000
--- a/deps/v8/test/unittests/heap/cppgc/allocation_unittest.cc
+++ /dev/null
@@ -1,42 +0,0 @@
-// Copyright 2020 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "include/cppgc/allocation.h"
-
-#include <memory>
-
-#include "src/heap/cppgc/heap.h"
-#include "test/unittests/heap/cppgc/tests.h"
-#include "testing/gtest/include/gtest/gtest.h"
-
-namespace cppgc {
-
-TEST(GCBasicHeapTest, CreateAndDestroyHeap) {
-  std::unique_ptr<Heap> heap{Heap::Create()};
-}
-
-namespace {
-
-class Foo : public GarbageCollected<Foo> {
- public:
-  static size_t destructor_callcount;
-
-  Foo() { destructor_callcount = 0; }
-  ~Foo() { destructor_callcount++; }
-};
-
-size_t Foo::destructor_callcount;
-
-class GCAllocationTest : public testing::TestWithHeap {};
-
-}  // namespace
-
-TEST_F(GCAllocationTest, MakeGarbageCollectedAndReclaim) {
-  MakeGarbageCollected<Foo>(GetHeap());
-  EXPECT_EQ(0u, Foo::destructor_callcount);
-  internal::Heap::From(GetHeap())->CollectGarbage();
-  EXPECT_EQ(1u, Foo::destructor_callcount);
-}
-
-}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/concurrent-sweeper-unittest.cc b/deps/v8/test/unittests/heap/cppgc/concurrent-sweeper-unittest.cc
new file mode 100644
index 00000000000..6a4aa203739
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/concurrent-sweeper-unittest.cc
@@ -0,0 +1,314 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <algorithm>
+#include <set>
+#include <vector>
+
+#include "include/cppgc/allocation.h"
+#include "include/cppgc/platform.h"
+#include "include/v8-platform.h"
+#include "src/heap/cppgc/globals.h"
+#include "src/heap/cppgc/heap-object-header-inl.h"
+#include "src/heap/cppgc/heap-page.h"
+#include "src/heap/cppgc/heap-space.h"
+#include "src/heap/cppgc/heap-visitor.h"
+#include "src/heap/cppgc/page-memory-inl.h"
+#include "src/heap/cppgc/raw-heap.h"
+#include "src/heap/cppgc/sweeper.h"
+#include "test/unittests/heap/cppgc/test-platform.h"
+#include "test/unittests/heap/cppgc/tests.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+class ResetLocalAllocationBufferVisitor final
+    : public HeapVisitor<ResetLocalAllocationBufferVisitor> {
+ public:
+  bool VisitLargePageSpace(LargePageSpace*) { return true; }
+  bool VisitNormalPageSpace(NormalPageSpace* space) {
+    space->ResetLinearAllocationBuffer();
+    return true;
+  }
+};
+
+void ResetLocalAllocationBuffers(Heap* heap) {
+  ResetLocalAllocationBufferVisitor visitor;
+  visitor.Traverse(&heap->raw_heap());
+}
+
+size_t g_destructor_callcount;
+
+template <size_t Size>
+class Finalizable : public GarbageCollected<Finalizable<Size>> {
+ public:
+  Finalizable() : creation_thread_{v8::base::OS::GetCurrentThreadId()} {}
+
+  virtual ~Finalizable() {
+    ++g_destructor_callcount;
+    EXPECT_EQ(creation_thread_, v8::base::OS::GetCurrentThreadId());
+  }
+
+  virtual void Trace(cppgc::Visitor*) const {}
+
+ private:
+  char array_[Size];
+  int creation_thread_;
+};
+
+using NormalFinalizable = Finalizable<32>;
+using LargeFinalizable = Finalizable<kLargeObjectSizeThreshold * 2>;
+
+template <size_t Size>
+class NonFinalizable : public GarbageCollected<NonFinalizable<Size>> {
+ public:
+  virtual void Trace(cppgc::Visitor*) const {}
+
+ private:
+  char array_[Size];
+};
+
+using NormalNonFinalizable = NonFinalizable<32>;
+using LargeNonFinalizable = NonFinalizable<kLargeObjectSizeThreshold * 2>;
+
+class ConcurrentSweeperTest : public testing::TestWithHeap {
+ public:
+  ConcurrentSweeperTest() { g_destructor_callcount = 0; }
+
+  void StartSweeping() {
+    Heap* heap = Heap::From(GetHeap());
+    ResetLocalAllocationBuffers(heap);
+    Sweeper& sweeper = heap->sweeper();
+    sweeper.Start(Sweeper::Config::kIncrementalAndConcurrent);
+  }
+
+  void FinishSweeping() {
+    Heap* heap = Heap::From(GetHeap());
+    Sweeper& sweeper = heap->sweeper();
+    sweeper.Finish();
+  }
+
+  const RawHeap& GetRawHeap() const {
+    const Heap* heap = Heap::From(GetHeap());
+    return heap->raw_heap();
+  }
+
+  void CheckFreeListEntries(const std::vector<void*>& objects) {
+    const Heap* heap = Heap::From(GetHeap());
+    const PageBackend* backend = heap->page_backend();
+
+    for (auto* object : objects) {
+      // The corresponding page could be removed.
+      if (!backend->Lookup(static_cast<ConstAddress>(object))) continue;
+
+      const auto* header =
+          BasePage::FromPayload(object)->TryObjectHeaderFromInnerAddress(
+              object);
+      // TryObjectHeaderFromInnerAddress returns nullptr for freelist entries.
+      EXPECT_EQ(nullptr, header);
+    }
+  }
+
+  void CheckPageRemoved(const BasePage* page) {
+    const Heap* heap = Heap::From(GetHeap());
+    const PageBackend* backend = heap->page_backend();
+    EXPECT_EQ(nullptr, backend->Lookup(reinterpret_cast<ConstAddress>(page)));
+  }
+
+  bool FreeListContains(const BaseSpace* space,
+                        const std::vector<void*>& objects) {
+    const Heap* heap = Heap::From(GetHeap());
+    const PageBackend* backend = heap->page_backend();
+    const auto& freelist = NormalPageSpace::From(space)->free_list();
+
+    for (void* object : objects) {
+      // The corresponding page could be removed.
+      if (!backend->Lookup(static_cast<ConstAddress>(object))) continue;
+
+      if (!freelist.Contains({object, 0})) return false;
+    }
+
+    return true;
+  }
+};
+
+}  // namespace
+
+TEST_F(ConcurrentSweeperTest, BackgroundSweepOfNormalPage) {
+  // Non finalizable objects are swept right away.
+  using GCedType = NormalNonFinalizable;
+
+  auto* unmarked_object = MakeGarbageCollected<GCedType>(GetHeap());
+  auto* marked_object = MakeGarbageCollected<GCedType>(GetHeap());
+  HeapObjectHeader::FromPayload(marked_object).TryMarkAtomic();
+
+  auto* page = BasePage::FromPayload(unmarked_object);
+  auto* space = page->space();
+
+  // The test requires objects to be allocated on the same page;
+  ASSERT_EQ(page, BasePage::FromPayload(marked_object));
+
+  StartSweeping();
+
+  // Wait for concurrent sweeping to finish.
+  GetPlatform().WaitAllBackgroundTasks();
+
+  // Check that the marked object was unmarked.
+  EXPECT_FALSE(HeapObjectHeader::FromPayload(marked_object).IsMarked());
+
+  // Check that free list entries are created right away for non-finalizable
+  // objects, but not immediately returned to the space's freelist.
+  CheckFreeListEntries({unmarked_object});
+  EXPECT_FALSE(FreeListContains(space, {unmarked_object}));
+
+  FinishSweeping();
+
+  // Check that finalizable objects are swept and put into the freelist of the
+  // corresponding space.
+  EXPECT_TRUE(FreeListContains(space, {unmarked_object}));
+}
+
+TEST_F(ConcurrentSweeperTest, BackgroundSweepOfLargePage) {
+  // Non finalizable objects are swept right away.
+  using GCedType = LargeNonFinalizable;
+
+  auto* unmarked_object = MakeGarbageCollected<GCedType>(GetHeap());
+  auto* marked_object = MakeGarbageCollected<GCedType>(GetHeap());
+  HeapObjectHeader::FromPayload(marked_object).TryMarkAtomic();
+
+  auto* unmarked_page = BasePage::FromPayload(unmarked_object);
+  auto* marked_page = BasePage::FromPayload(marked_object);
+  auto* space = unmarked_page->space();
+
+  ASSERT_EQ(space, marked_page->space());
+
+  StartSweeping();
+
+  // Wait for concurrent sweeping to finish.
+  GetPlatform().WaitAllBackgroundTasks();
+
+  // Check that the marked object was unmarked.
+  EXPECT_FALSE(HeapObjectHeader::FromPayload(marked_object).IsMarked());
+
+  // Check that free list entries are created right away for non-finalizable
+  // objects, but not immediately returned to the space's freelist.
+  CheckPageRemoved(unmarked_page);
+
+  // Check that marked pages are returned to space right away.
+  EXPECT_NE(space->end(), std::find(space->begin(), space->end(), marked_page));
+
+  FinishSweeping();
+}
+
+TEST_F(ConcurrentSweeperTest, DeferredFinalizationOfNormalPage) {
+  static constexpr size_t kNumberOfObjects = 10;
+  // Finalizable types are left intact by concurrent sweeper.
+  using GCedType = NormalFinalizable;
+
+  std::set<BasePage*> pages;
+  std::vector<void*> objects;
+
+  BaseSpace* space = nullptr;
+  for (size_t i = 0; i < kNumberOfObjects; ++i) {
+    auto* object = MakeGarbageCollected<GCedType>(GetHeap());
+    objects.push_back(object);
+    auto* page = BasePage::FromPayload(object);
+    pages.insert(page);
+    if (!space) space = page->space();
+  }
+
+  StartSweeping();
+
+  // Wait for concurrent sweeping to finish.
+  GetPlatform().WaitAllBackgroundTasks();
+
+  // Check that pages are not returned right away.
+  for (auto* page : pages) {
+    EXPECT_EQ(space->end(), std::find(space->begin(), space->end(), page));
+  }
+  // Check that finalizable objects are left intact in pages.
+  EXPECT_FALSE(FreeListContains(space, objects));
+  // No finalizers have been executed.
+  EXPECT_EQ(0u, g_destructor_callcount);
+
+  FinishSweeping();
+
+  // Check that finalizable objects are swept and turned into freelist entries.
+  CheckFreeListEntries(objects);
+  // Check that space's freelist contains these entries.
+  EXPECT_TRUE(FreeListContains(space, objects));
+  // Check that finalizers have been executed.
+  EXPECT_EQ(kNumberOfObjects, g_destructor_callcount);
+}
+
+TEST_F(ConcurrentSweeperTest, DeferredFinalizationOfLargePage) {
+  using GCedType = LargeFinalizable;
+
+  auto* object = MakeGarbageCollected<GCedType>(GetHeap());
+
+  auto* page = BasePage::FromPayload(object);
+  auto* space = page->space();
+
+  StartSweeping();
+
+  // Wait for concurrent sweeping to finish.
+  GetPlatform().WaitAllBackgroundTasks();
+
+  // Check that the page is not returned to the space.
+  EXPECT_EQ(space->end(), std::find(space->begin(), space->end(), page));
+  // Check that no destructors have been executed yet.
+  EXPECT_EQ(0u, g_destructor_callcount);
+
+  FinishSweeping();
+
+  // Check that the destructor was executed.
+  EXPECT_EQ(1u, g_destructor_callcount);
+  // Check that page was unmapped.
+  CheckPageRemoved(page);
+}
+
+TEST_F(ConcurrentSweeperTest, IncrementalSweeping) {
+  testing::TestPlatform::DisableBackgroundTasksScope disable_concurrent_sweeper(
+      &GetPlatform());
+
+  auto task_runner = GetPlatform().GetForegroundTaskRunner();
+
+  // Create two unmarked objects.
+  MakeGarbageCollected<NormalFinalizable>(GetHeap());
+  MakeGarbageCollected<LargeFinalizable>(GetHeap());
+
+  // Create two marked objects.
+  auto* marked_normal_object =
+      MakeGarbageCollected<NormalFinalizable>(GetHeap());
+  auto* marked_large_object = MakeGarbageCollected<LargeFinalizable>(GetHeap());
+
+  auto& marked_normal_header =
+      HeapObjectHeader::FromPayload(marked_normal_object);
+  auto& marked_large_header =
+      HeapObjectHeader::FromPayload(marked_large_object);
+
+  marked_normal_header.TryMarkAtomic();
+  marked_large_header.TryMarkAtomic();
+
+  StartSweeping();
+
+  EXPECT_EQ(0u, g_destructor_callcount);
+  EXPECT_TRUE(marked_normal_header.IsMarked());
+  EXPECT_TRUE(marked_large_header.IsMarked());
+
+  // Wait for incremental sweeper to finish.
+  GetPlatform().WaitAllForegroundTasks();
+
+  EXPECT_EQ(2u, g_destructor_callcount);
+  EXPECT_FALSE(marked_normal_header.IsMarked());
+  EXPECT_FALSE(marked_large_header.IsMarked());
+
+  FinishSweeping();
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/custom-spaces-unittest.cc b/deps/v8/test/unittests/heap/cppgc/custom-spaces-unittest.cc
new file mode 100644
index 00000000000..63db50e4b01
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/custom-spaces-unittest.cc
@@ -0,0 +1,138 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "include/cppgc/allocation.h"
+#include "include/cppgc/custom-space.h"
+#include "src/heap/cppgc/heap-page.h"
+#include "src/heap/cppgc/raw-heap.h"
+#include "test/unittests/heap/cppgc/tests.h"
+
+namespace cppgc {
+
+class CustomSpace1 : public CustomSpace<CustomSpace1> {
+ public:
+  static constexpr size_t kSpaceIndex = 0;
+};
+
+class CustomSpace2 : public CustomSpace<CustomSpace2> {
+ public:
+  static constexpr size_t kSpaceIndex = 1;
+};
+
+namespace internal {
+
+namespace {
+
+size_t g_destructor_callcount;
+
+class TestWithHeapWithCustomSpaces : public testing::TestWithPlatform {
+ protected:
+  TestWithHeapWithCustomSpaces() {
+    Heap::HeapOptions options;
+    options.custom_spaces.emplace_back(std::make_unique<CustomSpace1>());
+    options.custom_spaces.emplace_back(std::make_unique<CustomSpace2>());
+    heap_ = Heap::Create(platform_, std::move(options));
+    g_destructor_callcount = 0;
+  }
+
+  void PreciseGC() {
+    heap_->ForceGarbageCollectionSlow(
+        "TestWithHeapWithCustomSpaces", "Testing",
+        Heap::GCConfig::StackState::kNoHeapPointers);
+  }
+
+  cppgc::Heap* GetHeap() const { return heap_.get(); }
+
+ private:
+  std::unique_ptr<cppgc::Heap> heap_;
+};
+
+class RegularGCed final : public GarbageCollected<RegularGCed> {
+ public:
+  void Trace(Visitor*) const {}
+};
+
+class CustomGCed1 final : public GarbageCollected<CustomGCed1> {
+ public:
+  ~CustomGCed1() { g_destructor_callcount++; }
+  void Trace(Visitor*) const {}
+};
+class CustomGCed2 final : public GarbageCollected<CustomGCed2> {
+ public:
+  ~CustomGCed2() { g_destructor_callcount++; }
+  void Trace(Visitor*) const {}
+};
+
+class CustomGCedBase : public GarbageCollected<CustomGCedBase> {
+ public:
+  void Trace(Visitor*) const {}
+};
+class CustomGCedFinal1 final : public CustomGCedBase {
+ public:
+  ~CustomGCedFinal1() { g_destructor_callcount++; }
+};
+class CustomGCedFinal2 final : public CustomGCedBase {
+ public:
+  ~CustomGCedFinal2() { g_destructor_callcount++; }
+};
+
+}  // namespace
+
+}  // namespace internal
+
+template <>
+struct SpaceTrait<internal::CustomGCed1> {
+  using Space = CustomSpace1;
+};
+
+template <>
+struct SpaceTrait<internal::CustomGCed2> {
+  using Space = CustomSpace2;
+};
+
+template <typename T>
+struct SpaceTrait<
+    T, std::enable_if_t<std::is_base_of<internal::CustomGCedBase, T>::value>> {
+  using Space = CustomSpace1;
+};
+
+namespace internal {
+
+TEST_F(TestWithHeapWithCustomSpaces, AllocateOnCustomSpaces) {
+  auto* regular = MakeGarbageCollected<RegularGCed>(GetHeap());
+  auto* custom1 = MakeGarbageCollected<CustomGCed1>(GetHeap());
+  auto* custom2 = MakeGarbageCollected<CustomGCed2>(GetHeap());
+  EXPECT_EQ(RawHeap::kNumberOfRegularSpaces,
+            NormalPage::FromPayload(custom1)->space()->index());
+  EXPECT_EQ(RawHeap::kNumberOfRegularSpaces + 1,
+            NormalPage::FromPayload(custom2)->space()->index());
+  EXPECT_EQ(static_cast<size_t>(RawHeap::RegularSpaceType::kNormal1),
+            NormalPage::FromPayload(regular)->space()->index());
+}
+
+TEST_F(TestWithHeapWithCustomSpaces,
+       AllocateOnCustomSpacesSpecifiedThroughBase) {
+  auto* regular = MakeGarbageCollected<RegularGCed>(GetHeap());
+  auto* custom1 = MakeGarbageCollected<CustomGCedFinal1>(GetHeap());
+  auto* custom2 = MakeGarbageCollected<CustomGCedFinal2>(GetHeap());
+  EXPECT_EQ(RawHeap::kNumberOfRegularSpaces,
+            NormalPage::FromPayload(custom1)->space()->index());
+  EXPECT_EQ(RawHeap::kNumberOfRegularSpaces,
+            NormalPage::FromPayload(custom2)->space()->index());
+  EXPECT_EQ(static_cast<size_t>(RawHeap::RegularSpaceType::kNormal1),
+            NormalPage::FromPayload(regular)->space()->index());
+}
+
+TEST_F(TestWithHeapWithCustomSpaces, SweepCustomSpace) {
+  MakeGarbageCollected<CustomGCedFinal1>(GetHeap());
+  MakeGarbageCollected<CustomGCedFinal2>(GetHeap());
+  MakeGarbageCollected<CustomGCed1>(GetHeap());
+  MakeGarbageCollected<CustomGCed2>(GetHeap());
+  EXPECT_EQ(0u, g_destructor_callcount);
+  PreciseGC();
+  EXPECT_EQ(4u, g_destructor_callcount);
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/finalizer-trait_unittest.cc b/deps/v8/test/unittests/heap/cppgc/finalizer-trait-unittest.cc
similarity index 98%
rename from deps/v8/test/unittests/heap/cppgc/finalizer-trait_unittest.cc
rename to deps/v8/test/unittests/heap/cppgc/finalizer-trait-unittest.cc
index 91a255e7275..23da432730f 100644
--- a/deps/v8/test/unittests/heap/cppgc/finalizer-trait_unittest.cc
+++ b/deps/v8/test/unittests/heap/cppgc/finalizer-trait-unittest.cc
@@ -2,8 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "include/cppgc/finalizer-trait.h"
+#include "include/cppgc/internal/finalizer-trait.h"
+
 #include <type_traits>
+
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace cppgc {
diff --git a/deps/v8/test/unittests/heap/cppgc/free-list-unittest.cc b/deps/v8/test/unittests/heap/cppgc/free-list-unittest.cc
new file mode 100644
index 00000000000..e059734cf94
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/free-list-unittest.cc
@@ -0,0 +1,187 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/free-list.h"
+
+#include <memory>
+#include <numeric>
+#include <vector>
+
+#include "src/base/bits.h"
+#include "src/heap/cppgc/globals.h"
+#include "src/heap/cppgc/heap-object-header.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+namespace {
+
+class Block {
+ public:
+  Block() = default;
+  explicit Block(size_t size) : address_(calloc(1, size)), size_(size) {}
+
+  Block(Block&& other) V8_NOEXCEPT : address_(other.address_),
+                                     size_(other.size_) {
+    other.address_ = nullptr;
+    other.size_ = 0;
+  }
+
+  Block& operator=(Block&& other) V8_NOEXCEPT {
+    address_ = other.address_;
+    size_ = other.size_;
+    other.address_ = nullptr;
+    other.size_ = 0;
+    return *this;
+  }
+
+  ~Block() { free(address_); }
+
+  void* Address() const { return address_; }
+  size_t Size() const { return size_; }
+
+ private:
+  void* address_ = nullptr;
+  size_t size_ = 0;
+};
+
+std::vector<Block> CreateEntries() {
+  static constexpr size_t kFreeListEntrySizeLog2 =
+      v8::base::bits::WhichPowerOfTwo(kFreeListEntrySize);
+  std::vector<Block> vector;
+  vector.reserve(kPageSizeLog2);
+  for (size_t i = kFreeListEntrySizeLog2; i < kPageSizeLog2; ++i) {
+    vector.emplace_back(static_cast<size_t>(1u) << i);
+  }
+  return vector;
+}
+
+FreeList CreatePopulatedFreeList(const std::vector<Block>& blocks) {
+  FreeList list;
+  for (const auto& block : blocks) {
+    list.Add({block.Address(), block.Size()});
+  }
+  return list;
+}
+
+}  // namespace
+
+TEST(FreeListTest, Empty) {
+  FreeList list;
+  EXPECT_TRUE(list.IsEmpty());
+  EXPECT_EQ(0u, list.Size());
+
+  auto block = list.Allocate(16);
+  EXPECT_EQ(nullptr, block.address);
+  EXPECT_EQ(0u, block.size);
+}
+
+TEST(FreeListTest, Add) {
+  auto blocks = CreateEntries();
+  FreeList list = CreatePopulatedFreeList(blocks);
+  EXPECT_FALSE(list.IsEmpty());
+  const size_t allocated_size = std::accumulate(
+      blocks.cbegin(), blocks.cend(), 0u,
+      [](size_t acc, const Block& b) { return acc + b.Size(); });
+  EXPECT_EQ(allocated_size, list.Size());
+}
+
+TEST(FreeListTest, AddWasted) {
+  FreeList list;
+  alignas(HeapObjectHeader) uint8_t buffer[sizeof(HeapObjectHeader)];
+  list.Add({buffer, sizeof(buffer)});
+  EXPECT_EQ(0u, list.Size());
+  EXPECT_TRUE(list.IsEmpty());
+}
+
+TEST(FreeListTest, Clear) {
+  auto blocks = CreateEntries();
+  FreeList list = CreatePopulatedFreeList(blocks);
+  list.Clear();
+  EXPECT_EQ(0u, list.Size());
+  EXPECT_TRUE(list.IsEmpty());
+}
+
+TEST(FreeListTest, Move) {
+  {
+    auto blocks = CreateEntries();
+    FreeList list1 = CreatePopulatedFreeList(blocks);
+    const size_t expected_size = list1.Size();
+    FreeList list2 = std::move(list1);
+    EXPECT_EQ(expected_size, list2.Size());
+    EXPECT_FALSE(list2.IsEmpty());
+    EXPECT_EQ(0u, list1.Size());
+    EXPECT_TRUE(list1.IsEmpty());
+  }
+  {
+    auto blocks1 = CreateEntries();
+    FreeList list1 = CreatePopulatedFreeList(blocks1);
+    const size_t expected_size = list1.Size();
+
+    auto blocks2 = CreateEntries();
+    FreeList list2 = CreatePopulatedFreeList(blocks2);
+
+    list2 = std::move(list1);
+    EXPECT_EQ(expected_size, list2.Size());
+    EXPECT_FALSE(list2.IsEmpty());
+    EXPECT_EQ(0u, list1.Size());
+    EXPECT_TRUE(list1.IsEmpty());
+  }
+}
+
+TEST(FreeListTest, Append) {
+  auto blocks1 = CreateEntries();
+  FreeList list1 = CreatePopulatedFreeList(blocks1);
+  const size_t list1_size = list1.Size();
+
+  auto blocks2 = CreateEntries();
+  FreeList list2 = CreatePopulatedFreeList(blocks2);
+  const size_t list2_size = list1.Size();
+
+  list2.Append(std::move(list1));
+  EXPECT_EQ(list1_size + list2_size, list2.Size());
+  EXPECT_FALSE(list2.IsEmpty());
+  EXPECT_EQ(0u, list1.Size());
+  EXPECT_TRUE(list1.IsEmpty());
+}
+
+TEST(FreeListTest, Contains) {
+  auto blocks = CreateEntries();
+  FreeList list = CreatePopulatedFreeList(blocks);
+
+  for (const auto& block : blocks) {
+    EXPECT_TRUE(list.Contains({block.Address(), block.Size()}));
+  }
+}
+
+TEST(FreeListTest, Allocate) {
+  static constexpr size_t kFreeListEntrySizeLog2 =
+      v8::base::bits::WhichPowerOfTwo(kFreeListEntrySize);
+
+  std::vector<Block> blocks;
+  blocks.reserve(kPageSizeLog2);
+  for (size_t i = kFreeListEntrySizeLog2; i < kPageSizeLog2; ++i) {
+    blocks.emplace_back(static_cast<size_t>(1u) << i);
+  }
+
+  FreeList list = CreatePopulatedFreeList(blocks);
+
+  // Try allocate from the biggest block.
+  for (auto it = blocks.rbegin(); it < blocks.rend(); ++it) {
+    const auto result = list.Allocate(it->Size());
+    EXPECT_EQ(it->Address(), result.address);
+    EXPECT_EQ(it->Size(), result.size);
+  }
+
+  EXPECT_EQ(0u, list.Size());
+  EXPECT_TRUE(list.IsEmpty());
+
+  // Check that allocation fails for empty list:
+  const auto empty_block = list.Allocate(8);
+  EXPECT_EQ(nullptr, empty_block.address);
+  EXPECT_EQ(0u, empty_block.size);
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/garbage-collected-unittest.cc b/deps/v8/test/unittests/heap/cppgc/garbage-collected-unittest.cc
new file mode 100644
index 00000000000..d73691184f0
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/garbage-collected-unittest.cc
@@ -0,0 +1,146 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "include/cppgc/garbage-collected.h"
+
+#include "include/cppgc/allocation.h"
+#include "include/cppgc/type-traits.h"
+#include "src/heap/cppgc/heap-object-header-inl.h"
+#include "src/heap/cppgc/heap.h"
+#include "test/unittests/heap/cppgc/tests.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+class GCed : public GarbageCollected<GCed> {
+ public:
+  void Trace(Visitor*) const {}
+};
+class NotGCed {};
+class Mixin : public GarbageCollectedMixin {};
+class GCedWithMixin : public GarbageCollected<GCedWithMixin>, public Mixin {
+  USING_GARBAGE_COLLECTED_MIXIN();
+};
+class OtherMixin : public GarbageCollectedMixin {};
+class MergedMixins : public Mixin, public OtherMixin {
+  MERGE_GARBAGE_COLLECTED_MIXINS();
+
+ public:
+  void Trace(cppgc::Visitor* visitor) const override {
+    Mixin::Trace(visitor);
+    OtherMixin::Trace(visitor);
+  }
+};
+class GCWithMergedMixins : public GCed, public MergedMixins {
+  USING_GARBAGE_COLLECTED_MIXIN();
+
+ public:
+  void Trace(cppgc::Visitor* visitor) const override {
+    MergedMixins::Trace(visitor);
+  }
+};
+
+class GarbageCollectedTestWithHeap
+    : public testing::TestSupportingAllocationOnly {};
+
+}  // namespace
+
+TEST(GarbageCollectedTest, GarbageCollectedTrait) {
+  STATIC_ASSERT(!IsGarbageCollectedType<int>::value);
+  STATIC_ASSERT(!IsGarbageCollectedType<NotGCed>::value);
+  STATIC_ASSERT(IsGarbageCollectedType<GCed>::value);
+  STATIC_ASSERT(IsGarbageCollectedType<Mixin>::value);
+  STATIC_ASSERT(IsGarbageCollectedType<GCedWithMixin>::value);
+  STATIC_ASSERT(IsGarbageCollectedType<MergedMixins>::value);
+  STATIC_ASSERT(IsGarbageCollectedType<GCWithMergedMixins>::value);
+}
+
+TEST(GarbageCollectedTest, GarbageCollectedMixinTrait) {
+  STATIC_ASSERT(!IsGarbageCollectedMixinType<int>::value);
+  STATIC_ASSERT(!IsGarbageCollectedMixinType<GCed>::value);
+  STATIC_ASSERT(!IsGarbageCollectedMixinType<NotGCed>::value);
+  STATIC_ASSERT(IsGarbageCollectedMixinType<Mixin>::value);
+  STATIC_ASSERT(IsGarbageCollectedMixinType<GCedWithMixin>::value);
+  STATIC_ASSERT(IsGarbageCollectedMixinType<MergedMixins>::value);
+  STATIC_ASSERT(IsGarbageCollectedMixinType<GCWithMergedMixins>::value);
+}
+
+TEST_F(GarbageCollectedTestWithHeap, GetObjectStartReturnsCurrentAddress) {
+  GCed* gced = MakeGarbageCollected<GCed>(GetHeap());
+  GCedWithMixin* gced_with_mixin =
+      MakeGarbageCollected<GCedWithMixin>(GetHeap());
+  EXPECT_EQ(gced_with_mixin, static_cast<Mixin*>(gced_with_mixin)
+                                 ->GetTraceDescriptor()
+                                 .base_object_payload);
+  EXPECT_NE(gced, static_cast<Mixin*>(gced_with_mixin)
+                      ->GetTraceDescriptor()
+                      .base_object_payload);
+}
+
+namespace {
+
+class GCedWithPostConstructionCallback final : public GCed {
+ public:
+  static size_t cb_callcount;
+  GCedWithPostConstructionCallback() { cb_callcount = 0; }
+};
+size_t GCedWithPostConstructionCallback::cb_callcount;
+
+class MixinWithPostConstructionCallback {
+ public:
+  static size_t cb_callcount;
+  MixinWithPostConstructionCallback() { cb_callcount = 0; }
+  using MarkerForMixinWithPostConstructionCallback = int;
+};
+size_t MixinWithPostConstructionCallback::cb_callcount;
+
+class GCedWithMixinWithPostConstructionCallback final
+    : public GCed,
+      public MixinWithPostConstructionCallback {};
+
+}  // namespace
+}  // namespace internal
+
+template <>
+struct PostConstructionCallbackTrait<
+    internal::GCedWithPostConstructionCallback> {
+  static void Call(internal::GCedWithPostConstructionCallback* object) {
+    EXPECT_FALSE(
+        internal::HeapObjectHeader::FromPayload(object).IsInConstruction());
+    internal::GCedWithPostConstructionCallback::cb_callcount++;
+  }
+};
+
+template <typename T>
+struct PostConstructionCallbackTrait<
+    T,
+    internal::void_t<typename T::MarkerForMixinWithPostConstructionCallback>> {
+  // The parameter could just be T*.
+  static void Call(
+      internal::GCedWithMixinWithPostConstructionCallback* object) {
+    EXPECT_FALSE(
+        internal::HeapObjectHeader::FromPayload(object).IsInConstruction());
+    internal::GCedWithMixinWithPostConstructionCallback::cb_callcount++;
+  }
+};
+
+namespace internal {
+
+TEST_F(GarbageCollectedTestWithHeap, PostConstructionCallback) {
+  EXPECT_EQ(0u, GCedWithPostConstructionCallback::cb_callcount);
+  MakeGarbageCollected<GCedWithPostConstructionCallback>(GetHeap());
+  EXPECT_EQ(1u, GCedWithPostConstructionCallback::cb_callcount);
+}
+
+TEST_F(GarbageCollectedTestWithHeap, PostConstructionCallbackForMixin) {
+  EXPECT_EQ(0u, MixinWithPostConstructionCallback::cb_callcount);
+  MakeGarbageCollected<GCedWithMixinWithPostConstructionCallback>(GetHeap());
+  EXPECT_EQ(1u, MixinWithPostConstructionCallback::cb_callcount);
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/garbage-collected_unittest.cc b/deps/v8/test/unittests/heap/cppgc/garbage-collected_unittest.cc
deleted file mode 100644
index 5098bdf48e1..00000000000
--- a/deps/v8/test/unittests/heap/cppgc/garbage-collected_unittest.cc
+++ /dev/null
@@ -1,26 +0,0 @@
-// Copyright 2020 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "include/cppgc/garbage-collected.h"
-
-#include "testing/gtest/include/gtest/gtest.h"
-
-namespace cppgc {
-namespace internal {
-
-namespace {
-
-class GCed : public GarbageCollected<GCed> {};
-class NotGCed {};
-
-}  // namespace
-
-TEST(GarbageCollectedTest, GarbageCollectedTrait) {
-  EXPECT_FALSE(IsGarbageCollectedType<int>::value);
-  EXPECT_FALSE(IsGarbageCollectedType<NotGCed>::value);
-  EXPECT_TRUE(IsGarbageCollectedType<GCed>::value);
-}
-
-}  // namespace internal
-}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/gc-info_unittest.cc b/deps/v8/test/unittests/heap/cppgc/gc-info-unittest.cc
similarity index 91%
rename from deps/v8/test/unittests/heap/cppgc/gc-info_unittest.cc
rename to deps/v8/test/unittests/heap/cppgc/gc-info-unittest.cc
index e7bfb5a7fec..b45de5cd06b 100644
--- a/deps/v8/test/unittests/heap/cppgc/gc-info_unittest.cc
+++ b/deps/v8/test/unittests/heap/cppgc/gc-info-unittest.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "include/cppgc/gc-info.h"
+#include "include/cppgc/internal/gc-info.h"
 
 #include "include/cppgc/platform.h"
 #include "src/base/page-allocator.h"
@@ -23,7 +23,7 @@ TEST(GCInfoTableTest, InitialEmpty) {
 TEST(GCInfoTableTest, ResizeToMaxIndex) {
   v8::base::PageAllocator page_allocator;
   GCInfoTable table(&page_allocator);
-  GCInfo info = {nullptr, false};
+  GCInfo info = {nullptr, nullptr, false};
   for (GCInfoIndex i = GCInfoTable::kMinIndex; i < GCInfoTable::kMaxIndex;
        i++) {
     GCInfoIndex index = table.RegisterNewGCInfo(info);
@@ -34,7 +34,7 @@ TEST(GCInfoTableTest, ResizeToMaxIndex) {
 TEST(GCInfoTableDeathTest, MoreThanMaxIndexInfos) {
   v8::base::PageAllocator page_allocator;
   GCInfoTable table(&page_allocator);
-  GCInfo info = {nullptr, false};
+  GCInfo info = {nullptr, nullptr, false};
   // Create GCInfoTable::kMaxIndex entries.
   for (GCInfoIndex i = GCInfoTable::kMinIndex; i < GCInfoTable::kMaxIndex;
        i++) {
@@ -46,7 +46,7 @@ TEST(GCInfoTableDeathTest, MoreThanMaxIndexInfos) {
 TEST(GCInfoTableDeathTest, OldTableAreaIsReadOnly) {
   v8::base::PageAllocator page_allocator;
   GCInfoTable table(&page_allocator);
-  GCInfo info = {nullptr, false};
+  GCInfo info = {nullptr, nullptr, false};
   // Use up all slots until limit.
   GCInfoIndex limit = table.LimitForTesting();
   // Bail out if initial limit is already the maximum because of large committed
@@ -76,7 +76,7 @@ class ThreadRegisteringGCInfoObjects final : public v8::base::Thread {
         num_registrations_(num_registrations) {}
 
   void Run() final {
-    GCInfo info = {nullptr, false};
+    GCInfo info = {nullptr, nullptr, false};
     for (GCInfoIndex i = 0; i < num_registrations_; i++) {
       table_->RegisterNewGCInfo(info);
     }
@@ -101,7 +101,7 @@ TEST(GCInfoTableTest, MultiThreadedResizeToMaxIndex) {
 
   v8::base::PageAllocator page_allocator;
   GCInfoTable table(&page_allocator);
-  GCInfo info = {nullptr, false};
+  GCInfo info = {nullptr, nullptr, false};
   for (size_t i = 0; i < main_thread_initialized; i++) {
     table.RegisterNewGCInfo(info);
   }
@@ -126,8 +126,14 @@ namespace {
 
 class GCInfoTraitTest : public testing::TestWithPlatform {};
 
-class BasicType final {};
-class OtherBasicType final {};
+class BasicType final {
+ public:
+  void Trace(Visitor*) const {}
+};
+class OtherBasicType final {
+ public:
+  void Trace(Visitor*) const {}
+};
 
 }  // namespace
 
diff --git a/deps/v8/test/unittests/heap/cppgc/heap-object-header_unittest.cc b/deps/v8/test/unittests/heap/cppgc/heap-object-header-unittest.cc
similarity index 100%
rename from deps/v8/test/unittests/heap/cppgc/heap-object-header_unittest.cc
rename to deps/v8/test/unittests/heap/cppgc/heap-object-header-unittest.cc
diff --git a/deps/v8/test/unittests/heap/cppgc/heap-page-unittest.cc b/deps/v8/test/unittests/heap/cppgc/heap-page-unittest.cc
new file mode 100644
index 00000000000..1c4d7d83b6d
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/heap-page-unittest.cc
@@ -0,0 +1,274 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/heap-page.h"
+
+#include <algorithm>
+
+#include "include/cppgc/allocation.h"
+#include "include/cppgc/internal/accessors.h"
+#include "include/cppgc/persistent.h"
+#include "src/base/macros.h"
+#include "src/heap/cppgc/globals.h"
+#include "src/heap/cppgc/heap-object-header-inl.h"
+#include "src/heap/cppgc/heap-object-header.h"
+#include "src/heap/cppgc/page-memory-inl.h"
+#include "src/heap/cppgc/raw-heap.h"
+#include "test/unittests/heap/cppgc/tests.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+class PageTest : public testing::TestWithHeap {
+ public:
+  RawHeap& GetRawHeap() { return Heap::From(GetHeap())->raw_heap(); }
+};
+
+template <size_t Size>
+class GCed : public GarbageCollected<GCed<Size>> {
+ public:
+  virtual void Trace(cppgc::Visitor*) const {}
+  char array[Size];
+};
+
+}  // namespace
+
+TEST_F(PageTest, GetHeapForAllocatedObject) {
+  auto* gced = MakeGarbageCollected<GCed<1>>(GetHeap());
+  EXPECT_EQ(GetHeap(), GetHeapFromPayload(gced));
+}
+
+TEST_F(PageTest, SpaceIndexing) {
+  RawHeap& heap = GetRawHeap();
+  size_t space = 0u;
+  for (const auto& ptr : heap) {
+    EXPECT_EQ(&heap, ptr.get()->raw_heap());
+    EXPECT_EQ(space, ptr->index());
+    ++space;
+  }
+  EXPECT_GE(space, RawHeap::kNumberOfRegularSpaces);
+}
+
+TEST_F(PageTest, PredefinedSpaces) {
+  using SpaceType = RawHeap::RegularSpaceType;
+  RawHeap& heap = GetRawHeap();
+  {
+    auto* gced = MakeGarbageCollected<GCed<1>>(GetHeap());
+    BaseSpace* space = NormalPage::FromPayload(gced)->space();
+    EXPECT_EQ(heap.Space(SpaceType::kNormal1), space);
+    EXPECT_EQ(0u, space->index());
+    EXPECT_FALSE(space->is_large());
+  }
+  {
+    auto* gced = MakeGarbageCollected<GCed<32>>(GetHeap());
+    BaseSpace* space = NormalPage::FromPayload(gced)->space();
+    EXPECT_EQ(heap.Space(SpaceType::kNormal2), space);
+    EXPECT_EQ(1u, space->index());
+    EXPECT_FALSE(space->is_large());
+  }
+  {
+    auto* gced = MakeGarbageCollected<GCed<64>>(GetHeap());
+    BaseSpace* space = NormalPage::FromPayload(gced)->space();
+    EXPECT_EQ(heap.Space(SpaceType::kNormal3), space);
+    EXPECT_EQ(2u, space->index());
+    EXPECT_FALSE(space->is_large());
+  }
+  {
+    auto* gced = MakeGarbageCollected<GCed<128>>(GetHeap());
+    BaseSpace* space = NormalPage::FromPayload(gced)->space();
+    EXPECT_EQ(heap.Space(SpaceType::kNormal4), space);
+    EXPECT_EQ(3u, space->index());
+    EXPECT_FALSE(space->is_large());
+  }
+  {
+    auto* gced =
+        MakeGarbageCollected<GCed<2 * kLargeObjectSizeThreshold>>(GetHeap());
+    BaseSpace* space = NormalPage::FromPayload(gced)->space();
+    EXPECT_EQ(heap.Space(SpaceType::kLarge), space);
+    EXPECT_EQ(4u, space->index());
+    EXPECT_TRUE(space->is_large());
+  }
+}
+
+TEST_F(PageTest, NormalPageIndexing) {
+  using SpaceType = RawHeap::RegularSpaceType;
+  constexpr size_t kExpectedNumberOfPages = 10u;
+  constexpr size_t kObjectSize = 8u;
+  using Type = GCed<kObjectSize>;
+  static const size_t kNumberOfObjects =
+      (kExpectedNumberOfPages * NormalPage::PayloadSize() /
+       (sizeof(Type) + sizeof(HeapObjectHeader))) -
+      kExpectedNumberOfPages;
+
+  std::vector<Persistent<Type>> persistents(kNumberOfObjects);
+  for (auto& p : persistents) {
+    p = MakeGarbageCollected<Type>(GetHeap());
+  }
+
+  const RawHeap& heap = GetRawHeap();
+  const BaseSpace* space = heap.Space(SpaceType::kNormal1);
+  EXPECT_EQ(kExpectedNumberOfPages, space->size());
+
+  size_t page_n = 0;
+  for (const BasePage* page : *space) {
+    EXPECT_FALSE(page->is_large());
+    EXPECT_EQ(space, page->space());
+    ++page_n;
+  }
+  EXPECT_EQ(page_n, space->size());
+}
+
+TEST_F(PageTest, LargePageIndexing) {
+  using SpaceType = RawHeap::RegularSpaceType;
+  constexpr size_t kExpectedNumberOfPages = 10u;
+  constexpr size_t kObjectSize = 2 * kLargeObjectSizeThreshold;
+  using Type = GCed<kObjectSize>;
+  const size_t kNumberOfObjects = kExpectedNumberOfPages;
+
+  std::vector<Persistent<Type>> persistents(kNumberOfObjects);
+  for (auto& p : persistents) {
+    p = MakeGarbageCollected<Type>(GetHeap());
+  }
+
+  const RawHeap& heap = GetRawHeap();
+  const BaseSpace* space = heap.Space(SpaceType::kLarge);
+  EXPECT_EQ(kExpectedNumberOfPages, space->size());
+
+  size_t page_n = 0;
+  for (const BasePage* page : *space) {
+    EXPECT_TRUE(page->is_large());
+    ++page_n;
+  }
+  EXPECT_EQ(page_n, space->size());
+}
+
+TEST_F(PageTest, HeapObjectHeaderOnBasePageIndexing) {
+  constexpr size_t kObjectSize = 8;
+  using Type = GCed<kObjectSize>;
+  const size_t kNumberOfObjects =
+      NormalPage::PayloadSize() / (sizeof(Type) + sizeof(HeapObjectHeader));
+  const size_t kLeftSpace =
+      NormalPage::PayloadSize() % (sizeof(Type) + sizeof(HeapObjectHeader));
+
+  std::vector<Persistent<Type>> persistents(kNumberOfObjects);
+  for (auto& p : persistents) {
+    p = MakeGarbageCollected<Type>(GetHeap());
+  }
+
+  const auto* page =
+      static_cast<NormalPage*>(BasePage::FromPayload(persistents[0].Get()));
+  size_t size = 0;
+  size_t num = 0;
+  for (const HeapObjectHeader& header : *page) {
+    EXPECT_EQ(reinterpret_cast<Address>(persistents[num].Get()),
+              header.Payload());
+    size += header.GetSize();
+    ++num;
+  }
+  EXPECT_EQ(num, persistents.size());
+  EXPECT_EQ(size + kLeftSpace, NormalPage::PayloadSize());
+}
+
+TEST_F(PageTest, HeapObjectHeaderOnLargePageIndexing) {
+  constexpr size_t kObjectSize = 2 * kLargeObjectSizeThreshold;
+  using Type = GCed<kObjectSize>;
+  auto* gced = MakeGarbageCollected<Type>(GetHeap());
+
+  const auto* page = static_cast<LargePage*>(BasePage::FromPayload(gced));
+  const size_t expected_payload_size =
+      RoundUp(sizeof(Type) + sizeof(HeapObjectHeader), kAllocationGranularity);
+  EXPECT_EQ(expected_payload_size, page->PayloadSize());
+
+  const HeapObjectHeader* header = page->ObjectHeader();
+  EXPECT_EQ(reinterpret_cast<Address>(gced), header->Payload());
+}
+
+TEST_F(PageTest, NormalPageCreationDestruction) {
+  RawHeap& heap = GetRawHeap();
+  const PageBackend* backend = Heap::From(GetHeap())->page_backend();
+  auto* space = static_cast<NormalPageSpace*>(
+      heap.Space(RawHeap::RegularSpaceType::kNormal1));
+  auto* page = NormalPage::Create(space);
+  EXPECT_NE(space->end(), std::find(space->begin(), space->end(), page));
+  EXPECT_TRUE(
+      space->free_list().Contains({page->PayloadStart(), page->PayloadSize()}));
+  EXPECT_NE(nullptr, backend->Lookup(page->PayloadStart()));
+
+  space->free_list().Clear();
+  EXPECT_FALSE(
+      space->free_list().Contains({page->PayloadStart(), page->PayloadSize()}));
+  space->RemovePage(page);
+  EXPECT_EQ(space->end(), std::find(space->begin(), space->end(), page));
+  NormalPage::Destroy(page);
+  EXPECT_EQ(nullptr, backend->Lookup(page->PayloadStart()));
+}
+
+TEST_F(PageTest, LargePageCreationDestruction) {
+  constexpr size_t kObjectSize = 2 * kLargeObjectSizeThreshold;
+  RawHeap& heap = GetRawHeap();
+  const PageBackend* backend = Heap::From(GetHeap())->page_backend();
+  auto* space = static_cast<LargePageSpace*>(
+      heap.Space(RawHeap::RegularSpaceType::kLarge));
+  auto* page = LargePage::Create(space, kObjectSize);
+  EXPECT_NE(space->end(), std::find(space->begin(), space->end(), page));
+  EXPECT_NE(nullptr, backend->Lookup(page->PayloadStart()));
+
+  space->RemovePage(page);
+  EXPECT_EQ(space->end(), std::find(space->begin(), space->end(), page));
+  LargePage::Destroy(page);
+  EXPECT_EQ(nullptr, backend->Lookup(page->PayloadStart()));
+}
+
+#if DEBUG
+TEST_F(PageTest, UnsweptPageDestruction) {
+  RawHeap& heap = GetRawHeap();
+  {
+    auto* space = static_cast<NormalPageSpace*>(
+        heap.Space(RawHeap::RegularSpaceType::kNormal1));
+    auto* page = NormalPage::Create(space);
+    EXPECT_DEATH_IF_SUPPORTED(NormalPage::Destroy(page), "");
+  }
+  {
+    auto* space = static_cast<LargePageSpace*>(
+        heap.Space(RawHeap::RegularSpaceType::kLarge));
+    auto* page = LargePage::Create(space, 2 * kLargeObjectSizeThreshold);
+    EXPECT_DEATH_IF_SUPPORTED(LargePage::Destroy(page), "");
+    // Detach page and really destroy page in the parent process so that sweeper
+    // doesn't consider it.
+    space->RemovePage(page);
+    LargePage::Destroy(page);
+  }
+}
+#endif
+
+TEST_F(PageTest, ObjectHeaderFromInnerAddress) {
+  {
+    auto* object = MakeGarbageCollected<GCed<64>>(GetHeap());
+    const HeapObjectHeader& expected = HeapObjectHeader::FromPayload(object);
+
+    for (auto* inner_ptr = reinterpret_cast<ConstAddress>(object);
+         inner_ptr < reinterpret_cast<ConstAddress>(object + 1); ++inner_ptr) {
+      const HeapObjectHeader& hoh =
+          BasePage::FromPayload(object)->ObjectHeaderFromInnerAddress(
+              inner_ptr);
+      EXPECT_EQ(&expected, &hoh);
+    }
+  }
+  {
+    auto* object =
+        MakeGarbageCollected<GCed<2 * kLargeObjectSizeThreshold>>(GetHeap());
+    const HeapObjectHeader& expected = HeapObjectHeader::FromPayload(object);
+
+    const HeapObjectHeader& hoh =
+        BasePage::FromPayload(object)->ObjectHeaderFromInnerAddress(
+            reinterpret_cast<ConstAddress>(object) + kLargeObjectSizeThreshold);
+    EXPECT_EQ(&expected, &hoh);
+  }
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/heap-unittest.cc b/deps/v8/test/unittests/heap/cppgc/heap-unittest.cc
new file mode 100644
index 00000000000..160445e85cf
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/heap-unittest.cc
@@ -0,0 +1,117 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/heap.h"
+
+#include <algorithm>
+#include <iterator>
+#include <numeric>
+
+#include "include/cppgc/allocation.h"
+#include "src/heap/cppgc/globals.h"
+#include "test/unittests/heap/cppgc/tests.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+class GCHeapTest : public testing::TestWithHeap {
+ public:
+  void ConservativeGC() {
+    internal::Heap::From(GetHeap())->CollectGarbage(
+        {Heap::GCConfig::StackState::kMayContainHeapPointers});
+  }
+  void PreciseGC() {
+    internal::Heap::From(GetHeap())->CollectGarbage(
+        {Heap::GCConfig::StackState::kNoHeapPointers});
+  }
+};
+
+class Foo : public GarbageCollected<Foo> {
+ public:
+  static size_t destructor_callcount;
+
+  Foo() { destructor_callcount = 0; }
+  ~Foo() { destructor_callcount++; }
+
+  void Trace(cppgc::Visitor*) const {}
+};
+
+size_t Foo::destructor_callcount;
+
+template <size_t Size>
+class GCed : public GarbageCollected<Foo> {
+ public:
+  void Trace(cppgc::Visitor*) const {}
+  char buf[Size];
+};
+
+}  // namespace
+
+TEST_F(GCHeapTest, PreciseGCReclaimsObjectOnStack) {
+  Foo* volatile do_not_access = MakeGarbageCollected<Foo>(GetHeap());
+  USE(do_not_access);
+  EXPECT_EQ(0u, Foo::destructor_callcount);
+  PreciseGC();
+  EXPECT_EQ(1u, Foo::destructor_callcount);
+  PreciseGC();
+  EXPECT_EQ(1u, Foo::destructor_callcount);
+}
+
+namespace {
+
+const void* ConservativeGCReturningObject(cppgc::Heap* heap,
+                                          const void* volatile object) {
+  internal::Heap::From(heap)->CollectGarbage(
+      {Heap::GCConfig::StackState::kMayContainHeapPointers});
+  return object;
+}
+
+}  // namespace
+
+TEST_F(GCHeapTest, ConservativeGCRetainsObjectOnStack) {
+  Foo* volatile object = MakeGarbageCollected<Foo>(GetHeap());
+  EXPECT_EQ(0u, Foo::destructor_callcount);
+  EXPECT_EQ(object, ConservativeGCReturningObject(GetHeap(), object));
+  EXPECT_EQ(0u, Foo::destructor_callcount);
+  PreciseGC();
+  EXPECT_EQ(1u, Foo::destructor_callcount);
+  PreciseGC();
+  EXPECT_EQ(1u, Foo::destructor_callcount);
+}
+
+TEST_F(GCHeapTest, ObjectPayloadSize) {
+  static constexpr size_t kNumberOfObjectsPerArena = 16;
+  static constexpr size_t kObjectSizes[] = {1, 32, 64, 128,
+                                            2 * kLargeObjectSizeThreshold};
+
+  Heap::From(GetHeap())->CollectGarbage();
+
+  for (size_t k = 0; k < kNumberOfObjectsPerArena; ++k) {
+    MakeGarbageCollected<GCed<kObjectSizes[0]>>(GetHeap());
+    MakeGarbageCollected<GCed<kObjectSizes[1]>>(GetHeap());
+    MakeGarbageCollected<GCed<kObjectSizes[2]>>(GetHeap());
+    MakeGarbageCollected<GCed<kObjectSizes[3]>>(GetHeap());
+    MakeGarbageCollected<GCed<kObjectSizes[4]>>(GetHeap());
+  }
+
+  size_t aligned_object_sizes[arraysize(kObjectSizes)];
+  std::transform(std::cbegin(kObjectSizes), std::cend(kObjectSizes),
+                 std::begin(aligned_object_sizes), [](size_t size) {
+                   return RoundUp(size, kAllocationGranularity);
+                 });
+  const size_t expected_size = std::accumulate(
+      std::cbegin(aligned_object_sizes), std::cend(aligned_object_sizes), 0u,
+      [](size_t acc, size_t size) {
+        return acc + kNumberOfObjectsPerArena * size;
+      });
+  // TODO(chromium:1056170): Change to EXPECT_EQ when proper sweeping is
+  // implemented.
+  EXPECT_LE(expected_size, Heap::From(GetHeap())->ObjectPayloadSize());
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/logging-unittest.cc b/deps/v8/test/unittests/heap/cppgc/logging-unittest.cc
new file mode 100644
index 00000000000..d9ff9106863
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/logging-unittest.cc
@@ -0,0 +1,79 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "include/cppgc/internal/logging.h"
+
+#include <string>
+
+#include "include/cppgc/source-location.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+// GCC < 9 has a bug due to which calling non-constexpr functions are not
+// allowed even on constexpr path:
+// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67026.
+#if !defined(__GNUC__) || defined(__clang__)
+constexpr int CheckInConstexpr(int a) {
+  CPPGC_DCHECK(a > 0);
+  CPPGC_CHECK(a > 0);
+  return a;
+}
+#endif
+}  // namespace
+
+TEST(LoggingTest, Pass) {
+  CPPGC_DCHECK(true);
+  CPPGC_CHECK(true);
+}
+
+TEST(LoggingTest, Fail) {
+#if DEBUG
+  EXPECT_DEATH_IF_SUPPORTED(CPPGC_DCHECK(false), "");
+#endif
+  EXPECT_DEATH_IF_SUPPORTED(CPPGC_CHECK(false), "");
+}
+
+TEST(LoggingTest, DontReportUnused) {
+  int a = 1;
+  CPPGC_DCHECK(a);
+}
+
+#if !defined(__GNUC__) || defined(__clang__)
+TEST(LoggingTest, ConstexprContext) {
+  constexpr int a = CheckInConstexpr(1);
+  CPPGC_DCHECK(a);
+}
+#endif
+
+#if DEBUG && !defined(OFFICIAL_BUILD)
+TEST(LoggingTest, Message) {
+  using ::testing::ContainsRegex;
+  EXPECT_DEATH_IF_SUPPORTED(CPPGC_DCHECK(5 == 7),
+                            ContainsRegex("failed.*5 == 7"));
+  EXPECT_DEATH_IF_SUPPORTED(CPPGC_CHECK(5 == 7),
+                            ContainsRegex("failed.*5 == 7"));
+}
+
+#if CPPGC_SUPPORTS_SOURCE_LOCATION
+TEST(LoggingTest, SourceLocation) {
+  using ::testing::AllOf;
+  using ::testing::HasSubstr;
+  constexpr auto loc = SourceLocation::Current();
+  EXPECT_DEATH_IF_SUPPORTED(CPPGC_DCHECK(false),
+                            AllOf(HasSubstr(loc.FileName()),
+                                  HasSubstr(std::to_string(loc.Line() + 3))));
+  EXPECT_DEATH_IF_SUPPORTED(CPPGC_CHECK(false),
+                            AllOf(HasSubstr(loc.FileName()),
+                                  HasSubstr(std::to_string(loc.Line() + 6))));
+}
+#endif  // CPPGC_SUPPORTS_SOURCE_LOCATION
+
+#endif  // DEBUG
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/marker-unittest.cc b/deps/v8/test/unittests/heap/cppgc/marker-unittest.cc
new file mode 100644
index 00000000000..1ad0de90ef8
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/marker-unittest.cc
@@ -0,0 +1,241 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/marker.h"
+
+#include "include/cppgc/allocation.h"
+#include "include/cppgc/member.h"
+#include "include/cppgc/persistent.h"
+#include "src/heap/cppgc/heap-object-header-inl.h"
+#include "src/heap/cppgc/marking-visitor.h"
+#include "test/unittests/heap/cppgc/tests.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+class MarkerTest : public testing::TestWithHeap {
+ public:
+  using MarkingConfig = Marker::MarkingConfig;
+
+  void DoMarking(MarkingConfig config) {
+    Marker marker(Heap::From(GetHeap()));
+    marker.StartMarking(config);
+    marker.FinishMarking(config);
+    marker.ProcessWeakness();
+  }
+};
+
+class GCed : public GarbageCollected<GCed> {
+ public:
+  void SetChild(GCed* child) { child_ = child; }
+  void SetWeakChild(GCed* child) { weak_child_ = child; }
+  GCed* child() const { return child_.Get(); }
+  GCed* weak_child() const { return weak_child_.Get(); }
+  void Trace(cppgc::Visitor* visitor) const {
+    visitor->Trace(child_);
+    visitor->Trace(weak_child_);
+  }
+
+ private:
+  Member<GCed> child_;
+  WeakMember<GCed> weak_child_;
+};
+
+template <typename T>
+V8_NOINLINE T access(volatile const T& t) {
+  return t;
+}
+
+}  // namespace
+
+TEST_F(MarkerTest, PersistentIsMarked) {
+  Persistent<GCed> object = MakeGarbageCollected<GCed>(GetHeap());
+  HeapObjectHeader& header = HeapObjectHeader::FromPayload(object);
+  EXPECT_FALSE(header.IsMarked());
+  DoMarking(MarkingConfig(MarkingConfig::StackState::kNoHeapPointers));
+  EXPECT_TRUE(header.IsMarked());
+}
+
+TEST_F(MarkerTest, ReachableMemberIsMarked) {
+  Persistent<GCed> parent = MakeGarbageCollected<GCed>(GetHeap());
+  parent->SetChild(MakeGarbageCollected<GCed>(GetHeap()));
+  HeapObjectHeader& header = HeapObjectHeader::FromPayload(parent->child());
+  EXPECT_FALSE(header.IsMarked());
+  DoMarking(MarkingConfig(MarkingConfig::StackState::kNoHeapPointers));
+  EXPECT_TRUE(header.IsMarked());
+}
+
+TEST_F(MarkerTest, UnreachableMemberIsNotMarked) {
+  Member<GCed> object = MakeGarbageCollected<GCed>(GetHeap());
+  HeapObjectHeader& header = HeapObjectHeader::FromPayload(object);
+  EXPECT_FALSE(header.IsMarked());
+  DoMarking(MarkingConfig(MarkingConfig::StackState::kNoHeapPointers));
+  EXPECT_FALSE(header.IsMarked());
+}
+
+TEST_F(MarkerTest, ObjectReachableFromStackIsMarked) {
+  GCed* object = MakeGarbageCollected<GCed>(GetHeap());
+  EXPECT_FALSE(HeapObjectHeader::FromPayload(object).IsMarked());
+  DoMarking(MarkingConfig(MarkingConfig::StackState::kMayContainHeapPointers));
+  EXPECT_TRUE(HeapObjectHeader::FromPayload(object).IsMarked());
+  access(object);
+}
+
+TEST_F(MarkerTest, ObjectReachableOnlyFromStackIsNotMarkedIfStackIsEmpty) {
+  GCed* object = MakeGarbageCollected<GCed>(GetHeap());
+  HeapObjectHeader& header = HeapObjectHeader::FromPayload(object);
+  EXPECT_FALSE(header.IsMarked());
+  DoMarking(MarkingConfig(MarkingConfig::StackState::kNoHeapPointers));
+  EXPECT_FALSE(header.IsMarked());
+  access(object);
+}
+
+TEST_F(MarkerTest, WeakReferenceToUnreachableObjectIsCleared) {
+  {
+    WeakPersistent<GCed> weak_object = MakeGarbageCollected<GCed>(GetHeap());
+    EXPECT_TRUE(weak_object);
+    DoMarking(MarkingConfig(MarkingConfig::StackState::kNoHeapPointers));
+    EXPECT_FALSE(weak_object);
+  }
+  {
+    Persistent<GCed> parent = MakeGarbageCollected<GCed>(GetHeap());
+    parent->SetWeakChild(MakeGarbageCollected<GCed>(GetHeap()));
+    EXPECT_TRUE(parent->weak_child());
+    DoMarking(MarkingConfig(MarkingConfig::StackState::kNoHeapPointers));
+    EXPECT_FALSE(parent->weak_child());
+  }
+}
+
+TEST_F(MarkerTest, WeakReferenceToReachableObjectIsNotCleared) {
+  // Reachable from Persistent
+  {
+    Persistent<GCed> object = MakeGarbageCollected<GCed>(GetHeap());
+    WeakPersistent<GCed> weak_object(object);
+    EXPECT_TRUE(weak_object);
+    DoMarking(MarkingConfig(MarkingConfig::StackState::kNoHeapPointers));
+    EXPECT_TRUE(weak_object);
+  }
+  {
+    Persistent<GCed> object = MakeGarbageCollected<GCed>(GetHeap());
+    Persistent<GCed> parent = MakeGarbageCollected<GCed>(GetHeap());
+    parent->SetWeakChild(object);
+    EXPECT_TRUE(parent->weak_child());
+    DoMarking(MarkingConfig(MarkingConfig::StackState::kNoHeapPointers));
+    EXPECT_TRUE(parent->weak_child());
+  }
+  // Reachable from Member
+  {
+    Persistent<GCed> parent = MakeGarbageCollected<GCed>(GetHeap());
+    WeakPersistent<GCed> weak_object(MakeGarbageCollected<GCed>(GetHeap()));
+    parent->SetChild(weak_object);
+    EXPECT_TRUE(weak_object);
+    DoMarking(MarkingConfig(MarkingConfig::StackState::kNoHeapPointers));
+    EXPECT_TRUE(weak_object);
+  }
+  {
+    Persistent<GCed> parent = MakeGarbageCollected<GCed>(GetHeap());
+    parent->SetChild(MakeGarbageCollected<GCed>(GetHeap()));
+    parent->SetWeakChild(parent->child());
+    EXPECT_TRUE(parent->weak_child());
+    DoMarking(MarkingConfig(MarkingConfig::StackState::kNoHeapPointers));
+    EXPECT_TRUE(parent->weak_child());
+  }
+  // Reachable from stack
+  {
+    GCed* object = MakeGarbageCollected<GCed>(GetHeap());
+    WeakPersistent<GCed> weak_object(object);
+    EXPECT_TRUE(weak_object);
+    DoMarking(
+        MarkingConfig(MarkingConfig::StackState::kMayContainHeapPointers));
+    EXPECT_TRUE(weak_object);
+    access(object);
+  }
+  {
+    GCed* object = MakeGarbageCollected<GCed>(GetHeap());
+    Persistent<GCed> parent = MakeGarbageCollected<GCed>(GetHeap());
+    parent->SetWeakChild(object);
+    EXPECT_TRUE(parent->weak_child());
+    DoMarking(
+        MarkingConfig(MarkingConfig::StackState::kMayContainHeapPointers));
+    EXPECT_TRUE(parent->weak_child());
+    access(object);
+  }
+}
+
+TEST_F(MarkerTest, DeepHierarchyIsMarked) {
+  static constexpr int kHierarchyDepth = 10;
+  Persistent<GCed> root = MakeGarbageCollected<GCed>(GetHeap());
+  GCed* parent = root;
+  for (int i = 0; i < kHierarchyDepth; ++i) {
+    parent->SetChild(MakeGarbageCollected<GCed>(GetHeap()));
+    parent->SetWeakChild(parent->child());
+    parent = parent->child();
+  }
+  DoMarking(MarkingConfig(MarkingConfig::StackState::kNoHeapPointers));
+  EXPECT_TRUE(HeapObjectHeader::FromPayload(root).IsMarked());
+  parent = root;
+  for (int i = 0; i < kHierarchyDepth; ++i) {
+    EXPECT_TRUE(HeapObjectHeader::FromPayload(parent->child()).IsMarked());
+    EXPECT_TRUE(parent->weak_child());
+    parent = parent->child();
+  }
+}
+
+TEST_F(MarkerTest, NestedObjectsOnStackAreMarked) {
+  GCed* root = MakeGarbageCollected<GCed>(GetHeap());
+  root->SetChild(MakeGarbageCollected<GCed>(GetHeap()));
+  root->child()->SetChild(MakeGarbageCollected<GCed>(GetHeap()));
+  DoMarking(MarkingConfig(MarkingConfig::StackState::kMayContainHeapPointers));
+  EXPECT_TRUE(HeapObjectHeader::FromPayload(root).IsMarked());
+  EXPECT_TRUE(HeapObjectHeader::FromPayload(root->child()).IsMarked());
+  EXPECT_TRUE(HeapObjectHeader::FromPayload(root->child()->child()).IsMarked());
+}
+
+namespace {
+class GCedWithCallback : public GarbageCollected<GCedWithCallback> {
+ public:
+  template <typename Callback>
+  explicit GCedWithCallback(Callback callback) {
+    callback(this);
+  }
+
+  void Trace(Visitor*) const {}
+};
+}  // namespace
+
+TEST_F(MarkerTest, InConstructionObjectIsEventuallyMarkedEmptyStack) {
+  Marker marker(Heap::From(GetHeap()));
+  marker.StartMarking(
+      MarkingConfig(MarkingConfig::StackState::kMayContainHeapPointers));
+  GCedWithCallback* object = MakeGarbageCollected<GCedWithCallback>(
+      GetHeap(), [&marker](GCedWithCallback* obj) {
+        Member<GCedWithCallback> member(obj);
+        marker.GetMarkingVisitorForTesting()->Trace(member);
+      });
+  EXPECT_FALSE(HeapObjectHeader::FromPayload(object).IsMarked());
+  marker.FinishMarking(
+      MarkingConfig(MarkingConfig::StackState::kNoHeapPointers));
+  EXPECT_TRUE(HeapObjectHeader::FromPayload(object).IsMarked());
+}
+
+TEST_F(MarkerTest, InConstructionObjectIsEventuallyMarkedNonEmptyStack) {
+  Marker marker(Heap::From(GetHeap()));
+  marker.StartMarking(
+      MarkingConfig(MarkingConfig::StackState::kMayContainHeapPointers));
+  MakeGarbageCollected<GCedWithCallback>(
+      GetHeap(), [&marker](GCedWithCallback* obj) {
+        Member<GCedWithCallback> member(obj);
+        marker.GetMarkingVisitorForTesting()->Trace(member);
+        EXPECT_FALSE(HeapObjectHeader::FromPayload(obj).IsMarked());
+        marker.FinishMarking(
+            MarkingConfig(MarkingConfig::StackState::kMayContainHeapPointers));
+        EXPECT_TRUE(HeapObjectHeader::FromPayload(obj).IsMarked());
+      });
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/marking-visitor-unittest.cc b/deps/v8/test/unittests/heap/cppgc/marking-visitor-unittest.cc
new file mode 100644
index 00000000000..2ff04ee89c3
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/marking-visitor-unittest.cc
@@ -0,0 +1,285 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/marking-visitor.h"
+
+#include "include/cppgc/allocation.h"
+#include "include/cppgc/member.h"
+#include "include/cppgc/persistent.h"
+#include "include/cppgc/source-location.h"
+#include "src/heap/cppgc/globals.h"
+#include "src/heap/cppgc/heap-object-header-inl.h"
+#include "src/heap/cppgc/marker.h"
+#include "test/unittests/heap/cppgc/tests.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+class MarkingVisitorTest : public testing::TestWithHeap {
+ public:
+  MarkingVisitorTest()
+      : marker_(std::make_unique<Marker>(Heap::From(GetHeap()))) {}
+  ~MarkingVisitorTest() { marker_->ClearAllWorklistsForTesting(); }
+
+  Marker* GetMarker() { return marker_.get(); }
+
+ private:
+  std::unique_ptr<Marker> marker_;
+};
+
+class GCed : public GarbageCollected<GCed> {
+ public:
+  void Trace(cppgc::Visitor*) const {}
+};
+
+class Mixin : public GarbageCollectedMixin {};
+class GCedWithMixin : public GarbageCollected<GCedWithMixin>, public Mixin {
+  USING_GARBAGE_COLLECTED_MIXIN();
+
+ public:
+  void Trace(cppgc::Visitor*) const override {}
+};
+
+}  // namespace
+
+// Strong refernces are marked.
+
+TEST_F(MarkingVisitorTest, MarkMember) {
+  Member<GCed> object(MakeGarbageCollected<GCed>(GetHeap()));
+  HeapObjectHeader& header = HeapObjectHeader::FromPayload(object);
+
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+
+  EXPECT_FALSE(header.IsMarked());
+
+  visitor.Trace(object);
+
+  EXPECT_TRUE(header.IsMarked());
+}
+
+TEST_F(MarkingVisitorTest, MarkMemberMixin) {
+  GCedWithMixin* object(MakeGarbageCollected<GCedWithMixin>(GetHeap()));
+  Member<Mixin> mixin(object);
+  HeapObjectHeader& header = HeapObjectHeader::FromPayload(object);
+
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+
+  EXPECT_FALSE(header.IsMarked());
+
+  visitor.Trace(mixin);
+
+  EXPECT_TRUE(header.IsMarked());
+}
+
+TEST_F(MarkingVisitorTest, MarkPersistent) {
+  Persistent<GCed> object(MakeGarbageCollected<GCed>(GetHeap()));
+  HeapObjectHeader& header = HeapObjectHeader::FromPayload(object);
+
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+
+  EXPECT_FALSE(header.IsMarked());
+
+  visitor.TraceRoot(object, SourceLocation::Current());
+
+  EXPECT_TRUE(header.IsMarked());
+}
+
+TEST_F(MarkingVisitorTest, MarkPersistentMixin) {
+  GCedWithMixin* object(MakeGarbageCollected<GCedWithMixin>(GetHeap()));
+  Persistent<Mixin> mixin(object);
+  HeapObjectHeader& header = HeapObjectHeader::FromPayload(object);
+
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+
+  EXPECT_FALSE(header.IsMarked());
+
+  visitor.TraceRoot(mixin, SourceLocation::Current());
+
+  EXPECT_TRUE(header.IsMarked());
+}
+
+// Weak references are not marked.
+
+TEST_F(MarkingVisitorTest, DontMarkWeakMember) {
+  WeakMember<GCed> object(MakeGarbageCollected<GCed>(GetHeap()));
+  HeapObjectHeader& header = HeapObjectHeader::FromPayload(object);
+
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+
+  EXPECT_FALSE(header.IsMarked());
+
+  visitor.Trace(object);
+
+  EXPECT_FALSE(header.IsMarked());
+}
+
+TEST_F(MarkingVisitorTest, DontMarkWeakMemberMixin) {
+  GCedWithMixin* object(MakeGarbageCollected<GCedWithMixin>(GetHeap()));
+  WeakMember<Mixin> mixin(object);
+  HeapObjectHeader& header = HeapObjectHeader::FromPayload(object);
+
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+
+  EXPECT_FALSE(header.IsMarked());
+
+  visitor.Trace(mixin);
+
+  EXPECT_FALSE(header.IsMarked());
+}
+
+TEST_F(MarkingVisitorTest, DontMarkWeakPersistent) {
+  WeakPersistent<GCed> object(MakeGarbageCollected<GCed>(GetHeap()));
+  HeapObjectHeader& header = HeapObjectHeader::FromPayload(object);
+
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+
+  EXPECT_FALSE(header.IsMarked());
+
+  visitor.TraceRoot(object, SourceLocation::Current());
+
+  EXPECT_FALSE(header.IsMarked());
+}
+
+TEST_F(MarkingVisitorTest, DontMarkWeakPersistentMixin) {
+  GCedWithMixin* object(MakeGarbageCollected<GCedWithMixin>(GetHeap()));
+  WeakPersistent<Mixin> mixin(object);
+  HeapObjectHeader& header = HeapObjectHeader::FromPayload(object);
+
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+
+  EXPECT_FALSE(header.IsMarked());
+
+  visitor.TraceRoot(mixin, SourceLocation::Current());
+
+  EXPECT_FALSE(header.IsMarked());
+}
+
+// In construction objects are not marked.
+
+namespace {
+
+class GCedWithInConstructionCallback
+    : public GarbageCollected<GCedWithInConstructionCallback> {
+ public:
+  template <typename Callback>
+  explicit GCedWithInConstructionCallback(Callback callback) {
+    callback(this);
+  }
+  void Trace(cppgc::Visitor*) const {}
+};
+
+class MixinWithInConstructionCallback : public GarbageCollectedMixin {
+ public:
+  template <typename Callback>
+  explicit MixinWithInConstructionCallback(Callback callback) {
+    callback(this);
+  }
+};
+class GCedWithMixinWithInConstructionCallback
+    : public GarbageCollected<GCedWithMixinWithInConstructionCallback>,
+      public MixinWithInConstructionCallback {
+  USING_GARBAGE_COLLECTED_MIXIN();
+
+ public:
+  template <typename Callback>
+  explicit GCedWithMixinWithInConstructionCallback(Callback callback)
+      : MixinWithInConstructionCallback(callback) {}
+  void Trace(cppgc::Visitor*) const override {}
+};
+
+}  // namespace
+
+TEST_F(MarkingVisitorTest, DontMarkMemberInConstruction) {
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+  GCedWithInConstructionCallback* gced =
+      MakeGarbageCollected<GCedWithInConstructionCallback>(
+          GetHeap(), [&visitor](GCedWithInConstructionCallback* obj) {
+            Member<GCedWithInConstructionCallback> object(obj);
+            visitor.Trace(object);
+          });
+  EXPECT_FALSE(HeapObjectHeader::FromPayload(gced).IsMarked());
+}
+
+TEST_F(MarkingVisitorTest, DontMarkMemberMixinInConstruction) {
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+  GCedWithMixinWithInConstructionCallback* gced =
+      MakeGarbageCollected<GCedWithMixinWithInConstructionCallback>(
+          GetHeap(), [&visitor](MixinWithInConstructionCallback* obj) {
+            Member<MixinWithInConstructionCallback> mixin(obj);
+            visitor.Trace(mixin);
+          });
+  EXPECT_FALSE(HeapObjectHeader::FromPayload(gced).IsMarked());
+}
+
+TEST_F(MarkingVisitorTest, DontMarkWeakMemberInConstruction) {
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+  GCedWithInConstructionCallback* gced =
+      MakeGarbageCollected<GCedWithInConstructionCallback>(
+          GetHeap(), [&visitor](GCedWithInConstructionCallback* obj) {
+            WeakMember<GCedWithInConstructionCallback> object(obj);
+            visitor.Trace(object);
+          });
+  EXPECT_FALSE(HeapObjectHeader::FromPayload(gced).IsMarked());
+}
+
+TEST_F(MarkingVisitorTest, DontMarkWeakMemberMixinInConstruction) {
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+  GCedWithMixinWithInConstructionCallback* gced =
+      MakeGarbageCollected<GCedWithMixinWithInConstructionCallback>(
+          GetHeap(), [&visitor](MixinWithInConstructionCallback* obj) {
+            WeakMember<MixinWithInConstructionCallback> mixin(obj);
+            visitor.Trace(mixin);
+          });
+  EXPECT_FALSE(HeapObjectHeader::FromPayload(gced).IsMarked());
+}
+
+TEST_F(MarkingVisitorTest, DontMarkPersistentInConstruction) {
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+  GCedWithInConstructionCallback* gced =
+      MakeGarbageCollected<GCedWithInConstructionCallback>(
+          GetHeap(), [&visitor](GCedWithInConstructionCallback* obj) {
+            Persistent<GCedWithInConstructionCallback> object(obj);
+            visitor.TraceRoot(object, SourceLocation::Current());
+          });
+  EXPECT_FALSE(HeapObjectHeader::FromPayload(gced).IsMarked());
+}
+
+TEST_F(MarkingVisitorTest, DontMarkPersistentMixinInConstruction) {
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+  GCedWithMixinWithInConstructionCallback* gced =
+      MakeGarbageCollected<GCedWithMixinWithInConstructionCallback>(
+          GetHeap(), [&visitor](MixinWithInConstructionCallback* obj) {
+            Persistent<MixinWithInConstructionCallback> mixin(obj);
+            visitor.TraceRoot(mixin, SourceLocation::Current());
+          });
+  EXPECT_FALSE(HeapObjectHeader::FromPayload(gced).IsMarked());
+}
+
+TEST_F(MarkingVisitorTest, DontMarkWeakPersistentInConstruction) {
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+  GCedWithInConstructionCallback* gced =
+      MakeGarbageCollected<GCedWithInConstructionCallback>(
+          GetHeap(), [&visitor](GCedWithInConstructionCallback* obj) {
+            WeakPersistent<GCedWithInConstructionCallback> object(obj);
+            visitor.TraceRoot(object, SourceLocation::Current());
+          });
+  EXPECT_FALSE(HeapObjectHeader::FromPayload(gced).IsMarked());
+}
+
+TEST_F(MarkingVisitorTest, DontMarkWeakPersistentMixinInConstruction) {
+  MutatorThreadMarkingVisitor visitor(GetMarker());
+  GCedWithMixinWithInConstructionCallback* gced =
+      MakeGarbageCollected<GCedWithMixinWithInConstructionCallback>(
+          GetHeap(), [&visitor](MixinWithInConstructionCallback* obj) {
+            WeakPersistent<MixinWithInConstructionCallback> mixin(obj);
+            visitor.TraceRoot(mixin, SourceLocation::Current());
+          });
+  EXPECT_FALSE(HeapObjectHeader::FromPayload(gced).IsMarked());
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/member-unittest.cc b/deps/v8/test/unittests/heap/cppgc/member-unittest.cc
new file mode 100644
index 00000000000..17414986490
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/member-unittest.cc
@@ -0,0 +1,304 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "include/cppgc/member.h"
+
+#include <algorithm>
+#include <vector>
+
+#include "include/cppgc/allocation.h"
+#include "include/cppgc/garbage-collected.h"
+#include "include/cppgc/persistent.h"
+#include "include/cppgc/type-traits.h"
+#include "test/unittests/heap/cppgc/tests.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+struct GCed : GarbageCollected<GCed> {
+  virtual void Trace(cppgc::Visitor*) const {}
+};
+struct DerivedGCed : GCed {
+  void Trace(cppgc::Visitor* v) const override { GCed::Trace(v); }
+};
+
+// Compile tests.
+static_assert(!IsWeakV<Member<GCed>>, "Member is always strong.");
+static_assert(IsWeakV<WeakMember<GCed>>, "WeakMember is always weak.");
+
+struct CustomWriteBarrierPolicy {
+  static size_t InitializingWriteBarriersTriggered;
+  static size_t AssigningWriteBarriersTriggered;
+  static void InitializingBarrier(const void* slot, const void* value) {
+    ++InitializingWriteBarriersTriggered;
+  }
+  static void AssigningBarrier(const void* slot, const void* value) {
+    ++AssigningWriteBarriersTriggered;
+  }
+};
+size_t CustomWriteBarrierPolicy::InitializingWriteBarriersTriggered = 0;
+size_t CustomWriteBarrierPolicy::AssigningWriteBarriersTriggered = 0;
+
+using MemberWithCustomBarrier =
+    BasicMember<GCed, StrongMemberTag, CustomWriteBarrierPolicy>;
+
+struct CustomCheckingPolicy {
+  static std::vector<GCed*> Cached;
+  static size_t ChecksTriggered;
+  void CheckPointer(const void* ptr) {
+    EXPECT_NE(Cached.cend(), std::find(Cached.cbegin(), Cached.cend(), ptr));
+    ++ChecksTriggered;
+  }
+};
+std::vector<GCed*> CustomCheckingPolicy::Cached;
+size_t CustomCheckingPolicy::ChecksTriggered = 0;
+
+using MemberWithCustomChecking =
+    BasicMember<GCed, StrongMemberTag, DijkstraWriteBarrierPolicy,
+                CustomCheckingPolicy>;
+
+class MemberTest : public testing::TestSupportingAllocationOnly {};
+
+}  // namespace
+
+template <template <typename> class MemberType>
+void EmptyTest() {
+  {
+    MemberType<GCed> empty;
+    EXPECT_EQ(nullptr, empty.Get());
+    EXPECT_EQ(nullptr, empty.Release());
+  }
+  {
+    MemberType<GCed> empty = nullptr;
+    EXPECT_EQ(nullptr, empty.Get());
+    EXPECT_EQ(nullptr, empty.Release());
+  }
+}
+
+TEST_F(MemberTest, Empty) {
+  EmptyTest<Member>();
+  EmptyTest<WeakMember>();
+  EmptyTest<UntracedMember>();
+}
+
+template <template <typename> class MemberType>
+void ClearTest(cppgc::Heap* heap) {
+  MemberType<GCed> member = MakeGarbageCollected<GCed>(heap);
+  EXPECT_NE(nullptr, member.Get());
+  member.Clear();
+  EXPECT_EQ(nullptr, member.Get());
+}
+
+TEST_F(MemberTest, Clear) {
+  cppgc::Heap* heap = GetHeap();
+  ClearTest<Member>(heap);
+  ClearTest<WeakMember>(heap);
+  ClearTest<UntracedMember>(heap);
+}
+
+template <template <typename> class MemberType>
+void ReleaseTest(cppgc::Heap* heap) {
+  GCed* gced = MakeGarbageCollected<GCed>(heap);
+  MemberType<GCed> member = gced;
+  EXPECT_NE(nullptr, member.Get());
+  GCed* raw = member.Release();
+  EXPECT_EQ(gced, raw);
+  EXPECT_EQ(nullptr, member.Get());
+}
+
+TEST_F(MemberTest, Release) {
+  cppgc::Heap* heap = GetHeap();
+  ReleaseTest<Member>(heap);
+  ReleaseTest<WeakMember>(heap);
+  ReleaseTest<UntracedMember>(heap);
+}
+
+template <template <typename> class MemberType1,
+          template <typename> class MemberType2>
+void SwapTest(cppgc::Heap* heap) {
+  GCed* gced1 = MakeGarbageCollected<GCed>(heap);
+  GCed* gced2 = MakeGarbageCollected<GCed>(heap);
+  MemberType1<GCed> member1 = gced1;
+  MemberType2<GCed> member2 = gced2;
+  EXPECT_EQ(gced1, member1.Get());
+  EXPECT_EQ(gced2, member2.Get());
+  member1.Swap(member2);
+  EXPECT_EQ(gced2, member1.Get());
+  EXPECT_EQ(gced1, member2.Get());
+}
+
+TEST_F(MemberTest, Swap) {
+  cppgc::Heap* heap = GetHeap();
+  SwapTest<Member, Member>(heap);
+  SwapTest<Member, WeakMember>(heap);
+  SwapTest<Member, UntracedMember>(heap);
+  SwapTest<WeakMember, Member>(heap);
+  SwapTest<WeakMember, WeakMember>(heap);
+  SwapTest<WeakMember, UntracedMember>(heap);
+  SwapTest<UntracedMember, Member>(heap);
+  SwapTest<UntracedMember, WeakMember>(heap);
+  SwapTest<UntracedMember, UntracedMember>(heap);
+}
+
+template <template <typename> class MemberType1,
+          template <typename> class MemberType2>
+void HeterogeneousConversionTest(cppgc::Heap* heap) {
+  {
+    MemberType1<GCed> member1 = MakeGarbageCollected<GCed>(heap);
+    MemberType2<GCed> member2 = member1;
+    EXPECT_EQ(member1.Get(), member2.Get());
+  }
+  {
+    MemberType1<DerivedGCed> member1 = MakeGarbageCollected<DerivedGCed>(heap);
+    MemberType2<GCed> member2 = member1;
+    EXPECT_EQ(member1.Get(), member2.Get());
+  }
+  {
+    MemberType1<GCed> member1 = MakeGarbageCollected<GCed>(heap);
+    MemberType2<GCed> member2;
+    member2 = member1;
+    EXPECT_EQ(member1.Get(), member2.Get());
+  }
+  {
+    MemberType1<DerivedGCed> member1 = MakeGarbageCollected<DerivedGCed>(heap);
+    MemberType2<GCed> member2;
+    member2 = member1;
+    EXPECT_EQ(member1.Get(), member2.Get());
+  }
+}
+
+TEST_F(MemberTest, HeterogeneousInterface) {
+  cppgc::Heap* heap = GetHeap();
+  HeterogeneousConversionTest<Member, Member>(heap);
+  HeterogeneousConversionTest<Member, WeakMember>(heap);
+  HeterogeneousConversionTest<Member, UntracedMember>(heap);
+  HeterogeneousConversionTest<WeakMember, Member>(heap);
+  HeterogeneousConversionTest<WeakMember, WeakMember>(heap);
+  HeterogeneousConversionTest<WeakMember, UntracedMember>(heap);
+  HeterogeneousConversionTest<UntracedMember, Member>(heap);
+  HeterogeneousConversionTest<UntracedMember, WeakMember>(heap);
+  HeterogeneousConversionTest<UntracedMember, UntracedMember>(heap);
+}
+
+template <template <typename> class MemberType,
+          template <typename> class PersistentType>
+void PersistentConversionTest(cppgc::Heap* heap) {
+  {
+    PersistentType<GCed> persistent = MakeGarbageCollected<GCed>(heap);
+    MemberType<GCed> member = persistent;
+    EXPECT_EQ(persistent.Get(), member.Get());
+  }
+  {
+    PersistentType<DerivedGCed> persistent =
+        MakeGarbageCollected<DerivedGCed>(heap);
+    MemberType<GCed> member = persistent;
+    EXPECT_EQ(persistent.Get(), member.Get());
+  }
+  {
+    PersistentType<GCed> persistent = MakeGarbageCollected<GCed>(heap);
+    MemberType<GCed> member;
+    member = persistent;
+    EXPECT_EQ(persistent.Get(), member.Get());
+  }
+  {
+    PersistentType<DerivedGCed> persistent =
+        MakeGarbageCollected<DerivedGCed>(heap);
+    MemberType<GCed> member;
+    member = persistent;
+    EXPECT_EQ(persistent.Get(), member.Get());
+  }
+}
+
+TEST_F(MemberTest, PersistentConversion) {
+  cppgc::Heap* heap = GetHeap();
+  PersistentConversionTest<Member, Persistent>(heap);
+  PersistentConversionTest<Member, WeakPersistent>(heap);
+  PersistentConversionTest<WeakMember, Persistent>(heap);
+  PersistentConversionTest<WeakMember, WeakPersistent>(heap);
+  PersistentConversionTest<UntracedMember, Persistent>(heap);
+  PersistentConversionTest<UntracedMember, WeakPersistent>(heap);
+}
+
+template <template <typename> class MemberType1,
+          template <typename> class MemberType2>
+void EqualityTest(cppgc::Heap* heap) {
+  {
+    GCed* gced = MakeGarbageCollected<GCed>(heap);
+    MemberType1<GCed> member1 = gced;
+    MemberType2<GCed> member2 = gced;
+    EXPECT_TRUE(member1 == member2);
+    EXPECT_FALSE(member1 != member2);
+    member2 = member1;
+    EXPECT_TRUE(member1 == member2);
+    EXPECT_FALSE(member1 != member2);
+  }
+  {
+    MemberType1<GCed> member1 = MakeGarbageCollected<GCed>(heap);
+    MemberType2<GCed> member2 = MakeGarbageCollected<GCed>(heap);
+    EXPECT_TRUE(member1 != member2);
+    EXPECT_FALSE(member1 == member2);
+  }
+}
+
+TEST_F(MemberTest, EqualityTest) {
+  cppgc::Heap* heap = GetHeap();
+  EqualityTest<Member, Member>(heap);
+  EqualityTest<Member, WeakMember>(heap);
+  EqualityTest<Member, UntracedMember>(heap);
+  EqualityTest<WeakMember, Member>(heap);
+  EqualityTest<WeakMember, WeakMember>(heap);
+  EqualityTest<WeakMember, UntracedMember>(heap);
+  EqualityTest<UntracedMember, Member>(heap);
+  EqualityTest<UntracedMember, WeakMember>(heap);
+  EqualityTest<UntracedMember, UntracedMember>(heap);
+}
+
+TEST_F(MemberTest, WriteBarrierTriggered) {
+  CustomWriteBarrierPolicy::InitializingWriteBarriersTriggered = 0;
+  CustomWriteBarrierPolicy::AssigningWriteBarriersTriggered = 0;
+  GCed* gced = MakeGarbageCollected<GCed>(GetHeap());
+  MemberWithCustomBarrier member1 = gced;
+  EXPECT_EQ(1u, CustomWriteBarrierPolicy::InitializingWriteBarriersTriggered);
+  EXPECT_EQ(0u, CustomWriteBarrierPolicy::AssigningWriteBarriersTriggered);
+  member1 = gced;
+  EXPECT_EQ(1u, CustomWriteBarrierPolicy::InitializingWriteBarriersTriggered);
+  EXPECT_EQ(1u, CustomWriteBarrierPolicy::AssigningWriteBarriersTriggered);
+  member1 = nullptr;
+  EXPECT_EQ(1u, CustomWriteBarrierPolicy::InitializingWriteBarriersTriggered);
+  EXPECT_EQ(1u, CustomWriteBarrierPolicy::AssigningWriteBarriersTriggered);
+  MemberWithCustomBarrier member2 = nullptr;
+  // No initializing barriers for std::nullptr_t.
+  EXPECT_EQ(1u, CustomWriteBarrierPolicy::InitializingWriteBarriersTriggered);
+  EXPECT_EQ(1u, CustomWriteBarrierPolicy::AssigningWriteBarriersTriggered);
+  member2 = kSentinelPointer;
+  EXPECT_EQ(kSentinelPointer, member2.Get());
+  EXPECT_EQ(kSentinelPointer, member2);
+  // No initializing barriers for pointer sentinel.
+  EXPECT_EQ(1u, CustomWriteBarrierPolicy::InitializingWriteBarriersTriggered);
+  EXPECT_EQ(1u, CustomWriteBarrierPolicy::AssigningWriteBarriersTriggered);
+  member2.Swap(member1);
+  EXPECT_EQ(3u, CustomWriteBarrierPolicy::AssigningWriteBarriersTriggered);
+}
+
+TEST_F(MemberTest, CheckingPolicy) {
+  static constexpr size_t kElements = 64u;
+  CustomCheckingPolicy::ChecksTriggered = 0u;
+
+  for (std::size_t i = 0; i < kElements; ++i) {
+    CustomCheckingPolicy::Cached.push_back(
+        MakeGarbageCollected<GCed>(GetHeap()));
+  }
+
+  MemberWithCustomChecking member;
+  for (GCed* item : CustomCheckingPolicy::Cached) {
+    member = item;
+  }
+  EXPECT_EQ(CustomCheckingPolicy::Cached.size(),
+            CustomCheckingPolicy::ChecksTriggered);
+}
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/object-start-bitmap-unittest.cc b/deps/v8/test/unittests/heap/cppgc/object-start-bitmap-unittest.cc
new file mode 100644
index 00000000000..8a63249d431
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/object-start-bitmap-unittest.cc
@@ -0,0 +1,184 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/object-start-bitmap.h"
+
+#include "include/cppgc/allocation.h"
+#include "src/base/macros.h"
+#include "src/heap/cppgc/globals.h"
+#include "src/heap/cppgc/heap-object-header-inl.h"
+#include "src/heap/cppgc/heap-object-header.h"
+#include "src/heap/cppgc/object-start-bitmap-inl.h"
+#include "src/heap/cppgc/page-memory-inl.h"
+#include "src/heap/cppgc/raw-heap.h"
+#include "test/unittests/heap/cppgc/tests.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+bool IsEmpty(const ObjectStartBitmap& bitmap) {
+  size_t count = 0;
+  bitmap.Iterate([&count](Address) { count++; });
+  return count == 0;
+}
+
+// Abstraction for objects that hides ObjectStartBitmap::kGranularity and
+// the base address as getting either of it wrong will result in failed DCHECKs.
+class Object {
+ public:
+  static Address kBaseOffset;
+
+  explicit Object(size_t number) : number_(number) {
+    const size_t max_entries = ObjectStartBitmap::MaxEntries();
+    EXPECT_GE(max_entries, number_);
+  }
+
+  Address address() const {
+    return kBaseOffset + ObjectStartBitmap::Granularity() * number_;
+  }
+
+  HeapObjectHeader* header() const {
+    return reinterpret_cast<HeapObjectHeader*>(address());
+  }
+
+  // Allow implicitly converting Object to Address.
+  operator Address() const { return address(); }
+
+ private:
+  const size_t number_;
+};
+
+Address Object::kBaseOffset = reinterpret_cast<Address>(0x4000);
+
+}  // namespace
+
+TEST(ObjectStartBitmapTest, MoreThanZeroEntriesPossible) {
+  const size_t max_entries = ObjectStartBitmap::MaxEntries();
+  EXPECT_LT(0u, max_entries);
+}
+
+TEST(ObjectStartBitmapTest, InitialEmpty) {
+  ObjectStartBitmap bitmap(Object::kBaseOffset);
+  EXPECT_TRUE(IsEmpty(bitmap));
+}
+
+TEST(ObjectStartBitmapTest, SetBitImpliesNonEmpty) {
+  ObjectStartBitmap bitmap(Object::kBaseOffset);
+  bitmap.SetBit(Object(0));
+  EXPECT_FALSE(IsEmpty(bitmap));
+}
+
+TEST(ObjectStartBitmapTest, SetBitCheckBit) {
+  ObjectStartBitmap bitmap(Object::kBaseOffset);
+  Object object(7);
+  bitmap.SetBit(object);
+  EXPECT_TRUE(bitmap.CheckBit(object));
+}
+
+TEST(ObjectStartBitmapTest, SetBitClearbitCheckBit) {
+  ObjectStartBitmap bitmap(Object::kBaseOffset);
+  Object object(77);
+  bitmap.SetBit(object);
+  bitmap.ClearBit(object);
+  EXPECT_FALSE(bitmap.CheckBit(object));
+}
+
+TEST(ObjectStartBitmapTest, SetBitClearBitImpliesEmpty) {
+  ObjectStartBitmap bitmap(Object::kBaseOffset);
+  Object object(123);
+  bitmap.SetBit(object);
+  bitmap.ClearBit(object);
+  EXPECT_TRUE(IsEmpty(bitmap));
+}
+
+TEST(ObjectStartBitmapTest, AdjacentObjectsAtBegin) {
+  ObjectStartBitmap bitmap(Object::kBaseOffset);
+  Object object0(0);
+  Object object1(1);
+  bitmap.SetBit(object0);
+  bitmap.SetBit(object1);
+  EXPECT_FALSE(bitmap.CheckBit(Object(3)));
+  size_t count = 0;
+  bitmap.Iterate([&count, object0, object1](Address current) {
+    if (count == 0) {
+      EXPECT_EQ(object0.address(), current);
+    } else if (count == 1) {
+      EXPECT_EQ(object1.address(), current);
+    }
+    count++;
+  });
+  EXPECT_EQ(2u, count);
+}
+
+TEST(ObjectStartBitmapTest, AdjacentObjectsAtEnd) {
+  ObjectStartBitmap bitmap(Object::kBaseOffset);
+  const size_t last_entry_index = ObjectStartBitmap::MaxEntries() - 1;
+  Object object0(last_entry_index - 1);
+  Object object1(last_entry_index);
+  bitmap.SetBit(object0);
+  bitmap.SetBit(object1);
+  EXPECT_FALSE(bitmap.CheckBit(Object(last_entry_index - 2)));
+  size_t count = 0;
+  bitmap.Iterate([&count, object0, object1](Address current) {
+    if (count == 0) {
+      EXPECT_EQ(object0.address(), current);
+    } else if (count == 1) {
+      EXPECT_EQ(object1.address(), current);
+    }
+    count++;
+  });
+  EXPECT_EQ(2u, count);
+}
+
+TEST(ObjectStartBitmapTest, FindHeaderExact) {
+  ObjectStartBitmap bitmap(Object::kBaseOffset);
+  Object object(654);
+  bitmap.SetBit(object);
+  EXPECT_EQ(object.header(), bitmap.FindHeader(object.address()));
+}
+
+TEST(ObjectStartBitmapTest, FindHeaderApproximate) {
+  static const size_t kInternalDelta = 37;
+  ObjectStartBitmap bitmap(Object::kBaseOffset);
+  Object object(654);
+  bitmap.SetBit(object);
+  EXPECT_EQ(object.header(),
+            bitmap.FindHeader(object.address() + kInternalDelta));
+}
+
+TEST(ObjectStartBitmapTest, FindHeaderIteratingWholeBitmap) {
+  ObjectStartBitmap bitmap(Object::kBaseOffset);
+  Object object_to_find(Object(0));
+  Address hint_index = Object(ObjectStartBitmap::MaxEntries() - 1);
+  bitmap.SetBit(object_to_find);
+  EXPECT_EQ(object_to_find.header(), bitmap.FindHeader(hint_index));
+}
+
+TEST(ObjectStartBitmapTest, FindHeaderNextCell) {
+  // This white box test makes use of the fact that cells are of type uint8_t.
+  const size_t kCellSize = sizeof(uint8_t);
+  ObjectStartBitmap bitmap(Object::kBaseOffset);
+  Object object_to_find(Object(kCellSize - 1));
+  Address hint = Object(kCellSize);
+  bitmap.SetBit(Object(0));
+  bitmap.SetBit(object_to_find);
+  EXPECT_EQ(object_to_find.header(), bitmap.FindHeader(hint));
+}
+
+TEST(ObjectStartBitmapTest, FindHeaderSameCell) {
+  // This white box test makes use of the fact that cells are of type uint8_t.
+  const size_t kCellSize = sizeof(uint8_t);
+  ObjectStartBitmap bitmap(Object::kBaseOffset);
+  Object object_to_find(Object(kCellSize - 1));
+  bitmap.SetBit(Object(0));
+  bitmap.SetBit(object_to_find);
+  EXPECT_EQ(object_to_find.header(),
+            bitmap.FindHeader(object_to_find.address()));
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/page-memory-unittest.cc b/deps/v8/test/unittests/heap/cppgc/page-memory-unittest.cc
new file mode 100644
index 00000000000..1265d6994ff
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/page-memory-unittest.cc
@@ -0,0 +1,308 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/page-memory.h"
+
+#include "src/base/page-allocator.h"
+#include "src/heap/cppgc/page-memory-inl.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+
+TEST(MemoryRegionTest, Construct) {
+  constexpr size_t kSize = 17;
+  uint8_t dummy[kSize];
+  const MemoryRegion region(dummy, kSize);
+  EXPECT_EQ(dummy, region.base());
+  EXPECT_EQ(kSize, region.size());
+  EXPECT_EQ(dummy + kSize, region.end());
+}
+
+namespace {
+
+Address AtOffset(uint8_t* base, intptr_t offset) {
+  return reinterpret_cast<Address>(reinterpret_cast<intptr_t>(base) + offset);
+}
+
+}  // namespace
+
+TEST(MemoryRegionTest, ContainsAddress) {
+  constexpr size_t kSize = 7;
+  uint8_t dummy[kSize];
+  const MemoryRegion region(dummy, kSize);
+  EXPECT_FALSE(region.Contains(AtOffset(dummy, -1)));
+  EXPECT_TRUE(region.Contains(dummy));
+  EXPECT_TRUE(region.Contains(dummy + kSize - 1));
+  EXPECT_FALSE(region.Contains(AtOffset(dummy, kSize)));
+}
+
+TEST(MemoryRegionTest, ContainsMemoryRegion) {
+  constexpr size_t kSize = 7;
+  uint8_t dummy[kSize];
+  const MemoryRegion region(dummy, kSize);
+  const MemoryRegion contained_region1(dummy, kSize - 1);
+  EXPECT_TRUE(region.Contains(contained_region1));
+  const MemoryRegion contained_region2(dummy + 1, kSize - 1);
+  EXPECT_TRUE(region.Contains(contained_region2));
+  const MemoryRegion not_contained_region1(AtOffset(dummy, -1), kSize);
+  EXPECT_FALSE(region.Contains(not_contained_region1));
+  const MemoryRegion not_contained_region2(AtOffset(dummy, kSize), 1);
+  EXPECT_FALSE(region.Contains(not_contained_region2));
+}
+
+TEST(PageMemoryTest, Construct) {
+  constexpr size_t kOverallSize = 17;
+  uint8_t dummy[kOverallSize];
+  const MemoryRegion overall_region(dummy, kOverallSize);
+  const MemoryRegion writeable_region(dummy + 1, kOverallSize - 2);
+  const PageMemory page_memory(overall_region, writeable_region);
+  EXPECT_EQ(dummy, page_memory.overall_region().base());
+  EXPECT_EQ(dummy + kOverallSize, page_memory.overall_region().end());
+  EXPECT_EQ(dummy + 1, page_memory.writeable_region().base());
+  EXPECT_EQ(dummy + kOverallSize - 1, page_memory.writeable_region().end());
+}
+
+#if DEBUG
+
+TEST(PageMemoryDeathTest, ConstructNonContainedRegions) {
+  constexpr size_t kOverallSize = 17;
+  uint8_t dummy[kOverallSize];
+  const MemoryRegion overall_region(dummy, kOverallSize);
+  const MemoryRegion writeable_region(dummy + 1, kOverallSize);
+  EXPECT_DEATH_IF_SUPPORTED(PageMemory(overall_region, writeable_region), "");
+}
+
+#endif  // DEBUG
+
+TEST(PageMemoryRegionTest, NormalPageMemoryRegion) {
+  v8::base::PageAllocator allocator;
+  auto pmr = std::make_unique<NormalPageMemoryRegion>(&allocator);
+  pmr->UnprotectForTesting();
+  MemoryRegion prev_overall;
+  for (size_t i = 0; i < NormalPageMemoryRegion::kNumPageRegions; ++i) {
+    const PageMemory pm = pmr->GetPageMemory(i);
+    // Previous PageMemory aligns with the current one.
+    if (prev_overall.base()) {
+      EXPECT_EQ(prev_overall.end(), pm.overall_region().base());
+    }
+    prev_overall =
+        MemoryRegion(pm.overall_region().base(), pm.overall_region().size());
+    // Writeable region is contained in overall region.
+    EXPECT_TRUE(pm.overall_region().Contains(pm.writeable_region()));
+    EXPECT_EQ(0u, pm.writeable_region().base()[0]);
+    EXPECT_EQ(0u, pm.writeable_region().end()[-1]);
+    // Front guard page.
+    EXPECT_EQ(pm.writeable_region().base(),
+              pm.overall_region().base() + kGuardPageSize);
+    // Back guard page.
+    EXPECT_EQ(pm.overall_region().end(),
+              pm.writeable_region().end() + kGuardPageSize);
+  }
+}
+
+TEST(PageMemoryRegionTest, LargePageMemoryRegion) {
+  v8::base::PageAllocator allocator;
+  auto pmr = std::make_unique<LargePageMemoryRegion>(&allocator, 1024);
+  pmr->UnprotectForTesting();
+  const PageMemory pm = pmr->GetPageMemory();
+  EXPECT_LE(1024u, pm.writeable_region().size());
+  EXPECT_EQ(0u, pm.writeable_region().base()[0]);
+  EXPECT_EQ(0u, pm.writeable_region().end()[-1]);
+}
+
+TEST(PageMemoryRegionTest, PlatformUsesGuardPages) {
+  // This tests that the testing allocator actually uses protected guard
+  // regions.
+  v8::base::PageAllocator allocator;
+#if defined(V8_HOST_ARCH_PPC64) && !defined(_AIX)
+  EXPECT_FALSE(SupportsCommittingGuardPages(&allocator));
+#else   // !V8_HOST_ARCH_PPC64
+  EXPECT_TRUE(SupportsCommittingGuardPages(&allocator));
+#endif  // !V8_HOST_ARCH_PPC64
+}
+
+namespace {
+
+V8_NOINLINE uint8_t access(volatile const uint8_t& u) { return u; }
+
+}  // namespace
+
+TEST(PageMemoryRegionDeathTest, ReservationIsFreed) {
+  // Full sequence as part of the death test macro as otherwise, the macro
+  // may expand to statements that re-purpose the previously freed memory
+  // and thus not crash.
+  EXPECT_DEATH_IF_SUPPORTED(
+      v8::base::PageAllocator allocator; Address base; {
+        auto pmr = std::make_unique<LargePageMemoryRegion>(&allocator, 1024);
+        base = pmr->reserved_region().base();
+      } access(base[0]);
+      , "");
+}
+
+TEST(PageMemoryRegionDeathTest, FrontGuardPageAccessCrashes) {
+  v8::base::PageAllocator allocator;
+  auto pmr = std::make_unique<NormalPageMemoryRegion>(&allocator);
+  if (SupportsCommittingGuardPages(&allocator)) {
+    EXPECT_DEATH_IF_SUPPORTED(
+        access(pmr->GetPageMemory(0).overall_region().base()[0]), "");
+  }
+}
+
+TEST(PageMemoryRegionDeathTest, BackGuardPageAccessCrashes) {
+  v8::base::PageAllocator allocator;
+  auto pmr = std::make_unique<NormalPageMemoryRegion>(&allocator);
+  if (SupportsCommittingGuardPages(&allocator)) {
+    EXPECT_DEATH_IF_SUPPORTED(
+        access(pmr->GetPageMemory(0).writeable_region().end()[0]), "");
+  }
+}
+
+TEST(PageMemoryRegionTreeTest, AddNormalLookupRemove) {
+  v8::base::PageAllocator allocator;
+  auto pmr = std::make_unique<NormalPageMemoryRegion>(&allocator);
+  PageMemoryRegionTree tree;
+  tree.Add(pmr.get());
+  ASSERT_EQ(pmr.get(), tree.Lookup(pmr->reserved_region().base()));
+  ASSERT_EQ(pmr.get(), tree.Lookup(pmr->reserved_region().end() - 1));
+  ASSERT_EQ(nullptr, tree.Lookup(pmr->reserved_region().base() - 1));
+  ASSERT_EQ(nullptr, tree.Lookup(pmr->reserved_region().end()));
+  tree.Remove(pmr.get());
+  ASSERT_EQ(nullptr, tree.Lookup(pmr->reserved_region().base()));
+  ASSERT_EQ(nullptr, tree.Lookup(pmr->reserved_region().end() - 1));
+}
+
+TEST(PageMemoryRegionTreeTest, AddLargeLookupRemove) {
+  v8::base::PageAllocator allocator;
+  constexpr size_t kLargeSize = 5012;
+  auto pmr = std::make_unique<LargePageMemoryRegion>(&allocator, kLargeSize);
+  PageMemoryRegionTree tree;
+  tree.Add(pmr.get());
+  ASSERT_EQ(pmr.get(), tree.Lookup(pmr->reserved_region().base()));
+  ASSERT_EQ(pmr.get(), tree.Lookup(pmr->reserved_region().end() - 1));
+  ASSERT_EQ(nullptr, tree.Lookup(pmr->reserved_region().base() - 1));
+  ASSERT_EQ(nullptr, tree.Lookup(pmr->reserved_region().end()));
+  tree.Remove(pmr.get());
+  ASSERT_EQ(nullptr, tree.Lookup(pmr->reserved_region().base()));
+  ASSERT_EQ(nullptr, tree.Lookup(pmr->reserved_region().end() - 1));
+}
+
+TEST(PageMemoryRegionTreeTest, AddLookupRemoveMultiple) {
+  v8::base::PageAllocator allocator;
+  auto pmr1 = std::make_unique<NormalPageMemoryRegion>(&allocator);
+  constexpr size_t kLargeSize = 3127;
+  auto pmr2 = std::make_unique<LargePageMemoryRegion>(&allocator, kLargeSize);
+  PageMemoryRegionTree tree;
+  tree.Add(pmr1.get());
+  tree.Add(pmr2.get());
+  ASSERT_EQ(pmr1.get(), tree.Lookup(pmr1->reserved_region().base()));
+  ASSERT_EQ(pmr1.get(), tree.Lookup(pmr1->reserved_region().end() - 1));
+  ASSERT_EQ(pmr2.get(), tree.Lookup(pmr2->reserved_region().base()));
+  ASSERT_EQ(pmr2.get(), tree.Lookup(pmr2->reserved_region().end() - 1));
+  tree.Remove(pmr1.get());
+  ASSERT_EQ(pmr2.get(), tree.Lookup(pmr2->reserved_region().base()));
+  ASSERT_EQ(pmr2.get(), tree.Lookup(pmr2->reserved_region().end() - 1));
+  tree.Remove(pmr2.get());
+  ASSERT_EQ(nullptr, tree.Lookup(pmr2->reserved_region().base()));
+  ASSERT_EQ(nullptr, tree.Lookup(pmr2->reserved_region().end() - 1));
+}
+
+TEST(NormalPageMemoryPool, ConstructorEmpty) {
+  v8::base::PageAllocator allocator;
+  NormalPageMemoryPool pool;
+  constexpr size_t kBucket = 0;
+  EXPECT_EQ(NormalPageMemoryPool::Result(nullptr, nullptr), pool.Take(kBucket));
+}
+
+TEST(NormalPageMemoryPool, AddTakeSameBucket) {
+  v8::base::PageAllocator allocator;
+  auto pmr = std::make_unique<NormalPageMemoryRegion>(&allocator);
+  const PageMemory pm = pmr->GetPageMemory(0);
+  NormalPageMemoryPool pool;
+  constexpr size_t kBucket = 0;
+  pool.Add(kBucket, pmr.get(), pm.writeable_region().base());
+  EXPECT_EQ(
+      NormalPageMemoryPool::Result(pmr.get(), pm.writeable_region().base()),
+      pool.Take(kBucket));
+}
+
+TEST(NormalPageMemoryPool, AddTakeNotFoundDifferentBucket) {
+  v8::base::PageAllocator allocator;
+  auto pmr = std::make_unique<NormalPageMemoryRegion>(&allocator);
+  const PageMemory pm = pmr->GetPageMemory(0);
+  NormalPageMemoryPool pool;
+  constexpr size_t kFirstBucket = 0;
+  constexpr size_t kSecondBucket = 1;
+  pool.Add(kFirstBucket, pmr.get(), pm.writeable_region().base());
+  EXPECT_EQ(NormalPageMemoryPool::Result(nullptr, nullptr),
+            pool.Take(kSecondBucket));
+  EXPECT_EQ(
+      NormalPageMemoryPool::Result(pmr.get(), pm.writeable_region().base()),
+      pool.Take(kFirstBucket));
+}
+
+TEST(PageBackendTest, AllocateNormalUsesPool) {
+  v8::base::PageAllocator allocator;
+  PageBackend backend(&allocator);
+  constexpr size_t kBucket = 0;
+  Address writeable_base1 = backend.AllocateNormalPageMemory(kBucket);
+  EXPECT_NE(nullptr, writeable_base1);
+  backend.FreeNormalPageMemory(kBucket, writeable_base1);
+  Address writeable_base2 = backend.AllocateNormalPageMemory(kBucket);
+  EXPECT_NE(nullptr, writeable_base2);
+  EXPECT_EQ(writeable_base1, writeable_base2);
+}
+
+TEST(PageBackendTest, AllocateLarge) {
+  v8::base::PageAllocator allocator;
+  PageBackend backend(&allocator);
+  Address writeable_base1 = backend.AllocateLargePageMemory(13731);
+  EXPECT_NE(nullptr, writeable_base1);
+  Address writeable_base2 = backend.AllocateLargePageMemory(9478);
+  EXPECT_NE(nullptr, writeable_base2);
+  EXPECT_NE(writeable_base1, writeable_base2);
+  backend.FreeLargePageMemory(writeable_base1);
+  backend.FreeLargePageMemory(writeable_base2);
+}
+
+TEST(PageBackendTest, LookupNormal) {
+  v8::base::PageAllocator allocator;
+  PageBackend backend(&allocator);
+  constexpr size_t kBucket = 0;
+  Address writeable_base = backend.AllocateNormalPageMemory(kBucket);
+  EXPECT_EQ(nullptr, backend.Lookup(writeable_base - kGuardPageSize));
+  EXPECT_EQ(nullptr, backend.Lookup(writeable_base - 1));
+  EXPECT_EQ(writeable_base, backend.Lookup(writeable_base));
+  EXPECT_EQ(writeable_base, backend.Lookup(writeable_base + kPageSize -
+                                           2 * kGuardPageSize - 1));
+  EXPECT_EQ(nullptr,
+            backend.Lookup(writeable_base + kPageSize - 2 * kGuardPageSize));
+  EXPECT_EQ(nullptr,
+            backend.Lookup(writeable_base - kGuardPageSize + kPageSize - 1));
+}
+
+TEST(PageBackendTest, LookupLarge) {
+  v8::base::PageAllocator allocator;
+  PageBackend backend(&allocator);
+  constexpr size_t kSize = 7934;
+  Address writeable_base = backend.AllocateLargePageMemory(kSize);
+  EXPECT_EQ(nullptr, backend.Lookup(writeable_base - kGuardPageSize));
+  EXPECT_EQ(nullptr, backend.Lookup(writeable_base - 1));
+  EXPECT_EQ(writeable_base, backend.Lookup(writeable_base));
+  EXPECT_EQ(writeable_base, backend.Lookup(writeable_base + kSize - 1));
+}
+
+TEST(PageBackendDeathTest, DestructingBackendDestroysPageMemory) {
+  v8::base::PageAllocator allocator;
+  Address base;
+  {
+    PageBackend backend(&allocator);
+    constexpr size_t kBucket = 0;
+    base = backend.AllocateNormalPageMemory(kBucket);
+  }
+  EXPECT_DEATH_IF_SUPPORTED(access(base[0]), "");
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/persistent-unittest.cc b/deps/v8/test/unittests/heap/cppgc/persistent-unittest.cc
new file mode 100644
index 00000000000..e18872ebcea
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/persistent-unittest.cc
@@ -0,0 +1,658 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "include/cppgc/persistent.h"
+
+#include <vector>
+
+#include "include/cppgc/allocation.h"
+#include "include/cppgc/garbage-collected.h"
+#include "include/cppgc/member.h"
+#include "include/cppgc/type-traits.h"
+#include "src/heap/cppgc/heap.h"
+#include "src/heap/cppgc/visitor.h"
+#include "test/unittests/heap/cppgc/tests.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+struct GCed : GarbageCollected<GCed> {
+  static size_t trace_call_count;
+  virtual void Trace(cppgc::Visitor*) const { ++trace_call_count; }
+};
+size_t GCed::trace_call_count = 0;
+
+struct DerivedGCed : GCed {
+  void Trace(cppgc::Visitor* v) const override { GCed::Trace(v); }
+};
+
+template <template <typename> class PersistentType>
+PersistentRegion& GetRegion(cppgc::Heap* heap) {
+  auto* heap_impl = internal::Heap::From(heap);
+  return IsWeak<PersistentType<GCed>>::value
+             ? heap_impl->GetWeakPersistentRegion()
+             : heap_impl->GetStrongPersistentRegion();
+}
+
+template <typename T>
+using LocalizedPersistent =
+    internal::BasicPersistent<T, internal::StrongPersistentPolicy,
+                              internal::KeepLocationPolicy,
+                              internal::DefaultCheckingPolicy>;
+
+class RootVisitor final : public VisitorBase {
+ public:
+  RootVisitor() = default;
+
+  const auto& WeakCallbacks() const { return weak_callbacks_; }
+
+  void ProcessWeakCallbacks() {
+    const auto info = LivenessBrokerFactory::Create();
+    for (const auto& cb : weak_callbacks_) {
+      cb.first(info, cb.second);
+    }
+    weak_callbacks_.clear();
+  }
+
+ protected:
+  void VisitRoot(const void* t, TraceDescriptor desc) final {
+    desc.callback(this, desc.base_object_payload);
+  }
+  void VisitWeakRoot(const void*, TraceDescriptor, WeakCallback callback,
+                     const void* object) final {
+    weak_callbacks_.emplace_back(callback, object);
+  }
+
+ private:
+  std::vector<std::pair<WeakCallback, const void*>> weak_callbacks_;
+};
+class PersistentTest : public testing::TestSupportingAllocationOnly {};
+
+}  // namespace
+
+template <template <typename> class PersistentType>
+void NullStateCtor(cppgc::Heap* heap) {
+  EXPECT_EQ(0u, GetRegion<Persistent>(heap).NodesInUse());
+  {
+    PersistentType<GCed> empty;
+    EXPECT_EQ(nullptr, empty.Get());
+    EXPECT_EQ(nullptr, empty.Release());
+    EXPECT_EQ(0u, GetRegion<Persistent>(heap).NodesInUse());
+  }
+  {
+    PersistentType<GCed> empty = nullptr;
+    EXPECT_EQ(nullptr, empty.Get());
+    EXPECT_EQ(nullptr, empty.Release());
+    EXPECT_EQ(0u, GetRegion<Persistent>(heap).NodesInUse());
+  }
+  {
+    PersistentType<GCed> empty = kSentinelPointer;
+    EXPECT_EQ(kSentinelPointer, empty);
+    EXPECT_EQ(kSentinelPointer, empty.Release());
+    EXPECT_EQ(0u, GetRegion<Persistent>(heap).NodesInUse());
+  }
+  {
+    // Runtime null must not allocated associated node.
+    PersistentType<GCed> empty = static_cast<GCed*>(0);
+    EXPECT_EQ(nullptr, empty.Get());
+    EXPECT_EQ(nullptr, empty.Release());
+    EXPECT_EQ(0u, GetRegion<Persistent>(heap).NodesInUse());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+}
+
+TEST_F(PersistentTest, NullStateCtor) {
+  auto* heap = GetHeap();
+  NullStateCtor<Persistent>(heap);
+  NullStateCtor<WeakPersistent>(heap);
+}
+
+template <template <typename> class PersistentType>
+void RawCtor(cppgc::Heap* heap) {
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  GCed* gced = MakeGarbageCollected<GCed>(heap);
+  {
+    PersistentType<GCed> p = gced;
+    EXPECT_EQ(gced, p.Get());
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    PersistentType<GCed> p = *gced;
+    EXPECT_EQ(gced, p.Get());
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+}
+
+TEST_F(PersistentTest, RawCtor) {
+  auto* heap = GetHeap();
+  RawCtor<Persistent>(heap);
+  RawCtor<WeakPersistent>(heap);
+}
+
+template <template <typename> class PersistentType>
+void CopyCtor(cppgc::Heap* heap) {
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    PersistentType<GCed> p1 = MakeGarbageCollected<GCed>(heap);
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    PersistentType<GCed> p2 = p1;
+    EXPECT_EQ(2u, GetRegion<PersistentType>(heap).NodesInUse());
+    EXPECT_EQ(p1.Get(), p2.Get());
+    EXPECT_EQ(p1, p2);
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    PersistentType<GCed> p1;
+    EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+    PersistentType<GCed> p2 = p1;
+    EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+    EXPECT_EQ(nullptr, p1.Get());
+    EXPECT_EQ(p1, p2);
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    PersistentType<DerivedGCed> p1 = MakeGarbageCollected<DerivedGCed>(heap);
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    PersistentType<GCed> p2 = p1;
+    EXPECT_EQ(2u, GetRegion<PersistentType>(heap).NodesInUse());
+    EXPECT_EQ(p1.Get(), p2.Get());
+    EXPECT_EQ(p1, p2);
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    static constexpr size_t kSlots = 512u;
+    const PersistentType<GCed> prototype = MakeGarbageCollected<GCed>(heap);
+    std::vector<PersistentType<GCed>> vector;
+    vector.reserve(kSlots);
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    for (size_t i = 0; i < kSlots; ++i) {
+      vector.emplace_back(prototype);
+      EXPECT_EQ(i + 2, GetRegion<PersistentType>(heap).NodesInUse());
+    }
+    vector.clear();
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+}
+
+TEST_F(PersistentTest, CopyCtor) {
+  auto* heap = GetHeap();
+  CopyCtor<Persistent>(heap);
+  CopyCtor<WeakPersistent>(heap);
+}
+
+template <template <typename> class PersistentType>
+void MoveCtor(cppgc::Heap* heap) {
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    GCed* gced = MakeGarbageCollected<GCed>(heap);
+    PersistentType<GCed> p1 = gced;
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    PersistentType<GCed> p2 = std::move(p1);
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    EXPECT_EQ(gced, p2.Get());
+    // Moved-from-object is in the valid specified (nullptr) state.
+    EXPECT_EQ(nullptr, p1.Get());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    PersistentType<DerivedGCed> p1 = MakeGarbageCollected<DerivedGCed>(heap);
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    // Move ctor is not heterogeneous - fall back to copy ctor.
+    PersistentType<GCed> p2 = std::move(p1);
+    EXPECT_EQ(2u, GetRegion<PersistentType>(heap).NodesInUse());
+    EXPECT_EQ(p1.Get(), p2.Get());
+    EXPECT_EQ(p1, p2);
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    PersistentType<GCed> p1;
+    EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+    PersistentType<GCed> p2 = std::move(p1);
+    EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+    EXPECT_EQ(nullptr, p1.Get());
+    EXPECT_EQ(p1, p2);
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+}
+
+TEST_F(PersistentTest, MoveCtor) {
+  auto* heap = GetHeap();
+  MoveCtor<Persistent>(heap);
+  MoveCtor<WeakPersistent>(heap);
+}
+
+template <template <typename> class PersistentType,
+          template <typename> class MemberType>
+void MemberCtor(cppgc::Heap* heap) {
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    MemberType<GCed> m = MakeGarbageCollected<GCed>(heap);
+    PersistentType<GCed> p = m;
+    EXPECT_EQ(m.Get(), p.Get());
+    EXPECT_EQ(m, p);
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+}
+
+TEST_F(PersistentTest, MemberCtor) {
+  auto* heap = GetHeap();
+  MemberCtor<Persistent, Member>(heap);
+  MemberCtor<Persistent, WeakMember>(heap);
+  MemberCtor<Persistent, UntracedMember>(heap);
+  MemberCtor<WeakPersistent, Member>(heap);
+  MemberCtor<WeakPersistent, WeakMember>(heap);
+  MemberCtor<WeakPersistent, UntracedMember>(heap);
+}
+
+template <template <typename> class PersistentType>
+void NullStateAssignemnt(cppgc::Heap* heap) {
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    PersistentType<GCed> p = MakeGarbageCollected<GCed>(heap);
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    p = nullptr;
+    EXPECT_EQ(nullptr, p.Get());
+    EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  }
+  {
+    PersistentType<GCed> p = MakeGarbageCollected<GCed>(heap);
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    p = kSentinelPointer;
+    EXPECT_EQ(kSentinelPointer, p);
+    EXPECT_EQ(kSentinelPointer, p.Get());
+    EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  }
+  {
+    PersistentType<GCed> p = MakeGarbageCollected<GCed>(heap);
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    p = static_cast<GCed*>(0);
+    EXPECT_EQ(nullptr, p.Get());
+    EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  }
+}
+
+TEST_F(PersistentTest, NullStateAssignemnt) {
+  auto* heap = GetHeap();
+  NullStateAssignemnt<Persistent>(heap);
+  NullStateAssignemnt<WeakPersistent>(heap);
+}
+
+template <template <typename> class PersistentType>
+void RawAssignment(cppgc::Heap* heap) {
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  GCed* gced = MakeGarbageCollected<GCed>(heap);
+  {
+    PersistentType<GCed> p;
+    EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+    p = gced;
+    EXPECT_EQ(gced, p.Get());
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    PersistentType<GCed> p;
+    EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+    p = *gced;
+    EXPECT_EQ(gced, p.Get());
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+}
+
+TEST_F(PersistentTest, RawAssignment) {
+  auto* heap = GetHeap();
+  RawAssignment<Persistent>(heap);
+  RawAssignment<WeakPersistent>(heap);
+}
+
+template <template <typename> class PersistentType>
+void CopyAssignment(cppgc::Heap* heap) {
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    PersistentType<GCed> p1 = MakeGarbageCollected<GCed>(heap);
+    PersistentType<GCed> p2;
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    p2 = p1;
+    EXPECT_EQ(2u, GetRegion<PersistentType>(heap).NodesInUse());
+    EXPECT_EQ(p1.Get(), p2.Get());
+    EXPECT_EQ(p1, p2);
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    PersistentType<GCed> p1 = MakeGarbageCollected<GCed>(heap);
+    PersistentType<GCed> p2 = MakeGarbageCollected<GCed>(heap);
+    EXPECT_EQ(2u, GetRegion<PersistentType>(heap).NodesInUse());
+    p2 = p1;
+    // The old node from p2 must be dropped.
+    EXPECT_EQ(2u, GetRegion<PersistentType>(heap).NodesInUse());
+    EXPECT_EQ(p1.Get(), p2.Get());
+    EXPECT_EQ(p1, p2);
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    PersistentType<DerivedGCed> p1 = MakeGarbageCollected<DerivedGCed>(heap);
+    PersistentType<GCed> p2;
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    p2 = p1;
+    EXPECT_EQ(2u, GetRegion<PersistentType>(heap).NodesInUse());
+    EXPECT_EQ(p1.Get(), p2.Get());
+    EXPECT_EQ(p1, p2);
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    static constexpr size_t kSlots = 512u;
+    const PersistentType<GCed> prototype = MakeGarbageCollected<GCed>(heap);
+    std::vector<PersistentType<GCed>> vector(kSlots);
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    size_t i = 0;
+    for (auto& p : vector) {
+      p = prototype;
+      EXPECT_EQ(i + 2, GetRegion<PersistentType>(heap).NodesInUse());
+      ++i;
+    }
+    vector.clear();
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+}
+
+TEST_F(PersistentTest, CopyAssignment) {
+  auto* heap = GetHeap();
+  CopyAssignment<Persistent>(heap);
+  CopyAssignment<WeakPersistent>(heap);
+}
+
+template <template <typename> class PersistentType>
+void MoveAssignment(cppgc::Heap* heap) {
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    GCed* gced = MakeGarbageCollected<GCed>(heap);
+    PersistentType<GCed> p1 = gced;
+    PersistentType<GCed> p2;
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    p2 = std::move(p1);
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    EXPECT_EQ(gced, p2.Get());
+    // Moved-from-object is in the valid specified (nullptr) state.
+    EXPECT_EQ(nullptr, p1.Get());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    PersistentType<GCed> p1;
+    PersistentType<GCed> p2 = MakeGarbageCollected<GCed>(heap);
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    p2 = std::move(p1);
+    EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+    // Moved-from-object is in the valid specified (nullptr) state.
+    EXPECT_EQ(nullptr, p2.Get());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    GCed* gced = MakeGarbageCollected<GCed>(heap);
+    PersistentType<GCed> p1 = gced;
+    PersistentType<GCed> p2 = MakeGarbageCollected<GCed>(heap);
+    EXPECT_EQ(2u, GetRegion<PersistentType>(heap).NodesInUse());
+    p2 = std::move(p1);
+    // The old node from p2 must be dropped.
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    EXPECT_EQ(gced, p2.Get());
+    // Moved-from-object is in the valid specified (nullptr) state.
+    EXPECT_EQ(nullptr, p1.Get());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    PersistentType<DerivedGCed> p1 = MakeGarbageCollected<DerivedGCed>(heap);
+    PersistentType<GCed> p2;
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+    // Move ctor is not heterogeneous - fall back to copy assignment.
+    p2 = std::move(p1);
+    EXPECT_EQ(2u, GetRegion<PersistentType>(heap).NodesInUse());
+    EXPECT_EQ(p1.Get(), p2.Get());
+    EXPECT_EQ(p1, p2);
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+}
+
+TEST_F(PersistentTest, MoveAssignment) {
+  auto* heap = GetHeap();
+  MoveAssignment<Persistent>(heap);
+  MoveAssignment<WeakPersistent>(heap);
+}
+
+template <template <typename> class PersistentType,
+          template <typename> class MemberType>
+void MemberAssignment(cppgc::Heap* heap) {
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  {
+    MemberType<GCed> m = MakeGarbageCollected<GCed>(heap);
+    PersistentType<GCed> p;
+    p = m;
+    EXPECT_EQ(m.Get(), p.Get());
+    EXPECT_EQ(m, p);
+    EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+}
+
+TEST_F(PersistentTest, MemberAssignment) {
+  auto* heap = GetHeap();
+  MemberAssignment<Persistent, Member>(heap);
+  MemberAssignment<Persistent, WeakMember>(heap);
+  MemberAssignment<Persistent, UntracedMember>(heap);
+  MemberAssignment<WeakPersistent, Member>(heap);
+  MemberAssignment<WeakPersistent, WeakMember>(heap);
+  MemberAssignment<WeakPersistent, UntracedMember>(heap);
+}
+
+template <template <typename> class PersistentType>
+void ClearTest(cppgc::Heap* heap) {
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  PersistentType<GCed> p = MakeGarbageCollected<GCed>(heap);
+  EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+  EXPECT_NE(nullptr, p.Get());
+  p.Clear();
+  EXPECT_EQ(nullptr, p.Get());
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+}
+
+TEST_F(PersistentTest, Clear) {
+  auto* heap = GetHeap();
+  ClearTest<Persistent>(heap);
+  ClearTest<WeakPersistent>(heap);
+}
+
+template <template <typename> class PersistentType>
+void ReleaseTest(cppgc::Heap* heap) {
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+  GCed* gced = MakeGarbageCollected<GCed>(heap);
+  PersistentType<GCed> p = gced;
+  EXPECT_EQ(1u, GetRegion<PersistentType>(heap).NodesInUse());
+  EXPECT_NE(nullptr, p.Get());
+  GCed* raw = p.Release();
+  EXPECT_EQ(gced, raw);
+  EXPECT_EQ(nullptr, p.Get());
+  EXPECT_EQ(0u, GetRegion<PersistentType>(heap).NodesInUse());
+}
+
+TEST_F(PersistentTest, Release) {
+  auto* heap = GetHeap();
+  ReleaseTest<Persistent>(heap);
+  ReleaseTest<WeakPersistent>(heap);
+}
+
+template <template <typename> class PersistentType1,
+          template <typename> class PersistentType2>
+void HeterogeneousConversion(cppgc::Heap* heap) {
+  EXPECT_EQ(0u, GetRegion<PersistentType1>(heap).NodesInUse());
+  EXPECT_EQ(0u, GetRegion<PersistentType2>(heap).NodesInUse());
+  {
+    PersistentType1<GCed> persistent1 = MakeGarbageCollected<GCed>(heap);
+    PersistentType2<GCed> persistent2 = persistent1;
+    EXPECT_EQ(persistent1.Get(), persistent2.Get());
+    EXPECT_EQ(1u, GetRegion<PersistentType1>(heap).NodesInUse());
+    EXPECT_EQ(1u, GetRegion<PersistentType2>(heap).NodesInUse());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType1>(heap).NodesInUse());
+  EXPECT_EQ(0u, GetRegion<PersistentType2>(heap).NodesInUse());
+  {
+    PersistentType1<DerivedGCed> persistent1 =
+        MakeGarbageCollected<DerivedGCed>(heap);
+    PersistentType2<GCed> persistent2 = persistent1;
+    EXPECT_EQ(persistent1.Get(), persistent2.Get());
+    EXPECT_EQ(1u, GetRegion<PersistentType1>(heap).NodesInUse());
+    EXPECT_EQ(1u, GetRegion<PersistentType2>(heap).NodesInUse());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType1>(heap).NodesInUse());
+  EXPECT_EQ(0u, GetRegion<PersistentType2>(heap).NodesInUse());
+  {
+    PersistentType1<GCed> persistent1 = MakeGarbageCollected<GCed>(heap);
+    PersistentType2<GCed> persistent2;
+    persistent2 = persistent1;
+    EXPECT_EQ(persistent1.Get(), persistent2.Get());
+    EXPECT_EQ(1u, GetRegion<PersistentType1>(heap).NodesInUse());
+    EXPECT_EQ(1u, GetRegion<PersistentType2>(heap).NodesInUse());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType1>(heap).NodesInUse());
+  EXPECT_EQ(0u, GetRegion<PersistentType2>(heap).NodesInUse());
+  {
+    PersistentType1<DerivedGCed> persistent1 =
+        MakeGarbageCollected<DerivedGCed>(heap);
+    PersistentType2<GCed> persistent2;
+    persistent2 = persistent1;
+    EXPECT_EQ(persistent1.Get(), persistent2.Get());
+    EXPECT_EQ(1u, GetRegion<PersistentType1>(heap).NodesInUse());
+    EXPECT_EQ(1u, GetRegion<PersistentType2>(heap).NodesInUse());
+  }
+  EXPECT_EQ(0u, GetRegion<PersistentType1>(heap).NodesInUse());
+  EXPECT_EQ(0u, GetRegion<PersistentType2>(heap).NodesInUse());
+}
+
+TEST_F(PersistentTest, HeterogeneousConversion) {
+  auto* heap = GetHeap();
+  HeterogeneousConversion<Persistent, WeakPersistent>(heap);
+  HeterogeneousConversion<WeakPersistent, Persistent>(heap);
+}
+
+TEST_F(PersistentTest, TraceStrong) {
+  auto* heap = GetHeap();
+  static constexpr size_t kItems = 512;
+  std::vector<Persistent<GCed>> vec(kItems);
+  for (auto& p : vec) {
+    p = MakeGarbageCollected<GCed>(heap);
+  }
+  {
+    GCed::trace_call_count = 0;
+    RootVisitor v;
+    GetRegion<Persistent>(heap).Trace(&v);
+    EXPECT_EQ(kItems, GCed::trace_call_count);
+    EXPECT_EQ(kItems, GetRegion<Persistent>(heap).NodesInUse());
+  }
+  {
+    GCed::trace_call_count = 0;
+    vec[0].Clear();
+    vec[kItems / 2].Clear();
+    vec[kItems / 4].Clear();
+    vec[kItems - 1].Clear();
+    RootVisitor v;
+    GetRegion<Persistent>(heap).Trace(&v);
+    EXPECT_EQ(kItems - 4, GCed::trace_call_count);
+    EXPECT_EQ(kItems - 4, GetRegion<Persistent>(heap).NodesInUse());
+  }
+  {
+    GCed::trace_call_count = 0;
+    vec.clear();
+    RootVisitor v;
+    GetRegion<Persistent>(heap).Trace(&v);
+    EXPECT_EQ(0u, GCed::trace_call_count);
+    EXPECT_EQ(0u, GetRegion<Persistent>(heap).NodesInUse());
+  }
+}
+
+TEST_F(PersistentTest, TraceWeak) {
+  auto* heap = GetHeap();
+  static constexpr size_t kItems = 512;
+  std::vector<WeakPersistent<GCed>> vec(kItems);
+  for (auto& p : vec) {
+    p = MakeGarbageCollected<GCed>(heap);
+  }
+  GCed::trace_call_count = 0;
+  RootVisitor v;
+  GetRegion<WeakPersistent>(heap).Trace(&v);
+  const auto& callbacks = v.WeakCallbacks();
+  EXPECT_EQ(kItems, callbacks.size());
+  EXPECT_EQ(kItems, GetRegion<WeakPersistent>(heap).NodesInUse());
+
+  v.ProcessWeakCallbacks();
+  for (const auto& p : vec) {
+    EXPECT_EQ(nullptr, p.Get());
+  }
+  EXPECT_EQ(0u, GetRegion<WeakPersistent>(heap).NodesInUse());
+}
+
+#if CPPGC_SUPPORTS_SOURCE_LOCATION
+TEST_F(PersistentTest, LocalizedPersistent) {
+  GCed* gced = MakeGarbageCollected<GCed>(GetHeap());
+  {
+    const auto expected_loc = SourceLocation::Current();
+    LocalizedPersistent<GCed> p = gced;
+    const auto actual_loc = p.Location();
+    EXPECT_STREQ(expected_loc.Function(), actual_loc.Function());
+    EXPECT_STREQ(expected_loc.FileName(), actual_loc.FileName());
+    EXPECT_EQ(expected_loc.Line() + 1, actual_loc.Line());
+  }
+  {
+    // Copy ctor doesn't copy source location.
+    LocalizedPersistent<GCed> p1 = gced;
+    LocalizedPersistent<GCed> p2 = p1;
+    EXPECT_STREQ(p1.Location().Function(), p2.Location().Function());
+    EXPECT_STREQ(p1.Location().FileName(), p2.Location().FileName());
+    EXPECT_EQ(p1.Location().Line() + 1, p2.Location().Line());
+  }
+  {
+    // Copy assignment doesn't copy source location.
+    LocalizedPersistent<GCed> p1 = gced;
+    LocalizedPersistent<GCed> p2;
+    p2 = p1;
+    EXPECT_STREQ(p1.Location().Function(), p2.Location().Function());
+    EXPECT_STREQ(p1.Location().FileName(), p2.Location().FileName());
+    EXPECT_EQ(p1.Location().Line() + 1, p2.Location().Line());
+  }
+  {
+    // Clearing doesn't clear source location.
+    LocalizedPersistent<GCed> p1 = gced;
+    LocalizedPersistent<GCed> p2 = gced;
+    p2.Clear();
+    EXPECT_STREQ(p1.Location().Function(), p2.Location().Function());
+    EXPECT_STREQ(p1.Location().FileName(), p2.Location().FileName());
+    EXPECT_EQ(p1.Location().Line() + 1, p2.Location().Line());
+  }
+  {
+    LocalizedPersistent<GCed> p1 = gced;
+    const auto expected_loc = p1.Location();
+    LocalizedPersistent<GCed> p2 = std::move(p1);
+    EXPECT_STREQ(expected_loc.Function(), p2.Location().Function());
+    EXPECT_STREQ(expected_loc.FileName(), p2.Location().FileName());
+    EXPECT_EQ(expected_loc.Line(), p2.Location().Line());
+  }
+  {
+    LocalizedPersistent<GCed> p1 = gced;
+    const auto expected_loc = p1.Location();
+    LocalizedPersistent<GCed> p2;
+    p2 = std::move(p1);
+    EXPECT_STREQ(expected_loc.Function(), p2.Location().Function());
+    EXPECT_STREQ(expected_loc.FileName(), p2.Location().FileName());
+    EXPECT_EQ(expected_loc.Line(), p2.Location().Line());
+  }
+}
+#endif
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/prefinalizer-unittest.cc b/deps/v8/test/unittests/heap/cppgc/prefinalizer-unittest.cc
new file mode 100644
index 00000000000..3cd845ec2f2
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/prefinalizer-unittest.cc
@@ -0,0 +1,199 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "include/cppgc/prefinalizer.h"
+
+#include "include/cppgc/allocation.h"
+#include "include/cppgc/garbage-collected.h"
+#include "src/heap/cppgc/heap-object-header-inl.h"
+#include "src/heap/cppgc/heap.h"
+#include "test/unittests/heap/cppgc/tests.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+class PrefinalizerTest : public testing::TestWithHeap {};
+
+class GCed : public GarbageCollected<GCed> {
+  CPPGC_USING_PRE_FINALIZER(GCed, PreFinalizer);
+
+ public:
+  void Trace(Visitor*) const {}
+  void PreFinalizer() { ++prefinalizer_callcount; }
+
+  static size_t prefinalizer_callcount;
+};
+size_t GCed::prefinalizer_callcount = 0;
+
+}  // namespace
+
+TEST_F(PrefinalizerTest, PrefinalizerCalledOnDeadObject) {
+  GCed::prefinalizer_callcount = 0;
+  auto* object = MakeGarbageCollected<GCed>(GetHeap());
+  USE(object);
+  EXPECT_EQ(0u, GCed::prefinalizer_callcount);
+  PreciseGC();
+  EXPECT_EQ(1u, GCed::prefinalizer_callcount);
+  PreciseGC();
+  EXPECT_EQ(1u, GCed::prefinalizer_callcount);
+}
+
+TEST_F(PrefinalizerTest, PrefinalizerNotCalledOnLiveObject) {
+  GCed::prefinalizer_callcount = 0;
+  auto* object = MakeGarbageCollected<GCed>(GetHeap());
+  HeapObjectHeader::FromPayload(object).TryMarkAtomic();
+  EXPECT_EQ(0u, GCed::prefinalizer_callcount);
+  PreciseGC();
+  EXPECT_EQ(0u, GCed::prefinalizer_callcount);
+  PreciseGC();
+  EXPECT_EQ(1u, GCed::prefinalizer_callcount);
+}
+
+namespace {
+
+class Mixin : public GarbageCollectedMixin {
+  CPPGC_USING_PRE_FINALIZER(Mixin, PreFinalizer);
+
+ public:
+  void PreFinalizer() { ++prefinalizer_callcount; }
+
+  static size_t prefinalizer_callcount;
+};
+size_t Mixin::prefinalizer_callcount = 0;
+
+class GCedWithMixin : public GarbageCollected<GCedWithMixin>, public Mixin {
+  USING_GARBAGE_COLLECTED_MIXIN();
+};
+
+}  // namespace
+
+TEST_F(PrefinalizerTest, PrefinalizerCalledOnDeadMixinObject) {
+  Mixin::prefinalizer_callcount = 0;
+  auto* object = MakeGarbageCollected<GCedWithMixin>(GetHeap());
+  USE(object);
+  EXPECT_EQ(0u, Mixin::prefinalizer_callcount);
+  PreciseGC();
+  EXPECT_EQ(1u, Mixin::prefinalizer_callcount);
+  PreciseGC();
+  EXPECT_EQ(1u, Mixin::prefinalizer_callcount);
+}
+
+TEST_F(PrefinalizerTest, PrefinalizerNotCalledOnLiveMixinObject) {
+  Mixin::prefinalizer_callcount = 0;
+  auto* object = MakeGarbageCollected<GCedWithMixin>(GetHeap());
+  HeapObjectHeader::FromPayload(object).TryMarkAtomic();
+  EXPECT_EQ(0u, Mixin::prefinalizer_callcount);
+  PreciseGC();
+  EXPECT_EQ(0u, Mixin::prefinalizer_callcount);
+  PreciseGC();
+  EXPECT_EQ(1u, Mixin::prefinalizer_callcount);
+}
+
+namespace {
+
+class BaseMixin : public GarbageCollectedMixin {
+  CPPGC_USING_PRE_FINALIZER(BaseMixin, PreFinalizer);
+
+ public:
+  void PreFinalizer();
+
+  static size_t prefinalizer_callcount;
+};
+size_t BaseMixin::prefinalizer_callcount = 0;
+
+class InheritingMixin : public BaseMixin {
+  CPPGC_USING_PRE_FINALIZER(InheritingMixin, PreFinalizer);
+
+ public:
+  void PreFinalizer();
+
+  static size_t prefinalizer_callcount;
+};
+size_t InheritingMixin::prefinalizer_callcount = 0;
+
+class GCedWithMixins : public GarbageCollected<GCedWithMixins>,
+                       public InheritingMixin {
+  USING_GARBAGE_COLLECTED_MIXIN();
+  CPPGC_USING_PRE_FINALIZER(GCedWithMixins, PreFinalizer);
+
+ public:
+  void PreFinalizer();
+
+  static size_t prefinalizer_callcount;
+};
+size_t GCedWithMixins::prefinalizer_callcount = 0;
+
+void BaseMixin::PreFinalizer() {
+  EXPECT_EQ(1u, GCedWithMixins::prefinalizer_callcount);
+  EXPECT_EQ(1u, InheritingMixin::prefinalizer_callcount);
+  EXPECT_EQ(0u, BaseMixin::prefinalizer_callcount);
+  ++BaseMixin::prefinalizer_callcount;
+}
+
+void InheritingMixin::PreFinalizer() {
+  EXPECT_EQ(1u, GCedWithMixins::prefinalizer_callcount);
+  EXPECT_EQ(0u, InheritingMixin::prefinalizer_callcount);
+  EXPECT_EQ(0u, BaseMixin::prefinalizer_callcount);
+  InheritingMixin::prefinalizer_callcount = true;
+}
+
+void GCedWithMixins::PreFinalizer() {
+  EXPECT_EQ(0u, GCedWithMixins::prefinalizer_callcount);
+  EXPECT_EQ(0u, InheritingMixin::prefinalizer_callcount);
+  EXPECT_EQ(0u, BaseMixin::prefinalizer_callcount);
+  GCedWithMixins::prefinalizer_callcount = true;
+}
+}  // namespace
+
+TEST_F(PrefinalizerTest, PrefinalizerInvocationPreservesOrder) {
+  BaseMixin::prefinalizer_callcount = 0;
+  InheritingMixin::prefinalizer_callcount = 0;
+  GCedWithMixins::prefinalizer_callcount = 0;
+  auto* object = MakeGarbageCollected<GCedWithMixins>(GetHeap());
+  USE(object);
+  EXPECT_EQ(0u, GCedWithMixins::prefinalizer_callcount);
+  EXPECT_EQ(0u, InheritingMixin::prefinalizer_callcount);
+  EXPECT_EQ(0u, BaseMixin::prefinalizer_callcount);
+  PreciseGC();
+  EXPECT_EQ(1u, GCedWithMixins::prefinalizer_callcount);
+  EXPECT_EQ(1u, InheritingMixin::prefinalizer_callcount);
+  EXPECT_EQ(1u, BaseMixin::prefinalizer_callcount);
+  PreciseGC();
+  EXPECT_EQ(1u, GCedWithMixins::prefinalizer_callcount);
+  EXPECT_EQ(1u, InheritingMixin::prefinalizer_callcount);
+  EXPECT_EQ(1u, BaseMixin::prefinalizer_callcount);
+}
+
+namespace {
+
+class AllocatingPrefinalizer : public GarbageCollected<AllocatingPrefinalizer> {
+  CPPGC_USING_PRE_FINALIZER(AllocatingPrefinalizer, PreFinalizer);
+
+ public:
+  explicit AllocatingPrefinalizer(cppgc::Heap* heap) : heap_(heap) {}
+  void Trace(Visitor*) const {}
+  void PreFinalizer() { MakeGarbageCollected<GCed>(heap_); }
+
+ private:
+  cppgc::Heap* heap_;
+};
+
+}  // namespace
+
+#ifdef DEBUG
+
+TEST_F(PrefinalizerTest, PrefinalizerFailsOnAllcoation) {
+  auto* object =
+      MakeGarbageCollected<AllocatingPrefinalizer>(GetHeap(), GetHeap());
+  USE(object);
+  EXPECT_DEATH_IF_SUPPORTED(PreciseGC(), "");
+}
+
+#endif  // DEBUG
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/source-location-unittest.cc b/deps/v8/test/unittests/heap/cppgc/source-location-unittest.cc
new file mode 100644
index 00000000000..b477dc167d8
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/source-location-unittest.cc
@@ -0,0 +1,61 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "include/cppgc/source-location.h"
+
+#include "src/base/macros.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+constexpr char kFileName[] = "source-location-unittest.cc";
+
+bool Contains(const std::string& base_string, const std::string& substring) {
+  return base_string.find(substring) != std::string::npos;
+}
+
+}  // namespace
+
+TEST(SourceLocationTest, DefaultCtor) {
+  constexpr SourceLocation loc;
+  EXPECT_EQ(nullptr, loc.Function());
+  EXPECT_EQ(nullptr, loc.FileName());
+  EXPECT_EQ(0u, loc.Line());
+}
+
+void TestSourceLocationCurrent() {
+  static constexpr char kFunctionName[] = "TestSourceLocationCurrent";
+  static constexpr size_t kNextLine = __LINE__ + 1;
+  constexpr auto loc = SourceLocation::Current();
+#if !CPPGC_SUPPORTS_SOURCE_LOCATION
+  EXPECT_EQ(nullptr, loc.Function());
+  EXPECT_EQ(nullptr, loc.FileName());
+  EXPECT_EQ(0u, loc.Line());
+  USE(kNextLine);
+  return;
+#endif
+  EXPECT_EQ(kNextLine, loc.Line());
+  EXPECT_TRUE(Contains(loc.FileName(), kFileName));
+  EXPECT_TRUE(Contains(loc.Function(), kFunctionName));
+}
+
+TEST(SourceLocationTest, Current) { TestSourceLocationCurrent(); }
+
+void TestToString() {
+  static const std::string kDescriptor = std::string(__func__) + "@" +
+                                         __FILE__ + ":" +
+                                         std::to_string(__LINE__ + 1);
+  constexpr auto loc = SourceLocation::Current();
+  const auto string = loc.ToString();
+  EXPECT_EQ(kDescriptor, string);
+}
+
+#if CPPGC_SUPPORTS_SOURCE_LOCATION
+TEST(SourceLocationTest, ToString) { TestToString(); }
+#endif
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/stack-unittest.cc b/deps/v8/test/unittests/heap/cppgc/stack-unittest.cc
new file mode 100644
index 00000000000..7ff5274a19e
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/stack-unittest.cc
@@ -0,0 +1,357 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/stack.h"
+
+#include <memory>
+#include <ostream>
+
+#include "include/v8config.h"
+#include "src/base/platform/platform.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+#if V8_OS_LINUX && (V8_HOST_ARCH_IA32 || V8_HOST_ARCH_X64)
+#include <xmmintrin.h>
+#endif
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+class GCStackTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    stack_.reset(new Stack(v8::base::Stack::GetStackStart()));
+  }
+
+  void TearDown() override { stack_.reset(); }
+
+  Stack* GetStack() const { return stack_.get(); }
+
+ private:
+  std::unique_ptr<Stack> stack_;
+};
+
+}  // namespace
+
+TEST_F(GCStackTest, IsOnStackForStackValue) {
+  void* dummy;
+  EXPECT_TRUE(GetStack()->IsOnStack(&dummy));
+}
+
+TEST_F(GCStackTest, IsOnStackForHeapValue) {
+  auto dummy = std::make_unique<int>();
+  EXPECT_FALSE(GetStack()->IsOnStack(dummy.get()));
+}
+
+namespace {
+
+class StackScanner final : public StackVisitor {
+ public:
+  struct Container {
+    std::unique_ptr<int> value;
+  };
+
+  StackScanner() : container_(new Container{}) {
+    container_->value = std::make_unique<int>();
+  }
+
+  void VisitPointer(const void* address) final {
+    if (address == container_->value.get()) found_ = true;
+  }
+
+  void Reset() { found_ = false; }
+  bool found() const { return found_; }
+  int* needle() const { return container_->value.get(); }
+
+ private:
+  std::unique_ptr<Container> container_;
+  bool found_ = false;
+};
+
+}  // namespace
+
+TEST_F(GCStackTest, IteratePointersFindsOnStackValue) {
+  auto scanner = std::make_unique<StackScanner>();
+
+  // No check that the needle is initially not found as on some platforms it
+  // may be part of  temporaries after setting it up through StackScanner.
+  {
+    int* volatile tmp = scanner->needle();
+    USE(tmp);
+    GetStack()->IteratePointers(scanner.get());
+    EXPECT_TRUE(scanner->found());
+  }
+}
+
+TEST_F(GCStackTest, IteratePointersFindsOnStackValuePotentiallyUnaligned) {
+  auto scanner = std::make_unique<StackScanner>();
+
+  // No check that the needle is initially not found as on some platforms it
+  // may be part of  temporaries after setting it up through StackScanner.
+  {
+    char a = 'c';
+    USE(a);
+    int* volatile tmp = scanner->needle();
+    USE(tmp);
+    GetStack()->IteratePointers(scanner.get());
+    EXPECT_TRUE(scanner->found());
+  }
+}
+
+namespace {
+
+// Prevent inlining as that would allow the compiler to prove that the parameter
+// must not actually be materialized.
+//
+// Parameter positiosn are explicit to test various calling conventions.
+V8_NOINLINE void* RecursivelyPassOnParameterImpl(void* p1, void* p2, void* p3,
+                                                 void* p4, void* p5, void* p6,
+                                                 void* p7, void* p8,
+                                                 Stack* stack,
+                                                 StackVisitor* visitor) {
+  if (p1) {
+    return RecursivelyPassOnParameterImpl(nullptr, p1, nullptr, nullptr,
+                                          nullptr, nullptr, nullptr, nullptr,
+                                          stack, visitor);
+  } else if (p2) {
+    return RecursivelyPassOnParameterImpl(nullptr, nullptr, p2, nullptr,
+                                          nullptr, nullptr, nullptr, nullptr,
+                                          stack, visitor);
+  } else if (p3) {
+    return RecursivelyPassOnParameterImpl(nullptr, nullptr, nullptr, p3,
+                                          nullptr, nullptr, nullptr, nullptr,
+                                          stack, visitor);
+  } else if (p4) {
+    return RecursivelyPassOnParameterImpl(nullptr, nullptr, nullptr, nullptr,
+                                          p4, nullptr, nullptr, nullptr, stack,
+                                          visitor);
+  } else if (p5) {
+    return RecursivelyPassOnParameterImpl(nullptr, nullptr, nullptr, nullptr,
+                                          nullptr, p5, nullptr, nullptr, stack,
+                                          visitor);
+  } else if (p6) {
+    return RecursivelyPassOnParameterImpl(nullptr, nullptr, nullptr, nullptr,
+                                          nullptr, nullptr, p6, nullptr, stack,
+                                          visitor);
+  } else if (p7) {
+    return RecursivelyPassOnParameterImpl(nullptr, nullptr, nullptr, nullptr,
+                                          nullptr, nullptr, nullptr, p7, stack,
+                                          visitor);
+  } else if (p8) {
+    stack->IteratePointers(visitor);
+    return p8;
+  }
+  return nullptr;
+}
+
+V8_NOINLINE void* RecursivelyPassOnParameter(size_t num, void* parameter,
+                                             Stack* stack,
+                                             StackVisitor* visitor) {
+  switch (num) {
+    case 0:
+      stack->IteratePointers(visitor);
+      return parameter;
+    case 1:
+      return RecursivelyPassOnParameterImpl(nullptr, nullptr, nullptr, nullptr,
+                                            nullptr, nullptr, nullptr,
+                                            parameter, stack, visitor);
+    case 2:
+      return RecursivelyPassOnParameterImpl(nullptr, nullptr, nullptr, nullptr,
+                                            nullptr, nullptr, parameter,
+                                            nullptr, stack, visitor);
+    case 3:
+      return RecursivelyPassOnParameterImpl(nullptr, nullptr, nullptr, nullptr,
+                                            nullptr, parameter, nullptr,
+                                            nullptr, stack, visitor);
+    case 4:
+      return RecursivelyPassOnParameterImpl(nullptr, nullptr, nullptr, nullptr,
+                                            parameter, nullptr, nullptr,
+                                            nullptr, stack, visitor);
+    case 5:
+      return RecursivelyPassOnParameterImpl(nullptr, nullptr, nullptr,
+                                            parameter, nullptr, nullptr,
+                                            nullptr, nullptr, stack, visitor);
+    case 6:
+      return RecursivelyPassOnParameterImpl(nullptr, nullptr, parameter,
+                                            nullptr, nullptr, nullptr, nullptr,
+                                            nullptr, stack, visitor);
+    case 7:
+      return RecursivelyPassOnParameterImpl(nullptr, parameter, nullptr,
+                                            nullptr, nullptr, nullptr, nullptr,
+                                            nullptr, stack, visitor);
+    case 8:
+      return RecursivelyPassOnParameterImpl(parameter, nullptr, nullptr,
+                                            nullptr, nullptr, nullptr, nullptr,
+                                            nullptr, stack, visitor);
+    default:
+      UNREACHABLE();
+  }
+  UNREACHABLE();
+}
+
+}  // namespace
+
+TEST_F(GCStackTest, IteratePointersFindsParameterNesting0) {
+  auto scanner = std::make_unique<StackScanner>();
+  void* needle = RecursivelyPassOnParameter(0, scanner->needle(), GetStack(),
+                                            scanner.get());
+  EXPECT_EQ(scanner->needle(), needle);
+  EXPECT_TRUE(scanner->found());
+}
+
+TEST_F(GCStackTest, IteratePointersFindsParameterNesting1) {
+  auto scanner = std::make_unique<StackScanner>();
+  void* needle = RecursivelyPassOnParameter(1, scanner->needle(), GetStack(),
+                                            scanner.get());
+  EXPECT_EQ(scanner->needle(), needle);
+  EXPECT_TRUE(scanner->found());
+}
+
+TEST_F(GCStackTest, IteratePointersFindsParameterNesting2) {
+  auto scanner = std::make_unique<StackScanner>();
+  void* needle = RecursivelyPassOnParameter(2, scanner->needle(), GetStack(),
+                                            scanner.get());
+  EXPECT_EQ(scanner->needle(), needle);
+  EXPECT_TRUE(scanner->found());
+}
+
+TEST_F(GCStackTest, IteratePointersFindsParameterNesting3) {
+  auto scanner = std::make_unique<StackScanner>();
+  void* needle = RecursivelyPassOnParameter(3, scanner->needle(), GetStack(),
+                                            scanner.get());
+  EXPECT_EQ(scanner->needle(), needle);
+  EXPECT_TRUE(scanner->found());
+}
+
+TEST_F(GCStackTest, IteratePointersFindsParameterNesting4) {
+  auto scanner = std::make_unique<StackScanner>();
+  void* needle = RecursivelyPassOnParameter(4, scanner->needle(), GetStack(),
+                                            scanner.get());
+  EXPECT_EQ(scanner->needle(), needle);
+  EXPECT_TRUE(scanner->found());
+}
+
+TEST_F(GCStackTest, IteratePointersFindsParameterNesting5) {
+  auto scanner = std::make_unique<StackScanner>();
+  void* needle = RecursivelyPassOnParameter(5, scanner->needle(), GetStack(),
+                                            scanner.get());
+  EXPECT_EQ(scanner->needle(), needle);
+  EXPECT_TRUE(scanner->found());
+}
+
+TEST_F(GCStackTest, IteratePointersFindsParameterNesting6) {
+  auto scanner = std::make_unique<StackScanner>();
+  void* needle = RecursivelyPassOnParameter(6, scanner->needle(), GetStack(),
+                                            scanner.get());
+  EXPECT_EQ(scanner->needle(), needle);
+  EXPECT_TRUE(scanner->found());
+}
+
+TEST_F(GCStackTest, IteratePointersFindsParameterNesting7) {
+  auto scanner = std::make_unique<StackScanner>();
+  void* needle = RecursivelyPassOnParameter(7, scanner->needle(), GetStack(),
+                                            scanner.get());
+  EXPECT_EQ(scanner->needle(), needle);
+  EXPECT_TRUE(scanner->found());
+}
+
+TEST_F(GCStackTest, IteratePointersFindsParameterNesting8) {
+  auto scanner = std::make_unique<StackScanner>();
+  void* needle = RecursivelyPassOnParameter(8, scanner->needle(), GetStack(),
+                                            scanner.get());
+  EXPECT_EQ(scanner->needle(), needle);
+  EXPECT_TRUE(scanner->found());
+}
+
+// The following test uses inline assembly and has been checked to work on clang
+// to verify that the stack-scanning trampoline pushes callee-saved registers.
+//
+// The test uses a macro loop as asm() can only be passed string literals.
+#ifdef __clang__
+#ifdef V8_TARGET_ARCH_X64
+#ifdef V8_OS_WIN
+
+// Excluded from test: rbp
+#define FOR_ALL_CALLEE_SAVED_REGS(V) \
+  V("rdi")                           \
+  V("rsi")                           \
+  V("rbx")                           \
+  V("r12")                           \
+  V("r13")                           \
+  V("r14")                           \
+  V("r15")
+
+#else  // !V8_OS_WIN
+
+// Excluded from test: rbp
+#define FOR_ALL_CALLEE_SAVED_REGS(V) \
+  V("rbx")                           \
+  V("r12")                           \
+  V("r13")                           \
+  V("r14")                           \
+  V("r15")
+
+#endif  // !V8_OS_WIN
+#endif  // V8_TARGET_ARCH_X64
+#endif  // __clang__
+
+#ifdef FOR_ALL_CALLEE_SAVED_REGS
+
+TEST_F(GCStackTest, IteratePointersFindsCalleeSavedRegisters) {
+  auto scanner = std::make_unique<StackScanner>();
+
+  // No check that the needle is initially not found as on some platforms it
+  // may be part of  temporaries after setting it up through StackScanner.
+
+// First, clear all callee-saved registers.
+#define CLEAR_REGISTER(reg) asm("mov $0, %%" reg : : : reg);
+
+  FOR_ALL_CALLEE_SAVED_REGS(CLEAR_REGISTER)
+#undef CLEAR_REGISTER
+
+  // Keep local raw pointers to keep instruction sequences small below.
+  auto* local_stack = GetStack();
+  auto* local_scanner = scanner.get();
+
+// Moves |local_scanner->needle()| into a callee-saved register, leaving the
+// callee-saved register as the only register referencing the needle.
+// (Ignoring implementation-dependent dirty registers/stack.)
+#define KEEP_ALIVE_FROM_CALLEE_SAVED(reg)                                \
+  local_scanner->Reset();                                                \
+  /* This moves the temporary into the calee-saved register. */          \
+  asm("mov %0, %%" reg : : "r"(local_scanner->needle()) : reg);          \
+  /* Register is unprotected from here till the actual invocation. */    \
+  local_stack->IteratePointers(local_scanner);                           \
+  EXPECT_TRUE(local_scanner->found())                                    \
+      << "pointer in callee-saved register not found. register: " << reg \
+      << std::endl;                                                      \
+  /* Clear out the register again */                                     \
+  asm("mov $0, %%" reg : : : reg);
+
+  FOR_ALL_CALLEE_SAVED_REGS(KEEP_ALIVE_FROM_CALLEE_SAVED)
+#undef KEEP_ALIVE_FROM_CALLEE_SAVED
+#undef FOR_ALL_CALLEE_SAVED_REGS
+}
+#endif  // FOR_ALL_CALLEE_SAVED_REGS
+
+#if V8_OS_LINUX && (V8_HOST_ARCH_IA32 || V8_HOST_ARCH_X64)
+class CheckStackAlignmentVisitor final : public StackVisitor {
+ public:
+  void VisitPointer(const void*) final {
+    float f[4] = {0.};
+    volatile auto xmm = ::_mm_load_ps(f);
+    USE(xmm);
+  }
+};
+
+TEST_F(GCStackTest, StackAlignment) {
+  auto checker = std::make_unique<CheckStackAlignmentVisitor>();
+  GetStack()->IteratePointers(checker.get());
+}
+#endif  // V8_OS_LINUX && (V8_HOST_ARCH_IA32 || V8_HOST_ARCH_X64)
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/stack_unittest.cc b/deps/v8/test/unittests/heap/cppgc/stack_unittest.cc
deleted file mode 100644
index 435c06f83fd..00000000000
--- a/deps/v8/test/unittests/heap/cppgc/stack_unittest.cc
+++ /dev/null
@@ -1,256 +0,0 @@
-// Copyright 2020 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/heap/cppgc/stack.h"
-
-#include <memory>
-#include <ostream>
-
-#include "include/v8config.h"
-#include "src/base/platform/platform.h"
-#include "testing/gtest/include/gtest/gtest.h"
-
-#if V8_OS_LINUX && (V8_HOST_ARCH_IA32 || V8_HOST_ARCH_X64)
-#include <xmmintrin.h>
-#endif
-
-namespace cppgc {
-namespace internal {
-
-namespace {
-
-class GCStackTest : public ::testing::Test {
- protected:
-  void SetUp() override {
-    stack_.reset(new Stack(v8::base::Stack::GetStackStart()));
-  }
-
-  void TearDown() override { stack_.reset(); }
-
-  Stack* GetStack() const { return stack_.get(); }
-
- private:
-  std::unique_ptr<Stack> stack_;
-};
-
-}  // namespace
-
-TEST_F(GCStackTest, IsOnStackForStackValue) {
-  void* dummy;
-  EXPECT_TRUE(GetStack()->IsOnStack(&dummy));
-}
-
-TEST_F(GCStackTest, IsOnStackForHeapValue) {
-  auto dummy = std::make_unique<int>();
-  EXPECT_FALSE(GetStack()->IsOnStack(dummy.get()));
-}
-
-#ifdef CPPGC_SUPPORTS_CONSERVATIVE_STACK_SCAN
-
-namespace {
-
-class StackScanner final : public StackVisitor {
- public:
-  struct Container {
-    std::unique_ptr<int> value;
-  };
-
-  StackScanner() : container_(new Container{}) {
-    container_->value = std::make_unique<int>();
-  }
-
-  void VisitPointer(const void* address) final {
-    if (address == container_->value.get()) found_ = true;
-  }
-
-  void Reset() { found_ = false; }
-  bool found() const { return found_; }
-  int* needle() const { return container_->value.get(); }
-
- private:
-  std::unique_ptr<Container> container_;
-  bool found_ = false;
-};
-
-}  // namespace
-
-TEST_F(GCStackTest, IteratePointersFindsOnStackValue) {
-  auto scanner = std::make_unique<StackScanner>();
-
-  // No check that the needle is initially not found as on some platforms it
-  // may be part of the redzone or temporaries after setting it up throuhg
-  // StackScanner.
-  {
-    int* volatile tmp = scanner->needle();
-    USE(tmp);
-    GetStack()->IteratePointers(scanner.get());
-    EXPECT_TRUE(scanner->found());
-  }
-}
-
-TEST_F(GCStackTest, IteratePointersFindsOnStackValuePotentiallyUnaligned) {
-  auto scanner = std::make_unique<StackScanner>();
-
-  // No check that the needle is initially not found as on some platforms it
-  // may be part of the redzone or temporaries after setting it up throuhg
-  // StackScanner.
-  {
-    char a = 'c';
-    USE(a);
-    int* volatile tmp = scanner->needle();
-    USE(tmp);
-    GetStack()->IteratePointers(scanner.get());
-    EXPECT_TRUE(scanner->found());
-  }
-}
-
-namespace {
-
-void RecursivelyPassOnParameter(int* volatile p1, int* volatile p2,
-                                int* volatile p3, int* volatile p4,
-                                int* volatile p5, int* volatile p6,
-                                int* volatile p7, int* volatile p8,
-                                Stack* stack, StackVisitor* visitor) {
-  if (p1) {
-    RecursivelyPassOnParameter(nullptr, p1, nullptr, nullptr, nullptr, nullptr,
-                               nullptr, nullptr, stack, visitor);
-  } else if (p2) {
-    RecursivelyPassOnParameter(nullptr, nullptr, p2, nullptr, nullptr, nullptr,
-                               nullptr, nullptr, stack, visitor);
-  } else if (p3) {
-    RecursivelyPassOnParameter(nullptr, nullptr, nullptr, p3, nullptr, nullptr,
-                               nullptr, nullptr, stack, visitor);
-  } else if (p4) {
-    RecursivelyPassOnParameter(nullptr, nullptr, nullptr, nullptr, p4, nullptr,
-                               nullptr, nullptr, stack, visitor);
-  } else if (p5) {
-    RecursivelyPassOnParameter(nullptr, nullptr, nullptr, nullptr, nullptr, p5,
-                               nullptr, nullptr, stack, visitor);
-  } else if (p6) {
-    RecursivelyPassOnParameter(nullptr, nullptr, nullptr, nullptr, nullptr,
-                               nullptr, p6, nullptr, stack, visitor);
-  } else if (p7) {
-    RecursivelyPassOnParameter(nullptr, nullptr, nullptr, nullptr, nullptr,
-                               nullptr, nullptr, p7, stack, visitor);
-  } else if (p8) {
-    stack->IteratePointers(visitor);
-  }
-}
-
-}  // namespace
-
-TEST_F(GCStackTest, IteratePointersFindsParameter) {
-  auto scanner = std::make_unique<StackScanner>();
-  // No check that the needle is initially not found as on some platforms it
-  // may be part of the redzone or temporaries after setting it up throuhg
-  // StackScanner.
-  RecursivelyPassOnParameter(nullptr, nullptr, nullptr, nullptr, nullptr,
-                             nullptr, nullptr, scanner->needle(), GetStack(),
-                             scanner.get());
-  EXPECT_TRUE(scanner->found());
-}
-
-TEST_F(GCStackTest, IteratePointersFindsParameterInNestedFunction) {
-  auto scanner = std::make_unique<StackScanner>();
-  // No check that the needle is initially not found as on some platforms it
-  // may be part of the redzone or temporaries after setting it up throuhg
-  // StackScanner.
-  RecursivelyPassOnParameter(scanner->needle(), nullptr, nullptr, nullptr,
-                             nullptr, nullptr, nullptr, nullptr, GetStack(),
-                             scanner.get());
-  EXPECT_TRUE(scanner->found());
-}
-
-// The following test uses inline assembly and has been checked to work on clang
-// to verify that the stack-scanning trampoline pushes callee-saved registers.
-//
-// The test uses a macro loop as asm() can only be passed string literals.
-#ifdef __clang__
-#ifdef V8_TARGET_ARCH_X64
-#ifdef V8_OS_WIN
-
-// Excluded from test: rbp
-#define FOR_ALL_CALLEE_SAVED_REGS(V) \
-  V("rdi")                           \
-  V("rsi")                           \
-  V("rbx")                           \
-  V("r12")                           \
-  V("r13")                           \
-  V("r14")                           \
-  V("r15")
-
-#else  // !V8_OS_WIN
-
-// Excluded from test: rbp
-#define FOR_ALL_CALLEE_SAVED_REGS(V) \
-  V("rbx")                           \
-  V("r12")                           \
-  V("r13")                           \
-  V("r14")                           \
-  V("r15")
-
-#endif  // !V8_OS_WIN
-#endif  // V8_TARGET_ARCH_X64
-#endif  // __clang__
-
-#ifdef FOR_ALL_CALLEE_SAVED_REGS
-
-TEST_F(GCStackTest, IteratePointersFindsCalleeSavedRegisters) {
-  auto scanner = std::make_unique<StackScanner>();
-
-  // No check that the needle is initially not found as on some platforms it
-  // may be part of the redzone or temporaries after setting it up throuhg
-  // StackScanner.
-
-// First, clear all callee-saved registers.
-#define CLEAR_REGISTER(reg) asm("mov $0, %%" reg : : : reg);
-
-  FOR_ALL_CALLEE_SAVED_REGS(CLEAR_REGISTER)
-#undef CLEAR_REGISTER
-
-  // Keep local raw pointers to keep instruction sequences small below.
-  auto* local_stack = GetStack();
-  auto* local_scanner = scanner.get();
-
-// Moves |local_scanner->needle()| into a callee-saved register, leaving the
-// callee-saved register as the only register referencing the needle.
-// (Ignoring implementation-dependent dirty registers/stack.)
-#define KEEP_ALIVE_FROM_CALLEE_SAVED(reg)                                \
-  local_scanner->Reset();                                                \
-  /* This moves the temporary into the calee-saved register. */          \
-  asm("mov %0, %%" reg : : "r"(local_scanner->needle()) : reg);          \
-  /* Register is unprotected from here till the actual invocation. */    \
-  local_stack->IteratePointers(local_scanner);                           \
-  EXPECT_TRUE(local_scanner->found())                                    \
-      << "pointer in callee-saved register not found. register: " << reg \
-      << std::endl;                                                      \
-  /* Clear out the register again */                                     \
-  asm("mov $0, %%" reg : : : reg);
-
-  FOR_ALL_CALLEE_SAVED_REGS(KEEP_ALIVE_FROM_CALLEE_SAVED)
-#undef KEEP_ALIVE_FROM_CALLEE_SAVED
-#undef FOR_ALL_CALLEE_SAVED_REGS
-}
-#endif  // FOR_ALL_CALLEE_SAVED_REGS
-
-#if V8_OS_LINUX && (V8_HOST_ARCH_IA32 || V8_HOST_ARCH_X64)
-class CheckStackAlignmentVisitor final : public StackVisitor {
- public:
-  void VisitPointer(const void*) final {
-    float f[4] = {0.};
-    volatile auto xmm = ::_mm_load_ps(f);
-    USE(xmm);
-  }
-};
-
-TEST_F(GCStackTest, StackAlignment) {
-  auto checker = std::make_unique<CheckStackAlignmentVisitor>();
-  GetStack()->IteratePointers(checker.get());
-}
-#endif  // V8_OS_LINUX && (V8_HOST_ARCH_IA32 || V8_HOST_ARCH_X64)
-
-#endif  // CPPGC_SUPPORTS_CONSERVATIVE_STACK_SCAN
-
-}  // namespace internal
-}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/sweeper-unittest.cc b/deps/v8/test/unittests/heap/cppgc/sweeper-unittest.cc
new file mode 100644
index 00000000000..6a6ad054f39
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/sweeper-unittest.cc
@@ -0,0 +1,269 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/sweeper.h"
+
+#include <algorithm>
+
+#include "include/cppgc/allocation.h"
+#include "include/cppgc/persistent.h"
+#include "src/heap/cppgc/globals.h"
+#include "src/heap/cppgc/heap-object-header-inl.h"
+#include "src/heap/cppgc/heap-object-header.h"
+#include "src/heap/cppgc/heap-page.h"
+#include "src/heap/cppgc/heap-visitor.h"
+#include "src/heap/cppgc/heap.h"
+#include "src/heap/cppgc/page-memory-inl.h"
+#include "src/heap/cppgc/page-memory.h"
+#include "test/unittests/heap/cppgc/tests.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+class ResetLocalAllocationBufferVisitor final
+    : public HeapVisitor<ResetLocalAllocationBufferVisitor> {
+ public:
+  bool VisitLargePageSpace(LargePageSpace*) { return true; }
+  bool VisitNormalPageSpace(NormalPageSpace* space) {
+    space->ResetLinearAllocationBuffer();
+    return true;
+  }
+};
+
+void ResetLocalAllocationBuffers(Heap* heap) {
+  ResetLocalAllocationBufferVisitor visitor;
+  visitor.Traverse(&heap->raw_heap());
+}
+
+size_t g_destructor_callcount;
+
+template <size_t Size>
+class GCed : public GarbageCollected<GCed<Size>> {
+ public:
+  virtual ~GCed() { ++g_destructor_callcount; }
+
+  virtual void Trace(cppgc::Visitor*) const {}
+
+ private:
+  char array[Size];
+};
+
+class SweeperTest : public testing::TestWithHeap {
+ public:
+  SweeperTest() { g_destructor_callcount = 0; }
+
+  void Sweep() {
+    Heap* heap = Heap::From(GetHeap());
+    ResetLocalAllocationBuffers(heap);
+    Sweeper& sweeper = heap->sweeper();
+    sweeper.Start(Sweeper::Config::kAtomic);
+    sweeper.Finish();
+  }
+
+  void MarkObject(void* payload) {
+    HeapObjectHeader& header = HeapObjectHeader::FromPayload(payload);
+    header.TryMarkAtomic();
+  }
+
+  PageBackend* GetBackend() { return Heap::From(GetHeap())->page_backend(); }
+};
+
+}  // namespace
+
+TEST_F(SweeperTest, SweepUnmarkedNormalObject) {
+  constexpr size_t kObjectSize = 8;
+  using Type = GCed<kObjectSize>;
+
+  MakeGarbageCollected<Type>(GetHeap());
+
+  EXPECT_EQ(0u, g_destructor_callcount);
+
+  Sweep();
+
+  EXPECT_EQ(1u, g_destructor_callcount);
+}
+
+TEST_F(SweeperTest, DontSweepMarkedNormalObject) {
+  constexpr size_t kObjectSize = 8;
+  using Type = GCed<kObjectSize>;
+
+  auto* object = MakeGarbageCollected<Type>(GetHeap());
+  MarkObject(object);
+  BasePage* page = BasePage::FromPayload(object);
+  BaseSpace* space = page->space();
+
+  EXPECT_EQ(0u, g_destructor_callcount);
+
+  Sweep();
+
+  EXPECT_EQ(0u, g_destructor_callcount);
+  // Check that page is returned back to the space.
+  EXPECT_NE(space->end(), std::find(space->begin(), space->end(), page));
+  EXPECT_NE(nullptr, GetBackend()->Lookup(reinterpret_cast<Address>(object)));
+}
+
+TEST_F(SweeperTest, SweepUnmarkedLargeObject) {
+  constexpr size_t kObjectSize = kLargeObjectSizeThreshold * 2;
+  using Type = GCed<kObjectSize>;
+
+  auto* object = MakeGarbageCollected<Type>(GetHeap());
+  BasePage* page = BasePage::FromPayload(object);
+  BaseSpace* space = page->space();
+
+  EXPECT_EQ(0u, g_destructor_callcount);
+
+  Sweep();
+
+  EXPECT_EQ(1u, g_destructor_callcount);
+  // Check that page is gone.
+  EXPECT_EQ(space->end(), std::find(space->begin(), space->end(), page));
+  EXPECT_EQ(nullptr, GetBackend()->Lookup(reinterpret_cast<Address>(object)));
+}
+
+TEST_F(SweeperTest, DontSweepMarkedLargeObject) {
+  constexpr size_t kObjectSize = kLargeObjectSizeThreshold * 2;
+  using Type = GCed<kObjectSize>;
+
+  auto* object = MakeGarbageCollected<Type>(GetHeap());
+  MarkObject(object);
+  BasePage* page = BasePage::FromPayload(object);
+  BaseSpace* space = page->space();
+
+  EXPECT_EQ(0u, g_destructor_callcount);
+
+  Sweep();
+
+  EXPECT_EQ(0u, g_destructor_callcount);
+  // Check that page is returned back to the space.
+  EXPECT_NE(space->end(), std::find(space->begin(), space->end(), page));
+  EXPECT_NE(nullptr, GetBackend()->Lookup(reinterpret_cast<Address>(object)));
+}
+
+TEST_F(SweeperTest, SweepMultipleObjectsOnPage) {
+  constexpr size_t kObjectSize = 8;
+  using Type = GCed<kObjectSize>;
+  const size_t kNumberOfObjects =
+      NormalPage::PayloadSize() / (sizeof(Type) + sizeof(HeapObjectHeader));
+
+  for (size_t i = 0; i < kNumberOfObjects; ++i) {
+    MakeGarbageCollected<Type>(GetHeap());
+  }
+
+  EXPECT_EQ(0u, g_destructor_callcount);
+
+  Sweep();
+
+  EXPECT_EQ(kNumberOfObjects, g_destructor_callcount);
+}
+
+TEST_F(SweeperTest, SweepObjectsOnAllArenas) {
+  MakeGarbageCollected<GCed<1>>(GetHeap());
+  MakeGarbageCollected<GCed<32>>(GetHeap());
+  MakeGarbageCollected<GCed<64>>(GetHeap());
+  MakeGarbageCollected<GCed<128>>(GetHeap());
+  MakeGarbageCollected<GCed<2 * kLargeObjectSizeThreshold>>(GetHeap());
+
+  EXPECT_EQ(0u, g_destructor_callcount);
+
+  Sweep();
+
+  EXPECT_EQ(5u, g_destructor_callcount);
+}
+
+TEST_F(SweeperTest, SweepMultiplePagesInSingleSpace) {
+  MakeGarbageCollected<GCed<2 * kLargeObjectSizeThreshold>>(GetHeap());
+  MakeGarbageCollected<GCed<2 * kLargeObjectSizeThreshold>>(GetHeap());
+  MakeGarbageCollected<GCed<2 * kLargeObjectSizeThreshold>>(GetHeap());
+
+  EXPECT_EQ(0u, g_destructor_callcount);
+
+  Sweep();
+
+  EXPECT_EQ(3u, g_destructor_callcount);
+}
+
+TEST_F(SweeperTest, CoalesceFreeListEntries) {
+  constexpr size_t kObjectSize = 32;
+  using Type = GCed<kObjectSize>;
+
+  auto* object1 = MakeGarbageCollected<Type>(GetHeap());
+  auto* object2 = MakeGarbageCollected<Type>(GetHeap());
+  auto* object3 = MakeGarbageCollected<Type>(GetHeap());
+  auto* object4 = MakeGarbageCollected<Type>(GetHeap());
+
+  MarkObject(object1);
+  MarkObject(object4);
+
+  Address object2_start =
+      reinterpret_cast<Address>(&HeapObjectHeader::FromPayload(object2));
+  Address object3_end =
+      reinterpret_cast<Address>(&HeapObjectHeader::FromPayload(object3)) +
+      HeapObjectHeader::FromPayload(object3).GetSize();
+
+  const BasePage* page = BasePage::FromPayload(object2);
+  const FreeList& freelist = NormalPageSpace::From(page->space())->free_list();
+
+  const FreeList::Block coalesced_block = {object2_start,
+                                           object3_end - object2_start};
+
+  EXPECT_EQ(0u, g_destructor_callcount);
+  EXPECT_FALSE(freelist.Contains(coalesced_block));
+
+  Sweep();
+
+  EXPECT_EQ(2u, g_destructor_callcount);
+  EXPECT_TRUE(freelist.Contains(coalesced_block));
+}
+
+namespace {
+
+class GCInDestructor final : public GarbageCollected<GCInDestructor> {
+ public:
+  explicit GCInDestructor(Heap* heap) : heap_(heap) {}
+  ~GCInDestructor() {
+    // Instead of directly calling GC, allocations should be supported here as
+    // well.
+    heap_->CollectGarbage(internal::Heap::GCConfig::Default());
+  }
+  void Trace(Visitor*) const {}
+
+ private:
+  Heap* heap_;
+};
+
+}  // namespace
+
+TEST_F(SweeperTest, SweepDoesNotTriggerRecursiveGC) {
+  auto* internal_heap = internal::Heap::From(GetHeap());
+  size_t saved_epoch = internal_heap->epoch();
+  MakeGarbageCollected<GCInDestructor>(GetHeap(), internal_heap);
+  PreciseGC();
+  EXPECT_EQ(saved_epoch + 1, internal_heap->epoch());
+}
+
+TEST_F(SweeperTest, UnmarkObjects) {
+  auto* normal_object = MakeGarbageCollected<GCed<32>>(GetHeap());
+  auto* large_object =
+      MakeGarbageCollected<GCed<kLargeObjectSizeThreshold * 2>>(GetHeap());
+
+  auto& normal_object_header = HeapObjectHeader::FromPayload(normal_object);
+  auto& large_object_header = HeapObjectHeader::FromPayload(large_object);
+
+  normal_object_header.TryMarkAtomic();
+  large_object_header.TryMarkAtomic();
+
+  EXPECT_TRUE(normal_object_header.IsMarked());
+  EXPECT_TRUE(large_object_header.IsMarked());
+
+  Sweep();
+
+  EXPECT_FALSE(normal_object_header.IsMarked());
+  EXPECT_FALSE(large_object_header.IsMarked());
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/test-platform.cc b/deps/v8/test/unittests/heap/cppgc/test-platform.cc
new file mode 100644
index 00000000000..140e9c1589a
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/test-platform.cc
@@ -0,0 +1,125 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "test/unittests/heap/cppgc/test-platform.h"
+
+#include "src/base/platform/platform.h"
+#include "src/base/platform/time.h"
+
+namespace cppgc {
+namespace internal {
+namespace testing {
+
+void TestTaskRunner::PostTask(std::unique_ptr<v8::Task> task) {
+  tasks_.push_back(std::move(task));
+}
+
+void TestTaskRunner::PostNonNestableTask(std::unique_ptr<v8::Task> task) {
+  PostTask(std::move(task));
+}
+
+void TestTaskRunner::PostDelayedTask(std::unique_ptr<v8::Task> task, double) {
+  PostTask(std::move(task));
+}
+
+void TestTaskRunner::PostNonNestableDelayedTask(std::unique_ptr<v8::Task> task,
+                                                double) {
+  PostTask(std::move(task));
+}
+
+void TestTaskRunner::PostIdleTask(std::unique_ptr<v8::IdleTask> task) {
+  idle_tasks_.push_back(std::move(task));
+}
+
+bool TestTaskRunner::RunSingleTask() {
+  if (!tasks_.size()) return false;
+
+  tasks_.back()->Run();
+  tasks_.pop_back();
+
+  return true;
+}
+
+bool TestTaskRunner::RunSingleIdleTask(double deadline_in_seconds) {
+  if (!idle_tasks_.size()) return false;
+
+  idle_tasks_.back()->Run(deadline_in_seconds);
+  idle_tasks_.pop_back();
+
+  return true;
+}
+
+void TestTaskRunner::RunUntilIdle() {
+  for (auto& task : tasks_) {
+    task->Run();
+  }
+  tasks_.clear();
+
+  for (auto& task : idle_tasks_) {
+    task->Run(std::numeric_limits<double>::infinity());
+  }
+  idle_tasks_.clear();
+}
+
+class TestPlatform::TestJobHandle : public v8::JobHandle {
+ public:
+  explicit TestJobHandle(const std::shared_ptr<JobThread>& thread)
+      : thread_(thread) {
+    const bool success = thread_->Start();
+    USE(success);
+  }
+
+  void NotifyConcurrencyIncrease() override {}
+  void Join() override { thread_->Join(); }
+  void Cancel() override { Join(); }
+  bool IsRunning() override { return true; }
+
+ private:
+  std::shared_ptr<JobThread> thread_;
+};
+
+TestPlatform::TestPlatform()
+    : foreground_task_runner_(std::make_unique<TestTaskRunner>()) {}
+
+TestPlatform::~TestPlatform() V8_NOEXCEPT { WaitAllBackgroundTasks(); }
+
+std::unique_ptr<v8::JobHandle> TestPlatform::PostJob(
+    v8::TaskPriority, std::unique_ptr<v8::JobTask> job_task) {
+  if (AreBackgroundTasksDisabled()) return {};
+
+  auto thread = std::make_shared<JobThread>(std::move(job_task));
+  job_threads_.push_back(thread);
+  return std::make_unique<TestJobHandle>(std::move(thread));
+}
+
+double TestPlatform::MonotonicallyIncreasingTime() {
+  return v8::base::TimeTicks::HighResolutionNow().ToInternalValue() /
+         static_cast<double>(v8::base::Time::kMicrosecondsPerSecond);
+}
+
+void TestPlatform::WaitAllForegroundTasks() {
+  foreground_task_runner_->RunUntilIdle();
+}
+
+void TestPlatform::WaitAllBackgroundTasks() {
+  for (auto& thread : job_threads_) {
+    thread->Join();
+  }
+  job_threads_.clear();
+}
+
+TestPlatform::DisableBackgroundTasksScope::DisableBackgroundTasksScope(
+    TestPlatform* platform)
+    : platform_(platform) {
+  ++platform_->disabled_background_tasks_;
+}
+
+TestPlatform::DisableBackgroundTasksScope::~DisableBackgroundTasksScope()
+    V8_NOEXCEPT {
+  --platform_->disabled_background_tasks_;
+}
+
+}  // namespace testing
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/test-platform.h b/deps/v8/test/unittests/heap/cppgc/test-platform.h
new file mode 100644
index 00000000000..474afaed0f2
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/test-platform.h
@@ -0,0 +1,117 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_UNITTESTS_HEAP_CPPGC_TEST_PLATFORM_H_
+#define V8_UNITTESTS_HEAP_CPPGC_TEST_PLATFORM_H_
+
+#include <memory>
+#include <vector>
+
+#include "include/cppgc/platform.h"
+#include "src/base/page-allocator.h"
+#include "src/base/platform/platform.h"
+
+namespace cppgc {
+namespace internal {
+namespace testing {
+
+class TestTaskRunner : public v8::TaskRunner {
+ public:
+  void PostTask(std::unique_ptr<v8::Task> task) override;
+  void PostNonNestableTask(std::unique_ptr<v8::Task> task) override;
+  void PostDelayedTask(std::unique_ptr<v8::Task> task, double) override;
+  void PostNonNestableDelayedTask(std::unique_ptr<v8::Task> task,
+                                  double) override;
+
+  void PostIdleTask(std::unique_ptr<v8::IdleTask> task) override;
+  bool IdleTasksEnabled() override { return true; }
+
+  bool RunSingleTask();
+  bool RunSingleIdleTask(double duration_in_seconds);
+
+  void RunUntilIdle();
+
+ private:
+  std::vector<std::unique_ptr<v8::Task>> tasks_;
+  std::vector<std::unique_ptr<v8::IdleTask>> idle_tasks_;
+};
+
+class TestPlatform : public Platform {
+ public:
+  class DisableBackgroundTasksScope {
+   public:
+    explicit DisableBackgroundTasksScope(TestPlatform*);
+    ~DisableBackgroundTasksScope() V8_NOEXCEPT;
+
+   private:
+    TestPlatform* platform_;
+  };
+
+  TestPlatform();
+  ~TestPlatform() V8_NOEXCEPT override;
+
+  PageAllocator* GetPageAllocator() override { return &page_allocator_; }
+
+  std::shared_ptr<v8::TaskRunner> GetForegroundTaskRunner() override {
+    return foreground_task_runner_;
+  }
+
+  std::unique_ptr<v8::JobHandle> PostJob(
+      v8::TaskPriority, std::unique_ptr<v8::JobTask> job_task) override;
+
+  double MonotonicallyIncreasingTime() override;
+
+  void WaitAllForegroundTasks();
+  void WaitAllBackgroundTasks();
+
+ private:
+  class TestJobHandle;
+
+  class WorkerThread : public v8::base::Thread {
+   public:
+    explicit WorkerThread(std::unique_ptr<v8::Task> task)
+        : Thread(Options("worker")), task_(std::move(task)) {}
+
+    void Run() override {
+      if (task_) std::move(task_)->Run();
+    }
+
+   private:
+    std::unique_ptr<v8::Task> task_;
+  };
+
+  class JobThread : public v8::base::Thread {
+   public:
+    explicit JobThread(std::unique_ptr<v8::JobTask> task)
+        : Thread(Options("job")), task_(std::move(task)) {}
+
+    void Run() override {
+      class JobDelegate : public v8::JobDelegate {
+       public:
+        bool ShouldYield() override { return false; }
+        void NotifyConcurrencyIncrease() override {}
+      } delegate;
+
+      if (task_) task_->Run(&delegate);
+    }
+
+   private:
+    std::unique_ptr<v8::JobTask> task_;
+  };
+
+  bool AreBackgroundTasksDisabled() const {
+    return disabled_background_tasks_ > 0;
+  }
+
+  v8::base::PageAllocator page_allocator_;
+  std::shared_ptr<TestTaskRunner> foreground_task_runner_;
+  std::vector<std::shared_ptr<JobThread>> job_threads_;
+  size_t disabled_background_tasks_ = 0;
+};
+
+}  // namespace testing
+}  // namespace internal
+}  // namespace cppgc
+
+#endif  // V8_UNITTESTS_HEAP_CPPGC_TEST_PLATFORM_H_
diff --git a/deps/v8/test/unittests/heap/cppgc/tests.cc b/deps/v8/test/unittests/heap/cppgc/tests.cc
index e67ac730d6f..b03ea19be64 100644
--- a/deps/v8/test/unittests/heap/cppgc/tests.cc
+++ b/deps/v8/test/unittests/heap/cppgc/tests.cc
@@ -4,33 +4,34 @@
 
 #include "test/unittests/heap/cppgc/tests.h"
 
+#include <memory>
+
+#include "test/unittests/heap/cppgc/test-platform.h"
+
 namespace cppgc {
+namespace internal {
 namespace testing {
 
 // static
-std::unique_ptr<cppgc::PageAllocator> TestWithPlatform::page_allocator_;
+std::shared_ptr<TestPlatform> TestWithPlatform::platform_;
 
 // static
 void TestWithPlatform::SetUpTestSuite() {
-  page_allocator_.reset(new v8::base::PageAllocator());
-  cppgc::InitializePlatform(page_allocator_.get());
+  platform_ = std::make_unique<TestPlatform>();
+  cppgc::InitializeProcess(platform_->GetPageAllocator());
 }
 
 // static
 void TestWithPlatform::TearDownTestSuite() {
-  cppgc::ShutdownPlatform();
-  page_allocator_.reset();
+  cppgc::ShutdownProcess();
+  platform_.reset();
 }
 
-void TestWithHeap::SetUp() {
-  heap_ = Heap::Create();
-  TestWithPlatform::SetUp();
-}
+TestWithHeap::TestWithHeap() : heap_(Heap::Create(platform_)) {}
 
-void TestWithHeap::TearDown() {
-  heap_.reset();
-  TestWithPlatform::TearDown();
-}
+TestSupportingAllocationOnly::TestSupportingAllocationOnly()
+    : no_gc_scope_(internal::Heap::From(GetHeap())) {}
 
 }  // namespace testing
+}  // namespace internal
 }  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/tests.h b/deps/v8/test/unittests/heap/cppgc/tests.h
index d21f2564442..12946461a00 100644
--- a/deps/v8/test/unittests/heap/cppgc/tests.h
+++ b/deps/v8/test/unittests/heap/cppgc/tests.h
@@ -7,10 +7,12 @@
 
 #include "include/cppgc/heap.h"
 #include "include/cppgc/platform.h"
-#include "src/base/page-allocator.h"
+#include "src/heap/cppgc/heap.h"
+#include "test/unittests/heap/cppgc/test-platform.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace cppgc {
+namespace internal {
 namespace testing {
 
 class TestWithPlatform : public ::testing::Test {
@@ -18,22 +20,41 @@ class TestWithPlatform : public ::testing::Test {
   static void SetUpTestSuite();
   static void TearDownTestSuite();
 
- private:
-  static std::unique_ptr<cppgc::PageAllocator> page_allocator_;
+  TestPlatform& GetPlatform() const { return *platform_; }
+
+ protected:
+  static std::shared_ptr<TestPlatform> platform_;
 };
 
 class TestWithHeap : public TestWithPlatform {
  protected:
-  void SetUp() override;
-  void TearDown() override;
+  TestWithHeap();
 
-  Heap* GetHeap() const { return heap_.get(); }
+  void PreciseGC() {
+    heap_->ForceGarbageCollectionSlow(
+        "TestWithHeap", "Testing", Heap::GCConfig::StackState::kNoHeapPointers);
+  }
+
+  cppgc::Heap* GetHeap() const { return heap_.get(); }
 
  private:
   std::unique_ptr<cppgc::Heap> heap_;
 };
 
+// Restrictive test fixture that supports allocation but will make sure no
+// garbage collection is triggered. This is useful for writing idiomatic
+// tests where object are allocated on the managed heap while still avoiding
+// far reaching test consquences of full garbage collection calls.
+class TestSupportingAllocationOnly : public TestWithHeap {
+ protected:
+  TestSupportingAllocationOnly();
+
+ private:
+  Heap::NoGCScope no_gc_scope_;
+};
+
 }  // namespace testing
+}  // namespace internal
 }  // namespace cppgc
 
 #endif  // V8_UNITTESTS_HEAP_CPPGC_TESTS_H_
diff --git a/deps/v8/test/unittests/heap/cppgc/visitor-unittest.cc b/deps/v8/test/unittests/heap/cppgc/visitor-unittest.cc
new file mode 100644
index 00000000000..ae100cb156a
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/visitor-unittest.cc
@@ -0,0 +1,261 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/visitor.h"
+
+#include "include/cppgc/allocation.h"
+#include "include/cppgc/garbage-collected.h"
+#include "include/cppgc/trace-trait.h"
+#include "src/base/macros.h"
+#include "src/heap/cppgc/heap.h"
+#include "test/unittests/heap/cppgc/tests.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cppgc {
+namespace internal {
+
+namespace {
+
+class TraceTraitTest : public testing::TestSupportingAllocationOnly {};
+class VisitorTest : public testing::TestSupportingAllocationOnly {};
+
+class GCed : public GarbageCollected<GCed> {
+ public:
+  static size_t trace_callcount;
+
+  GCed() { trace_callcount = 0; }
+
+  virtual void Trace(cppgc::Visitor* visitor) const { trace_callcount++; }
+};
+
+size_t GCed::trace_callcount;
+
+class GCedMixin : public GarbageCollectedMixin {};
+
+class OtherPayload {
+ public:
+  virtual void* GetDummy() const { return nullptr; }
+};
+
+class GCedMixinApplication : public GCed,
+                             public OtherPayload,
+                             public GCedMixin {
+  USING_GARBAGE_COLLECTED_MIXIN();
+
+ public:
+  void Trace(cppgc::Visitor* visitor) const override {
+    GCed::Trace(visitor);
+    GCedMixin::Trace(visitor);
+  }
+};
+
+}  // namespace
+
+TEST_F(TraceTraitTest, GetObjectStartGCed) {
+  auto* gced = MakeGarbageCollected<GCed>(GetHeap());
+  EXPECT_EQ(gced,
+            TraceTrait<GCed>::GetTraceDescriptor(gced).base_object_payload);
+}
+
+TEST_F(TraceTraitTest, GetObjectStartGCedMixin) {
+  auto* gced_mixin_app = MakeGarbageCollected<GCedMixinApplication>(GetHeap());
+  auto* gced_mixin = static_cast<GCedMixin*>(gced_mixin_app);
+  EXPECT_EQ(gced_mixin_app,
+            TraceTrait<GCedMixin>::GetTraceDescriptor(gced_mixin)
+                .base_object_payload);
+}
+
+TEST_F(TraceTraitTest, TraceGCed) {
+  auto* gced = MakeGarbageCollected<GCed>(GetHeap());
+  EXPECT_EQ(0u, GCed::trace_callcount);
+  TraceTrait<GCed>::Trace(nullptr, gced);
+  EXPECT_EQ(1u, GCed::trace_callcount);
+}
+
+TEST_F(TraceTraitTest, TraceGCedMixin) {
+  auto* gced_mixin_app = MakeGarbageCollected<GCedMixinApplication>(GetHeap());
+  auto* gced_mixin = static_cast<GCedMixin*>(gced_mixin_app);
+  EXPECT_EQ(0u, GCed::trace_callcount);
+  TraceTrait<GCedMixin>::Trace(nullptr, gced_mixin);
+  EXPECT_EQ(1u, GCed::trace_callcount);
+}
+
+TEST_F(TraceTraitTest, TraceGCedThroughTraceDescriptor) {
+  auto* gced = MakeGarbageCollected<GCed>(GetHeap());
+  EXPECT_EQ(0u, GCed::trace_callcount);
+  TraceDescriptor desc = TraceTrait<GCed>::GetTraceDescriptor(gced);
+  desc.callback(nullptr, desc.base_object_payload);
+  EXPECT_EQ(1u, GCed::trace_callcount);
+}
+
+TEST_F(TraceTraitTest, TraceGCedMixinThroughTraceDescriptor) {
+  auto* gced_mixin_app = MakeGarbageCollected<GCedMixinApplication>(GetHeap());
+  auto* gced_mixin = static_cast<GCedMixin*>(gced_mixin_app);
+  EXPECT_EQ(0u, GCed::trace_callcount);
+  TraceDescriptor desc = TraceTrait<GCedMixin>::GetTraceDescriptor(gced_mixin);
+  desc.callback(nullptr, desc.base_object_payload);
+  EXPECT_EQ(1u, GCed::trace_callcount);
+}
+
+namespace {
+
+class DispatchingVisitor final : public VisitorBase {
+ public:
+  DispatchingVisitor(const void* object, const void* payload)
+      : object_(object), payload_(payload) {}
+
+ protected:
+  void Visit(const void* t, TraceDescriptor desc) final {
+    EXPECT_EQ(object_, t);
+    EXPECT_EQ(payload_, desc.base_object_payload);
+    desc.callback(this, desc.base_object_payload);
+  }
+
+  void VisitWeak(const void* t, TraceDescriptor desc, WeakCallback callback,
+                 const void* weak_member) final {
+    EXPECT_EQ(object_, t);
+    EXPECT_EQ(payload_, desc.base_object_payload);
+    LivenessBroker broker = LivenessBrokerFactory::Create();
+    callback(broker, weak_member);
+  }
+
+ private:
+  const void* object_;
+  const void* payload_;
+};
+
+}  // namespace
+
+TEST_F(VisitorTest, DispatchTraceGCed) {
+  Member<GCed> ref = MakeGarbageCollected<GCed>(GetHeap());
+  DispatchingVisitor visitor(ref, ref);
+  EXPECT_EQ(0u, GCed::trace_callcount);
+  visitor.Trace(ref);
+  EXPECT_EQ(1u, GCed::trace_callcount);
+}
+
+TEST_F(VisitorTest, DispatchTraceGCedMixin) {
+  auto* gced_mixin_app = MakeGarbageCollected<GCedMixinApplication>(GetHeap());
+  auto* gced_mixin = static_cast<GCedMixin*>(gced_mixin_app);
+  // Ensure that we indeed test dispatching an inner object.
+  EXPECT_NE(static_cast<void*>(gced_mixin_app), static_cast<void*>(gced_mixin));
+  Member<GCedMixin> ref = gced_mixin;
+  DispatchingVisitor visitor(gced_mixin, gced_mixin_app);
+  EXPECT_EQ(0u, GCed::trace_callcount);
+  visitor.Trace(ref);
+  EXPECT_EQ(1u, GCed::trace_callcount);
+}
+
+TEST_F(VisitorTest, DispatchTraceWeakGCed) {
+  WeakMember<GCed> ref = MakeGarbageCollected<GCed>(GetHeap());
+  DispatchingVisitor visitor(ref, ref);
+  visitor.Trace(ref);
+  // No marking, so reference should be cleared.
+  EXPECT_EQ(nullptr, ref.Get());
+}
+
+TEST_F(VisitorTest, DispatchTraceWeakGCedMixin) {
+  auto* gced_mixin_app = MakeGarbageCollected<GCedMixinApplication>(GetHeap());
+  auto* gced_mixin = static_cast<GCedMixin*>(gced_mixin_app);
+  // Ensure that we indeed test dispatching an inner object.
+  EXPECT_NE(static_cast<void*>(gced_mixin_app), static_cast<void*>(gced_mixin));
+  WeakMember<GCedMixin> ref = gced_mixin;
+  DispatchingVisitor visitor(gced_mixin, gced_mixin_app);
+  visitor.Trace(ref);
+  // No marking, so reference should be cleared.
+  EXPECT_EQ(nullptr, ref.Get());
+}
+
+namespace {
+
+class WeakCallbackVisitor final : public VisitorBase {
+ public:
+  void RegisterWeakCallback(WeakCallback callback, const void* param) final {
+    LivenessBroker broker = LivenessBrokerFactory::Create();
+    callback(broker, param);
+  }
+};
+
+struct WeakCallbackDispatcher {
+  static size_t callback_callcount;
+  static const void* callback_param;
+
+  static void Setup(const void* expected_param) {
+    callback_callcount = 0;
+    callback_param = expected_param;
+  }
+
+  static void Call(const LivenessBroker& broker, const void* param) {
+    EXPECT_EQ(callback_param, param);
+    callback_callcount++;
+  }
+};
+
+size_t WeakCallbackDispatcher::callback_callcount;
+const void* WeakCallbackDispatcher::callback_param;
+
+class GCedWithCustomWeakCallback final
+    : public GarbageCollected<GCedWithCustomWeakCallback> {
+ public:
+  void CustomWeakCallbackMethod(const LivenessBroker& broker) {
+    WeakCallbackDispatcher::Call(broker, this);
+  }
+
+  void Trace(cppgc::Visitor* visitor) const {
+    visitor->RegisterWeakCallbackMethod<
+        GCedWithCustomWeakCallback,
+        &GCedWithCustomWeakCallback::CustomWeakCallbackMethod>(this);
+  }
+};
+
+}  // namespace
+
+TEST_F(VisitorTest, DispatchRegisterWeakCallback) {
+  WeakCallbackVisitor visitor;
+  WeakCallbackDispatcher::Setup(&visitor);
+  EXPECT_EQ(0u, WeakCallbackDispatcher::callback_callcount);
+  visitor.RegisterWeakCallback(WeakCallbackDispatcher::Call, &visitor);
+  EXPECT_EQ(1u, WeakCallbackDispatcher::callback_callcount);
+}
+
+TEST_F(VisitorTest, DispatchRegisterWeakCallbackMethod) {
+  WeakCallbackVisitor visitor;
+  auto* gced = MakeGarbageCollected<GCedWithCustomWeakCallback>(GetHeap());
+  WeakCallbackDispatcher::Setup(gced);
+  EXPECT_EQ(0u, WeakCallbackDispatcher::callback_callcount);
+  gced->Trace(&visitor);
+  EXPECT_EQ(1u, WeakCallbackDispatcher::callback_callcount);
+}
+
+namespace {
+
+class Composite final {
+ public:
+  static size_t callback_callcount;
+  Composite() { callback_callcount = 0; }
+  void Trace(Visitor* visitor) const { callback_callcount++; }
+};
+
+size_t Composite::callback_callcount;
+
+class GCedWithComposite final : public GarbageCollected<GCedWithComposite> {
+ public:
+  void Trace(Visitor* visitor) const { visitor->Trace(composite); }
+
+  Composite composite;
+};
+
+}  // namespace
+
+TEST_F(VisitorTest, DispatchToCompositeObject) {
+  Member<GCedWithComposite> ref =
+      MakeGarbageCollected<GCedWithComposite>(GetHeap());
+  DispatchingVisitor visitor(ref, ref);
+  EXPECT_EQ(0u, Composite::callback_callcount);
+  visitor.Trace(ref);
+  EXPECT_EQ(1u, Composite::callback_callcount);
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/cppgc/worklist-unittest.cc b/deps/v8/test/unittests/heap/cppgc/worklist-unittest.cc
new file mode 100644
index 00000000000..b9e88436666
--- /dev/null
+++ b/deps/v8/test/unittests/heap/cppgc/worklist-unittest.cc
@@ -0,0 +1,346 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/cppgc/worklist.h"
+
+#include "test/unittests/heap/cppgc/tests.h"
+
+namespace cppgc {
+namespace internal {
+
+class SomeObject {};
+
+using TestWorklist = Worklist<SomeObject*, 64>;
+
+TEST(CppgcWorkListTest, SegmentCreate) {
+  TestWorklist::Segment segment;
+  EXPECT_TRUE(segment.IsEmpty());
+  EXPECT_EQ(0u, segment.Size());
+  EXPECT_FALSE(segment.IsFull());
+}
+
+TEST(CppgcWorkListTest, SegmentPush) {
+  TestWorklist::Segment segment;
+  EXPECT_EQ(0u, segment.Size());
+  EXPECT_TRUE(segment.Push(nullptr));
+  EXPECT_EQ(1u, segment.Size());
+}
+
+TEST(CppgcWorkListTest, SegmentPushPop) {
+  TestWorklist::Segment segment;
+  EXPECT_TRUE(segment.Push(nullptr));
+  EXPECT_EQ(1u, segment.Size());
+  SomeObject dummy;
+  SomeObject* object = &dummy;
+  EXPECT_TRUE(segment.Pop(&object));
+  EXPECT_EQ(0u, segment.Size());
+  EXPECT_EQ(nullptr, object);
+}
+
+TEST(CppgcWorkListTest, SegmentIsEmpty) {
+  TestWorklist::Segment segment;
+  EXPECT_TRUE(segment.IsEmpty());
+  EXPECT_TRUE(segment.Push(nullptr));
+  EXPECT_FALSE(segment.IsEmpty());
+}
+
+TEST(CppgcWorkListTest, SegmentIsFull) {
+  TestWorklist::Segment segment;
+  EXPECT_FALSE(segment.IsFull());
+  for (size_t i = 0; i < TestWorklist::Segment::kCapacity; i++) {
+    EXPECT_TRUE(segment.Push(nullptr));
+  }
+  EXPECT_TRUE(segment.IsFull());
+}
+
+TEST(CppgcWorkListTest, SegmentClear) {
+  TestWorklist::Segment segment;
+  EXPECT_TRUE(segment.Push(nullptr));
+  EXPECT_FALSE(segment.IsEmpty());
+  segment.Clear();
+  EXPECT_TRUE(segment.IsEmpty());
+  for (size_t i = 0; i < TestWorklist::Segment::kCapacity; i++) {
+    EXPECT_TRUE(segment.Push(nullptr));
+  }
+}
+
+TEST(CppgcWorkListTest, SegmentFullPushFails) {
+  TestWorklist::Segment segment;
+  EXPECT_FALSE(segment.IsFull());
+  for (size_t i = 0; i < TestWorklist::Segment::kCapacity; i++) {
+    EXPECT_TRUE(segment.Push(nullptr));
+  }
+  EXPECT_TRUE(segment.IsFull());
+  EXPECT_FALSE(segment.Push(nullptr));
+}
+
+TEST(CppgcWorkListTest, SegmentEmptyPopFails) {
+  TestWorklist::Segment segment;
+  EXPECT_TRUE(segment.IsEmpty());
+  SomeObject* object;
+  EXPECT_FALSE(segment.Pop(&object));
+}
+
+TEST(CppgcWorkListTest, SegmentUpdateFalse) {
+  TestWorklist::Segment segment;
+  SomeObject* object;
+  object = reinterpret_cast<SomeObject*>(&object);
+  EXPECT_TRUE(segment.Push(object));
+  segment.Update([](SomeObject* object, SomeObject** out) { return false; });
+  EXPECT_TRUE(segment.IsEmpty());
+}
+
+TEST(CppgcWorkListTest, SegmentUpdate) {
+  TestWorklist::Segment segment;
+  SomeObject* objectA;
+  objectA = reinterpret_cast<SomeObject*>(&objectA);
+  SomeObject* objectB;
+  objectB = reinterpret_cast<SomeObject*>(&objectB);
+  EXPECT_TRUE(segment.Push(objectA));
+  segment.Update([objectB](SomeObject* object, SomeObject** out) {
+    *out = objectB;
+    return true;
+  });
+  SomeObject* object;
+  EXPECT_TRUE(segment.Pop(&object));
+  EXPECT_EQ(object, objectB);
+}
+
+TEST(CppgcWorkListTest, CreateEmpty) {
+  TestWorklist worklist;
+  TestWorklist::View worklist_view(&worklist, 0);
+  EXPECT_TRUE(worklist_view.IsLocalEmpty());
+  EXPECT_TRUE(worklist.IsEmpty());
+}
+
+TEST(CppgcWorkListTest, LocalPushPop) {
+  TestWorklist worklist;
+  TestWorklist::View worklist_view(&worklist, 0);
+  SomeObject dummy;
+  SomeObject* retrieved = nullptr;
+  EXPECT_TRUE(worklist_view.Push(&dummy));
+  EXPECT_FALSE(worklist_view.IsLocalEmpty());
+  EXPECT_TRUE(worklist_view.Pop(&retrieved));
+  EXPECT_EQ(&dummy, retrieved);
+}
+
+TEST(CppgcWorkListTest, LocalIsBasedOnId) {
+  TestWorklist worklist;
+  // Use the same id.
+  TestWorklist::View worklist_view1(&worklist, 0);
+  TestWorklist::View worklist_view2(&worklist, 0);
+  SomeObject dummy;
+  SomeObject* retrieved = nullptr;
+  EXPECT_TRUE(worklist_view1.Push(&dummy));
+  EXPECT_FALSE(worklist_view1.IsLocalEmpty());
+  EXPECT_FALSE(worklist_view2.IsLocalEmpty());
+  EXPECT_TRUE(worklist_view2.Pop(&retrieved));
+  EXPECT_EQ(&dummy, retrieved);
+  EXPECT_TRUE(worklist_view1.IsLocalEmpty());
+  EXPECT_TRUE(worklist_view2.IsLocalEmpty());
+}
+
+TEST(CppgcWorkListTest, LocalPushStaysPrivate) {
+  TestWorklist worklist;
+  TestWorklist::View worklist_view1(&worklist, 0);
+  TestWorklist::View worklist_view2(&worklist, 1);
+  SomeObject dummy;
+  SomeObject* retrieved = nullptr;
+  EXPECT_TRUE(worklist.IsEmpty());
+  EXPECT_EQ(0U, worklist.GlobalPoolSize());
+  EXPECT_TRUE(worklist_view1.Push(&dummy));
+  EXPECT_FALSE(worklist.IsEmpty());
+  EXPECT_EQ(0U, worklist.GlobalPoolSize());
+  EXPECT_FALSE(worklist_view2.Pop(&retrieved));
+  EXPECT_EQ(nullptr, retrieved);
+  EXPECT_TRUE(worklist_view1.Pop(&retrieved));
+  EXPECT_EQ(&dummy, retrieved);
+  EXPECT_TRUE(worklist.IsEmpty());
+  EXPECT_EQ(0U, worklist.GlobalPoolSize());
+}
+
+TEST(CppgcWorkListTest, GlobalUpdateNull) {
+  TestWorklist worklist;
+  TestWorklist::View worklist_view(&worklist, 0);
+  SomeObject* object;
+  object = reinterpret_cast<SomeObject*>(&object);
+  for (size_t i = 0; i < TestWorklist::kSegmentCapacity; i++) {
+    EXPECT_TRUE(worklist_view.Push(object));
+  }
+  EXPECT_TRUE(worklist_view.Push(object));
+  worklist.Update([](SomeObject* object, SomeObject** out) { return false; });
+  EXPECT_TRUE(worklist.IsEmpty());
+  EXPECT_EQ(0U, worklist.GlobalPoolSize());
+}
+
+TEST(CppgcWorkListTest, GlobalUpdate) {
+  TestWorklist worklist;
+  TestWorklist::View worklist_view(&worklist, 0);
+  SomeObject* objectA = nullptr;
+  objectA = reinterpret_cast<SomeObject*>(&objectA);
+  SomeObject* objectB = nullptr;
+  objectB = reinterpret_cast<SomeObject*>(&objectB);
+  SomeObject* objectC = nullptr;
+  objectC = reinterpret_cast<SomeObject*>(&objectC);
+  for (size_t i = 0; i < TestWorklist::kSegmentCapacity; i++) {
+    EXPECT_TRUE(worklist_view.Push(objectA));
+  }
+  for (size_t i = 0; i < TestWorklist::kSegmentCapacity; i++) {
+    EXPECT_TRUE(worklist_view.Push(objectB));
+  }
+  EXPECT_TRUE(worklist_view.Push(objectA));
+  worklist.Update([objectA, objectC](SomeObject* object, SomeObject** out) {
+    if (object != objectA) {
+      *out = objectC;
+      return true;
+    }
+    return false;
+  });
+  for (size_t i = 0; i < TestWorklist::kSegmentCapacity; i++) {
+    SomeObject* object;
+    EXPECT_TRUE(worklist_view.Pop(&object));
+    EXPECT_EQ(object, objectC);
+  }
+}
+
+TEST(CppgcWorkListTest, FlushToGlobalPushSegment) {
+  TestWorklist worklist;
+  TestWorklist::View worklist_view0(&worklist, 0);
+  TestWorklist::View worklist_view1(&worklist, 1);
+  SomeObject* object = nullptr;
+  SomeObject* objectA = nullptr;
+  objectA = reinterpret_cast<SomeObject*>(&objectA);
+  EXPECT_TRUE(worklist_view0.Push(objectA));
+  worklist.FlushToGlobal(0);
+  EXPECT_EQ(1U, worklist.GlobalPoolSize());
+  EXPECT_TRUE(worklist_view1.Pop(&object));
+}
+
+TEST(CppgcWorkListTest, FlushToGlobalPopSegment) {
+  TestWorklist worklist;
+  TestWorklist::View worklist_view0(&worklist, 0);
+  TestWorklist::View worklist_view1(&worklist, 1);
+  SomeObject* object = nullptr;
+  SomeObject* objectA = nullptr;
+  objectA = reinterpret_cast<SomeObject*>(&objectA);
+  EXPECT_TRUE(worklist_view0.Push(objectA));
+  EXPECT_TRUE(worklist_view0.Push(objectA));
+  EXPECT_TRUE(worklist_view0.Pop(&object));
+  worklist.FlushToGlobal(0);
+  EXPECT_EQ(1U, worklist.GlobalPoolSize());
+  EXPECT_TRUE(worklist_view1.Pop(&object));
+}
+
+TEST(CppgcWorkListTest, Clear) {
+  TestWorklist worklist;
+  TestWorklist::View worklist_view(&worklist, 0);
+  SomeObject* object;
+  object = reinterpret_cast<SomeObject*>(&object);
+  for (size_t i = 0; i < TestWorklist::kSegmentCapacity; i++) {
+    EXPECT_TRUE(worklist_view.Push(object));
+  }
+  EXPECT_TRUE(worklist_view.Push(object));
+  EXPECT_EQ(1U, worklist.GlobalPoolSize());
+  worklist.Clear();
+  EXPECT_TRUE(worklist.IsEmpty());
+  EXPECT_EQ(0U, worklist.GlobalPoolSize());
+}
+
+TEST(CppgcWorkListTest, SingleSegmentSteal) {
+  TestWorklist worklist;
+  TestWorklist::View worklist_view1(&worklist, 0);
+  TestWorklist::View worklist_view2(&worklist, 1);
+  SomeObject dummy;
+  for (size_t i = 0; i < TestWorklist::kSegmentCapacity; i++) {
+    EXPECT_TRUE(worklist_view1.Push(&dummy));
+  }
+  SomeObject* retrieved = nullptr;
+  // One more push/pop to publish the full segment.
+  EXPECT_TRUE(worklist_view1.Push(nullptr));
+  EXPECT_TRUE(worklist_view1.Pop(&retrieved));
+  EXPECT_EQ(nullptr, retrieved);
+  EXPECT_EQ(1U, worklist.GlobalPoolSize());
+  // Stealing.
+  for (size_t i = 0; i < TestWorklist::kSegmentCapacity; i++) {
+    EXPECT_TRUE(worklist_view2.Pop(&retrieved));
+    EXPECT_EQ(&dummy, retrieved);
+    EXPECT_FALSE(worklist_view1.Pop(&retrieved));
+  }
+  EXPECT_TRUE(worklist.IsEmpty());
+  EXPECT_EQ(0U, worklist.GlobalPoolSize());
+}
+
+TEST(CppgcWorkListTest, MultipleSegmentsStolen) {
+  TestWorklist worklist;
+  TestWorklist::View worklist_view1(&worklist, 0);
+  TestWorklist::View worklist_view2(&worklist, 1);
+  TestWorklist::View worklist_view3(&worklist, 2);
+  SomeObject dummy1;
+  SomeObject dummy2;
+  for (size_t i = 0; i < TestWorklist::kSegmentCapacity; i++) {
+    EXPECT_TRUE(worklist_view1.Push(&dummy1));
+  }
+  for (size_t i = 0; i < TestWorklist::kSegmentCapacity; i++) {
+    EXPECT_TRUE(worklist_view1.Push(&dummy2));
+  }
+  SomeObject* retrieved = nullptr;
+  SomeObject dummy3;
+  // One more push/pop to publish the full segment.
+  EXPECT_TRUE(worklist_view1.Push(&dummy3));
+  EXPECT_TRUE(worklist_view1.Pop(&retrieved));
+  EXPECT_EQ(&dummy3, retrieved);
+  EXPECT_EQ(2U, worklist.GlobalPoolSize());
+  // Stealing.
+  EXPECT_TRUE(worklist_view2.Pop(&retrieved));
+  SomeObject* const expect_bag2 = retrieved;
+  EXPECT_TRUE(worklist_view3.Pop(&retrieved));
+  SomeObject* const expect_bag3 = retrieved;
+  EXPECT_EQ(0U, worklist.GlobalPoolSize());
+  EXPECT_NE(expect_bag2, expect_bag3);
+  EXPECT_TRUE(expect_bag2 == &dummy1 || expect_bag2 == &dummy2);
+  EXPECT_TRUE(expect_bag3 == &dummy1 || expect_bag3 == &dummy2);
+  for (size_t i = 1; i < TestWorklist::kSegmentCapacity; i++) {
+    EXPECT_TRUE(worklist_view2.Pop(&retrieved));
+    EXPECT_EQ(expect_bag2, retrieved);
+    EXPECT_FALSE(worklist_view1.Pop(&retrieved));
+  }
+  for (size_t i = 1; i < TestWorklist::kSegmentCapacity; i++) {
+    EXPECT_TRUE(worklist_view3.Pop(&retrieved));
+    EXPECT_EQ(expect_bag3, retrieved);
+    EXPECT_FALSE(worklist_view1.Pop(&retrieved));
+  }
+  EXPECT_TRUE(worklist.IsEmpty());
+}
+
+TEST(CppgcWorkListTest, MergeGlobalPool) {
+  TestWorklist worklist1;
+  TestWorklist::View worklist_view1(&worklist1, 0);
+  SomeObject dummy;
+  for (size_t i = 0; i < TestWorklist::kSegmentCapacity; i++) {
+    EXPECT_TRUE(worklist_view1.Push(&dummy));
+  }
+  SomeObject* retrieved = nullptr;
+  // One more push/pop to publish the full segment.
+  EXPECT_TRUE(worklist_view1.Push(nullptr));
+  EXPECT_TRUE(worklist_view1.Pop(&retrieved));
+  EXPECT_EQ(nullptr, retrieved);
+  EXPECT_EQ(1U, worklist1.GlobalPoolSize());
+  // Merging global pool into a new Worklist.
+  TestWorklist worklist2;
+  TestWorklist::View worklist_view2(&worklist2, 0);
+  EXPECT_EQ(0U, worklist2.GlobalPoolSize());
+  worklist2.MergeGlobalPool(&worklist1);
+  EXPECT_EQ(1U, worklist2.GlobalPoolSize());
+  EXPECT_FALSE(worklist2.IsEmpty());
+  for (size_t i = 0; i < TestWorklist::kSegmentCapacity; i++) {
+    EXPECT_TRUE(worklist_view2.Pop(&retrieved));
+    EXPECT_EQ(&dummy, retrieved);
+    EXPECT_FALSE(worklist_view1.Pop(&retrieved));
+  }
+  EXPECT_TRUE(worklist1.IsEmpty());
+  EXPECT_TRUE(worklist2.IsEmpty());
+}
+
+}  // namespace internal
+}  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc b/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc
index 829096ab231..371527e7400 100644
--- a/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc
+++ b/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc
@@ -33,7 +33,7 @@ class MockEmbedderHeapTracer : public EmbedderHeapTracer {
  public:
   MOCK_METHOD1(TracePrologue, void(EmbedderHeapTracer::TraceFlags));
   MOCK_METHOD1(TraceEpilogue, void(EmbedderHeapTracer::TraceSummary*));
-  MOCK_METHOD1(EnterFinalPause, void(EmbedderHeapTracer::EmbedderStackState));
+  MOCK_METHOD1(EnterFinalPause, void(EmbedderStackState));
   MOCK_METHOD0(IsTracingDone, bool());
   MOCK_METHOD1(RegisterV8References,
                void(const std::vector<std::pair<void*, void*> >&));
@@ -105,7 +105,10 @@ TEST(LocalEmbedderHeapTracer, EnterFinalPauseDefaultStackStateUnkown) {
   LocalEmbedderHeapTracer local_tracer(nullptr);
   local_tracer.SetRemoteTracer(&remote_tracer);
   // The default stack state is expected to be unkown.
-  EXPECT_CALL(remote_tracer, EnterFinalPause(EmbedderHeapTracer::kUnknown));
+  EXPECT_CALL(
+      remote_tracer,
+      EnterFinalPause(
+          EmbedderHeapTracer::EmbedderStackState::kMayContainHeapPointers));
   local_tracer.EnterFinalPause();
 }
 
@@ -115,8 +118,10 @@ TEST_F(LocalEmbedderHeapTracerWithIsolate,
   LocalEmbedderHeapTracer local_tracer(isolate());
   local_tracer.SetRemoteTracer(&remote_tracer);
   local_tracer.SetEmbedderStackStateForNextFinalization(
-      EmbedderHeapTracer::kEmpty);
-  EXPECT_CALL(remote_tracer, EnterFinalPause(EmbedderHeapTracer::kEmpty));
+      EmbedderHeapTracer::EmbedderStackState::kNoHeapPointers);
+  EXPECT_CALL(
+      remote_tracer,
+      EnterFinalPause(EmbedderHeapTracer::EmbedderStackState::kNoHeapPointers));
   local_tracer.EnterFinalPause();
 }
 
@@ -126,8 +131,11 @@ TEST_F(LocalEmbedderHeapTracerWithIsolate, TemporaryEmbedderStackState) {
   local_tracer.SetRemoteTracer(&remote_tracer);
   // Default is unknown, see above.
   {
-    EmbedderStackStateScope scope(&local_tracer, EmbedderHeapTracer::kEmpty);
-    EXPECT_CALL(remote_tracer, EnterFinalPause(EmbedderHeapTracer::kEmpty));
+    EmbedderStackStateScope scope(
+        &local_tracer, EmbedderHeapTracer::EmbedderStackState::kNoHeapPointers);
+    EXPECT_CALL(remote_tracer,
+                EnterFinalPause(
+                    EmbedderHeapTracer::EmbedderStackState::kNoHeapPointers));
     local_tracer.EnterFinalPause();
   }
 }
@@ -139,14 +147,21 @@ TEST_F(LocalEmbedderHeapTracerWithIsolate,
   local_tracer.SetRemoteTracer(&remote_tracer);
   // Default is unknown, see above.
   {
-    EmbedderStackStateScope scope(&local_tracer, EmbedderHeapTracer::kEmpty);
+    EmbedderStackStateScope scope(
+        &local_tracer, EmbedderHeapTracer::EmbedderStackState::kNoHeapPointers);
     {
-      EmbedderStackStateScope scope(&local_tracer,
-                                    EmbedderHeapTracer::kUnknown);
-      EXPECT_CALL(remote_tracer, EnterFinalPause(EmbedderHeapTracer::kUnknown));
+      EmbedderStackStateScope scope(
+          &local_tracer,
+          EmbedderHeapTracer::EmbedderStackState::kMayContainHeapPointers);
+      EXPECT_CALL(
+          remote_tracer,
+          EnterFinalPause(
+              EmbedderHeapTracer::EmbedderStackState::kMayContainHeapPointers));
       local_tracer.EnterFinalPause();
     }
-    EXPECT_CALL(remote_tracer, EnterFinalPause(EmbedderHeapTracer::kEmpty));
+    EXPECT_CALL(remote_tracer,
+                EnterFinalPause(
+                    EmbedderHeapTracer::EmbedderStackState::kNoHeapPointers));
     local_tracer.EnterFinalPause();
   }
 }
@@ -156,10 +171,15 @@ TEST_F(LocalEmbedderHeapTracerWithIsolate, EnterFinalPauseStackStateResets) {
   LocalEmbedderHeapTracer local_tracer(isolate());
   local_tracer.SetRemoteTracer(&remote_tracer);
   local_tracer.SetEmbedderStackStateForNextFinalization(
-      EmbedderHeapTracer::kEmpty);
-  EXPECT_CALL(remote_tracer, EnterFinalPause(EmbedderHeapTracer::kEmpty));
+      EmbedderHeapTracer::EmbedderStackState::kNoHeapPointers);
+  EXPECT_CALL(
+      remote_tracer,
+      EnterFinalPause(EmbedderHeapTracer::EmbedderStackState::kNoHeapPointers));
   local_tracer.EnterFinalPause();
-  EXPECT_CALL(remote_tracer, EnterFinalPause(EmbedderHeapTracer::kUnknown));
+  EXPECT_CALL(
+      remote_tracer,
+      EnterFinalPause(
+          EmbedderHeapTracer::EmbedderStackState::kMayContainHeapPointers));
   local_tracer.EnterFinalPause();
 }
 
diff --git a/deps/v8/test/unittests/heap/heap-unittest.cc b/deps/v8/test/unittests/heap/heap-unittest.cc
index 12b5d3a7fed..d96f70aec37 100644
--- a/deps/v8/test/unittests/heap/heap-unittest.cc
+++ b/deps/v8/test/unittests/heap/heap-unittest.cc
@@ -2,12 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/heap/heap.h"
+
 #include <cmath>
 #include <iostream>
 #include <limits>
 
 #include "src/handles/handles-inl.h"
-#include "src/heap/heap.h"
+#include "src/heap/memory-chunk.h"
 #include "src/heap/spaces-inl.h"
 #include "src/objects/objects-inl.h"
 #include "test/unittests/test-utils.h"
diff --git a/deps/v8/test/unittests/base/list-unittest.cc b/deps/v8/test/unittests/heap/list-unittest.cc
similarity index 87%
rename from deps/v8/test/unittests/base/list-unittest.cc
rename to deps/v8/test/unittests/heap/list-unittest.cc
index 39394e27435..c18ce00fc4f 100644
--- a/deps/v8/test/unittests/base/list-unittest.cc
+++ b/deps/v8/test/unittests/heap/list-unittest.cc
@@ -2,16 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/base/list.h"
+#include "src/heap/list.h"
 #include "testing/gtest-support.h"
 
 namespace v8 {
-namespace base {
+namespace internal {
+namespace heap {
 
 class TestChunk {
  public:
-  base::ListNode<TestChunk>& list_node() { return list_node_; }
-  base::ListNode<TestChunk> list_node_;
+  heap::ListNode<TestChunk>& list_node() { return list_node_; }
+  const heap::ListNode<TestChunk>& list_node() const { return list_node_; }
+  heap::ListNode<TestChunk> list_node_;
 };
 
 TEST(List, InsertAtTailAndRemove) {
@@ -88,5 +90,6 @@ TEST(List, InsertMultipleAtTailAndRemoveFromMiddle) {
   EXPECT_TRUE(list.Empty());
 }
 
-}  // namespace base
+}  // namespace heap
+}  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/heap/off-thread-factory-unittest.cc b/deps/v8/test/unittests/heap/off-thread-factory-unittest.cc
index 0592d7b2db6..af9f861d245 100644
--- a/deps/v8/test/unittests/heap/off-thread-factory-unittest.cc
+++ b/deps/v8/test/unittests/heap/off-thread-factory-unittest.cc
@@ -15,6 +15,7 @@
 #include "src/execution/off-thread-isolate.h"
 #include "src/handles/handles-inl.h"
 #include "src/handles/handles.h"
+#include "src/handles/maybe-handles.h"
 #include "src/heap/off-thread-factory-inl.h"
 #include "src/objects/fixed-array.h"
 #include "src/objects/script.h"
@@ -55,7 +56,13 @@ class OffThreadFactoryTest : public TestWithIsolateAndZone {
  public:
   OffThreadFactoryTest()
       : TestWithIsolateAndZone(),
-        parse_info_(isolate()),
+        state_(isolate()),
+        parse_info_(
+            isolate(),
+            UnoptimizedCompileFlags::ForToplevelCompile(
+                isolate(), true, construct_language_mode(FLAG_use_strict),
+                REPLMode::kNo),
+            &state_),
         off_thread_isolate_(isolate(), parse_info_.zone()) {}
 
   FunctionLiteral* ParseProgram(const char* source) {
@@ -68,8 +75,6 @@ class OffThreadFactoryTest : public TestWithIsolateAndZone {
 
     parse_info_.set_character_stream(
         ScannerStream::ForTesting(utf16_source.data(), utf16_source.size()));
-    parse_info_.set_toplevel();
-    parse_info_.set_allow_lazy_parsing();
 
     {
       DisallowHeapAllocation no_allocation;
@@ -78,9 +83,7 @@ class OffThreadFactoryTest : public TestWithIsolateAndZone {
 
       Parser parser(parse_info());
       parser.InitializeEmptyScopeChain(parse_info());
-      parser.ParseOnBackground(parse_info());
-
-      CHECK(DeclarationScope::Analyze(parse_info()));
+      parser.ParseOnBackground(parse_info(), 0, 0, kFunctionLiteralIdTopLevel);
     }
 
     parse_info()->ast_value_factory()->Internalize(off_thread_isolate());
@@ -88,7 +91,7 @@ class OffThreadFactoryTest : public TestWithIsolateAndZone {
 
     script_ = parse_info_.CreateScript(off_thread_isolate(),
                                        off_thread_factory()->empty_string(),
-                                       ScriptOriginOptions());
+                                       kNullMaybeHandle, ScriptOriginOptions());
 
     // Create the SFI list on the script so that SFI SetScript works.
     Handle<WeakFixedArray> infos = off_thread_factory()->NewWeakFixedArray(
@@ -116,6 +119,7 @@ class OffThreadFactoryTest : public TestWithIsolateAndZone {
   }
 
  private:
+  UnoptimizedCompileState state_;
   ParseInfo parse_info_;
   OffThreadIsolate off_thread_isolate_;
   Handle<String> source_string_;
@@ -123,11 +127,11 @@ class OffThreadFactoryTest : public TestWithIsolateAndZone {
 };
 
 TEST_F(OffThreadFactoryTest, OneByteInternalizedString_IsAddedToStringTable) {
-  Vector<const uint8_t> string_vector = StaticCharVector("foo");
+  Vector<const uint8_t> string_vector = StaticOneByteVector("foo");
   uint32_t hash_field = StringHasher::HashSequentialString<uint8_t>(
       string_vector.begin(), string_vector.length(), HashSeed(isolate()));
 
-  FixedArray off_thread_wrapper;
+  OffThreadTransferHandle<FixedArray> wrapper;
   {
     OffThreadHandleScope handle_scope(off_thread_isolate());
 
@@ -135,15 +139,15 @@ TEST_F(OffThreadFactoryTest, OneByteInternalizedString_IsAddedToStringTable) {
         off_thread_factory()->NewOneByteInternalizedString(string_vector,
                                                            hash_field);
 
-    off_thread_wrapper =
-        *off_thread_factory()->StringWrapperForTest(off_thread_string);
-    off_thread_factory()->FinishOffThread();
+    wrapper =
+        off_thread_isolate()->TransferHandle(WrapString(off_thread_string));
+    off_thread_isolate()->FinishOffThread();
   }
 
-  Handle<FixedArray> wrapper = handle(off_thread_wrapper, isolate());
-  off_thread_factory()->Publish(isolate());
+  off_thread_isolate()->Publish(isolate());
 
-  Handle<String> string = handle(String::cast(wrapper->get(0)), isolate());
+  Handle<String> string =
+      handle(String::cast(wrapper.ToHandle()->get(0)), isolate());
 
   EXPECT_TRUE(string->IsOneByteEqualTo(CStrVector("foo")));
   EXPECT_TRUE(string->IsInternalizedString());
@@ -162,12 +166,12 @@ TEST_F(OffThreadFactoryTest, OneByteInternalizedString_IsAddedToStringTable) {
 
 TEST_F(OffThreadFactoryTest,
        OneByteInternalizedString_DuplicateIsDeduplicated) {
-  Vector<const uint8_t> string_vector = StaticCharVector("foo");
+  Vector<const uint8_t> string_vector = StaticOneByteVector("foo");
   uint32_t hash_field = StringHasher::HashSequentialString<uint8_t>(
       string_vector.begin(), string_vector.length(), HashSeed(isolate()));
 
-  FixedArray off_thread_wrapper_1;
-  FixedArray off_thread_wrapper_2;
+  OffThreadTransferHandle<FixedArray> wrapper_1;
+  OffThreadTransferHandle<FixedArray> wrapper_2;
   {
     OffThreadHandleScope handle_scope(off_thread_isolate());
 
@@ -178,17 +182,19 @@ TEST_F(OffThreadFactoryTest,
         off_thread_factory()->NewOneByteInternalizedString(string_vector,
                                                            hash_field);
 
-    off_thread_wrapper_1 = *WrapString(off_thread_string_1);
-    off_thread_wrapper_2 = *WrapString(off_thread_string_2);
-    off_thread_factory()->FinishOffThread();
+    wrapper_1 =
+        off_thread_isolate()->TransferHandle(WrapString(off_thread_string_1));
+    wrapper_2 =
+        off_thread_isolate()->TransferHandle(WrapString(off_thread_string_2));
+    off_thread_isolate()->FinishOffThread();
   }
 
-  Handle<FixedArray> wrapper_1 = handle(off_thread_wrapper_1, isolate());
-  Handle<FixedArray> wrapper_2 = handle(off_thread_wrapper_2, isolate());
-  off_thread_factory()->Publish(isolate());
+  off_thread_isolate()->Publish(isolate());
 
-  Handle<String> string_1 = handle(String::cast(wrapper_1->get(0)), isolate());
-  Handle<String> string_2 = handle(String::cast(wrapper_2->get(0)), isolate());
+  Handle<String> string_1 =
+      handle(String::cast(wrapper_1.ToHandle()->get(0)), isolate());
+  Handle<String> string_2 =
+      handle(String::cast(wrapper_2.ToHandle()->get(0)), isolate());
 
   EXPECT_TRUE(string_1->IsOneByteEqualTo(CStrVector("foo")));
   EXPECT_TRUE(string_1->IsInternalizedString());
@@ -201,20 +207,21 @@ TEST_F(OffThreadFactoryTest, AstRawString_IsInternalized) {
 
   const AstRawString* raw_string = ast_value_factory.GetOneByteString("foo");
 
-  FixedArray off_thread_wrapper;
+  OffThreadTransferHandle<FixedArray> wrapper;
   {
     OffThreadHandleScope handle_scope(off_thread_isolate());
 
     ast_value_factory.Internalize(off_thread_isolate());
 
-    off_thread_wrapper = *WrapString(raw_string->string());
-    off_thread_factory()->FinishOffThread();
+    wrapper =
+        off_thread_isolate()->TransferHandle(WrapString(raw_string->string()));
+    off_thread_isolate()->FinishOffThread();
   }
 
-  Handle<FixedArray> wrapper = handle(off_thread_wrapper, isolate());
-  off_thread_factory()->Publish(isolate());
+  off_thread_isolate()->Publish(isolate());
 
-  Handle<String> string = handle(String::cast(wrapper->get(0)), isolate());
+  Handle<String> string =
+      handle(String::cast(wrapper.ToHandle()->get(0)), isolate());
 
   EXPECT_TRUE(string->IsOneByteEqualTo(CStrVector("foo")));
   EXPECT_TRUE(string->IsInternalizedString());
@@ -224,7 +231,7 @@ TEST_F(OffThreadFactoryTest, AstConsString_CreatesConsString) {
   AstValueFactory ast_value_factory(zone(), isolate()->ast_string_constants(),
                                     HashSeed(isolate()));
 
-  FixedArray off_thread_wrapper;
+  OffThreadTransferHandle<FixedArray> wrapper;
   {
     OffThreadHandleScope handle_scope(off_thread_isolate());
 
@@ -236,15 +243,15 @@ TEST_F(OffThreadFactoryTest, AstConsString_CreatesConsString) {
 
     ast_value_factory.Internalize(off_thread_isolate());
 
-    off_thread_wrapper =
-        *WrapString(foobar_string->GetString(off_thread_isolate()));
-    off_thread_factory()->FinishOffThread();
+    wrapper = off_thread_isolate()->TransferHandle(
+        WrapString(foobar_string->GetString(off_thread_isolate())));
+    off_thread_isolate()->FinishOffThread();
   }
 
-  Handle<FixedArray> wrapper = handle(off_thread_wrapper, isolate());
-  off_thread_factory()->Publish(isolate());
+  off_thread_isolate()->Publish(isolate());
 
-  Handle<String> string = handle(String::cast(wrapper->get(0)), isolate());
+  Handle<String> string =
+      handle(String::cast(wrapper.ToHandle()->get(0)), isolate());
 
   EXPECT_TRUE(string->IsConsString());
   EXPECT_TRUE(string->Equals(*isolate()->factory()->NewStringFromStaticChars(
@@ -254,18 +261,19 @@ TEST_F(OffThreadFactoryTest, AstConsString_CreatesConsString) {
 TEST_F(OffThreadFactoryTest, EmptyScript) {
   FunctionLiteral* program = ParseProgram("");
 
-  SharedFunctionInfo shared;
+  OffThreadTransferHandle<SharedFunctionInfo> shared;
   {
     OffThreadHandleScope handle_scope(off_thread_isolate());
 
-    shared = *off_thread_factory()->NewSharedFunctionInfoForLiteral(
-        program, script(), true);
+    shared = off_thread_isolate()->TransferHandle(
+        off_thread_factory()->NewSharedFunctionInfoForLiteral(program, script(),
+                                                              true));
 
-    off_thread_factory()->FinishOffThread();
+    off_thread_isolate()->FinishOffThread();
   }
 
-  Handle<SharedFunctionInfo> root_sfi = handle(shared, isolate());
-  off_thread_factory()->Publish(isolate());
+  off_thread_isolate()->Publish(isolate());
+  Handle<SharedFunctionInfo> root_sfi = shared.ToHandle();
 
   EXPECT_EQ(root_sfi->function_literal_id(), 0);
 }
@@ -278,18 +286,19 @@ TEST_F(OffThreadFactoryTest, LazyFunction) {
                               ->AsFunctionDeclaration()
                               ->fun();
 
-  SharedFunctionInfo shared;
+  OffThreadTransferHandle<SharedFunctionInfo> shared;
   {
     OffThreadHandleScope handle_scope(off_thread_isolate());
 
-    shared = *off_thread_factory()->NewSharedFunctionInfoForLiteral(
-        lazy, script(), true);
+    shared = off_thread_isolate()->TransferHandle(
+        off_thread_factory()->NewSharedFunctionInfoForLiteral(lazy, script(),
+                                                              true));
 
-    off_thread_factory()->FinishOffThread();
+    off_thread_isolate()->FinishOffThread();
   }
 
-  Handle<SharedFunctionInfo> lazy_sfi = handle(shared, isolate());
-  off_thread_factory()->Publish(isolate());
+  off_thread_isolate()->Publish(isolate());
+  Handle<SharedFunctionInfo> lazy_sfi = shared.ToHandle();
 
   EXPECT_EQ(lazy_sfi->function_literal_id(), 1);
   EXPECT_TRUE(lazy_sfi->Name().IsOneByteEqualTo(CStrVector("lazy")));
@@ -299,24 +308,28 @@ TEST_F(OffThreadFactoryTest, LazyFunction) {
 
 TEST_F(OffThreadFactoryTest, EagerFunction) {
   FunctionLiteral* program = ParseProgram("(function eager() {})");
+  // Rewritten to `.result = (function eager() {}); return .result`
   FunctionLiteral* eager = program->body()
                                ->at(0)
                                ->AsExpressionStatement()
                                ->expression()
+                               ->AsAssignment()
+                               ->value()
                                ->AsFunctionLiteral();
 
-  SharedFunctionInfo shared;
+  OffThreadTransferHandle<SharedFunctionInfo> shared;
   {
     OffThreadHandleScope handle_scope(off_thread_isolate());
 
-    shared = *off_thread_factory()->NewSharedFunctionInfoForLiteral(
-        eager, script(), true);
+    shared = off_thread_isolate()->TransferHandle(
+        off_thread_factory()->NewSharedFunctionInfoForLiteral(eager, script(),
+                                                              true));
 
-    off_thread_factory()->FinishOffThread();
+    off_thread_isolate()->FinishOffThread();
   }
 
-  Handle<SharedFunctionInfo> eager_sfi = handle(shared, isolate());
-  off_thread_factory()->Publish(isolate());
+  off_thread_isolate()->Publish(isolate());
+  Handle<SharedFunctionInfo> eager_sfi = shared.ToHandle();
 
   EXPECT_EQ(eager_sfi->function_literal_id(), 1);
   EXPECT_TRUE(eager_sfi->Name().IsOneByteEqualTo(CStrVector("eager")));
@@ -339,18 +352,51 @@ TEST_F(OffThreadFactoryTest, ImplicitNameFunction) {
                                        ->value()
                                        ->AsFunctionLiteral();
 
-  SharedFunctionInfo shared;
+  OffThreadTransferHandle<SharedFunctionInfo> shared;
+  {
+    OffThreadHandleScope handle_scope(off_thread_isolate());
+
+    shared = off_thread_isolate()->TransferHandle(
+        off_thread_factory()->NewSharedFunctionInfoForLiteral(implicit_name,
+                                                              script(), true));
+
+    off_thread_isolate()->FinishOffThread();
+  }
+
+  off_thread_isolate()->Publish(isolate());
+  Handle<SharedFunctionInfo> implicit_name_sfi = shared.ToHandle();
+
+  EXPECT_EQ(implicit_name_sfi->function_literal_id(), 1);
+  EXPECT_TRUE(
+      implicit_name_sfi->Name().IsOneByteEqualTo(CStrVector("implicit_name")));
+}
+
+TEST_F(OffThreadFactoryTest, GCDuringPublish) {
+  FunctionLiteral* program = ParseProgram("let implicit_name = function() {}");
+  FunctionLiteral* implicit_name = program->body()
+                                       ->at(0)
+                                       ->AsBlock()
+                                       ->statements()
+                                       ->at(0)
+                                       ->AsExpressionStatement()
+                                       ->expression()
+                                       ->AsAssignment()
+                                       ->value()
+                                       ->AsFunctionLiteral();
+
+  OffThreadTransferHandle<SharedFunctionInfo> shared;
   {
     OffThreadHandleScope handle_scope(off_thread_isolate());
 
-    shared = *off_thread_factory()->NewSharedFunctionInfoForLiteral(
-        implicit_name, script(), true);
+    shared = off_thread_isolate()->TransferHandle(
+        off_thread_factory()->NewSharedFunctionInfoForLiteral(implicit_name,
+                                                              script(), true));
 
-    off_thread_factory()->FinishOffThread();
+    off_thread_isolate()->FinishOffThread();
   }
 
-  Handle<SharedFunctionInfo> implicit_name_sfi = handle(shared, isolate());
-  off_thread_factory()->Publish(isolate());
+  off_thread_isolate()->Publish(isolate());
+  Handle<SharedFunctionInfo> implicit_name_sfi = shared.ToHandle();
 
   EXPECT_EQ(implicit_name_sfi->function_literal_id(), 1);
   EXPECT_TRUE(
diff --git a/deps/v8/test/unittests/heap/safepoint-unittest.cc b/deps/v8/test/unittests/heap/safepoint-unittest.cc
index 462992f5fd5..3caf3410d46 100644
--- a/deps/v8/test/unittests/heap/safepoint-unittest.cc
+++ b/deps/v8/test/unittests/heap/safepoint-unittest.cc
@@ -17,6 +17,7 @@ using SafepointTest = TestWithIsolate;
 
 TEST_F(SafepointTest, ReachSafepointWithoutLocalHeaps) {
   Heap* heap = i_isolate()->heap();
+  FLAG_local_heaps = true;
   bool run = false;
   {
     SafepointScope scope(heap);
@@ -47,6 +48,7 @@ class ParkedThread final : public v8::base::Thread {
 
 TEST_F(SafepointTest, StopParkedThreads) {
   Heap* heap = i_isolate()->heap();
+  FLAG_local_heaps = true;
 
   int safepoints = 0;
 
@@ -105,6 +107,7 @@ class RunningThread final : public v8::base::Thread {
 
 TEST_F(SafepointTest, StopRunningThreads) {
   Heap* heap = i_isolate()->heap();
+  FLAG_local_heaps = true;
 
   const int kThreads = 10;
   const int kRuns = 5;
diff --git a/deps/v8/test/unittests/heap/slot-set-unittest.cc b/deps/v8/test/unittests/heap/slot-set-unittest.cc
index b5e4a01ab44..1c0ef3ae656 100644
--- a/deps/v8/test/unittests/heap/slot-set-unittest.cc
+++ b/deps/v8/test/unittests/heap/slot-set-unittest.cc
@@ -85,7 +85,7 @@ TEST(SlotSet, Iterate) {
   }
 
   set->Iterate(
-      kNullAddress, SlotSet::kBucketsRegularPage,
+      kNullAddress, 0, SlotSet::kBucketsRegularPage,
       [](MaybeObjectSlot slot) {
         if (slot.address() % 3 == 0) {
           return KEEP_SLOT;
@@ -106,6 +106,40 @@ TEST(SlotSet, Iterate) {
   SlotSet::Delete(set, SlotSet::kBucketsRegularPage);
 }
 
+TEST(SlotSet, IterateFromHalfway) {
+  SlotSet* set = SlotSet::Allocate(SlotSet::kBucketsRegularPage);
+
+  for (int i = 0; i < Page::kPageSize; i += kTaggedSize) {
+    if (i % 7 == 0) {
+      set->Insert<AccessMode::ATOMIC>(i);
+    }
+  }
+
+  set->Iterate(
+      kNullAddress, SlotSet::kBucketsRegularPage / 2,
+      SlotSet::kBucketsRegularPage,
+      [](MaybeObjectSlot slot) {
+        if (slot.address() % 3 == 0) {
+          return KEEP_SLOT;
+        } else {
+          return REMOVE_SLOT;
+        }
+      },
+      SlotSet::KEEP_EMPTY_BUCKETS);
+
+  for (int i = 0; i < Page::kPageSize; i += kTaggedSize) {
+    if (i < Page::kPageSize / 2 && i % 7 == 0) {
+      EXPECT_TRUE(set->Lookup(i));
+    } else if (i >= Page::kPageSize / 2 && i % 21 == 0) {
+      EXPECT_TRUE(set->Lookup(i));
+    } else {
+      EXPECT_FALSE(set->Lookup(i));
+    }
+  }
+
+  SlotSet::Delete(set, SlotSet::kBucketsRegularPage);
+}
+
 TEST(SlotSet, Remove) {
   SlotSet* set = SlotSet::Allocate(SlotSet::kBucketsRegularPage);
 
diff --git a/deps/v8/test/unittests/heap/spaces-unittest.cc b/deps/v8/test/unittests/heap/spaces-unittest.cc
index 296c85d7072..3f054ef66bb 100644
--- a/deps/v8/test/unittests/heap/spaces-unittest.cc
+++ b/deps/v8/test/unittests/heap/spaces-unittest.cc
@@ -3,12 +3,16 @@
 // found in the LICENSE file.
 
 #include "src/heap/spaces.h"
+
 #include <memory>
+
 #include "src/common/globals.h"
 #include "src/execution/isolate.h"
 #include "src/heap/heap-inl.h"
 #include "src/heap/heap-write-barrier-inl.h"
 #include "src/heap/heap.h"
+#include "src/heap/large-spaces.h"
+#include "src/heap/memory-chunk.h"
 #include "src/heap/spaces-inl.h"
 #include "test/unittests/test-utils.h"
 
@@ -167,10 +171,15 @@ TEST_F(SpacesTest, OffThreadSpaceMergeDuringIncrementalMarking) {
     expected_merged_pages += pages_in_off_thread_space;
   }
 
-  heap->FinalizeIncrementalMarkingAtomically(GarbageCollectionReason::kTesting);
-
+  // Check the page size before finalizing marking, since the GC will see the
+  // empty pages and will evacuate them.
+  // TODO(leszeks): Maybe allocate real objects, and hold on to them with
+  // Handles, to make sure incremental marking finalization doesn't clear them
+  // away.
   EXPECT_EQ(pages_in_old_space + expected_merged_pages,
             old_space->CountTotalPages());
+
+  heap->FinalizeIncrementalMarkingAtomically(GarbageCollectionReason::kTesting);
 }
 
 class LargeOffThreadAllocationThread final : public base::Thread {
@@ -266,7 +275,10 @@ TEST_F(SpacesTest, OffThreadLargeObjectSpaceMergeDuringIncrementalMarking) {
     threads[i]->Join();
   }
 
-  int pages_in_old_space = lo_space->PageCount();
+  heap->StartIncrementalMarking(Heap::kNoGCFlags,
+                                GarbageCollectionReason::kTesting);
+
+  int pages_in_lo_space = lo_space->PageCount();
 
   int expected_merged_pages = 0;
   for (int i = 0; i < kNumThreads; ++i) {
@@ -276,7 +288,14 @@ TEST_F(SpacesTest, OffThreadLargeObjectSpaceMergeDuringIncrementalMarking) {
     expected_merged_pages += pages_in_off_thread_space;
   }
 
-  EXPECT_EQ(pages_in_old_space + expected_merged_pages, lo_space->PageCount());
+  // Check the page size before finalizing marking, since the GC will see the
+  // empty pages and will evacuate them.
+  // TODO(leszeks): Maybe allocate real objects, and hold on to them with
+  // Handles, to make sure incremental marking finalization doesn't clear them
+  // away.
+  EXPECT_EQ(pages_in_lo_space + expected_merged_pages, lo_space->PageCount());
+
+  heap->FinalizeIncrementalMarkingAtomically(GarbageCollectionReason::kTesting);
 }
 
 TEST_F(SpacesTest, WriteBarrierFromHeapObject) {
diff --git a/deps/v8/test/unittests/heap/unmapper-unittest.cc b/deps/v8/test/unittests/heap/unmapper-unittest.cc
index cd1344f8098..4bf23e8142b 100644
--- a/deps/v8/test/unittests/heap/unmapper-unittest.cc
+++ b/deps/v8/test/unittests/heap/unmapper-unittest.cc
@@ -7,6 +7,7 @@
 #include "src/base/region-allocator.h"
 #include "src/execution/isolate.h"
 #include "src/heap/heap-inl.h"
+#include "src/heap/memory-allocator.h"
 #include "src/heap/spaces-inl.h"
 #include "src/utils/ostreams.h"
 #include "test/unittests/test-utils.h"
diff --git a/deps/v8/test/unittests/libplatform/default-job-unittest.cc b/deps/v8/test/unittests/libplatform/default-job-unittest.cc
new file mode 100644
index 00000000000..b54e589fcad
--- /dev/null
+++ b/deps/v8/test/unittests/libplatform/default-job-unittest.cc
@@ -0,0 +1,233 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/libplatform/default-job.h"
+
+#include "src/base/platform/condition-variable.h"
+#include "src/base/platform/platform.h"
+#include "src/libplatform/default-platform.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace v8 {
+namespace platform {
+namespace default_job_unittest {
+
+// Verify that Cancel() on a job stops running the worker task and causes
+// current workers to yield.
+TEST(DefaultJobTest, CancelJob) {
+  static constexpr size_t kTooManyTasks = 1000;
+  static constexpr size_t kMaxTask = 4;
+  DefaultPlatform platform(kMaxTask);
+
+  // This Job notifies |threads_running| once started and loops until
+  // ShouldYield() returns true, and then returns.
+  class JobTest : public JobTask {
+   public:
+    ~JobTest() override = default;
+
+    void Run(JobDelegate* delegate) override {
+      {
+        base::MutexGuard guard(&mutex);
+        worker_count++;
+      }
+      threads_running.NotifyOne();
+      while (!delegate->ShouldYield()) {
+      }
+    }
+
+    size_t GetMaxConcurrency() const override {
+      return max_concurrency.load(std::memory_order_relaxed);
+    }
+
+    base::Mutex mutex;
+    base::ConditionVariable threads_running;
+    size_t worker_count = 0;
+    std::atomic_size_t max_concurrency{kTooManyTasks};
+  };
+
+  auto job = std::make_unique<JobTest>();
+  JobTest* job_raw = job.get();
+  auto state = std::make_shared<DefaultJobState>(
+      &platform, std::move(job), TaskPriority::kUserVisible, kMaxTask);
+  state->NotifyConcurrencyIncrease();
+
+  {
+    base::MutexGuard guard(&job_raw->mutex);
+    while (job_raw->worker_count < kMaxTask) {
+      job_raw->threads_running.Wait(&job_raw->mutex);
+    }
+    EXPECT_EQ(kMaxTask, job_raw->worker_count);
+  }
+  state->CancelAndWait();
+  // Workers should return and this test should not hang.
+}
+
+// Verify that Join() on a job contributes to max concurrency and waits for all
+// workers to return.
+TEST(DefaultJobTest, JoinJobContributes) {
+  static constexpr size_t kMaxTask = 4;
+  DefaultPlatform platform(kMaxTask);
+
+  // This Job notifies |threads_running| once started and blocks on a barrier
+  // until kMaxTask + 1 threads reach that point, and then returns.
+  class JobTest : public JobTask {
+   public:
+    ~JobTest() override = default;
+
+    void Run(JobDelegate* delegate) override {
+      base::MutexGuard guard(&mutex);
+      worker_count++;
+      threads_running.NotifyAll();
+      while (worker_count < kMaxTask + 1) threads_running.Wait(&mutex);
+      --max_concurrency;
+    }
+
+    size_t GetMaxConcurrency() const override {
+      return max_concurrency.load(std::memory_order_relaxed);
+    }
+
+    base::Mutex mutex;
+    base::ConditionVariable threads_running;
+    size_t worker_count = 0;
+    std::atomic_size_t max_concurrency{kMaxTask + 1};
+  };
+
+  auto job = std::make_unique<JobTest>();
+  JobTest* job_raw = job.get();
+  auto state = std::make_shared<DefaultJobState>(
+      &platform, std::move(job), TaskPriority::kUserVisible, kMaxTask);
+  state->NotifyConcurrencyIncrease();
+
+  // The main thread contributing is necessary for |worker_count| to reach
+  // kMaxTask + 1 thus, Join() should not hang.
+  state->Join();
+  EXPECT_EQ(0U, job_raw->max_concurrency);
+}
+
+// Verify that calling NotifyConcurrencyIncrease() (re-)schedules tasks with the
+// intended concurrency.
+TEST(DefaultJobTest, JobNotifyConcurrencyIncrease) {
+  static constexpr size_t kMaxTask = 4;
+  DefaultPlatform platform(kMaxTask);
+
+  // This Job notifies |threads_running| once started and blocks on a barrier
+  // until kMaxTask threads reach that point, and then returns.
+  class JobTest : public JobTask {
+   public:
+    ~JobTest() override = default;
+
+    void Run(JobDelegate* delegate) override {
+      base::MutexGuard guard(&mutex);
+      worker_count++;
+      threads_running.NotifyAll();
+      // Wait synchronously until |kMaxTask| workers reach this point.
+      while (worker_count < kMaxTask) threads_running.Wait(&mutex);
+      --max_concurrency;
+    }
+
+    size_t GetMaxConcurrency() const override {
+      return max_concurrency.load(std::memory_order_relaxed);
+    }
+
+    base::Mutex mutex;
+    base::ConditionVariable threads_running;
+    bool continue_flag = false;
+    size_t worker_count = 0;
+    std::atomic_size_t max_concurrency{kMaxTask / 2};
+  };
+
+  auto job = std::make_unique<JobTest>();
+  JobTest* job_raw = job.get();
+  auto state = std::make_shared<DefaultJobState>(
+      &platform, std::move(job), TaskPriority::kUserVisible, kMaxTask);
+  state->NotifyConcurrencyIncrease();
+
+  {
+    base::MutexGuard guard(&job_raw->mutex);
+    while (job_raw->worker_count < kMaxTask / 2)
+      job_raw->threads_running.Wait(&job_raw->mutex);
+    EXPECT_EQ(kMaxTask / 2, job_raw->worker_count);
+
+    job_raw->max_concurrency = kMaxTask;
+  }
+  state->NotifyConcurrencyIncrease();
+  // Workers should reach |continue_flag| and eventually return thus, Join()
+  // should not hang.
+  state->Join();
+  EXPECT_EQ(0U, job_raw->max_concurrency);
+}
+
+// Verify that Join() doesn't contribute if the Job is already finished.
+TEST(DefaultJobTest, FinishBeforeJoin) {
+  static constexpr size_t kMaxTask = 4;
+  DefaultPlatform platform(kMaxTask);
+
+  // This Job notifies |threads_running| once started and returns.
+  class JobTest : public JobTask {
+   public:
+    ~JobTest() override = default;
+
+    void Run(JobDelegate* delegate) override {
+      base::MutexGuard guard(&mutex);
+      worker_count++;
+      // Assert that main thread doesn't contribute in this test.
+      EXPECT_NE(main_thread_id, base::OS::GetCurrentThreadId());
+      worker_ran.NotifyAll();
+      --max_concurrency;
+    }
+
+    size_t GetMaxConcurrency() const override {
+      return max_concurrency.load(std::memory_order_relaxed);
+    }
+
+    const int main_thread_id = base::OS::GetCurrentThreadId();
+    base::Mutex mutex;
+    base::ConditionVariable worker_ran;
+    size_t worker_count = 0;
+    std::atomic_size_t max_concurrency{kMaxTask * 5};
+  };
+
+  auto job = std::make_unique<JobTest>();
+  JobTest* job_raw = job.get();
+  auto state = std::make_shared<DefaultJobState>(
+      &platform, std::move(job), TaskPriority::kUserVisible, kMaxTask);
+  state->NotifyConcurrencyIncrease();
+
+  {
+    base::MutexGuard guard(&job_raw->mutex);
+    while (job_raw->worker_count < kMaxTask * 5)
+      job_raw->worker_ran.Wait(&job_raw->mutex);
+    EXPECT_EQ(kMaxTask * 5, job_raw->worker_count);
+  }
+
+  state->Join();
+  EXPECT_EQ(0U, job_raw->max_concurrency);
+}
+
+// Verify that destroying a DefaultJobHandle triggers a DCHECK if neither Join()
+// or Cancel() was called.
+TEST(DefaultJobTest, LeakHandle) {
+  class JobTest : public JobTask {
+   public:
+    ~JobTest() override = default;
+
+    void Run(JobDelegate* delegate) override {}
+
+    size_t GetMaxConcurrency() const override { return 0; }
+  };
+
+  DefaultPlatform platform(0);
+  auto job = std::make_unique<JobTest>();
+  auto state = std::make_shared<DefaultJobState>(&platform, std::move(job),
+                                                 TaskPriority::kUserVisible, 1);
+  auto handle = std::make_unique<DefaultJobHandle>(std::move(state));
+#ifdef DEBUG
+  EXPECT_DEATH_IF_SUPPORTED({ handle.reset(); }, "");
+#endif  // DEBUG
+  handle->Join();
+}
+
+}  // namespace default_job_unittest
+}  // namespace platform
+}  // namespace v8
diff --git a/deps/v8/test/unittests/libplatform/default-platform-unittest.cc b/deps/v8/test/unittests/libplatform/default-platform-unittest.cc
index 2aa43de1ade..49aa0fe1cb2 100644
--- a/deps/v8/test/unittests/libplatform/default-platform-unittest.cc
+++ b/deps/v8/test/unittests/libplatform/default-platform-unittest.cc
@@ -32,8 +32,8 @@ struct MockIdleTask : public IdleTask {
 
 class DefaultPlatformWithMockTime : public DefaultPlatform {
  public:
-  DefaultPlatformWithMockTime()
-      : DefaultPlatform(IdleTaskSupport::kEnabled, nullptr) {
+  explicit DefaultPlatformWithMockTime(int thread_pool_size = 0)
+      : DefaultPlatform(thread_pool_size, IdleTaskSupport::kEnabled, nullptr) {
     mock_time_ = 0.0;
     SetTimeFunctionForTesting([]() { return mock_time_; });
   }
@@ -240,8 +240,7 @@ class TestBackgroundTask : public Task {
 }  // namespace
 
 TEST(CustomDefaultPlatformTest, RunBackgroundTask) {
-  DefaultPlatform platform;
-  platform.SetThreadPoolSize(1);
+  DefaultPlatform platform(1);
 
   base::Semaphore sem(0);
   bool task_executed = false;
@@ -256,12 +255,11 @@ TEST(CustomDefaultPlatformTest, RunBackgroundTask) {
 TEST(CustomDefaultPlatformTest, PostForegroundTaskAfterPlatformTermination) {
   std::shared_ptr<TaskRunner> foreground_taskrunner;
   {
-    DefaultPlatformWithMockTime platform;
+    DefaultPlatformWithMockTime platform(1);
 
     int dummy;
     Isolate* isolate = reinterpret_cast<Isolate*>(&dummy);
 
-    platform.SetThreadPoolSize(1);
     foreground_taskrunner = platform.GetForegroundTaskRunner(isolate);
   }
   // It should still be possible to post foreground tasks, even when the
diff --git a/deps/v8/test/unittests/objects/backing-store-unittest.cc b/deps/v8/test/unittests/objects/backing-store-unittest.cc
index d00f5632fe2..b31669a79c2 100644
--- a/deps/v8/test/unittests/objects/backing-store-unittest.cc
+++ b/deps/v8/test/unittests/objects/backing-store-unittest.cc
@@ -21,8 +21,10 @@ TEST_F(BackingStoreTest, GrowWasmMemoryInPlace) {
   EXPECT_EQ(1 * wasm::kWasmPageSize, backing_store->byte_length());
   EXPECT_EQ(2 * wasm::kWasmPageSize, backing_store->byte_capacity());
 
-  bool success = backing_store->GrowWasmMemoryInPlace(isolate(), 1, 2);
-  EXPECT_TRUE(success);
+  base::Optional<size_t> result =
+      backing_store->GrowWasmMemoryInPlace(isolate(), 1, 2);
+  EXPECT_TRUE(result.has_value());
+  EXPECT_EQ(result.value(), 1u);
   EXPECT_EQ(2 * wasm::kWasmPageSize, backing_store->byte_length());
 }
 
@@ -34,8 +36,9 @@ TEST_F(BackingStoreTest, GrowWasmMemoryInPlace_neg) {
   EXPECT_EQ(1 * wasm::kWasmPageSize, backing_store->byte_length());
   EXPECT_EQ(2 * wasm::kWasmPageSize, backing_store->byte_capacity());
 
-  bool success = backing_store->GrowWasmMemoryInPlace(isolate(), 2, 2);
-  EXPECT_FALSE(success);
+  base::Optional<size_t> result =
+      backing_store->GrowWasmMemoryInPlace(isolate(), 2, 2);
+  EXPECT_FALSE(result.has_value());
   EXPECT_EQ(1 * wasm::kWasmPageSize, backing_store->byte_length());
 }
 
@@ -47,8 +50,10 @@ TEST_F(BackingStoreTest, GrowSharedWasmMemoryInPlace) {
   EXPECT_EQ(2 * wasm::kWasmPageSize, backing_store->byte_length());
   EXPECT_EQ(3 * wasm::kWasmPageSize, backing_store->byte_capacity());
 
-  bool success = backing_store->GrowWasmMemoryInPlace(isolate(), 1, 3);
-  EXPECT_TRUE(success);
+  base::Optional<size_t> result =
+      backing_store->GrowWasmMemoryInPlace(isolate(), 1, 3);
+  EXPECT_TRUE(result.has_value());
+  EXPECT_EQ(result.value(), 2u);
   EXPECT_EQ(3 * wasm::kWasmPageSize, backing_store->byte_length());
 }
 
@@ -81,10 +86,11 @@ class GrowerThread : public base::Thread {
     while (true) {
       size_t current_length = backing_store_->byte_length();
       if (current_length >= max_length) break;
-      bool result =
+      base::Optional<size_t> result =
           backing_store_->GrowWasmMemoryInPlace(isolate_, increment_, max_);
       size_t new_length = backing_store_->byte_length();
-      if (result) {
+      if (result.has_value()) {
+        CHECK_LE(current_length / wasm::kWasmPageSize, result.value());
         CHECK_GE(new_length, current_length + increment_);
       } else {
         CHECK_EQ(max_length, new_length);
diff --git a/deps/v8/test/unittests/tasks/background-compile-task-unittest.cc b/deps/v8/test/unittests/tasks/background-compile-task-unittest.cc
index a9a0fac66ba..dd7519230ad 100644
--- a/deps/v8/test/unittests/tasks/background-compile-task-unittest.cc
+++ b/deps/v8/test/unittests/tasks/background-compile-task-unittest.cc
@@ -48,8 +48,9 @@ class BackgroundCompileTaskTest : public TestWithNativeContext {
   BackgroundCompileTask* NewBackgroundCompileTask(
       Isolate* isolate, Handle<SharedFunctionInfo> shared,
       size_t stack_size = FLAG_stack_size) {
+    UnoptimizedCompileState state(isolate);
     std::unique_ptr<ParseInfo> outer_parse_info =
-        test::OuterParseInfoForShared(isolate, shared);
+        test::OuterParseInfoForShared(isolate, shared, &state);
     AstValueFactory* ast_value_factory =
         outer_parse_info->GetOrCreateAstValueFactory();
     AstNodeFactory ast_node_factory(ast_value_factory,
@@ -75,7 +76,7 @@ class BackgroundCompileTaskTest : public TestWithNativeContext {
             shared->function_literal_id(), nullptr);
 
     return new BackgroundCompileTask(
-        allocator(), outer_parse_info.get(), function_name, function_literal,
+        outer_parse_info.get(), function_name, function_literal,
         isolate->counters()->worker_thread_runtime_call_stats(),
         isolate->counters()->compile_function_on_background(), FLAG_stack_size);
   }
diff --git a/deps/v8/test/unittests/test-helpers.cc b/deps/v8/test/unittests/test-helpers.cc
index 2d9149402fe..6691784a718 100644
--- a/deps/v8/test/unittests/test-helpers.cc
+++ b/deps/v8/test/unittests/test-helpers.cc
@@ -54,13 +54,15 @@ Handle<SharedFunctionInfo> CreateSharedFunctionInfo(
 }
 
 std::unique_ptr<ParseInfo> OuterParseInfoForShared(
-    Isolate* isolate, Handle<SharedFunctionInfo> shared) {
+    Isolate* isolate, Handle<SharedFunctionInfo> shared,
+    UnoptimizedCompileState* state) {
   Script script = Script::cast(shared->script());
-  std::unique_ptr<ParseInfo> result =
-      std::make_unique<ParseInfo>(isolate, script);
+  std::unique_ptr<ParseInfo> result = std::make_unique<ParseInfo>(
+      isolate, i::UnoptimizedCompileFlags::ForScriptCompile(isolate, script),
+      state);
 
   // Create a character stream to simulate the parser having done so for the
-  // to-level ParseProgram.
+  // top-level ParseProgram.
   Handle<String> source(String::cast(script.source()), isolate);
   std::unique_ptr<Utf16CharacterStream> stream(
       ScannerStream::For(isolate, source));
diff --git a/deps/v8/test/unittests/test-helpers.h b/deps/v8/test/unittests/test-helpers.h
index 8a4d9f02ce9..5cd1beb7618 100644
--- a/deps/v8/test/unittests/test-helpers.h
+++ b/deps/v8/test/unittests/test-helpers.h
@@ -46,7 +46,8 @@ Handle<SharedFunctionInfo> CreateSharedFunctionInfo(
     Isolate* isolate,
     v8::String::ExternalOneByteStringResource* maybe_resource);
 std::unique_ptr<ParseInfo> OuterParseInfoForShared(
-    Isolate* isolate, Handle<SharedFunctionInfo> shared);
+    Isolate* isolate, Handle<SharedFunctionInfo> shared,
+    UnoptimizedCompileState* state);
 
 }  // namespace test
 }  // namespace internal
diff --git a/deps/v8/test/unittests/test-utils.cc b/deps/v8/test/unittests/test-utils.cc
index 5ac44b3d575..86e2854596e 100644
--- a/deps/v8/test/unittests/test-utils.cc
+++ b/deps/v8/test/unittests/test-utils.cc
@@ -15,50 +15,61 @@
 
 namespace v8 {
 
-IsolateWrapper::IsolateWrapper(CounterLookupCallback counter_lookup_callback,
-                               bool enforce_pointer_compression)
+namespace {
+// counter_lookup_callback doesn't pass through any state information about
+// the current Isolate, so we have to store the current counter map somewhere.
+// Fortunately tests run serially, so we can just store it in a static global.
+CounterMap* kCurrentCounterMap = nullptr;
+}  // namespace
+
+IsolateWrapper::IsolateWrapper(CountersMode counters_mode,
+                               PointerCompressionMode pointer_compression_mode)
     : array_buffer_allocator_(
           v8::ArrayBuffer::Allocator::NewDefaultAllocator()) {
+  CHECK_NULL(kCurrentCounterMap);
+
   v8::Isolate::CreateParams create_params;
-  create_params.array_buffer_allocator = array_buffer_allocator_;
-  create_params.counter_lookup_callback = counter_lookup_callback;
-  if (enforce_pointer_compression) {
+  create_params.array_buffer_allocator = array_buffer_allocator_.get();
+
+  if (counters_mode == kEnableCounters) {
+    counter_map_ = std::make_unique<CounterMap>();
+    kCurrentCounterMap = counter_map_.get();
+
+    create_params.counter_lookup_callback = [](const char* name) {
+      CHECK_NOT_NULL(kCurrentCounterMap);
+      // If the name doesn't exist in the counter map, operator[] will default
+      // initialize it to zero.
+      return &(*kCurrentCounterMap)[name];
+    };
+  } else {
+    create_params.counter_lookup_callback = [](const char* name) -> int* {
+      return nullptr;
+    };
+  }
+
+  if (pointer_compression_mode == kEnforcePointerCompression) {
     isolate_ = reinterpret_cast<v8::Isolate*>(
         i::Isolate::New(i::IsolateAllocationMode::kInV8Heap));
-    v8::Isolate::Initialize(isolate_, create_params);
+    v8::Isolate::Initialize(isolate(), create_params);
   } else {
     isolate_ = v8::Isolate::New(create_params);
   }
-  CHECK_NOT_NULL(isolate_);
+  CHECK_NOT_NULL(isolate());
 }
 
 IsolateWrapper::~IsolateWrapper() {
   v8::Platform* platform = internal::V8::GetCurrentPlatform();
   CHECK_NOT_NULL(platform);
-  while (platform::PumpMessageLoop(platform, isolate_)) continue;
+  while (platform::PumpMessageLoop(platform, isolate())) continue;
   isolate_->Dispose();
-  delete array_buffer_allocator_;
-}
-
-// static
-v8::IsolateWrapper* SharedIsolateHolder::isolate_wrapper_ = nullptr;
-
-// static
-int* SharedIsolateAndCountersHolder::LookupCounter(const char* name) {
-  DCHECK_NOT_NULL(counter_map_);
-  auto map_entry = counter_map_->find(name);
-  if (map_entry == counter_map_->end()) {
-    counter_map_->emplace(name, 0);
+  if (counter_map_) {
+    CHECK_EQ(kCurrentCounterMap, counter_map_.get());
+    kCurrentCounterMap = nullptr;
+  } else {
+    CHECK_NULL(kCurrentCounterMap);
   }
-  return &counter_map_->at(name);
 }
 
-// static
-v8::IsolateWrapper* SharedIsolateAndCountersHolder::isolate_wrapper_ = nullptr;
-
-// static
-CounterMap* SharedIsolateAndCountersHolder::counter_map_ = nullptr;
-
 namespace internal {
 
 SaveFlags::SaveFlags() {
diff --git a/deps/v8/test/unittests/test-utils.h b/deps/v8/test/unittests/test-utils.h
index c2ffbf15610..30de25fe9ab 100644
--- a/deps/v8/test/unittests/test-utils.h
+++ b/deps/v8/test/unittests/test-utils.h
@@ -5,6 +5,7 @@
 #ifndef V8_UNITTESTS_TEST_UTILS_H_
 #define V8_UNITTESTS_TEST_UTILS_H_
 
+#include <memory>
 #include <vector>
 
 #include "include/v8.h"
@@ -24,144 +25,67 @@ class ArrayBufferAllocator;
 
 using CounterMap = std::map<std::string, int>;
 
+enum CountersMode { kNoCounters, kEnableCounters };
+
+// When PointerCompressionMode is kEnforcePointerCompression, the Isolate is
+// created with pointer compression force enabled. When it's
+// kDefaultPointerCompression then the Isolate is created with the default
+// pointer compression state for the current build.
+enum PointerCompressionMode {
+  kDefaultPointerCompression,
+  kEnforcePointerCompression
+};
+
 // RAII-like Isolate instance wrapper.
 class IsolateWrapper final {
  public:
-  // When enforce_pointer_compression is true the Isolate is created with
-  // enabled pointer compression. When it's false then the Isolate is created
-  // with the default pointer compression state for current build.
-  explicit IsolateWrapper(CounterLookupCallback counter_lookup_callback,
-                          bool enforce_pointer_compression = false);
+  explicit IsolateWrapper(CountersMode counters_mode,
+                          PointerCompressionMode pointer_compression_mode);
   ~IsolateWrapper();
 
   v8::Isolate* isolate() const { return isolate_; }
 
  private:
-  v8::ArrayBuffer::Allocator* array_buffer_allocator_;
+  std::unique_ptr<v8::ArrayBuffer::Allocator> array_buffer_allocator_;
+  std::unique_ptr<CounterMap> counter_map_;
   v8::Isolate* isolate_;
 
   DISALLOW_COPY_AND_ASSIGN(IsolateWrapper);
 };
 
-class SharedIsolateHolder final {
- public:
-  static v8::Isolate* isolate() { return isolate_wrapper_->isolate(); }
-
-  static void CreateIsolate() {
-    CHECK_NULL(isolate_wrapper_);
-    isolate_wrapper_ =
-        new IsolateWrapper([](const char* name) -> int* { return nullptr; });
-  }
-
-  static void DeleteIsolate() {
-    CHECK_NOT_NULL(isolate_wrapper_);
-    delete isolate_wrapper_;
-    isolate_wrapper_ = nullptr;
-  }
-
- private:
-  static v8::IsolateWrapper* isolate_wrapper_;
-
-  DISALLOW_IMPLICIT_CONSTRUCTORS(SharedIsolateHolder);
-};
-
-class SharedIsolateAndCountersHolder final {
- public:
-  static v8::Isolate* isolate() { return isolate_wrapper_->isolate(); }
-
-  static void CreateIsolate() {
-    CHECK_NULL(counter_map_);
-    CHECK_NULL(isolate_wrapper_);
-    counter_map_ = new CounterMap();
-    isolate_wrapper_ = new IsolateWrapper(LookupCounter);
-  }
-
-  static void DeleteIsolate() {
-    CHECK_NOT_NULL(counter_map_);
-    CHECK_NOT_NULL(isolate_wrapper_);
-    delete isolate_wrapper_;
-    isolate_wrapper_ = nullptr;
-    delete counter_map_;
-    counter_map_ = nullptr;
-  }
-
- private:
-  static int* LookupCounter(const char* name);
-  static CounterMap* counter_map_;
-  static v8::IsolateWrapper* isolate_wrapper_;
-
-  DISALLOW_IMPLICIT_CONSTRUCTORS(SharedIsolateAndCountersHolder);
-};
-
 //
 // A set of mixins from which the test fixtures will be constructed.
 //
-template <typename TMixin>
-class WithPrivateIsolateMixin : public TMixin {
+template <typename TMixin, CountersMode kCountersMode = kNoCounters,
+          PointerCompressionMode kPointerCompressionMode =
+              kDefaultPointerCompression>
+class WithIsolateMixin : public TMixin {
  public:
-  explicit WithPrivateIsolateMixin(bool enforce_pointer_compression = false)
-      : isolate_wrapper_([](const char* name) -> int* { return nullptr; },
-                         enforce_pointer_compression) {}
+  WithIsolateMixin()
+      : isolate_wrapper_(kCountersMode, kPointerCompressionMode) {}
 
   v8::Isolate* v8_isolate() const { return isolate_wrapper_.isolate(); }
 
-  static void SetUpTestCase() { TMixin::SetUpTestCase(); }
-  static void TearDownTestCase() { TMixin::TearDownTestCase(); }
-
  private:
   v8::IsolateWrapper isolate_wrapper_;
-
-  DISALLOW_COPY_AND_ASSIGN(WithPrivateIsolateMixin);
 };
 
-template <typename TMixin, typename TSharedIsolateHolder = SharedIsolateHolder>
-class WithSharedIsolateMixin : public TMixin {
- public:
-  WithSharedIsolateMixin() = default;
-
-  v8::Isolate* v8_isolate() const { return TSharedIsolateHolder::isolate(); }
-
-  static void SetUpTestCase() {
-    TMixin::SetUpTestCase();
-    TSharedIsolateHolder::CreateIsolate();
-  }
-
-  static void TearDownTestCase() {
-    TSharedIsolateHolder::DeleteIsolate();
-    TMixin::TearDownTestCase();
-  }
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(WithSharedIsolateMixin);
-};
-
-template <typename TMixin>
-class WithPointerCompressionIsolateMixin
-    : public WithPrivateIsolateMixin<TMixin> {
- public:
-  WithPointerCompressionIsolateMixin()
-      : WithPrivateIsolateMixin<TMixin>(true) {}
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(WithPointerCompressionIsolateMixin);
-};
+template <typename TMixin, CountersMode kCountersMode = kNoCounters>
+using WithPointerCompressionIsolateMixin =
+    WithIsolateMixin<TMixin, kCountersMode, kEnforcePointerCompression>;
 
 template <typename TMixin>
 class WithIsolateScopeMixin : public TMixin {
  public:
   WithIsolateScopeMixin()
-      : isolate_scope_(v8_isolate()), handle_scope_(v8_isolate()) {}
+      : isolate_scope_(this->v8_isolate()), handle_scope_(this->v8_isolate()) {}
 
-  v8::Isolate* isolate() const { return v8_isolate(); }
-  v8::Isolate* v8_isolate() const { return TMixin::v8_isolate(); }
+  v8::Isolate* isolate() const { return this->v8_isolate(); }
 
   v8::internal::Isolate* i_isolate() const {
-    return reinterpret_cast<v8::internal::Isolate*>(v8_isolate());
+    return reinterpret_cast<v8::internal::Isolate*>(this->v8_isolate());
   }
 
-  static void SetUpTestCase() { TMixin::SetUpTestCase(); }
-  static void TearDownTestCase() { TMixin::TearDownTestCase(); }
-
  private:
   v8::Isolate::Scope isolate_scope_;
   v8::HandleScope handle_scope_;
@@ -173,25 +97,23 @@ template <typename TMixin>
 class WithContextMixin : public TMixin {
  public:
   WithContextMixin()
-      : context_(Context::New(v8_isolate())), context_scope_(context_) {}
-
-  v8::Isolate* v8_isolate() const { return TMixin::v8_isolate(); }
+      : context_(Context::New(this->v8_isolate())), context_scope_(context_) {}
 
   const Local<Context>& context() const { return v8_context(); }
   const Local<Context>& v8_context() const { return context_; }
 
   Local<Value> RunJS(const char* source) {
     return RunJS(
-        v8::String::NewFromUtf8(v8_isolate(), source).ToLocalChecked());
+        v8::String::NewFromUtf8(this->v8_isolate(), source).ToLocalChecked());
   }
 
   Local<Value> RunJS(v8::String::ExternalOneByteStringResource* source) {
-    return RunJS(
-        v8::String::NewExternalOneByte(v8_isolate(), source).ToLocalChecked());
+    return RunJS(v8::String::NewExternalOneByte(this->v8_isolate(), source)
+                     .ToLocalChecked());
   }
 
   v8::Local<v8::String> NewString(const char* string) {
-    return v8::String::NewFromUtf8(v8_isolate(), string).ToLocalChecked();
+    return v8::String::NewFromUtf8(this->v8_isolate(), string).ToLocalChecked();
   }
 
   void SetGlobalProperty(const char* name, v8::Local<v8::Value> value) {
@@ -201,12 +123,9 @@ class WithContextMixin : public TMixin {
               .FromJust());
   }
 
-  static void SetUpTestCase() { TMixin::SetUpTestCase(); }
-  static void TearDownTestCase() { TMixin::TearDownTestCase(); }
-
  private:
   Local<Value> RunJS(Local<String> source) {
-    auto context = v8_isolate()->GetCurrentContext();
+    auto context = this->v8_isolate()->GetCurrentContext();
     Local<Script> script =
         v8::Script::Compile(context, source).ToLocalChecked();
     return script->Run(context).ToLocalChecked();
@@ -220,17 +139,17 @@ class WithContextMixin : public TMixin {
 
 // Use v8::internal::TestWithIsolate if you are testing internals,
 // aka. directly work with Handles.
-using TestWithIsolate =          //
-    WithIsolateScopeMixin<       //
-        WithSharedIsolateMixin<  //
+using TestWithIsolate =     //
+    WithIsolateScopeMixin<  //
+        WithIsolateMixin<   //
             ::testing::Test>>;
 
 // Use v8::internal::TestWithNativeContext if you are testing internals,
 // aka. directly work with Handles.
-using TestWithContext =              //
-    WithContextMixin<                //
-        WithIsolateScopeMixin<       //
-            WithSharedIsolateMixin<  //
+using TestWithContext =         //
+    WithContextMixin<           //
+        WithIsolateScopeMixin<  //
+            WithIsolateMixin<   //
                 ::testing::Test>>>;
 
 using TestWithIsolateAndPointerCompression =     //
@@ -279,9 +198,6 @@ class WithInternalIsolateMixin : public TMixin {
     return isolate()->random_number_generator();
   }
 
-  static void SetUpTestCase() { TMixin::SetUpTestCase(); }
-  static void TearDownTestCase() { TMixin::TearDownTestCase(); }
-
  private:
   DISALLOW_COPY_AND_ASSIGN(WithInternalIsolateMixin);
 };
@@ -293,9 +209,6 @@ class WithZoneMixin : public TMixin {
 
   Zone* zone() { return &zone_; }
 
-  static void SetUpTestCase() { TMixin::SetUpTestCase(); }
-  static void TearDownTestCase() { TMixin::TearDownTestCase(); }
-
  private:
   v8::internal::AccountingAllocator allocator_;
   Zone zone_;
@@ -303,42 +216,41 @@ class WithZoneMixin : public TMixin {
   DISALLOW_COPY_AND_ASSIGN(WithZoneMixin);
 };
 
-using TestWithIsolate =              //
-    WithInternalIsolateMixin<        //
-        WithIsolateScopeMixin<       //
-            WithSharedIsolateMixin<  //
+using TestWithIsolate =         //
+    WithInternalIsolateMixin<   //
+        WithIsolateScopeMixin<  //
+            WithIsolateMixin<   //
                 ::testing::Test>>>;
 
 using TestWithZone = WithZoneMixin<::testing::Test>;
 
-using TestWithIsolateAndZone =       //
-    WithInternalIsolateMixin<        //
-        WithIsolateScopeMixin<       //
-            WithSharedIsolateMixin<  //
-                WithZoneMixin<       //
+using TestWithIsolateAndZone =  //
+    WithInternalIsolateMixin<   //
+        WithIsolateScopeMixin<  //
+            WithIsolateMixin<   //
+                WithZoneMixin<  //
                     ::testing::Test>>>>;
 
-using TestWithNativeContext =            //
-    WithInternalIsolateMixin<            //
-        WithContextMixin<                //
-            WithIsolateScopeMixin<       //
-                WithSharedIsolateMixin<  //
+using TestWithNativeContext =       //
+    WithInternalIsolateMixin<       //
+        WithContextMixin<           //
+            WithIsolateScopeMixin<  //
+                WithIsolateMixin<   //
                     ::testing::Test>>>>;
 
 using TestWithNativeContextAndCounters =  //
     WithInternalIsolateMixin<             //
         WithContextMixin<                 //
             WithIsolateScopeMixin<        //
-                WithSharedIsolateMixin<   //
-                    ::testing::Test,      //
-                    SharedIsolateAndCountersHolder>>>>;
-
-using TestWithNativeContextAndZone =         //
-    WithZoneMixin<                           //
-        WithInternalIsolateMixin<            //
-            WithContextMixin<                //
-                WithIsolateScopeMixin<       //
-                    WithSharedIsolateMixin<  //
+                WithIsolateMixin<         //
+                    ::testing::Test, kEnableCounters>>>>;
+
+using TestWithNativeContextAndZone =    //
+    WithZoneMixin<                      //
+        WithInternalIsolateMixin<       //
+            WithContextMixin<           //
+                WithIsolateScopeMixin<  //
+                    WithIsolateMixin<   //
                         ::testing::Test>>>>>;
 
 class SaveFlags {
diff --git a/deps/v8/test/unittests/torque/torque-unittest.cc b/deps/v8/test/unittests/torque/torque-unittest.cc
index 778efc7641a..01f321e76d8 100644
--- a/deps/v8/test/unittests/torque/torque-unittest.cc
+++ b/deps/v8/test/unittests/torque/torque-unittest.cc
@@ -70,6 +70,8 @@ type bool generates 'TNode<BoolT>' constexpr 'bool';
 type bint generates 'TNode<BInt>' constexpr 'BInt';
 type string constexpr 'const char*';
 type RawPtr generates 'TNode<RawPtrT>' constexpr 'void*';
+type ExternalPointer
+    generates 'TNode<ExternalPointerT>' constexpr 'ExternalPointer_t';
 type Code extends HeapObject generates 'TNode<Code>';
 type BuiltinPtr extends Smi generates 'TNode<BuiltinPtr>';
 type Context extends HeapObject generates 'TNode<Context>';
@@ -85,6 +87,8 @@ struct float64_or_hole {
 }
 
 extern operator '+' macro IntPtrAdd(intptr, intptr): intptr;
+extern operator '!' macro Word32BinaryNot(bool): bool;
+extern operator '==' macro Word32Equal(int32, int32): bool;
 
 intrinsic %FromConstexpr<To: type, From: type>(b: From): To;
 intrinsic %RawDownCast<To: type, From: type>(x: From): To;
@@ -111,6 +115,13 @@ FromConstexpr<intptr, constexpr int31>(i: constexpr int31): intptr {
 FromConstexpr<intptr, constexpr intptr>(i: constexpr intptr): intptr {
   return %FromConstexpr<intptr>(i);
 }
+extern macro BoolConstant(constexpr bool): bool;
+FromConstexpr<bool, constexpr bool>(b: constexpr bool): bool {
+  return BoolConstant(b);
+}
+FromConstexpr<int32, constexpr int31>(i: constexpr int31): int32 {
+  return %FromConstexpr<int32>(i);
+}
 
 macro Cast<A : type extends Object>(implicit context: Context)(o: Object): A
     labels CastError {
@@ -334,6 +345,22 @@ TEST(Torque, ConstexprLetBindingDoesNotCrash) {
       HasSubstr("Use 'const' instead of 'let' for variable 'foo'"));
 }
 
+TEST(Torque, FailedImplicitCastFromConstexprDoesNotCrash) {
+  ExpectFailingCompilation(
+      R"(
+    extern enum SomeEnum {
+      kValue,
+      ...
+    }
+    macro Foo() {
+      Bar(SomeEnum::kValue);
+    }
+    macro Bar<T: type>(value: T) {}
+  )",
+      HasSubstr(
+          "Cannot find non-constexpr type corresponding to constexpr kValue"));
+}
+
 TEST(Torque, DoubleUnderScorePrefixIllegalForIdentifiers) {
   ExpectFailingCompilation(R"(
     @export macro Foo() {
@@ -625,6 +652,20 @@ TEST(Torque, EnumInTypeswitch) {
       }
     }
   )");
+
+  ExpectSuccessfulCompilation(R"(
+  extern enum MyEnum extends Smi {
+    kA,
+    kB,
+    kC,
+    ...
+  }
+
+  @export
+  macro Test(implicit context: Context)(b: bool): Smi {
+    return b ? MyEnum::kB : MyEnum::kA;
+  }
+)");
 }
 
 TEST(Torque, ConstClassFields) {
@@ -755,6 +796,39 @@ TEST(Torque, References) {
                            HasSubstr("cannot assign to const value"));
 }
 
+TEST(Torque, CatchFirstHandler) {
+  ExpectFailingCompilation(
+      R"(
+    @export
+    macro Test() {
+      try {
+      } label Foo {
+      } catch (e) {}
+    }
+  )",
+      HasSubstr(
+          "catch handler always has to be first, before any label handler"));
+}
+
+TEST(Torque, BitFieldLogicalAnd) {
+  std::string prelude = R"(
+    bitfield struct S extends uint32 {
+      a: bool: 1 bit;
+      b: bool: 1 bit;
+      c: int32: 5 bit;
+    }
+    macro Test(s: S): bool { return
+  )";
+  std::string postlude = ";}";
+  std::string message = "use & rather than &&";
+  ExpectFailingCompilation(prelude + "s.a && s.b" + postlude,
+                           HasSubstr(message));
+  ExpectFailingCompilation(prelude + "s.a && !s.b" + postlude,
+                           HasSubstr(message));
+  ExpectFailingCompilation(prelude + "!s.b && s.c == 34" + postlude,
+                           HasSubstr(message));
+}
+
 }  // namespace torque
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/unittests.status b/deps/v8/test/unittests/unittests.status
index 8d5aac70d93..704a9e4e104 100644
--- a/deps/v8/test/unittests/unittests.status
+++ b/deps/v8/test/unittests/unittests.status
@@ -28,6 +28,9 @@
 ['system == windows and asan', {
   # BUG(893437).
   'Torque*': [SKIP],
+
+  # Hangs on asan.
+  'PageMemoryRegionDeathTest*': [SKIP],
 }],  # system == windows and asan
 
 ['system == windows and arch == x64 and mode == release', {
@@ -48,4 +51,9 @@
   'DecompressionOptimizerTest.*': [SKIP],
 }], # not pointer_compression
 
+################################################################################
+['variant == stress_snapshot', {
+  '*': [SKIP],  # only relevant for mjsunit tests.
+}],
+
 ]
diff --git a/deps/v8/test/unittests/utils/vector-unittest.cc b/deps/v8/test/unittests/utils/vector-unittest.cc
index 75af40d6b5e..6f7d6ccac37 100644
--- a/deps/v8/test/unittests/utils/vector-unittest.cc
+++ b/deps/v8/test/unittests/utils/vector-unittest.cc
@@ -2,7 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <algorithm>
+
 #include "src/utils/utils.h"
+#include "testing/gmock-support.h"
 #include "testing/gtest-support.h"
 
 namespace v8 {
@@ -32,11 +35,11 @@ TEST(VectorTest, Factories) {
 TEST(VectorTest, Equals) {
   auto foo1 = CStrVector("foo");
   auto foo2 = ArrayVector("ffoo") + 1;
-  CHECK_EQ(4, foo2.size());  // Includes trailing '\0'.
+  EXPECT_EQ(4u, foo2.size());  // Includes trailing '\0'.
   foo2.Truncate(foo2.size() - 1);
   // This is a requirement for the test.
-  CHECK_NE(foo1.begin(), foo2.begin());
-  CHECK_EQ(foo1, foo2);
+  EXPECT_NE(foo1.begin(), foo2.begin());
+  EXPECT_EQ(foo1, foo2);
 
   // Compare Vector<char> against Vector<const char>.
   char arr1[] = {'a', 'b', 'c'};
@@ -46,31 +49,48 @@ TEST(VectorTest, Equals) {
   Vector<const char> vec1_const_char = vec1_char;
   Vector<char> vec2_char = ArrayVector(arr2);
   Vector<char> vec3_char = ArrayVector(arr3);
-  CHECK_NE(vec1_char.begin(), vec2_char.begin());
-  // Note: We directly call operator== and operator!= here (without CHECK_EQ or
-  // CHECK_NE) to have full control over the arguments.
-  CHECK(vec1_char == vec1_const_char);
-  CHECK(vec1_char == vec2_char);
-  CHECK(vec1_const_char == vec2_char);
-  CHECK(vec1_const_char != vec3_char);
-  CHECK(vec3_char != vec2_char);
-  CHECK(vec3_char != vec1_const_char);
+  EXPECT_NE(vec1_char.begin(), vec2_char.begin());
+  // Note: We directly call operator== and operator!= here (without EXPECT_EQ or
+  // EXPECT_NE) to have full control over the arguments.
+  EXPECT_TRUE(vec1_char == vec1_const_char);
+  EXPECT_TRUE(vec1_char == vec2_char);
+  EXPECT_TRUE(vec1_const_char == vec2_char);
+  EXPECT_TRUE(vec1_const_char != vec3_char);
+  EXPECT_TRUE(vec3_char != vec2_char);
+  EXPECT_TRUE(vec3_char != vec1_const_char);
 }
 
 TEST(OwnedVectorConstruction, Equals) {
   auto int_vec = OwnedVector<int>::New(4);
-  CHECK_EQ(4, int_vec.size());
+  EXPECT_EQ(4u, int_vec.size());
   auto find_non_zero = [](int i) { return i != 0; };
-  CHECK_EQ(int_vec.end(),
-           std::find_if(int_vec.begin(), int_vec.end(), find_non_zero));
+  EXPECT_EQ(int_vec.end(),
+            std::find_if(int_vec.begin(), int_vec.end(), find_non_zero));
 
   constexpr int kInit[] = {4, 11, 3};
   auto init_vec1 = OwnedVector<int>::Of(kInit);
   // Note: {const int} should also work: We initialize the owned vector, but
   // afterwards it's non-modifyable.
   auto init_vec2 = OwnedVector<const int>::Of(ArrayVector(kInit));
-  CHECK_EQ(init_vec1.as_vector(), ArrayVector(kInit));
-  CHECK_EQ(init_vec1.as_vector(), init_vec2.as_vector());
+  EXPECT_EQ(init_vec1.as_vector(), ArrayVector(kInit));
+  EXPECT_EQ(init_vec1.as_vector(), init_vec2.as_vector());
+}
+
+// Test that the constexpr factory methods work.
+TEST(VectorTest, ConstexprFactories) {
+  static constexpr int kInit1[] = {4, 11, 3};
+  static constexpr auto kVec1 = ArrayVector(kInit1);
+  STATIC_ASSERT(kVec1.size() == 3);
+  EXPECT_THAT(kVec1, testing::ElementsAreArray(kInit1));
+
+  static constexpr auto kVec2 = VectorOf(kInit1, 2);
+  STATIC_ASSERT(kVec2.size() == 2);
+  EXPECT_THAT(kVec2, testing::ElementsAre(4, 11));
+
+  static constexpr const char kInit3[] = "foobar";
+  static constexpr auto kVec3 = StaticCharVector(kInit3);
+  STATIC_ASSERT(kVec3.size() == 6);
+  EXPECT_THAT(kVec3, testing::ElementsAreArray(kInit3, kInit3 + 6));
 }
 
 }  // namespace internal
diff --git a/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc b/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
index e242132a145..486956e20f5 100644
--- a/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
+++ b/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/wasm/leb-helper.h"
 #include "test/unittests/test-utils.h"
 
 #include "src/init/v8.h"
@@ -216,9 +217,9 @@ class TestModuleBuilder {
     return static_cast<byte>(mod.globals.size() - 1);
   }
   byte AddSignature(const FunctionSig* sig) {
-    mod.signatures.push_back(sig);
-    CHECK_LE(mod.signatures.size(), kMaxByteSizedLeb128);
-    return static_cast<byte>(mod.signatures.size() - 1);
+    mod.add_signature(sig);
+    CHECK_LE(mod.types.size(), kMaxByteSizedLeb128);
+    return static_cast<byte>(mod.types.size() - 1);
   }
   byte AddFunction(const FunctionSig* sig, bool declared = true) {
     mod.functions.push_back({sig,         // sig
@@ -238,7 +239,7 @@ class TestModuleBuilder {
   }
   byte AddException(WasmExceptionSig* sig) {
     mod.exceptions.emplace_back(sig);
-    CHECK_LE(mod.signatures.size(), kMaxByteSizedLeb128);
+    CHECK_LE(mod.types.size(), kMaxByteSizedLeb128);
     return static_cast<byte>(mod.exceptions.size() - 1);
   }
 
@@ -2398,6 +2399,7 @@ TEST_F(FunctionBodyDecoderTest, Break_TypeCheck) {
 }
 
 TEST_F(FunctionBodyDecoderTest, Break_TypeCheckAll1) {
+  WASM_FEATURE_SCOPE(anyref);
   for (size_t i = 0; i < arraysize(kValueTypes); i++) {
     for (size_t j = 0; j < arraysize(kValueTypes); j++) {
       ValueType storage[] = {kValueTypes[i], kValueTypes[i], kValueTypes[j]};
@@ -2412,6 +2414,7 @@ TEST_F(FunctionBodyDecoderTest, Break_TypeCheckAll1) {
 }
 
 TEST_F(FunctionBodyDecoderTest, Break_TypeCheckAll2) {
+  WASM_FEATURE_SCOPE(anyref);
   for (size_t i = 0; i < arraysize(kValueTypes); i++) {
     for (size_t j = 0; j < arraysize(kValueTypes); j++) {
       ValueType storage[] = {kValueTypes[i], kValueTypes[i], kValueTypes[j]};
@@ -2426,6 +2429,7 @@ TEST_F(FunctionBodyDecoderTest, Break_TypeCheckAll2) {
 }
 
 TEST_F(FunctionBodyDecoderTest, Break_TypeCheckAll3) {
+  WASM_FEATURE_SCOPE(anyref);
   for (size_t i = 0; i < arraysize(kValueTypes); i++) {
     for (size_t j = 0; j < arraysize(kValueTypes); j++) {
       ValueType storage[] = {kValueTypes[i], kValueTypes[i], kValueTypes[j]};
@@ -2456,6 +2460,7 @@ TEST_F(FunctionBodyDecoderTest, Break_Unify) {
 }
 
 TEST_F(FunctionBodyDecoderTest, BreakIf_cond_type) {
+  WASM_FEATURE_SCOPE(anyref);
   for (size_t i = 0; i < arraysize(kValueTypes); i++) {
     for (size_t j = 0; j < arraysize(kValueTypes); j++) {
       ValueType types[] = {kValueTypes[i], kValueTypes[i], kValueTypes[j]};
@@ -2469,6 +2474,7 @@ TEST_F(FunctionBodyDecoderTest, BreakIf_cond_type) {
 }
 
 TEST_F(FunctionBodyDecoderTest, BreakIf_val_type) {
+  WASM_FEATURE_SCOPE(anyref);
   for (size_t i = 0; i < arraysize(kValueTypes); i++) {
     for (size_t j = 0; j < arraysize(kValueTypes); j++) {
       ValueType types[] = {kValueTypes[i], kValueTypes[i], kValueTypes[j],
@@ -3628,6 +3634,31 @@ class WasmOpcodeLengthTest : public TestWithZone {
     EXPECT_EQ(expected, OpcodeLength(code, code + sizeof(code)))
         << PrintOpcodes{code, code + sizeof...(bytes)};
   }
+
+  // Helper to check for prefixed opcodes, which can have multiple bytes.
+  void ExpectLengthPrefixed(unsigned operands, WasmOpcode opcode) {
+    uint8_t prefix = (opcode >> 8) & 0xff;
+    DCHECK(WasmOpcodes::IsPrefixOpcode(static_cast<WasmOpcode>(prefix)));
+    uint8_t index = opcode & 0xff;
+    uint8_t encoded[2] = {0, 0};
+    uint8_t* p = encoded;
+    unsigned len = static_cast<unsigned>(LEBHelper::sizeof_u32v(index));
+    DCHECK_GE(2, len);
+    LEBHelper::write_u32v(&p, index);
+    // length of index, + number of operands + prefix bye
+    ExpectLength(len + operands + 1, prefix, encoded[0], encoded[1]);
+  }
+
+  template <typename... Bytes>
+  void ExpectFailure(Bytes... bytes) {
+    const byte code[] = {bytes..., 0, 0, 0, 0, 0, 0, 0, 0};
+    WasmFeatures no_features = WasmFeatures::None();
+    WasmDecoder<Decoder::kValidate> decoder(nullptr, no_features, &no_features,
+                                            nullptr, code, code + sizeof(code),
+                                            0);
+    WasmDecoder<Decoder::kValidate>::OpcodeLength(&decoder, code);
+    EXPECT_EQ(decoder.failed(), true);
+  }
 };
 
 TEST_F(WasmOpcodeLengthTest, Statements) {
@@ -3754,17 +3785,20 @@ TEST_F(WasmOpcodeLengthTest, SimpleExpressions) {
 }
 
 TEST_F(WasmOpcodeLengthTest, SimdExpressions) {
-#define TEST_SIMD(name, opcode, sig) \
-  ExpectLength(2, kSimdPrefix, static_cast<byte>(kExpr##name & 0xFF));
+#define TEST_SIMD(name, opcode, sig) ExpectLengthPrefixed(0, kExpr##name);
   FOREACH_SIMD_0_OPERAND_OPCODE(TEST_SIMD)
 #undef TEST_SIMD
-#define TEST_SIMD(name, opcode, sig) \
-  ExpectLength(3, kSimdPrefix, static_cast<byte>(kExpr##name & 0xFF));
+#define TEST_SIMD(name, opcode, sig) ExpectLengthPrefixed(1, kExpr##name);
   FOREACH_SIMD_1_OPERAND_OPCODE(TEST_SIMD)
 #undef TEST_SIMD
-  ExpectLength(18, kSimdPrefix, static_cast<byte>(kExprS8x16Shuffle & 0xFF));
-  // test for bad simd opcode
-  ExpectLength(2, kSimdPrefix, 0xFF);
+  ExpectLengthPrefixed(16, kExprS8x16Shuffle);
+  // test for bad simd opcode, 0xFF is encoded in two bytes.
+  ExpectLength(3, kSimdPrefix, 0xFF, 0x1);
+}
+
+TEST_F(WasmOpcodeLengthTest, IllegalRefIndices) {
+  ExpectFailure(kExprBlock, kLocalRef, U32V_3(kV8MaxWasmTypes + 1));
+  ExpectFailure(kExprBlock, kLocalRef, U32V_4(0x01000000));
 }
 
 using TypesOfLocals = ZoneVector<ValueType>;
@@ -3802,6 +3836,21 @@ TEST_F(LocalDeclDecoderTest, NoLocals) {
   EXPECT_TRUE(decls.type_list.empty());
 }
 
+TEST_F(LocalDeclDecoderTest, WrongLocalDeclsCount1) {
+  static const byte data[] = {1};
+  BodyLocalDecls decls(zone());
+  bool result = DecodeLocalDecls(&decls, data, data + sizeof(data));
+  EXPECT_FALSE(result);
+}
+
+TEST_F(LocalDeclDecoderTest, WrongLocalDeclsCount2) {
+  static const byte data[] = {2, 1,
+                              static_cast<byte>(kWasmI32.value_type_code())};
+  BodyLocalDecls decls(zone());
+  bool result = DecodeLocalDecls(&decls, data, data + sizeof(data));
+  EXPECT_FALSE(result);
+}
+
 TEST_F(LocalDeclDecoderTest, OneLocal) {
   WASM_FEATURE_SCOPE(anyref);
   for (size_t i = 0; i < arraysize(kValueTypes); i++) {
diff --git a/deps/v8/test/unittests/wasm/module-decoder-unittest.cc b/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
index 68a2bb6ff14..fe93210ca7a 100644
--- a/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
+++ b/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
@@ -827,15 +827,15 @@ TEST_F(WasmModuleVerifyTest, MultipleSignatures) {
 
   ModuleResult result = DecodeModule(data, data + sizeof(data));
   EXPECT_OK(result);
-  EXPECT_EQ(3u, result.value()->signatures.size());
-  if (result.value()->signatures.size() == 3) {
-    EXPECT_EQ(0u, result.value()->signatures[0]->return_count());
-    EXPECT_EQ(1u, result.value()->signatures[1]->return_count());
-    EXPECT_EQ(1u, result.value()->signatures[2]->return_count());
-
-    EXPECT_EQ(0u, result.value()->signatures[0]->parameter_count());
-    EXPECT_EQ(1u, result.value()->signatures[1]->parameter_count());
-    EXPECT_EQ(2u, result.value()->signatures[2]->parameter_count());
+  EXPECT_EQ(3u, result.value()->types.size());
+  if (result.value()->types.size() == 3) {
+    EXPECT_EQ(0u, result.value()->signature(0)->return_count());
+    EXPECT_EQ(1u, result.value()->signature(1)->return_count());
+    EXPECT_EQ(1u, result.value()->signature(2)->return_count());
+
+    EXPECT_EQ(0u, result.value()->signature(0)->parameter_count());
+    EXPECT_EQ(1u, result.value()->signature(1)->parameter_count());
+    EXPECT_EQ(2u, result.value()->signature(2)->parameter_count());
   }
 
   EXPECT_OFF_END_FAILURE(data, 1);
@@ -1037,7 +1037,7 @@ TEST_F(WasmModuleVerifyTest, OneIndirectFunction) {
   ModuleResult result = DecodeModule(data, data + sizeof(data));
   EXPECT_OK(result);
   if (result.ok()) {
-    EXPECT_EQ(1u, result.value()->signatures.size());
+    EXPECT_EQ(1u, result.value()->types.size());
     EXPECT_EQ(1u, result.value()->functions.size());
     EXPECT_EQ(1u, result.value()->tables.size());
     EXPECT_EQ(1u, result.value()->tables[0].initial_size);
@@ -1123,7 +1123,7 @@ TEST_F(WasmModuleVerifyTest, OneIndirectFunction_one_entry) {
 
   ModuleResult result = DecodeModule(data, data + sizeof(data));
   EXPECT_OK(result);
-  EXPECT_EQ(1u, result.value()->signatures.size());
+  EXPECT_EQ(1u, result.value()->types.size());
   EXPECT_EQ(1u, result.value()->functions.size());
   EXPECT_EQ(1u, result.value()->tables.size());
   EXPECT_EQ(1u, result.value()->tables[0].initial_size);
@@ -1151,7 +1151,7 @@ TEST_F(WasmModuleVerifyTest, MultipleIndirectFunctions) {
 
   ModuleResult result = DecodeModule(data, data + sizeof(data));
   EXPECT_OK(result);
-  EXPECT_EQ(2u, result.value()->signatures.size());
+  EXPECT_EQ(2u, result.value()->types.size());
   EXPECT_EQ(4u, result.value()->functions.size());
   EXPECT_EQ(1u, result.value()->tables.size());
   EXPECT_EQ(8u, result.value()->tables[0].initial_size);
@@ -1487,10 +1487,9 @@ TEST_F(WasmModuleVerifyTest, TieringCompilationHints) {
   static const byte data[] = {
       SIGNATURES_SECTION(1, SIG_ENTRY_v_v),
       FUNCTION_SIGNATURES_SECTION(3, 0, 0, 0),
-      SECTION_COMPILATION_HINTS(
-          BASELINE_TIER_INTERPRETER | TOP_TIER_BASELINE,
-          BASELINE_TIER_BASELINE | TOP_TIER_OPTIMIZED,
-          BASELINE_TIER_INTERPRETER | TOP_TIER_INTERPRETER),
+      SECTION_COMPILATION_HINTS(BASELINE_TIER_BASELINE | TOP_TIER_BASELINE,
+                                BASELINE_TIER_BASELINE | TOP_TIER_OPTIMIZED,
+                                BASELINE_TIER_OPTIMIZED | TOP_TIER_OPTIMIZED),
       SECTION(Code, ENTRY_COUNT(3), NOP_BODY, NOP_BODY, NOP_BODY),
   };
 
@@ -1500,7 +1499,7 @@ TEST_F(WasmModuleVerifyTest, TieringCompilationHints) {
   EXPECT_EQ(3u, result.value()->compilation_hints.size());
   EXPECT_EQ(WasmCompilationHintStrategy::kDefault,
             result.value()->compilation_hints[0].strategy);
-  EXPECT_EQ(WasmCompilationHintTier::kInterpreter,
+  EXPECT_EQ(WasmCompilationHintTier::kBaseline,
             result.value()->compilation_hints[0].baseline_tier);
   EXPECT_EQ(WasmCompilationHintTier::kBaseline,
             result.value()->compilation_hints[0].top_tier);
@@ -1512,9 +1511,9 @@ TEST_F(WasmModuleVerifyTest, TieringCompilationHints) {
             result.value()->compilation_hints[1].top_tier);
   EXPECT_EQ(WasmCompilationHintStrategy::kDefault,
             result.value()->compilation_hints[2].strategy);
-  EXPECT_EQ(WasmCompilationHintTier::kInterpreter,
+  EXPECT_EQ(WasmCompilationHintTier::kOptimized,
             result.value()->compilation_hints[2].baseline_tier);
-  EXPECT_EQ(WasmCompilationHintTier::kInterpreter,
+  EXPECT_EQ(WasmCompilationHintTier::kOptimized,
             result.value()->compilation_hints[2].top_tier);
 }
 
@@ -2429,26 +2428,40 @@ TEST_F(WasmModuleCustomSectionTest, TwoKnownTwoUnknownSections) {
 
 TEST_F(WasmModuleVerifyTest, SourceMappingURLSection) {
   static const byte data[] = {
+      WASM_MODULE_HEADER,
       SECTION_SRC_MAP('s', 'r', 'c', '/', 'x', 'y', 'z', '.', 'c')};
-  ModuleResult result = DecodeModule(data, data + sizeof(data));
+  ModuleResult result = DecodeModuleNoHeader(data, data + sizeof(data));
   EXPECT_TRUE(result.ok());
-  EXPECT_EQ("src/xyz.c", result.value()->source_map_url);
+  EXPECT_EQ(WasmDebugSymbols::Type::SourceMap,
+            result.value()->debug_symbols.type);
+  ModuleWireBytes wire_bytes(data, data + sizeof(data));
+  WasmName external_url =
+      wire_bytes.GetNameOrNull(result.value()->debug_symbols.external_url);
+  EXPECT_EQ("src/xyz.c", std::string(external_url.data(), external_url.size()));
 }
 
 TEST_F(WasmModuleVerifyTest, BadSourceMappingURLSection) {
   static const byte data[] = {
+      WASM_MODULE_HEADER,
       SECTION_SRC_MAP('s', 'r', 'c', '/', 'x', 0xff, 'z', '.', 'c')};
-  ModuleResult result = DecodeModule(data, data + sizeof(data));
+  ModuleResult result = DecodeModuleNoHeader(data, data + sizeof(data));
   EXPECT_TRUE(result.ok());
-  EXPECT_EQ(0u, result.value()->source_map_url.size());
+  EXPECT_EQ(WasmDebugSymbols::Type::None, result.value()->debug_symbols.type);
+  EXPECT_EQ(0u, result.value()->debug_symbols.external_url.length());
 }
 
 TEST_F(WasmModuleVerifyTest, MultipleSourceMappingURLSections) {
-  static const byte data[] = {SECTION_SRC_MAP('a', 'b', 'c'),
+  static const byte data[] = {WASM_MODULE_HEADER,
+                              SECTION_SRC_MAP('a', 'b', 'c'),
                               SECTION_SRC_MAP('p', 'q', 'r')};
-  ModuleResult result = DecodeModule(data, data + sizeof(data));
+  ModuleResult result = DecodeModuleNoHeader(data, data + sizeof(data));
   EXPECT_TRUE(result.ok());
-  EXPECT_EQ("abc", result.value()->source_map_url);
+  EXPECT_EQ(WasmDebugSymbols::Type::SourceMap,
+            result.value()->debug_symbols.type);
+  ModuleWireBytes wire_bytes(data, data + sizeof(data));
+  WasmName external_url =
+      wire_bytes.GetNameOrNull(result.value()->debug_symbols.external_url);
+  EXPECT_EQ("abc", std::string(external_url.data(), external_url.size()));
 }
 
 TEST_F(WasmModuleVerifyTest, MultipleNameSections) {
diff --git a/deps/v8/test/unittests/wasm/streaming-decoder-unittest.cc b/deps/v8/test/unittests/wasm/streaming-decoder-unittest.cc
index 2c12d0934d3..f3e18196b3a 100644
--- a/deps/v8/test/unittests/wasm/streaming-decoder-unittest.cc
+++ b/deps/v8/test/unittests/wasm/streaming-decoder-unittest.cc
@@ -99,11 +99,11 @@ class WasmStreamingDecoderTest : public ::testing::Test {
                       size_t expected_functions) {
     for (int split = 0; split <= data.length(); ++split) {
       MockStreamingResult result;
-      StreamingDecoder stream(
+      auto stream = StreamingDecoder::CreateAsyncStreamingDecoder(
           std::make_unique<MockStreamingProcessor>(&result));
-      stream.OnBytesReceived(data.SubVector(0, split));
-      stream.OnBytesReceived(data.SubVector(split, data.length()));
-      stream.Finish();
+      stream->OnBytesReceived(data.SubVector(0, split));
+      stream->OnBytesReceived(data.SubVector(split, data.length()));
+      stream->Finish();
       EXPECT_TRUE(result.ok());
       EXPECT_EQ(expected_sections, result.num_sections);
       EXPECT_EQ(expected_functions, result.num_functions);
@@ -115,11 +115,11 @@ class WasmStreamingDecoderTest : public ::testing::Test {
                      const char* message) {
     for (int split = 0; split <= data.length(); ++split) {
       MockStreamingResult result;
-      StreamingDecoder stream(
+      auto stream = StreamingDecoder::CreateAsyncStreamingDecoder(
           std::make_unique<MockStreamingProcessor>(&result));
-      stream.OnBytesReceived(data.SubVector(0, split));
-      stream.OnBytesReceived(data.SubVector(split, data.length()));
-      stream.Finish();
+      stream->OnBytesReceived(data.SubVector(0, split));
+      stream->OnBytesReceived(data.SubVector(split, data.length()));
+      stream->Finish();
       EXPECT_FALSE(result.ok());
       EXPECT_EQ(error_offset, result.error.offset());
       EXPECT_EQ(message, result.error.message());
@@ -129,8 +129,9 @@ class WasmStreamingDecoderTest : public ::testing::Test {
 
 TEST_F(WasmStreamingDecoderTest, EmptyStream) {
   MockStreamingResult result;
-  StreamingDecoder stream(std::make_unique<MockStreamingProcessor>(&result));
-  stream.Finish();
+  auto stream = StreamingDecoder::CreateAsyncStreamingDecoder(
+      std::make_unique<MockStreamingProcessor>(&result));
+  stream->Finish();
   EXPECT_FALSE(result.ok());
 }
 
@@ -138,9 +139,10 @@ TEST_F(WasmStreamingDecoderTest, IncompleteModuleHeader) {
   const uint8_t data[] = {U32_LE(kWasmMagic), U32_LE(kWasmVersion)};
   {
     MockStreamingResult result;
-    StreamingDecoder stream(std::make_unique<MockStreamingProcessor>(&result));
-    stream.OnBytesReceived(VectorOf(data, 1));
-    stream.Finish();
+    auto stream = StreamingDecoder::CreateAsyncStreamingDecoder(
+        std::make_unique<MockStreamingProcessor>(&result));
+    stream->OnBytesReceived(VectorOf(data, 1));
+    stream->Finish();
     EXPECT_FALSE(result.ok());
   }
   for (uint32_t length = 1; length < sizeof(data); ++length) {
diff --git a/deps/v8/test/unittests/wasm/wasm-code-manager-unittest.cc b/deps/v8/test/unittests/wasm/wasm-code-manager-unittest.cc
index e0abf7adb4f..7311ad39e88 100644
--- a/deps/v8/test/unittests/wasm/wasm-code-manager-unittest.cc
+++ b/deps/v8/test/unittests/wasm/wasm-code-manager-unittest.cc
@@ -71,8 +71,8 @@ TEST_F(DisjointAllocationPoolTest, SimpleExtract) {
   a.Merge(b);
   CheckPool(a, {{1, 4}});
   CHECK_EQ(a.regions().size(), 1);
-  CHECK_EQ(a.regions().front().begin(), 1);
-  CHECK_EQ(a.regions().front().end(), 5);
+  CHECK_EQ(a.regions().begin()->begin(), 1);
+  CHECK_EQ(a.regions().begin()->end(), 5);
 }
 
 TEST_F(DisjointAllocationPoolTest, ExtractAll) {
@@ -111,6 +111,18 @@ TEST_F(DisjointAllocationPoolTest, Merging) {
   CheckPool(a, {{10, 15}});
 }
 
+TEST_F(DisjointAllocationPoolTest, MergingFirst) {
+  DisjointAllocationPool a = Make({{10, 5}, {20, 5}});
+  a.Merge({5, 5});
+  CheckPool(a, {{5, 10}, {20, 5}});
+}
+
+TEST_F(DisjointAllocationPoolTest, MergingAbove) {
+  DisjointAllocationPool a = Make({{10, 5}, {25, 5}});
+  a.Merge({20, 5});
+  CheckPool(a, {{10, 5}, {20, 10}});
+}
+
 TEST_F(DisjointAllocationPoolTest, MergingMore) {
   DisjointAllocationPool a = Make({{10, 5}, {20, 5}, {30, 5}});
   a.Merge({15, 5});
diff --git a/deps/v8/test/unittests/wasm/wasm-gdbserver-unittest.cc b/deps/v8/test/unittests/wasm/wasm-gdbserver-unittest.cc
new file mode 100644
index 00000000000..3d011f4b062
--- /dev/null
+++ b/deps/v8/test/unittests/wasm/wasm-gdbserver-unittest.cc
@@ -0,0 +1,275 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <string>
+
+#include "src/debug/wasm/gdb-server/packet.h"
+#include "src/debug/wasm/gdb-server/session.h"
+#include "src/debug/wasm/gdb-server/transport.h"
+#include "test/unittests/test-utils.h"
+#include "testing/gmock/include/gmock/gmock.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+namespace gdb_server {
+
+using ::testing::_;
+using ::testing::Return;
+using ::testing::SetArrayArgument;
+using ::testing::StrEq;
+
+class WasmGdbRemoteTest : public ::testing::Test {};
+
+TEST_F(WasmGdbRemoteTest, GdbRemotePacketAddChars) {
+  Packet packet;
+
+  // Read empty packet
+  bool end_of_packet = packet.EndOfPacket();
+  EXPECT_TRUE(end_of_packet);
+
+  // Add raw chars
+  packet.AddRawChar('4');
+  packet.AddRawChar('2');
+
+  std::string str;
+  packet.GetString(&str);
+  EXPECT_EQ("42", str);
+}
+
+TEST_F(WasmGdbRemoteTest, GdbRemotePacketAddBlock) {
+  static const uint8_t block[] = {0x01, 0x02, 0x03, 0x04, 0x05,
+                                  0x06, 0x07, 0x08, 0x09};
+  static const size_t kLen = sizeof(block) / sizeof(uint8_t);
+  Packet packet;
+  packet.AddBlock(block, kLen);
+
+  uint8_t buffer[kLen];
+  bool ok = packet.GetBlock(buffer, kLen);
+  EXPECT_TRUE(ok);
+  EXPECT_EQ(0, memcmp(block, buffer, kLen));
+
+  packet.Rewind();
+  std::string str;
+  ok = packet.GetString(&str);
+  EXPECT_TRUE(ok);
+  EXPECT_EQ("010203040506070809", str);
+}
+
+TEST_F(WasmGdbRemoteTest, GdbRemotePacketAddString) {
+  Packet packet;
+  packet.AddHexString("foobar");
+
+  std::string str;
+  bool ok = packet.GetString(&str);
+  EXPECT_TRUE(ok);
+  EXPECT_EQ("666f6f626172", str);
+
+  packet.Clear();
+  packet.AddHexString("GDB");
+  ok = packet.GetString(&str);
+  EXPECT_TRUE(ok);
+  EXPECT_EQ("474442", str);
+}
+
+TEST_F(WasmGdbRemoteTest, GdbRemotePacketAddNumbers) {
+  Packet packet;
+
+  static const uint64_t u64_val = 0xdeadbeef89abcdef;
+  static const uint8_t u8_val = 0x42;
+  packet.AddNumberSep(u64_val, ';');
+  packet.AddWord8(u8_val);
+
+  std::string str;
+  packet.GetString(&str);
+  EXPECT_EQ("deadbeef89abcdef;42", str);
+
+  packet.Rewind();
+  uint64_t val = 0;
+  char sep = '\0';
+  bool ok = packet.GetNumberSep(&val, &sep);
+  EXPECT_TRUE(ok);
+  EXPECT_EQ(u64_val, val);
+  uint8_t b = 0;
+  ok = packet.GetWord8(&b);
+  EXPECT_TRUE(ok);
+  EXPECT_EQ(u8_val, b);
+}
+
+TEST_F(WasmGdbRemoteTest, GdbRemotePacketSequenceNumber) {
+  Packet packet_with_sequence_num;
+  packet_with_sequence_num.AddWord8(42);
+  packet_with_sequence_num.AddRawChar(':');
+  packet_with_sequence_num.AddHexString("foobar");
+
+  int32_t sequence_num = 0;
+  packet_with_sequence_num.ParseSequence();
+  bool ok = packet_with_sequence_num.GetSequence(&sequence_num);
+  EXPECT_TRUE(ok);
+  EXPECT_EQ(42, sequence_num);
+
+  Packet packet_without_sequence_num;
+  packet_without_sequence_num.AddHexString("foobar");
+
+  packet_without_sequence_num.ParseSequence();
+  ok = packet_without_sequence_num.GetSequence(&sequence_num);
+  EXPECT_FALSE(ok);
+}
+
+TEST_F(WasmGdbRemoteTest, GdbRemotePacketRunLengthEncoded) {
+  Packet packet1;
+  packet1.AddRawChar('0');
+  packet1.AddRawChar('*');
+  packet1.AddRawChar(' ');
+
+  std::string str1;
+  bool ok = packet1.GetHexString(&str1);
+  EXPECT_TRUE(ok);
+  EXPECT_EQ("0000", std::string(packet1.GetPayload()));
+
+  Packet packet2;
+  packet2.AddRawChar('1');
+  packet2.AddRawChar('2');
+  packet2.AddRawChar('3');
+  packet2.AddRawChar('*');
+  packet2.AddRawChar(' ');
+  packet2.AddRawChar('a');
+  packet2.AddRawChar('b');
+
+  std::string str2;
+  ok = packet2.GetHexString(&str2);
+  EXPECT_TRUE(ok);
+  EXPECT_EQ("123333ab", std::string(packet2.GetPayload()));
+}
+
+TEST_F(WasmGdbRemoteTest, GdbRemoteUtilStringSplit) {
+  std::vector<std::string> parts1 = StringSplit({}, ",");
+  EXPECT_EQ(size_t(0), parts1.size());
+
+  auto parts2 = StringSplit("a", nullptr);
+  EXPECT_EQ(size_t(1), parts2.size());
+  EXPECT_EQ("a", parts2[0]);
+
+  auto parts3 = StringSplit(";a;bc;def;", ",");
+  EXPECT_EQ(size_t(1), parts3.size());
+  EXPECT_EQ(";a;bc;def;", parts3[0]);
+
+  auto parts4 = StringSplit(";a;bc;def;", ";");
+  EXPECT_EQ(size_t(3), parts4.size());
+  EXPECT_EQ("a", parts4[0]);
+  EXPECT_EQ("bc", parts4[1]);
+  EXPECT_EQ("def", parts4[2]);
+}
+
+class MockTransport : public TransportBase {
+ public:
+  MOCK_METHOD0(AcceptConnection, bool());
+  MOCK_METHOD2(Read, bool(char*, int32_t));
+  MOCK_METHOD2(Write, bool(const char*, int32_t));
+  MOCK_METHOD0(IsDataAvailable, bool());
+  MOCK_CONST_METHOD0(IsDataAvailable, bool());
+  MOCK_METHOD0(Disconnect, void());
+  MOCK_METHOD0(Close, void());
+  MOCK_METHOD0(WaitForDebugStubEvent, void());
+  MOCK_METHOD0(SignalThreadEvent, bool());
+};
+
+TEST_F(WasmGdbRemoteTest, GdbRemoteSessionSendPacket) {
+  const char* ack_buffer = "+";
+
+  MockTransport mock_transport;
+  EXPECT_CALL(mock_transport, Write(StrEq("$474442#39"), 10))
+      .WillOnce(Return(true));
+  EXPECT_CALL(mock_transport, Read(_, _))
+      .Times(1)
+      .WillOnce(
+          DoAll(SetArrayArgument<0>(ack_buffer, ack_buffer + 1), Return(true)));
+
+  Session session(&mock_transport);
+
+  Packet packet;
+  packet.AddHexString("GDB");
+  bool ok = session.SendPacket(&packet);
+  EXPECT_TRUE(ok);
+}
+
+TEST_F(WasmGdbRemoteTest, GdbRemoteSessionSendPacketDisconnectOnNoAck) {
+  MockTransport mock_transport;
+  EXPECT_CALL(mock_transport, Write(StrEq("$474442#39"), 10))
+      .Times(1)
+      .WillOnce(Return(true));
+  EXPECT_CALL(mock_transport, Read(_, _)).Times(1).WillOnce(Return(false));
+  EXPECT_CALL(mock_transport, Disconnect()).Times(1);
+
+  Session session(&mock_transport);
+
+  Packet packet;
+  packet.AddHexString("GDB");
+  bool ok = session.SendPacket(&packet);
+  EXPECT_FALSE(ok);
+}
+
+TEST_F(WasmGdbRemoteTest, GdbRemoteSessionGetPacketCheckChecksum) {
+  const char* buffer_bad = "$47#00";
+  const char* buffer_ok = "$47#6b";
+
+  MockTransport mock_transport;
+  EXPECT_CALL(mock_transport, Read(_, _))
+      .WillOnce(
+          DoAll(SetArrayArgument<0>(buffer_bad, buffer_bad + 1), Return(true)))
+      .WillOnce(DoAll(SetArrayArgument<0>(buffer_bad + 1, buffer_bad + 2),
+                      Return(true)))
+      .WillOnce(DoAll(SetArrayArgument<0>(buffer_bad + 2, buffer_bad + 3),
+                      Return(true)))
+      .WillOnce(DoAll(SetArrayArgument<0>(buffer_bad + 3, buffer_bad + 4),
+                      Return(true)))
+      .WillOnce(DoAll(SetArrayArgument<0>(buffer_bad + 4, buffer_bad + 5),
+                      Return(true)))
+      .WillOnce(DoAll(SetArrayArgument<0>(buffer_bad + 5, buffer_bad + 6),
+                      Return(true)))
+      .WillOnce(
+          DoAll(SetArrayArgument<0>(buffer_ok, buffer_ok + 1), Return(true)))
+      .WillOnce(DoAll(SetArrayArgument<0>(buffer_ok + 1, buffer_ok + 2),
+                      Return(true)))
+      .WillOnce(DoAll(SetArrayArgument<0>(buffer_ok + 2, buffer_ok + 3),
+                      Return(true)))
+      .WillOnce(DoAll(SetArrayArgument<0>(buffer_ok + 3, buffer_ok + 4),
+                      Return(true)))
+      .WillOnce(DoAll(SetArrayArgument<0>(buffer_ok + 4, buffer_ok + 5),
+                      Return(true)))
+      .WillOnce(DoAll(SetArrayArgument<0>(buffer_ok + 5, buffer_ok + 6),
+                      Return(true)));
+  EXPECT_CALL(mock_transport, Write(StrEq("-"), 1))  // Signal bad packet
+      .Times(1)
+      .WillOnce(Return(true));
+  EXPECT_CALL(mock_transport, Write(StrEq("+"), 1))  // Signal ack
+      .Times(1)
+      .WillOnce(Return(true));
+
+  Session session(&mock_transport);
+
+  Packet packet;
+  bool ok = session.GetPacket(&packet);
+  EXPECT_TRUE(ok);
+  char ch;
+  ok = packet.GetBlock(&ch, 1);
+  EXPECT_TRUE(ok);
+  EXPECT_EQ('G', ch);
+}
+
+TEST_F(WasmGdbRemoteTest, GdbRemoteSessionGetPacketDisconnectOnReadFailure) {
+  MockTransport mock_transport;
+  EXPECT_CALL(mock_transport, Read(_, _)).Times(1).WillOnce(Return(false));
+  EXPECT_CALL(mock_transport, Disconnect()).Times(1);
+
+  Session session(&mock_transport);
+  Packet packet;
+  bool ok = session.GetPacket(&packet);
+  EXPECT_FALSE(ok);
+}
+
+}  // namespace gdb_server
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/unittests/wasm/wasm-opcodes-unittest.cc b/deps/v8/test/unittests/wasm/wasm-opcodes-unittest.cc
deleted file mode 100644
index 12739ff44fc..00000000000
--- a/deps/v8/test/unittests/wasm/wasm-opcodes-unittest.cc
+++ /dev/null
@@ -1,35 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "test/unittests/test-utils.h"
-
-#include "src/wasm/wasm-opcodes.h"
-
-namespace v8 {
-namespace internal {
-namespace wasm {
-
-class WasmOpcodesTest : public TestWithZone {};
-
-TEST_F(WasmOpcodesTest, EveryOpcodeHasAName) {
-  static const struct {
-    WasmOpcode opcode;
-    const char* debug_name;
-  } kValues[] = {
-#define DECLARE_ELEMENT(name, opcode, sig) {kExpr##name, "kExpr" #name},
-      FOREACH_OPCODE(DECLARE_ELEMENT)};
-#undef DECLARE_ELEMENT
-
-  for (size_t i = 0; i < arraysize(kValues); i++) {
-    const char* result = WasmOpcodes::OpcodeName(kValues[i].opcode);
-    if (strcmp("unknown", result) == 0) {
-      EXPECT_TRUE(false) << "WasmOpcodes::OpcodeName(" << kValues[i].debug_name
-                         << ") == \"unknown\";"
-                            " plazz halp in src/wasm/wasm-opcodes.cc";
-    }
-  }
-}
-}  // namespace wasm
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/test/wasm-api-tests/callbacks.cc b/deps/v8/test/wasm-api-tests/callbacks.cc
index 350a425d474..8d53b767bd1 100644
--- a/deps/v8/test/wasm-api-tests/callbacks.cc
+++ b/deps/v8/test/wasm-api-tests/callbacks.cc
@@ -31,8 +31,8 @@ own<Trap> Stage4_GC(void* env, const Val args[], Val results[]) {
   printf("Stage4...\n");
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(env);
   isolate->heap()->PreciseCollectAllGarbage(
-      i::Heap::kNoGCFlags, i::GarbageCollectionReason::kTesting,
-      v8::kGCCallbackFlagForced);
+      i::Heap::kForcedGC, i::GarbageCollectionReason::kTesting,
+      v8::kNoGCCallbackFlags);
   results[0] = Val::i32(args[0].i32() + 1);
   return nullptr;
 }
diff --git a/deps/v8/test/wasm-api-tests/wasm-api-tests.status b/deps/v8/test/wasm-api-tests/wasm-api-tests.status
index a5d554103fb..05488c17115 100644
--- a/deps/v8/test/wasm-api-tests/wasm-api-tests.status
+++ b/deps/v8/test/wasm-api-tests/wasm-api-tests.status
@@ -3,9 +3,15 @@
 # found in the LICENSE file.
 
 [
+
 ['lite_mode or variant == jitless', {
   # TODO(v8:7777): Re-enable once wasm is supported in jitless mode.
   '*': [SKIP],
 }], # lite_mode or variant == jitless
 
+################################################################################
+['variant == stress_snapshot', {
+  '*': [SKIP],  # only relevant for mjsunit tests.
+}],
+
 ]
diff --git a/deps/v8/test/wasm-js/testcfg.py b/deps/v8/test/wasm-js/testcfg.py
index a4cb262c33a..61e55477f9c 100644
--- a/deps/v8/test/wasm-js/testcfg.py
+++ b/deps/v8/test/wasm-js/testcfg.py
@@ -31,10 +31,6 @@
                     'name': 'JS-BigInt-integration',
                     'flags': ['--experimental-wasm-bigint']
                   },
-                  {
-                    'name': 'multi-value',
-                    'flags': ['--experimental-wasm-mv']
-                  },
                   ]
 
 
diff --git a/deps/v8/test/wasm-js/tests.tar.gz.sha1 b/deps/v8/test/wasm-js/tests.tar.gz.sha1
index a1ad6de73fb..7b232024e92 100644
--- a/deps/v8/test/wasm-js/tests.tar.gz.sha1
+++ b/deps/v8/test/wasm-js/tests.tar.gz.sha1
@@ -1 +1 @@
-6e091ed0e8ef57cdbfa46265b0001f19e3bb0f20
\ No newline at end of file
+4ed8451098f61230e9675a3e92568f29419cc11d
\ No newline at end of file
diff --git a/deps/v8/test/wasm-js/wasm-js.status b/deps/v8/test/wasm-js/wasm-js.status
index b8fe4c068a7..d1d0ab5b1c2 100644
--- a/deps/v8/test/wasm-js/wasm-js.status
+++ b/deps/v8/test/wasm-js/wasm-js.status
@@ -3,16 +3,54 @@
 # found in the LICENSE file.
 
 [
+
 [ALWAYS, {
+  # TODO(v8:10556): Remove sub-typing in the reference-types implementation
+  'constructor/compile': [FAIL],
+  'constructor/instantiate-bad-imports': [FAIL],
+  'constructor/instantiate': [FAIL],
+  'constructor/multi-value': [FAIL],
+  'constructor/validate': [FAIL],
+  'global/constructor': [FAIL],
+  'global/value-get-set': [FAIL],
+  'global/valueOf': [FAIL],
+  'global/toString': [FAIL],
+  'instance/constructor-bad-imports': [FAIL],
+  'instance/constructor-caching': [FAIL],
+  'instance/constructor': [FAIL],
+  'instance/exports': [FAIL],
+  'instance/toString': [FAIL],
+  'interface': [FAIL],
+  'memory/toString': [FAIL],
+  'memory/grow': [FAIL],
+  'memory/buffer': [FAIL],
+  'memory/constructor': [FAIL],
+  'module/constructor': [FAIL],
+  'module/customSections': [FAIL],
+  'module/exports': [FAIL],
+  'module/imports': [FAIL],
+  'module/toString': [FAIL],
+  'proposals/JS-BigInt-integration/global/value-get-set': [FAIL],
+  'proposals/JS-BigInt-integration/global/constructor': [FAIL],
+  'proposals/js-types/constructor/instantiate': [FAIL],
+  'proposals/js-types/instance/constructor': [FAIL],
+  'prototypes': [FAIL],
+  'table/constructor': [FAIL],
+  'table/get-set': [FAIL],
+  'table/grow': [FAIL],
+  'table/length': [FAIL],
+  'table/toString': [FAIL],
+
   # These are slow, and not useful to run for the proposals:
   'proposals/reference-types/limits': [SKIP],
-  'proposals/multi-value/limits': [SKIP],
   'proposals/bulk-memory-operations/limits': [SKIP],
   'proposals/JS-BigInt-integration/limits': [SKIP],
   'proposals/js-types/limits': [SKIP],
   # TODO(v8:9673): Enable these spec tests once they exist, and the out-dated
   # tests have been removed.
   'proposals/JS-BigInt-integration/module/params-long': [FAIL],
+  # TODO(wasm): Update memory limit.
+  'limits': [FAIL],
 }], # ALWAYS
 
 ['arch == s390 or arch == s390x or system == aix', {
@@ -33,4 +71,9 @@
   '*': [SKIP],
 }], # lite_mode or variant == jitless
 
+################################################################################
+['variant == stress_snapshot', {
+  '*': [SKIP],  # only relevant for mjsunit tests.
+}],
+
 ]
diff --git a/deps/v8/test/wasm-spec-tests/testcfg.py b/deps/v8/test/wasm-spec-tests/testcfg.py
index 29c80e8ddcb..a7049965632 100644
--- a/deps/v8/test/wasm-spec-tests/testcfg.py
+++ b/deps/v8/test/wasm-spec-tests/testcfg.py
@@ -9,11 +9,13 @@
 
 proposal_flags = [{
                     'name': 'reference-types',
-                    'flags': ['--experimental-wasm-anyref']
+                    'flags': ['--experimental-wasm-anyref',
+                              '--wasm-staging']
                   },
                   {
                     'name': 'bulk-memory-operations',
-                    'flags': ['--experimental-wasm-bulk-memory']
+                    'flags': ['--experimental-wasm-bulk-memory',
+                              '--wasm-staging']
                   },
                   {
                     'name': 'js-types',
@@ -24,11 +26,6 @@
                     'name': 'JS-BigInt-integration',
                     'flags': ['--experimental-wasm-bigint']
                   },
-                  {
-                    'name': 'multi-value',
-                    'flags': ['--experimental-wasm-mv',
-                              '--no-experimental-wasm-bulk-memory']
-                  },
                   ]
 
 class TestLoader(testsuite.JSTestLoader):
@@ -54,7 +51,8 @@ def _get_source_flags(self):
     for proposal in proposal_flags:
       if os.sep.join(['proposals', proposal['name']]) in self.path:
         return proposal['flags']
-    return []
+    # TODO(thibaudm): Remove the flag once multi-value is shipped in V8.
+    return ['--experimental-wasm-mv']
 
 
 def GetSuite(*args, **kwargs):
diff --git a/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1 b/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1
index 9f6ff04f646..896bf076d08 100644
--- a/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1
+++ b/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1
@@ -1 +1 @@
-acdfb34955e3b0e5031890aebaf552782f38f0f3
\ No newline at end of file
+427b76df2465c910c3f849291bb3b449b3aac30b
\ No newline at end of file
diff --git a/deps/v8/test/wasm-spec-tests/wasm-spec-tests.status b/deps/v8/test/wasm-spec-tests/wasm-spec-tests.status
index 84daefc36d5..5fb5a2a530c 100644
--- a/deps/v8/test/wasm-spec-tests/wasm-spec-tests.status
+++ b/deps/v8/test/wasm-spec-tests/wasm-spec-tests.status
@@ -20,10 +20,29 @@
   'proposals/js-types/globals': [FAIL],
   'proposals/js-types/linking': [FAIL],
 
-  # TODO(thibaudm): Spec tests do not check multi-return functions correctly.
-  'proposals/multi-value/call': [FAIL],
-  'proposals/multi-value/if': [FAIL],
-  'proposals/multi-value/func': [FAIL],
+  # TODO(v8:10556): Remove sub-typing in the reference-types implementation
+  'proposals/bulk-memory-operations/binary': [FAIL],
+  'proposals/bulk-memory-operations/bulk': [FAIL],
+  'proposals/bulk-memory-operations/elem': [FAIL],
+  'proposals/bulk-memory-operations/imports': [FAIL],
+
+  'proposals/reference-types/binary': [FAIL],
+  'proposals/reference-types/bulk': [FAIL],
+  'proposals/reference-types/elem': [FAIL],
+  'proposals/reference-types/global': [FAIL],
+  'proposals/reference-types/linking': [FAIL],
+  'proposals/reference-types/ref_func': [FAIL],
+  'proposals/reference-types/ref_is_null': [FAIL],
+  'proposals/reference-types/ref_null': [FAIL],
+  'proposals/reference-types/table_get': [FAIL],
+  'proposals/reference-types/table_grow': [FAIL],
+  'proposals/reference-types/table_set': [FAIL],
+  'proposals/reference-types/table_size': [FAIL],
+  'proposals/reference-types/unreached-invalid': [FAIL],
+
+  # TODO(wasm): This test declares a table larger than allowed by the spec.
+  'table': [FAIL],
+  'proposals/reference-types/table': [FAIL],
 }],  # ALWAYS
 
 ['arch == mipsel or arch == mips64el or arch == mips or arch == mips64', {
@@ -47,13 +66,10 @@
   'proposals/JS-BigInt-integration/f64': [SKIP],
   'proposals/bulk-memory-operations/f32': [SKIP],
   'proposals/bulk-memory-operations/f64': [SKIP],
-  'proposals/multi-value/f32': [SKIP],
-  'proposals/multi-value/f64': [SKIP],
   'proposals/reference-types/f32': [SKIP],
   'proposals/reference-types/f64': [SKIP],
   'proposals/JS-BigInt-integration/float_misc': [SKIP],
   'proposals/bulk-memory-operations/float_misc': [SKIP],
-  'proposals/multi-value/float_misc': [SKIP],
   'proposals/reference-types/float_misc': [SKIP],
 }],  # 'arch == mipsel or arch == mips64el or arch == mips or arch == mips64'
 
@@ -73,8 +89,6 @@
   'proposals/JS-BigInt-integration/f64': [SKIP],
   'proposals/bulk-memory-operations/f32': [SKIP],
   'proposals/bulk-memory-operations/f64': [SKIP],
-  'proposals/multi-value/f32': [SKIP],
-  'proposals/multi-value/f64': [SKIP],
   'proposals/reference-types/f32': [SKIP],
   'proposals/reference-types/f64': [SKIP],
   # This test fails because ppc float to double doesn't convert sNaN to qNaN.
@@ -82,7 +96,6 @@
   'proposals/js-types/conversions': [SKIP],
   'proposals/JS-BigInt-integration/conversions': [SKIP],
   'proposals/bulk-memory-operations/conversions': [SKIP],
-  'proposals/multi-value/conversions': [SKIP],
   'proposals/reference-types/conversions':  [SKIP],
 }],  # 'arch == ppc or arch == ppc64'
 
@@ -96,8 +109,6 @@
   'proposals/JS-BigInt-integration/f64': [SKIP],
   'proposals/bulk-memory-operations/f32': [SKIP],
   'proposals/bulk-memory-operations/f64': [SKIP],
-  'proposals/multi-value/f32': [SKIP],
-  'proposals/multi-value/f64': [SKIP],
   'proposals/reference-types/f32': [SKIP],
   'proposals/reference-types/f64': [SKIP],
 }],  # 'arch == s390 or arch == s390x'
@@ -108,5 +119,9 @@
   '*': [SKIP],
 }], # lite_mode or variant == jitless
 
+################################################################################
+['variant == stress_snapshot', {
+  '*': [SKIP],  # only relevant for mjsunit tests.
+}],
 
 ]
diff --git a/deps/v8/test/webkit/webkit.status b/deps/v8/test/webkit/webkit.status
index b2938c89214..162d843bda2 100644
--- a/deps/v8/test/webkit/webkit.status
+++ b/deps/v8/test/webkit/webkit.status
@@ -136,5 +136,9 @@
   'fast/js/string-capitalization': [FAIL],
 }],  # variant == no_wasm_traps
 
-##############################################################################
+################################################################################
+['variant == stress_snapshot', {
+  '*': [SKIP],  # only relevant for mjsunit tests.
+}],
+
 ]
diff --git a/deps/v8/testing/gmock/BUILD.gn b/deps/v8/testing/gmock/BUILD.gn
index 0e203cb6eee..de5ae539093 100644
--- a/deps/v8/testing/gmock/BUILD.gn
+++ b/deps/v8/testing/gmock/BUILD.gn
@@ -12,13 +12,10 @@ source_set("gmock") {
   testonly = true
   sources = [
     "include/gmock/gmock-actions.h",
-    "include/gmock/gmock-generated-function-mockers.h",
     "include/gmock/gmock-matchers.h",
     "include/gmock/gmock.h",
   ]
-  deps = [
-    "//third_party/googletest:gmock",
-  ]
+  deps = [ "//third_party/googletest:gmock" ]
 
   public_configs = [
     "//third_party/googletest:gmock_config",
@@ -31,7 +28,5 @@ source_set("gmock") {
 # into //third_party/googletest.
 source_set("gmock_main") {
   testonly = true
-  deps = [
-    "//third_party/googletest:gmock_main",
-  ]
+  deps = [ "//third_party/googletest:gmock_main" ]
 }
diff --git a/deps/v8/testing/gmock/include/gmock/gmock-generated-function-mockers.h b/deps/v8/testing/gmock/include/gmock/gmock-generated-function-mockers.h
deleted file mode 100644
index b9986c7b11b..00000000000
--- a/deps/v8/testing/gmock/include/gmock/gmock-generated-function-mockers.h
+++ /dev/null
@@ -1,10 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// The file/directory layout of Google Test is not yet considered stable. Until
-// it stabilizes, Chromium code will use forwarding headers in testing/gtest
-// and testing/gmock, instead of directly including files in
-// third_party/googletest.
-
-#include "third_party/googletest/src/googlemock/include/gmock/gmock-generated-function-mockers.h"
diff --git a/deps/v8/third_party/googletest/BUILD.gn b/deps/v8/third_party/googletest/BUILD.gn
index f105d1a6b45..cfa9205547d 100644
--- a/deps/v8/third_party/googletest/BUILD.gn
+++ b/deps/v8/third_party/googletest/BUILD.gn
@@ -96,8 +96,8 @@ source_set("gtest") {
 
   if (is_fuchsia) {
     deps += [
-      "//third_party/fuchsia-sdk/sdk:fdio",
-      "//third_party/fuchsia-sdk/sdk:zx",
+      "//third_party/fuchsia-sdk/sdk/pkg/fdio",
+      "//third_party/fuchsia-sdk/sdk/pkg/zx",
     ]
   }
 }
@@ -106,12 +106,8 @@ source_set("gtest") {
 # See README.chromium for details.
 source_set("gtest_main") {
   testonly = true
-  sources = [
-    "src/googletest/src/gtest_main.cc",
-  ]
-  deps = [
-    ":gtest",
-  ]
+  sources = [ "src/googletest/src/gtest_main.cc" ]
+  deps = [ ":gtest" ]
 }
 
 # Do NOT depend on this directly. Use //testing/gmock:gmock_main instead.
@@ -123,8 +119,6 @@ source_set("gmock") {
     "src/googlemock/include/gmock/gmock-cardinalities.h",
     "src/googlemock/include/gmock/gmock-function-mocker.h",
     "src/googlemock/include/gmock/gmock-generated-actions.h",
-    "src/googlemock/include/gmock/gmock-generated-function-mockers.h",
-    "src/googlemock/include/gmock/gmock-generated-matchers.h",
     "src/googlemock/include/gmock/gmock-generated-nice-strict.h",
     "src/googlemock/include/gmock/gmock-matchers.h",
     "src/googlemock/include/gmock/gmock-more-actions.h",
@@ -158,10 +152,6 @@ source_set("gmock") {
 # See README.chromium for details.
 static_library("gmock_main") {
   testonly = true
-  sources = [
-    "src/googlemock/src/gmock_main.cc",
-  ]
-  deps = [
-    ":gmock",
-  ]
+  sources = [ "src/googlemock/src/gmock_main.cc" ]
+  deps = [ ":gmock" ]
 }
diff --git a/deps/v8/third_party/jinja2/README.chromium b/deps/v8/third_party/jinja2/README.chromium
index 5246c2f84b6..9b8311a6751 100644
--- a/deps/v8/third_party/jinja2/README.chromium
+++ b/deps/v8/third_party/jinja2/README.chromium
@@ -2,6 +2,7 @@ Name: Jinja2 Python Template Engine
 Short Name: jinja2
 URL: http://jinja.pocoo.org/
 Version: 2.10
+CPEPrefix: cpe:/a:pocoo:jinja2:2.10
 License: BSD 3-Clause
 License File: LICENSE
 Security Critical: no
diff --git a/deps/v8/third_party/jsoncpp/BUILD.gn b/deps/v8/third_party/jsoncpp/BUILD.gn
new file mode 100644
index 00000000000..411d2d62e73
--- /dev/null
+++ b/deps/v8/third_party/jsoncpp/BUILD.gn
@@ -0,0 +1,50 @@
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+config("jsoncpp_config") {
+  include_dirs = [
+    "source/include",
+    "generated",
+  ]
+
+  # TODO(crbug.com/983223): Update JsonCpp BUILD.gn to remove deprecated
+  # declaration flag.
+  # This temporary flag allowing clients to update to the new version, and then
+  # update to the new StreamWriter and CharReader classes.
+  if (!is_win || is_clang) {
+    cflags_cc = [ "-Wno-deprecated-declarations" ]
+  }
+}
+
+source_set("jsoncpp") {
+  sources = [
+    "generated/version.h",
+    "source/include/json/assertions.h",
+    "source/include/json/autolink.h",
+    "source/include/json/config.h",
+    "source/include/json/features.h",
+    "source/include/json/forwards.h",
+    "source/include/json/json.h",
+    "source/include/json/reader.h",
+    "source/include/json/value.h",
+    "source/include/json/writer.h",
+    "source/src/lib_json/json_reader.cpp",
+    "source/src/lib_json/json_tool.h",
+    "source/src/lib_json/json_value.cpp",
+    "source/src/lib_json/json_writer.cpp",
+  ]
+
+  public_configs = [ ":jsoncpp_config" ]
+
+  defines = [
+    "JSON_USE_EXCEPTION=0",
+    "JSON_USE_NULLREF=0",
+  ]
+
+  include_dirs = [ "source/src/lib_json" ]
+
+  if (!is_win || is_clang) {
+    cflags_cc = [ "-Wno-implicit-fallthrough" ]
+  }
+}
diff --git a/deps/v8/third_party/jsoncpp/LICENSE b/deps/v8/third_party/jsoncpp/LICENSE
new file mode 100644
index 00000000000..ca2bfe1a03e
--- /dev/null
+++ b/deps/v8/third_party/jsoncpp/LICENSE
@@ -0,0 +1,55 @@
+The JsonCpp library's source code, including accompanying documentation, 
+tests and demonstration applications, are licensed under the following
+conditions...
+
+The author (Baptiste Lepilleur) explicitly disclaims copyright in all 
+jurisdictions which recognize such a disclaimer. In such jurisdictions, 
+this software is released into the Public Domain.
+
+In jurisdictions which do not recognize Public Domain property (e.g. Germany as of
+2010), this software is Copyright (c) 2007-2010 by Baptiste Lepilleur, and is
+released under the terms of the MIT License (see below).
+
+In jurisdictions which recognize Public Domain property, the user of this 
+software may choose to accept it either as 1) Public Domain, 2) under the 
+conditions of the MIT License (see below), or 3) under the terms of dual 
+Public Domain/MIT License conditions described here, as they choose.
+
+The MIT License is about as close to Public Domain as a license can get, and is
+described in clear, concise terms at:
+
+   http://en.wikipedia.org/wiki/MIT_License
+   
+The full text of the MIT License follows:
+
+========================================================================
+Copyright (c) 2007-2010 Baptiste Lepilleur
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use, copy,
+modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+========================================================================
+(END LICENSE TEXT)
+
+The MIT license is compatible with both the GPL and commercial
+software, affording one all of the rights of Public Domain with the
+minor nuisance of being required to keep the above copyright notice
+and license text in the source code. Note also that by accepting the
+Public Domain "license" you can re-license your copy using whatever
+license you like.
diff --git a/deps/v8/third_party/jsoncpp/README.chromium b/deps/v8/third_party/jsoncpp/README.chromium
new file mode 100644
index 00000000000..48bc543f418
--- /dev/null
+++ b/deps/v8/third_party/jsoncpp/README.chromium
@@ -0,0 +1,16 @@
+Name: jsoncpp
+URL: https://github.com/open-source-parsers/jsoncpp
+Version: f572e8e42e22cfcf5ab0aea26574f408943edfa4
+License: MIT
+License File: LICENSE
+Security Critical: yes
+
+Description:
+JsonCpp is used by multiple projects for parsing and generating JSON data. This
+project is mirrored here from the public GitHub project, with a custom BUILD.gn
+to allow for building with our Ninja + GN configuration. The main project uses
+Meson or CMake for building.
+
+Note: to update this project to a new version, regenerating the version.h header
+is required. This can be done by installing either CMake or Meson, building the
+project, and copying the generated version.h to the generated/ subfolder.
diff --git a/deps/v8/third_party/jsoncpp/generated/version.h b/deps/v8/third_party/jsoncpp/generated/version.h
new file mode 100644
index 00000000000..9a760821e28
--- /dev/null
+++ b/deps/v8/third_party/jsoncpp/generated/version.h
@@ -0,0 +1,22 @@
+// DO NOT EDIT. This file (and "version") is a template used by the build system
+// (either CMake or Meson) to generate a "version.h" header file.
+#ifndef JSON_VERSION_H_INCLUDED
+#define JSON_VERSION_H_INCLUDED
+
+#define JSONCPP_VERSION_STRING "1.9.0"
+#define JSONCPP_VERSION_MAJOR 1
+#define JSONCPP_VERSION_MINOR 9
+#define JSONCPP_VERSION_PATCH 0
+#define JSONCPP_VERSION_QUALIFIER
+#define JSONCPP_VERSION_HEXA                                       \
+  ((JSONCPP_VERSION_MAJOR << 24) | (JSONCPP_VERSION_MINOR << 16) | \
+   (JSONCPP_VERSION_PATCH << 8))
+
+#ifdef JSONCPP_USING_SECURE_MEMORY
+#undef JSONCPP_USING_SECURE_MEMORY
+#endif
+#define JSONCPP_USING_SECURE_MEMORY 0
+// If non-zero, the library zeroes any memory that it has allocated before
+// it frees its memory.
+
+#endif  // JSON_VERSION_H_INCLUDED
diff --git a/deps/v8/third_party/v8/builtins/array-sort.tq b/deps/v8/third_party/v8/builtins/array-sort.tq
index 2d9f33a3129..03af91af95a 100644
--- a/deps/v8/third_party/v8/builtins/array-sort.tq
+++ b/deps/v8/third_party/v8/builtins/array-sort.tq
@@ -14,1399 +14,1385 @@
 // https://github.com/python/cpython/blob/master/Objects/listsort.txt
 
 namespace array {
-  class SortState extends HeapObject {
-    macro Compare(implicit context: Context)(x: JSAny, y: JSAny): Number {
-      const sortCompare: CompareBuiltinFn = this.sortComparePtr;
-      return sortCompare(context, this.userCmpFn, x, y);
-    }
+class SortState extends HeapObject {
+  macro Compare(implicit context: Context)(x: JSAny, y: JSAny): Number {
+    const sortCompare: CompareBuiltinFn = this.sortComparePtr;
+    return sortCompare(context, this.userCmpFn, x, y);
+  }
 
-    macro CheckAccessor(implicit context: Context)() labels Bailout {
-      const canUseSameAccessorFn: CanUseSameAccessorFn =
-          this.canUseSameAccessorFn;
+  macro CheckAccessor(implicit context: Context)() labels Bailout {
+    if (!IsFastJSArray(this.receiver, context)) goto Bailout;
 
-      if (!canUseSameAccessorFn(
-              context, this.receiver, this.initialReceiverMap,
-              this.initialReceiverLength)) {
-        goto Bailout;
-      }
-    }
+    const canUseSameAccessorFn: CanUseSameAccessorFn =
+        this.canUseSameAccessorFn;
 
-    macro ResetToGenericAccessor() {
-      this.loadFn = Load<GenericElementsAccessor>;
-      this.storeFn = Store<GenericElementsAccessor>;
-      this.deleteFn = Delete<GenericElementsAccessor>;
+    if (!canUseSameAccessorFn(
+            context, this.receiver, this.initialReceiverMap,
+            this.initialReceiverLength)) {
+      goto Bailout;
     }
+  }
 
-    // The receiver of the Array.p.sort call.
-    receiver: JSReceiver;
-
-    // The initial map and length of the receiver. After calling into JS, these
-    // are reloaded and checked. If they changed we bail to the baseline
-    // GenericElementsAccessor.
-    initialReceiverMap: Map;
-    initialReceiverLength: Number;
-
-    // If the user provided a comparison function, it is stored here.
-    userCmpFn: Undefined|Callable;
-
-    // Function pointer to the comparison function. This can either be a builtin
-    // that calls the user-provided comparison function or "SortDefault", which
-    // uses ToString and a lexicographical compare.
-    sortComparePtr: CompareBuiltinFn;
-
-    // The following four function pointer represent a Accessor/Path.
-    // These are used to Load/Store/Delete elements and to check whether
-    // to bail to the baseline GenericElementsAccessor.
-    loadFn: LoadFn;
-    storeFn: StoreFn;
-    deleteFn: DeleteFn;
-    canUseSameAccessorFn: CanUseSameAccessorFn;
-
-    // This controls when we get *into* galloping mode. It's initialized to
-    // kMinGallop. mergeLow and mergeHigh tend to nudge it higher for random
-    // data, and lower for highly structured data.
-    minGallop: Smi;
-
-    // A stack of sortState.pendingRunsSize pending runs yet to be merged.
-    // Run #i starts at sortState.pendingRuns[2 * i] and extends for
-    // sortState.pendingRuns[2 * i + 1] elements:
-    //
-    //   [..., base (i-1), length (i-1), base i, length i]
-    //
-    // It's always true (so long as the indices are in bounds) that
-    //
-    //   base of run #i + length of run #i == base of run #i + 1
-    //
-    pendingRunsSize: Smi;
-    pendingRuns: FixedArray;
+  macro ResetToGenericAccessor() {
+    this.loadFn = Load<GenericElementsAccessor>;
+    this.storeFn = Store<GenericElementsAccessor>;
+    this.deleteFn = Delete<GenericElementsAccessor>;
+  }
 
-    // This is a copy of the original array/object that needs sorting.
-    // workArray is never exposed to user-code, and as such cannot change
-    // shape and won't be left-trimmed.
-    workArray: FixedArray;
+  // The receiver of the Array.p.sort call.
+  receiver: JSReceiver;
+
+  // The initial map and length of the receiver. After calling into JS, these
+  // are reloaded and checked. If they changed we bail to the baseline
+  // GenericElementsAccessor.
+  initialReceiverMap: Map;
+  initialReceiverLength: Number;
+
+  // If the user provided a comparison function, it is stored here.
+  userCmpFn: Undefined|Callable;
+
+  // Function pointer to the comparison function. This can either be a builtin
+  // that calls the user-provided comparison function or "SortDefault", which
+  // uses ToString and a lexicographical compare.
+  sortComparePtr: CompareBuiltinFn;
+
+  // The following four function pointer represent a Accessor/Path.
+  // These are used to Load/Store/Delete elements and to check whether
+  // to bail to the baseline GenericElementsAccessor.
+  loadFn: LoadFn;
+  storeFn: StoreFn;
+  deleteFn: DeleteFn;
+  canUseSameAccessorFn: CanUseSameAccessorFn;
+
+  // This controls when we get *into* galloping mode. It's initialized to
+  // kMinGallop. mergeLow and mergeHigh tend to nudge it higher for random
+  // data, and lower for highly structured data.
+  minGallop: Smi;
+
+  // A stack of sortState.pendingRunsSize pending runs yet to be merged.
+  // Run #i starts at sortState.pendingRuns[2 * i] and extends for
+  // sortState.pendingRuns[2 * i + 1] elements:
+  //
+  //   [..., base (i-1), length (i-1), base i, length i]
+  //
+  // It's always true (so long as the indices are in bounds) that
+  //
+  //   base of run #i + length of run #i == base of run #i + 1
+  //
+  pendingRunsSize: Smi;
+  pendingRuns: FixedArray;
 
-    // Pointer to the temporary array.
-    tempArray: FixedArray;
+  // This is a copy of the original array/object that needs sorting.
+  // workArray is never exposed to user-code, and as such cannot change
+  // shape and won't be left-trimmed.
+  workArray: FixedArray;
 
-    // The initialReceiverLength converted and clamped to Smi.
-    sortLength: Smi;
+  // Pointer to the temporary array.
+  tempArray: FixedArray;
 
-    // The number of undefined that need to be inserted after sorting
-    // when the elements are copied back from the workArray to the receiver.
-    numberOfUndefined: Smi;
-  }
+  // The initialReceiverLength converted and clamped to Smi.
+  sortLength: Smi;
 
-  type FastSmiElements extends ElementsKind;
-  type FastObjectElements extends ElementsKind;
-
-  // With the pre-processing step in Torque, the exact number of elements
-  // to sort is unknown at the time the sort state is created.
-  // The 'length' property is an upper bound (as per spec),
-  // while the actual size of the backing store is a good guess.
-  // After the pre-processing step, the workarray won't change in length.
-  macro CalculateWorkArrayLength(
-      receiver: JSReceiver, initialReceiverLength: Number): intptr {
-    // TODO(szuend): Implement full range sorting, not only up to MaxSmi.
-    //               https://crbug.com/v8/7970.
-    let clampedReceiverLength: uintptr;
-    try {
-      clampedReceiverLength =
-          ChangeSafeIntegerNumberToUintPtr(initialReceiverLength)
-          otherwise UIntPtrOverflow;
-      if (clampedReceiverLength > kSmiMaxValue) {
-        clampedReceiverLength = kSmiMaxValue;
-      }
-    }
-    label UIntPtrOverflow {
+  // The number of undefined that need to be inserted after sorting
+  // when the elements are copied back from the workArray to the receiver.
+  numberOfUndefined: Smi;
+}
+
+type FastSmiElements extends ElementsKind;
+type FastObjectElements extends ElementsKind;
+
+// With the pre-processing step in Torque, the exact number of elements
+// to sort is unknown at the time the sort state is created.
+// The 'length' property is an upper bound (as per spec),
+// while the actual size of the backing store is a good guess.
+// After the pre-processing step, the workarray won't change in length.
+macro CalculateWorkArrayLength(
+    receiver: JSReceiver, initialReceiverLength: Number): intptr {
+  // TODO(szuend): Implement full range sorting, not only up to MaxSmi.
+  //               https://crbug.com/v8/7970.
+  let clampedReceiverLength: uintptr;
+  try {
+    clampedReceiverLength =
+        ChangeSafeIntegerNumberToUintPtr(initialReceiverLength)
+        otherwise UIntPtrOverflow;
+    if (clampedReceiverLength > kSmiMaxValue) {
       clampedReceiverLength = kSmiMaxValue;
     }
+  } label UIntPtrOverflow {
+    clampedReceiverLength = kSmiMaxValue;
+  }
 
-    let workArrayLength: intptr = Convert<intptr>(clampedReceiverLength);
-    try {
-      const object = Cast<JSObject>(receiver) otherwise NoJsObject;
-      const elementsLength = Convert<intptr>(object.elements.length);
+  let workArrayLength: intptr = Convert<intptr>(clampedReceiverLength);
+  try {
+    const object = Cast<JSObject>(receiver) otherwise NoJsObject;
+    const elementsLength = Convert<intptr>(object.elements.length);
 
-      // In some cases, elements are only on prototypes, but not on the receiver
-      // itself. Do nothing then, as {workArrayLength} got initialized with the
-      // {length} property.
-      if (elementsLength != 0) {
-        workArrayLength = IntPtrMin(workArrayLength, elementsLength);
-      }
+    // In some cases, elements are only on prototypes, but not on the receiver
+    // itself. Do nothing then, as {workArrayLength} got initialized with the
+    // {length} property.
+    if (elementsLength != 0) {
+      workArrayLength = IntPtrMin(workArrayLength, elementsLength);
     }
-    label NoJsObject {}
+  } label NoJsObject {}
 
-    return workArrayLength;
-  }
+  return workArrayLength;
+}
 
-  transitioning macro NewSortState(implicit context: Context)(
-      receiver: JSReceiver, comparefn: Undefined|Callable,
-      initialReceiverLength: Number): SortState {
-    const sortComparePtr =
-        comparefn != Undefined ? SortCompareUserFn : SortCompareDefault;
-    const map = receiver.map;
-    let loadFn: LoadFn;
-    let storeFn: StoreFn;
-    let deleteFn: DeleteFn;
-    let canUseSameAccessorFn: CanUseSameAccessorFn;
-
-    try {
-      const a: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
-
-      // Copy copy-on-write (COW) arrays.
-      array::EnsureWriteableFastElements(a);
-
-      const elementsKind: ElementsKind = map.elements_kind;
-      if (IsDoubleElementsKind(elementsKind)) {
-        loadFn = Load<FastDoubleElements>;
-        storeFn = Store<FastDoubleElements>;
-        deleteFn = Delete<FastDoubleElements>;
-        canUseSameAccessorFn = CanUseSameAccessor<FastDoubleElements>;
-      } else if (IsFastSmiElementsKind(elementsKind)) {
-        loadFn = Load<FastSmiElements>;
-        storeFn = Store<FastSmiElements>;
-        deleteFn = Delete<FastSmiElements>;
-        canUseSameAccessorFn = CanUseSameAccessor<FastSmiElements>;
-      } else {
-        loadFn = Load<FastObjectElements>;
-        storeFn = Store<FastObjectElements>;
-        deleteFn = Delete<FastObjectElements>;
-        canUseSameAccessorFn = CanUseSameAccessor<FastObjectElements>;
-      }
-    }
-    label Slow {
-      loadFn = Load<GenericElementsAccessor>;
-      storeFn = Store<GenericElementsAccessor>;
-      deleteFn = Delete<GenericElementsAccessor>;
-      canUseSameAccessorFn = CanUseSameAccessor<GenericElementsAccessor>;
+transitioning macro NewSortState(implicit context: Context)(
+    receiver: JSReceiver, comparefn: Undefined|Callable,
+    initialReceiverLength: Number): SortState {
+  const sortComparePtr =
+      comparefn != Undefined ? SortCompareUserFn : SortCompareDefault;
+  const map = receiver.map;
+  let loadFn: LoadFn;
+  let storeFn: StoreFn;
+  let deleteFn: DeleteFn;
+  let canUseSameAccessorFn: CanUseSameAccessorFn;
+
+  try {
+    const a: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
+
+    // Copy copy-on-write (COW) arrays.
+    array::EnsureWriteableFastElements(a);
+
+    const elementsKind: ElementsKind = map.elements_kind;
+    if (IsDoubleElementsKind(elementsKind)) {
+      loadFn = Load<FastDoubleElements>;
+      storeFn = Store<FastDoubleElements>;
+      deleteFn = Delete<FastDoubleElements>;
+      canUseSameAccessorFn = CanUseSameAccessor<FastDoubleElements>;
+    } else if (IsFastSmiElementsKind(elementsKind)) {
+      loadFn = Load<FastSmiElements>;
+      storeFn = Store<FastSmiElements>;
+      deleteFn = Delete<FastSmiElements>;
+      canUseSameAccessorFn = CanUseSameAccessor<FastSmiElements>;
+    } else {
+      loadFn = Load<FastObjectElements>;
+      storeFn = Store<FastObjectElements>;
+      deleteFn = Delete<FastObjectElements>;
+      canUseSameAccessorFn = CanUseSameAccessor<FastObjectElements>;
     }
-
-    const workArrayLength =
-        CalculateWorkArrayLength(receiver, initialReceiverLength);
-
-    return new SortState{
-      receiver,
-      initialReceiverMap: map,
-      initialReceiverLength,
-      userCmpFn: comparefn,
-      sortComparePtr,
-      loadFn,
-      storeFn,
-      deleteFn,
-      canUseSameAccessorFn,
-      minGallop: kMinGallopWins,
-      pendingRunsSize: 0,
-      pendingRuns: AllocateZeroedFixedArray(Convert<intptr>(kMaxMergePending)),
-      workArray: AllocateZeroedFixedArray(workArrayLength),
-      tempArray: kEmptyFixedArray,
-      sortLength: 0,
-      numberOfUndefined: 0
-    };
-  }
-
-  const kSuccess: Smi = 0;
-
-  // The maximum number of entries in a SortState's pending-runs stack.
-  // This is enough to sort arrays of size up to about
-  //   32 * phi ** kMaxMergePending
-  // where phi ~= 1.618. 85 is ridiculously large enough, good for an array with
-  // 2 ** 64 elements.
-  const kMaxMergePending: constexpr int31 = 85;
-
-  // When we get into galloping mode, we stay there until both runs win less
-  // often then kMinGallop consecutive times. See listsort.txt for more info.
-  const kMinGallopWins: constexpr int31 = 7;
-
-  // Default size of the temporary array. The temporary array is allocated when
-  // it is first requested, but it has always at least this size.
-  const kSortStateTempSize: Smi = 32;
-
-  type LoadFn = builtin(Context, SortState, Smi) => (JSAny|TheHole);
-  type StoreFn = builtin(Context, SortState, Smi, JSAny) => Smi;
-  type DeleteFn = builtin(Context, SortState, Smi) => Smi;
-  type CanUseSameAccessorFn = builtin(Context, JSReceiver, Map, Number) =>
-      Boolean;
-  type CompareBuiltinFn = builtin(Context, JSAny, JSAny, JSAny) => Number;
-
-  // The following builtins implement Load/Store for all the Accessors.
-  // The most generic baseline version uses Get-/SetProperty. We do not need
-  // to worry about the prototype chain, because the pre-processing step has
-  // copied values from the prototype chain to the receiver if they were visible
-  // through a hole.
-
-  transitioning builtin Load<ElementsAccessor : type extends ElementsKind>(
-      context: Context, sortState: SortState, index: Smi): JSAny|TheHole {
-    const receiver = sortState.receiver;
-    if (!HasProperty_Inline(receiver, index)) return TheHole;
-    return GetProperty(receiver, index);
+  } label Slow {
+    loadFn = Load<GenericElementsAccessor>;
+    storeFn = Store<GenericElementsAccessor>;
+    deleteFn = Delete<GenericElementsAccessor>;
+    canUseSameAccessorFn = CanUseSameAccessor<GenericElementsAccessor>;
   }
 
-  Load<FastSmiElements>(context: Context, sortState: SortState, index: Smi):
-      JSAny|TheHole {
-    const object = UnsafeCast<JSObject>(sortState.receiver);
-    const elements = UnsafeCast<FixedArray>(object.elements);
-    return UnsafeCast<(JSAny | TheHole)>(elements.objects[index]);
-  }
+  const workArrayLength =
+      CalculateWorkArrayLength(receiver, initialReceiverLength);
+
+  return new SortState{
+    receiver,
+    initialReceiverMap: map,
+    initialReceiverLength,
+    userCmpFn: comparefn,
+    sortComparePtr,
+    loadFn,
+    storeFn,
+    deleteFn,
+    canUseSameAccessorFn,
+    minGallop: kMinGallopWins,
+    pendingRunsSize: 0,
+    pendingRuns: AllocateZeroedFixedArray(Convert<intptr>(kMaxMergePending)),
+    workArray: AllocateZeroedFixedArray(workArrayLength),
+    tempArray: kEmptyFixedArray,
+    sortLength: 0,
+    numberOfUndefined: 0
+  };
+}
 
-  Load<FastObjectElements>(context: Context, sortState: SortState, index: Smi):
-      JSAny|TheHole {
-    const object = UnsafeCast<JSObject>(sortState.receiver);
-    const elements = UnsafeCast<FixedArray>(object.elements);
-    return UnsafeCast<(JSAny | TheHole)>(elements.objects[index]);
-  }
+const kSuccess: Smi = 0;
+
+// The maximum number of entries in a SortState's pending-runs stack.
+// This is enough to sort arrays of size up to about
+//   32 * phi ** kMaxMergePending
+// where phi ~= 1.618. 85 is ridiculously large enough, good for an array with
+// 2 ** 64 elements.
+const kMaxMergePending: constexpr int31 = 85;
+
+// When we get into galloping mode, we stay there until both runs win less
+// often then kMinGallop consecutive times. See listsort.txt for more info.
+const kMinGallopWins: constexpr int31 = 7;
+
+// Default size of the temporary array. The temporary array is allocated when
+// it is first requested, but it has always at least this size.
+const kSortStateTempSize: Smi = 32;
+
+type LoadFn = builtin(Context, SortState, Smi) => (JSAny|TheHole);
+type StoreFn = builtin(Context, SortState, Smi, JSAny) => Smi;
+type DeleteFn = builtin(Context, SortState, Smi) => Smi;
+type CanUseSameAccessorFn = builtin(Context, JSReceiver, Map, Number) =>
+    Boolean;
+type CompareBuiltinFn = builtin(Context, JSAny, JSAny, JSAny) => Number;
+
+// The following builtins implement Load/Store for all the Accessors.
+// The most generic baseline version uses Get-/SetProperty. We do not need
+// to worry about the prototype chain, because the pre-processing step has
+// copied values from the prototype chain to the receiver if they were visible
+// through a hole.
+
+transitioning builtin Load<ElementsAccessor : type extends ElementsKind>(
+    context: Context, sortState: SortState, index: Smi): JSAny|TheHole {
+  const receiver = sortState.receiver;
+  if (!HasProperty_Inline(receiver, index)) return TheHole;
+  return GetProperty(receiver, index);
+}
 
-  Load<FastDoubleElements>(context: Context, sortState: SortState, index: Smi):
-      JSAny|TheHole {
-    try {
-      const object = UnsafeCast<JSObject>(sortState.receiver);
-      const elements = UnsafeCast<FixedDoubleArray>(object.elements);
-      const value = elements.floats[index].Value() otherwise IfHole;
-      return AllocateHeapNumberWithValue(value);
-    }
-    label IfHole {
-      return TheHole;
-    }
-  }
+Load<FastSmiElements>(
+    context: Context, sortState: SortState, index: Smi): JSAny|TheHole {
+  const object = UnsafeCast<JSObject>(sortState.receiver);
+  const elements = UnsafeCast<FixedArray>(object.elements);
+  return UnsafeCast<(JSAny | TheHole)>(elements.objects[index]);
+}
 
-  transitioning builtin Store<ElementsAccessor : type extends ElementsKind>(
-      context: Context, sortState: SortState, index: Smi, value: JSAny): Smi {
-    SetProperty(sortState.receiver, index, value);
-    return kSuccess;
-  }
+Load<FastObjectElements>(
+    context: Context, sortState: SortState, index: Smi): JSAny|TheHole {
+  const object = UnsafeCast<JSObject>(sortState.receiver);
+  const elements = UnsafeCast<FixedArray>(object.elements);
+  return UnsafeCast<(JSAny | TheHole)>(elements.objects[index]);
+}
 
-  Store<FastSmiElements>(
-      context: Context, sortState: SortState, index: Smi, value: JSAny): Smi {
+Load<FastDoubleElements>(
+    context: Context, sortState: SortState, index: Smi): JSAny|TheHole {
+  try {
     const object = UnsafeCast<JSObject>(sortState.receiver);
-    const elements = UnsafeCast<FixedArray>(object.elements);
-    const value = UnsafeCast<Smi>(value);
-    StoreFixedArrayElement(elements, index, value, SKIP_WRITE_BARRIER);
-    return kSuccess;
+    const elements = UnsafeCast<FixedDoubleArray>(object.elements);
+    const value = elements.floats[index].Value() otherwise IfHole;
+    return AllocateHeapNumberWithValue(value);
+  } label IfHole {
+    return TheHole;
   }
+}
 
-  Store<FastObjectElements>(
-      context: Context, sortState: SortState, index: Smi, value: JSAny): Smi {
-    const object = UnsafeCast<JSObject>(sortState.receiver);
-    const elements = UnsafeCast<FixedArray>(object.elements);
-    elements.objects[index] = value;
-    return kSuccess;
-  }
+transitioning builtin Store<ElementsAccessor : type extends ElementsKind>(
+    context: Context, sortState: SortState, index: Smi, value: JSAny): Smi {
+  SetProperty(sortState.receiver, index, value);
+  return kSuccess;
+}
 
-  Store<FastDoubleElements>(
-      context: Context, sortState: SortState, index: Smi, value: JSAny): Smi {
-    const object = UnsafeCast<JSObject>(sortState.receiver);
-    const elements = UnsafeCast<FixedDoubleArray>(object.elements);
-    const heapVal = UnsafeCast<HeapNumber>(value);
-    const val = Convert<float64>(heapVal);
-    StoreFixedDoubleArrayElementSmi(elements, index, val);
-    return kSuccess;
-  }
+Store<FastSmiElements>(
+    context: Context, sortState: SortState, index: Smi, value: JSAny): Smi {
+  const object = UnsafeCast<JSObject>(sortState.receiver);
+  const elements = UnsafeCast<FixedArray>(object.elements);
+  const value = UnsafeCast<Smi>(value);
+  StoreFixedArrayElement(elements, index, value, SKIP_WRITE_BARRIER);
+  return kSuccess;
+}
 
-  transitioning builtin Delete<ElementsAccessor : type extends ElementsKind>(
-      context: Context, sortState: SortState, index: Smi): Smi {
-    const receiver = sortState.receiver;
-    DeleteProperty(receiver, index, LanguageMode::kStrict);
-    return kSuccess;
-  }
+Store<FastObjectElements>(
+    context: Context, sortState: SortState, index: Smi, value: JSAny): Smi {
+  const object = UnsafeCast<JSObject>(sortState.receiver);
+  const elements = UnsafeCast<FixedArray>(object.elements);
+  elements.objects[index] = value;
+  return kSuccess;
+}
 
-  Delete<FastSmiElements>(context: Context, sortState: SortState, index: Smi):
-      Smi {
-    assert(IsHoleyFastElementsKind(sortState.receiver.map.elements_kind));
+Store<FastDoubleElements>(
+    context: Context, sortState: SortState, index: Smi, value: JSAny): Smi {
+  const object = UnsafeCast<JSObject>(sortState.receiver);
+  const elements = UnsafeCast<FixedDoubleArray>(object.elements);
+  const heapVal = UnsafeCast<HeapNumber>(value);
+  const val = Convert<float64>(heapVal);
+  StoreFixedDoubleArrayElementSmi(elements, index, val);
+  return kSuccess;
+}
 
-    const object = UnsafeCast<JSObject>(sortState.receiver);
-    const elements = UnsafeCast<FixedArray>(object.elements);
-    elements.objects[index] = TheHole;
-    return kSuccess;
-  }
+transitioning builtin Delete<ElementsAccessor : type extends ElementsKind>(
+    context: Context, sortState: SortState, index: Smi): Smi {
+  const receiver = sortState.receiver;
+  DeleteProperty(receiver, index, LanguageMode::kStrict);
+  return kSuccess;
+}
 
-  Delete<FastObjectElements>(
-      context: Context, sortState: SortState, index: Smi): Smi {
-    assert(IsHoleyFastElementsKind(sortState.receiver.map.elements_kind));
+Delete<FastSmiElements>(
+    context: Context, sortState: SortState, index: Smi): Smi {
+  assert(IsHoleyFastElementsKind(sortState.receiver.map.elements_kind));
 
-    const object = UnsafeCast<JSObject>(sortState.receiver);
-    const elements = UnsafeCast<FixedArray>(object.elements);
-    elements.objects[index] = TheHole;
-    return kSuccess;
-  }
+  const object = UnsafeCast<JSObject>(sortState.receiver);
+  const elements = UnsafeCast<FixedArray>(object.elements);
+  elements.objects[index] = TheHole;
+  return kSuccess;
+}
 
-  Delete<FastDoubleElements>(
-      context: Context, sortState: SortState, index: Smi): Smi {
-    assert(IsHoleyFastElementsKind(sortState.receiver.map.elements_kind));
+Delete<FastObjectElements>(
+    context: Context, sortState: SortState, index: Smi): Smi {
+  assert(IsHoleyFastElementsKind(sortState.receiver.map.elements_kind));
 
-    const object = UnsafeCast<JSObject>(sortState.receiver);
-    const elements = UnsafeCast<FixedDoubleArray>(object.elements);
-    elements.floats[index] = kDoubleHole;
-    return kSuccess;
-  }
+  const object = UnsafeCast<JSObject>(sortState.receiver);
+  const elements = UnsafeCast<FixedArray>(object.elements);
+  elements.objects[index] = TheHole;
+  return kSuccess;
+}
 
-  transitioning builtin SortCompareDefault(
-      context: Context, comparefn: JSAny, x: JSAny, y: JSAny): Number {
-    assert(comparefn == Undefined);
+Delete<FastDoubleElements>(
+    context: Context, sortState: SortState, index: Smi): Smi {
+  assert(IsHoleyFastElementsKind(sortState.receiver.map.elements_kind));
 
-    if (TaggedIsSmi(x) && TaggedIsSmi(y)) {
-      return SmiLexicographicCompare(UnsafeCast<Smi>(x), UnsafeCast<Smi>(y));
-    }
+  const object = UnsafeCast<JSObject>(sortState.receiver);
+  const elements = UnsafeCast<FixedDoubleArray>(object.elements);
+  elements.floats[index] = kDoubleHole;
+  return kSuccess;
+}
 
-    // 5. Let xString be ? ToString(x).
-    const xString = ToString_Inline(x);
+transitioning builtin SortCompareDefault(
+    context: Context, comparefn: JSAny, x: JSAny, y: JSAny): Number {
+  assert(comparefn == Undefined);
 
-    // 6. Let yString be ? ToString(y).
-    const yString = ToString_Inline(y);
+  if (TaggedIsSmi(x) && TaggedIsSmi(y)) {
+    return SmiLexicographicCompare(UnsafeCast<Smi>(x), UnsafeCast<Smi>(y));
+  }
 
-    // 7. Let xSmaller be the result of performing
-    //    Abstract Relational Comparison xString < yString.
-    // 8. If xSmaller is true, return -1.
-    if (StringLessThan(context, xString, yString) == True) return -1;
+  // 5. Let xString be ? ToString(x).
+  const xString = ToString_Inline(x);
 
-    // 9. Let ySmaller be the result of performing
-    //    Abstract Relational Comparison yString < xString.
-    // 10. If ySmaller is true, return 1.
-    if (StringLessThan(context, yString, xString) == True) return 1;
+  // 6. Let yString be ? ToString(y).
+  const yString = ToString_Inline(y);
 
-    // 11. Return +0.
-    return 0;
-  }
+  // 7. Let xSmaller be the result of performing
+  //    Abstract Relational Comparison xString < yString.
+  // 8. If xSmaller is true, return -1.
+  if (StringLessThan(context, xString, yString) == True) return -1;
 
-  transitioning builtin SortCompareUserFn(
-      context: Context, comparefn: JSAny, x: JSAny, y: JSAny): Number {
-    assert(comparefn != Undefined);
-    const cmpfn = UnsafeCast<Callable>(comparefn);
+  // 9. Let ySmaller be the result of performing
+  //    Abstract Relational Comparison yString < xString.
+  // 10. If ySmaller is true, return 1.
+  if (StringLessThan(context, yString, xString) == True) return 1;
 
-    // a. Let v be ? ToNumber(? Call(comparefn, undefined, x, y)).
-    const v = ToNumber_Inline(Call(context, cmpfn, Undefined, x, y));
+  // 11. Return +0.
+  return 0;
+}
 
-    // b. If v is NaN, return +0.
-    if (NumberIsNaN(v)) return 0;
+transitioning builtin SortCompareUserFn(
+    context: Context, comparefn: JSAny, x: JSAny, y: JSAny): Number {
+  assert(comparefn != Undefined);
+  const cmpfn = UnsafeCast<Callable>(comparefn);
 
-    // c. return v.
-    return v;
-  }
+  // a. Let v be ? ToNumber(? Call(comparefn, undefined, x, y)).
+  const v = ToNumber_Inline(Call(context, cmpfn, Undefined, x, y));
 
-  builtin CanUseSameAccessor<ElementsAccessor : type extends ElementsKind>(
-      context: Context, receiver: JSReceiver, initialReceiverMap: Map,
-      initialReceiverLength: Number): Boolean {
-    if (receiver.map != initialReceiverMap) return False;
+  // b. If v is NaN, return +0.
+  if (NumberIsNaN(v)) return 0;
 
-    assert(TaggedIsSmi(initialReceiverLength));
-    const array = UnsafeCast<JSArray>(receiver);
-    const originalLength = UnsafeCast<Smi>(initialReceiverLength);
+  // c. return v.
+  return v;
+}
 
-    return SelectBooleanConstant(
-        UnsafeCast<Smi>(array.length) == originalLength);
-  }
+builtin CanUseSameAccessor<ElementsAccessor : type extends ElementsKind>(
+    context: Context, receiver: JSReceiver, initialReceiverMap: Map,
+    initialReceiverLength: Number): Boolean {
+  if (receiver.map != initialReceiverMap) return False;
 
-  CanUseSameAccessor<GenericElementsAccessor>(
-      _context: Context, _receiver: JSReceiver, _initialReceiverMap: Map,
-      _initialReceiverLength: Number): Boolean {
-    // Do nothing. We are already on the slow path.
-    return True;
-  }
+  assert(TaggedIsSmi(initialReceiverLength));
+  const array = UnsafeCast<JSArray>(receiver);
+  const originalLength = UnsafeCast<Smi>(initialReceiverLength);
 
-  // Re-loading the stack-size is done in a few places. The small macro allows
-  // for easier invariant checks at all use sites.
-  macro GetPendingRunsSize(implicit context: Context)(sortState: SortState):
-      Smi {
-    const stackSize: Smi = sortState.pendingRunsSize;
-    assert(stackSize >= 0);
-    return stackSize;
-  }
+  return SelectBooleanConstant(UnsafeCast<Smi>(array.length) == originalLength);
+}
 
-  macro GetPendingRunBase(implicit context:
-                              Context)(pendingRuns: FixedArray, run: Smi): Smi {
-    return UnsafeCast<Smi>(pendingRuns.objects[run << 1]);
-  }
+CanUseSameAccessor<GenericElementsAccessor>(
+    _context: Context, _receiver: JSReceiver, _initialReceiverMap: Map,
+    _initialReceiverLength: Number): Boolean {
+  // Do nothing. We are already on the slow path.
+  return True;
+}
 
-  macro SetPendingRunBase(pendingRuns: FixedArray, run: Smi, value: Smi) {
-    pendingRuns.objects[run << 1] = value;
-  }
+// Re-loading the stack-size is done in a few places. The small macro allows
+// for easier invariant checks at all use sites.
+macro GetPendingRunsSize(implicit context: Context)(sortState: SortState): Smi {
+  const stackSize: Smi = sortState.pendingRunsSize;
+  assert(stackSize >= 0);
+  return stackSize;
+}
 
-  macro GetPendingRunLength(implicit context: Context)(
-      pendingRuns: FixedArray, run: Smi): Smi {
-    return UnsafeCast<Smi>(pendingRuns.objects[(run << 1) + 1]);
-  }
+macro GetPendingRunBase(implicit context: Context)(
+    pendingRuns: FixedArray, run: Smi): Smi {
+  return UnsafeCast<Smi>(pendingRuns.objects[run << 1]);
+}
 
-  macro SetPendingRunLength(pendingRuns: FixedArray, run: Smi, value: Smi) {
-    pendingRuns.objects[(run << 1) + 1] = value;
-  }
+macro SetPendingRunBase(pendingRuns: FixedArray, run: Smi, value: Smi) {
+  pendingRuns.objects[run << 1] = value;
+}
 
-  macro PushRun(implicit context:
-                    Context)(sortState: SortState, base: Smi, length: Smi) {
-    assert(GetPendingRunsSize(sortState) < kMaxMergePending);
+macro GetPendingRunLength(implicit context: Context)(
+    pendingRuns: FixedArray, run: Smi): Smi {
+  return UnsafeCast<Smi>(pendingRuns.objects[(run << 1) + 1]);
+}
 
-    const stackSize: Smi = GetPendingRunsSize(sortState);
-    const pendingRuns: FixedArray = sortState.pendingRuns;
+macro SetPendingRunLength(pendingRuns: FixedArray, run: Smi, value: Smi) {
+  pendingRuns.objects[(run << 1) + 1] = value;
+}
 
-    SetPendingRunBase(pendingRuns, stackSize, base);
-    SetPendingRunLength(pendingRuns, stackSize, length);
+macro PushRun(implicit context: Context)(
+    sortState: SortState, base: Smi, length: Smi) {
+  assert(GetPendingRunsSize(sortState) < kMaxMergePending);
 
-    sortState.pendingRunsSize = stackSize + 1;
-  }
+  const stackSize: Smi = GetPendingRunsSize(sortState);
+  const pendingRuns: FixedArray = sortState.pendingRuns;
 
-  // Returns the temporary array and makes sure that it is big enough.
-  // TODO(szuend): Implement a better re-size strategy.
-  macro GetTempArray(implicit context: Context)(
-      sortState: SortState, requestedSize: Smi): FixedArray {
-    const minSize: Smi = SmiMax(kSortStateTempSize, requestedSize);
+  SetPendingRunBase(pendingRuns, stackSize, base);
+  SetPendingRunLength(pendingRuns, stackSize, length);
 
-    const currentSize: Smi = sortState.tempArray.length;
-    if (currentSize >= minSize) {
-      return sortState.tempArray;
-    }
+  sortState.pendingRunsSize = stackSize + 1;
+}
 
-    const tempArray: FixedArray =
-        AllocateZeroedFixedArray(Convert<intptr>(minSize));
+// Returns the temporary array and makes sure that it is big enough.
+// TODO(szuend): Implement a better re-size strategy.
+macro GetTempArray(implicit context: Context)(
+    sortState: SortState, requestedSize: Smi): FixedArray {
+  const minSize: Smi = SmiMax(kSortStateTempSize, requestedSize);
 
-    sortState.tempArray = tempArray;
-    return tempArray;
+  const currentSize: Smi = sortState.tempArray.length;
+  if (currentSize >= minSize) {
+    return sortState.tempArray;
   }
 
-  transitioning builtin
-  Copy(implicit context: Context)(
-      source: FixedArray, srcPos: Smi, target: FixedArray, dstPos: Smi,
-      length: Smi): JSAny {
-    assert(srcPos >= 0);
-    assert(dstPos >= 0);
-    assert(srcPos <= source.length - length);
-    assert(dstPos <= target.length - length);
-
-    // TODO(szuend): Investigate whether this builtin should be replaced
-    //               by CopyElements/MoveElements for perfomance.
-
-    // source and target might be the same array. To avoid overwriting
-    // values in the case of overlaping ranges, elements are copied from
-    // the back when srcPos < dstPos.
-    if (srcPos < dstPos) {
-      let srcIdx: Smi = srcPos + length - 1;
-      let dstIdx: Smi = dstPos + length - 1;
-      while (srcIdx >= srcPos) {
-        target.objects[dstIdx--] = source.objects[srcIdx--];
-      }
-    } else {
-      let srcIdx: Smi = srcPos;
-      let dstIdx: Smi = dstPos;
-      const to: Smi = srcPos + length;
+  const tempArray: FixedArray =
+      AllocateZeroedFixedArray(Convert<intptr>(minSize));
 
-      while (srcIdx < to) {
-        target.objects[dstIdx++] = source.objects[srcIdx++];
-      }
+  sortState.tempArray = tempArray;
+  return tempArray;
+}
+
+transitioning builtin
+Copy(implicit context: Context)(
+    source: FixedArray, srcPos: Smi, target: FixedArray, dstPos: Smi,
+    length: Smi): JSAny {
+  assert(srcPos >= 0);
+  assert(dstPos >= 0);
+  assert(srcPos <= source.length - length);
+  assert(dstPos <= target.length - length);
+
+  // TODO(szuend): Investigate whether this builtin should be replaced
+  //               by CopyElements/MoveElements for perfomance.
+
+  // source and target might be the same array. To avoid overwriting
+  // values in the case of overlaping ranges, elements are copied from
+  // the back when srcPos < dstPos.
+  if (srcPos < dstPos) {
+    let srcIdx: Smi = srcPos + length - 1;
+    let dstIdx: Smi = dstPos + length - 1;
+    while (srcIdx >= srcPos) {
+      target.objects[dstIdx--] = source.objects[srcIdx--];
+    }
+  } else {
+    let srcIdx: Smi = srcPos;
+    let dstIdx: Smi = dstPos;
+    const to: Smi = srcPos + length;
+
+    while (srcIdx < to) {
+      target.objects[dstIdx++] = source.objects[srcIdx++];
     }
-    return kSuccess;
   }
+  return kSuccess;
+}
 
-  // BinaryInsertionSort is the best method for sorting small arrays: it
-  // does few compares, but can do data movement quadratic in the number of
-  // elements. This is an advantage since comparisons are more expensive due
-  // to calling into JS.
-  //
-  //  [low, high) is a contiguous range of a array, and is sorted via
-  // binary insertion. This sort is stable.
-  //
-  // On entry, must have low <= start <= high, and that [low, start) is
-  // already sorted. Pass start == low if you do not know!.
-  macro BinaryInsertionSort(implicit context: Context, sortState: SortState)(
-      low: Smi, startArg: Smi, high: Smi) {
-    assert(low <= startArg && startArg <= high);
+// BinaryInsertionSort is the best method for sorting small arrays: it
+// does few compares, but can do data movement quadratic in the number of
+// elements. This is an advantage since comparisons are more expensive due
+// to calling into JS.
+//
+//  [low, high) is a contiguous range of a array, and is sorted via
+// binary insertion. This sort is stable.
+//
+// On entry, must have low <= start <= high, and that [low, start) is
+// already sorted. Pass start == low if you do not know!.
+macro BinaryInsertionSort(implicit context: Context, sortState: SortState)(
+    low: Smi, startArg: Smi, high: Smi) {
+  assert(low <= startArg && startArg <= high);
 
-    const workArray = sortState.workArray;
+  const workArray = sortState.workArray;
 
-    let start: Smi = low == startArg ? (startArg + 1) : startArg;
+  let start: Smi = low == startArg ? (startArg + 1) : startArg;
 
-    for (; start < high; ++start) {
-      // Set left to where a[start] belongs.
-      let left: Smi = low;
-      let right: Smi = start;
+  for (; start < high; ++start) {
+    // Set left to where a[start] belongs.
+    let left: Smi = low;
+    let right: Smi = start;
 
-      const pivot = UnsafeCast<JSAny>(workArray.objects[right]);
+    const pivot = UnsafeCast<JSAny>(workArray.objects[right]);
 
-      // Invariants:
-      //   pivot >= all in [low, left).
-      //   pivot  < all in [right, start).
-      assert(left < right);
+    // Invariants:
+    //   pivot >= all in [low, left).
+    //   pivot  < all in [right, start).
+    assert(left < right);
 
-      // Find pivot insertion point.
-      while (left < right) {
-        const mid: Smi = left + ((right - left) >> 1);
-        const order =
-            sortState.Compare(pivot, UnsafeCast<JSAny>(workArray.objects[mid]));
+    // Find pivot insertion point.
+    while (left < right) {
+      const mid: Smi = left + ((right - left) >> 1);
+      const order =
+          sortState.Compare(pivot, UnsafeCast<JSAny>(workArray.objects[mid]));
 
-        if (order < 0) {
-          right = mid;
-        } else {
-          left = mid + 1;
-        }
-      }
-      assert(left == right);
-
-      // The invariants still hold, so:
-      //   pivot >= all in [low, left) and
-      //   pivot  < all in [left, start),
-      //
-      // so pivot belongs at left. Note that if there are elements equal
-      // to pivot, left points to the first slot after them -- that's why
-      // this sort is stable. Slide over to make room.
-      for (let p: Smi = start; p > left; --p) {
-        workArray.objects[p] = workArray.objects[p - 1];
+      if (order < 0) {
+        right = mid;
+      } else {
+        left = mid + 1;
       }
-      workArray.objects[left] = pivot;
     }
-  }
+    assert(left == right);
 
-  // Return the length of the run beginning at low, in the range [low,
-  // high), low < high is required on entry. "A run" is the longest
-  // ascending sequence, with
-  //
-  //   a[low] <= a[low + 1] <= a[low + 2] <= ...
-  //
-  // or the longest descending sequence, with
-  //
-  //   a[low] > a[low + 1] > a[low + 2] > ...
-  //
-  // For its intended use in stable mergesort, the strictness of the
-  // definition of "descending" is needed so that the range can safely be
-  // reversed without violating stability (strict ">" ensures there are no
-  // equal elements to get out of order).
-  //
-  // In addition, if the run is "descending", it is reversed, so the
-  // returned length is always an ascending sequence.
-  macro CountAndMakeRun(implicit context: Context, sortState: SortState)(
-      lowArg: Smi, high: Smi): Smi {
-    assert(lowArg < high);
+    // The invariants still hold, so:
+    //   pivot >= all in [low, left) and
+    //   pivot  < all in [left, start),
+    //
+    // so pivot belongs at left. Note that if there are elements equal
+    // to pivot, left points to the first slot after them -- that's why
+    // this sort is stable. Slide over to make room.
+    for (let p: Smi = start; p > left; --p) {
+      workArray.objects[p] = workArray.objects[p - 1];
+    }
+    workArray.objects[left] = pivot;
+  }
+}
 
-    const workArray = sortState.workArray;
+// Return the length of the run beginning at low, in the range [low,
+// high), low < high is required on entry. "A run" is the longest
+// ascending sequence, with
+//
+//   a[low] <= a[low + 1] <= a[low + 2] <= ...
+//
+// or the longest descending sequence, with
+//
+//   a[low] > a[low + 1] > a[low + 2] > ...
+//
+// For its intended use in stable mergesort, the strictness of the
+// definition of "descending" is needed so that the range can safely be
+// reversed without violating stability (strict ">" ensures there are no
+// equal elements to get out of order).
+//
+// In addition, if the run is "descending", it is reversed, so the
+// returned length is always an ascending sequence.
+macro CountAndMakeRun(implicit context: Context, sortState: SortState)(
+    lowArg: Smi, high: Smi): Smi {
+  assert(lowArg < high);
 
-    const low: Smi = lowArg + 1;
-    if (low == high) return 1;
+  const workArray = sortState.workArray;
 
-    let runLength: Smi = 2;
+  const low: Smi = lowArg + 1;
+  if (low == high) return 1;
 
-    const elementLow = UnsafeCast<JSAny>(workArray.objects[low]);
-    const elementLowPred = UnsafeCast<JSAny>(workArray.objects[low - 1]);
-    let order = sortState.Compare(elementLow, elementLowPred);
+  let runLength: Smi = 2;
 
-    // TODO(szuend): Replace with "order < 0" once Torque supports it.
-    //               Currently the operator<(Number, Number) has return type
-    //               'never' and uses two labels to branch.
-    const isDescending: bool = order < 0 ? true : false;
+  const elementLow = UnsafeCast<JSAny>(workArray.objects[low]);
+  const elementLowPred = UnsafeCast<JSAny>(workArray.objects[low - 1]);
+  let order = sortState.Compare(elementLow, elementLowPred);
 
-    let previousElement: JSAny = elementLow;
-    for (let idx: Smi = low + 1; idx < high; ++idx) {
-      const currentElement = UnsafeCast<JSAny>(workArray.objects[idx]);
-      order = sortState.Compare(currentElement, previousElement);
+  // TODO(szuend): Replace with "order < 0" once Torque supports it.
+  //               Currently the operator<(Number, Number) has return type
+  //               'never' and uses two labels to branch.
+  const isDescending: bool = order < 0 ? true : false;
 
-      if (isDescending) {
-        if (order >= 0) break;
-      } else {
-        if (order < 0) break;
-      }
-
-      previousElement = currentElement;
-      ++runLength;
-    }
+  let previousElement: JSAny = elementLow;
+  for (let idx: Smi = low + 1; idx < high; ++idx) {
+    const currentElement = UnsafeCast<JSAny>(workArray.objects[idx]);
+    order = sortState.Compare(currentElement, previousElement);
 
     if (isDescending) {
-      ReverseRange(workArray, lowArg, lowArg + runLength);
+      if (order >= 0) break;
+    } else {
+      if (order < 0) break;
     }
 
-    return runLength;
+    previousElement = currentElement;
+    ++runLength;
   }
 
-  macro ReverseRange(array: FixedArray, from: Smi, to: Smi) {
-    let low: Smi = from;
-    let high: Smi = to - 1;
-
-    while (low < high) {
-      const elementLow = array.objects[low];
-      const elementHigh = array.objects[high];
-      array.objects[low++] = elementHigh;
-      array.objects[high--] = elementLow;
-    }
+  if (isDescending) {
+    ReverseRange(workArray, lowArg, lowArg + runLength);
   }
 
-  // Merges the two runs at stack indices i and i + 1.
-  // Returns kFailure if we need to bailout, kSuccess otherwise.
-  transitioning builtin
-  MergeAt(implicit context: Context, sortState: SortState)(i: Smi): Smi {
-    const stackSize: Smi = GetPendingRunsSize(sortState);
-
-    // We are only allowed to either merge the two top-most runs, or leave
-    // the top most run alone and merge the two next runs.
-    assert(stackSize >= 2);
-    assert(i >= 0);
-    assert(i == stackSize - 2 || i == stackSize - 3);
-
-    const workArray = sortState.workArray;
-
-    const pendingRuns: FixedArray = sortState.pendingRuns;
-    let baseA: Smi = GetPendingRunBase(pendingRuns, i);
-    let lengthA: Smi = GetPendingRunLength(pendingRuns, i);
-    const baseB: Smi = GetPendingRunBase(pendingRuns, i + 1);
-    let lengthB: Smi = GetPendingRunLength(pendingRuns, i + 1);
-    assert(lengthA > 0 && lengthB > 0);
-    assert(baseA + lengthA == baseB);
-
-    // Record the length of the combined runs; if i is the 3rd-last run now,
-    // also slide over the last run (which isn't involved in this merge).
-    // The current run i + 1 goes away in any case.
-    SetPendingRunLength(pendingRuns, i, lengthA + lengthB);
-    if (i == stackSize - 3) {
-      const base: Smi = GetPendingRunBase(pendingRuns, i + 2);
-      const length: Smi = GetPendingRunLength(pendingRuns, i + 2);
-      SetPendingRunBase(pendingRuns, i + 1, base);
-      SetPendingRunLength(pendingRuns, i + 1, length);
-    }
-    sortState.pendingRunsSize = stackSize - 1;
-
-    // Where does b start in a? Elements in a before that can be ignored,
-    // because they are already in place.
-    const keyRight = UnsafeCast<JSAny>(workArray.objects[baseB]);
-    const k: Smi = GallopRight(workArray, keyRight, baseA, lengthA, 0);
-    assert(k >= 0);
-
-    baseA = baseA + k;
-    lengthA = lengthA - k;
-    if (lengthA == 0) return kSuccess;
-    assert(lengthA > 0);
-
-    // Where does a end in b? Elements in b after that can be ignored,
-    // because they are already in place.
-    const keyLeft = UnsafeCast<JSAny>(workArray.objects[baseA + lengthA - 1]);
-    lengthB = GallopLeft(workArray, keyLeft, baseB, lengthB, lengthB - 1);
-    assert(lengthB >= 0);
-    if (lengthB == 0) return kSuccess;
-
-    // Merge what remains of the runs, using a temp array with
-    // min(lengthA, lengthB) elements.
-    if (lengthA <= lengthB) {
-      MergeLow(baseA, lengthA, baseB, lengthB);
-    } else {
-      MergeHigh(baseA, lengthA, baseB, lengthB);
-    }
-    return kSuccess;
-  }
-
-  // Locates the proper position of key in a sorted array; if the array
-  // contains an element equal to key, return the position immediately to
-  // the left of the leftmost equal element. (GallopRight does the same
-  // except returns the position to the right of the rightmost equal element
-  // (if any)).
-  //
-  // The array is sorted with "length" elements, starting at "base".
-  // "length" must be > 0.
-  //
-  // "hint" is an index at which to begin the search, 0 <= hint < n. The
-  // closer hint is to the final result, the faster this runs.
-  //
-  // The return value is the int offset in 0..length such that
-  //
-  // array[base + offset] < key <= array[base + offset + 1]
-  //
-  // pretending that array[base - 1] is minus infinity and array[base + len]
-  // is plus infinity. In other words, key belongs at index base + k.
-  builtin GallopLeft(implicit context: Context, sortState: SortState)(
-      array: FixedArray, key: JSAny, base: Smi, length: Smi, hint: Smi): Smi {
-    assert(length > 0 && base >= 0);
-    assert(0 <= hint && hint < length);
-
-    let lastOfs: Smi = 0;
-    let offset: Smi = 1;
-
-    const baseHintElement = UnsafeCast<JSAny>(array.objects[base + hint]);
-    let order = sortState.Compare(baseHintElement, key);
-
-    if (order < 0) {
-      // a[base + hint] < key: gallop right, until
-      // a[base + hint + lastOfs] < key <= a[base + hint + offset].
+  return runLength;
+}
 
-      // a[base + length - 1] is highest.
-      const maxOfs: Smi = length - hint;
-      while (offset < maxOfs) {
-        const offsetElement =
-            UnsafeCast<JSAny>(array.objects[base + hint + offset]);
-        order = sortState.Compare(offsetElement, key);
+macro ReverseRange(array: FixedArray, from: Smi, to: Smi) {
+  let low: Smi = from;
+  let high: Smi = to - 1;
 
-        // a[base + hint + offset] >= key? Break.
-        if (order >= 0) break;
+  while (low < high) {
+    const elementLow = array.objects[low];
+    const elementHigh = array.objects[high];
+    array.objects[low++] = elementHigh;
+    array.objects[high--] = elementLow;
+  }
+}
 
-        lastOfs = offset;
-        offset = (offset << 1) + 1;
+// Merges the two runs at stack indices i and i + 1.
+// Returns kFailure if we need to bailout, kSuccess otherwise.
+transitioning builtin
+MergeAt(implicit context: Context, sortState: SortState)(i: Smi): Smi {
+  const stackSize: Smi = GetPendingRunsSize(sortState);
+
+  // We are only allowed to either merge the two top-most runs, or leave
+  // the top most run alone and merge the two next runs.
+  assert(stackSize >= 2);
+  assert(i >= 0);
+  assert(i == stackSize - 2 || i == stackSize - 3);
+
+  const workArray = sortState.workArray;
+
+  const pendingRuns: FixedArray = sortState.pendingRuns;
+  let baseA: Smi = GetPendingRunBase(pendingRuns, i);
+  let lengthA: Smi = GetPendingRunLength(pendingRuns, i);
+  const baseB: Smi = GetPendingRunBase(pendingRuns, i + 1);
+  let lengthB: Smi = GetPendingRunLength(pendingRuns, i + 1);
+  assert(lengthA > 0 && lengthB > 0);
+  assert(baseA + lengthA == baseB);
+
+  // Record the length of the combined runs; if i is the 3rd-last run now,
+  // also slide over the last run (which isn't involved in this merge).
+  // The current run i + 1 goes away in any case.
+  SetPendingRunLength(pendingRuns, i, lengthA + lengthB);
+  if (i == stackSize - 3) {
+    const base: Smi = GetPendingRunBase(pendingRuns, i + 2);
+    const length: Smi = GetPendingRunLength(pendingRuns, i + 2);
+    SetPendingRunBase(pendingRuns, i + 1, base);
+    SetPendingRunLength(pendingRuns, i + 1, length);
+  }
+  sortState.pendingRunsSize = stackSize - 1;
+
+  // Where does b start in a? Elements in a before that can be ignored,
+  // because they are already in place.
+  const keyRight = UnsafeCast<JSAny>(workArray.objects[baseB]);
+  const k: Smi = GallopRight(workArray, keyRight, baseA, lengthA, 0);
+  assert(k >= 0);
+
+  baseA = baseA + k;
+  lengthA = lengthA - k;
+  if (lengthA == 0) return kSuccess;
+  assert(lengthA > 0);
+
+  // Where does a end in b? Elements in b after that can be ignored,
+  // because they are already in place.
+  const keyLeft = UnsafeCast<JSAny>(workArray.objects[baseA + lengthA - 1]);
+  lengthB = GallopLeft(workArray, keyLeft, baseB, lengthB, lengthB - 1);
+  assert(lengthB >= 0);
+  if (lengthB == 0) return kSuccess;
+
+  // Merge what remains of the runs, using a temp array with
+  // min(lengthA, lengthB) elements.
+  if (lengthA <= lengthB) {
+    MergeLow(baseA, lengthA, baseB, lengthB);
+  } else {
+    MergeHigh(baseA, lengthA, baseB, lengthB);
+  }
+  return kSuccess;
+}
 
-        // Integer overflow.
-        if (offset <= 0) offset = maxOfs;
-      }
+// Locates the proper position of key in a sorted array; if the array
+// contains an element equal to key, return the position immediately to
+// the left of the leftmost equal element. (GallopRight does the same
+// except returns the position to the right of the rightmost equal element
+// (if any)).
+//
+// The array is sorted with "length" elements, starting at "base".
+// "length" must be > 0.
+//
+// "hint" is an index at which to begin the search, 0 <= hint < n. The
+// closer hint is to the final result, the faster this runs.
+//
+// The return value is the int offset in 0..length such that
+//
+// array[base + offset] < key <= array[base + offset + 1]
+//
+// pretending that array[base - 1] is minus infinity and array[base + len]
+// is plus infinity. In other words, key belongs at index base + k.
+builtin GallopLeft(implicit context: Context, sortState: SortState)(
+    array: FixedArray, key: JSAny, base: Smi, length: Smi, hint: Smi): Smi {
+  assert(length > 0 && base >= 0);
+  assert(0 <= hint && hint < length);
+
+  let lastOfs: Smi = 0;
+  let offset: Smi = 1;
+
+  const baseHintElement = UnsafeCast<JSAny>(array.objects[base + hint]);
+  let order = sortState.Compare(baseHintElement, key);
+
+  if (order < 0) {
+    // a[base + hint] < key: gallop right, until
+    // a[base + hint + lastOfs] < key <= a[base + hint + offset].
+
+    // a[base + length - 1] is highest.
+    const maxOfs: Smi = length - hint;
+    while (offset < maxOfs) {
+      const offsetElement =
+          UnsafeCast<JSAny>(array.objects[base + hint + offset]);
+      order = sortState.Compare(offsetElement, key);
+
+      // a[base + hint + offset] >= key? Break.
+      if (order >= 0) break;
+
+      lastOfs = offset;
+      offset = (offset << 1) + 1;
+
+      // Integer overflow.
+      if (offset <= 0) offset = maxOfs;
+    }
 
-      if (offset > maxOfs) offset = maxOfs;
+    if (offset > maxOfs) offset = maxOfs;
 
-      // Translate back to positive offsets relative to base.
-      lastOfs = lastOfs + hint;
-      offset = offset + hint;
-    } else {
-      // key <= a[base + hint]: gallop left, until
-      // a[base + hint - offset] < key <= a[base + hint - lastOfs].
-      assert(order >= 0);
+    // Translate back to positive offsets relative to base.
+    lastOfs = lastOfs + hint;
+    offset = offset + hint;
+  } else {
+    // key <= a[base + hint]: gallop left, until
+    // a[base + hint - offset] < key <= a[base + hint - lastOfs].
+    assert(order >= 0);
 
-      // a[base + hint] is lowest.
-      const maxOfs: Smi = hint + 1;
-      while (offset < maxOfs) {
-        const offsetElement =
-            UnsafeCast<JSAny>(array.objects[base + hint - offset]);
-        order = sortState.Compare(offsetElement, key);
+    // a[base + hint] is lowest.
+    const maxOfs: Smi = hint + 1;
+    while (offset < maxOfs) {
+      const offsetElement =
+          UnsafeCast<JSAny>(array.objects[base + hint - offset]);
+      order = sortState.Compare(offsetElement, key);
 
-        if (order < 0) break;
+      if (order < 0) break;
 
-        lastOfs = offset;
-        offset = (offset << 1) + 1;
+      lastOfs = offset;
+      offset = (offset << 1) + 1;
 
-        // Integer overflow.
-        if (offset <= 0) offset = maxOfs;
-      }
+      // Integer overflow.
+      if (offset <= 0) offset = maxOfs;
+    }
 
-      if (offset > maxOfs) offset = maxOfs;
+    if (offset > maxOfs) offset = maxOfs;
 
-      // Translate back to positive offsets relative to base.
-      const tmp: Smi = lastOfs;
-      lastOfs = hint - offset;
-      offset = hint - tmp;
-    }
+    // Translate back to positive offsets relative to base.
+    const tmp: Smi = lastOfs;
+    lastOfs = hint - offset;
+    offset = hint - tmp;
+  }
 
-    assert(-1 <= lastOfs && lastOfs < offset && offset <= length);
+  assert(-1 <= lastOfs && lastOfs < offset && offset <= length);
 
-    // Now a[base+lastOfs] < key <= a[base+offset], so key belongs
-    // somewhere to the right of lastOfs but no farther right than offset.
-    // Do a binary search, with invariant:
-    //   a[base + lastOfs - 1] < key <= a[base + offset].
-    lastOfs++;
-    while (lastOfs < offset) {
-      const m: Smi = lastOfs + ((offset - lastOfs) >> 1);
+  // Now a[base+lastOfs] < key <= a[base+offset], so key belongs
+  // somewhere to the right of lastOfs but no farther right than offset.
+  // Do a binary search, with invariant:
+  //   a[base + lastOfs - 1] < key <= a[base + offset].
+  lastOfs++;
+  while (lastOfs < offset) {
+    const m: Smi = lastOfs + ((offset - lastOfs) >> 1);
 
-      order =
-          sortState.Compare(UnsafeCast<JSAny>(array.objects[base + m]), key);
+    order = sortState.Compare(UnsafeCast<JSAny>(array.objects[base + m]), key);
 
-      if (order < 0) {
-        lastOfs = m + 1;  // a[base + m] < key.
-      } else {
-        offset = m;  // key <= a[base + m].
-      }
+    if (order < 0) {
+      lastOfs = m + 1;  // a[base + m] < key.
+    } else {
+      offset = m;  // key <= a[base + m].
     }
-    // so a[base + offset - 1] < key <= a[base + offset].
-    assert(lastOfs == offset);
-    assert(0 <= offset && offset <= length);
-    return offset;
   }
+  // so a[base + offset - 1] < key <= a[base + offset].
+  assert(lastOfs == offset);
+  assert(0 <= offset && offset <= length);
+  return offset;
+}
 
-  // Exactly like GallopLeft, except that if key already exists in
-  // [base, base + length), finds the position immediately to the right of
-  // the rightmost equal value.
-  //
-  // The return value is the int offset in 0..length such that
-  //
-  // array[base + offset - 1] <= key < array[base + offset]
-  //
-  // or kFailure on error.
-  builtin GallopRight(implicit context: Context, sortState: SortState)(
-      array: FixedArray, key: JSAny, base: Smi, length: Smi, hint: Smi): Smi {
-    assert(length > 0 && base >= 0);
-    assert(0 <= hint && hint < length);
+// Exactly like GallopLeft, except that if key already exists in
+// [base, base + length), finds the position immediately to the right of
+// the rightmost equal value.
+//
+// The return value is the int offset in 0..length such that
+//
+// array[base + offset - 1] <= key < array[base + offset]
+//
+// or kFailure on error.
+builtin GallopRight(implicit context: Context, sortState: SortState)(
+    array: FixedArray, key: JSAny, base: Smi, length: Smi, hint: Smi): Smi {
+  assert(length > 0 && base >= 0);
+  assert(0 <= hint && hint < length);
 
-    let lastOfs: Smi = 0;
-    let offset: Smi = 1;
+  let lastOfs: Smi = 0;
+  let offset: Smi = 1;
 
-    const baseHintElement = UnsafeCast<JSAny>(array.objects[base + hint]);
-    let order = sortState.Compare(key, baseHintElement);
+  const baseHintElement = UnsafeCast<JSAny>(array.objects[base + hint]);
+  let order = sortState.Compare(key, baseHintElement);
 
-    if (order < 0) {
-      // key < a[base + hint]: gallop left, until
-      // a[base + hint - offset] <= key < a[base + hint - lastOfs].
+  if (order < 0) {
+    // key < a[base + hint]: gallop left, until
+    // a[base + hint - offset] <= key < a[base + hint - lastOfs].
 
-      // a[base + hint] is lowest.
-      const maxOfs: Smi = hint + 1;
-      while (offset < maxOfs) {
-        const offsetElement =
-            UnsafeCast<JSAny>(array.objects[base + hint - offset]);
-        order = sortState.Compare(key, offsetElement);
+    // a[base + hint] is lowest.
+    const maxOfs: Smi = hint + 1;
+    while (offset < maxOfs) {
+      const offsetElement =
+          UnsafeCast<JSAny>(array.objects[base + hint - offset]);
+      order = sortState.Compare(key, offsetElement);
 
-        if (order >= 0) break;
+      if (order >= 0) break;
 
-        lastOfs = offset;
-        offset = (offset << 1) + 1;
+      lastOfs = offset;
+      offset = (offset << 1) + 1;
 
-        // Integer overflow.
-        if (offset <= 0) offset = maxOfs;
-      }
+      // Integer overflow.
+      if (offset <= 0) offset = maxOfs;
+    }
 
-      if (offset > maxOfs) offset = maxOfs;
+    if (offset > maxOfs) offset = maxOfs;
 
-      // Translate back to positive offsets relative to base.
-      const tmp: Smi = lastOfs;
-      lastOfs = hint - offset;
-      offset = hint - tmp;
-    } else {
-      // a[base + hint] <= key: gallop right, until
-      // a[base + hint + lastOfs] <= key < a[base + hint + offset].
+    // Translate back to positive offsets relative to base.
+    const tmp: Smi = lastOfs;
+    lastOfs = hint - offset;
+    offset = hint - tmp;
+  } else {
+    // a[base + hint] <= key: gallop right, until
+    // a[base + hint + lastOfs] <= key < a[base + hint + offset].
 
-      // a[base + length - 1] is highest.
-      const maxOfs: Smi = length - hint;
-      while (offset < maxOfs) {
-        const offsetElement =
-            UnsafeCast<JSAny>(array.objects[base + hint + offset]);
-        order = sortState.Compare(key, offsetElement);
+    // a[base + length - 1] is highest.
+    const maxOfs: Smi = length - hint;
+    while (offset < maxOfs) {
+      const offsetElement =
+          UnsafeCast<JSAny>(array.objects[base + hint + offset]);
+      order = sortState.Compare(key, offsetElement);
 
-        // a[base + hint + ofs] <= key.
-        if (order < 0) break;
+      // a[base + hint + ofs] <= key.
+      if (order < 0) break;
 
-        lastOfs = offset;
-        offset = (offset << 1) + 1;
+      lastOfs = offset;
+      offset = (offset << 1) + 1;
 
-        // Integer overflow.
-        if (offset <= 0) offset = maxOfs;
-      }
+      // Integer overflow.
+      if (offset <= 0) offset = maxOfs;
+    }
 
-      if (offset > maxOfs) offset = maxOfs;
+    if (offset > maxOfs) offset = maxOfs;
 
-      // Translate back to positive offests relative to base.
-      lastOfs = lastOfs + hint;
-      offset = offset + hint;
-    }
-    assert(-1 <= lastOfs && lastOfs < offset && offset <= length);
+    // Translate back to positive offests relative to base.
+    lastOfs = lastOfs + hint;
+    offset = offset + hint;
+  }
+  assert(-1 <= lastOfs && lastOfs < offset && offset <= length);
 
-    // Now a[base + lastOfs] <= key < a[base + ofs], so key belongs
-    // somewhere to the right of lastOfs but no farther right than ofs.
-    // Do a binary search, with invariant
-    // a[base + lastOfs - 1] < key <= a[base + ofs].
-    lastOfs++;
-    while (lastOfs < offset) {
-      const m: Smi = lastOfs + ((offset - lastOfs) >> 1);
+  // Now a[base + lastOfs] <= key < a[base + ofs], so key belongs
+  // somewhere to the right of lastOfs but no farther right than ofs.
+  // Do a binary search, with invariant
+  // a[base + lastOfs - 1] < key <= a[base + ofs].
+  lastOfs++;
+  while (lastOfs < offset) {
+    const m: Smi = lastOfs + ((offset - lastOfs) >> 1);
 
-      order =
-          sortState.Compare(key, UnsafeCast<JSAny>(array.objects[base + m]));
+    order = sortState.Compare(key, UnsafeCast<JSAny>(array.objects[base + m]));
 
-      if (order < 0) {
-        offset = m;  // key < a[base + m].
-      } else {
-        lastOfs = m + 1;  // a[base + m] <= key.
-      }
+    if (order < 0) {
+      offset = m;  // key < a[base + m].
+    } else {
+      lastOfs = m + 1;  // a[base + m] <= key.
     }
-    // so a[base + offset - 1] <= key < a[base + offset].
-    assert(lastOfs == offset);
-    assert(0 <= offset && offset <= length);
-    return offset;
   }
+  // so a[base + offset - 1] <= key < a[base + offset].
+  assert(lastOfs == offset);
+  assert(0 <= offset && offset <= length);
+  return offset;
+}
 
-  // Merge the lengthA elements starting at baseA with the lengthB elements
-  // starting at baseB in a stable way, in-place. lengthA and lengthB must
-  // be > 0, and baseA + lengthA == baseB. Must also have that
-  // array[baseB] < array[baseA],
-  // that array[baseA + lengthA - 1] belongs at the end of the merge,
-  // and should have lengthA <= lengthB.
-  transitioning macro MergeLow(implicit context: Context, sortState: SortState)(
-      baseA: Smi, lengthAArg: Smi, baseB: Smi, lengthBArg: Smi) {
-    assert(0 < lengthAArg && 0 < lengthBArg);
-    assert(0 <= baseA && 0 < baseB);
-    assert(baseA + lengthAArg == baseB);
+// Merge the lengthA elements starting at baseA with the lengthB elements
+// starting at baseB in a stable way, in-place. lengthA and lengthB must
+// be > 0, and baseA + lengthA == baseB. Must also have that
+// array[baseB] < array[baseA],
+// that array[baseA + lengthA - 1] belongs at the end of the merge,
+// and should have lengthA <= lengthB.
+transitioning macro MergeLow(implicit context: Context, sortState: SortState)(
+    baseA: Smi, lengthAArg: Smi, baseB: Smi, lengthBArg: Smi) {
+  assert(0 < lengthAArg && 0 < lengthBArg);
+  assert(0 <= baseA && 0 < baseB);
+  assert(baseA + lengthAArg == baseB);
+
+  let lengthA: Smi = lengthAArg;
+  let lengthB: Smi = lengthBArg;
+
+  const workArray = sortState.workArray;
+  const tempArray: FixedArray = GetTempArray(sortState, lengthA);
+  Copy(workArray, baseA, tempArray, 0, lengthA);
+
+  let dest: Smi = baseA;
+  let cursorTemp: Smi = 0;
+  let cursorB: Smi = baseB;
+
+  workArray.objects[dest++] = workArray.objects[cursorB++];
+
+  try {
+    if (--lengthB == 0) goto Succeed;
+    if (lengthA == 1) goto CopyB;
+
+    let minGallop: Smi = sortState.minGallop;
+    // TODO(szuend): Replace with something that does not have a runtime
+    //               overhead as soon as its available in Torque.
+    while (Int32TrueConstant()) {
+      let nofWinsA: Smi = 0;  // # of times A won in a row.
+      let nofWinsB: Smi = 0;  // # of times B won in a row.
+
+      // Do the straightforward thing until (if ever) one run appears to
+      // win consistently.
+      // TODO(szuend): Replace with something that does not have a runtime
+      //               overhead as soon as its available in Torque.
+      while (Int32TrueConstant()) {
+        assert(lengthA > 1 && lengthB > 0);
 
-    let lengthA: Smi = lengthAArg;
-    let lengthB: Smi = lengthBArg;
+        const order = sortState.Compare(
+            UnsafeCast<JSAny>(workArray.objects[cursorB]),
+            UnsafeCast<JSAny>(tempArray.objects[cursorTemp]));
 
-    const workArray = sortState.workArray;
-    const tempArray: FixedArray = GetTempArray(sortState, lengthA);
-    Copy(workArray, baseA, tempArray, 0, lengthA);
+        if (order < 0) {
+          workArray.objects[dest++] = workArray.objects[cursorB++];
 
-    let dest: Smi = baseA;
-    let cursorTemp: Smi = 0;
-    let cursorB: Smi = baseB;
+          ++nofWinsB;
+          --lengthB;
+          nofWinsA = 0;
 
-    workArray.objects[dest++] = workArray.objects[cursorB++];
+          if (lengthB == 0) goto Succeed;
+          if (nofWinsB >= minGallop) break;
+        } else {
+          workArray.objects[dest++] = tempArray.objects[cursorTemp++];
 
-    try {
-      if (--lengthB == 0) goto Succeed;
-      if (lengthA == 1) goto CopyB;
+          ++nofWinsA;
+          --lengthA;
+          nofWinsB = 0;
 
-      let minGallop: Smi = sortState.minGallop;
-      // TODO(szuend): Replace with something that does not have a runtime
-      //               overhead as soon as its available in Torque.
-      while (Int32TrueConstant()) {
-        let nofWinsA: Smi = 0;  // # of times A won in a row.
-        let nofWinsB: Smi = 0;  // # of times B won in a row.
-
-        // Do the straightforward thing until (if ever) one run appears to
-        // win consistently.
-        // TODO(szuend): Replace with something that does not have a runtime
-        //               overhead as soon as its available in Torque.
-        while (Int32TrueConstant()) {
-          assert(lengthA > 1 && lengthB > 0);
-
-          const order = sortState.Compare(
-              UnsafeCast<JSAny>(workArray.objects[cursorB]),
-              UnsafeCast<JSAny>(tempArray.objects[cursorTemp]));
-
-          if (order < 0) {
-            workArray.objects[dest++] = workArray.objects[cursorB++];
-
-            ++nofWinsB;
-            --lengthB;
-            nofWinsA = 0;
-
-            if (lengthB == 0) goto Succeed;
-            if (nofWinsB >= minGallop) break;
-          } else {
-            workArray.objects[dest++] = tempArray.objects[cursorTemp++];
-
-            ++nofWinsA;
-            --lengthA;
-            nofWinsB = 0;
-
-            if (lengthA == 1) goto CopyB;
-            if (nofWinsA >= minGallop) break;
-          }
+          if (lengthA == 1) goto CopyB;
+          if (nofWinsA >= minGallop) break;
         }
+      }
 
-        // One run is winning so consistently that galloping may be a huge
-        // win. So try that, and continue galloping until (if ever) neither
-        // run appears to be winning consistently anymore.
-        ++minGallop;
-        let firstIteration: bool = true;
-        while (nofWinsA >= kMinGallopWins || nofWinsB >= kMinGallopWins ||
-               firstIteration) {
-          firstIteration = false;
-          assert(lengthA > 1 && lengthB > 0);
-
-          minGallop = SmiMax(1, minGallop - 1);
-          sortState.minGallop = minGallop;
-
-          nofWinsA = GallopRight(
-              tempArray, UnsafeCast<JSAny>(workArray.objects[cursorB]),
-              cursorTemp, lengthA, 0);
-          assert(nofWinsA >= 0);
-
-          if (nofWinsA > 0) {
-            Copy(tempArray, cursorTemp, workArray, dest, nofWinsA);
-            dest = dest + nofWinsA;
-            cursorTemp = cursorTemp + nofWinsA;
-            lengthA = lengthA - nofWinsA;
-
-            if (lengthA == 1) goto CopyB;
-
-            // lengthA == 0 is impossible now if the comparison function is
-            // consistent, but we can't assume that it is.
-            if (lengthA == 0) goto Succeed;
-          }
-          workArray.objects[dest++] = workArray.objects[cursorB++];
-          if (--lengthB == 0) goto Succeed;
+      // One run is winning so consistently that galloping may be a huge
+      // win. So try that, and continue galloping until (if ever) neither
+      // run appears to be winning consistently anymore.
+      ++minGallop;
+      let firstIteration: bool = true;
+      while (nofWinsA >= kMinGallopWins || nofWinsB >= kMinGallopWins ||
+             firstIteration) {
+        firstIteration = false;
+        assert(lengthA > 1 && lengthB > 0);
+
+        minGallop = SmiMax(1, minGallop - 1);
+        sortState.minGallop = minGallop;
 
-          nofWinsB = GallopLeft(
-              workArray, UnsafeCast<JSAny>(tempArray.objects[cursorTemp]),
-              cursorB, lengthB, 0);
-          assert(nofWinsB >= 0);
-          if (nofWinsB > 0) {
-            Copy(workArray, cursorB, workArray, dest, nofWinsB);
+        nofWinsA = GallopRight(
+            tempArray, UnsafeCast<JSAny>(workArray.objects[cursorB]),
+            cursorTemp, lengthA, 0);
+        assert(nofWinsA >= 0);
 
-            dest = dest + nofWinsB;
-            cursorB = cursorB + nofWinsB;
-            lengthB = lengthB - nofWinsB;
+        if (nofWinsA > 0) {
+          Copy(tempArray, cursorTemp, workArray, dest, nofWinsA);
+          dest = dest + nofWinsA;
+          cursorTemp = cursorTemp + nofWinsA;
+          lengthA = lengthA - nofWinsA;
 
-            if (lengthB == 0) goto Succeed;
-          }
-          workArray.objects[dest++] = tempArray.objects[cursorTemp++];
-          if (--lengthA == 1) goto CopyB;
+          if (lengthA == 1) goto CopyB;
+
+          // lengthA == 0 is impossible now if the comparison function is
+          // consistent, but we can't assume that it is.
+          if (lengthA == 0) goto Succeed;
         }
-        ++minGallop;  // Penalize it for leaving galloping mode
-        sortState.minGallop = minGallop;
-      }
-    }
-    label Succeed {
-      if (lengthA > 0) {
-        Copy(tempArray, cursorTemp, workArray, dest, lengthA);
+        workArray.objects[dest++] = workArray.objects[cursorB++];
+        if (--lengthB == 0) goto Succeed;
+
+        nofWinsB = GallopLeft(
+            workArray, UnsafeCast<JSAny>(tempArray.objects[cursorTemp]),
+            cursorB, lengthB, 0);
+        assert(nofWinsB >= 0);
+        if (nofWinsB > 0) {
+          Copy(workArray, cursorB, workArray, dest, nofWinsB);
+
+          dest = dest + nofWinsB;
+          cursorB = cursorB + nofWinsB;
+          lengthB = lengthB - nofWinsB;
+
+          if (lengthB == 0) goto Succeed;
+        }
+        workArray.objects[dest++] = tempArray.objects[cursorTemp++];
+        if (--lengthA == 1) goto CopyB;
       }
+      ++minGallop;  // Penalize it for leaving galloping mode
+      sortState.minGallop = minGallop;
     }
-    label CopyB {
-      assert(lengthA == 1 && lengthB > 0);
-      // The last element of run A belongs at the end of the merge.
-      Copy(workArray, cursorB, workArray, dest, lengthB);
-      workArray.objects[dest + lengthB] = tempArray.objects[cursorTemp];
+  } label Succeed {
+    if (lengthA > 0) {
+      Copy(tempArray, cursorTemp, workArray, dest, lengthA);
     }
+  } label CopyB {
+    assert(lengthA == 1 && lengthB > 0);
+    // The last element of run A belongs at the end of the merge.
+    Copy(workArray, cursorB, workArray, dest, lengthB);
+    workArray.objects[dest + lengthB] = tempArray.objects[cursorTemp];
   }
+}
 
-  // Merge the lengthA elements starting at baseA with the lengthB elements
-  // starting at baseB in a stable way, in-place. lengthA and lengthB must
-  // be > 0. Must also have that array[baseA + lengthA - 1] belongs at the
-  // end of the merge and should have lengthA >= lengthB.
-  transitioning macro MergeHigh(
-      implicit context: Context,
-      sortState:
-          SortState)(baseA: Smi, lengthAArg: Smi, baseB: Smi, lengthBArg: Smi) {
-    assert(0 < lengthAArg && 0 < lengthBArg);
-    assert(0 <= baseA && 0 < baseB);
-    assert(baseA + lengthAArg == baseB);
-
-    let lengthA: Smi = lengthAArg;
-    let lengthB: Smi = lengthBArg;
-
-    const workArray = sortState.workArray;
-    const tempArray: FixedArray = GetTempArray(sortState, lengthB);
-    Copy(workArray, baseB, tempArray, 0, lengthB);
-
-    // MergeHigh merges the two runs backwards.
-    let dest: Smi = baseB + lengthB - 1;
-    let cursorTemp: Smi = lengthB - 1;
-    let cursorA: Smi = baseA + lengthA - 1;
-
-    workArray.objects[dest--] = workArray.objects[cursorA--];
-
-    try {
-      if (--lengthA == 0) goto Succeed;
-      if (lengthB == 1) goto CopyA;
-
-      let minGallop: Smi = sortState.minGallop;
+// Merge the lengthA elements starting at baseA with the lengthB elements
+// starting at baseB in a stable way, in-place. lengthA and lengthB must
+// be > 0. Must also have that array[baseA + lengthA - 1] belongs at the
+// end of the merge and should have lengthA >= lengthB.
+transitioning macro MergeHigh(implicit context: Context, sortState: SortState)(
+    baseA: Smi, lengthAArg: Smi, baseB: Smi, lengthBArg: Smi) {
+  assert(0 < lengthAArg && 0 < lengthBArg);
+  assert(0 <= baseA && 0 < baseB);
+  assert(baseA + lengthAArg == baseB);
+
+  let lengthA: Smi = lengthAArg;
+  let lengthB: Smi = lengthBArg;
+
+  const workArray = sortState.workArray;
+  const tempArray: FixedArray = GetTempArray(sortState, lengthB);
+  Copy(workArray, baseB, tempArray, 0, lengthB);
+
+  // MergeHigh merges the two runs backwards.
+  let dest: Smi = baseB + lengthB - 1;
+  let cursorTemp: Smi = lengthB - 1;
+  let cursorA: Smi = baseA + lengthA - 1;
+
+  workArray.objects[dest--] = workArray.objects[cursorA--];
+
+  try {
+    if (--lengthA == 0) goto Succeed;
+    if (lengthB == 1) goto CopyA;
+
+    let minGallop: Smi = sortState.minGallop;
+    // TODO(szuend): Replace with something that does not have a runtime
+    //               overhead as soon as its available in Torque.
+    while (Int32TrueConstant()) {
+      let nofWinsA: Smi = 0;  // # of times A won in a row.
+      let nofWinsB: Smi = 0;  // # of times B won in a row.
+
+      // Do the straightforward thing until (if ever) one run appears to
+      // win consistently.
       // TODO(szuend): Replace with something that does not have a runtime
       //               overhead as soon as its available in Torque.
       while (Int32TrueConstant()) {
-        let nofWinsA: Smi = 0;  // # of times A won in a row.
-        let nofWinsB: Smi = 0;  // # of times B won in a row.
-
-        // Do the straightforward thing until (if ever) one run appears to
-        // win consistently.
-        // TODO(szuend): Replace with something that does not have a runtime
-        //               overhead as soon as its available in Torque.
-        while (Int32TrueConstant()) {
-          assert(lengthA > 0 && lengthB > 1);
-
-          const order = sortState.Compare(
-              UnsafeCast<JSAny>(tempArray.objects[cursorTemp]),
-              UnsafeCast<JSAny>(workArray.objects[cursorA]));
-
-          if (order < 0) {
-            workArray.objects[dest--] = workArray.objects[cursorA--];
-
-            ++nofWinsA;
-            --lengthA;
-            nofWinsB = 0;
-
-            if (lengthA == 0) goto Succeed;
-            if (nofWinsA >= minGallop) break;
-          } else {
-            workArray.objects[dest--] = tempArray.objects[cursorTemp--];
-
-            ++nofWinsB;
-            --lengthB;
-            nofWinsA = 0;
-
-            if (lengthB == 1) goto CopyA;
-            if (nofWinsB >= minGallop) break;
-          }
-        }
+        assert(lengthA > 0 && lengthB > 1);
 
-        // One run is winning so consistently that galloping may be a huge
-        // win. So try that, and continue galloping until (if ever) neither
-        // run appears to be winning consistently anymore.
-        ++minGallop;
-        let firstIteration: bool = true;
-        while (nofWinsA >= kMinGallopWins || nofWinsB >= kMinGallopWins ||
-               firstIteration) {
-          firstIteration = false;
-
-          assert(lengthA > 0 && lengthB > 1);
-
-          minGallop = SmiMax(1, minGallop - 1);
-          sortState.minGallop = minGallop;
-
-          let k: Smi = GallopRight(
-              workArray, UnsafeCast<JSAny>(tempArray.objects[cursorTemp]),
-              baseA, lengthA, lengthA - 1);
-          assert(k >= 0);
-          nofWinsA = lengthA - k;
-
-          if (nofWinsA > 0) {
-            dest = dest - nofWinsA;
-            cursorA = cursorA - nofWinsA;
-            Copy(workArray, cursorA + 1, workArray, dest + 1, nofWinsA);
-
-            lengthA = lengthA - nofWinsA;
-            if (lengthA == 0) goto Succeed;
-          }
-          workArray.objects[dest--] = tempArray.objects[cursorTemp--];
-          if (--lengthB == 1) goto CopyA;
-
-          k = GallopLeft(
-              tempArray, UnsafeCast<JSAny>(workArray.objects[cursorA]), 0,
-              lengthB, lengthB - 1);
-          assert(k >= 0);
-          nofWinsB = lengthB - k;
-
-          if (nofWinsB > 0) {
-            dest = dest - nofWinsB;
-            cursorTemp = cursorTemp - nofWinsB;
-            Copy(tempArray, cursorTemp + 1, workArray, dest + 1, nofWinsB);
-
-            lengthB = lengthB - nofWinsB;
-            if (lengthB == 1) goto CopyA;
-
-            // lengthB == 0 is impossible now if the comparison function is
-            // consistent, but we can't assume that it is.
-            if (lengthB == 0) goto Succeed;
-          }
+        const order = sortState.Compare(
+            UnsafeCast<JSAny>(tempArray.objects[cursorTemp]),
+            UnsafeCast<JSAny>(workArray.objects[cursorA]));
+
+        if (order < 0) {
           workArray.objects[dest--] = workArray.objects[cursorA--];
-          if (--lengthA == 0) goto Succeed;
+
+          ++nofWinsA;
+          --lengthA;
+          nofWinsB = 0;
+
+          if (lengthA == 0) goto Succeed;
+          if (nofWinsA >= minGallop) break;
+        } else {
+          workArray.objects[dest--] = tempArray.objects[cursorTemp--];
+
+          ++nofWinsB;
+          --lengthB;
+          nofWinsA = 0;
+
+          if (lengthB == 1) goto CopyA;
+          if (nofWinsB >= minGallop) break;
         }
-        ++minGallop;
-        sortState.minGallop = minGallop;
-      }
-    }
-    label Succeed {
-      if (lengthB > 0) {
-        assert(lengthA == 0);
-        Copy(tempArray, 0, workArray, dest - (lengthB - 1), lengthB);
       }
-    }
-    label CopyA {
-      assert(lengthB == 1 && lengthA > 0);
-
-      // The first element of run B belongs at the front of the merge.
-      dest = dest - lengthA;
-      cursorA = cursorA - lengthA;
-      Copy(workArray, cursorA + 1, workArray, dest + 1, lengthA);
-      workArray.objects[dest] = tempArray.objects[cursorTemp];
-    }
-  }
 
-  // Compute a good value for the minimum run length; natural runs shorter
-  // than this are boosted artificially via binary insertion sort.
-  //
-  // If n < 64, return n (it's too small to bother with fancy stuff).
-  // Else if n is an exact power of 2, return 32.
-  // Else return an int k, 32 <= k <= 64, such that n/k is close to, but
-  // strictly less than, an exact power of 2.
-  //
-  // See listsort.txt for more info.
-  macro ComputeMinRunLength(nArg: Smi): Smi {
-    let n: Smi = nArg;
-    let r: Smi = 0;  // Becomes 1 if any 1 bits are shifted off.
-
-    assert(n >= 0);
-    while (n >= 64) {
-      r = r | (n & 1);
-      n = n >> 1;
-    }
+      // One run is winning so consistently that galloping may be a huge
+      // win. So try that, and continue galloping until (if ever) neither
+      // run appears to be winning consistently anymore.
+      ++minGallop;
+      let firstIteration: bool = true;
+      while (nofWinsA >= kMinGallopWins || nofWinsB >= kMinGallopWins ||
+             firstIteration) {
+        firstIteration = false;
 
-    const minRunLength: Smi = n + r;
-    assert(nArg < 64 || (32 <= minRunLength && minRunLength <= 64));
-    return minRunLength;
-  }
+        assert(lengthA > 0 && lengthB > 1);
 
-  // Returns true iff run_length(n - 2) > run_length(n - 1) + run_length(n).
-  macro RunInvariantEstablished(implicit context: Context)(
-      pendingRuns: FixedArray, n: Smi): bool {
-    if (n < 2) return true;
+        minGallop = SmiMax(1, minGallop - 1);
+        sortState.minGallop = minGallop;
 
-    const runLengthN: Smi = GetPendingRunLength(pendingRuns, n);
-    const runLengthNM: Smi = GetPendingRunLength(pendingRuns, n - 1);
-    const runLengthNMM: Smi = GetPendingRunLength(pendingRuns, n - 2);
+        let k: Smi = GallopRight(
+            workArray, UnsafeCast<JSAny>(tempArray.objects[cursorTemp]), baseA,
+            lengthA, lengthA - 1);
+        assert(k >= 0);
+        nofWinsA = lengthA - k;
 
-    return runLengthNMM > runLengthNM + runLengthN;
-  }
+        if (nofWinsA > 0) {
+          dest = dest - nofWinsA;
+          cursorA = cursorA - nofWinsA;
+          Copy(workArray, cursorA + 1, workArray, dest + 1, nofWinsA);
 
-  // Examines the stack of runs waiting to be merged, merging adjacent runs
-  // until the stack invariants are re-established:
-  //
-  //   1. run_length(i - 3) > run_length(i - 2) + run_length(i - 1)
-  //   2. run_length(i - 2) > run_length(i - 1)
-  //
-  // TODO(szuend): Remove unnecessary loads. This macro was refactored to
-  //               improve readability, introducing unnecessary loads in the
-  //               process. Determine if all these extra loads are ok.
-  transitioning macro MergeCollapse(context: Context, sortState: SortState) {
-    const pendingRuns: FixedArray = sortState.pendingRuns;
-
-    // Reload the stack size because MergeAt might change it.
-    while (GetPendingRunsSize(sortState) > 1) {
-      let n: Smi = GetPendingRunsSize(sortState) - 2;
-
-      if (!RunInvariantEstablished(pendingRuns, n + 1) ||
-          !RunInvariantEstablished(pendingRuns, n)) {
-        if (GetPendingRunLength(pendingRuns, n - 1) <
-            GetPendingRunLength(pendingRuns, n + 1)) {
-          --n;
+          lengthA = lengthA - nofWinsA;
+          if (lengthA == 0) goto Succeed;
         }
-
-        MergeAt(n);
-      } else if (
-          GetPendingRunLength(pendingRuns, n) <=
-          GetPendingRunLength(pendingRuns, n + 1)) {
-        MergeAt(n);
-      } else {
-        break;
+        workArray.objects[dest--] = tempArray.objects[cursorTemp--];
+        if (--lengthB == 1) goto CopyA;
+
+        k = GallopLeft(
+            tempArray, UnsafeCast<JSAny>(workArray.objects[cursorA]), 0,
+            lengthB, lengthB - 1);
+        assert(k >= 0);
+        nofWinsB = lengthB - k;
+
+        if (nofWinsB > 0) {
+          dest = dest - nofWinsB;
+          cursorTemp = cursorTemp - nofWinsB;
+          Copy(tempArray, cursorTemp + 1, workArray, dest + 1, nofWinsB);
+
+          lengthB = lengthB - nofWinsB;
+          if (lengthB == 1) goto CopyA;
+
+          // lengthB == 0 is impossible now if the comparison function is
+          // consistent, but we can't assume that it is.
+          if (lengthB == 0) goto Succeed;
+        }
+        workArray.objects[dest--] = workArray.objects[cursorA--];
+        if (--lengthA == 0) goto Succeed;
       }
+      ++minGallop;
+      sortState.minGallop = minGallop;
+    }
+  } label Succeed {
+    if (lengthB > 0) {
+      assert(lengthA == 0);
+      Copy(tempArray, 0, workArray, dest - (lengthB - 1), lengthB);
     }
+  } label CopyA {
+    assert(lengthB == 1 && lengthA > 0);
+
+    // The first element of run B belongs at the front of the merge.
+    dest = dest - lengthA;
+    cursorA = cursorA - lengthA;
+    Copy(workArray, cursorA + 1, workArray, dest + 1, lengthA);
+    workArray.objects[dest] = tempArray.objects[cursorTemp];
+  }
+}
+
+// Compute a good value for the minimum run length; natural runs shorter
+// than this are boosted artificially via binary insertion sort.
+//
+// If n < 64, return n (it's too small to bother with fancy stuff).
+// Else if n is an exact power of 2, return 32.
+// Else return an int k, 32 <= k <= 64, such that n/k is close to, but
+// strictly less than, an exact power of 2.
+//
+// See listsort.txt for more info.
+macro ComputeMinRunLength(nArg: Smi): Smi {
+  let n: Smi = nArg;
+  let r: Smi = 0;  // Becomes 1 if any 1 bits are shifted off.
+
+  assert(n >= 0);
+  while (n >= 64) {
+    r = r | (n & 1);
+    n = n >> 1;
   }
 
-  // Regardless of invariants, merge all runs on the stack until only one
-  // remains. This is used at the end of the mergesort.
-  transitioning macro
-  MergeForceCollapse(context: Context, sortState: SortState) {
-    const pendingRuns: FixedArray = sortState.pendingRuns;
+  const minRunLength: Smi = n + r;
+  assert(nArg < 64 || (32 <= minRunLength && minRunLength <= 64));
+  return minRunLength;
+}
+
+// Returns true iff run_length(n - 2) > run_length(n - 1) + run_length(n).
+macro RunInvariantEstablished(implicit context: Context)(
+    pendingRuns: FixedArray, n: Smi): bool {
+  if (n < 2) return true;
+
+  const runLengthN: Smi = GetPendingRunLength(pendingRuns, n);
+  const runLengthNM: Smi = GetPendingRunLength(pendingRuns, n - 1);
+  const runLengthNMM: Smi = GetPendingRunLength(pendingRuns, n - 2);
 
-    // Reload the stack size becuase MergeAt might change it.
-    while (GetPendingRunsSize(sortState) > 1) {
-      let n: Smi = GetPendingRunsSize(sortState) - 2;
+  return runLengthNMM > runLengthNM + runLengthN;
+}
 
-      if (n > 0 &&
-          GetPendingRunLength(pendingRuns, n - 1) <
-              GetPendingRunLength(pendingRuns, n + 1)) {
+// Examines the stack of runs waiting to be merged, merging adjacent runs
+// until the stack invariants are re-established:
+//
+//   1. run_length(i - 3) > run_length(i - 2) + run_length(i - 1)
+//   2. run_length(i - 2) > run_length(i - 1)
+//
+// TODO(szuend): Remove unnecessary loads. This macro was refactored to
+//               improve readability, introducing unnecessary loads in the
+//               process. Determine if all these extra loads are ok.
+transitioning macro MergeCollapse(context: Context, sortState: SortState) {
+  const pendingRuns: FixedArray = sortState.pendingRuns;
+
+  // Reload the stack size because MergeAt might change it.
+  while (GetPendingRunsSize(sortState) > 1) {
+    let n: Smi = GetPendingRunsSize(sortState) - 2;
+
+    if (!RunInvariantEstablished(pendingRuns, n + 1) ||
+        !RunInvariantEstablished(pendingRuns, n)) {
+      if (GetPendingRunLength(pendingRuns, n - 1) <
+          GetPendingRunLength(pendingRuns, n + 1)) {
         --n;
       }
+
       MergeAt(n);
+    } else if (
+        GetPendingRunLength(pendingRuns, n) <=
+        GetPendingRunLength(pendingRuns, n + 1)) {
+      MergeAt(n);
+    } else {
+      break;
     }
   }
+}
 
-  transitioning macro
-  ArrayTimSortImpl(context: Context, sortState: SortState, length: Smi) {
-    if (length < 2) return;
-    let remaining: Smi = length;
-
-    // March over the array once, left to right, finding natural runs,
-    // and extending short natural runs to minrun elements.
-    let low: Smi = 0;
-    const minRunLength: Smi = ComputeMinRunLength(remaining);
-    while (remaining != 0) {
-      let currentRunLength: Smi = CountAndMakeRun(low, low + remaining);
-
-      // If the run is short, extend it to min(minRunLength, remaining).
-      if (currentRunLength < minRunLength) {
-        const forcedRunLength: Smi = SmiMin(minRunLength, remaining);
-        BinaryInsertionSort(low, low + currentRunLength, low + forcedRunLength);
-        currentRunLength = forcedRunLength;
-      }
-
-      // Push run onto pending-runs stack, and maybe merge.
-      PushRun(sortState, low, currentRunLength);
+// Regardless of invariants, merge all runs on the stack until only one
+// remains. This is used at the end of the mergesort.
+transitioning macro
+MergeForceCollapse(context: Context, sortState: SortState) {
+  const pendingRuns: FixedArray = sortState.pendingRuns;
 
-      MergeCollapse(context, sortState);
+  // Reload the stack size becuase MergeAt might change it.
+  while (GetPendingRunsSize(sortState) > 1) {
+    let n: Smi = GetPendingRunsSize(sortState) - 2;
 
-      // Advance to find next run.
-      low = low + currentRunLength;
-      remaining = remaining - currentRunLength;
+    if (n > 0 &&
+        GetPendingRunLength(pendingRuns, n - 1) <
+            GetPendingRunLength(pendingRuns, n + 1)) {
+      --n;
     }
-
-    MergeForceCollapse(context, sortState);
-    assert(GetPendingRunsSize(sortState) == 1);
-    assert(GetPendingRunLength(sortState.pendingRuns, 0) == length);
+    MergeAt(n);
   }
+}
 
-  transitioning macro
-  CompactReceiverElementsIntoWorkArray(
-      implicit context: Context, sortState: SortState)(): Smi {
-    let growableWorkArray = growable_fixed_array::GrowableFixedArray{
-      array: sortState.workArray,
-      capacity: Convert<intptr>(sortState.workArray.length),
-      length: 0
-    };
-
-    const loadFn = sortState.loadFn;
-
-    // TODO(szuend): Implement full range sorting, not only up to MaxSmi.
-    //               https://crbug.com/v8/7970.
-    const receiverLength: Number = sortState.initialReceiverLength;
-    assert(IsNumberNormalized(receiverLength));
-
-    const sortLength: Smi = TaggedIsSmi(receiverLength) ?
-        UnsafeCast<Smi>(receiverLength) :
-        Convert<PositiveSmi>(kSmiMax) otherwise unreachable;
-
-    // Move all non-undefined elements into {sortState.workArray}, holes
-    // are ignored.
-    let numberOfUndefined: Smi = 0;
-    for (let i: Smi = 0; i < receiverLength; ++i) {
-      const element: JSAny|TheHole = loadFn(context, sortState, i);
-
-      if (element == TheHole) {
-        // Do nothing for holes. The result is that elements are
-        // compacted at the front of the work array.
-      } else if (element == Undefined) {
-        numberOfUndefined++;
-      } else {
-        growableWorkArray.Push(element);
-      }
+transitioning macro
+ArrayTimSortImpl(context: Context, sortState: SortState, length: Smi) {
+  if (length < 2) return;
+  let remaining: Smi = length;
+
+  // March over the array once, left to right, finding natural runs,
+  // and extending short natural runs to minrun elements.
+  let low: Smi = 0;
+  const minRunLength: Smi = ComputeMinRunLength(remaining);
+  while (remaining != 0) {
+    let currentRunLength: Smi = CountAndMakeRun(low, low + remaining);
+
+    // If the run is short, extend it to min(minRunLength, remaining).
+    if (currentRunLength < minRunLength) {
+      const forcedRunLength: Smi = SmiMin(minRunLength, remaining);
+      BinaryInsertionSort(low, low + currentRunLength, low + forcedRunLength);
+      currentRunLength = forcedRunLength;
     }
 
-    // Reset the workArray on the frameState, as it may have grown.
-    sortState.workArray = growableWorkArray.array;
-    sortState.sortLength = sortLength;
-    sortState.numberOfUndefined = numberOfUndefined;
+    // Push run onto pending-runs stack, and maybe merge.
+    PushRun(sortState, low, currentRunLength);
+
+    MergeCollapse(context, sortState);
 
-    return Convert<Smi>(growableWorkArray.length);
+    // Advance to find next run.
+    low = low + currentRunLength;
+    remaining = remaining - currentRunLength;
   }
 
-  transitioning macro
-  CopyWorkArrayToReceiver(implicit context: Context, sortState: SortState)(
-      numberOfNonUndefined: Smi) {
-    const storeFn = sortState.storeFn;
-    const workArray = sortState.workArray;
-
-    assert(numberOfNonUndefined <= workArray.length);
-    assert(
-        numberOfNonUndefined + sortState.numberOfUndefined <=
-        sortState.sortLength);
-
-    // Writing the elements back is a 3 step process:
-    //   1. Copy the sorted elements from the workarray to the receiver.
-    //   2. Add {nOfUndefined} undefineds to the receiver.
-    //   3. Depending on the backing store either delete properties or
-    //      set them to the TheHole up to {sortState.sortLength}.
-    let index: Smi = 0;
-    for (; index < numberOfNonUndefined; ++index) {
-      storeFn(
-          context, sortState, index,
-          UnsafeCast<JSAny>(workArray.objects[index]));
-    }
+  MergeForceCollapse(context, sortState);
+  assert(GetPendingRunsSize(sortState) == 1);
+  assert(GetPendingRunLength(sortState.pendingRuns, 0) == length);
+}
 
-    const numberOfUndefinedEnd: Smi =
-        sortState.numberOfUndefined + numberOfNonUndefined;
-    for (; index < numberOfUndefinedEnd; ++index) {
-      storeFn(context, sortState, index, Undefined);
+transitioning macro
+CompactReceiverElementsIntoWorkArray(
+    implicit context: Context, sortState: SortState)(): Smi {
+  let growableWorkArray = growable_fixed_array::GrowableFixedArray{
+    array: sortState.workArray,
+    capacity: Convert<intptr>(sortState.workArray.length),
+    length: 0
+  };
+
+  const loadFn = sortState.loadFn;
+
+  // TODO(szuend): Implement full range sorting, not only up to MaxSmi.
+  //               https://crbug.com/v8/7970.
+  const receiverLength: Number = sortState.initialReceiverLength;
+  assert(IsNumberNormalized(receiverLength));
+
+  const sortLength: Smi = TaggedIsSmi(receiverLength) ?
+      UnsafeCast<Smi>(receiverLength) :
+      Convert<PositiveSmi>(kSmiMax) otherwise unreachable;
+
+  // Move all non-undefined elements into {sortState.workArray}, holes
+  // are ignored.
+  let numberOfUndefined: Smi = 0;
+  for (let i: Smi = 0; i < receiverLength; ++i) {
+    const element: JSAny|TheHole = loadFn(context, sortState, i);
+
+    if (element == TheHole) {
+      // Do nothing for holes. The result is that elements are
+      // compacted at the front of the work array.
+    } else if (element == Undefined) {
+      numberOfUndefined++;
+    } else {
+      growableWorkArray.Push(element);
     }
+  }
 
-    const end: Smi = sortState.sortLength;
-    const deleteFn = sortState.deleteFn;
-    for (; index < end; ++index) {
-      deleteFn(context, sortState, index);
-    }
+  // Reset the workArray on the frameState, as it may have grown.
+  sortState.workArray = growableWorkArray.array;
+  sortState.sortLength = sortLength;
+  sortState.numberOfUndefined = numberOfUndefined;
+
+  return Convert<Smi>(growableWorkArray.length);
+}
+
+transitioning macro
+CopyWorkArrayToReceiver(implicit context: Context, sortState: SortState)(
+    numberOfNonUndefined: Smi) {
+  const storeFn = sortState.storeFn;
+  const workArray = sortState.workArray;
+
+  assert(numberOfNonUndefined <= workArray.length);
+  assert(
+      numberOfNonUndefined + sortState.numberOfUndefined <=
+      sortState.sortLength);
+
+  // Writing the elements back is a 3 step process:
+  //   1. Copy the sorted elements from the workarray to the receiver.
+  //   2. Add {nOfUndefined} undefineds to the receiver.
+  //   3. Depending on the backing store either delete properties or
+  //      set them to the TheHole up to {sortState.sortLength}.
+  let index: Smi = 0;
+  for (; index < numberOfNonUndefined; ++index) {
+    storeFn(
+        context, sortState, index, UnsafeCast<JSAny>(workArray.objects[index]));
   }
 
-  transitioning builtin
-  ArrayTimSort(context: Context, sortState: SortState): JSAny {
-    const numberOfNonUndefined: Smi = CompactReceiverElementsIntoWorkArray();
-    ArrayTimSortImpl(context, sortState, numberOfNonUndefined);
+  const numberOfUndefinedEnd: Smi =
+      sortState.numberOfUndefined + numberOfNonUndefined;
+  for (; index < numberOfUndefinedEnd; ++index) {
+    storeFn(context, sortState, index, Undefined);
+  }
 
-    try {
-      // The comparison function or toString might have changed the
-      // receiver, if that is the case, we switch to the slow path.
-      sortState.CheckAccessor() otherwise Slow;
-    }
-    label Slow deferred {
-      sortState.ResetToGenericAccessor();
-    }
+  const end: Smi = sortState.sortLength;
+  const deleteFn = sortState.deleteFn;
+  for (; index < end; ++index) {
+    deleteFn(context, sortState, index);
+  }
+}
 
-    CopyWorkArrayToReceiver(numberOfNonUndefined);
-    return kSuccess;
+transitioning builtin
+ArrayTimSort(context: Context, sortState: SortState): JSAny {
+  const numberOfNonUndefined: Smi = CompactReceiverElementsIntoWorkArray();
+  ArrayTimSortImpl(context, sortState, numberOfNonUndefined);
+
+  try {
+    // The comparison function or toString might have changed the
+    // receiver, if that is the case, we switch to the slow path.
+    sortState.CheckAccessor() otherwise Slow;
+  } label Slow deferred {
+    sortState.ResetToGenericAccessor();
   }
 
-  // https://tc39.github.io/ecma262/#sec-array.prototype.sort
-  transitioning javascript builtin
-  ArrayPrototypeSort(js-implicit context: NativeContext, receiver: JSAny)(
-      ...arguments): JSAny {
-    // 1. If comparefn is not undefined and IsCallable(comparefn) is false,
-    //    throw a TypeError exception.
-    const comparefnObj: JSAny = arguments[0];
-    const comparefn = Cast<(Undefined | Callable)>(comparefnObj) otherwise
-    ThrowTypeError(MessageTemplate::kBadSortComparisonFunction, comparefnObj);
+  CopyWorkArrayToReceiver(numberOfNonUndefined);
+  return kSuccess;
+}
 
-    // 2. Let obj be ? ToObject(this value).
-    const obj: JSReceiver = ToObject(context, receiver);
+// https://tc39.github.io/ecma262/#sec-array.prototype.sort
+transitioning javascript builtin
+ArrayPrototypeSort(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  // 1. If comparefn is not undefined and IsCallable(comparefn) is false,
+  //    throw a TypeError exception.
+  const comparefnObj: JSAny = arguments[0];
+  const comparefn = Cast<(Undefined | Callable)>(comparefnObj) otherwise
+  ThrowTypeError(MessageTemplate::kBadSortComparisonFunction, comparefnObj);
 
-    // 3. Let len be ? ToLength(? Get(obj, "length")).
-    const len: Number = GetLengthProperty(obj);
+  // 2. Let obj be ? ToObject(this value).
+  const obj: JSReceiver = ToObject(context, receiver);
 
-    if (len < 2) return receiver;
+  // 3. Let len be ? ToLength(? Get(obj, "length")).
+  const len: Number = GetLengthProperty(obj);
 
-    const sortState: SortState = NewSortState(obj, comparefn, len);
-    ArrayTimSort(context, sortState);
+  if (len < 2) return receiver;
 
-    return receiver;
-  }
+  const sortState: SortState = NewSortState(obj, comparefn, len);
+  ArrayTimSort(context, sortState);
+
+  return receiver;
+}
 }
diff --git a/deps/v8/third_party/zlib/BUILD.gn b/deps/v8/third_party/zlib/BUILD.gn
index 1f572378e02..64cddc7c483 100644
--- a/deps/v8/third_party/zlib/BUILD.gn
+++ b/deps/v8/third_party/zlib/BUILD.gn
@@ -4,6 +4,10 @@
 
 import("//build/config/compiler/compiler.gni")
 
+if (build_with_chromium) {
+  import("//testing/test.gni")
+}
+
 if (current_cpu == "arm" || current_cpu == "arm64") {
   import("//build/config/arm.gni")
 }
@@ -14,6 +18,11 @@ config("zlib_config") {
 
 config("zlib_internal_config") {
   defines = [ "ZLIB_IMPLEMENTATION" ]
+
+  if (!is_debug) {
+    # Build code using -O3, see: crbug.com/1084371.
+    configs = [ "//build/config/compiler:optimize_speed" ]
+  }
 }
 
 use_arm_neon_optimizations = false
@@ -37,7 +46,9 @@ config("zlib_adler32_simd_config") {
     } else {
       defines += [ "X86_NOT_WINDOWS" ]
     }
-  } else if (use_arm_neon_optimizations) {
+  }
+
+  if (use_arm_neon_optimizations) {
     defines = [ "ADLER32_SIMD_NEON" ]
   }
 }
@@ -61,11 +72,6 @@ source_set("zlib_adler32_simd") {
       "adler32_simd.c",
       "adler32_simd.h",
     ]
-    if (!is_debug) {
-      # Use optimize_speed (-O3) to output the _smallest_ code.
-      configs -= [ "//build/config/compiler:default_optimization" ]
-      configs += [ "//build/config/compiler:optimize_speed" ]
-    }
   }
 
   configs += [ ":zlib_internal_config" ]
@@ -110,11 +116,6 @@ if (use_arm_neon_optimizations) {
         "crc32_simd.c",
         "crc32_simd.h",
       ]
-
-      if (!is_debug) {
-        configs -= [ "//build/config/compiler:default_optimization" ]
-        configs += [ "//build/config/compiler:optimize_speed" ]
-      }
     }
 
     configs += [ ":zlib_internal_config" ]
@@ -134,6 +135,7 @@ config("zlib_inflate_chunk_simd_config") {
 
   if (use_arm_neon_optimizations) {
     defines = [ "INFLATE_CHUNK_SIMD_NEON" ]
+
     if (current_cpu == "arm64") {
       defines += [ "INFLATE_CHUNK_READ_64LE" ]
     }
@@ -152,20 +154,14 @@ source_set("zlib_inflate_chunk_simd") {
       "contrib/optimizations/inffast_chunk.h",
       "contrib/optimizations/inflate.c",
     ]
-
-    if (use_arm_neon_optimizations && !is_debug) {
-      # Here we trade better performance on newer/bigger ARMv8 cores
-      # for less perf on ARMv7, per crbug.com/772870#c40
-      configs -= [ "//build/config/compiler:default_optimization" ]
-      configs += [ "//build/config/compiler:optimize_speed" ]
-    }
   }
 
+  configs += [ ":zlib_internal_config" ]
+
+  # Needed for MSVC, which is still supported by V8 and PDFium. zlib uses K&R C
+  # style function declarations, which triggers warning C4131.
   configs -= [ "//build/config/compiler:chromium_code" ]
-  configs += [
-    ":zlib_internal_config",
-    "//build/config/compiler:no_chromium_code",
-  ]
+  configs += [ "//build/config/compiler:no_chromium_code" ]
 
   public_configs = [ ":zlib_inflate_chunk_simd_config" ]
 }
@@ -198,6 +194,15 @@ source_set("zlib_crc32_simd") {
   public_configs = [ ":zlib_crc32_simd_config" ]
 }
 
+config("zlib_x86_simd_config") {
+  if (use_x86_x64_optimizations) {
+    defines = [
+      "CRC32_SIMD_SSE42_PCLMUL",
+      "DEFLATE_FILL_WINDOW_SSE2",
+    ]
+  }
+}
+
 source_set("zlib_x86_simd") {
   visibility = [ ":*" ]
 
@@ -215,11 +220,9 @@ source_set("zlib_x86_simd") {
     }
   }
 
-  configs -= [ "//build/config/compiler:chromium_code" ]
-  configs += [
-    ":zlib_internal_config",
-    "//build/config/compiler:no_chromium_code",
-  ]
+  configs += [ ":zlib_internal_config" ]
+
+  public_configs = [ ":zlib_x86_simd_config" ]
 }
 
 config("zlib_warnings") {
@@ -268,6 +271,7 @@ component("zlib") {
 
   defines = []
   deps = []
+
   if (!use_x86_x64_optimizations && !use_arm_neon_optimizations) {
     # Apparently android_cronet bot builds with NEON disabled and
     # we also should disable optimizations for iOS@x86 (a.k.a. simulator).
@@ -277,8 +281,8 @@ component("zlib") {
   if (is_ios) {
     # iOS@ARM is a special case where we always have NEON but don't check
     # for crypto extensions.
-    # TODO(cavalcantii): verify what is the current state of CPU features shipped
-    # on latest iOS devices.
+    # TODO(cavalcantii): verify what is the current state of CPU features
+    # shipped on latest iOS devices.
     defines += [ "ARM_OS_IOS" ]
   }
 
@@ -298,6 +302,8 @@ component("zlib") {
     sources += [ "inflate.c" ]
   }
 
+  deps += [ ":zlib_x86_simd" ]
+
   if (is_android) {
     import("//build/config/android/config.gni")
     if (defined(android_ndk_root) && android_ndk_root != "") {
@@ -308,17 +314,17 @@ component("zlib") {
   }
 
   configs -= [ "//build/config/compiler:chromium_code" ]
+  configs += [ "//build/config/compiler:no_chromium_code" ]
+
+  public_configs = [ ":zlib_config" ]
+
   configs += [
     ":zlib_internal_config",
-    "//build/config/compiler:no_chromium_code",
 
     # Must be after no_chromium_code for warning flags to be ordered correctly.
     ":zlib_warnings",
   ]
 
-  public_configs = [ ":zlib_config" ]
-
-  deps += [ ":zlib_x86_simd" ]
   allow_circular_includes_from = deps
 }
 
@@ -359,28 +365,53 @@ static_library("minizip") {
   deps = [ ":zlib" ]
 
   configs -= [ "//build/config/compiler:chromium_code" ]
-  configs += [
-    "//build/config/compiler:no_chromium_code",
+  configs += [ "//build/config/compiler:no_chromium_code" ]
 
+  public_configs = [ ":zlib_config" ]
+
+  configs += [
     # Must be after no_chromium_code for warning flags to be ordered correctly.
     ":minizip_warnings",
   ]
-
-  public_configs = [ ":zlib_config" ]
 }
 
 executable("zlib_bench") {
   include_dirs = [ "." ]
 
   sources = [ "contrib/bench/zlib_bench.cc" ]
-
   if (!is_debug) {
     configs -= [ "//build/config/compiler:default_optimization" ]
     configs += [ "//build/config/compiler:optimize_speed" ]
   }
 
+  deps = [ ":zlib" ]
+
   configs -= [ "//build/config/compiler:chromium_code" ]
   configs += [ "//build/config/compiler:no_chromium_code" ]
+}
 
-  deps = [ ":zlib" ]
+if (build_with_chromium) {
+  test("zlib_unittests") {
+    testonly = true
+
+    sources = [
+      "contrib/tests/infcover.cc",
+      "contrib/tests/infcover.h",
+      "contrib/tests/utils_unittest.cc",
+      "google/compression_utils_portable.cc",
+      "google/compression_utils_portable.h",
+    ]
+
+    deps = [
+      ":zlib",
+      "//testing/gtest",
+      "//testing/gtest:gtest_main",
+    ]
+
+    include_dirs = [
+      "//third_party/googletest/src/googletest/include/gtest",
+      ".",
+      "google",
+    ]
+  }
 }
diff --git a/deps/v8/third_party/zlib/DEPS b/deps/v8/third_party/zlib/DEPS
new file mode 100644
index 00000000000..b6dcfc6bc11
--- /dev/null
+++ b/deps/v8/third_party/zlib/DEPS
@@ -0,0 +1,3 @@
+include_rules = [
+    "+testing/gtest",
+]
\ No newline at end of file
diff --git a/deps/v8/third_party/zlib/README.chromium b/deps/v8/third_party/zlib/README.chromium
index 3d90f79be2f..c3c1ef69ad4 100644
--- a/deps/v8/third_party/zlib/README.chromium
+++ b/deps/v8/third_party/zlib/README.chromium
@@ -2,6 +2,7 @@ Name: zlib
 Short Name: zlib
 URL: http://zlib.net/
 Version: 1.2.11
+CPEPrefix: cpe:/a:zlib:zlib:1.2.11
 Security Critical: yes
 License: Custom license
 License File: LICENSE
diff --git a/deps/v8/third_party/zlib/chromeconf.h b/deps/v8/third_party/zlib/chromeconf.h
index 666093d696a..5ecf29edbff 100644
--- a/deps/v8/third_party/zlib/chromeconf.h
+++ b/deps/v8/third_party/zlib/chromeconf.h
@@ -192,4 +192,8 @@
 #define arm_check_features Cr_z_arm_check_features
 #define armv8_crc32_little Cr_z_armv8_crc32_little
 
+/* Symbols added by cpu_features.c */
+#define cpu_check_features Cr_z_cpu_check_features
+#define x86_cpu_enable_sse2 Cr_z_x86_cpu_enable_sse2
+
 #endif /* THIRD_PARTY_ZLIB_CHROMECONF_H_ */
diff --git a/deps/v8/third_party/zlib/contrib/optimizations/insert_string.h b/deps/v8/third_party/zlib/contrib/optimizations/insert_string.h
index 1826601b7fb..d3bc33c5ab0 100644
--- a/deps/v8/third_party/zlib/contrib/optimizations/insert_string.h
+++ b/deps/v8/third_party/zlib/contrib/optimizations/insert_string.h
@@ -4,45 +4,47 @@
  * Use of this source code is governed by a BSD-style license that can be
  * found in the Chromium source repository LICENSE file.
  */
-#ifdef _MSC_VER
+
+#if defined(_MSC_VER)
 #define INLINE __inline
 #else
 #define INLINE inline
 #endif
 
 #include "cpu_features.h"
-/* Optimized insert_string block */
-#if defined(CRC32_SIMD_SSE42_PCLMUL) || defined(CRC32_ARMV8_CRC32)
-#define TARGET_CPU_WITH_CRC
+
 // clang-format off
 #if defined(CRC32_SIMD_SSE42_PCLMUL)
-  /* Required to make MSVC bot build pass. */
-  #include <smmintrin.h>
-  #if defined(__GNUC__) || defined(__clang__)
-    #undef TARGET_CPU_WITH_CRC
+  #include <smmintrin.h>  /* Required to make MSVC bot build pass. */
+
+  #if defined(__clang__) || defined(__GNUC__)
     #define TARGET_CPU_WITH_CRC __attribute__((target("sse4.2")))
+  #else
+    #define TARGET_CPU_WITH_CRC
   #endif
 
   #define _cpu_crc32_u32 _mm_crc32_u32
 
 #elif defined(CRC32_ARMV8_CRC32)
   #if defined(__clang__)
-    #undef TARGET_CPU_WITH_CRC
     #define __crc32cw __builtin_arm_crc32cw
   #endif
 
-  #define _cpu_crc32_u32 __crc32cw
-
   #if defined(__aarch64__)
     #define TARGET_CPU_WITH_CRC __attribute__((target("crc")))
   #else  // !defined(__aarch64__)
     #define TARGET_CPU_WITH_CRC __attribute__((target("armv8-a,crc")))
   #endif  // defined(__aarch64__)
+
+  #define _cpu_crc32_u32 __crc32cw
+
 #endif
 // clang-format on
+
+#if defined(TARGET_CPU_WITH_CRC)
+
 TARGET_CPU_WITH_CRC
-local INLINE Pos insert_string_optimized(deflate_state* const s,
-                                         const Pos str) {
+local INLINE Pos insert_string_simd(deflate_state* const s, const Pos str) {
   Pos ret;
   unsigned *ip, val, h = 0;
 
@@ -64,7 +66,8 @@ local INLINE Pos insert_string_optimized(deflate_state* const s,
   s->prev[str & s->w_mask] = ret;
   return ret;
 }
-#endif /* Optimized insert_string block */
+
+#endif // TARGET_CPU_WITH_CRC
 
 /* ===========================================================================
  * Update a hash value with the given input byte
@@ -99,24 +102,22 @@ local INLINE Pos insert_string_c(deflate_state* const s, const Pos str) {
 }
 
 local INLINE Pos insert_string(deflate_state* const s, const Pos str) {
-/* String dictionary insertion: faster symbol hashing has a positive impact
- * on data compression speeds (around 20% on Intel and 36% on Arm Cortex big
- * cores).
- * A misfeature is that the generated compressed output will differ from
- * vanilla zlib (even though it is still valid 'DEFLATE-d' content).
+/* insert_string_simd string dictionary insertion: this SIMD symbol hashing
+ * significantly improves data compression speed.
  *
- * We offer here a way to disable the optimization if there is the expectation
- * that compressed content should match when compared to vanilla zlib.
+ * Note: the generated compressed output is a valid DEFLATE stream but will
+ * differ from vanilla zlib output ...
  */
-#if !defined(CHROMIUM_ZLIB_NO_CASTAGNOLI)
-  /* TODO(cavalcantii): unify CPU features code. */
-#if defined(CRC32_ARMV8_CRC32)
-  if (arm_cpu_enable_crc32)
-    return insert_string_optimized(s, str);
-#elif defined(CRC32_SIMD_SSE42_PCLMUL)
+#if defined(CHROMIUM_ZLIB_NO_CASTAGNOLI)
+/* ... so this build-time option can used to disable the SIMD symbol hasher
+ * if matching vanilla zlib DEFLATE output is required.
+ */ (;) /* FALLTHOUGH */
+#elif defined(TARGET_CPU_WITH_CRC) && defined(CRC32_SIMD_SSE42_PCLMUL)
   if (x86_cpu_enable_simd)
-    return insert_string_optimized(s, str);
-#endif
+    return insert_string_simd(s, str);
+#elif defined(TARGET_CPU_WITH_CRC) && defined(CRC32_ARMV8_CRC32)
+  if (arm_cpu_enable_crc32)
+    return insert_string_simd(s, str);
 #endif
   return insert_string_c(s, str);
 }
diff --git a/deps/v8/third_party/zlib/cpu_features.c b/deps/v8/third_party/zlib/cpu_features.c
index ceed98822ac..0c10a0024f4 100644
--- a/deps/v8/third_party/zlib/cpu_features.c
+++ b/deps/v8/third_party/zlib/cpu_features.c
@@ -19,6 +19,7 @@
  */
 int ZLIB_INTERNAL arm_cpu_enable_crc32 = 0;
 int ZLIB_INTERNAL arm_cpu_enable_pmull = 0;
+int ZLIB_INTERNAL x86_cpu_enable_sse2 = 0;
 int ZLIB_INTERNAL x86_cpu_enable_ssse3 = 0;
 int ZLIB_INTERNAL x86_cpu_enable_simd = 0;
 
@@ -127,16 +128,20 @@ static void _cpu_check_features(void)
     int x86_cpu_has_sse42;
     int x86_cpu_has_pclmulqdq;
     int abcd[4];
+
 #ifdef _MSC_VER
     __cpuid(abcd, 1);
 #else
     __cpuid(1, abcd[0], abcd[1], abcd[2], abcd[3]);
 #endif
+
     x86_cpu_has_sse2 = abcd[3] & 0x4000000;
     x86_cpu_has_ssse3 = abcd[2] & 0x000200;
     x86_cpu_has_sse42 = abcd[2] & 0x100000;
     x86_cpu_has_pclmulqdq = abcd[2] & 0x2;
 
+    x86_cpu_enable_sse2 = x86_cpu_has_sse2;
+
     x86_cpu_enable_ssse3 = x86_cpu_has_ssse3;
 
     x86_cpu_enable_simd = x86_cpu_has_sse2 &&
@@ -145,4 +150,4 @@ static void _cpu_check_features(void)
 }
 #endif
 #endif
-#endif
\ No newline at end of file
+#endif
diff --git a/deps/v8/third_party/zlib/cpu_features.h b/deps/v8/third_party/zlib/cpu_features.h
index 2a4a797342e..c7b15c55976 100644
--- a/deps/v8/third_party/zlib/cpu_features.h
+++ b/deps/v8/third_party/zlib/cpu_features.h
@@ -11,6 +11,7 @@
  */
 extern int arm_cpu_enable_crc32;
 extern int arm_cpu_enable_pmull;
+extern int x86_cpu_enable_sse2;
 extern int x86_cpu_enable_ssse3;
 extern int x86_cpu_enable_simd;
 
diff --git a/deps/v8/third_party/zlib/crc32.c b/deps/v8/third_party/zlib/crc32.c
index bd6964701bd..d4c3248d984 100644
--- a/deps/v8/third_party/zlib/crc32.c
+++ b/deps/v8/third_party/zlib/crc32.c
@@ -497,7 +497,7 @@ uLong ZEXPORT crc32_combine64(crc1, crc2, len2)
 
 ZLIB_INTERNAL void crc_reset(deflate_state *const s)
 {
-#ifdef ADLER32_SIMD_SSSE3
+#ifdef CRC32_SIMD_SSE42_PCLMUL
     if (x86_cpu_enable_simd) {
         crc_fold_init(s);
         return;
@@ -508,7 +508,7 @@ ZLIB_INTERNAL void crc_reset(deflate_state *const s)
 
 ZLIB_INTERNAL void crc_finalize(deflate_state *const s)
 {
-#ifdef ADLER32_SIMD_SSSE3
+#ifdef CRC32_SIMD_SSE42_PCLMUL
     if (x86_cpu_enable_simd)
         s->strm->adler = crc_fold_512to32(s);
 #endif
@@ -516,7 +516,7 @@ ZLIB_INTERNAL void crc_finalize(deflate_state *const s)
 
 ZLIB_INTERNAL void copy_with_crc(z_streamp strm, Bytef *dst, long size)
 {
-#ifdef ADLER32_SIMD_SSSE3
+#ifdef CRC32_SIMD_SSE42_PCLMUL
     if (x86_cpu_enable_simd) {
         crc_fold_copy(strm->state, dst, strm->next_in, size);
         return;
diff --git a/deps/v8/third_party/zlib/crc_folding.c b/deps/v8/third_party/zlib/crc_folding.c
index 48d77744aaf..ee31d4918d6 100644
--- a/deps/v8/third_party/zlib/crc_folding.c
+++ b/deps/v8/third_party/zlib/crc_folding.c
@@ -18,6 +18,8 @@
 
 #include "deflate.h"
 
+#ifdef CRC32_SIMD_SSE42_PCLMUL
+
 #include <inttypes.h>
 #include <emmintrin.h>
 #include <immintrin.h>
@@ -283,7 +285,7 @@ ZLIB_INTERNAL void crc_fold_copy(deflate_state *const s,
         goto partial;
     }
 
-    algn_diff = 0 - (uintptr_t)src & 0xF;
+    algn_diff = (0 - (uintptr_t)src) & 0xF;
     if (algn_diff) {
         xmm_crc_part = _mm_loadu_si128((__m128i *)src);
         _mm_storeu_si128((__m128i *)dst, xmm_crc_part);
@@ -491,3 +493,5 @@ unsigned ZLIB_INTERNAL crc_fold_512to32(deflate_state *const s)
     return ~crc;
     CRC_SAVE(s)
 }
+
+#endif  /* CRC32_SIMD_SSE42_PCLMUL */
diff --git a/deps/v8/third_party/zlib/deflate.c b/deps/v8/third_party/zlib/deflate.c
index 744d8558e2e..1597196b085 100644
--- a/deps/v8/third_party/zlib/deflate.c
+++ b/deps/v8/third_party/zlib/deflate.c
@@ -1213,7 +1213,7 @@ ZLIB_INTERNAL unsigned deflate_read_buf(strm, buf, size)
 #ifdef GZIP
     if (strm->state->wrap == 2)
         copy_with_crc(strm, buf, len);
-    else 
+    else
 #endif
     {
         zmemcpy(buf, strm->next_in, len);
@@ -1521,7 +1521,7 @@ local void fill_window_c(deflate_state *s);
 
 local void fill_window(deflate_state *s)
 {
-#ifdef ADLER32_SIMD_SSSE3
+#ifdef DEFLATE_FILL_WINDOW_SSE2
     if (x86_cpu_enable_simd) {
         fill_window_sse(s);
         return;
diff --git a/deps/v8/third_party/zlib/fill_window_sse.c b/deps/v8/third_party/zlib/fill_window_sse.c
index ed1e5d1d673..a841c99904b 100644
--- a/deps/v8/third_party/zlib/fill_window_sse.c
+++ b/deps/v8/third_party/zlib/fill_window_sse.c
@@ -9,9 +9,10 @@
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
-#include <immintrin.h>
 #include "deflate.h"
 
+#ifdef DEFLATE_FILL_WINDOW_SSE2
+
 #define UPDATE_HASH(s,h,i) \
     {\
         if (s->level < 6) { \
@@ -28,6 +29,8 @@
 
 extern int deflate_read_buf OF((z_streamp strm, Bytef *buf, unsigned size));
 
+#include <immintrin.h>
+
 void fill_window_sse(deflate_state *s)
 {
     const __m128i xmm_wsize = _mm_set1_epi16(s->w_size);
@@ -175,3 +178,5 @@ void fill_window_sse(deflate_state *s)
     Assert((ulg)s->strstart <= s->window_size - MIN_LOOKAHEAD,
            "not enough room for search");
 }
+
+#endif  /* DEFLATE_FILL_WINDOW_SSE2 */
diff --git a/deps/v8/third_party/zlib/google/DEPS b/deps/v8/third_party/zlib/google/DEPS
index 144fbd14929..03f2cb950b9 100644
--- a/deps/v8/third_party/zlib/google/DEPS
+++ b/deps/v8/third_party/zlib/google/DEPS
@@ -2,4 +2,5 @@ include_rules = [
   '+base',
   '+build',
   '+testing',
+  "+third_party/zlib/zlib.h",
 ]
diff --git a/deps/v8/third_party/zlib/google/OWNERS b/deps/v8/third_party/zlib/google/OWNERS
index 1ca25314631..868af3cc662 100644
--- a/deps/v8/third_party/zlib/google/OWNERS
+++ b/deps/v8/third_party/zlib/google/OWNERS
@@ -3,3 +3,4 @@ satorux@chromium.org
 # compression_utils*
 asvitkine@chromium.org
 isherman@chromium.org
+cavalcantii@chromium.org
diff --git a/deps/v8/third_party/zlib/google/compression_utils_portable.cc b/deps/v8/third_party/zlib/google/compression_utils_portable.cc
index 191e349e31a..331e41e1257 100644
--- a/deps/v8/third_party/zlib/google/compression_utils_portable.cc
+++ b/deps/v8/third_party/zlib/google/compression_utils_portable.cc
@@ -5,7 +5,7 @@
  * found in the Chromium source repository LICENSE file.
  */
 
-#include "third_party/zlib/google/compression_utils_portable.h"
+#include "compression_utils_portable.h"
 
 #include <stddef.h>
 #include <stdlib.h>
@@ -84,7 +84,7 @@ int CompressHelper(WrapperType wrapper_type,
                    int compression_level,
                    void* (*malloc_fn)(size_t),
                    void (*free_fn)(void*)) {
-  if (compression_level < 1 || compression_level > 9) {
+  if (compression_level < 0 || compression_level > 9) {
     compression_level = Z_DEFAULT_COMPRESSION;
   }
 
diff --git a/deps/v8/third_party/zlib/google/compression_utils_portable.h b/deps/v8/third_party/zlib/google/compression_utils_portable.h
index cd004e86cf5..c467bf7cfe0 100644
--- a/deps/v8/third_party/zlib/google/compression_utils_portable.h
+++ b/deps/v8/third_party/zlib/google/compression_utils_portable.h
@@ -9,10 +9,13 @@
 
 #include <stdint.h>
 
+/* TODO(cavalcantii): remove support for Chromium ever building with a system
+ * zlib.
+ */
 #if defined(USE_SYSTEM_ZLIB)
 #include <zlib.h>
 #else
-#include "third_party/zlib/zlib.h"
+#include "zlib.h"
 #endif
 
 namespace zlib_internal {
diff --git a/deps/v8/third_party/zlib/google/zip_internal.cc b/deps/v8/third_party/zlib/google/zip_internal.cc
index 314740f5447..a67b6c94358 100644
--- a/deps/v8/third_party/zlib/google/zip_internal.cc
+++ b/deps/v8/third_party/zlib/google/zip_internal.cc
@@ -5,6 +5,7 @@
 #include "third_party/zlib/google/zip_internal.h"
 
 #include <stddef.h>
+#include <string.h>
 
 #include <algorithm>
 
diff --git a/deps/v8/third_party/zlib/patches/0005-infcover-gtest.patch b/deps/v8/third_party/zlib/patches/0005-infcover-gtest.patch
new file mode 100644
index 00000000000..d963a3aa07f
--- /dev/null
+++ b/deps/v8/third_party/zlib/patches/0005-infcover-gtest.patch
@@ -0,0 +1,405 @@
+From 409594639f15d825202971db7a275023e05772ff Mon Sep 17 00:00:00 2001
+From: Adenilson Cavalcanti <adenilson.cavalcanti@arm.com>
+Date: Tue, 28 Apr 2020 10:48:01 -0700
+Subject: [PATCH] Local Changes:   - make C tests build as C++ code so we can
+ use gtest.   - use gtest EXPECT_TRUE instead of C assert.   - replace C
+ streams for C++ (portability issues).
+
+---
+ test/infcover.c | 167 ++++++++++++++++++++++++++----------------------
+ 1 file changed, 90 insertions(+), 77 deletions(-)
+
+diff --git a/test/infcover.c b/test/infcover.c
+index 2be0164..a8c51c7 100644
+--- a/test/infcover.c
++++ b/test/infcover.c
+@@ -4,11 +4,12 @@
+  */
+ 
+ /* to use, do: ./configure --cover && make cover */
+-
++// clang-format off
++#include "infcover.h"
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+-#include <assert.h>
++
+ #include "zlib.h"
+ 
+ /* get definition of internal structure so we can mess with it (see pull()),
+@@ -17,8 +18,22 @@
+ #include "inftrees.h"
+ #include "inflate.h"
+ 
++/* XXX: use C++ streams instead of printf/fputs/etc due to portability
++ * as type sizes can vary between platforms.
++ */
++#include <iostream>
+ #define local static
+ 
++/* XXX: hacking C assert and plugging into GTest. */
++#include "testing/gtest/include/gtest/gtest.h"
++#if defined(assert)
++#undef assert
++#define assert EXPECT_TRUE
++#endif
++
++/* XXX: handle what is a reserved word in C++. */
++#define try try_f
++
+ /* -- memory tracking routines -- */
+ 
+ /*
+@@ -72,7 +87,7 @@ local void *mem_alloc(void *mem, unsigned count, unsigned size)
+ {
+     void *ptr;
+     struct mem_item *item;
+-    struct mem_zone *zone = mem;
++    struct mem_zone *zone = static_cast<struct mem_zone *>(mem);
+     size_t len = count * (size_t)size;
+ 
+     /* induced allocation failure */
+@@ -87,7 +102,7 @@ local void *mem_alloc(void *mem, unsigned count, unsigned size)
+     memset(ptr, 0xa5, len);
+ 
+     /* create a new item for the list */
+-    item = malloc(sizeof(struct mem_item));
++    item = static_cast<struct mem_item *>(malloc(sizeof(struct mem_item)));
+     if (item == NULL) {
+         free(ptr);
+         return NULL;
+@@ -112,7 +127,7 @@ local void *mem_alloc(void *mem, unsigned count, unsigned size)
+ local void mem_free(void *mem, void *ptr)
+ {
+     struct mem_item *item, *next;
+-    struct mem_zone *zone = mem;
++    struct mem_zone *zone = static_cast<struct mem_zone *>(mem);
+ 
+     /* if no zone, just do a free */
+     if (zone == NULL) {
+@@ -159,7 +174,7 @@ local void mem_setup(z_stream *strm)
+ {
+     struct mem_zone *zone;
+ 
+-    zone = malloc(sizeof(struct mem_zone));
++    zone = static_cast<struct mem_zone *>(malloc(sizeof(struct mem_zone)));
+     assert(zone != NULL);
+     zone->first = NULL;
+     zone->total = 0;
+@@ -175,33 +190,33 @@ local void mem_setup(z_stream *strm)
+ /* set a limit on the total memory allocation, or 0 to remove the limit */
+ local void mem_limit(z_stream *strm, size_t limit)
+ {
+-    struct mem_zone *zone = strm->opaque;
++    struct mem_zone *zone = static_cast<struct mem_zone *>(strm->opaque);
+ 
+     zone->limit = limit;
+ }
+ 
+ /* show the current total requested allocations in bytes */
+-local void mem_used(z_stream *strm, char *prefix)
++local void mem_used(z_stream *strm, const char *prefix)
+ {
+-    struct mem_zone *zone = strm->opaque;
++    struct mem_zone *zone = static_cast<struct mem_zone *>(strm->opaque);
+ 
+-    fprintf(stderr, "%s: %lu allocated\n", prefix, zone->total);
++    std::cout << prefix << ": " << zone->total << " allocated" << std::endl;
+ }
+ 
+ /* show the high water allocation in bytes */
+-local void mem_high(z_stream *strm, char *prefix)
++local void mem_high(z_stream *strm, const char *prefix)
+ {
+-    struct mem_zone *zone = strm->opaque;
++    struct mem_zone *zone = static_cast<struct mem_zone *>(strm->opaque);
+ 
+-    fprintf(stderr, "%s: %lu high water mark\n", prefix, zone->highwater);
++    std::cout << prefix << ": " << zone->highwater << " high water mark" << std::endl;
+ }
+ 
+ /* release the memory allocation zone -- if there are any surprises, notify */
+-local void mem_done(z_stream *strm, char *prefix)
++local void mem_done(z_stream *strm, const char *prefix)
+ {
+     int count = 0;
+     struct mem_item *item, *next;
+-    struct mem_zone *zone = strm->opaque;
++    struct mem_zone *zone = static_cast<struct mem_zone *>(strm->opaque);
+ 
+     /* show high water mark */
+     mem_high(strm, prefix);
+@@ -218,13 +233,20 @@ local void mem_done(z_stream *strm, char *prefix)
+ 
+     /* issue alerts about anything unexpected */
+     if (count || zone->total)
+-        fprintf(stderr, "** %s: %lu bytes in %d blocks not freed\n",
+-                prefix, zone->total, count);
++        std::cout << "** " << prefix << ": "
++                  << zone->total << " bytes in "
++                  << count << " blocks not freed"
++                  << std::endl;
++
+     if (zone->notlifo)
+-        fprintf(stderr, "** %s: %d frees not LIFO\n", prefix, zone->notlifo);
++        std::cout << "** " << prefix << ": "
++                  << zone->notlifo << " frees not LIFO"
++                  << std::endl;
++
+     if (zone->rogue)
+-        fprintf(stderr, "** %s: %d frees not recognized\n",
+-                prefix, zone->rogue);
++        std::cout << "** " << prefix << ": "
++                  << zone->rogue << " frees not recognized"
++                  << std::endl;
+ 
+     /* free the zone and delete from the stream */
+     free(zone);
+@@ -247,7 +269,7 @@ local unsigned char *h2b(const char *hex, unsigned *len)
+     unsigned char *in, *re;
+     unsigned next, val;
+ 
+-    in = malloc((strlen(hex) + 1) >> 1);
++    in = static_cast<unsigned char *>(malloc((strlen(hex) + 1) >> 1));
+     if (in == NULL)
+         return NULL;
+     next = 0;
+@@ -268,7 +290,7 @@ local unsigned char *h2b(const char *hex, unsigned *len)
+     } while (*hex++);       /* go through the loop with the terminating null */
+     if (len != NULL)
+         *len = next;
+-    re = realloc(in, next);
++    re = static_cast<unsigned char *>(realloc(in, next));
+     return re == NULL ? in : re;
+ }
+ 
+@@ -281,7 +303,7 @@ local unsigned char *h2b(const char *hex, unsigned *len)
+    header information is collected with inflateGetHeader().  If a zlib stream
+    is looking for a dictionary, then an empty dictionary is provided.
+    inflate() is run until all of the input data is consumed. */
+-local void inf(char *hex, char *what, unsigned step, int win, unsigned len,
++local void inf(const char *hex, const char *what, unsigned step, int win, unsigned len,
+                int err)
+ {
+     int ret;
+@@ -298,7 +320,7 @@ local void inf(char *hex, char *what, unsigned step, int win, unsigned len,
+         mem_done(&strm, what);
+         return;
+     }
+-    out = malloc(len);                          assert(out != NULL);
++    out = static_cast<unsigned char *>(malloc(len));                          assert(out != NULL);
+     if (win == 47) {
+         head.extra = out;
+         head.extra_max = len;
+@@ -347,7 +369,7 @@ local void inf(char *hex, char *what, unsigned step, int win, unsigned len,
+ }
+ 
+ /* cover all of the lines in inflate.c up to inflate() */
+-local void cover_support(void)
++void cover_support(void)
+ {
+     int ret;
+     z_stream strm;
+@@ -381,11 +403,11 @@ local void cover_support(void)
+     strm.next_in = Z_NULL;
+     ret = inflateInit(&strm);                   assert(ret == Z_OK);
+     ret = inflateEnd(&strm);                    assert(ret == Z_OK);
+-    fputs("inflate built-in memory routines\n", stderr);
++    std::cout << "inflate built-in memory routines" << std::endl;;
+ }
+ 
+ /* cover all inflate() header and trailer cases and code after inflate() */
+-local void cover_wrap(void)
++void cover_wrap(void)
+ {
+     int ret;
+     z_stream strm, copy;
+@@ -394,7 +416,7 @@ local void cover_wrap(void)
+     ret = inflate(Z_NULL, 0);                   assert(ret == Z_STREAM_ERROR);
+     ret = inflateEnd(Z_NULL);                   assert(ret == Z_STREAM_ERROR);
+     ret = inflateCopy(Z_NULL, Z_NULL);          assert(ret == Z_STREAM_ERROR);
+-    fputs("inflate bad parameters\n", stderr);
++    std::cout << "inflate bad parameters" << std::endl;
+ 
+     inf("1f 8b 0 0", "bad gzip method", 0, 31, 0, Z_DATA_ERROR);
+     inf("1f 8b 8 80", "bad gzip flags", 0, 31, 0, Z_DATA_ERROR);
+@@ -415,9 +437,9 @@ local void cover_wrap(void)
+     strm.next_in = Z_NULL;
+     ret = inflateInit2(&strm, -8);
+     strm.avail_in = 2;
+-    strm.next_in = (void *)"\x63";
++    strm.next_in = (Bytef *)"\x63";
+     strm.avail_out = 1;
+-    strm.next_out = (void *)&ret;
++    strm.next_out = (Bytef *)&ret;
+     mem_limit(&strm, 1);
+     ret = inflate(&strm, Z_NO_FLUSH);           assert(ret == Z_MEM_ERROR);
+     ret = inflate(&strm, Z_NO_FLUSH);           assert(ret == Z_MEM_ERROR);
+@@ -428,11 +450,11 @@ local void cover_wrap(void)
+     mem_limit(&strm, (sizeof(struct inflate_state) << 1) + 256);
+     ret = inflatePrime(&strm, 16, 0);           assert(ret == Z_OK);
+     strm.avail_in = 2;
+-    strm.next_in = (void *)"\x80";
++    strm.next_in = (Bytef *)"\x80";
+     ret = inflateSync(&strm);                   assert(ret == Z_DATA_ERROR);
+     ret = inflate(&strm, Z_NO_FLUSH);           assert(ret == Z_STREAM_ERROR);
+     strm.avail_in = 4;
+-    strm.next_in = (void *)"\0\0\xff\xff";
++    strm.next_in = (Bytef *)"\0\0\xff\xff";
+     ret = inflateSync(&strm);                   assert(ret == Z_OK);
+     (void)inflateSyncPoint(&strm);
+     ret = inflateCopy(&copy, &strm);            assert(ret == Z_MEM_ERROR);
+@@ -454,7 +476,7 @@ local unsigned pull(void *desc, unsigned char **buf)
+         next = 0;
+         return 0;   /* no input (already provided at next_in) */
+     }
+-    state = (void *)((z_stream *)desc)->state;
++    state = reinterpret_cast<struct inflate_state *>(((z_stream *)desc)->state);
+     if (state != Z_NULL)
+         state->mode = SYNC;     /* force an otherwise impossible situation */
+     return next < sizeof(dat) ? (*buf = dat + next++, 1) : 0;
+@@ -467,7 +489,7 @@ local int push(void *desc, unsigned char *buf, unsigned len)
+ }
+ 
+ /* cover inflateBack() up to common deflate data cases and after those */
+-local void cover_back(void)
++void cover_back(void)
+ {
+     int ret;
+     z_stream strm;
+@@ -479,17 +501,17 @@ local void cover_back(void)
+     ret = inflateBack(Z_NULL, Z_NULL, Z_NULL, Z_NULL, Z_NULL);
+                                                 assert(ret == Z_STREAM_ERROR);
+     ret = inflateBackEnd(Z_NULL);               assert(ret == Z_STREAM_ERROR);
+-    fputs("inflateBack bad parameters\n", stderr);
++    std::cout << "inflateBack bad parameters" << std::endl;;
+ 
+     mem_setup(&strm);
+     ret = inflateBackInit(&strm, 15, win);      assert(ret == Z_OK);
+     strm.avail_in = 2;
+-    strm.next_in = (void *)"\x03";
++    strm.next_in = (Bytef *)"\x03";
+     ret = inflateBack(&strm, pull, Z_NULL, push, Z_NULL);
+                                                 assert(ret == Z_STREAM_END);
+         /* force output error */
+     strm.avail_in = 3;
+-    strm.next_in = (void *)"\x63\x00";
++    strm.next_in = (Bytef *)"\x63\x00";
+     ret = inflateBack(&strm, pull, Z_NULL, push, &strm);
+                                                 assert(ret == Z_BUF_ERROR);
+         /* force mode error by mucking with state */
+@@ -500,11 +522,11 @@ local void cover_back(void)
+ 
+     ret = inflateBackInit(&strm, 15, win);      assert(ret == Z_OK);
+     ret = inflateBackEnd(&strm);                assert(ret == Z_OK);
+-    fputs("inflateBack built-in memory routines\n", stderr);
++    std::cout << "inflateBack built-in memory routines" << std::endl;;
+ }
+ 
+ /* do a raw inflate of data in hexadecimal with both inflate and inflateBack */
+-local int try(char *hex, char *id, int err)
++local int try(const char *hex, const char *id, int err)
+ {
+     int ret;
+     unsigned len, size;
+@@ -518,11 +540,11 @@ local int try(char *hex, char *id, int err)
+ 
+     /* allocate work areas */
+     size = len << 3;
+-    out = malloc(size);
++    out = static_cast<unsigned char *>(malloc(size));
+     assert(out != NULL);
+-    win = malloc(32768);
++    win = static_cast<unsigned char *>(malloc(32768));
+     assert(win != NULL);
+-    prefix = malloc(strlen(id) + 6);
++    prefix = static_cast<char *>(malloc(strlen(id) + 6));
+     assert(prefix != NULL);
+ 
+     /* first with inflate */
+@@ -578,7 +600,7 @@ local int try(char *hex, char *id, int err)
+ }
+ 
+ /* cover deflate data cases in both inflate() and inflateBack() */
+-local void cover_inflate(void)
++void cover_inflate(void)
+ {
+     try("0 0 0 0 0", "invalid stored block lengths", 1);
+     try("3 0", "fixed", 0);
+@@ -613,32 +635,33 @@ local void cover_inflate(void)
+     inf("63 18 5 40 c 0", "window wrap", 3, -8, 300, Z_OK);
+ }
+ 
++/* XXX(cavalcantii): fix linking error due inflate_table. */
+ /* cover remaining lines in inftrees.c */
+-local void cover_trees(void)
+-{
+-    int ret;
+-    unsigned bits;
+-    unsigned short lens[16], work[16];
+-    code *next, table[ENOUGH_DISTS];
+-
+-    /* we need to call inflate_table() directly in order to manifest not-
+-       enough errors, since zlib insures that enough is always enough */
+-    for (bits = 0; bits < 15; bits++)
+-        lens[bits] = (unsigned short)(bits + 1);
+-    lens[15] = 15;
+-    next = table;
+-    bits = 15;
+-    ret = inflate_table(DISTS, lens, 16, &next, &bits, work);
+-                                                assert(ret == 1);
+-    next = table;
+-    bits = 1;
+-    ret = inflate_table(DISTS, lens, 16, &next, &bits, work);
+-                                                assert(ret == 1);
+-    fputs("inflate_table not enough errors\n", stderr);
+-}
++/* void cover_trees(void) */
++/* { */
++/*     int ret; */
++/*     unsigned bits; */
++/*     unsigned short lens[16], work[16]; */
++/*     code *next, table[ENOUGH_DISTS]; */
++
++/*     /\* we need to call inflate_table() directly in order to manifest not- */
++/*        enough errors, since zlib insures that enough is always enough *\/ */
++/*     for (bits = 0; bits < 15; bits++) */
++/*         lens[bits] = (unsigned short)(bits + 1); */
++/*     lens[15] = 15; */
++/*     next = table; */
++/*     bits = 15; */
++/*     ret = inflate_table(DISTS, lens, 16, &next, &bits, work); */
++/*                                                 assert(ret == 1); */
++/*     next = table; */
++/*     bits = 1; */
++/*     ret = inflate_table(DISTS, lens, 16, &next, &bits, work); */
++/*                                                 assert(ret == 1); */
++/*     fputs("inflate_table not enough errors\n", stderr); */
++/* } */
+ 
+ /* cover remaining inffast.c decoding and window copying */
+-local void cover_fast(void)
++void cover_fast(void)
+ {
+     inf("e5 e0 81 ad 6d cb b2 2c c9 01 1e 59 63 ae 7d ee fb 4d fd b5 35 41 68"
+         " ff 7f 0f 0 0 0", "fast length extra bits", 0, -8, 258, Z_DATA_ERROR);
+@@ -658,14 +681,4 @@ local void cover_fast(void)
+         Z_STREAM_END);
+ }
+ 
+-int main(void)
+-{
+-    fprintf(stderr, "%s\n", zlibVersion());
+-    cover_support();
+-    cover_wrap();
+-    cover_back();
+-    cover_inflate();
+-    cover_trees();
+-    cover_fast();
+-    return 0;
+-}
++// clang-format on
+-- 
+2.21.1 (Apple Git-122.3)
+
diff --git a/deps/v8/tools/callstats.html b/deps/v8/tools/callstats.html
index 97a6638215c..2ad6cf2daf9 100644
--- a/deps/v8/tools/callstats.html
+++ b/deps/v8/tools/callstats.html
@@ -1107,7 +1107,15 @@
     }
 
     function handleLoadText(text, append, fileName) {
-      handleLoadJSON(JSON.parse(text), append, fileName);
+      try {
+        handleLoadJSON(JSON.parse(text), append, fileName);
+      } catch(e) {
+        if (!fileName.endsWith('.txt')) {
+          alert(`Error parsing "${fileName}"`);
+          console.error(e);
+        }
+        handleLoadTXT(text, append, fileName);
+      }
     }
 
     function getStateFromParams() {
@@ -1128,17 +1136,37 @@
       if (append && !isFirstLoad) {
         json = createUniqueVersions(json)
       }
-      var state = getStateFromParams();
       if (!append || isFirstLoad) {
         pages = new Pages();
         versions = Versions.fromJSON(json);
       } else {
         Versions.fromJSON(json).forEach(e => versions.add(e))
       }
+      displayResultsAfterLoading(isFirstLoad)
+    }
+
+    function handleLoadTXT(txt, append, fileName) {
+      let isFirstLoad = pages === undefined;
+      // Load raw RCS output which contains a single page
+      if (!append || isFirstLoad) {
+        pages = new Pages();
+        versions = new Versions()
+      }
+      versions.add(Version.fromTXT(fileName, txt))
+      displayResultsAfterLoading()
+
+    }
+
+    function displayResultsAfterLoading(isFirstLoad) {
+      let state = getStateFromParams();
       initialize()
       if (isFirstLoad && !popHistoryState(state)) {
         showEntry(selectedPage.total);
+        return;
       }
+      selectedPage = versions.versions[0].pages[0]
+      if (selectedPage == undefined) return;
+      showPage(selectedPage);
     }
 
     function fixClusterTelemetryResults(json) {
@@ -1358,14 +1386,15 @@
           if (page !== undefined) return page;
         }
       }
-    }
-    Versions.fromJSON = function(json) {
-      var versions = new Versions();
-      for (var version in json) {
-        versions.add(Version.fromJSON(version, json[version]));
+
+      static fromJSON(json) {
+        var versions = new Versions();
+        for (var version in json) {
+          versions.add(Version.fromJSON(version, json[version]));
+        }
+        versions.sort();
+        return versions;
       }
-      versions.sort();
-      return versions;
     }
 
     class Version {
@@ -1475,14 +1504,22 @@
       sort() {
         this.pages.sort(NameComparator)
       }
-    }
-    Version.fromJSON = function(name, data) {
-      var version = new Version(name);
-      for (var pageName in data) {
-        version.add(PageVersion.fromJSON(version, pageName, data[pageName]));
+
+      static fromJSON(name, data) {
+        var version = new Version(name);
+        for (var pageName in data) {
+          version.add(PageVersion.fromJSON(version, pageName, data[pageName]));
+        }
+        version.sort();
+        return version;
+      }
+
+      static fromTXT(name, txt) {
+        let version = new Version(name);
+        let pageName = "RAW DATA";
+        version.add(PageVersion.fromTXT(version, pageName, txt));
+        return version;
       }
-      version.sort();
-      return version;
     }
 
     class Pages extends Map {
@@ -1610,24 +1647,39 @@
       getNextPage() {
         return this.version.getNextPage(this);
       }
-    }
-    PageVersion.fromJSON = function(version, name, data) {
-      let page = new PageVersion(version, pages.get(name));
-      // Distinguish between the legacy format which just uses Arrays,
-      // or the new object style.
-      if (Array.isArray(data)) {
-        for (let i = 0; i < data.length; i++) {
-          page.add(Entry.fromLegacyJSON(i, data[data.length - i - 1]));
+
+      static fromJSON(version, name, data) {
+        let page = new PageVersion(version, pages.get(name));
+        // Distinguish between the legacy format which just uses Arrays,
+        // or the new object style.
+        if (Array.isArray(data)) {
+          for (let i = 0; i < data.length; i++) {
+            page.add(Entry.fromLegacyJSON(i, data[data.length - i - 1]));
+          }
+        } else {
+          let position = 0;
+          for (let metric_name in data) {
+            page.add(Entry.fromJSON(position, metric_name, data[metric_name]));
+            position++;
+          }
         }
-      } else {
-        let position = 0;
-        for (let metric_name in data) {
-          page.add(Entry.fromJSON(position, metric_name, data[metric_name]));
-          position++;
+        page.sort();
+        return page
+      }
+
+      static fromTXT(version, name, txt) {
+        let pageVersion = new PageVersion(version, pages.get(name));
+        let lines = txt.split('\n');
+        let split = / +/g
+        // Skip the first two lines (HEADER and SEPARATOR)
+        for (let i = 2; i < lines.length; i++) {
+          let line = lines[i].trim().split(split)
+          if (line.length != 5) continue;
+          let position = i-2;
+          pageVersion.add(Entry.fromTXT(position, line));
         }
+        return pageVersion;
       }
-      page.sort();
-      return page
     }
 
 
@@ -1716,15 +1768,27 @@
       get timeVariancePercent() {
         return this._timeVariancePercent
       }
-    }
-    Entry.fromLegacyJSON = function(position, data) {
-      return new Entry(position, ...data);
-    }
-    Entry.fromJSON = function(position, name, data) {
-      let time = data.duration;
-      let count = data.count;
-      return new Entry(position, name, time.average, time.stddev, 
-                       count.average, count.stddev);
+
+      static fromLegacyJSON(position, data) {
+        return new Entry(position, ...data);
+      }
+
+      static fromJSON(position, name, data) {
+        let time = data.duration;
+        let count = data.count;
+        return new Entry(position, name, time.average, time.stddev, 0,
+                        count.average, count.stddev, 0);
+      }
+
+      static fromTXT(position, splitLine) {
+        let [name, time, timePercent, count, countPercent] = splitLine;
+        time = time.split('ms')
+        let timeDeviation = 0, countDeviation = 0;
+        let timeDeviationPercent = 0, countDeviationPercent = 0
+        return new Entry(position, name,
+          Number.parseFloat(time), timeDeviation, timeDeviationPercent,
+          Number.parseInt(count), countDeviation, countDeviationPercent)
+      }
     }
 
     class Group {
@@ -1899,11 +1963,11 @@ <h2>Data</h2>
       <form name="fileForm">
         <p>
           <label for="uploadInput">Load File:</label>
-          <input id="uploadInput" type="file" name="files" onchange="handleLoadFile();" accept=".json">
+          <input id="uploadInput" type="file" name="files" onchange="handleLoadFile();" accept=".json,.txt">
         </p>
         <p>
           <label for="appendInput">Append File:</label>
-          <input id="appendInput" type="file" name="files" onchange="handleAppendFile();" accept=".json">
+          <input id="appendInput" type="file" name="files" onchange="handleAppendFile();" accept=".json,.txt">
         </p>
       </form>
     </div>
diff --git a/deps/v8/tools/clusterfuzz/testdata/failure_output.txt b/deps/v8/tools/clusterfuzz/testdata/failure_output.txt
index 73db1cb0c32..e1511535bf4 100644
--- a/deps/v8/tools/clusterfuzz/testdata/failure_output.txt
+++ b/deps/v8/tools/clusterfuzz/testdata/failure_output.txt
@@ -9,9 +9,9 @@
 # Compared x64,ignition with x64,ignition_turbo
 #
 # Flags of x64,ignition:
---correctness-fuzzer-suppressions --expose-gc --allow-natives-for-differential-fuzzing --invoke-weak-callbacks --omit-quit --es-staging --wasm-staging --no-wasm-async-compilation --suppress-asm-messages --random-seed 12345 --turbo-filter=~ --noopt --liftoff --no-wasm-tier-up --flag1 --flag2=0
+--correctness-fuzzer-suppressions --expose-gc --fuzzing --allow-natives-for-differential-fuzzing --invoke-weak-callbacks --omit-quit --es-staging --wasm-staging --no-wasm-async-compilation --suppress-asm-messages --random-seed 12345 --turbo-filter=~ --noopt --liftoff --no-wasm-tier-up --flag1 --flag2=0
 # Flags of x64,ignition_turbo:
---correctness-fuzzer-suppressions --expose-gc --allow-natives-for-differential-fuzzing --invoke-weak-callbacks --omit-quit --es-staging --wasm-staging --no-wasm-async-compilation --suppress-asm-messages --random-seed 12345 --flag3
+--correctness-fuzzer-suppressions --expose-gc --fuzzing --allow-natives-for-differential-fuzzing --invoke-weak-callbacks --omit-quit --es-staging --wasm-staging --no-wasm-async-compilation --suppress-asm-messages --random-seed 12345 --flag3
 #
 # Difference:
 - unknown
diff --git a/deps/v8/tools/clusterfuzz/testdata/sanity_check_output.txt b/deps/v8/tools/clusterfuzz/testdata/sanity_check_output.txt
index 3c105ef1b4f..953071228ec 100644
--- a/deps/v8/tools/clusterfuzz/testdata/sanity_check_output.txt
+++ b/deps/v8/tools/clusterfuzz/testdata/sanity_check_output.txt
@@ -9,9 +9,9 @@
 # Compared x64,ignition with x64,ignition_turbo
 #
 # Flags of x64,ignition:
---correctness-fuzzer-suppressions --expose-gc --allow-natives-for-differential-fuzzing --invoke-weak-callbacks --omit-quit --es-staging --wasm-staging --no-wasm-async-compilation --suppress-asm-messages --random-seed 12345 --turbo-filter=~ --noopt --liftoff --no-wasm-tier-up
+--correctness-fuzzer-suppressions --expose-gc --fuzzing --allow-natives-for-differential-fuzzing --invoke-weak-callbacks --omit-quit --es-staging --wasm-staging --no-wasm-async-compilation --suppress-asm-messages --random-seed 12345 --turbo-filter=~ --noopt --liftoff --no-wasm-tier-up
 # Flags of x64,ignition_turbo:
---correctness-fuzzer-suppressions --expose-gc --allow-natives-for-differential-fuzzing --invoke-weak-callbacks --omit-quit --es-staging --wasm-staging --no-wasm-async-compilation --suppress-asm-messages --random-seed 12345
+--correctness-fuzzer-suppressions --expose-gc --fuzzing --allow-natives-for-differential-fuzzing --invoke-weak-callbacks --omit-quit --es-staging --wasm-staging --no-wasm-async-compilation --suppress-asm-messages --random-seed 12345
 #
 # Difference:
 - unknown
diff --git a/deps/v8/tools/clusterfuzz/v8_commands.py b/deps/v8/tools/clusterfuzz/v8_commands.py
index e84cd915e34..1956ef2802b 100644
--- a/deps/v8/tools/clusterfuzz/v8_commands.py
+++ b/deps/v8/tools/clusterfuzz/v8_commands.py
@@ -18,6 +18,7 @@
 DEFAULT_FLAGS = [
   '--correctness-fuzzer-suppressions',
   '--expose-gc',
+  '--fuzzing',
   '--allow-natives-for-differential-fuzzing',
   '--invoke-weak-callbacks',
   '--omit-quit',
diff --git a/deps/v8/tools/clusterfuzz/v8_foozzie.py b/deps/v8/tools/clusterfuzz/v8_foozzie.py
index b6638cc3774..33eba0c88a8 100755
--- a/deps/v8/tools/clusterfuzz/v8_foozzie.py
+++ b/deps/v8/tools/clusterfuzz/v8_foozzie.py
@@ -143,6 +143,25 @@
 # Placeholder string if no original source file could be determined.
 ORIGINAL_SOURCE_DEFAULT = 'none'
 
+# Placeholder string for failures from crash tests. If a failure is found with
+# this signature, the matching sources should be moved to the mapping below.
+ORIGINAL_SOURCE_CRASHTESTS = 'placeholder for CrashTests'
+
+# Mapping from relative original source path (e.g. CrashTests/path/to/file.js)
+# to a string key. Map to the same key for duplicate issues. The key should
+# have more than 3 characters to not collide with other existing hashes.
+# If a symptom from a particular original source file is known to map to a
+# known failure, it can be added to this mapping. This should be done for all
+# failures from CrashTests, as those by default map to the placeholder above.
+KNOWN_FAILURES = {
+  # Foo.caller with asm.js: https://crbug.com/1042556
+  'CrashTests/5712410200899584/04483.js': '.caller',
+  'CrashTests/5703451898085376/02176.js': '.caller',
+  'CrashTests/4846282433495040/04342.js': '.caller',
+  # Flaky issue that almost never repros.
+  'CrashTests/5694376231632896/1033966.js': 'flaky',
+}
+
 
 def infer_arch(d8):
   """Infer the V8 architecture from the build configuration next to the
@@ -313,6 +332,31 @@ def print_difference(
     print(text.encode('utf-8', 'replace'))
 
 
+def cluster_failures(source, known_failures=None):
+  """Returns a string key for clustering duplicate failures.
+
+  Args:
+    source: The original source path where the failure happened.
+    known_failures: Mapping from original source path to failure key.
+  """
+  known_failures = known_failures or KNOWN_FAILURES
+  # No source known. Typical for manually uploaded issues. This
+  # requires also manual issue creation.
+  if not source:
+    return ORIGINAL_SOURCE_DEFAULT
+  # Source is known to produce a particular failure.
+  if source in known_failures:
+    return known_failures[source]
+  # Subsume all other sources from CrashTests under one key. Otherwise
+  # failures lead to new crash tests which in turn lead to new failures.
+  if source.startswith('CrashTests'):
+    return ORIGINAL_SOURCE_CRASHTESTS
+
+  # We map all remaining failures to a short hash of the original source.
+  long_key = hashlib.sha1(source.encode('utf-8')).hexdigest()
+  return long_key[:ORIGINAL_SOURCE_HASH_LENGTH]
+
+
 def main():
   options = parse_args()
 
@@ -368,12 +412,6 @@ def main():
 
   difference, source = suppress.diff(first_config_output, second_config_output)
 
-  if source:
-    long_key = hashlib.sha1(source.encode('utf-8')).hexdigest()
-    source_key = long_key[:ORIGINAL_SOURCE_HASH_LENGTH]
-  else:
-    source_key = ORIGINAL_SOURCE_DEFAULT
-
   if difference:
     # Only bail out due to suppressed output if there was a difference. If a
     # suppression doesn't show up anymore in the statistics, we might want to
@@ -383,6 +421,7 @@ def main():
     if fail_bailout(second_config_output, suppress.ignore_by_output2):
       return RETURN_FAIL
 
+    source_key = cluster_failures(source)
     print_difference(
         options, source_key, first_cmd, second_cmd,
         first_config_output, second_config_output, difference, source)
diff --git a/deps/v8/tools/clusterfuzz/v8_foozzie_test.py b/deps/v8/tools/clusterfuzz/v8_foozzie_test.py
index f82afc9e205..0304814b7aa 100755
--- a/deps/v8/tools/clusterfuzz/v8_foozzie_test.py
+++ b/deps/v8/tools/clusterfuzz/v8_foozzie_test.py
@@ -101,6 +101,23 @@ def testConfig(self):
 
 
 class UnitTest(unittest.TestCase):
+  def testCluster(self):
+    crash_test_example_path = 'CrashTests/path/to/file.js'
+    self.assertEqual(
+        v8_foozzie.ORIGINAL_SOURCE_DEFAULT,
+        v8_foozzie.cluster_failures(''))
+    self.assertEqual(
+        v8_foozzie.ORIGINAL_SOURCE_CRASHTESTS,
+        v8_foozzie.cluster_failures(crash_test_example_path))
+    self.assertEqual(
+        '_o_O_',
+        v8_foozzie.cluster_failures(
+            crash_test_example_path,
+            known_failures={crash_test_example_path: '_o_O_'}))
+    self.assertEqual(
+        '980',
+        v8_foozzie.cluster_failures('v8/test/mjsunit/apply.js'))
+
   def testDiff(self):
     def diff_fun(one, two, skip=False):
       suppress = v8_suppressions.get_suppression(
diff --git a/deps/v8/tools/clusterfuzz/v8_mock.js b/deps/v8/tools/clusterfuzz/v8_mock.js
index 618e14c784a..6372a7afe2b 100644
--- a/deps/v8/tools/clusterfuzz/v8_mock.js
+++ b/deps/v8/tools/clusterfuzz/v8_mock.js
@@ -14,13 +14,26 @@ var prettyPrinted = function prettyPrinted(msg) { return msg; };
 
 // Mock Math.random.
 (function() {
-  let index = 0
+  let index = 1;
   Math.random = function() {
-    index = (index + 1) % 10;
-    return index / 10.0;
+      const x = Math.sin(index++) * 10000;
+      return x - Math.floor(x);
+  }
+})();
+
+// Mock Math.pow. Work around an optimization for -0.5.
+(function() {
+  const origMathPow = Math.pow;
+  Math.pow = function(a, b) {
+    if (b === -0.5) {
+      return 0;
+    } else {
+      return origMathPow(a, b);
+    }
   }
 })();
 
+
 // Mock Date.
 (function() {
   let index = 0;
@@ -159,3 +172,14 @@ Object.defineProperty(
     }
   };
 })();
+
+// Mock Realm.
+Realm.eval = function(realm, code) { return eval(code) };
+
+// Mock the nondeterministic parts of WeakRef and FinalizationRegistry.
+WeakRef.prototype.deref = function() { };
+FinalizationRegistry = function(callback) { };
+FinalizationRegistry.prototype.register = function(target, holdings) { };
+FinalizationRegistry.prototype.unregister = function(unregisterToken) { };
+FinalizationRegistry.prototype.cleanupSome = function() { };
+FinalizationRegistry.prototype[Symbol.toStringTag] = "FinalizationRegistry";
diff --git a/deps/v8/tools/clusterfuzz/v8_sanity_checks.js b/deps/v8/tools/clusterfuzz/v8_sanity_checks.js
index f2cb8935a20..c2f0b2a4d9e 100644
--- a/deps/v8/tools/clusterfuzz/v8_sanity_checks.js
+++ b/deps/v8/tools/clusterfuzz/v8_sanity_checks.js
@@ -30,3 +30,16 @@ print("https://crbug.com/985154");
   }
   print(Object.getOwnPropertyNames(foo().bar));
 })();
+
+print("Suppresses sensitive natives");
+(function () {
+  function foo() {}
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+  print(%GetOptimizationStatus(foo));
+  const fun = new Function("f", "sync", "return %GetOptimizationStatus(f);");
+  print(fun(foo));
+})();
diff --git a/deps/v8/tools/csvparser.js b/deps/v8/tools/csvparser.js
index bd106a7a410..a4d030441a1 100644
--- a/deps/v8/tools/csvparser.js
+++ b/deps/v8/tools/csvparser.js
@@ -46,14 +46,14 @@ class CsvParser {
     while (nextPos !== -1) {
       let escapeIdentifier = string.charAt(nextPos + 1);
       pos = nextPos + 2;
-      if (escapeIdentifier == 'n') {
+      if (escapeIdentifier === 'n') {
         result += '\n';
         nextPos = pos;
-      } else if (escapeIdentifier == '\\') {
+      } else if (escapeIdentifier === '\\') {
         result += '\\';
         nextPos = pos;
       } else {
-        if (escapeIdentifier == 'x') {
+        if (escapeIdentifier === 'x') {
           // \x00 ascii range escapes consume 2 chars.
           nextPos = pos + 2;
         } else {
@@ -71,7 +71,7 @@ class CsvParser {
       // If there are no more escape sequences consume the rest of the string.
       if (nextPos === -1) {
         result += string.substr(pos);
-      } else if (pos != nextPos) {
+      } else if (pos !== nextPos) {
         result += string.substring(pos, nextPos);
       }
     }
diff --git a/deps/v8/tools/debug_helper/BUILD.gn b/deps/v8/tools/debug_helper/BUILD.gn
index b151e129186..a2d76d1fda7 100644
--- a/deps/v8/tools/debug_helper/BUILD.gn
+++ b/deps/v8/tools/debug_helper/BUILD.gn
@@ -12,6 +12,8 @@ config("internal_config") {
     defines = [ "BUILDING_V8_DEBUG_HELPER" ]
   }
 
+  configs = [ "../..:v8_tracing_config" ]
+
   include_dirs = [
     ".",
     "../..",
@@ -25,6 +27,9 @@ config("external_config") {
   if (is_component_build) {
     defines = [ "USING_V8_DEBUG_HELPER" ]
   }
+
+  configs = [ "../..:external_config" ]
+
   include_dirs = [ "." ]
 }
 
diff --git a/deps/v8/tools/debug_helper/get-object-properties.cc b/deps/v8/tools/debug_helper/get-object-properties.cc
index 9146dd4633e..0e8fbf02a68 100644
--- a/deps/v8/tools/debug_helper/get-object-properties.cc
+++ b/deps/v8/tools/debug_helper/get-object-properties.cc
@@ -7,7 +7,8 @@
 #include "debug-helper-internal.h"
 #include "heap-constants.h"
 #include "include/v8-internal.h"
-#include "src/common/ptr-compr-inl.h"
+#include "src/common/external-pointer.h"
+#include "src/execution/isolate-utils.h"
 #include "src/objects/string-inl.h"
 #include "src/strings/unicode-inl.h"
 #include "torque-generated/class-debug-readers-tq.h"
@@ -323,8 +324,15 @@ class ReadStringVisitor : public TqObjectVisitor {
     // require knowledge of the embedder. For now, we only read cached external
     // strings.
     if (IsExternalStringCached(object)) {
-      uintptr_t data_address = reinterpret_cast<uintptr_t>(
-          GetOrFinish(object->GetResourceDataValue(accessor_)));
+      ExternalPointer_t resource_data =
+          GetOrFinish(object->GetResourceDataValue(accessor_));
+#ifdef V8_COMPRESS_POINTERS
+      uintptr_t data_address = static_cast<uintptr_t>(DecodeExternalPointer(
+          Isolate::FromRoot(GetIsolateRoot(heap_addresses_.any_heap_pointer)),
+          resource_data));
+#else
+      uintptr_t data_address = reinterpret_cast<uintptr_t>(resource_data);
+#endif  // V8_COMPRESS_POINTERS
       if (done_) return;
       ReadStringCharacters<TChar>(object, data_address);
     } else {
diff --git a/deps/v8/tools/gcmole/gcmole.cc b/deps/v8/tools/gcmole/gcmole.cc
index 606c90bb582..a2454b244ab 100644
--- a/deps/v8/tools/gcmole/gcmole.cc
+++ b/deps/v8/tools/gcmole/gcmole.cc
@@ -387,6 +387,7 @@ static bool SuspectedToCauseGC(clang::MangleContext* ctx,
   }
 
   if (gc_functions.find(decl->getNameAsString()) != gc_functions.end()) {
+    TRACE_LLVM_DECL("Suspected by ", decl);
     return true;
   }
 
diff --git a/deps/v8/tools/gcmole/suspects.whitelist b/deps/v8/tools/gcmole/suspects.whitelist
index 01db7401f22..1ac855f2f76 100644
--- a/deps/v8/tools/gcmole/suspects.whitelist
+++ b/deps/v8/tools/gcmole/suspects.whitelist
@@ -2,3 +2,5 @@ IsConstructor
 IsEval
 IsAsync
 IsPromiseAll
+IsPromiseAny
+VisitRootPointers
diff --git a/deps/v8/tools/gen-postmortem-metadata.py b/deps/v8/tools/gen-postmortem-metadata.py
index 1fddfcf83d6..84b9ad49905 100644
--- a/deps/v8/tools/gen-postmortem-metadata.py
+++ b/deps/v8/tools/gen-postmortem-metadata.py
@@ -223,9 +223,6 @@
         'value': 'SimpleNumberDictionaryShape::kEntrySize' },
 
     { 'name': 'type_JSError__JS_ERROR_TYPE', 'value': 'JS_ERROR_TYPE' },
-
-    { 'name': 'class_SharedFunctionInfo__function_data__Object',
-        'value': 'SharedFunctionInfo::kFunctionDataOffset' },
 ];
 
 #
diff --git a/deps/v8/tools/heap-stats/details-selection-template.html b/deps/v8/tools/heap-stats/details-selection-template.html
index cd429bf1a5d..9f12bde4066 100644
--- a/deps/v8/tools/heap-stats/details-selection-template.html
+++ b/deps/v8/tools/heap-stats/details-selection-template.html
@@ -86,6 +86,17 @@
   width: 50px;
 }
 
+.categorySelectionButtons {
+  float: right;
+}
+.categoryLabels {
+  float: left;
+  min-wdith: 200px;
+}
+.categoryContent {
+  clear: both;
+}
+
 </style>
 <section id="dataSelectionSection">
   <h2>Data selection</h2>
diff --git a/deps/v8/tools/heap-stats/details-selection.js b/deps/v8/tools/heap-stats/details-selection.js
index f7e32733d97..7130e19f408 100644
--- a/deps/v8/tools/heap-stats/details-selection.js
+++ b/deps/v8/tools/heap-stats/details-selection.js
@@ -30,6 +30,8 @@ defineCustomElement('details-selection', (templateText) =>
         .addEventListener('click', e => this.filterCurrentSelection(e));
     this.$('#category-auto-filter-btn')
         .addEventListener('click', e => this.filterTop20Categories(e));
+    this._data = undefined;
+    this.selection = undefined;
   }
 
   connectedCallback() {
@@ -38,6 +40,14 @@ defineCustomElement('details-selection', (templateText) =>
     }
   }
 
+  dataChanged() {
+    this.selection = {categories: {}};
+    this.resetUI(true);
+    this.populateIsolateSelect();
+    this.handleIsolateChange();
+    this.$('#dataSelectionSection').style.display = 'block';
+  }
+
   set data(value) {
     this._data = value;
     this.dataChanged();
@@ -85,45 +95,60 @@ defineCustomElement('details-selection', (templateText) =>
     const div = document.createElement('div');
     div.id = name;
     div.classList.add('box');
-    const ul = document.createElement('ul');
+
+    let ul = document.createElement('ul');
+    ul.className = 'categoryLabels'
+    {
+      const name_li = document.createElement('li');
+      name_li.textContent = CATEGORY_NAMES.get(name);
+      ul.appendChild(name_li);
+
+      const percent_li = document.createElement('li');
+      percent_li.textContent = '0%';
+      percent_li.id = name + 'PercentContent';
+      ul.appendChild(percent_li);
+    }
+    div.appendChild(ul);
+
+    ul = document.createElement('ul');
+    ul.className = 'categorySelectionButtons'
+    {
+      const all_li = document.createElement('li');
+      const all_button = document.createElement('button');
+      all_button.textContent = 'All';
+      all_button.addEventListener('click', e => this.selectCategory(name));
+      all_li.appendChild(all_button);
+      ul.appendChild(all_li);
+
+      const top_li = document.createElement('li');
+      const top_button = document.createElement('button');
+      top_button.textContent = 'Top 10';
+      top_button.addEventListener(
+          'click', e => this.selectCategoryTopEntries(name));
+      top_li.appendChild(top_button);
+      ul.appendChild(top_li);
+
+      const none_li = document.createElement('li');
+      const none_button = document.createElement('button');
+      none_button.textContent = 'None';
+      none_button.addEventListener('click', e => this.unselectCategory(name));
+      none_li.appendChild(none_button);
+      ul.appendChild(none_li);
+    }
     div.appendChild(ul);
-    const name_li = document.createElement('li');
-    ul.appendChild(name_li);
-    name_li.innerHTML = CATEGORY_NAMES.get(name);
-    const percent_li = document.createElement('li');
-    ul.appendChild(percent_li);
-    percent_li.innerHTML = '0%';
-    percent_li.id = name + 'PercentContent';
-    const all_li = document.createElement('li');
-    ul.appendChild(all_li);
-    const all_button = document.createElement('button');
-    all_li.appendChild(all_button);
-    all_button.innerHTML = 'All';
-    all_button.addEventListener('click', e => this.selectCategory(name));
-    const none_li = document.createElement('li');
-    ul.appendChild(none_li);
-    const none_button = document.createElement('button');
-    none_li.appendChild(none_button);
-    none_button.innerHTML = 'None';
-    none_button.addEventListener('click', e => this.unselectCategory(name));
+
     const innerDiv = document.createElement('div');
-    div.appendChild(innerDiv);
     innerDiv.id = name + 'Content';
+    innerDiv.className = 'categoryContent';
+    div.appendChild(innerDiv);
+
     const percentDiv = document.createElement('div');
-    div.appendChild(percentDiv);
     percentDiv.className = 'percentBackground';
     percentDiv.id = name + 'PercentBackground';
+    div.appendChild(percentDiv);
     return div;
   }
 
-  dataChanged() {
-    this.selection = {categories: {}};
-    this.resetUI(true);
-    this.populateIsolateSelect();
-    this.handleIsolateChange();
-    this.$('#dataSelectionSection').style.display = 'block';
-  }
-
   populateIsolateSelect() {
     let isolates = Object.entries(this.data);
     // Sorty by peak heap memory consumption.
@@ -259,7 +284,7 @@ defineCustomElement('details-selection', (templateText) =>
     });
     Object.entries(overalls).forEach(([category, category_overall]) => {
       let percents = category_overall / overall * 100;
-      this.$(`#${category}PercentContent`).innerHTML =
+      this.$(`#${category}PercentContent`).textContent =
           `${percents.toFixed(1)}%`;
       this.$('#' + category + 'PercentBackground').style.left = percents + '%';
     });
@@ -324,7 +349,7 @@ defineCustomElement('details-selection', (templateText) =>
 
   populateCategories() {
     this.clearCategories();
-    const categories = {};
+    const categories = {__proto__:null};
     for (let cat of CATEGORIES.keys()) {
       categories[cat] = [];
     }
@@ -354,6 +379,23 @@ defineCustomElement('details-selection', (templateText) =>
     this.notifySelectionChanged();
   }
 
+  selectCategoryTopEntries(category) {
+    // unselect all checkboxes in this category.
+    this.querySelectorAll('input[name=' + category + 'Checkbox]')
+        .forEach(checkbox => checkbox.checked = false);
+    const data = this.selectedData.instance_type_data;
+
+    // Get the max values for instance_types in this category
+    const categoryInstanceTypes = Array.from(CATEGORIES.get(category));
+    categoryInstanceTypes.filter(each => each in data)
+      .sort((a,b) => {
+        return data[b].overall - data[a].overall;
+      }).slice(0, 10).forEach((category) => {
+        this.$('#' + category + 'Checkbox').checked = true;
+      });
+    this.notifySelectionChanged();
+  }
+
   createCheckBox(instance_type, category) {
     const div = document.createElement('div');
     div.classList.add('instanceTypeSelectBox');
diff --git a/deps/v8/tools/heap-stats/global-timeline.js b/deps/v8/tools/heap-stats/global-timeline.js
index 2f16b1bdfbd..05c69f558e6 100644
--- a/deps/v8/tools/heap-stats/global-timeline.js
+++ b/deps/v8/tools/heap-stats/global-timeline.js
@@ -209,6 +209,10 @@ defineCustomElement('global-timeline', (templateText) =>
   }
 
   drawChart() {
+    setTimeout(() => this._drawChart(), 10);
+  }
+
+  _drawChart() {
     console.assert(this.data, 'invalid data');
     console.assert(this.selection, 'invalid selection');
 
diff --git a/deps/v8/tools/logreader.js b/deps/v8/tools/logreader.js
index ebdc55a618b..ff0a71a393d 100644
--- a/deps/v8/tools/logreader.js
+++ b/deps/v8/tools/logreader.js
@@ -190,7 +190,6 @@ LogReader.prototype.dispatchLogRow_ = function(fields) {
   var command = fields[0];
   var dispatch = this.dispatchTable_[command];
   if (dispatch === undefined) return;
-
   if (dispatch === null || this.skipDispatch(dispatch)) {
     return;
   }
@@ -241,7 +240,7 @@ LogReader.prototype.processLogLine_ = function(line) {
       var fields = this.csvParser_.parseLine(line);
       this.dispatchLogRow_(fields);
     } catch (e) {
-      this.printError('line ' + (this.lineNum_ + 1) + ': ' + (e.message || e));
+      this.printError('line ' + (this.lineNum_ + 1) + ': ' + (e.message || e) + '\n' + e.stack);
     }
   }
   this.lineNum_++;
diff --git a/deps/v8/tools/map-processor.html b/deps/v8/tools/map-processor.html
index a453c9a189f..77e0e7b19c7 100644
--- a/deps/v8/tools/map-processor.html
+++ b/deps/v8/tools/map-processor.html
@@ -16,6 +16,29 @@
   padding-left: 15px;
 }
 
+kbd {
+  background-color: #eee;
+  border-radius: 3px;
+  border: 1px solid black;
+  display: inline-block;
+  font-size: .9em;
+  font-weight: bold;
+  padding: 0px 4px 2px 4px;
+  white-space: nowrap;
+}
+dl {
+  display: grid;
+  grid-template-columns: min-content auto;
+  grid-gap: 10px;
+}
+dt {
+  text-align: right;
+  white-space: nowrap;
+}
+dd {
+  margin: 0;
+}
+
 #content {
   opacity: 0.0;
   height: 0px;
@@ -102,25 +125,35 @@
   border: 1px black solid;
 }
 
+#stats {
+  display: flex;
+  height: 250px;
+}
+
 #stats table {
-  display: inline-block;
+  flex: 1;
   padding-right: 50px;
+  max-height: 250px;
+  display: inline-block;
 }
 #stats table td {
   cursor: pointer;
 }
 #stats .transitionTable {
-  max-height: 200px;
   overflow-y: scroll;
 }
+#stats .transitionTable tr {
+  max-width: 200px;
 
+}
 #stats .transitionType {
   text-align: right;
+  max-width: 380px;
 }
 #stats .transitionType tr td:nth-child(2) {
   text-align: left;
 }
-#stats .transitionType tr:nth-child(1) td {
+#stats table thead td {
   border-bottom: 1px black dotted;
 }
 
@@ -452,19 +485,6 @@
   return document.createElement("tr");
 }
 
-function define(prototype, name, fn) {
-  Object.defineProperty(prototype, name, {value:fn, enumerable:false});
-}
-
-define(Array.prototype, "max", function(fn) {
-  if (this.length == 0) return undefined;
-  if (fn == undefined) fn = (each) => each;
-  let max = fn(this[0]);
-  for (let i = 1; i < this.length; i++) {
-    max = Math.max(max, fn(this[i]));
-  }
-  return max;
-})
 define(Array.prototype, "histogram", function(mapFn) {
   let histogram = [];
   for (let i = 0; i < this.length; i++) {
@@ -483,9 +503,6 @@
   return histogram;
 });
 
-define(Array.prototype, "first", function() { return this[0] });
-define(Array.prototype, "last", function() { return this[this.length - 1] });
-
 // =========================================================================
 // EventHandlers
 function handleBodyLoad() {
@@ -698,6 +715,7 @@
       timeNode.style.left = ((time-start) * timeToPixel) + "px";
       chunksNode.appendChild(timeNode);
     };
+    let backgroundTodo = [];
     for (let i = 0; i < chunks.length; i++) {
       let chunk = chunks[i];
       let height = (chunk.size() / max * kChunkHeight);
@@ -711,10 +729,13 @@
       node.addEventListener("mousemove", e => this.handleChunkMouseMove(e));
       node.addEventListener("click", e => this.handleChunkClick(e));
       node.addEventListener("dblclick", e => this.handleChunkDoubleClick(e));
-      this.setTimelineChunkBackground(chunk, node);
+      backgroundTodo.push([chunk, node])
       chunksNode.appendChild(node);
       chunk.markers.forEach(marker => addTimestamp(marker.time, marker.name));
     }
+
+    this.asyncSetTimelineChunkBackground(backgroundTodo)
+
     // Put a time marker roughly every 20 chunks.
     let expected  = duration / chunks.length * 20;
     let interval = (10 ** Math.floor(Math.log10(expected)));
@@ -753,6 +774,22 @@
     this.transitionView.showMaps(chunk.getUniqueTransitions());
   }
 
+  asyncSetTimelineChunkBackground(backgroundTodo) {
+    const kIncrement = 100;
+    let start = 0;
+    let delay = 1;
+    while (start < backgroundTodo.length) {
+      let end = Math.min(start+kIncrement, backgroundTodo.length);
+      setTimeout((from, to) => {
+        for (let i = from; i < to; i++) {
+          let [chunk, node] = backgroundTodo[i];
+          this.setTimelineChunkBackground(chunk, node);
+        }
+      }, delay++, start, end);
+      start = end;
+    }
+  }
+
   setTimelineChunkBackground(chunk, node) {
     // Render the types of transitions as bar charts
     const kHeight = chunk.height;
@@ -779,7 +816,7 @@
       });
     }
 
-    let imageData = this.backgroundCanvas.toDataURL("image/png");
+    let imageData = this.backgroundCanvas.toDataURL("image/webp", 0.2);
     node.style.backgroundImage = "url(" + imageData + ")";
   }
 
@@ -818,7 +855,7 @@
     ctx.stroke();
     ctx.closePath();
     ctx.fill();
-    let imageData = canvas.toDataURL("image/png");
+    let imageData = canvas.toDataURL("image/webp", 0.2);
     $("timelineOverview").style.backgroundImage = "url(" + imageData + ")";
   }
 
@@ -1101,7 +1138,7 @@
   }
   updateGeneralStats() {
     let pairs = [
-      ["Maps", null, e => true],
+      ["Total", null, e => true],
       ["Transitions", 'black', e => e.edge && e.edge.isTransition()],
       ["Fast to Slow", 'violet', e => e.edge && e.edge.isFastToSlow()],
       ["Slow to Fast", 'orange', e => e.edge && e.edge.isSlowToFast()],
@@ -1115,6 +1152,7 @@
 
     let text = "";
     let tableNode = table("transitionType");
+    tableNode.innerHTML = "<thead><tr><td>Color</td><td>Type</td><td>Count</td><td>Percent</td></tr></thead>";
     let name, filter;
     let total = this.timeline.size();
     pairs.forEach(([name, color, filter]) => {
@@ -1122,11 +1160,16 @@
       if (color !== null) {
         row.appendChild(td(div(['colorbox', color])));
       } else {
-       row.appendChild(td(""));
+        row.appendChild(td(""));
+      }
+      row.onclick = (e) => {
+        // lazily compute the stats
+        let node = e.target.parentNode;
+        if (node.maps == undefined) {
+          node.maps = this.timeline.filterUniqueTransitions(filter);
+        }
+        this.transitionView.showMaps(node.maps);
       }
-      row.maps = this.timeline.filterUniqueTransitions(filter);
-      row.onclick =
-          (e) => this.transitionView.showMaps(e.target.parentNode.maps);
       row.appendChild(td(name));
       let count = this.timeline.count(filter);
       row.appendChild(td(count));
@@ -1139,6 +1182,7 @@
   updateNamedTransitionsStats() {
     let tableNode = table("transitionTable");
     let nameMapPairs = Array.from(this.timeline.transitions.entries());
+    tableNode.innerHTML = "<thead><tr><td>Propery Name</td><td>#</td></tr></thead>";
     nameMapPairs
       .sort((a,b) => b[1].length - a[1].length)
       .forEach(([name, maps]) => {
@@ -1213,9 +1257,35 @@ <h2>Selected Map</h2>
     <section id="mapDetails"></section>
   </div>
 
-  <h2>Instructions</h2>
   <section>
+    <h2>Instructions</h2>
     <p>Visualize Map trees that have been gathered using <code>--trace-maps</code>.</p>
+    <h3>Keyboard Shortcuts</h3>
+    <dl>
+      <dt><kbd>SHIFT</kbd> + <kbd>Arrow Up</kbd></dt>
+      <dd>Follow Map transition forward (first child)</dd>
+
+      <dt><kbd>SHIFT</kbd> + <kbd>Arrow Down</kbd></dt>
+      <dd>Follow Map transition backwards</dd>
+
+      <dt><kbd>Arrow Up</kbd></dt>
+      <dd>Go to previous Map chunk</dd>
+
+      <dt><kbd>Arrow Down</kbd></dt>
+      <dd>Go to next Map in chunk</dd>
+
+      <dt><kbd>Arrow Left</kbd></dt>
+      <dd>Go to previous chunk</dd>
+
+      <dt><kbd>Arrow Right</kbd></dt>
+      <dd>Go to next chunk</dd>
+
+      <dt><kbd>+</kbd></dt>
+      <dd>Timeline zoom in</dd>
+
+      <dt><kbd>-</kbd></dt>
+      <dd>Timeline zoom out</dd>
+    </dl>
   </section>
 
   <div id="tooltip">
diff --git a/deps/v8/tools/map-processor.js b/deps/v8/tools/map-processor.js
index 7e8572af8c3..d743cba383a 100644
--- a/deps/v8/tools/map-processor.js
+++ b/deps/v8/tools/map-processor.js
@@ -3,10 +3,28 @@
 // found in the LICENSE file.
 
 // ===========================================================================
+function define(prototype, name, fn) {
+  Object.defineProperty(prototype, name, {value:fn, enumerable:false});
+}
+
+define(Array.prototype, "max", function(fn) {
+  if (this.length === 0) return undefined;
+  if (fn === undefined) fn = (each) => each;
+  let max = fn(this[0]);
+  for (let i = 1; i < this.length; i++) {
+    max = Math.max(max, fn(this[i]));
+  }
+  return max;
+})
+define(Array.prototype, "first", function() { return this[0] });
+define(Array.prototype, "last", function() { return this[this.length - 1] });
+// ===========================================================================
+
 class MapProcessor extends LogReader {
   constructor() {
     super();
     this.dispatchTable_ = {
+      __proto__:null,
       'code-creation': {
         parsers: [parseString, parseInt, parseInt, parseInt, parseInt,
           parseString, parseVarArgs],
@@ -41,6 +59,7 @@ class MapProcessor extends LogReader {
     };
     this.profile_ = new Profile();
     this.timeline_ = new Timeline();
+    this.formatPCRegexp_ = /(.*):[0-9]+:[0-9]+$/;
   }
 
   printError(str) {
@@ -73,9 +92,15 @@ class MapProcessor extends LogReader {
   processLogFile(fileName) {
     this.collectEntries = true
     this.lastLogFileName_ = fileName;
+    let i = 1;
     let line;
-    while (line = readline()) {
-      this.processLogLine(line);
+    try {
+      while (line = readline()) {
+        this.processLogLine(line);
+        i++;
+      }
+    } catch(e) {
+      console.error("Error occurred during parsing line " + i + ", trying to continue: " + e);
     }
     return this.finalize();
   }
@@ -131,13 +156,12 @@ class MapProcessor extends LogReader {
   formatPC(pc, line, column) {
     let entry = this.profile_.findEntry(pc);
     if (!entry) return "<unknown>"
-    if (entry.type == "Builtin") {
+    if (entry.type === "Builtin") {
       return entry.name;
     }
     let name = entry.func.getName();
-    let re = /(.*):[0-9]+:[0-9]+$/;
-    let array = re.exec(name);
-    if (!array) {
+    let array = this.formatPCRegexp_.exec(name);
+    if (array === null) {
       entry = name;
     } else {
       entry = entry.getState() + array[1];
@@ -146,12 +170,12 @@ class MapProcessor extends LogReader {
   }
 
   processMap(type, time, from, to, pc, line, column, reason, name) {
-    time = parseInt(time);
-    if (type == "Deprecate") return this.deprecateMap(type, time, from);
-    from = this.getExistingMap(from, time);
-    to = this.getExistingMap(to, time);
-    let edge = new Edge(type, name, reason, time, from, to);
-    to.filePosition = this.formatPC(pc, line, column);
+    let time_ = parseInt(time);
+    if (type === "Deprecate") return this.deprecateMap(type, time_, from);
+    let from_ = this.getExistingMap(from, time_);
+    let to_ = this.getExistingMap(to, time_);
+    let edge = new Edge(type, name, reason, time, from_, to_);
+    to_.filePosition = this.formatPC(pc, line, column);
     edge.finishSetup();
   }
 
@@ -170,7 +194,7 @@ class MapProcessor extends LogReader {
     //TODO(cbruni): fix initial map logging.
     let map = this.getExistingMap(id, time);
     if (!map.description) {
-      map.description = string;
+      //map.description = string;
     }
   }
 
@@ -212,19 +236,30 @@ class V8Map {
     this.filePosition = "";
   }
 
+  finalizeRootMap(id) {
+    let stack = [this];
+    while (stack.length > 0) {
+      let current = stack.pop();
+      if (current.leftId !== 0) {
+        console.error("Skipping potential parent loop between maps:", current)
+        continue;
+      }
+      current.finalize(id)
+      id += 1;
+      current.children.forEach(edge => stack.push(edge.to))
+      // TODO implement rightId
+    }
+    return id;
+  }
+
   finalize(id) {
     // Initialize preorder tree traversal Ids for fast subtree inclusion checks
     if (id <= 0) throw "invalid id";
     let currentId = id;
     this.leftId = currentId
-    this.children.forEach(edge => {
-      let map = edge.to;
-      currentId = map.finalize(currentId + 1);
-    });
-    this.rightId = currentId + 1;
-    return currentId + 1;
   }
 
+
   parent() {
     if (this.edge === void 0) return void 0;
     return this.edge.from;
@@ -239,7 +274,7 @@ class V8Map {
   }
 
   isRoot() {
-    return this.edge == void 0 || this.edge.from == void 0;
+    return this.edge === void 0 || this.edge.from === void 0;
   }
 
   contains(map) {
@@ -300,16 +335,16 @@ class V8Map {
   }
 
   static get(id) {
-    if (!this.cache) return undefined;
     return this.cache.get(id);
   }
 
   static set(id, map) {
-    if (!this.cache) this.cache = new Map();
     this.cache.set(id, map);
   }
 }
 
+V8Map.cache = new Map();
+
 
 // ===========================================================================
 class Edge {
@@ -323,21 +358,21 @@ class Edge {
   }
 
   finishSetup() {
-    if (this.from) this.from.addEdge(this);
-    if (this.to) {
-      this.to.edge = this;
-      if (this.to === this.from) throw "From and to must be distinct.";
-      if (this.from) {
-        if (this.to.time < this.from.time) {
-          console.error("invalid time order");
-        }
-        let newDepth = this.from.depth + 1;
-        if (this.to.depth > 0 && this.to.depth != newDepth) {
-          console.error("Depth has already been initialized");
-        }
-        this.to.depth = newDepth;
-      }
+    let from = this.from
+    if (from) from.addEdge(this);
+    let to = this.to;
+    if (to === undefined) return;
+    to.edge = this;
+    if (from === undefined ) return;
+    if (to === from) throw "From and to must be distinct.";
+    if (to.time < from.time) {
+      console.error("invalid time order");
     }
+    let newDepth = from.depth + 1;
+    if (to.depth > 0 && to.depth != newDepth) {
+      console.error("Depth has already been initialized");
+    }
+    to.depth = newDepth;
   }
 
   chunkIndex(chunks) {
@@ -471,16 +506,16 @@ class Timeline {
   finalize() {
     let id = 0;
     this.forEach(map => {
-      if (map.isRoot()) id = map.finalize(id + 1);
-      if (map.edge && map.edge.name) {
-        let edge = map.edge;
-        let list = this.transitions.get(edge.name);
-        if (list === undefined) {
-          this.transitions.set(edge.name, [edge]);
-        } else {
-          list.push(edge);
+        if (map.isRoot()) id = map.finalizeRootMap(id + 1);
+        if (map.edge && map.edge.name) {
+          let edge = map.edge;
+          let list = this.transitions.get(edge.name);
+          if (list === undefined) {
+            this.transitions.set(edge.name, [edge]);
+          } else {
+            list.push(edge);
+          }
         }
-      }
     });
     this.markers.sort((a, b) => b.time - a.time);
   }
@@ -490,7 +525,7 @@ class Timeline {
   }
 
   isEmpty() {
-    return this.size() == 0
+    return this.size() === 0
   }
 
   size() {
@@ -573,7 +608,7 @@ class Timeline {
 
   count(filter) {
     return this.values.reduce((sum, each) => {
-      return sum + (filter(each) ? 1 : 0);
+      return sum + (filter(each) === true ? 1 : 0);
     }, 0);
   }
 
@@ -584,10 +619,10 @@ class Timeline {
   filterUniqueTransitions(filter) {
     // Returns a list of Maps whose parent is not in the list.
     return this.values.filter(map => {
-      if (!filter(map)) return false;
+      if (filter(map) === false) return false;
       let parent = map.parent();
-      if (!parent) return true;
-      return !filter(parent);
+      if (parent === undefined) return true;
+      return filter(parent) === false;
     });
   }
 
@@ -617,7 +652,7 @@ class Chunk {
   }
 
   isEmpty() {
-    return this.items.length == 0;
+    return this.items.length === 0;
   }
 
   last() {
@@ -662,7 +697,7 @@ class Chunk {
   findChunk(chunks, delta) {
     let i = this.index + delta;
     let chunk = chunks[i];
-    while (chunk && chunk.size() == 0) {
+    while (chunk && chunk.size() === 0) {
       i += delta;
       chunk = chunks[i]
     }
diff --git a/deps/v8/tools/testrunner/local/variants.py b/deps/v8/tools/testrunner/local/variants.py
index 7464978eb29..39c3467b1b9 100644
--- a/deps/v8/tools/testrunner/local/variants.py
+++ b/deps/v8/tools/testrunner/local/variants.py
@@ -14,6 +14,7 @@
   "interpreted_regexp": [["--regexp-interpret-all"]],
   "jitless": [["--jitless"]],
   "minor_mc": [["--minor-mc"]],
+  "nci": [["--turbo-nci"]],
   "no_lfa": [["--no-lazy-feedback-allocation"]],
   # No optimization means disable all optimizations. OptimizeFunctionOnNextCall
   # would not force optimization too. It turns into a Nop. Please see
@@ -28,6 +29,7 @@
   "stress_js_bg_compile_wasm_code_gc": [["--stress-background-compile",
                                          "--stress-wasm-code-gc"]],
   "stress_incremental_marking": [["--stress-incremental-marking"]],
+  "stress_snapshot": [["--stress-snapshot"]],
   # Trigger stress sampling allocation profiler with sample interval = 2^14
   "stress_sampling": [["--stress-sampling-allocation-profiler=16384"]],
   "trusted": [["--no-untrusted-code-mitigations"]],
@@ -40,6 +42,7 @@
 
 SLOW_VARIANTS = set([
   'stress',
+  'stress_snapshot',
   'nooptimization',
 ])
 
diff --git a/deps/v8/tools/testrunner/standard_runner.py b/deps/v8/tools/testrunner/standard_runner.py
index 1b7acc41b7a..10545fa5f24 100755
--- a/deps/v8/tools/testrunner/standard_runner.py
+++ b/deps/v8/tools/testrunner/standard_runner.py
@@ -259,6 +259,8 @@ def _parse_variants(self, aliases_str):
     for v in user_variants:
       if v not in ALL_VARIANTS:
         print('Unknown variant: %s' % v)
+        print('    Available variants: %s' % ALL_VARIANTS)
+        print('    Available variant aliases: %s' % VARIANT_ALIASES.keys());
         raise base_runner.TestRunnerError()
     assert False, 'Unreachable'
 
diff --git a/deps/v8/tools/testrunner/testproc/progress.py b/deps/v8/tools/testrunner/testproc/progress.py
index e9aff177057..a993fc18a37 100644
--- a/deps/v8/tools/testrunner/testproc/progress.py
+++ b/deps/v8/tools/testrunner/testproc/progress.py
@@ -12,6 +12,7 @@
 import subprocess
 import sys
 import time
+import util
 
 from . import base
 from ..local import junit_output
@@ -369,7 +370,14 @@ def __init__(self, framework_name, arch, mode):
     self.arch = arch
     self.mode = mode
     self.results = []
-    self.tests = []
+    self.duration_sum = 0
+    self.test_count = 0
+
+  def configure(self, options):
+    super(JsonTestProgressIndicator, self).configure(options)
+    self.tests = util.FixedSizeTopList(
+        self.options.slow_tests_cutoff,
+        key=lambda rec: rec['duration'])
 
   def _on_result_for(self, test, result):
     if result.is_rerun:
@@ -381,9 +389,8 @@ def process_results(self, test, results):
     for run, result in enumerate(results):
       # TODO(majeski): Support for dummy/grouped results
       output = result.output
-      # Buffer all tests for sorting the durations in the end.
-      # TODO(machenbach): Running average + buffer only slowest 20 tests.
-      self.tests.append((test, output.duration, result.cmd))
+
+      self._buffer_slow_tests(test, result, output, run)
 
       # Omit tests that run as expected on the first try.
       # Everything that happens after the first run is included in the output
@@ -391,15 +398,36 @@ def process_results(self, test, results):
       if not result.has_unexpected_output and run == 0:
         continue
 
-      self.results.append({
+      record = self._test_record(test, result, output, run)
+      record.update({
+          "result": test.output_proc.get_outcome(output),
+          "stdout": output.stdout,
+          "stderr": output.stderr,
+        })
+      self.results.append(record)
+
+  def _buffer_slow_tests(self, test, result, output, run):
+    def result_value(test, result, output):
+      if not result.has_unexpected_output:
+        return ""
+      return test.output_proc.get_outcome(output)
+
+    record = self._test_record(test, result, output, run)
+    record.update({
+        "result": result_value(test, result, output),
+        "marked_slow": test.is_slow,
+      })
+    self.tests.add(record)
+    self.duration_sum += record['duration']
+    self.test_count += 1
+
+  def _test_record(self, test, result, output, run):
+    return {
         "name": str(test),
         "flags": result.cmd.args,
         "command": result.cmd.to_string(relative=True),
         "run": run + 1,
-        "stdout": output.stdout,
-        "stderr": output.stderr,
         "exit_code": output.exit_code,
-        "result": test.output_proc.get_outcome(output),
         "expected": test.expected_outcomes,
         "duration": output.duration,
         "random_seed": test.random_seed,
@@ -407,7 +435,7 @@ def process_results(self, test, results):
         "variant": test.variant,
         "variant_flags": test.variant_flags,
         "framework_name": self.framework_name,
-      })
+      }
 
   def finished(self):
     complete_results = []
@@ -417,36 +445,17 @@ def finished(self):
         complete_results = json.loads(f.read() or "[]")
 
     duration_mean = None
-    if self.tests:
-      # Get duration mean.
-      duration_mean = (
-          sum(duration for (_, duration, cmd) in self.tests) /
-          float(len(self.tests)))
-
-    # Sort tests by duration.
-    self.tests.sort(key=lambda __duration_cmd: __duration_cmd[1], reverse=True)
-    cutoff = self.options.slow_tests_cutoff
-    slowest_tests = self._test_records(self.tests[:cutoff])
+    if self.test_count:
+      duration_mean = self.duration_sum / self.test_count
 
     complete_results.append({
       "arch": self.arch,
       "mode": self.mode,
       "results": self.results,
-      "slowest_tests": slowest_tests,
+      "slowest_tests": self.tests.as_list(),
       "duration_mean": duration_mean,
-      "test_total": len(self.tests),
+      "test_total": self.test_count,
     })
 
     with open(self.options.json_test_results, "w") as f:
       f.write(json.dumps(complete_results))
-
-  def _test_records(self, tests):
-    return [
-      {
-        "name": str(test),
-        "flags": cmd.args,
-        "command": cmd.to_string(relative=True),
-        "duration": duration,
-        "marked_slow": test.is_slow,
-      } for (test, duration, cmd) in tests
-    ]
diff --git a/deps/v8/tools/testrunner/testproc/util.py b/deps/v8/tools/testrunner/testproc/util.py
new file mode 100644
index 00000000000..8c1024cc81d
--- /dev/null
+++ b/deps/v8/tools/testrunner/testproc/util.py
@@ -0,0 +1,39 @@
+#!/usr/bin/env python
+# Copyright 2020 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import heapq
+import random
+
+
+class FixedSizeTopList():
+  """Utility collection for gathering a fixed number of elements with the
+  biggest value for the given key. It employs a heap from which we pop the
+  smallest element when the collection is 'full'.
+
+  If you need a reversed behaviour (collect min values) just provide an
+  inverse key."""
+
+  def __init__(self, size, key=None):
+    self.size = size
+    self.key = key or (lambda x: x)
+    self.data = []
+    self.discriminator = 0
+
+  def add(self, elem):
+    elem_k = self.key(elem)
+    heapq.heappush(self.data, (elem_k, self.extra_key(), elem))
+    if len(self.data) > self.size:
+      heapq.heappop(self.data)
+
+  def extra_key(self):
+    # Avoid key clash in tuples sent to the heap.
+    # We want to avoid comparisons on the last element of the tuple
+    # since those elements might not be comparable.
+    self.discriminator += 1
+    return self.discriminator
+
+  def as_list(self):
+    original_data = [rec for (_, _, rec) in self.data]
+    return sorted(original_data, key=self.key, reverse=True)
diff --git a/deps/v8/tools/testrunner/testproc/util_unittest.py b/deps/v8/tools/testrunner/testproc/util_unittest.py
new file mode 100644
index 00000000000..243bf9789a7
--- /dev/null
+++ b/deps/v8/tools/testrunner/testproc/util_unittest.py
@@ -0,0 +1,61 @@
+#!/usr/bin/env python
+# Copyright 2020 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+from util import FixedSizeTopList
+import unittest
+
+class TestOrderedFixedSizeList(unittest.TestCase):
+  def test_empty(self):
+    ofsl = FixedSizeTopList(3)
+    self.assertEqual(ofsl.as_list(), [])
+
+  def test_12(self):
+    ofsl = FixedSizeTopList(3)
+    ofsl.add(1)
+    ofsl.add(2)
+    self.assertEqual(ofsl.as_list(), [2,1])
+
+  def test_4321(self):
+    ofsl = FixedSizeTopList(3)
+    ofsl.add(4)
+    ofsl.add(3)
+    ofsl.add(2)
+    ofsl.add(1)
+    data = ofsl.as_list()
+    self.assertEqual(data, [4,3,2])
+
+  def test_544321(self):
+    ofsl = FixedSizeTopList(4)
+    ofsl.add(5)
+    ofsl.add(4)
+    ofsl.add(4)
+    ofsl.add(3)
+    ofsl.add(2)
+    ofsl.add(1)
+    data = ofsl.as_list()
+    self.assertEqual(data, [5, 4, 4, 3])
+
+  def test_withkey(self):
+    ofsl = FixedSizeTopList(3,key=lambda x: x['val'])
+    ofsl.add({'val':4, 'something': 'four'})
+    ofsl.add({'val':3, 'something': 'three'})
+    ofsl.add({'val':-1, 'something': 'minusone'})
+    ofsl.add({'val':5, 'something': 'five'})
+    ofsl.add({'val':0, 'something': 'zero'})
+    data = [e['something'] for e in ofsl.as_list()]
+    self.assertEqual(data, ['five', 'four', 'three'])
+
+  def test_withkeyclash(self):
+    # Test that a key clash does not throw exeption
+    ofsl = FixedSizeTopList(2,key=lambda x: x['val'])
+    ofsl.add({'val':2, 'something': 'two'})
+    ofsl.add({'val':2, 'something': 'two'})
+    ofsl.add({'val':0, 'something': 'zero'})
+    data = [e['something'] for e in ofsl.as_list()]
+    self.assertEqual(data, ['two', 'two'])
+
+
+if __name__ == '__main__':
+  unittest.main()
diff --git a/deps/v8/tools/torque/format-torque.py b/deps/v8/tools/torque/format-torque.py
index fd51fa2eaf7..96eb3a19095 100755
--- a/deps/v8/tools/torque/format-torque.py
+++ b/deps/v8/tools/torque/format-torque.py
@@ -35,12 +35,18 @@ def preprocess(input):
   input = re.sub(r'@if\(', r'@iF(', input)
   input = re.sub(r'@export', r'@eXpOrT', input)
   input = re.sub(r'js-implicit[ \n]+', r'jS_iMpLiCiT_', input)
+  input = re.sub(r'^(\s*namespace\s+[a-zA-Z_0-9]+\s*{)(\s*)$', r'\1}\2', input, flags = re.MULTILINE);
 
   # Special handing of '%' for intrinsics, turn the percent
   # into a unicode character so that it gets treated as part of the
   # intrinsic's name if it's already adjacent to it.
   input = re.sub(r'%([A-Za-z])', kPercentEscape + r'\1', input)
 
+  # includes are not recognized, change them into comments so that the
+  # formatter ignores them first, until we can figure out a way to format cpp
+  # includes within a JS file.
+  input = re.sub(r'^#include', r'// InClUdE', input, flags=re.MULTILINE)
+
   return input
 
 def postprocess(output):
@@ -68,9 +74,13 @@ def postprocess(output):
       r"@export", output)
   output = re.sub(r'jS_iMpLiCiT_',
       r"js-implicit ", output)
+  output = re.sub(r'}\n *label ', r'} label ', output);
+  output = re.sub(r'^(\s*namespace\s+[a-zA-Z_0-9]+\s*{)}(\s*)$', r'\1\2', output, flags = re.MULTILINE);
 
   output = re.sub(kPercentEscape, r'%', output)
 
+  output = re.sub( r'^// InClUdE',r'#include', output, flags=re.MULTILINE)
+
   return output
 
 def process(filename, lint, should_format):
diff --git a/deps/v8/tools/turbolizer/README.md b/deps/v8/tools/turbolizer/README.md
index c5ee729d64d..fa804f65e94 100644
--- a/deps/v8/tools/turbolizer/README.md
+++ b/deps/v8/tools/turbolizer/README.md
@@ -74,7 +74,6 @@ well as '--cpu' to specify which CPU to sample.
 Turbolizer build process
 ------------------------
 
-Turbolizer is currently migrating to TypeScript. The typescript sources reside in
-tools/turbolizer/src, and the typescript compiler will put the JavaScript output
-into tools/turbolizer/build/. The index.html file is set up to load the JavaScript
-from that directory.
+The typescript sources reside in tools/turbolizer/src, and the typescript
+compiler will put the JavaScript output into tools/turbolizer/build/. The
+index.html file is set up to load the JavaScript from that directory.
diff --git a/deps/v8/tools/turbolizer/down-arrow.png b/deps/v8/tools/turbolizer/down-arrow.png
new file mode 100644
index 00000000000..39339f289a3
Binary files /dev/null and b/deps/v8/tools/turbolizer/down-arrow.png differ
diff --git a/deps/v8/tools/turbolizer/index.html b/deps/v8/tools/turbolizer/index.html
index 268e51e0200..ea1b0b74d27 100644
--- a/deps/v8/tools/turbolizer/index.html
+++ b/deps/v8/tools/turbolizer/index.html
@@ -8,6 +8,7 @@
   <meta charset="utf-8">
   <title>V8 Turbolizer</title>
   <link rel="stylesheet" href="turbo-visualizer.css">
+  <link rel="stylesheet" href="turbo-visualizer-ranges.css">
   <link rel="stylesheet" href="tabs.css">
   <link rel="icon" type="image/png" href="turbolizer.png">
 </head>
@@ -21,6 +22,12 @@
       <input id="upload-helper" type="file">
       <input id="upload" type="image" title="load graph" class="button-input" src="upload-icon.png" alt="upload graph">
     </div>
+    <div id="resizer-ranges" class="resizer" style="visibility:hidden;"></div>
+    <div id="ranges" class="content" style="visibility:hidden;"></div>
+    <div id="show-hide-ranges" class="show-hide-pane" style="visibility: hidden">
+      <input id="ranges-expand" type="image" title="show ranges" src="up-arrow.png" class="button-input invisible">
+      <input id="ranges-shrink" type="image" title="hide ranges" src="down-arrow.png" class="button-input">
+    </div>
   </div>
   <div id="resizer-right" class="resizer"></div>
   <div id="right" class="content"></div>
diff --git a/deps/v8/tools/turbolizer/src/constants.ts b/deps/v8/tools/turbolizer/src/constants.ts
index ada39ae6b3b..47dee8547ff 100644
--- a/deps/v8/tools/turbolizer/src/constants.ts
+++ b/deps/v8/tools/turbolizer/src/constants.ts
@@ -14,6 +14,9 @@ export const GENERATED_PANE_ID = 'right';
 export const DISASSEMBLY_PANE_ID = 'disassembly';
 export const DISASSEMBLY_COLLAPSE_ID = 'disassembly-shrink';
 export const DISASSEMBLY_EXPAND_ID = 'disassembly-expand';
+export const RANGES_PANE_ID = "ranges";
+export const RANGES_COLLAPSE_ID = "ranges-shrink";
+export const RANGES_EXPAND_ID = "ranges-expand";
 export const UNICODE_BLOCK = '&#9611;';
 export const PROF_COLS = [
   { perc: 0, col: { r: 255, g: 255, b: 255 } },
diff --git a/deps/v8/tools/turbolizer/src/graphmultiview.ts b/deps/v8/tools/turbolizer/src/graphmultiview.ts
index 380f7df77db..4f8f6339199 100644
--- a/deps/v8/tools/turbolizer/src/graphmultiview.ts
+++ b/deps/v8/tools/turbolizer/src/graphmultiview.ts
@@ -38,6 +38,11 @@ export class GraphMultiView extends View {
     return pane;
   }
 
+  hide() {
+    this.hideCurrentPhase();
+    super.hide();
+  }
+
   constructor(id, selectionBroker, sourceResolver) {
     super(id);
     const view = this;
@@ -86,7 +91,9 @@ export class GraphMultiView extends View {
   }
 
   show() {
-    super.show();
+    // Insert before is used so that the display is inserted before the
+    // resizer for the RangeView.
+    this.container.insertBefore(this.divNode, this.container.firstChild);
     this.initializeSelect();
     const lastPhaseIndex = +window.sessionStorage.getItem("lastSelectedPhase");
     const initialPhaseIndex = this.sourceResolver.repairPhaseId(lastPhaseIndex);
diff --git a/deps/v8/tools/turbolizer/src/range-view.ts b/deps/v8/tools/turbolizer/src/range-view.ts
new file mode 100644
index 00000000000..032c46b733f
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/range-view.ts
@@ -0,0 +1,927 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import { createElement } from "../src/util";
+import { SequenceView } from "../src/sequence-view";
+import { RegisterAllocation, Range, ChildRange, Interval } from "../src/source-resolver";
+
+class Constants {
+  // Determines how many rows each div group holds for the purposes of
+  // hiding by syncHidden.
+  static readonly ROW_GROUP_SIZE = 20;
+  static readonly POSITIONS_PER_INSTRUCTION = 4;
+  static readonly FIXED_REGISTER_LABEL_WIDTH = 6;
+
+  static readonly INTERVAL_TEXT_FOR_NONE = "none";
+  static readonly INTERVAL_TEXT_FOR_CONST = "const";
+  static readonly INTERVAL_TEXT_FOR_STACK = "stack:";
+}
+
+// This class holds references to the HTMLElements that represent each cell.
+class Grid {
+  elements: Array<Array<HTMLElement>>;
+
+  constructor() {
+    this.elements = [];
+  }
+
+  setRow(row: number, elementsRow: Array<HTMLElement>) {
+    this.elements[row] = elementsRow;
+  }
+
+  getCell(row: number, column: number) {
+    return this.elements[row][column];
+  }
+
+  getInterval(row: number, column: number) {
+    // The cell is within an inner wrapper div which is within the interval div.
+    return this.getCell(row, column).parentElement.parentElement;
+  }
+}
+
+// This class is used as a wrapper to hide the switch between the
+// two different Grid objects used, one for each phase,
+// before and after register allocation.
+class GridAccessor {
+  sequenceView: SequenceView;
+  grids: Map<number, Grid>;
+
+  constructor(sequenceView: SequenceView) {
+    this.sequenceView = sequenceView;
+    this.grids = new Map<number, Grid>();
+  }
+
+  private currentGrid() {
+    return this.grids.get(this.sequenceView.currentPhaseIndex);
+  }
+
+  getAnyGrid() {
+    return this.grids.values().next().value;
+  }
+
+  hasGrid() {
+    return this.grids.has(this.sequenceView.currentPhaseIndex);
+  }
+
+  addGrid(grid: Grid) {
+    if (this.hasGrid()) console.warn("Overwriting existing Grid.");
+    this.grids.set(this.sequenceView.currentPhaseIndex, grid);
+  }
+
+  getCell(row: number, column: number) {
+    return this.currentGrid().getCell(row, column);
+  }
+
+  getInterval(row: number, column: number) {
+    return this.currentGrid().getInterval(row, column);
+  }
+}
+
+// This class is used as a wrapper to access the interval HTMLElements
+class IntervalElementsAccessor {
+  sequenceView: SequenceView;
+  map: Map<number, Array<HTMLElement>>;
+
+  constructor(sequenceView: SequenceView) {
+    this.sequenceView = sequenceView;
+    this.map = new Map<number, Array<HTMLElement>>();
+  }
+
+  private currentIntervals() {
+    const intervals = this.map.get(this.sequenceView.currentPhaseIndex);
+    if (intervals == undefined) {
+      this.map.set(this.sequenceView.currentPhaseIndex, new Array<HTMLElement>());
+      return this.currentIntervals();
+    }
+    return intervals;
+  }
+
+  addInterval(interval: HTMLElement) {
+    this.currentIntervals().push(interval);
+  }
+
+  forEachInterval(callback: (phase: number, interval: HTMLElement) => void) {
+    for (const phase of this.map.keys()) {
+      for (const interval of this.map.get(phase)) {
+        callback(phase, interval);
+      }
+    }
+  }
+}
+
+// A simple class used to hold two Range objects. This is used to allow the two fixed register live
+// ranges of normal and deferred to be easily combined into a single row.
+class RangePair {
+  ranges: [Range, Range];
+
+  constructor(ranges: [Range, Range]) {
+    this.ranges = ranges;
+  }
+
+  forEachRange(callback: (range: Range) => void) {
+    this.ranges.forEach((range: Range) => { if (range) callback(range); });
+  }
+}
+
+// A number of css variables regarding dimensions of HTMLElements are required by RangeView.
+class CSSVariables {
+  positionWidth: number;
+  blockBorderWidth: number;
+
+  constructor() {
+    const getNumberValue = varName => {
+      return parseFloat(getComputedStyle(document.body)
+             .getPropertyValue(varName).match(/[+-]?\d+(\.\d+)?/g)[0]);
+    };
+    this.positionWidth = getNumberValue("--range-position-width");
+    this.blockBorderWidth = getNumberValue("--range-block-border");
+  }
+}
+
+// Store the required data from the blocks JSON.
+class BlocksData {
+  blockBorders: Set<number>;
+  blockInstructionCountMap: Map<number, number>;
+
+  constructor(blocks: Array<any>) {
+    this.blockBorders = new Set<number>();
+    this.blockInstructionCountMap = new Map<number, number>();
+    for (const block of blocks) {
+      this.blockInstructionCountMap.set(block.id, block.instructions.length);
+      const maxInstructionInBlock = block.instructions[block.instructions.length - 1].id;
+      this.blockBorders.add(maxInstructionInBlock);
+    }
+  }
+
+  isInstructionBorder(position: number) {
+    return ((position + 1) % Constants.POSITIONS_PER_INSTRUCTION) == 0;
+  }
+
+  isBlockBorder(position: number) {
+    return this.isInstructionBorder(position)
+        && this.blockBorders.has(Math.floor(position / Constants.POSITIONS_PER_INSTRUCTION));
+  }
+}
+
+class Divs {
+  // Already existing.
+  container: HTMLElement;
+  resizerBar: HTMLElement;
+  snapper: HTMLElement;
+
+  // Created by constructor.
+  content: HTMLElement;
+  // showOnLoad contains all content that may change depending on the JSON.
+  showOnLoad: HTMLElement;
+  xAxisLabel: HTMLElement;
+  yAxisLabel: HTMLElement;
+  registerHeaders: HTMLElement;
+  registers: HTMLElement;
+
+  // Assigned from RangeView.
+  wholeHeader: HTMLElement;
+  positionHeaders: HTMLElement;
+  yAxis: HTMLElement;
+  grid: HTMLElement;
+
+  constructor() {
+    this.container = document.getElementById("ranges");
+    this.resizerBar = document.getElementById("resizer-ranges");
+    this.snapper = document.getElementById("show-hide-ranges");
+
+    this.content = document.createElement("div");
+    this.content.appendChild(this.elementForTitle());
+
+    this.showOnLoad = document.createElement("div");
+    this.showOnLoad.style.visibility = "hidden";
+    this.content.appendChild(this.showOnLoad);
+
+    this.xAxisLabel = createElement("div", "range-header-label-x");
+    this.xAxisLabel.innerText = "Blocks, Instructions, and Positions";
+    this.showOnLoad.appendChild(this.xAxisLabel);
+    this.yAxisLabel = createElement("div", "range-header-label-y");
+    this.yAxisLabel.innerText = "Registers";
+    this.showOnLoad.appendChild(this.yAxisLabel);
+
+    this.registerHeaders = createElement("div", "range-register-labels");
+    this.registers = createElement("div", "range-registers");
+    this.registerHeaders.appendChild(this.registers);
+  }
+
+  elementForTitle() {
+    const titleEl = createElement("div", "range-title-div");
+    const titleBar = createElement("div", "range-title");
+    titleBar.appendChild(createElement("div", "", "Live Ranges"));
+    const titleHelp = createElement("div", "range-title-help", "?");
+    titleHelp.title = "Each row represents a single TopLevelLiveRange (or two if deferred exists)."
+      + "\nEach interval belongs to a LiveRange contained within that row's TopLevelLiveRange."
+      + "\nAn interval is identified by i, the index of the LiveRange within the TopLevelLiveRange,"
+      + "\nand j, the index of the interval within the LiveRange, to give i:j.";
+    titleEl.appendChild(titleBar);
+    titleEl.appendChild(titleHelp);
+    return titleEl;
+  }
+}
+
+class Helper {
+  static virtualRegisterName(registerIndex: string) {
+    return "v" + registerIndex;
+  }
+
+  static fixedRegisterName(range: Range) {
+    return range.child_ranges[0].op.text;
+  }
+
+  static getPositionElementsFromInterval(interval: HTMLElement) {
+    return interval.children[1].children;
+  }
+
+  static forEachFixedRange(source: RegisterAllocation, row: number,
+                           callback: (registerIndex: string, row: number, registerName: string,
+                                      ranges: RangePair) => void) {
+
+    const forEachRangeInMap = (rangeMap: Map<string, Range>) => {
+      // There are two fixed live ranges for each register, one for normal, another for deferred.
+      // These are combined into a single row.
+      const fixedRegisterMap = new Map<string, {ranges: [Range, Range], registerIndex: number}>();
+      for (const [registerIndex, range] of rangeMap) {
+        const registerName = this.fixedRegisterName(range);
+        if (fixedRegisterMap.has(registerName)) {
+          const entry = fixedRegisterMap.get(registerName);
+          entry.ranges[1] = range;
+          // Only use the deferred register index if no normal index exists.
+          if (!range.is_deferred) {
+            entry.registerIndex = parseInt(registerIndex, 10);
+          }
+        } else {
+          fixedRegisterMap.set(registerName, {ranges: [range, undefined],
+                                              registerIndex: parseInt(registerIndex, 10)});
+        }
+      }
+      // Sort the registers by number.
+      const sortedMap = new Map([...fixedRegisterMap.entries()].sort(([nameA, _], [nameB, __]) => {
+        // Larger numbers create longer strings.
+        if (nameA.length > nameB.length) return 1;
+        if (nameA.length < nameB.length) return -1;
+        // Sort lexicographically if same length.
+        if (nameA > nameB) return 1;
+        if (nameA < nameB) return -1;
+        return 0;
+      }));
+      for (const [registerName, {ranges, registerIndex}] of sortedMap) {
+        callback("" + (-registerIndex - 1), row, registerName, new RangePair(ranges));
+        ++row;
+      }
+    };
+
+    forEachRangeInMap(source.fixedLiveRanges);
+    forEachRangeInMap(source.fixedDoubleLiveRanges);
+
+    return row;
+  }
+}
+
+class RowConstructor {
+  view: RangeView;
+
+  constructor(view: RangeView) {
+    this.view = view;
+  }
+
+  // Constructs the row of HTMLElements for grid while providing a callback for each position
+  // depending on whether that position is the start of an interval or not.
+  // RangePair is used to allow the two fixed register live ranges of normal and deferred to be
+  // easily combined into a single row.
+  construct(grid: Grid, row: number, registerIndex: string, ranges: RangePair,
+            getElementForEmptyPosition: (position: number) => HTMLElement,
+            callbackForInterval: (position: number, interval: HTMLElement) => void) {
+    const positionArray = new Array<HTMLElement>(this.view.numPositions);
+    // Construct all of the new intervals.
+    const intervalMap = this.elementsForIntervals(registerIndex, ranges);
+    for (let position = 0; position < this.view.numPositions; ++position) {
+      const interval = intervalMap.get(position);
+      if (interval == undefined) {
+        positionArray[position] = getElementForEmptyPosition(position);
+      } else {
+        callbackForInterval(position, interval);
+        this.view.intervalsAccessor.addInterval(interval);
+        const intervalPositionElements = Helper.getPositionElementsFromInterval(interval);
+        for (let j = 0; j < intervalPositionElements.length; ++j) {
+          // Point positionsArray to the new elements.
+          positionArray[position + j] = (intervalPositionElements[j] as HTMLElement);
+        }
+        position += intervalPositionElements.length - 1;
+      }
+    }
+    grid.setRow(row, positionArray);
+  }
+
+  // This is the main function used to build new intervals.
+  // Returns a map of LifeTimePositions to intervals.
+  private elementsForIntervals(registerIndex: string, ranges: RangePair) {
+    const intervalMap = new Map<number, HTMLElement>();
+    let tooltip = "";
+    ranges.forEachRange((range: Range) => {
+      for (const childRange of range.child_ranges) {
+        switch (childRange.type) {
+          case "none":
+            tooltip = Constants.INTERVAL_TEXT_FOR_NONE;
+            break;
+          case "spill_range":
+            tooltip = Constants.INTERVAL_TEXT_FOR_STACK + registerIndex;
+            break;
+          default:
+            if (childRange.op.type == "constant") {
+              tooltip = Constants.INTERVAL_TEXT_FOR_CONST;
+            } else {
+              if (childRange.op.text) {
+                tooltip = childRange.op.text;
+              } else {
+                tooltip = childRange.op;
+              }
+            }
+            break;
+        }
+        childRange.intervals.forEach((intervalNums, index) => {
+          const interval = new Interval(intervalNums);
+          const intervalEl = this.elementForInterval(childRange, interval, tooltip,
+                                                     index, range.is_deferred);
+          intervalMap.set(interval.start, intervalEl);
+        });
+      }
+    });
+    return intervalMap;
+  }
+
+  private elementForInterval(childRange: ChildRange, interval: Interval,
+                             tooltip: string, index: number, isDeferred: boolean): HTMLElement {
+    const intervalEl = createElement("div", "range-interval");
+    const title = childRange.id + ":" + index + " " + tooltip;
+    intervalEl.setAttribute("title", isDeferred ? "deferred: " + title : title);
+    this.setIntervalColor(intervalEl, tooltip);
+    const intervalInnerWrapper = createElement("div", "range-interval-wrapper");
+    intervalEl.style.gridColumn = (interval.start + 1) + " / " + (interval.end + 1);
+    intervalInnerWrapper.style.gridTemplateColumns = "repeat(" + (interval.end - interval.start)
+                                        + ",calc(" + this.view.cssVariables.positionWidth + "ch + "
+                                        + this.view.cssVariables.blockBorderWidth + "px)";
+    const intervalTextEl = this.elementForIntervalString(tooltip, interval.end - interval.start);
+    intervalEl.appendChild(intervalTextEl);
+    for (let i = interval.start; i < interval.end; ++i) {
+      const classes = "range-position range-interval-position range-empty"
+                    + (this.view.blocksData.isBlockBorder(i) ? " range-block-border" :
+                      this.view.blocksData.isInstructionBorder(i) ? " range-instr-border" : "");
+      const positionEl = createElement("div", classes, "_");
+      positionEl.style.gridColumn = (i - interval.start + 1) + "";
+      intervalInnerWrapper.appendChild(positionEl);
+    }
+    intervalEl.appendChild(intervalInnerWrapper);
+    return intervalEl;
+  }
+
+  private setIntervalColor(interval: HTMLElement, tooltip: string) {
+    if (tooltip.includes(Constants.INTERVAL_TEXT_FOR_NONE)) return;
+    if (tooltip.includes(Constants.INTERVAL_TEXT_FOR_STACK + "-")) {
+      interval.style.backgroundColor = "rgb(250, 158, 168)";
+    } else if (tooltip.includes(Constants.INTERVAL_TEXT_FOR_STACK)) {
+      interval.style.backgroundColor = "rgb(250, 158, 100)";
+    } else if (tooltip.includes(Constants.INTERVAL_TEXT_FOR_CONST)) {
+      interval.style.backgroundColor = "rgb(153, 158, 230)";
+    } else {
+      interval.style.backgroundColor = "rgb(153, 220, 168)";
+    }
+  }
+
+  private elementForIntervalString(tooltip: string, numCells: number) {
+    const spanEl = createElement("span", "range-interval-text");
+    this.setIntervalString(spanEl, tooltip, numCells);
+    return spanEl;
+  }
+
+  // Each interval displays a string of information about it.
+  private setIntervalString(spanEl: HTMLElement, tooltip: string, numCells: number) {
+    const spacePerCell = this.view.cssVariables.positionWidth;
+    // One character space is removed to accommodate for padding.
+    const spaceAvailable = (numCells * spacePerCell) - 0.5;
+    let str = tooltip + "";
+    const length = tooltip.length;
+    spanEl.style.width = null;
+    let paddingLeft = null;
+    // Add padding if possible
+    if (length <= spaceAvailable) {
+      paddingLeft = (length == spaceAvailable) ? "0.5ch" : "1ch";
+    } else {
+      str = "";
+    }
+    spanEl.style.paddingTop = null;
+    spanEl.style.paddingLeft = paddingLeft;
+    spanEl.innerHTML = str;
+  }
+}
+
+class RangeViewConstructor {
+  view: RangeView;
+  gridTemplateColumns: string;
+  grid: Grid;
+
+  // Group the rows in divs to make hiding/showing divs more efficient.
+  currentGroup: HTMLElement;
+  currentPlaceholderGroup: HTMLElement;
+
+  constructor(rangeView: RangeView) {
+    this.view = rangeView;
+  }
+
+  construct() {
+    this.gridTemplateColumns = "repeat(" + this.view.numPositions
+                             + ",calc(" + this.view.cssVariables.positionWidth + "ch + "
+                             + this.view.cssVariables.blockBorderWidth + "px)";
+
+    this.grid = new Grid();
+    this.view.gridAccessor.addGrid(this.grid);
+
+    this.view.divs.wholeHeader = this.elementForHeader();
+    this.view.divs.showOnLoad.appendChild(this.view.divs.wholeHeader);
+
+    const gridContainer = document.createElement("div");
+    this.view.divs.grid = this.elementForGrid();
+    this.view.divs.yAxis = createElement("div", "range-y-axis");
+    this.view.divs.yAxis.appendChild(this.view.divs.registerHeaders);
+    this.view.divs.yAxis.onscroll = () => {
+      this.view.scrollHandler.syncScroll(ToSync.TOP, this.view.divs.yAxis, this.view.divs.grid);
+      this.view.scrollHandler.saveScroll();
+    };
+    gridContainer.appendChild(this.view.divs.yAxis);
+    gridContainer.appendChild(this.view.divs.grid);
+    this.view.divs.showOnLoad.appendChild(gridContainer);
+
+    this.resetGroups();
+    let row = 0;
+    row = this.addVirtualRanges(row);
+    this.addFixedRanges(row);
+  }
+
+  // The following three functions are for constructing the groups which the rows are contained
+  // within and which make up the grid. This is so as to allow groups of rows to easily be displayed
+  // and hidden for performance reasons. As rows are constructed, they are added to the currentGroup
+  // div. Each row in currentGroup is matched with an equivalent placeholder row in
+  // currentPlaceholderGroup that will be shown when currentGroup is hidden so as to maintain the
+  // dimensions and scroll positions of the grid.
+
+  private resetGroups () {
+    this.currentGroup = createElement("div", "range-positions-group range-hidden");
+    this.currentPlaceholderGroup = createElement("div", "range-positions-group");
+  }
+
+  private appendGroupsToGrid() {
+    this.view.divs.grid.appendChild(this.currentPlaceholderGroup);
+    this.view.divs.grid.appendChild(this.currentGroup);
+  }
+
+  private addRowToGroup(row: number, rowEl: HTMLElement) {
+    this.currentGroup.appendChild(rowEl);
+    this.currentPlaceholderGroup
+        .appendChild(createElement("div", "range-positions range-positions-placeholder", "_"));
+    if ((row + 1) % Constants.ROW_GROUP_SIZE == 0) {
+      this.appendGroupsToGrid();
+      this.resetGroups();
+    }
+  }
+
+  private addVirtualRanges(row: number) {
+    const source = this.view.sequenceView.sequence.register_allocation;
+    for (const [registerIndex, range] of source.liveRanges) {
+      const registerName = Helper.virtualRegisterName(registerIndex);
+      const registerEl = this.elementForVirtualRegister(registerName);
+      this.addRowToGroup(row, this.elementForRow(row, registerIndex,
+                                                 new RangePair([range, undefined])));
+      this.view.divs.registers.appendChild(registerEl);
+      ++row;
+    }
+    return row;
+  }
+
+  private addFixedRanges(row: number) {
+    row = Helper.forEachFixedRange(this.view.sequenceView.sequence.register_allocation, row,
+                                   (registerIndex: string, row: number,
+                                    registerName: string, ranges: RangePair) => {
+      const registerEl = this.elementForFixedRegister(registerName);
+      this.addRowToGroup(row, this.elementForRow(row, registerIndex, ranges));
+      this.view.divs.registers.appendChild(registerEl);
+    });
+    if (row % Constants.ROW_GROUP_SIZE != 0) {
+      this.appendGroupsToGrid();
+    }
+  }
+
+  // Each row of positions and intervals associated with a register is contained in a single
+  // HTMLElement. RangePair is used to allow the two fixed register live ranges of normal and
+  // deferred to be easily combined into a single row.
+  private elementForRow(row: number, registerIndex: string, ranges: RangePair) {
+    const rowEl = createElement("div", "range-positions");
+    rowEl.style.gridTemplateColumns = this.gridTemplateColumns;
+
+    const getElementForEmptyPosition = (position: number) => {
+      const blockBorder = this.view.blocksData.isBlockBorder(position);
+      const classes = "range-position range-empty "
+                    + (blockBorder ? "range-block-border" :
+                    this.view.blocksData.isInstructionBorder(position) ? "range-instr-border"
+                                                                       : "range-position-border");
+      const positionEl = createElement("div", classes, "_");
+      positionEl.style.gridColumn = (position + 1) + "";
+      rowEl.appendChild(positionEl);
+      return positionEl;
+    };
+
+    const callbackForInterval = (_, interval: HTMLElement) => {
+      rowEl.appendChild(interval);
+    };
+
+    this.view.rowConstructor.construct(this.grid, row, registerIndex, ranges,
+                                       getElementForEmptyPosition, callbackForInterval);
+    return rowEl;
+  }
+
+  private elementForVirtualRegister(registerName: string) {
+    const regEl = createElement("div", "range-reg", registerName);
+    regEl.setAttribute("title", registerName);
+    return regEl;
+  }
+
+  private elementForFixedRegister(registerName: string) {
+    let text = registerName;
+    const span = "".padEnd(Constants.FIXED_REGISTER_LABEL_WIDTH - text.length, "_");
+    text = "HW - <span class='range-transparent'>" + span + "</span>" + text;
+    const regEl = createElement("div", "range-reg");
+    regEl.innerHTML = text;
+    regEl.setAttribute("title", registerName);
+    return regEl;
+  }
+
+  // The header element contains the three headers for the LifeTimePosition axis.
+  private elementForHeader() {
+    const headerEl = createElement("div", "range-header");
+    this.view.divs.positionHeaders = createElement("div", "range-position-labels");
+
+    this.view.divs.positionHeaders.appendChild(this.elementForBlockHeader());
+    this.view.divs.positionHeaders.appendChild(this.elementForInstructionHeader());
+    this.view.divs.positionHeaders.appendChild(this.elementForPositionHeader());
+
+    headerEl.appendChild(this.view.divs.positionHeaders);
+    headerEl.onscroll = () => {
+      this.view.scrollHandler.syncScroll(ToSync.LEFT,
+                                         this.view.divs.wholeHeader, this.view.divs.grid);
+      this.view.scrollHandler.saveScroll();
+    };
+    return headerEl;
+  }
+
+  // The LifeTimePosition axis shows three headers, for positions, instructions, and blocks.
+
+  private elementForBlockHeader() {
+    const headerEl = createElement("div", "range-block-ids");
+    headerEl.style.gridTemplateColumns = this.gridTemplateColumns;
+
+    const elementForBlockIndex = (index: number, firstInstruction: number, instrCount: number) => {
+      const str = "B" + index;
+      const element =
+        createElement("div", "range-block-id range-header-element range-block-border", str);
+      element.setAttribute("title", str);
+      const firstGridCol = (firstInstruction * Constants.POSITIONS_PER_INSTRUCTION) + 1;
+      const lastGridCol = firstGridCol + (instrCount * Constants.POSITIONS_PER_INSTRUCTION);
+      element.style.gridColumn = firstGridCol + " / " + lastGridCol;
+      return element;
+    };
+
+    let blockIndex = 0;
+    for (let i = 0; i < this.view.sequenceView.numInstructions;) {
+      const instrCount = this.view.blocksData.blockInstructionCountMap.get(blockIndex);
+      headerEl.appendChild(elementForBlockIndex(blockIndex, i, instrCount));
+      ++blockIndex;
+      i += instrCount;
+    }
+    return headerEl;
+  }
+
+  private elementForInstructionHeader() {
+    const headerEl = createElement("div", "range-instruction-ids");
+    headerEl.style.gridTemplateColumns = this.gridTemplateColumns;
+
+    const elementForInstructionIndex = (index: number, isBlockBorder: boolean) => {
+      const classes = "range-instruction-id range-header-element "
+                    + (isBlockBorder ? "range-block-border" : "range-instr-border");
+      const element = createElement("div", classes, "" + index);
+      element.setAttribute("title", "" + index);
+      const firstGridCol = (index * Constants.POSITIONS_PER_INSTRUCTION) + 1;
+      element.style.gridColumn = firstGridCol + " / "
+                               + (firstGridCol + Constants.POSITIONS_PER_INSTRUCTION);
+      return element;
+    };
+
+    for (let i = 0; i < this.view.sequenceView.numInstructions; ++i) {
+      const blockBorder = this.view.blocksData.blockBorders.has(i);
+      headerEl.appendChild(elementForInstructionIndex(i, blockBorder));
+    }
+    return headerEl;
+  }
+
+  private elementForPositionHeader() {
+    const headerEl = createElement("div", "range-positions range-positions-header");
+    headerEl.style.gridTemplateColumns = this.gridTemplateColumns;
+
+    const elementForPositionIndex = (index: number, isBlockBorder: boolean) => {
+      const classes = "range-position range-header-element " +
+        (isBlockBorder ? "range-block-border"
+                       : this.view.blocksData.isInstructionBorder(index) ? "range-instr-border"
+                                                                         : "range-position-border");
+      const element = createElement("div", classes, "" + index);
+      element.setAttribute("title", "" + index);
+      return element;
+    };
+
+    for (let i = 0; i < this.view.numPositions; ++i) {
+      headerEl.appendChild(elementForPositionIndex(i, this.view.blocksData.isBlockBorder(i)));
+    }
+    return headerEl;
+  }
+
+  private elementForGrid() {
+    const gridEl = createElement("div", "range-grid");
+    gridEl.onscroll = () => {
+      this.view.scrollHandler.syncScroll(ToSync.TOP, this.view.divs.grid, this.view.divs.yAxis);
+      this.view.scrollHandler.syncScroll(ToSync.LEFT,
+                                         this.view.divs.grid, this.view.divs.wholeHeader);
+      this.view.scrollHandler.saveScroll();
+    };
+    return gridEl;
+  }
+}
+
+// Handles the work required when the phase is changed.
+// Between before and after register allocation for example.
+class PhaseChangeHandler {
+  view: RangeView;
+
+  constructor(view: RangeView) {
+    this.view = view;
+  }
+
+  // Called when the phase view is switched between before and after register allocation.
+  phaseChange() {
+    if (!this.view.gridAccessor.hasGrid()) {
+      // If this phase view has not been seen yet then the intervals need to be constructed.
+      this.addNewIntervals();
+    }
+    // Show all intervals pertaining to the current phase view.
+    this.view.intervalsAccessor.forEachInterval((phase, interval) => {
+      interval.classList.toggle("range-hidden", phase != this.view.sequenceView.currentPhaseIndex);
+    });
+  }
+
+  private addNewIntervals() {
+    // All Grids should point to the same HTMLElement for empty cells in the grid,
+    // so as to avoid duplication. The current Grid is used to retrieve these elements.
+    const currentGrid = this.view.gridAccessor.getAnyGrid();
+    const newGrid = new Grid();
+    this.view.gridAccessor.addGrid(newGrid);
+    const source = this.view.sequenceView.sequence.register_allocation;
+    let row = 0;
+    for (const [registerIndex, range] of source.liveRanges) {
+      this.addnewIntervalsInRange(currentGrid, newGrid, row, registerIndex,
+                                  new RangePair([range, undefined]));
+      ++row;
+    }
+    Helper.forEachFixedRange(this.view.sequenceView.sequence.register_allocation, row,
+                             (registerIndex, row, _, ranges) => {
+      this.addnewIntervalsInRange(currentGrid, newGrid, row, registerIndex, ranges);
+    });
+  }
+
+  private addnewIntervalsInRange(currentGrid: Grid, newGrid: Grid, row: number,
+                                 registerIndex: string, ranges: RangePair) {
+    const numReplacements = new Map<HTMLElement, number>();
+
+    const getElementForEmptyPosition = (position: number) => {
+      return currentGrid.getCell(row, position);
+    };
+
+    // Inserts new interval beside existing intervals.
+    const callbackForInterval = (position: number, interval: HTMLElement) => {
+      // Overlapping intervals are placed beside each other and the relevant ones displayed.
+      let currentInterval = currentGrid.getInterval(row, position);
+      // The number of intervals already inserted is tracked so that the inserted intervals
+      // are ordered correctly.
+      const intervalsAlreadyInserted = numReplacements.get(currentInterval);
+      numReplacements.set(currentInterval, intervalsAlreadyInserted ? intervalsAlreadyInserted + 1
+                                                                    : 1);
+      if (intervalsAlreadyInserted) {
+        for (let j = 0; j < intervalsAlreadyInserted; ++j) {
+          currentInterval = (currentInterval.nextElementSibling as HTMLElement);
+        }
+      }
+      interval.classList.add("range-hidden");
+      currentInterval.insertAdjacentElement('afterend', interval);
+    };
+
+    this.view.rowConstructor.construct(newGrid, row, registerIndex, ranges,
+                                          getElementForEmptyPosition, callbackForInterval);
+  }
+}
+
+enum ToSync { LEFT, TOP }
+
+// Handles saving and syncing the scroll positions of the grid.
+class ScrollHandler {
+  divs: Divs;
+  scrollTop: number;
+  scrollLeft: number;
+  scrollTopTimeout: NodeJS.Timeout;
+  scrollLeftTimeout: NodeJS.Timeout;
+  scrollTopFunc: (this: GlobalEventHandlers, ev: Event) => any;
+  scrollLeftFunc: (this: GlobalEventHandlers, ev: Event) => any;
+
+  constructor(divs: Divs) {
+    this.divs = divs;
+  }
+
+  // This function is used to hide the rows which are not currently in view and
+  // so reduce the performance cost of things like hit tests and scrolling.
+  syncHidden() {
+
+    const getOffset = (rowEl: HTMLElement, placeholderRowEl: HTMLElement, isHidden: boolean) => {
+      return isHidden ? placeholderRowEl.offsetTop : rowEl.offsetTop;
+    };
+
+    const toHide = new Array<[HTMLElement, HTMLElement]>();
+
+    const sampleCell = this.divs.registers.children[1] as HTMLElement;
+    const buffer = 2 * sampleCell.clientHeight;
+    const min = this.divs.grid.offsetTop + this.divs.grid.scrollTop - buffer;
+    const max = min + this.divs.grid.clientHeight + buffer;
+
+    // The rows are grouped by being contained within a group div. This is so as to allow
+    // groups of rows to easily be displayed and hidden with less of a performance cost.
+    // Each row in the mainGroup div is matched with an equivalent placeholder row in
+    // the placeholderGroup div that will be shown when mainGroup is hidden so as to maintain
+    // the dimensions and scroll positions of the grid.
+
+    const rangeGroups = this.divs.grid.children;
+    for (let i = 1; i < rangeGroups.length; i += 2) {
+      const mainGroup = rangeGroups[i] as HTMLElement;
+      const placeholderGroup = rangeGroups[i - 1] as HTMLElement;
+      const isHidden = mainGroup.classList.contains("range-hidden");
+      // The offsets are used to calculate whether the group is in view.
+      const offsetMin = getOffset(mainGroup.firstChild as HTMLElement,
+                                  placeholderGroup.firstChild as HTMLElement, isHidden);
+      const offsetMax = getOffset(mainGroup.lastChild as HTMLElement,
+                                  placeholderGroup.lastChild as HTMLElement, isHidden);
+      if (offsetMax > min && offsetMin < max) {
+        if (isHidden) {
+          // Show the rows, hide the placeholders.
+          mainGroup.classList.toggle("range-hidden", false);
+          placeholderGroup.classList.toggle("range-hidden", true);
+        }
+      } else if (!isHidden) {
+        // Only hide the rows once the new rows are shown so that scrollLeft is not lost.
+        toHide.push([mainGroup, placeholderGroup]);
+      }
+    }
+    for (const [mainGroup, placeholderGroup] of toHide) {
+      // Hide the rows, show the placeholders.
+      mainGroup.classList.toggle("range-hidden", true);
+      placeholderGroup.classList.toggle("range-hidden", false);
+    }
+  }
+
+  // This function is required to keep the axes labels in line with the grid
+  // content when scrolling.
+  syncScroll(toSync: ToSync, source: HTMLElement, target: HTMLElement) {
+    // Continually delay timeout until scrolling has stopped.
+    toSync == ToSync.TOP ? clearTimeout(this.scrollTopTimeout)
+                         : clearTimeout(this.scrollLeftTimeout);
+    if (target.onscroll) {
+      if (toSync == ToSync.TOP) this.scrollTopFunc = target.onscroll;
+      else this.scrollLeftFunc = target.onscroll;
+    }
+    // Clear onscroll to prevent the target syncing back with the source.
+    target.onscroll = null;
+
+    if (toSync == ToSync.TOP) target.scrollTop = source.scrollTop;
+    else target.scrollLeft = source.scrollLeft;
+
+    // Only show / hide the grid content once scrolling has stopped.
+    if (toSync == ToSync.TOP) {
+      this.scrollTopTimeout = setTimeout(() => {
+        target.onscroll = this.scrollTopFunc;
+        this.syncHidden();
+      }, 500);
+    } else {
+      this.scrollLeftTimeout = setTimeout(() => {
+        target.onscroll = this.scrollLeftFunc;
+        this.syncHidden();
+      }, 500);
+    }
+  }
+
+  saveScroll() {
+    this.scrollLeft = this.divs.grid.scrollLeft;
+    this.scrollTop = this.divs.grid.scrollTop;
+  }
+
+  restoreScroll() {
+    if (this.scrollLeft) {
+      this.divs.grid.scrollLeft = this.scrollLeft;
+      this.divs.grid.scrollTop = this.scrollTop;
+    }
+  }
+}
+
+// RangeView displays the live range data as passed in by SequenceView.
+// The data is displayed in a grid format, with the fixed and virtual registers
+// along one axis, and the LifeTimePositions along the other. Each LifeTimePosition
+// is part of an Instruction in SequenceView, which itself is part of an Instruction
+// Block. The live ranges are displayed as intervals, each belonging to a register,
+// and spanning across a certain range of LifeTimePositions.
+// When the phase being displayed changes between before register allocation and
+// after register allocation, only the intervals need to be changed.
+export class RangeView {
+  sequenceView: SequenceView;
+
+  initialized: boolean;
+  isShown: boolean;
+  numPositions: number;
+  cssVariables: CSSVariables;
+  divs: Divs;
+  rowConstructor: RowConstructor;
+  phaseChangeHandler: PhaseChangeHandler;
+  scrollHandler: ScrollHandler;
+  blocksData: BlocksData;
+  intervalsAccessor: IntervalElementsAccessor;
+  gridAccessor: GridAccessor;
+
+  constructor(sequence: SequenceView) {
+    this.initialized = false;
+    this.isShown = false;
+    this.sequenceView = sequence;
+  }
+
+  initializeContent(blocks: Array<any>) {
+    if (!this.initialized) {
+      this.gridAccessor = new GridAccessor(this.sequenceView);
+      this.intervalsAccessor = new IntervalElementsAccessor(this.sequenceView);
+      this.cssVariables = new CSSVariables();
+      this.blocksData = new BlocksData(blocks);
+      this.divs = new Divs();
+      this.scrollHandler = new ScrollHandler(this.divs);
+      this.numPositions = this.sequenceView.numInstructions * Constants.POSITIONS_PER_INSTRUCTION;
+      this.rowConstructor = new RowConstructor(this);
+      const constructor = new RangeViewConstructor(this);
+      constructor.construct();
+      this.phaseChangeHandler = new PhaseChangeHandler(this);
+      this.initialized = true;
+    } else {
+      // If the RangeView has already been initialized then the phase must have
+      // been changed.
+      this.phaseChangeHandler.phaseChange();
+    }
+  }
+
+  show() {
+    if (!this.isShown) {
+      this.isShown = true;
+      this.divs.container.appendChild(this.divs.content);
+      this.divs.resizerBar.style.visibility = "visible";
+      this.divs.container.style.visibility = "visible";
+      this.divs.snapper.style.visibility = "visible";
+      // Dispatch a resize event to ensure that the
+      // panel is shown.
+      window.dispatchEvent(new Event('resize'));
+
+      setTimeout(() => {
+        this.scrollHandler.restoreScroll();
+        this.scrollHandler.syncHidden();
+        this.divs.showOnLoad.style.visibility = "visible";
+      }, 100);
+    }
+  }
+
+  hide() {
+    if (this.initialized) {
+      this.isShown = false;
+      this.divs.container.removeChild(this.divs.content);
+      this.divs.resizerBar.style.visibility = "hidden";
+      this.divs.container.style.visibility = "hidden";
+      this.divs.snapper.style.visibility = "hidden";
+      this.divs.showOnLoad.style.visibility = "hidden";
+    } else {
+      window.document.getElementById('ranges').style.visibility = "hidden";
+    }
+    // Dispatch a resize event to ensure that the
+    // panel is hidden.
+    window.dispatchEvent(new Event('resize'));
+  }
+
+  onresize() {
+    if (this.isShown) this.scrollHandler.syncHidden();
+  }
+}
diff --git a/deps/v8/tools/turbolizer/src/resizer.ts b/deps/v8/tools/turbolizer/src/resizer.ts
index 4bd771f7313..ce0519398bb 100644
--- a/deps/v8/tools/turbolizer/src/resizer.ts
+++ b/deps/v8/tools/turbolizer/src/resizer.ts
@@ -11,6 +11,8 @@ class Snapper {
   sourceCollapse: HTMLElement;
   disassemblyExpand: HTMLElement;
   disassemblyCollapse: HTMLElement;
+  rangesExpand: HTMLElement;
+  rangesCollapse: HTMLElement;
 
   constructor(resizer: Resizer) {
     this.resizer = resizer;
@@ -18,6 +20,8 @@ class Snapper {
     this.sourceCollapse = document.getElementById(C.SOURCE_COLLAPSE_ID);
     this.disassemblyExpand = document.getElementById(C.DISASSEMBLY_EXPAND_ID);
     this.disassemblyCollapse = document.getElementById(C.DISASSEMBLY_COLLAPSE_ID);
+    this.rangesExpand = document.getElementById(C.RANGES_EXPAND_ID);
+    this.rangesCollapse = document.getElementById(C.RANGES_COLLAPSE_ID);
 
     document.getElementById("show-hide-source").addEventListener("click", () => {
       this.resizer.resizerLeft.classed("snapped", !this.resizer.resizerLeft.classed("snapped"));
@@ -29,13 +33,20 @@ class Snapper {
       this.setDisassemblyExpanded(!this.disassemblyExpand.classList.contains("invisible"));
       this.resizer.updatePanes();
     });
+    document.getElementById("show-hide-ranges").addEventListener("click", () => {
+      this.resizer.resizerRanges.classed("snapped", !this.resizer.resizerRanges.classed("snapped"));
+      this.setRangesExpanded(!this.rangesExpand.classList.contains("invisible"));
+      this.resizer.updatePanes();
+    });
   }
 
   restoreExpandedState(): void {
     this.resizer.resizerLeft.classed("snapped", window.sessionStorage.getItem("expandedState-source") == "false");
     this.resizer.resizerRight.classed("snapped", window.sessionStorage.getItem("expandedState-disassembly") == "false");
+    this.resizer.resizerRanges.classed("snapped", window.sessionStorage.getItem("expandedState-ranges") == "false");
     this.setSourceExpanded(this.getLastExpandedState("source", true));
     this.setDisassemblyExpanded(this.getLastExpandedState("disassembly", true));
+    this.setRangesExpanded(this.getLastExpandedState("ranges", true));
   }
 
   getLastExpandedState(type: string, defaultState: boolean): boolean {
@@ -48,6 +59,7 @@ class Snapper {
     window.sessionStorage.setItem("expandedState-source", `${isSourceExpanded}`);
     this.sourceExpand.classList.toggle("invisible", isSourceExpanded);
     this.sourceCollapse.classList.toggle("invisible", !isSourceExpanded);
+    document.getElementById("show-hide-ranges").style.marginLeft = isSourceExpanded ? null : "40px";
   }
 
   setSourceExpanded(isSourceExpanded: boolean): void {
@@ -65,30 +77,53 @@ class Snapper {
     this.disassemblyUpdate(isDisassemblyExpanded);
     this.resizer.updateRightWidth();
   }
+
+  rangesUpdate(isRangesExpanded: boolean): void {
+    window.sessionStorage.setItem("expandedState-ranges", `${isRangesExpanded}`);
+    this.rangesExpand.classList.toggle("invisible", isRangesExpanded);
+    this.rangesCollapse.classList.toggle("invisible", !isRangesExpanded);
+  }
+
+  setRangesExpanded(isRangesExpanded: boolean): void {
+    this.rangesUpdate(isRangesExpanded);
+    this.resizer.updateRanges();
+  }
 }
 
 export class Resizer {
   snapper: Snapper;
   deadWidth: number;
+  deadHeight: number;
   left: HTMLElement;
   right: HTMLElement;
+  ranges: HTMLElement;
+  middle: HTMLElement;
   sepLeft: number;
   sepRight: number;
+  sepRangesHeight: number;
   panesUpdatedCallback: () => void;
   resizerRight: d3.Selection<HTMLDivElement, any, any, any>;
   resizerLeft: d3.Selection<HTMLDivElement, any, any, any>;
+  resizerRanges: d3.Selection<HTMLDivElement, any, any, any>;
 
   private readonly SOURCE_PANE_DEFAULT_PERCENT = 1 / 4;
   private readonly DISASSEMBLY_PANE_DEFAULT_PERCENT = 3 / 4;
+  private readonly RANGES_PANE_HEIGHT_DEFAULT_PERCENT = 3 / 4;
+  private readonly RESIZER_RANGES_HEIGHT_BUFFER_PERCENTAGE = 5;
+  private readonly RESIZER_SIZE = document.getElementById("resizer-ranges").offsetHeight;
 
-  constructor(panesUpdatedCallback: () => void, deadWidth: number) {
+  constructor(panesUpdatedCallback: () => void, deadWidth: number, deadHeight: number) {
     const resizer = this;
     resizer.panesUpdatedCallback = panesUpdatedCallback;
     resizer.deadWidth = deadWidth;
+    resizer.deadHeight = deadHeight;
     resizer.left = document.getElementById(C.SOURCE_PANE_ID);
     resizer.right = document.getElementById(C.GENERATED_PANE_ID);
+    resizer.ranges = document.getElementById(C.RANGES_PANE_ID);
+    resizer.middle = document.getElementById("middle");
     resizer.resizerLeft = d3.select('#resizer-left');
     resizer.resizerRight = d3.select('#resizer-right');
+    resizer.resizerRanges = d3.select('#resizer-ranges');
     // Set default sizes, if they weren't set.
     if (window.sessionStorage.getItem("source-pane-percent") === null) {
       window.sessionStorage.setItem("source-pane-percent", `${this.SOURCE_PANE_DEFAULT_PERCENT}`);
@@ -96,8 +131,11 @@ export class Resizer {
     if (window.sessionStorage.getItem("disassembly-pane-percent") === null) {
       window.sessionStorage.setItem("disassembly-pane-percent", `${this.DISASSEMBLY_PANE_DEFAULT_PERCENT}`);
     }
+    if (window.sessionStorage.getItem("ranges-pane-height-percent") === null) {
+      window.sessionStorage.setItem("ranges-pane-height-percent", `${this.RANGES_PANE_HEIGHT_DEFAULT_PERCENT}`);
+    }
 
-    this.updateWidths();
+    this.updateSizes();
 
     const dragResizeLeft = d3.drag()
       .on('drag', function () {
@@ -151,8 +189,35 @@ export class Resizer {
         resizer.resizerRight.classed("dragged", false);
       });
     resizer.resizerRight.call(dragResizeRight);
+
+    const dragResizeRanges = d3.drag()
+      .on('drag', function () {
+        const y = d3.mouse(this.parentElement)[1];
+        resizer.sepRangesHeight = Math.max(100, Math.min(y, window.innerHeight) - resizer.RESIZER_RANGES_HEIGHT_BUFFER_PERCENTAGE);
+        resizer.updatePanes();
+      })
+      .on('start', function () {
+        resizer.resizerRanges.classed("dragged", true);
+      })
+      .on('end', function () {
+        // If the panel is close enough to the bottom, treat it as if it was pulled all the way to the bottom.
+        const y = d3.mouse(this.parentElement)[1];
+        if (y >= (window.innerHeight - deadHeight)) {
+          resizer.sepRangesHeight = window.innerHeight;
+          resizer.updatePanes();
+        }
+        // Snap if dragged all the way to the bottom.
+        resizer.resizerRanges.classed("snapped", resizer.sepRangesHeight >= window.innerHeight - 1);
+        if (!resizer.isRangesSnapped()) {
+          window.sessionStorage.setItem("ranges-pane-height-percent", `${resizer.sepRangesHeight / window.innerHeight}`);
+        }
+        resizer.snapper.setRangesExpanded(!resizer.isRangesSnapped());
+        resizer.resizerRanges.classed("dragged", false);
+      });
+    resizer.resizerRanges.call(dragResizeRanges);
+
     window.onresize = function () {
-      resizer.updateWidths();
+      resizer.updateSizes();
       resizer.updatePanes();
     };
     resizer.snapper = new Snapper(resizer);
@@ -167,15 +232,70 @@ export class Resizer {
     return this.resizerRight.classed("snapped");
   }
 
+  isRangesSnapped() {
+    return this.resizerRanges.classed("snapped");
+  }
+
+  updateRangesPane() {
+    const clientHeight = window.innerHeight;
+    const rangesIsHidden = this.ranges.style.visibility == "hidden";
+    let resizerSize = this.RESIZER_SIZE;
+    if (rangesIsHidden) {
+      resizerSize = 0;
+      this.sepRangesHeight = clientHeight;
+    }
+
+    const rangeHeight = clientHeight - this.sepRangesHeight;
+    this.ranges.style.height = rangeHeight + 'px';
+    const panelWidth = this.sepRight - this.sepLeft - (2 * resizerSize);
+    this.ranges.style.width = panelWidth + 'px';
+    const multiview = document.getElementById("multiview");
+    if (multiview && multiview.style) {
+        multiview.style.height = (this.sepRangesHeight - resizerSize) + 'px';
+        multiview.style.width = panelWidth + 'px';
+    }
+
+    // Resize the range grid and labels.
+    const rangeGrid = (this.ranges.getElementsByClassName("range-grid")[0] as HTMLElement);
+    if (rangeGrid) {
+      const yAxis = (this.ranges.getElementsByClassName("range-y-axis")[0] as HTMLElement);
+      const rangeHeader = (this.ranges.getElementsByClassName("range-header")[0] as HTMLElement);
+
+      const gridWidth = panelWidth - yAxis.clientWidth;
+      rangeGrid.style.width = Math.floor(gridWidth - 1) + 'px';
+      // Take live ranges' right scrollbar into account.
+      rangeHeader.style.width = (gridWidth - rangeGrid.offsetWidth + rangeGrid.clientWidth - 1) + 'px';
+      // Set resizer to horizontal.
+      this.resizerRanges.style('width', panelWidth + 'px');
+
+      const rangeTitle = (this.ranges.getElementsByClassName("range-title-div")[0] as HTMLElement);
+      const rangeHeaderLabel = (this.ranges.getElementsByClassName("range-header-label-x")[0] as HTMLElement);
+      const gridHeight = rangeHeight - rangeHeader.clientHeight - rangeTitle.clientHeight - rangeHeaderLabel.clientHeight;
+      rangeGrid.style.height = gridHeight + 'px';
+      // Take live ranges' bottom scrollbar into account.
+      yAxis.style.height = (gridHeight - rangeGrid.offsetHeight + rangeGrid.clientHeight) + 'px';
+    }
+    this.resizerRanges.style('ranges', this.ranges.style.height);
+  }
+
   updatePanes() {
     this.left.style.width = this.sepLeft + 'px';
     this.resizerLeft.style('left', this.sepLeft + 'px');
     this.right.style.width = (document.body.getBoundingClientRect().width - this.sepRight) + 'px';
     this.resizerRight.style('right', (document.body.getBoundingClientRect().width - this.sepRight - 1) + 'px');
-
+    this.updateRangesPane();
     this.panesUpdatedCallback();
   }
 
+  updateRanges() {
+    if (this.isRangesSnapped()) {
+      this.sepRangesHeight = window.innerHeight;
+    } else {
+      const sepRangesHeight = window.sessionStorage.getItem("ranges-pane-height-percent");
+      this.sepRangesHeight = window.innerHeight * Number.parseFloat(sepRangesHeight);
+    }
+  }
+
   updateLeftWidth() {
     if (this.isLeftSnapped()) {
       this.sepLeft = 0;
@@ -194,8 +314,9 @@ export class Resizer {
     }
   }
 
-  updateWidths() {
+  updateSizes() {
     this.updateLeftWidth();
     this.updateRightWidth();
+    this.updateRanges();
   }
 }
diff --git a/deps/v8/tools/turbolizer/src/sequence-view.ts b/deps/v8/tools/turbolizer/src/sequence-view.ts
index 49b7e9f7b2a..187b162b1cd 100644
--- a/deps/v8/tools/turbolizer/src/sequence-view.ts
+++ b/deps/v8/tools/turbolizer/src/sequence-view.ts
@@ -3,12 +3,21 @@
 // found in the LICENSE file.
 
 import { Sequence } from "../src/source-resolver";
-import { isIterable } from "../src/util";
+import { createElement } from "../src/util";
 import { TextView } from "../src/text-view";
+import { RangeView } from "../src/range-view";
 
 export class SequenceView extends TextView {
   sequence: Sequence;
   searchInfo: Array<any>;
+  phaseSelect: HTMLSelectElement;
+  numInstructions: number;
+  currentPhaseIndex: number;
+  phaseIndexes: Set<number>;
+  isShown: boolean;
+  rangeView: RangeView;
+  showRangeView: boolean;
+  toggleRangeViewEl: HTMLElement;
 
   createViewElement() {
     const pane = document.createElement('div');
@@ -20,6 +29,12 @@ export class SequenceView extends TextView {
 
   constructor(parentId, broker) {
     super(parentId, broker);
+    this.numInstructions = 0;
+    this.phaseIndexes = new Set<number>();
+    this.isShown = false;
+    this.showRangeView = false;
+    this.rangeView = null;
+    this.toggleRangeViewEl = this.elementForToggleRangeView();
   }
 
   attachSelection(s) {
@@ -37,34 +52,58 @@ export class SequenceView extends TextView {
     return this.selection.detachSelection();
   }
 
+  show() {
+    this.currentPhaseIndex = this.phaseSelect.selectedIndex;
+    if (!this.isShown) {
+      this.isShown = true;
+      this.phaseIndexes.add(this.currentPhaseIndex);
+      this.container.appendChild(this.divNode);
+      this.container.getElementsByClassName("graph-toolbox")[0].appendChild(this.toggleRangeViewEl);
+    }
+    if (this.showRangeView) this.rangeView.show();
+  }
+
+  hide() {
+    // A single SequenceView object is used for two phases (i.e before and after
+    // register allocation), tracking the indexes lets the redundant hides and
+    // shows be avoided when switching between the two.
+    this.currentPhaseIndex = this.phaseSelect.selectedIndex;
+    if (!this.phaseIndexes.has(this.currentPhaseIndex)) {
+      this.isShown = false;
+      this.container.removeChild(this.divNode);
+      this.container.getElementsByClassName("graph-toolbox")[0].removeChild(this.toggleRangeViewEl);
+      if (this.showRangeView) this.rangeView.hide();
+    }
+  }
+
+  onresize() {
+    if (this.showRangeView) this.rangeView.onresize();
+  }
+
   initializeContent(data, rememberedSelection) {
     this.divNode.innerHTML = '';
     this.sequence = data.sequence;
     this.searchInfo = [];
-    this.divNode.addEventListener('click', (e: MouseEvent) => {
+    this.divNode.onclick = (e: MouseEvent) => {
       if (!(e.target instanceof HTMLElement)) return;
       const instructionId = Number.parseInt(e.target.dataset.instructionId, 10);
       if (!instructionId) return;
       if (!e.shiftKey) this.broker.broadcastClear(null);
       this.broker.broadcastInstructionSelect(null, [instructionId], true);
-    });
+    };
+    this.phaseSelect = (document.getElementById('phase-select') as HTMLSelectElement);
+    this.currentPhaseIndex = this.phaseSelect.selectedIndex;
+
     this.addBlocks(this.sequence.blocks);
+    const lastBlock = this.sequence.blocks[this.sequence.blocks.length - 1];
+    this.numInstructions = lastBlock.instructions[lastBlock.instructions.length - 1].id + 1;
+    this.addRangeView();
     this.attachSelection(rememberedSelection);
     this.show();
   }
 
   elementForBlock(block) {
     const view = this;
-    function createElement(tag: string, cls: string | Array<string>, content?: string) {
-      const el = document.createElement(tag);
-      if (isIterable(cls)) {
-        for (const c of cls) el.classList.add(c);
-      } else {
-        el.classList.add(cls);
-      }
-      if (content != undefined) el.innerHTML = content;
-      return el;
-    }
 
     function mkLinkHandler(id, handler) {
       return function (e) {
@@ -84,16 +123,33 @@ export class SequenceView extends TextView {
       return mkLinkHandler(text, view.selectionHandler);
     }
 
+    function elementForOperandWithSpan(span, text, searchInfo, isVirtual) {
+      const selectionText = isVirtual ? "virt_" + text : text;
+      span.onclick = mkOperandLinkHandler(selectionText);
+      searchInfo.push(text);
+      view.addHtmlElementForNodeId(selectionText, span);
+      const container = createElement("div", "");
+      container.appendChild(span);
+      return container;
+    }
+
     function elementForOperand(operand, searchInfo) {
-      const text = operand.text;
-      const operandEl = createElement("div", ["parameter", "tag", "clickable", operand.type], text);
+      let isVirtual = false;
+      let className = "parameter tag clickable " + operand.type;
+      if (operand.text[0] == 'v' && !(operand.tooltip && operand.tooltip.includes("Float"))) {
+        isVirtual = true;
+        className += " virtual-reg";
+      }
+      const span = createElement("span", className, operand.text);
       if (operand.tooltip) {
-        operandEl.setAttribute("title", operand.tooltip);
+        span.setAttribute("title", operand.tooltip);
       }
-      operandEl.onclick = mkOperandLinkHandler(text);
-      searchInfo.push(text);
-      view.addHtmlElementForNodeId(text, operandEl);
-      return operandEl;
+      return elementForOperandWithSpan(span, operand.text, searchInfo, isVirtual);
+    }
+
+    function elementForPhiOperand(text, searchInfo) {
+      const span = createElement("span", "parameter tag clickable virtual-reg", text);
+      return elementForOperandWithSpan(span, text, searchInfo, true);
     }
 
     function elementForInstruction(instruction, searchInfo) {
@@ -115,7 +171,7 @@ export class SequenceView extends TextView {
       const gapEl = createElement("div", "gap", "gap");
       let hasGaps = false;
       for (const gap of instruction.gaps) {
-        const moves = createElement("div", ["comma-sep-list", "gap-move"]);
+        const moves = createElement("div", "comma-sep-list gap-move");
         for (const move of gap) {
           hasGaps = true;
           const moveEl = createElement("div", "move");
@@ -137,7 +193,7 @@ export class SequenceView extends TextView {
       instContentsEl.appendChild(instEl);
 
       if (instruction.outputs.length > 0) {
-        const outputs = createElement("div", ["comma-sep-list", "input-output-list"]);
+        const outputs = createElement("div", "comma-sep-list input-output-list");
         for (const output of instruction.outputs) {
           const outputEl = elementForOperand(output, searchInfo);
           outputs.appendChild(outputEl);
@@ -147,8 +203,8 @@ export class SequenceView extends TextView {
         instEl.appendChild(assignEl);
       }
 
-      let text = instruction.opcode + instruction.flags;
-      const instLabel = createElement("div", "node-label", text)
+      const text = instruction.opcode + instruction.flags;
+      const instLabel = createElement("div", "node-label", text);
       if (instruction.opcode == "ArchNop" && instruction.outputs.length == 1 && instruction.outputs[0].tooltip) {
         instLabel.innerText = instruction.outputs[0].tooltip;
       }
@@ -158,7 +214,7 @@ export class SequenceView extends TextView {
       instEl.appendChild(instLabel);
 
       if (instruction.inputs.length > 0) {
-        const inputs = createElement("div", ["comma-sep-list", "input-output-list"]);
+        const inputs = createElement("div", "comma-sep-list input-output-list");
         for (const input of instruction.inputs) {
           const inputEl = elementForOperand(input, searchInfo);
           inputs.appendChild(inputEl);
@@ -167,7 +223,7 @@ export class SequenceView extends TextView {
       }
 
       if (instruction.temps.length > 0) {
-        const temps = createElement("div", ["comma-sep-list", "input-output-list", "temps"]);
+        const temps = createElement("div", "comma-sep-list input-output-list temps");
         for (const temp of instruction.temps) {
           const tempEl = elementForOperand(temp, searchInfo);
           temps.appendChild(tempEl);
@@ -181,12 +237,12 @@ export class SequenceView extends TextView {
     const sequenceBlock = createElement("div", "schedule-block");
     sequenceBlock.classList.toggle("deferred", block.deferred);
 
-    const blockId = createElement("div", ["block-id", "com", "clickable"], block.id);
+    const blockId = createElement("div", "block-id com clickable", block.id);
     blockId.onclick = mkBlockLinkHandler(block.id);
     sequenceBlock.appendChild(blockId);
-    const blockPred = createElement("div", ["predecessor-list", "block-list", "comma-sep-list"]);
+    const blockPred = createElement("div", "predecessor-list block-list comma-sep-list");
     for (const pred of block.predecessors) {
-      const predEl = createElement("div", ["block-id", "com", "clickable"], pred);
+      const predEl = createElement("div", "block-id com clickable", pred);
       predEl.onclick = mkBlockLinkHandler(pred);
       blockPred.appendChild(predEl);
     }
@@ -211,7 +267,7 @@ export class SequenceView extends TextView {
       phiEl.appendChild(assignEl);
 
       for (const input of phi.operands) {
-        const inputEl = createElement("div", ["parameter", "tag", "clickable"], input);
+        const inputEl = elementForPhiOperand(input, this.searchInfo);
         phiEl.appendChild(inputEl);
       }
     }
@@ -221,9 +277,9 @@ export class SequenceView extends TextView {
       instructions.appendChild(elementForInstruction(instruction, this.searchInfo));
     }
     sequenceBlock.appendChild(instructions);
-    const blockSucc = createElement("div", ["successor-list", "block-list", "comma-sep-list"]);
+    const blockSucc = createElement("div", "successor-list block-list comma-sep-list");
     for (const succ of block.successors) {
-      const succEl = createElement("div", ["block-id", "com", "clickable"], succ);
+      const succEl = createElement("div", "block-id com clickable", succ);
       succEl.onclick = mkBlockLinkHandler(succ);
       blockSucc.appendChild(succEl);
     }
@@ -239,6 +295,63 @@ export class SequenceView extends TextView {
     }
   }
 
+  addRangeView() {
+    const preventRangeView = reason => {
+      const toggleRangesInput = this.toggleRangeViewEl.firstChild as HTMLInputElement;
+      if (this.rangeView) {
+        toggleRangesInput.checked = false;
+        this.toggleRangeView(toggleRangesInput);
+      }
+      toggleRangesInput.disabled = true;
+      this.toggleRangeViewEl.style.textDecoration = "line-through";
+      this.toggleRangeViewEl.setAttribute("title", reason);
+    };
+
+    if (this.sequence.register_allocation) {
+      if (!this.rangeView) {
+        this.rangeView = new RangeView(this);
+      }
+      const source = this.sequence.register_allocation;
+      if (source.fixedLiveRanges.size == 0 && source.liveRanges.size == 0) {
+        preventRangeView("No live ranges to show");
+      } else if (this.numInstructions >= 249) {
+        // This is due to the css grid-column being limited to 1000 columns.
+        // Performance issues would otherwise impose some limit.
+        // TODO(george.wort@arm.com): Allow the user to specify an instruction range
+        //                            to display that spans less than 249 instructions.
+        preventRangeView(
+          "Live range display is only supported for sequences with less than 249 instructions");
+      }
+      if (this.showRangeView) {
+        this.rangeView.initializeContent(this.sequence.blocks);
+      }
+    } else {
+      preventRangeView("No live range data provided");
+    }
+  }
+
+  elementForToggleRangeView() {
+    const toggleRangeViewEl = createElement("label", "", "show live ranges");
+    const toggleRangesInput = createElement("input", "range-toggle-show") as HTMLInputElement;
+    toggleRangesInput.setAttribute("type", "checkbox");
+    toggleRangesInput.oninput = () => this.toggleRangeView(toggleRangesInput);
+    toggleRangeViewEl.insertBefore(toggleRangesInput, toggleRangeViewEl.firstChild);
+    return toggleRangeViewEl;
+  }
+
+  toggleRangeView(toggleRangesInput: HTMLInputElement) {
+    toggleRangesInput.disabled = true;
+    this.showRangeView = toggleRangesInput.checked;
+    if (this.showRangeView) {
+      this.rangeView.initializeContent(this.sequence.blocks);
+      this.rangeView.show();
+    } else {
+      this.rangeView.hide();
+    }
+    window.dispatchEvent(new Event('resize'));
+    toggleRangesInput.disabled = false;
+  }
+
   searchInputAction(searchBar, e) {
     e.stopPropagation();
     this.selectionHandler.clear();
diff --git a/deps/v8/tools/turbolizer/src/source-resolver.ts b/deps/v8/tools/turbolizer/src/source-resolver.ts
index 588eea5b995..0eeb5fdca63 100644
--- a/deps/v8/tools/turbolizer/src/source-resolver.ts
+++ b/deps/v8/tools/turbolizer/src/source-resolver.ts
@@ -83,7 +83,7 @@ interface InstructionsPhase {
   instructionOffsetToPCOffset?: any;
   blockIdtoInstructionRange?: any;
   nodeIdToInstructionRange?: any;
-  codeOffsetsInfo?: CodeOffsetsInfo
+  codeOffsetsInfo?: CodeOffsetsInfo;
 }
 
 interface GraphPhase {
@@ -100,8 +100,43 @@ export interface Schedule {
   nodes: Array<any>;
 }
 
+export class Interval {
+  start: number;
+  end: number;
+
+  constructor(numbers: [number, number]) {
+    this.start = numbers[0];
+    this.end = numbers[1];
+  }
+}
+
+export interface ChildRange {
+  id: string;
+  type: string;
+  op: any;
+  intervals: Array<[number, number]>;
+}
+
+export interface Range {
+  child_ranges: Array<ChildRange>;
+  is_deferred: boolean;
+}
+
+export class RegisterAllocation {
+  fixedDoubleLiveRanges: Map<string, Range>;
+  fixedLiveRanges: Map<string, Range>;
+  liveRanges: Map<string, Range>;
+
+  constructor(registerAllocation) {
+    this.fixedDoubleLiveRanges = new Map<string, Range>(Object.entries(registerAllocation.fixed_double_live_ranges));
+    this.fixedLiveRanges = new Map<string, Range>(Object.entries(registerAllocation.fixed_live_ranges));
+    this.liveRanges = new Map<string, Range>(Object.entries(registerAllocation.live_ranges));
+  }
+}
+
 export interface Sequence {
   blocks: Array<any>;
+  register_allocation: RegisterAllocation;
 }
 
 class CodeOffsetsInfo {
@@ -720,8 +755,11 @@ export class SourceResolver {
     phase.schedule = state;
     return phase;
   }
+
   parseSequence(phase) {
-    phase.sequence = { blocks: phase.blocks };
+    phase.sequence = { blocks: phase.blocks,
+                       register_allocation: phase.register_allocation ? new RegisterAllocation(phase.register_allocation)
+                                                                      : undefined };
     return phase;
   }
 }
diff --git a/deps/v8/tools/turbolizer/src/turbo-visualizer.ts b/deps/v8/tools/turbolizer/src/turbo-visualizer.ts
index 22753cdda50..c4c355805c2 100644
--- a/deps/v8/tools/turbolizer/src/turbo-visualizer.ts
+++ b/deps/v8/tools/turbolizer/src/turbo-visualizer.ts
@@ -18,7 +18,7 @@ window.onload = function () {
   let sourceViews: Array<CodeView> = [];
   let selectionBroker: SelectionBroker = null;
   let sourceResolver: SourceResolver = null;
-  const resizer = new Resizer(panesUpdatedCallback, 75);
+  const resizer = new Resizer(panesUpdatedCallback, 75, 75);
   const sourceTabsContainer = document.getElementById(C.SOURCE_PANE_ID);
   const sourceTabs = new Tabs(sourceTabsContainer);
   sourceTabs.addTab("&#x2b;").classList.add("last-tab", "persistent-tab");
@@ -48,6 +48,8 @@ window.onload = function () {
       sourceViews.forEach(sv => sv.hide());
       if (multiview) multiview.hide();
       multiview = null;
+      document.getElementById("ranges").innerHTML = '';
+      document.getElementById('ranges').style.visibility = "hidden";
       if (disassemblyView) disassemblyView.hide();
       sourceViews = [];
       sourceResolver = new SourceResolver();
diff --git a/deps/v8/tools/turbolizer/src/util.ts b/deps/v8/tools/turbolizer/src/util.ts
index d9c8dcdce05..8d2fc845115 100644
--- a/deps/v8/tools/turbolizer/src/util.ts
+++ b/deps/v8/tools/turbolizer/src/util.ts
@@ -91,3 +91,10 @@ export function measureText(text: string) {
 export function interpolate(val: number, max: number, start: number, end: number) {
   return start + (end - start) * (val / max);
 }
+
+export function createElement(tag: string, cls: string, content?: string) {
+  const el = document.createElement(tag);
+  el.className = cls;
+  if (content != undefined) el.innerText = content;
+  return el;
+}
diff --git a/deps/v8/tools/turbolizer/turbo-visualizer-ranges.css b/deps/v8/tools/turbolizer/turbo-visualizer-ranges.css
new file mode 100644
index 00000000000..2faab0ee697
--- /dev/null
+++ b/deps/v8/tools/turbolizer/turbo-visualizer-ranges.css
@@ -0,0 +1,234 @@
+/* CSS specific to the live ranges div associated with
+   the RangeView typescript class in src/range-view.ts. */
+
+:root {
+  --range-y-axis-width: 18ch;
+  --range-position-width: 3.5ch;
+  --range-block-border: 6px;
+  --range-instr-border: 3px;
+  --range-position-border: 1px;
+}
+
+.range-bold {
+  font-weight: bold;
+  color: black;
+}
+
+#ranges {
+  font-family: monospace;
+  min-height: auto;
+  overflow: hidden;
+}
+
+#resizer-ranges {
+  height: 10px;
+}
+
+.range-title-div {
+  padding: 2ch 2ch 2ch 2ch;
+  white-space: nowrap;
+  overflow: auto;
+}
+
+.range-title {
+  text-decoration: underline;
+  font-weight: bold;
+  font-size: large;
+  display: inline-block;
+}
+
+.range-title-help {
+  margin-left: 2ch;
+  width: 1ch;
+  padding: 0 0.25ch;
+  border: 1px dotted black;
+  color: slategray;
+  display: inline-block;
+}
+
+input.range-toggle-show {
+  vertical-align: middle;
+}
+
+.range-header-label-x {
+  text-align: center;
+  margin-left: 13ch;
+}
+
+.range-header-label-y {
+  width: 11ch;
+  float: left;
+  white-space: pre-wrap;
+  word-wrap: break-word;
+  margin-left: 6ch;
+  margin-top: 4ch;
+}
+
+.range-y-axis {
+  display: inline-block;
+  width: var(--range-y-axis-width);
+  overflow: hidden;
+  white-space: nowrap;
+  vertical-align: top;
+}
+
+.range-header {
+  display: flex;
+  overflow: hidden;
+  height: 8ch;
+  margin-left: var(--range-y-axis-width);
+}
+
+.range-position-labels,
+.range-register-labels {
+  background-color: lightgray;
+}
+
+.range-register-labels {
+  float: right;
+}
+
+.range-position-labels {
+  margin-top: auto;
+}
+
+.range-registers {
+  float: right;
+  overflow: hidden;
+  text-align: right;
+}
+
+.range-positions-header,
+.range-instruction-ids,
+.range-block-ids {
+  overflow: hidden;
+  white-space: nowrap;
+  display: grid;
+  grid-gap: 0;
+}
+
+.range-reg {
+  width: 13ch;
+  text-align: right;
+}
+
+.range-reg::after {
+  content: ":";
+}
+
+.range-grid {
+  overflow: auto;
+  display: inline-block;
+  white-space: nowrap;
+}
+
+.range-block-id {
+  display: inline-block;
+  text-align: center;
+}
+
+.range-instruction-id {
+  display: inline-block;
+  text-align: center;
+}
+
+.range-position {
+  display: inline-block;
+  text-align: center;
+  z-index: 1;
+}
+
+.range-transparent,
+.range-position.range-empty {
+  color: transparent;
+}
+
+.range-block-id:hover,
+.range-instruction-id:hover,
+.range-reg:hover,
+.range-position:hover {
+  background-color: rgba(0, 0, 255, 0.10);
+}
+
+.range-position.range-header-element {
+  border-bottom: 2px solid rgb(109, 107, 107);
+}
+
+.range-block-id,
+.range-instruction-id,
+.range-reg,
+.range-interval,
+.range-position {
+  position: relative;
+  border: var(--range-position-border) solid rgb(109, 107, 107);
+}
+
+.range-block-id,
+.range-instruction-id,
+.range-interval,
+.range-position {
+  border-left: 0;
+}
+
+.range-block-ids > .range-block-id:first-child,
+.range-instruction-ids > .range-instruction-id:first-child,
+.range-positions > .range-position:first-child {
+  border-left: var(--range-position-border) solid rgb(109, 107, 107);
+}
+
+.range-position.range-interval-position {
+  border: none;
+}
+
+.range-interval-text {
+  position: absolute;
+  padding-left: 0.5ch;
+  z-index: 2;
+  pointer-events: none
+}
+
+.range-block-border,
+.range-block-border.range-position.range-interval-position:last-child {
+  border-right: var(--range-block-border) solid rgb(109, 107, 107);
+}
+
+.range-block-border.range-position.range-interval-position {
+  border-right: var(--range-block-border) solid transparent;
+}
+
+.range-instr-border,
+.range-instr-border.range-position.range-interval-position:last-child {
+  border-right: var(--range-instr-border) solid rgb(109, 107, 107);
+}
+
+.range-instr-border.range-position.range-interval-position {
+  border-right: var(--range-instr-border) solid transparent;
+}
+
+.range,
+.range-interval,
+.range-interval-wrapper,
+.range-positions {
+  white-space: nowrap;
+  display: inline-block;
+}
+
+.range-interval-wrapper,
+.range-positions {
+  display: grid;
+  grid-gap: 0;
+}
+
+.range-interval {
+  background-color: rgb(153, 158, 168);
+}
+
+.range-hidden {
+  display: none !important;
+}
+
+.range-positions-placeholder {
+  width: 100%;
+  border: var(--range-position-border) solid transparent;
+  color: transparent;
+}
\ No newline at end of file
diff --git a/deps/v8/tools/turbolizer/turbo-visualizer.css b/deps/v8/tools/turbolizer/turbo-visualizer.css
index 6fb6da3b794..c7da769eb5d 100644
--- a/deps/v8/tools/turbolizer/turbo-visualizer.css
+++ b/deps/v8/tools/turbolizer/turbo-visualizer.css
@@ -342,6 +342,13 @@ input:hover,
   background-color: #F8F8F8;
   user-select: none;
   flex: 1;
+  z-index: 7;
+}
+
+#middle.display-inline-flex,
+#middle.display-inline-flex #multiview,
+#middle.display-inline-flex #ranges {
+  display: inline-flex;
 }
 
 .viewpane {
@@ -351,11 +358,6 @@ input:hover,
   flex-direction: column;
 }
 
-.multiview {
-  width: 100%;
-}
-
-
 #show-hide-disassembly {
   right: 0;
 }
@@ -423,6 +425,10 @@ text {
   dominant-baseline: text-before-edge;
 }
 
+.tab-content {
+  z-index: 6;
+}
+
 .resizer {
   z-index: 10;
   width: 10px;
@@ -595,6 +601,10 @@ text {
   padding-right: .5ex;
 }
 
+.instruction span {
+  padding-right: 0;
+}
+
 .phi-label,
 .instruction-id {
   display: inline-block;
@@ -626,6 +636,10 @@ text {
   display: inline-block;
 }
 
+.phi span {
+  padding-right: 0;
+}
+
 .gap .gap-move {
   padding-left: .5ex;
   padding-right: .5ex;
@@ -639,6 +653,10 @@ text {
   content: ")";
 }
 
+.virtual-reg {
+  outline: 1px dotted blue;
+}
+
 .parameter.constant {
   outline: 1px dotted red;
 }
diff --git a/deps/v8/tools/turbolizer/up-arrow.png b/deps/v8/tools/turbolizer/up-arrow.png
new file mode 100644
index 00000000000..68cb14e80b3
Binary files /dev/null and b/deps/v8/tools/turbolizer/up-arrow.png differ
diff --git a/deps/v8/tools/unittests/run_tests_test.py b/deps/v8/tools/unittests/run_tests_test.py
index 14d999b5f4b..3fc91b8e90f 100755
--- a/deps/v8/tools/unittests/run_tests_test.py
+++ b/deps/v8/tools/unittests/run_tests_test.py
@@ -253,7 +253,6 @@ def check_cleaned_json_output(
     # Check relevant properties of the json output.
     with open(actual_json) as f:
       json_output = json.load(f)[0]
-      pretty_json = json.dumps(json_output, indent=2, sort_keys=True)
 
     # Replace duration in actual output as it's non-deterministic. Also
     # replace the python executable prefix as it has a different absolute
@@ -268,10 +267,15 @@ def replace_variable_data(data):
     for data in json_output['results']:
       replace_variable_data(data)
     json_output['duration_mean'] = 1
+    # We need lexicographic sorting here to avoid non-deterministic behaviour
+    # The original sorting key is duration, but in our fake test we have
+    # non-deterministic durations before we reset them to 1
+    json_output['slowest_tests'].sort(key= lambda x: str(x))
 
     with open(os.path.join(TEST_DATA_ROOT, expected_results_name)) as f:
       expected_test_results = json.load(f)
 
+    pretty_json = json.dumps(json_output, indent=2, sort_keys=True)
     msg = None  # Set to pretty_json for bootstrapping.
     self.assertDictEqual(json_output, expected_test_results, msg)
 
diff --git a/deps/v8/tools/unittests/testdata/expected_test_results1.json b/deps/v8/tools/unittests/testdata/expected_test_results1.json
index 31fac89ec84..d1fdb49525d 100644
--- a/deps/v8/tools/unittests/testdata/expected_test_results1.json
+++ b/deps/v8/tools/unittests/testdata/expected_test_results1.json
@@ -1,124 +1,157 @@
 {
-  "arch": "x64",
-  "duration_mean": 1,
-  "mode": "release",
+  "arch": "x64", 
+  "duration_mean": 1, 
+  "mode": "release", 
   "results": [
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner",
-      "duration": 1,
-      "exit_code": 1,
+      "command": "/usr/bin/python out/Release/d8_mocked.py --test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner", 
+      "duration": 1, 
+      "exit_code": 1, 
       "expected": [
         "PASS"
-      ],
+      ], 
       "flags": [
-        "--test",
-        "strawberries",
-        "--random-seed=123",
-        "--nohard-abort",
-	"--testing-d8-test-runner"
-      ],
-      "framework_name": "standard_runner",
-      "name": "sweet/strawberries",
-      "random_seed": 123,
-      "result": "FAIL",
-      "run": 1,
-      "stderr": "",
-      "stdout": "--test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner\n",
-      "target_name": "d8_mocked.py",
-      "variant": "default",
+        "--test", 
+        "strawberries", 
+        "--random-seed=123", 
+        "--nohard-abort", 
+        "--testing-d8-test-runner"
+      ], 
+      "framework_name": "standard_runner", 
+      "name": "sweet/strawberries", 
+      "random_seed": 123, 
+      "result": "FAIL", 
+      "run": 1, 
+      "stderr": "", 
+      "stdout": "--test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner\n", 
+      "target_name": "d8_mocked.py", 
+      "variant": "default", 
       "variant_flags": []
-    },
+    }, 
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner",
-      "duration": 1,
-      "exit_code": 1,
+      "command": "/usr/bin/python out/Release/d8_mocked.py --test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner", 
+      "duration": 1, 
+      "exit_code": 1, 
       "expected": [
         "PASS"
-      ],
+      ], 
       "flags": [
-        "--test",
-        "strawberries",
-        "--random-seed=123",
-        "--nohard-abort",
-	"--testing-d8-test-runner"
-      ],
-      "framework_name": "standard_runner",
-      "name": "sweet/strawberries",
-      "random_seed": 123,
-      "result": "FAIL",
-      "run": 2,
-      "stderr": "",
-      "stdout": "--test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner\n",
-      "target_name": "d8_mocked.py",
-      "variant": "default",
+        "--test", 
+        "strawberries", 
+        "--random-seed=123", 
+        "--nohard-abort", 
+        "--testing-d8-test-runner"
+      ], 
+      "framework_name": "standard_runner", 
+      "name": "sweet/strawberries", 
+      "random_seed": 123, 
+      "result": "FAIL", 
+      "run": 2, 
+      "stderr": "", 
+      "stdout": "--test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner\n", 
+      "target_name": "d8_mocked.py", 
+      "variant": "default", 
       "variant_flags": []
-    },
+    }, 
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner",
-      "duration": 1,
-      "exit_code": 1,
+      "command": "/usr/bin/python out/Release/d8_mocked.py --test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner", 
+      "duration": 1, 
+      "exit_code": 1, 
       "expected": [
         "PASS"
-      ],
+      ], 
       "flags": [
-        "--test",
-        "strawberries",
-        "--random-seed=123",
-        "--nohard-abort",
-	"--testing-d8-test-runner"
-      ],
-      "framework_name": "standard_runner",
-      "name": "sweet/strawberries",
-      "random_seed": 123,
-      "result": "FAIL",
-      "run": 3,
-      "stderr": "",
-      "stdout": "--test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner\n",
-      "target_name": "d8_mocked.py",
-      "variant": "default",
+        "--test", 
+        "strawberries", 
+        "--random-seed=123", 
+        "--nohard-abort", 
+        "--testing-d8-test-runner"
+      ], 
+      "framework_name": "standard_runner", 
+      "name": "sweet/strawberries", 
+      "random_seed": 123, 
+      "result": "FAIL", 
+      "run": 3, 
+      "stderr": "", 
+      "stdout": "--test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner\n", 
+      "target_name": "d8_mocked.py", 
+      "variant": "default", 
       "variant_flags": []
     }
-  ],
-  "slowest_tests": [
+  ], 
+  "slowest_tests": [ 
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner",
-      "duration": 1,
+      "command": "/usr/bin/python out/Release/d8_mocked.py --test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner", 
+      "duration": 1, 
+      "exit_code": 1, 
+      "expected": [
+        "PASS"
+      ], 
       "flags": [
-        "--test",
-        "strawberries",
-        "--random-seed=123",
-        "--nohard-abort",
-	"--testing-d8-test-runner"
-      ],
-      "marked_slow": true,
-      "name": "sweet/strawberries"
-    },
+        "--test", 
+        "strawberries", 
+        "--random-seed=123", 
+        "--nohard-abort", 
+        "--testing-d8-test-runner"
+      ], 
+      "framework_name": "standard_runner", 
+      "marked_slow": true, 
+      "name": "sweet/strawberries", 
+      "random_seed": 123, 
+      "result": "FAIL", 
+      "run": 1, 
+      "target_name": "d8_mocked.py", 
+      "variant": "default", 
+      "variant_flags": []
+    }, 
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner",
-      "duration": 1,
+      "command": "/usr/bin/python out/Release/d8_mocked.py --test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner", 
+      "duration": 1, 
+      "exit_code": 1, 
+      "expected": [
+        "PASS"
+      ], 
       "flags": [
-        "--test",
-        "strawberries",
-        "--random-seed=123",
-        "--nohard-abort",
-	"--testing-d8-test-runner"
-      ],
-      "marked_slow": true,
-      "name": "sweet/strawberries"
-    },
+        "--test", 
+        "strawberries", 
+        "--random-seed=123", 
+        "--nohard-abort", 
+        "--testing-d8-test-runner"
+      ], 
+      "framework_name": "standard_runner", 
+      "marked_slow": true, 
+      "name": "sweet/strawberries", 
+      "random_seed": 123, 
+      "result": "FAIL", 
+      "run": 2, 
+      "target_name": "d8_mocked.py", 
+      "variant": "default", 
+      "variant_flags": []
+    }, 
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner",
-      "duration": 1,
+      "command": "/usr/bin/python out/Release/d8_mocked.py --test strawberries --random-seed=123 --nohard-abort --testing-d8-test-runner", 
+      "duration": 1, 
+      "exit_code": 1, 
+      "expected": [
+        "PASS"
+      ], 
       "flags": [
-        "--test",
-        "strawberries",
-        "--random-seed=123",
-        "--nohard-abort",
-	"--testing-d8-test-runner"
-      ],
-      "marked_slow": true,
-      "name": "sweet/strawberries"
+        "--test", 
+        "strawberries", 
+        "--random-seed=123", 
+        "--nohard-abort", 
+        "--testing-d8-test-runner"
+      ], 
+      "framework_name": "standard_runner", 
+      "marked_slow": true, 
+      "name": "sweet/strawberries", 
+      "random_seed": 123, 
+      "result": "FAIL", 
+      "run": 3, 
+      "target_name": "d8_mocked.py", 
+      "variant": "default", 
+      "variant_flags": []
     }
-  ],
+  ], 
   "test_total": 3
-}
+}
\ No newline at end of file
diff --git a/deps/v8/tools/unittests/testdata/expected_test_results2.json b/deps/v8/tools/unittests/testdata/expected_test_results2.json
index fd179727986..ac9ab9cc595 100644
--- a/deps/v8/tools/unittests/testdata/expected_test_results2.json
+++ b/deps/v8/tools/unittests/testdata/expected_test_results2.json
@@ -1,82 +1,104 @@
 {
-  "arch": "x64",
-  "duration_mean": 1,
-  "mode": "release",
+  "arch": "x64", 
+  "duration_mean": 1, 
+  "mode": "release", 
   "results": [
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py bananaflakes --random-seed=123 --nohard-abort --testing-d8-test-runner",
-      "duration": 1,
-      "exit_code": 1,
+      "command": "/usr/bin/python out/Release/d8_mocked.py bananaflakes --random-seed=123 --nohard-abort --testing-d8-test-runner", 
+      "duration": 1, 
+      "exit_code": 1, 
       "expected": [
         "PASS"
-      ],
+      ], 
       "flags": [
-        "bananaflakes",
-        "--random-seed=123",
-        "--nohard-abort",
-	"--testing-d8-test-runner"
-      ],
-      "framework_name": "standard_runner",
-      "name": "sweet/bananaflakes",
-      "random_seed": 123,
-      "result": "FAIL",
-      "run": 1,
-      "stderr": "",
-      "stdout": "bananaflakes --random-seed=123 --nohard-abort --testing-d8-test-runner\n",
-      "target_name": "d8_mocked.py",
-      "variant": "default",
+        "bananaflakes", 
+        "--random-seed=123", 
+        "--nohard-abort", 
+        "--testing-d8-test-runner"
+      ], 
+      "framework_name": "standard_runner", 
+      "name": "sweet/bananaflakes", 
+      "random_seed": 123, 
+      "result": "FAIL", 
+      "run": 1, 
+      "stderr": "", 
+      "stdout": "bananaflakes --random-seed=123 --nohard-abort --testing-d8-test-runner\n", 
+      "target_name": "d8_mocked.py", 
+      "variant": "default", 
       "variant_flags": []
-    },
+    }, 
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py bananaflakes --random-seed=123 --nohard-abort --testing-d8-test-runner",
-      "duration": 1,
-      "exit_code": 0,
+      "command": "/usr/bin/python out/Release/d8_mocked.py bananaflakes --random-seed=123 --nohard-abort --testing-d8-test-runner", 
+      "duration": 1, 
+      "exit_code": 0, 
       "expected": [
         "PASS"
-      ],
+      ], 
       "flags": [
-        "bananaflakes",
-        "--random-seed=123",
-        "--nohard-abort",
-	"--testing-d8-test-runner"
-      ],
-      "framework_name": "standard_runner",
-      "name": "sweet/bananaflakes",
-      "random_seed": 123,
-      "result": "PASS",
-      "run": 2,
-      "stderr": "",
-      "stdout": "bananaflakes --random-seed=123 --nohard-abort --testing-d8-test-runner\n",
-      "target_name": "d8_mocked.py",
-      "variant": "default",
+        "bananaflakes", 
+        "--random-seed=123", 
+        "--nohard-abort", 
+        "--testing-d8-test-runner"
+      ], 
+      "framework_name": "standard_runner", 
+      "name": "sweet/bananaflakes", 
+      "random_seed": 123, 
+      "result": "PASS", 
+      "run": 2, 
+      "stderr": "", 
+      "stdout": "bananaflakes --random-seed=123 --nohard-abort --testing-d8-test-runner\n", 
+      "target_name": "d8_mocked.py", 
+      "variant": "default", 
       "variant_flags": []
     }
-  ],
+  ], 
   "slowest_tests": [
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py bananaflakes --random-seed=123 --nohard-abort --testing-d8-test-runner",
-      "duration": 1,
+      "command": "/usr/bin/python out/Release/d8_mocked.py bananaflakes --random-seed=123 --nohard-abort --testing-d8-test-runner", 
+      "duration": 1, 
+      "exit_code": 0, 
+      "expected": [
+        "PASS"
+      ], 
       "flags": [
-        "bananaflakes",
-        "--random-seed=123",
-        "--nohard-abort",
-	"--testing-d8-test-runner"
-      ],
-      "marked_slow": false,
-      "name": "sweet/bananaflakes"
-    },
+        "bananaflakes", 
+        "--random-seed=123", 
+        "--nohard-abort", 
+        "--testing-d8-test-runner"
+      ], 
+      "framework_name": "standard_runner", 
+      "marked_slow": false, 
+      "name": "sweet/bananaflakes", 
+      "random_seed": 123, 
+      "result": "", 
+      "run": 2, 
+      "target_name": "d8_mocked.py", 
+      "variant": "default", 
+      "variant_flags": []
+    }, 
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py bananaflakes --random-seed=123 --nohard-abort --testing-d8-test-runner",
-      "duration": 1,
+      "command": "/usr/bin/python out/Release/d8_mocked.py bananaflakes --random-seed=123 --nohard-abort --testing-d8-test-runner", 
+      "duration": 1, 
+      "exit_code": 1, 
+      "expected": [
+        "PASS"
+      ], 
       "flags": [
-        "bananaflakes",
-        "--random-seed=123",
-        "--nohard-abort",
-	"--testing-d8-test-runner"
-      ],
-      "marked_slow": false,
-      "name": "sweet/bananaflakes"
+        "bananaflakes", 
+        "--random-seed=123", 
+        "--nohard-abort", 
+        "--testing-d8-test-runner"
+      ], 
+      "framework_name": "standard_runner", 
+      "marked_slow": false, 
+      "name": "sweet/bananaflakes", 
+      "random_seed": 123, 
+      "result": "FAIL", 
+      "run": 1, 
+      "target_name": "d8_mocked.py", 
+      "variant": "default", 
+      "variant_flags": []
     }
-  ],
+  ], 
   "test_total": 2
 }
diff --git a/deps/v8/tools/v8heapconst.py b/deps/v8/tools/v8heapconst.py
index 07c4ebf8cb3..f38b72b6e61 100644
--- a/deps/v8/tools/v8heapconst.py
+++ b/deps/v8/tools/v8heapconst.py
@@ -29,8 +29,8 @@
   65: "BIG_INT_BASE_TYPE",
   66: "HEAP_NUMBER_TYPE",
   67: "ODDBALL_TYPE",
-  68: "EXPORTED_SUB_CLASS_BASE_TYPE",
-  69: "EXPORTED_SUB_CLASS_TYPE",
+  68: "ABSTRACT_INTERNAL_CLASS_SUBCLASS1_TYPE",
+  69: "ABSTRACT_INTERNAL_CLASS_SUBCLASS2_TYPE",
   70: "FOREIGN_TYPE",
   71: "PROMISE_FULFILL_REACTION_JOB_TASK_TYPE",
   72: "PROMISE_REJECT_REACTION_JOB_TASK_TYPE",
@@ -77,71 +77,78 @@
   113: "WASM_EXPORTED_FUNCTION_DATA_TYPE",
   114: "WASM_INDIRECT_FUNCTION_TABLE_TYPE",
   115: "WASM_JS_FUNCTION_DATA_TYPE",
-  116: "FIXED_ARRAY_TYPE",
-  117: "HASH_TABLE_TYPE",
-  118: "EPHEMERON_HASH_TABLE_TYPE",
-  119: "GLOBAL_DICTIONARY_TYPE",
-  120: "NAME_DICTIONARY_TYPE",
-  121: "NUMBER_DICTIONARY_TYPE",
-  122: "ORDERED_HASH_MAP_TYPE",
-  123: "ORDERED_HASH_SET_TYPE",
-  124: "ORDERED_NAME_DICTIONARY_TYPE",
-  125: "SIMPLE_NUMBER_DICTIONARY_TYPE",
-  126: "STRING_TABLE_TYPE",
-  127: "CLOSURE_FEEDBACK_CELL_ARRAY_TYPE",
-  128: "OBJECT_BOILERPLATE_DESCRIPTION_TYPE",
-  129: "SCOPE_INFO_TYPE",
-  130: "SCRIPT_CONTEXT_TABLE_TYPE",
-  131: "BYTE_ARRAY_TYPE",
-  132: "BYTECODE_ARRAY_TYPE",
-  133: "FIXED_DOUBLE_ARRAY_TYPE",
-  134: "INTERNAL_CLASS_WITH_SMI_ELEMENTS_TYPE",
-  135: "AWAIT_CONTEXT_TYPE",
-  136: "BLOCK_CONTEXT_TYPE",
-  137: "CATCH_CONTEXT_TYPE",
-  138: "DEBUG_EVALUATE_CONTEXT_TYPE",
-  139: "EVAL_CONTEXT_TYPE",
-  140: "FUNCTION_CONTEXT_TYPE",
-  141: "MODULE_CONTEXT_TYPE",
-  142: "NATIVE_CONTEXT_TYPE",
-  143: "SCRIPT_CONTEXT_TYPE",
-  144: "WITH_CONTEXT_TYPE",
-  145: "SMALL_ORDERED_HASH_MAP_TYPE",
-  146: "SMALL_ORDERED_HASH_SET_TYPE",
-  147: "SMALL_ORDERED_NAME_DICTIONARY_TYPE",
-  148: "SOURCE_TEXT_MODULE_TYPE",
-  149: "SYNTHETIC_MODULE_TYPE",
-  150: "UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE",
-  151: "UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE",
-  152: "WEAK_FIXED_ARRAY_TYPE",
-  153: "TRANSITION_ARRAY_TYPE",
-  154: "CELL_TYPE",
-  155: "CODE_TYPE",
-  156: "CODE_DATA_CONTAINER_TYPE",
-  157: "COVERAGE_INFO_TYPE",
-  158: "DESCRIPTOR_ARRAY_TYPE",
-  159: "EMBEDDER_DATA_ARRAY_TYPE",
-  160: "FEEDBACK_METADATA_TYPE",
-  161: "FEEDBACK_VECTOR_TYPE",
-  162: "FILLER_TYPE",
-  163: "FREE_SPACE_TYPE",
-  164: "INTERNAL_CLASS_TYPE",
-  165: "INTERNAL_CLASS_WITH_STRUCT_ELEMENTS_TYPE",
-  166: "MAP_TYPE",
-  167: "PREPARSE_DATA_TYPE",
-  168: "PROPERTY_ARRAY_TYPE",
-  169: "PROPERTY_CELL_TYPE",
-  170: "SHARED_FUNCTION_INFO_TYPE",
-  171: "SMI_BOX_TYPE",
-  172: "SMI_PAIR_TYPE",
-  173: "SORT_STATE_TYPE",
-  174: "WEAK_ARRAY_LIST_TYPE",
-  175: "WEAK_CELL_TYPE",
-  176: "JS_PROXY_TYPE",
+  116: "WASM_VALUE_TYPE",
+  117: "FIXED_ARRAY_TYPE",
+  118: "HASH_TABLE_TYPE",
+  119: "EPHEMERON_HASH_TABLE_TYPE",
+  120: "GLOBAL_DICTIONARY_TYPE",
+  121: "NAME_DICTIONARY_TYPE",
+  122: "NUMBER_DICTIONARY_TYPE",
+  123: "ORDERED_HASH_MAP_TYPE",
+  124: "ORDERED_HASH_SET_TYPE",
+  125: "ORDERED_NAME_DICTIONARY_TYPE",
+  126: "SIMPLE_NUMBER_DICTIONARY_TYPE",
+  127: "STRING_TABLE_TYPE",
+  128: "CLOSURE_FEEDBACK_CELL_ARRAY_TYPE",
+  129: "OBJECT_BOILERPLATE_DESCRIPTION_TYPE",
+  130: "SCOPE_INFO_TYPE",
+  131: "SCRIPT_CONTEXT_TABLE_TYPE",
+  132: "BYTE_ARRAY_TYPE",
+  133: "BYTECODE_ARRAY_TYPE",
+  134: "FIXED_DOUBLE_ARRAY_TYPE",
+  135: "INTERNAL_CLASS_WITH_SMI_ELEMENTS_TYPE",
+  136: "SLOPPY_ARGUMENTS_ELEMENTS_TYPE",
+  137: "AWAIT_CONTEXT_TYPE",
+  138: "BLOCK_CONTEXT_TYPE",
+  139: "CATCH_CONTEXT_TYPE",
+  140: "DEBUG_EVALUATE_CONTEXT_TYPE",
+  141: "EVAL_CONTEXT_TYPE",
+  142: "FUNCTION_CONTEXT_TYPE",
+  143: "MODULE_CONTEXT_TYPE",
+  144: "NATIVE_CONTEXT_TYPE",
+  145: "SCRIPT_CONTEXT_TYPE",
+  146: "WITH_CONTEXT_TYPE",
+  147: "SMALL_ORDERED_HASH_MAP_TYPE",
+  148: "SMALL_ORDERED_HASH_SET_TYPE",
+  149: "SMALL_ORDERED_NAME_DICTIONARY_TYPE",
+  150: "EXPORTED_SUB_CLASS_BASE_TYPE",
+  151: "EXPORTED_SUB_CLASS_TYPE",
+  152: "SOURCE_TEXT_MODULE_TYPE",
+  153: "SYNTHETIC_MODULE_TYPE",
+  154: "UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE",
+  155: "UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE",
+  156: "WEAK_FIXED_ARRAY_TYPE",
+  157: "TRANSITION_ARRAY_TYPE",
+  158: "CELL_TYPE",
+  159: "CODE_TYPE",
+  160: "CODE_DATA_CONTAINER_TYPE",
+  161: "COVERAGE_INFO_TYPE",
+  162: "DESCRIPTOR_ARRAY_TYPE",
+  163: "EMBEDDER_DATA_ARRAY_TYPE",
+  164: "FEEDBACK_METADATA_TYPE",
+  165: "FEEDBACK_VECTOR_TYPE",
+  166: "FILLER_TYPE",
+  167: "FREE_SPACE_TYPE",
+  168: "INTERNAL_CLASS_TYPE",
+  169: "INTERNAL_CLASS_WITH_STRUCT_ELEMENTS_TYPE",
+  170: "MAP_TYPE",
+  171: "ON_HEAP_BASIC_BLOCK_PROFILER_DATA_TYPE",
+  172: "PREPARSE_DATA_TYPE",
+  173: "PROPERTY_ARRAY_TYPE",
+  174: "PROPERTY_CELL_TYPE",
+  175: "SHARED_FUNCTION_INFO_TYPE",
+  176: "SMI_BOX_TYPE",
+  177: "SMI_PAIR_TYPE",
+  178: "SORT_STATE_TYPE",
+  179: "WASM_ARRAY_TYPE",
+  180: "WASM_STRUCT_TYPE",
+  181: "WEAK_ARRAY_LIST_TYPE",
+  182: "WEAK_CELL_TYPE",
+  183: "JS_PROXY_TYPE",
   1057: "JS_OBJECT_TYPE",
-  177: "JS_GLOBAL_OBJECT_TYPE",
-  178: "JS_GLOBAL_PROXY_TYPE",
-  179: "JS_MODULE_NAMESPACE_TYPE",
+  184: "JS_GLOBAL_OBJECT_TYPE",
+  185: "JS_GLOBAL_PROXY_TYPE",
+  186: "JS_MODULE_NAMESPACE_TYPE",
   1040: "JS_SPECIAL_API_OBJECT_TYPE",
   1041: "JS_PRIMITIVE_WRAPPER_TYPE",
   1042: "JS_MAP_KEY_ITERATOR_TYPE",
@@ -171,180 +178,184 @@
   1067: "JS_DISPLAY_NAMES_TYPE",
   1068: "JS_ERROR_TYPE",
   1069: "JS_FINALIZATION_REGISTRY_TYPE",
-  1070: "JS_FINALIZATION_REGISTRY_CLEANUP_ITERATOR_TYPE",
-  1071: "JS_LIST_FORMAT_TYPE",
-  1072: "JS_LOCALE_TYPE",
-  1073: "JS_MESSAGE_OBJECT_TYPE",
-  1074: "JS_NUMBER_FORMAT_TYPE",
-  1075: "JS_PLURAL_RULES_TYPE",
-  1076: "JS_PROMISE_TYPE",
-  1077: "JS_REG_EXP_TYPE",
-  1078: "JS_REG_EXP_STRING_ITERATOR_TYPE",
-  1079: "JS_RELATIVE_TIME_FORMAT_TYPE",
-  1080: "JS_SEGMENT_ITERATOR_TYPE",
-  1081: "JS_SEGMENTER_TYPE",
-  1082: "JS_STRING_ITERATOR_TYPE",
-  1083: "JS_V8_BREAK_ITERATOR_TYPE",
-  1084: "JS_WEAK_REF_TYPE",
-  1085: "WASM_EXCEPTION_OBJECT_TYPE",
-  1086: "WASM_GLOBAL_OBJECT_TYPE",
-  1087: "WASM_INSTANCE_OBJECT_TYPE",
-  1088: "WASM_MEMORY_OBJECT_TYPE",
-  1089: "WASM_MODULE_OBJECT_TYPE",
-  1090: "WASM_TABLE_OBJECT_TYPE",
-  1091: "JS_BOUND_FUNCTION_TYPE",
-  1092: "JS_FUNCTION_TYPE",
+  1070: "JS_LIST_FORMAT_TYPE",
+  1071: "JS_LOCALE_TYPE",
+  1072: "JS_MESSAGE_OBJECT_TYPE",
+  1073: "JS_NUMBER_FORMAT_TYPE",
+  1074: "JS_PLURAL_RULES_TYPE",
+  1075: "JS_PROMISE_TYPE",
+  1076: "JS_REG_EXP_TYPE",
+  1077: "JS_REG_EXP_STRING_ITERATOR_TYPE",
+  1078: "JS_RELATIVE_TIME_FORMAT_TYPE",
+  1079: "JS_SEGMENT_ITERATOR_TYPE",
+  1080: "JS_SEGMENTER_TYPE",
+  1081: "JS_STRING_ITERATOR_TYPE",
+  1082: "JS_V8_BREAK_ITERATOR_TYPE",
+  1083: "JS_WEAK_REF_TYPE",
+  1084: "WASM_EXCEPTION_OBJECT_TYPE",
+  1085: "WASM_GLOBAL_OBJECT_TYPE",
+  1086: "WASM_INSTANCE_OBJECT_TYPE",
+  1087: "WASM_MEMORY_OBJECT_TYPE",
+  1088: "WASM_MODULE_OBJECT_TYPE",
+  1089: "WASM_TABLE_OBJECT_TYPE",
+  1090: "JS_BOUND_FUNCTION_TYPE",
+  1091: "JS_FUNCTION_TYPE",
 }
 
 # List of known V8 maps.
 KNOWN_MAPS = {
-  ("read_only_space", 0x00121): (163, "FreeSpaceMap"),
-  ("read_only_space", 0x00149): (166, "MetaMap"),
+  ("read_only_space", 0x00121): (167, "FreeSpaceMap"),
+  ("read_only_space", 0x00149): (170, "MetaMap"),
   ("read_only_space", 0x0018d): (67, "NullMap"),
-  ("read_only_space", 0x001c5): (158, "DescriptorArrayMap"),
-  ("read_only_space", 0x001f5): (152, "WeakFixedArrayMap"),
-  ("read_only_space", 0x0021d): (162, "OnePointerFillerMap"),
-  ("read_only_space", 0x00245): (162, "TwoPointerFillerMap"),
+  ("read_only_space", 0x001c5): (162, "DescriptorArrayMap"),
+  ("read_only_space", 0x001f5): (156, "WeakFixedArrayMap"),
+  ("read_only_space", 0x0021d): (166, "OnePointerFillerMap"),
+  ("read_only_space", 0x00245): (166, "TwoPointerFillerMap"),
   ("read_only_space", 0x00289): (67, "UninitializedMap"),
   ("read_only_space", 0x002cd): (8, "OneByteInternalizedStringMap"),
   ("read_only_space", 0x00329): (67, "UndefinedMap"),
   ("read_only_space", 0x0035d): (66, "HeapNumberMap"),
   ("read_only_space", 0x003a1): (67, "TheHoleMap"),
   ("read_only_space", 0x00401): (67, "BooleanMap"),
-  ("read_only_space", 0x00489): (131, "ByteArrayMap"),
-  ("read_only_space", 0x004b1): (116, "FixedArrayMap"),
-  ("read_only_space", 0x004d9): (116, "FixedCOWArrayMap"),
-  ("read_only_space", 0x00501): (117, "HashTableMap"),
+  ("read_only_space", 0x00489): (132, "ByteArrayMap"),
+  ("read_only_space", 0x004b1): (117, "FixedArrayMap"),
+  ("read_only_space", 0x004d9): (117, "FixedCOWArrayMap"),
+  ("read_only_space", 0x00501): (118, "HashTableMap"),
   ("read_only_space", 0x00529): (64, "SymbolMap"),
   ("read_only_space", 0x00551): (40, "OneByteStringMap"),
-  ("read_only_space", 0x00579): (129, "ScopeInfoMap"),
-  ("read_only_space", 0x005a1): (170, "SharedFunctionInfoMap"),
-  ("read_only_space", 0x005c9): (155, "CodeMap"),
-  ("read_only_space", 0x005f1): (154, "CellMap"),
-  ("read_only_space", 0x00619): (169, "GlobalPropertyCellMap"),
+  ("read_only_space", 0x00579): (130, "ScopeInfoMap"),
+  ("read_only_space", 0x005a1): (175, "SharedFunctionInfoMap"),
+  ("read_only_space", 0x005c9): (159, "CodeMap"),
+  ("read_only_space", 0x005f1): (158, "CellMap"),
+  ("read_only_space", 0x00619): (174, "GlobalPropertyCellMap"),
   ("read_only_space", 0x00641): (70, "ForeignMap"),
-  ("read_only_space", 0x00669): (153, "TransitionArrayMap"),
+  ("read_only_space", 0x00669): (157, "TransitionArrayMap"),
   ("read_only_space", 0x00691): (45, "ThinOneByteStringMap"),
-  ("read_only_space", 0x006b9): (161, "FeedbackVectorMap"),
+  ("read_only_space", 0x006b9): (165, "FeedbackVectorMap"),
   ("read_only_space", 0x0070d): (67, "ArgumentsMarkerMap"),
   ("read_only_space", 0x0076d): (67, "ExceptionMap"),
   ("read_only_space", 0x007c9): (67, "TerminationExceptionMap"),
   ("read_only_space", 0x00831): (67, "OptimizedOutMap"),
   ("read_only_space", 0x00891): (67, "StaleRegisterMap"),
-  ("read_only_space", 0x008d5): (130, "ScriptContextTableMap"),
-  ("read_only_space", 0x008fd): (127, "ClosureFeedbackCellArrayMap"),
-  ("read_only_space", 0x00925): (160, "FeedbackMetadataArrayMap"),
-  ("read_only_space", 0x0094d): (116, "ArrayListMap"),
+  ("read_only_space", 0x008d5): (131, "ScriptContextTableMap"),
+  ("read_only_space", 0x008fd): (128, "ClosureFeedbackCellArrayMap"),
+  ("read_only_space", 0x00925): (164, "FeedbackMetadataArrayMap"),
+  ("read_only_space", 0x0094d): (117, "ArrayListMap"),
   ("read_only_space", 0x00975): (65, "BigIntMap"),
-  ("read_only_space", 0x0099d): (128, "ObjectBoilerplateDescriptionMap"),
-  ("read_only_space", 0x009c5): (132, "BytecodeArrayMap"),
-  ("read_only_space", 0x009ed): (156, "CodeDataContainerMap"),
-  ("read_only_space", 0x00a15): (157, "CoverageInfoMap"),
-  ("read_only_space", 0x00a3d): (133, "FixedDoubleArrayMap"),
-  ("read_only_space", 0x00a65): (119, "GlobalDictionaryMap"),
+  ("read_only_space", 0x0099d): (129, "ObjectBoilerplateDescriptionMap"),
+  ("read_only_space", 0x009c5): (133, "BytecodeArrayMap"),
+  ("read_only_space", 0x009ed): (160, "CodeDataContainerMap"),
+  ("read_only_space", 0x00a15): (161, "CoverageInfoMap"),
+  ("read_only_space", 0x00a3d): (134, "FixedDoubleArrayMap"),
+  ("read_only_space", 0x00a65): (120, "GlobalDictionaryMap"),
   ("read_only_space", 0x00a8d): (96, "ManyClosuresCellMap"),
-  ("read_only_space", 0x00ab5): (116, "ModuleInfoMap"),
-  ("read_only_space", 0x00add): (120, "NameDictionaryMap"),
+  ("read_only_space", 0x00ab5): (117, "ModuleInfoMap"),
+  ("read_only_space", 0x00add): (121, "NameDictionaryMap"),
   ("read_only_space", 0x00b05): (96, "NoClosuresCellMap"),
-  ("read_only_space", 0x00b2d): (121, "NumberDictionaryMap"),
+  ("read_only_space", 0x00b2d): (122, "NumberDictionaryMap"),
   ("read_only_space", 0x00b55): (96, "OneClosureCellMap"),
-  ("read_only_space", 0x00b7d): (122, "OrderedHashMapMap"),
-  ("read_only_space", 0x00ba5): (123, "OrderedHashSetMap"),
-  ("read_only_space", 0x00bcd): (124, "OrderedNameDictionaryMap"),
-  ("read_only_space", 0x00bf5): (167, "PreparseDataMap"),
-  ("read_only_space", 0x00c1d): (168, "PropertyArrayMap"),
+  ("read_only_space", 0x00b7d): (123, "OrderedHashMapMap"),
+  ("read_only_space", 0x00ba5): (124, "OrderedHashSetMap"),
+  ("read_only_space", 0x00bcd): (125, "OrderedNameDictionaryMap"),
+  ("read_only_space", 0x00bf5): (172, "PreparseDataMap"),
+  ("read_only_space", 0x00c1d): (173, "PropertyArrayMap"),
   ("read_only_space", 0x00c45): (92, "SideEffectCallHandlerInfoMap"),
   ("read_only_space", 0x00c6d): (92, "SideEffectFreeCallHandlerInfoMap"),
   ("read_only_space", 0x00c95): (92, "NextCallSideEffectFreeCallHandlerInfoMap"),
-  ("read_only_space", 0x00cbd): (125, "SimpleNumberDictionaryMap"),
-  ("read_only_space", 0x00ce5): (116, "SloppyArgumentsElementsMap"),
-  ("read_only_space", 0x00d0d): (145, "SmallOrderedHashMapMap"),
-  ("read_only_space", 0x00d35): (146, "SmallOrderedHashSetMap"),
-  ("read_only_space", 0x00d5d): (147, "SmallOrderedNameDictionaryMap"),
-  ("read_only_space", 0x00d85): (148, "SourceTextModuleMap"),
-  ("read_only_space", 0x00dad): (126, "StringTableMap"),
-  ("read_only_space", 0x00dd5): (149, "SyntheticModuleMap"),
-  ("read_only_space", 0x00dfd): (151, "UncompiledDataWithoutPreparseDataMap"),
-  ("read_only_space", 0x00e25): (150, "UncompiledDataWithPreparseDataMap"),
-  ("read_only_space", 0x00e4d): (174, "WeakArrayListMap"),
-  ("read_only_space", 0x00e75): (118, "EphemeronHashTableMap"),
-  ("read_only_space", 0x00e9d): (159, "EmbedderDataArrayMap"),
-  ("read_only_space", 0x00ec5): (175, "WeakCellMap"),
-  ("read_only_space", 0x00eed): (32, "StringMap"),
-  ("read_only_space", 0x00f15): (41, "ConsOneByteStringMap"),
-  ("read_only_space", 0x00f3d): (33, "ConsStringMap"),
-  ("read_only_space", 0x00f65): (37, "ThinStringMap"),
-  ("read_only_space", 0x00f8d): (35, "SlicedStringMap"),
-  ("read_only_space", 0x00fb5): (43, "SlicedOneByteStringMap"),
-  ("read_only_space", 0x00fdd): (34, "ExternalStringMap"),
-  ("read_only_space", 0x01005): (42, "ExternalOneByteStringMap"),
-  ("read_only_space", 0x0102d): (50, "UncachedExternalStringMap"),
-  ("read_only_space", 0x01055): (0, "InternalizedStringMap"),
-  ("read_only_space", 0x0107d): (2, "ExternalInternalizedStringMap"),
-  ("read_only_space", 0x010a5): (10, "ExternalOneByteInternalizedStringMap"),
-  ("read_only_space", 0x010cd): (18, "UncachedExternalInternalizedStringMap"),
-  ("read_only_space", 0x010f5): (26, "UncachedExternalOneByteInternalizedStringMap"),
-  ("read_only_space", 0x0111d): (58, "UncachedExternalOneByteStringMap"),
-  ("read_only_space", 0x01145): (67, "SelfReferenceMarkerMap"),
+  ("read_only_space", 0x00cbd): (126, "SimpleNumberDictionaryMap"),
+  ("read_only_space", 0x00ce5): (147, "SmallOrderedHashMapMap"),
+  ("read_only_space", 0x00d0d): (148, "SmallOrderedHashSetMap"),
+  ("read_only_space", 0x00d35): (149, "SmallOrderedNameDictionaryMap"),
+  ("read_only_space", 0x00d5d): (152, "SourceTextModuleMap"),
+  ("read_only_space", 0x00d85): (127, "StringTableMap"),
+  ("read_only_space", 0x00dad): (153, "SyntheticModuleMap"),
+  ("read_only_space", 0x00dd5): (155, "UncompiledDataWithoutPreparseDataMap"),
+  ("read_only_space", 0x00dfd): (154, "UncompiledDataWithPreparseDataMap"),
+  ("read_only_space", 0x00e25): (181, "WeakArrayListMap"),
+  ("read_only_space", 0x00e4d): (119, "EphemeronHashTableMap"),
+  ("read_only_space", 0x00e75): (163, "EmbedderDataArrayMap"),
+  ("read_only_space", 0x00e9d): (182, "WeakCellMap"),
+  ("read_only_space", 0x00ec5): (32, "StringMap"),
+  ("read_only_space", 0x00eed): (41, "ConsOneByteStringMap"),
+  ("read_only_space", 0x00f15): (33, "ConsStringMap"),
+  ("read_only_space", 0x00f3d): (37, "ThinStringMap"),
+  ("read_only_space", 0x00f65): (35, "SlicedStringMap"),
+  ("read_only_space", 0x00f8d): (43, "SlicedOneByteStringMap"),
+  ("read_only_space", 0x00fb5): (34, "ExternalStringMap"),
+  ("read_only_space", 0x00fdd): (42, "ExternalOneByteStringMap"),
+  ("read_only_space", 0x01005): (50, "UncachedExternalStringMap"),
+  ("read_only_space", 0x0102d): (0, "InternalizedStringMap"),
+  ("read_only_space", 0x01055): (2, "ExternalInternalizedStringMap"),
+  ("read_only_space", 0x0107d): (10, "ExternalOneByteInternalizedStringMap"),
+  ("read_only_space", 0x010a5): (18, "UncachedExternalInternalizedStringMap"),
+  ("read_only_space", 0x010cd): (26, "UncachedExternalOneByteInternalizedStringMap"),
+  ("read_only_space", 0x010f5): (58, "UncachedExternalOneByteStringMap"),
+  ("read_only_space", 0x0111d): (67, "SelfReferenceMarkerMap"),
+  ("read_only_space", 0x01145): (67, "BasicBlockCountersMarkerMap"),
   ("read_only_space", 0x01179): (95, "EnumCacheMap"),
   ("read_only_space", 0x011c9): (86, "ArrayBoilerplateDescriptionMap"),
-  ("read_only_space", 0x012c5): (98, "InterceptorInfoMap"),
-  ("read_only_space", 0x032e5): (71, "PromiseFulfillReactionJobTaskMap"),
-  ("read_only_space", 0x0330d): (72, "PromiseRejectReactionJobTaskMap"),
-  ("read_only_space", 0x03335): (73, "CallableTaskMap"),
-  ("read_only_space", 0x0335d): (74, "CallbackTaskMap"),
-  ("read_only_space", 0x03385): (75, "PromiseResolveThenableJobTaskMap"),
-  ("read_only_space", 0x033ad): (78, "FunctionTemplateInfoMap"),
-  ("read_only_space", 0x033d5): (79, "ObjectTemplateInfoMap"),
-  ("read_only_space", 0x033fd): (80, "AccessCheckInfoMap"),
-  ("read_only_space", 0x03425): (81, "AccessorInfoMap"),
-  ("read_only_space", 0x0344d): (82, "AccessorPairMap"),
-  ("read_only_space", 0x03475): (83, "AliasedArgumentsEntryMap"),
-  ("read_only_space", 0x0349d): (84, "AllocationMementoMap"),
-  ("read_only_space", 0x034c5): (87, "AsmWasmDataMap"),
-  ("read_only_space", 0x034ed): (88, "AsyncGeneratorRequestMap"),
-  ("read_only_space", 0x03515): (89, "BreakPointMap"),
-  ("read_only_space", 0x0353d): (90, "BreakPointInfoMap"),
-  ("read_only_space", 0x03565): (91, "CachedTemplateObjectMap"),
-  ("read_only_space", 0x0358d): (93, "ClassPositionsMap"),
-  ("read_only_space", 0x035b5): (94, "DebugInfoMap"),
-  ("read_only_space", 0x035dd): (97, "FunctionTemplateRareDataMap"),
-  ("read_only_space", 0x03605): (99, "InterpreterDataMap"),
-  ("read_only_space", 0x0362d): (100, "PromiseCapabilityMap"),
-  ("read_only_space", 0x03655): (101, "PromiseReactionMap"),
-  ("read_only_space", 0x0367d): (102, "PropertyDescriptorObjectMap"),
-  ("read_only_space", 0x036a5): (103, "PrototypeInfoMap"),
-  ("read_only_space", 0x036cd): (104, "ScriptMap"),
-  ("read_only_space", 0x036f5): (105, "SourceTextModuleInfoEntryMap"),
-  ("read_only_space", 0x0371d): (106, "StackFrameInfoMap"),
-  ("read_only_space", 0x03745): (107, "StackTraceFrameMap"),
-  ("read_only_space", 0x0376d): (108, "TemplateObjectDescriptionMap"),
-  ("read_only_space", 0x03795): (109, "Tuple2Map"),
-  ("read_only_space", 0x037bd): (110, "WasmCapiFunctionDataMap"),
-  ("read_only_space", 0x037e5): (111, "WasmDebugInfoMap"),
-  ("read_only_space", 0x0380d): (112, "WasmExceptionTagMap"),
-  ("read_only_space", 0x03835): (113, "WasmExportedFunctionDataMap"),
-  ("read_only_space", 0x0385d): (114, "WasmIndirectFunctionTableMap"),
-  ("read_only_space", 0x03885): (115, "WasmJSFunctionDataMap"),
-  ("read_only_space", 0x038ad): (134, "InternalClassWithSmiElementsMap"),
-  ("read_only_space", 0x038d5): (165, "InternalClassWithStructElementsMap"),
-  ("read_only_space", 0x038fd): (164, "InternalClassMap"),
-  ("read_only_space", 0x03925): (172, "SmiPairMap"),
-  ("read_only_space", 0x0394d): (171, "SmiBoxMap"),
-  ("read_only_space", 0x03975): (68, "ExportedSubClassBaseMap"),
-  ("read_only_space", 0x0399d): (69, "ExportedSubClassMap"),
-  ("read_only_space", 0x039c5): (173, "SortStateMap"),
-  ("read_only_space", 0x039ed): (85, "AllocationSiteWithWeakNextMap"),
-  ("read_only_space", 0x03a15): (85, "AllocationSiteWithoutWeakNextMap"),
-  ("read_only_space", 0x03a3d): (76, "LoadHandler1Map"),
-  ("read_only_space", 0x03a65): (76, "LoadHandler2Map"),
-  ("read_only_space", 0x03a8d): (76, "LoadHandler3Map"),
-  ("read_only_space", 0x03ab5): (77, "StoreHandler0Map"),
-  ("read_only_space", 0x03add): (77, "StoreHandler1Map"),
-  ("read_only_space", 0x03b05): (77, "StoreHandler2Map"),
-  ("read_only_space", 0x03b2d): (77, "StoreHandler3Map"),
+  ("read_only_space", 0x012b5): (98, "InterceptorInfoMap"),
+  ("read_only_space", 0x03369): (71, "PromiseFulfillReactionJobTaskMap"),
+  ("read_only_space", 0x03391): (72, "PromiseRejectReactionJobTaskMap"),
+  ("read_only_space", 0x033b9): (73, "CallableTaskMap"),
+  ("read_only_space", 0x033e1): (74, "CallbackTaskMap"),
+  ("read_only_space", 0x03409): (75, "PromiseResolveThenableJobTaskMap"),
+  ("read_only_space", 0x03431): (78, "FunctionTemplateInfoMap"),
+  ("read_only_space", 0x03459): (79, "ObjectTemplateInfoMap"),
+  ("read_only_space", 0x03481): (80, "AccessCheckInfoMap"),
+  ("read_only_space", 0x034a9): (81, "AccessorInfoMap"),
+  ("read_only_space", 0x034d1): (82, "AccessorPairMap"),
+  ("read_only_space", 0x034f9): (83, "AliasedArgumentsEntryMap"),
+  ("read_only_space", 0x03521): (84, "AllocationMementoMap"),
+  ("read_only_space", 0x03549): (87, "AsmWasmDataMap"),
+  ("read_only_space", 0x03571): (88, "AsyncGeneratorRequestMap"),
+  ("read_only_space", 0x03599): (89, "BreakPointMap"),
+  ("read_only_space", 0x035c1): (90, "BreakPointInfoMap"),
+  ("read_only_space", 0x035e9): (91, "CachedTemplateObjectMap"),
+  ("read_only_space", 0x03611): (93, "ClassPositionsMap"),
+  ("read_only_space", 0x03639): (94, "DebugInfoMap"),
+  ("read_only_space", 0x03661): (97, "FunctionTemplateRareDataMap"),
+  ("read_only_space", 0x03689): (99, "InterpreterDataMap"),
+  ("read_only_space", 0x036b1): (100, "PromiseCapabilityMap"),
+  ("read_only_space", 0x036d9): (101, "PromiseReactionMap"),
+  ("read_only_space", 0x03701): (102, "PropertyDescriptorObjectMap"),
+  ("read_only_space", 0x03729): (103, "PrototypeInfoMap"),
+  ("read_only_space", 0x03751): (104, "ScriptMap"),
+  ("read_only_space", 0x03779): (105, "SourceTextModuleInfoEntryMap"),
+  ("read_only_space", 0x037a1): (106, "StackFrameInfoMap"),
+  ("read_only_space", 0x037c9): (107, "StackTraceFrameMap"),
+  ("read_only_space", 0x037f1): (108, "TemplateObjectDescriptionMap"),
+  ("read_only_space", 0x03819): (109, "Tuple2Map"),
+  ("read_only_space", 0x03841): (110, "WasmCapiFunctionDataMap"),
+  ("read_only_space", 0x03869): (111, "WasmDebugInfoMap"),
+  ("read_only_space", 0x03891): (112, "WasmExceptionTagMap"),
+  ("read_only_space", 0x038b9): (113, "WasmExportedFunctionDataMap"),
+  ("read_only_space", 0x038e1): (114, "WasmIndirectFunctionTableMap"),
+  ("read_only_space", 0x03909): (115, "WasmJSFunctionDataMap"),
+  ("read_only_space", 0x03931): (116, "WasmValueMap"),
+  ("read_only_space", 0x03959): (136, "SloppyArgumentsElementsMap"),
+  ("read_only_space", 0x03981): (171, "OnHeapBasicBlockProfilerDataMap"),
+  ("read_only_space", 0x039a9): (168, "InternalClassMap"),
+  ("read_only_space", 0x039d1): (177, "SmiPairMap"),
+  ("read_only_space", 0x039f9): (176, "SmiBoxMap"),
+  ("read_only_space", 0x03a21): (150, "ExportedSubClassBaseMap"),
+  ("read_only_space", 0x03a49): (151, "ExportedSubClassMap"),
+  ("read_only_space", 0x03a71): (68, "AbstractInternalClassSubclass1Map"),
+  ("read_only_space", 0x03a99): (69, "AbstractInternalClassSubclass2Map"),
+  ("read_only_space", 0x03ac1): (135, "InternalClassWithSmiElementsMap"),
+  ("read_only_space", 0x03ae9): (169, "InternalClassWithStructElementsMap"),
+  ("read_only_space", 0x03b11): (178, "SortStateMap"),
+  ("read_only_space", 0x03b39): (85, "AllocationSiteWithWeakNextMap"),
+  ("read_only_space", 0x03b61): (85, "AllocationSiteWithoutWeakNextMap"),
+  ("read_only_space", 0x03b89): (76, "LoadHandler1Map"),
+  ("read_only_space", 0x03bb1): (76, "LoadHandler2Map"),
+  ("read_only_space", 0x03bd9): (76, "LoadHandler3Map"),
+  ("read_only_space", 0x03c01): (77, "StoreHandler0Map"),
+  ("read_only_space", 0x03c29): (77, "StoreHandler1Map"),
+  ("read_only_space", 0x03c51): (77, "StoreHandler2Map"),
+  ("read_only_space", 0x03c79): (77, "StoreHandler3Map"),
   ("map_space", 0x00121): (1057, "ExternalMap"),
-  ("map_space", 0x00149): (1073, "JSMessageObjectMap"),
+  ("map_space", 0x00149): (1072, "JSMessageObjectMap"),
 }
 
 # List of known V8 objects.
@@ -373,26 +384,26 @@
   ("read_only_space", 0x011b1): "EmptyObjectBoilerplateDescription",
   ("read_only_space", 0x011bd): "EmptyArrayBoilerplateDescription",
   ("read_only_space", 0x011f1): "EmptyClosureFeedbackCellArray",
-  ("read_only_space", 0x011f9): "EmptySloppyArgumentsElements",
-  ("read_only_space", 0x01209): "EmptySlowElementDictionary",
-  ("read_only_space", 0x0122d): "EmptyOrderedHashMap",
-  ("read_only_space", 0x01241): "EmptyOrderedHashSet",
-  ("read_only_space", 0x01255): "EmptyFeedbackMetadata",
-  ("read_only_space", 0x01261): "EmptyPropertyCell",
-  ("read_only_space", 0x01275): "EmptyPropertyDictionary",
-  ("read_only_space", 0x0129d): "NoOpInterceptorInfo",
-  ("read_only_space", 0x012ed): "EmptyWeakArrayList",
-  ("read_only_space", 0x012f9): "InfinityValue",
-  ("read_only_space", 0x01305): "MinusZeroValue",
-  ("read_only_space", 0x01311): "MinusInfinityValue",
-  ("read_only_space", 0x0131d): "SelfReferenceMarker",
-  ("read_only_space", 0x0135d): "OffHeapTrampolineRelocationInfo",
-  ("read_only_space", 0x01369): "TrampolineTrivialCodeDataContainer",
-  ("read_only_space", 0x01375): "TrampolinePromiseRejectionCodeDataContainer",
-  ("read_only_space", 0x01381): "GlobalThisBindingScopeInfo",
-  ("read_only_space", 0x013b9): "EmptyFunctionScopeInfo",
-  ("read_only_space", 0x013e1): "NativeScopeInfo",
-  ("read_only_space", 0x013fd): "HashSeed",
+  ("read_only_space", 0x011f9): "EmptySlowElementDictionary",
+  ("read_only_space", 0x0121d): "EmptyOrderedHashMap",
+  ("read_only_space", 0x01231): "EmptyOrderedHashSet",
+  ("read_only_space", 0x01245): "EmptyFeedbackMetadata",
+  ("read_only_space", 0x01251): "EmptyPropertyCell",
+  ("read_only_space", 0x01265): "EmptyPropertyDictionary",
+  ("read_only_space", 0x0128d): "NoOpInterceptorInfo",
+  ("read_only_space", 0x012dd): "EmptyWeakArrayList",
+  ("read_only_space", 0x012e9): "InfinityValue",
+  ("read_only_space", 0x012f5): "MinusZeroValue",
+  ("read_only_space", 0x01301): "MinusInfinityValue",
+  ("read_only_space", 0x0130d): "SelfReferenceMarker",
+  ("read_only_space", 0x0134d): "BasicBlockCountersMarker",
+  ("read_only_space", 0x01391): "OffHeapTrampolineRelocationInfo",
+  ("read_only_space", 0x0139d): "TrampolineTrivialCodeDataContainer",
+  ("read_only_space", 0x013a9): "TrampolinePromiseRejectionCodeDataContainer",
+  ("read_only_space", 0x013b5): "GlobalThisBindingScopeInfo",
+  ("read_only_space", 0x013ed): "EmptyFunctionScopeInfo",
+  ("read_only_space", 0x01415): "NativeScopeInfo",
+  ("read_only_space", 0x01431): "HashSeed",
   ("old_space", 0x00121): "ArgumentsIteratorAccessor",
   ("old_space", 0x00165): "ArrayLengthAccessor",
   ("old_space", 0x001a9): "BoundFunctionLengthAccessor",
@@ -414,19 +425,41 @@
   ("old_space", 0x004e1): "ArraySpeciesProtector",
   ("old_space", 0x004f5): "TypedArraySpeciesProtector",
   ("old_space", 0x00509): "PromiseSpeciesProtector",
-  ("old_space", 0x0051d): "StringLengthProtector",
-  ("old_space", 0x00531): "ArrayIteratorProtector",
-  ("old_space", 0x00545): "ArrayBufferDetachingProtector",
-  ("old_space", 0x00559): "PromiseHookProtector",
-  ("old_space", 0x0056d): "PromiseResolveProtector",
-  ("old_space", 0x00581): "MapIteratorProtector",
-  ("old_space", 0x00595): "PromiseThenProtector",
-  ("old_space", 0x005a9): "SetIteratorProtector",
-  ("old_space", 0x005bd): "StringIteratorProtector",
-  ("old_space", 0x005d1): "SingleCharacterStringCache",
-  ("old_space", 0x009d9): "StringSplitCache",
-  ("old_space", 0x00de1): "RegExpMultipleCache",
-  ("old_space", 0x011e9): "BuiltinsConstantsTable",
+  ("old_space", 0x0051d): "RegExpSpeciesProtector",
+  ("old_space", 0x00531): "StringLengthProtector",
+  ("old_space", 0x00545): "ArrayIteratorProtector",
+  ("old_space", 0x00559): "ArrayBufferDetachingProtector",
+  ("old_space", 0x0056d): "PromiseHookProtector",
+  ("old_space", 0x00581): "PromiseResolveProtector",
+  ("old_space", 0x00595): "MapIteratorProtector",
+  ("old_space", 0x005a9): "PromiseThenProtector",
+  ("old_space", 0x005bd): "SetIteratorProtector",
+  ("old_space", 0x005d1): "StringIteratorProtector",
+  ("old_space", 0x005e5): "SingleCharacterStringCache",
+  ("old_space", 0x009ed): "StringSplitCache",
+  ("old_space", 0x00df5): "RegExpMultipleCache",
+  ("old_space", 0x011fd): "BuiltinsConstantsTable",
+  ("old_space", 0x015a1): "AsyncFunctionAwaitRejectSharedFun",
+  ("old_space", 0x015c9): "AsyncFunctionAwaitResolveSharedFun",
+  ("old_space", 0x015f1): "AsyncGeneratorAwaitRejectSharedFun",
+  ("old_space", 0x01619): "AsyncGeneratorAwaitResolveSharedFun",
+  ("old_space", 0x01641): "AsyncGeneratorYieldResolveSharedFun",
+  ("old_space", 0x01669): "AsyncGeneratorReturnResolveSharedFun",
+  ("old_space", 0x01691): "AsyncGeneratorReturnClosedRejectSharedFun",
+  ("old_space", 0x016b9): "AsyncGeneratorReturnClosedResolveSharedFun",
+  ("old_space", 0x016e1): "AsyncIteratorValueUnwrapSharedFun",
+  ("old_space", 0x01709): "PromiseAllResolveElementSharedFun",
+  ("old_space", 0x01731): "PromiseAllSettledResolveElementSharedFun",
+  ("old_space", 0x01759): "PromiseAllSettledRejectElementSharedFun",
+  ("old_space", 0x01781): "PromiseAnyRejectElementSharedFun",
+  ("old_space", 0x017a9): "PromiseCapabilityDefaultRejectSharedFun",
+  ("old_space", 0x017d1): "PromiseCapabilityDefaultResolveSharedFun",
+  ("old_space", 0x017f9): "PromiseCatchFinallySharedFun",
+  ("old_space", 0x01821): "PromiseGetCapabilitiesExecutorSharedFun",
+  ("old_space", 0x01849): "PromiseThenFinallySharedFun",
+  ("old_space", 0x01871): "PromiseThrowerFinallySharedFun",
+  ("old_space", 0x01899): "PromiseValueThunkFinallySharedFun",
+  ("old_space", 0x018c1): "ProxyRevokeSharedFun",
 }
 
 # Lower 32 bits of first page addresses for various heap spaces.
@@ -442,10 +475,9 @@
   "CONSTRUCT_ENTRY",
   "EXIT",
   "OPTIMIZED",
-  "WASM_COMPILED",
+  "WASM",
   "WASM_TO_JS",
   "JS_TO_WASM",
-  "WASM_INTERPRETER_ENTRY",
   "WASM_DEBUG_BREAK",
   "C_WASM_ENTRY",
   "WASM_EXIT",
diff --git a/deps/v8/tools/wasm/update-wasm-spec-tests.sh b/deps/v8/tools/wasm/update-wasm-spec-tests.sh
index 0b8eb6790d8..8a63f94368e 100755
--- a/deps/v8/tools/wasm/update-wasm-spec-tests.sh
+++ b/deps/v8/tools/wasm/update-wasm-spec-tests.sh
@@ -71,7 +71,7 @@ log_and_run cp -r ${TMP_DIR}/spec/test/js-api/* ${JS_API_TEST_DIR}/tests
 # Generate the proposal tests.
 ###############################################################################
 
-repos='bulk-memory-operations reference-types js-types JS-BigInt-integration multi-value'
+repos='bulk-memory-operations reference-types js-types JS-BigInt-integration'
 
 for repo in ${repos}; do
   echo "Process ${repo}"
@@ -95,7 +95,10 @@ for repo in ${repos}; do
       log_and_run ./run.py --wasm ../../interpreter/wasm ${rel_filename} --out _build 2> /dev/null
     fi
   done
-  log_and_run cp _build/*.js ${SPEC_TEST_DIR}/tests/proposals/${repo}/
+
+  if ls _build/*.js > /dev/null; then
+    log_and_run cp _build/*.js ${SPEC_TEST_DIR}/tests/proposals/${repo}/
+  fi
 
   echo ">> Process js-api tests"
   log_and_run mkdir ${JS_API_TEST_DIR}/tests/proposals/${repo}
diff --git a/deps/v8/tools/whitespace.txt b/deps/v8/tools/whitespace.txt
index 482c695b656..e246f93f14d 100644
--- a/deps/v8/tools/whitespace.txt
+++ b/deps/v8/tools/whitespace.txt
@@ -7,10 +7,10 @@ A Smi balks into a war and says:
 The doubles heard this and started to unbox.
 The Smi looked at them when a crazy v8-autoroll account showed up...
 The autoroller bought a round of Himbeerbrause. Suddenly.....
-The bartender starts to shake the bottles......................
+The bartender starts to shake the bottles.....................
 I can't add trailing whitespaces, so I'm adding this line.....
 I'm starting to think that just adding trailing whitespaces might not be bad.
 
-Because whitespaces are not that funny......
+Because whitespaces are not that funny.....
 Today's answer to life the universe and everything is 12950!
-Today's answer to life the universe and everything is 6727!
+Today's answer to life the universe and everything is 6728!
diff --git a/tools/icu/icu_versions.json b/tools/icu/icu_versions.json
index a14ea6db288..19a05a679a9 100644
--- a/tools/icu/icu_versions.json
+++ b/tools/icu/icu_versions.json
@@ -1,3 +1,3 @@
 {
-    "minimum_icu": 65
+    "minimum_icu": 67
 }
diff --git a/tools/v8_gypfiles/features.gypi b/tools/v8_gypfiles/features.gypi
index b2ff6d4e107..b24e0b332b3 100644
--- a/tools/v8_gypfiles/features.gypi
+++ b/tools/v8_gypfiles/features.gypi
@@ -184,6 +184,15 @@
     # Enable lazy source positions by default.
     'v8_enable_lazy_source_positions%': 1,
 
+    # Enable third party HEAP library
+    'v8_enable_third_party_heap%': 0,
+
+    # Libaries used by third party heap
+    'v8_third_party_heap_libs%': [],
+
+    # Source code used by third party heap
+    'v8_third_party_heap_files%': [],
+
     # Disable write barriers when GCs are non-incremental and
     # heap has single generation.
     'v8_disable_write_barriers%': 0,
@@ -203,6 +212,10 @@
     # for ARM64.
     'v8_control_flow_integrity%': 0,
 
+    # Experimental support for native context independent code.
+    # https://crbug.com/v8/8888
+    'v8_enable_nci_code%': 0,
+
     # Variables from v8.gni
 
     # Enable ECMAScript Internationalization API. Enabling this feature will
@@ -228,10 +241,7 @@
         'defines': ['V8_ENABLE_FUTURE',],
       }],
       ['v8_enable_lite_mode==1', {
-        'defines': [
-          'V8_LITE_MODE',
-          'V8_JITLESS_MODE',
-        ],
+        'defines': ['V8_LITE_MODE',],
       }],
       ['v8_enable_gdbjit==1', {
         'defines': ['ENABLE_GDB_JIT_INTERFACE',],
@@ -299,6 +309,9 @@
       ['v8_disable_write_barriers==1', {
         'defines': ['V8_DISABLE_WRITE_BARRIERS',],
       }],
+      ['v8_enable_third_party_heap==1', {
+        'defines': ['V8_ENABLE_THIRD_PARTY_HEAP',],
+      }],
       ['v8_enable_concurrent_marking==1', {
         'defines': ['V8_CONCURRENT_MARKING',],
       }],
@@ -338,9 +351,11 @@
       ['v8_control_flow_integrity==1', {
         'defines': ['V8_ENABLE_CONTROL_FLOW_INTEGRITY',],
       }],
+      ['v8_enable_nci_code==1', {
+        'defines': ['V8_ENABLE_NCI_CODE',],
+      }],
     ],  # conditions
     'defines': [
-      'V8_EMBEDDED_BUILTINS',
       'V8_GYP_BUILD',
       'V8_TYPED_ARRAY_MAX_SIZE_IN_HEAP=<(v8_typed_array_max_size_in_heap)',
     ],  # defines
diff --git a/tools/v8_gypfiles/v8.gyp b/tools/v8_gypfiles/v8.gyp
index 347847b63cf..e9e5567dcc6 100644
--- a/tools/v8_gypfiles/v8.gyp
+++ b/tools/v8_gypfiles/v8.gyp
@@ -13,6 +13,7 @@
     'generate_bytecode_output_root': '<(SHARED_INTERMEDIATE_DIR)/generate-bytecode-output-root',
     'generate_bytecode_builtins_list_output': '<(generate_bytecode_output_root)/builtins-generated/bytecodes-builtins-list.h',
     'torque_files': [
+      "<(V8_ROOT)/src/builtins/aggregate-error.tq",
       "<(V8_ROOT)/src/builtins/array-copywithin.tq",
       "<(V8_ROOT)/src/builtins/array-every.tq",
       "<(V8_ROOT)/src/builtins/array-filter.tq",
@@ -38,14 +39,19 @@
       "<(V8_ROOT)/src/builtins/bigint.tq",
       "<(V8_ROOT)/src/builtins/boolean.tq",
       "<(V8_ROOT)/src/builtins/builtins-string.tq",
-      "<(V8_ROOT)/src/builtins/collections.tq",
       "<(V8_ROOT)/src/builtins/cast.tq",
+      "<(V8_ROOT)/src/builtins/collections.tq",
+      "<(V8_ROOT)/src/builtins/conversion.tq",
       "<(V8_ROOT)/src/builtins/convert.tq",
       "<(V8_ROOT)/src/builtins/console.tq",
       "<(V8_ROOT)/src/builtins/data-view.tq",
+      "<(V8_ROOT)/src/builtins/finalization-registry.tq",
       "<(V8_ROOT)/src/builtins/frames.tq",
       "<(V8_ROOT)/src/builtins/frame-arguments.tq",
+      "<(V8_ROOT)/src/builtins/function.tq",
       "<(V8_ROOT)/src/builtins/growable-fixed-array.tq",
+      "<(V8_ROOT)/src/builtins/ic-callable.tq",
+      "<(V8_ROOT)/src/builtins/ic.tq",
       "<(V8_ROOT)/src/builtins/internal-coverage.tq",
       "<(V8_ROOT)/src/builtins/iterator.tq",
       "<(V8_ROOT)/src/builtins/math.tq",
@@ -55,6 +61,7 @@
       "<(V8_ROOT)/src/builtins/promise-abstract-operations.tq",
       "<(V8_ROOT)/src/builtins/promise-all.tq",
       "<(V8_ROOT)/src/builtins/promise-all-element-closure.tq",
+      "<(V8_ROOT)/src/builtins/promise-any.tq",
       "<(V8_ROOT)/src/builtins/promise-constructor.tq",
       "<(V8_ROOT)/src/builtins/promise-finally.tq",
       "<(V8_ROOT)/src/builtins/promise-misc.tq",
@@ -99,11 +106,13 @@
       "<(V8_ROOT)/src/builtins/torque-internal.tq",
       "<(V8_ROOT)/src/builtins/typed-array-createtypedarray.tq",
       "<(V8_ROOT)/src/builtins/typed-array-every.tq",
+      "<(V8_ROOT)/src/builtins/typed-array-entries.tq",
       "<(V8_ROOT)/src/builtins/typed-array-filter.tq",
       "<(V8_ROOT)/src/builtins/typed-array-find.tq",
       "<(V8_ROOT)/src/builtins/typed-array-findindex.tq",
       "<(V8_ROOT)/src/builtins/typed-array-foreach.tq",
       "<(V8_ROOT)/src/builtins/typed-array-from.tq",
+      "<(V8_ROOT)/src/builtins/typed-array-keys.tq",
       "<(V8_ROOT)/src/builtins/typed-array-of.tq",
       "<(V8_ROOT)/src/builtins/typed-array-reduce.tq",
       "<(V8_ROOT)/src/builtins/typed-array-reduceright.tq",
@@ -112,7 +121,9 @@
       "<(V8_ROOT)/src/builtins/typed-array-some.tq",
       "<(V8_ROOT)/src/builtins/typed-array-sort.tq",
       "<(V8_ROOT)/src/builtins/typed-array-subarray.tq",
+      "<(V8_ROOT)/src/builtins/typed-array-values.tq",
       "<(V8_ROOT)/src/builtins/typed-array.tq",
+      "<(V8_ROOT)/src/builtins/wasm.tq",
       "<(V8_ROOT)/src/ic/handler-configuration.tq",
       "<(V8_ROOT)/src/objects/allocation-site.tq",
       "<(V8_ROOT)/src/objects/api-callbacks.tq",
@@ -228,7 +239,7 @@
             '<(torque_output_root)/torque-generated/class-verifiers-tq.h',
             '<(torque_output_root)/torque-generated/enum-verifiers-tq.cc',
             '<(torque_output_root)/torque-generated/objects-printer-tq.cc',
-            '<(torque_output_root)/torque-generated/objects-body-descriptors-tq-inl.h',
+            '<(torque_output_root)/torque-generated/objects-body-descriptors-tq-inl.inc',
             '<(torque_output_root)/torque-generated/class-definitions-tq.cc',
             '<(torque_output_root)/torque-generated/class-definitions-tq-inl.h',
             '<(torque_output_root)/torque-generated/class-definitions-tq.h',
@@ -745,6 +756,13 @@
         '<@(inspector_all_sources)',
       ],
       'conditions': [
+        ['v8_enable_third_party_heap==1', {
+          # TODO(targos): add values from v8_third_party_heap_files to sources
+        }, {
+          'sources': [
+            '<(V8_ROOT)/src/heap/third-party/heap-api-stub.cc',
+          ],
+        }],
         ['want_separate_host_toolset', {
           'toolsets': ['host', 'target'],
         }],
@@ -877,6 +895,9 @@
         ['v8_postmortem_support', {
           'dependencies': ['postmortem-metadata#target'],
         }],
+        ['v8_enable_third_party_heap', {
+          # TODO(targos): add values from v8_third_party_heap_libs to link_settings.libraries
+        }],
         # Platforms that don't have Compare-And-Swap (CAS) support need to link atomic library
         # to implement atomic memory access
         ['v8_current_cpu in ["mips", "mipsel", "mips64", "mips64el", "ppc", "arm"]', {
@@ -1218,6 +1239,8 @@
         '<(V8_ROOT)/include/libplatform/v8-tracing.h',
         '<(V8_ROOT)/src/libplatform/default-foreground-task-runner.cc',
         '<(V8_ROOT)/src/libplatform/default-foreground-task-runner.h',
+        '<(V8_ROOT)/src/libplatform/default-job.cc',
+        '<(V8_ROOT)/src/libplatform/default-job.h',
         '<(V8_ROOT)/src/libplatform/default-platform.cc',
         '<(V8_ROOT)/src/libplatform/default-platform.h',
         '<(V8_ROOT)/src/libplatform/default-worker-threads-task-runner.cc',